stim 1.20.2 → 1.22.0

package/dist/offload-worker.mjs

@@ -1,26 +1,200 @@
-import { O as writeConfigSetting } from "./config-BYDxlMY3.mjs";
-import { t as getExecutor } from "./exec-DqKo9GKJ.mjs";
-import { t as git } from "./git-DDfFzkMm.mjs";
-import { d as androidLayoutSetting, y as iosProjectDirSetting } from "./settings-B717odTD.mjs";
-import { D as fingerprintProject, M as refingerprintAfterMutation } from "./device-lease-BX1sJQ2E.mjs";
-import { w as workspaceLogsDir, x as workspaceDir } from "./workspace-state-DJt_MMvf.mjs";
+import { t as getExecutor } from "./exec-DEoAhcze.mjs";
+import { d as workspaceDir, m as workspaceLogsDir$1 } from "./paths-DQtTgsBf.mjs";
+import { k as writeConfigSetting } from "./config-DlrsduwG.mjs";
 import { n as stripAnsi } from "./process-output-Fpl8PYi8.mjs";
-import { d as projectRegistry, h as selectNativeXcodeProject } from "./project-_phNIJfs.mjs";
-import { o as parseNdjsonText } from "./ndjson-GOnbyvso.mjs";
-import { n as CCACHE_UNAVAILABLE, o as resolveCcache } from "./ccache-zdKiYQ3E.mjs";
-import { i as assembleTaskFor } from "./gradle-DSrXb6lG.mjs";
-import { f as podsAreStale, g as runPodInstall, p as readPodState, u as workerToolchain } from "./toolchain-DxSsNssu.mjs";
-import { a as validateGradleManifest, d as verifyNativeTransfer, m as manifestDigest, n as gradleStateDirectories, o as verifyGradleTransfer, r as nativeGradleOutputs, t as gradleOffloadInputs } from "./native-gradle-inputs-BsLRrl7u.mjs";
-import { n as buildAndroid, o as gradlewPath, r as buildIos } from "./react-native-build-CtCccJtb.mjs";
-import { n as buildAndroidOperation, t as buildIosOperation } from "./build-DYDbfkk5.mjs";
-import { n as recordPrebuild, r as runPrebuild, t as planPrebuild } from "./prebuild-DYbucPXy.mjs";
-import { f as podAction } from "./support-CwjbFs9H.mjs";
-import { r as stageBundle, t as resolveBundleExtras } from "./stage-KNTQopqv.mjs";
-import { t as logLines } from "./run-BtPgpKks.mjs";
-import { r as nativeXcodeMetadataDirectories } from "./native-xcode-inputs-CykopJdM.mjs";
-import { chmodSync, constants, copyFileSync, cpSync, createReadStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
+import { o as git, s as gitAsync } from "./operation-exec-BW0em61G.mjs";
+import { d as androidLayoutSetting, y as iosProjectDirSetting } from "./settings-C7O8A6ZI.mjs";
+import { f as projectRegistry, g as selectNativeXcodeProject } from "./project-wM_XFTvE.mjs";
+import { o as parseNdjsonText } from "./ndjson-CgE_o3Dl.mjs";
+import { Fn as processContext } from "./budget-Cvwn54qV.mjs";
+import { l as fingerprintProject, m as refingerprintAfterMutation } from "./build-cache-Dv7RN200.mjs";
+import { n as CCACHE_UNAVAILABLE, o as resolveCcache } from "./ccache-Btwc36-I.mjs";
+import { _ as clearCorruptCompilationCache, f as reactNativeArtifactReceipt, g as COMPILATION_CACHE_CORRUPT, m as reactNativeBuildQuery, p as reactNativeArtifactToolchain } from "./client-OyRoEuSr.mjs";
+import { f as workerToolchain, h as readPodState, i as availableIphone, m as podsAreStale, v as runPodInstall } from "./toolchain-DpJMHq0n.mjs";
+import { n as fingerprintNativeInputs, r as manifestDigest } from "./native-inputs-TRTTTRxt.mjs";
+import { a as sourceManifest, o as verifyNativeTransfer } from "./native-source-Y0yLhFyQ.mjs";
+import { i as nativeGradleOutputs, n as gradleStateDirectories, o as validateGradleManifest, s as verifyGradleTransfer, t as gradleOffloadInputs } from "./native-gradle-inputs-Dnh84Zbd.mjs";
+import { n as buildAndroid, o as gradlewPath, r as buildIos, u as assembleTaskFor } from "./react-native-build-Dvd8hC21.mjs";
+import { f as podAction } from "./support-CNioewsd.mjs";
+import { i as runPrebuild, r as recordPrebuild, t as planPrebuild } from "./prebuild-D4JoEAEs.mjs";
+import { g as dumpApkManifest, p as apkPackage } from "./support-yUiOjnVY.mjs";
+import { n as buildAndroidOperation, t as buildIosOperation } from "./build-CabC3G23.mjs";
+import { i as stageBundle, n as resolveBundleExtras } from "./stage-Bps5oius.mjs";
+import { t as logLines } from "./run-DidHghD1.mjs";
+import { r as nativeXcodeMetadataDirectories } from "./native-xcode-inputs-D_VOfFL7.mjs";
+import { n as swiftpmArtifactInputs, r as swiftpmArtifactSnapshot, t as readSwiftpmArtifactToolchain } from "./swiftpm-artifact-inputs-DFcGsXDP.mjs";
+import { a as nativeGradleWorkerArtifactIdentity, i as nativeGradleArtifactSnapshotFromReceipt, o as nativeGradleWorkerScope } from "./native-gradle-artifact-inputs-DHFnmrVf.mjs";
 import { createHash } from "node:crypto";
+import { chmodSync, constants, copyFileSync, cpSync, createReadStream, createWriteStream, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { isDeepStrictEqual } from "node:util";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
