stim 1.19.0 → 1.20.0

package/dist/{cli-C9Zvgbdc.mjs → cli-B2R8wH1F.mjs}

@@ -1,27 +1,27 @@
-import { n as debugLog } from "./exec-i8GDPwq9.mjs";
-import { y as refuseRelativeStimPaths } from "./config-DC5jEtd1.mjs";
+import { n as debugLog } from "./exec-B81Qodjn.mjs";
+import { y as refuseRelativeStimPaths } from "./config-D0LhTY3S.mjs";
 import { readFileSync } from "node:fs";
 import { runId } from "@stim-cli/core/state";
 import { Command } from "commander";
 //#region bin/cli.ts
 const commands = /* @__PURE__ */ new Map([
-	["doctor", () => import("./doctor-PRJH94v6.mjs")],
-	["worktree", () => import("./worktree-DV-A0LNL.mjs")],
-	["start", () => import("./start-D8NbxNBb.mjs")],
-	["ports", () => import("./ports-ByPc0_97.mjs")],
-	["stop", () => import("./stop-DRipAg-e.mjs")],
-	["ios", () => import("./ios-DYUr9LGc.mjs")],
-	["android", () => import("./android-BvV1gGdN.mjs")],
-	["web", () => import("./web-DFpFeZu5.mjs")],
-	["macos", () => import("./macos-nIOATJmR.mjs")],
-	["reload", () => import("./reload-rAPdqeRR.mjs")],
-	["device", () => import("./device-BHw0WlHl.mjs")],
-	["logs", () => import("./logs-Bao1HOMy.mjs")],
-	["settings", () => import("./settings-2am7TSxp.mjs")],
-	["status", () => import("./status-BOyp0CUl.mjs")],
-	["stats", () => import("./stats-8EJ5ivFT.mjs")],
-	["gc", () => import("./gc-CyHMcKcn.mjs")],
-	["guide", () => import("./guide-dRaQJJk9.mjs")]
+	["doctor", () => import("./doctor-C2MSuMMg.mjs")],
+	["worktree", () => import("./worktree-q7_OZNY0.mjs")],
+	["start", () => import("./start-CbQCSnXQ.mjs")],
+	["ports", () => import("./ports-jzvAJXXL.mjs")],
+	["stop", () => import("./stop-CCZS-C9m.mjs")],
+	["ios", () => import("./ios-BZ9dg2Fr.mjs")],
+	["android", () => import("./android-0vv-OruW.mjs")],
+	["web", () => import("./web-BLXpOe6b.mjs")],
+	["macos", () => import("./macos-C0iljhsN.mjs")],
+	["reload", () => import("./reload-D34GkY78.mjs")],
+	["device", () => import("./device-B7lsC0K1.mjs")],
+	["logs", () => import("./logs-DHaRNfg7.mjs")],
+	["settings", () => import("./settings-CT3E71-i.mjs")],
+	["status", () => import("./status-DARMkc9q.mjs")],
+	["stats", () => import("./stats-BIIDrjA8.mjs")],
+	["gc", () => import("./gc-PWp34zGb.mjs")],
+	["guide", () => import("./guide-Dai9lphv.mjs")]
 ]);
 const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf-8"));
 const program = new Command();
@@ -52,7 +52,7 @@ try {
 			}));
 		}
 		try {
-			const { triggerMaintenance } = await import("./trigger-CoalsMTV.mjs");
+			const { triggerMaintenance } = await import("./trigger-SHLOWJ4O.mjs");
 			triggerMaintenance(action.name());
 		} catch {}
 	});

package/dist/cli.mjs

@@ -4,6 +4,6 @@ const encode = (version) => version.split(".", 3).reduce((sum, part) => sum * 1e
 if (encode(process.versions.node) < encode("22.12.0")) {
 	process.stderr.write(`STIM_NODE_UNSUPPORTED: Stim needs Node 22.12.0 or later; this is Node ${process.versions.node} at ${process.execPath}. To run Stim where a project pins an older Node, see https://stim.appandflow.com/docs/requirements#older-node-pins\n`);
 	process.exitCode = 1;
-} else import("./cli-C9Zvgbdc.mjs");
+} else import("./cli-B2R8wH1F.mjs");
 //#endregion
 export {};

package/dist/{client-CuUo8Nvg.mjs → client-BLy1Pw2V.mjs}

@@ -1,18 +1,17 @@
-import { n as debugLog, t as getExecutor } from "./exec-i8GDPwq9.mjs";
-import { a as formatElapsed } from "./command-output-Bt8ygHE7.mjs";
-import { _ as loadConfig$1, d as getConfigDir } from "./config-DC5jEtd1.mjs";
-import { a as updateWorkspaceState, r as readWorkspaceState$1, t as clearWorkspaceStateKey, v as workspaceDir, w as withDirLock } from "./workspace-state-CR9X86xJ.mjs";
-import { i as signalDeclaredSpawns, r as refuseDeclaredSpawns, t as allowDeclaredSpawns } from "./spawn-claims-Kqiifsk2.mjs";
