@ogygie/cli 0.6.0 → 0.7.0

package/dist/cli.js

@@ -14588,6 +14588,42 @@ var governedFiles = [
     templatePath: "project/tsconfig.base.json",
     targetPath: "tsconfig.base.json",
     description: "Strict TypeScript options decided by the framework."
+  },
+  // The gate scripts (spec ogygie-standalone-repo v3). They decide nothing by
+  // themselves: they apply the framework's rules to what the manifest
+  // declares, so they are identical in every project — and a gate corrected
+  // upstream must reach every project, which recopying by hand never achieved.
+  // What used to be product-specific in them now lives in the manifest
+  // (`tenancy`).
+  {
+    templatePath: "project/scripts/verify-manifest.ts",
+    targetPath: "scripts/verify-manifest.ts",
+    description: "Gate: the manifest tells the truth about the actual code."
+  },
+  {
+    templatePath: "project/scripts/verify-specs.ts",
+    targetPath: "scripts/verify-specs.ts",
+    description: "Gate: spec frontmatter, canonical sections, lifecycle, decision refs."
+  },
+  {
+    templatePath: "project/scripts/verify-contracts.ts",
+    targetPath: "scripts/verify-contracts.ts",
+    description: "Gate: transitive purity of every contract entry point."
+  },
+  {
+    templatePath: "project/scripts/lint-interdits.ts",
+    targetPath: "scripts/lint-interdits.ts",
+    description: "Gate: the absolute bans of AGENTS.md, plus the raw-db rule derived from the manifest."
+  },
+  {
+    templatePath: "project/scripts/ogygie-impact.ts",
+    targetPath: "scripts/ogygie-impact.ts",
+    description: "Tool: blast radius of a feature, derived from the manifest."
+  },
+  {
+    templatePath: "project/scripts/ogygie-design-brief.ts",
+    targetPath: "scripts/ogygie-design-brief.ts",
+    description: "Tool: design brief derived from tokens, patterns, contracts and specs."
   }
 ];
 
