@vizejs/marquette 0.299.1

package/dist/test-run-canonical.mjs

@@ -0,0 +1,124 @@
+//#region src/test-run-canonical.ts
+/** Prefix of every test-run deployment admission id. */
+const TEST_RUN_ADMISSION_PREFIX = "test-run:";
+const ADMISSION_FINGERPRINT = /^[a-f0-9]{64}$/;
+function retained(evidence) {
+	return {
+		reference: evidence.reference,
+		fingerprint: evidence.fingerprint
+	};
+}
+function target(execution) {
+	return {
+		id: execution.id,
+		kind: execution.kind,
+		environment: execution.environment
+	};
+}
+function suite(execution) {
+	return {
+		id: execution.id,
+		targetId: execution.targetId,
+		kind: execution.kind,
+		shardIndex: execution.shardIndex,
+		shardCount: execution.shardCount,
+		outcome: execution.outcome,
+		passed: execution.passed,
+		failed: execution.failed,
+		skipped: execution.skipped,
+		retries: execution.retries,
+		durationMs: execution.durationMs,
+		invocationFingerprint: execution.invocationFingerprint,
+		report: retained(execution.report),
+		log: retained(execution.log)
+	};
+}
+/**
+* Serializes a test-run evidence record canonically.
+*
+* Property order matches the record schema, targets sort by id, suites sort
+* by id then shard index, and selection identifiers sort lexicographically,
+* so equivalent records produce byte-identical JSON in every language. Call
+* validation before trusting the record; canonicalization does not make an
+* invalid record valid.
+*/
+function canonicalTestRunJson(evidence) {
+	const canonical = {
+		format: evidence.format,
+		formatVersion: evidence.formatVersion ?? 1,
+		id: evidence.id,
+		application: evidence.application,
+		environment: evidence.environment,
+		contractFingerprint: evidence.contractFingerprint,
+		sourceRevision: evidence.sourceRevision,
+		release: evidence.release,
+		artifact: {
+			id: evidence.artifact.id,
+			fingerprint: evidence.artifact.fingerprint,
+			sizeBytes: evidence.artifact.sizeBytes
+		},
+		startedAt: evidence.startedAt,
+		completedAt: evidence.completedAt,
+		validUntil: evidence.validUntil,
+		runner: {
+			identity: evidence.runner.identity,
+			authenticationEvidence: retained(evidence.runner.authenticationEvidence),
+			isolation: evidence.runner.isolation,
+			invocationFingerprint: evidence.runner.invocationFingerprint,
+			environmentEvidence: retained(evidence.runner.environmentEvidence),
+			environmentFingerprint: evidence.runner.environmentFingerprint
+		},
+		selection: {
+			targetIds: [...evidence.selection.targetIds].sort(),
+			suiteIds: [...evidence.selection.suiteIds].sort()
+		},
+		targets: evidence.targets.map(target).sort((left, right) => left.id < right.id ? -1 : left.id > right.id ? 1 : 0),
+		suites: evidence.suites.map(suite).sort((left, right) => left.id !== right.id ? left.id < right.id ? -1 : 1 : left.shardIndex - right.shardIndex),
+		verification: {
+			verifier: evidence.verification.verifier,
+			completedAt: evidence.verification.completedAt,
+			outcome: evidence.verification.outcome,
+			targetCount: evidence.verification.targetCount,
+			suiteCount: evidence.verification.suiteCount,
+			passed: evidence.verification.passed,
+			failed: evidence.verification.failed,
+			skipped: evidence.verification.skipped,
+			retries: evidence.verification.retries,
+			evidence: retained(evidence.verification.evidence)
+		}
+	};
+	return JSON.stringify(canonical);
+}
+/**
+* Returns the lowercase SHA-256 fingerprint of the canonical record.
+*
+* The fingerprint is the exact value admitted as `test-run:<sha256>` by
+* deployment gates. Uses the Web Crypto API available in every supported
+* runtime.
+*/
+async function testRunFingerprint(evidence) {
+	const bytes = new TextEncoder().encode(canonicalTestRunJson(evidence));
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+	let fingerprint = "";
+	for (const byte of new Uint8Array(digest)) fingerprint += byte.toString(16).padStart(2, "0");
+	return fingerprint;
+}
+/** Returns the `test-run:<sha256>` admission id for one record. */
+async function testRunAdmissionId(evidence) {
+	return `${TEST_RUN_ADMISSION_PREFIX}${await testRunFingerprint(evidence)}`;
+}
+/**
+* Returns the fingerprint named by a `test-run:<sha256>` admission id.
+*
+* Returns `undefined` unless the prefix, length, and lowercase hexadecimal
+* grammar are all exact.
+*/
+function parseTestRunAdmissionId(id) {
+	if (!id.startsWith("test-run:")) return;
+	const fingerprint = id.slice(9);
+	return ADMISSION_FINGERPRINT.test(fingerprint) ? fingerprint : void 0;
+}
+//#endregion
+export { TEST_RUN_ADMISSION_PREFIX, canonicalTestRunJson, parseTestRunAdmissionId, testRunAdmissionId, testRunFingerprint };
+
+//# sourceMappingURL=test-run-canonical.mjs.map

package/dist/test-run-canonical.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-run-canonical.mjs","names":[],"sources":["../src/test-run-canonical.ts"],"sourcesContent":["import type {\n  TestRunEvidence,\n  TestRunRetainedEvidence,\n  TestRunSuiteExecution,\n  TestRunTargetExecution,\n} from \"./test-run-model.js\";\n\n/** Prefix of every test-run deployment admission id. */\nexport const TEST_RUN_ADMISSION_PREFIX = \"test-run:\";\n\nconst ADMISSION_FINGERPRINT = /^[a-f0-9]{64}$/;\n\nfunction retained(evidence: TestRunRetainedEvidence): TestRunRetainedEvidence {\n  return { reference: evidence.reference, fingerprint: evidence.fingerprint };\n}\n\nfunction target(execution: TestRunTargetExecution): TestRunTargetExecution {\n  return { id: execution.id, kind: execution.kind, environment: execution.environment };\n}\n\nfunction suite(execution: TestRunSuiteExecution): TestRunSuiteExecution {\n  return {\n    id: execution.id,\n    targetId: execution.targetId,\n    kind: execution.kind,\n    shardIndex: execution.shardIndex,\n    shardCount: execution.shardCount,\n    outcome: execution.outcome,\n    passed: execution.passed,\n    failed: execution.failed,\n    skipped: execution.skipped,\n    retries: execution.retries,\n    durationMs: execution.durationMs,\n    invocationFingerprint: execution.invocationFingerprint,\n    report: retained(execution.report),\n    log: retained(execution.log),\n  };\n}\n\n/**\n * Serializes a test-run evidence record canonically.