stim 1.20.2 → 1.21.0

package/dist/selection-CSl9i5qU.mjs

@@ -0,0 +1,619 @@
+import { m as reportSignal, u as operationState } from "./exec-_UbtCQcG.mjs";
+import { v as withDirLock$1 } from "./paths-DQtTgsBf.mjs";
+import { Q as findPeer$1, Z as endpoint, _ as loadConfig$1, ct as readHostPermissions, d as getConfigDir, et as outdatedServer, nt as reachMachine, ot as setupRemedy, rt as realIo, tt as parseMachine$1 } from "./config-CYcBF478.mjs";
+import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { hostname } from "node:os";
+import { ambientContext, ambientEnv, withDirLockAsync } from "@stim-cli/core";
+import { MACHINE_CREDENTIALS_VERSION, OFFLOAD_MODES, acceptsShape, automaticMachineEnabled, buildMachinesFile, buildMachinesLock, cannotHost, deviceHostMachinesClaims, deviceHostMachinesFile, deviceHostMachinesLock, isJsonObject, parseMachine, readBuildMachines, readDeviceHostMachines, settingDefinition } from "@stim-cli/core/state";
+import { releaseClaim, tryAcquireClaim } from "@stim-cli/core/ownership-claim";
+import { InvalidArgumentError } from "commander";
+//#region src/device-host/machines.ts
+function note$1(title, detail, fix = null) {
+	return {
+		code: "device-host-machine",
+		level: "note",
+		title,
+		detail,
+		fix
+	};
+}
+function configuredMachines() {
+	const remote = loadConfig$1()?.remote;
+	if (remote !== void 0 && !isJsonObject(remote)) return null;
+	const machines = remote?.machines;
+	if (machines === void 0) return [];
+	return acceptsShape(settingDefinition("remote.machines"), machines) ? machines : null;
+}
+/**
+* The `remote.machines` entries this machine asked for device-host access, in setting order, without the ones the
+* tailnet reports as running another OS than macOS, which can never host; null when the setting is invalid.
+*/
+function hostingMachines(status = realIo.status) {
+	const configured = configuredMachines();
+	if (configured === null) return null;
+	let candidates = configured;
+	try {
+		const asked = readDeviceHostMachines();
+		candidates = configured.filter((machine) => asked.some((each) => each.machine === machine));
+	} catch {
+		candidates = configured;
+	}
+	if (!candidates.length) return candidates;
+	const current = status();
+	return candidates.filter((machine) => !cannotHost(current, machine));
+}
+async function store(machines, operation) {
+	reportSignal(operation)?.throwIfAborted();
+	const write = () => {
+		reportSignal(operation)?.throwIfAborted();
+		const file = deviceHostMachinesFile();
+		const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+		try {
+			writeFileSync(tmp, `${JSON.stringify({
+				version: MACHINE_CREDENTIALS_VERSION,
+				machines
+			}, null, 2)}\n`, { mode: 384 });
+			renameSync(tmp, file);
+		} finally {
+			rmSync(tmp, { force: true });
+		}
+	};
+	const options = { ensureParent: () => mkdirSync(getConfigDir(), { recursive: true }) };
+	const signal = reportSignal(operation);
+	if (signal) await withDirLockAsync(deviceHostMachinesLock(), write, {
+		...options,
+		signal
+	});
+	else withDirLock$1(deviceHostMachinesLock(), write, options);
+}
+/**
+* Reports the device-host approval of each remote machine, separate from its build approval. Only --fix makes a setup
+* ticket or forgets credentials; every server key stays pinned.
