veriskit 0.2.0 → 0.4.0

package/dist/index.js

@@ -8,6 +8,20 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/version.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+var pkgUrl, VERSION;
+var init_version = __esm({
+  "src/version.ts"() {
+    "use strict";
+    pkgUrl = new URL("../package.json", import.meta.url);
+    VERSION = JSON.parse(
+      readFileSync(fileURLToPath(pkgUrl), "utf8")
+    ).version;
+  }
+});
+
 // src/util/fs-safe.ts
 import { existsSync } from "fs";
 import { mkdir, readFile, writeFile } from "fs/promises";
@@ -57,6 +71,7 @@ async function detectProject(root) {
   ];
   return {
     root,
+    name: pkg.name ?? void 0,
     packageManager: detectPackageManager(root),
     frameworks,
     languages,
@@ -153,7 +168,7 @@ function renderDoctor(project, env) {
   const ok = (s) => plain ? s : pc.green(s);
   const dim = (s) => plain ? s : pc.dim(s);
   const lines = [];
-  lines.push("Veris doctor");
+  lines.push("VerisKit doctor");
   lines.push("");
   lines.push(`Package manager  ${project.packageManager}`);
   lines.push(`Node             ${env.node}`);
@@ -189,8 +204,80 @@ var init_doctor = __esm({
   }
 });
 
+// src/evidence/record.ts
+import { createHash } from "crypto";
+import { basename } from "path";
+function canonicalize(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+  if (Array.isArray(value)) return value.map(sortValue);
+  if (value && typeof value === "object") {
+    const src = value;
+    const out = {};
+    for (const key of Object.keys(src).sort()) {
+      if (src[key] !== void 0) out[key] = sortValue(src[key]);
+    }
+    return out;
+  }
+  return value;
+}
+function sha256(text) {
+  return `sha256:${createHash("sha256").update(text, "utf8").digest("hex")}`;
+}
+function computeDigest(record) {
+  const { digest: _omit, ...rest } = record;
+  return sha256(canonicalize(rest));
+}
+function buildRecord(run, git, logDigests, toolVersion) {
+  const runnerOf = new Map(
+    run.project.capabilities.map((c) => [c.id, c.runner])
+  );
+  const checks = run.results.map((r) => {
+    const check = {
+      id: r.checkId,
+      status: r.status,
+      durationMs: r.durationMs,
+      summary: r.summary
+    };
+    const runner = runnerOf.get(r.checkId);
+    if (runner) check.runner = runner;
+    if (r.counts) check.counts = r.counts;
+    const digest = logDigests[r.checkId];
+    if (digest) check.logDigest = digest;
+    return check;
+  });
+  const scope = run.scope ? { kind: run.scope.kind, changedCount: run.scope.changedCount } : { kind: "full", changedCount: 0 };
+  const base = {
+    schema: EVIDENCE_SCHEMA,
+    id: run.id,
+    startedAt: run.startedAt,
+    tool: { name: "veriskit", version: toolVersion },
+    git,
+    env: run.env,
+    project: {
+      name: run.project.name ?? basename(run.project.root),
+      packageManager: run.project.packageManager,
+      frameworks: run.project.frameworks,
+      languages: run.project.languages
+    },
+    scope,
+    checks,
+    verdict: run.verdict
+  };
+  return { ...base, digest: computeDigest(base) };
+}
+var EVIDENCE_SCHEMA;
+var init_record = __esm({
+  "src/evidence/record.ts"() {
+    "use strict";
+    EVIDENCE_SCHEMA = "veriskit/evidence@1";
+  }
+});
+
 // src/evidence/store.ts
-import { writeFile as writeFile2 } from "fs/promises";
+import { readdirSync } from "fs";
+import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
 import { join as join2 } from "path";
 function newRunId() {
   counter += 1;
@@ -207,11 +294,6 @@ async function writeLog(runDir, checkId, content) {
   await writeFile2(ref, content, "utf8");
   return ref;
 }
-async function writeMetadata(runDir, run) {
-  const ref = join2(runDir, "metadata.json");
-  await writeFile2(ref, JSON.stringify(run, null, 2), "utf8");
-  return ref;
-}
 async function writeReport(root, id, markdown) {
   const dir = join2(root, ".veris", "reports");
   await ensureDir(dir);
@@ -219,11 +301,54 @@ async function writeReport(root, id, markdown) {
   await writeFile2(ref, markdown, "utf8");
   return ref;
 }
+async function writeEvidence(runDir, record) {
+  const ref = join2(runDir, "evidence.json");
+  await writeFile2(ref, `${JSON.stringify(record, null, 2)}
+`, "utf8");
+  return ref;
+}
+async function digestLogs(run) {
+  const out = {};
+  for (const r of run.results) {
+    if (!r.logRef) continue;
+    try {
+      out[r.checkId] = sha256(await readFile2(r.logRef, "utf8"));
+    } catch {
+    }
+  }
+  return out;
+}
+async function readRunLogs(runDir, checkIds) {
+  const out = {};
+  for (const id of checkIds) {
+    try {
+      out[id] = await readFile2(join2(runDir, `${id}.log`), "utf8");
+    } catch {
+    }
+  }
+  return out;
+}
+function latestRunDir(root) {
+  const runs = join2(root, ".veris", "runs");
+  try {
+    const dirs = readdirSync(runs, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name !== "watch").map((d) => d.name).sort();
+    const latest = dirs.at(-1);
+    return latest ? join2(runs, latest) : null;
+  } catch {
+    return null;
+  }
+}
+async function ensureEvidenceDir(root) {
+  const dir = join2(root, ".veris", "evidence");
+  await ensureDir(dir);
+  return dir;
+}
 var counter;
 var init_store = __esm({
   "src/evidence/store.ts"() {
     "use strict";
     init_fs_safe();
+    init_record();
     counter = 0;
   }
 });
@@ -231,7 +356,7 @@ var init_store = __esm({
 // src/util/exec.ts
 import { spawn } from "child_process";
 function exec(cmd, args, opts = {}) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const start = performance.now();
     const child = spawn(cmd, args, {
       cwd: opts.cwd,
@@ -249,7 +374,7 @@ function exec(cmd, args, opts = {}) {
     child.stderr.on("data", (d) => stderr += d.toString());
     child.on("close", (code) => {
       if (timer) clearTimeout(timer);
