stim 1.20.2 → 1.22.0

package/dist/{launch-C3qJ6Agb.mjs → launch-BjxemNpK.mjs}

@@ -1,510 +1,50 @@
-import { B as deviceSlotKey, E as upsertProject, p as getProject, u as getConcurrencyLimits, v as recordIosSchemeApprovals, z as deviceSlotFileKey } from "./config-BYDxlMY3.mjs";
-import { t as getExecutor } from "./exec-DqKo9GKJ.mjs";
-import { t as spawnEntry } from "./spawn-entry-Dcb7sDUz.mjs";
-import { Dt as repoRoot, Ft as makeTemporaryDirectory, It as removeTemporaryEntry, W as resolveCacheProviderConfig, Z as settingOriginScope, et as settingsLayers, ht as gitCommonDir, ot as detectProviders, q as resolveSettings } from "./settings-B717odTD.mjs";
-import { D as fingerprintProject, N as resolveBuild, P as storeBuild, R as untrackedNativeFiles, _ as waitForBuild, g as releaseBuildLock, m as acquireBuildLock } from "./device-lease-BX1sJQ2E.mjs";
-import { c as writeWorkspaceState, r as readWorkspaceState, w as workspaceLogsDir } from "./workspace-state-DJt_MMvf.mjs";
-import { _ as stepTimer, c as launchErrorReport, i as formatDuration, l as phaseLine, n as appReadinessMessage, v as launchErrorPreview } from "./command-output-BTy8hZ0F.mjs";
-import { I as workspaceDevServerMode, R as writeWorkspaceLaunch, _ as detectIsExpo, d as projectRegistry, r as findProjectRoot } from "./project-_phNIJfs.mjs";
-import { a as workspaceLinks } from "./stim-desktop-BzBN2Em2.mjs";
-import { d as signalProcessTree, s as pidExists, u as resolveProjectMetro } from "./metro-DnCEjCxs.mjs";
-import { F as acquireBuildSlot, L as releaseBuildSlot } from "./workspaces-C36s2jb9.mjs";
-import { Ft as recordRunStats, Nt as recordCapacityRefusal, jt as readRunEstimates, t as budgetGate } from "./budget-f7516Zk0.mjs";
-import { t as cancellableSleep } from "./cancellation-C_22VQTH.mjs";
-import { r as createNdjsonWriter } from "./ndjson-GOnbyvso.mjs";
-import { c as loadProjectProvider, f as resolveEasCliBin, i as checkEasAuth, m as uploadRemote, p as resolveRemote } from "./remote-cache-OyOyVIS3.mjs";
-import { c as startDevServer, g as detectBundleId } from "./start-BWqzODpb.mjs";
-import { d as listAllIosSims, m as listIosRuntimes, r as clearIosAppData } from "./ios-RkW4pnQf.mjs";
-import { c as readMetroRecords, f as verifyLaunch, i as RELEASE_VERIFY_WAIT_MS, l as unattributedLaunchLines, n as LAUNCH_FATAL, o as isBundleProof, p as verifyReleaseLaunch, r as LAUNCH_UNVERIFIED, s as readCollectorRecords, t as LAUNCH_BUNDLING, u as unverifiedLaunchLines } from "./launch-verify-B6Q8hZP-.mjs";
-import { C as restartedAppNote, S as launchIosApp, a as IOS_DEV_MENU_OFF_DEFAULTS_PLIST, f as devClientUrl, u as clearOtherUserApps, v as installIosApp, y as iosAppProcess } from "./app-install-BIKtMfPq.mjs";
-import { i as launchOutcomeRecord, n as ensureWorkspaceStorageSafely } from "./native-runtime-k8dTIrbK.mjs";
-import { A as readBundleId, f as podsAreStale, g as runPodInstall, j as resolveScheme, k as readBundleExecutable, p as readPodState } from "./toolchain-DxSsNssu.mjs";
-import { r as checkDeviceCapacity } from "./device-capacity-CBUAcRyQ.mjs";
-import { n as devClientTakesDevMenuParams, t as devClientScheme } from "./dev-client-DAWVIGBu.mjs";
-import { a as discoverXcodeProject, r as buildIos } from "./react-native-build-CtCccJtb.mjs";
-import { a as acquireRunLease, c as lostRefusal, d as runLease, s as lostLine, t as DEBUG_VERIFY_STEP_MS, u as releaseLeaseOnSignal } from "./device-lease-run-Cw2M4z51.mjs";
-import { n as readHostedIos, o as writeHostedIos } from "./ios-state-CBLe1xYw.mjs";
-import { o as checkEasFallback, s as automaticDevicePlacement } from "./build-plan-B7SZsc2N.mjs";
-import { n as nativeRunCommand, r as siblingPlatformSlots, t as launchSlotScope } from "./slot-launch-DPt0m9Nd.mjs";
-import { D as gateMetroOrigin, E as readRemoteSimulatorArch, a as ensureMetroReachable, l as remoteIosDeps, o as ensureRemoteBootOwned, r as bundleEntryPoint, u as resolveRemoteContext } from "./device-remote-xRT0Vmo9.mjs";
-import { a as resolveEasDevelopmentBuild } from "./eas-build-JyfqyHfC.mjs";
-import { n as verifyCollectorOwnership } from "./ownership-DCtw_2IA.mjs";
-import { n as ensureBooted, o as warmMetro, r as ensureOwnedDevice } from "./device-BECOiufl.mjs";
-import { n as clearIosAdoptionPending } from "./device-ios-COSi6oS1.mjs";
-import { t as selectFromPool } from "./device-pool-Bf-pOhSw.mjs";
-import { a as printNativeCrashReport, n as IOS_CRASH_REPORT_RETRY, o as simulatorConsolePaths, r as captureNativeCrashes, t as errorDiagnostics } from "./error-diagnostics-BR677IDM.mjs";
-import { r as runPrebuild, t as planPrebuild } from "./prebuild-DYbucPXy.mjs";
-import { i as deviceLabel, o as deviceShortName, t as appNameFromPath } from "./support-CwjbFs9H.mjs";
-import { o as reportIosResult } from "./ios-project-K9hY_Jab.mjs";
-import { n as prepareHostedIos, t as placeHostedIos } from "./hosted-ios-l-o3iM9J.mjs";
-import { c as isWirelessIosDevice, i as iosDeviceProcess, l as listIosDevices, n as installIosDeviceApp, p as verifyIosDeviceReleaseLaunch, r as iosDeviceBounds, t as awaitIosDeviceLaunch, u as localNetworkPending } from "./ios-device-D7pi2Sca.mjs";
-import { i as swapJsBundle } from "./js-swap-Bb3nsS07.mjs";
-import { existsSync, mkdirSync, mkdtempSync, openSync, rmSync, writeFileSync } from "node:fs";
