@ogygie/core 0.6.0 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogygie/core",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "Ogygie framework core: manifest/spec/error schemas, generic tenancy and gate tooling. Ships TypeScript sources — Ogygie products run tsx/vitest by construction (D1).",
   "license": "MIT",
   "type": "module",

package/src/manifest.schema.test.ts

@@ -456,3 +456,45 @@ describe("manifest — packages du produit (spec manifest-packages)", () => {
     expect(parsed.success).toBe(false);
   });
 });
+
+describe("manifest — bloc tenancy (spec ogygie-standalone-repo v3)", () => {
+  const socle = featureNamed("espaces-et-comptes");
+
+  it("un bloc tenancy valide est accepté, rawDbAllowed a un défaut vide", () => {
+    const parsed = OgygieManifestSchema.safeParse(
+      manifestWithPackages(undefined, [socle]),
+    );
+    expect(parsed.success).toBe(true);
+    const withTenancy = OgygieManifestSchema.safeParse({
+      ...manifestWithPackages(undefined, [socle]),
+      tenancy: { column: "workspace_id" },
+    });
+    expect(withTenancy.success && withTenancy.data.tenancy?.rawDbAllowed).toEqual([]);
+  });
+
+  it("le socle peut nommer les features autorisées à la base brute", () => {
+    const parsed = OgygieManifestSchema.safeParse({
+      ...manifestWithPackages(undefined, [socle]),
+      tenancy: { column: "workspace_id", rawDbAllowed: ["espaces-et-comptes"] },
+    });
+    expect(parsed.success).toBe(true);
+  });
+
+  it("MUTATION : un socle nommant une feature INEXISTANTE est refusé", () => {
+    const parsed = OgygieManifestSchema.safeParse({
+      ...manifestWithPackages(undefined, [socle]),
+      tenancy: { column: "workspace_id", rawDbAllowed: ["fantome"] },
+    });
+    expect(parsed.success).toBe(false);
+    const issue = parsed.success ? undefined : parsed.error.issues[0];
+    expect(issue?.message).toContain("matches no declared feature");
+  });
+
+  it("MUTATION : une colonne tenant vide est refusée — elle ne garderait rien", () => {
+    const parsed = OgygieManifestSchema.safeParse({
+      ...manifestWithPackages(undefined, [socle]),
+      tenancy: { column: "" },
+    });
+    expect(parsed.success).toBe(false);
+  });
+});

package/src/manifest.schema.ts

@@ -64,9 +64,33 @@ export const HttpRouteSchema = z.object({
  * `shared` is a literal `true`: a table is either shared (and says so) or
  * tenant-scoped (and stays a plain string) — no `shared: false` third state.
  */
+/**
+ * WHICH hole in the tenancy rail, because the two do not carry the same risk
+ * (D8):
+ * - `reference` — universal knowledge loaded by an extraction script, READ
+ *   ONLY for the API. What an ABSENT key means, which is also what
+ *   `shared: true` historically meant — read it through `sharedKindOf()`
+ *   rather than defaulting in the schema, so the manifest a project wrote is
+ *   the manifest an agent reads.
+ * - `ownerless` — data the API itself produces, owned by nobody because it is
+ *   born before any account. Its feature WRITES it, and since no tenant guards
+ *   it, an unguessable secret must: its rows are read by token, never by an
+ *   enumerable id. No gate can check that, so the feature's spec must say
+ *   where the secret lives.
+ *
+ * A security fact belongs on the map, not in a comment — hence a declared key
+ * rather than a convention.
+ */
+export const SharedTableKindSchema = z.enum(["reference", "ownerless"]);
+export type SharedTableKind = z.infer<typeof SharedTableKindSchema>;
+
 export const DbTableDeclarationSchema = z.union([
   z.string(),
-  z.object({ name: z.string(), shared: z.literal(true) }),
+  z.object({
+    name: z.string(),
+    shared: z.literal(true),
+    sharedKind: SharedTableKindSchema.optional(),
+  }),
 ]);
 export type DbTableDeclaration = z.infer<typeof DbTableDeclarationSchema>;
 
@@ -183,6 +207,34 @@ export const PackageManifestSchema = z.object({
 });
 export type PackageManifest = z.infer<typeof PackageManifestSchema>;
 
