@bjoernrochel/sevro 1.0.0 → 1.1.0

package/dist/src/fixtures/advisory.js

@@ -0,0 +1,206 @@
+import { isMissingFile } from "./tools.js";
+import { lstat, mkdir, readlink, readdir, realpath, rm, symlink, copyFile, } from "node:fs/promises";
+import { allocateWorkspace, removeWorkspace } from "./workspace-state.js";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { insideRoot as contained } from "../paths.js";
+import { runGit } from "../git.js";
+import { fixtureParts } from "./preparation.js";
+const MAX_GIT_OUTPUT = 16 * 1024 * 1024;
+const MAX_UNTRACKED_BYTES = 32 * 1024 * 1024;
+const MAX_UNTRACKED_FILES = 1024;
+const HIDDEN_ROOTS = [".agents", ".claude", ".codex", ".git"];
+function excluded(path, roots) {
+    return roots.some((root) => path === root || path.startsWith(`${root}/`));
+}
+async function git(cwd, args, input) {
+    try {
+        return await runGit({
+            cwd,
+            args,
+            input,
+            identity: "advisory",
+            label: "advisory fixture",
+            maxOutputBytes: MAX_GIT_OUTPUT,
+        });
+    }
+    catch (cause) {
+        throw new Error("advisory fixture Git operation failed", { cause });
+    }
+}
+function requireRelativeSymlink(root, path, target) {
+    if (isAbsolute(target) || !contained(root, resolve(dirname(path), target)))
+        throw new Error("advisory fixture contains an escaping symlink");
+}
+async function checkSymlink(root, path) {
+    const target = await readlink(path);
+    requireRelativeSymlink(root, path, target);
+    const actual = await realpath(path).catch((cause) => {
+        throw new Error("advisory fixture contains a broken symlink", { cause });
+    });
+    if (!contained(root, actual))
+        throw new Error("advisory fixture contains an escaping symlink");
+}
+async function checkAdvisoryEntry(root, path, entry) {
+    if (entry.isDirectory())
+        await checkSymlinks(root, path);
+    else if (entry.isSymbolicLink())
+        await checkSymlink(root, path);
+}
+async function checkSymlinks(root, directory = root) {
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+        if (directory === root && entry.name === ".git")
+            continue;
+        await checkAdvisoryEntry(root, join(directory, entry.name), entry);
+    }
+}
+async function safeParent(root, parts) {
+    let directory = root;
+    for (const part of parts.slice(0, -1)) {
+        directory = join(directory, part);
+        await mkdir(directory, { mode: 0o700 }).catch((error) => {
+            if (error.code !== "EEXIST")
+                throw error;
+        });
+        if (!(await lstat(directory)).isDirectory())
+            throw new Error("advisory fixture path has a non-directory parent");
+    }
+}
+async function copyUntracked(source, destination, exclusions) {
+    const output = await git(source, [
+        "ls-files",
+        "--others",
+        "--exclude-standard",
+        "-z",
+    ]);
+    const paths = new TextDecoder("utf-8", { fatal: true })
+        .decode(output)
+        .split("\0")
+        .filter(Boolean)
+        .filter((path) => !excluded(path, exclusions));
+    if (paths.length > MAX_UNTRACKED_FILES)
+        throw new Error("advisory fixture has too many untracked files");
+    const state = { totalBytes: 0 };
+    for (const path of paths)
+        await copyUntrackedPath(path, source, destination, state);
+}
+async function untrackedTargetExists(path) {
+    return lstat(path).then(() => true, (error) => {
+        if (isMissingFile(error))
+            return false;
+        throw error;
+    });
+}
+async function copyUntrackedPath(path, source, destination, state) {
+    const parts = fixtureParts(path), from = join(source, ...parts), to = join(destination, ...parts);
+    if (!contained(source, from) || !contained(destination, to))
+        throw new Error("advisory fixture path escapes its root");
+    const info = await lstat(from);
+    state.totalBytes += info.size;
+    if (state.totalBytes > MAX_UNTRACKED_BYTES)
+        throw new Error("advisory fixture untracked files exceed the size limit");
+    await safeParent(destination, parts);
+    if (await untrackedTargetExists(to))
+        throw new Error("advisory fixture untracked path already exists");
+    await copyUntrackedEntry(from, to, destination, info);
+}
+async function copyUntrackedEntry(from, to, destination, info) {
+    if (info.isFile()) {
+        await copyFile(from, to);
+        return;
+    }
+    if (info.isSymbolicLink()) {
+        const target = await readlink(from);
+        requireRelativeSymlink(destination, to, target);
+        await symlink(target, to);
+        return;
+    }
+    throw new Error("advisory fixture has an unsupported untracked entry");
+}
+/** Capture the candidate fixture's baseline before the host edits it. */
+export async function advisoryBaseRevision(workspace) {
+    const revision = (await git(workspace, ["rev-parse", "--verify", "HEAD"]))
+        .toString("utf8")
+        .trim();
+    if (!/^[a-f0-9]{40,64}$/.test(revision))
+        throw new Error("advisory fixture has no valid Git baseline");
+    return revision;
+}
+/** Rebuild a condition-blind Git view of the complete candidate change. */
+export async function buildBlindAdvisoryFixture(candidateWorkspace, options) {
+    requireAdvisorySource(candidateWorkspace, options.baseRevision);
+    const source = await realpath(candidateWorkspace);
+    const exclusions = advisoryExclusions(options);
+    const temporary = await allocateWorkspace();
+    try {
+        const destination = await realpath(temporary);
+        await initializeAdvisoryBaseline(source, destination, options.baseRevision, exclusions);
+        await applyCandidateChange(source, destination, options.baseRevision, exclusions);
+        return destination;
+    }
+    catch (error) {
+        await removeWorkspace(temporary);
+        throw error;
+    }
+}
+function requireAdvisorySource(workspace, revision) {
+    if (!isAbsolute(workspace) || !/^[a-f0-9]{40,64}$/.test(revision))
+        throw new Error("invalid advisory fixture source");
+}
+function advisoryExclusions(options) {
+    const paths = options.excludedPaths ?? [];
+    for (const path of paths) {
+        fixtureParts(path);
+        if (path.toLowerCase() === ".git" || path.toLowerCase().startsWith(".git/"))
+            throw new Error("invalid advisory exclusion");
+    }
