@stsepelin/checktrail 0.1.0-alpha.1

package/dist/src/phpstan.d.ts

@@ -0,0 +1,2 @@
+import type { Check, Inventory, Project } from "./types.js";
+export declare function phpstanCheck(source: Inventory, project: Project): Promise<Check>;

package/dist/src/phpstan.js

@@ -0,0 +1,51 @@
+import { localTool } from "./local-tool.js";
+export async function phpstanCheck(source, project) {
+    const files = project.files.filter((file) => file.endsWith(".php"));
+    const tool = await localTool(source.root, project.path, "phpstan/phpstan/phpstan", "vendor");
+    const config = [
+        "phpstan.neon",
+        "phpstan.neon.dist",
+        "phpstan.dist.neon",
+    ].find((file) => project.files.includes(file));
+    const check = {
+        id: "php.phpstan",
+        adapter: project.adapter,
+        project: project.path,
+        scope: files,
+        kind: "analysis",
+        parser: "phpstan-json",
+        commands: tool && config
+            ? [
+                {
+                    executable: "php",
+                    args: [
+                        tool,
+                        "analyse",
+                        "--configuration",
+                        `./${config}`,
+                        "--error-format=json",
+                        "--no-progress",
+                        "--no-ansi",
+                        "--debug",
+                        "--",
+                        ...files.map((file) => `./${file}`),
+                    ],
+                    cwd: project.path,
+                },
+            ]
+            : [],
+        reason: "Run local PHPStan with native per-file debug accounting, no result-cache reuse and JSON diagnostic totals.",
+    };
+    if (!files.length)
+        check.unavailableReason = "No PHP files were inventoried.";
+    else if (!tool)
+        check.unavailableReason =
+            "PHPStan is not installed in vendor within the configured root.";
+    else if (!config)
+        check.unavailableReason =
+            "A project-local PHPStan NEON configuration is required.";
+    else if (files.some((file) => /[\r\n]/.test(file)))
+        check.unavailableReason =
+            "PHPStan debug evidence cannot account for filenames containing newlines.";
+    return check;
+}

package/dist/src/phpunit-evidence.d.ts

@@ -0,0 +1,2 @@
+import type { Check, CheckResult, ProcessResult } from "./types.js";
+export declare function phpunitEvidence(check: Check, processes: ProcessResult[], root: string | undefined): Pick<CheckResult, "status" | "reason" | "tests">;

package/dist/src/phpunit-evidence.js

@@ -0,0 +1,53 @@
+import path from "node:path";
+import { importJUnit } from "./junit.js";
+export function phpunitEvidence(check, processes, root) {
+    const pest = check.id === "php.pest";
+    const name = pest ? "Pest" : "PHPUnit";
+    const incomplete = {
+        status: "inconclusive",
+        reason: `${name} evidence is incomplete, omits a planned test file, or has no passing assertions.`,
+    };
+    if (!root || !check.scope.length || processes.length !== 1)
+        return incomplete;
+    const process = processes[0];
+    const result = importJUnit(pest ? process.stderr : process.stdout);
+    if (!result.tests || !result.cases)
+        return process.exitCode === 0
+            ? incomplete
+            : {
+                status: "error",
+                reason: `${name} could not produce valid JUnit evidence; inspect runtime and configuration.`,
+            };
+    const tests = result.tests;
+    if (tests.failed)
+        return {
+            status: "failed",
+            reason: `${name} reported test or fixture failures.`,
+            tests,
+        };
+    if (!tests.passed)
+        return { ...incomplete, tests };
+    if (process.exitCode !== 0)
+        return {
+            status: "failed",
+            reason: `${name} reported a runtime, warning or risky-test failure.`,
+            tests,
+        };
+    const expected = new Set(check.scope.map((file) => path.resolve(root, check.project, file)));
+    const files = new Set();
+    for (const item of result.cases) {
+        if (!item.file || (item.status === "passed" && !item.assertions))
+            return { ...incomplete, tests };
+        const file = path.resolve(root, check.project, pest ? item.file.split("::")[0] : item.file);
+        if (!expected.has(file))
+            return { ...incomplete, tests };
+        files.add(file);
+    }
+    if (files.size !== expected.size)
+        return { ...incomplete, tests };
+    return {
+        status: "passed",
+        reason: `${name} produced fresh JUnit evidence for every planned file with passing assertions.`,
+        tests,
+    };
+}

