veriskit 0.2.0

package/dist/index.js

@@ -0,0 +1,1268 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/util/fs-safe.ts
+import { existsSync } from "fs";
+import { mkdir, readFile, writeFile } from "fs/promises";
+async function ensureDir(path) {
+  await mkdir(path, { recursive: true });
+}
+async function writeIfAbsent(path, content) {
+  if (existsSync(path)) return false;
+  await writeFile(path, content, "utf8");
+  return true;
+}
+async function readJsonIfExists(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+var init_fs_safe = __esm({
+  "src/util/fs-safe.ts"() {
+    "use strict";
+  }
+});
+
+// src/config/detect.ts
+import { existsSync as existsSync2 } from "fs";
+import { join } from "path";
+function detectPackageManager(root) {
+  if (existsSync2(join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync2(join(root, "yarn.lock"))) return "yarn";
+  if (existsSync2(join(root, "bun.lockb"))) return "bun";
+  return "npm";
+}
+async function detectProject(root) {
+  const pkg = await readJsonIfExists(join(root, "package.json")) ?? {};
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  const has = (name) => name in deps;
+  const scripts = pkg.scripts ?? {};
+  const languages = existsSync2(join(root, "tsconfig.json")) ? ["typescript", "javascript"] : ["javascript"];
+  const frameworks = ["next", "vite", "react"].filter(has);
+  const capabilities = [
+    detectTypes(root, has),
+    detectUnit(has, scripts),
+    detectLint(root, has),
+    detectBrowser(root, has)
+  ];
+  return {
+    root,
+    packageManager: detectPackageManager(root),
+    frameworks,
+    languages,
+    scripts,
+    capabilities
+  };
+}
+function detectTypes(root, has) {
+  if (existsSync2(join(root, "tsconfig.json")) && has("typescript"))
+    return { id: "types", available: true, runner: "tsc" };
+  return {
+    id: "types",
+    available: false,
+    reason: "no tsconfig.json + typescript dependency"
+  };
+}
+function detectUnit(has, scripts) {
+  if (has("vitest")) return { id: "unit", available: true, runner: "vitest" };
+  if (has("jest")) return { id: "unit", available: true, runner: "jest" };
+  if (Object.values(scripts).some((s) => s.includes("node --test")))
+    return { id: "unit", available: true, runner: "node-test" };
+  return { id: "unit", available: false, reason: "no test runner detected" };
+}
+function detectLint(root, has) {
+  if (existsSync2(join(root, "biome.json")) || has("@biomejs/biome"))
+    return { id: "lint", available: true, runner: "biome" };
+  if (has("eslint") || [".eslintrc", ".eslintrc.json", ".eslintrc.cjs", "eslint.config.js"].some(
+    (f) => existsSync2(join(root, f))
+  ))
+    return { id: "lint", available: true, runner: "eslint" };
+  return { id: "lint", available: false, reason: "no linter configured" };
+}
+function detectBrowser(root, has) {
+  if (has("@playwright/test") || existsSync2(join(root, "playwright.config.ts")))
+    return {
+      id: "browser",
+      available: false,
+      runner: "playwright",
+      reason: "detected; browser execution deferred to v0.5"
+    };
+  return {
+    id: "browser",
+    available: false,
+    reason: "no browser runner configured"
+  };
+}
+var init_detect = __esm({
+  "src/config/detect.ts"() {
+    "use strict";
+    init_fs_safe();
+  }
+});
+
+// src/util/env.ts
+import { platform } from "os";
+function detectCI() {
+  return process.env.CI === "true" || process.env.CI === "1";
+}
+function getEnvironmentInfo(pm) {
+  return {
+    os: platform(),
+    node: process.version,
+    pm,
+    ci: detectCI(),
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+var init_env = __esm({
+  "src/util/env.ts"() {
+    "use strict";
+  }
+});
+
+// src/cli/tty.ts
+function isPlain() {
+  return detectCI() || !process.stdout.isTTY;
+}
+var init_tty = __esm({
+  "src/cli/tty.ts"() {
+    "use strict";
+    init_env();
+  }
+});
+
+// src/cli/commands/doctor.ts
+var doctor_exports = {};
+__export(doctor_exports, {
+  renderDoctor: () => renderDoctor,
+  runDoctor: () => runDoctor
+});
+import pc from "picocolors";
+function renderDoctor(project, env) {
+  const plain = isPlain();
+  const ok = (s) => plain ? s : pc.green(s);
+  const dim = (s) => plain ? s : pc.dim(s);
+  const lines = [];
+  lines.push("Veris doctor");
+  lines.push("");
+  lines.push(`Package manager  ${project.packageManager}`);
+  lines.push(`Node             ${env.node}`);
+  lines.push(`Languages        ${project.languages.join(", ")}`);
+  if (project.frameworks.length)
+    lines.push(`Frameworks       ${project.frameworks.join(", ")}`);
+  lines.push("");
+  lines.push("Capabilities");
+  for (const c of project.capabilities) {
+    if (c.available) {
+      lines.push(`  ${ok("\u2713")} ${c.id.padEnd(8)} ${dim(`via ${c.runner}`)}`);
+    } else {
+      lines.push(
+        `  ${dim("\u2298")} ${c.id.padEnd(8)} ${dim(`skipped \u2014 ${c.reason}`)}`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+async function runDoctor(root) {
+  const project = await detectProject(root);
+  const env = getEnvironmentInfo(project.packageManager);
+  process.stdout.write(`${renderDoctor(project, env)}