+    return [...HIDDEN_ROOTS, ...paths];
+}
+async function initializeAdvisoryBaseline(source, destination, baseRevision, exclusions) {
+    await git(source, [
+        "clone",
+        "--local",
+        "--no-hardlinks",
+        "--no-checkout",
+        "--quiet",
+        source,
+        destination,
+    ]);
+    await git(destination, ["checkout", "--detach", "--quiet", baseRevision]);
+    for (const root of exclusions)
+        await rm(join(destination, ...fixtureParts(root)), {
+            recursive: true,
+            force: true,
+        });
+    await rm(join(destination, ".git"), { recursive: true, force: true });
+    await git(destination, ["init", "--quiet", "--initial-branch=main"]);
+    await git(destination, ["add", "-A"]);
+    await git(destination, [
+        "commit",
+        "--quiet",
+        "--allow-empty",
+        "-m",
+        "Advisory baseline",
+    ]);
+}
+async function applyCandidateChange(source, destination, baseRevision, exclusions) {
+    const pathspec = exclusions.flatMap((path) => [
+        `:(exclude)${path}`,
+        `:(exclude)${path}/**`,
+    ]);
+    const patch = await git(source, [
+        "diff",
+        "--binary",
+        "--no-ext-diff",
+        "--no-textconv",
+        "--no-renames",
+        baseRevision,
+        "--",
+        ".",
+        ...pathspec,
+    ]);
+    if (patch.length)
+        await git(destination, ["apply", "--binary", "-"], patch);
+    await copyUntracked(source, destination, exclusions);
+    await checkSymlinks(destination);
+}
+//# sourceMappingURL=advisory.js.map

package/dist/src/fixtures/advisory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory.js","sourceRoot":"","sources":["advisory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,mBAAgB;AACxC,OAAO,EACL,KAAK,EACL,KAAK,EACL,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,EAAE,EACF,OAAO,EACP,QAAQ,GACT,yBAAyB;AAC1B,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,6BAA0B;AACvE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,kBAAkB;AAC/D,OAAO,EAAE,UAAU,IAAI,SAAS,EAAE,oBAAiB;AACnD,OAAO,EAAE,MAAM,EAAE,kBAAe;AAChC,OAAO,EAAE,YAAY,EAAE,yBAAsB;AAE7C,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7C,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AAE9D,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAe;IAC7C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,KAAK,UAAU,GAAG,CAChB,GAAW,EACX,IAAc,EACd,KAAkB;IAElB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC;YAClB,GAAG;YACH,IAAI;YACJ,KAAK;YACL,QAAQ,EAAE,UAAU;YACpB,KAAK,EAAE,kBAAkB;YACzB,cAAc,EAAE,cAAc;SAC/B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC7B,IAAY,EACZ,IAAY,EACZ,MAAc;IAEd,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AACrE,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC3D,MAAM,IAAI,KAAK,CAAC,4CAA4C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;AACrE,CAAC;AACD,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,IAAY,EACZ,KAAa;IAEb,IAAI,KAAK,CAAC,WAAW,EAAE;QAAE,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;SACpD,IAAI,KAAK,CAAC,cAAc,EAAE;QAAE,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAClE,CAAC;AACD,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,SAAS,GAAG,IAAI;IACzD,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAC1D,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,KAAe;IACrD,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAC/D,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;QACtE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,MAAc,EACd,WAAmB,EACnB,UAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE;QAC/B,UAAU;QACV,UAAU;QACV,oBAAoB;QACpB,IAAI;KACL,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SACpD,MAAM,CAAC,MAAM,CAAC;SACd,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,MAAM,GAAG,mBAAmB;QACpC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK;QACtB,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAAY;IAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CACrB,GAAG,EAAE,CAAC,IAAI,EACV,CAAC,KAAc,EAAE,EAAE;QACjB,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,KAAK,CAAC;IACd,CAAC,CACF,CAAC;AACJ,CAAC;AACD,KAAK,UAAU,iBAAiB,CAC9B,IAAY,EACZ,MAAc,EACd,WAAmB,EACnB,KAA6B;IAE7B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,EAC9B,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,EAC7B,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC;IAC9B,IAAI,KAAK,CAAC,UAAU,GAAG,mBAAmB;QACxC,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,MAAM,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,qBAAqB,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AACD,KAAK,UAAU,kBAAkB,CAC/B,IAAY,EACZ,EAAU,EACV,WAAmB,EACnB,IAAW;IAEX,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAClB,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,sBAAsB,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;AACzE,CAAC;AASD,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB;IAC1D,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;SACvE,QAAQ,CAAC,MAAM,CAAC;SAChB,IAAI,EAAE,CAAC;IACV,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,kBAA0B,EAC1B,OAA6B;IAE7B,qBAAqB,CAAC,kBAAkB,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,0BAA0B,CAC9B,MAAM,EACN,WAAW,EACX,OAAO,CAAC,YAAY,EACpB,UAAU,CACX,CAAC;QACF,MAAM,oBAAoB,CACxB,MAAM,EACN,WAAW,EACX,OAAO,CAAC,YAAY,EACpB,UAAU,CACX,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB,EAAE,QAAgB;IAChE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AACvD,CAAC;AACD,SAAS,kBAAkB,CAAC,OAA6B;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,GAAG,YAAY,EAAE,GAAG,KAAK,CAAC,CAAC;AACrC,CAAC;AACD,KAAK,UAAU,0BAA0B,CACvC,MAAc,EACd,WAAmB,EACnB,YAAoB,EACpB,UAAoB;IAEpB,MAAM,GAAG,CAAC,MAAM,EAAE;QAChB,OAAO;QACP,SAAS;QACT,gBAAgB;QAChB,eAAe;QACf,SAAS;QACT,MAAM;QACN,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,UAAU;QAC3B,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE;YACjD,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACtC,MAAM,GAAG,CAAC,WAAW,EAAE;QACrB,QAAQ;QACR,SAAS;QACT,eAAe;QACf,IAAI;QACJ,mBAAmB;KACpB,CAAC,CAAC;AACL,CAAC;AACD,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,WAAmB,EACnB,YAAoB,EACpB,UAAoB;IAEpB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,aAAa,IAAI,EAAE;QACnB,aAAa,IAAI,KAAK;KACvB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE;QAC9B,MAAM;QACN,UAAU;QACV,eAAe;QACf,eAAe;QACf,cAAc;QACd,YAAY;QACZ,IAAI;QACJ,GAAG;QACH,GAAG,QAAQ;KACZ,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAC5E,MAAM,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC","sourcesContent":["import