stim 1.20.2 → 1.22.0

package/dist/client-OyRoEuSr.mjs

@@ -0,0 +1,1577 @@
+import { _ as reportSignal, b as debugLog, m as operationState, t as getExecutor } from "./exec-DEoAhcze.mjs";
+import { Q as openAuthenticated, _ as loadConfig$1, it as sayHello, rt as resolveEndpoint } from "./config-DlrsduwG.mjs";
+import { f as throwIfCancelled, o as git, s as gitAsync } from "./operation-exec-BW0em61G.mjs";
+import { r as createNdjsonWriter } from "./ndjson-CgE_o3Dl.mjs";
+import { X as emptyCaches, br as discoverCaches, nt as planCacheEmptying } from "./budget-Cvwn54qV.mjs";
+import { t as canonicalPath } from "./paths-BsJMoPP2.mjs";
+import { d as runCancellationSignal } from "./native-run-NwUuxbkg.mjs";
+import { n as CCACHE_UNAVAILABLE, t as CCACHE_NOT_RUN } from "./ccache-Btwc36-I.mjs";
+import { n as COMPILATION_CACHE_UNAVAILABLE, t as COMPILATION_CACHE_NOT_RUN } from "./xcode-BXn9-xYx.mjs";
+import { t as resolveMaintenanceSettings } from "./settings-Djl-mpjX.mjs";
+import { a as iosToolchainAsync, d as toolchainMismatches, f as workerToolchain, g as readRubyVersion } from "./toolchain-DpJMHq0n.mjs";
+import { l as pairedMachines, r as namedBuildMachine, t as OffloadRefusal } from "./selection-DSMbWEX2.mjs";
+import { r as manifestDigest } from "./native-inputs-TRTTTRxt.mjs";
+import { a as sourceManifest, i as nativeTransferManifest, n as gitVisiblePaths, t as checkNativeTransferMembership } from "./native-source-Y0yLhFyQ.mjs";
+import { a as nativeGradleTransfer } from "./native-gradle-inputs-Dnh84Zbd.mjs";
+import { createHash, webcrypto } from "node:crypto";
+import { closeSync, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { isDeepStrictEqual } from "node:util";
+import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
+import { LOG_ROTATE_BYTES, ambientContext, reactNativeArtifactIdentity, reactNativeArtifactQuery, rotatedLogPath, swiftpmArtifactQuery, withDirLock } from "@stim-cli/core";
+import { MAINTENANCE_LOG_NAME, OFFLOAD_MODES, automaticMachineEnabled, isJsonObject, maintenanceDir, maintenanceNdjsonFile, requireAutomaticMachine, runId, saturation, workspaceLogsDir } from "@stim-cli/core/state";
+import { WebSocket } from "ws";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { readFile, readlink } from "node:fs/promises";
+//#region src/maintenance/log.ts
+function maintenanceLogger(settings, pass, trigger) {
+	const file = maintenanceNdjsonFile();
+	const rotated = rotatedLogPath(file);
+	withDirLock(`${file}.lock`, () => {
+		try {
+			if (Date.now() - statSync(rotated).mtimeMs > settings.logRetentionDays * 864e5) unlinkSync(rotated);
+		} catch {}
+	});
+	const writer = createNdjsonWriter(file, { maxBytes: settings.logMaxMb * 1024 ** 2 });
+	return {
+		write(event, level, msg, fields = {}) {
+			if (level === "debug" && !settings.logChecks) return null;
+			const record = {
+				...fields,
+				ts: Date.now(),
+				src: "maintenance",
+				level,
+				msg,
+				event,
+				pass,
+				trigger,
+				mode: settings.mode === "on" ? "on" : "report"
+			};
+			if (!writer.write(record)) throw writer.lastError ?? /* @__PURE__ */ new Error(`Could not append ${file}`);
+			if (typeof fields.workspace === "string" && [
+				"maintenance_action",
+				"maintenance_failure",
+				"maintenance_skip"
+			].includes(event)) {
+				const workspace = createNdjsonWriter(join(workspaceLogsDir(fields.workspace), MAINTENANCE_LOG_NAME), { maxBytes: LOG_ROTATE_BYTES });
+				try {
+					if (!workspace.write(record)) throw workspace.lastError ?? /* @__PURE__ */ new Error("Could not append workspace maintenance log");
+				} finally {
+					workspace.close();
+				}
+			}
+			return record;
+		},
+		close: () => writer.close()
+	};
+}
+//#endregion
+//#region src/cache/compilation-cache-corruption.ts
+const COMPILATION_CACHE_CORRUPT = "STIM_COMPILATION_CACHE_CORRUPT";
+async function emptyCompilationCache(dir) {
+	const results = [];
+	const cache = discoverCaches().find((candidate) => canonicalPath(candidate.dir) === canonicalPath(dir));
+	if (cache?.source !== "registered" || cache.prune !== "atomic") return `${dir} is not a registered cache Stim empties whole`;
+	const [planned] = planCacheEmptying([cache], true);
+	await emptyCaches(planned ? [planned] : [], {
+		log: () => {},
+		error: () => {},
+		record: (kind, status, label, { id = null, bytes = null, detail = null } = {}) => {
+			results.push({
+				kind,
+				status,
+				label,
+				id,
+				bytes,
+				detail
+			});
+		},
+		fail: () => {}
+	});
+	const refused = results.find((result) => result.status !== "done");
+	return refused ? refused.detail ?? `could not empty ${dir}` : null;
+}
+function recordInMaintenanceLog(workspace, msg, fields, cleared) {
+	try {
+		mkdirSync(maintenanceDir(), { recursive: true });
+		const logger = maintenanceLogger(resolveMaintenanceSettings(), `build-${process.pid}`, "ios build");
+		try {
+			logger.write(cleared ? "maintenance_action" : "maintenance_failure", cleared ? "info" : "warn", msg, {
+				...fields,
+				workspace
+			});
+		} finally {
+			logger.close();
+		}
+	} catch {}
+}
+/**
+* Empties the shared compilation cache a failed build reported corrupt, through the path `gc --delete --cache` uses,
+* unless another build may be using it. It never retries the build; the result is the refusal to print.
+*/
+async function clearCorruptCompilationCache(corruption, workspace) {
+	const { dir, line } = corruption;
+	let blocked;
+	try {
+		blocked = await emptyCompilationCache(dir);
+	} catch (error) {
+		blocked = error instanceof Error ? error.message : String(error);
+	}
+	const fields = {
+		target: dir,
+		category: "compilation-cache",
+		reason: line,
+		...blocked ? { blocked } : {}
+	};
+	if (blocked) {
+		const message = `The shared compilation cache at ${dir} is corrupt (the compiler reported: ${line}). Stim did not empty it: ${blocked}.`;
+		recordInMaintenanceLog(workspace, message, fields, false);
+		return {
+			code: COMPILATION_CACHE_CORRUPT,
+			message,
+			remedy: "Once the reason above is resolved, run `stim gc --delete --cache \"compilation cache\"`, then run the same command again."
+		};
+	}
+	const message = `The shared compilation cache at ${dir} was corrupt (the compiler reported: ${line}). Stim emptied it.`;
+	recordInMaintenanceLog(workspace, message, fields, true);
+	return {
+		code: COMPILATION_CACHE_CORRUPT,
+		message,
+		remedy: "Run the same command again. Its build starts with an empty compilation cache."
