veriskit 0.3.0 → 0.4.1

package/dist/index.js

@@ -8,6 +8,20 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/version.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+var pkgUrl, VERSION;
+var init_version = __esm({
+  "src/version.ts"() {
+    "use strict";
+    pkgUrl = new URL("../package.json", import.meta.url);
+    VERSION = JSON.parse(
+      readFileSync(fileURLToPath(pkgUrl), "utf8")
+    ).version;
+  }
+});
+
 // src/util/fs-safe.ts
 import { existsSync } from "fs";
 import { mkdir, readFile, writeFile } from "fs/promises";
@@ -57,6 +71,7 @@ async function detectProject(root) {
   ];
   return {
     root,
+    name: pkg.name ?? void 0,
     packageManager: detectPackageManager(root),
     frameworks,
     languages,
@@ -153,7 +168,7 @@ function renderDoctor(project, env) {
   const ok = (s) => plain ? s : pc.green(s);
   const dim = (s) => plain ? s : pc.dim(s);
   const lines = [];
-  lines.push("Veris doctor");
+  lines.push("VerisKit doctor");
   lines.push("");
   lines.push(`Package manager  ${project.packageManager}`);
   lines.push(`Node             ${env.node}`);
@@ -189,8 +204,80 @@ var init_doctor = __esm({
   }
 });
 
+// src/evidence/record.ts
+import { createHash } from "crypto";
+import { basename } from "path";
+function canonicalize(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+  if (Array.isArray(value)) return value.map(sortValue);
+  if (value && typeof value === "object") {
+    const src = value;
+    const out = {};
+    for (const key of Object.keys(src).sort()) {
+      if (src[key] !== void 0) out[key] = sortValue(src[key]);
+    }
+    return out;
+  }
+  return value;
+}
+function sha256(text) {
+  return `sha256:${createHash("sha256").update(text, "utf8").digest("hex")}`;
+}
+function computeDigest(record) {
+  const { digest: _omit, ...rest } = record;
+  return sha256(canonicalize(rest));
+}
+function buildRecord(run, git, logDigests, toolVersion) {
+  const runnerOf = new Map(
+    run.project.capabilities.map((c) => [c.id, c.runner])
+  );
+  const checks = run.results.map((r) => {
+    const check = {
+      id: r.checkId,
+      status: r.status,
+      durationMs: r.durationMs,
+      summary: r.summary
+    };
+    const runner = runnerOf.get(r.checkId);
+    if (runner) check.runner = runner;
+    if (r.counts) check.counts = r.counts;
+    const digest = logDigests[r.checkId];
+    if (digest) check.logDigest = digest;
+    return check;
+  });
+  const scope = run.scope ? { kind: run.scope.kind, changedCount: run.scope.changedCount } : { kind: "full", changedCount: 0 };
+  const base = {
+    schema: EVIDENCE_SCHEMA,
+    id: run.id,
+    startedAt: run.startedAt,
+    tool: { name: "veriskit", version: toolVersion },
+    git,
+    env: run.env,
+    project: {
+      name: run.project.name ?? basename(run.project.root),
+      packageManager: run.project.packageManager,
+      frameworks: run.project.frameworks,
+      languages: run.project.languages
+    },
+    scope,
+    checks,
+    verdict: run.verdict
+  };
+  return { ...base, digest: computeDigest(base) };
+}
+var EVIDENCE_SCHEMA;
+var init_record = __esm({
+  "src/evidence/record.ts"() {
+    "use strict";
+    EVIDENCE_SCHEMA = "veriskit/evidence@1";
+  }
+});
+
 // src/evidence/store.ts
-import { writeFile as writeFile2 } from "fs/promises";
+import { readdirSync } from "fs";
+import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
 import { join as join2 } from "path";
 function newRunId() {
   counter += 1;
@@ -207,11 +294,6 @@ async function writeLog(runDir, checkId, content) {
