@vibesdotdev/secrets 0.0.1 → 1.0.0-rc.3

package/dist/support/path-queue.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Run `task` after every task already queued for `path` in this process has
+ * settled, so a read-modify-write of one file never interleaves with another
+ * (no lost update). A failed task does not block the queue: its failure goes
+ * to its own caller. Different paths never wait on each other.
+ *
+ * This orders writers inside one process. It does not coordinate separate
+ * processes writing the same file.
+ */
+export declare function serializeByPath<T>(path: string, task: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=path-queue.d.ts.map

package/dist/support/path-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-queue.d.ts","sourceRoot":"","sources":["../../src/support/path-queue.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAezF"}

package/dist/support/path-queue.js

@@ -0,0 +1,31 @@
+/** The tail of each path's queue: resolves when the last queued task for that path has settled. */
+const tails = new Map();
+/**
+ * Run `task` after every task already queued for `path` in this process has
+ * settled, so a read-modify-write of one file never interleaves with another
+ * (no lost update). A failed task does not block the queue: its failure goes
+ * to its own caller. Different paths never wait on each other.
+ *
+ * This orders writers inside one process. It does not coordinate separate
+ * processes writing the same file.
+ */
+export async function serializeByPath(path, task) {
+    const previous = tails.get(path);
+    let release = () => undefined;
+    // The gate only ever resolves, so waiting on a predecessor's gate cannot throw.
+    const gate = new Promise((resolve) => {
+        release = resolve;
+    });
+    tails.set(path, gate);
+    try {
+        if (previous)
+            await previous;
+        return await task();
+    }
+    finally {
+        release();
+        if (tails.get(path) === gate)
+            tails.delete(path);
+    }
+}
+//# sourceMappingURL=path-queue.js.map

package/dist/support/path-queue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-queue.js","sourceRoot":"","sources":["../../src/support/path-queue.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAI,IAAY,EAAE,IAAsB;IAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,OAAO,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;IAC1C,gFAAgF;IAChF,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC1C,OAAO,GAAG,OAAO,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACtB,IAAI,CAAC;QACJ,IAAI,QAAQ;YAAE,MAAM,QAAQ,CAAC;QAC7B,OAAO,MAAM,IAAI,EAAE,CAAC;IACrB,CAAC;YAAS,CAAC;QACV,OAAO,EAAE,CAAC;QACV,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;AACF,CAAC"}

package/dist/support/runtime-resolver.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Resolve the active secrets store from a runtime.
+ *
+ * Generation executors, agents, and other runtime consumers that need
+ * to materialize `{ source: 'secret', key: ... }` credential references
+ * should call this once per operation and pass the returned implementation
+ * along with the active environment scope.
+ *
+ * Selection rules:
+ *   - Filter descriptors by tier (`local` / `dev` / `staging` / `production`)
+ *   - Highest `priority` wins; a tie is `INVALID_INPUT` `store-ambiguous`
+ *     (`pickTierSecretsStore`, the same pick the kind and every CLI command use)
+ *   - Descriptors are parsed (`parseSecretsStoreDescriptors`), never cast
+ *   - Returns `null` when the `secrets/store` kind is not registered, no
+ *     descriptors exist, **or no descriptor lists the requested tier**
+ *     (callers fall back to env / worker bindings — never force-load a
+ *     consumer-only backend like encrypted-local on production cloud)
+ *   - Throws if a tier-eligible backend IS selected but its impl cannot be
+ *     resolved (corrupt-state failure, never silent)
+ */
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import type { SecretsStoreImplementation } from '../domain/kinds/store.interface.ts';
+import type { EnvironmentTier } from '../domain/kinds/store.schema.ts';
+export declare function resolveSecretsStore(runtime: Pick<RuntimeRef, 'hasKind' | 'query'>, tier?: EnvironmentTier): Promise<SecretsStoreImplementation | null>;
+//# sourceMappingURL=runtime-resolver.d.ts.map

package/dist/support/runtime-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-resolver.d.ts","sourceRoot":"","sources":["../../src/support/runtime-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAC;AACrF,OAAO,KAAK,EAAE,eAAe,EAAyB,MAAM,iCAAiC,CAAC;AAE9F,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,EAC9C,IAAI,GAAE,eAAyB,GAC7B,OAAO,CAAC,0BAA0B,GAAG,IAAI,CAAC,CAU5C"}

