stim 1.14.0 → 1.16.0

package/dist/client-BTY686R6.mjs

@@ -0,0 +1,1368 @@
+import { t as getExecutor } from "./exec-CaErVv7t.mjs";
+import { _ as loadConfig$1, d as getConfigDir } from "./config-D0DbpZtM.mjs";
+import { w as withDirLock } from "./workspace-state-B8-aJ1_5.mjs";
+import { T as CCACHE_UNAVAILABLE, a as toolchainMismatches, l as COMPILATION_CACHE_UNAVAILABLE, s as manifestDigest } from "./toolchain-DkUflduf.mjs";
+import { createHash } from "node:crypto";
+import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, writeFileSync, writeSync } from "node:fs";
+import { basename, dirname, join, relative } from "node:path";
+import { InvalidArgumentError } from "commander";
+import { OFFLOAD_MODES, buildMachinesFile, buildMachinesLock, endpoint, findPeer as findPeer$1, isJsonObject, parseMachine, parseMachine as parseMachine$1, pinnedEndpoint, readBuildMachines, saturation } from "@stim-cli/core/state";
+import { hostname } from "node:os";
+import { WebSocket } from "ws";
+//#region src/offload/access-ticket.ts
+function readAccessTicket() {
+	const ticket = process.env.STIM_ACCESS_TICKET?.trim();
+	return ticket && /^[A-Za-z0-9_-]{43}$/.test(ticket) ? {
+		ticket,
+		ticketHash: createHash("sha256").update(ticket).digest("hex")
+	} : void 0;
+}
+function readHostPermissions(value) {
+	const host = value;
+	return host && typeof host.name === "string" && typeof host.screenRecording === "boolean" && typeof host.accessibility === "boolean" ? {
+		name: host.name,
+		screenRecording: host.screenRecording,
+		accessibility: host.accessibility
+	} : void 0;
+}
+//#endregion
+//#region src/offload/tailnet.ts
+const MAC_APP_TAILSCALE = "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
+const HELLO_TIMEOUT_MS = 1e4;
+function tailscaleStatus() {
+	for (const binary of ["tailscale", MAC_APP_TAILSCALE]) {
+		const output = getExecutor().runFileQuiet(binary, ["status", "--json"], { timeoutMs: 5e3 });
+		if (output === null) continue;
+		try {
+			const status = JSON.parse(output);
+			return isJsonObject(status) && status.BackendState === "Running" ? status : null;
+		} catch {
+			return null;
+		}
+	}
+	return null;
+}
+function hello({ url, servername, host }, auth) {
+	return new Promise((resolve) => {
+		const socket = new WebSocket(url, {
+			handshakeTimeout: HELLO_TIMEOUT_MS,
+			servername,
+			headers: { Host: host }
+		});
+		const done = (reply) => {
+			clearTimeout(timer);
+			socket.removeAllListeners();
+			socket.on("error", () => {});
+			socket.close();
+			resolve(reply);
+		};
+		const timer = setTimeout(() => done({ failed: "no reply in time" }), HELLO_TIMEOUT_MS);
+		socket.on("open", () => {
+			socket.send(JSON.stringify({
+				id: 1,
+				method: "hello",
+				params: {
+					protocol: 1,
+					client: {
+						name: "stim",
+						version: "1"
+					},
+					auth
+				}
+			}));
+		});
+		socket.on("message", (data) => {
+			let message;
+			try {
+				message = JSON.parse(String(data));
+			} catch {
+				message = null;
+			}
+			if (isJsonObject(message) && ("result" in message || "error" in message)) return done(message);
+			done({ failed: "the reply was not a hello result" });
+		});
+		socket.on("error", (error) => done({ failed: error.message }));
+		socket.on("close", () => done({ failed: "the connection closed before a reply" }));
+	});
+}
+const realIo = {
+	status: tailscaleStatus,
+	hello
+};
+function pinnedEndpoint$1(credential, status = tailscaleStatus) {
+	return pinnedEndpoint(credential, parseMachine(credential.machine) ? status() : null);
+}
+//#endregion
+//#region src/offload/build-machines.ts
+/** The build machines named in `offload.machines` that this Mac asked for build access, in that order. */
+function pairedMachines(entries = configuredMachines()) {
+	const credentials = readBuildMachines();
+	return entries.flatMap((entry) => credentials.filter((each) => each.machine === entry));
+}
+function configuredMachines() {
+	const machines = loadConfig$1()?.offload?.machines;
+	return Array.isArray(machines) ? machines.filter((entry) => typeof entry === "string") : [];
+}
+function updateCredentials(change) {
+	const dir = getConfigDir();
+	withDirLock(buildMachinesLock(), () => {
+		const file = buildMachinesFile();
+		const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+		writeFileSync(tmp, `${JSON.stringify({
+			version: 1,
+			machines: change(readBuildMachines())
+		}, null, 2)}\n`, { mode: 384 });
+		try {
+			renameSync(tmp, file);
+		} catch (error) {
+			rmSync(tmp, { force: true });
+			throw error;
+		}
+	}, { ensureParent: () => mkdirSync(dir, { recursive: true }) });
+}
+function note(title, detail, fix = null) {
+	return {
+		code: "build-machine",
+		level: "note",
+		title,
+		detail,
+		fix
+	};
+}
+const approval = (entry, deviceId) => `A person on ${entry} approves it with \`stim-server devices grant ${deviceId} --build\`.`;
+const PROBLEM_TITLES = {
+	unreachable: "does not answer a build offer",
+	checkout: "cannot build an app outside a git checkout",
+	"stim-build": "runs another Stim build",
+	arch: "has another CPU architecture",
+	xcode: "has another Xcode",
+	"macos-sdk": "has another macOS SDK",
+	"simulator-sdk": "has another simulator SDK",
+	cocoapods: "has another CocoaPods",
+	bundler: "has no Bundler",
+	runtime: "has no simulator for this project's iOS runtime",
+	jdk: "runs another JDK major version",
+	"android-sdk": "has no Android SDK",
+	ndk: "lacks this project's NDK",
+	"build-tools": "lacks this project's Android build-tools",
+	"compile-sdk": "lacks this project's Android compile platform",
+	disk: "is low on disk",
+	busy: "is too busy to take builds"
+};
+function problemFix(code, entry) {
+	switch (code) {
+		case "unreachable": return `Check that stim-server runs on ${entry} and that its tailscale serve route answers, then run \`stim doctor\` again. To keep it running there, run \`stim-server service install --serve\` on ${entry}.`;
+		case "checkout": return "Offload syncs the files git lists; run Stim from a git checkout of the app.";
+		case "stim-build": return `Update stim-server on ${entry} to the same Stim build as this Mac: there, run \`stim-server service update --release <version>\` for this Mac's release, or \`--from <dir>\` with the packed packages of this Mac's checkout.`;
+		case "arch": return "Use a build machine with the same CPU architecture as this Mac.";
+		case "xcode":
+		case "simulator-sdk":
+		case "macos-sdk": return `Install and select the same Xcode on ${entry} and this Mac (\`xcode-select -p\` on each).`;
+		case "cocoapods": return `Install the same CocoaPods version on ${entry}, on the PATH its stim-server's login shell sets.`;
