@abloh/repository 1.0.0 → 1.0.1-staging.34767970367

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { RepoReader, PackageManifestReading, MatrixLeg, MatrixLegs, FailFastReading, SetupCandidateTrigger, SetupWorkflowCaller, SetupCandidateGate, NativeVocabulary, SetupFailFast, SetupCandidateExclusion, Refusal, YamlQuote, CoverageProviderChoice, MatrixValue, WorkflowNodePin, SetupScriptStep, ValueOrigin, CommandScriptHop, AngularTestTarget, PreparedTestCommand, InitFailureClass, InitQuestionKey, EnvironmentConfig, TargetSelectionKind, EvidenceOutputId, resolvePreparedTestCommand, MeasurementPlan, PackageExclusion } from '@abloh/core';
+import { RepoReader, PackageManifestReading, ProposedFile, MatrixLeg, MatrixLegs, FailFastReading, SetupCandidateTrigger, SetupWorkflowCaller, SetupCandidateGate, NativeVocabulary, SetupFailFast, SetupCandidateExclusion, Refusal, YamlQuote, CoverageProviderChoice, MatrixValue, WorkflowNodePin, SetupScriptStep, ValueOrigin, CommandScriptHop, AngularTestTarget, PreparedTestCommand, InitFailureClass, InitQuestionKey, EnvironmentConfig, TargetSelectionKind, EvidenceOutputId, resolvePreparedTestCommand, MeasurementPlan, PackageExclusion } from '@abloh/core';
 export { SETUP_STEP_ACTION, SETUP_STEP_IF, SETUP_STEP_JOB_STATUS, SETUP_STEP_NAME, setupStepIf } from '@abloh/core';
 import { JasmineSuite, ProofRunner, StrykerMutationRunner } from '@abloh/measure';
 
@@ -56,6 +56,17 @@ interface RepoAccess {
 }
 /** The access `abloh init` and every existing caller get: a checkout on this machine. */
 declare function diskRepoAccess(repoDir: string): RepoAccess;
+/**
+ * THE SAME ACCESS, READING {@link ProposedFile} BYTES FOR THE PATHS SOMEBODY HAS AGREED TO.
+ *
+ * WHAT IT IS FOR (the audit's class 5, 2026-09-12). `abloh init` has to draft as if an answered edit
+ * to a file of the maintainer's were already there, and it used to do that by writing the file and
+ * reading it back - before the confirmation that says abloh has written nothing yet. The root, the
+ * spellings of it and the realpath rule are untouched: only what the reader answers moves.
+ *
+ * An empty list returns the access itself, so the ordinary road pays nothing.
+ */
+declare function overlayRepoAccess(base: RepoAccess, files: readonly ProposedFile[]): RepoAccess;
 /**
  * The repository-relative path an absolute one names, or null when it names nothing in here.
  *
@@ -975,6 +986,20 @@ interface CiRecipe {
      * sets environment values Abloh has no key for, a build scoped to one workspace package.
      */
     notices: readonly string[];
+    /**
+     * THE CHOSEN JOB'S OWN STEPS THAT ABLOH READ AND DID NOT COPY INTO `.abloh/setup.sh`.
+     *
+     * THE RULING (the captain, 2026-09-12, review finding F4): init copies only the steps the tests
+     * need, a lint, format, docs or publish step is not one of them, and the maintainer is told which
+     * ones were left out. `honojs/hono` is the repository that earned it - its job runs `format`,
+     * `lint` and `editorconfig-checker` before its suite, and the checker downloads a release binary
+     * and cannot, so a repository that was never measured stopped on a step about trailing newlines.
+     *
+     * NOT {@link refusal} AND NOT A REFUSAL'S LIST. Those say abloh could not READ a step; these say
+     * abloh read it and the suite does not read what it produces. Only the first is a gap in abloh's
+     * reading, and folding the two would tell a maintainer to go and copy in a linter.
+     */
+    stepsNotCopied: readonly CiDroppedStep[];
 }
 type AptReading = {
     ok: true;
@@ -1029,6 +1054,21 @@ interface NodeEnvironment {
  *   cell does Abloh's step actually run on".
