stim 1.20.2 → 1.22.0

package/dist/settings.schema.json

@@ -287,7 +287,7 @@
           }
         },
         "remote": {
-          "description": "Default iOS remote target: eas, proxy, or an approved Mac in remote.machines; auto places on an approved Mac when this Mac is full or busy; local runs here, overriding a lower layer",
+          "description": "Default iOS remote target: eas, proxy, or an approved Mac in remote.machines; auto places on an approved Mac when this machine is full or busy; local runs here, overriding a lower layer",
           "type": "string",
           "pattern": "^[A-Za-z0-9][A-Za-z0-9.-]*(?::(?!0+$)(?:[0-5]?[0-9]{1,4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$",
           "x-stim": {
@@ -490,6 +490,19 @@
             ]
           }
         },
+        "artifactInputs": {
+          "description": "Complete repeatable native Gradle inputs for local APK caching, including declared local files and environment names",
+          "type": "object",
+          "x-stim": {
+            "key": "android.artifactInputs",
+            "kind": "object",
+            "scopes": [
+              "workspace",
+              "repo",
+              "committed"
+            ]
+          }
+        },
         "offloadInputs": {
           "description": "Native Gradle source sufficiency, exact ignored inputs and generated output directories for build workers",
           "type": "object",
@@ -532,7 +545,7 @@
           }
         },
         "remote": {
-          "description": "Default Android remote target: eas, proxy, or an approved Mac in remote.machines; auto places on an approved Mac when this Mac is full or busy; local runs here, overriding a lower layer",
+          "description": "Default Android remote target: eas, proxy, or an approved Mac in remote.machines; auto places on an approved Mac when this machine is full or busy; local runs here, overriding a lower layer",
           "type": "string",
           "pattern": "^[A-Za-z0-9][A-Za-z0-9.-]*(?::(?!0+$)(?:[0-5]?[0-9]{1,4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$",
           "x-stim": {
@@ -750,6 +763,19 @@
             "relative": true
           }
         },
+        "artifactInputs": {
+          "description": "Complete pinned, repeatable SwiftPM inputs producing a relocatable app for completed artifact caching.",
+          "type": "object",
+          "x-stim": {
+            "key": "macos.artifactInputs",
+            "kind": "object",
+            "scopes": [
+              "workspace",
+              "repo",
+              "committed"
+            ]
+          }
+        },
         "arguments": {
           "description": "Arguments passed directly to the owned macOS development executable.",
           "type": "array",
@@ -941,7 +967,7 @@
       "type": "object",
       "properties": {
         "keep": {
-          "description": "Pin this workspace: automatic maintenance never clears its build outputs or removes its worktree",
+          "description": "Pin this workspace: automatic maintenance never clears its build outputs, deletes its owned devices or removes its worktree",
           "type": "boolean",
           "default": false,
           "x-stim": {
@@ -961,7 +987,7 @@
       "type": "object",
       "properties": {
         "easFallback": {
-          "description": "When ios.remote or android.remote is auto, this Mac is at its concurrency.maxDevices cap and no Mac in remote.machines takes the run, run the simulator or emulator on a billed EAS Simulator instead of waiting or refusing, when eas-cli can",
+          "description": "When ios.remote or android.remote is auto, this machine is at its concurrency.maxDevices cap and no remote.machines entry takes the run, run the simulator or emulator on a billed EAS Simulator instead of waiting or refusing, when eas-cli can",
           "type": "boolean",
           "default": false,
           "x-stim": {
@@ -1243,7 +1269,7 @@
               }
             },
             "remote": {
-              "description": "Default iOS remote target: eas, proxy, or an approved Mac in remote.machines; auto places on an approved Mac when this Mac is full or busy; local runs here, overriding a lower layer",
+              "description": "Default iOS remote target: eas, proxy, or an approved Mac in remote.machines; auto places on an approved Mac when this machine is full or busy; local runs here, overriding a lower layer",
