assertledger 1.1.1 → 1.3.0

package/dist/engine/index.js

@@ -1,25 +1,29 @@
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { cp, lstat, mkdir, mkdtemp, open, readdir, readFile, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
+import { cp, link, lstat, mkdir, mkdtemp, open, readdir, readFile, realpath, rename, rm, stat, writeFile, } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
-import { pathToFileURL } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import { createScanner, SyntaxKind } from "typescript/unstable/ast";
-import { AdapterSchema, parseAgenticBenchmarkAcquisitionRequest, parseAgenticBenchmarkAcquisitionResult, parseEvidenceManifest, parseRepositoryAudit, parseRepositoryInitConfig, parseRepositoryInitLock, parseRepositoryInitResult, parseVerificationRequest, parseVersionedVerificationRequest, repositoryInitConfigDigest, repositoryInitLockDigest, } from "../contracts/index.js";
+import { AdapterSchema, isRepositoryExcludeName, parseAgenticBenchmarkAcquisitionRequest, parseAgenticBenchmarkAcquisitionResult, parseEvidenceManifest, parseRepositoryAudit, parseRepositoryInitConfig, parseRepositoryInitConfigV2, parseRepositoryInitLock, parseRepositoryInitLockV2, parseRepositoryInitResult, parseRepositoryInitResultV2, parseVerificationRequest, parseVersionedRepositoryInitConfig, parseVersionedRepositoryInitLock, parseVersionedVerificationRequest, RepositoryInitDetectionsSchema, repositoryInitConfigDigest, repositoryInitConfigV2Digest, repositoryInitLockDigest, repositoryInitLockV2Digest, } from "../contracts/index.js";
 import { assertSafeRelativePath, canonicalize, createAgenticBenchmark, decideEvidence, portablePathKey, replayAgenticBenchmark, replayEvidenceManifest, sealManifestArtifact, sha256Canonical, } from "../core/index.js";
+import { BUN_TEST_ADAPTER_PROFILE } from "./adapters/bun-test-profile.js";
 import { NODE_TEST_ADAPTER_PROFILE } from "./adapters/node-test-profile.js";
 import { runNodeTestRuntimePreflight, } from "./adapters/node-test-runtime.js";
-import { CONTAINER_LIMITATIONS, CONTAINER_REPORTER_FILE, CONTAINER_RESULT_FILE, CONTAINER_WORKSPACE, DEFAULT_CONTAINER_RUNTIME_COMMAND, prepareContainerBackend, runContainerExecution, } from "./container.js";
 import { normalizeRuntimeFacts, RUNTIME_FACTS_VERSION } from "./adapters/runtime-facts.js";
+import { CONTAINER_LIMITATIONS, CONTAINER_REPORTER_FILE, CONTAINER_RESULT_FILE, CONTAINER_WORKSPACE, DEFAULT_CONTAINER_RUNTIME_COMMAND, prepareContainerBackend, runContainerExecution, } from "./container.js";
 import { NODE_TEST_REPORTER_SOURCE } from "./node-test-reporter.js";
-import { runRuntimeDoctorChecks } from "./runtime-doctor.js";
+import { runBunRuntimeDoctorChecks, runRuntimeDoctorChecks, } from "./runtime-doctor.js";
 const DEFAULT_EXCLUDES = new Set([".git", ".testforge", "node_modules"]);
 const SHA256_PREFIX = "sha256:";
 const PROCESS_TERMINATION_GRACE_MS = 250;
 const CONTROLLED_REPORT_MAXIMUM_BYTES = 64 * 1024;
+const BUN_TEST_DRIVER_PATH = fileURLToPath(new URL("../../integrations/bun/driver.mjs", import.meta.url));
+const BUN_TEST_HELPER_PATH = fileURLToPath(new URL("../../integrations/bun/assertions.mjs", import.meta.url));
+const BUN_TEST_PRELOAD_PATH = fileURLToPath(new URL("../../integrations/bun/preload.mjs", import.meta.url));
 const TEMPORARY_CLEANUP_OPTIONS = {
     recursive: true,
     force: true,
@@ -31,6 +35,20 @@ const INIT_LOCK_FILE = "assertledger.lock.json";
 const INIT_MANAGED_FILES = new Set([INIT_CONFIG_FILE, INIT_LOCK_FILE]);
 const INIT_PACKAGE_MANAGERS = ["pnpm", "npm", "yarn", "bun", "uv", "poetry", "pip"];
 const INIT_FRAMEWORKS = ["node:test", "vitest", "jest", "bun:test", "pytest"];
+export class RepositoryInitWriteError extends Error {
+    targetPath;
+    temporaryPath;
+    temporaryCleanup;
+    installedPaths;
+    constructor(cause, targetPath, temporaryPath, temporaryCleanup, installedPaths) {
+        super("INIT_WRITE_FAILED", { cause });
+        this.name = "RepositoryInitWriteError";
+        this.targetPath = targetPath;
+        this.temporaryPath = temporaryPath;
+        this.temporaryCleanup = temporaryCleanup;
+        this.installedPaths = installedPaths;
+    }
+}
 async function removeTemporaryDirectory(directory) {
     await rm(directory, TEMPORARY_CLEANUP_OPTIONS);
 }
@@ -280,6 +298,32 @@ function registerPortablePath(spellings, relative) {
         throw new Error("PORTABLE_PATH_COLLISION");
     spellings.set(key, relative);
 }
+/** The declared list of a valid configuration; anything unreadable falls back to the defaults,
+ * which only widens the inventory and so keeps every link check. */
+async function configuredRepositoryExcludes(root) {
+    try {
+        const configPath = path.join(root, INIT_CONFIG_FILE);
+        if (!(await lstat(configPath)).isFile())
+            return [];
+        const value = JSON.parse(await readFile(configPath, "utf8"));
+        return parseVersionedRepositoryInitConfig(value).repository.exclude;
+    }
+    catch {
+        return [];
+    }
+}
+async function configuredRepositoryFramework(root) {
+    try {
+        const configPath = path.join(root, INIT_CONFIG_FILE);
+        if (!(await lstat(configPath)).isFile())
+            return undefined;
+        const value = JSON.parse(await readFile(configPath, "utf8"));
+        return parseVersionedRepositoryInitConfig(value).framework;
+    }
+    catch {
+        return undefined;
+    }
+}
 async function walkFiles(root, excludes) {
     const files = [];
     const spellings = new Map();
@@ -419,6 +463,9 @@ function initEvidenceKind(file) {
 function initNodeTestSource(file) {
     return /(?:^|\/)[^/]+\.test\.[cm]?[jt]s$/u.test(file);
 }
+function initBunTestSource(file) {
+    return /(?:^|\/)[^/]+\.(?:test|spec)\.[cm]?[jt]sx?$/u.test(file);
