stim 1.25.0 → 1.27.0

package/dist/api.mjs

@@ -1,31 +1,32 @@
-import { D as ownership_claim_exports, T as trackReportResource, b as operationState, c as throwIfCancelled, l as WorkspaceProcessCleanupError, s as cancelledError, w as runReport } from "./exec-VFRpu1iA.mjs";
-import { d as workspaceDir, m as workspaceLogsDir$1, r as ensureWorkspaceStorageAsync } from "./paths-DQtTgsBf.mjs";
-import { E as upsertProject, O as withConfigLockAsync$1, p as getProject, q as validateDeviceSlot, y as refuseRelativeStimPaths } from "./config-BZhXY15H.mjs";
-import { l as phaseLine } from "./command-output-BBvS1H6v.mjs";
-import { a as recordWorkspaceUseAsync } from "./workspace-state-CPSp3mav.mjs";
-import { Pt as repoRootAsync, Y as resolveProjectSettingsAsync, a as SETTING_SHAPE_REMEDY, at as unknownSettingKeys, p as cacheProviderSettingError, tt as settingShapeErrors } from "./settings-B5tCoq9N.mjs";
-import { c as projectProblem, f as projectRegistry, i as findProjectRoot$1, r as findCommandWorkspaceAsync, t as NO_PROJECT_REFUSAL } from "./project-BiC68mIp.mjs";
-import { n as macosDir } from "./state-DPaM3u5K.mjs";
-import { c as ensureHomeIdentity, s as workspaceShareURL } from "./stim-desktop-DS0mzR8U.mjs";
-import { r as createNdjsonWriter } from "./ndjson-CgE_o3Dl.mjs";
-import { B as recordFinishedBuild, H as startBuildProgress, U as tapBuildLog } from "./budget-HyShrIpL.mjs";
-import { d as runCancellationSignal, f as withNativeBuildRun } from "./native-run-D5OJsGwA.mjs";
-import { c as resolveBuildPlacement } from "./selection-D5cxEl3t.mjs";
-import { c as stopWorkspaceNow } from "./stop-Db9Kh-UA.mjs";
-import { r as runReload } from "./reload-FbSgMF8x.mjs";
-import { c as startDevServer } from "./start-YMpNwLhh.mjs";
-import { s as recordDoctorCheck } from "./doctor-watchman-BovI1y3-.mjs";
-import { a as readDoctorReport } from "./doctor-k3P3PizH.mjs";
-import { h as warmWorktreeTarget, m as removeWorktreeTarget } from "./worktree-CclFIe1Z.mjs";
-import { i as readGcReport, n as executeGc, o as withGcMaintenanceClaim } from "./gc-B9jcnmIk.mjs";
-import { r as readWorkspaceLogs, t as followWorkspaceLogs } from "./logs-BsIRre8x.mjs";
-import { t as readProjectStats } from "./stats-report-n2U5plhk.mjs";
-import { n as buildAndroidOperation, t as buildIosOperation } from "./build-CAiw8Ezm.mjs";
-import { a as readAndroidBuildPlan, i as runAndroidOperation } from "./android-BGwuK3Mc.mjs";
-import { i as readIosBuildPlan, r as runIosOperation } from "./ios-BRVM8b0P.mjs";
-import { a as buildMacosBundle, i as planMacos, n as runMacos } from "./macos-D477nfzH.mjs";
-import { t as runWeb } from "./web-B4Yjyt1G.mjs";
-import { i as SettingsRefusal, o as readSettingsContext, s as readSettingsPayload, t as mutateSetting } from "./settings-write-n0zwfohx.mjs";
+import { D as ownership_claim_exports, T as trackReportResource, b as operationState, c as throwIfCancelled, l as WorkspaceProcessCleanupError, s as cancelledError, w as runReport } from "./exec-aULwtNly.mjs";
+import { E as workspaceDir, a as recordWorkspaceUseAsync, k as workspaceLogsDir$1, v as ensureWorkspaceStorageAsync } from "./workspace-state-BjqdjnJR.mjs";
+import { E as upsertProject, O as withConfigLockAsync$1, p as getProject, q as validateDeviceSlot, y as refuseRelativeStimPaths } from "./config-Cn94Jc0g.mjs";
+import { l as phaseLine } from "./command-output-Dj-WT4BP.mjs";
+import { Lt as repoRootAsync, Z as resolveProjectSettingsAsync, _ as inertSettingWarning, a as SETTING_SHAPE_REMEDY, p as cacheProviderSettingError, rt as settingShapeErrors, st as unknownSettingKeys } from "./settings-BDVI8Ivc.mjs";
