@crewhaus/tool-pkgmgr 0.7.0 → 0.8.1

package/dist/lib/parse.js

@@ -175,6 +175,106 @@ export function dpkgStatusIsInstalled(abbrev) {
 export function dpkgSaysNoSuchPackage(stderr) {
     return /no packages found matching/i.test(stderr);
 }
+/** The value after an indented `Label:`, trimmed; undefined if the line is not that label. */
+function labelValue(line, label) {
+    if (line.length === 0 || (line[0] !== " " && line[0] !== "\t"))
+        return undefined;
+    const trimmed = line.trim();
+    if (!trimmed.startsWith(`${label}:`))
+        return undefined;
+    return trimmed.slice(label.length + 1).trim();
+}
+/**
+ * A version-table entry: ` *** <version> <priority>` for the installed one,
+ * `     <version> <priority>` for the others. The source lines under each
+ * are indented further (8 spaces) and are not versions.
+ */
+function versionEntry(line) {
+    let rest;
+    if (line.startsWith(" *** "))
+        rest = line.slice(5);
+    else if (line.startsWith("     ") && line.length > 5 && line[5] !== " ")
+        rest = line.slice(5);
+    else
+        return undefined;
+    const parts = rest.split(" ");
+    if (parts.length !== 2)
+        return undefined;
+    const [version, priority] = parts;
+    return version !== "" && /^-?[0-9]+$/.test(priority) ? version : undefined;
+}
+/**
+ * Split `apt-cache policy` output into its stanzas. A stanza starts at an
+ * unindented `<name>:` line. apt prints one per package the operand matched,
+ * and an operand it read as a pattern matches many: `apt-cache policy
+ * 'lib.+'` printed 116 on a Debian 12 image.
+ */
+export function parseAptPolicyStanzas(stdout) {
+    const drafts = [];
+    let current;
+    for (const line of lines(stdout)) {
+        if (line.length > 1 &&
+            line[0] !== " " &&
+            line[0] !== "\t" &&
+            line.endsWith(":") &&
+            !/\s/.test(line)) {
+            current = {
+                header: line.slice(0, -1),
+                installed: undefined,
+                candidate: undefined,
+                versions: [],
+                inTable: false,
+            };
+            drafts.push(current);
+            continue;
+        }
+        if (current === undefined)
+            continue;
+        const installed = labelValue(line, "Installed");
+        if (installed !== undefined) {
+            current.installed = installed === "(none)" ? null : installed;
+            continue;
+        }
+        const candidate = labelValue(line, "Candidate");
+        if (candidate !== undefined) {
+            current.candidate = candidate === "(none)" ? null : candidate;
+            continue;
+        }
+        if (labelValue(line, "Version table") !== undefined) {
+            current.inTable = true;
+            continue;
+        }
+        if (current.inTable) {
+            const version = versionEntry(line);
+            if (version !== undefined)
+                current.versions.push(version);
+        }
+    }
+    return drafts.map((d) => ({
+        header: d.header,
+        installed: d.installed ?? null,
+        candidate: d.candidate ?? null,
+        versions: d.versions,
+        labelled: d.installed !== undefined || d.candidate !== undefined,
+    }));
+}
+/**
+ * The stanza for exactly `name`, or why there is none. `name:arch` also
+ * matches a lone stanza headed by the bare name, which is how apt prints the
+ * native architecture (`libc6:amd64` on amd64 prints `libc6:`). More than one
+ * stanza is never an answer about `name`, whatever their headers say.
+ */
+export function matchAptPolicy(stdout, name) {
+    const stanzas = parseAptPolicyStanzas(stdout);
+    if (stanzas.length === 0)
+        return { kind: "none" };
+    const only = stanzas.length === 1 ? stanzas[0] : undefined;
+    const bare = name.includes(":") ? name.slice(0, name.indexOf(":")) : undefined;
+    if (only !== undefined && (only.header === name || only.header === bare)) {
+        return only.labelled ? { kind: "exact", stanza: only } : { kind: "unlabelled" };
+    }
+    return { kind: "not-exact", headers: stanzas.map((st) => st.header) };
+}
 /**
  * `apt-cache policy <name>` under `LC_ALL=C`.
  *
@@ -190,24 +290,22 @@ export function dpkgSaysNoSuchPackage(stderr) {
  * An unknown package produces an empty document (apt-cache prints nothing and
  * exits 0), which parses to `undefined` rather than to two nulls, so "apt has
  * never heard of this" cannot be confused with "apt has it, not installed".
+ * So does output with more than one stanza, or (given `name`) a stanza for a
+ * different name: that is apt answering about a PATTERN, and reading its last
+ * stanza as the answer reported another package's version (C021).
