@foss.global/forgefixtures 0.2.0

package/.smartconfig.json

@@ -0,0 +1,49 @@
+{
+  "@git.zone/cli": {
+    "schemaVersion": 2,
+    "projectType": "npm",
+    "module": {
+      "githost": "code.foss.global",
+      "gitscope": "foss.global",
+      "gitrepo": "forgefixtures",
+      "description": "Disposable, digest-pinned Gitea and GitLab CE fixtures with owned cleanup, local TLS and ground-truth seed data for forge integration tests.",
+      "npmPackagename": "@foss.global/forgefixtures",
+      "license": "MIT",
+      "projectDomain": "foss.global",
+      "keywords": [
+        "foss.global",
+        "gitea",
+        "gitlab",
+        "forge",
+        "fixtures",
+        "docker",
+        "integration testing",
+        "typescript"
+      ]
+    },
+    "release": {
+      "preflight": {
+        "requireCleanTree": true,
+        "test": true,
+        "build": true
+      },
+      "targets": {
+        "git": {
+          "enabled": true,
+          "remote": "origin",
+          "pushBranch": true,
+          "pushTags": true
+        },
+        "npm": {
+          "enabled": true,
+          "registries": [
+            "https://verdaccio.lossless.digital",
+            "https://registry.npmjs.org"
+          ],
+          "accessLevel": "public",
+          "alreadyPublished": "success"
+        }
+      }
+    }
+  }
+}

package/changelog.md

@@ -0,0 +1,17 @@
+# Changelog
+
+## 2026-09-25 - 0.2.0
+
+### Features
+
+- add disposable, digest-pinned Gitea fixtures with owned cleanup (gitea)
+  - Start `gitea/gitea:1.27.3-rootless` by index digest behind an in-process TLS-terminating reverse proxy with a lifecycle-local certificate authority, and verify the reported version against the pin.
+  - Bootstrap an administrator and access tokens through Gitea's admin CLI; expose a scoped HTTPS client that trusts only the fixture CA and origin.
+  - Label every container, network and volume with lifecycle ownership and reap the resources of expired owners, of owners on this host that rebooted, and of exited owners in the same PID namespace before each start; a stop during start cancels it and removes what it created.
+  - Seed users, organizations, repositories, branches, labels, milestones, tags, issues, pull requests, releases and Git LFS objects through the documented APIs and return a manifest read back from Gitea.
+- add disposable, digest-pinned GitLab CE fixtures on a rootless Docker daemon (gitlab)
+  - Start `gitlab/gitlab-ce:19.4.1-ce.0` by index digest as root on the current user's rootless daemon with GitLab's memory-constrained omnibus settings behind the TLS terminator, limited to 5 GiB memory, 4 CPUs and 4096 PIDs; ready once reconfigure finished, the container is healthy, the API answers and the pinned version is reported.
+  - Create personal access tokens through `gitlab-rails runner` with the script on stdin.
+  - Seed users, nested groups, public, internal and private projects, members, branches, labels, milestones, tags, issues (confidential issues and incidents), merge requests and releases through the REST API, fail when GitLab silently drops an attribute, and return a manifest read back from GitLab.
+  - Record the owner's machine ID in the ownership labels; owners on another machine are judged by expiry only, labels without a machine ID are never interpreted, and a process whose system has no valid `/etc/machine-id` uses a random ID fixed for its lifetime.
+  - Choose the published loopback port from the kernel's free ports, because a rootless daemon allocates ports blind to host listeners.

package/dist_ts/00_commitinfo_data.d.ts

@@ -0,0 +1,8 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export declare const commitinfo: {
+    name: string;
+    version: string;
+    description: string;
+};

package/dist_ts/00_commitinfo_data.js

@@ -0,0 +1,9 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export const commitinfo = {
+    name: '@foss.global/forgefixtures',
+    version: '0.2.0',
+    description: 'Disposable, digest-pinned Gitea and GitLab CE fixtures with owned cleanup, local TLS and ground-truth seed data for forge integration tests.'
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSw0QkFBNEI7SUFDbEMsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDhJQUE4STtDQUM1SixDQUFBIn0=

