stim 1.20.2 → 1.22.0

package/dist/native-gradle-artifact-inputs-DHFnmrVf.mjs

@@ -0,0 +1,270 @@
+import { t as getExecutor } from "./exec-DEoAhcze.mjs";
+import { r as childEnvironment } from "./operation-exec-BW0em61G.mjs";
+import { n as buildCacheKey } from "./build-cache-Dv7RN200.mjs";
+import { o as androidHome } from "./android-C7sVmyI9.mjs";
+import { n as fingerprintNativeInputs } from "./native-inputs-TRTTTRxt.mjs";
+import { r as nativeGradleLocalSourceDigest, t as gradleOffloadInputs } from "./native-gradle-inputs-Dnh84Zbd.mjs";
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { readFile, readdir, realpath, stat } from "node:fs/promises";
+//#region src/integrations/native-gradle-artifact-inputs.ts
+const NATIVE_GRADLE_CACHE_LIMIT = "Native APK caching requires android.artifactInputs with complete: true and a complete declaration of repeatable pinned inputs. Gradle incremental and task-cache reuse remain available without it.";
+function nativeGradleWorkerScope(sourceDigest, inputs) {
+	return JSON.stringify([sourceDigest, {
+		complete: true,
+		ignored: inputs.ignored,
+		outputs: inputs.outputs
+	}]);
+}
+function nativeGradleWorkerArtifactIdentity(fingerprint, scope, variant, abi) {
+	const hash = createHash("sha256").update(JSON.stringify([
+		"stim-native-gradle-worker-v1",
+		fingerprint,
+		scope
+	])).digest("hex");
+	return {
+		hash,
+		key: buildCacheKey("android", hash, {
+			variant,
+			...abi ? { abi } : {}
+		})
+	};
+}
+function gradleArtifactInputs(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(NATIVE_GRADLE_CACHE_LIMIT);
+	const localFiles = "localFiles" in value ? value.localFiles : [];
+	const environment = "environment" in value ? value.environment : [];
+	if (Object.keys(value).some((key) => ![
+		"complete",
+		"ignored",
+		"outputs",
+		"localFiles",
+		"environment"
+	].includes(key)) || !Array.isArray(localFiles) || !localFiles.every((path) => typeof path === "string" && path.length > 0 && !path.includes("\0")) || !Array.isArray(environment) || !environment.every((name) => typeof name === "string" && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name))) throw new Error(NATIVE_GRADLE_CACHE_LIMIT);
+	let inventory;
+	try {
+		inventory = gradleOffloadInputs({
+			complete: "complete" in value ? value.complete : void 0,
+			ignored: "ignored" in value ? value.ignored : void 0,
+			outputs: "outputs" in value ? value.outputs : void 0
+		});
+	} catch (error) {
+		throw new Error(String(error).replaceAll("android.offloadInputs", "android.artifactInputs"), { cause: error });
+	}
+	return {
+		...inventory,
+		localFiles: [...new Set(localFiles)].toSorted(),
+		environment: [...new Set(environment)].toSorted()
+	};
+}
+async function optionalText(path, signal, encoding = "utf8") {
+	try {
+		return await readFile(path, {
+			encoding,
+			signal
+		});
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+async function javaRelease(env, signal) {
+	let home = env.JAVA_HOME;
+	if (!home) {
+		const java = getExecutor().findExecutable("java");
+		if (java) {
+			const selected = dirname(dirname(await realpath(java)));
+			if ((await optionalText(join(selected, "release"), signal))?.includes("JAVA_VERSION=")) home = selected;
+		}
+	}
+	if (!home && process.platform === "darwin") {
+		const child = childEnvironment(env);
+		home = (await getExecutor().runFileAsync("/usr/libexec/java_home", [], {
+			timeoutMs: 1e4,
+			signal,
+			...child
+		})).trim();
+	}
+	if (!home || !(await optionalText(join(home, "release"), signal))?.includes("JAVA_VERSION=")) throw new Error("The Gradle wrapper JDK release identity is unavailable.");
+	return join(home, "release");
+}
+async function localPropertiesIdentity(properties, sdk, root, signal) {
+	const content = await optionalText(properties, signal, "latin1");
+	if (content === null) return null;
+	const retained = [];