package/dist/src/phpunit.d.ts

@@ -0,0 +1,2 @@
+import type { Check, Inventory, Project } from "./types.js";
+export declare function phpunitCheck(source: Inventory, project: Project, pest?: boolean): Promise<Check>;

package/dist/src/phpunit.js

@@ -0,0 +1,58 @@
+import { localTool } from "./local-tool.js";
+export async function phpunitCheck(source, project, pest = false) {
+    const files = project.files.filter((file) => file.endsWith("Test.php"));
+    const tool = await localTool(source.root, project.path, pest ? "pestphp/pest/bin/pest" : "phpunit/phpunit/phpunit", "vendor");
+    const configuration = ["phpunit.xml", "phpunit.xml.dist"].find((file) => project.files.includes(file));
+    const name = pest ? "Pest" : "PHPUnit";
+    const check = {
+        id: pest ? "php.pest" : "php.phpunit",
+        adapter: project.adapter,
+        project: project.path,
+        scope: files,
+        kind: "test",
+        parser: "phpunit-junit",
+        commands: tool
+            ? [
+                {
+                    executable: "php",
+                    args: [
+                        tool,
+                        ...(pest
+                            ? [
+                                "--ci",
+                                "--no-tia",
+                                "--colors=never",
+                                "--configuration",
+                                `./${configuration ?? "phpunit.xml"}`,
+                            ]
+                            : []),
+                        "--no-output",
+                        "--do-not-record-test-run-history",
+                        "--no-logging",
+                        "--log-junit",
+                        pest ? "php://stderr" : "php://stdout",
+                        "--all",
+                        "--fail-on-empty-test-suite",
+                        "--fail-on-risky",
+                        "--fail-on-warning",
+                        ...(pest ? [] : ["--"]),
+                        ...files.map((file) => `./${file}`),
+                    ],
+                    cwd: project.path,
+                },
+            ]
+            : [],
+        reason: `Run ${name} with fresh JUnit output, exact test-file accounting and positive native assertion evidence.`,
+    };
+    if (!files.length)
+        check.unavailableReason = "No *Test.php files were inventoried.";
+    else if (!tool)
+        check.unavailableReason = `${name} is not installed in vendor within the configured root.`;
+    else if (pest && !configuration)
+        check.unavailableReason =
+            "Pest requires a local phpunit.xml or phpunit.xml.dist to avoid generating configuration.";
+    else if (pest && files.some((file) => file.includes("::")))
+        check.unavailableReason =
+            "Pest JUnit cannot disambiguate a test path containing ::.";
+    return check;
+}

package/dist/src/pint-evidence.d.ts

@@ -0,0 +1,2 @@
+import type { Check, CheckResult, ProcessResult } from "./types.js";
+export declare function pintEvidence(check: Check, processes: ProcessResult[], root: string | undefined): Pick<CheckResult, "status" | "reason">;

package/dist/src/pint-evidence.js

@@ -0,0 +1,79 @@
+import path from "node:path";
+import { z } from "zod";
+const envelope = z
+    .object({
+    version: z.literal("1.32.1"),
+    files: z.array(z.string()),
+    fixers: z.array(z.string().min(1)),
+    blocked: z.string().nullable(),
+    report: z.string().optional(),
+    exitCode: z.number().int().optional(),
+})
+    .strict();
+const nativeReport = z
+    .object({
+    tool: z.literal("pint"),
+    result: z.enum(["passed", "fail", "fixed"]),
+    files: z
+        .array(z
+        .object({
+        path: z.string(),
+        fixers: z.array(z.string().min(1)).nonempty(),
+    })
+        .strict())
+        .optional(),
+    errors: z
+        .array(z.object({ path: z.string(), message: z.string() }).strict())
+        .optional(),
+})
+    .strict();
+export function pintEvidence(check, processes, root) {
+    const incomplete = {
+        status: "inconclusive",
+        reason: "Pint evidence is incomplete, unsupported, missing planned files or has no active rules.",
+    };
+    if (!root || !check.scope.length || processes.length !== 1)
+        return incomplete;
+    const process = processes[0];
+    try {
+        const result = envelope.parse(JSON.parse(process.stdout));
+        if (result.blocked !== null)
+            return incomplete;
+        if (!result.report || result.exitCode !== process.exitCode)
+            return incomplete;
+        const report = nativeReport.parse(JSON.parse(result.report));
+        if (report.result === "fixed")
+            return incomplete;
+        if ((report.files?.length ?? 0) + (report.errors?.length ?? 0) > 0)
+            return {
+                status: "failed",
+                reason: "Pint reported style or syntax errors.",
+            };
+        if (report.result !== "passed" || process.exitCode !== 0)
+            return {
+                status: "error",
+                reason: "Pint could not complete native validation.",
+            };
+        if (process.stderr.trim())
+            return incomplete;
+        const expected = new Set(check.scope.map((file) => path.resolve(root, check.project, file)));
+        const actual = new Set(result.files.map((file) => path.resolve(root, check.project, file)));
+        if (!result.fixers.length ||
+            actual.size !== result.files.length ||
+            actual.size !== expected.size ||
+            [...actual].some((file) => !expected.has(file)))
+            return incomplete;
+        return {
+            status: "passed",
+            reason: "Pint checked every planned file with active rules and no style or syntax errors.",
+        };
+    }
+    catch {
+        return process.exitCode === 0
+            ? incomplete
+            : {
+                status: "error",
+                reason: "Pint returned invalid evidence; inspect configuration and runtime prerequisites.",
+            };
+    }
+}