\n *\n * Property order matches the record schema, targets sort by id, suites sort\n * by id then shard index, and selection identifiers sort lexicographically,\n * so equivalent records produce byte-identical JSON in every language. Call\n * validation before trusting the record; canonicalization does not make an\n * invalid record valid.\n */\nexport function canonicalTestRunJson(evidence: TestRunEvidence): string {\n  const canonical = {\n    format: evidence.format,\n    formatVersion: evidence.formatVersion ?? 1,\n    id: evidence.id,\n    application: evidence.application,\n    environment: evidence.environment,\n    contractFingerprint: evidence.contractFingerprint,\n    sourceRevision: evidence.sourceRevision,\n    release: evidence.release,\n    artifact: {\n      id: evidence.artifact.id,\n      fingerprint: evidence.artifact.fingerprint,\n      sizeBytes: evidence.artifact.sizeBytes,\n    },\n    startedAt: evidence.startedAt,\n    completedAt: evidence.completedAt,\n    validUntil: evidence.validUntil,\n    runner: {\n      identity: evidence.runner.identity,\n      authenticationEvidence: retained(evidence.runner.authenticationEvidence),\n      isolation: evidence.runner.isolation,\n      invocationFingerprint: evidence.runner.invocationFingerprint,\n      environmentEvidence: retained(evidence.runner.environmentEvidence),\n      environmentFingerprint: evidence.runner.environmentFingerprint,\n    },\n    selection: {\n      targetIds: [...evidence.selection.targetIds].sort(),\n      suiteIds: [...evidence.selection.suiteIds].sort(),\n    },\n    targets: evidence.targets\n      .map(target)\n      .sort((left, right) => (left.id < right.id ? -1 : left.id > right.id ? 1 : 0)),\n    suites: evidence.suites\n      .map(suite)\n      .sort((left, right) =>\n        left.id !== right.id ? (left.id < right.id ? -1 : 1) : left.shardIndex - right.shardIndex,\n      ),\n    verification: {\n      verifier: evidence.verification.verifier,\n      completedAt: evidence.verification.completedAt,\n      outcome: evidence.verification.outcome,\n      targetCount: evidence.verification.targetCount,\n      suiteCount: evidence.verification.suiteCount,\n      passed: evidence.verification.passed,\n      failed: evidence.verification.failed,\n      skipped: evidence.verification.skipped,\n      retries: evidence.verification.retries,\n      evidence: retained(evidence.verification.evidence),\n    },\n  };\n  return JSON.stringify(canonical);\n}\n\n/**\n * Returns the lowercase SHA-256 fingerprint of the canonical record.\n *\n * The fingerprint is the exact value admitted as `test-run:<sha256>` by\n * deployment gates. Uses the Web Crypto API available in every supported\n * runtime.\n */\nexport async function testRunFingerprint(evidence: TestRunEvidence): Promise<string> {\n  const bytes = new TextEncoder().encode(canonicalTestRunJson(evidence));\n  const digest = await globalThis.crypto.subtle.digest(\"SHA-256\", bytes);\n  let fingerprint = \"\";\n  for (const byte of new Uint8Array(digest)) {\n    fingerprint += byte.toString(16).padStart(2, \"0\");\n  }\n  return fingerprint;\n}\n\n/** Returns the `test-run:<sha256>` admission id for one record. */\nexport async function testRunAdmissionId(evidence: TestRunEvidence): Promise<string> {\n  return `${TEST_RUN_ADMISSION_PREFIX}${await testRunFingerprint(evidence)}`;\n}\n\n/**\n * Returns the fingerprint named by a `test-run:<sha256>` admission id.\n *\n * Returns `undefined` unless the prefix, length, and lowercase hexadecimal\n * grammar are all exact.\n */\nexport function parseTestRunAdmissionId(id: string): string | undefined {\n  if (!id.startsWith(TEST_RUN_ADMISSION_PREFIX)) {\n    return undefined;\n  }\n  const fingerprint = id.slice(TEST_RUN_ADMISSION_PREFIX.length);\n  return ADMISSION_FINGERPRINT.test(fingerprint) ? fingerprint : undefined;\n}\n"],"mappings":";;AAQA,MAAa,4BAA4B;AAEzC,MAAM,wBAAwB;AAE9B,SAAS,SAAS,UAA4D;CAC5E,OAAO;EAAE,WAAW,SAAS;EAAW,aAAa,SAAS;EAAa;;AAG7E,SAAS,OAAO,WAA2D;CACzE,OAAO;EAAE,IAAI,UAAU;EAAI,MAAM,UAAU;EAAM,aAAa,UAAU;EAAa;;AAGvF,SAAS,MAAM,WAAyD;CACtE,OAAO;EACL,IAAI,UAAU;EACd,UAAU,UAAU;EACpB,MAAM,UAAU;EAChB,YAAY,UAAU;EACtB,YAAY,UAAU;EACtB,SAAS,UAAU;EACnB,QAAQ,UAAU;EAClB,QAAQ,UAAU;EAClB,SAAS,UAAU;EACnB,SAAS,UAAU;EACnB,YAAY,UAAU;EACtB,uBAAuB,UAAU;EACjC,QAAQ,SAAS,UAAU,OAAO;EAClC,KAAK,SAAS,UAAU,IAAI;EAC7B;;;;;;;;;;;AAYH,SAAgB,qBAAqB,UAAmC;CACtE,MAAM,YAAY;EAChB,QAAQ,SAAS;EACjB,eAAe,SAAS,iBAAiB;EACzC,IAAI,SAAS;EACb,aAAa,SAAS;EACtB,aAAa,SAAS;EACtB,qBAAqB,SAAS;EAC9B,gBAAgB,SAAS;EACzB,SAAS,SAAS;EAClB,UAAU;GACR,IAAI,SAAS,SAAS;GACtB,aAAa,SAAS,SAAS;GAC/B,WAAW,SAAS,SAAS;GAC9B;EACD,WAAW,SAAS;EACpB,aAAa,SAAS;EACtB,YAAY,SAAS;EACrB,QAAQ;GACN,UAAU,SAAS,OAAO;GAC1B,wBAAwB,SAAS,SAAS,OAAO,uBAAuB;GACxE,WAAW,SAAS,OAAO;GAC3B,uBAAuB,SAAS,OAAO;GACvC,qBAAqB,SAAS,SAAS,OAAO,oBAAoB;GAClE,wBAAwB,SAAS,OAAO;GACzC;EACD,WAAW;GACT,WAAW,CAAC,GAAG,SAAS,UAAU,UAAU,CAAC,MAAM;GACnD,UAAU,CAAC,GAAG,SAAS,UAAU,SAAS,CAAC,MAAM;GAClD;EACD,SAAS,SAAS,QACf,IAAI,OAAO,CACX,MAAM,MAAM,UAAW,KAAK,KAAK,MAAM,KAAK,KAAK,KAAK,KAAK,MAAM,KAAK,IAAI,EAAG;EAChF,QAAQ,SAAS,OACd,IAAI,MAAM,CACV,MAAM,MAAM,UACX,KAAK,OAAO,MAAM,KAAM,KAAK,KAAK,MAAM,KAAK,KAAK,IAAK,KAAK,aAAa,MAAM,WAChF;EACH,cAAc;GACZ,UAAU,SAAS,aAAa;GAChC,aAAa,SAAS,aAAa;GACnC,SAAS,SAAS,aAAa;GAC/B,aAAa,SAAS,aAAa;GACnC,YAAY,SAAS,aAAa;GAClC,QAAQ,SAAS,aAAa;GAC9B,QAAQ,SAAS,aAAa;GAC9B,SAAS,SAAS,aAAa;GAC/B,SAAS,SAAS,aAAa;GAC/B,UAAU,SAAS,SAAS,aAAa,SAAS;GACnD;EACF;CACD,OAAO,KAAK,UAAU,UAAU;;;;;;;;;AAUlC,eAAsB,mBAAmB,UAA4C;CACnF,MAAM,QAAQ,IAAI,aAAa,CAAC,OAAO,qBAAqB,SAAS,CAAC;CACtE,MAAM,SAAS,MAAM,WAAW,OAAO,OAAO,OAAO,WAAW,MAAM;CACtE,IAAI,cAAc;CAClB,KAAK,MAAM,QAAQ,IAAI,WAAW,OAAO,EACvC,eAAe,KAAK,SAAS,GAAG,CAAC,SAAS,GAAG,IAAI;CAEnD,OAAO;;;AAIT,eAAsB,mBAAmB,UAA4C;CACnF,OAAO,GAAG,4BAA4B,MAAM,mBAAmB,SAAS;;;;;;;;AAS1E,SAAgB,wBAAwB,IAAgC;CACtE,IAAI,CAAC,GAAG,WAAA,YAAqC,EAC3C;CAEF,MAAM,cAAc,GAAG,MAAM,EAAiC;CAC9D,OAAO,sBAAsB,KAAK,YAAY,GAAG,cAAc,KAAA"}

