stim 1.34.0 → 1.36.0

package/dist/support-BJbXovoO.mjs

@@ -0,0 +1,2089 @@
+import { C as operationState, D as ownership_claim_exports, l as cancellableSleep, n as isTimeoutError, p as withWorkspaceProcessLock, r as reportSignal, t as getExecutor } from "./exec-CGuDzt40.mjs";
+import { D as workspaceId$1, M as withDirLock$1, k as workspaceLogsDir$1 } from "./workspace-state-BhwAJBgA.mjs";
+import { a as formatElapsed, h as shortUdid, l as phaseLine, r as clockTime } from "./command-output-T3cDctRE.mjs";
+import { $ as notOnTailnetDiagnosis, A as withConfigLockAsync$1, B as findPeer$1, G as reachMachine, I as diagnoseOutcome, K as realIo, L as diagnoseTailscale, Q as diagnosisFinding, T as setDevice, U as outdatedServer, W as parseMachine$1, X as tailscaleStatusAsync, Y as setupRemedy, Z as diagnoseLocalUnreachable, a as clearDevice, d as getConfigDir, et as unconfirmedKeyFinding, ft as deviceSlotKey, gt as projectDeviceSlots, pt as deviceSlotPlatforms, tt as readHostPermissions, v as loadConfig$1, w as saveConfig, z as endpoint$1 } from "./config-BA3TgoIP.mjs";
+import { D as iosSimSlimProfileSetting, E as iosSimSlimDefaultSetting, _ as inertSettingWarning, a as SETTING_SHAPE_REMEDY, b as iosProjectDirSetting, p as cacheProviderSettingError, rt as settingShapeErrors, st as unknownSettingKeys, x as iosProjectDirSettingError } from "./settings-Bap-qjnp.mjs";
+import { Ct as selectParked, bt as parkedMaxSetting, gt as dropParked, ht as adoptParked, xt as readParked } from "./android-SJx1V3R3.mjs";
+import { i as createNdjsonWriter } from "./ndjson-CrjIsGzw.mjs";
+import { _ as withDeviceBootAdmission, _n as APP_READINESS_TIMEOUT_MS, f as runtimeMismatch, g as unknownIosRuntimeRefusal, h as unknownIosDeviceTypeRefusal, l as deviceTypeMismatch, n as DeviceAdmissionRefusal, on as MANIFEST_VERIFY_TIMEOUT_MS, t as DEFAULT_DEVICE_SLOT_WAIT_MS, u as layerNote } from "./device-capacity-CpAVcKgq.mjs";
+import { _t as teardownParkedIosSim, ht as teardownOwnedIosSim } from "./workspaces-Dh5N70qW.mjs";
+import { J as describeDiagnostic, s as cocoapodsInstall } from "./toolchain-DCnWAxQL.mjs";
+import { E as releaseRunLease, S as parseLease, T as raiseLease, b as leaseIsExpired, j as takeLease, v as deviceLeasePath, y as fileLeaseIo } from "./activity-BpdDvA8Q.mjs";
+import { A as springBoardRunning, B as reportMemoryCulprits, C as renameIosSim, D as resolveOwnedIosSim, E as resolveIosCreation, F as hostMemoryPressureAdvice, M as waitForSpringBoard, N as configuredIosSimulatorViewer, P as parseIosSimulatorApp, R as readHostMemoryPressure, S as readSpringBoardPid, T as resetIosPrivacy, _ as ownedSimName, a as createOwnedIosSim, d as listAllIosSims, f as listAllIosSimsAsync, h as listIosRuntimesAsync, n as bootIosSim, p as listIosDeviceTypesAsync, u as iosSimulatorFailureAdvice, w as resetIosKeychain, y as parseRuntimeVersion } from "./ios-BhfpRfNf.mjs";
+import { p as resolveOptimizations } from "./errors-DHm_U5gv.mjs";
+import { releaseClaim, tryAcquireClaim } from "@stim-cli/core/ownership-claim";
+import { createHash } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir, hostname } from "node:os";
+import { basename, join } from "node:path";
+import { LOG_ROTATE_BYTES, ambientContext, ambientEnv, withDirLockAsync } from "@stim-cli/core";
+import { MACHINE_CREDENTIALS_VERSION, acceptsShape, automaticMachineEnabled, buildMachinesFile, buildMachinesLock, cannotHost, currentTailnet, deviceHostMachinesClaims, deviceHostMachinesFile, deviceHostMachinesLock, isJsonObject, localEndpoint, parseMachine, placementWord, readBuildMachines, readDeviceHostMachines, settingDefinition, wrongTailnet } from "@stim-cli/core/state";
+import chalk from "chalk";
+import { InvalidArgumentError } from "commander";
+import { mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+//#region src/device-host/machines.ts
+function note$1(title, detail, fix = null) {
+	return {
+		code: "device-host-machine",
+		level: "note",
+		title,
+		detail,
+		fix
+	};
+}
+function configuredMachines() {
+	const remote = loadConfig$1()?.remote;
+	if (remote !== void 0 && !isJsonObject(remote)) return null;
+	const machines = remote?.machines;
+	if (machines === void 0) return [];
+	return acceptsShape(settingDefinition("remote.machines"), machines) ? machines : null;
+}
+/**
+* The `remote.machines` entries this machine asked for device-host access, in setting order, without the ones the
+* tailnet reports as running another OS than macOS, which can never host; null when the setting is invalid.
+*/
+async function hostingMachines(status, signal) {
+	const configured = configuredMachines();
+	if (configured === null) return null;
+	let candidates = configured;
+	try {
+		const asked = readDeviceHostMachines();
+		candidates = configured.filter((machine) => asked.some((each) => each.machine === machine));
+	} catch {
+		candidates = configured;
+	}
+	if (!candidates.some((machine) => parseMachine$1(machine)?.transport === "tailscale")) return candidates;
+	const current = await (status ? status() : tailscaleStatusAsync(signal));
+	signal?.throwIfAborted();
+	return candidates.filter((machine) => !cannotHost(current, machine));
+}
+async function store(machines, operation) {
+	reportSignal(operation)?.throwIfAborted();
+	const write = () => {
+		reportSignal(operation)?.throwIfAborted();
+		const file = deviceHostMachinesFile();
+		const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+		try {
+			writeFileSync(tmp, `${JSON.stringify({
+				version: MACHINE_CREDENTIALS_VERSION,
+				machines
+			}, null, 2)}\n`, { mode: 384 });
+			renameSync(tmp, file);
+		} finally {
+			rmSync(tmp, { force: true });
+		}
+	};
+	const options = { ensureParent: () => mkdirSync(getConfigDir(), { recursive: true }) };
+	const signal = reportSignal(operation);
+	if (signal) await withDirLockAsync(deviceHostMachinesLock(), write, {
+		...options,
+		signal
+	});
+	else withDirLock$1(deviceHostMachinesLock(), write, options);
+}
+/** Forgets this machine's hosting credential for `machine`; false when another run holds the credential claim. */
+async function forgetDeviceHostMachine(machine) {
+	const claim = tryAcquireClaim({
+		root: deviceHostMachinesClaims(),
+		mode: "exclusive",
+		label: "device-host approval"
+	});
+	if (!claim.acquired) {
+		releaseClaim(claim.pending);
+		return false;
+	}
+	try {
+		const credentials = readDeviceHostMachines();
+		if (credentials.some((each) => each.machine === machine)) await store(credentials.filter((each) => each.machine !== machine));
+		return true;
+	} finally {
+		releaseClaim(claim.acquired);
+	}
+}
+function notOnTailnet(machine, ambiguous, stored, current) {
+	const diagnosis = notOnTailnetDiagnosis(machine, ambiguous, stored ? wrongTailnet(stored, current) : null);
+	return {
+		diagnosis,
+		report: {
+			machine,
+			state: "not-on-tailnet",
+			...stored?.tailnet ? { tailnet: stored.tailnet } : {},
+			diagnosis
+		}
+	};
+}
+/**
+* Reports the device-host approval of each remote machine, separate from its build approval. Only `fix` makes a setup
+* ticket, and only `forget`, which defaults to `fix`, forgets the credentials of machines not in `entries`; every
+* server key stays pinned.
+*/
+async function inspectDeviceHostMachines({ fix, forget = fix, version = "<version>", tickets = /* @__PURE__ */ new Map(), operation, confirmKey }, io = realIo, entries = configuredMachines()) {
+	if (entries === null) return {
+		findings: [note$1("Invalid remote.machines setting", "Use a remote object with machines as an array of tailnet names. Existing hosting credentials and pinned keys are preserved.", "Run `stim guide settings` and correct the setting before running doctor again.")],
+		machines: []
+	};
+	const unavailable = (state, finding) => ({
+		findings: [finding],
+		machines: entries.map((machine) => ({
+			machine,
+			state
+		}))
+	});
+	const unreadable = () => unavailable("credentials-unavailable", note$1("Hosting credentials are unreadable", `Stim preserves ${deviceHostMachinesFile()} and its pinned keys.`, "Restore the existing file from a trusted backup or restore read access before running doctor again."));
+	if (!entries.length) {
+		if (!forget) return {
+			findings: [],
+			machines: []
+		};
+		try {
+			if (!readDeviceHostMachines().length) return {
+				findings: [],
+				machines: []
+			};
+		} catch {
+			return unreadable();
+		}
+	}
+	const claim = tryAcquireClaim({
+		root: deviceHostMachinesClaims(),
+		mode: "exclusive",
+		label: "device-host approval"
+	});
+	if (!claim.acquired) {
+		releaseClaim(claim.pending);
+		return unavailable("busy", note$1("Device-host approval is in use", "Another doctor run holds the hosting credential claim. Run doctor again after it finishes."));
+	}
+	try {
+		let credentials;
+		try {
+			credentials = readDeviceHostMachines();
+		} catch {
+			return unreadable();
+		}
+		if (forget) {
+			const kept = credentials.filter((each) => entries.includes(each.machine));
+			if (kept.length !== credentials.length) {
+				await store(kept, operation);
+				credentials = kept;
+			}
+		}
+		if (!entries.length) return {
+			findings: [],
+			machines: []
+		};
+		const tailnet = entries.some((entry) => parseMachine$1(entry)?.transport !== "local");
+		const status = tailnet ? await io.status() : null;
+		const inspected = {
+			findings: [],
+			machines: []
+		};
+		let off = null;
+		if (tailnet && !isJsonObject(status)) {
+			off = await diagnoseTailscale(io);
+			inspected.findings.push(note$1("Remote machines are unreachable", `remote.machines names remote machines. ${off.message}`, off.remedy));
+		}
+		const self = isJsonObject(status) && isJsonObject(status.Self) ? status.Self : {};
+		const deviceName = (typeof self.HostName === "string" && self.HostName ? self.HostName : hostname()).replace(/[\p{Cc}\p{Cf}]/gu, "").trim().slice(0, 64) || "Mac";
+		const namedNodes = /* @__PURE__ */ new Set();
+		for (const machine of new Set(entries)) {
+			const parsed = parseMachine$1(machine);
+			if (!parsed) {
+				inspected.machines.push({
+					machine,
+					state: "invalid"
+				});
+				inspected.findings.push(note$1(`Remote machine ${machine} is not a tailnet name or local: address`, "Expected `name`, `name:port`, `local:<host>` or `local:<host>:port`."));
+				continue;
+			}
+			const local = parsed.transport === "local";
+			if (!local && off) {
+				inspected.machines.push({
+					machine,
+					state: "tailscale-off",
+					diagnosis: off
+				});
+				continue;
+			}
+			const current = local ? null : await io.status();
+			if (!local && !isJsonObject(current)) {
+				const diagnosis = await diagnoseTailscale(io);
+				inspected.machines.push({
+					machine,
+					state: "tailscale-off",
+					diagnosis
+				});
+				inspected.findings.push(diagnosisFinding("device-host-machine", machine, diagnosis));
+				continue;
+			}
+			const peer = local ? null : findPeer$1(current, parsed.name);
+			if (peer === "missing" || peer === "ambiguous") {
+				const { report, diagnosis } = notOnTailnet(machine, peer === "ambiguous", credentials.find((each) => each.machine === machine), current);
+				inspected.machines.push(report);
+				inspected.findings.push(diagnosisFinding("device-host-machine", machine, diagnosis));
+				continue;
+			}
+			const signedIn = local ? null : currentTailnet(current);
+			const target = peer ? endpoint$1(peer, parsed.port) : localEndpoint(parsed.name, parsed.port);
+			const dnsName = peer ? { dnsName: peer.dnsName } : {};
+			const nodeRoute = peer ? `${peer.nodeId}:${parsed.port}` : `local:${parsed.name}:${parsed.port}`;
+			if (namedNodes.has(nodeRoute)) {
+				inspected.machines.push({
+					machine,
+					...dnsName,
+					state: "invalid"
+				});
+				inspected.findings.push(note$1(`Remote machine ${machine} repeats a named node`, "Name each tailnet node and serve port only once in remote.machines."));
+				continue;
+			}
+			namedNodes.add(nodeRoute);
+			if (cannotHost(current, machine)) {
+				inspected.machines.push({
+					machine,
+					...dnsName,
+					state: "not-asked"
+				});
+				continue;
+			}
+			const credential = credentials.find((each) => each.machine === machine);
+			reportSignal(operation)?.throwIfAborted();
+			const outcome = await reachMachine({
+				machine,
+				access: "device-host",
+				endpoint: target,
+				address: peer?.dnsName ?? parsed.name,
+				...signedIn ? { tailnet: signedIn } : {},
+				credential,
+				other: () => readBuildMachines().find((each) => each.machine === machine),
+				persist: async (next) => {
+					credentials = [...credentials.filter((each) => each.machine !== machine), next];
+					await store(credentials, operation);
+				},
+				fix,
+				deviceName,
+				setupFlags: ["build", "device-host"],
+				serverVersion: version,
+				io,
+				tickets,
+				...local ? { confirmKey: (serverKey) => confirmKey?.(machine, serverKey) ?? Promise.resolve(false) } : {}