+}
 function initSafePathPattern(value) {
     if (value.startsWith("-") || value.includes("\\"))
         return false;
@@ -462,7 +509,10 @@ function initPathPatternMatcher(pattern) {
 }
 function initCommandPathMatchers(command, testSources) {
     const conventionalDirectories = new Set(["test", "tests", "spec", "specs", "__tests__"]);
-    return command.arguments
+    const operands = command.executable === "bun" && command.arguments[0] === "test"
+        ? command.arguments.slice(1)
+        : command.arguments;
+    return operands
         .filter((argument) => initSafePathPattern(argument) &&
         (/[*?]/u.test(argument) ||
             argument.includes("/") ||
@@ -548,16 +598,75 @@ function initJavaScriptModuleSpecifiers(source) {
     specifiers.delete("");
     return specifiers;
 }
-async function atomicInitWrite(root, relative, content) {
+async function atomicInitWrite(root, relative, content, action, installedPaths, dependencies = {}) {
     const target = path.join(root, relative);
     const temporary = path.join(root, `.${relative}.${process.pid}.${Date.now()}.tmp`);
+    const openTemporary = dependencies.openTemporary ?? ((temporaryPath) => open(temporaryPath, "wx"));
+    const writeTemporary = dependencies.writeTemporary ??
+        ((_temporaryPath, temporaryContent, handle) => handle.writeFile(temporaryContent));
+    const renameTemporary = dependencies.renameTemporary ?? rename;
+    const linkTemporary = dependencies.linkTemporary ?? link;
+    const removeTemporary = dependencies.removeTemporary ?? ((temporaryPath) => rm(temporaryPath, { force: true }));
+    let temporaryOwned = false;
+    let temporaryHandle;
+    let temporaryHandleClosed = true;
+    let targetInstalled = false;
     try {
-        await writeFile(temporary, content, { flag: "wx" });
-        await rename(temporary, target);
+        temporaryHandle = await openTemporary(temporary);
+        temporaryOwned = true;
+        temporaryHandleClosed = false;
+        try {
+            await writeTemporary(temporary, content, temporaryHandle);
+        }
+        finally {
+            await temporaryHandle.close();
+            temporaryHandleClosed = true;
+        }
+        if (action === "CREATE") {
+            await linkTemporary(temporary, target);
+            targetInstalled = true;
+            await removeTemporary(temporary);
+        }
+        else {
+            await renameTemporary(temporary, target);
+            targetInstalled = true;
+        }
     }
     catch (error) {
-        await rm(temporary, { force: true });
-        throw error;
+        let temporaryCleanup = "NOT_OWNED";
+        if (!temporaryOwned) {
+            try {
+                await lstat(temporary);
+                temporaryCleanup = "UNRESOLVED";
+            }
+            catch (inspectionError) {
+                if (inspectionError.code !== "ENOENT") {
+                    temporaryCleanup = "UNRESOLVED";
+                }
+            }
+        }
+        if (temporaryOwned && !temporaryHandleClosed && temporaryHandle !== undefined) {
+            try {
+                await temporaryHandle.close();
+                temporaryHandleClosed = true;
+            }
+            catch {
+                temporaryCleanup = "UNRESOLVED";
+            }
+        }
+        if (temporaryOwned) {
+            temporaryCleanup = "REMOVED";
+            try {
+                await removeTemporary(temporary);
+            }
+            catch {
+                temporaryCleanup = "UNRESOLVED";
+            }
+        }
+        throw new RepositoryInitWriteError(error, target, temporary, temporaryCleanup, [
+            ...installedPaths,
+            ...(targetInstalled ? [target] : []),
+        ]);
     }
 }
 function initEmptyDetections(reasonCodes) {
@@ -571,8 +680,9 @@ function initEmptyDetections(reasonCodes) {
     };
 }
 function initTerminalResult(status, detections, reasonCodes) {
-    return parseRepositoryInitResult({
-        schemaVersion: "1.0.0",
+    const bunBuiltIn = detections.adapterRecommendation === "bun-test";
+    const result = {
+        schemaVersion: bunBuiltIn ? "2.0.0" : "1.0.0",
         status,
         reasonCodes: [...new Set(reasonCodes)].sort(),
         detections: { ...detections, reasonCodes: [...new Set(detections.reasonCodes)].sort() },
@@ -580,9 +690,10 @@ function initTerminalResult(status, detections, reasonCodes) {
         files: [],
         requiredOperatorInputs: ["worlds", "candidates"],
         nextCommands: [{ executable: "assertledger", arguments: ["audit", ".", "--json"] }],
-    });
+    };
+    return bunBuiltIn ? parseRepositoryInitResultV2(result) : parseRepositoryInitResult(result);
 }
-export async function initializeRepository(requestedRoot, options = {}) {
+export async function initializeRepository(requestedRoot, options = {}, writeDependencies = {}) {
     let root;
     try {
         root = await realpath(requestedRoot);
@@ -594,13 +705,32 @@ export async function initializeRepository(requestedRoot, options = {}) {
             "REPOSITORY_ROOT_INVALID",
         ]);
     }
+    const declaredExcludes = options.exclude ?? (await configuredRepositoryExcludes(root));
+    const repositoryExclude = [...new Set([...DEFAULT_EXCLUDES, ...declaredExcludes])].sort();
+    if (repositoryExclude.length > 1_000 ||
+        options.exclude?.some((entry) => !isRepositoryExcludeName(entry))) {
+        return initTerminalResult("CONFLICT", initEmptyDetections(["INVALID_REPOSITORY_EXCLUDE"]), [
+            "INVALID_REPOSITORY_EXCLUDE",
+        ]);
+    }
+    const inventoryExcludes = effectiveExcludes([...INIT_MANAGED_FILES, ...repositoryExclude]);
     const candidateRoots = ["tests/candidates"];
