stim 1.24.0 → 1.26.0

package/dist/{android-project-DVWyCbWU.d.mts → android-project-DUGMbq28.d.mts}

@@ -8,7 +8,7 @@ import { readFileSync as readFileSync$1 } from "fs";
 import { Command } from "commander";
 import "@expo/fingerprint";
 import { CacheProviderConfig, loadCacheProvider } from "@stim-cli/cache";
-import { BuildReactNativeArtifactQuery, BuildSwiftpmArtifactQuery, GradleOffloadInputs, HelloResult } from "@stim-cli/core/protocol";
+import { BuildReactNativeArtifactQuery, BuildSwiftpmArtifactQuery, GradleOffloadInputs, HelloResult, RemoteDiagnosis } from "@stim-cli/core/protocol";
 import { ChildProcess } from "node:child_process";
 //#region src/engine/build-facts.d.ts
 type CacheHitLevel = "local" | "remote" | false;
@@ -221,31 +221,79 @@ interface AndroidBuildPlan {
 //#region src/offload/toolchain.d.ts
 /** What must be identical on this Mac and a remote Mac for an iOS simulator build to come out the same. */
 interface IosToolchain {
-  /** A digest of Stim's built code, so both sides prove they run the same Stim. */
+  /** A digest of Stim's built code, compared only with a remote machine that reports no `compat`. */
   stimBuild: string | null;
+  /** The Stim build compatibility version both sides must share. */
+  compat: number;
   arch: string;
   xcode: string | null;
   simulatorSdk: string | null;
   cocoapods: string | null;
 }
+/** An Xcode app in `/Applications`, with the license and first-launch checks of its developer directory when they ran. */
+interface XcodeApp {
+  path: string;
+  version: string | null;
+  build: string | null;
+  license?: boolean;
+  firstLaunch?: boolean;
+}
 /** A remote machine's toolchain, the simulator runtimes it can build for, and its JDK and Android SDK packages. */
-interface WorkerToolchain extends IosToolchain {
+interface WorkerToolchain extends Omit<IosToolchain, "compat"> {
+  /** Absent from a stim-server older than build compatibility versions. */
+  compat?: number;
   /** The OS stim-server runs on, as Node names it; absent from a stim-server older than this field. */
   os?: string;
   macosSdk: string | null;
   bundler: string | null;
   runtimes: string[];
+  /** The developer directory `xcode-select -p` prints, null when it prints none; absent from a stim-server older than this field. */
+  developerDir?: string | null;
+  /** The Xcode apps in `/Applications`; their license and first-launch checks run only while `xcode` is null. */
+  xcodeApps?: XcodeApp[];
   jdk: string | null;
+  /** The majors of every JDK found on the machine, `jdk` included; absent from a stim-server older than this field. */
+  jdks?: string[];
   androidSdk: {
     ndk: string[];
     buildTools: string[];
     platforms: string[];
   } | null;
+  /** Whether that SDK has its licenses accepted, so Gradle can download a missing package; absent from a stim-server older than this field. */
+  androidLicenses?: boolean;
+  /** The SDK directory `androidSdk` was read from, for the commands that install into it; absent from a stim-server older than this field. */
+  androidHome?: string;
 }
 /** One reason a remote machine cannot take this build now, with a stable `code` for doctor's JSON. */
 interface OffloadProblem {
   code: "unreachable" | "checkout" | "stim-build" | "arch" | "xcode" | "macos-sdk" | "simulator-sdk" | "cocoapods" | "bundler" | "runtime" | "jdk" | "android-sdk" | "ndk" | "build-tools" | "compile-sdk" | "disk" | "busy" | "platform";
   reason: string;
+  /** Shell commands that clear it, to run on the remote machine, and what they do, as the end of "On <machine>, ...". */
+  commands?: string[];
+  lead?: string;
+  /** The problem whose fix also clears this one, so it carries no fix of its own. */
+  followsFrom?: OffloadProblem["code"];
+}
+//#endregion
+//#region src/offload/diagnosis.d.ts
+type Transport = {
+  kind: "http";
+  status: number;
+} | {
+  kind: "refused";
+} | {
+  kind: "silent";
+} | {
+  kind: "tls";
+  message: string;
+} | {
+  kind: "other";
+  message: string;
+};
+/** What a peer's `/health` says about a server that answered 503 (see `peerHealth` in stim-server). */
+interface PeerStartup {
+  state: "pending" | "degraded";
+  cause?: "home-unreadable" | "start-failed";
 }
 //#endregion
 //#region src/offload/tailnet.d.ts
@@ -287,11 +335,18 @@ type HelloReply = {
   };
 } | {
   failed: string;
+  transport?: Transport;
 };
 interface TailnetMachineIo {
   /** `tailscale status --json`, or null when Tailscale is not running. */
   status: () => unknown;
   hello: (endpoint: Endpoint, auth: MachineAuth) => Promise<HelloReply>;
+  /** `tailscale status --json` whatever its backend state, or null when no command answered; says why `status` is null. */
+  rawStatus?: () => unknown;
+  /** The `startup` of the peer's `/health` after a 503, or null when it says none. */
+  startup?: (endpoint: Endpoint) => Promise<PeerStartup | null>;
+  /** Whether `tailscale ping` gets an answer from the peer's address. */
+  ping?: (address: string) => Promise<boolean>;
 }
 type GeneratedTickets = Map<string, {
   ticket: string;
@@ -307,6 +362,7 @@ type GeneratedTickets = Map<string, {
 interface BuildMachineReport {
   machine: string;
   state: "invalid" | "tailscale-off" | "not-on-tailnet" | "key-changed" | "not-asked" | "pending" | "approved" | "revoked" | "lapsed" | "outdated" | "unreachable";
+  diagnosis?: RemoteDiagnosis;
   dnsName?: string;
   deviceId?: string;
   requestedAt?: string;
@@ -317,6 +373,8 @@ interface BuildMachineReport {
   reasons?: string[];
   /** The same reasons with the code of each, in the same order. */
   problems?: OffloadProblem[];
+  /** What a build there does beyond the match, such as downloading an SDK package; none of it stops the build. */
+  notes?: OffloadProblem[];
   /** The machine's reported capacity, when it answered an offer. */
   capacity?: Record<string, unknown>;
 }