+*/
+async function inspectDeviceHostMachines({ fix, version = "<version>", tickets = /* @__PURE__ */ new Map(), operation }, io = realIo, entries = configuredMachines()) {
+	if (entries === null) return {
+		findings: [note$1("Invalid remote.machines setting", "Use a remote object with machines as an array of tailnet names. Existing hosting credentials and pinned keys are preserved.", "Run `stim guide settings` and correct the setting before running doctor again.")],
+		machines: []
+	};
+	const unavailable = (state, finding) => ({
+		findings: [finding],
+		machines: entries.map((machine) => ({
+			machine,
+			state
+		}))
+	});
+	const unreadable = () => unavailable("credentials-unavailable", note$1("Hosting credentials are unreadable", `Stim preserves ${deviceHostMachinesFile()} and its pinned keys.`, "Restore the existing file from a trusted backup or restore read access before running doctor again."));
+	if (!entries.length) {
+		if (!fix) return {
+			findings: [],
+			machines: []
+		};
+		try {
+			if (!readDeviceHostMachines().length) return {
+				findings: [],
+				machines: []
+			};
+		} catch {
+			return unreadable();
+		}
+	}
+	const claim = tryAcquireClaim({
+		root: deviceHostMachinesClaims(),
+		mode: "exclusive",
+		label: "device-host approval"
+	});
+	if (!claim.acquired) {
+		releaseClaim(claim.pending);
+		return unavailable("busy", note$1("Device-host approval is in use", "Another doctor run holds the hosting credential claim. Run doctor again after it finishes."));
+	}
+	try {
+		let credentials;
+		try {
+			credentials = readDeviceHostMachines();
+		} catch {
+			return unreadable();
+		}
+		if (fix) {
+			const kept = credentials.filter((each) => entries.includes(each.machine));
+			if (kept.length !== credentials.length) {
+				await store(kept, operation);
+				credentials = kept;
+			}
+		}
+		if (!entries.length) return {
+			findings: [],
+			machines: []
+		};
+		const status = await io.status();
+		if (!isJsonObject(status)) return unavailable("tailscale-off", note$1("Remote machines are unreachable", "remote.machines names remote machines, but Tailscale is not running."));
+		const self = isJsonObject(status.Self) ? status.Self : {};
+		const deviceName = (typeof self.HostName === "string" && self.HostName ? self.HostName : hostname()).replace(/[\p{Cc}\p{Cf}]/gu, "").trim().slice(0, 64) || "Mac";
+		const inspected = {
+			findings: [],
+			machines: []
+		};
+		const namedNodes = /* @__PURE__ */ new Set();
+		for (const machine of new Set(entries)) {
+			const parsed = parseMachine$1(machine);
+			if (!parsed) {
+				inspected.machines.push({
+					machine,
+					state: "invalid"
+				});
+				inspected.findings.push(note$1(`Remote machine ${machine} is not a tailnet name`, "Expected `name` or `name:port`."));
+				continue;
+			}
+			const current = await io.status();
+			if (!isJsonObject(current)) {
+				inspected.machines.push({
+					machine,
+					state: "tailscale-off"
+				});
+				inspected.findings.push(note$1(`Remote machine ${machine} is unreachable`, "Tailscale stopped before this connection."));
+				continue;
+			}
+			const peer = findPeer$1(current, parsed.name);
+			if (peer === "missing" || peer === "ambiguous") {
+				inspected.machines.push({
+					machine,
+					state: "not-on-tailnet"
+				});
+				inspected.findings.push(note$1(`Remote machine ${machine} is not on this tailnet`, peer === "missing" ? "No peer has that name." : "Several peers match that name."));
+				continue;
+			}
+			const nodeRoute = `${peer.nodeId}:${parsed.port}`;
+			if (namedNodes.has(nodeRoute)) {
+				inspected.machines.push({
+					machine,
+					dnsName: peer.dnsName,
+					state: "invalid"
+				});
+				inspected.findings.push(note$1(`Remote machine ${machine} repeats a named node`, "Name each tailnet node and serve port only once in remote.machines."));
+				continue;
+			}
+			namedNodes.add(nodeRoute);
+			if (cannotHost(current, machine)) {
+				inspected.machines.push({
+					machine,
+					dnsName: peer.dnsName,
