@malmhq/intermesh-cli 0.1.0

package/dist/generation/templates/npm-cli/src/shared/files.ts

@@ -0,0 +1,45 @@
+import { lstat, stat, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { CliError, cliErrors } from './errors.js';
+import { dryRun, DryRunComplete } from './dry-run.js';
+import { printSuccess } from './output.js';
+
+export async function saveFile(path: string, body: Uint8Array, mediaType: string) {
+  await validateOutputFile(path);
+  if (dryRun.getStore()) {
+    printSuccess(
+      {
+        dry_run: true,
+        summary: 'Would write a new output file. No file was written.',
+        effect: 'Write an output file',
+        bytes: body.byteLength,
+        checks: ['Output does not exist', 'Parent directory exists'],
+        not_checked: ['Write permissions and available disk space'],
+      },
+      'save-file',
+    );
+    throw new DryRunComplete();
+  }
+  try {
+    await writeFile(path, body, { flag: 'wx' });
+  } catch {
+    throw new CliError(cliErrors.fileWriteFailed);
+  }
+  return { path, media_type: mediaType };
+}
+
+export async function validateOutputFile(path: string): Promise<void> {
+  try {
+    const exists = await lstat(path).then(
+      () => true,
+      (error: unknown) => {
+        if (error instanceof Error && 'code' in error && error.code === 'ENOENT') return false;
+        throw error;
+      },
+    );
+    if (exists || !(await stat(dirname(path))).isDirectory())
+      throw new Error('Invalid destination');
+  } catch {
+    throw new CliError(cliErrors.fileWriteFailed);
+  }
+}

package/dist/generation/templates/npm-cli/src/shared/http.ts

@@ -0,0 +1,125 @@
+import { bearerToken } from '../auth/credentials.js';
+import { dryRun, DryRunComplete, previewWorkflow, type WorkflowPreview } from './dry-run.js';
+import { printSuccess } from './output.js';
+import { customer } from '../customer.js';
+import { CliError, cliErrors } from './errors.js';
+
+type Method = 'DELETE' | 'GET' | 'HEAD' | 'OPTIONS' | 'PATCH' | 'POST' | 'PUT';
+
+function loopbackUrl(value: string): URL {
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new CliError(cliErrors.invalidLoopbackUrl);
+  }
+  if (
+    !['http:', 'https:'].includes(url.protocol) ||
+    !['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname) ||
+    url.username ||
+    url.password
+  ) {
+    throw new CliError(cliErrors.loopbackUrlNotPermitted);
+  }
+  return url;
+}
+
+function productionUrl(): URL {
+  const url = new URL(customer.api.base_url);
+  if (url.protocol !== 'https:' || url.username || url.password)
+    throw new CliError(cliErrors.customerApiConfigurationInvalid);
+  return url;
+}
+
+function operationUrl(base: URL, path: string): URL {
+  if (!path.startsWith('/') || path.startsWith('//'))
+    throw new CliError(cliErrors.operationPathInvalid);
+  const directory = new URL(base);
+  if (!directory.pathname.endsWith('/')) directory.pathname += '/';
+  return new URL(path.slice(1), directory);
+}
+
+export async function request(options: {
+  baseUrl?: string;
+  method: Method;
+  path: string;
+  query?: URLSearchParams;
+  body?: Uint8Array;
+  mediaType?: string;
+  timeoutMs?: number;
+  workflow?: WorkflowPreview;
+}): Promise<{ body: Uint8Array; mediaType: string; status: number }> {
+  const mockBaseUrl = options.baseUrl;
+  const mock = mockBaseUrl !== undefined;
+  const base = mockBaseUrl === undefined ? productionUrl() : loopbackUrl(mockBaseUrl);
+  const resolved = operationUrl(base, options.path);
+  const url = mock ? loopbackUrl(resolved.href) : resolved;
+  if (url.origin !== base.origin) throw new CliError(cliErrors.operationOriginMismatch);
+  for (const [key, value] of options.query ?? []) url.searchParams.append(key, value);
+  if (dryRun.getStore()) {
+    if (options.workflow) previewWorkflow(options.workflow, 'request');
+    printSuccess(
+      {
+        dry_run: true,
+        summary: `Would send a ${options.method} request. No API request was sent.`,
+        steps: [{ summary: `Send ${options.method} request`, status: 'planned' }],
+        method: options.method,
+        origin: url.origin,
+        path: '[REDACTED]',
+        query_parameters: [...(options.query?.keys() ?? [])],
+        body_bytes: options.body?.byteLength ?? 0,
+        checks: ['Request URL and local command inputs'],
+        not_checked: [
+          'API permissions and server state',
+          'Execution results',
+          'Later workflow steps unless explicitly declared',
+        ],
+      },
+      'request',
+    );
+    throw new DryRunComplete();
+  }
+  const signal = AbortSignal.timeout(options.timeoutMs ?? 30_000);
+  const headers = new Headers();
+  if (!mock) headers.set('authorization', `Bearer ${await bearerToken()}`);
+  if (options.mediaType) headers.set('content-type', options.mediaType);
+  try {
+    const response = await fetch(url, {
+      method: options.method,
+      headers,
+      body: options.body ? Buffer.from(options.body) : undefined,
+      redirect: 'manual',
+      signal,
+    });
+    if (response.status >= 300 && response.status < 400) {
+      await response.body?.cancel();
+      throw new CliError(cliErrors.redirectNotAllowed);
+    }
+    if (response.status === 401 || response.status === 403) {
+      await response.body?.cancel();
+      throw new CliError(cliErrors.authFailed);
+    }
+    if (!response.ok) {
+      await response.body?.cancel();
+      throw new CliError(cliErrors.upstream(response.status));
+    }
+    return {
+      body: new Uint8Array(await response.arrayBuffer()),
+      mediaType: response.headers.get('content-type') ?? 'application/octet-stream',
+      status: response.status,
+    };
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    if (signal.aborted) throw new CliError(cliErrors.timeout);
+    throw new CliError(cliErrors.requestFailed);
+  }
+}
+
+export function get(
+  baseUrl: string | undefined,
+  path: string,
+  query = new URLSearchParams(),
+  timeoutMs = 30_000,
+) {
+  return request({ baseUrl, method: 'GET', path, query, timeoutMs });
+}

