@stsepelin/checktrail 0.1.0-alpha.1

package/dist/src/inventory.js

@@ -0,0 +1,94 @@
+import { createHash } from "node:crypto";
+import { lstat, readdir, readFile, realpath } from "node:fs/promises";
+import path from "node:path";
+const excludedDirectories = new Set([
+    ".git",
+    "node_modules",
+    "vendor",
+    ".venv",
+    "venv",
+    "__pycache__",
+    "dist",
+    "build",
+    ".build",
+    "target",
+    "coverage",
+    ".next",
+    ".nuxt",
+    ".output",
+    ".checktrail",
+    ".repo-verifier",
+    ".terraform",
+    "obj",
+]);
+function sensitive(name) {
+    return (name === ".env" ||
+        name.startsWith(".env.") ||
+        name === ".checktrail.local.json" ||
+        name === ".repo-verifier.local.json" ||
+        /\.(pem|key|p12|pfx)$/i.test(name));
+}
+export async function withinRoot(root, relative) {
+    if (path.isAbsolute(relative) || relative.includes("\0"))
+        throw new Error("Expected a relative path");
+    const canonicalRoot = await realpath(root);
+    const resolved = await realpath(path.resolve(canonicalRoot, relative));
+    const relation = path.relative(canonicalRoot, resolved);
+    if (relation === ".." ||
+        relation.startsWith(`..${path.sep}`) ||
+        path.isAbsolute(relation)) {
+        throw new Error("Path escapes configured root");
+    }
+    return resolved;
+}
+export async function readProjectFile(root, relative) {
+    const resolved = await withinRoot(root, relative);
+    const stat = await lstat(resolved);
+    if (!stat.isFile() || stat.size > 8 * 1024 * 1024)
+        throw new Error("File exceeds inventory limits");
+    return readFile(resolved, "utf8");
+}
+export async function inventory(inputRoot) {
+    const root = await realpath(inputRoot);
+    const files = [];
+    const excluded = [];
+    const hash = createHash("sha256");
+    let size = 0;
+    let entriesSeen = 0;
+    async function visit(relative, depth) {
+        if (depth > 32)
+            throw new Error("Inventory depth limit exceeded");
+        const directory = await withinRoot(root, relative);
+        const entries = await readdir(directory, { withFileTypes: true });
+        entries.sort((a, b) => a.name.localeCompare(b.name, "en"));
+        for (const entry of entries) {
+            if (++entriesSeen > 20_000)
+                throw new Error("Inventory entry limit exceeded");
+            const file = relative === "." ? entry.name : `${relative}/${entry.name}`;
+            if (entry.name === ".git" ||
+                entry.isSymbolicLink() ||
+                sensitive(entry.name) ||
+                (entry.isDirectory() && excludedDirectories.has(entry.name))) {
+                excluded.push(file);
+            }
+            else if (entry.isDirectory()) {
+                await visit(file, depth + 1);
+            }
+            else if (entry.isFile()) {
+                const resolved = await withinRoot(root, file);
+                const stat = await lstat(resolved);
+                size += stat.size;
+                if (stat.size > 8 * 1024 * 1024 || size > 64 * 1024 * 1024) {
+                    throw new Error("Inventory byte limit exceeded");
+                }
+                const bytes = await readFile(resolved);
+                hash.update(JSON.stringify([file, bytes.length]));
+                hash.update(bytes);
+                files.push(file);
+            }
+        }
+    }
+    await visit(".", 0);
+    hash.update(JSON.stringify(excluded));
+    return { root, files, excluded, fingerprint: hash.digest("hex") };
+}

package/dist/src/java-compiler.d.ts

@@ -0,0 +1 @@
+export declare const javaCompilerSource: string;

