@vizejs/marquette 0.302.0 → 0.303.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ubugeeei
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/test-run-admission.d.mts

@@ -1,6 +1,6 @@
 import { i as TestRunEvidence } from "./test-run-model-DkllmEsY.mjs";
 import { MarquetteDiagnostic } from "./validate.mjs";
-import { TEST_RUN_ADMISSION_PREFIX, parseTestRunAdmissionId } from "./test-run-canonical.mjs";
+import { r as parseTestRunAdmissionId, t as TEST_RUN_ADMISSION_PREFIX } from "./test-run-canonical-CB-KzZxk.mjs";
 
 //#region src/test-run-admission.d.ts
 /**
@@ -43,6 +43,62 @@ interface TestRunCandidate {
  * hand the parsed record here.
  */
 declare function admitTestRun(evidence: TestRunEvidence, candidate: TestRunCandidate, admissionId: string, now: string): Promise<MarquetteDiagnostic[]>;
+/**
+ * Every denial code, in the stable lexicographic decision order.
+ *
+ * The vocabulary is shared by every backend family: a JavaScript, Rust, Go,
+ * or JVM host must derive the same codes from the same diagnostics, as
+ * pinned by the shared `tests/fixtures/test-run-evidence` decision fixtures.
+ * Codes are append-only: they are never renamed, renumbered, reused, or
+ * removed, and a new rejection cause always ships with a new code.
+ */
+declare const TEST_RUN_DENIAL_CODES: readonly ["admission-id-malformed", "admission-id-mismatch", "admission-time-malformed", "candidate-application-mismatch", "candidate-artifact-fingerprint-mismatch", "candidate-contract-fingerprint-mismatch", "candidate-environment-mismatch", "candidate-release-mismatch", "candidate-source-revision-mismatch", "check-candidate-mismatch", "check-invalid", "check-observer-not-independent", "record-expired", "record-invalid", "skipped-tests-recorded", "transition-chain-broken", "transition-invalid", "transition-replayed", "transition-state-mismatch", "verification-not-accepted"];
+/** Stable machine-readable cause class of one admission denial. */
+type TestRunDenialCode = (typeof TEST_RUN_DENIAL_CODES)[number];
+/**
+ * Structured allow-or-deny admission decision for one exact candidate.
+ *
+ * The decision carries the machine-readable cause classes next to the exact
+ * diagnostics, so a deployment gate in any language can act on one bounded
+ * vocabulary while operators keep the full explanation. Serialization
+ * follows the shared `test-run-admission` schema; decisions are outputs, so
+ * a gate must never trust a decision it did not compute itself.
+ */
+interface TestRunAdmissionDecision {
+  /** Whether the record admits the candidate; true only with no diagnostics. */
+  readonly allowed: boolean;
+  /** Deduplicated denial causes sorted lexicographically; empty when allowed. */
+  readonly denialCodes: readonly TestRunDenialCode[];
+  /** Complete diagnostics in the stable path, code, message order. */
+  readonly diagnostics: readonly MarquetteDiagnostic[];
+}
+/**
+ * Returns the stable denial code one admission diagnostic maps to.
+ *
+ * The mapping is total and identical in every host family: admission codes
+ * `VIZE_MARQUETTE_141` through `VIZE_MARQUETTE_148` map to their exact
+ * cause, `VIZE_MARQUETTE_144` distinguishes the mismatched candidate binding
+ * by its diagnostic path, `VIZE_MARQUETTE_149` through `VIZE_MARQUETTE_151`
+ * map to their tests-check cause, `VIZE_MARQUETTE_156` through
+ * `VIZE_MARQUETTE_159` map to their transition cause, every other
+ * diagnostic at a `check.` path is a `check-invalid` tests-check validation
+ * failure, every other diagnostic at a `transition.` path is a
+ * `transition-invalid` transition validation failure, and every remaining
+ * diagnostic is a `record-invalid` record-validation failure.
+ */
+declare function testRunDenialCode(diagnostic: MarquetteDiagnostic): TestRunDenialCode;
+/**
+ * Decides one candidate and returns the structured admission decision.
+ *
+ * The decision wraps {@link admitTestRun}: `diagnostics` is exactly its
+ * result, `denialCodes` maps every diagnostic through
+ * {@link testRunDenialCode} and then deduplicates and sorts the codes
+ * lexicographically, and `allowed` is true only when both are empty. Codes,
+ * ordering, and diagnostics are identical to the native implementation, as
+ * pinned by the shared decision fixtures. Inputs carry the same obligations
+ * as {@link admitTestRun}.
+ */
+declare function decideTestRunAdmission(evidence: TestRunEvidence, candidate: TestRunCandidate, admissionId: string, now: string): Promise<TestRunAdmissionDecision>;
 //#endregion
-export { TEST_RUN_ADMISSION_PREFIX, TestRunCandidate, admitTestRun, parseTestRunAdmissionId };
+export { TEST_RUN_ADMISSION_PREFIX, TEST_RUN_DENIAL_CODES, TestRunAdmissionDecision, TestRunCandidate, TestRunDenialCode, admitTestRun, decideTestRunAdmission, parseTestRunAdmissionId, testRunDenialCode };
 //# sourceMappingURL=test-run-admission.d.mts.map

package/dist/test-run-admission.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"test-run-admission.d.mts","names":[],"sources":["../src/test-run-admission.ts"],"mappings":";;;;;;;AAcA;;;;UAAiB,gBAAA;EAIN;EAAA,SAFA,WAAA;EAMA;EAAA,SAJA,WAAA;EAQA;EAAA,SANA,mBAAA;EAMmB;EAAA,SAJnB,cAAA;EA0BuB;EAAA,SAxBvB,OAAA;EAyBC;EAAA,SAvBD,mBAAA;AAAA;;;;;;;;;;;;;;;;;;;;iBAsBW,YAAA,CACpB,QAAA,EAAU,eAAA,EACV,SAAA,EAAW,gBAAA,EACX,WAAA,UACA,GAAA,WACC,OAAA,CAAQ,mBAAA"}
+{"version":3,"file":"test-run-admission.d.mts","names":[],"sources":["../src/test-run-admission.ts"],"mappings":";;;;;;;AAcA;;;;UAAiB,gBAAA;EAIN;EAAA,SAFA,WAAA;EAMA;EAAA,SAJA,WAAA;EAQA;EAAA,SANA,mBAAA;EAMmB;EAAA,SAJnB,cAAA;EA0BuB;EAAA,SAxBvB,OAAA;EAyBC;EAAA,SAvBD,mBAAA;AAAA;;;;;;;;;;;;;;AA+HX;;;;;AAwBA;iBAjIsB,YAAA,CACpB,QAAA,EAAU,eAAA,EACV,SAAA,EAAW,gBAAA,EACX,WAAA,UACA,GAAA,WACC,OAAA,CAAQ,mBAAA;;;;AAuIX;;;;;;cAnCa,qBAAA;;KAwBD,iBAAA,WAA4B,qBAAA;;;AA2CxC;;;;;;;UAhCiB,wBAAA;EAgCoE;EAAA,SA9B1E,OAAA;EAqFiC;EAAA,SAnFjC,WAAA,WAAsB,iBAAA;EAoFrB;EAAA,SAlFD,WAAA,WAAsB,mBAAA;AAAA;;;;;;;;;;;;;;;iBA0BjB,iBAAA,CAAkB,UAAA,EAAY,mBAAA,GAAsB,iBAAA;;;;;;;;;;;;iBAuD9C,sBAAA,CACpB,QAAA,EAAU,eAAA,EACV,SAAA,EAAW,gBAAA,EACX,WAAA,UACA,GAAA,WACC,OAAA,CAAQ,wBAAA"}

