@invarn/cibuild 2.9.5 → 2.9.7

package/dist/src/yaml/a-runtime-requirement-names-a-real-provider.test.js

@@ -1,66 +0,0 @@
-/**
- * A requirement that cannot be checked yet must not name a step as its source
- * unless a step is its source.
- *
- * Nine runtime requirements — `gradlew` in the three Android steps and the
- * Bitrise gradle wrapper, `project_path` in five Xcode steps — carried
- * `providedBy: 'git-clone'`. The lookup behind `providedBy` is keyed by step
- * *output names* (`CIBUILD_SOURCE_DIR`, `GIT_CLONE_COMMIT_HASH`, …) and these
- * requirements are named after a path or a command, so it could never match:
- * every Android validation printed "'gradlew' will be provided by 'git-clone'
- * step at runtime" whether the step was in the workflow or not.
- *
- * `git-clone` provides no files at all — the runner's checkout does, before
- * any step runs — and once it is out of the curated templates the sentence
- * names a step the pipeline does not contain.
- */
-import { describe, test, expect } from '@jest/globals';
-import './steps/index.js';
-import { StepValidator } from './step-validator.js';
-import { loadConfig } from '../config.js';
-const config = loadConfig();
-/** An Android workflow with no `git-clone` step, as issue 05 leaves it. */
-function gradlePipeline() {
-    return {
-        format_version: '1',
-        meta: { invarn: { stack: 'linux-android-35' } },
-        app: { envs: [{ JAVA_HOME: '/usr/lib/jvm/java-21' }] },
-        workflows: {
-            primary: {
-                steps: [
-                    {
-                        'gradle-build@1.0.0': {
-                            title: 'Build Debug APK',
-                            inputs: { gradle_task: 'assembleDebug' },
-                        },
-                    },
-                ],
-            },
-        },
-    };
-}
-describe('a runtime requirement names a real provider', () => {
-    test('a clone-free workflow never mentions git-clone', async () => {
-        const validator = new StepValidator(gradlePipeline(), 'primary', config);
-        const result = await validator.validateWorkflow();
-        const messages = result.issues.map((i) => i.result.message ?? '').join('\n');
-        expect(messages).not.toContain('git-clone');
-    });
-    test('the checkout is named as the source of the gradle wrapper', async () => {
-        const validator = new StepValidator(gradlePipeline(), 'primary', config);
-        const result = await validator.validateWorkflow();
-        const gradlew = result.issues.find((i) => i.requirement.name === 'gradlew');
-        expect(gradlew).toBeDefined();
-        expect(gradlew.requirement.severity).toBe('info');
-        expect(gradlew.result.message).toContain('the checkout');
-        // The wording must not promise a step: no step puts the wrapper on disk.
-        expect(gradlew.result.message).not.toMatch(/'the checkout' step/);
-    });
-    test('the info does not fail validation', async () => {
-        const validator = new StepValidator(gradlePipeline(), 'primary', config);
-        const result = await validator.validateWorkflow();
-        expect(result.valid).toBe(true);
-        expect(result.counts.errors).toBe(0);
-    });
-});
-//# sourceMappingURL=a-runtime-requirement-names-a-real-provider.test.js.map