+import { t as getExecutor } from "./exec-DEoAhcze.mjs";
+import { m as workspaceLogsDir } from "./paths-DQtTgsBf.mjs";
+import { B as deviceSlotFileKey, E as upsertProject, V as deviceSlotKey, p as getProject, u as getConcurrencyLimits, v as recordIosSchemeApprovals } from "./config-DlrsduwG.mjs";
+import { _ as stepTimer, c as launchErrorReport, i as formatDuration, l as phaseLine, n as appReadinessMessage, v as launchErrorPreview } from "./command-output-gwpm28fu.mjs";
+import { u as cancellableSleep } from "./operation-exec-BW0em61G.mjs";
+import { d as writeWorkspaceState, r as readWorkspaceState } from "./workspace-state-U08dEzhG.mjs";
+import { $ as settingOriginScope, G as resolveCacheProviderConfig, Ht as makeTemporaryDirectory, Nt as repoRootAsync, Ut as removeTemporaryEntry, Y as resolveSettings, ct as detectProviders, nt as settingsLayers, vt as gitCommonDirAsync } from "./settings-C7O8A6ZI.mjs";
+import { L as workspaceDevServerMode, f as projectRegistry, i as findProjectRoot, v as detectIsExpo, z as writeWorkspaceLaunch } from "./project-wM_XFTvE.mjs";
+import { r as createNdjsonWriter } from "./ndjson-CgE_o3Dl.mjs";
+import { c as pidExists, d as resolveProjectMetro, f as signalProcessTree } from "./metro-DiXtA3Ty.mjs";
+import { $t as readCollectorRecords, Bn as checkEasAuth, Bt as ensureMetroReachable, En as restartedAppNote, Gt as resolveRemoteContext, J as recordRunStats, Jn as resolveRemote, Jt as LAUNCH_FATAL, K as recordCapacityRefusal, Mn as readRemoteSimulatorArch, Nn as gateMetroOrigin, Qt as isBundleProof, Rt as bundleEntryPoint, Sn as iosAppProcess, Tn as launchIosApp, Un as loadProjectProvider, Vt as ensureRemoteBootOwned, W as readRunEstimates, Wt as remoteIosDeps, Xt as RELEASE_VERIFY_WAIT_MS, Yn as uploadRemote, Yt as LAUNCH_UNVERIFIED, an as verifyReleaseLaunch, en as readMetroRecords, hn as devClientUrl, in as verifyLaunch, mn as clearOtherUserApps, nn as unverifiedLaunchLines, qn as resolveEasCliBin, qt as LAUNCH_BUNDLING, t as budgetGate, tn as unattributedLaunchLines, un as IOS_DEV_MENU_OFF_DEFAULTS_PLIST, xn as installIosApp } from "./budget-Cvwn54qV.mjs";
+import { I as acquireBuildSlot, R as releaseBuildSlot } from "./workspaces-CpANmBlq.mjs";
+import { F as waitForBuild, M as acquireBuildLock, P as releaseBuildLock } from "./activity-CMLmzp7o.mjs";
+import { b as untrackedNativeFiles, g as storeBuild, h as resolveBuild, l as fingerprintProject } from "./build-cache-Dv7RN200.mjs";
+import { d as listAllIosSims, h as listIosRuntimesAsync, r as clearIosAppData } from "./ios-hcBpnEGk.mjs";
+import { o as workspaceLinks } from "./stim-desktop-D5OGpYZM.mjs";
+import { f as readBundleExecutable, m as resolveScheme, p as readBundleId } from "./xcode-BXn9-xYx.mjs";
+import { h as readPodState, m as podsAreStale, v as runPodInstall } from "./toolchain-DpJMHq0n.mjs";
+import { n as readHostedIos, o as writeHostedIos } from "./ios-state-Dtw5K2aI.mjs";
+import { n as prepareHostedIos, t as placeHostedIos } from "./hosted-ios-CsCS21hn.mjs";
+import { n as verifyCollectorOwnership } from "./ownership-C5fo5Edb.mjs";
+import { n as nativeRunCommand, r as siblingPlatformSlots, t as launchSlotScope } from "./slot-launch-CbfmNgM6.mjs";
+import { c as startDevServer, g as detectBundleId } from "./start-EojN4WFz.mjs";
+import { t as spawnEntry } from "./spawn-entry-jw19m8Nl.mjs";
+import { a as discoverXcodeProject, r as buildIos } from "./react-native-build-Dvd8hC21.mjs";
+import { a as acquireRunLease, c as lostRefusal, d as runLease, s as lostLine, t as DEBUG_VERIFY_STEP_MS, u as releaseLeaseOnAbort } from "./device-lease-run-xJPQ_QQG.mjs";
+import { r as checkDeviceCapacity } from "./device-capacity-DK5_EwRS.mjs";
+import { n as clearIosAdoptionPending } from "./device-ios-DoB6KFCO.mjs";
+import { i as deviceLabel, o as deviceShortName, t as appNameFromPath } from "./support-CNioewsd.mjs";
+import { a as sealAppForDevice, r as gateProfileForDevice } from "./ios-signing-BtAffm0A.mjs";
+import { a as resolveEasDevelopmentBuild } from "./eas-build-CwknaQYj.mjs";
+import { a as printNativeCrashReport, n as IOS_CRASH_REPORT_RETRY, o as simulatorConsolePaths, r as captureNativeCrashes, t as errorDiagnostics } from "./error-diagnostics-DBWO2rxE.mjs";
+import { i as launchOutcomeRecord, n as ensureWorkspaceStorageSafely } from "./native-runtime-B7KIafpM.mjs";
+import { i as runPrebuild, n as planPrebuildAsync } from "./prebuild-D4JoEAEs.mjs";
+import { n as devClientTakesDevMenuParams, t as devClientScheme } from "./dev-client-BSDR5h3F.mjs";
+import { n as automaticDevicePlacement, t as checkEasFallback } from "./eas-fallback-CSgAulr5.mjs";
+import { n as ensureBooted, o as warmMetro, r as ensureOwnedDevice } from "./device-B-L3Fbxy.mjs";
+import { t as selectFromPool } from "./device-pool-BMkdsefq.mjs";
+import { o as reportIosResult } from "./ios-project-CZhKODF3.mjs";
+import { c as isWirelessIosDevice, i as iosDeviceProcess, l as listIosDevices, n as installIosDeviceApp, p as verifyIosDeviceReleaseLaunch, r as iosDeviceBounds, t as awaitIosDeviceLaunch, u as localNetworkPending } from "./ios-device--h_-8ENa.mjs";
+import { i as swapJsBundle } from "./js-swap-Bwhh4S7V.mjs";
+import { mkdirSync, openSync, writeFileSync } from "node:fs";
+import { networkInterfaces } from "node:os";