package/dist_ts/classes.certificateauthority.d.ts

@@ -0,0 +1,22 @@
+export interface IForgeFixtureServerCertificate {
+    certificatePem: string;
+    privateKeyPem: string;
+}
+export interface IForgeFixtureServerCertificateRequest {
+    ipAddresses: string[];
+    dnsNames: string[];
+}
+/**
+ * A certificate authority that exists only in the memory of one fixture
+ * lifecycle. Its private key is never exported; callers receive the public CA
+ * certificate to trust and freshly issued server leaves.
+ */
+export declare class ForgeFixtureCertificateAuthority {
+    #private;
+    static create(lifecycleIdArg: string, validityMsArg: number): Promise<ForgeFixtureCertificateAuthority>;
+    private constructor();
+    /** Public CA certificate for scoped trust by fixture clients. */
+    get certificatePem(): string;
+    /** Issues a server leaf within the CA validity for exactly the requested names. */
+    issueServerCertificate(requestArg: IForgeFixtureServerCertificateRequest): Promise<IForgeFixtureServerCertificate>;
+}

package/dist_ts/classes.certificateauthority.js

@@ -0,0 +1,93 @@
+import * as plugins from './plugins.js';
+const certificateBackdateMs = 5 * 60 * 1000;
+const signingAlgorithm = { name: 'ECDSA', hash: 'SHA-256' };
+const generateP256KeyPair = async () => globalThis.crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
+const exportPrivateKeyPem = async (privateKeyArg) => {
+    const der = await globalThis.crypto.subtle.exportKey('pkcs8', privateKeyArg);
+    return plugins.crypto.createPrivateKey({ key: Buffer.from(der), format: 'der', type: 'pkcs8' })
+        .export({ format: 'pem', type: 'pkcs8' }).toString();
+};
+/**
+ * A certificate authority that exists only in the memory of one fixture
+ * lifecycle. Its private key is never exported; callers receive the public CA
+ * certificate to trust and freshly issued server leaves.
+ */
+export class ForgeFixtureCertificateAuthority {
+    static async create(lifecycleIdArg, validityMsArg) {
+        if (!lifecycleIdArg || /[,=+<>#;"\\]/.test(lifecycleIdArg)) {
+            throw new TypeError('The certificate authority lifecycle id is malformed.');
+        }
+        if (!Number.isSafeInteger(validityMsArg) || validityMsArg < 60_000) {
+            throw new TypeError('The certificate authority validity must be an integer of at least 60000 ms.');
+        }
+        const keys = await generateP256KeyPair();
+        const now = Date.now();
+        const certificate = await plugins.x509.X509CertificateGenerator.createSelfSigned({
+            serialNumber: plugins.crypto.randomBytes(16).toString('hex'),
+            name: `CN=forgefixtures ${lifecycleIdArg}`,
+            notBefore: new Date(now - certificateBackdateMs),
+            notAfter: new Date(now + validityMsArg),
+            signingAlgorithm,
+            keys,
+            extensions: [
+                new plugins.x509.BasicConstraintsExtension(true, 0, true),
+                new plugins.x509.KeyUsagesExtension(plugins.x509.KeyUsageFlags.keyCertSign | plugins.x509.KeyUsageFlags.cRLSign, true),
+                await plugins.x509.SubjectKeyIdentifierExtension.create(keys.publicKey),
+                await plugins.x509.AuthorityKeyIdentifierExtension.create(keys.publicKey),
+            ],
+        });
+        return new ForgeFixtureCertificateAuthority(certificate, keys.privateKey);
+    }
+    #certificate;
+    #signingKey;
+    constructor(certificateArg, signingKeyArg) {
+        this.#certificate = certificateArg;
+        this.#signingKey = signingKeyArg;
+    }
+    /** Public CA certificate for scoped trust by fixture clients. */
+    get certificatePem() {
+        return this.#certificate.toString('pem');
+    }
+    /** Issues a server leaf within the CA validity for exactly the requested names. */