package/dist/src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts

@@ -1,34 +0,0 @@
-/**
- * A credential slot scoped to a workflow the pipeline does not have refuses
- * the build, instead of silently belonging to nobody.
- *
- * The declaration `CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: ""` means "this
- * credential, for the workflow called `primary`". Nothing checked that a
- * workflow by that name existed, and every way of getting the name wrong fails
- * quietly:
- *
- *   - **A typo.** `CIBUILD_SW__PRIMRAY__X` decodes to workflow `primray`. No
- *     workflow is called that, so no workflow declares `X`, so `file@1.0.0`
- *     finds no key in its map, calls the credential optional, and skips it with
- *     a warning — the green-step failure mode issue 03 exists to end. The
- *     upload half is equally quiet: `ci secrets upload` encodes a value for
- *     `primray` and the resolver looks for `primary`.
- *   - **An underscore in the workflow's own name.** The encoding upper-cases
- *     the name and turns dashes into underscores, so decoding turns every
- *     underscore back into a dash. A workflow genuinely called `my_wf` is
- *     therefore unreachable: its slot decodes to `my-wf`, which the pipeline
- *     does not have. `ci secrets upload` warns about this at upload time; the
- *     pipeline is where it can be refused before a build starts.
- *
- * Both are one check — does the pipeline have a workflow by the decoded
- * name? — and both are refused at generation time, from the resolver, before
- * any step converts. That is the same place issue 03's refusal lands and for
- * the same reason: a build that cannot possibly deliver a credential should
- * stop while the message can still name the credential.
- *
- * The check only ever fires on a name we generate. No pipeline written before
- * this declared an encoded slot at all, and a global `CIBUILD_S__X` names no
- * workflow, so there is nothing in existence for it to refuse.
- */
-export {};
-//# sourceMappingURL=a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts.map