package/dist/test-run-admission.mjs

@@ -1,4 +1,4 @@
-import { a as error, o as isStrictTimestamp, t as validateTestRunEvidence } from "./test-run-validate-XF0vyoWI.mjs";
+import { d as isStrictTimestamp, t as validateTestRunEvidence, u as error } from "./test-run-validate-C_KR031E.mjs";
 import { TEST_RUN_ADMISSION_PREFIX, parseTestRunAdmissionId, testRunFingerprint } from "./test-run-canonical.mjs";
 //#region src/test-run-admission.ts
 /**
@@ -66,7 +66,105 @@ async function admitTestRun(evidence, candidate, admissionId, now) {
 	diagnostics.sort((left, right) => left.path !== right.path ? left.path < right.path ? -1 : 1 : left.code !== right.code ? left.code < right.code ? -1 : 1 : left.message < right.message ? -1 : left.message > right.message ? 1 : 0);
 	return diagnostics;
 }
+/**
+* Every denial code, in the stable lexicographic decision order.
+*
+* The vocabulary is shared by every backend family: a JavaScript, Rust, Go,
+* or JVM host must derive the same codes from the same diagnostics, as
+* pinned by the shared `tests/fixtures/test-run-evidence` decision fixtures.
+* Codes are append-only: they are never renamed, renumbered, reused, or
+* removed, and a new rejection cause always ships with a new code.
+*/
+const TEST_RUN_DENIAL_CODES = [
+	"admission-id-malformed",
+	"admission-id-mismatch",
+	"admission-time-malformed",
+	"candidate-application-mismatch",
+	"candidate-artifact-fingerprint-mismatch",
+	"candidate-contract-fingerprint-mismatch",
+	"candidate-environment-mismatch",
+	"candidate-release-mismatch",
+	"candidate-source-revision-mismatch",
+	"check-candidate-mismatch",
+	"check-invalid",
+	"check-observer-not-independent",
+	"record-expired",
+	"record-invalid",
+	"skipped-tests-recorded",
+	"transition-chain-broken",
+	"transition-invalid",
+	"transition-replayed",
+	"transition-state-mismatch",
+	"verification-not-accepted"
+];
+const CANDIDATE_MISMATCH_CODES = new Map([
+	["application", "candidate-application-mismatch"],
+	["artifact.fingerprint", "candidate-artifact-fingerprint-mismatch"],
+	["contractFingerprint", "candidate-contract-fingerprint-mismatch"],
+	["environment", "candidate-environment-mismatch"],
+	["release", "candidate-release-mismatch"],
+	["sourceRevision", "candidate-source-revision-mismatch"]
+]);
+/**
+* Returns the stable denial code one admission diagnostic maps to.
+*
+* The mapping is total and identical in every host family: admission codes
+* `VIZE_MARQUETTE_141` through `VIZE_MARQUETTE_148` map to their exact
+* cause, `VIZE_MARQUETTE_144` distinguishes the mismatched candidate binding
+* by its diagnostic path, `VIZE_MARQUETTE_149` through `VIZE_MARQUETTE_151`
+* map to their tests-check cause, `VIZE_MARQUETTE_156` through
+* `VIZE_MARQUETTE_159` map to their transition cause, every other
+* diagnostic at a `check.` path is a `check-invalid` tests-check validation
+* failure, every other diagnostic at a `transition.` path is a
+* `transition-invalid` transition validation failure, and every remaining
+* diagnostic is a `record-invalid` record-validation failure.
+*/
+function testRunDenialCode(diagnostic) {
+	switch (diagnostic.code) {
+		case "VIZE_MARQUETTE_141": return "admission-id-malformed";
+		case "VIZE_MARQUETTE_142": return "admission-id-mismatch";
+		case "VIZE_MARQUETTE_144": {
+			const mismatch = CANDIDATE_MISMATCH_CODES.get(diagnostic.path);
+			if (mismatch !== void 0) return mismatch;
+			break;
+		}
+		case "VIZE_MARQUETTE_145": return "record-expired";
+		case "VIZE_MARQUETTE_146": return "verification-not-accepted";
+		case "VIZE_MARQUETTE_147": return "skipped-tests-recorded";
+		case "VIZE_MARQUETTE_148": return "admission-time-malformed";
+		case "VIZE_MARQUETTE_149": return "check-candidate-mismatch";
+		case "VIZE_MARQUETTE_150": return "check-invalid";
+		case "VIZE_MARQUETTE_151": return "check-observer-not-independent";
+		case "VIZE_MARQUETTE_156": return "transition-state-mismatch";
+		case "VIZE_MARQUETTE_157": return "transition-chain-broken";
+		case "VIZE_MARQUETTE_158": return "transition-replayed";
+		case "VIZE_MARQUETTE_159": return "transition-state-mismatch";
+		default: break;
+	}
+	if (diagnostic.path.startsWith("check.")) return "check-invalid";
+	return diagnostic.path.startsWith("transition.") ? "transition-invalid" : "record-invalid";
+}
+/**
+* Decides one candidate and returns the structured admission decision.
+*
+* The decision wraps {@link admitTestRun}: `diagnostics` is exactly its
+* result, `denialCodes` maps every diagnostic through
+* {@link testRunDenialCode} and then deduplicates and sorts the codes
+* lexicographically, and `allowed` is true only when both are empty. Codes,
+* ordering, and diagnostics are identical to the native implementation, as
+* pinned by the shared decision fixtures. Inputs carry the same obligations
+* as {@link admitTestRun}.
+*/
+async function decideTestRunAdmission(evidence, candidate, admissionId, now) {
+	const diagnostics = await admitTestRun(evidence, candidate, admissionId, now);
+	const denialCodes = [...new Set(diagnostics.map(testRunDenialCode))].sort();
+	return {
+		allowed: diagnostics.length === 0,
+		denialCodes,
+		diagnostics
+	};
+}
 //#endregion
-export { TEST_RUN_ADMISSION_PREFIX, admitTestRun, parseTestRunAdmissionId };
+export { TEST_RUN_ADMISSION_PREFIX, TEST_RUN_DENIAL_CODES, admitTestRun, decideTestRunAdmission, parseTestRunAdmissionId, testRunDenialCode };
 