+import { dependencyInstall, withAmbientContext } from "@stim-cli/core";
+import { isJsonObject, windowsShortDir, windowsShortDirKey } from "@stim-cli/core/state";
+import { realpath } from "node:fs/promises";
+import { pipeline } from "node:stream/promises";
+import { createGzip } from "node:zlib";
+//#region src/offload/swiftpm-artifact.ts
+async function readSwiftpmWorkerToolchain(context, cwd) {
+	const commandPath = async (name) => {
+		const path = getExecutor().findExecutable(name, {
+			cwd,
+			env: context.env
+		});
+		if (!path) throw new Error(`The SwiftPM tool ${name} is unavailable.`);
+		return realpath(path);
+	};
+	const [selected, xcrun, xcodebuild] = await Promise.all([
+		commandPath("swift"),
+		commandPath("xcrun"),
+		commandPath("xcodebuild")
+	]);
+	const compiler = await realpath(await getExecutor().runFileAsync("/usr/bin/xcrun", ["--find", "swift"], {
+		cwd,
+		timeoutMs: 3e4
+	}));
+	const sdk = await realpath(context.env.SDKROOT ?? context.env.SWIFTPM_SDKROOT_macosx ?? await getExecutor().runFileAsync("/usr/bin/xcrun", [
+		"--sdk",
+		"macosx",
+		"--show-sdk-path"
+	], {
+		cwd,
+		timeoutMs: 3e4
+	}));
+	const overrides = {};
+	for (const variable of ["SWIFT_EXEC", "SWIFT_EXEC_MANIFEST"]) {
+		const command = context.env[variable];
+		if (!command) continue;
+		const version = await getExecutor().runFileAsync(command, ["--version"], {
+			cwd,
+			timeoutMs: 3e4,
+			declareFor: context
+		});
+		if (!version.trim()) throw new Error(`The SwiftPM ${variable} compiler identity is unavailable.`);
+		overrides[variable] = {
+			command: await commandPath(command),
+			version
+		};
+	}
+	const checkoutRequired = Object.keys(overrides).length > 0 || selected !== await realpath("/usr/bin/swift") && selected !== compiler || xcrun !== await realpath("/usr/bin/xcrun") || xcodebuild !== await realpath("/usr/bin/xcodebuild");
+	return {
+		...await readSwiftpmArtifactToolchain(context, void 0, cwd),
+		selection: {
+			command: selected,
+			compiler,
+			sdk,
+			xcrun,
+			xcodebuild,
+			overrides,
+			checkoutRequired
+		}
+	};
+}
+async function privateSnapshot(root, query, privateLockfile, toolchain, env, signal) {
+	const repository = resolve(root, ...query.project.split("/").filter(Boolean).map(() => ".."));
+	const declaration = swiftpmArtifactInputs(query.inputs);
+	return (await fingerprintNativeInputs([
+		...declaration.ignored.map((path) => ({
+			name: `ignored/${path}`,
+			path: join(repository, path)
+		})),
+		...declaration.localFiles.map((path, index) => ({
+			name: `local/${index}`,
+			path: resolve(root, path),
+			optional: true
+		})),
+		...privateLockfile ? [{
+			name: "package-resolved",
+			path: join(root, "Package.resolved"),
+			optional: true
+		}] : []
+	], {
+		parameters: {
+			toolchain,
+			environment: Object.fromEntries([.../* @__PURE__ */ new Set([
+				...declaration.environment,
+				"DEVELOPER_DIR",
+				"TOOLCHAINS",
+				"SDKROOT",
+				"SWIFT_EXEC",
+				"MACOSX_DEPLOYMENT_TARGET"
+			])].toSorted().map((name) => [name, env[name] ?? null]))
+		},
+		signal
+	})).hash;
+}
+/** Certifies actual worker inputs, not the client's transfer digest or cache identity. */
+async function swiftpmWorkerArtifactSnapshot(root, query, toolchain, env, signal) {
+	signal?.throwIfAborted();
+	root = await realpath(root);
+	const repository = await realpath(await gitAsync(root, ["rev-parse", "--show-toplevel"], { signal }));
+	const project = relative(repository, await realpath(root)).split(sep).join("/");
+	const visible = await sourceManifest(repository, true, signal);
+	if (query.project !== project || manifestDigest(visible) !== query.sourceDigest) throw new Error("The SwiftPM worker source does not match its completed transfer.");
+	const declaration = swiftpmArtifactInputs(query.inputs);
+	const build = {
+		...query.build,
+		resources: Object.fromEntries(Object.entries(query.build.resources).map(([name, path]) => [name, relative(root, resolve(repository, path))])),
+		assetCatalog: query.build.assetCatalog ? relative(root, resolve(repository, query.build.assetCatalog)) : null
+	};
+	const snapshot = await swiftpmArtifactSnapshot(root, declaration, build, {
+		swift: toolchain.swift,
+		sdk: toolchain.sdk,
+		xcode: toolchain.xcode,
+		arch: toolchain.arch
+	}, env, signal);
+	const sourcePaths = new Set(visible.map((file) => file.path));
+	const privatePaths = /* @__PURE__ */ new Set([...declaration.ignored.map((path) => resolve(repository, path)), ...declaration.localFiles.map((path) => resolve(root, path))]);
+	for (const path of [
+		build.infoPlist,
+		...Object.values(build.resources),
+		build.assetCatalog
+	]) {
+		if (path === null) continue;
+		const absolute = resolve(root, path);
+		const bundled = await fingerprintNativeInputs([{
+			name: "bundle",
+			path: absolute
+		}], {
