@agiledigital/pingone-aic-script-tester 0.1.0

package/dist/src/aic/idm.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Tenant-backed `IdmHandle` for replaying harness checks and cleanup. It keeps
+ * the tenant's materialized record shape intact; the local mock's projection
+ * is deliberately not reproduced on this lane.
+ */
+import type { JsonValue } from "../case/types.ts";
+import type { IdmHandle } from "../harness/types.ts";
+import { type AicIo, type TenantSession } from "./tenant.ts";
+export declare function tenantIdmHandle(io: AicIo, session: TenantSession): IdmHandle;
+export declare function encodeQueryFilter(filter: Readonly<Record<string, JsonValue>>): string;

package/dist/src/aic/idm.js

@@ -0,0 +1,112 @@
+import { isPlainObject } from "../case/util.js";
+import { splitResource } from "../harness/idm.js";
+import { AicLaneError, amRequest } from "./tenant.js";
+export function tenantIdmHandle(io, session) {
+    return {
+        async read(resource) {
+            const response = await amRequest(io, session, {
+                method: "GET",
+                path: recordPath(resource),
+            });
+            if (response.status === 404) {
+                return null;
+            }
+            if (response.status !== 200) {
+                throw statusError("read managed record", response.status, "200 or 404");
+            }
+            if (!isManagedRecord(response.body)) {
+                throw new AicLaneError("read managed record returned no materialized record");
+            }
+            return response.body;
+        },
+        async query(type, filter) {
+            const queryFilter = encodeQueryFilter(filter);
+            const response = await amRequest(io, session, {
+                method: "GET",
+                path: `${collectionPath(type)}?_queryFilter=${encodeURIComponent(queryFilter)}`,
+            });
+            if (response.status !== 200 || !isPlainObject(response.body)) {
+                throw statusError("query managed records", response.status, "200");
+            }
+            const result = response.body.result;
+            const resultCount = response.body.resultCount;
+            if (!Array.isArray(result) ||
+                !result.every(isManagedRecord) ||
+                typeof resultCount !== "number") {
+                throw new AicLaneError("query managed records returned an invalid result/resultCount shape");
+            }
+            return result;
+        },
+        async delete(resource) {
+            const response = await amRequest(io, session, {
+                method: "DELETE",
+                path: recordPath(resource),
+            });
+            if (response.status === 404) {
+                return;
+            }
+            if (response.status !== 200) {
+                throw statusError("delete managed record", response.status, "200 or 404");
+            }
+            if (!isManagedRecord(response.body)) {
+                throw new AicLaneError("delete managed record returned no deleted record");
+            }
+        },
+    };
+}
+export function encodeQueryFilter(filter) {
+    const entries = Object.entries(filter);
+    if (entries.length === 0) {
+        return "true";
+    }
+    return entries
+        .map(([field, value]) => `${encodeField(field)} eq ${encodeFilterValue(field, value)}`)
+        .join(" and ");
+}
+function recordPath(resource) {
+    const [type, id] = splitResource(resource);
+    return `${collectionPath(type)}/${encodeURIComponent(id)}`;
+}
+function collectionPath(type) {
+    const match = /^managed\/([^/]+)$/.exec(type);
+    if (match === null || match[1] === undefined) {
+        throw new AicLaneError(`managed type ${JSON.stringify(type)} must have the form managed/<type>`);
+    }
+    return `/openidm/managed/${encodeURIComponent(match[1])}`;
+}
+function encodeField(field) {
+    if (!/^\/?[A-Za-z0-9_$.-]+(?:\/[A-Za-z0-9_$.-]+)*$/.test(field)) {
+        throw new AicLaneError(`managed query field ${JSON.stringify(field)} cannot be encoded safely`);
+    }
+    return field;
+}
+function encodeFilterValue(field, value) {
+    if (typeof value === "string") {
+        if (value.includes('"') || hasControlCharacter(value)) {
+            throw unsupportedFilterValue(field, "strings containing quotes or control characters");
+        }
+        return `"${value}"`;
+    }
+    if (typeof value === "boolean") {
+        return String(value);
+    }
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return String(value);
+    }
+    if (value === null) {
+        throw unsupportedFilterValue(field, "null (CREST has no null literal)");
+    }
+    throw unsupportedFilterValue(field, "arrays and objects");
+}
+function hasControlCharacter(value) {
+    return [...value].some((character) => character.charCodeAt(0) < 0x20);
+}
+function isManagedRecord(value) {
+    return isPlainObject(value) && typeof value._id === "string";
+}
+function unsupportedFilterValue(field, detail) {
+    return new AicLaneError(`managed query field ${JSON.stringify(field)} uses an unencodable value: ${detail}`);
+}
+function statusError(operation, status, expected) {
+    return new AicLaneError(`${operation} returned HTTP ${status}, expected ${expected}`, { status });
+}

