prowl-tools 0.1.6 → 0.1.7

package/dist/{chunk-5KQR3IR3.js → chunk-R7NUH44M.js}

@@ -7,7 +7,7 @@ import {
   loadHunt,
   loadHuntTags,
   resolveViewport
-} from "./chunk-WHAMB4TY.js";
+} from "./chunk-O3OUTZ2P.js";
 
 // src/config/interpolate.ts
 import crypto from "crypto";
@@ -757,27 +757,71 @@ function createMacDriver(client, options = {}) {
   };
 }
 
+// src/browser/macdriver-release.ts
+import os from "os";
+import path2 from "path";
+var HELPER_BINARY = "prowl-macdriver";
+var MACDRIVER_VERSION = "0.1.0";
+var MACDRIVER_REPO = "prowl-tools/prowl";
+var MACDRIVER_SIGNING_IDENTIFIER = "tools.prowl.macdriver";
+var MACDRIVER_SIGNING_AUTHORITY_PREFIX = "Developer ID Application: Genkei Labs";
+var MACDRIVER_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?(?:\+[0-9A-Za-z][0-9A-Za-z.-]*)?$/;
+function validateMacdriverVersion(version) {
+  if (!MACDRIVER_VERSION_PATTERN.test(version)) {
+    throw new Error(
+      `Invalid prowl-macdriver version "${version}". Expected a release version like 0.1.0.`
+    );
+  }
+  return version;
+}
+function macdriverReleaseTag(version = MACDRIVER_VERSION) {
+  return `macdriver-v${validateMacdriverVersion(version)}`;
+}
+function macdriverAssetName(version = MACDRIVER_VERSION) {
+  return `prowl-macdriver-v${validateMacdriverVersion(version)}-universal.zip`;
+}
+function macdriverChecksumName(version = MACDRIVER_VERSION) {
+  return `${macdriverAssetName(version)}.sha256`;
+}
+function macdriverAssetUrl(assetName, version = MACDRIVER_VERSION) {
+  return `https://github.com/${MACDRIVER_REPO}/releases/download/${macdriverReleaseTag(version)}/${assetName}`;
+}
+function macdriverInstallRoot(homedir = os.homedir()) {
+  return path2.join(homedir, ".prowl", "macdriver");
+}
+function macdriverVersionDir(version = MACDRIVER_VERSION, homedir = os.homedir()) {
+  const root = path2.resolve(macdriverInstallRoot(homedir));
+  const versionDir = path2.resolve(root, validateMacdriverVersion(version));
+  if (!versionDir.startsWith(root + path2.sep)) {
+    throw new Error(`Resolved prowl-macdriver version directory escaped install root: ${versionDir}`);
+  }
+  return versionDir;
+}
+function macdriverInstalledBinary(version = MACDRIVER_VERSION, homedir = os.homedir()) {
+  return path2.join(macdriverVersionDir(version, homedir), HELPER_BINARY);
+}
+
 // src/browser/mac-helper.ts
 import { spawn } from "child_process";
 import fs2 from "fs";
-import path2 from "path";
+import os2 from "os";
+import path3 from "path";
 import { fileURLToPath } from "url";
-var HELPER_BINARY = "prowl-macdriver";
 function macdriverBuildInstructions() {
-  return "The macOS target requires the experimental `prowl-macdriver` helper, which is not shipped in the npm package. Build it locally:\n  cd macdriver && swift build -c release\nor point Prowl at a prebuilt binary via the PROWL_MACDRIVER_BIN environment variable.";
+  return "The macOS target needs the `prowl-macdriver` helper. Install the prebuilt, signed binary (recommended):\n  prowl macdriver install\nContributors building from source can instead run:\n  cd macdriver && swift build -c release\nor point Prowl at a prebuilt binary via the PROWL_MACDRIVER_BIN environment variable.";
 }
 function getPackageRoot() {
-  let dir = path2.dirname(fileURLToPath(import.meta.url));
-  const root = path2.parse(dir).root;
+  let dir = path3.dirname(fileURLToPath(import.meta.url));
+  const root = path3.parse(dir).root;
   while (dir !== root) {
-    if (fs2.existsSync(path2.join(dir, "package.json"))) {
+    if (fs2.existsSync(path3.join(dir, "package.json"))) {
       return dir;
     }
-    dir = path2.dirname(dir);
+    dir = path3.dirname(dir);
   }
   return root;
 }
-function resolveHelperBinary(env = process.env) {
+function resolveHelperBinary(env = process.env, options = {}) {
   const override = env.PROWL_MACDRIVER_BIN;
   if (override) {
     if (!fs2.existsSync(override)) {
@@ -788,10 +832,15 @@ ${macdriverBuildInstructions()}`
     }
     return override;
   }
+  const homedir = options.homedir ?? os2.homedir();
+  const userBinary = macdriverInstalledBinary(MACDRIVER_VERSION, homedir);
+  if (fs2.existsSync(userBinary)) {
+    return userBinary;
+  }
   const root = getPackageRoot();
   const candidates = [
-    path2.join(root, "macdriver", ".build", "release", HELPER_BINARY),
-    path2.join(root, "macdriver", ".build", "debug", HELPER_BINARY)
+    path3.join(root, "macdriver", ".build", "release", HELPER_BINARY),
+    path3.join(root, "macdriver", ".build", "debug", HELPER_BINARY)
   ];
   for (const candidate of candidates) {
     if (fs2.existsSync(candidate)) {
@@ -1721,12 +1770,12 @@ var Uia2Transport = class {
    * {@link Uia2HttpError} on a non-2xx response, or a timeout error when the
    * per-request deadline elapses.
    */
-  async request(method, path16, body, timeoutMs) {
+  async request(method, path18, body, timeoutMs) {
     const requestTimeoutMs = timeoutMs ?? this.requestTimeoutMs;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), requestTimeoutMs);
     timer.unref?.();
-    const url = `${this.baseUrl}${path16}`;
+    const url = `${this.baseUrl}${path18}`;
     let response;
     try {
       response = await this.fetchImpl(url, {
@@ -1738,7 +1787,7 @@ var Uia2Transport = class {
     } catch (error) {
       if (controller.signal.aborted) {
         const shown = requestTimeoutMs >= 1e3 ? `${Math.round(requestTimeoutMs / 1e3)}s` : `${requestTimeoutMs}ms`;
-        throw new Error(`uiautomator2 request ${method} ${path16} timed out after ${shown}`);
+        throw new Error(`uiautomator2 request ${method} ${path18} timed out after ${shown}`);
       }
       throw error instanceof Error ? error : new Error(String(error));
     } finally {
@@ -1749,7 +1798,7 @@ var Uia2Transport = class {
     if (!response.ok) {
       const wdError = extractWebdriverError(parsed);
       throw new Uia2HttpError(
-        `uiautomator2 ${method} ${path16} failed (${response.status})${wdError ? `: ${wdError}` : ""}`,
+        `uiautomator2 ${method} ${path18} failed (${response.status})${wdError ? `: ${wdError}` : ""}`,
         response.status,
         wdError
       );
@@ -1832,10 +1881,10 @@ function sleep(ms) {
 }
 function createUia2AgentClient(transport, sessionId, options = {}) {
   const base = `/session/${sessionId}`;
-  async function locate(query, path16) {
+  async function locate(query, path18) {
     return transport.request(
       "POST",
-      `${base}${path16}`,
+      `${base}${path18}`,
       androidQueryToLocator(query, { appPackage: options.appPackage })
     );
   }
@@ -1894,7 +1943,7 @@ function createUia2AgentClient(transport, sessionId, options = {}) {
 import { createRequire } from "module";
 import { execFile as execFile2 } from "child_process";
 import fs4 from "fs";
-import path3 from "path";
+import path4 from "path";
 var UIA2_REMOTE_PORT = 6790;
 function resolveAgentApks(requireFn = createRequire(import.meta.url)) {
   let pkgJsonPath;
@@ -1905,10 +1954,10 @@ function resolveAgentApks(requireFn = createRequire(import.meta.url)) {
       "The Android target requires the `appium-uiautomator2-server` package (its prebuilt APKs). It is an optional dependency of prowl-tools; it may have been skipped (--omit=optional) or failed to install. Restore it for a global Prowl install with: npm install -g appium-uiautomator2-server@10.6.2. If Prowl is installed locally in a project, run: npm install appium-uiautomator2-server@10.6.2"
     );
   }
-  const pkgDir = path3.dirname(pkgJsonPath);
+  const pkgDir = path4.dirname(pkgJsonPath);
   const version = requireFn(pkgJsonPath).version;
-  const serverApk = path3.join(pkgDir, "apks", `appium-uiautomator2-server-v${version}.apk`);
-  const testApk = path3.join(pkgDir, "apks", "appium-uiautomator2-server-debug-androidTest.apk");
+  const serverApk = path4.join(pkgDir, "apks", `appium-uiautomator2-server-v${version}.apk`);
+  const testApk = path4.join(pkgDir, "apks", "appium-uiautomator2-server-debug-androidTest.apk");
   for (const apk of [serverApk, testApk]) {
     if (!fs4.existsSync(apk)) {
       throw new Error(`Expected uiautomator2 agent APK is missing: ${apk}. Reinstall dependencies.`);
@@ -1956,7 +2005,7 @@ async function resolvePackage(app, runner, serial, aaptResolver, allowedApps) {
     assertAndroidAppAllowed(allowedApps, app);
     return app;
   }
-  const apkPath = path3.resolve(app);
+  const apkPath = path4.resolve(app);
   if (!fs4.existsSync(apkPath)) {
     throw new Error(`APK not found: ${apkPath}`);
   }
@@ -2250,8 +2299,8 @@ function createIosDriver(client, options) {
 import { execFile as execFile3, spawn as spawn3 } from "child_process";
 import { mkdir, readFile, rm, writeFile } from "fs/promises";