package/dist/test-run-model-B2INFVlw.mjs

@@ -0,0 +1,9 @@
+//#region src/test-run-model.ts
+/** Serialized `format` marker for test-run evidence records. */
+const TEST_RUN_EVIDENCE_FORMAT = "vize.test-run.evidence";
+/** Current serialized test-run evidence format version. */
+const TEST_RUN_EVIDENCE_FORMAT_VERSION = 1;
+//#endregion
+export { TEST_RUN_EVIDENCE_FORMAT_VERSION as n, TEST_RUN_EVIDENCE_FORMAT as t };
+
+//# sourceMappingURL=test-run-model-B2INFVlw.mjs.map

package/dist/test-run-model-B2INFVlw.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-run-model-B2INFVlw.mjs","names":[],"sources":["../src/test-run-model.ts"],"sourcesContent":["/** Serialized `format` marker for test-run evidence records. */\nexport const TEST_RUN_EVIDENCE_FORMAT = \"vize.test-run.evidence\" as const;\n\n/** Current serialized test-run evidence format version. */\nexport const TEST_RUN_EVIDENCE_FORMAT_VERSION = 1 as const;\n\n/** Isolation level of the runner that executed the tests. */\nexport type TestRunIsolation = \"dedicated\" | \"ephemeral\";\n\n/** Kind of user-visible target a test execution ran against. */\nexport type TestRunTargetKind = \"web\" | \"native\" | \"desktop\" | \"terminal\" | \"server\";\n\n/** Semantic kind of one executed suite. */\nexport type TestRunSuiteKind =\n  | \"unit\"\n  | \"integration\"\n  | \"contract\"\n  | \"end-to-end\"\n  | \"accessibility\"\n  | \"visual\"\n  | \"performance\"\n  | \"resilience\"\n  | \"installation\"\n  | \"upgrade\"\n  | \"migration\";\n\n/** Final result of one executed suite shard. */\nexport type TestRunSuiteOutcome = \"passed\" | \"failed\" | \"cancelled\";\n\n/** Final result of the independent verification pass. */\nexport type TestRunVerificationOutcome = \"accepted\" | \"rejected\";\n\n/**\n * Immutable, content-addressed reference to retained evidence.\n *\n * The reference names the retained content by SHA-256 so a green label can\n * never drift away from the bytes that were verified.\n */\nexport interface TestRunRetainedEvidence {\n  /** Content-addressed retrieval reference in `sha256:<64 hex>` form. */\n  readonly reference: string;\n  /** Lowercase SHA-256 fingerprint of the retained content. */\n  readonly fingerprint: string;\n}\n\n/** Exact release artifact that the recorded test executions exercised. */\nexport interface TestRunArtifact {\n  /** Stable artifact identifier. */\n  readonly id: string;\n  /** Lowercase SHA-256 fingerprint of the artifact bytes. */\n  readonly fingerprint: string;\n  /** Exact artifact size in bytes; must be at least one byte. */\n  readonly sizeBytes: number;\n}\n\n/** Authenticated runner that executed the recorded test run. */\nexport interface TestRunRunner {\n  /** Stable runner identity. */\n  readonly identity: string;\n  /** Retained evidence for the runner's authentication. */\n  readonly authenticationEvidence: TestRunRetainedEvidence;\n  /** Isolation level the runner guaranteed for this invocation. */\n  readonly isolation: TestRunIsolation;\n  /** Lowercase SHA-256 fingerprint of the exact invocation. */\n  readonly invocationFingerprint: string;\n  /** Retained evidence describing the execution environment. */\n  readonly environmentEvidence: TestRunRetainedEvidence;\n  /** Lowercase SHA-256 fingerprint of the execution environment. */\n  readonly environmentFingerprint: string;\n}\n\n/**\n * Complete candidate-selected target and suite coverage for the run.\n *\n * Recorded executions must cover exactly these identifiers; anything less is\n * an undeclared omission and anything more is an undeclared execution.\n */\nexport interface TestRunSelection<\n  TargetId extends string = string,\n  SuiteId extends string = string,\n> {\n  /** Selected target identifiers, unique within the selection. */\n  readonly targetIds: readonly TargetId[];\n  /** Selected suite identifiers, unique within the selection. */\n  readonly suiteIds: readonly SuiteId[];\n}\n\n/** One executed target of the release candidate. */\nexport interface TestRunTargetExecution<Id extends string = string> {\n  /** Stable target identifier from the candidate selection. */\n  readonly id: Id;\n  /** Kind of target that was exercised. */\n  readonly kind: TestRunTargetKind;\n  /** Environment identifier the target executed in. */\n  readonly environment: string;\n}\n\n/** One executed suite shard with its exact recorded results. */\nexport interface TestRunSuiteExecution<\n  Id extends string = string,\n  TargetId extends string = string,\n> {\n  /** Stable suite identifier from the candidate selection. */\n  readonly id: Id;\n  /** Target this shard executed against. */\n  readonly targetId: TargetId;\n  /** Semantic suite kind. */\n  readonly kind: TestRunSuiteKind;\n  /** One-based shard index within `shardCount`. */\n  readonly shardIndex: number;\n  /** Total number of shards the suite was split into. */\n  readonly shardCount: number;\n  /** Final shard outcome. */\n  readonly outcome: TestRunSuiteOutcome;\n  /** Number of passed tests. */\n  readonly passed: number;\n  /** Number of failed tests. */\n  readonly failed: number;\n  /** Number of skipped tests. */\n  readonly skipped: number;\n  /** Number of retried tests; retries must always be declared. */\n  readonly retries: number;\n  /** Wall-clock shard duration in milliseconds. */\n  readonly durationMs: number;\n  /** Lowercase SHA-256 fingerprint of the exact shard invocation. */\n  readonly invocationFingerprint: string;\n  /** Retained machine-readable report evidence. */\n  readonly report: TestRunRetainedEvidence;\n  /** Retained execution log evidence. */\n  readonly log: TestRunRetainedEvidence;\n}\n\n/** Independent verification summary over every recorded execution. */\nexport interface TestRunVerification {\n  /** Stable identity of the independent verifier. */\n  readonly verifier: string;\n  /** Millisecond-precision