+import { c as projectProblem, f as projectRegistry, i as findProjectRoot$1, r as findCommandWorkspaceAsync, t as NO_PROJECT_REFUSAL } from "./project-DYj-HVx6.mjs";
+import { n as macosDir } from "./state-CZxLyetD.mjs";
+import { c as ensureHomeIdentity, s as workspaceShareURL } from "./stim-desktop-CbWo21kb.mjs";
+import { i as createNdjsonWriter } from "./ndjson-Dy2W4vRa.mjs";
+import { Q as errorRemedy, X as tapBuildLog, Y as startBuildProgress, q as recordFinishedBuild } from "./workspaces-DFbj07jp.mjs";
+import { ot as runCancellationSignal, st as withNativeBuildRun } from "./toolchain-CbCG6C5Z.mjs";
+import { d as resolveBuildPlacement } from "./selection-Bs8phwhN.mjs";
+import { c as stopWorkspaceNow } from "./stop-D-EAr25B.mjs";
+import { r as runReload } from "./reload-fUdkH2_p.mjs";
+import { h as warmWorktreeTarget, m as removeWorktreeTarget } from "./worktree-COAJ3-OD.mjs";
+import { i as restoreLightenedDependencies } from "./lightened-BCsdAGj_.mjs";
+import { c as startDevServer } from "./start-DrPwER_2.mjs";
+import { s as recordDoctorCheck } from "./doctor-watchman-CxDbyrrt.mjs";
+import { c as readSettingsPayload, s as readSettingsContext, t as SettingsRefusal } from "./settings-payload-cm60Zhib.mjs";
+import { a as readDoctorReport } from "./doctor-DyqE9n1J.mjs";
+import { i as readGcReport, n as executeGc, o as withGcMaintenanceClaim } from "./gc-CGZ1Yg88.mjs";
+import { r as readWorkspaceLogs, t as followWorkspaceLogs } from "./logs-CC_-ZzEE.mjs";
+import { t as readProjectStats } from "./stats-report-B86Cv7Uc.mjs";
+import { n as buildAndroidOperation, t as buildIosOperation } from "./build-hS0QyFlQ.mjs";
+import { a as readAndroidBuildPlan, i as runAndroidOperation } from "./android-Cd6w7_qw.mjs";
+import { i as readIosBuildPlan, r as runIosOperation } from "./ios-B5HlVMhQ.mjs";
+import { a as buildMacosBundle, i as planMacos, n as runMacos } from "./macos-DlCBhMw5.mjs";
+import { t as runWeb } from "./web-Cq_AQ4DK.mjs";
+import { t as mutateSetting } from "./settings-write-BdNRLlBn.mjs";
 import { randomBytes } from "node:crypto";
 import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync } from "node:fs";
 import { stripVTControlCharacters } from "node:util";
@@ -79,6 +80,7 @@ async function buildMacosOperation(context, root, options) {
 		};
 		let directory;
 		let succeeded = false;
+		let remedy;
 		try {
 			const artifacts = join(workspaceDir(root), "artifacts");
 			mkdirSync(artifacts, { recursive: true });
@@ -117,6 +119,7 @@ async function buildMacosOperation(context, root, options) {
 			build.state = "failed";
 			build.error = failure instanceof Error ? failure.message : String(failure);
 			build.errorCode = failure.code;
+			remedy = errorRemedy(failure);
 			throw failure;
 		} finally {
 			build.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -137,7 +140,11 @@ async function buildMacosOperation(context, root, options) {
 					builtOn: build.builtOn,
 					offloadedTo: build.offloadedTo,
 					offloadFallback: build.offloadFallback,
-					compileSteps: progress.steps()
+					compileSteps: progress.steps(),
+					...build.error ? { ledger: {
+						message: build.error,
+						remedy
+					} } : {}
 				}, { artifactOnly: true });
 			} catch (error) {
 				note(phaseLine("state", `could not record the build: ${error?.message || error}`));
@@ -317,7 +324,7 @@ function createStim(options) {
 			}), () => {});
 			return task;
 		}),
-		gc: ({ signal, olderThan, cache, worktrees } = {}) => {
+		gc: ({ signal, olderThan, cache, worktrees, measureBuildState } = {}) => {
 			if (olderThan !== void 0 && !Number.isSafeInteger(olderThan)) return Promise.reject(new StimError({
 				code: "STIM_BAD_ARG",
 				message: "olderThan must be a whole number of days."
