A-72: no @novox/mesh-* package counts as beyond the SDK in mesh-build-node

Builds: design 47 G G-20 A-72

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

modules/mesh-build-node/cmd/mesh-build-node/fetch.go

@@ -260,7 +260,7 @@ func (m *Module) typeScriptModules(ctx context.Context, tree string) (dirs []str
 	return dirs, packages, nil
 }
 
-// ownDependencies are the package.json's dependencies beyond the SDK and beyond what is build-time: the types and
+// ownDependencies are the package.json's dependencies beyond the mesh's own packages (@novox/mesh-*, design 47 G A-72) and beyond what is build-time: the types and
 // typescript, which the toolchain carries (dependencies.go:49-70). Sorted; none for a module without a package.json.
 func ownDependencies(dir string) (names []string, pkg map[string]any, err error) {
 	raw, err := os.ReadFile(filepath.Join(dir, "package.json"))
@@ -275,7 +275,7 @@ func ownDependencies(dir string) (names []string, pkg map[string]any, err error)
 	}
 	deps, _ := pkg["dependencies"].(map[string]any)
 	for name := range deps {
-		if name != sdkPackage && name != "typescript" && !strings.HasPrefix(name, "@types/") {
+		if name != sdkPackage && !strings.HasPrefix(name, "@novox/mesh-") && name != "typescript" && !strings.HasPrefix(name, "@types/") {
 			names = append(names, name)
 		}
 	}

modules/mesh-build-node/cmd/mesh-build-node/fetch_test.go

@@ -96,6 +96,20 @@ func TestAModuleNamingOnlyTheSdkAndTypesInstallsNothing(t *testing.T) {
 	}
 }
 
+// 47/G A-72: a module naming another @novox/mesh-* package beside the SDK has no package beyond the SDK, so it installs
+// nothing and is not refused for want of a lock.
+func TestAMeshPackageIsNotBeyondTheSdk(t *testing.T) {
+	m, f := fetchMachine(t, typeScriptModule(`{"dependencies":{"@novox/mesh-sdk":"^0.1.6","@novox/mesh-tools":"^0.1.6"}}`), nil)
+	out, err := m.fetch(context.Background(), fetchArgs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := out.(FetchResult)
+	if len(npmCalls(f)) != 0 || len(r.Installed) != 0 || len(r.Refused) != 0 {
+		t.Errorf("result = %+v, npm calls %d, want nothing installed and nothing refused", r, len(npmCalls(f)))
+	}
+}
+
 // 1489/AC2: a module naming lodash with a lock gets npm ci --omit=dev --ignore-scripts (fake runner), its install put
 // at its node_modules without the SDK and without any copy of it; without a lock the step fails naming the directory.
 func TestAModuleNamingLodashWithALockIsInstalledWithoutTheSdkAndWithoutALockFails(t *testing.T) {