package/dist/support/runtime-resolver.js

@@ -0,0 +1,33 @@
+/**
+ * Resolve the active secrets store from a runtime.
+ *
+ * Generation executors, agents, and other runtime consumers that need
+ * to materialize `{ source: 'secret', key: ... }` credential references
+ * should call this once per operation and pass the returned implementation
+ * along with the active environment scope.
+ *
+ * Selection rules:
+ *   - Filter descriptors by tier (`local` / `dev` / `staging` / `production`)
+ *   - Highest `priority` wins; a tie is `INVALID_INPUT` `store-ambiguous`
+ *     (`pickTierSecretsStore`, the same pick the kind and every CLI command use)
+ *   - Descriptors are parsed (`parseSecretsStoreDescriptors`), never cast
+ *   - Returns `null` when the `secrets/store` kind is not registered, no
+ *     descriptors exist, **or no descriptor lists the requested tier**
+ *     (callers fall back to env / worker bindings — never force-load a
+ *     consumer-only backend like encrypted-local on production cloud)
+ *   - Throws if a tier-eligible backend IS selected but its impl cannot be
+ *     resolved (corrupt-state failure, never silent)
+ */
+import { parseSecretsStoreDescriptors, pickTierSecretsStore } from "../domain/kinds/store-selection.js";
+export async function resolveSecretsStore(runtime, tier = 'local') {
+    if (!runtime.hasKind('secrets/store'))
+        return null;
+    const query = runtime.query('secrets/store');
+    // Fail closed on tier: never fall back to an ineligible consumer backend
+    // (e.g. encrypted-local on production workerd → getPathRoots → paths/roots 500).
+    const target = pickTierSecretsStore(parseSecretsStoreDescriptors(query.descriptors()), tier);
+    if (!target)
+        return null;
+    return query.withId(target.id).resolve();
+}
+//# sourceMappingURL=runtime-resolver.js.map

package/dist/support/runtime-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-resolver.js","sourceRoot":"","sources":["../../src/support/runtime-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,4BAA4B,EAAC,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAIvG,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAA8C,EAC9C,OAAwB,OAAO;IAE/B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAqD,eAAe,CAAC,CAAC;IACjG,yEAAyE;IACzE,iFAAiF;IACjF,MAAM,MAAM,GAAG,oBAAoB,CAAC,4BAA4B,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;AAC1C,CAAC"}

package/dist/support/secret-value.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Whether `key` is a credential name a store answers (what `assertSecretKey`
+ * accepts), for code that filters names it reads from a source it does not
+ * control (a mounted directory, a host manifest) instead of refusing a caller.
+ */
+export declare function isSecretKey(key: string): boolean;
+/** The longest secret value a store accepts, in UTF-16 code units (1 MiB of ASCII). */
+export declare const SECRET_VALUE_MAX_LENGTH = 1048576;
+/**
+ * Refuse a value no store may hold: not a string (a JS caller can hand any
+ * value through the typed interface), or longer than the cap. The value itself
+ * is never put in the error.
+ */
+export declare function assertSecretValue(value: string): void;
+/**
+ * `assertSecretValue`, plus no line break and no NUL: a value a line-oriented
+ * file (a dotenv file) can hold without one value becoming two lines.
+ */
+export declare function assertSingleLineSecretValue(value: string): void;
+//# sourceMappingURL=secret-value.d.ts.map

package/dist/support/secret-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-value.d.ts","sourceRoot":"","sources":["../../src/support/secret-value.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAKhD;AAED,uFAAuF;AACvF,eAAO,MAAM,uBAAuB,UAAY,CAAC;AAajD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAIrD;AAED;;;GAGG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAG/D"}

package/dist/support/secret-value.js

@@ -0,0 +1,49 @@
+import { CapabilityError, isCapabilityError } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { assertSecretKey } from "../domain/kinds/secret-key.js";
+import { attemptOf } from "./file-failure.js";
+/**
+ * Whether `key` is a credential name a store answers (what `assertSecretKey`
+ * accepts), for code that filters names it reads from a source it does not
+ * control (a mounted directory, a host manifest) instead of refusing a caller.
+ */
+export function isSecretKey(key) {
+    const checked = attemptOf(() => assertSecretKey(key));
+    if (checked.ok)
+        return true;
+    if (isCapabilityError(checked.failure) && checked.failure.reason === 'secret-key-invalid')
+        return false;
+    throw checked.failure;
+}
+/** The longest secret value a store accepts, in UTF-16 code units (1 MiB of ASCII). */
+export const SECRET_VALUE_MAX_LENGTH = 1_048_576;
+const SecretValueSchema = z.string().max(SECRET_VALUE_MAX_LENGTH);
+const SingleLineSecretValueSchema = SecretValueSchema.regex(/^[^\n\r\0]*$/);
+function invalid(problem) {
+    return new CapabilityError('The secret value is not acceptable.', 'INVALID_INPUT', {
+        reason: 'secret-value-invalid',
+        retryable: false,
+        details: { problem }
+    });
+}
+/**
+ * Refuse a value no store may hold: not a string (a JS caller can hand any
+ * value through the typed interface), or longer than the cap. The value itself
+ * is never put in the error.
+ */
+export function assertSecretValue(value) {
+    const parsed = SecretValueSchema.safeParse(value);
+    if (parsed.success)
+        return;
+    throw invalid(parsed.error.issues.some((issue) => issue.code === 'too_big') ? 'too-long' : 'not-a-string');
+}
+/**
+ * `assertSecretValue`, plus no line break and no NUL: a value a line-oriented
+ * file (a dotenv file) can hold without one value becoming two lines.
+ */
+export function assertSingleLineSecretValue(value) {
+    assertSecretValue(value);
+    if (!SingleLineSecretValueSchema.safeParse(value).success)
+        throw invalid('line-break-or-nul');
+}
+//# sourceMappingURL=secret-value.js.map