     const outsideCandidateRoots = (file) => !candidateRoots.some((candidateRoot) => {
         const rootKey = portablePathKey(candidateRoot);
         const fileKey = portablePathKey(file);
         return fileKey === rootKey || fileKey.startsWith(`${rootKey}/`);
     });
-    const inventory = await walkFiles(root, effectiveExcludes([...INIT_MANAGED_FILES]));
+    let inventory;
+    try {
+        inventory = await walkFiles(root, inventoryExcludes);
+    }
+    catch (error) {
+        if (!(error instanceof Error) || error.message !== "UNSUPPORTED_REPOSITORY_SYMLINK")
+            throw error;
+        return initTerminalResult("CONFLICT", initEmptyDetections(["UNSUPPORTED_REPOSITORY_SYMLINK"]), [
+            "UNSUPPORTED_REPOSITORY_SYMLINK",
+        ]);
+    }
     const inScopeFiles = inventory.files.filter(outsideCandidateRoots);
     const contents = new Map();
     const evidenceBytes = new Map();
@@ -713,7 +843,7 @@ export async function initializeRepository(requestedRoot, options = {}) {
         (contents.has("requirements.txt") &&
             /(^|\n)pytest(?:[=<>!~]|$)/u.test(contents.get("requirements.txt") ?? "")))
         frameworkFacts.add("pytest");
-    const frameworkOverride = options.framework;
+    const frameworkOverride = options.framework ?? (await configuredRepositoryFramework(root));
     if (frameworkOverride !== undefined && !isInitFramework(frameworkOverride)) {
         const detections = initEmptyDetections(["FRAMEWORK_OVERRIDE_INVALID"]);
         detections.packageManager = packageManager;
@@ -825,8 +955,24 @@ export async function initializeRepository(requestedRoot, options = {}) {
             adapterRecommendation = "node-test";
         }
     }
+    else if (framework === "bun:test") {
+        const testSources = inScopeFiles.filter((file) => initBunTestSource(file) &&
+            initJavaScriptModuleSpecifiers(contents.get(file) ?? "").has("bun:test"));
+        const pathMatchers = initCommandPathMatchers(testCommand, testSources);
+        const baseTestFiles = pathMatchers.length === 0
+            ? testSources
+            : testSources.filter((file) => pathMatchers.some((matcher) => matcher(file)));
+        if (baseTestFiles.length > 0) {
+            adapter = { kind: "bun-test", executable: "bun", baseTestFiles };
+            adapterRecommendation = "bun-test";
+        }
+    }
     const reasonCodes = adapter === undefined
-        ? [framework === "node:test" ? "BASE_TEST_FILES_UNAVAILABLE" : "OFFICIAL_ADAPTER_UNAVAILABLE"]
+        ? [
+            framework === "node:test" || framework === "bun:test"
+                ? "BASE_TEST_FILES_UNAVAILABLE"
+                : "OFFICIAL_ADAPTER_UNAVAILABLE",
+        ]
         : [];
     const detections = {
         packageManager,
@@ -839,17 +985,23 @@ export async function initializeRepository(requestedRoot, options = {}) {
     if (adapter === undefined)
         return initTerminalResult("BLOCKED", detections, reasonCodes);
     await options.afterEvidenceSnapshot?.();
-    const config = parseRepositoryInitConfig({
-        schemaVersion: "1.0.0",
-        repository: { root: ".", exclude: [".git", ".testforge", "node_modules"] },
+    const bunBuiltIn = adapter.kind === "bun-test";
+    const configValue = {
+        schemaVersion: bunBuiltIn ? "2.0.0" : "1.0.0",
+        repository: { root: ".", exclude: repositoryExclude },
         packageManager,
         framework,
         testCommand,
         adapter,
         candidateRoots: [...candidateRoots],
-    });
+    };
+    const config = bunBuiltIn
+        ? parseRepositoryInitConfigV2(configValue)
+        : parseRepositoryInitConfig(configValue);
     const configContent = initJsonBytes(config);
-    const configDigest = repositoryInitConfigDigest(config);
+    const configDigest = config.schemaVersion === "2.0.0"
+        ? repositoryInitConfigV2Digest(config)
+        : repositoryInitConfigDigest(config);
     const evidenceFiles = inScopeFiles.filter((file) => initEvidenceKind(file) !== undefined);
     if (adapterEvidencePath !== undefined && !evidenceFiles.includes(adapterEvidencePath))
         evidenceFiles.push(adapterEvidencePath);
@@ -867,17 +1019,33 @@ export async function initializeRepository(requestedRoot, options = {}) {
                 : (initEvidenceKind(file) ?? "ADAPTER_CONFIG"),
         });
     }
-    const lockBase = {
-        schemaVersion: "1.0.0",
-        configDigest,
-        detector: { name: "assertledger-init", version: "1.0.0" },
-        evidence,
-        detections,
-    };
-    const lock = parseRepositoryInitLock({
-        ...lockBase,
-        lockDigest: repositoryInitLockDigest(lockBase),
-    });
+    let lock;
+    if (bunBuiltIn) {
+        const lockBase = {
+            schemaVersion: "2.0.0",
+            configDigest,
+            detector: { name: "assertledger-init", version: "2.0.0" },
+            evidence,
+            detections,
+        };
+        lock = parseRepositoryInitLockV2({
+            ...lockBase,
+            lockDigest: repositoryInitLockV2Digest(lockBase),
+        });
+    }
+    else {
+        const lockBase = {
+            schemaVersion: "1.0.0",
+            configDigest,
+            detector: { name: "assertledger-init", version: "1.0.0" },
+            evidence,
+            detections: RepositoryInitDetectionsSchema.parse(detections),
+        };
+        lock = parseRepositoryInitLock({
+            ...lockBase,
+            lockDigest: repositoryInitLockDigest(lockBase),
+        });
+    }
     const lockContent = initJsonBytes(lock);
     const plannedFiles = [
         { path: INIT_CONFIG_FILE, digest: rawSha256(configContent), content: configContent },
@@ -885,7 +1053,7 @@ export async function initializeRepository(requestedRoot, options = {}) {
