@abloh/repository 1.0.1 → 1.0.2-staging.34831899691

package/dist/index.js

@@ -1,8 +1,12 @@
+// src/aggregator-chain.ts
+import { join as join9 } from "path";
+
 // src/repo-access.ts
 import { realpathSync as realpathSync2 } from "fs";
 import { relative, resolve as resolve2 } from "path";
 import {
   normalizeRepoPath as normalizeRepoPath2,
+  overlayRepoReader,
   readPackageManifest
 } from "@abloh/core";
 
@@ -116,6 +120,10 @@ function diskRepoAccess(repoDir) {
     }
   };
 }
+function overlayRepoAccess(base, files) {
+  const reader = overlayRepoReader(base.reader, files);
+  return reader === base.reader ? base : { ...base, reader };
+}
 function repoPath(ctx, absolute) {
   const target = resolve2(absolute);
   for (const base of ctx.roots) {
@@ -147,6 +155,50 @@ function accessSubdirectories(ctx, absolute) {
   return ctx.reader.list(path).filter((name) => ctx.reader.entryKind(path === "" ? name : `${path}/${name}`) === "directory");
 }
 
+// src/detect.ts
+import { existsSync as existsSync2, readFileSync as readFileSync5 } from "fs";
+import { dirname as dirname4, isAbsolute as isAbsolute4, join as join8, relative as relative5, resolve as resolve6, sep as sep4 } from "path";
+import { SCRIPT_NAMED_RUNNERS as SCRIPT_NAMED_RUNNERS3, angularRunnerName, commandTokens, compiledOutputEvidence, debugPreparationOverflowStack, readsCompiledOutput, detectModuleLayout, directRunnerCommand, localBinaryPrefix, manifestScripts as manifestScripts3, parseLiteralArguments, parsePreparedTestCommand, planCommand as planCommand3, nextActionSentence, readPackageManagerDeclaration, readPackageManagerPin, resolveCommandPlan, runnerNamesInScript, scriptRuns as scriptRuns2, selectAngularTestTarget, nameDrivenRunners, summaryThenAction, watchModeRefusal, withWatchModeDisabled, withoutWatchDisableFlags } from "@abloh/core";
+
+// src/ci-recipe.ts
+import { basename, isAbsolute, relative as relative3, resolve as resolve3 } from "path";
+import { parse } from "yaml";
+import {
+  declaredDependencies as declaredDependencies2,
+  manifestScripts,
+  normalizeRepoPath as normalizeRepoPath3,
+  readPackageManifest as readPackageManifest2,
+  runIsDroppable,
+  scriptRuns
+} from "@abloh/core";
+import {
+  admitsMainlineBranch,
+  assignServicePorts,
+  environmentValueProblem,
+  isEnvironmentName,
+  isReservedCustomerVariable,
+  MAX_ENVIRONMENT_SERVICES,
+  serviceNameProblem,
+  SCRIPT_NAMED_RUNNERS,
+  UNDRIVABLE_RUNNERS,
+  undrivableRunner,
+  matchesCredentialShape,
+  matrixValueText as matrixValueText2,
+  nothingToMeasurePathFilter,
+  planCommand,
+  preparedCommandProblem,
+  readFailFastDeclaration,
+  refusalLines,
+  messageFromFacts,
+  renderRefusal,
+  reservedComposeProblem,
+  reservedComposition,
+  MAX_SYSTEM_PACKAGES,
+  runnerImageVocabulary,
+  sameMatrixValue,
+  systemPackageProblem
+} from "@abloh/core";
+
 // src/browser-lane.ts
 import { dirname as dirname2, join as join2, relative as relative2, sep as sep2 } from "path";
 function repoPathOrEmpty(ctx, absolute) {
@@ -312,44 +364,6 @@ function readBrowserLane(repoDir, ctx = diskRepoAccess(repoDir)) {
   return null;
 }
 
-// src/ci-recipe.ts
-import { basename, isAbsolute, relative as relative3, resolve as resolve3 } from "path";
-import { parse } from "yaml";
-import {
-  declaredDependencies as declaredDependencies2,
-  manifestScripts,
-  normalizeRepoPath as normalizeRepoPath3,
-  readPackageManifest as readPackageManifest2,
-  scriptRuns
-} from "@abloh/core";
-import {
-  admitsMainlineBranch,
-  assignServicePorts,
-  environmentValueProblem,
-  isEnvironmentName,
-  isReservedCustomerVariable,
-  MAX_ENVIRONMENT_SERVICES,
-  serviceNameProblem,
-  SCRIPT_NAMED_RUNNERS,
-  UNDRIVABLE_RUNNERS,
-  undrivableRunner,
-  matchesCredentialShape,
-  matrixValueText as matrixValueText2,
-  nothingToMeasurePathFilter,
-  planCommand,
-  preparedCommandProblem,
-  readFailFastDeclaration,
-  refusalLines,
-  messageFromFacts,
-  renderRefusal,
-  reservedComposeProblem,
-  reservedComposition,
-  MAX_SYSTEM_PACKAGES,
-  runnerImageVocabulary,
-  sameMatrixValue,
-  systemPackageProblem
-} from "@abloh/core";
-
 // src/workflow-environment.ts
 import { matrixValueText } from "@abloh/core";
 function layerEnvironment(scopes) {
@@ -1037,7 +1051,7 @@ function readStep(step, manifest, reader) {
       const script = workspaceFirst[2];
       if (TEST_NAMES.test(script)) return { kind: "test", command };
       if (BUILD_NAMES.test(script)) return { kind: "build", command, env };
-      return { kind: "other" };
+      return { kind: "other", command, why: "abloh could not read what it does" };
     }
     const scoped = /--workspace[= ]([^\s]+)|--filter[= ]([^\s]+)/u.test(tail);
     if (manifest.scripts[name] !== void 0 || scoped) {
@@ -1050,7 +1064,7 @@ function readStep(step, manifest, reader) {
       if (manifest.scripts[name] !== void 0 && scriptRunsBuild(manifest, name)) {
         return { kind: "build", command, env };
       }
-      return { kind: "other" };
+      return { kind: "other", command, why: scriptNotABuildBecause(manifest, name) };
     }
     if (TEST_BINARIES.has(name)) return { kind: "test", command };
     if (BUILD_BINARIES.has(name)) {
@@ -1170,7 +1184,20 @@ function scriptRunsBuild(manifest, name) {
     lifecycle: false
   });
   if (runs.length === 0) return false;
-  return runs.every((run) => run.kind === "preparation" && (run.role === "build" || run.role === "tool"));
+  return runs.every((run) => run.kind === "preparation" && run.role === "build");
+}
+function scriptNotABuildBecause(manifest, name) {
+  const runs = scriptRuns({
+    scripts: manifest.scripts,
+    dependencies: manifest.dependencies,
+    script: name,
+    lifecycle: false
+  });
+  if (runs.length > 0 && runs.every((run) => runIsDroppable(run) && run.kind !== "test")) {
+    return "it checks the tree rather than writing into it";
+  }
+  const unknown = runs.find((run) => run.kind === "preparation" && run.role === "tool");
+  return unknown === void 0 ? "abloh could not read what it does" : `abloh has no reading of ${unknown.name}, so it cannot say the suite needs it`;
 }
 function clip(command) {
   return command.length > 70 ? `${command.slice(0, 70)}\u2026` : command;
@@ -1334,6 +1361,7 @@ function emptyCiRecipe(refusal) {
     browserLane: null,
     unreadableJobCalls: [],
     refusal,
+    stepsNotCopied: [],
     notices: []
   };
 }
@@ -1359,6 +1387,7 @@ function deriveCiRecipe(input) {
       browserLane: null,
       unreadableJobCalls: [],
       refusal: `your CI configuration could not be read (${error instanceof Error ? error.message : "unknown error"})`,
+      stepsNotCopied: [],
       notices: []
     };
   }
@@ -1385,6 +1414,7 @@ function derive(input) {
     runnerImage: null,
     browserLane: null,
     unreadableJobCalls: calls,
+    stepsNotCopied: [],
     refusal,
     notices: [...bounds, ...notices]
   });
@@ -1598,20 +1628,21 @@ function assemble(input) {
   for (const refused of chosen.refusals) {
     if (!unread.some((seen2) => seen2.step === refused.step && seen2.why === refused.why)) unread.push(refused);
   }
-  const unreadMessage = messageFromFacts({
-    kind: "setup-ci-steps",
-    unread,
+  const stepsRead = {
     workflow: chosen.workflowPath,
     job: chosen.jobId,
     /* THE MAINTAINER'S OWN FILE SAID IT, and `at` is the receipt spelling every other notice in
        this function uses, so a reader meets one name for the job on every line. */
     at: `${chosen.file}::${chosen.jobId}`
-  });
-  if (unreadMessage.kind === "message") {
-    const refusal = unreadMessage.refusal;
-    const rendered = renderRefusal(refusal, "terminal");
+  };
+  const sayStepsRead = (facts2) => {
+    const outcome = messageFromFacts({ kind: "setup-ci-steps", ...stepsRead, ...facts2 });
+    if (outcome.kind !== "message") return;
+    const rendered = renderRefusal(outcome.refusal, "terminal");
     if (rendered !== null) notices.push(refusalLines(rendered).join("\n"));
-  }
+  };
+  sayStepsRead({ unread, notCopied: [] });
+  sayStepsRead({ unread: [], notCopied: [...chosen.notCopied] });
   const drafted = [];
   const seen = /* @__PURE__ */ new Set();
   const push = (step, source) => {
@@ -1838,6 +1869,11 @@ function assemble(input) {
     runnerImage,
     browserLane,
     unreadableJobCalls: input.unreadableJobCalls,
+    /* THE STEPS THE CHOSEN JOB RUNS THAT THE RECIPE LEFT OUT. See {@link CiRecipe.stepsNotCopied}:
+       this is the chosen candidate's own list and never a pooling of every job's, because the
+       recipe is derived from one job and a sentence about another job's steps would name edits to a
+       file abloh is not reading. */
+    stepsNotCopied: chosen.notCopied,
     refusal: null,
     notices
   };
@@ -2052,6 +2088,7 @@ function blankCandidate(file, jobId, label) {
     testSteps: [],
     installs: false,
     refusals: [],
+    notCopied: [],
     refusedTestSteps: [],
     /* A `.travis.yml` or a CircleCI job declares no `env:` block and no `services:` this module has
        a preset for, so the three keys those produce are empty here by construction. */
@@ -2489,6 +2526,7 @@ function readJob(reader, manifest, file, jobId, job, workflowEnv, bounds = []) {
     testSteps: [],
     installs: false,
     refusals: [],
+    notCopied: [],
     refusedTestSteps: [],
     node: null,
     nodeEnv: NO_NODE_ENVIRONMENT,
@@ -2595,6 +2633,15 @@ function readJob(reader, manifest, file, jobId, job, workflowEnv, bounds = []) {
             candidate.refusedTestSteps.push(classified.why);
           }
           break;
+        case "other":
+          if (!candidate.notCopied.some((seen) => seen.command === classified.command)) {
+            candidate.notCopied.push({
+              step: stepNumber(step),
+              command: classified.command,
+              why: classified.why
+            });
+          }
+          break;
         default:
           break;
       }
@@ -2626,1108 +2673,277 @@ function ciRefusalIsActionable(refusal) {
 }
 var __testing = { classifyRepoDefinedBuild, readAptStep, readCiNodeDeclaration };
 
-// src/config-draft.ts
-import { parse as parse2 } from "yaml";
-import {
-  CUSTOMER_TYPED,
-  DeclaredRefusalError,
-  refusalFromFacts,
-  WORKFLOW_FILE_PATH,
-  WORKFLOW_JOB_ID,
-  SEALED_BUN_VERSION,
-  SEALED_DENO_VERSION,
-  SETUP_SCRIPT_PATH,
-  configFlakyLines,
-  installCommandNeedsCorepackEnable,
-  parseLiteralArguments,
-  systemPackageInstallCommand,
-  configHeaderLines,
-  configSettingLines,
-  configSetupJobLines,
-  credentialShapeRefusal,
-  matchesCredentialShape as matchesCredentialShape2,
-  workflowYaml,
-  yamlScalar
-} from "@abloh/core";
-
-// src/init-refusal.ts
-var InitRefusal = class extends Error {
-  failureClass;
-  /**
-   * THE WALK KEY THIS REFUSAL IS ABOUT, where the throw site knows one the class cannot.
-   *
-   * Null on almost every throw, and that is right: the class already implies the key for a refusal
-   * that can only ever be about one - `no-reviewed-image` is `runtimeImage` wherever it is raised,
-   * and `init-refusal-shape.ts` holds that mapping in one table rather than repeating it at forty
-   * throw sites. This field is for the refusals where the class covers SEVERAL keys, which today is
-   * the answers document: `invalid-answers-file` is about whichever key the document got wrong, and
-   * a fix depends on knowing which.
-   */
-  questionKey;
-  /**
-   * THIS REFUSAL'S OWN REMEDY, where the class table's is not true of this instance.
-   *
-   * Null on almost every throw, and that is still right: a per-class remedy is what stops forty
-   * throw sites carrying forty drifting copies of the same sentence. But a CLASS is not always one
-   * situation, and `repository-too-large` is where that broke (external refusal review, rank 15).
-   * Its four throw sites all tell the human to pass `--environment-image`, because the scan they
-   * abandon is the Dockerfile scan and an image is what makes it unnecessary. The class table told
-   * the MACHINE to pass `--subdir`, which narrows nothing: the scan walks the repository root
-   * whatever `--subdir` says. A human and an agent reading the same refusal were sent to different
-   * options, and only one of them could work.
-   *
-   * So a throw site that knows better than its class says so here, and `init-refusal-shape.ts`
-   * prefers it. One refusal instance, one remedy, whoever is reading.
-   */
-  remedy;
-  constructor(failureClass, message, questionKey = null, remedy = null) {
-    super(message);
-    this.name = "InitRefusal";
-    this.failureClass = failureClass;
-    this.questionKey = questionKey;
-    this.remedy = remedy;
+// src/deno-project.ts
+import { lstatSync as lstatSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join4 } from "path";
+import { parseJsonc } from "@abloh/core";
+var DENO_CONFIG_FILES = ["deno.json", "deno.jsonc"];
+var DENO_LOCKFILE = "deno.lock";
+function stageInvokesDenoTest(stage) {
+  const tokens = stage.trim().split(/\s+/u).filter((token) => token !== "");
+  const first = (tokens[0] ?? "").replace(/^.*\//u, "");
+  return first === "deno" && /^deno\s+test(?:\s|$)/u.test(stage.trim());
+}
+function denoTestInvocation(taskBody) {
+  if (taskBody === null) return null;
+  const script = taskBody.trim();
+  if (script === "") return null;
+  if (/[;|<>`$()\n]/u.test(script)) return null;
+  if (/(^|[^&])&([^&]|$)/u.test(script)) return null;
+  const stages = script.split("&&").map((stage) => stage.trim());
+  if (stages.some((stage) => stage === "")) return null;
+  const matches = stages.filter(stageInvokesDenoTest);
+  return matches.length === 1 ? matches[0] : null;
+}
+function readDenoProject(dir, readText = diskReadText) {
+  for (const name of DENO_CONFIG_FILES) {
+    const path = join4(dir, name);
+    const text = readText(path);
+    if (text === null) continue;
+    const parsed = parseJsonc(text);
+    const tasks = parsed?.tasks;
+    const declared = tasks !== null && typeof tasks === "object" ? tasks["test"] : void 0;
+    const body = typeof declared === "string" ? declared : declared !== null && typeof declared === "object" && typeof declared.command === "string" ? declared.command : null;
+    if (body === null || body.trim() === "") return null;
+    return { configFile: name, testTask: body, testInvocation: denoTestInvocation(body) };
   }
-};
-function initRefusal(failureClass, message, questionKey = null, remedy = null) {
-  return new InitRefusal(failureClass, message, questionKey, remedy);
+  return null;
 }
-function refusalRemedyOf(error) {
-  return error instanceof InitRefusal ? error.remedy : null;
+function denoLockfilePath(dir, readText = diskReadText) {
+  return readText(join4(dir, DENO_LOCKFILE)) === null ? null : DENO_LOCKFILE;
 }
-function initFailureClassOf(error) {
-  return error instanceof InitRefusal ? error.failureClass : "unclassified";
+function scriptRunsDenoTest(testScript) {
+  if (testScript === null) return false;
+  return testScript.split(/&&|\|\||[;&|]/u).map((stage) => stage.trim()).some(stageInvokesDenoTest);
+}
+function diskReadText(absolutePath) {
+  try {
+    const info = lstatSync2(absolutePath);
+    if (!info.isFile() || info.isSymbolicLink()) return null;
+    return readFileSync2(absolutePath, "utf8");
+  } catch {
+    return null;
+  }
 }
 
-// src/config-draft.ts
-function commentLines(text, indent, width = 108) {
-  const lines = [];
-  let current = "";
-  for (const word of text.split(/\s+/u).filter((value) => value !== "")) {
-    const candidate = current === "" ? word : `${current} ${word}`;
-    if (`${indent}# ${candidate}`.length > width && current !== "") {
-      lines.push(`${indent}# ${current}`);
-      current = word;
-      continue;
+// src/rush-workspace.ts
+import { parseJsonc as parseJsonc2 } from "@abloh/core";
+var RUSH_CONFIG_FILE = "rush.json";
+var RUSH_TEST_SCRIPTS = ["test", "_phase:test"];
+var RUSH_CONFIG_DIRECTORY = "common/config/rush";
+var RUSH_SUBSPACE_DIRECTORY = "common/config/subspaces";
+var RUSH_LOCKFILE_NAME = "pnpm-lock.yaml";
+var RUSH_REPO_STATE_NAME = "repo-state.json";
+var RUSH_INSTALL_COMMAND = "node common/scripts/install-run-rush.js install";
+var RUSH_INSTALL_SCRIPT = "common/scripts/install-run-rush.js";
+function classifyRushTestScript(manifest, directory) {
+  const table = manifestScripts2(manifest);
+  for (const script of RUSH_TEST_SCRIPTS) {
+    const body = table[script];
+    if (typeof body !== "string" || body.trim() === "") continue;
+    if (/[;&|<>`\n]|\$\(/u.test(body)) {
+      return {
+        state: "unmeasurable",
+        reason: `the Rush project at ${directory} composes shell commands in its ${script} script rather than running one suite`,
+        remedy: `reduce ${directory}'s ${script} script to one command, or declare a plain "test" script that runs one suite`
+      };
     }
-    current = candidate;
+    return { state: "command", script, command: body.trim() };
   }
-  if (current !== "") lines.push(`${indent}# ${current}`);
-  return lines;
+  return {
+    state: "unmeasurable",
+    reason: `the Rush project at ${directory} declares neither a "test" nor a "_phase:test" script`,
+    remedy: `give ${directory} a "test" or "_phase:test" script in its package.json that runs its tests`
+  };
 }
-function renderEnvironmentBlock(input) {
-  const quote = input.yamlQuote ?? '"';
-  const receiptLinesQ = (entries, indent) => receiptLines(entries, indent, quote);
-  const lines = [];
-  if (input.coverageNote != null) lines.push(...commentLines(input.coverageNote, "", 80), "");
-  if (input.subdir !== null) {
-    lines.push(
-      "# The package measured.",
-      "target:",
-      `  directory: ${yamlScalar(input.subdir, quote)}`,
-      ""
-    );
-  }
-  lines.push(
-    ENVIRONMENT_BLOCK_HEADER,
-    "environment:",
-    ...receiptLinesQ([
-      { key: "runtimeImage", value: input.runtimeImage, receipt: input.evidence.runtimeImage }
-    ], "  "),
-    ...input.runtimes.length === 0 ? [] : [
-      "  runtimes: # pinned runtimes added to the proof image, installed at build time",
-      ...input.runtimes.flatMap((need) => [
-        ...commentLines(need.evidence, "    "),
-        `    - ${yamlScalar(need.runtime, quote)}`
-      ])
-    ],
-    ...input.browser === null ? [] : [
-      ...commentLines(
-        "your suite drives a real browser, so the proof image carries one and the run uses the browser seal - still --network none, reaching 127.0.0.1 and nothing else. Read from: " + input.browser.evidence.join("; "),
-        "  "
-      ),
-      `  browser: ${yamlScalar(input.browser.value, quote)}`
-    ],
-    `  installDirectory: ${yamlScalar(input.installDirectory, quote)}`,
-    ...receiptLinesQ([
-      /* THE POINTER, WHERE FOUR DERIVED KEYS USED TO BE (Kenneth, 2026-08-26). `systemPackages`,
-         `installCommand` and `setupCommands` are the commands that turn a checkout into a tree the
-         suite can run in, and they are now steps in a file the customer owns. What is left in this
-         block is everything that is NOT a command: the image, the directory, the test commands, the
-         services, the variables, the files. The receipt names the script rather than a source file
-         because the script carries a receipt of its own on every step. */
-      {
-        key: "setup",
-        value: input.setupPath ?? SETUP_SCRIPT_PATH,
-        receipt: "written by init and yours to edit. Every cold run executes it step by step"
-      },
-      /* THE ONE THING THE SCRIPT CANNOT SAY, so the file still does: WHY there is no install step
-         in it. A repository with no frozen recipe gets a script with nothing to install, and a
-         reader who only ever opens `abloh.yml` would otherwise see a pointer at a file that quietly
-         does less than they think. The remedy is the same sentence the console prints. */
-      ...input.installCommand === null ? [{ key: "installCommand", value: null, receipt: input.evidence.installCommand }] : [],
-      /* THE ONE RECEIPT THAT GAINS A CLAUSE IN THE FILE TOO, and only on the repositories it is
-         true of. `genericAdapterCost` carries what changed and why the prompt alone was not it. */
-      {
-        key: "testCommand",
-        value: input.testCommand,
-        receipt: testCommandReceipt({
-          evidence: input.evidence.testCommand,
-          cost: input.testCommandCostNote
-        })
-      },
-      /* WRITTEN ONLY WHERE IT SAYS SOMETHING, and its receipt is the whole reason it says anything.
-         See `ConfigInput.runner`: on an uncontested repository the key would restate what
-         `bindPreparedTestCommand` reads off the command one line above, so there is no line and the
-         PROMPT is where the detected runner is shown. Where a candidate was discarded, the line
-         records the decision AND names what was skipped, in the same words the prompt used - which
-         is what makes an unattended init as informed as an interactive one. */
-      ...input.runner === null ? [] : [{ key: "runner", value: input.runner, receipt: input.evidence.runner }],
-      /* THE ANSWER TO THE ONE QUESTION A VITEST REPOSITORY WITH NO COVERAGE PROVIDER IS ASKED.
-         WRITTEN ONLY WHERE SOMEBODY ANSWERED IT, on the same restraint every derived key here
-         follows: absent already means `install`, so a line saying `install` on a repository nobody
-         asked would be a claim about a conversation that never happened. Both answers are written
-         where there WAS one, because the file is where the run reads it. */
-      ...input.coverageProvider === void 0 ? [] : [{
-        key: "coverageProvider",
-        value: input.coverageProvider,
-        receipt: input.coverageProvider === "install" ? "you agreed abloh may stage @vitest/coverage-v8 in the job that measures, into its own cache outside this repository" : "you asked abloh not to install @vitest/coverage-v8, so the changed-line check reports itself as declined"
-      }],
-      ...input.sealedTestCommand !== null || input.sealedNote !== null ? [{
-        key: "sealedTestCommand",
-        value: input.sealedTestCommand,
-        receipt: input.sealedTestCommand === null ? input.sealedNote ?? "" : input.evidence.sealedTestCommand
-      }] : [],
-      /* THE ONE KEY WHOSE ABSENCE PRODUCES A WRONG NUMBER RATHER THAN A REFUSAL, so the file states
-         the finding even when it cannot state a value: a reviewer reading a commented-out
-         `rebuildCommand` beside "these two files say your tests read your build output" has the
-         whole question in front of them, and a file that stayed silent would leave a run reporting
-         every mutant as a survivor with nothing anywhere to explain it. */
-      ...input.rebuild === null ? [] : [{
-        key: "rebuildCommand",
-        value: input.rebuild.value,
-        /* THE KEY IS NAMED IN THE SENTENCE, because a null value renders as a bare comment with
-           no key beside it - and a reader who agrees with the finding then has nothing to type.
