@tryaura/aura-testkit 0.1.0

package/dist/index.js

@@ -0,0 +1,2005 @@
+import { spawn } from "node:child_process";
+import { dirname, isAbsolute, join, normalize, relative, sep } from "node:path";
+import { createHash } from "node:crypto";
+import { chmod, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, writeFile } from "node:fs/promises";
+import { PassThrough, Readable } from "node:stream";
+import { runCli } from "@tryaura/aura-cli";
+import { tmpdir } from "node:os";
+import { DEFAULT_HTTP_TIMEOUT_MS, MAX_HTTP_RESPONSE_BYTES, MAX_HTTP_TIMEOUT_MS } from "@tryaura/aura-sdk";
+import { createServer } from "node:http";
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/base.js
+var Diff = class {
+	diff(oldStr, newStr, options = {}) {
+		let callback;
+		if (typeof options === "function") {
+			callback = options;
+			options = {};
+		} else if ("callback" in options) callback = options.callback;
+		const oldString = this.castInput(oldStr, options);
+		const newString = this.castInput(newStr, options);
+		const oldTokens = this.removeEmpty(this.tokenize(oldString, options));
+		const newTokens = this.removeEmpty(this.tokenize(newString, options));
+		return this.diffWithOptionsObj(oldTokens, newTokens, options, callback);
+	}
+	diffWithOptionsObj(oldTokens, newTokens, options, callback) {
+		var _a;
+		const done = (value) => {
+			value = this.postProcess(value, options);
+			if (callback) {
+				setTimeout(function() {
+					callback(value);
+				}, 0);
+				return;
+			} else return value;
+		};
+		const newLen = newTokens.length, oldLen = oldTokens.length;
+		let editLength = 1;
+		let maxEditLength = newLen + oldLen;
+		if (options.maxEditLength != null) maxEditLength = Math.min(maxEditLength, options.maxEditLength);
+		const maxExecutionTime = (_a = options.timeout) !== null && _a !== void 0 ? _a : Infinity;
+		const abortAfterTimestamp = Date.now() + maxExecutionTime;
+		const bestPath = [{
+			oldPos: -1,
+			lastComponent: void 0
+		}];
+		let newPos = this.extractCommon(bestPath[0], newTokens, oldTokens, 0, options);
+		if (bestPath[0].oldPos + 1 >= oldLen && newPos + 1 >= newLen) return done(this.buildValues(bestPath[0].lastComponent, newTokens, oldTokens));
+		let minDiagonalToConsider = -Infinity, maxDiagonalToConsider = Infinity;
+		const execEditLength = () => {
+			for (let diagonalPath = Math.max(minDiagonalToConsider, -editLength); diagonalPath <= Math.min(maxDiagonalToConsider, editLength); diagonalPath += 2) {
+				let basePath;
+				const removePath = bestPath[diagonalPath - 1], addPath = bestPath[diagonalPath + 1];
+				if (removePath) bestPath[diagonalPath - 1] = void 0;
+				let canAdd = false;
+				if (addPath) {
+					const addPathNewPos = addPath.oldPos - diagonalPath;
+					canAdd = addPath && 0 <= addPathNewPos && addPathNewPos < newLen;
+				}
+				const canRemove = removePath && removePath.oldPos + 1 < oldLen;
+				if (!canAdd && !canRemove) {
+					bestPath[diagonalPath] = void 0;
+					continue;
+				}
+				if (!canRemove || canAdd && removePath.oldPos < addPath.oldPos) basePath = this.addToPath(addPath, true, false, 0, options);
+				else basePath = this.addToPath(removePath, false, true, 1, options);
+				newPos = this.extractCommon(basePath, newTokens, oldTokens, diagonalPath, options);
+				if (basePath.oldPos + 1 >= oldLen && newPos + 1 >= newLen) return done(this.buildValues(basePath.lastComponent, newTokens, oldTokens)) || true;
+				else {
+					bestPath[diagonalPath] = basePath;
+					if (basePath.oldPos + 1 >= oldLen) maxDiagonalToConsider = Math.min(maxDiagonalToConsider, diagonalPath - 1);
+					if (newPos + 1 >= newLen) minDiagonalToConsider = Math.max(minDiagonalToConsider, diagonalPath + 1);
+				}
+			}
+			editLength++;
+		};
+		if (callback) (function exec() {
+			setTimeout(function() {
+				if (editLength > maxEditLength || Date.now() > abortAfterTimestamp) return callback(void 0);
+				if (!execEditLength()) exec();
+			}, 0);
+		})();
+		else while (editLength <= maxEditLength && Date.now() <= abortAfterTimestamp) {
+			const ret = execEditLength();
+			if (ret) return ret;
+		}
+	}
+	addToPath(path, added, removed, oldPosInc, options) {
+		const last = path.lastComponent;
+		if (last && !options.oneChangePerToken && last.added === added && last.removed === removed) return {
+			oldPos: path.oldPos + oldPosInc,
+			lastComponent: {
+				count: last.count + 1,
+				added,
+				removed,
+				previousComponent: last.previousComponent
+			}
+		};
+		else return {
+			oldPos: path.oldPos + oldPosInc,
+			lastComponent: {
+				count: 1,
+				added,
+				removed,
+				previousComponent: last
+			}
+		};
+	}
+	extractCommon(basePath, newTokens, oldTokens, diagonalPath, options) {
+		const newLen = newTokens.length, oldLen = oldTokens.length;
+		let oldPos = basePath.oldPos, newPos = oldPos - diagonalPath, commonCount = 0;
+		while (newPos + 1 < newLen && oldPos + 1 < oldLen && this.equals(oldTokens[oldPos + 1], newTokens[newPos + 1], options)) {
+			newPos++;
+			oldPos++;
+			commonCount++;
+			if (options.oneChangePerToken) basePath.lastComponent = {
+				count: 1,
+				previousComponent: basePath.lastComponent,
+				added: false,
+				removed: false
+			};
+		}
+		if (commonCount && !options.oneChangePerToken) basePath.lastComponent = {
+			count: commonCount,
+			previousComponent: basePath.lastComponent,
+			added: false,
+			removed: false
+		};
+		basePath.oldPos = oldPos;
+		return newPos;
+	}
+	equals(left, right, options) {
+		if (options.comparator) return options.comparator(left, right);
+		else return left === right || !!options.ignoreCase && left.toLowerCase() === right.toLowerCase();
+	}
+	removeEmpty(array) {
+		const ret = [];
+		for (let i = 0; i < array.length; i++) if (array[i]) ret.push(array[i]);
+		return ret;
+	}
+	castInput(value, options) {
+		return value;
+	}
+	tokenize(value, options) {
+		return Array.from(value);
+	}
+	join(chars) {
+		return chars.join("");
+	}
+	postProcess(changeObjects, options) {
+		return changeObjects;
+	}
+	get useLongestToken() {
+		return false;
+	}
+	buildValues(lastComponent, newTokens, oldTokens) {
+		const components = [];
+		let nextComponent;
+		while (lastComponent) {
+			components.push(lastComponent);
+			nextComponent = lastComponent.previousComponent;
+			delete lastComponent.previousComponent;
+			lastComponent = nextComponent;
+		}
+		components.reverse();
+		const componentLen = components.length;
+		let componentPos = 0, newPos = 0, oldPos = 0;
+		for (; componentPos < componentLen; componentPos++) {
+			const component = components[componentPos];
+			if (!component.removed) {
+				if (!component.added && this.useLongestToken) {
+					let value = newTokens.slice(newPos, newPos + component.count);
+					value = value.map(function(value, i) {
+						const oldValue = oldTokens[oldPos + i];
+						return oldValue.length > value.length ? oldValue : value;
+					});
+					component.value = this.join(value);
+				} else component.value = this.join(newTokens.slice(newPos, newPos + component.count));
+				newPos += component.count;
+				if (!component.added) oldPos += component.count;
+			} else {
+				component.value = this.join(oldTokens.slice(oldPos, oldPos + component.count));
+				oldPos += component.count;
+			}
+		}
+		return components;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/character.js
+var CharacterDiff = class extends Diff {};
+new CharacterDiff();
+//#endregion
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/util/string.js
+function longestCommonPrefix(str1, str2) {
+	let i;
+	for (i = 0; i < str1.length && i < str2.length; i++) if (str1[i] != str2[i]) return str1.slice(0, i);
+	return str1.slice(0, i);
+}
+function longestCommonSuffix(str1, str2) {
+	let i;
+	if (!str1 || !str2 || str1[str1.length - 1] != str2[str2.length - 1]) return "";
+	for (i = 0; i < str1.length && i < str2.length; i++) if (str1[str1.length - (i + 1)] != str2[str2.length - (i + 1)]) return str1.slice(-i);
+	return str1.slice(-i);
+}
+function replacePrefix(string, oldPrefix, newPrefix) {
+	if (string.slice(0, oldPrefix.length) != oldPrefix) throw Error(`string ${JSON.stringify(string)} doesn't start with prefix ${JSON.stringify(oldPrefix)}; this is a bug`);
+	return newPrefix + string.slice(oldPrefix.length);
+}
+function replaceSuffix(string, oldSuffix, newSuffix) {
+	if (!oldSuffix) return string + newSuffix;
+	if (string.slice(-oldSuffix.length) != oldSuffix) throw Error(`string ${JSON.stringify(string)} doesn't end with suffix ${JSON.stringify(oldSuffix)}; this is a bug`);
+	return string.slice(0, -oldSuffix.length) + newSuffix;
+}
+function removePrefix(string, oldPrefix) {
+	return replacePrefix(string, oldPrefix, "");
+}
+function removeSuffix(string, oldSuffix) {
+	return replaceSuffix(string, oldSuffix, "");
+}
+function maximumOverlap(string1, string2) {
+	return string2.slice(0, overlapCount(string1, string2));
+}
+function overlapCount(a, b) {
+	let startA = 0;
+	if (a.length > b.length) startA = a.length - b.length;
+	let endB = b.length;
+	if (a.length < b.length) endB = a.length;
+	const map = Array(endB);
+	let k = 0;
+	map[0] = 0;
+	for (let j = 1; j < endB; j++) {
+		if (b[j] == b[k]) map[j] = map[k];
+		else map[j] = k;
+		while (k > 0 && b[j] != b[k]) k = map[k];
+		if (b[j] == b[k]) k++;
+	}
+	k = 0;
+	for (let i = startA; i < a.length; i++) {
+		while (k > 0 && a[i] != b[k]) k = map[k];
+		if (a[i] == b[k]) k++;
+	}
+	return k;
+}
+/**
+* Split a string into segments using a word segmenter, merging consecutive
+* segments if they are both whitespace segments. Whitespace segments can
+* appear adjacent to one another for two reasons:
+* - newlines always get their own segment
+* - where a diacritic is attached to a whitespace character in the text, the
+*   segment ends after the diacritic, so e.g. " \u0300 " becomes two segments.