+		case "bundler": return `Install Bundler (\`gem install bundler\`) on ${entry}, on the PATH its stim-server's login shell sets.`;
+		case "runtime": return `Install that iOS simulator runtime on ${entry} with at least one iPhone simulator, or set ios.runtime here to one ${entry} has.`;
+		case "jdk": return `Start stim-server on ${entry} with JAVA_HOME at a JDK of the same major version as this Mac's.`;
+		case "android-sdk":
+		case "ndk":
+		case "build-tools":
+		case "compile-sdk": return `Install the missing package with sdkmanager in the Android SDK stim-server on ${entry} uses (its ANDROID_HOME, else ~/Library/Android/sdk).`;
+		case "disk": return `Free space on ${entry}'s worker root (offload.workerRoot there).`;
+		case "busy": return `Builds stay on this Mac until ${entry} has capacity. On ${entry}, offload.maxLoadPerCore sets the load it accepts and concurrency.maxBuilds how many of its own builds it runs; it takes one offloaded build at a time.`;
+	}
+}
+const TRANSIENT = /* @__PURE__ */ new Set(["unreachable", "busy"]);
+function offloadFindings(entry, problems) {
+	return problems.map((problem) => ({
+		code: `build-machine-${problem.code}`,
+		level: TRANSIENT.has(problem.code) ? "note" : "cost",
+		title: `Build machine ${entry} ${PROBLEM_TITLES[problem.code]}`,
+		detail: `Builds fall back to this Mac: ${problem.reason}.`,
+		fix: problemFix(problem.code, entry)
+	}));
+}
+async function requestAccess(entry, peer, port, deviceName, io) {
+	const ticket = readAccessTicket();
+	const reply = await io.hello(endpoint(peer, port), {
+		request: "build",
+		deviceName,
+		...ticket ? { setupTicket: ticket.ticket } : {}
+	});
+	if (!("result" in reply) || !reply.result.approval || !reply.result.deviceToken) {
+		const reason = "failed" in reply ? reply.failed : "error" in reply ? reply.error.message : "it granted no request";
+		return {
+			report: {
+				machine: entry,
+				state: "unreachable",
+				dnsName: peer.dnsName
+			},
+			finding: note(`Could not ask ${entry} for build access`, reason)
+		};
+	}
+	const credential = {
+		machine: entry,
+		nodeId: peer.nodeId,
+		dnsName: peer.dnsName,
+		deviceId: reply.result.device.id,
+		deviceToken: reply.result.deviceToken,
+		state: "pending",
+		requestedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		...ticket ? { ticketHash: ticket.ticketHash } : {}
+	};
+	updateCredentials((credentials) => [...credentials.filter((each) => each.machine !== entry), credential]);
+	return {
+		report: {
+			machine: entry,
+			state: "pending",
+			dnsName: peer.dnsName,
+			deviceId: credential.deviceId,
+			requestedAt: credential.requestedAt
+		},
+		finding: note(`Asked ${entry} for build access`, `The request lapses at ${reply.result.approval.expiresAt}.`, approval(entry, credential.deviceId))
+	};
+}
+async function inspectMachine(entry, status, deviceName, fix, io, check) {
+	const parsed = parseMachine$1(entry);
+	if (!parsed) return {
+		report: {
+			machine: entry,
+			state: "invalid"
+		},
+		finding: note(`Build machine ${entry} is not a tailnet name`, "Expected `name` or `name:port`.")
+	};
+	const peer = findPeer$1(status, parsed.name);
+	if (peer === "missing" || peer === "ambiguous") {
+		const detail = peer === "missing" ? "No peer on this tailnet has that name." : "Several peers match that name.";
+		return {
+			report: {
+				machine: entry,
+				state: "not-on-tailnet"
+			},
+			finding: note(`Build machine ${entry} is not on this tailnet`, detail)
+		};
+	}
+	const credential = readBuildMachines().find((each) => each.machine === entry);
+	const known = {
+		machine: entry,
+		dnsName: peer.dnsName
+	};
+	if (credential && credential.nodeId !== peer.nodeId) return {
+		report: {
+			...known,
+			state: "node-changed",
+			deviceId: credential.deviceId,
+			requestedAt: credential.requestedAt
+		},
+		finding: note(`Build machine ${entry} is a different tailnet node`, `This Mac paired with node ${credential.nodeId}, but ${peer.dnsName} is now node ${peer.nodeId}. Stim does not connect to it.`, `If that Mac was replaced, remove ${entry} from offload.machines, run \`stim doctor --fix\` to forget the old pairing, then add it back and run \`stim doctor --fix\` again.`)
+	};
+	if (!credential) {
+		if (fix) return requestAccess(entry, peer, parsed.port, deviceName, io);
+		return {
+			report: {
+				...known,
+				state: "not-asked"
+			},
+			finding: note(`Build machine ${entry} has not approved this Mac`, "This Mac has not asked it for build access.", "Run `stim doctor --fix` to ask.")
+		};
+	}
+	const paired = {
+		...known,
+		deviceId: credential.deviceId,
+		requestedAt: credential.requestedAt
+	};
+	const reply = await io.hello(endpoint(peer, parsed.port), { deviceToken: credential.deviceToken });
+	if ("result" in reply && reply.result.capabilities.includes("build")) {
+		const permissions = readHostPermissions(reply.result.host);
+		const host = permissions ? { host: permissions } : {};
+		if (credential.state !== "approved") updateCredentials((credentials) => credentials.map((each) => each.machine === entry ? {
+			...each,
+			state: "approved"
+		} : each));
+		if (!check) return {
+			report: {
+				...paired,
+				state: "approved",
+				...host
+			},
+			finding: null
+		};
+		const { capacity, problems } = await check({
+			...credential,
+			state: "approved"
+		});
+		return {
+			report: {
+				...paired,
+				state: "approved",
+				...host,
+				offloadable: problems.length === 0,
+				reasons: problems.map((problem) => problem.reason),
+				problems,
+				...capacity ? { capacity } : {}
+			},
+			finding: null,
+			extra: offloadFindings(entry, problems)
+		};
+	}
+	if ("error" in reply && reply.error.code === "approval-pending") {
+		const ticket = fix && credential.state !== "approved" ? readAccessTicket() : void 0;
+		if (ticket && credential.ticketHash !== ticket.ticketHash) return requestAccess(entry, peer, parsed.port, deviceName, io);
+		return {
+			report: {
+				...paired,
+				state: "pending"
+			},
+			finding: note(`Build machine ${entry} has not approved this Mac yet`, `Requested at ${credential.requestedAt}.`, approval(entry, credential.deviceId))
+		};
+	}
+	if ("error" in reply && reply.error.code === "unauthorized") {
+		if (fix) return requestAccess(entry, peer, parsed.port, deviceName, io);
+		return {
+			report: {
+				...paired,
+				state: "revoked"
+			},
+			finding: note(`Build machine ${entry} no longer accepts this Mac`, `${reply.error.message} It was revoked, or the request lapsed before approval.`, "Run `stim doctor --fix` to ask again.")