package/dist/api.d.mts

@@ -1,4 +1,4 @@
-import { _ as IosFacts, a as BuildMachinesInspection, d as DoctorPlatform, f as Finding, g as CompilationCacheActivity, h as CcacheActivity, m as AndroidFacts, n as WebLaunched, o as GeneratedTickets, s as TailnetMachineIo, u as BudgetReport } from "./android-project-DVWyCbWU.mjs";
+import { _ as IosFacts, a as BuildMachinesInspection, d as DoctorPlatform, f as Finding, g as CompilationCacheActivity, h as CcacheActivity, m as AndroidFacts, n as WebLaunched, o as GeneratedTickets, s as TailnetMachineIo, u as BudgetReport } from "./android-project-DUGMbq28.mjs";
 import { a as WorkspaceLaunchPlatform } from "./ios-CDvlmUs7.mjs";
 import "./exec-DnYc4HGH.mjs";
 import "./pull-request-eODyIqZF.mjs";
@@ -8,7 +8,7 @@ import { AgentDeviceUsage, ArchivedWorkspace, BuildPlanPayload, MacosBuild, Maco
 import { statSync } from "fs";
 import { Command } from "commander";
 import { ToolchainEntry } from "@stim-cli/core/toolchain";
-import { HelloResult, PlatformBuildOptions, PlatformRunOptions } from "@stim-cli/core/protocol";
+import { HelloResult, PlatformBuildOptions, PlatformRunOptions, RemoteDiagnosis } from "@stim-cli/core/protocol";
 //#region src/engine/device-lease.d.ts
 type LeasePlatform = "ios" | "android";
 interface ReleasedLease {
@@ -19,7 +19,7 @@ interface ReleasedLease {
 }
 //#endregion
 //#region src/commands/gc/results.d.ts
-type GcResultKind = "archive" | "device" | "parkedDevice" | "parkedHostedDevice" | "idleDevice" | "deviceRecord" | "workspaceOutputs" | "recording" | "workspaceDirectory" | "project" | "buildLock" | "buildSlot" | "deviceLease" | "easSession" | "worktree" | "cache" | "statusCache" | "tempLeftover" | "trash" | "watchmanRoot" | "watchman" | "gradleDaemon" | "gradleVersion" | "kotlinDaemon";
+type GcResultKind = "archive" | "device" | "parkedDevice" | "parkedHostedDevice" | "idleDevice" | "deviceRecord" | "workspaceOutputs" | "recording" | "workspaceDirectory" | "project" | "buildLock" | "buildSlot" | "deviceLease" | "easSession" | "worktree" | "cache" | "statusCache" | "tempLeftover" | "trash" | "watchmanRoot" | "watchman" | "gradleDaemon" | "gradleVersion" | "kotlinDaemon" | "devServer" | "workspaceLogs" | "ledgerEntry" | "easLedgerEntry";
 type GcResultStatus = "done" | "kept" | "failed";
 interface GcResult {
   kind: GcResultKind;
@@ -214,6 +214,7 @@ interface StimVersionReport {
 interface MachineReport {
   machine: string;
   state: "invalid" | "tailscale-off" | "not-on-tailnet" | "key-changed" | "not-asked" | "pending" | "approved" | "revoked" | "lapsed" | "outdated" | "unreachable" | "credentials-unavailable" | "busy";
+  diagnosis?: RemoteDiagnosis;
   dnsName?: string;
   deviceId?: string;
   requestedAt?: string;
@@ -779,6 +780,8 @@ interface RunGcOptions {
   delete?: boolean;
   worktrees?: boolean;
   json?: boolean;
+  /** False reports worktree build-state sizes only from the disk-usage cache: a stale one is unmeasured (null), and no `du` runs for it. */
+  measureBuildState?: boolean;
 }
 interface GcRefusal {
   code: string;
@@ -801,7 +804,7 @@ type GcPayload = {
   results: GcResult[];
   inventory: GcInventory | null;
 } | GcRefusal;
-type GcReadOptions = Pick<RunGcOptions, "olderThan" | "cache" | "worktrees">;
+type GcReadOptions = Pick<RunGcOptions, "olderThan" | "cache" | "worktrees" | "measureBuildState">;
 //#endregion
 //#region src/commands/reload.d.ts
 type ReloadPlatform = WorkspaceLaunchPlatform | "web";
@@ -951,7 +954,7 @@ type StimGcOptions = GcReadOptions & StimReadOptions;
 type StimGcReport = Exclude<GcPayload, {
   code: string;
 }>;
-type StimGcMutationOptions = StimGcOptions & {
+type StimGcMutationOptions = Omit<StimGcOptions, "measureBuildState"> & {
   delete?: boolean;
   /** Shuts down owned devices idle for at least this many milliseconds, including without `delete`. */
   idleMs?: number;

