veriskit 0.5.1 → 0.6.0

package/dist/cli.js

@@ -0,0 +1,2982 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/version.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+var pkgUrl, VERSION;
+var init_version = __esm({
+  "src/version.ts"() {
+    "use strict";
+    pkgUrl = new URL("../package.json", import.meta.url);
+    VERSION = JSON.parse(
+      readFileSync(fileURLToPath(pkgUrl), "utf8")
+    ).version;
+  }
+});
+
+// src/util/fs-safe.ts
+import { existsSync } from "fs";
+import { mkdir, readFile, writeFile } from "fs/promises";
+async function ensureDir(path) {
+  await mkdir(path, { recursive: true });
+}
+async function writeIfAbsent(path, content) {
+  if (existsSync(path)) return false;
+  await writeFile(path, content, "utf8");
+  return true;
+}
+async function readJsonIfExists(path) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(await readFile(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+var init_fs_safe = __esm({
+  "src/util/fs-safe.ts"() {
+    "use strict";
+  }
+});
+
+// src/config/detect.ts
+import { existsSync as existsSync2 } from "fs";
+import { join } from "path";
+function detectPackageManager(root) {
+  if (existsSync2(join(root, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync2(join(root, "yarn.lock"))) return "yarn";
+  if (existsSync2(join(root, "bun.lockb"))) return "bun";
+  return "npm";
+}
+async function detectProject(root) {
+  const pkg = await readJsonIfExists(join(root, "package.json")) ?? {};
+  const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+  const has = (name) => name in deps;
+  const scripts = pkg.scripts ?? {};
+  const languages = existsSync2(join(root, "tsconfig.json")) ? ["typescript", "javascript"] : ["javascript"];
+  const frameworks = ["next", "vite", "react"].filter(has);
+  const capabilities = [
+    detectTypes(root, has),
+    detectUnit(has, scripts),
+    detectLint(root, has),
+    detectBrowser(root, has)
+  ];
+  return {
+    root,
+    name: pkg.name ?? void 0,
+    packageManager: detectPackageManager(root),
+    frameworks,
+    languages,
+    scripts,
+    capabilities
+  };
+}
+function detectTypes(root, has) {
+  if (existsSync2(join(root, "tsconfig.json")) && has("typescript"))
+    return { id: "types", available: true, runner: "tsc" };
+  return {
+    id: "types",
+    available: false,
+    reason: "no tsconfig.json + typescript dependency"
+  };
+}
+function detectUnit(has, scripts) {
+  if (has("vitest")) return { id: "unit", available: true, runner: "vitest" };
+  if (has("jest")) return { id: "unit", available: true, runner: "jest" };
+  if (Object.values(scripts).some((s) => s.includes("node --test")))
+    return { id: "unit", available: true, runner: "node-test" };
+  return { id: "unit", available: false, reason: "no test runner detected" };
+}
+function detectLint(root, has) {
+  if (existsSync2(join(root, "biome.json")) || has("@biomejs/biome"))
+    return { id: "lint", available: true, runner: "biome" };
+  if (has("eslint") || [".eslintrc", ".eslintrc.json", ".eslintrc.cjs", "eslint.config.js"].some(
+    (f) => existsSync2(join(root, f))
+  ))
+    return { id: "lint", available: true, runner: "eslint" };
+  return { id: "lint", available: false, reason: "no linter configured" };
+}
+function detectBrowser(root, has) {
+  if (has("@playwright/test") || existsSync2(join(root, "playwright.config.ts")) || existsSync2(join(root, "playwright.config.js"))) {
+    return { id: "browser", available: true, runner: "playwright" };
+  }
+  return {
+    id: "browser",
+    available: false,
+    reason: "no browser runner configured"
+  };
+}
+var init_detect = __esm({
+  "src/config/detect.ts"() {
+    "use strict";
+    init_fs_safe();
+  }
+});
+
+// src/util/env.ts
+import { platform } from "os";
+function detectCI() {
+  return process.env.CI === "true" || process.env.CI === "1";
+}
+function getEnvironmentInfo(pm) {
+  return {
+    os: platform(),
+    node: process.version,
+    pm,
+    ci: detectCI(),
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+var init_env = __esm({
+  "src/util/env.ts"() {
+    "use strict";
+  }
+});
+
+// src/cli/tty.ts
+function isPlain() {
+  return detectCI() || !process.stdout.isTTY;
+}
+var init_tty = __esm({
+  "src/cli/tty.ts"() {
+    "use strict";
+    init_env();
+  }
+});
+
+// src/cli/commands/doctor.ts
+var doctor_exports = {};
+__export(doctor_exports, {
+  renderDoctor: () => renderDoctor,
+  runDoctor: () => runDoctor
+});
+import pc from "picocolors";
+function renderDoctor(project, env) {
+  const plain = isPlain();
+  const ok = (s) => plain ? s : pc.green(s);
+  const dim = (s) => plain ? s : pc.dim(s);
+  const lines = [];
+  lines.push("VerisKit doctor");
+  lines.push("");
+  lines.push(`Package manager  ${project.packageManager}`);
+  lines.push(`Node             ${env.node}`);
+  lines.push(`Languages        ${project.languages.join(", ")}`);
+  if (project.frameworks.length)
+    lines.push(`Frameworks       ${project.frameworks.join(", ")}`);
+  lines.push("");
+  lines.push("Capabilities");
+  for (const c of project.capabilities) {
+    if (c.available) {
+      lines.push(`  ${ok("\u2713")} ${c.id.padEnd(8)} ${dim(`via ${c.runner}`)}`);
+    } else {
+      lines.push(
+        `  ${dim("\u2298")} ${c.id.padEnd(8)} ${dim(`skipped \u2014 ${c.reason}`)}`
+      );
+    }
+  }
+  return lines.join("\n");
+}
+async function runDoctor(root) {
+  const project = await detectProject(root);
+  const env = getEnvironmentInfo(project.packageManager);
+  process.stdout.write(`${renderDoctor(project, env)}
+`);
+  return 0;
+}
+var init_doctor = __esm({
+  "src/cli/commands/doctor.ts"() {
+    "use strict";
+    init_detect();
+    init_env();
+    init_tty();
+  }
+});
+
+// src/evidence/record.ts
+import { createHash } from "crypto";
+import { basename } from "path";
+function canonicalize(value) {
+  return JSON.stringify(sortValue(value));
+}
+function sortValue(value) {
+  if (Array.isArray(value)) return value.map(sortValue);
+  if (value && typeof value === "object") {
+    const src = value;
+    const out = {};
+    for (const key of Object.keys(src).sort()) {
+      if (src[key] !== void 0) out[key] = sortValue(src[key]);
+    }
+    return out;
+  }
+  return value;
+}
+function sha256(text) {
+  return `sha256:${createHash("sha256").update(text, "utf8").digest("hex")}`;
+}
+function computeDigest(record) {
+  const { digest: _omit, ...rest } = record;
+  return sha256(canonicalize(rest));
+}
+function buildRecord(run, git, logDigests, toolVersion) {
+  const runnerOf = new Map(
+    run.project.capabilities.map((c) => [c.id, c.runner])
+  );
+  const checks = run.results.map((r) => {
+    const check = {
+      id: r.checkId,
+      status: r.status,
+      durationMs: r.durationMs,
+      summary: r.summary
+    };
+    const runner = runnerOf.get(r.checkId);
+    if (runner) check.runner = runner;
+    if (r.counts) check.counts = r.counts;
+    const digest = logDigests[r.checkId];
+    if (digest) check.logDigest = digest;
+    return check;
+  });
+  const scope = run.scope ? { kind: run.scope.kind, changedCount: run.scope.changedCount } : { kind: "full", changedCount: 0 };
+  const base = {
+    schema: EVIDENCE_SCHEMA,
+    id: run.id,
+    startedAt: run.startedAt,
+    tool: { name: "veriskit", version: toolVersion },
+    git,
+    env: run.env,
+    project: {
+      name: run.project.name ?? basename(run.project.root),
+      packageManager: run.project.packageManager,
+      frameworks: run.project.frameworks,
+      languages: run.project.languages
+    },
+    scope,
+    checks,
+    verdict: run.verdict
+  };
+  return { ...base, digest: computeDigest(base) };
+}
+var EVIDENCE_SCHEMA;
+var init_record = __esm({
+  "src/evidence/record.ts"() {
+    "use strict";
+    EVIDENCE_SCHEMA = "veriskit/evidence@1";
+  }
+});
+
+// src/evidence/store.ts
+import { readdirSync } from "fs";
+import { readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
+function newRunId() {
+  counter += 1;
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  return `${stamp}-${counter}`;
+}
+async function createRunDir(root, id) {
+  const dir = join2(root, ".veris", "runs", id);
+  await ensureDir(dir);
+  return dir;
+}
+async function writeLog(runDir, checkId, content) {
+  const ref = join2(runDir, `${checkId}.log`);
+  await writeFile2(ref, content, "utf8");
+  return ref;
+}
+async function writeReport(root, id, markdown) {
+  const dir = join2(root, ".veris", "reports");
+  await ensureDir(dir);
+  const ref = join2(dir, `verify-${id}.md`);
+  await writeFile2(ref, markdown, "utf8");
+  return ref;
+}
+async function writeEvidence(runDir, record) {
+  const ref = join2(runDir, "evidence.json");
+  await writeFile2(ref, `${JSON.stringify(record, null, 2)}
+`, "utf8");
+  return ref;
+}
+async function digestLogs(run) {
+  const out = {};
+  for (const r of run.results) {
+    if (!r.logRef) continue;
+    try {
+      out[r.checkId] = sha256(await readFile2(r.logRef, "utf8"));
+    } catch {
+    }
+  }
+  return out;
+}
+async function readRunLogs(runDir, checkIds) {
+  const out = {};
+  for (const id of checkIds) {
+    try {
+      out[id] = await readFile2(join2(runDir, `${id}.log`), "utf8");
+    } catch {
+    }
+  }
+  return out;
+}
+function latestRunDir(root) {
+  const runs = join2(root, ".veris", "runs");
+  try {
+    const dirs = readdirSync(runs, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name !== "watch").map((d) => d.name).sort();
+    const latest = dirs.at(-1);
+    return latest ? join2(runs, latest) : null;
+  } catch {
+    return null;
+  }
+}
+async function ensureEvidenceDir(root) {
+  const dir = join2(root, ".veris", "evidence");
+  await ensureDir(dir);
+  return dir;
+}
+var counter;
+var init_store = __esm({
+  "src/evidence/store.ts"() {
+    "use strict";
+    init_fs_safe();
+    init_record();
+    counter = 0;
+  }
+});
+
+// src/util/exec.ts
+import { spawn } from "child_process";
+function exec(cmd, args, opts = {}) {
+  return new Promise((resolve2) => {
+    const start = performance.now();
+    const child = spawn(cmd, args, {
+      cwd: opts.cwd,
+      env: opts.env ?? process.env,
+      shell: false
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    const timer = opts.timeoutMs ? setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, opts.timeoutMs) : null;
+    child.stdout.on("data", (d) => stdout += d.toString());
+    child.stderr.on("data", (d) => stderr += d.toString());
+    child.on("close", (code) => {
+      if (timer) clearTimeout(timer);
+      resolve2({
+        code: code ?? 1,
+        stdout,
+        stderr,
+        durationMs: Math.round(performance.now() - start),
+        timedOut
+      });
+    });
+    child.on("error", () => {
+      if (timer) clearTimeout(timer);
+      resolve2({
+        code: 127,
+        stdout,
+        stderr: stderr || `failed to spawn ${cmd}`,
+        durationMs: Math.round(performance.now() - start),
+        timedOut
+      });
+    });
+  });
+}
+var init_exec = __esm({
+  "src/util/exec.ts"() {
+    "use strict";
+  }
+});
+
+// src/runners/base.ts
+import { join as join3 } from "path";
+function localBin(root, name) {
+  return join3(root, "node_modules", ".bin", name);
+}
+async function runViaExec(check, ctx, opts) {
+  const r = await exec(check.cmd, check.args, {
+    cwd: ctx.root,
+    timeoutMs: opts.timeoutMs
+  });
+  const status = r.code === 0 ? "passed" : r.timedOut ? "unknown" : "failed";
+  const output = [r.stdout, r.stderr].filter(Boolean).join("\n").trim();
+  const logRef = await writeLog(ctx.runDir, check.id, `${output}
+`);
+  const result = {
+    checkId: check.id,
+    status,
+    durationMs: r.durationMs,
+    summary: status === "passed" ? opts.pass : r.timedOut ? "timed out" : opts.fail,
+    logRef
+  };
+  if (status !== "passed" && output) {
+    result.outputTail = output.split("\n").slice(-TAIL_LINES).join("\n");
+  }
+  return result;
+}
+var TAIL_LINES;
+var init_base = __esm({
+  "src/runners/base.ts"() {
+    "use strict";
+    init_store();
+    init_exec();
+    TAIL_LINES = 20;
+  }
+});
+
+// src/runners/biome.ts
+var biomeRunner;
+var init_biome = __esm({
+  "src/runners/biome.ts"() {
+    "use strict";
+    init_base();
+    biomeRunner = {
+      id: "biome",
+      toCheck(project, _cap) {
+        return {
+          id: "lint",
+          title: "Lint",
+          runner: "biome",