+			});
+			reportSignal(operation)?.throwIfAborted();
+			if (outcome.state !== "not-asked" && outcome.credential) {
+				const next = outcome.credential;
+				if (JSON.stringify(next) !== JSON.stringify(credential)) {
+					credentials = [...credentials.filter((each) => each.machine !== machine), next];
+					await store(credentials, operation);
+				}
+			}
+			const saved = outcome.state !== "not-asked" ? outcome.credential : void 0;
+			const known = {
+				machine,
+				...dnsName,
+				...saved?.deviceId ? { deviceId: saved.deviceId } : {},
+				...saved?.tailnet ? { tailnet: saved.tailnet } : {},
+				...saved ? { requestedAt: saved.requestedAt } : {}
+			};
+			if (outcome.state === "approved") {
+				const host = readHostPermissions(outcome.result.host);
+				if (host && (host.screenRecording === false || host.accessibility === false)) {
+					const panes = [...host.screenRecording === false ? ["Screen & System Audio Recording (Screen Recording on macOS 14)"] : [], ...host.accessibility === false ? ["Device Control and Data Access (Accessibility on macOS 26 and earlier)"] : []];
+					const detail = [...host.screenRecording === false ? ["Viewing hosted macOS apps needs Screen Recording."] : [], ...host.accessibility === false ? ["Controlling them needs the control permission."] : []];
+					inspected.findings.push(note$1(`Remote Mac ${machine} needs ${panes.join(" and ")} for ${host.name}`, detail.join(" "), `On ${machine}, approve ${host.name} in System Settings > Privacy & Security, or run \`stim-server service install\` there again to show the requests.`));
+				}
+				inspected.machines.push({
+					...known,
+					state: "approved",
+					...host ? { host } : {}
+				});
+				continue;
+			}
+			if (outcome.state === "pending") {
+				inspected.machines.push({
+					...known,
+					state: "pending",
+					...outcome.credential.expiresAt ? { expiresAt: outcome.credential.expiresAt } : {}
+				});
+				inspected.findings.push(note$1(`Remote machine ${machine} has not approved this machine for device hosting yet`, `It does not hold this machine's setup ticket yet${outcome.credential.expiresAt ? `; the ticket expires at ${outcome.credential.expiresAt}` : ""}.`, setupRemedy(machine, outcome.command)));
+				continue;
+			}
+			if (outcome.state === "not-asked") {
+				inspected.machines.push({
+					...known,
+					state: "not-asked"
+				});
+				inspected.findings.push(note$1(`Remote machine ${machine} has not approved this machine for device hosting`, "This machine has not asked for hosting access.", `Run \`stim remote add ${machine}\` to make a setup ticket and print the command to run there.`));
+				continue;
+			}
+			if (outcome.state === "outdated") {
+				const outdated = outdatedServer(machine, version, outcome.command);
+				inspected.machines.push({
+					...known,
+					state: "outdated",
+					diagnosis: {
+						layer: "compat",
+						code: "server-outdated",
+						title: "Server is outdated",
+						message: outdated.detail,
+						remedy: outdated.fix
+					}
+				});
+				inspected.findings.push(note$1(outdated.title, outdated.detail, outdated.fix));
+				continue;
+			}
+			if (outcome.state === "unconfirmed") {
+				inspected.machines.push({
+					...known,
+					state: "key-unconfirmed",
+					fingerprint: outcome.fingerprint
+				});
+				inspected.findings.push(unconfirmedKeyFinding("device-host-machine", machine, outcome.fingerprint));
+				continue;
+			}
+			if (outcome.state === "unreachable") {
+				const failure = {
+					entry: machine,
+					port: parsed.port,
+					target,
+					reason: outcome.reason,
+					transport: outcome.transport
+				};
+				const startup = !peer && outcome.transport?.kind === "http" && outcome.transport.status === 503 ? await io.startup?.(target) : null;
+				const diagnosis = peer ? await diagnoseOutcome(io, {
+					...failure,
+					peer
+				}) : diagnoseLocalUnreachable({
+					...failure,
+					startup
+				});
+				inspected.machines.push({
+					...known,
+					state: "unreachable",
+					diagnosis
+				});
+				inspected.findings.push(diagnosisFinding("device-host-machine", machine, diagnosis));
+				continue;
+			}
+			inspected.machines.push({
+				...known,
+				state: outcome.state
+			});
+			inspected.findings.push(outcome.state === "key-changed" ? note$1(`Remote machine ${machine} answered with a different server key`, "Stim refuses to connect to a stim-server that does not prove it holds the key pinned at approval.", `If that machine or its Stim home was replaced, run \`stim remote remove ${machine}\`, then \`stim remote add ${machine}\`.`) : outcome.state === "lapsed" ? note$1(`Hosting request to ${machine} lapsed`, `${machine} did not approve this machine before its setup ticket expired at ${outcome.credential.expiresAt}.`, `Run \`stim remote add ${machine}\` to make a new ticket.`) : note$1(`Remote machine ${machine} no longer accepts this machine for device hosting`, `${outcome.reason} The pinned key is preserved.`, `Run \`stim remote add ${machine}\` to ask again.`));
+		}
+		return inspected;
+	} finally {
+		releaseClaim(claim.acquired);
+	}
+}
+//#endregion
+//#region src/offload/build-machines.ts
+/** The `remote.machines` entries that approved this machine for builds, in that order. */
+function pairedMachines(entries = configuredMachines() ?? []) {
+	const credentials = readBuildMachines().filter((each) => each.state === "approved");
+	return entries.flatMap((entry) => credentials.filter((each) => each.machine === entry));
+}
+async function updateCredentials(change, operation) {
+	reportSignal(operation)?.throwIfAborted();
+	const dir = getConfigDir();
+	const write = () => {
+		reportSignal(operation)?.throwIfAborted();
+		const file = buildMachinesFile();
+		const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+		writeFileSync(tmp, `${JSON.stringify({
+			version: MACHINE_CREDENTIALS_VERSION,
+			machines: change(readBuildMachines())
+		}, null, 2)}\n`, { mode: 384 });
+		try {
+			renameSync(tmp, file);
+		} catch (error) {
+			rmSync(tmp, { force: true });
+			throw error;
+		}
+	};
+	const options = { ensureParent: () => mkdirSync(dir, { recursive: true }) };
+	const signal = reportSignal(operation);
+	if (signal) await withDirLockAsync(buildMachinesLock(), write, {
+		...options,
+		signal
+	});
+	else withDirLock$1(buildMachinesLock(), write, options);
+}
+async function forgetBuildMachine(machine) {
+	if (readBuildMachines().some((each) => each.machine === machine)) await updateCredentials((credentials) => credentials.filter((each) => each.machine !== machine));
+}
+function note(title, detail, fix = null) {
+	return {
+		code: "build-machine",
+		level: "note",
+		title,
+		detail,
+		fix
+	};
+}
+const PROBLEM_TITLES = {
+	unreachable: "does not answer a build offer",
+	checkout: "cannot build an app outside a git checkout",
+	"stim-build": "runs an incompatible Stim build",
+	arch: "has another CPU architecture",
+	xcode: "has another Xcode",
+	"macos-sdk": "has another macOS SDK",
+	"simulator-sdk": "has another simulator SDK",
+	cocoapods: "has no CocoaPods, or another version",
+	bundler: "has no Bundler",
+	runtime: "has no simulator for this project's iOS runtime",
+	jdk: "runs another JDK major version",
+	"android-sdk": "has no Android SDK",
+	ndk: "lacks this project's NDK",
+	"build-tools": "lacks this project's Android build-tools",
+	"compile-sdk": "lacks this project's Android compile platform",
+	disk: "is low on disk",
+	busy: "is too busy to take builds",
+	platform: "cannot build this platform"
+};
+const NOTE_TITLES = {
+	jdk: "builds Android with its own JDK",
+	ndk: "downloads this project's NDK on its first Android build",
+	"build-tools": "downloads this project's Android build-tools on its first Android build",
+	"compile-sdk": "downloads this project's Android compile platform on its first Android build"
+};
+function commandFix(problem, entry) {
+	return problem.commands?.length && problem.lead ? [`On ${entry}, ${problem.lead}:`, ...problem.commands].join("\n") : null;
+}
+function problemFix(problem, entry) {
+	const { code } = problem;
+	if (problem.followsFrom) return `Fix the ${problem.followsFrom} problem on ${entry} first; this follows from it.`;
+	switch (code) {
+		case "unreachable": return `Check that stim-server runs on ${entry} and that its tailscale serve route answers, then run \`stim doctor\` again. To keep it running there, run \`stim-server service install --serve\` on ${entry}.`;
+		case "checkout": return "Offload syncs the files git lists; run Stim from a git checkout of the app.";
+		case "stim-build": return `Update stim-server on ${entry} to a Stim release with the same build compatibility version as this machine (an older stim-server needs the same Stim build): there, run \`stim-server service update --release <version>\` for this machine's release, or \`--from <dir>\` with the packed packages of this machine's checkout.`;
+		case "arch": return "Use a remote machine with the same CPU architecture as this machine.";
+		case "xcode":
+		case "simulator-sdk":
+		case "macos-sdk": return commandFix(problem, entry) ?? `Install and select the same Xcode on ${entry} and this Mac (\`xcode-select -p\` on each).`;
+		case "cocoapods": return commandFix(problem, entry) ?? `Install the same CocoaPods version on ${entry}, on the PATH its stim-server sets. A build sent there with --remote-build ${entry} still runs; a version that differs rewrites the COCOAPODS line of a committed Podfile.lock.`;
+		case "bundler": return `Install Bundler (\`gem install bundler\`) on ${entry}, on the PATH its stim-server's login shell sets.`;
+		case "runtime": return commandFix(problem, entry) ?? `Install that iOS simulator runtime on ${entry} with at least one iPhone simulator, or set ios.runtime here to one ${entry} has.`;
+		case "jdk": return commandFix(problem, entry) ?? `Start stim-server on ${entry} with JAVA_HOME at a JDK of the same major version as this machine's.`;
+		case "android-sdk":
+		case "ndk":
+		case "build-tools":
+		case "compile-sdk": return commandFix(problem, entry) ?? `Install the missing package with sdkmanager in the Android SDK stim-server on ${entry} uses (its ANDROID_HOME, else ~/Library/Android/sdk on macOS or ~/Android/Sdk on Linux).`;
+		case "disk": return `Free space on ${entry}'s worker root (server.workerRoot there).`;
+		case "platform": return `iOS and macOS builds need a Mac; ${entry} can take Android builds only.`;
+		case "busy": return `Builds stay on this machine until ${entry} has capacity. On ${entry}, server.maxLoadPerCore sets the load it accepts and concurrency.maxBuilds how many of its own builds it runs; it takes one offloaded build at a time.`;
+	}
+}
+const TRANSIENT = /* @__PURE__ */ new Set(["unreachable", "busy"]);
+const UNPREDICTABLE = /* @__PURE__ */ new Set([
+	"unreachable",
+	"busy",
+	"disk",
+	"checkout",
+	"cocoapods"
+]);
+/** Why a build on the machine named for it cannot work, from the toolchain differences found before this machine changes the checkout. */
+function predictedRefusal(entry, problems) {
+	const known = problems.filter((problem) => !UNPREDICTABLE.has(problem.code));
+	if (known.length === 0) return null;
+	return {
+		reason: known.map((problem) => problem.reason).join("; "),
+		remedy: known.map((problem) => problemFix(problem, entry)).join("\n")
+	};
+}
+function offloadFindings(entry, problems, notes, operation) {
+	const selected = operation?.env.STIM_REMOTE_BUILD?.trim() || loadConfig$1()?.remote?.build;
+	const consequence = typeof selected === "string" && placementWord(selected) === "remote-only" ? "remote.build is remote-only, so automatic builds skip this machine and refuse rather than build on this Mac:" : "Builds fall back to this machine:";
+	return [...problems.map((problem) => ({
+		code: `build-machine-${problem.code}`,
+		level: TRANSIENT.has(problem.code) ? "note" : "cost",
+		title: `Remote machine ${entry} ${PROBLEM_TITLES[problem.code]}`,
+		detail: `${consequence} ${problem.reason}.${problem.code === "cocoapods" ? ` A build sent there with --remote-build ${entry} still runs.` : ""}`,
+		fix: problemFix(problem, entry)
+	})), ...notes.map((each) => ({
+		code: `build-machine-${each.code}`,
+		level: "note",
+		title: `Remote machine ${entry} ${NOTE_TITLES[each.code] ?? "needs a first-build download"}`,
+		detail: `The build goes there anyway: ${each.reason}.`,
+		fix: commandFix(each, entry)
+	}))];
+}
+async function inspectMachine(entry, tailnet, deviceName, fix, version, tickets, io, check, operation, confirmKey) {
+	const parsed = parseMachine$1(entry);
+	if (!parsed) return {
+		report: {
+			machine: entry,
+			state: "invalid"
+		},
+		finding: note(`Remote machine ${entry} is not a tailnet name or local: address`, "Expected `name`, `name:port`, `local:<host>` or `local:<host>:port`.")
