veriskit 0.5.0 → 0.6.0

package/dist/index.js

@@ -8,198 +8,6 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
-// src/version.ts
-import { readFileSync } from "fs";
-import { fileURLToPath } from "url";
-var pkgUrl, VERSION;
-var init_version = __esm({
-  "src/version.ts"() {
-    "use strict";
-    pkgUrl = new URL("../package.json", import.meta.url);
-    VERSION = JSON.parse(
-      readFileSync(fileURLToPath(pkgUrl), "utf8")
-    ).version;
-  }
-});
-
-// src/util/fs-safe.ts
-import { existsSync } from "fs";
-import { mkdir, readFile, writeFile } from "fs/promises";
-async function ensureDir(path) {
-  await mkdir(path, { recursive: true });
-}
-async function writeIfAbsent(path, content) {
-  if (existsSync(path)) return false;
-  await writeFile(path, content, "utf8");
-  return true;
-}
-async function readJsonIfExists(path) {
-  if (!existsSync(path)) return null;
-  try {
-    return JSON.parse(await readFile(path, "utf8"));
-  } catch {
-    return null;
-  }
-}
-var init_fs_safe = __esm({
-  "src/util/fs-safe.ts"() {
-    "use strict";
-  }
-});
-
-// src/config/detect.ts
-import { existsSync as existsSync2 } from "fs";
-import { join } from "path";
-function detectPackageManager(root) {
-  if (existsSync2(join(root, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync2(join(root, "yarn.lock"))) return "yarn";
-  if (existsSync2(join(root, "bun.lockb"))) return "bun";
-  return "npm";
-}
-async function detectProject(root) {
-  const pkg = await readJsonIfExists(join(root, "package.json")) ?? {};
-  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
-  const has = (name) => name in deps;
-  const scripts = pkg.scripts ?? {};
-  const languages = existsSync2(join(root, "tsconfig.json")) ? ["typescript", "javascript"] : ["javascript"];
-  const frameworks = ["next", "vite", "react"].filter(has);
-  const capabilities = [
-    detectTypes(root, has),
-    detectUnit(has, scripts),
-    detectLint(root, has),
-    detectBrowser(root, has)
-  ];
-  return {
-    root,
-    name: pkg.name ?? void 0,
-    packageManager: detectPackageManager(root),
-    frameworks,
-    languages,
-    scripts,
-    capabilities
-  };
-}
-function detectTypes(root, has) {
-  if (existsSync2(join(root, "tsconfig.json")) && has("typescript"))
-    return { id: "types", available: true, runner: "tsc" };
-  return {
-    id: "types",
-    available: false,
-    reason: "no tsconfig.json + typescript dependency"
-  };
-}
-function detectUnit(has, scripts) {
-  if (has("vitest")) return { id: "unit", available: true, runner: "vitest" };
-  if (has("jest")) return { id: "unit", available: true, runner: "jest" };
-  if (Object.values(scripts).some((s) => s.includes("node --test")))
-    return { id: "unit", available: true, runner: "node-test" };
-  return { id: "unit", available: false, reason: "no test runner detected" };
-}
-function detectLint(root, has) {
-  if (existsSync2(join(root, "biome.json")) || has("@biomejs/biome"))
-    return { id: "lint", available: true, runner: "biome" };
-  if (has("eslint") || [".eslintrc", ".eslintrc.json", ".eslintrc.cjs", "eslint.config.js"].some(
-    (f) => existsSync2(join(root, f))
-  ))
-    return { id: "lint", available: true, runner: "eslint" };
-  return { id: "lint", available: false, reason: "no linter configured" };
-}
-function detectBrowser(root, has) {
-  if (has("@playwright/test") || existsSync2(join(root, "playwright.config.ts")) || existsSync2(join(root, "playwright.config.js"))) {
-    return { id: "browser", available: true, runner: "playwright" };
-  }
-  return {
-    id: "browser",
-    available: false,
-    reason: "no browser runner configured"
-  };
-}
-var init_detect = __esm({
-  "src/config/detect.ts"() {
-    "use strict";
-    init_fs_safe();
-  }
-});
-
-// src/util/env.ts
-import { platform } from "os";
-function detectCI() {
-  return process.env.CI === "true" || process.env.CI === "1";
-}
-function getEnvironmentInfo(pm) {
-  return {
-    os: platform(),
-    node: process.version,
-    pm,
-    ci: detectCI(),
-    timestamp: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-var init_env = __esm({
-  "src/util/env.ts"() {
-    "use strict";
-  }
-});
-
-// src/cli/tty.ts
-function isPlain() {
-  return detectCI() || !process.stdout.isTTY;
-}
-var init_tty = __esm({
-  "src/cli/tty.ts"() {
-    "use strict";
-    init_env();
-  }
-});
-
-// src/cli/commands/doctor.ts
-var doctor_exports = {};
-__export(doctor_exports, {
-  renderDoctor: () => renderDoctor,
-  runDoctor: () => runDoctor
-});
-import pc from "picocolors";
-function renderDoctor(project, env) {
-  const plain = isPlain();
-  const ok = (s) => plain ? s : pc.green(s);
-  const dim = (s) => plain ? s : pc.dim(s);
-  const lines = [];
-  lines.push("VerisKit doctor");
-  lines.push("");
-  lines.push(`Package manager  ${project.packageManager}`);
-  lines.push(`Node             ${env.node}`);
-  lines.push(`Languages        ${project.languages.join(", ")}`);
-  if (project.frameworks.length)
-    lines.push(`Frameworks       ${project.frameworks.join(", ")}`);
-  lines.push("");
-  lines.push("Capabilities");
-  for (const c of project.capabilities) {
-    if (c.available) {
-      lines.push(`  ${ok("\u2713")} ${c.id.padEnd(8)} ${dim(`via ${c.runner}`)}`);
-    } else {
-      lines.push(
-        `  ${dim("\u2298")} ${c.id.padEnd(8)} ${dim(`skipped \u2014 ${c.reason}`)}`
-      );
-    }
-  }
-  return lines.join("\n");
-}
-async function runDoctor(root) {
-  const project = await detectProject(root);
-  const env = getEnvironmentInfo(project.packageManager);
-  process.stdout.write(`${renderDoctor(project, env)}
-`);
-  return 0;
-}
-var init_doctor = __esm({
-  "src/cli/commands/doctor.ts"() {
-    "use strict";
-    init_detect();
-    init_env();
-    init_tty();
-  }
-});
-
 // src/evidence/record.ts
 import { createHash } from "crypto";
 import { basename } from "path";
@@ -271,1067 +79,637 @@ var init_record = __esm({
   }
 });
 
-// src/evidence/store.ts
-import { readdirSync } from "fs";
-import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import { join as join2 } from "path";
-function newRunId() {
-  counter += 1;
-  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
-  return `${stamp}-${counter}`;
-}
-async function createRunDir(root, id) {
-  const dir = join2(root, ".veris", "runs", id);
-  await ensureDir(dir);
-  return dir;
-}
-async function writeLog(runDir, checkId, content) {
-  const ref = join2(runDir, `${checkId}.log`);
-  await writeFile2(ref, content, "utf8");
-  return ref;
-}
-async function writeReport(root, id, markdown) {
-  const dir = join2(root, ".veris", "reports");
-  await ensureDir(dir);
-  const ref = join2(dir, `verify-${id}.md`);
-  await writeFile2(ref, markdown, "utf8");
-  return ref;
+// src/project-graph/discover.ts
+import { readdirSync as readdirSync2, statSync } from "fs";
+import { join as join5, relative as relative2, sep } from "path";
+function toPosix(p) {
+  return sep === "/" ? p : p.split(sep).join("/");
 }
-async function writeEvidence(runDir, record) {
-  const ref = join2(runDir, "evidence.json");
-  await writeFile2(ref, `${JSON.stringify(record, null, 2)}
-`, "utf8");
-  return ref;
+function classify(rel) {
+  if (TEST_RE2.test(rel)) return "test";
+  if (CONFIG_RE2.test(rel)) return "config";
+  return "source";
 }
-async function digestLogs(run) {
-  const out = {};
-  for (const r of run.results) {
-    if (!r.logRef) continue;
+function discoverFiles(root) {
+  const out = [];
+  const walk = (dir) => {
+    let entries;
     try {
-      out[r.checkId] = sha256(await readFile2(r.logRef, "utf8"));
+      entries = readdirSync2(dir);
     } catch {
+      return;
     }
-  }
-  return out;
-}
-async function readRunLogs(runDir, checkIds) {
-  const out = {};
-  for (const id of checkIds) {
-    try {
-      out[id] = await readFile2(join2(runDir, `${id}.log`), "utf8");
-    } catch {
+    for (const name of entries) {
+      const abs = join5(dir, name);
+      const rel = toPosix(relative2(root, abs));
+      if (IGNORE.test(rel)) continue;
+      let st;
+      try {
+        st = statSync(abs);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        walk(abs);
+      } else if (CODE_RE.test(rel)) {
+        out.push({ file: rel, kind: classify(rel) });
+      }
     }
+  };
+  walk(root);
+  return out.sort((a, b) => a.file.localeCompare(b.file));
+}
+var IGNORE, CODE_RE, TEST_RE2, CONFIG_RE2;
+var init_discover = __esm({
+  "src/project-graph/discover.ts"() {
+    "use strict";
+    IGNORE = /(^|\/)(\.git|\.claude|\.veris|\.agentloop|\.agentflight|node_modules|dist|coverage|build|fixtures|__fixtures__)(\/|$)/;
+    CODE_RE = /\.[cm]?[jt]sx?$/;
+    TEST_RE2 = /(\.(test|spec)\.[cm]?[jt]sx?$)|(^|\/)(test|tests|__tests__)\//;
+    CONFIG_RE2 = /(^|\/)([^/]+\.config\.[cm]?[jt]sx?)$/;
   }
-  return out;
+});
+
+// src/project-graph/scanner-resolver.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { dirname, join as join6, relative as relative3, resolve } from "path";
+function extractSpecifiers(text) {
+  const specs = [];
+  SPEC_RE.lastIndex = 0;
+  let m;
+  m = SPEC_RE.exec(text);
+  while (m !== null) {
+    const s = m[1] ?? m[2] ?? m[3] ?? m[4];
+    if (s) specs.push(s);
+    m = SPEC_RE.exec(text);
+  }
+  return specs;
 }
-function latestRunDir(root) {
-  const runs = join2(root, ".veris", "runs");
+function isFile(p) {
   try {
-    const dirs = readdirSync(runs, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name !== "watch").map((d) => d.name).sort();
-    const latest = dirs.at(-1);
-    return latest ? join2(runs, latest) : null;
+    return statSync2(p).isFile();
   } catch {
-    return null;
+    return false;
   }
 }
-async function ensureEvidenceDir(root) {
-  const dir = join2(root, ".veris", "evidence");
-  await ensureDir(dir);
-  return dir;
+function resolveRelative(fromDir, spec) {
+  const base = resolve(fromDir, spec);
+  const candidates = [base];
+  for (const ext of EXTS) candidates.push(base + ext);
+  const extMatch = base.match(/\.[cm]?[jt]sx?$/);
+  if (extMatch) {
+    const noExt = base.slice(0, -extMatch[0].length);
+    for (const ext of EXTS) candidates.push(noExt + ext);
+  }
+  for (const ext of EXTS) candidates.push(join6(base, `index${ext}`));
+  for (const c of candidates) {
+    if (existsSync3(c) && isFile(c)) return c;
+  }
+  return null;
 }
-var counter;
-var init_store = __esm({
-  "src/evidence/store.ts"() {
-    "use strict";
-    init_fs_safe();
-    init_record();
-    counter = 0;
+function scannerImports(root, file) {
+  let text;
+  try {
+    text = readFileSync2(join6(root, file), "utf8");
+  } catch {
+    return [];
   }
-});
-
-// src/util/exec.ts
-import { spawn } from "child_process";
-function exec(cmd, args, opts = {}) {
-  return new Promise((resolve2) => {
-    const start = performance.now();
-    const child = spawn(cmd, args, {
-      cwd: opts.cwd,
-      env: opts.env ?? process.env,
-      shell: false
-    });
-    let stdout = "";
-    let stderr = "";
-    let timedOut = false;
-    const timer = opts.timeoutMs ? setTimeout(() => {
-      timedOut = true;
-      child.kill("SIGKILL");
-    }, opts.timeoutMs) : null;
-    child.stdout.on("data", (d) => stdout += d.toString());
-    child.stderr.on("data", (d) => stderr += d.toString());
-    child.on("close", (code) => {
-      if (timer) clearTimeout(timer);
-      resolve2({
-        code: code ?? 1,
-        stdout,
-        stderr,
-        durationMs: Math.round(performance.now() - start),
-        timedOut
-      });
-    });
-    child.on("error", () => {
-      if (timer) clearTimeout(timer);
-      resolve2({
-        code: 127,
-        stdout,
-        stderr: stderr || `failed to spawn ${cmd}`,
-        durationMs: Math.round(performance.now() - start),
-        timedOut
-      });
-    });
-  });
+  const dir = dirname(join6(root, file));
+  const out = /* @__PURE__ */ new Set();
+  for (const spec of extractSpecifiers(text)) {
+    if (!spec.startsWith(".")) continue;
+    const resolved = resolveRelative(dir, spec);
+    if (resolved) out.add(toPosix(relative3(root, resolved)));
+  }
+  return [...out];
 }
-var init_exec = __esm({
-  "src/util/exec.ts"() {
+var EXTS, SPEC_RE;
+var init_scanner_resolver = __esm({
+  "src/project-graph/scanner-resolver.ts"() {
     "use strict";
+    init_discover();
+    EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+    SPEC_RE = /(?:import|export)\b[^'"]*?\bfrom\s*['"]([^'"]+)['"]|(?:^|[^.\w])import\s*['"]([^'"]+)['"]|\bimport\(\s*['"]([^'"]+)['"]\s*\)|\brequire\(\s*['"]([^'"]+)['"]\s*\)/g;
   }
 });
 
-// src/runners/base.ts
-import { join as join3 } from "path";
-function localBin(root, name) {
-  return join3(root, "node_modules", ".bin", name);
+// src/project-graph/ts-resolver.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { createRequire } from "module";
+import { join as join7, relative as relative4, sep as sep2 } from "path";
+function hasClassicApi(mod) {
+  const m = mod;
+  return !!m && typeof m.preProcessFile === "function" && typeof m.resolveModuleName === "function" && typeof m.readConfigFile === "function" && typeof m.parseJsonConfigFileContent === "function" && typeof m.sys === "object" && m.sys !== null;
 }
-async function runViaExec(check, ctx, opts) {
-  const r = await exec(check.cmd, check.args, {
-    cwd: ctx.root,
-    timeoutMs: opts.timeoutMs
-  });
-  const status = r.code === 0 ? "passed" : r.timedOut ? "unknown" : "failed";
-  const output = [r.stdout, r.stderr].filter(Boolean).join("\n").trim();
-  const logRef = await writeLog(ctx.runDir, check.id, `${output}
-`);
-  const result = {
-    checkId: check.id,
-    status,
-    durationMs: r.durationMs,
-    summary: status === "passed" ? opts.pass : r.timedOut ? "timed out" : opts.fail,
-    logRef
-  };
-  if (status !== "passed" && output) {
-    result.outputTail = output.split("\n").slice(-TAIL_LINES).join("\n");
+function loadTypeScript(root) {
+  try {
+    const require2 = createRequire(join7(root, "__veris__.js"));
+    const tsPath = require2.resolve("typescript");
+    const mod = require2(tsPath);
+    return hasClassicApi(mod) ? mod : null;
+  } catch {
+    return null;
   }
-  return result;
 }
-var TAIL_LINES;
-var init_base = __esm({
-  "src/runners/base.ts"() {
-    "use strict";
-    init_store();
-    init_exec();
-    TAIL_LINES = 20;
+function loadCompilerOptions(tsmod, root) {
+  const configPath = join7(root, "tsconfig.json");
+  const read = tsmod.readConfigFile(configPath, tsmod.sys.readFile);
+  if (read.error || !read.config) return {};
+  const parsed = tsmod.parseJsonConfigFileContent(read.config, tsmod.sys, root);
+  return parsed.options;
+}
+function tsImports(tsmod, root, options, file) {
+  let text;
+  try {
+    text = readFileSync3(join7(root, file), "utf8");
+  } catch {
+    return [];
   }
-});
-
-// src/runners/biome.ts
-var biomeRunner;
-var init_biome = __esm({
-  "src/runners/biome.ts"() {
-    "use strict";
-    init_base();
-    biomeRunner = {
-      id: "biome",
-      toCheck(project, _cap) {
-        return {
-          id: "lint",
-          title: "Lint",
-          runner: "biome",
-          cmd: localBin(project.root, "biome"),
-          args: ["check", "."]
-        };
-      },
-      run(check, ctx) {
-        return runViaExec(check, ctx, {
-          pass: "no lint errors",
-          fail: "lint errors found",
-          timeoutMs: 3 * 6e4
-        });
+  const abs = join7(root, file);
+  const out = /* @__PURE__ */ new Set();
+  try {
+    const pre = tsmod.preProcessFile(text, true, true);
+    for (const imp of pre.importedFiles) {
+      const res = tsmod.resolveModuleName(
+        imp.fileName,
+        abs,
+        options,
+        tsmod.sys
+      );
+      const resolved = res.resolvedModule?.resolvedFileName;
+      if (resolved && !resolved.includes("node_modules") && resolved.startsWith(root + sep2)) {
+        out.add(toPosix(relative4(root, resolved)));
       }
-    };
+    }
+  } catch {
   }
-});
-
-// src/runners/eslint.ts
-var eslintRunner;
-var init_eslint = __esm({
-  "src/runners/eslint.ts"() {
-    "use strict";
-    init_base();
-    eslintRunner = {
-      id: "eslint",
-      toCheck(project, _cap) {
-        return {
-          id: "lint",
-          title: "Lint",
-          runner: "eslint",
-          cmd: localBin(project.root, "eslint"),
-          args: ["."]
-        };
-      },
-      run(check, ctx) {
-        return runViaExec(check, ctx, {
-          pass: "no lint errors",
-          fail: "lint errors found",
-          timeoutMs: 3 * 6e4
-        });
-      }
-    };
+  return [...out];
+}
+function selectResolver(root) {
+  const tsmod = existsSync4(join7(root, "tsconfig.json")) ? loadTypeScript(root) : null;
+  if (tsmod) {
+    try {
+      const options = loadCompilerOptions(tsmod, root);
+      return {
+        resolver: "typescript",
+        importsOf: (file) => tsImports(tsmod, root, options, file)
+      };
+    } catch {
+    }
   }
-});
-
-// src/runners/jest.ts
-var jestRunner;
-var init_jest = __esm({
-  "src/runners/jest.ts"() {
+  return {
+    resolver: "scanner",
+    importsOf: (file) => scannerImports(root, file)
+  };
+}
+var init_ts_resolver = __esm({
+  "src/project-graph/ts-resolver.ts"() {
     "use strict";
-    init_base();
-    jestRunner = {
-      id: "jest",
-      toCheck(project, _cap, opts) {
-        return {
-          id: "unit",
-          title: "Unit tests",
-          runner: "jest",
-          cmd: localBin(project.root, "jest"),
-          args: ["--ci", ...opts?.targetFiles ?? []]
-        };
-      },
-      run(check, ctx) {
-        return runViaExec(check, ctx, {
-          pass: "unit tests passed",
-          fail: "unit tests failed",
-          timeoutMs: 10 * 6e4
-        });
-      }
-    };
+    init_discover();
+    init_scanner_resolver();
   }
 });
 
