@sdd-method/verify-cli 0.4.0 → 1.0.0

package/dist/lib/catalogue/canonical-schema.yaml

@@ -7,7 +7,7 @@
 # Emitted by sdd-cli's YAML emitter with no line folding; the three header scalars are quoted for the
 # textual readers downstream. The one deliberate difference from the authored form is schema_status:
 # the authored form says canonical; a projection never does.
-schema_version: "3.19.0"
+schema_version: "3.20.0"
 schema_owner: "sdd-method"
 schema_status: "generated"
 enums:
@@ -606,6 +606,13 @@ enums:
     - value: no-canonical-home
       description: "The platform has no canonical field for the item: platform contract work."
     description: Why an unsupported feature is unsupported, and so whose work the gap is.
+  repo_dependency_kind:
+    values:
+    - value: library
+      description: Linked or packaged at build time.
+    - value: generated-from
+      description: Its content was produced from the other repository's templates.
+    description: How one repository depends on another's code (M-ADR 0217 §4.1).
 catalogues:
   domains:
     primary_key: id
@@ -688,6 +695,10 @@ catalogues:
       type: string
       nullable: true
       description: "`true` when this SDD is a reference exemplar — it demonstrates a profile shape rather than modelling a real product or provider relationship. Empty otherwise, which is the unmarked norm (absent in the manifest = a real SDD, no finding). From the manifest's `exemplar:` field (sdd-manifest-schema 1.8.0). PROFILE-AGNOSTIC, unlike surface/packaging/application_archetype which are application-product-only — the first exemplar cohort found was integration-products. DERIVED, not authorable: this column and `integrations.exemplar` both come from the one manifest field, so they cannot disagree; two independently authored copies could, which is the failure mode the trait exists to remove. No builder branches on it — it is emitted to be filterable and nothing consumes it, because an implicit exclusion inside a rollup is much harder to remove than to add. Added in 2.46.0."
+    - name: shared_library
+      type: string
+      nullable: true
+      description: "`true` when this SDD exists to provide code other SDDs build from or generate from (M-ADR 0217 §4.4). Empty otherwise, the unmarked norm. From the SDD manifest's `shared_library:` field. PROFILE-AGNOSTIC, like `exemplar`. DERIVED, not authorable: this column and its twin on the other catalogue come from the one manifest field, so they cannot disagree. No builder branches on it; a rollup filters on it. Added in 3.20.0."
     - name: surface
       type: string
       nullable: true
@@ -778,6 +789,10 @@ catalogues:
       type: string
       nullable: true
       description: "`true` when this SDD is a reference exemplar — it demonstrates a profile shape rather than modelling a real product or provider relationship. Empty otherwise, which is the unmarked norm (absent in the manifest = a real SDD, no finding). From the manifest's `exemplar:` field (sdd-manifest-schema 1.8.0). PROFILE-AGNOSTIC, unlike surface/packaging/application_archetype which are application-product-only — the first exemplar cohort found was integration-products. DERIVED, not authorable: this column and `integrations.exemplar` both come from the one manifest field, so they cannot disagree; two independently authored copies could, which is the failure mode the trait exists to remove. No builder branches on it — it is emitted to be filterable and nothing consumes it, because an implicit exclusion inside a rollup is much harder to remove than to add. Added in 2.46.0."
+    - name: shared_library
+      type: string
+      nullable: true
+      description: "`true` when this SDD exists to provide code other SDDs build from or generate from (M-ADR 0217 §4.4). Empty otherwise, the unmarked norm. From the SDD manifest's `shared_library:` field. PROFILE-AGNOSTIC, like `exemplar`. DERIVED, not authorable: this column and its twin on the other catalogue come from the one manifest field, so they cannot disagree. No builder branches on it; a rollup filters on it. Added in 3.20.0."
