@sdd-method/verify-cli 0.1.0

package/dist/verify-program.js

@@ -0,0 +1,115 @@
+// Third entrypoint: the VERIFY surface — M-ADR 0212 §4.3b.
+//
+// A binary that CANNOT WRITE to the repository it is pointed at. That is the
+// whole property, and it is the one a pipeline can rely on: whatever runs
+// `sdd-verify` in CI can judge a repository and cannot change it.
+//
+// Two criteria admit a verb here, and both are required:
+//   1. it does not write to the target repository — TESTED, not read from a
+//      description: the package acceptance check runs every verb in every mode
+//      against a clean checkout and requires `git status --porcelain` to be
+//      empty. Reading help text misfiled four verbs before that test existed
+//      (`sync`, `render`, `catalogue graph`, `metamodel roundtrip`).
+//   2. it has something to act on in an adopter repository today. A read-only
+//      verb can fail this and pass (1): `metamodel roundtrip` is producer-only,
+//      `catalogue migration-map` serves a finished migration. Neither is here.
+//
+// ⚠ The boundary is ABSENCE, not a menu. The package ships only the import
+// closure of this file, so an excluded verb's code is not present to be reached
+// by any path — including `mcp serve`, which exposes the SDD as tools and would
+// hand authoring back through a second door. That is why registration imports
+// per-subcommand registrars (`catalogue-verify.ts`, `pack-validate.ts`) and never
+// a barrel that re-exports a build path.
+//
+// Verbs are the SAME registrars the full CLI uses: one implementation, two
+// surfaces, so behaviour cannot drift between them.
+import { Command, CommanderError } from "commander";
+import { getPackageVersion } from "./lib/package-version.js";
+import { registerCatalogueBaselineCheck, registerCatalogueImpact, registerCatalogueValidate, registerCatalogueVersion, } from "./verbs/catalogue-verify.js";
+import { registerList } from "./verbs/list.js";
+import { registerPackValidate } from "./verbs/pack-validate.js";
+import { registerValidate } from "./verbs/validate.js";
+const SPEC_URL = "https://github.com/tomfosteruk/sdd-method/blob/main/docs/method/cli/sdd-cli-specification.md";
+/** The full surface, as `<verb>` or `<verb> <subcommand>`. Asserted by test. */
+export const VERIFY_SURFACE = [
+    "validate",
+    "list",
+    "pack validate",
+    "catalogue validate",
+    "catalogue impact",
+    "catalogue baseline-check",
+    "catalogue version",
+];
+const OUTSIDE = "is not part of sdd-verify, which cannot write to the repository it is pointed at. " +
+    "Authoring and maintenance verbs are in @sdd-method/sdd-cli.";
+/**
+ * Refuse anything outside the surface BEFORE commander parses it. Left to
+ * commander, `sdd-verify sync --help` prints top-level usage and exits 0 — in a
+ * pipeline that is a step that runs nothing and passes, which is the failure
+ * this binary exists to prevent. So an excluded verb fails, loudly, whatever
+ * flags accompany it.
+ */
+export function rejectOutsideSurface(program, argv) {
+    const words = argv.filter((a) => !a.startsWith("-"));
+    if (words.length === 0)
+        return;
+    const [verb, sub] = words;
+    if (verb === "help")
+        return;
+    const cmd = program.commands.find((c) => c.name() === verb);
+    if (!cmd)
+        throw new Error(`'${verb}' ${OUTSIDE}`);
+    const subs = cmd.commands.map((c) => c.name()).filter((n) => n !== "help");
+    if (subs.length > 0 && sub !== undefined && sub !== "help" && !subs.includes(sub)) {
+        throw new Error(`'${verb} ${sub}' ${OUTSIDE}`);
+    }
+}
+export async function runVerify(argv) {
+    const program = buildVerifyProgram();
+    if (argv.length === 0) {
+        program.outputHelp();
+        return;
+    }
+    rejectOutsideSurface(program, argv);
+    try {
+        await program.parseAsync([...argv], { from: "user" });
+    }
+    catch (err) {
+        if (err instanceof CommanderError) {
+            if (err.code === "commander.help" ||
+                err.code === "commander.helpDisplayed" ||
+                err.code === "commander.version") {
+                return;
+            }
+        }
+        throw err;
+    }
+}
+export function buildVerifyProgram() {
+    const program = new Command();
+    program
+        .name("sdd-verify")
+        .description("Verify an SDD repository without changing it — validate, list, and read-only catalogue and pack checks. Cannot write to the repository it is pointed at.")
+        .version(getPackageVersion(), "-v, --version")
+        .addHelpText("after", `\nSpec: ${SPEC_URL}\nAuthoring and maintenance verbs (sync, catalogue build, init, scaffold, mcp, …) are in @sdd-method/sdd-cli.`)
+        .exitOverride()
+        .configureOutput({
+        writeOut: (str) => process.stdout.write(str),
+        writeErr: (str) => process.stderr.write(str),
+    });
+    registerValidate(program);
+    registerList(program);
+    const pack = program
+        .command("pack")
+        .description("Validate adopter-shipped context-pack seeds (ADR 0151) — read-only");
+    registerPackValidate(pack);
+    const catalogue = program
+        .command("catalogue")
+        .description("Validate and query per-SDD catalogues (ADR 0134) — read-only, never rebuilds");
+    registerCatalogueValidate(catalogue);
+    registerCatalogueImpact(catalogue);
+    registerCatalogueBaselineCheck(catalogue);
+    registerCatalogueVersion(catalogue);
+    return program;
+}
+//# sourceMappingURL=verify-program.js.map

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@sdd-method/verify-cli",
+  "version": "0.1.0",
+  "description": "Verify an SDD repository without changing it — validate, list, and read-only catalogue and pack checks. Ships only the code those verbs reach; it cannot write to the repository it is pointed at. Authoring and maintenance are in @sdd-method/sdd-cli.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "bin": {
+    "sdd-verify": "dist/verify-bin.js"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "dependencies": {
+    "commander": "^12.1.0",
+    "yaml": "^2.5.0",
+    "zod": "^4.3.6",
+    "@duckdb/node-api": "^1.5.5-r.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tomfosteruk/sdd-cli.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ]
+}