 import { basename, join } from "node:path";
-import { loadCacheProvider } from "@stim-cli/cache";
-import { hostSimulatorArch } from "@stim-cli/core";
-import { X509Certificate } from "node:crypto";
-import { networkInterfaces, tmpdir } from "node:os";
+import { ambientEnv, hostSimulatorArch } from "@stim-cli/core";
 import chalk from "chalk";
-//#region src/engine/ios-profile.ts
-const TAG = /<(\/?)\s*([A-Za-z0-9_]+)(?:\s[^>]*?)?(\/?)>/g;
-const ENTITIES = {
-	amp: "&",
-	lt: "<",
-	gt: ">",
-	quot: "\"",
-	apos: "'"
-};
-var PlistError = class extends Error {};
-function codePoint(value) {
-	if (!Number.isInteger(value) || value < 0 || value > 1114111 || value >= 55296 && value <= 57343) throw new PlistError(`character reference out of range: ${value}`);
-	return String.fromCodePoint(value);
-}
-function decodeEntities(raw) {
-	return raw.replace(/&(#x?[0-9A-Fa-f]+|[a-z]+);/g, (match, body) => {
-		if (body.startsWith("#x") || body.startsWith("#X")) return codePoint(Number.parseInt(body.slice(2), 16));
-		if (body.startsWith("#")) return codePoint(Number.parseInt(body.slice(1), 10));
-		return ENTITIES[body] ?? match;
-	});
-}
-function peekTag(cursor) {
-	TAG.lastIndex = cursor.pos;
-	const match = TAG.exec(cursor.xml);
-	if (!match) return null;
-	return {
-		name: (match[2] ?? "").toLowerCase(),
-		closing: match[1] === "/",
-		selfClosing: match[3] === "/",
-		end: TAG.lastIndex
-	};
-}
-function takeTag(cursor) {
-	const tag = peekTag(cursor);
-	if (tag) cursor.pos = tag.end;
-	return tag;
-}
-function takeText(cursor, name) {
-	const close = cursor.xml.indexOf(`</${name}>`, cursor.pos);
-	if (close < 0) {
-		cursor.pos = cursor.xml.length;
-		return "";
-	}
-	const raw = cursor.xml.slice(cursor.pos, close);
-	cursor.pos = close + name.length + 3;
-	return raw;
-}
-function parseValue(cursor) {
-	const peeked = peekTag(cursor);
-	if (!peeked || peeked.closing) return void 0;
-	const tag = takeTag(cursor);
-	if (tag.selfClosing) {
-		if (tag.name === "true") return true;
-		if (tag.name === "false") return false;
-		if (tag.name === "array") return [];
-		if (tag.name === "dict") return {};
-		return "";
-	}
-	switch (tag.name) {
-		case "plist": return parseValue(cursor);
-		case "dict": {
-			const out = {};
-			for (;;) {
-				const next = peekTag(cursor);
-				if (!next) break;
-				if (next.closing) {
-					cursor.pos = next.end;
-					break;
-				}
-				cursor.pos = next.end;
-				if (next.name !== "key") continue;
-				const key = decodeEntities(next.selfClosing ? "" : takeText(cursor, "key"));
-				const value = parseValue(cursor);
-				if (value !== void 0) out[key] = value;
-			}
-			return out;
-		}
-		case "array": {
-			const out = [];
-			for (;;) {
-				const next = peekTag(cursor);
-				if (!next) break;
-				if (next.closing) {
-					cursor.pos = next.end;
-					break;
-				}
-				const value = parseValue(cursor);
-				if (value === void 0) break;
-				out.push(value);
-			}
-			return out;
-		}
-		case "string":
-		case "key": return decodeEntities(takeText(cursor, tag.name));
-		case "integer": return Number.parseInt(takeText(cursor, "integer").trim(), 10);
-		case "real": return Number.parseFloat(takeText(cursor, "real").trim());
-		case "date": return new Date(takeText(cursor, "date").trim());
-		case "data": return Buffer.from(takeText(cursor, "data").replace(/\s+/g, ""), "base64");
-		case "true":
-			takeText(cursor, "true");
-			return true;
-		case "false":
-			takeText(cursor, "false");
-			return false;
-		default:
-			takeText(cursor, tag.name);
-			return "";
-	}
-}
-function parsePlist(xml) {
-	if (typeof xml !== "string" || xml.trim() === "") return null;
-	const stripped = xml.replace(/<!--[\s\S]*?-->/g, "");
-	const start = stripped.indexOf("<plist");
-	const cursor = {
-		xml: stripped,
-		pos: start < 0 ? 0 : start
-	};
-	try {
-		const value = parseValue(cursor);
-		return value === void 0 ? null : value;
-	} catch {
-		return null;
-	}
-}
-function isDict(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && !Buffer.isBuffer(value) && !(value instanceof Date);
-}
-function stringsOf(value) {
-	if (!Array.isArray(value)) return null;
-	return value.filter((v) => typeof v === "string");
-}
-function parseProvisioningProfilePlist(xml) {
-	const root = parsePlist(xml);
-	if (!isDict(root)) return null;
-	const entitlements = isDict(root.Entitlements ?? null) ? root.Entitlements : {};
-	const teamIdentifier = stringsOf(root.TeamIdentifier);
-	const expiration = root.ExpirationDate;
-	const certificates = Array.isArray(root.DeveloperCertificates) ? root.DeveloperCertificates.filter((v) => Buffer.isBuffer(v)) : [];
-	return {
-		name: typeof root.Name === "string" ? root.Name : null,
-		uuid: typeof root.UUID === "string" ? root.UUID : null,
-		teamIdentifier: teamIdentifier?.[0] ?? null,
-		expirationDate: expiration instanceof Date && !Number.isNaN(expiration.getTime()) ? expiration : null,
-		provisionedDevices: stringsOf(root.ProvisionedDevices),
-		provisionsAllDevices: root.ProvisionsAllDevices === true,
-		getTaskAllow: entitlements["get-task-allow"] === true,
-		certificates
-	};
-}
-function provisioningProfileKind(profile) {
-	if (profile.provisionedDevices) return profile.getTaskAllow ? "development" : "ad hoc";