package/dist/generation/templates/npm-cli/src/shared/output.ts

@@ -0,0 +1,33 @@
+import { parse, stringify } from 'lossless-json';
+import { CliError, cliErrors } from './errors.js';
+
+export function parseJson(body: Uint8Array): unknown {
+  try {
+    return parse(Buffer.from(body).toString('utf8'));
+  } catch {
+    throw new CliError(cliErrors.invalidJson);
+  }
+}
+
+export function printSuccess(data: unknown, command: string): void {
+  process.stdout.write(
+    stringify({ schema_version: '1.0.0', ok: true, data, meta: { command } }) + '\n',
+  );
+}
+
+export function printError(error: CliError): void {
+  process.stdout.write(
+    JSON.stringify({
+      schema_version: '1.0.0',
+      ok: false,
+      error: {
+        code: error.code,
+        message: error.message,
+        retryable: error.retryable,
+        ...(error.hint === undefined ? {} : { hint: error.hint }),
+        ...(error.details === undefined ? {} : { details: error.details }),
+      },
+    }) + '\n',
+  );
+  process.exitCode = error.exitCode;
+}

package/dist/generation/templates/npm-cli/test/auth.test.ts

@@ -0,0 +1,113 @@
+import assert from 'node:assert/strict';
+import { Readable, Writable } from 'node:stream';
+import { test } from 'node:test';
+import { login, logout, status, registerAuthCommands } from '../src/auth/commands.js';
+import { createProgram, runCli } from '../src/cli.js';
+import { bearerToken, credentialStatus, type CredentialStore } from '../src/auth/credentials.js';
+import { readHiddenToken } from '../src/auth/prompt.js';
+import { customer } from '../src/customer.js';
+
+function memoryStore(initial?: string) {
+  let token = initial;
+  const store: CredentialStore = {
+    async get() {
+      return token;
+    },
+    async set(value) {
+      token = value;
+    },
+    async delete() {
+      const removed = token !== undefined;
+      token = undefined;
+      return removed;
+    },
+  };
+  return { store, value: () => token };
+}
+
+void test('JSON login uses environment input and never prompts; dry run never stores it', async (context) => {
+  const key = customer.api.auth.environment_variable;
+  const original = process.env[key];
+  let output = '';
+  context.mock.method(process.stdout, 'write', (chunk: string | Uint8Array) => {
+    output += String(chunk);
+    return true;
+  });
+  const invoke = async (args: string[], memory: ReturnType<typeof memoryStore>) => {
+    const program = createProgram();
+    registerAuthCommands(program, memory.store, async () => {
+      throw new Error('Unexpected prompt');
+    });
+    await runCli(program, args);
+  };
+  try {
+    delete process.env[key];
+    const memory = memoryStore();
+    await invoke(['--json', 'login'], memory);
+    assert.equal(process.exitCode, 2);
+    assert.equal(JSON.parse(output).error.code, 'AUTH_REQUIRED');
+    process.exitCode = undefined;
+    output = '';
+    process.env[key] = 'private-token';
+    await invoke(['--json', '--dry-run', 'login'], memory);
+    assert.equal(memory.value(), undefined);
+    await invoke(['--json', 'login'], memory);
+    assert.equal(memory.value(), 'private-token');
+    assert.doesNotMatch(output, /private-token/);
+  } finally {
+    process.exitCode = undefined;
+    if (original === undefined) delete process.env[key];
+    else process.env[key] = original;
+  }
+});
+
+void test('login, status and logout use a credential store without exposing the token', async () => {
+  const memory = memoryStore();
+  assert.deepEqual(await login(memory.store, async () => 'private-token'), {
+    authenticated: true,