+			parameters: null,
+			signal
+		});
+		for (const entry of bundled.entries) {
+			if (entry.kind === "directory") continue;
+			const file = join(absolute, entry.path === "bundle" ? "" : entry.path.slice(7));
+			const name = relative(repository, file).split(sep).join("/");
+			if (!entry.kind.startsWith("file:") || !sourcePaths.has(name) && !privatePaths.has(file)) throw new Error("SwiftPM peer caching requires every ignored bundle file in the private input declaration.");
+		}
+	}
+	const privateLockfile = !sourcePaths.has([project, "Package.resolved"].filter(Boolean).join("/"));
+	const privateHash = await privateSnapshot(root, query, privateLockfile, toolchain, env, signal);
+	const hash = createHash("sha256").update(JSON.stringify([
+		"stim-swiftpm-worker-v1",
+		snapshot.hash,
+		query,
+		privateHash
+	])).digest("hex");
+	const identity = {
+		hash,
+		key: `swiftpm-peer-${hash}`
+	};
+	return {
+		identity,
+		receipt: {
+			query: structuredClone(query),
+			identity,
+			privateHash,
+			privateLockfile,
+			checkoutRequired: toolchain.selection.checkoutRequired
+		}
+	};
+}
+/** Revalidates private inputs of a receipt bound to a verified completed source transfer. */
+async function swiftpmArtifactFromReceipt(root, query, receipt, toolchain, env, signal) {
+	signal?.throwIfAborted();
+	if (!isDeepStrictEqual(query, receipt.query) || typeof receipt.checkoutRequired !== "boolean" || receipt.checkoutRequired !== toolchain.selection.checkoutRequired || !/^[a-f0-9]{64}$/.test(receipt.identity.hash) || receipt.identity.key !== `swiftpm-peer-${receipt.identity.hash}`) return null;
+	return await privateSnapshot(root, query, receipt.privateLockfile, toolchain, env, signal) === receipt.privateHash ? receipt.identity : null;
+}
+//#endregion
 //#region src/offload/worker.ts
 function emit(value) {
 	process.stdout.write(`${JSON.stringify(value)}\n`);
@@ -90,13 +264,85 @@ function ensureParents(root, path) {
 		mkdirSync(current);
 	}
 }
-function materialize(job, src) {
+const PRIVATE_DIRS = [
+	"$ErrorActionPreference = 'Stop'",
+	"$me = [Security.Principal.WindowsIdentity]::GetCurrent().User",
+	"$acl = New-Object Security.AccessControl.DirectorySecurity",
+	"$acl.SetAccessRuleProtection($true, $false)",
+	"foreach ($sid in @($me, (New-Object Security.Principal.SecurityIdentifier 'S-1-5-18'))) {",
+	"  $acl.AddAccessRule((New-Object Security.AccessControl.FileSystemAccessRule($sid, 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow')))",
+	"}",
+	"foreach ($line in [Console]::In.ReadToEnd().Split([char]10) | ForEach-Object { $_.Trim() } | Where-Object { $_ }) {",
+	"  $dir, $key = $line.Split([char]9)",
+	"  [void][IO.Directory]::CreateDirectory($dir, $acl)",
+	"  $current = Get-Acl -LiteralPath $dir",
+	"  $owner = $current.GetOwner([Security.Principal.SecurityIdentifier]).Value",
+	"  if ($owner -notin @($me.Value, 'S-1-5-32-544', 'S-1-5-18')) { [Console]::Error.WriteLine(\"$dir is owned by $owner\"); exit 3 }",
+	"  $foreign = $current.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier]) | Where-Object { $_.IdentityReference.Value -notin @($me.Value, 'S-1-5-18') }",
+	"  if (-not $current.AreAccessRulesProtected -or $foreign) { Set-Acl -LiteralPath $dir -AclObject $acl }",
+	"  if ($key) {",
+	"    $marker = \"$dir.owner\"",
+	"    if (-not (Test-Path -LiteralPath $marker)) { Set-Content -NoNewline -LiteralPath $marker -Value $key }",
+	"    elseif ((Get-Content -Raw -LiteralPath $marker) -ne $key) { [Console]::Error.WriteLine(\"$dir belongs to another build area\"); exit 4 }",
+	"  }",
+	"}"
+].join("\n");
+/**
+* Creates each directory, in order, with access for this user and SYSTEM only, and gives an existing one that ACL.
+* A directory at the drive root inherits the root's ACL, which lets every authenticated user modify it, so another
+* account could plant code in a build; one that another account owns could hold such code, so it is refused. A
+* directory with a key records it in `<dir>.owner` and is refused when another key is recorded there, since the
+* short names of different areas can collide.
+*/
+function makePrivateWindowsDirs(dirs) {
+	try {
+		getExecutor().runFile("powershell.exe", [
+			"-NoProfile",
+			"-NonInteractive",
+			"-Command",
+			PRIVATE_DIRS
+		], {
+			input: dirs.map((entry) => entry.join("	")).join("\n"),
+			timeoutMs: 6e4
+		});
+	} catch (error) {
+		const reason = (error instanceof Error ? error.message : String(error)).trim().split("\n").at(-1);
+		throw new Error(`Could not prepare the private Windows build directories: ${reason}`, { cause: error });
+	}
+}
+/**
+* Creates the checkout directory `src` of `area`. On Windows it is a junction to a private `windowsShortDir`, and the
+* client's Gradle home is made private too; an area whose `src` is a directory keeps it.