-           It is the same rule `installRemedy` follows one key up. */
-        receipt: input.rebuild.value !== null ? input.rebuild.evidence : `${input.rebuild.evidence}. Set rebuildCommand to the build that writes it - this package declares ${input.rebuild.candidates.join(" and ")}. Without one, every planted bug is reported as missed`
-      }]
-    ], "  ")
-  );
-  if (input.services.length > 0) {
-    lines.push(
-      "  services: # fresh instances per proof phase, reachable on localhost exactly as in your CI"
-    );
-    for (const service of input.services) {
-      lines.push(
-        ...commentLines(service.evidence, "    "),
-        `    - name: ${yamlScalar(service.name, quote)}`,
-        `      image: ${yamlScalar(service.image, quote)}`
-      );
-      if (service.env.length > 0) {
-        lines.push("      env: # your workflow's own values; the suite connects with these");
-        for (const entry of service.env) lines.push(`        ${entry.name}: ${yamlScalar(entry.value, quote)}`);
-      }
-      if (service.healthCommand !== null) {
-        lines.push(`      healthCommand: ${yamlScalar(service.healthCommand, quote)}`);
-      }
-      if (service.healthPort !== null) lines.push(`      healthPort: ${service.healthPort}`);
-      if (service.localhostPort != null && service.localhostPort !== service.healthPort) {
-        lines.push(
-          `      localhostPort: ${service.localhostPort} # another declared service listens on this one's port, so a run reaches it here`
-        );
-      }
+function manifestScripts2(manifest) {
+  const scripts = manifest?.scripts;
+  return scripts !== null && typeof scripts === "object" ? scripts : {};
+}
+function enumerateRushProjects(readFile, limit) {
+  const parsed = parseJsonc2(readFile(RUSH_CONFIG_FILE));
+  const declared = parsed?.projects;
+  if (!Array.isArray(declared)) return [];
+  const projects = [];
+  for (const entry of declared) {
+    if (entry === null || typeof entry !== "object") continue;
+    const name = entry.packageName;
+    const folder = entry.projectFolder;
+    if (typeof name !== "string" || typeof folder !== "string") continue;
+    const directory = normalizeProjectFolder(folder);
+    if (directory === null) continue;
+    const manifestPath = `${directory}/package.json`;
+    const manifestText = readFile(manifestPath);
+    if (manifestText === null) {
+      projects.push({
+        directory,
+        name,
+        test: {
+          state: "unmeasurable",
+          // Enumerated even so: the directory must not be silently absorbed into a parent's file
+          // list, which would attribute this project's changed files to another project.
+          reason: `the Rush project ${name} declares the folder ${directory}, which has no readable package.json`,
+          remedy: `add ${manifestPath}, or remove ${name} from rush.json's projects`
+        }
+      });
+      continue;
     }
+    const manifest = parseJsonc2(manifestText);
+    projects.push({
+      directory,
+      name,
+      test: manifest === null ? {
+        state: "unmeasurable",
+        reason: `the Rush project ${name}'s manifest at ${manifestPath} is not readable JSON`,
+        remedy: `fix ${manifestPath} so its manifest parses`
+      } : classifyRushTestScript(manifest, directory)
+    });
+    if (projects.length >= limit) break;
   }
-  if (input.identityFiles.length > 0) {
-    lines.push("  identityFiles: # a change here triggers reinstall instead of container reuse");
-    for (const path of input.identityFiles) lines.push(`    - ${yamlScalar(path, quote)}`);
-  }
-  if (input.requiredVariables.length > 0) {
-    lines.push("  requiredVariables: # names only; values come from your environment and are masked in every log");
-    for (const variable of input.requiredVariables) {
-      lines.push(...commentLines(variable.evidence, "    "), `    - ${yamlScalar(variable.name, quote)}`);
+  return projects.sort((a, b) => a.directory < b.directory ? -1 : a.directory > b.directory ? 1 : 0);
+}
+function normalizeProjectFolder(raw) {
+  const path = raw.trim().replace(/\\/gu, "/").replace(/^\.\//u, "").replace(/\/+$/u, "");
+  if (path === "" || path.startsWith("/") || /^[A-Za-z]:/u.test(path)) return null;
+  if (/[;&|<>`\s'"$]|\$\(/u.test(path)) return null;
+  if (path.split("/").some((segment) => segment === "..")) return null;
+  return path;
+}
+function rushIdentityFiles(input) {
+  const files = [RUSH_CONFIG_FILE];
+  const collect = (directory) => {
+    for (const name of [RUSH_LOCKFILE_NAME, RUSH_REPO_STATE_NAME]) {
+      const path = `${directory}/${name}`;
+      if (input.exists(path)) files.push(path);
     }
+  };
+  collect(RUSH_CONFIG_DIRECTORY);
+  for (const subspace of [...input.subdirectories(RUSH_SUBSPACE_DIRECTORY)].sort()) {
+    collect(`${RUSH_SUBSPACE_DIRECTORY}/${subspace}`);
   }
-  if (input.environmentValues.length > 0) {
-    for (const variable of input.environmentValues) {
-      const shape = matchesCredentialShape2(variable.value);
-      if (shape !== null) throw initRefusal("credential-in-environment-value", credentialShapeRefusal(variable.name, shape));
-    }
-    lines.push("  environmentValues: # literal values your CI sets; a secret goes in requiredVariables, by name");
-    for (const variable of input.environmentValues) {
-      lines.push(
-        ...commentLines(variable.evidence, "    "),
-        `    ${variable.name}: ${yamlScalar(variable.value, quote)}`
-      );
-    }
+  return files;
+}
+function rushLockfiles(input) {
+  return rushIdentityFiles(input).filter((path) => path.endsWith(`/${RUSH_LOCKFILE_NAME}`));
+}
+function rushNodeVersionRange(rushJsonText) {
+  const parsed = parseJsonc2(rushJsonText);
+  const range = parsed?.nodeSupportedVersionRange;
+  return typeof range === "string" && range.trim() !== "" ? range.trim() : null;
+}
+
+// src/workspace-aggregator.ts
+import { SCRIPT_NAMED_RUNNERS as SCRIPT_NAMED_RUNNERS2, binaryName, planCommand as planCommand2 } from "@abloh/core";
+function invokedProgram(command) {
+  const plan = planCommand2(command);
+  if (plan.kind === "program") return { program: plan.program, args: plan.args };
+  if (plan.kind === "manager-passthrough" && plan.token !== null) {
+    return { program: binaryName(plan.token), args: plan.args };
   }
-  if (input.generatedFiles.length > 0) {
-    lines.push("  generatedFiles: # written by your tooling during a run; an undeclared change aborts it");
-    for (const generated of input.generatedFiles) {
-      lines.push(...commentLines(generated.evidence, "    "), `    - ${yamlScalar(generated.path, quote)}`);
+  return null;
+}
+var TOOLS = ["turbo", "lage", "nx", "lerna"];
+function nxTargets(args) {
+  const targets = [];
+  for (let at = 0; at < args.length; at += 1) {
+    const arg = args[at];
+    const inline = /^(?:-t|--targets?)=(.+)$/u.exec(arg);
+    if (inline !== null) {
+      targets.push(...inline[1].split(","));
+      continue;
     }
-  }
-  if (input.rewrittenFiles.length > 0) {
-    lines.push("  rewrittenFiles: # committed files your own install rewrites; measured as your install left them");
-    for (const rewritten of input.rewrittenFiles) {
-      lines.push(...commentLines(rewritten.evidence, "    "), `    - ${yamlScalar(rewritten.path, quote)}`);
+    if (/^(?:-t|--targets?)$/u.test(arg)) {
+      const value = args[at + 1];
+      if (value !== void 0 && !value.startsWith("-")) {
+        targets.push(...value.split(","));
+        at += 1;
+      }
     }
   }
-  return lines;
+  return targets.filter((task) => task !== "");
 }
-function renderConfig(input) {
-  const coverage = input.coverageNote == null ? [] : [...commentLines(input.coverageNote, "", 80), ""];
-  const lines = [
-    ...coverage,
-    ...configHeaderLines("init"),
-    ...configSettingLines(),
-    /* AFTER THE TWO SETTINGS EVERY FILE CARRIES AND BEFORE THE JOB, because it is a setting of the
-       same kind - a rule about the whole run rather than a fact about this repository's CI. */
-    ...configFlakyLines(input.flaky),
-    /* BEFORE THE ENVIRONMENT BLOCK, because it is the shortest answer to the first question a
-       reviewer of this pull request asks - "which of our jobs is this running in" - and the
-       environment block below is the long answer to a different one. */
-    ...configSetupJobLines(
-      input.setupJob,
-      input.setupMatrixLeg,
-      input.setupFailFast,
-      input.setupStepUnreadableConditions,
-      input.yamlQuote ?? '"'
-    ),
-    ...renderEnvironmentBlock({ ...input, coverageNote: null })
-  ];
-  return `${lines.join("\n")}
-`;
-}
-function renderWorkflow(input) {
-  return readableWorkflow(workflowYaml({
-    node: input.workflowNode,
-    /* THE ONE RECIPE, NAMED. `environment.setup` when the repository declares its own path, so a
-       re-run of `init` over a customer's chosen path writes a workflow that calls that path. */
-    setupScriptPath: input.setupPath ?? SETUP_SCRIPT_PATH,
-    /* The same directory the sealed image runs those steps in - `installWorkdir` in the runner -
-       because a recipe that installs in one directory on the runner and another in the proof image
-       is two recipes again. */
-    setupWorkingDirectory: input.installDirectory,
-    runtimes: input.runtimes.map((need) => ({
-      name: need.runtime,
-      version: need.runtime === "bun" ? SEALED_BUN_VERSION : SEALED_DENO_VERSION,
-      evidence: need.evidence
-    }))
-  }));
-}
-function readableWorkflow(text) {
-  try {
-    parse2(text);
-  } catch (error) {
-    throw new DeclaredRefusalError(refusalFromFacts({
-      kind: "setup-step-written",
-      workflow: WORKFLOW_FILE_PATH,
-      job: WORKFLOW_JOB_ID,
-      why: `it does not parse as YAML: ${error instanceof Error ? error.message : "unknown error"}`
-    }));
-  }
-  return text;
-}
-function testCommandReceipt(input) {
-  return input.cost == null ? input.evidence : `${input.evidence}. ${input.cost}`;
-}
-function receiptLines(entries, indent, quote) {
-  const bodyOf = (entry) => entry.value === null ? null : `${indent}${entry.key}: ${yamlScalar(entry.value, quote)}`;
-  const itemBody = (item) => `${indent}  - ${yamlScalar(item.value, quote)}`;
-  const withReceipt = (body, receipt) => `${body} # ${receipt}`;
-  const lines = [];
-  for (const entry of entries) {
-    if (entry.items !== void 0) {
-      if (entry.items.length === 0) continue;
-      lines.push(`${indent}${entry.key}:${entry.receipt === "" ? "" : ` # ${entry.receipt}`}`);
-      for (const item of entry.items) lines.push(withReceipt(itemBody(item), item.receipt));
-      continue;
-    }
-    const body = bodyOf(entry);
-    if (body === null) {
-      if (entry.receipt !== "") lines.push(`${indent}# ${entry.key}: ${entry.receipt}`);
-      continue;
+function aggregatorInvocation(testScript) {
+  if (testScript === null) return null;
+  const script = testScript.trim();
+  if (script === "" || /[;&|<>`\n]|\$\(/u.test(script)) return null;
+  const invoked = invokedProgram(script);
+  if (invoked === null) return null;
+  const tool = TOOLS.find((candidate) => candidate === invoked.program);
+  if (tool === void 0) return null;
+  const args = invoked.args;
+  if (tool === "nx") {
+    const explicit = nxTargets(args);
+    if (explicit.length > 0) return { tool, tasks: explicit };
+    const positional = args.filter((arg) => !arg.startsWith("-"));
+    const head = positional[0];
+    if (head === void 0) return { tool, tasks: [] };
+    if (head === "run-many" || head === "affected") return { tool, tasks: [] };
+    if (head === "run") {
+      const target = positional[1]?.split(":")[1];
+      return { tool, tasks: target === void 0 ? [] : [target] };
     }
-    lines.push(withReceipt(body, entry.receipt));
+    return { tool, tasks: [head] };
   }
-  return lines;
-}
-var ENVIRONMENT_BLOCK_HEADER = "# Rebuild recipe for the proof container. Comments name the source file.";
-var STEP_WHAT = {
-  systemPackages: "OS packages your suite needs, pinned",
-  corepack: "put the package manager on PATH, for your own lifecycle scripts",
-  install: "dependencies, from your lockfile",
-  /**
-   * THE SAME STEP ON A REPOSITORY THAT CARRIES NO LOCKFILE (census run 7 F3, 2026-09-06).
-   *
-   * A SECOND SPELLING RATHER THAN A REWORD, on the rule above: `install`'s exact text is what a
-   * re-run recognizes as its own step, so changing it would orphan every install step already
-   * committed. Both are install steps to {@link initStepRole} and to {@link isInstallStep}, which is
-   * what every reader asks instead of comparing against one of them.
-   *
-   * IT EXISTS BECAUSE THE OTHER ONE WOULD BE FALSE. `fastify/fastify` and `pinojs/pino` both
-   * `.gitignore` their lockfile, so the drafted step resolves rather than installing frozen, and a
-   * comment saying "from your lockfile" above a command that has none is a claim the file cannot
-   * back. The `source` beside it names the ignore rule.
-   */
-  installUnlocked: "dependencies, resolved - your repository commits no lockfile",
-  build: "your build"
-};
-function isInstallStep(what) {
-  return what === STEP_WHAT.install || what === STEP_WHAT.installUnlocked;
-}
-function setupStepOrigin(step) {
-  return initStepRole(step.what) === null ? CUSTOMER_TYPED : "abloh-derived";
+  if (tool === "lerna") {
+    const positional = args.filter((arg) => !arg.startsWith("-"));
+    if (positional[0] !== "run") return null;
+    const leading2 = positional.slice(1, 2);
+    return { tool, tasks: leading2 };
+  }
+  const leading = args.slice(0, args.findIndex((arg) => arg.startsWith("-")) === -1 ? args.length : args.findIndex((arg) => arg.startsWith("-")));
+  const tasks = leading[0] === "run" ? leading.slice(1) : leading;
+  return { tool, tasks };
 }
-function initStepRole(what) {
-  if (what === STEP_WHAT.systemPackages) return "systemPackages";
-  if (what === STEP_WHAT.corepack || isInstallStep(what)) return "installCommand";
-  if (what === STEP_WHAT.build) return "setupCommands";
-  return null;
+function aggregatorTaskPhrase(invocation) {
+  if (invocation.tasks.length === 0) return "the tasks its own configuration selects";
+  const named = invocation.tasks.length < 3 ? invocation.tasks.join(" and ") : `${invocation.tasks.slice(0, -1).join(", ")} and ${invocation.tasks.at(-1)}`;
+  return `each package's own ${named} script${invocation.tasks.length === 1 ? "" : "s"}`;
 }
-function systemPackagesStep(pinned) {
-  if (pinned.length === 0) return null;
-  return {
-    what: STEP_WHAT.systemPackages,
-    source: [...new Set(pinned.map((entry) => entry.source))].join(", "),
-    /* THE SAME COMMAND THE IMAGE ALREADY RAN, one line per operation rather than one semicolon
-       chain, because this file is read by a person now. `set -e` is in the header, so the chain's
-       own guard is redundant here and its semicolons are noise. */
-    command: systemPackageInstallCommand(pinned, { pin: "optional" }).replace(/^set -e;\s*/u, "").split(";").map((part) => part.trim()).filter((part) => part !== "").join("\n")
-  };
+var ROOT_CONFIG_EXECUTORS = /* @__PURE__ */ new Map([
+  // Every spelling read out of a real repository on 2026-08-16: `@nx/jest:jest` is what ngxs/store
+  // and nrwl/nx-labs declare, `@nx/vitest:test` is what analogjs/analog declares, and the `@nrwl/*`
+  // names are the pre-16 package scope the same executors shipped under.
+  ["@nx/jest:jest", { runner: "jest", configOption: "jestConfig" }],
+  ["@nrwl/jest:jest", { runner: "jest", configOption: "jestConfig" }],
+  ["@nx/vite:test", { runner: "vitest", configOption: "configFile" }],
+  ["@nx/vitest:test", { runner: "vitest", configOption: "configFile" }],
+  ["@nrwl/vite:test", { runner: "vitest", configOption: "configFile" }]
+]);
+function workspaceRootCommand(runner, configFile, directory) {
+  return runner === "jest" ? `npx --no-install jest --config ${configFile}` : `npx --no-install vitest run --root ${directory} --config ${configFile}`;
 }
-function stepBody(env, command) {
-  if (env.length === 0) return command;
-  return [
-    ...[...env].sort((left, right) => left.name.localeCompare(right.name)).map((value) => `export ${value.name}=${shellSingleQuoted(value.value)}`),
-    command
-  ].join("\n");
+var RUN_COMMANDS_EXECUTORS = /* @__PURE__ */ new Set(["nx:run-commands", "@nrwl/workspace:run-commands"]);
+function commandRunner(command) {
+  const plan = planCommand2(command);
+  if (plan.kind === "node-test") return "node-test";
+  if (plan.kind === "runner") return plan.runner;
+  const invoked = invokedProgram(command);
+  if (invoked === null) return null;
+  return SCRIPT_NAMED_RUNNERS2.includes(invoked.program) ? invoked.program : null;
 }
-function shellSingleQuoted(value) {
-  return `'${value.replaceAll("'", `'\\''`)}'`;
+function normalizeWorkspacePath(raw) {
+  const path = raw.trim().replace(/\\/gu, "/").replace(/^\.\//u, "").replace(/\/+$/u, "");
+  if (path === "" || path.startsWith("/") || /^[A-Za-z]:/u.test(path)) return null;
+  if (/[;&|<>`\s'"$]|\$\(/u.test(path)) return null;
+  if (path.split("/").some((segment) => segment === "..")) return null;
+  return path;
 }
-function setupScriptSteps(input) {
-  const steps = [];
-  const pinned = systemPackagesStep(input.systemPackages);
-  if (pinned !== null) steps.push(pinned);
-  if (input.installCommand !== null) {
-    if (installCommandNeedsCorepackEnable(parseLiteralArguments(input.installCommand))) {
-      steps.push({
-        what: STEP_WHAT.corepack,
-        source: input.evidence.installCommand,
-        command: "corepack enable"
-      });
-    }
-    steps.push({
-      /* The step and its comment are one statement: a resolved install may not be introduced as
-         coming from a lockfile the commit does not hold. See {@link ConfigInput.installUnlocked}. */
-      what: input.installUnlocked === true ? STEP_WHAT.installUnlocked : STEP_WHAT.install,
-      source: input.evidence.installCommand,
-      /* THE COMMAND IS ABLOH'S AND THE ENVIRONMENT IS THE CUSTOMER'S. See
-         {@link ConfigInput.installEnvironment}: the command comes from the lockfile and the values
-         come from the step their own CI installs with. */
-      command: stepBody(input.installEnvironment, input.installCommand)
-    });
-  }
-  for (const entry of input.setupCommands) {
-    steps.push({ what: STEP_WHAT.build, source: entry.source, command: stepBody(entry.env, entry.command) });
+function classifyNxTestTarget(projectJson, directory) {
+  const targets = projectJson?.targets ?? projectJson?.architect;
+  const target = targets?.["test"];
+  if (target === void 0) {
+    return {
+      state: "unmeasurable",
+      reason: `the Nx project at ${directory} declares no test target`,
+      remedy: `give ${directory} a test target in its project.json, or a "test" script in its package.json`
+    };
   }
-  return steps;
-}
-
-// src/setup-question-descriptor.ts
-import {
-  judgeConfigKeyValue,
-  SETUP_FAIL_FAST_ANSWERS,
-  SETUP_FAIL_FAST_CONSEQUENCES
-} from "@abloh/core";
-var ATOM = /\s*,\s*/u;
-var COMMANDS = /\s*&&\s*/u;
-function splitAnswerList(shape, raw) {
-  const trimmed = raw.trim();
-  if (trimmed === "") return [];
-  return trimmed.split(shape.kind === "commands" ? COMMANDS : ATOM).map((entry) => entry.trim()).filter((entry) => entry !== "");
-}
-function splitAtFirstEquals(entry) {
-  const at = entry.indexOf("=");
-  return at === -1 ? [entry, null] : [entry.slice(0, at), entry.slice(at + 1)];
-}
-var SERVICE_ENTRY = /^(?<image>.*@sha256:[a-f0-9]{64})(?::(?<port>\d{1,5}))?$/u;
-function readServiceEntries(raw) {
-  return splitAnswerList({ kind: "list" }, raw).map((entry) => {
-    const [name, rest] = splitAtFirstEquals(entry);
-    const gate = rest === null ? null : SERVICE_ENTRY.exec(rest);
-    if (gate === null) return { name, image: rest ?? "" };
-    const port = gate.groups?.["port"];
+  const executor = typeof target.executor === "string" ? target.executor : typeof target.builder === "string" ? target.builder : null;
+  if (executor === null) {
     return {
-      name,
-      image: gate.groups?.["image"] ?? "",
-      ...port === void 0 ? {} : { healthPort: Number(port) }
-    };
-  });
-}
-function readAnswerValue(descriptor, raw) {
-  switch (descriptor.shape.kind) {
-    case "scalar":
-      return raw.trim();
-    case "list":
-      return splitAnswerList(descriptor.shape, raw);
-    case "commands":
-      return splitAnswerList(descriptor.shape, raw);
-    case "names":
-      return splitAnswerList(descriptor.shape, raw);
-    case "packages":
-      return splitAnswerList(descriptor.shape, raw).map((entry) => {
-        const [name, version] = splitAtFirstEquals(entry);
-        return version === null ? { name } : { name, version };
-      });
-    case "services":
-      return readServiceEntries(raw);
-    case "pairs":
-      return Object.fromEntries(
-        splitAnswerList(descriptor.shape, raw).map((entry) => {
-          const [name, value] = splitAtFirstEquals(entry);
-          return [name, value ?? ""];
-        })
-      );
-  }
-}
-function setupAnswerProblem(key, raw) {
-  const descriptor = SETUP_QUESTION_DESCRIPTORS[key];
-  if (descriptor === void 0) return `abloh asks no question about ${key}`;
-  const value = raw.trim();
-  if (value === "") return descriptor.required ? "this question needs an answer" : null;
-  if (descriptor.candidates.length > 0 && !descriptor.candidates.includes(value)) {
-    return `${value} is not one of ${descriptor.candidates.join(", ")}`;
-  }
-  if (descriptor.key !== "target.directory" && descriptor.channel === "discovery") return null;
-  const verdict = judgeConfigKeyValue(key, readAnswerValue(descriptor, raw));
-  if (verdict.ok) return null;
-  return verdict.at === null || verdict.at === void 0 ? verdict.reason : `${verdict.at} ${verdict.reason}`;
-}
-function applyAnswersToContract(draft, answers) {
-  let out = draft;
-  for (const descriptor of Object.values(SETUP_QUESTION_DESCRIPTORS)) {
-    if (descriptor.apply === void 0) continue;
-    const raw = answers[descriptor.key];
-    if (raw === void 0 || raw.trim() === "") continue;
-    out = descriptor.apply(out, raw);
-  }
-  return out;
-}
-var ANSWERED_EVIDENCE = "you answered this when you set abloh up";
-function evidenceFor(entries) {
-  return entries.map((path) => ({ path, evidence: ANSWERED_EVIDENCE }));
-}
-var SETUP_QUESTION_DESCRIPTORS = {
-  "environment.installCommand": {
-    key: "environment.installCommand",
-    ask: "How does this repository install its dependencies?",
-    why: "Abloh read your CI without running it, so it saw the command your workflow declares and not what your install actually writes. On the borrow road your own job installs and Abloh measures inside it, so this is only needed when Abloh builds for itself.",
-    candidates: [],
-    required: false,
-    unreadable: true,
-    shape: { kind: "scalar" },
-    channel: "contract",
-    apply: (draft, answer) => ({
-      ...draft,
-      installCommand: answer.trim(),
-      evidence: { ...draft.evidence, installCommand: ANSWERED_EVIDENCE }
-    })
-  },
-  "environment.setupCommands": {
-    key: "environment.setupCommands",
-    ask: "What does this repository build between installing and testing?",
-    why: "Abloh read the build steps out of the job it rides. A step it could not read is one the proof container never runs, and a suite that needs it then fails inside abloh rather than in your CI.",
-    candidates: [],
-    required: true,
-    /* ONE STEP PER ` && `, WHICH IS THE ONE KEY THAT IS NOT COMMA-SEPARATED and the CLI's prompt says
-       so for the same reason: a comma is an ordinary character inside a command, and a build is read
-       top to bottom. `splitAnswerList` is the one grammar both roads ask. */
-    shape: { kind: "commands" },
-    channel: "contract",
-    apply: (draft, answer) => ({
-      ...draft,
-      setupCommands: splitAnswerList({ kind: "commands" }, answer).map((command) => ({
-        command,
-        source: ANSWERED_EVIDENCE,
-        /* A COMMAND SOMEBODY TYPED CARRIES THE ENVIRONMENT THEY TYPED INTO IT. `CiSetupCommand.env`