package/dist/src/aic/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * AIC wrapper-journey lane. The same case definitions (`src/case`) drive this
+ * lane and the local Rhino lane; both are judged by `judge()` in verdict.ts.
+ */
+export { HARNESS_CALLBACK_ID, FAILURE_NODE_ID, SUCCESS_NODE_ID } from "./constants.ts";
+export { parseAuthenticateCallbacks } from "./callbacks.ts";
+export type { AuthenticateCallbacks } from "./callbacks.ts";
+export { chainFromRunResult, conform, conformChain } from "./conform.ts";
+export type { AicChainRunner, ChainConformanceInput, ChainConformanceReport, ChainPassReport, ConformanceInput, ConformanceReport, LaneResult, LaneRunner, LocalChainResult, } from "./conform.ts";
+export { diffRecordedEffects, judgeBoth } from "./diff.ts";
+export type { EffectsComparison, EffectsDisagreement, ObservationGap, } from "./diff.ts";
+export { emitLeasedJourney, emitWrapperJourney, subjectOutcomes } from "./emit-journey.ts";
+export type { EmitJourneyOptions, LeasedJourneyOptions, NodeResource, ScriptResource, WrapperInvoke, WrapperJourney, } from "./emit-journey.ts";
+export { AIC_LEASE_NAMESPACE, createLeaseIdentity, normalizedLeaseOutcomes, sha256, uuidV5, } from "./lease-identity.ts";
+export type { LeaseIdentity, LeaseIdentityOptions, LeaseResourceIds, } from "./lease-identity.ts";
+export { emitResultScript } from "./emit-result.ts";
+export { emitLeasedSessionJourney } from "./emit-session.ts";
+export { instrumentSubject } from "./emit-subject.ts";
+export type { InstrumentedSubject } from "./emit-subject.ts";
+export type { ManagedFixture } from "./managed.ts";
+export { AicFileLease } from "./file-lease.ts";
+export type { AicFileLeaseOptions, AicLeaseRunRequest } from "./file-lease.ts";
+export { acquireLeaseLock, addJournalFixture, addJournalResources, leaseStatePaths, newLeaseJournal, readLeaseJournal, removeJournalFixture, removeLeaseJournal, writeLeaseJournal, } from "./lease-lock.ts";
+export type { LeaseJournal, LeaseLock, LeaseStatePaths, } from "./lease-lock.ts";
+export { confirmResourceSnapshot, nodeRequestProjection, resourceRequestProjection, } from "./resource-snapshot.ts";
+export type { AicResourceKind } from "./resource-snapshot.ts";
+export { assembleEffects, classifyFinal, parseSubjectDump } from "./record.ts";
+export type { SubjectDump } from "./record.ts";
+export { runAicChain, runAicLane, validateAicRun } from "./run.ts";
+export type { AicReply, AicRunValidation, RunAicOptions } from "./run.ts";
+export { AicLaneError, AM_CONFIG_API_VERSION, amConfigHeaders, aicCliProvider, connectTenant, defaultAicIo, resolveTenantProvider, } from "./tenant.ts";
+export type { AicIo, ConnectOptions, TenantSession } from "./tenant.ts";
+export { checkTenantDescription, configuredTenantProvider, DEFAULT_SERVICE_ACCOUNT_SCOPE, logKeysReader, providerFromEnv, serviceAccountProvider, setTenantProvider, TENANT_ENV, tokenCallbackProvider, TenantProviderError, } from "./provider.ts";
+export type { HttpSend, LogKeys, LogReader, ServiceAccountOptions, TenantDescription, TenantProvider, TokenCallbackOptions, TokenRequest, } from "./provider.ts";
+export { aicUnsupportedReason } from "./unsupported.ts";