+* This function therefore runs the segmenter's .segment() method and then
+* merges consecutive segments of whitespace into a single part.
+*/
+function segment(string, segmenter) {
+	const parts = [];
+	for (const segmentObj of Array.from(segmenter.segment(string))) {
+		const segment = segmentObj.segment;
+		if (parts.length && /\s/.test(parts[parts.length - 1]) && /\s/.test(segment)) parts[parts.length - 1] += segment;
+		else parts.push(segment);
+	}
+	return parts;
+}
+function trailingWs(string, segmenter) {
+	if (segmenter) return leadingAndTrailingWs(string, segmenter)[1];
+	let i;
+	for (i = string.length - 1; i >= 0; i--) if (!string[i].match(/\s/)) break;
+	return string.substring(i + 1);
+}
+function leadingWs(string, segmenter) {
+	if (segmenter) return leadingAndTrailingWs(string, segmenter)[0];
+	const match = string.match(/^\s*/);
+	return match ? match[0] : "";
+}
+function leadingAndTrailingWs(string, segmenter) {
+	if (!segmenter) return [leadingWs(string), trailingWs(string)];
+	if (segmenter.resolvedOptions().granularity != "word") throw new Error("The segmenter passed must have a granularity of \"word\"");
+	const segments = segment(string, segmenter);
+	const firstSeg = segments[0];
+	const lastSeg = segments[segments.length - 1];
+	return [/\s/.test(firstSeg) ? firstSeg : "", /\s/.test(lastSeg) ? lastSeg : ""];
+}
+//#endregion
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/word.js
+const extendedWordChars = "a-zA-Z0-9_\\u{AD}\\u{C0}-\\u{D6}\\u{D8}-\\u{F6}\\u{F8}-\\u{2C6}\\u{2C8}-\\u{2D7}\\u{2DE}-\\u{2FF}\\u{1E00}-\\u{1EFF}";
+const tokenizeIncludingWhitespace = new RegExp(`[${extendedWordChars}]+|\\s+|[^${extendedWordChars}]`, "ug");
+var WordDiff = class extends Diff {
+	equals(left, right, options) {
+		if (options.ignoreCase) {
+			left = left.toLowerCase();
+			right = right.toLowerCase();
+		}
+		return left.trim() === right.trim();
+	}
+	tokenize(value, options = {}) {
+		let parts;
+		if (options.intlSegmenter) {
+			const segmenter = options.intlSegmenter;
+			if (segmenter.resolvedOptions().granularity != "word") throw new Error("The segmenter passed must have a granularity of \"word\"");
+			parts = segment(value, segmenter);
+		} else parts = value.match(tokenizeIncludingWhitespace) || [];
+		const tokens = [];
+		let prevPart = null;
+		parts.forEach((part) => {
+			if (/\s/.test(part)) {
+				if (prevPart == null) tokens.push(part);
+				else tokens.push(tokens.pop() + part);
+			} else if (prevPart != null && /\s/.test(prevPart)) {
+				if (tokens[tokens.length - 1] == prevPart) tokens.push(tokens.pop() + part);
+				else tokens.push(prevPart + part);
+			} else tokens.push(part);
+			prevPart = part;
+		});
+		return tokens;
+	}
+	join(tokens) {
+		return tokens.map((token, i) => {
+			if (i == 0) return token;
+			else return token.replace(/^\s+/, "");
+		}).join("");
+	}
+	postProcess(changes, options) {
+		if (!changes || options.oneChangePerToken) return changes;
+		let lastKeep = null;
+		let insertion = null;
+		let deletion = null;
+		changes.forEach((change) => {
+			if (change.added) insertion = change;
+			else if (change.removed) deletion = change;
+			else {
+				if (insertion || deletion) dedupeWhitespaceInChangeObjects(lastKeep, deletion, insertion, change, options.intlSegmenter);
+				lastKeep = change;
+				insertion = null;
+				deletion = null;
+			}
+		});
+		if (insertion || deletion) dedupeWhitespaceInChangeObjects(lastKeep, deletion, insertion, null, options.intlSegmenter);
+		return changes;
+	}
+};
+new WordDiff();
+function dedupeWhitespaceInChangeObjects(startKeep, deletion, insertion, endKeep, segmenter) {
+	if (deletion && insertion) {
+		const [oldWsPrefix, oldWsSuffix] = leadingAndTrailingWs(deletion.value, segmenter);
+		const [newWsPrefix, newWsSuffix] = leadingAndTrailingWs(insertion.value, segmenter);
+		if (startKeep) {
+			const commonWsPrefix = longestCommonPrefix(oldWsPrefix, newWsPrefix);
+			startKeep.value = replaceSuffix(startKeep.value, newWsPrefix, commonWsPrefix);
+			deletion.value = removePrefix(deletion.value, commonWsPrefix);
+			insertion.value = removePrefix(insertion.value, commonWsPrefix);
+		}
+		if (endKeep) {
+			const commonWsSuffix = longestCommonSuffix(oldWsSuffix, newWsSuffix);
+			endKeep.value = replacePrefix(endKeep.value, newWsSuffix, commonWsSuffix);
+			deletion.value = removeSuffix(deletion.value, commonWsSuffix);
+			insertion.value = removeSuffix(insertion.value, commonWsSuffix);
+		}
+	} else if (insertion) {
+		if (startKeep) {
+			const ws = leadingWs(insertion.value, segmenter);
+			insertion.value = insertion.value.substring(ws.length);
+		}
+		if (endKeep) {
+			const ws = leadingWs(endKeep.value, segmenter);
+			endKeep.value = endKeep.value.substring(ws.length);
+		}
+	} else if (startKeep && endKeep) {
+		const newWsFull = leadingWs(endKeep.value, segmenter), [delWsStart, delWsEnd] = leadingAndTrailingWs(deletion.value, segmenter);
+		const newWsStart = longestCommonPrefix(newWsFull, delWsStart);
+		deletion.value = removePrefix(deletion.value, newWsStart);
+		const newWsEnd = longestCommonSuffix(removePrefix(newWsFull, newWsStart), delWsEnd);
+		deletion.value = removeSuffix(deletion.value, newWsEnd);
+		endKeep.value = replacePrefix(endKeep.value, newWsFull, newWsEnd);
+		startKeep.value = replaceSuffix(startKeep.value, newWsFull, newWsFull.slice(0, newWsFull.length - newWsEnd.length));
+	} else if (endKeep) {
+		const endKeepWsPrefix = leadingWs(endKeep.value, segmenter);
+		const overlap = maximumOverlap(trailingWs(deletion.value, segmenter), endKeepWsPrefix);
+		deletion.value = removeSuffix(deletion.value, overlap);
+	} else if (startKeep) {
+		const overlap = maximumOverlap(trailingWs(startKeep.value, segmenter), leadingWs(deletion.value, segmenter));
+		deletion.value = removePrefix(deletion.value, overlap);
+	}
+}
+var WordsWithSpaceDiff = class extends Diff {
+	tokenize(value) {
+		const regex = new RegExp(`(\\r?\\n)|[${extendedWordChars}]+|[^\\S\\n\\r]+|[^${extendedWordChars}]`, "ug");
+		return value.match(regex) || [];
+	}
+};
+new WordsWithSpaceDiff();
+//#endregion
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/line.js
+var LineDiff = class extends Diff {
+	constructor() {
+		super(...arguments);
+		this.tokenize = tokenize;
+	}
+	equals(left, right, options) {
+		if (options.ignoreWhitespace) {
+			if (!options.newlineIsToken || !left.includes("\n")) left = left.trim();
+			if (!options.newlineIsToken || !right.includes("\n")) right = right.trim();
+		} else if (options.ignoreNewlineAtEof && !options.newlineIsToken) {
+			if (left.endsWith("\n")) left = left.slice(0, -1);
+			if (right.endsWith("\n")) right = right.slice(0, -1);
+		}
+		return super.equals(left, right, options);
+	}
+};
+const lineDiff = new LineDiff();
+function diffLines(oldStr, newStr, options) {
+	return lineDiff.diff(oldStr, newStr, options);
+}
+function tokenize(value, options) {
+	if (options.stripTrailingCr) value = value.replace(/\r\n/g, "\n");
+	const retLines = [], linesAndNewlines = value.split(/(\n|\r\n)/);
+	if (!linesAndNewlines[linesAndNewlines.length - 1]) linesAndNewlines.pop();
+	for (let i = 0; i < linesAndNewlines.length; i++) {
+		const line = linesAndNewlines[i];
+		if (i % 2 && !options.newlineIsToken) retLines[retLines.length - 1] += line;
+		else retLines.push(line);
+	}
+	return retLines;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/sentence.js
+function isSentenceEndPunct(char) {
+	return char == "." || char == "!" || char == "?";
+}
+var SentenceDiff = class extends Diff {
+	tokenize(value) {
+		var _a;
+		const result = [];
+		let tokenStartI = 0;
+		for (let i = 0; i < value.length; i++) {
+			if (i == value.length - 1) {
+				result.push(value.slice(tokenStartI));
+				break;
+			}
+			if (isSentenceEndPunct(value[i]) && value[i + 1].match(/\s/)) {
+				result.push(value.slice(tokenStartI, i + 1));
+				i = tokenStartI = i + 1;
+				while ((_a = value[i + 1]) === null || _a === void 0 ? void 0 : _a.match(/\s/)) i++;
+				result.push(value.slice(tokenStartI, i + 1));
+				tokenStartI = i + 1;
+			}
+		}
+		return result;
+	}
+};
+new SentenceDiff();
+//#endregion
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/css.js
+var CssDiff = class extends Diff {
+	tokenize(value) {
+		return value.split(/([{}:;,]|\s+)/);
+	}
+};
+new CssDiff();
+//#endregion
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/json.js
+var JsonDiff = class extends Diff {
+	constructor() {
+		super(...arguments);
+		this.tokenize = tokenize;
+	}
+	get useLongestToken() {
+		return true;
+	}
+	castInput(value, options) {
+		const { undefinedReplacement, stringifyReplacer = (k, v) => typeof v === "undefined" ? undefinedReplacement : v } = options;
+		return typeof value === "string" ? value : JSON.stringify(canonicalize(value, null, null, stringifyReplacer), null, "  ");
+	}
+	equals(left, right, options) {
+		return super.equals(left.replace(/,([\r\n])/g, "$1"), right.replace(/,([\r\n])/g, "$1"), options);
+	}
+};
+new JsonDiff();
+function canonicalize(obj, stack, replacementStack, replacer, key) {
+	stack = stack || [];
+	replacementStack = replacementStack || [];
+	if (replacer) obj = replacer(key === void 0 ? "" : key, obj);
+	let i;
+	for (i = 0; i < stack.length; i += 1) if (stack[i] === obj) return replacementStack[i];
+	let canonicalizedObj;
+	if ("[object Array]" === Object.prototype.toString.call(obj)) {
+		stack.push(obj);
+		canonicalizedObj = new Array(obj.length);
+		replacementStack.push(canonicalizedObj);
+		for (i = 0; i < obj.length; i += 1) canonicalizedObj[i] = canonicalize(obj[i], stack, replacementStack, replacer, String(i));
+		stack.pop();
+		replacementStack.pop();
+		return canonicalizedObj;
+	}
+	if (obj && obj.toJSON) obj = obj.toJSON();
+	if (typeof obj === "object" && obj !== null) {
+		stack.push(obj);
+		canonicalizedObj = {};
+		replacementStack.push(canonicalizedObj);
+		const sortedKeys = [];
+		let key;
+		for (key in obj)
+ /* istanbul ignore else */
+		if (Object.prototype.hasOwnProperty.call(obj, key)) sortedKeys.push(key);
+		sortedKeys.sort();
+		for (i = 0; i < sortedKeys.length; i += 1) {
+			key = sortedKeys[i];
+			canonicalizedObj[key] = canonicalize(obj[key], stack, replacementStack, replacer, key);
+		}
+		stack.pop();
+		replacementStack.pop();
+	} else canonicalizedObj = obj;
+	return canonicalizedObj;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/diff/array.js
+var ArrayDiff = class extends Diff {
+	tokenize(value) {
+		return value.slice();
+	}
+	join(value) {
+		return value;
+	}
+	removeEmpty(value) {
+		return value;
+	}
+};
+new ArrayDiff();
+//#endregion
+//#region ../../node_modules/.pnpm/diff@9.0.0/node_modules/diff/libesm/patch/create.js
+/**
+* Returns true if the filename contains characters that require C-style
+* quoting (as used by Git and GNU diffutils in diff output).
