@stsepelin/checktrail 0.1.0-alpha.1

package/dist/src/dotnet.js

@@ -0,0 +1,120 @@
+import { createHash } from "node:crypto";
+import { readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { z } from "zod";
+import { readProjectFile, withinRoot } from "./inventory.js";
+export const dotnetConfigSchema = z.strictObject({
+    schemaVersion: z.literal(1),
+    targetFramework: z.literal("net10.0"),
+    assemblyName: z
+        .string()
+        .regex(/^[A-Za-z_][A-Za-z0-9_.-]*$/)
+        .max(128),
+    languageVersion: z.enum(["12", "13", "14"]),
+    outputKind: z.enum(["library", "console"]),
+    nullable: z.enum(["enable", "disable", "warnings", "annotations"]),
+    warningsAsErrors: z.boolean(),
+    allowUnsafe: z.boolean(),
+    checkedArithmetic: z.boolean(),
+    implicitUsings: z.boolean(),
+    defines: z
+        .array(z
+        .string()
+        .regex(/^[A-Za-z_][A-Za-z0-9_]*$/)
+        .max(128))
+        .max(128)
+        .refine((values) => new Set(values).size === values.length &&
+        !values.some((value) => ["true", "false"].includes(value))),
+    references: z
+        .array(z.strictObject({
+        path: z
+            .string()
+            .min(1)
+            .max(4096)
+            .refine((value) => !/[\0\r\n]/.test(value)),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/),
+    }))
+        .max(128),
+});
+export const dotnetInvocationSchema = z.strictObject({
+    config: dotnetConfigSchema,
+    scope: z.array(z.string().min(1)).min(1).max(20_000),
+});
+export async function dotnetReferences(root, project, config) {
+    let total = 0;
+    const files = [];
+    for (const item of config.references) {
+        const declared = path.resolve(root, project, item.path);
+        const file = await withinRoot(root, path.relative(root, declared));
+        if (file !== declared)
+            throw new Error(".NET references must not traverse symbolic links");
+        const info = await stat(file);
+        total += info.size;
+        if (!info.isFile() ||
+            !file.endsWith(".dll") ||
+            info.size > 32 * 1024 * 1024 ||
+            total > 128 * 1024 * 1024)
+            throw new Error(".NET references require bounded, local DLL files");
+        if (files.includes(file))
+            throw new Error("Duplicate .NET reference");
+        if (createHash("sha256")
+            .update(await readFile(file))
+            .digest("hex") !== item.sha256)
+            throw new Error(".NET reference checksum does not match");
+        files.push(file);
+    }
+    return files;
+}
+export async function dotnetCheck(source, project) {
+    const scope = project.files.filter((file) => file.endsWith(".cs"));
+    const check = {
+        id: "dotnet.csharp",
+        adapter: project.adapter,
+        project: project.path,
+        scope,
+        kind: "analysis",
+        parser: "dotnet-json",
+        commands: [],
+        reason: "Compile explicitly configured C# sources with native syntax/semantic accounting and pinned local references.",
+    };
+    try {
+        if (!project.files.includes("checktrail.dotnet.json"))
+            throw new Error("Prepare an inventoried checktrail.dotnet.json with explicit compiler settings; MSBuild and NuGet are not invoked");
+        if (project.markers.filter((file) => file.endsWith(".csproj")).length !== 1 ||
+            project.markers.some((file) => /\.(?:fsproj|vbproj)$/.test(file)))
+            throw new Error("Use one C# project per root; mixed project languages require separate profiles");
+        if (!scope.length)
+            throw new Error("No C# source was inventoried");
+        if (project.files.some((file) => /\.(?:fs|fsx|vb|csx|razor|cshtml|xaml)$/.test(file)))
+            throw new Error("Mixed languages, scripts and generated UI sources require separate verified profiles");
+        const config = dotnetConfigSchema.parse(JSON.parse(await readProjectFile(source.root, path.posix.join(project.path, "checktrail.dotnet.json"))));
+        await dotnetReferences(source.root, project.path, config);
+        const invocation = JSON.stringify({ config, scope });
+        if (Buffer.byteLength(invocation) > 100 * 1024)
+            throw new Error(".NET invocation exceeds the 100 KiB argument limit");
+        check.commands.push({
+            executable: process.execPath,
+            args: [
+                fileURLToPath(new URL("./dotnet-runner.js", import.meta.url)),
+                source.root,
+                invocation,
+            ],
+            cwd: project.path,
+            env: {
+                PATH: process.env.PATH ?? "",
+                DOTNET_STARTUP_HOOKS: "",
+                DOTNET_ADDITIONAL_DEPS: "",
+                DOTNET_SHARED_STORE: "",
+                CORECLR_ENABLE_PROFILING: "0",
+            },
+        });
+    }
+    catch (error) {
+        check.unavailableReason =
+            error instanceof Error
+                ? error.message
+                : ".NET configuration could not be prepared";
+    }
+    return check;
+}

