stim 1.20.2 → 1.22.0

package/dist/native-run-NwUuxbkg.mjs

@@ -0,0 +1,276 @@
+import { i as withWorkspaceProcessLock, l as refuseDeclaredSpawns, m as operationState, p as isTermination, s as allowDeclaredSpawns, u as signalDeclaredSpawns, x as ownership_claim_exports } from "./exec-DEoAhcze.mjs";
+import { d as workspaceDir } from "./paths-DQtTgsBf.mjs";
+import { a as formatElapsed, l as phaseLine } from "./command-output-gwpm28fu.mjs";
+import { o as updateWorkspaceState, r as readWorkspaceState, t as clearWorkspaceStateKey } from "./workspace-state-U08dEzhG.mjs";
+import { t as canonicalPath } from "./paths-BsJMoPP2.mjs";
+import { existsSync, mkdirSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { setTimeout } from "node:timers/promises";
+//#region src/cache/cache-claim.ts
+const LABEL = "cache";
+const POLL_MS = 500;
+const EMPTYING_WAIT_MS = 6e5;
+/**
+* The claim set guarding a cache Stim can only empty whole. It sits beside the cache's resolved directory, so emptying
+* the cache never removes it and every path that reaches the same cache names the same set; before the cache exists,
+* its resolved parent stands in for it.
+*/
+function cacheClaimRoot(dir) {
+	return `${existsSync(dir) ? canonicalPath(dir) : join(canonicalPath(dirname(dir)), basename(dir))}.claims`;
+}
+function describe(holder) {
+	const { platform, projectRoot } = holder.details;
+	const where = typeof projectRoot === "string" ? ` in ${projectRoot}` : "";
+	return holder.mode === "shared" ? `the ${typeof platform === "string" ? platform : "iOS"} build (pid ${holder.owner.pid}${where}) may be using it` : `pid ${holder.owner.pid} is emptying it`;
+}
+/** Why the cache at `dir` may be in use, from its claim set, without taking or removing any claim. */
+function cacheUser(dir) {
+	const root = cacheClaimRoot(dir);
+	const survey = (0, ownership_claim_exports.readClaimSet)(root);
+	const problem = survey.unresolved[0];
+	if (problem) return `the cache claim ${problem.path} is unresolved, so a build may be using it`;
+	const holder = survey.live[0];
+	return holder ? describe(holder) : void 0;
+}
+/**
+* Takes the exclusive claim an emptier holds while it removes the cache's contents; a string is why it cannot.
+* It never waits for a build that holds the cache.
+*/
+function claimForEmptying(dir) {
+	try {
+		const attempt = (0, ownership_claim_exports.tryAcquireClaim)({
+			root: cacheClaimRoot(dir),
+			mode: "exclusive",
+			label: LABEL
+		});
+		if (attempt.acquired) return attempt.acquired;
+		if (attempt.pending) (0, ownership_claim_exports.releaseClaim)(attempt.pending);
+		const holder = attempt.held ?? attempt.waitingFor?.[0];
+		return holder ? describe(holder) : `its claim at ${cacheClaimRoot(dir)} could not be taken`;
+	} catch (error) {
+		if ((0, ownership_claim_exports.isClaimRefusal)(error) || (0, ownership_claim_exports.isClaimUnavailable)(error)) return error.message;
+		return `its claim at ${cacheClaimRoot(dir)} could not be taken: ${error instanceof Error ? error.message : String(error)}`;
+	}
+}
+/**
+* Takes the shared claim a build holds on the compilation cache it compiles with, waiting while an emptier holds it.
+* A claim set Stim cannot resolve, or no process identity, is a failure: the build never runs unguarded.
