stim 1.20.2 → 1.22.0

package/dist/ios-signing-BtAffm0A.mjs

@@ -0,0 +1,489 @@
+import { t as getExecutor } from "./exec-DEoAhcze.mjs";
+import { a as killOnAbort, f as throwIfCancelled, r as childEnvironment } from "./operation-exec-BW0em61G.mjs";
+import { X509Certificate } from "node:crypto";
+import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+//#region src/engine/ios-profile.ts
+const TAG = /<(\/?)\s*([A-Za-z0-9_]+)(?:\s[^>]*?)?(\/?)>/g;
+const ENTITIES = {
+	amp: "&",
+	lt: "<",
+	gt: ">",
+	quot: "\"",
+	apos: "'"
+};
+var PlistError = class extends Error {};
+function codePoint(value) {
+	if (!Number.isInteger(value) || value < 0 || value > 1114111 || value >= 55296 && value <= 57343) throw new PlistError(`character reference out of range: ${value}`);
+	return String.fromCodePoint(value);
+}
+function decodeEntities(raw) {
+	return raw.replace(/&(#x?[0-9A-Fa-f]+|[a-z]+);/g, (match, body) => {
+		if (body.startsWith("#x") || body.startsWith("#X")) return codePoint(Number.parseInt(body.slice(2), 16));
+		if (body.startsWith("#")) return codePoint(Number.parseInt(body.slice(1), 10));
+		return ENTITIES[body] ?? match;
+	});
+}
+function peekTag(cursor) {
+	TAG.lastIndex = cursor.pos;
+	const match = TAG.exec(cursor.xml);
+	if (!match) return null;
+	return {
+		name: (match[2] ?? "").toLowerCase(),
+		closing: match[1] === "/",
+		selfClosing: match[3] === "/",
+		end: TAG.lastIndex
+	};
+}
+function takeTag(cursor) {
+	const tag = peekTag(cursor);
+	if (tag) cursor.pos = tag.end;
+	return tag;
+}
+function takeText(cursor, name) {
+	const close = cursor.xml.indexOf(`</${name}>`, cursor.pos);
+	if (close < 0) {
+		cursor.pos = cursor.xml.length;
+		return "";
+	}
+	const raw = cursor.xml.slice(cursor.pos, close);
+	cursor.pos = close + name.length + 3;
+	return raw;
+}
+function parseValue(cursor) {
+	const peeked = peekTag(cursor);
+	if (!peeked || peeked.closing) return void 0;
+	const tag = takeTag(cursor);
+	if (tag.selfClosing) {
+		if (tag.name === "true") return true;
+		if (tag.name === "false") return false;
+		if (tag.name === "array") return [];
+		if (tag.name === "dict") return {};
+		return "";
+	}
+	switch (tag.name) {
+		case "plist": return parseValue(cursor);
+		case "dict": {
+			const out = {};
+			for (;;) {
+				const next = peekTag(cursor);
+				if (!next) break;
+				if (next.closing) {
+					cursor.pos = next.end;
+					break;
+				}
+				cursor.pos = next.end;
+				if (next.name !== "key") continue;
+				const key = decodeEntities(next.selfClosing ? "" : takeText(cursor, "key"));
+				const value = parseValue(cursor);
+				if (value !== void 0) out[key] = value;
+			}
+			return out;
+		}
+		case "array": {
+			const out = [];
+			for (;;) {
+				const next = peekTag(cursor);
+				if (!next) break;
+				if (next.closing) {
+					cursor.pos = next.end;
+					break;
+				}
+				const value = parseValue(cursor);
+				if (value === void 0) break;
+				out.push(value);
+			}
+			return out;
+		}
+		case "string":
+		case "key": return decodeEntities(takeText(cursor, tag.name));
+		case "integer": return Number.parseInt(takeText(cursor, "integer").trim(), 10);
+		case "real": return Number.parseFloat(takeText(cursor, "real").trim());
+		case "date": return new Date(takeText(cursor, "date").trim());
+		case "data": return Buffer.from(takeText(cursor, "data").replace(/\s+/g, ""), "base64");
+		case "true":
+			takeText(cursor, "true");
+			return true;
+		case "false":
+			takeText(cursor, "false");
+			return false;
+		default:
+			takeText(cursor, tag.name);
+			return "";
+	}
+}
+function parsePlist(xml) {
+	if (typeof xml !== "string" || xml.trim() === "") return null;