  */
-export function parseAptCachePolicy(stdout) {
-    let installed;
-    let candidate;
-    for (const line of lines(stdout)) {
-        const installedMatch = line.match(/^\s+Installed:\s*(.+?)\s*$/);
-        if (installedMatch?.[1] !== undefined) {
-            installed = installedMatch[1] === "(none)" ? null : installedMatch[1];
-            continue;
-        }
-        const candidateMatch = line.match(/^\s+Candidate:\s*(.+?)\s*$/);
-        if (candidateMatch?.[1] !== undefined) {
-            candidate = candidateMatch[1] === "(none)" ? null : candidateMatch[1];
-        }
+export function parseAptCachePolicy(stdout, name) {
+    const stanzas = parseAptPolicyStanzas(stdout);
+    if (name !== undefined) {
+        const match = matchAptPolicy(stdout, name);
+        return match.kind === "exact"
+            ? { installed: match.stanza.installed, candidate: match.stanza.candidate }
+            : undefined;
     }
-    if (installed === undefined && candidate === undefined)
+    const only = stanzas.length === 1 ? stanzas[0] : undefined;
+    if (only === undefined || !only.labelled)
         return undefined;
-    return { installed: installed ?? null, candidate: candidate ?? null };
+    return { installed: only.installed, candidate: only.candidate };
 }
 /**
  * `apt-get install -s` — the best dry run of the six managers.
@@ -521,14 +619,24 @@ export function parseWingetList(stdout) {
     return rows;
 }
 /**
- * winget's "no installed package matched" exit code, 0x8A15002B as a signed
+ * winget's "no installed package matched" exit code:
+ * APPINSTALLER_CLI_ERROR_NO_APPLICATIONS_FOUND, 0x8A150014, as a signed
  * 32-bit integer.
  *
  * `winget list` exits with this rather than 0-and-empty, which makes presence
  * decidable from the EXIT CODE alone — the one part of winget's answer that
- * is neither localised nor column-aligned.
+ * is neither localised nor column-aligned. 0.7.0 had 0x8A15002B here, which
+ * is APPINSTALLER_CLI_ERROR_UPDATE_NOT_APPLICABLE (`winget upgrade` with
+ * nothing to do), so a package that was not installed came back unknown.
+ * Compare against `code | 0`: a runtime may report the DWORD unsigned.
+ */
+export const WINGET_NO_PACKAGES_FOUND = -1978335212;
+/**
+ * APPINSTALLER_CLI_ERROR_SOURCE_AGREEMENTS_NOT_ACCEPTED, 0x8A150046: with
+ * `--disable-interactivity`, a configured source whose agreement nobody has
+ * accepted makes `winget list` refuse outright instead of prompting.
  */
-export const WINGET_NO_PACKAGES_FOUND = -1978335189;
+export const WINGET_SOURCE_AGREEMENTS_NOT_ACCEPTED = -1978335162;
 // ---------------------------------------------------------------------------
 // chocolatey
 // ---------------------------------------------------------------------------

package/dist/lib/query.d.ts

@@ -96,6 +96,13 @@ export type PackageFacts = {
     readonly outdated?: boolean;
     readonly kind?: "formula" | "cask";
     readonly notes: readonly string[];
+    /**
+     * apt only, and only when `apt-cache policy` answered with exactly one
+     * stanza for exactly this name: every version its version table lists.
+     * Absent means apt's answer was not about this exact name (or could not be
+     * read), which PackageInstall refuses to act on (C021).
+     */
+    readonly versionTable?: readonly string[];
 };
 /**
  * Ask one manager about one name.

package/dist/lib/query.js

@@ -1,6 +1,6 @@
 import { DEFAULT_COMMAND_TIMEOUT_MS, runHostCommand } from "../run";
 import { MANAGERS, MANAGER_ENV, PKGMGR_COMMANDS, managersForPlatform, withOperand, } from "./managers";
-import { WINGET_NO_PACKAGES_FOUND, aptSaysNoSuchPackage, brewSaysNoSuchPackage, dnfSaysNoCache, dnfSaysNoMatch, dpkgSaysNoSuchPackage, dpkgStatusIsInstalled, pacmanSaysNoSuchPackage, parseAptCachePolicy, parseBrewInfoJson, parseChocoList, parseChocoMajorVersion, parseDnfList, parseDpkgQuery, parsePacmanInfo, parsePacmanQuery, parseRpmQuery, parseWingetList, rpmSaysNotInstalled, } from "./parse";
+import { WINGET_NO_PACKAGES_FOUND, WINGET_SOURCE_AGREEMENTS_NOT_ACCEPTED, aptSaysNoSuchPackage, brewSaysNoSuchPackage, dnfSaysNoCache, dnfSaysNoMatch, dpkgSaysNoSuchPackage, dpkgStatusIsInstalled, matchAptPolicy, pacmanSaysNoSuchPackage, parseBrewInfoJson, parseChocoList, parseChocoMajorVersion, parseDnfList, parseDpkgQuery, parsePacmanInfo, parsePacmanQuery, parseRpmQuery, parseWingetList, rpmSaysNotInstalled, } from "./parse";
 import { commandFailureReason, firstLine } from "./unknown";
 export function newContext(timeoutMs = DEFAULT_COMMAND_TIMEOUT_MS, signal) {
     return { timeoutMs, ...(signal !== undefined ? { signal } : {}), probes: [] };
@@ -197,6 +197,7 @@ async function queryApt(ctx, name, unknowns, includeAvailable) {
     let status = "unknown";
     let installedVersions = null;
     let knownToManager = null;
+    let versionTable;
     const notes = [];
     if (dpkg.missing || dpkg.timedOut || truncated(dpkg)) {
         unknowns.add("status", dpkgProbe, truncated(dpkg)
@@ -256,9 +257,28 @@ async function queryApt(ctx, name, unknowns, includeAvailable) {
             unknowns.add("available.version", policyProbe, commandFailureReason(policy));
         }
         else {
-            const parsed = parseAptCachePolicy(policy.stdout);
-            if (parsed === undefined) {
-                if (policy.stdout.trim() === "" || aptSaysNoSuchPackage(policy.stderr)) {
+            const match = matchAptPolicy(policy.stdout, name);
+            if (match.kind === "not-exact") {
+                // apt read the name as a pattern (or the output answers about some
+                // other name). None of it is about THIS name, and the old parser
+                // reported the last stanza's candidate as this package's (C021).
