simulci 0.1.0 → 0.2.0

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from "node:module";
-import { basename, dirname, isAbsolute, join, posix, relative, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { parseArgs } from "node:util";
 //#region \0rolldown/runtime.js
@@ -1122,7 +1122,7 @@ var Parser = class {
 	}
 };
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/expressions.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/expressions.ts
 /** Every named context the GitHub Actions runtime knows about. */
 const KNOWN_CONTEXTS = [
 	"github",
@@ -1667,7 +1667,7 @@ function evaluateTemplate(text, resolve, options = {}) {
 	return known$2(out, mergeTaint(...parts));
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/ir.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/ir.ts
 /** Case-insensitive lookup of an own key, matching how GitHub resolves context property names. */
 function lookup(rec, key) {
 	if (Object.hasOwn(rec, key)) return rec[key];
@@ -1896,7 +1896,7 @@ function matrixResolver(combo) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/checks.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/checks.ts
 /**
 * Check-run names of jobs, as GitHub reports them (and as branch protection requires them).
 *
@@ -2029,7 +2029,7 @@ function skippedCheckName(job) {
 	return kind.kind === "static" ? kind.text || job.id : kind.template.trim();
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/text.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/text.ts
 /**
 * `s` without runs of `ch` at its end (and at its start with `start: true`). A loop rather than `/x+$/`, which
 * backtracks quadratically on long runs that are not at the end (CodeQL js/polynomial-redos).
@@ -2066,7 +2066,7 @@ function didYouMean(name, candidates) {
 	return best.d <= Math.max(2, Math.floor(name.length / 3)) ? best.c : void 0;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/glob.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/glob.ts
 /** Minimal glob: `*` matches within a segment, `**` across segments; plain strings match as path prefixes. */
 function matchesPattern(path, pattern) {
 	if (!pattern.includes("*")) return path === pattern || path.startsWith(pattern.endsWith("/") ? pattern : `${pattern}/`);
@@ -2074,7 +2074,7 @@ function matchesPattern(path, pattern) {
 }
 const escapeRe = (s) => s.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/queries.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/queries.ts
 /** Every reference in a unit's expressions, with the site it is in. */
 function* refsOf(unit) {
 	for (const site of unit.sites) for (const seg of site.segments) for (const ref of seg.refs) yield {
@@ -2085,7 +2085,7 @@ function* refsOf(unit) {
 /** Secrets every workflow can read without declaring them (lowercase): the automatic `GITHUB_TOKEN`. */
 const BUILTIN_SECRETS = /* @__PURE__ */ new Set(["github_token"]);
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/graph.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/graph.ts
 /** A path segment that names no key: the end of the path, a `*` filter or a `?` computed index. */
 const computed = (s) => s === void 0 || s === "*" || s === "?";
 /** Whether a path segment names the property `key` (lowercase): GitHub looks properties up ignoring case. */
@@ -9491,7 +9491,7 @@ var require_public_api = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.stringify = stringify;
 }));
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/source.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/source.ts
 var import_dist = (/* @__PURE__ */ __commonJSMin(((exports) => {
 	var composer = require_composer();
 	var Document = require_Document();
@@ -9566,7 +9566,7 @@ function formatLoc(loc) {
 	return `${loc.file}:${loc.line}:${loc.column}`;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/logger.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/logger.ts
 const ORDER = {
 	silent: 0,
 	error: 1,
@@ -9631,7 +9631,45 @@ function createLogger(options = {}) {
 }
 const silentLogger = createLogger({ level: "silent" });
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/parse.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/posix.ts
+/**
+* POSIX path arithmetic for repository-relative paths, with Node's `path.posix` semantics for what the parser and the
+* loader need, so the browser entry carries no `node:path`.
+*/
+const posixIsAbsolute = (path) => path.startsWith("/");
+/** `a/./b/../c` → `a/c`, `` → `.`, `/..` → `/`; a trailing slash is kept, as `path.posix.normalize` keeps it. */
+function posixNormalize(path) {
+	if (path === "") return ".";
+	const absolute = path.startsWith("/");
+	const trailing = path.endsWith("/");
+	const out = [];
+	for (const segment of path.split("/")) step(out, segment, absolute);
+	if (out.length === 0) return absolute ? "/" : trailing ? "./" : ".";
+	return `${absolute ? "/" : ""}${out.join("/")}${trailing ? "/" : ""}`;
+}
+/** One segment onto the normalized path: `.` and empty ones vanish, `..` pops (or stays, when relative and nothing is above). */
+function step(out, segment, absolute) {
+	if (segment === "" || segment === ".") return;
+	if (segment !== "..") {
+		out.push(segment);
+		return;
+	}
+	if (out.length && out.at(-1) !== "..") out.pop();
+	else if (!absolute) out.push("..");
+}
+/** The non-empty parts joined and normalized; `.` when there is nothing. */
+function posixJoin(...parts) {
+	const joined = parts.filter((p) => p !== "").join("/");
+	return joined === "" ? "." : posixNormalize(joined);
+}
+/** The last segment, trailing slashes ignored; `` for `/` and ``. */
+function posixBasename(path) {
+	const trimmed = path.replace(/\/+$/, "");
+	const i = trimmed.lastIndexOf("/");
+	return i === -1 ? trimmed : trimmed.slice(i + 1);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/parse.ts
 function createParseContext(repository) {
 	let id = 0;
 	return {
@@ -10249,7 +10287,7 @@ function outputDecls(unit, node, base, valueKey) {
 const WORKFLOW_FILE = /^\.github\/workflows\/[^/]+\.ya?ml$/;
 /** `a/./b/` → `a/b`, `` → `.`. Anything escaping the root (`../x`) keeps its `..` and is never read. */
 function normalizeRelative(path) {
-	return trimChar(posix.normalize(trimChar(path, "/") || "."), "/") || ".";
+	return trimChar(posixNormalize(trimChar(path, "/") || "."), "/") || ".";
 }
 function classifyUses(raw, at, loc, ctx) {
 	const value = raw.trim();
@@ -15117,7 +15155,9 @@ function parseWorkflow(entryFile, contextOrTrace) {
 		value: readTemplate(context, WORKFLOW_ROOT, reader, fileId)
 	};
 }
-(/* @__PURE__ */ __commonJSMin(((exports, module) => {
+//#endregion
+//#region ../../node_modules/.pnpm/cronstrue@2.59.0/node_modules/cronstrue/dist/cronstrue.js
+var require_cronstrue = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function webpackUniversalModuleDefinition(root, factory) {
 		if (typeof exports === "object" && typeof module === "object") module.exports = factory();
 		else if (typeof define === "function" && define.amd) define("cronstrue", [], factory);
@@ -15977,7 +16017,9 @@ function parseWorkflow(entryFile, contextOrTrace) {
 			return __webpack_exports__;
 		})();
 	});
-})))();
+}));
+//#endregion
+//#region ../../node_modules/.pnpm/@actions+workflow-parser@0.3.61/node_modules/@actions/workflow-parser/dist/model/converter/cron-constants.js
 const MONTHS = {
 	jan: 1,
 	feb: 2,
@@ -16023,8 +16065,7 @@ const DOW_RANGE = {
 	max: 6,
 	names: DAYS
 };
-//#endregion
-//#region ../../node_modules/.pnpm/@actions+workflow-parser@0.3.61/node_modules/@actions/workflow-parser/dist/model/converter/cron.js
+require_cronstrue();
 function isValidCron(cron) {
 	const parts = cron.split(/ +/);
 	if (parts.length != 5) return false;
@@ -17181,7 +17222,7 @@ function parseAction(entryFile, contextOrTrace) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/schema.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/schema.ts
 /** Root definitions @actions/workflow-parser validates against (the strict ones its editor tooling uses). */
 const SCHEMA_ROOT = {
 	workflow: "workflow-root-strict",
@@ -17277,7 +17318,7 @@ function mappingsAt(schema, root, path) {
 	return [...out];
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/validate.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/validate.ts
 /**
 * The parser's errors for an invalid `${{ }}`: those of the expression lexer and parser (@actions/expressions, which
 * the sites' own expression parse uses too), and the template reader's for a `${{` without `}}`.
