@stim-cli/core 1.13.0 → 1.15.0

package/README.md

@@ -35,4 +35,19 @@ registry and its JSON Schema, the created-device and EAS session ledger readers,
 NDJSON log records and queries, and the status and settings payload types. The
 CLI owns every write to that state. The cache packages do not import it.
 
+`@stim-cli/core/oversight` holds the pure notification and needs-attention rules
+shared by stim-server and the phone. It imports no Node APIs; mobile consumers
+import this subpath without loading the Node-only root or state entry points.
+Build core before typechecking, testing or bundling the phone app.
+
 The npm scope remains `@stim-cli` until the `@stim` scope is available.
+
+`@stim-cli/core/protocol` defines the server's wire contracts. The
+`phone-protocol` entry derives the phone's receiving types, including optional
+fields from older servers. `receive-protocol` contains precompiled validators
+for method results, known events and errors, with no Node or schema compiler
+dependency in the phone runtime. Unknown compatible fields remain accepted.
+Display enums accept open strings, and unknown values show neutral information or are skipped when unsupported.
+
+After changing these contracts, run `pnpm run rpc:generate` at the repository
+root; `pnpm run rpc:check` verifies the committed validators in CI.

package/dist/{core-CmZJEFj_.mjs → core-BwaxUjLX.mjs}

@@ -1,8 +1,9 @@
 import { S as quotedPath, _ as releaseClaim, r as ClaimRefusedError, x as tryAcquireClaim } from "./ownership-claim-O31Y5iIb.mjs";
-import fs, { existsSync, lstatSync, mkdirSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
+import fs, { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path, { basename, dirname, join } from "node:path";
-import { createHash } from "node:crypto";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { connect, createServer, isIP } from "node:net";
 //#region dir-lock.ts
 const DEFAULT_LOCK_WAIT_MS = 12e3;
 const DEFAULT_LOCK_POLL_MS = 25;
@@ -150,6 +151,12 @@ function withDirLock(lockPath, fn, { waitMs = DEFAULT_LOCK_WAIT_MS, pollMs = DEF
 	}
 }
 //#endregion
+//#region macos-resources.ts
+/** Whether a resource destination is a contained, non-empty path under Contents/Resources. */
+function validMacosResourceDestination(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= 1024 && !value.includes("\0") && !value.includes("\\") && !/^[A-Za-z]:/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
+}
+//#endregion
 //#region artifact-store.ts
 function artifactIn(dir) {
 	if (!existsSync(dir)) return null;
@@ -247,6 +254,122 @@ function storeArtifact(dest, buildPath, { runFile, overwrite = false, writeMetad
 	return artifactIn(dest);
 }
 //#endregion
+//#region compiled-helper.ts
+/**
+* Returns `<dir>/<name>-<hash>`, compiling it with `compile` first when it is missing. The hash covers `version` and
+* each input's name and bytes, so a changed source or compiler builds a new helper beside the old one. `compile`
+* writes to a private temporary path that is renamed into place, so concurrent builders never expose a partial file.
+*/
+async function compiledHelper({ dir, name, inputs, version, compile }) {
+	const hash = createHash("sha256").update(version);
+	for (const input of inputs) hash.update(basename(input)).update(readFileSync(input));
+	const helper = join(dir, `${name}-${hash.digest("hex").slice(0, 16)}`);
+	if (existsSync(helper)) return helper;
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	const output = `${helper}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
+	try {
+		await compile(output);
+		renameSync(output, helper);
+	} finally {
+		rmSync(output, { force: true });
+	}
+	return helper;
+}
+//#endregion
+//#region metro-bridge.ts
+function port(value) {
+	if (!Number.isInteger(value) || value < 1 || value > 65535) throw new Error("Invalid Metro bridge port.");
+}
+function credential(secret) {
+	if (!/^[a-f0-9]{64}$/.test(secret)) throw new Error("A Metro bridge needs a 256-bit secret.");
+	return Buffer.from(`${secret}\n`, "ascii");
+}
+function trackedServer(accept) {
+	const sockets = /* @__PURE__ */ new Set();
+	let closing;
+	const track = (socket) => {
+		sockets.add(socket);
+		socket.once("close", () => sockets.delete(socket));
+		socket.on("error", () => socket.destroy());
+	};
+	const server = createServer((socket) => {
+		if (closing || sockets.size >= 128) return void socket.destroy();
+		track(socket);
+		accept(socket, track);
+	});
+	return {
+		server,
+		close: () => {
+			closing ??= new Promise((resolve, reject) => {
+				for (const socket of sockets) socket.destroy();
+				if (!server.listening) return resolve();
+				server.close((error) => error ? reject(error) : resolve());
+			});
+			return closing;
+		}
+	};
+}
+function forward(source, target) {
+	source.once("close", () => target.destroy());
+	target.once("close", () => source.destroy());
+	source.pipe(target).pipe(source);
+}
+/** Bind this gateway only to the client's own Tailscale address; `peer` is the pinned worker's literal address. */
+function createMetroGateway({ metroPort, peer, secret }) {