-import { a as withWorkspaceProcessLock } from "./named-ports-B4iWH4E-.mjs";
-import { r as CCACHE_UNAVAILABLE, t as manifestDigest } from "./manifest-CX0d1IkZ.mjs";
-import { a as toolchainMismatches, m as COMPILATION_CACHE_UNAVAILABLE, u as readRubyVersion } from "./toolchain-C3xSoyUl.mjs";
+import { n as debugLog, t as getExecutor } from "./exec-B81Qodjn.mjs";
+import { _ as loadConfig$1, d as getConfigDir } from "./config-D0LhTY3S.mjs";
+import { D as withDirLock } from "./workspace-state-CSIFuuDa.mjs";
+import { a as markApproved, c as pinnedEndpoint$1, i as lapsedLine, l as realIo, n as findPeer$1, o as parseMachine$1, r as isLapsed, s as pendingReport, t as endpoint, u as requestedLine, x as runCancellationSignal } from "./tailnet-CoJUb2tB.mjs";
+import { n as CCACHE_UNAVAILABLE } from "./ccache-CjHQ5F8g.mjs";
+import { l as toolchainMismatches, m as readRubyVersion, v as COMPILATION_CACHE_UNAVAILABLE } from "./toolchain-DqyDXs30.mjs";
+import { c as gitVisiblePaths, i as nativeGradleTransfer, l as nativeTransferManifest, m as manifestDigest, s as checkNativeTransferMembership, u as sourceManifest } from "./native-gradle-inputs-BQnIdAlL.mjs";
 import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, writeFileSync, writeSync } from "node:fs";
-import { basename, dirname, join, relative } from "node:path";
-import { OFFLOAD_MODES, acceptsShape, automaticMachineEnabled, buildMachinesFile, buildMachinesLock, deviceHostMachinesClaims, deviceHostMachinesFile, deviceHostMachinesLock, endpoint, findPeer as findPeer$1, isJsonObject, parseMachine, parseMachine as parseMachine$1, pinnedEndpoint, readBuildMachines, readDeviceHostMachines, requireAutomaticMachine, runId, saturation, settingDefinition } from "@stim-cli/core/state";
-import { hostname } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
+import { OFFLOAD_MODES, acceptsShape, automaticMachineEnabled, buildMachinesFile, buildMachinesLock, deviceHostMachinesClaims, deviceHostMachinesFile, deviceHostMachinesLock, isJsonObject, parseMachine, readBuildMachines, readDeviceHostMachines, requireAutomaticMachine, runId, saturation, settingDefinition } from "@stim-cli/core/state";
 import { InvalidArgumentError } from "commander";
 import { releaseClaim, tryAcquireClaim } from "@stim-cli/core/ownership-claim";
 import { createHash } from "node:crypto";
+import { hostname } from "node:os";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { WebSocket } from "ws";
 //#region src/offload/access-ticket.ts
@@ -32,95 +31,6 @@ function readHostPermissions(value) {
 	} : void 0;
 }
 //#endregion
-//#region src/offload/tailnet.ts
-const MAC_APP_TAILSCALE = "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
-const HELLO_TIMEOUT_MS = 1e4;
-function isLapsed(credential) {
-	return credential.state === "pending" && !!credential.expiresAt && Date.parse(credential.expiresAt) <= Date.now();
-}
-function markApproved(credential) {
-	const { expiresAt: _expiresAt, ...rest } = credential;
-	return {
-		...rest,
-		state: "approved"
-	};
-}
-function pendingReport(credential) {
-	return {
-		state: "pending",
-		...credential.expiresAt ? { expiresAt: credential.expiresAt } : {}
-	};
-}
-function lapsedLine(machine, credential) {
-	return `${machine} did not approve this Mac before the request lapsed at ${credential.expiresAt}.`;
-}
-function requestedLine(credential) {
-	return `Requested at ${credential.requestedAt}${credential.expiresAt ? `; the request lapses at ${credential.expiresAt}` : ""}.`;
-}
-function tailscaleStatus() {
-	for (const binary of ["tailscale", MAC_APP_TAILSCALE]) {
-		const output = getExecutor().runFileQuiet(binary, ["status", "--json"], { timeoutMs: 5e3 });
-		if (output === null) continue;
-		try {
-			const status = JSON.parse(output);
