@stim-cli/core 1.20.2 → 1.22.0

package/README.md

@@ -42,6 +42,8 @@ strict parser and reader.
 shared by stim-server and the phone. It imports no Node APIs; mobile consumers
 import this subpath without loading the Node-only root or state entry points.
 Build core before typechecking, testing or bundling the phone app.
+Its `wakeAt` includes physical-device lease expiry and unattended EAS-session age;
+callers retain their clock and quiet-hours reevaluation.
 
 The npm scope remains `@stim-cli` until the `@stim` scope is available.
 

package/dist/{core-BkgfKqJ8.mjs → core-BTsCO1nW.mjs}

@@ -1,9 +1,11 @@
-import { S as quotedPath, _ as releaseClaim, r as ClaimRefusedError, x as tryAcquireClaim } from "./ownership-claim-O31Y5iIb.mjs";
+import { C as quotedPath, S as tryAcquireClaim, _ as releaseClaim, r as ClaimRefusedError, x as sleepSync } from "./ownership-claim-DHUs_Dir.mjs";
 import fs, { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
 import os from "node:os";
-import path, { basename, dirname, join } from "node:path";
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import path, { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { mkdir, rm } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 import { connect, createServer, isIP } from "node:net";
 //#region dir-lock.ts
@@ -11,9 +13,6 @@ const DEFAULT_LOCK_WAIT_MS = 12e3;
 const DEFAULT_LOCK_POLL_MS = 25;
 const lockDepths = /* @__PURE__ */ new Map();
 const OWNER_MARKER = /^\.stim-claim-[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/;
-function sleepSync(ms) {
-	Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
 /**
 * Whether Windows refused a call on the lock directory because another process is removing it at that
 * moment. NTFS answers ERROR_ACCESS_DENIED, which Node reports as EPERM, until that removal completes,
@@ -90,57 +89,42 @@ function takeLockDirectory(lockPath, claim) {
 	}
 	return marker;
 }
-function acquireDirLock(lockPath, { waitMs, pollMs, ensureParent }) {
+function prepareDirLock(lockPath, ensureParent) {
 	ensureParent?.();
 	statSync(dirname(lockPath));
-	const deadline = Date.now() + waitMs;
-	let claim;
-	try {
-		for (;;) {
-			if (!claim) {
-				const attempt = tryAcquireClaim({
-					root: `${lockPath}.claims`,
-					mode: "exclusive",
-					label: "directory lock"
-				});
-				claim = attempt.acquired;
-				if (attempt.pending) releaseClaim(attempt.pending);
-			}
-			if (claim) {
-				const marker = takeLockDirectory(lockPath, claim);
-				if (marker) return {
-					claim,
-					marker
-				};
-			}
-			if (Date.now() >= deadline) {
-				const error = /* @__PURE__ */ new Error(`Timed out waiting for the lock at ${lockPath}. ` + (claim ? `No current Stim holds it: the directory is empty, or an older Stim version holds or left it. If no older Stim is running, remove it and run the command again:\n  rm -rf ${quotedPath(lockPath)}` : "Another Stim process is holding it; wait for that command to finish and run the command again."));
-				error.code = "STIM_LOCK_TIMEOUT";
-				error.lockPath = lockPath;
-				throw error;
-			}
-			sleepSync(pollMs);
-		}
-	} catch (error) {
-		releaseClaim(claim);
-		throw error;
+}
+function attemptDirLock(lockPath, pending) {
+	if (!pending.claim) {
+		const attempt = tryAcquireClaim({
+			root: `${lockPath}.claims`,
+			mode: "exclusive",
+			label: "directory lock"
+		});
+		pending.claim = attempt.acquired;
+		if (attempt.pending) releaseClaim(attempt.pending);
 	}
+	if (!pending.claim) return null;
+	const marker = takeLockDirectory(lockPath, pending.claim);
+	return marker ? {
+		claim: pending.claim,
+		marker
+	} : null;
