stim 1.20.2 → 1.21.0

package/dist/config-CYcBF478.mjs

@@ -0,0 +1,949 @@
+import { f as ownership_claim_exports, g as trackReportResource, m as reportSignal, p as process_identity_exports, t as getExecutor } from "./exec-_UbtCQcG.mjs";
+import { join } from "node:path";
+import { ambientEnv, configDir, ensurePrivateDir } from "@stim-cli/core";
+import { allMetroPorts, cannotHost, clientIdentity, configCorruptRepair, endpoint, findEnclosingWorktreeRoot, findPeer as findPeer$1, getConcurrencyLimits, getConfigPath, getConfigPath as getConfigPath$1, getProject, getProjectSettings, getRepoSettings, isJsonObject, isPathPrefix, loadConfig, loadConfig as loadConfig$1, machineEndpoint, parseMachine, parseMachine as parseMachine$1, validateAutomaticPool, withConfigLock, withConfigLock as withConfigLock$1, withConfigLockAsync, withConfigLockAsync as withConfigLockAsync$1 } from "@stim-cli/core/state";
+import { dirname as dirname$1, isAbsolute as isAbsolute$1, join as join$1, normalize, parse, sep as sep$1 } from "path";
+import { WebSocket } from "ws";
+import { HandshakeRefusal, MAX_SERVER_MESSAGE_BYTES, TRANSPORT_OVERHEAD_BYTES, decodeSecret, initiateNoise, newSecret } from "@stim-cli/core/noise-session";
+import { existsSync, lstatSync, readdirSync, readlinkSync, renameSync, statSync, unlinkSync, writeFileSync } from "fs";
+import { InvalidArgumentError } from "commander";
+//#region src/offload/access-ticket.ts
+/** The setup ticket in `STIM_ACCESS_TICKET`, which Stim Desktop's Add Machine flow sets, or undefined. */
+function readAccessTicket() {
+	const ticket = ambientEnv().STIM_ACCESS_TICKET?.trim();
+	return ticket && decodeSecret(ticket) ? ticket : void 0;
+}
+function readHostPermissions(value) {
+	const host = value;
+	return host && typeof host.name === "string" && typeof host.screenRecording === "boolean" && typeof host.accessibility === "boolean" ? {
+		name: host.name,
+		screenRecording: host.screenRecording,
+		accessibility: host.accessibility
+	} : void 0;
+}
+//#endregion
+//#region src/offload/tailnet.ts
+const MAC_APP_TAILSCALE = "/Applications/Tailscale.app/Contents/MacOS/Tailscale";
+const HELLO_TIMEOUT_MS = 1e4;
+/** How long a setup ticket `stim doctor --fix` generates stays valid; `stim-server setup` takes at most 2 hours. */
+const GENERATED_TICKET_MS = 714e4;
+function parseTailscaleStatus(output) {
+	try {
+		const status = JSON.parse(output);
+		return isJsonObject(status) && status.BackendState === "Running" ? status : null;
+	} catch {
+		return null;
+	}
+}
+function tailscaleStatus() {
+	for (const binary of ["tailscale", MAC_APP_TAILSCALE]) {
+		const output = getExecutor().runFileQuiet(binary, ["status", "--json"], { timeoutMs: 5e3 });
+		if (output !== null) return parseTailscaleStatus(output);
+	}
+	return null;
+}
+async function tailscaleStatusAsync(signal) {
+	for (const binary of ["tailscale", MAC_APP_TAILSCALE]) {
+		signal?.throwIfAborted();
+		let output;
+		try {
+			output = await getExecutor().runFileAsync(binary, ["status", "--json"], {
+				timeoutMs: 5e3,
+				signal
+			});
+		} catch {
+			signal?.throwIfAborted();
+			continue;
+		}
+		signal?.throwIfAborted();
+		return parseTailscaleStatus(output);
+	}
+	return null;
+}
+const TURNED_AWAY = /* @__PURE__ */ new Set([
+	"unauthorized",
+	"forbidden",
+	"protocol-unsupported",
+	"server-key-mismatch"
+]);
+/** The connect code for a protocol 1 stim-server, which closes on the binary Noise prefix before answering it. */
+const SERVER_OUTDATED = "server-outdated";
+/**
+* The doctor finding for a protocol 1 stim-server on `entry`, shared by the build and device-host checks so doctor
+* prints it once. `command` is the setup command, when this machine has an unexpired ticket for it.
+*/
+function outdatedServer(entry, version, command) {
+	const update = `On ${entry}, run \`stim-server service update --release ${version}\` (add \`--label <name>\` for a custom service label; a server Stim Desktop runs updates with Stim Desktop)`;
+	return {
+		title: `Remote machine ${entry} runs an older stim-server`,
+		detail: `The stim-server on ${entry} speaks an older protocol than this Stim, so it cannot authenticate this machine.`,
+		fix: command ? `${update}, then run this there to approve this machine: ${command}` : `${update}, then run \`stim doctor --fix\` here.`
+	};
+}
+/**
+* Opens a WebSocket to `target` and runs the protocol 2 handshake with this machine's client key. A returning client
+* goes ahead only with the server that proves it holds the pinned key.