+*/
+async function shareCompilationCache({ dir, projectRoot, note, signal }) {
+	const started = Date.now();
+	let told = false;
+	for (;;) {
+		signal?.throwIfAborted();
+		let attempt;
+		let root = `${dir}.claims`;
+		try {
+			mkdirSync(dirname(dir), { recursive: true });
+			root = cacheClaimRoot(dir);
+			attempt = (0, ownership_claim_exports.tryAcquireClaim)({
+				root,
+				mode: "shared",
+				label: LABEL,
+				details: {
+					platform: "ios",
+					projectRoot
+				}
+			});
+		} catch (error) {
+			return { failure: (0, ownership_claim_exports.claimFailure)(error, null) ?? {
+				code: ownership_claim_exports.CLAIM_UNAVAILABLE,
+				message: `Stim could not take the compilation cache claim at ${root}: ${error instanceof Error ? error.message : String(error)}.`,
+				remedy: `Restore write access to ${dirname(root)}, then retry the same Stim command.`
+			} };
+		}
+		if (attempt.acquired) return { claim: attempt.acquired };
+		const emptier = attempt.held ? `pid ${attempt.held.owner.pid}` : "another process";
+		const waited = Date.now() - started;
+		if (waited >= EMPTYING_WAIT_MS) return { failure: {
+			code: "STIM_BUILD_FAILED",
+			message: `${emptier} has been emptying the compilation cache at ${dir} for ${formatElapsed(waited)}.`,
+			remedy: "Run the same command again once it has finished."
+		} };
+		if (!told) note(phaseLine("build", `waiting for ${emptier} to finish emptying the compilation cache at ${dir}`));
+		told = true;
+		await setTimeout(POLL_MS);
+	}
+}
+//#endregion
+//#region src/engine/native-run.ts
+const NATIVE_RUN_LOCK = "native-run";
+const NATIVE_RUN_WAIT_MS = 18e5;
+const WAIT_HEARTBEAT_MS = 3e4;
+const CANCEL_REQUEST_KEY = "nativeRunCancel";
+const REQUEST_POLL_MS = 250;
+function nativeRunHolder(holder) {
+	const { command, platform, slot, interrupt } = holder.details;
+	return {
+		command: typeof command === "string" ? command : null,
+		platform: typeof platform === "string" ? platform : null,
+		slot: typeof slot === "string" ? slot : "default",
+		takesSignals: interrupt === "signal"
+	};
+}
+function describeNativeRunHolder(holder, now) {
+	const { command, slot } = nativeRunHolder(holder);
+	const started = Date.parse(holder.startedAt);
+	const facts = [`pid ${holder.owner.pid}`];
+	if (Number.isFinite(started)) facts.push(`running for ${formatElapsed(now - started)}`);
+	if (command === null) return `another Stim run (${facts.join(", ")})`;
+	if (command === "build") return `an artifact build (${facts.join(", ")})`;
+	return `\`stim ${command}${slot === "default" ? "" : ` --slot ${slot}`}\` (${facts.join(", ")})`;
+}
+/**
+* Report a wait on the native-run lock: one line as soon as a holder is seen, a line for each new
+* holder, and a heartbeat every WAIT_HEARTBEAT_MS while the same holder keeps it.
+*/
+function nativeRunWaitNotice({ write, now = Date.now, describe = describeNativeRunHolder }) {
+	let claimId = null;
+	let lastAt = 0;
+	return (holder, firstLine) => {
+		const at = now();
+		if (holder.claimId !== claimId) {
+			claimId = holder.claimId;
+			lastAt = at;
+			write(firstLine ?? `waiting for ${describe(holder, at)} in this workspace to finish`);
+			return;
+		}
+		if (at - lastAt < WAIT_HEARTBEAT_MS) return;
+		lastAt = at;
+		write(`still waiting for ${describe(holder, at)}`);
+	};
+}
+/**
+* What `stop` does about the run holding the native-run lock. A build is interrupted only when the stop
+* leaves it nothing to deploy to: the whole workspace stops, the build targets the stopped slot, or the
+* stopped slot is the workspace's only device. A build for another slot that stays is left running and
+* the stop proceeds without the lock. Only an owner whose identity is proven live is signalled.
