stim 1.20.2 → 1.21.0

package/dist/device-DCxH7_By.mjs

@@ -0,0 +1,1068 @@
+import { t as getExecutor, u as operationState } from "./exec-_UbtCQcG.mjs";
+import { G as parseDeviceSlotOption, H as deviceSlotKey, K as projectDeviceSlots, _ as loadConfig$1, p as getProject } from "./config-CYcBF478.mjs";
+import { t as createLineReader } from "./process-output-Fpl8PYi8.mjs";
+import { r as clockTime } from "./command-output-B1UrjZHL.mjs";
+import { K as resolveIosProjectDir, Xt as removeTemporaryEntry, Yt as makeTemporaryDirectory, q as resolveProjectSettings, tt as settingValueAt } from "./settings-CsJDEXgK.mjs";
+import { f as projectRegistry, g as selectNativeXcodeProject, i as findProjectRoot$1, p as NativeXcodeError, t as NO_PROJECT_REFUSAL } from "./project-BZNjmW_8.mjs";
+import { In as runProcessOperation } from "./budget-Bs6SxxzO.mjs";
+import { C as parseLeaseDuration, D as releaseWorkspaceLeases, j as takeLease, y as fileLeaseIo } from "./activity-BzVfHSrY.mjs";
+import { $ as resolvePhysicalDevice, D as getAvdNameForSerialAsync, I as memoizeEmulatorProbe, Y as probeEmulatorSerial, c as androidPoolNoCandidatesRefusal, k as listAdbDevices, q as physicalDeviceModel, s as androidPoolCandidates } from "./android-DUYkNF4u.mjs";
+import { m as resolveScheme, v as xcodebuildArgs } from "./xcode-Zlx3qjEs.mjs";
+import { a as discoverXcodeProject } from "./react-native-build-rhk4smwQ.mjs";
+import { l as parseDeviceWait, p as waitForDevice } from "./device-lease-run-C8raGFoP.mjs";
+import { m as resolveConfiguration, y as resolveSchemeSelection } from "./support-Dlu37g6H.mjs";
+import { n as findSigningIdentities, o as parsePlist, s as parseProvisioningProfilePlist, t as decodeProvisioningProfile } from "./ios-signing-DTTIChGs.mjs";
+import { t as selectFromPool } from "./device-pool-DMRpVX9a.mjs";
+import { a as iosPoolCandidates, c as isWirelessIosDevice, f as resolveIosPhysicalDevice, l as listIosDevices, o as iosPoolNoCandidatesRefusal } from "./ios-device-CwFMehUS.mjs";
+import { i as nativeXcodePackages, t as nativeXcodeHasPackages } from "./native-xcode-inputs-CB2iQeWq.mjs";
+import { existsSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { settingDefinition, settingValueError } from "@stim-cli/core/state";
+import chalk from "chalk";
+import { createInterface } from "node:readline/promises";
+//#region src/engine/ios-provision.ts
+const KEY_SETTINGS_REMEDY = "Set all three with `stim settings set <key> <value> --scope machine` (ios.appStoreConnectKeyPath, ios.appStoreConnectKeyId, ios.appStoreConnectIssuerId), or export STIM_ASC_KEY_PATH, STIM_ASC_KEY_ID and STIM_ASC_ISSUER_ID; unset all three to use the Xcode account instead.";
+function keySetting(key, machine, env) {
+	const definition = settingDefinition(key);
+	const envName = definition?.env;
+	const fromEnv = envName ? env[envName] : void 0;
+	const value = fromEnv || settingValueAt(machine, key);
+	if (value === void 0 || value === "") return { missing: key };
+	const problem = definition ? settingValueError(definition, value) : null;
+	if (problem !== null || typeof value !== "string") return {
+		code: "STIM_BAD_ARG",
+		message: `${fromEnv ? envName : key} is not valid: expected ${problem ?? "a string"}. Stim does not print its value.`,
+		remedy: KEY_SETTINGS_REMEDY
+	};
+	return {
+		value,
+		source: fromEnv && envName ? envName : key
+	};
+}
+/** Each value comes from its environment variable when that is set and non-empty, otherwise from the machine config. */
+function provisionAuth(machine, env, fileExists = existsSync) {
+	const keyPath = keySetting("ios.appStoreConnectKeyPath", machine, env);
+	const keyId = keySetting("ios.appStoreConnectKeyId", machine, env);
+	const issuerId = keySetting("ios.appStoreConnectIssuerId", machine, env);
+	const read = [
+		keyPath,
+		keyId,
+		issuerId
+	];
+	for (const each of read) if ("code" in each) return each;
+	const missing = read.flatMap((each) => "missing" in each ? [each.missing] : []);
+	if (missing.length === read.length) return { kind: "xcode-account" };
+	if (!("value" in keyPath && "value" in keyId && "value" in issuerId)) return {
+		code: "STIM_BAD_ARG",
+		message: `An App Store Connect API key needs a key path, key ID and issuer ID; ${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} not set.`,
+		remedy: KEY_SETTINGS_REMEDY
+	};
+	if (!fileExists(keyPath.value)) return {
+		code: "STIM_BAD_ARG",
+		message: `The App Store Connect API key file that ${keyPath.source} names does not exist.`,
+		remedy: `Point ${keyPath.source} at the AuthKey_<KEY_ID>.p8 file App Store Connect gave you. ${KEY_SETTINGS_REMEDY}`
+	};
+	return {
+		kind: "api-key",
+		keyPath: keyPath.value,
+		keyId: keyId.value,
+		issuerId: issuerId.value
+	};
+}
+/** Replaces the key path, which can name a private key's location, wherever xcodebuild echoes it. */
+function redactKeyPath(text, auth) {
+	if (auth.kind !== "api-key") return text;
+	const paths = /* @__PURE__ */ new Set([auth.keyPath]);
+	try {
+		paths.add(realpathSync(auth.keyPath));
+	} catch {}
+	return [...paths].flatMap((path) => [
+		`'${path}'`,
+		path.replace(/([^A-Za-z0-9_\-./])/g, "\\$1"),
+		path