+*/
+function ensureCheckout(area, src) {
+	const stat = lstatSync(src, { throwIfNoEntry: false });
+	if (process.platform === "win32") {
+		const linked = !stat || stat.isSymbolicLink();
+		const realArea = realpathSync(area);
+		const target = windowsShortDir(realArea);
+		const gradleHome = process.env.GRADLE_USER_HOME;
+		const dirs = [[dirname(target)]];
+		if (linked) dirs.push([target, windowsShortDirKey("checkout", realArea)]);
+		if (gradleHome) dirs.push([gradleHome, windowsShortDirKey("gradle", dirname(dirname(area)))]);
+		makePrivateWindowsDirs(dirs);
+		if (!linked) return;
+		let current = null;
+		try {
+			current = realpathSync(src);
+		} catch {}
+		if (current?.toLowerCase() === target.toLowerCase()) return;
+		if (stat) rmSync(src, { force: true });
+		symlinkSync(target, src, "junction");
+		return;
+	}
+	mkdirSync(src, { recursive: true });
+}
+async function materialize(job, src) {
 	const recordFile = join(job.area, "mirror.json");
 	let previous = {};
 	try {
 		previous = JSON.parse(readFileSync(recordFile, "utf8"));
 	} catch {}
-	mkdirSync(src, { recursive: true });
 	if (!existsSync(join(src, ".git"))) {
 		git(src, ["init", "--quiet"], {
 			write: true,
@@ -126,7 +372,7 @@ function materialize(job, src) {
 			} catch {}
 			const allowed = [...declaration.outputs, ...gradleStateDirectories(job.project)];
 			if (receipt.project === job.project && Array.isArray(receipt.directories)) retained = allowed.filter((path) => receipt.directories.includes(path));
-			retained = nativeGradleOutputs(src, {
+			retained = await nativeGradleOutputs(src, {
 				complete: true,
 				ignored: [],
 				outputs: retained
@@ -238,42 +484,18 @@ function materialize(job, src) {
 		removed
 	};
 }
-function lockfileOf(src) {
-	if (existsSync(join(src, "pnpm-lock.yaml"))) return {
-		file: "pnpm-lock.yaml",
-		command: "pnpm",
-		args: (pkg) => [
-			"install",
-			"--frozen-lockfile",
-			...pkg ? ["--filter", `${pkg}...`] : []
-		]
-	};
-	if (existsSync(join(src, "yarn.lock"))) return {
-		file: "yarn.lock",
-		command: "yarn",
-		args: () => ["install", "--frozen-lockfile"]
-	};
-	if (existsSync(join(src, "package-lock.json"))) return {
-		file: "package-lock.json",
-		command: "npm",
-		args: () => ["ci"]
-	};
-	return null;
-}
 /** Installs JavaScript dependencies when the lockfile, or the install command, changed since the last install. */
 async function ensureDependencies(job, src) {
-	const lock = lockfileOf(src);
-	if (!lock) return;
-	const args = lock.args(job.packageName);
-	const lockfile = readFileSync(join(src, lock.file));
-	const digest = createHash("sha256").update(lockfile).update(JSON.stringify(args)).digest("hex");
+	const install = dependencyInstall(src, job.packageName);
+	if (!install) return;
+	const { command, args, digest, lockfile } = install;
 	const marker = join(job.area, "dependencies");
-	const installed = () => writeFileSync(join(job.area, "lockfile"), createHash("sha256").update(lockfile).digest("hex"));
+	const installed = () => writeFileSync(join(job.area, "lockfile"), lockfile);
 	if (existsSync(join(src, job.project, "node_modules")) && existsSync(marker)) {
 		if (readFileSync(marker, "utf8") === digest) return installed();
 	}
-	note("deps", `${lock.command} ${args.join(" ")}`);
-	const child = getExecutor().spawn(lock.command, args, {
+	note("deps", `${command} ${args.join(" ")}`);
+	const child = getExecutor().spawn(command, args, {
 		cwd: src,
 		env: {
 			...process.env,
@@ -296,7 +518,7 @@ async function ensureDependencies(job, src) {
 		child.on("error", reject);
 		child.on("exit", resolve);
 	});
-	if (code !== 0) throw new Error(`${lock.command} ${args.join(" ")} exited with ${code}: ${tail.join(" | ")}`);
+	if (code !== 0) throw new Error(`${command} ${args.join(" ")} exited with ${code}: ${tail.join(" | ")}`);
 	writeFileSync(marker, digest);
 	installed();
 }
@@ -312,12 +534,55 @@ function destination(runtime) {
 			"devices",
 			"available",
 			"-j"
-		], { timeoutMs: 2e4 }) ?? "{}").devices?.[runtime] ?? []).find((each) => each.name.startsWith("iPhone"));
+		], { timeoutMs: 2e4 }) ?? "{}").devices?.[runtime] ?? []).find(availableIphone);
 		return device ? `id=${device.udid}` : null;
 	} catch {
 		return null;
 	}
 }
+/**
+* Writes `name` under `dir` to `archive` as a gzip tarball at compression level 1. Node does the gzip because tar's
+* compression-level flags differ between bsdtar (macOS, Windows) and GNU tar (Linux).
+*/
+async function packArchive(archive, dir, name) {
+	const child = getExecutor().spawn("tar", [
+		"-cf",
+		"-",
+		"-C",
+		dir,
+		name
+	], { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] });
+	const tarball = child.stdout;
+	if (!tarball) throw new Error("tar opened no output stream.");
+	const stderr = [];
+	child.stderr?.on("data", (chunk) => stderr.push(String(chunk)));
+	let spawnError = null;
+	const exited = new Promise((resolve) => {
+		child.once("error", (error) => {
+			spawnError = error;
+			resolve(null);
+		});
+		child.once("close", resolve);
+	});
+	const timeout = new AbortController();
+	const timer = setTimeout(() => timeout.abort(), 6e5);
+	try {
+		await pipeline(tarball, createGzip({ level: 1 }), createWriteStream(archive), { signal: timeout.signal });
+	} catch (error) {
+		child.kill("SIGKILL");
+		await exited;
+		throw timeout.signal.aborted ? /* @__PURE__ */ new Error("Packing the artifact did not finish within 10 minutes.") : error;
+	} finally {
+		clearTimeout(timer);
+	}
+	const code = await exited;
+	if (spawnError) throw spawnError;