-      resolve({
+      resolve2({
         code: code ?? 1,
         stdout,
         stderr,
@@ -259,7 +384,7 @@ function exec(cmd, args, opts = {}) {
     });
     child.on("error", () => {
       if (timer) clearTimeout(timer);
-      resolve({
+      resolve2({
         code: 127,
         stdout,
         stderr: stderr || `failed to spawn ${cmd}`,
@@ -375,13 +500,13 @@ var init_jest = __esm({
     init_base();
     jestRunner = {
       id: "jest",
-      toCheck(project, _cap) {
+      toCheck(project, _cap, opts) {
         return {
           id: "unit",
           title: "Unit tests",
           runner: "jest",
           cmd: localBin(project.root, "jest"),
-          args: ["--ci"]
+          args: ["--ci", ...opts?.targetFiles ?? []]
         };
       },
       run(check, ctx) {
@@ -459,13 +584,14 @@ var init_vitest = __esm({
     init_base();
     vitestRunner = {
       id: "vitest",
-      toCheck(project, _cap) {
+      toCheck(project, _cap, opts) {
+        const files = opts?.targetFiles ?? [];
         return {
           id: "unit",
           title: "Unit tests",
           runner: "vitest",
           cmd: localBin(project.root, "vitest"),
-          args: ["run", "--reporter=json"]
+          args: ["run", "--reporter=json", ...files]
         };
       },
       run(check, ctx) {
@@ -544,7 +670,7 @@ var init_verdict = __esm({
 });
 
 // src/core/orchestrator.ts
-async function runChecks(project, ids, root) {
+async function runChecks(project, ids, root, opts = {}) {
   const known = new Set(project.capabilities.map((c) => c.id));
   const unknown = ids.filter((id2) => !known.has(id2));
   if (unknown.length > 0) {
@@ -565,7 +691,9 @@ async function runChecks(project, ids, root) {
         summary
       };
     }
-    const check = runner.toCheck(project, cap);
+    const check = runner.toCheck(project, cap, {
+      targetFiles: opts.targetFiles?.[capId]
+    });
     return runner.run(check, ctx);
   });
   const results = await Promise.all(tasks);
@@ -608,18 +736,18 @@ function glyph(status, plain) {
 function secs(ms) {
   return ms === 0 ? "" : `${(ms / 1e3).toFixed(1)}s`;
 }
-function renderRun(run) {
+function renderRun(run, record) {
   const plain = isPlain();
   const bold = (s) => plain ? s : pc2.bold(s);
   const dim = (s) => plain ? s : pc2.dim(s);
   const lines = [];
   const scoped = run.scope?.kind;
   if (scoped) {
-    lines.push(bold(`Veris \u2014 ${scoped}`));
+    lines.push(bold(`VerisKit \u2014 ${scoped}`));
     lines.push("");
     lines.push(`Scope       ${run.scope?.changedCount ?? 0} changed file(s)`);
   } else {
-    lines.push(bold("Veris"));
+    lines.push(bold("VerisKit"));
     lines.push("");
     lines.push(
       `Project     ${run.project.root.split("/").pop() ?? run.project.root}`
@@ -643,6 +771,13 @@ function renderRun(run) {
   const label = run.verdict.state === "verified" ? scoped ? "\u2713 Affected checks passed" : "\u2713 Verified" : run.verdict.state === "failed" ? scoped ? "\u2717 Affected checks failed" : "\u2717 Failed" : scoped ? "\u25B2 Affected: partial" : "\u25B2 Partial";
   const color = run.verdict.state === "verified" ? pc2.green : run.verdict.state === "failed" ? pc2.red : pc2.yellow;
   lines.push(`  ${plain ? label : color(label)}`);
+  if (record?.git) {
+    const g = record.git;
+    lines.push("");
+    lines.push(
+      `Commit      ${g.commit.slice(0, 7)} ${g.dirty ? "\xB7 tree dirty" : "\xB7 tree clean"}`
+    );
+  }
   if (run.reportRef) {
     lines.push("");
     lines.push("Report");
@@ -698,7 +833,7 @@ async function runInit(root) {
   await writeIfAbsent(join4(dir, ".gitignore"), GITIGNORE);
   process.stdout.write(
     wroteConfig ? `Veris initialized. Detected checks: ${defaultChecks.join(", ") || "none"}.
-` : "Veris already initialized (.veris/config.json exists). Nothing overwritten.\n"
+` : "VerisKit already initialized (.veris/config.json exists). Nothing overwritten.\n"
   );
   return 0;
 }
@@ -708,7 +843,14 @@ var init_init = __esm({
     "use strict";
     init_detect();
     init_fs_safe();
-    GITIGNORE = ["runs/", "reports/", "cache/", ""].join("\n");
+    GITIGNORE = [
+      "runs/",
+      "reports/",
+      "cache/",
+      "graph.json",
+      "evidence/",
+      ""
+    ].join("\n");
   }
 });
 
@@ -724,15 +866,60 @@ var init_load = __esm({
   }
 });
 
+// src/git/changes.ts
+function collect(set, out) {
+  for (const line of out.split("\n")) {
+    const f = line.trim();
+    if (f) set.add(f);
+  }
+}
+async function changedFiles(root, opts = {}) {
+  const base = opts.base ?? null;
+  const files = /* @__PURE__ */ new Set();
+  const diffArgs = base ? ["diff", "--name-only", base] : ["diff", "--name-only", "HEAD"];
+  const diff = await exec("git", diffArgs, { cwd: root });
+  if (diff.code === 0) collect(files, diff.stdout);
+  const untracked = await exec(
+    "git",
+    ["ls-files", "--others", "--exclude-standard"],
+    { cwd: root }
+  );
+  if (untracked.code === 0) collect(files, untracked.stdout);
+  return { files: [...files].sort(), base };
+}
+async function gitAnchor(root) {
+  const head = await exec("git", ["rev-parse", "HEAD"], { cwd: root });
+  if (head.code !== 0) return null;
+  const commit = head.stdout.trim();
+  const branchRes = await exec("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    cwd: root
+  });
+  const branch = branchRes.code === 0 ? branchRes.stdout.trim() : "HEAD";
+  const status = await exec("git", ["status", "--porcelain"], { cwd: root });
+  const lines = status.code === 0 ? status.stdout.split("\n").map((l) => l.trim()).filter(Boolean) : [];
+  return {
+    commit,
+    branch,
+    dirty: lines.length > 0,
+    changedFiles: lines.length
+  };
+}
+var init_changes = __esm({
+  "src/git/changes.ts"() {
+    "use strict";
+    init_exec();
+  }
