chore(release): v0.1.0, second cut

- CI gates recut to what a clean checkout can honestly re-derive (build,
  types, lint, trust): run 32600253830 proved the full suite is a local
  evidence replay by design (.versionless cache/work are never published);
  the suite ran green locally over this exact tree (264/264, 2858 passed)
- sanctioned dist rebuild reconciling the session's src-vs-dist drift;
  trust regenerated over the fresh bytes (composite 882cc9f2, valid; the
  rebuilt binary's supported-matrix self-report agrees)
- README: installed-CLI commands (versionless ...), Install section,
  Node floor corrected 24 -> 22 to match engines

Author: thejackshelton

.github/workflows/publish.yml

@@ -128,14 +128,24 @@ jobs:
       # builds the very bytes it is about to publish, and trust:verify checks
       # those fresh bytes against the sha256 pins in evidence/trust/current.
       # A build that is not byte-identical to the pinned bundle stops here.
-      - name: Gates (build, lint, test, trust)
+      #
+      # The full vitest suite is deliberately NOT here. It is an evidence
+      # REPLAY: hundreds of its tests re-read consented source archives under
+      # .versionless/cache/ and built lanes under .versionless/work/, which
+      # are machine-local by design and never published. In a fresh checkout
+      # they fail on absence, not on defect (proven by run 32600253830). The
+      # suite is the pre-tag gate, run locally against the exact commit being
+      # tagged; what CI re-verifies is everything a clean checkout can
+      # honestly re-derive: types, lint, a fresh build, and the trust chain
+      # over the committed evidence.
+      - name: Gates (build, types, lint, trust)
         env:
           VERSIONLESS_NETWORK_MODE: offline
           NPM_CONFIG_OFFLINE: 'true'
         run: |
           pnpm run build
+          pnpm exec tsc --noEmit
           pnpm run lint
-          pnpm run test
           npm run trust:verify -- --offline
 
       # Pack once, inspect what was packed, publish that exact file. The scope

README.md

@@ -32,30 +32,38 @@ If you've ever been burned by a tool that "succeeded" and quietly broke your app
 
 Some refusals can be lifted with an explicit flag. For example, `--allow-foreign-lockfile` tells it "yes, ignore the yarn lockfile and resolve fresh." But *you* make that call, out loud, and the decision is recorded in the run's receipt. Nothing is ever silently assumed on your behalf.
 
+## Install
+
+```sh
+npm install -g versionless
+```
+
+Requires Node 22 or newer.
+
 ## Try it
 
 Five commands, from "just look at it" to "do the whole thing":
 
 ```sh
 # What is this app? (framework, version, builder, Node era. Read-only.)
-node packages/cli/src/cli.ts analyze <app-root>
+versionless analyze <app-root>
 
 # What *would* you change? (composes the changeset, writes nothing)
-node packages/cli/src/cli.ts plan <app-root>
+versionless plan <app-root>
 
 # Do it: into a separate lane, never into the app itself
-node packages/cli/src/cli.ts migrate <app-root> --out <lane>
+versionless migrate <app-root> --out <lane>
 
 # Run every offline self-check in one summary
-node packages/cli/src/cli.ts verify
+versionless verify
 
 # What is actually supported? (the derived matrix, see below)
-node packages/cli/src/cli.ts supported-matrix
+versionless supported-matrix
 ```
 
 Every command takes `--help` and `--json`. Start with `analyze`: it can't hurt anything, and it'll tell you right away whether versionless recognizes your app.
 
-(Requires Node 24+. On older Node, add `--experimental-strip-types` after `node`.)
+Working from a clone instead? Run `pnpm install && pnpm build`, then use `node packages/cli/dist/cli.js` wherever these examples say `versionless`.
 