package/dist/src/pint-runner.d.ts

@@ -0,0 +1 @@
+export declare const pintRunner: string;

package/dist/src/pint-runner.js

@@ -0,0 +1,53 @@
+export const pintRunner = String.raw `
+$tool = realpath($argv[1]);
+Phar::loadPhar($tool, 'checktrail-pint.phar');
+$base = 'phar://checktrail-pint.phar';
+$loader = require $base.'/vendor/autoload.php';
+$loader->addClassMap([
+    'PhpCsFixer\FixerFactory' => $base.'/overrides/FixerFactory.php',
+    'PhpCsFixer\Runner\Parallel\ProcessFactory' => $base.'/overrides/Runner/Parallel/ProcessFactory.php',
+]);
+$app = require $base.'/bootstrap/app.php';
+$temporary = getenv('CHECKTRAIL_TEMP');
+if ($temporary === false || !is_dir($temporary)) throw new RuntimeException('Missing execution temporary directory');
+$input = new Symfony\Component\Console\Input\ArgvInput([
+    'pint', '--test', '--format=agent', '--cache-file='.$temporary.'/pint-cache.json', '--no-ansi', '--no-interaction', '--', ...array_slice($argv, 2),
+]);
+$output = new class extends Symfony\Component\Console\Output\BufferedOutput implements Symfony\Component\Console\Output\ConsoleOutputInterface {
+    private Symfony\Component\Console\Output\OutputInterface $errors;
+    public function __construct() {
+        parent::__construct();
+        $this->errors = new Symfony\Component\Console\Output\StreamOutput(STDERR);
+    }
+    public function getErrorOutput(): Symfony\Component\Console\Output\OutputInterface { return $this->errors; }
+    public function setErrorOutput(Symfony\Component\Console\Output\OutputInterface $error): void { $this->errors = $error; }
+    public function section(): Symfony\Component\Console\Output\ConsoleSectionOutput { throw new RuntimeException('Interactive sections are unsupported'); }
+};
+$app->instance(Symfony\Component\Console\Input\InputInterface::class, $input);
+$app->instance(Symfony\Component\Console\Output\OutputInterface::class, $output);
+$kernel = $app->make(Illuminate\Contracts\Console\Kernel::class);
+$kernel->bootstrap();
+$evidence = ['version' => config('app.version'), 'files' => [], 'fixers' => [], 'blocked' => null];
+if ($evidence['version'] !== '1.32.1') {
+    $evidence['blocked'] = 'unsupported-version';
+    echo json_encode($evidence, JSON_THROW_ON_ERROR);
+    exit(2);
+}
+$app['events']->listen(Illuminate\Console\Events\CommandStarting::class, function ($event) use (&$evidence) {
+    [$resolver] = App\Factories\ConfigurationResolverFactory::fromIO($event->input, $event->output);
+    $evidence['files'] = array_map(fn ($file) => $file->getRealPath(), iterator_to_array($resolver->getFinder(), false));
+    $fixers = $resolver->getFixers();
+    $evidence['fixers'] = array_map(fn ($fixer) => $fixer->getName(), $fixers);
+    if ($fixers === []) $evidence['blocked'] = 'no-active-rules';
+    foreach ($fixers as $fixer) {
+        if ($fixer instanceof App\Contracts\HasPrettierDependencies) $evidence['blocked'] = 'unverified-prettier-integration';
+    }
+    if ($evidence['blocked'] !== null) throw new RuntimeException($evidence['blocked']);
+});
+$status = $kernel->handle($input, $output);
+$evidence['report'] = $output->fetch();
+$evidence['exitCode'] = $status;
+$kernel->terminate($input, $status);
+echo json_encode($evidence, JSON_THROW_ON_ERROR);
+exit($status);
+`;