type { Dirent, Stats } from \"node:fs\";\nimport { isMissingFile } from \"./tools\";\nimport {\n  lstat,\n  mkdir,\n  readlink,\n  readdir,\n  realpath,\n  rm,\n  symlink,\n  copyFile,\n} from \"node:fs/promises\";\nimport { allocateWorkspace, removeWorkspace } from \"./workspace-state\";\nimport { dirname, isAbsolute, join, resolve } from \"node:path\";\nimport { insideRoot as contained } from \"../paths\";\nimport { runGit } from \"../git\";\nimport { fixtureParts } from \"./preparation\";\n\nconst MAX_GIT_OUTPUT = 16 * 1024 * 1024;\nconst MAX_UNTRACKED_BYTES = 32 * 1024 * 1024;\nconst MAX_UNTRACKED_FILES = 1024;\nconst HIDDEN_ROOTS = [\".agents\", \".claude\", \".codex\", \".git\"];\n\nfunction excluded(path: string, roots: string[]): boolean {\n  return roots.some((root) => path === root || path.startsWith(`${root}/`));\n}\n\nasync function git(\n  cwd: string,\n  args: string[],\n  input?: Uint8Array,\n): Promise<Buffer> {\n  try {\n    return await runGit({\n      cwd,\n      args,\n      input,\n      identity: \"advisory\",\n      label: \"advisory fixture\",\n      maxOutputBytes: MAX_GIT_OUTPUT,\n    });\n  } catch (cause) {\n    throw new Error(\"advisory fixture Git operation failed\", { cause });\n  }\n}\n\nfunction requireRelativeSymlink(\n  root: string,\n  path: string,\n  target: string,\n): void {\n  if (isAbsolute(target) || !contained(root, resolve(dirname(path), target)))\n    throw new Error(\"advisory fixture contains an escaping symlink\");\n}\nasync function checkSymlink(root: string, path: string): Promise<void> {\n  const target = await readlink(path);\n  requireRelativeSymlink(root, path, target);\n  const actual = await realpath(path).catch((cause: unknown) => {\n    throw new Error(\"advisory fixture contains a broken symlink\", { cause });\n  });\n  if (!contained(root, actual))\n    throw new Error(\"advisory fixture contains an escaping symlink\");\n}\nasync function checkAdvisoryEntry(\n  root: string,\n  path: string,\n  entry: Dirent,\n): Promise<void> {\n  if (entry.isDirectory()) await checkSymlinks(root, path);\n  else if (entry.isSymbolicLink()) await checkSymlink(root, path);\n}\nasync function checkSymlinks(root: string, directory = root): Promise<void> {\n  for (const entry of await readdir(directory, { withFileTypes: true })) {\n    if (directory === root && entry.name === \".git\") continue;\n    await checkAdvisoryEntry(root, join(directory, entry.name), entry);\n  }\n}\n\nasync function safeParent(root: string, parts: string[]): Promise<void> {\n  let directory = root;\n  for (const part of parts.slice(0, -1)) {\n    directory = join(directory, part);\n    await mkdir(directory, { mode: 0o700 }).catch((error: unknown) => {\n      if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") throw error;\n    });\n    if (!(await lstat(directory)).isDirectory())\n      throw new Error(\"advisory fixture path has a non-directory parent\");\n  }\n}\n\nasync function copyUntracked(\n  source: string,\n  destination: string,\n  exclusions: string[],\n): Promise<void> {\n  const output = await git(source, [\n    \"ls-files\",\n    \"--others\",\n    \"--exclude-standard\",\n    \"-z\",\n  ]);\n  const paths = new TextDecoder(\"utf-8\", { fatal: true })\n    .decode(output)\n    .split(\"\\0\")\n    .filter(Boolean)\n    .filter((path) => !excluded(path, exclusions));\n  if (paths.length > MAX_UNTRACKED_FILES)\n    throw new Error(\"advisory fixture has too many untracked files\");\n  const state = { totalBytes: 0 };\n  for (const path of paths)\n    await copyUntrackedPath(path, source, destination, state);\n}\n\nasync function untrackedTargetExists(path: string): Promise<boolean> {\n  return lstat(path).then(\n    () => true,\n    (error: unknown) => {\n      if (isMissingFile(error)) return false;\n      throw error;\n    },\n  );\n}\nasync function copyUntrackedPath(\n  path: string,\n  source: string,\n  destination: string,\n  state: { totalBytes: number },\n): Promise<void> {\n  const parts = fixtureParts(path),\n    from = join(source, ...parts),\n    to = join(destination, ...parts);\n  if (!contained(source, from) || !contained(destination, to))\n    throw new Error(\"advisory fixture path escapes its root\");\n  const info = await lstat(from);\n  state.totalBytes += info.size;\n  if (state.totalBytes > MAX_UNTRACKED_BYTES)\n    throw new Error(\"advisory fixture untracked files exceed the size limit\");\n  await safeParent(destination, parts);\n  if (await untrackedTargetExists(to))\n    throw new Error(\"advisory fixture untracked path already exists\");\n  await copyUntrackedEntry(from, to, destination, info);\n}\nasync function copyUntrackedEntry(\n  from: string,\n  to: string,\n  destination: string,\n  info: Stats,\n): Promise<void> {\n  if (info.isFile()) {\n    await copyFile(from, to);\n    return;\n  }\n  if (info.isSymbolicLink()) {\n    const target = await readlink(from);\n    requireRelativeSymlink(destination, to, target);\n    await symlink(target, to);\n    return;\n  }\n  throw new Error(\"advisory fixture has an unsupported untracked entry\");\n}\n\nexport interface BlindAdvisoryOptions {\n  /** Fixture HEAD before candidate execution. */\n  baseRevision: string;\n  /** Additional root-relative evaluator paths to omit from the judge view. */\n  excludedPaths?: string[];\n}\n\n/** Capture the candidate fixture's baseline before the host edits it. */\nexport async function advisoryBaseRevision(workspace: string): Promise<string> {\n  const revision = (await git(workspace, [\"rev-parse\", \"--verify\", \"HEAD\"]))\n    .toString(\"utf8\")\n    .trim();\n  if (!/^[a-f0-9]{40,64}$/.test(revision))\n    throw new Error(\"advisory fixture has no valid Git baseline\");\n  return revision;\n}\n\n/** Rebuild a condition-blind Git view of the complete candidate change. */\nexport async function buildBlindAdvisoryFixture(\n  candidateWorkspace: string,\n  options: BlindAdvisoryOptions,\n): Promise<string> {\n  requireAdvisorySource(candidateWorkspace, options.baseRevision);\n  const source = await realpath(candidateWorkspace);\n  const exclusions = advisoryExclusions(options);\n  const temporary = await allocateWorkspace();\n  try {\n    const destination = await realpath(temporary);\n    await initializeAdvisoryBaseline(\n      source,\n      destination,\n      options.baseRevision,\n      exclusions,\n    );\n    await applyCandidateChange(\n      source,\n      destination,\n      options.baseRevision,\n      exclusions,\n    );\n    return destination;\n  } catch (error) {\n    await removeWorkspace(temporary);\n    throw error;\n  }\n}\n\nfunction requireAdvisorySource(workspace: string, revision: string): void {\n  if (!isAbsolute(workspace) || !