-// src/runners/node-test.ts
-var nodeTestRunner;
-var init_node_test = __esm({
-  "src/runners/node-test.ts"() {
-    "use strict";
-    init_base();
-    nodeTestRunner = {
-      id: "node-test",
-      toCheck(_project, _cap) {
-        return {
-          id: "unit",
-          title: "Unit tests",
-          runner: "node-test",
-          cmd: process.execPath,
-          args: ["--test"]
-        };
-      },
-      run(check, ctx) {
-        return runViaExec(check, ctx, {
-          pass: "unit tests passed",
-          fail: "unit tests failed",
-          timeoutMs: 10 * 6e4
-        });
-      }
-    };
-  }
+// src/project-graph/graph.ts
+var graph_exports = {};
+__export(graph_exports, {
+  buildGraph: () => buildGraph
 });
-
-// src/runners/playwright.ts
-function parsePlaywrightStats(stdout) {
-  try {
-    const json = JSON.parse(stdout);
-    return json.stats ?? null;
-  } catch {
-    return null;
+async function buildGraph(project) {
+  const root = project.root;
+  const files = discoverFiles(root);
+  const known = new Set(files.map((f) => f.file));
+  const { resolver, importsOf } = selectResolver(root);
+  const nodes = {};
+  for (const f of files) {
+    nodes[f.file] = { file: f.file, kind: f.kind, imports: [], importedBy: [] };
+  }
+  for (const f of files) {
+    const imps = importsOf(f.file).filter((i) => known.has(i) && i !== f.file);
+    nodes[f.file].imports = imps;
+    for (const i of imps) nodes[i]?.importedBy.push(f.file);
   }
+  return {
+    root,
+    resolver,
+    nodes,
+    sourceFiles: files.filter((f) => f.kind === "source").map((f) => f.file),
+    testFiles: files.filter((f) => f.kind === "test").map((f) => f.file)
+  };
 }
-var TAIL_LINES2, playwrightRunner;
-var init_playwright = __esm({
-  "src/runners/playwright.ts"() {
+var init_graph = __esm({
+  "src/project-graph/graph.ts"() {
     "use strict";
-    init_store();
-    init_exec();
-    init_base();
-    TAIL_LINES2 = 20;
-    playwrightRunner = {
-      id: "playwright",
-      toCheck(project, _cap) {
-        return {
-          id: "browser",
-          title: "Browser tests",
-          runner: "playwright",
-          cmd: localBin(project.root, "playwright"),
-          args: ["test", "--reporter=json"]
-        };
-      },
-      async run(check, ctx) {
-        const r = await exec(check.cmd, check.args, {
-          cwd: ctx.root,
-          timeoutMs: 15 * 6e4
-        });
-        const output = [r.stdout, r.stderr].filter(Boolean).join("\n").trim();
-        const logRef = await writeLog(ctx.runDir, check.id, `${output}
-`);
-        const stats = parsePlaywrightStats(r.stdout);
-        let status;
-        if (r.timedOut) {
-          status = "unknown";
-        } else if (stats) {
-          status = r.code === 0 && (stats.unexpected ?? 0) === 0 ? "passed" : "failed";
-        } else {
-          status = r.code === 0 ? "unknown" : "failed";
-        }
-        const result = {
-          checkId: "browser",
-          status,
-          durationMs: r.durationMs,
-          summary: status === "passed" ? "browser tests passed" : r.timedOut ? "timed out" : status === "unknown" ? "browser tests ran but the results could not be parsed" : "browser tests failed",
-          logRef
-        };
-        if (stats) {
-          const passed = stats.expected ?? 0;
-          const failed = stats.unexpected ?? 0;
-          result.counts = {
-            passed,
-            failed,
-            total: passed + failed + (stats.flaky ?? 0) + (stats.skipped ?? 0)
-          };
-        }
-        if (status !== "passed" && output) {
-          result.outputTail = output.split("\n").slice(-TAIL_LINES2).join("\n");
-        }
-        return result;
-      }
-    };
+    init_discover();
+    init_ts_resolver();
   }
 });
 
-// src/runners/tsc.ts
-var tscRunner;
-var init_tsc = __esm({
-  "src/runners/tsc.ts"() {
-    "use strict";
-    init_base();
-    tscRunner = {
-      id: "tsc",
-      toCheck(project, _cap) {
-        return {
-          id: "types",
-          title: "Types",
-          runner: "tsc",
-          cmd: localBin(project.root, "tsc"),
-          args: ["--noEmit", "--pretty", "false"]
-        };
-      },
-      run(check, ctx) {
-        return runViaExec(check, ctx, {
-          pass: "no type errors",
-          fail: "type errors found",
-          timeoutMs: 5 * 6e4
-        });
-      }
-    };
+// src/project-graph/analyze.ts
+function transitiveDependents(graph, file) {
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [...graph.nodes[file]?.importedBy ?? []];
+  while (stack.length) {
+    const f = stack.pop();
+    if (!f || seen.has(f)) continue;
+    seen.add(f);
+    for (const d of graph.nodes[f]?.importedBy ?? []) stack.push(d);
   }
-});
-
-// src/runners/vitest.ts
-var vitestRunner;
-var init_vitest = __esm({
-  "src/runners/vitest.ts"() {
+  return seen;
+}
+function reachableFromTests(graph) {
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [...graph.testFiles];
+  while (stack.length) {
+    const f = stack.pop();
+    if (!f || seen.has(f)) continue;
+    seen.add(f);
+    for (const i of graph.nodes[f]?.imports ?? []) stack.push(i);
+  }
+  return seen;
+}
+function analyze(graph, changed = []) {
+  const blastRadius = {};
+  for (const file of Object.keys(graph.nodes)) {
+    blastRadius[file] = transitiveDependents(graph, file).size;
+  }
+  const reached = reachableFromTests(graph);
+  const byBlast = (a, b) => (blastRadius[b] ?? 0) - (blastRadius[a] ?? 0);
+  const untested = graph.sourceFiles.filter((f) => !reached.has(f)).sort(byBlast);
+  const changedSet = new Set(changed);
+  const untestedSet = new Set(untested);
+  const risky = graph.sourceFiles.filter(
+    (f) => (blastRadius[f] ?? 0) > 0 && (untestedSet.has(f) || changedSet.has(f))
+  ).sort(byBlast);
+  return { untested, blastRadius, risky };
+}
+var init_analyze = __esm({
+  "src/project-graph/analyze.ts"() {
     "use strict";
-    init_base();
-    vitestRunner = {
-      id: "vitest",
-      toCheck(project, _cap, opts) {
-        const files = opts?.targetFiles ?? [];
-        return {
-          id: "unit",
-          title: "Unit tests",
-          runner: "vitest",
-          cmd: localBin(project.root, "vitest"),
-          args: ["run", "--reporter=json", ...files]
-        };
-      },
-      run(check, ctx) {
-        return runViaExec(check, ctx, {
-          pass: "unit tests passed",
-          fail: "unit tests failed",
-          timeoutMs: 10 * 6e4
-        });
-      }
-    };
   }
 });
 
-// src/runners/index.ts
-var runners;
-var init_runners = __esm({
-  "src/runners/index.ts"() {
-    "use strict";
-    init_biome();
-    init_eslint();
-    init_jest();
-    init_node_test();
-    init_playwright();
-    init_tsc();
-    init_vitest();
-    init_base();
-    runners = {
-      tsc: tscRunner,
-      vitest: vitestRunner,
-      jest: jestRunner,
-      "node-test": nodeTestRunner,
-      eslint: eslintRunner,
-      biome: biomeRunner,
-      playwright: playwrightRunner
+// src/affected/select.ts
+var select_exports = {};
+__export(select_exports, {
+  selectAffectedTests: () => selectAffectedTests
+});
+function selectAffectedTests(graph, changed) {
+  if (graph.resolver !== "typescript") {
+    return {
+      mode: "full",
+      testFiles: [],
+      reason: "scanner graph can miss aliased/subpath imports \u2014 running the full suite"
     };
   }
-});
-
-// src/core/verdict.ts
-function computeVerdict(results, capabilities) {
-  const reasons = [];
-  const skipped = [];
-  const verifiedCapabilities = [];
-  const anyFailed = results.some((r) => r.status === "failed");
-  for (const cap of capabilities) {
-    const result = results.find((r) => r.checkId === cap.id);
-    if (!cap.available) {
-      skipped.push(cap.id);
-      reasons.push(`${cap.id} skipped \u2014 ${cap.reason ?? "not configured"}`);
-      continue;
-    }
-    if (result?.status === "passed") {
-      verifiedCapabilities.push(cap.id);
-      continue;
-    }
-    if (result?.status === "failed") {
-      reasons.push(`${cap.id} failed \u2014 ${result.summary}`);
-      continue;
+  for (const f of changed) {
+    if (GLOBAL_RE.test(f)) {
+      return {
+        mode: "full",
+        testFiles: [],
+        reason: `global/config change (${f})`
+      };
     }
-    skipped.push(cap.id);
-    reasons.push(`${cap.id} skipped \u2014 ${result?.summary ?? "did not run"}`);
-  }
-  let state;
-  if (anyFailed) state = "failed";
-  else if (skipped.length > 0) state = "partial";
-  else state = "verified";
-  return { state, verifiedCapabilities, skipped, reasons };
-}
-function verdictExitCode(verdict, opts = {}) {
-  if (verdict.state === "failed") return 1;
-  if (verdict.state === "partial") return opts.partialOk ? 0 : 2;
-  return 0;
-}
-var init_verdict = __esm({
-  "src/core/verdict.ts"() {
-    "use strict";
-  }
-});
-
-// src/core/orchestrator.ts
-async function runChecks(project, ids, root, opts = {}) {
-  const known = new Set(project.capabilities.map((c) => c.id));
-  const unknown = ids.filter((id2) => !known.has(id2));
-  if (unknown.length > 0) {
-    throw new Error(`Unknown check id(s): ${unknown.join(", ")}`);
-  }
-  const id = newRunId();
-  const runDir = await createRunDir(root, id);
-  const ctx = { root, runDir };
-  const tasks = ids.map(async (capId) => {
-    const cap = project.capabilities.find((c) => c.id === capId);
-    const runner = cap?.runner ? runners[cap.runner] : void 0;
-    if (!cap?.available || !runner) {
-      const summary = !cap?.available ? cap?.reason ?? "not configured" : `no runner registered for ${cap.runner}`;
+    if (!(f in graph.nodes)) {
       return {
-        checkId: capId,
-        status: "skipped",
-        durationMs: 0,
-        summary
+        mode: "full",
+        testFiles: [],
+        reason: `unresolved changed file (${f})`
       };
     }
-    const check = runner.toCheck(project, cap, {
-      targetFiles: opts.targetFiles?.[capId]
-    });
-    return runner.run(check, ctx);
-  });
-  const results = await Promise.all(tasks);
-  const requested = project.capabilities.filter((c) => ids.includes(c.id));
-  const verdict = computeVerdict(results, requested);
-  return {
-    id,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    project,
-    results,
-    verdict,
-    env: getEnvironmentInfo(project.packageManager)
-  };
-}
-var init_orchestrator = __esm({
-  "src/core/orchestrator.ts"() {
-    "use strict";
-    init_store();
-    init_runners();
-    init_env();
-    init_verdict();
-  }
-});
-
-// src/reporters/terminal.ts
-import pc2 from "picocolors";
-function glyph(status, plain) {
-  const map = {
-    passed: "\u2713",
-    failed: "\u2717",
-    skipped: "\u2298",
-    unknown: "?"
-  };
-  const g = map[status];
-  if (plain) return g;
-  if (status === "passed") return pc2.green(g);
-  if (status === "failed") return pc2.red(g);
-  return pc2.dim(g);
-}
-function secs(ms) {
-  return ms === 0 ? "" : `${(ms / 1e3).toFixed(1)}s`;
-}
-function renderRun(run, record) {
-  const plain = isPlain();
-  const bold = (s) => plain ? s : pc2.bold(s);
-  const dim = (s) => plain ? s : pc2.dim(s);
-  const lines = [];
-  const scoped = run.scope?.kind;
-  if (scoped) {
-    lines.push(bold(`VerisKit \u2014 ${scoped}`));
-    lines.push("");
-    lines.push(`Scope       ${run.scope?.changedCount ?? 0} changed file(s)`);
-  } else {
-    lines.push(bold("VerisKit"));
-    lines.push("");
-    lines.push(
-      `Project     ${run.project.root.split("/").pop() ?? run.project.root}`
-    );
-    lines.push(`Risk        ${dim("\u2014")}`);
   }
-  lines.push("");
-  lines.push("Checks");
-  for (const r of run.results) {
-    const g = glyph(r.status, plain);
-    const detail = r.status === "skipped" ? dim(`skipped \u2014 ${r.summary}`) : r.cached ? dim(`\u27F3 cached \xB7 ${secs(r.durationMs) || "\u2014"}`) : secs(r.durationMs);
-    lines.push(`  ${g} ${r.checkId.padEnd(14)} ${detail}`);
-    if (r.outputTail) {
-      for (const tail of r.outputTail.split("\n")) {
-        lines.push(dim(`    ${tail}`));
-      }
+  const tests = /* @__PURE__ */ new Set();
+  for (const f of changed) {
+    if (graph.nodes[f]?.kind === "test") tests.add(f);
+    for (const dep of transitiveDependents(graph, f)) {
+      if (graph.nodes[dep]?.kind === "test") tests.add(dep);
     }
   }
-  lines.push("");
-  lines.push("Result");
-  const label = run.verdict.state === "verified" ? scoped ? "\u2713 Affected checks passed" : "\u2713 Verified" : run.verdict.state === "failed" ? scoped ? "\u2717 Affected checks failed" : "\u2717 Failed" : scoped ? "\u25B2 Affected: partial" : "\u25B2 Partial";
-  const color = run.verdict.state === "verified" ? pc2.green : run.verdict.state === "failed" ? pc2.red : pc2.yellow;
-  lines.push(`  ${plain ? label : color(label)}`);
-  if (record?.git) {
-    const g = record.git;
-    lines.push("");
-    lines.push(
-      `Commit      ${g.commit.slice(0, 7)} ${g.dirty ? "\xB7 tree dirty" : "\xB7 tree clean"}`
-    );
+  if (tests.size === 0) {
+    return {
+      mode: "full",
+      testFiles: [],
+      reason: "no tests reach the changed files"
+    };
   }
-  if (run.reportRef) {
-    lines.push("");
-    lines.push("Report");
-    lines.push(`  ${run.reportRef}`);
+  const selected = [...tests].sort();
+  if (selected.some((t) => t.startsWith("-"))) {
+    return {
+      mode: "full",
+      testFiles: [],
+      reason: "a reaching test path starts with '-' (unsafe as a CLI argument)"
+    };
   }
-  return lines.join("\n");
+  return { mode: "graph", testFiles: selected, reason: "" };
 }
-var init_terminal = __esm({
-  "src/reporters/terminal.ts"() {
+var GLOBAL_RE;
+var init_select = __esm({
+  "src/affected/select.ts"() {
     "use strict";
-    init_tty();
+    init_analyze();
+    GLOBAL_RE = /(^|\/)(tsconfig[^/]*\.json|package\.json|biome\.jsonc?|\.eslintrc[^/]*|eslint\.config\.[^/]+|veris\.config\.[^/]+|[^/]+\.config\.[cm]?[jt]sx?|[^/]+\.setup\.[cm]?[jt]sx?)$/;
   }
 });
 