+	]).toSorted((a, b) => b.length - a.length).reduce((redacted, form) => redacted.replaceAll(form, "<ios.appStoreConnectKeyPath>"), text);
+}
+const PLATFORM_NAMES = {
+	iphoneos: "iOS",
+	watchos: "watchOS",
+	appletvos: "tvOS",
+	xros: "visionOS",
+	macosx: "macOS"
+};
+function platformName(platform) {
+	return PLATFORM_NAMES[platform] ?? platform;
+}
+function describeAuth(auth) {
+	return auth.kind === "api-key" ? `the App Store Connect API key ${auth.keyId}` : "the Apple account signed in to Xcode > Settings > Accounts";
+}
+function provisionXcodebuildArgs({ project, scheme, configuration, udid, derivedDataPath, auth, packageArgs = [] }) {
+	return xcodebuildArgs({
+		project,
+		scheme,
+		configuration,
+		sdk: "iphoneos",
+		udid,
+		derivedDataPath,
+		extraArgs: [
+			...packageArgs,
+			"-allowProvisioningUpdates",
+			"-allowProvisioningDeviceRegistration",
+			...auth.kind === "api-key" ? [
+				"-authenticationKeyPath",
+				auth.keyPath,
+				"-authenticationKeyID",
+				auth.keyId,
+				"-authenticationKeyIssuerID",
+				auth.issuerId
+			] : []
+		]
+	});
+}
+/** Every target of the scheme that xcodebuild signs with a provisioning profile, on any platform; null when the output is not JSON. */
+function parseSigningTargets(output) {
+	let items;
+	try {
+		items = JSON.parse(String(output));
+	} catch {
+		return null;
+	}
+	const targets = [];
+	for (const item of Array.isArray(items) ? items : []) {
+		const raw = item && typeof item === "object" && "buildSettings" in item ? item.buildSettings : null;
+		if (!raw || typeof raw !== "object") continue;
+		const settings = { ...raw };
+		if (settings.CODE_SIGNING_ALLOWED !== "YES" || settings.PROVISIONING_PROFILE_REQUIRED !== "YES" || typeof settings.PRODUCT_BUNDLE_IDENTIFIER !== "string" || settings.PRODUCT_BUNDLE_IDENTIFIER === "") continue;
+		const team = typeof settings.DEVELOPMENT_TEAM === "string" ? settings.DEVELOPMENT_TEAM.trim() : "";
+		targets.push({
+			target: typeof settings.TARGET_NAME === "string" ? settings.TARGET_NAME : settings.PRODUCT_BUNDLE_IDENTIFIER,
+			bundleId: settings.PRODUCT_BUNDLE_IDENTIFIER,
+			platform: typeof settings.PLATFORM_NAME === "string" ? settings.PLATFORM_NAME : "unknown",
+			team: team || null,
+			automatic: settings.CODE_SIGN_STYLE !== "Manual"
+		});
+	}
+	return targets;
+}
+function signingTargetsRefusal(targets, { scheme, configuration }) {
+	if (targets.length === 0) return {
+		code: "STIM_PROVISION_FAILED",
+		message: `Scheme ${scheme} builds no target that needs a provisioning profile in its ${configuration} configuration, so there is nothing to provision.`,
+		remedy: "Pass the app scheme with --scheme, or set ios.scheme, and check the configuration with --configuration."
+	};
+	const teamless = targets.filter((target) => target.team === null);
+	if (teamless.length > 0) return {
+		code: "STIM_PROVISION_FAILED",
+		message: `No development team is set for ${teamless.map((t) => `${t.target} (${t.bundleId})`).join(", ")} in the ${configuration} configuration. Stim provisions for the team the build signs with, and a later \`stim ios --device\` build uses the project's team too.`,
+		remedy: "Choose a team in Xcode > Signing & Capabilities, or for an Expo app set expo.ios.appleTeamId in the app config and run `npx expo prebuild -p ios` again, then retry."
+	};
+	const manual = targets.filter((target) => !target.automatic);
+	if (manual.length > 0) return {
+		code: "STIM_PROVISION_FAILED",
+		message: `${manual.map((t) => `${t.target} (${t.bundleId})`).join(", ")} use${manual.length === 1 ? "s" : ""} manual signing in the ${configuration} configuration, and xcodebuild creates or refreshes profiles only for automatic signing.`,
+		remedy: "Turn on Automatically manage signing in Xcode > Signing & Capabilities, or create the Development profile in the Apple Developer portal and install it."
+	};
+	return null;
+}
+function provisionPlanLines({ device, targets, auth, scheme, configuration }) {
+	return [
+		`This changes the Apple Developer account of team ${[...new Set(targets.map((target) => target.team))].join(", ")}, through ${describeAuth(auth)}:`,
+		`  - registers ${device.name} (${device.udid}) as a development device, when the team does not list it yet;`,
+		...targets.map((target) => `  - creates or refreshes the ${platformName(target.platform)} App Development profile for ${target.bundleId} (target ${target.target}, scheme ${scheme}, ${configuration})${target.platform === "iphoneos" ? " so it lists that device" : ""};`),
+		"  - creates an Apple Development certificate for this Mac when the keychain holds none for the team.",
+		`Those are all the targets scheme ${scheme} signs with a profile. It runs xcodebuild with -allowProvisioningUpdates -allowProvisioningDeviceRegistration for that scheme only and stops it once signing resolves; it installs nothing.`
+	];
+}
+const TASK_LINE = /^[A-Z][A-Za-z]+ /;
+const DIAGNOSTIC = /\b(?:error|warning|note):/i;
+/**
+* xcodebuild resolves signing while planning and runs build tasks only when planning succeeded: it prints
+* `Build description path:`, then either the planning errors and `** BUILD FAILED **`, or the first task such as
+* `CreateBuildDirectory`. An `error:` line therefore decides nothing on its own; the first task does.
