@sdd-method/verify-cli 1.0.0 → 1.1.0

package/dist/lib/catalogue/cli-version.js

@@ -2,9 +2,9 @@
  * sdd-cli version constant, used in error messages from the catalogue
  * builder + aggregator + validate subcommands.
  *
- * Read from package.json via getPackageVersion() to guarantee the
+ * Read from package.json via getSddCliVersion() (the ENGINE version, also in a persona package) to guarantee the
  * constant cannot drift from the published version.
  */
-import { getPackageVersion } from "../package-version.js";
-export const CLI_VERSION = getPackageVersion();
+import { getSddCliVersion } from "../package-version.js";
+export const CLI_VERSION = getSddCliVersion();
 //# sourceMappingURL=cli-version.js.map

package/dist/lib/lock-file.js

@@ -62,6 +62,10 @@ export function serialiseLockFile(lock) {
     const lines = [
         `method_repo: ${lock.methodRepo}`,
         `lock_version: ${lock.lockVersion}`,
+        ...(lock.ciBinding !== undefined ? [`ci_binding: ${lock.ciBinding}`] : []),
+        ...(lock.ciRunner !== undefined ? [`ci_runner: "${lock.ciRunner}"`] : []),
+        ...(lock.ciWorkflowBlockSha256 !== undefined ? [`ci_workflow_block_sha256: "${lock.ciWorkflowBlockSha256}"`] : []),
+        ...(lock.ciModuleSha256 !== undefined ? [`ci_module_sha256: "${lock.ciModuleSha256}"`] : []),
         "bundles:",
     ];
     for (const b of lock.bundles) {
@@ -109,6 +113,10 @@ function stripQuotes(value) {
 function parseVersioned(raw) {
     let methodRepo;
     let lockVersion;
+    let ciWorkflowBlockSha256;
+    let ciBinding;
+    let ciRunner;
+    let ciModuleSha256;
     const bundles = [];
     let inBundles = false;
     let inPaths = false;
@@ -170,6 +178,14 @@ function parseVersioned(raw) {
                     methodRepo = stripQuotes(value);
                 else if (key === "lock_version")
                     lockVersion = Number(stripQuotes(value));
+                else if (key === "ci_workflow_block_sha256")
+                    ciWorkflowBlockSha256 = stripQuotes(value);
+                else if (key === "ci_binding")
+                    ciBinding = stripQuotes(value);
+                else if (key === "ci_runner")
+                    ciRunner = stripQuotes(value);
+                else if (key === "ci_module_sha256")
+                    ciModuleSha256 = stripQuotes(value);
             }
             continue;
         }
@@ -289,7 +305,15 @@ function parseVersioned(raw) {
                 ? ` — the lock was written by a newer sdd-cli; upgrade rather than downgrading the lock.`
                 : `.`));
     }
-    return { methodRepo, lockVersion: LOCK_VERSION, bundles };
+    return {
+        methodRepo,
+        lockVersion: LOCK_VERSION,
+        bundles,
+        ...(ciBinding !== undefined ? { ciBinding } : {}),
+        ...(ciRunner !== undefined ? { ciRunner } : {}),
+        ...(ciWorkflowBlockSha256 !== undefined ? { ciWorkflowBlockSha256 } : {}),
+        ...(ciModuleSha256 !== undefined ? { ciModuleSha256 } : {}),
+    };
 }
 function migrateV1(raw, legacyBundleName) {
     const scalars = new Map();

package/dist/lib/pack/validate.js

@@ -4,7 +4,7 @@
 // (M-ADR 0212 §4.3b). `index.ts` re-exports it, so existing imports are unchanged.
 import { validateSeed } from "./schema.js";
 import { loadSeed } from "./seed.js";
-import { getPackageVersion } from "../package-version.js";
+import { getSddCliVersion } from "../package-version.js";
 import { fail, info, pass, section } from "./log.js";
 export async function runPackValidate(opts, stdout = (s) => process.stdout.write(s)) {
     stdout(section("Pack validate"));
@@ -21,7 +21,7 @@ export async function runPackValidate(opts, stdout = (s) => process.stdout.write
     // than itself, exactly as for `.sdd/sdd-manifest.yaml`. Silence here is what let an
     // adopter follow the schema and get a clean validation with no effect.
     if (seed.unknownKeys && seed.unknownKeys.length > 0) {
-        stdout(info(`${seed.unknownKeys.length} seed key(s) not understood by sdd-cli ${getPackageVersion()} ` +
+        stdout(info(`${seed.unknownKeys.length} seed key(s) not understood by sdd-cli ${getSddCliVersion()} ` +
             `and therefore IGNORED: ${seed.unknownKeys.join(", ")}. If the seed follows a newer ` +
             `context-pack-seed-schema than this build, upgrade sdd-cli; otherwise remove or correct the key.`));
     }