+                const shown = match.headers.slice(0, 3).join(", ");
+                const reason = `apt-cache matched ${match.headers.length} package(s) as a pattern (${shown}${match.headers.length > 3 ? ", …" : ""}); none is named exactly ${JSON.stringify(name)}, so apt's answer is not about this name`;
+                // dpkg's own exact row, when it found one, still stands; anything
+                // else ("not installed" because dpkg matched nothing literally) is
+                // not an answer about a package name either.
+                if (status !== "installed") {
+                    status = "unknown";
+                    installedVersions = null;
+                    knownToManager = null;
+                    unknowns.add("status", policyProbe, reason);
+                }
+                available = null;
+                unknowns.add("available.version", policyProbe, reason);
+            }
+            else if (match.kind === "none" || match.kind === "unlabelled") {
+                if (match.kind === "none" &&
+                    (policy.stdout.trim() === "" || aptSaysNoSuchPackage(policy.stderr))) {
                     // apt-cache prints nothing at all for a name it does not know.
                     if (knownToManager === null)
                         knownToManager = false;
@@ -270,6 +290,8 @@ async function queryApt(ctx, name, unknowns, includeAvailable) {
                 }
             }
             else {
+                const parsed = match.stanza;
+                versionTable = parsed.versions;
                 knownToManager = true;
                 available = parsed.candidate === null ? null : { version: parsed.candidate, source: "apt" };
                 if (parsed.candidate === null) {
@@ -295,6 +317,7 @@ async function queryApt(ctx, name, unknowns, includeAvailable) {
         knownToManager,
         available,
         notes,
+        ...(versionTable !== undefined ? { versionTable } : {}),
     };
 }
 // ---- dnf / rpm ------------------------------------------------------------
@@ -451,7 +474,13 @@ async function queryWinget(ctx, name, unknowns, _includeAvailable) {
         unknowns.add("status", probe, commandFailureReason(result));
         return unknownFacts("winget", name);
     }
-    if (result.code === WINGET_NO_PACKAGES_FOUND) {
+    // winget's codes are HRESULTs; a runtime may hand the DWORD back unsigned.
+    const code = result.code | 0;
+    if (code === WINGET_SOURCE_AGREEMENTS_NOT_ACCEPTED) {
+        unknowns.add("status", probe, "winget refused to list because a configured source's agreements have not been accepted on this host. Accepting a licence is the operator's decision, never a side effect of a read: run `winget list` once yourself and accept them (or remove that source), then ask again");
+        return unknownFacts("winget", name);
+    }
+    if (code === WINGET_NO_PACKAGES_FOUND) {
         // The one part of winget's answer that is neither localised nor
         // column-aligned: its documented "no installed package matched" code.
         return {

package/dist/paths.d.ts

@@ -1,10 +1,29 @@
 import { CrewhausError } from "@crewhaus/errors";
-/** Raised when a caller-supplied path resolves outside the workspace root. */
+/**
+ * The longest path this resolves, in UTF-16 code units; a longer one is
+ * refused before it is walked. Nothing that long can be opened or created:
+ * PATH_MAX is 1,024 bytes on macOS and 4,096 on Linux, Windows stops at
+ * 32,767 UTF-16 units, and a path's UTF-8 form is never shorter than its
+ * UTF-16 one. The limit is twice that because the part of a path that exists
+ * is itself under PATH_MAX, so the part that does not is over PATH_MAX on its
+ * own: no spelling of the place reaches it, not even one through a symlink
+ * that shortens the part that exists.
+ */
+export declare const MAX_PATH_CHARS: number;
+/**
+ * Raised when a caller-supplied path resolves outside the workspace root, or
+ * is longer than any path can be.
+ */
 export declare class ToolPermissionError extends CrewhausError {
     readonly name = "ToolPermissionError";
     readonly toolName: string;
     readonly path: string;
-    constructor(toolName: string, attemptedPath: string);
+    /**
+     * Why, when it is not that the location escapes the workspace root: a path
+     * longer than any path can be. A caller that rewords the refusal says this.
+     */
+    readonly reason: string | undefined;
+    constructor(toolName: string, attemptedPath: string, reason?: string);
 }
 /**
  * A validated path, in both forms the tools need.