-	return profile.provisionsAllDevices ? "enterprise" : "App Store";
-}
-function certificateCommonName(der) {
-	if (!Buffer.isBuffer(der) || der.length === 0) return null;
-	let subject;
-	try {
-		subject = new X509Certificate(der).subject;
-	} catch {
-		return null;
-	}
-	for (const part of String(subject).split(/\r?\n/)) {
-		const trimmed = part.trim();
-		if (trimmed.startsWith("CN=")) return trimmed.slice(3).trim() || null;
-	}
-	return /(?:^|,)\s*CN=([^,]+)/.exec(String(subject))?.[1]?.trim() || null;
-}
-const IDENTITY_LINE = /^\s*\d+\)\s+([0-9A-Fa-f]{40})\s+"(.+)"\s*$/;
-function parseSigningIdentities(text) {
-	if (typeof text !== "string") return [];
-	const out = [];
-	for (const line of text.split(/\r?\n/)) {
-		const match = IDENTITY_LINE.exec(line);
-		if (!match) continue;
-		out.push({
-			sha1: match[1].toUpperCase(),
-			name: match[2]
-		});
-	}
-	return out;
-}
-const SIGNING_CODES = {
-	noProfile: "STIM_NO_PROFILE",
-	profileMismatch: "STIM_PROFILE_MISMATCH",
-	noIdentity: "STIM_NO_SIGNING_IDENTITY",
-	codesignFailed: "STIM_CODESIGN_FAILED"
-};
-const XCODE_STEP = "build once from Xcode to install it -- Stim will not, because registering a device or minting a profile changes your Apple Developer account.";
-const KEYCHAIN_REMEDY = "Open Xcode > Settings > Accounts and download your certificates, or unlock the login keychain with `security unlock-keychain`. `security find-identity -v -p codesigning` should list `Apple Development: ...`.";
-function signingConfiguration(input) {
-	return input.configuration ?? "Debug";
-}
-function profileGate(input) {
-	const now = input.now ?? Date.now();
-	if (!input.profilePresent) return {
-		ok: false,
-		code: SIGNING_CODES.noProfile,
-		reason: "The app bundle has no embedded.mobileprovision, so it was built unsigned or for the simulator.",
-		remedy: `Set a team and profile for the target's ${signingConfiguration(input)} configuration in Xcode > Signing & Capabilities, then ${XCODE_STEP}`
-	};
-	if (!input.profile) return {
-		ok: false,
-		code: SIGNING_CODES.noProfile,
-		reason: "`openssl smime` could not decode the app bundle's embedded.mobileprovision.",
-		remedy: `The profile inside the app is corrupt. Delete the build cache entry with \`stim gc --delete\`, then ${XCODE_STEP}`
-	};
-	const profile = input.profile;
-	const named = profile.name ? `"${profile.name}"` : "the embedded profile";
-	if (!profile.expirationDate || profile.expirationDate.getTime() <= now) return {
-		ok: false,
-		code: SIGNING_CODES.profileMismatch,
-		reason: profile.expirationDate ? `The ${provisioningProfileKind(profile)} profile ${named} expired on ${profile.expirationDate.toISOString()}.` : `The ${provisioningProfileKind(profile)} profile ${named} carries no ExpirationDate, so Stim cannot prove it is still valid.`,
-		remedy: `Renew the profile under Signing & Capabilities, then ${XCODE_STEP}`
-	};
-	if (!profile.provisionedDevices) {
-		const kind = provisioningProfileKind(profile);
-		return {
-			ok: false,
-			code: SIGNING_CODES.profileMismatch,
-			reason: `${named} is an ${kind} profile, which carries no ProvisionedDevices list, so Stim cannot prove ${input.udid ?? "the target device"} is admitted.`,
-			remedy: `Local device runs need a development profile. Select one under Signing & Capabilities, then ${XCODE_STEP}`
-		};
-	}
-	const udid = input.udid;
-	if (!udid || !profile.provisionedDevices.some((d) => d.toLowerCase() === udid.toLowerCase())) return {
-		ok: false,
-		code: SIGNING_CODES.profileMismatch,
-		reason: `The ${provisioningProfileKind(profile)} profile ${named} lists ${profile.provisionedDevices.length} device(s) and ${udid ?? "the target device"} is not one of them.`,
-		remedy: `Register ${udid ?? "the device"} at developer.apple.com, regenerate the profile, then ${XCODE_STEP}`
-	};
-	return {
-		ok: true,
-		profile
-	};
-}
-function signingGate(input) {
-	const gated = profileGate(input);
-	if (!gated.ok) return gated;
-	const profile = gated.profile;
-	const named = profile.name ? `"${profile.name}"` : "the embedded profile";
-	const identities = Array.isArray(input.identities) ? input.identities : [];
-	if (identities.length === 0) return {
-		ok: false,
-		code: SIGNING_CODES.noIdentity,
-		reason: "`security find-identity -v -p codesigning` lists no codesigning identity on this machine.",
-		remedy: KEYCHAIN_REMEDY
-	};
-	if (input.pinnedSha1) {
-		const wanted = input.pinnedSha1.trim().toUpperCase();
-		const match = identities.find((i) => i.sha1 === wanted);
-		if (match) return {
-			ok: true,
-			identity: match
-		};
-		return {
-			ok: false,
-			code: SIGNING_CODES.noIdentity,
-			reason: `ios.signingIdentitySha1 is ${wanted}, which is not in the keychain. Available: ${identities.map((i) => `${i.sha1} "${i.name}"`).join(", ")}.`,
-			remedy: KEYCHAIN_REMEDY
-		};
-	}
-	const wantedName = input.pinnedName?.trim() || certificateCommonName(profile.certificates[0] ?? null);
-	if (!wantedName) return {
-		ok: false,
-		code: SIGNING_CODES.noIdentity,
-		reason: `Stim could not read a signing-identity name out of ${named}: its DeveloperCertificates entry has no readable subject CN.`,
-		remedy: "Set ios.signingIdentity in .stim.json to the identity name to re-sign with, or ios.signingIdentitySha1 to its SHA-1 hash."