package/dist/src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG"}

package/dist/src/yaml/a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.js

@@ -1,218 +0,0 @@
-/**
- * A credential slot scoped to a workflow the pipeline does not have refuses
- * the build, instead of silently belonging to nobody.
- *
- * The declaration `CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: ""` means "this
- * credential, for the workflow called `primary`". Nothing checked that a
- * workflow by that name existed, and every way of getting the name wrong fails
- * quietly:
- *
- *   - **A typo.** `CIBUILD_SW__PRIMRAY__X` decodes to workflow `primray`. No
- *     workflow is called that, so no workflow declares `X`, so `file@1.0.0`
- *     finds no key in its map, calls the credential optional, and skips it with
- *     a warning — the green-step failure mode issue 03 exists to end. The
- *     upload half is equally quiet: `ci secrets upload` encodes a value for
- *     `primray` and the resolver looks for `primary`.
- *   - **An underscore in the workflow's own name.** The encoding upper-cases
- *     the name and turns dashes into underscores, so decoding turns every
- *     underscore back into a dash. A workflow genuinely called `my_wf` is
- *     therefore unreachable: its slot decodes to `my-wf`, which the pipeline
- *     does not have. `ci secrets upload` warns about this at upload time; the
- *     pipeline is where it can be refused before a build starts.
- *
- * Both are one check — does the pipeline have a workflow by the decoded
- * name? — and both are refused at generation time, from the resolver, before
- * any step converts. That is the same place issue 03's refusal lands and for
- * the same reason: a build that cannot possibly deliver a credential should
- * stop while the message can still name the credential.
- *
- * The check only ever fires on a name we generate. No pipeline written before
- * this declared an encoded slot at all, and a global `CIBUILD_S__X` names no
- * workflow, so there is nothing in existence for it to refuse.
- */
-import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { convertYAMLToPipelineDef } from './converter.js';
-import { UnknownWorkflowSlotError } from './env-resolver.js';
-import { clearRegistry, registerStep } from './steps/registry.js';
-import { FileStepExecutor } from './steps/file.js';
-const mockConfig = {
-    artifactsDir: '/test/artifacts',
-    maxConcurrentJobs: 1,
-    paths: {
-        buildsDir: '/test/builds',
-        cacheDir: '/test/cache',
-        derivedDataDir: '/test/derived-data',
-    },
-    interpreters: {
-        bash: '/bin/bash',
-        python: 'python3',
-        ruby: 'ruby',
-        node: 'node',
-    },
-};
-const TARGET = 'local.properties';
-const VALUE = 'BASE_API_URL=https://example.test/api\n';
-const TOUCHED = [
-    'LOCAL_PROPERTIES',
-    'CIBUILD_S__LOCAL_PROPERTIES',
-    'CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES',
-    'CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES',
-    'CIBUILD_SW__RELEASE__LOCAL_PROPERTIES',
-    'CIBUILD_SW__MY_WF__LOCAL_PROPERTIES',
-];
-let workdir;
-let previousCwd;
-beforeEach(() => {
-    clearRegistry();
-    registerStep('file', new FileStepExecutor());
-    previousCwd = process.cwd();
-    workdir = mkdtempSync(join(tmpdir(), 'cibuild-unknown-workflow-'));
-    process.chdir(workdir);
-    workdir = process.cwd();
-    for (const key of TOUCHED)
-        delete process.env[key];
-});
-afterEach(() => {
-    process.chdir(previousCwd);
-    rmSync(workdir, { recursive: true, force: true });
-    clearRegistry();
-    for (const key of TOUCHED)
-        delete process.env[key];
-});
-/** A pipeline with the given declared slots and the given workflow names. */
-function probePipeline(declared, workflowNames = ['primary', 'pull-request', 'release']) {
-    const step = {
-        'file@1.0.0': {
-            is_skippable: true,
-            inputs: { target_path: TARGET, var_name: 'LOCAL_PROPERTIES' },
-        },
-    };
-    const workflows = {};
-    for (const name of workflowNames)
-        workflows[name] = { steps: [step] };
-    return {
-        format_version: '1',
-        app: { envs: Object.entries(declared).map(([k, v]) => ({ [k]: v })) },
-        workflows,
-    };
-}
-/** The conversion's outcome, without letting a throw escape the assertion. */
-async function convert(pipeline, workflow) {
-    try {
-        const result = await convertYAMLToPipelineDef(pipeline, mockConfig, workflow);
-        return { steps: result.pipeline.steps };
-    }
-    catch (error) {
-        return { error: error };
-    }
-}
-describe('a slot naming a workflow nobody has', () => {
-    test('refuses the build, naming the slot and the workflow it decodes to', async () => {
-        process.env.CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES = VALUE;
-        const { error, steps } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
-        expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
-        expect(error.message).toContain('CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES');
-        expect(error.message).toContain('primray');
-        expect(steps).toBeUndefined();
-    });
-    test('says which workflows the pipeline does have', async () => {