 import net from "net";
-import os from "os";
-import path4 from "path";
+import os3 from "os";
+import path5 from "path";
 var spawnXcrunProcess = (args, options) => {
   const child = spawn3("xcrun", args, {
     stdio: "ignore",
@@ -2265,7 +2314,7 @@ var spawnXcrunProcess = (args, options) => {
     }
   };
 };
-var DEFAULT_SIMULATOR_LOCK_ROOT = path4.join(os.tmpdir(), "prowl-ios-simulator-locks");
+var DEFAULT_SIMULATOR_LOCK_ROOT = path5.join(os3.tmpdir(), "prowl-ios-simulator-locks");
 var SIMULATOR_LOCK_OWNER_FILE = "owner.json";
 var execFileXcrunRunner = (args, options) => new Promise((resolve) => {
   execFile3(
@@ -2305,7 +2354,7 @@ function isProcessAlive(pid) {
 }
 async function removeStaleSimulatorLock(lockPath) {
   try {
-    const ownerText = await readFile(path4.join(lockPath, SIMULATOR_LOCK_OWNER_FILE), "utf8");
+    const ownerText = await readFile(path5.join(lockPath, SIMULATOR_LOCK_OWNER_FILE), "utf8");
     const owner = JSON.parse(ownerText);
     if (typeof owner.pid === "number" && Number.isInteger(owner.pid) && owner.pid > 0 && !isProcessAlive(owner.pid)) {
       await rm(lockPath, { recursive: true, force: true });
@@ -2323,7 +2372,7 @@ function simulatorReservedError(udid) {
 }
 async function reserveSimulatorUdid(udid, options = {}) {
   const lockRoot = options.lockRoot ?? DEFAULT_SIMULATOR_LOCK_ROOT;
-  const lockPath = path4.join(lockRoot, simulatorLockName(udid));
+  const lockPath = path5.join(lockRoot, simulatorLockName(udid));
   await mkdir(lockRoot, { recursive: true });
   for (let attempt = 0; attempt < 2; attempt += 1) {
     try {
@@ -2347,7 +2396,7 @@ async function reserveSimulatorUdid(udid, options = {}) {
     };
     try {
       await writeFile(
-        path4.join(lockPath, SIMULATOR_LOCK_OWNER_FILE),
+        path5.join(lockPath, SIMULATOR_LOCK_OWNER_FILE),
         `${JSON.stringify({ pid: process.pid, udid, createdAt: (/* @__PURE__ */ new Date()).toISOString() })}
 `,
         { flag: "wx" }
@@ -2539,15 +2588,15 @@ var WdaTransport = class {
    * {@link WdaHttpError} on a non-2xx response, or a timeout error when the
    * per-request deadline elapses.
    */
-  async requestFull(method, path16, body, timeoutMs) {
+  async requestFull(method, path18, body, timeoutMs) {
     const requestTimeoutMs = timeoutMs ?? this.requestTimeoutMs;
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), requestTimeoutMs);
     timer.unref?.();
-    const url = `${this.baseUrl}${path16}`;
+    const url = `${this.baseUrl}${path18}`;
     const timeoutError = () => {
       const shown = requestTimeoutMs >= 1e3 ? `${Math.round(requestTimeoutMs / 1e3)}s` : `${requestTimeoutMs}ms`;
-      return new Error(`WebDriverAgent request ${method} ${path16} timed out after ${shown}`);
+      return new Error(`WebDriverAgent request ${method} ${path18} timed out after ${shown}`);
     };
     let response;
     try {
@@ -2579,7 +2628,7 @@ var WdaTransport = class {
     if (!response.ok) {
       const wdError = extractWebdriverError2(parsed);
       throw new WdaHttpError(
-        `WebDriverAgent ${method} ${path16} failed (${response.status})${wdError ? `: ${wdError}` : ""}`,
+        `WebDriverAgent ${method} ${path18} failed (${response.status})${wdError ? `: ${wdError}` : ""}`,
         response.status,
         wdError
       );
@@ -2587,8 +2636,8 @@ var WdaTransport = class {
     return parsed;
   }
   /** Like {@link requestFull} but returns just the `value` field. */
-  async request(method, path16, body, timeoutMs) {
-    const parsed = await this.requestFull(method, path16, body, timeoutMs);
+  async request(method, path18, body, timeoutMs) {
+    const parsed = await this.requestFull(method, path18, body, timeoutMs);
     return parsed?.value;
   }
 };
@@ -2664,8 +2713,8 @@ function sleep2(ms) {
 }
 function createWdaAgentClient(transport, sessionId) {
   const base = `/session/${sessionId}`;
-  async function locate(query, path16) {
-    return transport.request("POST", `${base}${path16}`, iosQueryToLocator(query));
+  async function locate(query, path18) {
+    return transport.request("POST", `${base}${path18}`, iosQueryToLocator(query));
   }
   return {
     async findElement(query) {
@@ -2718,8 +2767,8 @@ function createWdaAgentClient(transport, sessionId) {
 import { createRequire as createRequire2 } from "module";
 import { execFile as execFile4 } from "child_process";
 import fs5 from "fs";
-import os2 from "os";
-import path5 from "path";
+import os4 from "os";
+import path6 from "path";
 var WDA_RUNNER_BUNDLE_ID = "com.facebook.WebDriverAgentRunner.xctrunner";
 var WDA_USE_PORT_ENV = "USE_PORT";
 var PREPARED_XCTESTRUN_PREFIX = "prowl-wda-xctestrun-";
@@ -2745,19 +2794,19 @@ function resolveWdaProject(requireFn = createRequire2(import.meta.url)) {
       "The iOS target requires the `appium-webdriveragent` package (its WDA Xcode project). It is an optional dependency of prowl-tools; it may have been skipped (--omit=optional) or failed to install. Restore it for a global Prowl install with: npm install -g appium-webdriveragent@16.4.0. If Prowl is installed locally in a project, run: npm install appium-webdriveragent@16.4.0"
     );
   }
-  const pkgDir = path5.dirname(pkgJsonPath);
+  const pkgDir = path6.dirname(pkgJsonPath);
   const version = requireFn(pkgJsonPath).version;
-  const projectPath = path5.join(pkgDir, "WebDriverAgent.xcodeproj");
+  const projectPath = path6.join(pkgDir, "WebDriverAgent.xcodeproj");
   if (!fs5.existsSync(projectPath)) {
     throw new Error(`Expected WebDriverAgent project is missing: ${projectPath}. Reinstall dependencies.`);
   }
   return { projectPath, version };
 }
-function wdaCacheDir(wdaVersion, xcode, homeDir = os2.homedir()) {
-  return path5.join(homeDir, ".prowl", "wda", `${wdaVersion}-xcode${xcode}`);
+function wdaCacheDir(wdaVersion, xcode, homeDir = os4.homedir()) {
+  return path6.join(homeDir, ".prowl", "wda", `${wdaVersion}-xcode${xcode}`);
 }
 function productsDir(derivedDataPath) {
-  return path5.join(derivedDataPath, "Build", "Products");
+  return path6.join(derivedDataPath, "Build", "Products");
 }
 function findXctestrunIn(dir) {
   let entries;
@@ -2767,7 +2816,7 @@ function findXctestrunIn(dir) {
     return null;
   }
   const match = entries.filter((name) => name.endsWith(".xctestrun") && !name.startsWith(PREPARED_XCTESTRUN_PREFIX)).sort()[0];
-  return match ? path5.join(dir, match) : null;
+  return match ? path6.join(dir, match) : null;
 }
 function resolveOverrideXctestrun(override) {
   if (!fs5.existsSync(override)) {
@@ -2779,7 +2828,7 @@ function resolveOverrideXctestrun(override) {
   const candidates = [];
   const stat = fs5.statSync(override);
   if (override.endsWith(".app")) {
-    candidates.push(path5.dirname(path5.dirname(override)));
+    candidates.push(path6.dirname(path6.dirname(override)));
   } else if (stat.isDirectory()) {
     candidates.push(override, productsDir(override));
   }
@@ -2796,7 +2845,7 @@ function resolveOverrideXctestrun(override) {
 async function resolveWdaTestRun(options = {}) {
   const runner = options.runner ?? execFileXcrunRunner;
   const env = options.env ?? process.env;
-  const homeDir = options.homeDir ?? os2.homedir();
+  const homeDir = options.homeDir ?? os4.homedir();
   const log = options.logger ?? ((message) => process.stderr.write(`${message}
 `));
   const override = env.PROWL_WDA_RUNNER;
@@ -2912,8 +2961,8 @@ var defaultWdaTestRunPreparer = async ({ xctestrunPath, port }) => {
   }
   const injected = injectUsePortIntoXctestrun(parsed, port);
   const stem = `${PREPARED_XCTESTRUN_PREFIX}${port}-${process.pid}`;
-  const outPath = path5.join(path5.dirname(xctestrunPath), `${stem}.xctestrun`);
-  const jsonPath = path5.join(os2.tmpdir(), `${stem}.json`);
+  const outPath = path6.join(path6.dirname(xctestrunPath), `${stem}.xctestrun`);
+  const jsonPath = path6.join(os4.tmpdir(), `${stem}.json`);
   fs5.writeFileSync(jsonPath, JSON.stringify(injected));
   try {
     await runPlutil(["-convert", "xml1", jsonPath, "-o", outPath]);
@@ -2926,7 +2975,7 @@ function cleanupPreparedTestRun(preparedPath) {
   if (!preparedPath) {
     return;
   }
-  if (!path5.basename(preparedPath).startsWith(PREPARED_XCTESTRUN_PREFIX)) {
+  if (!path6.basename(preparedPath).startsWith(PREPARED_XCTESTRUN_PREFIX)) {
     return;
   }
   fs5.rmSync(preparedPath, { force: true });
@@ -2951,7 +3000,7 @@ async function resolveBundleId(app, runner, udid, coldStart, allowedApps) {
     }
     return app;
   }
-  const appPath = path5.resolve(app);
+  const appPath = path6.resolve(app);
   if (!fs5.existsSync(appPath)) {
     throw new Error(`.app bundle not found: ${appPath}`);
   }
@@ -3110,14 +3159,14 @@ async function healSelector(probe, selector, options) {
 
