stim 1.34.0 → 1.36.0

package/dist/selection-CH-MUVGD.mjs

@@ -1,791 +0,0 @@
-import { C as operationState, r as reportSignal } from "./exec-CGuDzt40.mjs";
-import { M as withDirLock$1 } from "./workspace-state-BdZ-QgmB.mjs";
-import { $ as unconfirmedKeyFinding, F as diagnoseOutcome, G as realIo, H as outdatedServer, I as diagnoseTailscale, J as setupRemedy, Q as notOnTailnetDiagnosis, R as endpoint$1, U as parseMachine$1, W as reachMachine, X as diagnoseLocalUnreachable, Y as tailscaleStatusAsync, Z as diagnosisFinding, d as getConfigDir, et as readHostPermissions, v as loadConfig$1, z as findPeer$1 } from "./config-BW0fAtoK.mjs";
-import { s as cocoapodsInstall } from "./toolchain-CYonNjd_.mjs";
-import { releaseClaim, tryAcquireClaim } from "@stim-cli/core/ownership-claim";
-import { mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { hostname } from "node:os";
-import { ambientContext, ambientEnv, withDirLockAsync } from "@stim-cli/core";
-import { MACHINE_CREDENTIALS_VERSION, acceptsShape, automaticMachineEnabled, buildMachinesFile, buildMachinesLock, cannotHost, deviceHostMachinesClaims, deviceHostMachinesFile, deviceHostMachinesLock, isJsonObject, localEndpoint, parseMachine, placementWord, readBuildMachines, readDeviceHostMachines, settingDefinition } from "@stim-cli/core/state";
-import { InvalidArgumentError } from "commander";
-//#region src/device-host/machines.ts
-function note$1(title, detail, fix = null) {
-	return {
-		code: "device-host-machine",
-		level: "note",
-		title,
-		detail,
-		fix
-	};
-}
-function configuredMachines() {
-	const remote = loadConfig$1()?.remote;
-	if (remote !== void 0 && !isJsonObject(remote)) return null;
-	const machines = remote?.machines;
-	if (machines === void 0) return [];
-	return acceptsShape(settingDefinition("remote.machines"), machines) ? machines : null;
-}
-/**
-* The `remote.machines` entries this machine asked for device-host access, in setting order, without the ones the
-* tailnet reports as running another OS than macOS, which can never host; null when the setting is invalid.
-*/
-async function hostingMachines(status, signal) {
-	const configured = configuredMachines();
-	if (configured === null) return null;
-	let candidates = configured;
-	try {
-		const asked = readDeviceHostMachines();
-		candidates = configured.filter((machine) => asked.some((each) => each.machine === machine));
-	} catch {
-		candidates = configured;
-	}
-	if (!candidates.some((machine) => parseMachine$1(machine)?.transport === "tailscale")) return candidates;
-	const current = await (status ? status() : tailscaleStatusAsync(signal));
-	signal?.throwIfAborted();
-	return candidates.filter((machine) => !cannotHost(current, machine));
-}
-async function store(machines, operation) {
-	reportSignal(operation)?.throwIfAborted();
-	const write = () => {
-		reportSignal(operation)?.throwIfAborted();
-		const file = deviceHostMachinesFile();
-		const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-		try {
-			writeFileSync(tmp, `${JSON.stringify({
-				version: MACHINE_CREDENTIALS_VERSION,
-				machines
-			}, null, 2)}\n`, { mode: 384 });
-			renameSync(tmp, file);
-		} finally {
-			rmSync(tmp, { force: true });
-		}
-	};
-	const options = { ensureParent: () => mkdirSync(getConfigDir(), { recursive: true }) };
-	const signal = reportSignal(operation);
-	if (signal) await withDirLockAsync(deviceHostMachinesLock(), write, {
-		...options,
-		signal
-	});
-	else withDirLock$1(deviceHostMachinesLock(), write, options);
-}
-/**
-* Reports the device-host approval of each remote machine, separate from its build approval. Only --fix makes a setup
-* ticket or forgets credentials; every server key stays pinned.