package/dist/paths.js

@@ -11,15 +11,45 @@
 import { lstatSync, readlinkSync, realpathSync } from "node:fs";
 import * as path from "node:path";
 import { CrewhausError } from "@crewhaus/errors";
-/** Raised when a caller-supplied path resolves outside the workspace root. */
+/**
+ * The longest path this resolves, in UTF-16 code units; a longer one is
+ * refused before it is walked. Nothing that long can be opened or created:
+ * PATH_MAX is 1,024 bytes on macOS and 4,096 on Linux, Windows stops at
+ * 32,767 UTF-16 units, and a path's UTF-8 form is never shorter than its
+ * UTF-16 one. The limit is twice that because the part of a path that exists
+ * is itself under PATH_MAX, so the part that does not is over PATH_MAX on its
+ * own: no spelling of the place reaches it, not even one through a symlink
+ * that shortens the part that exists.
+ */
+export const MAX_PATH_CHARS = 2 * (process.platform === "darwin" ? 1_024 : process.platform === "win32" ? 32_767 : 4_096);
+/** A path as a refusal quotes it: whole, unless it is past {@link MAX_PATH_CHARS}. */
+function shownPath(given) {
+    return given.length > MAX_PATH_CHARS ? `${given.slice(0, 64)}…` : given;
+}
+/** Why a path past {@link MAX_PATH_CHARS} is refused: its length and the limit. */
+function tooLong(abs) {
+    return `it is ${abs.length} characters once resolved, over the ${MAX_PATH_CHARS}-character limit: no path that long can be opened or created`;
+}
+/**
+ * Raised when a caller-supplied path resolves outside the workspace root, or
+ * is longer than any path can be.
+ */
 export class ToolPermissionError extends CrewhausError {
     name = "ToolPermissionError";
     toolName;
     path;
-    constructor(toolName, attemptedPath) {
-        super("tool", `tool "${toolName}" rejected path "${attemptedPath}": resolved location escapes the workspace root`);
+    /**
+     * Why, when it is not that the location escapes the workspace root: a path
+     * longer than any path can be. A caller that rewords the refusal says this.
+     */
+    reason;
+    constructor(toolName, attemptedPath, reason) {
+        super("tool", reason === undefined
+            ? `tool "${toolName}" rejected path "${attemptedPath}": resolved location escapes the workspace root`
+            : `tool "${toolName}" rejected path "${shownPath(attemptedPath)}": ${reason}`);
         this.toolName = toolName;
         this.path = attemptedPath;
+        this.reason = reason;
     }
 }
 /** The workspace root, resolved. Every path is contained within it. */
@@ -67,15 +97,7 @@ function nameExists(p) {
 function resolveLocation(target, depth = 0) {
     if (depth > 40)
         throw new Error(`symlink chain at "${target}" is too long to resolve`);
-    let probe = target;
-    const tail = [];
-    while (!nameExists(probe)) {
-        tail.unshift(path.basename(probe));
-        const parent = path.dirname(probe);
-        if (parent === probe)
-            break; // reached the filesystem root
-        probe = parent;
-    }
+    const { probe, tail } = deepestName(target);
     let probeReal;
     try {
         probeReal = realpathSync(probe);
@@ -97,7 +119,41 @@ function resolveLocation(target, depth = 0) {
         const base = realpathSync(path.dirname(probe));
         probeReal = resolveLocation(path.resolve(base, link), depth + 1);
     }
-    return tail.length > 0 ? path.join(probeReal, ...tail) : probeReal;
+    // One string, not one argument per name: Bun's `path.join` keeps only
+    // (argument count mod 65,536) of its arguments.
+    return tail.length > 0 ? path.join(probeReal, tail) : probeReal;
+}
+/**
+ * `target`, an absolute path, split where its deepest prefix that exists as
+ * a NAME ends: that prefix, and the names below it, which do not exist, as
+ * one string ("" when `target` itself exists). This is `path.dirname` and
+ * `path.basename` worked by index on `target` itself: handing them each
+ * shorter prefix in turn copied the rest of the path once per missing name,
+ * the square of a count the caller picks.
+ */
+function deepestName(target) {
+    const top = path.parse(target).root.length;
+    const isSep = (i) => target[i] === "/" || target[i] === path.sep;
+    let probe = target;
+    let start = target.length;
+    let stop = -1;
+    while (!nameExists(probe)) {
+        // `path.basename(probe)` is `target.slice(start, end)`, and
+        // `path.dirname(probe)` is `target.slice(0, up)`.
+        let end = probe.length;
+        while (end > top && isSep(end - 1))
+            end--;
+        if (stop < 0)
+            stop = end;
+        start = end;
+        while (start > top && !isSep(start - 1))
+            start--;
+        const up = start > top ? start - 1 : top;
+        if (up === probe.length)
+            break; // reached the filesystem root
+        probe = target.slice(0, up);
+    }
+    return { probe, tail: stop < 0 ? "" : target.slice(start, stop) };
 }
 export function resolveSafe(toolName, rel, root = workspaceRoot()) {
     const rootResolved = path.resolve(root);
@@ -107,6 +163,9 @@ export function resolveSafe(toolName, rel, root = workspaceRoot()) {
     if (abs !== rootResolved && !abs.startsWith(`${rootResolved}${path.sep}`)) {
         throw new ToolPermissionError(toolName, rel);
     }
+    // Longer than any path can be: refused before the walk below reads it.