     ];
     let finalInScopeFiles;
     try {
-        const finalInventory = await walkFiles(root, effectiveExcludes([...INIT_MANAGED_FILES]));
+        const finalInventory = await walkFiles(root, inventoryExcludes);
         finalInScopeFiles = finalInventory.files.filter(outsideCandidateRoots);
     }
     catch {
@@ -940,7 +1108,7 @@ export async function initializeRepository(requestedRoot, options = {}) {
         let structural;
         try {
             const value = JSON.parse(existingLock);
-            structural = parseRepositoryInitLock(value);
+            structural = parseVersionedRepositoryInitLock(value);
         }
         catch {
             return initTerminalResult("CONFLICT", { ...detections, reasonCodes: ["LOCK_INVALID"] }, [
@@ -952,8 +1120,8 @@ export async function initializeRepository(requestedRoot, options = {}) {
         }
     }
     if (existingConfig === configContent && existingLock === lockContent) {
-        return parseRepositoryInitResult({
-            schemaVersion: "1.0.0",
+        const result = {
+            schemaVersion: bunBuiltIn ? "2.0.0" : "1.0.0",
             status: "UNCHANGED",
             reasonCodes: [],
             detections,
@@ -961,7 +1129,8 @@ export async function initializeRepository(requestedRoot, options = {}) {
             files: plannedFiles,
             requiredOperatorInputs: ["worlds", "candidates"],
             nextCommands: [{ executable: "assertledger", arguments: ["audit", ".", "--json"] }],
-        });
+        };
+        return bunBuiltIn ? parseRepositoryInitResultV2(result) : parseRepositoryInitResult(result);
     }
     const actions = [];
     if (existingConfig === undefined)
@@ -972,8 +1141,8 @@ export async function initializeRepository(requestedRoot, options = {}) {
         actions.push({ kind: "REGENERATE", path: INIT_LOCK_FILE });
     actions.sort((left, right) => left.path.localeCompare(right.path));
     const status = options.dryRun ? "WOULD_CREATE" : "CREATED";
-    const result = parseRepositoryInitResult({
-        schemaVersion: "1.0.0",
+    const resultValue = {
+        schemaVersion: bunBuiltIn ? "2.0.0" : "1.0.0",
         status,
         reasonCodes: [],
         detections,
@@ -981,13 +1150,19 @@ export async function initializeRepository(requestedRoot, options = {}) {
         files: plannedFiles,
         requiredOperatorInputs: ["worlds", "candidates"],
         nextCommands: [{ executable: "assertledger", arguments: ["audit", ".", "--json"] }],
-    });
+    };
+    const result = bunBuiltIn
+        ? parseRepositoryInitResultV2(resultValue)
+        : parseRepositoryInitResult(resultValue);
     if (!options.dryRun) {
+        const installedPaths = [];
         for (const action of actions) {
             const file = plannedFiles.find((candidate) => candidate.path === action.path);
             if (file === undefined)
                 throw new Error("INIT_PLAN_INCONSISTENT");
-            await atomicInitWrite(root, file.path, file.content);
+            await atomicInitWrite(root, file.path, file.content, action.kind, installedPaths, writeDependencies);
+            if (action.kind === "CREATE")
+                installedPaths.push(path.join(root, file.path));
         }
     }
     return result;
@@ -1029,9 +1204,52 @@ async function probeRuntimeTemporaryWorkspace() {
 }
 export async function doctorRepositoryRuntime(requestedRoot, options) {
     const repositoryRoot = path.resolve(requestedRoot);
+    const configuration = options.allowUnsafeExecution
+        ? await initializeRepository(repositoryRoot, { dryRun: true })
+        : undefined;
+    if (configuration?.schemaVersion === "2.0.0" &&
+        configuration.detections.adapterRecommendation === "bun-test") {
+        const configFile = configuration.files.find((file) => file.path === INIT_CONFIG_FILE);
+        if (configFile === undefined)
+            throw new Error("BUN_TEST_CONFIG_MISSING");
+        const config = parseRepositoryInitConfigV2(JSON.parse(configFile.content));
+        const environmentAllowlist = ["PATH", "SystemRoot", "WINDIR", "TEMP", "TMP"];
+        let resolvedExecutable = config.adapter.executable;
+        return runBunRuntimeDoctorChecks(repositoryRoot, configuration, {
+            probeExecutable: async () => {
+                const identity = await probeBunTestExecutable(config.adapter.executable, repositoryRoot, environmentAllowlist, 5_000, CONTROLLED_REPORT_MAXIMUM_BYTES);
+                resolvedExecutable = identity.resolvedExecutable;
+                return { bunVersion: identity.bunVersion };
+            },
+            probeDependencies: async () => {
+                const result = await runProcess({
+                    executable: resolvedExecutable,
+                    args: ["-e", 'import("bun:test").then(() => process.stdout.write("READY"))'],
+                    cwd: repositoryRoot,
+                    environment: environmentFromAllowlist(environmentAllowlist),
+                    timeoutMs: 5_000,
+                    maximumOutputBytes: CONTROLLED_REPORT_MAXIMUM_BYTES,
+                });
+                if (result.outcome !== "PASS" ||
+                    result.stdout.text !== "READY" ||
+                    result.stderr.totalBytes !== 0) {
+                    throw new Error("BUN_TEST_DEPENDENCY_UNAVAILABLE");
+                }
+            },
+            probeTemporaryWorkspace: probeRuntimeTemporaryWorkspace,
+            runSyntheticPreflight: async () => {
+                await runBunTestRuntimePreflight(resolvedExecutable, environmentAllowlist, 5_000, CONTROLLED_REPORT_MAXIMUM_BYTES);
+            },
+        });
+    }
     let resolvedExecutable = process.execPath;