@@ -14665,6 +14701,12 @@ var PackageManifestSchema = external_exports.object({
   dependsOn: external_exports.array(PackageDependencySchema).describe("Other PRODUCT packages, as package:<name> \u2014 never a feature: a package that depended on one would live under an app, and would be a feature"),
   status: external_exports.enum(["skeleton", "in-progress", "delivered"])
 });
+var TenancyManifestSchema = external_exports.object({
+  column: external_exports.string().min(1).describe("SQL name of the tenant column, e.g. workspace_id \u2014 the one AGENTS.product.md announces"),
+  rawDbAllowed: external_exports.array(FeatureNameSchema).default([]).describe(
+    "Features allowed to reach the raw database: the tenancy socle, which BUILDS the contexts and therefore predates them. Every other feature goes through tenantDb"
+  )
+});
 var OgygieManifestSchema = external_exports.object({
   version: external_exports.literal(1),
   product: external_exports.object({
@@ -14695,6 +14737,9 @@ var OgygieManifestSchema = external_exports.object({
     })
   ),
   features: external_exports.array(FeatureManifestSchema),
+  tenancy: TenancyManifestSchema.optional().describe(
+    "Product values the framework gates need \u2014 absent, the tenancy checks do not run"
+  ),
   packages: external_exports.array(PackageManifestSchema).optional().describe("Product code living outside every app \u2014 libraries, engines. Absent = the project has none"),
   vocabulary: ProductVocabularySchema.optional().describe(
     "The product's closed vocabulary \u2014 declared here, enforced by `ogygie verify-vocabulary`. Absent = gate silent"
@@ -14743,6 +14788,15 @@ var OgygieManifestSchema = external_exports.object({
   (manifest.packages ?? []).forEach((packageEntry, index) => {
     checkPackageDependencies(packageEntry.dependsOn, ["packages", index, "dependsOn"]);
   });
+  (manifest.tenancy?.rawDbAllowed ?? []).forEach((featureName, index) => {
+    if (!featureNames.has(featureName)) {
+      context.addIssue({
+        code: "custom",
+        path: ["tenancy", "rawDbAllowed", index],
+        message: `"${featureName}" matches no declared feature`
+      });
+    }
+  });
   const canonicalOwners = /* @__PURE__ */ new Map();
   const aliasOwners = /* @__PURE__ */ new Map();
   (manifest.vocabulary?.entries ?? []).forEach((entry, index) => {
@@ -15503,6 +15557,18 @@ var governedChecksumsByVersion = {
     "AGENTS.md": "c7d51a0cd97b67343b486bdb7c54914da68d96409eaa985959d2a525c65549fd",
     "CLAUDE.md": "785ee8d90e368806d8cf0b4d84a15f29d1dc961168bda86cf1a6c60a923c8c9b",
     "tsconfig.base.json": "0f8919e9ed8bbc88e0308fa2fa91471dabb18d1df721bd78c04076597eba89a2"
+  },
+  "0.7.0": {
+    ".github/workflows/ogygie-gates.yml": "48c40efe9fe66dd0f9c3b94287026d80eae9afd6782b5833fdf8846d8662babf",
+    "AGENTS.md": "c7d51a0cd97b67343b486bdb7c54914da68d96409eaa985959d2a525c65549fd",
+    "CLAUDE.md": "785ee8d90e368806d8cf0b4d84a15f29d1dc961168bda86cf1a6c60a923c8c9b",
+    "scripts/lint-interdits.ts": "d859e132b7020942a5211f5419b10045170dee6afba3f50ca5642570a5c4a683",
+    "scripts/ogygie-design-brief.ts": "aba1585717b30808dd0bc8930a37a1ad2d83ee6869f969dbd06ca595e37a4a89",
+    "scripts/ogygie-impact.ts": "0dd3ff8cdd57e6cff0dfec1c669fce53fde9ae43f0784ed114771c83d1f8b357",
+    "scripts/verify-contracts.ts": "725cae269e78ecdaa1923553c3097d8d96277824b5bd79a9a40284c6246036b7",
+    "scripts/verify-manifest.ts": "1adca9edee11e54ccaf0511012411516c52c68a32f686ca320c7e437afb22c7c",
+    "scripts/verify-specs.ts": "ccf09c04155e5e88fa9acd4a5db33c2c79e85923b2d92e8e866fe9cbc4cdf342",
+    "tsconfig.base.json": "0f8919e9ed8bbc88e0308fa2fa91471dabb18d1df721bd78c04076597eba89a2"
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogygie/cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Ogygie framework CLI: deterministic scaffolding (init), governed-file upgrades (upgrade) and lockstep verification (check) for Ogygie products.",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,7 @@
     "tsx": "^4.20.0",
     "typescript": "^5.8.0",
     "zod": "^4.0.0",
-    "@ogygie/core": "0.6.0"
+    "@ogygie/core": "0.7.0"
   },
   "scripts": {
     "typecheck": "tsc -p tsconfig.json",

package/templates/project/AGENTS.product.md

@@ -19,8 +19,7 @@
 - Tenant du produit : **à définir** (le mot du domaine qui possède les
   données). L'alias produit de `TenantContext` est **`<Tenant>Context`**
   (`apps/api/src/context.ts`) : clé TS de colonne `<tenant>Id`, colonne SQL
-  **`<tenant>_id`** — à déclarer aussi dans `scripts/verify-manifest.ts`
-  (`TENANT_COLUMN_NAMES`).
+  **`<tenant>_id`** — à déclarer aussi dans le bloc `tenancy` du manifeste).
 - Liste fermée du socle autorisé à toucher la base brute : **à définir** (la
   feature qui CONSTRUIT les contextes tenant) — déclarée dans
   `scripts/lint-interdits.ts` (`RAW_DB_SOCLE_ALLOWLIST`). Toute autre feature