package/dist/src/aic/index.js

@@ -0,0 +1,21 @@
+/**
+ * AIC wrapper-journey lane. The same case definitions (`src/case`) drive this
+ * lane and the local Rhino lane; both are judged by `judge()` in verdict.ts.
+ */
+export { HARNESS_CALLBACK_ID, FAILURE_NODE_ID, SUCCESS_NODE_ID } from "./constants.js";
+export { parseAuthenticateCallbacks } from "./callbacks.js";
+export { chainFromRunResult, conform, conformChain } from "./conform.js";
+export { diffRecordedEffects, judgeBoth } from "./diff.js";
+export { emitLeasedJourney, emitWrapperJourney, subjectOutcomes } from "./emit-journey.js";
+export { AIC_LEASE_NAMESPACE, createLeaseIdentity, normalizedLeaseOutcomes, sha256, uuidV5, } from "./lease-identity.js";
+export { emitResultScript } from "./emit-result.js";
+export { emitLeasedSessionJourney } from "./emit-session.js";
+export { instrumentSubject } from "./emit-subject.js";
+export { AicFileLease } from "./file-lease.js";
+export { acquireLeaseLock, addJournalFixture, addJournalResources, leaseStatePaths, newLeaseJournal, readLeaseJournal, removeJournalFixture, removeLeaseJournal, writeLeaseJournal, } from "./lease-lock.js";
+export { confirmResourceSnapshot, nodeRequestProjection, resourceRequestProjection, } from "./resource-snapshot.js";
+export { assembleEffects, classifyFinal, parseSubjectDump } from "./record.js";
+export { runAicChain, runAicLane, validateAicRun } from "./run.js";
+export { AicLaneError, AM_CONFIG_API_VERSION, amConfigHeaders, aicCliProvider, connectTenant, defaultAicIo, resolveTenantProvider, } from "./tenant.js";
+export { checkTenantDescription, configuredTenantProvider, DEFAULT_SERVICE_ACCOUNT_SCOPE, logKeysReader, providerFromEnv, serviceAccountProvider, setTenantProvider, TENANT_ENV, tokenCallbackProvider, TenantProviderError, } from "./provider.js";
+export { aicUnsupportedReason } from "./unsupported.js";

package/dist/src/aic/js.d.ts

@@ -0,0 +1,8 @@
+import type { JsonValue } from "../case/types.ts";
+/**
+ * AM-safe expression that reconstructs `value` via `JSON.parse`.
+ * Avoids object shorthand, destructuring, and other Rhino parse errors
+ * that a hand-emitted object literal would have to dodge per property.
+ */
+export declare function jsonParseCall(value: JsonValue): string;
+export declare function jsStringLiteral(value: string): string;

package/dist/src/aic/js.js

@@ -0,0 +1,11 @@
+/**
+ * AM-safe expression that reconstructs `value` via `JSON.parse`.
+ * Avoids object shorthand, destructuring, and other Rhino parse errors
+ * that a hand-emitted object literal would have to dodge per property.
+ */
+export function jsonParseCall(value) {
+    return `JSON.parse(${JSON.stringify(JSON.stringify(value))})`;
+}
+export function jsStringLiteral(value) {
+    return JSON.stringify(value);
+}