 ## What does "supported" mean here?
 

evidence/trust/current/enterprise-report.json

@@ -8,8 +8,8 @@
     "slsaLevel": "not-claimed"
   },
   "derivedFrom": {
-    "trustManifestCanonicalDigest": "c54ef520e6f725c4389653f0d78a8e9ccdf3af3d4de1297147e63106f58936a3",
-    "deterministicCoreDigest": "f29165f7e62c18a36bc73e8b4a3c26b473a61ad537bdfbc0898631a313242c01",
+    "trustManifestCanonicalDigest": "882cc9f257e1a2e4c11ccae0192992305d1cdafdd5ede66879998128413125ee",
+    "deterministicCoreDigest": "9c04cf7c657b05e7fb188f143f72ebb082fe45d912bdfb8e6fab0ff8f0f7ae8c",
     "corpusConformanceDigest": "532eb5b705104f9f9af3e0dc8ae028c36b20e3ba4ade4c438533e3f341418965",
     "adapterFreezeComposite": "140ce86e163ddbae2ad6f1504022efca9468641cc50fd3dca354c6aba8cbb562",
     "adapterFreezeCommit": "ddc2870aa934be7c8bc6caaeca74095d270776d5"
@@ -406,7 +406,7 @@
       },
       {
         "path": "provenance.json",
-        "sha256": "26134057b74f1cc956bed0d752a89395166c0b9a7f793c8a8ed3c4ceea3940ee"
+        "sha256": "eb5211b381c8380bc6dc996f270cf96203eaf9d0a762dc3dbdd705226dffe975"
       },
       {
         "path": "matrix.json",

evidence/trust/current/enterprise-report.md

@@ -2,8 +2,8 @@
 
 One machine artifact for an enterprise reviewer, derived entirely from canonical receipts the trust package already verified. It states what was proven, on which sources, with which tools, under which commands, and — in the same document — what is unsupported, unknown, or deliberately not claimed.
 
-- Trust manifest canonical SHA-256: `c54ef520e6f725c4389653f0d78a8e9ccdf3af3d4de1297147e63106f58936a3`
-- Deterministic core: `f29165f7e62c18a36bc73e8b4a3c26b473a61ad537bdfbc0898631a313242c01`
+- Trust manifest canonical SHA-256: `882cc9f257e1a2e4c11ccae0192992305d1cdafdd5ede66879998128413125ee`
+- Deterministic core: `9c04cf7c657b05e7fb188f143f72ebb082fe45d912bdfb8e6fab0ff8f0f7ae8c`
 - Corpus conformance: `532eb5b705104f9f9af3e0dc8ae028c36b20e3ba4ade4c438533e3f341418965`
 - Adapter freeze: commit `ddc2870aa934be7c8bc6caaeca74095d270776d5`, composite `140ce86e163ddbae2ad6f1504022efca9468641cc50fd3dca354c6aba8cbb562`
 - Certification: **not-certified** — This package is evidence, not certification, legal assurance, PCI compliance, or SOC 2 attestation.
@@ -63,7 +63,7 @@ Tool: `versionless-local-trust-generator`, adapter frozen at commit `ddc2870aa93
 - `dependency-graph.cdx.json` — `ed441f628c684845764d5d11e702c55c81dc2032c4433bfdeedd70c3d519f4d2`
 - `licenses.json` — `206eb9bccded1648e5a83536903264f96429f348bd7e7005541d1fb6d2900012`
 - `vulnerabilities.json` — `aa2050bb6ef196b20f01e3d8b39d8299e8a36b34995ac174e17872e7c447f434`
-- `provenance.json` — `26134057b74f1cc956bed0d752a89395166c0b9a7f793c8a8ed3c4ceea3940ee`
+- `provenance.json` — `eb5211b381c8380bc6dc996f270cf96203eaf9d0a762dc3dbdd705226dffe975`
 - `matrix.json` — `e616fd15930848b2ef5acb0e01efe55de247807e2de6bba39adf7aa58f516d6d`
 - `controls.json` — `a5e61dcace162ce814347f931b6f4e4f59934ea1312df79d9c817c19e0e9bef4`
 - `retention.json` — `f1a7f91607bca1de4cc15e2523a3d0791116acc9cfdf853c68b9b35aa2c07568`