+*/
+function openAuthenticated(target, auth, timeoutMs, signal, operation) {
+	signal?.throwIfAborted();
+	return new Promise((resolve) => {
+		const options = {
+			handshakeTimeout: timeoutMs,
+			servername: target.servername,
+			headers: { Host: target.host },
+			maxPayload: MAX_SERVER_MESSAGE_BYTES + TRANSPORT_OVERHEAD_BYTES
+		};
+		const socket = new WebSocket(target.url, options);
+		if (reportSignal(operation)) trackReportResource(operation, new Promise((done) => socket.once("close", () => done())), () => socket.terminate());
+		let settled = false;
+		const finish = (value) => {
+			if (settled) return;
+			settled = true;
+			signal?.removeEventListener("abort", cancel);
+			clearTimeout(timer);
+			if (!("send" in value)) {
+				socket.removeAllListeners("open");
+				socket.removeAllListeners("message");
+				socket.removeAllListeners("error");
+				socket.on("error", () => {});
+				socket.terminate();
+			}
+			resolve(value);
+		};
+		const cancel = () => finish({
+			failure: "cancelled",
+			refused: false,
+			code: "STIM_CANCELLED"
+		});
+		const timer = setTimeout(() => finish({
+			failure: "no reply in time",
+			refused: false
+		}), timeoutMs);
+		signal?.addEventListener("abort", cancel, { once: true });
+		if (signal?.aborted) return cancel();
+		const failed = (error) => finish({
+			failure: /Unexpected server response: 502/.test(error.message) ? "no stim-server answers behind its tailscale serve route (HTTP 502)" : error.message,
+			refused: false
+		});
+		socket.once("error", failed);
+		socket.once("open", () => {
+			const secret = "ticket" in auth ? decodeSecret(auth.ticket) : null;
+			let keyPair;
+			try {
+				keyPair = clientIdentity();
+			} catch (error) {
+				return finish({
+					failure: `this machine's client key is unavailable: ${error.message}`,
+					refused: false
+				});
+			}
+			(async () => {
+				try {
+					const noise = await initiateNoise(socket, {
+						keyPair,
+						..."serverKey" in auth ? { serverKey: Buffer.from(auth.serverKey, "base64url") } : {},
+						...secret ? {
+							secret,
+							name: "name" in auth ? auth.name : ""
+						} : {},
+						timeoutMs
+					});
+					socket.off("error", failed);
+					socket.on("error", () => {});
+					finish(noise);
+				} catch (error) {
+					const code = error instanceof HandshakeRefusal ? error.code : "handshake-failed";
+					if (code === "unexpected binary frame") return finish({
+						failure: "its stim-server speaks an older protocol than this Stim",
+						refused: true,
+						code: SERVER_OUTDATED
+					});
+					finish({
+						failure: error.message,
+						refused: TURNED_AWAY.has(code) || code === "unknown-secret",
+						code
+					});
+				}
+			})();
+		});
+	});
+}
+/** Sends `hello` on an authenticated connection; a close before the reply carries the server's refusal code. */
+function sayHello(socket, params, timeoutMs) {
+	return new Promise((resolve) => {
+		const done = (reply) => {
+			clearTimeout(timer);
+			socket.off("message", onMessage);
+			socket.off("close", onClose);
+			resolve(reply);
+		};
+		const onMessage = (data, isBinary) => {
+			if (isBinary) return;
+			let message;
+			try {
+				message = JSON.parse(data.toString("utf8"));
+			} catch {
+				message = null;
+			}
+			if (!isJsonObject(message) || message.id !== 1) return;
+			if (isJsonObject(message.error)) return done({ error: {
+				code: String(message.error.code),
+				message: String(message.error.message)
+			} });
+			done({ result: isJsonObject(message.result) ? message.result : {} });
+		};
+		const onClose = (code, reason) => done({ error: {
+			code: reason.length ? reason.toString() : "closed",
+			message: `the connection closed before a hello result (${code}${reason.length ? ` ${reason.toString()}` : ""})`
+		} });
+		const timer = setTimeout(() => done({ error: {
+			code: "timeout",
+			message: "no reply in time"
+		} }), timeoutMs);
+		socket.on("message", onMessage);
+		socket.on("close", onClose);
+		socket.send(JSON.stringify({
+			id: 1,
+			method: "hello",
+			params
+		}));
+	});
+}
+async function hello(target, auth, operation) {
+	const socket = await openAuthenticated(target, auth, HELLO_TIMEOUT_MS, reportSignal(operation), operation);
+	if (!("send" in socket)) return socket.code ? { error: {
+		code: socket.code,
+		message: socket.failure
+	} } : { failed: socket.failure };
+	try {
+		if ("onServerKey" in auth) await auth.onServerKey?.(socket.remoteKey.toString("base64url"));
+	} catch (error) {
+		socket.close(1e3);
+		throw error;
+	}
+	const reply = await sayHello(socket, {
+		client: {
+			name: "stim",
+			version: "1"
+		},
+		access: auth.access
+	}, HELLO_TIMEOUT_MS);
+	socket.close(1e3);
+	if ("error" in reply) return reply;
+	const { result } = reply;
+	const device = isJsonObject(result.device) ? result.device : null;