package/dist/support/secret-value.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-value.js","sourceRoot":"","sources":["../../src/support/secret-value.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAC,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACtC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,oBAAoB;QAAE,OAAO,KAAK,CAAC;IACxG,MAAM,OAAO,CAAC,OAAO,CAAC;AACvB,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAEjD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;AAClE,MAAM,2BAA2B,GAAG,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;AAE5E,SAAS,OAAO,CAAC,OAAe;IAC/B,OAAO,IAAI,eAAe,CAAC,qCAAqC,EAAE,eAAe,EAAE;QAClF,MAAM,EAAE,sBAAsB;QAC9B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE;KACpB,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC3B,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;AAC5G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACxD,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO;QAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAC/F,CAAC"}

package/dist/support/store-environment.d.ts

@@ -0,0 +1,10 @@
+import { type EnvironmentTier } from '../domain/kinds/schemas/store.schema.ts';
+/**
+ * The environment a file-backed store is asked about is one of the tier names
+ * (`local`, `dev`, `staging`, `production`), never free text: it becomes part of
+ * a file name or a vault section, so a path or an object-internal name is
+ * refused before anything is read or written. (A JS caller can hand any value
+ * through the typed interface; the schema parse is the check.)
+ */
+export declare function parseStoreEnvironment(environment: string): EnvironmentTier;
+//# sourceMappingURL=store-environment.d.ts.map

package/dist/support/store-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-environment.d.ts","sourceRoot":"","sources":["../../src/support/store-environment.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAErG;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,CAQ1E"}

package/dist/support/store-environment.js

@@ -0,0 +1,20 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { EnvironmentTierSchema } from "../domain/kinds/schemas/store.schema.js";
+/**
+ * The environment a file-backed store is asked about is one of the tier names
+ * (`local`, `dev`, `staging`, `production`), never free text: it becomes part of
+ * a file name or a vault section, so a path or an object-internal name is
+ * refused before anything is read or written. (A JS caller can hand any value
+ * through the typed interface; the schema parse is the check.)
+ */
+export function parseStoreEnvironment(environment) {
+    const parsed = EnvironmentTierSchema.safeParse(environment);
+    if (parsed.success)
+        return parsed.data;
+    throw new CapabilityError('The environment is not an environment tier.', 'INVALID_INPUT', {
+        reason: 'scope-invalid',
+        retryable: false,
+        details: { allowed: EnvironmentTierSchema.options.join(',') }
+    });
+}
+//# sourceMappingURL=store-environment.js.map

package/dist/support/store-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store-environment.js","sourceRoot":"","sources":["../../src/support/store-environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAuB,MAAM,yCAAyC,CAAC;AAErG;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACxD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,MAAM,IAAI,eAAe,CAAC,6CAA6C,EAAE,eAAe,EAAE;QACzF,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;KAC7D,CAAC,CAAC;AACJ,CAAC"}

package/dist/support/test-support/adapter-runtime.d.ts

@@ -0,0 +1,4 @@
+import { type FileSystemAdapterInterface } from '@vibesdotdev/filesystem';
+/** Compose a host with exactly the far-boundary filesystem supplied by the test. */
+export declare function runtimeOverAdapter(adapter?: FileSystemAdapterInterface, platform?: string): Promise<import("@vibesdotdev/kernel").VibesRuntime>;
+//# sourceMappingURL=adapter-runtime.d.ts.map

package/dist/support/test-support/adapter-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-runtime.d.ts","sourceRoot":"","sources":["../../../src/support/test-support/adapter-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,KAAK,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAI3F,oFAAoF;AACpF,wBAAsB,kBAAkB,CAAC,OAAO,CAAC,EAAE,0BAA0B,EAAE,QAAQ,SAAU,uDAahG"}