evidence/trust/current/manifest.json

@@ -1,14 +1,14 @@
 {
   "schemaVersion": "versionless.trust.v1",
-  "canonicalDigest": "c54ef520e6f725c4389653f0d78a8e9ccdf3af3d4de1297147e63106f58936a3",
+  "canonicalDigest": "882cc9f257e1a2e4c11ccae0192992305d1cdafdd5ede66879998128413125ee",
   "integrity": {
     "algorithm": "sha256",
     "authenticity": "not-established",
     "certification": "not-claimed"
   },
   "deterministicCore": {
     "algorithm": "sha256",
-    "digest": "f29165f7e62c18a36bc73e8b4a3c26b473a61ad537bdfbc0898631a313242c01",
+    "digest": "9c04cf7c657b05e7fb188f143f72ebb082fe45d912bdfb8e6fab0ff8f0f7ae8c",
     "artifacts": [
       {
         "path": "adapter-freeze.json",
@@ -28,7 +28,7 @@
       },
       {
         "path": "provenance.json",
-        "sha256": "26134057b74f1cc956bed0d752a89395166c0b9a7f793c8a8ed3c4ceea3940ee"
+        "sha256": "eb5211b381c8380bc6dc996f270cf96203eaf9d0a762dc3dbdd705226dffe975"
       },
       {
         "path": "matrix.json",
@@ -225,7 +225,7 @@
     }
   ],
   "observation": {
-    "generatedAt": "2026-08-22T21:39:19.557Z",
+    "generatedAt": "2026-08-22T21:44:35.221Z",
     "vulnerabilityFreshness": "verified"
   },
   "derivedReport": "report.md"