package/dist/api.mjs

@@ -1,31 +1,30 @@
 import { D as ownership_claim_exports, T as trackReportResource, b as operationState, c as throwIfCancelled, l as WorkspaceProcessCleanupError, s as cancelledError, w as runReport } from "./exec-VFRpu1iA.mjs";
-import { d as workspaceDir, m as workspaceLogsDir$1, r as ensureWorkspaceStorageAsync } from "./paths-DQtTgsBf.mjs";
-import { E as upsertProject, O as withConfigLockAsync$1, p as getProject, q as validateDeviceSlot, y as refuseRelativeStimPaths } from "./config-BZhXY15H.mjs";
-import { l as phaseLine } from "./command-output-DxC0k2rk.mjs";
-import { a as recordWorkspaceUseAsync } from "./workspace-state-CeBpIZgr.mjs";
-import { J as resolveProjectSettingsAsync, Nt as repoRootAsync, a as SETTING_SHAPE_REMEDY, et as settingShapeErrors, it as unknownSettingKeys, p as cacheProviderSettingError } from "./settings-RKwY33wv.mjs";
-import { c as projectProblem, f as projectRegistry, i as findProjectRoot$1, r as findCommandWorkspaceAsync, t as NO_PROJECT_REFUSAL } from "./project-Dz-hWkb-.mjs";
-import { n as macosDir } from "./state-BfAltYJP.mjs";
-import { c as ensureHomeIdentity, s as workspaceShareURL } from "./stim-desktop-DS0mzR8U.mjs";
+import { E as workspaceDir, a as recordWorkspaceUseAsync, k as workspaceLogsDir$1, v as ensureWorkspaceStorageAsync } from "./workspace-state-pUg3_RRA.mjs";
+import { E as upsertProject, O as withConfigLockAsync$1, p as getProject, q as validateDeviceSlot, y as refuseRelativeStimPaths } from "./config-BktkY_zC.mjs";
+import { l as phaseLine } from "./command-output-BF5AR2dL.mjs";
+import { Pt as repoRootAsync, Y as resolveProjectSettingsAsync, a as SETTING_SHAPE_REMEDY, at as unknownSettingKeys, p as cacheProviderSettingError, tt as settingShapeErrors } from "./settings-CosW5X-S.mjs";
+import { c as projectProblem, f as projectRegistry, i as findProjectRoot$1, r as findCommandWorkspaceAsync, t as NO_PROJECT_REFUSAL } from "./project-BUu6Is4k.mjs";
+import { n as macosDir } from "./state-C4OdpOTF.mjs";
+import { c as ensureHomeIdentity, s as workspaceShareURL } from "./stim-desktop-6Dqp-gjX.mjs";
 import { r as createNdjsonWriter } from "./ndjson-CgE_o3Dl.mjs";
-import { B as recordFinishedBuild, H as startBuildProgress, U as tapBuildLog } from "./budget-dPGuhNai.mjs";
-import { d as runCancellationSignal, f as withNativeBuildRun } from "./native-run-BmH7U8pr.mjs";
-import { c as resolveBuildPlacement } from "./selection-BLtvaqxc.mjs";
-import { c as stopWorkspaceNow } from "./stop-CL1kDHds.mjs";
-import { r as runReload } from "./reload-C1TTVesC.mjs";
-import { c as startDevServer } from "./start-BKGrEhzG.mjs";
-import { s as recordDoctorCheck } from "./doctor-watchman-B453A231.mjs";
-import { a as readDoctorReport } from "./doctor-DZgpqR6J.mjs";
-import { h as warmWorktreeTarget, m as removeWorktreeTarget } from "./worktree-Dw8kfacb.mjs";
-import { i as readGcReport, n as executeGc, o as withGcMaintenanceClaim } from "./gc-yVKpAOKM.mjs";
-import { r as readWorkspaceLogs, t as followWorkspaceLogs } from "./logs-DXE32kyb.mjs";