+	let selected = null;
+	for (const [, line = "", ending = ""] of content.matchAll(/([^\r\n]*)(\r\n|\r|\n|$)/g)) {
+		if (/^[ \t\f]*$/.test(line) || /^[ \t\f]*[#!]/.test(line)) {
+			retained.push(line + ending);
+			continue;
+		}
+		if ((line.match(/\\+$/)?.[0].length ?? 0) % 2 !== 0) throw new Error("Native APK caching requires single-line local.properties values.");
+		const entry = /^[ \t\f]*([A-Za-z0-9_.-]+)(?:[ \t\f]*[:=][ \t\f]*|[ \t\f]+)(.*)$/.exec(line);
+		if (!entry) {
+			if (/^[ \t\f]*[A-Za-z0-9_.-]+[ \t\f]*$/.test(line) && line.trim() !== "sdk.dir") {
+				retained.push(line + ending);
+				continue;
+			}
+			throw new Error("Native APK caching requires plain, unescaped local.properties keys.");
+		}
+		if (entry[1] !== "sdk.dir") {
+			retained.push(line + ending);
+			continue;
+		}
+		const value = entry[2] ?? "";
+		if (!value || [...value].some((character) => character.charCodeAt(0) > 127)) throw new Error("Native APK caching cannot resolve the local.properties SDK.");
+		selected = value.replace(/\\u([a-fA-F\d]{4})|\\(.)/g, (full, hex, escaped) => {
+			if (hex) return String.fromCharCode(parseInt(hex, 16));
+			if (escaped === "u") throw new Error("Native APK caching cannot resolve the local.properties SDK.");
+			if (escaped === "t") return "	";
+			if (escaped === "r") return "\r";
+			if (escaped === "n") return "\n";
+			if (escaped === "f") return "\f";
+			return escaped ?? full;
+		});
+	}
+	if (selected !== null && await realpath(resolve(root, selected)) !== sdk) throw new Error("Native APK caching requires the local.properties SDK to match ANDROID_HOME.");
+	return retained.join("");
+}
+async function nativeGradleArtifactSnapshot(root, value, build, abi, env, signal) {
+	signal?.throwIfAborted();
+	const declaration = gradleArtifactInputs(value);
+	const localFiles = declaration.localFiles.map((file) => resolve(root, file));
+	const properties = join(root, "local.properties");
+	const { complete, ignored, outputs } = declaration;
+	return nativeGradleArtifactSnapshotFromReceipt(root, {
+		source: await nativeGradleLocalSourceDigest(root, {
+			complete,
+			ignored,
+			outputs
+		}, [properties, ...localFiles], signal),
+		declaration,
+		build: {
+			variant: build.variant,
+			compilerCache: build.compilerCache,
+			gradleBuildCache: build.gradleBuildCache,
+			pch: build.pch,
+			cas: build.cas
+		},
+		abi
+	}, env, signal);
+}
+/** Revalidates private inputs; the caller must bind the receipt to a verified completed source snapshot. */
+async function nativeGradleArtifactSnapshotFromReceipt(root, receipt, env, signal) {
+	signal?.throwIfAborted();
+	const { build, abi } = receipt;
+	if (!/^[a-f0-9]{64}$/.test(receipt.source)) throw new Error("The completed Gradle source identity is invalid.");
+	const declaration = gradleArtifactInputs(receipt.declaration);
+	const localFiles = declaration.localFiles.map((file) => resolve(root, file));
+	for (const path of localFiles) {
+		const info = await stat(path).catch((error) => {
+			if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+			throw error;
+		});
+		if (info && !info.isFile()) throw new Error("android.artifactInputs.localFiles must name exact regular files.");
+	}
+	const properties = join(root, "local.properties");
+	const sdkDirectory = await realpath(androidHome(env));
+	const home = env.HOME ?? env.USERPROFILE ?? homedir();
+	const gradleHome = env.GRADLE_USER_HOME ?? join(home, ".gradle");
+	const inputs = [{
+		name: "jdk-release",
+		path: await javaRelease(env, signal),
+		optional: false
+	}, ...[
+		"gradle.properties",
+		"init.gradle",
+		"init.gradle.kts",
+		"init.d"
+	].map((name) => ({
+		name: `gradle-user/${name}`,
+		path: join(gradleHome, name),
+		optional: true
+	}))];
+	for (const group of [
+		"build-tools",
+		"platforms",
+		"ndk",
+		"cmake"
+	]) {
