@vizejs/marquette 0.299.1 → 0.303.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ubugeeei
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -99,18 +99,39 @@ deployment tooling can bind a `tests` check to retained, immutable facts:
 import { defineTestRunEvidence } from "@vizejs/marquette/test-run";
 import { validateTestRunEvidence } from "@vizejs/marquette/test-run/validate";
 import { testRunAdmissionId } from "@vizejs/marquette/test-run/canonical";
-import { admitTestRun } from "@vizejs/marquette/test-run/admission";
+import { admitTestRun, decideTestRunAdmission } from "@vizejs/marquette/test-run/admission";
+import { verifyTestRunCheck } from "@vizejs/marquette/test-run/check";
+import { verifyTestRunTransition } from "@vizejs/marquette/test-run/transition";
 
 const diagnostics = validateTestRunEvidence(evidence);
 const admissionId = await testRunAdmissionId(evidence); // test-run:<sha256>
 const rejections = await admitTestRun(evidence, candidate, admissionId, now);
+const decision = await decideTestRunAdmission(evidence, candidate, admissionId, now);
+if (!decision.allowed) {
+  console.error(decision.denialCodes); // e.g. ["record-expired"]
+}
+const release = await verifyTestRunCheck(retainedCheck, candidate, evidence, now);
+const journal = await verifyTestRunTransition(nextTransition, chainTip);
 ```
 
 Validation shares its `VIZE_MARQUETTE_1xx` codes, paths, and ordering with the
 native implementation, and the canonical entry produces byte-identical
 serialization and SHA-256 fingerprints, proven by the shared fixtures in
-`tests/fixtures/test-run-evidence/`. The published record schema is available
-from `@vizejs/marquette/test-run/schema`.
+`tests/fixtures/test-run-evidence/`. Admission decisions carry the stable,
+append-only denial-code vocabulary shared by every backend family; the same
+fixtures pin every decision so a JavaScript, Rust, Go, or JVM gate denies for
+identical machine-readable causes. The check entry replaces every generic
+test-result reference in release evidence: a retained `vize.test-run.check`
+record may only name the exact `test-run:<sha256>` admission id, bind the six
+candidate facts, and record an observer independent from the runner. The
+transition entry makes each release decision and the complete accepted
+anti-replay state one durable atomic record, chained by canonical SHA-256
+fingerprints; hosts persist it with a write-then-atomic-rename and verify the
+recovered tip before deciding anything new. The published record schema is
+available from `@vizejs/marquette/test-run/schema`, the decision contract from
+`@vizejs/marquette/test-run/admission/schema`, the tests-check contract from
+`@vizejs/marquette/test-run/check/schema`, and the transition contract from
+`@vizejs/marquette/test-run/transition/schema`.
 
 ## Guarantees
 

package/dist/application-contract.schema.json

@@ -0,0 +1,167 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://vizejs.dev/schemas/marquette/application-contract.schema.json",
+  "title": "Vize Application Marquette",
+  "description": "Versioned language-neutral application target, environment, backend, protocol, and route graph.",
+  "$ref": "#/$defs/contract",
+  "$defs": {
+    "identifier": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9._-]*$"
+    },
+    "target": {
+      "enum": ["web", "native", "desktop", "terminal"]
+    },
+    "runtime": {
+      "enum": [
+        "browser",
+        "javascript",
+        "rust",
+        "go",
+        "jvm",
+        "native",
+        "desktop",
+        "terminal",
+        "external"
+      ]
+    },
+    "capabilityDefinition": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "description"],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "description": { "type": "string", "minLength": 1 },
+        "version": { "type": "integer", "minimum": 1, "default": 1 }
+      }
+    },
+    "environment": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "target", "consumer", "runtime"],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "target": { "$ref": "#/$defs/target" },
+        "consumer": { "enum": ["client", "server"] },
+        "runtime": { "$ref": "#/$defs/runtime" },
+        "entry": { "type": "string", "minLength": 1 },
+        "dependsOn": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/identifier" },
+          "uniqueItems": true,
+          "default": []
+        },
+        "capabilities": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/identifier" },
+          "uniqueItems": true,
+          "default": []
+        }
+      }
+    },
+    "backend": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "family"],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "family": { "enum": ["javascript", "rust", "go", "jvm", "external"] },
+        "environment": { "$ref": "#/$defs/identifier" },
+        "capabilities": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/identifier" },
+          "uniqueItems": true,
+          "default": []
+        }
+      }
+    },
+    "protocol": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "family", "backend"],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "family": { "enum": ["schema-query", "typed-rpc", "binary-rpc"] },
+        "backend": { "$ref": "#/$defs/identifier" },
+        "capabilities": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/identifier" },
+          "uniqueItems": true,
+          "default": []
+        }
+      }
+    },
+    "route": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "path", "environment", "rendering"],
+      "properties": {
+        "id": { "$ref": "#/$defs/identifier" },
+        "path": { "type": "string", "pattern": "^/" },
+        "environment": { "$ref": "#/$defs/identifier" },
+        "rendering": {
+          "enum": [
+            "client",
+            "static",
+            "server",
+            "stream",
+            "partial",
+            "hybrid",
+            "native",
+            "desktop",
+            "terminal"
+          ]
+        },
+        "backend": { "$ref": "#/$defs/identifier" },
+        "protocol": { "$ref": "#/$defs/identifier" },
+        "capabilities": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/identifier" },
+          "uniqueItems": true,
+          "default": []
+        }
+      }
+    },
+    "contract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["application"],
+      "properties": {
+        "formatVersion": { "const": 1, "default": 1 },
+        "application": { "$ref": "#/$defs/identifier" },
+        "targets": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/target" },
+          "uniqueItems": true,
+          "default": []
+        },
+        "capabilities": {
+          "type": "object",
+          "propertyNames": { "$ref": "#/$defs/identifier" },
+          "additionalProperties": { "$ref": "#/$defs/capabilityDefinition" },
+          "default": {}
+        },
+        "environments": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/environment" },
+          "default": []
+        },
+        "backends": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/backend" },
+          "default": []
+        },
+        "protocols": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/protocol" },
+          "default": []
+        },
+        "routes": {
+          "type": "array",
+          "items": { "$ref": "#/$defs/route" },
+          "default": []
+        }
+      }
+    }
+  }
+}

package/dist/test-run-admission.d.mts

@@ -1,6 +1,6 @@
 import { i as TestRunEvidence } from "./test-run-model-DkllmEsY.mjs";
 import { MarquetteDiagnostic } from "./validate.mjs";
-import { TEST_RUN_ADMISSION_PREFIX, parseTestRunAdmissionId } from "./test-run-canonical.mjs";
+import { r as parseTestRunAdmissionId, t as TEST_RUN_ADMISSION_PREFIX } from "./test-run-canonical-CB-KzZxk.mjs";
 
 //#region src/test-run-admission.d.ts
 /**
@@ -43,6 +43,62 @@ interface TestRunCandidate {
  * hand the parsed record here.