+*/
+function needsQuoting(s) {
+	for (let i = 0; i < s.length; i++) if (s[i] < " " || s[i] > "~" || s[i] === "\"" || s[i] === "\\") return true;
+	return false;
+}
+/**
+* C-style quotes a filename, encoding special characters as escape sequences
+* and non-ASCII bytes as octal escapes. This is the inverse of
+* `parseQuotedFileName` in parse.ts.
+*
+* Non-ASCII bytes are encoded as UTF-8 before being emitted as octal escapes.
+* This matches the behaviour of both Git and GNU diffutils, which always emit
+* UTF-8 octal escapes regardless of the underlying filesystem encoding (e.g.
+* Git for Windows converts from NTFS's UTF-16 to UTF-8 internally).
+*
+* If the filename doesn't need quoting, returns it as-is.
+*/
+function quoteFileNameIfNeeded(s) {
+	if (!needsQuoting(s)) return s;
+	let result = "\"";
+	const bytes = new TextEncoder().encode(s);
+	let i = 0;
+	while (i < bytes.length) {
+		const b = bytes[i];
+		if (b === 7) result += "\\a";
+		else if (b === 8) result += "\\b";
+		else if (b === 9) result += "\\t";
+		else if (b === 10) result += "\\n";
+		else if (b === 11) result += "\\v";
+		else if (b === 12) result += "\\f";
+		else if (b === 13) result += "\\r";
+		else if (b === 34) result += "\\\"";
+		else if (b === 92) result += "\\\\";
+		else if (b >= 32 && b <= 126) result += String.fromCharCode(b);
+		else result += "\\" + b.toString(8).padStart(3, "0");
+		i++;
+	}
+	result += "\"";
+	return result;
+}
+const INCLUDE_HEADERS = {
+	includeIndex: true,
+	includeUnderline: true,
+	includeFileHeaders: true
+};
+function structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, options) {
+	let optionsObj;
+	if (!options) optionsObj = {};
+	else if (typeof options === "function") optionsObj = { callback: options };
+	else optionsObj = options;
+	if (typeof optionsObj.context === "undefined") optionsObj.context = 4;
+	const context = optionsObj.context;
+	if (optionsObj.newlineIsToken) throw new Error("newlineIsToken may not be used with patch-generation functions, only with diffing functions");
+	if (!optionsObj.callback) return diffLinesResultToPatch(diffLines(oldStr, newStr, optionsObj));
+	else {
+		const { callback } = optionsObj;
+		diffLines(oldStr, newStr, Object.assign(Object.assign({}, optionsObj), { callback: (diff) => {
+			const patch = diffLinesResultToPatch(diff);
+			callback(patch);
+		} }));
+	}
+	function diffLinesResultToPatch(diff) {
+		if (!diff) return;
+		diff.push({
+			value: "",
+			lines: []
+		});
+		function contextLines(lines) {
+			return lines.map(function(entry) {
+				return " " + entry;
+			});
+		}
+		const hunks = [];
+		let oldRangeStart = 0, newRangeStart = 0, curRange = [], oldLine = 1, newLine = 1;
+		for (let i = 0; i < diff.length; i++) {
+			const current = diff[i], lines = current.lines || splitLines(current.value);
+			current.lines = lines;
+			if (current.added || current.removed) {
+				if (!oldRangeStart) {
+					const prev = diff[i - 1];
+					oldRangeStart = oldLine;
+					newRangeStart = newLine;
+					if (prev) {
+						curRange = context > 0 ? contextLines(prev.lines.slice(-context)) : [];
+						oldRangeStart -= curRange.length;
+						newRangeStart -= curRange.length;
+					}
+				}
+				for (const line of lines) curRange.push((current.added ? "+" : "-") + line);
+				if (current.added) newLine += lines.length;
+				else oldLine += lines.length;
+			} else {
+				if (oldRangeStart) {
+					if (lines.length <= context * 2 && i < diff.length - 2) for (const line of contextLines(lines)) curRange.push(line);
+					else {
+						const contextSize = Math.min(lines.length, context);
+						for (const line of contextLines(lines.slice(0, contextSize))) curRange.push(line);
+						const hunk = {
+							oldStart: oldRangeStart,
+							oldLines: oldLine - oldRangeStart + contextSize,
+							newStart: newRangeStart,
+							newLines: newLine - newRangeStart + contextSize,
+							lines: curRange
+						};
+						hunks.push(hunk);
+						oldRangeStart = 0;
+						newRangeStart = 0;
+						curRange = [];
+					}
+				}
+				oldLine += lines.length;
+				newLine += lines.length;
+			}
+		}
+		for (const hunk of hunks) for (let i = 0; i < hunk.lines.length; i++) if (hunk.lines[i].endsWith("\n")) hunk.lines[i] = hunk.lines[i].slice(0, -1);
+		else {
+			hunk.lines.splice(i + 1, 0, "\");
+			i++;
+		}
+		return {
+			oldFileName,
+			newFileName,
+			oldHeader,
+			newHeader,
+			hunks
+		};
+	}
+}
+/**
+* creates a unified diff patch.
+*
+* @param patch either a single structured patch object (as returned by `structuredPatch`) or an
+*   array of them (as returned by `parsePatch`).
+* @param headerOptions behaves the same as the `headerOptions` option of `createTwoFilesPatch`.
+*   Ignored for patches where `isGit` is `true`.
+*
+* When a patch has `isGit: true`, `formatPatch` output is changed to more closely match Git's
+* output: it emits a `diff --git` header, emits Git extended headers as appropriate based on
+* properties like `isRename`, `isCreate`, `newMode`, etc, and will omit `---`/`+++` file
+* headers for patches with no hunks (e.g. renames without content changes).
