@ogygie/cli 0.6.0 → 0.8.0

package/dist/cli.js

@@ -14588,6 +14588,42 @@ var governedFiles = [
     templatePath: "project/tsconfig.base.json",
     targetPath: "tsconfig.base.json",
     description: "Strict TypeScript options decided by the framework."
+  },
+  // The gate scripts (spec ogygie-standalone-repo v3). They decide nothing by
+  // themselves: they apply the framework's rules to what the manifest
+  // declares, so they are identical in every project — and a gate corrected
+  // upstream must reach every project, which recopying by hand never achieved.
+  // What used to be product-specific in them now lives in the manifest
+  // (`tenancy`).
+  {
+    templatePath: "project/scripts/verify-manifest.ts",
+    targetPath: "scripts/verify-manifest.ts",
+    description: "Gate: the manifest tells the truth about the actual code."
+  },
+  {
+    templatePath: "project/scripts/verify-specs.ts",
+    targetPath: "scripts/verify-specs.ts",
+    description: "Gate: spec frontmatter, canonical sections, lifecycle, decision refs."
+  },
+  {
+    templatePath: "project/scripts/verify-contracts.ts",
+    targetPath: "scripts/verify-contracts.ts",
+    description: "Gate: transitive purity of every contract entry point."
+  },
+  {
+    templatePath: "project/scripts/lint-interdits.ts",
+    targetPath: "scripts/lint-interdits.ts",
+    description: "Gate: the absolute bans of AGENTS.md, plus the raw-db rule derived from the manifest."
+  },
+  {
+    templatePath: "project/scripts/ogygie-impact.ts",
+    targetPath: "scripts/ogygie-impact.ts",
+    description: "Tool: blast radius of a feature, derived from the manifest."
+  },
+  {
+    templatePath: "project/scripts/ogygie-design-brief.ts",
+    targetPath: "scripts/ogygie-design-brief.ts",
+    description: "Tool: design brief derived from tokens, patterns, contracts and specs."
   }
 ];
 
@@ -14613,9 +14649,14 @@ var HttpRouteSchema = external_exports.object({
     "Cache roots this mutation stales BEYOND its own path root (cross-feature dependency, read by the manifest-derived client \u2014 never guessed in a screen). Each value must be an existing feature name or route root"
   )
 });
+var SharedTableKindSchema = external_exports.enum(["reference", "ownerless"]);
 var DbTableDeclarationSchema = external_exports.union([
   external_exports.string(),
-  external_exports.object({ name: external_exports.string(), shared: external_exports.literal(true) })
+  external_exports.object({
+    name: external_exports.string(),
+    shared: external_exports.literal(true),
+    sharedKind: SharedTableKindSchema.optional()
+  })
 ]);
 var FeatureManifestSchema = external_exports.object({
   name: FeatureNameSchema,
@@ -14665,6 +14706,12 @@ var PackageManifestSchema = external_exports.object({
   dependsOn: external_exports.array(PackageDependencySchema).describe("Other PRODUCT packages, as package:<name> \u2014 never a feature: a package that depended on one would live under an app, and would be a feature"),
   status: external_exports.enum(["skeleton", "in-progress", "delivered"])
 });
+var TenancyManifestSchema = external_exports.object({
+  column: external_exports.string().min(1).describe("SQL name of the tenant column, e.g. workspace_id \u2014 the one AGENTS.product.md announces"),
+  rawDbAllowed: external_exports.array(FeatureNameSchema).default([]).describe(
+    "Features allowed to reach the raw database: the tenancy socle, which BUILDS the contexts and therefore predates them. Every other feature goes through tenantDb"
+  )
+});
 var OgygieManifestSchema = external_exports.object({
   version: external_exports.literal(1),
   product: external_exports.object({
@@ -14695,6 +14742,9 @@ var OgygieManifestSchema = external_exports.object({
     })
   ),
   features: external_exports.array(FeatureManifestSchema),
+  tenancy: TenancyManifestSchema.optional().describe(
+    "Product values the framework gates need \u2014 absent, the tenancy checks do not run"
+  ),