+          cmd: localBin(project.root, "biome"),
+          args: ["check", "."]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "no lint errors",
+          fail: "lint errors found",
+          timeoutMs: 3 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/eslint.ts
+var eslintRunner;
+var init_eslint = __esm({
+  "src/runners/eslint.ts"() {
+    "use strict";
+    init_base();
+    eslintRunner = {
+      id: "eslint",
+      toCheck(project, _cap) {
+        return {
+          id: "lint",
+          title: "Lint",
+          runner: "eslint",
+          cmd: localBin(project.root, "eslint"),
+          args: ["."]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "no lint errors",
+          fail: "lint errors found",
+          timeoutMs: 3 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/jest.ts
+var jestRunner;
+var init_jest = __esm({
+  "src/runners/jest.ts"() {
+    "use strict";
+    init_base();
+    jestRunner = {
+      id: "jest",
+      toCheck(project, _cap, opts) {
+        return {
+          id: "unit",
+          title: "Unit tests",
+          runner: "jest",
+          cmd: localBin(project.root, "jest"),
+          args: ["--ci", ...opts?.targetFiles ?? []]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "unit tests passed",
+          fail: "unit tests failed",
+          timeoutMs: 10 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/node-test.ts
+var nodeTestRunner;
+var init_node_test = __esm({
+  "src/runners/node-test.ts"() {
+    "use strict";
+    init_base();
+    nodeTestRunner = {
+      id: "node-test",
+      toCheck(_project, _cap) {
+        return {
+          id: "unit",
+          title: "Unit tests",
+          runner: "node-test",
+          cmd: process.execPath,
+          args: ["--test"]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "unit tests passed",
+          fail: "unit tests failed",
+          timeoutMs: 10 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/playwright.ts
+function parsePlaywrightStats(stdout) {
+  try {
+    const json = JSON.parse(stdout);
+    return json.stats ?? null;
+  } catch {
+    return null;
+  }
+}
+var TAIL_LINES2, playwrightRunner;
+var init_playwright = __esm({
+  "src/runners/playwright.ts"() {
+    "use strict";
+    init_store();
+    init_exec();
+    init_base();
+    TAIL_LINES2 = 20;
+    playwrightRunner = {
+      id: "playwright",
+      toCheck(project, _cap) {
+        return {
+          id: "browser",
+          title: "Browser tests",
+          runner: "playwright",
+          cmd: localBin(project.root, "playwright"),
+          args: ["test", "--reporter=json"]
+        };
+      },
+      async run(check, ctx) {
+        const r = await exec(check.cmd, check.args, {
+          cwd: ctx.root,
+          timeoutMs: 15 * 6e4
+        });
+        const output = [r.stdout, r.stderr].filter(Boolean).join("\n").trim();
+        const logRef = await writeLog(ctx.runDir, check.id, `${output}
+`);
+        const stats = parsePlaywrightStats(r.stdout);
+        let status;
+        if (r.timedOut) {
+          status = "unknown";
+        } else if (stats) {
+          status = r.code === 0 && (stats.unexpected ?? 0) === 0 ? "passed" : "failed";
+        } else {
+          status = r.code === 0 ? "unknown" : "failed";
+        }
+        const result = {
+          checkId: "browser",
+          status,
+          durationMs: r.durationMs,
+          summary: status === "passed" ? "browser tests passed" : r.timedOut ? "timed out" : status === "unknown" ? "browser tests ran but the results could not be parsed" : "browser tests failed",
+          logRef
+        };
+        if (stats) {
+          const passed = stats.expected ?? 0;
+          const failed = stats.unexpected ?? 0;
+          result.counts = {
+            passed,
+            failed,
+            total: passed + failed + (stats.flaky ?? 0) + (stats.skipped ?? 0)
+          };
+        }
+        if (status !== "passed" && output) {
+          result.outputTail = output.split("\n").slice(-TAIL_LINES2).join("\n");
+        }
+        return result;
+      }
+    };
+  }
+});
+
+// src/runners/tsc.ts
+var tscRunner;
+var init_tsc = __esm({
+  "src/runners/tsc.ts"() {
+    "use strict";
+    init_base();
+    tscRunner = {
+      id: "tsc",
+      toCheck(project, _cap) {
+        return {
+          id: "types",
+          title: "Types",
+          runner: "tsc",
+          cmd: localBin(project.root, "tsc"),
+          args: ["--noEmit", "--pretty", "false"]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "no type errors",
+          fail: "type errors found",
+          timeoutMs: 5 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/vitest.ts
+var vitestRunner;
+var init_vitest = __esm({
+  "src/runners/vitest.ts"() {
+    "use strict";
+    init_base();
+    vitestRunner = {
+      id: "vitest",
+      toCheck(project, _cap, opts) {
+        const files = opts?.targetFiles ?? [];
+        return {
+          id: "unit",
+          title: "Unit tests",
+          runner: "vitest",
+          cmd: localBin(project.root, "vitest"),
+          args: ["run", "--reporter=json", ...files]
+        };
+      },
+      run(check, ctx) {
+        return runViaExec(check, ctx, {
+          pass: "unit tests passed",
+          fail: "unit tests failed",
+          timeoutMs: 10 * 6e4
+        });
+      }
+    };
+  }
+});
+
+// src/runners/index.ts
+var runners;
+var init_runners = __esm({
+  "src/runners/index.ts"() {
+    "use strict";
+    init_biome();
+    init_eslint();
+    init_jest();
+    init_node_test();
+    init_playwright();
+    init_tsc();
+    init_vitest();
+    init_base();
+    runners = {
+      tsc: tscRunner,
+      vitest: vitestRunner,
+      jest: jestRunner,
+      "node-test": nodeTestRunner,
+      eslint: eslintRunner,
+      biome: biomeRunner,
+      playwright: playwrightRunner
+    };
+  }
+});
+
+// src/core/verdict.ts
+function computeVerdict(results, capabilities) {
+  const reasons = [];
+  const skipped = [];
+  const verifiedCapabilities = [];
+  const anyFailed = results.some((r) => r.status === "failed");
+  for (const cap of capabilities) {
+    const result = results.find((r) => r.checkId === cap.id);
+    if (!cap.available) {
+      skipped.push(cap.id);
+      reasons.push(`${cap.id} skipped \u2014 ${cap.reason ?? "not configured"}`);
+      continue;
+    }
+    if (result?.status === "passed") {
+      verifiedCapabilities.push(cap.id);
+      continue;
+    }
+    if (result?.status === "failed") {
+      reasons.push(`${cap.id} failed \u2014 ${result.summary}`);
+      continue;
+    }
+    skipped.push(cap.id);
+    reasons.push(`${cap.id} skipped \u2014 ${result?.summary ?? "did not run"}`);
+  }
+  let state;
+  if (anyFailed) state = "failed";
+  else if (skipped.length > 0) state = "partial";
+  else state = "verified";
+  return { state, verifiedCapabilities, skipped, reasons };
+}
+function verdictExitCode(verdict, opts = {}) {
+  if (verdict.state === "failed") return 1;
+  if (verdict.state === "partial") return opts.partialOk ? 0 : 2;
+  return 0;
+}
+var init_verdict = __esm({
+  "src/core/verdict.ts"() {
+    "use strict";
+  }
+});
+
+// src/core/orchestrator.ts
+async function runChecks(project, ids, root, opts = {}) {
+  const known = new Set(project.capabilities.map((c) => c.id));
+  const unknown = ids.filter((id2) => !known.has(id2));
+  if (unknown.length > 0) {
+    throw new Error(`Unknown check id(s): ${unknown.join(", ")}`);
+  }
+  const id = newRunId();
+  const runDir = await createRunDir(root, id);
+  const ctx = { root, runDir };
+  const tasks = ids.map(async (capId) => {
+    const cap = project.capabilities.find((c) => c.id === capId);
+    const runner = cap?.runner ? runners[cap.runner] : void 0;
+    if (!cap?.available || !runner) {
+      const summary = !cap?.available ? cap?.reason ?? "not configured" : `no runner registered for ${cap.runner}`;
+      return {
+        checkId: capId,
+        status: "skipped",
+        durationMs: 0,
+        summary
+      };
+    }
+    const check = runner.toCheck(project, cap, {
+      targetFiles: opts.targetFiles?.[capId]
+    });
+    return runner.run(check, ctx);
+  });
+  const results = await Promise.all(tasks);
+  const requested = project.capabilities.filter((c) => ids.includes(c.id));
+  const verdict = computeVerdict(results, requested);
+  return {
+    id,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    project,
+    results,
+    verdict,
+    env: getEnvironmentInfo(project.packageManager)
+  };
+}
+var init_orchestrator = __esm({
+  "src/core/orchestrator.ts"() {
+    "use strict";
+    init_store();
+    init_runners();
+    init_env();
+    init_verdict();
+  }
+});
+
+// src/reporters/terminal.ts
+import pc2 from "picocolors";
+function glyph(status, plain) {
+  const map = {
+    passed: "\u2713",
+    failed: "\u2717",
+    skipped: "\u2298",
+    unknown: "?"
+  };
+  const g = map[status];
+  if (plain) return g;
+  if (status === "passed") return pc2.green(g);
+  if (status === "failed") return pc2.red(g);
+  return pc2.dim(g);
+}
+function secs(ms) {
+  return ms === 0 ? "" : `${(ms / 1e3).toFixed(1)}s`;
+}
+function renderRun(run, record) {
+  const plain = isPlain();
+  const bold = (s) => plain ? s : pc2.bold(s);
+  const dim = (s) => plain ? s : pc2.dim(s);
+  const lines = [];
+  const scoped = run.scope?.kind;
+  if (scoped) {
+    lines.push(bold(`VerisKit \u2014 ${scoped}`));
+    lines.push("");
+    lines.push(`Scope       ${run.scope?.changedCount ?? 0} changed file(s)`);
+  } else {
+    lines.push(bold("VerisKit"));
+    lines.push("");
+    lines.push(
+      `Project     ${run.project.root.split("/").pop() ?? run.project.root}`
+    );
+    lines.push(`Risk        ${dim("\u2014")}`);
+  }
+  lines.push("");
+  lines.push("Checks");
+  for (const r of run.results) {
+    const g = glyph(r.status, plain);
+    const detail = r.status === "skipped" ? dim(`skipped \u2014 ${r.summary}`) : r.cached ? dim(`\u27F3 cached \xB7 ${secs(r.durationMs) || "\u2014"}`) : secs(r.durationMs);
+    lines.push(`  ${g} ${r.checkId.padEnd(14)} ${detail}`);
+    if (r.outputTail) {
+      for (const tail of r.outputTail.split("\n")) {
+        lines.push(dim(`    ${tail}`));
+      }
+    }
+  }
+  lines.push("");
+  lines.push("Result");
+  const label = run.verdict.state === "verified" ? scoped ? "\u2713 Affected checks passed" : "\u2713 Verified" : run.verdict.state === "failed" ? scoped ? "\u2717 Affected checks failed" : "\u2717 Failed" : scoped ? "\u25B2 Affected: partial" : "\u25B2 Partial";
+  const color = run.verdict.state === "verified" ? pc2.green : run.verdict.state === "failed" ? pc2.red : pc2.yellow;
+  lines.push(`  ${plain ? label : color(label)}`);
+  if (record?.git) {
+    const g = record.git;
+    lines.push("");
+    lines.push(
+      `Commit      ${g.commit.slice(0, 7)} ${g.dirty ? "\xB7 tree dirty" : "\xB7 tree clean"}`
+    );
+  }
+  if (run.reportRef) {
+    lines.push("");
+    lines.push("Report");
+    lines.push(`  ${run.reportRef}`);
+  }
+  return lines.join("\n");
+}
+var init_terminal = __esm({
+  "src/reporters/terminal.ts"() {
+    "use strict";
+    init_tty();
+  }
+});
+
+// src/cli/commands/test.ts
+var test_exports = {};
+__export(test_exports, {
+  runTest: () => runTest
+});
+async function runTest(root) {
+  const project = await detectProject(root);
+  const run = await runChecks(project, ["unit"], root);
+  process.stdout.write(`${renderRun(run)}
+`);
+  return verdictExitCode(run.verdict);
+}
+var init_test = __esm({
+  "src/cli/commands/test.ts"() {
+    "use strict";
+    init_detect();
+    init_orchestrator();
+    init_verdict();
+    init_terminal();
+  }
+});
+
+// src/cli/commands/init.ts
+var init_exports = {};
+__export(init_exports, {
+  runInit: () => runInit
+});
+import { join as join4 } from "path";
+async function runInit(root) {
+  const project = await detectProject(root);
+  const dir = join4(root, ".veris");
+  await ensureDir(dir);
+  const defaultChecks = project.capabilities.filter((c) => c.available && c.id !== "browser").map((c) => c.id);
+  const wroteConfig = await writeIfAbsent(
+    join4(dir, "config.json"),
+    `${JSON.stringify({ checks: defaultChecks }, null, 2)}
+`
+  );
+  await writeIfAbsent(join4(dir, ".gitignore"), GITIGNORE);
+  process.stdout.write(
+    wroteConfig ? `Veris initialized. Detected checks: ${defaultChecks.join(", ") || "none"}.