package/dist/src/aic/lease-identity.d.ts

@@ -0,0 +1,38 @@
+/**
+ * A private UUID namespace for rhino-local AIC lease resources.
+ *
+ * Changing it would orphan residue addressed by an earlier harness version.
+ */
+export declare const AIC_LEASE_NAMESPACE = "b42f3f57-ec8e-5e9f-9a2b-59cc9e9d45d0";
+export interface LeaseResourceIds {
+    subjectScript: string;
+    subjectNode: string;
+    resultScripts: Readonly<Record<string, string>>;
+    resultNodes: Readonly<Record<string, string>>;
+    sessionTree: string;
+    sessionScript: string;
+    sessionNode: string;
+}
+export interface LeaseIdentity {
+    id: string;
+    idHash: string;
+    treeName: string;
+    snapshotKey: string;
+    outcomes: readonly string[];
+    ids: LeaseResourceIds;
+    authorDigest: string;
+    structuralDigest: string;
+    ownerToken: string;
+    marker: string;
+}
+export interface LeaseIdentityOptions {
+    id: string;
+    source: string;
+    outcomes: readonly string[];
+    ownerToken?: string;
+}
+export declare function createLeaseIdentity(options: LeaseIdentityOptions): LeaseIdentity;
+export declare function normalizedLeaseOutcomes(outcomes: readonly string[]): string[];
+export declare function sha256(value: string): string;
+/** RFC 4122 UUIDv5 without adding a dependency. */
+export declare function uuidV5(name: string): string;

package/dist/src/aic/lease-identity.js

@@ -0,0 +1,72 @@
+/** Stable resource addressing and per-open ownership for the AIC file lease. */
+import { createHash, randomUUID } from "node:crypto";
+/**
+ * A private UUID namespace for rhino-local AIC lease resources.
+ *
+ * Changing it would orphan residue addressed by an earlier harness version.
+ */
+export const AIC_LEASE_NAMESPACE = "b42f3f57-ec8e-5e9f-9a2b-59cc9e9d45d0";
+export function createLeaseIdentity(options) {
+    const id = options.id.trim();
+    if (id.length === 0) {
+        throw new Error("rhino-local: aic.id must not be empty");
+    }
+    const outcomes = normalizedLeaseOutcomes(options.outcomes);
+    const idHash = sha256(id).slice(0, 20);
+    const treeName = `rl-aic-${idHash}`;
+    const resultScripts = {};
+    const resultNodes = {};
+    for (const outcome of outcomes) {
+        resultScripts[outcome] = uuidV5(`${id}:result-script:${outcome}`);
+        resultNodes[outcome] = uuidV5(`${id}:result-node:${outcome}`);
+    }
+    const authorDigest = sha256(options.source);
+    const structuralDigest = sha256(JSON.stringify({ schema: 1, id, outcomes }));
+    const ownerToken = options.ownerToken ?? randomUUID();
+    const marker = [
+        "rhino-local:v1",
+        idHash,
+        ownerToken,
+        authorDigest,
+        structuralDigest,
+    ].join(":");
+    return {
+        id,
+        idHash,
+        treeName,
+        snapshotKey: `__rhino_local_snapshot_${idHash}`,
+        outcomes,
+        ids: {
+            subjectScript: uuidV5(`${id}:subject-script`),
+            subjectNode: uuidV5(`${id}:subject-node`),
+            resultScripts,
+            resultNodes,
+            sessionTree: `rl-aic-${sha256(`${id}:session-tree`).slice(0, 20)}`,
+            sessionScript: uuidV5(`${id}:session-script`),
+            sessionNode: uuidV5(`${id}:session-node`),
+        },
+        authorDigest,
+        structuralDigest,
+        ownerToken,
+        marker,
+    };
+}
+export function normalizedLeaseOutcomes(outcomes) {
+    return [...new Set(["true", "false", ...outcomes])];
+}
+export function sha256(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}
+/** RFC 4122 UUIDv5 without adding a dependency. */
+export function uuidV5(name) {
+    const namespace = Buffer.from(AIC_LEASE_NAMESPACE.replace(/-/g, ""), "hex");
+    const bytes = createHash("sha1")
+        .update(namespace)
+        .update(name, "utf8")
+        .digest()
+        .subarray(0, 16);
+    bytes[6] = ((bytes[6] ?? 0) & 0x0f) | 0x50;
+    bytes[8] = ((bytes[8] ?? 0) & 0x3f) | 0x80;
+    const hex = bytes.toString("hex");
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}

