@sdd-method/author-cli 0.0.0-stage → 0.1.0

package/dist/lib/validate/bundle-coherence.js

@@ -0,0 +1,74 @@
+// Profile → bundle coherence (A2 of the bundle-migration plan).
+//
+// A repo's declared profile (`.sdd/sdd-manifest.yaml`) and the forward base
+// its lock carries can silently disagree: a reclassification edits the
+// manifest, nothing re-syncs the bundle, and no instrument notices — the
+// registration/adoption-lag class. Measured instance: two platform-subsystem
+// repos carried app-baseline for eight days, found by a human sweep.
+//
+// REPORTING-ONLY: a mismatch prints a [REPORT] line with the migration path
+// and exits 0. Gating is a later, deliberate change-set once both estates
+// read 0 (the scores-coverage precedent, M-ADR 0205 §4.5).
+import { readLockFile, findForwardBase } from "../lock-file.js";
+import { loadSddManifest, } from "../catalogue/manifest-loader.js";
+import { getSddCliVersion } from "../package-version.js";
+/**
+ * Manifest profile → the forward base that profile expects. Profiles with no
+ * entry (support-repo, organisation-profile) carry no expectation — silence,
+ * not a guess. NOTE: platform-subsystem is a CATEGORY under platform-profile,
+ * so the two measured mismatch repos resolve through the platform-profile row.
+ */
+const EXPECTED_FORWARD_BASE = {
+    "platform-profile": "platform-baseline",
+    "application-product": "app-baseline",
+    "integration-product": "integration-baseline",
+};
+export async function checkBundleCoherence(targetRepo) {
+    const lines = [];
+    const lock = await readLockFile(targetRepo);
+    const forwardBase = findForwardBase(lock);
+    if (!forwardBase) {
+        return {
+            exitCode: 0,
+            stdout: "",
+            skipped: "no forward base in method-baseline.lock — nothing to check",
+        };
+    }
+    let profile;
+    try {
+        const manifest = await loadSddManifest(targetRepo, {
+            cliVersion: getSddCliVersion(),
+        });
+        profile = manifest.profile;
+    }
+    catch (err) {
+        // Reporting-only: an absent/invalid manifest is its own (already-gated)
+        // problem; this check must not double-report it as a bundle mismatch.
+        return {
+            exitCode: 0,
+            stdout: "",
+            skipped: `manifest unavailable (${err.message.split("\n")[0]})`,
+        };
+    }
+    const expected = EXPECTED_FORWARD_BASE[profile];
+    if (expected === undefined) {
+        // Nothing to compare is not a pass: counting it as one inflated the
+        // suite's "passed" figure for profiles that carry no expectation.
+        return {
+            exitCode: 0,
+            stdout: "",
+            skipped: `profile '${profile}' declares no forward-base expectation — nothing to compare`,
+        };
+    }
+    if (forwardBase.name === expected) {
+        lines.push(`[PASS] bundle-coherence: profile '${profile}' ↔ forward base '${forwardBase.name}'\n`);
+        return { exitCode: 0, stdout: lines.join("") };
+    }
+    lines.push(`[REPORT] bundle-coherence: profile '${profile}' expects forward base '${expected}' ` +
+        `but the lock carries '${forwardBase.name}' — profile and bundle disagree. ` +
+        `Migration path: sdd-cli sync --bundle <${expected} tarball> --replace-bundle ${forwardBase.name} --dry-run, ` +
+        `review the three-way split, then re-run with --yes. ` +
+        `(Reporting-only; this check does not gate.)\n`);
+    return { exitCode: 0, stdout: lines.join("") };
+}
+//# sourceMappingURL=bundle-coherence.js.map