+*/
+function createPlanningWatch() {
+	let state = "planning";
+	return (line) => {
+		if (state === "ended") return false;
+		if (line.startsWith("** ")) {
+			state = "ended";
+			return false;
+		}
+		if (line.startsWith("Build description path: ")) {
+			state = "planned";
+			return false;
+		}
+		return state === "planned" && TASK_LINE.test(line) && !DIAGNOSTIC.test(line);
+	};
+}
+function errorText(line) {
+	const at = line.indexOf("error: ");
+	return (at < 0 ? line : line.slice(at + 7)).replace(/ \(in target '.*' from project '.*'\)$/, "").trim();
+}
+function provisionFailure(lines, auth, teams) {
+	const errors = lines.filter((line) => /\berror: /.test(line)).map(errorText);
+	const unique = [...new Set(errors)];
+	const has = (pattern) => unique.find((text) => pattern.test(text));
+	if (has(/^No Accounts\b/)) return {
+		code: "STIM_PROVISION_FAILED",
+		message: auth.kind === "api-key" ? `xcodebuild reported No Accounts although it was given ${describeAuth(auth)}.` : "xcodebuild has no Apple account to provision with: Xcode has no account signed in, and no App Store Connect API key is set.",
+		remedy: `Sign in under Xcode > Settings > Accounts with an Apple ID on team ${teams}, or ${KEY_SETTINGS_REMEDY.charAt(0).toLowerCase()}${KEY_SETTINGS_REMEDY.slice(1)} Then run \`stim device provision ios\` again.`
+	};
+	const noTeam = has(/^No Account for Team\b/);
+	const quoted = (text) => redactKeyPath(text, auth);
+	if (noTeam) return {
+		code: "STIM_PROVISION_FAILED",
+		message: `Xcode cannot reach team ${teams} through ${describeAuth(auth)}: ${quoted(noTeam)}`,
+		remedy: `Sign in to Xcode with an Apple ID that belongs to team ${teams}, or use an App Store Connect API key issued by that team. If the project names the wrong team, fix it in Xcode > Signing & Capabilities.`
+	};
+	const rejected = has(/Communication with Apple failed.*\b401\b/);
+	if (rejected) return {
+		code: "STIM_PROVISION_FAILED",
+		message: `Apple rejected ${describeAuth(auth)}: ${quoted(rejected)}`,
+		remedy: auth.kind === "api-key" ? "Check that the key ID and issuer ID match the .p8 file and that the key is still active under App Store Connect > Users and Access > Integrations." : "Sign in again under Xcode > Settings > Accounts."
+	};
+	if (has(/Unable to find a destination matching/)) return {
+		code: "STIM_PROVISION_FAILED",
+		message: "xcodebuild could not use the phone as a destination.",
+		remedy: "Unlock the phone, check that it is paired and has Developer Mode on, and that `xcrun devicectl list devices` lists it, then retry."
+	};
+	return {
+		code: "STIM_PROVISION_FAILED",
+		message: unique.length ? `xcodebuild could not provision signing: ${redactKeyPath(unique.slice(0, 5).join(" | "), auth)}` : "xcodebuild exited before signing resolved and printed no error.",
+		remedy: "Fix what xcodebuild reports, or open the workspace in Xcode, select the phone and build once, which provisions the same way after asking for an account."
+	};
+}
+function profileDirectories(home = homedir()) {
+	return [join(home, "Library", "Developer", "Xcode", "UserData", "Provisioning Profiles"), join(home, "Library", "MobileDevice", "Provisioning Profiles")];
+}
+function listProfileFiles(dirs) {
+	const files = /* @__PURE__ */ new Map();
+	for (const dir of dirs) {
+		let names;
+		try {
+			names = readdirSync(dir);
+		} catch {
+			continue;
+		}
+		for (const name of names) {
+			if (!name.endsWith(".mobileprovision")) continue;
+			try {
+				files.set(join(dir, name), statSync(join(dir, name)).mtimeMs);
+			} catch {}
+		}
+	}
+	return files;
+}
+function applicationIdentifierOf(xml) {
+	const root = parsePlist(xml);
+	const entitlements = root && typeof root === "object" && "Entitlements" in root ? root.Entitlements : null;
+	const value = entitlements && typeof entitlements === "object" && "application-identifier" in entitlements ? entitlements["application-identifier"] : null;
+	return typeof value === "string" ? value : null;
+}
+async function readInstalledProfiles(files, { exec = null } = {}) {
+	const out = [];
+	for (const [file, mtimeMs] of files) {
+		const xml = await decodeProvisioningProfile(file, { exec });
+		out.push({
+			file,
+			mtimeMs,
+			profile: xml === null ? null : parseProvisioningProfilePlist(xml),
+			applicationIdentifier: xml === null ? null : applicationIdentifierOf(xml)
+		});
+	}
+	return out;
+}
+function coversBundle(applicationIdentifier, team, bundleId) {
+	if (applicationIdentifier === `${team}.${bundleId}`) return "exact";
+	if (applicationIdentifier?.endsWith("*")) {
+		const prefix = applicationIdentifier.slice(0, -1);
+		if (`${team}.${bundleId}`.startsWith(prefix)) return "wildcard";
+	}
+	return null;
+}
+function provisionChanges({ before, after, targets, udid, identitiesBefore, identitiesAfter, now }) {
+	const profiles = targets.map((target) => {
+		const team = target.team;
+		const onPhone = target.platform === "iphoneos";
+		const best = after.flatMap((entry) => {
+			const profile = entry.profile;
+			const expires = profile?.expirationDate;
+			const devices = profile?.provisionedDevices;
+			if (!profile || !team || profile.teamIdentifier !== team || !profile.getTaskAllow) return [];
+			if (!expires || expires.getTime() <= now) return [];
+			if (!devices) return [];
+			if (onPhone && !devices.some((device) => device.toLowerCase() === udid.toLowerCase())) return [];
+			const fit = coversBundle(entry.applicationIdentifier, team, target.bundleId);
+			return fit ? [{
+				entry,
+				profile,
+				fit,
+				expires,
+				devices
+			}] : [];
+		}).toSorted((a, b) => Number(b.fit === "exact") - Number(a.fit === "exact") || b.expires.getTime() - a.expires.getTime())[0];
+		if (!best) return {
+			bundleId: target.bundleId,
+			onPhone,
+			profile: null,
+			installed: false
+		};
+		return {
+			bundleId: target.bundleId,
+			onPhone,
+			profile: {
+				name: best.profile.name,
+				uuid: best.profile.uuid,
+				expires: best.expires.toISOString(),
+				devices: best.devices.length
+			},
+			installed: before.get(best.entry.file) !== best.entry.mtimeMs
+		};
+	});
+	const known = new Set(identitiesBefore.map((identity) => identity.sha1));
+	return {
+		profiles,
+		identities: identitiesAfter.filter((identity) => !known.has(identity.sha1))