+					state: "not-asked"
+				});
+				continue;
+			}
+			const credential = credentials.find((each) => each.machine === machine);
+			reportSignal(operation)?.throwIfAborted();
+			const outcome = await reachMachine({
+				machine,
+				access: "device-host",
+				endpoint: endpoint(peer, parsed.port),
+				address: peer.dnsName,
+				credential,
+				other: () => readBuildMachines().find((each) => each.machine === machine),
+				persist: async (next) => {
+					credentials = [...credentials.filter((each) => each.machine !== machine), next];
+					await store(credentials, operation);
+				},
+				fix,
+				deviceName,
+				setupFlags: ["build", "device-host"],
+				serverVersion: version,
+				io,
+				tickets
+			});
+			reportSignal(operation)?.throwIfAborted();
+			if (outcome.state !== "not-asked" && outcome.credential) {
+				const next = outcome.credential;
+				if (JSON.stringify(next) !== JSON.stringify(credential)) {
+					credentials = [...credentials.filter((each) => each.machine !== machine), next];
+					await store(credentials, operation);
+				}
+			}
+			const saved = outcome.state !== "not-asked" ? outcome.credential : void 0;
+			const known = {
+				machine,
+				dnsName: peer.dnsName,
+				...saved?.deviceId ? { deviceId: saved.deviceId } : {},
+				...saved ? { requestedAt: saved.requestedAt } : {}
+			};
+			if (outcome.state === "approved") {
+				const host = readHostPermissions(outcome.result.host);
+				if (host && (host.screenRecording === false || host.accessibility === false)) {
+					const panes = [...host.screenRecording === false ? ["Screen & System Audio Recording (Screen Recording on macOS 14)"] : [], ...host.accessibility === false ? ["Device Control and Data Access (Accessibility on macOS 26 and earlier)"] : []];
+					const detail = [...host.screenRecording === false ? ["Viewing hosted macOS apps needs Screen Recording."] : [], ...host.accessibility === false ? ["Controlling them needs the control permission."] : []];
+					inspected.findings.push(note$1(`Remote Mac ${machine} needs ${panes.join(" and ")} for ${host.name}`, detail.join(" "), `On ${machine}, approve ${host.name} in System Settings > Privacy & Security, or run \`stim-server service install\` there again to show the requests.`));
+				}
+				inspected.machines.push({
+					...known,
+					state: "approved",
+					...host ? { host } : {}
+				});
+				continue;
+			}
+			if (outcome.state === "pending") {
+				inspected.machines.push({
+					...known,
+					state: "pending",
+					...outcome.credential.expiresAt ? { expiresAt: outcome.credential.expiresAt } : {}
+				});
+				inspected.findings.push(note$1(`Remote machine ${machine} has not approved this machine for device hosting yet`, `It does not hold this machine's setup ticket yet${outcome.credential.expiresAt ? `; the ticket expires at ${outcome.credential.expiresAt}` : ""}.`, setupRemedy(machine, outcome.command)));
+				continue;
+			}
+			if (outcome.state === "not-asked") {
+				inspected.machines.push({
+					...known,
+					state: "not-asked"
+				});
+				inspected.findings.push(note$1(`Remote machine ${machine} has not approved this machine for device hosting`, "This machine has not asked for hosting access.", "Run `stim doctor --fix` to make a setup ticket and print the command to run there."));
+				continue;
+			}
+			if (outcome.state === "outdated") {
+				const outdated = outdatedServer(machine, version, outcome.command);
+				inspected.machines.push({
+					...known,
+					state: "outdated"
+				});
+				inspected.findings.push(note$1(outdated.title, outdated.detail, outdated.fix));
+				continue;
+			}
+			inspected.machines.push({
+				...known,
+				state: outcome.state
+			});