+*/
+function formatPatch(patch, headerOptions) {
+	var _a, _b, _c, _d, _e, _f;
+	if (!headerOptions) headerOptions = INCLUDE_HEADERS;
+	if (Array.isArray(patch)) {
+		if (patch.length > 1 && !headerOptions.includeFileHeaders && !patch.every((p) => p.isGit)) throw new Error("Cannot omit file headers on a multi-file patch. (The result would be unparseable; how would a tool trying to apply the patch know which changes are to which file?)");
+		return patch.map((p) => formatPatch(p, headerOptions)).join("\n");
+	}
+	const ret = [];
+	if (patch.isGit) {
+		headerOptions = INCLUDE_HEADERS;
+		if (!patch.oldFileName) throw new Error("oldFileName must be specified for Git patches");
+		if (!patch.newFileName) throw new Error("newFileName must be specified for Git patches");
+		let gitOldName = patch.oldFileName;
+		let gitNewName = patch.newFileName;
+		if (patch.isCreate && gitOldName === "/dev/null") gitOldName = gitNewName.replace(/^b\//, "a/");
+		else if (patch.isDelete && gitNewName === "/dev/null") gitNewName = gitOldName.replace(/^a\//, "b/");
+		ret.push("diff --git " + quoteFileNameIfNeeded(gitOldName) + " " + quoteFileNameIfNeeded(gitNewName));
+		if (patch.isDelete) ret.push("deleted file mode " + ((_a = patch.oldMode) !== null && _a !== void 0 ? _a : "100644"));
+		if (patch.isCreate) ret.push("new file mode " + ((_b = patch.newMode) !== null && _b !== void 0 ? _b : "100644"));
+		if (patch.oldMode && patch.newMode && !patch.isDelete && !patch.isCreate) {
+			ret.push("old mode " + patch.oldMode);
+			ret.push("new mode " + patch.newMode);
+		}
+		if (patch.isRename) {
+			ret.push("rename from " + quoteFileNameIfNeeded(((_c = patch.oldFileName) !== null && _c !== void 0 ? _c : "").replace(/^a\//, "")));
+			ret.push("rename to " + quoteFileNameIfNeeded(((_d = patch.newFileName) !== null && _d !== void 0 ? _d : "").replace(/^b\//, "")));
+		}
+		if (patch.isCopy) {
+			ret.push("copy from " + quoteFileNameIfNeeded(((_e = patch.oldFileName) !== null && _e !== void 0 ? _e : "").replace(/^a\//, "")));
+			ret.push("copy to " + quoteFileNameIfNeeded(((_f = patch.newFileName) !== null && _f !== void 0 ? _f : "").replace(/^b\//, "")));
+		}
+	} else {
+		if (headerOptions.includeIndex && patch.oldFileName == patch.newFileName && patch.oldFileName !== void 0) ret.push("Index: " + patch.oldFileName);
+		if (headerOptions.includeUnderline) ret.push("===================================================================");
+	}
+	const hasHunks = patch.hunks.length > 0;
+	if (headerOptions.includeFileHeaders && patch.oldFileName !== void 0 && patch.newFileName !== void 0 && (!patch.isGit || hasHunks)) {
+		ret.push("--- " + quoteFileNameIfNeeded(patch.oldFileName) + (patch.oldHeader ? "	" + patch.oldHeader : ""));
+		ret.push("+++ " + quoteFileNameIfNeeded(patch.newFileName) + (patch.newHeader ? "	" + patch.newHeader : ""));
+	}
+	for (let i = 0; i < patch.hunks.length; i++) {
+		const hunk = patch.hunks[i];
+		const oldStart = hunk.oldLines === 0 ? hunk.oldStart - 1 : hunk.oldStart;
+		const newStart = hunk.newLines === 0 ? hunk.newStart - 1 : hunk.newStart;
+		ret.push("@@ -" + oldStart + "," + hunk.oldLines + " +" + newStart + "," + hunk.newLines + " @@");
+		for (const line of hunk.lines) ret.push(line);
+	}
+	return ret.join("\n") + "\n";
+}
+function createTwoFilesPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, options) {
+	if (typeof options === "function") options = { callback: options };
+	if (!(options === null || options === void 0 ? void 0 : options.callback)) {
+		const patchObj = structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, options);
+		if (!patchObj) return;
+		return formatPatch(patchObj, options === null || options === void 0 ? void 0 : options.headerOptions);
+	} else {
+		const { callback } = options;
+		structuredPatch(oldFileName, newFileName, oldStr, newStr, oldHeader, newHeader, Object.assign(Object.assign({}, options), { callback: (patchObj) => {
+			if (!patchObj) callback(void 0);
+			else callback(formatPatch(patchObj, options.headerOptions));
+		} }));
+	}
+}
+/**
+* Split `text` into an array of lines, including the trailing newline character (where present)
+*/
+function splitLines(text) {
+	const hasTrailingNl = text.endsWith("\n");
+	const result = text.split("\n").map((line) => line + "\n");
+	if (hasTrailingNl) result.pop();
+	else result.push(result.pop().slice(0, -1));
+	return result;
+}
+//#endregion
+//#region src/filesystem.ts
+const NULL_PATH = "/dev/null";
+const UTF8 = new TextDecoder("utf8", { fatal: true });
+async function captureFilesystem(seed) {
+	const entries = /* @__PURE__ */ new Map();
+	await Promise.all([captureDirectory(seed.homeDir, seed.homeDir, "<HOME>", entries), captureDirectory(seed.workspaceDir, seed.workspaceDir, "<WORKSPACE>", entries)]);
+	return entries;
+}
+function diffFilesystem(before, after, normalize) {
+	const paths = [.../* @__PURE__ */ new Set([...before.keys(), ...after.keys()])].sort();
+	const diffs = [];
+	for (const path of paths) {
+		const previous = before.get(path);
+		const current = after.get(path);
+		if (equalEntry(previous, current)) continue;
+		const status = changeStatus(previous, current);
+		const patch = createTwoFilesPatch(previous === void 0 ? NULL_PATH : path, current === void 0 ? NULL_PATH : path, normalize(renderEntry(previous)), normalize(renderEntry(current)), "before", "after", { context: 3 });
+		diffs.push(Object.freeze({
+			patch,
+			path,
+			status
+		}));
+	}
+	return Object.freeze(diffs);
+}
+async function captureDirectory(root, directory, label, entries) {
+	const children = await readdir(directory, { withFileTypes: true });
+	await Promise.all(children.map((child) => captureChild(root, join(directory, child.name), child, label, entries)));
+}
+async function captureChild(root, path, child, label, entries) {
+	const logicalPath = `${label}/${toPortablePath(relative(root, path))}`;
+	if (child.isDirectory()) {
+		entries.set(logicalPath, {
+			kind: "directory",
+			mode: await readMode(path)
+		});
+		await captureDirectory(root, path, label, entries);
+		return;
+	}
+	if (child.isFile()) {
+		entries.set(logicalPath, await readFileEntry(path));
+		return;
+	}
+	if (child.isSymbolicLink()) {
+		entries.set(logicalPath, {
+			kind: "symlink",
+			target: await readlink(path)
+		});
+		return;
+	}
+	throw new Error(`Cannot snapshot unsupported fixture entry at ${logicalPath}.`);
+}
+async function readFileEntry(path) {
+	const [content, mode] = await Promise.all([readFile(path), readMode(path)]);
+	const text = decodeText(content);
+	if (text === void 0) return {
+		byteLength: content.byteLength,
+		digest: createHash("sha256").update(content).digest("hex"),
+		kind: "binary",
+		mode
+	};
+	return {
+		kind: "file",
+		mode,
+		text
+	};
+}
+/** Bytes that are not UTF-8 text, and text holding NUL, cannot be rendered into a readable patch. */
+function decodeText(content) {
+	if (content.includes(0)) return;
+	try {
+		return UTF8.decode(content);
+	} catch {
+		return;
+	}
+}
+async function readMode(path) {
+	return (await lstat(path)).mode & 511;
+}
+function equalEntry(left, right) {
+	if (left === void 0 || right === void 0) return left === right;
+	return renderEntry(left) === renderEntry(right);
+}
+function changeStatus(before, after) {
+	if (before === void 0) return "added";
+	return after === void 0 ? "removed" : "modified";
+}
+/**
+* Renders one entry as the text its patch diffs.
+*
+* Permission bits lead every entry that has them, which is what makes a `chmod` with no other
+* change show up as a diff at all.
+*/
+function renderEntry(entry) {
+	if (entry === void 0) return "";
+	if (entry.kind === "symlink") return `symlink -> ${entry.target}\n`;
+	const header = `mode ${entry.mode.toString(8).padStart(3, "0")}\n`;
+	if (entry.kind === "directory") return `${header}directory\n`;
+	if (entry.kind === "binary") return `${header}binary ${String(entry.byteLength)} bytes sha256:${entry.digest}\n`;
+	return `${header}${entry.text}`;
+}
+function toPortablePath(path) {
+	return sep === "/" ? path : path.split(sep).join("/");
+}
+//#endregion
+//#region src/guards.ts
+/** Narrows to a plain JSON-shaped object, excluding arrays and null. */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Freezes a JSON-shaped value all the way down. */
+function deepFreeze(value) {
+	if (!isRecord(value) && !Array.isArray(value)) return value;
+	for (const property of Object.values(value)) deepFreeze(property);
+	return Object.freeze(value);
+}
+//#endregion
+//#region src/report.ts
+/** Reads and validates the complete `check --json` document without rebuilding it. */
+function parseReport(stdout, fail) {
+	let document;
+	try {
+		document = JSON.parse(stdout);
+	} catch {
+		throw fail("Check runner expected one JSON report on stdout.");
+	}
+	const problems = [];
+	if (!isCheckReport(document, problems)) throw fail(["Check runner received a JSON report it cannot read:", ...problems.map(indent)].join("\n"));
+	return deepFreeze(document);
+}
+function indent(problem) {
+	return `  - ${problem}`;
+}
+function isCheckReport(value, problems) {
+	return shape(REPORT)(value, "report", problems);
+}
+function reject(path, expectation, problems) {
+	problems.push(`${path}: expected ${expectation}`);
+	return false;
+}
+/** Validates the declared keys and ignores every other one, which is what lets the report grow. */
+function shape(fields) {
+	return (value, path, problems) => {
+		if (!isRecord(value)) return reject(path, "an object", problems);
+		let valid = true;
+		for (const [key, check] of Object.entries(fields)) valid = check(value[key], `${path}.${key}`, problems) && valid;
+		return valid;
+	};
+}
+function arrayOf(check) {
+	return (value, path, problems) => {
+		if (!Array.isArray(value)) return reject(path, "an array", problems);
+		let valid = true;
+		for (const [index, element] of value.entries()) valid = check(element, `${path}[${String(index)}]`, problems) && valid;
+		return valid;
+	};
+}
+function recordOf(check) {
+	return (value, path, problems) => {
+		if (!isRecord(value)) return reject(path, "an object", problems);
+		let valid = true;
+		for (const [key, entry] of Object.entries(value)) valid = check(entry, `${path}.${key}`, problems) && valid;
+		return valid;
+	};
+}
+function optional(check) {
+	return (value, path, problems) => value === void 0 || check(value, path, problems);
+}
+function oneOf(...allowed) {
+	const expectation = `one of ${allowed.map((option) => JSON.stringify(option)).join(", ")}`;
+	return (value, path, problems) => allowed.some((option) => option === value) || reject(path, expectation, problems);
+}
+const text = (value, path, problems) => typeof value === "string" || reject(path, "a string", problems);
+const boolean = (value, path, problems) => typeof value === "boolean" || reject(path, "a boolean", problems);
+const counter = (value, path, problems) => typeof value === "number" && Number.isInteger(value) && value >= 0 || reject(path, "a count", problems);
+const position = (value, path, problems) => typeof value === "number" && Number.isInteger(value) && value > 0 || reject(path, "a 1-based position", problems);
+const jsonObject = (value, path, problems) => isJsonObject(value) || reject(path, "a JSON object", problems);
+const location = shape({
+	column: optional(position),
+	line: optional(position),
+	path: text
+});
+const findingFields = shape({
+	checkId: text,
+	details: optional(text),
+	findingId: text,
+	fixability: oneOf("auto", "guided", "manual"),
+	locations: optional(arrayOf(location)),
+	message: text,
+	metadata: optional(jsonObject),
+	presentation: optional(shape({
+		columns: arrayOf(shape({
+			align: optional(oneOf("left", "right")),
+			falseLabel: optional(text),
+			format: optional(oneOf("boolean", "integer", "percentage", "text")),
+			heading: text,
+			key: text,
+			trueLabel: optional(text)
+		})),
+		kind: oneOf("metadata-table"),
+		rowsKey: text
+	})),
+	scope: oneOf("global", "project"),
+	severity: oneOf("error", "info", "warn")
+});
+/**
+* A finding, plus the one thing about a metadata table its own shape cannot say.
+*
+* `rowsKey` and every column `key` name something in `metadata`, and a name that matches nothing
+* fails quietly where it is meant to be read: the table vanishes from human output, or a column
+* renders blank down its whole length, while the JSON stays perfectly well-formed. A column that
+* only some rows carry is ordinary — the check that reports one file per row need not give every
+* file every property — so what is demanded here is that each row answer to at least one column.