+	const stripped = xml.replace(/<!--[\s\S]*?-->/g, "");
+	const start = stripped.indexOf("<plist");
+	const cursor = {
+		xml: stripped,
+		pos: start < 0 ? 0 : start
+	};
+	try {
+		const value = parseValue(cursor);
+		return value === void 0 ? null : value;
+	} catch {
+		return null;
+	}
+}
+function isDict(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && !Buffer.isBuffer(value) && !(value instanceof Date);
+}
+function stringsOf(value) {
+	if (!Array.isArray(value)) return null;
+	return value.filter((v) => typeof v === "string");
+}
+function parseProvisioningProfilePlist(xml) {
+	const root = parsePlist(xml);
+	if (!isDict(root)) return null;
+	const entitlements = isDict(root.Entitlements ?? null) ? root.Entitlements : {};
+	const teamIdentifier = stringsOf(root.TeamIdentifier);
+	const expiration = root.ExpirationDate;
+	const certificates = Array.isArray(root.DeveloperCertificates) ? root.DeveloperCertificates.filter((v) => Buffer.isBuffer(v)) : [];
+	return {
+		name: typeof root.Name === "string" ? root.Name : null,
+		uuid: typeof root.UUID === "string" ? root.UUID : null,
+		teamIdentifier: teamIdentifier?.[0] ?? null,
+		expirationDate: expiration instanceof Date && !Number.isNaN(expiration.getTime()) ? expiration : null,
+		provisionedDevices: stringsOf(root.ProvisionedDevices),
+		provisionsAllDevices: root.ProvisionsAllDevices === true,
+		getTaskAllow: entitlements["get-task-allow"] === true,
+		certificates
+	};
+}
+function provisioningProfileKind(profile) {
+	if (profile.provisionedDevices) return profile.getTaskAllow ? "development" : "ad hoc";
+	return profile.provisionsAllDevices ? "enterprise" : "App Store";
+}
+function certificateCommonName(der) {
+	if (!Buffer.isBuffer(der) || der.length === 0) return null;
+	let subject;
+	try {
+		subject = new X509Certificate(der).subject;
+	} catch {
+		return null;
+	}
+	for (const part of String(subject).split(/\r?\n/)) {
+		const trimmed = part.trim();
+		if (trimmed.startsWith("CN=")) return trimmed.slice(3).trim() || null;
+	}
+	return /(?:^|,)\s*CN=([^,]+)/.exec(String(subject))?.[1]?.trim() || null;
+}
+const IDENTITY_LINE = /^\s*\d+\)\s+([0-9A-Fa-f]{40})\s+"(.+)"\s*$/;
+function parseSigningIdentities(text) {
+	if (typeof text !== "string") return [];
+	const out = [];
+	for (const line of text.split(/\r?\n/)) {
+		const match = IDENTITY_LINE.exec(line);
+		if (!match) continue;
+		out.push({
+			sha1: match[1].toUpperCase(),
+			name: match[2]
+		});
+	}
+	return out;
+}
+const SIGNING_CODES = {
+	noProfile: "STIM_NO_PROFILE",
+	profileMismatch: "STIM_PROFILE_MISMATCH",
+	noIdentity: "STIM_NO_SIGNING_IDENTITY",
+	codesignFailed: "STIM_CODESIGN_FAILED"
+};
+const XCODE_STEP = "run `stim device provision ios`, which asks before it registers the device or creates the profile (agents run it only with the user's go-ahead), or build once from Xcode to install it. A build never does this, because registering a device or minting a profile changes your Apple Developer account.";
+const KEYCHAIN_REMEDY = "Open Xcode > Settings > Accounts and download your certificates, or unlock the login keychain with `security unlock-keychain`. `security find-identity -v -p codesigning` should list `Apple Development: ...`.";
+function signingConfiguration(input) {
+	return input.configuration ?? "Debug";
+}
+function profileGate(input) {
+	const now = input.now ?? Date.now();
+	if (!input.profilePresent) return {
+		ok: false,
+		code: SIGNING_CODES.noProfile,
+		reason: "The app bundle has no embedded.mobileprovision, so it was built unsigned or for the simulator.",
