@stsepelin/checktrail 0.1.0-alpha.1

package/dist/src/django-runner.js

@@ -0,0 +1,80 @@
+export const djangoRunner = String.raw `
+import contextlib, hashlib, json, sys
+from datetime import datetime, timezone
+from importlib.metadata import version, PackageNotFoundError
+
+def identity(value):
+    module = getattr(value, '__module__', None)
+    name = getattr(value, '__qualname__', None)
+    if not isinstance(module, str) or not isinstance(name, str):
+        raise ValueError('Unsupported callable identity')
+    return module + '.' + name
+
+def capture():
+    import django
+    django.setup()
+    from django.urls import get_resolver
+    from django.urls.resolvers import URLPattern, URLResolver, RoutePattern, RegexPattern
+    from django.urls.converters import IntConverter, StringConverter, UUIDConverter, SlugConverter, PathConverter
+    supported_converters = (IntConverter, StringConverter, UUIDConverter, SlugConverter, PathConverter)
+    entries = []
+    visited = 0
+    unsupported = 0
+    def walk(routes, patterns, namespaces, defaults, depth):
+        nonlocal visited, unsupported
+        if depth > 32:
+            raise ValueError('URL resolver depth limit exceeded')
+        for route in routes:
+            visited += 1
+            if visited > 20000:
+                raise ValueError('URL inventory entry limit exceeded')
+            if type(route) not in (URLPattern, URLResolver) or type(route.pattern) not in (RoutePattern, RegexPattern):
+                unsupported += 1
+                continue
+            pattern = route.pattern
+            if type(pattern) is RoutePattern and type(pattern._route) is not str:
+                unsupported += 1
+                continue
+            if any(type(converter) not in supported_converters for converter in pattern.converters.values()):
+                unsupported += 1
+                continue
+            signature = json.dumps([type(pattern).__name__, pattern.regex.pattern, pattern.regex.flags, pattern._is_endpoint], separators=(',', ':'), ensure_ascii=False)
+            fragments = patterns + [signature]
+            values = {**defaults, **(route.default_kwargs if type(route) is URLResolver else route.default_args)}
+            if type(route) is URLResolver:
+                walk(route.url_patterns, fragments, namespaces + ([route.namespace] if route.namespace else []), values, depth + 1)
+            else:
+                values_json = json.dumps(values, sort_keys=True, separators=(',', ':'), allow_nan=False)
+                handler = getattr(route.callback, 'view_class', route.callback)
+                entries.append({
+                    'key': json.dumps(fragments, separators=(',', ':'), ensure_ascii=False),
+                    'attributes': {'patterns': fragments, 'namespaces': namespaces, 'handler': identity(handler),
+                        'name': route.name, 'defaultsHash': hashlib.sha256(values_json.encode()).hexdigest()}
+                })
+    walk(get_resolver().url_patterns, [], [], {}, 0)
+    return entries, visited, unsupported
+
+try:
+    try:
+        installed = version('Django')
+    except PackageNotFoundError:
+        json.dump({'unavailable': 'django-runtime', 'reason': 'missing-package'}, sys.stdout)
+        sys.exit(3)
+    if installed != '6.1.1':
+        json.dump({'unavailable': 'django-runtime', 'reason': 'unsupported-version'}, sys.stdout)
+        sys.exit(3)
+    config = json.loads(sys.argv[1])
+    with contextlib.redirect_stdout(sys.stderr):
+        entries, visited, unsupported = capture()
+    json.dump({
+        'version': 1, 'djangoVersion': installed, 'visitedNodes': visited, 'unsupportedNodes': unsupported,
+        'runtime': {'schemaVersion': 1, 'format': 'runtime-inventory',
+            'producer': {'name': 'checktrail.django-routes', 'version': '1.0.0'},
+            'assembly': {'name': config['assembly'], 'environment': config['environment']},
+            'sourceFingerprint': sys.argv[2], 'capturedAt': datetime.now(timezone.utc).isoformat().replace('+00:00', 'Z'),
+            'collections': [{'kind': 'routes', 'complete': unsupported == 0, 'ordered': True, 'entries': entries}]}
+    }, sys.stdout)
+except Exception as error:
+    print(type(error).__name__ + ': ' + str(error), file=sys.stderr)
+    sys.exit(2)
+`;