-           is the environment abloh READ off a workflow step, so an answered command has none: what
-           the answer says is the whole of what this command runs. */
-        env: []
-      }))
-    })
-  },
-  "environment.runtimeImage": {
-    key: "environment.runtimeImage",
-    ask: "Which image should Abloh build its proof container from?",
-    why: "Abloh pins one by pulling it and reading its digest, which needs a machine. Left unanswered, a run uses the reviewed default for the Node your repository declares.",
-    candidates: [],
-    required: false,
-    unreadable: true,
-    shape: { kind: "scalar" },
-    channel: "contract",
-    apply: (draft, answer) => ({
-      ...draft,
-      runtimeImage: answer.trim(),
-      evidence: { ...draft.evidence, runtimeImage: ANSWERED_EVIDENCE }
-    })
-  },
-  "setup.job": {
-    key: "setup.job",
-    ask: "Which job should abloh measure in?",
-    why: "Everything else in the contract is read out of that one job.",
-    candidates: [],
-    required: true,
-    shape: { kind: "scalar" },
-    channel: "discovery"
-  },
-  "setup.matrixLeg": {
-    key: "setup.matrixLeg",
-    ask: "Which leg of that job's matrix?",
-    why: "The job abloh rides fans out, and a leg names one value per dimension of it.",
-    candidates: [],
-    required: true,
-    shape: { kind: "scalar" },
-    channel: "discovery"
-  },
-  "setup.failFast": {
-    key: "setup.failFast",
-    ask: "That job cancels every matrix leg when one fails. May abloh turn that off for it?",
-    /* THE VALUES THE CONTRACT ACCEPTS, on `flaky`'s own rule: the card writes the chosen candidate
-       into `abloh.yml`, so a candidate that read well and parsed badly would be a form that writes an
-       invalid file. What each one MEANS is the ask above it. */
-    why: SETUP_FAIL_FAST_ANSWERS.map((answer) => `${answer} ${SETUP_FAIL_FAST_CONSEQUENCES[answer]}.`).join(" "),
-    candidates: SETUP_FAIL_FAST_ANSWERS,
-    required: true,
-    shape: { kind: "scalar" },
-    /* A LINE IN THE FILE AND NOT A RE-DERIVATION. It does not move which job the recipe is read out
-       of - it is the maintainer's standing answer about the job already chosen - and
-       `configSetupJobLines` writes it on every road, with or without a job, because it is the one
-       statement in that block that was never abloh's to discard. */
-    channel: "contract",
-    apply: (draft, answer) => ({ ...draft, setupFailFast: answer.trim() })
-  },
-  flaky: {
-    key: "flaky",
-    ask: "Your suite was red on untouched code. What should abloh do about those tests?",
-    /* THE VALUES THE CONTRACT ACCEPTS, not a prose label: the card writes the chosen candidate into
-       `abloh.yml`, so a candidate that read well and parsed badly would be a form that writes an
-       invalid file. What each one MEANS is the ask above it. */
-    why: "quarantine sets them aside and measures the rest. strict measures nothing until they pass.",
-    candidates: ["quarantine", "strict"],
-    required: true,
-    shape: { kind: "scalar" },
-    channel: "contract",
-    /* `quarantine` WRITES NO LINE and that is not the answer being dropped: it is what a file with
-       no `flaky:` key already means, which `configFlakyLines` states at the renderer. */
-    apply: (draft, answer) => ({ ...draft, flaky: answer.trim() })
-  },
-  "environment.testCommand": {
-    key: "environment.testCommand",
-    ask: "Which command runs your tests?",
-    why: "Abloh read your CI without running it, and the command it found did not run a suite it could observe.",
-    candidates: [],
-    required: true,
-    shape: { kind: "scalar" },
-    channel: "contract",
-    apply: (draft, answer) => ({ ...draft, testCommand: answer.trim() })
-  },
-  "environment.sealedTestCommand": {
-    key: "environment.sealedTestCommand",
-    ask: "Which command runs your tests inside abloh's proof container?",
-    why: "Your own test script did something abloh's container could not, so it needs the runner on its own.",
-    candidates: [],
-    required: true,
-    shape: { kind: "scalar" },
-    channel: "contract",
-    apply: (draft, answer) => ({ ...draft, sealedTestCommand: answer.trim() })
-  },
-  "environment.rebuildCommand": {
-    key: "environment.rebuildCommand",
-    ask: "Which command builds the output your tests import?",
-    why: "Your tests read compiled output rather than the source abloh plants in, so without the build every planted bug is reported as missed. Abloh cannot resolve which of your build scripts writes it from your files alone.",
-    candidates: [],
-    required: true,
-    shape: { kind: "scalar" },
-    channel: "contract",
-    /* THE CANDIDATES AND THE MANAGER SURVIVE THE ANSWER, because they are the drafting's reading of
-       this repository and the answer is a value: a run that later clears the value would otherwise
-       lose the finding that made the key worth writing. Absent, they are the empty pair, which is
-       what a draft that found no build script already carries. */
-    apply: (draft, answer) => ({
-      ...draft,
-      rebuild: {
-        ...draft.rebuild ?? { candidates: [], manager: "" },
-        value: answer.trim(),
-        evidence: ANSWERED_EVIDENCE
-      }
-    })
-  },
-  "target.directory": {
-    key: "target.directory",
-    ask: "Which package should abloh measure?",
-    why: "This repository holds several, and a run measures one.",
-    candidates: [],
-    required: true,
-    shape: { kind: "scalar" },
-    /* A DISCOVERY ANSWER AND NOT A LINE. The runner, the test command and the whole measurement plan
-       are read out of the package being measured, so writing this key over a draft derived from the
-       root would leave every sibling value describing a different package. It goes back through
-       `resolveMeasurementPlan` as its `subdir`, exactly as the job pin goes back through the job. */
-    channel: "discovery"
-  },
-  "environment.coverageProvider": {
-    key: "environment.coverageProvider",
-    ask: "May abloh install the coverage provider your runner needs?",
-    why: "Your tree does not carry one, and without it abloh cannot say which of your changed lines your tests execute.",
-    candidates: ["install", "skip"],
-    required: true,
-    shape: { kind: "scalar" },
-    channel: "contract",
-    /* WRITTEN FOR BOTH ANSWERS, because a recorded answer is the difference between a maintainer
-       who chose the default and one who was never asked - see `ConfigInput.coverageProvider`. */
-    apply: (draft, answer) => ({ ...draft, coverageProvider: answer.trim() })
-  },
-  "environment.requiredVariables": {
-    key: "environment.requiredVariables",
-    ask: "Which environment variables does your suite need?",
-    why: "Names only. The values come from your own environment and are masked in every log.",
-    candidates: [],
-    required: true,
-    shape: { kind: "names" },
-    channel: "contract",
-    apply: (draft, answer) => ({
-      ...draft,
-      requiredVariables: splitAnswerList({ kind: "names" }, answer).map((name) => ({
-        name,
-        evidence: ANSWERED_EVIDENCE
-      }))
-    })
-  },
-  "environment.environmentValues": {
-    key: "environment.environmentValues",
-    ask: "Which literal values does your suite need in its environment?",
-    why: "A secret goes in requiredVariables by name instead, and never here.",
-    candidates: [],
-    required: true,
-    shape: { kind: "pairs" },
-    channel: "contract",
-    apply: (draft, answer) => ({
-      ...draft,
-      environmentValues: splitAnswerList({ kind: "pairs" }, answer).map((entry) => {
-        const [name, value] = splitAtFirstEquals(entry);
-        return { name, value: value ?? "", evidence: ANSWERED_EVIDENCE };
-      })
-    })
-  },
-  "environment.generatedFiles": {
-    key: "environment.generatedFiles",
-    ask: "Which directories does your own tooling write during a run?",
-    why: "An undeclared change to the checkout aborts a run, and abloh cannot tell yours from a stray one.",
-    candidates: [],
-    required: true,
-    shape: { kind: "list" },
-    channel: "contract",
-    apply: (draft, answer) => ({
-      ...draft,
-      generatedFiles: evidenceFor(splitAnswerList({ kind: "list" }, answer))
-    })
-  },
-  "environment.rewrittenFiles": {
-    key: "environment.rewrittenFiles",
-    ask: "Which committed files does your own install rewrite?",
-    why: "A rate measured over bytes your install changed is a rate about something else.",
-    candidates: [],
-    required: true,
-    shape: { kind: "list" },
-    channel: "contract",
-    apply: (draft, answer) => ({
-      ...draft,
-      rewrittenFiles: evidenceFor(splitAnswerList({ kind: "list" }, answer))
-    })
-  },
-  "environment.identityFiles": {
-    key: "environment.identityFiles",
-    ask: "Which files should a change to reinstall rather than reuse the container?",
-    why: "Abloh reuses a prepared container between runs unless one of these moved.",
-    candidates: [],
-    required: true,
-    shape: { kind: "list" },
-    channel: "contract",
-    apply: (draft, answer) => ({
-      ...draft,
-      identityFiles: splitAnswerList({ kind: "list" }, answer)
-    })
-  },
-  "environment.systemPackages": {
-    key: "environment.systemPackages",
-    ask: "Which OS packages does your build need?",
-    why: "The reviewed proof image is slim, so a native dependency that compiles on install needs its toolchain named.",
-    candidates: [],
-    required: true,
-    shape: { kind: "packages" },
-    channel: "contract",
-    apply: (draft, answer) => ({
-      ...draft,
-      systemPackages: splitAnswerList({ kind: "packages" }, answer).map((entry) => {
-        const [name, version] = splitAtFirstEquals(entry);
-        return { name, version, source: ANSWERED_EVIDENCE };
-      })
-    })
-  },
-  "environment.runtimes": {
-    key: "environment.runtimes",
-    ask: "Which runtimes beyond Node does your suite need?",
-    /* NO CLOSED CANDIDATE LIST, because this key takes SEVERAL: `setupAnswerProblem` compares a
-       closed list against the WHOLE answer, so `bun, deno` would be refused by a two-word list that
-       accepts each of them alone. `judgeConfigKeyValue` names the two the contract holds, entry by
-       entry, which is the reading that fits a list. */
-    why: "The proof image carries Node. A runtime your tests reach for and the image does not carry fails inside abloh rather than in your CI.",
-    candidates: [],
-    required: true,
-    shape: { kind: "names" },
-    channel: "contract",
-    apply: (draft, answer) => ({
-      ...draft,
-      runtimes: splitAnswerList({ kind: "names" }, answer).map((runtime) => ({
-        runtime,
-        evidence: ANSWERED_EVIDENCE
-      }))
-    })
-  },
-  "environment.services": {
-    key: "environment.services",
-    ask: "Which backing services does your suite need, and where is each one ready?",
-    why: "A proof runs in the same network namespace as its services, so your suite reaches them on localhost exactly as in your CI. Abloh pins the image by digest because a mutable tag cannot be part of what a run binds, and each service needs something to wait on before the suite starts.",
-    candidates: [],
-    required: true,
-    shape: { kind: "services" },
-    channel: "contract",
-    /* THE ENVIRONMENT IS NOT TYPED HERE and the entry says so at {@link SERVICE_ENTRY}: an image that
-       needs credentials fails its readiness gate and reports that, which is the same narrow door the
-       CLI's own typed entry goes through. */
-    apply: (draft, answer) => ({
-      ...draft,
-      services: readServiceEntries(answer).map((service) => ({
-        name: service.name,
-        spelling: `${service.name}=${service.image}`,
-        image: service.image,
-        env: [],
-        healthCommand: null,
-        healthPort: service.healthPort ?? null,
-        source: ANSWERED_EVIDENCE,
-        evidence: ANSWERED_EVIDENCE
-      }))
-    })
-  },
-  "environment.installDirectory": {
-    key: "environment.installDirectory",
-    ask: "Which directory owns the lockfile your install reads?",
-    why: "A workspace package installs from the root that holds its lockfile, not from its own folder.",
-    candidates: [],
-    required: false,
-    shape: { kind: "scalar" },
-    channel: "contract",
-    apply: (draft, answer) => ({ ...draft, installDirectory: answer.trim() })
-  },
-  "environment.runner": {
-    key: "environment.runner",
-    ask: "Which test runner does this repository use?",
-    why: "Abloh reads it from your own command, and a declaration outranks that reading.",
-    candidates: [],
-    required: false,
-    shape: { kind: "scalar" },
-    channel: "contract",
-    apply: (draft, answer) => ({
-      ...draft,
-      runner: answer.trim(),
-      boundRunner: answer.trim(),
-      evidence: { ...draft.evidence, runner: "declared in abloh.yml" }
-    })
-  }
-};
-var ANSWERABLE_SETUP_KEYS = Object.keys(SETUP_QUESTION_DESCRIPTORS);
-function contractDescriptors() {
-  return Object.values(SETUP_QUESTION_DESCRIPTORS).filter(
-    (descriptor) => descriptor.channel === "contract"
-  );
-}
-function answeredTargetDirectory(answers) {
-  const value = answers["target.directory"];
-  return value === void 0 || value.trim() === "" ? void 0 : value.trim();
-}
-
-// src/deno-project.ts
-import { lstatSync as lstatSync2, readFileSync as readFileSync2 } from "fs";
-import { join as join4 } from "path";
-import { parseJsonc } from "@abloh/core";
-var DENO_CONFIG_FILES = ["deno.json", "deno.jsonc"];
-var DENO_LOCKFILE = "deno.lock";
-function stageInvokesDenoTest(stage) {
-  const tokens = stage.trim().split(/\s+/u).filter((token) => token !== "");
-  const first = (tokens[0] ?? "").replace(/^.*\//u, "");
-  return first === "deno" && /^deno\s+test(?:\s|$)/u.test(stage.trim());
-}
-function denoTestInvocation(taskBody) {
-  if (taskBody === null) return null;
-  const script = taskBody.trim();
-  if (script === "") return null;
-  if (/[;|<>`$()\n]/u.test(script)) return null;
-  if (/(^|[^&])&([^&]|$)/u.test(script)) return null;
-  const stages = script.split("&&").map((stage) => stage.trim());
-  if (stages.some((stage) => stage === "")) return null;
-  const matches = stages.filter(stageInvokesDenoTest);
-  return matches.length === 1 ? matches[0] : null;
-}
-function readDenoProject(dir, readText = diskReadText) {
-  for (const name of DENO_CONFIG_FILES) {
-    const path = join4(dir, name);
-    const text = readText(path);
-    if (text === null) continue;
-    const parsed = parseJsonc(text);
-    const tasks = parsed?.tasks;
-    const declared = tasks !== null && typeof tasks === "object" ? tasks["test"] : void 0;
-    const body = typeof declared === "string" ? declared : declared !== null && typeof declared === "object" && typeof declared.command === "string" ? declared.command : null;
-    if (body === null || body.trim() === "") return null;
-    return { configFile: name, testTask: body, testInvocation: denoTestInvocation(body) };
-  }
-  return null;
-}
-function denoLockfilePath(dir, readText = diskReadText) {
-  return readText(join4(dir, DENO_LOCKFILE)) === null ? null : DENO_LOCKFILE;
-}
-function scriptRunsDenoTest(testScript) {
-  if (testScript === null) return false;
-  return testScript.split(/&&|\|\||[;&|]/u).map((stage) => stage.trim()).some(stageInvokesDenoTest);
-}
-function diskReadText(absolutePath) {
-  try {
-    const info = lstatSync2(absolutePath);
-    if (!info.isFile() || info.isSymbolicLink()) return null;
-    return readFileSync2(absolutePath, "utf8");
-  } catch {
-    return null;
-  }
-}
-
-// src/detect.ts
-import { existsSync as existsSync2, readFileSync as readFileSync5 } from "fs";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join8, relative as relative5, resolve as resolve6, sep as sep4 } from "path";
-import { SCRIPT_NAMED_RUNNERS as SCRIPT_NAMED_RUNNERS3, angularRunnerName, commandTokens, compiledOutputEvidence, debugPreparationOverflowStack, readsCompiledOutput, detectModuleLayout, directRunnerCommand, localBinaryPrefix, manifestScripts as manifestScripts3, parseLiteralArguments as parseLiteralArguments2, parsePreparedTestCommand, planCommand as planCommand3, nextActionSentence, readPackageManagerDeclaration, readPackageManagerPin, resolveCommandPlan, runnerNamesInScript, scriptRuns as scriptRuns2, selectAngularTestTarget, nameDrivenRunners, summaryThenAction, watchModeRefusal, withWatchModeDisabled, withoutWatchDisableFlags } from "@abloh/core";
-
-// src/rush-workspace.ts
-import { parseJsonc as parseJsonc2 } from "@abloh/core";
-var RUSH_CONFIG_FILE = "rush.json";
-var RUSH_TEST_SCRIPTS = ["test", "_phase:test"];
-var RUSH_CONFIG_DIRECTORY = "common/config/rush";
-var RUSH_SUBSPACE_DIRECTORY = "common/config/subspaces";
-var RUSH_LOCKFILE_NAME = "pnpm-lock.yaml";
-var RUSH_REPO_STATE_NAME = "repo-state.json";
-var RUSH_INSTALL_COMMAND = "node common/scripts/install-run-rush.js install";
-var RUSH_INSTALL_SCRIPT = "common/scripts/install-run-rush.js";
-function classifyRushTestScript(manifest, directory) {
-  const table = manifestScripts2(manifest);
-  for (const script of RUSH_TEST_SCRIPTS) {
-    const body = table[script];
-    if (typeof body !== "string" || body.trim() === "") continue;
-    if (/[;&|<>`\n]|\$\(/u.test(body)) {
-      return {
-        state: "unmeasurable",
-        reason: `the Rush project at ${directory} composes shell commands in its ${script} script rather than running one suite`,
-        remedy: `reduce ${directory}'s ${script} script to one command, or declare a plain "test" script that runs one suite`
-      };
-    }
-    return { state: "command", script, command: body.trim() };
-  }
-  return {
-    state: "unmeasurable",
-    reason: `the Rush project at ${directory} declares neither a "test" nor a "_phase:test" script`,
-    remedy: `give ${directory} a "test" or "_phase:test" script in its package.json that runs its tests`
-  };
-}
-function manifestScripts2(manifest) {
-  const scripts = manifest?.scripts;
-  return scripts !== null && typeof scripts === "object" ? scripts : {};
-}
-function enumerateRushProjects(readFile, limit) {
-  const parsed = parseJsonc2(readFile(RUSH_CONFIG_FILE));
-  const declared = parsed?.projects;
-  if (!Array.isArray(declared)) return [];
-  const projects = [];
-  for (const entry of declared) {
-    if (entry === null || typeof entry !== "object") continue;
-    const name = entry.packageName;
-    const folder = entry.projectFolder;
-    if (typeof name !== "string" || typeof folder !== "string") continue;
-    const directory = normalizeProjectFolder(folder);
-    if (directory === null) continue;
-    const manifestPath = `${directory}/package.json`;
-    const manifestText = readFile(manifestPath);
-    if (manifestText === null) {
-      projects.push({
-        directory,
-        name,
-        test: {
-          state: "unmeasurable",
-          // Enumerated even so: the directory must not be silently absorbed into a parent's file
-          // list, which would attribute this project's changed files to another project.
-          reason: `the Rush project ${name} declares the folder ${directory}, which has no readable package.json`,
-          remedy: `add ${manifestPath}, or remove ${name} from rush.json's projects`
-        }
-      });
-      continue;
-    }
-    const manifest = parseJsonc2(manifestText);
-    projects.push({
-      directory,
-      name,
-      test: manifest === null ? {
-        state: "unmeasurable",
-        reason: `the Rush project ${name}'s manifest at ${manifestPath} is not readable JSON`,
-        remedy: `fix ${manifestPath} so its manifest parses`
-      } : classifyRushTestScript(manifest, directory)
-    });
-    if (projects.length >= limit) break;
-  }
-  return projects.sort((a, b) => a.directory < b.directory ? -1 : a.directory > b.directory ? 1 : 0);
-}
-function normalizeProjectFolder(raw) {
-  const path = raw.trim().replace(/\\/gu, "/").replace(/^\.\//u, "").replace(/\/+$/u, "");
-  if (path === "" || path.startsWith("/") || /^[A-Za-z]:/u.test(path)) return null;
-  if (/[;&|<>`\s'"$]|\$\(/u.test(path)) return null;
-  if (path.split("/").some((segment) => segment === "..")) return null;
-  return path;
-}
-function rushIdentityFiles(input) {
-  const files = [RUSH_CONFIG_FILE];
-  const collect = (directory) => {
-    for (const name of [RUSH_LOCKFILE_NAME, RUSH_REPO_STATE_NAME]) {
-      const path = `${directory}/${name}`;
-      if (input.exists(path)) files.push(path);
-    }
-  };
-  collect(RUSH_CONFIG_DIRECTORY);
-  for (const subspace of [...input.subdirectories(RUSH_SUBSPACE_DIRECTORY)].sort()) {
-    collect(`${RUSH_SUBSPACE_DIRECTORY}/${subspace}`);
-  }
-  return files;
-}
-function rushLockfiles(input) {
-  return rushIdentityFiles(input).filter((path) => path.endsWith(`/${RUSH_LOCKFILE_NAME}`));
-}
-function rushNodeVersionRange(rushJsonText) {
-  const parsed = parseJsonc2(rushJsonText);
-  const range = parsed?.nodeSupportedVersionRange;
-  return typeof range === "string" && range.trim() !== "" ? range.trim() : null;
-}
-
-// src/workspace-aggregator.ts
-import { SCRIPT_NAMED_RUNNERS as SCRIPT_NAMED_RUNNERS2, binaryName, planCommand as planCommand2 } from "@abloh/core";
-function invokedProgram(command) {
-  const plan = planCommand2(command);
-  if (plan.kind === "program") return { program: plan.program, args: plan.args };
-  if (plan.kind === "manager-passthrough" && plan.token !== null) {
-    return { program: binaryName(plan.token), args: plan.args };
-  }
-  return null;
-}
-var TOOLS = ["turbo", "lage", "nx"];
-function nxTargets(args) {
-  const targets = [];
-  for (let at = 0; at < args.length; at += 1) {
-    const arg = args[at];
-    const inline = /^(?:-t|--targets?)=(.+)$/u.exec(arg);
-    if (inline !== null) {
-      targets.push(...inline[1].split(","));
-      continue;
-    }
-    if (/^(?:-t|--targets?)$/u.test(arg)) {
-      const value = args[at + 1];
-      if (value !== void 0 && !value.startsWith("-")) {
-        targets.push(...value.split(","));
-        at += 1;
-      }
-    }
-  }
-  return targets.filter((task) => task !== "");
-}
-function aggregatorInvocation(testScript) {
-  if (testScript === null) return null;
-  const script = testScript.trim();
-  if (script === "" || /[;&|<>`\n]|\$\(/u.test(script)) return null;
-  const invoked = invokedProgram(script);
-  if (invoked === null) return null;
-  const tool = TOOLS.find((candidate) => candidate === invoked.program);
-  if (tool === void 0) return null;
-  const args = invoked.args;
-  if (tool === "nx") {
-    const explicit = nxTargets(args);
-    if (explicit.length > 0) return { tool, tasks: explicit };
-    const positional = args.filter((arg) => !arg.startsWith("-"));
-    const head = positional[0];
-    if (head === void 0) return { tool, tasks: [] };
-    if (head === "run-many" || head === "affected") return { tool, tasks: [] };
-    if (head === "run") {
-      const target = positional[1]?.split(":")[1];
-      return { tool, tasks: target === void 0 ? [] : [target] };
-    }
-    return { tool, tasks: [head] };
-  }
-  const leading = args.slice(0, args.findIndex((arg) => arg.startsWith("-")) === -1 ? args.length : args.findIndex((arg) => arg.startsWith("-")));
-  const tasks = leading[0] === "run" ? leading.slice(1) : leading;
-  return { tool, tasks };
-}
-function aggregatorTaskPhrase(invocation) {
-  if (invocation.tasks.length === 0) return "the tasks its own configuration selects";
-  const named = invocation.tasks.length < 3 ? invocation.tasks.join(" and ") : `${invocation.tasks.slice(0, -1).join(", ")} and ${invocation.tasks.at(-1)}`;
-  return `each package's own ${named} script${invocation.tasks.length === 1 ? "" : "s"}`;
-}
-var ROOT_CONFIG_EXECUTORS = /* @__PURE__ */ new Map([
-  // Every spelling read out of a real repository on 2026-08-16: `@nx/jest:jest` is what ngxs/store
-  // and nrwl/nx-labs declare, `@nx/vitest:test` is what analogjs/analog declares, and the `@nrwl/*`
-  // names are the pre-16 package scope the same executors shipped under.