-			return isJsonObject(status) && status.BackendState === "Running" ? status : null;
-		} catch {
-			return null;
-		}
-	}
-	return null;
-}
-function hello({ url, servername, host }, auth) {
-	return new Promise((resolve) => {
-		const socket = new WebSocket(url, {
-			handshakeTimeout: HELLO_TIMEOUT_MS,
-			servername,
-			headers: { Host: host }
-		});
-		const done = (reply) => {
-			clearTimeout(timer);
-			socket.removeAllListeners();
-			socket.on("error", () => {});
-			socket.close();
-			resolve(reply);
-		};
-		const timer = setTimeout(() => done({ failed: "no reply in time" }), HELLO_TIMEOUT_MS);
-		socket.on("open", () => {
-			socket.send(JSON.stringify({
-				id: 1,
-				method: "hello",
-				params: {
-					protocol: 1,
-					client: {
-						name: "stim",
-						version: "1"
-					},
-					auth
-				}
-			}));
-		});
-		socket.on("message", (data) => {
-			let message;
-			try {
-				message = JSON.parse(String(data));
-			} catch {
-				message = null;
-			}
-			if (isJsonObject(message) && ("result" in message || "error" in message)) return done(message);
-			done({ failed: "the reply was not a hello result" });
-		});
-		socket.on("error", (error) => done({ failed: error.message }));
-		socket.on("close", () => done({ failed: "the connection closed before a reply" }));
-	});
-}
-const realIo = {
-	status: tailscaleStatus,
-	hello
-};
-function pinnedEndpoint$1(credential, status = tailscaleStatus) {
-	return pinnedEndpoint(credential, parseMachine(credential.machine) ? status() : null);
-}
-//#endregion
 //#region src/device-host/machines.ts
 function note$1(title, detail, fix = null) {
 	return {
@@ -766,159 +676,6 @@ function reportRemoteFailure(event, fields) {
 	} catch {}
 }
 //#endregion
-//#region src/engine/native-run.ts
-const NATIVE_RUN_LOCK = "native-run";
-const NATIVE_RUN_WAIT_MS = 18e5;
-const WAIT_HEARTBEAT_MS = 3e4;
-const CANCEL_REQUEST_KEY = "nativeRunCancel";
-function nativeRunHolder(holder) {
-	const { command, platform, slot } = holder.details;
-	return {
-		command: typeof command === "string" ? command : null,
-		platform: typeof platform === "string" ? platform : null,
-		slot: typeof slot === "string" ? slot : "default"
-	};
-}
-function describeNativeRunHolder(holder, now) {
-	const { command, slot } = nativeRunHolder(holder);
-	const started = Date.parse(holder.startedAt);
-	const facts = [`pid ${holder.owner.pid}`];
-	if (Number.isFinite(started)) facts.push(`running for ${formatElapsed(now - started)}`);
-	if (command === null) return `another Stim run (${facts.join(", ")})`;
-	return `\`stim ${command}${slot === "default" ? "" : ` --slot ${slot}`}\` (${facts.join(", ")})`;
-}
-/**
-* Report a wait on the native-run lock: one line as soon as a holder is seen, a line for each new
-* holder, and a heartbeat every WAIT_HEARTBEAT_MS while the same holder keeps it.
-*/
-function nativeRunWaitNotice({ write, now = Date.now, describe = describeNativeRunHolder }) {
-	let claimId = null;
-	let lastAt = 0;
-	return (holder, firstLine) => {
-		const at = now();
-		if (holder.claimId !== claimId) {
-			claimId = holder.claimId;
-			lastAt = at;
-			write(firstLine ?? `waiting for ${describe(holder, at)} in this workspace to finish`);
-			return;
-		}
-		if (at - lastAt < WAIT_HEARTBEAT_MS) return;
-		lastAt = at;
-		write(`still waiting for ${describe(holder, at)}`);
-	};
-}
-/**
-* What `stop` does about the run holding the native-run lock. A build is interrupted only when the stop
-* leaves it nothing to deploy to: the whole workspace stops, the build targets the stopped slot, or the
-* stopped slot is the workspace's only device. A build for another slot that stays is left running and
-* the stop proceeds without the lock. Only an owner whose identity is proven live is signalled.
