peachsim 0.1.1635 → 0.1.1641

package/README.md

@@ -599,7 +599,11 @@ foreground or background state. Both retain its browser session and app state.
 `sourceApp` does not add fields to React Native's `{ url }` event. A
 stopped guest rejects URL delivery. Explicit `newInstance: true`, deletion,
 and video recording create a new browser context; cold launches still use the
-supplied shell URL. When synchronization is enabled, URL delivery waits for
+supplied shell URL. Process termination and `newInstance: true` preserve
+cookies, local storage and IndexedDB for the next launch. `delete: true` and
+driver cleanup clear that retained storage. Relaunch creates a fresh runtime,
+so input focus and other in-memory component state do not survive termination.
+When synchronization is enabled, URL delivery waits for
 existing work before dispatch and for navigation and painting afterward.
 
 Element taps finish viewport measurement before resolving the selected node's
@@ -652,6 +656,11 @@ peach screenshot --with-frame --output /tmp/peach-framed.png
 peach record --duration 5 --output /tmp/peach-anim.mp4
 ```
 
+`peach record status` queries the recorder on the tracked simulator. A video
+whose stop reply timed out remains available: status reports processing or
+ready to save, and another `peach record stop --output <path>` joins the same
+finalization and saves its bytes. `peach record cancel` discards them.
+
 `peach screenshot --with-frame` composes the real Peach shell device chrome
 around the raw screen bitmap (reusing the shell bezel/button geometry, excluding
 the Electron top bar, rail gutter, and other window chrome). Flows can request

package/cli/app-config.ts

@@ -89,12 +89,21 @@ async function loadConfigFile(
     }
     const wire = WIRE_SLOTS.filter((slot) => loaded[slot] !== undefined)
     if (wire.length > 0) {
-      const migration = wireSlotMigration(project.appDir, {
-        modules: { ...loaded.turboModules, ...loaded.nativeModules },
-        views: { ...loaded.nativeViews },
-      })
+      const slots: readonly string[] = WIRE_SLOTS
+      const kept = Object.entries(loaded)
+        .filter(([key, value]) => !slots.includes(key) && value !== undefined)
+        .map(([key]) => key)
+      const migration = wireSlotMigration(
+        project.appDir,
+        project.configPath,
+        {
+          modules: { ...loaded.turboModules, ...loaded.nativeModules },
+          views: { ...loaded.nativeViews },
+        },
+        kept,
+      )
       throw new Error(
-        `${wire.join(', ')} moved under packages, keyed by the package whose native side they answer. replace them with:\n${migration}`,
+        `${wire.join(', ')} moved under packages, keyed by the package whose native side they answer. ${kept.length ? 'remove them and add' : 'replace the config with'}:\n${migration}`,
       )
     }
     return resolveConfigReplacementFiles(loaded, project.configPath)

package/cli/app-stubs.ts

@@ -25,6 +25,7 @@ import {
   type PeachConfig,
 } from '../src/config'
 import { isRecord } from '../src/is-record'
+import { rnxPublicBrand } from '../src/public-brand'
 import { visitParsedProgram } from '../src/visit-parsed-program'
 import {
   readProjectManifest,
@@ -380,26 +381,77 @@ export function packageNativeRequests(dir: string): NativeRequest[] {
   )
 }
 
-// the `packages` block that replaces a config's old top-level wire slots: each
-// name keyed by the direct dependency whose JavaScript asks for it. `packages`
-// takes only 'noop' or a file path, so any other old value is named for a hand
-// move instead of guessed.
-export function wireSlotMigration(
+// resolve the installed runtime dependency graph, including transitive native
+// packages. workspace source is scanned as app code instead. a transitive
+// package is scanned only when it ships native code: the graph runs to
+// thousands of packages, and the rest name nothing a direct dependency does not.