-	};
-	const matches = identities.filter((i) => i.name === wantedName);
-	if (matches.length === 1) return {
-		ok: true,
-		identity: matches[0]
-	};
-	if (matches.length === 0) return {
-		ok: false,
-		code: SIGNING_CODES.noIdentity,
-		reason: `The app was signed by "${wantedName}", which is not in this machine's keychain. Available: ${identities.map((i) => `"${i.name}"`).join(", ")}.`,
-		remedy: `${KEYCHAIN_REMEDY} Or set ios.signingIdentity in .stim.json to one of the identities listed above.`
-	};
-	return {
-		ok: false,
-		code: SIGNING_CODES.noIdentity,
-		reason: `${matches.length} keychain identities share the name "${wantedName}", so Stim cannot pick one: ${matches.map((i) => i.sha1).join(", ")}.`,
-		remedy: "Set ios.signingIdentitySha1 in .stim.json to the SHA-1 hash of the certificate to sign with."
-	};
-}
-//#endregion
-//#region src/engine/ios-signing.ts
-const EMBEDDED_PROFILE = "embedded.mobileprovision";
-const SIGNING_TIMEOUT_MS = 12e4;
-function lastLines(text, count = 5) {
-	return String(text ?? "").split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.trim() !== "").slice(-count);
-}
-function errorText(error) {
-	const withOutput = error;
-	const stderr = String(withOutput?.stderr ?? "").trim();
-	const stdout = String(withOutput?.stdout ?? "").trim();
-	return stderr || stdout || String(withOutput?.message ?? error);
-}
-function readEmbeddedProfile(appPath, { exec = null } = {}) {
-	const executor = exec || getExecutor();
-	const path = join(appPath, EMBEDDED_PROFILE);
-	if (!existsSync(path)) return {
-		present: false,
-		profile: null
-	};
-	try {
-		return {
-			present: true,
-			profile: parseProvisioningProfilePlist(executor.runFile("/usr/bin/openssl", [
-				"smime",
-				"-verify",
-				"-noverify",
-				"-inform",
-				"DER",
-				"-in",
-				path
-			], { timeoutMs: SIGNING_TIMEOUT_MS }))
-		};
-	} catch {
-		return {
-			present: true,
-			profile: null
-		};
-	}
-}
-function findSigningIdentities({ exec = null } = {}) {
-	const executor = exec || getExecutor();
-	try {
-		return parseSigningIdentities(executor.runFile("security", [
-			"find-identity",
-			"-v",
-			"-p",
-			"codesigning"
-		], { timeoutMs: SIGNING_TIMEOUT_MS }));
-	} catch {
-		return [];
-	}
-}
-function gateProfileForDevice(options) {
-	const read = readEmbeddedProfile(options.appPath, { exec: options.exec ?? null });
-	return profileGate({
-		profilePresent: read.present,
-		profile: read.profile,
-		identities: [],
-		udid: options.udid,
-		configuration: options.configuration ?? null,
-		...options.now === void 0 ? {} : { now: options.now }
-	});
-}
-function gateAppForDevice(options) {
-	const read = readEmbeddedProfile(options.appPath, { exec: options.exec ?? null });
-	return signingGate({
-		profilePresent: read.present,
-		profile: read.profile,
-		identities: read.present ? findSigningIdentities({ exec: options.exec ?? null }) : [],
-		udid: options.udid,
-		configuration: options.configuration ?? null,
-		pinnedName: options.pinnedName ?? null,
-		pinnedSha1: options.pinnedSha1 ?? null,
-		...options.now === void 0 ? {} : { now: options.now }
-	});
-}
-function extractEntitlements(appPath, executor) {
-	try {
-		return String(executor.runFile("codesign", [
-			"-d",
-			"--entitlements",
-			"-",
-			"--xml",
-			appPath
-		], { timeoutMs: SIGNING_TIMEOUT_MS })).trim();
-	} catch {
-		return "";
-	}
-}
-function resealBundle({ appPath, identity, exec = null }) {
-	const executor = exec || getExecutor();
-	const signAs = identity.sha1 || identity.name;
-	let mode = "preserve-metadata";
-	let preserveError = null;
-	try {
-		executor.runFile("codesign", [
-			"--force",
-			"--sign",
-			signAs,
-			"--preserve-metadata=identifier,entitlements,flags,runtime",
-			appPath
-		], { timeoutMs: SIGNING_TIMEOUT_MS });
-	} catch (error) {
-		preserveError = error;
-	}
-	let tempDir = null;
-	if (preserveError) {
-		const entitlements = extractEntitlements(appPath, executor);
-		const args = [
-			"--force",
-			"--sign",
-			signAs
-		];
-		if (entitlements !== "") {
-			tempDir = mkdtempSync(join(tmpdir(), "stim-entitlements-"));
-			const plist = join(tempDir, "entitlements.plist");
-			writeFileSync(plist, `${entitlements}\n`, "utf-8");
-			args.push("--entitlements", plist);
-			mode = "entitlements";
-		} else mode = "no-entitlements";
-		args.push(appPath);
-		try {
-			executor.runFile("codesign", args, { timeoutMs: SIGNING_TIMEOUT_MS });
-		} catch (error) {
-			return {
-				ok: false,
-				code: SIGNING_CODES.codesignFailed,
-				reason: `codesign could not re-seal ${appPath} with "${identity.name}": ${errorText(error)}`,
-				remedy: `Unlock the login keychain (\`security unlock-keychain\`) and confirm exactly one identity matches "${identity.name}".`,
-				lastLines: [...lastLines(errorText(preserveError)), ...lastLines(errorText(error))]
-			};
-		} finally {
-			if (tempDir) rmSync(tempDir, {
-				recursive: true,
-				force: true
-			});
-		}
-	}
-	try {
-		executor.runFile("codesign", [
-			"--verify",
-			"--strict",
-			appPath
