@vibe-agent-toolkit/utils 0.1.42 → 0.2.0-rc.10

package/dist/test-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"test-helpers.js","sourceRoot":"","sources":["../src/test-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE5E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,QAA2C,EAC3C,GAAG,OAAiB;IAEpB,iDAAiD;IACjD,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,QAAQ,EAAE,CAAC;IAEzC,iEAAiE;IACjE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAEpD,kFAAkF;IAClF,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,CACjC,WAAW,EACX,UAAU,EACV,WAAW,EACX,cAAc,EACd,QAAQ,EACR,KAAK,EACL,GAAG,OAAO,CACX,CAAC;IAEF,wDAAwD;IAExD,OAAO,aAAa,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IAOnD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,OAAO;QACL,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,QAAQ,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,UAAU,EAAE,KAAK,IAAI,EAAE;YACrB,WAAW,EAAE,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,CAAC;YACzD,8FAA8F;YAC9F,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,SAAS,EAAE,KAAK,IAAI,EAAE;YACpB,4CAA4C;QAC9C,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAOlD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,OAAO;QACL,SAAS,EAAE,GAAG,EAAE;YACd,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC;QAChF,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE;YACb,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,UAAU,EAAE,GAAG,EAAE;YACf,WAAW,EAAE,CAAC;YACd,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,CAAC;YACzD,aAAa,CAAC,OAAO,CAAC,CAAC;QACzB,CAAC;QACD,SAAS,EAAE,GAAG,EAAE;YACd,4CAA4C;QAC9C,CAAC;QACD,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;KAC1B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"test-helpers.js","sourceRoot":"","sources":["../src/test-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAgB7E,IAAI,gBAAsD,CAAC;AAE3D;;;;GAIG;AACH,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;AAEpG,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,0BAA0B,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnI,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,sBAAsB,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC;YACH,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,gBAAgB,GAAG,EAAuB,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC9C,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QACD,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC9B,yEAAyE;YACzE,0EAA0E;YAC1E,wEAAwE;YACxE,uEAAuE;YACvE,qDAAqD;YACrD,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;oBAAE,MAAM,KAAK,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAuB,EACvB,MAAc,EACd,IAAY,EACZ,IAAkC;IAElC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuB,EACvB,MAAc,EACd,IAAY,EACZ,IAAkC;IAElC,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,kCAAkC;IAClC,yBAAyB;IACzB,gBAAgB;IAChB,uBAAuB;IACvB,SAAS;IACT,iCAAiC;IACjC,gBAAgB;IAChB,gBAAgB;IAChB,mBAAmB;IACnB,eAAe;IACf,eAAe;IACf,sBAAsB;IACtB,YAAY;IACZ,kBAAkB;IAClB,eAAe;CACP,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAG,IAAI,GAAG,EAA8B,CAAC;IAEpD,MAAM,MAAM,GAAG,CAAC,IAAY,EAAQ,EAAE;QACpC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,iBAAiB,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IAED,OAAO,GAAG,EAAE;QACV,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YAClC,uEAAuE;YACvE,iEAAiE;YACjE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACrD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAGD;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,cAAc,OAAO,KAAK,MAAM,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AACjG,CAAC;AAgBD;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,EAAW;IAC3D,MAAkC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;IACjD,qBAAqB,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,YAAY,CAAC,MAA6B,EAAE,UAAkB,EAAE,IAAY;IAC1F,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAoC,CAAC;IACnE,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3C,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,MAAe,EAAE,GAAG,IAAe,EAAW,EAAE;QACzE,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO;YAAE,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,OAAO,QAAQ,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAA8B,EAAE,UAAkB,EAAE,IAAY;IAC5F,MAAM,QAAQ,GAAI,EAAE,CAAC,MAAM,CAA8C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3C,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAe,EAAE,GAAG,IAAe,EAAoB,EAAE;QACpF,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,OAAO;YAAE,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/F,OAAO,QAAQ,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA6B,EAC7B,UAAkB,EAClB,IAAY,EACZ,IAA0B;IAE1B,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,IAAY,EACZ,IAA0B;IAE1B,OAAO,iBAAiB,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC"}