package/dist/src/aic/lease-lock.d.ts

@@ -0,0 +1,45 @@
+import type { LeaseIdentity } from "./lease-identity.ts";
+import type { CreatedResource } from "./run.ts";
+export interface LeaseJournal {
+    version: 1;
+    tenantHash: string;
+    aicId: string;
+    realm: string;
+    treeName: string;
+    ownerToken: string;
+    resources: CreatedResource[];
+    managedFixtures: Array<{
+        type: string;
+        id: string;
+    }>;
+}
+export interface LeaseStatePaths {
+    root: string;
+    lockDir: string;
+    ownerPath: string;
+    journalPath: string;
+    tenantHash: string;
+}
+export interface LeaseLock {
+    paths: LeaseStatePaths;
+    release(): Promise<void>;
+}
+export declare function leaseStatePaths(baseUrl: string, identity: LeaseIdentity, root?: string): LeaseStatePaths;
+export declare function acquireLeaseLock(paths: LeaseStatePaths, identity: LeaseIdentity, options?: {
+    timeoutMs?: number;
+    processExists?: (pid: number) => boolean;
+    pollMs?: number;
+}): Promise<LeaseLock>;
+export declare function newLeaseJournal(paths: LeaseStatePaths, identity: LeaseIdentity, realm: string, resources: readonly CreatedResource[]): LeaseJournal;
+export declare function readLeaseJournal(path: string): Promise<LeaseJournal | undefined>;
+export declare function writeLeaseJournal(path: string, journal: LeaseJournal): Promise<void>;
+export declare function removeLeaseJournal(path: string): Promise<void>;
+export declare function addJournalFixture(path: string, fixture: {
+    type: string;
+    id: string;
+}): Promise<void>;
+export declare function addJournalResources(path: string, resources: readonly CreatedResource[]): Promise<void>;
+export declare function removeJournalFixture(path: string, fixture: {
+    type: string;
+    id: string;
+}): Promise<void>;