+		const directory = join(sdkDirectory, group);
+		const versions = await readdir(directory).catch((error) => {
+			if (error instanceof Error && "code" in error && error.code === "ENOENT") return [];
+			throw error;
+		});
+		for (const version of versions.toSorted()) {
+			if (!(await stat(join(directory, version))).isDirectory()) continue;
+			const path = join(directory, version, "source.properties");
+			if (await optionalText(path, signal) !== null) inputs.push({
+				name: `sdk/${group}/${version}`,
+				path,
+				optional: false
+			});
+		}
+	}
+	if (!inputs.some((input) => input.name.startsWith("sdk/build-tools/"))) throw new Error("Android SDK build-tools version metadata is unavailable.");
+	const preferences = [
+		join(home, ".android"),
+		...env.ANDROID_USER_HOME ? [env.ANDROID_USER_HOME] : [],
+		...[
+			"ANDROID_PREFS_ROOT",
+			"ANDROID_SDK_HOME",
+			"TEST_TMPDIR"
+		].flatMap((name) => env[name] ? [join(env[name], ".android")] : [])
+	];
+	for (const [index, directory] of [...new Set(preferences)].entries()) inputs.push({
+		name: `debug-keystore/${index}`,
+		path: join(directory, "debug.keystore"),
+		optional: true
+	});
+	for (const [index, path] of localFiles.entries()) inputs.push({
+		name: `local/${index}`,
+		path,
+		optional: true
+	});
+	const environment = Object.fromEntries([.../* @__PURE__ */ new Set([
+		...declaration.environment,
+		"JAVA_OPTS",
+		"JAVA_TOOL_OPTIONS",
+		"_JAVA_OPTIONS",
+		"GRADLE_OPTS"
+	])].toSorted().map((name) => [name, env[name] ?? null]));
+	const localProperties = await localPropertiesIdentity(properties, sdkDirectory, root, signal);
+	const local = await fingerprintNativeInputs(inputs, {
+		parameters: {
+			declaration,
+			environment,
+			localProperties: createHash("sha256").update(JSON.stringify(localProperties)).digest("hex")
+		},
+		signal
+	});
+	const hash = createHash("sha256").update("stim-native-gradle-artifact-v1\0").update(JSON.stringify({
+		source: receipt.source,
+		local: local.hash,
+		platform: process.platform,
+		arch: process.arch,
+		variant: build.variant ?? "debug",
+		compilerCache: build.compilerCache,
+		gradleBuildCache: build.gradleBuildCache,
+		pch: build.pch,
+		cas: build.cas,
+		abi
+	})).digest("hex");
+	return {
+		hash,
+		key: buildCacheKey("android", hash, {
+			variant: build.variant ?? "debug",
+			...abi ? { abi } : {}
+		}),
+		sdkDirectory,
+		receipt: {
+			source: receipt.source,
+			declaration,
+			build,
+			abi
+		}
+	};
+}
+//#endregion
+export { nativeGradleWorkerArtifactIdentity as a, nativeGradleArtifactSnapshotFromReceipt as i, gradleArtifactInputs as n, nativeGradleWorkerScope as o, nativeGradleArtifactSnapshot as r, NATIVE_GRADLE_CACHE_LIMIT as t };

package/dist/native-gradle-inputs-Dnh84Zbd.mjs

@@ -0,0 +1,211 @@
+import { s as gitAsync } from "./operation-exec-BW0em61G.mjs";
+import { n as fingerprintNativeInputs, r as manifestDigest } from "./native-inputs-TRTTTRxt.mjs";
+import { a as sourceManifest, i as nativeTransferManifest, r as nativeFileDigest } from "./native-source-Y0yLhFyQ.mjs";
+import { createHash } from "node:crypto";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { access, lstat, readFile, readlink, realpath } from "node:fs/promises";
+//#region src/integrations/native-gradle-inputs.ts
+function containedPath(path) {
+	return typeof path === "string" && path.length > 0 && !path.includes("\\") && !path.includes(":") && !path.includes("\0") && !path.split("/").some((part) => !part || part === "." || part === ".." || part.toLowerCase() === ".git");
+}
+function gradleOffloadInputs(value) {
+	const input = value;
+	if (!input || typeof input !== "object" || input.complete !== true || Object.keys(input).some((key) => ![
+		"complete",
+		"ignored",
+		"outputs"