+	if (code !== 0) throw new Error(`tar exited with ${code}: ${stderr.join("").trim().slice(-500)}`);
+}
 async function sha256Of(path) {
 	const hash = createHash("sha256");
 	for await (const chunk of createReadStream(path)) hash.update(chunk);
@@ -347,13 +612,14 @@ async function build(job) {
 		message,
 		timings
 	});
-	const src = join(job.area, "src");
+	ensureCheckout(job.area, join(job.area, "src"));
+	const src = realpathSync(join(job.area, "src"));
 	const root = join(src, job.project);
 	const log = relayWriter(join(job.area, "build.ndjson"));
 	const mirrored = await time("syncMs", () => materialize(job, src));
 	const realSrc = realpathSync(src);
 	const realRoot = realpathSync(root);
-	if (realRoot !== realSrc && !realRoot.startsWith(`${realSrc}/`)) return failed("bad-project", `${job.project} leaves the checkout.`);
+	if (realRoot !== realSrc && !realRoot.startsWith(`${realSrc}${sep}`)) return failed("bad-project", `${job.project} leaves the checkout.`);
 	note("sync", `${job.manifest.length} files, ${mirrored.written} written, ${mirrored.removed} removed`);
 	let fingerprint;
 	let compiled;
@@ -361,21 +627,11 @@ async function build(job) {
 		if (job.platform !== "android" || job.expectedFingerprint !== null) return failed("unsupported-provider", "Native Gradle needs an Android request with no reusable artifact identity.");
 		const selected = projectRegistry.selectAndroid(root);
 		if ("problem" in selected || selected.id !== "native-android") return failed("provider-mismatch", "The transferred project did not select the native Android integration.");
-		if (!verifyGradleTransfer(src, job.project, job.native.inputs, job.manifest, job.native.sourceDigest)) return failed("source-mismatch", "The materialized native inputs do not match the source transfer.");
+		if (!await verifyGradleTransfer(src, job.project, job.native.inputs, job.manifest, job.native.sourceDigest)) return failed("source-mismatch", "The materialized native inputs do not match the source transfer.");
 		compiled = await compileNativeAndroid(job, root, log, time);
 		if (!compiled.ok) return failed(compiled.code, compiled.message);
 		try {
-			const model = JSON.parse(readFileSync(join(workspaceDir(root), "gradle-build", `native-apk-${encodeURIComponent(job.android?.variant ?? "debug")}.json`), "utf8"));
-			const outputs = nativeGradleOutputs(src, job.native.inputs, model.buildDirectories);
-			if (!verifyGradleTransfer(src, job.project, job.native.inputs, job.manifest, job.native.sourceDigest)) throw new Error("The native source changed while the worker compiled it.");
-			const directories = [...outputs, ...gradleStateDirectories(job.project).filter((path) => lstatSync(join(src, path), { throwIfNoEntry: false })?.isDirectory())];
-			const receipt = join(job.area, "gradle-outputs.json");
-			const tmp = `${receipt}.${process.pid}.tmp`;
-			writeFileSync(tmp, JSON.stringify({
-				project: job.project,
-				directories
-			}));
-			renameSync(tmp, receipt);
+			if (!await verifyGradleTransfer(src, job.project, job.native.inputs, job.manifest, job.native.sourceDigest)) throw new Error("The native source changed while the worker compiled it.");
 		} catch (error) {
 			if (compiled.temporary) rmSync(compiled.temporary, {
 				recursive: true,
@@ -391,7 +647,7 @@ async function build(job) {
 		let metadataDirectories;
 		try {
 			metadataDirectories = nativeXcodeMetadataDirectories(selectNativeXcodeProject(root, job.scheme ?? void 0, job.configuration ?? void 0));
-			if (!verifyNativeTransfer(src, job.manifest, job.native.sourceDigest, metadataDirectories)) return failed("source-mismatch", "The materialized native inputs do not match the source transfer.");
+			if (!await verifyNativeTransfer(src, job.manifest, job.native.sourceDigest, metadataDirectories)) return failed("source-mismatch", "The materialized native inputs do not match the source transfer.");
 		} catch (error) {
 			return failed("source-mismatch", error.message);
 		}
@@ -401,7 +657,7 @@ async function build(job) {
 		compiled = await compileNativeIos(job, root, log, time);
 		if (!compiled.ok) return failed(compiled.code, compiled.message);
 		try {
-			if (!verifyNativeTransfer(src, job.manifest, job.native.sourceDigest, metadataDirectories)) throw new Error("The native source changed while the worker compiled it.");
+			if (!await verifyNativeTransfer(src, job.manifest, job.native.sourceDigest, metadataDirectories)) throw new Error("The native source changed while the worker compiled it.");
 		} catch (error) {
 			if (compiled.temporary) rmSync(compiled.temporary, {
 				recursive: true,
@@ -413,7 +669,7 @@ async function build(job) {
 	} else if (job.platform === "macos") {
 		fingerprint = await time("fingerprintMs", () => manifestDigest(job.manifest));
 		if (fingerprint !== job.expectedFingerprint) return failed("fingerprint-mismatch", `the manifest there fingerprints ${fingerprint.slice(0, 12)}, here ${job.expectedFingerprint?.slice(0, 12)}`);
-		compiled = await compileMacos(job, root, log, time);
+		compiled = await workerOperation(root, (context) => compileMacos(context, job, root, log, time));
 		if (!compiled.ok) return failed(compiled.code, compiled.message);
 	} else {
 		try {
@@ -424,7 +680,7 @@ async function build(job) {
 		const platform = job.platform;
 		let iosProject;
 		try {
-			iosProject = iosProjectDirSetting({ ios: { projectPath: job.iosProjectPath ?? void 0 } }, root);
+			iosProject = iosProjectDirSetting({ ios: { projectPath: job.iosProjectPath ?? void 0 } }, realRoot);