-*/
-async function inspectDeviceHostMachines({ fix, version = "<version>", tickets = /* @__PURE__ */ new Map(), operation, confirmKey }, io = realIo, entries = configuredMachines()) {
-	if (entries === null) return {
-		findings: [note$1("Invalid remote.machines setting", "Use a remote object with machines as an array of tailnet names. Existing hosting credentials and pinned keys are preserved.", "Run `stim guide settings` and correct the setting before running doctor again.")],
-		machines: []
-	};
-	const unavailable = (state, finding) => ({
-		findings: [finding],
-		machines: entries.map((machine) => ({
-			machine,
-			state
-		}))
-	});
-	const unreadable = () => unavailable("credentials-unavailable", note$1("Hosting credentials are unreadable", `Stim preserves ${deviceHostMachinesFile()} and its pinned keys.`, "Restore the existing file from a trusted backup or restore read access before running doctor again."));
-	if (!entries.length) {
-		if (!fix) return {
-			findings: [],
-			machines: []
-		};
-		try {
-			if (!readDeviceHostMachines().length) return {
-				findings: [],
-				machines: []
-			};
-		} catch {
-			return unreadable();
-		}
-	}
-	const claim = tryAcquireClaim({
-		root: deviceHostMachinesClaims(),
-		mode: "exclusive",
-		label: "device-host approval"
-	});
-	if (!claim.acquired) {
-		releaseClaim(claim.pending);
-		return unavailable("busy", note$1("Device-host approval is in use", "Another doctor run holds the hosting credential claim. Run doctor again after it finishes."));
-	}
-	try {
-		let credentials;
-		try {
-			credentials = readDeviceHostMachines();
-		} catch {
-			return unreadable();
-		}
-		if (fix) {
-			const kept = credentials.filter((each) => entries.includes(each.machine));
-			if (kept.length !== credentials.length) {
-				await store(kept, operation);
-				credentials = kept;
-			}
-		}
-		if (!entries.length) return {
-			findings: [],
-			machines: []
-		};
-		const tailnet = entries.some((entry) => parseMachine$1(entry)?.transport !== "local");
-		const status = tailnet ? await io.status() : null;
-		const inspected = {
-			findings: [],
-			machines: []
-		};
-		let off = null;
-		if (tailnet && !isJsonObject(status)) {
-			off = await diagnoseTailscale(io);
-			inspected.findings.push(note$1("Remote machines are unreachable", `remote.machines names remote machines. ${off.message}`, off.remedy));
-		}
-		const self = isJsonObject(status) && isJsonObject(status.Self) ? status.Self : {};
-		const deviceName = (typeof self.HostName === "string" && self.HostName ? self.HostName : hostname()).replace(/[\p{Cc}\p{Cf}]/gu, "").trim().slice(0, 64) || "Mac";
-		const namedNodes = /* @__PURE__ */ new Set();
-		for (const machine of new Set(entries)) {
-			const parsed = parseMachine$1(machine);
-			if (!parsed) {
-				inspected.machines.push({
-					machine,
-					state: "invalid"
-				});
-				inspected.findings.push(note$1(`Remote machine ${machine} is not a tailnet name or local: address`, "Expected `name`, `name:port`, `local:<host>` or `local:<host>:port`."));
-				continue;
-			}
-			const local = parsed.transport === "local";
-			if (!local && off) {
-				inspected.machines.push({
-					machine,
-					state: "tailscale-off",
-					diagnosis: off
-				});
-				continue;
-			}
-			const current = local ? null : await io.status();
-			if (!local && !isJsonObject(current)) {
-				const diagnosis = await diagnoseTailscale(io);
-				inspected.machines.push({
-					machine,
-					state: "tailscale-off",
-					diagnosis
-				});
-				inspected.findings.push(diagnosisFinding("device-host-machine", machine, diagnosis));
-				continue;
-			}
-			const peer = local ? null : findPeer$1(current, parsed.name);
-			if (peer === "missing" || peer === "ambiguous") {
-				const diagnosis = notOnTailnetDiagnosis(machine, peer === "ambiguous");
-				inspected.machines.push({
-					machine,
-					state: "not-on-tailnet",
-					diagnosis
-				});
-				inspected.findings.push(diagnosisFinding("device-host-machine", machine, diagnosis));
-				continue;
-			}
-			const target = peer ? endpoint$1(peer, parsed.port) : localEndpoint(parsed.name, parsed.port);
-			const dnsName = peer ? { dnsName: peer.dnsName } : {};
-			const nodeRoute = peer ? `${peer.nodeId}:${parsed.port}` : `local:${parsed.name}:${parsed.port}`;
-			if (namedNodes.has(nodeRoute)) {
-				inspected.machines.push({
-					machine,
-					...dnsName,
-					state: "invalid"
-				});
-				inspected.findings.push(note$1(`Remote machine ${machine} repeats a named node`, "Name each tailnet node and serve port only once in remote.machines."));
-				continue;
-			}
-			namedNodes.add(nodeRoute);
-			if (cannotHost(current, machine)) {
-				inspected.machines.push({
-					machine,
-					...dnsName,
-					state: "not-asked"
-				});
-				continue;
-			}
-			const credential = credentials.find((each) => each.machine === machine);
-			reportSignal(operation)?.throwIfAborted();
-			const outcome = await reachMachine({
-				machine,
-				access: "device-host",
-				endpoint: target,
-				address: peer?.dnsName ?? parsed.name,
-				credential,
-				other: () => readBuildMachines().find((each) => each.machine === machine),