package/dist/lib/package-version.js

@@ -13,6 +13,25 @@ import { fileURLToPath } from "node:url";
  * Cached on first call.
  */
 let cached;
+let cachedEngine;
+/**
+ * The version of the sdd-cli ENGINE this code is. In @sdd-method/sdd-cli it is the package
+ * version. In a persona package (verify-cli, maintain-cli) the package version is the
+ * persona's own (0.1.0, 1.0.0), while every check and stamp that means "which sdd-cli is
+ * this" (a bundle's minimum_sdd_cli_version, the CLI version stamped into catalogues, the
+ * MCP server identity) must see the engine it was built from. The persona build writes that
+ * as `sddCliVersion` in the package's package.json. Found by maintain-cli's acceptance run:
+ * its sync refused every bundle because 0.1.0 < 1.41.0.
+ */
+export function getSddCliVersion() {
+    if (cachedEngine !== undefined)
+        return cachedEngine;
+    const here = dirname(fileURLToPath(import.meta.url));
+    const pkg = JSON.parse(readFileSync(resolve(here, "..", "..", "package.json"), "utf8"));
+    cachedEngine = pkg.sddCliVersion ?? pkg.version;
+    return cachedEngine;
+}
+/** The package's own version: what `--version` prints. For the engine version, use getSddCliVersion. */
 export function getPackageVersion() {
     if (cached !== undefined)
         return cached;
@@ -36,20 +55,38 @@ export function getPackageVersion() {
  *
  * Throws rather than defaults: a missing version must not render a floating install.
  */
-let cachedVerify;
-export function getVerifyCliVersion() {
-    if (cachedVerify !== undefined)
-        return cachedVerify;
+const cachedPersona = {};
+/**
+ * One exact npm version: X.Y.Z, optionally with a prerelease tag (1.1.0-rc.0), which a release
+ * candidate published under the `next` dist-tag needs so hosted CI can run it before the release.
+ * Never a range, a tag name or a wildcard.
+ */
+export const EXACT_VERSION = /^\d+\.\d+\.\d+(-[0-9A-Za-z]+(\.[0-9A-Za-z]+)*)?$/;
+function personaVersion(persona) {
+    const hit = cachedPersona[persona];
+    if (hit !== undefined)
+        return hit;
     const here = dirname(fileURLToPath(import.meta.url));
     const fromSource = here.endsWith(`${sep}src${sep}lib`);
     const file = fromSource
-        ? resolve(here, "..", "..", "scripts", "verify-version.json")
-        : resolve(here, "..", "verify-version.json");
+        ? resolve(here, "..", "..", "scripts", `${persona}-version.json`)
+        : resolve(here, "..", `${persona}-version.json`);
     const parsed = JSON.parse(readFileSync(file, "utf8"));
-    if (typeof parsed.version !== "string" || !/^\d+\.\d+\.\d+$/.test(parsed.version)) {
-        throw new Error(`${file} has no semver \`version\`; refusing to render an unpinned verify-cli install`);
+    if (typeof parsed.version !== "string" || !EXACT_VERSION.test(parsed.version)) {
+        throw new Error(`${file} has no semver \`version\`; refusing to render an unpinned ${persona}-cli install`);
     }
-    cachedVerify = parsed.version;
-    return cachedVerify;
+    cachedPersona[persona] = parsed.version;
+    return parsed.version;
+}
+export function getVerifyCliVersion() {
+    return personaVersion("verify");
+}
+/**
+ * The @sdd-method/maintain-cli version released WITH this sdd-cli. The managed CI workflow's
+ * catalogue freshness step installs exactly this version (M-ADR 0218 §5; ruled 2026-10-15, sdm-jts.6).
+ * Read the same way as the verify version, for the same reason (dist/ copy, never scripts/ live).
+ */
+export function getMaintainCliVersion() {
+    return personaVersion("maintain");
 }
 //# sourceMappingURL=package-version.js.map