+    async issueServerCertificate(requestArg) {
+        const names = [
+            ...requestArg.ipAddresses.map((ipArg) => {
+                if (plugins.net.isIP(ipArg) === 0)
+                    throw new TypeError(`"${ipArg}" is not an IP address.`);
+                return { type: 'ip', value: ipArg };
+            }),
+            ...requestArg.dnsNames.map((dnsNameArg) => {
+                if (!/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/.test(dnsNameArg)) {
+                    throw new TypeError(`"${dnsNameArg}" is not an exact lowercase DNS name.`);
+                }
+                return { type: 'dns', value: dnsNameArg };
+            }),
+        ];
+        if (names.length === 0)
+            throw new TypeError('A server certificate needs at least one name.');
+        const keys = await generateP256KeyPair();
+        const certificate = await plugins.x509.X509CertificateGenerator.create({
+            serialNumber: plugins.crypto.randomBytes(16).toString('hex'),
+            subject: `CN=${names[0].value}`,
+            issuer: this.#certificate.subjectName,
+            notBefore: this.#certificate.notBefore,
+            notAfter: this.#certificate.notAfter,
+            signingAlgorithm,
+            publicKey: keys.publicKey,
+            signingKey: this.#signingKey,
+            extensions: [
+                new plugins.x509.BasicConstraintsExtension(false, undefined, true),
+                new plugins.x509.KeyUsagesExtension(plugins.x509.KeyUsageFlags.digitalSignature, true),
+                new plugins.x509.ExtendedKeyUsageExtension([plugins.x509.ExtendedKeyUsage.serverAuth]),
+                new plugins.x509.SubjectAlternativeNameExtension(names),
+                await plugins.x509.SubjectKeyIdentifierExtension.create(keys.publicKey),
+                await plugins.x509.AuthorityKeyIdentifierExtension.create(this.#certificate.publicKey),
+            ],
+        });
+        return {
+            certificatePem: certificate.toString('pem'),
+            privateKeyPem: await exportPrivateKeyPem(keys.privateKey),
+        };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5jZXJ0aWZpY2F0ZWF1dGhvcml0eS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2NsYXNzZXMuY2VydGlmaWNhdGVhdXRob3JpdHkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFZeEMsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztBQUM1QyxNQUFNLGdCQUFnQixHQUFHLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLENBQUM7QUFFNUQsTUFBTSxtQkFBbUIsR0FBRyxLQUFLLElBQTRCLEVBQUUsQ0FDN0QsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsT0FBTyxFQUFFLEVBQUUsSUFBSSxFQUFFLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFFekcsTUFBTSxtQkFBbUIsR0FBRyxLQUFLLEVBQUUsYUFBd0IsRUFBbUIsRUFBRTtJQUM5RSxNQUFNLEdBQUcsR0FBRyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxPQUFPLEVBQUUsYUFBYSxDQUFDLENBQUM7SUFDN0UsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUM7U0FDNUYsTUFBTSxDQUFDLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztBQUN6RCxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxPQUFPLGdDQUFnQztJQUNwQyxNQUFNLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FDeEIsY0FBc0IsRUFDdEIsYUFBcUI7UUFFckIsSUFBSSxDQUFDLGNBQWMsSUFBSSxjQUFjLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7WUFDM0QsTUFBTSxJQUFJLFNBQVMsQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO1FBQzlFLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUMsSUFBSSxhQUFhLEdBQUcsTUFBTSxFQUFFLENBQUM7WUFDbkUsTUFBTSxJQUFJLFNBQVMsQ0FBQyw2RUFBNkUsQ0FBQyxDQUFDO1FBQ3JHLENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxNQUFNLG1CQUFtQixFQUFFLENBQUM7UUFDekMsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sV0FBVyxHQUFHLE1BQU0sT0FBTyxDQUFDLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxnQkFBZ0IsQ0FBQztZQUMvRSxZQUFZLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztZQUM1RCxJQUFJLEVBQUUsb0JBQW9CLGNBQWMsRUFBRTtZQUMxQyxTQUFTLEVBQUUsSUFBSSxJQUFJLENBQUMsR0FBRyxHQUFHLHFCQUFxQixDQUFDO1lBQ2hELFFBQVEsRUFBRSxJQUFJLElBQUksQ0FBQyxHQUFHLEdBQUcsYUFBYSxDQUFDO1lBQ3ZDLGdCQUFnQjtZQUNoQixJQUFJO1lBQ0osVUFBVSxFQUFFO2dCQUNWLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyx5QkFBeUIsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxFQUFFLElBQUksQ0FBQztnQkFDekQsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUNqQyxPQUFPLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxXQUFXLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUMzRSxJQUFJLENBQ0w7Z0JBQ0QsTUFBTSxPQUFPLENBQUMsSUFBSSxDQUFDLDZCQUE2QixDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO2dCQUN2RSxNQUFNLE9BQU8sQ0FBQyxJQUFJLENBQUMsK0JBQStCLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7YUFDMUU7U0FDRixDQUFDLENBQUM7UUFDSCxPQUFPLElBQUksZ0NBQWdDLENBQUMsV0FBVyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBRVEsWUFBWSxDQUErQjtJQUMzQyxXQUFXLENBQVk7SUFFaEMsWUFBb0IsY0FBNEMsRUFBRSxhQUF3QjtRQUN4RixJQUFJLENBQUMsWUFBWSxHQUFHLGNBQWMsQ0FBQztRQUNuQyxJQUFJLENBQUMsV0FBVyxHQUFHLGFBQWEsQ0FBQztJQUNuQyxDQUFDO0lBRUQsaUVBQWlFO0lBQ2pFLElBQVcsY0FBYztRQUN2QixPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzNDLENBQUM7SUFFRCxtRkFBbUY7SUFDNUUsS0FBSyxDQUFDLHNCQUFzQixDQUNqQyxVQUFpRDtRQUVqRCxNQUFNLEtBQUssR0FBRztZQUNaLEdBQUcsVUFBVSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRTtnQkFDdEMsSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDO29CQUFFLE1BQU0sSUFBSSxTQUFTLENBQUMsSUFBSSxLQUFLLHlCQUF5QixDQUFDLENBQUM7Z0JBQzNGLE9BQU8sRUFBRSxJQUFJLEVBQUUsSUFBYSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsQ0FBQztZQUMvQyxDQUFDLENBQUM7WUFDRixHQUFHLFVBQVUsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsVUFBVSxFQUFFLEVBQUU7Z0JBQ3hDLElBQUksQ0FBQyw2RUFBNkUsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztvQkFDcEcsTUFBTSxJQUFJLFNBQVMsQ0FBQyxJQUFJLFVBQVUsdUNBQXVDLENBQUMsQ0FBQztnQkFDN0UsQ0FBQztnQkFDRCxPQUFPLEVBQUUsSUFBSSxFQUFFLEtBQWMsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLENBQUM7WUFDckQsQ0FBQyxDQUFDO1NBQ0gsQ0FBQztRQUNGLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDO1lBQUUsTUFBTSxJQUFJLFNBQVMsQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO1FBQzdGLE1BQU0sSUFBSSxHQUFHLE1BQU0sbUJBQW1CLEVBQUUsQ0FBQztRQUN6QyxNQUFNLFdBQVcsR0FBRyxNQUFNLE9BQU8sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLENBQUMsTUFBTSxDQUFDO1lBQ3JFLFlBQVksRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDO1lBQzVELE9BQU8sRUFBRSxNQUFNLEtBQUssQ0FBQyxDQUFDLENBQUUsQ0FBQyxLQUFLLEVBQUU7WUFDaEMsTUFBTSxFQUFFLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVztZQUNyQyxTQUFTLEVBQUUsSUFBSSxDQUFDLFlBQVksQ0FBQyxTQUFTO1lBQ3RDLFFBQVEsRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVE7WUFDcEMsZ0JBQWdCO1lBQ2hCLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztZQUN6QixVQUFVLEVBQUUsSUFBSSxDQUFDLFdBQVc7WUFDNUIsVUFBVSxFQUFFO2dCQUNWLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyx5QkFBeUIsQ0FBQyxLQUFLLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQztnQkFDbEUsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLGdCQUFnQixFQUFFLElBQUksQ0FBQztnQkFDdEYsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztnQkFDdEYsSUFBSSxPQUFPLENBQUMsSUFBSSxDQUFDLCtCQUErQixDQUFDLEtBQUssQ0FBQztnQkFDdkQsTUFBTSxPQUFPLENBQUMsSUFBSSxDQUFDLDZCQUE2QixDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO2dCQUN2RSxNQUFNLE9BQU8sQ0FBQyxJQUFJLENBQUMsK0JBQStCLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDO2FBQ3ZGO1NBQ0YsQ0FBQyxDQUFDO1FBQ0gsT0FBTztZQUNMLGNBQWMsRUFBRSxXQUFXLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztZQUMzQyxhQUFhLEVBQUUsTUFBTSxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDO1NBQzFELENBQUM7SUFDSixDQUFDO0NBQ0YifQ==