  */
 declare function readCiNodeDeclaration(raw: string | null, matrix: unknown, reader: RepoReader, leg?: MatrixLeg | null | undefined, env?: NodeEnvironment): CiNodeVersion | null;
+/** One step of a candidate job abloh read and declined to translate, with its own sentence. */
+/**
+ * ONE STEP ABLOH READ AND DID NOT COPY: where it sits, what it runs, and why it was left out.
+ *
+ * THE COMMAND IS THE MAINTAINER'S OWN TEXT, so it is local-only wherever it is shown - the same
+ * rule `setup-ci-steps-unread` already carries its step bodies under.
+ */
+interface CiDroppedStep {
+    /** 1-based, as a maintainer counts the `steps:` of their own job. Null for Travis and CircleCI. */
+    step: number | null;
+    /** The step's own command line. */
+    command: string;
+    /** Why the suite does not need it, in the reading's own words. */
+    why: string;
+}
 /**
  * DO TWO JOB REFERENCES NAME THE SAME JOB, whichever spelling each of them uses?
  *
@@ -2219,8 +2259,27 @@ interface DraftService {
  *
  * A constant because a re-run has to RECOGNIZE it: the block is replaced from its own `environment:`
  * line down, and a header left stranded above the replacement appears twice in the customer's file.
+ *
+ * IT NAMES CI RATHER THAN A CONTAINER (the audit of 2026-09-12, 10.4). "the proof container" is a
+ * thing one road builds: a run on the maintainer's own machine measures a copy of their own tree
+ * with their own installed dependencies, and reads none of the keys under this header. The block is
+ * still written on both roads, because it is what their CI needs the day they add abloh's check
+ * there, and the header now says so instead of describing work that is not happening.
  */
-declare const ENVIRONMENT_BLOCK_HEADER = "# Rebuild recipe for the proof container. Comments name the source file.";
+declare const ENVIRONMENT_BLOCK_HEADER = "# How CI rebuilds this project for abloh's check. Comments name the source file.";
+/**
+ * HEADERS THIS COMMAND USED TO WRITE, so a re-run still recognizes a file it wrote before.
+ *
+ * WHY IT EXISTS. The recognition above is an exact string match. Change the constant with no list
+ * beside it and every `abloh.yml` already carrying the old line gets the new header written above
+ * the old one - the exact duplication that constant's own header warns about, arriving through the
+ * one edit it did not anticipate.
+ *
+ * IT ONLY GROWS. A line here is a line some repository has committed, and nothing rewrites it.
+ */
+declare const RETIRED_ENVIRONMENT_BLOCK_HEADERS: readonly string[];
+/** Is this line an environment-block header this command has ever written? */
+declare function isEnvironmentBlockHeader(line: string): boolean;
 /**
  * WHAT ABLOH READ ABOUT THE JOB ITS STEP RIDES, as the contract will state it.
  *
@@ -4427,6 +4486,29 @@ declare function placeSetupStep(input: {
         before: string;
     } | null;
 }): SetupStepPlacement | Refusal;
+/**
+ * Is abloh's step already the last thing this job does?
+ *
+ * MATCHED ON THE ACTION REPOSITORY AND NOT ON THE PIN. A customer who is already running abloh at
+ * an older commit has an abloh step, and appending a second one would run the measurement twice and
+ * put two check runs on every pull request. The pin is ours to bump and theirs to keep.
+ */
+/**
+ * DOES THIS WORKFLOW ALREADY RUN ABLOH, in any job of it?
+ *
+ * WHO ASKS (the captain's ruling of 2026-09-12). Re-running `abloh init` adds a lane, so the command
+ * has to be able to tell a repository that is already set up for pull requests from one that is not
+ * - and the step in one of the maintainer's own jobs is the fact that says so.
+ *
+ * IT IS THE SAME MATCHER THE WRITER USES, over every job rather than over one. A second reading of
+ * "is abloh's step here" is how one of them comes to answer differently, and the writer's answer is
+ * what decides whether a second step is appended.