@@ -326,7 +333,8 @@ function createStim(options) {
 				const result = await readGcReport({
 					olderThan,
 					cache,
-					worktrees
+					worktrees,
+					measureBuildState
 				}, {
 					operation: context,
 					easLedgerRoot: join(context.env.HOME || context.env.USERPROFILE || homedir(), ".stim", "machine", "eas")
@@ -611,6 +619,8 @@ async function start(context, options) {
 	});
 	const root = findProjectRoot$1(context.projectRoot);
 	if (!root) throw new StimError(NO_PROJECT_REFUSAL);
+	const lightened = await restoreLightenedDependencies(root, context);
+	if (lightened) throw new StimError(lightened);
 	const problem = projectProblem(root, "dev-server");
 	if (problem) throw new StimError({
 		code: "STIM_NO_PROJECT",
@@ -632,7 +642,7 @@ async function start(context, options) {
 			message: shapeErrors.join("\n"),
 			remedy: SETTING_SHAPE_REMEDY
 		});
-		for (const key of unknownSettingKeys(settings)) note(context)(`Warning: setting "${key}" is not read by Stim and will be ignored.`);
+		for (const key of unknownSettingKeys(settings)) note(context)(inertSettingWarning(settings, key));
 		const cacheError = cacheProviderSettingError(settings);
 		if (cacheError) note(context)(`Warning: ${cacheError} No cache provider is used.`);
 		await ensureWorkspaceStorageAsync(root, context.signal);

package/dist/apk-signed-tail-BHQHx3Rm.mjs

@@ -0,0 +1,142 @@
+import { y as sharedBuildCache } from "./workspace-state-BjqdjnJR.mjs";
+import { E as findBuildTool } from "./android-DriNoAVy.mjs";
+import { createHash, randomUUID } from "node:crypto";
+import { closeSync, fstatSync, openSync, readFileSync, readSync, realpathSync, renameSync, rmSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
+import { writeFile } from "node:fs/promises";
+//#region src/engine/apk-signed-tail.ts
+const SIGNED_TAIL_FILE = "apk-signed-tail.json";
+const EOCD_SIGNATURE = 101010256;
+const EOCD_MIN_BYTES = 22;
+const EOCD_SEARCH_BYTES = 65557;
+const SIGNING_BLOCK_FOOTER_BYTES = 24;
+const SIGNING_BLOCK_MAGIC = "APK Sig Block 42";
+const SIGNATURE_SCHEME_IDS = /* @__PURE__ */ new Set([1896449818, 4031998144]);
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+const VERIFIED_V2_OR_V3 = /^Verified using v[23] scheme \(APK Signature Scheme v[23]\): true\s*$/m;
+/**
+* The offset where an APK's v2 or v3 signing block starts, or null when the file has no such block, is ZIP64, or is
+* malformed. https://source.android.com/docs/security/features/apksigning/v2#apk-signing-block
+*/
+function signingBlockOffset(size, read) {
+	if (size < EOCD_MIN_BYTES) return null;
+	const searched = Math.min(size, EOCD_SEARCH_BYTES);
+	const end = read(size - searched, searched);
+	let eocd = -1;
+	for (let i = end.length - EOCD_MIN_BYTES; i >= 0; i--) if (end.readUInt32LE(i) === EOCD_SIGNATURE && i + EOCD_MIN_BYTES + end.readUInt16LE(i + 20) === end.length) {
+		eocd = i;
+		break;
+	}
+	if (eocd < 0) return null;
+	const directoryOffset = end.readUInt32LE(eocd + 16);
+	if (directoryOffset === 4294967295 || directoryOffset < 32) return null;
+	const footer = read(directoryOffset - SIGNING_BLOCK_FOOTER_BYTES, SIGNING_BLOCK_FOOTER_BYTES);
+	if (footer.subarray(8).toString("latin1") !== SIGNING_BLOCK_MAGIC) return null;
+	const blockSize = footer.readBigUInt64LE(0);
+	if (blockSize < BigInt(SIGNING_BLOCK_FOOTER_BYTES) || blockSize + 8n > BigInt(directoryOffset)) return null;
+	const start = directoryOffset - Number(blockSize) - 8;
+	const pairs = read(start, Number(blockSize) + 8 - SIGNING_BLOCK_FOOTER_BYTES);
+	if (pairs.readBigUInt64LE(0) !== blockSize) return null;
+	let position = 8;
+	while (position + 12 <= pairs.length) {
+		const length = pairs.readBigUInt64LE(position);
+		if (length < 4n || length > BigInt(pairs.length - position - 8)) return null;
+		if (SIGNATURE_SCHEME_IDS.has(pairs.readUInt32LE(position + 8))) return start;
+		position += 8 + Number(length);
+	}
+	return null;
+}