+			inspected.findings.push(outcome.state === "key-changed" ? note$1(`Remote machine ${machine} answered with a different server key`, "Stim refuses to connect to a stim-server that does not prove it holds the key pinned at approval.", `If that machine or its Stim home was replaced, remove ${machine} from remote.machines, run \`stim doctor --fix\`, then add it back and run \`stim doctor --fix\` again.`) : outcome.state === "lapsed" ? note$1(`Hosting request to ${machine} lapsed`, `${machine} did not approve this machine before its setup ticket expired at ${outcome.credential.expiresAt}.`, "Run `stim doctor --fix` to make a new ticket.") : outcome.state === "revoked" ? note$1(`Remote machine ${machine} no longer accepts this machine for device hosting`, `${outcome.reason} The pinned key is preserved.`, "Run `stim doctor --fix` to ask again.") : note$1(`Remote machine ${machine} did not confirm hosting access`, outcome.reason, `Check stim-server and its tailnet serve route on ${machine}, then run doctor again.`));
+		}
+		return inspected;
+	} finally {
+		releaseClaim(claim.acquired);
+	}
+}
+//#endregion
+//#region src/offload/build-machines.ts
+/** The `remote.machines` entries that approved this machine for builds, in that order. */
+function pairedMachines(entries = configuredMachines() ?? []) {
+	const credentials = readBuildMachines().filter((each) => each.state === "approved");
+	return entries.flatMap((entry) => credentials.filter((each) => each.machine === entry));
+}
+async function updateCredentials(change, operation) {
+	reportSignal(operation)?.throwIfAborted();
+	const dir = getConfigDir();
+	const write = () => {
+		reportSignal(operation)?.throwIfAborted();
+		const file = buildMachinesFile();
+		const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+		writeFileSync(tmp, `${JSON.stringify({
+			version: MACHINE_CREDENTIALS_VERSION,
+			machines: change(readBuildMachines())
+		}, null, 2)}\n`, { mode: 384 });
+		try {
+			renameSync(tmp, file);
+		} catch (error) {
+			rmSync(tmp, { force: true });
+			throw error;
+		}
+	};
+	const options = { ensureParent: () => mkdirSync(dir, { recursive: true }) };
+	const signal = reportSignal(operation);
+	if (signal) await withDirLockAsync(buildMachinesLock(), write, {
+		...options,
+		signal
+	});
+	else withDirLock$1(buildMachinesLock(), write, options);
+}
+function note(title, detail, fix = null) {
+	return {
+		code: "build-machine",
+		level: "note",
+		title,
+		detail,
+		fix
+	};
+}
+const PROBLEM_TITLES = {
+	unreachable: "does not answer a build offer",
+	checkout: "cannot build an app outside a git checkout",
+	"stim-build": "runs another Stim build",
+	arch: "has another CPU architecture",
+	xcode: "has another Xcode",
+	"macos-sdk": "has another macOS SDK",
+	"simulator-sdk": "has another simulator SDK",
+	cocoapods: "has another CocoaPods",
+	bundler: "has no Bundler",
+	runtime: "has no simulator for this project's iOS runtime",
+	jdk: "runs another JDK major version",
+	"android-sdk": "has no Android SDK",
+	ndk: "lacks this project's NDK",
+	"build-tools": "lacks this project's Android build-tools",
+	"compile-sdk": "lacks this project's Android compile platform",
+	disk: "is low on disk",
+	busy: "is too busy to take builds",
+	platform: "cannot build this platform"
+};
+function problemFix(code, entry) {
+	switch (code) {
+		case "unreachable": return `Check that stim-server runs on ${entry} and that its tailscale serve route answers, then run \`stim doctor\` again. To keep it running there, run \`stim-server service install --serve\` on ${entry}.`;
+		case "checkout": return "Offload syncs the files git lists; run Stim from a git checkout of the app.";
+		case "stim-build": return `Update stim-server on ${entry} to the same Stim build as this machine: there, run \`stim-server service update --release <version>\` for this machine's release, or \`--from <dir>\` with the packed packages of this machine's checkout.`;
+		case "arch": return "Use a remote machine with the same CPU architecture as this machine.";
+		case "xcode":
+		case "simulator-sdk":
+		case "macos-sdk": return `Install and select the same Xcode on ${entry} and this Mac (\`xcode-select -p\` on each).`;
+		case "cocoapods": return `Install the same CocoaPods version on ${entry}, on the PATH its stim-server's login shell sets.`;