package/dist/support/test-support/adapter-runtime.js

@@ -0,0 +1,19 @@
+import { filesystemPlugin } from '@vibesdotdev/filesystem';
+import { createRuntimePlugin } from '@vibesdotdev/kernel';
+import { createTestRuntime } from '@vibesdotdev/testing/node/runtime';
+/** Compose a host with exactly the far-boundary filesystem supplied by the test. */
+export async function runtimeOverAdapter(adapter, platform = 'linux') {
+    const plugins = adapter ? [
+        filesystemPlugin,
+        createRuntimePlugin({
+            id: 'secrets.test-filesystem', name: 'Secrets test filesystem',
+            dependencies: ['filesystem'],
+            descriptors: [adapter.descriptor],
+            onRegister(runtime) {
+                runtime.registerLoader('filesystem/adapter', adapter.descriptor.id, async () => ({ impl: adapter }));
+            }
+        })
+    ] : [];
+    return (await createTestRuntime({ binding: 'owned', platform, hostFileSystem() { }, plugins })).runtime;
+}
+//# sourceMappingURL=adapter-runtime.js.map

package/dist/support/test-support/adapter-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-runtime.js","sourceRoot":"","sources":["../../../src/support/test-support/adapter-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAkC,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAEtE,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAoC,EAAE,QAAQ,GAAG,OAAO;IAChG,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;QACzB,gBAAgB;QAChB,mBAAmB,CAAC;YACnB,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE,yBAAyB;YAC9D,YAAY,EAAE,CAAC,YAAY,CAAC;YAC5B,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;YACjC,UAAU,CAAC,OAAO;gBACjB,OAAO,CAAC,cAAc,CAAC,oBAAoB,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACtG,CAAC;SACD,CAAC;KACF,CAAC,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CAAC,MAAM,iBAAiB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACzG,CAAC"}

package/dist/support/test-support/filesystem-descriptor.d.ts

@@ -0,0 +1,19 @@
+import { type FileSystemAdapterDescriptor } from '@vibesdotdev/filesystem/schemas/adapter-descriptor';
+/** The adapter id every in-package double registers under. */
+export declare const FILESYSTEM_DOUBLE_ID = "secrets-test-filesystem";
+/**
+ * The double's default capabilities. `versioned-file` is what the transport and
+ * mounted-files paths read through, and the schema requires its metadata beside
+ * it; `owner-private` is what the attestation claims are written with. A test
+ * that needs an adapter that cannot bound a read empties `capabilities` (see
+ * the filesystem double) rather than editing a descriptor.
+ */
+export declare const DEFAULT_CAPABILITIES: readonly ["list", "read", "write", "stat", "owner-private", "versioned-file"];
+/**
+ * The double's descriptor, parsed by its owning schema. The `versioned-file`
+ * metadata is present exactly when the capability list declares that capability,
+ * because the schema holds the two to each other; deriving it here is what lets a
+ * caller narrow the capability list without hand-editing the metadata.
+ */
+export declare function filesystemDoubleDescriptor(capabilities?: FileSystemAdapterDescriptor['capabilities']): FileSystemAdapterDescriptor;
+//# sourceMappingURL=filesystem-descriptor.d.ts.map

package/dist/support/test-support/filesystem-descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-descriptor.d.ts","sourceRoot":"","sources":["../../../src/support/test-support/filesystem-descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAEP,KAAK,2BAA2B,EAC/B,MAAM,oDAAoD,CAAC;AAE5D,8DAA8D;AAC9D,eAAO,MAAM,oBAAoB,4BAA4B,CAAC;AAE9D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,+EAOvB,CAAC;AAEX;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACzC,YAAY,GAAE,2BAA2B,CAAC,cAAc,CAA6B,GACnF,2BAA2B,CAoB7B"}