   packages: external_exports.array(PackageManifestSchema).optional().describe("Product code living outside every app \u2014 libraries, engines. Absent = the project has none"),
   vocabulary: ProductVocabularySchema.optional().describe(
     "The product's closed vocabulary \u2014 declared here, enforced by `ogygie verify-vocabulary`. Absent = gate silent"
@@ -14743,6 +14793,15 @@ var OgygieManifestSchema = external_exports.object({
   (manifest.packages ?? []).forEach((packageEntry, index) => {
     checkPackageDependencies(packageEntry.dependsOn, ["packages", index, "dependsOn"]);
   });
+  (manifest.tenancy?.rawDbAllowed ?? []).forEach((featureName, index) => {
+    if (!featureNames.has(featureName)) {
+      context.addIssue({
+        code: "custom",
+        path: ["tenancy", "rawDbAllowed", index],
+        message: `"${featureName}" matches no declared feature`
+      });
+    }
+  });
   const canonicalOwners = /* @__PURE__ */ new Map();
   const aliasOwners = /* @__PURE__ */ new Map();
   (manifest.vocabulary?.entries ?? []).forEach((entry, index) => {
@@ -15503,6 +15562,30 @@ var governedChecksumsByVersion = {
     "AGENTS.md": "c7d51a0cd97b67343b486bdb7c54914da68d96409eaa985959d2a525c65549fd",
     "CLAUDE.md": "785ee8d90e368806d8cf0b4d84a15f29d1dc961168bda86cf1a6c60a923c8c9b",
     "tsconfig.base.json": "0f8919e9ed8bbc88e0308fa2fa91471dabb18d1df721bd78c04076597eba89a2"
+  },
+  "0.7.0": {
+    ".github/workflows/ogygie-gates.yml": "48c40efe9fe66dd0f9c3b94287026d80eae9afd6782b5833fdf8846d8662babf",
+    "AGENTS.md": "c7d51a0cd97b67343b486bdb7c54914da68d96409eaa985959d2a525c65549fd",
+    "CLAUDE.md": "785ee8d90e368806d8cf0b4d84a15f29d1dc961168bda86cf1a6c60a923c8c9b",
+    "scripts/lint-interdits.ts": "d859e132b7020942a5211f5419b10045170dee6afba3f50ca5642570a5c4a683",
+    "scripts/ogygie-design-brief.ts": "aba1585717b30808dd0bc8930a37a1ad2d83ee6869f969dbd06ca595e37a4a89",
+    "scripts/ogygie-impact.ts": "0dd3ff8cdd57e6cff0dfec1c669fce53fde9ae43f0784ed114771c83d1f8b357",
+    "scripts/verify-contracts.ts": "725cae269e78ecdaa1923553c3097d8d96277824b5bd79a9a40284c6246036b7",
+    "scripts/verify-manifest.ts": "1adca9edee11e54ccaf0511012411516c52c68a32f686ca320c7e437afb22c7c",
+    "scripts/verify-specs.ts": "ccf09c04155e5e88fa9acd4a5db33c2c79e85923b2d92e8e866fe9cbc4cdf342",
+    "tsconfig.base.json": "0f8919e9ed8bbc88e0308fa2fa91471dabb18d1df721bd78c04076597eba89a2"
+  },
+  "0.8.0": {
+    ".github/workflows/ogygie-gates.yml": "48c40efe9fe66dd0f9c3b94287026d80eae9afd6782b5833fdf8846d8662babf",
+    "AGENTS.md": "e44f635c0b203a0040098425f217c5a29c47e57280a3545b60d640aea0d59a70",
+    "CLAUDE.md": "785ee8d90e368806d8cf0b4d84a15f29d1dc961168bda86cf1a6c60a923c8c9b",
+    "scripts/lint-interdits.ts": "d859e132b7020942a5211f5419b10045170dee6afba3f50ca5642570a5c4a683",
+    "scripts/ogygie-design-brief.ts": "aba1585717b30808dd0bc8930a37a1ad2d83ee6869f969dbd06ca595e37a4a89",
+    "scripts/ogygie-impact.ts": "0dd3ff8cdd57e6cff0dfec1c669fce53fde9ae43f0784ed114771c83d1f8b357",
+    "scripts/verify-contracts.ts": "725cae269e78ecdaa1923553c3097d8d96277824b5bd79a9a40284c6246036b7",
+    "scripts/verify-manifest.ts": "1adca9edee11e54ccaf0511012411516c52c68a32f686ca320c7e437afb22c7c",
+    "scripts/verify-specs.ts": "ccf09c04155e5e88fa9acd4a5db33c2c79e85923b2d92e8e866fe9cbc4cdf342",
+    "tsconfig.base.json": "0f8919e9ed8bbc88e0308fa2fa91471dabb18d1df721bd78c04076597eba89a2"
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogygie/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Ogygie framework CLI: deterministic scaffolding (init), governed-file upgrades (upgrade) and lockstep verification (check) for Ogygie products.",
   "license": "MIT",
   "type": "module",
@@ -22,7 +22,7 @@
     "tsx": "^4.20.0",
     "typescript": "^5.8.0",
     "zod": "^4.0.0",
-    "@ogygie/core": "0.6.0"
+    "@ogygie/core": "0.8.0"
   },
   "scripts": {
     "typecheck": "tsc -p tsconfig.json",

package/templates/project/AGENTS.md

@@ -381,22 +381,37 @@ par vigilance.