/^[a-f0-9]{40,64}$/.test(revision))\n    throw new Error(\"invalid advisory fixture source\");\n}\nfunction advisoryExclusions(options: BlindAdvisoryOptions): string[] {\n  const paths = options.excludedPaths ?? [];\n  for (const path of paths) {\n    fixtureParts(path);\n    if (path.toLowerCase() === \".git\" || path.toLowerCase().startsWith(\".git/\"))\n      throw new Error(\"invalid advisory exclusion\");\n  }\n  return [...HIDDEN_ROOTS, ...paths];\n}\nasync function initializeAdvisoryBaseline(\n  source: string,\n  destination: string,\n  baseRevision: string,\n  exclusions: string[],\n): Promise<void> {\n  await git(source, [\n    \"clone\",\n    \"--local\",\n    \"--no-hardlinks\",\n    \"--no-checkout\",\n    \"--quiet\",\n    source,\n    destination,\n  ]);\n  await git(destination, [\"checkout\", \"--detach\", \"--quiet\", baseRevision]);\n  for (const root of exclusions)\n    await rm(join(destination, ...fixtureParts(root)), {\n      recursive: true,\n      force: true,\n    });\n  await rm(join(destination, \".git\"), { recursive: true, force: true });\n  await git(destination, [\"init\", \"--quiet\", \"--initial-branch=main\"]);\n  await git(destination, [\"add\", \"-A\"]);\n  await git(destination, [\n    \"commit\",\n    \"--quiet\",\n    \"--allow-empty\",\n    \"-m\",\n    \"Advisory baseline\",\n  ]);\n}\nasync function applyCandidateChange(\n  source: string,\n  destination: string,\n  baseRevision: string,\n  exclusions: string[],\n): Promise<void> {\n  const pathspec = exclusions.flatMap((path) => [\n    `:(exclude)${path}`,\n    `:(exclude)${path}/**`,\n  ]);\n  const patch = await git(source, [\n    \"diff\",\n    \"--binary\",\n    \"--no-ext-diff\",\n    \"--no-textconv\",\n    \"--no-renames\",\n    baseRevision,\n    \"--\",\n    \".\",\n    ...pathspec,\n  ]);\n  if (patch.length) await git(destination, [\"apply\", \"--binary\", \"-\"], patch);\n  await copyUntracked(source, destination, exclusions);\n  await checkSymlinks(destination);\n}\n"]}

package/dist/src/fixtures/bin.js

@@ -0,0 +1,41 @@
+import { prepareFixtureTools, installFixtureTools, isMissingFile, } from "./tools.js";
+import { lstat, mkdir, realpath } from "node:fs/promises";
+import { join } from "node:path";
+/** Validate executable fixture tools without allowing path traversal. */
+export function prepareFixtureBin(value) {
+    return prepareFixtureTools(value, /^[A-Za-z][A-Za-z0-9._-]*$/, 64, "invalid fixture binaries");
+}
+/** Install declared tools inside the fixture's Git metadata, after commits. */
+export async function installFixtureBin(bin, workspace) {
+    if (!bin || Object.keys(bin).length === 0)
+        return;
+    const directory = join(workspace, ".git", "fixture-bin");
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await installFixtureTools(bin, directory, {
+        directory: "fixture binary directory is invalid",
+        target: "fixture binary target is invalid",
+    });
+}
+/** Setup may also install trusted tools, such as a repository ticket stub. */
+export async function fixtureBinDirectory(workspace) {
+    const path = join(workspace, ".git", "fixture-bin");
+    try {
+        await validateBinDirectory(path);
+        const canonicalWorkspace = await realpath(workspace);
+        const canonicalBin = await realpath(path);
+        if (canonicalBin !== join(canonicalWorkspace, ".git", "fixture-bin"))
+            throw new Error("fixture binary directory escapes the workspace");
+        return path;
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return null;
+        throw error;
+    }
+}
+async function validateBinDirectory(path) {
+    const entry = await lstat(path);
+    if (!entry.isDirectory() || entry.isSymbolicLink())
+        throw new Error("fixture binary directory is invalid");
+}
+//# sourceMappingURL=bin.js.map

package/dist/src/fixtures/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["bin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,GACd,mBAAgB;AACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,yBAAyB;AAC1D,OAAO,EAAE,IAAI,EAAE,kBAAkB;AAEjC,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAC/B,KAAc;IAEd,OAAO,mBAAmB,CACxB,KAAK,EACL,2BAA2B,EAC3B,EAAE,EACF,0BAA0B,CAC3B,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAuC,EACvC,SAAiB;IAEjB,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACzD,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE;QACxC,SAAS,EAAE,qCAAqC;QAChD,MAAM,EAAE,kCAAkC;KAC3C,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB;IAEjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,kBAAkB,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,YAAY,KAAK,IAAI,CAAC,kBAAkB,EAAE,MAAM,EAAE,aAAa,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;QAChD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;AAC3D,CAAC","sourcesContent":["import {\n  prepareFixtureTools,\n  installFixtureTools,\n  isMissingFile,\n} from \"./tools\";\nimport { lstat, mkdir, realpath } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\n/** Validate executable fixture tools without allowing path traversal. */\nexport function prepareFixtureBin(\n  value: unknown,\n): Record<string, string> | null {\n  return prepareFixtureTools(\n    value,\n    /^[A-Za-z][A-Za-z0-9._-]*$/,\n    64,\n    \"invalid fixture binaries\",\n  );\n}\n\n/** Install declared tools inside the fixture's Git metadata, after commits. */\nexport async function installFixtureBin(\n  bin: Record<string, string> | undefined,\n  workspace: string,\n): Promise<void> {\n  if (!bin || Object.keys(bin).length === 0) return;\n  const directory = join(workspace, \".git\", \"fixture-bin\");\n  await mkdir(directory, { recursive: true, mode: 0o700 });\n  await installFixtureTools(bin, directory, {\n    directory: \"fixture binary directory is invalid\",\n    target: \"fixture binary target is invalid\",\n  });\n}\n\n/** Setup may also install trusted tools, such as a repository ticket stub. */\nexport async function fixtureBinDirectory(\n  workspace: string,\n): Promise<string | null> {\n  const path = join(workspace, \".git\", \"fixture-bin\");\n  try {\n    await validateBinDirectory(path);\n    const canonicalWorkspace = await realpath(workspace);\n    const canonicalBin = await realpath(path);\n    if (canonicalBin !== join(canonicalWorkspace, \".git\", \"fixture-bin\"))\n      throw new Error(\"fixture binary directory escapes the workspace\");\n    return path;\n  } catch (error) {\n    if (isMissingFile(error)) return null;\n    throw error;\n  }\n}\n\nasync function validateBinDirectory(path: string): Promise<void> {\n  const entry = await lstat(path);\n  if (!entry.isDirectory() || entry.isSymbolicLink())\n    throw new Error(\"fixture binary directory is invalid\");\n}\n"]}