  */
 declare function admitTestRun(evidence: TestRunEvidence, candidate: TestRunCandidate, admissionId: string, now: string): Promise<MarquetteDiagnostic[]>;
+/**
+ * Every denial code, in the stable lexicographic decision order.
+ *
+ * The vocabulary is shared by every backend family: a JavaScript, Rust, Go,
+ * or JVM host must derive the same codes from the same diagnostics, as
+ * pinned by the shared `tests/fixtures/test-run-evidence` decision fixtures.
+ * Codes are append-only: they are never renamed, renumbered, reused, or
+ * removed, and a new rejection cause always ships with a new code.
+ */
+declare const TEST_RUN_DENIAL_CODES: readonly ["admission-id-malformed", "admission-id-mismatch", "admission-time-malformed", "candidate-application-mismatch", "candidate-artifact-fingerprint-mismatch", "candidate-contract-fingerprint-mismatch", "candidate-environment-mismatch", "candidate-release-mismatch", "candidate-source-revision-mismatch", "check-candidate-mismatch", "check-invalid", "check-observer-not-independent", "record-expired", "record-invalid", "skipped-tests-recorded", "transition-chain-broken", "transition-invalid", "transition-replayed", "transition-state-mismatch", "verification-not-accepted"];
+/** Stable machine-readable cause class of one admission denial. */
+type TestRunDenialCode = (typeof TEST_RUN_DENIAL_CODES)[number];
+/**
+ * Structured allow-or-deny admission decision for one exact candidate.
+ *
+ * The decision carries the machine-readable cause classes next to the exact
+ * diagnostics, so a deployment gate in any language can act on one bounded
+ * vocabulary while operators keep the full explanation. Serialization
+ * follows the shared `test-run-admission` schema; decisions are outputs, so
+ * a gate must never trust a decision it did not compute itself.
+ */
+interface TestRunAdmissionDecision {
+  /** Whether the record admits the candidate; true only with no diagnostics. */
+  readonly allowed: boolean;
+  /** Deduplicated denial causes sorted lexicographically; empty when allowed. */
+  readonly denialCodes: readonly TestRunDenialCode[];
+  /** Complete diagnostics in the stable path, code, message order. */
+  readonly diagnostics: readonly MarquetteDiagnostic[];
+}
+/**
+ * Returns the stable denial code one admission diagnostic maps to.
+ *
+ * The mapping is total and identical in every host family: admission codes
+ * `VIZE_MARQUETTE_141` through `VIZE_MARQUETTE_148` map to their exact
+ * cause, `VIZE_MARQUETTE_144` distinguishes the mismatched candidate binding
+ * by its diagnostic path, `VIZE_MARQUETTE_149` through `VIZE_MARQUETTE_151`
+ * map to their tests-check cause, `VIZE_MARQUETTE_156` through
+ * `VIZE_MARQUETTE_159` map to their transition cause, every other
+ * diagnostic at a `check.` path is a `check-invalid` tests-check validation
+ * failure, every other diagnostic at a `transition.` path is a
+ * `transition-invalid` transition validation failure, and every remaining
+ * diagnostic is a `record-invalid` record-validation failure.
+ */
+declare function testRunDenialCode(diagnostic: MarquetteDiagnostic): TestRunDenialCode;
+/**
+ * Decides one candidate and returns the structured admission decision.
+ *
+ * The decision wraps {@link admitTestRun}: `diagnostics` is exactly its
+ * result, `denialCodes` maps every diagnostic through
+ * {@link testRunDenialCode} and then deduplicates and sorts the codes
+ * lexicographically, and `allowed` is true only when both are empty. Codes,
+ * ordering, and diagnostics are identical to the native implementation, as
+ * pinned by the shared decision fixtures. Inputs carry the same obligations
+ * as {@link admitTestRun}.
+ */
+declare function decideTestRunAdmission(evidence: TestRunEvidence, candidate: TestRunCandidate, admissionId: string, now: string): Promise<TestRunAdmissionDecision>;
 //#endregion
-export { TEST_RUN_ADMISSION_PREFIX, TestRunCandidate, admitTestRun, parseTestRunAdmissionId };
+export { TEST_RUN_ADMISSION_PREFIX, TEST_RUN_DENIAL_CODES, TestRunAdmissionDecision, TestRunCandidate, TestRunDenialCode, admitTestRun, decideTestRunAdmission, parseTestRunAdmissionId, testRunDenialCode };
 //# sourceMappingURL=test-run-admission.d.mts.map

package/dist/test-run-admission.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"test-run-admission.d.mts","names":[],"sources":["../src/test-run-admission.ts"],"mappings":";;;;;;;AAcA;;;;UAAiB,gBAAA;EAIN;EAAA,SAFA,WAAA;EAMA;EAAA,SAJA,WAAA;EAQA;EAAA,SANA,mBAAA;EAMmB;EAAA,SAJnB,cAAA;EA0BuB;EAAA,SAxBvB,OAAA;EAyBC;EAAA,SAvBD,mBAAA;AAAA;;;;;;;;;;;;;;;;;;;;iBAsBW,YAAA,CACpB,QAAA,EAAU,eAAA,EACV,SAAA,EAAW,gBAAA,EACX,WAAA,UACA,GAAA,WACC,OAAA,CAAQ,mBAAA"}
+{"version":3,"file":"test-run-admission.d.mts","names":[],"sources":["../src/test-run-admission.ts"],"mappings":";;;;;;;AAcA;;;;UAAiB,gBAAA;EAIN;EAAA,SAFA,WAAA;EAMA;EAAA,SAJA,WAAA;EAQA;EAAA,SANA,mBAAA;EAMmB;EAAA,SAJnB,cAAA;EA0BuB;EAAA,SAxBvB,OAAA;EAyBC;EAAA,SAvBD,mBAAA;AAAA;;;;;;;;;;;;;;AA+HX;;;;;AAwBA;iBAjIsB,YAAA,CACpB,QAAA,EAAU,eAAA,EACV,SAAA,EAAW,gBAAA,EACX,WAAA,UACA,GAAA,WACC,OAAA,CAAQ,mBAAA;;;;AAuIX;;;;;;cAnCa,qBAAA;;KAwBD,iBAAA,WAA4B,qBAAA;;;AA2CxC;;;;;;;UAhCiB,wBAAA;EAgCoE;EAAA,SA9B1E,OAAA;EAqFiC;EAAA,SAnFjC,WAAA,WAAsB,iBAAA;EAoFrB;EAAA,SAlFD,WAAA,WAAsB,mBAAA;AAAA;;;;;;;;;;;;;;;iBA0BjB,iBAAA,CAAkB,UAAA,EAAY,mBAAA,GAAsB,iBAAA;;;;;;;;;;;;iBAuD9C,sBAAA,CACpB,QAAA,EAAU,eAAA,EACV,SAAA,EAAW,gBAAA,EACX,WAAA,UACA,GAAA,WACC,OAAA,CAAQ,wBAAA"}

package/dist/test-run-admission.mjs

@@ -1,4 +1,4 @@
-import { a as error, o as isStrictTimestamp, t as validateTestRunEvidence } from "./test-run-validate-XF0vyoWI.mjs";
+import { d as isStrictTimestamp, t as validateTestRunEvidence, u as error } from "./test-run-validate-C_KR031E.mjs";
 import { TEST_RUN_ADMISSION_PREFIX, parseTestRunAdmissionId, testRunFingerprint } from "./test-run-canonical.mjs";
 //#region src/test-run-admission.ts
 /**
@@ -66,7 +66,105 @@ async function admitTestRun(evidence, candidate, admissionId, now) {
 	diagnostics.sort((left, right) => left.path !== right.path ? left.path < right.path ? -1 : 1 : left.code !== right.code ? left.code < right.code ? -1 : 1 : left.message < right.message ? -1 : left.message > right.message ? 1 : 0);
 	return diagnostics;
 }
+/**
+* Every denial code, in the stable lexicographic decision order.