 //# sourceMappingURL=test-run-admission.mjs.map

package/dist/test-run-admission.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"test-run-admission.mjs","names":[],"sources":["../src/test-run-admission.ts"],"sourcesContent":["import type { TestRunEvidence } from \"./test-run-model.js\";\nimport type { MarquetteDiagnostic } from \"./validate.js\";\nimport { parseTestRunAdmissionId, testRunFingerprint } from \"./test-run-canonical.js\";\nimport { validateTestRunEvidence } from \"./test-run-validate.js\";\nimport { error, isStrictTimestamp } from \"./test-run-validate-rules.js\";\n\nexport { TEST_RUN_ADMISSION_PREFIX, parseTestRunAdmissionId } from \"./test-run-canonical.js\";\n\n/**\n * Exact release candidate a deployment gate wants evidence for.\n *\n * Every field must match the record exactly; admission never falls back to a\n * newer, older, or partially matching record.\n */\nexport interface TestRunCandidate {\n  /** Application the gate is deploying. */\n  readonly application: string;\n  /** Deployment environment the gate is promoting into. */\n  readonly environment: string;\n  /** Lowercase SHA-256 fingerprint of the application contract. */\n  readonly contractFingerprint: string;\n  /** Exact source revision of the candidate. */\n  readonly sourceRevision: string;\n  /** Release the candidate belongs to. */\n  readonly release: string;\n  /** Lowercase SHA-256 fingerprint of the exact artifact being promoted. */\n  readonly artifactFingerprint: string;\n}\n\n/**\n * Decides whether one record admits one exact candidate at one instant.\n *\n * An empty result admits the deployment. Any diagnostic rejects it: the\n * record must validate cleanly, its canonical fingerprint must be the one\n * named by `admissionId`, every candidate binding must match exactly, the\n * record must not be expired at `now`, the independent verification must\n * have accepted the run, and no skipped test may remain unaccounted for.\n *\n * Codes, paths, messages, and ordering are identical to the native\n * implementation, so both host families reach the same decision for the\n * same record.\n *\n * `now` must be a millisecond-precision UTC timestamp such as\n * `2026-01-01T00:00:00.000Z`; the fixed-width format keeps the expiry\n * comparison exact. Callers own retrieval: fetch the canonical bytes from an\n * immutable store within their own deadline, refuse oversized content, and\n * hand the parsed record here.\n */\nexport async function admitTestRun(\n  evidence: TestRunEvidence,\n  candidate: TestRunCandidate,\n  admissionId: string,\n  now: string,\n): Promise<MarquetteDiagnostic[]> {\n  const diagnostics = validateTestRunEvidence(evidence);\n\n  const nowIsExact = isStrictTimestamp(now);\n  if (!nowIsExact) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_148\",\n        \"admission.now\",\n        \"admission time must be a millisecond-precision UTC instant\",\n      ),\n    );\n  }\n\n  const expected = parseTestRunAdmissionId(admissionId);\n  if (expected === undefined) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_141\",\n        \"admission.id\",\n        \"admission id must be test-run: followed by 64 lowercase hexadecimal characters\",\n      ),\n    );\n  } else if ((await testRunFingerprint(evidence)) !== expected) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_142\",\n        \"admission.id\",\n        \"admission id does not name this record's canonical fingerprint\",\n      ),\n    );\n  }\n\n  const bindings = [\n    [evidence.application, candidate.application, \"application\"],\n    [evidence.environment, candidate.environment, \"environment\"],\n    [evidence.contractFingerprint, candidate.contractFingerprint, \"contractFingerprint\"],\n    [evidence.sourceRevision, candidate.sourceRevision, \"sourceRevision\"],\n    [evidence.release, candidate.release, \"release\"],\n    [evidence.artifact.fingerprint, candidate.artifactFingerprint, \"artifact.fingerprint\"],\n  ] as const;\n  for (const [recorded, wanted, field] of bindings) {\n    if (recorded !== wanted) {\n      diagnostics.push(\n        error(\"VIZE_MARQUETTE_144\", field, `record does not bind the candidate ${field}`),\n      );\n    }\n  }\n\n  if (nowIsExact && evidence.validUntil <= now) {\n    diagnostics.push(\n      error(\"VIZE_MARQUETTE_145\", \"validUntil\", \"record is expired at the admission time\"),\n    );\n  }\n  if (evidence.verification.outcome !== \"accepted\") {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_146\",\n        \"verification.outcome\",\n        \"only an accepted verification can admit a deployment\",\n      ),\n    );\n  }\n  if (evidence.verification.skipped > 0) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_147\",\n        \"verification.skipped\",\n        \"skipped tests are not approved for deployment admission\",\n      ),\n    );\n  }\n\n  diagnostics.sort((left, right) =>\n    left.path !== right.path\n      ? left.path < right.path\n        ? -1\n        : 1\n      : left.code !== right.code\n        ? left.code < right.code\n          ? -1\n          : 1\n        : left.message < right.message\n          ? -1\n          : left.message > right.message\n            ? 1\n            : 0,\n  );\n  return diagnostics;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgDA,eAAsB,aACpB,UACA,WACA,aACA,KACgC;CAChC,MAAM,cAAc,wBAAwB,SAAS;CAErD,MAAM,aAAa,kBAAkB,IAAI;CACzC,IAAI,CAAC,YACH,YAAY,KACV,MACE,sBACA,iBACA,6DACD,CACF;CAGH,MAAM,WAAW,wBAAwB,YAAY;CACrD,IAAI,aAAa,KAAA,GACf,YAAY,KACV,MACE,sBACA,gBACA,iFACD,CACF;MACI,IAAK,MAAM,mBAAmB,SAAS,KAAM,UAClD,YAAY,KACV,MACE,sBACA,gBACA,iEACD,CACF;CAGH,MAAM,WAAW;EACf;GAAC,SAAS;GAAa,UAAU;GAAa;GAAc;EAC5D;GAAC,SAAS;GAAa,UAAU;GAAa;GAAc;EAC5D;GAAC,SAAS;GAAqB,UAAU;GAAqB;GAAsB;EACpF;GAAC,SAAS;GAAgB,UAAU;GAAgB;GAAiB;EACrE;GAAC,SAAS;GAAS,UAAU;GAAS;GAAU;EAChD;GAAC,SAAS,SAAS;GAAa,UAAU;GAAqB;GAAuB;EACvF;CACD,KAAK,MAAM,CAAC,UAAU,QAAQ,UAAU,UACtC,IAAI,aAAa,QACf,YAAY,KACV,MAAM,sBAAsB,OAAO,sCAAsC,QAAQ,CAClF;CAIL,IAAI,cAAc,SAAS,cAAc,KACvC,YAAY,KACV,MAAM,sBAAsB,cAAc,0CAA0C,CACrF;CAEH,IAAI,SAAS,aAAa,YAAY,YACpC,YAAY,KACV,MACE,sBACA,wBACA,uDACD,CACF;CAEH,IAAI,SAAS,aAAa,UAAU,GAClC,YAAY,KACV,MACE,sBACA,wBACA,0DACD,CACF;CAGH,YAAY,MAAM,MAAM,UACtB,KAAK,SAAS,MAAM,OAChB,KAAK,OAAO,MAAM,OAChB,KACA,IACF,KAAK,SAAS,MAAM,OAClB,KAAK,OAAO,MAAM,OAChB,KACA,IACF,KAAK,UAAU,MAAM,UACnB,KACA,KAAK,UAAU,MAAM,UACnB,IACA,EACX;CACD,OAAO"}