UTC time the verification completed. */\n  readonly completedAt: string;\n  /** Final verification outcome. */\n  readonly outcome: TestRunVerificationOutcome;\n  /** Exact number of recorded target executions. */\n  readonly targetCount: number;\n  /** Exact number of recorded suite executions. */\n  readonly suiteCount: number;\n  /** Total passed tests across every recorded suite execution. */\n  readonly passed: number;\n  /** Total failed tests across every recorded suite execution. */\n  readonly failed: number;\n  /** Total skipped tests across every recorded suite execution. */\n  readonly skipped: number;\n  /** Total retried tests across every recorded suite execution. */\n  readonly retries: number;\n  /** Retained evidence produced by the verification pass. */\n  readonly evidence: TestRunRetainedEvidence;\n}\n\n/**\n * Complete, versioned test-run evidence for one release candidate.\n *\n * The record binds application, environment, application contract, source\n * revision, release, and exact artifact fingerprint to bounded target and\n * suite executions, so a `tests` deployment check can only be satisfied by\n * retained, immutable facts instead of a mutable label or path.\n */\nexport interface TestRunEvidence {\n  /** Serialized format marker; always {@link TEST_RUN_EVIDENCE_FORMAT}. */\n  readonly format: typeof TEST_RUN_EVIDENCE_FORMAT;\n  /**\n   * Serialized format version.\n   *\n   * @default 1\n   */\n  readonly formatVersion?: typeof TEST_RUN_EVIDENCE_FORMAT_VERSION;\n  /** Stable record identifier. */\n  readonly id: string;\n  /** Application the run verified. */\n  readonly application: string;\n  /** Deployment environment the run verified the candidate for. */\n  readonly environment: string;\n  /** Lowercase SHA-256 fingerprint of the application contract. */\n  readonly contractFingerprint: string;\n  /** Exact source revision the candidate was built from. */\n  readonly sourceRevision: string;\n  /** Release the candidate belongs to. */\n  readonly release: string;\n  /** Exact artifact the recorded executions exercised. */\n  readonly artifact: TestRunArtifact;\n  /** Millisecond-precision UTC time the run started. */\n  readonly startedAt: string;\n  /** Millisecond-precision UTC time the run completed. */\n  readonly completedAt: string;\n  /** Millisecond-precision UTC time the record expires. */\n  readonly validUntil: string;\n  /** Authenticated runner that executed the run. */\n  readonly runner: TestRunRunner;\n  /** Complete candidate-selected target and suite coverage. */\n  readonly selection: TestRunSelection;\n  /** Recorded target executions. */\n  readonly targets: readonly TestRunTargetExecution[];\n  /** Recorded suite executions. */\n  readonly suites: readonly TestRunSuiteExecution[];\n  /** Independent verification summary. */\n  readonly verification: TestRunVerification;\n}\n\n/** Target identifiers recorded by one test-run evidence record. */\nexport type TestRunTargetId<Evidence extends TestRunEvidence> = Evidence[\"targets\"][number][\"id\"];\n\n/** Suite identifiers recorded by one test-run evidence record. */\nexport type TestRunSuiteId<Evidence extends TestRunEvidence> = Evidence[\"suites\"][number][\"id\"];\n"],"mappings":";;AACA,MAAa,2BAA2B;;AAGxC,MAAa,mCAAmC"}

package/dist/test-run-model-DkllmEsY.d.mts

@@ -0,0 +1,181 @@
+//#region src/test-run-model.d.ts
+/** Serialized `format` marker for test-run evidence records. */
+declare const TEST_RUN_EVIDENCE_FORMAT: "vize.test-run.evidence";
+/** Current serialized test-run evidence format version. */
+declare const TEST_RUN_EVIDENCE_FORMAT_VERSION: 1;
+/** Isolation level of the runner that executed the tests. */
+type TestRunIsolation = "dedicated" | "ephemeral";
+/** Kind of user-visible target a test execution ran against. */
+type TestRunTargetKind = "web" | "native" | "desktop" | "terminal" | "server";
+/** Semantic kind of one executed suite. */
+type TestRunSuiteKind = "unit" | "integration" | "contract" | "end-to-end" | "accessibility" | "visual" | "performance" | "resilience" | "installation" | "upgrade" | "migration";
+/** Final result of one executed suite shard. */
+type TestRunSuiteOutcome = "passed" | "failed" | "cancelled";
+/** Final result of the independent verification pass. */
+type TestRunVerificationOutcome = "accepted" | "rejected";
+/**
+ * Immutable, content-addressed reference to retained evidence.
+ *
+ * The reference names the retained content by SHA-256 so a green label can
+ * never drift away from the bytes that were verified.
+ */
+interface TestRunRetainedEvidence {
+  /** Content-addressed retrieval reference in `sha256:<64 hex>` form. */
+  readonly reference: string;
+  /** Lowercase SHA-256 fingerprint of the retained content. */
+  readonly fingerprint: string;
+}
+/** Exact release artifact that the recorded test executions exercised. */
+interface TestRunArtifact {
+  /** Stable artifact identifier. */
+  readonly id: string;
+  /** Lowercase SHA-256 fingerprint of the artifact bytes. */
+  readonly fingerprint: string;
+  /** Exact artifact size in bytes; must be at least one byte. */
+  readonly sizeBytes: number;
+}
+/** Authenticated runner that executed the recorded test run. */
+interface TestRunRunner {
+  /** Stable runner identity. */
+  readonly identity: string;
+  /** Retained evidence for the runner's authentication. */
+  readonly authenticationEvidence: TestRunRetainedEvidence;
+  /** Isolation level the runner guaranteed for this invocation. */
+  readonly isolation: TestRunIsolation;
+  /** Lowercase SHA-256 fingerprint of the exact invocation. */
+  readonly invocationFingerprint: string;
+  /** Retained evidence describing the execution environment. */
+  readonly environmentEvidence: TestRunRetainedEvidence;
+  /** Lowercase SHA-256 fingerprint of the execution environment. */
+  readonly environmentFingerprint: string;
+}
+/**
+ * Complete candidate-selected target and suite coverage for the run.