+ *
+ * AN UNREADABLE FILE ANSWERS FALSE. What that costs is an offer to set up a lane that is already
+ * there, which a maintainer can decline. Answering true would hide the offer from somebody who
+ * needs it.
+ */
+declare function workflowRunsAbloh(text: string): boolean;
 
 /**
  * WHICH OF THE MAINTAINER'S SUITE STEPS ABLOH'S STEP GOES BEHIND, ON THE LEG IT PINNED.
@@ -4628,4 +4710,4 @@ declare function selectAutoTarget(input: {
  */
 declare function committedYarnVersion(directory: string, lockfileName: string, ctx?: RepoAccess): string | null;
 
-export { ANSWERABLE_SETUP_KEYS, ANSWERED_EVIDENCE, type AggregatorInvocation, type AggregatorTool, type AttestationJob, type AutoTargetSelection, type BrowserLane, type BrowserLaneEvidence, type BrowserLaneKind, CI_RECIPE_REFUSALS, type CiBorrowJob, type CiBrowserLane, type CiEnvironmentValue, type CiInstallStep, type CiJobStep, type CiJobTestStep, type CiManagerVersion, type CiNodeVersion, type CiRecipe, type CiRequiredVariable, type CiService, type CiSetupCommand, type CiSystemPackage, type CiTestCommand, type CiUnreadableJobCall, type CiUnsupportedService, type ConfigInput, type ConfigSystemPackage, type CoverageChildSuite, DENO_CONFIG_FILES, DENO_LOCKFILE, type DeclaredBinding, type DeclaredCommandContext, type DenoProject, type DraftService, ENVIRONMENT_BLOCK_HEADER, InitRefusal, type LockfileChoice, type ManifestClassification, type NodeChoice, type NodeDeclaration, type NodeDeclarationProblem, type NodeDeclarationRejection, type NodeEnvironment, type NodeRelease, type NodeRequirement, type NodeSpecReading, type NxProject, type NxTestTarget, type PackageManager, type PackageManagerContext, type PackageManagerResolution, type PlanDeclaration, type PolicyDeclaration, RUSH_CONFIG_DIRECTORY, RUSH_CONFIG_FILE, RUSH_INSTALL_COMMAND, RUSH_INSTALL_SCRIPT, RUSH_LOCKFILE_NAME, RUSH_REPO_STATE_NAME, RUSH_SUBSPACE_DIRECTORY, RUSH_TEST_SCRIPTS, type ReadTextAt, type RebuildDraftValue, type RepoAccess, type ResolveMeasurementPlanInput, type Runner, type RuntimeNeed, type RushProject, type RushTestTarget, SETUP_QUESTION_DESCRIPTORS, STEP_WHAT, type SetupAnswerChannel, type SetupAnswerShape, type SetupDraftValues, type SetupFailFastDecision, type SetupJobDecision, type SetupJobQuestion, type SetupMatrixLeg, type SetupPin, type SetupPublishPlacement, type SetupQuestionDescriptor, type SetupStepAnchor, type SetupStepPlacement, type SetupStepPrecondition, type SubmoduleRoot, type TargetDetection, TargetDetectionError, TargetNotFoundError, type TargetNotFoundReason, type TargetResolution, type TargetResolutionInput, type WorkflowEnvironmentEntry, type WorkflowEnvironmentLevel, type WorkflowEnvironmentScope, type WorkflowExpressionFacts, type WorkflowExpressionReading, type WorkspaceEnumeration, type WorkspaceRootSuite, __testing, accessExists, accessKind, accessManifest, accessSubdirectories, accessText, admitSubmodules, aggregatorInvocation, aggregatorTaskPhrase, aliasHopFamily, answeredTargetDirectory, applyAnswersToContract, applyDeclaredRunner, argvInvokesNodeTest, assertNoGitlinkChanges, bindDeclaredCommand, bindPreparedTestCommand, chooseNodeVersion, ciInstallSteps, ciInstallersFor, ciManagerVersions, ciRefusalIsActionable, classicPerTestRefusal, classicPerTestRunner, classifyNxTestTarget, classifyPackageDirectory, classifyPackageManifest, classifyRushTestScript, classifyWithAliasHop, commentLines, committedYarnVersion, contractDescriptors, decideSetupJob, declarableSetupJobs, declaredCommandContext, declaredRunner, declaredRunnerInvocation, declaredSetupJob, declaredSetupPin, denoLockfilePath, denoTestInvocation, deriveCiRecipe, detectJasmineSuite, detectPackageManager, detectPackageManagerContext, detectTarget, detectVitestDir, diskRepoAccess, diskRepoReader, doorSetupJobs, emptyCiRecipe, engineRunner, enumerateNxProjects, enumerateRushProjects, enumerateWorkspacePackages, enumerateWorkspacePackagesOnDisk, initFailureClassOf, initRefusal, initStepRole, invokesNodeTest, isBrowserInstallCommand, isInstallStep, jasmineSuiteFromScript, layerEnvironment, materializeSubmodule, nodeDeclarationProblemReason, nodeSpecVersions, placeSetupStep, policyDeclaration, preRunnerStageCommands, readAnswerValue, readBrowserLane, readDenoProject, readNodeSpec, readWorkflowExpressions, referencesExpression, referencesSecret, refusalRemedyOf, renderConfig, renderEnvironmentBlock, renderWorkflow, repoPath, resolveMeasurementPlan, resolveSetupPin, resolveTarget, resolveTargetDetection, rootAggregatorTasks, runnerInvocation, runnerStageCommand, runnerSuiteInvocations, rushIdentityFiles, rushLockfiles, rushNodeVersionRange, sameJobReference, scriptRunsDenoTest, selectAutoTarget, setupAnswerProblem, setupJobCandidates, setupJobReference, setupScriptSteps, setupStepAnchor, setupStepOrigin, splitAnswerList, suiteStages, systemPackagesStep, testCommandReceipt, testStepLabel, testableWorkspacePackages, unreadableConditionLine, vitestDirIn, withoutPackageRunnerPrefix, workDirPrefix };
+export { ANSWERABLE_SETUP_KEYS, ANSWERED_EVIDENCE, type AggregatorInvocation, type AggregatorTool, type AttestationJob, type AutoTargetSelection, type BrowserLane, type BrowserLaneEvidence, type BrowserLaneKind, CI_RECIPE_REFUSALS, type CiBorrowJob, type CiBrowserLane, type CiDroppedStep, type CiEnvironmentValue, type CiInstallStep, type CiJobStep, type CiJobTestStep, type CiManagerVersion, type CiNodeVersion, type CiRecipe, type CiRequiredVariable, type CiService, type CiSetupCommand, type CiSystemPackage, type CiTestCommand, type CiUnreadableJobCall, type CiUnsupportedService, type ConfigInput, type ConfigSystemPackage, type CoverageChildSuite, DENO_CONFIG_FILES, DENO_LOCKFILE, type DeclaredBinding, type DeclaredCommandContext, type DenoProject, type DraftService, ENVIRONMENT_BLOCK_HEADER, InitRefusal, type LockfileChoice, type ManifestClassification, type NodeChoice, type NodeDeclaration, type NodeDeclarationProblem, type NodeDeclarationRejection, type NodeEnvironment, type NodeRelease, type NodeRequirement, type NodeSpecReading, type NxProject, type NxTestTarget, type PackageManager, type PackageManagerContext, type PackageManagerResolution, type PlanDeclaration, type PolicyDeclaration, RETIRED_ENVIRONMENT_BLOCK_HEADERS, RUSH_CONFIG_DIRECTORY, RUSH_CONFIG_FILE, RUSH_INSTALL_COMMAND, RUSH_INSTALL_SCRIPT, RUSH_LOCKFILE_NAME, RUSH_REPO_STATE_NAME, RUSH_SUBSPACE_DIRECTORY, RUSH_TEST_SCRIPTS, type ReadTextAt, type RebuildDraftValue, type RepoAccess, type ResolveMeasurementPlanInput, type Runner, type RuntimeNeed, type RushProject, type RushTestTarget, SETUP_QUESTION_DESCRIPTORS, STEP_WHAT, type SetupAnswerChannel, type SetupAnswerShape, type SetupDraftValues, type SetupFailFastDecision, type SetupJobDecision, type SetupJobQuestion, type SetupMatrixLeg, type SetupPin, type SetupPublishPlacement, type SetupQuestionDescriptor, type SetupStepAnchor, type SetupStepPlacement, type SetupStepPrecondition, type SubmoduleRoot, type TargetDetection, TargetDetectionError, TargetNotFoundError, type TargetNotFoundReason, type TargetResolution, type TargetResolutionInput, type WorkflowEnvironmentEntry, type WorkflowEnvironmentLevel, type