 }
-function withDirLock(lockPath, fn, { waitMs = DEFAULT_LOCK_WAIT_MS, pollMs = DEFAULT_LOCK_POLL_MS, ensureParent } = {}) {
-	const depth = lockDepths.get(lockPath) || 0;
-	if (depth > 0) {
-		lockDepths.set(lockPath, depth + 1);
-		try {
-			return fn();
-		} finally {
-			lockDepths.set(lockPath, (lockDepths.get(lockPath) ?? 1) - 1);
-		}
+function dirLockTimeout(lockPath, claim) {
+	const error = /* @__PURE__ */ new Error(`Timed out waiting for the lock at ${lockPath}. ` + (claim ? `No current Stim holds it: the directory is empty, or an older Stim version holds or left it. If no older Stim is running, remove it and run the command again:\n  rm -rf ${quotedPath(lockPath)}` : "Another Stim process is holding it; wait for that command to finish and run the command again."));
+	error.code = "STIM_LOCK_TIMEOUT";
+	error.lockPath = lockPath;
+	return error;
+}
+function nestedDirLock(lockPath, fn) {
+	lockDepths.set(lockPath, (lockDepths.get(lockPath) ?? 0) + 1);
+	try {
+		return fn();
+	} finally {
+		lockDepths.set(lockPath, (lockDepths.get(lockPath) ?? 1) - 1);
 	}
-	const { claim, marker } = acquireDirLock(lockPath, {
-		waitMs,
-		pollMs,
-		ensureParent
-	});
+}
+function holdDirLock(lockPath, { claim, marker }, fn) {
 	lockDepths.set(lockPath, 1);
 	try {
 		return fn();
@@ -152,6 +136,73 @@ function withDirLock(lockPath, fn, { waitMs = DEFAULT_LOCK_WAIT_MS, pollMs = DEF
 		releaseClaim(claim);
 	}
 }
+function withDirLock(lockPath, fn, { waitMs = DEFAULT_LOCK_WAIT_MS, pollMs = DEFAULT_LOCK_POLL_MS, ensureParent } = {}) {
+	if ((lockDepths.get(lockPath) || 0) > 0) return nestedDirLock(lockPath, fn);
+	prepareDirLock(lockPath, ensureParent);
+	const deadline = Date.now() + waitMs;
+	const pending = {};
+	let held;
+	try {
+		while (!(held = attemptDirLock(lockPath, pending))) {
+			if (Date.now() >= deadline) throw dirLockTimeout(lockPath, pending.claim);
+			sleepSync(pollMs);
+		}
+	} catch (error) {
+		releaseClaim(pending.claim);
+		throw error;
+	}
+	return holdDirLock(lockPath, held, fn);
+}
+/**
+* `withDirLock` that waits for a contended lock on a timer instead of blocking the thread. `fn` still runs
+* synchronously: nothing awaits between taking the lock, running `fn` and releasing the lock, so the held
+* transaction and reentrant nesting behave exactly as with `withDirLock`.
+* An optional signal cancels acquisition; it cannot interrupt the synchronous transaction.
+*/
+async function withDirLockAsync(lockPath, fn, options = {}) {
+	options.signal?.throwIfAborted();
+	if ((lockDepths.get(lockPath) || 0) > 0) return nestedDirLock(lockPath, fn);
+	return acquireDirLockAsync(lockPath, options, (held) => holdDirLock(lockPath, held, () => {
+		options.signal?.throwIfAborted();
+		return fn();
+	}));
+}
+async function acquireDirLockAsync(lockPath, { waitMs = DEFAULT_LOCK_WAIT_MS, pollMs = DEFAULT_LOCK_POLL_MS, ensureParent, signal }, fn) {
+	signal?.throwIfAborted();
+	prepareDirLock(lockPath, ensureParent);
+	const deadline = Date.now() + waitMs;
+	const pending = {};
+	let held;
+	try {
+		while (!(held = attemptDirLock(lockPath, pending))) {
+			if (Date.now() >= deadline) throw dirLockTimeout(lockPath, pending.claim);
+			releaseClaim(pending.claim);
+			pending.claim = void 0;
+			await setTimeout$1(pollMs, void 0, { signal });
+		}
+	} catch (error) {
+		releaseClaim(pending.claim);
+		throw error;
+	}
+	return fn(held);
+}
+/**
+* Holds the directory lock and its ownership claim until the body settles. Transactions are exclusive even
+* within one process and are not reentrant. Cancellation stops acquisition; the body owns cancellation after admission.
