fix: enforce array contains/minContains/maxContains on generated models

[vishkaty]

What

totals.json requires an array that contains exactly one subtotal and one
total entry (allOf of two contains groups, each minContains:1/maxContains:1).
datamodel-code-generator drops contains/minContains/maxContains, so the
generated Totals (a bare list[Total] alias) accepts arrays that violate this —
empty, missing a total, or duplicate subtotals all pass validation.

This extends the existing postprocess_models.py mechanism (added in #55 for
minProperties) to also enforce array containment. Because preprocess_schemas.py
merges allOf and a JSON node can hold only one contains (silently dropping the
second group), the injector now snapshots the pristine schemas before
preprocessing and derives every predicate from contains.properties.*.const. It
threads a pydantic.AfterValidator enforcing all bounds into the alias metadata —
Totals and its create/update request variants alike. Data-driven (nothing
hardcodes subtotal/total), idempotent, dependency-free.

Also fixed: SDK-guarded tests were silently skipping

description.json moved from shopping/types to common/types, so the shared
test import raised and set HAVE_SDK = False — every SDK-guarded test (including
#55's minProperties tests) was skipping in CI. This corrects the import, so those
tests run again.

Tests

tests/test_codegen_pipeline.py:

• TotalsContainsTest — across Totals, TotalsCreateRequest, TotalsUpdateRequest:
  reject [], [total, total], [subtotal, subtotal], [subtotal], [total];
  accept [subtotal, total]; plus a test asserting a subtotal-only array fails on
  the total rule specifically.
• ArrayContainsInjectorTest — scanner reads both allOf branches and root-level
  single contains; ignores non-array / predicate-less; injection + idempotency.

Verification

• Full suite green as CI runs it (python -m unittest discover -s tests -p "test_*.py"):
  33 passed, 0 skipped (with the SDK-guarded tests now actually running; fix: enforce minProperties on generated models #55's
  tests pass).
• bash generate_models.sh regenerates the validator on all three models;
  idempotent (byte-identical re-run); ruff + ruff-format clean.

Generated models are intentionally not committed (the tracked generated tree is
stale vs main); the injector emits the validator whenever generate_models.sh runs.

[vishkaty]

Following up with the results of a full end to end verification.

I regenerated the models against the pinned schema and ran the complete conformance suite against the reference flower shop server, comparing a build with these validators to a baseline without them. The baseline passes cleanly (69 tests, 0 failures). With the contains validators active, every checkout operation fails (67 failures across all 15 files).

The cause is a construction order in the reference server, not a spec violation. The server creates the checkout with an empty totals list and then fills it in during recalculation:

checkout = Checkout(..., totals=[], ...)   # services/checkout_service.py
... later ...
_recalculate_totals(checkout)              # appends subtotal + total

Because the constraint is an AfterValidator, it runs at construction time on the transient empty list and raises before recalculation runs. The final wire document the server emits is fully valid (exactly one subtotal and one total), so this is only about when the check fires.

The wider point is one of altitude. The generated models are used both to parse incoming documents and to build outgoing ones incrementally. A wire level contains cardinality rule enforced on every construction rejects a legitimate mid build state, which makes it a breaking change for any builder style consumer, the reference server being the clearest example. This differs from a leaf constraint like the minProperties work, where the object is never built empty and then populated.

Since you maintain both the SDK and the reference server, I did not want to pick a direction unilaterally. Two options that both preserve strict enforcement:

1. Keep the validators and adjust the reference server to avoid constructing an invalid intermediate, for example computing totals before construction or using model_construct for the transient. Small server change, keeps enforcement strict.
2. Move enforcement to the parse and serialize boundary so it validates complete documents rather than every in memory construction.

I am happy to implement either, or a variation you prefer. Marking this as a draft until we align on the approach.

[damaz91]

Thanks for drafting the change and outlining the options @vishkaty ! I'm good with option 1

[vishkaty]

Thanks - going with option 1.

I filed the reference-server change as Universal-Commerce-Protocol/samples#152. It builds the in-progress checkout with model_construct and re-validates the completed document once the server-authoritative totals are populated, so this PR's enforcement stays strict on the wire document.

Verified end to end: with samples#152 applied and the validators here active, the full conformance suite runs 69 passing / 0 failures (was 67 failures without the server change). samples#152 is safe to land independently - it behaves identically with or without these validators - so it can merge first or alongside this to keep the reference server green.

Marking this ready for review.

[vishkaty]

Small correction on approach: I moved samples#152 away from model_construct to seeding a valid placeholder totals at construction (overwritten by _recalculate_totals immediately). model_construct skipped coercion of extension fields (it left discounts as a raw dict and broke the server's discount integration tests), so normal construction with a seeded placeholder is the safer minimal change. Enforcement here stays strict.

Re-verified: 69/0 conformance with these validators active, and the server's own integration tests (16) + happy-path client green without them.