+	].includes(key)) || !Array.isArray(input.ignored) || !input.ignored.every(containedPath) || !Array.isArray(input.outputs) || !input.outputs.every(containedPath)) throw new Error("Native Gradle offload requires android.offloadInputs with complete: true, ignored: [exact repository-relative files], and outputs: [generated repository-relative directories].");
+	const ignored = [...new Set(input.ignored)].toSorted();
+	const outputs = [...new Set(input.outputs)].toSorted();
+	if (ignored.some((path) => path.split("/").at(-1) === "local.properties")) throw new Error("local.properties is machine-local; remove it from android.offloadInputs.ignored.");
+	if (outputs.some((path) => path.split("/").some((part) => part === ".gradle" || part === ".kotlin"))) throw new Error("Gradle project state is worker-owned and cannot be declared as a generated output.");
+	for (const output of outputs) if (outputs.some((other) => other !== output && output.startsWith(`${other}/`))) throw new Error(`Generated output ${output} is nested inside another output declaration.`);
+	return {
+		complete: true,
+		ignored,
+		outputs
+	};
+}
+const below = (path, directory) => path === directory || path.startsWith(`${directory}/`);
+function gradleStateDirectories(project) {
+	return [".gradle", ".kotlin"].map((name) => project ? `${project}/${name}` : name);
+}
+async function statIfPresent(path) {
+	try {
+		return await lstat(path);
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+		throw error;
+	}
+}
+async function requireRealParents(repository, path, signal) {
+	const parts = path.split("/");
+	for (let index = 1; index < parts.length; index++) {
+		signal?.throwIfAborted();
+		const stat = await statIfPresent(join(repository, ...parts.slice(0, index)));
+		if (stat && !stat.isDirectory()) throw new Error(`Native input ${path} has a non-directory parent.`);
+	}
+}
+async function nativeGradleTransfer(root, value, signal) {
+	return nativeGradleInventory(root, value, [], signal, true);
+}
+async function nativeGradleLocalSourceDigest(root, value, localFiles, signal) {
+	const { project, digest } = await nativeGradleInventory(root, value, localFiles, signal, false);
+	return createHash("sha256").update(JSON.stringify({
+		project,
+		digest
+	})).digest("hex");
+}
+async function nativeGradleInventory(root, value, localFiles, signal, transfer) {
+	signal?.throwIfAborted();
+	const declaration = gradleOffloadInputs(value);
+	const repository = await realpath(await gitAsync(root, ["rev-parse", "--show-toplevel"], { signal }));
+	const realRoot = await realpath(root);
+	const project = relative(repository, realRoot).split(sep).join("/");
+	const local = localFiles.map((path) => resolve(realRoot, relative(root, path)));
+	if (project && !containedPath(project)) throw new Error("The native Gradle project leaves its repository.");
+	if (transfer && (await statIfPresent(join(repository, project, "buildSrc")))?.isDirectory()) throw new Error("Native Gradle offload does not support buildSrc: AGP does not report its build directories, so the worker cannot keep them.");
+	const state = gradleStateDirectories(project);
+	const files = new Map((await sourceManifest(repository, true, signal)).map((file) => [file.path, file]));
+	for (const path of declaration.ignored) {
+		await requireRealParents(repository, path, signal);
+		const absolute = join(repository, path);
+		const stat = await lstat(absolute);
+		if (!stat.isFile() && !stat.isSymbolicLink()) throw new Error(`Ignored native input ${path} must be an exact file or link, not a directory.`);
+		if (stat.isSymbolicLink()) {
+			const content = Buffer.from(await readlink(absolute));
+			files.set(path, {
+				path,
+				kind: "link",
+				size: content.length,
+				sha256: createHash("sha256").update(content).digest("hex")
+			});
+		} else files.set(path, {
+			path,
+			kind: stat.mode & 73 ? "exec" : "file",
+			...await nativeFileDigest(absolute, signal)
+		});
+	}