+	};
+	const local = parsed.transport === "local";
+	if (!local && "off" in tailnet) return {
+		report: {
+			machine: entry,
+			state: "tailscale-off",
+			diagnosis: tailnet.off
+		},
+		finding: null
+	};
+	const status = "status" in tailnet ? tailnet.status : {};
+	const peer = local ? null : findPeer$1(status, parsed.name);
+	const credential = readBuildMachines().find((each) => each.machine === entry);
+	const signedIn = local ? null : currentTailnet(status);
+	if (peer === "missing" || peer === "ambiguous") {
+		const diagnosis = notOnTailnetDiagnosis(entry, peer === "ambiguous", credential ? wrongTailnet(credential, status) : null);
+		return {
+			report: {
+				machine: entry,
+				state: "not-on-tailnet",
+				...credential?.tailnet ? { tailnet: credential.tailnet } : {},
+				diagnosis
+			},
+			finding: diagnosisFinding("build-machine", entry, diagnosis)
+		};
+	}
+	const target = peer ? endpoint$1(peer, parsed.port) : localEndpoint(parsed.name, parsed.port);
+	const address = peer?.dnsName ?? parsed.name;
+	const other = () => {
+		try {
+			return readDeviceHostMachines().find((each) => each.machine === entry);
+		} catch {
+			return;
+		}
+	};
+	const persist = (next) => updateCredentials((credentials) => [...credentials.filter((each) => each.machine !== entry), next], operation);
+	reportSignal(operation)?.throwIfAborted();
+	const outcome = await reachMachine({
+		machine: entry,
+		access: "build",
+		endpoint: target,
+		address,
+		...signedIn ? { tailnet: signedIn } : {},
+		credential,
+		other,
+		persist,
+		fix,
+		deviceName,
+		setupFlags: cannotHost(status, entry) ? ["build"] : ["build", "device-host"],
+		serverVersion: version,
+		io,
+		tickets,
+		...local ? { confirmKey: (serverKey) => confirmKey?.(entry, serverKey) ?? Promise.resolve(false) } : {}
+	});
+	const known = {
+		machine: entry,
+		...peer ? { dnsName: peer.dnsName } : {}
+	};
+	reportSignal(operation)?.throwIfAborted();
+	if (outcome.state !== "not-asked" && outcome.credential) {
+		const next = outcome.credential;
+		if (JSON.stringify(next) !== JSON.stringify(credential)) await updateCredentials((credentials) => [...credentials.filter((each) => each.machine !== entry), next], operation);
+	}
+	const paired = {
+		...known,
+		...outcome.state !== "not-asked" && outcome.credential?.tailnet ? { tailnet: outcome.credential.tailnet } : {},
+		...outcome.state !== "not-asked" && outcome.credential?.deviceId ? { deviceId: outcome.credential.deviceId } : {},
+		...outcome.state !== "not-asked" && outcome.credential ? { requestedAt: outcome.credential.requestedAt } : {}
+	};
+	switch (outcome.state) {
+		case "not-asked": return {
+			report: {
+				...known,
+				state: "not-asked"
+			},
+			finding: note(`Remote machine ${entry} has not approved this machine for builds`, "This machine has not asked it for build access.", `Run \`stim remote add ${entry}\` to make a setup ticket and print the command to run there.`)
+		};
+		case "key-changed": return {
+			report: {
+				...paired,
+				state: "key-changed"
+			},
+			finding: note(`Remote machine ${entry} answered with a different server key`, `${address} did not prove it holds the stim-server key this machine pinned at approval. Stim does not connect to it.`, `If that machine or its Stim home was replaced, run \`stim remote remove ${entry}\` to forget the old pairing, then \`stim remote add ${entry}\`.`)
+		};
+		case "unconfirmed": return {
+			report: {
+				...paired,
+				state: "key-unconfirmed",
+				fingerprint: outcome.fingerprint
+			},
+			finding: unconfirmedKeyFinding("build-machine", entry, outcome.fingerprint)
+		};
+		case "pending": return {
+			report: {
+				...paired,
+				state: "pending",
+				...outcome.credential.expiresAt ? { expiresAt: outcome.credential.expiresAt } : {}
+			},
+			finding: note(`Remote machine ${entry} has not approved this machine for builds yet`, `It does not hold this machine's setup ticket yet${outcome.credential.expiresAt ? `; the ticket expires at ${outcome.credential.expiresAt}` : ""}.`, setupRemedy(entry, outcome.command))
+		};
+		case "lapsed": return {
+			report: {
+				...paired,
+				state: "lapsed"
+			},
+			finding: note(`Build request to ${entry} lapsed`, `${entry} did not approve this machine before its setup ticket expired at ${outcome.credential.expiresAt}.`, `Run \`stim remote add ${entry}\` to make a new ticket.`)
+		};
+		case "revoked": return {
+			report: {
+				...paired,
+				state: "revoked"
+			},
+			finding: note(`Remote machine ${entry} no longer accepts this machine for builds`, `${outcome.reason} It was revoked.`, `Run \`stim remote add ${entry}\` to ask again.`)
+		};
+		case "outdated": {
+			const outdated = outdatedServer(entry, version, outcome.command);
+			const diagnosis = {
+				layer: "compat",
+				code: "server-outdated",
+				title: "Server is outdated",
+				message: outdated.detail,
+				remedy: outdated.fix
+			};
+			return {
+				report: {
+					...paired,
+					state: "outdated",
+					diagnosis
+				},
+				finding: note(outdated.title, outdated.detail, outdated.fix)
+			};
+		}
+		case "unreachable": {
+			const failure = {
+				entry,
+				port: parsed.port,
+				target,
+				reason: outcome.reason,
+				transport: outcome.transport
+			};
+			const startup = !peer && outcome.transport?.kind === "http" && outcome.transport.status === 503 ? await io.startup?.(target) : null;
+			const diagnosis = peer ? await diagnoseOutcome(io, {
+				...failure,
+				peer
+			}) : diagnoseLocalUnreachable({
+				...failure,
+				startup
+			});
+			return {
+				report: {
+					...paired,
+					state: "unreachable",
+					diagnosis
+				},
+				finding: diagnosisFinding("build-machine", entry, diagnosis)
+			};
+		}
+	}
+	const permissions = readHostPermissions(outcome.result.host);
+	const host = permissions ? { host: permissions } : {};
+	if (!check) return {
+		report: {
+			...paired,
+			state: "approved",
+			...host
+		},
+		finding: null
+	};
+	const { capacity, problems, notes = [] } = await check(outcome.credential);
+	return {
+		report: {
+			...paired,
+			state: "approved",
+			...host,
+			offloadable: problems.length === 0,
+			reasons: problems.map((problem) => problem.reason),
+			problems,
+			...notes.length ? { notes } : {},
+			...capacity ? { capacity } : {}
+		},
+		finding: null,
+		extra: offloadFindings(entry, problems, notes, operation)
+	};
+}
+/**
+* Doctor findings and a report for each `remote.machines` entry. The worker's stim-server key is pinned on first
+* contact; every later connection must prove it holds that key. With `fix`, makes a setup ticket for a named machine
+* this machine holds no pairing for, or that revoked it. With `forget`, which defaults to `fix`, forgets pairings of
+* machines not in `entries`. With
+* `check`, each approved machine is asked for one build offer and reports every reason it would not take this
+* project's build.
+*/
+async function inspectBuildMachines({ fix, forget = fix, check = null, version = "<version>", tickets = /* @__PURE__ */ new Map(), operation, confirmKey }, io = realIo, entries = configuredMachines()) {
+	if (entries === null) return {
+		findings: [note("Invalid remote.machines setting", "Use a remote object with machines as an array of tailnet names. Existing credentials and pinned keys are preserved.", "Run `stim guide settings` and correct the setting before running doctor again.")],
+		machines: []
+	};
+	const unnamed = (each) => !entries.includes(each.machine);
+	if (forget && readBuildMachines().some(unnamed)) await updateCredentials((credentials) => credentials.filter((each) => !unnamed(each)), operation);
+	if (entries.length === 0) return {
+		findings: [],
+		machines: []
+	};
+	const tailnet = entries.some((entry) => parseMachine$1(entry)?.transport !== "local");
+	const read = tailnet ? await io.status() : null;
+	const view = isJsonObject(read) ? { status: read } : tailnet ? { off: await diagnoseTailscale(io) } : { status: {} };
+	const inspection = {
+		findings: [],
+		machines: []
+	};
+	if ("off" in view) inspection.findings.push(note("Remote machines are unreachable", `remote.machines names remote machines. ${view.off.message}`, view.off.remedy));
+	const self = "status" in view && isJsonObject(view.status.Self) ? view.status.Self : {};
+	const deviceName = (typeof self.HostName === "string" && self.HostName ? self.HostName : hostname()).replace(/[\p{Cc}\p{Cf}]/gu, "").trim().slice(0, 64) || "Mac";
+	const inspected = await Promise.all(entries.map((entry) => inspectMachine(entry, view, deviceName, fix, version, tickets, io, check, operation, confirmKey)));
+	for (const { report, finding, extra = [] } of inspected) {
+		inspection.machines.push(report);
+		if (finding) inspection.findings.push(finding);
+		inspection.findings.push(...extra);
+	}
+	return inspection;
+}
+//#endregion
+//#region src/engine/device-lease-run.ts
+const LEASE_STEP_FLOOR_MS = 6e4;
+const DEBUG_VERIFY_STEP_MS = MANIFEST_VERIFY_TIMEOUT_MS + APP_READINESS_TIMEOUT_MS;
+const DEVICE_WAIT_POLL_MS = 2e3;
+const DEVICE_WAIT_LINE_MS = 3e4;
+const DEVICE_BUSY = "STIM_DEVICE_BUSY";
+const DEVICE_LOST = "STIM_DEVICE_LOST";
+function leaseStepMs(boundMs = 0) {
+	return Math.max(LEASE_STEP_FLOOR_MS, boundMs);
+}
+function parseDeviceWait(value) {
+	if (value === void 0 || value === null) return { seconds: 60 };
+	const seconds = String(value).trim() === "" ? NaN : Number(value);
+	if (!Number.isInteger(seconds) || seconds < 0) return { error: `Invalid --wait value ${JSON.stringify(value)}. Pass a whole number of seconds, e.g. --wait 90.` };
+	return { seconds };
+}
+function waitFlagConflict(argv) {
+	return argv.some((arg) => arg === "--wait" || arg.startsWith("--wait=")) && argv.includes("--no-wait");
+}
+function leaseExpiryText(expiresAt, now) {
+	const remaining = Date.parse(expiresAt) - now;
+	return `${clockTime(expiresAt)} (${formatElapsed(Math.max(0, remaining))} from now)`;
+}
+function describeDevice(lease) {
+	return lease.deviceName ? `${lease.deviceName} (${lease.id})` : lease.id;
+}
+function facts(lease) {
+	return {
+		platform: lease.platform,
+		id: lease.id,
+		deviceName: lease.deviceName,
+		holder: lease.holder,
+		expiresAt: lease.expiresAt
+	};
+}
+function waitingLine(lease, now) {
+	return `waiting for ${lease.holder} to release ${describeDevice(lease)}; its lease runs until ${leaseExpiryText(lease.expiresAt, now)} -- stim guide lifecycle lease`;
+}
+function appIdMatch(ours, theirs) {
+	if (!ours || !theirs) return "unknown";
+	return ours === theirs ? "same" : "different";
+}
+function bypassLines(lease, now, match) {
+	const consequence = {
+		same: "Both workspaces build the same app id, so this install terminates the app that workspace is running.",
+		different: "The other workspace's app id differs, so the launch below backgrounds it rather than ending it.",
+		unknown: "Stim cannot tell whether the two workspaces build the same app id; if they do, this install terminates the holder's running app."