+*/
+async function withDirLockTransaction(lockPath, fn, options = {}) {
+	return acquireDirLockAsync(lockPath, options, async ({ claim, marker }) => {
+		try {
+			options.signal?.throwIfAborted();
+			return await fn();
+		} finally {
+			try {
+				removeLockDirectory(lockPath, marker);
+			} catch {}
+			releaseClaim(claim);
+		}
+	});
+}
 //#endregion
 //#region state/json-file.ts
 const readScope = new AsyncLocalStorage();
@@ -195,12 +246,94 @@ function readJsonObject(path) {
 	}
 }
 //#endregion
+//#region context.ts
+const ambient = new AsyncLocalStorage();
+/**
+* Runs `fn` with `context` reachable through `ambientContext()`, including after an `await` inside it. A temporary
+* bridge for call sites that are not passed a context yet: `configDir()`, `runId()` and the exec wrapper's base
+* environment.
+*/
+function withAmbientContext(context, fn) {
+	return ambient.run(context, fn);
+}
+/** The context set by `withAmbientContext`, for call sites that are not passed one yet. */
+function ambientContext() {
+	return ambient.getStore();
+}
+/** Writes `text` to the ambient context's output, or to the process stream outside one. */
+function ambientWrite(stream, text) {
+	const context = ambient.getStore();
+	if (context) context.output(stream, text);
+	else process[stream].write(text);
+}
+/** The environment of the ambient context, or `process.env` outside one. */
+function ambientEnv() {
+	return ambient.getStore()?.env ?? process.env;
+}
+//#endregion
 //#region macos-resources.ts
 /** Whether a resource destination is a contained, non-empty path under Contents/Resources. */
 function validMacosResourceDestination(value) {
 	return typeof value === "string" && value.length > 0 && value.length <= 1024 && !value.includes("\0") && !value.includes("\\") && !/^[A-Za-z]:/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== "..");
 }
 //#endregion
+//#region systemd-unit.ts
+const ESCAPES = {
+	"\\": "\\\\",
+	"\"": "\\\"",
+	"\n": "\\n",
+	"	": "\\t",
+	"\r": "\\r"
+};
+const UNESCAPES = {
+	n: "\n",
+	t: "	",
+	r: "\r"
+};
+/**
+* One double-quoted word as systemd.syntax(7) reads it: C escapes inside the quotes, `%` doubled because unit files
+* expand specifiers, and in `ExecStart=` `$` doubled because systemd expands variables in command lines.
+*/
+function quoteUnitWord(value, exec) {
+	return `"${value.replace(/[\\"\n\t\r%$]/g, (char) => char === "%" ? "%%" : char === "$" ? exec ? "$$" : "$" : ESCAPES[char] ?? char)}"`;
+}
+/** The words of a unit value `quoteUnitWord` wrote, or null when the value is not in that form. */
+function unitWords(line, exec) {
+	const out = [];
+	const pattern = /\s*(?:"((?:[^"\\]|\\.)*)"|([^\s"]+))/y;
+	let index = 0;
+	while (index < line.length && line.slice(index).trim()) {
+		pattern.lastIndex = index;
+		const match = pattern.exec(line);
+		if (!match) return null;
+		index = pattern.lastIndex;
+		const raw = match[1] ?? match[2] ?? "";
+		out.push(raw.replace(/\\(.)|%%|\$\$/g, (whole, escaped) => escaped !== void 0 ? UNESCAPES[escaped] ?? escaped : whole === "%%" ? "%" : exec ? "$" : whole));
+	}
+	return out;
+}
+/** The `key=value` lines of a unit file with the section each is in, skipping comments and blank lines. */
+function unitLines(text) {
+	let section = "";
+	const out = [];
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#") || trimmed.startsWith(";")) continue;
+		const header = /^\[(.+)\]$/.exec(trimmed)?.[1];
+		if (header) {
+			section = header;
+			continue;
+		}
+		const equals = trimmed.indexOf("=");
+		if (equals > 0) out.push({
+			section,
+			key: trimmed.slice(0, equals).trim(),
+			value: trimmed.slice(equals + 1).trim()
+		});
+	}
+	return out;
+}
+//#endregion
 //#region artifact-store.ts
 function artifactIn(dir) {
 	if (!existsSync(dir)) return null;
@@ -298,6 +431,68 @@ function storeArtifact(dest, buildPath, { runFile, overwrite = false, writeMetad