+	for (const file of files.values()) {
+		if (local.includes(resolve(repository, file.path))) {
+			files.delete(file.path);
+			continue;
+		}
+		if (!containedPath(file.path)) throw new Error(`Native input ${file.path} is not a contained relative path.`);
+		await requireRealParents(repository, file.path, signal);
+		if (state.some((path) => below(file.path, path))) throw new Error("Gradle project state cannot be transferred as source.");
+		if (declaration.outputs.some((output) => below(file.path, output) || below(output, file.path))) throw new Error(`Native input ${file.path} overlaps a declared generated output.`);
+		if (file.path.split("/").at(-1) === "local.properties") {
+			if (file.kind === "link") throw new Error(`Native input ${file.path} is a machine-local properties link.`);
+			if ((await readFile(join(repository, file.path), {
+				encoding: "utf8",
+				signal
+			})).split(/\r?\n/).some((line) => line.trim() && !/^\s*[#!]/.test(line) && !/^\s*sdk\.dir\s*[:=].*[^\\]$/.test(line))) throw new Error(`Native input ${file.path} contains unsupported machine-local properties.`);
+			files.delete(file.path);
+			continue;
+		}
+	}
+	for (const file of files.values()) if (file.kind === "link") {
+		const absolute = join(repository, file.path);
+		const target = await readlink(absolute);
+		const resolved = await realpath(resolve(dirname(absolute), target));
+		const destination = relative(repository, resolved).split(sep).join("/");
+		if (isAbsolute(target) || !containedPath(destination) || !files.has(destination)) throw new Error(`Native input ${file.path} links to a target outside the declared source inventory.`);
+	}
+	for (const output of declaration.outputs) {
+		await requireRealParents(repository, output, signal);
+		const stat = await statIfPresent(join(repository, output));
+		if (stat && !stat.isDirectory()) throw new Error(`Generated output ${output} is not a real directory.`);
+		if (state.some((path) => below(output, path) || below(path, output))) throw new Error(`Generated output ${output} overlaps Gradle project state.`);
+	}
+	const empty = createHash("sha256").update("").digest("hex");
+	for (const path of files.keys()) {
+		const parts = path.split("/");
+		for (let index = 1; index < parts.length; index++) {
+			const directory = parts.slice(0, index).join("/");
+			files.set(directory, {
+				path: directory,
+				kind: "directory",
+				size: 0,
+				sha256: empty
+			});
+		}
+	}
+	const selected = [...files.values()].toSorted((a, b) => a.path.localeCompare(b.path));
+	return {
+		repository,
+		project,
+		declaration,
+		files: selected,
+		digest: manifestDigest(selected)
+	};
+}
+async function canonicalParent(path) {
+	const missing = [];
+	while (!await access(path).then(() => true, () => false) && dirname(path) !== path) {
+		missing.unshift(basename(path));
+		path = dirname(path);
+	}
+	return join(await realpath(path), ...missing);
+}
+async function nativeGradleOutputs(repository, declaration, reported, signal) {
+	signal?.throwIfAborted();
+	if (!Array.isArray(reported) || !reported.every((path) => typeof path === "string" && isAbsolute(path))) throw new Error("AGP did not report the configured native Gradle build directories.");
+	const real = await realpath(repository);
+	const reportedPaths = /* @__PURE__ */ new Set();
+	for (const absolute of reported) {
+		const resolved = resolve(absolute);
+		const canonical = join(await canonicalParent(dirname(resolved)), basename(resolved));
+		const path = relative(real, canonical).split(sep).join("/");
+		if (!containedPath(path)) throw new Error("A Gradle build directory leaves the transferred repository.");
+		await requireRealParents(repository, path, signal);
+		const stat = await statIfPresent(join(repository, path));
+		if (stat && !stat.isDirectory()) throw new Error(`Gradle build directory ${path} is not a real directory.`);