package/dist/support/test-support/filesystem-descriptor.js

@@ -0,0 +1,46 @@
+import { FileSystemAdapterDescriptorSchema } from '@vibesdotdev/filesystem/schemas/adapter-descriptor';
+/** The adapter id every in-package double registers under. */
+export const FILESYSTEM_DOUBLE_ID = 'secrets-test-filesystem';
+/**
+ * The double's default capabilities. `versioned-file` is what the transport and
+ * mounted-files paths read through, and the schema requires its metadata beside
+ * it; `owner-private` is what the attestation claims are written with. A test
+ * that needs an adapter that cannot bound a read empties `capabilities` (see
+ * the filesystem double) rather than editing a descriptor.
+ */
+export const DEFAULT_CAPABILITIES = [
+    'list',
+    'read',
+    'write',
+    'stat',
+    'owner-private',
+    'versioned-file'
+];
+/**
+ * The double's descriptor, parsed by its owning schema. The `versioned-file`
+ * metadata is present exactly when the capability list declares that capability,
+ * because the schema holds the two to each other; deriving it here is what lets a
+ * caller narrow the capability list without hand-editing the metadata.
+ */
+export function filesystemDoubleDescriptor(capabilities = [...DEFAULT_CAPABILITIES]) {
+    const declared = {
+        id: FILESYSTEM_DOUBLE_ID,
+        kind: 'filesystem/adapter',
+        name: 'Secrets Test FileSystem',
+        protocols: ['file', 'directory'],
+        capabilities,
+        // The host's Node-API adapter carries no `priority`; declaring one states
+        // this double's precedence without a test reaching past the kind's resolver.
+        priority: 100
+    };
+    // The schema holds the `versioned-file` capability and its metadata to each
+    // other, so the metadata is declared exactly when the capability is.
+    if (capabilities.includes('versioned-file')) {
+        return FileSystemAdapterDescriptorSchema.parse({
+            ...declared,
+            versionedFile: { revisionScheme: 'secrets-test-v1', revisionScope: 'file-content' }
+        });
+    }
+    return FileSystemAdapterDescriptorSchema.parse(declared);
+}
+//# sourceMappingURL=filesystem-descriptor.js.map

package/dist/support/test-support/filesystem-descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-descriptor.js","sourceRoot":"","sources":["../../../src/support/test-support/filesystem-descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EACP,iCAAiC,EAEhC,MAAM,oDAAoD,CAAC;AAE5D,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IACnC,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,eAAe;IACf,gBAAgB;CACP,CAAC;AAEX;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACzC,eAA4D,CAAC,GAAG,oBAAoB,CAAC;IAErF,MAAM,QAAQ,GAAG;QAChB,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,oBAAoB;QAC1B,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC;QAChC,YAAY;QACZ,0EAA0E;QAC1E,6EAA6E;QAC7E,QAAQ,EAAE,GAAG;KACb,CAAC;IACF,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,YAAY,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,OAAO,iCAAiC,CAAC,KAAK,CAAC;YAC9C,GAAG,QAAQ;YACX,aAAa,EAAE,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc,EAAE;SACnF,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,iCAAiC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC"}

package/dist/support/test-support/filesystem-double.d.ts

@@ -0,0 +1,41 @@
+import { type FilesystemDouble, type FilesystemDoubleOptions } from "../../schemas/domain/testing/filesystem.schema.ts";
+export { type FilesystemDouble, type FilesystemDoubleAdapter, type FilesystemDoubleOptions } from "../../schemas/domain/testing/filesystem.schema.ts";
+export { DEFAULT_CAPABILITIES, FILESYSTEM_DOUBLE_ID, filesystemDoubleDescriptor } from "./filesystem-descriptor.ts";
+export { escapeRegExp, joinPath, normalizePath, stripPrefix } from "./path-mechanics.ts";
+/**
+ * The one in-memory `filesystem/adapter` this package's tests register.
+ *
+ * The Node declared test environment already registers the kind and the Node-API
+ * adapter on every `createTestRuntime` host, so a per-file double could not
+ * re-register either: a hand-written descriptor literal was parsed by the real
+ * `FileSystemAdapterDescriptorSchema` and refused (`descriptor-invalid`, no
+ * `protocols`), a second `registerKind` threw, and a double that only won
+ * selection by being the sole candidate stopped winning. This module owns the
+ * three answers instead, once:
+ *
+ * 1. the kind is registered only when the host has none;
+ * 2. the descriptor is the owning schema's own parse of a literal, never a
+ *    hand-written duplicate type, so a required field that appears later refuses
+ *    here rather than silently registering an under-described adapter;
+ * 3. a host that must answer through a double composes the host filesystem out
+ *    (`hostFileSystem: () => {}`, through `bootSecretsTestRuntime`), leaving the
+ *    double as its only adapter; a test whose premise is "this host owns no
+ *    filesystem adapter at all" gets that same host, and the typed
+ *    `filesystem-adapter-not-registered` rows keep a real host to refuse on.
+ */
+import { CapabilityError, type VibesRuntime } from '@vibesdotdev/kernel';
+/**
+ * Register the in-memory adapter as `runtime`'s `filesystem/adapter`, and return
+ * the recorded view of it. The kind is registered only when the host has none
+ * (a bare `VibesRuntime` with no environment); on a `createTestRuntime` host the
+ * declared test environment registered it first and this registers the
+ * descriptor and loader against that kind.
+ *
+ * The host's own Node-API adapter wins selection by registration order, so a
+ * host that must answer through this double is booted with `hostFileSystem:
+ * false` (`bootSecretsTestRuntime`), which leaves this as its only adapter.
+ */
+export declare function registerFilesystemDouble(runtime?: VibesRuntime, options?: FilesystemDoubleOptions): FilesystemDouble;
+/** A typed adapter refusal, for a test that needs one this module does not produce. */
+export declare function notFound(): CapabilityError;
+//# sourceMappingURL=filesystem-double.d.ts.map