package/dist/src/java-compiler.js

@@ -0,0 +1,110 @@
+export const javaCompilerSource = String.raw `
+import java.io.*;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.*;
+import java.util.*;
+import java.util.jar.*;
+import javax.tools.*;
+import com.sun.source.tree.*;
+import com.sun.source.util.*;
+
+class VerifierCompiler {
+  static String quote(String value) {
+    if (value == null) return "null";
+    StringBuilder out = new StringBuilder("\"");
+    for (char c : value.toCharArray()) {
+      if (c == '"' || c == '\\') out.append('\\').append(c);
+      else if (c < 32 || Character.isSurrogate(c)) out.append(String.format("\\u%04x", (int)c));
+      else out.append(c);
+    }
+    return out.append('"').toString();
+  }
+  static String strings(Collection<String> values) {
+    return "[" + String.join(",", values.stream().map(VerifierCompiler::quote).toList()) + "]";
+  }
+  public static void main(String[] args) throws Exception {
+    List<String> input = Files.readAllLines(Path.of(args[0]), StandardCharsets.UTF_8);
+    int release = Integer.parseInt(input.get(0));
+    boolean strict = Boolean.parseBoolean(input.get(1));
+    int count = Integer.parseInt(input.get(2));
+    List<Path> jars = new ArrayList<>();
+    for (int i = 0; i < count; i++) {
+      Path jar = Path.of(new String(Base64.getDecoder().decode(input.get(3 + i)), StandardCharsets.UTF_8));
+      try (JarFile archive = new JarFile(jar.toFile())) {
+        if (archive.getManifest() != null && archive.getManifest().getMainAttributes().getValue(Attributes.Name.CLASS_PATH) != null)
+          throw new IOException("Implicit JAR classpath is unsupported");
+        if (archive.stream().anyMatch(entry -> entry.getName().endsWith(".java")))
+          throw new IOException("Source-bearing JARs are unsupported");
+      }
+      jars.add(jar);
+    }
+    List<Path> sources = new ArrayList<>();
+    for (int i = 3 + count; i < input.size(); i++)
+      sources.add(Path.of(new String(Base64.getDecoder().decode(input.get(i)), StandardCharsets.UTF_8)));
+    JavaCompiler compiler = ToolProvider.getSystemJavaCompiler();
+    if (compiler == null) throw new IOException("Full JDK required");
+    List<Diagnostic<? extends JavaFileObject>> diagnostics = new ArrayList<>();
+    DiagnosticListener<JavaFileObject> listener = diagnostic -> {
+      if (diagnostics.size() >= 2000) throw new IllegalStateException("Diagnostic limit exceeded");
+      diagnostics.add(diagnostic);
+    };
+    try (StandardJavaFileManager standard = compiler.getStandardFileManager(listener, Locale.ROOT, StandardCharsets.UTF_8)) {
+      standard.setLocationFromPaths(StandardLocation.CLASS_PATH, jars);
+      standard.setLocationFromPaths(StandardLocation.SOURCE_PATH, List.of());
+      standard.setLocationFromPaths(StandardLocation.ANNOTATION_PROCESSOR_PATH, List.of());
+      long[] bytes = {0};
+      JavaFileManager manager = new ForwardingJavaFileManager<StandardJavaFileManager>(standard) {
+        @Override public JavaFileObject getJavaFileForOutput(Location location, String name, JavaFileObject.Kind kind, FileObject sibling) throws IOException {
+          if (location != StandardLocation.CLASS_OUTPUT || kind != JavaFileObject.Kind.CLASS)
+            throw new IOException("Unexpected compiler output");
+          return new SimpleJavaFileObject(URI.create("memory:///" + name.replace('.', '/') + kind.extension), kind) {
+            @Override public OutputStream openOutputStream() {
