sverka 0.0.0 → 0.2.3

package/dist/index.mjs

@@ -0,0 +1,2038 @@
+import { t as missingBuildHint } from "./errors-DHioC6LB.mjs";
+import * as nodeModule from "node:module";
+import { register } from "node:module";
+import process$1 from "node:process";
+import yargs from "yargs";
+import { constants, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { mkdir, open, readFile, realpath, writeFile } from "node:fs/promises";
+import { collectConstructWarnings, synthesize, validateGraph } from "@sverka/workflow";
+import { bindRunPlan, createPlanner } from "@sverka/sdk";
+import { DEFAULT_POLICY, createBuiltinResolver, evaluatePolicy, loadBaseline, normalizeSarif, serializeSarif, synthesizeCheckSteps } from "@sverka/verification";
+import { createDockerDriver, createEngine, createHostDriver } from "@sverka/runtime";
+import { spawnSync } from "node:child_process";
+import { compileGithub, compileGitlab } from "@sverka/compiler";
+import { z } from "zod";
+//#region src/types.ts
+/** Exit codes used by the CLI. */
+const ExitCode = {
+	Success: 0,
+	PolicyFail: 1,
+	UsageError: 2,
+	RuntimeError: 3
+};
+/** Error thrown when CLI argument parsing or command execution fails. */
+var CliError = class extends Error {
+	code;
+	exitCode;
+	cause;
+	constructor(message, code, exitCode, cause) {
+		super(message);
+		this.name = "CliError";
+		this.code = code;
+		this.exitCode = exitCode;
+		this.cause = cause;
+	}
+};
+//#endregion
+//#region src/output.ts
+/**
+* OutputWriter that writes to caller-provided sinks (stdout/stderr).
+* In production, the sinks write to process.stdout/process.stderr.
+* In tests, the sinks capture into arrays.
+*/
+var ConsoleOutputWriter = class {
+	#out;
+	#err;
+	#quiet;
+	#verbose;
+	constructor(out, err, quiet = false, verbose = false) {
+		this.#out = out;
+		this.#err = err;
+		this.#quiet = quiet;
+		this.#verbose = verbose;
+	}
+	write(text) {
+		if (this.#quiet) return;
+		this.#out(text);
+	}
+	writeLine(text) {
+		if (this.#quiet) return;
+		this.#out(text + "\n");
+	}
+	error(text) {
+		this.#err(text);
+	}
+	errorLine(text) {
+		this.#err(text + "\n");
+	}
+	/** Write a debug line to stderr, only when --verbose is set. */
+	debug(text) {
+		if (this.#verbose) this.#err(text + "\n");
+	}
+};
+/**
+* Wrapper that applies --quiet / --verbose / --format semantics to any
+* underlying OutputWriter. Used to make injected test writers respect the
+* same suppression rules as the production writer.
+*
+* - `--quiet` (text format) suppresses stdout writes; JSON stdout is kept.
+* - `--verbose` routes `debug()` to the underlying `errorLine()`.
+* - stderr is never suppressed.
+*/
+var FlagAwareWriter = class {
+	#base;
+	#quiet;
+	#verbose;
+	constructor(base, quiet, verbose) {
+		this.#base = base;
+		this.#quiet = quiet;
+		this.#verbose = verbose;
+	}
+	write(text) {
+		if (this.#quiet) return;
+		this.#base.write(text);
+	}
+	writeLine(text) {
+		if (this.#quiet) return;
+		this.#base.writeLine(text);
+	}
+	error(text) {
+		this.#base.error(text);
+	}
+	errorLine(text) {
+		this.#base.errorLine(text);
+	}
+	debug(text) {
+		if (this.#verbose) this.#base.errorLine(text);
+	}
+};
+/**
+* Create an OutputWriter from global flags. In JSON format, stdout is NOT
+* suppressed by --quiet (the JSON result is the data and must be emitted).
+*/
+function createOutputWriter(global, out, err) {
+	return new ConsoleOutputWriter(out, err, global.quiet && global.format === "text", global.verbose);
+}
+/**
+* Wrap any OutputWriter with --quiet / --verbose semantics from global flags.
+* Use for injected test writers so they respect the same suppression rules.
+*/
+function wrapOutputWriter(global, base) {
+	return new FlagAwareWriter(base, global.quiet && global.format === "text", global.verbose);
+}
+//#endregion
+//#region src/internal/version.ts
+/**
+* Resolve the sverka CLI version from its own package.json.
+* Walks up from this module so it works from src/ (dev) and bundled
+* dist/ alike, and never picks up the consumer's cwd package.json
+* (which is what yargs' default --version resolution does).
+*/
+function cliVersion() {
+	let dir = dirname(fileURLToPath(import.meta.url));
+	while (true) {
+		try {
+			const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8"));
+			if (pkg.name === "sverka" && pkg.version) return pkg.version;
+		} catch {}
+		const parent = dirname(dir);
+		if (parent === dir) return "0.0.0";
+		dir = parent;
+	}
+}
+//#endregion
+//#region src/internal/paths.ts
+/**
+* Resolve a path against a root directory. Absolute paths are returned
+* unchanged; relative paths are joined under `root` so that `--root` governs
+* path resolution regardless of the process working directory.
+*/
+function resolveUnderRoot(root, path) {
+	return isAbsolute(path) ? path : join(root, path);
+}
+//#endregion
+//#region src/internal/config.ts
+let hooksRegistered = false;
+function findHooksFile() {
+	for (const rel of ["./config-hooks.mjs", "./internal/config-hooks.mjs"]) try {
+		const candidate = fileURLToPath(new URL(rel, import.meta.url));
+		if (existsSync(candidate)) return candidate;
+	} catch {}
+	return null;
+}
+/**
+* Register ESM resolve hooks so a config file that cannot resolve @sverka/*
+* packages from its own location falls back to the copies bundled with the
+* CLI. This makes a globally-installed `sverka` self-contained.
+*/
+async function registerConfigHooks() {
+	if (hooksRegistered) return;
+	const hooksFile = findHooksFile();
+	if (hooksFile === null) return;
+	const href = pathToFileURL(hooksFile).href;
+	try {
+		const registerHooks = nodeModule.registerHooks;
+		if (typeof registerHooks === "function") {
+			const hooks = await import(href);
+			if (typeof hooks.resolve === "function") {
+				registerHooks.call(nodeModule, { resolve: hooks.resolve });
+				hooksRegistered = true;
+				return;
+			}
+		}
+		register(href);
+		hooksRegistered = true;
+	} catch {}
+}
+/**
+* Find a sverka.config.ts or sverka.config.js file in the given root.
+* Returns the absolute path or null if not found.
+*/
+async function findConfig(root) {
+	for (const candidate of [
+		"sverka.config.ts",
+		"sverka.config.js",
+		"sverka.config.mjs"
+	]) {
+		const path = join(root, candidate);
+		if (existsSync(path)) return path;
+	}
+	return null;
+}
+/**
+* Resolve the effective config path from global flags.
+* Throws a usage error when no config can be found.
+*/
+async function resolveConfigPath$1(global) {
+	let configPath = global.config ? resolveUnderRoot(global.root, global.config) : null;
+	if (!configPath) configPath = await findConfig(global.root);
+	if (!configPath) throw new CliError("no config found (use --config to specify a path)", "MISSING_ARG", ExitCode.UsageError);
+	return configPath;
+}
+/**
+* Structural check that avoids `instanceof` across package boundaries.
+* A construct-like object (Project or bare Pipeline — single-pipeline
+* configs may skip the Project) has a `node` with an `id` string and a
+* `children` array.
+*/
+function notConstructError() {
+	return new CliError("config must export a Project or Pipeline instance (default or named 'project')", "SDK_ERROR", ExitCode.RuntimeError);
+}
+function assertConstructLike(value) {
+	if (value === null || typeof value !== "object") throw notConstructError();
+	const node = value.node;
+	if (typeof node !== "object" || node === null || typeof node.id !== "string" || !Array.isArray(node.children) || typeof node.findAll !== "function") throw notConstructError();
+}
+/**
+* Load a sverka config file and return the Project construct.
+* The config file must export a `default` Project-like instance or a named
+* `project` Project-like instance.
+*
+* @throws CliError if the config cannot be loaded or doesn't export a Project.
+*/
+async function loadConfig(configPath) {
+	const absPath = isAbsolute(configPath) ? configPath : resolve(process.cwd(), configPath);
+	if (!existsSync(absPath)) throw new CliError(`config not found: ${absPath}`, "MISSING_ARG", ExitCode.UsageError);
+	let mod;
+	try {
+		await registerConfigHooks();
+		mod = await import(pathToFileURL(absPath).href);
+	} catch (e) {
+		throw new CliError(`failed to load config: ${e instanceof Error ? e.message : String(e)}`, "SDK_ERROR", ExitCode.RuntimeError, e);
+	}
+	const construct = mod.project ?? mod.default;
+	assertConstructLike(construct);
+	return construct;
+}
+/**
+* Resolve, load, and synthesize the config for commands that need a graph.
+*/
+async function loadProjectGraph(global) {
+	const configPath = await resolveConfigPath$1(global);
+	const project = await loadConfig(configPath);
+	const warnings = collectConstructWarnings(project);
+	return {
+		configPath,
+		project,
+		graph: synthesize(project),
+		warnings
+	};
+}
+/**
+* Detect the package manager used by the project at `root`.
+* Falls back to `npm` when no lockfile or packageManager field is found.
