@splitin/verification-cli 0.1.0-beta.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 SplitInTech
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NOTICE

@@ -0,0 +1,32 @@
+Verification Adapter SDK
+Copyright (c) 2026 SplitInTech
+
+This product is licensed under the MIT License. See LICENSE.
+
+Third-party notices
+===================
+
+This project redistributes no vendor identity SDKs in its core or server
+packages. Optional peer dependencies used by browser plugins:
+
+- `@stripe/stripe-js` — Stripe, Inc. (MIT). Used only by the Stripe Identity
+  browser plugin via dynamic import. Stripe is a trademark of Stripe, Inc.
+- `persona` — Persona Identities, Inc. Used only by the Persona browser plugin
+  via dynamic import.
+- `react-plaid-link` — Plaid Inc. (MIT). Used only by the Plaid Identity
+  Verification browser plugin via dynamic import. Plaid is a trademark of
+  Plaid Inc.
+
+Server adapters speak HTTPS to provider APIs with an injected Fetch
+implementation. They do not bundle Stripe, Persona, or Plaid Node SDKs.
+
+Runtime and tooling (declared in package.json; not vendored):
+
+- `ajv` — MIT
+- `jose` — MIT (Plaid webhook JWT verification)
+- `pg` — MIT (optional PostgreSQL executor)
+- TypeScript, tsup, vitest, Changesets — Apache-2.0 / MIT as published by
+  their authors
+
+This project provides engineering primitives. It is not a legal, KYC, KYB, or
+regulatory compliance certification.

package/README.md

@@ -0,0 +1,38 @@
+# @splitin/verification-cli
+
+`splitin-verification` initializes, validates, and diagnoses a self-hosted
+verification adapter workspace. Every generated configuration is
+**disabled-by-default development**. Production routes stay off until sandbox
+certification.
+
+```bash
+npx splitin-verification init
+npx splitin-verification config validate
+npx splitin-verification doctor
+```
+
+The CLI never prints values matching `sk_`, `rk_`, `whsec_`, or tokens.
+
+## Commands
+
+| Command | What it does |
+| --- | --- |
+| `init` | Write `verification.config.json` and `.env.example` with empty placeholders |
+| `config validate` | Check contract/API version compatibility and credential *shape* without creating billable production attempts |
+| `doctor` | Diagnose database, webhook, provider, browser-key, and routing readiness |
+| `db migrate` / `db rollback` | Write SQL migrations for the `verification` schema. Does not apply them to production |
+| `provider scaffold` | Write a fourth-party adapter stub for `com.example.employee_check` |
+| `provider conformance` | Run `@splitin/verification-adapter-sdk` `runAdapterConformance` against the sandbox fake |
+| `registry generate` | Write a typed provider/package registry (`productionRoutesEnabled = false`) |
+| `dev` | Bind a loopback sandbox listener. `/v1/*` and `/production/*` return 403 |
+| `release verify` | Check versions and npm trusted-publishing policy (OIDC, no embedded npm token) |
+
+## Credential checks
+
+`config validate` and `doctor` inspect prefixes (`sk_test_` vs `sk_live_`) and
+pinned API versions. They do **not** create Stripe Identity sessions, Persona
+inquiries, or Plaid Identity Verification attempts.
+
+## License
+
+MIT. See [LICENSE](LICENSE).