sootsim 0.1.294 → 0.1.296

package/dist-lib/skills.cjs

@@ -1,4 +1,4 @@
-/*! sootsim v0.1.294 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
+/*! sootsim v0.1.296 | (c) 2026 Tamagui LLC | Proprietary — see LICENSE */
 let __sootsim_import_meta_url = ''; try { __sootsim_import_meta_url = require('url').pathToFileURL(__filename).href; } catch {}
 "use strict";
 var __create = Object.create;
@@ -474,10 +474,10 @@ var init_registry = __esm({
           },
           {
             range: ">=4.0.0",
-            coverage: 0.96,
-            note: "core animations, gestures, scroll, layout transitions, keyboard, sensors, reduced motion, and native view property reads",
-            working: "useSharedValue, useAnimatedStyle/Props/Reaction, useDerivedValue, useAnimatedScrollHandler, useScrollViewOffset, useFrameCallback, useAnimatedRef, useAnimatedKeyboard, useAnimatedSensor, useReducedMotion, entering/exiting/layout transitions, withTiming/Spring/Decay/Delay/Sequence/Repeat/Clamp, interpolate, interpolateColor, runOnJS/UI, measure, scrollTo, getViewProp (layout, opacity, zIndex, backgroundColor, boxShadow), Easing, createAnimatedComponent, Animated.View/Text/Image/ScrollView/FlatList",
-            missing: "Reanimated 4 native CSS keyframes/transitions and direct setViewStyle remain incomplete"
+            coverage: 0.97,
+            note: "core animations, gestures, scroll, layout transitions, keyboard, sensors, reduced motion, native view property reads, and direct static style snapshots",
+            working: "useSharedValue, useAnimatedStyle/Props/Reaction, useDerivedValue, useAnimatedScrollHandler, useScrollViewOffset, useFrameCallback, useAnimatedRef, useAnimatedKeyboard, useAnimatedSensor, useReducedMotion, entering/exiting/layout transitions, withTiming/Spring/Decay/Delay/Sequence/Repeat/Clamp, interpolate, interpolateColor, runOnJS/UI, measure, scrollTo, getViewProp (layout, opacity, zIndex, backgroundColor, boxShadow), direct setViewStyle snapshots, Easing, createAnimatedComponent, Animated.View/Text/Image/ScrollView/FlatList",
+            missing: "Reanimated 4 native CSS keyframes and transitions remain incomplete"
           }
         ]
       },
@@ -10490,18 +10490,24 @@ function detectFramework(deps) {
   if (deps["react-native"]) return "bare";
   return "unknown";
 }
-function isRNEcosystemPackage(name) {
+function isRNEcosystemPackage(name, data) {
   if (NON_RN_PACKAGES.has(name)) return false;
-  return name.startsWith("react-native") || name.startsWith("expo-") || name.startsWith("@react-native") || name.startsWith("@shopify/") || name.startsWith("@gorhom/") || name.startsWith("@callstack/") || POLYFILL_REGISTRY[name] !== void 0 || UNSUPPORTABLE.has(name);
+  return name.startsWith("react-native") || name.startsWith("expo-") || name.startsWith("@react-native") || name.startsWith("@shopify/") || name.startsWith("@gorhom/") || name.startsWith("@callstack/") || data.registry[name] !== void 0 || data.unsupported.includes(name);
 }
 function scanDeps(pkg) {
+  return scanDepsWithData(pkg, {
+    registry: POLYFILL_REGISTRY,
+    unsupported: [...UNSUPPORTABLE]
+  });
+}
+function scanDepsWithData(pkg, data) {
   const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
   const framework = detectFramework(allDeps);
   const rnVersion = allDeps["react-native"] || null;
   const packages = [];
   for (const [name, version] of Object.entries(allDeps)) {
-    if (!isRNEcosystemPackage(name)) continue;
-    if (UNSUPPORTABLE.has(name)) {
+    if (!isRNEcosystemPackage(name, data)) continue;
+    if (data.unsupported.includes(name)) {
       packages.push({
         name,
         version,
@@ -10511,14 +10517,14 @@ function scanDeps(pkg) {
       });
       continue;
     }
-    const entry = POLYFILL_REGISTRY[name];
+    const entry = data.registry[name];
     if (!entry) {
       packages.push({
         name,
         version,
         coverage: 0.3,
         status: "auto-stub",
-        note: "auto-stub (basic no-op proxy)"
+        note: "not yet verified; it may work through SootSim's generic native seam"
       });
       continue;
     }
@@ -10539,7 +10545,7 @@ function scanDeps(pkg) {
         version,
         coverage: 0.3,
         status: "auto-stub",
-        note: "version not matched"
+        note: "not yet verified for this version"
       });
       continue;
     }
@@ -10596,18 +10602,106 @@ var init_scan = __esm({
   }
 });
 
+// ../compat/src/scan-summary.ts
+function countScanResults(result) {
+  const counts = {
+    supported: 0,
+    partial: 0,
+    unsupported: 0,
+    notYetVerified: 0,
+    notRelevant: 0
+  };
+  for (const pkg of result.packages) {
+    switch (pkg.status) {
+      case "full":