   await writeFile2(ref, content, "utf8");
   return ref;
 }
-async function writeMetadata(runDir, run) {
-  const ref = join2(runDir, "metadata.json");
-  await writeFile2(ref, JSON.stringify(run, null, 2), "utf8");
-  return ref;
-}
 async function writeReport(root, id, markdown) {
   const dir = join2(root, ".veris", "reports");
   await ensureDir(dir);
@@ -219,11 +301,54 @@ async function writeReport(root, id, markdown) {
   await writeFile2(ref, markdown, "utf8");
   return ref;
 }
+async function writeEvidence(runDir, record) {
+  const ref = join2(runDir, "evidence.json");
+  await writeFile2(ref, `${JSON.stringify(record, null, 2)}
+`, "utf8");
+  return ref;
+}
+async function digestLogs(run) {
+  const out = {};
+  for (const r of run.results) {
+    if (!r.logRef) continue;
+    try {
+      out[r.checkId] = sha256(await readFile2(r.logRef, "utf8"));
+    } catch {
+    }
+  }
+  return out;
+}
+async function readRunLogs(runDir, checkIds) {
+  const out = {};
+  for (const id of checkIds) {
+    try {
+      out[id] = await readFile2(join2(runDir, `${id}.log`), "utf8");
+    } catch {
+    }
+  }
+  return out;
+}
+function latestRunDir(root) {
+  const runs = join2(root, ".veris", "runs");
+  try {
+    const dirs = readdirSync(runs, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name !== "watch").map((d) => d.name).sort();
+    const latest = dirs.at(-1);
+    return latest ? join2(runs, latest) : null;
+  } catch {
+    return null;
+  }
+}
+async function ensureEvidenceDir(root) {
+  const dir = join2(root, ".veris", "evidence");
+  await ensureDir(dir);
+  return dir;
+}
 var counter;
 var init_store = __esm({
   "src/evidence/store.ts"() {
     "use strict";
     init_fs_safe();
+    init_record();
     counter = 0;
   }
 });
@@ -611,18 +736,18 @@ function glyph(status, plain) {
 function secs(ms) {
   return ms === 0 ? "" : `${(ms / 1e3).toFixed(1)}s`;
 }
-function renderRun(run) {
+function renderRun(run, record) {
   const plain = isPlain();
   const bold = (s) => plain ? s : pc2.bold(s);
   const dim = (s) => plain ? s : pc2.dim(s);
   const lines = [];
   const scoped = run.scope?.kind;
   if (scoped) {
-    lines.push(bold(`Veris \u2014 ${scoped}`));
+    lines.push(bold(`VerisKit \u2014 ${scoped}`));
     lines.push("");
     lines.push(`Scope       ${run.scope?.changedCount ?? 0} changed file(s)`);
   } else {
-    lines.push(bold("Veris"));
+    lines.push(bold("VerisKit"));
     lines.push("");
     lines.push(
       `Project     ${run.project.root.split("/").pop() ?? run.project.root}`
@@ -646,6 +771,13 @@ function renderRun(run) {
   const label = run.verdict.state === "verified" ? scoped ? "\u2713 Affected checks passed" : "\u2713 Verified" : run.verdict.state === "failed" ? scoped ? "\u2717 Affected checks failed" : "\u2717 Failed" : scoped ? "\u25B2 Affected: partial" : "\u25B2 Partial";
   const color = run.verdict.state === "verified" ? pc2.green : run.verdict.state === "failed" ? pc2.red : pc2.yellow;
   lines.push(`  ${plain ? label : color(label)}`);
+  if (record?.git) {
+    const g = record.git;
+    lines.push("");
+    lines.push(
+      `Commit      ${g.commit.slice(0, 7)} ${g.dirty ? "\xB7 tree dirty" : "\xB7 tree clean"}`
+    );
+  }
   if (run.reportRef) {
     lines.push("");
     lines.push("Report");
@@ -701,7 +833,7 @@ async function runInit(root) {
   await writeIfAbsent(join4(dir, ".gitignore"), GITIGNORE);
   process.stdout.write(
     wroteConfig ? `Veris initialized. Detected checks: ${defaultChecks.join(", ") || "none"}.
