@sdd-method/sdd-cli 1.41.0 → 1.43.0

package/scripts/maintain-acceptance.mjs

@@ -0,0 +1,240 @@
+#!/usr/bin/env node
+// Acceptance for the maintain CLI — M-ADR 0218 §4.2–4.3.
+//
+// The property: every write sdd-maintain makes is DERIVED or METHOD-MANAGED, and is a
+// deterministic function of its inputs. Tested, not asserted. For each workspace: fresh clones,
+// each maintain verb run twice, and after each run
+//   (a) SCOPE: every path `git status --porcelain --ignored` reports is in the
+//       derived-and-managed set (the lock's own managed paths included);
+//   (b) DETERMINISM: the second run on the same commit leaves exactly the bytes the first did.
+// Fails closed on: an out-of-set write, a second run that changes anything, a verb that crashes,
+// and the CONTROL: a deliberate out-of-set write must be SEEN, or every PASS is vacuous.
+// Verbs it cannot exercise in a workspace are listed under COVERAGE, never passed silently.
+//
+//   (c) PARITY: the same verb run by the full sdd-cli (--control-bin) on a twin workspace leaves a
+//       byte-identical tree. Scope and determinism cannot see a verb that crashes or renders
+//       differently; verify-cli learned the same lesson (0.1.0 shipped missing bundled scripts).
+// usage: maintain-acceptance.mjs --bin <maintain-bin.js> --control-bin <sdd-cli cli.js> --dist <sdd-method dist dir> <sdd-repo>...
+//   Each <sdd-repo> is cloned with the siblings its aggregation manifest names (paths kept),
+//   so `catalogue aggregate` runs on a platform root.
+
+import { execFileSync, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join, relative, resolve } from "node:path";
+
+const args = process.argv.slice(2);
+const opt = (k) => { const i = args.indexOf(k); if (i === -1) return undefined; const v = args[i + 1]; args.splice(i, 2); return v; };
+const BIN = resolve(opt("--bin") ?? die("--bin required"));
+const DIST = resolve(opt("--dist") ?? die("--dist required"));
+const CONTROL = resolve(opt("--control-bin") ?? die("--control-bin required (the full sdd-cli, for parity)"));
+const REPOS = args.map((a) => resolve(a));
+if (REPOS.length === 0) die("give at least one SDD repository");
+
+function die(m) { process.stderr.write(`maintain-acceptance: ${m}\n`); process.exit(2); }
+let FAIL = 0;
+const fail = (m) => { FAIL++; process.stdout.write(`  FAIL ${m}\n`); };
+const ok = (m) => process.stdout.write(`  ok   ${m}\n`);
+const exercised = new Set();
+
+// ---- the derived-and-managed set (M-ADR 0218 §4.3) -------------------------------------------
+const FIXED = [
+  /^method-baseline\.lock$/, /^\.sdd-repo-kind$/,                    // item 2
+  /^\.github\/workflows\/method-validation\.yml$/,                   // item 3 (block-merged)
+  /^\.gitlab-ci\.yml$/, /^\.jenkins\/method-validation\.Jenkinsfile$/, // item 3, the other CI bindings (M-ADR 0219 §4.4)
+  /^\.dagger\/method-validation\//,                                   // item 3, the module every binding calls (M-ADR 0219 §4.3)
+  /^agent-instructions\.md$/, /^CLAUDE\.md$/, /^AGENTS\.md$/,        // item 4
+  /^\.claude\/settings\.json$/, /^\.github\/hooks\//, /^\.github\/copilot\//, // item 5
+  /^catalogues\//, /^catalogues-aggregated\//, /^catalogues(-aggregated)?-graph\.jsonl$/, // item 7
+  /^\.sdd\/bundle-cache\//,                                           // sync's cache of the last-applied bundle (managed by sync itself)
+  /^MCP_SETUP\.md$/,                                                  // item 9 (code repo)
+];
+function lockManaged(repo) {
+  const p = join(repo, "method-baseline.lock");
+  if (!existsSync(p)) return new Set();
+  const out = new Set();
+  for (const line of readFileSync(p, "utf8").split("\n")) {
+    const m = /^ {6}- "?(?:[0-9a-f]{64} {2})?([^"]+)"?$/.exec(line);
+    if (m) out.add(m[1]);
+  }
+  return out;
+}
+function outOfSet(repo, managed) {
+  const st = spawnSync("git", ["-C", repo, "status", "--porcelain", "--ignored", "--untracked-files=all"], { encoding: "utf8" });
+  const bad = [];
+  for (const line of st.stdout.split("\n").filter(Boolean)) {
+    let p = line.slice(3);
+    if (p.includes(" -> ")) p = p.split(" -> ")[1];
+    p = p.replace(/^"|"$/g, "");
+    if (managed.has(p) || FIXED.some((rx) => rx.test(p))) continue;
+    bad.push(p);
+  }
+  return bad;
+}
+// A digest of every file git reports as changed, for the determinism check.