+        counts.supported++;
+        break;
+      case "partial":
+        counts.partial++;
+        break;
+      case "unsupported":
+        counts.unsupported++;
+        break;
+      case "auto-stub":
+        counts.notYetVerified++;
+        break;
+      case "not-relevant":
+        counts.notRelevant++;
+        break;
+    }
+  }
+  return counts;
+}
+function formatScanCounts(result) {
+  const counts = countScanResults(result);
+  return [
+    `${counts.supported} supported`,
+    `${counts.partial} partial`,
+    `${counts.unsupported} unsupported`,
+    `${counts.notYetVerified} not yet verified`
+  ].join(", ");
+}
+function formatPackageStatus(pkg) {
+  switch (pkg.status) {
+    case "full":
+      return "supported";
+    case "partial":
+      return "partial";
+    case "unsupported":
+      return "unsupported";
+    case "auto-stub":
+      return "not yet verified";
+    case "not-relevant":
+      return "not relevant at runtime";
+  }
+}
+function formatDetailedScanLines(result) {
+  const lines = [];
+  const actionable = result.packages.filter(
+    (pkg) => pkg.status === "partial" || pkg.status === "unsupported"
+  );
+  for (const pkg of actionable) {
+    lines.push(`${formatPackageStatus(pkg)}: ${pkg.name}@${pkg.version} \u2014 ${pkg.note}`);
+  }
+  const unknown = result.packages.filter((pkg) => pkg.status === "auto-stub");
+  if (unknown.length > 0) {
+    lines.push("Not yet verified:");
+    for (const pkg of unknown) {
+      lines.push(`  ${pkg.name}@${pkg.version} \u2014 ${pkg.note}`);
+    }
+    lines.push(
+      "SootSim may still work. The simulator will report a concrete runtime error if it finds a gap."
+    );
+  }
+  return lines;
+}
+var COMPAT_RESULT_CAVEAT;
+var init_scan_summary = __esm({
+  "../compat/src/scan-summary.ts"() {
+    "use strict";
+    COMPAT_RESULT_CAVEAT = "This is a dependency-level estimate, not a guarantee that every app path works.";
+  }
+});
+
 // ../compat/src/web.ts
 var web_exports = {};
 __export(web_exports, {
   COMPAT_CATEGORIES: () => COMPAT_CATEGORIES,
+  COMPAT_RESULT_CAVEAT: () => COMPAT_RESULT_CAVEAT,
   POLYFILL_REGISTRY: () => POLYFILL_REGISTRY,
   UNSUPPORTABLE: () => UNSUPPORTABLE,
-  scanDeps: () => scanDeps
+  countScanResults: () => countScanResults,
+  formatDetailedScanLines: () => formatDetailedScanLines,
+  formatPackageStatus: () => formatPackageStatus,
+  formatScanCounts: () => formatScanCounts,
+  scanDeps: () => scanDeps,
+  scanDepsWithData: () => scanDepsWithData
 });
 var init_web = __esm({
   "../compat/src/web.ts"() {
     "use strict";
     init_scan();
+    init_scan_summary();
     init_registry();
   }
 });
@@ -10616,6 +10710,7 @@ var init_web = __esm({
 var bridge_constants_exports = {};
 __export(bridge_constants_exports, {
   DEFAULT_SOOTSIM_BRIDGE_PORT: () => DEFAULT_SOOTSIM_BRIDGE_PORT,
+  DEFAULT_SOOTSIM_BRIDGE_URL: () => DEFAULT_SOOTSIM_BRIDGE_URL,
   SOOTSIM_BRIDGE_SIM_CLOSE_CODE: () => SOOTSIM_BRIDGE_SIM_CLOSE_CODE,
   SOOTSIM_BRIDGE_SIM_CLOSE_REASON: () => SOOTSIM_BRIDGE_SIM_CLOSE_REASON,
   resolveSootsimBridgePort: () => resolveSootsimBridgePort,
@@ -10714,11 +10809,12 @@ function resolveSootsimBridgeWebSocketUrl(input) {
     href: input.href
   });
 }
-var DEFAULT_SOOTSIM_BRIDGE_PORT, CONTRAST_DEV_HTTP_BASE_PORT, SOOTSIM_SITE_DEV_HTTP_BASE_PORT, SOOTSIM_SHELL_DEV_HTTP_BASE_PORT, LOCAL_DEV_HTTP_BASE_PORTS, MAX_LOCAL_DEV_PORT_OFFSET, SOOTSIM_BRIDGE_SIM_CLOSE_CODE, SOOTSIM_BRIDGE_SIM_CLOSE_REASON;
+var DEFAULT_SOOTSIM_BRIDGE_PORT, DEFAULT_SOOTSIM_BRIDGE_URL, CONTRAST_DEV_HTTP_BASE_PORT, SOOTSIM_SITE_DEV_HTTP_BASE_PORT, SOOTSIM_SHELL_DEV_HTTP_BASE_PORT, LOCAL_DEV_HTTP_BASE_PORTS, MAX_LOCAL_DEV_PORT_OFFSET, SOOTSIM_BRIDGE_SIM_CLOSE_CODE, SOOTSIM_BRIDGE_SIM_CLOSE_REASON;
 var init_bridge_constants = __esm({
   "src/bridge-constants.ts"() {
     "use strict";
     DEFAULT_SOOTSIM_BRIDGE_PORT = 7668;
+    DEFAULT_SOOTSIM_BRIDGE_URL = `http://localhost:${DEFAULT_SOOTSIM_BRIDGE_PORT}/`;
     CONTRAST_DEV_HTTP_BASE_PORT = 3e3;
     SOOTSIM_SITE_DEV_HTTP_BASE_PORT = 3001;
     SOOTSIM_SHELL_DEV_HTTP_BASE_PORT = 5173;
@@ -10738,7 +10834,7 @@ function hasOwnKeys(value) {
 }
 function hasSootSimConfig(config) {
   if (!config) return false;
-  return hasOwnKeys(config.modules) || hasOwnKeys(config.turboModules) || hasOwnKeys(config.nativeModules) || hasOwnKeys(config.env) || hasOwnKeys(config.network?.remap) || hasOwnKeys(config.settings) || hasOwnKeys(config.initialState);
+  return typeof config.runtimeVersion === "string" && config.runtimeVersion.length > 0 || hasOwnKeys(config.modules) || hasOwnKeys(config.turboModules) || hasOwnKeys(config.nativeModules) || hasOwnKeys(config.env) || hasOwnKeys(config.network?.remap) || hasOwnKeys(config.settings) || hasOwnKeys(config.initialState);