+});
+
 // src/reporters/markdown.ts
 import { relative } from "path";
 function cell(value) {
   return value.replace(/\|/g, "\\|");
 }
-function renderMarkdown(run) {
+function renderMarkdown(run, record) {
   const root = run.project.root;
   const lines = [];
-  lines.push("# Veris Verification Report");
+  lines.push("# VerisKit Verification Report");
   if (run.scope?.kind) {
     lines.push("");
     lines.push(
@@ -745,6 +932,13 @@ function renderMarkdown(run) {
   lines.push(
     `**Node:** ${run.env.node} \xB7 **OS:** ${run.env.os} \xB7 **PM:** ${run.env.pm} \xB7 **CI:** ${run.env.ci}`
   );
+  if (record?.git) {
+    const g = record.git;
+    const tree = g.dirty ? `tree dirty, ${g.changedFiles} uncommitted file(s)` : "tree clean";
+    lines.push(`**Commit:** ${g.commit.slice(0, 7)} (${g.branch}) \xB7 ${tree}`);
+  } else if (record) {
+    lines.push("**Commit:** no git anchor available");
+  }
   lines.push("");
   lines.push("## Checks");
   lines.push("");
@@ -776,9 +970,16 @@ function renderMarkdown(run) {
       lines.push("```");
     }
   }
+  if (record) {
+    lines.push("");
+    lines.push(`**Evidence digest:** \`${record.digest}\``);
+    lines.push(
+      "_Integrity digest over the canonical record. Detects edits and corruption; it is not forgery-proof on its own. Publish the digest separately or sign it to prove authorship._"
+    );
+  }
   lines.push("");
   lines.push(
-    "_Generated by Veris. A `Partial` verdict means one or more capabilities did not run \u2014 it is not a pass._"
+    "_Generated by VerisKit. A `Partial` verdict means one or more capabilities did not run \u2014 it is not a pass._"
   );
   lines.push("");
   return lines.join("\n");
@@ -805,11 +1006,18 @@ async function runVerify(root, opts = {}) {
   const config = await loadConfig(root);
   const checks = config?.checks?.length ? config.checks : DEFAULT_CHECKS;
   const run = await runChecks(project, checks, root);
-  const reportRef = await writeReport(root, run.id, renderMarkdown(run));
+  const git = await gitAnchor(root);
+  const logDigests = await digestLogs(run);
+  const record = buildRecord(run, git, logDigests, VERSION);
+  const reportRef = await writeReport(
+    root,
+    run.id,
+    renderMarkdown(run, record)
+  );
   run.reportRef = reportRef;
   const runDir = await createRunDir(root, run.id);
-  await writeMetadata(runDir, run);
-  process.stdout.write(`${renderRun(run)}
+  await writeEvidence(runDir, record);
+  process.stdout.write(`${renderRun(run, record)}
 `);
   return verdictExitCode(run.verdict, opts);
 }
@@ -821,9 +1029,12 @@ var init_verify = __esm({
     init_load();
     init_orchestrator();
     init_verdict();
+    init_record();
     init_store();
+    init_changes();
     init_markdown();
     init_terminal();
+    init_version();
     DEFAULT_CHECKS = ["types", "lint", "unit"];
   }
 });
@@ -833,13 +1044,13 @@ var report_exports = {};
 __export(report_exports, {
   runReport: () => runReport
 });
-import { readdirSync, readFileSync as readFileSync2 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join6 } from "path";
 async function runReport(root) {
   const dir = join6(root, ".veris", "reports");
   let files;
   try {
-    files = readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    files = readdirSync2(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     process.stdout.write("No reports yet. Run `veris verify` first.\n");
     return 0;
@@ -912,31 +1123,335 @@ var init_gate = __esm({
   }
 });
 
-// src/git/changes.ts
-function collect(set, out) {
-  for (const line of out.split("\n")) {
-    const f = line.trim();
-    if (f) set.add(f);
+// src/project-graph/discover.ts
+import { readdirSync as readdirSync3, statSync } from "fs";
+import { join as join7, relative as relative2, sep } from "path";
+function toPosix(p) {
+  return sep === "/" ? p : p.split(sep).join("/");
+}
+function classify(rel) {
+  if (TEST_RE2.test(rel)) return "test";
+  if (CONFIG_RE2.test(rel)) return "config";
+  return "source";
+}
+function discoverFiles(root) {
+  const out = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync3(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      const abs = join7(dir, name);
+      const rel = toPosix(relative2(root, abs));
+      if (IGNORE.test(rel)) continue;
+      let st;
+      try {
+        st = statSync(abs);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        walk(abs);
+      } else if (CODE_RE.test(rel)) {
+        out.push({ file: rel, kind: classify(rel) });
+      }
+    }
+  };
+  walk(root);
+  return out.sort((a, b) => a.file.localeCompare(b.file));
+}
+var IGNORE, CODE_RE, TEST_RE2, CONFIG_RE2;
+var init_discover = __esm({
+  "src/project-graph/discover.ts"() {
+    "use strict";
+    IGNORE = /(^|\/)(\.git|\.claude|\.veris|\.agentloop|\.agentflight|node_modules|dist|coverage|build|fixtures|__fixtures__)(\/|$)/;
+    CODE_RE = /\.[cm]?[jt]sx?$/;
+    TEST_RE2 = /(\.(test|spec)\.[cm]?[jt]sx?$)|(^|\/)(test|tests|__tests__)\//;
+    CONFIG_RE2 = /(^|\/)([^/]+\.config\.[cm]?[jt]sx?)$/;
+  }
+});
+
+// src/project-graph/scanner-resolver.ts
+import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
+import { dirname, join as join8, relative as relative3, resolve } from "path";
+function extractSpecifiers(text) {
+  const specs = [];
+  SPEC_RE.lastIndex = 0;
+  let m;
+  m = SPEC_RE.exec(text);
+  while (m !== null) {
+    const s = m[1] ?? m[2] ?? m[3] ?? m[4];
+    if (s) specs.push(s);
+    m = SPEC_RE.exec(text);
   }
+  return specs;
 }
-async function changedFiles(root, opts = {}) {
-  const base = opts.base ?? null;
-  const files = /* @__PURE__ */ new Set();
-  const diffArgs = base ? ["diff", "--name-only", base] : ["diff", "--name-only", "HEAD"];
-  const diff = await exec("git", diffArgs, { cwd: root });