+// Workspace roots are normalised so the twin (another temp path) can be compared: context pull, for
+// one, writes the SDD's absolute path into what it renders.
+function snapshot(repo, roots = []) {
+  const st = spawnSync("git", ["-C", repo, "status", "--porcelain", "--ignored", "--untracked-files=all"], { encoding: "utf8" });
+  const h = createHash("sha256");
+  for (const line of st.stdout.split("\n").filter(Boolean).sort()) {
+    const p = line.slice(3).split(" -> ").pop().replace(/^"|"$/g, "");
+    h.update(line.slice(0, 3) + p + "\0");
+    const abs = join(repo, p);
+    if (existsSync(abs) && statSync(abs).isFile()) {
+      let text = readFileSync(abs, "latin1");
+      for (const r of roots) text = text.split(r).join("<WS>");
+      h.update(text, "latin1");
+    }
+  }
+  return h.digest("hex");
+}
+
+// ---- workspace -------------------------------------------------------------------------------
+// Each workspace clones a whole manifest tree (up to ~55k inodes), and /tmp is a tmpfs whose inode
+// table is the real limit: one release's runs leaked ~450k and filled it. Removed on every exit,
+// failures included; MAINTAIN_ACC_KEEP=1 keeps them for inspection.
+const workspaces = [];
+process.on("exit", () => {
+  if (process.env.MAINTAIN_ACC_KEEP) return void process.stderr.write(`maintain-acceptance: kept ${workspaces.join(" ")}\n`);
+  for (const ws of workspaces) rmSync(ws, { recursive: true, force: true });
+});
+function cloneTree(root) {
+  const ws = mkdtempSync(join(tmpdir(), "maintain-acc-"));
+  workspaces.push(ws);
+  const base = dirname(root);
+  const todo = [root];
+  const seen = new Set();
+  const missing = [];
+  while (todo.length) {
+    const src = todo.pop();
+    if (seen.has(src)) continue;
+    seen.add(src);
+    const dest = join(ws, relative(base, src));
+    mkdirSync(dirname(dest), { recursive: true });
+    execFileSync("git", ["clone", "-q", "--no-hardlinks", src, dest]);
+    const man = join(src, "orchestration", "aggregation-manifest.yaml");
+    if (existsSync(man)) {
+      for (const m of readFileSync(man, "utf8").matchAll(/path: "([^"]+)"/g)) {
+        let p = resolve(src, m[1]);
+        if (["catalogues", "catalogues-aggregated"].includes(basename(p))) p = dirname(p);
+        if (existsSync(join(p, ".git"))) todo.push(p);
+        else missing.push(relative(base, p));
+      }
+    }
+  }
+  return { ws, clone: join(ws, basename(root)), base, missing };
+}
+const run = (repo, verbArgs, bin = BIN) => spawnSync("node", [bin, ...verbArgs], { cwd: repo, encoding: "utf8" });
+// The twin workspace's path for a path in the primary one (parity runs mirror every call).
+let TWIN = null;
+const twinOf = (p) => (TWIN && p.startsWith(TWIN.from) ? TWIN.to + p.slice(TWIN.from.length) : p);
+function twice(label, repo, verbArgs, managedFn, { allowNonZero = false } = {}) {
+  const r1 = run(repo, verbArgs);
+  // An uncaught error (maintain-bin prints "sdd-maintain: <message>") is a CRASH, never a finding,
+  // whatever the exit code allowance: allowNonZero once let an ENOENT pass as render screen's "exit 1".