    tenant** (second rempart : même une requête buggée ne peut pas lire un
    autre tenant). Toute migration créant une table tenant inclut sa policy RLS —
    le template de migration l'impose.
-4. Les tables de référentiel PARTAGÉ — connaissance universelle qu'aucun tenant
-   ne possède, chargée par un script d'extraction depuis une source externe
-   versionnée — sont déclarées explicitement au manifeste sous la forme objet
-   `{ "name": "<table>", "shared": true }` (clé anglaise : le manifeste est
-   machine-lisible). Elles échappent alors à la règle 3 (pas de colonne
-   tenant, pas de policy RLS tenant) ET à la règle 2 : n'ayant aucune colonne
-   sur laquelle filtrer, elles se lisent hors de `tenantDb`. Ce droit se paie
-   comptant, et les gates le vérifient au lieu de faire confiance :
+4. Les tables SANS PROPRIÉTAIRE TENANT sont déclarées explicitement au manifeste
+   sous la forme objet `{ "name": "<table>", "shared": true, "sharedKind": "..." }`
+   (clés anglaises : le manifeste est machine-lisible). Elles échappent alors à
+   la règle 3 (pas de colonne tenant, pas de policy RLS tenant) ET à la règle 2 :
+   n'ayant aucune colonne sur laquelle filtrer, elles se lisent hors de
+   `tenantDb`.
+
+   **Deux natures, et une seule est écrivable par l'API** (D8). La nature se
+   déclare au manifeste, parce qu'une information de sécurité vit sur la carte :
+   - **`reference`** — connaissance universelle qu'aucun tenant ne possède,
+     chargée par un script d'extraction depuis une source externe versionnée.
+     **Côté API elle est en LECTURE SEULE** : seul le script d'extraction
+     l'alimente. C'est le défaut quand `sharedKind` est absent, et le sens
+     historique de `shared: true`.
+   - **`ownerless`** — donnée produite par l'API elle-même, sans propriétaire
+     parce qu'elle naît avant tout compte. **Sa feature l'écrit.** N'ayant pas
+     de tenant pour rempart, elle en porte un autre : ses lignes ne se lisent
+     que par un **secret non devinable** (jeton), jamais par un identifiant
+     énumérable ni séquentiel. Une table `ownerless` sans ce secret est une
+     violation — et comme aucun gate ne sait le vérifier, la spec de la feature
+     doit dire OÙ vit ce secret et comment il est produit.
+
+   Ce droit se paie comptant, et les gates vérifient ce qu'ils peuvent au lieu
+   de faire confiance :
    - une feature ne gagne l'accès brut à la base que si TOUTES ses tables sont
      partagées (lint-interdits, dérivé du manifeste) — une seule table tenant
      dans la même feature le lui retire ;
    - une table déclarée partagée qui porte encore la colonne tenant casse
-     verify-manifest (`SHARED_TABLE_WITH_TENANT_COLUMN`) ;
-   - côté API ces tables sont en LECTURE SEULE : seul le script d'extraction
-     les alimente.
-   La liste des tables partagées du produit est dans `AGENTS.product.md`.
+     verify-manifest (`SHARED_TABLE_WITH_TENANT_COLUMN`).
+   La liste des tables partagées du produit, avec leur nature, est dans
+   `AGENTS.product.md`.