+		case "bundler": return `Install Bundler (\`gem install bundler\`) on ${entry}, on the PATH its stim-server's login shell sets.`;
+		case "runtime": return `Install that iOS simulator runtime on ${entry} with at least one iPhone simulator, or set ios.runtime here to one ${entry} has.`;
+		case "jdk": return `Start stim-server on ${entry} with JAVA_HOME at a JDK of the same major version as this machine's.`;
+		case "android-sdk":
+		case "ndk":
+		case "build-tools":
+		case "compile-sdk": return `Install the missing package with sdkmanager in the Android SDK stim-server on ${entry} uses (its ANDROID_HOME, else ~/Library/Android/sdk on macOS or ~/Android/Sdk on Linux).`;
+		case "disk": return `Free space on ${entry}'s worker root (server.workerRoot there).`;
+		case "platform": return `iOS and macOS builds need a Mac; ${entry} can take Android builds only.`;
+		case "busy": return `Builds stay on this machine until ${entry} has capacity. On ${entry}, server.maxLoadPerCore sets the load it accepts and concurrency.maxBuilds how many of its own builds it runs; it takes one offloaded build at a time.`;
+	}
+}
+const TRANSIENT = /* @__PURE__ */ new Set(["unreachable", "busy"]);
+function offloadFindings(entry, problems) {
+	return problems.map((problem) => ({
+		code: `build-machine-${problem.code}`,
+		level: TRANSIENT.has(problem.code) ? "note" : "cost",
+		title: `Remote machine ${entry} ${PROBLEM_TITLES[problem.code]}`,
+		detail: `Builds fall back to this machine: ${problem.reason}.`,
+		fix: problemFix(problem.code, entry)
+	}));
+}
+async function inspectMachine(entry, status, deviceName, fix, version, tickets, io, check, operation) {
+	const parsed = parseMachine$1(entry);
+	if (!parsed) return {
+		report: {
+			machine: entry,
+			state: "invalid"
+		},
+		finding: note(`Remote machine ${entry} is not a tailnet name`, "Expected `name` or `name:port`.")
+	};
+	const peer = findPeer$1(status, parsed.name);
+	if (peer === "missing" || peer === "ambiguous") {
+		const detail = peer === "missing" ? "No peer on this tailnet has that name." : "Several peers match that name.";
+		return {
+			report: {
+				machine: entry,
+				state: "not-on-tailnet"
+			},
+			finding: note(`Remote machine ${entry} is not on this tailnet`, detail)
+		};
+	}
+	const credential = readBuildMachines().find((each) => each.machine === entry);
+	const other = () => {
+		try {
+			return readDeviceHostMachines().find((each) => each.machine === entry);
+		} catch {
+			return;
+		}
+	};
+	const persist = (next) => updateCredentials((credentials) => [...credentials.filter((each) => each.machine !== entry), next], operation);
+	reportSignal(operation)?.throwIfAborted();
+	const outcome = await reachMachine({
+		machine: entry,
+		access: "build",
+		endpoint: endpoint(peer, parsed.port),
+		address: peer.dnsName,
+		credential,
+		other,
+		persist,
+		fix,
+		deviceName,
+		setupFlags: cannotHost(status, entry) ? ["build"] : ["build", "device-host"],
+		serverVersion: version,
+		io,
+		tickets
+	});
+	const known = {
+		machine: entry,
+		dnsName: peer.dnsName
+	};
+	reportSignal(operation)?.throwIfAborted();
+	if (outcome.state !== "not-asked" && outcome.credential) {
+		const next = outcome.credential;
+		if (JSON.stringify(next) !== JSON.stringify(credential)) await updateCredentials((credentials) => [...credentials.filter((each) => each.machine !== entry), next], operation);
+	}
+	const paired = {
+		...known,
+		...outcome.state !== "not-asked" && outcome.credential?.deviceId ? { deviceId: outcome.credential.deviceId } : {},
+		...outcome.state !== "not-asked" && outcome.credential ? { requestedAt: outcome.credential.requestedAt } : {}
+	};
+	switch (outcome.state) {
+		case "not-asked": return {
+			report: {
+				...known,
+				state: "not-asked"
+			},
+			finding: note(`Remote machine ${entry} has not approved this machine for builds`, "This machine has not asked it for build access.", "Run `stim doctor --fix` to make a setup ticket and print the command to run there.")