-// src/cli/commands/test.ts
-var test_exports = {};
-__export(test_exports, {
-  runTest: () => runTest
-});
-async function runTest(root) {
-  const project = await detectProject(root);
-  const run = await runChecks(project, ["unit"], root);
-  process.stdout.write(`${renderRun(run)}
-`);
-  return verdictExitCode(run.verdict);
+// src/evidence/signing.ts
+import {
+  createHash as createHash2,
+  createPrivateKey,
+  createPublicKey,
+  sign as cryptoSign,
+  verify as cryptoVerify,
+  generateKeyPairSync
+} from "crypto";
+function derOf(publicKey) {
+  return publicKey.export({ type: "spki", format: "der" });
+}
+function keyId(publicKey) {
+  const key = typeof publicKey === "string" ? createPublicKey(publicKey) : publicKey;
+  return createHash2("sha256").update(derOf(key)).digest("hex").slice(0, 8);
+}
+function signatureKeyId(sig) {
+  const key = createPublicKey({
+    key: Buffer.from(sig.publicKey, "base64"),
+    format: "der",
+    type: "spki"
+  });
+  return keyId(key);
+}
+function verifySignature(sig) {
+  try {
+    const publicKey = createPublicKey({
+      key: Buffer.from(sig.publicKey, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    return cryptoVerify(
+      null,
+      Buffer.from(sig.digest, "utf8"),
+      publicKey,
+      Buffer.from(sig.signature, "base64")
+    );
+  } catch {
+    return false;
+  }
 }
-var init_test = __esm({
-  "src/cli/commands/test.ts"() {
+var init_signing = __esm({
+  "src/evidence/signing.ts"() {
     "use strict";
-    init_detect();
-    init_orchestrator();
-    init_verdict();
-    init_terminal();
   }
 });
 
-// src/cli/commands/init.ts
-var init_exports = {};
-__export(init_exports, {
-  runInit: () => runInit
+// src/evidence/bundle.ts
+var bundle_exports = {};
+__export(bundle_exports, {
+  BUNDLE_SCHEMA: () => BUNDLE_SCHEMA,
+  buildBundle: () => buildBundle,
+  verifyBundle: () => verifyBundle
 });
-import { join as join4 } from "path";
-async function runInit(root) {
-  const project = await detectProject(root);
-  const dir = join4(root, ".veris");
-  await ensureDir(dir);
-  const defaultChecks = project.capabilities.filter((c) => c.available && c.id !== "browser").map((c) => c.id);
-  const wroteConfig = await writeIfAbsent(
-    join4(dir, "config.json"),
-    `${JSON.stringify({ checks: defaultChecks }, null, 2)}
-`
-  );
-  await writeIfAbsent(join4(dir, ".gitignore"), GITIGNORE);
-  process.stdout.write(
-    wroteConfig ? `Veris initialized. Detected checks: ${defaultChecks.join(", ") || "none"}.
-` : "VerisKit already initialized (.veris/config.json exists). Nothing overwritten.\n"
-  );
-  return 0;
+function buildBundle(record, report, logs, signature) {
+  const manifest = {
+    record: record.digest,
+    report: sha256(report),
+    logs: Object.fromEntries(
+      Object.entries(logs).map(([k, v]) => [k, sha256(v)])
+    )
+  };
+  const base = signature ? { schema: BUNDLE_SCHEMA, record, report, logs, manifest, signature } : { schema: BUNDLE_SCHEMA, record, report, logs, manifest };
+  return { ...base, bundleDigest: sha256(canonicalize(base)) };
 }
-var GITIGNORE;
-var init_init = __esm({
-  "src/cli/commands/init.ts"() {
-    "use strict";
-    init_detect();
-    init_fs_safe();
-    GITIGNORE = [
-      "runs/",
-      "reports/",
-      "cache/",
-      "graph.json",
-      "evidence/",
-      "keys/",
-      ""
-    ].join("\n");
+function verifyBundle(bundle, opts = {}) {
+  const checks = [];
+  const recordResult = verifyRecord(bundle.record);
+  checks.push(...recordResult.checks);
+  const reportDigest = sha256(bundle.report);
+  checks.push({
+    name: "report",
+    ok: reportDigest === bundle.manifest.report,
+    detail: reportDigest === bundle.manifest.report ? "matches manifest" : "mismatch"
+  });
+  for (const [id, body] of Object.entries(bundle.logs)) {
+    const d = sha256(body);
+    checks.push({
+      name: `log:${id}`,
+      ok: d === bundle.manifest.logs[id],
+      detail: d === bundle.manifest.logs[id] ? "matches manifest" : "mismatch"
+    });
   }
-});
-
-// src/config/load.ts
-import { join as join5 } from "path";
-async function loadConfig(root) {
-  return readJsonIfExists(join5(root, ".veris", "config.json"));
+  const { bundleDigest: _omit, ...rest } = bundle;
+  const recomputed = sha256(canonicalize(rest));
+  checks.push({
+    name: "bundle digest",
+    ok: recomputed === bundle.bundleDigest,
+    detail: recomputed === bundle.bundleDigest ? "matches" : "mismatch"
+  });
+  let signed = false;
+  if (bundle.signature) {
+    signed = true;
+    checks.push(
+      ...signatureChecks(bundle.record.digest, bundle.signature, {
+        expectedKeyId: opts.expectedKeyId,
+        expectedPubKeyPem: opts.expectedPubKeyPem
+      })
+    );
+  } else if (opts.expectedKeyId || opts.expectedPubKeyPem) {
+    checks.push({
+      name: "signature",
+      ok: false,
+      detail: "a signature was required (--pubkey/--key-id) but the bundle is unsigned"
+    });
+  }
+  return {
+    ok: checks.every((c) => c.ok),
+    kind: "bundle",
+    record: bundle.record,
+    checks,
+    signed
+  };
 }
-var init_load = __esm({
-  "src/config/load.ts"() {
+var BUNDLE_SCHEMA;
+var init_bundle = __esm({
+  "src/evidence/bundle.ts"() {
     "use strict";
-    init_fs_safe();
+    init_record();
+    init_verify_evidence();
+    BUNDLE_SCHEMA = "veriskit/bundle@1";
   }
 });
 
-// src/git/changes.ts
-function collect(set, out) {
-  for (const line of out.split("\n")) {
-    const f = line.trim();
-    if (f) set.add(f);
-  }
-}
-async function changedFiles(root, opts = {}) {
-  const base = opts.base ?? null;
-  const files = /* @__PURE__ */ new Set();
-  const diffArgs = base ? ["diff", "--name-only", base] : ["diff", "--name-only", "HEAD"];
-  const diff = await exec("git", diffArgs, { cwd: root });
-  if (diff.code === 0) collect(files, diff.stdout);
-  const untracked = await exec(
-    "git",
-    ["ls-files", "--others", "--exclude-standard"],
-    { cwd: root }
+// src/evidence/verify-evidence.ts
+import { existsSync as existsSync5 } from "fs";
+import { readFile as readFile3 } from "fs/promises";
+function verifyRecord(record) {
+  const recomputed = computeDigest(
+    record
   );
-  if (untracked.code === 0) collect(files, untracked.stdout);
-  return { files: [...files].sort(), base };
+  const ok = recomputed === record.digest;
+  const checks = [
+    {
+      name: "record digest",
+      ok,
+      detail: ok ? "matches the canonical record" : `recomputed ${recomputed}, record claims ${record.digest}`
+    }
+  ];
+  return { ok, kind: "record", record, checks, signed: false };
 }
-async function gitAnchor(root) {
-  const head = await exec("git", ["rev-parse", "HEAD"], { cwd: root });
-  if (head.code !== 0) return null;
-  const commit = head.stdout.trim();
-  const branchRes = await exec("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
-    cwd: root
+function signatureChecks(recordDigest, sig, opts = {}) {
+  const checks = [];
+  const kid = signatureKeyId(sig);
+  const validSig = verifySignature(sig) && sig.digest === recordDigest;
+  checks.push({
+    name: "signature",
+    ok: validSig,
+    detail: validSig ? `valid ed25519 signature by key ${kid}` : "signature does not match this record"
   });
-  const branch = branchRes.code === 0 ? branchRes.stdout.trim() : "HEAD";
-  const status = await exec("git", ["status", "--porcelain"], { cwd: root });
-  const lines = status.code === 0 ? status.stdout.split("\n").map((l) => l.trim()).filter(Boolean) : [];
-  return {
-    commit,
-    branch,
-    dirty: lines.length > 0,
-    changedFiles: lines.length
-  };
-}
-var init_changes = __esm({
-  "src/git/changes.ts"() {
-    "use strict";
-    init_exec();
+  if (opts.expectedKeyId || opts.expectedPubKeyPem) {
+    let matches = false;
+    if (opts.expectedPubKeyPem) {
+      try {
+        matches = keyId(opts.expectedPubKeyPem) === kid;
+      } catch {
+        matches = false;
+      }
+    } else if (opts.expectedKeyId) {
+      matches = opts.expectedKeyId.toLowerCase() === kid.toLowerCase();
+    }
+    checks.push({
+      name: "signer",
+      ok: matches,
+      detail: matches ? `signer matches the expected key ${kid}` : `signer ${kid} does not match the expected key`
+    });
   }
-});
-
-// src/reporters/markdown.ts
-import { relative } from "path";
-function cell(value) {
-  return value.replace(/\|/g, "\\|");
+  return checks;
 }
-function renderMarkdown(run, record) {
-  const root = run.project.root;
-  const lines = [];
-  lines.push("# VerisKit Verification Report");
-  if (run.scope?.kind) {
-    lines.push("");
-    lines.push(
-      `> **Scope:** ${run.scope.kind} \u2014 ${run.scope.changedCount} changed file(s). Only affected checks ran; this is not a full verification.`
-    );
+async function verifyEvidenceFile(path, opts = {}) {
+  const parsed = JSON.parse(await readFile3(path, "utf8"));
+  if (parsed?.schema === "veriskit/bundle@1") {
+    const { verifyBundle: verifyBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
+    return verifyBundle2(parsed, opts);
   }
-  lines.push("");
-  lines.push(`**Verdict:** ${STATE_LABEL[run.verdict.state]}`);
-  lines.push(`**When:** ${run.startedAt}`);
-  lines.push(
-    `**Node:** ${run.env.node} \xB7 **OS:** ${run.env.os} \xB7 **PM:** ${run.env.pm} \xB7 **CI:** ${run.env.ci}`
+  const result = verifyRecord(parsed);
+  const assertedSigner = Boolean(
+    opts.expectedKeyId || opts.expectedPubKeyPem || opts.sigPath
   );
-  if (record?.git) {
-    const g = record.git;
-    const tree = g.dirty ? `tree dirty, ${g.changedFiles} uncommitted file(s)` : "tree clean";
-    lines.push(`**Commit:** ${g.commit.slice(0, 7)} (${g.branch}) \xB7 ${tree}`);
-  } else if (record) {
-    lines.push("**Commit:** no git anchor available");
-  }
-  lines.push("");
-  lines.push("## Checks");
-  lines.push("");
-  lines.push("| Check | Status | Duration | Summary | Log |");
-  lines.push("| --- | --- | --- | --- | --- |");
-  for (const r of run.results) {
-    const dur = r.durationMs ? `${(r.durationMs / 1e3).toFixed(1)}s` : "\u2014";
-    const log = r.logRef ? cell(relative(root, r.logRef)) : "\u2014";
-    lines.push(
-      `| ${r.checkId} | ${r.status} | ${dur} | ${cell(r.summary)} | ${log} |`
-    );
-  }
-  if (run.verdict.skipped.length) {
-    lines.push("");
-    lines.push("## Skipped");
-    lines.push("");
-    for (const reason of run.verdict.reasons) lines.push(`- ${reason}`);
-  }
-  const failures = run.results.filter((r) => r.outputTail);
-  if (failures.length) {
-    lines.push("");
-    lines.push("## Failure output");
-    for (const r of failures) {
-      lines.push("");
-      lines.push(`### ${r.checkId}`);
-      lines.push("");
-      lines.push("```");
-      lines.push(r.outputTail ?? "");
-      lines.push("```");
-    }
-  }
-  if (record) {
-    lines.push("");
-    lines.push(`**Evidence digest:** \`${record.digest}\``);
-    lines.push(
-      "_Integrity digest over the canonical record. Detects edits and corruption; it is not forgery-proof on its own. Publish the digest separately or sign it to prove authorship._"
+  const sigPath = opts.sigPath ?? `${path}.sig`;
+  if (existsSync5(sigPath)) {
+    const sig = JSON.parse(await readFile3(sigPath, "utf8"));
+    result.checks.push(
+      ...signatureChecks(result.record.digest, sig, {
+        expectedKeyId: opts.expectedKeyId,
+        expectedPubKeyPem: opts.expectedPubKeyPem
+      })
     );
+    result.signed = true;
+  } else if (assertedSigner) {
+    result.checks.push({
+      name: "signature",
+      ok: false,
+      detail: "a signature was required (--pubkey/--key-id/--sig) but none was found"
+    });
   }
-  lines.push("");
-  lines.push(
-    "_Generated by VerisKit. A `Partial` verdict means one or more capabilities did not run \u2014 it is not a pass._"
-  );
-  lines.push("");
-  return lines.join("\n");
+  result.ok = result.checks.every((c) => c.ok);
+  return result;
 }
-var STATE_LABEL;
-var init_markdown = __esm({
-  "src/reporters/markdown.ts"() {
+var init_verify_evidence = __esm({
+  "src/evidence/verify-evidence.ts"() {
     "use strict";
-    STATE_LABEL = {
-      verified: "Verified",
-      failed: "Failed",
-      partial: "Partial"
-    };
+    init_record();
+    init_signing();
   }
 });
 
-// src/publish/comment.ts
-function renderComment(run, record) {
-  const summary = run.results.filter((r) => r.status !== "skipped").map((r) => `${r.checkId} ${r.status}`).join(" \xB7 ");
-  return [
-    MARKER,
-    `**VerisKit: ${STATE_LABEL2[run.verdict.state]}**`,
-    "",
-    summary,
-    "",
-    "<details><summary>Report</summary>",
-    "",
-    renderMarkdown(run, record),
-    "",
-    "</details>",
-    ""
-  ].join("\n");
-}
-var MARKER, STATE_LABEL2;
-var init_comment = __esm({
-  "src/publish/comment.ts"() {
-    "use strict";
-    init_markdown();
-    MARKER = "<!-- veriskit-report -->";
-    STATE_LABEL2 = {
-      verified: "verified",
-      failed: "failed",
-      partial: "partial"
-    };
-  }
-});
+// src/config/detect.ts
+import { existsSync as existsSync2 } from "fs";
+import { join } from "path";
 
-// src/publish/context.ts
-import { readFileSync as readFileSync2 } from "fs";
-function defaultReadEvent(path) {
+// src/util/fs-safe.ts
+import { existsSync } from "fs";
+import { mkdir, readFile, writeFile } from "fs/promises";
+async function ensureDir(path) {
+  await mkdir(path, { recursive: true });
+}
+async function readJsonIfExists(path) {
+  if (!existsSync(path)) return null;
   try {
-    return JSON.parse(readFileSync2(path, "utf8"));
+    return JSON.parse(await readFile(path, "utf8"));
   } catch {
     return null;
   }
 }
-function resolvePublishContext(env = process.env, readEvent = defaultReadEvent) {
-  const repository = env.GITHUB_REPOSITORY;
-  const token = env.GITHUB_TOKEN;
-  if (!repository || !token) return null;
-  const [owner, repo] = repository.split("/");
-  if (!owner || !repo) return null;
-  let prNumber = null;
-  let headSha = env.GITHUB_SHA ?? "";
-  const refMatch = (env.GITHUB_REF ?? "").match(/^refs\/pull\/(\d+)\//);
-  if (refMatch) prNumber = Number(refMatch[1]);
-  const event = readEvent(env.GITHUB_EVENT_PATH ?? "");
-  const pr = event?.pull_request;
-  if (pr) {
-    if (prNumber === null && typeof pr.number === "number") {
-      prNumber = pr.number;
-    }
-    if (pr.head?.sha) headSha = pr.head.sha;
-  }
-  if (prNumber === null || !headSha) return null;
-  return { owner, repo, token, prNumber, headSha };
-}
-var init_context = __esm({
-  "src/publish/context.ts"() {
-    "use strict";
-  }
-});
 