+*
+* The vocabulary is shared by every backend family: a JavaScript, Rust, Go,
+* or JVM host must derive the same codes from the same diagnostics, as
+* pinned by the shared `tests/fixtures/test-run-evidence` decision fixtures.
+* Codes are append-only: they are never renamed, renumbered, reused, or
+* removed, and a new rejection cause always ships with a new code.
+*/
+const TEST_RUN_DENIAL_CODES = [
+	"admission-id-malformed",
+	"admission-id-mismatch",
+	"admission-time-malformed",
+	"candidate-application-mismatch",
+	"candidate-artifact-fingerprint-mismatch",
+	"candidate-contract-fingerprint-mismatch",
+	"candidate-environment-mismatch",
+	"candidate-release-mismatch",
+	"candidate-source-revision-mismatch",
+	"check-candidate-mismatch",
+	"check-invalid",
+	"check-observer-not-independent",
+	"record-expired",
+	"record-invalid",
+	"skipped-tests-recorded",
+	"transition-chain-broken",
+	"transition-invalid",
+	"transition-replayed",
+	"transition-state-mismatch",
+	"verification-not-accepted"
+];
+const CANDIDATE_MISMATCH_CODES = new Map([
+	["application", "candidate-application-mismatch"],
+	["artifact.fingerprint", "candidate-artifact-fingerprint-mismatch"],
+	["contractFingerprint", "candidate-contract-fingerprint-mismatch"],
+	["environment", "candidate-environment-mismatch"],
+	["release", "candidate-release-mismatch"],
+	["sourceRevision", "candidate-source-revision-mismatch"]
+]);
+/**
+* Returns the stable denial code one admission diagnostic maps to.
+*
+* The mapping is total and identical in every host family: admission codes
+* `VIZE_MARQUETTE_141` through `VIZE_MARQUETTE_148` map to their exact
+* cause, `VIZE_MARQUETTE_144` distinguishes the mismatched candidate binding
+* by its diagnostic path, `VIZE_MARQUETTE_149` through `VIZE_MARQUETTE_151`
+* map to their tests-check cause, `VIZE_MARQUETTE_156` through
+* `VIZE_MARQUETTE_159` map to their transition cause, every other
+* diagnostic at a `check.` path is a `check-invalid` tests-check validation
+* failure, every other diagnostic at a `transition.` path is a
+* `transition-invalid` transition validation failure, and every remaining
+* diagnostic is a `record-invalid` record-validation failure.
+*/
+function testRunDenialCode(diagnostic) {
+	switch (diagnostic.code) {
+		case "VIZE_MARQUETTE_141": return "admission-id-malformed";
+		case "VIZE_MARQUETTE_142": return "admission-id-mismatch";
+		case "VIZE_MARQUETTE_144": {
+			const mismatch = CANDIDATE_MISMATCH_CODES.get(diagnostic.path);
+			if (mismatch !== void 0) return mismatch;
+			break;
+		}
+		case "VIZE_MARQUETTE_145": return "record-expired";
+		case "VIZE_MARQUETTE_146": return "verification-not-accepted";
+		case "VIZE_MARQUETTE_147": return "skipped-tests-recorded";
+		case "VIZE_MARQUETTE_148": return "admission-time-malformed";
+		case "VIZE_MARQUETTE_149": return "check-candidate-mismatch";
+		case "VIZE_MARQUETTE_150": return "check-invalid";
+		case "VIZE_MARQUETTE_151": return "check-observer-not-independent";
+		case "VIZE_MARQUETTE_156": return "transition-state-mismatch";
+		case "VIZE_MARQUETTE_157": return "transition-chain-broken";
+		case "VIZE_MARQUETTE_158": return "transition-replayed";
+		case "VIZE_MARQUETTE_159": return "transition-state-mismatch";
+		default: break;
+	}
+	if (diagnostic.path.startsWith("check.")) return "check-invalid";
+	return diagnostic.path.startsWith("transition.") ? "transition-invalid" : "record-invalid";
+}
+/**
+* Decides one candidate and returns the structured admission decision.
+*
+* The decision wraps {@link admitTestRun}: `diagnostics` is exactly its
+* result, `denialCodes` maps every diagnostic through
+* {@link testRunDenialCode} and then deduplicates and sorts the codes
+* lexicographically, and `allowed` is true only when both are empty. Codes,
+* ordering, and diagnostics are identical to the native implementation, as
+* pinned by the shared decision fixtures. Inputs carry the same obligations
+* as {@link admitTestRun}.