-` : "Veris already initialized (.veris/config.json exists). Nothing overwritten.\n"
+` : "VerisKit already initialized (.veris/config.json exists). Nothing overwritten.\n"
   );
   return 0;
 }
@@ -711,7 +843,15 @@ var init_init = __esm({
     "use strict";
     init_detect();
     init_fs_safe();
-    GITIGNORE = ["runs/", "reports/", "cache/", "graph.json", ""].join("\n");
+    GITIGNORE = [
+      "runs/",
+      "reports/",
+      "cache/",
+      "graph.json",
+      "evidence/",
+      "keys/",
+      ""
+    ].join("\n");
   }
 });
 
@@ -727,15 +867,60 @@ var init_load = __esm({
   }
 });
 
+// src/git/changes.ts
+function collect(set, out) {
+  for (const line of out.split("\n")) {
+    const f = line.trim();
+    if (f) set.add(f);
+  }
+}
+async function changedFiles(root, opts = {}) {
+  const base = opts.base ?? null;
+  const files = /* @__PURE__ */ new Set();
+  const diffArgs = base ? ["diff", "--name-only", base] : ["diff", "--name-only", "HEAD"];
+  const diff = await exec("git", diffArgs, { cwd: root });
+  if (diff.code === 0) collect(files, diff.stdout);
+  const untracked = await exec(
+    "git",
+    ["ls-files", "--others", "--exclude-standard"],
+    { cwd: root }
+  );
+  if (untracked.code === 0) collect(files, untracked.stdout);
+  return { files: [...files].sort(), base };
+}
+async function gitAnchor(root) {
+  const head = await exec("git", ["rev-parse", "HEAD"], { cwd: root });
+  if (head.code !== 0) return null;
+  const commit = head.stdout.trim();
+  const branchRes = await exec("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    cwd: root
+  });
+  const branch = branchRes.code === 0 ? branchRes.stdout.trim() : "HEAD";
+  const status = await exec("git", ["status", "--porcelain"], { cwd: root });
+  const lines = status.code === 0 ? status.stdout.split("\n").map((l) => l.trim()).filter(Boolean) : [];
+  return {
+    commit,
+    branch,
+    dirty: lines.length > 0,
+    changedFiles: lines.length
+  };
+}
+var init_changes = __esm({
+  "src/git/changes.ts"() {
+    "use strict";
+    init_exec();
+  }
+});
+
 // src/reporters/markdown.ts
 import { relative } from "path";
 function cell(value) {
   return value.replace(/\|/g, "\\|");
 }
-function renderMarkdown(run) {
+function renderMarkdown(run, record) {
   const root = run.project.root;
   const lines = [];
-  lines.push("# Veris Verification Report");
+  lines.push("# VerisKit Verification Report");
   if (run.scope?.kind) {
     lines.push("");
     lines.push(
@@ -748,6 +933,13 @@ function renderMarkdown(run) {
   lines.push(
     `**Node:** ${run.env.node} \xB7 **OS:** ${run.env.os} \xB7 **PM:** ${run.env.pm} \xB7 **CI:** ${run.env.ci}`
   );
+  if (record?.git) {
+    const g = record.git;
+    const tree = g.dirty ? `tree dirty, ${g.changedFiles} uncommitted file(s)` : "tree clean";
+    lines.push(`**Commit:** ${g.commit.slice(0, 7)} (${g.branch}) \xB7 ${tree}`);
+  } else if (record) {
+    lines.push("**Commit:** no git anchor available");
+  }
   lines.push("");
   lines.push("## Checks");
   lines.push("");
@@ -779,9 +971,16 @@ function renderMarkdown(run) {
       lines.push("```");
     }
   }
+  if (record) {
+    lines.push("");
+    lines.push(`**Evidence digest:** \`${record.digest}\``);
+    lines.push(
+      "_Integrity digest over the canonical record. Detects edits and corruption; it is not forgery-proof on its own. Publish the digest separately or sign it to prove authorship._"
+    );
+  }
   lines.push("");
   lines.push(
-    "_Generated by Veris. A `Partial` verdict means one or more capabilities did not run \u2014 it is not a pass._"
+    "_Generated by VerisKit. A `Partial` verdict means one or more capabilities did not run \u2014 it is not a pass._"
   );
   lines.push("");
   return lines.join("\n");
@@ -808,11 +1007,18 @@ async function runVerify(root, opts = {}) {
   const config = await loadConfig(root);
   const checks = config?.checks?.length ? config.checks : DEFAULT_CHECKS;
   const run = await runChecks(project, checks, root);
-  const reportRef = await writeReport(root, run.id, renderMarkdown(run));
+  const git = await gitAnchor(root);
+  const logDigests = await digestLogs(run);
+  const record = buildRecord(run, git, logDigests, VERSION);
+  const reportRef = await writeReport(
+    root,
+    run.id,
+    renderMarkdown(run, record)
+  );
   run.reportRef = reportRef;
   const runDir = await createRunDir(root, run.id);
-  await writeMetadata(runDir, run);
-  process.stdout.write(`${renderRun(run)}
+  await writeEvidence(runDir, record);
+  process.stdout.write(`${renderRun(run, record)}
 `);
   return verdictExitCode(run.verdict, opts);
 }
@@ -824,9 +1030,12 @@ var init_verify = __esm({
     init_load();
     init_orchestrator();