+`);
+  return 0;
+}
+var init_doctor = __esm({
+  "src/cli/commands/doctor.ts"() {
+    "use strict";
+    init_detect();
+    init_env();
+    init_tty();
+  }
+});
+
+// src/evidence/store.ts
+import { writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
+function newRunId() {
+  counter += 1;
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  return `${stamp}-${counter}`;
+}
+async function createRunDir(root, id) {
+  const dir = join2(root, ".veris", "runs", id);
+  await ensureDir(dir);
+  return dir;
+}
+async function writeLog(runDir, checkId, content) {
+  const ref = join2(runDir, `${checkId}.log`);
+  await writeFile2(ref, content, "utf8");
+  return ref;
+}
+async function writeMetadata(runDir, run) {
+  const ref = join2(runDir, "metadata.json");
+  await writeFile2(ref, JSON.stringify(run, null, 2), "utf8");
+  return ref;
+}
+async function writeReport(root, id, markdown) {
+  const dir = join2(root, ".veris", "reports");
+  await ensureDir(dir);
+  const ref = join2(dir, `verify-${id}.md`);
+  await writeFile2(ref, markdown, "utf8");
+  return ref;
+}
+var counter;
+var init_store = __esm({
+  "src/evidence/store.ts"() {
+    "use strict";
+    init_fs_safe();
+    counter = 0;
+  }
+});
+
+// src/util/exec.ts
+import { spawn } from "child_process";
+function exec(cmd, args, opts = {}) {
+  return new Promise((resolve) => {
+    const start = performance.now();
+    const child = spawn(cmd, args, {
+      cwd: opts.cwd,
+      env: opts.env ?? process.env,
+      shell: false
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    const timer = opts.timeoutMs ? setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, opts.timeoutMs) : null;
+    child.stdout.on("data", (d) => stdout += d.toString());
+    child.stderr.on("data", (d) => stderr += d.toString());
+    child.on("close", (code) => {
+      if (timer) clearTimeout(timer);
+      resolve({
+        code: code ?? 1,
+        stdout,
+        stderr,
+        durationMs: Math.round(performance.now() - start),
+        timedOut
+      });
+    });
+    child.on("error", () => {
+      if (timer) clearTimeout(timer);
+      resolve({
+        code: 127,
+        stdout,
+        stderr: stderr || `failed to spawn ${cmd}`,
+        durationMs: Math.round(performance.now() - start),
+        timedOut
+      });
+    });
+  });
+}
+var init_exec = __esm({
+  "src/util/exec.ts"() {
+    "use strict";
+  }
+});
+
+// src/runners/base.ts
+import { join as join3 } from "path";
+function localBin(root, name) {
+  return join3(root, "node_modules", ".bin", name);
+}
+async function runViaExec(check, ctx, opts) {
+  const r = await exec(check.cmd, check.args, {
+    cwd: ctx.root,
+    timeoutMs: opts.timeoutMs
+  });
+  const status = r.code === 0 ? "passed" : r.timedOut ? "unknown" : "failed";
+  const output = [r.stdout, r.stderr].filter(Boolean).join("\n").trim();
+  const logRef = await writeLog(ctx.runDir, check.id, `${output}
+`);
+  const result = {
+    checkId: check.id,
+    status,
+    durationMs: r.durationMs,
+    summary: status === "passed" ? opts.pass : r.timedOut ? "timed out" : opts.fail,
+    logRef
+  };
+  if (status !== "passed" && output) {
+    result.outputTail = output.split("\n").slice(-TAIL_LINES).join("\n");
+  }
+  return result;
+}
+var TAIL_LINES;
+var init_base = __esm({
+  "src/runners/base.ts"() {
+    "use strict";
+    init_store();
+    init_exec();
+    TAIL_LINES = 20;
+  }
+});
+
+// src/runners/biome.ts
+var biomeRunner;
+var init_biome = __esm({
+  "src/runners/biome.ts"() {
+    "use strict";
+    init_base();
+    biomeRunner = {
+      id: "biome",
+      toCheck(project, _cap) {
+        return {
+          id: "lint",
+          title: "Lint",
+          runner: "biome",
+          cmd: localBin(project.root, "biome"),
+          args: ["check", "."]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "no lint errors",
+          fail: "lint errors found",
+          timeoutMs: 3 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/eslint.ts
+var eslintRunner;
+var init_eslint = __esm({
+  "src/runners/eslint.ts"() {
+    "use strict";
+    init_base();
+    eslintRunner = {
+      id: "eslint",
+      toCheck(project, _cap) {
+        return {
+          id: "lint",
+          title: "Lint",
+          runner: "eslint",
+          cmd: localBin(project.root, "eslint"),
+          args: ["."]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "no lint errors",
+          fail: "lint errors found",
+          timeoutMs: 3 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/jest.ts
+var jestRunner;
+var init_jest = __esm({
+  "src/runners/jest.ts"() {
+    "use strict";
+    init_base();
+    jestRunner = {
+      id: "jest",
+      toCheck(project, _cap) {
+        return {
+          id: "unit",
+          title: "Unit tests",
+          runner: "jest",
+          cmd: localBin(project.root, "jest"),
+          args: ["--ci"]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "unit tests passed",
+          fail: "unit tests failed",
+          timeoutMs: 10 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/node-test.ts