+` : "VerisKit already initialized (.veris/config.json exists). Nothing overwritten.\n"
+  );
+  return 0;
+}
+var GITIGNORE;
+var init_init = __esm({
+  "src/cli/commands/init.ts"() {
+    "use strict";
+    init_detect();
+    init_fs_safe();
+    GITIGNORE = [
+      "runs/",
+      "reports/",
+      "cache/",
+      "graph.json",
+      "evidence/",
+      "keys/",
+      ""
+    ].join("\n");
+  }
+});
+
+// src/affected/gate.ts
+function affectedChecks(files, project) {
+  const available = new Set(
+    project.capabilities.filter((c) => c.available).map((c) => c.id)
+  );
+  const wanted = /* @__PURE__ */ new Set();
+  const reasonByCheck = {};
+  const want = (id, reason) => {
+    if (available.has(id) && !wanted.has(id)) {
+      wanted.add(id);
+      reasonByCheck[id] = reason;
+    }
+  };
+  const wantAll = (reason) => {
+    for (const id of available) want(id, reason);
+  };
+  for (const f of files) {
+    if (CONFIG_RE.test(f)) {
+      wantAll(`config changed (${f})`);
+    } else if (DOC_RE.test(f)) {
+    } else if (TEST_RE.test(f)) {
+      want("unit", "test file changed");
+      want("lint", "test file changed");
+    } else if (TS_RE.test(f)) {
+      want("types", "TypeScript changed");
+      want("lint", "TypeScript changed");
+      want("unit", "TypeScript changed");
+    } else if (JS_RE.test(f)) {
+      want("lint", "JavaScript changed");
+      want("unit", "JavaScript changed");
+    } else {
+      wantAll(`unrecognized file changed (${f})`);
+    }
+  }
+  return {
+    checks: ORDER.filter((id) => wanted.has(id)),
+    reasonByCheck,
+    changedCount: files.length
+  };
+}
+var ORDER, CONFIG_RE, TEST_RE, TS_RE, JS_RE, DOC_RE;
+var init_gate = __esm({
+  "src/affected/gate.ts"() {
+    "use strict";
+    ORDER = ["types", "lint", "unit", "browser"];
+    CONFIG_RE = /(^|\/)(tsconfig[^/]*\.json|biome\.jsonc?|\.eslintrc[^/]*|eslint\.config\.[^/]+|package\.json|veris\.config\.[^/]+)$/;
+    TEST_RE = /(\.(test|spec)\.[cm]?[jt]sx?$)|(^|\/)(test|__tests__)\//;
+    TS_RE = /\.[cm]?tsx?$/;
+    JS_RE = /\.[cm]?jsx?$/;
+    DOC_RE = /(\.(md|mdx|markdown|txt|png|jpe?g|gif|svg|webp|ico)$)|((^|\/)LICENSE$)/i;
+  }
+});
+
+// src/config/load.ts
+import { join as join5 } from "path";
+async function loadConfig(root) {
+  return readJsonIfExists(join5(root, ".veris", "config.json"));
+}
+var init_load = __esm({
+  "src/config/load.ts"() {
+    "use strict";
+    init_fs_safe();
+  }
+});
+
+// src/git/changes.ts
+function collect(set, out) {
+  for (const line of out.split("\n")) {
+    const f = line.trim();
+    if (f) set.add(f);
+  }
+}
+async function changedFiles(root, opts = {}) {
+  const base = opts.base ?? null;
+  const files = /* @__PURE__ */ new Set();
+  const diffArgs = base ? ["diff", "--name-only", base] : ["diff", "--name-only", "HEAD"];
+  const diff = await exec("git", diffArgs, { cwd: root });
+  if (diff.code === 0) collect(files, diff.stdout);
+  const untracked = await exec(
+    "git",
+    ["ls-files", "--others", "--exclude-standard"],
+    { cwd: root }
+  );
+  if (untracked.code === 0) collect(files, untracked.stdout);
+  return { files: [...files].sort(), base };
+}
+async function gitAnchor(root) {
+  const head = await exec("git", ["rev-parse", "HEAD"], { cwd: root });
+  if (head.code !== 0) return null;
+  const commit = head.stdout.trim();
+  const branchRes = await exec("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    cwd: root
+  });
+  const branch = branchRes.code === 0 ? branchRes.stdout.trim() : "HEAD";
+  const status = await exec("git", ["status", "--porcelain"], { cwd: root });
+  const lines = status.code === 0 ? status.stdout.split("\n").map((l) => l.trim()).filter(Boolean) : [];
+  return {
+    commit,
+    branch,
+    dirty: lines.length > 0,
+    changedFiles: lines.length
+  };
+}
+var init_changes = __esm({
+  "src/git/changes.ts"() {
+    "use strict";
+    init_exec();
+  }
+});
+
+// src/reporters/markdown.ts
+import { relative } from "path";
+function cell(value) {
+  return value.replace(/\|/g, "\\|");
+}
+function renderMarkdown(run, record) {
+  const root = run.project.root;
+  const lines = [];
+  lines.push("# VerisKit Verification Report");
+  if (run.scope?.kind) {
+    lines.push("");
+    lines.push(
+      `> **Scope:** ${run.scope.kind} \u2014 ${run.scope.changedCount} changed file(s). Only affected checks ran; this is not a full verification.`
+    );
+  }
+  lines.push("");
+  lines.push(`**Verdict:** ${STATE_LABEL[run.verdict.state]}`);
+  lines.push(`**When:** ${run.startedAt}`);
+  lines.push(
+    `**Node:** ${run.env.node} \xB7 **OS:** ${run.env.os} \xB7 **PM:** ${run.env.pm} \xB7 **CI:** ${run.env.ci}`
+  );
+  if (record?.git) {
+    const g = record.git;
+    const tree = g.dirty ? `tree dirty, ${g.changedFiles} uncommitted file(s)` : "tree clean";
+    lines.push(`**Commit:** ${g.commit.slice(0, 7)} (${g.branch}) \xB7 ${tree}`);
+  } else if (record) {
+    lines.push("**Commit:** no git anchor available");
+  }
+  lines.push("");
+  lines.push("## Checks");
+  lines.push("");
+  lines.push("| Check | Status | Duration | Summary | Log |");
+  lines.push("| --- | --- | --- | --- | --- |");
+  for (const r of run.results) {
+    const dur = r.durationMs ? `${(r.durationMs / 1e3).toFixed(1)}s` : "\u2014";
+    const log = r.logRef ? cell(relative(root, r.logRef)) : "\u2014";
+    lines.push(
+      `| ${r.checkId} | ${r.status} | ${dur} | ${cell(r.summary)} | ${log} |`
+    );
+  }
+  if (run.verdict.skipped.length) {
+    lines.push("");
+    lines.push("## Skipped");
+    lines.push("");
+    for (const reason of run.verdict.reasons) lines.push(`- ${reason}`);
+  }
+  const failures = run.results.filter((r) => r.outputTail);
+  if (failures.length) {
+    lines.push("");
+    lines.push("## Failure output");
+    for (const r of failures) {
+      lines.push("");
+      lines.push(`### ${r.checkId}`);
+      lines.push("");
+      lines.push("```");
+      lines.push(r.outputTail ?? "");
+      lines.push("```");
+    }
+  }
+  if (record) {
+    lines.push("");
+    lines.push(`**Evidence digest:** \`${record.digest}\``);
+    lines.push(
+      "_Integrity digest over the canonical record. Detects edits and corruption; it is not forgery-proof on its own. Publish the digest separately or sign it to prove authorship._"
+    );
+  }
+  lines.push("");
+  lines.push(
+    "_Generated by VerisKit. A `Partial` verdict means one or more capabilities did not run \u2014 it is not a pass._"
+  );
+  lines.push("");
+  return lines.join("\n");
+}
+var STATE_LABEL;
+var init_markdown = __esm({
+  "src/reporters/markdown.ts"() {
+    "use strict";
+    STATE_LABEL = {
+      verified: "Verified",
+      failed: "Failed",
+      partial: "Partial"
+    };
+  }
+});
+
+// src/project-graph/discover.ts
+import { readdirSync as readdirSync2, statSync } from "fs";
+import { join as join6, relative as relative2, sep } from "path";
+function toPosix(p) {
+  return sep === "/" ? p : p.split(sep).join("/");
+}
+function classify(rel) {
+  if (TEST_RE2.test(rel)) return "test";
+  if (CONFIG_RE2.test(rel)) return "config";
+  return "source";
+}
+function discoverFiles(root) {
+  const out = [];
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync2(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      const abs = join6(dir, name);
+      const rel = toPosix(relative2(root, abs));
+      if (IGNORE.test(rel)) continue;
+      let st;
+      try {
+        st = statSync(abs);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        walk(abs);
+      } else if (CODE_RE.test(rel)) {
+        out.push({ file: rel, kind: classify(rel) });
+      }
+    }
+  };
+  walk(root);
+  return out.sort((a, b) => a.file.localeCompare(b.file));
+}
+var IGNORE, CODE_RE, TEST_RE2, CONFIG_RE2;
+var init_discover = __esm({
+  "src/project-graph/discover.ts"() {
+    "use strict";
+    IGNORE = /(^|\/)(\.git|\.claude|\.veris|\.agentloop|\.agentflight|node_modules|dist|coverage|build|fixtures|__fixtures__)(\/|$)/;
+    CODE_RE = /\.[cm]?[jt]sx?$/;
+    TEST_RE2 = /(\.(test|spec)\.[cm]?[jt]sx?$)|(^|\/)(test|tests|__tests__)\//;
+    CONFIG_RE2 = /(^|\/)([^/]+\.config\.[cm]?[jt]sx?)$/;
+  }
+});
+
+// src/project-graph/scanner-resolver.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { dirname, join as join7, relative as relative3, resolve } from "path";
+function extractSpecifiers(text) {
+  const specs = [];
+  SPEC_RE.lastIndex = 0;
+  let m;
+  m = SPEC_RE.exec(text);
+  while (m !== null) {
+    const s = m[1] ?? m[2] ?? m[3] ?? m[4];
+    if (s) specs.push(s);
+    m = SPEC_RE.exec(text);
+  }
+  return specs;
+}
+function isFile(p) {
+  try {
+    return statSync2(p).isFile();
+  } catch {
+    return false;
+  }
+}
+function resolveRelative(fromDir, spec) {
+  const base = resolve(fromDir, spec);
+  const candidates = [base];
+  for (const ext of EXTS) candidates.push(base + ext);
+  const extMatch = base.match(/\.[cm]?[jt]sx?$/);
+  if (extMatch) {
+    const noExt = base.slice(0, -extMatch[0].length);
+    for (const ext of EXTS) candidates.push(noExt + ext);
+  }
+  for (const ext of EXTS) candidates.push(join7(base, `index${ext}`));
+  for (const c of candidates) {
+    if (existsSync3(c) && isFile(c)) return c;
+  }
+  return null;
+}
+function scannerImports(root, file) {
+  let text;
+  try {
+    text = readFileSync2(join7(root, file), "utf8");
+  } catch {
+    return [];
+  }
+  const dir = dirname(join7(root, file));
+  const out = /* @__PURE__ */ new Set();
+  for (const spec of extractSpecifiers(text)) {
+    if (!spec.startsWith(".")) continue;
+    const resolved = resolveRelative(dir, spec);
+    if (resolved) out.add(toPosix(relative3(root, resolved)));
+  }
+  return [...out];
+}
+var EXTS, SPEC_RE;
+var init_scanner_resolver = __esm({
+  "src/project-graph/scanner-resolver.ts"() {
+    "use strict";
+    init_discover();
+    EXTS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
+    SPEC_RE = /(?:import|export)\b[^'"]*?\bfrom\s*['"]([^'"]+)['"]|(?:^|[^.\w])import\s*['"]([^'"]+)['"]|\bimport\(\s*['"]([^'"]+)['"]\s*\)|\brequire\(\s*['"]([^'"]+)['"]\s*\)/g;
+  }
+});
+
+// src/project-graph/ts-resolver.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { createRequire } from "module";
+import { join as join8, relative as relative4, sep as sep2 } from "path";
+function hasClassicApi(mod) {
+  const m = mod;
+  return !!m && typeof m.preProcessFile === "function" && typeof m.resolveModuleName === "function" && typeof m.readConfigFile === "function" && typeof m.parseJsonConfigFileContent === "function" && typeof m.sys === "object" && m.sys !== null;
+}
+function loadTypeScript(root) {
+  try {
+    const require2 = createRequire(join8(root, "__veris__.js"));