     init_verdict();
+    init_record();
     init_store();
+    init_changes();
     init_markdown();
     init_terminal();
+    init_version();
     DEFAULT_CHECKS = ["types", "lint", "unit"];
   }
 });
@@ -836,13 +1045,13 @@ var report_exports = {};
 __export(report_exports, {
   runReport: () => runReport
 });
-import { readdirSync, readFileSync as readFileSync2 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join6 } from "path";
 async function runReport(root) {
   const dir = join6(root, ".veris", "reports");
   let files;
   try {
-    files = readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    files = readdirSync2(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     process.stdout.write("No reports yet. Run `veris verify` first.\n");
     return 0;
@@ -915,36 +1124,8 @@ var init_gate = __esm({
   }
 });
 
-// src/git/changes.ts
-function collect(set, out) {
-  for (const line of out.split("\n")) {
-    const f = line.trim();
-    if (f) set.add(f);
-  }
-}
-async function changedFiles(root, opts = {}) {
-  const base = opts.base ?? null;
-  const files = /* @__PURE__ */ new Set();
-  const diffArgs = base ? ["diff", "--name-only", base] : ["diff", "--name-only", "HEAD"];
-  const diff = await exec("git", diffArgs, { cwd: root });
-  if (diff.code === 0) collect(files, diff.stdout);
-  const untracked = await exec(
-    "git",
-    ["ls-files", "--others", "--exclude-standard"],
-    { cwd: root }
-  );
-  if (untracked.code === 0) collect(files, untracked.stdout);
-  return { files: [...files].sort(), base };
-}
-var init_changes = __esm({
-  "src/git/changes.ts"() {
-    "use strict";
-    init_exec();
-  }
-});
-
 // src/project-graph/discover.ts
-import { readdirSync as readdirSync2, statSync } from "fs";
+import { readdirSync as readdirSync3, statSync } from "fs";
 import { join as join7, relative as relative2, sep } from "path";
 function toPosix(p) {
   return sep === "/" ? p : p.split(sep).join("/");
@@ -959,7 +1140,7 @@ function discoverFiles(root) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync2(dir);
+      entries = readdirSync3(dir);
     } catch {
       return;
     }
@@ -1322,11 +1503,18 @@ async function runAffected(root, opts = {}) {
       });
     }
   }
-  const reportRef = await writeReport(root, run.id, renderMarkdown(run));
+  const git = await gitAnchor(root);
+  const logDigests = await digestLogs(run);
+  const record = buildRecord(run, git, logDigests, VERSION);
+  const reportRef = await writeReport(
+    root,
+    run.id,
+    renderMarkdown(run, record)
+  );
   run.reportRef = reportRef;
   const runDir = await createRunDir(root, run.id);
-  await writeMetadata(runDir, run);
-  process.stdout.write(`${renderRun(run)}
+  await writeEvidence(runDir, record);
+  process.stdout.write(`${renderRun(run, record)}
 `);
   if (narrowedNote) process.stdout.write(`${narrowedNote}
 `);
@@ -1339,23 +1527,25 @@ var init_affected = __esm({
     init_detect();
     init_orchestrator();
     init_verdict();
+    init_record();
     init_store();
     init_changes();
     init_markdown();
     init_terminal();
+    init_version();
   }
 });
 
 // src/watch/watcher.ts
 import {
   watch as fsWatch,
-  readdirSync as readdirSync3,
+  readdirSync as readdirSync4,
   statSync as statSync3
 } from "fs";
-import { basename, join as join10, relative as relative5 } from "path";
+import { basename as basename2, join as join10, relative as relative5 } from "path";
 function watch(root, opts, onBatch) {
   const debounceMs = opts.debounceMs ?? 150;
-  const rootBase = basename(root);
+  const rootBase = basename2(root);
   let pending = /* @__PURE__ */ new Set();
   let timer = null;
   const flush = () => {
@@ -1406,7 +1596,7 @@ function scanMtimes(root) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync3(dir);
+      entries = readdirSync4(dir);
     } catch {
       return;
     }
@@ -1582,7 +1772,7 @@ function renderScan(graph, analysis) {
   const dim = (s) => plain ? s : pc3.dim(s);
   const warn = (s) => plain ? s : pc3.yellow(s);
   const lines = [];
-  lines.push(bold("Veris \u2014 scan"));
+  lines.push(bold("VerisKit \u2014 scan"));
   lines.push("");
   lines.push(
     `Resolver    ${graph.resolver}${graph.resolver === "scanner" ? dim("  (no TypeScript found \u2014 relative imports only)") : ""}`
@@ -1644,7 +1834,7 @@ function renderPlan(project, graph, analysis, changed) {
   const dim = (s) => plain ? s : pc4.dim(s);
   const warn = (s) => plain ? s : pc4.yellow(s);
   const lines = [];
-  lines.push(bold("Veris \u2014 plan"));
+  lines.push(bold("VerisKit \u2014 plan"));
   lines.push(dim(`(graph via ${graph.resolver})`));
   lines.push("");
   lines.push("Test these first (high impact, untested)");