+var nodeTestRunner;
+var init_node_test = __esm({
+  "src/runners/node-test.ts"() {
+    "use strict";
+    init_base();
+    nodeTestRunner = {
+      id: "node-test",
+      toCheck(_project, _cap) {
+        return {
+          id: "unit",
+          title: "Unit tests",
+          runner: "node-test",
+          cmd: process.execPath,
+          args: ["--test"]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "unit tests passed",
+          fail: "unit tests failed",
+          timeoutMs: 10 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/tsc.ts
+var tscRunner;
+var init_tsc = __esm({
+  "src/runners/tsc.ts"() {
+    "use strict";
+    init_base();
+    tscRunner = {
+      id: "tsc",
+      toCheck(project, _cap) {
+        return {
+          id: "types",
+          title: "Types",
+          runner: "tsc",
+          cmd: localBin(project.root, "tsc"),
+          args: ["--noEmit", "--pretty", "false"]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "no type errors",
+          fail: "type errors found",
+          timeoutMs: 5 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/vitest.ts
+var vitestRunner;
+var init_vitest = __esm({
+  "src/runners/vitest.ts"() {
+    "use strict";
+    init_base();
+    vitestRunner = {
+      id: "vitest",
+      toCheck(project, _cap) {
+        return {
+          id: "unit",
+          title: "Unit tests",
+          runner: "vitest",
+          cmd: localBin(project.root, "vitest"),
+          args: ["run", "--reporter=json"]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "unit tests passed",
+          fail: "unit tests failed",
+          timeoutMs: 10 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/index.ts
+var runners;
+var init_runners = __esm({
+  "src/runners/index.ts"() {
+    "use strict";
+    init_biome();
+    init_eslint();
+    init_jest();
+    init_node_test();
+    init_tsc();
+    init_vitest();
+    init_base();
+    runners = {
+      tsc: tscRunner,
+      vitest: vitestRunner,
+      jest: jestRunner,
+      "node-test": nodeTestRunner,
+      eslint: eslintRunner,
+      biome: biomeRunner
+    };
+  }
+});
+
+// src/core/verdict.ts
+function computeVerdict(results, capabilities) {
+  const reasons = [];
+  const skipped = [];
+  const verifiedCapabilities = [];
+  const anyFailed = results.some((r) => r.status === "failed");
+  for (const cap of capabilities) {
+    const result = results.find((r) => r.checkId === cap.id);
+    if (!cap.available) {
+      skipped.push(cap.id);
+      reasons.push(`${cap.id} skipped \u2014 ${cap.reason ?? "not configured"}`);
+      continue;
+    }
+    if (result?.status === "passed") {
+      verifiedCapabilities.push(cap.id);
+      continue;
+    }
+    if (result?.status === "failed") {
+      reasons.push(`${cap.id} failed \u2014 ${result.summary}`);
+      continue;
+    }
+    skipped.push(cap.id);
+    reasons.push(`${cap.id} skipped \u2014 ${result?.summary ?? "did not run"}`);
+  }
+  let state;
+  if (anyFailed) state = "failed";
+  else if (skipped.length > 0) state = "partial";
+  else state = "verified";
+  return { state, verifiedCapabilities, skipped, reasons };
+}
+function verdictExitCode(verdict, opts = {}) {
+  if (verdict.state === "failed") return 1;
+  if (verdict.state === "partial") return opts.partialOk ? 0 : 2;
+  return 0;
+}
+var init_verdict = __esm({
+  "src/core/verdict.ts"() {
+    "use strict";
+  }
+});
+
+// src/core/orchestrator.ts
+async function runChecks(project, ids, root) {
+  const known = new Set(project.capabilities.map((c) => c.id));
+  const unknown = ids.filter((id2) => !known.has(id2));
+  if (unknown.length > 0) {
+    throw new Error(`Unknown check id(s): ${unknown.join(", ")}`);
+  }
+  const id = newRunId();
+  const runDir = await createRunDir(root, id);
+  const ctx = { root, runDir };
+  const tasks = ids.map(async (capId) => {
+    const cap = project.capabilities.find((c) => c.id === capId);
+    const runner = cap?.runner ? runners[cap.runner] : void 0;
+    if (!cap?.available || !runner) {
+      const summary = !cap?.available ? cap?.reason ?? "not configured" : `no runner registered for ${cap.runner}`;
+      return {
+        checkId: capId,
+        status: "skipped",
+        durationMs: 0,
+        summary
+      };
+    }
+    const check = runner.toCheck(project, cap);
+    return runner.run(check, ctx);
+  });
+  const results = await Promise.all(tasks);
+  const requested = project.capabilities.filter((c) => ids.includes(c.id));
+  const verdict = computeVerdict(results, requested);
+  return {
+    id,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    project,
+    results,
+    verdict,
+    env: getEnvironmentInfo(project.packageManager)
+  };
+}
+var init_orchestrator = __esm({
+  "src/core/orchestrator.ts"() {
+    "use strict";
+    init_store();
+    init_runners();
+    init_env();
+    init_verdict();
+  }
+});
+
+// src/reporters/terminal.ts
+import pc2 from "picocolors";
+function glyph(status, plain) {
+  const map = {
+    passed: "\u2713",
+    failed: "\u2717",
+    skipped: "\u2298",
+    unknown: "?"