+*/
+function decideStopAction({ stopSlot, holder, ownerIdentity, deviceSlots }) {
+	if (holder.command === "macos" || holder.command === "build") {
+		if (stopSlot !== void 0) return { action: "proceed" };
+		return ownerIdentity === "same" ? { action: "interrupt" } : { action: "refuse" };
+	}
+	if (holder.command !== "ios" && holder.command !== "android") return { action: "wait" };
+	if (!(stopSlot === void 0 || holder.slot === stopSlot || deviceSlots.includes(stopSlot) && deviceSlots.every((slot) => slot === stopSlot))) return { action: "proceed" };
+	return ownerIdentity === "same" ? { action: "interrupt" } : { action: "refuse" };
+}
+const requestListeners = /* @__PURE__ */ new Map();
+/**
+* Ask the run holding `claimId` to cancel: the request is written to the workspace state, where the run's watch
+* finds it, and a run in this process is told at once.
+*/
+function requestNativeRunCancel(root, claimId, pid = process.pid) {
+	updateWorkspaceState(root, (state) => ({
+		...state,
+		[CANCEL_REQUEST_KEY]: {
+			claimId,
+			pid,
+			at: (/* @__PURE__ */ new Date()).toISOString()
+		}
+	}));
+	requestListeners.get(claimId)?.();
+}
+function cancelRequestFor(root, claimId) {
+	const request = readWorkspaceState(root)?.[CANCEL_REQUEST_KEY];
+	if (request?.claimId !== claimId || typeof request.pid !== "number") return null;
+	return { pid: request.pid };
+}
+function clearNativeRunCancel(root, claimId) {
+	try {
+		clearWorkspaceStateKey(root, CANCEL_REQUEST_KEY, (value) => value?.claimId === claimId);
+	} catch {}
+}
+/** The active native run of `context`'s operation aborts this signal when it is cancelled. */
+function runCancellationSignal(context) {
+	return operationState(context).runSignal;
+}
+/** Why `context`'s native run was cancelled, or null while it was not. */
+function runCancellation(context) {
+	return operationState(context).cancelled;
+}
+function cancelledFailure(context, platform, { code, message }) {
+	const cancelled = runCancellation(context);
+	if (cancelled === null || code === "STIM_CLAIM_UNAVAILABLE") return null;
+	return {
+		code: "STIM_CANCELLED",
+		message: `The ${platform} run was ${cancelled} before it finished.`,
+		remedy: `Run \`stim ${platform}\` again when you want the app on a device.`,
+		lines: [`it stopped at ${code ?? "an unfinished step"}${message ? `: ${message}` : ""}`]
+	};
+}
+function cancelOnAbort({ context, root, claim, write, controller }) {
+	const state = operationState(context);
+	const cancel = () => {
+		if (controller.signal.aborted) return;
+		const request = cancelRequestFor(root, claim.claimId);
+		const cancelled = request ? `cancelled by \`stim stop\` (pid ${request.pid})` : "cancelled by an interrupt";
+		state.cancelled = cancelled;
+		state.handled = true;
+		controller.abort();
+		refuseDeclaredSpawns(context, `the run was ${cancelled}`);
+		const signalled = signalDeclaredSpawns(context, "SIGINT");
+		if (signalled > 0 || request) state.draining = true;
+		write(signalled > 0 ? `${cancelled}; stopping the running build tool` : request ? `${cancelled}; stopping before the next build tool or install` : cancelled);
+	};
+	const onAbort = () => {
+		if (!isTermination(context.signal.reason)) cancel();
+	};
+	const onRequest = () => {
+		if (controller.signal.aborted || !cancelRequestFor(root, claim.claimId)) return;
+		cancel();
+		state.abortOperation?.("stop");
+	};
+	context.signal.addEventListener("abort", onAbort);
+	if (context.signal.aborted) onAbort();
+	requestListeners.set(claim.claimId, onRequest);
+	const watch = setInterval(onRequest, REQUEST_POLL_MS);
+	watch.unref();
+	return () => {
+		clearInterval(watch);
+		requestListeners.delete(claim.claimId);
+		context.signal.removeEventListener("abort", onAbort);
+		allowDeclaredSpawns(context);
+		clearNativeRunCancel(root, claim.claimId);
+	};
+}
+/**
+* Run an `ios`, `android` or `macos` invocation under the workspace's native-run lock: the claim records the
+* command, platform and slot, and a wait for another holder is reported on `write`. An abort of `context.signal`
+* forwards an interrupt to the running declared build tool and refuses any later one; a run `stim stop` cancelled
+* stops before its next build tool or install. A `SIGTERM` abort reason is left to the caller.