+    const tsPath = require2.resolve("typescript");
+    const mod = require2(tsPath);
+    return hasClassicApi(mod) ? mod : null;
+  } catch {
+    return null;
+  }
+}
+function loadCompilerOptions(tsmod, root) {
+  const configPath = join8(root, "tsconfig.json");
+  const read = tsmod.readConfigFile(configPath, tsmod.sys.readFile);
+  if (read.error || !read.config) return {};
+  const parsed = tsmod.parseJsonConfigFileContent(read.config, tsmod.sys, root);
+  return parsed.options;
+}
+function tsImports(tsmod, root, options, file) {
+  let text;
+  try {
+    text = readFileSync3(join8(root, file), "utf8");
+  } catch {
+    return [];
+  }
+  const abs = join8(root, file);
+  const out = /* @__PURE__ */ new Set();
+  try {
+    const pre = tsmod.preProcessFile(text, true, true);
+    for (const imp of pre.importedFiles) {
+      const res = tsmod.resolveModuleName(
+        imp.fileName,
+        abs,
+        options,
+        tsmod.sys
+      );
+      const resolved = res.resolvedModule?.resolvedFileName;
+      if (resolved && !resolved.includes("node_modules") && resolved.startsWith(root + sep2)) {
+        out.add(toPosix(relative4(root, resolved)));
+      }
+    }
+  } catch {
+  }
+  return [...out];
+}
+function selectResolver(root) {
+  const tsmod = existsSync4(join8(root, "tsconfig.json")) ? loadTypeScript(root) : null;
+  if (tsmod) {
+    try {
+      const options = loadCompilerOptions(tsmod, root);
+      return {
+        resolver: "typescript",
+        importsOf: (file) => tsImports(tsmod, root, options, file)
+      };
+    } catch {
+    }
+  }
+  return {
+    resolver: "scanner",
+    importsOf: (file) => scannerImports(root, file)
+  };
+}
+var init_ts_resolver = __esm({
+  "src/project-graph/ts-resolver.ts"() {
+    "use strict";
+    init_discover();
+    init_scanner_resolver();
+  }
+});
+
+// src/project-graph/graph.ts
+var graph_exports = {};
+__export(graph_exports, {
+  buildGraph: () => buildGraph
+});
+async function buildGraph(project) {
+  const root = project.root;
+  const files = discoverFiles(root);
+  const known = new Set(files.map((f) => f.file));
+  const { resolver, importsOf } = selectResolver(root);
+  const nodes = {};
+  for (const f of files) {
+    nodes[f.file] = { file: f.file, kind: f.kind, imports: [], importedBy: [] };
+  }
+  for (const f of files) {
+    const imps = importsOf(f.file).filter((i) => known.has(i) && i !== f.file);
+    nodes[f.file].imports = imps;
+    for (const i of imps) nodes[i]?.importedBy.push(f.file);
+  }
+  return {
+    root,
+    resolver,
+    nodes,
+    sourceFiles: files.filter((f) => f.kind === "source").map((f) => f.file),
+    testFiles: files.filter((f) => f.kind === "test").map((f) => f.file)
+  };
+}
+var init_graph = __esm({
+  "src/project-graph/graph.ts"() {
+    "use strict";
+    init_discover();
+    init_ts_resolver();
+  }
+});
+
+// src/project-graph/analyze.ts
+function transitiveDependents(graph, file) {
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [...graph.nodes[file]?.importedBy ?? []];
+  while (stack.length) {
+    const f = stack.pop();
+    if (!f || seen.has(f)) continue;
+    seen.add(f);
+    for (const d of graph.nodes[f]?.importedBy ?? []) stack.push(d);
+  }
+  return seen;
+}
+function reachableFromTests(graph) {
+  const seen = /* @__PURE__ */ new Set();
+  const stack = [...graph.testFiles];
+  while (stack.length) {
+    const f = stack.pop();
+    if (!f || seen.has(f)) continue;
+    seen.add(f);
+    for (const i of graph.nodes[f]?.imports ?? []) stack.push(i);
+  }
+  return seen;
+}
+function analyze(graph, changed = []) {
+  const blastRadius = {};
+  for (const file of Object.keys(graph.nodes)) {
+    blastRadius[file] = transitiveDependents(graph, file).size;
+  }
+  const reached = reachableFromTests(graph);
+  const byBlast = (a, b) => (blastRadius[b] ?? 0) - (blastRadius[a] ?? 0);
+  const untested = graph.sourceFiles.filter((f) => !reached.has(f)).sort(byBlast);
+  const changedSet = new Set(changed);
+  const untestedSet = new Set(untested);
+  const risky = graph.sourceFiles.filter(
+    (f) => (blastRadius[f] ?? 0) > 0 && (untestedSet.has(f) || changedSet.has(f))
+  ).sort(byBlast);
+  return { untested, blastRadius, risky };
+}
+var init_analyze = __esm({
+  "src/project-graph/analyze.ts"() {
+    "use strict";
+  }
+});
+
+// src/affected/select.ts
+var select_exports = {};
+__export(select_exports, {
+  selectAffectedTests: () => selectAffectedTests
+});
+function selectAffectedTests(graph, changed) {
+  if (graph.resolver !== "typescript") {
+    return {
+      mode: "full",
+      testFiles: [],
+      reason: "scanner graph can miss aliased/subpath imports \u2014 running the full suite"
+    };
+  }
+  for (const f of changed) {
+    if (GLOBAL_RE.test(f)) {
+      return {
+        mode: "full",
+        testFiles: [],
+        reason: `global/config change (${f})`
+      };
+    }
+    if (!(f in graph.nodes)) {
+      return {
+        mode: "full",
+        testFiles: [],
+        reason: `unresolved changed file (${f})`
+      };
+    }
+  }
+  const tests = /* @__PURE__ */ new Set();
+  for (const f of changed) {
+    if (graph.nodes[f]?.kind === "test") tests.add(f);
+    for (const dep of transitiveDependents(graph, f)) {
+      if (graph.nodes[dep]?.kind === "test") tests.add(dep);
+    }
+  }
+  if (tests.size === 0) {
+    return {
+      mode: "full",
+      testFiles: [],
+      reason: "no tests reach the changed files"
+    };
+  }
+  const selected = [...tests].sort();
+  if (selected.some((t) => t.startsWith("-"))) {
+    return {
+      mode: "full",
+      testFiles: [],
+      reason: "a reaching test path starts with '-' (unsafe as a CLI argument)"
+    };
+  }
+  return { mode: "graph", testFiles: selected, reason: "" };
+}
+var GLOBAL_RE;
+var init_select = __esm({
+  "src/affected/select.ts"() {
+    "use strict";
+    init_analyze();
+    GLOBAL_RE = /(^|\/)(tsconfig[^/]*\.json|package\.json|biome\.jsonc?|\.eslintrc[^/]*|eslint\.config\.[^/]+|veris\.config\.[^/]+|[^/]+\.config\.[cm]?[jt]sx?|[^/]+\.setup\.[cm]?[jt]sx?)$/;
+  }
+});
+
+// src/core/orchestrate.ts
+function resolveChecks(configChecks, project, opts) {
+  let checks = configChecks?.length ? configChecks : DEFAULT_CHECKS;
+  if (opts.browser && !checks.includes("browser")) {
+    const cap = project.capabilities.find((c) => c.id === "browser");
+    if (cap?.available) checks = [...checks, "browser"];
+  }
+  return checks;
+}
+async function verifyProject(root, opts = {}) {
+  const project = await detectProject(root);
+  const config = await loadConfig(root);
+  const checks = resolveChecks(config?.checks, project, opts);
+  const run = await runChecks(project, checks, root);
+  const git = await gitAnchor(root);
+  const logDigests = await digestLogs(run);
+  const record = buildRecord(run, git, logDigests, VERSION);
+  const reportRef = await writeReport(
+    root,
+    run.id,
+    renderMarkdown(run, record)
+  );
+  run.reportRef = reportRef;
+  const runDir = await createRunDir(root, run.id);
+  await writeEvidence(runDir, record);
+  return { run, record };
+}
+async function affectedProject(root, opts = {}) {
+  const project = await detectProject(root);
+  const { files } = await changedFiles(root, { base: opts.base });
+  const plan = affectedChecks(files, project);
+  if (plan.checks.length === 0) {
+    return {
+      note: `Nothing affected \u2014 ${files.length} changed file(s), no checks to run.`,
+      changedCount: files.length,
+      nothingAffected: true
+    };
+  }
+  let targetFiles;
+  let note = "";
+  const unitRunner = project.capabilities.find((c) => c.id === "unit")?.runner;
+  const canNarrow = unitRunner === "vitest" || unitRunner === "jest";
+  if (plan.checks.includes("unit") && canNarrow) {
+    const { buildGraph: buildGraph2 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
+    const { selectAffectedTests: selectAffectedTests2 } = await Promise.resolve().then(() => (init_select(), select_exports));
+    const graph = await buildGraph2(project);
+    const sel = selectAffectedTests2(graph, files);
+    if (sel.mode === "graph") {
+      targetFiles = { unit: sel.testFiles };
+      note = `unit narrowed to ${sel.testFiles.length} of ${graph.testFiles.length} test file(s) via ${graph.resolver} graph`;
+    } else {
+      note = `unit ran in full \u2014 ${sel.reason}`;
+    }
+  } else if (plan.checks.includes("unit") && unitRunner) {
+    note = `unit ran in full \u2014 the ${unitRunner} runner does not support file filtering`;
+  }
+  const run = await runChecks(project, plan.checks, root, { targetFiles });
+  run.scope = { kind: "affected", changedCount: files.length };
+  const affected = new Set(plan.checks);
+  for (const cap of project.capabilities) {
+    if (cap.available && cap.id !== "browser" && !affected.has(cap.id)) {
+      run.results.push({
+        checkId: cap.id,
+        status: "skipped",
+        durationMs: 0,
+        summary: "not affected by changes"
+      });
+    }
+  }
+  const git = await gitAnchor(root);
+  const logDigests = await digestLogs(run);
+  const record = buildRecord(run, git, logDigests, VERSION);
+  const reportRef = await writeReport(
+    root,
+    run.id,
+    renderMarkdown(run, record)
+  );
+  run.reportRef = reportRef;
+  const runDir = await createRunDir(root, run.id);
+  await writeEvidence(runDir, record);
+  return {
+    run,
+    record,
+    note,
+    changedCount: files.length,
+    nothingAffected: false
+  };
+}
+var DEFAULT_CHECKS;
+var init_orchestrate = __esm({
+  "src/core/orchestrate.ts"() {
+    "use strict";
+    init_gate();
+    init_detect();
+    init_load();
+    init_record();
+    init_store();
+    init_changes();
+    init_markdown();
+    init_version();
+    init_orchestrator();
+    DEFAULT_CHECKS = ["types", "lint", "unit"];
+  }
+});
+
+// src/publish/comment.ts
+function renderComment(run, record) {
+  const summary = run.results.filter((r) => r.status !== "skipped").map((r) => `${r.checkId} ${r.status}`).join(" \xB7 ");
+  return [
+    MARKER,
+    `**VerisKit: ${STATE_LABEL2[run.verdict.state]}**`,
+    "",
+    summary,
+    "",
+    "<details><summary>Report</summary>",
+    "",
+    renderMarkdown(run, record),
+    "",
+    "</details>",
+    ""
+  ].join("\n");
+}
+var MARKER, STATE_LABEL2;
+var init_comment = __esm({
+  "src/publish/comment.ts"() {
+    "use strict";
+    init_markdown();
+    MARKER = "<!-- veriskit-report -->";
+    STATE_LABEL2 = {
+      verified: "verified",
+      failed: "failed",
+      partial: "partial"
+    };
+  }
+});
+
+// src/publish/context.ts
+import { readFileSync as readFileSync4 } from "fs";
+function defaultReadEvent(path) {
+  try {