+	if (!device || typeof device.id !== "string" || !Array.isArray(result.capabilities)) return { failed: "the reply was not a hello result" };
+	return {
+		result,
+		serverKey: socket.remoteKey.toString("base64url")
+	};
+}
+const realIo = {
+	status: tailscaleStatus,
+	hello
+};
+function doctorIo(operation) {
+	return {
+		status: () => tailscaleStatusAsync(operation?.signal),
+		hello: (target, auth) => hello(target, auth, operation)
+	};
+}
+/** Where to reach a paired machine now, or why Stim cannot; the handshake then checks its pinned key. */
+async function resolveEndpoint(credential, status = () => tailscaleStatusAsync(signal), signal) {
+	return machineEndpoint(credential.machine, parseMachine(credential.machine) ? await status() : null);
+}
+/** The remedy for a pending request: the printed setup command, or where the person finds it. */
+function setupRemedy(entry, command) {
+	return command ? `A person on ${entry} runs this there to approve this machine: ${command}` : `A person on ${entry} runs the \`stim-server setup\` command Stim Desktop showed for this machine.`;
+}
+function setupCommand(ticket, expiresAt, flags, version) {
+	return `STIM_SETUP_TICKET=${ticket} npx --yes --package @stim-cli/server@${version} stim-server setup --expires ${expiresAt} ${flags.map((flag) => `--${flag}`).join(" ")}`;
+}
+function newPending(input, ticket, expiresAt, now) {
+	return {
+		machine: input.machine,
+		transport: "tailscale",
+		address: input.address,
+		state: "pending",
+		requestedAt: new Date(now).toISOString(),
+		ticket,
+		...expiresAt ? { expiresAt } : {}
+	};
+}
+function approved(input, reply, requestedAt) {
+	return {
+		state: "approved",
+		credential: {
+			machine: input.machine,
+			transport: "tailscale",
+			address: input.address,
+			state: "approved",
+			requestedAt,
+			serverKey: reply.serverKey,
+			deviceId: reply.result.device.id
+		},
+		result: reply.result
+	};
+}
+/**
+* Connects to one remote machine for one access and says what changed. A returning client pins the stored server key.
+* A pending client spends its setup ticket in first contact until the worker's `stim-server setup` approves it; the
+* worker answers `unknown-secret` before that. With `fix`, a machine with no credential, or a revoked or lapsed one,
+* gets a new setup ticket: `STIM_ACCESS_TICKET` when set (Stim Desktop's Add Machine flow), else one this machine
+* generates, with the command to run on the worker. A pending credential is replaced when `STIM_ACCESS_TICKET` names
+* another ticket.
+*/
+async function reachMachine(input) {
+	const now = input.now ?? Date.now();
+	const { credential, io, access } = input;
+	const given = readAccessTicket();
+	const ask = () => {
+		if (given) return firstContact(newPending(input, given, void 0, now));
+		const other = input.other();
+		const shared = other?.state === "pending" && other.expiresAt ? other : void 0;
+		const ticket = shared ? {
+			ticket: shared.ticket,
+			expiresAt: shared.expiresAt
+		} : input.tickets.get(input.machine) ?? {
+			ticket: newSecret(),
+			expiresAt: new Date(now + GENERATED_TICKET_MS).toISOString()
+		};
+		input.tickets.set(input.machine, ticket);
+		return firstContact(newPending(input, ticket.ticket, ticket.expiresAt, now));
+	};
+	const firstContact = async (asked) => {
+		let pending = asked;
+		if (pending.serverKey) {
+			const resumed = await io.hello(input.endpoint, {
+				access,
+				serverKey: pending.serverKey
+			});
+			if ("result" in resumed && resumed.result.capabilities.includes(access)) return approved(input, resumed, pending.requestedAt);
+		}
+		const reply = await io.hello(input.endpoint, {
+			access,
+			ticket: pending.ticket,
+			name: input.deviceName,
+			onServerKey: (serverKey) => {
+				pending = {
+					...pending,
+					serverKey
+				};
+				return input.persist(pending);
+			}
+		});
+		if ("result" in reply && reply.result.capabilities.includes(access)) return approved(input, reply, pending.requestedAt);
+		const command = pending.expiresAt ? setupCommand(pending.ticket, pending.expiresAt, input.setupFlags, input.serverVersion) : null;
+		if ("error" in reply && reply.error.code === "server-outdated") return {
+			state: "outdated",
+			credential: pending,
+			command
+		};
+		const sibling = "error" in reply && reply.error.code === "unknown-secret" ? input.other()?.serverKey : void 0;
+		if (sibling && sibling !== pending.serverKey) {
+			const again = await io.hello(input.endpoint, {
+				access,
+				serverKey: sibling
+			});
+			if ("result" in again && again.result.capabilities.includes(access)) return approved(input, again, pending.requestedAt);
+		}
+		if ("error" in reply && (reply.error.code === "unknown-secret" || reply.error.code === "forbidden")) return {
+			state: "pending",
+			credential: pending,
+			command,