@@ -17673,7 +17714,7 @@ function mergeFix(key, where, whole) {
 	return whole && single ? `${repeat}, or alias ${whole} instead.` : `${repeat}.`;
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/script-writes.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/script-writes.ts
 const escapes$1 = (path) => path === ".." || path.startsWith("../");
 /** `cmd` or `sudo -E cmd`: words that run the next word as the command. */
 const PREFIXES = /* @__PURE__ */ new Set([
@@ -17841,10 +17882,10 @@ function resolveWord(word, cwd) {
 	}
 	if (base === void 0 || w === "" || /[$`*?[\]{}~]/.test(w) || w.startsWith("/")) return void 0;
 	if (/^[A-Za-z][\w+.-]*:/.test(w)) return void 0;
-	const path = normalizeRelative(posix.join(base, w));
+	const path = normalizeRelative(posixJoin(base, w));
 	return escapes$1(path) ? void 0 : path;
 }
-const basename$1 = (word) => posix.basename(word.replaceAll("\\", "/").replace(/\/+$/, ""));
+const basename$1 = (word) => posixBasename(word.replaceAll("\\", "/").replace(/\/+$/, ""));
 /**
 * Paths an inline script writes to: destinations of copies, moves, links and `mkdir`, clones and worktrees,
 * extractions (`tar -C`, `unzip -d`), downloads (`-o`, `--output`) and redirections. Variables other than
@@ -17971,7 +18012,7 @@ function writesTo(write, path, isRepoDir) {
 	return write.path !== "." && path.startsWith(`${write.path}/`) && !isRepoDir(write.path);
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/workspace.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/workspace.ts
 /**
 * Before any checkout, assume this repository at the workspace root: most jobs check it out there, possibly through
 * a step flowpact cannot see into, and a `./` action is unusable otherwise.
@@ -18346,106 +18387,10 @@ function workspaceResolver(opts) {
 	};
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+852776fb87daeb7010eafbce3cda467d415ec70f/node_modules/@ciatlas/core/src/project.ts
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/project.ts
 const WORKFLOWS_DIR = ".github/workflows";
-/** How many links one path may go through (the OS's ELOOP limit), and how many linked directories one walk expands. */
-const MAX_LINKS = 40;
-const MAX_LINKED_DIRS = 1e3;
 const ACTIONS_DIR = ".github/actions";
 const toPosix = (p) => p.split("\\").join("/");
-/**
-* Whether `abs` (after following symlinks) is inside the repository at `root` and outside its `.git` directory. A
-* checkout can contain symlinks; this keeps a caller from reading e.g. /etc or the persisted git credentials, and from
-* writing through a link. A path that does not exist yet is judged by its nearest existing parent.
-*/
-function insideRepository(root, abs) {
-	let realRoot;
-	try {
-		realRoot = realpathSync(root);
-	} catch {
-		realRoot = resolve(root);
-	}
-	let target = resolve(abs);
-	let rest = "";
-	for (;;) try {
-		target = join(realpathSync(target), rest);
-		break;
-	} catch {
-		const parent = dirname(target);
-		if (parent === target) return false;
-		rest = join(basename(target), rest);
-		target = parent;
-	}
-	const rel = toPosix(relative(realRoot, target));
-	if (rel === "") return true;
-	if (escapesRoot(rel)) return false;
-	return rel !== ".git" && !rel.startsWith(".git/");
-}
-function nodeFileSystem(root) {
-	const abs = (p) => join(root, p);
-	const listings = /* @__PURE__ */ new Map();
-	/** On case-insensitive file systems, `.GitHub/x.YML` opens `.github/x.yml`; GitHub (Linux) would not find it. */
-	const exactCase = (p) => {
-		let dir = root;
-		for (const part of toPosix(p).split("/").filter((x) => x && x !== ".")) {
-			if (part === "..") return false;
-			let names = listings.get(dir);
-			if (!names) {
-				try {
-					names = new Set(readdirSync(dir));
-				} catch {
-					return false;
-				}
-				listings.set(dir, names);
-			}
-			if (!names.has(part)) return false;
-			dir = join(dir, part);
-		}
-		return true;
-	};
-	/** Follows symlinks and accepts only existing targets inside the repository (see insideRepository). */
-	const inside = (p) => existsSync(abs(p)) && exactCase(p) && insideRepository(root, abs(p));
-	const isFile = (p) => inside(p) && statSync(abs(p)).isFile();
-	return {
-		read: (p) => isFile(p) ? readFileSync(abs(p), "utf8") : void 0,
-		list: (dir) => {
-			if (!inside(dir) || !statSync(abs(dir)).isDirectory()) return [];
-			return readdirSync(abs(dir)).map((name) => toPosix(join(dir, name))).filter((f) => isFile(f));
-		},
-		walk: (dir) => {
-			if (!inside(dir) || !statSync(abs(dir)).isDirectory()) return [];
-			const out = [];
-			let linked = 0;
-			const queue = [{
-				dir: toPosix(dir),
-				above: /* @__PURE__ */ new Set(),
-				links: 0
-			}];
-			for (let i = 0; i < queue.length; i++) {
-				const next = queue[i];
-				const real = realpathSync(abs(next.dir));
-				if (next.above.has(real)) continue;
-				const above = new Set(next.above).add(real);
-				for (const name of readdirSync(abs(next.dir))) {
-					if (name === "node_modules" || name === ".git") continue;
-					const p = toPosix(join(next.dir, name));
-					if (isFile(p)) out.push(p);
-					else if (inside(p) && statSync(abs(p)).isDirectory()) {
-						const link = lstatSync(abs(p)).isSymbolicLink();
-						if (link && (next.links >= MAX_LINKS || linked++ >= MAX_LINKED_DIRS)) continue;
-						queue.push({
-							dir: p,
-							above,
-							links: next.links + (link ? 1 : 0)
-						});
-					}
-				}
-			}
-			return out;
-		},
-		isDir: (p) => inside(p) && statSync(abs(p)).isDirectory()
-	};
-}
 /** The prefix of the paths below `dir`: `a/` for `a`, `a/`, `./a` or `./a/`, and `` for the root (`.`, `./`, ``). */
 const dirPrefix = (dir) => {
 	const d = toPosix(dir).replace(/^\.(\/|$)/, "").replace(/\/$/, "");
@@ -18471,10 +18416,12 @@ const isWorkflowFile = (p) => /^\.github\/workflows\/[^/]+\.ya?ml$/i.test(p);
 /** GitHub matches the directory of a called workflow exactly, whatever the file system's case sensitivity. */