+              return new OutputStream() {
+                public void write(int value) throws IOException {
+                  if (++bytes[0] > 32 * 1024 * 1024) throw new IOException("Output limit exceeded");
+                }
+                public void write(byte[] value, int offset, int length) throws IOException {
+                  bytes[0] += length;
+                  if (bytes[0] > 32 * 1024 * 1024) throw new IOException("Output limit exceeded");
+                }
+              };
+            }
+          };
+        }
+      };
+      List<String> options = new ArrayList<>(List.of("--release", Integer.toString(release), "-encoding", "UTF-8", "-proc:none", "-implicit:none", "-Xlint:all", "-Xmaxerrs", "2000", "-Xmaxwarns", "2000"));
+      if (strict) options.add("-Werror");
+      StringWriter extra = new StringWriter();
+      JavacTask task = (JavacTask)compiler.getTask(extra, manager, listener, options, null, standard.getJavaFileObjectsFromPaths(sources));
+      Map<String, Integer> parsed = new TreeMap<>();
+      Map<String, Set<String>> declared = new TreeMap<>();
+      Map<String, Set<String>> analyzed = new TreeMap<>();
+      int[] finished = {0};
+      task.addTaskListener(new TaskListener() {
+        @Override public void finished(TaskEvent event) {
+          if (event.getKind() == TaskEvent.Kind.COMPILATION) finished[0]++;
+          if (event.getSourceFile() == null) return;
+          String file = Path.of(event.getSourceFile().toUri()).toAbsolutePath().normalize().toString();
+          if (event.getKind() == TaskEvent.Kind.PARSE) {
+            parsed.merge(file, 1, Integer::sum);
+            Set<String> types = declared.computeIfAbsent(file, key -> new TreeSet<>());
+            CompilationUnitTree unit = event.getCompilationUnit();
+            String prefix = unit.getPackageName() == null ? "" : unit.getPackageName().toString() + ".";
+            for (Tree tree : unit.getTypeDecls()) if (tree instanceof ClassTree type)
+              types.add(prefix + type.getSimpleName());
+          }
+          if (event.getKind() == TaskEvent.Kind.ANALYZE && event.getTypeElement() != null)
+            analyzed.computeIfAbsent(file, key -> new TreeSet<>()).add(event.getTypeElement().getQualifiedName().toString());
+        }
+      });
+      boolean success = task.call();
+      List<String> observations = new ArrayList<>();
+      for (String file : parsed.keySet()) observations.add("{\"file\":" + quote(file) + ",\"parsed\":" + parsed.get(file) + ",\"declared\":" + strings(declared.getOrDefault(file, Set.of())) + ",\"analyzed\":" + strings(analyzed.getOrDefault(file, Set.of())) + "}");
+      List<String> messages = new ArrayList<>();
+      for (Diagnostic<? extends JavaFileObject> item : diagnostics) messages.add("{\"kind\":" + quote(item.getKind().name()) + ",\"code\":" + quote(item.getCode()) + ",\"message\":" + quote(item.getMessage(Locale.ROOT)) + ",\"file\":" + quote(item.getSource() == null ? null : Path.of(item.getSource().toUri()).toAbsolutePath().normalize().toString()) + ",\"line\":" + item.getLineNumber() + "}");
+      System.out.print("{\"version\":1,\"runtime\":" + quote(Runtime.version().toString()) + ",\"vendor\":" + quote(System.getProperty("java.vendor")) + ",\"success\":" + success + ",\"finished\":" + finished[0] + ",\"extra\":" + quote(extra.toString()) + ",\"sources\":[" + String.join(",", observations) + "],\"diagnostics\":[" + String.join(",", messages) + "]}");
+    }
+  }
+}
+`;

