stim 1.8.0 → 1.10.0

package/dist/{device-remote-ByN8P6CB.mjs → device-remote-Dy1jGj3U.mjs}

@@ -1,16 +1,538 @@
-import { t as getExecutor } from "./exec-B29XNuhP.mjs";
-import { D as withDirLock, u as getConfigDir } from "./config-B7iyKWkL.mjs";
-import { _ as workspaceLogsDir, h as workspaceDir, v as workspaceName, y as workspaceStateFile } from "./workspace-state-BT5E3SA2.mjs";
-import { a as clearRemoteSession, l as readRemoteSession, s as readMetroTunnel } from "./state-DZobzxLW.mjs";
-import { i as pidExists } from "./metro-C7bcJ0uo.mjs";
-import { z as planMetroReach } from "./settings-BXXorVM2.mjs";
-import { t as withWorkspaceProcessLock } from "./workspace-process-lock-BYfZz_S-.mjs";
-import { T as readMetroRecords, a as LAUNCH_ERROR, b as isBundleProof, p as devClientDeepLink, r as INSTALL_ERROR } from "./app-install-BDbsSgCl.mjs";
-import { S as sanitizeDeviceLabel } from "./ios-BcCiI4TS.mjs";
-import { t as probePublicHttp } from "./public-http-probe-CyMDrQ3c.mjs";
+import { u as getConfigDir } from "./config-BEq0Qw_a.mjs";
+import { t as getExecutor } from "./exec-DK8KaVHK.mjs";
+import { r as createNdjsonWriter } from "./ndjson-CDY9IkVC.mjs";
+import { N as workspaceStateFile, O as workspaceDir, P as withDirLock, i as pidExists, j as workspaceLogsDir, k as workspaceId } from "./metro-BWLOJ_Wr.mjs";
+import { c as ownedDeviceLabel, u as resolvePackageJson } from "./project-BXZzOABt.mjs";
+import { a as clearRemoteSession, l as readRemoteSession, s as readMetroTunnel } from "./state-WGdIbi_d.mjs";
+import { t as withWorkspaceProcessLock } from "./workspace-process-lock-BXA96myD.mjs";
+import { n as stripAnsi } from "./process-output-Fpl8PYi8.mjs";
+import { B as planMetroReach } from "./settings-DOugPlPz.mjs";
+import { u as probePublicHttp } from "./ownership-DZjdx8Gq.mjs";
+import { C as sanitizeDeviceLabel } from "./ios-B2Fpqvlb.mjs";
+import { n as expoBinFromPackage, r as expoBinPath, s as findBinUpward } from "./server-expo-BvOCeakp.mjs";
+import { a as LAUNCH_ERROR, i as INSTALL_ERROR, l as devClientDeepLink } from "./app-install-CrJ6t_bv.mjs";
+import { c as readMetroRecords, o as isBundleProof } from "./launch-verify-CQS_Kg-C.mjs";
+import { t as compareStimVersions } from "./stim-installations-CINXy_su.mjs";
+import { createRequire } from "node:module";
 import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { homedir } from "node:os";
+import { easMachineStateRoot, easMachineStateRoot as easMachineStateRoot$1, easSessionLedgerFile, easSessionLedgerLock, readEasSessionLedger, readEasSessionLedger as readEasSessionLedger$1, readJsonObject, validEasSessionClaim } from "@stim-cli/core/state";
+import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { format } from "node:util";
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/engine/remote-cache.ts
+const EAS_PROVIDER_PACKAGE = "eas-build-cache-provider";
+const RESOLVE_TIMEOUT_MS = 3e4;
+const UPLOAD_TIMEOUT_MS = 6e4;
+const CONFIG_TIMEOUT_MS = 3e4;
+const DYNAMIC_CONFIG_FILES = [
+	"app.config.ts",
+	"app.config.js",
+	"app.config.mjs",
+	"app.config.cjs"
+];
+const TIMED_OUT = Symbol("timed-out");
+function dynamicConfigFile(root) {
+	for (const name of DYNAMIC_CONFIG_FILES) if (existsSync(join(root, name))) return name;
+	return null;
+}
+function providerFromConfig(config) {
+	if (!config || typeof config !== "object") return null;
+	const expoField = config.expo;
+	const exp = expoField && typeof expoField === "object" ? expoField : config;
+	return exp.buildCacheProvider ?? exp.experiments?.buildCacheProvider ?? null;
+}
+function ownerFromConfig(config) {
+	if (!config || typeof config !== "object") return null;
+	const expoField = config.expo;
+	const owner = (expoField && typeof expoField === "object" ? expoField : config).owner;
+	return typeof owner === "string" && owner.trim() !== "" ? owner.trim() : null;
+}
+function normalizeProvider(raw) {
+	if (raw === null || raw === void 0 || raw === "") return null;
+	if (raw === "eas") return {
+		name: "eas",
+		reference: EAS_PROVIDER_PACKAGE,
+		options: {}
+	};
+	if (typeof raw === "object") {
+		const obj = raw;
+		if (typeof obj.plugin === "string" && obj.plugin.trim() !== "") {
+			const reference = obj.plugin.trim();
+			return {
+				name: reference,
+				reference,
+				options: obj.options && typeof obj.options === "object" ? obj.options : {}
+			};
+		}
+	}
+	return { invalid: typeof raw === "string" ? `"${raw}"` : JSON.stringify(raw) };
+}
+function runOptionsFor(platform) {
+	return platform === "android" ? { variant: "debug" } : { configuration: "Debug" };
+}
+function isProviderPlugin(plugin) {
+	if (!plugin || typeof plugin !== "object") return false;
+	const p = plugin;
+	const resolves = typeof p.resolveBuildCache === "function" || typeof p.resolveRemoteBuildCache === "function";
+	const uploads = typeof p.uploadBuildCache === "function" || typeof p.uploadRemoteBuildCache === "function";
+	return resolves && uploads;
+}
+function cacheLevel(value) {
+	return value === "local" || value === "remote" ? value : false;