+*/
+const finding = (value, path, problems) => {
+	const valid = findingFields(value, path, problems);
+	return isRecord(value) ? tableRowsAreReadable(value, path, problems) && valid : valid;
+};
+function tableRowsAreReadable(value, path, problems) {
+	const presentation = value["presentation"];
+	if (!isRecord(presentation) || presentation["kind"] !== "metadata-table") return true;
+	const rowsKey = presentation["rowsKey"];
+	const metadata = value["metadata"];
+	const rows = typeof rowsKey === "string" && isRecord(metadata) ? metadata[rowsKey] : void 0;
+	if (!Array.isArray(rows) || !rows.every(isRecord)) return reject(`${path}.metadata.${typeof rowsKey === "string" ? rowsKey : "?"}`, "an array of objects, because presentation.rowsKey names it", problems);
+	const keys = columnKeys(presentation["columns"]);
+	if (keys.length === 0) return true;
+	return rows.every((row, index) => keys.some((key) => row[key] !== void 0) ? true : reject(`${path}.metadata.${String(rowsKey)}[${String(index)}]`, `a row carrying at least one column key (${keys.join(", ")})`, problems));
+}
+function columnKeys(columns) {
+	if (!Array.isArray(columns)) return [];
+	return columns.flatMap((column) => {
+		const key = isRecord(column) ? column["key"] : void 0;
+		return typeof key === "string" ? [key] : [];
+	});
+}
+const REPORT = {
+	apps: arrayOf(shape({
+		appId: text,
+		detection: shape({
+			authenticated: optional(boolean),
+			installed: boolean,
+			version: optional(text)
+		}),
+		displayName: text,
+		support: optional(shape({
+			status: oneOf("supported", "unknown", "unsupported"),
+			supportedRange: text,
+			version: optional(text)
+		}))
+	})),
+	diagnostics: arrayOf(shape({
+		detail: optional(text),
+		id: text,
+		message: text,
+		path: optional(text),
+		phase: oneOf("check", "detect", "files", "fix", "parse", "read", "support")
+	})),
+	findings: arrayOf(finding),
+	fixes: optional(arrayOf(shape({
+		checkId: text,
+		findingId: text,
+		manualSteps: arrayOf(text),
+		message: optional(text),
+		operations: arrayOf(shape({
+			conflict: optional(text),
+			diff: optional(text),
+			effect: oneOf("archive", "conflict", "create", "move", "noop", "remove", "symlink", "update"),
+			paths: arrayOf(text)
+		})),
+		status: oneOf("applied", "failed", "partial", "planned"),
+		summary: text
+	}))),
+	kind: oneOf("check-report"),
+	passedChecks: arrayOf(shape({
+		id: text,
+		title: text
+	})),
+	schemaVersion: oneOf(1),
+	status: oneOf("clean", "empty", "error", "operational-error", "warning"),
+	summary: shape({
+		categories: recordOf(shape({
+			errors: counter,
+			informational: counter,
+			passed: counter,
+			warnings: counter
+		})),
+		diagnostics: counter,
+		errors: counter,
+		exitCode: oneOf(0, 1, 2, 3),
+		informational: counter,
+		passed: counter,
+		warnings: counter
+	})
+};
+function isJsonObject(value) {
+	return isRecord(value) && Object.values(value).every(isJsonValue);
+}
+function isJsonValue(value) {
+	return value === null || typeof value === "boolean" || typeof value === "number" || typeof value === "string" || Array.isArray(value) && value.every(isJsonValue) || isJsonObject(value);
+}
+//#endregion
+//#region src/run-result.ts
+/** Converts either CLI execution boundary into the testkit's stable result contract. */
+async function collectCheckResult(seed, execute) {
+	const before = await captureFilesystem(seed);
+	const capture = await execute();
+	const normalize = createNormalizer(seed);
+	const spawned = capture.boundary === "spawned";
+	const transcript = {
+		exitCode: capture.exitCode,
+		signal: spawned ? capture.signal : null,
+		stderr: normalize(capture.stderr),
+		stdout: normalize(capture.stdout),
+		timedOutAfterMs: spawned ? capture.timedOutAfterMs : void 0
+	};
+	const exitCode = requireExitCode(transcript);
+	if (capture.boundary === "in-process") requireAppliedExitCode(capture.appliedExitCode, exitCode, transcript);
+	const report = parseReport(transcript.stdout, (message) => runError(message, transcript));
+	if (report.summary.exitCode !== exitCode) throw runError("Check runner saw a report and process with disagreeing exit codes.", transcript);
+	const after = await captureFilesystem(seed);
+	return Object.freeze({
+		diffs: diffFilesystem(before, after, normalize),
+		exitCode,
+		findings: report.findings,
+		report,
+		stderr: transcript.stderr,
+		stdout: transcript.stdout
+	});
+}
+/**
+* Proves the in-process run applied the exit code it returned.
+*
+* Only this boundary can disagree with itself: a child process has one exit status and no second
+* opinion to compare it against.
+*/
+function requireAppliedExitCode(appliedExitCode, exitCode, transcript) {
+	if (appliedExitCode === void 0) throw runError("Check runner never reported the exit code it applied.", transcript);
+	if (appliedExitCode !== exitCode) throw runError("Check runner saw two disagreeing exit codes for one run.", transcript);
+}
+function requireExitCode(transcript) {
+	if (transcript.timedOutAfterMs !== void 0) throw runError(`Check runner killed the run after ${String(transcript.timedOutAfterMs)}ms without an exit.`, transcript);
+	if (transcript.signal !== null) throw runError(`Check runner terminated from signal ${transcript.signal}.`, transcript);
+	if (transcript.exitCode === null) throw runError("Check runner terminated without an exit code.", transcript);
+	if (transcript.exitCode !== 0 && transcript.exitCode !== 1 && transcript.exitCode !== 2 && transcript.exitCode !== 3) throw runError(`Check runner returned unsupported exit code ${String(transcript.exitCode)}.`, transcript);
+	return transcript.exitCode;
+}
+const TRANSCRIPT_LIMIT = 2e3;
+function runError(message, transcript) {
+	return new Error([
+		message,
+		`  exit code: ${describeExit(transcript)}`,
+		`  stdout: ${describeStream(transcript.stdout)}`,
+		`  stderr: ${describeStream(transcript.stderr)}`
+	].join("\n"));
+}
+function describeExit(transcript) {
+	if (transcript.signal !== null) return `signal ${transcript.signal}`;
+	return transcript.exitCode === null ? "<missing>" : String(transcript.exitCode);
+}
+function describeStream(value) {
+	if (value === "") return "<empty>";
+	const trimmed = value.length > TRANSCRIPT_LIMIT ? value.slice(0, TRANSCRIPT_LIMIT) : value;
+	const suffix = value.length > TRANSCRIPT_LIMIT ? "… (truncated)" : "";
+	return `${trimmed.replaceAll("\n", "\n    ")}${suffix}`;
+}
+/** Replaces a seed's machine-specific paths with stable labels, longest path first. */
+function createNormalizer(seed) {
+	const ordered = [...[
+		[seed.homeDir, "<HOME>"],
+		[seed.pathDir, "<PATH>"],
+		[seed.workspaceDir, "<WORKSPACE>"],
+		[dirname(seed.homeDir), "<SEED>"]
+	]].sort((left, right) => right[0].length - left[0].length);
+	return (value) => {
+		let normalized = value;
+		for (const [path, label] of ordered) normalized = normalized.replaceAll(path, label);
+		return normalized;
+	};
+}
+//#endregion
+//#region src/binary-runner.ts
+/**
+* How long a compiled run may take before the runner stops waiting.
+*
+* Generous on purpose: this is the bound that turns a hang into a readable failure, not a budget
+* anyone should be tuning a passing test against.
+*/
+const DEFAULT_TIMEOUT_MS = 3e4;
+/** Flags the runner supplies itself, which a caller repeating would silently duplicate. */
+const RESERVED_FLAGS = /* @__PURE__ */ new Set([
+	"--home",
+	"--json",
+	"--path"
+]);
+/** Runs a compiled Aura distribution's `check --json` command against one deterministic seed. */
+async function runBinaryCheck(options) {
+	if (!isAbsolute(options.binaryPath)) throw new Error(`Compiled binary path must be absolute. Received: ${options.binaryPath}`);
+	rejectReservedFlags(options.args ?? []);
+	return collectCheckResult(options.seed, () => executeBinary(options));
+}
+/**
+* Refuses an argument the runner already passes.
+*
+* Repeating one is not an error the CLI reports — it parses as a second occurrence and quietly wins
+* or loses depending on the flag — so the test that did it would fail somewhere else entirely.
+*/
+function rejectReservedFlags(args) {
+	for (const arg of args) {
+		const [flag] = arg.split("=");
+		if (flag !== void 0 && RESERVED_FLAGS.has(flag)) throw new Error(`Check runner already supplies ${flag}. Remove it from args; the seed decides its value.`);
+	}
+}
+function executeBinary(options) {
+	const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+	return new Promise((resolve, reject) => {
+		try {
+			const child = spawn(options.binaryPath, [
+				"check",
+				"--json",
+				"--home",
+				options.seed.homeDir,
+				"--path",
+				options.seed.pathDir,
+				...options.args ?? []
+			], {
+				cwd: options.seed.workspaceDir,
+				env: {
+					HOME: options.seed.homeDir,
+					NO_COLOR: "1",
+					PATH: options.seed.pathDir
+				},
+				stdio: [
+					"ignore",
+					"pipe",
+					"pipe"
+				]
+			});
+			const stderr = [];
+			const stdout = [];
+			let timedOut = false;
+			const timer = setTimeout(() => {
+				timedOut = true;
+				child.kill("SIGKILL");
+			}, timeoutMs);
+			child.stderr.setEncoding("utf8");
+			child.stdout.setEncoding("utf8");
+			child.stderr.on("data", (chunk) => {
+				stderr.push(chunk);
+			});
+			child.stdout.on("data", (chunk) => {
+				stdout.push(chunk);
+			});
+			child.once("error", (error) => {
+				clearTimeout(timer);
+				reject(new Error(`Could not launch compiled Aura binary: ${error.message}`, { cause: error }));
+			});
+			child.once("close", (exitCode, signal) => {
+				clearTimeout(timer);
+				resolve({
+					boundary: "spawned",
+					exitCode,
+					signal,
+					stderr: stderr.join(""),
+					stdout: stdout.join(""),
+					...timedOut ? { timedOutAfterMs: timeoutMs } : {}
+				});
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			reject(new Error(`Could not launch compiled Aura binary: ${message}`, { cause: error }));
+		}
+	});
+}
+//#endregion
+//#region ../core/src/http.ts
+/**
+* Hosts allowed to serve plain `http:`.
+*
+* Literal loopback addresses only: `localhost` can resolve anywhere the resolver decides, so a
+* credential sent to it could still leave the machine.
+*/
+const LOOPBACK_HOSTS$1 = ["127.0.0.1", "[::1]"];
+/**
+* Creates {@link Environment.httpGet}: a bounded, TLS-only GET that never rejects.