     return runRuntimeDoctorChecks(repositoryRoot, options.allowUnsafeExecution, {
-        inspectConfiguration: () => initializeRepository(repositoryRoot, { dryRun: true }),
+        inspectConfiguration: async () => {
+            const inspected = configuration ?? (await initializeRepository(repositoryRoot, { dryRun: true }));
+            if (inspected.schemaVersion !== "1.0.0")
+                throw new Error("RUNTIME_CONFIGURATION_UNAVAILABLE");
+            return inspected;
+        },
         probeExecutable: async () => {
             const identity = await probeNodeTestExecutable(process.execPath, repositoryRoot, [], 5_000, CONTROLLED_REPORT_MAXIMUM_BYTES);
             resolvedExecutable = identity.resolvedExecutable;
@@ -1368,9 +1586,10 @@ async function resolveRepositoryRoot(rootInput) {
         throw new TypeError("INVALID_REPOSITORY_ROOT");
     }
 }
-export async function analyzeRepository(rootInput) {
+export async function analyzeRepository(rootInput, options = {}) {
     const root = await resolveRepositoryRoot(rootInput);
-    const { files } = await walkFiles(root, effectiveExcludes([]));
+    const declaredExcludes = options.configuredExcludes === true ? await configuredRepositoryExcludes(root) : [];
+    const { files } = await walkFiles(root, effectiveExcludes(declaredExcludes));
     const digest = createHash("sha256");
     const languageCounts = new Map();
     const frameworks = new Set();
@@ -1777,7 +1996,9 @@ function parseRequest(value) {
     if (candidateRoots.length === 0)
         throw new TypeError("INVALID_CANDIDATE_ROOTS");
     assertPortableStringCollection(candidateRoots, "DUPLICATE_CANDIDATE_ROOT");
-    if (adapter.kind !== "node-test" && adapter.kind !== "testforge-command") {
+    if (adapter.kind !== "node-test" &&
+        adapter.kind !== "bun-test" &&
+        adapter.kind !== "testforge-command") {
         throw new TypeError("UNSUPPORTED_ADAPTER");
     }
     // The versioned contract already restricts container isolation to v2 requests.
@@ -1896,13 +2117,15 @@ function parseRequest(value) {
     if (minimumTargetWeightPermille > 1_000) {
         throw new TypeError("INVALID_MINIMUM_TARGET_WEIGHT_PERMILLE");
     }
-    const normalizedAdapter = adapter.kind === "node-test"
+    const normalizedAdapter = adapter.kind === "node-test" || adapter.kind === "bun-test"
         ? (() => {
-            const extraArguments = parseNodeTestExtraArguments(adapter.extraArguments);
+            const extraArguments = adapter.kind === "node-test"
+                ? parseNodeTestExtraArguments(adapter.extraArguments)
+                : undefined;
             const baseTestFiles = requireStringArray(adapter.baseTestFiles, "base_test_files").map((file) => assertSafeRelativePath(file, ["."]));
             assertPortableStringCollection(baseTestFiles, "DUPLICATE_BASE_TEST_FILE");
             return {
-                kind: "node-test",
+                kind: adapter.kind,
                 executable: requireString(adapter.executable, "adapter_executable"),
                 baseTestFiles,
                 ...(extraArguments === undefined ? {} : { extraArguments }),
@@ -2099,6 +2322,19 @@ async function readStructuredCommandReport(resultFile, processResult, maximumByt
     }
     return parseStructuredCommandReport(await readBoundedJsonFile(resultFile, maximumBytes), processResult);
 }
+function readBunDriverReport(processResult) {
+    if (processResult.outcome === "TIMEOUT" ||
+        processResult.outcome === "INFRA_ERROR" ||
+        processResult.stdout.truncated ||
+        processResult.stdout.totalBytes > CONTROLLED_REPORT_MAXIMUM_BYTES)
+        return undefined;
+    try {
+        return parseStructuredCommandReport(JSON.parse(processResult.stdout.text), processResult);
+    }
+    catch {
+        return undefined;
+    }
+}
 async function readNodeTestReport(resultFile, processResult, maximumBytes) {
     if (processResult.outcome === "TIMEOUT" || processResult.outcome === "INFRA_ERROR") {
         return undefined;
@@ -2179,6 +2415,71 @@ async function probeNodeTestExecutable(requestedExecutable, repositoryRoot, envi
         nodeVersion: secondProbe.nodeVersion,
     };
 }
+async function runBunExecutableProbe(executable, repositoryRoot, environmentAllowlist, timeoutMs, maximumOutputBytes) {
+    const result = await runProcess({
+        executable,
+        args: [
+            "-e",
+            "console.log(JSON.stringify({execPath:process.execPath,bunVersion:Bun.version,bunRevision:Bun.revision}))",
+        ],
+        cwd: repositoryRoot,
+        environment: environmentFromAllowlist(environmentAllowlist),
+        timeoutMs: Math.min(timeoutMs, 5_000),
+        maximumOutputBytes: Math.min(maximumOutputBytes, CONTROLLED_REPORT_MAXIMUM_BYTES),
+    });
+    if (result.outcome !== "PASS" || result.stdout.truncated || result.stderr.totalBytes !== 0) {
+        throw new Error("BUN_TEST_EXECUTABLE_PROBE_FAILED");
+    }
+    let report;
+    try {
+        report = JSON.parse(result.stdout.text.trim());
+    }
+    catch {
+        throw new Error("BUN_TEST_EXECUTABLE_PROBE_FAILED");
+    }
+    if (!isRecord(report) ||
+        Object.keys(report).sort().join("\0") !== "bunRevision\0bunVersion\0execPath" ||
+        typeof report.execPath !== "string" ||
+        report.execPath.length === 0 ||
+        typeof report.bunVersion !== "string" ||
+        typeof report.bunRevision !== "string") {
+        throw new Error("BUN_TEST_EXECUTABLE_PROBE_FAILED");
+    }
+    if (report.bunVersion !== BUN_TEST_ADAPTER_PROFILE.bunVersion ||
+        report.bunRevision !== BUN_TEST_ADAPTER_PROFILE.bunRevision) {
+        throw new Error("BUN_TEST_VERSION_UNSUPPORTED");
+    }
+    return {
+        execPath: report.execPath,