+function readSignedTail(apkPath) {
+	let fd = null;
+	try {
+		fd = openSync(apkPath, "r");
+		const open = fd;
+		const size = fstatSync(open).size;
+		const read = (position, length) => {
+			const buffer = Buffer.alloc(length);
+			if (readSync(open, buffer, 0, length, position) !== length) throw new Error("short read");
+			return buffer;
+		};
+		const tailOffset = signingBlockOffset(size, read);
+		if (tailOffset === null) return null;
+		const tailSha256 = createHash("sha256").update(read(tailOffset, size - tailOffset)).digest("hex");
+		return {
+			file: basename(apkPath),
+			size,
+			tailOffset,
+			tailSha256
+		};
+	} catch {
+		return null;
+	} finally {
+		if (fd !== null) try {
+			closeSync(fd);
+		} catch {}
+	}
+}
+const apksignerPath = () => findBuildTool(["apksigner"])?.path ?? null;
+async function computeSignedTail(apkPath, run, findSigner = apksignerPath) {
+	const tail = readSignedTail(apkPath);
+	if (!tail) return null;
+	const signer = findSigner();
+	if (!signer) return null;
+	try {
+		if (!VERIFIED_V2_OR_V3.test(String(await run(signer, [
+			"verify",
+			"--verbose",
+			apkPath
+		])))) return null;
+	} catch {
+		return null;
+	}
+	const after = readSignedTail(apkPath);
+	return after && after.size === tail.size && after.tailSha256 === tail.tailSha256 ? tail : null;
+}
+function recordedSignedTail(apkPath) {
+	try {
+		const parsed = JSON.parse(readFileSync(join(dirname(apkPath), SIGNED_TAIL_FILE), "utf-8"));
+		if (!parsed || typeof parsed !== "object" || !("file" in parsed) || !("size" in parsed) || !("tailOffset" in parsed) || !("tailSha256" in parsed)) return null;
+		const { file, size, tailOffset, tailSha256 } = parsed;
+		if (file !== basename(apkPath) || typeof size !== "number" || typeof tailOffset !== "number" || typeof tailSha256 !== "string" || !SHA256_HEX.test(tailSha256) || !Number.isSafeInteger(size) || !Number.isSafeInteger(tailOffset) || tailOffset < 0 || tailOffset >= size) return null;
+		const current = readSignedTail(apkPath);
+		if (!current || current.size !== size || current.tailOffset !== tailOffset || current.tailSha256 !== tailSha256) return null;
+		return {
+			file,
+			size,
+			tailOffset,
+			tailSha256
+		};
+	} catch {
+		return null;
+	}
+}
+async function writeSignedTail(dir, tail) {
+	const target = join(dir, SIGNED_TAIL_FILE);
+	const temporary = `${target}.${randomUUID()}.tmp`;
+	try {
+		await writeFile(temporary, JSON.stringify(tail));
+		renameSync(temporary, target);
+	} catch (error) {
+		rmSync(temporary, { force: true });
+		throw error;
+	}
+}
+function inBuildCacheEntry(apkPath) {
+	try {
+		return realpathSync(dirname(dirname(apkPath))) === realpathSync(join(sharedBuildCache(), "android"));
+	} catch {
+		return false;
+	}
+}
+async function signedTailFor(apkPath, run, findSigner) {
+	const recorded = recordedSignedTail(apkPath);
+	if (recorded || !inBuildCacheEntry(apkPath)) return recorded;
+	const computed = await computeSignedTail(apkPath, run, findSigner);
+	if (!computed) return null;
+	try {
+		await writeSignedTail(dirname(apkPath), computed);
+	} catch {}
+	return computed;
+}
+//#endregion
+export { signedTailFor as n, writeSignedTail as r, computeSignedTail as t };

package/dist/{artifact-Co8zixVx.mjs → artifact-0AGJYB9O.mjs}

@@ -1,17 +1,16 @@
-import { D as ownership_claim_exports, c as throwIfCancelled, x as withDrainingCancellation } from "./exec-VFRpu1iA.mjs";
-import { d as workspaceDir } from "./paths-DQtTgsBf.mjs";
-import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-BBvS1H6v.mjs";
-import { Bn as RESOLVE_TIMEOUT_MS, Gn as isEasAuthFailureText, Wn as easAuthNote } from "./budget-HyShrIpL.mjs";
-import { d as runCancellationSignal, r as cancelledFailure } from "./native-run-D5OJsGwA.mjs";
-import { g as providerDownloadPath, h as prepareProviderDownloadDir } from "./build-cache-CKCzxzxA.mjs";