package/dist/src/pint.d.ts

@@ -0,0 +1,2 @@
+import type { Check, Inventory, Project } from "./types.js";
+export declare function pintCheck(source: Inventory, project: Project): Promise<Check>;

package/dist/src/pint.js

@@ -0,0 +1,37 @@
+import { localTool } from "./local-tool.js";
+import { pintRunner } from "./pint-runner.js";
+export async function pintCheck(source, project) {
+    const files = project.files.filter((file) => file.endsWith(".php") && !file.endsWith(".blade.php"));
+    const tool = await localTool(source.root, project.path, "laravel/pint/builds/pint", "vendor");
+    const check = {
+        id: "php.pint",
+        adapter: project.adapter,
+        project: project.path,
+        scope: files,
+        kind: "format",
+        parser: "pint-json",
+        commands: tool
+            ? [
+                {
+                    executable: "php",
+                    args: [
+                        "-r",
+                        pintRunner,
+                        "--",
+                        tool,
+                        ...files.map((file) => `./${file}`),
+                    ],
+                    cwd: project.path,
+                    temporaryDirectory: true,
+                },
+            ]
+            : [],
+        reason: "Run Pint on non-Blade PHP files in test mode with native file and active-rule evidence and no reusable cache.",
+    };
+    if (!files.length)
+        check.unavailableReason = "No non-Blade PHP files were inventoried.";
+    else if (!tool)
+        check.unavailableReason =
+            "Pint is not installed in vendor within the configured root.";
+    return check;
+}

package/dist/src/playwright-evidence.d.ts

@@ -0,0 +1,2 @@
+import type { Check, CheckResult, ProcessResult } from "./types.js";
+export declare function playwrightEvidence(check: Check, processes: ProcessResult[], root: string | undefined): Pick<CheckResult, "status" | "reason" | "tests">;