+        bunVersion: report.bunVersion,
+        bunRevision: report.bunRevision,
+    };
+}
+async function probeBunTestExecutable(requestedExecutable, repositoryRoot, environmentAllowlist, timeoutMs, maximumOutputBytes) {
+    const first = await runBunExecutableProbe(requestedExecutable, repositoryRoot, environmentAllowlist, timeoutMs, maximumOutputBytes);
+    let resolvedExecutable;
+    try {
+        resolvedExecutable = await realpath(first.execPath);
+        if (!(await stat(resolvedExecutable)).isFile())
+            throw new Error("not a file");
+    }
+    catch {
+        throw new Error("BUN_TEST_EXECUTABLE_PROBE_FAILED");
+    }
+    const second = await runBunExecutableProbe(resolvedExecutable, repositoryRoot, environmentAllowlist, timeoutMs, maximumOutputBytes);
+    if ((await realpath(second.execPath)) !== resolvedExecutable ||
+        second.bunVersion !== first.bunVersion ||
+        second.bunRevision !== first.bunRevision) {
+        throw new Error("BUN_TEST_EXECUTABLE_PROBE_FAILED");
+    }
+    return {
+        requestedExecutable,
+        resolvedExecutable,
+        executableDigest: await sha256File(resolvedExecutable),
+        bunVersion: second.bunVersion,
+        bunRevision: second.bunRevision,
+    };
+}
 // Evaluated by `node -p` inside a fresh container before any candidate code runs there.
 const CONTAINER_NODE_PROBE_SOURCE = '(() => { const fs = require("node:fs"); const crypto = require("node:crypto"); const execPath = fs.realpathSync(process.execPath); return JSON.stringify({ digest: "sha256:" + crypto.createHash("sha256").update(fs.readFileSync(execPath)).digest("hex"), execPath, node: process.versions.node }); })()';
 function parseJsonBytes(bytes) {
@@ -2286,6 +2587,8 @@ function containerPreflightExecutor(container, executable) {
 }
 async function executeContainerAdapter(request, container, workspace, candidateFiles) {
     const adapter = request.adapter;
+    if (adapter.kind === "bun-test")
+        throw new Error("BUN_TEST_CONTAINER_UNSUPPORTED");
     const executed = await runContainerExecution(container, {
         workspace,
         ...(adapter.kind === "node-test" ? { reporterSource: NODE_TEST_REPORTER_SOURCE } : {}),
@@ -2370,6 +2673,9 @@ async function executeTrustedLocalAdapter(request, workspace, temporaryRoot, can
         environment.TESTFORGE_RESULT_FILE = resultFile;
         environment.TESTFORGE_CANDIDATE_FILES = JSON.stringify(candidateFiles);
     }
+    else if (request.adapter.kind === "bun-test") {
+        environment.TESTFORGE_CANDIDATE_FILES = JSON.stringify(candidateFiles);
+    }
     else {
         if (nodeTestReporterPath === undefined)
             throw new Error("NODE_TEST_REPORTER_MISSING");
@@ -2385,20 +2691,30 @@ async function executeTrustedLocalAdapter(request, workspace, temporaryRoot, can
             ...request.adapter.baseTestFiles,
             ...candidateFiles,
         ]
-        : request.adapter.arguments;
+        : request.adapter.kind === "bun-test"
+            ? [
+                BUN_TEST_DRIVER_PATH,
+                request.adapter.executable,
+                BUN_TEST_HELPER_PATH,
+                ...request.adapter.baseTestFiles,
+            ]
+            : request.adapter.arguments;
     const result = await runProcess({
-        executable: request.adapter.executable,
+        executable: request.adapter.kind === "bun-test" ? process.execPath : request.adapter.executable,
         args,
         cwd: workspace,
         environment,
         timeoutMs: request.budgets.timeoutMsPerExecution,
         maximumOutputBytes: request.budgets.maximumOutputBytes,
     });
+    const structuredReport = request.adapter.kind === "testforge-command"
+        ? await readStructuredCommandReport(resultFile, result, CONTROLLED_REPORT_MAXIMUM_BYTES)
+        : request.adapter.kind === "bun-test"
+            ? readBunDriverReport(result)
+            : undefined;
     return {
         result,
-        structuredReport: request.adapter.kind === "testforge-command"
-            ? await readStructuredCommandReport(resultFile, result, CONTROLLED_REPORT_MAXIMUM_BYTES)
-            : undefined,
+        structuredReport,
         nodeTestReport: request.adapter.kind === "node-test"
             ? await readNodeTestReport(resultFile, result, CONTROLLED_REPORT_MAXIMUM_BYTES)
             : undefined,
@@ -2444,6 +2760,119 @@ async function executeObservation(request, repositoryRoot, world, candidate, att
         await removeTemporaryDirectory(temporaryRoot);
     }
 }
+async function runBunTestRuntimePreflight(executable, environmentAllowlist, timeoutMs, maximumOutputBytes) {
+    const probeSources = [
+        {
+            name: "assertion",
+            source: 'import { test } from "bun:test"; import { assertSame } from "assertledger/bun"; test("assertion", () => assertSame(1, 2));\n',
+            outcome: "ASSERTION_FAILURE",
+            attributed: true,
+        },
+        {
+            name: "generic-throw",
+            source: 'import { test } from "bun:test"; test("generic", () => { throw new Error("generic"); });\n',
+            outcome: "PROCESS_CRASH",
+            attributed: false,
+        },
+        {
+            name: "caught-assertion",
+            source: 'import { test } from "bun:test"; import { assertSame } from "assertledger/bun"; test("caught", () => { try { assertSame(1, 2); } catch {} throw new Error("generic"); });\n',
+            outcome: "PROCESS_CRASH",
+            attributed: false,
+        },
+        {
+            name: "replayed-assertion",
+            source: 'import { test } from "bun:test"; import { assertSame } from "assertledger/bun"; let saved; try { assertSame(1, 2); } catch (error) { saved = error; } test("replayed", () => { throw saved; });\n',
