@ogygie/cli 0.2.0 → 0.4.0

package/dist/cli.js

@@ -14667,7 +14667,20 @@ var OgygieManifestSchema = external_exports.object({
       name: external_exports.string(),
       path: external_exports.string(),
       type: external_exports.enum(["api", "front", "gateway"]),
-      entryPoint: external_exports.string()
+      entryPoint: external_exports.string(),
+      /**
+       * Code the product HOSTS without maintaining it — imported as-is from
+       * elsewhere, the framework's own dev tooling being the typical case.
+       * A vendored app is skipped by the vocabulary gate: a product's business
+       * vocabulary has no claim over code it will never rename.
+       *
+       * A literal `true`, like `shared` on a table: an app is either vendored
+       * (and says so) or the product's own (and stays silent) — no third
+       * state. The derogation is declared here, machine-readably, and the gate
+       * ANNOUNCES it on every run — one that stops being visible is one that
+       * gets forgotten.
+       */
+      vendored: external_exports.literal(true).optional()
     })
   ),
   features: external_exports.array(FeatureManifestSchema),
@@ -14991,6 +15004,19 @@ function diffLines(oldText, newText) {
   return output.join("\n");
 }
 
+// src/framework-gates.ts
+var frameworkGates = [
+  {
+    scriptName: "ogygie:verify-vocabulary",
+    command: "ogygie verify-vocabulary",
+    intent: "Le vocabulaire d\xE9clar\xE9 au manifeste : alias interdits dans les identifiants, puret\xE9 des fichiers gouvern\xE9s."
+  }
+];
+function missingFrameworkGates(scripts) {
+  const commands = Object.values(scripts ?? {}).join(" ; ");
+  return frameworkGates.filter((gate) => !commands.includes(gate.command));
+}
+
 // src/version.ts
 function compareVersions(a, b) {
   const partsA = a.split(".").map(Number);
@@ -15005,6 +15031,30 @@ function compareVersions(a, b) {
 }
 
 // src/commands/upgrade.ts
+function reportMissingGates(deps) {
+  const packageJsonPath = join4(deps.projectRoot, "package.json");
+  if (!existsSync4(packageJsonPath)) return;
+  let scripts;
+  try {
+    const parsed = JSON.parse(readFileSync4(packageJsonPath, "utf8"));
+    const scriptsValue = typeof parsed === "object" && parsed !== null ? parsed.scripts : void 0;
+    if (typeof scriptsValue === "object" && scriptsValue !== null) {
+      scripts = scriptsValue;
+    }
+  } catch {
+    return;
+  }
+  const missing = missingFrameworkGates(scripts);
+  if (missing.length === 0) return;
+  deps.log("");
+  deps.log(
+    `\u26A0 ${missing.length} gate(s) du framework ne tournent pas dans ta boucle locale (package.json n'est pas gouvern\xE9 \u2014 \xE0 toi de l'ajouter, la CI gouvern\xE9e les appelle d\xE9j\xE0) :`
+  );
+  for (const gate of missing) {
+    deps.log(`    "${gate.scriptName}": "${gate.command}"   # ${gate.intent}`);
+  }
+  deps.log("  puis appelle ces scripts depuis ton script `verify`.");
+}
 async function upgradeProject(deps) {
   const installedVersion = readPinnedOgygieVersion(deps.projectRoot);
   if (compareVersions(deps.cliVersion, installedVersion) < 0) {
@@ -15013,7 +15063,7 @@ async function upgradeProject(deps) {
       message: `The running CLI (${deps.cliVersion}) is older than the project's ogygieVersion (${installedVersion}) \u2014 a downgrade does not exist.`,
       file: "ogygie.manifest.json",
       cause: `cli ${deps.cliVersion} < ogygieVersion ${installedVersion}`,
-      suggestedFix: "Run `pnpm update @ogygie/cli` first, then retry the upgrade."
+      suggestedFix: `Install a CLI at least as recent as the project, WITH an explicit version (init pins exact ranges, so a bare \`pnpm update\` moves nothing): pnpm update @ogygie/core@${installedVersion} @ogygie/cli@${installedVersion} \u2014 then retry the upgrade.`
     });
   }
   if (compareVersions(deps.cliVersion, installedVersion) === 0) {
@@ -15089,6 +15139,7 @@ ${diff}`);
   deps.log(
     `Rappel lockstep (D2) : mettre @ogygie/core ET @ogygie/cli \xE0 ${deps.cliVersion} (\`pnpm update @ogygie/core@${deps.cliVersion} @ogygie/cli@${deps.cliVersion}\`), puis committer l'upgrade SEUL \u2014 jamais m\xEAl\xE9 \xE0 une feature.`
   );
+  reportMissingGates(deps);
   return {
     fromVersion: installedVersion,
     toVersion: deps.cliVersion,
@@ -15152,9 +15203,6 @@ function stripComments(sourceText) {
 }
 