+}
+function exitAfterFlush(code = 0, { exit = (c) => process.exit(c), stream = process.stdout } = {}) {
+	try {
+		stream.write("", () => exit(code));
+	} catch {
+		exit(code);
+	}
+}
+function readProjectConfig(root, { run = null, timeoutMs = CONFIG_TIMEOUT_MS } = {}) {
+	const dynamic = dynamicConfigFile(root);
+	if (!dynamic) {
+		const file = join(root, "app.json");
+		if (!existsSync(file)) return {
+			config: null,
+			source: null
+		};
+		try {
+			return {
+				config: JSON.parse(readFileSync(file, "utf-8")),
+				source: "app.json"
+			};
+		} catch (err) {
+			return { unavailable: `app.json could not be parsed: ${firstLine(err)}` };
+		}
+	}
+	const bin = expoBinPath(root);
+	if (!bin) return { unavailable: `${dynamic} is code, so it has to be evaluated to read its buildCacheProvider, and the \`expo\` package is not resolvable from this project (no expo/package.json to read a bin from, and no node_modules/.bin/expo here or in any parent)` };
+	const exec = run || ((file, args, opts) => getExecutor().runFile(file, args, opts));
+	let stdout;
+	try {
+		stdout = exec(bin, [
+			"config",
+			"--json",
+			root
+		], { timeoutMs });
+	} catch (err) {
+		return { unavailable: `\`expo config --json\` failed: ${firstLine(err)}` };
+	}
+	try {
+		return {
+			config: JSON.parse(String(stdout)),
+			source: dynamic
+		};
+	} catch (err) {
+		return { unavailable: `\`expo config --json\` did not print JSON: ${firstLine(err)}` };
+	}
+}
+async function loadPlugin(projectRoot, reference, { requireFrom = null } = {}) {
+	const localRequire = requireFrom ? requireFrom(projectRoot) : createRequire(join(projectRoot, "package.json"));
+	const file = localRequire.resolve(reference);
+	let mod;
+	try {
+		mod = localRequire(file);
+	} catch (err) {
+		if (err?.code !== "ERR_REQUIRE_ESM") throw err;
+		mod = await import(pathToFileURL(file).href);
+	}
+	const plugin = mod?.default ?? mod;
+	if (!isProviderPlugin(plugin)) throw new Error(`"${reference}" does not export resolveBuildCache and uploadBuildCache functions`);
+	return plugin;
+}
+async function loadProjectProvider(projectRoot, { isExpo = true, run = null, requireFrom = null, timeoutMs = CONFIG_TIMEOUT_MS } = {}) {
+	if (!isExpo) return { none: true };
+	const read = readProjectConfig(projectRoot, {
+		run,
+		timeoutMs
+	});
+	if (read.unavailable) return { unavailable: read.unavailable };
+	const normalized = normalizeProvider(providerFromConfig(read.config));
+	if (!normalized) return { none: true };
+	if (normalized.invalid) return { unavailable: `buildCacheProvider is ${normalized.invalid}, which is not "eas" or { plugin: <module> }` };
+	if (normalized.reference === "@stim-cli/expo-build-cache") return { none: true };
+	let plugin;
+	try {
+		plugin = await loadPlugin(projectRoot, normalized.reference, { requireFrom });
+	} catch (err) {
+		const missing = err?.code === "MODULE_NOT_FOUND";
+		return { unavailable: normalized.name === "eas" && missing ? `the EAS build cache needs the \`${EAS_PROVIDER_PACKAGE}\` package, which is not installed in this project` : `${normalized.name} could not be loaded: ${firstLine(err)}` };
+	}
+	return {
+		provider: {
+			plugin,
+			options: normalized.options ?? {}
+		},
+		name: normalized.name,
+		owner: ownerFromConfig(read.config)
+	};
+}
+const WHOAMI_TIMEOUT_MS = 15e3;
+const EAS_CLI_PACKAGE = "eas-cli";
+const EAS_CLI_BIN = "eas";
+function parseWhoami({ stdout = "", stderr = "", exitCode = 0 } = {}) {
+	const out = stripAnsi(stdout);
+	const combined = `${out}\n${stripAnsi(stderr)}`;
+	if (/^\s*Not logged in\s*$/m.test(combined)) return { loggedOut: true };
+	if (exitCode !== 0) return { unknown: firstLine(combined.trim() || `eas whoami exited ${exitCode}`) };
+	const lines = out.split("\n").map((line) => line.trim()).filter((line) => line !== "");
+	if (lines.length === 0) return { unknown: "eas whoami printed nothing" };
+	const raw = lines[0];
+	if (raw === void 0) return { unknown: "eas whoami printed nothing" };
+	const viaToken = /\(authenticated using EXPO_TOKEN\)\s*$/.test(raw);
+	const display = raw.replace(/\s*\(authenticated using EXPO_TOKEN\)\s*$/, "").trim();
+	const accounts = [];
+	for (const line of lines) {
+		const name = /^\u2022\s*(\S+)\s*\(Role:/.exec(line)?.[1];
+		if (name !== void 0) accounts.push(name);
+	}
+	if (accounts.length === 0 && !display.endsWith("(robot)") && display !== "robot") accounts.push(display);
+	return {
+		loggedIn: true,
+		account: display,
+		accounts: accounts.length ? accounts : null,
+		viaToken
+	};
+}
+function isEasAuthFailureText(text) {
+	const t = stripAnsi(text || "");
+	if (t.trim() === "") return false;
+	return /not logged in/i.test(t) || /\beas login\b/i.test(t) || /EXPO_TOKEN/.test(t) || /unauthorized/i.test(t) || /not authorized/i.test(t) || /authentication (failed|required)/i.test(t);
+}
+function easAuthNote(status) {
+	const { code, account, owner, reason, phase = "resolve" } = status || {};
+	const because = reason ? ` (${reason})` : "";