package/dist/support/test-support/filesystem-double.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-double.d.ts","sourceRoot":"","sources":["../../../src/support/test-support/filesystem-double.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAA8B,KAAK,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAKpJ,OAAO,EAAE,KAAK,gBAAgB,EAAC,KAAK,uBAAuB,EAAC,KAAK,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AACpJ,OAAO,EAAE,oBAAoB,EAAC,oBAAoB,EAAC,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAClH,OAAO,EAAE,YAAY,EAAC,QAAQ,EAAC,aAAa,EAAC,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACtF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACP,eAAe,EACf,KAAK,YAAY,EAChB,MAAM,qBAAqB,CAAC;AAe7B;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACvC,OAAO,CAAC,EAAE,YAAY,EACtB,OAAO,CAAC,EAAE,uBAAuB,GAC/B,gBAAgB,CAgIlB;AAED,uFAAuF;AACvF,wBAAgB,QAAQ,IAAI,eAAe,CAE1C"}

package/dist/support/test-support/filesystem-double.js

@@ -0,0 +1,196 @@
+import {} from "../../schemas/domain/testing/filesystem.schema.js";
+import { filesystemDoubleDescriptor } from "./filesystem-descriptor.js";
+import { pathOperations } from "./filesystem-paths.js";
+import { privateFileOperations } from "./private-files.js";
+import { registerAdapter } from "./register-adapter.js";
+export {} from "../../schemas/domain/testing/filesystem.schema.js";
+export { DEFAULT_CAPABILITIES, FILESYSTEM_DOUBLE_ID, filesystemDoubleDescriptor } from "./filesystem-descriptor.js";
+export { escapeRegExp, joinPath, normalizePath, stripPrefix } from "./path-mechanics.js";
+/**
+ * The one in-memory `filesystem/adapter` this package's tests register.
+ *
+ * The Node declared test environment already registers the kind and the Node-API
+ * adapter on every `createTestRuntime` host, so a per-file double could not
+ * re-register either: a hand-written descriptor literal was parsed by the real
+ * `FileSystemAdapterDescriptorSchema` and refused (`descriptor-invalid`, no
+ * `protocols`), a second `registerKind` threw, and a double that only won
+ * selection by being the sole candidate stopped winning. This module owns the
+ * three answers instead, once:
+ *
+ * 1. the kind is registered only when the host has none;
+ * 2. the descriptor is the owning schema's own parse of a literal, never a
+ *    hand-written duplicate type, so a required field that appears later refuses
+ *    here rather than silently registering an under-described adapter;
+ * 3. a host that must answer through a double composes the host filesystem out
+ *    (`hostFileSystem: () => {}`, through `bootSecretsTestRuntime`), leaving the
+ *    double as its only adapter; a test whose premise is "this host owns no
+ *    filesystem adapter at all" gets that same host, and the typed
+ *    `filesystem-adapter-not-registered` rows keep a real host to refuse on.
+ */
+import { CapabilityError } from '@vibesdotdev/kernel';
+/**
+ * The host's errno, as the canonical taxonomy carries one: a `CapabilityError`
+ * whose `details.code` is the host's own code, so a double and the host's own
+ * adapter refuse through the same value a caller reads.
+ */
+function nativeError(message, code) {
+    return new CapabilityError(message, 'UNAVAILABLE', {
+        reason: 'filesystem-host-error',
+        retryable: false,
+        details: { code }
+    });
+}
+/**
+ * Register the in-memory adapter as `runtime`'s `filesystem/adapter`, and return
+ * the recorded view of it. The kind is registered only when the host has none
+ * (a bare `VibesRuntime` with no environment); on a `createTestRuntime` host the
+ * declared test environment registered it first and this registers the
+ * descriptor and loader against that kind.
+ *
+ * The host's own Node-API adapter wins selection by registration order, so a
+ * host that must answer through this double is booted with `hostFileSystem:
+ * false` (`bootSecretsTestRuntime`), which leaves this as its only adapter.
+ */
+export function registerFilesystemDouble(runtime, options) {
+    const files = new Map();
+    if (options?.files) {
+        if (options.files instanceof Map) {
+            for (const [path, content] of options.files) {
+                files.set(path, content);
+            }
+        }
+        else {
+            for (const [path, content] of Object.entries(options.files)) {
+                files.set(path, content);
+            }
+        }
+    }
+    const reads = [];
+    const unreadable = new Map();
+    const statSizes = new Map();
+    const descriptor = filesystemDoubleDescriptor(options?.capabilities);
+    // The parsed descriptor's own array, not a second one: a test that empties
+    // `capabilities` must be editing what the implementation reads, which is how