+		reportedPaths.add(path);
+	}
+	for (const output of declaration.outputs) if (!reportedPaths.has(output)) throw new Error(`Declared output ${output} was not reported by AGP.`);
+	for (const path of reportedPaths) if ((await statIfPresent(join(repository, path)))?.isDirectory() && !declaration.outputs.some((output) => below(path, output))) throw new Error(`Gradle build directory ${path} is not declared; add it to android.offloadInputs.outputs.`);
+	const outputs = [];
+	for (const path of declaration.outputs) {
+		signal?.throwIfAborted();
+		if ((await statIfPresent(join(repository, path)))?.isDirectory()) outputs.push(path);
+	}
+	return outputs;
+}
+function validateGradleManifest(project, declaration, files) {
+	gradleOffloadInputs(declaration);
+	if (project && !containedPath(project)) throw new Error("The native Gradle project leaves its repository.");
+	const excluded = [...declaration.outputs, ...gradleStateDirectories(project)];
+	for (const file of files) if (!containedPath(file.path) || excluded.some((path) => below(file.path, path) || file.kind !== "directory" && below(path, file.path))) throw new Error(`Native source ${file.path} overlaps worker outputs or leaves the repository.`);
+	for (const path of declaration.ignored) if (!files.some((file) => file.path === path && file.kind !== "directory")) throw new Error(`Declared ignored input ${path} is missing from the transfer.`);
+}
+async function verifyGradleTransfer(repository, project, declaration, files, digest, signal) {
+	signal?.throwIfAborted();
+	validateGradleManifest(project, declaration, files);
+	const excluded = [...declaration.outputs, ...gradleStateDirectories(project)];
+	for (const path of excluded) {
+		await requireRealParents(repository, path, signal);
+		const stat = await statIfPresent(join(repository, path));
+		if (stat && !stat.isDirectory()) throw new Error(`Worker output ${path} is not a real directory.`);
+	}
+	const markers = excluded.flatMap((path) => path.split("/").slice(0, -1).map((_, index) => join(repository, ...path.split("/").slice(0, index + 1))));
+	const snapshot = await fingerprintNativeInputs([{
+		name: "repository",
+		path: repository
+	}], {
+		excluded: [join(repository, ".git"), ...excluded.map((path) => join(repository, path))],
+		ignoredDirectoryMarkers: markers.filter((path) => !files.some((file) => join(repository, file.path) === path)),
+		parameters: null,
+		signal
+	});
+	const known = new Set(files.map((file) => file.path));
+	for (const entry of snapshot.entries) {
+		if (!entry.path.startsWith("repository/") || entry.path.includes("/@target")) continue;
+		const parts = entry.path.slice(11).split("/");
+		const index = parts.findIndex((_, depth) => !known.has(parts.slice(0, depth + 1).join("/")));
+		if (index >= 0 && (index < parts.length - 1 || entry.kind === "directory")) throw new Error(`Native Gradle directory ${parts.slice(0, index + 1).join("/")} is outside the source transfer and not a declared output reported by AGP; such directories, for example, included builds or externalNativeBuild staging, are not supported for remote builds.`);
+	}
+	return manifestDigest(await nativeTransferManifest(repository, snapshot, files, signal)) === digest;
+}
+//#endregion
+export { nativeGradleTransfer as a, nativeGradleOutputs as i, gradleStateDirectories as n, validateGradleManifest as o, nativeGradleLocalSourceDigest as r, verifyGradleTransfer as s, gradleOffloadInputs as t };

package/dist/native-inputs-TRTTTRxt.mjs

@@ -0,0 +1,91 @@
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { dirname, join, resolve, sep } from "node:path";
+import { lstat, readdir, readlink, realpath } from "node:fs/promises";
+//#region src/offload/manifest.ts
+function manifestDigest(entries) {
+	const hash = createHash("sha256");