+	if (code === "logged-out") return `eas is not authenticated${because} -- run \`eas login\` (or set EXPO_TOKEN); ` + (phase === "upload" ? "this build stayed in the local cache" : "building with the local cache only");
+	if (code === "wrong-account") return `eas is authenticated as ${account}, and this project's owner is ${owner} -- run \`eas login\` as a member of ${owner} (or set EXPO_TOKEN); consulting the EAS cache anyway`;
+	return null;
+}
+function resolveEasCliBin(projectRoot, { lookupPath = null } = {}) {
+	const fromPackage = expoBinFromPackage(resolvePackageJson(projectRoot, EAS_CLI_PACKAGE), EAS_CLI_BIN);
+	if (fromPackage) return {
+		file: fromPackage,
+		source: "project"
+	};
+	const shim = findBinUpward(projectRoot, EAS_CLI_BIN);
+	if (shim) return {
+		file: shim,
+		source: "project"
+	};
+	const onPath = lookupPath ? lookupPath() : getExecutor().findExecutable(EAS_CLI_BIN);
+	const file = (String(onPath || "").split("\n")[0] ?? "").trim();
+	return file ? {
+		file,
+		source: "path"
+	} : null;
+}
+const easAuthCache = /* @__PURE__ */ new Map();
+function checkEasAuth({ projectRoot, owner = null, run = null, resolveBin = null, timeoutMs = WHOAMI_TIMEOUT_MS, cache = easAuthCache }) {
+	const key = `${projectRoot}::${owner || ""}`;
+	if (cache?.has(key)) return cache.get(key);
+	const answer = probeEasAuth({
+		projectRoot,
+		owner,
+		run,
+		resolveBin,
+		timeoutMs
+	});
+	cache?.set(key, answer);
+	return answer;
+}
+function probeEasAuth({ projectRoot, owner, run, resolveBin, timeoutMs }) {
+	const bin = (resolveBin || resolveEasCliBin)(projectRoot);
+	if (!bin) return {
+		failed: true,
+		code: "no-cli",
+		reason: "no `eas` executable is resolvable from this project or on PATH",
+		remedy: "Install eas-cli (`npm i -g eas-cli`, or as a project devDependency), then run `eas login`."
+	};
+	const exec = run || ((file, args, opts) => getExecutor().runFile(file, args, opts));
+	let result;
+	try {
+		result = {
+			stdout: String(exec(bin.file, ["whoami"], { timeoutMs }) ?? ""),
+			exitCode: 0
+		};
+	} catch (e) {
+		const err = e;
+		if (err?.code === "ETIMEDOUT" || err?.signal === "SIGTERM" || err?.killed) return { unknown: `eas whoami timed out after ${timeoutMs}ms` };
+		result = {
+			stdout: String(err?.stdout ?? ""),
+			stderr: String(err?.stderr ?? err?.message ?? ""),
+			exitCode: typeof err?.status === "number" ? err.status : 1
+		};
+	}
+	const parsed = parseWhoami(result);
+	if (parsed.loggedOut) return {
+		failed: true,
+		code: "logged-out",
+		reason: "eas whoami says \"Not logged in\"",
+		remedy: "Run `eas login` (or set EXPO_TOKEN)."
+	};
+	if (parsed.unknown) return { unknown: parsed.unknown };
+	if (owner && Array.isArray(parsed.accounts) && !parsed.accounts.includes(owner)) return {
+		failed: true,
+		code: "wrong-account",
+		account: parsed.account,
+		accounts: parsed.accounts,
+		owner,
+		reason: `eas is authenticated as ${parsed.account} (accounts: ${parsed.accounts.join(", ")}), which does not include this project's owner ${owner}`,
+		remedy: `Run \`eas login\` as a member of ${owner}, or set EXPO_TOKEN to a token for it.`
+	};
+	return {
+		ok: true,
+		account: parsed.account,
+		accounts: parsed.accounts,
+		viaToken: parsed.viaToken,
+		source: bin.source
+	};
+}
+const capturing = [];
+const abandoned = /* @__PURE__ */ new Set();
+let patched = null;
+const PROVIDER_CONTEXT = new AsyncLocalStorage();
+function uploadDestination(lines) {
+	const text = (lines || []).map(stripAnsi);
+	for (const line of text) {
+		const url = /(https?:\/\/[^\s'"]+)/.exec(line)?.[1];
+		if (url !== void 0) return url.replace(/[.,)\]]+$/, "");
+	}
+	for (const line of text) {
+		const slug = /\bto\s+(@?[\w.-]+\/[\w.-]+)/i.exec(line)?.[1];
+		if (slug !== void 0) return slug.replace(/[.,)\]]+$/, "");
+	}
+	return null;
+}
+function providerNote(text) {
+	return `${"cache".padEnd(11)} ${text}`;
+}
+function currentFrame() {
+	const store = PROVIDER_CONTEXT.getStore();
+	return store && (capturing.includes(store) || abandoned.has(store)) ? store : null;
+}
+function install() {
+	if (patched && process.stdout.write === patched.patchedWrite) return;
+	const stdout = process.stdout;
+	const write = stdout.write.bind(stdout);
+	const log = console.log;
+	const passthrough = write;
+	const patchedWrite = ((chunk, encoding, callback) => {
+		const frame = currentFrame();
+		if (!frame) return passthrough(chunk, encoding, callback);
+		const cb = typeof encoding === "function" ? encoding : callback;
+		absorb(frame, typeof chunk === "string" ? chunk : String(chunk));
+		if (typeof cb === "function") cb();
+		return true;
+	});
+	const patchedLog = (...args) => {
+		const frame = currentFrame();
+		if (!frame) return log(...args);
+		absorb(frame, `${format(...args)}\n`);
+	};
+	stdout.write = patchedWrite;
+	console.log = patchedLog;
+	patched = {
+		stdout,
+		write,
+		log,
+		patchedWrite,
+		patchedLog
+	};
+}
+function uninstall() {
+	if (!patched || capturing.length || abandoned.size) return;
+	if (patched.stdout.write === patched.patchedWrite) patched.stdout.write = patched.write;