 // src/runner/history.ts
 import fs6 from "fs";
-import path6 from "path";
+import path7 from "path";
 var HISTORY_FILE = "history.json";
 var LOCK_FILE_SUFFIX = ".lock";
 var LOCK_RETRY_MS = 10;
 var LOCK_TIMEOUT_MS = 5e3;
 var SLEEP_BUFFER = new Int32Array(new SharedArrayBuffer(4));
 function historyPath(configDir) {
-  return path6.join(configDir, HISTORY_FILE);
+  return path7.join(configDir, HISTORY_FILE);
 }
 function isHistoryEntry(value) {
   if (!value || typeof value !== "object") {
@@ -3171,7 +3220,7 @@ function sleepSync(ms) {
 function withHistoryLock(configDir, fn) {
   const filePath = historyPath(configDir);
   const lockPath = `${filePath}${LOCK_FILE_SUFFIX}`;
-  fs6.mkdirSync(path6.dirname(filePath), { recursive: true });
+  fs6.mkdirSync(path7.dirname(filePath), { recursive: true });
   const startedAt = Date.now();
   while (Date.now() - startedAt < LOCK_TIMEOUT_MS) {
     let fd;
@@ -3212,11 +3261,11 @@ function appendEntry(configDir, entry, maxRuns) {
 
 // src/runner/index.ts
 import fs12 from "fs";
-import path12 from "path";
+import path13 from "path";
 
 // src/browser/playwright-driver.ts
 import fs7 from "fs";
-import path7 from "path";
+import path8 from "path";
 import {
   chromium,
   firefox,
@@ -3249,7 +3298,7 @@ async function launchBrowser(options) {
       }
     }
     if (options.recordHar) {
-      contextOptions.recordHar = { path: path7.join(options.runDir, "network.har") };
+      contextOptions.recordHar = { path: path8.join(options.runDir, "network.har") };
     }
     const context = await browser.newContext(contextOptions);
     const page = await context.newPage();
@@ -3257,7 +3306,7 @@ async function launchBrowser(options) {
     page.setDefaultNavigationTimeout(options.timeout);
     let tracePath;
     if (options.trace) {
-      tracePath = path7.join(options.runDir, "trace.zip");
+      tracePath = path8.join(options.runDir, "trace.zip");
       await context.tracing.start({ screenshots: true, snapshots: true, sources: true });
     }
     return { browser, context, page, tracePath };
@@ -3436,7 +3485,7 @@ function createPlaywrightDriver(page) {
 
 // src/runner/steps.ts
 import fs8 from "fs";
-import path8 from "path";
+import path9 from "path";
 