+*/
+function withNativeBuildRun(context, root, details, fn, { write }) {
+	const notice = nativeRunWaitNotice({ write });
+	const state = operationState(context);
+	return withWorkspaceProcessLock(workspaceDir(root), NATIVE_RUN_LOCK, async (claim) => {
+		state.cancelled = null;
+		const controller = new AbortController();
+		state.runSignal = controller.signal;
+		const dispose = cancelOnAbort({
+			context,
+			root,
+			claim,
+			write,
+			controller
+		});
+		try {
+			return await fn(claim);
+		} finally {
+			dispose();
+			state.runSignal = void 0;
+		}
+	}, {
+		external: true,
+		signal: context.signal,
+		waitMs: NATIVE_RUN_WAIT_MS,
+		declareSpawnsFor: context,
+		details: {
+			...details,
+			interrupt: state.takesSignals ? "signal" : "request"
+		},
+		onHeld: (holder) => notice(holder)
+	});
+}
+//#endregion
+export { decideStopAction as a, nativeRunWaitNotice as c, runCancellationSignal as d, withNativeBuildRun as f, shareCompilationCache as h, clearNativeRunCancel as i, requestNativeRunCancel as l, claimForEmptying as m, NATIVE_RUN_WAIT_MS as n, describeNativeRunHolder as o, cacheUser as p, cancelledFailure as r, nativeRunHolder as s, NATIVE_RUN_LOCK as t, runCancellation as u };

package/dist/{native-runtime-k8dTIrbK.mjs → native-runtime-B7KIafpM.mjs}

@@ -1,14 +1,15 @@
-import { j as metroPortSetting } from "./settings-B717odTD.mjs";
-import { p as ensureWorkspaceStorage, r as readWorkspaceState$1 } from "./workspace-state-DJt_MMvf.mjs";
-import { l as phaseLine } from "./command-output-BTy8hZ0F.mjs";
-import { u as resolveProjectMetro } from "./metro-DnCEjCxs.mjs";
-import { c as startDevServer } from "./start-BWqzODpb.mjs";
-import { r as LAUNCH_UNVERIFIED, t as LAUNCH_BUNDLING } from "./launch-verify-B6Q8hZP-.mjs";
+import { n as ensureWorkspaceStorage } from "./paths-DQtTgsBf.mjs";
+import { l as phaseLine } from "./command-output-gwpm28fu.mjs";
+import { r as readWorkspaceState$1 } from "./workspace-state-U08dEzhG.mjs";
+import { j as metroPortSetting } from "./settings-C7O8A6ZI.mjs";
+import { d as resolveProjectMetro } from "./metro-DiXtA3Ty.mjs";
+import { Yt as LAUNCH_UNVERIFIED, qt as LAUNCH_BUNDLING } from "./budget-Cvwn54qV.mjs";
+import { c as startDevServer } from "./start-EojN4WFz.mjs";
 import { readIdleStop } from "@stim-cli/core/state";
 import chalk from "chalk";
 //#region src/commands/native-runtime.ts
-async function ensureDevServer({ root, port, settings, settingsContext, remote, note, resolve = resolveProjectMetro, start = startDevServer, readState = readWorkspaceState$1 }) {
-	const pin = metroPortSetting(settings);
+async function ensureDevServer({ root, port, settings, settingsContext, remote, env, note, resolve = resolveProjectMetro, start = startDevServer, readState = readWorkspaceState$1 }) {
+	const pin = metroPortSetting(settings, env);
 	const canReuse = !pin.error && (pin.port === null || pin.port === port);
 	const held = port === null || !canReuse ? null : (await resolve(port, root)).metro;
 	if (port !== null && held) return {