+		};
+		case "key-changed": return {
+			report: {
+				...paired,
+				state: "key-changed"
+			},
+			finding: note(`Remote machine ${entry} answered with a different server key`, `${peer.dnsName} did not prove it holds the stim-server key this machine pinned at approval. Stim does not connect to it.`, `If that machine or its Stim home was replaced, remove ${entry} from remote.machines, run \`stim doctor --fix\` to forget the old pairing, then add it back and run \`stim doctor --fix\` again.`)
+		};
+		case "pending": return {
+			report: {
+				...paired,
+				state: "pending",
+				...outcome.credential.expiresAt ? { expiresAt: outcome.credential.expiresAt } : {}
+			},
+			finding: note(`Remote machine ${entry} has not approved this machine for builds yet`, `It does not hold this machine's setup ticket yet${outcome.credential.expiresAt ? `; the ticket expires at ${outcome.credential.expiresAt}` : ""}.`, setupRemedy(entry, outcome.command))
+		};
+		case "lapsed": return {
+			report: {
+				...paired,
+				state: "lapsed"
+			},
+			finding: note(`Build request to ${entry} lapsed`, `${entry} did not approve this machine before its setup ticket expired at ${outcome.credential.expiresAt}.`, "Run `stim doctor --fix` to make a new ticket.")
+		};
+		case "revoked": return {
+			report: {
+				...paired,
+				state: "revoked"
+			},
+			finding: note(`Remote machine ${entry} no longer accepts this machine for builds`, `${outcome.reason} It was revoked.`, "Run `stim doctor --fix` to ask again.")
+		};
+		case "outdated": {
+			const outdated = outdatedServer(entry, version, outcome.command);
+			return {
+				report: {
+					...paired,
+					state: "outdated"
+				},
+				finding: note(outdated.title, outdated.detail, outdated.fix)
+			};
+		}
+		case "unreachable": return {
+			report: {
+				...paired,
+				state: "unreachable"
+			},
+			finding: note(`Could not reach remote machine ${entry}`, outcome.reason, `Check that stim-server runs on ${entry}. To keep it running there, run \`stim-server service install --serve\` on ${entry}.`)
+		};
+	}
+	const permissions = readHostPermissions(outcome.result.host);
+	const host = permissions ? { host: permissions } : {};
+	if (!check) return {
+		report: {
+			...paired,
+			state: "approved",
+			...host
+		},
+		finding: null
+	};
+	const { capacity, problems } = await check(outcome.credential);
+	return {
+		report: {
+			...paired,
+			state: "approved",
+			...host,
+			offloadable: problems.length === 0,
+			reasons: problems.map((problem) => problem.reason),
+			problems,
+			...capacity ? { capacity } : {}
+		},
+		finding: null,
+		extra: offloadFindings(entry, problems)
+	};
+}
+/**
+* Doctor findings and a report for each `remote.machines` entry. The worker's stim-server key is pinned on first
+* contact; every later connection must prove it holds that key. With `fix`, makes a setup ticket for a named machine
+* this machine holds no pairing for, or that revoked it, and forgets pairings of machines no longer named. With
+* `check`, each approved machine is asked for one build offer and reports every reason it would not take this
+* project's build.
+*/
+async function inspectBuildMachines({ fix, check = null, version = "<version>", tickets = /* @__PURE__ */ new Map(), operation }, io = realIo, entries = configuredMachines()) {
+	if (entries === null) return {
+		findings: [note("Invalid remote.machines setting", "Use a remote object with machines as an array of tailnet names. Existing credentials and pinned keys are preserved.", "Run `stim guide settings` and correct the setting before running doctor again.")],
+		machines: []
+	};
+	const unnamed = (each) => !entries.includes(each.machine);
+	if (fix && readBuildMachines().some(unnamed)) await updateCredentials((credentials) => credentials.filter((each) => !unnamed(each)), operation);
+	if (entries.length === 0) return {
+		findings: [],
+		machines: []
+	};
+	const status = await io.status();
+	if (!isJsonObject(status)) return {
+		findings: [note("Remote machines are unreachable", "remote.machines names remote machines, but Tailscale is not running.")],
+		machines: entries.map((machine) => ({
+			machine,
+			state: "tailscale-off"
+		}))
+	};
+	const self = isJsonObject(status.Self) ? status.Self : {};
