@sdd-method/verify-cli 1.2.0 → 1.3.0

package/NOTICE

@@ -2,7 +2,7 @@ sdd-cli
 Copyright 2026 Tom Foster
 
 This product includes software developed as part of the SDD method
-distribution (https://github.com/tomfosteruk/sdd-method).
+distribution.
 
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.

package/dist/lib/catalogue/scores-coverage.js

@@ -171,7 +171,7 @@ export const RUBRIC_ELIGIBILITY = [
         joinColumn: "id",
         refTransform: null,
         eligibilityFilter: null,
-        eligibilityNote: "NO local population, measured rather than assumed. Refs are '<domain>-feature-grounding-<slug>' and the tails are SIBLING SDD SLUGS (app-shell, cold-chain, connect-rapide), not rows in this SDD: 0/15 against products, applications, features and repositories, and 1/15 against capabilities — a coincidence, not a join. A cross-SDD reference the member tier cannot resolve, so its coverage is declared unmeasurable rather than given a transform that would produce plausible wrong numbers.",
+        eligibilityNote: "NO local population, measured rather than assumed. Refs are '<domain>-feature-grounding-<slug>' and the tails are SIBLING SDD SLUGS (app-shell, gift-cards, storefront-express), not rows in this SDD: 0/15 against products, applications, features and repositories, and 1/15 against capabilities — a coincidence, not a join. A cross-SDD reference the member tier cannot resolve, so its coverage is declared unmeasurable rather than given a transform that would produce plausible wrong numbers.",
     },
     {
         rubricId: "reverse-contract-quality",

package/dist/lib/lock-file.js

@@ -66,6 +66,8 @@ export function serialiseLockFile(lock) {
         ...(lock.ciRunner !== undefined ? [`ci_runner: "${lock.ciRunner}"`] : []),
         ...(lock.ciWorkflowBlockSha256 !== undefined ? [`ci_workflow_block_sha256: "${lock.ciWorkflowBlockSha256}"`] : []),
         ...(lock.ciModuleSha256 !== undefined ? [`ci_module_sha256: "${lock.ciModuleSha256}"`] : []),
+        ...(lock.cliSource !== undefined ? [`cli_source: ${lock.cliSource}`] : []),
+        ...(lock.cliPackage !== undefined ? [`cli_package: "${lock.cliPackage}"`] : []),
         "bundles:",
     ];
     for (const b of lock.bundles) {
@@ -117,6 +119,8 @@ function parseVersioned(raw) {
     let ciBinding;
     let ciRunner;
     let ciModuleSha256;
+    let cliSource;
+    let cliPackage;
     const bundles = [];
     let inBundles = false;
     let inPaths = false;
@@ -186,6 +190,10 @@ function parseVersioned(raw) {
                     ciRunner = stripQuotes(value);
                 else if (key === "ci_module_sha256")
                     ciModuleSha256 = stripQuotes(value);
+                else if (key === "cli_source")
+                    cliSource = stripQuotes(value);
+                else if (key === "cli_package")
+                    cliPackage = stripQuotes(value);
             }
             continue;
         }
@@ -313,6 +321,8 @@ function parseVersioned(raw) {
         ...(ciRunner !== undefined ? { ciRunner } : {}),
         ...(ciWorkflowBlockSha256 !== undefined ? { ciWorkflowBlockSha256 } : {}),
         ...(ciModuleSha256 !== undefined ? { ciModuleSha256 } : {}),
+        ...(cliSource !== undefined ? { cliSource } : {}),
+        ...(cliPackage !== undefined ? { cliPackage } : {}),
     };
 }
 function migrateV1(raw, legacyBundleName) {