+	};
+}
+//#endregion
+//#region src/remote-log.ts
+const sinks = /* @__PURE__ */ new WeakMap();
+/** Where this operation's failed remote requests are written for `stim logs`. */
+function setRemoteLogSink(context, next) {
+	if (next) sinks.set(context, next);
+	else sinks.delete(context);
+}
+function reportRemoteFailure(context, event, fields) {
+	try {
+		if (context) sinks.get(context)?.({
+			src: "build",
+			level: "warn",
+			event,
+			...fields
+		});
+	} catch {}
+}
+//#endregion
+//#region src/offload/react-native-artifact.ts
+function reactNativeBuildQuery(build, fingerprint, project, toolchain) {
+	if (build.native) return null;
+	return reactNativeArtifactQuery({
+		project,
+		fingerprint,
+		toolchain,
+		isExpo: build.isExpo === true,
+		platform: build.platform,
+		...build.platform === "ios" ? { ios: {
+			runtime: build.runtime,
+			configuration: build.configuration ?? "Debug",
+			scheme: build.scheme ?? null,
+			projectPath: build.iosProjectPath ?? "ios",
+			optimizations: build.optimizations
+		} } : { android: build.android }
+	});
+}
+async function reactNativeArtifactToolchain(platform, root) {
+	if (platform === "ios") {
+		const tools = await iosToolchainAsync(root);
+		return tools.stimBuild && tools.xcode && tools.simulatorSdk && tools.cocoapods ? {
+			...tools,
+			os: process.platform
+		} : null;
+	}
+	const { stimBuild, os, arch, jdk, androidSdk } = workerToolchain(null, "gradle");
+	return stimBuild && jdk && androidSdk ? {
+		stimBuild,
+		os,
+		arch,
+		jdk,
+		androidSdk
+	} : null;
+}
+function reactNativeArtifactReceipt(query, toolchain) {
+	if (!toolchain || !isDeepStrictEqual(reactNativeArtifactQuery({
+		...query,
+		toolchain
+	})?.toolchain, query.toolchain)) return null;
+	const receipt = {
+		query,
+		toolchain
+	};
+	const identity = reactNativeArtifactIdentity(receipt);
+	return {
+		identity: {
+			hash: identity.fingerprint,
+			key: identity.cacheKey
+		},
+		receipt
+	};
+}
+//#endregion
+//#region src/offload/client.ts
+const CONNECT_TIMEOUT_MS = 1e4;
+const OFFER_TIMEOUT_MS = 2e4;
+const REQUEST_TIMEOUT_MS = 12e4;
+const JOB_TIMEOUT_MS = 39e5;
+const PING_MS = 15e3;
+const SILENT_MS = 6e4;
+const CLOSE_TIMEOUT_MS = 2e3;
+const CLOSE_ABNORMAL = 1006;
+const TURNED_AWAY = /* @__PURE__ */ new Set([
+	"unauthorized",
+	"forbidden",
+	"protocol-unsupported",
+	"server-key-mismatch"
+]);
+const RESUME_WINDOW_MS = 18e4;
+const RESUME_DELAY_MS = 2e3;
+const RESUME_MAX_DELAY_MS = 15e3;
+const PAGE_BYTES = 49152;
+const CHUNK_BYTES = 61440;
+const MAX_BUFFERED = 8388608;
+const DIGEST_BYTES = 32;
+function offloadMode(env = ambientContext()?.env ?? process.env) {
+	const raw = env.STIM_REMOTE_BUILD_MODE || loadConfig$1()?.remote?.buildMode;
+	return OFFLOAD_MODES.includes(raw) ? raw : "auto";
+}
+function buildPlacementCandidates(selected) {
+	const config = loadConfig$1();
+	return {
+		localEnabled: selected !== "auto" || automaticMachineEnabled("build", "local", config),
+		mode: selected === "local" ? "off" : offloadMode(),
+		machines: selected === "local" ? [] : namedBuildMachine(selected) ? pairedMachines([selected]).slice(0, 1) : pairedMachines().filter((entry) => automaticMachineEnabled("build", entry.machine, config))
+	};
+}
+function remotePhaseText(name, msg, machine) {
+	const text = msg.trim();
+	return `${text.startsWith(`${name} `) ? text.slice(name.length).trimStart() : text} (on ${machine})`;
+}
+const plural = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
+function capacityText(capacity) {
+	const builds = capacity.maxBuilds > 0 ? `${capacity.builds} of ${capacity.maxBuilds} build slots busy` : plural(capacity.builds, "build");
+	return `load ${capacity.loadPerCore}/core, ${builds}`;
+}
+function placementLoad(choice) {
+	const { loadPerCore, builds, maxBuilds } = choice.offer.capacity;
+	if (typeof loadPerCore !== "number" || typeof builds !== "number") return "";
+	return `; ${capacityText({
+		loadPerCore,
+		builds,
+		maxBuilds: maxBuilds ?? 0
+	})} there`;
+}
+/**
+* Whether a build may go to a remote machine at all, before any machine is asked. `auto` keeps the build here while
+* this machine has a free `concurrency.maxBuilds` slot and its load per core is under `server.maxLoadPerCore`.
+* A named selection ignores local capacity and mode, and refuses an unsupported build or missing pairing.
+*/
+function offloadPlacement({ mode, machines, here, unsupported, localEnabled = true, selected = "auto" }) {
+	if (namedBuildMachine(selected)) {
+		if (unsupported) throw new OffloadRefusal(selected, `${unsupported}, so a named remote machine cannot take it`);
+		if (machines === 0) throw new OffloadRefusal(selected, "no remote machine is paired");
+		return {
+			offload: true,
+			code: "named",
+			reason: `selected with --remote-build ${selected}`
+		};
+	}
+	if (selected === "local") return {
+		offload: false,
+		code: "local-selected",
+		reason: "--remote-build local"
+	};
+	if (!localEnabled) {
+		const reason = mode === "off" ? "remote.buildMode is off" : unsupported ?? (machines === 0 ? "no enabled remote machine is paired" : null);
+		if (reason) throw new OffloadRefusal("auto", `${reason}; local is disabled in remote.buildPoolDisabled`);
+		return {
+			offload: true,
+			code: "local-disabled",
+			reason: "local is disabled in remote.buildPoolDisabled"
+		};
+	}
+	if (mode === "off") return {
+		offload: false,
+		code: "mode-off",
+		reason: "remote.buildMode is off"
+	};
+	if (machines === 0) return {
+		offload: false,
+		code: "no-remote-mac",
+		reason: "no remote machine is paired"
+	};
+	if (unsupported) return {
+		offload: false,
+		code: "unsupported",
+		reason: unsupported
+	};
+	if (mode === "force") return {
+		offload: true,
+		code: "forced",
+		reason: "remote.buildMode is force"
+	};
+	const busy = saturation(here);
+	return busy ? {
+		offload: true,
+		code: "this-mac-busy",
+		reason: `this machine is busy: ${busy} (${capacityText(here)})`
+	} : {
+		offload: false,
+		code: "this-mac-free",
+		reason: `${capacityText(here)} here`
+	};
+}
+function matchingArtifact(offer, identity) {
+	const cached = offer.artifact;
+	if (!identity || !cached || typeof cached.name !== "string" || basename(cached.name) !== cached.name || !Number.isSafeInteger(cached.size) || cached.size <= 0 || typeof cached.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(cached.sha256)) return null;
+	if (identity === "react-native-ios" || identity === "react-native-android") {
+		const platform = identity === "react-native-ios" ? "ios" : "android";
+		return ARTIFACT_NAME[platform].test(cached.name) && /^[a-f0-9]{64}$/.test(cached.fingerprint) && cached.cacheKey === `react-native-${platform}-${cached.fingerprint}` && (platform === "ios" || ANDROID_PACKAGE.test(String(cached.androidPackage ?? ""))) ? cached : null;
+	}
+	if (identity === "swiftpm") return cached.name.endsWith(".app") && typeof cached.fingerprint === "string" && /^[a-f0-9]{64}$/.test(cached.fingerprint) && cached.cacheKey === `swiftpm-peer-${cached.fingerprint}` ? cached : null;
+	if (identity === "native-gradle") return cached.name.endsWith(".apk") && typeof cached.fingerprint === "string" && /^[a-f0-9]{64}$/.test(cached.fingerprint) && typeof cached.cacheKey === "string" && cached.cacheKey.length > 0 && cached.cacheKey.length <= 1024 && typeof cached.androidPackage === "string" && ANDROID_PACKAGE.test(cached.androidPackage) ? cached : null;
+	return cached.name.endsWith(".app") && cached.cacheKey === identity.cacheKey && cached.fingerprint === identity.fingerprint ? cached : null;
+}
+const gb = (bytes) => (bytes / 1024 ** 3).toFixed(1);
+/** Every reason a machine's offer cannot take this build, in either mode; empty when it can. */
+function offerProblems(offer, target) {
+	const problems = toolchainMismatches(target, offer.toolchain);
+	const capacity = offer.capacity;
+	const { running, max, diskFreeBytes, minDiskFreeBytes, declined } = capacity;
+	if (diskFreeBytes !== null && diskFreeBytes < minDiskFreeBytes) problems.push({
+		code: "disk",
+		reason: `${gb(diskFreeBytes)} GB free, needs ${gb(minDiskFreeBytes)} GB`
+	});
+	else if (declined || declined === void 0 && running >= max) {
+		const why = declined ?? `already running ${running} offloaded build(s), its limit`;
+		const load = typeof capacity.loadPerCore === "number" && typeof capacity.builds === "number" ? `; ${capacityText({
+			loadPerCore: capacity.loadPerCore,
+			builds: capacity.builds,
+			maxBuilds: capacity.maxBuilds ?? 0
+		})}` : "";
+		problems.push({
+			code: "busy",
+			reason: `busy (${why}${load})`
+		});
+	}
+	return problems;
+}
+/**
+* The asked machines that can take the build, best first, and one reason per machine that cannot. A machine with any
+* `offerProblems` never takes it. In `auto`, a machine must also be expected to build faster than this machine: while
+* every local build slot is busy any machine that accepts will do, otherwise its load per core must be lower than
+* this machine's. A named selection considers only that machine and skips this local-capacity gating.