-import { n as CCACHE_UNAVAILABLE, r as ccacheActivityLine, t as CCACHE_NOT_RUN } from "./ccache-h1FKhZeg.mjs";
-import { c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, u as remotePhaseText } from "./client-BQsmyp_-.mjs";
-import { i as namedBuildMachine, o as requireLocalBuild, r as fingerprintMismatchRemedy, t as OffloadRefusal } from "./selection-D5cxEl3t.mjs";
-import { f as formatDiagnostic } from "./react-native-build-CwZB-agu.mjs";
-import { u as skippedMissReason } from "./prebuild-JUaqOLpc.mjs";
-import { t as buildPlacementRecord } from "./placement-log-DjOXJRIH.mjs";
-import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-zA4S7RHE.mjs";
-import { a as PLATFORM, h as displayPath } from "./support-Cxj9CmII.mjs";
+import { D as ownership_claim_exports, c as throwIfCancelled, x as withDrainingCancellation } from "./exec-aULwtNly.mjs";
+import { E as workspaceDir } from "./workspace-state-BjqdjnJR.mjs";
+import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-Dj-WT4BP.mjs";
+import { Dn as RESOLVE_TIMEOUT_MS, Mn as isEasAuthFailureText, jn as easAuthNote, n as CCACHE_UNAVAILABLE, r as ccacheActivityLine, t as CCACHE_NOT_RUN } from "./ccache-BWTze1Ls.mjs";
+import { Q as cancelledFailure, ot as runCancellationSignal } from "./toolchain-CbCG6C5Z.mjs";
+import { b as providerDownloadPath, y as prepareProviderDownloadDir } from "./build-cache-gBJ-WKzA.mjs";
+import { c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, u as remotePhaseText } from "./client-xsdxrhWA.mjs";
+import { a as missingPackageManagerRemedy, i as fingerprintMismatchRemedy, l as requireLocalBuild, n as automaticBuild, o as namedBuildMachine, t as OffloadRefusal } from "./selection-Bs8phwhN.mjs";
+import { f as formatDiagnostic } from "./react-native-build-DaK2IFyP.mjs";
+import { u as skippedMissReason } from "./prebuild-BDpToDgR.mjs";
+import { t as buildPlacementRecord } from "./placement-log-BXUbiZM6.mjs";
+import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-BKN2Yuhg.mjs";
+import { a as PLATFORM, h as displayPath } from "./support-CNg_YsOk.mjs";
 import { t as AndroidRecipeRefusal } from "./android-project-BCAAmMwz.mjs";
 import { rmSync } from "node:fs";
 import { join } from "node:path";
@@ -47,7 +46,7 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 			}
 		}));
 		if (namedBuildMachine(buildMachine)) throw new OffloadRefusal(buildMachine, reason, info.remedy);
-		requireLocalBuild(buildMachine);
+		requireLocalBuild(buildMachine, reason);
 		record.offloadFallback = reason;
 		phase("build", `${line} -> building here`);
 	};
@@ -295,7 +294,7 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 		try {
 			slotWaitMs = (await run.takeBuildSlot({
 				signal,
-				automatic: buildMachine === "auto",
+				automatic: automaticBuild(buildMachine),
 				max: maxBuilds,
 				out,
 				waitingFor: (info) => waitingFor?.(info, "build-slot")
@@ -319,12 +318,11 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 			hereReason = cacheIneligible;
 			return null;
 		}
-		const { mode, machines, localEnabled } = buildPlacementCandidates(buildMachine);
+		const { machines, localEnabled } = buildPlacementCandidates(buildMachine);
 		if (localEnabled && machines.length === 0 && !namedBuildMachine(buildMachine) && buildMachine !== "local") return null;
 		const unsupported = targetOffloadRefusal ?? (recipe.offload ? recipe.offload.unsupported : "this project integration does not support offloaded builds");
 		const here = machineCapacity();
 		const placement = offloadPlacement({
-			mode,
 			localEnabled,
 			machines: machines.length,
 			here,
@@ -335,7 +333,6 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 			hereReason = placement.reason;
 			if (placement.code === "this-mac-free" && cachePolicy.read && cachePolicy.remote && (recipe.offload?.uncachedArtifacts || recipe.offload && !recipe.offload.request.native)) return {
 				cacheOnly: true,
-				mode,
 				here,
 				code: placement.code,