@@ -1708,21 +1898,479 @@ var init_plan = __esm({
   }
 });
 
+// src/evidence/signing.ts
+import {
+  createHash as createHash2,
+  createPrivateKey,
+  createPublicKey,
+  sign as cryptoSign,
+  verify as cryptoVerify,
+  generateKeyPairSync
+} from "crypto";
+function derOf(publicKey) {
+  return publicKey.export({ type: "spki", format: "der" });
+}
+function keyId(publicKey) {
+  const key = typeof publicKey === "string" ? createPublicKey(publicKey) : publicKey;
+  return createHash2("sha256").update(derOf(key)).digest("hex").slice(0, 8);
+}
+function signatureKeyId(sig) {
+  const key = createPublicKey({
+    key: Buffer.from(sig.publicKey, "base64"),
+    format: "der",
+    type: "spki"
+  });
+  return keyId(key);
+}
+function generateKeyPair() {
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  return {
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }),
+    privateKeyPem: privateKey.export({
+      type: "pkcs8",
+      format: "pem"
+    }),
+    keyId: keyId(publicKey)
+  };
+}
+function signDigest(digest, privateKeyPem) {
+  const privateKey = createPrivateKey(privateKeyPem);
+  const publicKey = createPublicKey(
+    privateKey
+  );
+  const sig = cryptoSign(null, Buffer.from(digest, "utf8"), privateKey);
+  return {
+    schema: SIGNATURE_SCHEMA,
+    alg: "ed25519",
+    keyId: keyId(publicKey),
+    publicKey: derOf(publicKey).toString("base64"),
+    digest,
+    signature: sig.toString("base64"),
+    signedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function verifySignature(sig) {
+  try {
+    const publicKey = createPublicKey({
+      key: Buffer.from(sig.publicKey, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    return cryptoVerify(
+      null,
+      Buffer.from(sig.digest, "utf8"),
+      publicKey,
+      Buffer.from(sig.signature, "base64")
+    );
+  } catch {
+    return false;
+  }
+}
+var SIGNATURE_SCHEMA;
+var init_signing = __esm({
+  "src/evidence/signing.ts"() {
+    "use strict";
+    SIGNATURE_SCHEMA = "veriskit/signature@1";
+  }
+});
+
+// src/evidence/verify-evidence.ts
+import { existsSync as existsSync5 } from "fs";
+import { readFile as readFile3 } from "fs/promises";
+function verifyRecord(record) {
+  const recomputed = computeDigest(
+    record
+  );
+  const ok = recomputed === record.digest;
+  const checks = [
+    {
+      name: "record digest",
+      ok,
+      detail: ok ? "matches the canonical record" : `recomputed ${recomputed}, record claims ${record.digest}`
+    }
+  ];
+  return { ok, kind: "record", record, checks, signed: false };
+}
+function signatureChecks(recordDigest, sig, opts = {}) {
+  const checks = [];
+  const kid = signatureKeyId(sig);
+  const validSig = verifySignature(sig) && sig.digest === recordDigest;
+  checks.push({
+    name: "signature",
+    ok: validSig,
+    detail: validSig ? `valid ed25519 signature by key ${kid}` : "signature does not match this record"
+  });
+  if (opts.expectedKeyId || opts.expectedPubKeyPem) {
+    let matches = false;
+    if (opts.expectedPubKeyPem) {
+      try {
+        matches = keyId(opts.expectedPubKeyPem) === kid;
+      } catch {
+        matches = false;
+      }
+    } else if (opts.expectedKeyId) {
+      matches = opts.expectedKeyId.toLowerCase() === kid.toLowerCase();
+    }
+    checks.push({
+      name: "signer",
+      ok: matches,
+      detail: matches ? `signer matches the expected key ${kid}` : `signer ${kid} does not match the expected key`
+    });
+  }
+  return checks;
+}
+async function verifyEvidenceFile(path, opts = {}) {
+  const parsed = JSON.parse(await readFile3(path, "utf8"));
+  if (parsed?.schema === "veriskit/bundle@1") {
+    const { verifyBundle: verifyBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
+    return verifyBundle2(parsed, opts);
+  }
+  const result = verifyRecord(parsed);
+  const assertedSigner = Boolean(
+    opts.expectedKeyId || opts.expectedPubKeyPem || opts.sigPath
+  );
+  const sigPath = opts.sigPath ?? `${path}.sig`;
+  if (existsSync5(sigPath)) {
+    const sig = JSON.parse(await readFile3(sigPath, "utf8"));
+    result.checks.push(
+      ...signatureChecks(result.record.digest, sig, {
+        expectedKeyId: opts.expectedKeyId,
+        expectedPubKeyPem: opts.expectedPubKeyPem
+      })
+    );
+    result.signed = true;
+  } else if (assertedSigner) {
+    result.checks.push({
+      name: "signature",
+      ok: false,
+      detail: "a signature was required (--pubkey/--key-id/--sig) but none was found"
+    });
+  }
+  result.ok = result.checks.every((c) => c.ok);
+  return result;
+}
+var init_verify_evidence = __esm({
+  "src/evidence/verify-evidence.ts"() {
+    "use strict";
+    init_record();
+    init_signing();
+  }
+});
+
+// src/evidence/bundle.ts