-        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
-        expect(error.message).toContain('primary');
-        expect(error.message).toContain('pull-request');
-        expect(error.message).toContain('release');
-    });
-    test('names the credential the slot is for, since that is what has to arrive', async () => {
-        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
-        expect(error.message).toContain('LOCAL_PROPERTIES');
-    });
-    test('refuses from whichever workflow is being run', async () => {
-        // The slot is in `app.envs`, so it is a defect in the pipeline and not in
-        // one workflow of it. A build of `release` must not pass just because the
-        // bad slot happens to name something else.
-        for (const workflow of ['primary', 'pull-request', 'release']) {
-            const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), workflow);
-            expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
-        }
-    });
-    test('refuses a slot declared inside a workflow, not only in app.envs', async () => {
-        const pipeline = {
-            format_version: '1',
-            workflows: {
-                primary: {
-                    envs: [{ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }],
-                    steps: [
-                        {
-                            'file@1.0.0': {
-                                is_skippable: true,
-                                inputs: { target_path: TARGET, var_name: 'LOCAL_PROPERTIES' },
-                            },
-                        },
-                    ],
-                },
-            },
-        };
-        const { error } = await convert(pipeline, 'primary');
-        expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
-    });
-    test('carries no secret value into the message', async () => {
-        process.env.CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES = VALUE;
-        const { error } = await convert(probePipeline({ CIBUILD_SW__PRIMRAY__LOCAL_PROPERTIES: '' }), 'primary');
-        expect(error.message).not.toContain(VALUE.trim());
-        expect(error.message).not.toContain('example.test');
-    });
-});
-describe('a workflow whose own name the encoding cannot survive', () => {
-    test('is refused, and the message says the underscore is why', async () => {
-        // The pipeline really does have `my_wf`. Its slot still cannot reach it:
-        // decoding turns every underscore back into a dash, so the slot belongs to
-        // `my-wf`. Saying only "no such workflow" about a workflow that is right
-        // there would read as a bug in us.
-        const { error } = await convert(probePipeline({ CIBUILD_SW__MY_WF__LOCAL_PROPERTIES: '' }, ['my_wf']), 'my_wf');
-        expect(error).toBeInstanceOf(UnknownWorkflowSlotError);
-        expect(error.message).toContain('my_wf');
-        expect(error.message).toContain('my-wf');
-        expect(error.message).toMatch(/underscore/i);
-    });
-    test('is not refused when the workflow is named with a dash instead', async () => {
-        process.env.CIBUILD_SW__MY_WF__LOCAL_PROPERTIES = VALUE;
-        const { error, steps } = await convert(probePipeline({ CIBUILD_SW__MY_WF__LOCAL_PROPERTIES: '' }, ['my-wf']), 'my-wf');
-        expect(error).toBeUndefined();
-        expect(steps).toHaveLength(1);
-    });
-});
-describe('what the guard leaves alone', () => {
-    test('a pipeline whose scoped slots all name real workflows', async () => {
-        process.env.CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES = VALUE;
-        process.env.CIBUILD_SW__RELEASE__LOCAL_PROPERTIES = VALUE;
-        const declared = {
-            CIBUILD_SW__PRIMARY__LOCAL_PROPERTIES: '',
-            CIBUILD_SW__RELEASE__LOCAL_PROPERTIES: '',
-        };
-        const { error } = await convert(probePipeline(declared, ['primary', 'release']), 'primary');
-        expect(error).toBeUndefined();
-    });
-    test('a global slot, which names no workflow at all', async () => {
-        process.env.CIBUILD_S__LOCAL_PROPERTIES = VALUE;
-        const { error, steps } = await convert(probePipeline({ CIBUILD_S__LOCAL_PROPERTIES: '' }, ['primary']), 'primary');
-        expect(error).toBeUndefined();
-        expect(steps).toHaveLength(1);
-    });
-    test('an ordinary flat slot, which is every pipeline written before this', async () => {
-        process.env.LOCAL_PROPERTIES = VALUE;
-        const { error, steps } = await convert(probePipeline({ LOCAL_PROPERTIES: '' }, ['primary']), 'primary');
-        expect(error).toBeUndefined();
-        expect(steps).toHaveLength(1);
-    });
-    test('a half-encoded name, which is not a scoped slot and never was', async () => {
-        // `decodeSecretName` returns nothing for these, so they are ordinary
-        // variable names. Refusing them would be inventing a rule.
-        for (const key of ['CIBUILD_SW__RELEASE', 'CIBUILD_SW__RELEASE__', 'CIBUILD_S__']) {
-            const { error } = await convert(probePipeline({ [key]: '' }, ['primary']), 'primary');
-            expect(error).toBeUndefined();
-        }
-    });
-});
-//# sourceMappingURL=a-scoped-slot-must-name-a-workflow-the-pipeline-has.test.js.map