package/dist/src/engine.d.ts

@@ -0,0 +1,19 @@
+import { type ExternalReference } from "./external-adapter.js";
+import type { CheckResult, Inventory, Plan, Report } from "./types.js";
+export interface PlanOptions {
+    externalAdapters?: ExternalReference[];
+    base?: string;
+    policyOverlay?: string;
+    environment?: Record<string, string>;
+}
+export declare function createPlan(root: string, options?: PlanOptions): Promise<{
+    source: Inventory;
+    plan: Plan;
+}>;
+export declare function aggregate(checks: CheckResult[], stale?: boolean): Report["outcome"];
+export interface ValidationOptions extends PlanOptions {
+    trusted: boolean;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}
+export declare function validate(root: string, options: ValidationOptions): Promise<Report>;

package/dist/src/engine.js

@@ -0,0 +1,239 @@
+import { externalChecks, externalPolicyFingerprint, externalReferencesSchema, loadExternalAdapters, } from "./external-adapter.js";
+import { selectGitChanges, verifyGitIdentity } from "./git-selection.js";
+import { operatorEnvironment, selectEnvironment, environmentFingerprint, } from "./environment.js";
+import { randomUUID } from "node:crypto";
+import { discover, checksFor } from "./adapters.js";
+import { loadConfig } from "./config.js";
+import { evaluate } from "./evidence.js";
+import { inventory } from "./inventory.js";
+import { runProcess } from "./runner.js";
+import { identifyTool, toolsFor } from "./tool-versions.js";
+import { VERSION } from "./types.js";
+export async function createPlan(root, options = {}) {
+    const suppliedEnvironment = operatorEnvironment(options.environment);
+    const source = await inventory(root);
+    const external = await loadExternalAdapters(options.externalAdapters);
+    const projects = discover(source, external);
+    const { config, fingerprint: baseFingerprint } = await loadConfig(source, options.policyOverlay);
+    const fingerprint = externalPolicyFingerprint(baseFingerprint, external);
+    const selected = new Map(config?.projects.map((p) => [p.path, p.checks]));
+    for (const key of selected.keys()) {
+        if (!projects.some((p) => p.path === key))
+            throw new Error(`No detected project at configured path: ${key}`);
+    }
+    const checks = [];
+    const accepted = new Map();
+    for (const project of projects) {
+        if (config && !selected.has(project.path))
+            continue;
+        const requested = selected.get(project.path);
+        const extension = external.find((item) => item.identity.id === project.adapter);
+        const candidates = extension
+            ? externalChecks(source, project, extension)
+            : await checksFor(source, project, requested);
+        for (const check of candidates) {
+            if (requested && !requested.includes(check.id))
+                continue;
+            const names = config?.projects.find((item) => item.path === project.path)
+                ?.environment ?? [];
+            if (names.length) {
+                check.environment = [...names].sort();
+                if (names.some((name) => !Object.hasOwn(suppliedEnvironment, name)))
+                    check.unavailableReason ??=
+                        "Required project environment was not supplied by the operator.";
+                if (check.commands.some((command) => names.some((name) => Object.hasOwn(command.env ?? {}, name))))
+                    throw new Error("Project environment conflicts with protected adapter settings");
+            }
+            check.tools = await toolsFor(source.root, check);
+            checks.push(check);
+            const ids = accepted.get(project.path) ?? new Set();
+            ids.add(check.id);
+            accepted.set(project.path, ids);
+        }
+    }
+    for (const [project, ids] of selected) {
+        for (const id of ids) {
+            if (!accepted.get(project)?.has(id))
+                throw new Error(`Check is unknown or inapplicable: ${id}`);
+        }
+    }
+    const selection = options.base === undefined
+        ? undefined
+        : await selectGitChanges(source, [...new Set(checks.map((check) => check.project))], options.base, config?.workspace);
+    if (selection &&
+        (external.length > 0 ||
+            options.policyOverlay !== undefined ||
+            config?.projects.some((project) => project.packs?.length))) {
+        selection.mode = "full";
+        selection.reason = external.length
+            ? "External adapter impact requires complete project validation."
+            : "Pack and operator-overlay impact requires complete project validation.";
+        selection.selectedProjects = [
+            ...new Set(checks.map((check) => check.project)),
+        ];
+    }
+    const selectedChecks = selection
+        ? checks.filter((check) => selection.selectedProjects.includes(check.project))
+        : checks;
+    return {
+        source,
+        plan: {
+            schemaVersion: 1,
+            engineVersion: VERSION,
+            sourceFingerprint: source.fingerprint,
+            policyFingerprint: fingerprint,
+            excluded: source.excluded,
+            projects,
+            checks: selectedChecks,
+            ...(config?.workspace ? { workspace: config.workspace } : {}),
+            ...(selection ? { selection } : {}),
+        },
+    };
+}
+export function aggregate(checks, stale = false) {
+    if (checks.some((check) => check.status === "failed"))
+        return "failed";
+    if (stale ||
+        checks.length === 0 ||
+        checks.some((check) => check.status !== "passed"))
+        return "incomplete";
+    return "passed";
+}
+export async function validate(root, options) {
+    if (!options.trusted)