+	const deviceName = (typeof self.HostName === "string" && self.HostName ? self.HostName : hostname()).replace(/[\p{Cc}\p{Cf}]/gu, "").trim().slice(0, 64) || "Mac";
+	const inspection = {
+		findings: [],
+		machines: []
+	};
+	const inspected = await Promise.all(entries.map((entry) => inspectMachine(entry, status, deviceName, fix, version, tickets, io, check, operation)));
+	for (const { report, finding, extra = [] } of inspected) {
+		inspection.machines.push(report);
+		if (finding) inspection.findings.push(finding);
+		inspection.findings.push(...extra);
+	}
+	return inspection;
+}
+//#endregion
+//#region src/offload/selection.ts
+var OffloadRefusal = class extends Error {
+	code = "STIM_OFFLOAD_REFUSED";
+	remedy = "Run stim doctor --fix to ask for build access if not paired; it prints the stim-server setup command a person runs on the worker to approve this machine. Check stim settings get remote.machines, or rerun with --remote-build auto or --remote-build local.";
+	constructor(machine, reason) {
+		super(reason.startsWith(`${machine}: `) ? reason : `${machine}: ${reason}`);
+	}
+};
+function resolveBuildMachine(flag, env, setting) {
+	const selected = flag ?? (env?.trim() || void 0) ?? setting ?? "auto";
+	if (typeof selected !== "string" || !selected.trim() || !parseMachine(selected)) throw Object.assign(/* @__PURE__ */ new Error("--remote-build / remote.build must be auto, local, or a tailnet machine name."), { code: "STIM_BAD_ARG" });
+	const trimmed = selected.trim();
+	const reserved = trimmed.toLowerCase();
+	return reserved === "auto" || reserved === "local" ? reserved : trimmed;
+}
+function parseBuildMachineOption(value) {
+	try {
+		return resolveBuildMachine(value);
+	} catch (error) {
+		throw new InvalidArgumentError(error.message);
+	}
+}
+function requireLocalBuild(selected) {
+	if (selected === "auto" && !automaticMachineEnabled("build", "local")) throw new OffloadRefusal("auto", "local is disabled in remote.buildPoolDisabled; enable it or select a machine explicitly");
+}
+function namedBuildMachine(selected) {
+	return selected !== "auto" && selected !== "local";
+}
+function requireConfiguredMachine(selected, machines) {
+	if (!namedBuildMachine(selected)) return selected;
+	const parsed = parseMachine(selected);
+	const entries = Array.isArray(machines) ? machines.filter((entry) => typeof entry === "string") : [];
+	const match = entries.find((entry) => {
+		const candidate = parseMachine(entry);
+		return candidate?.name === parsed.name && candidate.port === parsed.port;
+	});
+	if (!match) throw new OffloadRefusal(selected, `not listed in remote.machines (configured: ${entries.join(", ") || "none"})`);
+	return match;
+}
+const settingSource = (flag, env, setting) => flag !== void 0 ? "flag" : env?.trim() ? "env" : setting !== void 0 ? "setting" : "default";
+/** The settings that decide where a build runs, with the layer each value came from, for this run's `--remote-build`. */
+function buildPlacementSettings(selected) {
+	const flag = operationState(ambientContext()).buildMachineFlag;
+	const remote = loadConfig$1()?.remote;
+	const rawMode = ambientEnv().STIM_REMOTE_BUILD_MODE || remote?.buildMode;
+	return [{
+		key: "remote.build",
+		value: selected,
+		from: settingSource(flag, ambientEnv().STIM_REMOTE_BUILD, remote?.build)
+	}, {
+		key: "remote.buildMode",
+		value: selected === "local" ? "off" : OFFLOAD_MODES.includes(rawMode) ? rawMode : "auto",
+		from: settingSource(void 0, ambientEnv().STIM_REMOTE_BUILD_MODE, remote?.buildMode)
+	}];
+}
+function resolveBuildPlacement(flag) {
+	const remote = loadConfig$1()?.remote;
+	operationState(ambientContext()).buildMachineFlag = flag;
+	let selected = "auto";
+	try {
+		selected = resolveBuildMachine(flag, ambientEnv().STIM_REMOTE_BUILD, remote?.build);
+		selected = requireConfiguredMachine(selected, remote?.machines);
+		if (namedBuildMachine(selected) && pairedMachines([selected]).length === 0) throw new OffloadRefusal(selected, "no remote machine is paired");
+		return { selected };
+	} catch (error) {
+		return {
+			selected,
+			failure: {
+				code: error.code,
+				message: error.message,
+				remedy: error instanceof OffloadRefusal ? error.remedy : "Pass --remote-build auto, local, or an entry from stim settings get remote.machines."