-  ["@nx/jest:jest", { runner: "jest", configOption: "jestConfig" }],
-  ["@nrwl/jest:jest", { runner: "jest", configOption: "jestConfig" }],
-  ["@nx/vite:test", { runner: "vitest", configOption: "configFile" }],
-  ["@nx/vitest:test", { runner: "vitest", configOption: "configFile" }],
-  ["@nrwl/vite:test", { runner: "vitest", configOption: "configFile" }]
-]);
-function workspaceRootCommand(runner, configFile, directory) {
-  return runner === "jest" ? `npx --no-install jest --config ${configFile}` : `npx --no-install vitest run --root ${directory} --config ${configFile}`;
-}
-var RUN_COMMANDS_EXECUTORS = /* @__PURE__ */ new Set(["nx:run-commands", "@nrwl/workspace:run-commands"]);
-function commandRunner(command) {
-  const plan = planCommand2(command);
-  if (plan.kind === "node-test") return "node-test";
-  if (plan.kind === "runner") return plan.runner;
-  const invoked = invokedProgram(command);
-  if (invoked === null) return null;
-  return SCRIPT_NAMED_RUNNERS2.includes(invoked.program) ? invoked.program : null;
-}
-function normalizeWorkspacePath(raw) {
-  const path = raw.trim().replace(/\\/gu, "/").replace(/^\.\//u, "").replace(/\/+$/u, "");
-  if (path === "" || path.startsWith("/") || /^[A-Za-z]:/u.test(path)) return null;
-  if (/[;&|<>`\s'"$]|\$\(/u.test(path)) return null;
-  if (path.split("/").some((segment) => segment === "..")) return null;
-  return path;
-}
-function classifyNxTestTarget(projectJson, directory) {
-  const targets = projectJson?.targets ?? projectJson?.architect;
-  const target = targets?.["test"];
-  if (target === void 0) {
-    return {
-      state: "unmeasurable",
-      reason: `the Nx project at ${directory} declares no test target`,
-      remedy: `give ${directory} a test target in its project.json, or a "test" script in its package.json`
-    };
-  }
-  const executor = typeof target.executor === "string" ? target.executor : typeof target.builder === "string" ? target.builder : null;
-  if (executor === null) {
-    return {
-      state: "unmeasurable",
-      reason: `the Nx project at ${directory} declares a test target with no executor`,
-      remedy: `name an executor on ${directory}'s test target, or give the package a "test" script`
+      state: "unmeasurable",
+      reason: `the Nx project at ${directory} declares a test target with no executor`,
+      remedy: `name an executor on ${directory}'s test target, or give the package a "test" script`
     };
   }
   const rootConfig = ROOT_CONFIG_EXECUTORS.get(executor);
@@ -3893,9 +3109,9 @@ import { InvariantError } from "@abloh/core";
 import { execFileSync } from "child_process";
 import { lstatSync as lstatSync3, mkdirSync, readFileSync as readFileSync3, readdirSync as readdirSync2, realpathSync as realpathSync3, rmSync } from "fs";
 import { dirname as dirname3, isAbsolute as isAbsolute3, join as join6, normalize as normalize2, resolve as resolve5, sep as sep3 } from "path";
-import { DeclaredRefusalError as DeclaredRefusalError2, mergeBaseNotEstablished, refusalFromFacts as refusalFromFacts2 } from "@abloh/core";
+import { DeclaredRefusalError, mergeBaseNotEstablished, refusalFromFacts } from "@abloh/core";
 var refuseSubmodule = (path, observed) => {
-  throw new DeclaredRefusalError2(refusalFromFacts2({ kind: "submodule-admission", path, observed }));
+  throw new DeclaredRefusalError(refusalFromFacts({ kind: "submodule-admission", path, observed }));
 };
 var GITLINK_MODE = "160000";
 function git(repoDir, args) {
@@ -3934,8 +3150,8 @@ function assertNoGitlinkChanges(repoDir, base, head, uncommitted) {
     const newMode = fields[1];
     if (oldMode === GITLINK_MODE || newMode === GITLINK_MODE) offenders.push(path);
   }
-  const refusal = refusalFromFacts2({ kind: "submodule-change", offenders });
-  if (refusal !== null) throw new DeclaredRefusalError2(refusal);
+  const refusal = refusalFromFacts({ kind: "submodule-change", offenders });
+  if (refusal !== null) throw new DeclaredRefusalError(refusal);
 }
 function gitAllowFail(repoDir, args) {
   try {
@@ -5177,7 +4393,7 @@ function splitAtRunnerStageInWrapper(testScript, runner, scripts) {
   if (/[;&|<>`]|\$\(/u.test(script)) return null;
   let argv;
   try {
-    argv = parseLiteralArguments2(script, "npm-run-all test script");
+    argv = parseLiteralArguments(script, "npm-run-all test script");
   } catch {
     return null;
   }
@@ -5208,7 +4424,7 @@ function splitAtRunnerStageInWrapper(testScript, runner, scripts) {
     if (leaf === void 0 || leaf.trim() === "") return null;
     let leafArgv;
     try {
-      leafArgv = parseLiteralArguments2(leaf, `wrapper child ${name}`);
+      leafArgv = parseLiteralArguments(leaf, `wrapper child ${name}`);
     } catch {
       leafArgv = [];
     }
@@ -5301,7 +4517,7 @@ function jasmineSuiteFromScript(testScript) {
   for (const stage of stages) {
     let tokens;
     try {
-      tokens = parseLiteralArguments2(stage, "test script");
+      tokens = parseLiteralArguments(stage, "test script");
     } catch {
       return void 0;
     }
@@ -5406,6 +4622,7 @@ function classifyPackageManifest(pkg, aggregatorTasks = []) {
       ...adopted,
       scripts,
       aggregatorTasks: [],
+      aggregatorInvocationScript: null,
       aggregatorTask: taskSuite.task,
       aggregatorTaskRefusal: null
     };
@@ -5424,6 +4641,7 @@ function classifyPackageManifest(pkg, aggregatorTasks = []) {
     scripts,
     aggregator: aggregated?.tool ?? null,
     aggregatorTasks: aggregated?.tasks ?? [],
+    aggregatorInvocationScript: aggregated === null ? null : testScript,
     aggregatorTask: null,
     aggregatorTaskRefusal: taskSuite === null ? null : taskSuite.refusal
   };
@@ -5446,7 +4664,12 @@ function classifyWithAliasHop(manifest, family, aggregatorTasks = []) {
   if (typeof inner !== "string") return base;
   const hopped = classifyPackageManifest({ ...manifest, scripts: { ...base.scripts, test: inner } });
   if (hopped.runner !== null) return hopped;
-  return hopped.aggregator === null ? base : { ...base, aggregator: hopped.aggregator, aggregatorTasks: hopped.aggregatorTasks };
+  return hopped.aggregator === null ? base : {
+    ...base,
+    aggregator: hopped.aggregator,
+    aggregatorTasks: hopped.aggregatorTasks,
+    aggregatorInvocationScript: hopped.aggregatorInvocationScript
+  };
 }
 function probeNxProject(ctx, repoDir, dir) {
   const text = accessText(ctx, join8(dir, "project.json"));
@@ -5542,658 +4765,1658 @@ function probePkg(ctx, dir, aliasFamily = null, repoDir = dir, aggregatorTasks =
     refusal: null
   };
 }
-function probeManifest(ctx, dir, manifest, aliasFamily, repoDir, aggregatorTasks) {
-  if (manifest === null) {
-    const nx = probeNxProject(ctx, repoDir, dir);
-    if (nx !== null) {
-      return {
-        dir,
-        runner: nx.runner,
-        testScript: null,
-        note: null,
-        scripts: {},
-        aggregator: null,
-        aggregatorTasks: [],
-        aggregatorTask: null,
-        angular: null,
-        declaredCommand: nx.command,
-        workspaceRootSuite: nx.workspaceRootSuite
-      };
+function probeManifest(ctx, dir, manifest, aliasFamily, repoDir, aggregatorTasks) {
+  if (manifest === null) {
+    const nx = probeNxProject(ctx, repoDir, dir);
+    if (nx !== null) {
+      return {
+        dir,
+        runner: nx.runner,
+        testScript: null,
+        note: null,
+        scripts: {},
+        aggregator: null,
+        aggregatorTasks: [],
+        aggregatorTask: null,
+        angular: null,
+        declaredCommand: nx.command,
+        workspaceRootSuite: nx.workspaceRootSuite
+      };
+    }
+    return probeDenoProject(ctx, dir);
+  }
+  const pkg = manifest;
+  const classified = classifyWithAliasHop(pkg, aliasFamily, aggregatorTasks);
+  if (classified.aggregatorTask !== null && classified.testScript !== null) {
+    return {
+      dir,
+      ...classified,
+      angular: null,
+      declaredCommand: aggregatorTaskCommand(
+        classified.testScript,
+        classified.runner,
+        detectModuleLayout(repoDir, dir)
+      ),
+      workspaceRootSuite: null
+    };
+  }
+  if (classified.runner === null && scriptRunsDenoTest(classified.testScript)) {
+    return {
+      dir,
+      ...classified,
+      runner: "deno",
+      note: "deno",
+      angular: null,
+      declaredCommand: runnerInvocation(classified.testScript, "deno"),
+      workspaceRootSuite: null
+    };
+  }
+  if (classified.runner === null && classified.testScript === null) {
+    const nx = probeNxProject(ctx, repoDir, dir);
+    if (nx !== null) {
+      return {
+        dir,
+        ...classified,
+        runner: nx.runner,
+        angular: null,
+        declaredCommand: nx.command,
+        workspaceRootSuite: nx.workspaceRootSuite
+      };
+    }
+    const rush = probeRushProject(ctx, repoDir, dir);
+    if (rush !== null) return rush;
+    const deno = probeDenoProject(ctx, dir);
+    if (deno !== null) return deno;
+  }
+  const angular = probeAngular(ctx, dir, classified);
+  if (angular !== null) {
+    return {
+      dir,
+      ...classified,
+      runner: angularRunnerName(angular.runner),
+      angular,
+      note: `angular:${angular.builder}`,
+      declaredCommand: null,
+      workspaceRootSuite: null
+    };
+  }
+  return {
+    dir,
+    ...classified,
+    angular: null,
+    declaredCommand: null,
+    workspaceRootSuite: null
+  };
+}
+function classifyPackageDirectory(repoDir, dir, ctx = diskRepoAccess(repoDir)) {
+  const reading = accessManifest(ctx, join8(repoDir, dir, "package.json"));
+  if (reading.standing !== "read") return null;
+  try {
+    return classifyWithAliasHop(
+      reading.manifest,
+      rootAliasFamily(ctx, repoDir),
+      rootAggregatorTasksInRepository(ctx, repoDir)
+    );
+  } catch {
+    return null;
+  }
+}
+function declaredCommandContext(repoDir, subdir, ctx = diskRepoAccess(repoDir)) {
+  const packageReading = accessManifest(ctx, join8(repoDir, subdir ?? ".", "package.json"));
+  const scripts = packageReading.standing === "read" ? manifestScripts3(packageReading.manifest) : {};
+  const rootReading = accessManifest(ctx, join8(repoDir, "package.json"));
+  const manifest = rootReading.standing === "read" ? rootReading.manifest : void 0;
+  return { scripts, ...manifest === void 0 ? {} : { manifest } };
+}
+function rootAliasFamily(ctx, repoDir) {
+  return withRootManifest(ctx, repoDir, aliasHopFamily, null);
+}
+function rootAggregatorTasksInRepository(ctx, repoDir) {
+  return withRootManifest(ctx, repoDir, rootAggregatorTasks, []);
+}
+function withRootManifest(ctx, repoDir, read, absent) {
+  const reading = accessManifest(ctx, join8(repoDir, "package.json"));
+  if (reading.standing !== "read") return absent;
+  try {
+    return read(reading.manifest);
+  } catch {
+    return absent;
+  }
+}
+var MAX_FANOUT_CHILDREN = 16;
+var NATIVE_COVERAGE_RUNNERS = /* @__PURE__ */ new Set([
+  "jest",
+  "vitest",
+  "mocha",
+  "node-test",
+  "ava",
+  "tap",
+  "jasmine"
+]);
+function corepackManaged(manager) {
+  return manager.version !== null && (manager.pm === "npm" || manager.pm === "pnpm" || manager.pm === "yarn");
+}
+function packageScriptCommand(manager, script) {
+  return manager.pm === "bun" ? `bun run ${script}` : manager.pm === "deno" ? `deno task ${script}` : corepackManaged(manager) ? `corepack ${manager.pm} run ${script}` : `${manager.pm} run ${script}`;
+}
+function packageTestCommand(manager) {
+  return manager.pm === "bun" ? "bun run test" : manager.pm === "deno" ? "deno task test" : corepackManaged(manager) ? `corepack ${manager.pm} test` : manager.pm === "npm" ? "npm test" : `${manager.pm} test`;
+}
+function scriptPattern(pattern) {
+  const escaped = pattern.replace(/[\\^$+.[\]{}()|]/gu, "\\$&");
+  return new RegExp(`^${escaped.replace(/\*/gu, "[^:]*").replace(/\?/gu, "[^:]")}$`, "u");
+}
+var WRAPPERS = ["npm-run-all", "run-p", "run-s"];
+var WRAPPER_SCHEDULING_OPTIONS = /^(?:-[aclps]+|--parallel|--sequential|--continue-on-error|--silent|--aggregate-output|--print-label)$/u;
+function leafRunner(leaf) {
+  const named = runnerNamesInScript(leaf);
+  const runner = named.length === 1 ? named[0] : invokesNodeTest(leaf) ? "node-test" : null;
+  if (runner === null || !NATIVE_COVERAGE_RUNNERS.has(runner)) return null;
+  return runnerSuiteInvocations(leaf, runner) > 1 ? null : runner;
+}
+function wrapperFanout(probe, manager) {
+  const script = probe.testScript;
+  if (script === null) return void 0;
+  const executable = script.trim().split(/\s+/u)[0]?.replace(/^.*\//u, "");
+  if (!WRAPPERS.includes(executable)) return void 0;
+  if (/[;&|<>`]|\$\(/u.test(script)) return { refusal: "it composes shell commands around the wrapper" };
+  let argv;
+  try {
+    argv = parseLiteralArguments(script, "npm-run-all test script");
+  } catch {
+    return { refusal: "its wrapper invocation could not be parsed as one literal command" };
+  }
+  const patterns = [];
+  let parallel = executable === "run-p";
+  let sequential = executable === "run-s";
+  for (const arg of argv.slice(1)) {
+    if (arg.startsWith("-")) {
+      if (!WRAPPER_SCHEDULING_OPTIONS.test(arg)) {
+        return { refusal: `the wrapper option ${arg} can change which suites run to completion` };
+      }
+      if (arg === "--parallel" || /^-[aclps]+$/u.test(arg) && arg.includes("p")) parallel = true;
+      if (arg === "--sequential" || /^-[aclps]+$/u.test(arg) && arg.includes("s")) sequential = true;
+      continue;
+    }
+    patterns.push(arg);
+  }
+  if (patterns.length === 0) return { refusal: "its wrapper selects no scripts" };
+  if (parallel && sequential) return { refusal: "its wrapper asks for parallel and sequential at once" };
+  const selected = /* @__PURE__ */ new Set();
+  const names = Object.keys(probe.scripts).sort();
+  for (const pattern of patterns) {
+    const matches = names.filter((name) => name !== "test" && scriptPattern(pattern).test(name));
+    if (matches.length === 0) return { refusal: `no script matches the pattern ${pattern}` };
+    for (const match of matches) selected.add(match);
+  }
+  const children = scriptChildren([...selected].sort(), probe, manager);
+  return "refusal" in children ? children : { children: children.children, execution: parallel ? "parallel" : "sequential" };
+}
+function concurrentlyFanout(probe, manager) {
+  const script = probe.testScript;
+  if (script === null) return void 0;
+  if (script.trim().split(/\s+/u)[0]?.replace(/^.*\//u, "") !== "concurrently") return void 0;
+  if (/[;&|<>`]|\$\(/u.test(script)) return { refusal: "it composes shell commands around concurrently" };
+  let argv;
+  try {
+    argv = parseLiteralArguments(script, "concurrently test script");
+  } catch {
+    return { refusal: "its concurrently invocation could not be parsed as one literal command" };
+  }
+  const patterns = [];
+  for (const arg of argv.slice(1)) {
+    if (arg.startsWith("-")) {
+      if (!/^(?:--(?:names|prefix|prefix-colors|group|raw)|-[np]|-c)$/u.test(arg)) {
+        return { refusal: `the concurrently option ${arg} can change which suites run to completion` };
+      }
+      continue;
+    }
+    if (!arg.startsWith("npm:")) {
+      return { refusal: "concurrently is given a raw command line rather than an npm: script reference" };
+    }
+    patterns.push(arg.slice("npm:".length));
+  }
+  if (patterns.length === 0) return { refusal: "its concurrently invocation selects no scripts" };
+  const selected = /* @__PURE__ */ new Set();
+  const names = Object.keys(probe.scripts).sort();
+  for (const pattern of patterns) {
+    const matches = names.filter((name) => name !== "test" && scriptPattern(pattern).test(name));
+    if (matches.length === 0) return { refusal: `no script matches the pattern ${pattern}` };
+    for (const match of matches) selected.add(match);
+  }
+  const children = scriptChildren([...selected].sort(), probe, manager);
+  return "refusal" in children ? children : { children: children.children, execution: "parallel" };
+}
+function scriptChildren(scripts, probe, manager) {
+  if (scripts.length === 0) return { refusal: "it selects no scripts" };
+  if (scripts.length > MAX_FANOUT_CHILDREN) {
+    return { refusal: `it launches ${scripts.length} suites, more than the ${MAX_FANOUT_CHILDREN} this run will measure` };
+  }
+  const children = [];
+  for (const script of scripts) {
+    if (!/^[A-Za-z0-9:_-]{1,128}$/u.test(script)) return { refusal: `the script name ${script} is not a plain name` };
+    const leaf = probe.scripts[script];
+    if (leaf === void 0 || /[;&|<>`]|\$\(/u.test(leaf)) {
+      return { refusal: `the script ${script} composes shell commands rather than running one suite` };
+    }
+    let leafArgv;
+    try {
+      leafArgv = parseLiteralArguments(leaf, `fanout child ${script}`);
+    } catch {
+      return { refusal: `the script ${script} could not be parsed as one literal command` };
+    }
+    if (leafArgv.some((arg) => WRAPPERS.includes(arg))) {
+      return { refusal: `the script ${script} is itself a wrapper, and this expands one level only` };
+    }
+    const runner = leafRunner(leaf);
+    if (runner === null) return { refusal: `the script ${script} names no single runner with native coverage` };
+    children.push({ script, runner, testCommand: packageScriptCommand(manager, script) });
+  }
+  return { children };
+}
+function chainFanout(probe, manager) {
+  const script = probe.testScript;
+  if (script === null || script.trim() === "") return void 0;
+  if (suiteStages(script, probe.scripts) < 2) return void 0;
+  if (/[|<>`]|\$\(/u.test(script) || /(^|[^&])&([^&]|$)/u.test(script)) {
+    return { refusal: "its suites are composed with something other than `&&`, so which of them ran is not decidable" };
+  }
+  if (script.includes(";")) {
+    return { refusal: "its suites are separated by `;`, which runs the next one whether or not the last passed" };
+  }
+  const chainStages = script.split("&&").map((stage) => stage.trim());
+  if (chainStages.some((stage) => stage === "")) return { refusal: "its `&&` chain has an empty stage" };
+  if (chainStages.length > MAX_FANOUT_CHILDREN) {
+    return { refusal: `it chains ${chainStages.length} stages, more than the ${MAX_FANOUT_CHILDREN} this run will measure` };
+  }
+  const children = [];
+  for (const stage of chainStages) {
+    if (suiteStages(stage, probe.scripts) === 0) continue;
+    const alias = /^(?:corepack\s+)?(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?([A-Za-z0-9:._-]+)$/u.exec(stage);
+    if (alias !== null) {
+      const family = stage.trim().replace(/^corepack\s+/u, "").split(/\s+/u)[0];
+      if (family !== manager.pm) {
+        return { refusal: `the stage \`${stage}\` runs under ${family} while this package resolves to ${manager.pm}` };
+      }
+      const named = scriptChildren([alias[1]], probe, manager);
+      if ("refusal" in named) return named;
+      children.push(...named.children);
+      continue;
     }
-    return probeDenoProject(ctx, dir);
+    const runner = [...NATIVE_COVERAGE_RUNNERS].find((candidate) => stageInvokes(stage, candidate));
+    if (runner === void 0) {
+      return { refusal: `the stage \`${stage}\` is neither a suite nor a script this run can name` };
+    }
+    const testCommand = runner === "node-test" ? stage : `npx --no-install ${stage}`;
+    try {
+      parsePreparedTestCommand(testCommand, "fanout stage");
+    } catch {
+      return { refusal: `the stage \`${stage}\` is not a literal command this run can execute on its own` };
+    }
+    children.push({ runner, testCommand });
   }
-  const pkg = manifest;
-  const classified = classifyWithAliasHop(pkg, aliasFamily, aggregatorTasks);
-  if (classified.aggregatorTask !== null && classified.testScript !== null) {
+  if (children.length < 2) return void 0;
+  return { children, execution: "sequential" };
+}
+function suiteFanoutPlan(probe, manager) {
+  const aggregated = probe.aggregator === null ? null : { tool: probe.aggregator, tasks: [...probe.aggregatorTasks] };
+  if (aggregated !== null) {
     return {
-      dir,
-      ...classified,
-      angular: null,
-      declaredCommand: aggregatorTaskCommand(
-        classified.testScript,
-        classified.runner,
-        detectModuleLayout(repoDir, dir)
-      ),
-      workspaceRootSuite: null
+      coverageExclusion: `this package's test script delegates to ${aggregated.tool}, which runs ${aggregatorTaskPhrase(aggregated)} rather than one suite, so no single coverage report describes it; abloh measures such a repository per package instead`
     };
   }
-  if (classified.runner === null && scriptRunsDenoTest(classified.testScript)) {
+  const resolved = wrapperFanout(probe, manager) ?? concurrentlyFanout(probe, manager) ?? chainFanout(probe, manager);
+  if (resolved === void 0) return {};
+  if ("refusal" in resolved) {
+    return { coverageExclusion: `this package's test script launches more than one suite, but ${resolved.refusal}` };
+  }
+  const runners = [...new Set(resolved.children.map((child) => child.runner))].sort();
+  if (runners.length > 1) {
     return {
-      dir,
-      ...classified,
-      runner: "deno",
-      note: "deno",
-      angular: null,
-      declaredCommand: runnerInvocation(classified.testScript, "deno"),
-      workspaceRootSuite: null
+      coverageExclusion: `this package's test script launches ${resolved.children.length} suites across ${runners.join(" and ")}, and one coverage report cannot carry two providers, so none of them is measured rather than some`
     };
   }
-  if (classified.runner === null && classified.testScript === null) {
-    const nx = probeNxProject(ctx, repoDir, dir);
-    if (nx !== null) {
-      return {
-        dir,
-        ...classified,
-        runner: nx.runner,
-        angular: null,
-        declaredCommand: nx.command,
-        workspaceRootSuite: nx.workspaceRootSuite
-      };
+  return { coverageChildren: resolved.children, coverageExecution: resolved.execution };
+}
+function compiledOutputFields(input) {
+  if (input.angular || input.runner === "deno") return {};
+  const reading = readsCompiledOutput({
+    /*
+     * THE ONE READING ON THIS PATH THAT DOES NOT GO THROUGH THE REPOSITORY READER, and it is a
+     * decision rather than an oversight.