 				reason: placement.reason,
@@ -349,12 +346,11 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 					reason: placement.reason
 				}
 			}));
-			if (mode !== "off") phase("build", `placement: here (${placement.reason})`);
+			if (buildMachine !== "local") phase("build", `placement: here (${placement.reason})`);
 			return null;
 		}
 		return {
 			cacheOnly: false,
-			mode,
 			here,
 			code: placement.code,
 			reason: placement.reason,
@@ -377,7 +373,6 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 		const choice = await chooseBuildMachine({
 			projectRoot: root,
 			target,
-			mode: candidate.mode,
 			here: candidate.here,
 			note: (line) => phase("build", chalk.dim(`offload: ${line}`)),
 			machines: candidate.machines,
@@ -506,7 +501,7 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 			fallBack(`${choice.machine}: ${why}`, `offload failed: ${why}`, {
 				code: "offload-failed",
 				machine: choice.machine,
-				remedy: outcome.ok ? void 0 : fingerprintMismatchRemedy(outcome.reason)
+				remedy: outcome.ok ? void 0 : fingerprintMismatchRemedy(outcome.reason) ?? missingPackageManagerRemedy(choice.machine, outcome.reason)
 			});
 			writer.write({
 				src: "build",
@@ -780,11 +775,14 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 			now
 		}
 	});
-	if (!acquired.ok) return {
-		ok: false,
-		failure: acquired.failure,
-		ccache: ccacheActivity
-	};
+	if (!acquired.ok) {
+		recipe.fingerprintCheck?.()?.cancel();
+		return {
+			ok: false,
+			failure: acquired.failure,
+			ccache: ccacheActivity
+		};
+	}
 	return {
 		ok: true,
 		artifact: {
@@ -792,7 +790,9 @@ async function acquireAndroidArtifact({ context, root, buildLog, writer, recipe,
 			handoff,
 			androidPackage,
 			apkPackage: record.cacheHit && storeKey ? entryAppId(PLATFORM, storeKey) : null,
+			fingerprintCheck: recipe.fingerprintCheck?.() ?? null,
 			release: async () => {
+				recipe.fingerprintCheck?.()?.cancel();
 				await settleArtifactUploads(providerUpload, uploadPending);
 				acquired.release();
 			},

package/dist/{artifact-DN8JNwqS.mjs → artifact-faemIZv5.mjs}

@@ -1,17 +1,16 @@
-import { D as ownership_claim_exports, c as throwIfCancelled, x as withDrainingCancellation } from "./exec-VFRpu1iA.mjs";
-import { d as workspaceDir } from "./paths-DQtTgsBf.mjs";
-import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-BBvS1H6v.mjs";
-import { Bn as RESOLVE_TIMEOUT_MS, Gn as isEasAuthFailureText, Wn as easAuthNote } from "./budget-HyShrIpL.mjs";
-import { d as runCancellationSignal, r as cancelledFailure } from "./native-run-D5OJsGwA.mjs";
-import { _ as providerUploadOutcome, g as providerDownloadPath, h as prepareProviderDownloadDir, x as storedAppId } from "./build-cache-CKCzxzxA.mjs";
-import { o as compilationCacheActivityLine, t as COMPILATION_CACHE_NOT_RUN } from "./xcode-CiIIDnuD.mjs";
-import { C as COMPILATION_CACHE_CORRUPT, c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, u as remotePhaseText, w as clearCorruptCompilationCache } from "./client-BQsmyp_-.mjs";
-import { i as namedBuildMachine, o as requireLocalBuild, r as fingerprintMismatchRemedy, t as OffloadRefusal } from "./selection-D5cxEl3t.mjs";
-import { S as xcodeFailureReport, p as printDiagnostics } from "./support-qKcbgmI5.mjs";
-import { u as skippedMissReason } from "./prebuild-JUaqOLpc.mjs";
-import { t as buildPlacementRecord } from "./placement-log-DjOXJRIH.mjs";
-import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-zA4S7RHE.mjs";
-import { r as finishIosUpload, t as IosRecipeRefusal } from "./ios-project-DCUDo06I.mjs";
+import { D as ownership_claim_exports, c as throwIfCancelled, x as withDrainingCancellation } from "./exec-aULwtNly.mjs";
+import { E as workspaceDir } from "./workspace-state-BjqdjnJR.mjs";
+import { _ as stepTimer, i as formatDuration, l as phaseLine, m as shortHash } from "./command-output-Dj-WT4BP.mjs";