-  if (diff.code === 0) collect(files, diff.stdout);
-  const untracked = await exec(
-    "git",
-    ["ls-files", "--others", "--exclude-standard"],
-    { cwd: root }
-  );
-  if (untracked.code === 0) collect(files, untracked.stdout);
-  return { files: [...files].sort(), base };
+function isFile(p) {
+  try {
+    return statSync2(p).isFile();
+  } catch {
+    return false;
+  }
 }
-var init_changes = __esm({
-  "src/git/changes.ts"() {
+function resolveRelative(fromDir, spec) {
+  const base = resolve(fromDir, spec);
+  const candidates = [base];
+  for (const ext of EXTS) candidates.push(base + ext);
+  const extMatch = base.match(/\.[cm]?[jt]sx?$/);
+  if (extMatch) {
+    const noExt = base.slice(0, -extMatch[0].length);
+    for (const ext of EXTS) candidates.push(noExt + ext);
+  }
+  for (const ext of EXTS) candidates.push(join8(base, `index${ext}`));
+  for (const c of candidates) {
+    if (existsSync3(c) && isFile(c)) return c;
+  }
+  return null;
+}
+function scannerImports(root, file) {
+  let text;
+  try {
+    text = readFileSync3(join8(root, file), "utf8");
+  } catch {
+    return [];
+  }
+  const dir = dirname(join8(root, file));
+  const out = /* @__PURE__ */ new Set();
+  for (const spec of extractSpecifiers(text)) {
+    if (!spec.startsWith(".")) continue;
+    const resolved = resolveRelative(dir, spec);
+    if (resolved) out.add(toPosix(relative3(root, resolved)));
+  }
+  return [...out];
+}
+var EXTS, SPEC_RE;
+var init_scanner_resolver = __esm({
+  "src/project-graph/scanner-resolver.ts"() {
+    "use strict";
+    init_discover();
+    EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+    SPEC_RE = /(?:import|export)\b[^'"]*?\bfrom\s*['"]([^'"]+)['"]|(?:^|[^.\w])import\s*['"]([^'"]+)['"]|\bimport\(\s*['"]([^'"]+)['"]\s*\)|\brequire\(\s*['"]([^'"]+)['"]\s*\)/g;
+  }
+});
+
+// src/project-graph/ts-resolver.ts
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { createRequire } from "module";
+import { join as join9, relative as relative4, sep as sep2 } from "path";
+function hasClassicApi(mod) {
+  const m = mod;
+  return !!m && typeof m.preProcessFile === "function" && typeof m.resolveModuleName === "function" && typeof m.readConfigFile === "function" && typeof m.parseJsonConfigFileContent === "function" && typeof m.sys === "object" && m.sys !== null;
+}
+function loadTypeScript(root) {
+  try {
+    const require2 = createRequire(join9(root, "__veris__.js"));
+    const tsPath = require2.resolve("typescript");
+    const mod = require2(tsPath);
+    return hasClassicApi(mod) ? mod : null;
+  } catch {
+    return null;
+  }
+}
+function loadCompilerOptions(tsmod, root) {
+  const configPath = join9(root, "tsconfig.json");
+  const read = tsmod.readConfigFile(configPath, tsmod.sys.readFile);
+  if (read.error || !read.config) return {};
+  const parsed = tsmod.parseJsonConfigFileContent(read.config, tsmod.sys, root);
+  return parsed.options;
+}
+function tsImports(tsmod, root, options, file) {
+  let text;
+  try {
+    text = readFileSync4(join9(root, file), "utf8");
+  } catch {
+    return [];
+  }
+  const abs = join9(root, file);
+  const out = /* @__PURE__ */ new Set();
+  try {
+    const pre = tsmod.preProcessFile(text, true, true);
+    for (const imp of pre.importedFiles) {
+      const res = tsmod.resolveModuleName(
+        imp.fileName,
+        abs,
+        options,
+        tsmod.sys
+      );
+      const resolved = res.resolvedModule?.resolvedFileName;
+      if (resolved && !resolved.includes("node_modules") && resolved.startsWith(root + sep2)) {
+        out.add(toPosix(relative4(root, resolved)));
+      }
+    }
+  } catch {
+  }
+  return [...out];
+}
+function selectResolver(root) {
+  const tsmod = existsSync4(join9(root, "tsconfig.json")) ? loadTypeScript(root) : null;
+  if (tsmod) {
+    try {
+      const options = loadCompilerOptions(tsmod, root);
+      return {
+        resolver: "typescript",
+        importsOf: (file) => tsImports(tsmod, root, options, file)
+      };
+    } catch {
+    }
+  }
+  return {
+    resolver: "scanner",
+    importsOf: (file) => scannerImports(root, file)
+  };
+}
+var init_ts_resolver = __esm({
+  "src/project-graph/ts-resolver.ts"() {
+    "use strict";
+    init_discover();
+    init_scanner_resolver();
+  }
+});
+
+// src/project-graph/graph.ts
+var graph_exports = {};
+__export(graph_exports, {
+  buildGraph: () => buildGraph
+});
+async function buildGraph(project) {
+  const root = project.root;
+  const files = discoverFiles(root);
+  const known = new Set(files.map((f) => f.file));
+  const { resolver, importsOf } = selectResolver(root);
+  const nodes = {};
+  for (const f of files) {
+    nodes[f.file] = { file: f.file, kind: f.kind, imports: [], importedBy: [] };
+  }
+  for (const f of files) {
+    const imps = importsOf(f.file).filter((i) => known.has(i) && i !== f.file);
+    nodes[f.file].imports = imps;
+    for (const i of imps) nodes[i]?.importedBy.push(f.file);
+  }
+  return {
+    root,
+    resolver,
+    nodes,
+    sourceFiles: files.filter((f) => f.kind === "source").map((f) => f.file),
+    testFiles: files.filter((f) => f.kind === "test").map((f) => f.file)
+  };
+}
+var init_graph = __esm({
+  "src/project-graph/graph.ts"() {
+    "use strict";
+    init_discover();
+    init_ts_resolver();
+  }
+});
+
+// src/project-graph/analyze.ts
+function transitiveDependents(graph, file) {
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [...graph.nodes[file]?.importedBy ?? []];
+  while (stack.length) {
+    const f = stack.pop();
+    if (!f || seen.has(f)) continue;
+    seen.add(f);
+    for (const d of graph.nodes[f]?.importedBy ?? []) stack.push(d);
+  }
+  return seen;
+}
+function reachableFromTests(graph) {
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [...graph.testFiles];
+  while (stack.length) {