+{"version":3,"file":"test-run-admission.mjs","names":[],"sources":["../src/test-run-admission.ts"],"sourcesContent":["import type { TestRunEvidence } from \"./test-run-model.js\";\nimport type { MarquetteDiagnostic } from \"./validate.js\";\nimport { parseTestRunAdmissionId, testRunFingerprint } from \"./test-run-canonical.js\";\nimport { validateTestRunEvidence } from \"./test-run-validate.js\";\nimport { error, isStrictTimestamp } from \"./test-run-validate-rules.js\";\n\nexport { TEST_RUN_ADMISSION_PREFIX, parseTestRunAdmissionId } from \"./test-run-canonical.js\";\n\n/**\n * Exact release candidate a deployment gate wants evidence for.\n *\n * Every field must match the record exactly; admission never falls back to a\n * newer, older, or partially matching record.\n */\nexport interface TestRunCandidate {\n  /** Application the gate is deploying. */\n  readonly application: string;\n  /** Deployment environment the gate is promoting into. */\n  readonly environment: string;\n  /** Lowercase SHA-256 fingerprint of the application contract. */\n  readonly contractFingerprint: string;\n  /** Exact source revision of the candidate. */\n  readonly sourceRevision: string;\n  /** Release the candidate belongs to. */\n  readonly release: string;\n  /** Lowercase SHA-256 fingerprint of the exact artifact being promoted. */\n  readonly artifactFingerprint: string;\n}\n\n/**\n * Decides whether one record admits one exact candidate at one instant.\n *\n * An empty result admits the deployment. Any diagnostic rejects it: the\n * record must validate cleanly, its canonical fingerprint must be the one\n * named by `admissionId`, every candidate binding must match exactly, the\n * record must not be expired at `now`, the independent verification must\n * have accepted the run, and no skipped test may remain unaccounted for.\n *\n * Codes, paths, messages, and ordering are identical to the native\n * implementation, so both host families reach the same decision for the\n * same record.\n *\n * `now` must be a millisecond-precision UTC timestamp such as\n * `2026-01-01T00:00:00.000Z`; the fixed-width format keeps the expiry\n * comparison exact. Callers own retrieval: fetch the canonical bytes from an\n * immutable store within their own deadline, refuse oversized content, and\n * hand the parsed record here.\n */\nexport async function admitTestRun(\n  evidence: TestRunEvidence,\n  candidate: TestRunCandidate,\n  admissionId: string,\n  now: string,\n): Promise<MarquetteDiagnostic[]> {\n  const diagnostics = validateTestRunEvidence(evidence);\n\n  const nowIsExact = isStrictTimestamp(now);\n  if (!nowIsExact) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_148\",\n        \"admission.now\",\n        \"admission time must be a millisecond-precision UTC instant\",\n      ),\n    );\n  }\n\n  const expected = parseTestRunAdmissionId(admissionId);\n  if (expected === undefined) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_141\",\n        \"admission.id\",\n        \"admission id must be test-run: followed by 64 lowercase hexadecimal characters\",\n      ),\n    );\n  } else if ((await testRunFingerprint(evidence)) !== expected) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_142\",\n        \"admission.id\",\n        \"admission id does not name this record's canonical fingerprint\",\n      ),\n    );\n  }\n\n  const bindings = [\n    [evidence.application, candidate.application, \"application\"],\n    [evidence.environment, candidate.environment, \"environment\"],\n    [evidence.contractFingerprint, candidate.contractFingerprint, \"contractFingerprint\"],\n    [evidence.sourceRevision, candidate.sourceRevision, \"sourceRevision\"],\n    [evidence.release, candidate.release, \"release\"],\n    [evidence.artifact.fingerprint, candidate.artifactFingerprint, \"artifact.fingerprint\"],\n  ] as const;\n  for (const [recorded, wanted, field] of bindings) {\n    if (recorded !== wanted) {\n      diagnostics.push(\n        error(\"VIZE_MARQUETTE_144\", field, `record does not bind the candidate ${field}`),\n      );\n    }\n  }\n\n  if (nowIsExact && evidence.validUntil <= now) {\n    diagnostics.push(\n      error(\"VIZE_MARQUETTE_145\", \"validUntil\", \"record is expired at the admission time\"),\n    );\n  }\n  if (evidence.verification.outcome !== \"accepted\") {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_146\",\n        \"verification.outcome\",\n        \"only an accepted verification can admit a deployment\",\n      ),\n    );\n  }\n  if (evidence.verification.skipped > 0) {\n    diagnostics.push(\n      error(\n        \"VIZE_MARQUETTE_147\",\n        \"verification.skipped\",\n        \"skipped tests are not approved for deployment admission\",\n      ),\n    );\n  }\n\n  diagnostics.sort((left, right) =>\n    left.path !== right.path\n      ? left.path < right.path\n        ? -1\n        : 1\n      : left.code !== right.code\n        ? left.code < right.code\n          ? -1\n          : 1\n        : left.message < right.message\n          ? -1\n          : left.message > right.message\n            ? 1\n            : 0,\n  );\n  return diagnostics;\n}\n\n/**\n * Every denial code, in the stable lexicographic decision order.\n *\n * The vocabulary is shared by every backend family: a JavaScript, Rust, Go,\n * or JVM host must derive the same codes from the same diagnostics, as\n * pinned by the shared `tests/fixtures/test-run-evidence` decision fixtures.\n * Codes are append-only: they are never renamed, renumbered, reused, or\n * removed, and a new rejection cause always ships with a new code.\n */\nexport const TEST_RUN_DENIAL_CODES = [\n  \"admission-id-malformed\",\n  \"admission-id-mismatch\",\n  \"admission-time-malformed\",\n  \"candidate-application-mismatch\",\n  \"candidate-artifact-fingerprint-mismatch\",\n  \"candidate-contract-fingerprint-mismatch\",\n  \"candidate-environment-mismatch\",\n  \"candidate-release-mismatch\",\n  \"candidate-source-revision-mismatch\",\n  \"check-candidate-mismatch\",\n  \"check-invalid\",\n  \"check-observer-not-independent\",\n  \"record-expired\",\n  \"record-invalid\",\n  \"skipped-tests-recorded\",\n  \"transition-chain-broken\",\n  \"transition-invalid\",\n  \"transition-replayed\",\n  \"transition-state-mismatch\",\n  \"verification-not-accepted\",\n] as const;\n\n/** Stable machine-readable cause class of one admission denial. */\nexport type TestRunDenialCode = (typeof TEST_RUN_DENIAL_CODES)[number];\n\n/**\n * Structured allow-or-deny admission decision for one exact candidate.