+  };
+  const g = map[status];
+  if (plain) return g;
+  if (status === "passed") return pc2.green(g);
+  if (status === "failed") return pc2.red(g);
+  return pc2.dim(g);
+}
+function secs(ms) {
+  return ms === 0 ? "" : `${(ms / 1e3).toFixed(1)}s`;
+}
+function renderRun(run) {
+  const plain = isPlain();
+  const bold = (s) => plain ? s : pc2.bold(s);
+  const dim = (s) => plain ? s : pc2.dim(s);
+  const lines = [];
+  const scoped = run.scope?.kind;
+  if (scoped) {
+    lines.push(bold(`Veris \u2014 ${scoped}`));
+    lines.push("");
+    lines.push(`Scope       ${run.scope?.changedCount ?? 0} changed file(s)`);
+  } else {
+    lines.push(bold("Veris"));
+    lines.push("");
+    lines.push(
+      `Project     ${run.project.root.split("/").pop() ?? run.project.root}`
+    );
+    lines.push(`Risk        ${dim("\u2014")}`);
+  }
+  lines.push("");
+  lines.push("Checks");
+  for (const r of run.results) {
+    const g = glyph(r.status, plain);
+    const detail = r.status === "skipped" ? dim(`skipped \u2014 ${r.summary}`) : r.cached ? dim(`\u27F3 cached \xB7 ${secs(r.durationMs) || "\u2014"}`) : secs(r.durationMs);
+    lines.push(`  ${g} ${r.checkId.padEnd(14)} ${detail}`);
+    if (r.outputTail) {
+      for (const tail of r.outputTail.split("\n")) {
+        lines.push(dim(`    ${tail}`));
+      }
+    }
+  }
+  lines.push("");
+  lines.push("Result");
+  const label = run.verdict.state === "verified" ? scoped ? "\u2713 Affected checks passed" : "\u2713 Verified" : run.verdict.state === "failed" ? scoped ? "\u2717 Affected checks failed" : "\u2717 Failed" : scoped ? "\u25B2 Affected: partial" : "\u25B2 Partial";
+  const color = run.verdict.state === "verified" ? pc2.green : run.verdict.state === "failed" ? pc2.red : pc2.yellow;
+  lines.push(`  ${plain ? label : color(label)}`);
+  if (run.reportRef) {
+    lines.push("");
+    lines.push("Report");
+    lines.push(`  ${run.reportRef}`);
+  }
+  return lines.join("\n");
+}
+var init_terminal = __esm({
+  "src/reporters/terminal.ts"() {
+    "use strict";
+    init_tty();
+  }
+});
+
+// src/cli/commands/test.ts
+var test_exports = {};
+__export(test_exports, {
+  runTest: () => runTest
+});
+async function runTest(root) {
+  const project = await detectProject(root);
+  const run = await runChecks(project, ["unit"], root);
+  process.stdout.write(`${renderRun(run)}
+`);
+  return verdictExitCode(run.verdict);
+}
+var init_test = __esm({
+  "src/cli/commands/test.ts"() {
+    "use strict";
+    init_detect();
+    init_orchestrator();
+    init_verdict();
+    init_terminal();
+  }
+});
+
+// src/cli/commands/init.ts
+var init_exports = {};
+__export(init_exports, {
+  runInit: () => runInit
+});
+import { join as join4 } from "path";
+async function runInit(root) {
+  const project = await detectProject(root);
+  const dir = join4(root, ".veris");
+  await ensureDir(dir);
+  const defaultChecks = project.capabilities.filter((c) => c.available && c.id !== "browser").map((c) => c.id);
+  const wroteConfig = await writeIfAbsent(
+    join4(dir, "config.json"),
+    `${JSON.stringify({ checks: defaultChecks }, null, 2)}
+`
+  );
+  await writeIfAbsent(join4(dir, ".gitignore"), GITIGNORE);
+  process.stdout.write(
+    wroteConfig ? `Veris initialized. Detected checks: ${defaultChecks.join(", ") || "none"}.