     - name: surface
       type: string
       nullable: true
@@ -871,6 +886,10 @@ catalogues:
       type: string
       nullable: true
       description: "`true` when the emitting SDD is a reference exemplar (demonstrates a profile shape rather than modelling a real provider relationship); empty otherwise. Derived from the SDD manifest's `exemplar:` field (sdd-manifest-schema 1.8.0), same source as `products.exemplar` — neither column is independently authorable. Carried on `sub_integrations` rows too, INHERITED from the emitting SDD. That deliberately differs from `ingestion_pattern`/`invocation_pattern`, which are empty on sub rows, and the difference is the point: a pattern is a MECHANISM (how this integration acquires data), genuinely one per SDD, whereas `exemplar` is a REALITY STATUS that propagates to everything the SDD emits — if the SDD is a demonstration then every provider relationship it declares is a demonstration. Leaving sub rows empty would flag the umbrella and count its demonstration sub-providers as real, reproducing the rollup overcount this column exists to fix one level down. Do not normalise it to match the pattern columns. The trade accepted: a real SDD with one demonstration sub-provider is unexpressible — a state that should not exist. Added in 2.46.0."
+    - name: shared_library
+      type: string
+      nullable: true
+      description: "`true` when this SDD exists to provide code other SDDs build from or generate from (M-ADR 0217 §4.4). Empty otherwise, the unmarked norm. From the SDD manifest's `shared_library:` field. PROFILE-AGNOSTIC, like `exemplar`. DERIVED, not authorable: this column and its twin on the other catalogue come from the one manifest field, so they cannot disagree. No builder branches on it; a rollup filters on it. Added in 3.20.0."
     - name: source_sdd_id
       type: string
       nullable: true
@@ -4050,3 +4069,49 @@ catalogues:
       references: repositories.id
       nullable: false
       external: true
+  repo_dependency:
+    primary_key: id
+    columns:
+    - name: id
+      type: string
+      nullable: false
+      description: <from_repo_id>__<to_repo_id>__<kind>.
+    - name: from_repo_id
+      type: string
+      nullable: false
+      description: The dependent repository; one of this SDD's own.
+    - name: to_repo_id
+      type: string
+      nullable: false
+      description: The repository depended on, in this SDD or another. External at build; it must resolve at aggregation, and is never renamed or guessed to make it resolve.
+    - name: kind
+      type: string
+      nullable: false
+      description: Bound to repo_dependency_kind.
+    - name: version
+      type: string
+      nullable: true
+      description: The version or reference depended on, where the source states one; empty otherwise. The declared source wins over the derived one.
+    - name: declared_in
+      type: string
+      nullable: false
+      description: The file the row came from, relative to the SDD root; the declared source when both name the dependency.
+    - name: source_sdd_id
+      type: string
+      nullable: true
+      description: Originating SDD slug. Populated by the aggregator per M-ADR 0134.
+    - name: platform_sdd_id
+      type: string
+      nullable: true
+      description: The platform this row belongs to — sdd_id of its platform-root. Stamped by the aggregator (M-ADR 0208 §4.4).
+    description: "Edge: a repository depends on another repository's code without either being a running service — a library linked at build time, or a template family it was generated from (M-ADR 0217). The depended-on repository may belong to another SDD, which describes it; this row only references it."
+    foreign_keys:
+    - column: from_repo_id
+      references: repositories.id
+      nullable: false
+    - column: to_repo_id
+      references: repositories.id
+      nullable: false
+      external: true
+    column_enums:
+      kind: enums.repo_dependency_kind