 // src/runner/policy.ts
 var ALWAYS_ALLOWED_PROTOCOLS = ["about:", "data:"];
@@ -4116,7 +4165,7 @@ async function runInlineAssert(driver, policy, assertion) {
   throw new Error("assert step is missing an assertion type");
 }
 function screenshotPath(screenshotsDir, fileName) {
-  return path8.join(screenshotsDir, fileName);
+  return path9.join(screenshotsDir, fileName);
 }
 function stepPath(prefix, index) {
   return prefix ? `${prefix}.${index}` : `${index}`;
@@ -4133,7 +4182,7 @@ function validateDownloadFilename(suggestedFilename) {
   const safeFilename = suggestedFilename.trim();
   const allowedFilenamePattern = /^[^<>:"/\\|?*]+$/;
   const hasControlCharacter = Array.from(safeFilename).some((char) => char.charCodeAt(0) < 32);
-  if (safeFilename.length === 0 || safeFilename !== suggestedFilename || safeFilename !== path8.basename(safeFilename) || safeFilename.includes("..") || /[/\\]/.test(safeFilename) || hasControlCharacter || !allowedFilenamePattern.test(safeFilename)) {
+  if (safeFilename.length === 0 || safeFilename !== suggestedFilename || safeFilename !== path9.basename(safeFilename) || safeFilename.includes("..") || /[/\\]/.test(safeFilename) || hasControlCharacter || !allowedFilenamePattern.test(safeFilename)) {
     throw new Error(`Invalid download filename: "${suggestedFilename}"`);
   }
   return safeFilename;
@@ -4313,7 +4362,7 @@ var STEP_HANDLERS = {
       if (!("setInputFiles" in h.step)) unknownStep();
       const resolvedInput = await h.policy.resolveActionSelector(h.step.setInputFiles.selector);
       const rawFiles = h.step.setInputFiles.files;
-      const resolveFile = (f) => path8.isAbsolute(f) ? f : path8.join(h.context.configDir, f);
+      const resolveFile = (f) => path9.isAbsolute(f) ? f : path9.join(h.context.configDir, f);
       const resolvedFiles = Array.isArray(rawFiles) ? rawFiles.map(resolveFile) : resolveFile(rawFiles);
       await h.driver.setInputFiles(resolvedInput.selector, resolvedFiles);
       h.policy.ensureLocationAllowed(h.driver);
@@ -4675,11 +4724,11 @@ var STEP_HANDLERS = {
         if (!responseFile) {
           throw new Error("mock.response must include either body or file");
         }
-        const candidateFilePath = path8.isAbsolute(responseFile) ? responseFile : path8.join(h.context.configDir, responseFile);
-        const resolvedConfigDir = path8.resolve(h.context.configDir);
-        const resolvedFilePath = path8.resolve(candidateFilePath);
-        const relativePath = path8.relative(resolvedConfigDir, resolvedFilePath);
-        const isWithinConfigDir = relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${path8.sep}`) && !path8.isAbsolute(relativePath);
+        const candidateFilePath = path9.isAbsolute(responseFile) ? responseFile : path9.join(h.context.configDir, responseFile);
+        const resolvedConfigDir = path9.resolve(h.context.configDir);
+        const resolvedFilePath = path9.resolve(candidateFilePath);
+        const relativePath = path9.relative(resolvedConfigDir, resolvedFilePath);
+        const isWithinConfigDir = relativePath === "" || relativePath !== ".." && !relativePath.startsWith(`..${path9.sep}`) && !path9.isAbsolute(relativePath);
         if (!isWithinConfigDir) {
           throw new Error("mock.response.file must resolve within config directory");
         }
@@ -4746,7 +4795,7 @@ var STEP_HANDLERS = {
     capabilities: ["evaluate"],
     run: async (h) => {
       if (!("runScript" in h.step)) unknownStep();
-      const filePath = path8.isAbsolute(h.step.runScript.file) ? h.step.runScript.file : path8.join(h.context.configDir, h.step.runScript.file);
+      const filePath = path9.isAbsolute(h.step.runScript.file) ? h.step.runScript.file : path9.join(h.context.configDir, h.step.runScript.file);
       const fileContents = fs8.readFileSync(filePath, "utf-8");
       await h.driver.evaluate(fileContents);
       return {
@@ -4768,11 +4817,11 @@ var STEP_HANDLERS = {
       const name = h.step.assertScreenshot.name;
       const threshold = h.step.assertScreenshot.threshold ?? 0.1;
       const baselineDir = ensureBaselineDir(h.context.configDir);
-      const baselinePath = path8.join(baselineDir, `${name}.png`);
-      const currentScreenshotPath = path8.join(h.context.runDir, "screenshots", `${name}-current.png`);
-      fs8.mkdirSync(path8.dirname(currentScreenshotPath), { recursive: true });
+      const baselinePath = path9.join(baselineDir, `${name}.png`);
+      const currentScreenshotPath = path9.join(h.context.runDir, "screenshots", `${name}-current.png`);
+      fs8.mkdirSync(path9.dirname(currentScreenshotPath), { recursive: true });
       await h.driver.screenshot({ path: currentScreenshotPath, fullPage: true });
-      h.screenshots.push(path8.join("screenshots", `${name}-current.png`));
+      h.screenshots.push(path9.join("screenshots", `${name}-current.png`));
       if (!fs8.existsSync(baselinePath)) {
         fs8.copyFileSync(currentScreenshotPath, baselinePath);
         return {
@@ -4780,7 +4829,7 @@ var STEP_HANDLERS = {
           result: { type: "assertScreenshot", status: "pass", durationMs: Date.now() - h.stepStart, value: "baseline created" }
         };
       }
-      const diffPath = path8.join(h.context.runDir, "screenshots", `${name}-diff.png`);
+      const diffPath = path9.join(h.context.runDir, "screenshots", `${name}-diff.png`);
       const comparison = await compareScreenshots(baselinePath, currentScreenshotPath, diffPath, threshold);
       if (comparison.match) {
         return {
@@ -4793,7 +4842,7 @@ var STEP_HANDLERS = {
           }
         };
       }
-      h.screenshots.push(path8.join("screenshots", `${name}-diff.png`));
+      h.screenshots.push(path9.join("screenshots", `${name}-diff.png`));
       throw new Error(
         `Visual regression: ${(comparison.diffPercentage * 100).toFixed(2)}% diff exceeds threshold ${(threshold * 100).toFixed(0)}%`
       );
@@ -4819,7 +4868,7 @@ var STEP_HANDLERS = {
       }
       const fileName = `assertWithAI_step_${h.index + 1}.png`;
       const relative = await h.addScreenshot(fileName);
-      const screenshotFullPath = path8.join(h.context.runDir, relative);
+      const screenshotFullPath = path9.join(h.context.runDir, relative);
       const imageBase64 = fs8.readFileSync(screenshotFullPath).toString("base64");
       const assertVision = h.context.assertVision ?? assertWithAiVision;
       const verdict = await assertVision(
@@ -4877,7 +4926,7 @@ var STEP_HANDLERS = {
           `Download filename mismatch: expected "${opts.filename}", got "${suggestedFilename}"`
         );
       }
-      const savePath = path8.join(h.context.runDir, suggestedFilename);
+      const savePath = path9.join(h.context.runDir, suggestedFilename);
       await download.saveAs(savePath);
       return {
         kind: "result",
@@ -4906,7 +4955,7 @@ async function executeSteps(context) {
     maxSteps: context.maxSteps,
     selfHealing: context.selfHealing
   });
-  const screenshotsDir = path8.join(context.runDir, "screenshots");
+  const screenshotsDir = path9.join(context.runDir, "screenshots");
   fs8.mkdirSync(screenshotsDir, { recursive: true });
   const currentHuntName = context.huntStack?.[context.huntStack.length - 1];
   policy.assertWithinMaxSteps(context.steps.length, currentHuntName);
@@ -4917,7 +4966,7 @@ async function executeSteps(context) {
   const addScreenshot = async (fileName) => {
     const fullPath = screenshotPath(screenshotsDir, fileName);
     await captureScreenshot2(driver, fullPath);
-    const relative = path8.join("screenshots", fileName);
+    const relative = path9.join("screenshots", fileName);
     screenshots.push(relative);
     return relative;
   };
@@ -5005,12 +5054,12 @@ async function executeSteps(context) {
   return { results, screenshots, failed: false };
 }
 async function captureFinalScreenshot(page, runDir) {
-  const screenshotsDir = path8.join(runDir, "screenshots");
+  const screenshotsDir = path9.join(runDir, "screenshots");
   fs8.mkdirSync(screenshotsDir, { recursive: true });
   const fileName = "final.png";
   const filePath = screenshotPath(screenshotsDir, fileName);
   await captureScreenshot2(page, filePath);
-  return path8.join("screenshots", fileName);
+  return path9.join("screenshots", fileName);
 }
 