+		remedy: `Set a team and profile for the target's ${signingConfiguration(input)} configuration in Xcode > Signing & Capabilities, then ${XCODE_STEP}`
+	};
+	if (!input.profile) return {
+		ok: false,
+		code: SIGNING_CODES.noProfile,
+		reason: "`openssl smime` could not decode the app bundle's embedded.mobileprovision.",
+		remedy: `The profile inside the app is corrupt. Delete the build cache entry with \`stim gc --delete\`, then ${XCODE_STEP}`
+	};
+	const profile = input.profile;
+	const named = profile.name ? `"${profile.name}"` : "the embedded profile";
+	if (!profile.expirationDate || profile.expirationDate.getTime() <= now) return {
+		ok: false,
+		code: SIGNING_CODES.profileMismatch,
+		reason: profile.expirationDate ? `The ${provisioningProfileKind(profile)} profile ${named} expired on ${profile.expirationDate.toISOString()}.` : `The ${provisioningProfileKind(profile)} profile ${named} carries no ExpirationDate, so Stim cannot prove it is still valid.`,
+		remedy: `Renew the profile under Signing & Capabilities, then ${XCODE_STEP}`
+	};
+	if (!profile.provisionedDevices) {
+		const kind = provisioningProfileKind(profile);
+		return {
+			ok: false,
+			code: SIGNING_CODES.profileMismatch,
+			reason: `${named} is an ${kind} profile, which carries no ProvisionedDevices list, so Stim cannot prove ${input.udid ?? "the target device"} is admitted.`,
+			remedy: `Local device runs need a development profile. Select one under Signing & Capabilities, then ${XCODE_STEP}`
+		};
+	}
+	const udid = input.udid;
+	if (!udid || !profile.provisionedDevices.some((d) => d.toLowerCase() === udid.toLowerCase())) return {
+		ok: false,
+		code: SIGNING_CODES.profileMismatch,
+		reason: `The ${provisioningProfileKind(profile)} profile ${named} lists ${profile.provisionedDevices.length} device(s) and ${udid ?? "the target device"} is not one of them.`,
+		remedy: `Run \`stim device provision ios${udid ? ` ${udid}` : ""}\`, which asks before it registers the device and refreshes the profile (agents run it only with the user's go-ahead), or register it at developer.apple.com, regenerate the profile and build once from Xcode. A build never does this, because registering a device or minting a profile changes your Apple Developer account.`
+	};
+	return {
+		ok: true,
+		profile
+	};
+}
+function signingGate(input) {
+	const gated = profileGate(input);
+	if (!gated.ok) return gated;
+	const profile = gated.profile;
+	const named = profile.name ? `"${profile.name}"` : "the embedded profile";
+	const identities = Array.isArray(input.identities) ? input.identities : [];
+	if (identities.length === 0) return {
+		ok: false,
+		code: SIGNING_CODES.noIdentity,
+		reason: "`security find-identity -v -p codesigning` lists no codesigning identity on this machine.",
+		remedy: KEYCHAIN_REMEDY
+	};
+	if (input.pinnedSha1) {
+		const wanted = input.pinnedSha1.trim().toUpperCase();
+		const match = identities.find((i) => i.sha1 === wanted);
+		if (match) return {
+			ok: true,
+			identity: match
+		};
+		return {
+			ok: false,
+			code: SIGNING_CODES.noIdentity,
+			reason: `ios.signingIdentitySha1 is ${wanted}, which is not in the keychain. Available: ${identities.map((i) => `${i.sha1} "${i.name}"`).join(", ")}.`,
+			remedy: KEYCHAIN_REMEDY
+		};
+	}
+	const wantedName = input.pinnedName?.trim() || certificateCommonName(profile.certificates[0] ?? null);
+	if (!wantedName) return {
+		ok: false,
+		code: SIGNING_CODES.noIdentity,
+		reason: `Stim could not read a signing-identity name out of ${named}: its DeveloperCertificates entry has no readable subject CN.`,
+		remedy: "Set ios.signingIdentity in .stim.json to the identity name to re-sign with, or ios.signingIdentitySha1 to its SHA-1 hash."