package/dist/lib/validate/bundle-coherence.js

@@ -11,7 +11,7 @@
 // read 0 (the scores-coverage precedent, M-ADR 0205 §4.5).
 import { readLockFile, findForwardBase } from "../lock-file.js";
 import { loadSddManifest, } from "../catalogue/manifest-loader.js";
-import { getPackageVersion } from "../package-version.js";
+import { getSddCliVersion } from "../package-version.js";
 /**
  * Manifest profile → the forward base that profile expects. Profiles with no
  * entry (support-repo, organisation-profile) carry no expectation — silence,
@@ -37,7 +37,7 @@ export async function checkBundleCoherence(targetRepo) {
     let profile;
     try {
         const manifest = await loadSddManifest(targetRepo, {
-            cliVersion: getPackageVersion(),
+            cliVersion: getSddCliVersion(),
         });
         profile = manifest.profile;
     }

package/dist/lib/validate/plan.js

@@ -0,0 +1,54 @@
+/**
+ * The method-managed validation job, as DATA (bead sdm-dd6.2; Dagger ruling sdm-s48, 2026-10-15).
+ *
+ * One ordered plan per profile: every default validator, the platform's script-only checks, then the
+ * advisory catalogue freshness check. Every executor renders or runs THIS: the GitHub workflow
+ * generator (ci-workflow.ts) and the Dagger module (via `sdd-verify validate --list`). The job list
+ * drifted once when CI kept a hand copy of the suite (2026-10-01: three validators never reached CI),
+ * so no executor may keep its own list.
+ */
+import { validatorsForProfile } from "./dispatch.js";
+/** Titles kept from the hand-kept list, so step names stay readable. */
+const TITLES = {
+    "adr-structure": "Validate ADR metadata",
+    "spec-lifecycle": "Validate spec lifecycle",
+    "no-bare-adr": "Reject bare ADR references",
+    traceability: "Validate traceability",
+    "runway-classification": "Validate runway classification",
+    "corpus-consistency": "Validate corpus consistency",
+    config: "Validate configuration",
+    "app-docs": "Validate app documentation",
+    "integration-docs": "Validate integration documentation",
+    "yaml-parse": "Validate that tracked YAML parses",
+    "gate-readiness": "Validate gate readiness",
+    "bundle-coherence": "Report bundle coherence",
+    // CI has no platform checkout, so this step runs the app-only checks; the met gate needs the platform beside it.
+    "app-dependencies": "Validate app dependencies (app-only checks; no platform checkout in CI)",
+};
+export function methodValidationPlan(profile) {
+    const steps = validatorsForProfile(profile)
+        .filter((v) => v.optional !== true)
+        .map((v) => ({
+        id: v.name,
+        title: TITLES[v.name] ?? `Validate ${v.name}`,
+        tool: "sdd-verify",
+        args: ["validate", "--target-repo", ".", "--validator", v.name],
+        advisory: false,
+    }));
+    if (profile === "platform") {
+        steps.push({ id: "cascade-completeness", title: "Validate cascade completeness", tool: "bash", args: ["orchestration/scripts/validate-cascade-completeness.sh", "all"], advisory: false }, { id: "architecture-alignment", title: "Validate architecture alignment", tool: "bash", args: ["orchestration/scripts/validate-architecture-alignment.sh"], advisory: false });
+    }
+    steps.push({
+        id: "catalogue-freshness",
+        title: "Check catalogues reproduce from the specs (advisory)",
+        tool: "sdd-maintain",
+        args: ["catalogue", "build", "--check", "--sdd-path", "."],
+        advisory: true,
+    });
+    return steps;
+}
+/** The shell form of a step, as a CI host's `run:` line writes it. */
+export function stepCommand(step) {
+    return [step.tool, ...step.args].join(" ");
+}
+//# sourceMappingURL=plan.js.map

package/dist/maintain-version.json

@@ -0,0 +1,4 @@
+{
+  "version": "0.1.0",
+  "built_against_sdd_cli": "1.42.0"
+}