 		} catch (error) {
 			return failed("bad-request", error.message);
 		}
@@ -433,17 +689,17 @@ async function build(job) {
 			androidLayout = androidLayoutSetting({ android: {
 				gradleRoot: job.android?.gradleRoot ?? void 0,
 				module: job.android?.module ?? void 0
-			} }, root, realSrc);
+			} }, realRoot, realSrc);
 		} catch (error) {
 			return failed("bad-request", error.message);
 		}
-		const initial = await time("fingerprintMs", () => fingerprintProject(root, {
+		const initial = await time("fingerprintMs", () => fingerprintProject(realRoot, {
 			platform,
 			iosProjectPath: iosProject.relative,
 			androidLayout
 		}));
-		if (!initial) return failed("no-fingerprint", "The remote Mac could not fingerprint the project.");
-		const plan = planPrebuild(root, platform, {
+		if (!initial) return failed("no-fingerprint", "The remote machine could not fingerprint the project.");
+		const plan = planPrebuild(realRoot, platform, {
 			isExpo: job.isExpo,
 			fingerprint: initial.hash,
 			sources: initial.sources
@@ -452,17 +708,17 @@ async function build(job) {
 		const mutations = [];
 		if (plan === "generate" || plan === "regenerate") {
 			note("prebuild", plan === "generate" ? `generating ${platform}/` : `regenerating ${platform}/ with --clean`);
-			recordPrebuild(root, platform, null);
-			const result = await time("prebuildMs", () => runPrebuild(root, platform, log, { clean: plan === "regenerate" }));
+			recordPrebuild(realRoot, platform, null);
+			const result = await time("prebuildMs", () => runPrebuild(realRoot, platform, log, { clean: plan === "regenerate" }));
 			if (result?.failed) return failed("prebuild-failed", result.reason ?? "expo prebuild failed.");
 			mutations.push("prebuild");
 		}
 		if (platform === "ios") {
-			const podState = readPodState(root, iosProject.dir);
+			const podState = readPodState(realRoot, iosProject.dir);
 			const pods = podAction(podState, podsAreStale(podState.lockText, podState.manifestText, podState.dir));
 			if (pods.install) {
 				note("pods", `${pods.reason ?? "Pods are stale"} -> pod install`);
-				const result = await time("podsMs", () => runPodInstall(root, log, {
+				const result = await time("podsMs", () => runPodInstall(realRoot, log, {
 					directory: iosProject.dir,
 					onHeartbeat: (line) => note("pods", line)
 				}));
@@ -473,7 +729,7 @@ async function build(job) {
 		fingerprint = initial.hash;
 		if (mutations.length) {
 			const after = await time("fingerprintMs", () => refingerprintAfterMutation({
-				projectRoot: root,
+				projectRoot: realRoot,
 				platform,
 				previousHash: initial.hash,
 				iosProjectPath: iosProject.relative,
@@ -481,20 +737,25 @@ async function build(job) {
 			}));
 			if (!after) return failed("no-fingerprint", `No fingerprint after ${mutations.join(", ")}.`);
 			fingerprint = after.hash;
-			if (mutations.includes("prebuild")) recordPrebuild(root, platform, after.hash);
+			if (mutations.includes("prebuild")) recordPrebuild(realRoot, platform, after.hash);
 		}
 		if (fingerprint !== job.expectedFingerprint) return failed("fingerprint-mismatch", `the checkout there fingerprints ${fingerprint.slice(0, 12)}, here ${job.expectedFingerprint?.slice(0, 12)}`);
-		compiled = platform === "android" ? await compileAndroid(job, root, log, time, androidLayout) : await compileIos(job, root, log, time);
+		const tools = job.cacheArtifact ? await reactNativeArtifactToolchain(platform, realRoot) : null;
+		const query = tools ? reactNativeBuildQuery(job, fingerprint, job.project, tools) : null;
+		const receipt = query ? reactNativeArtifactReceipt(query, tools) : null;
+		compiled = platform === "android" ? await compileAndroid(job, realRoot, log, time, androidLayout) : await compileIos(job, realRoot, log, time);
 		if (!compiled.ok) return failed(compiled.code, compiled.message);
 		const builtFingerprint = fingerprint;
 		const settled = await time("fingerprintMs", () => refingerprintAfterMutation({
-			projectRoot: root,
+			projectRoot: realRoot,
 			platform,
 			previousHash: builtFingerprint,
 			iosProjectPath: iosProject.relative,
 			androidLayout
 		}));
 		if (!settled || settled.moved) return failed("fingerprint-moved", "The inputs changed during the build there.");
+		const after = query && receipt ? reactNativeArtifactReceipt(query, await reactNativeArtifactToolchain(platform, realRoot)) : null;
+		if (receipt && after && isDeepStrictEqual(receipt, after)) compiled.reactNativeArtifact = receipt;
 	}
 	try {
 		const out = join(job.area, "out", job.job);
@@ -510,15 +771,7 @@ async function build(job) {
 			verbatimSymlinks: true,
 			mode: constants.COPYFILE_FICLONE
 		});
-		await time("packageMs", () => getExecutor().runFileAsync("tar", [
-			"-czf",
-			archive,
-			"--options",
-			"gzip:compression-level=1",
-			"-C",
-			dirname(compiled.path),
-			name
-		], { timeoutMs: 6e5 }));
+		await time("packageMs", () => packArchive(archive, dirname(compiled.path), name));
 		const sha256 = await time("packageMs", () => sha256Of(archive));
 		return {
 			ok: true,
@@ -531,6 +784,9 @@ async function build(job) {
 			fingerprint,
 			...compiled.androidPackage ? { androidPackage: compiled.androidPackage } : {},
 			...job.native ? { sourceDigest: job.native.sourceDigest } : {},
+			...compiled.cacheArtifact ? { cacheArtifact: compiled.cacheArtifact } : {},
+			...compiled.reactNativeArtifact ? { reactNativeArtifact: compiled.reactNativeArtifact } : {},
+			...compiled.swiftpmArtifact ? { swiftpmArtifact: compiled.swiftpmArtifact } : {},