+* A machine that reports no load (a stim-server older than capacity) takes an `auto` build only while
+* every local slot is busy. Matching dependency installations rank first, then load.
+*/
+function pickOffer({ mode, here, offers, target, localEnabled = true, selected = "auto", artifact, cacheOnly = false }) {
+	const slotsFull = here.maxBuilds > 0 && here.builds >= here.maxBuilds;
+	const reasons = [];
+	const candidates = [];
+	const skip = (machine, code, msg, detail) => {
+		reasons.push(`${machine}: ${msg}`);
+		candidates.push({
+			machine,
+			code,
+			msg,
+			...detail ? { detail } : {}
+		});
+	};
+	const ranked = [];
+	offers.forEach(({ machine, offer, failure }, index) => {
+		if (namedBuildMachine(selected) && machine !== selected) return;
+		if (!offer) return skip(machine, "unreachable", failure ?? "no offer");
+		if (matchingArtifact(offer, artifact) && (artifact !== "swiftpm" || toolchainMismatches(target, offer.toolchain).length === 0)) {
+			ranked.push({
+				index,
+				score: Number.POSITIVE_INFINITY,
+				load: 0
+			});
+			candidates.push({
+				machine,
+				code: "artifact-hit",
+				msg: "has the exact completed artifact"
+			});
+			return;
+		}
+		if (cacheOnly) return skip(machine, "artifact-miss", "no matching completed artifact");
+		const problems = offerProblems(offer, target);
+		if (problems.length) return skip(machine, problemCode(problems[0]), problems.map((problem) => problem.reason).join("; "), problems.map((problem) => problem.code));
+		const load = offer.capacity.loadPerCore;
+		if (selected === "auto" && localEnabled && mode === "auto" && !slotsFull) {
+			if (typeof load !== "number") return skip(machine, "load", "capacity unknown (older stim-server) while this machine has a free slot");
+			if (load >= here.loadPerCore) return skip(machine, "load", `no less loaded (load ${load}/core there, ${here.loadPerCore}/core here)`);
+		}
+		const score = Number(offer.warm.dependencies);
+		ranked.push({
+			index,
+			score,
+			load: typeof load === "number" ? load : Number.POSITIVE_INFINITY
+		});
+		candidates.push({
+			machine,
+			code: "accepted",
+			msg: typeof load === "number" ? `can take the build (load ${load}/core there)` : "can take the build"
+		});
+	});
+	ranked.sort((a, b) => b.score - a.score || a.load - b.load);
+	return {
+		order: ranked.map((each) => each.index),
+		reasons,
+		candidates
+	};
+}
+function problemCode({ code }) {
+	return code === "disk" || code === "busy" || code === "unreachable" ? code : code === "runtime" ? "no-matching-device" : "version-mismatch";
+}
+function closeOnExit(socket, context) {
+	if (!context) return;
+	const state = operationState(context);
+	if (!state.takesSignals) return;
+	const close = () => socket.close(1e3);
+	const unregister = () => state.exitCleanups.delete(close);
+	state.exitCleanups.add(close);
+	socket.once("close", unregister);
+	return unregister;
+}
+/**
+* One authenticated connection to another machine's stim-server, for build offload or device hosting. Closing it cancels
+* its build jobs there; a connection that drops, or that stays silent for `SILENT_MS` after `watch()`, leaves them
+* running for a while so a new connection can `build.attach` to them.
+*/
+var BuildConnection = class BuildConnection {
+	nextId = 2;
+	pending = /* @__PURE__ */ new Map();
+	writeWaiters = /* @__PURE__ */ new Set();
+	progress = null;
+	binary = null;
+	closed = null;
+	heard = Date.now();
+	watched = false;
+	ended = false;
+	keepalive;
+	socket;
+	features;
+	context;
+	unregisterExitCleanup;
+	constructor(socket, features, context) {
+		this.socket = socket;
+		this.features = features;
+		this.context = context;
+		this.unregisterExitCleanup = closeOnExit(socket, context);
+		this.keepalive = setInterval(() => {
+			if (this.watched && Date.now() - this.heard > SILENT_MS) return void socket.terminate();
+			socket.ping();
+		}, PING_MS);
+		this.keepalive.unref();
+		socket.on("pong", () => this.heard = Date.now());
+		socket.on("message", (data, isBinary) => {
+			this.heard = Date.now();
+			const frame = Buffer.isBuffer(data) ? data : Buffer.concat(Array.isArray(data) ? data : [Buffer.from(data)]);
+			if (isBinary) return this.binary?.(frame);
+			let message;
+			try {
+				message = JSON.parse(frame.toString("utf8"));
+			} catch {
+				return;
+			}
+			if (!isJsonObject(message)) return;
+			if (message.event === "build.progress") return this.progress?.(message);
+			const resolve = typeof message.id === "number" ? this.pending.get(message.id) : void 0;
+			if (resolve) {
+				this.pending.delete(message.id);
+				resolve(message);
+			}
+		});
+		socket.on("close", (code, reason) => {
+			clearInterval(this.keepalive);
+			this.closed = `the connection closed (${code}${reason.length ? ` ${reason.toString()}` : ""})`;
+			for (const wake of this.writeWaiters) wake();
+			for (const resolve of this.pending.values()) resolve({ error: {
+				code: "closed",
+				message: this.closed
+			} });
+			this.pending.clear();
+			const dropped = code === CLOSE_ABNORMAL;
+			this.progress?.({
+				job: "",
+				outcome: {
+					ok: false,
+					code: dropped ? "dropped" : "closed",
+					message: this.closed
+				}
+			});
+		});
+		socket.on("error", () => {});
+	}
+	/** Resolves why it could not connect; `refused` when the machine answered and turned this machine away. */
+	static async open(target, serverKey, timeoutMs, capability = "build", signal) {
+		const context = ambientContext();
+		const started = performance.now();
+		const result = await BuildConnection.connect(target, serverKey, timeoutMs, capability, signal, context);
+		const ms = Math.round(performance.now() - started);
+		debugLog.log("remote_connect", {
+			host: target.host,
+			capability,
+			ms,
+			timeoutMs,
+			...result instanceof BuildConnection ? { ok: true } : {
+				ok: false,
+				failure: result.failure,
+				code: result.code
+			}
+		});
+		if (!(result instanceof BuildConnection)) reportRemoteFailure(context, "remote_connect_failed", {
+			host: target.host,
+			capability,
+			ms,
+			timeoutMs,
+			msg: result.failure,
+			code: result.code
+		});
+		return result;
+	}
+	static async connect(target, serverKey, timeoutMs, capability, signal, context) {
+		const started = Date.now();
+		const socket = await openAuthenticated(target, {
+			access: capability,
+			serverKey
+		}, timeoutMs, signal, context);
+		if (!("send" in socket)) return socket;
+		const reply = await sayHello(socket, {
+			client: {
+				name: "stim",
+				version: "1",
+				runId: runId()
+			},
+			access: capability
+		}, Math.max(1, timeoutMs - (Date.now() - started)));
+		if ("error" in reply) {
+			socket.terminate();
+			return {
+				failure: reply.error.message,
+				refused: TURNED_AWAY.has(reply.error.code),
+				code: reply.error.code
+			};
+		}
+		const capabilities = reply.result.capabilities;
+		if (!Array.isArray(capabilities) || !capabilities.includes(capability)) {
+			socket.terminate();
+			return {
+				failure: `it has not granted this machine ${capability === "build" ? "build" : "hosting"} access`,
+				refused: true,
+				code: "forbidden"
+			};
+		}
+		const features = reply.result.features;
+		return new BuildConnection(socket, Array.isArray(features) ? features.filter((each) => typeof each === "string") : [], context);
+	}
+	supports(feature) {
+		return this.features.includes(feature);
+	}
+	request(method, params, timeoutMs = REQUEST_TIMEOUT_MS) {
+		if (this.closed) return Promise.resolve({ error: {
+			code: "closed",
+			message: this.closed
+		} });
+		const id = this.nextId++;
+		const started = performance.now();
+		const done = (reply) => {
+			const ms = Math.round(performance.now() - started);
+			debugLog.log("remote_request", {
+				method,
+				ms,
+				..."error" in reply ? {
+					ok: false,
+					code: reply.error.code
+				} : { ok: true }
+			});
+			if ("error" in reply) reportRemoteFailure(this.context, "remote_request_failed", {
+				method,
+				ms,
+				code: reply.error.code,
+				msg: reply.error.message
+			});
+			return reply;
+		};
+		return new Promise((resolve) => {
+			const timer = setTimeout(() => {
+				this.pending.delete(id);
+				resolve(done({ error: {
+					code: "timeout",
+					message: `${method} got no reply in ${timeoutMs / 1e3} s`
+				} }));
+			}, timeoutMs);
+			this.pending.set(id, (reply) => {
+				clearTimeout(timer);
+				resolve(done(reply));
+			});
+			this.socket.send(JSON.stringify({
+				id,
+				method,
+				params
+			}));
+		});
+	}
+	async sendBinary(frame) {
+		if (this.closed) return;
+		let completed = false;
+		let resume;
+		this.socket.send(frame, { binary: true }, () => {
+			completed = true;
+			resume?.();
+		});
+		if (completed || this.closed || this.socket.bufferedAmount <= MAX_BUFFERED) return;
+		await new Promise((resolve) => {
+			const wake = () => {
+				this.writeWaiters.delete(wake);
+				resolve();
+			};
+			resume = wake;
+			this.writeWaiters.add(wake);
+		});
+	}
+	onProgress(listener) {
+		this.progress = listener;
+	}
+	onBinary(listener) {
+		this.binary = listener;
+	}
+	get failure() {
+		return this.closed;
+	}
+	/**
+	* Treats `SILENT_MS` without a frame as a dropped connection from now on. Only while waiting on a job: a long
+	* upload or this process hashing the checkout can delay pongs without anything being wrong.