 const isCallableWorkflowPath = (p) => /^\.github\/workflows\/[^/]+\.ya?ml$/.test(p.replace(/\.ya?ml$/i, (e) => e.toLowerCase()));
 /** Local `uses:` targets must stay inside the repository. */
-const escapesRoot = (p) => p === ".." || p.startsWith("../") || isAbsolute(p);
-function loadProject(opts) {
+const escapesRoot = (p) => p === ".." || p.startsWith("../") || posixIsAbsolute(p);
+/** Loads a project through a host (`loadProject` of the Node and browser entries wire one in). */
+function loadProjectWith(opts, host) {
 	const logger = (opts.logger ?? silentLogger).child("load");
-	const fs = opts.fs ?? nodeFileSystem(opts.root);
+	const fs = opts.fs ?? host.defaultFs?.(opts.root);
+	if (!fs) throw new Error("loadProject needs a file system here: pass fs (memoryFileSystem(files))");
 	const ctx = createParseContext(opts.repository);
 	const workflows = /* @__PURE__ */ new Map();
 	const actions = /* @__PURE__ */ new Map();
@@ -18540,7 +18487,7 @@ function loadProject(opts) {
 	let wholeRepository = false;
 	const ignoredTargets = [];
 	for (const p of opts.paths ?? []) {
-		const rel = toPosix(relative(opts.root, resolve(opts.root, p))) || ".";
+		const rel = host.relativeTo(opts.root, p) || ".";
 		if (rel === "." || rel === "") {
 			wholeRepository = true;
 			continue;
@@ -18649,6 +18596,119 @@ function externalUnits(remotes = [], ctx) {
 	}
 	return { external: out };
 }
+//#endregion
+//#region ../../node_modules/.pnpm/@ciatlas+core@https+++codeload.github.com+ciatlas+core+tar.gz+cf55cd8373233ba8a821439697c996db4188ecc3/node_modules/@ciatlas/core/src/node-fs.ts
+/** The project loader on a Node.js host: the working tree on disk, and `owner/repo` from the environment or git. */
+/** How many links one path may go through (the OS's ELOOP limit), and how many linked directories one walk expands. */
+const MAX_LINKS = 40;
+const MAX_LINKED_DIRS = 1e3;
+/**
+* Whether `abs` (after following symlinks) is inside the repository at `root` and outside its `.git` directory. A
+* checkout can contain symlinks; this keeps a caller from reading e.g. /etc or the persisted git credentials, and from
+* writing through a link. A path that does not exist yet is judged by its nearest existing parent.
+*/
+function insideRepository(root, abs) {
+	let realRoot;
+	try {
+		realRoot = realpathSync(root);
+	} catch {
+		realRoot = resolve(root);
+	}
+	let target = resolve(abs);
+	let rest = "";
+	for (;;) try {
+		target = join(realpathSync(target), rest);
+		break;
+	} catch {
+		const parent = dirname(target);
+		if (parent === target) return false;
+		rest = join(basename(target), rest);
+		target = parent;
+	}
+	const rel = toPosix(relative(realRoot, target));
+	if (rel === "") return true;
+	if (rel === ".." || rel.startsWith("../")) return false;
+	return rel !== ".git" && !rel.startsWith(".git/");
+}
+function nodeFileSystem(root) {
+	const abs = (p) => join(root, p);
+	const listings = /* @__PURE__ */ new Map();
+	/** On case-insensitive file systems, `.GitHub/x.YML` opens `.github/x.yml`; GitHub (Linux) would not find it. */
+	const exactCase = (p) => {
+		let dir = root;
+		for (const part of toPosix(p).split("/").filter((x) => x && x !== ".")) {
+			if (part === "..") return false;
+			let names = listings.get(dir);
+			if (!names) {
+				try {
+					names = new Set(readdirSync(dir));
+				} catch {
+					return false;
+				}
+				listings.set(dir, names);
+			}
+			if (!names.has(part)) return false;
+			dir = join(dir, part);
+		}
+		return true;
+	};
+	/** Follows symlinks and accepts only existing targets inside the repository (see insideRepository). */
+	const inside = (p) => existsSync(abs(p)) && exactCase(p) && insideRepository(root, abs(p));
+	const isFile = (p) => inside(p) && statSync(abs(p)).isFile();
+	/** One directory of the walk: its files to `out`, its subdirectories to `queue`. */
+	const expand = (next, out, queue, budget) => {
+		const real = realpathSync(abs(next.dir));
+		if (next.above.has(real)) return;
+		const above = new Set(next.above).add(real);
+		for (const name of readdirSync(abs(next.dir))) {
+			if (name === "node_modules" || name === ".git") continue;
+			const p = toPosix(join(next.dir, name));
+			if (isFile(p)) out.push(p);
+			else if (inside(p) && statSync(abs(p)).isDirectory()) enqueue(p, next, above, queue, budget);
+		}
+	};
+	/** A subdirectory onto the queue, unless it is a link past the depth or count the walk allows. */
+	const enqueue = (p, next, above, queue, budget) => {
+		const link = lstatSync(abs(p)).isSymbolicLink();
+		if (link && (next.links >= MAX_LINKS || budget.linked++ >= MAX_LINKED_DIRS)) return;
+		queue.push({
+			dir: p,
+			above,
+			links: next.links + (link ? 1 : 0)
+		});
+	};
+	return {
+		read: (p) => isFile(p) ? readFileSync(abs(p), "utf8") : void 0,
+		list: (dir) => {
+			if (!inside(dir) || !statSync(abs(dir)).isDirectory()) return [];
+			return readdirSync(abs(dir)).map((name) => toPosix(join(dir, name))).filter((f) => isFile(f));
+		},
+		walk: (dir) => {
+			if (!inside(dir) || !statSync(abs(dir)).isDirectory()) return [];
+			const out = [];
+			const queue = [{
+				dir: toPosix(dir),
+				above: /* @__PURE__ */ new Set(),
+				links: 0
+			}];
+			const budget = { linked: 0 };
+			for (let i = 0; i < queue.length; i++) expand(queue[i], out, queue, budget);
+			return out;
+		},
+		isDir: (p) => inside(p) && statSync(abs(p)).isDirectory()
+	};
+}
+const nodeHost = {
+	defaultFs: (root) => nodeFileSystem(root),
+	relativeTo: (root, p) => {
+		const rel = relative(root, resolve(root, p));
+		return isAbsolute(rel) ? ".." : toPosix(rel);
+	}
+};
+/** Loads the project at `root`: from disk unless `fs` says otherwise. */
+function loadProject(opts) {
+	return loadProjectWith(opts, nodeHost);
+}
 new Set(CONTEXT_FUNCTIONS.map((f) => f.name.toLowerCase()));
 //#endregion
 //#region ../engine/src/plan/values.ts
@@ -18701,6 +18761,12 @@ function* product(lists) {
 	const [first, ...rest] = lists;