+	if (console.log === patched.patchedLog) console.log = patched.log;
+	patched = null;
+}
+function absorb(frame, chunk) {
+	try {
+		process.stderr.write(chunk);
+	} catch {}
+	frame.pending += chunk;
+	let index = frame.pending.indexOf("\n");
+	while (index !== -1) {
+		emitLine(frame, frame.pending.slice(0, index));
+		frame.pending = frame.pending.slice(index + 1);
+		index = frame.pending.indexOf("\n");
+	}
+}
+function emitLine(frame, raw) {
+	const line = stripAnsi(raw).trim();
+	if (line === "") return;
+	frame.lines.push(line);
+	const writer = frame.writer();
+	try {
+		writer?.write({
+			src: "build",
+			level: "debug",
+			event: "provider",
+			msg: line
+		});
+	} catch {}
+	frame.onLine?.(line);
+}
+function beginCapture({ logWriter = null, projectRoot = null, platform = null, onLine = null } = {}) {
+	let own = null;
+	const frame = {
+		lines: [],
+		pending: "",
+		onLine,
+		writer: () => {
+			if (logWriter) return logWriter;
+			if (own) return own;
+			if (!projectRoot || !platform) return null;
+			own = createNdjsonWriter(join(workspaceLogsDir(projectRoot), `build-${platform}.ndjson`));
+			return own;
+		},
+		close: () => {
+			own?.close?.();
+			own = null;
+		}
+	};
+	capturing.push(frame);
+	install();
+	return frame;
+}
+function endCapture(frame) {
+	if (!frame) return;
+	const at = capturing.lastIndexOf(frame);
+	if (at !== -1) capturing.splice(at, 1);
+	abandoned.delete(frame);
+	if (frame.pending !== "") {
+		const rest = frame.pending;
+		frame.pending = "";
+		emitLine(frame, rest);
+	}
+	frame.close();
+	uninstall();
+}
+function abandonCapture(frame, work) {
+	if (!frame) return;
+	const at = capturing.lastIndexOf(frame);
+	if (at !== -1) capturing.splice(at, 1);
+	abandoned.add(frame);
+	Promise.resolve(work).then(() => endCapture(frame), () => endCapture(frame));
+}
+async function resolveRemote({ provider, platform, projectRoot, fingerprintHash, runOptions = null, timeoutMs = RESOLVE_TIMEOUT_MS, logWriter = null } = {}) {
+	if (!provider?.plugin || !fingerprintHash) return null;
+	const opts = runOptions || runOptionsFor(platform);
+	const outcome = await withBudget(async () => {
+		const props = {
+			fingerprintHash: await providerFingerprint({
+				provider,
+				platform,
+				projectRoot,
+				runOptions: opts
+			}) ?? fingerprintHash,
+			platform,
+			runOptions: opts,
+			projectRoot
+		};
+		return typeof provider.plugin.resolveBuildCache === "function" ? provider.plugin.resolveBuildCache(props, provider.options) : provider.plugin.resolveRemoteBuildCache(props, provider.options);
+	}, timeoutMs, {
+		logWriter,
+		projectRoot,
+		platform
+	});
+	if (outcome.timedOut) return { timedOut: true };
+	if (outcome.error) return { failed: firstLine(outcome.error) };
+	const appPath = typeof outcome.value === "string" ? outcome.value.trim() : "";
+	if (!appPath) return null;
+	if (!existsSync(appPath)) return { failed: `returned ${appPath}, which does not exist` };
+	return { appPath };
+}
+async function uploadRemote({ provider, platform, projectRoot, fingerprintHash, buildPath, runOptions = null, timeoutMs = UPLOAD_TIMEOUT_MS, logWriter = null, note = (line) => console.error(line) } = {}) {
+	if (!provider?.plugin || !fingerprintHash || !buildPath) return { skipped: true };
+	const opts = runOptions || runOptionsFor(platform);
+	let announced = false;
+	const onLine = (line) => {
+		if (announced) return;
+		const dest = uploadDestination([line]);
+		if (!dest) return;
+		announced = true;
+		note(providerNote(`uploading to ${dest}`));
+	};
+	const outcome = await withBudget(async () => {
+		const props = {
+			projectRoot,
+			platform,
+			fingerprintHash: await providerFingerprint({
+				provider,
+				platform,
+				projectRoot,
+				runOptions: opts
+			}) ?? fingerprintHash,
+			buildPath,
+			runOptions: opts
+		};
+		return typeof provider.plugin.uploadBuildCache === "function" ? provider.plugin.uploadBuildCache(props, provider.options) : provider.plugin.uploadRemoteBuildCache(props, provider.options);
+	}, timeoutMs, {
+		logWriter,
+		projectRoot,
+		platform,
+		onLine
+	});
+	if (outcome.timedOut) return { timedOut: true };
+	if (outcome.error) return { failed: firstLine(outcome.error) };
+	if (typeof outcome.value !== "string" || outcome.value.trim() === "") {
+		const authLine = outcome.lines.find((line) => isEasAuthFailureText(line));
+		return { failed: authLine ? firstLine(authLine) : "the provider returned no upload destination" };
+	}
+	const destination = uploadDestination(outcome.lines);
+	return destination ? {
+		uploaded: true,
+		destination
+	} : { uploaded: true };
+}
+async function providerFingerprint({ provider, platform, projectRoot, runOptions }) {
+	if (typeof provider.plugin.calculateFingerprintHash !== "function") return null;
+	try {
+		const hash = await provider.plugin.calculateFingerprintHash({
+			projectRoot,
+			platform,
+			runOptions
+		}, provider.options);
+		return typeof hash === "string" && hash.trim() !== "" ? hash.trim() : null;
+	} catch {