+var bundle_exports = {};
+__export(bundle_exports, {
+  BUNDLE_SCHEMA: () => BUNDLE_SCHEMA,
+  buildBundle: () => buildBundle,
+  verifyBundle: () => verifyBundle
+});
+function buildBundle(record, report, logs, signature) {
+  const manifest = {
+    record: record.digest,
+    report: sha256(report),
+    logs: Object.fromEntries(
+      Object.entries(logs).map(([k, v]) => [k, sha256(v)])
+    )
+  };
+  const base = signature ? { schema: BUNDLE_SCHEMA, record, report, logs, manifest, signature } : { schema: BUNDLE_SCHEMA, record, report, logs, manifest };
+  return { ...base, bundleDigest: sha256(canonicalize(base)) };
+}
+function verifyBundle(bundle, opts = {}) {
+  const checks = [];
+  const recordResult = verifyRecord(bundle.record);
+  checks.push(...recordResult.checks);
+  const reportDigest = sha256(bundle.report);
+  checks.push({
+    name: "report",
+    ok: reportDigest === bundle.manifest.report,
+    detail: reportDigest === bundle.manifest.report ? "matches manifest" : "mismatch"
+  });
+  for (const [id, body] of Object.entries(bundle.logs)) {
+    const d = sha256(body);
+    checks.push({
+      name: `log:${id}`,
+      ok: d === bundle.manifest.logs[id],
+      detail: d === bundle.manifest.logs[id] ? "matches manifest" : "mismatch"
+    });
+  }
+  const { bundleDigest: _omit, ...rest } = bundle;
+  const recomputed = sha256(canonicalize(rest));
+  checks.push({
+    name: "bundle digest",
+    ok: recomputed === bundle.bundleDigest,
+    detail: recomputed === bundle.bundleDigest ? "matches" : "mismatch"
+  });
+  let signed = false;
+  if (bundle.signature) {
+    signed = true;
+    checks.push(
+      ...signatureChecks(bundle.record.digest, bundle.signature, {
+        expectedKeyId: opts.expectedKeyId,
+        expectedPubKeyPem: opts.expectedPubKeyPem
+      })
+    );
+  } else if (opts.expectedKeyId || opts.expectedPubKeyPem) {
+    checks.push({
+      name: "signature",
+      ok: false,
+      detail: "a signature was required (--pubkey/--key-id) but the bundle is unsigned"
+    });
+  }
+  return {
+    ok: checks.every((c) => c.ok),
+    kind: "bundle",
+    record: bundle.record,
+    checks,
+    signed
+  };
+}
+var BUNDLE_SCHEMA;
+var init_bundle = __esm({
+  "src/evidence/bundle.ts"() {
+    "use strict";
+    init_record();
+    init_verify_evidence();
+    BUNDLE_SCHEMA = "veriskit/bundle@1";
+  }
+});
+
+// src/cli/commands/evidence.ts
+var evidence_exports = {};
+__export(evidence_exports, {
+  runEvidenceBundle: () => runEvidenceBundle,
+  runEvidenceKeygen: () => runEvidenceKeygen,
+  runEvidenceShow: () => runEvidenceShow,
+  runEvidenceSign: () => runEvidenceSign,
+  runEvidenceVerify: () => runEvidenceVerify
+});
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync } from "fs";
+import { writeFile as writeFile4 } from "fs/promises";
+import { basename as basename3, dirname as dirname2, join as join12 } from "path";
+import pc5 from "picocolors";
+async function runEvidenceVerify(path, opts = {}) {
+  let expectedPubKeyPem;
+  if (opts.pubkey) {
+    try {
+      expectedPubKeyPem = readFileSync5(opts.pubkey, "utf8");
+    } catch {
+      process.stderr.write(`veris: cannot read public key at ${opts.pubkey}
+`);
+      return 1;
+    }
+  }
+  let result;
+  try {
+    result = await verifyEvidenceFile(path, {
+      sigPath: opts.sig,
+      expectedKeyId: opts.keyId,
+      expectedPubKeyPem
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: cannot read evidence at ${path}: ${msg}
+`);
+    return 1;
+  }
+  const plain = isPlain();
+  const mark = (ok) => plain ? ok ? "ok" : "FAIL" : ok ? pc5.green("\u2713") : pc5.red("\u2717");
+  for (const check of result.checks) {
+    process.stdout.write(
+      `  ${mark(check.ok)} ${check.name}: ${check.detail}
+`
+    );
+  }
+  const g = result.record.git;
+  const anchor = g ? `commit ${g.commit.slice(0, 7)} \xB7 ${g.dirty ? "tree dirty" : "tree clean"}` : "no git anchor";
+  process.stdout.write(
+    `
+${result.ok ? "digest OK" : "TAMPERED"} \xB7 verdict ${result.record.verdict.state} \xB7 ${anchor}
+`
+  );
+  process.stdout.write(`
+${HONESTY}
+`);
+  if (result.signed && !opts.pubkey && !opts.keyId) {
+    process.stdout.write(
+      "\nThis record is signed. Confirm you trust the signing key by comparing its\nkey id above to one you already trust, or re-run with --pubkey / --key-id.\n"
+    );
+  }
+  return result.ok ? 0 : 1;
+}
+async function runEvidenceKeygen(root, opts = {}) {
+  const out = opts.out ?? join12(root, ".veris", "keys", "veriskit-signing.key");
+  const pub = `${out}.pub`;
+  if (existsSync6(out) || existsSync6(pub)) {
+    process.stderr.write(
+      `veris: a key already exists at ${out}. Refusing to overwrite it.