package/dist/src/fixtures/cleanup.js

@@ -0,0 +1,43 @@
+import { chmod, lstat, readdir, rm } from "node:fs/promises";
+import { join } from "node:path";
+function permissionFailure(error) {
+    const code = error.code;
+    return code === "EACCES" || code === "EPERM";
+}
+async function restoreDirectoryAccess(path) {
+    const entry = await lstat(path);
+    if (!entry.isDirectory())
+        return;
+    await chmod(path, (entry.mode & 0o7777) | 0o700);
+    for (const child of await readdir(path, { withFileTypes: true }))
+        if (child.isDirectory())
+            await restoreDirectoryAccess(join(path, child.name));
+}
+/** Remove owned disposable state without following cache or fixture symlinks. */
+export async function removeDisposableDirectory(path) {
+    try {
+        await rm(path, { recursive: true, force: true });
+    }
+    catch (error) {
+        if (error.code === "ENOTDIR")
+            return;
+        if (!permissionFailure(error))
+            throw error;
+        await restoreDirectoryAccess(path);
+        await rm(path, { recursive: true, force: true });
+    }
+}
+/** Clear a completed fixture while preserving its reserved root for active peers. */
+export async function clearFixtureContents(workspace) {
+    const root = await lstat(workspace);
+    if (!root.isDirectory())
+        throw new Error("fixture workspace is not a directory");
+    if ((root.mode & 0o700) !== 0o700)
+        await chmod(workspace, (root.mode & 0o7777) | 0o700);
+    const names = await readdir(workspace);
+    await Promise.all(names.map(async (name) => {
+        const path = join(workspace, name);
+        await removeDisposableDirectory(path);
+    }));
+}
+//# sourceMappingURL=cleanup.js.map

package/dist/src/fixtures/cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.js","sourceRoot":"","sources":["cleanup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,yBAAyB;AAC7D,OAAO,EAAE,IAAI,EAAE,kBAAkB;AAEjC,SAAS,iBAAiB,CAAC,KAAc;IACvC,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;IACnD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY;IAChD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;QAAE,OAAO;IACjC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,WAAW,EAAE;YACrB,MAAM,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAY;IAC1D,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO;QAChE,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAC3C,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB;IAC1D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK;QAC/B,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,yBAAyB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC,CAAC,CACH,CAAC;AACJ,CAAC","sourcesContent":["import { chmod, lstat, readdir, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\n\nfunction permissionFailure(error: unknown): boolean {\n  const code = (error as NodeJS.ErrnoException).code;\n  return code === \"EACCES\" || code === \"EPERM\";\n}\n\nasync function restoreDirectoryAccess(path: string): Promise<void> {\n  const entry = await lstat(path);\n  if (!entry.isDirectory()) return;\n  await chmod(path, (entry.mode & 0o7777) | 0o700);\n  for (const child of await readdir(path, { withFileTypes: true }))\n    if (child.isDirectory())\n      await restoreDirectoryAccess(join(path, child.name));\n}\n\n/** Remove owned disposable state without following cache or fixture symlinks. */\nexport async function removeDisposableDirectory(path: string): Promise<void> {\n  try {\n    await rm(path, { recursive: true, force: true });\n  } catch (error) {\n    if ((error as NodeJS.ErrnoException).code === \"ENOTDIR\") return;\n    if (!permissionFailure(error)) throw error;\n    await restoreDirectoryAccess(path);\n    await rm(path, { recursive: true, force: true });\n  }\n}\n\n/** Clear a completed fixture while preserving its reserved root for active peers. */\nexport async function clearFixtureContents(workspace: string): Promise<void> {\n  const root = await lstat(workspace);\n  if (!root.isDirectory())\n    throw new Error(\"fixture workspace is not a directory\");\n  if ((root.mode & 0o700) !== 0o700)\n    await chmod(workspace, (root.mode & 0o7777) | 0o700);\n  const names = await readdir(workspace);\n  await Promise.all(\n    names.map(async (name) => {\n      const path = join(workspace, name);\n      await removeDisposableDirectory(path);\n    }),\n  );\n}\n"]}

package/dist/src/fixtures/create.js

@@ -0,0 +1,94 @@
+import { appendFile, mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { allocateWorkspace, removeWorkspace } from "./workspace-state.js";
+import { fixtureBinDirectory, installFixtureBin } from "./bin.js";
+import { installGitHooks } from "./git-hooks.js";
+import { materializeGeneratedFixture, } from "./generated.js";
+import { runFixtureSetup } from "./setup.js";
+import { fixtureParts, safePreparationTarget, } from "./preparation.js";
+import { applyRepositoryOverlay, cloneRepositorySource, } from "./repository.js";
+import { EvaluationConfigurationError, } from "../evaluation/types.js";
+export async function createFixture(source, options) {
+    const paths = inlineFixturePaths(source);
+    const artifacts = options.artifacts ?? [];
+    const workspace = options.reservedWorkspace ?? (await allocateWorkspace());
+    try {
+        await initializeFixtureHistory(source, options.sources, workspace);
+        await installDeclaredFixtureTools(source, workspace);
+        await writeInlineFixtureFiles(paths, workspace);
+        await setupFixture(options.setup, workspace, options.projectRoot, options.signal, options.candidateRuntimeRoot);
+        await mountPreparationArtifacts(artifacts, workspace);
+        await excludePreparationArtifacts(artifacts, workspace);