 	for (const value of first) for (const tail of product(rest)) yield [value, ...tail];
 }
+/** A value in GitHub's string form: `null` is empty, objects are JSON, the rest `String()`. */
+function stringOf(value) {
+	if (value === null) return "";
+	if (typeof value === "object") return JSON.stringify(value);
+	return String(value);
+}
 //#endregion
 //#region ../engine/src/contexts.ts
 /** The value of a context reference, with the unknown that explains a missing value. */
@@ -19045,28 +19111,24 @@ function literalValue(text) {
 function evaluateCondition(text, state, status) {
 	const parsed = parseExpression(text);
 	const reads = parsed.refs.map((ref) => ({
-		ref: `${ref.context}${ref.path.length ? `.${ref.path.join(".")}` : ""}`,
+		ref: refName(ref),
 		value: ref.dynamic ? unknown$1([`${ref.context}.${ref.path.join(".")}`]) : lookupContext(state, ref)
 	}));
-	if (!parsed.ast) return {
-		value: unknown$1([`expression:${text}`], [true, false]),
+	return {
+		value: conditionValue(parsed, contextResolver(state), status, reads),
 		reads
 	};
+}
+/** A reference as a read names it: `needs.build.result`, `github`. */
+const refName = (ref) => `${ref.context}${ref.path.length ? `.${ref.path.join(".")}` : ""}`;
+/** Known true, known false, or unknown because of the reads and status answers it could not decide over. */
+function conditionValue(parsed, resolve, status, reads) {
+	if (!parsed.ast) return unknown$1([`expression:${parsed.source}`], [true, false]);
 	const options = { runtime: (name) => statusAnswer(status, name) };
-	const resolve = contextResolver(state);
-	if (definitelyTruthy(parsed.ast, resolve, options)) return {
-		value: known$1(true),
-		reads
-	};
-	if (definitelyFalsy(parsed.ast, resolve, options)) return {
-		value: known$1(false),
-		reads
-	};
+	if (definitelyTruthy(parsed.ast, resolve, options)) return known$1(true);
+	if (definitelyFalsy(parsed.ast, resolve, options)) return known$1(false);
 	const unknowns = [...reads.flatMap((r) => r.value.known ? [] : r.value.unknowns), ...Object.values(status).flatMap((s) => s.known ? [] : s.unknowns)];
-	return {
-		value: unknown$1(unknowns.length ? unknowns : [`expression:${text}`], [true, false]),
-		reads
-	};
+	return unknown$1(unknowns.length ? unknowns : [`expression:${parsed.source}`], [true, false]);
 }
 /** The status functions as core's evaluator asks for them; an unknown answer leaves the call unknown. */
 function statusAnswer(status, name) {
@@ -19095,11 +19157,6 @@ function evaluateValue(text, state, status) {
 	return unknown$1(unknowns.length ? unknowns : [`expression:${text}`]);
 }
 /** A value as GitHub writes it into a string: `null` is empty, objects are JSON. */
-function stringOf(value) {
-	if (value === null) return "";
-	if (typeof value === "object") return JSON.stringify(value);
-	return String(value);
-}
 /**
 * A script with its `${{ }}` segments replaced by their values, for folding what it writes; a segment the plan cannot
 * evaluate becomes `UNKNOWN_MARKER`, which taints any write that includes it.
@@ -19218,7 +19275,7 @@ function pathsMatch(changed, filter) {
 }
 //#endregion
 //#region ../engine/src/paths.ts
-const ID = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+const ID$1 = /^[A-Za-z_][A-Za-z0-9_-]*$/;
 var UnitPathError = class extends Error {
 	name = "UnitPathError";
 };
@@ -19242,7 +19299,7 @@ function parseJobSegment(part, text) {
 	const m = /^([^[.]+)(?:\[([^\]]*)\])?(?:\.(.+))?$/.exec(part);
 	if (!m) throw new UnitPathError(`cannot read '${part}' in '${text}'`);
 	const [, job, leg, step] = m;
-	if (!ID.test(job)) throw new UnitPathError(`'${job}' is not a job id in '${text}'`);
+	if (!ID$1.test(job)) throw new UnitPathError(`'${job}' is not a job id in '${text}'`);
 	const segment = { job };
 	if (leg !== void 0) segment.leg = parseLeg(leg, text);
 	if (step !== void 0) segment.step = parseStep(step, text);
@@ -19263,9 +19320,18 @@ function parseStep(step, text) {
 		if (!Number.isInteger(n) || n < 1) throw new UnitPathError(`'${step}' is not #<position> in '${text}'`);
 		return { index: n };
 	}
-	if (!ID.test(step)) throw new UnitPathError(`'${step}' is not a step id in '${text}'`);
+	if (!ID$1.test(step)) throw new UnitPathError(`'${step}' is not a step id in '${text}'`);
 	return { id: step };
 }
+function formatUnitPath(path) {
+	const body = path.segments.map((s) => {
+		const leg = s.leg ? `[${Object.entries(s.leg).map(([k, v]) => `${k}=${v}`).join(",")}]` : "";
+		const step = s.step ? s.step.id !== void 0 ? s.step.id : `#${s.step.index}` : "";
+		if (s.job === void 0) return step;
+		return `${s.job}${leg}${step ? `.${step}` : ""}`;
+	}).join("/");
+	return path.workflow === void 0 ? body : `${path.workflow}:${body}`;
+}
 /** Whether a path names the location: same depth, same jobs and steps, leg values a subset of the location's. */
 function pathMatches(path, location) {
 	if (path.workflow !== void 0 && !workflowMatches(path.workflow, location.workflow)) return false;
@@ -27637,6 +27703,107 @@ function unitPathOfId(id, paths) {
 	return best === void 0 ? id : `${paths.get(best)}${id.slice(best.length)}`;
 }
 //#endregion
+//#region ../engine/src/plan/pins.ts
+const RACE = "race:fail-fast:";
+const ID = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+/** Sets `producer` and an assume `pin` on every unknown about a planned unit's field. */
+function assumePins(plan, units) {
+	for (const u of plan.unknowns) {
+		const ref = unitRef(u.id, units);
+		if (!ref) continue;
+		u.producer = ref.node;
+		const pin = pinOf(plan, ref.node, units.get(ref.node), ref.about);
+		if (pin) u.pin = pin;
+	}
+}
+/** The unit an unknown is about and what of it: the longest unit id followed by `.outputs.`, `.env.` or `.outcome`. */
+function unitRef(id, units) {
+	if (id.startsWith(RACE)) {
+		const node = id.slice(15);
+		return units.get(node)?.kind === "job" ? {
+			node,
+			about: { field: "cancelled" }
+		} : void 0;
+	}
+	if (id.startsWith("race:") || id.startsWith("conflict:")) return void 0;