+`
+    );
+    return 1;
+  }
+  const { mkdir: mkdir2 } = await import("fs/promises");
+  await mkdir2(dirname2(out), { recursive: true });
+  const kp = generateKeyPair();
+  writeFileSync(out, kp.privateKeyPem, { mode: 384 });
+  chmodSync(out, 384);
+  writeFileSync(pub, kp.publicKeyPem, "utf8");
+  process.stdout.write(
+    [
+      `Wrote signing key ${out} (keep this secret; do not commit it)`,
+      `Wrote public key ${pub}`,
+      `Key id ${kp.keyId}`,
+      ""
+    ].join("\n")
+  );
+  return 0;
+}
+async function runEvidenceSign(evidencePath, opts = {}) {
+  let privateKeyPem;
+  if (process.env.VERISKIT_SIGNING_KEY) {
+    privateKeyPem = process.env.VERISKIT_SIGNING_KEY;
+  } else if (opts.key) {
+    try {
+      privateKeyPem = readFileSync5(opts.key, "utf8");
+    } catch {
+      process.stderr.write(`veris: cannot read signing key at ${opts.key}
+`);
+      return 1;
+    }
+  } else {
+    process.stderr.write(
+      "veris: no signing key. Pass --key <path> or set VERISKIT_SIGNING_KEY.\n"
+    );
+    return 1;
+  }
+  let record;
+  try {
+    record = JSON.parse(readFileSync5(evidencePath, "utf8"));
+  } catch {
+    process.stderr.write(`veris: cannot read evidence at ${evidencePath}
+`);
+    return 1;
+  }
+  const recomputed = computeDigest(
+    record
+  );
+  if (recomputed !== record.digest) {
+    process.stderr.write(
+      "veris: refusing to sign, the record digest does not match its contents.\n"
+    );
+    return 1;
+  }
+  let sig;
+  try {
+    sig = signDigest(record.digest, privateKeyPem);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: signing failed: ${msg}
+`);
+    return 1;
+  }
+  const out = opts.out ?? `${evidencePath}.sig`;
+  writeFileSync(out, `${JSON.stringify(sig, null, 2)}
+`, "utf8");
+  process.stdout.write(
+    `Signed ${evidencePath}
+Wrote ${out} (key ${sig.keyId})
+`
+  );
+  return 0;
+}
+async function runEvidenceBundle(root, opts = {}) {
+  const runDir = latestRunDir(root);
+  if (!runDir) {
+    process.stdout.write("No evidence yet. Run `veris verify` first.\n");
+    return 1;
+  }
+  let record;
+  try {
+    record = JSON.parse(
+      readFileSync5(join12(runDir, "evidence.json"), "utf8")
+    );
+  } catch {
+    process.stderr.write(`veris: no evidence.json in ${runDir}
+`);
+    return 1;
+  }
+  let report = "";
+  try {
+    report = readFileSync5(
+      join12(root, ".veris", "reports", `verify-${record.id}.md`),
+      "utf8"
+    );
+  } catch {
+  }
+  const logIds = record.checks.filter((c) => c.logDigest).map((c) => c.id);
+  const logs = await readRunLogs(runDir, logIds);
+  let signature;
+  const sigPath = join12(runDir, "evidence.json.sig");
+  if (existsSync6(sigPath)) {
+    try {
+      signature = JSON.parse(readFileSync5(sigPath, "utf8"));
+    } catch {
+    }
+  }
+  const bundle = buildBundle(record, report, logs, signature);
+  const outDir = await ensureEvidenceDir(root);
+  const out = opts.out ?? join12(outDir, `${record.id}.bundle.json`);
+  await writeFile4(out, `${JSON.stringify(bundle, null, 2)}
+`, "utf8");
+  process.stdout.write(`Wrote portable evidence bundle: ${out}
+`);
+  return 0;
+}
+async function runEvidenceShow(root, path) {
+  const target = path ?? (() => {
+    const dir = latestRunDir(root);
+    return dir ? join12(dir, "evidence.json") : null;
+  })();
+  if (!target) {
+    process.stdout.write("No evidence yet. Run `veris verify` first.\n");
+    return 0;
+  }
+  let record;
+  try {
+    record = JSON.parse(readFileSync5(target, "utf8"));
+  } catch {
+    process.stderr.write(`veris: cannot read evidence at ${target}
+`);
+    return 1;
+  }
+  const g = record.git;
+  process.stdout.write(
+    [