               "type": "string",
               "pattern": "^[A-Za-z0-9][A-Za-z0-9.-]*(?::(?!0+$)(?:[0-5]?[0-9]{1,4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$",
               "x-stim": {
@@ -1256,6 +1282,46 @@
                   "committed"
                 ]
               }
+            },
+            "appStoreConnectKeyPath": {
+              "description": "App Store Connect API key (.p8) that `stim device provision ios` authenticates with",
+              "type": "string",
+              "x-stim": {
+                "key": "ios.appStoreConnectKeyPath",
+                "kind": "path",
+                "scopes": [
+                  "machine"
+                ],
+                "absolute": true,
+                "env": "STIM_ASC_KEY_PATH",
+                "sensitive": true
+              }
+            },
+            "appStoreConnectKeyId": {
+              "description": "Key ID of ios.appStoreConnectKeyPath",
+              "type": "string",
+              "pattern": "^[A-Za-z0-9]+$",
+              "x-stim": {
+                "key": "ios.appStoreConnectKeyId",
+                "kind": "string",
+                "scopes": [
+                  "machine"
+                ],
+                "env": "STIM_ASC_KEY_ID"
+              }
+            },
+            "appStoreConnectIssuerId": {
+              "description": "Issuer ID of ios.appStoreConnectKeyPath",
+              "type": "string",
+              "pattern": "^[A-Za-z0-9-]+$",
+              "x-stim": {
+                "key": "ios.appStoreConnectIssuerId",
+                "kind": "string",
+                "scopes": [
+                  "machine"
+                ],
+                "env": "STIM_ASC_ISSUER_ID"
+              }
             }
           },
           "additionalProperties": false
@@ -1294,7 +1360,7 @@
               }
             },
             "remote": {
-              "description": "Default Android remote target: eas, proxy, or an approved Mac in remote.machines; auto places on an approved Mac when this Mac is full or busy; local runs here, overriding a lower layer",
+              "description": "Default Android remote target: eas, proxy, or an approved Mac in remote.machines; auto places on an approved Mac when this machine is full or busy; local runs here, overriding a lower layer",
               "type": "string",
               "pattern": "^[A-Za-z0-9][A-Za-z0-9.-]*(?::(?!0+$)(?:[0-5]?[0-9]{1,4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$",
               "x-stim": {
@@ -1855,6 +1921,20 @@
                 "env": "STIM_MAINTENANCE_OLDER_THAN_DAYS"
               }
             },
+            "deviceIdleDays": {
+              "description": "Days a workspace stays idle before the age sweep deletes its owned simulators and emulators; 0 turns that off",
+              "type": "integer",
+              "minimum": 0,
+              "default": 3,
+              "x-stim": {
+                "key": "maintenance.deviceIdleDays",
+                "kind": "number",
+                "scopes": [
+                  "machine"
+                ],
+                "env": "STIM_MAINTENANCE_DEVICE_IDLE_DAYS"
+              }
+            },
             "protectRecentHours": {
               "description": "Cache entries used within this many hours are never evicted",
               "type": "integer",
@@ -1869,8 +1949,64 @@
                 "env": "STIM_MAINTENANCE_PROTECT_RECENT_HOURS"
               }
             },
+            "urgentFreeDiskGb": {
+              "description": "Free disk, in GB, below which automatic maintenance reports disk pressure level 2; 0 turns that threshold off",
+              "type": "number",
+              "minimum": 0,
+              "default": 12,
+              "x-stim": {
+                "key": "maintenance.urgentFreeDiskGb",
+                "kind": "number",
+                "scopes": [
+                  "machine"
+                ],
+                "env": "STIM_MAINTENANCE_URGENT_FREE_DISK_GB"
+              }
+            },
+            "criticalFreeDiskGb": {
+              "description": "Free disk, in GB, below which automatic maintenance enters disk pressure level 3, also at or below budget.hardFloorDiskGb; 0 leaves only the hard floor",