+		};
+	}
+	const reason = "failed" in reply ? reply.failed : "error" in reply ? reply.error.message : "unexpected reply";
+	return {
+		report: {
+			...paired,
+			state: "unreachable"
+		},
+		finding: note(`Could not reach build machine ${entry}`, reason, `Check that stim-server runs on ${entry}. To keep it running there, run \`stim-server service install --serve\` on ${entry}.`)
+	};
+}
+/**
+* Doctor findings and a report for each `offload.machines` entry. The worker's node is pinned when access is
+* requested; a later connection goes only to the current MagicDNS name of that same node, checked before the token
+* is sent. With `fix`, requests access from a named machine this Mac holds no pairing for, requests again when the
+* pinned node forgot this Mac or, with `STIM_ACCESS_TICKET` set, when a pending request carries another ticket, and forgets pairings of machines no longer named. With `check`, each approved
+* machine is asked for one build offer and reports every reason it would not take this project's build.
+*/
+async function inspectBuildMachines({ fix, check = null }, io = realIo, entries = configuredMachines()) {
+	const unnamed = (each) => !entries.includes(each.machine);
+	if (fix && readBuildMachines().some(unnamed)) updateCredentials((credentials) => credentials.filter((each) => !unnamed(each)));
+	if (entries.length === 0) return {
+		findings: [],
+		machines: []
+	};
+	const status = io.status();
+	if (!isJsonObject(status)) return {
+		findings: [note("Build machines are unreachable", "offload.machines names build machines, but Tailscale is not running.")],
+		machines: entries.map((machine) => ({
+			machine,
+			state: "tailscale-off"
+		}))
+	};
+	const self = isJsonObject(status.Self) ? status.Self : {};
+	const deviceName = (typeof self.HostName === "string" && self.HostName ? self.HostName : hostname()).replace(/[\p{Cc}\p{Cf}]/gu, "").trim().slice(0, 64) || "Mac";
+	const inspection = {
+		findings: [],
+		machines: []
+	};
+	const inspected = await Promise.all(entries.map((entry) => inspectMachine(entry, status, deviceName, fix, io, check)));
+	for (const { report, finding, extra = [] } of inspected) {
+		inspection.machines.push(report);
+		if (finding) inspection.findings.push(finding);
+		inspection.findings.push(...extra);
+	}
+	return inspection;
+}
+//#endregion
+//#region src/offload/selection.ts
+var OffloadRefusal = class extends Error {
+	code = "STIM_OFFLOAD_REFUSED";
+	remedy = "Run stim doctor --fix to ask for build access if not paired. On the worker, a person finds the id with stim-server devices and approves it with stim-server devices grant <id> --build. Check stim settings get offload.machines, or rerun with --build-machine auto or --build-machine local.";
+	constructor(machine, reason) {
+		super(reason.startsWith(`${machine}: `) ? reason : `${machine}: ${reason}`);
+	}
+};
+function resolveBuildMachine(flag, env, setting) {
+	const selected = flag ?? (env?.trim() || void 0) ?? setting ?? "auto";
+	if (typeof selected !== "string" || !selected.trim() || !parseMachine(selected)) throw Object.assign(/* @__PURE__ */ new Error("--build-machine / offload.machine must be auto, local, or a tailnet machine name."), { code: "STIM_BAD_ARG" });
+	const trimmed = selected.trim();
+	const reserved = trimmed.toLowerCase();
+	return reserved === "auto" || reserved === "local" ? reserved : trimmed;
+}
+function parseBuildMachineOption(value) {
+	try {
+		return resolveBuildMachine(value);
+	} catch (error) {
+		throw new InvalidArgumentError(error.message);
+	}
+}
+function namedBuildMachine(selected) {
+	return selected !== "auto" && selected !== "local";
+}
+function requireConfiguredMachine(selected, machines) {
+	if (!namedBuildMachine(selected)) return selected;
+	const parsed = parseMachine(selected);
+	const entries = Array.isArray(machines) ? machines.filter((entry) => typeof entry === "string") : [];
+	const match = entries.find((entry) => {
+		const candidate = parseMachine(entry);
+		return candidate?.name === parsed.name && candidate.port === parsed.port;
+	});
+	if (!match) throw new OffloadRefusal(selected, `not listed in offload.machines (configured: ${entries.join(", ") || "none"})`);
+	return match;
+}
+function resolveBuildPlacement(flag) {
+	const offload = loadConfig$1()?.offload;
+	let selected = "auto";
+	try {
+		selected = resolveBuildMachine(flag, process.env.STIM_OFFLOAD_MACHINE, offload?.machine);
+		selected = requireConfiguredMachine(selected, offload?.machines);
+		if (namedBuildMachine(selected) && pairedMachines([selected]).length === 0) throw new OffloadRefusal(selected, "no build machine is paired");
+		return { selected };
+	} catch (error) {
+		return {
+			selected,
+			failure: {
+				code: error.code,
+				message: error.message,
+				remedy: error instanceof OffloadRefusal ? error.remedy : "Pass --build-machine auto, local, or an entry from stim settings get offload.machines."
+			}
+		};
+	}
+}
+//#endregion
+//#region src/offload/client.ts
+const CONNECT_TIMEOUT_MS = 1e4;
+const OFFER_TIMEOUT_MS = 2e4;
+const REQUEST_TIMEOUT_MS = 12e4;
+const JOB_TIMEOUT_MS = 39e5;
+const PING_MS = 15e3;
+const SILENT_MS = 6e4;
+const CLOSE_TIMEOUT_MS = 2e3;
+const CLOSE_ABNORMAL = 1006;
+const TURNED_AWAY = /* @__PURE__ */ new Set([
+	"unauthorized",
+	"forbidden",
+	"approval-pending",
+	"protocol-unsupported"
+]);
+const RESUME_WINDOW_MS = 18e4;
+const RESUME_DELAY_MS = 2e3;
+const RESUME_MAX_DELAY_MS = 15e3;
+const PAGE_BYTES = 49152;
+const CHUNK_BYTES = 61440;
+const MAX_BUFFERED = 8388608;
+const DIGEST_BYTES = 32;
+function offloadMode(env = process.env) {
+	const raw = env.STIM_OFFLOAD_MODE || loadConfig$1()?.offload?.mode;
+	return OFFLOAD_MODES.includes(raw) ? raw : "auto";
+}
+function buildPlacementCandidates(selected) {
+	return {
+		mode: selected === "local" ? "off" : offloadMode(),
+		machines: selected === "local" ? [] : namedBuildMachine(selected) ? pairedMachines([selected]).slice(0, 1) : pairedMachines()
+	};
+}
+function remotePhaseText(name, msg, machine) {
+	const text = msg.trim();
+	return `${text.startsWith(`${name} `) ? text.slice(name.length).trimStart() : text} (on ${machine})`;
+}
+const plural = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
+function capacityText(capacity) {
+	const builds = capacity.maxBuilds > 0 ? `${capacity.builds} of ${capacity.maxBuilds} build slots busy` : plural(capacity.builds, "build");
+	return `load ${capacity.loadPerCore}/core, ${builds}`;
+}
+function placementLoad(choice) {
+	const { loadPerCore, builds, maxBuilds } = choice.offer.capacity;
+	if (typeof loadPerCore !== "number" || typeof builds !== "number") return "";
+	return `; ${capacityText({
+		loadPerCore,
+		builds,
+		maxBuilds: maxBuilds ?? 0
+	})} there`;
+}
+/**
+* Whether a build may go to a build machine at all, before any machine is asked. `auto` keeps the build here while
+* this Mac has a free `concurrency.maxBuilds` slot and its load per core is under `offload.maxLoadPerCore`.