\n *\n * The decision carries the machine-readable cause classes next to the exact\n * diagnostics, so a deployment gate in any language can act on one bounded\n * vocabulary while operators keep the full explanation. Serialization\n * follows the shared `test-run-admission` schema; decisions are outputs, so\n * a gate must never trust a decision it did not compute itself.\n */\nexport interface TestRunAdmissionDecision {\n  /** Whether the record admits the candidate; true only with no diagnostics. */\n  readonly allowed: boolean;\n  /** Deduplicated denial causes sorted lexicographically; empty when allowed. */\n  readonly denialCodes: readonly TestRunDenialCode[];\n  /** Complete diagnostics in the stable path, code, message order. */\n  readonly diagnostics: readonly MarquetteDiagnostic[];\n}\n\nconst CANDIDATE_MISMATCH_CODES: ReadonlyMap<string, TestRunDenialCode> = new Map([\n  [\"application\", \"candidate-application-mismatch\"],\n  [\"artifact.fingerprint\", \"candidate-artifact-fingerprint-mismatch\"],\n  [\"contractFingerprint\", \"candidate-contract-fingerprint-mismatch\"],\n  [\"environment\", \"candidate-environment-mismatch\"],\n  [\"release\", \"candidate-release-mismatch\"],\n  [\"sourceRevision\", \"candidate-source-revision-mismatch\"],\n]);\n\n/**\n * Returns the stable denial code one admission diagnostic maps to.\n *\n * The mapping is total and identical in every host family: admission codes\n * `VIZE_MARQUETTE_141` through `VIZE_MARQUETTE_148` map to their exact\n * cause, `VIZE_MARQUETTE_144` distinguishes the mismatched candidate binding\n * by its diagnostic path, `VIZE_MARQUETTE_149` through `VIZE_MARQUETTE_151`\n * map to their tests-check cause, `VIZE_MARQUETTE_156` through\n * `VIZE_MARQUETTE_159` map to their transition cause, every other\n * diagnostic at a `check.` path is a `check-invalid` tests-check validation\n * failure, every other diagnostic at a `transition.` path is a\n * `transition-invalid` transition validation failure, and every remaining\n * diagnostic is a `record-invalid` record-validation failure.\n */\nexport function testRunDenialCode(diagnostic: MarquetteDiagnostic): TestRunDenialCode {\n  switch (diagnostic.code) {\n    case \"VIZE_MARQUETTE_141\":\n      return \"admission-id-malformed\";\n    case \"VIZE_MARQUETTE_142\":\n      return \"admission-id-mismatch\";\n    case \"VIZE_MARQUETTE_144\": {\n      const mismatch = CANDIDATE_MISMATCH_CODES.get(diagnostic.path);\n      if (mismatch !== undefined) {\n        return mismatch;\n      }\n      break;\n    }\n    case \"VIZE_MARQUETTE_145\":\n      return \"record-expired\";\n    case \"VIZE_MARQUETTE_146\":\n      return \"verification-not-accepted\";\n    case \"VIZE_MARQUETTE_147\":\n      return \"skipped-tests-recorded\";\n    case \"VIZE_MARQUETTE_148\":\n      return \"admission-time-malformed\";\n    case \"VIZE_MARQUETTE_149\":\n      return \"check-candidate-mismatch\";\n    case \"VIZE_MARQUETTE_150\":\n      return \"check-invalid\";\n    case \"VIZE_MARQUETTE_151\":\n      return \"check-observer-not-independent\";\n    case \"VIZE_MARQUETTE_156\":\n      return \"transition-state-mismatch\";\n    case \"VIZE_MARQUETTE_157\":\n      return \"transition-chain-broken\";\n    case \"VIZE_MARQUETTE_158\":\n      return \"transition-replayed\";\n    case \"VIZE_MARQUETTE_159\":\n      return \"transition-state-mismatch\";\n    default:\n      break;\n  }\n  if (diagnostic.path.startsWith(\"check.\")) {\n    return \"check-invalid\";\n  }\n  return diagnostic.path.startsWith(\"transition.\") ? \"transition-invalid\" : \"record-invalid\";\n}\n\n/**\n * Decides one candidate and returns the structured admission decision.\n *\n * The decision wraps {@link admitTestRun}: `diagnostics` is exactly its\n * result, `denialCodes` maps every diagnostic through\n * {@link testRunDenialCode} and then deduplicates and sorts the codes\n * lexicographically, and `allowed` is true only when both are empty. Codes,\n * ordering, and diagnostics are identical to the native implementation, as\n * pinned by the shared decision fixtures. Inputs carry the same obligations\n * as {@link admitTestRun}.\n */\nexport async function decideTestRunAdmission(\n  evidence: TestRunEvidence,\n  candidate: TestRunCandidate,\n  admissionId: string,\n  now: string,\n): Promise<TestRunAdmissionDecision> {\n  const diagnostics = await admitTestRun(evidence, candidate, admissionId, now);\n  const denialCodes = [...new Set(diagnostics.map(testRunDenialCode))].sort();\n  return { allowed: diagnostics.length === 0, denialCodes, diagnostics };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAgDA,eAAsB,aACpB,UACA,WACA,aACA,KACgC;CAChC,MAAM,cAAc,wBAAwB,SAAS;CAErD,MAAM,aAAa,kBAAkB,IAAI;CACzC,IAAI,CAAC,YACH,YAAY,KACV,MACE,sBACA,iBACA,6DACD,CACF;CAGH,MAAM,WAAW,wBAAwB,YAAY;CACrD,IAAI,aAAa,KAAA,GACf,YAAY,KACV,MACE,sBACA,gBACA,iFACD,CACF;MACI,IAAK,MAAM,mBAAmB,SAAS,KAAM,UAClD,YAAY,KACV,MACE,sBACA,gBACA,iEACD,CACF;CAGH,MAAM,WAAW;EACf;GAAC,SAAS;GAAa,UAAU;GAAa;GAAc;EAC5D;GAAC,SAAS;GAAa,UAAU;GAAa;GAAc;EAC5D;GAAC,SAAS;GAAqB,UAAU;GAAqB;GAAsB;EACpF;GAAC,SAAS;GAAgB,UAAU;GAAgB;GAAiB;EACrE;GAAC,SAAS;GAAS,UAAU;GAAS;GAAU;EAChD;GAAC,SAAS,SAAS;GAAa,UAAU;GAAqB;GAAuB;EACvF;CACD,KAAK,MAAM,CAAC,UAAU,QAAQ,UAAU,UACtC,IAAI,aAAa,QACf,YAAY,KACV,MAAM,sBAAsB,OAAO,sCAAsC,QAAQ,CAClF;CAIL,IAAI,cAAc,SAAS,cAAc,KACvC,YAAY,KACV,MAAM,sBAAsB,cAAc,0CAA0C,CACrF;CAEH,IAAI,SAAS,aAAa,YAAY,YACpC,YAAY,KACV,MACE,sBACA,wBACA,uDACD,CACF;CAEH,IAAI,SAAS,aAAa,UAAU,GAClC,YAAY,KACV,MACE,sBACA,wBACA,0DACD,CACF;CAGH,YAAY,MAAM,MAAM,UACtB,KAAK,SAAS,MAAM,OAChB,KAAK,OAAO,MAAM,OAChB,KACA,IACF,KAAK,SAAS,MAAM,OAClB,KAAK,OAAO,MAAM,OAChB,KACA,IACF,KAAK,UAAU,MAAM,UACnB,KACA,KAAK,UAAU,MAAM,UACnB,IACA,EACX;CACD,OAAO;;;;;;;;;;;AAYT,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAuBD,MAAM,2BAAmE,IAAI,IAAI;CAC/E,CAAC,eAAe,iCAAiC;CACjD,CAAC,wBAAwB,0CAA0C;CACnE,CAAC,uBAAuB,0CAA0C;CAClE,CAAC,eAAe,iCAAiC;CACjD,CAAC,WAAW,6BAA6B;CACzC,CAAC,kBAAkB,qCAAqC;CACzD,CAAC;;;;;;;;;;;;;;;AAgBF,SAAgB,kBAAkB,YAAoD;CACpF,QAAQ,WAAW,MAAnB;EACE,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBAAsB;GACzB,MAAM,WAAW,yBAAyB,IAAI,WAAW,KAAK;GAC9D,IAAI,aAAa,KAAA,GACf,OAAO;GAET;;EAEF,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,KAAK,sBACH,OAAO;EACT,SACE;;CAEJ,IAAI,WAAW,KAAK,WAAW,SAAS,EACtC,OAAO;CAET,OAAO,WAAW,KAAK,WAAW,cAAc,GAAG,uBAAuB;;;;;;;;;;;;;AAc5E,eAAsB,uBACpB,UACA,WACA,aACA,KACmC;CACnC,MAAM,cAAc,MAAM,aAAa,UAAU,WAAW,aAAa,IAAI;CAC7E,MAAM,cAAc,CAAC,GAAG,IAAI,IAAI,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,MAAM;CAC3E,OAAO;EAAE,SAAS,YAAY,WAAW;EAAG;EAAa;EAAa"}