package/dist/lib/catalogue/manifest-loader.js

@@ -215,6 +215,9 @@ const ManifestSchema = z.object({
     // application-product. Absent reads as a real SDD, the unmarked norm, with no
     // finding. Only `true` is meaningful; `false` is redundant but accepted.
     exemplar: z.boolean().optional(),
+    // Shared-library trait (sdd-manifest-schema 1.12.0, M-ADR 0217 §4.4). Profile-agnostic,
+    // like `exemplar`; absent is the unmarked norm, no finding.
+    shared_library: z.boolean().optional(),
     // Application-product archetype trait (M-ADR 0191, sdd-manifest-schema
     // 1.2.0). RESOLVED enum, not fixed: the loader validates only the slug
     // shape here. Whether the value resolves against the active vocabulary
@@ -374,6 +377,7 @@ export async function loadSddManifest(sddPath, options) {
         ...(parsed.data.surface !== undefined ? { surface: parsed.data.surface } : {}),
         ...(parsed.data.packaging !== undefined ? { packaging: parsed.data.packaging } : {}),
         ...(parsed.data.exemplar !== undefined ? { exemplar: parsed.data.exemplar } : {}),
+        ...(parsed.data.shared_library !== undefined ? { sharedLibrary: parsed.data.shared_library } : {}),
         ...(parsed.data.application_archetype !== undefined
             ? { applicationArchetype: parsed.data.application_archetype }
             : {}),

package/dist/lib/catalogue/rubric-coverage-map.yaml

@@ -859,3 +859,13 @@ coverage:
       repo_id:
         class: xref
         impact_flow: toward-source
+  repo_dependency:
+    kind: edge
+    scoring: predicate
+    class: dependency
+    impact_flow: toward-source
+    instrument: "FK resolution against repositories at aggregation: a dependency naming no repository fails like any other foreign key (M-ADR 0217 §4.1)"
+  repo_dependency_kind:
+    kind: enum
+    scoring: not-applicable
+    reason: closed vocabulary, not an artefact

package/dist/lib/package-version.js

@@ -1,5 +1,5 @@
 import { readFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { dirname, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 /**
  * Read the package version from package.json at runtime so the various
@@ -22,4 +22,34 @@ export function getPackageVersion() {
     cached = pkg.version;
     return cached;
 }
+/**
+ * The @sdd-method/verify-cli version released WITH this sdd-cli (M-ADR 0212
+ * §6.1 Phase 1). The method-managed CI workflow installs exactly this version,
+ * so the CLI that syncs a repository decides which verifier judges it.
+ *
+ * Read from dist/verify-version.json, which the build copies from
+ * scripts/verify-version.json. Never from scripts/ in a built layout: the global
+ * `sdd-cli` on the method's machines is a link into the checkout, so reading the
+ * committed file live would render a version bumped in source but not yet
+ * published into every workflow synced that day, while dist/ still lagged.
+ * Source layout (tests) has no copy and reads scripts/ directly.
+ *
+ * Throws rather than defaults: a missing version must not render a floating install.
+ */
+let cachedVerify;
+export function getVerifyCliVersion() {
+    if (cachedVerify !== undefined)
+        return cachedVerify;
+    const here = dirname(fileURLToPath(import.meta.url));
+    const fromSource = here.endsWith(`${sep}src${sep}lib`);
+    const file = fromSource
+        ? resolve(here, "..", "..", "scripts", "verify-version.json")
+        : resolve(here, "..", "verify-version.json");
+    const parsed = JSON.parse(readFileSync(file, "utf8"));
+    if (typeof parsed.version !== "string" || !/^\d+\.\d+\.\d+$/.test(parsed.version)) {
+        throw new Error(`${file} has no semver \`version\`; refusing to render an unpinned verify-cli install`);
+    }
+    cachedVerify = parsed.version;
+    return cachedVerify;
+}
 //# sourceMappingURL=package-version.js.map

package/dist/verify-version.json

@@ -0,0 +1,4 @@
+{
+  "version": "1.0.0",
+  "built_against_sdd_cli": "1.41.0"
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdd-method/verify-cli",
-  "version": "0.4.0",
+  "version": "1.0.0",
   "description": "Verify an SDD repository without changing it — validate, list, and read-only catalogue and pack checks. Ships only the code those verbs reach; it cannot write to the repository it is pointed at. Authoring and maintenance are in @sdd-method/sdd-cli.",
   "license": "Apache-2.0",
   "type": "module",