+              "type": "number",
+              "minimum": 0,
+              "default": 6,
+              "x-stim": {
+                "key": "maintenance.criticalFreeDiskGb",
+                "kind": "number",
+                "scopes": [
+                  "machine"
+                ],
+                "env": "STIM_MAINTENANCE_CRITICAL_FREE_DISK_GB"
+              }
+            },
+            "pressureProtectMinutes": {
+              "description": "Protection window, in minutes, that replaces maintenance.protectRecentHours at disk pressure levels 2 and 3",
+              "type": "integer",
+              "minimum": 0,
+              "default": 10,
+              "x-stim": {
+                "key": "maintenance.pressureProtectMinutes",
+                "kind": "number",
+                "scopes": [
+                  "machine"
+                ],
+                "env": "STIM_MAINTENANCE_PRESSURE_PROTECT_MINUTES"
+              }
+            },
+            "gradleVersionIdleDays": {
+              "description": "At disk pressure level 3, stop idle Gradle and Kotlin daemons, then delete the Gradle version caches and wrapper distributions no registered project pins once their directories are unmodified this many days; 0 turns this off",
+              "type": "integer",
+              "minimum": 0,
+              "default": 7,
+              "x-stim": {
+                "key": "maintenance.gradleVersionIdleDays",
+                "kind": "number",
+                "scopes": [
+                  "machine"
+                ],
+                "env": "STIM_MAINTENANCE_GRADLE_VERSION_IDLE_DAYS"
+              }
+            },
             "removeFinishedWorktrees": {
-              "description": "Remove clean linked worktrees whose branch or pull request finished, under gc.worktreeGraceMinutes",
+              "description": "Remove clean linked worktrees whose branch or pull request finished, under gc.worktreeGraceMinutes, and at disk pressure level 3 clean, pushed ones with no commits of their own",
               "type": "boolean",
               "default": true,
               "x-stim": {
@@ -2045,7 +2181,7 @@
           "type": "object",
           "properties": {
             "logs": {
-              "description": "Debug-level logging. While on, the CLI records its commands, child processes and requests to other Macs, and stim-server records every request with its timings, under STIM_HOME/logs/debug/ with rotation. Nothing is sent anywhere, and records never carry arguments, tokens or tickets",
+              "description": "Debug-level logging. While on, the CLI records its commands, child processes and requests to other machines, and stim-server records every request with its timings, under STIM_HOME/logs/debug/ with rotation. Nothing is sent anywhere, and records never carry arguments, tokens or tickets",
               "type": "boolean",
               "default": false,
               "x-stim": {
@@ -2085,8 +2221,32 @@
         "server": {
           "type": "object",
           "properties": {
+            "buildsPaused": {
+              "description": "Temporarily refuse new incoming builds without interrupting running builds, serving cached artifacts, or changing client approvals; local CLI builds remain available",
+              "type": "boolean",
+              "default": false,
+              "x-stim": {
+                "key": "server.buildsPaused",
+                "kind": "boolean",
+                "scopes": [
+                  "machine"
+                ]
+              }
+            },
+            "devicesPaused": {
+              "description": "Temporarily refuse new hosted iOS, Android and macOS sessions without interrupting existing sessions or changing client approvals; local CLI devices remain available",
+              "type": "boolean",
+              "default": false,
+              "x-stim": {
+                "key": "server.devicesPaused",
+                "kind": "boolean",
+                "scopes": [
+                  "machine"
+                ]
+              }
+            },
             "acceptClientBuilds": {
-              "description": "Whether a Mac approved for builds or device hosting here may update this Mac's stim-server service to that Mac's own stim-server build; releases from npm need no setting",