WorkflowEnvironmentScope, type WorkflowExpressionFacts, type WorkflowExpressionReading, type WorkspaceEnumeration, type WorkspaceRootSuite, __testing, accessExists, accessKind, accessManifest, accessSubdirectories, accessText, admitSubmodules, aggregatorInvocation, aggregatorTaskPhrase, aliasHopFamily, answeredTargetDirectory, applyAnswersToContract, applyDeclaredRunner, argvInvokesNodeTest, assertNoGitlinkChanges, bindDeclaredCommand, bindPreparedTestCommand, chooseNodeVersion, ciInstallSteps, ciInstallersFor, ciManagerVersions, ciRefusalIsActionable, classicPerTestRefusal, classicPerTestRunner, classifyNxTestTarget, classifyPackageDirectory, classifyPackageManifest, classifyRushTestScript, classifyWithAliasHop, commentLines, committedYarnVersion, contractDescriptors, decideSetupJob, declarableSetupJobs, declaredCommandContext, declaredRunner, declaredRunnerInvocation, declaredSetupJob, declaredSetupPin, denoLockfilePath, denoTestInvocation, deriveCiRecipe, detectJasmineSuite, detectPackageManager, detectPackageManagerContext, detectTarget, detectVitestDir, diskRepoAccess, diskRepoReader, doorSetupJobs, emptyCiRecipe, engineRunner, enumerateNxProjects, enumerateRushProjects, enumerateWorkspacePackages, enumerateWorkspacePackagesOnDisk, initFailureClassOf, initRefusal, initStepRole, invokesNodeTest, isBrowserInstallCommand, isEnvironmentBlockHeader, isInstallStep, jasmineSuiteFromScript, layerEnvironment, materializeSubmodule, nodeDeclarationProblemReason, nodeSpecVersions, overlayRepoAccess, placeSetupStep, policyDeclaration, preRunnerStageCommands, readAnswerValue, readBrowserLane, readDenoProject, readNodeSpec, readWorkflowExpressions, referencesExpression, referencesSecret, refusalRemedyOf, renderConfig, renderEnvironmentBlock, renderWorkflow, repoPath, resolveMeasurementPlan, resolveSetupPin, resolveTarget, resolveTargetDetection, rootAggregatorTasks, runnerInvocation, runnerStageCommand, runnerSuiteInvocations, rushIdentityFiles, rushLockfiles, rushNodeVersionRange, sameJobReference, scriptRunsDenoTest, selectAutoTarget, setupAnswerProblem, setupJobCandidates, setupJobReference, setupScriptSteps, setupStepAnchor, setupStepOrigin, splitAnswerList, suiteStages, systemPackagesStep, testCommandReceipt, testStepLabel, testableWorkspacePackages, unreadableConditionLine, vitestDirIn, withoutPackageRunnerPrefix, workDirPrefix, workflowRunsAbloh };

package/dist/index.js

@@ -3,6 +3,7 @@ import { realpathSync as realpathSync2 } from "fs";
 import { relative, resolve as resolve2 } from "path";
 import {
   normalizeRepoPath as normalizeRepoPath2,
+  overlayRepoReader,
   readPackageManifest
 } from "@abloh/core";
 
@@ -116,6 +117,10 @@ function diskRepoAccess(repoDir) {
     }
   };
 }
+function overlayRepoAccess(base, files) {
+  const reader = overlayRepoReader(base.reader, files);
+  return reader === base.reader ? base : { ...base, reader };
+}
 function repoPath(ctx, absolute) {
   const target = resolve2(absolute);
   for (const base of ctx.roots) {
@@ -320,6 +325,7 @@ import {
   manifestScripts,
   normalizeRepoPath as normalizeRepoPath3,
   readPackageManifest as readPackageManifest2,
+  runIsDroppable,
   scriptRuns
 } from "@abloh/core";
 import {
@@ -1037,7 +1043,7 @@ function readStep(step, manifest, reader) {
       const script = workspaceFirst[2];
       if (TEST_NAMES.test(script)) return { kind: "test", command };
       if (BUILD_NAMES.test(script)) return { kind: "build", command, env };
-      return { kind: "other" };
+      return { kind: "other", command, why: "abloh could not read what it does" };