+	}[match];
+	return [`--no-wait: ${lease.holder} holds ${describeDevice(lease)} until ${leaseExpiryText(lease.expiresAt, now)}, and this run is proceeding without a lease.`, consequence];
+}
+function busyRefusal({ lease, now, idLabel, waitSeconds }) {
+	return {
+		code: DEVICE_BUSY,
+		message: `${lease.holder} holds ${describeDevice(lease)} until ${leaseExpiryText(lease.expiresAt, now)}` + (waitSeconds > 0 ? `, and this command waited ${waitSeconds}s for it.` : "."),
+		remedy: `Wait longer with \`--wait <seconds>\`, pick another device with \`--device <${idLabel}>\`, or pass \`--no-wait\` to install anyway -- which takes no lease and, when both workspaces build the same app id, terminates the holder's running app.`,
+		lease: facts(lease)
+	};
+}
+function unreadableRefusal(path) {
+	return {
+		code: DEVICE_BUSY,
+		message: `The lease file at ${path} does not parse, so Stim cannot tell who holds that device.`,
+		remedy: `Read ${path} and, once you know no run depends on it, delete it. \`stim gc\` reports it on every run.`,
+		lease: {
+			platform: null,
+			id: null,
+			deviceName: null,
+			holder: null,
+			expiresAt: null
+		}
+	};
+}
+function untokenedRefusal(lease, now) {
+	return {
+		code: DEVICE_BUSY,
+		message: `This workspace holds ${describeDevice(lease)} until ${leaseExpiryText(lease.expiresAt, now)}, but its own record of that lease is gone, so this run cannot prove the lease is still its own.`,
+		remedy: "Run `stim device unlock`, which releases by holder, then run this command again.",
+		lease: facts(lease)
+	};
+}
+function otherDeviceRefusal(leasedId, requestedId) {
+	return {
+		code: "STIM_NO_DEVICE",
+		message: `This workspace already leases ${leasedId}, and this run asked for ${requestedId}.`,
+		remedy: `Run \`stim device unlock\` to give up ${leasedId}, or use it with \`--device ${leasedId}\`.`,
+		lease: null
+	};
+}
+function lostLine(holder, expiresAt, now) {
+	return `${holder ?? "another workspace"} took this device's lease${expiresAt ? ` until ${leaseExpiryText(expiresAt, now)}` : ""}. The app is already installed, so this run continues without one.`;
+}
+function lostRefusal(holder, expiresAt, now) {
+	const who = holder ?? "another workspace";
+	const until = expiresAt ? ` until ${leaseExpiryText(expiresAt, now)}` : "";
+	return {
+		code: DEVICE_LOST,
+		message: `${who} took this device's lease${until} before this run could install.`,
+		remedy: "Run this command again; it waits for that lease with `--wait <seconds>`.",
+		lease: null
+	};
+}
+function runLease({ root, platform, slot = "default", kind, expiresAt, io = fileLeaseIo }) {
+	const handle = {
+		kind,
+		expiresAt,
+		lost: false,
+		raise(boundMs) {
+			if (handle.kind === null || handle.lost) return {
+				ok: !handle.lost,
+				holder: null,
+				expiresAt: handle.expiresAt
+			};
+			const result = raiseLease({
+				root,
+				platform,
+				slot,
+				minMs: leaseStepMs(boundMs)
+			}, io);
+			if (result.status === "raised") {
+				handle.expiresAt = result.lease.expiresAt;
+				return {
+					ok: true,
+					holder: result.lease.holder,
+					expiresAt: result.lease.expiresAt
+				};
+			}
+			handle.lost = true;
+			const taken = result.status === "lost" ? result.lease : null;
+			return {
+				ok: false,
+				holder: taken?.holder ?? null,
+				expiresAt: taken?.expiresAt ?? null
+			};
+		},
+		release() {
+			if (handle.kind === null) return;
+			releaseRunLease({
+				root,
+				platform,
+				slot
+			}, io);
+		},
+		facts() {
+			if (handle.kind === null || handle.lost || handle.expiresAt === null) return null;
+			return {
+				kind: handle.kind,
+				expiresAt: handle.expiresAt
+			};
+		}
+	};
+	return handle;
+}
+/** Release the run's lease as soon as `context`'s operation is aborted; returns a function that stops listening. */
+function releaseLeaseOnAbort(context, release) {
+	const onAbort = () => {
+		operationState(context).handled = true;
+		release();
+	};
+	if (context.signal.aborted) onAbort();
+	else context.signal.addEventListener("abort", onAbort, { once: true });
+	return () => context.signal.removeEventListener("abort", onAbort);
+}
+async function waitForDevice({ root, platform, slot = "default", id, idLabel, waitSeconds, noWait = false, appId = null, holderAppId = () => null, now = Date.now, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), warn = () => {}, io = fileLeaseIo, deadline, lastLine }) {
+	const path = deviceLeasePath(platform, id);
+	for (;;) {
+		const raw = io.readLease(path);
+		const current = parseLease(raw);
+		if (raw !== null && !current) return {
+			status: "refused",
+			refusal: unreadableRefusal(path)
+		};
+		if (!current || leaseIsExpired(current, now())) return { status: "free" };
+		if (current.holder === root && (current.slot ?? "default") === slot) return {
+			status: "ours",
+			lease: current
+		};
+		if (noWait) {
+			for (const line of bypassLines(current, now(), appIdMatch(appId, holderAppId(current.holder)))) warn(line);
+			return {
+				status: "bypassed",
+				lease: current
+			};
+		}
+		if (now() >= deadline) return {
+			status: "refused",
+			refusal: busyRefusal({
+				lease: current,
+				now: now(),
+				idLabel,
+				waitSeconds
+			})
+		};
+		if (lastLine.at === null || now() - lastLine.at >= 3e4) {
+			lastLine.at = now();
+			warn(waitingLine(current, now()));
+		}
+		await sleep(DEVICE_WAIT_POLL_MS);
+	}
+}
+async function acquireRunLease({ root, platform, slot = "default", id, deviceName = null, idLabel, waitSeconds, noWait, installBoundMs, appId = null, holderAppId = () => null, now = Date.now, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), warn = () => {}, io = fileLeaseIo }) {
+	const recorded = io.readHolder(root)[deviceSlotKey(platform, slot)];
+	let held = recorded;
+	if (recorded && recorded.id !== id) {
+		const other = parseLease(io.readLease(deviceLeasePath(platform, recorded.id)));
+		if (other && other.token === recorded.token && !leaseIsExpired(other, now())) return {
+			status: "refused",
+			refusal: otherDeviceRefusal(recorded.id, id)
+		};
+		held = void 0;
+	}
+	const path = deviceLeasePath(platform, id);
+	const deadline = now() + waitSeconds * 1e3;
+	const lastLine = { at: null };
+	for (;;) {
+		const current = parseLease(io.readLease(path));
+		const mine = current && held && current.token === held.token ? {
+			lease: current,
+			record: held
+		} : null;
+		if (mine && (mine.record.kind === "run" || !leaseIsExpired(mine.lease, now()))) {
+			const raised = raiseLease({
+				root,
+				platform,
+				slot,
+				minMs: leaseStepMs(installBoundMs)
+			}, io);
+			if (raised.status === "raised") return {
+				status: "leased",
+				kind: mine.record.kind,
+				expiresAt: raised.lease.expiresAt
+			};
+		}
+		const outcome = await waitForDevice({
+			root,
+			platform,
+			slot,
+			id,
+			idLabel,
+			waitSeconds,
+			noWait,
+			appId,
+			holderAppId,
+			now,
+			sleep,
+			warn,
+			io,
+			deadline,
+			lastLine
+		});
+		if (outcome.status === "refused") return outcome;
+		if (outcome.status === "bypassed") return { status: "unleased" };
+		if (outcome.status === "ours") return {
+			status: "refused",
+			refusal: untokenedRefusal(outcome.lease, now())
+		};
+		const taken = takeLease({
+			root,
+			platform,
+			slot,
+			id,
+			deviceName,
+			kind: "run",
+			durationMs: leaseStepMs(installBoundMs)
+		}, io);
+		if (taken.status === "unreadable") return {
+			status: "refused",
+			refusal: unreadableRefusal(taken.path)
+		};
+		if (taken.status === "taken" || taken.status === "set") return {
+			status: "leased",
+			kind: taken.status === "set" ? held?.kind ?? "run" : "run",
+			expiresAt: taken.lease.expiresAt
+		};
+	}
+}
+//#endregion
+//#region src/offload/selection.ts
+const FINGERPRINT_MISMATCH_REMEDY = "The build Mac fingerprints the synced checkout differently; the message names the sources that differ. Stim sends tracked and untracked files and the gitignored files the fingerprint reads, except under node_modules. A source still differs when the build Mac's dependency install or pod install writes it differently, or when the app config reads an environment variable or file that differs. Make that input agree on both Macs, for example by committing the lockfile pod install rewrote there, or rerun with --remote-build auto or --remote-build local.";
+/** The remedy for a React Native worker's fingerprint-mismatch reason, or undefined for any other reason. */
+function fingerprintMismatchRemedy(reason) {
+	return reason.startsWith("fingerprint-mismatch: the checkout there ") ? FINGERPRINT_MISMATCH_REMEDY : void 0;
+}
+const MISSING_PACKAGE_MANAGER = /^deps-failed: spawn (pnpm|yarn|npm) ENOENT/;
+/** The remedy for a worker whose dependency install could not start its package manager; undefined for any other reason. */
+function missingPackageManagerRemedy(machine, reason) {
+	const tool = MISSING_PACKAGE_MANAGER.exec(reason)?.[1];
+	if (!tool) return void 0;
+	return `${machine} has no ${tool} on the PATH of its stim-server service, and the app's lockfile needs it. ${tool === "npm" ? "Reinstall Node there, which ships npm" : `Install it with \`corepack enable ${tool}\` or \`npm install --global ${tool}\`, using sudo where Node is installed system-wide`}, then run the same command again, or rerun with --remote-build auto or --remote-build local.`;
+}
+const PODS_FAILED_PREFIX = "pod install failed: ";
+/** The reason a failed worker job is reported with: a `pods-failed` code reads as a failed pod install. */
+function workerFailureReason(code, message) {
+	return code === "pods-failed" ? `${PODS_FAILED_PREFIX}${String(message ?? "")}` : `${String(code ?? "failed")}: ${String(message ?? "")}`;
+}
+/** The remedy for a worker whose `pod install` failed, naming the install when it has no CocoaPods; undefined for any other reason. */
+function podsFailedRemedy(machine, reason, localCocoapods) {
+	if (!reason.startsWith(PODS_FAILED_PREFIX)) return void 0;
+	const retry = "run the same command again, or rerun with --remote-build auto or --remote-build local";
+	if (!reason.includes("CocoaPods is not installed: no `pod` executable on PATH.")) return `Fix the pod install error on ${machine} (run pod install in its checkout under server.workerRoot there to see all of it), then ${retry}.`;
+	const { lead, commands } = cocoapodsInstall(localCocoapods);
+	return [
+		`On ${machine}, ${lead}:`,
+		...commands,
+		`Then ${retry}.`
+	].join("\n");
+}
+var OffloadRefusal = class extends Error {
+	code = "STIM_OFFLOAD_REFUSED";
+	remedy;
+	constructor(machine, reason, remedy = "Run stim doctor --fix to ask for build access if not paired; it prints the stim-server setup command a person runs on the worker to approve this machine. Check stim settings get remote.machines, or rerun with --remote-build auto, remote or local.") {
+		super(reason.startsWith(`${machine}: `) ? reason : `${machine}: ${reason}`);
+		this.remedy = remedy;
+	}
+};
+function resolveBuildMachine(flag, env, setting) {
+	const selected = flag ?? (env?.trim() || void 0) ?? setting ?? "auto";
+	if (typeof selected !== "string" || !selected.trim() || !parseMachine(selected)) throw Object.assign(/* @__PURE__ */ new Error("--remote-build / remote.build must be local, auto, remote, remote-only, or a tailnet machine name."), { code: "STIM_BAD_ARG" });