+ *
+ * Recorded executions must cover exactly these identifiers; anything less is
+ * an undeclared omission and anything more is an undeclared execution.
+ */
+interface TestRunSelection<TargetId extends string = string, SuiteId extends string = string> {
+  /** Selected target identifiers, unique within the selection. */
+  readonly targetIds: readonly TargetId[];
+  /** Selected suite identifiers, unique within the selection. */
+  readonly suiteIds: readonly SuiteId[];
+}
+/** One executed target of the release candidate. */
+interface TestRunTargetExecution<Id extends string = string> {
+  /** Stable target identifier from the candidate selection. */
+  readonly id: Id;
+  /** Kind of target that was exercised. */
+  readonly kind: TestRunTargetKind;
+  /** Environment identifier the target executed in. */
+  readonly environment: string;
+}
+/** One executed suite shard with its exact recorded results. */
+interface TestRunSuiteExecution<Id extends string = string, TargetId extends string = string> {
+  /** Stable suite identifier from the candidate selection. */
+  readonly id: Id;
+  /** Target this shard executed against. */
+  readonly targetId: TargetId;
+  /** Semantic suite kind. */
+  readonly kind: TestRunSuiteKind;
+  /** One-based shard index within `shardCount`. */
+  readonly shardIndex: number;
+  /** Total number of shards the suite was split into. */
+  readonly shardCount: number;
+  /** Final shard outcome. */
+  readonly outcome: TestRunSuiteOutcome;
+  /** Number of passed tests. */
+  readonly passed: number;
+  /** Number of failed tests. */
+  readonly failed: number;
+  /** Number of skipped tests. */
+  readonly skipped: number;
+  /** Number of retried tests; retries must always be declared. */
+  readonly retries: number;
+  /** Wall-clock shard duration in milliseconds. */
+  readonly durationMs: number;
+  /** Lowercase SHA-256 fingerprint of the exact shard invocation. */
+  readonly invocationFingerprint: string;
+  /** Retained machine-readable report evidence. */
+  readonly report: TestRunRetainedEvidence;
+  /** Retained execution log evidence. */
+  readonly log: TestRunRetainedEvidence;
+}
+/** Independent verification summary over every recorded execution. */
+interface TestRunVerification {
+  /** Stable identity of the independent verifier. */
+  readonly verifier: string;
+  /** Millisecond-precision UTC time the verification completed. */
+  readonly completedAt: string;
+  /** Final verification outcome. */
+  readonly outcome: TestRunVerificationOutcome;
+  /** Exact number of recorded target executions. */
+  readonly targetCount: number;
+  /** Exact number of recorded suite executions. */
+  readonly suiteCount: number;
+  /** Total passed tests across every recorded suite execution. */
+  readonly passed: number;
+  /** Total failed tests across every recorded suite execution. */
+  readonly failed: number;
+  /** Total skipped tests across every recorded suite execution. */
+  readonly skipped: number;
+  /** Total retried tests across every recorded suite execution. */
+  readonly retries: number;
+  /** Retained evidence produced by the verification pass. */
+  readonly evidence: TestRunRetainedEvidence;
+}
+/**
+ * Complete, versioned test-run evidence for one release candidate.
+ *
+ * The record binds application, environment, application contract, source
+ * revision, release, and exact artifact fingerprint to bounded target and
+ * suite executions, so a `tests` deployment check can only be satisfied by
+ * retained, immutable facts instead of a mutable label or path.
+ */
+interface TestRunEvidence {
+  /** Serialized format marker; always {@link TEST_RUN_EVIDENCE_FORMAT}. */
+  readonly format: typeof TEST_RUN_EVIDENCE_FORMAT;
+  /**
+   * Serialized format version.
+   *
+   * @default 1
+   */
+  readonly formatVersion?: typeof TEST_RUN_EVIDENCE_FORMAT_VERSION;
+  /** Stable record identifier. */
+  readonly id: string;
+  /** Application the run verified. */
+  readonly application: string;
+  /** Deployment environment the run verified the candidate for. */
+  readonly environment: string;
+  /** Lowercase SHA-256 fingerprint of the application contract. */
+  readonly contractFingerprint: string;
+  /** Exact source revision the candidate was built from. */
+  readonly sourceRevision: string;
+  /** Release the candidate belongs to. */
+  readonly release: string;
+  /** Exact artifact the recorded executions exercised. */
+  readonly artifact: TestRunArtifact;
+  /** Millisecond-precision UTC time the run started. */
+  readonly startedAt: string;
+  /** Millisecond-precision UTC time the run completed. */
+  readonly completedAt: string;
+  /** Millisecond-precision UTC time the record expires. */
+  readonly validUntil: string;
+  /** Authenticated runner that executed the run. */
+  readonly runner: TestRunRunner;
+  /** Complete candidate-selected target and suite coverage. */
+  readonly selection: TestRunSelection;
+  /** Recorded target executions. */
+  readonly targets: readonly TestRunTargetExecution[];
+  /** Recorded suite executions. */
+  readonly suites: readonly TestRunSuiteExecution[];
+  /** Independent verification summary. */
+  readonly verification: TestRunVerification;
+}
+/** Target identifiers recorded by one test-run evidence record. */
+type TestRunTargetId<Evidence extends TestRunEvidence> = Evidence["targets"][number]["id"];