+function dependencyNativeOwners(
   appDir: string,
-  wire: { modules: Record<string, unknown>; views: Record<string, unknown> },
-): string {
+  manifest: ProjectManifest | null,
+): Map<string, string> {
   const owners = new Map<string, string>()
-  const manifest = readProjectManifest(appDir)
-  for (const name of Object.keys({
+  const pending = Object.keys({
     ...manifest?.devDependencies,
     ...manifest?.dependencies,
-  })) {
-    const dir = installedPackageDir(appDir, name)
-    if (!dir) continue
-    for (const request of packageNativeRequests(dir))
-      if (!owners.has(`${request.kind}:${request.name}`))
-        owners.set(`${request.kind}:${request.name}`, name)
+  }).map((name) => ({ from: appDir, name }))
+  const visited = new Set<string>()
+  for (let index = 0; index < pending.length; index++) {
+    const { from, name } = pending[index]
+    const dir = installedPackageDir(from, name)
+    if (!dir || visited.has(dir)) continue
+    visited.add(dir)
+    const dependency = readProjectManifest(dir)
+    const optional = readPackageJson(dir)?.optionalDependencies
+    if (
+      dir.split('/').includes('node_modules') &&
+      (from === appDir || hasNativeCode(dir, 'ios'))
+    )
+      for (const request of packageNativeRequests(dir))
+        if (!owners.has(`${request.kind}:${request.name}`))
+          owners.set(`${request.kind}:${request.name}`, dependency?.name ?? name)
+    for (const child of Object.keys({
+      ...dependency?.dependencies,
+      ...(isRecord(optional) ? optional : {}),
+    }))
+      pending.push({ from: dir, name: child })
   }
+  return owners
+}
+
+// a complete config module in the form the app's config file already uses, so
+// the printed text pastes over it
+function configModule(configPath: string | null, packages: string[]): string {
+  const body = ['  packages: {', ...packages, '  },']
+  if (
+    configPath &&
+    (configPath.endsWith('.cjs') ||
+      (configPath.endsWith('.js') &&
+        /\bmodule\.exports\b/.test(readSmallFile(configPath) ?? '')))
+  )
+    return ['module.exports = {', ...body, '}'].join('\n')
+  return [
+    `import { defineConfig } from '${rnxPublicBrand.packageName}/config'`,
+    '',
+    'export default defineConfig({',
+    ...body,
+    '})',
+  ].join('\n')
+}
+
+// what replaces a config's old top-level wire slots: each name keyed by the
+// package whose JavaScript asks for it. a config holding only those slots gets
+// a complete module; one with other settings (`kept`) gets just the packages
+// entries, since a whole module would drop them. `packages` takes only 'noop'
+// or a file path, so any other old value is named for a hand move instead of
+// guessed.
+export function wireSlotMigration(
+  appDir: string,
+  configPath: string | null,
+  wire: { modules: Record<string, unknown>; views: Record<string, unknown> },
+  kept: readonly string[] = [],
+): string {
+  const manifest = readProjectManifest(appDir)
+  const owners = dependencyNativeOwners(appDir, manifest)
   if (manifest)
     for (const request of scanLocalNative(
       appDir,
@@ -408,6 +460,7 @@ export function wireSlotMigration(
       undefined,
       new Set(),
       true,
+      owners,
     ))
       if (!owners.has(`${request.kind}:${request.name}`))
         owners.set(`${request.kind}:${request.name}`, request.package)
@@ -453,9 +506,17 @@ export function wireSlotMigration(
     ].filter(Boolean)
     return `    [${JSON.stringify(owner)}]: { ${parts.join(', ')} },`
   })
+  if (lines.length && kept.length)
+    return [
+      ...manual.map((line) => `// ${line}`),