+      `Evidence   ${basename3(target)}`,
+      `Verdict    ${record.verdict.state}`,
+      `Project    ${record.project.name}`,
+      `Scope      ${record.scope.kind} (${record.scope.changedCount} changed)`,
+      `Commit     ${g ? `${g.commit.slice(0, 7)} (${g.branch}) ${g.dirty ? "\xB7 tree dirty" : "\xB7 tree clean"}` : "no git anchor"}`,
+      `Checks     ${record.checks.map((c) => `${c.id}:${c.status}`).join(", ")}`,
+      `Digest     ${record.digest}`,
+      ""
+    ].join("\n")
+  );
+  return 0;
+}
+var HONESTY;
+var init_evidence = __esm({
+  "src/cli/commands/evidence.ts"() {
+    "use strict";
+    init_bundle();
+    init_record();
+    init_signing();
+    init_store();
+    init_verify_evidence();
+    init_tty();
+    HONESTY = "An integrity digest confirms the record was not edited or corrupted since it was written.\nIt is not forgery-proof on its own: publish the digest separately (CI log, PR) or sign it (veris evidence sign) to prove authorship.";
+  }
+});
+
 // src/cli/index.ts
+init_version();
 import { realpathSync } from "fs";
 import { argv } from "process";
 import { pathToFileURL } from "url";
 import cac from "cac";
-
-// src/version.ts
-import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
-var pkgUrl = new URL("../package.json", import.meta.url);
-var VERSION = JSON.parse(
-  readFileSync(fileURLToPath(pkgUrl), "utf8")
-).version;
-
-// src/cli/index.ts
 function buildCli() {
   const cli = cac("veris");
   cli.version(VERSION);
@@ -1771,6 +2419,52 @@ function buildCli() {
     const { runPlan: runPlan2 } = await Promise.resolve().then(() => (init_plan(), plan_exports));
     process.exitCode = await runPlan2(process.cwd(), { base: opts.base });
   });
+  cli.command(
+    "evidence <action> [file]",
+    "Evidence: verify <file> | bundle | show [file] | keygen | sign <file>"
+  ).option("--out <file>", "For bundle/keygen/sign: output path").option("--key <file>", "For sign: the private signing key (PEM)").option("--pubkey <file>", "For verify: assert the signer's public key").option("--key-id <id>", "For verify: assert the signer's key id").option("--sig <file>", "For verify: signature path (default <file>.sig)").action(
+    async (action, file, opts) => {
+      const mod = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
+      if (action === "verify") {
+        if (!file) {
+          process.stderr.write("veris: evidence verify needs a <file>\n");
+          process.exitCode = 1;
+          return;
+        }
+        process.exitCode = await mod.runEvidenceVerify(file, {
+          pubkey: opts.pubkey,
+          keyId: opts.keyId,
+          sig: opts.sig
+        });
+      } else if (action === "bundle") {
+        process.exitCode = await mod.runEvidenceBundle(process.cwd(), {
+          out: opts.out
+        });
+      } else if (action === "show") {
+        process.exitCode = await mod.runEvidenceShow(process.cwd(), file);
+      } else if (action === "keygen") {
+        process.exitCode = await mod.runEvidenceKeygen(process.cwd(), {
+          out: opts.out
+        });
+      } else if (action === "sign") {
+        if (!file) {
+          process.stderr.write("veris: evidence sign needs a <file>\n");
+          process.exitCode = 1;
+          return;
+        }
+        process.exitCode = await mod.runEvidenceSign(file, {
+          key: opts.key,
+          out: opts.out
+        });
+      } else {
+        process.stderr.write(
+          `veris: unknown evidence action '${action}' (use verify | bundle | show | keygen | sign)
+`
+        );
+        process.exitCode = 1;
+      }
+    }
+  );
   return { raw: cli, version: VERSION };
 }
 async function main(argv2) {