package/dist/testing/executables.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Absolute paths for the executables test fixtures spawn.
+ *
+ * A test that spawns `'git'` or `'node'` by bare name asks the OS to search
+ * `PATH`, and a writable directory on `PATH` turns that into a place to plant
+ * a binary (the class SonarCloud's S4036 flags). Fixtures resolve the binary
+ * ONCE, here, to an absolute path and spawn that: `node` is the process that
+ * is running the test (`process.execPath`, the only node whose version the
+ * test can vouch for), and `git` is found by walking `PATH`.
+ *
+ * Why a second `PATH` walk beside `safe-exec.ts`'s `which`: `which` resolves
+ * in-process too, but it is a third-party package, and the `./testing` subpath
+ * is pinned dependency-free (`subpath-purity.test.ts`) — an adopter's test
+ * suite pulls nothing in. This walk answers the same question under that
+ * constraint: the first REGULAR FILE on `PATH` named `name` (with a `PATHEXT`
+ * extension on Windows) that the process may execute.
+ */
+/** The `node` running this test, absolute. */
+export declare const NODE_EXECUTABLE: string;
+/** The names to try in one `PATH` directory: `PATHEXT` variants on Windows, the bare name elsewhere. */
+export declare function executableCandidates(name: string, platform: NodeJS.Platform, pathext: string | undefined): string[];
+/**
+ * The first executable named `name` on `PATH`, absolute.
+ *
+ * @throws {Error} when nothing on `PATH` is executable under that name — a
+ *   fixture that needs `git` and has none should fail at the first spawn with
+ *   the reason, not with the OS's `ENOENT` for a bare word.
+ */
+export declare function resolveExecutable(name: string): string;
+/** `git`, absolute, resolved on first use and cached for the process. */
+export declare function gitExecutable(): string;
+//# sourceMappingURL=executables.d.ts.map

package/dist/testing/executables.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executables.d.ts","sourceRoot":"","sources":["../../src/testing/executables.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,8CAA8C;AAC9C,eAAO,MAAM,eAAe,EAAE,MAAyB,CAAC;AAExD,wGAAwG;AACxG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAInH;AAcD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUtD;AAID,yEAAyE;AACzE,wBAAgB,aAAa,IAAI,MAAM,CAGtC"}

package/dist/testing/executables.js

@@ -0,0 +1,70 @@
+/**
+ * Absolute paths for the executables test fixtures spawn.
+ *
+ * A test that spawns `'git'` or `'node'` by bare name asks the OS to search
+ * `PATH`, and a writable directory on `PATH` turns that into a place to plant
+ * a binary (the class SonarCloud's S4036 flags). Fixtures resolve the binary
+ * ONCE, here, to an absolute path and spawn that: `node` is the process that
+ * is running the test (`process.execPath`, the only node whose version the
+ * test can vouch for), and `git` is found by walking `PATH`.
+ *
+ * Why a second `PATH` walk beside `safe-exec.ts`'s `which`: `which` resolves
+ * in-process too, but it is a third-party package, and the `./testing` subpath
+ * is pinned dependency-free (`subpath-purity.test.ts`) — an adopter's test
+ * suite pulls nothing in. This walk answers the same question under that
+ * constraint: the first REGULAR FILE on `PATH` named `name` (with a `PATHEXT`
+ * extension on Windows) that the process may execute.
+ */
+import { accessSync, constants, statSync } from 'node:fs';
+import { delimiter } from 'node:path';
+import { isFilesystemAccessError } from '../errors/errno.js';
+import { safePath } from '../path-core.js';
+/** The `node` running this test, absolute. */
+export const NODE_EXECUTABLE = process.execPath;
+/** The names to try in one `PATH` directory: `PATHEXT` variants on Windows, the bare name elsewhere. */
+export function executableCandidates(name, platform, pathext) {
+    if (platform !== 'win32')
+        return [name];
+    const extensions = (pathext ?? '.EXE;.CMD;.BAT;.COM').split(';').filter((ext) => ext !== '');
+    return [...extensions.map((ext) => `${name}${ext}`), name];
+}
+/** Is `full` a regular file the process may execute? A directory named `git` passes `X_OK` (search permission) and is not one. */
+function isExecutableFile(full) {
+    try {
+        accessSync(full, constants.X_OK);
+        return statSync(full).isFile();
+    }
+    catch (error) {
+        // Absent or not executable here: the next directory on PATH may have it.
+        if (isFilesystemAccessError(error))
+            return false;
+        throw error;
+    }
+}
+/**
+ * The first executable named `name` on `PATH`, absolute.
+ *
+ * @throws {Error} when nothing on `PATH` is executable under that name — a
+ *   fixture that needs `git` and has none should fail at the first spawn with
+ *   the reason, not with the OS's `ENOENT` for a bare word.
+ */
+export function resolveExecutable(name) {
+    const candidates = executableCandidates(name, process.platform, process.env['PATHEXT']);
+    for (const dir of (process.env['PATH'] ?? '').split(delimiter)) {
+        if (dir === '')
+            continue;
+        for (const candidate of candidates) {
+            const full = safePath.join(dir, candidate);
+            if (isExecutableFile(full))
+                return full;
+        }
+    }
+    throw new Error(`No executable named "${name}" on PATH (${process.env['PATH'] ?? '<unset>'})`);
+}
+let resolvedGit;
+/** `git`, absolute, resolved on first use and cached for the process. */
+export function gitExecutable() {
+    resolvedGit ??= resolveExecutable('git');
+    return resolvedGit;
+}
+//# sourceMappingURL=executables.js.map