+	};
+}
+function provisionReportLines(changes, device, resolved = true) {
+	const lines = changes.profiles.flatMap((outcome) => {
+		if (outcome.profile) {
+			if (!resolved && !outcome.installed) return [];
+			const listing = outcome.onPhone ? `lists ${device.name} among ${outcome.profile.devices} device(s)` : `lists ${outcome.profile.devices} device(s)`;
+			return [`${outcome.bundleId}: ${outcome.installed ? "installed" : "already had"} profile "${outcome.profile.name ?? outcome.profile.uuid}" (${outcome.profile.uuid}), which ${listing} and expires ${outcome.profile.expires.slice(0, 10)}.`];
+		}
+		if (!resolved) return [];
+		return [outcome.onPhone ? `${outcome.bundleId}: xcodebuild resolved signing, but no installed Development profile listing ${device.udid} was found under ${profileDirectories().join(" or ")}.` : `${outcome.bundleId}: no installed Development profile for it was found under ${profileDirectories().join(" or ")}; its device is not the phone, so Stim does not check it further.`];
+	});
+	for (const identity of changes.identities) lines.push(`New signing identity in the keychain: ${identity.name}.`);
+	return lines;
+}
+const PROVISION_TIMEOUT_MS = 9e5;
+/** How long xcodebuild gets after SIGINT before SIGTERM, and after SIGTERM before SIGKILL. */
+const PROVISION_STOP_GRACE_MS = {
+	interrupt: 1e4,
+	terminate: 5e3
+};
+async function runProvisioningBuild({ args, cwd, env, signal, exec = null, timeoutMs = PROVISION_TIMEOUT_MS, graceMs = PROVISION_STOP_GRACE_MS, onChild = () => () => {} }) {
+	const executor = exec || getExecutor();
+	const lines = [];
+	const executing = createPlanningWatch();
+	let resolved = false;
+	let timedOut = false;
+	let cancelled = false;
+	let child;
+	try {
+		child = executor.spawn("xcodebuild", args, {
+			cwd,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			env: {
+				...env,
+				NSUnbufferedIO: "YES",
+				FORCE_COLOR: "0"
+			}
+		});
+	} catch (error) {
+		return {
+			resolved: false,
+			lines,
+			code: null,
+			timedOut,
+			cancelled,
+			error: error instanceof Error ? error : new Error(String(error))
+		};
+	}
+	const forget = onChild(child);
+	const escalations = [];
+	let stopping = false;
+	const stop = (first) => {
+		if (stopping) return;
+		stopping = true;
+		child.kill(first);
+		const terminateAt = first === "SIGINT" ? graceMs.interrupt : 0;
+		if (first === "SIGINT") escalations.push(setTimeout(() => child.kill("SIGTERM"), terminateAt));
+		escalations.push(setTimeout(() => child.kill("SIGKILL"), terminateAt + graceMs.terminate));
+	};
+	const onLine = (line) => {
+		lines.push(line);
+		if (!resolved && !stopping && executing(line)) {
+			resolved = true;
+			stop("SIGINT");
+		}
+	};
+	const out = createLineReader(onLine);
+	const err = createLineReader(onLine);
+	child.stdout?.setEncoding("utf-8");
+	child.stderr?.setEncoding("utf-8");
+	child.stdout?.on("data", (chunk) => out.push(chunk));
+	child.stderr?.on("data", (chunk) => err.push(chunk));
+	const timer = setTimeout(() => {
+		timedOut = true;
+		stop("SIGTERM");
+	}, timeoutMs);
+	const onAbort = () => {
+		cancelled = true;
+		stop(signal?.reason === "SIGTERM" ? "SIGTERM" : "SIGINT");
+	};
+	signal?.addEventListener("abort", onAbort, { once: true });
+	if (signal?.aborted) onAbort();
+	return new Promise((resolve) => {
+		let settled = false;
+		const finish = (code, error) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			for (const escalation of escalations) clearTimeout(escalation);
+			signal?.removeEventListener("abort", onAbort);
+			forget();
+			out.flush();
+			err.flush();
+			resolve({
+				resolved: resolved || code === 0 && !cancelled && !timedOut,
+				lines,
+				code,
+				timedOut,
+				cancelled,
+				...error ? { error } : {}
+			});
+		};
+		child.on("close", (code) => finish(code));
+		child.on("error", (error) => finish(null, error));
+	});
+}
+//#endregion
+//#region src/commands/device-provision.ts
+function located(project) {
+	const { flag, path, dir } = project;
+	return flag && path && dir ? {
+		...project,
+		flag,
+		path,
+		dir
+	} : null;
+}
+async function selectXcode(root, settings, { scheme, configuration }) {
+	const selected = projectRegistry.selectIos(root);
+	if ("problem" in selected) return {
+		code: "STIM_NO_PROJECT",
+		message: selected.problem.message,
+		remedy: selected.problem.remedy
+	};
+	if (selected.id === "native-xcode") try {
+		const native = selectNativeXcodeProject(root, scheme ?? void 0, configuration);
+		const packages = nativeXcodePackages(root);
+		if (nativeXcodeHasPackages(native) && !existsSync(join(packages, "workspace-state.json"))) return {
+			code: "STIM_PROVISION_FAILED",
+			message: existsSync(packages) ? `Scheme ${native.scheme} uses Swift packages, and Stim's package directory ${packages} holds no workspace-state.json, so its resolution is incomplete.` : `Scheme ${native.scheme} uses Swift packages, and this workspace has not resolved them yet.`,
+			remedy: "Run `stim ios` once (it resolves them into Stim's package directory for a simulator build), or `stim ios --device <udid>` (it resolves them and stops at signing), then run `stim device provision ios` again."
+		};
+		return {
+			project: native.container,
+			scheme: native.scheme,
+			configuration,
+			packageArgs: nativeXcodeHasPackages(native) ? [
+				"-clonedSourcePackagesDirPath",
+				packages,
+				"-disableAutomaticPackageResolution"
+			] : []
+		};
+	} catch (error) {
+		if (error instanceof NativeXcodeError) return {
+			code: error.code,
+			message: error.message,
+			remedy: error.remedy
+		};
+		throw error;
+	}
+	const discovered = discoverXcodeProject(root, resolveIosProjectDir(settings, root).dir);
+	const project = located(discovered);
+	if (discovered.error || !project) return {
+		code: "STIM_PROVISION_FAILED",
+		message: discovered.error?.message ?? `No Xcode project or workspace was found for ${root}.`,
+		remedy: discovered.error?.remedy ?? "Generate the ios/ project, then retry."
+	};
+	const resolved = await resolveScheme(project, { scheme });
+	if (resolved.error || !resolved.scheme) return resolved.error ?? {
+		code: "STIM_NO_SCHEME",
+		message: `Could not select an app scheme in ${project.path}.`,
+		remedy: "Pass --scheme <name>, or set ios.scheme."