-				persist: async (next) => {
-					credentials = [...credentials.filter((each) => each.machine !== machine), next];
-					await store(credentials, operation);
-				},
-				fix,
-				deviceName,
-				setupFlags: ["build", "device-host"],
-				serverVersion: version,
-				io,
-				tickets,
-				...local ? { confirmKey: (serverKey) => confirmKey?.(machine, serverKey) ?? Promise.resolve(false) } : {}
-			});
-			reportSignal(operation)?.throwIfAborted();
-			if (outcome.state !== "not-asked" && outcome.credential) {
-				const next = outcome.credential;
-				if (JSON.stringify(next) !== JSON.stringify(credential)) {
-					credentials = [...credentials.filter((each) => each.machine !== machine), next];
-					await store(credentials, operation);
-				}
-			}
-			const saved = outcome.state !== "not-asked" ? outcome.credential : void 0;
-			const known = {
-				machine,
-				...dnsName,
-				...saved?.deviceId ? { deviceId: saved.deviceId } : {},
-				...saved ? { requestedAt: saved.requestedAt } : {}
-			};
-			if (outcome.state === "approved") {
-				const host = readHostPermissions(outcome.result.host);
-				if (host && (host.screenRecording === false || host.accessibility === false)) {
-					const panes = [...host.screenRecording === false ? ["Screen & System Audio Recording (Screen Recording on macOS 14)"] : [], ...host.accessibility === false ? ["Device Control and Data Access (Accessibility on macOS 26 and earlier)"] : []];
-					const detail = [...host.screenRecording === false ? ["Viewing hosted macOS apps needs Screen Recording."] : [], ...host.accessibility === false ? ["Controlling them needs the control permission."] : []];
-					inspected.findings.push(note$1(`Remote Mac ${machine} needs ${panes.join(" and ")} for ${host.name}`, detail.join(" "), `On ${machine}, approve ${host.name} in System Settings > Privacy & Security, or run \`stim-server service install\` there again to show the requests.`));
-				}
-				inspected.machines.push({
-					...known,
-					state: "approved",
-					...host ? { host } : {}
-				});
-				continue;
-			}
-			if (outcome.state === "pending") {
-				inspected.machines.push({
-					...known,
-					state: "pending",
-					...outcome.credential.expiresAt ? { expiresAt: outcome.credential.expiresAt } : {}
-				});
-				inspected.findings.push(note$1(`Remote machine ${machine} has not approved this machine for device hosting yet`, `It does not hold this machine's setup ticket yet${outcome.credential.expiresAt ? `; the ticket expires at ${outcome.credential.expiresAt}` : ""}.`, setupRemedy(machine, outcome.command)));
-				continue;
-			}
-			if (outcome.state === "not-asked") {
-				inspected.machines.push({
-					...known,
-					state: "not-asked"
-				});
-				inspected.findings.push(note$1(`Remote machine ${machine} has not approved this machine for device hosting`, "This machine has not asked for hosting access.", "Run `stim doctor --fix` to make a setup ticket and print the command to run there."));
-				continue;
-			}
-			if (outcome.state === "outdated") {
-				const outdated = outdatedServer(machine, version, outcome.command);
-				inspected.machines.push({
-					...known,
-					state: "outdated",
-					diagnosis: {
-						layer: "compat",
-						code: "server-outdated",
-						title: "Server is outdated",
-						message: outdated.detail,
-						remedy: outdated.fix
-					}
-				});
-				inspected.findings.push(note$1(outdated.title, outdated.detail, outdated.fix));
-				continue;
-			}
-			if (outcome.state === "unconfirmed") {
-				inspected.machines.push({
-					...known,
-					state: "key-unconfirmed",
-					fingerprint: outcome.fingerprint
-				});
-				inspected.findings.push(unconfirmedKeyFinding("device-host-machine", machine, outcome.fingerprint));
-				continue;
-			}
-			if (outcome.state === "unreachable") {
-				const failure = {
-					entry: machine,
-					port: parsed.port,
-					target,
-					reason: outcome.reason,
-					transport: outcome.transport
-				};
-				const startup = !peer && outcome.transport?.kind === "http" && outcome.transport.status === 503 ? await io.startup?.(target) : null;
-				const diagnosis = peer ? await diagnoseOutcome(io, {
-					...failure,
-					peer
-				}) : diagnoseLocalUnreachable({
-					...failure,
-					startup
-				});
-				inspected.machines.push({
-					...known,
-					state: "unreachable",
-					diagnosis
-				});
-				inspected.findings.push(diagnosisFinding("device-host-machine", machine, diagnosis));
-				continue;
-			}
-			inspected.machines.push({
-				...known,
-				state: outcome.state
-			});
-			inspected.findings.push(outcome.state === "key-changed" ? note$1(`Remote machine ${machine} answered with a different server key`, "Stim refuses to connect to a stim-server that does not prove it holds the key pinned at approval.", `If that machine or its Stim home was replaced, remove ${machine} from remote.machines, run \`stim doctor --fix\`, then add it back and run \`stim doctor --fix\` again.`) : outcome.state === "lapsed" ? note$1(`Hosting request to ${machine} lapsed`, `${machine} did not approve this machine before its setup ticket expired at ${outcome.credential.expiresAt}.`, "Run `stim doctor --fix` to make a new ticket.") : note$1(`Remote machine ${machine} no longer accepts this machine for device hosting`, `${outcome.reason} The pinned key is preserved.`, "Run `stim doctor --fix` to ask again."));