+` : "Veris already initialized (.veris/config.json exists). Nothing overwritten.\n"
+  );
+  return 0;
+}
+var GITIGNORE;
+var init_init = __esm({
+  "src/cli/commands/init.ts"() {
+    "use strict";
+    init_detect();
+    init_fs_safe();
+    GITIGNORE = ["runs/", "reports/", "cache/", ""].join("\n");
+  }
+});
+
+// src/config/load.ts
+import { join as join5 } from "path";
+async function loadConfig(root) {
+  return readJsonIfExists(join5(root, ".veris", "config.json"));
+}
+var init_load = __esm({
+  "src/config/load.ts"() {
+    "use strict";
+    init_fs_safe();
+  }
+});
+
+// src/reporters/markdown.ts
+import { relative } from "path";
+function cell(value) {
+  return value.replace(/\|/g, "\\|");
+}
+function renderMarkdown(run) {
+  const root = run.project.root;
+  const lines = [];
+  lines.push("# Veris Verification Report");
+  if (run.scope?.kind) {
+    lines.push("");
+    lines.push(
+      `> **Scope:** ${run.scope.kind} \u2014 ${run.scope.changedCount} changed file(s). Only affected checks ran; this is not a full verification.`
+    );
+  }
+  lines.push("");
+  lines.push(`**Verdict:** ${STATE_LABEL[run.verdict.state]}`);
+  lines.push(`**When:** ${run.startedAt}`);
+  lines.push(
+    `**Node:** ${run.env.node} \xB7 **OS:** ${run.env.os} \xB7 **PM:** ${run.env.pm} \xB7 **CI:** ${run.env.ci}`
+  );
+  lines.push("");
+  lines.push("## Checks");
+  lines.push("");
+  lines.push("| Check | Status | Duration | Summary | Log |");
+  lines.push("| --- | --- | --- | --- | --- |");
+  for (const r of run.results) {
+    const dur = r.durationMs ? `${(r.durationMs / 1e3).toFixed(1)}s` : "\u2014";
+    const log = r.logRef ? cell(relative(root, r.logRef)) : "\u2014";
+    lines.push(
+      `| ${r.checkId} | ${r.status} | ${dur} | ${cell(r.summary)} | ${log} |`
+    );
+  }
+  if (run.verdict.skipped.length) {
+    lines.push("");
+    lines.push("## Skipped");
+    lines.push("");
+    for (const reason of run.verdict.reasons) lines.push(`- ${reason}`);
+  }
+  const failures = run.results.filter((r) => r.outputTail);
+  if (failures.length) {
+    lines.push("");
+    lines.push("## Failure output");
+    for (const r of failures) {
+      lines.push("");
+      lines.push(`### ${r.checkId}`);
+      lines.push("");
+      lines.push("```");
+      lines.push(r.outputTail ?? "");
+      lines.push("```");
+    }
+  }
+  lines.push("");
+  lines.push(
+    "_Generated by Veris. A `Partial` verdict means one or more capabilities did not run \u2014 it is not a pass._"
+  );
+  lines.push("");
+  return lines.join("\n");
+}
+var STATE_LABEL;
+var init_markdown = __esm({
+  "src/reporters/markdown.ts"() {
+    "use strict";
+    STATE_LABEL = {
+      verified: "Verified",
+      failed: "Failed",
+      partial: "Partial"
+    };
+  }
+});
+
+// src/cli/commands/verify.ts
+var verify_exports = {};
+__export(verify_exports, {
+  runVerify: () => runVerify
+});
+async function runVerify(root, opts = {}) {
+  const project = await detectProject(root);
+  const config = await loadConfig(root);
+  const checks = config?.checks?.length ? config.checks : DEFAULT_CHECKS;
+  const run = await runChecks(project, checks, root);
+  const reportRef = await writeReport(root, run.id, renderMarkdown(run));
+  run.reportRef = reportRef;
+  const runDir = await createRunDir(root, run.id);
+  await writeMetadata(runDir, run);
+  process.stdout.write(`${renderRun(run)}
+`);
+  return verdictExitCode(run.verdict, opts);
+}
+var DEFAULT_CHECKS;
+var init_verify = __esm({
+  "src/cli/commands/verify.ts"() {
+    "use strict";
+    init_detect();
+    init_load();
+    init_orchestrator();
+    init_verdict();
+    init_store();
+    init_markdown();
+    init_terminal();
+    DEFAULT_CHECKS = ["types", "lint", "unit"];
+  }
+});
+
+// src/cli/commands/report.ts
+var report_exports = {};