+        throw new Error("Execution requires operator trust. Use --trust-project or start MCP with --allow-execution.");
+    const timeoutMs = options.timeoutMs ?? 30_000;
+    if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 120_000)
+        throw new Error("Timeout must be between 1 and 120000 milliseconds");
+    const externalAdapters = externalReferencesSchema.parse(options.externalAdapters ?? []);
+    const started = Date.now();
+    const suppliedEnvironment = operatorEnvironment(options.environment);
+    const { source, plan } = await createPlan(root, {
+        environment: suppliedEnvironment,
+        externalAdapters,
+        ...(options.base !== undefined ? { base: options.base } : {}),
+        ...(options.policyOverlay !== undefined
+            ? { policyOverlay: options.policyOverlay }
+            : {}),
+    });
+    let activeEnvironment = {};
+    const checks = [];
+    let outputBudget = 4 * 1024 * 1024;
+    const identified = new Map();
+    const execute = async (command, maximum = 1024 * 1024) => {
+        const remaining = timeoutMs - (Date.now() - started);
+        if (remaining <= 0 || outputBudget <= 0 || options.signal?.aborted)
+            return undefined;
+        const result = await runProcess(source.root, command, {
+            timeoutMs: remaining,
+            environment: activeEnvironment,
+            maxOutputBytes: Math.min(outputBudget, maximum),
+            ...(options.signal ? { signal: options.signal } : {}),
+        });
+        outputBudget -=
+            Buffer.byteLength(result.stdout) + Buffer.byteLength(result.stderr);
+        return result;
+    };
+    for (const check of plan.checks) {
+        activeEnvironment = selectEnvironment(check.environment ?? [], suppliedEnvironment);
+        const environmentIdentity = environmentFingerprint(activeEnvironment);
+        const tools = [];
+        if (!check.unavailableReason)
+            for (const tool of check.tools ?? []) {
+                const key = JSON.stringify([tool, environmentIdentity]);
+                let identity = identified.get(key);
+                if (!identity) {
+                    try {
+                        identity = await identifyTool(source.root, tool, (command) => execute(command, 8192));
+                    }
+                    catch {
+                        identity = {
+                            name: tool.name,
+                            source: tool.source,
+                            version: null,
+                            status: "inconclusive",
+                        };
+                    }
+                    identified.set(key, identity);
+                }
+                tools.push(identity);
+            }
+        const processes = [];
+        let executionError = false;
+        if (!check.unavailableReason) {
+            for (const command of check.commands) {
+                const remaining = timeoutMs - (Date.now() - started);
+                if (remaining <= 0 || outputBudget <= 0 || options.signal?.aborted)
+                    break;
+                try {
+                    const processResult = await execute(command);
+                    if (!processResult)
+                        break;
+                    processes.push(processResult);
+                }
+                catch {
+                    executionError = true;
+                    break;
+                }
+            }
+        }
+        const result = evaluate(check, processes, source.root);
+        result.tools = tools;
+        if (check.environment?.length)
+            result.environment = {
+                names: Object.keys(activeEnvironment),
+                fingerprint: environmentIdentity,
+            };
+        if (result.status === "passed" &&
+            tools.some((tool) => tool.status !== "identified")) {
+            result.status = "inconclusive";
+            result.reason =
+                "The check completed but required tool identity could not be established.";
+        }
+        if (executionError) {
+            result.status = "error";
+            result.reason = "The command could not be prepared or started safely.";
+        }
+        checks.push(result);
+    }
+    let finalSourceFingerprint = null;
+    try {
+        finalSourceFingerprint = (await inventory(source.root)).fingerprint;
+    }
+    catch {
+        /* The report must retain results when source inspection fails. */
+    }
+    let sourceError = finalSourceFingerprint === null;
+    let sourceChanged = !sourceError && finalSourceFingerprint !== source.fingerprint;
+    if (plan.selection?.git) {
+        const state = await verifyGitIdentity(source.root, plan.selection.git);
+        sourceError ||= state === "error";
+        sourceChanged ||= state === "changed";
+    }
+    try {
+        const currentPolicy = await loadConfig(source, options.policyOverlay);
+        const currentExternal = await loadExternalAdapters(externalAdapters);
+        sourceChanged ||=
+            externalPolicyFingerprint(currentPolicy.fingerprint, currentExternal) !==
+                plan.policyFingerprint;
+    }
+    catch {
+        sourceError = true;
+    }
+    return {
+        ...(plan.selection ? { selection: plan.selection } : {}),
+        schemaVersion: 1,
+        engineVersion: VERSION,
+        runId: randomUUID(),
+        startedAt: new Date(started).toISOString(),
+        durationMs: Date.now() - started,
+        sourceFingerprint: source.fingerprint,
+        finalSourceFingerprint,
+        policyFingerprint: plan.policyFingerprint,
+        excluded: source.excluded,
+        sourceChanged,
+        sourceError,
+        outcome: aggregate(checks, sourceChanged || sourceError),
+        checks,
+    };
+}