package/dist/test-run-admission.schema.json

@@ -0,0 +1,84 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://vizejs.dev/schemas/marquette/test-run-admission.schema.json",
+  "title": "Vize Test Run Admission Decision",
+  "description": "Language-neutral allow-or-deny decision that one test-run evidence record produces for one exact release candidate at one instant. Every backend family (JavaScript, Rust, Go, JVM) must produce byte-equivalent decisions for the same evidence, candidate, admission id, and admission time; the shared tests/fixtures/test-run-evidence admission-decision fixtures are the conformance source of truth for new host implementations.",
+  "$ref": "#/$defs/decision",
+  "$defs": {
+    "denialCode": {
+      "description": "Stable machine-readable cause class of one admission denial. The vocabulary is append-only: codes are never renamed, renumbered, reused, or removed, and every new distinguishable rejection cause ships with a new code added to this enum in lexicographic position. Hosts must map every diagnostic to exactly one code: VIZE_MARQUETTE_141 to admission-id-malformed; VIZE_MARQUETTE_142 to admission-id-mismatch; VIZE_MARQUETTE_144 to the candidate-*-mismatch code named by its diagnostic path (application, artifact.fingerprint, contractFingerprint, environment, release, sourceRevision); VIZE_MARQUETTE_145 to record-expired; VIZE_MARQUETTE_146 to verification-not-accepted; VIZE_MARQUETTE_147 to skipped-tests-recorded; VIZE_MARQUETTE_148 to admission-time-malformed; VIZE_MARQUETTE_149 to check-candidate-mismatch; VIZE_MARQUETTE_150 to check-invalid; VIZE_MARQUETTE_151 to check-observer-not-independent; VIZE_MARQUETTE_156 to transition-state-mismatch; VIZE_MARQUETTE_157 to transition-chain-broken; VIZE_MARQUETTE_158 to transition-replayed; VIZE_MARQUETTE_159 to transition-state-mismatch; every other diagnostic whose path starts with check. to check-invalid; every other diagnostic whose path starts with transition. to transition-invalid; and every remaining diagnostic, including every record-validation code, to record-invalid.",
+      "enum": [
+        "admission-id-malformed",
+        "admission-id-mismatch",
+        "admission-time-malformed",
+        "candidate-application-mismatch",
+        "candidate-artifact-fingerprint-mismatch",
+        "candidate-contract-fingerprint-mismatch",
+        "candidate-environment-mismatch",
+        "candidate-release-mismatch",
+        "candidate-source-revision-mismatch",
+        "check-candidate-mismatch",
+        "check-invalid",
+        "check-observer-not-independent",
+        "record-expired",
+        "record-invalid",
+        "skipped-tests-recorded",
+        "transition-chain-broken",
+        "transition-invalid",
+        "transition-replayed",
+        "transition-state-mismatch",
+        "verification-not-accepted"
+      ]
+    },
+    "diagnostic": {
+      "description": "One stable, source-addressable diagnostic explaining a denial cause. Codes, severities, paths, messages, and ordering are identical across host families.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "severity", "path", "message"],
+      "properties": {
+        "code": {
+          "description": "Stable machine-readable diagnostic code.",
+          "type": "string",
+          "pattern": "^VIZE_MARQUETTE_[0-9]{3}$"
+        },
+        "severity": {
+          "description": "Diagnostic severity; any diagnostic denies admission.",
+          "enum": ["error", "warning"]
+        },
+        "path": {
+          "description": "JSON-style path into the record or the admission input.",
+          "type": "string",
+          "minLength": 1
+        },
+        "message": {
+          "description": "Human-readable explanation and next action.",
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "decision": {
+      "description": "Structured admission decision. allowed is true only when denialCodes and diagnostics are both empty. denialCodes maps every diagnostic to its denial code, deduplicated and sorted lexicographically by Unicode code point. diagnostics keeps the stable path, code, message order shared by every implementation.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["allowed", "denialCodes", "diagnostics"],
+      "properties": {
+        "allowed": {
+          "description": "Whether the record admits the candidate.",
+          "type": "boolean"
+        },
+        "denialCodes": {
+          "description": "Deduplicated denial causes in lexicographic order; empty when allowed.",
+          "type": "array",
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/denialCode" }
+        },
+        "diagnostics": {
+          "description": "Complete denial diagnostics; empty when allowed.",
+          "type": "array",
+          "items": { "$ref": "#/$defs/diagnostic" }
+        }
+      }
+    }
+  }
+}

package/dist/test-run-canonical-CB-KzZxk.d.mts

@@ -0,0 +1,35 @@
+import { i as TestRunEvidence } from "./test-run-model-DkllmEsY.mjs";
+
+//#region src/test-run-canonical.d.ts
+/** Prefix of every test-run deployment admission id. */
+declare const TEST_RUN_ADMISSION_PREFIX = "test-run:";
+/**
+ * Serializes a test-run evidence record canonically.
+ *
+ * Property order matches the record schema, targets sort by id, suites sort
+ * by id then shard index, and selection identifiers sort lexicographically,
+ * so equivalent records produce byte-identical JSON in every language. Call
+ * validation before trusting the record; canonicalization does not make an
+ * invalid record valid.
+ */
+declare function canonicalTestRunJson(evidence: TestRunEvidence): string;
+/**
+ * Returns the lowercase SHA-256 fingerprint of the canonical record.
+ *
+ * The fingerprint is the exact value admitted as `test-run:<sha256>` by
+ * deployment gates. Uses the Web Crypto API available in every supported
+ * runtime.
+ */
+declare function testRunFingerprint(evidence: TestRunEvidence): Promise<string>;
+/** Returns the `test-run:<sha256>` admission id for one record. */
+declare function testRunAdmissionId(evidence: TestRunEvidence): Promise<string>;
+/**
+ * Returns the fingerprint named by a `test-run:<sha256>` admission id.
+ *
+ * Returns `undefined` unless the prefix, length, and lowercase hexadecimal
+ * grammar are all exact.
+ */
+declare function parseTestRunAdmissionId(id: string): string | undefined;
+//#endregion
+export { testRunFingerprint as a, testRunAdmissionId as i, canonicalTestRunJson as n, parseTestRunAdmissionId as r, TEST_RUN_ADMISSION_PREFIX as t };
+//# sourceMappingURL=test-run-canonical-CB-KzZxk.d.mts.map