package/dist/lib/validate/dispatch.js

@@ -0,0 +1,243 @@
+import { checkBundleCoherence } from "./bundle-coherence.js";
+import { checkYamlParse } from "./yaml-parse.js";
+// Validators that accept --app-root / --repo-root flags work fine from the
+// bundled location because they override their internal ROOT_DIR via the
+// flag. Validators without that flag (adr-structure, runway-classification,
+// spec-lifecycle) compute ROOT_DIR as SCRIPT_DIR/../.. — so we must run the
+// copy that sync placed inside the target repo, not the bundled sdd-cli copy.
+const APP_VALIDATORS = [
+    {
+        name: "app-docs",
+        source: { kind: "bundled", script: "validate-app-docs.sh" },
+        build: (ctx) => ({ status: "run", args: ["--app-root", ctx.targetRepo] }),
+    },
+    {
+        name: "app-dependencies",
+        source: { kind: "bundled", script: "validate-app-dependencies.sh" },
+        // NO LONGER SKIPS WITHOUT --platform-root. It used to, and the consequence was
+        // that the validator had never executed: measured across 22/22 forward-estate
+        // app repos it skipped every time, because nothing passes --platform-root, and
+        // the suite printed "All validators passed" over the skip.
+        //
+        // Only the resolution halves of checks 2 and 3 need a platform surface. The
+        // stability vocabulary, "is a service_id declared", and "does a locked
+        // dependency name a contract_path" are all answerable in the app repo alone,
+        // and they are the more basic defects. The script now runs those and reports
+        // the resolutions it could not perform, with their denominator — a partial run
+        // that never claims the gate is met (M-ADR 0200 §4.3).
+        build: (ctx) => ({
+            status: "run",
+            args: [
+                "--app-root",
+                ctx.targetRepo,
+                ...(ctx.platformRoot ? ["--platform-root", ctx.platformRoot] : []),
+            ],
+        }),
+    },
+    {
+        name: "adr-structure",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-adr-structure.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "spec-lifecycle",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-spec-lifecycle.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "no-bare-adr",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-no-bare-adr.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "bundle-coherence",
+        source: {
+            kind: "native",
+            run: async (ctx) => checkBundleCoherence(ctx.targetRepo),
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "yaml-parse",
+        source: {
+            kind: "native",
+            run: async (ctx) => checkYamlParse(ctx.targetRepo),
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    // Note: validate-runway-classification is intentionally NOT in the app set.
+    // It requires platform-level files (docs/platform/feature-tree.md,
+    // architecture-runway-index.md) that app repos don't own. Per ADR 0089,
+    // the reduced app suite is app-specific validators + shared foundations,
+    // not platform validators.
+];
+const INTEGRATION_VALIDATORS = [
+    {
+        name: "integration-docs",
+        source: { kind: "bundled", script: "validate-integration-docs.sh" },
+        build: (ctx) => ({ status: "run", args: ["--repo-root", ctx.targetRepo] }),
+    },
+    {
+        name: "adr-structure",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-adr-structure.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "spec-lifecycle",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-spec-lifecycle.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "no-bare-adr",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-no-bare-adr.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "bundle-coherence",
+        source: {
+            kind: "native",
+            run: async (ctx) => checkBundleCoherence(ctx.targetRepo),
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "yaml-parse",
+        source: {
+            kind: "native",
+            run: async (ctx) => checkYamlParse(ctx.targetRepo),
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+];
+const PLATFORM_VALIDATORS = [
+    {
+        name: "traceability",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-traceability.sh",
+        },
+        build: () => ({ status: "run", args: ["all"] }),
+    },
+    {
+        name: "runway-classification",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-runway-classification.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "adr-structure",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-adr-structure.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "spec-lifecycle",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-spec-lifecycle.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "no-bare-adr",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-no-bare-adr.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "corpus-consistency",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-corpus-consistency.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "config",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-config.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "gate-readiness",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-gate-readiness.sh",
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "bundle-coherence",
+        source: {
+            kind: "native",
+            run: async (ctx) => checkBundleCoherence(ctx.targetRepo),
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    {
+        name: "yaml-parse",
+        source: {
+            kind: "native",
+            run: async (ctx) => checkYamlParse(ctx.targetRepo),
+        },
+        build: () => ({ status: "run", args: [] }),
+    },
+    // Optional: the upstream validate-docs.sh dispatcher covers the 6
+    // conditional validators (backward-compatibility, deprecation-runway,
+    // migration-completeness, ddd-artifacts, glossary-alignment,
+    // intent-quality-readiness) and self-skips when their inputs (BASELINE.md,
+    // gate-registry files) aren't present. Invoked via --validator docs-all.
+    {
+        name: "docs-all",
+        source: {
+            kind: "target-repo",
+            relPath: "orchestration/scripts/validate-docs.sh",
+        },
+        build: () => ({ status: "run", args: ["all"] }),
+        optional: true,
+    },
+];
+export function validatorsForProfile(profile) {
+    if (profile === "platform")
+        return PLATFORM_VALIDATORS;
+    return profile === "application" ? APP_VALIDATORS : INTEGRATION_VALIDATORS;
+}
+export function selectValidators(profile, filter) {
+    const all = validatorsForProfile(profile);
+    if (!filter)
+        return all.filter((v) => v.optional !== true);
+    const matched = all.find((v) => v.name === filter);
+    if (!matched) {
+        throw new Error(`Unknown validator "${filter}" for ${profile} profile. Available: ${all
+            .map((v) => v.name)
+            .join(", ")}`);
+    }
+    return [matched];
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/lib/validate/index.js