     }
     const scoped = /--workspace[= ]([^\s]+)|--filter[= ]([^\s]+)/u.test(tail);
     if (manifest.scripts[name] !== void 0 || scoped) {
@@ -1050,7 +1056,7 @@ function readStep(step, manifest, reader) {
       if (manifest.scripts[name] !== void 0 && scriptRunsBuild(manifest, name)) {
         return { kind: "build", command, env };
       }
-      return { kind: "other" };
+      return { kind: "other", command, why: scriptNotABuildBecause(manifest, name) };
     }
     if (TEST_BINARIES.has(name)) return { kind: "test", command };
     if (BUILD_BINARIES.has(name)) {
@@ -1170,7 +1176,20 @@ function scriptRunsBuild(manifest, name) {
     lifecycle: false
   });
   if (runs.length === 0) return false;
-  return runs.every((run) => run.kind === "preparation" && (run.role === "build" || run.role === "tool"));
+  return runs.every((run) => run.kind === "preparation" && run.role === "build");
+}
+function scriptNotABuildBecause(manifest, name) {
+  const runs = scriptRuns({
+    scripts: manifest.scripts,
+    dependencies: manifest.dependencies,
+    script: name,
+    lifecycle: false
+  });
+  if (runs.length > 0 && runs.every((run) => runIsDroppable(run) && run.kind !== "test")) {
+    return "it checks the tree rather than writing into it";
+  }
+  const unknown = runs.find((run) => run.kind === "preparation" && run.role === "tool");
+  return unknown === void 0 ? "abloh could not read what it does" : `abloh has no reading of ${unknown.name}, so it cannot say the suite needs it`;
 }
 function clip(command) {
   return command.length > 70 ? `${command.slice(0, 70)}\u2026` : command;
@@ -1334,6 +1353,7 @@ function emptyCiRecipe(refusal) {
     browserLane: null,
     unreadableJobCalls: [],
     refusal,
+    stepsNotCopied: [],
     notices: []
   };
 }
@@ -1359,6 +1379,7 @@ function deriveCiRecipe(input) {
       browserLane: null,
       unreadableJobCalls: [],
       refusal: `your CI configuration could not be read (${error instanceof Error ? error.message : "unknown error"})`,
+      stepsNotCopied: [],
       notices: []
     };
   }
@@ -1385,6 +1406,7 @@ function derive(input) {
     runnerImage: null,
     browserLane: null,
     unreadableJobCalls: calls,
+    stepsNotCopied: [],
     refusal,
     notices: [...bounds, ...notices]
   });
@@ -1598,20 +1620,21 @@ function assemble(input) {
   for (const refused of chosen.refusals) {
     if (!unread.some((seen2) => seen2.step === refused.step && seen2.why === refused.why)) unread.push(refused);
   }
-  const unreadMessage = messageFromFacts({
-    kind: "setup-ci-steps",
-    unread,
+  const stepsRead = {
     workflow: chosen.workflowPath,
     job: chosen.jobId,
     /* THE MAINTAINER'S OWN FILE SAID IT, and `at` is the receipt spelling every other notice in
        this function uses, so a reader meets one name for the job on every line. */
     at: `${chosen.file}::${chosen.jobId}`
-  });
-  if (unreadMessage.kind === "message") {
-    const refusal = unreadMessage.refusal;
-    const rendered = renderRefusal(refusal, "terminal");
+  };
+  const sayStepsRead = (facts2) => {
+    const outcome = messageFromFacts({ kind: "setup-ci-steps", ...stepsRead, ...facts2 });
+    if (outcome.kind !== "message") return;
+    const rendered = renderRefusal(outcome.refusal, "terminal");
     if (rendered !== null) notices.push(refusalLines(rendered).join("\n"));
-  }
+  };
+  sayStepsRead({ unread, notCopied: [] });
+  sayStepsRead({ unread: [], notCopied: [...chosen.notCopied] });
   const drafted = [];
   const seen = /* @__PURE__ */ new Set();