+*/
+function detectPackageManager$1(root) {
+	const fromLockfile = detectFromLockfile(root);
+	if (fromLockfile) return fromLockfile;
+	const fromPkg = detectFromPackageJson(root);
+	if (fromPkg) return fromPkg;
+	return "npm";
+}
+function detectFromLockfile(root) {
+	if (existsSync(join(root, "bun.lockb")) || existsSync(join(root, "bun.lock"))) return "bun";
+	if (existsSync(join(root, "pnpm-lock.yaml"))) return "pnpm";
+	if (existsSync(join(root, "yarn.lock"))) return "yarn";
+	if (existsSync(join(root, "package-lock.json"))) return "npm";
+}
+function detectFromPackageJson(root) {
+	const pkgPath = join(root, "package.json");
+	if (!existsSync(pkgPath)) return void 0;
+	try {
+		const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+		if (typeof pkg.packageManager === "string") return pmFromPackageManagerField(pkg.packageManager);
+	} catch {}
+}
+function pmFromPackageManagerField(packageManager) {
+	if (packageManager.startsWith("npm")) return "npm";
+	if (packageManager.startsWith("pnpm")) return "pnpm";
+	if (packageManager.startsWith("yarn")) return "yarn";
+	if (packageManager.startsWith("bun")) return "bun";
+}
+/**
+* Ensure `@sverka/workflow` is declared as a devDependency of the target
+* project. Creates a minimal package.json when one does not exist.
+*/
+async function ensureConstructsDependency(root) {
+	const pkgPath = join(root, "package.json");
+	const base = await loadPackageBase(pkgPath);
+	const pkg = {
+		name: base.name ?? "sverka-project",
+		version: base.version ?? "0.0.0",
+		...base
+	};
+	const declared = ensureConstructsDeclared(pkg, root);
+	await writeFile(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf8");
+	return declared;
+}
+async function loadPackageBase(pkgPath) {
+	try {
+		return JSON.parse(await readFile(pkgPath, "utf8"));
+	} catch (e) {
+		if (e.code === "ENOENT") return {
+			name: "sverka-project",
+			version: "0.0.0"
+		};
+		throw new CliError(`failed to read package.json: ${e instanceof Error ? e.message : String(e)}`, "PACKAGE_ERROR", ExitCode.RuntimeError, e);
+	}
+}
+/** Dependency names that were renamed to @sverka/workflow. */
+const LEGACY_DEP_NAMES = ["@sverka/constructs", "@sverka/cdk"];
+/** Drop renamed legacy package entries from dependencies/devDependencies. */
+function removeLegacyDeps(pkg) {
+	for (const key of ["dependencies", "devDependencies"]) {
+		const deps = pkg[key];
+		if (deps === void 0) continue;
+		for (const name of LEGACY_DEP_NAMES) delete deps[name];
+		if (Object.keys(deps).length === 0) delete pkg[key];
+	}
+}
+function ensureConstructsDeclared(pkg, root) {
+	removeLegacyDeps(pkg);
+	const deps = pkg.dependencies ?? {};
+	const devDeps = pkg.devDependencies ?? {};
+	const existing = deps["@sverka/workflow"] ?? devDeps["@sverka/workflow"];
+	if (typeof existing === "string") return existing;
+	if (existing !== void 0) {
+		delete deps["@sverka/workflow"];
+		delete devDeps["@sverka/workflow"];
+	}
+	const spec = constructsDepSpec(root);
+	if (spec === null) return null;
+	pkg.devDependencies = {
+		...devDeps,
+		"@sverka/workflow": spec
+	};
+	return spec;
+}
+/**
+* Dependency spec for @sverka/workflow in the target project.
+*
+* - `workspace:*` inside the sverka monorepo itself.
+* - `^<version>` when the package resolves from a node_modules tree (a real
+*   registry install).
+* - `link:<dir>` (or `file:<dir>` for npm, which rejects the `link:`
+*   protocol) when it resolves to a bare checkout — a semver spec would
+*   fail to install when the version was never published.
+* - null when the package cannot be resolved at all — nothing is declared,
+*   the caller warns instead of writing an uninstallable spec.
+*/
+function constructsDepSpec(root) {
+	if (isLocalWorkspace(root)) return "workspace:*";
+	const resolved = resolveConstructsPackage();
+	if (resolved === null) return null;
+	if (resolved.dir.includes(`${sep}node_modules${sep}`)) return `^${resolved.version}`;
+	return `${detectPackageManager$1(root) === "npm" ? "file:" : "link:"}${resolved.dir}`;
+}
+/** Resolve the @sverka/workflow package directory and version from the CLI's context. */
+function resolveConstructsPackage() {
+	let entry;
+	try {
+		entry = fileURLToPath(import.meta.resolve("@sverka/workflow"));
+	} catch {
+		return null;
+	}
+	let dir = dirname(entry);
+	while (true) {
+		const pkgPath = join(dir, "package.json");
+		if (existsSync(pkgPath)) try {
+			const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+			if (pkg.name === "@sverka/workflow") return {
+				dir,
+				version: pkg.version ?? "0.0.0"
+			};
+		} catch {}
+		const parent = dirname(dir);
+		if (parent === dir) return null;
+		dir = parent;
+	}
+}
+function isLocalWorkspace(root) {
+	const rootPkg = join(root, "package.json");
+	const constructsPkg = join(root, "packages", "workflow", "package.json");
+	try {
+		const rootData = JSON.parse(readFileSync(rootPkg, "utf8"));
+		if (JSON.parse(readFileSync(constructsPkg, "utf8")).name !== "@sverka/workflow") return false;
+		return (Array.isArray(rootData.workspaces) ? rootData.workspaces : rootData.workspaces?.packages ?? []).some((pattern) => pattern.startsWith("packages"));
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/internal/detect.ts
+/** package.json script names that map to pipeline steps. */
+const DETECT_SCRIPT_CHECKS = [
+	"lint",
+	"typecheck",
+	"test",
+	"build",
+	"format",
+	"check"
+];
+/**
+* Read package.json scripts under root. Returns an empty map when absent or
+* malformed. Ground truth for JS/TS projects.
+*/
+function readPackageScripts(root) {
+	try {
+		const scripts = JSON.parse(readFileSync(join(root, "package.json"), "utf8")).scripts ?? {};
+		const out = {};
+		for (const [name, value] of Object.entries(scripts)) if (typeof value === "string" && value.length > 0) out[name] = value;
+		return out;
+	} catch {
+		return {};
+	}
+}
+/**
+* True when a command is a package-manager script invocation
+* (`<pm> run <script>`) whose script does not exist — a phantom step that
+* would fail with "Missing script" on first run.
+*/
+function isPhantomScriptStep(command, scripts) {
+	const m = /^(?:bun|npm|pnpm|yarn|deno)\s+run\s+([A-Za-z0-9:_-]+)/.exec(command.trim());
+	if (m === null) return false;
+	return !(m[1] in scripts);
+}
+/**
+* Detect checks for the project at `root`: planner proposals (filtered to
+* real scripts) plus any known check scripts the planner did not cover.
+*/
+async function detectProjectChecks(root) {
+	const pm = detectPackageManager$1(root);
+	const scripts = readPackageScripts(root);
+	const checks = [];
+	try {
+		const planner = createPlanner();
+		const ctx = await planner.discover({
+			root,
+			scopeToRoot: true
+		});
+		const proposal = await planner.plan(ctx);
+		if (proposal.checks.length > 0) {
+			const resolver = createBuiltinResolver();
+			const resolved = synthesizeCheckSteps(proposal.checks, ctx, resolver);
+			for (const r of resolved) {
+				const shellOp = r.step.operations.find((o) => o.kind === "shell");
+				const command = shellOp?.kind === "shell" ? shellOp.command : "";
+				if (isPhantomScriptStep(command, scripts)) continue;
+				const sarifOut = r.outputs.find((o) => o.format === "sarif");
+				checks.push({
+					checkId: r.checkId,
+					command,
+					...sarifOut !== void 0 ? { sarifOutput: sarifOut.path } : {},
+					source: "planner"
+				});
+			}
+		}
+	} catch {}
+	for (const name of DETECT_SCRIPT_CHECKS) {
+		if (!(name in scripts)) continue;
+		if (checks.some((c) => c.checkId === name)) continue;
+		checks.push({
+			checkId: name,
+			command: `${pm} run ${name}`,
+			source: "script"
+		});
+	}
+	return checks;
+}
+//#endregion
+//#region src/commands/init.ts
+function buildMinimalTemplate(pm) {
+	return [
+		"import { Project, Pipeline, ShellStep, Entry } from \"@sverka/workflow\";",
+		"",
+		"const proj = new Project(\"verify\");",
+		"const ci = new Pipeline(proj, \"ci\");",
+		`new ShellStep(ci, "lint", { command: "${pm} run lint" });`,
+		`new ShellStep(ci, "typecheck", { command: "${pm} run typecheck" });`,
+		`new ShellStep(ci, "test", { command: "${pm} run test" });`,
+		"new Entry(ci, \"on-push\", { trigger: { kind: \"push\" }, roots: [\"lint\", \"typecheck\", \"test\"] });",
+		"",
+		"export default proj;",
+		""
+	].join("\n");
+}
+function buildFullTemplate(pm) {
+	return [
+		"import { Project, Pipeline, ShellStep, Entry } from \"@sverka/workflow\";",
+		"",
+		"const proj = new Project(\"verify\");",
+		"const ci = new Pipeline(proj, \"ci\");",
+		`new ShellStep(ci, "lint", { command: "${pm} run lint" });`,
+		`new ShellStep(ci, "typecheck", { command: "${pm} run typecheck" });`,
+		`new ShellStep(ci, "test", { command: "${pm} run test" });`,
+		`new ShellStep(ci, "build", { command: "${pm} run build" });`,
+		"new Entry(ci, \"on-push\", { trigger: { kind: \"push\" }, roots: [\"lint\", \"typecheck\", \"test\", \"build\"] });",
+		"",
+		"export default proj;",
+		""
+	].join("\n");
+}
+/** Build a config from detected checks (planner + package.json scripts). */
+async function buildDetectedTemplate(root) {
+	const checks = await detectProjectChecks(root);
+	if (checks.length === 0) return null;
+	const stepLines = checks.map((c) => {
+		const id = JSON.stringify(c.checkId);
+		const cmd = JSON.stringify(c.command);
+		if (c.sarifOutput !== void 0) return `new ShellStep(ci, ${id}, { command: ${cmd}, outputs: ${"{ " + JSON.stringify(c.sarifOutput) + ": { type: \"artifact\", fromStdout: true } }"} });`;
+		return `new ShellStep(ci, ${id}, { command: ${cmd} });`;
+	});
+	const rootList = checks.map((c) => JSON.stringify(c.checkId)).join(", ");
+	return [
+		"import { Project, Pipeline, ShellStep, Entry, push } from \"@sverka/workflow\";",
+		"",
+		"const proj = new Project(\"verify\");",
+		"const ci = new Pipeline(proj, \"ci\");",
+		...stepLines,
+		`new Entry(ci, "on-push", { trigger: push(), roots: [${rootList}] });`,
+		"",
+		"export default proj;",
+		""
+	].join("\n");
+}
+/** Resolve and validate the template name, returning its file content. */
+function resolveTemplateContent(template, pm) {
+	if (template !== "minimal" && template !== "full") throw new CliError(`invalid template: ${template} (expected minimal|full)`, "INVALID_FLAG", ExitCode.UsageError);
+	return template === "full" ? buildFullTemplate(pm) : buildMinimalTemplate(pm);
+}
+/** Write the config file, creating parent directories and using exclusive create when not forcing. */
+async function writeConfig(configPath, content, force) {
+	if (existsSync(configPath) && !force) throw new CliError(`config already exists: ${configPath} (use --force to overwrite)`, "CONFIG_EXISTS", ExitCode.UsageError);
+	const flags = force ? "utf8" : {
+		encoding: "utf8",
+		flag: "wx"
+	};
+	try {
+		await mkdir(dirname(configPath), { recursive: true });
+		await writeFile(configPath, content, flags);
+	} catch (e) {
+		if (e instanceof Error && "code" in e && e.code === "EEXIST") throw new CliError(`config already exists: ${configPath} (use --force to overwrite)`, "CONFIG_EXISTS", ExitCode.UsageError, e);
+		throw e;
+	}
+}
+/** Emit the init result in the requested output format. */
+function emitInitResult(output, format, configPath, template, start) {
+	if (format === "json") output.writeLine(JSON.stringify({
+		command: "init",
+		data: {
+			path: configPath,
+			template
+		},
+		durationMs: Date.now() - start
+	}));
+	else output.writeLine(`Created ${configPath} (template: ${template})`);
+}
+/** Resolve the config path relative to root, honoring an explicit --config. */
+function resolveConfigPath(root, config) {
+	const selected = config ?? "sverka.config.ts";
+	return isAbsolute(selected) ? selected : join(root, selected);
+}
+/**
+* Create a sverka.config.ts in the root directory.