@@ -0,0 +1,110 @@
+import { profileFromRepoKind, readRepoKind } from "../repo-kind.js";
+import { aggregateResults, classifyResult } from "./aggregate.js";
+import { selectValidators } from "./dispatch.js";
+import { runValidator } from "./runner.js";
+const SECTION_RULE = "═".repeat(59);
+export async function runValidate(opts, stdout = (line) => process.stdout.write(line)) {
+    const repoKind = await readRepoKind(opts.targetRepo);
+    if (repoKind === null) {
+        stdout(fail(`Not an SDD repo: no .sdd-repo-kind marker in ${opts.targetRepo}`));
+        return { exitCode: 1, summary: emptySummary() };
+    }
+    const profile = profileFromRepoKind(repoKind);
+    stdout(section(`Validate (${profile})`));
+    let validators;
+    try {
+        validators = selectValidators(profile, opts.validator);
+    }
+    catch (err) {
+        stdout(fail(err.message));
+        return { exitCode: 1, summary: emptySummary() };
+    }
+    const results = [];
+    for (const cfg of validators) {
+        stdout(info(`Running ${cfg.name}`));
+        const result = await runValidator(cfg, {
+            targetRepo: opts.targetRepo,
+            ...(opts.platformRoot ? { platformRoot: opts.platformRoot } : {}),
+        });
+        results.push(result);
+        if (result.status === "skip") {
+            stdout(skip(`${cfg.name}: skipped — ${result.reason}`));
+            continue;
+        }
+        if (result.stdout)
+            stdout(result.stdout);
+        if (result.stderr)
+            stdout(result.stderr);
+        if (result.exitCode !== 0)
+            stdout(fail(`${cfg.name}: exit ${result.exitCode}`));
+        else if (classifyResult(result, { strict: opts.strict }) === "not-measured") {
+            stdout(na(`${cfg.name}: nothing measured — its population is empty`));
+        }
+        else
+            stdout(pass(`${cfg.name}: ok`));
+    }
+    const summary = aggregateResults(results, { strict: opts.strict });
+    stdout(info(`Summary: passed=${summary.passed} failed=${summary.failed} skipped=${summary.skipped} ` +
+        `not-measured=${summary.notMeasured} warned=${summary.warned}${opts.strict ? " (strict)" : ""}`));
+    stdout(verdict(summary, validators.length));
+    return { exitCode: summary.exitCode, summary };
+}
+// Every verdict states its denominator. A skipped validator did not run, so it
+// cannot be covered by a green verdict: "all passed" with one skipped and "all
+// passed" with none were previously the same line (M-ADR 0200 §4.3). The
+// exit code is deliberately unchanged — the defect is the claim, not the
+// gating; whether an unexecutable validator should FAIL is the open design
+// question (post-3.0.0-followons.md A2), not this one.
+function verdict(summary, selected) {
+    if (summary.exitCode !== 0)
+        return fail("One or more validators failed");
+    const ran = summary.passed + summary.failed;
+    const nm = summary.notMeasured;
+    if (summary.skipped === 0 && nm === 0)
+        return pass("All validators passed");
+    if (ran === 0 && nm === 0) {
+        return warn(`0 of ${selected} validators ran — all ${summary.skipped} skipped. ` +
+            `This is an absence of evidence, not a pass.`);
+    }
+    if (nm === 0) {
+        return warn(`${ran} of ${selected} validators passed — ${summary.skipped} skipped, ` +
+            `and a skipped validator is not covered by this verdict.`);
+    }
+    const uncovered = [
+        summary.skipped > 0 ? `${summary.skipped} skipped` : "",
+        nm > 0 ? `${nm} measured nothing (an empty population)` : "",
+    ]
+        .filter(Boolean)
+        .join(", ");
+    if (ran === 0) {
+        return warn(`0 of ${selected} validators measured anything — ${uncovered}. ` +
+            `This is an absence of evidence, not a pass.`);
+    }
+    return warn(`${ran} of ${selected} validators passed — ${uncovered}; ` +
+        `neither is covered by this verdict.`);
+}
+function section(title) {
+    return `\n${SECTION_RULE}\n  ${title}\n${SECTION_RULE}\n\n`;
+}
+function info(msg) {
+    return `[INFO] ${msg}\n`;
+}
+function pass(msg) {
+    return `[PASS] ${msg}\n`;
+}
+function fail(msg) {
+    return `[FAIL] ${msg}\n`;
+}
+function skip(msg) {
+    return `[SKIP] ${msg}\n`;
+}
+function na(msg) {
+    return `[N/A] ${msg}\n`;
+}
+function warn(msg) {
+    return `[WARN] ${msg}\n`;
+}
+function emptySummary() {
+    return { exitCode: 1, passed: 0, failed: 0, skipped: 0, warned: 0, notMeasured: 0 };
+}
+//# sourceMappingURL=index.js.map