 }
 function applySootSimConfigToUrl(url, config) {
   const parsed = new URL(url);
@@ -11783,7 +11879,7 @@ function readDaemonLockfile() {
       const bytesRead = import_node_fs2.default.readSync(fd, buf, 0, DAEMON_LOCKFILE_MAX_BYTES, 0);
       const raw = buf.subarray(0, bytesRead).toString("utf8");
       const parsed = JSON.parse(raw);
-      if (parsed && parsed.schema === 1 && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number") {
+      if (parsed && parsed.schema === 1 && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number" && (parsed.servedRuntimes === void 0 || Array.isArray(parsed.servedRuntimes) && parsed.servedRuntimes.every((version) => typeof version === "string"))) {
         return parsed;
       }
       return null;
@@ -11802,7 +11898,7 @@ function readDevBridgeLockfile() {
       const bytesRead = import_node_fs2.default.readSync(fd, buf, 0, DAEMON_LOCKFILE_MAX_BYTES, 0);
       const raw = buf.subarray(0, bytesRead).toString("utf8");
       const parsed = JSON.parse(raw);
-      if (parsed && parsed.schema === 1 && parsed.source === "vite-dev" && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.cwd === "string" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number" && (parsed.shellPort === void 0 || typeof parsed.shellPort === "number")) {
+      if (parsed && parsed.schema === 1 && parsed.source === "vite-dev" && typeof parsed.pid === "number" && typeof parsed.bridgePort === "number" && typeof parsed.runtimePort === "number" && typeof parsed.cwd === "string" && typeof parsed.startedAt === "number" && typeof parsed.heartbeatAt === "number" && (parsed.shellPort === void 0 || typeof parsed.shellPort === "number") && (parsed.servedRuntimes === void 0 || Array.isArray(parsed.servedRuntimes) && parsed.servedRuntimes.every((version) => typeof version === "string"))) {
         return parsed;
       }
       return null;
@@ -11885,42 +11981,10 @@ var init_home_paths = __esm({
   }
 });
 
-// src/runtime-assets.ts
-function findMonorepoRoot() {
-  if (_monorepoRootCache !== void 0) return _monorepoRootCache;
-  let dir = import_path.default.dirname((0, import_url.fileURLToPath)(__sootsim_import_meta_url));
-  for (let i = 0; i < 12 && dir !== import_path.default.dirname(dir); i++) {
-    if (import_fs.default.existsSync(import_path.default.join(dir, "packages/sootsim-engine/package.json")) && import_fs.default.existsSync(import_path.default.join(dir, "public/sootsim"))) {
-      _monorepoRootCache = dir;
-      return dir;
-    }
-    dir = import_path.default.dirname(dir);
-  }
-  _monorepoRootCache = null;
-  return null;
-}
-function resolveDevCheckoutRuntimeRoot() {
-  if (process.env.SOOTSIM_HOME && readActiveRuntime()) return null;
-  const root = findMonorepoRoot();
-  if (!root) return null;
-  const devBuild = import_path.default.join(root, "public/sootsim");
-  if (import_fs.default.existsSync(import_path.default.join(devBuild, "index.html")) && import_fs.default.existsSync(import_path.default.join(devBuild, "engine/index.html")) && import_fs.default.existsSync(import_path.default.join(devBuild, "engine-tenant/worker.js"))) {
-    return devBuild;
-  }
-  return null;
-}
-var import_fs, import_path, import_url, _monorepoRootCache;
-var init_runtime_assets = __esm({
-  "src/runtime-assets.ts"() {
-    "use strict";
-    import_fs = __toESM(require("fs"), 1);
-    import_path = __toESM(require("path"), 1);
-    import_url = require("url");
-    init_home_paths();
-  }
-});
-
 // ../contrast-runtime-delivery/src/product.ts
+function isValidRuntimeVersion(value) {
+  return value.length <= 100 && /^[0-9A-Za-z][0-9A-Za-z._+-]*$/.test(value);
+}
 function listInstalledRuntimes(product) {
   try {
     return import_node_fs3.default.readdirSync(product.runtimesDir(), { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort(compareSemver);
@@ -11983,6 +12047,7 @@ function createRuntimeDelivery(product) {
     return input || process.env[product.env.channel] || config.runtimeChannel || "stable";
   }
   function resolvePin() {
+    if (!product.env.pin) return null;
     const env = process.env[product.env.pin];
     if (env && env.trim()) return env.trim();
     const config = readConfig();
@@ -12012,6 +12077,9 @@ function createRuntimeDelivery(product) {
         `no version specified and channel '${channel}' has no latest entry in the manifest`
       );
     }
+    if (!isValidRuntimeVersion(version)) {
+      throw new Error(`invalid runtime version: ${version}`);
+    }
     const entry = manifest.versions[version];
     if (!entry) {
       throw new Error(
@@ -12027,10 +12095,11 @@ function createRuntimeDelivery(product) {
     const { version, channel, entry } = resolveVersion(manifest, opts);