+  const crashed = /^sdd-maintain: /m.test(r1.stderr ?? "");
+  if (crashed || (r1.status !== 0 && !allowNonZero)) { fail(`${label}: ${crashed ? "CRASHED" : `exit ${r1.status}`} — ${(r1.stderr || r1.stdout).trim().split("\n").pop()}`); return; }
+  const bad1 = outOfSet(repo, managedFn());
+  if (bad1.length) fail(`${label}: wrote outside the derived-and-managed set: ${bad1.slice(0, 5).join(", ")}`);
+  const roots = TWIN ? [TWIN.from, TWIN.to] : [];
+  const s1 = snapshot(repo, roots);
+  const r2 = run(repo, verbArgs);
+  const s2 = snapshot(repo, roots);
+  // parity: the full CLI, same verb, same arguments, on the twin
+  const twinArgs = verbArgs.map((a) => twinOf(a));
+  const rc = run(twinOf(repo), twinArgs, CONTROL);
+  run(twinOf(repo), twinArgs, CONTROL); // keep the twin in step with the primary's second run
+  const sc = snapshot(twinOf(repo), roots);
+  const parity = sc === s2 && rc.status === r1.status;
+  if (!parity) fail(`${label}: PARITY — sdd-cli ${sc === s2 ? "" : "left a different tree, "}exited ${rc.status} where sdd-maintain exited ${r1.status}`);
+  if (s1 !== s2) fail(`${label}: NOT deterministic — the second run on the same commit changed the tree`);
+  else if (!bad1.length && parity) ok(`${label} (exit ${r1.status}): in scope, second run byte-identical, = sdd-cli`);
+  exercised.add(label.split(" @")[0]);
+  void r2;
+}
+
+// ---- control: the detector must see an out-of-set write --------------------------------------
+{
+  const { clone } = cloneTree(REPOS[0]);
+  writeFileSync(join(clone, "docs", "CONTROL-out-of-set.md"), "x\n");
+  if (outOfSet(clone, lockManaged(clone)).includes("docs/CONTROL-out-of-set.md")) ok("CONTROL: an out-of-set write is seen");
+  else fail("CONTROL: an out-of-set write was NOT seen — every scope PASS below would be vacuous");
+}
+
+for (const repo of REPOS) {
+  const { clone, ws, missing } = cloneTree(repo);
+  const twin = cloneTree(repo);
+  TWIN = { from: ws, to: twin.ws };
+  const name = basename(repo);
+  process.stdout.write(`=== ${name} ===\n`);
+  const managed = () => lockManaged(clone);
+  // Bundle the lock is on: re-applying it is a real sync with nothing upstream changed.
+  const lock = readFileSync(join(clone, "method-baseline.lock"), "utf8");
+  const fwd = /- name: ([\w-]+)\n\s+bundle_version: "([^"]+)"(?:[\s\S]*?)is_forward_base: true/.exec(lock);
+  if (fwd) {
+    const tb = join(DIST, fwd[1], `${fwd[1]}-${fwd[2]}.tar.gz`);
+    // A lock that predates the CI digest (written before M-ADR 0218 §4.7) refuses its first sync on
+    // a newer CI render by design, and the wave passes --allow-overwrite exactly once; do the same.
+    const firstDigest = /^ci_workflow_block_sha256:/m.test(lock) ? [] : ["--allow-overwrite"];
+    if (existsSync(tb)) twice(`sync @${name}`, clone, ["sync", "--bundle", tb, "--target-repo", ".", ...firstDigest], managed);
+    else process.stdout.write(`  skip sync: ${tb} not on disk\n`);
+  }
+  twice(`generate-briefing @${name}`, clone, ["generate-briefing", "--target-dir", "."], managed);
+  // A build may exit 1 on pre-existing estate findings; scope and determinism hold either way.
+  twice(`catalogue build @${name}`, clone, ["catalogue", "build", "--sdd-path", "."], managed, { allowNonZero: true });
+  twice(`catalogue graph @${name}`, clone, ["catalogue", "graph", "--sdd-path", "."], managed, { allowNonZero: true });
+  if (existsSync(join(clone, "orchestration", "aggregation-manifest.yaml")) && missing.length > 0) {
+    process.stdout.write(`  skip catalogue aggregate: ${missing.length} manifest sibling(s) not on disk to clone (e.g. ${missing[0]})\n`);
+  } else if (existsSync(join(clone, "orchestration", "aggregation-manifest.yaml"))) {
+    // members first, so the aggregate reads current member catalogues
+    for (const d of readdirSync(ws, { recursive: true }).filter((p) => p.endsWith(".sdd-repo-kind"))) {
+      const member = join(ws, dirname(d));
+      if (member !== clone) {
+        run(member, ["catalogue", "build", "--sdd-path", "."]);
+        run(twinOf(member), ["catalogue", "build", "--sdd-path", "."], CONTROL);
+      }
+    }
+    twice(`catalogue aggregate @${name}`, clone, ["catalogue", "aggregate", "--sdd-path", "."], managed, { allowNonZero: true });
+  }
+  // catalogue diff: from HEAD with an empty delta, so attribution is trivially complete; it writes nothing into the SDD.