+import { K as startBuildProgress, W as recordFinishedBuild, q as tapBuildLog } from "./budget-k2mZGvvk.mjs";
+import { d as runCancellationSignal, f as withNativeBuildRun } from "./native-run-BfIDFKLH.mjs";
+import { l as resolveBuildPlacement } from "./selection-BNPBZ6T5.mjs";
+import { c as stopWorkspaceNow } from "./stop-DRqQVqDJ.mjs";
+import { r as runReload } from "./reload-CCR7KC_l.mjs";
+import { c as startDevServer } from "./start-_BdJ32cZ.mjs";
+import { s as recordDoctorCheck } from "./doctor-watchman-BStK05nt.mjs";
+import { a as readDoctorReport } from "./doctor-Bhg1ii70.mjs";
+import { h as warmWorktreeTarget, m as removeWorktreeTarget } from "./worktree-BKuklFh_.mjs";
+import { i as readGcReport, n as executeGc, o as withGcMaintenanceClaim } from "./gc-ldgr-hXU.mjs";
+import { r as readWorkspaceLogs, t as followWorkspaceLogs } from "./logs-dQDki6Tt.mjs";
 import { t as readProjectStats } from "./stats-report-n2U5plhk.mjs";
-import { n as buildAndroidOperation, t as buildIosOperation } from "./build-CaF574eS.mjs";
-import { a as readAndroidBuildPlan, i as runAndroidOperation } from "./android-BZppyPe_.mjs";
-import { i as readIosBuildPlan, r as runIosOperation } from "./ios-B1FXRCMX.mjs";
-import { a as buildMacosBundle, i as planMacos, n as runMacos } from "./macos-CCfhb-jT.mjs";
-import { t as runWeb } from "./web-BH7peScT.mjs";
-import { i as SettingsRefusal, o as readSettingsContext, s as readSettingsPayload, t as mutateSetting } from "./settings-write--gj6MACV.mjs";
+import { n as buildAndroidOperation, t as buildIosOperation } from "./build-DPhApsjV.mjs";
+import { a as readAndroidBuildPlan, i as runAndroidOperation } from "./android-CiNQw3kq.mjs";
+import { i as readIosBuildPlan, r as runIosOperation } from "./ios-ftxdQbJS.mjs";
+import { a as buildMacosBundle, i as planMacos, n as runMacos } from "./macos-DBBPNnIA.mjs";
+import { t as runWeb } from "./web-Bihbf7-u.mjs";
+import { i as SettingsRefusal, o as readSettingsContext, s as readSettingsPayload, t as mutateSetting } from "./settings-write-QjYfSrjF.mjs";
 import { randomBytes } from "node:crypto";
 import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
 import { stripVTControlCharacters } from "node:util";
@@ -317,7 +316,7 @@ function createStim(options) {
 			}), () => {});
 			return task;
 		}),
-		gc: ({ signal, olderThan, cache, worktrees } = {}) => {
+		gc: ({ signal, olderThan, cache, worktrees, measureBuildState } = {}) => {
 			if (olderThan !== void 0 && !Number.isSafeInteger(olderThan)) return Promise.reject(new StimError({
 				code: "STIM_BAD_ARG",
 				message: "olderThan must be a whole number of days."
@@ -326,7 +325,8 @@ function createStim(options) {
 				const result = await readGcReport({
 					olderThan,
 					cache,
-					worktrees
+					worktrees,
+					measureBuildState
 				}, {
 					operation: context,
 					easLedgerRoot: join(context.env.HOME || context.env.USERPROFILE || homedir(), ".stim", "machine", "eas")