+* A named selection ignores local capacity and mode, and refuses an unsupported build or missing pairing.
+*/
+function offloadPlacement({ mode, machines, here, unsupported, selected = "auto" }) {
+	if (namedBuildMachine(selected)) {
+		if (unsupported) throw new OffloadRefusal(selected, `${unsupported}, so a named build machine cannot take it`);
+		if (machines === 0) throw new OffloadRefusal(selected, "no build machine is paired");
+		return {
+			offload: true,
+			reason: `selected with --build-machine ${selected}`
+		};
+	}
+	if (selected === "local") return {
+		offload: false,
+		reason: "--build-machine local"
+	};
+	if (mode === "off") return {
+		offload: false,
+		reason: "offload.mode is off"
+	};
+	if (machines === 0) return {
+		offload: false,
+		reason: "no build machine is paired"
+	};
+	if (unsupported) return {
+		offload: false,
+		reason: unsupported
+	};
+	if (mode === "force") return {
+		offload: true,
+		reason: "offload.mode is force"
+	};
+	const busy = saturation(here);
+	return busy ? {
+		offload: true,
+		reason: `this Mac is busy: ${busy} (${capacityText(here)})`
+	} : {
+		offload: false,
+		reason: `${capacityText(here)} here`
+	};
+}
+const gb = (bytes) => (bytes / 1024 ** 3).toFixed(1);
+/** Every reason a machine's offer cannot take this build, in either mode; empty when it can. */
+function offerProblems(offer, target) {
+	const problems = toolchainMismatches(target, offer.toolchain);
+	const capacity = offer.capacity;
+	const { running, max, diskFreeBytes, minDiskFreeBytes, declined } = capacity;
+	if (diskFreeBytes !== null && diskFreeBytes < minDiskFreeBytes) problems.push({
+		code: "disk",
+		reason: `${gb(diskFreeBytes)} GB free, needs ${gb(minDiskFreeBytes)} GB`
+	});
+	else if (declined || declined === void 0 && running >= max) {
+		const why = declined ?? `already running ${running} offloaded build(s), its limit`;
+		const load = typeof capacity.loadPerCore === "number" && typeof capacity.builds === "number" ? `; ${capacityText({
+			loadPerCore: capacity.loadPerCore,
+			builds: capacity.builds,
+			maxBuilds: capacity.maxBuilds ?? 0
+		})}` : "";
+		problems.push({
+			code: "busy",
+			reason: `busy (${why}${load})`
+		});
+	}
+	return problems;
+}
+/**
+* The asked machines that can take the build, best first, and one reason per machine that cannot. A machine with any
+* `offerProblems` never takes it. In `auto`, a machine must also be expected to build faster than this Mac: while
+* every local build slot is busy any machine that accepts will do, otherwise its load per core must be lower than
+* this Mac's. A named selection considers only that machine and skips this local-capacity gating.
+* A machine that reports no load (a stim-server older than capacity) takes an `auto` build only while
+* every local slot is busy. The rest rank warmest first, then least loaded.
+*/
+function pickOffer({ mode, here, offers, target, selected = "auto" }) {
+	const slotsFull = here.maxBuilds > 0 && here.builds >= here.maxBuilds;
+	const reasons = [];
+	const ranked = [];
+	offers.forEach(({ machine, offer, failure }, index) => {
+		if (namedBuildMachine(selected) && machine !== selected) return;
+		if (!offer) return void reasons.push(`${machine}: ${failure ?? "no offer"}`);
+		const problems = offerProblems(offer, target);
+		if (problems.length) {
+			reasons.push(`${machine}: ${problems.map((problem) => problem.reason).join("; ")}`);
+			return;
+		}
+		const load = offer.capacity.loadPerCore;
+		if (selected === "auto" && mode === "auto" && !slotsFull) {
+			if (typeof load !== "number") {
+				reasons.push(`${machine}: capacity unknown (older stim-server) while this Mac has a free slot`);
+				return;
+			}
+			if (load >= here.loadPerCore) {
+				reasons.push(`${machine}: no less loaded (load ${load}/core there, ${here.loadPerCore}/core here)`);
+				return;
+			}
+		}
+		const score = Number(offer.warm.checkout) + Number(offer.warm.dependencies) + Number(offer.warm.build);
+		ranked.push({
+			index,
+			score,
+			load: typeof load === "number" ? load : Number.POSITIVE_INFINITY
+		});
+	});
+	ranked.sort((a, b) => b.score - a.score || a.load - b.load);
+	return {
+		order: ranked.map((each) => each.index),
+		reasons
+	};
+}
+const openSockets = /* @__PURE__ */ new Set();
+let closingOnExit = false;
+/**
+* A close frame on every connection still open when this process exits, as on an interrupt, so the machine cancels
+* its builds instead of keeping them for a new connection.
+*/
+function closeOnExit(socket) {
+	if (!closingOnExit) {
+		closingOnExit = true;
+		process.once("exit", () => {
+			for (const each of openSockets) each.close(1e3);
+		});
+	}
+	openSockets.add(socket);
+	socket.once("close", () => openSockets.delete(socket));
+}
+/**
+* One authenticated connection to another Mac's stim-server, for build offload or device hosting. Closing it cancels
+* its build jobs there; a connection that drops, or that stays silent for `SILENT_MS` after `watch()`, leaves them
+* running for a while so a new connection can `build.attach` to them.