+        await fixtureBinDirectory(workspace);
+        return workspace;
+    }
+    catch (error) {
+        if (!options.reservedWorkspace)
+            await removeWorkspace(workspace);
+        throw error;
+    }
+}
+function inlineFixturePaths(source) {
+    return Object.entries(source.kind === "inline" ? (source.files ?? {}) : {}).map(([path, content]) => ({ path, parts: fixtureParts(path), content }));
+}
+async function cloneFixtureRepository(source, sources, workspace) {
+    if (!sources)
+        throw new EvaluationConfigurationError("repository source root is required and must be absolute");
+    await cloneRepositorySource(source.fixture.sourceRef, sources, source.repository, workspace);
+}
+async function initializeFixtureHistory(source, sources, workspace) {
+    switch (source.kind) {
+        case "repository":
+            await cloneFixtureRepository(source, sources, workspace);
+            await applyRepositoryOverlay(source.fixture, workspace);
+            break;
+        case "generated":
+            await materializeGeneratedFixture(source.fixture, workspace);
+            break;
+        case "inline":
+            break;
+    }
+}
+async function installDeclaredFixtureTools(source, workspace) {
+    const fixture = source.kind === "inline" ? undefined : source.fixture;
+    await installFixtureBin(fixture?.bin, workspace);
+    await installGitHooks(fixture?.hooks, workspace);
+}
+async function writeInlineFixtureFiles(files, workspace) {
+    for (const file of files) {
+        const target = join(workspace, ...file.parts);
+        await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+        await writeFile(target, file.content, { flag: "wx", mode: 0o600 });
+    }
+}
+async function setupFixture(setup, workspace, projectRoot, signal, candidateRuntimeRoot) {
+    if (!setup)
+        return;
+    await runFixtureSetup(setup, {
+        workspace,
+        projectRoot,
+        fixtureBinDir: (await fixtureBinDirectory(workspace)) ?? undefined,
+        signal,
+        candidateRuntimeRoot,
+    });
+}
+async function mountPreparationArtifacts(artifacts, workspace) {
+    for (const artifact of artifacts) {
+        const target = await safePreparationTarget(workspace, artifact.relativePath);
+        await writeFile(target, artifact.bytes, {
+            flag: "wx",
+            mode: artifact.executable ? 0o700 : 0o600,
+        });
+    }
+}
+async function excludePreparationArtifacts(artifacts, workspace) {
+    const gitExcluded = artifacts.filter((artifact) => artifact.gitExclude);
+    if (!gitExcluded.length)
+        return;
+    const special = new Set(["\\", "*", "?", "[", "]", "#", "!", " "]);
+    const patterns = gitExcluded.map((artifact) => Array.from(artifact.relativePath)
+        .map((character) => special.has(character) ? `\\${character}` : character)
+        .join(""));
+    await appendFile(join(workspace, ".git", "info", "exclude"), `\n${patterns.map((path) => `/${path}`).join("\n")}\n`);
+}
+//# sourceMappingURL=create.js.map

package/dist/src/fixtures/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["create.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,yBAAyB;AAChE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB;AAC1C,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,6BAA0B;AACvE,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,iBAAc;AAC/D,OAAO,EAAE,eAAe,EAAE,uBAAoB;AAC9C,OAAO,EACL,2BAA2B,GAE5B,uBAAoB;AACrB,OAAO,EAAE,eAAe,EAAqB,mBAAgB;AAC7D,OAAO,EACL,YAAY,EACZ,qBAAqB,GAGtB,yBAAsB;AACvB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,GAGtB,wBAAqB;AACtB,OAAO,EACL,4BAA4B,GAE7B,+BAA4B;AAiB7B,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,OAAuB;IAEvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnE,MAAM,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACrD,MAAM,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChD,MAAM,YAAY,CAChB,OAAO,CAAC,KAAK,EACb,SAAS,EACT,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,oBAAoB,CAC7B,CAAC;QACF,MAAM,yBAAyB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,2BAA2B,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxD,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,iBAAiB;YAAE,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAqB;IAC/C,OAAO,MAAM,CAAC,OAAO,CACnB,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CACrD,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,MAAsD,EACtD,OAAuC,EACvC,SAAiB;IAEjB,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,4BAA4B,CACpC,yDAAyD,CAC1D,CAAC;IACJ,MAAM,qBAAqB,CACzB,MAAM,CAAC,OAAO,CAAC,SAAS,EACxB,OAAO,EACP,MAAM,CAAC,UAAU,EACjB,SAAS,CACV,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,MAAqB,EACrB,OAAuC,EACvC,SAAiB;IAEjB,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,YAAY;YACf,MAAM,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YACzD,MAAM,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACxD,MAAM;QACR,KAAK,WAAW;YACd,MAAM,2BAA2B,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC7D,MAAM;QACR,KAAK,QAAQ;YACX,MAAM;IACV,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IACtE,MAAM,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,KAA4C,EAC5C,SAAiB;IAEjB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/D,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAsC,EACtC,SAAiB,EACjB,WAAmB,EACnB,MAAoB,EACpB,oBAA6B;IAE7B,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,eAAe,CAAC,KAAK,EAAE;QAC3B,SAAS;QACT,WAAW;QACX,aAAa,EAAE,CAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC,CAAC,IAAI,SAAS;QAClE,MAAM;QACN,oBAAoB;KACrB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,SAA2B,EAC3B,SAAiB;IAEjB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CACxC,SAAS,EACT,QAAQ,CAAC,YAAY,CACtB,CAAC;QACF,MAAM,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,EAAE;YACtC,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK;SAC1C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,SAA2B,EAC3B,SAAiB;IAEjB,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACxE,IAAI,CAAC,WAAW,CAAC,MAAM;QAAE,OAAO;IAChC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC5C,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;SAC9B,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACjB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CACtD;SACA,IAAI,CAAC,EAAE,CAAC,CACZ,CAAC;IACF,MAAM,UAAU,CACd,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAC1C,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACvD,CAAC;AACJ,CAAC","sourcesContent":["import { appendFile, mkdir, writeFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { allocateWorkspace, removeWorkspace } from \"./workspace-state\";\nimport { fixtureBinDirectory, installFixtureBin } from \"./bin\";\nimport { installGitHooks } from \"./git-hooks\";\nimport {\n  materializeGeneratedFixture,\n  type GeneratedFixture,\n} from \"./generated\";\nimport { runFixtureSetup, type FixtureSetup } from \"./setup\";\nimport {\n  fixtureParts,\n  safePreparationTarget,\n  type InlineArtifact,\n  type PreparationSources,\n} from \"./preparation\";\nimport {\n  applyRepositoryOverlay,\n  cloneRepositorySource,\n  type RepositoryFixture,\n  type RepositorySource,\n} from \"./repository\";\nimport {\n  EvaluationConfigurationError,\n  type ResolvedCase,\n} from \"../evaluation/types\";\n\nexport type FixtureSource<Repository = RepositorySource> =\n  | { kind: \"inline\"; files: ResolvedCase[\"fixture\"][\"files\"] }\n  | { kind: \"generated\"; fixture: GeneratedFixture }\n  | { kind: \"repository\"; fixture: RepositoryFixture; repository: Repository };\n\ninterface FixtureOptions {\n  artifacts?: InlineArtifact[];\n  sources?: PreparationSources;\n  setup?: FixtureSetup | null;\n  projectRoot: string;\n  signal?: AbortSignal;\n  reservedWorkspace?: string;\n  candidateRuntimeRoot?: string;\n}\n\nexport async function createFixture(\n  source: FixtureSource,\n  options: FixtureOptions,\n): Promise<string> {\n  const paths = inlineFixturePaths(source);\n  const artifacts = options.artifacts ?? [];\n  const workspace = options.reservedWorkspace ?? (await allocateWorkspace());\n  try {\n    await initializeFixtureHistory(source, options.sources, workspace);\n    await installDeclaredFixtureTools(source, workspace);\n    await writeInlineFixtureFiles(paths, workspace);\n    await setupFixture(\n      options.setup,\n      workspace,\n      options.projectRoot,\n      options.signal,\n      options.candidateRuntimeRoot,\n    );\n    await mountPreparationArtifacts(artifacts, workspace);\n    await excludePreparationArtifacts(artifacts, workspace);\n    await fixtureBinDirectory(workspace);\n    return workspace;\n  } catch (error) {\n    if (!options.reservedWorkspace) await removeWorkspace(workspace);\n    throw error;\n  }\n}\n\nfunction inlineFixturePaths(source: FixtureSource) {\n  return Object.entries(\n    source.kind === \"inline\" ? (source.files ?? {}) : {},\n  ).map(([path, content]) => ({ path, parts: fixtureParts(path), content }));\n}\n\nasync function cloneFixtureRepository(\n  source: Extract<FixtureSource, { kind: \"repository\" }>,\n  sources: PreparationSources | undefined,\n  workspace: string,\n): Promise<void> {\n  if (!sources)\n    throw new EvaluationConfigurationError(\n      \"repository source root is required and must be absolute\",\n    );\n  await cloneRepositorySource(\n    source.fixture.sourceRef,\n    sources,\n    source.repository,\n    workspace,\n  );\n}\n\nasync function initializeFixtureHistory(\n  source: FixtureSource,\n  sources: PreparationSources | undefined,\n  workspace: string,\n): Promise<void> {\n  switch (source.kind) {\n    case \"repository\":\n      await cloneFixtureRepository(source, sources, workspace);\n      await applyRepositoryOverlay(source.fixture, workspace);\n      break;\n    case \"generated\":\n      await materializeGeneratedFixture(source.fixture, workspace);\n      break;\n    case \"inline\":\n      break;\n  }\n}\n\nasync function installDeclaredFixtureTools(\n  source: FixtureSource,\n  workspace: string,\n): Promise<void> {\n  const fixture = source.kind === \"inline\" ? undefined : source.fixture;\n  await installFixtureBin(fixture?.bin, workspace);\n  await installGitHooks(fixture?.hooks, workspace);\n}\n\nasync function writeInlineFixtureFiles(\n  files: ReturnType<typeof inlineFixturePaths>,\n  workspace: string,\n): Promise<void> {\n  for (const file of files) {\n    const target = join(workspace, ...file.parts);\n    await mkdir(dirname(target), { recursive: true, mode: 0o700 });\n    await writeFile(target, file.content, { flag: \"wx\", mode: 0o600 });\n  }\n}\n\nasync function setupFixture(\n  setup: FixtureSetup | null | undefined,\n  workspace: string,\n  projectRoot: string,\n  signal?: AbortSignal,\n  candidateRuntimeRoot?: string,\n): Promise<void> {\n  if (!setup) return;\n  await runFixtureSetup(setup, {\n    workspace,\n    projectRoot,\n    fixtureBinDir: (await fixtureBinDirectory(workspace)) ?? undefined,\n    signal,\n    candidateRuntimeRoot,\n  });\n}\n\nasync function mountPreparationArtifacts(\n  artifacts: InlineArtifact[],\n  workspace: string,\n): Promise<void> {\n  for (const artifact of artifacts) {\n    const target = await safePreparationTarget(\n      workspace,\n      artifact.relativePath,\n    );\n    await writeFile(target, artifact.bytes, {\n      flag: \"wx\",\n      mode: artifact.executable ? 0o700 : 0o600,\n    });\n  }\n}\n\nasync function excludePreparationArtifacts(\n  artifacts: InlineArtifact[],\n  workspace: string,\n): Promise<void> {\n  const gitExcluded = artifacts.filter((artifact) => artifact.gitExclude);\n  if (!gitExcluded.length) return;\n  const special = new Set([\"\\\\\", \"*\", \"?\", \"[\", \"]\", \"#\", \"!\", \" \"]);\n  const patterns = gitExcluded.map((artifact) =>\n    Array.from(artifact.relativePath)\n      .map((character) =>\n        special.has(character) ? `\\\\${character}` : character,\n      )\n      .join(\"\"),\n  );\n  await appendFile(\n    join(workspace, \".git\", \"info\", \"exclude\"),\n    `\\n${patterns.map((path) => `/${path}`).join(\"\\n\")}\\n`,\n  );\n}\n"]}

package/dist/src/fixtures/generated.js

@@ -0,0 +1,181 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { canonicalJson } from "../identity.js";
+import { prepareFixtureBin } from "./bin.js";
+import { prepareGitHooks } from "./git-hooks.js";
+import { fixtureParts } from "./preparation.js";
+import { runGit } from "../git.js";
+const MAX_COMMITS = 128;
+const MAX_FILES = 1024;
+const MAX_BYTES = 32 * 1024 * 1024;
+const MAX_GIT_OUTPUT = 64 * 1024;
+function validFiles(value) {
+    return (Boolean(value && typeof value === "object" && !Array.isArray(value)) &&
+        Object.values(value).every((item) => typeof item === "string"));
+}
+function validPath(path) {
+    const parts = fixtureParts(path);
+    if (parts.some((part) => part.toLowerCase() === ".git"))