+      `// keep ${kept.join(', ')}; merge these into packages`,
+      '  packages: {',
+      ...lines,
+      '  },',
+    ].join('\n')
   return [
-    ...(lines.length ? ['  packages: {', ...lines, '  },'] : []),
-    ...manual.map((line) => `  // ${line}`),
+    ...manual.map((line) => `// ${line}`),
+    ...(lines.length ? [configModule(configPath, lines)] : []),
   ].join('\n')
 }
 
@@ -519,6 +580,7 @@ export function scanLocalNative(
   platform: ScanResult['scoreSummary']['platform'] | undefined,
   knownPackages: ReadonlySet<string> = new Set(),
   includeLegacy = false,
+  providers?: ReadonlyMap<string, string>,
 ): LocalNative[] {
   const expoModuleDirs: string[] = []
   const excludedModuleDirs: string[] = []
@@ -549,7 +611,12 @@ export function scanLocalNative(
       dir,
       scanRepository(dir).directories.flatMap((sub) =>
         listDir(sub)
-          .filter((name) => NATIVE_SOURCE_FILE.test(name))
+          .filter(
+            (name) =>
+              NATIVE_SOURCE_FILE.test(name) &&
+              (!platform ||
+                (platform === 'ios' ? name.endsWith('.swift') : name.endsWith('.kt'))),
+          )
           .map((name) => join(sub, name)),
       ),
     ]),
@@ -571,11 +638,14 @@ export function scanLocalNative(
     return result
   }
   const found = new Map<string, LocalNative>()
+  // a name an installed dependency asks for belongs to that dependency, whoever
+  // in the app spells it out
   const add = (kind: LocalNative['kind'], name: string, file: string, line: number) => {
-    const packageName = owner(dirname(file))
-    if (knownPackages.has(packageName)) return
     const key = `${kind}:${name}`
     if (found.has(key)) return
+    providers ??= dependencyNativeOwners(appDir, pkg)
+    const packageName = providers.get(key) ?? owner(dirname(file))
+    if (knownPackages.has(packageName)) return
     const moduleDir = expoModuleDirs.find((dir) => file.startsWith(`${dir}/`)) ?? null
     found.set(key, {
       kind,
@@ -584,8 +654,12 @@ export function scanLocalNative(
       path: `${relative(appDir, file)}:${line}`,
       expoModule: moduleDir ? relative(appDir, moduleDir) || '.' : null,
       swift: moduleDir
-        ? (nativeFilesByModule.get(moduleDir) ?? []).some((path) =>
-            path.endsWith('.swift'),
+        ? (nativeFilesByModule.get(moduleDir) ?? []).some(
+            (path) =>
+              path.endsWith('.swift') &&
+              [...(readSmallFile(path) ?? '').matchAll(/\bName\(\s*"(\w+)"\s*\)/g)].some(
+                (match) => match[1] === name,
+              ),
           )
         : false,
       answered: answered[kind].has(name),

package/cli/bridge-flow-runner.ts

@@ -3103,11 +3103,11 @@ export class SootSimBridgeFlowRunner {
   }
 
   async startProfile() {
-    const result = await this.evaluate<any>(`(() => {
+    const result = await this.evaluate<any>(`(async () => {
       if (!window.__sootsimShellPerf) {
         return { error: "shell frame profile unavailable (__sootsimShellPerf missing on the page)" }
       }
-      window.__sootsimShellPerf.start()
+      await window.__sootsimShellPerf.start()
       return { started: true }
     })()`)
     if (result?.error) {

package/cli/cloud-client.ts

@@ -27,6 +27,10 @@ import {
 import { rewriteGuestImportMeta } from '../../peach-engine/src/guest-import-meta.ts'
 import { loadMetroFingerprintRegistry } from '../../peach-engine/src/metro-fingerprint-registry-client.ts'
 import { inferMetroModuleIdentity } from '../../peach-engine/src/metro-fingerprint.ts'
+import {
+  isNativeJavaScriptBundle,
+  isRolldownBundle,
+} from '../../peach-engine/src/preview/bundle-layout'