package/dist/src/django.d.ts

@@ -0,0 +1,9 @@
+import { z } from "zod";
+import type { Check, Inventory, Project } from "./types.js";
+export declare const djangoConfigSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    settings: z.ZodString;
+    assembly: z.ZodString;
+    environment: z.ZodString;
+}, z.core.$strict>;
+export declare function djangoCheck(source: Inventory, project: Project): Promise<Check>;

package/dist/src/django.js

@@ -0,0 +1,50 @@
+import path from "node:path";
+import { z } from "zod";
+import { readProjectFile } from "./inventory.js";
+import { djangoRunner } from "./django-runner.js";
+export const djangoConfigSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    settings: z
+        .string()
+        .regex(/^[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*$/)
+        .max(256),
+    assembly: z.string().min(1).max(256),
+    environment: z.string().min(1).max(256),
+});
+export async function djangoCheck(source, project) {
+    const check = {
+        id: "python.django-routes",
+        adapter: project.adapter,
+        project: project.path,
+        scope: [],
+        commands: [],
+        kind: "analysis",
+        parser: "django-json",
+        reason: "Load explicit Django test settings, run native application setup, and inventory supported URL patterns including nested resolvers.",
+    };
+    if (!project.files.includes("checktrail.django.json")) {
+        check.unavailableReason =
+            "Django route validation requires an explicit checktrail.django.json profile.";
+        return check;
+    }
+    const config = djangoConfigSchema.parse(JSON.parse(await readProjectFile(source.root, path.posix.join(project.path, "checktrail.django.json"))));
+    const modulePath = config.settings.replaceAll(".", "/");
+    check.scope = [`${modulePath}.py`, `${modulePath}/__init__.py`].filter((file) => project.files.includes(file));
+    if (check.scope.length !== 1) {
+        check.unavailableReason =
+            "Django settings must resolve to one inventoried local Python module or package.";
+        return check;
+    }
+    check.commands = [
+        {
+            executable: "python3",
+            args: ["-c", djangoRunner, JSON.stringify(config), source.fingerprint],
+            cwd: project.path,
+            env: {
+                PYTHONDONTWRITEBYTECODE: "1",
+                DJANGO_SETTINGS_MODULE: config.settings,
+            },
+        },
+    ];
+    return check;
+}

package/dist/src/dotnet-compiler.d.ts

@@ -0,0 +1 @@
+export declare const dotnetCompilerSource: string;