+/** Suite identifiers recorded by one test-run evidence record. */
+type TestRunSuiteId<Evidence extends TestRunEvidence> = Evidence["suites"][number]["id"];
+//#endregion
+export { TestRunVerificationOutcome as _, TestRunIsolation as a, TestRunSelection as c, TestRunSuiteKind as d, TestRunSuiteOutcome as f, TestRunVerification as g, TestRunTargetKind as h, TestRunEvidence as i, TestRunSuiteExecution as l, TestRunTargetId as m, TEST_RUN_EVIDENCE_FORMAT_VERSION as n, TestRunRetainedEvidence as o, TestRunTargetExecution as p, TestRunArtifact as r, TestRunRunner as s, TEST_RUN_EVIDENCE_FORMAT as t, TestRunSuiteId as u };
+//# sourceMappingURL=test-run-model-DkllmEsY.d.mts.map

package/dist/test-run-model-DkllmEsY.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-run-model-DkllmEsY.d.mts","names":[],"sources":["../src/test-run-model.ts"],"mappings":";;cACa,wBAAA;;cAGA,gCAAA;;KAGD,gBAAA;AAHZ;AAAA,KAMY,iBAAA;;KAGA,gBAAA;;KAcA,mBAAA;;KAGA,0BAAA;;;AApBZ;;;;UA4BiB,uBAAA;EAzBL;EAAA,SA2BD,SAAA;;WAEA,WAAA;AAAA;AAfX;AAAA,UAmBiB,eAAA;;WAEN,EAAA;EArBoB;EAAA,SAuBpB,WAAA;EApB2B;EAAA,SAsB3B,SAAA;AAAA;;UAIM,aAAA;EAlBuB;EAAA,SAoB7B,QAAA;EAlBA;EAAA,SAoBA,sBAAA,EAAwB,uBAAA;EAdlB;EAAA,SAgBN,SAAA,EAAW,gBAAA;;WAEX,qBAAA;EAhBA;EAAA,SAkBA,mBAAA,EAAqB,uBAAA;EAdrB;EAAA,SAgBA,sBAAA;AAAA;AAZX;;;;;;AAAA,UAqBiB,gBAAA;EAXsC;EAAA,SAgB5C,SAAA,WAAoB,QAAA;EAtBpB;EAAA,SAwBA,QAAA,WAAmB,OAAA;AAAA;;UAIb,sBAAA;EAtBN;EAAA,SAwBA,EAAA,EAAI,EAAA;EAtBJ;EAAA,SAwBA,IAAA,EAAM,iBAAA;EAxBgB;EAAA,SA0BtB,WAAA;AAAA;;UAIM,qBAAA;EApBf;EAAA,SAyBS,EAAA,EAAI,EAAA;EArBJ;EAAA,SAuBA,QAAA,EAAU,QAAA;EArBV;EAAA,SAuBA,IAAA,EAAM,gBAAA;EAvBoB;EAAA,SAyB1B,UAAA;EArBM;EAAA,SAuBN,UAAA;EAvB4B;EAAA,SAyB5B,OAAA,EAAS,mBAAA;EAzBoB;EAAA,SA2B7B,MAAA;EAzBI;EAAA,SA2BJ,MAAA;EAzBM;EAAA,SA2BN,OAAA;EAzBW;EAAA,SA2BX,OAAA;EAvBM;EAAA,SAyBN,UAAA;EAzB2B;EAAA,SA2B3B,qBAAA;EApBU;EAAA,SAsBV,MAAA,EAAQ,uBAAA;EAdC;EAAA,SAgBT,GAAA,EAAK,uBAAA;AAAA;;UAIC,mBAAA;EAlCf;EAAA,SAoCS,QAAA;EAhCA;EAAA,SAkCA,WAAA;EAhCA;EAAA,SAkCA,OAAA,EAAS,0BAAA;EAhCT;EAAA,SAkCA,WAAA;EAhCA;EAAA,SAkCA,UAAA;EA9BA;EAAA,SAgCA,MAAA;EA9BA;EAAA,SAgCA,MAAA;EA5BA;EAAA,SA8BA,OAAA;EA1BA;EAAA,SA4BA,OAAA;EAxBA;EAAA,SA0BA,QAAA,EAAU,uBAAA;AAAA;;;;AApBrB;;;;;UA+BiB,eAAA;EAzBN;EAAA,SA2BA,MAAA,SAAe,wBAAA;EAzBf;;;;;EAAA,SA+BA,aAAA,UAAuB,gCAAA;EAnBvB;EAAA,SAqBA,EAAA;EArBiC;EAAA,SAuBjC,WAAA;EAZM;EAAA,SAcN,WAAA;;WAEA,mBAAA;EARuB;EAAA,SAUvB,cAAA;EAYQ;EAAA,SAVR,OAAA;EAckB;EAAA,SAZlB,QAAA,EAAU,eAAA;EAgBI;EAAA,SAdd,SAAA;EAciC;EAAA,SAZjC,WAAA;EAxBe;EAAA,SA0Bf,UAAA;EApBuB;EAAA,SAsBvB,MAAA,EAAQ,aAAA;EAlBR;EAAA,SAoBA,SAAA,EAAW,gBAAA;EAhBX;EAAA,SAkBA,OAAA,WAAkB,sBAAA;EAdlB;EAAA,SAgBA,MAAA,WAAiB,qBAAA;EAdP;EAAA,SAgBV,YAAA,EAAc,mBAAA;AAAA;;KAIb,eAAA,kBAAiC,eAAA,IAAmB,QAAA;;KAGpD,cAAA,kBAAgC,eAAA,IAAmB,QAAA"}

package/dist/test-run-validate-XF0vyoWI.mjs

@@ -0,0 +1,229 @@
+import "./test-run-model-B2INFVlw.mjs";
+const IDENTIFIER = /^[a-z0-9][a-z0-9._-]*$/;
+const DIGEST = /^[a-f0-9]{64}$/;
+const SOURCE_REVISION = /^[a-f0-9]{40,128}$/;
+const TIMESTAMP = /^([0-9]{4})-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$/;
+/** Builds the stable diagnostic path for a named collection member. */
+function evidencePath(collection, id) {
+	return `${collection}.${id}`;
+}
+/** Creates one error diagnostic. */
+function error(code, path, message) {
+	return {
+		code,
+		severity: "error",
+		path,
+		message
+	};
+}
+/** Validates the shared identifier grammar and the schema length bound. */
+function checkIdentifier(id, path, diagnostics) {
+	if (!IDENTIFIER.test(id)) diagnostics.push(error("VIZE_MARQUETTE_103", path, "identifier must use lowercase ASCII letters, digits, dash, underscore, or dot"));
+	if (id.length === 0 || id.length > 128) diagnostics.push(error("VIZE_MARQUETTE_103", path, "identifier must be between 1 and 128 characters"));
+}
+/** Validates a lowercase 64-character SHA-256 fingerprint. */
+function checkDigest(value, path, diagnostics) {
+	if (!DIGEST.test(value)) diagnostics.push(error("VIZE_MARQUETTE_104", path, "fingerprint must be 64 lowercase hexadecimal characters"));
+}
+/** Validates an exact source revision digest. */
+function checkSourceRevision(value, diagnostics) {
+	if (!SOURCE_REVISION.test(value)) diagnostics.push(error("VIZE_MARQUETTE_105", "sourceRevision", "source revision must be 40 to 128 lowercase hexadecimal characters"));
+}
+/** Returns whether `value` is a millisecond-precision UTC calendar instant. */
+function isStrictTimestamp(value) {
+	const match = TIMESTAMP.exec(value);
+	if (match === null) return false;
+	const year = Number(match[1]);
+	const month = Number(match[2]);
+	return Number(match[3]) <= (month === 2 ? year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0) ? 29 : 28 : month === 4 || month === 6 || month === 9 || month === 11 ? 30 : 31);
+}
+/** Validates a millisecond-precision UTC timestamp. */
+function checkTimestamp(value, path, diagnostics) {
+	if (!isStrictTimestamp(value)) diagnostics.push(error("VIZE_MARQUETTE_107", path, "timestamp must be a millisecond-precision UTC instant like 2026-01-01T00:00:00.000Z"));
+}
+/** Rejects integers that lose precision in a consuming language. */
+function checkSafeInteger(value, path, diagnostics) {
+	if (value > 9007199254740991) diagnostics.push(error("VIZE_MARQUETTE_111", path, "value must not exceed the largest exactly-representable integer"));
+}
+/**
+* Validates an immutable retained-evidence binding.