+	for (let dot = id.lastIndexOf("."); dot > 0; dot = id.lastIndexOf(".", dot - 1)) {
+		const node = id.slice(0, dot);
+		if (!units.has(node)) continue;
+		const about = aboutOf(id.slice(dot + 1));
+		return about ? {
+			node,
+			about
+		} : void 0;
+	}
+}
+function aboutOf(rest) {
+	if (rest === "outcome") return { field: "outcome" };
+	for (const field of ["outputs", "env"]) if (rest.startsWith(`${field}.`) && rest.length > field.length + 1) return {
+		field,
+		name: rest.slice(field.length + 1)
+	};
+}
+function pinOf(plan, node, site, about) {
+	if (about.field === "env" && site.kind === "job") return void 0;
+	const named = namedBy(site.location);
+	if (!named) return void 0;
+	const entry = {};
+	if (sharesJobId(plan, node, site.location)) entry.workflow = site.location.workflow;
+	entry[site.kind] = named.path;
+	if (named.matrix) entry.matrix = named.matrix;
+	if (about.field === "cancelled" || about.field === "outcome") entry.outcome = about.field === "cancelled" ? "cancelled" : "failure";
+	else entry[about.field] = { [about.name]: "" };
+	return {
+		layer: "assume",
+		fragment: entry,
+		at: ["assume"]
+	};
+}
+/**
+* The unit path of a location, with the leg of its last segment taken out as `matrix:` values; undefined when a leg
+* further up cannot be written in the path, or an id is not one a path holds.
+*/
+function namedBy(location) {
+	const segments = segmentsOf(location);
+	if (!segments) return void 0;
+	const last = segments.at(-1);
+	const own = last.job === void 0 ? void 0 : last.leg;
+	if (own) delete last.leg;
+	if (!segments.every((s) => s.leg === void 0 || legInPath(s.leg))) return void 0;
+	const path = formatUnitPath({ segments });
+	return own && Object.keys(own).length ? {
+		path,
+		matrix: own
+	} : { path };
+}
+/** The chain as path segments: a job opens one, a step after a job's step opens one inside its composite action. */
+function segmentsOf(location) {
+	const segments = [];
+	for (const link of location.chain) if (link.kind === "step") addStep(segments, link);
+	else if (ID.test(link.id)) segments.push(link.leg ? {
+		job: link.id,
+		leg: { ...link.leg }
+	} : { job: link.id });
+	else return void 0;
+	return segments.length ? segments : void 0;
+}
+/** A step joins its job's segment, or opens one inside the composite action of the step before it. */
+function addStep(segments, link) {
+	const step = link.id !== void 0 && ID.test(link.id) ? { id: link.id } : { index: link.index };
+	const last = segments.at(-1);
+	if (last?.job !== void 0 && last.step === void 0) last.step = step;
+	else segments.push({ step });
+}
+/** Whether `[k=v,…]` reads back as these values: no `/`, `,` or `]`, no surrounding space, no `=` in a key. */
+const legInPath = (leg) => Object.entries(leg).every(([k, v]) => plainCell(k) && !k.includes("=") && plainCell(v));
+const plainCell = (s) => s.trim() === s && !/[/,\]]/.test(s);
+/** Whether another workflow of the plan has a job of the same id as the unit's first job. */
+function sharesJobId(plan, node, location) {
+	const first = location.chain[0];
+	if (first?.kind !== "job") return false;
+	return plan.workflows.some((w) => w.depth === 0 && !node.startsWith(`${w.id}#`) && w.jobs.some((j) => j.jobId === first.id));
+}
+//#endregion
 //#region ../engine/src/scenario.ts
 /**
 * A scenario: the facts about one run that the engine simulates. Authors write the input shape (in a test's `when:`,
@@ -28630,7 +28797,7 @@ function verdictOf(gates) {
 //#endregion
 //#region ../engine/src/version.ts
 /** The simulci version. release-please updates it with every release. */
-const VERSION = "0.1.0";
+const VERSION = "0.2.0";
 /** The schema version of every JSON document the engine emits or reads. A breaking change bumps it. */
 const SCHEMA_VERSIONS = {
 	scenario: 1,
@@ -28685,6 +28852,8 @@ var Planner = class {
 	diagnostics = [];
 	applied = [];
 	models = /* @__PURE__ */ new Map();
+	/** Every planned step and leg by id, with the location an assume entry is matched against. */
+	units = /* @__PURE__ */ new Map();
 	index;
 	constructor(loaded, scenario, detail, maxDepth, mocks, shipped) {
 		this.loaded = loaded;
@@ -28700,7 +28869,7 @@ var Planner = class {
 			depth: 0,
 			checkPrefix: ""
 		}));
-		return {
+		const plan = {
 			$schema: schemaUrl("runPlan"),
 			schemaVersion: 1,
 			engine: {
@@ -28718,6 +28887,8 @@ var Planner = class {
 			})).sort((a, b) => a.id.localeCompare(b.id)),
 			diagnostics: this.finishDiagnostics()
 		};
+		assumePins(plan, this.units);
+		return plan;
 	}
 	/** The mocks' own diagnostics, plus the entries that named nothing in this plan (SC102). */
 	finishDiagnostics() {
@@ -28865,74 +29036,65 @@ var Planner = class {
 			total: exp.combos.length || 1
 		};
 		plan.legs = this.legsOf(job, exp, segments, legCtx);
-		this.failFast(plan, job);
+		for (const leg of plan.legs) {
+			const location = {
+				workflow: ctx.wf.path,
+				chain: [...ctx.chain, legLinkOf(job, leg)]
+			};
+			this.units.set(leg.id, {
+				location,
+				kind: "job"
+			});
+			this.applyLegFacts(job, leg, jobNode, location);
+		}
+		this.failFast(plan);
 		plan.result = this.jobResultOf(runs, cond, continueOnError, plan.legs);
-		plan.outputs = this.jobOutputs(job, plan, jobNode);
-		this.applyJobFacts(job, plan, continueOnError, {
-			workflow: ctx.wf.path,
-			chain: [...ctx.chain, {
-				kind: "job",
-				id: job.id
-			}]
-		});
+		plan.outputs = this.jobOutputs(plan, jobNode);
 		return plan;
 	}
-	/** A mock on the job: its outcome applies at the job boundary (the steps stay planned), its outputs overlay. */
-	applyJobFacts(job, plan, continueOnError, location) {
-		const facts = this.mocks.factsFor(location, plan.id);
+	/**
+	* A mock on the job or one of its legs (`test[node=22]`, or `test` with `matrix:`): its outcome is the leg's result
+	* (the steps stay planned), its outputs overlay the leg's. The job's result and outputs are then read from its legs.