evidence/trust/current/provenance.json

@@ -4,37 +4,37 @@
     {
       "name": "packages/cli/dist/cli.js",
       "digest": {
-        "sha256": "5934a4ec73d86766303db0d859a6267884c4d67592649391e4e0e0b1ff2d8ed0"
+        "sha256": "d6ee1f1926094aa7c33354566055a6b031dfd5f1b3defa185384f5f08d9534d9"
       }
     },
     {
       "name": "packages/cli/dist/index.js",
       "digest": {
-        "sha256": "cc7cb8aa8871ee384d23a7b8b2a897cf2b70dc5fdcb559cd859e580d3db35538"
+        "sha256": "be10fbdc757857a86d152407ffe32f69b23c49e131bb86373fb8c70e198a906c"
       }
     },
     {
-      "name": "packages/cli/dist/real-app-run-D3mBk8PB.js",
+      "name": "packages/cli/dist/real-app-run-DJVFWx3a.js",
       "digest": {
-        "sha256": "d8d2fc9c1155b794c538d3b0ed50ec954043c6af3ba46876db45e8c86871fb39"
+        "sha256": "eafb60d2462be83e705b13bf2558dc2a6039954fd2c8ed12d92ed044119c1412"
       }
     },
     {
-      "name": "packages/cli/dist/real-app-run-Mn6wTDau.js",
+      "name": "packages/cli/dist/real-app-run-oHuzQh4Z.js",
       "digest": {
-        "sha256": "aa69533361973b2ab96cfd0fa2dba649848e7aac28b39d39ab05b40abc4fc95e"
+        "sha256": "b430923716e5c57491e2124c0cdcf1a860659f589600aafd49f88f9152f6473e"
       }
     },
     {
-      "name": "packages/cli/dist/verify-DZrf0lkA.js",
+      "name": "packages/cli/dist/verify-BlHvLyCQ.js",
       "digest": {
-        "sha256": "f503699161ce5a67406153ed12a57c44a3a6b96260c141dd461a38be80eb854e"
+        "sha256": "e3ef927c9a1f228c06c23c4a3909da6fa2e4d56f9bde68ac9fcba3976899fa96"
       }
     },
     {
       "name": "packages/core/dist/index.js",
       "digest": {
-        "sha256": "579d557348c11234d9e77a77bdd5f251abbd6c7742d5840c3b0e8883aed8aa16"
+        "sha256": "307fc3b0a93d259d6ce1136a2b711782dc7b185dd7a690172e2cf1c016d992f3"
       }
     },
     {
@@ -46,25 +46,25 @@
     {
       "name": "packages/frameworks/angular/dist/index.js",
       "digest": {
-        "sha256": "a40a05b15047e7d72df517fa4f8a63039ba0791bb0a59f1aec11f87f51b4a9e0"
+        "sha256": "ef2156c7c237e6ddd245792022f39e680abc0650ea20779c47feb96bf6b822bd"
       }
     },
     {
       "name": "packages/frameworks/angularjs/dist/index.js",
       "digest": {
-        "sha256": "32a156567e0e193c851cfbf12b9a3ba2346145bf624a68e422b1ef12e2120f6b"
+        "sha256": "f365d232d16f7003ec0159daa06cc4ab4556787efd8d775a2206c9aee7481c32"
       }
     },
     {
       "name": "packages/frameworks/nextjs/dist/index.js",
       "digest": {
-        "sha256": "5bf951cec5b59c987d1778f69ba8ed08cb6343c889fd3ea412dc2413fec937b5"
+        "sha256": "d51d631abf9d0d1ef664c9233f7409ce5c6c14f52e9136e9f6430082102f034c"
       }
     },
     {
       "name": "packages/frameworks/react/dist/index.js",
       "digest": {
-        "sha256": "5515304e7b4de4e1cb017f5c7d87cc6d4e11fb2f1d920049b96fb548200f0116"
+        "sha256": "36a3506ace71589a8998654cd5b00f5b4ef569da7790c5df131f05c086542a09"
       }
     },
     {
@@ -76,7 +76,7 @@
     {
       "name": "packages/trust/dist/index.js",
       "digest": {
-        "sha256": "0145c9814c91e8c83a4a42ed650071f5e2b4dd8bba795f6f804037806a4432d3"
+        "sha256": "bbcbba26c4d53e55af02a2044f8d06221b74d1460e68f158e282790430a9d647"
       }
     }
   ],
@@ -366,55 +366,55 @@
       "byproducts": [
         {
           "path": "packages/cli/dist/cli.js",
-          "sha256": "5934a4ec73d86766303db0d859a6267884c4d67592649391e4e0e0b1ff2d8ed0"
+          "sha256": "d6ee1f1926094aa7c33354566055a6b031dfd5f1b3defa185384f5f08d9534d9"
         },
         {
           "path": "packages/cli/dist/index.js",
-          "sha256": "cc7cb8aa8871ee384d23a7b8b2a897cf2b70dc5fdcb559cd859e580d3db35538"