+*/
+async function decideTestRunAdmission(evidence, candidate, admissionId, now) {
+	const diagnostics = await admitTestRun(evidence, candidate, admissionId, now);
+	const denialCodes = [...new Set(diagnostics.map(testRunDenialCode))].sort();
+	return {
+		allowed: diagnostics.length === 0,
+		denialCodes,
+		diagnostics
+	};
+}
 //#endregion
-export { TEST_RUN_ADMISSION_PREFIX, admitTestRun, parseTestRunAdmissionId };
+export { TEST_RUN_ADMISSION_PREFIX, TEST_RUN_DENIAL_CODES, admitTestRun, decideTestRunAdmission, parseTestRunAdmissionId, testRunDenialCode };
 
 //# sourceMappingURL=test-run-admission.mjs.map

package/dist/test-run-admission.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"test-run-admission.mjs","names":[],"sources":["../src/test-run-admission.ts"],"sourcesContent":["import type { TestRunEvidence } from \"./test-run-model.js\";\nimport type { MarquetteDiagnostic } from \"./validate.js\";\nimport { parseTestRunAdmissionId, testRunFingerprint } from \"./test-run-canonical.js\";\nimport { validateTestRunEvidence } from \"./test-run-validate.js\";\nimport { error, isStrictTimestamp } from \"./test-run-validate-rules.js\";\n\nexport { TEST_RUN_ADMISSION_PREFIX, parseTestRunAdmissionId } from \"./test-run-canonical.js\";\n\n/**\n * Exact release candidate a deployment gate wants evidence for.\n *\n * Every field must match the record exactly; admission never falls back to a\n * newer, older, or partially matching record.\n */\nexport interface TestRunCandidate {\n  /** Application the gate is deploying. */\n  readonly application: string;\n  /** Deployment environment the gate is promoting into. */\n  readonly environment: string;\n  /** Lowercase SHA-256 fingerprint of the application contract. */\n  readonly contractFingerprint: string;\n  /** Exact source revision of the candidate. */\n  readonly sourceRevision: string;\n  /** Release the candidate belongs to. */\n  readonly release: string;\n  /** Lowercase SHA-256 fingerprint of the exact artifact being promoted. */\n  readonly artifactFingerprint: string;\n}\n\n/**\n * Decides whether one record admits one exact candidate at one instant.\n *\n * An empty result admits the deployment. Any diagnostic rejects it: the\n * record must validate cleanly, its canonical fingerprint must be the one\n * named by `admissionId`, every candidate binding must match exactly, the\n * record must not be expired at `now`, the independent verification must\n * have accepted the run, and no skipped test may remain unaccounted for.\n *\n * Codes, paths, messages, and ordering are identical to the native\n * implementation, so both host families reach the same decision for the\n * same record.\n *\n * `now` must be a millisecond-precision UTC timestamp such as\n * `2026-01-01T00:00:00.000Z`; the fixed-width format keeps the expiry\n * comparison exact. Callers own retrieval: fetch the canonical bytes from an\n * immutable store within their own deadline, refuse oversized content, and\n * hand the parsed record here.\n */\nexport async function admitTestRun(\n  evidence: TestRunEvidence,\n  candidate: TestRunCandidate,\n  admissionId: string,\n  now: string,\n): Promise<MarquetteDiagnostic[]> {\n  const diagnostics = validateTestRunEvidence(evidence);\n\n  const nowIsExact = isStrictTimestamp(now);\n  if (!nowIsExact) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_148\",\n        \"admission.now\",\n        \"admission time must be a millisecond-precision UTC instant\",\n      ),\n    );\n  }\n\n  const expected = parseTestRunAdmissionId(admissionId);\n  if (expected === undefined) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_141\",\n        \"admission.id\",\n        \"admission id must be test-run: followed by 64 lowercase hexadecimal characters\",\n      ),\n    );\n  } else if ((await testRunFingerprint(evidence)) !== expected) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_142\",\n        \"admission.id\",\n        \"admission id does not name this record's canonical fingerprint\",\n      ),\n    );\n  }\n\n  const bindings = [\n    [evidence.application, candidate.application, \"application\"],\n    [evidence.environment, candidate.environment, \"environment\"],\n    [evidence.contractFingerprint, candidate.contractFingerprint, \"contractFingerprint\"],\n    [evidence.sourceRevision, candidate.sourceRevision, \"sourceRevision\"],\n    [evidence.release, candidate.release, \"release\"],\n    [evidence.artifact.fingerprint, candidate.artifactFingerprint, \"artifact.fingerprint\"],\n  ] as const;\n  for (const [recorded, wanted, field] of bindings) {\n    if (recorded !== wanted) {\n      diagnostics.push(\n        error(\"VIZE_MARQUETTE_144\", field, `record does not bind the candidate ${field}`),\n      );\n    }\n  }\n\n  if (nowIsExact && evidence.validUntil <= now) {\n    diagnostics.push(\n      error(\"VIZE_MARQUETTE_145\", \"validUntil\", \"record is expired at the admission time\"),\n    );\n  }\n  if (evidence.verification.outcome !== \"accepted\") {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_146\",\n        \"verification.outcome\",\n        \"only an accepted verification can admit a deployment\",\n      ),\n    );\n  }\n  if (evidence.verification.skipped > 0) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_147\",\n        \"verification.skipped\",\n        \"skipped tests are not approved for deployment admission\",\n      ),\n    );\n  }\n\n  diagnostics.sort((left, right) =>\n    left.path !== right.path\n      ? left.path < right.path\n        ? -1\n        : 1\n      : left.code !== right.code\n        ? left.code < right.code\n          ? -1\n          : 1\n        : left.message < right.message\n          ? -1\n          : left.message > right.message\n            ? 