+    return JSON.parse(readFileSync4(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function resolvePublishContext(env = process.env, readEvent = defaultReadEvent) {
+  const repository = env.GITHUB_REPOSITORY;
+  const token = env.GITHUB_TOKEN;
+  if (!repository || !token) return null;
+  const [owner, repo] = repository.split("/");
+  if (!owner || !repo) return null;
+  let prNumber = null;
+  let headSha = env.GITHUB_SHA ?? "";
+  const refMatch = (env.GITHUB_REF ?? "").match(/^refs\/pull\/(\d+)\//);
+  if (refMatch) prNumber = Number(refMatch[1]);
+  const event = readEvent(env.GITHUB_EVENT_PATH ?? "");
+  const pr = event?.pull_request;
+  if (pr) {
+    if (prNumber === null && typeof pr.number === "number") {
+      prNumber = pr.number;
+    }
+    if (pr.head?.sha) headSha = pr.head.sha;
+  }
+  if (prNumber === null || !headSha) return null;
+  return { owner, repo, token, prNumber, headSha };
+}
+var init_context = __esm({
+  "src/publish/context.ts"() {
+    "use strict";
+  }
+});
+
+// src/publish/github.ts
+function headers(token) {
+  return {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "veriskit",
+    "Content-Type": "application/json"
+  };
+}
+async function gh(method, url, token, body) {
+  const res = await fetch(url, {
+    method,
+    headers: headers(token),
+    body: body === void 0 ? void 0 : JSON.stringify(body)
+  });
+  if (!res.ok) {
+    const path = url.replace("https://api.github.com", "");
+    let detail = "";
+    try {
+      const errBody = await res.json();
+      if (errBody?.message) detail = `: ${errBody.message}`;
+    } catch {
+    }
+    throw new GitHubApiError(
+      res.status,
+      `GitHub API ${method} ${path} -> ${res.status}${detail}`
+    );
+  }
+  return res.status === 204 ? null : res.json();
+}
+function repoBase(ctx) {
+  return `https://api.github.com/repos/${ctx.owner}/${ctx.repo}`;
+}
+async function upsertComment(ctx, body) {
+  const base = repoBase(ctx);
+  const comments = await gh(
+    "GET",
+    `${base}/issues/${ctx.prNumber}/comments?per_page=100`,
+    ctx.token
+  );
+  const existing = comments.find((c) => (c.body ?? "").includes(MARKER));
+  if (existing) {
+    await gh("PATCH", `${base}/issues/comments/${existing.id}`, ctx.token, {
+      body
+    });
+  } else {
+    await gh("POST", `${base}/issues/${ctx.prNumber}/comments`, ctx.token, {
+      body
+    });
+  }
+}
+async function createCheckRun(ctx, opts) {
+  await gh("POST", `${repoBase(ctx)}/check-runs`, ctx.token, {
+    name: opts.name,
+    head_sha: ctx.headSha,
+    status: "completed",
+    conclusion: opts.conclusion,
+    output: { title: opts.title, summary: opts.summary }
+  });
+}
+var GitHubApiError;
+var init_github = __esm({
+  "src/publish/github.ts"() {
+    "use strict";
+    init_comment();
+    GitHubApiError = class extends Error {
+      status;
+      constructor(status, message) {
+        super(message);
+        this.name = "GitHubApiError";
+        this.status = status;
+      }
+    };
+  }
+});
+
+// src/publish/publish.ts
+async function publishToGitHub(run, record) {
+  const ctx = resolvePublishContext();
+  if (!ctx) {
+    process.stdout.write(
+      "veris: --github set but no GitHub PR context found (need GITHUB_TOKEN + a pull_request event); skipping publish.\n"
+    );
+    return;
+  }
+  try {
+    await upsertComment(ctx, renderComment(run, record));
+    await createCheckRun(ctx, {
+      name: "VerisKit",
+      conclusion: CONCLUSION[run.verdict.state],
+      title: `VerisKit: ${run.verdict.state}`,
+      summary: renderMarkdown(run, record)
+    });
+    process.stdout.write(
+      `veris: published the verdict to PR #${ctx.prNumber}
+`
+    );
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: GitHub publish failed: ${msg}
+`);
+  }
+}
+var CONCLUSION;
+var init_publish = __esm({
+  "src/publish/publish.ts"() {
+    "use strict";
+    init_markdown();
+    init_comment();
+    init_context();
+    init_github();
+    CONCLUSION = {
+      verified: "success",
+      failed: "failure",
+      partial: "neutral"
+    };
+  }
+});
+
+// src/cli/commands/verify.ts
+var verify_exports = {};
+__export(verify_exports, {
+  runVerify: () => runVerify
+});
+async function runVerify(root, opts = {}) {
+  const { run, record } = await verifyProject(root, opts);
+  process.stdout.write(`${renderRun(run, record)}
+`);
+  if (opts.github) await publishToGitHub(run, record);
+  return verdictExitCode(run.verdict, opts);
+}
+var init_verify = __esm({
+  "src/cli/commands/verify.ts"() {
+    "use strict";
+    init_orchestrate();
+    init_verdict();
+    init_publish();
+    init_terminal();
+  }
+});
+
+// src/cli/commands/report.ts
+var report_exports = {};
+__export(report_exports, {
+  runReport: () => runReport
+});
+import { readdirSync as readdirSync3, readFileSync as readFileSync5 } from "fs";
+import { join as join9 } from "path";
+async function runReport(root) {
+  const dir = join9(root, ".veris", "reports");
+  let files;
+  try {
+    files = readdirSync3(dir).filter((f) => f.endsWith(".md")).sort();
+  } catch {
+    process.stdout.write("No reports yet. Run `veris verify` first.\n");
+    return 0;
+  }
+  const latest = files.at(-1);
+  if (!latest) {
+    process.stdout.write("No reports yet. Run `veris verify` first.\n");
+    return 0;
+  }
+  process.stdout.write(`${readFileSync5(join9(dir, latest), "utf8")}
+`);
+  return 0;
+}
+var init_report = __esm({
+  "src/cli/commands/report.ts"() {
+    "use strict";
+  }
+});
+
+// src/cli/commands/affected.ts
+var affected_exports = {};
+__export(affected_exports, {
+  runAffected: () => runAffected
+});
+async function runAffected(root, opts = {}) {
+  const outcome = await affectedProject(root, opts);
+  if (outcome.nothingAffected || !outcome.run || !outcome.record) {
+    process.stdout.write(`${outcome.note}
+`);
+    return 0;
+  }
+  const { run, record, note } = outcome;
+  process.stdout.write(`${renderRun(run, record)}
+`);
+  if (note) process.stdout.write(`${note}
+`);
+  if (opts.github) await publishToGitHub(run, record);
+  return verdictExitCode(run.verdict, opts);
+}
+var init_affected = __esm({
+  "src/cli/commands/affected.ts"() {
+    "use strict";
+    init_orchestrate();
+    init_verdict();
+    init_publish();
+    init_terminal();
+  }
+});
+
+// src/watch/watcher.ts
+import {
+  watch as fsWatch,
+  readdirSync as readdirSync4,
+  statSync as statSync3
+} from "fs";
+import { basename as basename2, join as join10, relative as relative5 } from "path";
+function watch(root, opts, onBatch) {
+  const debounceMs = opts.debounceMs ?? 150;
+  const rootBase = basename2(root);
+  let pending = /* @__PURE__ */ new Set();
+  let timer = null;
+  const flush = () => {
+    const batch = [...pending];
+    pending = /* @__PURE__ */ new Set();
+    timer = null;
+    if (batch.length) onBatch(batch);
+  };
+  const schedule = (rel) => {
+    if (!rel || rel === rootBase || IGNORE2.test(rel)) return;
+    pending.add(rel);
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(flush, debounceMs);
+  };
+  if (opts.poll) {
+    const interval = opts.pollIntervalMs ?? 400;
+    const mtimes = scanMtimes(root);
+    const tick = setInterval(() => {
+      const next = scanMtimes(root);
+      for (const [p, m] of next) {
+        if (mtimes.get(p) !== m) schedule(p);
+      }
+      mtimes.clear();
+      for (const [p, m] of next) mtimes.set(p, m);
+    }, interval);
+    return () => {
+      clearInterval(tick);
+      if (timer) clearTimeout(timer);
+    };
+  }
+  let watcher;
+  try {
+    watcher = fsWatch(root, { recursive: true }, (_event, filename) => {
+      if (filename) schedule(filename.toString());
+    });
+  } catch {
+    throw new Error(
+      "recursive fs.watch is unavailable on this platform; rerun with --poll"
+    );
+  }
+  return () => {
+    if (timer) clearTimeout(timer);
+    watcher.close();
+  };
+}
+function scanMtimes(root) {
+  const out = /* @__PURE__ */ new Map();
+  const walk = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync4(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      const abs = join10(dir, name);
+      const rel = relative5(root, abs);
+      if (IGNORE2.test(rel)) continue;
+      let st;
+      try {
+        st = statSync3(abs);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) walk(abs);
+      else out.set(rel, st.mtimeMs);
+    }
+  };
+  walk(root);
+  return out;
+}
+var IGNORE2;
+var init_watcher = __esm({
+  "src/watch/watcher.ts"() {
+    "use strict";
+    IGNORE2 = /(^|\/)(\.git|\.veris|\.agentloop|\.agentflight|node_modules|dist)(\/|$)/;
+  }
+});
+
+// src/cli/commands/watch.ts
+var watch_exports = {};
+__export(watch_exports, {
+  buildWatchResults: () => buildWatchResults,
+  runWatch: () => runWatch
+});
+function buildWatchResults(project, affected, fresh, cache) {
+  const affectedSet = new Set(affected);
+  const freshById = new Map(fresh.map((r) => [r.checkId, r]));
+  const out = [];
+  for (const cap of project.capabilities) {
+    if (!cap.available || cap.id === "browser") continue;
+    const f = freshById.get(cap.id);
+    if (f) {
+      out.push({ ...f, cached: false });
+      continue;
+    }
+    const c = cache.get(cap.id);
+    if (c && !affectedSet.has(cap.id)) {
+      out.push({ ...c, cached: true });
+      continue;
+    }
+    out.push({
+      checkId: cap.id,
+      status: "skipped",
+      durationMs: 0,
+      summary: "not affected by changes"
+    });
+  }
+  return out;
+}
+async function runWatch(root, opts = {}) {
+  const cache = /* @__PURE__ */ new Map();
+  let running = false;
+  const availableIds = (project) => project.capabilities.filter((c) => c.available && c.id !== "browser").map((c) => c.id);
+  const tick = async (initial) => {
+    if (running) return;
+    running = true;
+    try {
+      const project = await detectProject(root);
+      const { files } = await changedFiles(root);
+      const checks = initial ? availableIds(project) : affectedChecks(files, project).checks;
+      let targetFiles;
+      let narrowedNote = "";
+      const unitRunner = project.capabilities.find(
+        (c) => c.id === "unit"
+      )?.runner;
+      const canNarrow = unitRunner === "vitest" || unitRunner === "jest";
+      if (!initial && checks.includes("unit") && canNarrow) {
+        const { buildGraph: buildGraph2 } = await Promise.resolve().then(() => (init_graph(), graph_exports));
+        const { selectAffectedTests: selectAffectedTests2 } = await Promise.resolve().then(() => (init_select(), select_exports));
+        const graph = await buildGraph2(project);
+        const sel = selectAffectedTests2(graph, files);
+        if (sel.mode === "graph") {
+          targetFiles = { unit: sel.testFiles };