 import { isLoopbackHost } from '../src/backend-origin.ts'
 import {
   isRnxCloudCommandType,
@@ -172,7 +176,7 @@ function resolveCloudOrigin(value?: string): string {
 function readImmutableBundleSource(bundlePath: string, command: string): string {
   const filepath = resolve(bundlePath)
   if (extname(filepath) !== '.js') {
-    throw new Error(`${command} requires one local Metro .js bundle`)
+    throw new Error(`${command} requires one local .js bundle`)
   }
   const descriptor = openSync(filepath, 'r')
   try {
@@ -200,9 +204,6 @@ function readImmutableBundleSource(bundlePath: string, command: string): string
     } catch {
       throw new Error(`${command} bundle must be valid UTF-8 JavaScript`)
     }
-    if (source.includes('\0') || !source.includes('__d(') || !source.includes('__r(')) {
-      throw new Error(`${command} requires a Metro JavaScript bundle`)
-    }
     return source
   } finally {
     closeSync(descriptor)
@@ -231,9 +232,6 @@ async function fetchBundleSource(bundleUrl: string, command: string): Promise<st
   if (text.length === 0) {
     throw new Error(`${command} bundle is empty`)
   }
-  if (text.includes('\0') || !text.includes('__d(') || !text.includes('__r(')) {
-    throw new Error(`${command} requires a Metro JavaScript bundle`)
-  }
   return text
 }
 
@@ -260,6 +258,9 @@ async function loadBundleSource(bundleInput: string, command: string): Promise<s
   const source = isRemoteBundleInput(bundleInput)
     ? await fetchBundleSource(bundleInput, command)
     : readImmutableBundleSource(bundleInput, command)
+  if (!isNativeJavaScriptBundle(source)) {
+    throw new Error(`${command} requires a supported React Native JavaScript bundle`)
+  }
   // validate the actual runtime script form without executing guest code or
   // allocating a host.
   try {
@@ -728,25 +729,44 @@ export async function produceCloudArtifact(
   maxBytes: number = MAX_RNX_CLOUD_BUNDLE_BYTES,
   assetsDirectory?: string,
 ): Promise<CloudArtifactProduction> {
-  return produceArtifact(
+  const prepared = await embedBundleAssets(
     bundlePath,
-    maxBytes,
     REMOTE_COMMAND,
     assetsDirectory ? 'require-assets' : 'allow-placeholders',
     assetsDirectory,
   )
+  return produceArtifact(prepared, maxBytes, REMOTE_COMMAND)
 }
 
 /** prepares a standalone preview whose bytes must represent every Metro asset. */
-export async function producePreviewArtifact(
-  bundlePath: string,
-): Promise<CloudArtifactProduction> {
-  return produceArtifact(
-    bundlePath,
-    Number.POSITIVE_INFINITY,
-    PREVIEW_COMMAND,
-    'require-assets',
-  )
+export async function producePreviewArtifact(bundlePath: string) {
+  const prepared = await embedBundleAssets(bundlePath, PREVIEW_COMMAND, 'require-assets')
+  if (!isRolldownBundle(prepared.source)) {
+    return {
+      ...(await produceArtifact(prepared, Number.POSITIVE_INFINITY, PREVIEW_COMMAND)),
+      minified: true,
+    }
+  }
+  const bytes = Buffer.from(prepared.code, 'utf8')
+  const sha256 = createHash('sha256').update(bytes).digest('hex')
+  return {
+    bytes,
+    sha256,
+    minified: false,
+    receipt: {
+      source: {
+        sha256: createHash('sha256').update(prepared.source).digest('hex'),
+        bytes: Buffer.byteLength(prepared.source, 'utf8'),
+      },
+      artifact: { sha256, bytes: bytes.byteLength },
+    },
+    warnings:
+      prepared.search.unconfirmed && prepared.dest
+        ? [
+            `peach preview could not authenticate asset hashes in ${prepared.dest.directory}; confirm these are the assets this bundle was built against.`,
+          ]
+        : [],