+			}
+		};
+	}
+}
+//#endregion
+export { requireLocalBuild as a, inspectBuildMachines as c, hostingMachines as d, inspectDeviceHostMachines as f, parseBuildMachineOption as i, pairedMachines as l, buildPlacementSettings as n, resolveBuildMachine as o, namedBuildMachine as r, resolveBuildPlacement as s, OffloadRefusal as t, configuredMachines as u };

package/dist/{server-bare-R2m_gsH8.mjs → server-bare-CxTrvDg8.mjs}

@@ -1,7 +1,6 @@
-import { J as __require, q as __commonJSMin } from "./config-BYDxlMY3.mjs";
-import { t as getExecutor } from "./exec-DqKo9GKJ.mjs";
-import { K as resolveProjectSettings } from "./settings-B717odTD.mjs";
-import { c as registerMetroStore, f as resolveMetroSharedCache, n as supervisorError, r as appendCacheStore, s as metroStoreRoot } from "./errors-DzkMYh8Q.mjs";
+import { t as getExecutor, v as __commonJSMin, y as __require } from "./exec-_UbtCQcG.mjs";
+import { q as resolveProjectSettings } from "./settings-CsJDEXgK.mjs";
+import { c as registerMetroStore, f as resolveMetroSharedCache, n as supervisorError, r as appendCacheStore, s as metroStoreRoot } from "./errors-ccaPc4ox.mjs";
 import { createRequire } from "node:module";
 import { isAbsolute, join, relative, sep } from "node:path";
 //#endregion

package/dist/{server-command-CTtCkmcQ.mjs → server-command-CtzloH3v.mjs}

@@ -1,9 +1,9 @@
-import { t as getExecutor } from "./exec-DqKo9GKJ.mjs";
-import { n as METRO_COMMAND_PORT } from "./settings-B717odTD.mjs";
-import { w as MODE_COMMAND } from "./project-_phNIJfs.mjs";
-import { d as signalProcessTree } from "./metro-DnCEjCxs.mjs";
-import { r as createNdjsonWriter } from "./ndjson-GOnbyvso.mjs";
-import { f as recordFromLine, m as superviseChildServer } from "./server-expo-DsguMGUF.mjs";
+import { t as getExecutor } from "./exec-_UbtCQcG.mjs";
+import { n as METRO_COMMAND_PORT } from "./settings-CsJDEXgK.mjs";
+import { T as MODE_COMMAND } from "./project-BZNjmW_8.mjs";
+import { r as createNdjsonWriter } from "./ndjson-CgE_o3Dl.mjs";
+import { p as signalProcessTree } from "./metro-DEXpIhHC.mjs";
+import { f as recordFromLine, h as superviseChildServer, m as withProjectNode } from "./server-expo-DT_F_uVI.mjs";
 import { join } from "node:path";
 import { LOG_ROTATE_BYTES } from "@stim-cli/core";
 //#region src/supervisor/server-command.ts
@@ -29,6 +29,13 @@ async function startCommandServer({ root, port, logsDir, command, writer = null,
 		msg: "metro.command starts the dev server, so Stim does not add its shared Metro transform store"
 	});
 	const group = platform !== "win32";
+	const node = withProjectNode(root, process.env);
+	if (node.pinned) log.write({
+		src: "metro",
+		level: "info",
+		event: "project_node",
+		msg: `Metro runs on Node ${node.pinned.version} from ${node.pinned.bin}, which ${node.pinned.pin} pins`
+	});
 	const child = spawn(program, args, {
 		cwd: root,
 		stdio: [
@@ -38,7 +45,7 @@ async function startCommandServer({ root, port, logsDir, command, writer = null,
 		],
 		detached: group,
 		env: {
-			...process.env,
+			...node.env,
 			FORCE_COLOR: "0"
 		}
 	});

package/dist/server-expo-C-90EhcG.mjs

@@ -0,0 +1,2 @@
+import { p as startExpoServer } from "./server-expo-DT_F_uVI.mjs";
+export { startExpoServer };