+			reason: reply.error.message
+		};
+		return {
+			state: "unreachable",
+			credential: pending,
+			reason: "failed" in reply ? reply.failed : "error" in reply ? reply.error.message : "it did not grant this access"
+		};
+	};
+	if (!credential) return input.fix ? ask() : { state: "not-asked" };
+	if (credential.state === "approved") {
+		const reply = await io.hello(input.endpoint, {
+			access,
+			serverKey: credential.serverKey
+		});
+		if ("result" in reply && reply.result.capabilities.includes(access)) return approved(input, reply, credential.requestedAt);
+		if ("error" in reply && reply.error.code === "server-key-mismatch") return {
+			state: "key-changed",
+			credential
+		};
+		if ("error" in reply && reply.error.code === "server-outdated") return {
+			state: "outdated",
+			credential,
+			command: null
+		};
+		if ("error" in reply && (reply.error.code === "unauthorized" || reply.error.code === "forbidden")) return input.fix ? ask() : {
+			state: "revoked",
+			credential,
+			reason: reply.error.message
+		};
+		if ("result" in reply) return input.fix ? ask() : {
+			state: "revoked",
+			credential,
+			reason: "it no longer grants this access"
+		};
+		return {
+			state: "unreachable",
+			credential,
+			reason: "failed" in reply ? reply.failed : reply.error.message
+		};
+	}
+	if (input.fix && given && given !== credential.ticket) return ask();
+	if (credential.expiresAt && Date.parse(credential.expiresAt) <= now) return input.fix ? ask() : {
+		state: "lapsed",
+		credential
+	};
+	return firstContact(credential);
+}
+//#endregion
+//#region src/devices/device-slots.ts
+const DEFAULT_DEVICE_SLOT = "default";
+const DEVICE_SLOT_RULE = "A device slot must be 1-64 letters, digits, underscores or hyphens, starting with a letter or digit.";
+function isDeviceSlot(slot) {
+	return /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(slot) && ![
+		"constructor",
+		"prototype",
+		"__proto__"
+	].includes(slot);
+}
+function validateDeviceSlot(slot = "default") {
+	if (!isDeviceSlot(slot)) {
+		const error = /* @__PURE__ */ new Error(DEVICE_SLOT_RULE);
+		Object.assign(error, { code: "STIM_BAD_ARG" });
+		throw error;
+	}
+	return slot;
+}
+function parseDeviceSlotOption(slot) {
+	if (!isDeviceSlot(slot)) throw new InvalidArgumentError(DEVICE_SLOT_RULE);
+	if (slot === "web") throw new InvalidArgumentError(`web names this workspace's owned Chrome (stim stop --slot web); choose another device slot name.`);
+	return slot;
+}
+function deviceSlotPlatforms(project, slot = DEFAULT_DEVICE_SLOT) {
+	validateDeviceSlot(slot);
+	if (slot === DEFAULT_DEVICE_SLOT) return project?.platforms;
+	return project?.deviceSlots && Object.hasOwn(project.deviceSlots, slot) ? project.deviceSlots[slot] : void 0;
+}
+function projectDeviceSlots(project) {
+	const slots = [{
+		slot: DEFAULT_DEVICE_SLOT,
+		platforms: project?.platforms ?? {}
+	}];
+	for (const [slot, platforms] of Object.entries(project?.deviceSlots ?? {})) {
+		validateDeviceSlot(slot);
+		if (slot === DEFAULT_DEVICE_SLOT) throw new Error("The default device slot must use the existing platforms record.");
+		if (!platforms || typeof platforms !== "object" || Array.isArray(platforms)) throw new Error(`Invalid device slot record: ${slot}`);
+		slots.push({
+			slot,
+			platforms
+		});
+	}
+	return slots;
+}
+function assignSlotDevice(project, platform, device, slot = DEFAULT_DEVICE_SLOT) {
+	validateDeviceSlot(slot);
+	if (platform !== "ios" && platform !== "android") throw new Error(`Unknown device platform: ${platform}`);
+	if (slot === DEFAULT_DEVICE_SLOT) project.platforms = {
+		...project.platforms,
+		[platform]: device
+	};
+	else project.deviceSlots = {
+		...project.deviceSlots,
+		[slot]: {
+			...deviceSlotPlatforms(project, slot),
+			[platform]: device
+		}
+	};
+}
+function removeSlotDevice(project, platform, slot = DEFAULT_DEVICE_SLOT) {
+	const platforms = deviceSlotPlatforms(project, slot);
+	if (!platforms) return;
+	delete platforms[platform];
+	if (slot !== DEFAULT_DEVICE_SLOT && Object.keys(platforms).length === 0) {
+		delete project.deviceSlots[slot];
+		if (Object.keys(project.deviceSlots).length === 0) delete project.deviceSlots;
+	}
+}
+function deviceSlotKey(platform, slot = "default") {
+	validateDeviceSlot(slot);
+	if (platform !== "ios" && platform !== "android") throw new Error(`Unknown device platform: ${platform}`);
+	return slot === "default" ? platform : `${platform}:${slot}`;
+}
+/**
+* The slot key in a form that is legal as a file name. NTFS reads a colon in a file name as an
+* alternate data stream: the write and the read of the exact path both succeed while `readdirSync`
+* cannot see the file, so every non-default slot's logs would be invisible to `stim logs`. A slot
+* name can contain neither a colon nor a dot, so the two forms stay one-to-one.