+              "description": "Whether a machine approved for builds or device hosting here may update this machine's stim-server service to that machine's own stim-server build; releases from npm need no setting",
               "type": "boolean",
               "default": false,
               "x-stim": {
@@ -2098,7 +2258,7 @@
               }
             },
             "maxLoadPerCore": {
-              "description": "Load per core (5-minute load average divided by the CPU count) at which this Mac counts as saturated: it declines builds other Macs send it, automatic build placement stops preferring it, and automatic iOS and Android device placement treats it as busy",
+              "description": "Load per core (5-minute load average divided by the CPU count) at which this machine counts as saturated: it declines builds other machines send it, automatic build placement stops preferring it, and automatic iOS and Android device placement treats it as busy",
               "type": "number",
               "minimum": 0.1,
               "default": 2,
@@ -2111,7 +2271,7 @@
               }
             },
             "workerRoot": {
-              "description": "Directory where stim-server keeps the checkouts, dependencies and build state of the Macs that build here; default $STIM_HOME/build-worker",
+              "description": "Directory where stim-server keeps the checkouts, dependencies and build state of the machines that build here; default $STIM_HOME/build-worker",
               "type": "string",
               "x-stim": {
                 "key": "server.workerRoot",
@@ -2123,7 +2283,7 @@
               }
             },
             "gradleDaemonIdleMinutes": {
-              "description": "Minutes the Gradle daemon of an Android build another Mac sent here stays warm after the build; 0 stops it when the build ends",
+              "description": "Minutes the Gradle daemon of an Android build another machine sent here stays warm after the build; 0 stops it when the build ends",
               "type": "integer",
               "minimum": 0,
               "maximum": 35791,
@@ -2143,7 +2303,7 @@
           "type": "object",
           "properties": {
             "machines": {
-              "description": "Tailscale names of the remote Macs this Mac may build on and host owned simulators on, each optionally with :<port> of its tailscale serve route (default 7443); what each is used for follows the build and device-host approvals it grants, which doctor --fix asks for separately",
+              "description": "Tailscale names of the remote machines this machine may build on and host owned simulators on, each optionally with :<port> of its tailscale serve route (default 7443); what each is used for follows the build and device-host approvals it grants, which doctor --fix asks for separately",
               "type": "array",
               "items": {
                 "type": "string"
@@ -2187,7 +2347,7 @@
               }
             },
             "easFallback": {
-              "description": "When ios.remote or android.remote is auto, this Mac is at its concurrency.maxDevices cap and no Mac in remote.machines takes the run, run the simulator or emulator on a billed EAS Simulator instead of waiting or refusing, when eas-cli can",
+              "description": "When ios.remote or android.remote is auto, this machine is at its concurrency.maxDevices cap and no remote.machines entry takes the run, run the simulator or emulator on a billed EAS Simulator instead of waiting or refusing, when eas-cli can",
               "type": "boolean",
               "default": false,
               "x-stim": {
@@ -2202,7 +2362,7 @@
               }
             },
             "build": {
-              "description": "Build placement: auto follows remote.buildMode within enabled automatic pool members; local always builds here; a name in remote.machines requires that remote Mac without fallback. The ios, android and macos --remote-build flag overrides this setting and its environment override",
+              "description": "Build placement: auto follows remote.buildMode within enabled automatic pool members; local always builds here; a name in remote.machines requires that remote machine without fallback. The ios, android and macos --remote-build flag overrides this setting and its environment override",
               "type": "string",