     const destDir = product.runtimeDir(version);
     const setActive = opts.setActive !== false;
-    pruneLocalRetention({ protectVersions: [version] });
+    const protectVersions = [version, ...opts.protectVersions ?? []];
+    pruneLocalRetention({ protectVersions });
     if (!opts.force && import_node_fs4.default.existsSync(import_node_path4.default.join(destDir, product.installedMarker))) {
       if (setActive) product.writeActiveRuntime(version);
-      pruneLocalRetention({ protectVersions: [version] });
+      pruneLocalRetention({ protectVersions });
       return {
         version,
         channel,
@@ -12042,29 +12111,32 @@ function createRuntimeDelivery(product) {
       };
     }
     const tarUrl = entry.tarball || tarballUrl(version, cdnOrigin);
-    const tarCachePath = import_node_path4.default.join(
-      product.cacheDir(),
+    const downloadDir = import_node_fs4.default.mkdtempSync(
+      import_node_path4.default.join(import_node_os2.default.tmpdir(), `${product.id}-runtime-download-`)
+    );
+    const runtimeArchivePath = import_node_path4.default.join(
+      downloadDir,
       runtimeTarballCacheName(product, version)
     );
-    process.stderr.write(`${product.id}: downloading runtime ${version}\u2026
-`);
-    await downloadToFile(tarUrl, tarCachePath);
-    process.stderr.write(`${product.id}: extracting runtime ${version}\u2026
-`);
     const tmpDir = import_node_path4.default.join(
       import_node_path4.default.dirname(destDir),
       `.installing-${version}-${process.pid}`
     );
     import_node_fs4.default.rmSync(tmpDir, { recursive: true, force: true });
     try {
-      const actualSha = await sha256File(tarCachePath);
+      process.stderr.write(`${product.id}: downloading runtime ${version}\u2026
+`);
+      await downloadToFile(tarUrl, runtimeArchivePath);
+      process.stderr.write(`${product.id}: extracting runtime ${version}\u2026
+`);
+      const actualSha = await sha256File(runtimeArchivePath);
       if (actualSha !== entry.sha256) {
         throw new Error(
           `sha256 mismatch for runtime ${version}: expected ${entry.sha256}, actual ${actualSha}`
         );
       }
       import_node_fs4.default.mkdirSync(tmpDir, { recursive: true });
-      await extractTarball(tarCachePath, tmpDir);
+      await extractTarball(runtimeArchivePath, tmpDir);
       if (!import_node_fs4.default.existsSync(import_node_path4.default.join(tmpDir, product.installedMarker))) {
         throw new Error(
           `extracted tarball for runtime ${version} is missing ${product.installedMarker}`
@@ -12076,10 +12148,10 @@ function createRuntimeDelivery(product) {
       import_node_fs4.default.rmSync(tmpDir, { recursive: true, force: true });
       throw err;
     } finally {
-      import_node_fs4.default.rmSync(tarCachePath, { force: true });
+      import_node_fs4.default.rmSync(downloadDir, { recursive: true, force: true });
     }
     if (setActive) product.writeActiveRuntime(version);
-    pruneLocalRetention({ protectVersions: [version] });
+    pruneLocalRetention({ protectVersions });
     return {
       version,
       channel,
@@ -12092,7 +12164,7 @@ function createRuntimeDelivery(product) {
   }
   async function updateToLatest(opts = {}) {
     product.ensureHome();
-    pruneLocalRetention();
+    pruneLocalRetention({ protectVersions: opts.protectVersions });
     const cdnOrigin = resolveCdnOrigin(opts.cdnOrigin);
     const channel = resolveChannel(opts.channel);
     const pin = resolvePin();
@@ -12114,7 +12186,8 @@ function createRuntimeDelivery(product) {
         version: pin,
         channel,
         cdnOrigin,
-        setActive: false
+        setActive: false,
+        protectVersions: opts.protectVersions
       });
       return {
         checked: true,
@@ -12162,7 +12235,8 @@ function createRuntimeDelivery(product) {
       version: latestVersion,
       channel,
       cdnOrigin,
-      setActive: false
+      setActive: false,
+      protectVersions: opts.protectVersions
     });
     return {
       checked: true,
@@ -12304,13 +12378,14 @@ function extractTarball(tarPath, destDir) {
     });
   });
 }
-var import_node_child_process2, import_node_crypto, import_node_fs4, import_node_path4, import_node_stream, import_promises2, DEFAULT_LOCAL_RUNTIME_RETENTION_COUNT;
+var import_node_child_process2, import_node_crypto, import_node_fs4, import_node_os2, import_node_path4, import_node_stream, import_promises2, DEFAULT_LOCAL_RUNTIME_RETENTION_COUNT;
 var init_src = __esm({
   "../contrast-runtime-delivery/src/index.ts"() {
     "use strict";
     import_node_child_process2 = require("node:child_process");
     import_node_crypto = __toESM(require("node:crypto"), 1);