package/dist/test-run-canonical-CB-KzZxk.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-run-canonical-CB-KzZxk.d.mts","names":[],"sources":["../src/test-run-canonical.ts"],"mappings":";;;;cAQa,yBAAA;AAAb;;;;;AAwCA;;;;AAxCA,iBAwCgB,oBAAA,CAAqB,QAAA,EAAU,eAAA;AA6D/C;;;;;;;AAAA,iBAAsB,kBAAA,CAAmB,QAAA,EAAU,eAAA,GAAkB,OAAA;;iBAW/C,kBAAA,CAAmB,QAAA,EAAU,eAAA,GAAkB,OAAA;;;;;;;iBAUrD,uBAAA,CAAwB,EAAA"}

package/dist/test-run-canonical.d.mts

@@ -1,35 +1,2 @@
-import { i as TestRunEvidence } from "./test-run-model-DkllmEsY.mjs";
-
-//#region src/test-run-canonical.d.ts
-/** Prefix of every test-run deployment admission id. */
-declare const TEST_RUN_ADMISSION_PREFIX = "test-run:";
-/**
- * Serializes a test-run evidence record canonically.
- *
- * Property order matches the record schema, targets sort by id, suites sort
- * by id then shard index, and selection identifiers sort lexicographically,
- * so equivalent records produce byte-identical JSON in every language. Call
- * validation before trusting the record; canonicalization does not make an
- * invalid record valid.
- */
-declare function canonicalTestRunJson(evidence: TestRunEvidence): string;
-/**
- * Returns the lowercase SHA-256 fingerprint of the canonical record.
- *
- * The fingerprint is the exact value admitted as `test-run:<sha256>` by
- * deployment gates. Uses the Web Crypto API available in every supported
- * runtime.
- */
-declare function testRunFingerprint(evidence: TestRunEvidence): Promise<string>;
-/** Returns the `test-run:<sha256>` admission id for one record. */
-declare function testRunAdmissionId(evidence: TestRunEvidence): Promise<string>;
-/**
- * Returns the fingerprint named by a `test-run:<sha256>` admission id.
- *
- * Returns `undefined` unless the prefix, length, and lowercase hexadecimal
- * grammar are all exact.
- */
-declare function parseTestRunAdmissionId(id: string): string | undefined;
-//#endregion
-export { TEST_RUN_ADMISSION_PREFIX, canonicalTestRunJson, parseTestRunAdmissionId, testRunAdmissionId, testRunFingerprint };
-//# sourceMappingURL=test-run-canonical.d.mts.map
+import { a as testRunFingerprint, i as testRunAdmissionId, n as canonicalTestRunJson, r as parseTestRunAdmissionId, t as TEST_RUN_ADMISSION_PREFIX } from "./test-run-canonical-CB-KzZxk.mjs";
+export { TEST_RUN_ADMISSION_PREFIX, canonicalTestRunJson, parseTestRunAdmissionId, testRunAdmissionId, testRunFingerprint };

package/dist/test-run-check.d.mts

@@ -0,0 +1,80 @@
+import { i as TestRunEvidence } from "./test-run-model-DkllmEsY.mjs";
+import { MarquetteDiagnostic } from "./validate.mjs";
+import { TestRunAdmissionDecision, TestRunCandidate } from "./test-run-admission.mjs";
+
+//#region src/test-run-check.d.ts
+/**
+ * Serialized `format` marker for retained tests-check records.
+ *
+ * Readers must reject any other value before trusting the record.
+ */
+declare const TEST_RUN_CHECK_FORMAT = "vize.test-run.check";
+/**
+ * Current serialized tests-check format.
+ *
+ * Readers must reject a higher value until they explicitly support it.
+ */
+declare const TEST_RUN_CHECK_FORMAT_VERSION = 1;
+/**
+ * Retained, release-bound `tests` check for one deployment decision.
+ *
+ * The record replaces every generic test-result reference — a summary blob,
+ * a report path, or a green workflow label — with the exact
+ * `test-run:<sha256>` admission id of an independently verified run, the six
+ * candidate facts the run was admitted for, and the identity and instant of
+ * the independent observer that recorded the admission. A release decision
+ * retaining anything else as its tests evidence cannot pass
+ * {@link verifyTestRunCheck}.
+ */
+interface TestRunCheck {
+  /** Serialized format marker; always {@link TEST_RUN_CHECK_FORMAT}. */
+  readonly format: typeof TEST_RUN_CHECK_FORMAT;
+  /**
+   * Serialized format version.
+   *
+   * Defaults to {@link TEST_RUN_CHECK_FORMAT_VERSION}.
+   */
+  readonly formatVersion?: typeof TEST_RUN_CHECK_FORMAT_VERSION;
+  /** Exact `test-run:<sha256>` admission id of the observed run. */
+  readonly evidence: string;
+  /** Exact candidate facts the run was admitted for. */
+  readonly candidate: TestRunCandidate;
+  /**
+   * Identity of the independent observer that recorded the admission.
+   *
+   * The observer is the trusted promotion boundary, never the runner that
+   * executed the tests.
+   */
+  readonly observer: string;
+  /** Millisecond-precision UTC instant the admission was observed. */
+  readonly observedAt: string;
+}
+/**
+ * Validates a retained tests-check record structurally.
+ *
+ * Diagnostics use `check.` paths and are deterministic and sorted by path,
+ * code, and message. A generic evidence reference fails here with
+ * `VIZE_MARQUETTE_141`: only an exact `test-run:<sha256>` admission id can
+ * name retained test evidence. Structural validity never admits anything by
+ * itself; {@link verifyTestRunCheck} must confirm the record against the
+ * caller's candidate and the retained run. Codes, paths, messages, and
+ * ordering are identical to the native implementation.
+ */
+declare function validateTestRunCheck(check: TestRunCheck): MarquetteDiagnostic[];
+/**
+ * Verifies one retained tests check against the caller's own facts.
+ *
+ * The caller supplies the candidate it is deciding from its own trusted
+ * facts; the retained check must validate structurally, bind that candidate
+ * exactly, name an observer independent from the run's runner, and be
+ * observed no earlier than the run's completed verification. The referenced
+ * record is then admitted exactly like {@link admitTestRun}: canonical
+ * fingerprint, candidate bindings, expiry at `now`, verification outcome,
+ * and skipped-test accounting all fail closed. Diagnostics, denial codes,
+ * and ordering are identical to the native implementation, as pinned by the
+ * shared check-decision fixtures.
+ */
+declare function verifyTestRunCheck(check: TestRunCheck, candidate: TestRunCandidate, evidence: TestRunEvidence, now: string): Promise<TestRunAdmissionDecision>;
+//#endregion
+export { TEST_RUN_CHECK_FORMAT, TEST_RUN_CHECK_FORMAT_VERSION, TestRunCheck, validateTestRunCheck, verifyTestRunCheck };
+//# sourceMappingURL=test-run-check.d.mts.map