+	*/
+	applyLegFacts(job, leg, jobNode, location) {
+		const facts = this.mocks.factsFor(location, leg.id);
 		if (facts.outcome) {
-			const result = jobResult({
-				skipped: false,
-				continueOnError,
-				legResults: [facts.outcome.value]
-			});
-			plan.result = plan.runs.verdict === "maybe" ? unknown$1(plan.result.known ? [] : plan.result.unknowns, ["skipped", ...candidates(result) ?? []]) : result;
-			this.record(facts.outcome.by, plan.id, "outcome");
-			if (job.steps.length) this.diagnostics.push({
+			leg.result = facts.outcome.value;
+			this.record(facts.outcome.by, leg.id, "outcome");
+			if (job.steps.length) this.diagnoseOnce({
 				severity: "info",
 				code: "SC108",
 				message: `${facts.outcome.by} sets the outcome of job ${job.id}; its steps are planned as written`,
-				node: plan.id,
+				node: jobNode,
 				mock: facts.outcome.by
 			});
 		}
-		const declared = job.uses ? Object.keys(plan.outputs) : Object.keys(job.outputs);
-		this.overlayOutputs(plan.outputs, facts, plan.id, {
+		const declared = job.uses ? Object.keys(leg.outputs) : Object.keys(job.outputs);
+		this.overlayOutputs(leg.outputs, facts, leg.id, {
 			closed: true,
 			names: declared,
 			what: `job ${job.id}`
 		});
 	}
+	/** A diagnostic said once: every leg of a matrix that meets the same mock says the same thing. */
+	diagnoseOnce(d) {
+		if (!this.diagnostics.some((x) => x.code === d.code && x.mock === d.mock && x.message === d.message)) this.diagnostics.push(d);
+	}
 	/** Fail-fast: once a leg fails, the other legs are cancelled or finish first; `needs` reads the job as failed either way. */
-	failFast(plan, job) {
+	failFast(plan) {
 		if (!plan.matrix?.failFast.known || !plan.matrix.failFast.value) return;
 		if (!plan.legs.some((l) => l.result.known && l.result.value === "failure")) return;
 		for (const leg of plan.legs) {
 			if (!leg.result.known || leg.result.value !== "success") continue;
 			const id = `race:fail-fast:${leg.id}`;
-			const matrix = Object.fromEntries(Object.entries(leg.values).map(([k, v]) => [k, v.known ? stringOf(v.value) : "?"]));
-			this.register({
-				id,
-				kind: "race",
-				reads: [],
-				affects: [],
-				pin: {
-					layer: "assume",
-					fragment: {
-						job: job.id,
-						matrix,
-						outcome: "cancelled"
-					},
-					at: ["assume"]
-				}
-			}, void 0);
+			this.note([id]);
 			leg.result = unknown$1([id], ["success", "cancelled"]);
 		}
 	}
 	/** Mocked outputs over the unit's own; a name a closed interface does not declare is an error (SC101). */
 	overlayOutputs(outputs, facts, node, iface) {
 		for (const [name, fact] of Object.entries(facts.outputs)) {
-			if (iface.closed && !iface.names.includes(name)) this.diagnostics.push({
+			if (iface.closed && !iface.names.includes(name)) this.diagnoseOnce({
 				severity: "error",
 				code: "SC101",
 				message: `${fact.by} sets output '${name}', which ${iface.what} does not declare${iface.names.length ? ` (it declares ${iface.names.join(", ")})` : ""}`,
@@ -28970,13 +29132,25 @@ var Planner = class {
 			node: ctx.wfNode,
 			verdict: ctx.triggered.verdict
 		};
-		const runs = decide(ctx.triggered, cond.value, [parent, ifReason]);
+		const runs = this.nestingLimit(job, ctx, decide(ctx.triggered, cond.value, [parent, ifReason]));
 		if (runs.verdict === "maybe") this.noteValue(cond.value, jobNode);
 		return {
 			runs,
 			cond
 		};
 	}
+	/** A call past the nesting limit does not run, whatever its `if:` says: the job stops, not only its legs. */
+	nestingLimit(job, ctx, runs) {
+		if (runs.verdict === "no" || !job.uses || ctx.depth + 1 < this.maxDepth) return runs;
+		if (!this.index.calleeOf(job)) return runs;
+		return {
+			verdict: "no",
+			chain: [...runs.chain, {
+				kind: "limit",
+				limit: "nesting"
+			}]
+		};
+	}
 	matrixPlan(job, exp, ctx, jobNode) {
 		const matrix = {
 			keys: exp.keys,
@@ -29025,25 +29199,29 @@ var Planner = class {
 		};
 		return [leg];
 	}
+	/**
+	* The result `needs` reads. A reader runs only where the workflow does, so a job `maybe` only because its workflow
+	* is reads as its legs did; an `if:` the plan cannot decide adds `skipped`.