-*/
-function decideStopAction({ stopSlot, holder, ownerIdentity, deviceSlots }) {
-	if (holder.command === "macos") {
-		if (stopSlot !== void 0) return { action: "proceed" };
-		return ownerIdentity === "same" ? { action: "interrupt" } : { action: "refuse" };
-	}
-	if (holder.command !== "ios" && holder.command !== "android") return { action: "wait" };
-	if (!(stopSlot === void 0 || holder.slot === stopSlot || deviceSlots.includes(stopSlot) && deviceSlots.every((slot) => slot === stopSlot))) return { action: "proceed" };
-	return ownerIdentity === "same" ? { action: "interrupt" } : { action: "refuse" };
-}
-function requestNativeRunCancel(root, claimId, pid = process.pid) {
-	updateWorkspaceState(root, (state) => ({
-		...state,
-		[CANCEL_REQUEST_KEY]: {
-			claimId,
-			pid,
-			at: (/* @__PURE__ */ new Date()).toISOString()
-		}
-	}));
-}
-function cancelRequestFor(root, claimId) {
-	const request = readWorkspaceState$1(root)?.[CANCEL_REQUEST_KEY];
-	if (request?.claimId !== claimId || typeof request.pid !== "number") return null;
-	return { pid: request.pid };
-}
-function clearNativeRunCancel(root, claimId) {
-	try {
-		clearWorkspaceStateKey(root, CANCEL_REQUEST_KEY, (value) => value?.claimId === claimId);
-	} catch {}
-}
-let cancelled = null;
-let cancellationSignal;
-/** The active native run aborts this signal when it is cancelled. */
-function runCancellationSignal() {
-	return cancellationSignal;
-}
-/** Why this process's native run was cancelled, or null while it was not. */
-function runCancellation() {
-	return cancelled;
-}
-function cancelledFailure(platform, { code, message }) {
-	if (cancelled === null) return null;
-	return {
-		code: "STIM_CANCELLED",
-		message: `The ${platform} run was ${cancelled} before it finished.`,
-		remedy: `Run \`stim ${platform}\` again when you want the app on a device.`,
-		lines: [`it stopped at ${code ?? "an unfinished step"}${message ? `: ${message}` : ""}`]
-	};
-}
-function cancelOnInterrupt({ root, claim, write, exit, controller }) {
-	let signals = 0;
-	const onInterrupt = () => {
-		signals += 1;
-		if (signals > 1) {
-			exit(130);
-			return;
-		}
-		const request = cancelRequestFor(root, claim.claimId);
-		cancelled = request ? `cancelled by \`stim stop\` (pid ${request.pid})` : "cancelled by an interrupt";
-		controller.abort();
-		refuseDeclaredSpawns(`the run was ${cancelled}`);
-		const signalled = signalDeclaredSpawns("SIGINT");
-		write(signalled > 0 ? `${cancelled}; stopping the running build tool` : request ? `${cancelled}; stopping before the next build tool or install` : cancelled);
-		if (signalled === 0 && !request) exit(130);
-	};
-	process.on("SIGINT", onInterrupt);
-	return () => {
-		process.off("SIGINT", onInterrupt);
-		allowDeclaredSpawns();
-		clearNativeRunCancel(root, claim.claimId);
-	};
-}
-/**
-* Run an `ios`, `android` or `macos` invocation under the workspace's native-run lock: the claim records the
-* command, platform and slot, and a wait for another holder is reported on `write`. The first SIGINT
-* forwards the interrupt to the running declared build tool; a run `stim stop` cancelled between build
-* tools starts no further one; a terminal interrupt with no build tool running, or a second SIGINT, exits
-* with 130 at once.