package/dist/testing/executables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executables.js","sourceRoot":"","sources":["../../src/testing/executables.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,8CAA8C;AAC9C,MAAM,CAAC,MAAM,eAAe,GAAW,OAAO,CAAC,QAAQ,CAAC;AAExD,wGAAwG;AACxG,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,QAAyB,EAAE,OAA2B;IACvG,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;IAC7F,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,kIAAkI;AAClI,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,IAAI,uBAAuB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IACxF,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/D,IAAI,GAAG,KAAK,EAAE;YAAE,SAAS;QACzB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC3C,IAAI,gBAAgB,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,cAAc,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC;AACjG,CAAC;AAED,IAAI,WAA+B,CAAC;AAEpC,yEAAyE;AACzE,MAAM,UAAU,aAAa;IAC3B,WAAW,KAAK,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/testing/hostile-tree.d.ts

@@ -0,0 +1,79 @@
+/**
+ * One hostile fixture tree, built the same way for every sink.
+ *
+ * A correctness sweep found a delete, a copy and an uninstall that
+ * each walked out of their root, and found them by hand-building the same
+ * shapes — a symlink pointing out, a symlink pointing back at the root, a
+ * `..`-named entry, an unreadable directory, a traversal name — one throwaway
+ * fixture per probe. This module
+ * is that fixture, once, so a sink's test says `buildHostileTree(base)` and
+ * `it.each(HOSTILE_NAMES)` and is refusing the shapes the next sink's test is
+ * refusing too. A shape added here reaches every sink that uses it.
+ *
+ * ⛔ Framework-free, like everything under `testing/`: no `vitest` import, so
+ * the `./testing` subpath keeps the empty third-party set its purity pin
+ * asserts. Fields that the host cannot build are `null` — route those through
+ * the suite's own `skip()` so the skip is visible in the report.
+ */
+/** The names a sink must refuse when they arrive as "the entry to act on". */
+export declare const HOSTILE_NAMES: readonly string[];
+/** The tree {@link buildHostileTree} plants, every path absolute and forward-slashed. */
+export interface HostileTree {
+    /** The trusted root — the directory a sink must stay inside. */
+    readonly root: string;
+    /** A regular directory under the root; `root/member`. */
+    readonly member: string;
+    /** A member whose NAME begins with two dots; `root/..cache`. Legitimate. */
+    readonly dotdotNamed: string;
+    /** A sibling of the root, outside it. */
+    readonly outside: string;
+    /** `outside/victim` — holds `secret.txt`; a traversal that succeeds deletes or copies this. */
+    readonly victim: string;
+    /** `root/link-out` → `outside/victim`, or `null` where the host cannot symlink. */
+    readonly linkOut: string | null;
+    /** `root/link-in` → `root/member`, or `null` where the host cannot symlink. */
+    readonly linkIn: string | null;
+    /** `root/dangling` → a path that does not exist, or `null` where the host cannot symlink. */
+    readonly dangling: string | null;
+    /** `root/loop` → `root` itself — a walk that follows it never ends — or `null` where the host cannot symlink. */
+    readonly linkLoop: string | null;
+    /** A link OUTSIDE the tree that points AT the root, or `null` where the host cannot symlink. */
+    readonly rootAlias: string | null;
+    /** `root/unreadable`, mode 000, or `null` where the host cannot deny reads. */
+    readonly unreadable: string | null;
+    /** A directory whose own name is 200 characters, under the root; `null` where the OS refused it. */
+    readonly longPath: string | null;
+    /** Restore modes and remove everything this call created. Idempotent. */
+    cleanup(): void;
+}
+/**
+ * Plant the hostile tree under `base`, which must exist and be empty enough
+ * to take `root`, `outside` and `root-alias` as direct children.
+ *
+ * @param base - A scratch directory the caller owns (a per-test temp dir)
+ * @returns The tree, with `null` for every shape this host cannot build
+ */
+export declare function buildHostileTree(base: string): HostileTree;
+/** A hostile tree replanted per test, driven from the suite's own hooks. */
+export interface HostileTreePerTest {
+    /** Mint a scratch root and plant a fresh tree in it. Drive from `beforeEach`. */
+    plant: () => void;
+    /** Tear the tree down and remove the scratch root. Drive from `afterEach`. */
+    clear: () => void;
+    /** The tree planted by the most recent {@link HostileTreePerTest.plant}. */
+    tree: () => HostileTree;
+}
+/**
+ * Hold a per-test hostile tree, so a suite's wiring is three lines:
+ * `const hostile = hostileTreePerTest('x'); beforeEach(hostile.plant); afterEach(hostile.clear);`.
+ *
+ * Same shape and same reasons as `replantableCorpus`: the tree comes back
+ * through a GETTER because it is reminted per test, `plant` clears any tree
+ * still standing so nested `describe`s do not leak one, and `tree()` before
+ * `plant()` throws by name rather than surfacing as an undefined read.
+ *
+ * @param prefix - `mkdtemp` prefix for the scratch root, so a leak names its suite
+ * @returns Plant/clear/tree, to be driven from the caller's own hooks
+ */
+export declare function hostileTreePerTest(prefix: string): HostileTreePerTest;
+//# sourceMappingURL=hostile-tree.d.ts.map

package/dist/testing/hostile-tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostile-tree.d.ts","sourceRoot":"","sources":["../../src/testing/hostile-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH,8EAA8E;AAC9E,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAW1C,CAAC;AAEF,yFAAyF;AACzF,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,iHAAiH;IACjH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gGAAgG;IAChG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,yEAAyE;IACzE,OAAO,IAAI,IAAI,CAAC;CACjB;AAuBD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CA8D1D;AAED,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,8EAA8E;IAC9E,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,WAAW,CAAC;CACzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,kBAAkB,CAuBrE"}