+*
+* Redirects are refused (`redirect: "error"`) so a directory cannot bounce a bearer token to an
+* address the caller never named. The response body is streamed against the byte cap rather than
+* buffered first, so an oversized body is abandoned mid-transfer.
+*/
+function createHttpGet() {
+	return async (request) => {
+		const vetted = vetHttpUrl(request.url);
+		if (!(vetted instanceof URL)) return {
+			kind: "failure",
+			reason: vetted
+		};
+		const maxBytes = clamp(request.maxResponseBytes, MAX_HTTP_RESPONSE_BYTES, MAX_HTTP_RESPONSE_BYTES);
+		try {
+			return await readBody(await fetch(vetted, {
+				headers: request.headers ?? {},
+				method: "GET",
+				redirect: "error",
+				signal: AbortSignal.timeout(clampHttpTimeout(request.timeoutMs))
+			}), maxBytes, request.responseType === "bytes");
+		} catch (error) {
+			return {
+				kind: "failure",
+				reason: failureReason(error)
+			};
+		}
+	};
+}
+/** Parses a URL and applies the TLS-only rule, collapsing both refusals into failure reasons. */
+function vetHttpUrl(raw) {
+	let url;
+	try {
+		url = new URL(raw);
+	} catch {
+		return "invalid-url";
+	}
+	return isAllowedHttpUrl(url) ? url : "insecure-url";
+}
+/** Applies the shared timeout default and ceiling every HTTP client in the kernel honors. */
+function clampHttpTimeout(value) {
+	return clamp(value, DEFAULT_HTTP_TIMEOUT_MS, MAX_HTTP_TIMEOUT_MS);
+}
+/** Replaces an absent, zero, negative, or non-finite value by the default; caps at the ceiling. */
+function clamp(value, fallback, ceiling) {
+	if (value === void 0 || !Number.isFinite(value) || value <= 0) return fallback;
+	return Math.min(value, ceiling);
+}
+function isLoopbackHttp(url) {
+	return url.protocol === "http:" && LOOPBACK_HOSTS$1.includes(url.hostname);
+}
+/**
+* Whether a parsed URL satisfies the TLS rule {@link createHttpGet} enforces.
+*
+* Exposed so configuration that carries a URL — a registered skill directory, a preset entry — can
+* be refused at validation time with a named problem instead of failing later mid-request.
+*/
+function isAllowedHttpUrl(url) {
+	return url.protocol === "https:" || isLoopbackHttp(url);
+}
+/** Streams the body against the byte cap; decoding happens only once the cap is known to hold. */
+async function readBody(response, maxBytes, binary) {
+	const reader = response.body?.getReader();
+	if (reader === void 0) return binary ? {
+		body: /* @__PURE__ */ new Uint8Array(),
+		kind: "binary-response",
+		status: response.status
+	} : {
+		body: "",
+		kind: "response",
+		status: response.status
+	};
+	const chunks = [];
+	let received = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		received += value.byteLength;
+		if (received > maxBytes) {
+			await reader.cancel();
+			return {
+				kind: "failure",
+				reason: "response-too-large"
+			};
+		}
+		chunks.push(value);
+	}
+	const body = concatenate(chunks, received);
+	return binary ? {
+		body,
+		kind: "binary-response",
+		status: response.status
+	} : {
+		body: new TextDecoder().decode(body),
+		kind: "response",
+		status: response.status
+	};
+}
+function concatenate(chunks, length) {
+	const joined = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		joined.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return joined;
+}
+/**
+* Collapses every throw into the closed failure vocabulary.
+*
+* Error text is deliberately dropped: runtime messages can echo the request, and the request may
+* carry credentials in its headers.
+*/
+function failureReason(error) {
+	const name = error instanceof Error ? error.name : "";
+	return name === "TimeoutError" || name === "AbortError" ? "timeout" : "network";
+}
+//#endregion
+//#region src/http.ts
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["127.0.0.1", "[::1]"]);
+const realHttpGet = createHttpGet();
+/**
+* The network policy every testkit runner injects: loopback servers only.
+*
+* A test run is hermetic by construction — a distribution that registers a real skill directory
+* must not make its integration tests reach that host. Mock servers listen on `127.0.0.1`, which
+* this passes straight through to the kernel's own client, caps and all.
+*/
+const loopbackOnlyHttpGet = (request) => {
+	let url;
+	try {
+		url = new URL(request.url);
+	} catch {
+		return Promise.resolve({
+			kind: "failure",
+			reason: "invalid-url"
+		});
+	}
+	if (!LOOPBACK_HOSTS.has(url.hostname)) return Promise.resolve({
+		kind: "failure",
+		reason: "network"
+	});
+	return realHttpGet(request);
+};
+//#endregion
+//#region src/text-capture.ts
+/** A writable stream that accumulates everything written to it as text. */
+function createTextCapture() {
+	const chunks = [];
+	const stream = new PassThrough();
+	stream.setEncoding("utf8");
+	stream.on("data", (chunk) => {
+		chunks.push(chunk);
+	});
+	return {
+		read: () => chunks.join(""),
+		stream
+	};
+}
+//#endregion
+//#region src/runner.ts
+/** Runs `check --json` without reading process state and returns snapshot-ready output. */
+async function runCheck(options) {
+	return collectCheckResult(options.seed, async () => {
+		const stderr = createTextCapture();
+		const stdout = createTextCapture();
+		let appliedExitCode;
+		const exitCode = await runCli(options.distro, {
+			argv: [
+				"check",
+				"--json",
+				...options.args ?? []
+			],
+			colorDepth: 0,
+			cwd: options.seed.workspaceDir,
+			environmentVariables: { PATH: options.seed.pathDir },
+			homeDir: options.seed.homeDir,
+			httpGet: loopbackOnlyHttpGet,
+			setExitCode: (code) => {
+				appliedExitCode = code;
+			},
+			stderr: stderr.stream,
+			stdin: Readable.from([]),
+			stdout: stdout.stream
+		});
+		return {
+			appliedExitCode,
+			boundary: "in-process",
+			exitCode,
+			stderr: stderr.read(),
+			stdout: stdout.read()
+		};
+	});
+}
+//#endregion
+//#region src/setup-runner.ts
+/**
+* Runs `setup --yes` in-process against a seed and returns snapshot-ready output.
+*
+* `--yes` because this boundary has no terminal: every question resolves to the default the wizard
+* would have proposed, which is exactly what the acceptance tests need to prove about converge and
+* end-on-green behaviour. Interactive keypress flows are covered by the CLI's own engine tests.
+*/
+async function runSetup(options) {
+	const before = await captureFilesystem(options.seed);
+	const stderr = createTextCapture();
+	const stdout = createTextCapture();
+	let exitCode = -1;
+	await runCli(options.distro, {
+		argv: [
+			"setup",
+			"--yes",
+			...options.args ?? []
+		],
+		colorDepth: 0,
+		cwd: options.seed.workspaceDir,
+		environmentVariables: {
+			...options.environmentVariables,
+			PATH: options.seed.pathDir
+		},
+		homeDir: options.seed.homeDir,
+		httpGet: loopbackOnlyHttpGet,
+		setExitCode: (code) => {
+			exitCode = code;
+		},
+		stderr: stderr.stream,
+		stdin: Readable.from([]),
+		stdout: stdout.stream
+	});
+	const normalize = createNormalizer(options.seed);
+	const after = await captureFilesystem(options.seed);
+	return Object.freeze({
+		diffs: diffFilesystem(before, after, normalize),
+		exitCode,
+		stderr: normalize(stderr.read()),
+		stdout: normalize(stdout.read())
+	});
+}
+//#endregion
+//#region src/convergence.ts
+const JOURNAL_ENTRY = /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}Z(?:-\d{4})?$/u;
+const CONVERGED_MARKERS = ["Already converged — nothing to do.", "Nothing to fix."];
+/**
+* Runs one converge boundary twice and proves the second pass had no work to plan or journal.
+*
+* Throws framework-independent errors so distributions can use this helper from any test runner.
+*/
+async function expectConvergedTwice(seed, run) {
+	const first = await run();
+	requireSuccessful("first", first);
+	const afterFirst = await captureFilesystem(seed);
+	const journalAfterFirst = await journalEntries(seed);
+	const second = await run();
+	requireSuccessful("second", second);
+	const transcript = `${second.stdout}\n${second.stderr}`;
+	if (!CONVERGED_MARKERS.some((marker) => transcript.includes(marker))) throw convergenceError("second run did not report that it was already converged", second);
+	if (transcript.includes("Applied ")) throw convergenceError("second run reported applied operations", second);
+	const reportedDiffs = second.diffs.filter((diff) => !isJournalPath(diff.path));
+	if (reportedDiffs.length > 0) throw convergenceError(`second run reported ${String(reportedDiffs.length)} filesystem diff(s): ${reportedDiffs.map((diff) => diff.path).join(", ")}`, second);
+	const snapshotDiffs = diffFilesystem(afterFirst, await captureFilesystem(seed), (value) => value).filter((diff) => !isJournalPath(diff.path));
+	if (snapshotDiffs.length > 0) throw convergenceError(`second run changed ${String(snapshotDiffs.length)} captured path(s): ${snapshotDiffs.map((diff) => diff.path).join(", ")}`, second);
+	if ((await journalEntries(seed)).join("\n") !== journalAfterFirst.join("\n")) throw convergenceError("second run changed the undo journal entries", second);
+	return Object.freeze({
+		first,
+		second
+	});
+}
+/**
+* Whether a path belongs to the undo journal rather than to the state being converged.
+*
+* The journal is where a run records what it replaced, and it holds the target-lock directory a run
+* touches whether or not it writes anything. Convergence is a claim about the machine's
+* configuration, so journal paths are excluded here and asserted separately, by entry name.
+*/
+function isJournalPath(path) {
+	return path.includes("/.backups/") || path.endsWith("/.backups");
+}
+function requireSuccessful(label, result) {
+	if (result.exitCode !== 0) throw convergenceError(`${label} run exited with ${String(result.exitCode)}`, result);
+}
+async function journalEntries(seed) {
+	try {
+		return (await readdir(join(seed.homeDir, "agents", ".backups"))).filter((name) => JOURNAL_ENTRY.test(name)).sort();
+	} catch (error) {
+		if (errorCode(error) === "ENOENT") return [];
+		throw error;
+	}
+}
+function errorCode(error) {
+	if (typeof error !== "object" || error === null || !("code" in error)) return;
+	const code = error.code;
+	return typeof code === "string" ? code : void 0;
+}
+function convergenceError(message, result) {
+	return new Error([
+		`Expected converge-twice invariant: ${message}.`,
+		`  stdout: ${result.stdout === "" ? "<empty>" : result.stdout}`,
+		`  stderr: ${result.stderr === "" ? "<empty>" : result.stderr}`
+	].join("\n"));
+}
+//#endregion
+//#region src/types.ts
+/**
+* Matches any single argument in that position.