+          "sha256": "be10fbdc757857a86d152407ffe32f69b23c49e131bb86373fb8c70e198a906c"
         },
         {
-          "path": "packages/cli/dist/real-app-run-D3mBk8PB.js",
-          "sha256": "d8d2fc9c1155b794c538d3b0ed50ec954043c6af3ba46876db45e8c86871fb39"
+          "path": "packages/cli/dist/real-app-run-DJVFWx3a.js",
+          "sha256": "eafb60d2462be83e705b13bf2558dc2a6039954fd2c8ed12d92ed044119c1412"
         },
         {
-          "path": "packages/cli/dist/real-app-run-Mn6wTDau.js",
-          "sha256": "aa69533361973b2ab96cfd0fa2dba649848e7aac28b39d39ab05b40abc4fc95e"
+          "path": "packages/cli/dist/real-app-run-oHuzQh4Z.js",
+          "sha256": "b430923716e5c57491e2124c0cdcf1a860659f589600aafd49f88f9152f6473e"
         },
         {
-          "path": "packages/cli/dist/verify-DZrf0lkA.js",
-          "sha256": "f503699161ce5a67406153ed12a57c44a3a6b96260c141dd461a38be80eb854e"
+          "path": "packages/cli/dist/verify-BlHvLyCQ.js",
+          "sha256": "e3ef927c9a1f228c06c23c4a3909da6fa2e4d56f9bde68ac9fcba3976899fa96"
         },
         {
           "path": "packages/core/dist/index.js",
-          "sha256": "579d557348c11234d9e77a77bdd5f251abbd6c7742d5840c3b0e8883aed8aa16"
+          "sha256": "307fc3b0a93d259d6ce1136a2b711782dc7b185dd7a690172e2cf1c016d992f3"
         },
         {
           "path": "packages/experiments/dist/index.js",
           "sha256": "d8010f506021916daca5893223078a3a4ca767cdd0a091dfc71db31ea46f3440"
         },
         {
           "path": "packages/frameworks/angular/dist/index.js",
-          "sha256": "a40a05b15047e7d72df517fa4f8a63039ba0791bb0a59f1aec11f87f51b4a9e0"
+          "sha256": "ef2156c7c237e6ddd245792022f39e680abc0650ea20779c47feb96bf6b822bd"
         },
         {
           "path": "packages/frameworks/angularjs/dist/index.js",
-          "sha256": "32a156567e0e193c851cfbf12b9a3ba2346145bf624a68e422b1ef12e2120f6b"
+          "sha256": "f365d232d16f7003ec0159daa06cc4ab4556787efd8d775a2206c9aee7481c32"
         },
         {
           "path": "packages/frameworks/nextjs/dist/index.js",
-          "sha256": "5bf951cec5b59c987d1778f69ba8ed08cb6343c889fd3ea412dc2413fec937b5"
+          "sha256": "d51d631abf9d0d1ef664c9233f7409ce5c6c14f52e9136e9f6430082102f034c"
         },
         {
           "path": "packages/frameworks/react/dist/index.js",
-          "sha256": "5515304e7b4de4e1cb017f5c7d87cc6d4e11fb2f1d920049b96fb548200f0116"
+          "sha256": "36a3506ace71589a8998654cd5b00f5b4ef569da7790c5df131f05c086542a09"
         },
         {
           "path": "packages/node-guard/dist/index.cjs",
           "sha256": "712511b49d6118cc33dff524dd2ea7aa9061eb80a8df0fb2c0ee4a3bc50ed8b6"
         },
         {
           "path": "packages/trust/dist/index.js",
-          "sha256": "0145c9814c91e8c83a4a42ed650071f5e2b4dd8bba795f6f804037806a4432d3"
+          "sha256": "bbcbba26c4d53e55af02a2044f8d06221b74d1460e68f158e282790430a9d647"
         }
       ]
     }

evidence/trust/current/report.md

@@ -1,8 +1,8 @@
 # Versionless project trust package
 
-- Canonical SHA-256: `c54ef520e6f725c4389653f0d78a8e9ccdf3af3d4de1297147e63106f58936a3`
-- Deterministic core: `f29165f7e62c18a36bc73e8b4a3c26b473a61ad537bdfbc0898631a313242c01`
-- Generated observation: `2026-08-22T21:39:19.557Z`
+- Canonical SHA-256: `882cc9f257e1a2e4c11ccae0192992305d1cdafdd5ede66879998128413125ee`
+- Deterministic core: `9c04cf7c657b05e7fb188f143f72ebb082fe45d912bdfb8e6fab0ff8f0f7ae8c`
+- Generated observation: `2026-08-22T21:44:35.221Z`
 - Vulnerability input freshness: **verified** (seven-day maximum age)
 - Integrity: **hash-only; authenticity is not established**
 - Assurance: **this package is evidence, not certification, legal assurance, PCI compliance, or SOC 2 attestation**