+    // the "an adapter that cannot bound a read" rows reach their refusal.
+    const capabilities = descriptor.capabilities;
+    const adapter = {
+        ...privateFileOperations(files, () => double.sharedParent),
+        ...pathOperations(files),
+        descriptor,
+        async exists(path) {
+            return files.has(path);
+        },
+        async stat(path) {
+            const errno = unreadable.get(path);
+            if (errno)
+                throw nativeError(`${errno}: ${path}`, errno);
+            const data = files.get(path);
+            if (data === undefined)
+                throw nativeError(`ENOENT: ${path}`, 'ENOENT');
+            return {
+                kind: 'file',
+                size: statSizes.get(path) ?? new TextEncoder().encode(data).byteLength,
+                mtime: new Date(0).toISOString(),
+                readable: true,
+                writable: true,
+                isSymlink: false
+            };
+        },
+        async readFile(path) {
+            reads.push(path);
+            const errno = unreadable.get(path);
+            if (errno)
+                throw nativeError(`${errno}: ${path}`, errno);
+            const data = files.get(path);
+            if (data === undefined)
+                throw nativeError(`ENOENT: ${path}`, 'ENOENT');
+            return data;
+        },
+        /** The adapter's bounded read: recorded only when the file is within `maxBytes`. */
+        async readFileVersioned(path, options) {
+            const errno = unreadable.get(path);
+            if (errno) {
+                return {
+                    status: 'unavailable',
+                    reason: `${errno}: read failed`,
+                    cause: nativeError(`${errno}: ${path}`, errno)
+                };
+            }
+            const data = files.get(path);
+            if (data === undefined)
+                return { status: 'not-found', reason: 'File does not exist' };
+            const bytes = new TextEncoder().encode(data);
+            if (bytes.byteLength > options.maxBytes) {
+                return {
+                    status: 'too-large',
+                    reason: 'too large',
+                    sizeBytes: bytes.byteLength,
+                    maxBytes: options.maxBytes
+                };
+            }
+            reads.push(path);
+            return {
+                status: 'ok',
+                bytes,
+                revision: { scheme: 'secrets-test-v1', value: String(bytes.byteLength) }
+            };
+        },
+        async writeFile(path, data) {
+            files.set(path, data instanceof Uint8Array ? new TextDecoder().decode(data) : data);
+        },
+        async list(path) {
+            const prefix = path.endsWith('/') ? path : `${path}/`;
+            return [...files.keys()]
+                .filter((candidate) => candidate.startsWith(prefix))
+                .map((candidate) => ({
+                id: candidate,
+                name: candidate.slice(prefix.length),
+                path: candidate,
+                kind: 'file',
+                sizeBytes: new TextEncoder().encode(files.get(candidate) ?? '').byteLength,
+                readable: true,
+                writable: true
+            }));
+        },
+        async mkdir() { },
+        async remove(path) {
+            files.delete(path);
+        },
+        async rename(oldPath, newPath) {
+            const data = files.get(oldPath);
+            if (data === undefined)
+                throw nativeError(`ENOENT: ${oldPath}`, 'ENOENT');
+            files.set(newPath, data);
+            files.delete(oldPath);
+        },
+        async copy(source, destination) {
+            const data = files.get(source);
+            if (data === undefined)
+                throw nativeError(`ENOENT: ${source}`, 'ENOENT');
+            files.set(destination, data);
+        },
+        async watch() {
+            // An in-memory table has no host to watch; the disposer is what the
+            // contract owes a caller.
+            return () => { };
+        },
+    };
+    const double = {
+        adapter,
+        files,
+        reads,
+        unreadable,
+        statSizes,
+        capabilities,
+        descriptor,
+        sharedParent: options?.sharedParent
+    };
+    if (runtime)
+        registerAdapter(runtime, descriptor, adapter);
+    return double;
+}
+/** A typed adapter refusal, for a test that needs one this module does not produce. */
+export function notFound() {
+    return new CapabilityError('absent', 'NOT_FOUND', { reason: 'filesystem-missing' });
+}
+//# sourceMappingURL=filesystem-double.js.map