 	return artifactIn(dest);
 }
 //#endregion
+//#region artifact-store-async.ts
+/** Awaits copying before atomic publication; cancellation before publication preserves the previous entry. */
+async function storeArtifactAsync(dest, buildPath, { runFile, overwrite = false, writeMetadata, onRenameError, signal }) {
+	signal?.throwIfAborted();
+	const existing = artifactIn(dest);
+	if (existing && !overwrite) return existing;
+	const token = randomUUID();
+	const staging = `${dest}.staging-${token}`;
+	const replaced = `${dest}.replaced-${token}`;
+	const target = join(staging, basename(buildPath));
+	await mkdir(staging, { recursive: true });
+	try {
+		signal?.throwIfAborted();
+		try {
+			await runFile("cp", [
+				"-c",
+				"-R",
+				buildPath,
+				target
+			]);
+		} catch {
+			signal?.throwIfAborted();
+			await rm(target, {
+				recursive: true,
+				force: true
+			});
+			signal?.throwIfAborted();
+			await runFile("cp", [
+				"-R",
+				buildPath,
+				target
+			]);
+		}
+		signal?.throwIfAborted();
+		await writeMetadata?.(staging);
+		signal?.throwIfAborted();
+		const published = artifactIn(dest);
+		if (published && !overwrite) return published;
+		mkdirSync(dirname(dest), { recursive: true });
+		if (existsSync(dest)) renameSync(dest, replaced);
+		try {
+			renameSync(staging, dest);
+		} catch (error) {
+			try {
+				renameSync(replaced, dest);
+			} catch {}
+			if (!onRenameError) throw error;
+			await onRenameError(staging);
+		}
+		return artifactIn(dest);
+	} finally {
+		await rm(staging, {
+			recursive: true,
+			force: true
+		});
+		await rm(replaced, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+//#endregion
 //#region compiled-helper.ts
 const RECENT_MS = 6e5;
 const pruned = /* @__PURE__ */ new Set();
@@ -343,9 +538,9 @@ function pruneCompiledHelpers(dir, currentName, name, runningPaths = runningExec
 * Returns `<dir>/<name>-<hash>`, compiling it with `compile` first when it is missing. The hash covers `version` and
 * each input's name and bytes, so a changed source or compiler builds a new helper beside the old one. `compile`
 * writes to a private temporary path that is renamed into place, so concurrent builders never expose a partial file.
-* Pruning is best effort and keeps this helper, the newest previous build, helpers modified in the last ten minutes and running helpers. It runs after a build and on the first call per process.
+* Pruning is best effort and keeps this helper, the newest previous build, helpers modified in the last ten minutes and running helpers. It runs after a build and on the first call per process unless `prune` is false.
 */
-async function compiledHelper({ dir, name, inputs, version, compile }) {
+async function compiledHelper({ dir, name, inputs, version, compile, prune = true }) {
 	const hash = createHash("sha256").update(version);
 	for (const input of inputs) hash.update(basename(input)).update(readFileSync(input));
 	const helper = join(dir, `${name}-${hash.digest("hex").slice(0, 16)}`);
@@ -363,11 +558,50 @@ async function compiledHelper({ dir, name, inputs, version, compile }) {
 			rmSync(output, { force: true });
 		}
 	}
-	if (built || !pruned.has(`${dir}/${name}`)) pruneCompiledHelpers(dir, basename(helper), name);
-	pruned.add(`${dir}/${name}`);
+	if (prune) {
+		if (built || !pruned.has(`${dir}/${name}`)) pruneCompiledHelpers(dir, basename(helper), name);
+		pruned.add(`${dir}/${name}`);
+	}
 	return helper;
 }
 //#endregion
+//#region dependency-install.ts
+/** The existing worker install command and marker identity for a repository's selected lockfile. */
+function dependencyInstall(root, packageName) {
+	const file = [
+		"pnpm-lock.yaml",
+		"yarn.lock",
+		"package-lock.json"
+	].find((name) => existsSync(join(root, name)));
+	if (!file) return null;