+/**
+ * The two product values the framework's own gates need to do their job.
+ *
+ * They used to live as constants INSIDE the gate scripts, which is what kept
+ * those scripts out of governance: a governed file is identical in every
+ * Ogygie project, and these are not. Declared here, the scripts become
+ * identical everywhere and can finally be governed — so a corrected gate
+ * reaches every project through `ogygie upgrade` instead of waiting for each
+ * one to recopy it (spec ogygie-standalone-repo v3).
+ *
+ * Absent, the checks that depend on them simply do not run: a project without
+ * tenancy has nothing to guard, and saying so explicitly beats guarding
+ * nothing while pretending otherwise.
+ */
+export const TenancyManifestSchema = z.object({
+  column: z
+    .string()
+    .min(1)
+    .describe("SQL name of the tenant column, e.g. workspace_id — the one AGENTS.product.md announces"),
+  rawDbAllowed: z
+    .array(FeatureNameSchema)
+    .default([])
+    .describe(
+      "Features allowed to reach the raw database: the tenancy socle, which BUILDS the contexts and therefore predates them. Every other feature goes through tenantDb",
+    ),
+});
+export type TenancyManifest = z.infer<typeof TenancyManifestSchema>;
+
 export const OgygieManifestSchema = z.object({
   version: z.literal(1),
   product: z.object({
@@ -213,6 +265,9 @@ export const OgygieManifestSchema = z.object({
     }),
   ),
   features: z.array(FeatureManifestSchema),
+  tenancy: TenancyManifestSchema.optional().describe(
+    "Product values the framework gates need — absent, the tenancy checks do not run",
+  ),
   packages: z
     .array(PackageManifestSchema)
     .optional()
@@ -280,6 +335,18 @@ export const OgygieManifestSchema = z.object({
       checkPackageDependencies(packageEntry.dependsOn, ["packages", index, "dependsOn"]);
     });
 
+    // A socle that names no existing feature guards nothing, and nobody would
+    // notice: the lint would simply allow one fewer folder.
+    (manifest.tenancy?.rawDbAllowed ?? []).forEach((featureName, index) => {
+      if (!featureNames.has(featureName)) {
+        context.addIssue({
+          code: "custom",
+          path: ["tenancy", "rawDbAllowed", index],
+          message: `"${featureName}" matches no declared feature`,
+        });
+      }
+    });
+
     // Vocabulary coherence (B2): one concept = one term. A canonical declared
     // twice, an alias claimed by two entries, or an alias that IS someone's
     // canonical would make the gate's suggested fix ambiguous — refused here,

package/src/shared-tables.test.ts

@@ -7,15 +7,7 @@
 import { describe, expect, it } from "vitest";
 import type { FeatureManifest } from "./manifest.schema.js";
 import { FeatureManifestSchema } from "./manifest.schema.js";
-import {
-  dbTableNamesOf,
-  findTenantColumnsInSharedTables,
-  mayUseRawDb,
-  ownsOnlySharedTables,
-  sharedTableNamesOf,
-  splitDbSchemaByTable,
-  tenantTableNamesOf,
-} from "./shared-tables.js";
+import { dbTableNamesOf, findTenantColumnsInSharedTables, mayUseRawDb, ownsOnlySharedTables, sharedKindOf, sharedTableNamesOf, splitDbSchemaByTable, tenantTableNamesOf } from "./shared-tables.js";
 
 const SOCLE = new Set(["accounts"]);
 
@@ -134,3 +126,25 @@ export const labels = pgTable("labels", {
     ).toEqual([{ table: "labels", tenantColumn: "org_id" }]);
   });
 });
+
+describe("sharedKindOf — quelle brèche dans le rail tenant (D8)", () => {
+  it("une table tenant n'a AUCUNE nature : ce n'est pas une brèche", () => {
+    expect(sharedKindOf("orders")).toBeNull();
+  });
+
+  it("une table partagée sans `sharedKind` vaut `reference` — le sens historique", () => {
+    expect(sharedKindOf({ name: "currency_rates", shared: true })).toBe("reference");
+  });
+
+  it("une table `ownerless` est rendue telle quelle : sa feature l'écrit", () => {
+    expect(sharedKindOf({ name: "public_drafts", shared: true, sharedKind: "ownerless" })).toBe(
+      "ownerless",
+    );
+  });
+
+  it("une table `reference` explicite reste `reference`", () => {
+    expect(sharedKindOf({ name: "postal_codes", shared: true, sharedKind: "reference" })).toBe(
+      "reference",
+    );
+  });
+});

package/src/shared-tables.ts

@@ -19,7 +19,7 @@
  * they return. The module is GENERIC infrastructure (D10 amended): it speaks
  * "tenant", never a word of the product's domain.
  */
-import type { DbTableDeclaration, FeatureManifest } from "./manifest.schema.js";
+import type { SharedTableKind, DbTableDeclaration, FeatureManifest } from "./manifest.schema.js";
 
 /** Name of a table however it was declared (bare string or object form). */
 export function dbTableNameOf(declaration: DbTableDeclaration): string {
@@ -111,3 +111,14 @@ export function findTenantColumnsInSharedTables(
   }
   return findings;
 }
+
+/**
+ * The nature of a shared table: what the declaration says, or `reference` when
+ * it says nothing — the historical meaning of `shared: true`, kept so older
+ * manifests keep meaning what they meant (AGENTS.md §Multi-tenant rule 4).
+ * A tenant-scoped table has no nature: it is not a hole in the rail.
+ */
+export function sharedKindOf(declaration: DbTableDeclaration): SharedTableKind | null {
+  if (typeof declaration === "string") return null;
+  return declaration.sharedKind ?? "reference";
+}