               "pattern": "^[A-Za-z0-9][A-Za-z0-9.-]*(?::(?!0+$)(?:[0-5]?[0-9]{1,4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?$",
               "default": "auto",
@@ -2216,7 +2376,7 @@
               }
             },
             "buildMode": {
-              "description": "When remote.build is auto, where iOS simulator Debug, Android emulator debug and macOS SwiftPM Debug builds run: auto builds here while this Mac has a free concurrency.maxBuilds slot and its load is under server.maxLoadPerCore, and otherwise builds on a less loaded Mac in remote.machines; force builds on an enabled remote Mac whenever one can take the build; off builds here when local is enabled in remote.buildPoolDisabled",
+              "description": "When remote.build is auto, where iOS simulator Debug, Android emulator debug and macOS SwiftPM Debug builds run: auto builds here while this machine has a free concurrency.maxBuilds slot and its load is under server.maxLoadPerCore, and otherwise builds on a less loaded machine in remote.machines; force builds on an enabled remote machine whenever one can take the build; off builds here when local is enabled in remote.buildPoolDisabled",
               "type": "string",
               "enum": [
                 "auto",

package/dist/{simslim-CCr3rE-A.mjs → simslim-BNckWpXi.mjs}

@@ -1,9 +1,9 @@
-import { d as getConfigDir, j as ownership_claim_exports, k as process_identity_exports } from "./config-BYDxlMY3.mjs";
-import { t as getExecutor } from "./exec-DqKo9GKJ.mjs";
+import { g as process_identity_exports, m as operationState, p as isTermination, t as getExecutor, x as ownership_claim_exports } from "./exec-DEoAhcze.mjs";
+import { d as getConfigDir } from "./config-DlrsduwG.mjs";
 import { n as stripAnsi, r as waitForChild, t as createLineReader } from "./process-output-Fpl8PYi8.mjs";
 import { join } from "node:path";
 //#region src/engine/simslim.ts
-async function reconcileSimSlim({ udid, profile, previouslyManaged = false, out = () => {}, spawn, timeoutMs = 72e4, cleanupMs = 1e4 }) {
+async function reconcileSimSlim({ udid, profile, previouslyManaged = false, out = () => {}, spawn, timeoutMs = 72e4, cleanupMs = 1e4, context }) {
 	if (!profile && !previouslyManaged) return {
 		managed: false,
 		profile: null
@@ -53,8 +53,12 @@ async function reconcileSimSlim({ udid, profile, previouslyManaged = false, out
 		cancellation ??= signal;
 		stopGroup();
 	};
-	const onInterrupt = () => cancel("SIGINT");
-	const onTerminate = () => cancel("SIGTERM");
+	const state = operationState(context);
+	const onAbort = () => {
+		state.handled = true;
+		state.draining = true;
+		cancel(isTermination(context?.signal.reason) ? "SIGTERM" : "SIGINT");
+	};
 	const groupAlive = () => child?.pid !== void 0 && (0, ownership_claim_exports.processGroupAlive)(child.pid);
 	const settled = () => result !== void 0 && !groupAlive();
 	const waitUntil = async (deadline, cancellable = false) => {
@@ -64,10 +68,10 @@ async function reconcileSimSlim({ udid, profile, previouslyManaged = false, out
 		}
 		return settled();
 	};
-	process.on("SIGINT", onInterrupt);
-	process.on("SIGTERM", onTerminate);
-	process.on("exit", stopGroup);
+	context?.signal.addEventListener("abort", onAbort);
+	state.exitCleanups.add(stopGroup);
 	try {
+		if (context?.signal.aborted) onAbort();
 		(0, ownership_claim_exports.markClaimChildPending)(claim);
 		try {
 			child = (spawn ?? ((cmd, childArgs, opts) => getExecutor().spawn(cmd, childArgs, opts)))("simslim", args, {
@@ -115,10 +119,8 @@ async function reconcileSimSlim({ udid, profile, previouslyManaged = false, out
 			child.stderr?.destroy?.();
 			child.unref();
 		}
-		process.off("SIGINT", onInterrupt);
-		process.off("SIGTERM", onTerminate);
-		process.off("exit", stopGroup);
-		if (cancellation) process.exit(cancellation === "SIGINT" ? 130 : 143);
+		context?.signal.removeEventListener("abort", onAbort);
+		state.exitCleanups.delete(stopGroup);
 	}
 	stdout.flush();
 	stderr.flush();

package/dist/{slot-launch-DPt0m9Nd.mjs → slot-launch-CbfmNgM6.mjs}

@@ -1,9 +1,9 @@
-import { H as parseDeviceSlotKey, W as projectDeviceSlots, p as getProject } from "./config-BYDxlMY3.mjs";
-import { n as fileLeaseIo } from "./device-lease-BX1sJQ2E.mjs";
-import { r as readWorkspaceState$1 } from "./workspace-state-DJt_MMvf.mjs";