+	return placementWord(selected) ?? selected.trim();
+}
+function parseBuildMachineOption(value) {
+	try {
+		return resolveBuildMachine(value);
+	} catch (error) {
+		throw new InvalidArgumentError(error.message);
+	}
+}
+function automaticBuild(selected) {
+	const word = placementWord(selected);
+	return word !== null && word !== "local";
+}
+function requireLocalBuild(selected, reason) {
+	const word = placementWord(selected);
+	const lead = reason ? `${reason}; ` : "";
+	if (word === "remote-only") throw new OffloadRefusal(selected, `${lead}remote-only never builds on this machine`);
+	if ((word === "auto" || word === "remote") && !automaticMachineEnabled("build", "local")) throw new OffloadRefusal(selected, `${lead}local is disabled in remote.buildPoolDisabled; enable it or select a machine explicitly`);
+}
+function namedBuildMachine(selected) {
+	return placementWord(selected) === null;
+}
+function requireConfiguredMachine(selected, machines) {
+	if (!namedBuildMachine(selected)) return selected;
+	const parsed = parseMachine(selected);
+	const entries = Array.isArray(machines) ? machines.filter((entry) => typeof entry === "string") : [];
+	const match = entries.find((entry) => {
+		const candidate = parseMachine(entry);
+		return candidate?.transport === parsed.transport && candidate.name === parsed.name && candidate.port === parsed.port;
+	});
+	if (!match) throw new OffloadRefusal(selected, `not listed in remote.machines (configured: ${entries.join(", ") || "none"})`);
+	return match;
+}
+const settingSource = (flag, env, setting) => flag !== void 0 ? "flag" : env?.trim() ? "env" : setting !== void 0 ? "setting" : "default";
+/** The settings that decide where a build runs, with the layer each value came from, for this run's `--remote-build`. */
+function buildPlacementSettings(selected) {
+	const flag = operationState(ambientContext()).buildMachineFlag;
+	return [{
+		key: "remote.build",
+		value: selected,
+		from: settingSource(flag, ambientEnv().STIM_REMOTE_BUILD, loadConfig$1()?.remote?.build)
+	}];
+}
+function resolveBuildPlacement(flag) {
+	const remote = loadConfig$1()?.remote;
+	operationState(ambientContext()).buildMachineFlag = flag;
+	let selected = "auto";
+	try {
+		selected = resolveBuildMachine(flag, ambientEnv().STIM_REMOTE_BUILD, remote?.build);
+		selected = requireConfiguredMachine(selected, remote?.machines);
+		if (namedBuildMachine(selected) && pairedMachines([selected]).length === 0) throw new OffloadRefusal(selected, "no remote machine is paired");
+		return { selected };
+	} catch (error) {
+		return {
+			selected,
+			failure: {
+				code: error.code,
+				message: error.message,
+				remedy: error instanceof OffloadRefusal ? error.remedy : "Pass --remote-build local, auto, remote, remote-only, or an entry from stim settings get remote.machines."
+			}
+		};
+	}
+}
+//#endregion
+//#region src/devices/springboard-crash-reports.ts
+const REPORT_WINDOW_MS = 6e5;
+const MAX_CANDIDATES = 100;
+const MAX_STORED = 40;
+const MAX_REPORT_BYTES = 1048576;
+const MAX_COPIED_BYTES = 8388608;
+function selectSpringBoardReports(entries, udid, sinceMs) {
+	const owner = `.${udid}`.toLowerCase();
+	return entries.flatMap(({ name, text }) => {
+		if (!/^SpringBoard-.+\.ips$/.test(name)) return [];
+		try {
+			const report = JSON.parse(text.slice(text.indexOf("\n") + 1));
+			if (!isJsonObject(report)) return [];
+			const { coalitionName, captureTime } = report;
+			const capturedAt = Date.parse(typeof captureTime === "string" ? captureTime : "");
+			return typeof coalitionName === "string" && coalitionName.toLowerCase().endsWith(owner) && capturedAt >= sinceMs ? [name] : [];
+		} catch {
+			return [];
+		}
+	});
+}
+/**
+* Copies this simulator's recent SpringBoard crash reports from DiagnosticReports and its Retired folder into
+* `destDir`, which keeps at most 40 of them. The source folders are only read; macOS deletes their reports after
+* about two days. Returns the matching reports now in `destDir`, how many matched but did not fit its limits, and
+* the message of a write that failed.
+*/
+async function copySpringBoardCrashReports({ udid, destDir, now = Date.now(), home = homedir() }) {
+	const since = now - REPORT_WINDOW_MS;
+	const reportsDir = join(home, "Library/Logs/DiagnosticReports");
+	const candidates = /* @__PURE__ */ new Map();
+	for (const directory of [reportsDir, join(reportsDir, "Retired")]) {
+		let names;
+		try {
+			names = await readdir(directory);
+		} catch (error) {
+			if (error instanceof Error && "code" in error && error.code === "ENOENT") continue;
+			throw error;
+		}
+		for (const name of names) {
+			if (!/^SpringBoard-.+\.ips$/.test(name) || candidates.has(name)) continue;
+			try {
+				const path = join(directory, name);
+				const { mtimeMs, size } = await stat(path);
+				if (mtimeMs >= since && size <= MAX_REPORT_BYTES) candidates.set(name, {
+					path,
+					mtimeMs
+				});
+			} catch {}
+		}
+	}
+	const newest = [...candidates].toSorted((a, b) => b[1].mtimeMs - a[1].mtimeMs).slice(0, MAX_CANDIDATES);
+	const entries = [];
+	for (const [name, { path }] of newest) try {
+		entries.push({
+			name,
+			text: await readFile(path, "utf8")
+		});
+	} catch {}
+	const matching = selectSpringBoardReports(entries, udid, since);
+	if (matching.length === 0) return {
+		files: [],
+		dropped: 0
+	};
+	await mkdir(destDir, {
+		recursive: true,
+		mode: 448
+	});
+	const present = new Set(await readdir(destDir));
+	let stored = [...present].filter((name) => /^SpringBoard-.+\.ips$/.test(name)).length;
+	let copiedBytes = 0;
+	const files = [];
+	for (const { name, text } of entries) {
+		if (!matching.includes(name)) continue;
+		if (present.has(name)) {
+			files.push(name);
+			continue;
+		}
+		const bytes = Buffer.byteLength(text);
+		if (stored >= MAX_STORED || copiedBytes + bytes > MAX_COPIED_BYTES) continue;
+		try {
+			await writeFile(join(destDir, name), text, {
+				flag: "wx",
+				mode: 384
+			});
+		} catch (error) {
+			if (error instanceof Error && "code" in error && error.code === "EEXIST") {
+				files.push(name);
+				continue;
+			}
+			await rm(join(destDir, name), { force: true }).catch(() => {});
+			return {
+				files,
+				dropped: 0,
+				failure: error instanceof Error ? error.message : String(error)
+			};
+		}
+		stored++;
+		copiedBytes += bytes;
+		files.push(name);
+	}
+	return {
+		files,
+		dropped: matching.length - files.length
+	};
+}
+//#endregion
+//#region src/engine/ios-boot-log.ts
+function iosBootRecorder(root, slot, udid) {
+	return (event, { level = "info", ...fields }) => {
+		try {
+			const writer = createNdjsonWriter(join(workspaceLogsDir$1(root), "device.ndjson"), { maxBytes: LOG_ROTATE_BYTES });
+			writer.write({
+				src: "device",
+				platform: "ios",
+				level,
+				event,
+				deviceId: udid,
+				...slot && slot !== "default" ? { slot } : {},
+				...fields
+			});
+			writer.close();
+		} catch {}
+	};
+}
+//#endregion
+//#region src/engine/device-ios.ts
+function recordBootPhase(record, udid, origin) {
+	return (event) => {
+		const pid = "pid" in event ? event.pid : void 0;
+		const boot = event.phase === "boot_requested" ? origin : void 0;
+		record("ios_boot", {
+			phase: event.phase,
+			...pid === void 0 ? {} : { pid },
+			...boot === void 0 ? {} : { boot },
+			msg: `ios boot ${udid}: ${event.phase}${pid === void 0 ? "" : ` pid ${pid}`}${boot === void 0 ? "" : ` (${boot})`}`
+		});
+	};
+}
+function startIosBoot(udid, configure, label, out, simulatorApp, root, slot, origin, deviceSlotWait) {
+	const done = withDeviceBootAdmission({
+		platform: "ios",
+		key: udid
+	}, async () => {
+		out(chalk.dim(phaseLine("device", `booting ${label} (${udid})`)));
+		await bootIosSim(udid, {
+			label,
+			out,
+			simulatorApp,
+			env: ambientContext()?.env,
+			onPhase: recordBootPhase(iosBootRecorder(root, slot, udid), udid, origin)
+		});
+		await configure();
+		await muteBootedSimulator(udid, out);
+	}, {
+		...deviceSlotWait,
+		root,
+		out
+	});
+	done.catch(() => {});
+	return {
+		udid,
+		done
+	};
+}
+const SPRINGBOARD_MUTE_WAIT_MS = 6e4;
+async function muteBootedSimulator(udid, out) {
+	try {
+		const springBoard = await waitForSpringBoard(udid, Date.now() + SPRINGBOARD_MUTE_WAIT_MS);
+		if (springBoard.state === "unreadable") throw new Error(springBoard.reason);
+		if (springBoard.state === "timed-out") throw new Error(`SpringBoard did not finish starting within ${SPRINGBOARD_MUTE_WAIT_MS / 1e3}s.`);
+		const response = JSON.parse(await getExecutor().runFileAsync("xcrun", [
+			"devicectl",
+			"device",
+			"settings",
+			"audio",
+			"--device",
+			udid,
+			"--volume",
+			"0",
+			"--json-output",
+			"-"
+		], { timeoutMs: 3e4 }));
+		if (!isJsonObject(response) || !isJsonObject(response.info) || response.info.outcome !== "success" || !isJsonObject(response.result) || typeof response.result.deviceIdentifier !== "string" || response.result.deviceIdentifier.toUpperCase() !== udid.toUpperCase() || response.result.volume !== 0) throw new Error("Xcode did not confirm volume zero for this simulator.");
+		out(chalk.dim(phaseLine("device", "simulator muted; turn on Sound in its Stim Desktop options")));
+	} catch (error) {
+		out(chalk.yellow(phaseLine("device", `Could not mute this simulator: ${error instanceof Error ? error.message : String(error)}`)));
+	}
+}
+var IosDeviceMismatchError = class extends Error {
+	remedy = "Run `stim worktree remove` (or `stim gc --delete`) to reap the current sim, then `stim ios` again to create the requested one, or pass `--slot <name>` to create it beside the current one.";
+};
+async function ensureOwnedIosDevice({ record, projectPath, slot, settingsRoot, label, settings, flags, note, out, reconcileIosSimulator, simSnapshot }) {
+	const pressure = readHostMemoryPressure();
+	const memoryAdvice = hostMemoryPressureAdvice(pressure);
+	if (memoryAdvice) out(chalk.yellow(phaseLine("memory", memoryAdvice)));
+	reportMemoryCulprits(pressure, (named) => out(chalk.yellow(phaseLine("memory", named))));
+	const simslimProfile = iosSimSlimProfileSetting(settings, settingsRoot);
+	const simslimDefault = iosSimSlimDefaultSetting(settings);
+	if (record?.deviceUdid) {
+		if (record.owned) {
+			const listed = simSnapshot ? simSnapshot.read() : listAllIosSims({ includeUnavailable: true });
+			const resolved = resolveOwnedIosSim(record.deviceUdid, listed);
+			if (resolved.notOwned) note(chalk.yellow(`Note: recorded sim is now named "${resolved.notOwned}", not Stim-owned -- creating a fresh owned sim instead of booting it.`));
+			else if (resolved.missing) {} else {
+				const sim = resolved.sim;
+				const wantedType = flags.deviceType || settings?.ios?.deviceType;
+				const deviceTypes = await listIosDeviceTypesAsync({ snapshot: simSnapshot });
+				const mismatch = deviceTypeMismatch(sim.deviceTypeIdentifier, wantedType, deviceTypes);
+				if (mismatch) throw new IosDeviceMismatchError(`${mismatch}. Stim will not silently boot a different model.`);
+				const versionMismatch = flags.runtimeFlag ? runtimeMismatch(sim.runtime, flags.runtimeFlag, await listIosRuntimesAsync({ snapshot: simSnapshot })) : null;
+				if (versionMismatch) throw new IosDeviceMismatchError(`${versionMismatch}. Stim will not silently boot a different iOS version.`);