+	};
+	const matches = identities.filter((i) => i.name === wantedName);
+	if (matches.length === 1) return {
+		ok: true,
+		identity: matches[0]
+	};
+	if (matches.length === 0) return {
+		ok: false,
+		code: SIGNING_CODES.noIdentity,
+		reason: `The app was signed by "${wantedName}", which is not in this machine's keychain. Available: ${identities.map((i) => `"${i.name}"`).join(", ")}.`,
+		remedy: `${KEYCHAIN_REMEDY} Or set ios.signingIdentity in .stim.json to one of the identities listed above.`
+	};
+	return {
+		ok: false,
+		code: SIGNING_CODES.noIdentity,
+		reason: `${matches.length} keychain identities share the name "${wantedName}", so Stim cannot pick one: ${matches.map((i) => i.sha1).join(", ")}.`,
+		remedy: "Set ios.signingIdentitySha1 in .stim.json to the SHA-1 hash of the certificate to sign with."
+	};
+}
+//#endregion
+//#region src/engine/ios-signing.ts
+const EMBEDDED_PROFILE = "embedded.mobileprovision";
+const SIGNING_TIMEOUT_MS = 12e4;
+function lastLines(text, count = 5) {
+	return String(text ?? "").split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.trim() !== "").slice(-count);
+}
+function errorText(error) {
+	const withOutput = error;
+	const stderr = String(withOutput?.stderr ?? "").trim();
+	const stdout = String(withOutput?.stdout ?? "").trim();
+	return stderr || stdout || String(withOutput?.message ?? error);
+}
+async function signingCommand(file, args, { exec, env, signal }) {
+	throwIfCancelled(signal, "iOS signing");
+	try {
+		const output = await (exec || getExecutor()).runFileAsync(file, args, {
+			timeoutMs: SIGNING_TIMEOUT_MS,
+			...env ? childEnvironment(env) : {},
+			onSpawn: killOnAbort(signal)
+		});
+		throwIfCancelled(signal, "iOS signing");
+		return output;
+	} catch (error) {
+		throwIfCancelled(signal, "iOS signing");
+		throw error;
+	}
+}
+async function readEmbeddedProfile(appPath, options = {}) {
+	throwIfCancelled(options.signal, "iOS signing");
+	const path = join(appPath, EMBEDDED_PROFILE);
+	if (!existsSync(path)) return {
+		present: false,
+		profile: null
+	};
+	const plist = await decodeProvisioningProfile(path, options);
+	return {
+		present: true,
+		profile: plist === null ? null : parseProvisioningProfilePlist(plist)
+	};
+}
+async function decodeProvisioningProfile(path, options = {}) {
+	try {
+		return await signingCommand("/usr/bin/openssl", [
+			"smime",
+			"-verify",
+			"-noverify",
+			"-inform",
+			"DER",
+			"-in",
+			path
+		], options);
+	} catch {
+		throwIfCancelled(options.signal, "iOS signing");
+		return null;
+	}
+}
+async function findSigningIdentities(options = {}) {
+	return await probeSigningIdentities(options) ?? [];
+}
+/** The keychain's code signing identities, or null when `security find-identity` itself failed. */
+async function probeSigningIdentities(options = {}) {
+	try {
+		return parseSigningIdentities(await signingCommand("security", [
+			"find-identity",
+			"-v",
+			"-p",
+			"codesigning"
+		], options));
+	} catch {
+		throwIfCancelled(options.signal, "iOS signing");
+		return null;
+	}
+}
+async function gateProfileForDevice(options) {
+	const read = await readEmbeddedProfile(options.appPath, options);
+	return profileGate({
+		profilePresent: read.present,
+		profile: read.profile,
+		identities: [],
+		udid: options.udid,
+		configuration: options.configuration ?? null,
+		...options.now === void 0 ? {} : { now: options.now }
+	});
+}
+async function gateAppForDevice(options) {
+	const read = await readEmbeddedProfile(options.appPath, options);
+	return signingGate({
+		profilePresent: read.present,
+		profile: read.profile,
+		identities: read.present ? await findSigningIdentities(options) : [],
+		udid: options.udid,