     import_node_fs4 = __toESM(require("node:fs"), 1);
+    import_node_os2 = __toESM(require("node:os"), 1);
     import_node_path4 = __toESM(require("node:path"), 1);
     import_node_stream = require("node:stream");
     import_promises2 = require("node:stream/promises");
@@ -12320,6 +12395,63 @@ var init_src = __esm({
   }
 });
 
+// src/runtime-assets.ts
+function findMonorepoRoot() {
+  if (_monorepoRootCache !== void 0) return _monorepoRootCache;
+  let dir = import_path.default.dirname((0, import_url.fileURLToPath)(__sootsim_import_meta_url));
+  for (let i = 0; i < 12 && dir !== import_path.default.dirname(dir); i++) {
+    if (import_fs.default.existsSync(import_path.default.join(dir, "packages/sootsim-engine/package.json")) && import_fs.default.existsSync(import_path.default.join(dir, "public/sootsim"))) {
+      _monorepoRootCache = dir;
+      return dir;
+    }
+    dir = import_path.default.dirname(dir);
+  }
+  _monorepoRootCache = null;
+  return null;
+}
+function resolveDevCheckoutRuntimeRoot() {
+  if (process.env.SOOTSIM_HOME && readActiveRuntime()) return null;
+  const root = findMonorepoRoot();
+  if (!root) return null;
+  const devBuild = import_path.default.join(root, "public/sootsim");
+  if (import_fs.default.existsSync(import_path.default.join(devBuild, "index.html")) && import_fs.default.existsSync(import_path.default.join(devBuild, "engine/index.html")) && import_fs.default.existsSync(import_path.default.join(devBuild, "engine-tenant/worker.js"))) {
+    return devBuild;
+  }
+  return null;
+}
+function runtimeVersionFromHostname(hostname) {
+  const suffix = ".runtime.localhost";
+  if (!hostname.toLowerCase().endsWith(suffix)) return null;
+  const labels = hostname.slice(0, -suffix.length).split(".");
+  if (labels.length === 0 || labels.some((label) => !/^[0-9a-f]{1,60}$/i.test(label))) {
+    return null;
+  }
+  const encoded = labels.join("");
+  if (encoded.length % 2 !== 0) return null;
+  try {
+    const version = Buffer.from(encoded, "hex").toString("utf8");
+    return isValidRuntimeVersion(version) ? version : null;
+  } catch {
+    return null;
+  }
+}
+function resolveInstalledRuntimeRoot(version) {
+  const dir = runtimeDir(version);
+  if (!import_fs.default.existsSync(import_path.default.join(dir, "index.html"))) return null;
+  return dir;
+}
+var import_fs, import_path, import_url, _monorepoRootCache;
+var init_runtime_assets = __esm({
+  "src/runtime-assets.ts"() {
+    "use strict";
+    import_fs = __toESM(require("fs"), 1);
+    import_path = __toESM(require("path"), 1);
+    import_url = require("url");
+    init_src();
+    init_home_paths();
+  }
+});
+
 // src/runtime-delivery.ts
 var DEFAULT_RUNTIME_CDN_ORIGIN, SOOTSIM_RUNTIME_PRODUCT, sootsimRuntime;
 var init_runtime_delivery = __esm({
@@ -12339,8 +12471,7 @@ var init_runtime_delivery = __esm({
       installedMarker: "index.html",
       env: {
         cdnOrigin: "SOOTSIM_CDN_ORIGIN",
-        channel: "SOOTSIM_RUNTIME_CHANNEL",
-        pin: "SOOTSIM_RUNTIME_VERSION"
+        channel: "SOOTSIM_RUNTIME_CHANNEL"
       },
       ensureHome: ensureSootsimHome,
       configFile: configFilePath,
@@ -14733,6 +14864,7 @@ var init_bridge_host = __esm({
               recentActions: []
             };
             this.sims.set(sim.id, sim);
+            this.writeConnectedRuntimeSnapshot();
             if (this.shouldPromoteSim(sim)) {
               this.primarySimId = sim.id;
             }
@@ -14824,6 +14956,7 @@ var init_bridge_host = __esm({
               sim = null;
               role = "cli";
               this.cliIdentityKeyBySocket.set(ws, `ws-${this.nextCliFallbackId++}`);
+              this.writeConnectedRuntimeSnapshot();
               this.broadcastSimAssignments();
               this.broadcastSimClientStates();
             }
@@ -14837,6 +14970,7 @@ var init_bridge_host = __esm({
                 sim.url = registration.url;
                 sim.title = registration.title;
                 sim.userAgent = registration.userAgent;
+                this.writeConnectedRuntimeSnapshot();
                 if (typeof registration.kind === "string" && registration.kind.trim()) {
                   sim.kind = registration.kind.trim();
                 }
@@ -14861,11 +14995,14 @@ var init_bridge_host = __esm({
                 return;
               }
               if (msg.type === "bridge:write-shared-config") {
-                const patch = msg.patch && typeof msg.patch === "object" ? msg.patch : null;
-                if (!patch) return;
-                let next;
+                if (!msg.patch || typeof msg.patch !== "object" || Array.isArray(msg.patch)) {
+                  return;
+                }