+*
+* The retrieval reference must be content-addressed and name exactly the
+* fingerprinted bytes; anything else would let retained evidence mutate
+* behind a stable-looking record.
+*/
+function checkRetainedEvidence(retained, path, diagnostics) {
+	checkDigest(retained.fingerprint, evidencePath(path, "fingerprint"), diagnostics);
+	const suffix = retained.reference.startsWith("sha256:") ? retained.reference.slice(7) : void 0;
+	if (suffix === void 0 || !DIGEST.test(suffix)) diagnostics.push(error("VIZE_MARQUETTE_108", evidencePath(path, "reference"), "evidence reference must be sha256: followed by 64 lowercase hexadecimal characters"));
+	else if (suffix !== retained.fingerprint) diagnostics.push(error("VIZE_MARQUETTE_109", evidencePath(path, "reference"), "content-addressed reference must name the fingerprinted content"));
+}
+//#endregion
+//#region src/test-run-validate-executions.ts
+/** Maximum recorded target executions and selected target identifiers. */
+const TEST_RUN_MAX_TARGETS = 32;
+/** Maximum recorded suite executions and selected suite identifiers. */
+const TEST_RUN_MAX_SUITES = 512;
+/** Maximum shard index and shard count for one suite execution. */
+const TEST_RUN_MAX_SHARDS = 1024;
+/** Validates recorded target executions against the candidate selection. */
+function validateTargets(evidence, diagnostics) {
+	if (evidence.targets.length === 0 || evidence.targets.length > 32) diagnostics.push(error("VIZE_MARQUETTE_131", "targets", "record must include between 1 and 32 target executions"));
+	const seen = /* @__PURE__ */ new Set();
+	const selected = new Set(evidence.selection.targetIds);
+	for (const target of evidence.targets) {
+		const path = evidencePath("targets", target.id);
+		checkIdentifier(target.id, path, diagnostics);
+		checkIdentifier(target.environment, evidencePath(path, "environment"), diagnostics);
+		if (seen.has(target.id)) diagnostics.push(error("VIZE_MARQUETTE_117", path, "target execution is recorded more than once"));
+		seen.add(target.id);
+		if (!selected.has(target.id)) diagnostics.push(error("VIZE_MARQUETTE_118", path, "target execution was not selected for this candidate"));
+	}
+	for (const id of evidence.selection.targetIds) if (!seen.has(id)) diagnostics.push(error("VIZE_MARQUETTE_119", evidencePath("selection.targetIds", id), "selected target has no recorded execution"));
+}
+/** Validates recorded suite executions, shards, and their consistency. */
+function validateSuites(evidence, diagnostics) {
+	if (evidence.suites.length === 0 || evidence.suites.length > 512) diagnostics.push(error("VIZE_MARQUETTE_131", "suites", "record must include between 1 and 512 suite executions"));
+	const shards = /* @__PURE__ */ new Map();
+	const selected = new Set(evidence.selection.suiteIds);
+	const recordedTargets = new Set(evidence.targets.map((target) => target.id));
+	for (const suite of evidence.suites) {
+		const path = evidencePath("suites", suite.id);
+		let group = shards.get(suite.id);
+		if (group === void 0) {
+			group = {
+				shardCount: suite.shardCount,
+				kind: suite.kind,
+				targetId: suite.targetId,
+				indexes: /* @__PURE__ */ new Set(),
+				kindsDisagree: false,
+				targetsDisagree: false,
+				countsDisagree: false
+			};
+			shards.set(suite.id, group);
+			checkIdentifier(suite.id, path, diagnostics);
+			if (!selected.has(suite.id)) diagnostics.push(error("VIZE_MARQUETTE_121", path, "suite execution was not selected for this candidate"));
+			if (!recordedTargets.has(suite.targetId)) diagnostics.push(error("VIZE_MARQUETTE_123", evidencePath(path, "targetId"), "suite target has no recorded target execution"));
+		}
+		group.kindsDisagree ||= group.kind !== suite.kind;
+		group.targetsDisagree ||= group.targetId !== suite.targetId;
+		group.countsDisagree ||= group.shardCount !== suite.shardCount;
+		if (group.indexes.has(suite.shardIndex)) diagnostics.push(error("VIZE_MARQUETTE_120", path, "suite shard is recorded more than once"));
+		group.indexes.add(suite.shardIndex);
+		if (suite.shardCount === 0 || suite.shardCount > 1024 || suite.shardIndex === 0 || suite.shardIndex > suite.shardCount) diagnostics.push(error("VIZE_MARQUETTE_124", evidencePath(path, "shardIndex"), "shard index must fall within a shard count between 1 and 1024"));
+		checkSafeInteger(suite.durationMs, evidencePath(path, "durationMs"), diagnostics);
+		checkDigest(suite.invocationFingerprint, evidencePath(path, "invocationFingerprint"), diagnostics);
+		checkRetainedEvidence(suite.report, evidencePath(path, "report"), diagnostics);
+		checkRetainedEvidence(suite.log, evidencePath(path, "log"), diagnostics);
+		const executed = suite.passed + suite.failed + suite.skipped;
+		if (!(suite.outcome === "passed" ? suite.failed === 0 && executed > 0 : suite.outcome === "failed" ? suite.failed > 0 : true)) diagnostics.push(error("VIZE_MARQUETTE_130", evidencePath(path, "outcome"), "suite outcome does not match its recorded counts"));
+	}
+	for (const id of evidence.selection.suiteIds) if (!shards.has(id)) diagnostics.push(error("VIZE_MARQUETTE_122", evidencePath("selection.suiteIds", id), "selected suite has no recorded execution"));
+	for (const [id, group] of shards) {
+		const path = evidencePath("suites", id);
+		if (group.kindsDisagree || group.targetsDisagree || group.countsDisagree) diagnostics.push(error("VIZE_MARQUETTE_126", path, "every shard of one suite must share its kind, target, and shard count"));
+		else if (group.shardCount !== 0 && group.shardCount <= 1024 && group.indexes.size !== group.shardCount) diagnostics.push(error("VIZE_MARQUETTE_125", path, `suite must record every shard from 1 to ${group.shardCount}`));
+	}
+}
+/** Validates the independent verification summary. */
+function validateVerification(evidence, diagnostics) {
+	const verification = evidence.verification;
+	checkIdentifier(verification.verifier, "verification.verifier", diagnostics);