package/dist/src/dotnet-compiler.js

@@ -0,0 +1,87 @@
+export const dotnetCompilerSource = String.raw `
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Reflection.Metadata;
+using System.Reflection.PortableExecutable;
+using System.Text;
+using System.Text.Json;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.Text;
+
+sealed class BoundedOutput : MemoryStream {
+    const int Limit = 32 * 1024 * 1024;
+    void Check(long length) { if (length > Limit) throw new IOException("Compiler output limit exceeded"); }
+    public override void Write(byte[] buffer, int offset, int count) { Check(Position + count); base.Write(buffer, offset, count); }
+    public override void Write(ReadOnlySpan<byte> buffer) { Check(Position + buffer.Length); base.Write(buffer); }
+    public override void WriteByte(byte value) { Check(Position + 1); base.WriteByte(value); }
+    public override void SetLength(long value) { Check(value); base.SetLength(value); }
+}
+
+class VerifierCompiler {
+    static void Main(string[] args) {
+        using var input = JsonDocument.Parse(File.ReadAllText(args[0], Encoding.UTF8));
+        var root = input.RootElement;
+        var config = root.GetProperty("config");
+        var language = config.GetProperty("languageVersion").GetString() switch {
+            "12" => LanguageVersion.CSharp12, "13" => LanguageVersion.CSharp13, "14" => LanguageVersion.CSharp14,
+            _ => throw new InvalidOperationException("Unsupported language version")
+        };
+        var nullable = config.GetProperty("nullable").GetString() switch {
+            "enable" => NullableContextOptions.Enable, "disable" => NullableContextOptions.Disable,
+            "warnings" => NullableContextOptions.Warnings, "annotations" => NullableContextOptions.Annotations,
+            _ => throw new InvalidOperationException("Unsupported nullable context")
+        };
+        var parseOptions = new CSharpParseOptions(language, DocumentationMode.Parse, SourceCodeKind.Regular,
+            config.GetProperty("defines").EnumerateArray().Select(item => item.GetString()!));
+        var trees = new List<SyntaxTree>();
+        foreach (var file in root.GetProperty("sources").EnumerateArray()) {
+            var name = file.GetString()!;
+            var text = File.ReadAllText(name, new UTF8Encoding(false, true));
+            trees.Add(CSharpSyntaxTree.ParseText(SourceText.From(text, Encoding.UTF8, SourceHashAlgorithm.Sha256), parseOptions, name));
+        }
+        var implicitUsings = config.GetProperty("implicitUsings").GetBoolean();
+        if (implicitUsings) trees.Add(CSharpSyntaxTree.ParseText("global using System; global using System.Collections.Generic; global using System.IO; global using System.Linq; global using System.Net.Http; global using System.Threading; global using System.Threading.Tasks;", parseOptions, "checktrail://implicit-usings", Encoding.UTF8));
+        var references = root.GetProperty("references").EnumerateArray().Select(item => {
+            var file = item.GetString()!;
+            using var stream = File.OpenRead(file);
+            using var image = new PEReader(stream);
+            if (!image.HasMetadata) throw new InvalidOperationException("Reference is not a managed assembly");
+            var metadata = image.GetMetadataReader();
+            if (!metadata.IsAssembly || metadata.AssemblyFiles.Count != 0)
+                throw new InvalidOperationException("Multi-file assembly references are unsupported");
+            return MetadataReference.CreateFromFile(file);
+        }).ToArray();
+        var options = new CSharpCompilationOptions(
+            config.GetProperty("outputKind").GetString() == "console" ? OutputKind.ConsoleApplication : OutputKind.DynamicallyLinkedLibrary,
+            optimizationLevel: OptimizationLevel.Release, checkOverflow: config.GetProperty("checkedArithmetic").GetBoolean(),
+            allowUnsafe: config.GetProperty("allowUnsafe").GetBoolean(), warningLevel: 9999,
+            generalDiagnosticOption: config.GetProperty("warningsAsErrors").GetBoolean() ? ReportDiagnostic.Error : ReportDiagnostic.Default,
+            concurrentBuild: false, deterministic: true, nullableContextOptions: nullable, reportSuppressedDiagnostics: true);
+        var compilation = CSharpCompilation.Create(config.GetProperty("assemblyName").GetString()!, trees, references, options);
+        var sources = new List<object>();
+        foreach (var tree in trees.Where(tree => tree.FilePath != "checktrail://implicit-usings")) {
+            var syntax = tree.GetRoot();
+            var model = compilation.GetSemanticModel(tree);
+            var diagnostics = model.GetDiagnostics();
+            if (diagnostics.Length > 2000) throw new InvalidOperationException("Diagnostic limit exceeded");
+            sources.Add(new {file = tree.FilePath, syntaxLength = syntax.FullSpan.Length, textLength = tree.GetText().Length,
+                semantic = model.SyntaxTree == tree, semanticDiagnosticCount = diagnostics.Length});
+        }
+        using var output = new BoundedOutput();
+        var result = compilation.Emit(output);
+        if (result.Diagnostics.Length > 2000) throw new InvalidOperationException("Diagnostic limit exceeded");
+        var messages = result.Diagnostics.Select(item => {
+            var line = item.Location.IsInSource ? item.Location.GetLineSpan() : default;
+            return new {code = item.Id, severity = item.Severity.ToString(), message = item.GetMessage(System.Globalization.CultureInfo.InvariantCulture),
+                suppressed = item.IsSuppressed, file = item.Location.IsInSource ? item.Location.SourceTree?.FilePath : null,
+                line = item.Location.IsInSource ? line.StartLinePosition.Line + 1 : 0};
+        }).ToArray();
+        Console.Write(JsonSerializer.Serialize(new {version = 1, compiler = typeof(CSharpCompilation).Assembly.GetName().Version!.ToString(),
+            runtime = Environment.Version.ToString(), success = result.Success, outputBytes = output.Length,
+            ownedTreeCount = implicitUsings ? 1 : 0, referenceCount = references.Length, settings = config, sources, diagnostics = messages}));
+    }
+}
+`;