package/dist/src/java-evidence.d.ts

@@ -0,0 +1,2 @@
+import type { Check, CheckResult, ProcessResult } from "./types.js";
+export declare function javaEvidence(check: Check, processes: ProcessResult[], root: string | undefined): Pick<CheckResult, "status" | "reason" | "findings" | "findingsComplete">;

package/dist/src/java-evidence.js

@@ -0,0 +1,114 @@
+import path from "node:path";
+import { z } from "zod";
+import { javaInvocationSchema } from "./java.js";
+const schema = z.strictObject({
+    version: z.literal(1),
+    runtime: z.literal("25.0.4+7-LTS"),
+    vendor: z.literal("Eclipse Adoptium"),
+    success: z.boolean(),
+    finished: z.number().int().nonnegative(),
+    extra: z.string(),
+    sources: z
+        .array(z.strictObject({
+        file: z.string(),
+        parsed: z.number().int().nonnegative(),
+        declared: z.array(z.string()),
+        analyzed: z.array(z.string()),
+    }))
+        .max(20_000),
+    diagnostics: z
+        .array(z.strictObject({
+        kind: z.enum([
+            "ERROR",
+            "WARNING",
+            "MANDATORY_WARNING",
+            "NOTE",
+            "OTHER",
+        ]),
+        code: z.string().min(1),
+        message: z.string(),
+        file: z.string().nullable(),
+        line: z.number().int(),
+    }))
+        .max(2000),
+});
+export function javaEvidence(check, processes, root) {
+    const incomplete = {
+        status: "inconclusive",
+        reason: "Java evidence is malformed or lacks native source/analysis accounting",
+        findingsComplete: false,
+    };
+    if (!root || processes.length !== 1)
+        return incomplete;
+    const process = processes[0];
+    if (process.exitCode === 3) {
+        try {
+            z.strictObject({ unavailable: z.literal("java-toolchain") }).parse(JSON.parse(process.stdout));
+            return {
+                status: "unavailable",
+                reason: "The verified Temurin Java compiler is unavailable",
+            };
+        }
+        catch {
+            return incomplete;
+        }
+    }
+    if (process.exitCode !== 0)
+        return {
+            status: "error",
+            reason: "Java evidence collection did not complete normally",
+            findingsComplete: false,
+        };
+    try {
+        const data = schema.parse(JSON.parse(process.stdout));
+        const planned = javaInvocationSchema.parse(JSON.parse(check.commands[0].args[2]));
+        if (JSON.stringify(planned.scope) !== JSON.stringify(check.scope) ||
+            data.finished !== 1 ||
+            data.extra.trim())
+            return incomplete;
+        const expected = new Set(check.scope.map((file) => path.resolve(root, check.project, file)));
+        const findings = data.diagnostics.map((item) => ({
+            ruleId: `javac/${item.code}`,
+            level: item.kind === "ERROR"
+                ? "error"
+                : item.kind.endsWith("WARNING")
+                    ? "warning"
+                    : "note",
+            message: item.message,
+            ...(item.file && expected.has(item.file) && item.line > 0
+                ? {
+                    file: path.relative(root, item.file).split(path.sep).join("/"),
+                    line: item.line,
+                }
+                : {}),
+        }));
+        const errors = data.diagnostics.some((item) => item.kind === "ERROR");
+        if (errors && !data.success)
+            return {
+                status: "failed",
+                reason: "Java reported compiler errors; failed compilation does not establish complete analysis",
+                findings,
+                findingsComplete: false,
+            };
+        if (errors ||
+            !data.success ||
+            !expected.size ||
+            data.sources.length !== expected.size ||
+            new Set(data.sources.map((item) => item.file)).size !== expected.size ||
+            data.sources.some((item) => !expected.has(item.file) ||
+                item.parsed !== 1 ||
+                new Set(item.declared).size !== item.declared.length ||
+                new Set(item.analyzed).size !== item.analyzed.length ||
+                item.declared.some((type) => !item.analyzed.includes(type))))
+            return { ...incomplete, findings };
+        return {
+            status: "passed",
+            reason: "The configured Java sources compiled with complete parse/analysis accounting; no application code or tests were executed",
+            findings,
+            findingsComplete: true,
+        };
+    }
+    catch {
+        return incomplete;
+    }
+}

package/dist/src/java-runner.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/java-runner.js