+  {
+    const delta = join(ws, `${name}-delta.yaml`);
+    writeFileSync(delta, "findings: []\n");
+    writeFileSync(twinOf(delta), "findings: []\n");
+    twice(`catalogue diff @${name}`, clone, ["catalogue", "diff", "--from", "HEAD", "--attribute", delta, "--sdd-path", "."], managed, { allowNonZero: true });
+  }
+  // pack build: every seed the SDD produces, to an output OUTSIDE its tracked content (§4.3 item 8).
+  const distDir = join(clone, "orchestration", "distribution");
+  if (existsSync(distDir)) {
+    const seed = readdirSync(distDir).find((f) => f.endsWith("-seed.yaml"));
+    if (seed) twice(`pack build @${name}`, clone, ["pack", "build", "--seed", join(distDir, seed), "--producer-repo", ".", "--out-dir", join(ws, "pack-out")], managed, { allowNonZero: true });
+  }
+  // render screen: the first screen spec, to an explicit --out outside the tree (§4.3 item 8).
+  const screens = join(clone, "screens");
+  if (existsSync(screens)) {
+    const spec = readdirSync(screens).find((f) => f.endsWith(".md"));
+    if (spec) twice(`render screen @${name}`, clone, ["render", "screen", join("screens", spec), "--out", join(ws, "screen.svg")], managed);
+  }
+  // context pull: a scratch code repo beside the clone, named for a repository this SDD catalogues.
+  const repoCsv = join(clone, "catalogues", "repositories.csv");
+  if (existsSync(repoCsv)) {
+    const id = readFileSync(repoCsv, "utf8").split("\n")[1]?.split(",")[0];
+    if (id && existsSync(join(clone, "orchestration/templates/briefing/code-repo/agent-instructions.md.hbs"))) {
+      const code = join(dirname(clone), id);
+      for (const c of [code, twinOf(code)]) {
+        mkdirSync(c, { recursive: true });
+        execFileSync("git", ["-C", c, "init", "-q"]);
+      }
+      twice(`context pull @${name}`, code, ["context", "pull", "--sdd", clone], () => new Set());
+    } else process.stdout.write(`  skip context pull: ${id ? "the SDD's baseline has no code-repo templates yet" : "no repositories catalogued"}\n`);
+  }
+}
+
+const SURFACE = ["sync", "generate-briefing", "catalogue build", "catalogue graph", "catalogue aggregate", "context pull", "catalogue diff", "pack build", "render screen"];
+const missing = SURFACE.filter((v) => !exercised.has(v));
+process.stdout.write(`COVERAGE exercised: ${[...exercised].join(", ")}\n`);
+if (missing.length) process.stdout.write(`COVERAGE NOT exercised here (needs inputs this run lacks): ${missing.join(", ")}\n`);
+process.stdout.write(FAIL === 0 ? "ACCEPTANCE PASS — every maintain write in scope and deterministic\n" : `ACCEPTANCE FAIL (${FAIL})\n`);
+process.exit(FAIL === 0 ? 0 : 1);

package/scripts/maintain-version.json

@@ -0,0 +1,4 @@
+{
+  "version": "0.2.0",
+  "built_against_sdd_cli": "1.43.0"
+}

package/scripts/release-gate.mjs

@@ -39,6 +39,15 @@ if (process.argv.includes("--audit")) {
   process.exit(0);
 }
 
+// M-ADR 0218 §4.6: the persona packages are released WITH sdd-cli, in one change-set. A release that
+// bumps sdd-cli without re-stamping a persona's version file would build a package that claims an
+// engine it is not, so the publish refuses (the build refuses it too).