+     *
+     * `readsCompiledOutput` FOLLOWS `extends` INTO `node_modules` by design - rushstack's projects
+     * extend `@rushstack/heft-node-rig/profiles/default/tsconfig-base.json`, whose `outDir` is five
+     * hops out of the store and back into the project's own `lib`, and refusing to follow it means
+     * this reading never sees the repository the compile-then-test ruling was measured on. An
+     * installed store is exactly where symlinks live and exactly where "inside the checkout" is a
+     * different question, so the reader's two refusals - a symlinked leaf, and a parent that
+     * resolves outside the root - would silently narrow it. What that costs is not a refusal: a
+     * config this reading cannot see produces a different `rebuildCommand`, and a wrong rebuild is
+     * the one failure in this product that ends in a confident WRONG NUMBER.
+     *
+     * IT IS SAFE HERE FOR THE REASON THE READER EXISTS ELSEWHERE. The paths are composed by
+     * `compiled-output.ts` from a config's own `extends` and from `node_modules` walked upwards,
+     * never from a repository-author-controlled string this module passes through; and the only
+     * road that reaches it is one that HAS a checkout, since a service reading over the contents
+     * API has no installed store to follow into anyway.
+     */
+    readFile: (path) => {
+      const absolute = join8(input.repoDir, ...path.split("/"));
+      if (!existsSync2(absolute)) return null;
+      try {
+        return readFileSync5(absolute, "utf8");
+      } catch {
+        return null;
+      }
+    },
+    packageDir: input.packageDir ?? "",
+    runner: input.runner,
+    invocation: input.invocation,
+    /* THE COMMAND THIS RUN EXECUTES, beside the invocation and never instead of it. `runnerInvocation`
+       answers a narrower question - whether a stage can be RE-EMITTED - so it declines a stage with
+       anything in front of the runner, and `devcontainers/cli`'s whole suite is
+       `env TS_NODE_PROJECT=... mocha ... src/test/*.test.ts`. The reading in `@abloh/core` resolves the
+       runner's stage out of this where no invocation arrived; its own header states both halves. */
+    testCommand: input.testCommand,
+    scripts: input.scripts,
+    manager: input.manager,
+    /*
+     * THE SECOND READING'S SEAM IS THE REPOSITORY READER and never the raw filesystem one above.
+     *
+     * That one exists to follow a `tsconfig` `extends` into an installed store, which is the one
+     * place this detection legitimately leaves the tree. This reading opens the SUITE'S OWN TEST
+     * FILES, which are the repository's, so it takes the reader whose refusals are about staying
+     * inside it - a symlinked leaf and a parent resolving out of the root.
+     */
+    reader: input.ctx.reader
+  });
+  const found = reading.state === "reads-compiled-output" ? reading : null;
+  return {
+    rebuildCommand: found?.rebuildCommand ?? void 0,
+    rebuildEvidence: found === null ? void 0 : compiledOutputEvidence(found),
+    rebuildCandidates: found === null || found.candidates.length === 0 ? void 0 : found.candidates,
+    rebuildOutputDirectory: found?.outputDirectory ?? void 0
+  };
+}
+function repositoryRootOf(detected) {
+  if (detected.subdir === null || detected.workspaceRootSuite !== void 0) return detected.workDir;
+  return resolve6(detected.workDir, ...detected.subdir.split("/").map(() => ".."));
+}
+var VITEST_CONFIG_FILES = [
+  "vitest.config.ts",
+  "vitest.config.mts",
+  "vitest.config.cts",
+  "vitest.config.js",
+  "vitest.config.mjs",
+  "vitest.config.cjs",
+  "vite.config.ts",
+  "vite.config.mts",
+  "vite.config.cts",
+  "vite.config.js",
+  "vite.config.mjs",
+  "vite.config.cjs"
+];
+function detectVitestDir(dir, ctx = diskRepoAccess(dir)) {
+  for (const name of VITEST_CONFIG_FILES) {
+    const p = join8(dir, name);
+    let src;
+    try {
+      src = accessText(ctx, p);
+    } catch (e) {
+      debugPreparationOverflowStack(e);
+      throw new TargetDetectionError(
+        `${name} at ${dir} could not be read: ${e instanceof Error ? e.message : "unreadable"}`
+      );
     }
-    const rush = probeRushProject(ctx, repoDir, dir);
-    if (rush !== null) return rush;
-    const deno = probeDenoProject(ctx, dir);
-    if (deno !== null) return deno;
+    if (src === null) continue;
+    return vitestDirIn(src);
   }
-  const angular = probeAngular(ctx, dir, classified);
-  if (angular !== null) {
-    return {
-      dir,
-      ...classified,
-      runner: angularRunnerName(angular.runner),
-      angular,
-      note: `angular:${angular.builder}`,
-      declaredCommand: null,
-      workspaceRootSuite: null
-    };
+  return void 0;
+}
+function vitestDirIn(source) {
+  const masked = maskLiterals(source);
+  const open = firstUnmasked(source, masked, /(?:^|[\s,;{])["']?test["']?\s*:\s*\{/gu);
+  if (open === -1) return void 0;
+  let depth = 0;
+  let close = -1;
+  for (let at = open; at < masked.length; at++) {
+    if (masked[at] === "{") depth += 1;
+    else if (masked[at] === "}") {
+      depth -= 1;
+      if (depth === 0) {
+        close = at;
+        break;
+      }
+    }
+  }
+  if (close === -1) return void 0;
+  const quote = firstUnmasked(source.slice(0, close), masked.slice(0, close), /\bdir["']?\s*:\s*['"`]/gu, open);
+  if (quote === -1) return void 0;
+  const end = masked.indexOf(source[quote], quote + 1);
+  if (end === -1 || end >= close) return void 0;
+  const value = source.slice(quote + 1, end);
+  return value === "" ? void 0 : value;
+}
+function firstUnmasked(source, masked, pattern, from = 0) {
+  pattern.lastIndex = from;
+  for (let match = pattern.exec(source); match !== null; match = pattern.exec(source)) {
+    const at = match.index + match[0].length - 1;
+    if (masked[at] === source[at]) return at;
   }
-  return {
-    dir,
-    ...classified,
-    angular: null,
-    declaredCommand: null,
-    workspaceRootSuite: null
-  };
+  return -1;
 }
-function classifyPackageDirectory(repoDir, dir, ctx = diskRepoAccess(repoDir)) {
-  const reading = accessManifest(ctx, join8(repoDir, dir, "package.json"));
-  if (reading.standing !== "read") return null;
-  try {
-    return classifyWithAliasHop(
-      reading.manifest,
-      rootAliasFamily(ctx, repoDir),
-      rootAggregatorTasksInRepository(ctx, repoDir)
-    );
-  } catch {
-    return null;
+function maskLiterals(source) {
+  const out = source.split("");
+  const blank = (from, to) => {
+    for (let at2 = from; at2 < to && at2 < out.length; at2++) if (out[at2] !== "\n") out[at2] = " ";
+  };
+  let at = 0;
+  let previous = "";
+  while (at < source.length) {
+    const char = source[at];
+    if (char === '"' || char === "'" || char === "`") {
+      let end = at + 1;
+      while (end < source.length && source[end] !== char) end += source[end] === "\\" ? 2 : 1;
+      blank(at + 1, end);
+      at = Math.min(end + 1, source.length);
+      previous = char;
+      continue;
+    }
+    if (char === "/" && source[at + 1] === "/") {
+      const end = source.indexOf("\n", at);
+      blank(at, end === -1 ? source.length : end);
+      at = end === -1 ? source.length : end;
+      continue;
+    }
+    if (char === "/" && source[at + 1] === "*") {
+      const end = source.indexOf("*/", at + 2);
+      blank(at, end === -1 ? source.length : end + 2);
+      at = end === -1 ? source.length : end + 2;
+      continue;
+    }
+    if (char === "/" && previous !== "" && /[(,=:[!&|?{};+\-*]/u.test(previous)) {
+      let end = at + 1;
+      while (end < source.length && source[end] !== "/" && source[end] !== "\n") end += source[end] === "\\" ? 2 : 1;
+      if (source[end] === "/") {
+        blank(at, end + 1);
+        at = end + 1;
+        continue;
+      }
+    }
+    if (!/\s/u.test(char)) previous = char;
+    at += 1;
   }
+  return out.join("");
 }
-function declaredCommandContext(repoDir, subdir, ctx = diskRepoAccess(repoDir)) {
-  const packageReading = accessManifest(ctx, join8(repoDir, subdir ?? ".", "package.json"));
-  const scripts = packageReading.standing === "read" ? manifestScripts3(packageReading.manifest) : {};
-  const rootReading = accessManifest(ctx, join8(repoDir, "package.json"));
-  const manifest = rootReading.standing === "read" ? rootReading.manifest : void 0;
-  return { scripts, ...manifest === void 0 ? {} : { manifest } };
+function workDirPrefix(detection) {
+  return detection.workspaceRootSuite === void 0 ? detection.subdir : null;
 }
-function rootAliasFamily(ctx, repoDir) {
-  return withRootManifest(ctx, repoDir, aliasHopFamily, null);
+function classicPerTestRunner(runner) {
+  return runner !== "command" && classicPerTestRefusal(runner) === null;
 }
-function rootAggregatorTasksInRepository(ctx, repoDir) {
-  return withRootManifest(ctx, repoDir, rootAggregatorTasks, []);
+function classicPerTestRefusal(runner) {
+  return runner === "deno" ? "deno's mutation runs the whole suite per mutant (Stryker ships no deno runner), so the classic per-test layer has no per-test report to read; the sealed v2 engine drives deno one test at a time and is where a proposed test for this repository comes from" : null;
 }
-function withRootManifest(ctx, repoDir, read, absent) {
-  const reading = accessManifest(ctx, join8(repoDir, "package.json"));
-  if (reading.standing !== "read") return absent;
+function declaresWorkspace(ctx, repoDir) {
+  for (const name of ["pnpm-workspace.yaml", "pnpm-workspace.yml", "nx.json", "lerna.json"]) {
+    if (accessExists(ctx, join8(repoDir, name))) return true;
+  }
   try {
-    return read(reading.manifest);
+    const reading = accessManifest(ctx, join8(repoDir, "package.json"));
+    if (reading.standing !== "read") return false;
+    const workspaces = reading.manifest.workspaces;
+    if (Array.isArray(workspaces)) return workspaces.length > 0;
+    if (workspaces !== null && typeof workspaces === "object") {
+      return Array.isArray(workspaces.packages);
+    }
   } catch {
-    return absent;
+    return false;
   }
+  return false;
 }
-var MAX_FANOUT_CHILDREN = 16;
-var NATIVE_COVERAGE_RUNNERS = /* @__PURE__ */ new Set([
-  "jest",
-  "vitest",
-  "mocha",
-  "node-test",
-  "ava",
-  "tap",
-  "jasmine"
-]);
-function corepackManaged(manager) {
-  return manager.version !== null && (manager.pm === "npm" || manager.pm === "pnpm" || manager.pm === "yarn");
+var NAMED_CANDIDATES = 8;
+function testableWorkspacePackages(repoDir, refusals, ctx = diskRepoAccess(repoDir)) {
+  const aliasFamily = rootAliasFamily(ctx, repoDir);
+  const aggregatorTasks = rootAggregatorTasksInRepository(ctx, repoDir);
+  const found = [];
+  const enumeration = enumerateWorkspacePackages(repoDir);
+  if (refusals !== void 0) refusals.push(...enumeration.refusals);
+  for (const dir of enumeration.packages) {
+    const { probe, refusal } = probePkg(ctx, join8(repoDir, dir), aliasFamily, repoDir, aggregatorTasks);
+    if (refusal !== null) {
+      if (refusals !== void 0) refusals.push(refusal.summary);
+      continue;
+    }
+    if (probe === null) continue;
+    if (probe.runner !== null || declaresASuite(probe)) found.push(dir);
+  }
+  return found;
 }
-function packageScriptCommand(manager, script) {
-  return manager.pm === "bun" ? `bun run ${script}` : manager.pm === "deno" ? `deno task ${script}` : corepackManaged(manager) ? `corepack ${manager.pm} run ${script}` : `${manager.pm} run ${script}`;
+function declaresASuite(probe) {
+  if (probe.testScript === null) return false;
+  const runs = scriptRuns2({ scripts: probe.scripts, text: probe.testScript });
+  if (runs.length === 0) return true;
+  return runs.some((run) => run.kind === "test" || run.kind === "unknown");
 }
-function packageTestCommand(manager) {
-  return manager.pm === "bun" ? "bun run test" : manager.pm === "deno" ? "deno task test" : corepackManaged(manager) ? `corepack ${manager.pm} test` : manager.pm === "npm" ? "npm test" : `${manager.pm} test`;
+function candidateRemedy(repoDir) {
+  const refusals = [];
+  const candidates = testableWorkspacePackages(repoDir, refusals);
+  if (candidates.length === 0) {
+    return refusals.length > 0 ? `${refusals[0]}. Declare environment.testCommand in abloh.yml with the command that runs your suite, or run abloh init from the package that holds it` : "declare environment.testCommand in abloh.yml with the command that runs your suite, or run abloh init from the package that holds it";
+  }
+  return `point --subdir (or abloh.yml target.directory) at one of the ${candidates.length} package(s) here that declare a suite, such as ${candidates[0]}`;
 }
-function scriptPattern(pattern) {
-  const escaped = pattern.replace(/[\\^$+.[\]{}()|]/gu, "\\$&");
-  return new RegExp(`^${escaped.replace(/\*/gu, "[^:]*").replace(/\?/gu, "[^:]")}$`, "u");
+function candidateSentence(repoDir) {
+  const candidates = testableWorkspacePackages(repoDir);
+  if (candidates.length === 0) return "";
+  const named = candidates.slice(0, NAMED_CANDIDATES);
+  const more = candidates.length - named.length;
+  return `. The packages here that declare a suite are ${named.join(", ")}` + (more > 0 ? ` and ${more} more` : "");
+}
+function detectTarget(repoDir, subdir, resolution = {}, ctx = diskRepoAccess(repoDir)) {
+  const aliasFamily = rootAliasFamily(ctx, repoDir);
+  const aggregatorTasks = rootAggregatorTasksInRepository(ctx, repoDir);
+  const explicitResult = subdir ? probePkg(ctx, join8(repoDir, subdir), aliasFamily, repoDir, aggregatorTasks) : null;
+  if (explicitResult?.refusal != null) throw manifestRefusal(explicitResult.refusal);
+  const explicit = explicitResult?.probe ?? null;
+  if (subdir && explicit === null) {
+    throw new TargetNotFoundError(
+      "configured-directory-has-no-package",
+      `the configured target directory ${JSON.stringify(subdir)} has no package.json, so there is no package there to measure; point --subdir (or abloh.yml target.directory) at the directory holding the package's package.json, or remove it to measure the repository root`,
+      "point --subdir (or abloh.yml target.directory) at the directory holding the package's package.json, or remove it to measure the repository root"
+    );
+  }
+  const rootResult = probePkg(ctx, repoDir, aliasFamily, repoDir, aggregatorTasks);
+  if (rootResult.refusal !== null) throw manifestRefusal(rootResult.refusal);
+  const root = rootResult.probe;
+  const probe = explicit !== null && (explicit.runner !== null || explicit.testScript !== null) ? explicit : root !== null && (root.runner !== null || root.testScript !== null) ? root : null;
+  if (!probe) {
+    throw new TargetNotFoundError(
+      "no-testable-package",
+      `no package.json with a test runner or test script found under ${repoDir}` + (subdir ? ` or in the configured target directory ${JSON.stringify(subdir)}` : "") + candidateSentence(repoDir),
+      candidateRemedy(repoDir)
+    );
+  }
+  const workspaceRootSuite = probe.workspaceRootSuite;
+  const commandDir = workspaceRootSuite === null ? probe.dir : repoDir;
+  const manager = detectPackageManagerContext(repoDir, commandDir, resolution, ctx);
+  const pm = manager.pm;
+  const runner = probe.runner ?? "command";
+  const projectTestCommand = packageTestCommand(manager);
+  const direct = directRunnerCommand(runner, detectModuleLayout(repoDir, probe.dir));
+  if (probe.declaredCommand === null && probe.testScript === null && direct !== null && probe.dir === repoDir && declaresWorkspace(ctx, repoDir)) {
+    throw new TargetNotFoundError(
+      "workspace-root-declares-no-test-script",
+      `${repoDir} is a workspace root that declares no test script, so there is no suite here to measure and Abloh will not guess one from an installed runner: point --subdir (or abloh.yml target.directory) at the package you want measured, or declare environment.testCommand if one command runs the suite from the root` + candidateSentence(repoDir),
+      "point --subdir (or abloh.yml target.directory) at the package you want measured, or declare environment.testCommand if one command runs the suite from the root" + candidateSentence(repoDir)
+    );
+  }
+  const testCommand = probe.declaredCommand ?? (probe.testScript !== null || direct === null ? projectTestCommand : direct);
+  const rel = relative5(repoDir, probe.dir);
+  const resolvedSubdir = rel === "" ? null : rel;
+  const lifecycleHooks = [probe.scripts.pretest, probe.scripts.posttest].filter(
+    (hook) => typeof hook === "string"
+  );
+  const runnerStage = probe.testScript !== null && testCommand === projectTestCommand ? runnerStageCommand(probe.testScript, runner, lifecycleHooks, probe.scripts) : null;
+  const preRunnerStages = probe.testScript !== null && testCommand === projectTestCommand ? preRunnerStageCommands(probe.testScript, runner, probe.scripts) : [];
+  const watchDeclaration = testCommand === projectTestCommand ? probe.testScript : testCommand;
+  if (watchDeclaration !== null) {
+    const refusal = watchModeRefusal(
+      runner,
+      watchDeclaration,
+      testCommand === projectTestCommand ? `scripts.test in ${join8(relative5(repoDir, probe.dir), "package.json")}` : probe.declaredCommand === testCommand ? "your declared environment.testCommand" : "your test command"
+    );
+    if (refusal !== null) throw new TargetDetectionError(refusal);
+  }
+  const watchNormalized = watchDeclaration === null ? null : withWatchModeDisabled({
+    runner,
+    command: testCommand,
+    watchDeclaration,
+    packageManagerMajor: manager.version === null ? null : Number.parseInt(manager.version, 10)
+  });
+  const effectiveTestCommand = watchNormalized ?? testCommand;
+  const watchNormalizedStage = runnerStage === null ? null : withWatchModeDisabled({ runner, command: runnerStage, watchDeclaration: runnerStage });
+  const invocation = RUNNER_INVOCATION_CARRYING_RUNNERS.has(runner) ? runnerInvocation(probe.testScript, runner, probe.scripts) ?? probe.declaredCommand ?? (testCommand === direct ? direct : null) : null;
+  return {
+    pm,
+    runner,
+    testCommand: effectiveTestCommand,
+    ...watchNormalized === null ? {} : { watchModeNormalized: true },
+    ...probe.aggregator === null ? {} : { workspaceAggregator: probe.aggregator },
+    ...probe.aggregatorTask == null ? {} : { aggregatorTask: probe.aggregatorTask },
+    ...runnerStage === null ? {} : { runnerStageCommand: watchNormalizedStage ?? runnerStage },
+    /* Only alongside a runner stage, because these are exactly what running that stage alone would
+       otherwise skip. A one-stage script gated by a lifecycle hook has a runner stage and no
+       earlier stage of its own, and gets an empty list rather than a key. */
+    ...runnerStage === null || preRunnerStages.length === 0 ? {} : { preRunnerStageCommands: preRunnerStages },
+    ...invocation === null ? {} : { runnerInvocation: invocation },
+    vitestDir: runner === "vitest" ? detectVitestDir(probe.dir, ctx) : void 0,
+    jasmineSuite: runner === "jasmine" ? detectJasmineSuite(probe.dir, probe.testScript, ctx) : void 0,
+    ...probe.angular === null ? {} : { angularTarget: probe.angular },
+    subdir: resolvedSubdir,
+    workDir: commandDir,
+    ...workspaceRootSuite === null ? {} : { workspaceRootSuite },
+    ...probe.note ? { identifiedRunner: probe.note } : {},
+    ...compiledOutputFields({
+      ctx,
+      repoDir,
+      packageDir: resolvedSubdir,
+      runner,
+      invocation,
+      testCommand: effectiveTestCommand,
+      scripts: probe.scripts,
+      manager: pm,
+      angular: probe.angular !== null
+    }),
+    ...runner === "command" ? suiteFanoutPlan(probe, manager) : {}
+  };
+}
+
+// src/aggregator-chain.ts
+import { runnerConfigFromInvocation } from "@abloh/core";
+var EXCLUDE_FLAGS = /* @__PURE__ */ new Set(["--exclude"]);
+var SELECTION_FLAGS = /* @__PURE__ */ new Set([
+  "--filter",
+  "-F",
+  // turbo
+  "--projects",
+  "-p",
+  // nx
+  "--scope",
+  "--ignore",
+  "--since",
+  // lerna
+  "--to"
+  // lage
+]);
+function flagValues(args, names) {
+  const found = [];
+  for (let at = 0; at < args.length; at += 1) {
+    const arg = args[at];
+    const eq = arg.indexOf("=");
+    const name = eq === -1 ? arg : arg.slice(0, eq);
+    if (!names.has(name)) continue;
+    if (eq !== -1) {
+      found.push(arg.slice(eq + 1));
+      continue;
+    }
+    const next = args[at + 1];
+    if (next !== void 0 && !next.startsWith("-")) {
+      found.push(next);
+      at += 1;
+    } else {
+      found.push("");
+    }
+  }
+  return found;
 }
-var WRAPPERS = ["npm-run-all", "run-p", "run-s"];
-var WRAPPER_SCHEDULING_OPTIONS = /^(?:-[aclps]+|--parallel|--sequential|--continue-on-error|--silent|--aggregate-output|--print-label)$/u;
-function leafRunner(leaf) {
-  const named = runnerNamesInScript(leaf);
-  const runner = named.length === 1 ? named[0] : invokesNodeTest(leaf) ? "node-test" : null;
-  if (runner === null || !NATIVE_COVERAGE_RUNNERS.has(runner)) return null;
-  return runnerSuiteInvocations(leaf, runner) > 1 ? null : runner;
+function selectionFlagsPresent(args) {
+  const present = [];
+  for (const arg of args) {
+    const eq = arg.indexOf("=");
+    const name = eq === -1 ? arg : arg.slice(0, eq);
+    if (SELECTION_FLAGS.has(name)) present.push(arg);
+  }
+  return present;
 }
-function wrapperFanout(probe, manager) {
-  const script = probe.testScript;
-  if (script === null) return void 0;
-  const executable = script.trim().split(/\s+/u)[0]?.replace(/^.*\//u, "");
-  if (!WRAPPERS.includes(executable)) return void 0;
-  if (/[;&|<>`]|\$\(/u.test(script)) return { refusal: "it composes shell commands around the wrapper" };
-  let argv;
+function plainGlob(pattern) {
+  const path = pattern.trim().replace(/\\/gu, "/").replace(/^\.\//u, "").replace(/\/+$/u, "");
+  if (path === "" || path.startsWith("/") || /[{}()[\]!?+@|^$]/u.test(path)) return null;
+  if (path.split("/").some((segment) => segment === "..")) return null;
+  const source = path.split("/").map((segment) => segment === "**" ? "[^/]+(?:/[^/]+)*" : segment === "*" ? "[^/]+" : segment.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")).join("/");
   try {
-    argv = parseLiteralArguments2(script, "npm-run-all test script");
+    return new RegExp(`^${source}$`, "u");
   } catch {
-    return { refusal: "its wrapper invocation could not be parsed as one literal command" };
+    return null;
   }
-  const patterns = [];
-  let parallel = executable === "run-p";
-  let sequential = executable === "run-s";
-  for (const arg of argv.slice(1)) {
-    if (arg.startsWith("-")) {
-      if (!WRAPPER_SCHEDULING_OPTIONS.test(arg)) {
-        return { refusal: `the wrapper option ${arg} can change which suites run to completion` };
-      }
-      if (arg === "--parallel" || /^-[aclps]+$/u.test(arg) && arg.includes("p")) parallel = true;
-      if (arg === "--sequential" || /^-[aclps]+$/u.test(arg) && arg.includes("s")) sequential = true;
+}
+var CONFIG_STEMS = {
+  vitest: ["vitest.config", "vite.config"],
+  jest: ["jest.config"],
+  mocha: [".mocharc"],
+  ava: ["ava.config"],
+  jasmine: ["jasmine.json"],
+  tap: ["tap.yaml"]
+};
+var CONFIG_EXTENSIONS = ["", ".ts", ".mts", ".cts", ".js", ".mjs", ".cjs", ".json", ".yaml", ".yml"];
+function configFileFor(repoDir, ctx, directory, runner, script) {
+  const named = runnerConfigFromInvocation({ runner, testCommand: script });
+  if (named !== null) return joinInsideRepository(directory, named);
+  for (const stem of CONFIG_STEMS[runner] ?? []) {
+    for (const extension of CONFIG_EXTENSIONS) {
+      const relative7 = directory === "" ? `${stem}${extension}` : `${directory}/${stem}${extension}`;
+      if (accessKind(ctx, join9(repoDir, relative7)) === "file") return relative7;
+    }
+  }
+  return null;
+}
+function joinInsideRepository(directory, declared) {
+  const raw = declared.replace(/^["']|["']$/gu, "").replace(/\\/gu, "/");
+  if (raw === "" || raw.startsWith("/") || /^[A-Za-z]:/u.test(raw) || /[;&|<>`$]/u.test(raw)) return null;
+  const resolved = [];
+  for (const segment of [...directory.split("/"), ...raw.split("/")]) {
+    if (segment === "" || segment === ".") continue;
+    if (segment === "..") {
+      if (resolved.length === 0) return null;
+      resolved.pop();
       continue;
     }
-    patterns.push(arg);
+    resolved.push(segment);
   }
-  if (patterns.length === 0) return { refusal: "its wrapper selects no scripts" };
-  if (parallel && sequential) return { refusal: "its wrapper asks for parallel and sequential at once" };
-  const selected = /* @__PURE__ */ new Set();
-  const names = Object.keys(probe.scripts).sort();
-  for (const pattern of patterns) {
-    const matches = names.filter((name) => name !== "test" && scriptPattern(pattern).test(name));
-    if (matches.length === 0) return { refusal: `no script matches the pattern ${pattern}` };
-    for (const match of matches) selected.add(match);
+  return resolved.length === 0 ? null : resolved.join("/");
+}
+function manifestAt(ctx, repoDir, directory) {
+  const reading = accessManifest(ctx, join9(repoDir, directory, "package.json"));
+  return reading.standing === "read" ? reading.manifest : null;
+}
+function aggregatorChain(repoDir, ctx = diskRepoAccess(repoDir)) {
+  const rootManifest = manifestAt(ctx, repoDir, "");
+  if (rootManifest === null) return null;
+  const family = aliasHopFamily(rootManifest);
+  const classified = classifyWithAliasHop(rootManifest, family);
+  if (classified.aggregator === null) return null;
+  const invocationScript = classified.aggregatorInvocationScript;
+  const invocation = invocationScript === null ? null : aggregatorInvocation(invocationScript);
+  const args = invocationScript === null ? [] : invocationScript.trim().split(/\s+/u).slice(1);
+  const unreadSelection = selectionFlagsPresent(args);
+  const excludeGlobs = [];
+  for (const value of flagValues(args, EXCLUDE_FLAGS)) {
+    const glob = plainGlob(value);
+    if (glob === null) unreadSelection.push(`--exclude=${value}`);
+    else excludeGlobs.push(glob);
+  }
+  const enumeration = enumerateWorkspacePackages(repoDir, ctx);
+  const packages = [];
+  const gaps = [];
+  const excluded = [];
+  for (const directory of enumeration.packages) {
+    if (excludeGlobs.some((glob) => glob.test(directory))) {
+      excluded.push(directory);
+      continue;
+    }
+    const manifest = manifestAt(ctx, repoDir, directory);
+    if (manifest === null) {
+      gaps.push({ directory, reason: "abloh could not read its package.json" });
+      continue;
+    }
+    const packageFamily = aliasHopFamily(manifest) ?? family;
+    const suite = classifyWithAliasHop(manifest, packageFamily, classified.aggregatorTasks);
+    if (suite.runner === null || suite.testScript === null) {
+      gaps.push({
+        directory,
+        reason: suite.aggregatorTaskRefusal ?? `nothing it declares under ${describeTasks(classified.aggregatorTasks)} runs a test runner abloh recognizes`
+      });
+      continue;
+    }
+    packages.push({
+      directory,
+      task: suite.aggregatorTask ?? "test",
+      script: suite.testScript,
+      runner: suite.runner,
+      configFile: configFileFor(repoDir, ctx, directory, suite.runner, suite.testScript)
+    });
   }
-  const children = scriptChildren([...selected].sort(), probe, manager);
-  return "refusal" in children ? children : { children: children.children, execution: parallel ? "parallel" : "sequential" };
+  return {
+    tool: classified.aggregator,
+    tasks: invocation?.tasks ?? classified.aggregatorTasks,
+    packages,
+    gaps,
+    unreadSelection,
+    excluded,
+    refusals: enumeration.refusals
+  };
 }
-function concurrentlyFanout(probe, manager) {
-  const script = probe.testScript;
-  if (script === null) return void 0;
-  if (script.trim().split(/\s+/u)[0]?.replace(/^.*\//u, "") !== "concurrently") return void 0;
-  if (/[;&|<>`]|\$\(/u.test(script)) return { refusal: "it composes shell commands around concurrently" };
-  let argv;
-  try {
-    argv = parseLiteralArguments2(script, "concurrently test script");
-  } catch {
-    return { refusal: "its concurrently invocation could not be parsed as one literal command" };
+function describeTasks(tasks) {
+  const named = tasks.length === 0 ? ["test"] : [...tasks];
+  if (named.length === 1) return named[0];
+  return `${named.slice(0, -1).join(", ")} or ${named.at(-1)}`;
+}
+
+// src/config-draft.ts
+import { parse as parse2 } from "yaml";
+import {
+  CUSTOMER_TYPED,
+  DeclaredRefusalError as DeclaredRefusalError2,
+  refusalFromFacts as refusalFromFacts2,
+  WORKFLOW_FILE_PATH,
+  WORKFLOW_JOB_ID,
+  SEALED_BUN_VERSION,
+  SEALED_DENO_VERSION,
+  SETUP_SCRIPT_PATH,
+  configFlakyLines,
+  installCommandNeedsCorepackEnable,
+  parseLiteralArguments as parseLiteralArguments2,
+  systemPackageInstallCommand,
+  configHeaderLines,
+  configSettingLines,
+  configSetupJobLines,
+  credentialShapeRefusal,
+  matchesCredentialShape as matchesCredentialShape2,
+  workflowYaml,
+  yamlScalar
+} from "@abloh/core";
+
+// src/init-refusal.ts
+var InitRefusal = class extends Error {
+  failureClass;
+  /**
+   * THE WALK KEY THIS REFUSAL IS ABOUT, where the throw site knows one the class cannot.