 // src/runner/assertions.ts
@@ -5132,6 +5181,59 @@ async function evaluateAssertions(options) {
   }
   return results;
 }
+async function evaluateNativeAssertions(options) {
+  const assertions = mergeAssertions(options.config, options.huntAssertions);
+  const authoredTypes = new Set(
+    (options.huntAssertions ?? []).map((assertion) => Object.keys(assertion)[0])
+  );
+  const results = [];
+  const warnings = [];
+  for (const assertion of assertions) {
+    const type = Object.keys(assertion)[0] ?? "assertion";
+    try {
+      if ("selectorExists" in assertion) {
+        options.assertAllowedSelector?.(assertion.selectorExists);
+        const count = await options.driver.count(assertion.selectorExists);
+        results.push({
+          type: "selectorExists",
+          value: assertion.selectorExists,
+          status: count > 0 ? "pass" : "fail",
+          error: count > 0 ? void 0 : "Selector not found"
+        });
+        continue;
+      }
+      if ("selectorNotExists" in assertion) {
+        options.assertAllowedSelector?.(assertion.selectorNotExists);
+        const count = await options.driver.count(assertion.selectorNotExists);
+        results.push({
+          type: "selectorNotExists",
+          value: assertion.selectorNotExists,
+          status: count === 0 ? "pass" : "fail",
+          error: count === 0 ? void 0 : "Selector exists"
+        });
+        continue;
+      }
+      const rawValue = assertion[type];
+      results.push({
+        type,
+        value: rawValue,
+        status: "skipped",
+        error: `skipped (web-only): not supported on the ${options.targetLabel} target`
+      });
+      if (authoredTypes.has(type)) {
+        warnings.push(`${type} is web-only; skipped on ${options.targetLabel} target`);
+      }
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : "no error details";
+      results.push({
+        type,
+        status: "fail",
+        error: `Native assertion "${type}" failed: ${detail}`
+      });
+    }
+  }
+  return { results, warnings };
+}
 
 // src/runner/tracing.ts
 var DEFAULT_TRACE_HEADER = "traceparent";
@@ -5171,17 +5273,17 @@ function captureTraceCorrelation(response, headerName, sink, redactionValues = [
 
 // src/reporter/result.ts
 import fs9 from "fs";
-import path9 from "path";
+import path10 from "path";
 function writeResult(runDir, result) {
   const fileName = "result.json";
-  const fullPath = path9.join(runDir, fileName);
+  const fullPath = path10.join(runDir, fileName);
   fs9.writeFileSync(fullPath, JSON.stringify(result, null, 2));
   return fileName;
 }
 
 // src/reporter/summary.ts
 import fs10 from "fs";
-import path10 from "path";
+import path11 from "path";
 function escapeMd(text) {
   return text.replace(/([|`*_{}[\]()#+\-!\\])/g, "\\$1");
 }
@@ -5259,7 +5361,7 @@ function writeSummary(runDir, result) {
     }
   }
   const fileName = "summary.md";
-  const fullPath = path10.join(runDir, fileName);
+  const fullPath = path11.join(runDir, fileName);
   fs10.writeFileSync(fullPath, `${lines.join("\n")}
 `);
   return fileName;
@@ -5267,20 +5369,21 @@ function writeSummary(runDir, result) {
 