package/dist/src/environment.d.ts

@@ -0,0 +1,6 @@
+import { z } from "zod";
+export declare const environmentName: z.ZodString;
+export declare function operatorEnvironment(input?: Record<string, string>): Record<string, string>;
+export declare function inheritEnvironment(names: string[], source?: NodeJS.ProcessEnv): Record<string, string>;
+export declare function selectEnvironment(names: string[], supplied: Record<string, string>): Record<string, string>;
+export declare function environmentFingerprint(environment: Record<string, string>): string;

package/dist/src/environment.js

@@ -0,0 +1,36 @@
+import { createHash } from "node:crypto";
+import { z } from "zod";
+export const environmentName = z
+    .string()
+    .max(128)
+    .regex(/^[A-Z_][A-Z0-9_]*$/);
+const environmentSchema = z
+    .record(environmentName, z
+    .string()
+    .max(16_384)
+    .refine((value) => !value.includes("\0")))
+    .refine((value) => Object.keys(value).length <= 64);
+export function operatorEnvironment(input = {}) {
+    return environmentSchema.parse(input);
+}
+export function inheritEnvironment(names, source = process.env) {
+    if (new Set(names).size !== names.length)
+        throw new Error("Duplicate environment permission");
+    return operatorEnvironment(Object.fromEntries(names.map((name) => {
+        environmentName.parse(name);
+        if (!Object.hasOwn(source, name) || source[name] === undefined)
+            throw new Error(`Allowed environment variable is unset: ${name}`);
+        return [name, source[name]];
+    })));
+}
+export function selectEnvironment(names, supplied) {
+    return Object.fromEntries(names
+        .filter((name) => Object.hasOwn(supplied, name))
+        .sort()
+        .map((name) => [name, supplied[name]]));
+}
+export function environmentFingerprint(environment) {
+    return createHash("sha256")
+        .update(JSON.stringify(Object.entries(environment).sort(([a], [b]) => a.localeCompare(b, "en"))))
+        .digest("hex");
+}