-// src/publish/github.ts
-function headers(token) {
+// src/config/detect.ts
+function detectPackageManager(root) {
+  if (existsSync2(join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync2(join(root, "yarn.lock"))) return "yarn";
+  if (existsSync2(join(root, "bun.lockb"))) return "bun";
+  return "npm";
+}
+async function detectProject(root) {
+  const pkg = await readJsonIfExists(join(root, "package.json")) ?? {};
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  const has = (name) => name in deps;
+  const scripts = pkg.scripts ?? {};
+  const languages = existsSync2(join(root, "tsconfig.json")) ? ["typescript", "javascript"] : ["javascript"];
+  const frameworks = ["next", "vite", "react"].filter(has);
+  const capabilities = [
+    detectTypes(root, has),
+    detectUnit(has, scripts),
+    detectLint(root, has),
+    detectBrowser(root, has)
+  ];
   return {
-    Authorization: `Bearer ${token}`,
-    Accept: "application/vnd.github+json",
-    "X-GitHub-Api-Version": "2022-11-28",
-    "User-Agent": "veriskit",
-    "Content-Type": "application/json"
+    root,
+    name: pkg.name ?? void 0,
+    packageManager: detectPackageManager(root),
+    frameworks,
+    languages,
+    scripts,
+    capabilities
   };
 }
-async function gh(method, url, token, body) {
-  const res = await fetch(url, {
-    method,
-    headers: headers(token),
-    body: body === void 0 ? void 0 : JSON.stringify(body)
-  });
-  if (!res.ok) {
-    const path = url.replace("https://api.github.com", "");
-    throw new GitHubApiError(
-      res.status,
-      `GitHub API ${method} ${path} -> ${res.status}`
-    );
-  }
-  return res.json();
-}
-function repoBase(ctx) {
-  return `https://api.github.com/repos/${ctx.owner}/${ctx.repo}`;
+function detectTypes(root, has) {
+  if (existsSync2(join(root, "tsconfig.json")) && has("typescript"))
+    return { id: "types", available: true, runner: "tsc" };
+  return {
+    id: "types",
+    available: false,
+    reason: "no tsconfig.json + typescript dependency"
+  };
 }
-async function upsertComment(ctx, body) {
-  const base = repoBase(ctx);
-  const comments = await gh(
-    "GET",
-    `${base}/issues/${ctx.prNumber}/comments?per_page=100`,
-    ctx.token
-  );
-  const existing = comments.find((c) => (c.body ?? "").includes(MARKER));
-  if (existing) {
-    await gh("PATCH", `${base}/issues/comments/${existing.id}`, ctx.token, {
-      body
-    });
-  } else {
-    await gh("POST", `${base}/issues/${ctx.prNumber}/comments`, ctx.token, {
-      body
-    });
-  }
+function detectUnit(has, scripts) {
+  if (has("vitest")) return { id: "unit", available: true, runner: "vitest" };
+  if (has("jest")) return { id: "unit", available: true, runner: "jest" };
+  if (Object.values(scripts).some((s) => s.includes("node --test")))
+    return { id: "unit", available: true, runner: "node-test" };
+  return { id: "unit", available: false, reason: "no test runner detected" };
 }
-async function createCheckRun(ctx, opts) {
-  await gh("POST", `${repoBase(ctx)}/check-runs`, ctx.token, {
-    name: opts.name,
-    head_sha: ctx.headSha,
-    status: "completed",
-    conclusion: opts.conclusion,
-    output: { title: opts.title, summary: opts.summary }
-  });
+function detectLint(root, has) {
+  if (existsSync2(join(root, "biome.json")) || has("@biomejs/biome"))
+    return { id: "lint", available: true, runner: "biome" };
+  if (has("eslint") || [".eslintrc", ".eslintrc.json", ".eslintrc.cjs", "eslint.config.js"].some(
+    (f) => existsSync2(join(root, f))
+  ))
+    return { id: "lint", available: true, runner: "eslint" };
+  return { id: "lint", available: false, reason: "no linter configured" };
 }
-var GitHubApiError;
-var init_github = __esm({
-  "src/publish/github.ts"() {
-    "use strict";
-    init_comment();
-    GitHubApiError = class extends Error {
-      status;
-      constructor(status, message) {
-        super(message);
-        this.name = "GitHubApiError";
-        this.status = status;
-      }
-    };
+function detectBrowser(root, has) {
+  if (has("@playwright/test") || existsSync2(join(root, "playwright.config.ts")) || existsSync2(join(root, "playwright.config.js"))) {
+    return { id: "browser", available: true, runner: "playwright" };
   }
-});
-
-// src/publish/publish.ts
-async function publishToGitHub(run, record) {
-  const ctx = resolvePublishContext();
-  if (!ctx) {
-    process.stdout.write(
-      "veris: --github set but no GitHub PR context found (need GITHUB_TOKEN + a pull_request event); skipping publish.\n"
-    );
-    return;
-  }
-  try {
-    await upsertComment(ctx, renderComment(run, record));
-    await createCheckRun(ctx, {
-      name: "VerisKit",
-      conclusion: CONCLUSION[run.verdict.state],
-      title: `VerisKit: ${run.verdict.state}`,
-      summary: renderMarkdown(run, record)
-    });
-    process.stdout.write(
-      `veris: published the verdict to PR #${ctx.prNumber}
-`
-    );
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`veris: GitHub publish failed: ${msg}
-`);
-  }
-}
-var CONCLUSION;
-var init_publish = __esm({
-  "src/publish/publish.ts"() {
-    "use strict";
-    init_markdown();
-    init_comment();
-    init_context();
-    init_github();
-    CONCLUSION = {
-      verified: "success",
-      failed: "failure",
-      partial: "neutral"
-    };
-  }
-});
-
-// src/cli/commands/verify.ts
-var verify_exports = {};
-__export(verify_exports, {
-  resolveChecks: () => resolveChecks,
-  runVerify: () => runVerify
-});
-function resolveChecks(configChecks, project, opts) {
-  let checks = configChecks?.length ? configChecks : DEFAULT_CHECKS;
-  if (opts.browser && !checks.includes("browser")) {
-    const cap = project.capabilities.find((c) => c.id === "browser");
-    if (cap?.available) checks = [...checks, "browser"];
-  }
-  return checks;
-}
-async function runVerify(root, opts = {}) {
-  const project = await detectProject(root);
-  const config = await loadConfig(root);
-  const checks = resolveChecks(config?.checks, project, opts);
-  const run = await runChecks(project, checks, root);
-  const git = await gitAnchor(root);
-  const logDigests = await digestLogs(run);
-  const record = buildRecord(run, git, logDigests, VERSION);
-  const reportRef = await writeReport(
-    root,
-    run.id,
-    renderMarkdown(run, record)
-  );
-  run.reportRef = reportRef;
-  const runDir = await createRunDir(root, run.id);
-  await writeEvidence(runDir, record);
-  process.stdout.write(`${renderRun(run, record)}
-`);
-  if (opts.github) await publishToGitHub(run, record);
-  return verdictExitCode(run.verdict, opts);
-}
-var DEFAULT_CHECKS;
-var init_verify = __esm({
-  "src/cli/commands/verify.ts"() {
-    "use strict";
-    init_detect();
-    init_load();
-    init_orchestrator();
-    init_verdict();
-    init_record();
-    init_store();
-    init_changes();
-    init_publish();
-    init_markdown();
-    init_terminal();
-    init_version();
-    DEFAULT_CHECKS = ["types", "lint", "unit"];
-  }
-});
-
-// src/cli/commands/report.ts
-var report_exports = {};
-__export(report_exports, {
-  runReport: () => runReport
-});
-import { readdirSync as readdirSync2, readFileSync as readFileSync3 } from "fs";
-import { join as join6 } from "path";
-async function runReport(root) {
-  const dir = join6(root, ".veris", "reports");
-  let files;
-  try {
-    files = readdirSync2(dir).filter((f) => f.endsWith(".md")).sort();
-  } catch {
-    process.stdout.write("No reports yet. Run `veris verify` first.\n");
-    return 0;
-  }
-  const latest = files.at(-1);
-  if (!latest) {
-    process.stdout.write("No reports yet. Run `veris verify` first.\n");
-    return 0;
-  }
-  process.stdout.write(`${readFileSync3(join6(dir, latest), "utf8")}
-`);
-  return 0;
+  return {
+    id: "browser",
+    available: false,
+    reason: "no browser runner configured"
+  };
 }
-var init_report = __esm({
-  "src/cli/commands/report.ts"() {
-    "use strict";
-  }
-});
 
 // src/affected/gate.ts
+var ORDER = ["types", "lint", "unit", "browser"];
+var CONFIG_RE = /(^|\/)(tsconfig[^/]*\.json|biome\.jsonc?|\.eslintrc[^/]*|eslint\.config\.[^/]+|package\.json|veris\.config\.[^/]+)$/;
+var TEST_RE = /(\.(test|spec)\.[cm]?[jt]sx?$)|(^|\/)(test|__tests__)\//;
+var TS_RE = /\.[cm]?tsx?$/;
+var JS_RE = /\.[cm]?jsx?$/;
+var DOC_RE = /(\.(md|mdx|markdown|txt|png|jpe?g|gif|svg|webp|ico)$)|((^|\/)LICENSE$)/i;
 function affectedChecks(files, project) {
   const available = new Set(
     project.capabilities.filter((c) => c.available).map((c) => c.id)
@@ -1371,1327 +749,635 @@ function affectedChecks(files, project) {
     changedCount: files.length
   };
 }
-var ORDER, CONFIG_RE, TEST_RE, TS_RE, JS_RE, DOC_RE;
-var init_gate = __esm({
-  "src/affected/gate.ts"() {
-    "use strict";
-    ORDER = ["types", "lint", "unit", "browser"];
-    CONFIG_RE = /(^|\/)(tsconfig[^/]*\.json|biome\.jsonc?|\.eslintrc[^/]*|eslint\.config\.[^/]+|package\.json|veris\.config\.[^/]+)$/;
-    TEST_RE = /(\.(test|spec)\.[cm]?[jt]sx?$)|(^|\/)(test|__tests__)\//;
-    TS_RE = /\.[cm]?tsx?$/;
-    JS_RE = /\.[cm]?jsx?$/;
-    DOC_RE = /(\.(md|mdx|markdown|txt|png|jpe?g|gif|svg|webp|ico)$)|((^|\/)LICENSE$)/i;
-  }
-});
 
-// src/project-graph/discover.ts
-import { readdirSync as readdirSync3, statSync } from "fs";
-import { join as join7, relative as relative2, sep } from "path";
-function toPosix(p) {
-  return sep === "/" ? p : p.split(sep).join("/");
-}
-function classify(rel) {
-  if (TEST_RE2.test(rel)) return "test";
-  if (CONFIG_RE2.test(rel)) return "config";
-  return "source";
-}
-function discoverFiles(root) {
-  const out = [];
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync3(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const abs = join7(dir, name);
-      const rel = toPosix(relative2(root, abs));
-      if (IGNORE.test(rel)) continue;
-      let st;
-      try {
-        st = statSync(abs);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        walk(abs);
-      } else if (CODE_RE.test(rel)) {
-        out.push({ file: rel, kind: classify(rel) });
-      }
-    }
-  };
-  walk(root);
-  return out.sort((a, b) => a.file.localeCompare(b.file));
+// src/config/load.ts
+import { join as join2 } from "path";
+async function loadConfig(root) {
+  return readJsonIfExists(join2(root, ".veris", "config.json"));
 }
-var IGNORE, CODE_RE, TEST_RE2, CONFIG_RE2;
-var init_discover = __esm({
-  "src/project-graph/discover.ts"() {
-    "use strict";
-    IGNORE = /(^|\/)(\.git|\.claude|\.veris|\.agentloop|\.agentflight|node_modules|dist|coverage|build|fixtures|__fixtures__)(\/|$)/;
-    CODE_RE = /\.[cm]?[jt]sx?$/;
-    TEST_RE2 = /(\.(test|spec)\.[cm]?[jt]sx?$)|(^|\/)(test|tests|__tests__)\//;
-    CONFIG_RE2 = /(^|\/)([^/]+\.config\.[cm]?[jt]sx?)$/;
-  }
-});
 
-// src/project-graph/scanner-resolver.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
-import { dirname, join as join8, relative as relative3, resolve } from "path";
-function extractSpecifiers(text) {
-  const specs = [];
-  SPEC_RE.lastIndex = 0;
-  let m;
-  m = SPEC_RE.exec(text);
-  while (m !== null) {
-    const s = m[1] ?? m[2] ?? m[3] ?? m[4];
-    if (s) specs.push(s);
-    m = SPEC_RE.exec(text);
-  }
-  return specs;
-}
-function isFile(p) {
-  try {
-    return statSync2(p).isFile();
-  } catch {
-    return false;
-  }
-}
-function resolveRelative(fromDir, spec) {
-  const base = resolve(fromDir, spec);
-  const candidates = [base];
-  for (const ext of EXTS) candidates.push(base + ext);
-  const extMatch = base.match(/\.[cm]?[jt]sx?$/);
-  if (extMatch) {
-    const noExt = base.slice(0, -extMatch[0].length);
-    for (const ext of EXTS) candidates.push(noExt + ext);
-  }
-  for (const ext of EXTS) candidates.push(join8(base, `index${ext}`));
-  for (const c of candidates) {
-    if (existsSync3(c) && isFile(c)) return c;
-  }
-  return null;
-}
-function scannerImports(root, file) {
-  let text;
-  try {
-    text = readFileSync4(join8(root, file), "utf8");
-  } catch {
-    return [];
-  }
-  const dir = dirname(join8(root, file));
-  const out = /* @__PURE__ */ new Set();
-  for (const spec of extractSpecifiers(text)) {
-    if (!spec.startsWith(".")) continue;
-    const resolved = resolveRelative(dir, spec);
-    if (resolved) out.add(toPosix(relative3(root, resolved)));
-  }
-  return [...out];
-}
-var EXTS, SPEC_RE;
-var init_scanner_resolver = __esm({
-  "src/project-graph/scanner-resolver.ts"() {
-    "use strict";
-    init_discover();
-    EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
-    SPEC_RE = /(?:import|export)\b[^'"]*?\bfrom\s*['"]([^'"]+)['"]|(?:^|[^.\w])import\s*['"]([^'"]+)['"]|\bimport\(\s*['"]([^'"]+)['"]\s*\)|\brequire\(\s*['"]([^'"]+)['"]\s*\)/g;
-  }
-});
+// src/core/orchestrate.ts
+init_record();
 