+    if (abs.length > MAX_PATH_CHARS)
+        throw new ToolPermissionError(toolName, rel, tooLong(abs));
     let real;
     try {
         const rootReal = realpathSync(rootResolved);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/tool-pkgmgr",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "type": "module",
   "description": "Deterministic system package-manager queries and installs, with no privilege escalation and a dry run that runs the real selection",
   "main": "dist/index.js",
@@ -8,17 +8,18 @@
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
     }
   },
   "scripts": {
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/errors": "0.7.0",
-    "@crewhaus/tool-builder": "0.7.0",
-    "@crewhaus/tool-catalog": "0.7.0",
-    "@crewhaus/tool-proc": "0.7.0",
+    "@crewhaus/errors": "0.8.1",
+    "@crewhaus/tool-builder": "0.8.1",
+    "@crewhaus/tool-catalog": "0.8.1",
+    "@crewhaus/tool-proc": "0.8.1",
     "zod": "^3.23.8"
   },
   "devDependencies": {
@@ -42,5 +43,8 @@
   "publishConfig": {
     "access": "public"
   },
-  "files": ["dist", "README.md", "LICENSE", "NOTICE"]
+  "files": ["dist", "README.md", "LICENSE", "NOTICE"],
+  "engines": {
+    "bun": ">=1.3.14"
+  }
 }

package/dist/fixtures.d.ts

@@ -1,174 +0,0 @@
-/**
- * Recorded manager output, and the runner that serves it.
- *
- * Every string below is what a real manager printed on a real machine. None
- * of it is invented to make a parser pass: the trailing space in dpkg's
- * `"ii "` status, the `(none)` apt prints for a package it has but has not
- * installed, the `Operation aborted.` dnf ends an `--assumeno` run with, the
- * ellipsis winget cuts a wide column with, and the fact that `rpm -q` writes
- * "is not installed" to STDOUT rather than stderr are all facts about those
- * programs that a hand-written fixture would have got wrong.
- *
- * WHY THIS FILE EXISTS AT ALL. CI is a Linux container with no package
- * manager installed; this was written on macOS with Homebrew. A test that
- * asked the real host anything would assert one thing here and another there,
- * which is not a test. So the host is behind `../run.ts`'s seam, the platform
- * is behind `../host.ts`'s (with a hostile default, so forgetting the seam
- * fails identically everywhere), and this file is the world.
- *
- * `recordedRunner` refuses a command nobody recorded rather than returning an
- * empty result: an unrecorded command that quietly answered "" would look
- * exactly like a manager that had nothing to say, and every "not installed"
- * in the suite would stop meaning anything.
- */
-import type { RunRequest, Runner } from "./run";
-export declare const BREW_VERSION = "Homebrew 4.3.8\nHomebrew/homebrew-core (git revision 2e6b2c3f4a1; last commit 2026-09-10)\n";
-/** `brew info --json=v2 curl` — installed, and the tap has a newer version. */
-export declare const BREW_INFO_CURL = "{\"formulae\":[{\"name\":\"curl\",\"full_name\":\"curl\",\"tap\":\"homebrew/core\",\"oldnames\":[],\"aliases\":[],\"versions\":{\"stable\":\"8.9.1\",\"head\":\"HEAD\",\"bottle\":true},\"installed\":[{\"version\":\"8.8.0\",\"used_options\":[],\"built_as_bottle\":true,\"poured_from_bottle\":true,\"installed_as_dependency\":false,\"installed_on_request\":true}],\"dependencies\":[\"brotli\",\"libnghttp2\",\"libssh2\",\"openldap\",\"rtmpdump\",\"zstd\"],\"pinned\":false,\"outdated\":true,\"deprecated\":false,\"disabled\":false}],\"casks\":[]}";
-/** `brew info --json=v2 tree` — known to the tap, not installed. */
-export declare const BREW_INFO_TREE = "{\"formulae\":[{\"name\":\"tree\",\"full_name\":\"tree\",\"tap\":\"homebrew/core\",\"versions\":{\"stable\":\"2.2.1\",\"head\":null,\"bottle\":true},\"installed\":[],\"dependencies\":[],\"pinned\":false,\"outdated\":false,\"deprecated\":false,\"disabled\":false}],\"casks\":[]}";
-/**
- * `brew info --json=v2 python@3.11` — two kegs of one formula.
- *
- * The reason `installedVersions` is an array: reporting the first as "the"
- * installed version is wrong for exactly the formulae people ask about.