+          narrowedNote = `unit narrowed to ${sel.testFiles.length} of ${graph.testFiles.length} test file(s) via ${graph.resolver} graph`;
+        } else {
+          narrowedNote = `unit ran in full \u2014 ${sel.reason}`;
+        }
+      } else if (!initial && checks.includes("unit") && unitRunner) {
+        narrowedNote = `unit ran in full \u2014 the ${unitRunner} runner does not support file filtering`;
+      }
+      let fresh = [];
+      if (checks.length) {
+        const r = await runChecks(project, checks, root, { targetFiles });
+        fresh = r.results;
+        for (const result of fresh) cache.set(result.checkId, { ...result });
+      }
+      const results = buildWatchResults(project, checks, fresh, cache);
+      const availableCaps = project.capabilities.filter(
+        (c) => c.available && c.id !== "browser"
+      );
+      const verdict = computeVerdict(results, availableCaps);
+      const run = {
+        id: "watch",
+        startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        project,
+        results,
+        verdict,
+        env: {
+          os: process.platform,
+          node: process.version,
+          pm: project.packageManager,
+          ci: false,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        },
+        scope: { kind: "watch", changedCount: files.length }
+      };
+      process.stdout.write(`${renderRun(run)}
+`);
+      if (narrowedNote) process.stdout.write(`${narrowedNote}
+`);
+    } finally {
+      running = false;
+    }
+  };
+  process.stdout.write("veris watch \u2014 press Ctrl-C to stop\n");
+  await tick(true);
+  return await new Promise((resolve2) => {
+    let stop;
+    try {
+      stop = watch(root, { poll: opts.poll }, () => {
+        void tick(false);
+      });
+    } catch (err) {
+      process.stderr.write(
+        `veris: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      resolve2(1);
+      return;
+    }
+    process.on("SIGINT", () => {
+      stop();
+      process.stdout.write("\nStopped.\n");
+      resolve2(0);
+    });
+  });
+}
+var init_watch = __esm({
+  "src/cli/commands/watch.ts"() {
+    "use strict";
+    init_gate();
+    init_detect();
+    init_orchestrator();
+    init_verdict();
+    init_changes();
+    init_terminal();
+    init_watcher();
+  }
+});
+
+// src/cli/commands/scan.ts
+var scan_exports = {};
+__export(scan_exports, {
+  renderScan: () => renderScan,
+  runScan: () => runScan
+});
+import { writeFile as writeFile3 } from "fs/promises";
+import { join as join11 } from "path";
+import pc3 from "picocolors";
+function renderScan(graph, analysis) {
+  const plain = isPlain();
+  const bold = (s) => plain ? s : pc3.bold(s);
+  const dim = (s) => plain ? s : pc3.dim(s);
+  const warn = (s) => plain ? s : pc3.yellow(s);
+  const lines = [];
+  lines.push(bold("VerisKit \u2014 scan"));
+  lines.push("");
+  lines.push(
+    `Resolver    ${graph.resolver}${graph.resolver === "scanner" ? dim("  (no TypeScript found \u2014 relative imports only)") : ""}`
+  );
+  lines.push(
+    `Modules     ${Object.keys(graph.nodes).length}   \xB7  Source ${graph.sourceFiles.length}  \xB7  Tests ${graph.testFiles.length}`
+  );
+  lines.push("");
+  lines.push("Untested (top by impact)");
+  const top = analysis.untested.slice(0, 10);
+  if (top.length === 0)
+    lines.push(dim("  none \u2014 every source file is reached by a test"));
+  for (const f of top) {
+    lines.push(
+      `  ${warn("!")} ${f}   ${dim(`${analysis.blastRadius[f] ?? 0} dependents`)}`
+    );
+  }
+  return lines.join("\n");
+}
+async function runScan(root) {
+  const project = await detectProject(root);
+  const graph = await buildGraph(project);
+  const analysis = analyze(graph);
+  const dir = join11(root, ".veris");
+  await ensureDir(dir);
+  await writeFile3(
+    join11(dir, "graph.json"),
+    JSON.stringify({ resolver: graph.resolver, nodes: graph.nodes }, null, 2),
+    "utf8"
+  );
+  process.stdout.write(`${renderScan(graph, analysis)}
+`);
+  process.stdout.write(`
+Graph        ${join11(".veris", "graph.json")}
+`);
+  return 0;
+}
+var init_scan = __esm({
+  "src/cli/commands/scan.ts"() {
+    "use strict";
+    init_detect();
+    init_analyze();
+    init_graph();
+    init_fs_safe();
+    init_tty();
+  }
+});
+
+// src/cli/commands/plan.ts
+var plan_exports = {};
+__export(plan_exports, {
+  renderPlan: () => renderPlan,
+  runPlan: () => runPlan
+});
+import pc4 from "picocolors";
+function renderPlan(project, graph, analysis, changed) {
+  const plain = isPlain();
+  const bold = (s) => plain ? s : pc4.bold(s);
+  const dim = (s) => plain ? s : pc4.dim(s);
+  const warn = (s) => plain ? s : pc4.yellow(s);
+  const lines = [];
+  lines.push(bold("VerisKit \u2014 plan"));
+  lines.push(dim(`(graph via ${graph.resolver})`));
+  lines.push("");
+  lines.push("Test these first (high impact, untested)");
+  const top = analysis.untested.slice(0, 5);
+  if (top.length === 0)
+    lines.push(
+      dim(
+        "  none \u2014 untested files have no dependents or all files are covered"
+      )
+    );
+  top.forEach((f, i) => {
+    lines.push(
+      `  ${i + 1}. ${f}   ${dim(`(${analysis.blastRadius[f] ?? 0} dependents, no test reaches it)`)}`
+    );
+  });
+  lines.push("");
+  lines.push("Verification setup");
+  const weak = project.capabilities.filter(
+    (c) => !c.available && c.id !== "browser"
+  );
+  if (weak.length === 0)
+    lines.push(dim("  \u2713 types, lint, and unit are all configured"));
+  for (const c of weak)
+    lines.push(
+      `  ${warn("\u26A0")} ${c.id} capability unavailable \u2014 ${c.reason ?? "not configured"}`
+    );
+  if (changed.length) {
+    lines.push("");
+    lines.push(`Risky changes (${changed.length} changed file(s))`);
+    if (analysis.risky.length === 0) lines.push(dim("  none flagged"));
+    for (const f of analysis.risky.slice(0, 8)) {
+      const untested = analysis.untested.includes(f) ? ", untested" : "";
+      lines.push(
+        `  ${warn("!")} ${f}   ${dim(`${analysis.blastRadius[f] ?? 0} dependents${untested}`)}`
+      );
+    }
+  }
+  lines.push("");
+  lines.push(
+    dim("Next: `veris affected` runs only the tests that reach your changes.")
+  );
+  return lines.join("\n");
+}
+async function runPlan(root, opts = {}) {
+  const project = await detectProject(root);
+  const graph = await buildGraph(project);
+  const { files } = await changedFiles(root, { base: opts.base });
+  const analysis = analyze(graph, files);
+  process.stdout.write(`${renderPlan(project, graph, analysis, files)}
+`);
+  return 0;
+}
+var init_plan = __esm({
+  "src/cli/commands/plan.ts"() {
+    "use strict";
+    init_detect();
+    init_changes();
+    init_analyze();
+    init_graph();
+    init_tty();
+  }
+});
+
+// src/evidence/signing.ts
+import {
+  createHash as createHash2,
+  createPrivateKey,
+  createPublicKey,
+  sign as cryptoSign,
+  verify as cryptoVerify,
+  generateKeyPairSync
+} from "crypto";
+function derOf(publicKey) {
+  return publicKey.export({ type: "spki", format: "der" });
+}
+function keyId(publicKey) {
+  const key = typeof publicKey === "string" ? createPublicKey(publicKey) : publicKey;
+  return createHash2("sha256").update(derOf(key)).digest("hex").slice(0, 8);
+}
+function signatureKeyId(sig) {
+  const key = createPublicKey({
+    key: Buffer.from(sig.publicKey, "base64"),
+    format: "der",
+    type: "spki"
+  });
+  return keyId(key);
+}
+function generateKeyPair() {
+  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+  return {
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }),
+    privateKeyPem: privateKey.export({
+      type: "pkcs8",
+      format: "pem"
+    }),
+    keyId: keyId(publicKey)
+  };
+}
+function signDigest(digest, privateKeyPem) {
+  const privateKey = createPrivateKey(privateKeyPem);
+  const publicKey = createPublicKey(
+    privateKey
+  );
+  const sig = cryptoSign(null, Buffer.from(digest, "utf8"), privateKey);
+  return {
+    schema: SIGNATURE_SCHEMA,
+    alg: "ed25519",
+    keyId: keyId(publicKey),
+    publicKey: derOf(publicKey).toString("base64"),
+    digest,
+    signature: sig.toString("base64"),
+    signedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function verifySignature(sig) {
+  try {
+    const publicKey = createPublicKey({
+      key: Buffer.from(sig.publicKey, "base64"),
+      format: "der",
+      type: "spki"
+    });
+    return cryptoVerify(
+      null,
+      Buffer.from(sig.digest, "utf8"),
+      publicKey,
+      Buffer.from(sig.signature, "base64")
+    );
+  } catch {
+    return false;
+  }
+}
+var SIGNATURE_SCHEMA;
+var init_signing = __esm({
+  "src/evidence/signing.ts"() {
+    "use strict";
+    SIGNATURE_SCHEMA = "veriskit/signature@1";
+  }
+});
+
+// src/evidence/verify-evidence.ts
+import { existsSync as existsSync5 } from "fs";
+import { readFile as readFile3 } from "fs/promises";
+function verifyRecord(record) {
+  const recomputed = computeDigest(
+    record
+  );
+  const ok = recomputed === record.digest;
+  const checks = [
+    {
+      name: "record digest",
+      ok,
+      detail: ok ? "matches the canonical record" : `recomputed ${recomputed}, record claims ${record.digest}`
+    }
+  ];
+  return { ok, kind: "record", record, checks, signed: false };
+}
+function signatureChecks(recordDigest, sig, opts = {}) {
+  const checks = [];
+  const kid = signatureKeyId(sig);
+  const validSig = verifySignature(sig) && sig.digest === recordDigest;
+  checks.push({
+    name: "signature",
+    ok: validSig,
+    detail: validSig ? `valid ed25519 signature by key ${kid}` : "signature does not match this record"
+  });
+  if (opts.expectedKeyId || opts.expectedPubKeyPem) {
+    let matches = false;
+    if (opts.expectedPubKeyPem) {
+      try {
+        matches = keyId(opts.expectedPubKeyPem) === kid;
+      } catch {
+        matches = false;
+      }
+    } else if (opts.expectedKeyId) {
+      matches = opts.expectedKeyId.toLowerCase() === kid.toLowerCase();
+    }
+    checks.push({
+      name: "signer",
+      ok: matches,
+      detail: matches ? `signer matches the expected key ${kid}` : `signer ${kid} does not match the expected key`
+    });
+  }
+  return checks;
+}
+async function verifyEvidenceFile(path, opts = {}) {
+  const parsed = JSON.parse(await readFile3(path, "utf8"));
+  if (parsed?.schema === "veriskit/bundle@1") {
+    const { verifyBundle: verifyBundle2 } = await Promise.resolve().then(() => (init_bundle(), bundle_exports));
+    return verifyBundle2(parsed, opts);
+  }
+  const result = verifyRecord(parsed);
+  const assertedSigner = Boolean(
+    opts.expectedKeyId || opts.expectedPubKeyPem || opts.sigPath
+  );
+  const sigPath = opts.sigPath ?? `${path}.sig`;
+  if (existsSync5(sigPath)) {