+		configuration: options.configuration ?? null,
+		pinnedName: options.pinnedName ?? null,
+		pinnedSha1: options.pinnedSha1 ?? null,
+		...options.now === void 0 ? {} : { now: options.now }
+	});
+}
+async function extractEntitlements(appPath, options) {
+	try {
+		return String(await signingCommand("codesign", [
+			"-d",
+			"--entitlements",
+			"-",
+			"--xml",
+			appPath
+		], options)).trim();
+	} catch {
+		throwIfCancelled(options.signal, "iOS signing");
+		return "";
+	}
+}
+async function resealBundle({ appPath, identity, ...options }) {
+	const signAs = identity.sha1 || identity.name;
+	let mode = "preserve-metadata";
+	let preserveError = null;
+	try {
+		await signingCommand("codesign", [
+			"--force",
+			"--sign",
+			signAs,
+			"--preserve-metadata=identifier,entitlements,flags,runtime",
+			appPath
+		], options);
+	} catch (error) {
+		throwIfCancelled(options.signal, "iOS signing");
+		preserveError = error;
+	}
+	let tempDir = null;
+	if (preserveError) {
+		const entitlements = await extractEntitlements(appPath, options);
+		const args = [
+			"--force",
+			"--sign",
+			signAs
+		];
+		if (entitlements !== "") {
+			tempDir = mkdtempSync(join(tmpdir(), "stim-entitlements-"));
+			const plist = join(tempDir, "entitlements.plist");
+			writeFileSync(plist, `${entitlements}\n`, "utf-8");
+			args.push("--entitlements", plist);
+			mode = "entitlements";
+		} else mode = "no-entitlements";
+		args.push(appPath);
+		try {
+			await signingCommand("codesign", args, options);
+		} catch (error) {
+			throwIfCancelled(options.signal, "iOS signing");
+			return {
+				ok: false,
+				code: SIGNING_CODES.codesignFailed,
+				reason: `codesign could not re-seal ${appPath} with "${identity.name}": ${errorText(error)}`,
+				remedy: `Unlock the login keychain (\`security unlock-keychain\`) and confirm exactly one identity matches "${identity.name}".`,
+				lastLines: [...lastLines(errorText(preserveError)), ...lastLines(errorText(error))]
+			};
+		} finally {
+			if (tempDir) rmSync(tempDir, {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	try {
+		await signingCommand("codesign", [
+			"--verify",
+			"--strict",
+			appPath
+		], options);
+	} catch (error) {
+		throwIfCancelled(options.signal, "iOS signing");
+		return {
+			ok: false,
+			code: SIGNING_CODES.codesignFailed,
+			reason: `codesign --verify --strict rejected ${appPath} after re-sealing it with "${identity.name}": ${errorText(error)}`,
+			remedy: "The bundle signed but did not seal. Delete the cached artifact with `stim gc --delete` and build fresh, then retry.",
+			lastLines: lastLines(errorText(error))
+		};
+	}
+	return {
+		ok: true,
+		identity,
+		mode
+	};
+}
+async function sealAppForDevice(options) {
+	const gate = await gateAppForDevice(options);
+	if (!gate.ok) return {
+		...gate,
+		lastLines: []
+	};
+	return resealBundle({
+		...options,
+		identity: gate.identity
+	});
+}
+//#endregion
+export { sealAppForDevice as a, probeSigningIdentities as i, findSigningIdentities as n, parsePlist as o, gateProfileForDevice as r, parseProvisioningProfilePlist as s, decodeProvisioningProfile as t };

package/dist/{ios-state-CBLe1xYw.mjs → ios-state-Dtw5K2aI.mjs}

@@ -1,4 +1,4 @@
-import { a as updateWorkspaceState, r as readWorkspaceState$1 } from "./workspace-state-DJt_MMvf.mjs";
+import { o as updateWorkspaceState, r as readWorkspaceState$1 } from "./workspace-state-U08dEzhG.mjs";
 import { HOSTED_METRO_REQUESTS_KEY, hostedMetroRequests, hostedNativeRecords, isJsonObject, parseHostedNativePlacement, unreadableHostedNative } from "@stim-cli/core/state";
 //#region src/device-host/ios-state.ts
 function readHostedNative(root, platform, slot) {

package/dist/{ios-nOLJGVdy.mjs → ios-xtlRHaeB.mjs}