1\n            : 0,\n  );\n  return diagnostics;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgDA,eAAsB,aACpB,UACA,WACA,aACA,KACgC;CAChC,MAAM,cAAc,wBAAwB,SAAS;CAErD,MAAM,aAAa,kBAAkB,IAAI;CACzC,IAAI,CAAC,YACH,YAAY,KACV,MACE,sBACA,iBACA,6DACD,CACF;CAGH,MAAM,WAAW,wBAAwB,YAAY;CACrD,IAAI,aAAa,KAAA,GACf,YAAY,KACV,MACE,sBACA,gBACA,iFACD,CACF;MACI,IAAK,MAAM,mBAAmB,SAAS,KAAM,UAClD,YAAY,KACV,MACE,sBACA,gBACA,iEACD,CACF;CAGH,MAAM,WAAW;EACf;GAAC,SAAS;GAAa,UAAU;GAAa;GAAc;EAC5D;GAAC,SAAS;GAAa,UAAU;GAAa;GAAc;EAC5D;GAAC,SAAS;GAAqB,UAAU;GAAqB;GAAsB;EACpF;GAAC,SAAS;GAAgB,UAAU;GAAgB;GAAiB;EACrE;GAAC,SAAS;GAAS,UAAU;GAAS;GAAU;EAChD;GAAC,SAAS,SAAS;GAAa,UAAU;GAAqB;GAAuB;EACvF;CACD,KAAK,MAAM,CAAC,UAAU,QAAQ,UAAU,UACtC,IAAI,aAAa,QACf,YAAY,KACV,MAAM,sBAAsB,OAAO,sCAAsC,QAAQ,CAClF;CAIL,IAAI,cAAc,SAAS,cAAc,KACvC,YAAY,KACV,MAAM,sBAAsB,cAAc,0CAA0C,CACrF;CAEH,IAAI,SAAS,aAAa,YAAY,YACpC,YAAY,KACV,MACE,sBACA,wBACA,uDACD,CACF;CAEH,IAAI,SAAS,aAAa,UAAU,GAClC,YAAY,KACV,MACE,sBACA,wBACA,0DACD,CACF;CAGH,YAAY,MAAM,MAAM,UACtB,KAAK,SAAS,MAAM,OAChB,KAAK,OAAO,MAAM,OAChB,KACA,IACF,KAAK,SAAS,MAAM,OAClB,KAAK,OAAO,MAAM,OAChB,KACA,IACF,KAAK,UAAU,MAAM,UACnB,KACA,KAAK,UAAU,MAAM,UACnB,IACA,EACX;CACD,OAAO"}
+{"version":3,"file":"test-run-admission.mjs","names":[],"sources":["../src/test-run-admission.ts"],"sourcesContent":["import type { TestRunEvidence } from \"./test-run-model.js\";\nimport type { MarquetteDiagnostic } from \"./validate.js\";\nimport { parseTestRunAdmissionId, testRunFingerprint } from \"./test-run-canonical.js\";\nimport { validateTestRunEvidence } from \"./test-run-validate.js\";\nimport { error, isStrictTimestamp } from \"./test-run-validate-rules.js\";\n\nexport { TEST_RUN_ADMISSION_PREFIX, parseTestRunAdmissionId } from \"./test-run-canonical.js\";\n\n/**\n * Exact release candidate a deployment gate wants evidence for.\n *\n * Every field must match the record exactly; admission never falls back to a\n * newer, older, or partially matching record.\n */\nexport interface TestRunCandidate {\n  /** Application the gate is deploying. */\n  readonly application: string;\n  /** Deployment environment the gate is promoting into. */\n  readonly environment: string;\n  /** Lowercase SHA-256 fingerprint of the application contract. */\n  readonly contractFingerprint: string;\n  /** Exact source revision of the candidate. */\n  readonly sourceRevision: string;\n  /** Release the candidate belongs to. */\n  readonly release: string;\n  /** Lowercase SHA-256 fingerprint of the exact artifact being promoted. */\n  readonly artifactFingerprint: string;\n}\n\n/**\n * Decides whether one record admits one exact candidate at one instant.\n *\n * An empty result admits the deployment. Any diagnostic rejects it: the\n * record must validate cleanly, its canonical fingerprint must be the one\n * named by `admissionId`, every candidate binding must match exactly, the\n * record must not be expired at `now`, the independent verification must\n * have accepted the run, and no skipped test may remain unaccounted for.\n *\n * Codes, paths, messages, and ordering are identical to the native\n * implementation, so both host families reach the same decision for the\n * same record.\n *\n * `now` must be a millisecond-precision UTC timestamp such as\n * `2026-01-01T00:00:00.000Z`; the fixed-width format keeps the expiry\n * comparison exact. Callers own retrieval: fetch the canonical bytes from an\n * immutable store within their own deadline, refuse oversized content, and\n * hand the parsed record here.\n */\nexport async function admitTestRun(\n  evidence: TestRunEvidence,\n  candidate: TestRunCandidate,\n  admissionId: string,\n  now: string,\n): Promise<MarquetteDiagnostic[]> {\n  const diagnostics = validateTestRunEvidence(evidence);\n\n  const nowIsExact = isStrictTimestamp(now);\n  if (!nowIsExact) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_148\",\n        \"admission.now\",\n        \"admission time must be a millisecond-precision UTC instant\",\n      ),\n    );\n  }\n\n  const expected = parseTestRunAdmissionId(admissionId);\n  if (expected === undefined) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_141\",\n        \"admission.id\",\n        \"admission id must be test-run: followed by 64 lowercase hexadecimal characters\",\n      ),\n    );\n  } else if ((await testRunFingerprint(evidence)) !== expected) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_142\",\n        \"admission.id\",\n        \"admission id does not name this record's canonical fingerprint\",\n      ),\n    );\n  }\n\n  const bindings = [\n    [evidence.application, candidate.application, \"application\"],\n    [evidence.environment, candidate.environment, \"environment\"],\n    [evidence.contractFingerprint, candidate.contractFingerprint, \"contractFingerprint\"],\n    [evidence.sourceRevision, candidate.sourceRevision, \"sourceRevision\"],\n    [evidence.release, candidate.release, \"release\"],\n    [evidence.artifact.fingerprint, candidate.artifactFingerprint, \"artifact.fingerprint\"],\n  ] as const;\n  for (const [recorded, wanted, field] of bindings) {\n    if (recorded !== wanted) {\n      diagnostics.push(\n        error(\"VIZE_MARQUETTE_144\", field, `record does not bind the candidate ${field}`),\n      );\n    }\n  }\n\n  if (nowIsExact && evidence.validUntil <= now) {\n    diagnostics.push(\n      error(\"VIZE_MARQUETTE_145\", \"validUntil\", \"record is expired at the admission time\"),\n    );\n  }\n  if (evidence.verification.outcome !== \"accepted\") {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_146\",\n        \"verification.outcome\",\n        \"only an accepted verification can admit a deployment\",\n      ),\n    );\n  }\n  if (evidence.verification.skipped > 0) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_147\",\n        \"verification.skipped\",\n        \"skipped tests are not approved for deployment admission\",\n      ),\n    );\n  }\n\n  diagnostics.sort((left, right) =>\n    left.path !