+   *
+   * Null on almost every throw, and that is right: the class already implies the key for a refusal
+   * that can only ever be about one - `no-reviewed-image` is `runtimeImage` wherever it is raised,
+   * and `init-refusal-shape.ts` holds that mapping in one table rather than repeating it at forty
+   * throw sites. This field is for the refusals where the class covers SEVERAL keys, which today is
+   * the answers document: `invalid-answers-file` is about whichever key the document got wrong, and
+   * a fix depends on knowing which.
+   */
+  questionKey;
+  /**
+   * THIS REFUSAL'S OWN REMEDY, where the class table's is not true of this instance.
+   *
+   * Null on almost every throw, and that is still right: a per-class remedy is what stops forty
+   * throw sites carrying forty drifting copies of the same sentence. But a CLASS is not always one
+   * situation, and `repository-too-large` is where that broke (external refusal review, rank 15).
+   * Its four throw sites all tell the human to pass `--environment-image`, because the scan they
+   * abandon is the Dockerfile scan and an image is what makes it unnecessary. The class table told
+   * the MACHINE to pass `--subdir`, which narrows nothing: the scan walks the repository root
+   * whatever `--subdir` says. A human and an agent reading the same refusal were sent to different
+   * options, and only one of them could work.
+   *
+   * So a throw site that knows better than its class says so here, and `init-refusal-shape.ts`
+   * prefers it. One refusal instance, one remedy, whoever is reading.
+   */
+  remedy;
+  constructor(failureClass, message, questionKey = null, remedy = null) {
+    super(message);
+    this.name = "InitRefusal";
+    this.failureClass = failureClass;
+    this.questionKey = questionKey;
+    this.remedy = remedy;
   }
-  const patterns = [];
-  for (const arg of argv.slice(1)) {
-    if (arg.startsWith("-")) {
-      if (!/^(?:--(?:names|prefix|prefix-colors|group|raw)|-[np]|-c)$/u.test(arg)) {
-        return { refusal: `the concurrently option ${arg} can change which suites run to completion` };
+};
+function initRefusal(failureClass, message, questionKey = null, remedy = null) {
+  return new InitRefusal(failureClass, message, questionKey, remedy);
+}
+function refusalRemedyOf(error) {
+  return error instanceof InitRefusal ? error.remedy : null;
+}
+function initFailureClassOf(error) {
+  return error instanceof InitRefusal ? error.failureClass : "unclassified";
+}
+
+// src/config-draft.ts
+function commentLines(text, indent, width = 108) {
+  const lines = [];
+  let current = "";
+  for (const word of text.split(/\s+/u).filter((value) => value !== "")) {
+    const candidate = current === "" ? word : `${current} ${word}`;
+    if (`${indent}# ${candidate}`.length > width && current !== "") {
+      lines.push(`${indent}# ${current}`);
+      current = word;
+      continue;
+    }
+    current = candidate;
+  }
+  if (current !== "") lines.push(`${indent}# ${current}`);
+  return lines;
+}
+function renderEnvironmentBlock(input) {
+  const quote = input.yamlQuote ?? '"';
+  const receiptLinesQ = (entries, indent) => receiptLines(entries, indent, quote);
+  const lines = [];
+  if (input.coverageNote != null) lines.push(...commentLines(input.coverageNote, "", 80), "");
+  if (input.subdir !== null) {
+    lines.push(
+      "# The package measured.",
+      "target:",
+      `  directory: ${yamlScalar(input.subdir, quote)}`,
+      ""
+    );
+  }
+  lines.push(
+    ENVIRONMENT_BLOCK_HEADER,
+    "environment:",
+    ...receiptLinesQ([
+      { key: "runtimeImage", value: input.runtimeImage, receipt: input.evidence.runtimeImage }
+    ], "  "),
+    ...input.runtimes.length === 0 ? [] : [
+      "  runtimes: # pinned runtimes added to the proof image, installed at build time",
+      ...input.runtimes.flatMap((need) => [
+        ...commentLines(need.evidence, "    "),
+        `    - ${yamlScalar(need.runtime, quote)}`
+      ])
+    ],
+    ...input.browser === null ? [] : [
+      ...commentLines(
+        "your suite drives a real browser, so the proof image carries one and the run uses the browser seal - still --network none, reaching 127.0.0.1 and nothing else. Read from: " + input.browser.evidence.join("; "),
+        "  "
+      ),
+      `  browser: ${yamlScalar(input.browser.value, quote)}`
+    ],
+    `  installDirectory: ${yamlScalar(input.installDirectory, quote)}`,
+    ...receiptLinesQ([
+      /* THE POINTER, WHERE FOUR DERIVED KEYS USED TO BE (Kenneth, 2026-08-26). `systemPackages`,
+         `installCommand` and `setupCommands` are the commands that turn a checkout into a tree the
+         suite can run in, and they are now steps in a file the customer owns. What is left in this
+         block is everything that is NOT a command: the image, the directory, the test commands, the
+         services, the variables, the files. The receipt names the script rather than a source file
+         because the script carries a receipt of its own on every step. */
+      {
+        key: "setup",
+        value: input.setupPath ?? SETUP_SCRIPT_PATH,
+        receipt: "written by init and yours to edit. Every cold run executes it step by step"
+      },
+      /* THE ONE THING THE SCRIPT CANNOT SAY, so the file still does: WHY there is no install step
+         in it. A repository with no frozen recipe gets a script with nothing to install, and a
+         reader who only ever opens `abloh.yml` would otherwise see a pointer at a file that quietly
+         does less than they think. The remedy is the same sentence the console prints. */
+      ...input.installCommand === null ? [{ key: "installCommand", value: null, receipt: input.evidence.installCommand }] : [],
+      /* THE ONE RECEIPT THAT GAINS A CLAUSE IN THE FILE TOO, and only on the repositories it is
+         true of. `genericAdapterCost` carries what changed and why the prompt alone was not it. */
+      {
+        key: "testCommand",
+        value: input.testCommand,
+        receipt: testCommandReceipt({
+          evidence: input.evidence.testCommand,
+          cost: input.testCommandCostNote
+        })
+      },
+      /* WRITTEN ONLY WHERE IT SAYS SOMETHING, and its receipt is the whole reason it says anything.
+         See `ConfigInput.runner`: on an uncontested repository the key would restate what
+         `bindPreparedTestCommand` reads off the command one line above, so there is no line and the
+         PROMPT is where the detected runner is shown. Where a candidate was discarded, the line
+         records the decision AND names what was skipped, in the same words the prompt used - which
+         is what makes an unattended init as informed as an interactive one. */
+      ...input.runner === null ? [] : [{ key: "runner", value: input.runner, receipt: input.evidence.runner }],
+      /* THE ANSWER TO THE ONE QUESTION A VITEST REPOSITORY WITH NO COVERAGE PROVIDER IS ASKED.
+         WRITTEN ONLY WHERE SOMEBODY ANSWERED IT, on the same restraint every derived key here
+         follows: absent already means `install`, so a line saying `install` on a repository nobody
+         asked would be a claim about a conversation that never happened. Both answers are written
+         where there WAS one, because the file is where the run reads it. */
+      ...input.coverageProvider === void 0 ? [] : [{
+        key: "coverageProvider",
+        value: input.coverageProvider,
+        receipt: input.coverageProvider === "install" ? "you agreed abloh may stage @vitest/coverage-v8 where a run measures, into its own cache outside this repository" : "you asked abloh not to install @vitest/coverage-v8, so the changed-line check reports itself as declined"
+      }],
+      ...input.sealedTestCommand !== null || input.sealedNote !== null ? [{
+        key: "sealedTestCommand",
+        value: input.sealedTestCommand,
+        receipt: input.sealedTestCommand === null ? input.sealedNote ?? "" : input.evidence.sealedTestCommand
+      }] : [],
+      /* THE ONE KEY WHOSE ABSENCE PRODUCES A WRONG NUMBER RATHER THAN A REFUSAL, so the file states
+         the finding even when it cannot state a value: a reviewer reading a commented-out
+         `rebuildCommand` beside "these two files say your tests read your build output" has the
+         whole question in front of them, and a file that stayed silent would leave a run reporting
+         every mutant as a survivor with nothing anywhere to explain it. */
+      ...input.rebuild === null ? [] : [{
+        key: "rebuildCommand",
+        value: input.rebuild.value,
+        /* THE KEY IS NAMED IN THE SENTENCE, because a null value renders as a bare comment with
+           no key beside it - and a reader who agrees with the finding then has nothing to type.
+           It is the same rule `installRemedy` follows one key up. */
+        receipt: input.rebuild.value !== null ? input.rebuild.evidence : `${input.rebuild.evidence}. Set rebuildCommand to the build that writes it - this package declares ${input.rebuild.candidates.join(" and ")}. Without one, every planted bug is reported as missed`
+      }]
+    ], "  ")
+  );
+  if (input.services.length > 0) {
+    lines.push(
+      "  services: # fresh instances per proof phase, reachable on localhost exactly as in your CI"
+    );
+    for (const service of input.services) {
+      lines.push(
+        ...commentLines(service.evidence, "    "),
+        `    - name: ${yamlScalar(service.name, quote)}`,
+        `      image: ${yamlScalar(service.image, quote)}`
+      );
+      if (service.env.length > 0) {
+        lines.push("      env: # your workflow's own values; the suite connects with these");
+        for (const entry of service.env) lines.push(`        ${entry.name}: ${yamlScalar(entry.value, quote)}`);
+      }
+      if (service.healthCommand !== null) {
+        lines.push(`      healthCommand: ${yamlScalar(service.healthCommand, quote)}`);
+      }
+      if (service.healthPort !== null) lines.push(`      healthPort: ${service.healthPort}`);
+      if (service.localhostPort != null && service.localhostPort !== service.healthPort) {
+        lines.push(
+          `      localhostPort: ${service.localhostPort} # another declared service listens on this one's port, so a run reaches it here`
+        );
       }
-      continue;
-    }
-    if (!arg.startsWith("npm:")) {
-      return { refusal: "concurrently is given a raw command line rather than an npm: script reference" };
     }
-    patterns.push(arg.slice("npm:".length));
-  }
-  if (patterns.length === 0) return { refusal: "its concurrently invocation selects no scripts" };
-  const selected = /* @__PURE__ */ new Set();
-  const names = Object.keys(probe.scripts).sort();
-  for (const pattern of patterns) {
-    const matches = names.filter((name) => name !== "test" && scriptPattern(pattern).test(name));
-    if (matches.length === 0) return { refusal: `no script matches the pattern ${pattern}` };
-    for (const match of matches) selected.add(match);
   }
-  const children = scriptChildren([...selected].sort(), probe, manager);
-  return "refusal" in children ? children : { children: children.children, execution: "parallel" };
-}
-function scriptChildren(scripts, probe, manager) {
-  if (scripts.length === 0) return { refusal: "it selects no scripts" };
-  if (scripts.length > MAX_FANOUT_CHILDREN) {
-    return { refusal: `it launches ${scripts.length} suites, more than the ${MAX_FANOUT_CHILDREN} this run will measure` };
+  if (input.identityFiles.length > 0) {
+    lines.push("  identityFiles: # a change here makes CI reinstall instead of reusing its image");
+    for (const path of input.identityFiles) lines.push(`    - ${yamlScalar(path, quote)}`);
   }
-  const children = [];
-  for (const script of scripts) {
-    if (!/^[A-Za-z0-9:_-]{1,128}$/u.test(script)) return { refusal: `the script name ${script} is not a plain name` };
-    const leaf = probe.scripts[script];
-    if (leaf === void 0 || /[;&|<>`]|\$\(/u.test(leaf)) {
-      return { refusal: `the script ${script} composes shell commands rather than running one suite` };
-    }
-    let leafArgv;
-    try {
-      leafArgv = parseLiteralArguments2(leaf, `fanout child ${script}`);
-    } catch {
-      return { refusal: `the script ${script} could not be parsed as one literal command` };
-    }
-    if (leafArgv.some((arg) => WRAPPERS.includes(arg))) {
-      return { refusal: `the script ${script} is itself a wrapper, and this expands one level only` };
+  if (input.requiredVariables.length > 0) {
+    lines.push("  requiredVariables: # names only; values come from your environment and are masked in every log");
+    for (const variable of input.requiredVariables) {
+      lines.push(...commentLines(variable.evidence, "    "), `    - ${yamlScalar(variable.name, quote)}`);
     }
-    const runner = leafRunner(leaf);
-    if (runner === null) return { refusal: `the script ${script} names no single runner with native coverage` };
-    children.push({ script, runner, testCommand: packageScriptCommand(manager, script) });
-  }
-  return { children };
-}
-function chainFanout(probe, manager) {
-  const script = probe.testScript;
-  if (script === null || script.trim() === "") return void 0;
-  if (suiteStages(script, probe.scripts) < 2) return void 0;
-  if (/[|<>`]|\$\(/u.test(script) || /(^|[^&])&([^&]|$)/u.test(script)) {
-    return { refusal: "its suites are composed with something other than `&&`, so which of them ran is not decidable" };
-  }
-  if (script.includes(";")) {
-    return { refusal: "its suites are separated by `;`, which runs the next one whether or not the last passed" };
-  }
-  const chainStages = script.split("&&").map((stage) => stage.trim());
-  if (chainStages.some((stage) => stage === "")) return { refusal: "its `&&` chain has an empty stage" };
-  if (chainStages.length > MAX_FANOUT_CHILDREN) {
-    return { refusal: `it chains ${chainStages.length} stages, more than the ${MAX_FANOUT_CHILDREN} this run will measure` };
   }
-  const children = [];
-  for (const stage of chainStages) {
-    if (suiteStages(stage, probe.scripts) === 0) continue;
-    const alias = /^(?:corepack\s+)?(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?([A-Za-z0-9:._-]+)$/u.exec(stage);
-    if (alias !== null) {
-      const family = stage.trim().replace(/^corepack\s+/u, "").split(/\s+/u)[0];
-      if (family !== manager.pm) {
-        return { refusal: `the stage \`${stage}\` runs under ${family} while this package resolves to ${manager.pm}` };
-      }
-      const named = scriptChildren([alias[1]], probe, manager);
-      if ("refusal" in named) return named;
-      children.push(...named.children);
-      continue;
-    }
-    const runner = [...NATIVE_COVERAGE_RUNNERS].find((candidate) => stageInvokes(stage, candidate));
-    if (runner === void 0) {
-      return { refusal: `the stage \`${stage}\` is neither a suite nor a script this run can name` };
+  if (input.environmentValues.length > 0) {
+    for (const variable of input.environmentValues) {
+      const shape = matchesCredentialShape2(variable.value);
+      if (shape !== null) throw initRefusal("credential-in-environment-value", credentialShapeRefusal(variable.name, shape));
     }
-    const testCommand = runner === "node-test" ? stage : `npx --no-install ${stage}`;
-    try {
-      parsePreparedTestCommand(testCommand, "fanout stage");
-    } catch {
-      return { refusal: `the stage \`${stage}\` is not a literal command this run can execute on its own` };
+    lines.push("  environmentValues: # literal values your CI sets; a secret goes in requiredVariables, by name");
+    for (const variable of input.environmentValues) {
+      lines.push(
+        ...commentLines(variable.evidence, "    "),
+        `    ${variable.name}: ${yamlScalar(variable.value, quote)}`
+      );
     }
-    children.push({ runner, testCommand });
-  }
-  if (children.length < 2) return void 0;
-  return { children, execution: "sequential" };
-}
-function suiteFanoutPlan(probe, manager) {
-  const aggregated = probe.aggregator === null ? null : { tool: probe.aggregator, tasks: [...probe.aggregatorTasks] };
-  if (aggregated !== null) {
-    return {
-      coverageExclusion: `this package's test script delegates to ${aggregated.tool}, which runs ${aggregatorTaskPhrase(aggregated)} rather than one suite, so no single coverage report describes it; abloh measures such a repository per package instead`
-    };
-  }
-  const resolved = wrapperFanout(probe, manager) ?? concurrentlyFanout(probe, manager) ?? chainFanout(probe, manager);
-  if (resolved === void 0) return {};
-  if ("refusal" in resolved) {
-    return { coverageExclusion: `this package's test script launches more than one suite, but ${resolved.refusal}` };
-  }
-  const runners = [...new Set(resolved.children.map((child) => child.runner))].sort();
-  if (runners.length > 1) {
-    return {
-      coverageExclusion: `this package's test script launches ${resolved.children.length} suites across ${runners.join(" and ")}, and one coverage report cannot carry two providers, so none of them is measured rather than some`
-    };
   }
-  return { coverageChildren: resolved.children, coverageExecution: resolved.execution };
-}
-function compiledOutputFields(input) {
-  if (input.angular || input.runner === "deno") return {};
-  const reading = readsCompiledOutput({
-    /*
-     * THE ONE READING ON THIS PATH THAT DOES NOT GO THROUGH THE REPOSITORY READER, and it is a
-     * decision rather than an oversight.
-     *
-     * `readsCompiledOutput` FOLLOWS `extends` INTO `node_modules` by design - rushstack's projects
-     * extend `@rushstack/heft-node-rig/profiles/default/tsconfig-base.json`, whose `outDir` is five
-     * hops out of the store and back into the project's own `lib`, and refusing to follow it means
-     * this reading never sees the repository the compile-then-test ruling was measured on. An
-     * installed store is exactly where symlinks live and exactly where "inside the checkout" is a
-     * different question, so the reader's two refusals - a symlinked leaf, and a parent that
-     * resolves outside the root - would silently narrow it. What that costs is not a refusal: a
-     * config this reading cannot see produces a different `rebuildCommand`, and a wrong rebuild is
-     * the one failure in this product that ends in a confident WRONG NUMBER.
-     *
-     * IT IS SAFE HERE FOR THE REASON THE READER EXISTS ELSEWHERE. The paths are composed by
-     * `compiled-output.ts` from a config's own `extends` and from `node_modules` walked upwards,
-     * never from a repository-author-controlled string this module passes through; and the only
-     * road that reaches it is one that HAS a checkout, since a service reading over the contents
-     * API has no installed store to follow into anyway.
