sdr-visualizer 1.2.6__tar.gz → 1.2.7__tar.gz

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/AGENTS.md

@@ -47,7 +47,8 @@ only requires Jinja2. The `dev` group supplies Python test/lint tooling and
 `browser` supplies Playwright. On Linux, use
 `uv run playwright install --with-deps chromium webkit` if browser system libraries
 are missing. `tests/conftest.py` generates missing large CJA/AA fixtures on demand.
-Do not commit generated performance fixtures or caches.
+Do not commit generated performance fixtures or caches. Add `-n auto` to any
+pytest command below to run it in parallel with `pytest-xdist`, as CI does.
 
 Use `uv run ruff format` to format changes. Use a focused `uv run pytest tests/test_*.py`
 selection while iterating, then complete the PR checks below. Offline CLI smoke:

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/CHANGELOG.md

@@ -4,6 +4,40 @@ All notable changes to `sdr-visualizer` will be documented here. The format foll
 
 ## [Unreleased]
 
+## [1.2.7] - 2026-10-30
+
+### Changed
+
+- Advance the catalog tested-through generator markers to `cja_auto_sdr`
+  3.13.6 and `aa_auto_sdr` 1.24.5. Snapshots that declare those versions no
+  longer print a newer-than-tested warning.
+- Accept any `cja_auto_sdr` release at 3.11.8 or newer for live `cja-lineage`
+  discovery, instead of an exact list of versions. A version newer than 3.13.6,
+  the newest version exercised for this release, still runs and prints a
+  warning. Pre-release, local, or decorated version strings, other tools, and
+  versions older than 3.11.8 still fail closed before credentials are used.
+  Live output keeps the same shape validation as saved discovery.
+- Reject a snapshot whose JSON repeats a key within one object, instead of
+  silently keeping the last value. This applies to snapshot files, stdin, live
+  generator output, comparison baselines, and trend members, and matches
+  sdr-grader. The error does not echo the key. A trend member with a repeated
+  key is skipped with a warning.
+- Verify Python 3.13 in CI and list Python 3.11 through 3.14 in the package
+  classifiers. The installation requirement is still Python 3.11 or newer.
+- Maintainer tooling only: CI pins uv 0.13.6, matching sdr-grader, so CI and
+  contributors resolve the lockfile with the same uv.
+- Update the optional AA Workspace SDK to `aanalytics2==0.5.5.post3` and align
+  its collection version guard with the package pin. The upstream change is
+  limited to the knowledge graph module, which collection does not use.
+- Speed up CI. Tests run in parallel with `pytest-xdist`, coverage is measured
+  once on Python 3.14, superseded pull request runs are cancelled, and every
+  job has a timeout. The `version-sync` check now runs inside the `lint`
+  workflow, and Pages publishes the committed examples.
+- Allow a manual `release.yml` dry run that runs every release gate and the
+  build but skips the tag-version check, PyPI publication, and the GitHub
+  release. The workflow policy now requires that guard on `publish` whenever
+  the release workflow has a trigger other than a tag push.
+
 ## [1.2.6] - 2026-10-27
 
 ### Changed
@@ -781,7 +815,8 @@ The following are explicitly internal and may change without notice:
 - Workspace project visualization (v0.4)
 - Schema map view (v0.5)
 
-[Unreleased]: https://github.com/brian-a-au/sdr-visualizer/compare/v1.2.6...HEAD
+[Unreleased]: https://github.com/brian-a-au/sdr-visualizer/compare/v1.2.7...HEAD
+[1.2.7]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.7
 [1.2.6]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.6
 [1.2.5]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.5
 [1.2.4]: https://github.com/brian-a-au/sdr-visualizer/releases/tag/v1.2.4