+	};
+	return {
+		project,
+		scheme: resolved.scheme,
+		configuration,
+		packageArgs: []
+	};
+}
+function lastLines(text, count = 5) {
+	return text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).slice(-count).join(" | ");
+}
+function errorField(error, key) {
+	return error && typeof error === "object" && key in error ? String(Reflect.get(error, key) ?? "") : "";
+}
+async function readBuildSettings({ project, scheme, configuration, packageArgs }) {
+	try {
+		return { output: await getExecutor().runFileAsync("xcodebuild", [
+			project.flag,
+			project.path,
+			"-scheme",
+			scheme,
+			"-configuration",
+			configuration,
+			"-sdk",
+			"iphoneos",
+			"-destination",
+			"generic/platform=iOS",
+			...packageArgs,
+			"-showBuildSettings",
+			"-json"
+		], {
+			cwd: project.dir,
+			timeoutMs: 18e4
+		}) };
+	} catch (error) {
+		return { error: lastLines(errorField(error, "stderr") || errorField(error, "stdout") || errorField(error, "message") || String(error)) };
+	}
+}
+function openTerminal() {
+	return createInterface({
+		input: process.stdin,
+		output: process.stderr
+	});
+}
+/** Asks `question` on the terminal; only `y` or `yes` confirms, and Ctrl+C or end of input answer no. */
+async function confirmInTerminal(question, open = openTerminal) {
+	const input = open();
+	const controller = new AbortController();
+	const abort = () => controller.abort();
+	input.on("SIGINT", abort);
+	input.on("close", abort);
+	try {
+		return /^(y|yes)$/i.test((await input.question(question, { signal: controller.signal })).trim());
+	} catch (error) {
+		if (error instanceof Error && error.name === "AbortError") return false;
+		throw error;
+	} finally {
+		input.off("SIGINT", abort);
+		input.off("close", abort);
+		input.close();
+	}
+}
+const DEFAULT_DEPS$1 = {
+	findProjectRoot: findProjectRoot$1,
+	resolveSettings: (root) => resolveProjectSettings(root).settings,
+	machineConfig: loadConfig$1,
+	env: process.env,
+	fileExists: existsSync,
+	listIosDevices,
+	selectXcode,
+	readBuildSettings,
+	interactive: process.stdin.isTTY === true && process.stderr.isTTY === true,
+	confirm: (question) => confirmInTerminal(question),
+	profileFiles: listProfileFiles,
+	readInstalledProfiles,
+	findSigningIdentities,
+	runProvisioningBuild,
+	makeDerivedData: (root) => makeTemporaryDirectory(root, "stim-provision-"),
+	removeDerivedData: removeTemporaryEntry,
+	operation: void 0,
+	now: () => Date.now(),
+	out: (line) => console.log(line),
+	note: (line) => console.error(line)
+};
+const UNCONFIRMED_REMEDY = "Run it in a terminal and answer y, or pass --yes once the owner of the Apple Developer account has agreed to the changes listed. Agents never pass --yes without the user explicitly asking for this step.";
+async function runProvision(platformArg, udidArg, opts = {}, overrides = {}) {
+	const d = {
+		...DEFAULT_DEPS$1,
+		...overrides
+	};
+	const json = Boolean(opts.json);
+	const report = (failure) => {
+		d.note(chalk.red(`${failure.code}: ${failure.message}`));
+		d.note(chalk.dim(failure.remedy));
+		if (json) d.out(JSON.stringify({
+			code: failure.code,
+			message: failure.message,
+			remedy: failure.remedy,
+			...failure.plan ? { plan: failure.plan } : {},
+			...failure.changes ? { changes: failure.changes } : {}
+		}));
+		return failure;
+	};
+	if (platformArg !== "ios") return report({
+		code: "STIM_BAD_ARG",
+		message: `\`stim device provision\` takes ios, not ${JSON.stringify(platformArg)}.`,
+		remedy: "Run `stim device provision ios`. Android debug builds install on a phone without any developer account change."
+	});
+	const root = d.findProjectRoot(process.cwd());
+	if (!root) return report(NO_PROJECT_REFUSAL);
+	const settings = d.resolveSettings(root);
+	const auth = provisionAuth(d.machineConfig(), d.env, d.fileExists);
+	if ("code" in auth) return report(auth);
+	const resolved = resolveIosPhysicalDevice(udidArg ?? null, await d.listIosDevices(), {
+		several: "Name the one to provision with `stim device provision ios <udid>`.",
+		notAPhone: "Name a physical iPhone or iPad from `xcrun devicectl list devices` with `stim device provision ios <udid>`. Simulators need no provisioning.",
+		physicalOnly: "`stim device provision ios` provisions only a physical iPhone or iPad",
+		transportOnly: "Stim provisions a phone only over a cable or Wi-Fi"
+	});
+	if (!resolved.udid) return report({
+		code: "STIM_NO_DEVICE",
+		message: String(resolved.error),
+		remedy: resolved.remedy ?? ""
+	});
+	const device = {
+		udid: resolved.udid,
+		name: resolved.name ?? resolved.udid
+	};
+	const selection = await d.selectXcode(root, settings, {
+		scheme: resolveSchemeSelection({ scheme: opts.scheme ?? null }, settings) ?? null,
+		configuration: resolveConfiguration(opts.configuration, settings) ?? "Debug"
+	});
+	if ("code" in selection) return report(selection);
+	const { project, scheme, configuration } = selection;
+	const buildSettings = await d.readBuildSettings(selection);
+	const targets = "output" in buildSettings ? parseSigningTargets(buildSettings.output) : null;
+	if (!targets) return report({
+		code: "STIM_PROVISION_FAILED",
+		message: "error" in buildSettings ? `xcodebuild could not report the ${configuration} build settings of scheme ${scheme}: ${buildSettings.error}` : `xcodebuild reported the ${configuration} build settings of scheme ${scheme}, but not as JSON Stim can read.`,