@@ -34,7 +35,8 @@ async function ensureDevServer({ root, port, settings, settingsContext, remote,
 		message: `Could not start this workspace's dev server: ${result.error.message}`,
 		remedy: result.error.remedy,
 		lines: result.lines,
-		reclaimed: result.reclaimed
+		reclaimed: result.reclaimed,
+		...result.retainedClaimRoots ? { retainedClaimRoots: result.retainedClaimRoots } : {}
 	};
 	const { facts } = result;
 	return {

package/dist/native-source-Y0yLhFyQ.mjs

@@ -0,0 +1,133 @@
+import { s as gitAsync } from "./operation-exec-BW0em61G.mjs";
+import { n as fingerprintNativeInputs, r as manifestDigest } from "./native-inputs-TRTTTRxt.mjs";
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { lstat, readlink, realpath } from "node:fs/promises";
+//#region src/offload/native-source.ts
+function* repositoryInputs(snapshot) {
+	const links = snapshot.entries.filter((entry) => entry.kind === "link").map((entry) => `${entry.path}/@target`);
+	for (const entry of snapshot.entries) {
+		if (entry.path === "repository") continue;
+		if (!entry.path.startsWith("repository/")) throw new Error("Native offload requires every input to be inside the repository.");
+		if (links.some((link) => entry.path === link || entry.path.startsWith(`${link}/`))) continue;
+		yield {
+			entry,
+			path: entry.path.slice(11)
+		};
+	}
+}
+const absentInput = (path) => /* @__PURE__ */ new Error(`Native input ${path} is ignored or absent from the source transfer; it was not uploaded.`);
+/** Throws the same membership refusal as nativeTransferManifest, from the git-visible paths alone. */
+function checkNativeTransferMembership(snapshot, visible) {
+	for (const { entry, path } of repositoryInputs(snapshot)) {
+		if (entry.kind === "directory" || visible.has(path)) continue;
+		for (let index = path.indexOf("/"); index !== -1; index = path.indexOf("/", index + 1)) if (visible.has(path.slice(0, index))) throw new Error(`Native input ${path} is inside the git submodule ${path.slice(0, index)}; submodules are not transferred.`);
+		throw absentInput(path);
+	}
+}
+async function nativeTransferManifest(root, snapshot, visible, signal) {
+	const files = new Map(visible.map((file) => [file.path, file]));
+	signal?.throwIfAborted();
+	root = await realpath(root);
+	const selected = [];
+	const empty = createHash("sha256").update("").digest("hex");
+	for (const { entry, path } of repositoryInputs(snapshot)) {
+		signal?.throwIfAborted();
+		if (entry.kind === "directory") {
+			selected.push({
+				path,
+				kind: "directory",
+				size: 0,
+				sha256: empty
+			});
+			continue;
+		}
+		const file = files.get(path);
+		if (!file) throw absentInput(path);
+		const kind = entry.kind === "file:0" ? "file" : entry.kind === "file:73" ? "exec" : entry.kind;
+		if (kind !== file.kind || entry.sha256 !== file.sha256) throw new Error(`Native input ${path} changed or has an unsupported executable mode.`);
+		selected.push(file);
+		if (kind === "link") {
+			const link = join(root, path);
+			const target = await readlink(link);
+			const destination = relative(root, await realpath(resolve(dirname(link), target)));