+for (const persona of ["verify", "maintain", "author"]) {
+  const f = JSON.parse(readFileSync(join(root, "scripts", `${persona}-version.json`), "utf-8"));
+  if (f.built_against_sdd_cli !== pkg.version)
+    fail(`scripts/${persona}-version.json says built_against_sdd_cli ${f.built_against_sdd_cli}, but this release is ${pkg.version}; bump the persona's version and re-stamp it in the release commit`);
+}
+
 const tag = `v${pkg.version}`;
 if (run("git", ["status", "--porcelain", "--untracked-files=no"]) !== "") fail("the working tree has uncommitted changes to tracked files");
 const head = run("git", ["rev-parse", "HEAD"]);

package/scripts/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.0.0",
-  "built_against_sdd_cli": "1.41.0"
+  "version": "1.2.0",
+  "built_against_sdd_cli": "1.43.0"
 }

package/scripts/vitest-tmpdir.mjs

@@ -0,0 +1,26 @@
+// Gives each test run its own temp directory and removes it whole when the run ends.
+//
+// Every fixture is created under os.tmpdir(), which reads TMPDIR. Setting TMPDIR here, in the
+// main process before any worker starts, sends every fixture of this run (and of the bash
+// scripts the tests spawn, which honour TMPDIR via mktemp) into one directory, whatever prefix
+// its test chose. vitest-teardown.mjs could only sweep the prefixes it listed: 3 of the 129 the
+// tests used, so the rest accumulated in /tmp (14,203 directories on 2026-10-16). A concurrent
+// run on the same machine has its own directory, so neither run can touch the other's fixtures.
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import sweepLegacy from "./vitest-teardown.mjs";
+
+export default function setup() {
+  const original = process.env.TMPDIR;
+  const dir = mkdtempSync(join(tmpdir(), "sdd-cli-vitest-"));
+  process.env.TMPDIR = dir;
+  return async () => {
+    if (process.env.SDD_CLI_KEEP_TMP) process.stdout.write(`vitest-tmpdir: kept ${dir}\n`);
+    else rmSync(dir, { recursive: true, force: true });
+    // Fixtures from runs before this setup existed sit directly in /tmp; sweep them by prefix and age.
+    if (original === undefined) delete process.env.TMPDIR;
+    else process.env.TMPDIR = original;
+    await sweepLegacy();
+  };
+}

package/scripts/build-verify-package.mjs

@@ -1,210 +0,0 @@
-// Assemble the publishable @sdd-method/verify-cli package — M-ADR 0212 §4.3b.
-//
-// ONE SOURCE, and this time a genuinely smaller ARTEFACT. The conformance
-// package copied the whole of dist/ under a second manifest, so its "excluded"
-// verbs were one `node dist/cli.js …` away. This script ships only the import
-// CLOSURE of dist/verify-bin.js: an excluded verb's code is not in the package
-// to be reached by any path.
-//
-// Fails closed on four conditions, each of which would otherwise let the
-// boundary pass while not holding:
-//   1. a relative import in the closure that does not resolve to a file;
-//   2. a bare import that is neither a Node built-in nor a declared dependency;
-//   3. a CANARY — a known authoring module — present in the closure;
-//   4. a canary that no longer EXISTS in dist. A canary that was renamed or
-//      deleted cannot be absent from anything, so the check above would pass
-//      vacuously; this makes it fail instead, and asks for the list to follow.
-//
-// The generated directory is gitignored and safe to delete.
-
-import { cp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { builtinModules } from "node:module";
-import { dirname, join, relative, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..");
-// SDD_CLI_DIST: check a build made elsewhere. `dist/` is what a linked global `sdd-cli`
-// runs, so building it to run this check silently put unreleased code in front of every
-// session on the machine (2026-10-01, about nine hours). `npm run verify:boundary` builds
-// into build/check-dist and checks that instead; only a release should write dist/.
-const DIST = process.env.SDD_CLI_DIST ? resolve(process.env.SDD_CLI_DIST) : join(ROOT, "dist");
-const OUT = join(ROOT, "build", "verify-cli");
-const ENTRY = join(DIST, "verify-bin.js");
-
-// Authoring and maintenance code that must never reach this package. Entry
-// modules of excluded verbs plus the full CLI's own entrypoints.
