cyber-sdd 0.4.0 → 0.4.2

package/license

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Unional
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cyber-sdd",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Spec-Driven Development. Scaffold, validate, and maintain behavioral specs (spec.md + .feature files) for software features.",
   "repository": {
     "type": "git",
@@ -10,9 +10,10 @@
   "license": "MIT",
   "type": "module",
   "bin": {
-    "sdd-check-specs": "./skills/check-project-specs/scripts/check-project-specs.mts"
+    "sdd-check-specs": "./dist/check-project-specs/scripts/check-project-specs.js"
   },
   "files": [
+    "dist",
     "skills",
     "agents",
     ".plugin",
@@ -21,10 +22,18 @@
     "!skills/**/*.test.mts"
   ],
   "dependencies": {
-    "gherkin-cli": "0.0.2"
+    "gherkin-cli": "0.2.1"
   },
   "homepage": "https://github.com/cyberuni/cyber-sdd",
+  "devDependencies": {
+    "tsdown": "^0.23.0"
+  },
+  "engines": {
+    "node": ">=22.11"
+  },
   "scripts": {
+    "build": "tsdown",
+    "build:vendor": "tsdown -c tsdown.vendor.config.ts",
     "check:spec": "node ./skills/check-project-specs/scripts/check-project-specs.mts",
     "test": "node --test \"skills/*/scripts/*.test.mts\"",
     "typecheck": "tsc -p tsconfig.json"

package/skills/check-project-specs/scripts/check-project-specs.mts

@@ -20,7 +20,7 @@ import {
 	type SpecRecord,
 } from '../../discover-specs/scripts/discover-specs.mts'
 
-const SKILLS_DIR = resolve(dirname(fileURLToPath(import.meta.url)), '../..')
+const HERE = fileURLToPath(import.meta.url)
 
 // ─── the engine set ───────────────────────────────────────────────────────────
 
@@ -61,6 +61,17 @@ export const ENGINES: Engine[] = [
 	},
 ]
 
+/**
+ * Where an engine runs from. The .mts source runs its siblings in the skills tree; the
+ * published bin runs from dist/, which mirrors that tree compiled to .js (tsdown.config.ts)
+ * — Node will not strip types under node_modules, so the bin must never reach back into
+ * the .mts tree.
+ */
+export function enginePath(e: Engine, here: string = HERE): string {
+	const skillsDir = resolve(dirname(here), '../..')
+	return join(skillsDir, here.endsWith('.mts') ? e.script : e.script.replace(/\.mts$/, '.js'))
+}
+
 // ─── repo root ────────────────────────────────────────────────────────────────
 
 /** Walk up from `start` for the workspace marker. Returns '' when not found. */
@@ -200,7 +211,7 @@ function runEngines(repoRoot: string, specDir: string): number {
 		// cwd is the repo root, not the project dir: the engines resolve
 		// repo-root-relative references against process.cwd().
 		try {
-			execFileSync('node', [join(SKILLS_DIR, e.script), ...e.args(specDir)], {
+			execFileSync('node', [enginePath(e), ...e.args(specDir)], {
 				cwd: repoRoot,
 				stdio: 'inherit',
 			})

package/skills/concept-index/scripts/concept-index.mts

@@ -10,7 +10,7 @@
 // are exported for node:test; running the file directly drives the CLI.
 
 import { existsSync, readdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
-import { join } from 'node:path'
+import { join, relative } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
 export const BEGIN_MARKER = '<!-- BEGIN generated: by-concept (project-spec/concept-index) -->'
@@ -120,7 +120,7 @@ function walk(dir: string, specDir: string, out: NodeRecord[]): void {
 		} else if (entry.name.endsWith('.md')) {
 			const fm = parseFrontmatter(readFileSync(full, 'utf8'))
 			if (!fm || fm.concepts.length === 0) continue
-			const relPath = full.slice(specDir.length + 1).replace(/\\/g, '/')
+			const relPath = relative(specDir, full).replace(/\\/g, '/')
 			out.push({
 				relPath,
 				display: displayPath(relPath),

package/skills/spec-gate/README.md

@@ -24,3 +24,12 @@ References `sdd:lifecycle-governance`, `sdd:ownership-governance`, `sdd:gate-val
   reconcile); run via `pnpm verify:specs-new`. Tested by `check-spec-state.test.mts`.
 - `check-suite.mts` — deterministic `.feature`-form validator (Gherkin validity, boolean-`Then`
   form, scenario ordering); run via `pnpm verify:specs-new`. Tested by `check-suite.test.mts`.
+  It imports gherkin-cli from `../vendor/gherkin-cli.mjs`, a committed self-contained bundle, so it
+  runs from an installed plugin, which has no `node_modules`. `pnpm build:vendor` rebuilds the
+  bundle; `check-suite-installed.test.mts` runs the engine from a copy of the plugin's files and
+  fails while the bundle is stale.
+- `classify-edit-class.mts` — the structural edit-class classifier for touched frozen `.feature`
+  files. It imports the same `../vendor/gherkin-cli.mjs` bundle; `classify-edit-class-installed.test.mts`
+  runs it from a copy of the plugin's files.
+- `vendor/gherkin-cli.mjs` is shared: `touch-set-correction` and `verify-scenarios` import it from
+  here too, so the plugin ships one copy.