   const push = (step, source) => {
@@ -1838,6 +1861,11 @@ function assemble(input) {
     runnerImage,
     browserLane,
     unreadableJobCalls: input.unreadableJobCalls,
+    /* THE STEPS THE CHOSEN JOB RUNS THAT THE RECIPE LEFT OUT. See {@link CiRecipe.stepsNotCopied}:
+       this is the chosen candidate's own list and never a pooling of every job's, because the
+       recipe is derived from one job and a sentence about another job's steps would name edits to a
+       file abloh is not reading. */
+    stepsNotCopied: chosen.notCopied,
     refusal: null,
     notices
   };
@@ -2052,6 +2080,7 @@ function blankCandidate(file, jobId, label) {
     testSteps: [],
     installs: false,
     refusals: [],
+    notCopied: [],
     refusedTestSteps: [],
     /* A `.travis.yml` or a CircleCI job declares no `env:` block and no `services:` this module has
        a preset for, so the three keys those produce are empty here by construction. */
@@ -2489,6 +2518,7 @@ function readJob(reader, manifest, file, jobId, job, workflowEnv, bounds = []) {
     testSteps: [],
     installs: false,
     refusals: [],
+    notCopied: [],
     refusedTestSteps: [],
     node: null,
     nodeEnv: NO_NODE_ENVIRONMENT,
@@ -2595,6 +2625,15 @@ function readJob(reader, manifest, file, jobId, job, workflowEnv, bounds = []) {
             candidate.refusedTestSteps.push(classified.why);
           }
           break;
+        case "other":
+          if (!candidate.notCopied.some((seen) => seen.command === classified.command)) {
+            candidate.notCopied.push({
+              step: stepNumber(step),
+              command: classified.command,
+              why: classified.why
+            });
+          }
+          break;
         default:
           break;
       }
@@ -2790,7 +2829,7 @@ function renderEnvironmentBlock(input) {
       ...input.coverageProvider === void 0 ? [] : [{
         key: "coverageProvider",
         value: input.coverageProvider,
-        receipt: input.coverageProvider === "install" ? "you agreed abloh may stage @vitest/coverage-v8 in the job that measures, into its own cache outside this repository" : "you asked abloh not to install @vitest/coverage-v8, so the changed-line check reports itself as declined"
+        receipt: input.coverageProvider === "install" ? "you agreed abloh may stage @vitest/coverage-v8 where a run measures, into its own cache outside this repository" : "you asked abloh not to install @vitest/coverage-v8, so the changed-line check reports itself as declined"
       }],
       ...input.sealedTestCommand !== null || input.sealedNote !== null ? [{
         key: "sealedTestCommand",
@@ -2838,7 +2877,7 @@ function renderEnvironmentBlock(input) {
     }
   }
   if (input.identityFiles.length > 0) {
-    lines.push("  identityFiles: # a change here triggers reinstall instead of container reuse");
+    lines.push("  identityFiles: # a change here makes CI reinstall instead of reusing its image");
     for (const path of input.identityFiles) lines.push(`    - ${yamlScalar(path, quote)}`);
   }
   if (input.requiredVariables.length > 0) {
@@ -2952,7 +2991,13 @@ function receiptLines(entries, indent, quote) {
   }
   return lines;
 }
-var ENVIRONMENT_BLOCK_HEADER = "# Rebuild recipe for the proof container. Comments name the source file.";
+var ENVIRONMENT_BLOCK_HEADER = "# How CI rebuilds this project for abloh's check. Comments name the source file.";
+var RETIRED_ENVIRONMENT_BLOCK_HEADERS = [
+  "# Rebuild recipe for the proof container. Comments name the source file."