-const CANARIES = [
-  "cli.js",
-  "index.js",
-  "verbs/sync.js",
-  "verbs/catalogue.js",
-  "verbs/pack.js",
-  "verbs/mcp.js",
-  "verbs/init.js",
-  "verbs/render.js",
-  "verbs/metamodel.js",
-  "verbs/conformance.js",
-  "lib/sync/index.js",
-  "lib/catalogue/build.js",
-  "lib/catalogue/aggregate.js",
-  "lib/catalogue/graph-run.js",
-  "lib/catalogue/migration-map.js",
-  "lib/pack/builder.js",
-];
-
-const die = (msg) => {
-  process.stderr.write(`build-verify-package: FAIL — ${msg}\n`);
-  process.exit(1);
-};
-
-if (!existsSync(ENTRY)) die(`${relative(ROOT, ENTRY)} missing — run \`npm run build\` first`);
-
-// ---- 1. closure over imports ----------------------------------------------
-// Line-based over tsc output, skipping comment lines. An earlier regex over the
-// whole text read `// from "changed" produces…` in a comment as an import of a
-// package called `changed` — prose parsed as code, the same failure a grep over
-// workflow comments made the same day. Fail-closed caught it; this stops it.
-const STATIC = /^\s*(?:import|export|\})[^\n]*?\bfrom\s*["']([^"']+)["']/;
-const SIDE = /^\s*import\s*["']([^"']+)["']/;
-const DYNAMIC = /\bimport\s*\(\s*["']([^"']+)["']\s*\)/g;
-function specifiers(src) {
-  const out = [];
-  for (const line of src.split("\n")) {
-    const t = line.trimStart();
-    if (t.startsWith("//") || t.startsWith("*") || t.startsWith("/*")) continue;
-    const m = line.match(STATIC) ?? line.match(SIDE);
-    if (m) out.push(m[1]);
-    for (const d of line.matchAll(DYNAMIC)) out.push(d[1]);
-  }
-  return out;
-}
-const closure = new Set();
-const bare = new Set();
-const stack = [ENTRY];
-while (stack.length) {
-  const f = stack.pop();
-  if (closure.has(f)) continue;
-  closure.add(f);
-  for (const spec of specifiers(readFileSync(f, "utf8"))) {
-    if (spec.startsWith(".")) {
-      const target = resolve(dirname(f), spec);
-      if (!existsSync(target)) die(`${relative(DIST, f)} imports '${spec}', which does not resolve`);
-      stack.push(target);
-    } else {
-      bare.add(spec);
-    }
-  }
-}
-
-// ---- 2. dependencies = only what the closure imports -----------------------
-const main = JSON.parse(await readFile(join(ROOT, "package.json"), "utf8"));
-const pkgName = (spec) =>
-  spec.startsWith("@") ? spec.split("/").slice(0, 2).join("/") : spec.split("/")[0];
-const builtins = new Set(builtinModules);
-const deps = {};
-for (const spec of bare) {
-  if (spec.startsWith("node:") || builtins.has(spec) || builtins.has(spec.split("/")[0])) continue;
-  const name = pkgName(spec);
-  const range = main.dependencies?.[name];
-  if (!range) die(`closure imports '${spec}', which is not a declared dependency of sdd-cli`);
-  deps[name] = range;
-}
-
-// ---- 3 + 4. canaries -------------------------------------------------------
-for (const c of CANARIES) {
-  const abs = join(DIST, c);
-  if (!existsSync(abs)) die(`canary '${c}' no longer exists in dist — the check would pass vacuously; update CANARIES`);
-  if (closure.has(abs)) die(`authoring module '${c}' is reachable from verify-bin.js — the boundary does not hold`);
-}
-
-// ---- bundled shell scripts -------------------------------------------------
-// Some validators are shell scripts SHIPPED WITH the package (dispatch.ts:
-// `kind: "bundled"`), resolved by lib/scripts.ts to <package-root>/scripts/.
-// They are launched by path, not imported, so the closure above cannot see
-// them. verify-cli 0.1.0 shipped without them and `app-docs` and
-// `integration-docs` failed with exit 127 on every app and integration repo —
-// found by a parity check against sdd-cli, not by the no-write acceptance,
-// because a validator that cannot find its script writes nothing.
-const bundled = new Set();
-for (const f of closure) {
-  for (const m of readFileSync(f, "utf8").matchAll(/kind:\s*"bundled",\s*script:\s*"([^"]+)"/g)) {
-    const p = join(ROOT, "scripts", m[1]);
-    if (!existsSync(p)) die(`${relative(DIST, f)} declares bundled script '${m[1]}', which does not exist in scripts/`);
-    bundled.add(p);
-  }
-}
-
-// ---- assets: yaml/json data beside a closure module ------------------------
-const assets = new Set();
-for (const f of closure) {
-  const dir = dirname(f);
-  for (const name of readdirSync(dir)) {
-    const p = join(dir, name);
-    if (/\.(ya?ml|json)$/.test(name) && statSync(p).isFile()) assets.add(p);
-  }
-}
-
-// ---- assemble --------------------------------------------------------------
-// The version is COMMITTED (scripts/verify-version.json), not defaulted. Defaulting to "0.1.0" let a build
-// of new source carry an old version silently; verify-cli then fell two sdd-cli releases behind unnoticed.