-*/
-function withNativeBuildRun(root, details, fn, { write, exit = (code) => process.exit(code) }) {
-	const notice = nativeRunWaitNotice({ write });
-	return withWorkspaceProcessLock(workspaceDir(root), NATIVE_RUN_LOCK, async (claim) => {
-		cancelled = null;
-		const controller = new AbortController();
-		cancellationSignal = controller.signal;
-		const dispose = cancelOnInterrupt({
-			root,
-			claim,
-			write,
-			exit,
-			controller
-		});
-		try {
-			return await fn(claim);
-		} finally {
-			dispose();
-			cancellationSignal = void 0;
-		}
-	}, {
-		external: true,
-		waitMs: NATIVE_RUN_WAIT_MS,
-		declareSpawns: true,
-		details: { ...details },
-		onHeld: (holder) => notice(holder)
-	});
-}
-//#endregion
 //#region src/offload/client.ts
 const CONNECT_TIMEOUT_MS = 1e4;
 const OFFER_TIMEOUT_MS = 2e4;
@@ -1402,61 +1159,37 @@ function repoIdentity(projectRoot) {
 		lockfile: lock ? createHash("sha256").update(readFileSync(join(repoRoot, lock))).digest("hex") : null
 	};
 }
-/** The exact source a build needs: tracked and untracked, not ignored, as `git ls-files -co --exclude-standard`. */
-function sourceManifest(repoRoot) {
-	const listed = getExecutor().runFile("git", [
-		"-C",
-		repoRoot,
-		"ls-files",
-		"-z",
-		"-co",
-		"--exclude-standard"
-	], {
-		untrimmed: true,
-		timeoutMs: 12e4
-	});
-	const files = [];
-	for (const path of new Set(listed.split("\0").filter(Boolean))) {
-		const absolute = join(repoRoot, path);
-		let stat;
-		try {
-			stat = lstatSync(absolute);
-		} catch {
-			continue;
-		}
-		if (stat.isSymbolicLink()) {
-			const target = Buffer.from(readlinkSync(absolute));
-			files.push({
-				path,
-				kind: "link",
-				size: target.length,
-				sha256: sha256(target)
-			});
-		} else if (stat.isFile()) {
-			const content = readFileSync(absolute);
-			files.push({
-				path,
-				kind: stat.mode & 73 ? "exec" : "file",
-				size: content.length,
-				sha256: sha256(content)
-			});
-		}
+const sha256 = (content) => createHash("sha256").update(content).digest("hex");
+/** Why the native inputs cannot be sent to a remote Mac, such as an ignored file among them, or null when they can. */
+function nativeTransferRefusal(repoRoot, snapshot) {
+	try {
+		checkNativeTransferMembership(snapshot, gitVisiblePaths(repoRoot));
+		return null;
+	} catch (error) {
+		return error.message.split("\n")[0];
 	}
-	return files;
 }
-const sha256 = (content) => createHash("sha256").update(content).digest("hex");
 function blobContent(repoRoot, file) {
 	const absolute = join(repoRoot, file.path);
-	return file.kind === "link" ? Buffer.from(readlinkSync(absolute)) : readFileSync(absolute);
+	return file.kind === "directory" ? Buffer.alloc(0) : file.kind === "link" ? Buffer.from(readlinkSync(absolute)) : readFileSync(absolute);
 }
 /** Closes every connection the choice still holds. */
 function closeOffload(choice) {
 	choice.connection.close();
 	for (const each of choice.runnersUp.splice(0)) each.connection.close();
 }
+const NATIVE_BUILD_FEATURE = {
+	xcode: "native-xcode-build",
+	gradle: "native-gradle-build"
+};
+const unsupportedNative = (provider) => `This worker does not support native ${provider === "xcode" ? "Xcode" : "Gradle"} builds.`;
+const ANDROID_PACKAGE = /^[A-Za-z_][\w]*(?:\.[A-Za-z_][\w]*)+$/;
+function nativeTransferInput(native) {
+	return native?.provider === "xcode" ? native.snapshot : native?.transfer;
+}
 /** Connects to one paired machine and asks it for an offer; the caller closes the connection it returns. */
 async function probeMachine(credential, identity, { connectMs = CONNECT_TIMEOUT_MS, offerMs = OFFER_TIMEOUT_MS } = {}) {
-	const target = pinnedEndpoint$1(credential);
+	const target = await pinnedEndpoint$1(credential);
 	if (typeof target === "string") return {
 		credential,
 		failure: target
@@ -1466,10 +1199,18 @@ async function probeMachine(credential, identity, { connectMs = CONNECT_TIMEOUT_
 		credential,
 		failure: connection.failure
 	};
+	if (identity.native && !connection.supports(NATIVE_BUILD_FEATURE[identity.native])) {
+		connection.close();
+		return {
+			credential,
+			failure: unsupportedNative(identity.native)
+		};
+	}
+	const native = identity.native === "gradle" || identity.native && connection.supports("native-xcode-toolchain") ? identity.native : void 0;
 	const reply = await connection.request("build.offer", {
 		repo: identity.repo,
 		...identity.lockfile ? { lockfile: identity.lockfile } : {},
-		...identity.rubyVersion ? { rubyVersion: identity.rubyVersion } : {}
+		...native ? { native } : identity.rubyVersion ? { rubyVersion: identity.rubyVersion } : {}
 	}, offerMs);
 	const failure = replyError(reply);
 	if (failure || !("result" in reply)) {
@@ -1502,7 +1243,8 @@ async function chooseBuildMachine({ projectRoot, target, mode, here, note, machi
 	const rubyVersion = readRubyVersion(projectRoot) ?? void 0;
 	const asked = await Promise.all(machines.map((credential) => probeMachine(credential, {
 		...identity,
-		rubyVersion
+		rubyVersion,
+		...target.platform !== "macos" ? { native: target.native } : {}
 	})));
 	const { order, reasons, candidates } = pickOffer({
 		localEnabled: selected !== "auto" || automaticMachineEnabled("build", "local"),
@@ -1540,6 +1282,10 @@ async function chooseBuildMachine({ projectRoot, target, mode, here, note, machi
 		automatic: selected === "auto"
 	};
 }
+function validArtifactIdentity(request, fingerprint) {
+	if (request.platform === "macos") return true;
+	return request.native?.provider === "gradle" ? fingerprint === null : typeof fingerprint === "string" && fingerprint.length > 0;
+}
 const ARTIFACT_NAME = {
 	ios: /^[^/]+\.app$/,
 	android: /^[^/]+\.apk$/,
@@ -1550,12 +1296,12 @@ const ARTIFACT_NAME = {
 * `RESUME_WINDOW_MS`, shorter than the machine's grace for a dropped connection, has passed. Returns why it
 * could not.