+        throw new Error("generated fixture cannot write repository metadata");
+}
+function fixtureRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("invalid generated fixture");
+    return value;
+}
+function fixtureKeys(fixture) {
+    const keys = [
+        "kind",
+        "commits",
+        "files",
+        "staged",
+        "commitFiles",
+        "hooks",
+        "bin",
+    ];
+    if (fixture.kind !== "generated" ||
+        Object.keys(fixture).some((key) => !keys.includes(key)))
+        throw new Error("invalid generated fixture");
+}
+function stringArray(value) {
+    return (Array.isArray(value) &&
+        value.every((item) => typeof item === "string"));
+}
+function fixtureOptionalFields(fixture) {
+    if (fixture.files !== undefined && !validFiles(fixture.files))
+        throw new Error("invalid generated fixture");
+    validateStagedField(fixture.staged);
+    if (fixture.commitFiles !== undefined &&
+        typeof fixture.commitFiles !== "boolean")
+        throw new Error("invalid generated fixture");
+}
+function validateStagedField(value) {
+    if (value !== undefined && !stringArray(value))
+        throw new Error("invalid generated fixture");
+}
+function fixtureCommits(value) {
+    if (!Array.isArray(value) || value.length > MAX_COMMITS)
+        throw new Error("invalid generated fixture");
+    return value;
+}
+function commitMessage(value) {
+    return (typeof value === "string" &&
+        Boolean(value.trim()) &&
+        Buffer.byteLength(value, "utf8") <= 4096);
+}
+function commitRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("invalid generated fixture commit");
+    return value;
+}
+function prepareCommit(value) {
+    const commit = commitRecord(value);
+    if (Object.keys(commit).some((key) => key !== "message" && key !== "files") ||
+        !commitMessage(commit.message))
+        throw new Error("invalid generated fixture commit");
+    if (!validFiles(commit.files) || Object.keys(commit.files).length === 0)
+        throw new Error("invalid generated fixture commit");
+    return { message: commit.message, files: commit.files };
+}
+function countFiles(contents, files) {
+    for (const [path, content] of Object.entries(files)) {
+        validPath(path);
+        contents.paths.push(path);
+        contents.files++;
+        contents.bytes +=
+            Buffer.byteLength(path, "utf8") + Buffer.byteLength(content, "utf8");
+    }
+}
+function validateContents(contents) {
+    if (contents.files > MAX_FILES || contents.bytes > MAX_BYTES)
+        throw new Error("generated fixture exceeds the size limit");
+    const normalized = [...new Set(contents.paths)].map((path) => path.toLowerCase());
+    for (const [index, path] of normalized.entries()) {
+        if (normalized.slice(0, index).some((other) => pathsCollide(path, other)))
+            throw new Error("generated fixture paths collide");
+    }
+}
+function pathsCollide(path, other) {
+    return (path === other ||
+        path.startsWith(`${other}/`) ||
+        other.startsWith(`${path}/`));
+}
+function validateStaging(staged, overlay, commitFiles) {
+    if (new Set(staged.map((path) => path.toLowerCase())).size !== staged.length ||
+        staged.some((path) => !Object.hasOwn(overlay, path)) ||
+        emptyOverlayCommit(commitFiles, overlay))
+        throw new Error("invalid generated fixture staging");
+}
+function emptyOverlayCommit(commitFiles, overlay) {
+    return commitFiles === true && Object.keys(overlay).length === 0;
+}
+/** Freeze a bounded declarative history before any host or fixture work. */
+export function prepareGeneratedFixture(value) {
+    const fixture = fixtureRecord(value);
+    fixtureKeys(fixture);
+    const commits = fixtureCommits(fixture.commits);
+    fixtureOptionalFields(fixture);
+    prepareGitHooks(fixture.hooks);
+    prepareFixtureBin(fixture.bin);
+    const contents = { bytes: 0, files: 0, paths: [] };
+    for (const value of commits) {
+        const commit = prepareCommit(value);
+        contents.bytes += Buffer.byteLength(commit.message, "utf8");
+        countFiles(contents, commit.files);
+    }
+    // The optional fields were checked above; preserve absent fields in the frozen declaration.
+    const overlay = validFiles(fixture.files) ? fixture.files : {};
+    const staged = stringArray(fixture.staged) ? fixture.staged : [];
+    countFiles(contents, overlay);
+    contents.bytes += staged.reduce((size, path) => size + Buffer.byteLength(path, "utf8"), 0);
+    validateContents(contents);
+    validateStaging(staged, overlay, fixture.commitFiles);
+    return JSON.parse(canonicalJson(fixture));
+}
+async function git(workspace, args) {
+    try {
+        await runGit({
+            cwd: workspace,
+            args,
+            identity: "fixture",
+            label: "generated fixture",
+            maxOutputBytes: MAX_GIT_OUTPUT,
+        });
+    }
+    catch (cause) {
+        throw new Error("generated fixture Git operation failed", { cause });
+    }
+}
+async function writeFiles(workspace, files) {
+    for (const [path, content] of Object.entries(files)) {
+        const target = join(workspace, ...fixtureParts(path));
+        await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+        await writeFile(target, content, { flag: "w", mode: 0o600 });
+    }
+}
+/** Build a deterministic local Git history, then apply working-tree state. */
+export async function materializeGeneratedFixture(fixture, workspace) {
+    await git(workspace, ["init", "--quiet", "--initial-branch=main"]);
+    for (const commit of fixture.commits) {
+        await writeFiles(workspace, commit.files);
+        await git(workspace, ["add", "--", ...Object.keys(commit.files)]);
+        await git(workspace, ["commit", "--quiet", "-m", commit.message]);
+    }
+    await applyGeneratedOverlay(fixture, workspace);
+}
+async function applyGeneratedOverlay(fixture, workspace) {
+    const overlay = fixture.files ?? {};
+    await writeFiles(workspace, overlay);
+    if (fixture.commitFiles) {
+        await git(workspace, ["add", "--", ...Object.keys(overlay)]);
+        await git(workspace, [
+            "commit",
+            "--quiet",
+            "-m",
+            "Add evaluation scaffolding",
+        ]);
+    }
+    if (fixture.staged?.length)
+        await git(workspace, ["add", "--", ...fixture.staged]);
+}
+//# sourceMappingURL=generated.js.map