-import { E as getAvdNameForSerial, O as listAdbDevices } from "./android-Mz_Inn3w.mjs";
-import { d as listAllIosSims } from "./ios-RkW4pnQf.mjs";
-import { p as deviceShellArg } from "./app-install-BIKtMfPq.mjs";
+import { G as projectDeviceSlots, U as parseDeviceSlotKey, p as getProject } from "./config-DlrsduwG.mjs";
+import { r as readWorkspaceState$1 } from "./workspace-state-U08dEzhG.mjs";
+import { gn as deviceShellArg } from "./budget-Cvwn54qV.mjs";
+import { y as fileLeaseIo } from "./activity-CMLmzp7o.mjs";
+import { O as getAvdNameForSerialAsync, j as listAdbDevicesAsync } from "./android-C7sVmyI9.mjs";
+import { f as listAllIosSimsAsync } from "./ios-hcBpnEGk.mjs";
 import { hostedNativeRecords } from "@stim-cli/core/state";
 //#region src/engine/slot-launch.ts
 function launchSlotScope(root, slot = "default") {
@@ -19,31 +19,26 @@ function launchSlotScope(root, slot = "default") {
 const DEVICE_LISTING_TIMEOUT_MS = 5e3;
 function ownedDeviceRunning(platform) {
 	let listing = null;
-	const list = () => {
+	const list = async () => {
 		if (platform === "android") {
-			const { emulators, unhealthy } = listAdbDevices({ timeoutMs: DEVICE_LISTING_TIMEOUT_MS });
+			const { emulators, unhealthy } = await listAdbDevicesAsync({ timeoutMs: DEVICE_LISTING_TIMEOUT_MS });
 			const names = [];
 			for (const entry of [...emulators, ...unhealthy.filter((candidate) => candidate.kind === "emulator")]) {
-				const name = getAvdNameForSerial(entry.serial, { timeoutMs: DEVICE_LISTING_TIMEOUT_MS });
+				const name = await getAvdNameForSerialAsync(entry.serial, { timeoutMs: DEVICE_LISTING_TIMEOUT_MS });
 				if (name === null) return () => true;
 				names.push(name);
 			}
 			return (device) => typeof device.avdName === "string" && names.includes(device.avdName);
 		}
-		const booted = new Set(listAllIosSims({ timeoutMs: DEVICE_LISTING_TIMEOUT_MS }).filter((sim) => sim.state === "Booted").map((sim) => sim.udid));
+		const booted = new Set((await listAllIosSimsAsync({ timeoutMs: DEVICE_LISTING_TIMEOUT_MS })).filter((sim) => sim.state === "Booted").map((sim) => sim.udid));
 		return (device) => typeof device.deviceUdid === "string" && booted.has(device.deviceUdid);
 	};
-	return (device) => {
-		try {
-			listing ??= list();
-			return listing(device);
-		} catch {
-			listing = () => true;
-			return true;
-		}
+	return async (device) => {
+		listing ??= list().catch(() => () => true);
+		return (await listing)(device);
 	};
 }
-function siblingPlatformSlots(root, platform, slot = "default", { deviceRunning = ownedDeviceRunning(platform) } = {}) {
+async function siblingPlatformSlots(root, platform, slot = "default", { deviceRunning = ownedDeviceRunning(platform) } = {}) {
 	const slots = /* @__PURE__ */ new Set();
 	const state = readWorkspaceState$1(root);
 	for (const hosted of Object.keys(hostedNativeRecords(state, platform))) slots.add(hosted);
@@ -56,7 +51,7 @@ function siblingPlatformSlots(root, platform, slot = "default", { deviceRunning
 	}
 	for (const { slot: other, platforms } of projectDeviceSlots(getProject(root))) {
 		const device = platforms[platform];
-		if (other !== slot && !slots.has(other) && device && deviceRunning(device)) slots.add(other);
+		if (other !== slot && !slots.has(other) && device && await deviceRunning(device)) slots.add(other);
 	}
 	slots.delete(slot);
 	return [...slots].toSorted();

package/dist/{spawn-entry-Dcb7sDUz.mjs → spawn-entry-jw19m8Nl.mjs}

@@ -2,7 +2,6 @@ import { basename, dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 //#region src/spawn-entry.ts
 const DEV_ENTRIES = {
-	"api-run": "./api-run.ts",
 	"supervisor-run": "./supervisor/run.ts",
 	"collector-run": "./collector/run.ts",
 	"web-run": "./web/run.ts",

package/dist/stage-Bps5oius.mjs

@@ -0,0 +1,200 @@
+import { h as withDrainingCancellation, t as getExecutor } from "./exec-DEoAhcze.mjs";
+import { f as throwIfCancelled } from "./operation-exec-BW0em61G.mjs";
+import { d as runCancellationSignal } from "./native-run-NwUuxbkg.mjs";
+import { existsSync, lstatSync, promises, readdirSync, realpathSync, statSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { validMacosResourceDestination } from "@stim-cli/core";
+//#region src/macos/stage.ts
+async function validateInfoPlist(context, root, product, infoPlist) {
+	const source = resolve(root, infoPlist);