 */
-async function resumeJob(credential, job, abandoned, signal) {
+async function resumeJob(credential, job, abandoned, signal, native) {
 	const deadline = Date.now() + RESUME_WINDOW_MS;
 	let delay = RESUME_DELAY_MS;
 	let last = "no attempt";
 	while (!abandoned()) {
-		const target = pinnedEndpoint$1(credential);
+		const target = await pinnedEndpoint$1(credential);
 		const connection = typeof target === "string" ? {
 			failure: target,
 			refused: false
@@ -1568,6 +1314,10 @@ async function resumeJob(credential, job, abandoned, signal) {
 				connection.close();
 				break;
 			}
+			if (native && !connection.supports(NATIVE_BUILD_FEATURE[native])) {
+				connection.close();
+				return unsupportedNative(native);
+			}
 			const early = [];
 			connection.onProgress((event) => early.push(event));
 			const cancel = () => connection.close();
@@ -1600,10 +1350,11 @@ async function resumeJob(credential, job, abandoned, signal) {
 	return `no connection to it within ${RESUME_WINDOW_MS / 6e4} min (${last})`;
 }
 /** Mirrors the checkout on the machine: the manifest in pages, then every blob it lacks. */
-async function syncSource(connection, identity, onEnter) {
+async function syncSource(connection, identity, onEnter, native) {
 	onEnter("sync");
 	const syncStarted = Date.now();
-	const manifest = sourceManifest(identity.repoRoot);
+	const manifest = native && "declaration" in native ? nativeGradleTransfer(join(identity.repoRoot, identity.project), native.declaration).files : native ? nativeTransferManifest(identity.repoRoot, native, sourceManifest(identity.repoRoot)) : sourceManifest(identity.repoRoot);
+	if (native && "declaration" in native && manifestDigest(manifest) !== native.digest) return { failure: "The native Gradle source changed before upload." };
 	const bySha = new Map(manifest.map((file) => [file.sha256, file]));
 	const missing = [];
 	for (let index = 0; index < manifest.length || index === 0;) {
@@ -1647,12 +1398,20 @@ async function syncSource(connection, identity, onEnter) {
 		digest: manifestDigest(manifest)
 	};
 }
+function stagedArtifactEscapes(stagingDir, artifactPath, hasContents) {
+	if ((hasContents ? [artifactPath, join(artifactPath, "Contents")] : [artifactPath]).some((path) => lstatSync(path, { throwIfNoEntry: false })?.isSymbolicLink())) return true;
+	if (!existsSync(artifactPath)) return false;
+	const inside = relative(realpathSync(stagingDir), realpathSync(artifactPath));
+	return inside === ".." || inside.startsWith(`..${sep}`) || isAbsolute(inside);
+}
 /**
 * Builds on the chosen machine and brings the `.app` or `.apk` back into `stagingDir`, verified against the
 * sha256 the machine reports. The caller re-fingerprints and stores it.