+*/
+function deviceSlotFileKey(platform, slot = "default") {
+	return deviceSlotKey(platform, slot).replace(":", ".");
+}
+function parseDeviceSlotKey(key) {
+	const [platform, slot = "default", extra] = key.split(":");
+	if (platform !== "ios" && platform !== "android" || extra !== void 0) return null;
+	try {
+		validateDeviceSlot(slot);
+	} catch {
+		return null;
+	}
+	if (key !== deviceSlotKey(platform, slot)) return null;
+	return {
+		platform,
+		slot
+	};
+}
+//#endregion
+//#region src/fs-util.ts
+const WINDOWS = process.platform === "win32";
+const DRIVE_LETTERS = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+function volumeRootFor(path) {
+	const normalized = normalize(String(path));
+	if (WINDOWS) return parse(normalized).root.replace(/^[a-z]:/, (drive) => drive.toUpperCase());
+	const m = normalized.match(/^\/volumes\/([^/]+)/i);
+	return m ? `/Volumes/${m[1]}` : "/";
+}
+function resolveWorkspaceRealish(workspacePath) {
+	const raw = String(workspacePath);
+	if (!isAbsolute$1(raw)) return null;
+	let current = raw;
+	const MAX_HOPS = 40;
+	for (let hops = 0; hops < MAX_HOPS; hops++) {
+		const normalized = normalize(current);
+		const root = parse(normalized).root;
+		const segments = normalized.slice(root.length).split(sep$1).filter(Boolean);
+		let prefix = root.endsWith(sep$1) ? root.slice(0, -sep$1.length) : root;
+		let followedSymlink = false;
+		for (const segment of segments) {
+			prefix += `${sep$1}${segment}`;
+			let st;
+			try {
+				st = lstatSync(prefix);
+			} catch (err) {
+				if (err && err.code === "ENOENT") return normalized;
+				return null;
+			}
+			if (st.isSymbolicLink()) {
+				let target;
+				try {
+					target = readlinkSync(prefix);
+				} catch {
+					return null;
+				}
+				current = `${isAbsolute$1(target) ? target : normalize(join$1(dirname$1(prefix), target))}${normalized.slice(prefix.length)}`;
+				followedSymlink = true;
+				break;
+			}
+		}
+		if (!followedSymlink) return normalized;
+	}
+	return null;
+}
+function isRealMount(entryDev, rootDev) {
+	return entryDev != null && rootDev != null && entryDev !== rootDev;
+}
+function listWindowsVolumeRoots(statFn) {
+	const roots = [];
+	for (const letter of DRIVE_LETTERS) {
+		const root = `${letter}:${sep$1}`;
+		try {
+			statFn(root);
+		} catch {
+			continue;
+		}
+		roots.push(root);
+	}
+	return roots;
+}
+function listMountedVolumes({ statFn = statSync } = {}) {
+	if (WINDOWS) return listWindowsVolumeRoots(statFn);
+	const roots = ["/"];
+	let rootDev;
+	try {
+		rootDev = statFn("/").dev;
+	} catch {
+		return roots;
+	}
+	try {
+		for (const name of readdirSync("/Volumes")) {
+			const path = join$1("/Volumes", name);
+			let entryDev;
+			try {
+				entryDev = statFn(path).dev;
+			} catch {
+				continue;
+			}
+			if (isRealMount(entryDev, rootDev)) roots.push(path);
+		}
+	} catch {}
+	return roots;
+}
+function resolveVolumeRoot(path) {
+	const realish = resolveWorkspaceRealish(path);
+	return realish === null ? null : volumeRootFor(realish);
+}
+function uncShareIsReachable(volume, statFn) {
+	if (!WINDOWS || !volume.startsWith(`${sep$1}${sep$1}`)) return false;
+	try {
+		return statFn(volume).isDirectory();
+	} catch {
+		return false;
+	}
+}
+function isOnMountedVolume(path, mountedVolumes, { statFn = statSync } = {}) {
+	const mounted = new Set(mountedVolumes || listMountedVolumes());
+	const volume = resolveVolumeRoot(path);
+	if (volume === null) return false;
+	return mounted.has(volume) || uncShareIsReachable(volume, statFn);
+}
+function directorySize(dir, { timeoutMs }) {
+	return measuredDirectorySize(dir, { timeoutMs }) ?? 0;
+}
+async function directorySizeAsync(dir, { timeoutMs }) {
+	return await measuredDirectorySizeAsync(dir, { timeoutMs }) ?? 0;
+}
+async function measuredDirectorySizeAsync(dir, { timeoutMs }) {
+	let out;
+	try {
+		out = await getExecutor().runFileAsync("du", ["-sk", dir], {
+			timeoutMs,
+			killSignal: "SIGKILL"
+		});
+	} catch {
+		return null;
+	}
+	if (!out) return 0;
+	const kb = parseInt(out.split(/\s+/)[0] ?? "", 10);
+	return isNaN(kb) ? 0 : kb * 1024;
+}
+function measuredDirectorySize(dir, { timeoutMs }) {
+	let out;
+	try {
+		out = getExecutor().runFile("du", ["-sk", dir], { timeoutMs });
+	} catch {
+		return null;
+	}
+	if (!out) return 0;
+	const kb = parseInt(out.split(/\s+/)[0] ?? "", 10);
+	return isNaN(kb) ? 0 : kb * 1024;