+*
+* Arity still has to match, so a response stays an exact description of one shape of invocation —
+* this only frees the positions whose value a test cannot predict, such as a temporary path.
+*/
+const ANY_ARGUMENT = Symbol("aura-testkit.anyArgument");
+//#endregion
+//#region src/shims.ts
+const COMMAND_NAME = /^[A-Za-z0-9._+-]+$/u;
+const RESERVED_NAMES = /* @__PURE__ */ new Set([".", ".."]);
+async function writeShim(options) {
+	const { command, logDir, pathDir, responses } = options;
+	validateShim(command, responses);
+	const path = join(pathDir, command);
+	await writeFile(path, renderShim(command, join(logDir, command), responses), "utf8");
+	await chmod(path, 493);
+}
+/**
+* Reads back every invocation one shim recorded.
+*
+* The log frames each record as its argument count followed by that many arguments, all
+* NUL-terminated. Arguments cannot contain NUL — {@link validateShim} rejects that — so the framing
+* stays unambiguous for empty arguments and for arguments holding newlines.
+*/
+async function readInvocations(logDir, command) {
+	if (!isPortableCommandName(command)) return [];
+	let log;
+	try {
+		log = await readFile(join(logDir, command), "utf8");
+	} catch (error) {
+		if (isNotFound(error)) return [];
+		throw error;
+	}
+	const fields = log.split("\0");
+	fields.pop();
+	const invocations = [];
+	let cursor = 0;
+	while (cursor < fields.length) {
+		const count = Number(fields[cursor]);
+		if (!Number.isInteger(count) || count < 0 || cursor + 1 + count > fields.length) throw new Error(`Shim ${command} wrote an invocation log this runner cannot read.`);
+		invocations.push(Object.freeze(fields.slice(cursor + 1, cursor + 1 + count)));
+		cursor += 1 + count;
+	}
+	return Object.freeze(invocations);
+}
+function validateShim(command, responses) {
+	if (!isPortableCommandName(command)) throw new Error(`Shim command must be a portable executable name. Received: ${command}`);
+	if (responses.length === 0) throw new Error(`Shim ${command} must declare at least one response.`);
+	const invocations = /* @__PURE__ */ new Set();
+	for (const response of responses) {
+		const key = describeArgs(response.args);
+		if (invocations.has(key)) throw new Error(`Shim ${command} declares the same arguments more than once: ${key}`);
+		invocations.add(key);
+		validateResponse(command, response);
+	}
+}
+/** The name has to be a single path segment: `.` and `..` pass the character test but are not. */
+function isPortableCommandName(command) {
+	return COMMAND_NAME.test(command) && !RESERVED_NAMES.has(command);
+}
+function describeArgs(args) {
+	return JSON.stringify(args.map((argument) => isAnyArgument(argument) ? null : argument));
+}
+function isAnyArgument(argument) {
+	return argument === ANY_ARGUMENT;
+}
+function validateResponse(command, response) {
+	const exitCode = response.exitCode ?? 0;
+	if (!Number.isInteger(exitCode) || exitCode < 0 || exitCode > 255) throw new Error(`Shim ${command} exit code must be an integer from 0 to 255.`);
+	const literals = response.args.filter((argument) => !isAnyArgument(argument));
+	for (const value of [
+		command,
+		...literals,
+		response.stdout ?? "",
+		response.stderr ?? ""
+	]) if (value.includes("\0")) throw new Error(`Shim ${command} values cannot contain a NUL character.`);
+}
+function renderShim(command, logPath, responses) {
+	return [
+		"#!/bin/sh",
+		"{",
+		`  printf '%s\\0' "$#"`,
+		"  for aura_recorded in \"$@\"; do",
+		`    printf '%s\\0' "$aura_recorded"`,
+		"  done",
+		`} >> ${shellQuote(logPath)}`,
+		...responses.map(renderResponse),
+		`printf '%s' ${shellQuote(`aura-testkit: unmatched invocation: ${command}`)} >&2`,
+		"for aura_reported in \"$@\"; do",
+		"  printf \" %s\" \"$aura_reported\" >&2",
+		"done",
+		"printf '\\n' >&2",
+		"exit 2",
+		""
+	].join("\n");
+}
+function renderResponse(response) {
+	return [
+		`if ${[`[ "$#" -eq ${String(response.args.length)} ]`, ...response.args.flatMap((argument, index) => isAnyArgument(argument) ? [] : [`[ "$${String(index + 1)}" = ${shellQuote(argument)} ]`])].join(" && ")}; then`,
+		...response.stdout === void 0 ? [] : [`  printf '%s' ${shellQuote(response.stdout)}`],
+		...response.stderr === void 0 ? [] : [`  printf '%s' ${shellQuote(response.stderr)} >&2`],
+		`  exit ${String(response.exitCode ?? 0)}`,
+		"fi"
+	].join("\n");
+}
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+function isNotFound(error) {
+	return isRecord(error) && error["code"] === "ENOENT";
+}
+//#endregion
+//#region src/seed.ts
+var SeedBuilder = class {
+	#homeFiles = /* @__PURE__ */ new Map();
+	#shims = /* @__PURE__ */ new Map();
+	#workspaceFiles = /* @__PURE__ */ new Map();
+	homeFile(path, content) {
+		addFile(this.#homeFiles, "HOME", path, content);
+		return this;
+	}
+	shim(command, responses) {
+		validateShim(command, responses);
+		if (this.#shims.has(command)) throw new Error(`Shim command is already seeded: ${command}`);
+		this.#shims.set(command, {
+			command,
+			responses: responses.map((response) => ({
+				...response,
+				args: [...response.args]
+			}))
+		});
+		return this;
+	}
+	workspaceFile(path, content) {
+		addFile(this.#workspaceFiles, "workspace", path, content);
+		return this;
+	}
+	async build() {
+		const root = await realpath(await mkdtemp(join(tmpdir(), "aura-testkit-")));
+		const homeDir = join(root, "home");
+		const logDir = join(root, "invocations");
+		const pathDir = join(root, "bin");
+		const workspaceDir = join(root, "workspace");
+		const commands = new Set(this.#shims.keys());
+		try {
+			await Promise.all([
+				mkdir(homeDir, { recursive: true }),
+				mkdir(logDir, { recursive: true }),
+				mkdir(pathDir, { recursive: true }),
+				mkdir(workspaceDir, { recursive: true })
+			]);
+			const roots = {
+				homeDir,
+				workspaceDir
+			};
+			await Promise.all([writeFiles(homeDir, this.#homeFiles.values(), roots), writeFiles(workspaceDir, this.#workspaceFiles.values(), roots)]);
+			await Promise.all([...this.#shims.values()].map((shim) => writeShim({
+				command: shim.command,
+				logDir,
+				pathDir,
+				responses: shim.responses
+			})));
+		} catch (error) {
+			await rm(root, {
+				force: true,
+				recursive: true
+			});
+			throw error;
+		}
+		let cleanupPromise;
+		const cleanup = () => {
+			cleanupPromise ??= rm(root, {
+				force: true,
+				recursive: true
+			});
+			return cleanupPromise;
+		};
+		return Object.freeze({
+			cleanup,
+			homeDir,
+			invocations: (command) => commands.has(command) ? readInvocations(logDir, command) : Promise.resolve([]),
+			pathDir,
+			workspaceDir,
+			[Symbol.asyncDispose]: cleanup
+		});
+	}
+};
+/** Starts a fluent description of one isolated fake machine. */
+function createSeedBuilder() {
+	return new SeedBuilder();
+}
+function addFile(files, scope, path, content) {
+	const normalized = normalizeSeedPath(path);
+	if (files.has(normalized)) throw new Error(`${scope} file is already seeded: ${normalized}`);
+	files.set(normalized, {
+		content,
+		path: normalized
+	});
+}
+function normalizeSeedPath(path) {
+	if (path.length === 0 || path.includes("\0") || isAbsolute(path)) throw new Error(`Seed file path must be a non-empty relative path. Received: ${path}`);
+	const normalized = normalize(path);
+	if (normalized === "." || normalized === ".." || normalized.startsWith(`..${sep}`)) throw new Error(`Seed file path must stay inside its root. Received: ${path}`);
+	return normalized;
+}
+/**
+* Materializes one root's files, resolving any content declared as a function of the roots.
+*
+* Sequential on purpose: two declared paths can disagree about whether a name is a file or a
+* directory, and writing them in declaration order makes which one fails deterministic.