+	checkTimestamp(verification.completedAt, "verification.completedAt", diagnostics);
+	checkRetainedEvidence(verification.evidence, "verification.evidence", diagnostics);
+	if (verification.completedAt < evidence.completedAt) diagnostics.push(error("VIZE_MARQUETTE_114", "verification.completedAt", "verification must complete after the run completes"));
+	if (verification.targetCount !== evidence.targets.length) diagnostics.push(error("VIZE_MARQUETTE_127", "verification.targetCount", "verified target count must equal the recorded target executions"));
+	if (verification.suiteCount !== evidence.suites.length) diagnostics.push(error("VIZE_MARQUETTE_127", "verification.suiteCount", "verified suite count must equal the recorded suite executions"));
+	const totals = {
+		passed: 0,
+		failed: 0,
+		skipped: 0,
+		retries: 0
+	};
+	for (const suite of evidence.suites) {
+		totals.passed += suite.passed;
+		totals.failed += suite.failed;
+		totals.skipped += suite.skipped;
+		totals.retries += suite.retries;
+	}
+	const recorded = [
+		[
+			totals.passed,
+			verification.passed,
+			"verification.passed",
+			"passed"
+		],
+		[
+			totals.failed,
+			verification.failed,
+			"verification.failed",
+			"failed"
+		],
+		[
+			totals.skipped,
+			verification.skipped,
+			"verification.skipped",
+			"skipped"
+		],
+		[
+			totals.retries,
+			verification.retries,
+			"verification.retries",
+			"retried"
+		]
+	];
+	for (const [total, value, path, name] of recorded) if (total !== value) diagnostics.push(error("VIZE_MARQUETTE_128", path, `verified ${name} total must equal the sum over suite executions`));
+	if (verification.outcome === "accepted") {
+		if (!evidence.suites.every((suite) => suite.outcome === "passed" && suite.failed === 0) || verification.failed > 0) diagnostics.push(error("VIZE_MARQUETTE_129", "verification.outcome", "verification cannot accept a run with failed or cancelled executions"));
+	}
+}
+//#endregion
+//#region src/test-run-validate.ts
+/**
+* Validates a complete test-run evidence record.
+*
+* Diagnostics are deterministic and sorted by path, code, and message so the
+* same record produces identical CLI, promotion, test, and CI output in
+* every consuming language. A record with any error diagnostic must never
+* satisfy a deployment check.
+*/
+function validateTestRunEvidence(evidence) {
+	const diagnostics = [];
+	if (evidence.format !== "vize.test-run.evidence") diagnostics.push(error("VIZE_MARQUETTE_101", "format", "unsupported test-run evidence format marker"));
+	if ((evidence.formatVersion ?? 1) !== 1) diagnostics.push(error("VIZE_MARQUETTE_102", "formatVersion", "unsupported test-run evidence format version"));
+	checkIdentifier(evidence.id, "id", diagnostics);
+	checkIdentifier(evidence.application, "application", diagnostics);
+	checkIdentifier(evidence.environment, "environment", diagnostics);
+	checkDigest(evidence.contractFingerprint, "contractFingerprint", diagnostics);
+	checkSourceRevision(evidence.sourceRevision, diagnostics);
+	if (evidence.release.length === 0 || evidence.release.length > 256) diagnostics.push(error("VIZE_MARQUETTE_106", "release", "release must be between 1 and 256 characters"));
+	checkIdentifier(evidence.artifact.id, "artifact.id", diagnostics);
+	checkDigest(evidence.artifact.fingerprint, "artifact.fingerprint", diagnostics);
+	if (evidence.artifact.sizeBytes === 0) diagnostics.push(error("VIZE_MARQUETTE_110", "artifact.sizeBytes", "artifact size must be at least one byte"));
+	checkSafeInteger(evidence.artifact.sizeBytes, "artifact.sizeBytes", diagnostics);
+	checkTimestamp(evidence.startedAt, "startedAt", diagnostics);
+	checkTimestamp(evidence.completedAt, "completedAt", diagnostics);
+	checkTimestamp(evidence.validUntil, "validUntil", diagnostics);
+	if (evidence.completedAt < evidence.startedAt) diagnostics.push(error("VIZE_MARQUETTE_112", "completedAt", "run completion must not precede its start"));
+	if (evidence.validUntil <= evidence.completedAt) diagnostics.push(error("VIZE_MARQUETTE_113", "validUntil", "record expiry must come after run completion"));
+	const runner = evidence.runner;
+	checkIdentifier(runner.identity, "runner.identity", diagnostics);
+	checkRetainedEvidence(runner.authenticationEvidence, "runner.authenticationEvidence", diagnostics);
+	checkDigest(runner.invocationFingerprint, "runner.invocationFingerprint", diagnostics);
+	checkRetainedEvidence(runner.environmentEvidence, "runner.environmentEvidence", diagnostics);
+	checkDigest(runner.environmentFingerprint, "runner.environmentFingerprint", diagnostics);
+	const selection = evidence.selection;
+	if (selection.targetIds.length === 0 || selection.targetIds.length > 32) diagnostics.push(error("VIZE_MARQUETTE_115", "selection.targetIds", "selection must include between 1 and 32 targets"));
+	if (selection.suiteIds.length === 0 || selection.suiteIds.length > 512) diagnostics.push(error("VIZE_MARQUETTE_115", "selection.suiteIds", "selection must include between 1 and 512 suites"));
+	for (const id of selection.targetIds) checkIdentifier(id, evidencePath("selection.targetIds", id), diagnostics);
+	for (const id of selection.suiteIds) checkIdentifier(id, evidencePath("selection.suiteIds", id), diagnostics);
+	validateTargets(evidence, diagnostics);
+	validateSuites(evidence, diagnostics);
+	validateVerification(evidence, diagnostics);
+	diagnostics.sort((left, right) => left.path !== right.path ? left.path < right.path ? -1 : 1 : left.code !== right.code ? left.code < right.code ? -1 : 1 : left.message < right.message ? -1 : left.message > right.message ? 1 : 0);
+	return diagnostics;
+}
+//#endregion
+export { error as a, TEST_RUN_MAX_TARGETS as i, TEST_RUN_MAX_SHARDS as n, isStrictTimestamp as o, TEST_RUN_MAX_SUITES as r, validateTestRunEvidence as t };
+
+//# sourceMappingURL=test-run-validate-XF0vyoWI.mjs.map