package/dist/testing/hostile-tree.js

@@ -0,0 +1,164 @@
+/**
+ * One hostile fixture tree, built the same way for every sink.
+ *
+ * A correctness sweep found a delete, a copy and an uninstall that
+ * each walked out of their root, and found them by hand-building the same
+ * shapes — a symlink pointing out, a symlink pointing back at the root, a
+ * `..`-named entry, an unreadable directory, a traversal name — one throwaway
+ * fixture per probe. This module
+ * is that fixture, once, so a sink's test says `buildHostileTree(base)` and
+ * `it.each(HOSTILE_NAMES)` and is refusing the shapes the next sink's test is
+ * refusing too. A shape added here reaches every sink that uses it.
+ *
+ * ⛔ Framework-free, like everything under `testing/`: no `vitest` import, so
+ * the `./testing` subpath keeps the empty third-party set its purity pin
+ * asserts. Fields that the host cannot build are `null` — route those through
+ * the suite's own `skip()` so the skip is visible in the report.
+ */
+import { chmodSync, rmSync, writeFileSync } from 'node:fs';
+import { isFilesystemAccessError } from '../errors/errno.js';
+import { mkdirSyncReal, safePath } from '../path-utils.js';
+import { createSymlink, symlinkCapability } from '../test-helpers.js';
+import { CANNOT_DENY_READS } from './platform-gates.js';
+import { createTempDir, removeTempDir } from './temp-dir.js';
+/** The names a sink must refuse when they arrive as "the entry to act on". */
+export const HOSTILE_NAMES = [
+    '..',
+    '../victim',
+    '../../victim',
+    'a/../../victim',
+    String.raw `..\victim`,
+    '.',
+    '',
+    '/victim',
+    String.raw `C:\victim`,
+    `nul${String.fromCodePoint(0)}byte`,
+];
+/** A link, or `null` when this host cannot make one (the capability probe said so). */
+function tryLink(cap, target, link, type) {
+    if (cap === null)
+        return null;
+    createSymlink(cap, target, link, type);
+    return link;
+}
+function tryMkdir(dir) {
+    try {
+        mkdirSyncReal(dir);
+        return dir;
+    }
+    catch (error) {
+        // Only a name the OS will not take is "cannot build" — `ENAMETOOLONG` on
+        // a host with a shorter limit. Anything else is a broken fixture.
+        if (error instanceof Error && 'code' in error && error.code === 'ENAMETOOLONG') {
+            return null;
+        }
+        throw error;
+    }
+}
+/**
+ * Plant the hostile tree under `base`, which must exist and be empty enough
+ * to take `root`, `outside` and `root-alias` as direct children.
+ *
+ * @param base - A scratch directory the caller owns (a per-test temp dir)
+ * @returns The tree, with `null` for every shape this host cannot build
+ */
+export function buildHostileTree(base) {
+    const root = safePath.join(base, 'root');
+    const member = safePath.join(root, 'member');
+    const dotdotNamed = safePath.join(root, '..cache');
+    const outside = safePath.join(base, 'outside');
+    const victim = safePath.join(outside, 'victim');
+    mkdirSyncReal(member, { recursive: true });
+    mkdirSyncReal(safePath.join(root, 'nested', 'deep'), { recursive: true });
+    mkdirSyncReal(dotdotNamed);
+    mkdirSyncReal(victim, { recursive: true });
+    writeFileSync(safePath.join(victim, 'secret.txt'), 'TOKEN=abc\n');