+		remedy: `Run \`xcodebuild ${project.flag} ${project.path} -scheme ${scheme} -configuration ${configuration} -sdk iphoneos -showBuildSettings -json\` to see what it reports.`
+	});
+	const targetRefusal = signingTargetsRefusal(targets, {
+		scheme,
+		configuration
+	});
+	if (targetRefusal) return report(targetRefusal);
+	const teams = [...new Set(targets.flatMap((target) => target.team ? [target.team] : []))];
+	const plan = {
+		platform: "ios",
+		udid: device.udid,
+		deviceName: device.name,
+		teams,
+		auth: auth.kind === "api-key" ? {
+			kind: "api-key",
+			keyId: auth.keyId
+		} : { kind: "xcode-account" },
+		scheme,
+		configuration,
+		targets: targets.map(({ target, bundleId, platform }) => ({
+			target,
+			bundleId,
+			platform
+		}))
+	};
+	for (const line of provisionPlanLines({
+		device,
+		targets,
+		auth,
+		scheme,
+		configuration
+	})) d.note(line);
+	if (!(opts.yes === true || !json && d.interactive && await d.confirm("Make these changes to the Apple Developer account? [y/N] "))) return report({
+		code: "STIM_PROVISION_UNCONFIRMED",
+		message: "Nothing changed: provisioning changes an Apple Developer account, so it runs only after explicit confirmation.",
+		remedy: UNCONFIRMED_REMEDY,
+		plan
+	});
+	let derivedDataPath;
+	try {
+		derivedDataPath = d.makeDerivedData(root);
+	} catch (error) {
+		return report({
+			code: "STIM_PROVISION_FAILED",
+			message: `Nothing changed: Stim could not create a temporary DerivedData directory: ${error instanceof Error ? error.message : String(error)}`,
+			remedy: "Set STIM_TMPDIR, or tempDir in the Stim machine config, to a writable directory outside Git working trees.",
+			plan
+		});
+	}
+	const removeDerivedData = () => {
+		try {
+			d.removeDerivedData(derivedDataPath);
+		} catch {}
+	};
+	const state = operationState(d.operation);
+	const drain = () => {
+		state.handled = true;
+		state.draining = true;
+	};
+	d.operation?.signal.addEventListener("abort", drain, { once: true });
+	let running = null;
+	const forcedExit = () => {
+		running?.kill("SIGKILL");
+		removeDerivedData();
+	};
+	state.exitCleanups.add(forcedExit);
+	const dirs = profileDirectories();
+	const profilesBefore = d.profileFiles(dirs);
+	const identitiesBefore = await d.findSigningIdentities();
+	d.note(chalk.dim(`Provisioning through ${describeAuth(auth)}; xcodebuild contacts Apple...`));
+	let run;
+	try {
+		if (d.operation?.signal.aborted) return report({
+			code: "STIM_PROVISION_FAILED",
+			message: "Nothing changed: provisioning was interrupted before xcodebuild started.",
+			remedy: "Run `stim device provision ios` again.",
+			plan
+		});
+		run = await d.runProvisioningBuild({
+			args: provisionXcodebuildArgs({
+				project,
+				scheme,
+				configuration,
+				udid: device.udid,
+				derivedDataPath,
+				auth,
+				packageArgs: selection.packageArgs
+			}),
+			cwd: project.dir,
+			env: d.env,
+			...d.operation ? { signal: d.operation.signal } : {},
+			onChild: (child) => {
+				running = child;
+				return () => {
+					running = null;
+				};
+			}
+		});
+	} finally {
+		removeDerivedData();
+		state.exitCleanups.delete(forcedExit);
+		d.operation?.signal.removeEventListener("abort", drain);
+	}
+	const changes = provisionChanges({
+		before: profilesBefore,
+		after: await d.readInstalledProfiles(d.profileFiles(dirs)),
+		targets,
+		udid: device.udid,
+		identitiesBefore,
+		identitiesAfter: await d.findSigningIdentities(),
+		now: d.now()
+	});
+	if (!run.resolved) {
+		const failure = run.error ? {
+			code: "STIM_PROVISION_FAILED",
+			message: `Could not run xcodebuild: ${redactKeyPath(run.error.message, auth)}`,
+			remedy: "Install Xcode and select it with `sudo xcode-select -s /Applications/Xcode.app`."
+		} : run.cancelled ? {
+			code: "STIM_PROVISION_FAILED",
+			message: "Provisioning was interrupted before xcodebuild resolved signing.",
+			remedy: "Run `stim device provision ios` again to finish; it is safe to repeat."
+		} : run.timedOut ? {
+			code: "STIM_PROVISION_FAILED",
+			message: `xcodebuild did not resolve signing within ${PROVISION_TIMEOUT_MS / 6e4} minutes, so Stim stopped it.`,
+			remedy: "Check the network connection to Apple and that the phone stays unlocked and connected, then run `stim device provision ios` again."
+		} : provisionFailure(run.lines, auth, teams.join(", "));
+		const already = provisionReportLines(changes, device, false);
+		if (already.length > 0 && !json) {
+			d.note("Already changed before it stopped:");
+			for (const line of already) d.note(`  ${redactKeyPath(line, auth)}`);
+		}
+		return report({
+			...failure,
+			plan,
+			changes
+		});
+	}
+	const result = {
+		...plan,
+		changes
+	};
+	if (json) d.out(JSON.stringify(result));
+	else {
+		const unconfirmed = changes.profiles.some((outcome) => outcome.onPhone && outcome.profile === null);
+		d.out(unconfirmed ? chalk.yellow(`xcodebuild resolved signing for ${device.name} (${device.udid}) on team ${teams.join(", ")}, but Stim could not confirm every installed profile.`) : chalk.green(`Provisioned signing for ${device.name} (${device.udid}) on team ${teams.join(", ")}.`));
+		for (const line of provisionReportLines(changes, device)) d.out(unconfirmed ? chalk.yellow(line) : line);
+		d.out(`Next: stim ios --device ${device.udid}`);
+	}
+	return result;
+}
+//#endregion
+//#region src/commands/device.ts
+const DEFAULT_FOR = "5m";
+const DEFAULT_DEPS = {
+	findProjectRoot: findProjectRoot$1,
+	getProject,