package/dist/src/eslint-evidence.d.ts

@@ -0,0 +1,2 @@
+import type { Check, CheckResult, ProcessResult } from "./types.js";
+export declare function eslintEvidence(check: Check, processes: ProcessResult[], root: string | undefined): Pick<CheckResult, "status" | "reason" | "findings" | "findingsComplete">;

package/dist/src/eslint-evidence.js

@@ -0,0 +1,98 @@
+import path from "node:path";
+import { z } from "zod";
+const count = z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const evidenceSchema = z.object({
+    schemaVersion: z.literal(1),
+    toolVersion: z.string().regex(/^\d+\.\d+\.\d+/),
+    files: z.array(z.object({
+        path: z.string(),
+        configured: z.boolean(),
+        activeRules: count,
+        results: z.array(z.object({
+            filePath: z.string(),
+            errorCount: count,
+            warningCount: count,
+            fatalErrorCount: count,
+            messages: z.array(z.object({
+                ruleId: z.string().min(1).nullable(),
+                severity: z.union([z.literal(1), z.literal(2)]),
+                fatal: z.boolean().optional(),
+                message: z.string(),
+                line: z.number().int().positive().optional(),
+            })),
+        })),
+    })),
+});
+export function eslintEvidence(check, processes, root) {
+    if (processes.some((p) => p.exitCode !== 0 && p.exitCode !== 1))
+        return {
+            status: "error",
+            reason: "ESLint could not complete; inspect its configuration, plugins and runtime locally.",
+        };
+    const incomplete = {
+        status: "inconclusive",
+        reason: "ESLint evidence is incomplete, inconsistent, or does not cover every planned file with enabled rules.",
+    };
+    if (!root ||
+        processes.length !== 1 ||
+        processes[0].stderr.trim() ||
+        !check.scope.length)
+        return incomplete;
+    try {
+        const evidence = evidenceSchema.parse(JSON.parse(processes[0].stdout));
+        const expected = new Set(check.scope);
+        const seen = new Set();
+        let violations = 0;
+        const findings = [];
+        for (const file of evidence.files) {
+            if (!expected.has(file.path) ||
+                seen.has(file.path) ||
+                !file.configured ||
+                file.activeRules === 0 ||
+                file.results.length !== 1)
+                return incomplete;
+            seen.add(file.path);
+            const result = file.results[0];
+            if (result.filePath !== path.resolve(root, check.project, file.path))
+                return incomplete;
+            if (result.errorCount !==
+                result.messages.filter((m) => m.severity === 2).length ||
+                result.warningCount !==
+                    result.messages.filter((m) => m.severity === 1).length ||
+                result.fatalErrorCount !==
+                    result.messages.filter((m) => m.fatal).length ||
+                result.messages.some((m) => (m.fatal && m.severity !== 2) ||
+                    (m.severity === 1 && m.ruleId === null)))
+                return incomplete;
+            violations += result.errorCount + result.warningCount;
+            findings.push(...result.messages.map((message) => ({
+                ruleId: message.ruleId ?? "parse-error",
+                level: message.severity === 2 ? "error" : "warning",
+                message: message.message,
+                file: path.posix.join(check.project, file.path),
+                ...(message.line ? { line: message.line } : {}),
+            })));
+        }
+        if (seen.size !== expected.size)
+            return incomplete;
+        if (violations)
+            return {
+                status: "failed",
+                reason: "ESLint reported errors or warnings in the planned files.",
+                findings,
+                findingsComplete: processes[0].exitCode === 1 &&
+                    findings.every((finding) => finding.ruleId !== "parse-error"),
+            };
+        if (processes[0].exitCode !== 0)
+            return incomplete;
+        return {
+            status: "passed",
+            findings,
+            findingsComplete: true,
+            reason: "ESLint checked every planned file with enabled rules and reported no errors or warnings.",
+        };
+    }
+    catch {
+        return incomplete;
+    }
+}

package/dist/src/eslint-runner.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/eslint-runner.js