@@ -1,4 +1,4 @@
-import { t as getExecutor } from "./exec-DqKo9GKJ.mjs";
+import { t as getExecutor } from "./exec-DEoAhcze.mjs";
 //#region src/collector/ios.ts
 const MESSAGE_TYPE_LEVEL = {
 	Debug: "debug",

package/dist/{js-swap-Bb3nsS07.mjs → js-swap-Bwhh4S7V.mjs}

@@ -1,11 +1,13 @@
-import { t as getExecutor } from "./exec-DqKo9GKJ.mjs";
-import { Ft as makeTemporaryDirectory, It as removeTemporaryEntry } from "./settings-B717odTD.mjs";
+import { d as spawnDeclared, m as operationState, t as getExecutor } from "./exec-DEoAhcze.mjs";
 import { r as waitForChild, t as createLineReader } from "./process-output-Fpl8PYi8.mjs";
-import { t as cleanLine } from "./server-expo-DsguMGUF.mjs";
-import { M as startBuildHeartbeat, P as tailLines, y as HEARTBEAT_INTERVAL_MS } from "./toolchain-DxSsNssu.mjs";
+import { a as killOnAbort, f as throwIfCancelled, t as runOperationFile } from "./operation-exec-BW0em61G.mjs";
+import { Ht as makeTemporaryDirectory, Ut as removeTemporaryEntry } from "./settings-C7O8A6ZI.mjs";
+import { Xn as bundleInvocation } from "./budget-Cvwn54qV.mjs";
+import { t as cleanLine } from "./server-expo-CrjB29pq.mjs";
+import { _ as tailLines, h as startBuildHeartbeat, r as HEARTBEAT_INTERVAL_MS } from "./xcode-BXn9-xYx.mjs";
+import { randomUUID } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { basename, join } from "node:path";
-import { randomUUID } from "node:crypto";
 //#region src/engine/js-swap.ts
 const JS_BUNDLE_NAME = "main.jsbundle";
 const LAST_LINES = 5;
@@ -107,9 +109,9 @@ function assetCatalogTarget(infoPlist) {
 		targetDevices: targetDevices.length ? targetDevices : ["iphone"]
 	};
 }
-function readPlistKey(e, plist, key, format) {
+async function readPlistKey(context, e, plist, key, format) {
 	try {
-		return e.runFile("plutil", [
+		return await runOperationFile(context, e, "plutil", [
 			"-extract",
 			key,
 			format,
@@ -122,14 +124,14 @@ function readPlistKey(e, plist, key, format) {
 		throw err;
 	}
 }
-function readAssetCatalogTarget(e, plist) {
-	const flag = readPlistKey(e, plist, "RCTUseAssetCatalog", "raw");
+async function readAssetCatalogTarget(context, e, plist) {
+	const flag = await readPlistKey(context, e, plist, "RCTUseAssetCatalog", "raw");
 	if (flag === null) return null;
-	const families = readPlistKey(e, plist, "UIDeviceFamily", "json");
+	const families = await readPlistKey(context, e, plist, "UIDeviceFamily", "json");
 	return assetCatalogTarget({
 		RCTUseAssetCatalog: flag,
-		DTPlatformName: readPlistKey(e, plist, "DTPlatformName", "raw"),
-		MinimumOSVersion: readPlistKey(e, plist, "MinimumOSVersion", "raw"),
+		DTPlatformName: await readPlistKey(context, e, plist, "DTPlatformName", "raw"),
+		MinimumOSVersion: await readPlistKey(context, e, plist, "MinimumOSVersion", "raw"),
 		UIDeviceFamily: families === null ? void 0 : JSON.parse(families)
 	});
 }
@@ -206,7 +208,7 @@ function hermescArgs({ bundle, out }) {
 		bundle
 	];
 }
-async function swapJsBundle({ root, iosDir, isExpo, cachedAppPath, logWriter = null, exec = null, spawnFn = null, mkdtemp = () => makeTemporaryDirectory(cachedAppPath, "stim-js-swap-"), exists = existsSync, hermesEnabled = null, now = Date.now, heartbeatMs = HEARTBEAT_INTERVAL_MS, onHeartbeat = (line) => console.error(line) }) {
+async function swapJsBundle({ context, root, iosDir, isExpo, cachedAppPath, logWriter = null, exec = null, spawnFn = null, mkdtemp = () => makeTemporaryDirectory(cachedAppPath, "stim-js-swap-"), exists = existsSync, hermesEnabled = null, now = Date.now, heartbeatMs = HEARTBEAT_INTERVAL_MS, onHeartbeat = (line) => console.error(line) }) {
 	const e = exec || getExecutor();
 	const startedAt = now();