+		return null;
+	}
+}
+async function withBudget(factory, ms, capture) {
+	let timer = null;
+	const timeout = new Promise((resolve) => {
+		timer = setTimeout(() => resolve(TIMED_OUT), ms);
+		timer?.unref?.();
+	});
+	const frame = beginCapture(capture || {});
+	const work = Promise.resolve().then(() => PROVIDER_CONTEXT.run(frame, factory)).then((value) => ({ value }), (error) => ({ error }));
+	try {
+		const settled = await Promise.race([work, timeout]);
+		if (settled === TIMED_OUT) {
+			abandonCapture(frame, work);
+			return {
+				timedOut: true,
+				lines: frame.lines
+			};
+		}
+		endCapture(frame);
+		return {
+			...settled,
+			lines: frame.lines
+		};
+	} catch (err) {
+		endCapture(frame);
+		throw err;
+	} finally {
+		if (timer) clearTimeout(timer);
+	}
+}
+function firstLine(err) {
+	const line = (String(err?.message || err || "unknown error").trim().split("\n")[0] ?? "").trim();
+	return line.length > 200 ? `${line.slice(0, 197)}...` : line;
+}
+//#endregion
 //#region src/engine/metro-gate.ts
 const REMOTE_METRO_WRONG = "STIM_REMOTE_METRO_WRONG";
 const GATE_TIMEOUT_MS = 25e3;
@@ -81,7 +603,11 @@ function remoteProfile({ daemon, platform, label }) {
 		session: scope,
 		tenant: scope,
 		runId: scope,
-		sessionIsolation: "tenant"
+		sessionIsolation: "tenant",
+		...platform === "android" ? {
+			leaseProvider: "proxy",
+			clientId: scope
+		} : {}
 	};
 }
 function daemonEnv(daemon) {
@@ -144,6 +670,18 @@ const LIVE_STATUSES$1 = ["new", "in-progress"];
 const LIVE_SESSION_STATUSES = /* @__PURE__ */ new Set(["NEW", "IN_PROGRESS"]);
 const TERMINAL_SESSION_STATUSES = /* @__PURE__ */ new Set(["STOPPED", "ERRORED"]);
 const SESSION_PLATFORMS = /* @__PURE__ */ new Set(["ios", "android"]);
+const MIN_EAS_CLI_SIMULATOR_VERSION = "21.6.0";
+function easCliUpgradeRemedy(minimum) {
+	return `Upgrade eas-cli to ${minimum} or later (\`npm install --global eas-cli@latest\`, or the project's eas-cli dependency)`;
+}
+function easCliSupport(versionOutput, minimum) {
+	const version = /\beas-cli\/(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)/.exec(versionOutput ?? "")?.[1] ?? null;
+	const order = version ? compareStimVersions(version, minimum) : null;
+	return {
+		supported: order !== null && order >= 0,
+		version
+	};
+}
 function ownedSessionName(label) {
 	const clean = sanitizeDeviceLabel(label);
 	return `${OWNED_PREFIX}${clean.startsWith(OWNED_PREFIX) ? clean.slice(5) : clean}`;
@@ -413,80 +951,14 @@ function parseStoppedSession(stdout) {
 	};
 }
 //#endregion
+//#region src/engine/eas-machine-root-guard-env.ts
+const EAS_TEST_GUARD_ROOT_ENV = "STIM_TEST_GUARD_REAL_EAS_ROOT";
+//#endregion
 //#region src/engine/eas-session-ledger.ts
-function easMachineStateRoot() {
-	return join(homedir(), ".stim", "machine", "eas");
-}
-function easSessionLedgerFile(root = easMachineStateRoot()) {
-	return join(root, "sessions.json");
-}
-function validClaim(id, value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-	const claim = value;
-	if (claim.sessionId !== id) return null;
-	if (typeof claim.name !== "string" || !claim.name.startsWith("stim-")) return null;
-	if (claim.platform !== "ios" && claim.platform !== "android") return null;
-	if (typeof claim.workspaceRoot !== "string" || !isAbsolute(claim.workspaceRoot)) return null;
-	if (typeof claim.workspaceHome !== "string" || !isAbsolute(claim.workspaceHome)) return null;
-	if (typeof claim.stateFile !== "string" || !isAbsolute(claim.stateFile)) return null;
-	const workspaceRoot = resolve(claim.workspaceRoot);
-	const workspaceHome = resolve(claim.workspaceHome);
-	const stateFile = resolve(claim.stateFile);
-	const stateRelative = relative(workspaceHome, stateFile);
-	if (!stateRelative || stateRelative.startsWith("..") || isAbsolute(stateRelative)) return null;
-	if (stateFile !== join(workspaceHome, "workspaces", workspaceName(workspaceRoot), "state.json")) return null;
-	return {
-		sessionId: id,
-		name: claim.name,
-		platform: claim.platform,
-		workspaceRoot,
-		workspaceHome,
-		stateFile
-	};
-}
-function readEasSessionLedger(root = easMachineStateRoot()) {
-	const file = easSessionLedgerFile(root);
-	if (!existsSync(file)) return {
-		claims: /* @__PURE__ */ new Map(),
-		notice: null,
-		safe: true
-	};
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(file, "utf-8"));
-	} catch (error) {
-		return {
-			claims: /* @__PURE__ */ new Map(),
-			notice: `EAS ownership ledger ${file} is unreadable: ${error.message}`,
-			safe: false
-		};
-	}
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return {
-		claims: /* @__PURE__ */ new Map(),
-		notice: `EAS ownership ledger ${file} is malformed.`,
-		safe: false
-	};
-	const ledger = parsed;
-	if (ledger.version !== 1 || !ledger.claims || typeof ledger.claims !== "object" || Array.isArray(ledger.claims)) return {
-		claims: /* @__PURE__ */ new Map(),
-		notice: `EAS ownership ledger ${file} is malformed.`,
-		safe: false
-	};
-	const claims = /* @__PURE__ */ new Map();
-	for (const [id, value] of Object.entries(ledger.claims)) {