+];
+function isEnvironmentBlockHeader(line) {
+  return line === ENVIRONMENT_BLOCK_HEADER || RETIRED_ENVIRONMENT_BLOCK_HEADERS.includes(line);
+}
 var STEP_WHAT = {
   systemPackages: "OS packages your suite needs, pinned",
   corepack: "put the package manager on PATH, for your own lifecycle scripts",
@@ -2977,7 +3022,9 @@ function isInstallStep(what) {
   return what === STEP_WHAT.install || what === STEP_WHAT.installUnlocked;
 }
 function setupStepOrigin(step) {
-  return initStepRole(step.what) === null ? CUSTOMER_TYPED : "abloh-derived";
+  const role = initStepRole(step.what);
+  if (role === null) return CUSTOMER_TYPED;
+  return role === "setupCommands" ? "abloh-composed" : "abloh-derived";
 }
 function initStepRole(what) {
   if (what === STEP_WHAT.systemPackages) return "systemPackages";
@@ -7278,6 +7325,20 @@ function failFastInsertion(lines, job) {
   }
   return null;
 }
+function workflowRunsAbloh(text) {
+  let document;
+  try {
+    document = parse3(text);
+  } catch {
+    return false;
+  }
+  const jobs = document?.jobs;
+  if (typeof jobs !== "object" || jobs === null) return false;
+  return Object.values(jobs).some((job) => {
+    const steps = job?.steps;
+    return Array.isArray(steps) && alreadyEndsInAblohStep(steps);
+  });
+}
 function alreadyEndsInAblohStep(steps) {
   const repository = SETUP_STEP_ACTION.split("@")[0] ?? SETUP_STEP_ACTION;
   return steps.some(
@@ -7593,6 +7654,7 @@ export {
   DENO_LOCKFILE,
   ENVIRONMENT_BLOCK_HEADER,
   InitRefusal,
+  RETIRED_ENVIRONMENT_BLOCK_HEADERS,
   RUSH_CONFIG_DIRECTORY,
   RUSH_CONFIG_FILE,
   RUSH_INSTALL_COMMAND,
@@ -7670,12 +7732,14 @@ export {
   initStepRole,
   invokesNodeTest,
   isBrowserInstallCommand,
+  isEnvironmentBlockHeader,
   isInstallStep,
   jasmineSuiteFromScript,
   layerEnvironment,
   materializeSubmodule,
   nodeDeclarationProblemReason,
   nodeSpecVersions,
+  overlayRepoAccess,
   placeSetupStep,
   policyDeclaration,
   preRunnerStageCommands,
@@ -7721,5 +7785,6 @@ export {
   unreadableConditionLine,
   vitestDirIn,
   withoutPackageRunnerPrefix,
-  workDirPrefix
+  workDirPrefix,
+  workflowRunsAbloh
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloh/repository",
-  "version": "1.0.0",
+  "version": "1.0.1-staging.34767970367",
   "description": "Reads a repository and decides what abloh may measure in it: the CI recipe, the target, the package manager, the workspace packages, the job abloh's step rides and the measurement plan. Shared by the CLI, which reads a checkout, and by the control plane, which reads the same repository over GitHub's contents API. \"name\" will publish under the @abloh scope.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
@@ -23,8 +23,8 @@
   "dependencies": {
     "semver": "7.8.5",
     "yaml": "^2.6.1",
-    "@abloh/core": "1.0.0",
-    "@abloh/measure": "1.0.0"
+    "@abloh/measure": "1.0.1-staging.34767970367",
+    "@abloh/core": "1.0.1-staging.34767970367"
   },
   "devDependencies": {
     "@types/semver": "7.7.1",