+    storage: 'secure-store',
+  });
+  assert.equal(memory.value(), 'private-token');
+  assert.deepEqual(await status(memory.store), {
+    api: customer.api.base_url,
+    configured: true,
+    source: 'secure-store',
+  });
+  assert.deepEqual(await logout(memory.store), { removed: true });
+  assert.equal(memory.value(), undefined);
+  await assert.rejects(
+    login(memory.store, async () => ''),
+    { code: 'INVALID_INPUT' },
+  );
+});
+
+void test('environment credentials override the secure store for CI', async () => {
+  const name = customer.api.auth.environment_variable;
+  const original = process.env[name];
+  process.env[name] = 'environment-token';
+  try {
+    assert.equal(await bearerToken(memoryStore('stored-token').store), 'environment-token');
+    assert.deepEqual(await credentialStatus(memoryStore().store), {
+      configured: true,
+      source: 'environment',
+    });
+  } finally {
+    if (original === undefined) delete process.env[name];
+    else process.env[name] = original;
+  }
+  await assert.rejects(bearerToken(memoryStore().store), { code: 'AUTH_REQUIRED' });
+});
+
+void test('token prompt rejects non-interactive input without reading or echoing it', async () => {
+  let output = '';
+  const sink = new Writable({
+    write(chunk, _encoding, done) {
+      output += String(chunk);
+      done();
+    },
+  });
+  await assert.rejects(readHiddenToken('Paste token', Readable.from('private-token\n'), sink), {
+    code: 'INVALID_INPUT',
+  });
+  assert.equal(output, '');
+});

package/dist/generation/templates/npm-cli/test/fixture-cli.ts

@@ -0,0 +1,51 @@
+import { createProgram, runCli } from '../src/cli.js';
+import { get, request } from '../src/shared/http.js';
+import { CliError, cliErrors } from '../src/shared/errors.js';
+import { parseJson, printSuccess } from '../src/shared/output.js';
+
+const program = createProgram();
+program
+  .command('example-command')
+  .description('Synthetic command for foundation tests only')
+  .requiredOption('--id <id>', 'Exact decimal identifier', (value: string) => {
+    if (!/^-?[0-9]+$/.test(value))
+      throw new CliError(cliErrors.invalidInput('ID must be an integer.'));
+    return value;
+  })
+  .allowExcessArguments(false)
+  .action(async (_options, command) => {
+    const options = command.optsWithGlobals() as { id: string; baseUrl: string };
+    const result = await get(options.baseUrl, '/records', new URLSearchParams({ id: options.id }));
+    printSuccess(parseJson(result.body), 'example-command');
+  });
+program
+  .command('example-workflow')
+  .requiredOption('--id <id>', 'Customer identifier')
+  .action(async (_options, command) => {
+    const options = command.optsWithGlobals();
+    const found = await request({
+      baseUrl: options.baseUrl,
+      method: 'GET',
+      path: '/customers',
+      query: new URLSearchParams({ id: options.id }),
+      workflow: {
+        summary: 'Find the selected customer and create an invoice.',
+        steps: [
+          { summary: 'Find the selected customer' },
+          {
+            summary: 'Create an invoice using the returned customer ID',
+            depends_on_response: true,
+          },
+        ],
+      },
+    });
+    const customer = JSON.parse(Buffer.from(found.body).toString('utf8'));
+    const result = await request({
+      baseUrl: options.baseUrl,
+      method: 'POST',
+      path: '/invoices',
+      body: Buffer.from(JSON.stringify({ customer_id: customer.id })),
+    });
+    printSuccess(parseJson(result.body), 'example-workflow');
+  });
+await runCli(program, process.argv.slice(2));