+                const patch = Object.fromEntries(
+                  Object.entries(msg.patch)
+                );
                 try {
-                  next = writeSharedConfig(patch);
+                  this.writeAndBroadcastSharedConfig(patch);
                 } catch (err) {
                   process.stderr.write(
                     `sootsim: bridge:write-shared-config failed: ${err instanceof Error ? err.message : String(err)}
@@ -14873,17 +15010,6 @@ var init_bridge_host = __esm({
                   );
                   return;
                 }
-                const payload = JSON.stringify({
-                  type: "bridge:shared-config-changed",
-                  config: next
-                });
-                for (const peer of this.sims.values()) {
-                  if (peer.ws.readyState !== import_ws2.WebSocket.OPEN) continue;
-                  try {
-                    peer.ws.send(payload);
-                  } catch {
-                  }
-                }
                 return;
               }
               if (msg.type === "bridge:open-path") {
@@ -15198,6 +15324,18 @@ var init_bridge_host = __esm({
         void this.agentHost.seedOnBoot();
       }
       bootstrapping = true;
+      connectedRuntimeVersions() {
+        const versions = /* @__PURE__ */ new Set();
+        for (const sim of this.sims.values()) {
+          try {
+            const url = new URL(sim.url || sim.origin || "http://localhost");
+            const version = runtimeVersionFromHostname(url.hostname);
+            if (version) versions.add(version);
+          } catch {
+          }
+        }
+        return [...versions].sort();
+      }
       buildLockfileSnapshot() {
         return {
           schema: 1,
@@ -15207,6 +15345,7 @@ var init_bridge_host = __esm({
           runtimePort: this.effectivePort,
           activeRuntime: this.activeRuntimeVersion,
           activeRuntimeDir: this.activeRuntimeDirPath,
+          servedRuntimes: this.connectedRuntimeVersions(),
           startedAt: this.startedAt,
           heartbeatAt: Date.now(),
           bootstrapping: this.bootstrapping
@@ -15224,7 +15363,8 @@ var init_bridge_host = __esm({
           cwd: process.cwd(),
           startedAt: this.startedAt,
           heartbeatAt: Date.now(),
-          source: "vite-dev"
+          source: "vite-dev",
+          servedRuntimes: this.connectedRuntimeVersions()
         };
       }
       writeLockfileSnapshot() {
@@ -15233,6 +15373,20 @@ var init_bridge_host = __esm({
       writeDevLockfileSnapshot() {
         writeDevBridgeLockfile(this.buildDevLockfileSnapshot());
       }
+      writeConnectedRuntimeSnapshot() {
+        if (this.shouldWriteLockfile && this.httpServer) {
+          try {
+            this.writeLockfileSnapshot();
+          } catch {
+          }
+        }
+        if (this.shouldWriteDevLockfile && this.httpServer) {
+          try {
+            this.writeDevLockfileSnapshot();
+          } catch {
+          }
+        }
+      }
       refreshActiveRuntime() {
         this.activeRuntimeVersion = readActiveRuntime();
         this.activeRuntimeDirPath = resolveDevCheckoutRuntimeRoot() ?? activeRuntimeDir();
@@ -15284,6 +15438,7 @@ var init_bridge_host = __esm({
       }
       startRuntimeUpdater() {
         if (!this.shouldWriteLockfile || this.runtimeUpdateTimer) return;
+        if (import_fs3.default.existsSync(import_path3.default.join(sootsimHomeDir(), "runtime-update-disabled"))) return;
         if (process.env.SOOTSIM_HOME && isSootsimDevCheckout() && !readActiveRuntime()) {
           return;
         }
@@ -15301,7 +15456,9 @@ var init_bridge_host = __esm({
             if (reason === "startup") {
               process.stderr.write("sootsim: checking for runtime updates\u2026\n");
             }
-            const result = await sootsimRuntime.updateToLatest();
+            const result = await sootsimRuntime.updateToLatest({
+              protectVersions: this.connectedRuntimeVersions()
+            });
             if (!result.updated || !result.latestVersion) {
               if (reason === "startup") {
                 process.stderr.write(
@@ -15362,6 +15519,11 @@ var init_bridge_host = __esm({
           runtimeDir: this.activeRuntimeDirPath
         });
         for (const sim of this.sims.values()) {
+          try {
+            const simUrl = new URL(sim.url || sim.origin || "http://localhost");
+            if (runtimeVersionFromHostname(simUrl.hostname)) continue;
+          } catch {
+          }
           if (sim.ws.readyState === import_ws2.WebSocket.OPEN) {
             try {
               sim.ws.send(payload);
@@ -15405,12 +15567,77 @@ var init_bridge_host = __esm({