package/dist/src/playwright-evidence.js

@@ -0,0 +1,127 @@
+import path from "node:path";
+import { z } from "zod";
+const status = z.enum([
+    "passed",
+    "failed",
+    "timedOut",
+    "skipped",
+    "interrupted",
+]);
+const schema = z.object({
+    version: z.literal(1),
+    status,
+    errors: z.array(z.string()),
+    projects: z.array(z.string()),
+    tests: z.array(z.object({
+        id: z.string().min(1),
+        file: z.string(),
+        project: z.string(),
+        expectedStatus: status,
+        outcome: z.enum(["expected", "unexpected", "flaky", "skipped"]),
+        results: z.array(z.object({
+            status,
+            retry: z.number().int().nonnegative(),
+            errors: z.array(z.string()),
+        })),
+    })),
+});
+export function playwrightEvidence(check, processes, root) {
+    const incomplete = {
+        status: "inconclusive",
+        reason: "Playwright evidence is incomplete, inconsistent, skipped or omits planned test files.",
+    };
+    if (!root || processes.length !== 1 || !check.scope.length)
+        return incomplete;
+    const process = processes[0];
+    if (process.exitCode !== 0 && process.exitCode !== 1)
+        return {
+            status: "error",
+            reason: "Playwright configuration or its supported native integration could not run.",
+        };
+    let report;
+    try {
+        report = schema.parse(JSON.parse(process.stdout));
+    }
+    catch {
+        return incomplete;
+    }
+    const expected = new Set(check.scope.map((file) => path.resolve(root, check.project, file)));
+    const files = new Set();
+    const ids = new Set();
+    const projects = new Set(report.projects);
+    const seenProjects = new Set();
+    if (projects.size !== report.projects.length)
+        return incomplete;
+    const tests = { total: 0, passed: 0, failed: 0, skipped: 0 };
+    let missingBrowserTests = 0;
+    for (const test of report.tests) {
+        if (!expected.has(test.file) ||
+            ids.has(test.id) ||
+            !projects.has(test.project))
+            return incomplete;
+        ids.add(test.id);
+        files.add(test.file);
+        seenProjects.add(test.project);
+        tests.total++;
+        if (!test.results.length)
+            return incomplete;
+        let missingBrowser = false;
+        for (const [index, attempt] of test.results.entries()) {
+            if (attempt.retry !== index || attempt.status === "interrupted")
+                return incomplete;
+            if (attempt.status === "passed" && attempt.errors.length)
+                return incomplete;
+            missingBrowser ||= attempt.errors.some((error) => /browserType\.launch: Executable doesn't exist at/.test(error));
+        }
+        if (missingBrowser)
+            missingBrowserTests++;
+        const last = test.results.at(-1);
+        if (test.outcome === "skipped") {
+            if (last.status !== "skipped")
+                return incomplete;
+            tests.skipped++;
+        }
+        else if (test.outcome === "expected") {
+            if (last.status !== test.expectedStatus)
+                return incomplete;
+            if (test.expectedStatus === "passed") {
+                if (test.results.some((attempt) => attempt.status !== "passed"))
+                    return incomplete;
+                tests.passed++;
+            }
+            else
+                tests.skipped++;
+        }
+        else
+            tests.failed++;
+    }
+    if (missingBrowserTests &&
+        missingBrowserTests === tests.failed &&
+        !report.errors.length)
+        return {
+            status: "unavailable",
+            reason: "Playwright reported a missing browser executable; browsers must be prepared separately.",
+            tests,
+        };
+    if (report.status === "interrupted" || report.status === "skipped")
+        return incomplete;
+    if (tests.failed ||
+        report.errors.length ||
+        report.status !== "passed" ||
+        process.exitCode !== 0)
+        return {
+            status: "failed",
+            reason: "Playwright reported failed/flaky tests or a native runner error.",
+            tests,
+        };
+    if (files.size !== expected.size ||
+        seenProjects.size !== projects.size ||
+        !tests.passed ||
+        tests.skipped)
+        return { ...incomplete, tests };
+    return {
+        status: "passed",
+        reason: "Playwright completed passing non-skipped tests for every planned test file.",
+        tests,
+    };
+}

package/dist/src/playwright-reporter.d.ts

@@ -0,0 +1,10 @@
+import type { FullConfig, FullResult, Reporter, Suite, TestError } from "@playwright/test/reporter";
+export default class EvidenceReporter implements Reporter {
+    private suite?;
+    private errors;
+    private projects;
+    onBegin(config: FullConfig, suite: Suite): void;
+    onError(error: TestError): void;
+    onEnd(result: FullResult): void;
+    printsToStdio(): boolean;
+}

package/dist/src/playwright-reporter.js

@@ -0,0 +1,37 @@
+import { stripVTControlCharacters } from "node:util";
+const message = (error) => stripVTControlCharacters(error.message ?? error.value ?? "Unknown Playwright error");
+export default class EvidenceReporter {
+    suite;
+    errors = [];
+    projects = [];
+    onBegin(config, suite) {
+        this.suite = suite;
+        this.projects = config.projects.map((project) => project.name);
+    }
+    onError(error) {
+        this.errors.push(message(error));
+    }
+    onEnd(result) {
+        process.stdout.write(`${JSON.stringify({
+            version: 1,
+            status: result.status,
+            errors: this.errors,
+            projects: this.projects,
+            tests: this.suite?.allTests().map((test) => ({
+                id: test.id,
+                file: test.location.file,
+                project: test.parent.project()?.name,
+                expectedStatus: test.expectedStatus,
+                outcome: test.outcome(),
+                results: test.results.map((attempt) => ({
+                    status: attempt.status,
+                    retry: attempt.retry,
+                    errors: attempt.errors.map(message),
+                })),
+            })) ?? [],
+        })}\n`);
+    }
+    printsToStdio() {
+        return true;
+    }
+}

package/dist/src/playwright-runner.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/playwright-runner.js