@@ -0,0 +1,79 @@
+import { spawnSync } from "node:child_process";
+import { mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { javaCompilerSource } from "./java-compiler.js";
+import { javaDependencies, javaInvocationSchema } from "./java.js";
+import { withinRoot } from "./inventory.js";
+const env = { ...process.env };
+for (const name of [
+    "JAVA_TOOL_OPTIONS",
+    "JDK_JAVA_OPTIONS",
+    "_JAVA_OPTIONS",
+    "CLASSPATH",
+])
+    delete env[name];
+function invoke(args) {
+    return spawnSync("java", args, {
+        env,
+        encoding: "utf8",
+        maxBuffer: 1024 * 1024,
+    });
+}
+async function main() {
+    const version = invoke(["--version"]);
+    if (process.argv[2] === "--version") {
+        process.stdout.write(version.stdout ?? "");
+        process.stderr.write(version.stderr ?? "");
+        process.exitCode = version.status ?? 2;
+        return;
+    }
+    if (version.status !== 0 ||
+        version.stderr ||
+        !version.stdout.startsWith("openjdk 25.0.4 2026-07-21 LTS\nOpenJDK Runtime Environment Temurin-25.0.4+7 ")) {
+        process.stdout.write(JSON.stringify({ unavailable: "java-toolchain" }));
+        process.exitCode = 3;
+        return;
+    }
+    const root = await realpath(process.argv[2]);
+    const project = path.relative(root, await realpath(process.cwd())) || ".";
+    const invocation = javaInvocationSchema.parse(JSON.parse(process.argv[3]));
+    const jars = await javaDependencies(root, project, invocation.config);
+    const files = await Promise.all(invocation.scope.map((file) => withinRoot(root, path.join(project, file))));
+    const temporary = await mkdtemp(path.join(tmpdir(), "checktrail-java-"));
+    try {
+        const helper = path.join(temporary, "VerifierCompiler.java");
+        const config = path.join(temporary, "inputs.txt");
+        await writeFile(helper, javaCompilerSource);
+        await writeFile(config, [
+            String(invocation.config.release),
+            String(invocation.config.warningsAsErrors),
+            String(jars.length),
+            ...[...jars, ...files].map((file) => Buffer.from(file).toString("base64")),
+        ].join("\n"));
+        const result = invoke([
+            "-Xmx256m",
+            "-Dfile.encoding=UTF-8",
+            "-Duser.language=en",
+            "-Duser.country=US",
+            "--class-path",
+            temporary,
+            helper,
+            config,
+        ]);
+        if (result.error ||
+            result.signal ||
+            result.status !== 0 ||
+            result.stderr.trim())
+            throw new Error("Java compiler did not complete native evidence collection");
+        await javaDependencies(root, project, invocation.config);
+        process.stdout.write(result.stdout);
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+    }
+}
+main().catch(() => {
+    process.stderr.write("Java evidence collection could not complete\n");
+    process.exitCode = 2;
+});

package/dist/src/java.d.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+import type { Check, Inventory, Project } from "./types.js";
+export declare const javaConfigSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    release: z.ZodNumber;
+    warningsAsErrors: z.ZodBoolean;
+    classPath: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const javaInvocationSchema: z.ZodObject<{
+    config: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        release: z.ZodNumber;
+        warningsAsErrors: z.ZodBoolean;
+        classPath: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    scope: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare function javaDependencies(root: string, project: string, config: z.infer<typeof javaConfigSchema>): Promise<string[]>;
+export declare function javaCheck(source: Inventory, project: Project): Promise<Check>;