package/dist/generation/templates/npm-cli/test/foundation.test.ts

@@ -0,0 +1,316 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import { customer } from '../src/customer.js';
+import { get } from '../src/shared/http.js';
+import { saveFile } from '../src/shared/files.js';
+import { parseJson } from '../src/shared/output.js';
+import { mockServer, runCli } from './helpers.js';
+import { dryRun, DryRunComplete, previewWorkflow } from '../src/shared/dry-run.js';
+import { request } from '../src/shared/http.js';
+
+void test('workflow preview describes every step without executing response-dependent work', async (context) => {
+  let output = '';
+  context.mock.method(process.stdout, 'write', (chunk: string | Uint8Array) => {
+    output += String(chunk);
+    return true;
+  });
+  const workflow = {
+    summary: 'Find a customer and create an invoice.',
+    steps: [
+      { summary: 'Find the customer' },
+      { summary: 'Create an invoice', depends_on_response: true },
+    ],
+  };
+  assert.throws(() => dryRun.run(true, () => previewWorkflow(workflow, 'invoice')), DryRunComplete);
+  const preview = JSON.parse(output).data;
+  assert.equal(preview.summary, workflow.summary);
+  assert.equal(preview.steps.length, 2);
+  assert.equal(preview.steps[1].status, 'resolved_during_execution');
+  assert.ok(preview.not_checked.includes('API permissions and server state'));
+  output = '';
+  dryRun.run(false, () => previewWorkflow(workflow, 'invoice'));
+  assert.equal(output, '');
+});
+
+void test('dry run validates input and sends no HTTP request', async () => {
+  let requests = 0;
+  const server = await mockServer((_request, response) => {
+    requests++;
+    response.end('{}');
+  });
+  try {
+    const result = await runCli([
+      '--json',
+      '--dry-run',
+      'example-command',
+      '--id',
+      '123',
+      '--base-url',
+      server.url,
+    ]);
+    assert.equal(result.code, 0, result.stdout);
+    assert.equal(result.stderr, '');
+    assert.equal(JSON.parse(result.stdout).data.dry_run, true);
+    const workflow = await runCli([
+      'example-workflow',
+      '--id',
+      'private-customer',
+      '--base-url',
+      server.url,
+      '--dry-run',
+    ]);
+    assert.equal(workflow.code, 0);
+    assert.equal(JSON.parse(workflow.stdout).data.steps.length, 2);
+    assert.equal(JSON.parse(workflow.stdout).data.steps[1].status, 'resolved_during_execution');
+    assert.doesNotMatch(workflow.stdout, /private-customer/);
+    const invalid = await runCli([
+      '--dry-run',
+      'example-command',
+      '--id',
+      'invalid',
+      '--base-url',
+      server.url,
+    ]);
+    assert.equal(invalid.code, 2);
+    assert.equal(JSON.parse(invalid.stdout).ok, false);
+    assert.equal(requests, 0);
+  } finally {
+    await server.close();
+  }
+});
+
+void test('dry run blocks mutations and file writes without exposing request values', async (context) => {
+  let output = '';
+  context.mock.method(process.stdout, 'write', (chunk: string | Uint8Array) => {
+    output += String(chunk);
+    return true;
+  });
+  context.mock.method(globalThis, 'fetch', () => {
+    throw new Error('dry run must not fetch');
+  });
+  const dir = await mkdtemp(join(tmpdir(), 'cli-dry-file-'));
+  try {
+    for (const method of ['POST', 'PATCH', 'DELETE'] as const) {
+      await assert.rejects(
+        dryRun.run(true, () =>
+          request({
+            method,
+            path: '/private-value',
+            query: new URLSearchParams({ token: 'private-value' }),
+            body: Buffer.from('private-value'),
+          }),
+        ),
+        DryRunComplete,
+      );
+    }
+    await assert.rejects(
+      dryRun.run(true, () =>
+        saveFile(join(dir, 'result'), Buffer.from('private-value'), 'text/plain'),