-// src/project-graph/ts-resolver.ts
-import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
-import { createRequire } from "module";
-import { join as join9, relative as relative4, sep as sep2 } from "path";
-function hasClassicApi(mod) {
-  const m = mod;
-  return !!m && typeof m.preProcessFile === "function" && typeof m.resolveModuleName === "function" && typeof m.readConfigFile === "function" && typeof m.parseJsonConfigFileContent === "function" && typeof m.sys === "object" && m.sys !== null;
+// src/evidence/store.ts
+import { readdirSync } from "fs";
+import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { join as join3 } from "path";
+init_record();
+var counter = 0;
+function newRunId() {
+  counter += 1;
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  return `${stamp}-${counter}`;
 }
-function loadTypeScript(root) {
-  try {
-    const require2 = createRequire(join9(root, "__veris__.js"));
-    const tsPath = require2.resolve("typescript");
-    const mod = require2(tsPath);
-    return hasClassicApi(mod) ? mod : null;
-  } catch {
-    return null;
-  }
+async function createRunDir(root, id) {
+  const dir = join3(root, ".veris", "runs", id);
+  await ensureDir(dir);
+  return dir;
 }
-function loadCompilerOptions(tsmod, root) {
-  const configPath = join9(root, "tsconfig.json");
-  const read = tsmod.readConfigFile(configPath, tsmod.sys.readFile);
-  if (read.error || !read.config) return {};
-  const parsed = tsmod.parseJsonConfigFileContent(read.config, tsmod.sys, root);
-  return parsed.options;
+async function writeLog(runDir, checkId, content) {
+  const ref = join3(runDir, `${checkId}.log`);
+  await writeFile2(ref, content, "utf8");
+  return ref;
 }
-function tsImports(tsmod, root, options, file) {
-  let text;
-  try {
-    text = readFileSync5(join9(root, file), "utf8");
-  } catch {
-    return [];
-  }
-  const abs = join9(root, file);
-  const out = /* @__PURE__ */ new Set();
-  try {
-    const pre = tsmod.preProcessFile(text, true, true);
-    for (const imp of pre.importedFiles) {
-      const res = tsmod.resolveModuleName(
-        imp.fileName,
-        abs,
-        options,
-        tsmod.sys
-      );
-      const resolved = res.resolvedModule?.resolvedFileName;
-      if (resolved && !resolved.includes("node_modules") && resolved.startsWith(root + sep2)) {
-        out.add(toPosix(relative4(root, resolved)));
-      }
-    }
-  } catch {
-  }
-  return [...out];
+async function writeReport(root, id, markdown) {
+  const dir = join3(root, ".veris", "reports");
+  await ensureDir(dir);
+  const ref = join3(dir, `verify-${id}.md`);
+  await writeFile2(ref, markdown, "utf8");
+  return ref;
 }
-function selectResolver(root) {
-  const tsmod = existsSync4(join9(root, "tsconfig.json")) ? loadTypeScript(root) : null;
-  if (tsmod) {
+async function writeEvidence(runDir, record) {
+  const ref = join3(runDir, "evidence.json");
+  await writeFile2(ref, `${JSON.stringify(record, null, 2)}
+`, "utf8");
+  return ref;
+}
+async function digestLogs(run) {
+  const out = {};
+  for (const r of run.results) {
+    if (!r.logRef) continue;
     try {
-      const options = loadCompilerOptions(tsmod, root);
-      return {
-        resolver: "typescript",
-        importsOf: (file) => tsImports(tsmod, root, options, file)
-      };
+      out[r.checkId] = sha256(await readFile2(r.logRef, "utf8"));
     } catch {
     }
   }
-  return {
-    resolver: "scanner",
-    importsOf: (file) => scannerImports(root, file)
-  };
+  return out;
 }
-var init_ts_resolver = __esm({
-  "src/project-graph/ts-resolver.ts"() {
-    "use strict";
-    init_discover();
-    init_scanner_resolver();
-  }
-});
 
-// src/project-graph/graph.ts
-var graph_exports = {};
-__export(graph_exports, {
-  buildGraph: () => buildGraph
-});
-async function buildGraph(project) {
-  const root = project.root;
-  const files = discoverFiles(root);
-  const known = new Set(files.map((f) => f.file));
-  const { resolver, importsOf } = selectResolver(root);
-  const nodes = {};
-  for (const f of files) {
-    nodes[f.file] = { file: f.file, kind: f.kind, imports: [], importedBy: [] };
-  }
-  for (const f of files) {
-    const imps = importsOf(f.file).filter((i) => known.has(i) && i !== f.file);
-    nodes[f.file].imports = imps;
-    for (const i of imps) nodes[i]?.importedBy.push(f.file);
-  }
-  return {
-    root,
-    resolver,
-    nodes,
-    sourceFiles: files.filter((f) => f.kind === "source").map((f) => f.file),
-    testFiles: files.filter((f) => f.kind === "test").map((f) => f.file)
-  };
-}
-var init_graph = __esm({
-  "src/project-graph/graph.ts"() {
-    "use strict";
-    init_discover();
-    init_ts_resolver();
-  }
-});
-
-// src/project-graph/analyze.ts
-function transitiveDependents(graph, file) {
-  const seen = /* @__PURE__ */ new Set();
-  const stack = [...graph.nodes[file]?.importedBy ?? []];
-  while (stack.length) {
-    const f = stack.pop();
-    if (!f || seen.has(f)) continue;
-    seen.add(f);
-    for (const d of graph.nodes[f]?.importedBy ?? []) stack.push(d);
-  }
-  return seen;
-}
-function reachableFromTests(graph) {
-  const seen = /* @__PURE__ */ new Set();
-  const stack = [...graph.testFiles];
-  while (stack.length) {
-    const f = stack.pop();
-    if (!f || seen.has(f)) continue;
-    seen.add(f);
-    for (const i of graph.nodes[f]?.imports ?? []) stack.push(i);
-  }
-  return seen;
-}
-function analyze(graph, changed = []) {
-  const blastRadius = {};
-  for (const file of Object.keys(graph.nodes)) {
-    blastRadius[file] = transitiveDependents(graph, file).size;
-  }
-  const reached = reachableFromTests(graph);
-  const byBlast = (a, b) => (blastRadius[b] ?? 0) - (blastRadius[a] ?? 0);
-  const untested = graph.sourceFiles.filter((f) => !reached.has(f)).sort(byBlast);
-  const changedSet = new Set(changed);
-  const untestedSet = new Set(untested);
-  const risky = graph.sourceFiles.filter(
-    (f) => (blastRadius[f] ?? 0) > 0 && (untestedSet.has(f) || changedSet.has(f))
-  ).sort(byBlast);
-  return { untested, blastRadius, risky };
-}
-var init_analyze = __esm({
-  "src/project-graph/analyze.ts"() {
-    "use strict";
-  }
-});
-
-// src/affected/select.ts
-var select_exports = {};
-__export(select_exports, {
-  selectAffectedTests: () => selectAffectedTests
-});
-function selectAffectedTests(graph, changed) {
-  if (graph.resolver !== "typescript") {
-    return {
-      mode: "full",
-      testFiles: [],
-      reason: "scanner graph can miss aliased/subpath imports \u2014 running the full suite"
-    };
-  }
-  for (const f of changed) {
-    if (GLOBAL_RE.test(f)) {
-      return {
-        mode: "full",
-        testFiles: [],
-        reason: `global/config change (${f})`
-      };
-    }
-    if (!(f in graph.nodes)) {
-      return {
-        mode: "full",
-        testFiles: [],
-        reason: `unresolved changed file (${f})`
-      };
-    }
-  }
-  const tests = /* @__PURE__ */ new Set();
-  for (const f of changed) {
-    if (graph.nodes[f]?.kind === "test") tests.add(f);
-    for (const dep of transitiveDependents(graph, f)) {
-      if (graph.nodes[dep]?.kind === "test") tests.add(dep);
-    }
-  }
-  if (tests.size === 0) {
-    return {
-      mode: "full",
-      testFiles: [],
-      reason: "no tests reach the changed files"
-    };
-  }
-  const selected = [...tests].sort();
-  if (selected.some((t) => t.startsWith("-"))) {
-    return {
-      mode: "full",
-      testFiles: [],
-      reason: "a reaching test path starts with '-' (unsafe as a CLI argument)"
-    };
-  }
-  return { mode: "graph", testFiles: selected, reason: "" };
-}
-var GLOBAL_RE;
-var init_select = __esm({
-  "src/affected/select.ts"() {
-    "use strict";
-    init_analyze();
-    GLOBAL_RE = /(^|\/)(tsconfig[^/]*\.json|package\.json|biome\.jsonc?|\.eslintrc[^/]*|eslint\.config\.[^/]+|veris\.config\.[^/]+|[^/]+\.config\.[cm]?[jt]sx?|[^/]+\.setup\.[cm]?[jt]sx?)$/;
-  }
-});
-
-// src/cli/commands/affected.ts
-var affected_exports = {};
-__export(affected_exports, {
-  runAffected: () => runAffected
-});
-async function runAffected(root, opts = {}) {
-  const project = await detectProject(root);
-  const { files } = await changedFiles(root, { base: opts.base });
-  const plan = affectedChecks(files, project);
-  if (plan.checks.length === 0) {
-    process.stdout.write(
-      `Nothing affected \u2014 ${files.length} changed file(s), no checks to run.
-`
-    );
-    return 0;
-  }
-  let targetFiles;
-  let narrowedNote = "";
-  const unitRunner = project.capabilities.find((c) => c.id === "unit")?.runner;
-  const canNarrow = unitRunner === "vitest" || unitRunner === "jest";
-  if (plan.checks.includes("unit") && canNarrow) {
-    const { buildGraph: buildGraph2 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
-    const { selectAffectedTests: selectAffectedTests2 } = await Promise.resolve().then(() => (init_select(), select_exports));
-    const graph = await buildGraph2(project);
-    const sel = selectAffectedTests2(graph, files);
-    if (sel.mode === "graph") {
-      targetFiles = { unit: sel.testFiles };
-      narrowedNote = `unit narrowed to ${sel.testFiles.length} of ${graph.testFiles.length} test file(s) via ${graph.resolver} graph`;
-    } else {
-      narrowedNote = `unit ran in full \u2014 ${sel.reason}`;
-    }
-  } else if (plan.checks.includes("unit") && unitRunner) {
-    narrowedNote = `unit ran in full \u2014 the ${unitRunner} runner does not support file filtering`;
-  }
-  const run = await runChecks(project, plan.checks, root, { targetFiles });
-  run.scope = { kind: "affected", changedCount: files.length };
-  const affected = new Set(plan.checks);
-  for (const cap of project.capabilities) {
-    if (cap.available && cap.id !== "browser" && !affected.has(cap.id)) {
-      run.results.push({
-        checkId: cap.id,
-        status: "skipped",
-        durationMs: 0,
-        summary: "not affected by changes"
+// src/util/exec.ts
+import { spawn } from "child_process";
+function exec(cmd, args, opts = {}) {
+  return new Promise((resolve2) => {
+    const start = performance.now();
+    const child = spawn(cmd, args, {
+      cwd: opts.cwd,
+      env: opts.env ?? process.env,
+      shell: false
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    const timer = opts.timeoutMs ? setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, opts.timeoutMs) : null;
+    child.stdout.on("data", (d) => stdout += d.toString());
+    child.stderr.on("data", (d) => stderr += d.toString());
+    child.on("close", (code) => {
+      if (timer) clearTimeout(timer);
+      resolve2({
+        code: code ?? 1,
+        stdout,
+        stderr,
+        durationMs: Math.round(performance.now() - start),
+        timedOut
       });
-    }
-  }
-  const git = await gitAnchor(root);
-  const logDigests = await digestLogs(run);
-  const record = buildRecord(run, git, logDigests, VERSION);
-  const reportRef = await writeReport(
-    root,
-    run.id,
-    renderMarkdown(run, record)
-  );
-  run.reportRef = reportRef;
-  const runDir = await createRunDir(root, run.id);
-  await writeEvidence(runDir, record);
-  process.stdout.write(`${renderRun(run, record)}
-`);
-  if (narrowedNote) process.stdout.write(`${narrowedNote}
-`);
-  if (opts.github) await publishToGitHub(run, record);
-  return verdictExitCode(run.verdict, opts);
-}
-var init_affected = __esm({
-  "src/cli/commands/affected.ts"() {
-    "use strict";
-    init_gate();
-    init_detect();
-    init_orchestrator();
-    init_verdict();
-    init_record();
-    init_store();
-    init_changes();
-    init_publish();
-    init_markdown();
-    init_terminal();
-    init_version();
-  }
-});
-
-// src/watch/watcher.ts
-import {
-  watch as fsWatch,
-  readdirSync as readdirSync4,
-  statSync as statSync3
-} from "fs";
-import { basename as basename2, join as join10, relative as relative5 } from "path";
-function watch(root, opts, onBatch) {
-  const debounceMs = opts.debounceMs ?? 150;
-  const rootBase = basename2(root);
-  let pending = /* @__PURE__ */ new Set();
-  let timer = null;
-  const flush = () => {
-    const batch = [...pending];
-    pending = /* @__PURE__ */ new Set();
-    timer = null;
-    if (batch.length) onBatch(batch);
-  };
-  const schedule = (rel) => {
-    if (!rel || rel === rootBase || IGNORE2.test(rel)) return;
-    pending.add(rel);
-    if (timer) clearTimeout(timer);
-    timer = setTimeout(flush, debounceMs);
-  };
-  if (opts.poll) {
-    const interval = opts.pollIntervalMs ?? 400;
-    const mtimes = scanMtimes(root);
-    const tick = setInterval(() => {
-      const next = scanMtimes(root);
-      for (const [p, m] of next) {
-        if (mtimes.get(p) !== m) schedule(p);
-      }
-      mtimes.clear();
-      for (const [p, m] of next) mtimes.set(p, m);
-    }, interval);
-    return () => {
-      clearInterval(tick);
+    });
+    child.on("error", () => {
       if (timer) clearTimeout(timer);
-    };
-  }
-  let watcher;
-  try {
-    watcher = fsWatch(root, { recursive: true }, (_event, filename) => {
-      if (filename) schedule(filename.toString());
+      resolve2({
+        code: 127,
+        stdout,
+        stderr: stderr || `failed to spawn ${cmd}`,
+        durationMs: Math.round(performance.now() - start),
+        timedOut
+      });
     });
-  } catch {
-    throw new Error(
-      "recursive fs.watch is unavailable on this platform; rerun with --poll"
-    );
-  }
-  return () => {
-    if (timer) clearTimeout(timer);
-    watcher.close();
-  };
-}
-function scanMtimes(root) {
-  const out = /* @__PURE__ */ new Map();
-  const walk = (dir) => {
-    let entries;
-    try {
-      entries = readdirSync4(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      const abs = join10(dir, name);
-      const rel = relative5(root, abs);
-      if (IGNORE2.test(rel)) continue;
-      let st;
-      try {
-        st = statSync3(abs);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) walk(abs);
-      else out.set(rel, st.mtimeMs);
-    }
-  };
-  walk(root);
-  return out;
+  });
 }
-var IGNORE2;
-var init_watcher = __esm({
-  "src/watch/watcher.ts"() {
-    "use strict";
-    IGNORE2 = /(^|\/)(\.git|\.veris|\.agentloop|\.agentflight|node_modules|dist)(\/|$)/;
-  }
-});
 
-// src/cli/commands/watch.ts
-var watch_exports = {};
-__export(watch_exports, {
-  buildWatchResults: () => buildWatchResults,
-  runWatch: () => runWatch
-});
-function buildWatchResults(project, affected, fresh, cache) {
-  const affectedSet = new Set(affected);
-  const freshById = new Map(fresh.map((r) => [r.checkId, r]));
-  const out = [];
-  for (const cap of project.capabilities) {
-    if (!cap.available || cap.id === "browser") continue;
-    const f = freshById.get(cap.id);
-    if (f) {
-      out.push({ ...f, cached: false });
-      continue;
-    }
-    const c = cache.get(cap.id);
-    if (c && !affectedSet.has(cap.id)) {
-      out.push({ ...c, cached: true });
-      continue;
-    }
-    out.push({
-      checkId: cap.id,
-      status: "skipped",
-      durationMs: 0,
-      summary: "not affected by changes"
-    });
+// src/git/changes.ts
+function collect(set, out) {
+  for (const line of out.split("\n")) {
+    const f = line.trim();
+    if (f) set.add(f);
   }
-  return out;
 }
-async function runWatch(root, opts = {}) {
-  const cache = /* @__PURE__ */ new Map();
-  let running = false;
-  const availableIds = (project) => project.capabilities.filter((c) => c.available && c.id !== "browser").map((c) => c.id);
-  const tick = async (initial) => {
-    if (running) return;
-    running = true;
-    try {
-      const project = await detectProject(root);
-      const { files } = await changedFiles(root);
-      const checks = initial ? availableIds(project) : affectedChecks(files, project).checks;
-      let targetFiles;
-      let narrowedNote = "";
-      const unitRunner = project.capabilities.find(
-        (c) => c.id === "unit"
-      )?.runner;
-      const canNarrow = unitRunner === "vitest" || unitRunner === "jest";
-      if (!initial && checks.includes("unit") && canNarrow) {
-        const { buildGraph: buildGraph2 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
-        const { selectAffectedTests: selectAffectedTests2 } = await Promise.resolve().then(() => (init_select(), select_exports));
-        const graph = await buildGraph2(project);
-        const sel = selectAffectedTests2(graph, files);
-        if (sel.mode === "graph") {
-          targetFiles = { unit: sel.testFiles };
-          narrowedNote = `unit narrowed to ${sel.testFiles.length} of ${graph.testFiles.length} test file(s) via ${graph.resolver} graph`;
-        } else {
-          narrowedNote = `unit ran in full \u2014 ${sel.reason}`;
-        }
-      } else if (!initial && checks.includes("unit") && unitRunner) {
-        narrowedNote = `unit ran in full \u2014 the ${unitRunner} runner does not support file filtering`;
-      }
-      let fresh = [];
-      if (checks.length) {
-        const r = await runChecks(project, checks, root, { targetFiles });
-        fresh = r.results;
-        for (const result of fresh) cache.set(result.checkId, { ...result });
-      }
-      const results = buildWatchResults(project, checks, fresh, cache);
-      const availableCaps = project.capabilities.filter(
-        (c) => c.available && c.id !== "browser"
-      );
-      const verdict = computeVerdict(results, availableCaps);
-      const run = {
-        id: "watch",
-        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        project,
-        results,
-        verdict,
-        env: {
-          os: process.platform,
-          node: process.version,
-          pm: project.packageManager,
-          ci: false,
-          timestamp: (/* @__PURE__ */ new Date()).toISOString()
-        },
-        scope: { kind: "watch", changedCount: files.length }
-      };
-      process.stdout.write(`${renderRun(run)}
-`);
-      if (narrowedNote) process.stdout.write(`${narrowedNote}
-`);
-    } finally {
-      running = false;
-    }
-  };
-  process.stdout.write("veris watch \u2014 press Ctrl-C to stop\n");
-  await tick(true);
-  return await new Promise((resolve2) => {
-    let stop;
-    try {
-      stop = watch(root, { poll: opts.poll }, () => {
-        void tick(false);
-      });
-    } catch (err) {
-      process.stderr.write(
-        `veris: ${err instanceof Error ? err.message : String(err)}
-`
-      );
-      resolve2(1);
-      return;
-    }
-    process.on("SIGINT", () => {
-      stop();
-      process.stdout.write("\nStopped.\n");
-      resolve2(0);
-    });
+async function changedFiles(root, opts = {}) {
+  const base = opts.base ?? null;
+  const files = /* @__PURE__ */ new Set();
+  const diffArgs = base ? ["diff", "--name-only", base] : ["diff", "--name-only", "HEAD"];
+  const diff = await exec("git", diffArgs, { cwd: root });
+  if (diff.code === 0) collect(files, diff.stdout);
+  const untracked = await exec(
+    "git",
+    ["ls-files", "--others", "--exclude-standard"],
+    { cwd: root }
+  );
+  if (untracked.code === 0) collect(files, untracked.stdout);
+  return { files: [...files].sort(), base };
+}
+async function gitAnchor(root) {
+  const head = await exec("git", ["rev-parse", "HEAD"], { cwd: root });
+  if (head.code !== 0) return null;
+  const commit = head.stdout.trim();
+  const branchRes = await exec("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    cwd: root
   });
+  const branch = branchRes.code === 0 ? branchRes.stdout.trim() : "HEAD";
+  const status = await exec("git", ["status", "--porcelain"], { cwd: root });
+  const lines = status.code === 0 ? status.stdout.split("\n").map((l) => l.trim()).filter(Boolean) : [];
+  return {
+    commit,
+    branch,
+    dirty: lines.length > 0,
+    changedFiles: lines.length
+  };
 }
-var init_watch = __esm({
-  "src/cli/commands/watch.ts"() {
-    "use strict";
-    init_gate();
-    init_detect();
-    init_orchestrator();
-    init_verdict();
-    init_changes();
-    init_terminal();
-    init_watcher();
-  }
-});
 