+    writeFileSync(safePath.join(member, 'file.txt'), 'member\n');
+    const cap = symlinkCapability();
+    const linkOut = tryLink(cap, victim, safePath.join(root, 'link-out'), 'dir');
+    const linkIn = tryLink(cap, member, safePath.join(root, 'link-in'), 'dir');
+    const dangling = tryLink(cap, safePath.join(root, 'does-not-exist'), safePath.join(root, 'dangling'), 'file');
+    const linkLoop = tryLink(cap, root, safePath.join(root, 'loop'), 'dir');
+    const rootAlias = tryLink(cap, root, safePath.join(base, 'root-alias'), 'dir');
+    let unreadable = null;
+    if (!CANNOT_DENY_READS) {
+        unreadable = safePath.join(root, 'unreadable');
+        mkdirSyncReal(unreadable);
+        writeFileSync(safePath.join(unreadable, 'hidden.txt'), 'x');
+        chmodSync(unreadable, 0o000);
+    }
+    const longPath = tryMkdir(safePath.join(root, 'L'.repeat(200)));
+    let cleaned = false;
+    return {
+        root,
+        member,
+        dotdotNamed,
+        outside,
+        victim,
+        linkOut,
+        linkIn,
+        dangling,
+        linkLoop,
+        rootAlias,
+        unreadable,
+        longPath,
+        cleanup: () => {
+            if (cleaned)
+                return;
+            cleaned = true;
+            if (unreadable !== null) {
+                try {
+                    chmodSync(unreadable, 0o700);
+                }
+                catch (error) {
+                    // Already removed by the subject under test, which a delete sink is
+                    // entitled to do; a refusal to restore anything else stays loud.
+                    if (!isFilesystemAccessError(error))
+                        throw error;
+                }
+            }
+            for (const dir of [root, outside, rootAlias]) {
+                if (dir !== null)
+                    rmSync(dir, { recursive: true, force: true });
+            }
+        },
+    };
+}
+/**
+ * Hold a per-test hostile tree, so a suite's wiring is three lines:
+ * `const hostile = hostileTreePerTest('x'); beforeEach(hostile.plant); afterEach(hostile.clear);`.
+ *
+ * Same shape and same reasons as `replantableCorpus`: the tree comes back
+ * through a GETTER because it is reminted per test, `plant` clears any tree
+ * still standing so nested `describe`s do not leak one, and `tree()` before
+ * `plant()` throws by name rather than surfacing as an undefined read.
+ *
+ * @param prefix - `mkdtemp` prefix for the scratch root, so a leak names its suite
+ * @returns Plant/clear/tree, to be driven from the caller's own hooks
+ */
+export function hostileTreePerTest(prefix) {
+    let scratch;
+    let planted;
+    const clear = () => {
+        planted?.cleanup();
+        planted = undefined;
+        if (scratch !== undefined)
+            removeTempDir(scratch);
+        scratch = undefined;
+    };
+    return {
+        plant: () => {
+            clear();
+            scratch = createTempDir(prefix);
+            planted = buildHostileTree(scratch);
+        },
+        clear,
+        tree: () => {
+            if (planted === undefined) {
+                throw new Error(`hostileTreePerTest('${prefix}'): tree() before plant() — the suite is missing its beforeEach`);
+            }
+            return planted;
+        },
+    };
+}
+//# sourceMappingURL=hostile-tree.js.map