+				const model = {
+					model: deviceTypes.find((d) => d.identifier === sim.deviceTypeIdentifier)?.name ?? null,
+					runtime: parseRuntimeVersion(sim.runtime)
+				};
+				const name = ownedIosName(sim, label, model, projectPath, listed) === sim.name ? sim.name : await withIosDeviceNameLock(() => renameToOwnedName(sim, label, model, projectPath));
+				const updated = {
+					deviceUdid: sim.udid,
+					owned: true,
+					deviceName: name,
+					...record.simslimManaged ? { simslimManaged: true } : {},
+					...record.simslimApplied ? { simslimApplied: record.simslimApplied } : {},
+					...record.adopted ? { adopted: true } : {},
+					...record.adoptionPending ? { adoptionPending: true } : {},
+					...record.parkedCacheKey ? { parkedCacheKey: record.parkedCacheKey } : {},
+					...record.schemeApprovals ? { schemeApprovals: record.schemeApprovals } : {}
+				};
+				const configure = async (freshBoot) => {
+					if (record.adoptionPending) await resetAdoptedSim(sim.udid, out);
+					return configureOwnedIosSim({
+						record: updated,
+						projectPath,
+						slot,
+						profile: simslimProfile,
+						slimByDefault: simslimDefault,
+						freshBoot,
+						out,
+						reconcileIosSimulator
+					});
+				};
+				const facts = {
+					deviceType: model.model,
+					runtime: model.runtime
+				};
+				if (sim.state !== "Booted") return {
+					...updated,
+					booting: startIosBoot(sim.udid, () => configure(true), name, out, flags.simulatorApp, projectPath, slot, record.adoptionPending ? "adopted" : "existing", flags.deviceSlotWait),
+					...facts
+				};
+				const { record: configured, rebooted } = await configure(false);
+				if (rebooted) await muteBootedSimulator(sim.udid, out);
+				return {
+					...configured,
+					...facts,
+					booted: sim.udid
+				};
+			}
+		} else {
+			const sim = (await listAllIosSimsAsync()).find((s) => s.udid === record.deviceUdid);
+			if (sim) {
+				if (sim.state !== "Booted") {
+					note(chalk.yellow(`Note: assigned sim ${sim.name} (${sim.udid}) is shut down and is not owned by Stim, so it will not be booted automatically.`));
+					note(chalk.dim("Boot it yourself, or run `stim gc --delete` to clear the assignment so Stim can create an owned sim."));
+				}
+				return record;
+			}
+		}
+		await withConfigLockAsync$1(() => {
+			const current = deviceSlotPlatforms(loadConfig$1()?.projects?.[projectPath], slot)?.ios;
+			if (!current) return;
+			if (current.deviceUdid !== record.deviceUdid || current.owned !== record.owned) throw new Error("The simulator assignment changed during recovery. Run `stim ios` again.");
+			clearDevice(projectPath, "ios", slot);
+		});
+	}
+	const choice = await resolveIosCreation({
+		deviceType: flags.deviceType || settings.ios?.deviceType,
+		runtime: flags.runtime || settings.ios?.runtime
+	});
+	const adopted = parkedMaxSetting("ios").max > 0 ? await withIosDeviceNameLock(() => takeParkedIosSim({
+		projectPath,
+		slot,
+		label,
+		choice,
+		out
+	})) : null;
+	if (adopted) {
+		const booting = startIosBoot(adopted.deviceUdid, async () => {
+			await resetAdoptedSim(adopted.deviceUdid, out);
+			await configureOwnedIosSim({
+				record: adopted,
+				projectPath,
+				slot,
+				profile: simslimProfile,
+				slimByDefault: simslimDefault,
+				freshBoot: true,
+				out,
+				reconcileIosSimulator
+			});
+		}, adopted.deviceName, out, flags.simulatorApp, projectPath, slot, "adopted", flags.deviceSlotWait);
+		return {
+			...adopted,
+			booting,
+			deviceType: choice.deviceType,
+			runtime: choice.runtime
+		};
+	}
+	const created = await withIosDeviceNameLock(async () => {
+		const suffix = ownedIosNameSuffix(label, {
+			model: choice.deviceType,
+			runtime: choice.runtime
+		}, projectPath, void 0, await listAllIosSimsAsync({ includeUnavailable: true }));
+		const result = await createOwnedIosSim(label, { suffix }, choice);
+		await withConfigLockAsync$1(() => setDevice(projectPath, "ios", {
+			deviceUdid: result.udid,
+			owned: true,
+			deviceName: result.name
+		}, slot));
+		return result;
+	});
+	const newRecord = {
+		deviceUdid: created.udid,
+		owned: true,
+		deviceName: created.name
+	};
+	const booting = startIosBoot(created.udid, () => configureOwnedIosSim({
+		record: newRecord,
+		projectPath,
+		slot,
+		profile: simslimProfile,
+		slimByDefault: simslimDefault,
+		freshBoot: true,
+		out,
+		reconcileIosSimulator
+	}), created.name, out, flags.simulatorApp, projectPath, slot, "created", flags.deviceSlotWait);
+	return {
+		...newRecord,
+		created: true,
+		booting,
+		deviceType: created.deviceType,
+		runtime: created.runtime
+	};
+}
+function withIosDeviceNameLock(fn) {
+	return withWorkspaceProcessLock(getConfigDir(), "ios-device-names", async () => fn(), { external: true });
+}
+function ownedIosNameSuffix(label, model, projectPath, udid, listed) {
+	const names = new Set(listed.filter((sim) => sim.udid !== udid).map((sim) => sim.name));
+	for (const project of Object.values(loadConfig$1()?.projects ?? {})) for (const { platforms } of projectDeviceSlots(project)) {
+		const record = platforms.ios;
+		if (record?.deviceUdid !== udid && record?.deviceName) names.add(record.deviceName);
+	}
+	for (const parked of readParked("ios")) if (parked.udid !== udid) names.add(parked.name);
+	let suffix = "";
+	for (let attempt = 0; names.has(ownedSimName(label, model, suffix)); attempt++) suffix = ` ${workspaceId$1(projectPath)}${attempt ? `-${attempt}` : ""}`;
+	return suffix;
+}
+function ownedIosName(sim, label, model, projectPath, listed) {
+	return ownedSimName(label, model, ownedIosNameSuffix(label, model, projectPath, sim.udid, listed));
+}
+async function renameToOwnedName(sim, label, model, projectPath) {
+	const wanted = ownedIosName(sim, label, model, projectPath, await listAllIosSimsAsync({ includeUnavailable: true }));
+	if (sim.name === wanted) return wanted;
+	try {
+		await renameIosSim(sim.udid, wanted);
+		return wanted;
+	} catch {
+		return sim.name;
+	}
+}
+async function resetAdoptedSim(udid, out) {
+	out(chalk.dim(phaseLine("device", `resetting privacy grants and the keychain on ${udid}`)));
+	await resetIosPrivacy(udid);
+	await resetIosKeychain(udid);
+}
+async function takeParkedIosSim({ projectPath, slot, label, choice, out }) {
+	const candidates = selectParked(readParked("ios"), {
+		deviceTypeIdentifier: choice.deviceTypeId,
+		runtimeIdentifier: choice.runtimeId
+	});
+	if (candidates.length === 0) return null;
+	const listed = new Map((await listAllIosSimsAsync({ includeUnavailable: true })).map((sim) => [sim.udid, sim]));
+	for (const parked of candidates) {
+		const sim = listed.get(parked.udid);
+		if (!sim || !sim.available) {
+			const result = sim ? await teardownParkedIosSim(parked.udid, { label: parked.name }) : null;
+			if (sim ? result?.status === "torn-down" : await dropParked("ios", parked.udid)) out(chalk.dim(phaseLine("device", `deleted parked ${parked.name} (${parked.udid}): ${sim ? "unavailable" : "gone"}`)));
+			else if (result?.status === "failed") out(chalk.yellow(phaseLine("device", `could not delete unavailable parked ${parked.name} (${parked.udid}): ${result.reason}`)));
+			continue;
+		}
+		if (!sim.name.startsWith("stim-")) {
+			out(chalk.yellow(phaseLine("device", `kept parked record for ${parked.udid}: simulator is now named ${JSON.stringify(sim.name)} and is not Stim-owned`)));
+			continue;
+		}
+		const model = {
+			model: choice.deviceType,
+			runtime: choice.runtime
+		};
+		const name = ownedSimName(label, model, ownedIosNameSuffix(label, model, projectPath, parked.udid, [...listed.values()]));
+		const device = {
+			deviceUdid: parked.udid,
+			owned: true,
+			deviceName: name,
+			adopted: true,
+			adoptionPending: true,
+			...parked.simslimManaged ? { simslimManaged: true } : {},
+			...parked.cacheKey ? { parkedCacheKey: parked.cacheKey } : {}
+		};
+		const adopted = await adoptParked({
+			platform: "ios",
+			projectPath,
+			slot,
+			udid: parked.udid,
+			device
+		});
+		if (!adopted) continue;
+		try {
+			await renameIosSim(parked.udid, name);
+		} catch {}
+		return adopted.schemeApprovals && adopted.schemeApprovals.length > 0 ? {
+			...device,
+			schemeApprovals: adopted.schemeApprovals
+		} : device;
+	}
+	return null;
+}
+function clearIosAdoptionPending(projectPath, slot = "default") {
+	return withConfigLockAsync$1(() => {
+		const cfg = loadConfig$1();
+		const ios = deviceSlotPlatforms(cfg?.projects?.[projectPath], slot)?.ios;
+		if (!cfg || !ios?.adoptionPending) return;
+		delete ios.adopted;
+		delete ios.adoptionPending;
+		delete ios.parkedCacheKey;
+		saveConfig(cfg);
+	});
+}
+function simslimProfileIdentity(profile, slimByDefault) {
+	if (profile) return `profile:${createHash("sha256").update(readFileSync(profile)).digest("hex")}`;
+	return slimByDefault ? "default" : null;
+}
+async function startedSpringBoardPid(udid) {
+	const springBoard = await waitForSpringBoard(udid, Date.now() + SPRINGBOARD_MUTE_WAIT_MS);
+	return springBoard.state === "started" ? springBoard.pid : null;
+}
+async function configureOwnedIosSim({ record, projectPath, slot, profile, slimByDefault, freshBoot, out, reconcileIosSimulator }) {
+	const identity = simslimProfileIdentity(profile, slimByDefault);
+	const slimConfigured = identity !== null || Boolean(record.simslimManaged);
+	const applied = record.simslimApplied;
+	const springBoardBefore = slimConfigured ? await readSpringBoardPid(record.deviceUdid) : null;
+	if (identity !== null && record.simslimManaged && !freshBoot && applied?.profile === identity && springBoardBefore !== null && springBoardBefore === applied.springBoardPid) {
+		await withConfigLockAsync$1(() => setDevice(projectPath, "ios", { ...record }, slot));
+		return {
+			record,
+			rebooted: false
+		};
+	}
+	if (profile) out(chalk.dim(phaseLine("device", `applying the SimSlim profile to ${record.deviceUdid}`)));
+	else if (slimByDefault) out(chalk.dim(phaseLine("device", `applying SimSlim's default services to ${record.deviceUdid}`)));
+	else if (record.simslimManaged) out(chalk.dim(phaseLine("device", `restoring stock simulator services on ${record.deviceUdid}`)));
+	const previouslyManaged = Boolean(record.simslimManaged);
+	if (identity !== null && !record.simslimManaged || applied) {
+		const { simslimApplied: _applied, ...rest } = record;
+		const pending = identity !== null ? {
+			...rest,
+			simslimManaged: true
+		} : rest;
+		await withConfigLockAsync$1(() => setDevice(projectPath, "ios", pending, slot));
+		record = pending;
+	}
+	const result = await reconcileIosSimulator({
+		context: ambientContext(),
+		udid: record.deviceUdid,
+		profile,
+		slimByDefault,
+		previouslyManaged,
+		out
+	});
+	const updated = { ...record };
+	if (result.managed) updated.simslimManaged = true;
+	else delete updated.simslimManaged;
+	const springBoardAfter = slimConfigured ? await startedSpringBoardPid(record.deviceUdid) : null;
+	if (result.managed && !result.notInstalled && identity !== null && springBoardAfter !== null) updated.simslimApplied = {
+		profile: identity,
+		springBoardPid: springBoardAfter
+	};
+	await withConfigLockAsync$1(() => setDevice(projectPath, "ios", updated, slot));
+	const rebooted = slimConfigured && springBoardAfter !== springBoardBefore;