@@ -0,0 +1,61 @@
+import path from "node:path";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+import { withinRoot } from "./inventory.js";
+async function main() {
+    const [entry, root] = process.argv.slice(2);
+    if (!entry || !root)
+        throw new Error("Invalid Playwright runner arguments");
+    const tool = await withinRoot(root, path.relative(root, entry));
+    const require = createRequire(tool);
+    const metadata = require(tool);
+    if (metadata.name !== "playwright" || metadata.version !== "1.63.0")
+        throw new Error("Playwright native configuration integration requires verified version 1.63.0");
+    const { configLoader } = require("playwright/lib/common");
+    const { testRunner } = require("playwright/lib/runner");
+    const output = await mkdtemp(path.join(tmpdir(), "checktrail-playwright-"));
+    try {
+        const config = await configLoader.loadConfigFromFile(process.cwd(), {
+            forbidOnly: true,
+            failOnFlakyTests: true,
+            maxFailures: 0,
+            updateSnapshots: "none",
+            updateSourceMethod: "patch",
+            ignoreSnapshots: false,
+            shard: null,
+            outputDir: output,
+            workers: 1,
+            quiet: true,
+            reporter: [
+                [fileURLToPath(new URL("./playwright-reporter.js", import.meta.url))],
+            ],
+        });
+        if (config.webServers.length || config.plugins.length)
+            throw new Error("Playwright webServer and private runner plugins require separately supported execution profiles");
+        if (new Set(config.projects.map(({ project }) => project.name)).size !==
+            config.projects.length)
+            throw new Error("Playwright project names must be unique for evidence accounting");
+        config.captureGitInfo = { commit: false, diff: false };
+        config.config.grep = /.*/;
+        config.config.grepInvert = null;
+        for (const { project } of config.projects) {
+            project.grep = /.*/;
+            project.grepInvert = null;
+        }
+        const status = await testRunner.runAllTestsWithConfig(config, {
+            listMode: false,
+            passWithNoTests: false,
+            lastFailed: false,
+        });
+        process.exitCode = status === "passed" ? 0 : 1;
+    }
+    finally {
+        await rm(output, { recursive: true, force: true });
+    }
+}
+main().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : "Playwright execution failed"}\n`);
+    process.exitCode = 2;
+});

package/dist/src/playwright.d.ts

@@ -0,0 +1,2 @@
+import type { Check, Inventory, Project } from "./types.js";
+export declare function playwrightCheck(source: Inventory, project: Project): Promise<Check>;

package/dist/src/playwright.js

@@ -0,0 +1,35 @@
+import { fileURLToPath } from "node:url";
+import { localTool } from "./local-tool.js";
+export async function playwrightCheck(source, project) {
+    const files = project.files.filter((file) => /\.(?:test|spec)\.(?:[cm]?[jt]s|[jt]sx)$/.test(file));
+    const tool = await localTool(source.root, project.path, "playwright/package.json");
+    const check = {
+        id: "javascript.playwright",
+        adapter: project.adapter,
+        project: project.path,
+        kind: "test",
+        parser: "playwright-json",
+        scope: files,
+        reason: "Run installed Playwright with complete native test evidence, focused-test rejection and snapshot updates disabled.",
+        commands: tool
+            ? [
+                {
+                    executable: process.execPath,
+                    cwd: project.path,
+                    args: [
+                        fileURLToPath(new URL("./playwright-runner.js", import.meta.url)),
+                        tool,
+                        source.root,
+                    ],
+                    env: { CI: "1", PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1" },
+                },
+            ]
+            : [],
+    };
+    if (!files.length)
+        check.unavailableReason = "No .test or .spec JS/TS files were inventoried.";
+    else if (!tool)
+        check.unavailableReason =
+            "Playwright is not installed within the configured root.";
+    return check;
+}

package/dist/src/policy-pack.d.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+export declare const packReferenceSchema: z.ZodObject<{
+    path: z.ZodString;
+    sha256: z.ZodString;
+}, z.core.$strict>;
+export declare const policyPackSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    id: z.ZodString;
+    version: z.ZodString;
+    description: z.ZodString;
+    requiredChecks: z.ZodArray<z.ZodString>;
+    requiredEnvironment: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type PolicyPack = z.infer<typeof policyPackSchema>;
+export type PackReference = z.infer<typeof packReferenceSchema>;
+export interface LoadedPack {
+    pack: PolicyPack;
+    sha256: string;
+}
+export declare function parsePolicyPack(contents: string): PolicyPack;
+export declare function loadPolicyPack(root: string, input: PackReference): Promise<LoadedPack>;