package/dist/lib/validate/plan.js

@@ -0,0 +1,54 @@
+/**
+ * The method-managed validation job, as DATA (bead sdm-dd6.2; Dagger ruling sdm-s48, 2026-10-15).
+ *
+ * One ordered plan per profile: every default validator, the platform's script-only checks, then the
+ * advisory catalogue freshness check. Every executor renders or runs THIS: the GitHub workflow
+ * generator (ci-workflow.ts) and the Dagger module (via `sdd-verify validate --list`). The job list
+ * drifted once when CI kept a hand copy of the suite (2026-10-01: three validators never reached CI),
+ * so no executor may keep its own list.
+ */
+import { validatorsForProfile } from "./dispatch.js";
+/** Titles kept from the hand-kept list, so step names stay readable. */
+const TITLES = {
+    "adr-structure": "Validate ADR metadata",
+    "spec-lifecycle": "Validate spec lifecycle",
+    "no-bare-adr": "Reject bare ADR references",
+    traceability: "Validate traceability",
+    "runway-classification": "Validate runway classification",
+    "corpus-consistency": "Validate corpus consistency",
+    config: "Validate configuration",
+    "app-docs": "Validate app documentation",
+    "integration-docs": "Validate integration documentation",
+    "yaml-parse": "Validate that tracked YAML parses",
+    "gate-readiness": "Validate gate readiness",
+    "bundle-coherence": "Report bundle coherence",
+    // CI has no platform checkout, so this step runs the app-only checks; the met gate needs the platform beside it.
+    "app-dependencies": "Validate app dependencies (app-only checks; no platform checkout in CI)",
+};
+export function methodValidationPlan(profile) {
+    const steps = validatorsForProfile(profile)
+        .filter((v) => v.optional !== true)
+        .map((v) => ({
+        id: v.name,
+        title: TITLES[v.name] ?? `Validate ${v.name}`,
+        tool: "sdd-verify",
+        args: ["validate", "--target-repo", ".", "--validator", v.name],
+        advisory: false,
+    }));
+    if (profile === "platform") {
+        steps.push({ id: "cascade-completeness", title: "Validate cascade completeness", tool: "bash", args: ["orchestration/scripts/validate-cascade-completeness.sh", "all"], advisory: false }, { id: "architecture-alignment", title: "Validate architecture alignment", tool: "bash", args: ["orchestration/scripts/validate-architecture-alignment.sh"], advisory: false });
+    }
+    steps.push({
+        id: "catalogue-freshness",
+        title: "Check catalogues reproduce from the specs (advisory)",
+        tool: "sdd-maintain",
+        args: ["catalogue", "build", "--check", "--sdd-path", "."],
+        advisory: true,
+    });
+    return steps;
+}
+/** The shell form of a step, as a CI host's `run:` line writes it. */
+export function stepCommand(step) {
+    return [step.tool, ...step.args].join(" ");
+}
+//# sourceMappingURL=plan.js.map