package/dist/src/aic/lease-lock.js

@@ -0,0 +1,173 @@
+/** Local process lock and identifier-only crash journal for an AIC file lease. */
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { sha256 } from "./lease-identity.js";
+import { AicLaneError } from "./tenant.js";
+export function leaseStatePaths(baseUrl, identity, root = join(tmpdir(), "rhino-local-aic-leases")) {
+    const tenantHash = sha256(baseUrl).slice(0, 20);
+    const key = `${tenantHash}-${identity.idHash}`;
+    const lockDir = join(root, `${key}.lock`);
+    return {
+        root,
+        lockDir,
+        ownerPath: join(lockDir, "owner.json"),
+        journalPath: join(root, `${key}.journal.json`),
+        tenantHash,
+    };
+}
+export async function acquireLeaseLock(paths, identity, options = {}) {
+    await mkdir(paths.root, { recursive: true, mode: 0o700 });
+    const deadline = Date.now() + (options.timeoutMs ?? 120_000);
+    const isAlive = options.processExists ?? processExists;
+    for (;;) {
+        try {
+            await mkdir(paths.lockDir, { mode: 0o700 });
+            break;
+        }
+        catch (error) {
+            if (!hasCode(error, "EEXIST")) {
+                throw error;
+            }
+        }
+        const owner = await readJson(paths.ownerPath);
+        if (owner !== undefined && !isAlive(owner.pid)) {
+            await rm(paths.lockDir, { recursive: true, force: true });
+            continue;
+        }
+        if (Date.now() >= deadline) {
+            throw new AicLaneError(`timed out waiting for AIC file lease ${JSON.stringify(identity.id)}${owner === undefined ? "" : ` held by pid ${owner.pid}`}`);
+        }
+        await delay(options.pollMs ?? 100);
+    }
+    const owner = {
+        pid: process.pid,
+        ownerToken: identity.ownerToken,
+        aicId: identity.id,
+    };
+    try {
+        await writeFile(paths.ownerPath, JSON.stringify(owner), {
+            encoding: "utf8",
+            mode: 0o600,
+            flag: "wx",
+        });
+    }
+    catch (error) {
+        await rm(paths.lockDir, { recursive: true, force: true });
+        throw error;
+    }
+    let released = false;
+    return {
+        paths,
+        async release() {
+            if (released) {
+                return;
+            }
+            const current = await readJson(paths.ownerPath);
+            if (current?.ownerToken === identity.ownerToken) {
+                await rm(paths.lockDir, { recursive: true, force: true });
+            }
+            released = true;
+        },
+    };
+}
+export function newLeaseJournal(paths, identity, realm, resources) {
+    return {
+        version: 1,
+        tenantHash: paths.tenantHash,
+        aicId: identity.id,
+        realm,
+        treeName: identity.treeName,
+        ownerToken: identity.ownerToken,
+        resources: resources.map((resource) => ({ ...resource })),
+        managedFixtures: [],
+    };
+}
+export async function readLeaseJournal(path) {
+    return readJson(path);
+}
+export async function writeLeaseJournal(path, journal) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    await writeFile(temporary, JSON.stringify(journal), {
+        encoding: "utf8",
+        mode: 0o600,
+        flag: "wx",
+    });
+    await rename(temporary, path);
+}
+export async function removeLeaseJournal(path) {
+    await rm(path, { force: true });
+}
+export async function addJournalFixture(path, fixture) {
+    const journal = await requireJournal(path);
+    if (!journal.managedFixtures.some((item) => item.type === fixture.type && item.id === fixture.id)) {
+        journal.managedFixtures.push(fixture);
+        await writeLeaseJournal(path, journal);
+    }
+}
+export async function addJournalResources(path, resources) {
+    const journal = await requireJournal(path);
+    for (const resource of resources) {
+        if (!journal.resources.some((item) => sameResource(item, resource))) {
+            journal.resources.push({ ...resource });
+        }
+    }
+    await writeLeaseJournal(path, journal);
+}
+export async function removeJournalFixture(path, fixture) {
+    const journal = await requireJournal(path);
+    journal.managedFixtures = journal.managedFixtures.filter((item) => item.type !== fixture.type || item.id !== fixture.id);
+    await writeLeaseJournal(path, journal);
+}
+async function requireJournal(path) {
+    const journal = await readLeaseJournal(path);
+    if (journal === undefined) {
+        throw new AicLaneError("AIC file lease ownership journal is missing");
+    }
+    return journal;
+}
+async function readJson(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (hasCode(error, "ENOENT")) {
+            return undefined;
+        }
+        throw new AicLaneError(`could not read AIC file lease state at ${path}`, {
+            cause: error,
+        });
+    }
+}
+function processExists(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return hasCode(error, "EPERM");
+    }
+}
+function sameResource(left, right) {
+    if (left.kind !== right.kind) {
+        return false;
+    }
+    if (left.kind === "tree" && right.kind === "tree") {
+        return left.name === right.name;
+    }
+    if (left.kind !== "tree" && right.kind !== "tree") {
+        return left.id === right.id;
+    }
+    return false;
+}
+function hasCode(error, code) {
+    return (typeof error === "object" &&
+        error !== null &&
+        "code" in error &&
+        error.code === code);
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/dist/src/aic/managed.d.ts

@@ -0,0 +1,28 @@
+import type { Given, JsonObject } from "../case/types.ts";
+import { type AicIo, type TenantSession } from "./tenant.ts";
+export interface ManagedFixture {
+    type: string;
+    record: JsonObject;
+}
+export interface SeededManagedFixture {
+    type: string;
+    id: string;
+}
+/** Whether the first pass's managed seed came exactly from this fixture ledger. */
+export declare function managedSeedMatches(managed: Given["managed"], fixtures: readonly ManagedFixture[]): boolean;
+/** Create with CREST's create-only request, then prove every declared field landed. */
+export declare function seedManagedFixtures(io: AicIo, session: TenantSession, fixtures: readonly ManagedFixture[], seeded: SeededManagedFixture[]): Promise<void>;
+/** Delete one fixture the harness successfully created. A prior script delete is clean. */
+export declare function deleteManagedFixture(io: AicIo, session: TenantSession, fixture: SeededManagedFixture): Promise<void>;
+/**
+ * Serialize managed-fixture runs across worker processes for one tenant.
+ * A collision after this lock is acquired is therefore pre-existing state,
+ * not two files in this harness racing each other.
+ */
+export declare function acquireManagedFixtureLock(session: TenantSession, label: string): Promise<() => Promise<void>>;
+export declare function fixtureIdentity(fixture: ManagedFixture): {
+    collection: string;
+    id: string;
+    resource: string;
+};
+export declare function managedResource(type: string, id: string): string;