package/dist/src/dotnet-evidence.d.ts

@@ -0,0 +1,2 @@
+import type { Check, CheckResult, ProcessResult } from "./types.js";
+export declare function dotnetEvidence(check: Check, processes: ProcessResult[], root: string | undefined): Pick<CheckResult, "status" | "reason" | "findings" | "findingsComplete">;

package/dist/src/dotnet-evidence.js

@@ -0,0 +1,127 @@
+import path from "node:path";
+import { z } from "zod";
+import { dotnetConfigSchema, dotnetInvocationSchema } from "./dotnet.js";
+const schema = z.strictObject({
+    sdkVersion: z.literal("10.0.401"),
+    runtimeReferenceVersion: z.literal("10.0.12"),
+    referenceFiles: z.number().int().min(2).max(509),
+    compilerAndReferencesSha256: z.string().regex(/^[a-f0-9]{64}$/),
+    compilation: z.strictObject({
+        version: z.literal(1),
+        compiler: z.literal("5.9.0.0"),
+        runtime: z.literal("10.0.12"),
+        success: z.boolean(),
+        outputBytes: z
+            .number()
+            .int()
+            .nonnegative()
+            .max(32 * 1024 * 1024),
+        ownedTreeCount: z.number().int().min(0).max(1),
+        referenceCount: z.number().int().positive(),
+        settings: dotnetConfigSchema,
+        sources: z
+            .array(z.strictObject({
+            file: z.string(),
+            syntaxLength: z.number().int().nonnegative(),
+            textLength: z.number().int().nonnegative(),
+            semantic: z.boolean(),
+            semanticDiagnosticCount: z.number().int().nonnegative().max(2000),
+        }))
+            .max(20_000),
+        diagnostics: z
+            .array(z.strictObject({
+            code: z.string().regex(/^CS\d+$/),
+            severity: z.enum(["Error", "Warning", "Info", "Hidden"]),
+            message: z.string(),
+            suppressed: z.boolean(),
+            file: z.string().nullable(),
+            line: z.number().int().nonnegative(),
+        }))
+            .max(2000),
+    }),
+});
+export function dotnetEvidence(check, processes, root) {
+    const incomplete = {
+        status: "inconclusive",
+        reason: ".NET evidence is malformed, suppressed or missing native compilation/source accounting",
+        findingsComplete: false,
+    };
+    if (!root || processes.length !== 1)
+        return incomplete;
+    const process = processes[0];
+    if (process.exitCode === 3) {
+        try {
+            z.strictObject({ unavailable: z.literal("dotnet-toolchain") }).parse(JSON.parse(process.stdout));
+            return {
+                status: "unavailable",
+                reason: "The verified .NET SDK and Roslyn compiler are unavailable",
+            };
+        }
+        catch {
+            return incomplete;
+        }
+    }
+    if (process.exitCode !== 0)
+        return {
+            status: "error",
+            reason: ".NET evidence collection did not complete normally",
+            findingsComplete: false,
+        };
+    try {
+        const data = schema.parse(JSON.parse(process.stdout));
+        const result = data.compilation;
+        const planned = dotnetInvocationSchema.parse(JSON.parse(check.commands[0].args[2]));
+        if (JSON.stringify(planned.scope) !== JSON.stringify(check.scope) ||
+            JSON.stringify(planned.config) !== JSON.stringify(result.settings) ||
+            result.ownedTreeCount !== Number(planned.config.implicitUsings) ||
+            result.referenceCount !==
+                data.referenceFiles + planned.config.references.length)
+            return incomplete;
+        const expected = new Set(check.scope.map((file) => path.resolve(root, check.project, file)));
+        const findings = result.diagnostics
+            .filter((item) => !item.suppressed)
+            .map((item) => ({
+            ruleId: `csharp/${item.code}`,
+            level: item.severity === "Error"
+                ? "error"
+                : item.severity === "Warning"
+                    ? "warning"
+                    : "note",
+            message: item.message,
+            ...(item.file && expected.has(item.file) && item.line > 0
+                ? {
+                    file: path.relative(root, item.file).split(path.sep).join("/"),
+                    line: item.line,
+                }
+                : {}),
+        }));
+        const errors = result.diagnostics.some((item) => item.severity === "Error" && !item.suppressed);
+        if (errors && !result.success)
+            return {
+                status: "failed",
+                reason: "Roslyn reported compiler errors; failed compilation does not establish complete analysis",
+                findings,
+                findingsComplete: false,
+            };
+        if (errors ||
+            !result.success ||
+            !result.outputBytes ||
+            result.diagnostics.some((item) => item.suppressed) ||
+            !expected.size ||
+            result.sources.length !== expected.size ||
+            new Set(result.sources.map((item) => item.file)).size !== expected.size ||
+            result.sources.some((item) => !expected.has(item.file) ||
+                !item.semantic ||
+                item.syntaxLength !== item.textLength))
+            return { ...incomplete, findings };
+        return {
+            status: "passed",
+            reason: "Configured C# sources compiled with native syntax and semantic accounting; no application code, build targets or tests were executed",
+            findings,
+            findingsComplete: true,
+        };
+    }
+    catch {
+        return incomplete;
+    }
+}

package/dist/src/dotnet-runner.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/dotnet-runner.js