+			if (isAbsolute(target) || isAbsolute(destination) || destination === ".." || destination.startsWith(`..${sep}`)) throw new Error(`Native input ${path} has a link that cannot be relocated inside the repository.`);
+		}
+	}
+	return selected.toSorted((a, b) => a.path.localeCompare(b.path));
+}
+async function verifyNativeTransfer(root, files, digest, ignoredDirectoryMarkers = []) {
+	const snapshot = await fingerprintNativeInputs([{
+		name: "repository",
+		path: root
+	}], {
+		excluded: [join(root, ".git")],
+		ignoredDirectoryMarkers,
+		parameters: null
+	});
+	return manifestDigest(await nativeTransferManifest(root, snapshot, files)) === digest;
+}
+/** SHA-256 and byte count of one regular file, streamed without blocking the caller. */
+async function nativeFileDigest(path, signal) {
+	const hash = createHash("sha256");
+	let size = 0;
+	try {
+		for await (const chunk of createReadStream(path, { signal })) {
+			hash.update(chunk);
+			size += chunk.length;
+		}
+	} finally {
+		signal?.throwIfAborted();
+	}
+	return {
+		size,
+		sha256: hash.digest("hex")
+	};
+}
+/** The exact source a build needs: tracked and untracked, not ignored, as `git ls-files -co --exclude-standard`. */
+async function sourceManifest(repoRoot, strict = false, signal) {
+	const files = [];
+	for (const path of await gitVisiblePaths(repoRoot, signal)) {
+		signal?.throwIfAborted();
+		const absolute = join(repoRoot, path);
+		let stat;
+		try {
+			stat = await lstat(absolute);
+		} catch (error) {
+			if (strict && error.code !== "ENOENT") throw error;
+			continue;
+		}
+		if (stat.isSymbolicLink()) {
+			const target = Buffer.from(await readlink(absolute));
+			files.push({
+				path,
+				kind: "link",
+				size: target.length,
+				sha256: createHash("sha256").update(target).digest("hex")
+			});
+		} else if (stat.isFile()) files.push({
+			path,
+			kind: stat.mode & 73 ? "exec" : "file",
+			...await nativeFileDigest(absolute, signal)
+		});
+		else if (strict) throw new Error(`Native source ${path} is not a file or link; transfer submodule contents explicitly.`);
+	}
+	signal?.throwIfAborted();
+	return files;
+}
+async function gitVisiblePaths(repoRoot, signal) {
+	const listed = await gitAsync(repoRoot, [
+		"ls-files",
+		"-z",
+		"-co",
+		"--exclude-standard"
+	], {
+		untrimmed: true,
+		timeoutMs: 12e4,
+		signal
+	});
+	return new Set(listed.split("\0").filter(Boolean));
+}
+//#endregion
+export { sourceManifest as a, nativeTransferManifest as i, gitVisiblePaths as n, verifyNativeTransfer as o, nativeFileDigest as r, checkNativeTransferMembership as t };

package/dist/{native-xcode-inputs-CykopJdM.mjs → native-xcode-inputs-D_VOfFL7.mjs}

@@ -1,10 +1,10 @@
-import { r as gitQuiet } from "./git-DDfFzkMm.mjs";
-import { b as workspaceDerivedData, x as workspaceDir } from "./workspace-state-DJt_MMvf.mjs";
-import { m as pbxString, p as pbxReferences } from "./project-_phNIJfs.mjs";
-import { f as NativeInputError, p as fingerprintNativeInputs } from "./native-gradle-inputs-BsLRrl7u.mjs";