+*/
+async function writeFiles(root, files, roots) {
+	for (const file of files) {
+		const destination = join(root, file.path);
+		const fromRoot = relative(root, destination);
+		if (fromRoot === ".." || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) throw new Error(`Seed file escaped its root: ${file.path}`);
+		const content = typeof file.content === "string" ? file.content : file.content(roots);
+		await mkdir(dirname(destination), { recursive: true });
+		await writeFile(destination, content, "utf8");
+	}
+}
+//#endregion
+//#region src/mock-directory.ts
+/** A local `node:http` skill directory speaking the standard protocol, one call per scenario. */
+function createMockDirectoryBuilder() {
+	const listings = [];
+	const files = /* @__PURE__ */ new Map();
+	const payloads = /* @__PURE__ */ new Map();
+	let requiredToken;
+	const builder = {
+		build: () => start(listings, files, payloads, requiredToken),
+		payloadBytes: (skillId, bytes) => {
+			payloads.set(skillId, bytes);
+			return builder;
+		},
+		rawFileEntry: (skillId, entry) => {
+			const existing = files.get(skillId) ?? [];
+			existing.push(entry);
+			files.set(skillId, existing);
+			return builder;
+		},
+		requireToken: (token) => {
+			requiredToken = token;
+			return builder;
+		},
+		skill: (listing, skillFiles) => {
+			listings.push(listing);
+			const existing = files.get(listing.id) ?? [];
+			existing.push(...skillFiles);
+			files.set(listing.id, existing);
+			return builder;
+		}
+	};
+	return builder;
+}
+async function start(listings, files, payloads, requiredToken) {
+	const requests = [];
+	const server = createServer((request, response) => {
+		requests.push({
+			authorization: request.headers.authorization,
+			method: request.method ?? "",
+			path: request.url ?? ""
+		});
+		respond(request, response, listings, files, payloads, requiredToken);
+	});
+	await new Promise((resolve) => {
+		server.listen(0, "127.0.0.1", resolve);
+	});
+	const address = server.address();
+	const close = () => new Promise((resolve, reject) => {
+		server.close((error) => error === void 0 ? resolve() : reject(error));
+	});
+	return {
+		close,
+		requests,
+		url: `http://127.0.0.1:${String(address.port)}`,
+		[Symbol.asyncDispose]: close
+	};
+}
+function respond(request, response, listings, files, payloads, requiredToken) {
+	if (requiredToken !== void 0 && request.headers.authorization !== `Bearer ${requiredToken}`) {
+		response.writeHead(401, { "content-type": "text/plain" });
+		response.end("unauthorized");
+		return;
+	}
+	const body = request.url === "/index.json" ? JSON.stringify(listings) : skillBody(request.url, listings, files, payloads);
+	if (body === void 0) {
+		response.writeHead(404, { "content-type": "text/plain" });
+		response.end("not found");
+		return;
+	}
+	response.writeHead(200, { "content-type": "application/json" });
+	response.end(body);
+}
+/** The content response for a `/skills/<id>` path, or nothing when the path names no skill. */
+function skillBody(url, listings, files, payloads) {
+	if (url?.startsWith("/skills/") !== true) return;
+	const skillId = url.slice(8);
+	const payload = payloads.get(skillId);
+	if (payload !== void 0) return "x".repeat(payload);
+	const listing = listings.find((candidate) => candidate.id === skillId);
+	if (listing === void 0) return;
+	return JSON.stringify({
+		...listing,
+		files: files.get(skillId) ?? []
+	});
+}
+//#endregion
+//#region src/fixtures/claude-code.ts
+/** The `claude` executable's answers, for composing multi-app seeds on one builder. */
+function claudeCodeShimResponses(options) {
+	return [{
+		args: ["--version"],
+		stdout: `${options.version} (Claude Code)\n`
+	}, {
+		args: ["auth", "status"],
+		exitCode: options.authenticated ? 0 : 1,
+		stdout: JSON.stringify({ loggedIn: options.authenticated }) + "\n"
+	}];
+}
+/** Builds documented Claude Code global and project configuration against an exact CLI version. */
+function createClaudeCodeSeed(options) {
+	return createSeedBuilder().homeFile(".claude/CLAUDE.md", [
+		"# Global Claude Code instructions",
+		"",
+		"@~/agents/AGENTS.md",
+		"See @team.md for team-specific details.",
+		"Ask @alice about @tryaura/core; neither is an import.",
+		"Keep `@literal.md` as an example.",
+		"```md",
+		"@fenced.md",
+		"```",
+		""
+	].join("\n")).homeFile(".claude/team.md", "# Team instructions\n").homeFile(".claude/settings.json", "{\"permissions\":{\"allow\":[\"Bash(pnpm test)\"]}}\n").homeFile("agents/AGENTS.md", "# Shared agent instructions\n").homeFile(".claude.json", ({ workspaceDir }) => claudeConfiguration(workspaceDir, options.inlineSecrets !== false)).workspaceFile("CLAUDE.md", [
+		"# Project Claude Code instructions",
+		"",
+		"@./docs/project.md",
+		"@~/agents/AGENTS.md",
+		""
+	].join("\n")).workspaceFile("docs/project.md", "# Project-specific instructions\n").workspaceFile(".mcp.json", JSON.stringify({ mcpServers: { projectDocs: {
+		args: ["--project"],
+		command: "project-docs-server",
+		env: { PROJECT_TOKEN: "${PROJECT_TOKEN}" }
+	} } }, void 0, 2) + "\n").shim("claude", claudeCodeShimResponses(options)).shim("npx", [{ args: [] }]).shim("project-docs-server", [{ args: [] }]).build();
+}
+function claudeConfiguration(workspaceDir, inlineSecrets) {
+	return JSON.stringify({
+		mcpServers: {
+			docs: {
+				args: ["-y", "@example/docs-mcp"],
+				command: "npx",
+				env: { DOCS_TOKEN: "${DOCS_TOKEN}" }
+			},
+			legacy: {
+				args: [
+					"@example/legacy-mcp",
+					"--api-key",
+					inlineSecrets ? "sk-fixture-secret" : "${LEGACY_TOKEN}"
+				],
+				command: "npx"
+			},
+			sentry: {
+				headers: { Authorization: "Bearer ${SENTRY_TOKEN}" },
+				type: "http",
+				url: "https://mcp.sentry.dev"
+			},
+			streaming: {
+				type: "sse",
+				url: `https://sse.example.com/mcp?token=${inlineSecrets ? "sk-fixture-secret" : "${STREAMING_TOKEN}"}`
+			}
+		},
+		projects: {
+			"/unrelated/project": { mcpServers: { ignored: { command: "ignored" } } },
+			[workspaceDir]: { mcpServers: { local: {
+				headers: { Authorization: "Bearer ${LOCAL_TOKEN}" },
+				type: "http",
+				url: `https://local.example.com/mcp?token=${inlineSecrets ? "sk-local-secret" : "${LOCAL_URL_TOKEN}"}`
+			} } }
+		}
+	}, void 0, 2) + "\n";
+}
+//#endregion
+//#region src/fixtures/codex.ts
+/** Workspace-relative directory the `"nested"` layout puts its second `AGENTS.md` in. */
+const CODEX_NESTED_PACKAGE = "packages/app";
+/** The `codex` executable's answers, for composing multi-app seeds on one builder. */
+function codexShimResponses(options) {
+	return [{
+		args: ["--version"],
+		stdout: `codex-cli ${options.version}\n`
+	}, {
+		args: ["login", "status"],
+		exitCode: options.authenticated ? 0 : 1,
+		stdout: options.authenticated ? "Logged in using ChatGPT\n" : "Not logged in\n"
+	}];
+}
+/** Builds one documented Codex configuration against an exact CLI version. */
+function createCodexSeed(options) {
+	let builder = createSeedBuilder().homeFile(".codex/AGENTS.md", [
+		"# Global Codex instructions",
+		"",
+		"Follow the shared Aura instructions.",
+		""
+	].join("\n")).homeFile(".codex/config.toml", ({ workspaceDir }) => codexConfiguration(workspaceDir, options.projectTrust)).homeFile("agents/AGENTS.md", "# Shared agent instructions\n").shim("codex", codexShimResponses(options));
+	if (options.projectInstructions !== void 0) builder = builder.workspaceFile("AGENTS.md", instructions("Project"));
+	if (options.projectInstructions === "override") builder = builder.workspaceFile("AGENTS.override.md", instructions("Project override"));
+	if (options.projectInstructions === "nested") builder = builder.workspaceFile(".git", "gitdir: /dev/null\n").workspaceFile(`${CODEX_NESTED_PACKAGE}/AGENTS.md`, instructions("Package"));
+	return builder.build();
+}
+function instructions(title) {
+	return [
+		`# ${title} Codex instructions`,
+		"",
+		`Prefer the ${title.toLowerCase()} conventions.`,
+		""
+	].join("\n");
+}
+function codexConfiguration(workspaceDir, trust) {
+	return [
+		"model = \"gpt-5\"",
+		"",
+		...trust === void 0 ? [] : [
+			`[projects.${JSON.stringify(workspaceDir)}]`,
+			`trust_level = "${trust}"`,
+			""
+		],
+		"[mcp_servers.docs]",
+		"command = \"npx\"",
+		"args = [\"-y\", \"@example/docs-mcp\"]",
+		"env = { DOCS_TOKEN = \"inline-fixture-secret\" }",
+		"env_vars = [\"LOCAL_TOKEN\", { name = \"REMOTE_TOKEN\", source = \"remote\" }]",
+		"",
+		"[mcp_servers.legacy]",
+		"command = \"npx\"",
+		"args = [\"@example/legacy-mcp\", \"--api-key\", \"sk-fixture-secret\"]",
+		"",
+		"[mcp_servers.sentry]",
+		"url = \"https://mcp.sentry.dev/mcp?token=sk-fixture-secret\"",
+		"bearer_token_env_var = \"SENTRY_TOKEN\"",
+		"http_headers = { \"X-Static\" = \"inline-fixture-secret\" }",
+		"env_http_headers = { Authorization = \"AUTH_TOKEN\" }",
+		"",
+		"[mcp_servers.disabled]",
+		"command = \"ignored\"",
+		"enabled = false",
+		""
+	].join("\n");
+}
+//#endregion
+//#region src/fixtures/cursor.ts
+/** The `cursor` executable's answers, for composing multi-app seeds on one builder. */
+function cursorShimResponses(options) {
+	return [{
+		args: ["--version"],
+		stdout: `${options.version}\nfixture-commit\narm64\n`
+	}];
+}
+/** Builds documented Cursor rule and MCP configuration against an exact editor version. */
+function createCursorSeed(options) {
+	let builder = createSeedBuilder().homeFile(".cursor/mcp.json", JSON.stringify({ mcpServers: { docs: {
+		args: ["-y", "@example/docs-mcp"],
+		command: "npx",
+		env: { DOCS_TOKEN: "${env:DOCS_TOKEN}" }
+	} } }, void 0, 2) + "\n").workspaceFile(".cursor/mcp.json", JSON.stringify({ mcpServers: { sentry: {
+		headers: { Authorization: "Bearer ${env:SENTRY_TOKEN}" },
+		url: "https://mcp.sentry.dev/mcp?token=sk-fixture-secret"
+	} } }, void 0, 2) + "\n").shim("cursor", cursorShimResponses(options));
+	if (options.rules === "legacy") builder = builder.workspaceFile(".cursorrules", "# Legacy Cursor instructions\n\nUse the repository conventions.\n").workspaceFile(".cursor/rules/ignored.md", "# Not a Cursor project rule\n");
+	else builder = builder.workspaceFile("AGENTS.md", "# Project agents guide\n\nFollow the workspace conventions.\n").workspaceFile(".cursor/rules/project.mdc", "---\nalwaysApply: true\n---\n\nUse @project-template.ts.\n").workspaceFile(".cursor/rules/project-template.ts", "export const template = true;\n").workspaceFile(".cursor/rules/backend/database.mdc", "---\ndescription: Database conventions\nalwaysApply: false\n---\n\nRead @schema.sql.\n").workspaceFile(".cursor/rules/backend/schema.sql", "select 1;\n").workspaceFile(".cursor/rules/ignored.md", "# Not a Cursor project rule\n");
+	return builder.build();
+}
+//#endregion
+export { ANY_ARGUMENT, CODEX_NESTED_PACKAGE, captureFilesystem, claudeCodeShimResponses, codexShimResponses, createClaudeCodeSeed, createCodexSeed, createCursorSeed, createMockDirectoryBuilder, createSeedBuilder, cursorShimResponses, expectConvergedTwice, loopbackOnlyHttpGet, runBinaryCheck, runCheck, runSetup };