package/dist/apk-signed-tail-B46U9hXc.mjs

@@ -0,0 +1,142 @@
+import { y as sharedBuildCache } from "./workspace-state-pUg3_RRA.mjs";
+import { E as findBuildTool } from "./android-DTAcRwBC.mjs";
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, fstatSync, openSync, readFileSync, readSync, realpathSync, renameSync, rmSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { writeFile } from "node:fs/promises";
+//#region src/engine/apk-signed-tail.ts
+const SIGNED_TAIL_FILE = "apk-signed-tail.json";
+const EOCD_SIGNATURE = 101010256;
+const EOCD_MIN_BYTES = 22;
+const EOCD_SEARCH_BYTES = 65557;
+const SIGNING_BLOCK_FOOTER_BYTES = 24;
+const SIGNING_BLOCK_MAGIC = "APK Sig Block 42";
+const SIGNATURE_SCHEME_IDS = /* @__PURE__ */ new Set([1896449818, 4031998144]);
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+const VERIFIED_V2_OR_V3 = /^Verified using v[23] scheme \(APK Signature Scheme v[23]\): true\s*$/m;
+/**
+* The offset where an APK's v2 or v3 signing block starts, or null when the file has no such block, is ZIP64, or is
+* malformed. https://source.android.com/docs/security/features/apksigning/v2#apk-signing-block
+*/
+function signingBlockOffset(size, read) {
+	if (size < EOCD_MIN_BYTES) return null;
+	const searched = Math.min(size, EOCD_SEARCH_BYTES);
+	const end = read(size - searched, searched);
+	let eocd = -1;
+	for (let i = end.length - EOCD_MIN_BYTES; i >= 0; i--) if (end.readUInt32LE(i) === EOCD_SIGNATURE && i + EOCD_MIN_BYTES + end.readUInt16LE(i + 20) === end.length) {
+		eocd = i;
+		break;
+	}
+	if (eocd < 0) return null;
+	const directoryOffset = end.readUInt32LE(eocd + 16);
+	if (directoryOffset === 4294967295 || directoryOffset < 32) return null;
+	const footer = read(directoryOffset - SIGNING_BLOCK_FOOTER_BYTES, SIGNING_BLOCK_FOOTER_BYTES);
+	if (footer.subarray(8).toString("latin1") !== SIGNING_BLOCK_MAGIC) return null;
+	const blockSize = footer.readBigUInt64LE(0);
+	if (blockSize < BigInt(SIGNING_BLOCK_FOOTER_BYTES) || blockSize + 8n > BigInt(directoryOffset)) return null;
+	const start = directoryOffset - Number(blockSize) - 8;
+	const pairs = read(start, Number(blockSize) + 8 - SIGNING_BLOCK_FOOTER_BYTES);
+	if (pairs.readBigUInt64LE(0) !== blockSize) return null;
+	let position = 8;
+	while (position + 12 <= pairs.length) {
+		const length = pairs.readBigUInt64LE(position);
+		if (length < 4n || length > BigInt(pairs.length - position - 8)) return null;
+		if (SIGNATURE_SCHEME_IDS.has(pairs.readUInt32LE(position + 8))) return start;
+		position += 8 + Number(length);
+	}
+	return null;
+}
+function readSignedTail(apkPath) {
+	let fd = null;
+	try {
+		fd = openSync(apkPath, "r");
+		const open = fd;
+		const size = fstatSync(open).size;
+		const read = (position, length) => {
+			const buffer = Buffer.alloc(length);
+			if (readSync(open, buffer, 0, length, position) !== length) throw new Error("short read");
+			return buffer;
+		};
+		const tailOffset = signingBlockOffset(size, read);
+		if (tailOffset === null) return null;
+		const tailSha256 = createHash("sha256").update(read(tailOffset, size - tailOffset)).digest("hex");
+		return {
+			file: basename(apkPath),
+			size,
+			tailOffset,
+			tailSha256
+		};
+	} catch {
+		return null;
+	} finally {
+		if (fd !== null) try {
+			closeSync(fd);
+		} catch {}
+	}
+}
+const apksignerPath = () => findBuildTool(["apksigner"])?.path ?? null;
+async function computeSignedTail(apkPath, run, findSigner = apksignerPath) {
+	const tail = readSignedTail(apkPath);
+	if (!tail) return null;
+	const signer = findSigner();
+	if (!signer) return null;
+	try {
+		if (!VERIFIED_V2_OR_V3.test(String(await run(signer, [
+			"verify",
+			"--verbose",
+			apkPath
+		])))) return null;
+	} catch {
+		return null;
+	}
+	const after = readSignedTail(apkPath);
+	return after && after.size === tail.size && after.tailSha256 === tail.tailSha256 ? tail : null;
+}
+function recordedSignedTail(apkPath) {
+	try {
+		const parsed = JSON.parse(readFileSync(join(dirname(apkPath), SIGNED_TAIL_FILE), "utf-8"));
+		if (!parsed || typeof parsed !== "object" || !("file" in parsed) || !("size" in parsed) || !("tailOffset" in parsed) || !("tailSha256" in parsed)) return null;
+		const { file, size, tailOffset, tailSha256 } = parsed;
+		if (file !== basename(apkPath) || typeof size !== "number" || typeof tailOffset !== "number" || typeof tailSha256 !== "string" || !SHA256_HEX.test(tailSha256) || !Number.isSafeInteger(size) || !Number.isSafeInteger(tailOffset) || tailOffset < 0 || tailOffset >= size) return null;
+		const current = readSignedTail(apkPath);
+		if (!current || current.size !== size || current.tailOffset !== tailOffset || current.tailSha256 !== tailSha256) return null;
+		return {
+			file,
+			size,
+			tailOffset,
+			tailSha256
+		};
+	} catch {
+		return null;
+	}
+}
+async function writeSignedTail(dir, tail) {
+	const target = join(dir, SIGNED_TAIL_FILE);
+	const temporary = `${target}.${randomUUID()}.tmp`;
+	try {
+		await writeFile(temporary, JSON.stringify(tail));
+		renameSync(temporary, target);
+	} catch (error) {
+		rmSync(temporary, { force: true });
+		throw error;
+	}
+}
+function inBuildCacheEntry(apkPath) {
+	try {
+		return realpathSync(dirname(dirname(apkPath))) === realpathSync(join(sharedBuildCache(), "android"));
+	} catch {
+		return false;
+	}
+}
+async function signedTailFor(apkPath, run, findSigner) {
+	const recorded = recordedSignedTail(apkPath);
+	if (recorded || !inBuildCacheEntry(apkPath)) return recorded;
+	const computed = await computeSignedTail(apkPath, run, findSigner);
+	if (!computed) return null;
+	try {
+		await writeSignedTail(dirname(apkPath), computed);
+	} catch {}
+	return computed;
+}
+//#endregion
+export { signedTailFor as n, writeSignedTail as r, computeSignedTail as t };