+*/
+async function initCommand(args, global, output, start) {
+	const configPath = resolveConfigPath(global.root, global.config);
+	if (existsSync(configPath) && !args.force) throw new CliError(`config already exists: ${configPath} (use --force to overwrite)`, "CONFIG_EXISTS", ExitCode.UsageError);
+	let content;
+	let template;
+	if (args.detect) {
+		await mkdir(global.root, { recursive: true });
+		output.debug(`init: root=${global.root} detect=true force=${Boolean(args.force)}`);
+		const detected = await buildDetectedTemplate(global.root);
+		if (detected !== null) {
+			content = detected;
+			template = "detect";
+		} else {
+			output.debug("init: detection found no checks, falling back to minimal template");
+			content = buildMinimalTemplate(detectPackageManager$1(global.root));
+			template = "minimal";
+		}
+	} else {
+		template = args.template ?? "minimal";
+		const pm = detectPackageManager$1(global.root);
+		output.debug(`init: root=${global.root} template=${template} pm=${pm} force=${Boolean(args.force)}`);
+		content = resolveTemplateContent(template, pm);
+		await mkdir(global.root, { recursive: true });
+	}
+	if (await ensureConstructsDependency(global.root) === null) output.errorLine("note: could not resolve @sverka/workflow — the generated config imports it; install it (e.g. bun add -d @sverka/workflow) before running sverka");
+	await writeConfig(configPath, content, Boolean(args.force));
+	emitInitResult(output, global.format, configPath, template, start);
+	return ExitCode.Success;
+}
+//#endregion
+//#region src/commands/validate.ts
+/**
+* Validate a sverka config: synthesize the Definition Graph and run validators.
+* Exit 0 if valid, 2 if missing config, 3 if load/synthesis fails.
+*/
+async function validateCommand(global, output, start) {
+	output.debug(`validate: root=${global.root} config=${global.config ?? "(auto)"}`);
+	const { configPath, graph, warnings } = await loadProjectGraph(global);
+	validateGraph(graph);
+	const durationMs = Date.now() - start;
+	if (global.format === "json") output.writeLine(JSON.stringify({
+		command: "validate",
+		data: {
+			path: configPath,
+			valid: true,
+			pipelines: graph.project.pipelines.length,
+			warnings
+		},
+		durationMs
+	}));
+	else {
+		for (const warning of warnings) output.errorLine(`warning: ${warning}`);
+		output.writeLine(`Config valid: ${configPath}`);
+		output.writeLine(`  pipelines: ${graph.project.pipelines.length}`);
+		for (const pipeline of graph.project.pipelines) output.writeLine(`    ${pipeline.id}: ${pipeline.steps.length} steps, ${pipeline.entries.length} entries`);
+	}
+	return ExitCode.Success;
+}
+//#endregion
+//#region src/internal/graph.ts
+/**
+* Return the id of the first entry found across all pipelines.
+* Returns `undefined` when the graph contains no entries.
+*/
+function resolveDefaultEntryId(graph) {
+	for (const pipeline of graph.project.pipelines) {
+		const entry = pipeline.entries[0];
+		if (entry) return entry.id;
+	}
+}
+/**
+* Return whether an entry with the given id exists in the graph.
+*/
+function entryExists(graph, entryId) {
+	for (const pipeline of graph.project.pipelines) for (const entry of pipeline.entries) if (entry.id === entryId) return true;
+	return false;
+}
+//#endregion
+//#region src/commands/plan.ts
+/**
+* Bind an Entry and Inputs into a Run Plan and display it.
+*/
+async function planCommand(args, global, output, start) {
+	output.debug(`plan: root=${global.root} entry=${args.entryId ?? "(first)"}`);
+	const { graph } = await loadProjectGraph(global);
+	const entryId = args.entryId ?? resolveDefaultEntryId(graph);
+	if (!entryId) throw new CliError("no entries in graph", "MISSING_ARG", ExitCode.UsageError);
+	if (!entryExists(graph, entryId)) throw new CliError(`entry "${entryId}" not found in graph`, "MISSING_ARG", ExitCode.UsageError);
+	const plan = bindRunPlan({
+		graph,
+		entryId
+	});
+	const durationMs = Date.now() - start;
+	if (global.format === "json") output.writeLine(JSON.stringify({
+		command: "plan",
+		data: {
+			id: plan.id,
+			graphId: plan.graphId,
+			entry: plan.entry,
+			steps: plan.steps.map((s) => s.id),
+			inputs: plan.inputs
+		},
+		durationMs
+	}));
+	else {
+		output.writeLine(`Run Plan: ${plan.id}`);
+		output.writeLine(`  entry: ${plan.entry.id}`);
+		output.writeLine(`  steps: ${plan.steps.length}`);
+		for (const step of plan.steps) {
+			const deps = step.dependencies.length > 0 ? ` (depends: ${step.dependencies.map((d) => d.producer).join(", ")})` : "";
+			output.writeLine(`    - ${step.id}${deps}`);
+		}
+	}
+	return ExitCode.Success;
+}
+//#endregion
+//#region src/commands/graph.ts
+/**
+* Display the Definition Graph: pipelines, entries, steps, and dependencies.
+*/
+async function graphCommand(global, output, start) {
+	output.debug(`graph: root=${global.root}`);
+	const { graph } = await loadProjectGraph(global);
+	const durationMs = Date.now() - start;
+	if (global.format === "json") output.writeLine(JSON.stringify({
+		command: "graph",
+		data: graph,
+		durationMs
+	}));
+	else {
+		output.writeLine(`Definition Graph: ${graph.project.id}`);
+		for (const pipeline of graph.project.pipelines) {
+			output.writeLine(`  Pipeline: ${pipeline.id}`);
+			output.writeLine(`    entries:`);
+			for (const entry of pipeline.entries) output.writeLine(`      ${entry.id} (trigger: ${entry.trigger.kind}, roots: ${entry.roots.join(", ")})`);
+			output.writeLine(`    steps:`);
+			for (const step of pipeline.steps) {
+				const deps = step.dependencies.length > 0 ? ` → [${step.dependencies.map((d) => `${d.kind}:${d.producer}`).join(", ")}]` : "";
+				output.writeLine(`      ${step.id}${deps}`);
+			}
+		}
+	}
+	return ExitCode.Success;
+}
+//#endregion
+//#region src/internal/runtime-check.ts
+/**
+* Check if a binary is available on PATH by spawning `<binary> --version`.
+* Returns true if the binary exists and exits 0, false otherwise.
+*/
+function isBinaryAvailable(binary) {
+	const result = spawnSync(binary, ["--version"], {
+		stdio: [
+			"ignore",
+			"pipe",
+			"ignore"
+		],
+		encoding: "utf8",
+		timeout: 5e3
+	});
+	return result.status === 0 && result.error === void 0;
+}
+//#endregion
+//#region src/internal/report-context.ts
+function git(root, ...args) {
+	const res = spawnSync("git", args, {
+		cwd: root,
+		encoding: "utf-8",
+		timeout: 2e3
+	});
+	return (res.status === 0 ? res.stdout?.trim() : void 0) || void 0;
+}
+/** Normalize a git remote URL (ssh or https) to a clickable web URL.