+	avdNameOf: getAvdNameForSerialAsync,
+	listIosDevices,
+	listAdbDevices,
+	physicalDeviceModel,
+	probeEmulatorSerial,
+	takeLease,
+	releaseLeases: releaseWorkspaceLeases,
+	waitForDevice,
+	selectFromPool,
+	io: fileLeaseIo,
+	now: () => Date.now(),
+	sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+	out: (line) => console.log(line),
+	note: (line) => console.error(line)
+};
+function grantLine(facts, durationText) {
+	return `locked ${facts.deviceName ? `${facts.deviceName} (${facts.id})` : facts.id} for ${facts.holder} until ${clockTime(facts.expiresAt)} (${durationText}). Renew: stim device lock ${facts.platform}${facts.slot ? ` --slot ${facts.slot}` : ""} --for ${durationText}. Release: stim device unlock${facts.slot ? ` --slot ${facts.slot}` : ""}.`;
+}
+function releasedLine(lease) {
+	return `unlocked ${lease.deviceName ? `${lease.deviceName} (${lease.id})` : lease.id} -- the ${lease.platform} lease ran until ${clockTime(lease.expiresAt)}.`;
+}
+function readPlatform(value) {
+	return value === "ios" || value === "android" ? value : null;
+}
+async function resolveDevice(platform, requested, d) {
+	if (platform === "ios") {
+		const resolved = resolveIosPhysicalDevice(requested, await d.listIosDevices());
+		if (!resolved.udid) return {
+			code: "STIM_NO_DEVICE",
+			message: resolved.error,
+			remedy: resolved.remedy ?? null
+		};
+		return {
+			id: resolved.udid,
+			deviceName: resolved.name ?? resolved.udid
+		};
+	}
+	const resolved = resolvePhysicalDevice(requested, d.listAdbDevices(), d.probeEmulatorSerial);
+	if (!resolved.serial) return {
+		code: "STIM_NO_DEVICE",
+		message: resolved.error,
+		remedy: resolved.remedy ?? null
+	};
+	return {
+		id: resolved.serial,
+		deviceName: d.physicalDeviceModel(resolved.serial) ?? resolved.serial
+	};
+}
+async function findOwnedVirtualDevice(project, platform, id, avdNameOf) {
+	let running;
+	for (const { slot, platforms } of projectDeviceSlots(project)) {
+		if (platform === "ios") {
+			const sim = platforms.ios;
+			if (sim?.owned && sim.deviceUdid && sim.deviceUdid.toLowerCase() === id.toLowerCase()) return {
+				id: sim.deviceUdid,
+				deviceName: sim.deviceName ?? null,
+				slot
+			};
+			continue;
+		}
+		const emulator = platforms.android;
+		if (!emulator?.owned || !emulator.avdName || !/^emulator-\d+$/.test(id)) continue;
+		running ??= { name: await avdNameOf(id) };
+		if (running.name === emulator.avdName) return {
+			id,
+			deviceName: emulator.deviceName ?? emulator.avdName,
+			slot
+		};
+	}
+	return null;
+}
+function isFailure(value) {
+	return "code" in value;
+}
+async function poolDevice(platform, idLabel, waitSeconds, deadline, root, d, slot) {
+	const isEmulator = memoizeEmulatorProbe(d.probeEmulatorSerial);
+	const pooled = await d.selectFromPool({
+		...slot ? { slot } : {},
+		root,
+		platform,
+		idLabel,
+		list: async () => platform === "ios" ? iosPoolCandidates(await d.listIosDevices()).map((entry) => ({
+			id: entry.udid,
+			name: entry.name,
+			fallback: isWirelessIosDevice(entry)
+		})) : androidPoolCandidates(d.listAdbDevices(), isEmulator).map((entry) => ({ id: entry.serial })),
+		noCandidates: async () => {
+			const resolved = platform === "ios" ? iosPoolNoCandidatesRefusal(await d.listIosDevices()) : androidPoolNoCandidatesRefusal(d.listAdbDevices(), isEmulator);
+			return {
+				message: resolved.error,
+				remedy: resolved.remedy
+			};
+		},
+		waitSeconds,
+		deadline,
+		now: d.now,
+		sleep: d.sleep,
+		warn: (line) => d.note(chalk.yellow(line)),
+		io: d.io
+	});
+	if (pooled.status === "refused") return {
+		code: pooled.refusal.code,
+		message: pooled.refusal.message,
+		remedy: pooled.refusal.remedy,
+		...pooled.refusal.lease === null ? {} : { lease: pooled.refusal.lease }
+	};
+	const name = pooled.candidate.name ?? (platform === "ios" ? pooled.candidate.id : d.physicalDeviceModel(pooled.candidate.id));
+	return {
+		id: pooled.candidate.id,
+		deviceName: name ?? pooled.candidate.id
+	};
+}
+async function runLock(platformArg, idArg, opts = {}, overrides = {}) {
+	const d = {
+		...DEFAULT_DEPS,
+		...overrides
+	};
+	const json = Boolean(opts.json);
+	const report = (failure) => {
+		d.note(chalk.red(`${failure.code}: ${failure.message}`));
+		if (failure.remedy) d.note(chalk.dim(failure.remedy));
+		if (json) d.out(JSON.stringify({
+			code: failure.code,
+			message: failure.message,
+			remedy: failure.remedy,
+			...failure.lease === void 0 ? {} : { lease: failure.lease }
+		}));
+		return failure;
+	};
+	const platform = readPlatform(platformArg);
+	if (!platform) return report({
+		code: "STIM_BAD_ARG",
+		message: `\`stim device lock\` takes ios or android, not ${JSON.stringify(platformArg)}.`,
+		remedy: "Run `stim device lock ios` or `stim device lock android`."
+	});
+	const root = d.findProjectRoot(process.cwd());
+	if (!root) return report(NO_PROJECT_REFUSAL);
+	const durationText = String(opts.for ?? DEFAULT_FOR).trim();
+	const duration = parseLeaseDuration(durationText);
+	if ("error" in duration) return report({
+		code: "STIM_BAD_ARG",
+		message: duration.error,
+		remedy: "Pass a whole number of seconds or minutes from 10s to 30m, e.g. --for 90s or --for 10m."
+	});
+	const wait = parseDeviceWait(opts.wait);
+	if ("error" in wait) return report({
+		code: "STIM_BAD_ARG",
+		message: wait.error,
+		remedy: "Pass a whole number of seconds, e.g. --wait 90. `--wait 0` refuses a leased device at once."