package/dist/{artifact-BR5VNArK.mjs → artifact-BxREhAaV.mjs}

@@ -1,17 +1,17 @@
 import { D as ownership_claim_exports, c as throwIfCancelled, x as withDrainingCancellation } from "./exec-VFRpu1iA.mjs";
-import { d as workspaceDir } from "./paths-DQtTgsBf.mjs";
-import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-DxC0k2rk.mjs";
-import { Un as easAuthNote, Wn as isEasAuthFailureText, zn as RESOLVE_TIMEOUT_MS } from "./budget-dPGuhNai.mjs";
-import { d as runCancellationSignal, r as cancelledFailure } from "./native-run-BmH7U8pr.mjs";
-import { g as providerDownloadPath, h as prepareProviderDownloadDir } from "./build-cache-HFUQ9eLz.mjs";
-import { n as CCACHE_UNAVAILABLE, r as ccacheActivityLine, t as CCACHE_NOT_RUN } from "./ccache-CCn1S6qG.mjs";
-import { c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, u as remotePhaseText } from "./client-18-ZowoT.mjs";
-import { i as namedBuildMachine, o as requireLocalBuild, r as fingerprintMismatchRemedy, t as OffloadRefusal } from "./selection-BLtvaqxc.mjs";
-import { f as formatDiagnostic } from "./react-native-build-AuCu-aAP.mjs";
-import { u as skippedMissReason } from "./prebuild-DmVCf5xb.mjs";
-import { t as buildPlacementRecord } from "./placement-log-DUvqqsB-.mjs";
-import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-CEs02U2o.mjs";
-import { a as PLATFORM, h as displayPath } from "./support-B3tzVhKn.mjs";
+import { E as workspaceDir } from "./workspace-state-pUg3_RRA.mjs";
+import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-BF5AR2dL.mjs";
+import { Jn as easAuthNote, Wn as RESOLVE_TIMEOUT_MS, Yn as isEasAuthFailureText } from "./budget-k2mZGvvk.mjs";
+import { d as runCancellationSignal, r as cancelledFailure } from "./native-run-BfIDFKLH.mjs";
+import { v as prepareProviderDownloadDir, y as providerDownloadPath } from "./build-cache-DrXNCy3T.mjs";
+import { n as CCACHE_UNAVAILABLE, r as ccacheActivityLine, t as CCACHE_NOT_RUN } from "./ccache-Bx5TbxwG.mjs";
+import { c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, u as remotePhaseText } from "./client-D9CaRks-.mjs";
+import { i as namedBuildMachine, r as fingerprintMismatchRemedy, s as requireLocalBuild, t as OffloadRefusal } from "./selection-BNPBZ6T5.mjs";
+import { f as formatDiagnostic } from "./react-native-build-oNwqF5Wb.mjs";
+import { u as skippedMissReason } from "./prebuild-gmouvmJZ.mjs";
+import { t as buildPlacementRecord } from "./placement-log-DIFPQAXp.mjs";
+import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-DVsvSwf7.mjs";
+import { a as PLATFORM, h as displayPath } from "./support-BGSCBoib.mjs";
 import { t as AndroidRecipeRefusal } from "./android-project-BCAAmMwz.mjs";
 import { rmSync } from "node:fs";
 import { join } from "node:path";
@@ -28,7 +28,7 @@ function fail(code, message, remedy, extra = {}) {
 		extra
 	};
 }
-async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe, targetOffloadRefusal, buildPlan, cacheProviderConfig, requestedBuildCache, easBuild, androidPackage: initialPackage, record, maxBuilds, progress }, { acquireLock, releaseLock, waitForBuild, easAuth, resolveRemoteBuild, uploadRemoteBuild, loadCacheProviderModule, acquireSlot, releaseSlot, now }) {
+async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe, targetOffloadRefusal, buildPlan, cacheProviderConfig, requestedBuildCache, easBuild, androidPackage: initialPackage, record, maxBuilds, progress }, { acquireLock, releaseLock, waitForBuild, easAuth, resolveRemoteBuild, uploadRemoteBuild, loadCacheProviderModule, storedAppId: entryAppId, acquireSlot, releaseSlot, now }) {
 	const { phase, out, stats, step, miss, hit: lateHit, place, waitingOn, waitingFor } = progress;
 	let fallbackMachine = null;
 	let hereReason = "no remote machine is paired";
@@ -780,18 +780,24 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 			now
 		}
 	});
-	if (!acquired.ok) return {
-		ok: false,
-		failure: acquired.failure,
-		ccache: ccacheActivity
-	};
+	if (!acquired.ok) {
+		recipe.fingerprintCheck?.()?.cancel();
+		return {
+			ok: false,
+			failure: acquired.failure,
+			ccache: ccacheActivity
+		};
+	}
 	return {
 		ok: true,
 		artifact: {
 			apkPath: acquired.artifact,
 			handoff,
 			androidPackage,
+			apkPackage: record.cacheHit && storeKey ? entryAppId(PLATFORM, storeKey) : null,
+			fingerprintCheck: recipe.fingerprintCheck?.() ?? null,
 			release: async () => {
+				recipe.fingerprintCheck?.()?.cancel();
 				await settleArtifactUploads(providerUpload, uploadPending);
 				acquired.release();
 			},