+    const f = stack.pop();
+    if (!f || seen.has(f)) continue;
+    seen.add(f);
+    for (const i of graph.nodes[f]?.imports ?? []) stack.push(i);
+  }
+  return seen;
+}
+function analyze(graph, changed = []) {
+  const blastRadius = {};
+  for (const file of Object.keys(graph.nodes)) {
+    blastRadius[file] = transitiveDependents(graph, file).size;
+  }
+  const reached = reachableFromTests(graph);
+  const byBlast = (a, b) => (blastRadius[b] ?? 0) - (blastRadius[a] ?? 0);
+  const untested = graph.sourceFiles.filter((f) => !reached.has(f)).sort(byBlast);
+  const changedSet = new Set(changed);
+  const untestedSet = new Set(untested);
+  const risky = graph.sourceFiles.filter(
+    (f) => (blastRadius[f] ?? 0) > 0 && (untestedSet.has(f) || changedSet.has(f))
+  ).sort(byBlast);
+  return { untested, blastRadius, risky };
+}
+var init_analyze = __esm({
+  "src/project-graph/analyze.ts"() {
     "use strict";
-    init_exec();
+  }
+});
+
+// src/affected/select.ts
+var select_exports = {};
+__export(select_exports, {
+  selectAffectedTests: () => selectAffectedTests
+});
+function selectAffectedTests(graph, changed) {
+  if (graph.resolver !== "typescript") {
+    return {
+      mode: "full",
+      testFiles: [],
+      reason: "scanner graph can miss aliased/subpath imports \u2014 running the full suite"
+    };
+  }
+  for (const f of changed) {
+    if (GLOBAL_RE.test(f)) {
+      return {
+        mode: "full",
+        testFiles: [],
+        reason: `global/config change (${f})`
+      };
+    }
+    if (!(f in graph.nodes)) {
+      return {
+        mode: "full",
+        testFiles: [],
+        reason: `unresolved changed file (${f})`
+      };
+    }
+  }
+  const tests = /* @__PURE__ */ new Set();
+  for (const f of changed) {
+    if (graph.nodes[f]?.kind === "test") tests.add(f);
+    for (const dep of transitiveDependents(graph, f)) {
+      if (graph.nodes[dep]?.kind === "test") tests.add(dep);
+    }
+  }
+  if (tests.size === 0) {
+    return {
+      mode: "full",
+      testFiles: [],
+      reason: "no tests reach the changed files"
+    };
+  }
+  const selected = [...tests].sort();
+  if (selected.some((t) => t.startsWith("-"))) {
+    return {
+      mode: "full",
+      testFiles: [],
+      reason: "a reaching test path starts with '-' (unsafe as a CLI argument)"
+    };
+  }
+  return { mode: "graph", testFiles: selected, reason: "" };
+}
+var GLOBAL_RE;
+var init_select = __esm({
+  "src/affected/select.ts"() {
+    "use strict";
+    init_analyze();
+    GLOBAL_RE = /(^|\/)(tsconfig[^/]*\.json|package\.json|biome\.jsonc?|\.eslintrc[^/]*|eslint\.config\.[^/]+|veris\.config\.[^/]+|[^/]+\.config\.[cm]?[jt]sx?|[^/]+\.setup\.[cm]?[jt]sx?)$/;
   }
 });
 
@@ -956,7 +1471,25 @@ async function runAffected(root, opts = {}) {
     );
     return 0;
   }
-  const run = await runChecks(project, plan.checks, root);
+  let targetFiles;
+  let narrowedNote = "";
+  const unitRunner = project.capabilities.find((c) => c.id === "unit")?.runner;
+  const canNarrow = unitRunner === "vitest" || unitRunner === "jest";
+  if (plan.checks.includes("unit") && canNarrow) {
+    const { buildGraph: buildGraph2 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
+    const { selectAffectedTests: selectAffectedTests2 } = await Promise.resolve().then(() => (init_select(), select_exports));
+    const graph = await buildGraph2(project);
+    const sel = selectAffectedTests2(graph, files);
+    if (sel.mode === "graph") {
+      targetFiles = { unit: sel.testFiles };
+      narrowedNote = `unit narrowed to ${sel.testFiles.length} of ${graph.testFiles.length} test file(s) via ${graph.resolver} graph`;
+    } else {
+      narrowedNote = `unit ran in full \u2014 ${sel.reason}`;
+    }
+  } else if (plan.checks.includes("unit") && unitRunner) {
+    narrowedNote = `unit ran in full \u2014 the ${unitRunner} runner does not support file filtering`;
+  }
+  const run = await runChecks(project, plan.checks, root, { targetFiles });
   run.scope = { kind: "affected", changedCount: files.length };
   const affected = new Set(plan.checks);
   for (const cap of project.capabilities) {
@@ -969,11 +1502,20 @@ async function runAffected(root, opts = {}) {
       });
     }
   }
-  const reportRef = await writeReport(root, run.id, renderMarkdown(run));
+  const git = await gitAnchor(root);
+  const logDigests = await digestLogs(run);
+  const record = buildRecord(run, git, logDigests, VERSION);
+  const reportRef = await writeReport(
+    root,
+    run.id,
+    renderMarkdown(run, record)
+  );
   run.reportRef = reportRef;
   const runDir = await createRunDir(root, run.id);
-  await writeMetadata(runDir, run);
-  process.stdout.write(`${renderRun(run)}
+  await writeEvidence(runDir, record);
+  process.stdout.write(`${renderRun(run, record)}
+`);
+  if (narrowedNote) process.stdout.write(`${narrowedNote}
 `);
   return verdictExitCode(run.verdict, opts);
 }
@@ -984,23 +1526,25 @@ var init_affected = __esm({
     init_detect();
     init_orchestrator();
     init_verdict();
+    init_record();
     init_store();
     init_changes();
     init_markdown();
     init_terminal();
+    init_version();
   }
 });
 
 // src/watch/watcher.ts
 import {
   watch as fsWatch,
-  readdirSync as readdirSync2,
-  statSync
+  readdirSync as readdirSync4,
+  statSync as statSync3
 } from "fs";
-import { basename, join as join7, relative as relative2 } from "path";
+import { basename as basename2, join as join10, relative as relative5 } from "path";
 function watch(root, opts, onBatch) {
   const debounceMs = opts.debounceMs ?? 150;
-  const rootBase = basename(root);
+  const rootBase = basename2(root);
   let pending = /* @__PURE__ */ new Set();
   let timer = null;
   const flush = () => {
@@ -1010,7 +1554,7 @@ function watch(root, opts, onBatch) {