package/dist/src/java.js

@@ -0,0 +1,102 @@
+import { createHash } from "node:crypto";
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+import { readProjectFile, withinRoot } from "./inventory.js";
+export const javaConfigSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    release: z.number().int().min(8).max(25),
+    warningsAsErrors: z.boolean(),
+    classPath: z
+        .array(z.strictObject({
+        path: z
+            .string()
+            .min(1)
+            .max(4096)
+            .refine((value) => !/[\0\r\n]/.test(value)),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+    }))
+        .max(128),
+});
+export const javaInvocationSchema = z.strictObject({
+    config: javaConfigSchema,
+    scope: z.array(z.string().min(1)).min(1).max(20_000),
+});
+export async function javaDependencies(root, project, config) {
+    let total = 0;
+    const files = [];
+    for (const item of config.classPath) {
+        const declared = path.resolve(root, project, item.path);
+        const file = await withinRoot(root, path.relative(root, declared));
+        if (declared !== file)
+            throw new Error("Java dependencies must not traverse symbolic links");
+        const info = await stat(file);
+        total += info.size;
+        if (!info.isFile() ||
+            !file.endsWith(".jar") ||
+            info.size > 32 * 1024 * 1024 ||
+            total > 128 * 1024 * 1024)
+            throw new Error("Java dependencies require bounded, local JAR files");
+        if (files.includes(file))
+            throw new Error("Duplicate Java classpath dependency");
+        if (createHash("sha256")
+            .update(await readFile(file))
+            .digest("hex") !== item.sha256)
+            throw new Error("Java dependency checksum does not match");
+        files.push(file);
+    }
+    return files;
+}
+export async function javaCheck(source, project) {
+    const scope = project.files.filter((file) => file.endsWith(".java"));
+    const check = {
+        id: "jvm.javac",
+        adapter: project.adapter,
+        project: project.path,
+        scope,
+        kind: "analysis",
+        parser: "java-json",
+        commands: [],
+        reason: "Compile explicitly configured Java sources with annotation processing disabled and native parse/analysis accounting.",
+    };
+    try {
+        if (!project.files.includes("checktrail.java.json"))
+            throw new Error("Prepare an inventoried checktrail.java.json with a release and pinned classpath; Maven and Gradle are not invoked");
+        if (!scope.length)
+            throw new Error("No Java source was inventoried");
+        if (scope.some((file) => path.posix.basename(file) === "module-info.java"))
+            throw new Error("Java modules require a separate verified module-path profile");
+        if (project.files.some((file) => /\.(?:kt|kts|scala)$/.test(file) &&
+            !["build.gradle.kts", "settings.gradle.kts"].includes(path.posix.basename(file))))
+            throw new Error("Mixed JVM language projects require a separate compiler profile");
+        const config = javaConfigSchema.parse(JSON.parse(await readProjectFile(source.root, path.posix.join(project.path, "checktrail.java.json"))));
+        await javaDependencies(source.root, project.path, config);
+        const invocation = JSON.stringify({ config, scope });
+        if (Buffer.byteLength(invocation) > 100 * 1024)
+            throw new Error("Java invocation exceeds the 100 KiB argument limit");
+        check.commands.push({
+            executable: process.execPath,
+            args: [
+                fileURLToPath(new URL("./java-runner.js", import.meta.url)),
+                source.root,
+                invocation,
+            ],
+            cwd: project.path,
+            env: {
+                PATH: process.env.PATH ?? "",
+                JAVA_TOOL_OPTIONS: "",
+                JDK_JAVA_OPTIONS: "",
+                _JAVA_OPTIONS: "",
+                CLASSPATH: "",
+            },
+        });
+    }
+    catch (error) {
+        check.unavailableReason =
+            error instanceof Error
+                ? error.message
+                : "Java configuration could not be prepared";
+    }
+    return check;
+}

package/dist/src/jest-evidence.d.ts

@@ -0,0 +1,2 @@
+import type { Check, CheckResult, ProcessResult } from "./types.js";
+export declare function jestEvidence(check: Check, processes: ProcessResult[], root: string | undefined): Pick<CheckResult, "status" | "reason" | "tests">;