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sdr-visualizer
-Version: 1.2.6
+Version: 1.2.7
 Summary: Static-output visual catalog generator for Adobe Customer Journey Analytics and Adobe Analytics implementations.
 Project-URL: Homepage, https://brian-a-au.github.io/sdr-visualizer/
 Project-URL: Documentation, https://github.com/brian-a-au/sdr-visualizer#documentation
@@ -11,10 +11,19 @@ Author: Brian Au
 License-Expression: MIT
 License-File: LICENSE
 License-File: THIRD_PARTY_LICENSES
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Scientific/Engineering :: Visualization
 Requires-Python: >=3.11
 Requires-Dist: jinja2>=3.1
 Provides-Extra: workspace-aa
-Requires-Dist: aanalytics2==0.5.5.post2; extra == 'workspace-aa'
+Requires-Dist: aanalytics2==0.5.5.post3; extra == 'workspace-aa'
 Requires-Dist: requests>=2.32; extra == 'workspace-aa'
 Provides-Extra: workspace-cja
 Requires-Dist: cjapy==0.3.1; extra == 'workspace-cja'
@@ -26,7 +35,6 @@ Description-Content-Type: text/markdown
 [![PyPI](https://img.shields.io/pypi/v/sdr-visualizer)](https://pypi.org/project/sdr-visualizer/)
 [![Tests](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/test.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/test.yml)
 [![Lint](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/lint.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/lint.yml)
-[![Version Sync](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/version-sync.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/version-sync.yml)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/downloads/)
 [![Coverage](https://img.shields.io/badge/coverage-99%25-brightgreen.svg)](https://github.com/brian-a-au/sdr-visualizer/tree/main/tests)
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
@@ -62,19 +70,16 @@ confidentiality and data-handling policy.
 
 ## Public preview scope
 
-This project is in public preview. A report describes what is configured in a
-snapshot. It does not grade the implementation, and it does not confirm that a
-configuration is correct, complete, or working at runtime. Review the details
+This project is in public preview. A report shows what a snapshot configures. It
+does not grade the implementation or confirm that it works. Check the details
 against the source implementation before you act on them.
 
-The report embeds the supported normalized component catalog, not every
-platform-specific field. Optional Workspace project references are unverified
-candidates, and an empty result never means a component is unused. Keep the
-original generator snapshot for anything the report does not embed.
-
-The tool is verified on Ubuntu with Python 3.11, 3.12, and 3.14. Other platforms
-and later Python versions are not yet verified. The package installs on Python
-3.11 or newer.
+- The report embeds the supported components, not every platform field. Keep the
+  original generator snapshot for anything the report does not embed.
+- Workspace project references are unverified. An empty result does not mean a
+  component is unused.
+- The tool is verified on Ubuntu with Python 3.11 through 3.14. It installs on
+  Python 3.11 or newer.
 
 ## Install
 

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/README.md

@@ -3,7 +3,6 @@
 [![PyPI](https://img.shields.io/pypi/v/sdr-visualizer)](https://pypi.org/project/sdr-visualizer/)
 [![Tests](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/test.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/test.yml)
 [![Lint](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/lint.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/lint.yml)
-[![Version Sync](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/version-sync.yml/badge.svg)](https://github.com/brian-a-au/sdr-visualizer/actions/workflows/version-sync.yml)
 [![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-blue.svg)](https://www.python.org/downloads/)
 [![Coverage](https://img.shields.io/badge/coverage-99%25-brightgreen.svg)](https://github.com/brian-a-au/sdr-visualizer/tree/main/tests)
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
@@ -39,19 +38,16 @@ confidentiality and data-handling policy.
 
 ## Public preview scope
 
-This project is in public preview. A report describes what is configured in a
-snapshot. It does not grade the implementation, and it does not confirm that a
-configuration is correct, complete, or working at runtime. Review the details
+This project is in public preview. A report shows what a snapshot configures. It
+does not grade the implementation or confirm that it works. Check the details
 against the source implementation before you act on them.
 
-The report embeds the supported normalized component catalog, not every
-platform-specific field. Optional Workspace project references are unverified
-candidates, and an empty result never means a component is unused. Keep the
-original generator snapshot for anything the report does not embed.
-
-The tool is verified on Ubuntu with Python 3.11, 3.12, and 3.14. Other platforms
-and later Python versions are not yet verified. The package installs on Python
-3.11 or newer.
+- The report embeds the supported components, not every platform field. Keep the
+  original generator snapshot for anything the report does not embed.
+- Workspace project references are unverified. An empty result does not mean a
+  component is unused.
+- The tool is verified on Ubuntu with Python 3.11 through 3.14. It installs on
+  Python 3.11 or newer.
 