     if (batch.length) onBatch(batch);
   };
   const schedule = (rel) => {
-    if (!rel || rel === rootBase || IGNORE.test(rel)) return;
+    if (!rel || rel === rootBase || IGNORE2.test(rel)) return;
     pending.add(rel);
     if (timer) clearTimeout(timer);
     timer = setTimeout(flush, debounceMs);
@@ -1051,17 +1595,17 @@ function scanMtimes(root) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync2(dir);
+      entries = readdirSync4(dir);
     } catch {
       return;
     }
     for (const name of entries) {
-      const abs = join7(dir, name);
-      const rel = relative2(root, abs);
-      if (IGNORE.test(rel)) continue;
+      const abs = join10(dir, name);
+      const rel = relative5(root, abs);
+      if (IGNORE2.test(rel)) continue;
       let st;
       try {
-        st = statSync(abs);
+        st = statSync3(abs);
       } catch {
         continue;
       }
@@ -1072,11 +1616,11 @@ function scanMtimes(root) {
   walk(root);
   return out;
 }
-var IGNORE;
+var IGNORE2;
 var init_watcher = __esm({
   "src/watch/watcher.ts"() {
     "use strict";
-    IGNORE = /(^|\/)(\.git|\.veris|\.agentloop|\.agentflight|node_modules|dist)(\/|$)/;
+    IGNORE2 = /(^|\/)(\.git|\.veris|\.agentloop|\.agentflight|node_modules|dist)(\/|$)/;
   }
 });
 
@@ -1122,9 +1666,29 @@ async function runWatch(root, opts = {}) {
       const project = await detectProject(root);
       const { files } = await changedFiles(root);
       const checks = initial ? availableIds(project) : affectedChecks(files, project).checks;
+      let targetFiles;
+      let narrowedNote = "";
+      const unitRunner = project.capabilities.find(
+        (c) => c.id === "unit"
+      )?.runner;
+      const canNarrow = unitRunner === "vitest" || unitRunner === "jest";
+      if (!initial && checks.includes("unit") && canNarrow) {
+        const { buildGraph: buildGraph2 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
+        const { selectAffectedTests: selectAffectedTests2 } = await Promise.resolve().then(() => (init_select(), select_exports));
+        const graph = await buildGraph2(project);
+        const sel = selectAffectedTests2(graph, files);
+        if (sel.mode === "graph") {
+          targetFiles = { unit: sel.testFiles };
+          narrowedNote = `unit narrowed to ${sel.testFiles.length} of ${graph.testFiles.length} test file(s) via ${graph.resolver} graph`;
+        } else {
+          narrowedNote = `unit ran in full \u2014 ${sel.reason}`;
+        }
+      } else if (!initial && checks.includes("unit") && unitRunner) {
+        narrowedNote = `unit ran in full \u2014 the ${unitRunner} runner does not support file filtering`;
+      }
       let fresh = [];
       if (checks.length) {
-        const r = await runChecks(project, checks, root);
+        const r = await runChecks(project, checks, root, { targetFiles });
         fresh = r.results;
         for (const result of fresh) cache.set(result.checkId, { ...result });
       }
@@ -1149,6 +1713,8 @@ async function runWatch(root, opts = {}) {
         scope: { kind: "watch", changedCount: files.length }
       };
       process.stdout.write(`${renderRun(run)}
+`);
+      if (narrowedNote) process.stdout.write(`${narrowedNote}
 `);
     } finally {
       running = false;
@@ -1156,7 +1722,7 @@ async function runWatch(root, opts = {}) {
   };
   process.stdout.write("veris watch \u2014 press Ctrl-C to stop\n");
   await tick(true);
-  return await new Promise((resolve) => {
+  return await new Promise((resolve2) => {
     let stop;
     try {
       stop = watch(root, { poll: opts.poll }, () => {
@@ -1167,13 +1733,13 @@ async function runWatch(root, opts = {}) {
         `veris: ${err instanceof Error ? err.message : String(err)}
 `
       );
-      resolve(1);
+      resolve2(1);
       return;
     }
     process.on("SIGINT", () => {
       stop();
       process.stdout.write("\nStopped.\n");
-      resolve(0);
+      resolve2(0);
     });
   });
 }
@@ -1190,21 +1756,364 @@ var init_watch = __esm({
   }
 });
 
+// src/cli/commands/scan.ts
+var scan_exports = {};
+__export(scan_exports, {
+  renderScan: () => renderScan,
+  runScan: () => runScan
+});
+import { writeFile as writeFile3 } from "fs/promises";
+import { join as join11 } from "path";
+import pc3 from "picocolors";
+function renderScan(graph, analysis) {
+  const plain = isPlain();
+  const bold = (s) => plain ? s : pc3.bold(s);
+  const dim = (s) => plain ? s : pc3.dim(s);
+  const warn = (s) => plain ? s : pc3.yellow(s);
+  const lines = [];
+  lines.push(bold("VerisKit \u2014 scan"));
+  lines.push("");
+  lines.push(
+    `Resolver    ${graph.resolver}${graph.resolver === "scanner" ? dim("  (no TypeScript found \u2014 relative imports only)") : ""}`
+  );
+  lines.push(
+    `Modules     ${Object.keys(graph.nodes).length}   \xB7  Source ${graph.sourceFiles.length}  \xB7  Tests ${graph.testFiles.length}`
+  );
+  lines.push("");
+  lines.push("Untested (top by impact)");
+  const top = analysis.untested.slice(0, 10);
+  if (top.length === 0)
+    lines.push(dim("  none \u2014 every source file is reached by a test"));
+  for (const f of top) {
+    lines.push(
+      `  ${warn("!")} ${f}   ${dim(`${analysis.blastRadius[f] ?? 0} dependents`)}`
+    );
+  }
+  return lines.join("\n");
+}
+async function runScan(root) {
+  const project = await detectProject(root);
+  const graph = await buildGraph(project);
+  const analysis = analyze(graph);
+  const dir = join11(root, ".veris");
+  await ensureDir(dir);
+  await writeFile3(
+    join11(dir, "graph.json"),
+    JSON.stringify({ resolver: graph.resolver, nodes: graph.nodes }, null, 2),
+    "utf8"
+  );
+  process.stdout.write(`${renderScan(graph, analysis)}
+`);
+  process.stdout.write(`
+Graph        ${join11(".veris", "graph.json")}
+`);
+  return 0;
+}
+var init_scan = __esm({