package/dist/src/jest-evidence.js

@@ -0,0 +1,117 @@
+import path from "node:path";
+import { z } from "zod";
+const count = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const schema = z.object({
+    success: z.boolean(),
+    wasInterrupted: z.boolean(),
+    numTotalTests: count,
+    numPassedTests: count,
+    numFailedTests: count,
+    numPendingTests: count,
+    numTodoTests: count,
+    numTotalTestSuites: count,
+    numPassedTestSuites: count,
+    numFailedTestSuites: count,
+    numPendingTestSuites: count,
+    numRuntimeErrorTestSuites: count,
+    runExecError: z.unknown().optional(),
+    testResults: z.array(z.object({
+        testFilePath: z.string(),
+        numPassingTests: count,
+        numFailingTests: count,
+        numPendingTests: count,
+        numTodoTests: count,
+        testExecError: z.unknown().optional(),
+        testResults: z.array(z.object({
+            status: z.enum(["passed", "failed", "pending", "todo", "disabled"]),
+            fullName: z.string(),
+            wouldRun: z.unknown().optional(),
+        })),
+    })),
+});
+export function jestEvidence(check, processes, root) {
+    const incomplete = {
+        status: "inconclusive",
+        reason: "Jest evidence is incomplete, inconsistent, or omits planned files or runnable tests.",
+    };
+    if (!root || processes.length !== 1 || !check.scope.length)
+        return incomplete;
+    const process = processes[0];
+    if (process.exitCode !== 0 && process.exitCode !== 1)
+        return {
+            status: "error",
+            reason: "Jest could not start or complete normally; inspect the runtime and configuration.",
+        };
+    let report;
+    try {
+        report = schema.parse(JSON.parse(process.stdout));
+    }
+    catch {
+        return incomplete;
+    }
+    if (report.wasInterrupted)
+        return incomplete;
+    const expected = new Set(check.scope.map((file) => path.resolve(root, check.project, file)));
+    const seen = new Set();
+    const tests = { total: 0, passed: 0, failed: 0, skipped: 0 };
+    let pending = 0;
+    let todo = 0;
+    let runtimeFailure = Boolean(report.runExecError);
+    for (const file of report.testResults) {
+        if (!expected.has(file.testFilePath) || seen.has(file.testFilePath))
+            return incomplete;
+        seen.add(file.testFilePath);
+        runtimeFailure ||= Boolean(file.testExecError);
+        const counts = { passed: 0, failed: 0, pending: 0, todo: 0 };
+        for (const assertion of file.testResults) {
+            if (assertion.wouldRun !== undefined)
+                return incomplete;
+            if (assertion.status === "disabled")
+                counts.pending++;
+            else
+                counts[assertion.status]++;
+        }
+        if (counts.passed !== file.numPassingTests ||
+            counts.failed !== file.numFailingTests ||
+            counts.pending !== file.numPendingTests ||
+            counts.todo !== file.numTodoTests)
+            return incomplete;
+        tests.passed += counts.passed;
+        tests.failed += counts.failed;
+        pending += counts.pending;
+        todo += counts.todo;
+    }
+    tests.skipped = pending + todo;
+    tests.total = tests.passed + tests.failed + tests.skipped;
+    if (seen.size !== expected.size ||
+        tests.total !== report.numTotalTests ||
+        tests.passed !== report.numPassedTests ||
+        tests.failed !== report.numFailedTests ||
+        pending !== report.numPendingTests ||
+        todo !== report.numTodoTests ||
+        report.numTotalTestSuites !== seen.size ||
+        report.numTotalTestSuites !==
+            report.numPassedTestSuites +
+                report.numFailedTestSuites +
+                report.numPendingTestSuites)
+        return incomplete;
+    if (tests.failed ||
+        runtimeFailure ||
+        report.numFailedTestSuites ||
+        report.numRuntimeErrorTestSuites ||
+        !report.success ||
+        process.exitCode !== 0)
+        return {
+            status: "failed",
+            reason: "Jest reported a test, suite, or execution failure.",
+            tests,
+        };
+    // Jest uses pending for both deliberate skips and tests omitted by .only.
+    if (!tests.passed || pending || report.numPendingTestSuites)
+        return { ...incomplete, tests };
+    return {
+        status: "passed",
+        reason: "Jest accounted for every planned file with passing assertions and no pending tests.",
+        tests,
+    };
+}

package/dist/src/jest-runner.d.ts

@@ -0,0 +1 @@
+export {};