package/dist/src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.d.ts

@@ -1,27 +0,0 @@
-/**
- * A value `SecretsManager` was just told to store is a value it can read back.
- *
- * It could not, on exactly the repositories that matter. `loadSecrets` sets
- * `fileLoaded` when it finds a `.cibuild-secrets.json` or a
- * `CIBUILD_S*`-shaped environment, and every reader begins
- * `if (!this.fileLoaded) return process.env[...]` — a compatibility fallback
- * to bare `CIBUILD_`-prefixed variables from before the store existed.
- * `storeSecret` writes the file but never clears the flag, so on a repository
- * that had no store — a first `ci init`, which is the only time `ci init`
- * collects anything — every value collected in that run read back as absent
- * from the instance that stored it.
- *
- * It is not a hypothetical. `ci init` extracts a workflow's keystore target
- * from `storeFile=` in the `keystore.properties` it collected a moment
- * earlier, which is how a project whose signing config names
- * `app/customer.jks` gets its `file@` step pointed there instead of at
- * `keystore.jks`. That read returned undefined on every fresh repository, so
- * the resolution silently fell through to the Gradle-detected path — the half
- * of issue 07 that shipped and never fired.
- *
- * The fix is additive rather than a flag flip: the stored data is consulted
- * first, and the environment fallback stays exactly where it was for anything
- * the store does not hold. Nothing that resolved before stops resolving.
- */
-export {};
-//# sourceMappingURL=a-value-this-instance-stored-is-a-value-it-has.test.d.ts.map