-		}
-		return inspected;
-	} finally {
-		releaseClaim(claim.acquired);
-	}
-}
-//#endregion
-//#region src/offload/build-machines.ts
-/** The `remote.machines` entries that approved this machine for builds, in that order. */
-function pairedMachines(entries = configuredMachines() ?? []) {
-	const credentials = readBuildMachines().filter((each) => each.state === "approved");
-	return entries.flatMap((entry) => credentials.filter((each) => each.machine === entry));
-}
-async function updateCredentials(change, operation) {
-	reportSignal(operation)?.throwIfAborted();
-	const dir = getConfigDir();
-	const write = () => {
-		reportSignal(operation)?.throwIfAborted();
-		const file = buildMachinesFile();
-		const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-		writeFileSync(tmp, `${JSON.stringify({
-			version: MACHINE_CREDENTIALS_VERSION,
-			machines: change(readBuildMachines())
-		}, null, 2)}\n`, { mode: 384 });
-		try {
-			renameSync(tmp, file);
-		} catch (error) {
-			rmSync(tmp, { force: true });
-			throw error;
-		}
-	};
-	const options = { ensureParent: () => mkdirSync(dir, { recursive: true }) };
-	const signal = reportSignal(operation);
-	if (signal) await withDirLockAsync(buildMachinesLock(), write, {
-		...options,
-		signal
-	});
-	else withDirLock$1(buildMachinesLock(), write, options);
-}
-function note(title, detail, fix = null) {
-	return {
-		code: "build-machine",
-		level: "note",
-		title,
-		detail,
-		fix
-	};
-}
-const PROBLEM_TITLES = {
-	unreachable: "does not answer a build offer",
-	checkout: "cannot build an app outside a git checkout",
-	"stim-build": "runs an incompatible Stim build",
-	arch: "has another CPU architecture",
-	xcode: "has another Xcode",
-	"macos-sdk": "has another macOS SDK",
-	"simulator-sdk": "has another simulator SDK",
-	cocoapods: "has no CocoaPods, or another version",
-	bundler: "has no Bundler",
-	runtime: "has no simulator for this project's iOS runtime",
-	jdk: "runs another JDK major version",
-	"android-sdk": "has no Android SDK",
-	ndk: "lacks this project's NDK",
-	"build-tools": "lacks this project's Android build-tools",
-	"compile-sdk": "lacks this project's Android compile platform",
-	disk: "is low on disk",
-	busy: "is too busy to take builds",
-	platform: "cannot build this platform"
-};
-const NOTE_TITLES = {
-	jdk: "builds Android with its own JDK",
-	ndk: "downloads this project's NDK on its first Android build",
-	"build-tools": "downloads this project's Android build-tools on its first Android build",
-	"compile-sdk": "downloads this project's Android compile platform on its first Android build"
-};
-function commandFix(problem, entry) {
-	return problem.commands?.length && problem.lead ? [`On ${entry}, ${problem.lead}:`, ...problem.commands].join("\n") : null;
-}
-function problemFix(problem, entry) {
-	const { code } = problem;
-	if (problem.followsFrom) return `Fix the ${problem.followsFrom} problem on ${entry} first; this follows from it.`;
-	switch (code) {
-		case "unreachable": return `Check that stim-server runs on ${entry} and that its tailscale serve route answers, then run \`stim doctor\` again. To keep it running there, run \`stim-server service install --serve\` on ${entry}.`;
-		case "checkout": return "Offload syncs the files git lists; run Stim from a git checkout of the app.";
-		case "stim-build": return `Update stim-server on ${entry} to a Stim release with the same build compatibility version as this machine (an older stim-server needs the same Stim build): there, run \`stim-server service update --release <version>\` for this machine's release, or \`--from <dir>\` with the packed packages of this machine's checkout.`;
-		case "arch": return "Use a remote machine with the same CPU architecture as this machine.";
-		case "xcode":
-		case "simulator-sdk":
-		case "macos-sdk": return commandFix(problem, entry) ?? `Install and select the same Xcode on ${entry} and this Mac (\`xcode-select -p\` on each).`;
-		case "cocoapods": return commandFix(problem, entry) ?? `Install the same CocoaPods version on ${entry}, on the PATH its stim-server sets. A build sent there with --remote-build ${entry} still runs; a version that differs rewrites the COCOAPODS line of a committed Podfile.lock.`;
-		case "bundler": return `Install Bundler (\`gem install bundler\`) on ${entry}, on the PATH its stim-server's login shell sets.`;
-		case "runtime": return commandFix(problem, entry) ?? `Install that iOS simulator runtime on ${entry} with at least one iPhone simulator, or set ios.runtime here to one ${entry} has.`;
-		case "jdk": return commandFix(problem, entry) ?? `Start stim-server on ${entry} with JAVA_HOME at a JDK of the same major version as this machine's.`;
-		case "android-sdk":
-		case "ndk":
-		case "build-tools":
-		case "compile-sdk": return commandFix(problem, entry) ?? `Install the missing package with sdkmanager in the Android SDK stim-server on ${entry} uses (its ANDROID_HOME, else ~/Library/Android/sdk on macOS or ~/Android/Sdk on Linux).`;