package/templates/project/scripts/lint-interdits.ts

@@ -22,6 +22,13 @@ const ROOT = fileURLToPath(new URL("..", import.meta.url));
 const SELF = fileURLToPath(import.meta.url);
 const SCANNED_DIRS = ["apps", "packages", "scripts"];
 const IGNORED_DIRS = new Set(["node_modules", "dist", ".git"]);
+// Build artifacts of a FRAMEWORK repo: a published package may embed a copy of
+// templates/ before publishing (generated and gitignored, like dist/). Derived
+// from the manifest rather than hard-coded, so this file stays identical in
+// every project — a consumer manifest has no framework block, and the set is
+// simply empty.
+const embeddedTemplateDirs = (frameworkPackagePaths: readonly string[]): Set<string> =>
+  new Set(frameworkPackagePaths.map((packagePath) => join(ROOT, packagePath, "templates")));
 const EXTENSIONS = [".ts", ".tsx", ".mts", ".mjs"];
 
 const TS_IGNORE_BAN = {
@@ -29,16 +36,12 @@ const TS_IGNORE_BAN = {
   rule: "ts-ignore interdit — @ts-expect-error avec justification si inévitable",
 };
 
-// Closed-list socle exception (AGENTS.md §Multi-tenant): the tenancy feature
-// BUILDS the contexts, so it predates them. Every other feature goes through
-// tenantDb — unless the manifest declares that every table it owns is SHARED,
-// which have no tenant column to filter on. Interim guard until the real
-// ESLint `ogygie/no-raw-db` rule lands.
+// Socle exception (AGENTS.md §Multi-tenant): the tenancy feature BUILDS the
+// contexts, so it predates them. Every other feature goes through tenantDb —
+// unless the manifest declares that every table it owns is SHARED, which have
+// no tenant column to filter on. The list is DECLARED at the manifest
+// (`tenancy.rawDbAllowed`), never held here: this file is governed.
 const FEATURES_PREFIX = "apps/api/src/features/";
-// TODO(product): the ONE tenancy socle feature allowed to touch the raw
-// database (it BUILDS the tenant contexts) — declare it in AGENTS.product.md
-// and here. Empty until the socle exists.
-const RAW_DB_SOCLE_ALLOWLIST = new Set<string>([]);
 const RAW_DB_BAN = {
   pattern: /\bctx\.db\b/,
   rule: "ctx.db interdit hors du socle et des features à tables partagées — passer par tenantDb (AGENTS.md §Multi-tenant)",
@@ -53,11 +56,15 @@ const manifest = OgygieManifestSchema.parse(
   JSON.parse(readFileSync(join(ROOT, "ogygie.manifest.json"), "utf8")),
 );
 /** Feature folder names allowed to touch the raw database, derived — not held. */
+const socleAllowlist = new Set(manifest.tenancy?.rawDbAllowed ?? []);
 const rawDbAllowedFolders = new Set(
   manifest.features
-    .filter((feature) => mayUseRawDb(feature, RAW_DB_SOCLE_ALLOWLIST))
+    .filter((feature) => mayUseRawDb(feature, socleAllowlist))
     .map((feature) => feature.folder.split("/").at(-1) ?? feature.name),
 );
+const ignoredBuildDirs = embeddedTemplateDirs(
+  (manifest.framework?.packages ?? []).map((packageEntry) => packageEntry.path),
+);
 
 const violations: string[] = [];
 
@@ -75,6 +82,7 @@ function scan(dir: string): void {
     const entryPath = join(dir, entry);
     const stats = statSync(entryPath);
     if (stats.isDirectory()) {
+      if (ignoredBuildDirs.has(entryPath)) continue;
       scan(entryPath);
       continue;
     }

package/templates/project/scripts/verify-manifest.ts

@@ -28,12 +28,35 @@ import {
 import { ogygieError, type OgygieError } from "@ogygie/core/errors";
 