           return;
         }
         const method = (req.method || "GET").toUpperCase();
+        let url;
+        try {
+          url = new URL(req.url || "/", `http://${req.headers.host || "localhost"}`);
+        } catch {
+          res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+          res.end("invalid request URL or host");
+          return;
+        }
+        if (url.pathname === "/__sootsim/shared-config") {
+          res.setHeader("Access-Control-Allow-Origin", "*");
+          res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+          res.setHeader("Cache-Control", "no-store");
+          if (method === "OPTIONS") {
+            res.writeHead(204, { Allow: "GET, HEAD, POST, OPTIONS" });
+            res.end();
+            return;
+          }
+          if (method === "GET" || method === "HEAD") {
+            let body = "{}";
+            try {
+              body = JSON.stringify(readSharedConfig());
+            } catch {
+            }
+            res.writeHead(200, { "Content-Type": "application/json" });
+            if (method === "HEAD") res.end();
+            else res.end(body);
+            return;
+          }
+          if (method === "POST") {
+            void (async () => {
+              try {
+                const chunks = [];
+                let size = 0;
+                for await (const chunk of req) {
+                  const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                  size += buffer.byteLength;
+                  if (size > 8 * 1024 * 1024) {
+                    res.writeHead(413, { "Content-Type": "text/plain; charset=utf-8" });
+                    res.end("shared config patch is too large");
+                    return;
+                  }
+                  chunks.push(buffer);
+                }
+                const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+                  throw new Error("shared config patch must be an object");
+                }
+                const patch = Object.fromEntries(
+                  Object.entries(parsed)
+                );
+                const next = this.writeAndBroadcastSharedConfig(patch);
+                res.writeHead(200, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(next));
+              } catch (error) {
+                res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8" });
+                res.end(
+                  `invalid shared config patch: ${error instanceof Error ? error.message : String(error)}`
+                );
+              }
+            })();
+            return;
+          }
+          res.writeHead(405, { Allow: "GET, HEAD, POST, OPTIONS" });
+          res.end("method not allowed");
+          return;
+        }
         if (method !== "GET" && method !== "HEAD") {
           res.writeHead(405, { Allow: "GET, HEAD" });
           res.end("method not allowed");
           return;
         }
-        const url = new URL(req.url || "/", "http://localhost");
         if (url.pathname === "/__bundle-proxy") {
           const target = url.searchParams.get("url");
           if (!target) {
@@ -15487,30 +15714,13 @@ var init_bridge_host = __esm({
           );
           return;
         }
-        if (url.pathname === "/__sootsim/shared-config") {
-          res.setHeader("Access-Control-Allow-Origin", "*");
-          res.setHeader("Cache-Control", "no-store");
-          if (method === "GET" || method === "HEAD") {
-            let body = "{}";
-            try {
-              body = JSON.stringify(readSharedConfig());
-            } catch {
-            }
-            res.writeHead(200, { "Content-Type": "application/json" });
-            if (method === "HEAD") res.end();
-            else res.end(body);
-            return;
-          }
-          res.writeHead(405, { Allow: "GET, HEAD" });
-          res.end("method not allowed (use the bridge over WS for writes)");
-          return;
-        }
-        this.refreshActiveRuntime();
-        const baseDir = this.activeRuntimeDirPath;
+        const requestedRuntime = runtimeVersionFromHostname(url.hostname);
+        if (!requestedRuntime) this.refreshActiveRuntime();
+        const baseDir = requestedRuntime ? resolveInstalledRuntimeRoot(requestedRuntime) : this.activeRuntimeDirPath;
         if (!baseDir) {
           res.writeHead(503, { "Content-Type": "text/plain; charset=utf-8" });
           res.end(
-            "sootsim: no active runtime installed. run `sootsim runtime install` to fetch one."
+            requestedRuntime ? `sootsim: runtime ${requestedRuntime} is not installed. run \`sootsim open\` from that app again.` : "sootsim: no active runtime installed. run `sootsim runtime install` to fetch one."