package/dist/testing/hostile-tree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostile-tree.js","sourceRoot":"","sources":["../../src/testing/hostile-tree.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,oBAAoB,CAAC;AAE9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG7D,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,IAAI;IACJ,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,MAAM,CAAC,GAAG,CAAA,WAAW;IACrB,GAAG;IACH,EAAE;IACF,SAAS;IACT,MAAM,CAAC,GAAG,CAAA,WAAW;IACrB,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM;CACpC,CAAC;AAgCF,uFAAuF;AACvF,SAAS,OAAO,CAAC,GAA6B,EAAE,MAAc,EAAE,IAAY,EAAE,IAAoB;IAChG,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,CAAC,CAAC;QACnB,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,kEAAkE;QAClE,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC/E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAEhD,aAAa,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,aAAa,CAAC,WAAW,CAAC,CAAC;IAC3B,aAAa,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,aAAa,CAAC,CAAC;IAClE,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IAE7D,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9G,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;IAE/E,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC/C,aAAa,CAAC,UAAU,CAAC,CAAC;QAC1B,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5D,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAEhE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,OAAO;QACL,IAAI;QACJ,MAAM;QACN,WAAW;QACX,OAAO;QACP,MAAM;QACN,OAAO;QACP,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,SAAS;QACT,UAAU;QACV,QAAQ;QACR,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACH,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBAC/B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,oEAAoE;oBACpE,iEAAiE;oBACjE,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;wBAAE,MAAM,KAAK,CAAC;gBACnD,CAAC;YACH,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC7C,IAAI,GAAG,KAAK,IAAI;oBAAE,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAYD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,IAAI,OAA2B,CAAC;IAChC,IAAI,OAAgC,CAAC;IACrC,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,OAAO,EAAE,OAAO,EAAE,CAAC;QACnB,OAAO,GAAG,SAAS,CAAC;QACpB,IAAI,OAAO,KAAK,SAAS;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO,GAAG,SAAS,CAAC;IACtB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,EAAE,GAAG,EAAE;YACV,KAAK,EAAE,CAAC;YACR,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,KAAK;QACL,IAAI,EAAE,GAAG,EAAE;YACT,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,iEAAiE,CAAC,CAAC;YAClH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/testing/platform-gates.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The host facts a fixture has to ask before it can build a refusal.
+ *
+ * ⛔ Framework-free, like everything under `testing/`: no `vitest` import, so
+ * the `./testing` subpath keeps the empty third-party set its purity pin
+ * asserts. Route a `true` here through the suite's own `skip()` so the skip is
+ * visible in the report — a fixture that silently no-ops is a passing test for
+ * a property nobody exercised.
+ */
+/**
+ * Whether a `chmod 000` on this host denies anything.
+ *
+ * Two hosts read every mode as readable: Windows, where POSIX mode bits do not
+ * bind at all, and a POSIX process running as root, which bypasses them. On
+ * either, a fixture directory made unreadable is still readable, so a test of
+ * "the walker refuses what it cannot list" would pass by listing it.
+ *
+ * ⚠️ Evaluated ONCE at module load, as a constant rather than a function, on
+ * purpose: the answer is a property of the process's identity and platform,
+ * neither of which changes mid-run, and a constant is what `it.skipIf(...)`
+ * takes. This one line used to be spelled in 28 test files under three names
+ * (`CANNOT_DENY_READS`, `PERMISSIONS_ENFORCED`, inline), which is 28 places
+ * for the `getuid` guard to drift.
+ */
+export declare const CANNOT_DENY_READS: boolean;
+/**
+ * The positive spelling, for the suites that phrase the gate as "only run
+ * where modes bind". Same fact, no second evaluation.
+ */
+export declare const PERMISSIONS_ENFORCED: boolean;
+//# sourceMappingURL=platform-gates.d.ts.map