 ## Install
 

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/docs/ADAPTER_GUIDE.md

@@ -178,6 +178,10 @@ The fixtures may diverge from sdr-grader's over time — the visualizer wants mo
   and mapping keys before normalization. Embedded definition, tag, and
   reference helpers repeat that Unicode-scalar check after decoding, when
   escaped surrogates first materialize.
+- `input/json_io.py` (`unique_object`, `DuplicateJSONKeyError`) — snapshot
+  files, stdin, and generator output reject a JSON object that repeats a member
+  name, mirrored from sdr-grader #127 (`c8e7316`). The helper body is
+  identical; only the module docstring differs.
 - `_optional_list` (AA) — an absent/null optional section is `[]`, but a present non-list value raises `InvalidSnapshotError` (a malformed export, not an empty one). CJA gets the same guarantee through `_section_records`.
 - `generator_version_warning` / `_version_tuple` / `TESTED_THROUGH_GENERATOR_VERSION` — the Q5 version-compat warning mechanism (1.0.0). The helper bodies are behavior-identical; the constant's *value* is per-platform and per-release by design (the newest generator version that release was validated against).
 - `_optional_timestamp` — guards `created_at`/`modified_at`: keeps the value only if it's already a non-empty string, else `None`, so `_compact` drops a non-string timestamp (an epoch int, say) instead of leaking it into the payload. Present in both `cja.py` and `aa.py` here, and mirrored into the grader's copies of both adapters — a non-string timestamp is *missing*, not a value worth coercing to a numeric string.

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/docs/DEPENDABOT_AUTOMATION.md

@@ -57,7 +57,7 @@ Adobe credential, or external review service is needed.
 The deployment enables **Allow auto-merge** and adds `dependabot-policy` to the
 existing required checks, with the GitHub Actions app as the check source:
 
-`lint`, `test (3.11)`, `test (3.12)`, `test (3.14)`, `browser-perf`, `check`, `verify`, `analyze (python, none)`, `analyze (javascript-typescript, none)`, `dependency-review`, `actionlint`, `lockfile`, `dependabot-policy`.
+`lint`, `test (3.11)`, `test (3.12)`, `test (3.13)`, `test (3.14)`, `browser-perf`, `check`, `verify`, `analyze (python, none)`, `analyze (javascript-typescript, none)`, `dependency-review`, `actionlint`, `lockfile`, `dependabot-policy`.
 
 Branch protection continues to require up-to-date branches and enforce the
 requirements for administrators. Existing review requirements are preserved;

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/docs/LINEAGE.md

@@ -42,15 +42,12 @@ cja-lineage --live --binary /absolute/path/to/cja_auto_sdr \
 Alternatively use `--profile profile-name`, or omit both credential selectors
 to use the upstream default credential route. `--profile` and `--config-file`
 are mutually exclusive and apply only to `--live`. The executable and explicit
-configuration paths must be absolute. Live discovery currently accepts exactly
-`cja_auto_sdr` 3.11.8, 3.12.0, 3.12.2, and 3.12.4. Other versions fail closed pending
-compatibility qualification; saved discovery is validated by shape rather than
-generator version. Version 3.12.2 was qualified against the offline discovery
-contract with synthetic inventories and blocked network access. That compatibility
-check does not qualify credentials, network behavior, or a live release. No
-generator is installed automatically. Version 3.12.4 was qualified with fresh
-read-only dataset discovery and saved-shape validation; this does not imply
-complete visibility into every dataset or Connection.
+configuration paths must be absolute. Live discovery accepts
+`cja_auto_sdr` 3.11.8 or newer, reported as a plain `X.Y.Z` version. Older
+versions, pre-release or local builds, and other tools fail closed before
+credentials are used. Versions newer than 3.13.6 run with a warning. Live and
+saved discovery output are both validated by shape. No generator is installed
+automatically.
 