 			compilationCache: compiled.cache,
 			timings
 		};
@@ -541,12 +797,9 @@ async function build(job) {
 		});
 	}
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function differingParameters(here, there, path) {
 	if (JSON.stringify(here) === JSON.stringify(there)) return [];
-	if (!isRecord(here) || !isRecord(there)) return [path];
+	if (!isJsonObject(here) || !isJsonObject(there)) return [path];
 	return [.../* @__PURE__ */ new Set([...Object.keys(here), ...Object.keys(there)])].toSorted().flatMap((key) => differingParameters(here[key], there[key], `${path}.${key}`));
 }
 function unused() {
@@ -593,6 +846,10 @@ async function nativeIdentityRefusal(job, native, root, load) {
 		return `This Mac cannot key the native build: ${error.message}`;
 	}
 }
+function workerOperation(root, fn) {
+	const context = processContext(root, new AbortController().signal);
+	return withAmbientContext(context, () => fn(context));
+}
 async function compileNativeIos(job, root, log, time) {
 	if (job.native?.provider !== "xcode" || !job.optimizations) return {
 		ok: false,
@@ -612,15 +869,15 @@ async function compileNativeIos(job, root, log, time) {
 		}, `optimizations.ios.${key}`, value ?? void 0);
 	}
 	note("build", `native Xcode ${job.configuration ?? "Debug"}`);
-	const logFile = join(workspaceLogsDir(root), "build-ios.ndjson");
+	const logFile = join(workspaceLogsDir$1(root), "build-ios.ndjson");
 	try {
 		rmSync(logFile, { force: true });
-		const built = await time("buildMs", () => buildIosOperation(root, {
+		const built = await time("buildMs", () => workerOperation(root, (context) => buildIosOperation(context, root, {
 			scheme: job.scheme ?? void 0,
 			configuration: job.configuration ?? void 0,
 			arch: native.arch ?? "all",
 			remoteBuild: "local"
-		}));
+		})));
 		if (built.cacheKey !== native.cacheKey || built.cacheSkipped) {
 			rmSync(dirname(built.appPath), {
 				recursive: true,
@@ -639,6 +896,14 @@ async function compileNativeIos(job, root, log, time) {
 			temporary: dirname(built.appPath)
 		};
 	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "STIM_COMPILATION_CACHE_CORRUPT") {
+			const remedy = "remedy" in error && typeof error.remedy === "string" ? ` ${error.remedy}` : "";
+			return {
+				ok: false,
+				code: COMPILATION_CACHE_CORRUPT,
+				message: `${error.message}${remedy}`
+			};
+		}
 		return {
 			ok: false,
 			code: "native-build-failed",
@@ -648,6 +913,25 @@ async function compileNativeIos(job, root, log, time) {
 		if (existsSync(logFile)) for (const record of parseNdjsonText(readFileSync(logFile, "utf8"))) log.write(record);
 	}
 }
+async function validateNativeAndroidOutputs(job, root) {
+	if (job.native?.provider !== "gradle") throw new Error("A native Gradle source declaration is required.");
+	try {
+		const src = realpathSync(join(job.area, "src"));
+		const model = JSON.parse(readFileSync(join(workspaceDir(root), "gradle-build", `native-apk-${encodeURIComponent(job.android?.variant ?? "debug")}.json`), "utf8"));
+		const outputs = await nativeGradleOutputs(src, job.native.inputs, model.buildDirectories);
+		if (!await verifyGradleTransfer(src, job.project, job.native.inputs, job.manifest, job.native.sourceDigest)) throw new Error("The native source changed while the worker compiled it.");
+		const directories = [...outputs, ...gradleStateDirectories(job.project).filter((path) => lstatSync(join(src, path), { throwIfNoEntry: false })?.isDirectory())];
+		const receipt = join(job.area, "gradle-outputs.json");
+		const tmp = `${receipt}.${process.pid}.tmp`;
+		writeFileSync(tmp, JSON.stringify({
+			project: job.project,
+			directories
+		}));
+		renameSync(tmp, receipt);
+	} catch (error) {
+		throw Object.assign(new Error(error.message), { code: "source-moved" });
+	}
+}
 async function compileNativeAndroid(job, root, log, time) {
 	const options = job.android;
 	if (!options) return {
@@ -671,24 +955,41 @@ async function compileNativeAndroid(job, root, log, time) {
 		process.exit(143);
 	};
 	process.once("SIGTERM", stop);
-	const logFile = join(workspaceLogsDir(root), "build-android.ndjson");
+	const logFile = join(workspaceLogsDir$1(root), "build-android.ndjson");
+	let cacheArtifact;
 	note("build", `native Gradle ${options.variant ?? "debug"}`);
 	try {
 		rmSync(logFile, { force: true });
-		const built = await time("buildMs", () => buildAndroidOperation(root, {
+		const built = await time("buildMs", () => workerOperation(root, (context) => buildAndroidOperation(context, root, {
 			variant: options.variant ?? void 0,
 			abi: options.abi ?? "all",
 			remoteBuild: "local"
-		}));
-		if (built.cacheKey !== null || !built.cacheSkipped || !built.androidPackage) {
+		}, {
+			cachePolicy: job.native?.provider === "gradle" && job.native.cache ? job.native.cache : {
+				read: false,
+				write: false,
+				remote: false
+			},
+			artifactScope: {
+				key: job.native?.provider === "gradle" ? nativeGradleWorkerScope(job.native.sourceDigest, job.native.inputs) : "null",
+				validate: () => validateNativeAndroidOutputs(job, root),
+				record: (identity, receipt) => {
+					cacheArtifact = {
+						identity,
+						receipt
+					};
+				}
+			}
+		})));
+		if (!built.androidPackage) {
 			rmSync(dirname(built.apkPath), {
 				recursive: true,
 				force: true
 			});
 			return {
 				ok: false,
-				code: "unexpected-cache-identity",
-				message: "The native Gradle worker returned an unsupported artifact identity or package."
+				code: "invalid-package",
+				message: "The native Gradle worker returned no verified APK package."