+	const inside = relative(realpathSync(root), realpathSync(source));
+	if (!lstatSync(source).isFile() || inside === ".." || inside.startsWith(`..${sep}`) || isAbsolute(inside)) throw new Error("macos.infoPlist must be a regular file inside the project, not a symbolic link. See stim guide macos.");
+	const plist = JSON.parse(await tool(context, "plutil", [
+		"-convert",
+		"json",
+		"-o",
+		"-",
+		source
+	], { timeoutMs: 1e4 }));
+	if (typeof plist.CFBundleIdentifier !== "string" || plist.CFBundleExecutable !== product) throw new Error("macos.infoPlist must name a CFBundleIdentifier and the selected product as CFBundleExecutable.");
+	if (plist.CFBundleURLTypes || plist.SUFeedURL) throw new Error("Use a development Info.plist without shared URL schemes or an update feed.");
+	if (plist.LSMinimumSystemVersion !== void 0 && typeof plist.LSMinimumSystemVersion !== "string") throw new Error("macos.infoPlist LSMinimumSystemVersion must be a string. See stim guide macos.");
+	return {
+		bundleId: plist.CFBundleIdentifier,
+		minimumSystemVersion: plist.LSMinimumSystemVersion
+	};
+}
+async function setBundleName(context, plistPath, name) {
+	for (const key of ["CFBundleDisplayName", "CFBundleName"]) await tool(context, "plutil", [
+		"-replace",
+		key,
+		"-string",
+		name,
+		plistPath
+	], { timeoutMs: 1e4 });
+}
+async function reidentifyBundle(context, bundle, id, name) {
+	const plist = join(bundle, "Contents", "Info.plist");
+	await tool(context, "plutil", [
+		"-replace",
+		"CFBundleIdentifier",
+		"-string",
+		id,
+		plist
+	], { timeoutMs: 1e4 });
+	if (name !== void 0) await setBundleName(context, plist, name);
+	await tool(context, "codesign", [
+		"--force",
+		"--sign",
+		"-",
+		bundle
+	], { timeoutMs: "unbounded" });
+}
+function resourceError(key, entry, reason) {
+	throw new Error(`${key} entry ${JSON.stringify(entry)}: ${reason}. See stim guide macos.`);
+}
+function containsSymlink(dir) {
+	return readdirSync(dir, { withFileTypes: true }).some((entry) => entry.isSymbolicLink() || entry.isDirectory() && containsSymlink(join(dir, entry.name)));
+}
+function overlaps(a, b) {
+	a = a.normalize("NFC").toLowerCase();
+	b = b.normalize("NFC").toLowerCase();
+	return a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
+}
+function resolveBundleExtras(root, repository, resources = {}, assetCatalog) {
+	const boundary = realpathSync(repository);
+	const sourcePath = (key, entry) => {
+		if (typeof entry !== "string" || !entry || isAbsolute(entry) || entry.includes("\0")) resourceError(key, entry, "source must be a non-empty relative path");
+		let source;
+		try {
+			source = realpathSync(resolve(root, entry));
+		} catch {
+			resourceError(key, entry, "source does not exist");
+		}
+		const path = relative(boundary, source);
+		if (path === ".." || path.startsWith(`..${sep}`) || isAbsolute(path)) resourceError(key, entry, "source leaves the repository");
+		if (path === "") resourceError(key, entry, "source is the repository root");
+		const stat = statSync(source);
+		if (!stat.isFile() && !stat.isDirectory()) resourceError(key, entry, "source must be a regular file or directory");
+		if (stat.isDirectory() && containsSymlink(source)) resourceError(key, entry, "source directory contains a symbolic link");
+		return source;
+	};
+	let catalog;
+	if (assetCatalog !== void 0 && assetCatalog !== null) {
+		catalog = sourcePath("macos.assetCatalog", assetCatalog);
+		if (!catalog.endsWith(".xcassets") || !statSync(catalog).isDirectory()) resourceError("macos.assetCatalog", assetCatalog, "catalog must be a .xcassets directory");
+	}
+	if (!resources || typeof resources !== "object" || Array.isArray(resources)) resourceError("macos.resources", resources, "expected an object");
+	const entries = Object.entries(resources);
+	if (entries.length > 256) {
+		const [destination, source] = entries[256];
+		resourceError(`macos.resources[${JSON.stringify(destination)}]`, source, "at most 256 entries are allowed");
+	}
+	const reserved = catalog ? ["Assets.car"] : [];
+	const resolved = [];
+	for (const [destination, source] of entries) {
+		const key = `macos.resources[${JSON.stringify(destination)}]`;
+		if (!validMacosResourceDestination(destination)) resourceError(key, source, "invalid destination");
+		if (reserved.some((other) => overlaps(destination, other))) resourceError(key, source, "destination collides with another resource");