+* Credentials embedded in https remotes (user:token@host) are stripped. */
+function repoWebUrl(remote) {
+	if (!remote) return void 0;
+	const ssh = /^git@([^:]+):(.+?)(\.git)?$/.exec(remote);
+	if (ssh) return `https://${ssh[1]}/${ssh[2]}`;
+	try {
+		const url = new URL(remote);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return;
+		url.username = "";
+		url.password = "";
+		url.pathname = url.pathname.replace(/\.git$/, "");
+		return url.toString().replace(/\/$/, "");
+	} catch {
+		return;
+	}
+}
+function collectLinks(repo, commit) {
+	const links = [];
+	if (repo) links.push({
+		label: "Repo",
+		url: repo
+	});
+	if (repo && commit) links.push({
+		label: "Commit",
+		url: `${repo}/commit/${commit}`
+	});
+	if (repo && process$1.env.GITHUB_RUN_ID) links.push({
+		label: "CI run",
+		url: `${repo}/actions/runs/${process$1.env.GITHUB_RUN_ID}`
+	});
+	return links;
+}
+function collectReportContext(root, command) {
+	const env = process$1.env;
+	const repo = (env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY ? `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}` : void 0) ?? repoWebUrl(git(root, "remote", "get-url", "origin"));
+	const commit = env.GITHUB_SHA ?? git(root, "rev-parse", "HEAD");
+	const branch = env.GITHUB_REF_NAME ?? git(root, "rev-parse", "--abbrev-ref", "HEAD");
+	const meta = [...branch ? [{
+		label: "Branch",
+		value: branch
+	}] : [], {
+		label: "Directory",
+		value: root
+	}];
+	return {
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		command,
+		meta,
+		links: collectLinks(repo, commit)
+	};
+}
+//#endregion
+//#region src/commands/run.ts
+/**
+* Execute a Run Plan through the native engine and print events.
+*/
+async function runCommand(args, global, output, start) {
+	const executor = args.executor ?? "host";
+	const isSarif = global.format === "sarif";
+	const isWeb = global.format === "web";
+	const isHtml = global.format === "html" || args.output !== void 0 && !isSarif && !isWeb;
+	const evaluate = args.evaluate || isHtml || isSarif || isWeb;
+	output.debug(`run: root=${global.root} executor=${executor} entry=${args.entryId ?? "(first)"} format=${global.format}`);
+	assertExecutorAvailable(executor);
+	const { graph, warnings } = await loadProjectGraph(global);
+	for (const warning of warnings) output.errorLine(`warning: ${warning}`);
+	const entryId = resolveEntryId(graph, args.entryId);
+	const plan = bindRunPlan({
+		graph,
+		entryId
+	});
+	const workspace = global.root;
+	const artifactDir = join(global.root, ".sverka", "artifacts");
+	if (args.jobs !== void 0 && (!Number.isInteger(args.jobs) || args.jobs < 1 || args.jobs > 64)) throw new CliError("--jobs must be an integer in [1, 64]", "INVALID_FLAG", ExitCode.UsageError);
+	const { events, runStatus, renderer } = await consumeEvents(createEngine({
+		drivers: buildDrivers(executor),
+		maxConcurrent: args.jobs ?? 4
+	}), plan, {
+		workspace,
+		artifactDir
+	}, global, output, graph, args);
+	const durationMs = Date.now() - start;
+	let policyExitCode = 0;
+	let evalResult = null;
+	let collectionFailed = false;
+	if (evaluate) {
+		const result = await runEvaluation(artifactDir, global, output, events, renderer, args);
+		policyExitCode = result.exitCode;
+		evalResult = result.summary;
+		collectionFailed = result.summary === null && result.exitCode === ExitCode.RuntimeError;
+	}
+	renderer?.flush();
+	if (isHtml && renderer) {
+		const reportPath = args.output ?? join(global.root, ".sverka", "report.html");
+		output.writeLine(`Wrote HTML report to ${reportPath}`);
+	}
+	if (renderer && "waitUntilExit" in renderer) await renderer.waitUntilExit();
+	if (collectionFailed) return policyExitCode;
+	writeRunOutput(plan.id, runStatus, events, durationMs, global, output, evalResult);
+	if (evaluate && policyExitCode !== 0) return policyExitCode;
+	return exitCodeForStatus(runStatus);
+}
+function assertExecutorAvailable(executor) {
+	if (executor === "docker" && !isBinaryAvailable("docker")) throw new CliError("docker executor not available (docker not found on PATH)", "RUNTIME_NOT_AVAILABLE", ExitCode.RuntimeError);
+}
+function resolveEntryId(graph, entryId) {
+	const resolved = entryId ?? resolveDefaultEntryId(graph);
+	if (!resolved) throw new CliError("no entries in graph", "MISSING_ARG", ExitCode.UsageError);
+	if (!entryExists(graph, resolved)) throw new CliError(`entry "${resolved}" not found in graph`, "MISSING_ARG", ExitCode.UsageError);
+	return resolved;
+}
+function buildDrivers(executor) {
+	const drivers = [createHostDriver({
+		enabled: true,
+		allowlist: {
+			entries: [],
+			isAllowed: () => true
+		},
+		envAllowlist: [
+			"PATH",
+			"HOME",
+			"USER",
+			"SHELL",
+			"TMPDIR",
+			"XDG_CONFIG_HOME",
+			"XDG_CACHE_HOME",
+			"XDG_DATA_HOME",
+			"XDG_STATE_HOME",
+			"XDG_RUNTIME_DIR"
+		]
+	})];
+	if (executor === "docker") drivers.push(createDockerDriver({}));
+	return drivers;
+}
+async function consumeEvents(engine, plan, ctx, global, output, graph, args) {
+	const events = [];
+	let runStatus = "failure";
+	const { createTextRenderer, createHtmlRenderer, createInkRenderer } = await import("@sverka/reporter");
+	let renderer = null;
+	const isSarif = global.format === "sarif";
+	const isWeb = global.format === "web";
+	const isHtml = global.format === "html" || args.output !== void 0 && !isSarif && !isWeb;
+	if (args.tui === true && !global.quiet && !isHtml && !isSarif && !isWeb && global.format === "text") try {
+		renderer = createInkRenderer({ graph });
+	} catch {
+		renderer = createTextRenderer({ writer: output });
+	}
+	else if (global.format === "text" && !isHtml) renderer = createTextRenderer({ writer: output });
+	else if (isHtml) renderer = createHtmlRenderer({
+		outputPath: args.output ?? join(global.root, ".sverka", "report.html"),
+		graph,
+		context: collectReportContext(global.root, `sverka ${process$1.argv.slice(2).join(" ")}`)
+	});
+	for await (const event of engine.run({
+		plan,
+		workspace: ctx.workspace,
+		artifactDir: ctx.artifactDir
+	})) {
+		events.push(event);
+		renderer?.onEvent(event);
+		if (event.type === "run-completed") runStatus = event.status;
+	}
+	return {
+		events,
+		runStatus,
+		renderer
+	};
+}
+async function runEvaluation(artifactDir, global, output, _events, renderer, args) {
+	const { collectFindings, evaluateGate, ReporterError } = await import("@sverka/reporter");
+	let rows;
+	try {
+		rows = await collectFindings({ artifactDir });
+	} catch (e) {
+		if (e instanceof ReporterError) {
+			if (global.format === "json") output.writeLine(JSON.stringify({
+				command: "run",
+				error: "COLLECTION_FAILED",
+				message: e.message
+			}));
+			else output.writeLine(`Collection failed: ${e.message}`);
+			return {
+				exitCode: ExitCode.RuntimeError,
+				summary: null
+			};
+		}
+		throw e;
+	}
+	const findings = rows.map((r) => r.finding);
+	const { result, exitCode } = evaluateGate({ findings });
+	if (renderer) {
+		renderer.onFindings(findings);
+		renderer.onVerdict(result);
+		renderer.flush();
+	}
+	if (global.format === "sarif") {
+		const sarifPath = args.output ?? join(global.root, ".sverka", "findings.sarif");
+		const sarifLog = serializeSarif(findings);
+		mkdirSync(dirname(sarifPath), { recursive: true });
+		writeFileSync(sarifPath, JSON.stringify(sarifLog, null, 2), "utf-8");
+		output.writeLine(`Wrote SARIF to ${sarifPath}`);
+	}
+	if (global.format === "web") {
+		const webPath = args.output ?? join(global.root, ".sverka", "report.html");
+		try {
+			const { generateSarifHtml } = await import("@sverka/sarif-viewer-web");
+			const html = generateSarifHtml(findings);
+			mkdirSync(dirname(webPath), { recursive: true });
+			writeFileSync(webPath, html, "utf-8");
+			output.writeLine(`Wrote HTML report to ${webPath}`);
+		} catch (e) {
+			output.errorLine(`sverka run: failed to generate web report: ${e instanceof Error ? e.message : String(e)}`);
+			return {
+				exitCode: 1,
+				summary: {
+					findings,
+					verdict: result.verdict,
+					summary: result.summary
+				}
+			};
+		}
+	}
+	return {
+		exitCode,
+		summary: {
+			findings,
+			verdict: result.verdict,
+			summary: result.summary
+		}
+	};
+}
+const SIMPLE_STEP_STATUSES = {
+	"step-skipped": "skipped",
+	"step-cancelled": "cancelled",
+	"step-suspended": "suspended"
+};
+/** Extract per-step results from the event stream for JSON output. */
+function summarizeSteps(events) {
+	const steps = [];
+	for (const event of events) {
+		const step = summarizeStep(event);
+		if (step !== void 0) steps.push(step);
+	}
+	return steps;
+}
+function summarizeStep(event) {
+	if (event.type === "step-succeeded" || event.type === "step-failed") return {
+		stepId: event.stepId,
+		status: event.type === "step-succeeded" ? "succeeded" : "failed",
+		durationMs: event.durationMs,
+		...event.type === "step-failed" ? { error: event.error } : {},
+		...capturedOutputFields(event)
+	};
+	if (event.type === "step-cache-hit") return {
+		stepId: event.stepId,
+		status: "cache-hit",
+		cacheKey: event.key
+	};
+	const status = SIMPLE_STEP_STATUSES[event.type];
+	if (status === void 0 || !("stepId" in event)) return void 0;
+	return {
+		stepId: event.stepId,
+		status
+	};
+}
+function capturedOutputFields(event) {
+	return {
+		...event.stdout !== void 0 ? { stdout: event.stdout } : {},
+		...event.stderr !== void 0 ? { stderr: event.stderr } : {},
+		...event.exitCode !== void 0 ? { exitCode: event.exitCode } : {}
+	};
+}
+function writeRunOutput(planId, runStatus, events, durationMs, global, output, evalResult) {
+	if (global.format === "json") {
+		const steps = summarizeSteps(events);
+		output.writeLine(JSON.stringify({
+			command: "run",
+			data: {
+				planId,
+				status: runStatus,
+				steps,
+				...evalResult ? {
+					findings: evalResult.findings.length,
+					verdict: evalResult.verdict,
+					summary: evalResult.summary
+				} : {}
+			},
+			durationMs
+		}));
+	}
+}
+function exitCodeForStatus(runStatus) {
+	if (runStatus === "success") return ExitCode.Success;
+	if (runStatus === "failure") return ExitCode.PolicyFail;
+	return ExitCode.RuntimeError;
+}
+//#endregion
+//#region src/commands/discover.ts
+/**
+* Discover project context and display it.