+__export(report_exports, {
+  runReport: () => runReport
+});
+import { readdirSync, readFileSync as readFileSync2 } from "fs";
+import { join as join6 } from "path";
+async function runReport(root) {
+  const dir = join6(root, ".veris", "reports");
+  let files;
+  try {
+    files = readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+  } catch {
+    process.stdout.write("No reports yet. Run `veris verify` first.\n");
+    return 0;
+  }
+  const latest = files.at(-1);
+  if (!latest) {
+    process.stdout.write("No reports yet. Run `veris verify` first.\n");
+    return 0;
+  }
+  process.stdout.write(`${readFileSync2(join6(dir, latest), "utf8")}
+`);
+  return 0;
+}
+var init_report = __esm({
+  "src/cli/commands/report.ts"() {
+    "use strict";
+  }
+});
+
+// src/affected/gate.ts
+function affectedChecks(files, project) {
+  const available = new Set(
+    project.capabilities.filter((c) => c.available).map((c) => c.id)
+  );
+  const wanted = /* @__PURE__ */ new Set();
+  const reasonByCheck = {};
+  const want = (id, reason) => {
+    if (available.has(id) && !wanted.has(id)) {
+      wanted.add(id);
+      reasonByCheck[id] = reason;
+    }
+  };
+  const wantAll = (reason) => {
+    for (const id of available) want(id, reason);
+  };
+  for (const f of files) {
+    if (CONFIG_RE.test(f)) {
+      wantAll(`config changed (${f})`);
+    } else if (DOC_RE.test(f)) {
+    } else if (TEST_RE.test(f)) {
+      want("unit", "test file changed");
+      want("lint", "test file changed");
+    } else if (TS_RE.test(f)) {
+      want("types", "TypeScript changed");
+      want("lint", "TypeScript changed");
+      want("unit", "TypeScript changed");
+    } else if (JS_RE.test(f)) {
+      want("lint", "JavaScript changed");
+      want("unit", "JavaScript changed");
+    } else {
+      wantAll(`unrecognized file changed (${f})`);
+    }
+  }
+  return {
+    checks: ORDER.filter((id) => wanted.has(id)),
+    reasonByCheck,
+    changedCount: files.length
+  };
+}
+var ORDER, CONFIG_RE, TEST_RE, TS_RE, JS_RE, DOC_RE;
+var init_gate = __esm({
+  "src/affected/gate.ts"() {
+    "use strict";
+    ORDER = ["types", "lint", "unit", "browser"];
+    CONFIG_RE = /(^|\/)(tsconfig[^/]*\.json|biome\.jsonc?|\.eslintrc[^/]*|eslint\.config\.[^/]+|package\.json|veris\.config\.[^/]+)$/;
+    TEST_RE = /(\.(test|spec)\.[cm]?[jt]sx?$)|(^|\/)(test|__tests__)\//;
+    TS_RE = /\.[cm]?tsx?$/;
+    JS_RE = /\.[cm]?jsx?$/;
+    DOC_RE = /(\.(md|mdx|markdown|txt|png|jpe?g|gif|svg|webp|ico)$)|((^|\/)LICENSE$)/i;
+  }
+});
+
+// src/git/changes.ts
+function collect(set, out) {
+  for (const line of out.split("\n")) {
+    const f = line.trim();
+    if (f) set.add(f);
+  }
+}
+async function changedFiles(root, opts = {}) {
+  const base = opts.base ?? null;
+  const files = /* @__PURE__ */ new Set();
+  const diffArgs = base ? ["diff", "--name-only", base] : ["diff", "--name-only", "HEAD"];
+  const diff = await exec("git", diffArgs, { cwd: root });
+  if (diff.code === 0) collect(files, diff.stdout);
+  const untracked = await exec(
+    "git",
+    ["ls-files", "--others", "--exclude-standard"],
+    { cwd: root }
+  );
+  if (untracked.code === 0) collect(files, untracked.stdout);
+  return { files: [...files].sort(), base };
+}
+var init_changes = __esm({
+  "src/git/changes.ts"() {
+    "use strict";
+    init_exec();
+  }
+});
+
+// src/cli/commands/affected.ts
+var affected_exports = {};
+__export(affected_exports, {
+  runAffected: () => runAffected
+});
+async function runAffected(root, opts = {}) {
+  const project = await detectProject(root);
+  const { files } = await changedFiles(root, { base: opts.base });
+  const plan = affectedChecks(files, project);
+  if (plan.checks.length === 0) {
+    process.stdout.write(
+      `Nothing affected \u2014 ${files.length} changed file(s), no checks to run.