 // src/reporter/junit.ts
 import fs11 from "fs";
-import path11 from "path";
+import path12 from "path";
 function escapeXml(text) {
   return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 }
 function writeJunit(runDir, result) {
   const totalTests = result.steps.length + result.assertions.length;
   const failures = result.steps.filter((s) => s.status === "fail").length + result.assertions.filter((a) => a.status === "fail").length;
+  const skipped = result.assertions.filter((a) => a.status === "skipped").length;
   const timeSeconds = (result.durationMs / 1e3).toFixed(3);
   const huntName = escapeXml(result.hunt);
   const lines = [];
   lines.push('<?xml version="1.0" encoding="UTF-8"?>');
   lines.push("<testsuites>");
   lines.push(
-    `  <testsuite name="${huntName}" tests="${totalTests}" failures="${failures}" errors="0" time="${timeSeconds}" timestamp="${escapeXml(result.startedAt)}">`
+    `  <testsuite name="${huntName}" tests="${totalTests}" failures="${failures}" errors="0" skipped="${skipped}" time="${timeSeconds}" timestamp="${escapeXml(result.startedAt)}">`
   );
   for (let i = 0; i < result.steps.length; i++) {
     const step = result.steps[i];
@@ -5304,6 +5407,11 @@ function writeJunit(runDir, result) {
       lines.push(`    <testcase name="${caseName}" classname="${huntName}" time="0">`);
       lines.push(`      <failure message="${escapedFailureText}" type="assertion">${escapedFailureText}</failure>`);
       lines.push("    </testcase>");
+    } else if (assertion.status === "skipped") {
+      const skipText = escapeXml(assertion.error ?? "skipped");
+      lines.push(`    <testcase name="${caseName}" classname="${huntName}" time="0">`);
+      lines.push(`      <skipped message="${skipText}"/>`);
+      lines.push("    </testcase>");
     } else {
       lines.push(`    <testcase name="${caseName}" classname="${huntName}" time="0"/>`);
     }
@@ -5311,7 +5419,7 @@ function writeJunit(runDir, result) {
   lines.push("  </testsuite>");
   lines.push("</testsuites>");
   const fileName = "junit.xml";
-  const fullPath = path11.join(runDir, fileName);
+  const fullPath = path12.join(runDir, fileName);
   fs11.writeFileSync(fullPath, `${lines.join("\n")}
 `);
   return fileName;
@@ -5354,11 +5462,11 @@ function parseViewportFlag(value) {
   return value;
 }
 function resolvePath(configDir, inputPath) {
-  if (path12.isAbsolute(inputPath)) {
+  if (path13.isAbsolute(inputPath)) {
     return inputPath;
   }
-  const projectRoot = path12.dirname(configDir);
-  return path12.join(projectRoot, inputPath);
+  const projectRoot = path13.dirname(configDir);
+  return path13.join(projectRoot, inputPath);
 }
 function buildRunResult(options) {
   return {
@@ -5377,7 +5485,7 @@ function buildRunResult(options) {
 }
 function writeConsoleLog(runDir, entries) {
   const fileName = "console.log";
-  const filePath = path12.join(runDir, fileName);
+  const filePath = path13.join(runDir, fileName);
   const lines = entries.map((entry) => {
     const location = entry.location ? ` (${entry.location})` : "";
     return `[${entry.type}] ${entry.text}${location}`;
@@ -5390,7 +5498,7 @@ async function executeHuntAttempt(options, config, configDir, interpolatedHunt,
   const headless = options.headed ? false : config.browser.headless;
   const slowMo = options.slowMo ?? config.browser.slowMo;
   const maxSteps = config.guardrails.maxSteps;
-  const runDir = path12.join(configDir, "runs", timestamp());
+  const runDir = path13.join(configDir, "runs", timestamp());
   fs12.mkdirSync(runDir, { recursive: true });
   const storageStatePath = config.auth.storageStatePath ? resolvePath(configDir, config.auth.storageStatePath) : void 0;
   const engine = options.browser ?? config.browser.engine;
@@ -5574,7 +5682,7 @@ async function runHunt(options) {
 }
 async function executeNativeHuntAttempt(options, config, configDir, interpolatedHunt, redactedFillSteps, randomVars, allowedApps, native) {
   const maxSteps = config.guardrails.maxSteps;
-  const runDir = path12.join(configDir, "runs", timestamp());
+  const runDir = path13.join(configDir, "runs", timestamp());
   fs12.mkdirSync(runDir, { recursive: true });
   const session = await native.launchSession();
   let result;
@@ -5583,6 +5691,13 @@ async function executeNativeHuntAttempt(options, config, configDir, interpolated
     const appIdentity = native.sessionAppIdentity(session);
     const targetLabel = `${native.targetType}:${appIdentity}`;
     const effectiveAllowedApps = [.../* @__PURE__ */ new Set([...allowedApps, native.targetApp, appIdentity])];
+    const assertionPolicy = createRunPolicy(driver, {
+      forbiddenSelectors: config.guardrails.forbiddenSelectors,
+      allowedDomains: [],
+      allowedApps: effectiveAllowedApps,
+      maxSteps,
+      selfHealing: config.guardrails.selfHealing
+    });
     const startedAt = (/* @__PURE__ */ new Date()).toISOString();
     const startTime = Date.now();
     let stepResults = [];
@@ -5622,8 +5737,19 @@ async function executeNativeHuntAttempt(options, config, configDir, interpolated
     } catch {
       finalScreenshot = void 0;
     }
+    const { results: assertionResults, warnings: assertionWarnings } = await evaluateNativeAssertions({
+      driver,
+      config,
+      huntAssertions: interpolatedHunt.assertions,
+      assertAllowedSelector: assertionPolicy.assertAllowedSelector,
+      targetLabel: nativeTargetLabel(native.targetType)
+    });
+    for (const warning of assertionWarnings) {
+      console.warn(warning);
+    }
     const durationMs = Date.now() - startTime;
-    const status = stepFailed ? "fail" : "pass";
+    const assertionsFailed = assertionResults.some((assertion) => assertion.status === "fail");
+    const status = stepFailed || assertionsFailed ? "fail" : "pass";
     const artifacts = {
       screenshots: finalScreenshot ? [...stepScreenshots, finalScreenshot] : stepScreenshots
     };
@@ -5634,7 +5760,7 @@ async function executeNativeHuntAttempt(options, config, configDir, interpolated
       hunt: options.huntName,
       targetUrl: targetLabel,
       steps: stepResults,
-      assertions: [],
+      assertions: assertionResults,
       artifacts
     });
     result = writeReports(runDir, runResult, { junit: options.junit ?? config.artifacts.junit });
@@ -5747,7 +5873,6 @@ async function runNativeHunt(options, config, configDir, target, native) {
   const hunt = loadHunt(options.huntName, configDir);
   const { hunt: interpolatedHunt, redactedFillSteps, randomVars } = interpolateHunt(hunt, process.env);
   assertStepsSupportedByTarget(interpolatedHunt.steps, native.targetType);
-  assertHuntAssertionsSupportedByTarget(interpolatedHunt.assertions, native.targetType);
   native.assertAppAllowed(config.guardrails.allowedApps, target);
   const maxSteps = config.guardrails.maxSteps;
   if (interpolatedHunt.steps.length > maxSteps) {
@@ -5788,7 +5913,7 @@ async function runNativeHunt(options, config, configDir, target, native) {
 }
 function recordHistory(configDir, outcome, maxRuns) {
   try {
-    const relativeRunDir = path12.relative(configDir, outcome.runDir);
+    const relativeRunDir = path13.relative(configDir, outcome.runDir);
     appendEntry(
       configDir,
       {
@@ -5910,7 +6035,7 @@ function clusterFailures(failures) {
 
 // src/backlog/index.ts
 import fs13 from "fs";
-import path13 from "path";
+import path14 from "path";
 
 // src/backlog/parse.ts
 var MARKER_FP = /<!--\s*prowl:fp=([0-9a-f]+)/;
@@ -6016,7 +6141,7 @@ function buildFailure(hunt) {
   if (!hunt.runDir) return failure;
   let run;
   try {
-    const resultJson = readFileOrEmpty(path13.join(hunt.runDir, "result.json"));
+    const resultJson = readFileOrEmpty(path14.join(hunt.runDir, "result.json"));
     if (!resultJson) return failure;
     run = JSON.parse(resultJson);
   } catch (error) {
@@ -6045,8 +6170,8 @@ function extractFailures(suiteResult) {
 }
 function updateBacklogFromSuite(suiteResult, options = {}) {
   const projectRoot = options.projectRoot ?? process.cwd();
-  const backlogPath = options.backlogPath ?? path13.join(projectRoot, "docs", "backlog.md");
-  const resolvedPath = options.resolvedPath ?? path13.join(projectRoot, "docs", "resolved.md");
+  const backlogPath = options.backlogPath ?? path14.join(projectRoot, "docs", "backlog.md");
+  const resolvedPath = options.resolvedPath ?? path14.join(projectRoot, "docs", "resolved.md");
   const date = options.date ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const summary = { created: [], regressions: [], skipped: [], backlogPath };
   const failures = extractFailures(suiteResult);
@@ -6078,18 +6203,18 @@ function updateBacklogFromSuite(suiteResult, options = {}) {
     }
   }
   if (ticketsToAdd.length > 0) {
-    fs13.mkdirSync(path13.dirname(backlogPath), { recursive: true });
+    fs13.mkdirSync(path14.dirname(backlogPath), { recursive: true });
     fs13.writeFileSync(backlogPath, insertTickets(backlogContent, ticketsToAdd));
   }
   return summary;
 }
 
 // src/runner/suite.ts
-import path15 from "path";
+import path16 from "path";
 
 // src/reporter/ci-summary.ts
 import fs14 from "fs";
-import path14 from "path";
+import path15 from "path";
 import chalk from "chalk";
 function countCiResults(results) {
   return {
@@ -6154,7 +6279,7 @@ function writeCiResult(ciRunDir, results, startedAt, totalDurationMs, flaky = []
     ...clusters.length > 0 ? { clusters } : {}
   };
   fs14.mkdirSync(ciRunDir, { recursive: true });
-  const filePath = path14.join(ciRunDir, "ci-result.json");
+  const filePath = path15.join(ciRunDir, "ci-result.json");
   fs14.writeFileSync(filePath, JSON.stringify(ciResult, null, 2) + "\n");
   return filePath;
 }
@@ -6340,7 +6465,7 @@ async function runSuite(options = {}) {
   const clusters = clusterFailures(
     extractFailures({ result: { hunts: results }, resultPath: null })
   ).filter((cluster) => cluster.count > 1);
-  const ciRunDir = path15.join(configDir, "runs", timestamp("ci"));
+  const ciRunDir = path16.join(configDir, "runs", timestamp("ci"));
   const resultPath = writeCiResult(ciRunDir, results, startedAt, totalDurationMs, flaky, clusters);
   const { passed, failed, skipped } = countCiResults(results);
   return {
@@ -7015,6 +7140,298 @@ async function generateHunt(options) {
   return yamlStr;
 }
 
