backend-skeleton 1.0.0-beta.1 → 1.0.0-beta.2

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "backend-skeleton",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.2",
   "type": "module",
   "description": "Spec-driven backend scaffolding: brownfield-scan gate, feature_id-keyed contracts, UUID bidirectional handles, stack-choice wiring.",
-  "license": "MIT",
+  "license": "AGPL-3.0-or-later",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/popixoxipop-collab/backend-skeleton.git"
@@ -27,7 +27,10 @@
     "new/",
     "stack/",
     "schemas/",
-    "scripts/preflight-base-ref.sh"
+    "scripts/preflight-base-ref.sh",
+    "LICENSE",
+    "COMMERCIAL-LICENSE.md",
+    "COMMERCIAL-LICENSE-AGREEMENT.md"
   ],
   "scripts": {
     "test": "node --test test/*.test.mjs",

package/schemas/feature-contract.schema.json

@@ -7,7 +7,7 @@
   "additionalProperties": false,
   "required": ["sbf_contract", "feature_id", "feature_uid", "source", "operations", "warnings", "completeness"],
   "properties": {
-    "sbf_contract": { "const": "4" },
+    "sbf_contract": { "const": "6" },
     "feature_id": { "type": "string", "pattern": "^[0-9]{3}-[a-z0-9]+(-[a-z0-9]+)*$" },
     "feature_uid": { "type": "string", "format": "uuid" },
     "source": {
@@ -19,6 +19,10 @@
         "provenance": { "type": "string" }
       }
     },
+    "sourceSecuritySchemes": {
+      "description": "A7: components.securitySchemes entries copied verbatim from a real source document (--openapi-file), restricted to schemes actually referenced by at least one operation's copied sourceSecurity requirement anywhere in this contract. Omitted entirely when openapi reconciliation never resolved any security requirement.",
+      "type": "object"
+    },
     "operations": {
       "type": "object",
       "additionalProperties": {
@@ -43,6 +47,57 @@
           "errorSchema": {
             "description": "A3: all documented 4xx/5xx application/json response schemas for this operation, fully inlined (no $ref); an anyOf union when 2+ distinct shapes are documented. Present only when matched/adopted AND at least one resolved.",
             "type": "object"
+          },
+          "sourceParameters": {
+            "description": "A7: non-path (query/header/cookie) parameters copied verbatim from a real source document's operation.parameters[], with `schema` resolved through inlineSchema(). Present only when matched/adopted AND the source document declared at least one such parameter that could be copied (a parameter whose own schema failed to resolve is still included here, just without a `schema` key).",
+            "type": "array",
+            "items": { "type": "object" }
+          },
+          "sourceSecurity": {
+            "description": "A7: the operation's OpenAPI Security Requirement array, copied verbatim from the source document -- including a literal [] (a genuine positive claim of 'no auth required'). Present only when the source document declared `security` for this exact operation AND every scheme it names resolved against components.securitySchemes.",
+            "type": "array",
+            "items": { "type": "object" }
+          },
+          "sourceSummary": {
+            "description": "A7: the operation's `summary` string, copied verbatim from the source document. Present only when the source document set one -- never synthesized from operationId or module names.",
+            "type": "string"
+          },
+          "sourceTags": {
+            "description": "A7: the operation's `tags` array, copied verbatim from the source document. Present only when the source document set at least one.",
+            "type": "array",
+            "items": { "type": "string" }
+          },
+          "sourceResponses": {
+            "description": "A8: per-status HTTP responses copied from a real source document, keyed by the document's own literal status key (a literal code, a range key like \"2XX\", or \"default\") -- never re-bucketed. Additive to responseSchema/errorSchema above, never replacing them; contracts/validate.mjs does not read this field. Present only when matched/adopted AND both the response and error union projections resolved cleanly (or had nothing to project) for this operation.",
+            "type": "object",
+            "propertyNames": { "pattern": "^(?:[1-5](?:[0-9]{2}|XX)|default)$" },
+            "additionalProperties": {
+              "type": "object",
+              "additionalProperties": false,
+              "properties": {
+                "description": { "type": "string" },
+                "schemaFrom": { "enum": ["response", "error"] },
+                "schema": { "type": "object" },
+                "mediaTypes": { "type": "array", "items": { "type": "string" } }
+              }
+            }
+          },
+          "sourceRequestBody": {
+            "description": "A8: the request body's non-application/json media types (e.g. multipart/form-data), copied from a real source document. `content` never carries an \"application/json\" key -- that stays requestBodySchema above, the one representation of that one fact.",
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+              "required": { "type": "boolean" },
+              "content": {
+                "type": "object",
+                "not": { "required": ["application/json"] },
+                "additionalProperties": {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "properties": { "schema": { "type": "object" } }
+                }
+              }
+            }
           }
         }
       }