+	*/
 	jobResultOf(runs, cond, continueOnError, legs) {
 		const result = jobResult({
 			skipped: false,
 			continueOnError,
 			legResults: legs.map((l) => l.result)
 		});
-		if (runs.verdict !== "maybe") return result;
-		return unknown$1(cond.value.known ? [] : cond.value.unknowns, ["skipped", ...candidates(result) ?? []]);
+		return runs.verdict === "maybe" ? orSkipped(result, cond.value, "first") : result;
 	}
 	/** A job's outputs as readers see them: the legs' values, where an empty value never wins and the last to finish does (lab 8). */
-	jobOutputs(job, plan, jobNode) {
+	jobOutputs(plan, jobNode) {
 		const out = {};
-		const names = job.uses ? [...new Set(plan.legs.flatMap((l) => Object.keys(l.outputs)))] : Object.keys(job.outputs);
+		const names = [...new Set(plan.legs.flatMap((l) => Object.keys(l.outputs)))];
 		for (const name of names) {
 			const values = plan.legs.map((l) => l.outputs[name] ?? known$1(""));
 			const ids = values.flatMap((v) => v.known ? [] : v.unknowns);
 			const nonEmpty = [...new Set(values.flatMap((v) => v.known && v.value !== "" ? [v.value] : []))];
+			const chosen = nonEmpty[0] ?? "";
 			if (ids.length) out[name] = unknown$1(ids);
-			else if (nonEmpty.length <= 1) out[name] = known$1(nonEmpty[0] ?? "");
+			else if (nonEmpty.length <= 1) out[name] = values.find((v) => v.known && v.value === chosen);
 			else {
 				const race = `race:matrix-outputs:${jobNode}.${name}`;
 				this.note([race]);
@@ -29077,23 +29255,18 @@ var Planner = class {
 		if (combo) leg.origin = combo.origin;
 		if (job.runsOn) leg.runsOn = this.runsOn(job, ctx.wf, state, legId);
 		if (job.environment) leg.environment = this.environment(job, ctx.wf, state, legId);
+		const location = {
+			workflow: ctx.wf.path,
+			chain: [...ctx.chain, legLinkOf(job, leg)]
+		};
 		if (job.uses) {
-			this.planCall(leg, state, seg, ctx);
+			this.planCall(leg, state, seg, ctx, location);
 			return leg;
 		}
 		leg.check = {
 			name: `${ctx.checkPrefix}${seg.name}`,
 			certain: seg.certain
 		};
-		const legLink = {
-			kind: "job",
-			id: job.id
-		};
-		if (combo) legLink.leg = Object.fromEntries(Object.entries(leg.values).map(([k, v]) => [k, v.known ? stringOf(v.value) : "?"]));
-		const location = {
-			workflow: ctx.wf.path,
-			chain: [...ctx.chain, legLink]
-		};
 		const steps = this.planSteps(job.steps, ctx.settings.steps, legId, runs, state, void 0, location);
 		if (this.detail === "steps") leg.steps = steps.plans;
 		leg.result = legResult(steps.conclusions);
@@ -29148,34 +29321,18 @@ var Planner = class {
 		return v;
 	}
 	/** A reusable workflow called by the leg: nested with the caller's inputs and secrets, its result from its jobs. */
-	planCall(leg, state, seg, ctx) {
+	planCall(leg, state, seg, ctx, location) {
 		const { job } = ctx;
 		const callee = this.index.calleeOf(job);
 		if (!callee) {
 			this.unsupportedCall(leg, job);
 			return;
 		}
-		if (ctx.depth + 1 >= this.maxDepth) {
-			leg.runs = {
-				verdict: "no",
-				chain: [...leg.runs.chain, {
-					kind: "limit",
-					limit: "nesting"
-				}]
-			};
-			leg.result = known$1("skipped");
-			return;
-		}
 		const inputs = callInputs(job, callee, state);
 		for (const v of Object.values(inputs)) this.noteValue(v);
-		const callLink = {
-			kind: "job",
-			id: job.id
-		};
-		if (Object.keys(leg.values).length) callLink.leg = Object.fromEntries(Object.entries(leg.values).map(([k, v]) => [k, v.known ? stringOf(v.value) : "?"]));
 		leg.call = this.planWorkflow(callee, {
 			depth: ctx.depth + 1,
-			chain: [...ctx.chain, callLink],
+			chain: location.chain,
 			caller: leg.id,
 			triggered: {
 				verdict: leg.runs.verdict,
@@ -29190,12 +29347,12 @@ var Planner = class {
 			checkPrefix: `${ctx.checkPrefix}${seg.name} / `
 		});
 		const legResults = leg.call.jobs.map((j) => j.result);
-		leg.result = leg.runs.verdict === "no" ? known$1("skipped") : jobResult({
+		leg.result = jobResult({
 			skipped: false,
 			continueOnError: known$1(false),
 			legResults
 		});
-		leg.outputs = leg.call.outputs;
+		leg.outputs = { ...leg.call.outputs };
 	}
 	unsupportedCall(leg, job) {
 		const why = job.uses?.kind === "remote-workflow" ? "a remote reusable workflow is not loaded" : "the called workflow was not found or cannot be called";
@@ -29261,6 +29418,10 @@ var Planner = class {
 		return out;
 	}
 	planStep(step, st, sid, parentId, parentRuns, state, status, location) {
+		this.units.set(sid, {
+			location,
+			kind: "step"
+		});
 		const evaluated = st?.if ?? impliedIf(step);
 		const cond = evaluateCondition(evaluated, state, stepStatusFunctions(status));
 		const parent = {
@@ -29314,10 +29475,7 @@ var Planner = class {
 			envWrites: {}
 		};
 		const facts = this.mocks.factsFor(location, sid, step.uses?.raw, target.model);
-		const envWrites = {
-			...this.scriptEnv(step, sid, state),
-			...this.envWritesOf(facts, sid)
-		};
+		const envWrites = this.envWrites(step, sid, state, facts);
 		const { produced, base } = this.producedOutcome(facts, runs, cond, sid);
 		if (target.action?.using === "composite") return {
 			...this.compositeProduct(target.action, step, sid, state, runs, location, facts, produced, base),
@@ -29336,13 +29494,26 @@ var Planner = class {
 			envWrites
 		};
 	}
-	/** The outputs in interface order, then the names only a mock added; a name nothing valued stays unknown. */
+	/**
+	* The outputs in interface order, then the names only a mock added; a name nothing valued stays unknown. Only what
+	* is unknown after the mocks is an unknown of the plan: a pinned output is not.