-		], { timeoutMs: SIGNING_TIMEOUT_MS });
-	} catch (error) {
-		return {
-			ok: false,
-			code: SIGNING_CODES.codesignFailed,
-			reason: `codesign --verify --strict rejected ${appPath} after re-sealing it with "${identity.name}": ${errorText(error)}`,
-			remedy: "The bundle signed but did not seal. Delete the cached artifact with `stim gc --delete` and build fresh, then retry.",
-			lastLines: lastLines(errorText(error))
-		};
-	}
-	return {
-		ok: true,
-		identity,
-		mode
-	};
-}
-function sealAppForDevice(options) {
-	const gate = gateAppForDevice(options);
-	if (!gate.ok) return {
-		...gate,
-		lastLines: []
-	};
-	return resealBundle({
-		appPath: options.appPath,
-		identity: gate.identity,
-		exec: options.exec ?? null
-	});
-}
-//#endregion
+import { loadCacheProvider } from "@stim-cli/cache";
 //#region src/engine/ios-lan.ts
 const IP_TXT = "ip.txt";
 function chooseLanAddress({ pinned = null, candidates }) {
@@ -694,7 +234,7 @@ async function replaceCollector({ root, slot = "default", udid, bundleId, appNam
 			cwd: root,
 			detached: true,
 			stdio,
-			env: process.env
+			env: ambientEnv()
 		});
 		child?.unref?.();
 	} catch (err) {
@@ -724,8 +264,8 @@ const DEFAULT_DEPS = {
 	resolveSettings,
 	settingsLayers,
 	settingOriginScope,
-	gitCommonDir,
-	repoRoot,
+	gitCommonDir: gitCommonDirAsync,
+	repoRoot: repoRootAsync,
 	detectBundleId,
 	detectIsExpo,
 	devClientScheme,
@@ -736,7 +276,7 @@ const DEFAULT_DEPS = {
 	checkDeviceCapacity,
 	budgetGate,
 	ensureOwnedDevice,
-	listIosRuntimes,
+	listIosRuntimes: listIosRuntimesAsync,
 	listAllIosSims,
 	ensureBooted,
 	resolveRemoteContext,
@@ -768,7 +308,7 @@ const DEFAULT_DEPS = {
 	resolveEasCliBin,
 	resolveRemote,
 	uploadRemote,
-	planPrebuild,
+	planPrebuild: planPrebuildAsync,
 	runPrebuild,
 	readPodState,
 	podsAreStale,
@@ -786,7 +326,7 @@ const DEFAULT_DEPS = {
 	acquireRunLease,
 	runLease,
 	selectFromPool,
-	releaseLeaseOnSignal,
+	releaseLeaseOnAbort,
 	iosDeviceProcess,
 	verifyIosDeviceReleaseLaunch,
 	readBundleId,
@@ -852,7 +392,7 @@ function iosMetroRuntime(prepare) {
 function missingCrashReportHint({ physical, remote, crashed }) {
 	return crashed && !physical && !remote ? `No attributable native crash report captured yet. ${IOS_CRASH_REPORT_RETRY}` : "No attributable native crash report captured. Read `stim logs --source device` for available output.";
 }
-async function verifyIosProcessRun({ root, slot, appPath, d, launched, configuration, phase, note, logsDir, launchedAt, bundleId, udid, physical, appName, remoteDevice, embeddedJavaScript }) {
+async function verifyIosProcessRun({ operation, root, slot, appPath, d, launched, configuration, phase, note, logsDir, launchedAt, bundleId, udid, physical, appName, remoteDevice, embeddedJavaScript }) {
 	const readNativeCrashes = () => remoteDevice ? [] : captureNativeCrashes({
 		root,
 		slot,
@@ -862,12 +402,12 @@ async function verifyIosProcessRun({ root, slot, appPath, d, launched, configura
 		since: launchedAt,
 		appPath,
 		physical
-	}, logsDir);
+	}, logsDir, operation?.signal, operation?.env);
 	const processCheck = physical ? await d.verifyIosDeviceReleaseLaunch({
 		udid,
 		appName: appName ?? bundleId
 	}) : await d.verifyReleaseLaunch({ pid: launched?.pid ?? null });
-	const crashes = readNativeCrashes();
+	const crashes = await readNativeCrashes();
 	if (processCheck?.verified && !crashes.length) {
 		phase("verify", `process alive ${formatDuration(processCheck.waitedMs ?? 0)} after launch (${configuration}: no bundle fetch to observe)`);
 		return { state: true };
@@ -882,7 +422,7 @@ async function verifyIosProcessRun({ root, slot, appPath, d, launched, configura
 	note(chalk.yellow(phaseLine("", `${embeddedJavaScript ? "Release" : "Process"} readiness was not established. Run \`stim logs --errors\` for captured crash reports, or \`stim logs --source device\` for the full device output.`)));
 	return { state: crashes.length || processCheck?.reason === "exited" ? LAUNCH_FATAL : LAUNCH_UNVERIFIED };
 }
-async function verifyIosMetroRun({ root, slot, appPath, d, launched, phase, note, metroCheck, logsDir, launchedAt, metroPort, isExpo, bundleId, udid, scheme, physical, appName, lanAddress, lanOrigin, remoteDevice, metroOrigin, enterActivity }) {
+async function verifyIosMetroRun({ operation, root, slot, appPath, d, launched, phase, note, metroCheck, logsDir, launchedAt, metroPort, isExpo, bundleId, udid, scheme, physical, appName, lanAddress, lanOrigin, remoteDevice, metroOrigin, enterActivity }) {
 	const runCommand = nativeRunCommand("ios", slot, {
 		physical,
 		deviceId: udid
@@ -896,15 +436,15 @@ async function verifyIosMetroRun({ root, slot, appPath, d, launched, phase, note
 		since: launchedAt,
 		appPath,
 		physical
-	}, logsDir);
-	const deviceProcess = () => {
-		const running = d.iosDeviceProcess({
+	}, logsDir, operation?.signal, operation?.env);
+	const deviceProcess = async () => {
+		const running = await d.iosDeviceProcess({
 			udid,
 			appName: appName ?? bundleId
 		});