-// src/cli/commands/scan.ts
-var scan_exports = {};
-__export(scan_exports, {
-  renderScan: () => renderScan,
-  runScan: () => runScan
-});
-import { writeFile as writeFile3 } from "fs/promises";
-import { join as join11 } from "path";
-import pc3 from "picocolors";
-function renderScan(graph, analysis) {
-  const plain = isPlain();
-  const bold = (s) => plain ? s : pc3.bold(s);
-  const dim = (s) => plain ? s : pc3.dim(s);
-  const warn = (s) => plain ? s : pc3.yellow(s);
+// src/reporters/markdown.ts
+import { relative } from "path";
+var STATE_LABEL = {
+  verified: "Verified",
+  failed: "Failed",
+  partial: "Partial"
+};
+function cell(value) {
+  return value.replace(/\|/g, "\\|");
+}
+function renderMarkdown(run, record) {
+  const root = run.project.root;
   const lines = [];
-  lines.push(bold("VerisKit \u2014 scan"));
-  lines.push("");
-  lines.push(
-    `Resolver    ${graph.resolver}${graph.resolver === "scanner" ? dim("  (no TypeScript found \u2014 relative imports only)") : ""}`
-  );
-  lines.push(
-    `Modules     ${Object.keys(graph.nodes).length}   \xB7  Source ${graph.sourceFiles.length}  \xB7  Tests ${graph.testFiles.length}`
-  );
-  lines.push("");
-  lines.push("Untested (top by impact)");
-  const top = analysis.untested.slice(0, 10);
-  if (top.length === 0)
-    lines.push(dim("  none \u2014 every source file is reached by a test"));
-  for (const f of top) {
+  lines.push("# VerisKit Verification Report");
+  if (run.scope?.kind) {
+    lines.push("");
     lines.push(
-      `  ${warn("!")} ${f}   ${dim(`${analysis.blastRadius[f] ?? 0} dependents`)}`
+      `> **Scope:** ${run.scope.kind} \u2014 ${run.scope.changedCount} changed file(s). Only affected checks ran; this is not a full verification.`
     );
   }
-  return lines.join("\n");
-}
-async function runScan(root) {
-  const project = await detectProject(root);
-  const graph = await buildGraph(project);
-  const analysis = analyze(graph);
-  const dir = join11(root, ".veris");
-  await ensureDir(dir);
-  await writeFile3(
-    join11(dir, "graph.json"),
-    JSON.stringify({ resolver: graph.resolver, nodes: graph.nodes }, null, 2),
-    "utf8"
+  lines.push("");
+  lines.push(`**Verdict:** ${STATE_LABEL[run.verdict.state]}`);
+  lines.push(`**When:** ${run.startedAt}`);
+  lines.push(
+    `**Node:** ${run.env.node} \xB7 **OS:** ${run.env.os} \xB7 **PM:** ${run.env.pm} \xB7 **CI:** ${run.env.ci}`
   );
-  process.stdout.write(`${renderScan(graph, analysis)}
-`);
-  process.stdout.write(`
-Graph        ${join11(".veris", "graph.json")}
-`);
-  return 0;
-}
-var init_scan = __esm({
-  "src/cli/commands/scan.ts"() {
-    "use strict";
-    init_detect();
-    init_analyze();
-    init_graph();
-    init_fs_safe();
-    init_tty();
+  if (record?.git) {
+    const g = record.git;
+    const tree = g.dirty ? `tree dirty, ${g.changedFiles} uncommitted file(s)` : "tree clean";
+    lines.push(`**Commit:** ${g.commit.slice(0, 7)} (${g.branch}) \xB7 ${tree}`);
+  } else if (record) {
+    lines.push("**Commit:** no git anchor available");
   }
-});
-
-// src/cli/commands/plan.ts
-var plan_exports = {};
-__export(plan_exports, {
-  renderPlan: () => renderPlan,
-  runPlan: () => runPlan
-});
-import pc4 from "picocolors";
-function renderPlan(project, graph, analysis, changed) {
-  const plain = isPlain();
-  const bold = (s) => plain ? s : pc4.bold(s);
-  const dim = (s) => plain ? s : pc4.dim(s);
-  const warn = (s) => plain ? s : pc4.yellow(s);
-  const lines = [];
-  lines.push(bold("VerisKit \u2014 plan"));
-  lines.push(dim(`(graph via ${graph.resolver})`));
   lines.push("");
-  lines.push("Test these first (high impact, untested)");
-  const top = analysis.untested.slice(0, 5);
-  if (top.length === 0)
-    lines.push(
-      dim(
-        "  none \u2014 untested files have no dependents or all files are covered"
-      )
-    );
-  top.forEach((f, i) => {
-    lines.push(
-      `  ${i + 1}. ${f}   ${dim(`(${analysis.blastRadius[f] ?? 0} dependents, no test reaches it)`)}`
-    );
-  });
+  lines.push("## Checks");
   lines.push("");
-  lines.push("Verification setup");
-  const weak = project.capabilities.filter(
-    (c) => !c.available && c.id !== "browser"
-  );
-  if (weak.length === 0)
-    lines.push(dim("  \u2713 types, lint, and unit are all configured"));
-  for (const c of weak)
+  lines.push("| Check | Status | Duration | Summary | Log |");
+  lines.push("| --- | --- | --- | --- | --- |");
+  for (const r of run.results) {
+    const dur = r.durationMs ? `${(r.durationMs / 1e3).toFixed(1)}s` : "\u2014";
+    const log = r.logRef ? cell(relative(root, r.logRef)) : "\u2014";
     lines.push(
-      `  ${warn("\u26A0")} ${c.id} capability unavailable \u2014 ${c.reason ?? "not configured"}`
+      `| ${r.checkId} | ${r.status} | ${dur} | ${cell(r.summary)} | ${log} |`
     );
-  if (changed.length) {
-    lines.push("");
-    lines.push(`Risky changes (${changed.length} changed file(s))`);
-    if (analysis.risky.length === 0) lines.push(dim("  none flagged"));
-    for (const f of analysis.risky.slice(0, 8)) {
-      const untested = analysis.untested.includes(f) ? ", untested" : "";
-      lines.push(
-        `  ${warn("!")} ${f}   ${dim(`${analysis.blastRadius[f] ?? 0} dependents${untested}`)}`
-      );
-    }
   }
-  lines.push("");
-  lines.push(
-    dim("Next: `veris affected` runs only the tests that reach your changes.")
-  );
-  return lines.join("\n");
-}
-async function runPlan(root, opts = {}) {
-  const project = await detectProject(root);
-  const graph = await buildGraph(project);
-  const { files } = await changedFiles(root, { base: opts.base });
-  const analysis = analyze(graph, files);
-  process.stdout.write(`${renderPlan(project, graph, analysis, files)}
-`);
-  return 0;
-}
-var init_plan = __esm({
-  "src/cli/commands/plan.ts"() {
-    "use strict";
-    init_detect();
-    init_changes();
-    init_analyze();
-    init_graph();
-    init_tty();
+  if (run.verdict.skipped.length) {
+    lines.push("");
+    lines.push("## Skipped");
+    lines.push("");
+    for (const reason of run.verdict.reasons) lines.push(`- ${reason}`);
   }
-});
-
-// src/evidence/signing.ts
-import {
-  createHash as createHash2,
-  createPrivateKey,
-  createPublicKey,
-  sign as cryptoSign,
-  verify as cryptoVerify,
-  generateKeyPairSync
-} from "crypto";
-function derOf(publicKey) {
-  return publicKey.export({ type: "spki", format: "der" });
-}
-function keyId(publicKey) {
-  const key = typeof publicKey === "string" ? createPublicKey(publicKey) : publicKey;
-  return createHash2("sha256").update(derOf(key)).digest("hex").slice(0, 8);
-}
-function signatureKeyId(sig) {
-  const key = createPublicKey({
-    key: Buffer.from(sig.publicKey, "base64"),
-    format: "der",
-    type: "spki"
-  });
-  return keyId(key);
-}
-function generateKeyPair() {
-  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
-  return {
-    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }),
-    privateKeyPem: privateKey.export({
-      type: "pkcs8",
-      format: "pem"
-    }),
-    keyId: keyId(publicKey)
-  };
-}
-function signDigest(digest, privateKeyPem) {
-  const privateKey = createPrivateKey(privateKeyPem);
-  const publicKey = createPublicKey(
-    privateKey
-  );
-  const sig = cryptoSign(null, Buffer.from(digest, "utf8"), privateKey);
-  return {
-    schema: SIGNATURE_SCHEMA,
-    alg: "ed25519",
-    keyId: keyId(publicKey),
-    publicKey: derOf(publicKey).toString("base64"),
-    digest,
-    signature: sig.toString("base64"),
-    signedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function verifySignature(sig) {
-  try {
-    const publicKey = createPublicKey({
-      key: Buffer.from(sig.publicKey, "base64"),
-      format: "der",
-      type: "spki"
-    });
-    return cryptoVerify(
-      null,
-      Buffer.from(sig.digest, "utf8"),
-      publicKey,
-      Buffer.from(sig.signature, "base64")
+  const failures = run.results.filter((r) => r.outputTail);
+  if (failures.length) {
+    lines.push("");
+    lines.push("## Failure output");
+    for (const r of failures) {
+      lines.push("");
+      lines.push(`### ${r.checkId}`);
+      lines.push("");
+      lines.push("```");
+      lines.push(r.outputTail ?? "");
+      lines.push("```");
+    }
+  }
+  if (record) {
+    lines.push("");
+    lines.push(`**Evidence digest:** \`${record.digest}\``);
+    lines.push(
+      "_Integrity digest over the canonical record. Detects edits and corruption; it is not forgery-proof on its own. Publish the digest separately or sign it to prove authorship._"
     );
-  } catch {
-    return false;
   }
+  lines.push("");
+  lines.push(
+    "_Generated by VerisKit. A `Partial` verdict means one or more capabilities did not run \u2014 it is not a pass._"
+  );
+  lines.push("");
+  return lines.join("\n");
 }
-var SIGNATURE_SCHEMA;
-var init_signing = __esm({
-  "src/evidence/signing.ts"() {
-    "use strict";
-    SIGNATURE_SCHEMA = "veriskit/signature@1";
-  }
-});
 
-// src/evidence/verify-evidence.ts
-import { existsSync as existsSync5 } from "fs";
-import { readFile as readFile3 } from "fs/promises";
-function verifyRecord(record) {
-  const recomputed = computeDigest(
-    record
-  );
-  const ok = recomputed === record.digest;
-  const checks = [
-    {
-      name: "record digest",
-      ok,
-      detail: ok ? "matches the canonical record" : `recomputed ${recomputed}, record claims ${record.digest}`
-    }
-  ];
-  return { ok, kind: "record", record, checks, signed: false };
+// src/version.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+var pkgUrl = new URL("../package.json", import.meta.url);
+var VERSION = JSON.parse(
+  readFileSync(fileURLToPath(pkgUrl), "utf8")
+).version;
+
+// src/runners/base.ts
+import { join as join4 } from "path";
+function localBin(root, name) {
+  return join4(root, "node_modules", ".bin", name);
 }
-function signatureChecks(recordDigest, sig, opts = {}) {
-  const checks = [];
-  const kid = signatureKeyId(sig);
-  const validSig = verifySignature(sig) && sig.digest === recordDigest;
-  checks.push({
-    name: "signature",
-    ok: validSig,
-    detail: validSig ? `valid ed25519 signature by key ${kid}` : "signature does not match this record"
+var TAIL_LINES = 20;
+async function runViaExec(check, ctx, opts) {
+  const r = await exec(check.cmd, check.args, {
+    cwd: ctx.root,
+    timeoutMs: opts.timeoutMs
   });
-  if (opts.expectedKeyId || opts.expectedPubKeyPem) {
-    let matches = false;
-    if (opts.expectedPubKeyPem) {
-      try {
-        matches = keyId(opts.expectedPubKeyPem) === kid;
-      } catch {
-        matches = false;
-      }
-    } else if (opts.expectedKeyId) {
-      matches = opts.expectedKeyId.toLowerCase() === kid.toLowerCase();
-    }
-    checks.push({
-      name: "signer",
-      ok: matches,
-      detail: matches ? `signer matches the expected key ${kid}` : `signer ${kid} does not match the expected key`
-    });
-  }
-  return checks;
-}
-async function verifyEvidenceFile(path, opts = {}) {
-  const parsed = JSON.parse(await readFile3(path, "utf8"));
-  if (parsed?.schema === "veriskit/bundle@1") {
-    const { verifyBundle: verifyBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
-    return verifyBundle2(parsed, opts);
-  }
-  const result = verifyRecord(parsed);
-  const assertedSigner = Boolean(
-    opts.expectedKeyId || opts.expectedPubKeyPem || opts.sigPath
-  );
-  const sigPath = opts.sigPath ?? `${path}.sig`;
-  if (existsSync5(sigPath)) {
-    const sig = JSON.parse(await readFile3(sigPath, "utf8"));
-    result.checks.push(
-      ...signatureChecks(result.record.digest, sig, {
-        expectedKeyId: opts.expectedKeyId,
-        expectedPubKeyPem: opts.expectedPubKeyPem
-      })
-    );
-    result.signed = true;
-  } else if (assertedSigner) {
-    result.checks.push({
-      name: "signature",
-      ok: false,
-      detail: "a signature was required (--pubkey/--key-id/--sig) but none was found"
-    });
+  const status = r.code === 0 ? "passed" : r.timedOut ? "unknown" : "failed";
+  const output = [r.stdout, r.stderr].filter(Boolean).join("\n").trim();
+  const logRef = await writeLog(ctx.runDir, check.id, `${output}
+`);
+  const result = {
+    checkId: check.id,
+    status,
+    durationMs: r.durationMs,
+    summary: status === "passed" ? opts.pass : r.timedOut ? "timed out" : opts.fail,
+    logRef
+  };
+  if (status !== "passed" && output) {
+    result.outputTail = output.split("\n").slice(-TAIL_LINES).join("\n");
   }
-  result.ok = result.checks.every((c) => c.ok);
   return result;
 }
-var init_verify_evidence = __esm({
-  "src/evidence/verify-evidence.ts"() {
-    "use strict";
-    init_record();
-    init_signing();
+
+// src/runners/biome.ts
+var biomeRunner = {
+  id: "biome",
+  toCheck(project, _cap) {
+    return {
+      id: "lint",
+      title: "Lint",
+      runner: "biome",
+      cmd: localBin(project.root, "biome"),
+      args: ["check", "."]
+    };
+  },
+  run(check, ctx) {
+    return runViaExec(check, ctx, {
+      pass: "no lint errors",
+      fail: "lint errors found",
+      timeoutMs: 3 * 6e4
+    });
   }
-});
+};
 