+*/
+async function discoverCommand(global, output, start) {
+	output.debug(`discover: root=${global.root}`);
+	const ctx = await createPlanner().discover({ root: global.root });
+	const durationMs = Date.now() - start;
+	if (global.format === "json") output.writeLine(JSON.stringify({
+		command: "discover",
+		data: {
+			root: ctx.root,
+			commit: ctx.commit,
+			dirty: ctx.dirty,
+			languages: ctx.languages,
+			packageManagers: ctx.packageManagers,
+			hasContainerBuild: ctx.hasContainerBuild,
+			hasCiDefinition: ctx.hasCiDefinition,
+			monorepo: ctx.monorepo,
+			changedFiles: ctx.changedFiles.length
+		},
+		durationMs
+	}));
+	else {
+		output.writeLine(`Project: ${ctx.root}`);
+		output.writeLine(`  commit: ${ctx.commit || "(none)"}`);
+		output.writeLine(`  dirty: ${ctx.dirty}`);
+		output.writeLine(`  languages: ${ctx.languages.map((l) => l.name).join(", ") || "(none)"}`);
+		output.writeLine(`  package managers: ${ctx.packageManagers.map((p) => p.name).join(", ") || "(none)"}`);
+		output.writeLine(`  container build: ${ctx.hasContainerBuild}`);
+		output.writeLine(`  CI definition: ${ctx.hasCiDefinition}`);
+		if (ctx.monorepo) output.writeLine(`  monorepo: ${ctx.monorepo.tool} (${ctx.monorepo.workspaces.length} workspaces)`);
+		output.writeLine(`  changed files: ${ctx.changedFiles.length}`);
+	}
+	return ExitCode.Success;
+}
+//#endregion
+//#region src/commands/check.ts
+/**
+* Discover project checks (planner + package.json scripts) and display the
+* steps they would become — the same detection `init --detect` uses.
+*/
+async function checkCommand(global, output, start) {
+	output.debug(`check: root=${global.root}`);
+	const checks = await detectProjectChecks(global.root);
+	const durationMs = Date.now() - start;
+	if (global.format === "json") output.writeLine(JSON.stringify({
+		command: "check",
+		data: {
+			proposed: checks.map((c) => c.checkId),
+			resolved: checks.map((c) => ({
+				id: c.checkId,
+				command: c.command
+			}))
+		},
+		durationMs
+	}));
+	else {
+		output.writeLine(`Proposed checks: ${checks.length}`);
+		for (const c of checks) output.writeLine(`  - ${c.checkId} (${c.source}): ${c.command}`);
+	}
+	return ExitCode.Success;
+}
+//#endregion
+//#region src/commands/policy.ts
+/**
+* Evaluate findings against the default policy.
+* In v0, this is a placeholder — findings come from a baseline file
+* or are empty (no execution output to extract from yet).
+*/
+async function policyCommand(args, global, output, start) {
+	output.debug(`policy: root=${global.root} findings=${args.findings} baseline=${args.baseline ?? "(none)"}`);
+	const findings = normalizeFindings(await loadFindingsFile(resolveUnderRoot(global.root, args.findings)), {
+		root: global.root,
+		checkIdPrefix: "",
+		defaultConfidence: .5
+	});
+	const baselineFingerprints = await loadBaselineFingerprints(global.root, args.baseline);
+	const result = evaluatePolicy(findings, DEFAULT_POLICY, [...baselineFingerprints]);
+	writePolicyOutput(result, global, output, Date.now() - start);
+	return result.verdict === "pass" ? ExitCode.Success : ExitCode.PolicyFail;
+}
+async function loadFindingsFile(findingsPath) {
+	if (!existsSync(findingsPath)) throw new CliError(`findings file not found: ${findingsPath}`, "MISSING_ARG", ExitCode.UsageError);
+	try {
+		return JSON.parse(await readFile(findingsPath, "utf8"));
+	} catch (e) {
+		throw new CliError(`failed to parse findings file: ${e instanceof Error ? e.message : String(e)}`, "SDK_ERROR", ExitCode.RuntimeError, e);
+	}
+}
+function normalizeFindings(raw, ctx) {
+	try {
+		return normalizeSarif(raw, ctx);
+	} catch (e) {
+		throw new CliError(`failed to normalize findings: ${e instanceof Error ? e.message : String(e)}`, "SDK_ERROR", ExitCode.RuntimeError, e);
+	}
+}
+async function loadBaselineFingerprints(root, baseline) {
+	if (!baseline) return [];
+	const baselinePath = resolveUnderRoot(root, baseline);
+	try {
+		return (await loadBaseline(baselinePath)).fingerprints;
+	} catch (e) {
+		throw new CliError(`failed to load baseline: ${e instanceof Error ? e.message : String(e)}`, "SDK_ERROR", ExitCode.RuntimeError, e);
+	}
+}
+function writePolicyOutput(result, global, output, durationMs) {
+	if (global.format === "json") output.writeLine(JSON.stringify({
+		command: "policy",
+		data: {
+			verdict: result.verdict,
+			summary: result.summary,
+			triggered: result.triggered.length
+		},
+		durationMs
+	}));
+	else {
+		output.writeLine(`Policy: ${result.verdict}`);
+		output.writeLine(`  ${result.summary}`);
+	}
+}
+//#endregion
+//#region src/internal/ci-setup.ts
+/**
+* Detect the toolchain setup a generated GitHub workflow needs on a clean
+* runner: the package-manager action + dependency install, and recursive
+* submodule checkout when the repo has .gitmodules.
+*
+* The declared `packageManager` version is honored where the toolchain
+* supports it: `bun-version` for bun, Corepack for pnpm/yarn (both read the
+* `packageManager` field), and an explicit global install for npm.
+*
+* Always emits `checkoutWith` with `persist-credentials: false` —
+* generated YAML never persists the GITHUB_TOKEN, even when nothing else
+* was detected.