 */
 async function offloadBuild({ choice, expectedFingerprint, request, stagingDir, onPhase, onEnter, onRecord, note }) {
 	const { identity } = choice;
+	const native = request.platform !== "macos" ? request.native : void 0;
+	let sourceDigest = null;
 	const started = Date.now();
 	const fail = (reason) => {
 		closeOffload(choice);
@@ -1684,6 +1443,8 @@ async function offloadBuild({ choice, expectedFingerprint, request, stagingDir,
 	signal?.addEventListener("abort", cancel, { once: true });
 	try {
 		throwIfCancelled();
+		if (!validArtifactIdentity(request, expectedFingerprint)) return fail("The build request has an invalid reusable artifact identity.");
+		if (native?.provider === "xcode" && native.snapshot.hash !== expectedFingerprint) return fail("The native source snapshot does not match the requested artifact identity.");
 		let job = null;
 		let early = [];
 		let resuming = false;
@@ -1691,7 +1452,7 @@ async function offloadBuild({ choice, expectedFingerprint, request, stagingDir,
 			if (resuming || settled) return;
 			resuming = true;
 			note(`offload: the connection to ${choice.machine} dropped (${why}); reattaching to the build there`);
-			const resumed = await resumeJob(choice.credential, job, () => settled, signal);
+			const resumed = await resumeJob(choice.credential, job, () => settled, signal, native?.provider);
 			resuming = false;
 			if (settled) {
 				if (typeof resumed !== "string") resumed.connection.close();
@@ -1739,13 +1500,19 @@ async function offloadBuild({ choice, expectedFingerprint, request, stagingDir,
 				if (moveOn(reason)) continue;
 				return fail(reason);
 			}
-			const synced = await syncSource(choice.connection, identity, onEnter);
+			if (native && !choice.connection.supports(NATIVE_BUILD_FEATURE[native.provider])) {
+				const reason = unsupportedNative(native.provider);
+				if (moveOn(reason)) continue;
+				return fail(reason);
+			}
+			const synced = await syncSource(choice.connection, identity, onEnter, nativeTransferInput(native));
 			throwIfCancelled();
 			if ("failure" in synced) {
 				if (moveOn(synced.failure)) continue;
 				return fail(synced.failure);
 			}
 			({syncMs, uploadedBytes} = synced);
+			sourceDigest = synced.digest;
 			onPhase("sync", `${synced.files} files, uploaded ${synced.uploaded} (${mb(uploadedBytes)}) in ${seconds(syncMs)}`);
 			workerStarted = Date.now();
 			early = [];
@@ -1757,6 +1524,15 @@ async function offloadBuild({ choice, expectedFingerprint, request, stagingDir,
 				project: identity.project,
 				platform: request.platform,
 				fingerprint: request.platform === "macos" ? synced.digest : expectedFingerprint,
+				...native ? { native: {
+					provider: native.provider,
+					sourceDigest: synced.digest,
+					...native.provider === "xcode" ? {
+						cacheKey: native.cacheKey,
+						arch: native.arch,
+						parameters: native.snapshot.parameters
+					} : { inputs: native.transfer.declaration }
+				} } : {},
 				...request.platform === "macos" ? { macos: {
 					product: request.product,
 					infoPlist: request.infoPlist,
@@ -1766,6 +1542,7 @@ async function offloadBuild({ choice, expectedFingerprint, request, stagingDir,
 				} } : {
 					configuration: request.platform === "ios" ? request.configuration : null,
 					scheme: request.platform === "ios" ? request.scheme : null,
+					iosProjectPath: request.platform === "ios" ? request.iosProjectPath ?? null : null,
 					runtime: request.platform === "ios" ? request.runtime : null,
 					packageName: packageName(join(identity.repoRoot, identity.project)),
 					isExpo: request.isExpo,
@@ -1797,6 +1574,8 @@ async function offloadBuild({ choice, expectedFingerprint, request, stagingDir,
 		connection.onProgress(null);
 		const workerMs = Date.now() - workerStarted;
 		if (result.ok !== true) return fail(`${String(result.code ?? "failed")}: ${String(result.message ?? "")}`);
+		if (native && (result.sourceDigest !== sourceDigest || result.fingerprint !== expectedFingerprint)) return fail("The worker returned a different native source or artifact identity.");
+		if (native?.provider === "gradle" && !ANDROID_PACKAGE.test(String(result.androidPackage ?? ""))) return fail("The worker returned no verified native APK package.");
 		const artifact = result.artifact;
 		const name = typeof artifact?.name === "string" ? artifact.name : "";