-		const claim = validClaim(id, value);
-		if (!claim) return {
-			claims: /* @__PURE__ */ new Map(),
-			notice: `EAS ownership ledger ${file} is malformed.`,
-			safe: false
-		};
-		claims.set(id, claim);
-	}
-	return {
-		claims,
-		notice: null,
-		safe: true
-	};
+function assertEasMachineRootWritable(root) {
+	const guardedRoot = process.env[EAS_TEST_GUARD_ROOT_ENV];
+	if (!guardedRoot || resolve(root) !== resolve(guardedRoot)) return;
+	throw new Error(`Refusing to write the real EAS machine root ${root} from a test process. Pass a temporary ledgerRoot, machineRoot, or easLedgerRoot, or point HOME (and USERPROFILE on Windows) at a temporary directory.`);
 }
 function writeLedger(root, ledger) {
 	mkdirSync(root, { recursive: true });
@@ -501,9 +973,10 @@ function writeLedger(root, ledger) {
 	}
 }
 function recordEasSessionClaim(claim, root = easMachineStateRoot()) {
-	const normalized = validClaim(claim.sessionId, claim);
+	assertEasMachineRootWritable(root);
+	const normalized = validEasSessionClaim(claim.sessionId, claim);
 	if (!normalized) throw new Error(`Invalid EAS session claim for ${claim.sessionId}.`);
-	withDirLock(join(root, "ledger.lock"), () => {
+	withDirLock(easSessionLedgerLock(root), () => {
 		const current = readEasSessionLedger(root);
 		if (!current.safe) throw new Error(current.notice ?? "EAS ownership ledger is unreadable.");
 		current.claims.set(normalized.sessionId, normalized);
@@ -511,12 +984,13 @@ function recordEasSessionClaim(claim, root = easMachineStateRoot()) {
 			version: 1,
 			claims: Object.fromEntries(current.claims)
 		});
-	}, { ensureParent: () => mkdirSync(dirname(join(root, "ledger.lock")), { recursive: true }) });
+	}, { ensureParent: () => mkdirSync(dirname(easSessionLedgerLock(root)), { recursive: true }) });
 }
 function removeEasSessionClaim(sessionId, root = easMachineStateRoot()) {
 	const file = easSessionLedgerFile(root);
 	if (!existsSync(file)) return false;
-	return withDirLock(join(root, "ledger.lock"), () => {
+	assertEasMachineRootWritable(root);
+	return withDirLock(easSessionLedgerLock(root), () => {
 		const current = readEasSessionLedger(root);
 		if (!current.safe) return false;
 		if (!current.claims.delete(sessionId)) return false;
@@ -531,7 +1005,8 @@ function removeEasSessionClaim(sessionId, root = easMachineStateRoot()) {
 //#region src/engine/eas-project-lock.ts
 const EAS_PROJECT_LOCK_WAIT_MS = 24e4;
 function withEasProjectLock(_root, fn, options = {}) {
-	const { machineRoot = easMachineStateRoot(), ...lockOptions } = options;
+	const { machineRoot = easMachineStateRoot$1(), ...lockOptions } = options;
+	assertEasMachineRootWritable(machineRoot);
 	return withWorkspaceProcessLock(machineRoot, "eas-project", fn, {
 		waitMs: EAS_PROJECT_LOCK_WAIT_MS,
 		...lockOptions,
@@ -559,7 +1034,9 @@ function resolveMetroOrigin({ metroPort, publicUrl = null, mode = "auto", isExpo
 }
 function describe(err) {
 	const e = err;
-	return (typeof e?.stderr === "string" ? e.stderr.trim() : "") || String(e?.message ?? err);
+	const stderr = typeof e?.stderr === "string" ? e.stderr.trim() : "";
+	if (err?.code === "ETIMEDOUT") return String(e?.message ?? err);
+	return stderr || String(e?.message ?? err);
 }
 const PROXY_CREDENTIAL_ENV = ["AGENT_DEVICE_DAEMON_BASE_URL", "AGENT_DEVICE_DAEMON_AUTH_TOKEN"];
 function easExecOptions(root) {
@@ -569,6 +1046,9 @@ function easExecOptions(root) {
 	};
 }
 const EAS_OPERATION_TIMEOUT_MS = 3e4;
+const EAS_SESSION_CREATE_TIMEOUT_MS = 6e5;
+const AGENT_DEVICE_TIMEOUT_MS = 12e4;
+const AGENT_DEVICE_INSTALL_TIMEOUT_MS = 6e5;
 function easBoundedExecOptions(root) {
 	return {
 		...easExecOptions(root),
@@ -643,8 +1123,22 @@ function remoteDeviceDeps(ctx) {
 						label: ctx.label,
 						platform: ctx.platform ?? "ios",
 						maxDurationMinutes: ctx.maxDurationMinutes ?? null
-					}), easEnv);
+					}), {
+						...easEnv,
+						timeoutMs: EAS_SESSION_CREATE_TIMEOUT_MS,
+						killSignal: "SIGKILL"
+					});
 				} catch (err) {
+					if (err?.code === "ETIMEDOUT") {
+						const partial = parseCreatedSession(String(err.stdout ?? ""));
+						if (partial) return abandonSession(ctx, partial.id, `eas sim did not finish within ${EAS_SESSION_CREATE_TIMEOUT_MS / 6e4} minutes after creating session ${partial.id}.`);
+						const name = ownedSessionName(ctx.label);
+						return {
+							failed: true,
+							reason: `eas sim did not finish within ${EAS_SESSION_CREATE_TIMEOUT_MS / 6e4} minutes and the eas process was killed. EAS may still have started session ${name}; it has no Stim ownership claim, so \`stim gc\` will not stop it.`,
+							remedy: `Run \`eas simulator:list --name ${name}\` and stop any running session with \`eas simulator:stop --id <id>\`, then retry.`
+						};
+					}
 					return {
 						failed: true,
 						reason: `eas sim failed: ${describe(err)}`
@@ -674,13 +1168,17 @@ function remoteDeviceDeps(ctx) {
 			try {
 				getExecutor().runFile(ctx.agentDeviceBin, closeArgs(profilePath), {
 					cwd: ctx.root,
-					env: daemonEnv(daemon)