-     */
-    readFile: (path) => {
-      const absolute = join8(input.repoDir, ...path.split("/"));
-      if (!existsSync2(absolute)) return null;
-      try {
-        return readFileSync5(absolute, "utf8");
-      } catch {
-        return null;
-      }
-    },
-    packageDir: input.packageDir ?? "",
-    runner: input.runner,
-    invocation: input.invocation,
-    /* THE COMMAND THIS RUN EXECUTES, beside the invocation and never instead of it. `runnerInvocation`
-       answers a narrower question - whether a stage can be RE-EMITTED - so it declines a stage with
-       anything in front of the runner, and `devcontainers/cli`'s whole suite is
-       `env TS_NODE_PROJECT=... mocha ... src/test/*.test.ts`. The reading in `@abloh/core` resolves the
-       runner's stage out of this where no invocation arrived; its own header states both halves. */
-    testCommand: input.testCommand,
-    scripts: input.scripts,
-    manager: input.manager,
-    /*
-     * THE SECOND READING'S SEAM IS THE REPOSITORY READER and never the raw filesystem one above.
-     *
-     * That one exists to follow a `tsconfig` `extends` into an installed store, which is the one
-     * place this detection legitimately leaves the tree. This reading opens the SUITE'S OWN TEST
-     * FILES, which are the repository's, so it takes the reader whose refusals are about staying
-     * inside it - a symlinked leaf and a parent resolving out of the root.
-     */
-    reader: input.ctx.reader
-  });
-  const found = reading.state === "reads-compiled-output" ? reading : null;
-  return {
-    rebuildCommand: found?.rebuildCommand ?? void 0,
-    rebuildEvidence: found === null ? void 0 : compiledOutputEvidence(found),
-    rebuildCandidates: found === null || found.candidates.length === 0 ? void 0 : found.candidates,
-    rebuildOutputDirectory: found?.outputDirectory ?? void 0
-  };
-}
-function repositoryRootOf(detected) {
-  if (detected.subdir === null || detected.workspaceRootSuite !== void 0) return detected.workDir;
-  return resolve6(detected.workDir, ...detected.subdir.split("/").map(() => ".."));
-}
-var VITEST_CONFIG_FILES = [
-  "vitest.config.ts",
-  "vitest.config.mts",
-  "vitest.config.cts",
-  "vitest.config.js",
-  "vitest.config.mjs",
-  "vitest.config.cjs",
-  "vite.config.ts",
-  "vite.config.mts",
-  "vite.config.cts",
-  "vite.config.js",
-  "vite.config.mjs",
-  "vite.config.cjs"
-];
-function detectVitestDir(dir, ctx = diskRepoAccess(dir)) {
-  for (const name of VITEST_CONFIG_FILES) {
-    const p = join8(dir, name);
-    let src;
-    try {
-      src = accessText(ctx, p);
-    } catch (e) {
-      debugPreparationOverflowStack(e);
-      throw new TargetDetectionError(
-        `${name} at ${dir} could not be read: ${e instanceof Error ? e.message : "unreadable"}`
-      );
+  if (input.generatedFiles.length > 0) {
+    lines.push("  generatedFiles: # written by your tooling during a run; an undeclared change aborts it");
+    for (const generated of input.generatedFiles) {
+      lines.push(...commentLines(generated.evidence, "    "), `    - ${yamlScalar(generated.path, quote)}`);
     }
-    if (src === null) continue;
-    return vitestDirIn(src);
   }
-  return void 0;
-}
-function vitestDirIn(source) {
-  const masked = maskLiterals(source);
-  const open = firstUnmasked(source, masked, /(?:^|[\s,;{])["']?test["']?\s*:\s*\{/gu);
-  if (open === -1) return void 0;
-  let depth = 0;
-  let close = -1;
-  for (let at = open; at < masked.length; at++) {
-    if (masked[at] === "{") depth += 1;
-    else if (masked[at] === "}") {
-      depth -= 1;
-      if (depth === 0) {
-        close = at;
-        break;
-      }
+  if (input.rewrittenFiles.length > 0) {
+    lines.push("  rewrittenFiles: # committed files your own install rewrites; measured as your install left them");
+    for (const rewritten of input.rewrittenFiles) {
+      lines.push(...commentLines(rewritten.evidence, "    "), `    - ${yamlScalar(rewritten.path, quote)}`);
     }
   }
-  if (close === -1) return void 0;
-  const quote = firstUnmasked(source.slice(0, close), masked.slice(0, close), /\bdir["']?\s*:\s*['"`]/gu, open);
-  if (quote === -1) return void 0;
-  const end = masked.indexOf(source[quote], quote + 1);
-  if (end === -1 || end >= close) return void 0;
-  const value = source.slice(quote + 1, end);
-  return value === "" ? void 0 : value;
+  return lines;
 }
-function firstUnmasked(source, masked, pattern, from = 0) {
-  pattern.lastIndex = from;
-  for (let match = pattern.exec(source); match !== null; match = pattern.exec(source)) {
-    const at = match.index + match[0].length - 1;
-    if (masked[at] === source[at]) return at;
+function renderConfig(input) {
+  const coverage = input.coverageNote == null ? [] : [...commentLines(input.coverageNote, "", 80), ""];
+  const lines = [
+    ...coverage,
+    ...configHeaderLines("init"),
+    ...configSettingLines(),
+    /* AFTER THE TWO SETTINGS EVERY FILE CARRIES AND BEFORE THE JOB, because it is a setting of the
+       same kind - a rule about the whole run rather than a fact about this repository's CI. */
+    ...configFlakyLines(input.flaky),
+    /* BEFORE THE ENVIRONMENT BLOCK, because it is the shortest answer to the first question a
+       reviewer of this pull request asks - "which of our jobs is this running in" - and the
+       environment block below is the long answer to a different one. */
+    ...configSetupJobLines(
+      input.setupJob,
+      input.setupMatrixLeg,
+      input.setupFailFast,
+      input.setupStepUnreadableConditions,
+      input.yamlQuote ?? '"'
+    ),
+    ...renderEnvironmentBlock({ ...input, coverageNote: null })
+  ];
+  return `${lines.join("\n")}
+`;
+}
+function renderWorkflow(input) {
+  return readableWorkflow(workflowYaml({
+    node: input.workflowNode,
+    /* THE ONE RECIPE, NAMED. `environment.setup` when the repository declares its own path, so a
+       re-run of `init` over a customer's chosen path writes a workflow that calls that path. */
+    setupScriptPath: input.setupPath ?? SETUP_SCRIPT_PATH,
+    /* The same directory the sealed image runs those steps in - `installWorkdir` in the runner -
+       because a recipe that installs in one directory on the runner and another in the proof image
+       is two recipes again. */
+    setupWorkingDirectory: input.installDirectory,
+    runtimes: input.runtimes.map((need) => ({
+      name: need.runtime,
+      version: need.runtime === "bun" ? SEALED_BUN_VERSION : SEALED_DENO_VERSION,
+      evidence: need.evidence
+    }))
+  }));
+}
+function readableWorkflow(text) {
+  try {
+    parse2(text);
+  } catch (error) {
+    throw new DeclaredRefusalError2(refusalFromFacts2({
+      kind: "setup-step-written",
+      workflow: WORKFLOW_FILE_PATH,
+      job: WORKFLOW_JOB_ID,
+      why: `it does not parse as YAML: ${error instanceof Error ? error.message : "unknown error"}`
+    }));
   }
-  return -1;
+  return text;
 }
-function maskLiterals(source) {
-  const out = source.split("");
-  const blank = (from, to) => {
-    for (let at2 = from; at2 < to && at2 < out.length; at2++) if (out[at2] !== "\n") out[at2] = " ";
-  };
-  let at = 0;
-  let previous = "";
-  while (at < source.length) {
-    const char = source[at];
-    if (char === '"' || char === "'" || char === "`") {
-      let end = at + 1;
-      while (end < source.length && source[end] !== char) end += source[end] === "\\" ? 2 : 1;
-      blank(at + 1, end);
-      at = Math.min(end + 1, source.length);
-      previous = char;
-      continue;
-    }
-    if (char === "/" && source[at + 1] === "/") {
-      const end = source.indexOf("\n", at);
-      blank(at, end === -1 ? source.length : end);
-      at = end === -1 ? source.length : end;
+function testCommandReceipt(input) {
+  return input.cost == null ? input.evidence : `${input.evidence}. ${input.cost}`;
+}
+function receiptLines(entries, indent, quote) {
+  const bodyOf = (entry) => entry.value === null ? null : `${indent}${entry.key}: ${yamlScalar(entry.value, quote)}`;
+  const itemBody = (item) => `${indent}  - ${yamlScalar(item.value, quote)}`;
+  const withReceipt = (body, receipt) => `${body} # ${receipt}`;
+  const lines = [];
+  for (const entry of entries) {
+    if (entry.items !== void 0) {
+      if (entry.items.length === 0) continue;
+      lines.push(`${indent}${entry.key}:${entry.receipt === "" ? "" : ` # ${entry.receipt}`}`);
+      for (const item of entry.items) lines.push(withReceipt(itemBody(item), item.receipt));
       continue;
     }
-    if (char === "/" && source[at + 1] === "*") {
-      const end = source.indexOf("*/", at + 2);
-      blank(at, end === -1 ? source.length : end + 2);
-      at = end === -1 ? source.length : end + 2;
+    const body = bodyOf(entry);
+    if (body === null) {
+      if (entry.receipt !== "") lines.push(`${indent}# ${entry.key}: ${entry.receipt}`);
       continue;
     }
-    if (char === "/" && previous !== "" && /[(,=:[!&|?{};+\-*]/u.test(previous)) {
-      let end = at + 1;
-      while (end < source.length && source[end] !== "/" && source[end] !== "\n") end += source[end] === "\\" ? 2 : 1;
-      if (source[end] === "/") {
-        blank(at, end + 1);
-        at = end + 1;
-        continue;
-      }
-    }
-    if (!/\s/u.test(char)) previous = char;
-    at += 1;
+    lines.push(withReceipt(body, entry.receipt));
   }
-  return out.join("");
+  return lines;
 }
-function workDirPrefix(detection) {
-  return detection.workspaceRootSuite === void 0 ? detection.subdir : null;
+var ENVIRONMENT_BLOCK_HEADER = "# How CI rebuilds this project for abloh's check. Comments name the source file.";
+var RETIRED_ENVIRONMENT_BLOCK_HEADERS = [
+  "# Rebuild recipe for the proof container. Comments name the source file."
+];
+function isEnvironmentBlockHeader(line) {
+  return line === ENVIRONMENT_BLOCK_HEADER || RETIRED_ENVIRONMENT_BLOCK_HEADERS.includes(line);
 }
-function classicPerTestRunner(runner) {
-  return runner !== "command" && classicPerTestRefusal(runner) === null;
+var STEP_WHAT = {
+  systemPackages: "OS packages your suite needs, pinned",
+  corepack: "put the package manager on PATH, for your own lifecycle scripts",
+  install: "dependencies, from your lockfile",
+  /**
+   * THE SAME STEP ON A REPOSITORY THAT CARRIES NO LOCKFILE (census run 7 F3, 2026-09-06).
+   *
+   * A SECOND SPELLING RATHER THAN A REWORD, on the rule above: `install`'s exact text is what a
+   * re-run recognizes as its own step, so changing it would orphan every install step already
+   * committed. Both are install steps to {@link initStepRole} and to {@link isInstallStep}, which is
+   * what every reader asks instead of comparing against one of them.
+   *
+   * IT EXISTS BECAUSE THE OTHER ONE WOULD BE FALSE. `fastify/fastify` and `pinojs/pino` both
+   * `.gitignore` their lockfile, so the drafted step resolves rather than installing frozen, and a
+   * comment saying "from your lockfile" above a command that has none is a claim the file cannot
+   * back. The `source` beside it names the ignore rule.
+   */
+  installUnlocked: "dependencies, resolved - your repository commits no lockfile",
+  build: "your build"
+};
+function isInstallStep(what) {
+  return what === STEP_WHAT.install || what === STEP_WHAT.installUnlocked;
 }
-function classicPerTestRefusal(runner) {
-  return runner === "deno" ? "deno's mutation runs the whole suite per mutant (Stryker ships no deno runner), so the classic per-test layer has no per-test report to read; the sealed v2 engine drives deno one test at a time and is where a proposed test for this repository comes from" : null;
+function setupStepOrigin(step) {
+  const role = initStepRole(step.what);
+  if (role === null) return CUSTOMER_TYPED;
+  return role === "setupCommands" ? "abloh-composed" : "abloh-derived";
 }
-function declaresWorkspace(ctx, repoDir) {
-  for (const name of ["pnpm-workspace.yaml", "pnpm-workspace.yml", "nx.json", "lerna.json"]) {
-    if (accessExists(ctx, join8(repoDir, name))) return true;
-  }
-  try {
-    const reading = accessManifest(ctx, join8(repoDir, "package.json"));
-    if (reading.standing !== "read") return false;
-    const workspaces = reading.manifest.workspaces;
-    if (Array.isArray(workspaces)) return workspaces.length > 0;
-    if (workspaces !== null && typeof workspaces === "object") {
-      return Array.isArray(workspaces.packages);
+function initStepRole(what) {
+  if (what === STEP_WHAT.systemPackages) return "systemPackages";
+  if (what === STEP_WHAT.corepack || isInstallStep(what)) return "installCommand";
+  if (what === STEP_WHAT.build) return "setupCommands";
+  return null;
+}
+function systemPackagesStep(pinned) {
+  if (pinned.length === 0) return null;
+  return {
+    what: STEP_WHAT.systemPackages,
+    source: [...new Set(pinned.map((entry) => entry.source))].join(", "),
+    /* THE SAME COMMAND THE IMAGE ALREADY RAN, one line per operation rather than one semicolon
+       chain, because this file is read by a person now. `set -e` is in the header, so the chain's
+       own guard is redundant here and its semicolons are noise. */
+    command: systemPackageInstallCommand(pinned, { pin: "optional" }).replace(/^set -e;\s*/u, "").split(";").map((part) => part.trim()).filter((part) => part !== "").join("\n")
+  };
+}
+function stepBody(env, command) {
+  if (env.length === 0) return command;
+  return [
+    ...[...env].sort((left, right) => left.name.localeCompare(right.name)).map((value) => `export ${value.name}=${shellSingleQuoted(value.value)}`),
+    command
+  ].join("\n");
+}
+function shellSingleQuoted(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function setupScriptSteps(input) {
+  const steps = [];
+  const pinned = systemPackagesStep(input.systemPackages);
+  if (pinned !== null) steps.push(pinned);
+  if (input.installCommand !== null) {
+    if (installCommandNeedsCorepackEnable(parseLiteralArguments2(input.installCommand))) {
+      steps.push({
+        what: STEP_WHAT.corepack,
+        source: input.evidence.installCommand,
+        command: "corepack enable"
+      });
     }
-  } catch {
-    return false;
+    steps.push({
+      /* The step and its comment are one statement: a resolved install may not be introduced as
+         coming from a lockfile the commit does not hold. See {@link ConfigInput.installUnlocked}. */
+      what: input.installUnlocked === true ? STEP_WHAT.installUnlocked : STEP_WHAT.install,
+      source: input.evidence.installCommand,
+      /* THE COMMAND IS ABLOH'S AND THE ENVIRONMENT IS THE CUSTOMER'S. See
+         {@link ConfigInput.installEnvironment}: the command comes from the lockfile and the values
+         come from the step their own CI installs with. */
+      command: stepBody(input.installEnvironment, input.installCommand)
+    });
+  }
+  for (const entry of input.setupCommands) {
+    steps.push({ what: STEP_WHAT.build, source: entry.source, command: stepBody(entry.env, entry.command) });
+  }
+  return steps;
+}
+
+// src/setup-question-descriptor.ts
+import {
+  judgeConfigKeyValue,
+  SETUP_FAIL_FAST_ANSWERS,
+  SETUP_FAIL_FAST_CONSEQUENCES
+} from "@abloh/core";
+var ATOM = /\s*,\s*/u;
+var COMMANDS = /\s*&&\s*/u;
+function splitAnswerList(shape, raw) {
+  const trimmed = raw.trim();
+  if (trimmed === "") return [];
+  return trimmed.split(shape.kind === "commands" ? COMMANDS : ATOM).map((entry) => entry.trim()).filter((entry) => entry !== "");
+}
+function splitAtFirstEquals(entry) {
+  const at = entry.indexOf("=");
+  return at === -1 ? [entry, null] : [entry.slice(0, at), entry.slice(at + 1)];
+}
+var SERVICE_ENTRY = /^(?<image>.*@sha256:[a-f0-9]{64})(?::(?<port>\d{1,5}))?$/u;
+function readServiceEntries(raw) {
+  return splitAnswerList({ kind: "list" }, raw).map((entry) => {
+    const [name, rest] = splitAtFirstEquals(entry);
+    const gate = rest === null ? null : SERVICE_ENTRY.exec(rest);
+    if (gate === null) return { name, image: rest ?? "" };
+    const port = gate.groups?.["port"];
+    return {
+      name,
+      image: gate.groups?.["image"] ?? "",
+      ...port === void 0 ? {} : { healthPort: Number(port) }
+    };
+  });
+}
+function readAnswerValue(descriptor, raw) {
+  switch (descriptor.shape.kind) {
+    case "scalar":
+      return raw.trim();
+    case "list":
+      return splitAnswerList(descriptor.shape, raw);
+    case "commands":
+      return splitAnswerList(descriptor.shape, raw);
+    case "names":
+      return splitAnswerList(descriptor.shape, raw);
+    case "packages":
+      return splitAnswerList(descriptor.shape, raw).map((entry) => {
+        const [name, version] = splitAtFirstEquals(entry);
+        return version === null ? { name } : { name, version };
+      });
+    case "services":
+      return readServiceEntries(raw);
+    case "pairs":
+      return Object.fromEntries(
+        splitAnswerList(descriptor.shape, raw).map((entry) => {
+          const [name, value] = splitAtFirstEquals(entry);
+          return [name, value ?? ""];
+        })
+      );
   }
-  return false;
 }
-var NAMED_CANDIDATES = 8;
-function testableWorkspacePackages(repoDir, refusals, ctx = diskRepoAccess(repoDir)) {
-  const aliasFamily = rootAliasFamily(ctx, repoDir);
-  const aggregatorTasks = rootAggregatorTasksInRepository(ctx, repoDir);
-  const found = [];
-  const enumeration = enumerateWorkspacePackages(repoDir);
-  if (refusals !== void 0) refusals.push(...enumeration.refusals);
-  for (const dir of enumeration.packages) {
-    const { probe, refusal } = probePkg(ctx, join8(repoDir, dir), aliasFamily, repoDir, aggregatorTasks);
-    if (refusal !== null) {
-      if (refusals !== void 0) refusals.push(refusal.summary);
-      continue;
-    }
-    if (probe === null) continue;
-    if (probe.runner !== null || declaresASuite(probe)) found.push(dir);
+function setupAnswerProblem(key, raw) {
+  const descriptor = SETUP_QUESTION_DESCRIPTORS[key];
+  if (descriptor === void 0) return `abloh asks no question about ${key}`;
+  const value = raw.trim();
+  if (value === "") return descriptor.required ? "this question needs an answer" : null;
+  if (descriptor.candidates.length > 0 && !descriptor.candidates.includes(value)) {
+    return `${value} is not one of ${descriptor.candidates.join(", ")}`;
   }
-  return found;
-}
-function declaresASuite(probe) {
-  if (probe.testScript === null) return false;
-  const runs = scriptRuns2({ scripts: probe.scripts, text: probe.testScript });
-  if (runs.length === 0) return true;
-  return runs.some((run) => run.kind === "test" || run.kind === "unknown");
+  if (descriptor.key !== "target.directory" && descriptor.channel === "discovery") return null;
+  const verdict = judgeConfigKeyValue(key, readAnswerValue(descriptor, raw));
+  if (verdict.ok) return null;
+  return verdict.at === null || verdict.at === void 0 ? verdict.reason : `${verdict.at} ${verdict.reason}`;
 }
-function candidateRemedy(repoDir) {
-  const refusals = [];
-  const candidates = testableWorkspacePackages(repoDir, refusals);
-  if (candidates.length === 0) {
-    return refusals.length > 0 ? `${refusals[0]}. Declare environment.testCommand in abloh.yml with the command that runs your suite, or run abloh init from the package that holds it` : "declare environment.testCommand in abloh.yml with the command that runs your suite, or run abloh init from the package that holds it";
+function applyAnswersToContract(draft, answers) {
+  let out = draft;
+  for (const descriptor of Object.values(SETUP_QUESTION_DESCRIPTORS)) {
+    if (descriptor.apply === void 0) continue;
+    const raw = answers[descriptor.key];
+    if (raw === void 0 || raw.trim() === "") continue;
+    out = descriptor.apply(out, raw);
   }
-  return `point --subdir (or abloh.yml target.directory) at one of the ${candidates.length} package(s) here that declare a suite, such as ${candidates[0]}`;
+  return out;
 }
-function candidateSentence(repoDir) {
-  const candidates = testableWorkspacePackages(repoDir);
-  if (candidates.length === 0) return "";
-  const named = candidates.slice(0, NAMED_CANDIDATES);
-  const more = candidates.length - named.length;
-  return `. The packages here that declare a suite are ${named.join(", ")}` + (more > 0 ? ` and ${more} more` : "");
+var ANSWERED_EVIDENCE = "you answered this when you set abloh up";
+function evidenceFor(entries) {
+  return entries.map((path) => ({ path, evidence: ANSWERED_EVIDENCE }));
 }
-function detectTarget(repoDir, subdir, resolution = {}, ctx = diskRepoAccess(repoDir)) {
-  const aliasFamily = rootAliasFamily(ctx, repoDir);
-  const aggregatorTasks = rootAggregatorTasksInRepository(ctx, repoDir);
-  const explicitResult = subdir ? probePkg(ctx, join8(repoDir, subdir), aliasFamily, repoDir, aggregatorTasks) : null;
-  if (explicitResult?.refusal != null) throw manifestRefusal(explicitResult.refusal);
-  const explicit = explicitResult?.probe ?? null;
-  if (subdir && explicit === null) {
-    throw new TargetNotFoundError(
-      "configured-directory-has-no-package",
-      `the configured target directory ${JSON.stringify(subdir)} has no package.json, so there is no package there to measure; point --subdir (or abloh.yml target.directory) at the directory holding the package's package.json, or remove it to measure the repository root`,
-      "point --subdir (or abloh.yml target.directory) at the directory holding the package's package.json, or remove it to measure the repository root"
-    );
-  }
-  const rootResult = probePkg(ctx, repoDir, aliasFamily, repoDir, aggregatorTasks);
-  if (rootResult.refusal !== null) throw manifestRefusal(rootResult.refusal);
-  const root = rootResult.probe;
-  const probe = explicit !== null && (explicit.runner !== null || explicit.testScript !== null) ? explicit : root !== null && (root.runner !== null || root.testScript !== null) ? root : null;
-  if (!probe) {
-    throw new TargetNotFoundError(
-      "no-testable-package",
-      `no package.json with a test runner or test script found under ${repoDir}` + (subdir ? ` or in the configured target directory ${JSON.stringify(subdir)}` : "") + candidateSentence(repoDir),
-      candidateRemedy(repoDir)
-    );
-  }
-  const workspaceRootSuite = probe.workspaceRootSuite;
-  const commandDir = workspaceRootSuite === null ? probe.dir : repoDir;
-  const manager = detectPackageManagerContext(repoDir, commandDir, resolution, ctx);
-  const pm = manager.pm;
-  const runner = probe.runner ?? "command";
-  const projectTestCommand = packageTestCommand(manager);
-  const direct = directRunnerCommand(runner, detectModuleLayout(repoDir, probe.dir));
-  if (probe.declaredCommand === null && probe.testScript === null && direct !== null && probe.dir === repoDir && declaresWorkspace(ctx, repoDir)) {
-    throw new TargetNotFoundError(
-      "workspace-root-declares-no-test-script",
-      `${repoDir} is a workspace root that declares no test script, so there is no suite here to measure and Abloh will not guess one from an installed runner: point --subdir (or abloh.yml target.directory) at the package you want measured, or declare environment.testCommand if one command runs the suite from the root` + candidateSentence(repoDir),
-      "point --subdir (or abloh.yml target.directory) at the package you want measured, or declare environment.testCommand if one command runs the suite from the root" + candidateSentence(repoDir)
-    );
+var SETUP_QUESTION_DESCRIPTORS = {
+  "environment.installCommand": {
+    key: "environment.installCommand",
+    ask: "How does this repository install its dependencies?",
+    why: "Abloh read your CI without running it, so it saw the command your workflow declares and not what your install actually writes. On the borrow road your own job installs and Abloh measures inside it, so this is only needed when Abloh builds for itself.",