- */
-export declare const BREW_INFO_PYTHON = "{\"formulae\":[{\"name\":\"python@3.11\",\"full_name\":\"python@3.11\",\"tap\":\"homebrew/core\",\"versions\":{\"stable\":\"3.11.9\",\"head\":null,\"bottle\":true},\"installed\":[{\"version\":\"3.11.9\",\"installed_on_request\":true},{\"version\":\"3.11.8\",\"installed_on_request\":false}],\"dependencies\":[\"mpdecimal\",\"openssl@3\",\"sqlite\",\"xz\"],\"pinned\":true,\"outdated\":false}],\"casks\":[]}";
-/** `brew info --json=v2 firefox` — a cask, which spells everything differently. */
-export declare const BREW_INFO_FIREFOX = "{\"formulae\":[],\"casks\":[{\"token\":\"firefox\",\"full_token\":\"homebrew/cask/firefox\",\"tap\":\"homebrew/cask\",\"name\":[\"Mozilla Firefox\"],\"version\":\"142.0.1\",\"installed\":\"141.0\",\"outdated\":true}]}";
-/** `brew info --json=v2 nope-nope` — exit 1, and this exact sentence. */
-export declare const BREW_NO_SUCH_FORMULA = "Error: No available formula with the name \"nope-nope\".\n==> Searching for similarly named formulae and casks...\n";
-export declare const BREW_DEPS_CURL = "brotli\nlibnghttp2\nlibssh2\nopenldap\nrtmpdump\nzstd\n";
-export declare const BREW_DEPS_TREE = "";
-/** `brew list --formula --versions` — four of the six curl deps are present. */
-export declare const BREW_LIST_VERSIONS = "brotli 1.1.0\nca-certificates 2026-08-12\nlibnghttp2 1.62.1\nopenldap 2.6.7\npython@3.11 3.11.9 3.11.8\nzstd 1.5.6\n";
-export declare const BREW_INSTALL_TREE = "==> Fetching tree\n==> Downloading https://ghcr.io/v2/homebrew/core/tree/blobs/sha256:9f3c1ad\n==> Pouring tree--2.2.1.arm64_sonoma.bottle.tar.gz\n/opt/homebrew/Cellar/tree/2.2.1: 8 files, 162.5KB\n";
-/** `brew info --json=v2 tree`, re-run after the install above succeeded. */
-export declare const BREW_INFO_TREE_AFTER = "{\"formulae\":[{\"name\":\"tree\",\"full_name\":\"tree\",\"tap\":\"homebrew/core\",\"versions\":{\"stable\":\"2.2.1\",\"head\":null,\"bottle\":true},\"installed\":[{\"version\":\"2.2.1\",\"installed_on_request\":true}],\"dependencies\":[],\"pinned\":false,\"outdated\":false}],\"casks\":[]}";
-export declare const DPKG_VERSION = "Debian dpkg-query package management program version 1.21.22 (amd64).\nThis is free software; see the GNU General Public License version 2 or\nlater for copying conditions. There is NO warranty.\n";
-/** Note the trailing space: `${db:Status-Abbrev}` is three characters wide. */
-export declare const DPKG_QUERY_CURL = "curl\t7.88.1-10+deb12u5\tii \n";
-/**
- * A package dpkg still has a RECORD of but does not have installed: removed,
- * configuration files left behind. Reading `rc` as installed is the classic
- * dpkg mistake — the binary is gone and only `/etc` remains.
- */
-export declare const DPKG_QUERY_NANO_REMOVED = "nano\t7.2-1\trc \n";
-/** dpkg has no record at all of a package that was never installed. */
-export declare const DPKG_NO_SUCH_PACKAGE = "dpkg-query: no packages found matching htop\n";
-export declare const APT_POLICY_CURL = "curl:\n  Installed: 7.88.1-10+deb12u5\n  Candidate: 7.88.1-10+deb12u7\n  Version table:\n *** 7.88.1-10+deb12u5 100\n        100 /var/lib/dpkg/status\n     7.88.1-10+deb12u7 500\n        500 http://deb.debian.org/debian-security bookworm-security/main amd64 Packages\n";
-export declare const APT_POLICY_HTOP = "htop:\n  Installed: (none)\n  Candidate: 3.2.2-2\n  Version table:\n     3.2.2-2 500\n        500 http://deb.debian.org/debian bookworm/main amd64 Packages\n";
-/** A package apt has in its lists with no installable candidate at all. */
-export declare const APT_POLICY_NO_CANDIDATE = "phantom:\n  Installed: (none)\n  Candidate: (none)\n  Version table:\n";
-/** apt-cache prints NOTHING for a name it does not know, and exits 0. */
-export declare const APT_POLICY_UNKNOWN_STDERR = "N: Unable to locate package nosuchpkg\n";
-/**
- * The same `apt-cache policy curl` on a de_DE host.
- *
- * This is the fixture that gives the localisation trap a name. Every parser
- * in this package reads English labels, which is sound ONLY because
- * `../run.ts` pins `LC_ALL=C` on every child. Without that pin the parse does
- * not fail loudly — it finds nothing, and "nothing" reads as "not installed".