 		if (!ARTIFACT_NAME[request.platform].test(name) || typeof artifact.sha256 !== "string") return fail(`the machine reported no .${request.platform === "android" ? "apk" : "app"} artifact`);
@@ -1847,6 +1626,7 @@ async function offloadBuild({ choice, expectedFingerprint, request, stagingDir,
 		throwIfCancelled();
 		rmSync(archive, { force: true });
 		const artifactPath = join(stagingDir, name);
+		if (stagedArtifactEscapes(stagingDir, artifactPath, request.platform === "macos")) return fail(`fetch: ${machine} returned ${name} as or through a symbolic link or outside the staging directory`);
 		if (request.platform === "ios" && !existsSync(join(artifactPath, "Info.plist"))) return fail(`fetch: ${name} has no Info.plist`);
 		if (request.platform === "android" && !(lstatSync(artifactPath, { throwIfNoEntry: false })?.isFile() ?? false)) return fail(`fetch: ${name} is not a file`);
 		if (request.platform === "macos") {
@@ -1868,6 +1648,7 @@ async function offloadBuild({ choice, expectedFingerprint, request, stagingDir,
 				sha256: digest
 			} } : {},
 			compilationCache: request.platform === "ios" ? compilationActivity(result.compilationCache) : COMPILATION_CACHE_UNAVAILABLE,
+			...native?.provider === "gradle" ? { androidPackage: result.androidPackage } : {},
 			ccache: request.platform === "android" ? ccacheActivity(result.compilationCache) : CCACHE_UNAVAILABLE,
 			timings: {
 				offerMs: choice.offerMs,
@@ -1979,9 +1760,10 @@ function offloadCheck(projectRoot, targets) {
 		};
 		probe.connection.close();
 		resolved ??= targets();
+		const resolvedTargets = await resolved;
 		const problems = [];
-		for (const target of resolved) for (const problem of offerProblems(probe.offer, target)) {
-			const labeled = resolved.length > 1 && !SHARED_PROBLEMS.has(problem.code) ? {
+		for (const target of resolvedTargets) for (const problem of offerProblems(probe.offer, target)) {
+			const labeled = resolvedTargets.length > 1 && !SHARED_PROBLEMS.has(problem.code) ? {
 				...problem,
 				reason: `${PLATFORM_LABEL[target.platform]}: ${problem.reason}`
 			} : problem;
@@ -1994,4 +1776,4 @@ function offloadCheck(projectRoot, targets) {
 	};
 }
 //#endregion
-export { resolveBuildPlacement as A, setRemoteLogSink as C, parseBuildMachineOption as D, namedBuildMachine as E, parseMachine$1 as F, pinnedEndpoint$1 as I, realIo as L, configuredMachines as M, hostingMachines as N, requireLocalBuild as O, inspectDeviceHostMachines as P, withNativeBuildRun as S, buildPlacementSettings as T, nativeRunHolder as _, offloadBuild as a, runCancellation as b, placementLoad as c, NATIVE_RUN_LOCK as d, NATIVE_RUN_WAIT_MS as f, describeNativeRunHolder as g, decideStopAction as h, closeOffload as i, inspectBuildMachines as j, resolveBuildMachine as k, remotePhaseText as l, clearNativeRunCancel as m, buildPlacementCandidates as n, offloadCheck as o, cancelledFailure as p, chooseBuildMachine as r, offloadPlacement as s, BuildConnection as t, simulatorRuntime as u, nativeRunWaitNotice as v, OffloadRefusal as w, runCancellationSignal as x, requestNativeRunCancel as y };
+export { inspectDeviceHostMachines as C, hostingMachines as S, requireLocalBuild as _, nativeTransferRefusal as a, inspectBuildMachines as b, offloadPlacement as c, simulatorRuntime as d, setRemoteLogSink as f, parseBuildMachineOption as g, namedBuildMachine as h, closeOffload as i, placementLoad as l, buildPlacementSettings as m, buildPlacementCandidates as n, offloadBuild as o, OffloadRefusal as p, chooseBuildMachine as r, offloadCheck as s, BuildConnection as t, remotePhaseText as u, resolveBuildMachine as v, configuredMachines as x, resolveBuildPlacement as y };

package/dist/collector-run.d.mts

@@ -18,6 +18,10 @@ interface ExecOptions {
    * `runFile` and `runFileAsync`: reject nonempty stderr even when the command exits successfully.
    */
   rejectStderr?: boolean;
+  /** `runFile` and `runFileAsync`: run in its own session with all stdio ignored and return ''; the child reports through a file, so a background process it leaves behind cannot hold a pipe open. */
+  detachedSilent?: boolean;
+  /** `runFile` and `runFileAsync`: exact values replaced with `***` in every string field of a thrown error, including message, stack, stdout, stderr and output. */
+  redact?: readonly string[];
 }
 interface Executor {
   run(cmd: string, opts?: ExecOptions): string;