+            outcome: "PROCESS_CRASH",
+            attributed: false,
+        },
+        {
+            name: "replayed-row",
+            source: 'import { test } from "bun:test"; import { assertSame } from "assertledger/bun"; let saved; test.each([0, 1])("row %i", (row) => { if (row === 0) { try { assertSame(1, 2); } catch (error) { saved = error; } return; } throw saved; });\n',
+            outcome: "PROCESS_CRASH",
+            attributed: false,
+        },
+        {
+            name: "async-cross-test",
+            source: 'import { test } from "bun:test"; import { assertSame } from "assertledger/bun"; let signalReady; const ready = new Promise((resolve) => { signalReady = resolve; }); let rejectReceiver; test("origin", () => { ready.then(() => { try { assertSame(1, 2); } catch (error) { rejectReceiver(error); } }); }); test("receiver", () => new Promise((_, reject) => { rejectReceiver = reject; signalReady(); }));\n',
+            outcome: "PROCESS_CRASH",
+            attributed: false,
+        },
+        {
+            name: "multi-assertion-rows",
+            source: 'import { test } from "bun:test"; import { assertSame } from "assertledger/bun"; test.each([1, 2])("row %i", (row) => assertSame(row, 0));\n',
+            outcome: "ASSERTION_FAILURE",
+            attributed: true,
+        },
+        {
+            name: "operand-throw",
+            source: 'import { test } from "bun:test"; import { assertSame } from "assertledger/bun"; test("operand", () => assertSame((() => { throw new Error("operand"); })(), 1));\n',
+            outcome: "PROCESS_CRASH",
+            attributed: false,
+        },
+        {
+            name: "native-expect",
+            source: 'import { test, expect } from "bun:test"; test("native", () => expect(1).toBe(2));\n',
+            outcome: "PROCESS_CRASH",
+            attributed: false,
+        },
+        {
+            name: "hook-failure",
+            source: 'import { afterEach, test } from "bun:test"; import { assertSame } from "assertledger/bun"; afterEach(() => { throw new Error("hook"); }); test("candidate", () => assertSame(1, 2));\n',
+            outcome: "INFRA_ERROR",
+            attributed: false,
+        },
+    ];
+    try {
+        const probes = [];
+        for (const probe of probeSources) {
+            const evidence = await withEmptyWorkspace(async (workspace) => {
+                await writeFile(path.join(workspace, "package.json"), '{"type":"module"}\n');
+                await writeFile(path.join(workspace, "base.test.ts"), 'import { test } from "bun:test"; test("control", () => {});\n');
+                const candidatePath = path.join(workspace, "candidate.test.ts");
+                await writeFile(candidatePath, probe.source);
+                const result = await runProcess({
+                    executable: process.execPath,
+                    args: [BUN_TEST_DRIVER_PATH, executable, BUN_TEST_HELPER_PATH, "base.test.ts"],
+                    cwd: workspace,
+                    environment: {
+                        ...environmentFromAllowlist(environmentAllowlist),
+                        TESTFORGE_CANDIDATE_FILES: JSON.stringify(["candidate.test.ts"]),
+                    },
+                    timeoutMs: Math.min(timeoutMs, 5_000),
+                    maximumOutputBytes: Math.min(maximumOutputBytes, CONTROLLED_REPORT_MAXIMUM_BYTES),
+                });
+                const report = readBunDriverReport(result);
+                const expectedCandidateCount = probe.name === "hook-failure"
+                    ? 0
+                    : probe.name === "replayed-row" ||
+                        probe.name === "async-cross-test" ||
+                        probe.name === "multi-assertion-rows"
+                        ? 2
+                        : 1;
+                if (report?.outcome !== probe.outcome ||
+                    report.attributed !== probe.attributed ||
+                    report.testsDiscovered !==
+                        (expectedCandidateCount === 0 ? 0 : expectedCandidateCount + 1) ||
+                    report.candidateTestsDiscovered !== expectedCandidateCount) {
+                    throw new Error("BUN_TEST_PROFILE_PREFLIGHT_FAILED");
+                }
+                return {
+                    name: probe.name,
+                    outcome: report.outcome,
+                    attributed: report.attributed,
+                    testsDiscovered: report.testsDiscovered,
+                    candidateTestsDiscovered: report.candidateTestsDiscovered,
+                };
+            });
+            probes.push(evidence);
+        }
+        return { protocolVersion: "1.0.0", probes };
+    }
+    catch (error) {
+        throw new Error("BUN_TEST_PROFILE_PREFLIGHT_FAILED", { cause: error });
+    }
+}
 export async function verifyCampaign(value, options = {}) {
     const request = parseRequest(value);
     const container = request.isolation.kind === "container"
@@ -2466,6 +2895,15 @@ export async function verifyCampaign(value, options = {}) {
     if (request.adapter.kind === "node-test" && nodeIdentity !== undefined) {
         request.adapter.executable = nodeIdentity.resolvedExecutable;
     }
+    const bunIdentity = request.adapter.kind === "bun-test"
+        ? await probeBunTestExecutable(request.adapter.executable, repositoryRoot, trustedLocalEnvironmentAllowlist(request), request.budgets.timeoutMsPerExecution, request.budgets.maximumOutputBytes)
+        : undefined;
+    if (request.adapter.kind === "bun-test" && bunIdentity !== undefined) {
+        request.adapter.executable = bunIdentity.resolvedExecutable;
+    }
+    const bunDriverDigest = request.adapter.kind === "bun-test" ? await sha256File(BUN_TEST_DRIVER_PATH) : undefined;