+	});
+	const idLabel = platform === "ios" ? "udid" : "serial";
+	const deadline = d.now() + wait.seconds * 1e3;
+	const lastLine = { at: null };
+	const owned = idArg ? await findOwnedVirtualDevice(d.getProject(root), platform, idArg, d.avdNameOf) : null;
+	if (owned && opts.slot && opts.slot !== owned.slot) return report({
+		code: "STIM_BAD_ARG",
+		message: `${owned.id} is this workspace's ${platform} device in slot ${owned.slot}, not ${opts.slot}.`,
+		remedy: `Run \`stim device lock ${platform} ${owned.id}\` without --slot, or with --slot ${owned.slot}.`
+	});
+	const held = owned ? d.io.readHolder(root)[deviceSlotKey(platform, owned.slot)] : void 0;
+	if (owned && held && held.id !== owned.id) return report({
+		code: "STIM_DEVICE_BUSY",
+		message: `This workspace already leases ${held.id} for ${platform} in slot ${owned.slot}, and a workspace holds one lease per platform and slot.`,
+		remedy: `Release it with \`stim device unlock ${platform}${owned.slot === "default" ? "" : ` --slot ${owned.slot}`}\` once nothing depends on it, then lock ${owned.id}.`
+	});
+	const slot = owned ? owned.slot === "default" ? void 0 : owned.slot : opts.slot;
+	const device = owned ? owned : idArg ? await resolveDevice(platform, idArg, d) : await poolDevice(platform, idLabel, wait.seconds, deadline, root, d, opts.slot);
+	if (isFailure(device)) return report(device);
+	for (;;) {
+		const outcome = await d.waitForDevice({
+			...slot ? { slot } : {},
+			root,
+			platform,
+			id: device.id,
+			idLabel,
+			waitSeconds: wait.seconds,
+			now: d.now,
+			sleep: d.sleep,
+			warn: (line) => d.note(chalk.yellow(line)),
+			io: d.io,
+			deadline,
+			lastLine
+		});
+		if (outcome.status === "refused") return report({
+			...outcome.refusal,
+			lease: outcome.refusal.lease
+		});
+		const taken = d.takeLease({
+			...slot ? { slot } : {},
+			root,
+			platform,
+			id: device.id,
+			deviceName: device.deviceName,
+			kind: "declared",
+			durationMs: duration.ms
+		}, d.io);
+		if (taken.status === "unreadable") return report({
+			code: "STIM_DEVICE_BUSY",
+			message: `The lease file at ${taken.path} does not parse, so Stim cannot tell who holds that device.`,
+			remedy: `Read ${taken.path} and, once you know no run depends on it, delete it. \`stim gc\` reports it on every run.`,
+			lease: {
+				platform: null,
+				id: null,
+				deviceName: null,
+				holder: null,
+				expiresAt: null
+			}
+		});
+		if (taken.status === "held") continue;
+		const facts = {
+			...taken.lease.slot ? { slot: taken.lease.slot } : {},
+			platform,
+			id: taken.lease.id,
+			deviceName: taken.lease.deviceName,
+			holder: taken.lease.holder,
+			kind: "declared",
+			grantedAt: taken.lease.grantedAt,
+			expiresAt: taken.lease.expiresAt,
+			leaseSeconds: Math.round(duration.ms / 1e3)
+		};
+		if (json) d.out(JSON.stringify(facts));
+		else d.out(chalk.green(grantLine(facts, durationText)));
+		return facts;
+	}
+}
+async function runUnlock(platformArg, opts = {}, overrides = {}) {
+	const d = {
+		...DEFAULT_DEPS,
+		...overrides
+	};
+	const json = Boolean(opts.json);
+	const report = (failure) => {
+		d.note(chalk.red(`${failure.code}: ${failure.message}`));
+		if (failure.remedy) d.note(chalk.dim(failure.remedy));
+		if (json) d.out(JSON.stringify({
+			code: failure.code,
+			message: failure.message,
+			remedy: failure.remedy
+		}));
+		return failure;
+	};
+	const platform = platformArg === void 0 ? null : readPlatform(platformArg);
+	if (platformArg !== void 0 && !platform) return report({
+		code: "STIM_BAD_ARG",
+		message: `\`stim device unlock\` takes ios or android, not ${JSON.stringify(platformArg)}.`,
+		remedy: "Run `stim device unlock` for every lease this workspace holds, or name one platform."
+	});
+	const root = d.findProjectRoot(process.cwd());
+	if (!root) return report(NO_PROJECT_REFUSAL);
+	const released = d.releaseLeases(root, {
+		platform,
+		...opts.slot ? { slot: opts.slot } : {}
+	}, d.io);
+	if (released.length === 0) d.note(chalk.dim(`No ${platform ? `${platform} ` : ""}device lease to release for ${root}. \`stim status\` lists every lease on this machine.`));
+	if (json) d.out(JSON.stringify(released.map((lease) => ({
+		...lease,
+		holder: root
+	}))));
+	else for (const lease of released) d.out(chalk.green(releasedLine(lease)));
+	return released;
+}
+function registerDevice(program, deps = {}) {
+	const device = program.command("device").description("Lease a connected physical device to this workspace, give it back, or provision iOS signing for it");
+	device.command("lock").argument("<platform>", "ios or android").argument("[id]", "the UDID or serial to lease, a connected device or this workspace's own simulator or emulator; without one, the first free connected device is used").description("Lease a connected physical device, or this workspace's own simulator or emulator, to this workspace for a declared time, so another workspace's `--device` run waits and agents see the device as driven. Nothing but this command and a `--device` run moves the expiry.").option("--for <duration>", `How long to hold it: a whole number of seconds or minutes from 10s to 30m (default ${DEFAULT_FOR})`).option("--wait <seconds>", "How long to wait for a device another workspace holds, before refusing with STIM_DEVICE_BUSY (default 60, 0 refuses at once)").option("--slot <name>", "Use this workspace device slot", parseDeviceSlotOption).option("--json", "print the lease as JSON on stdout").action(async (platform, id, opts) => {
+		if ("code" in await runLock(platform, id, opts, deps)) process.exit(1);
+	});
+	device.command("unlock").argument("[platform]", "ios or android; without one, every lease this workspace holds is released").description("Release the device lease or leases this workspace holds. Releasing nothing is not an error.").option("--slot <name>", "Use this workspace device slot", parseDeviceSlotOption).option("--json", "print the released leases as JSON on stdout").action(async (platform, opts) => {
+		const result = await runUnlock(platform, opts, deps);
+		if (!Array.isArray(result)) process.exit(1);
+	});
+	device.command("provision").argument("<platform>", "ios").argument("[udid]", "the connected iPhone or iPad to provision for; required when more than one is connected").description("Register a connected iPhone with the project's Apple Developer team and create or refresh its iOS App Development profile, through xcodebuild -allowProvisioningUpdates. It lists the account changes and asks first; no build ever does this.").option("--scheme <name>", "Xcode scheme whose signed targets to provision (default: ios.scheme, then detected)").option("--configuration <name>", "build configuration to provision (default: ios.configuration, then Debug)").option("--yes", "confirm the listed Apple Developer account changes without a prompt").option("--json", "print the plan and result, or the refusal, as JSON on stdout").action(async (platform, udid, opts) => {
+		const root = findProjectRoot$1(process.cwd()) ?? process.cwd();
+		const { value: result, interrupted } = await runProcessOperation(root, (operation) => runProvision(platform, udid, opts, { operation }));
+		if ("code" in result) process.exit(interrupted ?? 1);
+	});
+}
+function deviceCommand(program) {
+	registerDevice(program);
+}
+//#endregion
+export { deviceCommand as default, grantLine, registerDevice, releasedLine, runLock, runUnlock };