+  }
 }
 
 export interface CloudBoxArtifactProduction {
@@ -890,18 +910,10 @@ async function embedBundleAssets(
 }
 
 async function produceArtifact(
-  bundlePath: string,
+  prepared: Awaited<ReturnType<typeof embedBundleAssets>>,
   maxBytes: number,
   command: string,
-  assetPolicy: 'allow-placeholders' | 'require-assets',
-  assetsDirectory?: string,
 ): Promise<CloudArtifactProduction> {
-  const prepared = await embedBundleAssets(
-    bundlePath,
-    command,
-    assetPolicy,
-    assetsDirectory,
-  )
   const artifact = await buildRnxCloudArtifact(prepared.code, {
     inferModuleIdentity: (source) => inferCloudModuleIdentity(source, command),
   })
@@ -1453,12 +1465,17 @@ function cloudCommand(command: {
 class CloudBridge implements WsBridge {
   readonly plane = 'cloud' as const
 
-  constructor(private readonly session: CloudSimSession) {}
+  constructor(
+    private readonly session: CloudSimSession,
+    private readonly explicitTimeoutMs?: number,
+  ) {}
 
   async send(
     command: { type: string; [key: string]: unknown },
-    options?: { timeoutMs?: number },
+    options?: { timeoutMs?: number; defaultTimeoutMs?: number },
   ): Promise<unknown> {
+    const timeoutMs =
+      options?.timeoutMs ?? this.explicitTimeoutMs ?? options?.defaultTimeoutMs
     const body: CloudCommandEnvelope = {
       id: randomUUID(),
       claimId: this.session.claimId,
@@ -1475,9 +1492,7 @@ class CloudBridge implements WsBridge {
             'content-type': 'application/json',
           },
           body: JSON.stringify(body),
-          ...(options?.timeoutMs
-            ? { signal: AbortSignal.timeout(options.timeoutMs) }
-            : {}),
+          ...(timeoutMs ? { signal: AbortSignal.timeout(timeoutMs) } : {}),
         },
       )
     } catch (error) {
@@ -1538,12 +1553,17 @@ class CloudBridge implements WsBridge {
 class CloudBoxBridge implements WsBridge {
   readonly plane = 'cloud' as const
 
-  constructor(private readonly session: CloudBoxSession) {}
+  constructor(
+    private readonly session: CloudBoxSession,
+    private readonly explicitTimeoutMs?: number,
+  ) {}
 
   async send(
     command: { type: string; [key: string]: unknown },
-    options?: { timeoutMs?: number },
+    options?: { timeoutMs?: number; defaultTimeoutMs?: number },
   ): Promise<unknown> {
+    const timeoutMs =
+      options?.timeoutMs ?? this.explicitTimeoutMs ?? options?.defaultTimeoutMs
     const id = randomUUID()
     // the wire id is this request's, so the command carries none. `simId` names
     // a local sim among several and a box has exactly one.
@@ -1562,9 +1582,7 @@ class CloudBoxBridge implements WsBridge {
             'content-type': 'application/json',
           },
           body: JSON.stringify({ id, command: payload }),
-          ...(options?.timeoutMs
-            ? { signal: AbortSignal.timeout(options.timeoutMs) }
-            : {}),
+          ...(timeoutMs ? { signal: AbortSignal.timeout(timeoutMs) } : {}),
         },
       )
     } catch (error) {
@@ -1619,13 +1637,15 @@ class CloudBoxBridge implements WsBridge {
 }
 
 export function createCloudBridgeForParsed(
-  parsed: Pick<ParsedBridgeCliArgs, 'simId' | 'simIdSource'>,
+  parsed: Pick<ParsedBridgeCliArgs, 'simId' | 'simIdSource'> &
+    Partial<Pick<ParsedBridgeCliArgs, 'explicitTimeout' | 'commandTimeoutMs'>>,
 ): WsBridge | null {
   const session = resolveCloudSessionForParsed(parsed)
   if (!session) return null
+  const timeoutMs = parsed.explicitTimeout ? parsed.commandTimeoutMs : undefined
   return session.service === 'box'
-    ? new CloudBoxBridge(session)