+// src/browser/macdriver-install.ts
+import { execFile as execFile5 } from "child_process";
+import { createHash as createHash2 } from "crypto";
+import fs15 from "fs";
+import os5 from "os";
+import path17 from "path";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile5);
+function parseChecksumFile(text) {
+  const token = text.trim().split(/\s+/, 1)[0] ?? "";
+  const digest = token.toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(digest)) {
+    throw new Error(`Malformed .sha256 checksum file (expected a 64-char hex digest, got: ${text.trim().slice(0, 80)})`);
+  }
+  return digest;
+}
+function sha256Hex(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+var commandRunner = async (file, args) => execFileAsync(file, args);
+function commandOutput(result) {
+  return [result.stdout, result.stderr].filter((value) => value !== void 0).map((value) => value.toString()).join("\n").trim();
+}
+function commandErrorDetail(error) {
+  const err = error;
+  return [err.stderr, err.stdout, err.message].filter((value) => value !== void 0 && value !== "").map((value) => value.toString()).join("\n").trim();
+}
+async function runRequiredCommand(run, binaryPath, command, args, label) {
+  try {
+    return await run(command, args);
+  } catch (error) {
+    const detail = commandErrorDetail(error);
+    throw new Error(`${label} failed for ${binaryPath}${detail ? `: ${detail}` : ""}`);
+  }
+}
+var zipinfoArchiveLister = async (zipPath) => {
+  try {
+    const { stdout } = await execFileAsync("zipinfo", ["-1", zipPath]);
+    return stdout.toString().split(/\r?\n/).filter((entry) => entry.length > 0);
+  } catch (error) {
+    const detail = commandErrorDetail(error);
+    throw new Error(`Failed to inspect release archive ${zipPath} with zipinfo${detail ? `: ${detail}` : ""}`);
+  }
+};
+function normalizeArchiveEntryName(entry) {
+  if (entry.length === 0 || entry !== entry.trim() || entry.includes("\0") || entry.includes("\\")) {
+    throw new Error(`Unsafe path in prowl-macdriver release archive: ${JSON.stringify(entry)}`);
+  }
+  if (entry.endsWith("/")) {
+    throw new Error(`Unexpected directory in prowl-macdriver release archive: ${entry}`);
+  }
+  if (path17.posix.isAbsolute(entry)) {
+    throw new Error(`Unsafe absolute path in prowl-macdriver release archive: ${entry}`);
+  }
+  const parts = entry.split("/");
+  if (parts.some((part) => part === "" || part === "." || part === "..")) {
+    throw new Error(`Unsafe path in prowl-macdriver release archive: ${entry}`);
+  }
+  return entry;
+}
+function validateMacdriverArchiveEntries(entries) {
+  const normalized = entries.map(normalizeArchiveEntryName);
+  if (normalized.length !== 1 || normalized[0] !== HELPER_BINARY) {
+    const shown = normalized.length > 0 ? normalized.join(", ") : "(empty archive)";
+    throw new Error(
+      `Unexpected prowl-macdriver release archive contents: ${shown}. Expected exactly "${HELPER_BINARY}" at the archive root.`
+    );
+  }
+}
+var dittoExtractor = async (zipPath, destDir) => {
+  await execFileAsync("ditto", ["-x", "-k", zipPath, destDir]);
+};
+function parseCodesignDetails(text) {
+  const details = { identifier: null, authorities: [], teamIdentifier: null };
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("Identifier=")) {
+      details.identifier = trimmed.slice("Identifier=".length);
+    } else if (trimmed.startsWith("Authority=")) {
+      details.authorities.push(trimmed.slice("Authority=".length));
+    } else if (trimmed.startsWith("TeamIdentifier=")) {
+      details.teamIdentifier = trimmed.slice("TeamIdentifier=".length);
+    }
+  }
+  return details;
+}
+function validateCodesignDetails(details, binaryPath) {
+  if (details.identifier !== MACDRIVER_SIGNING_IDENTIFIER) {
+    throw new Error(
+      `codesign verification failed for ${binaryPath}: expected identifier "${MACDRIVER_SIGNING_IDENTIFIER}", got "${details.identifier ?? "missing"}"`
+    );
+  }
+  const developerIdAuthority = details.authorities.find(
+    (authority) => authority.startsWith(`${MACDRIVER_SIGNING_AUTHORITY_PREFIX} (`)
+  );
+  const authorityTeamId = developerIdAuthority?.match(/\(([A-Z0-9]{10})\)$/)?.[1] ?? null;
+  if (!developerIdAuthority || !authorityTeamId) {
+    const shown = details.authorities.length > 0 ? details.authorities.join(" / ") : "missing";
+    throw new Error(
+      `codesign verification failed for ${binaryPath}: expected ${MACDRIVER_SIGNING_AUTHORITY_PREFIX} signer, got ${shown}`
+    );
+  }
+  if (!details.teamIdentifier) {
+    throw new Error(`codesign verification failed for ${binaryPath}: missing TeamIdentifier`);
+  }
+  if (details.teamIdentifier !== authorityTeamId) {
+    throw new Error(
+      `codesign verification failed for ${binaryPath}: TeamIdentifier ${details.teamIdentifier} does not match Developer ID authority team ${authorityTeamId}`
+    );
+  }
+}
+async function verifyMacdriverSignature(binaryPath, run = commandRunner) {
+  await runRequiredCommand(run, binaryPath, "codesign", ["--verify", "--strict", binaryPath], "codesign verification");
+  const display = await runRequiredCommand(
+    run,
+    binaryPath,
+    "codesign",
+    ["--display", "--verbose=4", binaryPath],
+    "codesign detail inspection"
+  );
+  validateCodesignDetails(parseCodesignDetails(commandOutput(display)), binaryPath);
+  await runRequiredCommand(
+    run,
+    binaryPath,
+    "spctl",
+    ["--assess", "--type", "execute", "--verbose=4", binaryPath],
+    "spctl assessment"
+  );
+}
+var codesignVerifier = async (binaryPath) => {
+  await verifyMacdriverSignature(binaryPath);
+};
+async function downloadAndVerify(options = {}) {
+  const version = options.version ?? MACDRIVER_VERSION;
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const assetName = macdriverAssetName(version);
+  const zipUrl = macdriverAssetUrl(assetName, version);
+  const sumUrl = macdriverAssetUrl(macdriverChecksumName(version), version);
+  const [zipRes, sumRes] = await Promise.all([
+    fetchImpl(zipUrl, { redirect: "follow" }),
+    fetchImpl(sumUrl, { redirect: "follow" })
+  ]);
+  if (zipRes.status === 404 || sumRes.status === 404) {
+    throw new Error(
+      `No published prowl-macdriver release for ${macdriverReleaseTag(version)} yet.
+The signed binary is cut by the maintainer; until then build from source:
+  cd macdriver && swift build -c release`
+    );
+  }
+  if (!zipRes.ok) {
+    throw new Error(`Failed to download ${assetName} (HTTP ${zipRes.status}) from ${zipUrl}`);
+  }
+  if (!sumRes.ok) {
+    throw new Error(`Failed to download the checksum (HTTP ${sumRes.status}) from ${sumUrl}`);
+  }
+  const zipBytes = Buffer.from(await zipRes.arrayBuffer());