 The command currently targets macOS and Linux, using POSIX process and
 owner-only output protections. Windows execution is not qualified. The generated
@@ -120,7 +117,7 @@ Keep live reports private to their authorized audience. The repository
 | `invalid-json` / `invalid-utf8` | Save complete UTF-8 JSON output, without terminal messages mixed into it. |
 | `saved-read-failed` | Check that the saved file exists and is readable. |
 | `executable-invalid` | Use an absolute, current-user-owned executable that is not group/world writable. |
-| `executable-version-mismatch` | Use a qualified upstream version listed above. |
+| `executable-version-mismatch` | Use a `cja_auto_sdr` release at 3.11.8 or newer that reports a plain `X.Y.Z` version. |
 | `selector-invalid` | Check the profile or absolute configuration path and use one credential selector. |
 | `process-failed` / `timeout` | Check upstream authentication and discovery independently; acquisition has a 600-second limit. |
 | `saved-too-large` / `stdout-limit-exceeded` / `stderr-limit-exceeded` | Reduce the discovery scope; capture is bounded at 64 MiB for saved/stdout and 1 MiB for stderr. |

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/docs/PRODUCT_CONTRACT.md

@@ -171,6 +171,12 @@ or coercion; decoder resource-limit failures and structure-limit violations
 are invalid input. Values decoded from embedded JSON are checked again because
 escaped surrogates first materialize at that boundary.
 
+A JSON object that repeats a member name is invalid input, even when the
+repeated values are identical. This applies to snapshot files, stdin, live
+generator output, comparison baselines, and trend members. The error does not
+echo the key or its values. A trend member with a repeated key is skipped with
+a warning, like any other unreadable member.
+
 The graph includes directed edges only when both source and target exist.
 CJA-derived-field component references are normalized and contribute to those
 edges and degree counts. Dangling references do not create graph edges.
@@ -207,8 +213,8 @@ unusable, and capped-out members do not warn. The current markers are:
 
 | Platform | Warning threshold |
 |---|---:|
-| CJA (`cja_auto_sdr`) | 3.13.2 |
-| AA (`aa_auto_sdr`) | 1.24.1 |
+| CJA (`cja_auto_sdr`) | 3.13.6 |
+| AA (`aa_auto_sdr`) | 1.24.5 |
 
 A marker is evidence of exercised compatibility, not a promise about every
 possible snapshot produced by that version. It may advance only after a

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/docs/RELEASE_EVIDENCE_TEMPLATE.md

@@ -214,6 +214,7 @@ cannot be closed by recording the current delta as diff-backed N/A.
 | Exact-SHA test matrix run(s) | pending |
 | `test (3.11)` | pending |
 | `test (3.12)` | pending |
+| `test (3.13)` | pending |
 | `test (3.14)` | pending |
 | `browser-perf` | pending |
 | `analyze (python, none)` | pending |

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/docs/RELEASING.md

@@ -289,7 +289,8 @@ Inspect repository settings immediately before the go/no-go decision and record
 the result:
 
 - `main` requires pull requests and the expected test/lint checks, including
-  `test (3.11)`, `test (3.12)`, `test (3.14)`, and `browser-perf`;
+  `test (3.11)`, `test (3.12)`, `test (3.13)`, `test (3.14)`, and
+  `browser-perf`;
 - the candidate has successful `analyze (python, none)` and
   `analyze (javascript-typescript, none)` CodeQL checks, and `main` requires
   both emitted contexts before tag authorization;
@@ -310,7 +311,7 @@ the result:
 
 Inspect the emitted hosted check names and branch-protection/ruleset required
 contexts; editing the workflow does not update repository settings. Retain the
-established required contexts and add `test (3.14)` through the authorized
+established required contexts and add `test (3.13)` and `test (3.14)` through the authorized
 hosted-control workflow. Record the settings inspection and exact-SHA run links.
 Each Python matrix lane must pass its runtime-version assertion, non-browser
 coverage gate, and Python performance gate. The test and release browser jobs,
@@ -437,6 +438,13 @@ versions, and one live generation path against the frozen candidate. Any drift
 from candidate evidence stops publication and requires complete
 requalification; it is not patched into the release after tagging.
 