package/dist/src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"a-value-this-instance-stored-is-a-value-it-has.test.d.ts","sourceRoot":"","sources":["../../../src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG"}

package/dist/src/yaml/a-value-this-instance-stored-is-a-value-it-has.test.js

@@ -1,126 +0,0 @@
-/**
- * A value `SecretsManager` was just told to store is a value it can read back.
- *
- * It could not, on exactly the repositories that matter. `loadSecrets` sets
- * `fileLoaded` when it finds a `.cibuild-secrets.json` or a
- * `CIBUILD_S*`-shaped environment, and every reader begins
- * `if (!this.fileLoaded) return process.env[...]` — a compatibility fallback
- * to bare `CIBUILD_`-prefixed variables from before the store existed.
- * `storeSecret` writes the file but never clears the flag, so on a repository
- * that had no store — a first `ci init`, which is the only time `ci init`
- * collects anything — every value collected in that run read back as absent
- * from the instance that stored it.
- *
- * It is not a hypothetical. `ci init` extracts a workflow's keystore target
- * from `storeFile=` in the `keystore.properties` it collected a moment
- * earlier, which is how a project whose signing config names
- * `app/customer.jks` gets its `file@` step pointed there instead of at
- * `keystore.jks`. That read returned undefined on every fresh repository, so
- * the resolution silently fell through to the Gradle-detected path — the half
- * of issue 07 that shipped and never fired.
- *
- * The fix is additive rather than a flag flip: the stored data is consulted
- * first, and the environment fallback stays exactly where it was for anything
- * the store does not hold. Nothing that resolved before stops resolving.
- */
-import { describe, test, expect, beforeEach, afterEach } from '@jest/globals';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { SecretsManager } from './secrets-manager.js';
-const KEYSTORE_PROPERTIES = 'storeFile=app/customer.jks\nstorePassword=x\n';
-let dir;
-let storePath;
-beforeEach(() => {
-    dir = mkdtempSync(join(tmpdir(), 'cibuild-store-readback-'));
-    storePath = join(dir, '.cibuild-secrets.json');
-    delete process.env.CIBUILD_KEYSTORE_PROPERTIES;
-    delete process.env.CIBUILD_FROM_THE_ENVIRONMENT;
-});
-afterEach(() => {
-    rmSync(dir, { recursive: true, force: true });
-    delete process.env.CIBUILD_KEYSTORE_PROPERTIES;
-    delete process.env.CIBUILD_FROM_THE_ENVIRONMENT;
-});
-describe('a repository that had no store yet', () => {
-    test('reads back a workflow-scoped value it just stored', () => {
-        const sm = new SecretsManager(storePath);
-        sm.storeSecret('KEYSTORE_PROPERTIES', KEYSTORE_PROPERTIES, 'release');
-        expect(sm.getSecret('KEYSTORE_PROPERTIES', 'release')).toBe(KEYSTORE_PROPERTIES);
-        expect(sm.hasSecret('KEYSTORE_PROPERTIES', 'release')).toBe(true);
-        expect(sm.getSecretIdByName('KEYSTORE_PROPERTIES', 'release')).toBe('KEYSTORE_PROPERTIES');
-    });
-    test('is why `ci init` can point a keystore step at the declared target', () => {
-        // The read that silently returned undefined: `ci init` takes the keystore
-        // target out of the properties file it collected in the same run.
-        const sm = new SecretsManager(storePath);
-        sm.storeSecret('KEYSTORE_PROPERTIES', KEYSTORE_PROPERTIES, 'release');
-        const storeFile = sm
-            .getSecret('KEYSTORE_PROPERTIES', 'release')
-            ?.split('\n')
-            .find((line) => line.trim().startsWith('storeFile='));
-        expect(storeFile).toBe('storeFile=app/customer.jks');
-    });
-    test('reads back a global value it just stored', () => {
-        const sm = new SecretsManager(storePath);
-        sm.storeSecret('LOCAL_PROPERTIES', 'BASE_API_URL=x\n');
-        expect(sm.getSecret('LOCAL_PROPERTIES')).toBe('BASE_API_URL=x\n');
-        expect(sm.getAll()).toHaveProperty('LOCAL_PROPERTIES', 'BASE_API_URL=x\n');
-        expect(sm.getAllSecretNames()).toContain('LOCAL_PROPERTIES');
-    });
-    test('keeps a value scoped to the workflow it was stored for', () => {
-        const sm = new SecretsManager(storePath);
-        sm.storeSecret('LOCAL_PROPERTIES', 'ci-dynamic', 'primary');
-        sm.storeSecret('LOCAL_PROPERTIES', 'prod', 'release');
-        expect(sm.getSecret('LOCAL_PROPERTIES', 'primary')).toBe('ci-dynamic');
-        expect(sm.getSecret('LOCAL_PROPERTIES', 'release')).toBe('prod');
-        // No global value was stored, so a workflow nobody stored for has none.
-        expect(sm.getSecret('LOCAL_PROPERTIES', 'pull-request')).toBeUndefined();
-    });
-});
-describe('the environment fallback', () => {
-    test('still answers for a key the store does not hold', () => {
-        process.env.CIBUILD_FROM_THE_ENVIRONMENT = 'inherited';
-        const sm = new SecretsManager(storePath);
-        sm.storeSecret('LOCAL_PROPERTIES', 'stored');
-        expect(sm.getSecret('FROM_THE_ENVIRONMENT')).toBe('inherited');
-        expect(sm.hasSecret('FROM_THE_ENVIRONMENT')).toBe(true);
-        expect(sm.getAll()).toMatchObject({
-            FROM_THE_ENVIRONMENT: 'inherited',
-            LOCAL_PROPERTIES: 'stored',
-        });
-    });
-    test('answers for everything when nothing has been stored', () => {
-        process.env.CIBUILD_FROM_THE_ENVIRONMENT = 'inherited';
-        const sm = new SecretsManager(storePath);
-        expect(sm.getSecret('FROM_THE_ENVIRONMENT')).toBe('inherited');
-        expect(sm.getAll()).toEqual({ FROM_THE_ENVIRONMENT: 'inherited' });
-    });
-    test('loses to a value that was actually stored', () => {
-        process.env.CIBUILD_KEYSTORE_PROPERTIES = 'from-the-environment';
-        const sm = new SecretsManager(storePath);
-        sm.storeSecret('KEYSTORE_PROPERTIES', KEYSTORE_PROPERTIES, 'release');
-        expect(sm.getSecret('KEYSTORE_PROPERTIES', 'release')).toBe(KEYSTORE_PROPERTIES);
-    });
-});
-describe('a repository that already had a store', () => {
-    test('is unchanged — the file is the answer and the environment is not consulted', () => {
-        process.env.CIBUILD_FROM_THE_ENVIRONMENT = 'inherited';
-        writeFileSync(storePath, JSON.stringify({ global: { A: 'from-the-file' }, workflows: {} }), { mode: 0o600 });
-        const sm = new SecretsManager(storePath);
-        expect(sm.getSecret('A')).toBe('from-the-file');
-        expect(sm.getSecret('FROM_THE_ENVIRONMENT')).toBeUndefined();
-        expect(sm.getAll()).toEqual({ A: 'from-the-file' });
-    });
-    test('still lets a workflow value beat the global one', () => {
-        writeFileSync(storePath, JSON.stringify({
-            global: { A: 'global' },
-            workflows: { release: { A: 'release' } },
-        }), { mode: 0o600 });
-        const sm = new SecretsManager(storePath);
-        expect(sm.getSecret('A', 'release')).toBe('release');
-        expect(sm.getSecret('A', 'primary')).toBe('global');
-        expect(sm.getAll('release')).toEqual({ A: 'release' });
-    });
-});
-//# sourceMappingURL=a-value-this-instance-stored-is-a-value-it-has.test.js.map