+}
+function formatBytes(bytes) {
+	if (bytes >= 1024 ** 3) return `${(bytes / 1024 ** 3).toFixed(1)}G`;
+	if (bytes >= 1024 ** 2) return `${Math.round(bytes / 1024 ** 2)}M`;
+	return `${Math.round(bytes / 1024)}K`;
+}
+//#endregion
+//#region src/devices/avd-claim.ts
+function acquireAvdClaim(avdName) {
+	const root = join(configDir(), "avd-locks", `${encodeURIComponent(avdName.toLowerCase())}.lock`);
+	const label = `AVD ${avdName}`;
+	const attempt = (0, ownership_claim_exports.tryAcquireClaim)({
+		root,
+		mode: "exclusive",
+		label
+	});
+	if (attempt.pending) (0, ownership_claim_exports.releaseClaim)(attempt.pending);
+	if (attempt.acquired) return attempt.acquired;
+	throw new ownership_claim_exports.ClaimRefusedError({
+		root,
+		claimPath: attempt.held?.path ?? attempt.waitingFor?.[0]?.path ?? root,
+		label,
+		reason: "another operation is creating, recovering, or tearing down this AVD"
+	});
+}
+//#endregion
+//#region src/workspace/config.ts
+function getConfigDir() {
+	return configDir();
+}
+function refuseRelativeStimPaths(env = process.env) {
+	for (const name of [
+		"STIM_HOME",
+		"STIM_BUILD_CACHE",
+		"STIM_METRO_CACHE"
+	]) {
+		const value = env[name];
+		if (!value || isAbsolute$1(value)) continue;
+		const error = /* @__PURE__ */ new Error(`${name}=${value} is not an absolute path. Set it to an absolute path, or unset it to use the default.`);
+		error.code = "STIM_RELATIVE_PATH";
+		throw error;
+	}
+}
+function saveConfig(config) {
+	ensurePrivateDir(getConfigDir());
+	const target = getConfigPath();
+	const tmp = `${target}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+	writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
+	try {
+		renameSync(tmp, target);
+	} catch (err) {
+		try {
+			unlinkSync(tmp);
+		} catch {}
+		throw err;
+	}
+}
+const CONFIG_VERSION = 2;
+function ensureConfig() {
+	return withConfigLock(() => {
+		const existing = loadConfig();
+		if (existing) {
+			if (existing.version !== CONFIG_VERSION) {
+				existing.version = CONFIG_VERSION;
+				saveConfig(existing);
+			}
+			return existing;
+		}
+		const fresh = {
+			version: CONFIG_VERSION,
+			projects: {},
+			repos: {}
+		};
+		saveConfig(fresh);
+		return fresh;
+	});
+}
+function requireAbsoluteProjectPath(projectPath) {
+	if (isAbsolute$1(projectPath)) return;
+	throw new Error(`Project key "${projectPath}" is not an absolute path. The registry is keyed by the realpath of a workspace root, so a relative key can never resolve.`);
+}
+function upsertProject(projectPath, fields) {
+	requireAbsoluteProjectPath(projectPath);
+	return withConfigLock(() => {
+		const cfg = ensureConfig();
+		const existing = cfg.projects[projectPath] || {
+			metroPort: null,
+			platforms: {}
+		};
+		cfg.projects[projectPath] = {
+			...existing,
+			...typeof fields === "function" ? fields(existing) : fields
+		};
+		saveConfig(cfg);
+		return cfg.projects[projectPath];
+	});
+}
+function removeProject(projectPath) {
+	withConfigLock(() => {
+		const cfg = loadConfig();
+		if (!cfg?.projects?.[projectPath]) return;
+		if (Object.keys(cfg.projects[projectPath].ports ?? {}).length) throw new Error(`Named ports remain for ${projectPath}; stop or release them before removing its registry entry.`);
+		for (const { platforms } of projectDeviceSlots(cfg.projects[projectPath])) if (platforms.android?.owned && platforms.android.avdName) (0, ownership_claim_exports.releaseClaim)(acquireAvdClaim(platforms.android.avdName));
+		delete cfg.projects[projectPath];
+		saveConfig(cfg);
+	});
+}
+function claimMetroPort(projectPath, port) {
+	return withConfigLock(() => {
+		const cfg = ensureConfig();
+		if (!cfg.projects[projectPath]) throw new Error(`Project not registered: ${projectPath}`);
+		for (const [path, proj] of Object.entries(cfg.projects)) {
+			if (path !== projectPath && proj?.metroPort === port) return null;
+			if (Object.values(proj?.ports ?? {}).includes(port)) return null;
+		}
+		cfg.projects[projectPath].metroPort = port;
+		saveConfig(cfg);
+		return port;
+	});
+}
+function releaseMetroPort(projectPath, port) {
+	withConfigLock(() => {
+		const cfg = loadConfig();
+		const project = cfg?.projects?.[projectPath];
+		if (!cfg || project?.metroPort !== port) return;
+		project.metroPort = null;
+		saveConfig(cfg);
+	});
+}
+function setDevice(projectPath, platform, deviceFields, slot = "default") {