+import { d as workspaceDir, u as workspaceDerivedData } from "./paths-DQtTgsBf.mjs";
+import { a as killOnAbort, l as gitQuietAsync, r as childEnvironment } from "./operation-exec-BW0em61G.mjs";
+import { h as pbxString, m as pbxReferences } from "./project-wM_XFTvE.mjs";
+import { n as fingerprintNativeInputs, t as NativeInputError } from "./native-inputs-TRTTTRxt.mjs";
+import { createHash } from "node:crypto";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { createHash } from "node:crypto";
 //#region src/integrations/native-xcode-inputs.ts
 function nativeXcodePackages(root) {
 	return join(workspaceDir(root), "xcode-packages");
@@ -66,24 +66,30 @@ function inside(root, path) {
 function fold(path) {
 	return path.normalize("NFC").toLowerCase();
 }
-function gitVisibility(sourceRoot) {
+async function gitVisibility(sourceRoot, env, signal) {
+	signal?.throwIfAborted();
 	if (!existsSync(join(sourceRoot, ".git"))) return null;
-	const listing = gitQuiet(sourceRoot, [
+	const childEnv = childEnvironment(env);
+	const listing = await gitQuietAsync(sourceRoot, [
 		"ls-files",
 		"-z",
 		"--cached",
 		"--others",
 		"--exclude-standard"
 	], {
+		env: childEnv.env,
 		untrimmed: true,
 		omitEnv: [
+			...childEnv.omitEnv,
 			"GIT_DIR",
 			"GIT_WORK_TREE",
 			"GIT_INDEX_FILE",
 			"GIT_COMMON_DIR"
 		],
-		timeoutMs: 12e4
+		timeoutMs: 12e4,
+		onSpawn: killOnAbort(signal)
 	});
+	signal?.throwIfAborted();
 	if (listing === null) return null;
 	const listed = /* @__PURE__ */ new Set();
 	const whole = /* @__PURE__ */ new Set();
@@ -105,9 +111,9 @@ function gitVisibility(sourceRoot) {
 		include
 	};
 }
-function nativeXcodeInputSnapshot(root, selection, parameters, sourceRoot = root) {
+async function nativeXcodeInputSnapshot(root, selection, parameters, env, sourceRoot = root, signal) {
 	if (selection.platform === "unknown") return { cacheIneligible: "The selected application platform cannot be resolved from its project configuration" };
-	const visibility = gitVisibility(sourceRoot);
+	const visibility = await gitVisibility(sourceRoot, env, signal);
 	const inputs = [{
 		name: "repository",
 		path: sourceRoot,
@@ -120,7 +126,7 @@ function nativeXcodeInputSnapshot(root, selection, parameters, sourceRoot = root
 	];
 	const reasons = /* @__PURE__ */ new Set();
 	const environment = {};
-	for (const [name, value] of Object.entries(process.env).toSorted(([a], [b]) => a.localeCompare(b))) if (value !== void 0 && /^(?:DEVELOPER_DIR|TOOLCHAINS|SDKROOT|CFLAGS|CPPFLAGS|CXXFLAGS|OBJCFLAGS|LDFLAGS|ARCHS|ONLY_ACTIVE_ARCH|SOURCE_DATE_EPOCH|ZERO_AR_DATE|IPHONEOS_DEPLOYMENT_TARGET|MACOSX_DEPLOYMENT_TARGET|DEVELOPMENT_TEAM|XCODE_.*|SWIFT_.*|CLANG_.*|GCC_.*|OTHER_.*FLAGS|CODE_SIGN.*|PROVISIONING_.*)$/.test(name)) environment[name] = value;
+	for (const [name, value] of Object.entries(env).toSorted(([a], [b]) => a.localeCompare(b))) if (value !== void 0 && /^(?:DEVELOPER_DIR|TOOLCHAINS|SDKROOT|CFLAGS|CPPFLAGS|CXXFLAGS|OBJCFLAGS|LDFLAGS|ARCHS|ONLY_ACTIVE_ARCH|SOURCE_DATE_EPOCH|ZERO_AR_DATE|IPHONEOS_DEPLOYMENT_TARGET|MACOSX_DEPLOYMENT_TARGET|DEVELOPMENT_TEAM|XCODE_.*|SWIFT_.*|CLANG_.*|GCC_.*|OTHER_.*FLAGS|CODE_SIGN.*|PROVISIONING_.*)$/.test(name)) environment[name] = value;