-// Bump the file in every sdd-cli release commit (minor with the CLI's minor; patch for fixes).
-const versionFile = JSON.parse(readFileSync(join(ROOT, "scripts", "verify-version.json"), "utf8"));
-const version = versionFile.version;
-if (!/^\d+\.\d+\.\d+$/.test(version ?? "")) die("scripts/verify-version.json has no semver `version`");
-if (process.env.VERIFY_VERSION && process.env.VERIFY_VERSION !== version)
-  die(`VERIFY_VERSION=${process.env.VERIFY_VERSION} disagrees with scripts/verify-version.json (${version}); edit the file`);
-// Empty the directory, never remove it: a shell sitting in build/verify-cli
-// (to run `npm publish`) keeps a handle on the directory itself, and deleting
-// it leaves that shell in a path that no longer exists — npm then dies with
-// ENOENT uv_cwd. That happened, twice, between a rebuild and a publish.
-await mkdir(OUT, { recursive: true });
-for (const entry of readdirSync(OUT)) await rm(join(OUT, entry), { recursive: true, force: true });
-for (const f of [...closure, ...assets]) {
-  const dest = join(OUT, "dist", relative(DIST, f));
-  await mkdir(dirname(dest), { recursive: true });
-  await cp(f, dest);
-}
-for (const p of bundled) {
-  await mkdir(join(OUT, "scripts"), { recursive: true });
-  await cp(p, join(OUT, "scripts", relative(join(ROOT, "scripts"), p)));
-}
-for (const f of ["LICENSE", "NOTICE"]) await cp(join(ROOT, f), join(OUT, f));
-
-if (main.publishConfig?.access !== "public") die("sdd-cli's package.json has no publishConfig.access=public — the verify package would publish private");
-
-const pkg = {
-  name: "@sdd-method/verify-cli",
-  version,
-  description:
-    "Verify an SDD repository without changing it — validate, list, and read-only catalogue and pack checks. Ships only the code those verbs reach; it cannot write to the repository it is pointed at. Authoring and maintenance are in @sdd-method/sdd-cli.",
-  license: main.license,
-  type: main.type,
-  bin: { "sdd-verify": "dist/verify-bin.js" },
-  engines: main.engines,
-  dependencies: deps,
-  repository: main.repository,
-  // Inherited, not assumed: a scoped package publishes PRIVATE by default, and
-  // the first publish of this one failed with E402 (private packages need a
-  // paid plan) because this field was missing. sdd-cli carries it; so must this.
-  publishConfig: main.publishConfig,
-  files: ["dist", "scripts", "README.md", "LICENSE", "NOTICE"],
-};
-await writeFile(join(OUT, "package.json"), `${JSON.stringify(pkg, null, 2)}\n`);
-await writeFile(
-  join(OUT, "README.md"),
-  `# @sdd-method/verify-cli\n\n` +
-    `\`sdd-verify\` checks an SDD repository and **cannot change it**.\n\n` +
-    `Verbs: \`validate\`, \`list\`, \`pack validate\`, \`catalogue validate\` (incl. \`--coverage\`), ` +
-    `\`catalogue impact\`, \`catalogue baseline-check\`, \`catalogue version\`.\n\n` +
-    `The package contains only the code those verbs reach. Authoring and maintenance verbs — ` +
-    `\`sync\`, \`catalogue build\`, \`init\`, \`scaffold\`, \`mcp\` and the rest — are not present in it, ` +
-    `and are in \`@sdd-method/sdd-cli\`. Invoking one fails with exit 1.\n`,
-);
-
-const kb = (fs) => Math.round(fs.reduce((n, f) => n + statSync(f).size, 0) / 1024);
-process.stdout.write(
-  `assembled ${pkg.name}@${version} at build/verify-cli\n` +
-    `  modules ${closure.size} (${kb([...closure])} kB) · assets ${assets.size} · bundled scripts ${bundled.size} · deps ${Object.keys(deps).join(", ")}\n` +
-    `  canaries absent: ${CANARIES.length}/${CANARIES.length}\n`,
-);