-		case "disk": return `Free space on ${entry}'s worker root (server.workerRoot there).`;
-		case "platform": return `iOS and macOS builds need a Mac; ${entry} can take Android builds only.`;
-		case "busy": return `Builds stay on this machine until ${entry} has capacity. On ${entry}, server.maxLoadPerCore sets the load it accepts and concurrency.maxBuilds how many of its own builds it runs; it takes one offloaded build at a time.`;
-	}
-}
-const TRANSIENT = /* @__PURE__ */ new Set(["unreachable", "busy"]);
-const UNPREDICTABLE = /* @__PURE__ */ new Set([
-	"unreachable",
-	"busy",
-	"disk",
-	"checkout",
-	"cocoapods"
-]);
-/** Why a build on the machine named for it cannot work, from the toolchain differences found before this machine changes the checkout. */
-function predictedRefusal(entry, problems) {
-	const known = problems.filter((problem) => !UNPREDICTABLE.has(problem.code));
-	if (known.length === 0) return null;
-	return {
-		reason: known.map((problem) => problem.reason).join("; "),
-		remedy: known.map((problem) => problemFix(problem, entry)).join("\n")
-	};
-}
-function offloadFindings(entry, problems, notes, operation) {
-	const selected = operation?.env.STIM_REMOTE_BUILD?.trim() || loadConfig$1()?.remote?.build;
-	const consequence = typeof selected === "string" && placementWord(selected) === "remote-only" ? "remote.build is remote-only, so automatic builds skip this machine and refuse rather than build on this Mac:" : "Builds fall back to this machine:";
-	return [...problems.map((problem) => ({
-		code: `build-machine-${problem.code}`,
-		level: TRANSIENT.has(problem.code) ? "note" : "cost",
-		title: `Remote machine ${entry} ${PROBLEM_TITLES[problem.code]}`,
-		detail: `${consequence} ${problem.reason}.${problem.code === "cocoapods" ? ` A build sent there with --remote-build ${entry} still runs.` : ""}`,
-		fix: problemFix(problem, entry)
-	})), ...notes.map((each) => ({
-		code: `build-machine-${each.code}`,
-		level: "note",
-		title: `Remote machine ${entry} ${NOTE_TITLES[each.code] ?? "needs a first-build download"}`,
-		detail: `The build goes there anyway: ${each.reason}.`,
-		fix: commandFix(each, entry)
-	}))];
-}
-async function inspectMachine(entry, tailnet, deviceName, fix, version, tickets, io, check, operation, confirmKey) {
-	const parsed = parseMachine$1(entry);
-	if (!parsed) return {
-		report: {
-			machine: entry,
-			state: "invalid"
-		},
-		finding: note(`Remote machine ${entry} is not a tailnet name or local: address`, "Expected `name`, `name:port`, `local:<host>` or `local:<host>:port`.")
-	};
-	const local = parsed.transport === "local";
-	if (!local && "off" in tailnet) return {
-		report: {
-			machine: entry,
-			state: "tailscale-off",
-			diagnosis: tailnet.off
-		},
-		finding: null
-	};
-	const status = "status" in tailnet ? tailnet.status : {};
-	const peer = local ? null : findPeer$1(status, parsed.name);
-	if (peer === "missing" || peer === "ambiguous") {
-		const diagnosis = notOnTailnetDiagnosis(entry, peer === "ambiguous");
-		return {
-			report: {
-				machine: entry,
-				state: "not-on-tailnet",
-				diagnosis
-			},
-			finding: diagnosisFinding("build-machine", entry, diagnosis)
-		};
-	}
-	const target = peer ? endpoint$1(peer, parsed.port) : localEndpoint(parsed.name, parsed.port);
-	const address = peer?.dnsName ?? parsed.name;
-	const credential = readBuildMachines().find((each) => each.machine === entry);
-	const other = () => {
-		try {
-			return readDeviceHostMachines().find((each) => each.machine === entry);
-		} catch {
-			return;
-		}
-	};
-	const persist = (next) => updateCredentials((credentials) => [...credentials.filter((each) => each.machine !== entry), next], operation);
-	reportSignal(operation)?.throwIfAborted();
-	const outcome = await reachMachine({
-		machine: entry,
-		access: "build",
-		endpoint: target,
-		address,
-		credential,
-		other,
-		persist,
-		fix,
-		deviceName,
-		setupFlags: cannotHost(status, entry) ? ["build"] : ["build", "device-host"],
-		serverVersion: version,
-		io,
-		tickets,
-		...local ? { confirmKey: (serverKey) => confirmKey?.(entry, serverKey) ?? Promise.resolve(false) } : {}
-	});
-	const known = {
-		machine: entry,
-		...peer ? { dnsName: peer.dnsName } : {}
-	};
-	reportSignal(operation)?.throwIfAborted();
-	if (outcome.state !== "not-asked" && outcome.credential) {
-		const next = outcome.credential;
-		if (JSON.stringify(next) !== JSON.stringify(credential)) await updateCredentials((credentials) => [...credentials.filter((each) => each.machine !== entry), next], operation);
-	}
-	const paired = {
-		...known,
-		...outcome.state !== "not-asked" && outcome.credential?.deviceId ? { deviceId: outcome.credential.deviceId } : {},
-		...outcome.state !== "not-asked" && outcome.credential ? { requestedAt: outcome.credential.requestedAt } : {}
-	};
-	switch (outcome.state) {
-		case "not-asked": return {
-			report: {
-				...known,
-				state: "not-asked"
-			},
-			finding: note(`Remote machine ${entry} has not approved this machine for builds`, "This machine has not asked it for build access.", "Run `stim doctor --fix` to make a setup ticket and print the command to run there.")