package/dist/testing/platform-gates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-gates.d.ts","sourceRoot":"","sources":["../../src/testing/platform-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,EAAE,OACkE,CAAC;AAEnG;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,OAA4B,CAAC"}

package/dist/testing/platform-gates.js

@@ -0,0 +1,31 @@
+/**
+ * The host facts a fixture has to ask before it can build a refusal.
+ *
+ * ⛔ Framework-free, like everything under `testing/`: no `vitest` import, so
+ * the `./testing` subpath keeps the empty third-party set its purity pin
+ * asserts. Route a `true` here through the suite's own `skip()` so the skip is
+ * visible in the report — a fixture that silently no-ops is a passing test for
+ * a property nobody exercised.
+ */
+/**
+ * Whether a `chmod 000` on this host denies anything.
+ *
+ * Two hosts read every mode as readable: Windows, where POSIX mode bits do not
+ * bind at all, and a POSIX process running as root, which bypasses them. On
+ * either, a fixture directory made unreadable is still readable, so a test of
+ * "the walker refuses what it cannot list" would pass by listing it.
+ *
+ * ⚠️ Evaluated ONCE at module load, as a constant rather than a function, on
+ * purpose: the answer is a property of the process's identity and platform,
+ * neither of which changes mid-run, and a constant is what `it.skipIf(...)`
+ * takes. This one line used to be spelled in 28 test files under three names
+ * (`CANNOT_DENY_READS`, `PERMISSIONS_ENFORCED`, inline), which is 28 places
+ * for the `getuid` guard to drift.
+ */
+export const CANNOT_DENY_READS = process.platform === 'win32' || (typeof process.getuid === 'function' && process.getuid() === 0);
+/**
+ * The positive spelling, for the suites that phrase the gate as "only run
+ * where modes bind". Same fact, no second evaluation.
+ */
+export const PERMISSIONS_ENFORCED = !CANNOT_DENY_READS;
+//# sourceMappingURL=platform-gates.js.map

package/dist/testing/platform-gates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-gates.js","sourceRoot":"","sources":["../../src/testing/platform-gates.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAEnG;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAY,CAAC,iBAAiB,CAAC"}