+	port(metroPort);
+	if (!isIP(peer)) throw new Error("The Metro gateway requires a pinned peer address.");
+	const expected = credential(secret);
+	return trackedServer((socket, track) => {
+		if (socket.remoteAddress?.replace(/^::ffff:/, "") !== peer) return void socket.destroy();
+		const deadline = setTimeout(() => socket.destroy(), 5e3);
+		socket.once("close", () => clearTimeout(deadline));
+		let prefix = Buffer.alloc(0);
+		const authenticate = (chunk) => {
+			const needed = expected.length - prefix.length;
+			prefix = Buffer.concat([prefix, chunk.subarray(0, needed)]);
+			if (prefix.length < expected.length) return;
+			socket.removeListener("data", authenticate);
+			socket.pause();
+			if (!timingSafeEqual(prefix, expected)) return void socket.destroy();
+			clearTimeout(deadline);
+			const upstream = connect({
+				host: "127.0.0.1",
+				port: metroPort
+			});
+			track(upstream);
+			if (chunk.length > needed) socket.unshift(chunk.subarray(needed));
+			forward(socket, upstream);
+		};
+		socket.on("data", authenticate);
+	});
+}
+/** Bind this endpoint only to worker loopback; `peer` comes from the approved client's authenticated connection. */
+function createMetroBridge({ gatewayPort, peer, secret }) {
+	port(gatewayPort);
+	if (!isIP(peer)) throw new Error("The Metro bridge requires an authenticated peer address.");
+	const prefix = credential(secret);
+	return trackedServer((socket, track) => {
+		socket.pause();
+		const upstream = connect({
+			host: peer,
+			port: gatewayPort,
+			timeout: 5e3
+		});
+		track(upstream);
+		upstream.once("timeout", () => upstream.destroy());
+		upstream.once("close", () => socket.destroy());
+		upstream.once("connect", () => {
+			upstream.setTimeout(0);
+			upstream.write(prefix);
+			forward(socket, upstream);
+		});
+		socket.once("close", () => upstream.destroy());
+	});
+}
+//#endregion
 //#region index.ts
 const warnedRelative = /* @__PURE__ */ new Set();
 function absoluteEnvPath(name) {
@@ -353,14 +476,19 @@ function buildTarget(options) {
 	if (SIMULATOR_UDID.test(name) || EMULATOR_SERIAL.test(name)) return "sim";
 	return `on-${slug(name)}`;
 }
+/** The simulator slice a local build compiles for this machine: `arm64` or `x86_64`. */
+function hostSimulatorArch(arch = process.arch) {
+	return arch === "x64" ? "x86_64" : "arm64";
+}
 function buildCacheKey(platform, fingerprintHash, options = {}) {
 	const opts = options && typeof options === "object" ? options : {};
-	const abi = platform === "android" && typeof opts.abi === "string" ? slug(opts.abi) : "";
+	const target = buildTarget(opts);
+	const abi = platform === "android" && typeof opts.abi === "string" ? slug(opts.abi) : platform === "ios" && target === "sim" && typeof opts.arch === "string" ? slug(opts.arch) : "";
 	const allArch = platform === "android" && opts.allArch === true ? "-all-arch" : "";
 	const compiler = typeof opts.compiler === "string" ? slug(opts.compiler) : "";
 	const profile = typeof opts.buildProfile === "string" ? slug(opts.buildProfile) : "";
 	const scheme = platform === "ios" && typeof opts.scheme === "string" && opts.scheme ? createHash("sha256").update(opts.scheme).digest("hex") : "";
-	return `${fingerprintHash}-${buildVariant(platform, opts)}-${buildTarget(opts)}${abi ? `-${abi}` : ""}${allArch}${compiler ? `-${compiler}` : ""}${profile ? `-${profile}` : ""}${scheme ? `-scheme-${scheme}` : ""}`;
+	return `${fingerprintHash}-${buildVariant(platform, opts)}-${target}${abi ? `-${abi}` : ""}${allArch}${compiler ? `-${compiler}` : ""}${profile ? `-${profile}` : ""}${scheme ? `-scheme-${scheme}` : ""}`;
 }
 const METRO_NAMED_CACHE_LAYOUT = "metro-named-v1";
 function cacheManifestLockPath(file) {
@@ -426,4 +554,4 @@ function matchesCache(cache, match) {
 	return match.layout === void 0 || cache.layout === match.layout;
 }
 //#endregion
-export { artifactIn as C, withDirLock as E, workspaceStateDir as S, storeArtifact as T, updateCacheManifest as _, buildCacheRoot as a, workspaceName as b, cachePathSetting as c, readCacheManifest as d, registerCache as f, tagSharedStore as g, sharedStoreRoot as h, buildCacheKey as i, configDir as l, rotatedLogPath as m, METRO_NAMED_CACHE_LAYOUT as n, cacheManifestLockPath as o, rotateLog as p, STORE_ROOT_TAG as r, cacheNameSegment as s, LOG_ROTATE_BYTES as t, metroCacheRoot as u, workspaceId as v, resolveArtifact as w, workspaceSlug as x, workspaceLogDir as y };
+export { validMacosResourceDestination as A, workspaceStateDir as C, artifactIn as D, compiledHelper as E, resolveArtifact as O, workspaceSlug as S, createMetroGateway as T, tagSharedStore as _, buildCacheRoot as a, workspaceLogDir as b, cachePathSetting as c, metroCacheRoot as d, readCacheManifest as f, sharedStoreRoot as g, rotatedLogPath as h, buildCacheKey as i, withDirLock as j, storeArtifact as k, configDir as l, rotateLog as m, METRO_NAMED_CACHE_LAYOUT as n, cacheManifestLockPath as o, registerCache as p, STORE_ROOT_TAG as r, cacheNameSegment as s, LOG_ROTATE_BYTES as t, hostSimulatorArch as u, updateCacheManifest as v, createMetroBridge as w, workspaceName as x, workspaceId as y };