== right.path\n      ? left.path < right.path\n        ? -1\n        : 1\n      : left.code !== right.code\n        ? left.code < right.code\n          ? -1\n          : 1\n        : left.message < right.message\n          ? -1\n          : left.message > right.message\n            ? 1\n            : 0,\n  );\n  return diagnostics;\n}\n\n/**\n * Every denial code, in the stable lexicographic decision order.\n *\n * The vocabulary is shared by every backend family: a JavaScript, Rust, Go,\n * or JVM host must derive the same codes from the same diagnostics, as\n * pinned by the shared `tests/fixtures/test-run-evidence` decision fixtures.\n * Codes are append-only: they are never renamed, renumbered, reused, or\n * removed, and a new rejection cause always ships with a new code.\n */\nexport const TEST_RUN_DENIAL_CODES = [\n  \"admission-id-malformed\",\n  \"admission-id-mismatch\",\n  \"admission-time-malformed\",\n  \"candidate-application-mismatch\",\n  \"candidate-artifact-fingerprint-mismatch\",\n  \"candidate-contract-fingerprint-mismatch\",\n  \"candidate-environment-mismatch\",\n  \"candidate-release-mismatch\",\n  \"candidate-source-revision-mismatch\",\n  \"check-candidate-mismatch\",\n  \"check-invalid\",\n  \"check-observer-not-independent\",\n  \"record-expired\",\n  \"record-invalid\",\n  \"skipped-tests-recorded\",\n  \"transition-chain-broken\",\n  \"transition-invalid\",\n  \"transition-replayed\",\n  \"transition-state-mismatch\",\n  \"verification-not-accepted\",\n] as const;\n\n/** Stable machine-readable cause class of one admission denial. */\nexport type TestRunDenialCode = (typeof TEST_RUN_DENIAL_CODES)[number];\n\n/**\n * Structured allow-or-deny admission decision for one exact candidate.\n *\n * The decision carries the machine-readable cause classes next to the exact\n * diagnostics, so a deployment gate in any language can act on one bounded\n * vocabulary while operators keep the full explanation. Serialization\n * follows the shared `test-run-admission` schema; decisions are outputs, so\n * a gate must never trust a decision it did not compute itself.\n */\nexport interface TestRunAdmissionDecision {\n  /** Whether the record admits the candidate; true only with no diagnostics. */\n  readonly allowed: boolean;\n  /** Deduplicated denial causes sorted lexicographically; empty when allowed. */\n  readonly denialCodes: readonly TestRunDenialCode[];\n  /** Complete diagnostics in the stable path, code, message order. */\n  readonly diagnostics: readonly MarquetteDiagnostic[];\n}\n\nconst CANDIDATE_MISMATCH_CODES: ReadonlyMap<string, TestRunDenialCode> = new Map([\n  [\"application\", \"candidate-application-mismatch\"],\n  [\"artifact.fingerprint\", \"candidate-artifact-fingerprint-mismatch\"],\n  [\"contractFingerprint\", \"candidate-contract-fingerprint-mismatch\"],\n  [\"environment\", \"candidate-environment-mismatch\"],\n  [\"release\", \"candidate-release-mismatch\"],\n  [\"sourceRevision\", \"candidate-source-revision-mismatch\"],\n]);\n\n/**\n * Returns the stable denial code one admission diagnostic maps to.\n *\n * The mapping is total and identical in every host family: admission codes\n * `VIZE_MARQUETTE_141` through `VIZE_MARQUETTE_148` map to their exact\n * cause, `VIZE_MARQUETTE_144` distinguishes the mismatched candidate binding\n * by its diagnostic path, `VIZE_MARQUETTE_149` through `VIZE_MARQUETTE_151`\n * map to their tests-check cause, `VIZE_MARQUETTE_156` through\n * `VIZE_MARQUETTE_159` map to their transition cause, every other\n * diagnostic at a `check.` path is a `check-invalid` tests-check validation\n * failure, every other diagnostic at a `transition.` path is a\n * `transition-invalid` transition validation failure, and every remaining\n * diagnostic is a `record-invalid` record-validation failure.\n */\nexport function testRunDenialCode(diagnostic: MarquetteDiagnostic): TestRunDenialCode {\n  switch (diagnostic.code) {\n    case \"VIZE_MARQUETTE_141\":\n      return \"admission-id-malformed\";\n    case \"VIZE_MARQUETTE_142\":\n      return \"admission-id-mismatch\";\n    case \"VIZE_MARQUETTE_144\": {\n      const mismatch = CANDIDATE_MISMATCH_CODES.get(diagnostic.path);\n      if (mismatch !== undefined) {\n        return mismatch;\n      }\n      break;\n    }\n    case \"VIZE_MARQUETTE_145\":\n      return \"record-expired\";\n    case \"VIZE_MARQUETTE_146\":\n      return \"verification-not-accepted\";\n    case \"VIZE_MARQUETTE_147\":\n      return \"skipped-tests-recorded\";\n    case \"VIZE_MARQUETTE_148\":\n      return \"admission-time-malformed\";\n    case \"VIZE_MARQUETTE_149\":\n      return \"check-candidate-mismatch\";\n    case \"VIZE_MARQUETTE_150\":\n      return \"check-invalid\";\n    case \"VIZE_MARQUETTE_151\":\n      return \"check-observer-not-independent\";\n    case \"VIZE_MARQUETTE_156\":\n      return \"transition-state-mismatch\";\n    case \"VIZE_MARQUETTE_157\":\n      return \"transition-chain-broken\";\n    case \"VIZE_MARQUETTE_158\":\n      return \"transition-replayed\";\n    case \"VIZE_MARQUETTE_159\":\n      return \"transition-state-mismatch\";\n    default:\n      break;\n  }\n  if (diagnostic.path.startsWith(\"check.\")) {\n    return \"check-invalid\";\n  }\n  return diagnostic.path.startsWith(\"transition.\") ? \"transition-invalid\" : \"record-invalid\";\n}\n\n/**\n * Decides one candidate and returns the structured admission decision.\n *\n * The decision wraps {@link admitTestRun}: `diagnostics` is exactly its\n * result, `denialCodes` maps every diagnostic through\n * {@link testRunDenialCode} and then deduplicates and sorts the codes\n * lexicographically, and `allowed` is true only when both are empty. Codes,\n * ordering, and diagnostics are identical to the native implementation, as\n * pinned by the shared decision fixtures. Inputs carry the same obligations\n * as {@link admitTestRun}.