package/dist/{artifact-Bdt_n9Jc.mjs → artifact-CsAP6AGK.mjs}

@@ -1,17 +1,17 @@
 import { D as ownership_claim_exports, c as throwIfCancelled, x as withDrainingCancellation } from "./exec-VFRpu1iA.mjs";
-import { d as workspaceDir } from "./paths-DQtTgsBf.mjs";
-import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-DxC0k2rk.mjs";
-import { Un as easAuthNote, Wn as isEasAuthFailureText, zn as RESOLVE_TIMEOUT_MS } from "./budget-dPGuhNai.mjs";
-import { d as runCancellationSignal, r as cancelledFailure } from "./native-run-BmH7U8pr.mjs";
-import { _ as providerUploadOutcome, g as providerDownloadPath, h as prepareProviderDownloadDir } from "./build-cache-HFUQ9eLz.mjs";
-import { o as compilationCacheActivityLine, t as COMPILATION_CACHE_NOT_RUN } from "./xcode-DHu41qQ4.mjs";
-import { C as COMPILATION_CACHE_CORRUPT, c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, u as remotePhaseText, w as clearCorruptCompilationCache } from "./client-18-ZowoT.mjs";
-import { i as namedBuildMachine, o as requireLocalBuild, r as fingerprintMismatchRemedy, t as OffloadRefusal } from "./selection-BLtvaqxc.mjs";
-import { S as xcodeFailureReport, p as printDiagnostics } from "./support-B1W-hmC2.mjs";
-import { u as skippedMissReason } from "./prebuild-DmVCf5xb.mjs";
-import { t as buildPlacementRecord } from "./placement-log-DUvqqsB-.mjs";
-import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-CEs02U2o.mjs";
-import { r as finishIosUpload, t as IosRecipeRefusal } from "./ios-project-KYqeJURj.mjs";
+import { E as workspaceDir } from "./workspace-state-pUg3_RRA.mjs";
+import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-BF5AR2dL.mjs";
+import { Jn as easAuthNote, Wn as RESOLVE_TIMEOUT_MS, Yn as isEasAuthFailureText } from "./budget-k2mZGvvk.mjs";
+import { d as runCancellationSignal, r as cancelledFailure } from "./native-run-BfIDFKLH.mjs";
+import { b as providerUploadOutcome, v as prepareProviderDownloadDir, w as storedAppId, y as providerDownloadPath } from "./build-cache-DrXNCy3T.mjs";
+import { P as compilationCacheActivityLine, k as COMPILATION_CACHE_NOT_RUN } from "./toolchain-J4J8MrAr.mjs";
+import { C as COMPILATION_CACHE_CORRUPT, c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, s as offloadCheck, u as remotePhaseText, w as clearCorruptCompilationCache } from "./client-D9CaRks-.mjs";
+import { i as namedBuildMachine, o as podsFailedRemedy, p as predictedRefusal, r as fingerprintMismatchRemedy, s as requireLocalBuild, t as OffloadRefusal } from "./selection-BNPBZ6T5.mjs";
+import { S as xcodeFailureReport, p as printDiagnostics } from "./support-CVOCp0Ft.mjs";
+import { f as settleFingerprintCheck, u as skippedMissReason } from "./prebuild-gmouvmJZ.mjs";
+import { t as buildPlacementRecord } from "./placement-log-DIFPQAXp.mjs";
+import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-DVsvSwf7.mjs";
+import { r as finishIosUpload, t as IosRecipeRefusal } from "./ios-project-Ty5pHl9O.mjs";
 import { rmSync } from "node:fs";
 import { join } from "node:path";
 import { machineCapacity } from "@stim-cli/core/state";
@@ -354,6 +354,13 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 			if (mode !== "off") phase("build", `placement: here (${placement.reason})`);
 			return null;
 		}
+		const named = machines.find((each) => each.machine === buildMachine);
+		const offload = recipe.offload;
+		if (placement.code === "named" && named && offload && runtime) {
+			const { problems } = await offloadCheck(root, async () => [await offload.target(runtime)])(named);
+			const predicted = predictedRefusal(buildMachine, problems);
+			if (predicted) throw new OffloadRefusal(buildMachine, predicted.reason, predicted.remedy);
+		}
 		return {
 			cacheOnly: false,
 			mode,
@@ -364,14 +371,17 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 			machines
 		};
 	}
+	let localCocoapods = null;
 	/** Asks the paired machines once the post-mutation key is known; null builds here. */
 	async function chooseMachine(candidate) {
 		const offload = recipe.offload;
 		if (!offload) return null;
 		let asked = [];
+		const target = await offload.target(candidate.runtime);
+		localCocoapods = target.platform === "ios" ? target.local.cocoapods : null;
 		const choice = await chooseBuildMachine({
 			projectRoot: root,
-			target: await offload.target(candidate.runtime),
+			target,
 			mode: candidate.mode,
 			here: candidate.here,
 			note: (line) => note(chalk.dim(phaseLine("build", `offload: ${line}`))),
@@ -484,7 +494,7 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 			fallBack(`${choice.machine}: ${why}`, `offload failed: ${why}`, {
 				code: corrupt === void 0 ? "offload-failed" : COMPILATION_CACHE_CORRUPT,
 				machine: choice.machine,
-				remedy: outcome.ok ? void 0 : fingerprintMismatchRemedy(outcome.reason)
+				remedy: outcome.ok ? void 0 : fingerprintMismatchRemedy(outcome.reason) ?? podsFailedRemedy(choice.machine, outcome.reason, localCocoapods)
 			});
 			logWriter().write({
 				src: "build",
@@ -778,18 +788,21 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 		logFile,
 		deps: d
 	});
-	if (!acquired.ok) return {
-		ok: false,
-		failure: acquired.failure,
-		compilationCache
-	};
+	if (!acquired.ok) {
+		recipe.fingerprintCheck?.()?.cancel();
+		return {
+			ok: false,
+			failure: acquired.failure,
+			compilationCache
+		};
+	}
 	appPath = acquired.artifact;
 	return {
 		ok: true,
 		artifact: {
 			handoff,
 			path: appPath,
-			bundleId,
+			bundleId: bundleId ?? (cacheHit && storeKey ? storedAppId("ios", storeKey) : null),
 			cache: {
 				identity: storeHash && storeKey ? {
 					fingerprint: storeHash,
@@ -822,8 +835,10 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 					if (outcome.warn) note(chalk.yellow(phaseLine("cache", outcome.line)));
 					else phase("cache", outcome.line);
 				}
+				await settleFingerprintCheck(recipe.fingerprintCheck?.() ?? null, "ios", (line) => note(chalk.yellow(phaseLine("fingerprint", line))), (record) => logWriter().write(record));
 				return abandonedRemote || uploadWasAbandoned;
 			},
+			cancelFingerprintCheck: () => recipe.fingerprintCheck?.()?.cancel(),
 			release: async () => {
 				await settleArtifactUploads(providerUpload, uploadPending);
 				acquired.release();