+	requireAbsoluteProjectPath(projectPath);
+	withConfigLock(() => {
+		const cfg = ensureConfig();
+		if (!cfg.projects[projectPath]) throw new Error(`Project not registered: ${projectPath}`);
+		assignSlotDevice(cfg.projects[projectPath], platform, deviceFields, slot);
+		saveConfig(cfg);
+	});
+}
+function releaseAndroidConsolePort(projectPath, consolePort, slot = "default") {
+	return withConfigLock(() => {
+		const cfg = loadConfig();
+		const android = deviceSlotPlatforms(cfg?.projects?.[projectPath], slot)?.android;
+		if (!cfg || !android || android.consolePort !== consolePort) return false;
+		delete android.consolePort;
+		saveConfig(cfg);
+		return true;
+	});
+}
+function recordIosSchemeApprovals(projectPath, deviceUdid, schemeApprovals, slot = "default") {
+	withConfigLock(() => {
+		const cfg = loadConfig();
+		const ios = deviceSlotPlatforms(cfg?.projects?.[projectPath], slot)?.ios;
+		if (!cfg || !ios?.owned || ios.deviceUdid !== deviceUdid) return;
+		ios.schemeApprovals = schemeApprovals;
+		saveConfig(cfg);
+	});
+}
+function clearAndroidBootPending(projectPath, avdName, slot = "default") {
+	withConfigLock(() => {
+		const cfg = loadConfig();
+		const android = deviceSlotPlatforms(cfg?.projects?.[projectPath], slot)?.android;
+		if (!cfg || android?.avdName !== avdName || !android.bootPending) return;
+		delete android.bootPending;
+		saveConfig(cfg);
+	});
+}
+function clearDevice(projectPath, platform, slot = "default", expectedId) {
+	return withConfigLock(() => {
+		const cfg = loadConfig();
+		const project = cfg?.projects?.[projectPath];
+		if (!cfg || !project) return false;
+		const current = deviceSlotPlatforms(project, slot)?.[platform];
+		if (expectedId !== void 0 && (platform === "ios" ? current?.deviceUdid : current?.avdName) !== expectedId) return false;
+		removeSlotDevice(project, platform, slot);
+		saveConfig(cfg);
+		return true;
+	});
+}
+function setSupervisor(projectPath, { pid, port, startedAt, processToken }) {
+	requireAbsoluteProjectPath(projectPath);
+	return withConfigLock(() => {
+		const cfg = ensureConfig();
+		if (!cfg.projects[projectPath]) cfg.projects[projectPath] = {
+			metroPort: null,
+			platforms: {}
+		};
+		cfg.projects[projectPath].supervisor = {
+			pid,
+			port,
+			startedAt,
+			processToken
+		};
+		saveConfig(cfg);
+		return cfg.projects[projectPath].supervisor;
+	});
+}
+function clearSupervisor(projectPath, expected) {
+	return withConfigLock(() => {
+		const cfg = loadConfig();
+		const current = cfg?.projects?.[projectPath]?.supervisor;
+		if (!current) return true;
+		if (expected !== void 0 && !(0, process_identity_exports.sameProcessRecord)(current, expected)) return false;
+		delete cfg.projects[projectPath].supervisor;
+		saveConfig(cfg);
+		return true;
+	});
+}
+function targetSettings(cfg, target, create) {
+	if (target.scope === "machine") return cfg;
+	if (target.scope === "workspace") {
+		if (!cfg.projects[target.projectPath]) {
+			if (!create) return null;
+			cfg.projects[target.projectPath] = {
+				metroPort: null,
+				platforms: {}
+			};
+		}
+		const project = cfg.projects[target.projectPath];
+		if (!project.settings && create) project.settings = {};
+		return project.settings ?? null;
+	}
+	if (!cfg.repos[target.gitCommonDir]) {
+		if (!create) return null;
+		cfg.repos[target.gitCommonDir] = {};
+	}
+	const repo = cfg.repos[target.gitCommonDir];
+	if (!repo.settings && create) repo.settings = {};
+	return repo.settings ?? null;
+}
+function localDevicePoolOff(dottedKey, value) {
+	if (dottedKey === "remote.devicePoolDisabled") return Array.isArray(value) && value.includes("local");
+	if (dottedKey !== "remote.machines") return false;
+	const disabled = loadConfig()?.remote?.devicePoolDisabled;
+	return Array.isArray(disabled) && disabled.includes("local");
+}
+function writeConfigSetting(target, dottedKey, value) {
+	if (target.scope === "workspace") requireAbsoluteProjectPath(target.projectPath);
+	const status = target.scope === "machine" && localDevicePoolOff(dottedKey, value) ? realIo.status() : null;
+	return withConfigLock(() => applyConfigSetting(target, dottedKey, value, status));
+}
+/** Waits for the config lock and device-pool probe asynchronously; cancellation prevents a pending write. */
+async function writeConfigSettingAsync(target, dottedKey, value, signal) {