 	const elapsed = () => now() - startedAt;
@@ -232,15 +234,16 @@ async function swapJsBundle({ root, iosDir, isExpo, cachedAppPath, logWriter = n
 		tmp = mkdtemp();
 		appCopy = join(tmp, basename(cachedAppPath));
 		try {
-			e.runFile("cp", [
+			await runOperationFile(context, e, "cp", [
 				"-c",
 				"-R",
 				cachedAppPath,
 				appCopy
 			], { timeoutMs: "unbounded" });
 		} catch {
+			throwIfCancelled(context ? operationState(context).runSignal ?? context.signal : void 0, "JS swap");
 			removeTemporaryEntry(appCopy);
-			e.runFile("cp", [
+			await runOperationFile(context, e, "cp", [
 				"-R",
 				cachedAppPath,
 				appCopy
@@ -252,7 +255,7 @@ async function swapJsBundle({ root, iosDir, isExpo, cachedAppPath, logWriter = n
 	let catalogTarget;
 	const infoPlistPath = join(appCopy, "Info.plist");
 	try {
-		catalogTarget = readAssetCatalogTarget(e, infoPlistPath);
+		catalogTarget = await readAssetCatalogTarget(context, e, infoPlistPath);
 	} catch (err) {
 		return fail("catalog", `could not read ${infoPlistPath}: ${describe(err)}`);
 	}
@@ -299,7 +302,8 @@ async function swapJsBundle({ root, iosDir, isExpo, cachedAppPath, logWriter = n
 	};
 	let child;
 	try {
-		child = spawn(command.file, command.args, {
+		const invocation = bundleInvocation(root, isExpo, command.args.slice(1));
+		child = spawnDeclared(context, () => spawn(invocation.file, invocation.args, {
 			cwd: root,
 			stdio: [
 				"ignore",
@@ -307,10 +311,11 @@ async function swapJsBundle({ root, iosDir, isExpo, cachedAppPath, logWriter = n
 				"pipe"
 			],
 			env: {
-				...process.env,
+				...context?.env ?? process.env,
 				FORCE_COLOR: "0"
 			}
-		});
+		}));
+		killOnAbort(context ? operationState(context).runSignal ?? context.signal : void 0)(child);
 	} catch (err) {
 		return fail("bundle", `could not run ${command.file} ${command.args[0]}: ${describe(err)}`);
 	}
@@ -350,11 +355,11 @@ async function swapJsBundle({ root, iosDir, isExpo, cachedAppPath, logWriter = n
 		else {
 			const hbc = join(tmp, `${JS_BUNDLE_NAME}.hbc`);
 			try {
-				e.runFile(hermesc, hermescArgs({
+				await runOperationFile(context, e, hermesc, hermescArgs({
 					bundle: bundleOutput,
 					out: hbc
 				}), { timeoutMs: "unbounded" });
-				e.runFile("mv", [hbc, bundleOutput], { timeoutMs: 3e4 });
+				await runOperationFile(context, e, "mv", [hbc, bundleOutput], { timeoutMs: 3e4 });
 				hermes = true;
 			} catch (err) {
 				return fail("hermesc", `hermesc failed on ${bundleOutput}: ${describe(err)}`);
@@ -362,8 +367,8 @@ async function swapJsBundle({ root, iosDir, isExpo, cachedAppPath, logWriter = n
 		}
 	}
 	try {
-		e.runFile("cp", [bundleOutput, join(appCopy, JS_BUNDLE_NAME)], { timeoutMs: "unbounded" });
-		e.runFile("cp", [
+		await runOperationFile(context, e, "cp", [bundleOutput, join(appCopy, JS_BUNDLE_NAME)], { timeoutMs: "unbounded" });
+		await runOperationFile(context, e, "cp", [
 			"-R",
 			`${assetsDest}/.`,
 			`${appCopy}/`
@@ -380,7 +385,7 @@ async function swapJsBundle({ root, iosDir, isExpo, cachedAppPath, logWriter = n
 			});
 			if (readdirSync(catalogDir).some((name) => name.endsWith(".imageset"))) {
 				mkdirSync(catalogBundle);
-				const output = e.runFile("xcrun", actoolArgs({
+				const output = await runOperationFile(context, e, "xcrun", actoolArgs({
 					catalog: catalogDir,
 					out: catalogBundle,
 					target: catalogTarget
@@ -400,7 +405,7 @@ async function swapJsBundle({ root, iosDir, isExpo, cachedAppPath, logWriter = n
 		return fail("updates", `could not refresh the expo-updates manifest ${manifest}: ${describe(err)}`);
 	}
 	try {
-		e.runFile("codesign", [
+		await runOperationFile(context, e, "codesign", [
 			"--force",
 			"--sign",
 			"-",