package/dist/verbs/validate.js

@@ -1,4 +1,8 @@
 import { runValidate } from "../lib/validate/index.js";
+import { methodValidationPlan } from "../lib/validate/plan.js";
+import { profileFromRepoKind, readRepoKind } from "../lib/repo-kind.js";
+const LISTABLE = ["platform", "application", "integration"];
+const isListable = (p) => LISTABLE.includes(p);
 import { resolvePathOption } from "./path-option.js";
 export function registerValidate(program) {
     program
@@ -8,7 +12,29 @@ export function registerValidate(program) {
         .option("--platform-root <dir>", "path to the sdd-method (or platform) repo, required for app-dependencies", resolvePathOption)
         .option("--validator <name>", "run only the named validator")
         .option("--strict", "treat warnings as failures")
+        .option("--list", "print the method-managed validation job for this repo's profile as JSON (the plan every CI executor runs, the Dagger module included) and run nothing")
+        .option("--profile <profile>", "with --list: the profile to list, instead of reading .sdd-repo-kind (platform | application | integration)")
         .action(async (opts) => {
+        if (opts.list === true) {
+            let profile;
+            if (opts.profile !== undefined) {
+                if (!isListable(opts.profile)) {
+                    process.stderr.write(`--profile must be platform, application or integration (got: ${opts.profile})\n`);
+                    process.exit(2);
+                }
+                profile = opts.profile;
+            }
+            else {
+                const kind = await readRepoKind(opts.targetRepo);
+                if (kind === null) {
+                    process.stderr.write(`Not an SDD repo (no .sdd-repo-kind in ${opts.targetRepo}); pass --profile\n`);
+                    process.exit(1);
+                }
+                profile = profileFromRepoKind(kind);
+            }
+            process.stdout.write(JSON.stringify({ profile, steps: methodValidationPlan(profile) }, null, 2) + "\n");
+            return;
+        }
         const { exitCode } = await runValidate({
             targetRepo: opts.targetRepo,
             ...(opts.platformRoot ? { platformRoot: opts.platformRoot } : {}),

package/dist/verify-program.js

@@ -49,7 +49,7 @@ const OUTSIDE = "is not part of sdd-verify, which cannot write to the repository
  * this binary exists to prevent. So an excluded verb fails, loudly, whatever
  * flags accompany it.
  */
-export function rejectOutsideSurface(program, argv) {
+export function rejectOutsideSurface(program, argv, outside = OUTSIDE) {
     const words = argv.filter((a) => !a.startsWith("-"));
     if (words.length === 0)
         return;
@@ -58,10 +58,10 @@ export function rejectOutsideSurface(program, argv) {
         return;
     const cmd = program.commands.find((c) => c.name() === verb);
     if (!cmd)
-        throw new Error(`'${verb}' ${OUTSIDE}`);
+        throw new Error(`'${verb}' ${outside}`);
     const subs = cmd.commands.map((c) => c.name()).filter((n) => n !== "help");
     if (subs.length > 0 && sub !== undefined && sub !== "help" && !subs.includes(sub)) {
-        throw new Error(`'${verb} ${sub}' ${OUTSIDE}`);
+        throw new Error(`'${verb} ${sub}' ${outside}`);
     }
 }
 export async function runVerify(argv) {
@@ -97,6 +97,14 @@ export function buildVerifyProgram() {
         writeOut: (str) => process.stdout.write(str),
         writeErr: (str) => process.stderr.write(str),
     });
+    registerVerifySurface(program);
+    return program;
+}
+/**
+ * The verify verbs, registered onto any program. sdd-verify calls it; sdd-maintain calls it too,
+ * which is what makes the personas nest structurally: whatever verify ships, maintain ships.
+ */
+export function registerVerifySurface(program) {
     registerValidate(program);
     registerList(program);
     const pack = program
@@ -110,6 +118,5 @@ export function buildVerifyProgram() {
     registerCatalogueImpact(catalogue);
     registerCatalogueBaselineCheck(catalogue);
     registerCatalogueVersion(catalogue);
-    return program;
 }
 //# sourceMappingURL=verify-program.js.map

package/dist/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.0.0",
-  "built_against_sdd_cli": "1.41.0"
+  "version": "1.1.0",
+  "built_against_sdd_cli": "1.42.0"
 }

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@sdd-method/verify-cli",
-  "version": "1.0.0",
+  "version": "1.1.0",
+  "sddCliVersion": "1.42.0",
   "description": "Verify an SDD repository without changing it — validate, list, and read-only catalogue and pack checks. Ships only the code those verbs reach; it cannot write to the repository it is pointed at. Authoring and maintenance are in @sdd-method/sdd-cli.",
   "license": "Apache-2.0",
   "type": "module",