+*/
+function detectCiSetup(root) {
+	const setup = detectPackageManagerSetup(root);
+	const checkoutWith = existsSync(join(root, ".gitmodules")) ? {
+		"persist-credentials": false,
+		submodules: "recursive"
+	} : { "persist-credentials": false };
+	return {
+		...setup.length > 0 ? { setup } : {},
+		checkoutWith
+	};
+}
+function detectPackageManagerSetup(root) {
+	const { name, version } = detectPackageManager(root);
+	if (name === "bun") return bunSteps(version);
+	if (name === void 0) return [];
+	const node = setupNodeStep(root);
+	switch (name) {
+		case "pnpm": return pnpmSteps(version, node);
+		case "yarn": return yarnSteps(version, node);
+		case "npm": return npmSteps(root, version, node);
+		default: return [];
+	}
+}
+/** setup-node step — pins Node from engines.node (a semver range), else lts. */
+function setupNodeStep(root) {
+	return {
+		name: "Setup Node",
+		uses: "actions/setup-node@v7",
+		with: { "node-version": nodeVersion(root) }
+	};
+}
+function nodeVersion(root) {
+	try {
+		const raw = readFileSync(join(root, "package.json"), "utf8");
+		const engines = JSON.parse(raw).engines?.node;
+		if (typeof engines === "string" && engines.trim() !== "") return engines;
+	} catch {}
+	return "lts/*";
+}
+function bunSteps(version) {
+	return [{
+		name: "Setup Bun",
+		uses: "oven-sh/setup-bun@v2",
+		...version ? { with: { "bun-version": version } } : {}
+	}, {
+		name: "Install dependencies",
+		run: "bun install --frozen-lockfile --ignore-scripts"
+	}];
+}
+function pnpmSteps(version, node) {
+	return [
+		{
+			name: "Setup pnpm",
+			uses: "pnpm/action-setup@v4",
+			...version ? {} : { with: { version: "latest" } }
+		},
+		node,
+		{
+			name: "Install dependencies",
+			run: "pnpm install --frozen-lockfile --ignore-scripts"
+		}
+	];
+}
+function yarnSteps(version, node) {
+	return [
+		node,
+		...version ? [{
+			name: "Enable Corepack",
+			run: "corepack enable"
+		}] : [],
+		{
+			name: "Install dependencies",
+			run: "yarn install"
+		}
+	];
+}
+function npmSteps(root, version, node) {
+	return [
+		node,
+		...version ? [{
+			name: "Pin npm",
+			run: `npm install -g "npm@${version}"`
+		}] : [],
+		{
+			name: "Install dependencies",
+			run: existsSync(join(root, "package-lock.json")) ? "npm ci --ignore-scripts" : "npm install --ignore-scripts"
+		}
+	];
+}
+function detectPackageManager(root) {
+	const declared = packageManagerField(root);
+	if (declared) return declared;
+	if (existsSync(join(root, "bun.lock")) || existsSync(join(root, "bun.lockb"))) return { name: "bun" };
+	if (existsSync(join(root, "pnpm-lock.yaml"))) return { name: "pnpm" };
+	if (existsSync(join(root, "yarn.lock"))) return { name: "yarn" };
+	if (existsSync(join(root, "package-lock.json"))) return { name: "npm" };
+	if (existsSync(join(root, "package.json"))) return { name: "npm" };
+	return {};
+}
+function packageManagerField(root) {
+	try {
+		const raw = readFileSync(join(root, "package.json"), "utf8");
+		const pm = JSON.parse(raw).packageManager;
+		if (typeof pm !== "string") return void 0;
+		const [name, version] = pm.split("@");
+		if (name === "bun" || name === "pnpm" || name === "yarn" || name === "npm") return version !== void 0 ? {
+			name,
+			version
+		} : { name };
+	} catch {}
+}
+//#endregion
+//#region src/commands/compile.ts
+/** Compile the Definition Graph to a target CI YAML. */
+async function compileCommand(args, global, output, start) {
+	const target = args.target;
+	if (target !== "github" && target !== "gitlab") throw new CliError(`invalid compile target: ${target} (expected github or gitlab)`, "INVALID_FLAG", ExitCode.UsageError);
+	if (args.output && args.outputDir) throw new CliError("--output and --output-dir are mutually exclusive", "INVALID_FLAG", ExitCode.UsageError);
+	output.debug(`compile: root=${global.root} target=${target} output=${args.output ?? "stdout"}`);
+	const { graph } = await loadProjectGraph(global);
+	const result = target === "github" ? compileGithub(graph, {
+		...detectCiSetup(global.root),
+		...args.pin ? { pinning: { mode: "strict" } } : {}
+	}) : compileGitlab(graph);
+	let hasError = false;
+	for (const d of result.diagnostics) {
+		output.errorLine(`[${d.severity}] ${d.capability}: ${d.message}`);
+		if (d.severity === "error") hasError = true;
+	}
+	const yaml = result.artifacts.map((a) => a.content).join("\n---\n");
+	if (result.artifacts.length > 1 && !args.outputDir) {
+		if (args.output) throw new CliError(`--output cannot represent ${result.artifacts.length} artifacts; use --output-dir`, "INVALID_FLAG", ExitCode.UsageError);
+		output.errorLine(`[warning] ${result.artifacts.length} artifacts glued into one stream; use --output-dir to write separate files`);
+	}
+	if (args.outputDir) {
+		const outDir = resolve(global.root, args.outputDir);
+		await mkdir(outDir, { recursive: true });
+		const realOutDir = await realpath(outDir);
+		const contained = (base, p) => {
+			const rel = relative(base, p);
+			return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+		};
+		const written = [];
+		for (const a of result.artifacts) {
+			const outPath = resolve(outDir, a.path);
+			const escapes = () => new CliError(`artifact path escapes output dir: ${a.path}`, "INVALID_FLAG", ExitCode.UsageError);
+			if (!contained(outDir, outPath)) throw escapes();
+			for (let ancestor = dirname(outPath);;) try {
+				const realAncestor = await realpath(ancestor);
+				if (!contained(realOutDir, join(realAncestor, relative(ancestor, outPath)))) throw escapes();
+				break;
+			} catch (e) {
+				if (e instanceof CliError) throw e;
+				if (e.code !== "ENOENT") throw e;
+				const up = dirname(ancestor);
+				if (up === ancestor) break;
+				ancestor = up;
+			}
+			await mkdir(dirname(outPath), { recursive: true });
+			const flags = constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW;
+			let fh;
+			try {
+				fh = await open(outPath, flags);
+			} catch (e) {
+				if (e.code === "ELOOP") throw escapes();
+				throw e;
+			}
+			try {
+				await fh.writeFile(a.content);
+			} finally {
+				await fh.close();
+			}
+			written.push(outPath);
+		}
+		if (global.format === "json") output.writeLine(JSON.stringify({
+			command: "compile",
+			data: {
+				target,
+				paths: written
+			},
+			durationMs: Date.now() - start
+		}));
+		else for (const p of written) output.writeLine(`Compiled ${target} workflow to ${p}`);
+	} else if (args.output) {
+		const outPath = resolve(global.root, args.output);
+		await mkdir(dirname(outPath), { recursive: true });
+		await writeFile(outPath, yaml, "utf8");
+		if (global.format === "json") output.writeLine(JSON.stringify({
+			command: "compile",
+			data: {
+				target,
+				path: outPath
+			},
+			durationMs: Date.now() - start
+		}));
+		else output.writeLine(`Compiled ${target} workflow to ${outPath}`);
+	} else if (global.format === "json") output.writeLine(JSON.stringify({
+		command: "compile",
+		data: {
+			target,
+			yaml
+		},
+		durationMs: Date.now() - start
+	}));
+	else output.write(yaml);
+	return hasError ? ExitCode.RuntimeError : ExitCode.Success;
+}
+//#endregion
+//#region src/commands/synth.ts
+/**
+* Alias for `compile`. Delegates to compileCommand.
+*/
+async function synthCommand(args, global, output, start) {
+	return compileCommand(args, global, output, start);
+}
+//#endregion
+//#region src/internal/buffering-writer.ts
+/**
+* OutputWriter for MCP tool execution: captures structured stdout output
+* (command handlers emit JSON when format="json") and routes all error/debug
+* output to stderr. stdout is reserved for MCP JSON-RPC transport.
+*/
+var BufferingOutputWriter = class {
+	#buffer = "";
+	write(text) {
+		this.#buffer += text;
+	}
+	writeLine(text) {
+		this.#buffer += text + "\n";
+	}
+	error(text) {
+		process$1.stderr.write(text);
+	}
+	errorLine(text) {
+		process$1.stderr.write(text + "\n");
+	}
+	debug(text) {
+		process$1.stderr.write(text + "\n");
+	}
+	/** The captured stdout content (JSON string from the command handler). */
+	get captured() {
+		return this.#buffer;
+	}
+};
+//#endregion
+//#region src/internal/mcp-tools.ts
+/** Build GlobalFlags for JSON-format command execution. */
+function jsonFlags(root) {
+	return {
+		format: "json",
+		config: null,
+		root,
+		quiet: false,
+		verbose: false
+	};
+}
+/** Safely parse JSON, returning null on failure. */
+function safeJsonParse(text) {
+	try {
+		return JSON.parse(text);
+	} catch {
+		return null;
+	}
+}
+/**
+* Run a CLI command handler with a buffering writer and return an MCP
+* CallToolResult. On success (exit 0), the captured JSON `data` field is
+* returned as text content. On failure, isError is set with the error message.
+*/
+async function runCommandAsTool(fn, root) {
+	const writer = new BufferingOutputWriter();
+	const global = jsonFlags(root);
+	const start = Date.now();
+	try {
+		const exitCode = await fn(writer, global, start);
+		const text = writer.captured.trim();
+		if (exitCode === ExitCode.Success) {
+			const parsed = text ? safeJsonParse(text) : null;
+			const data = parsed && typeof parsed === "object" && "data" in parsed ? parsed.data : parsed ?? {};
+			return { content: [{
+				type: "text",
+				text: JSON.stringify(data)
+			}] };
+		}
+		const parsed = text ? safeJsonParse(text) : null;
+		return {
+			content: [{
+				type: "text",
+				text: parsed ? JSON.stringify(parsed) : text || `exit code ${exitCode}`
+			}],
+			isError: true
+		};
+	} catch (e) {
+		return {
+			content: [{
+				type: "text",
+				text: e instanceof Error ? e.message : String(e)
+			}],
+			isError: true
+		};
+	}
+}
+z.string().optional(), z.string().optional(), z.string().optional(), z.string().optional(), z.string().optional(), z.string().optional(), z.enum(["host", "docker"]).optional(), z.string().optional(), z.enum(["github", "gitlab"]);
+/**
+* Register all 5 Sverka MCP tools on the given McpServer.
+* Each tool maps to the corresponding CLI command handler.
+*/
+function registerSverkaTools(server, defaultRoot) {
+	server.tool("sverka.validate", "Validate a sverka config: synthesize the Definition Graph and run validators.", { root: z.string().optional() }, async (args) => {
+		return runCommandAsTool((w, g, s) => validateCommand(g, w, s), args.root ?? defaultRoot);
+	});
+	server.tool("sverka.plan", "Bind an Entry and inputs into a Run Plan and return the step list.", {
+		root: z.string().optional(),
+		entryId: z.string().optional()
+	}, async (args) => {
+		return runCommandAsTool((w, g, s) => planCommand({ ...args.entryId !== void 0 && { entryId: args.entryId } }, g, w, s), args.root ?? defaultRoot);
+	});
+	server.tool("sverka.graph", "Display the Definition Graph: pipelines, entries, steps, and dependencies.", { root: z.string().optional() }, async (args) => {
+		return runCommandAsTool((w, g, s) => graphCommand(g, w, s), args.root ?? defaultRoot);
+	});
+	server.tool("sverka.run", "Execute the workflow locally through the native engine and return the run status.", {
+		root: z.string().optional(),
+		entryId: z.string().optional(),
+		executor: z.enum(["host", "docker"]).optional()
+	}, async (args) => {
+		return runCommandAsTool((w, g, s) => runCommand({
+			...args.entryId !== void 0 && { entryId: args.entryId },
+			...args.executor !== void 0 && { executor: args.executor }
+		}, g, w, s), args.root ?? defaultRoot);
+	});
+	server.tool("sverka.synth", "Compile the workflow to a target CI YAML (github or gitlab).", {
+		root: z.string().optional(),
+		target: z.enum(["github", "gitlab"])
+	}, async (args) => {
+		return synthTool(args.root ?? defaultRoot, args.target);
+	});
+}
+/** Run the synth tool: load graph, compile to target, return artifacts. */
+async function synthTool(root, target) {
+	try {
+		const { graph } = await loadProjectGraph({
+			root,
+			config: null
+		});
+		const result = target === "github" ? compileGithub(graph) : compileGitlab(graph);
+		const data = {
+			target,
+			artifacts: result.artifacts.map((a) => ({
+				path: a.path,
+				content: a.content
+			})),
+			diagnostics: result.diagnostics
+		};
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(data)
+		}] };
+	} catch (e) {
+		return {
+			content: [{
+				type: "text",
+				text: e instanceof Error ? e.message : String(e)
+			}],
+			isError: true
+		};
+	}
+}
+//#endregion
+//#region src/commands/mcp-server.ts
+/**
+* Start an MCP server over stdio that exposes Sverka operations as tools.