 
 ### Template repository (le SEUL accès DB autorisé)
 ```ts

package/templates/project/AGENTS.product.md

@@ -19,8 +19,7 @@
 - Tenant du produit : **à définir** (le mot du domaine qui possède les
   données). L'alias produit de `TenantContext` est **`<Tenant>Context`**
   (`apps/api/src/context.ts`) : clé TS de colonne `<tenant>Id`, colonne SQL
-  **`<tenant>_id`** — à déclarer aussi dans `scripts/verify-manifest.ts`
-  (`TENANT_COLUMN_NAMES`).
+  **`<tenant>_id`** — à déclarer aussi dans le bloc `tenancy` du manifeste).
 - Liste fermée du socle autorisé à toucher la base brute : **à définir** (la
   feature qui CONSTRUIT les contextes tenant) — déclarée dans
   `scripts/lint-interdits.ts` (`RAW_DB_SOCLE_ALLOWLIST`). Toute autre feature

package/templates/project/scripts/lint-interdits.ts

@@ -22,6 +22,13 @@ const ROOT = fileURLToPath(new URL("..", import.meta.url));
 const SELF = fileURLToPath(import.meta.url);
 const SCANNED_DIRS = ["apps", "packages", "scripts"];
 const IGNORED_DIRS = new Set(["node_modules", "dist", ".git"]);
+// Build artifacts of a FRAMEWORK repo: a published package may embed a copy of
+// templates/ before publishing (generated and gitignored, like dist/). Derived
+// from the manifest rather than hard-coded, so this file stays identical in
+// every project — a consumer manifest has no framework block, and the set is
+// simply empty.
+const embeddedTemplateDirs = (frameworkPackagePaths: readonly string[]): Set<string> =>
+  new Set(frameworkPackagePaths.map((packagePath) => join(ROOT, packagePath, "templates")));
 const EXTENSIONS = [".ts", ".tsx", ".mts", ".mjs"];
 
 const TS_IGNORE_BAN = {
@@ -29,16 +36,12 @@ const TS_IGNORE_BAN = {
   rule: "ts-ignore interdit — @ts-expect-error avec justification si inévitable",
 };
 
-// Closed-list socle exception (AGENTS.md §Multi-tenant): the tenancy feature
-// BUILDS the contexts, so it predates them. Every other feature goes through
-// tenantDb — unless the manifest declares that every table it owns is SHARED,
-// which have no tenant column to filter on. Interim guard until the real
-// ESLint `ogygie/no-raw-db` rule lands.
+// Socle exception (AGENTS.md §Multi-tenant): the tenancy feature BUILDS the
+// contexts, so it predates them. Every other feature goes through tenantDb —
+// unless the manifest declares that every table it owns is SHARED, which have
+// no tenant column to filter on. The list is DECLARED at the manifest
+// (`tenancy.rawDbAllowed`), never held here: this file is governed.
 const FEATURES_PREFIX = "apps/api/src/features/";
-// TODO(product): the ONE tenancy socle feature allowed to touch the raw
-// database (it BUILDS the tenant contexts) — declare it in AGENTS.product.md
-// and here. Empty until the socle exists.
-const RAW_DB_SOCLE_ALLOWLIST = new Set<string>([]);
 const RAW_DB_BAN = {
   pattern: /\bctx\.db\b/,
   rule: "ctx.db interdit hors du socle et des features à tables partagées — passer par tenantDb (AGENTS.md §Multi-tenant)",
@@ -53,11 +56,15 @@ const manifest = OgygieManifestSchema.parse(
   JSON.parse(readFileSync(join(ROOT, "ogygie.manifest.json"), "utf8")),
 );
 /** Feature folder names allowed to touch the raw database, derived — not held. */
+const socleAllowlist = new Set(manifest.tenancy?.rawDbAllowed ?? []);
 const rawDbAllowedFolders = new Set(
   manifest.features
-    .filter((feature) => mayUseRawDb(feature, RAW_DB_SOCLE_ALLOWLIST))
+    .filter((feature) => mayUseRawDb(feature, socleAllowlist))
     .map((feature) => feature.folder.split("/").at(-1) ?? feature.name),
 );
+const ignoredBuildDirs = embeddedTemplateDirs(
+  (manifest.framework?.packages ?? []).map((packageEntry) => packageEntry.path),
+);
 
 const violations: string[] = [];
 
@@ -75,6 +82,7 @@ function scan(dir: string): void {
     const entryPath = join(dir, entry);
     const stats = statSync(entryPath);
     if (stats.isDirectory()) {
+      if (ignoredBuildDirs.has(entryPath)) continue;
       scan(entryPath);
       continue;
     }

package/templates/project/scripts/verify-manifest.ts

@@ -28,12 +28,35 @@ import {
 import { ogygieError, type OgygieError } from "@ogygie/core/errors";
 
 /**
- * Tenant column names of the PRODUCT (the core stays generic). A table
- * declared `shared: true` must carry none of them.