package/dist/lib/validate/runner.js

@@ -0,0 +1,85 @@
+import { execFile as execFileCb } from "node:child_process";
+import { access } from "node:fs/promises";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { resolveBundledScript } from "../scripts.js";
+const execFile = promisify(execFileCb);
+export async function runValidator(cfg, ctx) {
+    const built = cfg.build(ctx);
+    if (built.status === "skip") {
+        return {
+            name: cfg.name,
+            scriptPath: null,
+            status: "skip",
+            reason: built.reason,
+        };
+    }
+    if (cfg.source.kind === "native") {
+        const r = await cfg.source.run(ctx);
+        if (r.skipped !== undefined) {
+            return {
+                name: cfg.name,
+                scriptPath: "(native)",
+                status: "skip",
+                reason: r.skipped,
+            };
+        }
+        return {
+            name: cfg.name,
+            scriptPath: "(native)",
+            status: "run",
+            exitCode: r.exitCode,
+            stdout: r.stdout,
+            stderr: "",
+        };
+    }
+    const resolved = await resolveScriptPath(cfg.source, ctx);
+    if (!resolved.exists) {
+        return {
+            name: cfg.name,
+            scriptPath: resolved.path,
+            status: "skip",
+            reason: `script not found in target repo (${resolved.path}); expected sync to have placed it there`,
+        };
+    }
+    try {
+        const { stdout, stderr } = await execFile("bash", [resolved.path, ...built.args], {
+            cwd: ctx.targetRepo,
+            encoding: "utf8",
+            maxBuffer: 16 * 1024 * 1024,
+        });
+        return {
+            name: cfg.name,
+            scriptPath: resolved.path,
+            status: "run",
+            exitCode: 0,
+            stdout,
+            stderr,
+        };
+    }
+    catch (err) {
+        const e = err;
+        return {
+            name: cfg.name,
+            scriptPath: resolved.path,
+            status: "run",
+            exitCode: typeof e.code === "number" ? e.code : 1,
+            stdout: e.stdout ?? "",
+            stderr: e.stderr ?? "",
+        };
+    }
+}
+async function resolveScriptPath(source, ctx) {
+    if (source.kind === "bundled") {
+        return { exists: true, path: resolveBundledScript(source.script) };
+    }
+    const path = join(ctx.targetRepo, source.relPath);
+    try {
+        await access(path);
+        return { exists: true, path };
+    }
+    catch {
+        return { exists: false, path };
+    }
+}
+//# sourceMappingURL=runner.js.map