           );
           return;
         }
@@ -16117,6 +16327,21 @@ var init_bridge_host = __esm({
           );
         }
       }
+      writeAndBroadcastSharedConfig(patch) {
+        const next = writeSharedConfig(patch);
+        const payload = JSON.stringify({
+          type: "bridge:shared-config-changed",
+          config: next
+        });
+        for (const peer of this.sims.values()) {
+          if (peer.ws.readyState !== import_ws2.WebSocket.OPEN) continue;
+          try {
+            peer.ws.send(payload);
+          } catch {
+          }
+        }
+        return next;
+      }
       broadcastSimClientStates() {
         for (const sim of this.sims.values()) {
           if (sim.ws.readyState !== import_ws2.WebSocket.OPEN) continue;
@@ -16255,6 +16480,7 @@ var init_bridge_host = __esm({
           expiresAt: Date.now() + _SootSimBridgeHost.SIM_RECONNECT_TTL_MS
         });
         this.sims.delete(sim.id);
+        this.writeConnectedRuntimeSnapshot();
       }
       getRestorableSimState(simId) {
         const snapshot = this.restorableSims.get(simId);
@@ -18381,6 +18607,13 @@ var init_auth = __esm({
   }
 });
 
+// cli/app-project.ts
+var init_app_project = __esm({
+  "cli/app-project.ts"() {
+    "use strict";
+  }
+});
+
 // cli/app-fonts.ts
 var import_node_module, import_config_plugin_fonts, require2;
 var init_app_fonts = __esm({
@@ -18388,6 +18621,7 @@ var init_app_fonts = __esm({
     "use strict";
     import_node_module = require("node:module");
     import_config_plugin_fonts = require("sootsim-engine/engine/config-plugin-fonts");
+    init_app_project();
     require2 = (0, import_node_module.createRequire)(__sootsim_import_meta_url);
   }
 });
@@ -18399,6 +18633,7 @@ var init_app_splash = __esm({
     "use strict";
     import_node_module2 = require("node:module");
     import_config_plugin_splash = require("sootsim-engine/engine/config-plugin-splash");
+    init_app_project();
     require3 = (0, import_node_module2.createRequire)(__sootsim_import_meta_url);
   }
 });
@@ -20591,11 +20826,6 @@ var skill = {
 };
 
 // src/skills/builtin/compat-check.ts
-function getCompatStatus(entry) {
-  if (entry.stubType === "works") return "full";
-  if (entry.stubType === "build-only") return "full";
-  return entry.versions.some((version) => version.coverage >= 1) ? "full" : "auto-stub";
-}
 var skill2 = {
   name: "compat-check",
   description: "Check package compatibility with sootsim",
@@ -20613,62 +20843,46 @@ var skill2 = {
         }
       },
       async execute(params, context) {
-        const fs11 = await import("fs");
-        const path11 = await import("path");
-        const { POLYFILL_REGISTRY: POLYFILL_REGISTRY2 } = await Promise.resolve().then(() => (init_web(), web_exports));
-        if (params.packageName) {
-          const entry = POLYFILL_REGISTRY2[params.packageName];
-          if (!entry) {
-            return {
-              success: true,
-              message: `${params.packageName}: not in registry (may be auto-stubbed if native)`,
-              data: { package: params.packageName, status: "unknown" }
-            };
-          }
-          const status = getCompatStatus(entry);
-          return {
-            success: true,
-            message: `${params.packageName}: ${status}`,
-            data: { package: params.packageName, status, ...entry }
-          };
-        }
-        const pkgPath = path11.join(context.projectDir, "package.json");
-        if (!fs11.existsSync(pkgPath)) {
+        const fs11 = await import("node:fs");
+        const path11 = await import("node:path");
+        const { COMPAT_RESULT_CAVEAT: COMPAT_RESULT_CAVEAT2, formatPackageStatus: formatPackageStatus2, formatScanCounts: formatScanCounts2, scanDeps: scanDeps2 } = await Promise.resolve().then(() => (init_web(), web_exports));
+        const packagePath = path11.join(context.projectDir, "package.json");
+        if (!fs11.existsSync(packagePath)) {
           return { success: false, message: "No package.json found" };
         }
-        const pkg = JSON.parse(fs11.readFileSync(pkgPath, "utf8"));
-        const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
-        const results = {
-          full: [],
-          partial: [],
-          "auto-stub": [],
-          unsupported: [],
-          unknown: []
-        };
-        for (const dep of Object.keys(allDeps)) {
-          const entry = POLYFILL_REGISTRY2[dep];
-          if (entry) {
-            const status = getCompatStatus(entry);
-            if (results[status]) results[status].push(dep);
-          } else if (isNative(dep)) {
-            results.unknown.push(dep);
-          }
+        const parsed = JSON.parse(fs11.readFileSync(packagePath, "utf8"));
+        if (!parsed || typeof parsed !== "object") {
+          return { success: false, message: "package.json is not an object" };
         }
+        const dependencies = readDependencies(parsed);
+        const scan = params.packageName ? scanDeps2({
+          dependencies: {
+            [params.packageName]: dependencies[params.packageName] ?? "*"
+          }
+        }) : scanDeps2(parsed);
+        const packageResult = params.packageName ? scan.packages[0] : void 0;
+        const message = packageResult ? `${params.packageName}: ${formatPackageStatus2(packageResult)}. ${COMPAT_RESULT_CAVEAT2}` : `${formatScanCounts2(scan)}. ${COMPAT_RESULT_CAVEAT2}`;
         const reportPath = path11.join(context.outputDir, "compat-report.json");
         fs11.mkdirSync(path11.dirname(reportPath), { recursive: true });
-        fs11.writeFileSync(reportPath, JSON.stringify(results, null, 2));
+        fs11.writeFileSync(reportPath, `${JSON.stringify(scan, null, 2)}
+`);
         return {
-          success: results.unsupported.length === 0,
-          message: `${results.full.length} full, ${results.partial.length} partial, ${results.unsupported.length} unsupported, ${results.unknown.length} unknown`,
+          success: true,
+          message,
           artifacts: [{ type: "report", name: "compat-report", path: reportPath }],
-          data: results
+          data: scan
         };
       }
     }
   ]
 };
-function isNative(name) {
-  return name.startsWith("expo-") || name.startsWith("react-native-") || name.startsWith("@react-native/") || name.startsWith("@react-native-community/") || name.startsWith("@expo/") || name === "expo";
+function readDependencies(value) {
+  const dependencies = Reflect.get(value, "dependencies");
+  const devDependencies = Reflect.get(value, "devDependencies");
+  return {
+    ...dependencies && typeof dependencies === "object" ? dependencies : {},
+    ...devDependencies && typeof devDependencies === "object" ? devDependencies : {}
+  };
 }
 
 // src/skills/builtin/maestro-test.ts