+*/
+var BuildConnection = class BuildConnection {
+	nextId = 2;
+	pending = /* @__PURE__ */ new Map();
+	progress = null;
+	binary = null;
+	closed = null;
+	heard = Date.now();
+	watched = false;
+	ended = false;
+	keepalive;
+	socket;
+	features;
+	constructor(socket, features) {
+		this.socket = socket;
+		this.features = features;
+		closeOnExit(socket);
+		this.keepalive = setInterval(() => {
+			if (this.watched && Date.now() - this.heard > SILENT_MS) return void socket.terminate();
+			socket.ping();
+		}, PING_MS);
+		this.keepalive.unref();
+		socket.on("pong", () => this.heard = Date.now());
+		socket.on("message", (data, isBinary) => {
+			this.heard = Date.now();
+			const frame = Buffer.isBuffer(data) ? data : Buffer.concat(Array.isArray(data) ? data : [Buffer.from(data)]);
+			if (isBinary) return this.binary?.(frame);
+			let message;
+			try {
+				message = JSON.parse(frame.toString("utf8"));
+			} catch {
+				return;
+			}
+			if (!isJsonObject(message)) return;
+			if (message.event === "build.progress") return this.progress?.(message);
+			const resolve = typeof message.id === "number" ? this.pending.get(message.id) : void 0;
+			if (resolve) {
+				this.pending.delete(message.id);
+				resolve(message);
+			}
+		});
+		socket.on("close", (code, reason) => {
+			clearInterval(this.keepalive);
+			this.closed = `the connection closed (${code}${reason.length ? ` ${reason.toString()}` : ""})`;
+			for (const resolve of this.pending.values()) resolve({ error: {
+				code: "closed",
+				message: this.closed
+			} });
+			this.pending.clear();
+			const dropped = code === CLOSE_ABNORMAL;
+			this.progress?.({
+				job: "",
+				outcome: {
+					ok: false,
+					code: dropped ? "dropped" : "closed",
+					message: this.closed
+				}
+			});
+		});
+		socket.on("error", () => {});
+	}
+	/** Resolves why it could not connect; `refused` when the machine answered and turned this Mac away. */
+	static open(target, token, timeoutMs, capability = "build") {
+		return new Promise((resolve) => {
+			const options = {
+				handshakeTimeout: timeoutMs,
+				servername: target.servername,
+				headers: { Host: target.host }
+			};
+			const socket = new WebSocket(target.url, options);
+			const fail = (reason, refused = false, code) => {
+				clearTimeout(timer);
+				socket.removeAllListeners();
+				socket.on("error", () => {});
+				socket.terminate();
+				resolve({
+					failure: reason,
+					refused,
+					...code ? { code } : {}
+				});
+			};
+			const timer = setTimeout(() => fail("no reply in time"), timeoutMs);
+			socket.once("error", (error) => fail(/Unexpected server response: 502/.test(error.message) ? "no stim-server answers behind its tailscale serve route (HTTP 502)" : error.message));
+			socket.once("close", () => fail("the connection closed before hello"));
+			socket.once("open", () => {
+				socket.send(JSON.stringify({
+					id: 1,
+					method: "hello",
+					params: {
+						protocol: 1,
+						client: {
+							name: "stim",
+							version: "1"
+						},
+						auth: { deviceToken: token }
+					}
+				}));
+			});
+			socket.once("message", (data) => {
+				clearTimeout(timer);
+				socket.removeAllListeners();
+				let reply;
+				try {
+					reply = JSON.parse(String(data));
+				} catch {
+					return fail("the reply was not a hello result");
+				}
+				if (isJsonObject(reply) && isJsonObject(reply.error)) return fail(String(reply.error.message), TURNED_AWAY.has(String(reply.error.code)), String(reply.error.code));
+				const capabilities = isJsonObject(reply) && isJsonObject(reply.result) ? reply.result.capabilities : null;
+				if (!Array.isArray(capabilities) || !capabilities.includes(capability)) return fail(`it has not granted this Mac ${capability === "build" ? "build" : "hosting"} access`, true, "forbidden");
+				const features = isJsonObject(reply) && isJsonObject(reply.result) ? reply.result.features : null;
+				resolve(new BuildConnection(socket, Array.isArray(features) ? features.filter((each) => typeof each === "string") : []));
+			});
+		});
+	}
+	supports(feature) {
+		return this.features.includes(feature);
+	}
+	request(method, params, timeoutMs = REQUEST_TIMEOUT_MS) {
+		if (this.closed) return Promise.resolve({ error: {
+			code: "closed",
+			message: this.closed
+		} });
+		const id = this.nextId++;
+		return new Promise((resolve) => {
+			const timer = setTimeout(() => {
+				this.pending.delete(id);
+				resolve({ error: {
+					code: "timeout",
+					message: `${method} got no reply in ${timeoutMs / 1e3} s`
+				} });
+			}, timeoutMs);
+			this.pending.set(id, (reply) => {
+				clearTimeout(timer);
+				resolve(reply);
+			});
+			this.socket.send(JSON.stringify({
+				id,
+				method,
+				params
+			}));
+		});
+	}
+	async sendBinary(frame) {
+		this.socket.send(frame, { binary: true });
+		while (this.socket.bufferedAmount > MAX_BUFFERED && !this.closed) await new Promise((resolve) => setTimeout(resolve, 5));
+	}
+	onProgress(listener) {
+		this.progress = listener;
+	}
+	onBinary(listener) {
+		this.binary = listener;
+	}
+	get failure() {
+		return this.closed;
+	}
+	/**
+	* Treats `SILENT_MS` without a frame as a dropped connection from now on. Only while waiting on a job: a long
+	* upload or this process hashing the checkout can delay pongs without anything being wrong.
+	*/
+	watch() {
+		this.heard = Date.now();
+		this.watched = true;
+	}
+	/** Closes with a close frame, which tells the machine to cancel this connection's jobs. */
+	close() {
+		if (this.ended) return;
+		this.forget();
+		if (this.socket.readyState === WebSocket.CLOSED) return;
+		const timer = setTimeout(() => this.socket.terminate(), CLOSE_TIMEOUT_MS);
+		this.socket.once("close", () => clearTimeout(timer));
+		this.socket.close(1e3);
+	}
+	/** Ends the connection without a close frame, which leaves its jobs on the machine for a new connection. */
+	drop() {
+		if (this.ended) return;
+		this.forget();
+		this.socket.terminate();
+	}
+	forget() {
+		this.ended = true;
+		clearInterval(this.keepalive);
+		this.socket.removeAllListeners("close");
+		openSockets.delete(this.socket);
+	}
+};
+function replyError(reply) {
+	return "error" in reply ? `${reply.error.code}: ${reply.error.message}` : null;
+}
+/** The repository on the build machine: one area per git common dir, shared by all its worktrees. */
+function repoIdentity(projectRoot) {
+	const run = getExecutor().runFile;
+	const repoRoot = realpathSync(run("git", [
+		"-C",
+		projectRoot,
+		"rev-parse",
+		"--show-toplevel"
+	]));
+	const common = realpathSync(run("git", [
+		"-C",
+		repoRoot,
+		"rev-parse",
+		"--path-format=absolute",
+		"--git-common-dir"
+	]));
+	const digest = createHash("sha256").update(common).digest("hex").slice(0, 12);
+	const name = (basename(dirname(common)) || "repo").replace(/[^A-Za-z0-9._-]/g, "_").replace(/^[^A-Za-z0-9]+/, "");
+	const lock = [
+		"pnpm-lock.yaml",
+		"yarn.lock",
+		"package-lock.json"
+	].find((file) => existsSync(join(repoRoot, file)));
+	return {
+		repoRoot,
+		project: relative(repoRoot, realpathSync(projectRoot)),
+		repo: `${name.slice(0, 60) || "repo"}-${digest}`,
+		lockfile: lock ? createHash("sha256").update(readFileSync(join(repoRoot, lock))).digest("hex") : null
+	};
+}
+/** The exact source a build needs: tracked and untracked, not ignored, as `git ls-files -co --exclude-standard`. */
+function sourceManifest(repoRoot) {
+	const listed = getExecutor().runFile("git", [
+		"-C",
+		repoRoot,
+		"ls-files",
+		"-z",
+		"-co",
+		"--exclude-standard"
+	], {
+		untrimmed: true,
+		timeoutMs: 12e4
+	});
+	const files = [];