 		return running.state === "unknown" ? null : running.state === "running";
 	};
-	const siblings = metroCheck ? siblingPlatformSlots(root, "ios", slot) : [];
+	const siblings = metroCheck ? await siblingPlatformSlots(root, "ios", slot) : [];
 	const verification = metroCheck ? await d.verifyLaunch({
 		requireBundleResponse: true,
 		slot: launchSlotScope(root, slot),
@@ -918,16 +458,16 @@ async function verifyIosMetroRun({ root, slot, appPath, d, launched, phase, note
 		platform: "ios",
 		mode: workspaceDevServerMode(root, isExpo),
 		readNativeCrashes,
-		processAlive: remoteDevice ? null : physical ? deviceProcess : () => {
+		processAlive: remoteDevice ? null : physical ? deviceProcess : async () => {
 			if (launched?.pid) return d.pidExists(launched.pid);
-			const running = iosAppProcess(udid, bundleId);
+			const running = await iosAppProcess(udid, bundleId);
 			return running.state === "unknown" ? null : running.state === "running";
 		}
 	}) : {
 		verified: false,
 		skipped: true
 	};
-	const nativeCrashes = verification.errors?.some((record) => record.event === "native_crash") ? [] : readNativeCrashes();
+	const nativeCrashes = verification.errors?.some((record) => record.event === "native_crash") ? [] : await readNativeCrashes();
 	if (nativeCrashes.length) verification.fatal = true;
 	verification.errors = await errorDiagnostics([...verification.errors ?? [], ...nativeCrashes], {
 		root,
@@ -1040,14 +580,14 @@ function reportLaunchErrors(errors, note, root) {
 	for (const line of report.lines) note(chalk.yellow(phaseLine("launch", line)));
 	return report.lines.length > 0;
 }
-function installsOverWifi(d, udid, selectedWireless, note) {
-	const current = d.listIosDevices().find((entry) => entry.udid === udid);
+async function installsOverWifi(d, udid, selectedWireless, note) {
+	const current = (await d.listIosDevices()).find((entry) => entry.udid === udid);
 	const wireless = current ? isWirelessIosDevice(current) : selectedWireless;
 	if (wireless) note(phaseLine("device", `${current?.name ?? udid} is paired over Wi-Fi, so the install and launch go over the network and take longer than over a cable`));
 	return wireless;
 }
-function cleanAdoptedIosApps({ d, udid, bundleId, devClient, phase, note }) {
-	const swept = d.clearOtherUserApps({
+async function cleanAdoptedIosApps({ d, udid, bundleId, devClient, phase, note }) {
+	const swept = await d.clearOtherUserApps({
 		udid,
 		keep: bundleId
 	});
@@ -1055,7 +595,7 @@ function cleanAdoptedIosApps({ d, udid, bundleId, devClient, phase, note }) {
 	if (swept.listed && swept.failed.length === 0) {
 		if (swept.kept && bundleId) {
 			try {
-				d.clearIosAppData(udid, bundleId, { defaultsPlist: devClient ? IOS_DEV_MENU_OFF_DEFAULTS_PLIST : null });
+				await d.clearIosAppData(udid, bundleId, { defaultsPlist: devClient ? IOS_DEV_MENU_OFF_DEFAULTS_PLIST : null });
 			} catch (error) {
 				return `Could not clear the data ${bundleId} kept from the previous workspace: ${String(error?.message || error)}`;
 			}
@@ -1070,12 +610,12 @@ function cleanAdoptedIosApps({ d, udid, bundleId, devClient, phase, note }) {
 function installMayBeProven(adopting, parkedCacheKey, storeKey) {
 	return !adopting || !parkedCacheKey || parkedCacheKey === storeKey;
 }
-function resolveRunBundleId(d, projectBundleId, appPath, bundleId) {
+async function resolveRunBundleId(d, projectBundleId, appPath, bundleId) {
 	if (!appPath || bundleId) return bundleId;
-	return d.readBundleId(appPath) || projectBundleId();
+	return await d.readBundleId(appPath) || await projectBundleId();
 }
-function readRunExecutable(d, appPath, note) {
-	const executable = appPath ? d.readBundleExecutable(appPath) : null;
+async function readRunExecutable(d, appPath, note) {
+	const executable = appPath ? await d.readBundleExecutable(appPath) : null;
 	if (appPath && !executable) note(chalk.dim(`Could not read CFBundleExecutable from ${appPath}; the device log predicate falls back to the .app basename.`));
 	return executable;
 }
@@ -1101,7 +641,7 @@ function launchFailureRemedy(remoteDevice, udid, bundleId, logFile) {
 	if (remoteDevice) return remoteDevice.failureRemedy();
 	return `If the simulator timed out, run \`stim doctor --platform ios\` and resolve any reported host memory pressure before retrying. Otherwise run \`xcrun simctl launch --terminate-running-process --console ${udid} ${bundleId}\` to see what the app reports, and check ${logFile}.`;
 }
-async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devicePlacement, artifact, d, root, slot, json, release, configuration, buildScheme, isExpo, metroCheck, metroPort, logsDir, logFile, device, udid, physical, wireless, lanAddress, lanOriginUrl, remoteDevice, bootPromise, bootDuration, bootPending, fail, phase, note, logWriter, elapsed, startedAt, closeWriter, lease, releaseLease, recordRun, reclaimed, devServer, enterPhase, enterActivity }) {