+					env: daemonEnv(daemon),
+					timeoutMs: AGENT_DEVICE_TIMEOUT_MS,
+					killSignal: "SIGKILL"
 				});
 			} catch {}
 			try {
 				getExecutor().runFile(ctx.agentDeviceBin, connectArgs(profilePath), {
 					cwd: ctx.root,
-					env: daemonEnv(daemon)
+					env: daemonEnv(daemon),
+					timeoutMs: AGENT_DEVICE_TIMEOUT_MS,
+					killSignal: "SIGKILL"
 				});
 			} catch (err) {
 				if (createdHere) return abandonSession(ctx, createdHere, `agent-device connect failed: ${describe(err)}`);
@@ -706,7 +1204,9 @@ function remoteDeviceDeps(ctx) {
 			try {
 				getExecutor().runFile(ctx.agentDeviceBin, installArgs(session.profilePath, artifactPath), {
 					cwd: ctx.root,
-					env: daemonEnv(session.daemon)
+					env: daemonEnv(session.daemon),
+					timeoutMs: AGENT_DEVICE_INSTALL_TIMEOUT_MS,
+					killSignal: "SIGKILL"
 				});
 				return {
 					ok: true,
@@ -725,7 +1225,9 @@ function remoteDeviceDeps(ctx) {
 			if (metroPort === null) try {
 				getExecutor().runFile(ctx.agentDeviceBin, openArgs(session.profilePath, appId, null, null), {
 					cwd: ctx.root,
-					env: daemonEnv(session.daemon)
+					env: daemonEnv(session.daemon),
+					timeoutMs: AGENT_DEVICE_TIMEOUT_MS,
+					killSignal: "SIGKILL"
 				});
 				return {
 					ok: true,
@@ -753,12 +1255,16 @@ function remoteDeviceDeps(ctx) {
 			try {
 				getExecutor().runFile(ctx.agentDeviceBin, openArgs(session.profilePath, appId, url, metroHintFrom(origin.origin)), {
 					cwd: ctx.root,
-					env: daemonEnv(session.daemon)
+					env: daemonEnv(session.daemon),
+					timeoutMs: AGENT_DEVICE_TIMEOUT_MS,
+					killSignal: "SIGKILL"
 				});
 				if (url) try {
 					getExecutor().runFile(ctx.agentDeviceBin, acceptAlertArgs(session.profilePath), {
 						cwd: ctx.root,
-						env: daemonEnv(session.daemon)
+						env: daemonEnv(session.daemon),
+						timeoutMs: AGENT_DEVICE_TIMEOUT_MS,
+						killSignal: "SIGKILL"
 					});
 				} catch {}
 				return {
@@ -788,10 +1294,11 @@ function remoteDeviceDeps(ctx) {
 			}
 			return stopped;
 		},
-		webPreviewUrl: () => session?.daemon.webPreviewUrl ?? null
+		webPreviewUrl: () => session?.daemon.webPreviewUrl ?? null,
+		failureRemedy: () => ctx.backend === "eas" && session?.id ? `EAS Simulator session ${session.id} is still running and billed until it reaches its time limit or \`stim stop\` ends it. Fix the error above and run this command again to reuse the session, or run \`stim stop\` to end it.` : "Check that the remote daemon is reachable and still has the device, then run this command again."
 	};
 }
-async function resolveRemoteContext({ root, label, backend, platform = "ios", easBin, env = process.env, lookupAgentDevice = defaultLookupAgentDevice, maxDurationMinutes = null }) {
+async function resolveRemoteContext({ root, backend, platform = "ios", easBin, env = process.env, lookupAgentDevice = defaultLookupAgentDevice, readEasCliVersion = readInstalledEasCliVersion, maxDurationMinutes = null }) {
 	const agentDeviceBin = lookupAgentDevice();
 	if (!agentDeviceBin) return {
 		failed: "agent-device is not on PATH, and it is what drives a remote device.",
@@ -825,9 +1332,17 @@ async function resolveRemoteContext({ root, label, backend, platform = "ios", ea
 		remedy: "Install eas-cli, then run the device command with `--remote eas` again.",
 		code: "STIM_REMOTE_EAS_UNAVAILABLE"
 	};
+	else {
+		const { supported, version } = easCliSupport(readEasCliVersion(easBin, root), MIN_EAS_CLI_SIMULATOR_VERSION);
+		if (!supported) return {
+			failed: version ? `eas-cli ${version} (${easBin}) has no EAS Simulator commands; the eas backend needs eas-cli ${MIN_EAS_CLI_SIMULATOR_VERSION} or later.` : `Could not read an eas-cli version from \`${easBin} --version\`; the eas backend needs eas-cli ${MIN_EAS_CLI_SIMULATOR_VERSION} or later.`,
+			remedy: `${easCliUpgradeRemedy(MIN_EAS_CLI_SIMULATOR_VERSION)}, then run the device command with \`--remote eas\` again.`,
+			code: "STIM_REMOTE_EAS_UNAVAILABLE"
+		};
+	}
 	return { ctx: {
 		root,
-		label,
+		label: `${ownedDeviceLabel(root)}-${workspaceId(root)}`,
 		backend,
 		platform,
 		easBin: easBin ?? "",
@@ -837,6 +1352,13 @@ async function resolveRemoteContext({ root, label, backend, platform = "ios", ea
 		existingDaemon
 	} };
 }
+function readInstalledEasCliVersion(easBin, root) {
+	try {
+		return getExecutor().runFile(easBin, ["--version"], easBoundedExecOptions(root));
+	} catch {
+		return null;
+	}
+}
 function binOnPath(bin) {
 	try {
 		return Boolean(getExecutor().findExecutable(bin));
@@ -915,7 +1437,7 @@ function withRemoteSessionLock(root, fn, options = {}) {
 		...options
 	});
 }
-async function ensureRemoteBootOwned({ root, platform, sessionName, startedAt, boot, createdSessionId, abandonCreatedSession, writeState, register = () => {}, withProjectLock = withEasProjectLock, withLock = withRemoteSessionLock, removeEasSessionClaim: removeClaim = removeEasSessionClaim, ledgerRoot = easMachineStateRoot() }) {