-    : new CloudBridge(session)
+    ? new CloudBoxBridge(session, timeoutMs)
+    : new CloudBridge(session, timeoutMs)
 }
 
 // deletes the box, which ends the simulator it holds. a cloud session box is

package/cli/cloud-session.ts

@@ -60,6 +60,7 @@ export interface CloudBoxSession {
   platform?: RemotePlatform
   device?: string
   artifact?: CloudSessionArtifactIdentity
+  appFontsWireSha256?: string
 }
 
 export function normalizeCloudOrigin(source: string): string {
@@ -128,7 +129,13 @@ export function createCloudBoxSession(input: {
   platform?: RemotePlatform
   device?: string
   artifact?: CloudSessionArtifactIdentity
+  appFontsWireSha256?: string
 }): CloudBoxSession {
+  if (
+    input.appFontsWireSha256 !== undefined &&
+    !/^[a-f0-9]{64}$/.test(input.appFontsWireSha256)
+  )
+    throw new Error('cloud box session has an invalid app-font wire digest')
   const session: CloudBoxSession = {
     version: CLOUD_SESSION_VERSION,
     service: 'box',
@@ -138,6 +145,9 @@ export function createCloudBoxSession(input: {
     ...(input.platform ? { platform: input.platform } : {}),
     ...(input.device?.trim() ? { device: input.device.trim() } : {}),
     ...(input.artifact ? { artifact: input.artifact } : {}),
+    ...(input.appFontsWireSha256 !== undefined
+      ? { appFontsWireSha256: input.appFontsWireSha256 }
+      : {}),
   }
   if (!session.boxId || !session.boxToken) {
     throw new Error('cloud box session requires a box, an origin, and a box token')
@@ -198,6 +208,11 @@ export function parseCloudSession(encoded: string): CloudSession {
   try {
     if (parsed.service === 'box') {
       if (!boxId || !boxToken) throw new Error('unreadable cloud box session')
+      if (
+        parsed.appFontsWireSha256 !== undefined &&
+        typeof parsed.appFontsWireSha256 !== 'string'
+      )
+        throw new Error('unreadable app-font wire digest')
       return createCloudBoxSession({
         boxId,
         boxToken,
@@ -205,6 +220,7 @@ export function parseCloudSession(encoded: string): CloudSession {
         platform,
         device,
         artifact,
+        appFontsWireSha256: parsed.appFontsWireSha256,
       })
     }
     const simId = parsed.simId

package/cli/commands/assert.ts

@@ -162,11 +162,14 @@ interface VerbResult {
   reason?: string
 }
 
-async function runVerbOnce(verbArgs: string[]): Promise<VerbResult> {
+async function runVerbOnce(
+  verbArgs: string[],
+  globalArgs: string[],
+): Promise<VerbResult> {
   // re-invoke self through the real CLI entry, so every code path the user's
   // verb would take, assert takes too.
   const { executable, prefixArgs } = rnxSelfInvocation()
-  const args = [...prefixArgs, ...verbArgs, '--json']
+  const args = [...prefixArgs, ...globalArgs, ...verbArgs, '--json']
 
   return new Promise<VerbResult>((resolve) => {
     const proc = spawn(executable, args, {
@@ -402,7 +405,10 @@ function runJq(expr: string, payload: unknown): Promise<string> {
   })
 }
 
-export async function runAssert(rawArgs: string[]): Promise<void> {
+export async function runAssert(
+  rawArgs: string[],
+  target: { port?: number; sim?: string } = {},
+): Promise<void> {
   if (rawArgs[0] === '--help' || rawArgs[0] === '-h' || rawArgs.length === 0) {
     printHelp()
     peachExit(rawArgs.length === 0 ? 2 : 0)
@@ -430,6 +436,13 @@ export async function runAssert(rawArgs: string[]): Promise<void> {
   const effectivePredicates =
     predicates.length > 0 ? predicates : [{ kind: '--exists', args: [] }]
 
+  // the child is a fresh CLI process: without the caller's explicit port and
+  // sim it falls back to the saved target.