+    const sig = JSON.parse(await readFile3(sigPath, "utf8"));
+    result.checks.push(
+      ...signatureChecks(result.record.digest, sig, {
+        expectedKeyId: opts.expectedKeyId,
+        expectedPubKeyPem: opts.expectedPubKeyPem
+      })
+    );
+    result.signed = true;
+  } else if (assertedSigner) {
+    result.checks.push({
+      name: "signature",
+      ok: false,
+      detail: "a signature was required (--pubkey/--key-id/--sig) but none was found"
+    });
+  }
+  result.ok = result.checks.every((c) => c.ok);
+  return result;
+}
+var init_verify_evidence = __esm({
+  "src/evidence/verify-evidence.ts"() {
+    "use strict";
+    init_record();
+    init_signing();
+  }
+});
+
+// src/evidence/bundle.ts
+var bundle_exports = {};
+__export(bundle_exports, {
+  BUNDLE_SCHEMA: () => BUNDLE_SCHEMA,
+  buildBundle: () => buildBundle,
+  verifyBundle: () => verifyBundle
+});
+function buildBundle(record, report, logs, signature) {
+  const manifest = {
+    record: record.digest,
+    report: sha256(report),
+    logs: Object.fromEntries(
+      Object.entries(logs).map(([k, v]) => [k, sha256(v)])
+    )
+  };
+  const base = signature ? { schema: BUNDLE_SCHEMA, record, report, logs, manifest, signature } : { schema: BUNDLE_SCHEMA, record, report, logs, manifest };
+  return { ...base, bundleDigest: sha256(canonicalize(base)) };
+}
+function verifyBundle(bundle, opts = {}) {
+  const checks = [];
+  const recordResult = verifyRecord(bundle.record);
+  checks.push(...recordResult.checks);
+  const reportDigest = sha256(bundle.report);
+  checks.push({
+    name: "report",
+    ok: reportDigest === bundle.manifest.report,
+    detail: reportDigest === bundle.manifest.report ? "matches manifest" : "mismatch"
+  });
+  for (const [id, body] of Object.entries(bundle.logs)) {
+    const d = sha256(body);
+    checks.push({
+      name: `log:${id}`,
+      ok: d === bundle.manifest.logs[id],
+      detail: d === bundle.manifest.logs[id] ? "matches manifest" : "mismatch"
+    });
+  }
+  const { bundleDigest: _omit, ...rest } = bundle;
+  const recomputed = sha256(canonicalize(rest));
+  checks.push({
+    name: "bundle digest",
+    ok: recomputed === bundle.bundleDigest,
+    detail: recomputed === bundle.bundleDigest ? "matches" : "mismatch"
+  });
+  let signed = false;
+  if (bundle.signature) {
+    signed = true;
+    checks.push(
+      ...signatureChecks(bundle.record.digest, bundle.signature, {
+        expectedKeyId: opts.expectedKeyId,
+        expectedPubKeyPem: opts.expectedPubKeyPem
+      })
+    );
+  } else if (opts.expectedKeyId || opts.expectedPubKeyPem) {
+    checks.push({
+      name: "signature",
+      ok: false,
+      detail: "a signature was required (--pubkey/--key-id) but the bundle is unsigned"
+    });
+  }
+  return {
+    ok: checks.every((c) => c.ok),
+    kind: "bundle",
+    record: bundle.record,
+    checks,
+    signed
+  };
+}
+var BUNDLE_SCHEMA;
+var init_bundle = __esm({
+  "src/evidence/bundle.ts"() {
+    "use strict";
+    init_record();
+    init_verify_evidence();
+    BUNDLE_SCHEMA = "veriskit/bundle@1";
+  }
+});
+
+// src/cli/commands/evidence.ts
+var evidence_exports = {};
+__export(evidence_exports, {
+  runEvidenceBundle: () => runEvidenceBundle,
+  runEvidenceKeygen: () => runEvidenceKeygen,
+  runEvidenceShow: () => runEvidenceShow,
+  runEvidenceSign: () => runEvidenceSign,
+  runEvidenceVerify: () => runEvidenceVerify
+});
+import { chmodSync, existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync } from "fs";
+import { writeFile as writeFile4 } from "fs/promises";
+import { basename as basename3, dirname as dirname2, join as join12 } from "path";
+import pc5 from "picocolors";
+async function runEvidenceVerify(path, opts = {}) {
+  let expectedPubKeyPem;
+  if (opts.pubkey) {
+    try {
+      expectedPubKeyPem = readFileSync6(opts.pubkey, "utf8");
+    } catch {
+      process.stderr.write(`veris: cannot read public key at ${opts.pubkey}
+`);
+      return 1;
+    }
+  }
+  let result;
+  try {
+    result = await verifyEvidenceFile(path, {
+      sigPath: opts.sig,
+      expectedKeyId: opts.keyId,
+      expectedPubKeyPem
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: cannot read evidence at ${path}: ${msg}
+`);
+    return 1;
+  }
+  const plain = isPlain();
+  const mark = (ok) => plain ? ok ? "ok" : "FAIL" : ok ? pc5.green("\u2713") : pc5.red("\u2717");
+  for (const check of result.checks) {
+    process.stdout.write(
+      `  ${mark(check.ok)} ${check.name}: ${check.detail}
+`
+    );
+  }
+  const g = result.record.git;
+  const anchor = g ? `commit ${g.commit.slice(0, 7)} \xB7 ${g.dirty ? "tree dirty" : "tree clean"}` : "no git anchor";
+  process.stdout.write(
+    `
+${result.ok ? "digest OK" : "TAMPERED"} \xB7 verdict ${result.record.verdict.state} \xB7 ${anchor}
+`
+  );
+  process.stdout.write(`
+${HONESTY}
+`);
+  if (result.signed && !opts.pubkey && !opts.keyId) {
+    process.stdout.write(
+      "\nThis record is signed. Confirm you trust the signing key by comparing its\nkey id above to one you already trust, or re-run with --pubkey / --key-id.\n"
+    );
+  }
+  return result.ok ? 0 : 1;
+}
+async function runEvidenceKeygen(root, opts = {}) {
+  const out = opts.out ?? join12(root, ".veris", "keys", "veriskit-signing.key");
+  const pub = `${out}.pub`;
+  if (existsSync6(out) || existsSync6(pub)) {
+    process.stderr.write(
+      `veris: a key already exists at ${out}. Refusing to overwrite it.
+`
+    );
+    return 1;
+  }
+  const { mkdir: mkdir3 } = await import("fs/promises");
+  await mkdir3(dirname2(out), { recursive: true });
+  const kp = generateKeyPair();
+  writeFileSync(out, kp.privateKeyPem, { mode: 384 });
+  chmodSync(out, 384);
+  writeFileSync(pub, kp.publicKeyPem, "utf8");
+  process.stdout.write(
+    [
+      `Wrote signing key ${out} (keep this secret; do not commit it)`,
+      `Wrote public key ${pub}`,
+      `Key id ${kp.keyId}`,
+      ""
+    ].join("\n")
+  );
+  return 0;
+}
+async function runEvidenceSign(evidencePath, opts = {}) {
+  let privateKeyPem;
+  if (process.env.VERISKIT_SIGNING_KEY) {
+    privateKeyPem = process.env.VERISKIT_SIGNING_KEY;
+  } else if (opts.key) {
+    try {
+      privateKeyPem = readFileSync6(opts.key, "utf8");
+    } catch {
+      process.stderr.write(`veris: cannot read signing key at ${opts.key}
+`);
+      return 1;
+    }
+  } else {
+    process.stderr.write(
+      "veris: no signing key. Pass --key <path> or set VERISKIT_SIGNING_KEY.\n"
+    );
+    return 1;
+  }
+  let record;
+  try {
+    record = JSON.parse(readFileSync6(evidencePath, "utf8"));
+  } catch {
+    process.stderr.write(`veris: cannot read evidence at ${evidencePath}
+`);
+    return 1;
+  }
+  const recomputed = computeDigest(
+    record
+  );
+  if (recomputed !== record.digest) {
+    process.stderr.write(
+      "veris: refusing to sign, the record digest does not match its contents.\n"
+    );
+    return 1;
+  }
+  let sig;
+  try {
+    sig = signDigest(record.digest, privateKeyPem);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: signing failed: ${msg}
+`);
+    return 1;
+  }
+  const out = opts.out ?? `${evidencePath}.sig`;
+  writeFileSync(out, `${JSON.stringify(sig, null, 2)}
+`, "utf8");
+  process.stdout.write(
+    `Signed ${evidencePath}
+Wrote ${out} (key ${sig.keyId})
+`
+  );
+  return 0;
+}
+async function runEvidenceBundle(root, opts = {}) {
+  const runDir = latestRunDir(root);
+  if (!runDir) {
+    process.stdout.write("No evidence yet. Run `veris verify` first.\n");
+    return 1;
+  }
+  let record;
+  try {
+    record = JSON.parse(
+      readFileSync6(join12(runDir, "evidence.json"), "utf8")
+    );
+  } catch {
+    process.stderr.write(`veris: no evidence.json in ${runDir}
+`);
+    return 1;
+  }
+  let report = "";
+  try {
+    report = readFileSync6(
+      join12(root, ".veris", "reports", `verify-${record.id}.md`),
+      "utf8"
+    );
+  } catch {
+  }
+  const logIds = record.checks.filter((c) => c.logDigest).map((c) => c.id);
+  const logs = await readRunLogs(runDir, logIds);
+  let signature;
+  const sigPath = join12(runDir, "evidence.json.sig");
+  if (existsSync6(sigPath)) {
+    try {
+      signature = JSON.parse(readFileSync6(sigPath, "utf8"));
+    } catch {
+    }
+  }
+  const bundle = buildBundle(record, report, logs, signature);
+  const outDir = await ensureEvidenceDir(root);
+  const out = opts.out ?? join12(outDir, `${record.id}.bundle.json`);
+  await writeFile4(out, `${JSON.stringify(bundle, null, 2)}
+`, "utf8");
+  process.stdout.write(`Wrote portable evidence bundle: ${out}
+`);
+  return 0;
+}
+async function runEvidenceShow(root, path) {
+  const target = path ?? (() => {
+    const dir = latestRunDir(root);
+    return dir ? join12(dir, "evidence.json") : null;
+  })();
+  if (!target) {
+    process.stdout.write("No evidence yet. Run `veris verify` first.\n");
+    return 0;
+  }
+  let record;
+  try {
+    record = JSON.parse(readFileSync6(target, "utf8"));
+  } catch {
+    process.stderr.write(`veris: cannot read evidence at ${target}
+`);
+    return 1;
+  }
+  const g = record.git;
+  process.stdout.write(
+    [
+      `Evidence   ${basename3(target)}`,
+      `Verdict    ${record.verdict.state}`,
+      `Project    ${record.project.name}`,
+      `Scope      ${record.scope.kind} (${record.scope.changedCount} changed)`,
+      `Commit     ${g ? `${g.commit.slice(0, 7)} (${g.branch}) ${g.dirty ? "\xB7 tree dirty" : "\xB7 tree clean"}` : "no git anchor"}`,
+      `Checks     ${record.checks.map((c) => `${c.id}:${c.status}`).join(", ")}`,
+      `Digest     ${record.digest}`,
+      ""
+    ].join("\n")
+  );
+  return 0;
+}
+var HONESTY;
+var init_evidence = __esm({
+  "src/cli/commands/evidence.ts"() {
+    "use strict";
+    init_bundle();
+    init_record();
+    init_signing();
+    init_store();
+    init_verify_evidence();
+    init_tty();
+    HONESTY = "An integrity digest confirms the record was not edited or corrupted since it was written.\nIt is not forgery-proof on its own: publish the digest separately (CI log, PR) or sign it (veris evidence sign) to prove authorship.";
+  }
+});
+
+// src/publish/badge.ts
+function buildBadge(verdict) {
+  const s = STYLE[verdict.state];
+  return {
+    schemaVersion: 1,
+    label: "veriskit",
+    message: s.message,
+    color: s.color
+  };
+}
+var STYLE;
+var init_badge = __esm({
+  "src/publish/badge.ts"() {
+    "use strict";
+    STYLE = {
+      verified: { message: "verified", color: "14b8a6" },
+      failed: { message: "failed", color: "e5484d" },
+      partial: { message: "partial", color: "f5a623" }
+    };
+  }
+});
+
+// src/cli/commands/badge.ts
+var badge_exports = {};
+__export(badge_exports, {
+  runBadge: () => runBadge
+});