-		};
-		case "key-changed": return {
-			report: {
-				...paired,
-				state: "key-changed"
-			},
-			finding: note(`Remote machine ${entry} answered with a different server key`, `${address} did not prove it holds the stim-server key this machine pinned at approval. Stim does not connect to it.`, `If that machine or its Stim home was replaced, remove ${entry} from remote.machines, run \`stim doctor --fix\` to forget the old pairing, then add it back and run \`stim doctor --fix\` again.`)
-		};
-		case "unconfirmed": return {
-			report: {
-				...paired,
-				state: "key-unconfirmed",
-				fingerprint: outcome.fingerprint
-			},
-			finding: unconfirmedKeyFinding("build-machine", entry, outcome.fingerprint)
-		};
-		case "pending": return {
-			report: {
-				...paired,
-				state: "pending",
-				...outcome.credential.expiresAt ? { expiresAt: outcome.credential.expiresAt } : {}
-			},
-			finding: note(`Remote machine ${entry} has not approved this machine for builds yet`, `It does not hold this machine's setup ticket yet${outcome.credential.expiresAt ? `; the ticket expires at ${outcome.credential.expiresAt}` : ""}.`, setupRemedy(entry, outcome.command))
-		};
-		case "lapsed": return {
-			report: {
-				...paired,
-				state: "lapsed"
-			},
-			finding: note(`Build request to ${entry} lapsed`, `${entry} did not approve this machine before its setup ticket expired at ${outcome.credential.expiresAt}.`, "Run `stim doctor --fix` to make a new ticket.")
-		};
-		case "revoked": return {
-			report: {
-				...paired,
-				state: "revoked"
-			},
-			finding: note(`Remote machine ${entry} no longer accepts this machine for builds`, `${outcome.reason} It was revoked.`, "Run `stim doctor --fix` to ask again.")
-		};
-		case "outdated": {
-			const outdated = outdatedServer(entry, version, outcome.command);
-			const diagnosis = {
-				layer: "compat",
-				code: "server-outdated",
-				title: "Server is outdated",
-				message: outdated.detail,
-				remedy: outdated.fix
-			};
-			return {
-				report: {
-					...paired,
-					state: "outdated",
-					diagnosis
-				},
-				finding: note(outdated.title, outdated.detail, outdated.fix)
-			};
-		}
-		case "unreachable": {
-			const failure = {
-				entry,
-				port: parsed.port,
-				target,
-				reason: outcome.reason,
-				transport: outcome.transport
-			};
-			const startup = !peer && outcome.transport?.kind === "http" && outcome.transport.status === 503 ? await io.startup?.(target) : null;
-			const diagnosis = peer ? await diagnoseOutcome(io, {
-				...failure,
-				peer
-			}) : diagnoseLocalUnreachable({
-				...failure,
-				startup
-			});
-			return {
-				report: {
-					...paired,
-					state: "unreachable",
-					diagnosis
-				},
-				finding: diagnosisFinding("build-machine", entry, diagnosis)
-			};
-		}
-	}
-	const permissions = readHostPermissions(outcome.result.host);
-	const host = permissions ? { host: permissions } : {};
-	if (!check) return {
-		report: {
-			...paired,
-			state: "approved",
-			...host
-		},
-		finding: null
-	};
-	const { capacity, problems, notes = [] } = await check(outcome.credential);
-	return {
-		report: {
-			...paired,
-			state: "approved",
-			...host,
-			offloadable: problems.length === 0,
-			reasons: problems.map((problem) => problem.reason),
-			problems,
-			...notes.length ? { notes } : {},
-			...capacity ? { capacity } : {}
-		},
-		finding: null,
-		extra: offloadFindings(entry, problems, notes, operation)
-	};
-}
-/**
-* Doctor findings and a report for each `remote.machines` entry. The worker's stim-server key is pinned on first
-* contact; every later connection must prove it holds that key. With `fix`, makes a setup ticket for a named machine
-* this machine holds no pairing for, or that revoked it, and forgets pairings of machines no longer named. With
-* `check`, each approved machine is asked for one build offer and reports every reason it would not take this
-* project's build.