package/dist/lib/validate/plan.js

@@ -25,7 +25,7 @@ const TITLES = {
     // CI has no platform checkout, so this step runs the app-only checks; the met gate needs the platform beside it.
     "app-dependencies": "Validate app dependencies (app-only checks; no platform checkout in CI)",
 };
-export function methodValidationPlan(profile) {
+export function methodValidationPlan(profile, opts = {}) {
     const steps = validatorsForProfile(profile)
         .filter((v) => v.optional !== true)
         .map((v) => ({
@@ -38,12 +38,15 @@ export function methodValidationPlan(profile) {
     if (profile === "platform") {
         steps.push({ id: "cascade-completeness", title: "Validate cascade completeness", tool: "bash", args: ["orchestration/scripts/validate-cascade-completeness.sh", "all"], advisory: false }, { id: "architecture-alignment", title: "Validate architecture alignment", tool: "bash", args: ["orchestration/scripts/validate-architecture-alignment.sh"], advisory: false });
     }
+    const gating = opts.catalogueRebuild === true;
     steps.push({
         id: "catalogue-freshness",
-        title: "Check catalogues reproduce from the specs (advisory)",
+        title: gating
+            ? "Check catalogues reproduce from the specs (gating: the pipeline rebuilt them)"
+            : "Check catalogues reproduce from the specs (advisory)",
         tool: "sdd-maintain",
         args: ["catalogue", "build", "--check", "--sdd-path", "."],
-        advisory: true,
+        advisory: !gating,
     });
     return steps;
 }

package/dist/maintain-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.2.0",
-  "built_against_sdd_cli": "1.43.0"
+  "version": "0.3.0",
+  "built_against_sdd_cli": "1.44.0"
 }

package/dist/verbs/validate.js

@@ -14,7 +14,12 @@ export function registerValidate(program) {
         .option("--strict", "treat warnings as failures")
         .option("--list", "print the method-managed validation job for this repo's profile as JSON (the plan every CI executor runs, the Dagger module included) and run nothing")
         .option("--profile <profile>", "with --list: the profile to list, instead of reading .sdd-repo-kind (platform | application | integration)")
+        .option("--catalogue-rebuild", "with --list: the pipeline rebuilt the catalogues on this run (M-ADR 0220 §4.4), so the catalogue freshness step gates instead of advising")
         .action(async (opts) => {
+        if (opts.catalogueRebuild === true && opts.list !== true) {
+            process.stderr.write("--catalogue-rebuild only applies with --list\n");
+            process.exit(2);
+        }
         if (opts.list === true) {
             let profile;
             if (opts.profile !== undefined) {
@@ -32,7 +37,7 @@ export function registerValidate(program) {
                 }
                 profile = profileFromRepoKind(kind);
             }
-            process.stdout.write(JSON.stringify({ profile, steps: methodValidationPlan(profile) }, null, 2) + "\n");
+            process.stdout.write(JSON.stringify({ profile, steps: methodValidationPlan(profile, { catalogueRebuild: opts.catalogueRebuild === true }) }, null, 2) + "\n");
             return;
         }
         const { exitCode } = await runValidate({

package/dist/verify-program.js

@@ -29,7 +29,7 @@ import { registerCatalogueBaselineCheck, registerCatalogueImpact, registerCatalo
 import { registerList } from "./verbs/list.js";
 import { registerPackValidate } from "./verbs/pack-validate.js";
 import { registerValidate } from "./verbs/validate.js";
-const SPEC_URL = "https://github.com/tomfosteruk/sdd-method/blob/main/docs/method/cli/sdd-cli-specification.md";
+const SPEC_URL = "docs/method/cli/sdd-cli-specification.md (in the method distribution)";
 /** The full surface, as `<verb>` or `<verb> <subcommand>`. Asserted by test. */
 export const VERIFY_SURFACE = [
     "validate",

package/dist/verify-version.json

@@ -1,4 +1,4 @@
 {
-  "version": "1.2.0",
-  "built_against_sdd_cli": "1.43.0"
+  "version": "1.3.0",
+  "built_against_sdd_cli": "1.44.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sdd-method/verify-cli",
-  "version": "1.2.0",
-  "sddCliVersion": "1.43.0",
+  "version": "1.3.0",
+  "sddCliVersion": "1.44.0",
   "description": "Verify an SDD repository without changing it — validate, list, and read-only catalogue and pack checks. Ships only the code those verbs reach; it cannot write to the repository it is pointed at. Authoring and maintenance are in @sdd-method/sdd-cli.",
   "license": "Apache-2.0",
   "type": "module",
@@ -17,10 +17,6 @@
     "zod": "^4.3.6",
     "@duckdb/node-api": "^1.5.5-r.3"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/tomfosteruk/sdd-cli.git"
-  },
   "publishConfig": {
     "access": "public"
   },