+	for (const path of new Set(listed.split("\0").filter(Boolean))) {
+		const absolute = join(repoRoot, path);
+		let stat;
+		try {
+			stat = lstatSync(absolute);
+		} catch {
+			continue;
+		}
+		if (stat.isSymbolicLink()) {
+			const target = Buffer.from(readlinkSync(absolute));
+			files.push({
+				path,
+				kind: "link",
+				size: target.length,
+				sha256: sha256(target)
+			});
+		} else if (stat.isFile()) {
+			const content = readFileSync(absolute);
+			files.push({
+				path,
+				kind: stat.mode & 73 ? "exec" : "file",
+				size: content.length,
+				sha256: sha256(content)
+			});
+		}
+	}
+	return files;
+}
+const sha256 = (content) => createHash("sha256").update(content).digest("hex");
+function blobContent(repoRoot, file) {
+	const absolute = join(repoRoot, file.path);
+	return file.kind === "link" ? Buffer.from(readlinkSync(absolute)) : readFileSync(absolute);
+}
+/** Closes every connection the choice still holds. */
+function closeOffload(choice) {
+	choice.connection.close();
+	for (const each of choice.runnersUp.splice(0)) each.connection.close();
+}
+/** Connects to one paired machine and asks it for an offer; the caller closes the connection it returns. */
+async function probeMachine(credential, identity, { connectMs = CONNECT_TIMEOUT_MS, offerMs = OFFER_TIMEOUT_MS } = {}) {
+	const target = pinnedEndpoint$1(credential);
+	if (typeof target === "string") return {
+		credential,
+		failure: target
+	};
+	const connection = await BuildConnection.open(target, credential.deviceToken, connectMs);
+	if (!(connection instanceof BuildConnection)) return {
+		credential,
+		failure: connection.failure
+	};
+	const reply = await connection.request("build.offer", {
+		repo: identity.repo,
+		...identity.lockfile ? { lockfile: identity.lockfile } : {}
+	}, offerMs);
+	const failure = replyError(reply);
+	if (failure || !("result" in reply)) {
+		connection.close();
+		return {
+			credential,
+			failure: failure ?? "no offer"
+		};
+	}
+	return {
+		credential,
+		connection,
+		offer: reply.result
+	};
+}
+/**
+* Asks every paired machine for an offer in parallel and keeps the connection to the one `pickOffer` chooses, or
+* returns why none takes the build. A named selection probes only its credential and skips auto load gating.
+*/
+async function chooseBuildMachine({ projectRoot, target, mode, here, note, machines = pairedMachines(), selected = "auto" }) {
+	const started = Date.now();
+	let identity;
+	try {
+		identity = repoIdentity(projectRoot);
+	} catch (error) {
+		return `this app is not in a git checkout (${error.message.split("\n")[0]})`;
+	}
+	if (namedBuildMachine(selected)) machines = machines.filter((each) => each.machine === selected).slice(0, 1);
+	const asked = await Promise.all(machines.map((credential) => probeMachine(credential, identity)));
+	const { order, reasons } = pickOffer({
+		selected,
+		mode,
+		here,
+		target,
+		offers: asked.map((each) => ({
+			machine: each.credential.machine,
+			offer: "offer" in each ? each.offer : null,
+			..."failure" in each ? { failure: each.failure } : {}
+		}))
+	});
+	asked.forEach((each, at) => {
+		if (!order.includes(at) && "connection" in each) each.connection.close();
+	});
+	if (order.length === 0) return reasons.length ? reasons.join("; ") : "no build machine is paired";
+	for (const reason of reasons) note(reason);
+	const [first, ...rest] = order.map((at) => {
+		const pick = asked[at];
+		return {
+			machine: pick.credential.machine,
+			credential: pick.credential,
+			connection: pick.connection,
+			offer: pick.offer
+		};
+	});
+	return {
+		...first,
+		target,
+		offerMs: Date.now() - started,
+		identity,
+		runnersUp: rest
+	};
+}
+const ARTIFACT_NAME = {
+	ios: /^[^/]+\.app$/,
+	android: /^[^/]+\.apk$/,
+	macos: /^[^/]+\.app$/
+};
+/**
+* Reconnects to the machine that runs `job` and takes the job over with `build.attach`, retrying until
+* `RESUME_WINDOW_MS`, shorter than the machine's grace for a dropped connection, has passed. Returns why it
+* could not.
+*/
+async function resumeJob(credential, job, abandoned) {
+	const deadline = Date.now() + RESUME_WINDOW_MS;
+	let delay = RESUME_DELAY_MS;
+	let last = "no attempt";
+	while (!abandoned()) {
+		const target = pinnedEndpoint$1(credential);
+		const connection = typeof target === "string" ? {
+			failure: target,
+			refused: false
+		} : await BuildConnection.open(target, credential.deviceToken, CONNECT_TIMEOUT_MS);
+		if (!(connection instanceof BuildConnection)) {
+			if (connection.refused) return `the machine turned this Mac away (${connection.failure})`;
+			last = connection.failure;
+		} else {
+			const early = [];
+			connection.onProgress((event) => early.push(event));
+			const reply = await connection.request("build.attach", { job }, OFFER_TIMEOUT_MS);
+			if ("result" in reply) {
+				const outcome = isJsonObject(reply.result) ? reply.result.outcome : null;
+				return {
+					connection,
+					outcome: isJsonObject(outcome) ? outcome : null,
+					early
+				};
+			}
+			last = replyError(reply);
+			if (reply.error.code !== "closed" && reply.error.code !== "timeout") {
+				connection.close();
+				return `the machine did not hand the build back (${last})`;
+			}
+			connection.drop();
+		}
+		if (Date.now() + delay > deadline) break;
+		await new Promise((resolve) => setTimeout(resolve, delay));
+		delay = Math.min(delay * 2, RESUME_MAX_DELAY_MS);
+	}
+	return `no connection to it within ${RESUME_WINDOW_MS / 6e4} min (${last})`;
+}
+/** Mirrors the checkout on the machine: the manifest in pages, then every blob it lacks. */
+async function syncSource(connection, identity, onEnter) {
+	onEnter("sync");
+	const syncStarted = Date.now();
+	const manifest = sourceManifest(identity.repoRoot);
+	const bySha = new Map(manifest.map((file) => [file.sha256, file]));
+	const missing = [];
+	for (let index = 0; index < manifest.length || index === 0;) {
+		const page = [];
+		let bytes = 0;
+		while (index < manifest.length && (page.length === 0 || bytes < PAGE_BYTES)) {
+			const file = manifest[index++];
+			bytes += Buffer.byteLength(JSON.stringify(file)) + 1;
+			page.push(file);
+		}
+		const done = index >= manifest.length;
+		const reply = await connection.request("build.sync", {
+			repo: identity.repo,
+			files: page,
+			done
+		});
+		const failure = replyError(reply);
+		if (failure || !("result" in reply)) return { failure: `sync: ${failure ?? "no reply"}` };
+		missing.push(...reply.result.missing ?? []);
+		if (done) break;
+	}
+	let uploadedBytes = 0;
+	for (const digest of missing) {
+		const file = bySha.get(digest);
+		if (!file) return { failure: `sync: the machine asked for an unknown blob ${digest}` };
+		const content = blobContent(identity.repoRoot, file);
+		if (sha256(content) !== digest) return { failure: `sync: ${file.path} changed while syncing` };
+		const header = Buffer.from(digest, "hex");
+		for (let offset = 0; offset < content.length || offset === 0; offset += CHUNK_BYTES) {
+			await connection.sendBinary(Buffer.concat([header, content.subarray(offset, offset + CHUNK_BYTES)]));
+			if (content.length === 0) break;
+		}
+		uploadedBytes += content.length;
+		if (connection.failure) return { failure: `sync: ${connection.failure}` };
+	}
+	return {
+		files: manifest.length,
+		uploaded: missing.length,
+		uploadedBytes,
+		syncMs: Date.now() - syncStarted,
+		digest: manifestDigest(manifest)
+	};
+}
+/**
+* Builds on the chosen machine and brings the `.app` or `.apk` back into `stagingDir`, verified against the
+* sha256 the machine reports. The caller re-fingerprints and stores it.