 	const dependencyRoots = /* @__PURE__ */ new Map();
 	const synchronizedRoots = [];
 	const reveal = (path, complete = true) => {
@@ -144,10 +150,10 @@ function nativeXcodeInputSnapshot(root, selection, parameters, sourceRoot = root
 		const result = value.replace(/\$\(([^)]+)\)|\$\{([^}]+)\}/g, (_match, parenthesized, braced) => {
 			const name = parenthesized ?? braced;
 			if (known[name] !== void 0) return known[name];
-			const env = process.env[name];
-			if (env !== void 0) {
-				environment[name] = env;
-				return env;
+			const supplied = env[name];
+			if (supplied !== void 0) {
+				environment[name] = supplied;
+				return supplied;
 			}
 			missing = true;
 			return "";
@@ -272,8 +278,8 @@ function nativeXcodeInputSnapshot(root, selection, parameters, sourceRoot = root
 			"CCC_OVERRIDE_OPTIONS",
 			"CLANG_CONFIG_FILE_USER_DIR",
 			"CLANG_CONFIG_FILE_SYSTEM_DIR"
-		]) if (process.env[name]) reasons.add(`Environment ${name} supplies native inputs outside the resolved project`);
-		if (process.env.XCODE_XCCONFIG_FILE) xcconfig(resolve(process.env.XCODE_XCCONFIG_FILE), selection.targetProject);
+		]) if (env[name]) reasons.add(`Environment ${name} supplies native inputs outside the resolved project`);
+		if (env.XCODE_XCCONFIG_FILE) xcconfig(resolve(selection.container.dir, env.XCODE_XCCONFIG_FILE), selection.targetProject);
 		for (const [name, value] of Object.entries(environment)) if (/(?:FLAGS|OTHER_.*FLAGS)$/.test(name) && /(?:[/@]|(?:^|\s)-(?:I|F|L|include|isystem|iquote|iframework|ivfsoverlay|fmodule|fplugin|resource-dir|sdk))/.test(value)) reasons.add(`Environment ${name} supplies compiler inputs outside the resolved project`);
 		if (nativeXcodeHasPackages(selection)) reasons.add("Swift package manifests, plugins and transitive local dependencies have no verified input closure");
 		if (reasons.size) return { cacheIneligible: [...reasons].join("; ") };
@@ -281,8 +287,9 @@ function nativeXcodeInputSnapshot(root, selection, parameters, sourceRoot = root
 			name,
 			path: realpathSync(path)
 		});
-		const snapshot = fingerprintNativeInputs(inputs, {
+		const snapshot = await fingerprintNativeInputs(inputs, {
 			excluded,
+			signal,
 			ignoredDirectoryMarkers: nativeXcodeMetadataDirectories(selection),
 			parameters: {
 				recipe: "native-xcode-v1",
@@ -298,6 +305,7 @@ function nativeXcodeInputSnapshot(root, selection, parameters, sourceRoot = root
 		if (snapshot.entries.some((entry) => synchronizedRoots.some((prefix) => entry.path.startsWith(`${prefix}/`)) && /\.(?:c|cc|cpp|cxx|m|mm|h|hh|hpp|hxx|metal)$/i.test(entry.path))) return { cacheIneligible: "C-family or Metal sources need a verified compiler include dependency graph" };
 		return snapshot;
 	} catch (error) {
+		signal?.throwIfAborted();
 		return { cacheIneligible: error instanceof NativeInputError ? error.message : `Native input closure is unavailable: ${error.message}` };
 	}
 }