+import { readFileSync as readFileSync7 } from "fs";
+import { mkdir as mkdir2, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname3, join as join13 } from "path";
+async function runBadge(root, opts = {}) {
+  const dir = latestRunDir(root);
+  if (!dir) {
+    process.stdout.write("No runs yet. Run `veris verify` first.\n");
+    return 1;
+  }
+  let record;
+  try {
+    record = JSON.parse(
+      readFileSync7(join13(dir, "evidence.json"), "utf8")
+    );
+  } catch {
+    process.stderr.write(`veris: no evidence.json in ${dir}
+`);
+    return 1;
+  }
+  const out = opts.out ?? join13(root, ".veris", "badge.json");
+  await mkdir2(dirname3(out), { recursive: true });
+  await writeFile5(
+    out,
+    `${JSON.stringify(buildBadge(record.verdict), null, 2)}
+`,
+    "utf8"
+  );
+  process.stdout.write(`Wrote badge ${out}
+`);
+  return 0;
+}
+var init_badge2 = __esm({
+  "src/cli/commands/badge.ts"() {
+    "use strict";
+    init_store();
+    init_badge();
+  }
+});
+
+// src/history/flaky.ts
+function detectFlaky(records) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const rec of records) {
+    for (const c of rec.checks ?? []) {
+      const arr = byId.get(c.id) ?? [];
+      arr.push(c.status);
+      byId.set(c.id, arr);
+    }
+  }
+  const flaky = [];
+  for (const [id, statuses] of byId) {
+    if (statuses.includes("passed") && statuses.includes("failed")) {
+      flaky.push({ id, statuses });
+    }
+  }
+  return flaky;
+}
+var init_flaky = __esm({
+  "src/history/flaky.ts"() {
+    "use strict";
+  }
+});
+
+// src/history/read.ts
+import { readdirSync as readdirSync5, readFileSync as readFileSync8 } from "fs";
+import { join as join14 } from "path";
+function loadRuns(root, limit = 20) {
+  const runs = join14(root, ".veris", "runs");
+  let names;
+  try {
+    names = readdirSync5(runs, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name !== "watch").map((d) => d.name);
+  } catch {
+    return [];
+  }
+  const records = [];
+  for (const name of names) {
+    try {
+      const rec = JSON.parse(
+        readFileSync8(join14(runs, name, "evidence.json"), "utf8")
+      );
+      if (rec?.schema === "veriskit/evidence@1") records.push(rec);
+    } catch {
+    }
+  }
+  records.sort(
+    (a, b) => a.startedAt < b.startedAt ? 1 : a.startedAt > b.startedAt ? -1 : 0
+  );
+  return records.slice(0, limit);
+}
+var init_read = __esm({
+  "src/history/read.ts"() {
+    "use strict";
+  }
+});
+
+// src/cli/commands/log.ts
+var log_exports = {};
+__export(log_exports, {
+  runLog: () => runLog
+});
+async function runLog(root, opts = {}) {
+  const limit = Number.isFinite(opts.limit) && opts.limit > 0 ? opts.limit : 20;
+  const records = loadRuns(root, limit);
+  if (records.length === 0) {
+    process.stdout.write("No runs yet. Run `veris verify` first.\n");
+    return 0;
+  }
+  if (opts.flaky) {
+    const flaky = detectFlaky(records);
+    if (flaky.length === 0) {
+      process.stdout.write(
+        `No flaky checks in the last ${records.length} run(s).
+`
+      );
+      return 0;
+    }
+    process.stdout.write(
+      `Flaky checks (both passed and failed in the last ${records.length} run(s), newest first):
+`
+    );
+    for (const f of flaky) {
+      process.stdout.write(`  ${f.id.padEnd(8)} ${f.statuses.join(" ")}
+`);
+    }
+    return 0;
+  }
+  for (const rec of records) {
+    const date = rec.startedAt.slice(0, 19).replace("T", " ");
+    const checks = (rec.checks ?? []).map((c) => `${c.id}:${c.status}`).join(" ");
+    const commit = rec.git ? rec.git.commit.slice(0, 7) : "-";
+    process.stdout.write(
+      `${date}  ${rec.verdict.state.padEnd(9)} ${checks}  ${commit}
+`
+    );
+  }
+  process.stdout.write(
+    "\nHistory is local to this machine (.veris/runs is gitignored).\n"
+  );
+  return 0;
+}
+var init_log = __esm({
+  "src/cli/commands/log.ts"() {
+    "use strict";
+    init_flaky();
+    init_read();
+  }
+});
+
+// src/cli/index.ts
+init_version();
+import { realpathSync } from "fs";
+import { argv } from "process";
+import { pathToFileURL } from "url";
+import cac from "cac";
+function buildCli() {
+  const cli = cac("veris");
+  cli.version(VERSION);
+  cli.help();
+  cli.command("doctor", "Report environment + capabilities (read-only)").action(async () => {
+    const { runDoctor: runDoctor2 } = await Promise.resolve().then(() => (init_doctor(), doctor_exports));
+    process.exitCode = await runDoctor2(process.cwd());
+  });
+  cli.command("test", "Run the detected unit test runner").action(async () => {
+    const { runTest: runTest2 } = await Promise.resolve().then(() => (init_test(), test_exports));
+    process.exitCode = await runTest2(process.cwd());
+  });
+  cli.command("init", "Detect the stack and set up .veris (idempotent)").action(async () => {
+    const { runInit: runInit2 } = await Promise.resolve().then(() => (init_init(), init_exports));
+    process.exitCode = await runInit2(process.cwd());
+  });
+  cli.command("verify", "Run the full check set and produce a verdict + report").option("--partial-ok", "Exit 0 even when the verdict is partial").option(
+    "--github",
+    "Publish the verdict to the GitHub PR (comment + check run)"
+  ).option("--browser", "Also run browser tests (Playwright), when available").action(
+    async (opts) => {
+      const { runVerify: runVerify2 } = await Promise.resolve().then(() => (init_verify(), verify_exports));
+      process.exitCode = await runVerify2(process.cwd(), {
+        partialOk: opts.partialOk,
+        github: opts.github,
+        browser: opts.browser
+      });
+    }
+  );
+  cli.command("report", "Print the latest verification report").action(async () => {
+    const { runReport: runReport2 } = await Promise.resolve().then(() => (init_report(), report_exports));
+    process.exitCode = await runReport2(process.cwd());
+  });
+  cli.command("affected", "Run only the checks affected by changed files").option("--base <ref>", "Compare against a git ref instead of HEAD").option("--partial-ok", "Exit 0 even when the verdict is partial").option(
+    "--github",
+    "Publish the verdict to the GitHub PR (comment + check run)"
+  ).action(
+    async (opts) => {
+      const { runAffected: runAffected2 } = await Promise.resolve().then(() => (init_affected(), affected_exports));
+      process.exitCode = await runAffected2(process.cwd(), {
+        base: opts.base,
+        partialOk: opts.partialOk,
+        github: opts.github
+      });
+    }
+  );
+  cli.command("watch", "Re-run affected checks as files change (Ctrl-C to stop)").option("--poll", "Use mtime polling instead of native fs.watch").action(async (opts) => {
+    const { runWatch: runWatch2 } = await Promise.resolve().then(() => (init_watch(), watch_exports));
+    process.exitCode = await runWatch2(process.cwd(), { poll: opts.poll });
+  });
+  cli.command("scan", "Map the import graph and untested areas (read-only)").action(async () => {
+    const { runScan: runScan2 } = await Promise.resolve().then(() => (init_scan(), scan_exports));
+    process.exitCode = await runScan2(process.cwd());
+  });
+  cli.command(
+    "plan",
+    "Recommend what to test, from the import graph (read-only)"
+  ).option("--base <ref>", "Also factor in changes vs a git ref").action(async (opts) => {
+    const { runPlan: runPlan2 } = await Promise.resolve().then(() => (init_plan(), plan_exports));
+    process.exitCode = await runPlan2(process.cwd(), { base: opts.base });
+  });
+  cli.command(
+    "evidence <action> [file]",
+    "Evidence: verify <file> | bundle | show [file] | keygen | sign <file>"
+  ).option("--out <file>", "For bundle/keygen/sign: output path").option("--key <file>", "For sign: the private signing key (PEM)").option("--pubkey <file>", "For verify: assert the signer's public key").option("--key-id <id>", "For verify: assert the signer's key id").option("--sig <file>", "For verify: signature path (default <file>.sig)").action(
+    async (action, file, opts) => {
+      const mod = await Promise.resolve().then(() => (init_evidence(), evidence_exports));
+      if (action === "verify") {
+        if (!file) {
+          process.stderr.write("veris: evidence verify needs a <file>\n");
+          process.exitCode = 1;
+          return;
+        }
+        process.exitCode = await mod.runEvidenceVerify(file, {
+          pubkey: opts.pubkey,
+          keyId: opts.keyId,
+          sig: opts.sig
+        });
+      } else if (action === "bundle") {
+        process.exitCode = await mod.runEvidenceBundle(process.cwd(), {
+          out: opts.out
+        });
+      } else if (action === "show") {
+        process.exitCode = await mod.runEvidenceShow(process.cwd(), file);
+      } else if (action === "keygen") {
+        process.exitCode = await mod.runEvidenceKeygen(process.cwd(), {
+          out: opts.out
+        });
+      } else if (action === "sign") {
+        if (!file) {
+          process.stderr.write("veris: evidence sign needs a <file>\n");
+          process.exitCode = 1;
+          return;
+        }
+        process.exitCode = await mod.runEvidenceSign(file, {
+          key: opts.key,
+          out: opts.out
+        });
+      } else {
+        process.stderr.write(
+          `veris: unknown evidence action '${action}' (use verify | bundle | show | keygen | sign)
+`
+        );
+        process.exitCode = 1;
+      }
+    }
+  );
+  cli.command(
+    "badge",
+    "Write a shields.io endpoint JSON from the latest verdict"
+  ).option("--out <file>", "Output path (default .veris/badge.json)").action(async (opts) => {
+    const { runBadge: runBadge2 } = await Promise.resolve().then(() => (init_badge2(), badge_exports));
+    process.exitCode = await runBadge2(process.cwd(), { out: opts.out });
+  });
+  cli.command("log", "List past verification runs (local history)").option("--limit <n>", "How many runs to show (default 20)").option("--flaky", "Show only checks that flip-flop across runs").action(async (opts) => {
+    const { runLog: runLog2 } = await Promise.resolve().then(() => (init_log(), log_exports));
+    process.exitCode = await runLog2(process.cwd(), {
+      limit: opts.limit ? Number(opts.limit) : void 0,
+      flaky: opts.flaky
+    });
+  });
+  return { raw: cli, version: VERSION };
+}
+async function main(argv2) {
+  try {
+    const { raw } = buildCli();
+    if (argv2.length <= 2) {
+      raw.outputHelp();
+      return;
+    }
+    raw.parse(argv2);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`veris: ${msg}
+`);
+    process.exitCode = 1;
+  }
+}
+var invokedPath = argv[1] ? realpathSync(argv[1]) : "";
+var isEntry = import.meta.url === pathToFileURL(invokedPath).href;
+if (isEntry) void main(argv);
+export {
+  buildCli,
+  main
+};