+	*/
+	watch() {
+		this.heard = Date.now();
+		this.watched = true;
+	}
+	/** Closes with a close frame, which tells the machine to cancel this connection's jobs. */
+	close() {
+		if (this.ended) return;
+		this.forget();
+		if (this.socket.readyState === WebSocket.CLOSED) return;
+		const timer = setTimeout(() => this.socket.terminate(), CLOSE_TIMEOUT_MS);
+		this.socket.once("close", () => clearTimeout(timer));
+		this.socket.close(1e3);
+	}
+	/** Ends the connection without a close frame, which leaves its jobs on the machine for a new connection. */
+	drop() {
+		if (this.ended) return;
+		this.forget();
+		this.socket.terminate();
+	}
+	forget() {
+		this.ended = true;
+		this.closed ??= "the connection was closed by this client";
+		for (const wake of this.writeWaiters) wake();
+		for (const resolve of this.pending.values()) resolve({ error: {
+			code: "closed",
+			message: this.closed
+		} });
+		this.pending.clear();
+		this.progress = null;
+		this.binary = null;
+		clearInterval(this.keepalive);
+		this.socket.removeAllListeners("close");
+		this.unregisterExitCleanup?.();
+	}
+};
+function replyError(reply) {
+	return "error" in reply ? `${reply.error.code}: ${reply.error.message}` : null;
+}
+/** The repository on the remote machine: one area per git common dir, shared by all its worktrees. */
+function repoIdentity(projectRoot) {
+	const repoRoot = realpathSync(git(projectRoot, ["rev-parse", "--show-toplevel"]));
+	return repositoryIdentity(projectRoot, repoRoot, realpathSync(git(repoRoot, [
+		"rev-parse",
+		"--path-format=absolute",
+		"--git-common-dir"
+	])));
+}
+function repositoryIdentity(projectRoot, repoRoot, common) {
+	const digest = createHash("sha256").update(common).digest("hex").slice(0, 12);
+	const name = (basename(dirname(common)) || "repo").replace(/[^A-Za-z0-9._-]/g, "_").replace(/^[^A-Za-z0-9]+/, "");
+	const lock = [
+		"pnpm-lock.yaml",
+		"yarn.lock",
+		"package-lock.json"
+	].find((file) => existsSync(join(repoRoot, file)));
+	return {
+		repoRoot,
+		project: relative(repoRoot, realpathSync(projectRoot)),
+		repo: `${name.slice(0, 60) || "repo"}-${digest}`,
+		lockfile: lock ? createHash("sha256").update(readFileSync(join(repoRoot, lock))).digest("hex") : null
+	};
+}
+function dependencySelection(identity, target) {
+	if (!identity.lockfile || target.platform === "macos" || target.native) return void 0;
+	return {
+		project: identity.project.split(sep).join("/"),
+		packageName: packageName(join(identity.repoRoot, identity.project))
+	};
+}
+/** Why the native inputs cannot be sent to a remote machine, such as an ignored file among them, or null when they can. */
+async function nativeTransferRefusal(repoRoot, snapshot, signal) {
+	try {
+		checkNativeTransferMembership(snapshot, await gitVisiblePaths(repoRoot, signal));
+		return null;
+	} catch (error) {
+		signal?.throwIfAborted();
+		return error.message.split("\n")[0];
+	}
+}
+async function blobContent(repoRoot, file, signal) {
+	const absolute = join(repoRoot, file.path);
+	return file.kind === "directory" ? Buffer.alloc(0) : file.kind === "link" ? Buffer.from(await readlink(absolute)) : await readFile(absolute, { signal });
+}
+/** Closes every connection the choice still holds. */
+function closeOffload(choice) {
+	choice.connection.close();
+	for (const each of choice.runnersUp.splice(0)) each.connection.close();
+}
+const NATIVE_BUILD_FEATURE = {
+	xcode: "native-xcode-build",
+	gradle: "native-gradle-build"
+};
+const unsupportedNative = (provider) => `This worker does not support native ${provider === "xcode" ? "Xcode" : "Gradle"} builds.`;
+const ANDROID_PACKAGE = /^[A-Za-z_][\w]*(?:\.[A-Za-z_][\w]*)+$/;
+function nativeTransferInput(native) {
+	return native?.provider === "xcode" ? native.snapshot : native?.transfer;
+}
+/** Connects to one paired machine and asks it for an offer; the caller closes the connection it returns. */
+async function probeMachine(credential, identity, { connectMs = CONNECT_TIMEOUT_MS, offerMs = OFFER_TIMEOUT_MS } = {}) {
+	const target = await resolveEndpoint(credential, void 0, reportSignal(ambientContext()));
+	if (typeof target === "string") return {
+		credential,
+		failure: target
+	};
+	const connection = await BuildConnection.open(target, credential.serverKey, connectMs, "build", reportSignal(ambientContext()));
+	if (!(connection instanceof BuildConnection)) return {
+		credential,
+		failure: connection.failure
+	};
+	if (identity.native && !connection.supports(NATIVE_BUILD_FEATURE[identity.native])) {
+		connection.close();
+		return {
+			credential,
+			failure: unsupportedNative(identity.native)
+		};
+	}
+	const native = identity.native === "gradle" || identity.native && connection.supports("native-xcode-toolchain") ? identity.native : void 0;
+	const reply = await connection.request("build.offer", {
+		repo: identity.repo,
+		...identity.lockfile ? { lockfile: identity.lockfile } : {},
+		...identity.dependencies && connection.supports("build-dependency-cache") ? { dependencies: identity.dependencies } : {},
+		...native ? { native } : identity.rubyVersion ? { rubyVersion: identity.rubyVersion } : {},
+		...native === "xcode" && identity.artifact && connection.supports("build-artifact-cache") ? { artifact: identity.artifact } : {},
+		...identity.swiftpmArtifact && connection.supports("swiftpm-peer-cache") ? { swiftpmArtifact: identity.swiftpmArtifact } : {},
+		...identity.reactNativeArtifact && connection.supports("react-native-peer-cache") ? { reactNativeArtifact: identity.reactNativeArtifact } : {},
+		...native === "gradle" && identity.gradleArtifact && connection.supports("native-gradle-peer-cache") ? { gradleArtifact: identity.gradleArtifact } : {}
+	}, offerMs);
+	const failure = replyError(reply);
+	if (failure || !("result" in reply)) {
+		connection.close();
+		return {
+			credential,
+			failure: failure ?? "no offer"
+		};
+	}
+	const reported = reply.result;
+	const offer = {
+		...reported,
+		warm: {
+			...reported.warm,
+			dependencies: identity.dependencies !== void 0 && connection.supports("build-dependency-cache") && reported.warm.dependencies
+		}
+	};
+	return {
+		credential,
+		connection,
+		offer: identity.swiftpmArtifact && !connection.supports("swiftpm-peer-cache") || identity.reactNativeArtifact && !connection.supports("react-native-peer-cache") || native === "gradle" && (!identity.gradleArtifact || !connection.supports("native-gradle-peer-cache")) ? {
+			...offer,
+			artifact: null
+		} : offer
+	};
+}
+/**
+* Asks every paired machine for an offer in parallel and keeps the connection to the one `pickOffer` chooses, or
+* returns why none takes the build. A named selection probes only its credential and skips auto load gating.