+*/
+async function offloadBuild({ choice, expectedFingerprint, request, stagingDir, onPhase, onEnter, onRecord, note }) {
+	const { identity } = choice;
+	const started = Date.now();
+	const fail = (reason) => {
+		closeOffload(choice);
+		return {
+			ok: false,
+			machine: choice.machine,
+			reason: reason.split("\n")[0].slice(0, 300)
+		};
+	};
+	try {
+		let job = null;
+		let early = [];
+		let settle;
+		let settled = false;
+		const outcome = new Promise((resolve) => {
+			settle = (value) => {
+				settled = true;
+				resolve(value);
+			};
+		});
+		let resuming = false;
+		const reattach = async (why) => {
+			if (resuming || settled) return;
+			resuming = true;
+			note(`offload: the connection to ${choice.machine} dropped (${why}); reattaching to the build there`);
+			const resumed = await resumeJob(choice.credential, job, () => settled);
+			resuming = false;
+			if (settled) {
+				if (typeof resumed !== "string") resumed.connection.close();
+				return;
+			}
+			if (typeof resumed === "string") return settle({
+				ok: false,
+				code: "closed",
+				message: `${why}; ${resumed}`
+			});
+			choice.connection = resumed.connection;
+			resumed.connection.watch();
+			note(`offload: reattached to the build on ${choice.machine}`);
+			resumed.connection.onProgress(handle);
+			if (resumed.outcome) settle(resumed.outcome);
+			for (const event of resumed.early.splice(0)) handle(event);
+		};
+		const handle = (event) => {
+			if (event.job && event.job !== job) return;
+			if (event.outcome?.code === "dropped" && !event.job && job !== null) {
+				reattach(String(event.outcome.message));
+				return;
+			}
+			if (event.outcome) return settle(event.outcome);
+			if (event.record) onRecord(event.record);
+			if (event.phase && typeof event.msg === "string") {
+				onEnter(event.phase);
+				onPhase(event.phase, event.msg);
+			}
+		};
+		let syncMs = 0;
+		let uploadedBytes = 0;
+		let workerStarted = 0;
+		const moveOn = (why) => {
+			const next = choice.runnersUp.shift();
+			if (!next) return false;
+			note(`placement: ${next.machine} (${choice.machine} could not take the build: ${why})`);
+			choice.connection.close();
+			Object.assign(choice, next);
+			return true;
+		};
+		for (;;) {
+			const synced = await syncSource(choice.connection, identity, onEnter);
+			if ("failure" in synced) {
+				if (moveOn(synced.failure)) continue;
+				return fail(synced.failure);
+			}
+			({syncMs, uploadedBytes} = synced);
+			onPhase("sync", `${synced.files} files, uploaded ${synced.uploaded} (${mb(uploadedBytes)}) in ${seconds(syncMs)}`);
+			workerStarted = Date.now();
+			early = [];
+			choice.connection.onProgress((event) => job === null ? early.push(event) : handle(event));
+			const reply = await choice.connection.request("build.start", {
+				repo: identity.repo,
+				project: identity.project,
+				platform: request.platform,
+				fingerprint: request.platform === "macos" ? synced.digest : expectedFingerprint,
+				...request.platform === "macos" ? { macos: {
+					product: request.product,
+					infoPlist: request.infoPlist,
+					bundleId: request.bundleId,
+					...request.resources !== void 0 ? { resources: request.resources } : {},
+					...request.assetCatalog !== void 0 ? { assetCatalog: request.assetCatalog } : {}
+				} } : {
+					configuration: request.platform === "ios" ? request.configuration : null,
+					scheme: request.platform === "ios" ? request.scheme : null,
+					runtime: request.platform === "ios" ? request.runtime : null,
+					packageName: packageName(join(identity.repoRoot, identity.project)),
+					isExpo: request.isExpo,
+					optimizations: request.platform === "ios" && isJsonObject(request.optimizations) ? request.optimizations : null,
+					...request.platform === "android" ? { android: request.android } : {}
+				},
+				stimBuild: choice.target.local.stimBuild
+			});
+			if ("result" in reply) {
+				job = reply.result.job;
+				break;
+			}
+			const refused = `start: ${replyError(reply)}`;
+			if (reply.error.code === "bad-request" || !moveOn(refused)) return fail(refused);
+		}
+		for (const each of choice.runnersUp.splice(0)) each.connection.close();
+		choice.connection.watch();
+		for (const event of early.splice(0)) handle(event);
+		const timer = setTimeout(() => settle({
+			ok: false,
+			code: "timeout",
+			message: "the build did not finish in time"
+		}), JOB_TIMEOUT_MS);
+		const result = await outcome;
+		clearTimeout(timer);
+		const { connection, machine } = choice;
+		connection.onProgress(null);
+		const workerMs = Date.now() - workerStarted;
+		if (result.ok !== true) return fail(`${String(result.code ?? "failed")}: ${String(result.message ?? "")}`);
+		const artifact = result.artifact;
+		const name = typeof artifact?.name === "string" ? artifact.name : "";
+		if (!ARTIFACT_NAME[request.platform].test(name) || typeof artifact.sha256 !== "string") return fail(`the machine reported no .${request.platform === "android" ? "apk" : "app"} artifact`);
+		onEnter("fetch");
+		const fetchStarted = Date.now();
+		rmSync(stagingDir, {
+			recursive: true,
+			force: true
+		});
+		mkdirSync(stagingDir, { recursive: true });
+		const archive = join(stagingDir, "app.tgz");
+		const fd = openSync(archive, "w");
+		const hash = createHash("sha256");
+		let received = 0;
+		let badFrame = false;
+		connection.onBinary((frame) => {
+			if (frame.length < DIGEST_BYTES || frame.subarray(0, DIGEST_BYTES).toString("hex") !== artifact.sha256) {
+				badFrame = true;
+				return;
+			}
+			const data = frame.subarray(DIGEST_BYTES);
+			try {
+				writeSync(fd, data);
+			} catch {
+				badFrame = true;
+				return;
+			}
+			hash.update(data);
+			received += data.length;
+		});
+		const fetched = await connection.request("build.artifact", { job }, 9e5);
+		connection.onBinary(null);
+		closeSync(fd);
+		const fetchFailure = replyError(fetched);
