daacini — DaaCini CLI

A thin command-line client for DaaCini — diagrams-as-code for architecture, network, cloud, and security. You write diagram text; DaaCini returns clean SVG. Source in, SVG out — the rendering engine runs on IjyaLabs servers and is never bundled here.

Install

npm install -g @ijyalabs/daacini

Use

# render a .daacini diagram to SVG
daacini render diagram.daacini              # → diagram.svg
daacini render diagram.daacini -o out.svg
daacini render diagram.daacini --provenance   # embed a semantic-identity node,
                                             #   so `daacini provenance` can detect drift
cat diagram.daacini | daacini render        # → stdout

# check a diagram before rendering (CI-friendly: exit 1 on errors)
daacini lint diagram.daacini
daacini lint diagram.daacini --json          # machine-readable findings
cat diagram.daacini | daacini lint --strict  # also fail on warnings

# the one command CI should run: `format --check` + `lint --strict` together
daacini check diagram.daacini                # read-only gate, exit 1 on either
daacini format diagram.daacini               # canonicalise (stable ids, explicit edges)
daacini format diagram.daacini --check       # read-only: exit 1 if it would change
daacini lint diagram.daacini --fix --format  # rewrite in place instead

# has the MEANING changed, or only the layout/theme?
daacini semantic diagram.daacini --hash          # identity hash per diagram block
daacini semantic before.daacini --diff after.daacini
daacini semantic --check before.daacini after.daacini   # 0 same, 1 changed, 2 uncomparable
daacini provenance .                             # gate: committed X.svg drifted from X.daacini

# transpile an existing diagram (Mermaid / Graphviz DOT / PlantUML / D2)
daacini convert legacy.mmd                   # → legacy.daacini
daacini convert legacy.mmd --from mermaid
daacini convert legacy.dot --render -o out.svg   # convert then render in one call

# discover what you can draw
daacini kinds                                # every kind & mode (catalog)
daacini examples security:dfd                # a worked, ready-to-render example
daacini spec network                         # the machine capability spec for a surface
daacini audit topology.daacini               # network analysis: SPOF / segments / HA / oversub
daacini audit topology.daacini --strict      # CI gate: exit 1 on any error finding
daacini audit topology.daacini --sarif       # SARIF 2.1.0 for GitHub code-scanning
daacini audit topology.daacini --blast-radius --top 5     # which single failure hurts most
daacini audit topology.daacini --reachable "web->db"      # segmentation matrix
daacini audit topology.daacini --segmentation "web->db;web-/>mgmt"   # gate on those
daacini audit before.daacini --diff after.daacini         # what regressed vs improved
daacini audit topology.daacini --report      # all of the above as one JSON
daacini propose topology.daacini --origin hand-authored   # → daacini-proposal/v1 on stdout
                                             #   NOT code and NOT deployable; --origin is required
daacini project daacini.project.json         # resolve local imports, write reviewable derived artifacts
daacini doctor                               # check the service is reachable + versions

daacini --help is the full reference — every command and option, kept in the client itself so it cannot disagree with what the client accepts.

A tiny example — web.daacini:

network
title: Web Service
Users -> Load Balancer
Load Balancer -> Web A
Load Balancer -> Web B
Web A -> DB @primary
Web B -> DB

daacini render web.daacini    # → web.svg

Configuration

| | | | --- | --- | | --endpoint <url> / DAACINI_ENDPOINT | service URL (default https://daacini.ijyalabs.in) |

For controlled test environments, set DAACINI_ENDPOINT to an approved compatible service URL.

Exit codes

| code | meaning | | --- | --- | | 0 | the command succeeded, or the gate passed | | 1 | the gate failed (lint errors, an error-severity audit finding, a semantic change) | | 2 | the command line itself was wrong — unknown command, unknown option, a missing or unacceptable option value |

2 matters in CI. An unknown option used to be dropped in silence, so daacini audit topology.daacini --stric ran the informational audit and exited 0: a gate that could not fail, and nothing in the output said so. The same held for an option value the client interprets itself — --fail-on warning meant --fail-on error. Both are now refused, with the nearest real flag suggested.

Each command validates --fail-on against its own vocabulary: error | warn for audit --strict, duplicate | error for semantic --report.

Notes

• Requires Node 18+ (uses the built-in fetch).
• Personal & private use only; no commercial use or redistribution.
• Source retention is disabled by default by the hosted service. Do not put secrets in a diagram.

Project manifests

For a repository with local, reusable source blocks, store a daacini.project.json with the diagrams and run daacini project daacini.project.json. The client resolves bounded local @@ imports and produces SVG, lint, audit, SARIF, and SHA-256 input records in .daacini-artifacts; it does not copy source into that output. See docs/55-hosted-project-manifest.md.

Support / feedback: [email protected] · Licensing: [email protected]