@@ -0,0 +1,167 @@
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { copyFile, mkdtemp, readFile, readdir, realpath, rm, stat, writeFile, } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { dotnetCompilerSource } from "./dotnet-compiler.js";
+import { dotnetInvocationSchema, dotnetReferences } from "./dotnet.js";
+import { withinRoot } from "./inventory.js";
+const sdkVersion = "10.0.401";
+const runtimeVersion = "10.0.12";
+const compilerVersion = "5.9.0-1.26423.113 (e34a38d2ae1fc26406a317517196e55c68ff83ab)";
+const env = {
+    PATH: process.env.PATH ?? "",
+    DOTNET_CLI_TELEMETRY_OPTOUT: "1",
+    DOTNET_NOLOGO: "1",
+    DOTNET_SKIP_FIRST_TIME_EXPERIENCE: "1",
+    DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: "1",
+    DOTNET_EnableDiagnostics: "0",
+    DOTNET_GCHeapHardLimit: "10000000",
+};
+let nativeBytes = 0;
+function invoke(args, cwd) {
+    const result = spawnSync("dotnet", args, {
+        cwd,
+        env,
+        encoding: "utf8",
+        maxBuffer: 1024 * 1024,
+    });
+    nativeBytes +=
+        Buffer.byteLength(result.stdout ?? "") +
+            Buffer.byteLength(result.stderr ?? "");
+    if (result.error ||
+        result.signal ||
+        result.status === null ||
+        nativeBytes > 4 * 1024 * 1024)
+        throw new Error(".NET invocation did not complete within evidence limits");
+    return result;
+}
+async function fingerprint(files) {
+    const hash = createHash("sha256");
+    let total = 0;
+    if (files.length > 512)
+        throw new Error(".NET reference pack exceeds file limits");
+    for (const file of files) {
+        const info = await stat(file);
+        total += info.size;
+        if (!info.isFile() ||
+            info.size > 32 * 1024 * 1024 ||
+            total > 128 * 1024 * 1024)
+            throw new Error(".NET reference pack exceeds byte limits");
+        hash
+            .update(path.basename(file))
+            .update("\0")
+            .update(createHash("sha256")
+            .update(await readFile(file))
+            .digest("hex"))
+            .update("\0");
+    }
+    return hash.digest("hex");
+}
+async function main() {
+    const temporary = await mkdtemp(path.join(tmpdir(), "checktrail-dotnet-"));
+    try {
+        let sdk;
+        try {
+            const list = invoke(["--list-sdks"], temporary);
+            const matches = list.stdout
+                .split(/\r?\n/)
+                .flatMap((line) => /^10\.0\.401 \[([^\r\n]+)\]$/.exec(line)?.[1] ?? []);
+            if (list.status !== 0 || list.stderr || matches.length !== 1)
+                throw new Error("Missing verified SDK");
+            sdk = await realpath(path.join(matches[0], sdkVersion));
+            const version = invoke(["exec", path.join(sdk, "Roslyn/bincore/csc.dll"), "-version"], temporary);
+            if (version.status !== 0 ||
+                version.stderr ||
+                version.stdout.trim() !== compilerVersion)
+                throw new Error("Unverified Roslyn compiler");
+        }
+        catch {
+            process.stdout.write(JSON.stringify({ unavailable: "dotnet-toolchain" }));
+            process.exitCode = 3;
+            return;
+        }
+        if (process.argv[2] === "--version") {
+            process.stdout.write(`${sdkVersion}\n`);
+            return;
+        }
+        const installation = path.resolve(sdk, "../..");
+        const referencePack = path.join(installation, "packs/Microsoft.NETCore.App.Ref", runtimeVersion, "ref/net10.0");
+        const builtins = (await readdir(referencePack))