+  const expected = parseChecksumFile(await sumRes.text());
+  const actual = sha256Hex(zipBytes);
+  if (actual !== expected) {
+    throw new Error(
+      `Checksum mismatch for ${assetName}.
+  expected: ${expected}
+  actual:   ${actual}
+The download was rejected and discarded; re-run the install, and report it if it repeats.`
+    );
+  }
+  return zipBytes;
+}
+async function installMacdriver(options = {}) {
+  const version = validateMacdriverVersion(options.version ?? MACDRIVER_VERSION);
+  const homedir = options.homedir ?? os5.homedir();
+  const listArchiveEntries = options.listArchiveEntries ?? zipinfoArchiveLister;
+  const extract = options.extract ?? dittoExtractor;
+  const verifySignature = options.verifySignature ?? codesignVerifier;
+  const installRoot = macdriverInstallRoot(homedir);
+  const versionDir = macdriverVersionDir(version, homedir);
+  const binaryPath = macdriverInstalledBinary(version, homedir);
+  if (!options.force && fs15.existsSync(binaryPath)) {
+    return { version, binaryPath, alreadyInstalled: true };
+  }
+  const zipBytes = await downloadAndVerify({ version, fetchImpl: options.fetchImpl });
+  fs15.mkdirSync(installRoot, { recursive: true });
+  const stagingDir = fs15.mkdtempSync(path17.join(installRoot, `.tmp-${version}-`));
+  const extractDir = path17.join(stagingDir, "extract");
+  const zipPath = path17.join(stagingDir, macdriverAssetName(version));
+  try {
+    fs15.mkdirSync(extractDir);
+    fs15.writeFileSync(zipPath, zipBytes);
+    validateMacdriverArchiveEntries(await listArchiveEntries(zipPath));
+    await extract(zipPath, extractDir);
+    const stagedBinaryPath = path17.join(extractDir, HELPER_BINARY);
+    assertExtractedHelper(extractDir, stagedBinaryPath);
+    fs15.chmodSync(stagedBinaryPath, 493);
+    await verifySignature(stagedBinaryPath);
+    replaceVersionDir(versionDir, extractDir, installRoot);
+  } finally {
+    fs15.rmSync(stagingDir, { recursive: true, force: true });
+  }
+  return { version, binaryPath, alreadyInstalled: false };
+}
+function assertExtractedHelper(extractDir, binaryPath) {
+  const entries = fs15.readdirSync(extractDir);
+  if (!entries.includes(HELPER_BINARY)) {
+    throw new Error(`The release archive did not contain a "${HELPER_BINARY}" binary.`);
+  }
+  if (entries.length !== 1 || entries[0] !== HELPER_BINARY) {
+    const shown = entries.length > 0 ? entries.join(", ") : "(empty directory)";
+    throw new Error(
+      `Unexpected extracted prowl-macdriver archive contents: ${shown}. Expected exactly "${HELPER_BINARY}".`
+    );
+  }
+  let stat = null;
+  try {
+    stat = fs15.lstatSync(binaryPath);
+  } catch {
+  }
+  if (!stat?.isFile()) {
+    throw new Error(`The release archive "${HELPER_BINARY}" entry is not a regular file.`);
+  }
+}
+function replaceVersionDir(versionDir, stagedVersionDir, installRoot) {
+  const backupDir = path17.join(installRoot, `.previous-${path17.basename(versionDir)}-${process.pid}-${Date.now()}`);
+  let backedUp = false;
+  try {
+    if (fs15.existsSync(versionDir)) {
+      fs15.renameSync(versionDir, backupDir);
+      backedUp = true;
+    }
+    fs15.renameSync(stagedVersionDir, versionDir);
+    if (backedUp) {
+      fs15.rmSync(backupDir, { recursive: true, force: true });
+    }
+  } catch (error) {
+    if (backedUp && !fs15.existsSync(versionDir) && fs15.existsSync(backupDir)) {
+      fs15.renameSync(backupDir, versionDir);
+    }
+    throw error;
+  }
+}
+var runVersionProbe = async (binaryPath) => {
+  try {
+    const { stdout } = await execFileAsync(binaryPath, ["version"], { timeout: 5e3 });
+    const match = stdout.match(/prowl-macdriver\s+(\S+)/);
+    return match ? match[1] : stdout.trim() || null;
+  } catch {
+    return null;
+  }
+};
+async function collectMacdriverStatus(options = {}) {
+  const env = options.env ?? process.env;
+  const homedir = options.homedir ?? os5.homedir();
+  const probe = options.probe ?? runVersionProbe;
+  let resolved = null;
+  try {
+    const resolvedPath = resolveHelperBinary(env, { homedir });
+    resolved = { path: resolvedPath, source: classifyResolvedSource(resolvedPath, env, homedir) };
+  } catch {
+    resolved = null;
+  }
+  const installed = [];
+  const root = macdriverInstallRoot(homedir);
+  if (fs15.existsSync(root)) {
+    for (const entry of fs15.readdirSync(root, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      let binaryPath;
+      try {
+        binaryPath = macdriverInstalledBinary(entry.name, homedir);
+      } catch {
+        continue;
+      }
+      if (fs15.existsSync(binaryPath)) {
+        installed.push({ version: entry.name, binaryPath });
+      }
+    }
+    installed.sort((a, b) => a.version.localeCompare(b.version));
+  }
+  const probedVersion = resolved ? await probe(resolved.path) : null;
+  return { resolved, pinnedVersion: MACDRIVER_VERSION, installed, probedVersion };
+}
+function classifyResolvedSource(resolvedPath, env, homedir) {
+  if (env.PROWL_MACDRIVER_BIN && resolvedPath === env.PROWL_MACDRIVER_BIN) {
+    return "env";
+  }
+  if (resolvedPath.startsWith(macdriverInstallRoot(homedir) + path17.sep)) {
+    return "user-install";
+  }
+  return "source-build";
+}
+function tccGuidance() {
+  return "macOS permissions: the app that hosts Prowl (your terminal \u2014 Terminal, iTerm, VS Code, \u2026)\nmust be granted, in System Settings \u2192 Privacy & Security:\n  \u2022 Accessibility \u2014 required to drive the target app\n  \u2022 Screen Recording \u2014 required for screenshots / visual baselines\nGrant both to the terminal app, not to prowl-macdriver itself, then re-run your hunt.";
+}
+
 export {
   interpolateHunt,
   WEB_ONLY_STEP_TYPES,
@@ -7032,6 +7449,20 @@ export {
   createPlaywrightDriver,
   parseMacSelector,
   createMacDriver,
+  HELPER_BINARY,
+  MACDRIVER_VERSION,
+  MACDRIVER_REPO,
+  MACDRIVER_SIGNING_IDENTIFIER,
+  MACDRIVER_SIGNING_AUTHORITY_PREFIX,
+  MACDRIVER_VERSION_PATTERN,
+  validateMacdriverVersion,
+  macdriverReleaseTag,
+  macdriverAssetName,
+  macdriverChecksumName,
+  macdriverAssetUrl,
+  macdriverInstallRoot,
+  macdriverVersionDir,
+  macdriverInstalledBinary,
   macdriverBuildInstructions,
   resolveHelperBinary,
   DEFAULT_REQUEST_TIMEOUT_MS,
@@ -7145,6 +7576,19 @@ export {
   matchIosSelector,
   isIosInteractive,
   analyzeIosApp,
-  generateHunt
+  generateHunt,
+  parseChecksumFile,
+  sha256Hex,
+  zipinfoArchiveLister,
+  validateMacdriverArchiveEntries,
+  dittoExtractor,
+  parseCodesignDetails,
+  verifyMacdriverSignature,
+  codesignVerifier,
+  downloadAndVerify,
+  installMacdriver,
+  runVersionProbe,
+  collectMacdriverStatus,
+  tccGuidance
 };
-//# sourceMappingURL=chunk-5KQR3IR3.js.map
+//# sourceMappingURL=chunk-R7NUH44M.js.map