+  const globalArgs = [
+    ...(target.port != null ? ['--port', String(target.port)] : []),
+    ...(target.sim ? ['--sim', target.sim] : []),
+  ]
+
   const deadline = withinMs > 0 ? Date.now() + withinMs : 0
   let attempts = 0
   let lastFailReason = ''
@@ -437,7 +450,7 @@ export async function runAssert(rawArgs: string[]): Promise<void> {
 
   while (true) {
     attempts++
-    const verbResult = await runVerbOnce(verbArgs)
+    const verbResult = await runVerbOnce(verbArgs, globalArgs)
     if (!verbResult.ok) {
       lastVerbSkipReason = verbResult.reason || 'verb failed'
       if (Date.now() < deadline) {

package/cli/commands/box.ts

@@ -10,6 +10,7 @@
 // name on the command line, else the one `peach box use` remembered. see
 // boxTarget below.
 
+import { createHash } from 'node:crypto'
 import fs from 'node:fs'
 import path from 'node:path'
 import { createInterface } from 'node:readline'
@@ -536,7 +537,13 @@ export async function createPrebuiltBundleBox(options: {
   const nativeRenderer = options.nativeProjectDir
     ? readNativeProjectRenderer(options.nativeProjectDir, platform)
     : undefined
-  return cloudBoxClient(options).create({
+  const appFonts = options.nativeProjectDir
+    ? readNativeLinkedAppFontsWire({
+        projectDir: options.nativeProjectDir,
+        platform,
+      })
+    : ''
+  const box = await cloudBoxClient(options).create({
     name: options.name,
     stack: prebuiltBundleBoxTemplate.stack,
     template: BOX_TEMPLATES.resolve({ name: prebuiltBundleBoxTemplate.name }).provenance,
@@ -544,16 +551,17 @@ export async function createPrebuiltBundleBox(options: {
       options.bundle,
       options.device,
       options.initialUrl ?? null,
-      options.nativeProjectDir
-        ? readNativeLinkedAppFontsWire({
-            projectDir: options.nativeProjectDir,
-            platform,
-          })
-        : '',
+      appFonts,
       nativeRenderer,
     ),
     ...(options.secrets ? { secrets: options.secrets } : {}),
   })
+  return {
+    box,
+    appFontsWireSha256: box.existing
+      ? undefined
+      : createHash('sha256').update(appFonts).digest('hex'),
+  }
 }
 
 // a plain .env file: `NAME=value` lines, an optional `export `, optional
@@ -698,7 +706,7 @@ async function runCloudBoxCreate(
   }
   let session: BoxShellSession | null = null
   try {
-    const box =
+    const created =
       'bundle' in source
         ? await createPrebuiltBundleBox({
             ...connection,
@@ -708,21 +716,27 @@ async function runCloudBoxCreate(
             name,
             ...(secrets ? { secrets } : {}),
           })
-        : await cloudBoxClient(connection).create({
-            name,
-            stack: template.stack,
-            template: template.provenance,
-            source: source.checkout,
-            ...(secrets ? { secrets } : {}),
-            onProgress:
-              opts.verbose && !json
-                ? (seeded, total) => console.log(`  ...seeded ${seeded}/${total} files`)
-                : undefined,
-          })
+        : {
+            box: await cloudBoxClient(connection).create({
+              name,
+              stack: template.stack,
+              template: template.provenance,
+              source: source.checkout,
+              ...(secrets ? { secrets } : {}),
+              onProgress:
+                opts.verbose && !json
+                  ? (seeded, total) => console.log(`  ...seeded ${seeded}/${total} files`)
+                  : undefined,
+            }),
+          }
+    const { box } = created
     if (json) {
       console.log(
         JSON.stringify({
           ...box.description,
+          ...('appFontsWireSha256' in created
+            ? { appFontsWireSha256: created.appFontsWireSha256 }
+            : {}),
           ...(box.accessToken ? { accessToken: box.accessToken } : {}),
         }),
       )