+		reserved.push(destination);
+		resolved.push([destination, sourcePath(key, source)]);
+	}
+	return {
+		resources: Object.fromEntries(resolved),
+		assetCatalog: catalog
+	};
+}
+async function stageBundle(context, root, product, infoPlist, bin, bundle, bundleId, extras = { resources: {} }, displayName) {
+	const signal = runCancellationSignal(context) ?? context.signal;
+	await withDrainingCancellation(context, signal, async () => {
+		throwIfCancelled(signal, "macOS bundle staging");
+		const { minimumSystemVersion } = await validateInfoPlist(context, root, product, infoPlist);
+		for (const entry of readdirSync(bin).filter((name) => name.endsWith(".bundle"))) for (const [destination, source] of Object.entries(extras.resources)) if (overlaps(destination, entry)) resourceError(`macos.resources[${JSON.stringify(destination)}]`, source, `destination collides with ${entry}`);
+		await promises.rm(bundle, {
+			recursive: true,
+			force: true
+		});
+		const contents = join(bundle, "Contents");
+		await promises.mkdir(join(contents, "MacOS"), { recursive: true });
+		await promises.mkdir(join(contents, "Resources"), { recursive: true });
+		await promises.mkdir(join(contents, "Frameworks"), { recursive: true });
+		const executable = join(contents, "MacOS", product);
+		await copy(context, join(bin, product), executable);
+		await copy(context, resolve(root, infoPlist), join(contents, "Info.plist"));
+		await tool(context, "/usr/libexec/PlistBuddy", [
+			"-c",
+			`Set :CFBundleIdentifier ${bundleId}`,
+			join(contents, "Info.plist")
+		], { timeoutMs: 1e4 });
+		if (displayName !== void 0) await setBundleName(context, join(contents, "Info.plist"), displayName);
+		for (const entry of readdirSync(bin)) if (entry.endsWith(".framework")) {
+			const target = join(contents, "Frameworks", entry);
+			await copy(context, join(bin, entry), target, {
+				recursive: true,
+				dereference: false,
+				verbatimSymlinks: true
+			});
+			await tool(context, "codesign", [
+				"--force",
+				"--sign",
+				"-",
+				target
+			], { timeoutMs: "unbounded" });
+		} else if (entry.endsWith(".bundle")) await copy(context, join(bin, entry), join(contents, "Resources", entry), { recursive: true });
+		const frameworkPath = "@executable_path/../Frameworks";
+		if (!(await tool(context, "otool", ["-l", executable], { timeoutMs: 3e4 })).includes(frameworkPath)) await tool(context, "install_name_tool", [
+			"-add_rpath",
+			frameworkPath,
+			executable
+		], { timeoutMs: 3e4 });
+		for (const [destination, source] of Object.entries(extras.resources)) {
+			const target = join(contents, "Resources", destination);
+			await promises.mkdir(dirname(target), { recursive: true });
+			await copy(context, source, target, { recursive: true });
+		}
+		if (extras.assetCatalog) {
+			await tool(context, "xcrun", [
+				"actool",
+				extras.assetCatalog,
+				"--compile",
+				join(contents, "Resources"),
+				"--platform",
+				"macosx",
+				...minimumSystemVersion === void 0 ? [] : ["--minimum-deployment-target", minimumSystemVersion],
+				"--output-partial-info-plist",
+				"/dev/null"
+			], { timeoutMs: "unbounded" });
+			if (!existsSync(join(contents, "Resources", "Assets.car"))) resourceError("macos.assetCatalog", extras.assetCatalog, "actool did not produce Assets.car");
+		}
+		await tool(context, "codesign", [
+			"--force",
+			"--sign",
+			"-",
+			bundle
+		], { timeoutMs: "unbounded" });
+	});
+}
+async function tool(context, file, args, options) {
+	const signal = runCancellationSignal(context) ?? context.signal;
+	throwIfCancelled(signal, "macOS bundle staging");
+	const result = await getExecutor().runFileAsync(file, args, {
+		...options,
+		declareFor: context
+	});
+	throwIfCancelled(signal, "macOS bundle staging");
+	return result;
+}
+async function copy(context, source, target, options = {}) {
+	const signal = runCancellationSignal(context) ?? context.signal;
+	throwIfCancelled(signal, "macOS bundle staging");
+	await promises.cp(source, target, {
+		...options,
+		filter: () => {
+			throwIfCancelled(signal, "macOS bundle staging");
+			return true;
+		}
+	});
+	throwIfCancelled(signal, "macOS bundle staging");
+}
+//#endregion
+export { validateInfoPlist as a, stageBundle as i, resolveBundleExtras as n, setBundleName as r, reidentifyBundle as t };