package/dist/test-run-check.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-run-check.d.mts","names":[],"sources":["../src/test-run-check.ts"],"mappings":";;;;;;;AAwBA;;;cAAa,qBAAA;;AAOb;;;;cAAa,6BAAA;AAab;;;;;;;;;;;AAAA,UAAiB,YAAA;EAUN;EAAA,SARA,MAAA,SAAe,qBAAA;EAUJ;;;;;EAAA,SAJX,aAAA,UAAuB,6BAAA;EA2BE;EAAA,SAzBzB,QAAA;EAyBmE;EAAA,SAvBnE,SAAA,EAAW,gBAAA;EAuBe;;;;AA4DrC;;EA5DqC,SAhB1B,QAAA;EA6EF;EAAA,SA3EE,UAAA;AAAA;;;;;;;;;;;;iBAcK,oBAAA,CAAqB,KAAA,EAAO,YAAA,GAAe,mBAAA;;;;;;;;;;;;;;iBA4DrC,kBAAA,CACpB,KAAA,EAAO,YAAA,EACP,SAAA,EAAW,gBAAA,EACX,QAAA,EAAU,eAAA,EACV,GAAA,WACC,OAAA,CAAQ,wBAAA"}

package/dist/test-run-check.mjs

@@ -0,0 +1,116 @@
+import { a as checkDigest, c as checkSourceRevision, d as isStrictTimestamp, l as checkTimestamp, o as checkIdentifier, u as error } from "./test-run-validate-C_KR031E.mjs";
+import { parseTestRunAdmissionId } from "./test-run-canonical.mjs";
+import { admitTestRun, testRunDenialCode } from "./test-run-admission.mjs";
+//#region src/test-run-check.ts
+/**
+* Serialized `format` marker for retained tests-check records.
+*
+* Readers must reject any other value before trusting the record.
+*/
+const TEST_RUN_CHECK_FORMAT = "vize.test-run.check";
+/**
+* Current serialized tests-check format.
+*
+* Readers must reject a higher value until they explicitly support it.
+*/
+const TEST_RUN_CHECK_FORMAT_VERSION = 1;
+/**
+* Validates a retained tests-check record structurally.
+*
+* Diagnostics use `check.` paths and are deterministic and sorted by path,
+* code, and message. A generic evidence reference fails here with
+* `VIZE_MARQUETTE_141`: only an exact `test-run:<sha256>` admission id can
+* name retained test evidence. Structural validity never admits anything by
+* itself; {@link verifyTestRunCheck} must confirm the record against the
+* caller's candidate and the retained run. Codes, paths, messages, and
+* ordering are identical to the native implementation.
+*/
+function validateTestRunCheck(check) {
+	const diagnostics = [];
+	if (check.format !== "vize.test-run.check") diagnostics.push(error("VIZE_MARQUETTE_101", "check.format", "unsupported tests-check format marker"));
+	if ((check.formatVersion ?? 1) !== 1) diagnostics.push(error("VIZE_MARQUETTE_102", "check.formatVersion", "unsupported tests-check format version"));
+	if (parseTestRunAdmissionId(check.evidence) === void 0) diagnostics.push(error("VIZE_MARQUETTE_141", "check.evidence", "check evidence must be test-run: followed by 64 lowercase hexadecimal characters"));
+	const candidate = check.candidate;
+	checkIdentifier(candidate.application, "check.candidate.application", diagnostics);
+	checkIdentifier(candidate.environment, "check.candidate.environment", diagnostics);
+	checkDigest(candidate.contractFingerprint, "check.candidate.contractFingerprint", diagnostics);
+	checkSourceRevision(candidate.sourceRevision, "check.candidate.sourceRevision", diagnostics);
+	if (candidate.release.length === 0 || candidate.release.length > 256) diagnostics.push(error("VIZE_MARQUETTE_106", "check.candidate.release", "release must be between 1 and 256 characters"));
+	checkDigest(candidate.artifactFingerprint, "check.candidate.artifactFingerprint", diagnostics);
+	checkIdentifier(check.observer, "check.observer", diagnostics);
+	checkTimestamp(check.observedAt, "check.observedAt", diagnostics);
+	sortDiagnostics(diagnostics);
+	return diagnostics;
+}
+/**
+* Verifies one retained tests check against the caller's own facts.
+*
+* The caller supplies the candidate it is deciding from its own trusted
+* facts; the retained check must validate structurally, bind that candidate
+* exactly, name an observer independent from the run's runner, and be
+* observed no earlier than the run's completed verification. The referenced
+* record is then admitted exactly like {@link admitTestRun}: canonical
+* fingerprint, candidate bindings, expiry at `now`, verification outcome,
+* and skipped-test accounting all fail closed. Diagnostics, denial codes,
+* and ordering are identical to the native implementation, as pinned by the
+* shared check-decision fixtures.
+*/
+async function verifyTestRunCheck(check, candidate, evidence, now) {
+	const diagnostics = validateTestRunCheck(check);
+	const bindings = [
+		[
+			check.candidate.application,
+			candidate.application,
+			"application",
+			"application"
+		],
+		[
+			check.candidate.environment,
+			candidate.environment,
+			"environment",
+			"environment"
+		],
+		[
+			check.candidate.contractFingerprint,
+			candidate.contractFingerprint,
+			"contractFingerprint",
+			"contract fingerprint"
+		],
+		[
+			check.candidate.sourceRevision,
+			candidate.sourceRevision,
+			"sourceRevision",
+			"source revision"
+		],
+		[
+			check.candidate.release,
+			candidate.release,
+			"release",
+			"release"
+		],
+		[
+			check.candidate.artifactFingerprint,
+			candidate.artifactFingerprint,
+			"artifactFingerprint",
+			"artifact fingerprint"
+		]
+	];
+	for (const [recorded, expected, property, field] of bindings) if (recorded !== expected) diagnostics.push(error("VIZE_MARQUETTE_149", `check.candidate.${property}`, `check does not bind the candidate ${field}`));
+	if (check.observer === evidence.runner.identity) diagnostics.push(error("VIZE_MARQUETTE_151", "check.observer", "check observer must be independent from the run's runner"));
+	if (isStrictTimestamp(check.observedAt) && check.observedAt < evidence.verification.completedAt) diagnostics.push(error("VIZE_MARQUETTE_150", "check.observedAt", "observation must not precede the completed verification"));
+	diagnostics.push(...await admitTestRun(evidence, candidate, check.evidence, now));
+	sortDiagnostics(diagnostics);
+	const denialCodes = [...new Set(diagnostics.map(testRunDenialCode))].sort();
+	return {
+		allowed: diagnostics.length === 0,
+		denialCodes,
+		diagnostics
+	};
+}
+function sortDiagnostics(diagnostics) {
+	diagnostics.sort((left, right) => left.path !== right.path ? left.path < right.path ? -1 : 1 : left.code !== right.code ? left.code < right.code ? -1 : 1 : left.message < right.message ? -1 : left.message > right.message ? 1 : 0);
+}
+//#endregion
+export { TEST_RUN_CHECK_FORMAT, TEST_RUN_CHECK_FORMAT_VERSION, validateTestRunCheck, verifyTestRunCheck };
+
+//# sourceMappingURL=test-run-check.mjs.map