+*/
+async function chooseBuildMachine({ projectRoot, target, mode, here, note, machines = pairedMachines(), selected = "auto", onCandidates, artifact, gradleArtifact, reactNativeArtifact, swiftpmArtifact, cacheOnly = false }) {
+	const started = Date.now();
+	let identity;
+	try {
+		identity = repoIdentity(projectRoot);
+	} catch (error) {
+		return `this app is not in a git checkout (${error.message.split("\n")[0]})`;
+	}
+	if (namedBuildMachine(selected)) machines = machines.filter((each) => each.machine === selected).slice(0, 1);
+	else machines = machines.filter((each) => automaticMachineEnabled("build", each.machine));
+	const rubyVersion = readRubyVersion(projectRoot) ?? void 0;
+	const gradleQuery = gradleArtifact ? {
+		...gradleArtifact,
+		project: identity.project
+	} : void 0;
+	const reactNativeQuery = reactNativeArtifact ? reactNativeBuildQuery(reactNativeArtifact.request, reactNativeArtifact.fingerprint, identity.project, target.local) : null;
+	const swiftpmQuery = swiftpmArtifact?.artifactInputs ? swiftpmArtifactQuery({
+		project: identity.project,
+		sourceDigest: manifestDigest(await sourceManifest(identity.repoRoot, true, runCancellationSignal(ambientContext()) ?? ambientContext()?.signal)),
+		stimBuild: target.local.stimBuild,
+		inputs: swiftpmArtifact.artifactInputs,
+		build: {
+			product: swiftpmArtifact.product,
+			infoPlist: swiftpmArtifact.infoPlist,
+			resources: swiftpmArtifact.resources ?? {},
+			assetCatalog: swiftpmArtifact.assetCatalog ?? null
+		}
+	}) : null;
+	const asked = await Promise.all(machines.map((credential) => probeMachine(credential, {
+		...identity,
+		rubyVersion,
+		dependencies: dependencySelection(identity, target),
+		...target.platform !== "macos" ? { native: target.native } : {},
+		...artifact ? { artifact } : {},
+		...gradleQuery ? { gradleArtifact: gradleQuery } : {},
+		...reactNativeQuery ? { reactNativeArtifact: reactNativeQuery } : {},
+		...swiftpmQuery ? { swiftpmArtifact: swiftpmQuery } : {}
+	})));
+	const { order, reasons, candidates } = pickOffer({
+		localEnabled: selected !== "auto" || automaticMachineEnabled("build", "local"),
+		selected,
+		mode,
+		here,
+		target,
+		artifact: swiftpmQuery ? "swiftpm" : reactNativeQuery ? `react-native-${reactNativeQuery.platform}` : gradleQuery ? "native-gradle" : artifact,
+		cacheOnly,
+		offers: asked.map((each) => ({
+			machine: each.credential.machine,
+			offer: "offer" in each ? each.offer : null,
+			..."failure" in each ? { failure: each.failure } : {}
+		}))
+	});
+	asked.forEach((each, at) => {
+		if (!order.includes(at) && "connection" in each) each.connection.close();
+	});
+	onCandidates?.(candidates);
+	if (order.length === 0) return reasons.length ? reasons.join("; ") : "no remote machine is paired";
+	for (const reason of reasons) note(reason);
+	const [first, ...rest] = order.map((at) => {
+		const pick = asked[at];
+		return {
+			machine: pick.credential.machine,
+			credential: pick.credential,
+			connection: pick.connection,
+			offer: pick.offer
+		};
+	});
+	return {
+		...first,
+		mode,
+		here,
+		target,
+		offerMs: Date.now() - started,
+		identity,
+		runnersUp: rest,
+		automatic: selected === "auto",
+		cacheOnly,
+		...gradleQuery ? { gradleArtifact: gradleQuery } : {},
+		...reactNativeQuery ? { reactNativeArtifact: reactNativeQuery } : {},
+		...swiftpmQuery ? { swiftpmArtifact: swiftpmQuery } : {}
+	};
+}
+function macosBuildParameters(request, peerCache) {
+	return {
+		...request.cacheArtifact === true && peerCache ? { cacheArtifact: true } : {},
+		macos: {
+			...request.artifactInputs && peerCache ? { artifactInputs: request.artifactInputs } : {},
+			product: request.product,
+			infoPlist: request.infoPlist,
+			bundleId: request.bundleId,
+			...request.resources !== void 0 ? { resources: request.resources } : {},
+			...request.assetCatalog !== void 0 ? { assetCatalog: request.assetCatalog } : {}
+		}
+	};
+}
+function validArtifactIdentity(request, fingerprint) {
+	if (request.platform === "macos") return true;
+	return request.native?.provider === "gradle" ? fingerprint === null : typeof fingerprint === "string" && fingerprint.length > 0;
+}
+const ARTIFACT_NAME = {
+	ios: /^[^/]+\.app$/,
+	android: /^[^/]+\.apk$/,
+	macos: /^[^/]+\.app$/
+};
+async function peerArtifact(choice, request, fingerprint) {
+	const swiftpm = choice.swiftpmArtifact;
+	if (swiftpm) {
+		if (request.platform !== "macos" || !isDeepStrictEqual(swiftpm, swiftpmArtifactQuery({
+			...swiftpm,
+			inputs: request.artifactInputs,
+			build: {
+				product: request.product,
+				infoPlist: request.infoPlist,
+				resources: request.resources ?? {},
+				assetCatalog: request.assetCatalog ?? null
+			}
+		}))) throw new Error("The SwiftPM artifact query does not match the build request.");
+		if (!choice.connection.supports("swiftpm-peer-cache") || manifestDigest(await sourceManifest(choice.identity.repoRoot, true, runCancellationSignal(ambientContext()) ?? ambientContext()?.signal)) !== swiftpm.sourceDigest) return null;
+		return matchingArtifact(choice.offer, "swiftpm");
+	}
+	const reactNative = choice.reactNativeArtifact;
+	if (reactNative) {
+		if (typeof fingerprint !== "string" || !isDeepStrictEqual(reactNative, reactNativeBuildQuery(request, fingerprint, choice.identity.project, choice.target.local))) throw new Error("The React Native artifact query does not match the build request.");
+		return choice.connection.supports("react-native-peer-cache") ? matchingArtifact(choice.offer, `react-native-${reactNative.platform}`) : null;
+	}
+	const query = choice.gradleArtifact;
+	if (query) {
+		if (request.platform !== "android" || request.native?.provider !== "gradle" || !request.native.cache?.read || !request.native.cache.remote || query.project !== choice.identity.project || query.sourceDigest !== request.native.transfer.digest || !isDeepStrictEqual(query.inputs, request.native.transfer.declaration) || !isDeepStrictEqual(query.android, request.android)) throw new Error("The Gradle artifact query does not match the build request.");
+		return choice.connection.supports("native-gradle-peer-cache") ? matchingArtifact(choice.offer, "native-gradle") : null;
+	}
+	if (request.platform === "ios" && request.native && typeof fingerprint === "string" && choice.connection.supports("build-artifact-cache")) return matchingArtifact(choice.offer, {
+		fingerprint,
+		cacheKey: request.native.cacheKey
+	});
+	return null;
+}
+/**
+* Reconnects to the machine that runs `job` and takes the job over with `build.attach`, retrying until
+* `RESUME_WINDOW_MS`, shorter than the machine's grace for a dropped connection, has passed. Returns why it
+* could not.