+		if (fetchFailure || !("result" in fetched)) return fail(`fetch: ${fetchFailure ?? "no reply"}`);
+		const digest = hash.digest("hex");
+		const declared = fetched.result;
+		if (badFrame) return fail("fetch: an artifact frame had another digest or could not be written here");
+		if (digest !== artifact.sha256 || declared.sha256 !== digest || declared.size !== received) return fail(`fetch: the artifact's sha256 ${digest.slice(0, 12)} does not match ${String(artifact.sha256).slice(0, 12)}`);
+		await getExecutor().runFileAsync("tar", [
+			"-xf",
+			archive,
+			"-C",
+			stagingDir
+		], { timeoutMs: 6e5 });
+		rmSync(archive, { force: true });
+		const artifactPath = join(stagingDir, name);
+		if (request.platform === "ios" && !existsSync(join(artifactPath, "Info.plist"))) return fail(`fetch: ${name} has no Info.plist`);
+		if (request.platform === "android" && !(lstatSync(artifactPath, { throwIfNoEntry: false })?.isFile() ?? false)) return fail(`fetch: ${name} is not a file`);
+		if (request.platform === "macos") {
+			for (const segments of [["Contents", "Info.plist"], [
+				"Contents",
+				"MacOS",
+				request.product
+			]]) if (!lstatSync(join(artifactPath, ...segments), { throwIfNoEntry: false })?.isFile()) return fail(`fetch: ${name} has no regular ${segments.join("/")}`);
+		}
+		const fetchMs = Date.now() - fetchStarted;
+		connection.close();
+		return {
+			ok: true,
+			machine,
+			artifactPath,
+			...request.platform === "macos" && typeof declared.handoff === "string" && /^[0-9a-f]{64}$/.test(declared.handoff) ? { handoff: {
+				nodeId: choice.credential.nodeId,
+				token: declared.handoff,
+				sha256: digest
+			} } : {},
+			compilationCache: request.platform === "ios" ? compilationActivity(result.compilationCache) : COMPILATION_CACHE_UNAVAILABLE,
+			ccache: request.platform === "android" ? ccacheActivity(result.compilationCache) : CCACHE_UNAVAILABLE,
+			timings: {
+				offerMs: choice.offerMs,
+				syncMs,
+				workerMs,
+				fetchMs,
+				totalMs: Date.now() - started + choice.offerMs,
+				worker: isJsonObject(result.timings) ? result.timings : {},
+				uploadedBytes,
+				artifactBytes: received
+			}
+		};
+	} catch (error) {
+		return fail(error.message.split("\n")[0] ?? String(error));
+	}
+}
+function packageName(projectRoot) {
+	try {
+		const name = JSON.parse(readFileSync(join(projectRoot, "package.json"), "utf8")).name;
+		return typeof name === "string" ? name : null;
+	} catch {
+		return null;
+	}
+}
+const numberOrNull = (field) => typeof field === "number" ? field : null;
+function compilationActivity(value) {
+	if (!isJsonObject(value) || value.status !== "reported") return COMPILATION_CACHE_UNAVAILABLE;
+	return {
+		status: "reported",
+		hits: numberOrNull(value.hits),
+		cacheableTasks: numberOrNull(value.cacheableTasks),
+		hitRatePercent: numberOrNull(value.hitRatePercent)
+	};
+}
+function ccacheActivity(value) {
+	if (!isJsonObject(value) || value.status !== "reported") return CCACHE_UNAVAILABLE;
+	return {
+		status: "reported",
+		hits: numberOrNull(value.hits),
+		misses: numberOrNull(value.misses),
+		hitRatePercent: numberOrNull(value.hitRatePercent)
+	};
+}
+const mb = (bytes) => `${(bytes / 1024 ** 2).toFixed(1)} MB`;
+const seconds = (ms) => `${(ms / 1e3).toFixed(1)}s`;
+function simulatorRuntime(udid) {
+	try {
+		const listed = JSON.parse(getExecutor().runFileQuiet("xcrun", [
+			"simctl",
+			"list",
+			"devices",
+			"-j"
+		], { timeoutMs: 2e4 }) ?? "{}");
+		for (const [runtime, devices] of Object.entries(listed.devices ?? {})) if (devices.some((device) => device.udid === udid)) return runtime;
+	} catch {}
+	return null;
+}
+const DOCTOR_CONNECT_MS = 5e3;
+const DOCTOR_OFFER_MS = 8e3;
+const PLATFORM_LABEL = {
+	ios: "iOS",
+	android: "Android",
+	macos: "macOS"
+};
+const SHARED_PROBLEMS = /* @__PURE__ */ new Set([
+	"stim-build",
+	"arch",
+	"disk",
+	"busy"
+]);
+/**
+* Doctor's offload check for `projectRoot`: one bounded offer per machine, judged for each build `targets` returns
+* by `offerProblems` exactly as placement judges it. No build runs. With several targets, a problem that only
+* one platform has names it.
+*/
+function offloadCheck(projectRoot, targets) {
+	let identity;
+	try {
+		identity = repoIdentity(projectRoot);
+	} catch (error) {
+		identity = error.message.split("\n")[0] ?? "git failed";
+	}
+	let resolved = null;
+	return async (credential) => {
+		if (typeof identity === "string") return {
+			capacity: null,
+			problems: [{
+				code: "checkout",
+				reason: `this app is not in a git checkout (${identity})`
+			}]
+		};
+		const probe = await probeMachine(credential, identity, {
+			connectMs: DOCTOR_CONNECT_MS,
+			offerMs: DOCTOR_OFFER_MS
+		});
+		if ("failure" in probe) return {
+			capacity: null,
+			problems: [{
+				code: "unreachable",
+				reason: probe.failure
+			}]
+		};
+		probe.connection.close();
+		resolved ??= targets();
+		const problems = [];
+		for (const target of resolved) for (const problem of offerProblems(probe.offer, target)) {
+			const labeled = resolved.length > 1 && !SHARED_PROBLEMS.has(problem.code) ? {
+				...problem,
+				reason: `${PLATFORM_LABEL[target.platform]}: ${problem.reason}`
+			} : problem;
+			if (!problems.some((each) => each.code === labeled.code && each.reason === labeled.reason)) problems.push(labeled);
+		}
+		return {
+			capacity: probe.offer.capacity,
+			problems
+		};
+	};
+}
+//#endregion
+export { readHostPermissions as S, findPeer$1 as _, offloadBuild as a, realIo as b, placementLoad as c, OffloadRefusal as d, namedBuildMachine as f, endpoint as g, inspectBuildMachines as h, closeOffload as i, remotePhaseText as l, resolveBuildPlacement as m, buildPlacementCandidates as n, offloadCheck as o, parseBuildMachineOption as p, chooseBuildMachine as r, offloadPlacement as s, BuildConnection as t, simulatorRuntime as u, parseMachine$1 as v, readAccessTicket as x, pinnedEndpoint$1 as y };