+Before tagging, a maintainer may dispatch `release.yml` manually on the
+candidate commit (`gh workflow run release.yml --ref <branch>`) as a dry run.
+It runs the browser and performance gates, the build, and the installed-artifact
+smoke run, and it skips the tag-version check, PyPI publication, and the GitHub
+release. A dry run's `dist` artifact is not the authoritative release artifact;
+only the tag-triggered run produces that.
+
 After the candidate is approved, a separate explicit tag authorization starts
 the release workflow. Record the workflow run ID and attempt, event, tag,
 `headSha`, job conclusions, retained artifact ID, artifact expiry, distribution

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/docs/WORKSPACE_USAGE.md

@@ -183,7 +183,7 @@ bounded selection; an empty catalog cannot request collection.
 
 ## Collection behavior and limits
 
-Collection uses `cjapy==0.3.1` for CJA and `aanalytics2==0.5.5.post2` for AA.
+Collection uses `cjapy==0.3.1` for CJA and `aanalytics2==0.5.5.post3` for AA.
 Each SDK's `findComponentsUsage` runs locally against sanitized fetched project
 definitions in a separate, credential-free process. Characterized helpers can
 miss structures or return false positives. **All SDK results remain unverified

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/pyproject.toml

@@ -1,19 +1,30 @@
 [project]
 name = "sdr-visualizer"
-version = "1.2.6"
+version = "1.2.7"
 description = "Static-output visual catalog generator for Adobe Customer Journey Analytics and Adobe Analytics implementations."
 readme = "README.md"
 license = "MIT"
 license-files = ["LICENSE", "THIRD_PARTY_LICENSES"]
 authors = [{ name = "Brian Au" }]
 requires-python = ">=3.11"
+classifiers = [
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Scientific/Engineering :: Visualization",
+]
 dependencies = [
     "jinja2>=3.1",
 ]
 
 [project.optional-dependencies]
 workspace-cja = ["cjapy==0.3.1", "requests>=2.32"]
-workspace-aa = ["aanalytics2==0.5.5.post2", "requests>=2.32"]
+workspace-aa = ["aanalytics2==0.5.5.post3", "requests>=2.32"]
 
 [project.scripts]
 sdr-visualizer = "sdr_visualizer.cli.main:main"
@@ -35,6 +46,7 @@ dev = [
     "jsonschema>=4.21",
     "pytest-cov>=5.0",
     "pyyaml>=6.0",
+    "pytest-xdist>=3.8.0",
 ]
 browser = [
     "playwright>=1.43",

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/scripts/check_workflow_policy.py

@@ -29,6 +29,9 @@ EXPECTED_CODEQL_MATRIX = {
 }
 EXPECTED_CODEQL_CONFIG_FILE = "./.github/codeql/codeql-config.yml"
 EXPECTED_CODEQL_IGNORES = ["examples/**"]
+# The one job guard release.yml may use: it skips publication on manual dry
+# runs and, lacking a status function, still implies success().
+RELEASE_PUBLISH_GUARD = "github.event_name == 'push'"
 
 
 def _error(path: Path, message: str) -> str:
@@ -243,12 +246,26 @@ def _release_errors(path: Path, workflow: dict[str, Any]) -> list[str]:
         errors.append(_error(path, "github-release must need publish"))
     for job_name, job in jobs.items():
         if isinstance(job, dict):
+            item = job
+            if job_name == "publish" and job.get("if") == RELEASE_PUBLISH_GUARD:
+                item = {key: value for key, value in job.items() if key != "if"}
             _require_default_success(
                 errors,
                 path=path,
                 label=f"job {job_name!r}",
-                item=job,
+                item=item,
             )
+    # PyYAML reads the bare `on` key as boolean True.
+    triggers = workflow.get("on", workflow.get(True))
+    trigger_names = set(triggers) if isinstance(triggers, (dict, list)) else {triggers}
+    if trigger_names != {"push"} and publish.get("if") != RELEASE_PUBLISH_GUARD:
+        errors.append(
+            _error(
+                path,
+                f"publish must use 'if: {RELEASE_PUBLISH_GUARD}' when release has "
+                "triggers other than push",
+            )
+        )
 
     build_distribution = _step_index(
         build, lambda step: _run_is(step, "uv build --out-dir dist/packages")

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/scripts/dependabot_review.py

@@ -36,6 +36,7 @@ REQUIRED_CHECKS = frozenset(
         "lint",
         "test (3.12)",
         "actionlint",
+        "test (3.13)",
         "test (3.14)",
     }
 )

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/src/sdr_visualizer/__init__.py

@@ -1,3 +1,3 @@
 """sdr-visualizer: visual catalog generator for CJA / AA implementations."""
 