+	*/
 	finishOutputs(opaque, sid) {
 		const out = {};
-		for (const name of opaque.names) out[name] = opaque.outputs[name] ?? this.unknownOutput(sid, name);
+		for (const name of opaque.names) out[name] = opaque.outputs[name] ?? outputUnknown(sid, name);
 		for (const [name, v] of Object.entries(opaque.outputs)) out[name] ??= v;
+		for (const v of Object.values(out)) this.noteValue(v);
 		return out;
 	}
+	/** The `$GITHUB_ENV` writes the steps after this one read: the script's, under the mocked ones. */
+	envWrites(step, sid, state, facts) {
+		const writes = {
+			...this.scriptEnv(step, sid, state),
+			...this.envWritesOf(facts, sid)
+		};
+		for (const v of Object.values(writes)) this.noteValue(v);
+		return writes;
+	}
 	envWritesOf(facts, sid) {
 		const envWrites = {};
 		for (const [name, fact] of Object.entries(facts.env)) {
@@ -29351,13 +29522,13 @@ var Planner = class {
 		}
 		return envWrites;
 	}
-	/** The outcome as mocked, else success; a `maybe` step may also have been skipped. */
+	/** The outcome as mocked, else success; a step whose own `if:` is unknown may also have been skipped. */
 	producedOutcome(facts, runs, cond, sid) {
 		const produced = facts.outcome ? facts.outcome.value : known$1("success");
 		if (facts.outcome) this.record(facts.outcome.by, sid, "outcome");
 		return {
 			produced,
-			base: runs.verdict === "yes" ? produced : unknown$1(cond.value.known ? [] : cond.value.unknowns, [...candidates(produced) ?? [], "skipped"])
+			base: runs.verdict === "yes" ? produced : orSkipped(produced, cond.value, "last")
 		};
 	}
 	/** A composite action under its step: a mocked outcome makes it opaque, otherwise its inner steps decide. */
@@ -29407,11 +29578,7 @@ var Planner = class {
 	scriptOutputs(step, sid, state) {
 		const outputs = {};
 		const folded = foldWrites(substituteTemplates(step.run ?? "", state), { unknownId: (n) => `${sid}.outputs.${n}` });
-		for (const name of /* @__PURE__ */ new Set([...step.writesOutputs.names, ...Object.keys(folded)])) {
-			const v = folded[name] ?? this.unknownOutput(sid, name);
-			this.noteValue(v);
-			outputs[name] = v;
-		}
+		for (const name of /* @__PURE__ */ new Set([...step.writesOutputs.names, ...Object.keys(folded)])) outputs[name] = folded[name] ?? outputUnknown(sid, name);
 		const open = !(step.writesOutputs.mentions && !step.writesOutputs.dynamic);
 		return {
 			outputs,
@@ -29423,17 +29590,10 @@ var Planner = class {
 	/** The `$GITHUB_ENV` writes of a script, as the steps after it read them. */
 	scriptEnv(step, sid, state) {
 		if (step.run === void 0) return {};
-		const folded = foldWrites(substituteTemplates(step.run, state), {
+		return foldWrites(substituteTemplates(step.run, state), {
 			file: "GITHUB_ENV",
 			unknownId: (n) => `${sid}.env.${n}`
 		});
-		for (const v of Object.values(folded)) this.noteValue(v);
-		return folded;
-	}
-	unknownOutput(sid, name) {
-		const id = `${sid}.outputs.${name}`;
-		this.note([id]);
-		return unknown$1([id]);
 	}
 	planComposite(action, step, stepNode, state, runs, location) {
 		const id = compositeNodeId(stepNode, action.path);
@@ -29626,6 +29786,27 @@ function legValues(combo, legId) {
 	if (!combo) return {};
 	return Object.fromEntries(Object.entries(combo.values).map(([k, c]) => [k, c.known ? known$1(c.value) : unknown$1([`${legId}.matrix.${k}`])]));
 }
+/**
+* A result when the unit's own `if:` may leave it skipped: `skipped` joins its candidates (a job has listed it first, a
+* step last). A parent's `maybe` adds nothing: the unit's readers (`needs`, `steps`) run only where its parent does.
+*/
+function orSkipped(result, cond, at) {
+	if (cond.known) return result;
+	const ids = [...cond.unknowns, ...result.known ? [] : result.unknowns];
+	const options = candidates(result);
+	if (!options) return unknown$1(ids);
+	return unknown$1(ids, at === "first" ? ["skipped", ...options] : [...options, "skipped"]);
+}
+const outputUnknown = (sid, name) => unknown$1([`${sid}.outputs.${name}`]);
+/** The link of a leg in a location: its job, with the leg's values (`?` for an unknown one) when it has a matrix. */
+function legLinkOf(job, leg) {
+	const link = {
+		kind: "job",
+		id: job.id
+	};
+	if (Object.keys(leg.values).length) link.leg = Object.fromEntries(Object.entries(leg.values).map(([k, v]) => [k, v.known ? stringOf(v.value) : "?"]));
+	return link;
+}
 /** The verdict under a parent and an `if:` value: the first `no` wins, an unknown makes it `maybe`. */
 function decide(parent, value, chain) {
 	if (parent.verdict === "no") return {
@@ -29746,6 +29927,7 @@ function topoOrder(wf) {
 	return order;
 }
 const KINDS = [
+	[/^conflict:/, "conflict"],
 	[/^vars\./, "var"],
 	[/^inputs\./, "input"],
 	[/^secrets\./, "secret"],
@@ -29755,6 +29937,7 @@ const KINDS = [
 	[/^race:/, "race"],
 	[/\.outputs\./, "step-output"],
 	[/\.outcome$/, "outcome"],
+	[/\.env\./, "env"],
 	[/matrix/, "matrix"],
 	[/hashfiles/i, "hashfiles"]
 ];
@@ -29768,7 +29951,6 @@ function kindOf(id) {
 	return KINDS.find(([re]) => re.test(id))?.[1] ?? "unsupported";
 }
 const SCENARIO_PINS = [
-	[/^vars\.(.+)$/, (name) => ({ vars: { [name]: "" } })],
 	[/^inputs\.((?!.*\.default$).+)$/, (name) => ({ inputs: { [name]: "" } })],
 	[/^github\.(sha)$/, () => ({ sha: "" })],
 	[/^github\.(actor|triggering_actor)$/, () => ({ actor: { login: "" } })],
@@ -29776,7 +29958,10 @@ const SCENARIO_PINS = [
 	[/^github\.(ref|ref_name|ref_type)$/, () => ({ tag: "" })],
 	[/^scenario\.changed$/, () => ({ changed: ["path/to/file"] })]
 ];
-/** The scenario field that would pin an unknown read, when there is one. */
+/**
+* The scenario field that would pin an unknown read, when there is one. A step's or job's output, outcome or env
+* write is pinned by an assume entry, set over the finished plan (`assumePins`).
+*/
 function pinFor(id) {
 	for (const [re, fragment] of SCENARIO_PINS) {
 		const m = re.exec(id);
@@ -31138,7 +31323,8 @@ const REF_GROUP = [
 const MERGED = /* @__PURE__ */ new Set([
 	"inputs",
 	"vars",
-	"actor"
+	"actor",
+	"workflow_run"
 ]);
 /** The case's scenario over the file's: records merge key by key, the ref group is replaced whole, the rest replaced. */
 function mergeScenario(given, when) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "simulci",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Static simulator and test framework for GitHub Actions: which jobs and steps run for a scenario, and why.",
   "keywords": [
     "ci",