+* External AI agents can invoke sverka.validate, sverka.plan, sverka.graph,
+* sverka.run, and sverka.synth via the Model Context Protocol.
+*
+* The server runs until stdin closes or SIGTERM is received. stdout is
+* reserved for MCP JSON-RPC transport — all logs go to stderr.
+*
+* @param shutdownSignal Optional promise that resolves to signal shutdown
+*   (for testing). In production, the server waits for stdin close / SIGTERM.
+*/
+async function mcpServerCommand(_args, global, output, _start, shutdownSignal) {
+	output.debug(`mcp-server: root=${global.root}`);
+	const { McpServer } = await import("@modelcontextprotocol/sdk/server/mcp.js");
+	const { StdioServerTransport } = await import("@modelcontextprotocol/sdk/server/stdio.js");
+	const server = new McpServer({
+		name: "sverka",
+		version: cliVersion()
+	});
+	registerSverkaTools(server, global.root);
+	const transport = new StdioServerTransport();
+	try {
+		await server.connect(transport);
+	} catch (e) {
+		const msg = e instanceof Error ? e.message : String(e);
+		output.errorLine(`mcp-server: failed to start: ${msg}`);
+		return ExitCode.RuntimeError;
+	}
+	await (shutdownSignal ?? waitForStdinClose());
+	await server.close();
+	return ExitCode.Success;
+}
+/** Wait for stdin close or SIGTERM. */
+function waitForStdinClose() {
+	return new Promise((resolve) => {
+		const cleanup = () => {
+			process$1.stdin.off("end", cleanup);
+			process$1.stdin.off("close", cleanup);
+			process$1.off("SIGTERM", cleanup);
+			resolve();
+		};
+		process$1.stdin.on("end", cleanup);
+		process$1.stdin.on("close", cleanup);
+		process$1.on("SIGTERM", cleanup);
+	});
+}
+//#endregion
+//#region src/commands/doctor.ts
+/**
+* Check the environment: Node.js, Bun, git. Reports status of each.
+* Exit 0 when all pass, 3 when a required tool is missing.
+*/
+async function doctorCommand(global, output, start) {
+	output.debug(`doctor: root=${global.root}`);
+	const checks = [
+		runCheck("node", "node", true),
+		runCheck("bun", "bun", false),
+		runCheck("git", "git", true)
+	];
+	const allOk = checks.every((c) => !c.required || c.status === "ok");
+	const exitCode = allOk ? ExitCode.Success : ExitCode.RuntimeError;
+	const durationMs = Date.now() - start;
+	if (global.format === "json") output.writeLine(JSON.stringify({
+		command: "doctor",
+		data: {
+			checks,
+			allOk
+		},
+		durationMs
+	}));
+	else {
+		output.writeLine("Environment diagnostics:");
+		for (const check of checks) {
+			const version = check.version ? `v${check.version}` : "NOT FOUND";
+			output.writeLine(`  ${check.name}: ${version}`);
+		}
+		output.writeLine(allOk ? "All checks passed." : "Some checks failed.");
+	}
+	return exitCode;
+}
+function runCheck(name, binary, required) {
+	try {
+		const result = spawnSync(binary, ["--version"], {
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			],
+			encoding: "utf8",
+			timeout: 5e3
+		});
+		if (result.status !== 0 || result.error) return {
+			name,
+			status: "missing",
+			version: null,
+			required
+		};
+		const out = result.stdout.trim();
+		return {
+			name,
+			status: "ok",
+			version: out.match(/(\d+\.\d+\.\d+[^\s]*)/)?.[1] ?? out,
+			required
+		};
+	} catch {
+		return {
+			name,
+			status: "missing",
+			version: null,
+			required
+		};
+	}
+}
+//#endregion
+//#region src/commands/view.ts
+/**
+* View SARIF findings in the terminal TUI or generate an HTML report.
+*/
+async function viewCommand(args, global, output, start) {
+	let sarifJson;
+	if (args.file) try {
+		sarifJson = readFileSync(args.file, "utf8");
+	} catch (e) {
+		throw new CliError(`failed to read SARIF file: ${e instanceof Error ? e.message : String(e)}`, "MISSING_ARG", ExitCode.RuntimeError);
+	}
+	else if (!process$1.stdin.isTTY) {
+		sarifJson = readFileSync(0, "utf8");
+		if (sarifJson.trim() === "") {
+			output.errorLine("sverka view: stdin is empty.");
+			return ExitCode.RuntimeError;
+		}
+	} else {
+		output.errorLine("sverka view: no input. Provide a SARIF file argument or pipe SARIF via stdin.");
+		return ExitCode.UsageError;
+	}
+	let sarif;
+	try {
+		sarif = JSON.parse(sarifJson);
+	} catch (e) {
+		output.errorLine(`sverka view: invalid JSON: ${e instanceof Error ? e.message : String(e)}`);
+		return ExitCode.RuntimeError;
+	}
+	if (args.format === "web") return renderWeb(sarif, args, output);
+	return renderTui(sarif, output);
+}
+/** Launch the TUI viewer using @sverka/sarif-viewer-tui. */
+async function renderTui(sarif, output) {
+	try {
+		const { renderSarifTui } = await import("@sverka/sarif-viewer-tui");
+		await renderSarifTui({ sarif });
+		return ExitCode.Success;
+	} catch (e) {
+		output.errorLine(`sverka view: ${e instanceof Error ? e.message : String(e)}`);
+		return ExitCode.RuntimeError;
+	}
+}
+/** Generate an HTML report using @sverka/sarif-viewer-web. */
+async function renderWeb(sarif, args, output) {
+	try {
+		const { renderSarifWeb } = await import("@sverka/sarif-viewer-web");
+		const outputPath = args.output ?? "sarif-report.html";
+		renderSarifWeb({
+			sarif,
+			outputPath
+		});
+		output.writeLine(`Wrote ${outputPath}`);
+		return ExitCode.Success;
+	} catch (e) {
+		output.errorLine(`sverka view: ${e instanceof Error ? e.message : String(e)}`);
+		return ExitCode.RuntimeError;
+	}
+}
+//#endregion
+//#region src/commands/ui.ts
+/**
+* Start a local web dashboard server that lists SARIF files
+* and renders individual findings reports.