+      ),
+      DryRunComplete,
+    );
+    await assert.rejects(readFile(join(dir, 'result')), { code: 'ENOENT' });
+    assert.doesNotMatch(output, /private-value/);
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});
+
+void test('root and command help work without configuration; version follows package metadata', async () => {
+  for (const args of [[], ['--help'], ['example-command', '--help']]) {
+    const result = await runCli(args);
+    assert.equal(result.code, 0, result.stderr);
+    assert.match(result.stdout, /Usage:/);
+    assert.doesNotMatch(result.stdout, /base-url/u);
+    assert.equal(result.stderr, '');
+    if (args[0] === 'example-command') assert.match(result.stdout, /--id <id>/);
+  }
+  const pkg = JSON.parse(await readFile('package.json', 'utf8'));
+  assert.equal(JSON.parse((await runCli(['--version'])).stdout).data.help.trim(), pkg.version);
+  assert.doesNotMatch((await runCli(['--help'], 'src/index.ts')).stdout, /example-command/);
+});
+
+void test('CLI rejects bad input without requests and preserves int64 in requests and output', async () => {
+  const requests: string[] = [];
+  const server = await mockServer((request, response) => {
+    requests.push(request.url!);
+    response.end('{"id":9007199254740993,"quoted":"9007199254740993"}');
+  });
+  try {
+    for (const args of [
+      [],
+      ['--id', '1.5'],
+      ['--id', '1junk'],
+      ['--id', '1', '--bogus'],
+      ['--id', '1', 'extra'],
+    ]) {
+      const result = await runCli(['example-command', '--base-url', server.url, ...args]);
+      assert.equal(result.code, 2);
+      assert.equal(result.stderr, '');
+      const error = JSON.parse(result.stdout).error;
+      assert.equal(error.code, 'INVALID_INPUT');
+      assert.equal(error.hint, 'Run the command with --help to see valid inputs.');
+      assert.deepEqual(error.details, { reason: 'invalid_arguments' });
+      assert.equal(requests.length, 0);
+    }
+    const unknown = await runCli(['unknown']);
+    assert.equal(unknown.code, 2);
+    assert.equal(JSON.parse(unknown.stdout).error.code, 'UNKNOWN_COMMAND');
+    const result = await runCli([
+      'example-command',
+      '--id',
+      '9007199254740993',
+      '--base-url',
+      server.url,
+    ]);
+    assert.equal(result.code, 0, result.stderr);
+    assert.equal(
+      result.stdout,
+      '{"schema_version":"1.0.0","ok":true,"data":{"id":9007199254740993,"quoted":"9007199254740993"},"meta":{"command":"example-command"}}\n',
+    );
+    assert.deepEqual(requests, ['/records?id=9007199254740993']);
+  } finally {
+    await server.close();
+  }
+});
+
+void test('URL restrictions apply to the resolved destination without leaking credentials', async () => {
+  for (const value of [
+    '',
+    'bad-url',
+    'https://example.com',
+    'file:///tmp/test',
+    'http://user:secret@localhost',
+  ]) {
+    await assert.rejects(get(value, '/records'), { code: 'INVALID_CONFIG' });
+  }
+  for (const path of ['https://example.com', '//example.com', 'http://127.0.0.1:99/records']) {
+    await assert.rejects(get('http://127.0.0.1:1', path), { code: 'INVALID_CONFIG' });
+  }
+  const result = await runCli([
+    'example-command',
+    '--id',
+    '1',
+    '--base-url',
+    'http://user:secret@localhost',
+  ]);
+  assert.equal(result.code, 2);
+  assert.doesNotMatch(result.stdout, /user|secret/);
+  assert.equal(JSON.parse(result.stdout).error.code, 'INVALID_CONFIG');
+});
+
+void test('production requests use Bearer authentication while mocks receive no token', async () => {
+  const originalFetch = globalThis.fetch;
+  const tokenName = customer.api.auth.environment_variable;
+  const originalToken = process.env[tokenName];