package/skills/spec-gate/scripts/check-suite.mts

@@ -6,7 +6,8 @@
 import { type Dirent, readdirSync, readFileSync, realpathSync } from 'node:fs'
 import { basename, dirname, join } from 'node:path'
 import { pathToFileURL } from 'node:url'
-import { validateFeatures } from 'gherkin-cli'
+// The bundled copy, not the package: an installed plugin has no node_modules to resolve it from.
+import { validate } from '../vendor/gherkin-cli.mjs'
 
 // ─── types ────────────────────────────────────────────────────────────────────
 
@@ -143,7 +144,7 @@ export interface ParseError {
 // Maps the pinned parser's per-file report to its errors (empty array when it parses) so callers
 // can look a path up directly.
 export function runGherkinValidate(paths: string[]): Map<string, ParseError[]> {
-	const { files } = validateFeatures(paths)
+	const { files } = validate(paths)
 	const out = new Map<string, ParseError[]>()
 	for (const f of files) {
 		out.set(

package/skills/spec-gate/scripts/classify-edit-class.mts

@@ -9,7 +9,7 @@
 // The classification is STRUCTURAL, never a raw git line-diff. A raw line-diff is fooled by a
 // trailing step orphaned off a frozen scenario onto a newly added adjacent scenario: the orphan
 // shows no `-` line and reads as purely additive, so a narrowing self-clears silently and
-// Clearance never fires. The pinned `gherkin-cli@0.0.2` `diffFeatures(paths, {base})` is AST-level
+// Clearance never fires. The pinned `gherkin-cli` `diffFeatures(paths, {base})` is AST-level
 // and is not fooled — it reports the losing baseline scenario as `modified` (`addOnly: false`).
 //
 // The pin is load-bearing, not incidental. Through `0.0.1` the differ's scenario identity covered
@@ -36,7 +36,7 @@ import { execFileSync } from 'node:child_process'
 import { readFileSync, realpathSync } from 'node:fs'
 import { dirname, join, relative, resolve, sep } from 'node:path'
 import { pathToFileURL } from 'node:url'
-import { type DiffReader, diffFeatures, GitError } from 'gherkin-cli'
+import { GitError, diff as gherkinDiff, type ReadsGitDiff } from '../vendor/gherkin-cli.mjs'
 
 // ─── types ────────────────────────────────────────────────────────────────────
 
@@ -193,13 +193,13 @@ function readGitShow(base: string, path: string, cwd: string): string {
 	}
 }
 
-// Thin boundary around the pinned `gherkin-cli` `diffFeatures` — never a re-implemented differ.
+// Thin boundary around the pinned `gherkin-cli` `diff` — never a re-implemented differ.
 // classifyFromDiff / classifyFromFileResult carry the tested logic; this only wires the engine in.
-// Takes a batch of paths (`diffFeatures` is already variadic over paths) so a multi-file caller
+// Takes a batch of paths (`diff` is already variadic over paths) so a multi-file caller
 // pays for one parse pass, not one per file.
 export type GherkinDiffRunner = (base: string, paths: string[], cwd: string) => GherkinDiffOutput
 
-// `diffFeatures`'s default reader resolves each path via `path.resolve(file)` against
+// `diff`'s default reader resolves each path via `path.resolve(file)` against
 // `process.cwd()` and derives git's own cwd from THAT resolved location (`dirname` of the
 // resolved path, then `git ls-files --full-name` to recover the repo-relative path) — it never
 // trusts a caller-supplied cwd for the git commands at all. That self-derivation is why the
@@ -208,7 +208,7 @@ export type GherkinDiffRunner = (base: string, paths: string[], cwd: string) =>
 // This reader is the library's own extension seam ("Injectable so tests can skip git"), replicated
 // verbatim with the one substitution that matters here — `resolve(cwd, file)` instead of
 // `resolve(file)` — so a caller's `cwd` participates without discarding that self-correction.
-function makeCwdReader(cwd: string): DiffReader {
+function makeCwdReader(cwd: string): ReadsGitDiff['readDiff'] {
 	return (file, base) => {
 		const abs = resolve(cwd, file)
 		const dir = dirname(abs)
@@ -249,7 +249,7 @@ function makeCwdReader(cwd: string): DiffReader {
 }
 
 export const runGherkinDiff: GherkinDiffRunner = (base, paths, cwd) =>
-	diffFeatures(paths, { base, reader: makeCwdReader(cwd) })
+	gherkinDiff(paths, { base, full: true }, { readDiff: makeCwdReader(cwd) })
 
 // ─── per-file classification ────────────────────────────────────────────────────
 

package/skills/spec-gate/vendor/gherkin-cli.d.mts

@@ -0,0 +1,2 @@
+// Types for the bundled gherkin-cli beside this file: the same module, so the same types.
+export * from 'gherkin-cli'