-__version__ = "1.2.6"
+__version__ = "1.2.7"

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/src/sdr_visualizer/adapters/aa.py

@@ -356,7 +356,7 @@ def _walk_segment_definition(definition: Any) -> tuple[int, list[str]]:
 # and the historical compatibility corpus; snapshot declarations alone do not
 # establish this marker. Undeclared versions stay unknown and do not warn.
 # The compatibility policy warns about newer declared versions, never refuses.
-TESTED_THROUGH_GENERATOR_VERSION = "1.24.1"
+TESTED_THROUGH_GENERATOR_VERSION = "1.24.5"
 
 
 def generator_version_warning(adapter_version: str) -> str | None:

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/src/sdr_visualizer/adapters/cja.py

@@ -368,7 +368,7 @@ def _walk_for_contexts(node: Any, out: list[str]) -> None:
 # and the historical compatibility corpus; snapshot declarations alone do not
 # establish this marker. Undeclared versions stay unknown and do not warn.
 # The compatibility policy warns about newer declared versions, never refuses.
-TESTED_THROUGH_GENERATOR_VERSION = "3.13.2"
+TESTED_THROUGH_GENERATOR_VERSION = "3.13.6"
 
 
 def generator_version_warning(adapter_version: str) -> str | None:

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/src/sdr_visualizer/cli/lineage.py

@@ -34,7 +34,7 @@ def main(argv: list[str] | None = None) -> int:
     parser.add_argument(
         "--binary",
         type=Path,
-        help="Absolute path to cja_auto_sdr 3.11.8, 3.12.0, 3.12.2, or 3.12.4 (live only)",
+        help="Absolute path to cja_auto_sdr 3.11.8 or newer (live only)",
     )
     auth = parser.add_mutually_exclusive_group()
     auth.add_argument("--profile", help="Named upstream credential profile (live only)")
@@ -80,7 +80,11 @@ def main(argv: list[str] | None = None) -> int:
         return 3
     topology = (
         acquire_live(
-            args.binary, scope_label=label, profile=args.profile, config_file=args.config_file
+            args.binary,
+            scope_label=label,
+            profile=args.profile,
+            config_file=args.config_file,
+            on_warning=lambda message: print(f"cja-lineage: warning: {message}", file=sys.stderr),
         )
         if args.live
         else acquire_saved(args.saved, scope_label=label)

sdr_visualizer-1.2.7/src/sdr_visualizer/input/json_io.py

@@ -0,0 +1,19 @@
+"""Object construction for external JSON read as snapshots."""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+class DuplicateJSONKeyError(ValueError):
+    """A serialized object repeats a decoded member name."""
+
+
+def unique_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
+    """Reject duplicate names without exposing input keys or values in errors."""
+    result: dict[str, Any] = {}
+    for key, value in pairs:
+        if key in result:
+            raise DuplicateJSONKeyError("JSON contains duplicate object keys")
+        result[key] = value
+    return result

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/src/sdr_visualizer/input/lineage_discovery.py

@@ -12,6 +12,7 @@ import signal
 import stat
 import subprocess
 import time
+from collections.abc import Callable
 from contextlib import suppress
 from dataclasses import dataclass
 from enum import StrEnum
@@ -27,7 +28,12 @@ DEFAULT_SAVED_LIMIT = DEFAULT_STDOUT_LIMIT
 DEFAULT_TIMEOUT_SECONDS = 600.0
 