+	if (rebooted && !result.notInstalled) iosBootRecorder(projectPath, slot, record.deviceUdid)("ios_boot", {
+		phase: "simslim_reboot",
+		pidBefore: springBoardBefore,
+		pidAfter: springBoardAfter,
+		msg: `ios boot ${record.deviceUdid}: simslim_reboot (SpringBoard pid ${springBoardBefore ?? "unknown"} to ${springBoardAfter ?? "unknown"})`
+	});
+	return {
+		record: updated,
+		rebooted
+	};
+}
+const SPRINGBOARD_RESPAWN_POLLS = 20;
+const SPAWN_STALL_TOLERANCE_MS = 18e4;
+async function ensureIosBooted(args) {
+	const { springBoardDown, ...first } = await bootOwnedIosSim(args);
+	const { device, projectPath, out } = args;
+	const udid = device?.deviceUdid;
+	if (!springBoardDown || !device || !udid) return first;
+	out(chalk.yellow(phaseLine("device", `SpringBoard is not running on ${udid}; restarting the simulator once`)));
+	const record = iosBootRecorder(projectPath, args.slot, udid);
+	await preserveSpringBoardReports(record, udid, projectPath);
+	const stopped = await teardownOwnedIosSim(udid, { workspace: projectPath });
+	if (stopped.status !== "torn-down") return {
+		...first,
+		reason: `${first.reason} The restart did not run: ${stopped.reason ?? stopped.status}.`
+	};
+	record("ios_boot", {
+		phase: "restart",
+		level: "warn",
+		msg: `ios boot ${udid}: restart (SpringBoard is not running after boot; restarting once)`
+	});
+	const { booted: _booted, booting: _booting, ...unbooted } = device;
+	const { springBoardDown: stillDown, ...second } = await bootOwnedIosSim({
+		...args,
+		device: unbooted,
+		origin: "restart"
+	});
+	if (stillDown) await preserveSpringBoardReports(record, udid, projectPath);
+	return stillDown ? {
+		...second,
+		reason: `${second.reason} Stim already restarted the simulator once, so it did not restart it again.`
+	} : second;
+}
+async function preserveSpringBoardReports(record, udid, root) {
+	const dir = workspaceLogsDir$1(root);
+	try {
+		const { files, dropped, failure } = await copySpringBoardCrashReports({
+			udid,
+			destDir: dir
+		});
+		const limit = dropped ? `; ${dropped} more matched but exceeded the copy limits` : "";
+		record("springboard_crash_reports", {
+			level: files.length || dropped || failure ? "warn" : "info",
+			files,
+			dropped,
+			...failure ? { failure } : {},
+			dir,
+			msg: failure ? `could not copy a SpringBoard crash report for ${udid} (${files.length} copied before it): ${failure}` : files.length ? `copied ${files.length} SpringBoard crash report(s) for ${udid} to ${dir}: ${files.join(", ")}${limit}` : dropped ? `${dropped} SpringBoard crash report(s) for ${udid} matched but exceeded the copy limits` : `no SpringBoard crash report for ${udid} from the last 10 minutes`
+		});
+	} catch (error) {
+		record("springboard_crash_reports", {
+			level: "warn",
+			files: [],
+			dropped: 0,
+			failure: error instanceof Error ? error.message : String(error),
+			dir,
+			msg: `could not copy SpringBoard crash reports for ${udid}: ${error instanceof Error ? error.message : String(error)}`
+		});
+	}
+}
+async function bootOwnedIosSim({ device, projectPath, slot, origin, deviceSlotWait, simulatorApp, timeoutMs, pollMs, out }) {
+	const udid = device?.deviceUdid;
+	if (!udid) return {
+		failed: true,
+		reason: "No iOS simulator is recorded for this project."
+	};
+	const onPhase = recordBootPhase(iosBootRecorder(projectPath, slot, udid), udid, origin ?? (device.adoptionPending ? "adopted" : "existing"));
+	const openViewer = async () => {
+		await configuredIosSimulatorViewer(simulatorApp, ambientContext()?.env).open(udid);
+		onPhase({ phase: "viewer_opened" });
+	};
+	const ready = async () => {
+		try {
+			const stallDeadline = Date.now() + SPAWN_STALL_TOLERANCE_MS;
+			const listSpringBoard = async () => {
+				for (;;) try {
+					return await getExecutor().runFileAsync("xcrun", [
+						"simctl",
+						"spawn",
+						udid,
+						"launchctl",
+						"list"
+					], { timeoutMs: 3e4 });
+				} catch (error) {
+					if (!isTimeoutError(error) || Date.now() >= stallDeadline) throw error;
+					const sims = await listAllIosSimsAsync().catch(() => null);
+					if (sims && sims.find((s) => s.udid === udid)?.state !== "Booted") throw error;
+				}
+			};
+			let listing = await listSpringBoard();
+			for (let poll = 0; !springBoardRunning(listing) && poll < SPRINGBOARD_RESPAWN_POLLS; poll++) {
+				await cancellableSleep(pollMs);
+				listing = await listSpringBoard();
+			}
+			if (!springBoardRunning(listing)) return {
+				failed: true,
+				springBoardDown: true,
+				reason: `Simulator ${udid} reports Booted, but SpringBoard (the system shell) is not running, so apps cannot launch. Run \`stim stop\`, then \`stim ios\` again. If it repeats, look for SpringBoard crash reports in ~/Library/Logs/DiagnosticReports.`
+			};
+			return {
+				ok: true,
+				udid
+			};
+		} catch (error) {
+			return {
+				failed: true,
+				reason: `Simulator ${udid} failed its process-spawn readiness check: ${error?.message || error}. ${await iosSimulatorFailureAdvice()}`
+			};
+		}
+	};
+	const booting = device?.booting;
+	if (booting?.udid === udid) {
+		try {
+			await booting.done;
+		} catch (e) {
+			return bootFailure(udid, e);
+		}
+		return ready();
+	}
+	const readiness = device?.booted === udid ? await ready() : null;
+	if (readiness?.ok) {
+		if (simulatorApp !== void 0) await openViewer();
+		return readiness;
+	}
+	let resolved;
+	try {
+		resolved = resolveOwnedIosSim(udid, await listAllIosSimsAsync());
+	} catch (e) {
+		return {
+			failed: true,
+			reason: `Could not list simulators: ${e?.message || e}`
+		};
+	}
+	if (resolved.missing) return {
+		failed: true,
+		reason: `Simulator ${udid} no longer exists. Run \`stim ios\` again to create a fresh owned sim.`
+	};
+	if (resolved.notOwned) return {
+		failed: true,
+		reason: `Simulator ${udid} is now named "${resolved.notOwned}" and is not Stim-owned; refusing to boot it.`
+	};
+	const sim = resolved.sim;
+	if (sim.state === "Booted") {
+		const result = readiness ?? await ready();
+		if (result.ok && simulatorApp !== void 0) await openViewer();
+		return result;
+	}
+	const bootDeadline = Date.now() + timeoutMs;
+	try {
+		await withDeviceBootAdmission({
+			platform: "ios",
+			key: udid
+		}, async () => {
+			out(chalk.dim(phaseLine("device", `booting ${sim.name} (${udid})`)));
+			await bootIosSim(udid, {
+				timeoutMs,
+				label: sim.name,
+				out,
+				simulatorApp,
+				env: ambientContext()?.env,
+				onPhase
+			});
+			await muteBootedSimulator(udid, out);
+		}, {
+			...deviceSlotWait,
+			root: projectPath,
+			out
+		});
+	} catch (e) {
+		return bootFailure(udid, e);
+	}
+	const deadline = Math.max(bootDeadline, Date.now() + 2 * pollMs);
+	while (Date.now() < deadline) {
+		await cancellableSleep(pollMs);
+		let state = null;
+		try {
+			state = (await listAllIosSimsAsync({ timeoutMs: 3e4 })).find((s) => s.udid === udid)?.state ?? null;
+		} catch {}
+		if (state === "Booted") return ready();
+	}
+	return {
+		failed: true,
+		reason: `Simulator ${udid} did not reach the Booted state within ${Math.round(timeoutMs / 1e3)}s.`
+	};
+}
+function bootFailure(udid, error) {
+	const refusal = error instanceof DeviceAdmissionRefusal ? error : (0, ownership_claim_exports.claimFailure)(error, "stim ios");
+	if (refusal) return {
+		failed: true,
+		code: refusal.code,
+		reason: refusal.message,
+		remedy: refusal.remedy
+	};
+	return {
+		failed: true,
+		reason: `Could not boot simulator ${udid}: ${error?.message || error}`
+	};
+}
+function buildLogFile(root) {
+	return join(workspaceLogsDir$1(root), `build-ios.ndjson`);
+}
+function iosProjectPathError(settings, root, isExpo) {
+	const error = iosProjectDirSettingError(settings, root);
+	if (error || !iosProjectDirSetting(settings, root).custom || !isExpo()) return error;
+	return "ios.projectPath applies to bare React Native apps only: expo prebuild generates and builds ios/. Remove it for this Expo app.";
+}
+function resolveIosBuildSetup(remoteBuild, settings, warn, env) {
+	const [shapeError, ...lines] = settingShapeErrors(settings);
+	if (shapeError) return {
+		ok: false,
+		failure: {
+			code: "STIM_BAD_ARG",
+			message: shapeError,
+			lines,
+			remedy: SETTING_SHAPE_REMEDY
+		}
+	};
+	const placement = resolveBuildPlacement(remoteBuild);
+	if (placement.failure) return {
+		ok: false,
+		failure: {
+			...placement.failure,
+			setup: true
+		}
+	};
+	let optimizations;
+	try {
+		optimizations = resolveOptimizations(settings, env);
+	} catch (error) {
+		return {
+			ok: false,
+			failure: {
+				code: "STIM_BAD_ARG",
+				message: error.message,
+				remedy: SETTING_SHAPE_REMEDY
+			}
+		};
+	}
+	for (const key of unknownSettingKeys(settings)) warn("setting", inertSettingWarning(settings, key));
+	const cacheProviderError = cacheProviderSettingError(settings);
+	if (cacheProviderError) warn("cache", `${cacheProviderError} Using the local cache.`);
+	return {
+		ok: true,
+		buildMachine: placement.selected,
+		optimizations
+	};
+}
+const MAX_PRINTED_DIAGNOSTICS = 6;
+function deviceLabel(device, udid) {
+	const name = device?.deviceName || device?.name || null;
+	return name ? `${name} (${shortUdid(udid)})` : shortUdid(udid);
+}
+function deviceShortName(device, udid) {
+	return device?.deviceName || device?.name || shortUdid(udid);
+}
+function appNameFromPath(appPath) {
+	if (typeof appPath !== "string" || appPath.trim() === "") return null;
+	const name = basename(appPath).replace(/\.app$/i, "");
+	return name === "" ? null : name;
+}
+function iosConfigurationSetting(settings) {
+	const ios = settings?.["ios"];
+	if (!ios || typeof ios !== "object" || Array.isArray(ios)) return null;
+	const raw = ios["configuration"];
+	return typeof raw === "string" && raw.trim() !== "" ? raw.trim() : null;
+}
+function resolveConfiguration(flag, settings) {
+	return (typeof flag === "string" && flag.trim() !== "" ? flag.trim() : null) || iosConfigurationSetting(settings);
+}
+function resolveSchemeSelection({ scheme, easProfile }, settings) {
+	if (typeof scheme === "string" || easProfile !== void 0) return scheme ?? void 0;
+	return iosStringSetting(settings, "scheme") ?? void 0;
+}
+function iosStringSetting(settings, key) {
+	const ios = settings?.["ios"];
+	if (!ios || typeof ios !== "object" || Array.isArray(ios)) return null;
+	const raw = ios[key];
+	return typeof raw === "string" && raw.trim() !== "" ? raw.trim() : null;
+}
+function resolveDeviceType(flag, settings) {
+	return (typeof flag === "string" && flag.trim() !== "" ? flag.trim() : null) || iosStringSetting(settings, "deviceType");
+}
+function resolveRuntime(flag, settings) {
+	return (typeof flag === "string" && flag.trim() !== "" ? flag.trim() : null) || iosStringSetting(settings, "runtime");
+}
+function resolveSimulatorAppFlag(flag, physical, remoteBackend, automatic = false) {
+	if (flag === void 0) return {};
+	let simulatorApp;
+	try {
+		simulatorApp = parseIosSimulatorApp(flag, "--simulator-app");
+	} catch (error) {
+		return { refusal: {
+			code: "STIM_BAD_ARG",
+			message: error.message
+		} };
+	}
+	if (physical || remoteBackend && !automatic) return { refusal: {
+		code: "STIM_BAD_ARG",
+		message: "--simulator-app only applies to a local owned iOS simulator.",
+		remedy: "Drop --simulator-app when using a physical or remote device."
