feat: add ory validate opl

[alnr]

Adds ory validate opl --file ./my-permissions.ts, a thin command over the
RelationshipAPI.CheckOplSyntax SDK call that was already vendored but unused.
It replaces the raw curl workaround from the issue and exits non-zero on
syntax errors, so it can be used as a CI/CD check before ory update opl.

$ ory validate opl --file ./namespace_config.ts
The Ory Permission Language file is valid.

$ ory validate opl --file ./broken.ts
./broken.ts:1:36: expected 'permits' or 'related', got ""
$ echo $?
1

$ ory validate opl --file ./broken.ts --format json
{"errors":[{"end":{"Line":1,"column":36},"message":"expected 'permits' or 'related', got \"\"","start":{"Line":1,"column":36}}]}

Details:

• Errors are rendered compiler-style (<source>:<line>:<column>: <message>) on
  stderr for the human-readable formats, so editors and CI log parsers pick up
  the location. The machine-readable formats print the API result verbatim, with
  the errors key always present so that jq '.errors | length' works on the
  success path too.
• --file - reads from stdin, and errors are then reported against stdin.
• --quiet silences the success message but not the syntax errors.
• An empty file is reported as valid (the SDK refuses to send a zero-length
  body, and a whitespace-only file — semantically identical — is valid).

The syntax check endpoint lives on the project's own API
(<slug>.projects.oryapis.com) rather than the Console API, and there was no
SDK-client helper for that host, so this also adds
CommandHelper.NewProjectAPIClient.

Related Issue or Design Document

Closes #402.

Checklist

• I have read the contributing guidelines
  and signed the CLA.
• I have referenced an issue containing the design document if my change
  introduces a new feature.
• I have read the security policy.
• I confirm that this pull request does not address a security
  vulnerability. If this pull request addresses a security vulnerability, I
  confirm that I got approval (please contact
  security@ory.com) from the maintainers to push
  the changes.
• I have added tests that prove my fix is effective or that my feature
  works.
• I have added the necessary documentation within the code base (if
  appropriate).

Further comments

The command is mounted under the existing ory validate parent (next to
validate identity) rather than as a new top-level ory check verb, as
suggested in the issue — validate already exists and carries the same
semantics.

🤖 Generated with Claude Code

https://claude.ai/code/session_012UL5u7KWLdu8hzNTNvYq5a

Summary by CodeRabbit

• New Features

  • Added validate opl to check project namespace configuration syntax.
  • Supports file input, standard input, quiet mode, and JSON output.
  • Reports syntax errors with clear source locations and machine-readable messages.
  • Added an API client for interacting with the selected project’s API.

• Tests

  • Added coverage for valid, invalid, empty, JSON, stdin, quiet, and project-selection scenarios.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fcb05e16-c1e5-4f52-ba1d-fa42fde72451

📥 Commits

Reviewing files that changed from the base of the PR and between 539898a and 80fd958.

📒 Files selected for processing (4)

• cmd/cloudx/client/sdks.go
• cmd/cloudx/project/validate_namespace_config.go
• cmd/cloudx/project/validate_namespace_config_test.go
• cmd/cloudx/validate.go

---

📝 Walkthrough

Walkthrough

Adds a project-scoped SDK client and registers validate opl, which reads namespace configuration files or stdin, checks OPL syntax through the Project API, formats errors, and supports table, JSON, quiet, and human-readable output modes.

Changes

Namespace configuration validation

Layer / File(s)	Summary
Project-scoped API client cmd/cloudx/client/sdks.go	Adds an authenticated SDK client targeting the selected project’s <slug>.projects API endpoint.
OPL validation command cmd/cloudx/project/validate_namespace_config.go, cmd/cloudx/validate.go	Adds source loading, syntax checking, parse-error formatting, structured output, failure handling, and validate opl registration.
Validation command coverage cmd/cloudx/project/validate_namespace_config_test.go	Tests valid, invalid, empty, stdin, JSON, quiet, and project-selection flows.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant CommandHelper
  participant RelationshipAPI
  CLI->>CommandHelper: Create project API client
  CommandHelper->>RelationshipAPI: Configure selected project endpoint
  CLI->>RelationshipAPI: Check OPL syntax
  RelationshipAPI-->>CLI: Return parse errors
  CLI-->>CLI: Format output and set exit status

Loading

Possibly related PRs

• ory/cli#444: Modifies the shared project HTTP client construction used by the new project-scoped API client.

Suggested reviewers: zepatrik

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: adding the OPL validation command.
Description check	✅ Passed	The description follows the template and includes the feature summary, linked issue, checklist, and extra implementation notes.
Linked Issues check	✅ Passed	The PR implements the requested OPL syntax check command for CI/CD and replaces the curl workaround, satisfying issue #402.
Out of Scope Changes check	✅ Passed	The changes are focused on the new validate opl command, its SDK helper, tests, and command registration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/402-validate-opl

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[alnr]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.