-*/
-async function inspectBuildMachines({ fix, check = null, version = "<version>", tickets = /* @__PURE__ */ new Map(), operation, confirmKey }, io = realIo, entries = configuredMachines()) {
-	if (entries === null) return {
-		findings: [note("Invalid remote.machines setting", "Use a remote object with machines as an array of tailnet names. Existing credentials and pinned keys are preserved.", "Run `stim guide settings` and correct the setting before running doctor again.")],
-		machines: []
-	};
-	const unnamed = (each) => !entries.includes(each.machine);
-	if (fix && readBuildMachines().some(unnamed)) await updateCredentials((credentials) => credentials.filter((each) => !unnamed(each)), operation);
-	if (entries.length === 0) return {
-		findings: [],
-		machines: []
-	};
-	const tailnet = entries.some((entry) => parseMachine$1(entry)?.transport !== "local");
-	const read = tailnet ? await io.status() : null;
-	const view = isJsonObject(read) ? { status: read } : tailnet ? { off: await diagnoseTailscale(io) } : { status: {} };
-	const inspection = {
-		findings: [],
-		machines: []
-	};
-	if ("off" in view) inspection.findings.push(note("Remote machines are unreachable", `remote.machines names remote machines. ${view.off.message}`, view.off.remedy));
-	const self = "status" in view && isJsonObject(view.status.Self) ? view.status.Self : {};
-	const deviceName = (typeof self.HostName === "string" && self.HostName ? self.HostName : hostname()).replace(/[\p{Cc}\p{Cf}]/gu, "").trim().slice(0, 64) || "Mac";
-	const inspected = await Promise.all(entries.map((entry) => inspectMachine(entry, view, deviceName, fix, version, tickets, io, check, operation, confirmKey)));
-	for (const { report, finding, extra = [] } of inspected) {
-		inspection.machines.push(report);
-		if (finding) inspection.findings.push(finding);
-		inspection.findings.push(...extra);
-	}
-	return inspection;
-}
-//#endregion
-//#region src/offload/selection.ts
-const FINGERPRINT_MISMATCH_REMEDY = "The build Mac fingerprints the synced checkout differently; the message names the sources that differ. Stim sends tracked and untracked files and the gitignored files the fingerprint reads, except under node_modules. A source still differs when the build Mac's dependency install or pod install writes it differently, or when the app config reads an environment variable or file that differs. Make that input agree on both Macs, for example by committing the lockfile pod install rewrote there, or rerun with --remote-build auto or --remote-build local.";
-/** The remedy for a React Native worker's fingerprint-mismatch reason, or undefined for any other reason. */
-function fingerprintMismatchRemedy(reason) {
-	return reason.startsWith("fingerprint-mismatch: the checkout there ") ? FINGERPRINT_MISMATCH_REMEDY : void 0;
-}
-const MISSING_PACKAGE_MANAGER = /^deps-failed: spawn (pnpm|yarn|npm) ENOENT/;
-/** The remedy for a worker whose dependency install could not start its package manager; undefined for any other reason. */
-function missingPackageManagerRemedy(machine, reason) {
-	const tool = MISSING_PACKAGE_MANAGER.exec(reason)?.[1];
-	if (!tool) return void 0;
-	return `${machine} has no ${tool} on the PATH of its stim-server service, and the app's lockfile needs it. ${tool === "npm" ? "Reinstall Node there, which ships npm" : `Install it with \`corepack enable ${tool}\` or \`npm install --global ${tool}\`, using sudo where Node is installed system-wide`}, then run the same command again, or rerun with --remote-build auto or --remote-build local.`;
-}
-const PODS_FAILED_PREFIX = "pod install failed: ";
-/** The reason a failed worker job is reported with: a `pods-failed` code reads as a failed pod install. */
-function workerFailureReason(code, message) {
-	return code === "pods-failed" ? `${PODS_FAILED_PREFIX}${String(message ?? "")}` : `${String(code ?? "failed")}: ${String(message ?? "")}`;
-}
-/** The remedy for a worker whose `pod install` failed, naming the install when it has no CocoaPods; undefined for any other reason. */
-function podsFailedRemedy(machine, reason, localCocoapods) {
-	if (!reason.startsWith(PODS_FAILED_PREFIX)) return void 0;
-	const retry = "run the same command again, or rerun with --remote-build auto or --remote-build local";
-	if (!reason.includes("CocoaPods is not installed: no `pod` executable on PATH.")) return `Fix the pod install error on ${machine} (run pod install in its checkout under server.workerRoot there to see all of it), then ${retry}.`;
