@ogygie/core 0.7.0 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ogygie/core",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Ogygie framework core: manifest/spec/error schemas, generic tenancy and gate tooling. Ships TypeScript sources — Ogygie products run tsx/vitest by construction (D1).",
   "license": "MIT",
   "type": "module",

package/src/manifest.schema.ts

@@ -64,9 +64,33 @@ export const HttpRouteSchema = z.object({
  * `shared` is a literal `true`: a table is either shared (and says so) or
  * tenant-scoped (and stays a plain string) — no `shared: false` third state.
  */
+/**
+ * WHICH hole in the tenancy rail, because the two do not carry the same risk
+ * (D8):
+ * - `reference` — universal knowledge loaded by an extraction script, READ
+ *   ONLY for the API. What an ABSENT key means, which is also what
+ *   `shared: true` historically meant — read it through `sharedKindOf()`
+ *   rather than defaulting in the schema, so the manifest a project wrote is
+ *   the manifest an agent reads.
+ * - `ownerless` — data the API itself produces, owned by nobody because it is
+ *   born before any account. Its feature WRITES it, and since no tenant guards
+ *   it, an unguessable secret must: its rows are read by token, never by an
+ *   enumerable id. No gate can check that, so the feature's spec must say
+ *   where the secret lives.
+ *
+ * A security fact belongs on the map, not in a comment — hence a declared key
+ * rather than a convention.
+ */
+export const SharedTableKindSchema = z.enum(["reference", "ownerless"]);
+export type SharedTableKind = z.infer<typeof SharedTableKindSchema>;
+
 export const DbTableDeclarationSchema = z.union([
   z.string(),
-  z.object({ name: z.string(), shared: z.literal(true) }),
+  z.object({
+    name: z.string(),
+    shared: z.literal(true),
+    sharedKind: SharedTableKindSchema.optional(),
+  }),
 ]);
 export type DbTableDeclaration = z.infer<typeof DbTableDeclarationSchema>;
 

package/src/shared-tables.test.ts

@@ -7,15 +7,7 @@
 import { describe, expect, it } from "vitest";
 import type { FeatureManifest } from "./manifest.schema.js";
 import { FeatureManifestSchema } from "./manifest.schema.js";
-import {
-  dbTableNamesOf,
-  findTenantColumnsInSharedTables,
-  mayUseRawDb,
-  ownsOnlySharedTables,
-  sharedTableNamesOf,
-  splitDbSchemaByTable,
-  tenantTableNamesOf,
-} from "./shared-tables.js";
+import { dbTableNamesOf, findTenantColumnsInSharedTables, mayUseRawDb, ownsOnlySharedTables, sharedKindOf, sharedTableNamesOf, splitDbSchemaByTable, tenantTableNamesOf } from "./shared-tables.js";
 
 const SOCLE = new Set(["accounts"]);
 
@@ -134,3 +126,25 @@ export const labels = pgTable("labels", {
     ).toEqual([{ table: "labels", tenantColumn: "org_id" }]);
   });
 });
+
+describe("sharedKindOf — quelle brèche dans le rail tenant (D8)", () => {
+  it("une table tenant n'a AUCUNE nature : ce n'est pas une brèche", () => {
+    expect(sharedKindOf("orders")).toBeNull();
+  });
+
+  it("une table partagée sans `sharedKind` vaut `reference` — le sens historique", () => {
+    expect(sharedKindOf({ name: "currency_rates", shared: true })).toBe("reference");
+  });
+
+  it("une table `ownerless` est rendue telle quelle : sa feature l'écrit", () => {
+    expect(sharedKindOf({ name: "public_drafts", shared: true, sharedKind: "ownerless" })).toBe(
+      "ownerless",
+    );
+  });
+
+  it("une table `reference` explicite reste `reference`", () => {
+    expect(sharedKindOf({ name: "postal_codes", shared: true, sharedKind: "reference" })).toBe(
+      "reference",
+    );
+  });
+});

package/src/shared-tables.ts

@@ -19,7 +19,7 @@
  * they return. The module is GENERIC infrastructure (D10 amended): it speaks
  * "tenant", never a word of the product's domain.
  */
-import type { DbTableDeclaration, FeatureManifest } from "./manifest.schema.js";
+import type { SharedTableKind, DbTableDeclaration, FeatureManifest } from "./manifest.schema.js";
 
 /** Name of a table however it was declared (bare string or object form). */
 export function dbTableNameOf(declaration: DbTableDeclaration): string {
@@ -111,3 +111,14 @@ export function findTenantColumnsInSharedTables(
   }
   return findings;
 }
+
+/**
+ * The nature of a shared table: what the declaration says, or `reference` when
+ * it says nothing — the historical meaning of `shared: true`, kept so older
+ * manifests keep meaning what they meant (AGENTS.md §Multi-tenant rule 4).
+ * A tenant-scoped table has no nature: it is not a hole in the rail.
+ */
+export function sharedKindOf(declaration: DbTableDeclaration): SharedTableKind | null {
+  if (typeof declaration === "string") return null;
+  return declaration.sharedKind ?? "reference";
+}