 _READ_SIZE = 64 * 1024
-_VERSION_OUTPUT = re.compile(rb"\Acja_auto_sdr (?:3\.11\.8|3\.12\.0|3\.12\.2|3\.12\.4)(?:\r?\n)?\Z")
+# Live discovery accepts any plain X.Y.Z release at or above the first
+# qualified version. Output is shape-validated like saved discovery, so a
+# version newer than the last one exercised warns instead of failing.
+MINIMUM_LIVE_GENERATOR_VERSION = "3.11.8"
+TESTED_THROUGH_LIVE_GENERATOR_VERSION = "3.13.6"
+_VERSION_OUTPUT = re.compile(rb"\Acja_auto_sdr (\d{1,6})\.(\d{1,6})\.(\d{1,6})(?:\r?\n)?\Z")
 _VERSION_OUTPUT_LIMIT = 8 * 1024
 _VERSION_TIMEOUT_SECONDS = 10.0
 _PROFILE = re.compile(r"\A[A-Za-z0-9][A-Za-z0-9_.-]{0,127}\Z")
@@ -124,11 +130,13 @@ def acquire_live(
     stdout_limit: int = DEFAULT_STDOUT_LIMIT,
     stderr_limit: int = DEFAULT_STDERR_LIMIT,
     timeout_seconds: float = DEFAULT_TIMEOUT_SECONDS,
+    on_warning: Callable[[str], None] | None = None,
 ) -> LineageDiscoveryResult:
     """Run verified CJA discovery and normalize its bounded stdout.
 
     Executable identity and version are checked in a credential-free process
     before profile/config selectors or the live environment are constructed.
+    A version newer than the tested-through marker is passed to ``on_warning``.
     """
     if (
         not _positive_limit(stdout_limit)
@@ -147,8 +155,11 @@ def acquire_live(
 
     executable_path = Path(executable)
     verification = _verify_executable(executable_path)
-    if verification is not None:
+    if isinstance(verification, LineageDiscoveryFailure):
         return verification
+    warning = _live_version_warning(verification)
+    if warning is not None and on_warning is not None:
+        on_warning(warning)
 
     argv = [str(executable_path)]
     if normalized_profile is not None:
@@ -174,7 +185,7 @@ def acquire_live(
     return _decode_and_normalize(captured.stdout, scope_label=scope_label)
 
 
-def _verify_executable(path: Path) -> LineageDiscoveryFailure | None:
+def _verify_executable(path: Path) -> LineageDiscoveryFailure | tuple[int, int, int]:
     if not path.is_absolute():
         return LineageDiscoveryFailure(LineageDiscoveryFailureCode.EXECUTABLE_INVALID)
     try:
@@ -198,9 +209,29 @@ def _verify_executable(path: Path) -> LineageDiscoveryFailure | None:
     )
     if isinstance(captured, LineageDiscoveryFailure) or captured.returncode != 0:
         return LineageDiscoveryFailure(LineageDiscoveryFailureCode.EXECUTABLE_INVALID)
-    if _VERSION_OUTPUT.fullmatch(captured.stdout) is None:
+    match = _VERSION_OUTPUT.fullmatch(captured.stdout)
+    if match is None:
         return LineageDiscoveryFailure(LineageDiscoveryFailureCode.EXECUTABLE_VERSION_MISMATCH)
-    return None
+    version = (int(match[1]), int(match[2]), int(match[3]))
+    if version < _parse_version(MINIMUM_LIVE_GENERATOR_VERSION):
+        return LineageDiscoveryFailure(LineageDiscoveryFailureCode.EXECUTABLE_VERSION_MISMATCH)
+    return version
+
+
+def _parse_version(text: str) -> tuple[int, int, int]:
+    major, minor, patch = (int(part) for part in text.split("."))
+    return major, minor, patch
+
+
+def _live_version_warning(version: tuple[int, int, int]) -> str | None:
+    if version <= _parse_version(TESTED_THROUGH_LIVE_GENERATOR_VERSION):
+        return None
+    return (
+        f"cja_auto_sdr {'.'.join(map(str, version))} is newer than the newest version "
+        f"this release was tested against for live lineage "
+        f"({TESTED_THROUGH_LIVE_GENERATOR_VERSION}); newer discovery fields may not be "
+        "represented"
+    )
 
 
 def _validate_selectors(

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/src/sdr_visualizer/input/loader.py

@@ -20,6 +20,7 @@ from pathlib import Path
 from typing import Any
 
 from sdr_visualizer.core.exceptions import InvalidSnapshotError
+from sdr_visualizer.input.json_io import DuplicateJSONKeyError, unique_object
 
 STDIN_TOKEN = "-"
 