+    const bunHelperDigest = request.adapter.kind === "bun-test" ? await sha256File(BUN_TEST_HELPER_PATH) : undefined;
+    const bunPreloadDigest = request.adapter.kind === "bun-test" ? await sha256File(BUN_TEST_PRELOAD_PATH) : undefined;
     const nodeRuntimePreflight = request.adapter.kind === "node-test" && nodeIdentity !== undefined
         ? await runNodeTestRuntimePreflight({
             executable: nodeIdentity.resolvedExecutable,
@@ -2481,6 +2919,9 @@ export async function verifyCampaign(value, options = {}) {
                 }),
         })
         : undefined;
+    const bunRuntimePreflight = request.adapter.kind === "bun-test" && bunIdentity !== undefined
+        ? await runBunTestRuntimePreflight(bunIdentity.resolvedExecutable, trustedLocalEnvironmentAllowlist(request), request.budgets.timeoutMsPerExecution, request.budgets.maximumOutputBytes)
+        : undefined;
     const campaignRoot = await realpath(await mkdtemp(path.join(os.tmpdir(), "testforge-campaign-")));
     const repositorySnapshot = path.join(campaignRoot, "repository");
     try {
@@ -2495,7 +2936,9 @@ export async function verifyCampaign(value, options = {}) {
         const inputPaths = [
             ...request.worlds.flatMap((world) => world.files.map((file) => file.path)),
             ...request.candidates.flatMap((candidate) => candidate.files.map((file) => file.path)),
-            ...(request.adapter.kind === "node-test" ? request.adapter.baseTestFiles : []),
+            ...(request.adapter.kind === "node-test" || request.adapter.kind === "bun-test"
+                ? request.adapter.baseTestFiles
+                : []),
             ...request.candidateRoots,
         ];
         for (const inputPath of inputPaths) {
@@ -2537,7 +2980,9 @@ export async function verifyCampaign(value, options = {}) {
                     name: request.adapter.kind,
                     version: request.adapter.kind === "testforge-command"
                         ? request.adapter.protocolVersion
-                        : (nodeIdentity?.nodeVersion ?? "unprobed"),
+                        : request.adapter.kind === "bun-test"
+                            ? (bunIdentity?.bunVersion ?? "unprobed")
+                            : (nodeIdentity?.nodeVersion ?? "unprobed"),
                     configuration: request.adapter.kind === "node-test" && nodeIdentity !== undefined
                         ? {
                             kind: "node-test",
@@ -2560,7 +3005,31 @@ export async function verifyCampaign(value, options = {}) {
                                 ...request.adapter.baseTestFiles,
                             ],
                         }
-                        : request.adapter,
+                        : request.adapter.kind === "bun-test" && bunIdentity !== undefined
+                            ? {
+                                kind: "bun-test",
+                                profile: BUN_TEST_ADAPTER_PROFILE,
+                                requestedExecutable: bunIdentity.requestedExecutable,
+                                resolvedExecutable: bunIdentity.resolvedExecutable,
+                                executableDigest: bunIdentity.executableDigest,
+                                bunVersion: bunIdentity.bunVersion,
+                                bunRevision: bunIdentity.bunRevision,
+                                driverDigest: bunDriverDigest,
+                                helperDigest: bunHelperDigest,
+                                preloadDigest: bunPreloadDigest,
+                                runtimePreflight: bunRuntimePreflight,
+                                arguments: [
+                                    "test",
+                                    "--max-concurrency=1",
+                                    "--retry=0",
+                                    "--preload",
+                                    "./node_modules/assertledger/preload.mjs",
+                                    "--reporter=junit",
+                                    "--reporter-outfile=<generated-junit-file>",
+                                    ...request.adapter.baseTestFiles,
+                                ],
+                            }
+                            : request.adapter,
                 },
                 execution: {
                     isolation: container === undefined ? "UNSANDBOXED" : "CONTAINER",
@@ -2612,9 +3081,21 @@ export async function verifyCampaign(value, options = {}) {
                 ? [
                     "UNSANDBOXED trusted-local execution cannot safely contain hostile candidate code.",
                     "Process-tree termination is best effort and depends on host operating-system facilities.",
+                    ...(request.adapter.kind === "bun-test"
+                        ? [
+                            "Only failures from the AssertLedger-owned assertSame helper are admitted as Bun assertions; native bun:test expect failures are not assertion evidence.",
+                            "Bun callback instrumentation determines assertion ownership; JUnit counts only check completeness and never classify assertions.",
+                        ]
+                        : []),
                 ]
                 : [...CONTAINER_LIMITATIONS],
         };
+        if (request.adapter.kind === "bun-test" &&
+            ((await sha256File(BUN_TEST_DRIVER_PATH)) !== bunDriverDigest ||
+                (await sha256File(BUN_TEST_HELPER_PATH)) !== bunHelperDigest ||
+                (await sha256File(BUN_TEST_PRELOAD_PATH)) !== bunPreloadDigest)) {
+            throw new Error("BUN_TEST_ASSET_CHANGED_DURING_CAMPAIGN");
+        }
         return sealManifestArtifact(finalManifest);
     }
     finally {