- * TODO(product): declare your tenant column here (the SQL name announced in
- * AGENTS.product.md, e.g. "workspace_id") — empty, this check guards nothing.
+ * Tenant column of the PRODUCT, read from the manifest (`tenancy.column`) —
+ * never a constant in this file, which is governed and therefore identical in
+ * every Ogygie project. A table declared `shared: true` must not carry it.
+ * No tenancy declared = nothing to guard, and the check stands down instead of
+ * pretending.
  */
-const TENANT_COLUMN_NAMES: readonly string[] = [];
+const tenantColumnNames = (): readonly string[] =>
+  manifest.tenancy === undefined ? [] : [manifest.tenancy.column];
+
+/**
+ * A project declaring SHARED tables without a tenant column is the one case
+ * where silence is dangerous: the check that guards those tables cannot run,
+ * and a passing gate would mean nothing. Said out loud rather than skipped —
+ * a gate that quietly guards nothing is worse than no gate.
+ */
+function reportUndeclaredTenancy(): void {
+  if (manifest.tenancy !== undefined) return;
+  const shared = manifest.features.flatMap((feature) => sharedTableNamesOf(feature));
+  if (shared.length === 0) return;
+  report({
+    code: "MANIFEST_TENANCY_UNDECLARED",
+    message:
+      "Shared tables are declared but the manifest declares no tenant column — the shared-table check cannot guard anything.",
+    file: MANIFEST_PATH,
+    cause: `tables ${shared.join(", ")} declared shared, tenancy block absent`,
+    suggestedFix:
+      'Declare `"tenancy": { "column": "<sql_tenant_column>", "rawDbAllowed": [...] }` in the manifest — the value AGENTS.product.md announces.',
+  });
+}
 
 const ROOT = new URL("..", import.meta.url).pathname;
 const MANIFEST_PATH = "ogygie.manifest.json";
@@ -71,6 +94,7 @@ if (!parsed.success) {
   conclude();
 }
 const manifest = parsed.data;
+reportUndeclaredTenancy();
 
 for (const app of manifest.apps) {
   if (!existsSync(join(ROOT, app.path))) {
@@ -84,6 +108,29 @@ for (const app of manifest.apps) {
   }
 }
 
+// Framework self-description (spec ogygie-standalone-repo B1): every path the
+// block advertises must exist — an agent trusts the manifest INSTEAD of
+// exploring, so a phantom path here is a lie like any other.
+if (manifest.framework !== undefined) {
+  const declaredPaths = [
+    ...manifest.framework.packages.map((pkg) => pkg.path),
+    manifest.framework.templates.project,
+    manifest.framework.templates.feature,
+    manifest.framework.governedFiles,
+  ];
+  for (const declaredPath of declaredPaths) {
+    if (!existsSync(join(ROOT, declaredPath))) {
+      report({
+        code: "MANIFEST_FRAMEWORK_PATH_NOT_FOUND",
+        message: `The framework block declares ${declaredPath}, which does not exist.`,
+        file: MANIFEST_PATH,
+        cause: `framework path ${declaredPath} absent from disk`,
+        suggestedFix: "Create the folder/module or fix the framework block.",
+      });
+    }
+  }
+}
+
 // A declared package whose folder is absent is a lying map, exactly like a
 // phantom app (spec manifest-packages B1).
 for (const productPackage of manifest.packages ?? []) {
@@ -238,7 +285,7 @@ for (const feature of manifest.features) {
     for (const finding of findTenantColumnsInSharedTables(
       dbSchemaContent,
       sharedTableNamesOf(feature),
-      TENANT_COLUMN_NAMES,
+      tenantColumnNames(),
     )) {
       report({
         code: "SHARED_TABLE_WITH_TENANT_COLUMN",