@@ -60,7 +61,9 @@ def _load_stdin() -> tuple[dict[str, Any], str]:
     if not raw.strip():
         raise InvalidSnapshotError("stdin is empty; expected JSON snapshot")
     try:
-        snapshot = json.loads(raw)
+        snapshot = json.loads(raw, object_pairs_hook=unique_object)
+    except DuplicateJSONKeyError:
+        raise InvalidSnapshotError("stdin JSON contains duplicate object keys") from None
     except json.JSONDecodeError as exc:
         raise InvalidSnapshotError(f"stdin is not valid JSON: {exc}") from exc
     except ValueError as exc:
@@ -76,7 +79,9 @@ def _load_from_file(path: Path) -> tuple[dict[str, Any], str]:
     except (OSError, UnicodeError) as exc:
         raise InvalidSnapshotError(f"could not read {path}: {exc}") from exc
     try:
-        snapshot = json.loads(text)
+        snapshot = json.loads(text, object_pairs_hook=unique_object)
+    except DuplicateJSONKeyError:
+        raise InvalidSnapshotError(f"{path}: JSON contains duplicate object keys") from None
     except json.JSONDecodeError as exc:
         raise InvalidSnapshotError(f"{path}: not valid JSON: {exc}") from exc
     except ValueError as exc:

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/src/sdr_visualizer/input/shell_out.py

@@ -15,6 +15,7 @@ from pathlib import Path
 from typing import Any
 
 from sdr_visualizer.core.exceptions import InvalidSnapshotError
+from sdr_visualizer.input.json_io import DuplicateJSONKeyError, unique_object
 
 SHELL_OUT_TIMEOUT_SECONDS = 600
 
@@ -107,7 +108,9 @@ def _shell_out(
             raise InvalidSnapshotError(f"{tool} JSON output could not be read: {exc}") from exc
 
     try:
-        snapshot = json.loads(snapshot_text)
+        snapshot = json.loads(snapshot_text, object_pairs_hook=unique_object)
+    except DuplicateJSONKeyError:
+        raise InvalidSnapshotError(f"{tool} output contains duplicate object keys") from None
     except json.JSONDecodeError as exc:
         raise InvalidSnapshotError(f"{tool} produced output that is not valid JSON: {exc}") from exc
     except ValueError as exc:

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/src/sdr_visualizer/usage/normalize.py

@@ -14,7 +14,7 @@ from sdr_visualizer.core.structure_limits import (
 )
 
 MAX_IPC_BYTES = 16 * 1024 * 1024
-SDK_VERSIONS = {"cja": ("cjapy", "0.3.1"), "aa": ("aanalytics2", "0.5.5.post2")}
+SDK_VERSIONS = {"cja": ("cjapy", "0.3.1"), "aa": ("aanalytics2", "0.5.5.post3")}
 EXCLUDED_PROJECTS_LIMITATION = "Malformed or unsupported projects were excluded from SDK matching"
 CANDIDATE_LIMITATION = (
     "SDK matching is incomplete; exact component and environment match remain unverified"

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/tests/test_adapters_cja.py

@@ -858,7 +858,7 @@ def test_equal_older_or_unparseable_versions_do_not_warn():
 
 
 def test_tuple_length_mismatch_versions_compare_correctly():
-    # (3, 14) > (3, 13, 2), while the shorter (3, 13) sorts below the
+    # (3, 14) > (3, 13, 6), while the shorter (3, 13) sorts below the
     # longer tested tuple. This pins Python tuple ordering as the contract.
     from sdr_visualizer.adapters.cja import generator_version_warning
 

{sdr_visualizer-1.2.6 → sdr_visualizer-1.2.7}/tests/test_cli.py

@@ -1101,10 +1101,10 @@ def test_tested_generator_version_does_not_warn(tmp_path, capsys):
 @pytest.mark.parametrize(
     ("platform", "version", "warns"),
     [
-        ("cja", "3.13.2", False),
-        ("cja", "3.13.3", True),
-        ("aa", "1.24.1", False),
-        ("aa", "1.24.2", True),
+        ("cja", "3.13.6", False),
+        ("cja", "3.13.7", True),
+        ("aa", "1.24.5", False),
+        ("aa", "1.24.6", True),
     ],
 )
 def test_catalog_generator_warning_boundary(platform, version, warns, tmp_path, capsys):