@@ -0,0 +1,61 @@
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { readProjectFile, withinRoot } from "./inventory.js";
+async function main() {
+    const [entry, root, config, ...files] = process.argv.slice(2);
+    if (!entry || !root || !config || !files.length)
+        throw new Error("Invalid ESLint runner arguments");
+    const cwd = process.cwd();
+    const tool = await withinRoot(root, path.relative(root, entry));
+    const configPath = await withinRoot(root, path.relative(root, path.resolve(cwd, config)));
+    const { ESLint } = (await import(pathToFileURL(tool).href));
+    const eslint = new ESLint({
+        cwd,
+        overrideConfigFile: configPath,
+        fix: false,
+        cache: false,
+    });
+    const evidence = [];
+    let violations = false;
+    for (const file of files) {
+        const filePath = await withinRoot(root, path.relative(root, path.resolve(cwd, file)));
+        const configuration = await eslint.calculateConfigForFile(filePath);
+        const activeRules = Object.values(configuration?.rules ?? {}).filter((rule) => {
+            const severity = Array.isArray(rule) ? rule[0] : rule;
+            return (severity === 1 ||
+                severity === 2 ||
+                severity === "warn" ||
+                severity === "error");
+        }).length;
+        const source = configuration
+            ? await readProjectFile(root, path.relative(root, filePath))
+            : undefined;
+        const results = source === undefined
+            ? []
+            : await eslint.lintText(source, { filePath, warnIgnored: true });
+        for (const result of results)
+            violations ||= result.errorCount + result.warningCount > 0;
+        evidence.push({
+            path: file,
+            configured: configuration !== undefined,
+            activeRules,
+            results: results.map(({ filePath, messages, errorCount, warningCount, fatalErrorCount, }) => ({
+                filePath,
+                messages,
+                errorCount,
+                warningCount,
+                fatalErrorCount,
+            })),
+        });
+    }
+    process.stdout.write(JSON.stringify({
+        schemaVersion: 1,
+        toolVersion: ESLint.version,
+        files: evidence,
+    }) + "\n");
+    process.exitCode = violations ? 1 : 0;
+}
+main().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : "ESLint execution failed"}\n`);
+    process.exitCode = 2;
+});

package/dist/src/eslint.d.ts

@@ -0,0 +1,2 @@
+import type { Check, Inventory, Project } from "./types.js";
+export declare function eslintCheck(source: Inventory, project: Project): Promise<Check>;

package/dist/src/eslint.js

@@ -0,0 +1,40 @@
+import { fileURLToPath } from "node:url";
+import { localTool } from "./local-tool.js";
+export async function eslintCheck(source, project) {
+    const files = project.files.filter((file) => /\.(?:[cm]?[jt]s|[jt]sx|vue)$/.test(file));
+    const configs = project.files.filter((file) => /^eslint\.config\.(?:js|mjs|cjs)$/.test(file));
+    const tool = await localTool(source.root, project.path, "eslint/lib/api.js");
+    const check = {
+        id: "javascript.eslint",
+        adapter: project.adapter,
+        project: project.path,
+        scope: files,
+        kind: "analysis",
+        parser: "eslint-json",
+        reason: "Lint each inventoried JS/TS/Vue file with the project's flat config; require matching configuration and enabled rules for every file.",
+        commands: tool && configs.length === 1
+            ? [
+                {
+                    executable: process.execPath,
+                    args: [
+                        fileURLToPath(new URL("./eslint-runner.js", import.meta.url)),
+                        tool,
+                        source.root,
+                        configs[0],
+                        ...files,
+                    ],
+                    cwd: project.path,
+                },
+            ]
+            : [],
+    };
+    if (configs.length !== 1)
+        check.unavailableReason =
+            "Exactly one project-local eslint.config.js, .mjs or .cjs is required.";
+    else if (!files.length)
+        check.unavailableReason = "No supported source files were inventoried.";
+    else if (!tool)
+        check.unavailableReason =
+            "No project-local or root-hoisted ESLint installation is available within the configured root.";
+    return check;
+}

package/dist/src/evidence.d.ts

@@ -0,0 +1,2 @@
+import type { Check, CheckResult, ProcessResult } from "./types.js";
+export declare function evaluate(check: Check, processes: ProcessResult[], root?: string): CheckResult;