+  "src/cli/commands/scan.ts"() {
+    "use strict";
+    init_detect();
+    init_analyze();
+    init_graph();
+    init_fs_safe();
+    init_tty();
+  }
+});
+
+// src/cli/commands/plan.ts
+var plan_exports = {};
+__export(plan_exports, {
+  renderPlan: () => renderPlan,
+  runPlan: () => runPlan
+});
+import pc4 from "picocolors";
+function renderPlan(project, graph, analysis, changed) {
+  const plain = isPlain();
+  const bold = (s) => plain ? s : pc4.bold(s);
+  const dim = (s) => plain ? s : pc4.dim(s);
+  const warn = (s) => plain ? s : pc4.yellow(s);
+  const lines = [];
+  lines.push(bold("VerisKit \u2014 plan"));
+  lines.push(dim(`(graph via ${graph.resolver})`));
+  lines.push("");
+  lines.push("Test these first (high impact, untested)");
+  const top = analysis.untested.slice(0, 5);
+  if (top.length === 0)
+    lines.push(
+      dim(
+        "  none \u2014 untested files have no dependents or all files are covered"
+      )
+    );
+  top.forEach((f, i) => {
+    lines.push(
+      `  ${i + 1}. ${f}   ${dim(`(${analysis.blastRadius[f] ?? 0} dependents, no test reaches it)`)}`
+    );
+  });
+  lines.push("");
+  lines.push("Verification setup");
+  const weak = project.capabilities.filter(
+    (c) => !c.available && c.id !== "browser"
+  );
+  if (weak.length === 0)
+    lines.push(dim("  \u2713 types, lint, and unit are all configured"));
+  for (const c of weak)
+    lines.push(
+      `  ${warn("\u26A0")} ${c.id} capability unavailable \u2014 ${c.reason ?? "not configured"}`
+    );
+  if (changed.length) {
+    lines.push("");
+    lines.push(`Risky changes (${changed.length} changed file(s))`);
+    if (analysis.risky.length === 0) lines.push(dim("  none flagged"));
+    for (const f of analysis.risky.slice(0, 8)) {
+      const untested = analysis.untested.includes(f) ? ", untested" : "";
+      lines.push(
+        `  ${warn("!")} ${f}   ${dim(`${analysis.blastRadius[f] ?? 0} dependents${untested}`)}`
+      );
+    }
+  }
+  lines.push("");
+  lines.push(
+    dim("Next: `veris affected` runs only the tests that reach your changes.")
+  );
+  return lines.join("\n");
+}
+async function runPlan(root, opts = {}) {
+  const project = await detectProject(root);
+  const graph = await buildGraph(project);
+  const { files } = await changedFiles(root, { base: opts.base });
+  const analysis = analyze(graph, files);
+  process.stdout.write(`${renderPlan(project, graph, analysis, files)}
+`);
+  return 0;
+}
+var init_plan = __esm({
+  "src/cli/commands/plan.ts"() {
+    "use strict";
+    init_detect();
+    init_changes();
+    init_analyze();
+    init_graph();
+    init_tty();
+  }
+});
+
+// src/evidence/verify-evidence.ts
+import { readFile as readFile3 } from "fs/promises";
+function verifyRecord(record) {
+  const recomputed = computeDigest(
+    record
+  );
+  const ok = recomputed === record.digest;
+  const checks = [
+    {
+      name: "record digest",
+      ok,
+      detail: ok ? "matches the canonical record" : `recomputed ${recomputed}, record claims ${record.digest}`
+    }
+  ];
+  return { ok, kind: "record", record, checks };
+}
+async function verifyEvidenceFile(path) {
+  const parsed = JSON.parse(await readFile3(path, "utf8"));
+  if (parsed?.schema === "veriskit/bundle@1") {
+    const { verifyBundle: verifyBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
+    return verifyBundle2(parsed);
+  }
+  return verifyRecord(parsed);
+}
+var init_verify_evidence = __esm({
+  "src/evidence/verify-evidence.ts"() {
+    "use strict";
+    init_record();
+  }
+});
+
+// src/evidence/bundle.ts
+var bundle_exports = {};
+__export(bundle_exports, {
+  BUNDLE_SCHEMA: () => BUNDLE_SCHEMA,
+  buildBundle: () => buildBundle,
+  verifyBundle: () => verifyBundle
+});
+function buildBundle(record, report, logs) {
+  const manifest = {
+    record: record.digest,
+    report: sha256(report),
+    logs: Object.fromEntries(
+      Object.entries(logs).map(([k, v]) => [k, sha256(v)])
+    )
+  };
+  const base = { schema: BUNDLE_SCHEMA, record, report, logs, manifest };
+  return { ...base, bundleDigest: sha256(canonicalize(base)) };
+}
+function verifyBundle(bundle) {
+  const checks = [];
+  const recordResult = verifyRecord(bundle.record);
+  checks.push(...recordResult.checks);
+  const reportDigest = sha256(bundle.report);
+  checks.push({
+    name: "report",
+    ok: reportDigest === bundle.manifest.report,
+    detail: reportDigest === bundle.manifest.report ? "matches manifest" : "mismatch"
+  });
+  for (const [id, body] of Object.entries(bundle.logs)) {
+    const d = sha256(body);
+    checks.push({
+      name: `log:${id}`,
+      ok: d === bundle.manifest.logs[id],
+      detail: d === bundle.manifest.logs[id] ? "matches manifest" : "mismatch"
+    });
+  }
+  const { bundleDigest: _omit, ...rest } = bundle;
+  const recomputed = sha256(canonicalize(rest));
+  checks.push({
+    name: "bundle digest",
+    ok: recomputed === bundle.bundleDigest,
+    detail: recomputed === bundle.bundleDigest ? "matches" : "mismatch"
+  });
+  return {
+    ok: checks.every((c) => c.ok),
+    kind: "bundle",
+    record: bundle.record,
+    checks
+  };
+}
+var BUNDLE_SCHEMA;
+var init_bundle = __esm({
+  "src/evidence/bundle.ts"() {
+    "use strict";
+    init_record();
+    init_verify_evidence();
+    BUNDLE_SCHEMA = "veriskit/bundle@1";
+  }
+});
+
+// src/cli/commands/evidence.ts
+var evidence_exports = {};
+__export(evidence_exports, {
+  runEvidenceBundle: () => runEvidenceBundle,
+  runEvidenceShow: () => runEvidenceShow,
+  runEvidenceVerify: () => runEvidenceVerify
+});
+import { readFileSync as readFileSync5 } from "fs";
+import { writeFile as writeFile4 } from "fs/promises";
+import { basename as basename3, join as join12 } from "path";
+import pc5 from "picocolors";