+	const command = file === "pnpm-lock.yaml" ? "pnpm" : file === "yarn.lock" ? "yarn" : "npm";
+	const args = command === "pnpm" ? [
+		"install",
+		"--frozen-lockfile",
+		...packageName ? ["--filter", `${packageName}...`] : []
+	] : command === "yarn" ? ["install", "--frozen-lockfile"] : ["ci"];
+	const bytes = readFileSync(join(root, file));
+	return {
+		command,
+		args,
+		lockfile: createHash("sha256").update(bytes).digest("hex"),
+		digest: createHash("sha256").update(bytes).update(JSON.stringify(args)).digest("hex")
+	};
+}
+/** Whether the worker can reuse this project's dependency install without running the package manager. */
+function reusableDependencies(area, project, packageName, lockfile) {
+	try {
+		const root = realpathSync(join(area, "src"));
+		const selected = realpathSync(join(root, project));
+		const path = relative(root, selected);
+		if (path === ".." || path.startsWith(`..${sep}`) || isAbsolute(path)) return false;
+		const install = dependencyInstall(root, packageName);
+		return install?.lockfile === lockfile && existsSync(join(selected, "node_modules")) && readFileSync(join(area, "dependencies"), "utf8") === install.digest;
+	} catch {
+		return false;
+	}
+}
+//#endregion
 //#region metro-bridge.ts
 function port(value) {
 	if (!Number.isInteger(value) || value < 1 || value > 65535) throw new Error("Invalid Metro bridge port.");
@@ -459,10 +693,160 @@ function createMetroBridge({ gatewayPort, peer, secret }) {
 	});
 }
 //#endregion
+//#region react-native-artifact.ts
+const text$1 = (value) => typeof value === "string" && value.length > 0 && value.length <= 256 && !/[\0\r\n]/.test(value);
+const path$2 = (value) => text$1(value) && !/[\\:]/.test(value) && value.split("/").every((part) => part !== "" && part !== ".." && part !== ".git");
+/** Validates and canonicalizes the choices used by completed React Native peer artifacts. */
+function reactNativeArtifactQuery(value) {
+	if (!isJsonObject(value) || typeof value.project !== "string" || value.project !== "" && !path$2(value.project) || !text$1(value.fingerprint) || typeof value.isExpo !== "boolean" || Object.keys(value).some((key) => ![
+		"project",
+		"fingerprint",
+		"isExpo",
+		"platform",
+		"toolchain",
+		"ios",
+		"android"
+	].includes(key))) return null;
+	const tools = value.toolchain;
+	if (!isJsonObject(tools) || !text$1(tools.stimBuild)) return null;
+	const common = {
+		project: value.project,
+		fingerprint: value.fingerprint,
+		isExpo: value.isExpo
+	};
+	if (value.platform === "ios" && value.android === void 0 && isJsonObject(value.ios)) {
+		const { runtime, configuration, scheme, projectPath, optimizations } = value.ios;
+		if (!text$1(tools.arch) || !text$1(tools.xcode) || !text$1(tools.simulatorSdk) || !text$1(tools.cocoapods) || !text$1(runtime) || !text$1(configuration) || /release/i.test(configuration) || scheme !== null && !text$1(scheme) || !path$2(projectPath) || !isJsonObject(optimizations) || typeof optimizations.compilationCache !== "boolean" || optimizations.swiftCompilationCache !== null && typeof optimizations.swiftCompilationCache !== "boolean" || typeof optimizations.prefixMapping !== "boolean" || Object.keys(value.ios).some((key) => ![
+			"runtime",
+			"configuration",
+			"scheme",
+			"projectPath",
+			"optimizations"
+		].includes(key)) || Object.keys(optimizations).some((key) => ![
+			"compilationCache",
+			"swiftCompilationCache",
+			"prefixMapping"
+		].includes(key))) return null;
+		return {
+			...common,
+			platform: "ios",
+			toolchain: {
+				stimBuild: tools.stimBuild,
+				arch: tools.arch,
+				xcode: tools.xcode,
+				simulatorSdk: tools.simulatorSdk,
+				cocoapods: tools.cocoapods
+			},
+			ios: {
+				runtime,
+				configuration,
+				scheme,
+				projectPath,
+				optimizations: {
+					compilationCache: optimizations.compilationCache,