+async function finishIosRun({ operation, output, projectBundleId, runtime, runtimePreparation, devicePlacement, artifact, d, root, slot, json, release, configuration, buildScheme, isExpo, metroCheck, metroPort, logsDir, logFile, device, udid, physical, wireless, lanAddress, lanOriginUrl, remoteDevice, bootPromise, bootDuration, bootPending, fail, phase, note, logWriter, elapsed, startedAt, closeWriter, lease, releaseLease, recordRun, reclaimed, devServer, enterPhase, enterActivity }) {
 	const { path: appPath, bundleId: initialBundleId, failureFields: buildFailure, cache } = artifact;
 	const { hit: cacheHit, providerName, buildMachine, builtOn, offloadedTo, offloadFallback, readEnabled: useBuildCache, missReason, waitedForBuild, compilation: compilationCache } = cache;
 	const storeHash = cache.identity?.fingerprint ?? null;
@@ -1130,7 +670,7 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 		}
 		return null;
 	};
-	bundleId = resolveRunBundleId(d, projectBundleId, appPath, bundleId);
+	bundleId = await resolveRunBundleId(d, projectBundleId, appPath, bundleId);
 	if (appPath && !bundleId) return fail({
 		code: "STIM_INSTALL_FAILED",
 		message: `Could not read a bundle identifier from the cached app at ${appPath}.`,
@@ -1155,13 +695,13 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 	const scheme = runtime.scheme(root, appPath, d);
 	const devMenuParams = runtime.devMenuParams(root, d);
 	const appName = appNameFromPath(appPath);
-	const appExecutable = readRunExecutable(d, appPath, note);
+	const appExecutable = await readRunExecutable(d, appPath, note);
 	const dropSwapDir = artifact.release;
 	let installSkipped = false;
 	let launched;
 	let launchedAt = d.now();
 	if (physical) {
-		const overWifi = installsOverWifi(d, udid, wireless, note);
+		const overWifi = await installsOverWifi(d, udid, wireless, note);
 		const bounds = iosDeviceBounds(overWifi);
 		const lostBeforeInstall = raiseLeaseFor(bounds.installMs, true);
 		if (lostBeforeInstall) return fail(lostBeforeInstall);
@@ -1171,7 +711,7 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 		});
 		enterPhase("install");
 		const installTimer = stepTimer(d.now);
-		const installed = d.installIosDeviceApp({
+		const installed = await d.installIosDeviceApp({
 			udid,
 			appPath,
 			bundleId,
@@ -1288,7 +828,7 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 	} else {
 		const adopting = Boolean(device?.adoptionPending);
 		if (adopting) {
-			const cleanupFailure = cleanAdoptedIosApps({
+			const cleanupFailure = await cleanAdoptedIosApps({
 				d,
 				udid,
 				bundleId,
@@ -1309,7 +849,7 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 		}
 		enterPhase("install");
 		const installTimer = stepTimer(d.now);
-		const installed = d.installIosApp({
+		const installed = await d.installIosApp({
 			udid,
 			appPath,
 			bundleId,
@@ -1369,7 +909,7 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 				metroPort: port,
 				devClientScheme,
 				devMenuParams: menuParams,
-				consolePaths: simulatorConsolePaths({
+				consolePaths: await simulatorConsolePaths({
 					deviceId: udid,
 					appId: bundleId,
 					since: launchedAt
@@ -1378,7 +918,7 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 		});
 		if ("error" in launched) return fail(launched.error);
 		if (launched.failed) {
-			printNativeCrashReport({
+			await printNativeCrashReport({
 				root,
 				slot,
 				platform: "ios",
@@ -1386,7 +926,7 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 				appId: bundleId,
 				since: launchedAt,
 				appPath
-			}, logsDir, (line) => note(chalk.red(phaseLine("launch", line))), Boolean(remoteDevice));
+			}, logsDir, (line) => note(chalk.red(phaseLine("launch", line))), Boolean(remoteDevice), operation?.signal, operation?.env);
 			return fail({
 				code: launched.code || "STIM_LAUNCH_FAILED",
 				message: launched.reason,
@@ -1428,6 +968,7 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 	});
 	if (physical) raiseLeaseFor(runtime.verificationWaitMs, false);
 	const { state: launchState, warning: launchWarning, unattributed } = await runtime.verify(runtimePreparation, {
+		operation,
 		root,
 		slot,
 		appPath,
@@ -1481,6 +1022,7 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 	const uploadsAbandoned = await artifact.completeUploads();
 	return {
 		facts: reportIosResult({
+			output,
 			devicePlacement,
 			root,
 			slot,
@@ -1519,7 +1061,7 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 			recordRun,
 			reclaimed,
 			devServer,
-			links: workspaceLinks(root, {
+			links: await workspaceLinks(root, {
 				platform: "ios",
 				slot
 			})
@@ -1528,4 +1070,4 @@ async function finishIosRun({ projectBundleId, runtime, runtimePreparation, devi
 	};
 }
 //#endregion
-export { collectorEntry as a, copyAppAside as c, gateProfileForDevice as d, DEFAULT_DEPS as i, lanOriginUrlFor as l, iosMetroRuntime as n, replaceCollector as o, iosProcessRuntime as r, chooseLanAddress as s, finishIosRun as t, writeIpTxt as u };
+export { collectorEntry as a, copyAppAside as c, DEFAULT_DEPS as i, lanOriginUrlFor as l, iosMetroRuntime as n, replaceCollector as o, iosProcessRuntime as r, chooseLanAddress as s, finishIosRun as t, writeIpTxt as u };