\n */\nexport async function decideTestRunAdmission(\n  evidence: TestRunEvidence,\n  candidate: TestRunCandidate,\n  admissionId: string,\n  now: string,\n): Promise<TestRunAdmissionDecision> {\n  const diagnostics = await admitTestRun(evidence, candidate, admissionId, now);\n  const denialCodes = [...new Set(diagnostics.map(testRunDenialCode))].sort();\n  return { allowed: diagnostics.length === 0, denialCodes, diagnostics };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgDA,eAAsB,aACpB,UACA,WACA,aACA,KACgC;CAChC,MAAM,cAAc,wBAAwB,SAAS;CAErD,MAAM,aAAa,kBAAkB,IAAI;CACzC,IAAI,CAAC,YACH,YAAY,KACV,MACE,sBACA,iBACA,6DACD,CACF;CAGH,MAAM,WAAW,wBAAwB,YAAY;CACrD,IAAI,aAAa,KAAA,GACf,YAAY,KACV,MACE,sBACA,gBACA,iFACD,CACF;MACI,IAAK,MAAM,mBAAmB,SAAS,KAAM,UAClD,YAAY,KACV,MACE,sBACA,gBACA,iEACD,CACF;CAGH,MAAM,WAAW;EACf;GAAC,SAAS;GAAa,UAAU;GAAa;GAAc;EAC5D;GAAC,SAAS;GAAa,UAAU;GAAa;GAAc;EAC5D;GAAC,SAAS;GAAqB,UAAU;GAAqB;GAAsB;EACpF;GAAC,SAAS;GAAgB,UAAU;GAAgB;GAAiB;EACrE;GAAC,SAAS;GAAS,UAAU;GAAS;GAAU;EAChD;GAAC,SAAS,SAAS;GAAa,UAAU;GAAqB;GAAuB;EACvF;CACD,KAAK,MAAM,CAAC,UAAU,QAAQ,UAAU,UACtC,IAAI,aAAa,QACf,YAAY,KACV,MAAM,sBAAsB,OAAO,sCAAsC,QAAQ,CAClF;CAIL,IAAI,cAAc,SAAS,cAAc,KACvC,YAAY,KACV,MAAM,sBAAsB,cAAc,0CAA0C,CACrF;CAEH,IAAI,SAAS,aAAa,YAAY,YACpC,YAAY,KACV,MACE,sBACA,wBACA,uDACD,CACF;CAEH,IAAI,SAAS,aAAa,UAAU,GAClC,YAAY,KACV,MACE,sBACA,wBACA,0DACD,CACF;CAGH,YAAY,MAAM,MAAM,UACtB,KAAK,SAAS,MAAM,OAChB,KAAK,OAAO,MAAM,OAChB,KACA,IACF,KAAK,SAAS,MAAM,OAClB,KAAK,OAAO,MAAM,OAChB,KACA,IACF,KAAK,UAAU,MAAM,UACnB,KACA,KAAK,UAAU,MAAM,UACnB,IACA,EACX;CACD,OAAO;;;;;;;;;;;AAYT,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAuBD,MAAM,2BAAmE,IAAI,IAAI;CAC/E,CAAC,eAAe,iCAAiC;CACjD,CAAC,wBAAwB,0CAA0C;CACnE,CAAC,uBAAuB,0CAA0C;CAClE,CAAC,eAAe,iCAAiC;CACjD,CAAC,WAAW,6BAA6B;CACzC,CAAC,kBAAkB,qCAAqC;CACzD,CAAC;;;;;;;;;;;;;;;AAgBF,SAAgB,kBAAkB,YAAoD;CACpF,QAAQ,WAAW,MAAnB;EACE,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBAAsB;GACzB,MAAM,WAAW,yBAAyB,IAAI,WAAW,KAAK;GAC9D,IAAI,aAAa,KAAA,GACf,OAAO;GAET;;EAEF,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,SACE;;CAEJ,IAAI,WAAW,KAAK,WAAW,SAAS,EACtC,OAAO;CAET,OAAO,WAAW,KAAK,WAAW,cAAc,GAAG,uBAAuB;;;;;;;;;;;;;AAc5E,eAAsB,uBACpB,UACA,WACA,aACA,KACmC;CACnC,MAAM,cAAc,MAAM,aAAa,UAAU,WAAW,aAAa,IAAI;CAC7E,MAAM,cAAc,CAAC,GAAG,IAAI,IAAI,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,MAAM;CAC3E,OAAO;EAAE,SAAS,YAAY,WAAW;EAAG;EAAa;EAAa"}

package/dist/test-run-admission.schema.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://vizejs.dev/schemas/marquette/test-run-admission.schema.json",
+  "title": "Vize Test Run Admission Decision",
+  "description": "Language-neutral allow-or-deny decision that one test-run evidence record produces for one exact release candidate at one instant. Every backend family (JavaScript, Rust, Go, JVM) must produce byte-equivalent decisions for the same evidence, candidate, admission id, and admission time; the shared tests/fixtures/test-run-evidence admission-decision fixtures are the conformance source of truth for new host implementations.",
+  "$ref": "#/$defs/decision",
+  "$defs": {
+    "denialCode": {
+      "description": "Stable machine-readable cause class of one admission denial. The vocabulary is append-only: codes are never renamed, renumbered, reused, or removed, and every new distinguishable rejection cause ships with a new code added to this enum in lexicographic position. Hosts must map every diagnostic to exactly one code: VIZE_MARQUETTE_141 to admission-id-malformed; VIZE_MARQUETTE_142 to admission-id-mismatch; VIZE_MARQUETTE_144 to the candidate-*-mismatch code named by its diagnostic path (application, artifact.fingerprint, contractFingerprint, environment, release, sourceRevision); VIZE_MARQUETTE_145 to record-expired; VIZE_MARQUETTE_146 to verification-not-accepted; VIZE_MARQUETTE_147 to skipped-tests-recorded; VIZE_MARQUETTE_148 to admission-time-malformed; VIZE_MARQUETTE_149 to check-candidate-mismatch; VIZE_MARQUETTE_150 to check-invalid; VIZE_MARQUETTE_151 to check-observer-not-independent; VIZE_MARQUETTE_156 to transition-state-mismatch; VIZE_MARQUETTE_157 to transition-chain-broken; VIZE_MARQUETTE_158 to transition-replayed; VIZE_MARQUETTE_159 to transition-state-mismatch; every other diagnostic whose path starts with check. to check-invalid; every other diagnostic whose path starts with transition. to transition-invalid; and every remaining diagnostic, including every record-validation code, to record-invalid.",
+      "enum": [
+        "admission-id-malformed",
+        "admission-id-mismatch",
+        "admission-time-malformed",
+        "candidate-application-mismatch",
+        "candidate-artifact-fingerprint-mismatch",
+        "candidate-contract-fingerprint-mismatch",
+        "candidate-environment-mismatch",
+        "candidate-release-mismatch",
+        "candidate-source-revision-mismatch",
+        "check-candidate-mismatch",
+        "check-invalid",
+        "check-observer-not-independent",
+        "record-expired",
+        "record-invalid",
+        "skipped-tests-recorded",
+        "transition-chain-broken",
+        "transition-invalid",
+        "transition-replayed",
+        "transition-state-mismatch",
+        "verification-not-accepted"
+      ]
+    },
+    "diagnostic": {
+      "description": "One stable, source-addressable diagnostic explaining a denial cause. Codes, severities, paths, messages, and ordering are identical across host families.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "severity", "path", "message"],
+      "properties": {
+        "code": {