package/dist/{attempt-DW-mQqM7.mjs → attempt-ClyJlZPT.mjs}

@@ -10,13 +10,15 @@ function due(state, settings, now, attemptedAt) {
 		pressure: settings.pressureCheckMinutes * 6e4,
 		size: settings.sizeCheckMinutes * 6e4,
 		worktree: settings.removeFinishedWorktrees ? settings.worktreeCheckMinutes * 6e4 : Infinity,
-		sweep: settings.sweepHours > 0 ? settings.sweepHours * 36e5 : Infinity
+		sweep: settings.sweepHours > 0 ? settings.sweepHours * 36e5 : Infinity,
+		idle: settings.idleCheckMinutes * 6e4
 	};
 	return [
 		"pressure",
 		"size",
 		"worktree",
-		"sweep"
+		"sweep",
+		"idle"
 	].filter((check) => {
 		if (intervalMs[check] === Infinity || elapsed(state?.deferredAt?.[check]) < DEFERRED_RETRY_MS) return false;
 		return elapsed(state?.lastAt[check]) >= intervalMs[check];

package/dist/{browser-web-ycg9qWB8.mjs → browser-web-rYPyqhTf.mjs}

@@ -1,18 +1,17 @@
 import { D as ownership_claim_exports, S as process_identity_exports, c as throwIfCancelled, l as WorkspaceProcessCleanupError, s as cancelledError, t as getExecutor, u as withWorkspaceProcessLock } from "./exec-VFRpu1iA.mjs";
-import { d as workspaceDir, m as workspaceLogsDir$1 } from "./paths-DQtTgsBf.mjs";
-import { p as getProject } from "./config-BZhXY15H.mjs";
-import { l as phaseLine } from "./command-output-DxC0k2rk.mjs";
-import { l as withWorkspaceStateLockAsync, r as readWorkspaceState$1 } from "./workspace-state-CeBpIZgr.mjs";
-import { a as SETTING_SHAPE_REMEDY, at as webSettings, j as metroPortSetting } from "./settings-RKwY33wv.mjs";
-import { b as isPackageResolvable, v as detectIsExpo } from "./project-Dz-hWkb-.mjs";
-import { d as resolveProjectMetro } from "./metro-Bu8LBfzS.mjs";
+import { E as workspaceDir, k as workspaceLogsDir$1, l as withWorkspaceStateLockAsync, r as readWorkspaceState$1 } from "./workspace-state-pUg3_RRA.mjs";
+import { p as getProject } from "./config-BktkY_zC.mjs";
+import { l as phaseLine } from "./command-output-BF5AR2dL.mjs";
+import { M as metroPortSetting, a as SETTING_SHAPE_REMEDY, ot as webSettings } from "./settings-CosW5X-S.mjs";
+import { b as isPackageResolvable, v as detectIsExpo } from "./project-BUu6Is4k.mjs";
+import { d as resolveProjectMetro } from "./metro-CjC10t6E.mjs";
 import { s as readNdjsonGenerations$1 } from "./ndjson-CgE_o3Dl.mjs";
-import { f as webLogFile, m as webSupervisorLogFile, o as readWebRecord, s as updateWebRecord } from "./state-B1ig0Kqy.mjs";
-import { nn as readMetroRecords } from "./budget-dPGuhNai.mjs";
-import { D as teardownBrowserHeld, g as resolveSupervisorTarget } from "./workspaces-CSV2Orf4.mjs";
-import { i as reserveBrowserPort, n as getNamedPort } from "./named-ports-BWDuU5oQ.mjs";
+import { f as webLogFile, m as webSupervisorLogFile, o as readWebRecord, s as updateWebRecord } from "./state-C1i2nMOP.mjs";
+import { sn as readMetroRecords } from "./budget-k2mZGvvk.mjs";
+import { D as teardownBrowserHeld, g as resolveSupervisorTarget } from "./workspaces-g2lhdBXF.mjs";
+import { i as reserveBrowserPort, n as getNamedPort } from "./named-ports-BG0j1X4g.mjs";
 import { n as sendToOwnedPage, t as liveWebRecord } from "./page-CzEA_-5_.mjs";
-import { o as resolveWorkspaceMetroPort } from "./start-BKGrEhzG.mjs";
+import { o as resolveWorkspaceMetroPort } from "./start-_BdJ32cZ.mjs";
 import { t as spawnEntry } from "./spawn-entry-jw19m8Nl.mjs";
 import { n as windowsLauncherArgs } from "./detached-entry-KmieOKgN.mjs";
 import { a as findChrome, t as CHROME_INSTALL_REMEDY } from "./chrome-BvV8ssI3.mjs";