+  let authorization: string | null = null;
+  process.env[tokenName] = 'private-token';
+  globalThis.fetch = (input, init) => {
+    authorization = new Headers(init?.headers).get('authorization');
+    assert.equal(String(input), `${customer.api.base_url}/records`);
+    return Promise.resolve(new Response('{}'));
+  };
+  try {
+    await get(undefined, '/records');
+    assert.equal(authorization, 'Bearer private-token');
+  } finally {
+    globalThis.fetch = originalFetch;
+    if (originalToken === undefined) delete process.env[tokenName];
+    else process.env[tokenName] = originalToken;
+  }
+
+  const server = await mockServer((request, response) => {
+    assert.equal(request.headers.authorization, undefined);
+    response.end('{}');
+  });
+  try {
+    await get(server.url, '/records');
+  } finally {
+    await server.close();
+  }
+});
+
+void test('HTTP errors are redacted, redirects are not followed and query encoding is exact', async () => {
+  const paths: string[] = [];
+  const server = await mockServer((request, response) => {
+    paths.push(request.url!);
+    if (request.url === '/error') {
+      response.writeHead(503, { 'content-type': 'application/problem+json' });
+      response.end('{"detail":"secret-token"}');
+    } else if (request.url === '/redirect') {
+      response.writeHead(302, { location: '/target' });
+      response.end();
+    } else response.end('ok');
+  });
+  try {
+    await assert.rejects(get(server.url, '/error'), {
+      code: 'UPSTREAM_ERROR',
+      message: 'API returned HTTP 503.',
+      hint: 'Check the API status and request inputs, then retry when appropriate.',
+      details: { status: 503 },
+      retryable: false,
+    });
+    await assert.rejects(get(server.url, '/redirect'), { code: 'REQUEST_FAILED' });
+    await get(
+      server.url,
+      '/records',
+      new URLSearchParams([
+        ['name', 'a/b & c'],
+        ['tag', 'one'],
+        ['tag', 'two'],
+      ]),
+    );
+    assert.deepEqual(paths, ['/error', '/redirect', '/records?name=a%2Fb+%26+c&tag=one&tag=two']);
+  } finally {
+    await server.close();
+  }
+});
+
+void test('timeouts cover response headers and body; transport failure stays distinct', async () => {
+  for (const sendHeaders of [false, true]) {
+    const server = await mockServer((_request, response) => {
+      if (sendHeaders) {
+        response.writeHead(200);
+        response.write('partial');
+      }
+    });
+    try {
+      await assert.rejects(get(server.url, '/', undefined, 100), {
+        code: 'REQUEST_TIMEOUT',
+        retryable: true,
+      });
+    } finally {
+      await server.close();
+    }
+  }
+  const server = await mockServer((_request, response) => response.end());
+  await server.close();
+  await assert.rejects(get(server.url, '/'), { code: 'REQUEST_FAILED', retryable: true });
+  assert.throws(() => parseJson(Buffer.from('invalid')), { code: 'REQUEST_FAILED' });
+});
+
+void test('file output preserves bytes and refuses to overwrite', async () => {
+  const dir = await mkdtemp(join(tmpdir(), 'cli-files-'));
+  const path = join(dir, 'artifact');
+  const body = new Uint8Array([0, 255, 128, 10]);
+  try {
+    assert.deepEqual(await saveFile(path, body, 'application/octet-stream'), {
+      path,
+      media_type: 'application/octet-stream',
+    });
+    assert.deepEqual(await readFile(path), Buffer.from(body));
+    await assert.rejects(
+      dryRun.run(true, () => saveFile(path, body, 'text/plain')),
+      { code: 'FILE_WRITE_FAILED' },
+    );
+    await assert.rejects(saveFile(path, Buffer.from('changed'), 'text/plain'), {
+      code: 'FILE_WRITE_FAILED',
+    });
+    assert.deepEqual(await readFile(path), Buffer.from(body));
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+});