+    candidates: [],
+    required: false,
+    unreadable: true,
+    shape: { kind: "scalar" },
+    channel: "contract",
+    apply: (draft, answer) => ({
+      ...draft,
+      installCommand: answer.trim(),
+      evidence: { ...draft.evidence, installCommand: ANSWERED_EVIDENCE }
+    })
+  },
+  "environment.setupCommands": {
+    key: "environment.setupCommands",
+    ask: "What does this repository build between installing and testing?",
+    why: "Abloh read the build steps out of the job it rides. A step it could not read is one the proof container never runs, and a suite that needs it then fails inside abloh rather than in your CI.",
+    candidates: [],
+    required: true,
+    /* ONE STEP PER ` && `, WHICH IS THE ONE KEY THAT IS NOT COMMA-SEPARATED and the CLI's prompt says
+       so for the same reason: a comma is an ordinary character inside a command, and a build is read
+       top to bottom. `splitAnswerList` is the one grammar both roads ask. */
+    shape: { kind: "commands" },
+    channel: "contract",
+    apply: (draft, answer) => ({
+      ...draft,
+      setupCommands: splitAnswerList({ kind: "commands" }, answer).map((command) => ({
+        command,
+        source: ANSWERED_EVIDENCE,
+        /* A COMMAND SOMEBODY TYPED CARRIES THE ENVIRONMENT THEY TYPED INTO IT. `CiSetupCommand.env`
+           is the environment abloh READ off a workflow step, so an answered command has none: what
+           the answer says is the whole of what this command runs. */
+        env: []
+      }))
+    })
+  },
+  "environment.runtimeImage": {
+    key: "environment.runtimeImage",
+    ask: "Which image should Abloh build its proof container from?",
+    why: "Abloh pins one by pulling it and reading its digest, which needs a machine. Left unanswered, a run uses the reviewed default for the Node your repository declares.",
+    candidates: [],
+    required: false,
+    unreadable: true,
+    shape: { kind: "scalar" },
+    channel: "contract",
+    apply: (draft, answer) => ({
+      ...draft,
+      runtimeImage: answer.trim(),
+      evidence: { ...draft.evidence, runtimeImage: ANSWERED_EVIDENCE }
+    })
+  },
+  "setup.job": {
+    key: "setup.job",
+    ask: "Which job should abloh measure in?",
+    why: "Everything else in the contract is read out of that one job.",
+    candidates: [],
+    required: true,
+    shape: { kind: "scalar" },
+    channel: "discovery"
+  },
+  "setup.matrixLeg": {
+    key: "setup.matrixLeg",
+    ask: "Which leg of that job's matrix?",
+    why: "The job abloh rides fans out, and a leg names one value per dimension of it.",
+    candidates: [],
+    required: true,
+    shape: { kind: "scalar" },
+    channel: "discovery"
+  },
+  "setup.failFast": {
+    key: "setup.failFast",
+    ask: "That job cancels every matrix leg when one fails. May abloh turn that off for it?",
+    /* THE VALUES THE CONTRACT ACCEPTS, on `flaky`'s own rule: the card writes the chosen candidate
+       into `abloh.yml`, so a candidate that read well and parsed badly would be a form that writes an
+       invalid file. What each one MEANS is the ask above it. */
+    why: SETUP_FAIL_FAST_ANSWERS.map((answer) => `${answer} ${SETUP_FAIL_FAST_CONSEQUENCES[answer]}.`).join(" "),
+    candidates: SETUP_FAIL_FAST_ANSWERS,
+    required: true,
+    shape: { kind: "scalar" },
+    /* A LINE IN THE FILE AND NOT A RE-DERIVATION. It does not move which job the recipe is read out
+       of - it is the maintainer's standing answer about the job already chosen - and
+       `configSetupJobLines` writes it on every road, with or without a job, because it is the one
+       statement in that block that was never abloh's to discard. */
+    channel: "contract",
+    apply: (draft, answer) => ({ ...draft, setupFailFast: answer.trim() })
+  },
+  flaky: {
+    key: "flaky",
+    ask: "Your suite was red on untouched code. What should abloh do about those tests?",
+    /* THE VALUES THE CONTRACT ACCEPTS, not a prose label: the card writes the chosen candidate into
+       `abloh.yml`, so a candidate that read well and parsed badly would be a form that writes an
+       invalid file. What each one MEANS is the ask above it. */
+    why: "quarantine sets them aside and measures the rest. strict measures nothing until they pass.",
+    candidates: ["quarantine", "strict"],
+    required: true,
+    shape: { kind: "scalar" },
+    channel: "contract",
+    /* `quarantine` WRITES NO LINE and that is not the answer being dropped: it is what a file with
+       no `flaky:` key already means, which `configFlakyLines` states at the renderer. */
+    apply: (draft, answer) => ({ ...draft, flaky: answer.trim() })
+  },
+  "environment.testCommand": {
+    key: "environment.testCommand",
+    ask: "Which command runs your tests?",
+    why: "Abloh read your CI without running it, and the command it found did not run a suite it could observe.",
+    candidates: [],
+    required: true,
+    shape: { kind: "scalar" },
+    channel: "contract",
+    apply: (draft, answer) => ({ ...draft, testCommand: answer.trim() })
+  },
+  "environment.sealedTestCommand": {
+    key: "environment.sealedTestCommand",
+    ask: "Which command runs your tests inside abloh's proof container?",
+    why: "Your own test script did something abloh's container could not, so it needs the runner on its own.",
+    candidates: [],
+    required: true,
+    shape: { kind: "scalar" },
+    channel: "contract",
+    apply: (draft, answer) => ({ ...draft, sealedTestCommand: answer.trim() })
+  },
+  "environment.rebuildCommand": {
+    key: "environment.rebuildCommand",
+    ask: "Which command builds the output your tests import?",
+    why: "Your tests read compiled output rather than the source abloh plants in, so without the build every planted bug is reported as missed. Abloh cannot resolve which of your build scripts writes it from your files alone.",
+    candidates: [],
+    required: true,
+    shape: { kind: "scalar" },
+    channel: "contract",
+    /* THE CANDIDATES AND THE MANAGER SURVIVE THE ANSWER, because they are the drafting's reading of
+       this repository and the answer is a value: a run that later clears the value would otherwise
+       lose the finding that made the key worth writing. Absent, they are the empty pair, which is
+       what a draft that found no build script already carries. */
+    apply: (draft, answer) => ({
+      ...draft,
+      rebuild: {
+        ...draft.rebuild ?? { candidates: [], manager: "" },
+        value: answer.trim(),
+        evidence: ANSWERED_EVIDENCE
+      }
+    })
+  },
+  "target.directory": {
+    key: "target.directory",
+    ask: "Which package should abloh measure?",
+    why: "This repository holds several, and a run measures one.",
+    candidates: [],
+    required: true,
+    shape: { kind: "scalar" },
+    /* A DISCOVERY ANSWER AND NOT A LINE. The runner, the test command and the whole measurement plan
+       are read out of the package being measured, so writing this key over a draft derived from the
+       root would leave every sibling value describing a different package. It goes back through
+       `resolveMeasurementPlan` as its `subdir`, exactly as the job pin goes back through the job. */
+    channel: "discovery"
+  },
+  "environment.coverageProvider": {
+    key: "environment.coverageProvider",
+    ask: "May abloh install the coverage provider your runner needs?",
+    why: "Your tree does not carry one, and without it abloh cannot say which of your changed lines your tests execute.",
+    candidates: ["install", "skip"],
+    required: true,
+    shape: { kind: "scalar" },
+    channel: "contract",
+    /* WRITTEN FOR BOTH ANSWERS, because a recorded answer is the difference between a maintainer
+       who chose the default and one who was never asked - see `ConfigInput.coverageProvider`. */
+    apply: (draft, answer) => ({ ...draft, coverageProvider: answer.trim() })
+  },
+  "environment.requiredVariables": {
+    key: "environment.requiredVariables",
+    ask: "Which environment variables does your suite need?",
+    why: "Names only. The values come from your own environment and are masked in every log.",
+    candidates: [],
+    required: true,
+    shape: { kind: "names" },
+    channel: "contract",
+    apply: (draft, answer) => ({
+      ...draft,
+      requiredVariables: splitAnswerList({ kind: "names" }, answer).map((name) => ({
+        name,
+        evidence: ANSWERED_EVIDENCE
+      }))
+    })
+  },
+  "environment.environmentValues": {
+    key: "environment.environmentValues",
+    ask: "Which literal values does your suite need in its environment?",
+    why: "A secret goes in requiredVariables by name instead, and never here.",
+    candidates: [],
+    required: true,
+    shape: { kind: "pairs" },
+    channel: "contract",
+    apply: (draft, answer) => ({
+      ...draft,
+      environmentValues: splitAnswerList({ kind: "pairs" }, answer).map((entry) => {
+        const [name, value] = splitAtFirstEquals(entry);
+        return { name, value: value ?? "", evidence: ANSWERED_EVIDENCE };
+      })
+    })
+  },
+  "environment.generatedFiles": {
+    key: "environment.generatedFiles",
+    ask: "Which directories does your own tooling write during a run?",
+    why: "An undeclared change to the checkout aborts a run, and abloh cannot tell yours from a stray one.",
+    candidates: [],
+    required: true,
+    shape: { kind: "list" },
+    channel: "contract",
+    apply: (draft, answer) => ({
+      ...draft,
+      generatedFiles: evidenceFor(splitAnswerList({ kind: "list" }, answer))
+    })
+  },
+  "environment.rewrittenFiles": {
+    key: "environment.rewrittenFiles",
+    ask: "Which committed files does your own install rewrite?",
+    why: "A rate measured over bytes your install changed is a rate about something else.",
+    candidates: [],
+    required: true,
+    shape: { kind: "list" },
+    channel: "contract",
+    apply: (draft, answer) => ({
+      ...draft,
+      rewrittenFiles: evidenceFor(splitAnswerList({ kind: "list" }, answer))
+    })
+  },
+  "environment.identityFiles": {
+    key: "environment.identityFiles",
+    ask: "Which files should a change to reinstall rather than reuse the container?",
+    why: "Abloh reuses a prepared container between runs unless one of these moved.",
+    candidates: [],
+    required: true,
+    shape: { kind: "list" },
+    channel: "contract",
+    apply: (draft, answer) => ({
+      ...draft,
+      identityFiles: splitAnswerList({ kind: "list" }, answer)
+    })
+  },
+  "environment.systemPackages": {
+    key: "environment.systemPackages",
+    ask: "Which OS packages does your build need?",
+    why: "The reviewed proof image is slim, so a native dependency that compiles on install needs its toolchain named.",
+    candidates: [],
+    required: true,
+    shape: { kind: "packages" },
+    channel: "contract",
+    apply: (draft, answer) => ({
+      ...draft,
+      systemPackages: splitAnswerList({ kind: "packages" }, answer).map((entry) => {
+        const [name, version] = splitAtFirstEquals(entry);
+        return { name, version, source: ANSWERED_EVIDENCE };
+      })
+    })
+  },
+  "environment.runtimes": {
+    key: "environment.runtimes",
+    ask: "Which runtimes beyond Node does your suite need?",
+    /* NO CLOSED CANDIDATE LIST, because this key takes SEVERAL: `setupAnswerProblem` compares a
+       closed list against the WHOLE answer, so `bun, deno` would be refused by a two-word list that
+       accepts each of them alone. `judgeConfigKeyValue` names the two the contract holds, entry by
+       entry, which is the reading that fits a list. */
+    why: "The proof image carries Node. A runtime your tests reach for and the image does not carry fails inside abloh rather than in your CI.",
+    candidates: [],
+    required: true,
+    shape: { kind: "names" },
+    channel: "contract",
+    apply: (draft, answer) => ({
+      ...draft,
+      runtimes: splitAnswerList({ kind: "names" }, answer).map((runtime) => ({
+        runtime,
+        evidence: ANSWERED_EVIDENCE
+      }))
+    })
+  },
+  "environment.services": {
+    key: "environment.services",
+    ask: "Which backing services does your suite need, and where is each one ready?",
+    why: "A proof runs in the same network namespace as its services, so your suite reaches them on localhost exactly as in your CI. Abloh pins the image by digest because a mutable tag cannot be part of what a run binds, and each service needs something to wait on before the suite starts.",
+    candidates: [],
+    required: true,
+    shape: { kind: "services" },
+    channel: "contract",
+    /* THE ENVIRONMENT IS NOT TYPED HERE and the entry says so at {@link SERVICE_ENTRY}: an image that
+       needs credentials fails its readiness gate and reports that, which is the same narrow door the
+       CLI's own typed entry goes through. */
+    apply: (draft, answer) => ({
+      ...draft,
+      services: readServiceEntries(answer).map((service) => ({
+        name: service.name,
+        spelling: `${service.name}=${service.image}`,
+        image: service.image,
+        env: [],
+        healthCommand: null,
+        healthPort: service.healthPort ?? null,
+        source: ANSWERED_EVIDENCE,
+        evidence: ANSWERED_EVIDENCE
+      }))
+    })
+  },
+  "environment.installDirectory": {
+    key: "environment.installDirectory",
+    ask: "Which directory owns the lockfile your install reads?",
+    why: "A workspace package installs from the root that holds its lockfile, not from its own folder.",
+    candidates: [],
+    required: false,
+    shape: { kind: "scalar" },
+    channel: "contract",
+    apply: (draft, answer) => ({ ...draft, installDirectory: answer.trim() })
+  },
+  "environment.runner": {
+    key: "environment.runner",
+    ask: "Which test runner does this repository use?",
+    why: "Abloh reads it from your own command, and a declaration outranks that reading.",
+    candidates: [],
+    required: false,
+    shape: { kind: "scalar" },
+    channel: "contract",
+    apply: (draft, answer) => ({
+      ...draft,
+      runner: answer.trim(),
+      boundRunner: answer.trim(),
+      evidence: { ...draft.evidence, runner: "declared in abloh.yml" }
+    })
   }
-  const testCommand = probe.declaredCommand ?? (probe.testScript !== null || direct === null ? projectTestCommand : direct);
-  const rel = relative5(repoDir, probe.dir);
-  const resolvedSubdir = rel === "" ? null : rel;
-  const lifecycleHooks = [probe.scripts.pretest, probe.scripts.posttest].filter(
-    (hook) => typeof hook === "string"
+};
+var ANSWERABLE_SETUP_KEYS = Object.keys(SETUP_QUESTION_DESCRIPTORS);
+function contractDescriptors() {
+  return Object.values(SETUP_QUESTION_DESCRIPTORS).filter(
+    (descriptor) => descriptor.channel === "contract"
   );
-  const runnerStage = probe.testScript !== null && testCommand === projectTestCommand ? runnerStageCommand(probe.testScript, runner, lifecycleHooks, probe.scripts) : null;
-  const preRunnerStages = probe.testScript !== null && testCommand === projectTestCommand ? preRunnerStageCommands(probe.testScript, runner, probe.scripts) : [];
-  const watchDeclaration = testCommand === projectTestCommand ? probe.testScript : testCommand;
-  if (watchDeclaration !== null) {
-    const refusal = watchModeRefusal(
-      runner,
-      watchDeclaration,
-      testCommand === projectTestCommand ? `scripts.test in ${join8(relative5(repoDir, probe.dir), "package.json")}` : probe.declaredCommand === testCommand ? "your declared environment.testCommand" : "your test command"
-    );
-    if (refusal !== null) throw new TargetDetectionError(refusal);
-  }
-  const watchNormalized = watchDeclaration === null ? null : withWatchModeDisabled({
-    runner,
-    command: testCommand,
-    watchDeclaration,
-    packageManagerMajor: manager.version === null ? null : Number.parseInt(manager.version, 10)
-  });
-  const effectiveTestCommand = watchNormalized ?? testCommand;
-  const watchNormalizedStage = runnerStage === null ? null : withWatchModeDisabled({ runner, command: runnerStage, watchDeclaration: runnerStage });
-  const invocation = RUNNER_INVOCATION_CARRYING_RUNNERS.has(runner) ? runnerInvocation(probe.testScript, runner, probe.scripts) ?? probe.declaredCommand ?? (testCommand === direct ? direct : null) : null;
-  return {
-    pm,
-    runner,
-    testCommand: effectiveTestCommand,
-    ...watchNormalized === null ? {} : { watchModeNormalized: true },
-    ...probe.aggregator === null ? {} : { workspaceAggregator: probe.aggregator },
-    ...probe.aggregatorTask == null ? {} : { aggregatorTask: probe.aggregatorTask },
-    ...runnerStage === null ? {} : { runnerStageCommand: watchNormalizedStage ?? runnerStage },
-    /* Only alongside a runner stage, because these are exactly what running that stage alone would
-       otherwise skip. A one-stage script gated by a lifecycle hook has a runner stage and no
-       earlier stage of its own, and gets an empty list rather than a key. */
-    ...runnerStage === null || preRunnerStages.length === 0 ? {} : { preRunnerStageCommands: preRunnerStages },
-    ...invocation === null ? {} : { runnerInvocation: invocation },
-    vitestDir: runner === "vitest" ? detectVitestDir(probe.dir, ctx) : void 0,
-    jasmineSuite: runner === "jasmine" ? detectJasmineSuite(probe.dir, probe.testScript, ctx) : void 0,
-    ...probe.angular === null ? {} : { angularTarget: probe.angular },
-    subdir: resolvedSubdir,
-    workDir: commandDir,
-    ...workspaceRootSuite === null ? {} : { workspaceRootSuite },
-    ...probe.note ? { identifiedRunner: probe.note } : {},
-    ...compiledOutputFields({
-      ctx,
-      repoDir,
-      packageDir: resolvedSubdir,
-      runner,
-      invocation,
-      testCommand: effectiveTestCommand,
-      scripts: probe.scripts,
-      manager: pm,
-      angular: probe.angular !== null
-    }),
-    ...runner === "command" ? suiteFanoutPlan(probe, manager) : {}
-  };
+}
+function answeredTargetDirectory(answers) {
+  const value = answers["target.directory"];
+  return value === void 0 || value.trim() === "" ? void 0 : value.trim();
 }
 
 // src/measurement-plan-resolver.ts
 import { readFileSync as readFileSync6 } from "fs";
 import { createHash } from "crypto";
-import { join as join9, relative as relative6 } from "path";
+import { join as join10, relative as relative6 } from "path";
 import {
   MEASUREMENT_PLAN_SCHEMA,
   EVIDENCE_OUTPUTS,
@@ -6203,7 +6426,7 @@ import {
   resolvePreparedTestCommand
 } from "@abloh/core";
 function policyDeclaration(repoDir, ctx = diskRepoAccess(repoDir)) {
-  const policyPath = join9(repoDir, "abloh.yml");
+  const policyPath = join10(repoDir, "abloh.yml");
   if (!repoFileExists(ctx, policyPath)) {
     return { directory: null, testCommand: void 0, runner: void 0 };
   }
@@ -6296,7 +6519,7 @@ function resolveMeasurementPlan(input) {
   });
   const declaration = declarationOf(repoDir, input.declaration, ctx);
   const workDir = relative6(repoDir, detection.workDir) || ".";
-  const policyPath = join9(repoDir, "abloh.yml");
+  const policyPath = join10(repoDir, "abloh.yml");
   const environmentPolicy = input.declaration !== void 0 && input.declaration.source === "supplied" ? input.declaration.environment ?? null : repoFileExists(ctx, policyPath) ? tryLoadPolicy(policyPath)?.environment ?? null : null;
   const command = resolvePreparedTestCommand({
     ...input.cliTestCommand === void 0 ? {} : { cli: input.cliTestCommand },
@@ -6309,27 +6532,27 @@ function resolveMeasurementPlan(input) {
     bindings.push({ path: "abloh.yml", digest: digestOf(ctx, policyPath), kind: "policy" });
   }
   for (const name of PLAN_MANIFEST_FILES) {
-    const path = join9(detection.workDir, name);
+    const path = join10(detection.workDir, name);
     if (repoFileExists(ctx, path)) {
       bindings.push({
-        path: join9(workDir === "." ? "" : workDir, name),
+        path: join10(workDir === "." ? "" : workDir, name),
         digest: digestOf(ctx, path),
         kind: "manifest"
       });
     }
   }
   for (const name of PLAN_LOCKFILES) {
-    const path = join9(repoDir, name);
+    const path = join10(repoDir, name);
     if (repoFileExists(ctx, path)) {
       bindings.push({ path: name, digest: digestOf(ctx, path), kind: "lockfile" });
     }
   }
   const setupPath = environmentPolicy?.setup ?? null;
   if (setupPath !== null) {
-    bindings.push({ path: setupPath, digest: digestOf(ctx, join9(repoDir, setupPath)), kind: "setup" });
+    bindings.push({ path: setupPath, digest: digestOf(ctx, join10(repoDir, setupPath)), kind: "setup" });
   }
   for (const name of environmentPolicy?.identityFiles ?? []) {
-    bindings.push({ path: name, digest: digestOf(ctx, join9(repoDir, name)), kind: "identity" });
+    bindings.push({ path: name, digest: digestOf(ctx, join10(repoDir, name)), kind: "identity" });
   }
   bindings.sort(
     (left, right) => left.path === right.path ? left.kind.localeCompare(right.kind) : left.path.localeCompare(right.path)
@@ -6368,7 +6591,7 @@ function resolveMeasurementPlan(input) {
       systemPackages: environmentPolicy?.systemPackages ?? []
     },
     setup: {
-      script: setupPath === null ? null : { path: setupPath, digest: digestOf(ctx, join9(repoDir, setupPath)) },
+      script: setupPath === null ? null : { path: setupPath, digest: digestOf(ctx, join10(repoDir, setupPath)) },
       installCommand: environmentPolicy?.installCommand ?? null,
       installDirectory: environmentPolicy?.installDirectory ?? ".",
       setupCommands: environmentPolicy?.setupCommands ?? [],
@@ -6506,7 +6729,7 @@ function nodeDeclarationProblemReason(rejection) {
 }
 
 // src/setup-job.ts
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import {
   filterSetupCandidates,
   jobOnMatrixLeg,
@@ -6562,7 +6785,7 @@ function declaredSetupJob(repoDir) {
   return declaredSetupPin(repoDir).job;
 }
 function declaredSetupPin(repoDir, ctx = diskRepoAccess(repoDir)) {
-  const text = accessText(ctx, join10(repoDir, "abloh.yml"));
+  const text = accessText(ctx, join11(repoDir, "abloh.yml"));
   if (text === null) return {};
   const reading = readSetupPinFromDocument(text);
   if (reading.kind === "absent") return {};
@@ -7278,6 +7501,20 @@ function failFastInsertion(lines, job) {
   }
   return null;
 }
+function workflowRunsAbloh(text) {
+  let document;
+  try {
+    document = parse3(text);
+  } catch {
+    return false;
+  }
+  const jobs = document?.jobs;
+  if (typeof jobs !== "object" || jobs === null) return false;
+  return Object.values(jobs).some((job) => {
+    const steps = job?.steps;
+    return Array.isArray(steps) && alreadyEndsInAblohStep(steps);
+  });
+}
 function alreadyEndsInAblohStep(steps) {
   const repository = SETUP_STEP_ACTION.split("@")[0] ?? SETUP_STEP_ACTION;
   return steps.some(
@@ -7593,6 +7830,7 @@ export {
   DENO_LOCKFILE,
   ENVIRONMENT_BLOCK_HEADER,
   InitRefusal,
+  RETIRED_ENVIRONMENT_BLOCK_HEADERS,
   RUSH_CONFIG_DIRECTORY,
   RUSH_CONFIG_FILE,
   RUSH_INSTALL_COMMAND,
@@ -7616,6 +7854,7 @@ export {
   accessSubdirectories,
   accessText,
   admitSubmodules,
+  aggregatorChain,
   aggregatorInvocation,
   aggregatorTaskPhrase,
   aliasHopFamily,
@@ -7670,12 +7909,14 @@ export {
   initStepRole,
   invokesNodeTest,
   isBrowserInstallCommand,
+  isEnvironmentBlockHeader,
   isInstallStep,
   jasmineSuiteFromScript,
   layerEnvironment,
   materializeSubmodule,
   nodeDeclarationProblemReason,
   nodeSpecVersions,
+  overlayRepoAccess,
   placeSetupStep,
   policyDeclaration,
   preRunnerStageCommands,
@@ -7721,5 +7962,6 @@ export {
   unreadableConditionLine,
   vitestDirIn,
   withoutPackageRunnerPrefix,
-  workDirPrefix
+  workDirPrefix,
+  workflowRunsAbloh
 };