+import { Dn as RESOLVE_TIMEOUT_MS, Mn as isEasAuthFailureText, jn as easAuthNote } from "./ccache-BWTze1Ls.mjs";
+import { P as compilationCacheActivityLine, Q as cancelledFailure, k as COMPILATION_CACHE_NOT_RUN, ot as runCancellationSignal } from "./toolchain-CbCG6C5Z.mjs";
+import { T as storedAppId, b as providerDownloadPath, x as providerUploadOutcome, y as prepareProviderDownloadDir } from "./build-cache-gBJ-WKzA.mjs";
+import { C as COMPILATION_CACHE_CORRUPT, c as offloadPlacement, i as closeOffload, l as placementLoad, n as buildPlacementCandidates, o as offloadBuild, r as chooseBuildMachine, s as offloadCheck, u as remotePhaseText, w as clearCorruptCompilationCache } from "./client-xsdxrhWA.mjs";
+import { a as missingPackageManagerRemedy, c as podsFailedRemedy, h as predictedRefusal, i as fingerprintMismatchRemedy, l as requireLocalBuild, n as automaticBuild, o as namedBuildMachine, t as OffloadRefusal } from "./selection-Bs8phwhN.mjs";
+import { S as xcodeFailureReport, p as printDiagnostics } from "./support-Be0UeVZU.mjs";
+import { f as settleFingerprintCheck, u as skippedMissReason } from "./prebuild-BDpToDgR.mjs";
+import { t as buildPlacementRecord } from "./placement-log-BXUbiZM6.mjs";
+import { n as settleArtifactUploads, t as acquireArtifact } from "./acquire-artifact-BKN2Yuhg.mjs";
+import { r as finishIosUpload, t as IosRecipeRefusal } from "./ios-project-D8Jcy_br.mjs";
 import { rmSync } from "node:fs";
 import { join } from "node:path";
 import { machineCapacity } from "@stim-cli/core/state";
@@ -64,7 +63,7 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 			}
 		}));
 		if (namedBuildMachine(buildMachine)) throw new OffloadRefusal(buildMachine, reason, info.remedy);
-		requireLocalBuild(buildMachine);
+		requireLocalBuild(buildMachine, reason);
 		offloadFallback = reason;
 		buildFailure = {
 			...buildFailure,
@@ -289,7 +288,7 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 		try {
 			slotWaitMs = (await run.takeBuildSlot({
 				signal,
-				automatic: buildMachine === "auto",
+				automatic: automaticBuild(buildMachine),
 				max: maxBuilds,
 				out: note,
 				waitingFor: (info) => waitingFor?.(info, "build-slot")
@@ -314,9 +313,9 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 			hereReason = cacheIneligible;
 			return null;
 		}
-		const { mode, machines, localEnabled } = buildPlacementCandidates(buildMachine);
+		const { machines, localEnabled } = buildPlacementCandidates(buildMachine);
 		if (localEnabled && machines.length === 0 && !namedBuildMachine(buildMachine) && buildMachine !== "local") return null;
-		const { runtime, unsupported } = mode === "off" && !namedBuildMachine(buildMachine) ? {
+		const { runtime, unsupported } = buildMachine === "local" ? {
 			runtime: null,
 			unsupported: null
 		} : await recipe.offload?.context() ?? {
@@ -325,7 +324,6 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 		};
 		const here = machineCapacity();
 		const placement = offloadPlacement({
-			mode,
 			localEnabled,
 			machines: machines.length,
 			here,
@@ -336,7 +334,6 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 			hereReason = placement.reason;
 			if (placement.code === "this-mac-free" && runtime && useBuildCache && cachePolicy.remote && recipe.offload !== void 0) return {
 				cacheOnly: true,
-				mode,
 				here,
 				code: placement.code,
 				reason: placement.reason,
@@ -351,12 +348,18 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 					reason: placement.reason
 				}
 			}));
-			if (mode !== "off") phase("build", `placement: here (${placement.reason})`);
+			if (buildMachine !== "local") phase("build", `placement: here (${placement.reason})`);
 			return null;
 		}
+		const named = machines.find((each) => each.machine === buildMachine);
+		const offload = recipe.offload;
+		if (placement.code === "named" && named && offload && runtime) {
+			const { problems } = await offloadCheck(root, async () => [await offload.target(runtime)])(named);