+`
+    );
+    return 0;
+  }
+  const run = await runChecks(project, plan.checks, root);
+  run.scope = { kind: "affected", changedCount: files.length };
+  const affected = new Set(plan.checks);
+  for (const cap of project.capabilities) {
+    if (cap.available && cap.id !== "browser" && !affected.has(cap.id)) {
+      run.results.push({
+        checkId: cap.id,
+        status: "skipped",
+        durationMs: 0,
+        summary: "not affected by changes"
+      });
+    }
+  }
+  const reportRef = await writeReport(root, run.id, renderMarkdown(run));
+  run.reportRef = reportRef;
+  const runDir = await createRunDir(root, run.id);
+  await writeMetadata(runDir, run);
+  process.stdout.write(`${renderRun(run)}
+`);
+  return verdictExitCode(run.verdict, opts);
+}
+var init_affected = __esm({
+  "src/cli/commands/affected.ts"() {
+    "use strict";
+    init_gate();
+    init_detect();
+    init_orchestrator();
+    init_verdict();
+    init_store();
+    init_changes();
+    init_markdown();
+    init_terminal();
+  }
+});
+
+// src/watch/watcher.ts
+import {
+  watch as fsWatch,
+  readdirSync as readdirSync2,
+  statSync
+} from "fs";
+import { basename, join as join7, relative as relative2 } from "path";
+function watch(root, opts, onBatch) {
+  const debounceMs = opts.debounceMs ?? 150;
+  const rootBase = basename(root);
+  let pending = /* @__PURE__ */ new Set();
+  let timer = null;
+  const flush = () => {
+    const batch = [...pending];
+    pending = /* @__PURE__ */ new Set();
+    timer = null;
+    if (batch.length) onBatch(batch);
+  };
+  const schedule = (rel) => {
+    if (!rel || rel === rootBase || IGNORE.test(rel)) return;
+    pending.add(rel);
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(flush, debounceMs);
+  };
+  if (opts.poll) {
+    const interval = opts.pollIntervalMs ?? 400;
+    const mtimes = scanMtimes(root);
+    const tick = setInterval(() => {
+      const next = scanMtimes(root);
+      for (const [p, m] of next) {
+        if (mtimes.get(p) !== m) schedule(p);
+      }
+      mtimes.clear();
+      for (const [p, m] of next) mtimes.set(p, m);
+    }, interval);
+    return () => {
+      clearInterval(tick);
+      if (timer) clearTimeout(timer);
+    };
+  }
+  let watcher;
+  try {
+    watcher = fsWatch(root, { recursive: true }, (_event, filename) => {
+      if (filename) schedule(filename.toString());
+    });
+  } catch {
+    throw new Error(
+      "recursive fs.watch is unavailable on this platform; rerun with --poll"
+    );
+  }
+  return () => {
+    if (timer) clearTimeout(timer);
+    watcher.close();
+  };
+}
+function scanMtimes(root) {
+  const out = /* @__PURE__ */ new Map();
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync2(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      const abs = join7(dir, name);
+      const rel = relative2(root, abs);
+      if (IGNORE.test(rel)) continue;
+      let st;
+      try {
+        st = statSync(abs);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) walk(abs);
+      else out.set(rel, st.mtimeMs);
+    }
+  };
+  walk(root);
+  return out;
+}
+var IGNORE;
+var init_watcher = __esm({
+  "src/watch/watcher.ts"() {
+    "use strict";
+    IGNORE = /(^|\/)(\.git|\.veris|\.agentloop|\.agentflight|node_modules|dist)(\/|$)/;
+  }
+});
+
+// src/cli/commands/watch.ts
+var watch_exports = {};
+__export(watch_exports, {
+  buildWatchResults: () => buildWatchResults,
+  runWatch: () => runWatch
+});
+function buildWatchResults(project, affected, fresh, cache) {
+  const affectedSet = new Set(affected);
+  const freshById = new Map(fresh.map((r) => [r.checkId, r]));
+  const out = [];
+  for (const cap of project.capabilities) {
+    if (!cap.available || cap.id === "browser") continue;
+    const f = freshById.get(cap.id);
+    if (f) {
+      out.push({ ...f, cached: false });
+      continue;
+    }
+    const c = cache.get(cap.id);
+    if (c && !affectedSet.has(cap.id)) {
+      out.push({ ...c, cached: true });
+      continue;
+    }
+    out.push({
+      checkId: cap.id,
+      status: "skipped",
+      durationMs: 0,
+      summary: "not affected by changes"
+    });
+  }
+  return out;
+}
+async function runWatch(root, opts = {}) {
+  const cache = /* @__PURE__ */ new Map();
+  let running = false;
+  const availableIds = (project) => project.capabilities.filter((c) => c.available && c.id !== "browser").map((c) => c.id);
+  const tick = async (initial) => {
+    if (running) return;
+    running = true;
+    try {
+      const project = await detectProject(root);
+      const { files } = await changedFiles(root);
+      const checks = initial ? availableIds(project) : affectedChecks(files, project).checks;
+      let fresh = [];
+      if (checks.length) {
+        const r = await runChecks(project, checks, root);
+        fresh = r.results;