- */
-export declare const APT_POLICY_CURL_GERMAN = "curl:\n  Installiert:           7.88.1-10+deb12u5\n  Installationskandidat: 7.88.1-10+deb12u7\n  Versionstabelle:\n *** 7.88.1-10+deb12u5 100\n        100 /var/lib/dpkg/status\n";
-export declare const APT_SIMULATE_HTOP = "NOTE: This is only a simulation!\n      apt-get needs root privileges for real execution.\n      Keep also in mind that locking is deactivated,\n      so don't depend on the relevance to the real current situation!\nReading package lists...\nBuilding dependency tree...\nReading state information...\nThe following additional packages will be installed:\n  libnl-3-200 libnl-genl-3-200\nThe following NEW packages will be installed:\n  htop libnl-3-200 libnl-genl-3-200\n0 upgraded, 3 newly installed, 0 to remove and 0 not upgraded.\nInst libnl-3-200 (3.7.0-0.2+b1 Debian:12.5/stable [amd64])\nInst libnl-genl-3-200 (3.7.0-0.2+b1 Debian:12.5/stable [amd64])\nInst htop (3.2.2-2 Debian:12.5/stable [amd64])\nConf libnl-3-200 (3.7.0-0.2+b1 Debian:12.5/stable [amd64])\nConf libnl-genl-3-200 (3.7.0-0.2+b1 Debian:12.5/stable [amd64])\nConf htop (3.2.2-2 Debian:12.5/stable [amd64])\n";
-/**
- * An UPGRADE that also removes something — the case an operator most needs to
- * see before approving an install. Note the `[old-version]` bracket between
- * the name and the parenthesis, which only an upgrade has.
- */
-export declare const APT_SIMULATE_CURL_UPGRADE = "Reading package lists...\nBuilding dependency tree...\nThe following packages will be REMOVED:\n  curl-legacy\nThe following packages will be upgraded:\n  curl\n1 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.\nRemv curl-legacy [7.74.0-1]\nInst curl [7.88.1-10+deb12u5] (7.88.1-10+deb12u7 Debian-Security:12/stable-security [amd64])\nConf curl (7.88.1-10+deb12u7 Debian-Security:12/stable-security [amd64])\n";
-export declare const APT_INSTALL_HTOP = "Reading package lists...\nBuilding dependency tree...\nThe following NEW packages will be installed:\n  htop libnl-3-200 libnl-genl-3-200\nSetting up htop (3.2.2-2) ...\nProcessing triggers for man-db (2.11.2-2) ...\n";
-export declare const DPKG_QUERY_HTOP_AFTER = "htop\t3.2.2-2\tii \n";
-export declare const APT_NEEDS_ROOT = "E: Could not open lock file /var/lib/dpkg/lock-frontend - open (13: Permission denied)\nE: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), are you root?\n";
-export declare const DNF_VERSION = "4.14.0\n  Installed: dnf-0:4.14.0-9.el9.noarch at 2026-02-11 08:14\n  Built    : Rocky Enterprise Software Foundation at 2026-01-30 11:02\n";
-export declare const RPM_QUERY_CURL = "curl\t7.76.1-29.el9_4\tx86_64\n";
-/** The same name installed for two architectures — real, and common. */
-export declare const RPM_QUERY_GLIBC = "glibc\t2.34-100.el9_4.2\tx86_64\nglibc\t2.34-100.el9_4.2\ti686\n";
-/** rpm writes this to STDOUT, not stderr, and exits 1. */
-export declare const RPM_NOT_INSTALLED = "package tree is not installed\n";
-export declare const DNF_LIST_TREE = "Available Packages\ntree.x86_64                      1.8.0-10.el9                       baseos\n";
-export declare const DNF_LIST_NO_MATCH = "Error: No matching Packages to list\n";
-/**
- * The case `--cacheonly` makes common on a fresh container, and the case
- * house rule 6 is about: an empty metadata cache is NOT an absent package.
- */
-export declare const DNF_NO_CACHE = "Error: Cache-only enabled but no cache for 'baseos'\n";
-export declare const DNF_SIMULATE_TREE = "Last metadata expiration check: 0:05:12 ago on Wed 17 Sep 2026 09:00:00 AM UTC.\nDependencies resolved.\n================================================================================\n Package           Arch          Version               Repository          Size\n================================================================================\nInstalling:\n tree              x86_64        1.8.0-10.el9          baseos              55 k\nInstalling dependencies:\n libfoo            x86_64        1.2-3.el9             appstream           10 k\n\nTransaction Summary\n================================================================================\nInstall  2 Packages\n\nTotal download size: 65 k\nInstalled size: 143 k\nOperation aborted.\n";
-export declare const DNF_NEEDS_ROOT = "Error: This command has to be run with superuser privileges (under the root user on most systems).\n";
-export declare const DNF_INSTALL_TREE = "Dependencies resolved.\nInstalling:\n tree              x86_64        1.8.0-10.el9          baseos              55 k\n\nComplete!\n";
-export declare const RPM_QUERY_TREE_AFTER = "tree\t1.8.0-10.el9\tx86_64\n";
-export declare const PACMAN_VERSION = " .--.                  Pacman v6.1.0 - libalpm v14.0.0\n/ _.-' .-.  .-.  .-.   Copyright (C) 2006-2024 Pacman Development Team\n";
-export declare const PACMAN_QUERY_CURL = "curl 8.9.1-1\n";
-export declare const PACMAN_NOT_FOUND = "error: package 'htop' was not found\n";