+            .filter((file) => file.endsWith(".dll"))
+            .sort()
+            .map((file) => path.join(referencePack, file));
+        if (!["System.Runtime.dll", "mscorlib.dll"].every((file) => builtins.includes(path.join(referencePack, file))))
+            throw new Error("Incomplete .NET reference pack");
+        const compiler = path.join(sdk, "Roslyn/bincore");
+        const compilerLibraries = [
+            "Microsoft.CodeAnalysis.dll",
+            "Microsoft.CodeAnalysis.CSharp.dll",
+        ].map((file) => path.join(compiler, file));
+        const toolFiles = [
+            ...builtins,
+            ...compilerLibraries,
+            path.join(compiler, "csc.dll"),
+        ];
+        const before = await fingerprint(toolFiles);
+        const root = await realpath(process.argv[2]);
+        const project = path.relative(root, await realpath(process.cwd())) || ".";
+        const invocation = dotnetInvocationSchema.parse(JSON.parse(process.argv[3]));
+        const references = await dotnetReferences(root, project, invocation.config);
+        const sources = await Promise.all(invocation.scope.map((file) => withinRoot(root, path.join(project, file))));
+        const helper = path.join(temporary, "VerifierCompiler.cs");
+        const output = path.join(temporary, "VerifierCompiler.dll");
+        await writeFile(helper, dotnetCompilerSource);
+        const bootstrap = invoke([
+            "exec",
+            path.join(compiler, "csc.dll"),
+            "-nologo",
+            "-noconfig",
+            "-nostdlib+",
+            "-langversion:14",
+            "-nullable:enable",
+            "-warnaserror+",
+            "-target:exe",
+            `-out:${output}`,
+            ...[...builtins, ...compilerLibraries].map((file) => `-r:${file}`),
+            helper,
+        ], temporary);
+        if (bootstrap.status !== 0 || bootstrap.stderr || bootstrap.stdout.trim())
+            throw new Error("Owned .NET compiler helper could not be prepared");
+        for (const file of compilerLibraries)
+            await copyFile(file, path.join(temporary, path.basename(file)));
+        await writeFile(path.join(temporary, "VerifierCompiler.runtimeconfig.json"), JSON.stringify({
+            runtimeOptions: {
+                tfm: "net10.0",
+                framework: { name: "Microsoft.NETCore.App", version: runtimeVersion },
+                rollForward: "Disable",
+            },
+        }));
+        const input = path.join(temporary, "invocation.json");
+        await writeFile(input, JSON.stringify({
+            config: invocation.config,
+            sources,
+            references: [...builtins, ...references],
+        }));
+        const result = invoke(["exec", output, input], temporary);
+        if (result.status !== 0 || result.stderr.trim())
+            throw new Error(".NET compiler did not complete evidence collection");
+        await dotnetReferences(root, project, invocation.config);
+        if ((await fingerprint(toolFiles)) !== before)
+            throw new Error(".NET reference pack or compiler changed during compilation");
+        process.stdout.write(JSON.stringify({
+            sdkVersion,
+            runtimeReferenceVersion: runtimeVersion,
+            referenceFiles: builtins.length,
+            compilerAndReferencesSha256: before,
+            compilation: JSON.parse(result.stdout),
+        }));
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+    }
+}
+main().catch(() => {
+    process.stderr.write(".NET evidence collection could not complete\n");
+    process.exitCode = 2;
+});