-	const { lead, commands } = cocoapodsInstall(localCocoapods);
-	return [
-		`On ${machine}, ${lead}:`,
-		...commands,
-		`Then ${retry}.`
-	].join("\n");
-}
-var OffloadRefusal = class extends Error {
-	code = "STIM_OFFLOAD_REFUSED";
-	remedy;
-	constructor(machine, reason, remedy = "Run stim doctor --fix to ask for build access if not paired; it prints the stim-server setup command a person runs on the worker to approve this machine. Check stim settings get remote.machines, or rerun with --remote-build auto, remote or local.") {
-		super(reason.startsWith(`${machine}: `) ? reason : `${machine}: ${reason}`);
-		this.remedy = remedy;
-	}
-};
-function resolveBuildMachine(flag, env, setting) {
-	const selected = flag ?? (env?.trim() || void 0) ?? setting ?? "auto";
-	if (typeof selected !== "string" || !selected.trim() || !parseMachine(selected)) throw Object.assign(/* @__PURE__ */ new Error("--remote-build / remote.build must be local, auto, remote, remote-only, or a tailnet machine name."), { code: "STIM_BAD_ARG" });
-	return placementWord(selected) ?? selected.trim();
-}
-function parseBuildMachineOption(value) {
-	try {
-		return resolveBuildMachine(value);
-	} catch (error) {
-		throw new InvalidArgumentError(error.message);
-	}
-}
-function automaticBuild(selected) {
-	const word = placementWord(selected);
-	return word !== null && word !== "local";
-}
-function requireLocalBuild(selected, reason) {
-	const word = placementWord(selected);
-	const lead = reason ? `${reason}; ` : "";
-	if (word === "remote-only") throw new OffloadRefusal(selected, `${lead}remote-only never builds on this machine`);
-	if ((word === "auto" || word === "remote") && !automaticMachineEnabled("build", "local")) throw new OffloadRefusal(selected, `${lead}local is disabled in remote.buildPoolDisabled; enable it or select a machine explicitly`);
-}
-function namedBuildMachine(selected) {
-	return placementWord(selected) === null;
-}
-function requireConfiguredMachine(selected, machines) {
-	if (!namedBuildMachine(selected)) return selected;
-	const parsed = parseMachine(selected);
-	const entries = Array.isArray(machines) ? machines.filter((entry) => typeof entry === "string") : [];
-	const match = entries.find((entry) => {
-		const candidate = parseMachine(entry);
-		return candidate?.transport === parsed.transport && candidate.name === parsed.name && candidate.port === parsed.port;
-	});
-	if (!match) throw new OffloadRefusal(selected, `not listed in remote.machines (configured: ${entries.join(", ") || "none"})`);
-	return match;
-}
-const settingSource = (flag, env, setting) => flag !== void 0 ? "flag" : env?.trim() ? "env" : setting !== void 0 ? "setting" : "default";
-/** The settings that decide where a build runs, with the layer each value came from, for this run's `--remote-build`. */
-function buildPlacementSettings(selected) {
-	const flag = operationState(ambientContext()).buildMachineFlag;
-	return [{
-		key: "remote.build",
-		value: selected,
-		from: settingSource(flag, ambientEnv().STIM_REMOTE_BUILD, loadConfig$1()?.remote?.build)
-	}];
-}
-function resolveBuildPlacement(flag) {
-	const remote = loadConfig$1()?.remote;
-	operationState(ambientContext()).buildMachineFlag = flag;
-	let selected = "auto";
-	try {
-		selected = resolveBuildMachine(flag, ambientEnv().STIM_REMOTE_BUILD, remote?.build);
-		selected = requireConfiguredMachine(selected, remote?.machines);
-		if (namedBuildMachine(selected) && pairedMachines([selected]).length === 0) throw new OffloadRefusal(selected, "no remote machine is paired");
-		return { selected };
-	} catch (error) {
-		return {
-			selected,
-			failure: {
-				code: error.code,
-				message: error.message,
-				remedy: error instanceof OffloadRefusal ? error.remedy : "Pass --remote-build local, auto, remote, remote-only, or an entry from stim settings get remote.machines."
-			}
-		};
-	}
-}
-//#endregion
-export { hostingMachines as _, missingPackageManagerRemedy as a, podsFailedRemedy as c, resolveBuildPlacement as d, workerFailureReason as f, configuredMachines as g, predictedRefusal as h, fingerprintMismatchRemedy as i, requireLocalBuild as l, pairedMachines as m, automaticBuild as n, namedBuildMachine as o, inspectBuildMachines as p, buildPlacementSettings as r, parseBuildMachineOption as s, OffloadRefusal as t, resolveBuildMachine as u, inspectDeviceHostMachines as v };