+        for (const result of fresh) cache.set(result.checkId, { ...result });
+      }
+      const results = buildWatchResults(project, checks, fresh, cache);
+      const availableCaps = project.capabilities.filter(
+        (c) => c.available && c.id !== "browser"
+      );
+      const verdict = computeVerdict(results, availableCaps);
+      const run = {
+        id: "watch",
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        project,
+        results,
+        verdict,
+        env: {
+          os: process.platform,
+          node: process.version,
+          pm: project.packageManager,
+          ci: false,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        },
+        scope: { kind: "watch", changedCount: files.length }
+      };
+      process.stdout.write(`${renderRun(run)}
+`);
+    } finally {
+      running = false;
+    }
+  };
+  process.stdout.write("veris watch \u2014 press Ctrl-C to stop\n");
+  await tick(true);
+  return await new Promise((resolve) => {
+    let stop;
+    try {
+      stop = watch(root, { poll: opts.poll }, () => {
+        void tick(false);
+      });
+    } catch (err) {
+      process.stderr.write(
+        `veris: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      resolve(1);
+      return;
+    }
+    process.on("SIGINT", () => {
+      stop();
+      process.stdout.write("\nStopped.\n");
+      resolve(0);
+    });
+  });
+}
+var init_watch = __esm({
+  "src/cli/commands/watch.ts"() {
+    "use strict";
+    init_gate();
+    init_detect();
+    init_orchestrator();
+    init_verdict();
+    init_changes();
+    init_terminal();
+    init_watcher();
+  }
+});
+
+// src/cli/index.ts
+import { realpathSync } from "fs";
+import { argv } from "process";
+import { pathToFileURL } from "url";
+import cac from "cac";
+
+// src/version.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+var pkgUrl = new URL("../package.json", import.meta.url);
+var VERSION = JSON.parse(
+  readFileSync(fileURLToPath(pkgUrl), "utf8")
+).version;
+
+// src/cli/index.ts
+function buildCli() {
+  const cli = cac("veris");
+  cli.version(VERSION);
+  cli.help();
+  cli.command("doctor", "Report environment + capabilities (read-only)").action(async () => {
+    const { runDoctor: runDoctor2 } = await Promise.resolve().then(() => (init_doctor(), doctor_exports));
+    process.exitCode = await runDoctor2(process.cwd());
+  });
+  cli.command("test", "Run the detected unit test runner").action(async () => {
+    const { runTest: runTest2 } = await Promise.resolve().then(() => (init_test(), test_exports));
+    process.exitCode = await runTest2(process.cwd());
+  });
+  cli.command("init", "Detect the stack and set up .veris (idempotent)").action(async () => {
+    const { runInit: runInit2 } = await Promise.resolve().then(() => (init_init(), init_exports));
+    process.exitCode = await runInit2(process.cwd());
+  });
+  cli.command("verify", "Run the full check set and produce a verdict + report").option("--partial-ok", "Exit 0 even when the verdict is partial").action(async (opts) => {
+    const { runVerify: runVerify2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
+    process.exitCode = await runVerify2(process.cwd(), {
+      partialOk: opts.partialOk
+    });
+  });
+  cli.command("report", "Print the latest verification report").action(async () => {
+    const { runReport: runReport2 } = await Promise.resolve().then(() => (init_report(), report_exports));
+    process.exitCode = await runReport2(process.cwd());
+  });
+  cli.command("affected", "Run only the checks affected by changed files").option("--base <ref>", "Compare against a git ref instead of HEAD").option("--partial-ok", "Exit 0 even when the verdict is partial").action(async (opts) => {
+    const { runAffected: runAffected2 } = await Promise.resolve().then(() => (init_affected(), affected_exports));
+    process.exitCode = await runAffected2(process.cwd(), {
+      base: opts.base,
+      partialOk: opts.partialOk
+    });
+  });
+  cli.command("watch", "Re-run affected checks as files change (Ctrl-C to stop)").option("--poll", "Use mtime polling instead of native fs.watch").action(async (opts) => {
+    const { runWatch: runWatch2 } = await Promise.resolve().then(() => (init_watch(), watch_exports));
+    process.exitCode = await runWatch2(process.cwd(), { poll: opts.poll });
+  });
+  return { raw: cli, version: VERSION };
+}
+async function main(argv2) {
+  try {
+    const { raw } = buildCli();
+    if (argv2.length <= 2) {
+      raw.outputHelp();
+      return;
+    }
+    raw.parse(argv2);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: ${msg}
+`);
+    process.exitCode = 1;
+  }
+}
+var invokedPath = argv[1] ? realpathSync(argv[1]) : "";
+var isEntry = import.meta.url === pathToFileURL(invokedPath).href;
+if (isEntry) void main(argv);
+export {
+  buildCli,
+  main
+};