+	for (const entry of entries.toSorted((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) hash.update(`${entry.path}\0${entry.kind}\0${entry.sha256}\n`);
+	return hash.digest("hex");
+}
+//#endregion
+//#region src/integrations/native-inputs.ts
+var NativeInputError = class extends Error {};
+async function fingerprintNativeInputs(inputs, { excluded = [], ignoredDirectoryMarkers = [], parameters, signal }) {
+	const exclusions = excluded.map((path) => resolve(path));
+	const directoryMarkers = new Set(ignoredDirectoryMarkers.map((path) => resolve(path)));
+	const entries = [];
+	const names = /* @__PURE__ */ new Set();
+	const isExcluded = (path) => exclusions.some((output) => path === output || path.startsWith(`${output}${sep}`));
+	let admit;
+	const record = (path, kind, content = "") => {
+		entries.push({
+			path,
+			kind,
+			sha256: createHash("sha256").update(content).digest("hex")
+		});
+	};
+	const walk = async (absolute, logical, ancestors, optional = false, relative = null) => {
+		signal?.throwIfAborted();
+		let stat;
+		try {
+			stat = await lstat(absolute);
+		} catch (error) {
+			if (optional && error.code === "ENOENT") {
+				record(logical, "absent");
+				return;
+			}
+			throw error;
+		}
+		if (stat.isSymbolicLink()) {
+			const target = await readlink(absolute);
+			const resolved = resolve(dirname(absolute), target);
+			if (isExcluded(resolved)) throw new NativeInputError(`Native input ${logical} links into an excluded output.`);
+			if (ancestors.has(absolute)) throw new NativeInputError(`Native input ${logical} contains a link cycle.`);
+			record(logical, "link", target);
+			await walk(resolved, `${logical}/@target`, /* @__PURE__ */ new Set([...ancestors, absolute]));
+		} else if (stat.isDirectory()) {
+			const canonical = await realpath(absolute);
+			if (ancestors.has(canonical)) throw new NativeInputError(`Native input ${logical} contains a directory cycle.`);
+			if (!directoryMarkers.has(absolute)) record(logical, "directory");
+			const next = /* @__PURE__ */ new Set([...ancestors, canonical]);
+			for (const name of (await readdir(absolute)).toSorted()) {
+				const child = join(absolute, name);
+				const childRelative = relative === null ? null : relative ? `${relative}/${name}` : name;
+				if (isExcluded(child) || childRelative !== null && admit && !admit(childRelative)) continue;
+				await walk(child, `${logical}/${name}`, next, false, childRelative);
+			}
+		} else if (stat.isFile()) {
+			const digest = createHash("sha256");
+			for await (const chunk of createReadStream(absolute, { signal })) digest.update(chunk);
+			entries.push({
+				path: logical,
+				kind: `file:${stat.mode & 73}`,
+				sha256: digest.digest("hex")
+			});
+		} else throw new NativeInputError(`Native input ${logical} is not a file, directory or symbolic link.`);
+	};
+	try {
+		for (const input of inputs) {
+			if (!input.name || names.has(input.name)) throw new NativeInputError("Native input names must be unique.");
+			names.add(input.name);
+			const path = resolve(input.path);
+			if (isExcluded(path)) throw new NativeInputError(`Native input ${input.name} is also an excluded output.`);
+			admit = input.admit;
+			await walk(path, input.name, /* @__PURE__ */ new Set(), input.optional, "");
+		}
+	} catch (error) {
+		signal?.throwIfAborted();
+		if (error instanceof NativeInputError) throw error;
+		throw new NativeInputError(`Could not read native build inputs: ${error.message}`, { cause: error });
+	}
+	signal?.throwIfAborted();
+	const sorted = entries.toSorted((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+	return {
+		hash: createHash("sha256").update("stim-native-inputs-v1\0").update(JSON.stringify(parameters)).update("\0").update(manifestDigest(sorted)).digest("hex"),
+		entries: sorted,
+		parameters
+	};
+}
+//#endregion
+export { fingerprintNativeInputs as n, manifestDigest as r, NativeInputError as t };