package/dist/src/dotnet.d.ts

@@ -0,0 +1,65 @@
+import { z } from "zod";
+import type { Check, Inventory, Project } from "./types.js";
+export declare const dotnetConfigSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    targetFramework: z.ZodLiteral<"net10.0">;
+    assemblyName: z.ZodString;
+    languageVersion: z.ZodEnum<{
+        12: "12";
+        13: "13";
+        14: "14";
+    }>;
+    outputKind: z.ZodEnum<{
+        library: "library";
+        console: "console";
+    }>;
+    nullable: z.ZodEnum<{
+        enable: "enable";
+        disable: "disable";
+        warnings: "warnings";
+        annotations: "annotations";
+    }>;
+    warningsAsErrors: z.ZodBoolean;
+    allowUnsafe: z.ZodBoolean;
+    checkedArithmetic: z.ZodBoolean;
+    implicitUsings: z.ZodBoolean;
+    defines: z.ZodArray<z.ZodString>;
+    references: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        sha256: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const dotnetInvocationSchema: z.ZodObject<{
+    config: z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        targetFramework: z.ZodLiteral<"net10.0">;
+        assemblyName: z.ZodString;
+        languageVersion: z.ZodEnum<{
+            12: "12";
+            13: "13";
+            14: "14";
+        }>;
+        outputKind: z.ZodEnum<{
+            library: "library";
+            console: "console";
+        }>;
+        nullable: z.ZodEnum<{
+            enable: "enable";
+            disable: "disable";
+            warnings: "warnings";
+            annotations: "annotations";
+        }>;
+        warningsAsErrors: z.ZodBoolean;
+        allowUnsafe: z.ZodBoolean;
+        checkedArithmetic: z.ZodBoolean;
+        implicitUsings: z.ZodBoolean;
+        defines: z.ZodArray<z.ZodString>;
+        references: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    scope: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare function dotnetReferences(root: string, project: string, config: z.infer<typeof dotnetConfigSchema>): Promise<string[]>;
+export declare function dotnetCheck(source: Inventory, project: Project): Promise<Check>;