package/dist/support/test-support/filesystem-double.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-double.js","sourceRoot":"","sources":["../../../src/support/test-support/filesystem-double.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmF,MAAM,mDAAmD,CAAC;AACpJ,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAmF,MAAM,mDAAmD,CAAC;AACpJ,OAAO,EAAE,oBAAoB,EAAC,oBAAoB,EAAC,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAClH,OAAO,EAAE,YAAY,EAAC,QAAQ,EAAC,aAAa,EAAC,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACtF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EACP,eAAe,EAEd,MAAM,qBAAqB,CAAC;AAE7B;;;;GAIG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IACjD,OAAO,IAAI,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE;QAClD,MAAM,EAAE,uBAAuB;QAC/B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,EAAE,IAAI,EAAE;KACjB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACvC,OAAsB,EACtB,OAAiC;IAEjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,KAAK,YAAY,GAAG,EAAE,CAAC;YAClC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC7C,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;aAAM,CAAC;YACP,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7D,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1B,CAAC;QACF,CAAC;IACF,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACrE,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC7C,MAAM,OAAO,GAA4B;QACxC,GAAG,qBAAqB,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;QAC1D,GAAG,cAAc,CAAC,KAAK,CAAC;QACxB,UAAU;QACV,KAAK,CAAC,MAAM,CAAC,IAAY;YACxB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAY;YACtB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK;gBAAE,MAAM,WAAW,CAAC,GAAG,KAAK,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,WAAW,CAAC,WAAW,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO;gBACN,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU;gBACtE,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gBAChC,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,KAAK;aAChB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAY;YAC1B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK;gBAAE,MAAM,WAAW,CAAC,GAAG,KAAK,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,WAAW,CAAC,WAAW,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACb,CAAC;QACD,oFAAoF;QACpF,KAAK,CAAC,iBAAiB,CAAC,IAAY,EAAE,OAA6B;YAClE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,CAAC;gBACX,OAAO;oBACN,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE,GAAG,KAAK,eAAe;oBAC/B,KAAK,EAAE,WAAW,CAAC,GAAG,KAAK,KAAK,IAAI,EAAE,EAAE,KAAK,CAAC;iBAC9C,CAAC;YACH,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YACtF,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzC,OAAO;oBACN,MAAM,EAAE,WAAW;oBACnB,MAAM,EAAE,WAAW;oBACnB,SAAS,EAAE,KAAK,CAAC,UAAU;oBAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;iBAC1B,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO;gBACN,MAAM,EAAE,IAAI;gBACZ,KAAK;gBACL,QAAQ,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE;aACxE,CAAC;QACH,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,IAAyB;YACtD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAY;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;YACtD,OAAO,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;iBACtB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;iBACnD,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;gBACpB,EAAE,EAAE,SAAS;gBACb,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;gBACpC,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,MAAe;gBACrB,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU;gBAC1E,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,IAAI;aACd,CAAC,CAAC,CAAC;QACN,CAAC;QACD,KAAK,CAAC,KAAK,KAAoB,CAAC;QAChC,KAAK,CAAC,MAAM,CAAC,IAAY;YACxB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;YAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,WAAW,CAAC,WAAW,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;YAC1E,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzB,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,WAAmB;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,WAAW,CAAC,WAAW,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;YACzE,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,CAAC,KAAK;YACV,oEAAoE;YACpE,0BAA0B;YAC1B,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;QAClB,CAAC;KACD,CAAC;IACF,MAAM,MAAM,GAAqB;QAChC,OAAO;QACP,KAAK;QACL,KAAK;QACL,UAAU;QACV,SAAS;QACT,YAAY;QACZ,UAAU;QACV,YAAY,EAAE,OAAO,EAAE,YAAY;KACnC,CAAC;IACF,IAAI,OAAO;QAAE,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,QAAQ;IACvB,OAAO,IAAI,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACrF,CAAC"}

package/dist/support/test-support/filesystem-paths.d.ts

@@ -0,0 +1,3 @@
+import type { FilesystemDoubleAdapter } from '../../schemas/domain/testing/filesystem.schema.ts';
+export declare function pathOperations(files: Map<string, string>): Pick<FilesystemDoubleAdapter, "resolve" | "dirname" | "basename" | "join" | "relative" | "isAbsolute" | "normalize" | "extname" | "glob">;
+//# sourceMappingURL=filesystem-paths.d.ts.map

package/dist/support/test-support/filesystem-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-paths.d.ts","sourceRoot":"","sources":["../../../src/support/test-support/filesystem-paths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mDAAmD,CAAC;AAGjG,wBAAgB,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,uBAAuB,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC,CAoDpM"}