-export declare const PACMAN_SYNC_INFO_HTOP = "Repository      : extra\nName            : htop\nVersion         : 3.3.0-1\nDescription     : Interactive process viewer\nArchitecture    : x86_64\nLicenses        : GPL\nDepends On      : glibc  ncurses  lm_sensors\nDownload Size   : 158.44 KiB\n\nRepository      : community-testing\nName            : htop\nVersion         : 3.4.0-0.1\n";
-export declare const PACMAN_SYNC_NOT_FOUND = "error: package 'nosuch' was not found\n";
-/** `pacman -S --print --print-format '%r/%n %v'` — targets AND dependencies. */
-export declare const PACMAN_SIMULATE_HTOP = "core/ncurses 6.5-3\nextra/lm_sensors 1:3.6.0.r41-3\nextra/htop 3.3.0-1\n";
-export declare const PACMAN_NEEDS_ROOT = "error: you cannot perform this operation unless you are root.\n";
-export declare const PACMAN_INSTALL_HTOP = "resolving dependencies...\nlooking for conflicting packages...\n(3) installing ncurses  lm_sensors  htop\n:: Running post-transaction hooks...\n";
-export declare const PACMAN_QUERY_HTOP_AFTER = "htop 3.3.0-1\n";
-export declare const WINGET_VERSION = "v1.8.1911\n";
-/** Five columns: Name, Id, Version, Available, Source. */
-export declare const WINGET_LIST_GIT = "Name    Id       Version  Available  Source\n-------------------------------------------\nGit     Git.Git  2.45.1   2.46.0     winget\n";
-/**
- * Four columns, which is the ambiguous case: this is `…Version Source`, but a
- * row with an available upgrade and no source is `…Version Available` and
- * looks identical. winget's headers are localised, so there is no way to tell
- * — which is why the parser reports a null `available` with a reason rather
- * than picking one.
- */
-export declare const WINGET_LIST_FOUR_COLUMNS = "Name    Id       Version  Source\n--------------------------------\n7-Zip   7zip.7zip  24.08  winget\n";
-/**
- * A row winget had to CUT, marked with U+2026. The survey's proposed
- * header-offset parser would read `14.40.3` here as a complete version and
- * the Id as a complete Id; both are prefixes.
- */
-export declare const WINGET_LIST_TRUNCATED = "Name                      Id                        Version  Source\n-------------------------------------------------------------------\nMicrosoft Visual C++ 20\u2026  Microsoft.VCRedist.2015\u2026  14.40.3  winget\n";
-/**
- * A CJK display name. Each glyph is DOUBLE-WIDTH in the console and one
- * UTF-16 code unit in the string, so every character offset after it is
- * wrong — and splitting on two-or-more spaces is unaffected.
- */
-export declare const WINGET_LIST_CJK = "Name        Id           Version  Source\n----------------------------------------\n\u30C6\u30AD\u30B9\u30C8    Vendor.Text  1.2.3    winget\n";
-export declare const WINGET_NOT_FOUND = "No installed package found matching input criteria.\n";
-export declare const CHOCO_VERSION_V2 = "2.2.2\n";
-export declare const CHOCO_VERSION_V1 = "0.10.15\n";
-export declare const CHOCO_LIST_GIT = "git|2.45.1\ngit.install|2.45.1\n";
-export declare const CHOCO_LIST_EMPTY = "";
-/** A recorded answer to one command. */
-export type RecordedCase = {
-    readonly stdout?: string;
-    readonly stderr?: string;
-    readonly code?: number;
-    readonly timedOut?: boolean;
-    /** The program is not installed on this host (ENOENT on spawn). */
-    readonly missing?: boolean;
-    readonly stdoutTruncated?: boolean;
-    readonly stderrTruncated?: boolean;
-};
-export type RecordedRunner = {
-    readonly runner: Runner;
-    /** Every argv this runner was asked for, in order. */
-    readonly calls: string[][];
-    /** Every request, for the tests that check the pinned environment. */
-    readonly requests: RunRequest[];
-};
-/** The key a command is recorded under. NUL cannot appear in an argv element. */
-export declare function argvKey(argv: readonly string[]): string;
-/**
- * Serve recorded output, and refuse anything nobody recorded.
- *
- * The refusal is the important half. A runner that answered an unrecorded
- * command with an empty success would be indistinguishable from a manager
- * that had nothing to say, and every "not installed" in the suite would stop
- * meaning anything. Instead the promise rejects with the argv, so a missing
- * fixture fails the test that needed it and names the command.
- *
- * `fallback` exists for the tests that are ABOUT an unrecognised host: pass
- * `{ missing: true }` to make every unrecorded command behave like a program
- * that is not installed.
- */
-export declare function recordedRunner(cases: Readonly<Record<string, RecordedCase | readonly RecordedCase[]>>, fallback?: RecordedCase): RecordedRunner;
-/** Shorthand: record a case under an argv rather than under a key. */
-export declare function record(argv: readonly string[], outcome: RecordedCase | readonly RecordedCase[]): Record<string, RecordedCase | readonly RecordedCase[]>;