+*/
+async function resumeJob(credential, job, abandoned, signal, native) {
+	const deadline = Date.now() + RESUME_WINDOW_MS;
+	let delay = RESUME_DELAY_MS;
+	let last = "no attempt";
+	while (!abandoned()) {
+		const target = await resolveEndpoint(credential);
+		const connection = typeof target === "string" ? {
+			failure: target,
+			refused: false
+		} : await BuildConnection.open(target, credential.serverKey, CONNECT_TIMEOUT_MS);
+		if (!(connection instanceof BuildConnection)) {
+			if (connection.refused) return `it turned this machine away (${connection.failure})`;
+			last = connection.failure;
+		} else {
+			if (abandoned()) {
+				connection.close();
+				break;
+			}
+			if (native && !connection.supports(NATIVE_BUILD_FEATURE[native])) {
+				connection.close();
+				return unsupportedNative(native);
+			}
+			const early = [];
+			connection.onProgress((event) => early.push(event));
+			const cancel = () => connection.close();
+			signal?.addEventListener("abort", cancel, { once: true });
+			const reply = await connection.request("build.attach", { job }, OFFER_TIMEOUT_MS);
+			signal?.removeEventListener("abort", cancel);
+			if (abandoned()) {
+				connection.close();
+				break;
+			}
+			if ("result" in reply) {
+				const outcome = isJsonObject(reply.result) ? reply.result.outcome : null;
+				return {
+					connection,
+					outcome: isJsonObject(outcome) ? outcome : null,
+					early
+				};
+			}
+			last = replyError(reply);
+			if (reply.error.code !== "closed" && reply.error.code !== "timeout") {
+				connection.close();
+				return `the machine did not hand the build back (${last})`;
+			}
+			connection.drop();
+		}
+		if (abandoned() || Date.now() + delay > deadline) break;
+		await setTimeout$1(delay, void 0, { signal }).catch(() => {});
+		delay = Math.min(delay * 2, RESUME_MAX_DELAY_MS);
+	}
+	return `no connection to it within ${RESUME_WINDOW_MS / 6e4} min (${last})`;
+}
+/** Mirrors the checkout on the machine: the manifest in pages, then every blob it lacks. */
+async function syncSource(connection, identity, onEnter, native, signal) {
+	onEnter("sync");
+	const syncStarted = Date.now();
+	const manifest = native && "declaration" in native ? (await nativeGradleTransfer(join(identity.repoRoot, identity.project), native.declaration, signal)).files : native ? await nativeTransferManifest(identity.repoRoot, native, await sourceManifest(identity.repoRoot, false, signal), signal) : await sourceManifest(identity.repoRoot, false, signal);
+	if (native && "declaration" in native && manifestDigest(manifest) !== native.digest) return { failure: "The native Gradle source changed before upload." };
+	const bySha = new Map(manifest.map((file) => [file.sha256, file]));
+	const missing = [];
+	for (let index = 0; index < manifest.length || index === 0;) {
+		const page = [];
+		let bytes = 0;
+		while (index < manifest.length && (page.length === 0 || bytes < PAGE_BYTES)) {
+			const file = manifest[index++];
+			bytes += Buffer.byteLength(JSON.stringify(file)) + 1;
+			page.push(file);
+		}
+		const done = index >= manifest.length;
+		const reply = await connection.request("build.sync", {
+			repo: identity.repo,
+			files: page,
+			done
+		});
+		const failure = replyError(reply);
+		if (failure || !("result" in reply)) return { failure: `sync: ${failure ?? "no reply"}` };
+		missing.push(...reply.result.missing ?? []);
+		if (done) break;
+	}
+	let uploadedBytes = 0;
+	for (const digest of missing) {
+		const file = bySha.get(digest);
+		if (!file) return { failure: `sync: the machine asked for an unknown blob ${digest}` };
+		const content = await blobContent(identity.repoRoot, file, signal);
+		if (Buffer.from(await webcrypto.subtle.digest("SHA-256", content)).toString("hex") !== digest) return { failure: `sync: ${file.path} changed while syncing` };
+		const header = Buffer.from(digest, "hex");
+		for (let offset = 0; offset < content.length || offset === 0; offset += CHUNK_BYTES) {
+			await connection.sendBinary(Buffer.concat([header, content.subarray(offset, offset + CHUNK_BYTES)]));
+			if (content.length === 0) break;
+		}
+		uploadedBytes += content.length;
+		if (connection.failure) return { failure: `sync: ${connection.failure}` };
+	}
+	return {
+		files: manifest.length,
+		uploaded: missing.length,
+		uploadedBytes,
+		syncMs: Date.now() - syncStarted,
+		digest: manifestDigest(manifest)
+	};
+}
+function stagedArtifactEscapes(stagingDir, artifactPath, hasContents) {
+	if ((hasContents ? [artifactPath, join(artifactPath, "Contents")] : [artifactPath]).some((path) => lstatSync(path, { throwIfNoEntry: false })?.isSymbolicLink())) return true;
+	if (!existsSync(artifactPath)) return false;
+	const inside = relative(realpathSync(stagingDir), realpathSync(artifactPath));
+	return inside === ".." || inside.startsWith(`..${sep}`) || isAbsolute(inside);
+}
+async function fetchArtifact({ connection, method, params, artifact, request, stagingDir, machine, cacheHit, checkCancelled }) {
+	const name = artifact.name;
+	const archive = join(stagingDir, "app.tgz");
+	const fd = openSync(archive, "w");
+	const hash = createHash("sha256");
+	let received = 0;
+	let badFrame = false;
+	connection.onBinary((frame) => {
+		if (frame.length < DIGEST_BYTES || frame.subarray(0, DIGEST_BYTES).toString("hex") !== artifact.sha256) {
+			badFrame = true;
+			return;
+		}
+		const data = frame.subarray(DIGEST_BYTES);
+		if (cacheHit && received + data.length > Number(artifact.size)) {
+			badFrame = true;
+			return;
+		}
+		try {
+			writeSync(fd, data);
+		} catch {
+			badFrame = true;
+			return;
+		}
+		hash.update(data);
+		received += data.length;
+	});
+	const fetched = await connection.request(method, params, 9e5);
+	connection.onBinary(null);
+	closeSync(fd);
+	checkCancelled();
+	const fetchFailure = replyError(fetched);
+	if (fetchFailure || !("result" in fetched) || fetched.result === null) return { failure: `fetch: ${fetchFailure ?? "the cached artifact was removed"}` };
+	const digest = hash.digest("hex");
+	const declared = fetched.result;
+	if (badFrame) return { failure: "fetch: an artifact frame had another digest or could not be written here" };
+	if (digest !== artifact.sha256 || declared.sha256 !== digest || declared.size !== received) return { failure: `fetch: the artifact's sha256 ${digest.slice(0, 12)} does not match ${String(artifact.sha256).slice(0, 12)}` };
+	if (cacheHit) {
+		if ((await getExecutor().runFileAsync("tar", ["-tf", archive], { timeoutMs: 6e5 })).split("\n").filter(Boolean).some((member) => {
+			const clean = member.replace(/^\.\//, "");
+			return !(clean === name || clean.startsWith(`${name}/`)) || clean.split("/").includes("..");
+		})) return { failure: "fetch: the archive contains paths outside its app" };
+	}
+	await getExecutor().runFileAsync("tar", [
+		"-xf",
+		archive,
+		"-C",
+		stagingDir
+	], { timeoutMs: 6e5 });
+	checkCancelled();
+	rmSync(archive, { force: true });
+	const artifactPath = join(stagingDir, name);
+	if (stagedArtifactEscapes(stagingDir, artifactPath, request.platform === "macos")) return { failure: `fetch: ${machine} returned ${name} as or through a symbolic link or outside the staging directory` };
+	if (cacheHit) {
+		const pending = [artifactPath];
+		const root = realpathSync(artifactPath);
+		for (const path of pending) {
+			const stat = lstatSync(path);
+			if (stat.isDirectory()) pending.push(...readdirSync(path).map((entry) => join(path, entry)));
+			else if (stat.isSymbolicLink()) {
+				const inside = relative(root, realpathSync(path));
+				if (inside === ".." || inside.startsWith(`..${sep}`) || isAbsolute(inside)) return { failure: "fetch: an app link resolves outside its bundle" };
+			}
+		}
+	}
+	if (request.platform === "ios" && !existsSync(join(artifactPath, "Info.plist"))) return { failure: `fetch: ${name} has no Info.plist` };
+	if (request.platform === "android" && !(lstatSync(artifactPath, { throwIfNoEntry: false })?.isFile() ?? false)) return { failure: `fetch: ${name} is not a file` };
+	if (request.platform === "macos") {
+		for (const segments of [["Contents", "Info.plist"], [
+			"Contents",
+			"MacOS",
+			request.product
+		]]) if (!lstatSync(join(artifactPath, ...segments), { throwIfNoEntry: false })?.isFile()) return { failure: `fetch: ${name} has no regular ${segments.join("/")}` };
+	}
+	return {
+		artifactPath,
+		digest,
+		received,
+		declared
+	};
+}
+function keepCorruptCacheMessage(failed, result) {
+	return result.code === "STIM_COMPILATION_CACHE_CORRUPT" ? {
+		...failed,
+		compilationCacheCorrupt: String(result.message ?? "")
+	} : failed;
+}
+/**
+* Builds on the chosen machine and brings the `.app` or `.apk` back into `stagingDir`, verified against the
+* sha256 the machine reports. The caller re-fingerprints and stores it.