+	if (target.scope === "workspace") requireAbsoluteProjectPath(target.projectPath);
+	signal?.throwIfAborted();
+	const status = target.scope === "machine" && (dottedKey === "remote.machines" || localDevicePoolOff(dottedKey, value)) ? await tailscaleStatusAsync(signal) : null;
+	return withConfigLockAsync(() => applyConfigSetting(target, dottedKey, value, status), signal);
+}
+function applyConfigSetting(target, dottedKey, value, status) {
+	const cfg = value === void 0 ? loadConfig() : ensureConfig();
+	const settings = cfg ? targetSettings(cfg, target, value !== void 0) : null;
+	if (!cfg || !settings) return false;
+	if (value === void 0) {
+		if (!deleteNested(settings, dottedKey)) return false;
+	} else writeNested(settings, dottedKey, value);
+	if (target.scope === "machine") {
+		if (dottedKey === "remote.buildPoolDisabled" || dottedKey === "remote.machines") validateAutomaticPool("build", cfg);
+		if (dottedKey === "remote.devicePoolDisabled" || dottedKey === "remote.machines") validateAutomaticPool("device", cfg, (machine) => !cannotHost(status, machine));
+	}
+	saveConfig(cfg);
+	return true;
+}
+function writeNested(obj, dottedKey, value) {
+	const keys = dottedKey.split(".");
+	let cur = obj;
+	for (let i = 0; i < keys.length - 1; i++) {
+		const k = keys[i];
+		if (k === void 0) continue;
+		const next = cur[k];
+		if (typeof next !== "object" || next === null) cur[k] = {};
+		cur = cur[k];
+	}
+	const leaf = keys[keys.length - 1];
+	if (leaf !== void 0) cur[leaf] = value;
+}
+function deleteNested(obj, dottedKey) {
+	const keys = dottedKey.split(".");
+	const chain = [obj];
+	let cur = obj;
+	for (let i = 0; i < keys.length - 1; i++) {
+		const k = keys[i];
+		if (k === void 0) return false;
+		const next = cur[k];
+		if (next == null || typeof next !== "object") return false;
+		cur = next;
+		chain.push(cur);
+	}
+	const leaf = keys[keys.length - 1];
+	if (leaf === void 0) return false;
+	if (!(leaf in cur)) return false;
+	delete cur[leaf];
+	for (let i = chain.length - 2; i >= 0; i--) {
+		const parent = chain[i];
+		const key = keys[i];
+		const child = chain[i + 1];
+		if (parent === void 0 || key === void 0 || child === void 0) break;
+		if (Object.keys(child).length === 0) delete parent[key];
+		else break;
+	}
+	return true;
+}
+function allConsolePortsAndSerials({ isMounted = isOnMountedVolume } = {}) {
+	const cfg = loadConfig();
+	const result = {
+		androidConsolePorts: [],
+		androidPhysicalSerials: []
+	};
+	if (!cfg) return result;
+	for (const [path, proj] of Object.entries(cfg.projects || {})) {
+		if (!existsSync(path) && isMounted(path)) continue;
+		for (const { platforms } of projectDeviceSlots(proj)) {
+			const android = platforms.android;
+			if (typeof android?.consolePort === "number") result.androidConsolePorts.push(android.consolePort);
+			if (android?.serial && !android.avdName) result.androidPhysicalSerials.push(android.serial);
+		}
+	}
+	return result;
+}
+//#endregion
+export { openAuthenticated as $, writeConfigSettingAsync as A, assignSlotDevice as B, saveConfig as C, withConfigLock$1 as D, upsertProject as E, isOnMountedVolume as F, parseDeviceSlotOption as G, deviceSlotKey as H, listMountedVolumes as I, validateDeviceSlot as J, projectDeviceSlots as K, measuredDirectorySize as L, directorySize as M, directorySizeAsync as N, withConfigLockAsync$1 as O, formatBytes as P, findPeer$1 as Q, measuredDirectorySizeAsync as R, removeProject as S, setSupervisor as T, deviceSlotPlatforms as U, deviceSlotFileKey as V, parseDeviceSlotKey as W, doctorIo as X, SERVER_OUTDATED as Y, endpoint as Z, loadConfig$1 as _, clearDevice as a, sayHello as at, releaseAndroidConsolePort as b, ensureConfig as c, readHostPermissions as ct, getConfigDir as d, outdatedServer as et, getConfigPath$1 as f, isPathPrefix as g, getRepoSettings as h, clearAndroidBootPending as i, resolveEndpoint as it, acquireAvdClaim as j, writeConfigSetting as k, findEnclosingWorktreeRoot as l, getProjectSettings as m, allMetroPorts as n, reachMachine as nt, clearSupervisor as o, setupRemedy as ot, getProject as p, removeSlotDevice as q, claimMetroPort as r, realIo as rt, configCorruptRepair as s, tailscaleStatusAsync as st, allConsolePortsAndSerials as t, parseMachine$1 as tt, getConcurrencyLimits as u, recordIosSchemeApprovals as v, setDevice as w, releaseMetroPort as x, refuseRelativeStimPaths as y, volumeRootFor as z };