+					swiftCompilationCache: optimizations.swiftCompilationCache ?? false,
+					prefixMapping: optimizations.prefixMapping
+				}
+			}
+		};
+	}
+	if (value.platform === "android" && value.ios === void 0 && isJsonObject(value.android)) {
+		const { variant, abi, gradleBuildCache, pch, compilerCache, gradleRoot = null, module = null } = value.android;
+		if (!text$1(tools.jdk) || variant !== null && (!text$1(variant) || !/^[A-Za-z0-9_-]+$/.test(variant) || /release/i.test(variant)) || abi !== null && (!text$1(abi) || !/^[A-Za-z0-9_-]+$/.test(abi)) || typeof gradleBuildCache !== "boolean" || compilerCache !== "ccache" && compilerCache !== "none" || gradleRoot !== null && !path$2(gradleRoot) || module !== null && (!text$1(module) || !/^(:(?!\.\.?(?::|$))[A-Za-z0-9._-]+){1,20}$/.test(module)) || Object.keys(value.android).some((key) => ![
+			"variant",
+			"abi",
+			"gradleBuildCache",
+			"pch",
+			"compilerCache",
+			"gradleRoot",
+			"module"
+		].includes(key))) return null;
+		if (pch !== "auto" && pch !== "on" && pch !== "off") return null;
+		return {
+			...common,
+			platform: "android",
+			toolchain: {
+				stimBuild: tools.stimBuild,
+				jdk: tools.jdk
+			},
+			android: {
+				variant: variant ?? "debug",
+				abi: abi === "all" ? null : abi,
+				gradleBuildCache,
+				pch,
+				compilerCache,
+				gradleRoot: gradleRoot ?? "android",
+				module: module ?? ":app"
+			}
+		};
+	}
+	return null;
+}
+/** The identity of a canonical React Native query and the toolchain verified around its build. */
+function reactNativeArtifactIdentity(receipt) {
+	const fingerprint = createHash("sha256").update(JSON.stringify(receipt)).digest("hex");
+	return {
+		fingerprint,
+		cacheKey: `react-native-${receipt.query.platform}-${fingerprint}`
+	};
+}
+//#endregion
+//#region swiftpm-artifact.ts
+const text = (value) => typeof value === "string" && value.length > 0 && value.length <= 4096 && !value.includes("\0");
+const path$1 = (value) => text(value) && !/[\\:]/.test(value) && value.split("/").every((part) => part !== "" && part !== "." && part !== ".." && part.toLowerCase() !== ".git");
+const strings = (value, valid) => Array.isArray(value) && value.length <= 1e3 && value.every(valid);
+const normalized = (values) => [...new Set(values)].toSorted();
+/** Validates and canonicalizes the source and build choices of a completed SwiftPM peer artifact. */
+function swiftpmArtifactQuery(value) {
+	if (!isJsonObject(value) || Object.keys(value).some((key) => ![
+		"project",
+		"sourceDigest",
+		"stimBuild",
+		"inputs",
+		"build"
+	].includes(key)) || typeof value.project !== "string" || value.project !== "" && !path$1(value.project) || typeof value.sourceDigest !== "string" || !/^[a-f0-9]{64}$/.test(value.sourceDigest) || !text(value.stimBuild) || value.stimBuild.length > 256) return null;
+	const { inputs, build } = value;
+	if (!isJsonObject(inputs) || inputs.complete !== true || Object.keys(inputs).some((key) => ![
+		"complete",
+		"ignored",
+		"outputs",
+		"localFiles",
+		"environment"
+	].includes(key)) || !strings(inputs.ignored, path$1) || !strings(inputs.outputs, path$1) || !strings(inputs.localFiles, text) || !strings(inputs.environment, (name) => typeof name === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) || !isJsonObject(build) || Object.keys(build).some((key) => ![
+		"product",
+		"infoPlist",
+		"resources",
+		"assetCatalog"
+	].includes(key)) || typeof build.product !== "string" || !/^[A-Za-z0-9_.-]{1,100}$/.test(build.product) || !path$1(build.infoPlist) || !isJsonObject(build.resources) || Object.keys(build.resources).length > 256 || build.assetCatalog !== null && !path$1(build.assetCatalog)) return null;
+	const resourceEntries = [];
+	for (const [destination, source] of Object.entries(build.resources).toSorted(([a], [b]) => a.localeCompare(b))) {
+		if (!validMacosResourceDestination(destination) || !path$1(source)) return null;