+async function ensureRemoteBootOwned({ root, platform, sessionName, startedAt, boot, createdSessionId, abandonCreatedSession, webPreviewUrl = () => null, writeState, register = () => {}, withProjectLock = withEasProjectLock, withLock = withRemoteSessionLock, removeEasSessionClaim: removeClaim = removeEasSessionClaim, ledgerRoot = easMachineStateRoot$1() }) {
 	try {
 		return await withProjectLock(root, () => withLock(root, async () => {
 			register();
@@ -932,10 +1454,12 @@ async function ensureRemoteBootOwned({ root, platform, sessionName, startedAt, b
 					workspaceHome: getConfigDir(),
 					stateFile: workspaceStateFile(root)
 				}, ledgerRoot);
+				const preview = webPreviewUrl();
 				writeState(root, { remoteDevice: {
 					platform,
 					sessionId,
-					startedAt
+					startedAt,
+					...preview ? { webPreviewUrl: preview } : {}
 				} });
 				return booted;
 			} catch (err) {
@@ -1041,7 +1565,8 @@ function remoteIosDeps(ctx) {
 		}),
 		createdSessionId: core.createdSessionId,
 		abandonCreatedSession: core.abandonCreatedSession,
-		webPreviewUrl: core.webPreviewUrl
+		webPreviewUrl: core.webPreviewUrl,
+		failureRemedy: core.failureRemedy
 	};
 }
 function remoteAndroidDeps(ctx) {
@@ -1069,7 +1594,8 @@ function remoteAndroidDeps(ctx) {
 		}),
 		createdSessionId: core.createdSessionId,
 		abandonCreatedSession: core.abandonCreatedSession,
-		webPreviewUrl: core.webPreviewUrl
+		webPreviewUrl: core.webPreviewUrl,
+		failureRemedy: core.failureRemedy
 	};
 }
 function endRecordedSession({ root, sessionId, easBin, lookupAgentDevice, ledgerRoot }) {
@@ -1091,10 +1617,14 @@ function endRecordedSession({ root, sessionId, easBin, lookupAgentDevice, ledger
 function teardownRemote(ctx, { sessionId }) {
 	const profilePath = remoteProfilePath(ctx.root);
 	try {
-		getExecutor().runFile(ctx.agentDeviceBin, disconnectArgs(profilePath), { cwd: ctx.root });
+		getExecutor().runFile(ctx.agentDeviceBin, disconnectArgs(profilePath), {
+			cwd: ctx.root,
+			timeoutMs: AGENT_DEVICE_TIMEOUT_MS,
+			killSignal: "SIGKILL"
+		});
 	} catch {}
 	if (!sessionId) return { status: "torn-down" };
-	const ledger = readEasSessionLedger(ctx.easLedgerRoot);
+	const ledger = readEasSessionLedger$1(ctx.easLedgerRoot);
 	const claimNeedsRemoval = !ledger.safe || ledger.claims.has(sessionId);
 	const removeClaim = () => {
 		try {
@@ -1202,16 +1732,12 @@ async function ensureMetroReachable({ ctx, metroPort, isExpo, tunnelMode = "auto
 }
 function bundleEntryPoint(root, isExpo) {
 	if (!isExpo) return "index";
-	try {
-		const pkg = JSON.parse(readFileSync(resolve(root, "package.json"), "utf-8"));
-		if (typeof pkg.main !== "string" || !pkg.main.trim()) return "index";
-		const main = pkg.main.trim();
-		const local = main.startsWith(".") || /\.[cm]?[jt]sx?$/.test(main) || existsSync(resolve(root, main));
-		const normalized = main.replace(/^\.\//, "").replace(/\.(?:[cm]?[jt]sx?)$/, "");
-		return local ? normalized : `node_modules/${normalized}`;
-	} catch {
-		return "index";
-	}
+	const declared = readJsonObject(resolve(root, "package.json"))?.main;
+	if (typeof declared !== "string" || !declared.trim()) return "index";
+	const main = declared.trim();
+	const local = main.startsWith(".") || /\.[cm]?[jt]sx?$/.test(main) || existsSync(resolve(root, main));
+	const normalized = main.replace(/^\.\//, "").replace(/\.(?:[cm]?[jt]sx?)$/, "");
+	return local ? normalized : `node_modules/${normalized}`;
 }
 //#endregion
-export { verifyStoppedSession as C, stopSessionArgs as S, inspectSessionForTeardown as _, ensureMetroReachable as a, ownedSessionName as b, remoteIosDeps as c, withEasProjectLock as d, easMachineStateRoot as f, getSessionArgs as g, findOrphanedOwnedSessions as h, endRecordedSession as i, resolveRemoteContext as l, removeEasSessionClaim as m, binOnPath as n, ensureRemoteBootOwned as o, readEasSessionLedger as p, bundleEntryPoint as r, remoteAndroidDeps as s, REMOTE_SESSION_ERROR as t, withRemoteSessionLock as u, isDefinitiveMissingSessionError as v, gateMetroOrigin as w, parseSessionListPage as x, listOwnedSessionsArgs as y };
+export { UPLOAD_TIMEOUT_MS as A, resolveRemote as B, listOwnedSessionsArgs as C, verifyStoppedSession as D, stopSessionArgs as E, isEasAuthFailureText as F, loadProjectProvider as I, ownerFromConfig as L, checkEasAuth as M, easAuthNote as N, gateMetroOrigin as O, exitAfterFlush as P, providerFromConfig as R, isDefinitiveMissingSessionError as S, parseSessionListPage as T, uploadRemote as V, easCliSupport as _, ensureMetroReachable as a, getSessionArgs as b, remoteAndroidDeps as c, withRemoteSessionLock as d, withEasProjectLock as f, MIN_EAS_CLI_SIMULATOR_VERSION as g, removeEasSessionClaim as h, endRecordedSession as i, cacheLevel as j, RESOLVE_TIMEOUT_MS as k, remoteIosDeps as l, readEasSessionLedger$1 as m, binOnPath as n, ensureRemoteBootOwned as o, easMachineStateRoot$1 as p, bundleEntryPoint as r, readInstalledEasCliVersion as s, REMOTE_SESSION_ERROR as t, resolveRemoteContext as u, easCliUpgradeRemedy as v, ownedSessionName as w, inspectSessionForTeardown as x, findOrphanedOwnedSessions as y, resolveEasCliBin as z };