-// src/evidence/bundle.ts
-var bundle_exports = {};
-__export(bundle_exports, {
-  BUNDLE_SCHEMA: () => BUNDLE_SCHEMA,
-  buildBundle: () => buildBundle,
-  verifyBundle: () => verifyBundle
-});
-function buildBundle(record, report, logs, signature) {
-  const manifest = {
-    record: record.digest,
-    report: sha256(report),
-    logs: Object.fromEntries(
-      Object.entries(logs).map(([k, v]) => [k, sha256(v)])
-    )
-  };
-  const base = signature ? { schema: BUNDLE_SCHEMA, record, report, logs, manifest, signature } : { schema: BUNDLE_SCHEMA, record, report, logs, manifest };
-  return { ...base, bundleDigest: sha256(canonicalize(base)) };
-}
-function verifyBundle(bundle, opts = {}) {
-  const checks = [];
-  const recordResult = verifyRecord(bundle.record);
-  checks.push(...recordResult.checks);
-  const reportDigest = sha256(bundle.report);
-  checks.push({
-    name: "report",
-    ok: reportDigest === bundle.manifest.report,
-    detail: reportDigest === bundle.manifest.report ? "matches manifest" : "mismatch"
-  });
-  for (const [id, body] of Object.entries(bundle.logs)) {
-    const d = sha256(body);
-    checks.push({
-      name: `log:${id}`,
-      ok: d === bundle.manifest.logs[id],
-      detail: d === bundle.manifest.logs[id] ? "matches manifest" : "mismatch"
+// src/runners/eslint.ts
+var eslintRunner = {
+  id: "eslint",
+  toCheck(project, _cap) {
+    return {
+      id: "lint",
+      title: "Lint",
+      runner: "eslint",
+      cmd: localBin(project.root, "eslint"),
+      args: ["."]
+    };
+  },
+  run(check, ctx) {
+    return runViaExec(check, ctx, {
+      pass: "no lint errors",
+      fail: "lint errors found",
+      timeoutMs: 3 * 6e4
     });
   }
-  const { bundleDigest: _omit, ...rest } = bundle;
-  const recomputed = sha256(canonicalize(rest));
-  checks.push({
-    name: "bundle digest",
-    ok: recomputed === bundle.bundleDigest,
-    detail: recomputed === bundle.bundleDigest ? "matches" : "mismatch"
-  });
-  let signed = false;
-  if (bundle.signature) {
-    signed = true;
-    checks.push(
-      ...signatureChecks(bundle.record.digest, bundle.signature, {
-        expectedKeyId: opts.expectedKeyId,
-        expectedPubKeyPem: opts.expectedPubKeyPem
-      })
-    );
-  } else if (opts.expectedKeyId || opts.expectedPubKeyPem) {
-    checks.push({
-      name: "signature",
-      ok: false,
-      detail: "a signature was required (--pubkey/--key-id) but the bundle is unsigned"
+};
+
+// src/runners/jest.ts
+var jestRunner = {
+  id: "jest",
+  toCheck(project, _cap, opts) {
+    return {
+      id: "unit",
+      title: "Unit tests",
+      runner: "jest",
+      cmd: localBin(project.root, "jest"),
+      args: ["--ci", ...opts?.targetFiles ?? []]
+    };
+  },
+  run(check, ctx) {
+    return runViaExec(check, ctx, {
+      pass: "unit tests passed",
+      fail: "unit tests failed",
+      timeoutMs: 10 * 6e4
     });
   }
-  return {
-    ok: checks.every((c) => c.ok),
-    kind: "bundle",
-    record: bundle.record,
-    checks,
-    signed
-  };
-}
-var BUNDLE_SCHEMA;
-var init_bundle = __esm({
-  "src/evidence/bundle.ts"() {
-    "use strict";
-    init_record();
-    init_verify_evidence();
-    BUNDLE_SCHEMA = "veriskit/bundle@1";
+};
+
+// src/runners/node-test.ts
+var nodeTestRunner = {
+  id: "node-test",
+  toCheck(_project, _cap) {
+    return {
+      id: "unit",
+      title: "Unit tests",
+      runner: "node-test",
+      cmd: process.execPath,
+      args: ["--test"]
+    };
+  },
+  run(check, ctx) {
+    return runViaExec(check, ctx, {
+      pass: "unit tests passed",
+      fail: "unit tests failed",
+      timeoutMs: 10 * 6e4
+    });
   }
-});
+};
 
-// src/cli/commands/evidence.ts
-var evidence_exports = {};
-__export(evidence_exports, {
-  runEvidenceBundle: () => runEvidenceBundle,
-  runEvidenceKeygen: () => runEvidenceKeygen,
-  runEvidenceShow: () => runEvidenceShow,
-  runEvidenceSign: () => runEvidenceSign,
-  runEvidenceVerify: () => runEvidenceVerify
-});
-import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync } from "fs";
-import { writeFile as writeFile4 } from "fs/promises";
-import { basename as basename3, dirname as dirname2, join as join12 } from "path";
-import pc5 from "picocolors";
-async function runEvidenceVerify(path, opts = {}) {
-  let expectedPubKeyPem;
-  if (opts.pubkey) {
-    try {
-      expectedPubKeyPem = readFileSync6(opts.pubkey, "utf8");
-    } catch {
-      process.stderr.write(`veris: cannot read public key at ${opts.pubkey}
+// src/runners/playwright.ts
+function parsePlaywrightStats(stdout) {
+  try {
+    const json = JSON.parse(stdout);
+    return json.stats ?? null;
+  } catch {
+    return null;
+  }
+}
+var TAIL_LINES2 = 20;
+var playwrightRunner = {
+  id: "playwright",
+  toCheck(project, _cap) {
+    return {
+      id: "browser",
+      title: "Browser tests",
+      runner: "playwright",
+      cmd: localBin(project.root, "playwright"),
+      args: ["test", "--reporter=json"]
+    };
+  },
+  async run(check, ctx) {
+    const r = await exec(check.cmd, check.args, {
+      cwd: ctx.root,
+      timeoutMs: 15 * 6e4
+    });
+    const output = [r.stdout, r.stderr].filter(Boolean).join("\n").trim();
+    const logRef = await writeLog(ctx.runDir, check.id, `${output}
 `);
-      return 1;
+    const stats = parsePlaywrightStats(r.stdout);
+    let status;
+    if (r.timedOut) {
+      status = "unknown";
+    } else if (stats) {
+      status = r.code === 0 && (stats.unexpected ?? 0) === 0 ? "passed" : "failed";
+    } else {
+      status = r.code === 0 ? "unknown" : "failed";
+    }
+    const result = {
+      checkId: "browser",
+      status,
+      durationMs: r.durationMs,
+      summary: status === "passed" ? "browser tests passed" : r.timedOut ? "timed out" : status === "unknown" ? "browser tests ran but the results could not be parsed" : "browser tests failed",
+      logRef
+    };
+    if (stats) {
+      const passed = stats.expected ?? 0;
+      const failed = stats.unexpected ?? 0;
+      result.counts = {
+        passed,
+        failed,
+        total: passed + failed + (stats.flaky ?? 0) + (stats.skipped ?? 0)
+      };
     }
+    if (status !== "passed" && output) {
+      result.outputTail = output.split("\n").slice(-TAIL_LINES2).join("\n");
+    }
+    return result;
   }
-  let result;
-  try {
-    result = await verifyEvidenceFile(path, {
-      sigPath: opts.sig,
-      expectedKeyId: opts.keyId,
-      expectedPubKeyPem
+};
+
+// src/runners/tsc.ts
+var tscRunner = {
+  id: "tsc",
+  toCheck(project, _cap) {
+    return {
+      id: "types",
+      title: "Types",
+      runner: "tsc",
+      cmd: localBin(project.root, "tsc"),
+      args: ["--noEmit", "--pretty", "false"]
+    };
+  },
+  run(check, ctx) {
+    return runViaExec(check, ctx, {
+      pass: "no type errors",
+      fail: "type errors found",
+      timeoutMs: 5 * 6e4
+    });
+  }
+};
+
+// src/runners/vitest.ts
+var vitestRunner = {
+  id: "vitest",
+  toCheck(project, _cap, opts) {
+    const files = opts?.targetFiles ?? [];
+    return {
+      id: "unit",
+      title: "Unit tests",
+      runner: "vitest",
+      cmd: localBin(project.root, "vitest"),
+      args: ["run", "--reporter=json", ...files]
+    };
+  },
+  run(check, ctx) {
+    return runViaExec(check, ctx, {
+      pass: "unit tests passed",
+      fail: "unit tests failed",
+      timeoutMs: 10 * 6e4
     });
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`veris: cannot read evidence at ${path}: ${msg}
-`);
-    return 1;
-  }
-  const plain = isPlain();
-  const mark = (ok) => plain ? ok ? "ok" : "FAIL" : ok ? pc5.green("\u2713") : pc5.red("\u2717");
-  for (const check of result.checks) {
-    process.stdout.write(
-      `  ${mark(check.ok)} ${check.name}: ${check.detail}
-`
-    );
-  }
-  const g = result.record.git;
-  const anchor = g ? `commit ${g.commit.slice(0, 7)} \xB7 ${g.dirty ? "tree dirty" : "tree clean"}` : "no git anchor";
-  process.stdout.write(
-    `
-${result.ok ? "digest OK" : "TAMPERED"} \xB7 verdict ${result.record.verdict.state} \xB7 ${anchor}
-`
-  );
-  process.stdout.write(`
-${HONESTY}
-`);
-  if (result.signed && !opts.pubkey && !opts.keyId) {
-    process.stdout.write(
-      "\nThis record is signed. Confirm you trust the signing key by comparing its\nkey id above to one you already trust, or re-run with --pubkey / --key-id.\n"
-    );
   }
-  return result.ok ? 0 : 1;
+};
+
+// src/runners/index.ts
+var runners = {
+  tsc: tscRunner,
+  vitest: vitestRunner,
+  jest: jestRunner,
+  "node-test": nodeTestRunner,
+  eslint: eslintRunner,
+  biome: biomeRunner,
+  playwright: playwrightRunner
+};
+
+// src/util/env.ts
+import { platform } from "os";
+function detectCI() {
+  return process.env.CI === "true" || process.env.CI === "1";
 }
-async function runEvidenceKeygen(root, opts = {}) {
-  const out = opts.out ?? join12(root, ".veris", "keys", "veriskit-signing.key");
-  const pub = `${out}.pub`;
-  if (existsSync6(out) || existsSync6(pub)) {
-    process.stderr.write(
-      `veris: a key already exists at ${out}. Refusing to overwrite it.
-`
-    );
-    return 1;
-  }
-  const { mkdir: mkdir3 } = await import("fs/promises");
-  await mkdir3(dirname2(out), { recursive: true });
-  const kp = generateKeyPair();
-  writeFileSync(out, kp.privateKeyPem, { mode: 384 });
-  chmodSync(out, 384);
-  writeFileSync(pub, kp.publicKeyPem, "utf8");
-  process.stdout.write(
-    [
-      `Wrote signing key ${out} (keep this secret; do not commit it)`,
-      `Wrote public key ${pub}`,
-      `Key id ${kp.keyId}`,
-      ""
-    ].join("\n")
-  );
-  return 0;
+function getEnvironmentInfo(pm) {
+  return {
+    os: platform(),
+    node: process.version,
+    pm,
+    ci: detectCI(),
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
 }
-async function runEvidenceSign(evidencePath, opts = {}) {
-  let privateKeyPem;
-  if (process.env.VERISKIT_SIGNING_KEY) {
-    privateKeyPem = process.env.VERISKIT_SIGNING_KEY;
-  } else if (opts.key) {
-    try {
-      privateKeyPem = readFileSync6(opts.key, "utf8");
-    } catch {
-      process.stderr.write(`veris: cannot read signing key at ${opts.key}
-`);
-      return 1;
+
+// src/core/verdict.ts
+function computeVerdict(results, capabilities) {
+  const reasons = [];
+  const skipped = [];
+  const verifiedCapabilities = [];
+  const anyFailed = results.some((r) => r.status === "failed");
+  for (const cap of capabilities) {
+    const result = results.find((r) => r.checkId === cap.id);
+    if (!cap.available) {
+      skipped.push(cap.id);
+      reasons.push(`${cap.id} skipped \u2014 ${cap.reason ?? "not configured"}`);
+      continue;
     }
-  } else {
-    process.stderr.write(
-      "veris: no signing key. Pass --key <path> or set VERISKIT_SIGNING_KEY.\n"
-    );
-    return 1;
-  }
-  let record;
-  try {
-    record = JSON.parse(readFileSync6(evidencePath, "utf8"));
-  } catch {
-    process.stderr.write(`veris: cannot read evidence at ${evidencePath}
-`);
-    return 1;
+    if (result?.status === "passed") {
+      verifiedCapabilities.push(cap.id);
+      continue;
+    }
+    if (result?.status === "failed") {
+      reasons.push(`${cap.id} failed \u2014 ${result.summary}`);
+      continue;
+    }
+    skipped.push(cap.id);
+    reasons.push(`${cap.id} skipped \u2014 ${result?.summary ?? "did not run"}`);
   }
-  const recomputed = computeDigest(
-    record
-  );
-  if (recomputed !== record.digest) {
-    process.stderr.write(
-      "veris: refusing to sign, the record digest does not match its contents.\n"
-    );
-    return 1;
+  let state;
+  if (anyFailed) state = "failed";
+  else if (skipped.length > 0) state = "partial";
+  else state = "verified";
+  return { state, verifiedCapabilities, skipped, reasons };
+}
+
+// src/core/orchestrator.ts
+async function runChecks(project, ids, root, opts = {}) {
+  const known = new Set(project.capabilities.map((c) => c.id));
+  const unknown = ids.filter((id2) => !known.has(id2));
+  if (unknown.length > 0) {
+    throw new Error(`Unknown check id(s): ${unknown.join(", ")}`);
   }
-  let sig;
-  try {
-    sig = signDigest(record.digest, privateKeyPem);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`veris: signing failed: ${msg}
-`);
-    return 1;
+  const id = newRunId();
+  const runDir = await createRunDir(root, id);
+  const ctx = { root, runDir };
+  const tasks = ids.map(async (capId) => {
+    const cap = project.capabilities.find((c) => c.id === capId);
+    const runner = cap?.runner ? runners[cap.runner] : void 0;
+    if (!cap?.available || !runner) {
+      const summary = !cap?.available ? cap?.reason ?? "not configured" : `no runner registered for ${cap.runner}`;
+      return {
+        checkId: capId,
+        status: "skipped",
+        durationMs: 0,
+        summary
+      };
+    }
+    const check = runner.toCheck(project, cap, {
+      targetFiles: opts.targetFiles?.[capId]
+    });
+    return runner.run(check, ctx);
+  });
+  const results = await Promise.all(tasks);
+  const requested = project.capabilities.filter((c) => ids.includes(c.id));
+  const verdict = computeVerdict(results, requested);
+  return {
+    id,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    project,
+    results,
+    verdict,
+    env: getEnvironmentInfo(project.packageManager)
+  };
+}
+
+// src/core/orchestrate.ts
+var DEFAULT_CHECKS = ["types", "lint", "unit"];
+function resolveChecks(configChecks, project, opts) {
+  let checks = configChecks?.length ? configChecks : DEFAULT_CHECKS;
+  if (opts.browser && !checks.includes("browser")) {
+    const cap = project.capabilities.find((c) => c.id === "browser");
+    if (cap?.available) checks = [...checks, "browser"];
   }
-  const out = opts.out ?? `${evidencePath}.sig`;
-  writeFileSync(out, `${JSON.stringify(sig, null, 2)}
-`, "utf8");
-  process.stdout.write(
-    `Signed ${evidencePath}
-Wrote ${out} (key ${sig.keyId})
-`
+  return checks;
+}
+async function verifyProject(root, opts = {}) {
+  const project = await detectProject(root);
+  const config = await loadConfig(root);
+  const checks = resolveChecks(config?.checks, project, opts);
+  const run = await runChecks(project, checks, root);
+  const git = await gitAnchor(root);
+  const logDigests = await digestLogs(run);
+  const record = buildRecord(run, git, logDigests, VERSION);
+  const reportRef = await writeReport(
+    root,
+    run.id,
+    renderMarkdown(run, record)
   );
-  return 0;
+  run.reportRef = reportRef;
+  const runDir = await createRunDir(root, run.id);
+  await writeEvidence(runDir, record);
+  return { run, record };
 }
-async function runEvidenceBundle(root, opts = {}) {
-  const runDir = latestRunDir(root);
-  if (!runDir) {
-    process.stdout.write("No evidence yet. Run `veris verify` first.\n");
-    return 1;
-  }
-  let record;
-  try {
-    record = JSON.parse(
-      readFileSync6(join12(runDir, "evidence.json"), "utf8")
-    );
-  } catch {
-    process.stderr.write(`veris: no evidence.json in ${runDir}
-`);
-    return 1;
+async function affectedProject(root, opts = {}) {
+  const project = await detectProject(root);
+  const { files } = await changedFiles(root, { base: opts.base });
+  const plan = affectedChecks(files, project);
+  if (plan.checks.length === 0) {
+    return {
+      note: `Nothing affected \u2014 ${files.length} changed file(s), no checks to run.`,
+      changedCount: files.length,
+      nothingAffected: true
+    };
   }
-  let report = "";
-  try {
-    report = readFileSync6(
-      join12(root, ".veris", "reports", `verify-${record.id}.md`),
-      "utf8"
-    );
-  } catch {
+  let targetFiles;
+  let note = "";
+  const unitRunner = project.capabilities.find((c) => c.id === "unit")?.runner;
+  const canNarrow = unitRunner === "vitest" || unitRunner === "jest";
+  if (plan.checks.includes("unit") && canNarrow) {
+    const { buildGraph: buildGraph2 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
+    const { selectAffectedTests: selectAffectedTests2 } = await Promise.resolve().then(() => (init_select(), select_exports));
+    const graph = await buildGraph2(project);
+    const sel = selectAffectedTests2(graph, files);
+    if (sel.mode === "graph") {
+      targetFiles = { unit: sel.testFiles };
+      note = `unit narrowed to ${sel.testFiles.length} of ${graph.testFiles.length} test file(s) via ${graph.resolver} graph`;
+    } else {
+      note = `unit ran in full \u2014 ${sel.reason}`;
+    }
+  } else if (plan.checks.includes("unit") && unitRunner) {
+    note = `unit ran in full \u2014 the ${unitRunner} runner does not support file filtering`;
   }
-  const logIds = record.checks.filter((c) => c.logDigest).map((c) => c.id);
-  const logs = await readRunLogs(runDir, logIds);
-  let signature;
-  const sigPath = join12(runDir, "evidence.json.sig");
-  if (existsSync6(sigPath)) {
-    try {
-      signature = JSON.parse(readFileSync6(sigPath, "utf8"));
-    } catch {
+  const run = await runChecks(project, plan.checks, root, { targetFiles });
+  run.scope = { kind: "affected", changedCount: files.length };
+  const affected = new Set(plan.checks);
+  for (const cap of project.capabilities) {
+    if (cap.available && cap.id !== "browser" && !affected.has(cap.id)) {
+      run.results.push({
+        checkId: cap.id,
+        status: "skipped",
+        durationMs: 0,
+        summary: "not affected by changes"
+      });
     }
   }
-  const bundle = buildBundle(record, report, logs, signature);
-  const outDir = await ensureEvidenceDir(root);
-  const out = opts.out ?? join12(outDir, `${record.id}.bundle.json`);
-  await writeFile4(out, `${JSON.stringify(bundle, null, 2)}
-`, "utf8");
-  process.stdout.write(`Wrote portable evidence bundle: ${out}
-`);
-  return 0;
-}
-async function runEvidenceShow(root, path) {
-  const target = path ?? (() => {
-    const dir = latestRunDir(root);
-    return dir ? join12(dir, "evidence.json") : null;
-  })();
-  if (!target) {
-    process.stdout.write("No evidence yet. Run `veris verify` first.\n");
-    return 0;
-  }
-  let record;
-  try {
-    record = JSON.parse(readFileSync6(target, "utf8"));
-  } catch {
-    process.stderr.write(`veris: cannot read evidence at ${target}
-`);
-    return 1;
-  }
-  const g = record.git;
-  process.stdout.write(
-    [
-      `Evidence   ${basename3(target)}`,
-      `Verdict    ${record.verdict.state}`,
-      `Project    ${record.project.name}`,
-      `Scope      ${record.scope.kind} (${record.scope.changedCount} changed)`,
-      `Commit     ${g ? `${g.commit.slice(0, 7)} (${g.branch}) ${g.dirty ? "\xB7 tree dirty" : "\xB7 tree clean"}` : "no git anchor"}`,
-      `Checks     ${record.checks.map((c) => `${c.id}:${c.status}`).join(", ")}`,
-      `Digest     ${record.digest}`,
-      ""
-    ].join("\n")
+  const git = await gitAnchor(root);
+  const logDigests = await digestLogs(run);
+  const record = buildRecord(run, git, logDigests, VERSION);
+  const reportRef = await writeReport(
+    root,
+    run.id,
+    renderMarkdown(run, record)
   );
-  return 0;
-}
-var HONESTY;
-var init_evidence = __esm({
-  "src/cli/commands/evidence.ts"() {
-    "use strict";
-    init_bundle();
-    init_record();
-    init_signing();
-    init_store();
-    init_verify_evidence();
-    init_tty();
-    HONESTY = "An integrity digest confirms the record was not edited or corrupted since it was written.\nIt is not forgery-proof on its own: publish the digest separately (CI log, PR) or sign it (veris evidence sign) to prove authorship.";
-  }
-});
-
-// src/publish/badge.ts
-function buildBadge(verdict) {
-  const s = STYLE[verdict.state];
+  run.reportRef = reportRef;
+  const runDir = await createRunDir(root, run.id);
+  await writeEvidence(runDir, record);
   return {
-    schemaVersion: 1,
-    label: "veriskit",
-    message: s.message,
-    color: s.color
+    run,
+    record,
+    note,
+    changedCount: files.length,
+    nothingAffected: false
   };
 }
-var STYLE;
-var init_badge = __esm({
-  "src/publish/badge.ts"() {
-    "use strict";
-    STYLE = {
-      verified: { message: "verified", color: "14b8a6" },
-      failed: { message: "failed", color: "e5484d" },
-      partial: { message: "partial", color: "f5a623" }
-    };
-  }
-});
 