+*/
+async function uiCommand(args, global, output, _start) {
+	const artifactsDir = join(global.root, ".sverka", "artifacts");
+	const port = args.port ?? 3e3;
+	const host = args.host ?? "localhost";
+	try {
+		const { startUiServer } = await import("@sverka/ui");
+		const server = await startUiServer({
+			artifactsDir,
+			port,
+			host
+		});
+		output.writeLine(`Sverka UI running at ${server.url}`);
+		output.writeLine(`Artifacts: ${artifactsDir}`);
+		output.writeLine("Press Ctrl+C to stop.");
+		process$1.once("SIGINT", () => {
+			server.close();
+			process$1.exit(ExitCode.Success);
+		});
+		return new Promise(() => {});
+	} catch (e) {
+		output.errorLine(`sverka ui: ${e instanceof Error ? e.message : String(e)}`);
+		return ExitCode.RuntimeError;
+	}
+}
+//#endregion
+//#region src/main.ts
+/** Build GlobalFlags from parsed yargs options. */
+function buildGlobalFlags(parsed) {
+	return {
+		format: resolveFormat(parsed.format),
+		config: typeof parsed.config === "string" ? parsed.config : null,
+		root: typeof parsed.root === "string" ? parsed.root : process$1.cwd(),
+		quiet: Boolean(parsed.quiet),
+		verbose: Boolean(parsed.verbose)
+	};
+}
+/** Resolve the format string from parsed yargs. */
+function resolveFormat(format) {
+	if (format === "json") return "json";
+	if (format === "html") return "html";
+	if (format === "sarif") return "sarif";
+	if (format === "web") return "web";
+	return "text";
+}
+/** Resolve the real output writer, wrapping injected writers with flag semantics. */
+function resolveOutputWriter(global, deps) {
+	if (deps?.output) return wrapOutputWriter(global, deps.output);
+	return createOutputWriter(global, (s) => process$1.stdout.write(s), (s) => process$1.stderr.write(s));
+}
+/** Configure the init subcommand options. */
+function addInitCommand(y) {
+	return y.option("template", {
+		type: "string",
+		default: "minimal",
+		choices: ["minimal", "full"]
+	}).option("force", {
+		type: "boolean",
+		default: false
+	}).option("detect", {
+		type: "boolean",
+		default: false,
+		describe: "Generate config from detected project checks (overrides --template)"
+	});
+}
+/** Configure the run subcommand options. */
+function addRunCommand(y) {
+	return y.option("entry", { type: "string" }).option("executor", {
+		type: "string",
+		default: "host",
+		choices: ["host", "docker"]
+	}).option("evaluate", {
+		type: "boolean",
+		default: false
+	}).option("output", {
+		type: "string",
+		alias: "o",
+		describe: "Output file path for HTML report (implies --format html)"
+	}).option("tui", {
+		type: "boolean",
+		describe: "Interactive terminal UI (off by default; opt-in only)"
+	}).option("jobs", {
+		type: "number",
+		alias: "j",
+		describe: "Max steps running concurrently (default: 4)"
+	});
+}
+/** Configure the plan subcommand options. */
+function addPlanCommand(y) {
+	return y.option("entry", { type: "string" });
+}
+/** Configure the policy subcommand options. */
+function addPolicyCommand(y) {
+	return y.option("findings", {
+		type: "string",
+		demandOption: true
+	}).option("baseline", { type: "string" });
+}
+/** Configure the synth subcommand options. */
+function addSynthCommand(y) {
+	return y.option("target", {
+		type: "string",
+		demandOption: true,
+		choices: ["github", "gitlab"]
+	});
+}
+/** Configure the compile subcommand options. */
+function addCompileCommand(y) {
+	return y.option("target", {
+		type: "string",
+		demandOption: true,
+		choices: ["github", "gitlab"]
+	}).option("output", {
+		type: "string",
+		alias: "o",
+		describe: "Write YAML to a file instead of stdout"
+	}).option("output-dir", {
+		type: "string",
+		describe: "Write each artifact to <dir>/<artifact path> (multi-pipeline)"
+	}).option("pin", {
+		type: "boolean",
+		default: false,
+		describe: "Pin GitHub action refs to commit SHAs (github target)"
+	});
+}
+/** Configure the view subcommand options. */
+function addViewCommand(y) {
+	return y.positional("file", {
+		type: "string",
+		describe: "Path to a .sarif file (reads from stdin if omitted)"
+	}).option("format", {
+		type: "string",
+		alias: "f",
+		choices: [
+			"tui",
+			"web",
+			"html"
+		],
+		default: "tui",
+		describe: "View format: tui (terminal), web/html (HTML report)"
+	}).option("output", {
+		type: "string",
+		alias: "o",
+		describe: "Output HTML file path (for --format web, default: sarif-report.html)"
+	});
+}
+/** Configure the ui subcommand options. */
+function addUiCommand(y) {
+	return y.option("port", {
+		type: "number",
+		default: 3e3,
+		describe: "Port to listen on"
+	}).option("host", {
+		type: "string",
+		default: "localhost",
+		describe: "Host to bind"
+	});
+}
+function buildParser() {
+	return yargs([]).scriptName("sverka").version(cliVersion()).option("format", {
+		type: "string",
+		alias: "f",
+		choices: [
+			"text",
+			"json",
+			"html",
+			"sarif",
+			"web"
+		]
+	}).option("config", {
+		type: "string",
+		alias: "c"
+	}).option("root", {
+		type: "string",
+		alias: "r",
+		default: process$1.cwd()
+	}).option("quiet", {
+		type: "boolean",
+		alias: "q",
+		default: false
+	}).option("verbose", {
+		type: "boolean",
+		alias: "v",
+		default: false
+	}).command("init", "Create a sverka.config.ts", addInitCommand).command("validate", "Validate a sverka config").command("plan", "Bind Entry + inputs → Run Plan", addPlanCommand).command("graph", "Display the Definition Graph").command("run", "Execute the workflow locally", addRunCommand).command("discover", "Discover and display project context").command("check", "Resolve proposed checks → StepDefinitions").command("policy", "Evaluate findings against policy", addPolicyCommand).command("synth", "Alias for compile — compile to a target CI YAML", addSynthCommand).command("compile", "Compile to a target CI YAML", addCompileCommand).command("mcp-server", "Expose Sverka as an MCP server (stdio)").command("doctor", "Diagnose environment and dependencies").command("view [file]", "View SARIF findings in TUI or generate HTML report", addViewCommand).command("ui", "Start local web dashboard server", addUiCommand).demandCommand(1, "No command given").strict().fail((msg, err) => {
+		if (err) throw err;
+		throw new CliError(msg, "UNKNOWN_COMMAND", ExitCode.UsageError);
+	});
+}
+/** Dispatch a single command to its handler. */
+async function dispatch(command, parsed, global, output, start) {
+	switch (command) {
+		case "init": return dispatchInit(parsed, global, output, start);
+		case "validate": return validateCommand(global, output, start);
+		case "plan": return dispatchPlan(parsed, global, output, start);
+		case "graph": return graphCommand(global, output, start);
+		case "run": return dispatchRun(parsed, global, output, start);
+		case "discover": return discoverCommand(global, output, start);
+		case "check": return checkCommand(global, output, start);
+		case "policy": return dispatchPolicy(parsed, global, output, start);
+		case "synth": return dispatchSynth(parsed, global, output, start);
+		case "compile": return dispatchCompile(parsed, global, output, start);
+		case "mcp-server": return mcpServerCommand({}, global, output, start);
+		case "doctor": return doctorCommand(global, output, start);
+		case "view": return dispatchView(parsed, global, output, start);
+		case "ui": return dispatchUi(parsed, global, output, start);
+		default: throw new CliError(`unknown command: ${command}`, "UNKNOWN_COMMAND", ExitCode.UsageError);
+	}
+}
+function dispatchInit(parsed, global, output, start) {
+	return initCommand({
+		template: typeof parsed.template === "string" ? parsed.template : void 0,
+		force: Boolean(parsed.force),
+		detect: Boolean(parsed.detect)
+	}, global, output, start);
+}
+function dispatchPlan(parsed, global, output, start) {
+	const args = {};
+	if (typeof parsed.entry === "string") args.entryId = parsed.entry;
+	return planCommand(args, global, output, start);
+}
+function dispatchRun(parsed, global, output, start) {
+	const args = {
+		executor: parsed.executor === "docker" ? "docker" : "host",
+		evaluate: Boolean(parsed.evaluate)
+	};
+	if (parsed.jobs !== void 0) {
+		const jobs = Number(parsed.jobs);
+		if (!Number.isInteger(jobs) || jobs < 1 || jobs > 64) throw new CliError("--jobs must be an integer in [1, 64]", "INVALID_FLAG", ExitCode.UsageError);
+		args.jobs = jobs;
+	}
+	if (typeof parsed.entry === "string") args.entryId = parsed.entry;
+	if (typeof parsed.output === "string") args.output = parsed.output;
+	if (parsed.tui === true) args.tui = true;
+	if (parsed.tui === false) args.tui = false;
+	return runCommand(args, global, output, start);
+}
+function dispatchPolicy(parsed, global, output, start) {
+	const args = { findings: String(parsed.findings) };
+	if (typeof parsed.baseline === "string") args.baseline = parsed.baseline;
+	return policyCommand(args, global, output, start);
+}
+function dispatchSynth(parsed, global, output, start) {
+	return synthCommand({ target: parsed.target === "gitlab" ? "gitlab" : "github" }, global, output, start);
+}
+function dispatchCompile(parsed, global, output, start) {
+	const args = { target: parsed.target === "gitlab" ? "gitlab" : "github" };
+	if (typeof parsed.output === "string") args.output = parsed.output;
+	if (typeof parsed.outputDir === "string") args.outputDir = parsed.outputDir;
+	if (parsed.pin === true) args.pin = true;
+	return compileCommand(args, global, output, start);
+}
+function dispatchView(parsed, global, output, start) {
+	const args = { format: parsed.format === "web" || parsed.format === "html" ? "web" : "tui" };
+	if (typeof parsed.file === "string") args.file = parsed.file;
+	if (typeof parsed.output === "string") args.output = parsed.output;
+	return viewCommand(args, global, output, start);
+}
+function dispatchUi(parsed, global, output, start) {
+	const args = {};
+	if (typeof parsed.port === "number") args.port = parsed.port;
+	if (typeof parsed.host === "string") args.host = parsed.host;
+	return uiCommand(args, global, output, start);
+}
+/**
+* The main CLI entry point.
+* @param argv Command-line arguments (excluding node and script path).
+* @returns Exit code (0 = success, 1 = policy fail, 2 = usage error, 3 = runtime error).
+*/
+async function main(argv, deps) {
+	const start = Date.now();
+	const output = deps?.output ?? createOutputWriter({
+		format: "text",
+		config: null,
+		root: process$1.cwd(),
+		quiet: false,
+		verbose: false
+	}, (s) => process$1.stdout.write(s), (s) => process$1.stderr.write(s));
+	let parsed;
+	try {
+		parsed = await buildParser().parseAsync(argv);
+	} catch (e) {
+		return handleError(e, output, start);
+	}
+	const global = buildGlobalFlags(parsed);
+	const realOutput = resolveOutputWriter(global, deps);
+	const command = String(parsed._[0] ?? "");
+	realOutput.debug(`sverka: command=${command} root=${global.root} format=${global.format}`);
+	try {
+		return await dispatch(command, parsed, global, realOutput, start);
+	} catch (e) {
+		return handleError(e, realOutput, start);
+	}
+}
+function handleError(e, output, _start) {
+	const hint = missingBuildHint(e);
+	if (e instanceof CliError) {
+		output.errorLine(`error: ${e.message}`);
+		if (hint !== null) output.errorLine(`hint: ${hint}`);
+		return e.exitCode;
+	}
+	const msg = e instanceof Error ? e.message : String(e);
+	output.errorLine(`error: ${msg}`);
+	if (hint !== null) output.errorLine(`hint: ${hint}`);
+	return ExitCode.RuntimeError;
+}
+//#endregion
+export { CliError, ConsoleOutputWriter, ExitCode, createOutputWriter, main, wrapOutputWriter };
+
+//# sourceMappingURL=index.mjs.map