+          "description": "Stable machine-readable diagnostic code.",
+          "type": "string",
+          "pattern": "^VIZE_MARQUETTE_[0-9]{3}$"
+        },
+        "severity": {
+          "description": "Diagnostic severity; any diagnostic denies admission.",
+          "enum": ["error", "warning"]
+        },
+        "path": {
+          "description": "JSON-style path into the record or the admission input.",
+          "type": "string",
+          "minLength": 1
+        },
+        "message": {
+          "description": "Human-readable explanation and next action.",
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "decision": {
+      "description": "Structured admission decision. allowed is true only when denialCodes and diagnostics are both empty. denialCodes maps every diagnostic to its denial code, deduplicated and sorted lexicographically by Unicode code point. diagnostics keeps the stable path, code, message order shared by every implementation.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["allowed", "denialCodes", "diagnostics"],
+      "properties": {
+        "allowed": {
+          "description": "Whether the record admits the candidate.",
+          "type": "boolean"
+        },
+        "denialCodes": {
+          "description": "Deduplicated denial causes in lexicographic order; empty when allowed.",
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/denialCode" }
+        },
+        "diagnostics": {
+          "description": "Complete denial diagnostics; empty when allowed.",
+          "type": "array",
+          "items": { "$ref": "#/$defs/diagnostic" }
+        }
+      }
+    }
+  }
+}

package/dist/test-run-canonical-CB-KzZxk.d.mts

@@ -0,0 +1,35 @@
+import { i as TestRunEvidence } from "./test-run-model-DkllmEsY.mjs";
+
+//#region src/test-run-canonical.d.ts
+/** Prefix of every test-run deployment admission id. */
+declare const TEST_RUN_ADMISSION_PREFIX = "test-run:";
+/**
+ * Serializes a test-run evidence record canonically.
+ *
+ * Property order matches the record schema, targets sort by id, suites sort
+ * by id then shard index, and selection identifiers sort lexicographically,
+ * so equivalent records produce byte-identical JSON in every language. Call
+ * validation before trusting the record; canonicalization does not make an
+ * invalid record valid.
+ */
+declare function canonicalTestRunJson(evidence: TestRunEvidence): string;
+/**
+ * Returns the lowercase SHA-256 fingerprint of the canonical record.
+ *
+ * The fingerprint is the exact value admitted as `test-run:<sha256>` by
+ * deployment gates. Uses the Web Crypto API available in every supported
+ * runtime.
+ */
+declare function testRunFingerprint(evidence: TestRunEvidence): Promise<string>;
+/** Returns the `test-run:<sha256>` admission id for one record. */
+declare function testRunAdmissionId(evidence: TestRunEvidence): Promise<string>;
+/**
+ * Returns the fingerprint named by a `test-run:<sha256>` admission id.
+ *
+ * Returns `undefined` unless the prefix, length, and lowercase hexadecimal
+ * grammar are all exact.
+ */
+declare function parseTestRunAdmissionId(id: string): string | undefined;
+//#endregion
+export { testRunFingerprint as a, testRunAdmissionId as i, canonicalTestRunJson as n, parseTestRunAdmissionId as r, TEST_RUN_ADMISSION_PREFIX as t };
+//# sourceMappingURL=test-run-canonical-CB-KzZxk.d.mts.map

package/dist/test-run-canonical-CB-KzZxk.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-run-canonical-CB-KzZxk.d.mts","names":[],"sources":["../src/test-run-canonical.ts"],"mappings":";;;;cAQa,yBAAA;AAAb;;;;;AAwCA;;;;AAxCA,iBAwCgB,oBAAA,CAAqB,QAAA,EAAU,eAAA;AA6D/C;;;;;;;AAAA,iBAAsB,kBAAA,CAAmB,QAAA,EAAU,eAAA,GAAkB,OAAA;;iBAW/C,kBAAA,CAAmB,QAAA,EAAU,eAAA,GAAkB,OAAA;;;;;;;iBAUrD,uBAAA,CAAwB,EAAA"}

package/dist/test-run-canonical.d.mts

@@ -1,35 +1,2 @@
-import { i as TestRunEvidence } from "./test-run-model-DkllmEsY.mjs";
-
-//#region src/test-run-canonical.d.ts
-/** Prefix of every test-run deployment admission id. */
-declare const TEST_RUN_ADMISSION_PREFIX = "test-run:";
-/**
- * Serializes a test-run evidence record canonically.
- *
- * Property order matches the record schema, targets sort by id, suites sort
- * by id then shard index, and selection identifiers sort lexicographically,
- * so equivalent records produce byte-identical JSON in every language. Call
- * validation before trusting the record; canonicalization does not make an
- * invalid record valid.
- */
-declare function canonicalTestRunJson(evidence: TestRunEvidence): string;
-/**
- * Returns the lowercase SHA-256 fingerprint of the canonical record.
- *
- * The fingerprint is the exact value admitted as `test-run:<sha256>` by
- * deployment gates. Uses the Web Crypto API available in every supported
- * runtime.
- */
-declare function testRunFingerprint(evidence: TestRunEvidence): Promise<string>;
-/** Returns the `test-run:<sha256>` admission id for one record. */
-declare function testRunAdmissionId(evidence: TestRunEvidence): Promise<string>;
-/**
- * Returns the fingerprint named by a `test-run:<sha256>` admission id.
- *
- * Returns `undefined` unless the prefix, length, and lowercase hexadecimal
- * grammar are all exact.
- */
-declare function parseTestRunAdmissionId(id: string): string | undefined;
-//#endregion
-export { TEST_RUN_ADMISSION_PREFIX, canonicalTestRunJson, parseTestRunAdmissionId, testRunAdmissionId, testRunFingerprint };
-//# sourceMappingURL=test-run-canonical.d.mts.map
+import { a as testRunFingerprint, i as testRunAdmissionId, n as canonicalTestRunJson, r as parseTestRunAdmissionId, t as TEST_RUN_ADMISSION_PREFIX } from "./test-run-canonical-CB-KzZxk.mjs";
+export { TEST_RUN_ADMISSION_PREFIX, canonicalTestRunJson, parseTestRunAdmissionId, testRunAdmissionId, testRunFingerprint };