+*/
+async function offloadBuild(input) {
+	const { choice, expectedFingerprint, request, stagingDir, onPhase, onEnter, onRecord, note } = input;
+	let cacheHit = false;
+	let keepStaging = false;
+	const { identity } = choice;
+	const native = request.platform !== "macos" ? request.native : void 0;
+	let sourceDigest = null;
+	const started = Date.now();
+	const fail = (reason) => {
+		closeOffload(choice);
+		return {
+			ok: false,
+			machine: choice.machine,
+			reason: reason.split("\n")[0].slice(0, 300)
+		};
+	};
+	const signal = runCancellationSignal(ambientContext());
+	const checkCancelled = () => throwIfCancelled(signal, "offloaded build");
+	let settle;
+	let settled = false;
+	const outcome = new Promise((resolve) => {
+		settle = (value) => {
+			settled = true;
+			resolve(value);
+		};
+	});
+	const cancel = () => {
+		settle({
+			ok: false,
+			code: "cancelled"
+		});
+		closeOffload(choice);
+	};
+	signal?.addEventListener("abort", cancel, { once: true });
+	const retryCachedMiss = async (reason) => {
+		checkCancelled();
+		note(`cache: ${choice.machine}: ${reason}`);
+		const next = choice.runnersUp.shift();
+		if (next) {
+			choice.connection.close();
+			Object.assign(choice, next);
+		} else {
+			if (choice.cacheOnly) return fail(reason);
+			choice.connection.close();
+			const probe = await probeMachine(choice.credential, {
+				...identity,
+				dependencies: dependencySelection(identity, choice.target),
+				...native ? { native: native.provider } : {}
+			});
+			if ("failure" in probe) return fail(probe.failure);
+			const placement = pickOffer({
+				mode: choice.mode,
+				here: choice.here,
+				target: choice.target,
+				selected: choice.automatic ? "auto" : choice.machine,
+				localEnabled: !choice.automatic || automaticMachineEnabled("build", "local"),
+				offers: [{
+					machine: choice.machine,
+					offer: probe.offer
+				}]
+			});
+			if (placement.order.length === 0) {
+				probe.connection.close();
+				return fail(placement.reasons.join("; "));
+			}
+			Object.assign(choice, probe, { offer: {
+				...probe.offer,
+				artifact: null
+			} });
+		}
+		const retried = await offloadBuild(input);
+		keepStaging = retried.ok;
+		return retried;
+	};
+	try {
+		checkCancelled();
+		if (!validArtifactIdentity(request, expectedFingerprint)) return fail("The build request has an invalid reusable artifact identity.");
+		if (native?.provider === "xcode" && native.snapshot.hash !== expectedFingerprint) return fail("The native source snapshot does not match the requested artifact identity.");
+		let cached = null;
+		let job = null;
+		let early = [];
+		let resuming = false;
+		const reattach = async (why) => {
+			if (resuming || settled) return;
+			resuming = true;
+			note(`offload: the connection to ${choice.machine} dropped (${why}); reattaching to the build there`);
+			const resumed = await resumeJob(choice.credential, job, () => settled, signal, native?.provider);
+			resuming = false;
+			if (settled) {
+				if (typeof resumed !== "string") resumed.connection.close();
+				return;
+			}
+			if (typeof resumed === "string") return settle({
+				ok: false,
+				code: "closed",
+				message: `${why}; ${resumed}`
+			});
+			choice.connection = resumed.connection;
+			resumed.connection.watch();
+			note(`offload: reattached to the build on ${choice.machine}`);
+			resumed.connection.onProgress(handle);
+			if (resumed.outcome) settle(resumed.outcome);
+			for (const event of resumed.early.splice(0)) handle(event);
+		};
+		const handle = (event) => {
+			if (event.job && event.job !== job) return;
+			if (event.outcome?.code === "dropped" && !event.job && job !== null) {
+				reattach(String(event.outcome.message));
+				return;
+			}
+			if (event.outcome) return settle(event.outcome);
+			if (event.record) onRecord(event.record);
+			if (event.phase && typeof event.msg === "string") {
+				onEnter(event.phase);
+				onPhase(event.phase, event.msg);
+			}
+		};
+		let syncMs = 0;
+		let uploadedBytes = 0;
+		let workerStarted = 0;
+		const moveOn = (why) => {
+			const next = choice.runnersUp.shift();
+			if (!next) return false;
+			note(`placement: ${next.machine} (${choice.machine} could not take the build: ${why})`);
+			choice.connection.close();
+			Object.assign(choice, next);
+			return true;
+		};
+		for (;;) {
+			if (choice.automatic && !automaticMachineEnabled("build", choice.machine)) {
+				const reason = `${choice.machine} is disabled in remote.buildPoolDisabled`;
+				if (moveOn(reason)) continue;
+				return fail(reason);
+			}
+			if (native && !choice.connection.supports(NATIVE_BUILD_FEATURE[native.provider])) {
+				const reason = unsupportedNative(native.provider);
+				if (moveOn(reason)) continue;
+				return fail(reason);
+			}
+			cached = await peerArtifact(choice, request, expectedFingerprint);
+			if (cached) {
+				cacheHit = true;
+				settle({
+					ok: true,
+					artifact: cached,
+					fingerprint: expectedFingerprint,
+					androidPackage: cached.androidPackage
+				});
+				break;
+			}
+			if (choice.cacheOnly) return fail("The exact artifact is no longer available.");
+			const synced = await syncSource(choice.connection, identity, onEnter, nativeTransferInput(native), signal);
+			checkCancelled();
+			if ("failure" in synced) {
+				if (moveOn(synced.failure)) continue;
+				return fail(synced.failure);
+			}
+			({syncMs, uploadedBytes} = synced);
+			sourceDigest = synced.digest;
+			onPhase("sync", `${synced.files} files, uploaded ${synced.uploaded} (${mb(uploadedBytes)}) in ${seconds(syncMs)}`);
+			workerStarted = Date.now();
+			early = [];
+			choice.connection.onProgress((event) => job === null ? early.push(event) : handle(event));
+			if (choice.automatic) requireAutomaticMachine("build", choice.machine);
+			checkCancelled();
+			const reply = await choice.connection.request("build.start", {
+				repo: identity.repo,
+				project: identity.project,
+				platform: request.platform,
+				fingerprint: request.platform === "macos" ? synced.digest : expectedFingerprint,
+				...native ? { native: {
+					provider: native.provider,
+					sourceDigest: synced.digest,
+					...native.provider === "xcode" ? {
+						cacheKey: native.cacheKey,
+						arch: native.arch,
+						parameters: native.snapshot.parameters
+					} : {
+						inputs: native.transfer.declaration,
+						...choice.connection.supports("native-gradle-artifact-cache") ? { cache: native.cache } : {}
+					}
+				} } : {},
+				...request.platform === "macos" ? macosBuildParameters(request, choice.connection.supports("swiftpm-peer-cache")) : {
+					configuration: request.platform === "ios" ? request.configuration : null,
+					scheme: request.platform === "ios" ? request.scheme : null,
+					iosProjectPath: request.platform === "ios" ? request.iosProjectPath ?? null : null,
+					runtime: request.platform === "ios" ? request.runtime : null,
+					packageName: packageName(join(identity.repoRoot, identity.project)),
+					isExpo: request.isExpo,
+					...!native && request.cacheArtifact === true && choice.connection.supports("react-native-peer-cache") ? { cacheArtifact: true } : {},
+					optimizations: request.platform === "ios" && isJsonObject(request.optimizations) ? request.optimizations : null,
+					...request.platform === "android" ? { android: request.android } : {}
+				},
+				stimBuild: choice.target.local.stimBuild
+			});
+			checkCancelled();
+			if ("result" in reply) {
+				job = reply.result.job;
+				break;
+			}
+			const refused = `start: ${replyError(reply)}`;
+			if (reply.error.code === "bad-request" || !moveOn(refused)) return fail(refused);
+		}
+		if (!cacheHit) for (const each of choice.runnersUp.splice(0)) each.connection.close();
+		choice.connection.watch();
+		for (const event of early.splice(0)) handle(event);
+		const timer = setTimeout(() => settle({
+			ok: false,
+			code: "timeout",
+			message: "the build did not finish in time"
+		}), JOB_TIMEOUT_MS);
+		const result = await outcome;
+		clearTimeout(timer);
+		checkCancelled();
+		const { connection, machine } = choice;
+		connection.onProgress(null);
+		const workerMs = cacheHit ? 0 : Date.now() - workerStarted;