package/dist/lib/validate/yaml-parse.js

@@ -0,0 +1,112 @@
+// YAML parse gate — every tracked YAML source must parse STRICTLY.
+//
+// The catalogue builders read YAML file by file and, for most sources, log
+// `invalid YAML` and move on: the file becomes wholly invisible to the
+// catalogue and nothing ever fails. Measured: 19 unparseable files across 4
+// SDDs, 16 in one repo, accumulated that way.
+//
+// THE LOADER IS THE GATE. PyYAML (and any last-key-wins loader) accepts a
+// duplicate key and silently keeps the second value, so a parse-only check
+// with it certifies exactly the corruption a line-surgery transformer
+// produces. `yaml` v2 refuses duplicate keys (DUPLICATE_KEY) and the other
+// malformations a lenient parse glosses — e.g. a `: ` inside an unquoted
+// scalar (`path: (none — tel: URL)`), which no pattern rule catches.
+//
+// Scope: the YAML files git TRACKS (`*.yaml`, `*.yml`) — the repo's sources,
+// not build output or dependencies. Outside a git work tree there is no
+// honest scope, so the check reports a SKIP rather than a pass.
+//
+// A TEMPLATE is not YAML until rendered (Helm/Go `{{- … -}}`, Handlebars).
+// A file that fails to parse AND carries a template directive is listed as
+// templated and not failed — UNLESS one of its errors is a duplicate key: a
+// duplicate key is a duplicate however the file is produced, and exempting it
+// would let any `{{ }}` in a value hide exactly the defect this gate exists for.
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { parseAllDocuments } from "yaml";
+const execFileAsync = promisify(execFile);
+const TEMPLATE_DIRECTIVE_RE = /\{\{[\s\S]*?\}\}/;
+/** Strict-parse one YAML text; returns the errors (empty = parses). */
+export function strictYamlErrors(text) {
+    return parseAllDocuments(text).flatMap((doc) => doc.errors.map((e) => ({
+        code: e.code,
+        message: e.message.split("\n")[0] ?? e.message,
+    })));
+}
+async function trackedYamlFiles(repo) {
+    try {
+        const { stdout } = await execFileAsync("git", ["-C", repo, "ls-files", "-z", "--", "*.yaml", "*.yml"], { maxBuffer: 64 * 1024 * 1024 });
+        return stdout.split("\0").filter((p) => p !== "");
+    }
+    catch {
+        return null;
+    }
+}
+export async function checkYamlParse(targetRepo) {
+    const files = await trackedYamlFiles(targetRepo);
+    if (files === null) {
+        return {
+            exitCode: 0,
+            stdout: "",
+            skipped: "not a git work tree — no tracked-file scope to check",
+        };
+    }
+    const failures = [];
+    const templated = [];
+    let read = 0;
+    for (const file of files) {
+        let text;
+        try {
+            text = await readFile(join(targetRepo, file), "utf-8");
+        }
+        catch {
+            continue; // tracked but deleted in the work tree: not a parse question
+        }
+        read += 1;
+        const errors = strictYamlErrors(text);
+        if (errors.length > 0 &&
+            !errors.some((e) => e.code === "DUPLICATE_KEY") &&
+            TEMPLATE_DIRECTIVE_RE.test(text)) {
+            templated.push(file);
+            continue;
+        }
+        for (const e of errors) {
+            failures.push({ file, code: e.code, message: e.message });
+        }
+    }
+    const checked = read - templated.length;
+    const templatedNote = templated.length === 0
+        ? ""
+        : `[INFO] yaml-parse: ${templated.length} templated file(s) not checked — they do not parse ` +
+            `until rendered and carry a {{ … }} directive: ${templated.join(", ")}\n`;
+    if (failures.length === 0 && checked === 0) {
+        // Zero files checked is absence of evidence, never a pass.
+        return {
+            exitCode: 0,
+            stdout: templatedNote,
+            skipped: "no tracked YAML files to parse — nothing to check",
+        };
+    }
+    if (failures.length === 0) {
+        return {
+            exitCode: 0,
+            stdout: templatedNote +
+                `[PASS] yaml-parse: ${checked} tracked YAML file(s) parse strictly (duplicate keys refused)\n`,
+        };
+    }
+    const failedFiles = new Set(failures.map((f) => f.file)).size;
+    const byCode = new Map();
+    for (const f of failures)
+        byCode.set(f.code, (byCode.get(f.code) ?? 0) + 1);
+    const lines = failures.map((f) => `[FAIL] yaml-parse: ${f.file}: ${f.code}: ${f.message}\n`);
+    if (templatedNote !== "")
+        lines.unshift(templatedNote);
+    lines.push(`[FAIL] yaml-parse: ${failedFiles} of ${checked} tracked YAML file(s) do not parse strictly ` +
+        `(${[...byCode].map(([c, n]) => `${c} ×${n}`).join(", ")}). ` +
+        `A file that does not parse is invisible to the catalogue; a duplicate key keeps only one ` +
+        `of its values under a lenient loader. Fix the file — do not relax the loader.\n`);
+    return { exitCode: 1, stdout: lines.join("") };
+}
+//# sourceMappingURL=yaml-parse.js.map

package/dist/maintain-version.json

@@ -0,0 +1,4 @@
+{
+  "version": "0.2.0",
+  "built_against_sdd_cli": "1.43.0"
+}