 			};
 		}
 		return {
@@ -696,12 +997,13 @@ async function compileNativeAndroid(job, root, log, time) {
 			path: built.apkPath,
 			temporary: dirname(built.apkPath),
 			cache: built.ccache,
-			androidPackage: built.androidPackage
+			androidPackage: built.androidPackage,
+			...cacheArtifact && cacheArtifact.identity.key === built.cacheKey ? { cacheArtifact } : {}
 		};
 	} catch (error) {
 		return {
 			ok: false,
-			code: "native-build-failed",
+			code: error instanceof Error && "code" in error && error.code === "source-moved" ? "source-moved" : "native-build-failed",
 			message: error.message
 		};
 	} finally {
@@ -710,7 +1012,7 @@ async function compileNativeAndroid(job, root, log, time) {
 		if (existsSync(logFile)) for (const record of parseNdjsonText(readFileSync(logFile, "utf8"))) log.write(record);
 	}
 }
-async function compileMacos(job, root, log, time) {
+async function compileMacos(context, job, root, log, time) {
 	const options = job.macos;
 	if (!options) return {
 		ok: false,
@@ -757,6 +1059,26 @@ async function compileMacos(job, root, log, time) {
 	};
 	try {
 		const extras = resolveBundleExtras(src, src, options.resources, options.assetCatalog);
+		const query = job.cacheArtifact && options.artifactInputs && job.expectedFingerprint && job.stimBuild ? {
+			project: job.project,
+			sourceDigest: job.expectedFingerprint,
+			stimBuild: job.stimBuild,
+			inputs: options.artifactInputs,
+			build: {
+				product: options.product,
+				infoPlist: options.infoPlist,
+				resources: options.resources ?? {},
+				assetCatalog: options.assetCatalog ?? null
+			}
+		} : null;
+		const snapshot = async () => query ? swiftpmWorkerArtifactSnapshot(root, query, await readSwiftpmWorkerToolchain(context, root), context.env) : null;
+		let before = null;
+		try {
+			before = await snapshot();
+		} catch (error) {
+			context.signal.throwIfAborted();
+			note("build", `SwiftPM artifact inventory unavailable: ${String(error)}`);
+		}
 		return await time("buildMs", async () => {
 			await run([
 				"build",
@@ -780,11 +1102,21 @@ async function compileMacos(job, root, log, time) {
 				"--show-bin-path"
 			], true);
 			const bundle = join(job.area, "out", job.job, `${options.product}.app`);
-			stageBundle(root, options.product, options.infoPlist, bin, bundle, options.bundleId, extras);
+			await stageBundle(context, root, options.product, options.infoPlist, bin, bundle, options.bundleId, extras);
+			let swiftpmArtifact = null;
+			if (before) try {
+				const after = await snapshot();
+				if (after?.identity.hash === before.identity.hash) swiftpmArtifact = after;
+				else note("build", "SwiftPM inputs changed during the build; not retaining its artifact.");
+			} catch (error) {
+				context.signal.throwIfAborted();
+				note("build", `SwiftPM artifact inventory skipped: ${String(error)}`);
+			}
 			return {
 				ok: true,
 				path: bundle,
-				cache: {}
+				cache: {},
+				...swiftpmArtifact ? { swiftpmArtifact } : {}
 			};
 		});
 	} catch (error) {
@@ -816,6 +1148,14 @@ async function compileIos(job, root, log, time) {
 		onNote: (line) => note("build", line)
 	}));
 	if (!built.ok) {
+		if (built.compilationCacheCorruption) {
+			const report = await clearCorruptCompilationCache(built.compilationCacheCorruption, root);
+			return {
+				ok: false,
+				code: report.code,
+				message: `${report.message} ${report.remedy}`
+			};
+		}
 		const first = built.diagnostics[0]?.message;
 		return {
 			ok: false,
@@ -899,10 +1239,12 @@ async function compileAndroid(job, root, log, time, layout) {
 				message: first ?? (built.lastLines.slice(-3).join(" | ") || built.reason)
 			};
 		}
+		const androidPackage = built.androidPackage ?? apkPackage(await dumpApkManifest(built.apkPath));
 		return {
 			ok: true,
 			path: built.apkPath,
-			cache: built.ccache ?? CCACHE_UNAVAILABLE
+			cache: built.ccache ?? CCACHE_UNAVAILABLE,
+			...androidPackage ? { androidPackage } : {}
 		};
 	} finally {
 		process.off("SIGTERM", stop);
@@ -914,6 +1256,27 @@ async function main() {
 	if (mode === "offer") return emit(workerToolchain(process.argv[3] ?? null));
 	if (mode === "offer-native-xcode") return emit(workerToolchain(null, "xcode"));
 	if (mode === "offer-native-gradle") return emit(workerToolchain(null, "gradle"));
+	if (mode === "native-gradle-artifact") {
+		const chunks = [];
+		for await (const chunk of process.stdin) chunks.push(chunk);
+		const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+		if (!/^[a-f0-9]{64}$/.test(input.sourceDigest)) throw new Error("The completed transfer identity is invalid.");
+		gradleOffloadInputs(input.inputs);
+		if (input.android) {
+			const { android, receipt } = input;
+			if (android.variant !== null && android.variant !== receipt.build.variant || (android.abi === "all" ? null : android.abi) !== receipt.abi || android.compilerCache !== receipt.build.compilerCache || android.gradleBuildCache !== receipt.build.gradleBuildCache || android.pch !== receipt.build.pch || receipt.build.cas !== null) throw new Error("The completed Gradle build choices do not match this artifact request.");
+		}
+		const snapshot = await workerOperation(input.root, (context) => nativeGradleArtifactSnapshotFromReceipt(input.root, input.receipt, context.env, context.signal));
+		return emit({ identity: nativeGradleWorkerArtifactIdentity(snapshot.hash, nativeGradleWorkerScope(input.sourceDigest, input.inputs), input.receipt.build.variant ?? "debug", input.receipt.abi) });
+	}
+	if (mode === "swiftpm-artifact") {
+		const chunks = [];
+		for await (const chunk of process.stdin) chunks.push(chunk);
+		const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+		const checkout = existsSync(input.root);
+		if (!checkout && input.receipt.checkoutRequired !== false) return emit({ identity: null });
+		return emit({ identity: await workerOperation(input.root, async (context) => swiftpmArtifactFromReceipt(input.root, input.query, input.receipt, await readSwiftpmWorkerToolchain(context, checkout ? input.root : process.cwd()), context.env)) });
+	}
 	if (mode === "build") {
 		const chunks = [];
 		for await (const chunk of process.stdin) chunks.push(chunk);
@@ -922,7 +1285,7 @@ async function main() {
 			...await build(JSON.parse(Buffer.concat(chunks).toString("utf8")))
 		});
 	}
-	process.stderr.write("usage: offload-worker offer | offer-native-xcode | offer-native-gradle | build < job.json\n");
+	process.stderr.write("usage: offload-worker offer | offer-native-xcode | offer-native-gradle | native-gradle-artifact | build < job.json\n");
 	process.exitCode = 2;
 }
 main().catch((error) => {