+		resourceEntries.push([destination, source]);
+	}
+	return {
+		project: value.project,
+		sourceDigest: value.sourceDigest,
+		stimBuild: value.stimBuild,
+		inputs: {
+			complete: true,
+			ignored: normalized(inputs.ignored),
+			outputs: normalized(inputs.outputs),
+			localFiles: normalized(inputs.localFiles),
+			environment: normalized(inputs.environment)
+		},
+		build: {
+			product: build.product,
+			infoPlist: build.infoPlist,
+			resources: Object.fromEntries(resourceEntries),
+			assetCatalog: build.assetCatalog
+		}
+	};
+}
+//#endregion
 //#region index.ts
 const warnedRelative = /* @__PURE__ */ new Set();
 function absoluteEnvPath(name) {
-	const value = process.env[name];
+	const value = ambientEnv()[name];
 	if (!value) return null;
 	if (path.isAbsolute(value)) return value;
 	if (!warnedRelative.has(name)) {
@@ -472,7 +856,7 @@ function absoluteEnvPath(name) {
 	return null;
 }
 function configDir() {
-	return absoluteEnvPath("STIM_HOME") || path.join(os.homedir(), ".stim");
+	return ambientContext()?.home ?? (absoluteEnvPath("STIM_HOME") || path.join(os.homedir(), ".stim"));
 }
 /** Creates `dir` and its missing parents owner-only, and narrows an existing `dir` that grants group or other access when the filesystem and owner allow it. */
 function ensurePrivateDir(dir) {
@@ -660,7 +1044,7 @@ function registerCache({ dir, name, prune, note, entriesDepth, layout, replaces
 				name,
 				prune,
 				note,
-				registeredBy: process.cwd()
+				registeredBy: ambientContext()?.cwd ?? process.cwd()
 			};
 			if (entriesDepth) record.entriesDepth = entriesDepth;
 			if (layout) record.layout = layout;
@@ -678,4 +1062,4 @@ function matchesCache(cache, match) {
 	return match.layout === void 0 || cache.layout === match.layout;
 }
 //#endregion
-export { resolveArtifact as A, workspaceName as C, createMetroGateway as D, createMetroBridge as E, readJsonObject as F, readStateFile as I, withStateReadCache as L, validMacosResourceDestination as M, isJsonObject as N, compiledHelper as O, readJsonFile as P, withDirLock as R, workspaceLogDir as S, workspaceStateDir as T, rotatedLogPath as _, buildCacheRoot as a, updateCacheManifest as b, cacheNameSegment as c, ensurePrivateDir as d, hostSimulatorArch as f, rotateLog as g, registerCache as h, buildCacheKey as i, storeArtifact as j, artifactIn as k, cachePathSetting as l, readCacheManifest as m, METRO_NAMED_CACHE_LAYOUT as n, cacheDirRefusal as o, metroCacheRoot as p, STORE_ROOT_TAG as r, cacheManifestLockPath as s, LOG_ROTATE_BYTES as t, configDir as u, sharedStoreRoot as v, workspaceSlug as w, workspaceId as x, tagSharedStore as y };
+export { withDirLockTransaction as $, createMetroGateway as A, unitWords as B, workspaceName as C, reactNativeArtifactIdentity as D, swiftpmArtifactQuery as E, artifactIn as F, withAmbientContext as G, ambientContext as H, resolveArtifact as I, readJsonObject as J, isJsonObject as K, storeArtifact as L, reusableDependencies as M, compiledHelper as N, reactNativeArtifactQuery as O, storeArtifactAsync as P, withDirLockAsync as Q, quoteUnitWord as R, workspaceLogDir as S, workspaceStateDir as T, ambientEnv as U, validMacosResourceDestination as V, ambientWrite as W, withStateReadCache as X, readStateFile as Y, withDirLock as Z, rotatedLogPath as _, buildCacheRoot as a, updateCacheManifest as b, cacheNameSegment as c, ensurePrivateDir as d, hostSimulatorArch as f, rotateLog as g, registerCache as h, buildCacheKey as i, dependencyInstall as j, createMetroBridge as k, cachePathSetting as l, readCacheManifest as m, METRO_NAMED_CACHE_LAYOUT as n, cacheDirRefusal as o, metroCacheRoot as p, readJsonFile as q, STORE_ROOT_TAG as r, cacheManifestLockPath as s, LOG_ROTATE_BYTES as t, configDir as u, sharedStoreRoot as v, workspaceSlug as w, workspaceId as x, tagSharedStore as y, unitLines as z };