+	} };
+	return { simulatorApp };
+}
+async function deviceModelRefusal({ slot, deviceTypeFlag, runtimeFlag, deviceType, runtime, deviceTypeOrigin = null, runtimeOrigin = null, physical, remoteBackend, hosted = false, listRuntimes, signal, snapshot }) {
+	if (slot && slot !== "default" && remoteBackend) return {
+		code: "STIM_BAD_ARG",
+		message: "Named slots currently support local simulators and physical devices.",
+		remedy: "Use the default slot for a remote session."
+	};
+	if (typeof deviceTypeFlag === "string" && deviceTypeFlag.trim() === "") return {
+		code: "STIM_BAD_ARG",
+		message: "--device-type was given an empty name.",
+		remedy: "Pass `--device-type <name>` with a model `xcrun simctl list devicetypes` names, e.g. \"iPad Pro 13-inch (M5)\"."
+	};
+	if (typeof runtimeFlag === "string" && runtimeFlag.trim() === "") return {
+		code: "STIM_BAD_ARG",
+		message: "--runtime was given an empty version.",
+		remedy: "Pass `--runtime <version>` with a runtime `xcrun simctl list runtimes` reports, e.g. \"18.5\"."
+	};
+	if (remoteBackend) {
+		const eas = remoteBackend === "eas";
+		const given = [!eas && deviceTypeFlag && "--device-type", runtimeFlag && "--runtime"].filter(Boolean).join(" and ");
+		if (given) return {
+			code: "STIM_BAD_ARG",
+			message: `${given} ${given.includes(" and ") ? "apply" : "applies"} only to a local owned iOS simulator; the ${remoteBackend} remote backend chooses its own ${eas ? "iOS runtime" : "device"}.`,
+			remedy: `Drop ${given} for a remote run. For a local owned simulator, drop --remote and unset ios.remote with \`stim settings unset ios.remote --scope <machine|workspace|repo|committed>\`.`
+		};
+		return null;
+	}
+	if (physical || hosted) return null;
+	if (!deviceType && !runtime) return null;
+	let runtimes;
+	try {
+		runtimes = await listRuntimes({
+			signal,
+			snapshot
+		});
+	} catch (error) {
+		return {
+			code: "STIM_NO_DEVICE",
+			message: `Could not read the installed simulator runtimes: ${error?.message || error}`,
+			remedy: "Run `stim doctor` to check the simulator toolchain, then try again."
+		};
+	}
+	const runtimeRefusal = unknownIosRuntimeRefusal(runtime, runtimes);
+	if (runtimeRefusal) {
+		const { message, remedy } = layerNote(runtimeRefusal, "ios.runtime", runtimeFlag, runtimeOrigin);
+		return {
+			code: "STIM_BAD_ARG",
+			message,
+			remedy
+		};
+	}
+	const deviceTypeRefusal = unknownIosDeviceTypeRefusal(deviceType, runtimes, runtime);
+	if (deviceTypeRefusal) {
+		const { message, remedy } = layerNote(deviceTypeRefusal, "ios.deviceType", deviceTypeFlag, deviceTypeOrigin);
+		return {
+			code: "STIM_BAD_ARG",
+			message,
+			remedy
+		};
+	}
+	return null;
+}
+function ownedSimFailure(error) {
+	return {
+		code: "STIM_NO_DEVICE",
+		message: `Could not ensure an owned iOS simulator: ${error?.message || error}`,
+		remedy: error instanceof IosDeviceMismatchError ? error.remedy : "Run `stim doctor` to check the simulator toolchain, then try again."
+	};
+}
+function isReleaseConfiguration(configuration) {
+	return typeof configuration === "string" && configuration.trim() !== "" && configuration.trim().toLowerCase() !== "debug";
+}
+function simulatorBuildArch({ physical, remoteArch, hostArch, configuration }) {
+	if (physical) return null;
+	if (remoteArch) return remoteArch;
+	return isReleaseConfiguration(configuration) ? null : hostArch;
+}
+function iosProviderRunOptions(configuration, arch) {
+	if (arch) return {
+		configuration: configuration || "Debug",
+		arch
+	};
+	return configuration ? { configuration } : null;
+}
+function podAction(podState, verdict, { prebuildRan = false } = {}) {
+	if (verdict?.stale) return {
+		install: true,
+		reason: verdict.reason
+	};
+	if (verdict?.noPods && podState?.hasPodfile) return {
+		install: true,
+		reason: "ios/Podfile exists but no pods are installed"
+	};
+	if (prebuildRan && podState?.hasPodfile) return {
+		install: true,
+		reason: "prebuild updated ios/ in place"
+	};
+	return { install: false };
+}
+function xcodeFailureReport(result, logPath) {
+	const diagnostics = result.diagnostics;
+	const code = result.exitCode;
+	const how = code === null ? "" : ` (exit code ${code})`;
+	return {
+		message: diagnostics.length ? `\`xcodebuild\` failed${how} with ${diagnostics.length} diagnostic${diagnostics.length === 1 ? "" : "s"}.` : `\`xcodebuild\` failed${how} with no recognizable diagnostic.`,
+		remedy: diagnostics.find((d) => d?.remedy)?.remedy || `See ${logPath} for the transcript.`
+	};
+}
+function printDiagnostics(note, result) {
+	const diagnostics = result.diagnostics;
+	const shown = diagnostics.slice(0, MAX_PRINTED_DIAGNOSTICS);
+	for (const diagnostic of shown) note(chalk.red(phaseLine("error", describeDiagnostic(diagnostic))));
+	const hidden = diagnostics.length - shown.length + result.truncated;
+	if (hidden > 0) note(chalk.dim(phaseLine("error", `... and ${hidden} more diagnostic${hidden === 1 ? "" : "s"} in the log`)));
+	if (diagnostics.length === 0) {
+		note(chalk.red(phaseLine("error", "xcodebuild failed with no recognizable diagnostic; last lines:")));
+		for (const line of result.tail.slice(-5)) note(chalk.dim(phaseLine("", line)));
+	}
+}
+function resolveIosWait(opts, physical) {
+	const noWait = opts.wait === false;
+	if (opts.waitConflict) return { failure: {
+		code: "STIM_BAD_ARG",
+		message: "--wait and --no-wait ask for opposite things.",
+		remedy: "Pass only one of `--wait <seconds>` and `--no-wait`."
+	} };
+	const waitParsed = parseDeviceWait(noWait ? void 0 : opts.wait);
+	if ("error" in waitParsed) return { failure: {
+		code: "STIM_BAD_ARG",
+		message: waitParsed.error,
+		remedy: "Pass a whole number of seconds, e.g. --wait 90. `--wait 0` refuses a busy lease or device slot at once."
+	} };
+	return {
+		waitSeconds: waitParsed.seconds,
+		noWait,
+		checkCapacity: !physical && (noWait || waitParsed.seconds === 0),
+		deviceSlotWaitMs: noWait ? 0 : opts.wait === void 0 && !physical ? DEFAULT_DEVICE_SLOT_WAIT_MS : waitParsed.seconds * 1e3
+	};
+}
+function createIosDeviceWaitRun(stats, progress, signal) {
+	const controller = new AbortController();
+	let waiting = false;
+	let boot;
+	let outcome;
+	return {
+		policy: {
+			signal: signal ? AbortSignal.any([controller.signal, signal]) : controller.signal,
+			waitingFor(info) {
+				waiting = info !== null;
+				progress.waitingFor(info, "device-slot");
+			},
+			onWait: stats.addDeviceSlotWaitMs,
+			onBootStart: () => progress.bootStarted()
+		},
+		record(next) {
+			if (waiting) outcome = next;
+			else stats.record(next);
+		},
+		booting(pending) {
+			boot ??= pending?.done;
+		},
+		async finish() {
+			const queued = waiting;
+			controller.abort();
+			if (queued) await boot?.catch(() => {});
+			if (outcome) stats.record(outcome);
+		}
+	};
+}
+//#endregion
+export { inspectBuildMachines as $, fingerprintMismatchRemedy as A, DEVICE_BUSY as B, clearIosAdoptionPending as C, OffloadRefusal as D, muteBootedSimulator as E, requireLocalBuild as F, lostLine as G, DEVICE_WAIT_POLL_MS as H, resolveBuildMachine as I, releaseLeaseOnAbort as J, lostRefusal as K, resolveBuildPlacement as L, namedBuildMachine as M, parseBuildMachineOption as N, automaticBuild as O, podsFailedRemedy as P, forgetBuildMachine as Q, workerFailureReason as R, xcodeFailureReport as S, ensureOwnedIosDevice as T, acquireRunLease as U, DEVICE_WAIT_LINE_MS as V, leaseExpiryText as W, waitFlagConflict as X, runLease as Y, waitForDevice as Z, resolveIosWait as _, deviceModelRefusal as a, inspectDeviceHostMachines as at, resolveSimulatorAppFlag as b, iosProjectPathError as c, ownedSimFailure as d, pairedMachines as et, podAction as f, resolveIosBuildSetup as g, resolveDeviceType as h, deviceLabel as i, hostingMachines as it, missingPackageManagerRemedy as j, buildPlacementSettings as k, iosProviderRunOptions as l, resolveConfiguration as m, buildLogFile as n, configuredMachines as nt, deviceShortName as o, printDiagnostics as p, parseDeviceWait as q, createIosDeviceWaitRun as r, forgetDeviceHostMachine as rt, iosConfigurationSetting as s, appNameFromPath as t, predictedRefusal as tt, isReleaseConfiguration as u, resolveRuntime as v, ensureIosBooted as w, simulatorBuildArch as x, resolveSchemeSelection as y, DEBUG_VERIFY_STEP_MS as z };