+			const predicted = predictedRefusal(buildMachine, problems);
+			if (predicted) throw new OffloadRefusal(buildMachine, predicted.reason, predicted.remedy);
+		}
 		return {
 			cacheOnly: false,
-			mode,
 			here,
 			code: placement.code,
 			reason: placement.reason,
@@ -364,15 +367,17 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 			machines
 		};
 	}
+	let localCocoapods = null;
 	/** Asks the paired machines once the post-mutation key is known; null builds here. */
 	async function chooseMachine(candidate) {
 		const offload = recipe.offload;
 		if (!offload) return null;
 		let asked = [];
+		const target = await offload.target(candidate.runtime);
+		localCocoapods = target.platform === "ios" ? target.local.cocoapods : null;
 		const choice = await chooseBuildMachine({
 			projectRoot: root,
-			target: await offload.target(candidate.runtime),
-			mode: candidate.mode,
+			target,
 			here: candidate.here,
 			note: (line) => note(chalk.dim(phaseLine("build", `offload: ${line}`))),
 			machines: candidate.machines,
@@ -484,7 +489,7 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 			fallBack(`${choice.machine}: ${why}`, `offload failed: ${why}`, {
 				code: corrupt === void 0 ? "offload-failed" : COMPILATION_CACHE_CORRUPT,
 				machine: choice.machine,
-				remedy: outcome.ok ? void 0 : fingerprintMismatchRemedy(outcome.reason)
+				remedy: outcome.ok ? void 0 : fingerprintMismatchRemedy(outcome.reason) ?? missingPackageManagerRemedy(choice.machine, outcome.reason) ?? podsFailedRemedy(choice.machine, outcome.reason, localCocoapods)
 			});
 			logWriter().write({
 				src: "build",
@@ -778,11 +783,14 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 		logFile,
 		deps: d
 	});
-	if (!acquired.ok) return {
-		ok: false,
-		failure: acquired.failure,
-		compilationCache
-	};
+	if (!acquired.ok) {
+		recipe.fingerprintCheck?.()?.cancel();
+		return {
+			ok: false,
+			failure: acquired.failure,
+			compilationCache
+		};
+	}
 	appPath = acquired.artifact;
 	return {
 		ok: true,
@@ -822,8 +830,10 @@ async function acquireIosArtifact({ context, root, logFile, recipe, physical, co
 					if (outcome.warn) note(chalk.yellow(phaseLine("cache", outcome.line)));
 					else phase("cache", outcome.line);
 				}
+				await settleFingerprintCheck(recipe.fingerprintCheck?.() ?? null, "ios", (line) => note(chalk.yellow(phaseLine("fingerprint", line))), (record) => logWriter().write(record));
 				return abandonedRemote || uploadWasAbandoned;
 			},
+			cancelFingerprintCheck: () => recipe.fingerprintCheck?.()?.cancel(),
 			release: async () => {
 				await settleArtifactUploads(providerUpload, uploadPending);
 				acquired.release();

package/dist/{artifact-platform-CMRc0M_r.mjs → artifact-platform-BO2Uvk_A.mjs}

@@ -1,4 +1,4 @@
-import { t as getExecutor } from "./exec-VFRpu1iA.mjs";
+import { t as getExecutor } from "./exec-aULwtNly.mjs";
 import { join } from "node:path";
 //#region src/macos/artifact-platform.ts
 async function validateMacosArtifactPlatform(context, bundle, product, signal, nodeArch = process.arch) {

package/dist/{attempt-DW-mQqM7.mjs → attempt-ClyJlZPT.mjs}

@@ -10,13 +10,15 @@ function due(state, settings, now, attemptedAt) {
 		pressure: settings.pressureCheckMinutes * 6e4,
 		size: settings.sizeCheckMinutes * 6e4,
 		worktree: settings.removeFinishedWorktrees ? settings.worktreeCheckMinutes * 6e4 : Infinity,
-		sweep: settings.sweepHours > 0 ? settings.sweepHours * 36e5 : Infinity
+		sweep: settings.sweepHours > 0 ? settings.sweepHours * 36e5 : Infinity,
+		idle: settings.idleCheckMinutes * 6e4
 	};
 	return [
 		"pressure",
 		"size",
 		"worktree",
-		"sweep"
+		"sweep",
+		"idle"
 	].filter((check) => {
 		if (intervalMs[check] === Infinity || elapsed(state?.deferredAt?.[check]) < DEFERRED_RETRY_MS) return false;
 		return elapsed(state?.lastAt[check]) >= intervalMs[check];