-// src/cli/commands/badge.ts
-var badge_exports = {};
-__export(badge_exports, {
-  runBadge: () => runBadge
-});
-import { readFileSync as readFileSync7 } from "fs";
-import { mkdir as mkdir2, writeFile as writeFile5 } from "fs/promises";
-import { dirname as dirname3, join as join13 } from "path";
-async function runBadge(root, opts = {}) {
-  const dir = latestRunDir(root);
-  if (!dir) {
-    process.stdout.write("No runs yet. Run `veris verify` first.\n");
-    return 1;
-  }
-  let record;
-  try {
-    record = JSON.parse(
-      readFileSync7(join13(dir, "evidence.json"), "utf8")
-    );
-  } catch {
-    process.stderr.write(`veris: no evidence.json in ${dir}
-`);
-    return 1;
-  }
-  const out = opts.out ?? join13(root, ".veris", "badge.json");
-  await mkdir2(dirname3(out), { recursive: true });
-  await writeFile5(
-    out,
-    `${JSON.stringify(buildBadge(record.verdict), null, 2)}
-`,
-    "utf8"
-  );
-  process.stdout.write(`Wrote badge ${out}
-`);
-  return 0;
-}
-var init_badge2 = __esm({
-  "src/cli/commands/badge.ts"() {
-    "use strict";
-    init_store();
-    init_badge();
-  }
-});
+// src/index.ts
+init_verify_evidence();
 
 // src/history/flaky.ts
 function detectFlaky(records) {
@@ -2711,20 +1397,15 @@ function detectFlaky(records) {
   }
   return flaky;
 }
-var init_flaky = __esm({
-  "src/history/flaky.ts"() {
-    "use strict";
-  }
-});
 
 // src/history/read.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync8 } from "fs";
-import { join as join14 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join8 } from "path";
 function loadRuns(root, limit = 20) {
-  const runs = join14(root, ".veris", "runs");
+  const runs = join8(root, ".veris", "runs");
   let names;
   try {
-    names = readdirSync5(runs, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name !== "watch").map((d) => d.name);
+    names = readdirSync3(runs, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name !== "watch").map((d) => d.name);
   } catch {
     return [];
   }
@@ -2732,7 +1413,7 @@ function loadRuns(root, limit = 20) {
   for (const name of names) {
     try {
       const rec = JSON.parse(
-        readFileSync8(join14(runs, name, "evidence.json"), "utf8")
+        readFileSync4(join8(runs, name, "evidence.json"), "utf8")
       );
       if (rec?.schema === "veriskit/evidence@1") records.push(rec);
     } catch {
@@ -2743,213 +1424,18 @@ function loadRuns(root, limit = 20) {
   );
   return records.slice(0, limit);
 }
-var init_read = __esm({
-  "src/history/read.ts"() {
-    "use strict";
-  }
-});
-
-// src/cli/commands/log.ts
-var log_exports = {};
-__export(log_exports, {
-  runLog: () => runLog
-});
-async function runLog(root, opts = {}) {
-  const limit = Number.isFinite(opts.limit) && opts.limit > 0 ? opts.limit : 20;
-  const records = loadRuns(root, limit);
-  if (records.length === 0) {
-    process.stdout.write("No runs yet. Run `veris verify` first.\n");
-    return 0;
-  }
-  if (opts.flaky) {
-    const flaky = detectFlaky(records);
-    if (flaky.length === 0) {
-      process.stdout.write(
-        `No flaky checks in the last ${records.length} run(s).
-`
-      );
-      return 0;
-    }
-    process.stdout.write(
-      `Flaky checks (both passed and failed in the last ${records.length} run(s), newest first):
-`
-    );
-    for (const f of flaky) {
-      process.stdout.write(`  ${f.id.padEnd(8)} ${f.statuses.join(" ")}
-`);
-    }
-    return 0;
-  }
-  for (const rec of records) {
-    const date = rec.startedAt.slice(0, 19).replace("T", " ");
-    const checks = (rec.checks ?? []).map((c) => `${c.id}:${c.status}`).join(" ");
-    const commit = rec.git ? rec.git.commit.slice(0, 7) : "-";
-    process.stdout.write(
-      `${date}  ${rec.verdict.state.padEnd(9)} ${checks}  ${commit}
-`
-    );
-  }
-  process.stdout.write(
-    "\nHistory is local to this machine (.veris/runs is gitignored).\n"
-  );
-  return 0;
-}
-var init_log = __esm({
-  "src/cli/commands/log.ts"() {
-    "use strict";
-    init_flaky();
-    init_read();
-  }
-});
 
-// src/cli/index.ts
-init_version();
-import { realpathSync } from "fs";
-import { argv } from "process";
-import { pathToFileURL } from "url";
-import cac from "cac";
-function buildCli() {
-  const cli = cac("veris");
-  cli.version(VERSION);
-  cli.help();
-  cli.command("doctor", "Report environment + capabilities (read-only)").action(async () => {
-    const { runDoctor: runDoctor2 } = await Promise.resolve().then(() => (init_doctor(), doctor_exports));
-    process.exitCode = await runDoctor2(process.cwd());
-  });
-  cli.command("test", "Run the detected unit test runner").action(async () => {
-    const { runTest: runTest2 } = await Promise.resolve().then(() => (init_test(), test_exports));
-    process.exitCode = await runTest2(process.cwd());
-  });
-  cli.command("init", "Detect the stack and set up .veris (idempotent)").action(async () => {
-    const { runInit: runInit2 } = await Promise.resolve().then(() => (init_init(), init_exports));
-    process.exitCode = await runInit2(process.cwd());
-  });
-  cli.command("verify", "Run the full check set and produce a verdict + report").option("--partial-ok", "Exit 0 even when the verdict is partial").option(
-    "--github",
-    "Publish the verdict to the GitHub PR (comment + check run)"
-  ).option("--browser", "Also run browser tests (Playwright), when available").action(
-    async (opts) => {
-      const { runVerify: runVerify2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
-      process.exitCode = await runVerify2(process.cwd(), {
-        partialOk: opts.partialOk,
-        github: opts.github,
-        browser: opts.browser
-      });
-    }
-  );
-  cli.command("report", "Print the latest verification report").action(async () => {
-    const { runReport: runReport2 } = await Promise.resolve().then(() => (init_report(), report_exports));
-    process.exitCode = await runReport2(process.cwd());
-  });
-  cli.command("affected", "Run only the checks affected by changed files").option("--base <ref>", "Compare against a git ref instead of HEAD").option("--partial-ok", "Exit 0 even when the verdict is partial").option(
-    "--github",
-    "Publish the verdict to the GitHub PR (comment + check run)"
-  ).action(
-    async (opts) => {
-      const { runAffected: runAffected2 } = await Promise.resolve().then(() => (init_affected(), affected_exports));
-      process.exitCode = await runAffected2(process.cwd(), {
-        base: opts.base,
-        partialOk: opts.partialOk,
-        github: opts.github
-      });
-    }
-  );
-  cli.command("watch", "Re-run affected checks as files change (Ctrl-C to stop)").option("--poll", "Use mtime polling instead of native fs.watch").action(async (opts) => {
-    const { runWatch: runWatch2 } = await Promise.resolve().then(() => (init_watch(), watch_exports));
-    process.exitCode = await runWatch2(process.cwd(), { poll: opts.poll });
-  });
-  cli.command("scan", "Map the import graph and untested areas (read-only)").action(async () => {
-    const { runScan: runScan2 } = await Promise.resolve().then(() => (init_scan(), scan_exports));
-    process.exitCode = await runScan2(process.cwd());
-  });
-  cli.command(
-    "plan",
-    "Recommend what to test, from the import graph (read-only)"
-  ).option("--base <ref>", "Also factor in changes vs a git ref").action(async (opts) => {
-    const { runPlan: runPlan2 } = await Promise.resolve().then(() => (init_plan(), plan_exports));
-    process.exitCode = await runPlan2(process.cwd(), { base: opts.base });
-  });
-  cli.command(
-    "evidence <action> [file]",
-    "Evidence: verify <file> | bundle | show [file] | keygen | sign <file>"
-  ).option("--out <file>", "For bundle/keygen/sign: output path").option("--key <file>", "For sign: the private signing key (PEM)").option("--pubkey <file>", "For verify: assert the signer's public key").option("--key-id <id>", "For verify: assert the signer's key id").option("--sig <file>", "For verify: signature path (default <file>.sig)").action(
-    async (action, file, opts) => {
-      const mod = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
-      if (action === "verify") {
-        if (!file) {
-          process.stderr.write("veris: evidence verify needs a <file>\n");
-          process.exitCode = 1;
-          return;
-        }
-        process.exitCode = await mod.runEvidenceVerify(file, {
-          pubkey: opts.pubkey,
-          keyId: opts.keyId,
-          sig: opts.sig
-        });
-      } else if (action === "bundle") {
-        process.exitCode = await mod.runEvidenceBundle(process.cwd(), {
-          out: opts.out
-        });
-      } else if (action === "show") {
-        process.exitCode = await mod.runEvidenceShow(process.cwd(), file);
-      } else if (action === "keygen") {
-        process.exitCode = await mod.runEvidenceKeygen(process.cwd(), {
-          out: opts.out
-        });
-      } else if (action === "sign") {
-        if (!file) {
-          process.stderr.write("veris: evidence sign needs a <file>\n");
-          process.exitCode = 1;
-          return;
-        }
-        process.exitCode = await mod.runEvidenceSign(file, {
-          key: opts.key,
-          out: opts.out
-        });
-      } else {
-        process.stderr.write(
-          `veris: unknown evidence action '${action}' (use verify | bundle | show | keygen | sign)
-`
-        );
-        process.exitCode = 1;
-      }
-    }
-  );
-  cli.command(
-    "badge",
-    "Write a shields.io endpoint JSON from the latest verdict"
-  ).option("--out <file>", "Output path (default .veris/badge.json)").action(async (opts) => {
-    const { runBadge: runBadge2 } = await Promise.resolve().then(() => (init_badge2(), badge_exports));
-    process.exitCode = await runBadge2(process.cwd(), { out: opts.out });
-  });
-  cli.command("log", "List past verification runs (local history)").option("--limit <n>", "How many runs to show (default 20)").option("--flaky", "Show only checks that flip-flop across runs").action(async (opts) => {
-    const { runLog: runLog2 } = await Promise.resolve().then(() => (init_log(), log_exports));
-    process.exitCode = await runLog2(process.cwd(), {
-      limit: opts.limit ? Number(opts.limit) : void 0,
-      flaky: opts.flaky
-    });
-  });
-  return { raw: cli, version: VERSION };
-}
-async function main(argv2) {
-  try {
-    const { raw } = buildCli();
-    if (argv2.length <= 2) {
-      raw.outputHelp();
-      return;
-    }
-    raw.parse(argv2);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`veris: ${msg}
-`);
-    process.exitCode = 1;
-  }
-}
-var invokedPath = argv[1] ? realpathSync(argv[1]) : "";
-var isEntry = import.meta.url === pathToFileURL(invokedPath).href;
-if (isEntry) void main(argv);
+// src/index.ts
+init_analyze();
+init_graph();
 export {
-  buildCli,
-  main
+  affectedProject,
+  analyze,
+  buildGraph,
+  detectFlaky,
+  detectProject,
+  getEnvironmentInfo,
+  loadRuns,
+  verifyEvidenceFile,
+  verifyProject
 };