 /**
- * Tenant column names of the PRODUCT (the core stays generic). A table
- * declared `shared: true` must carry none of them.
- * TODO(product): declare your tenant column here (the SQL name announced in
- * AGENTS.product.md, e.g. "workspace_id") — empty, this check guards nothing.
+ * Tenant column of the PRODUCT, read from the manifest (`tenancy.column`) —
+ * never a constant in this file, which is governed and therefore identical in
+ * every Ogygie project. A table declared `shared: true` must not carry it.
+ * No tenancy declared = nothing to guard, and the check stands down instead of
+ * pretending.
  */
-const TENANT_COLUMN_NAMES: readonly string[] = [];
+const tenantColumnNames = (): readonly string[] =>
+  manifest.tenancy === undefined ? [] : [manifest.tenancy.column];
+
+/**
+ * A project declaring SHARED tables without a tenant column is the one case
+ * where silence is dangerous: the check that guards those tables cannot run,
+ * and a passing gate would mean nothing. Said out loud rather than skipped —
+ * a gate that quietly guards nothing is worse than no gate.
+ */
+function reportUndeclaredTenancy(): void {
+  if (manifest.tenancy !== undefined) return;
+  const shared = manifest.features.flatMap((feature) => sharedTableNamesOf(feature));
+  if (shared.length === 0) return;
+  report({
+    code: "MANIFEST_TENANCY_UNDECLARED",
+    message:
+      "Shared tables are declared but the manifest declares no tenant column — the shared-table check cannot guard anything.",
+    file: MANIFEST_PATH,
+    cause: `tables ${shared.join(", ")} declared shared, tenancy block absent`,
+    suggestedFix:
+      'Declare `"tenancy": { "column": "<sql_tenant_column>", "rawDbAllowed": [...] }` in the manifest — the value AGENTS.product.md announces.',
+  });
+}
 
 const ROOT = new URL("..", import.meta.url).pathname;
 const MANIFEST_PATH = "ogygie.manifest.json";
@@ -71,6 +94,7 @@ if (!parsed.success) {
   conclude();
 }
 const manifest = parsed.data;
+reportUndeclaredTenancy();
 
 for (const app of manifest.apps) {
   if (!existsSync(join(ROOT, app.path))) {
@@ -84,6 +108,29 @@ for (const app of manifest.apps) {
   }
 }
 
+// Framework self-description (spec ogygie-standalone-repo B1): every path the
+// block advertises must exist — an agent trusts the manifest INSTEAD of
+// exploring, so a phantom path here is a lie like any other.
+if (manifest.framework !== undefined) {
+  const declaredPaths = [
+    ...manifest.framework.packages.map((pkg) => pkg.path),
+    manifest.framework.templates.project,
+    manifest.framework.templates.feature,
+    manifest.framework.governedFiles,
+  ];
+  for (const declaredPath of declaredPaths) {
+    if (!existsSync(join(ROOT, declaredPath))) {
+      report({
+        code: "MANIFEST_FRAMEWORK_PATH_NOT_FOUND",
+        message: `The framework block declares ${declaredPath}, which does not exist.`,
+        file: MANIFEST_PATH,
+        cause: `framework path ${declaredPath} absent from disk`,
+        suggestedFix: "Create the folder/module or fix the framework block.",
+      });
+    }
+  }
+}
+
 // A declared package whose folder is absent is a lying map, exactly like a
 // phantom app (spec manifest-packages B1).
 for (const productPackage of manifest.packages ?? []) {
@@ -238,7 +285,7 @@ for (const feature of manifest.features) {
     for (const finding of findTenantColumnsInSharedTables(
       dbSchemaContent,
       sharedTableNamesOf(feature),
-      TENANT_COLUMN_NAMES,
+      tenantColumnNames(),
     )) {
       report({
         code: "SHARED_TABLE_WITH_TENANT_COLUMN",