 // ../ogygie-core/src/vocabulary-audit.ts
-function vocabularyRootsOf(vocabulary) {
-  return vocabulary.entries.flatMap((entry) => [entry.canonical, ...entry.forbiddenAliases]);
-}
 function canonicalByAlias(vocabulary) {
   const byAlias = /* @__PURE__ */ new Map();
   for (const entry of vocabulary.entries) {
@@ -15167,7 +15215,7 @@ function auditProductVocabulary(input) {
   if (vocabulary === void 0 || vocabulary.entries.length === 0) return [];
   const canonicalOfAlias = canonicalByAlias(vocabulary);
   const forbiddenAliases = [...canonicalOfAlias.keys()];
-  const everyRoot = vocabularyRootsOf(vocabulary);
+  const canonicalTerms = vocabulary.entries.map((entry) => entry.canonical);
   const violations = [];
   for (const file2 of input.sourceFiles) {
     for (const match of findProductVocabulary(stripComments(file2.content), forbiddenAliases)) {
@@ -15180,7 +15228,7 @@ function auditProductVocabulary(input) {
     }
   }
   for (const file2 of input.governedFiles) {
-    for (const match of findProductVocabulary(file2.content, everyRoot)) {
+    for (const match of findProductVocabulary(file2.content, canonicalTerms)) {
       violations.push({
         kind: "GOVERNED_FILE",
         filePath: file2.path,
@@ -15244,13 +15292,22 @@ function collectCodeFiles(projectRoot, folder) {
 }
 function productCodeFoldersOf(manifest) {
   return [
-    ...manifest.apps.map((app) => app.path),
+    ...manifest.apps.filter((app) => app.vendored !== true).map((app) => app.path),
     ...(manifest.framework?.packages ?? []).map((packageEntry) => packageEntry.path)
   ];
 }
+function vendoredAppsOf(manifest) {
+  return manifest.apps.filter((app) => app.vendored === true).map((app) => ({ name: app.name, path: app.path }));
+}
 function verifyVocabulary(deps) {
   const manifest = readManifest(deps.projectRoot);
   if (manifest.vocabulary === void 0) return [];
+  const vendored = vendoredAppsOf(manifest);
+  if (vendored.length > 0 && deps.log !== void 0) {
+    deps.log(
+      `${vendored.length} app(s) hors du scan (vendored \u2014 code h\xE9berg\xE9, non maintenu par le produit) : ${vendored.map((app) => `${app.name} (${app.path})`).join(", ")}`
+    );
+  }
   const sourceFiles = productCodeFoldersOf(manifest).flatMap(
     (folder) => collectCodeFiles(deps.projectRoot, folder)
   );
@@ -15292,6 +15349,18 @@ var governedChecksumsByVersion = {
     "AGENTS.md": "ca73ab619d8c55fac11858d815bf5fbab6537ecebe7ae4123cbdeb3e3e36bf1a",
     "CLAUDE.md": "785ee8d90e368806d8cf0b4d84a15f29d1dc961168bda86cf1a6c60a923c8c9b",
     "tsconfig.base.json": "0f8919e9ed8bbc88e0308fa2fa91471dabb18d1df721bd78c04076597eba89a2"
+  },
+  "0.3.0": {
+    ".github/workflows/ogygie-gates.yml": "48c40efe9fe66dd0f9c3b94287026d80eae9afd6782b5833fdf8846d8662babf",
+    "AGENTS.md": "ca73ab619d8c55fac11858d815bf5fbab6537ecebe7ae4123cbdeb3e3e36bf1a",
+    "CLAUDE.md": "785ee8d90e368806d8cf0b4d84a15f29d1dc961168bda86cf1a6c60a923c8c9b",
+    "tsconfig.base.json": "0f8919e9ed8bbc88e0308fa2fa91471dabb18d1df721bd78c04076597eba89a2"
+  },
+  "0.4.0": {
+    ".github/workflows/ogygie-gates.yml": "48c40efe9fe66dd0f9c3b94287026d80eae9afd6782b5833fdf8846d8662babf",
+    "AGENTS.md": "c7d51a0cd97b67343b486bdb7c54914da68d96409eaa985959d2a525c65549fd",
+    "CLAUDE.md": "785ee8d90e368806d8cf0b4d84a15f29d1dc961168bda86cf1a6c60a923c8c9b",
+    "tsconfig.base.json": "0f8919e9ed8bbc88e0308fa2fa91471dabb18d1df721bd78c04076597eba89a2"
   }
 };
 
@@ -15378,7 +15447,10 @@ ogygie check \u2014 ${problems.length} probl\xE8me(s).`);
       `ogygie check \u2014 OK, lockstep ${cliVersion()} et fichiers gouvern\xE9s intacts.`
     );
   } else if (command === "verify-vocabulary") {
-    const problems = verifyVocabulary({ projectRoot: process.cwd() });
+    const problems = verifyVocabulary({
+      projectRoot: process.cwd(),
+      log: (line) => console.log(line)
+    });
     if (problems.length > 0) {
       for (const problem of problems) printError(problem);
       console.error(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogygie/cli",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Ogygie framework CLI: deterministic scaffolding (init), governed-file upgrades (upgrade) and lockstep verification (check) for Ogygie products.",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,7 @@
     "tsx": "^4.20.0",
     "typescript": "^5.8.0",
     "zod": "^4.0.0",
-    "@ogygie/core": "0.2.0"
+    "@ogygie/core": "0.4.0"
   },
   "scripts": {
     "typecheck": "tsc -p tsconfig.json",

package/templates/project/AGENTS.md

@@ -272,6 +272,14 @@ se fait PAR RACINE, donc une racine trop courte attrape des mots génériques
 (déclarer `memo` interdit fait tomber `memory`, `createInMemoryDb`…). Une racine
 se déclare assez longue pour ne nommer que le concept.
 
+**Le code que le produit héberge sans le maintenir** — l'outil de dev du
+framework propagé dans le dépôt en est le cas type — se déclare
+`"vendored": true` sur son entrée d'`apps[]`, et sort du scan : un vocabulaire
+métier n'a pas de prise sur du code que le produit ne renommera jamais. La
+dérogation se déclare au manifeste, comme celle d'une table partagée, et le
+gate l'ANNONCE à chaque exécution — une dérogation qu'on ne voit plus est une
+dérogation qui s'oublie. Elle ne couvre JAMAIS le code du produit lui-même.
+
 ## Front (apps/web) — règles et templates canoniques
 
 ### Stack imposée (toute autre lib = amendement DECISIONS.md d'abord)