package/dist_ts/classes.containerlifecycle.d.ts

@@ -0,0 +1,88 @@
+import * as plugins from './plugins.js';
+import { ForgeFixtureHttpClient } from './classes.httpclient.js';
+import type { IForgeFixtureEndpoint, IForgeFixtureImage, IForgeFixtureLifecycleOptions, IForgeFixtureReapReport, TForgeFixtureKind } from './interfaces.js';
+/** What a forge driver asks the lifecycle to run. */
+export interface IForgeFixtureContainerSpec {
+    image: IForgeFixtureImage;
+    /** Explicit container user. Root requires `allowRootOnRootless` and a verified rootless daemon. */
+    user: string;
+    allowRootOnRootless?: true;
+    command: plugins.docker.TContainerCommand;
+    env: Record<string, string>;
+    /** Plain-HTTP port inside the container that the TLS terminator forwards to. */
+    httpPort: number;
+    tmpfsMounts?: plugins.docker.IContainerTmpfsMount[];
+    /** Named volumes created and removed by this lifecycle, mounted at `target`. */
+    volumes?: Array<{
+        purpose: string;
+        target: string;
+    }>;
+    memoryBytes: number;
+    nanoCpus: number;
+    pidsLimit: number;
+    shmSizeBytes?: number;
+    stopTimeoutSeconds: number;
+    healthcheck?: plugins.docker.IContainerHealthcheck;
+}
+export type TForgeFixtureContainerHealth = 'none' | 'starting' | 'healthy' | 'unhealthy';
+export type TForgeFixtureLifecycleState = 'idle' | 'preparing' | 'prepared' | 'starting' | 'running' | 'stopping' | 'stopped';
+/** Raised by lifecycle steps that observe a stop request. */
+export declare class ForgeFixtureStoppedError extends Error {
+    constructor(kindArg: TForgeFixtureKind, optionsArg?: ErrorOptions);
+}
+/**
+ * Owns one fixture's Docker resources, local CA, TLS terminator and scoped
+ * HTTPS client. Every resource carries ownership labels, so resources left by a
+ * crashed process are removed by the next lifecycle's reaper run.
+ */
+export declare class ForgeFixtureContainerLifecycle {
+    #private;
+    constructor(kindArg: TForgeFixtureKind, optionsArg: IForgeFixtureLifecycleOptions, startupTimeoutMsArg: number);
+    get state(): TForgeFixtureLifecycleState;
+    get startupTimeoutMs(): number;
+    get lifecycleId(): string;
+    get endpoint(): IForgeFixtureEndpoint;
+    get http(): ForgeFixtureHttpClient;
+    get dockerHost(): plugins.docker.DockerHost;
+    /** Aborted once `stop()` or `requestStop()` was called. */
+    get stopSignal(): AbortSignal;
+    /** Throws {@link ForgeFixtureStoppedError} once a stop was requested. */
+    assertNotStopping(): void;
+    /**
+     * Once a stop was requested, any failure it provoked (an aborted pull, a
+     * refused request) is reported as {@link ForgeFixtureStoppedError} with the
+     * original failure as its cause.
+     */
+    stopAwareError(errorArg: unknown): unknown;
+    /**
+     * Marks the lifecycle as stopping without waiting. Running steps observe it
+     * at their next checkpoint, an image pull is cancelled, and the lifecycle can
+     * no longer be prepared or started.
+     */
+    requestStop(): void;
+    /** Report of the reaper run that preceded this lifecycle. */
+    get lastReapReport(): IForgeFixtureReapReport | undefined;
+    /**
+     * Reaps stale fixtures, creates ownership, CA and TLS terminator. The
+     * returned endpoint is final: its port is bound before the forge starts.
+     */
+    prepare(): Promise<IForgeFixtureEndpoint>;
+    /** Pulls the pinned image, creates the owned network and container, starts it and wires the terminator. */
+    startContainer(specArg: IForgeFixtureContainerSpec): Promise<void>;
+    /** Runs argv in the container as its configured user. Never logs stdin or output. */
+    exec(commandArg: plugins.docker.TContainerCommand, optionsArg?: plugins.docker.IContainerExecOptions): Promise<plugins.docker.IContainerExecResult>;
+    /** Fails with the container's exit state and recent logs when it stopped running. */
+    assertContainerRunning(): Promise<void>;
+    /** Docker's view of the container healthcheck (`none` without a healthcheck). */
+    containerHealth(): Promise<TForgeFixtureContainerHealth>;
+    /** Recent container logs, for diagnostics after a failed readiness wait. */
+    logsTail(linesArg: number): Promise<string>;
+    /**
+     * Requests a stop, waits for a running prepare or container start to observe
+     * it, then removes every owned resource in dependency order, including those
+     * that step created. Idempotent. When a removal fails, the remaining
+     * resources stay recorded and a later call retries them; the failures are
+     * thrown together.
+     */
+    stop(): Promise<void>;
+}