+		if (result.ok !== true) return keepCorruptCacheMessage(fail(`${String(result.code ?? "failed")}: ${String(result.message ?? "")}`), result);
+		if (!cacheHit && native && (result.sourceDigest !== sourceDigest || result.fingerprint !== expectedFingerprint)) return fail("The worker returned a different native source or artifact identity.");
+		if (native?.provider === "gradle" && !ANDROID_PACKAGE.test(String(result.androidPackage ?? ""))) return fail("The worker returned no verified native APK package.");
+		const artifact = result.artifact;
+		const name = typeof artifact?.name === "string" ? artifact.name : "";
+		if (!ARTIFACT_NAME[request.platform].test(name) || typeof artifact.sha256 !== "string") return fail(`the machine reported no .${request.platform === "android" ? "apk" : "app"} artifact`);
+		onEnter("fetch");
+		checkCancelled();
+		const fetchStarted = Date.now();
+		rmSync(stagingDir, {
+			recursive: true,
+			force: true
+		});
+		mkdirSync(stagingDir, { recursive: true });
+		const downloaded = await fetchArtifact({
+			connection,
+			artifact: {
+				name,
+				size: artifact.size,
+				sha256: artifact.sha256
+			},
+			request,
+			stagingDir,
+			machine,
+			cacheHit,
+			checkCancelled,
+			method: cacheHit ? "build.cached-artifact" : "build.artifact",
+			params: cached ? {
+				repo: identity.repo,
+				artifact: {
+					fingerprint: cached.fingerprint,
+					cacheKey: cached.cacheKey
+				},
+				...choice.gradleArtifact ? { gradleArtifact: choice.gradleArtifact } : {},
+				...choice.reactNativeArtifact ? { reactNativeArtifact: choice.reactNativeArtifact } : {},
+				...choice.swiftpmArtifact ? { swiftpmArtifact: choice.swiftpmArtifact } : {}
+			} : { job }
+		});
+		if ("failure" in downloaded) return cacheHit ? await retryCachedMiss(downloaded.failure) : fail(downloaded.failure);
+		if (cacheHit && choice.swiftpmArtifact && !await peerArtifact(choice, request, expectedFingerprint)) return await retryCachedMiss("The SwiftPM source changed during artifact transfer.");
+		const { artifactPath, digest, received, declared } = downloaded;
+		const fetchMs = Date.now() - fetchStarted;
+		closeOffload(choice);
+		keepStaging = true;
+		return {
+			ok: true,
+			...cacheHit ? { cacheHit: true } : {},
+			machine,
+			artifactPath,
+			...typeof declared.handoff === "string" && /^[0-9a-f]{64}$/.test(declared.handoff) ? { handoff: {
+				serverKey: choice.credential.serverKey,
+				token: declared.handoff,
+				sha256: digest
+			} } : {},
+			...offloadCacheActivity(request.platform, result.compilationCache, cacheHit),
+			...native?.provider === "gradle" ? { androidPackage: result.androidPackage } : {},
+			timings: {
+				offerMs: choice.offerMs,
+				syncMs,
+				workerMs,
+				fetchMs,
+				totalMs: Date.now() - started + choice.offerMs,
+				worker: isJsonObject(result.timings) ? result.timings : {},
+				uploadedBytes,
+				artifactBytes: received
+			}
+		};
+	} catch (error) {
+		checkCancelled();
+		const reason = error.message.split("\n")[0] ?? String(error);
+		return cacheHit ? await retryCachedMiss(reason) : fail(reason);
+	} finally {
+		signal?.removeEventListener("abort", cancel);
+		if (!keepStaging) rmSync(stagingDir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function offloadCacheActivity(platform, activity, cacheHit) {
+	if (cacheHit) return {
+		compilationCache: COMPILATION_CACHE_NOT_RUN,
+		ccache: CCACHE_NOT_RUN
+	};
+	return {
+		compilationCache: platform === "ios" ? compilationActivity(activity) : COMPILATION_CACHE_UNAVAILABLE,
+		ccache: platform === "android" ? ccacheActivity(activity) : CCACHE_UNAVAILABLE
+	};
+}
+function packageName(projectRoot) {
+	try {
+		const name = JSON.parse(readFileSync(join(projectRoot, "package.json"), "utf8")).name;
+		return typeof name === "string" ? name : null;
+	} catch {
+		return null;
+	}
+}
+const numberOrNull = (field) => typeof field === "number" ? field : null;
+function compilationActivity(value) {
+	if (!isJsonObject(value) || value.status !== "reported") return COMPILATION_CACHE_UNAVAILABLE;
+	return {
+		status: "reported",
+		hits: numberOrNull(value.hits),
+		cacheableTasks: numberOrNull(value.cacheableTasks),
+		hitRatePercent: numberOrNull(value.hitRatePercent)
+	};
+}
+function ccacheActivity(value) {
+	if (!isJsonObject(value) || value.status !== "reported") return CCACHE_UNAVAILABLE;
+	return {
+		status: "reported",
+		hits: numberOrNull(value.hits),
+		misses: numberOrNull(value.misses),
+		hitRatePercent: numberOrNull(value.hitRatePercent)
+	};
+}
+const mb = (bytes) => `${(bytes / 1024 ** 2).toFixed(1)} MB`;
+const seconds = (ms) => `${(ms / 1e3).toFixed(1)}s`;
+function simulatorRuntime(udid) {
+	try {
+		const listed = JSON.parse(getExecutor().runFileQuiet("xcrun", [
+			"simctl",
+			"list",
+			"devices",
+			"-j"
+		], { timeoutMs: 2e4 }) ?? "{}");
+		for (const [runtime, devices] of Object.entries(listed.devices ?? {})) if (devices.some((device) => device.udid === udid)) return runtime;
+	} catch {}
+	return null;
+}
+/**
+* Every reason a machine's offer would not take this app's builds, judged for each of `targets`. A target the machine
+* cannot build at all, such as iOS on Linux, is left out while it can build another of them. With several targets, a
+* reason only one platform has names it.
+*/
+function machineProblems(offer, targets) {
+	const judged = targets.map((target) => ({
+		target,
+		found: offerProblems(offer, target)
+	}));
+	const buildable = judged.filter(({ found }) => !found.some((problem) => problem.code === "platform"));
+	const problems = [];
+	for (const { target, found } of buildable.length ? buildable : judged) for (const problem of found) {
+		const labeled = targets.length > 1 && !SHARED_PROBLEMS.has(problem.code) ? {
+			...problem,
+			reason: `${PLATFORM_LABEL[target.platform]}: ${problem.reason}`
+		} : problem;
+		if (!problems.some((each) => each.code === labeled.code && each.reason === labeled.reason)) problems.push(labeled);
+	}
+	return problems;
+}
+const DOCTOR_CONNECT_MS = 5e3;
+const DOCTOR_OFFER_MS = 8e3;
+const PLATFORM_LABEL = {
+	ios: "iOS",
+	android: "Android",
+	macos: "macOS"
+};
+const SHARED_PROBLEMS = /* @__PURE__ */ new Set([
+	"stim-build",
+	"disk",
+	"busy"
+]);
+/**
+* Doctor's offload check for `projectRoot`: one bounded offer per machine, judged by `machineProblems` for the builds
+* `targets` returns. No build runs.
+*/
+function offloadCheck(projectRoot, targets) {
+	let identity;
+	const readIdentity = async () => {
+		try {
+			const repoRoot = realpathSync(await gitAsync(projectRoot, ["rev-parse", "--show-toplevel"]));
+			return repositoryIdentity(projectRoot, repoRoot, realpathSync(await gitAsync(repoRoot, [
+				"rev-parse",
+				"--path-format=absolute",
+				"--git-common-dir"
+			])));
+		} catch (error) {
+			reportSignal(ambientContext())?.throwIfAborted();
+			return error instanceof Error ? error.message.split("\n")[0] ?? "git failed" : "git failed";
+		}
+	};
+	let resolved = null;
+	return async (credential) => {
+		const repository = await (identity ??= readIdentity());
+		if (typeof repository === "string") return {
+			capacity: null,
+			problems: [{
+				code: "checkout",
+				reason: `this app is not in a git checkout (${repository})`
+			}]
+		};
+		const probe = await probeMachine(credential, {
+			...repository,
+			rubyVersion: readRubyVersion(projectRoot) ?? void 0
+		}, {
+			connectMs: DOCTOR_CONNECT_MS,
+			offerMs: DOCTOR_OFFER_MS
+		});
+		if ("failure" in probe) return {
+			capacity: null,
+			problems: [{
+				code: "unreachable",
+				reason: probe.failure
+			}]
+		};
+		probe.connection.close();
+		resolved ??= targets();
+		return {
+			capacity: probe.offer.capacity,
+			problems: machineProblems(probe.offer, await resolved)
+		};
+	};
+}
+//#endregion
+export { clearCorruptCompilationCache as _, nativeTransferRefusal as a, offloadPlacement as c, simulatorRuntime as d, reactNativeArtifactReceipt as f, COMPILATION_CACHE_CORRUPT as g, setRemoteLogSink as h, closeOffload as i, placementLoad as l, reactNativeBuildQuery as m, buildPlacementCandidates as n, offloadBuild as o, reactNativeArtifactToolchain as p, chooseBuildMachine as r, offloadCheck as s, BuildConnection as t, remotePhaseText as u, maintenanceLogger as v };