+async function runEvidenceVerify(path) {
+  let result;
+  try {
+    result = await verifyEvidenceFile(path);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: cannot read evidence at ${path}: ${msg}
+`);
+    return 1;
+  }
+  const plain = isPlain();
+  const mark = (ok) => plain ? ok ? "ok" : "FAIL" : ok ? pc5.green("\u2713") : pc5.red("\u2717");
+  for (const check of result.checks) {
+    process.stdout.write(
+      `  ${mark(check.ok)} ${check.name}: ${check.detail}
+`
+    );
+  }
+  const g = result.record.git;
+  const anchor = g ? `commit ${g.commit.slice(0, 7)} \xB7 ${g.dirty ? "tree dirty" : "tree clean"}` : "no git anchor";
+  process.stdout.write(
+    `
+${result.ok ? "digest OK" : "TAMPERED"} \xB7 verdict ${result.record.verdict.state} \xB7 ${anchor}
+`
+  );
+  process.stdout.write(`
+${HONESTY}
+`);
+  return result.ok ? 0 : 1;
+}
+async function runEvidenceBundle(root, opts = {}) {
+  const runDir = latestRunDir(root);
+  if (!runDir) {
+    process.stdout.write("No evidence yet. Run `veris verify` first.\n");
+    return 1;
+  }
+  let record;
+  try {
+    record = JSON.parse(
+      readFileSync5(join12(runDir, "evidence.json"), "utf8")
+    );
+  } catch {
+    process.stderr.write(`veris: no evidence.json in ${runDir}
+`);
+    return 1;
+  }
+  let report = "";
+  try {
+    report = readFileSync5(
+      join12(root, ".veris", "reports", `verify-${record.id}.md`),
+      "utf8"
+    );
+  } catch {
+  }
+  const logIds = record.checks.filter((c) => c.logDigest).map((c) => c.id);
+  const logs = await readRunLogs(runDir, logIds);
+  const bundle = buildBundle(record, report, logs);
+  const outDir = await ensureEvidenceDir(root);
+  const out = opts.out ?? join12(outDir, `${record.id}.bundle.json`);
+  await writeFile4(out, `${JSON.stringify(bundle, null, 2)}
+`, "utf8");
+  process.stdout.write(`Wrote portable evidence bundle: ${out}
+`);
+  return 0;
+}
+async function runEvidenceShow(root, path) {
+  const target = path ?? (() => {
+    const dir = latestRunDir(root);
+    return dir ? join12(dir, "evidence.json") : null;
+  })();
+  if (!target) {
+    process.stdout.write("No evidence yet. Run `veris verify` first.\n");
+    return 0;
+  }
+  let record;
+  try {
+    record = JSON.parse(readFileSync5(target, "utf8"));
+  } catch {
+    process.stderr.write(`veris: cannot read evidence at ${target}
+`);
+    return 1;
+  }
+  const g = record.git;
+  process.stdout.write(
+    [
+      `Evidence   ${basename3(target)}`,
+      `Verdict    ${record.verdict.state}`,
+      `Project    ${record.project.name}`,
+      `Scope      ${record.scope.kind} (${record.scope.changedCount} changed)`,
+      `Commit     ${g ? `${g.commit.slice(0, 7)} (${g.branch}) ${g.dirty ? "\xB7 tree dirty" : "\xB7 tree clean"}` : "no git anchor"}`,
+      `Checks     ${record.checks.map((c) => `${c.id}:${c.status}`).join(", ")}`,
+      `Digest     ${record.digest}`,
+      ""
+    ].join("\n")
+  );
+  return 0;
+}
+var HONESTY;
+var init_evidence = __esm({
+  "src/cli/commands/evidence.ts"() {
+    "use strict";
+    init_bundle();
+    init_store();
+    init_verify_evidence();
+    init_tty();
+    HONESTY = "An integrity digest confirms the record was not edited or corrupted since it was written.\nIt is not forgery-proof on its own: publish the digest separately (CI log, PR) or sign it (planned) to prove authorship.";
+  }
+});
+
 // src/cli/index.ts
+init_version();
 import { realpathSync } from "fs";
 import { argv } from "process";
 import { pathToFileURL } from "url";
 import cac from "cac";
-
-// src/version.ts
-import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
-var pkgUrl = new URL("../package.json", import.meta.url);
-var VERSION = JSON.parse(
-  readFileSync(fileURLToPath(pkgUrl), "utf8")
-).version;
-
-// src/cli/index.ts
 function buildCli() {
   const cli = cac("veris");
   cli.version(VERSION);
@@ -1242,6 +2151,45 @@ function buildCli() {
     const { runWatch: runWatch2 } = await Promise.resolve().then(() => (init_watch(), watch_exports));
     process.exitCode = await runWatch2(process.cwd(), { poll: opts.poll });
   });
+  cli.command("scan", "Map the import graph and untested areas (read-only)").action(async () => {
+    const { runScan: runScan2 } = await Promise.resolve().then(() => (init_scan(), scan_exports));
+    process.exitCode = await runScan2(process.cwd());
+  });
+  cli.command(
+    "plan",
+    "Recommend what to test, from the import graph (read-only)"
+  ).option("--base <ref>", "Also factor in changes vs a git ref").action(async (opts) => {
+    const { runPlan: runPlan2 } = await Promise.resolve().then(() => (init_plan(), plan_exports));
+    process.exitCode = await runPlan2(process.cwd(), { base: opts.base });
+  });
+  cli.command(
+    "evidence <action> [file]",
+    "Evidence tools: verify <file> | bundle | show [file]"
+  ).option("--out <file>", "For bundle: write to a specific path").action(
+    async (action, file, opts) => {
+      const mod = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
+      if (action === "verify") {
+        if (!file) {
+          process.stderr.write("veris: evidence verify needs a <file>\n");
+          process.exitCode = 1;
+          return;
+        }
+        process.exitCode = await mod.runEvidenceVerify(file);
+      } else if (action === "bundle") {
+        process.exitCode = await mod.runEvidenceBundle(process.cwd(), {
+          out: opts.out
+        });
+      } else if (action === "show") {
+        process.exitCode = await mod.runEvidenceShow(process.cwd(), file);
+      } else {
+        process.stderr.write(
+          `veris: unknown evidence action '${action}' (use verify | bundle | show)
+`
+        );
+        process.exitCode = 1;
+      }
+    }
+  );
   return { raw: cli, version: VERSION };
 }
 async function main(argv2) {