package/dist/src/yaml/bitrise-compat.d.ts

@@ -1,65 +0,0 @@
-/**
- * Bitrise YAML Compatibility Layer
- *
- * This module provides compatibility functions to convert Bitrise YAML pipelines
- * to CI Build format, including metadata conversion and environment variable mapping.
- */
-import type { YAMLPipeline } from './types.js';
-/**
- * Map of Bitrise environment variables to CI Build equivalents
- * Used for automatic variable substitution (FR-9.2)
- */
-export declare const BITRISE_ENV_MAP: Record<string, string>;
-/**
- * Bitrise environment variables that require user input
- * These cannot be automatically mapped and must be provided by the user (FR-9.3)
- */
-export declare const BITRISE_USER_REQUIRED_VARS: string[];
-/**
- * Error class for Bitrise-specific environment variable issues
- * Provides detailed information about missing variables (FR-9.3, FR-9.4, FR-9.5)
- */
-export declare class BitriseEnvironmentError extends Error {
-    readonly missingVariables: BitriseVariableInfo[];
-    constructor(missingVariables: BitriseVariableInfo[]);
-}
-/**
- * Information about a missing Bitrise environment variable
- */
-export interface BitriseVariableInfo {
-    /** Variable name (e.g., BITRISE_PUBLIC_INSTALL_PAGE_URL) */
-    name: string;
-    /** Step where the variable is used */
-    stepName: string;
-    /** Input field where the variable is used */
-    inputField: string;
-    /** CI Build equivalent variable name (if available) */
-    cibuildEquivalent?: string;
-    /** Suggested action for the user */
-    suggestedAction: string;
-}
-/**
- * Converts Bitrise metadata to CI Build format
- * Transforms meta.bitrise.io to meta.cibuild.io (FR-1.1, FR-1.2, FR-1.3)
- *
- * @param pipeline YAML pipeline object (mutated in place)
- */
-export declare function convertBitriseMetadata(pipeline: YAMLPipeline): void;
-/**
- * Detects Bitrise-specific environment variables in step inputs
- * Scans recursively through objects and arrays (FR-9.1)
- *
- * @param inputs Step inputs object
- * @param stepName Name of the step (for error reporting)
- * @returns Array of detected Bitrise variable information
- */
-export declare function detectBitriseEnvironmentVariables(inputs: any, stepName: string): BitriseVariableInfo[];
-/**
- * Checks if a variable should trigger a warning vs error
- * Mapped variables generate info logs, unmapped variables generate errors
- *
- * @param varName Bitrise variable name
- * @returns True if variable needs user configuration (error), false if auto-mapped (info)
- */
-export declare function requiresUserConfiguration(varName: string): boolean;
-//# sourceMappingURL=bitrise-compat.d.ts.map

package/dist/src/yaml/bitrise-compat.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bitrise-compat.d.ts","sourceRoot":"","sources":["../../../src/yaml/bitrise-compat.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmBlD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,0BAA0B,UAKtC,CAAC;AAEF;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,SAAgB,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;gBAE5C,gBAAgB,EAAE,mBAAmB,EAAE;CAMpD;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,CAsBnE;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,GAAG,EACX,QAAQ,EAAE,MAAM,GACf,mBAAmB,EAAE,CAOvB;AA2HD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAElE"}