chore: harden repository guardrails

tests/boundaries.test.ts

@@ -12,21 +12,93 @@ describe("repository dependency boundaries", () => {
     expect(result.violations).toEqual([]);
   });
 
+  it("accepts generated module composition only through the generated bootstrap boundary", async () => {
+    const result = await checkBoundaries(path.join(fixtures, "legal-generated-bootstrap"));
+    expect(result.violations).toEqual([]);
+  });
+
+  it("honors explicit pnpm workspace exclusions", async () => {
+    const result = await checkBoundaries(path.join(fixtures, "workspace-exclusion"));
+    expect(result.violations).toEqual([]);
+  });
+
   it.each([
     ["core-imports-module", "core-is-feature-agnostic"],
+    ["app-imports-module", "apps-are-composition-roots"],
+    ["module-imports-core", "modules-use-public-platform-contracts"],
     ["module-imports-surface", "modules-use-public-platform-contracts"],
+    ["package-boundary-direction", "modules-use-public-platform-contracts"],
     ["cross-module-import", "modules-do-not-import-other-modules"],
+    ["surface-imports-module", "surfaces-use-public-contracts"],
+    ["cross-surface-import", "surfaces-are-independent"],
+    ["builder-imports-module", "builder-composes-contracts"],
+    ["contracts-import-core", "contracts-do-not-depend-upward"],
+    ["sdk-imports-core", "sdks-do-not-depend-on-implementations"],
+    ["shared-role-order", "sdks-do-not-depend-on-implementations"],
+    ["package-without-exports", "workspace-imports-use-public-exports"],
+    ["private-package-import", "workspace-imports-use-public-exports"],
+    ["non-workspace-version", "internal-dependencies-use-workspace-protocol"],
+    ["workspace-alias", "workspace-dependency-aliases-are-forbidden"],
+    ["undeclared-workspace-dependency", "workspace-dependencies-are-declared"],
+    ["duplicate-package-name", "workspace-package-names-are-unique"],
+    ["unknown-shared-role", "shared-packages-declare-known-roles"],
+    ["workspace-unsupported-pattern", "workspace-patterns-use-supported-syntax"],
+    ["package-cycle", "no-circular-package-dependencies"],
     ["module-has-ui", "modules-do-not-own-ui"],
+    ["module-ui-framework", "modules-do-not-own-ui"],
+    ["module-imports-ui-package", "modules-use-public-platform-contracts"],
+    ["cross-package-relative", "workspace-imports-use-public-exports"],
     ["cycle", "no-circular-source-dependencies"],
   ])("rejects %s", async (fixture, expectedRule) => {
     const result = await checkBoundaries(path.join(fixtures, fixture));
     expect(result.violations.map((violation) => violation.rule)).toContain(expectedRule);
   });
 
-  it("rejects both component and stylesheet files inside a module", async () => {
+  it("rejects component, stylesheet, and case-insensitive view files inside a module", async () => {
     const result = await checkBoundaries(path.join(fixtures, "module-has-ui"));
     expect(
       result.violations.filter((violation) => violation.rule === "modules-do-not-own-ui"),
+    ).toHaveLength(3);
+  });
+
+  it("rejects UI framework dependencies, imports, and view formats inside a module", async () => {
+    const result = await checkBoundaries(path.join(fixtures, "module-ui-framework"));
+    expect(
+      result.violations.filter((violation) => violation.rule === "modules-do-not-own-ui"),
+    ).toHaveLength(4);
+  });
+
+  it("requires workspace: ranges in every dependency field", async () => {
+    const result = await checkBoundaries(path.join(fixtures, "non-workspace-version"));
+    expect(
+      result.violations.filter(
+        (violation) => violation.rule === "internal-dependencies-use-workspace-protocol",
+      ),
+    ).toHaveLength(4);
+  });
+
+  it("resolves forbidden workspace aliases before applying layer rules", async () => {
+    const result = await checkBoundaries(path.join(fixtures, "workspace-alias"));
+    expect(
+      result.violations.filter(
+        (violation) => violation.rule === "workspace-dependency-aliases-are-forbidden",
+      ),
     ).toHaveLength(2);
+    expect(result.violations.map((violation) => violation.rule)).toEqual(
+      expect.arrayContaining([
+        "workspace-dependency-aliases-are-forbidden",
+        "modules-use-public-platform-contracts",
+      ]),
+    );
+  });
+
+  it("prevents contracts and SDKs from depending upward through shared packages", async () => {
+    const result = await checkBoundaries(path.join(fixtures, "shared-role-order"));
+    expect(result.violations.map((violation) => violation.rule)).toEqual(
+      expect.arrayContaining([
+        "contracts-do-not-depend-upward",
+        "sdks-do-not-depend-on-implementations",
+      ]),
+    );
   });
 });

tests/fixtures/boundaries/app-imports-module/apps/api/src/index.ts

@@ -0,0 +1,3 @@
+import { calendar } from "../../../modules/calendar/src/index.js";
+
+export const invalidAppFeature = calendar;

tests/fixtures/boundaries/app-imports-module/modules/calendar/src/index.ts

@@ -0,0 +1 @@
+export const calendar = "calendar";

tests/fixtures/boundaries/builder-imports-module/builders/default/src/index.ts

@@ -0,0 +1,3 @@
+import { calendar } from "../../../modules/calendar/src/index.js";
+
+export const invalidBuilderFeature = calendar;

tests/fixtures/boundaries/builder-imports-module/modules/calendar/src/index.ts

@@ -0,0 +1 @@
+export const calendar = "calendar";

tests/fixtures/boundaries/contracts-import-core/core/src/index.ts

@@ -0,0 +1 @@
+export const core = "core";

tests/fixtures/boundaries/contracts-import-core/packages/contracts/src/index.ts

@@ -0,0 +1,3 @@
+import { core } from "../../../core/src/index.js";
+
+export const invalidContract = core;

tests/fixtures/boundaries/cross-package-relative/core/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/core",
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {
+    "@ekklesia/contracts": "workspace:*"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}

tests/fixtures/boundaries/cross-package-relative/core/src/index.ts

@@ -0,0 +1,3 @@
+import { contract } from "../../packages/contracts/src/index.js";
+
+export const invalidPrivatePath = contract;

tests/fixtures/boundaries/cross-package-relative/packages/contracts/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/contracts",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "contracts"
+  }
+}

tests/fixtures/boundaries/cross-package-relative/packages/contracts/src/index.ts

@@ -0,0 +1 @@
+export const contract = "contract";

tests/fixtures/boundaries/cross-surface-import/surfaces/dashboard/src/index.ts

@@ -0,0 +1,3 @@
+import { website } from "../../../surfaces/website/src/index.js";
+
+export const invalidSurfaceDependency = website;

tests/fixtures/boundaries/cross-surface-import/surfaces/website/src/index.ts

@@ -0,0 +1 @@
+export const website = "website";

tests/fixtures/boundaries/duplicate-package-name/packages/one/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/duplicate",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "tooling"
+  }
+}

tests/fixtures/boundaries/duplicate-package-name/packages/one/src/index.ts

@@ -0,0 +1 @@
+export const one = 1;

tests/fixtures/boundaries/duplicate-package-name/packages/two/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/duplicate",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "tooling"
+  }
+}

tests/fixtures/boundaries/duplicate-package-name/packages/two/src/index.ts

@@ -0,0 +1 @@
+export const two = 2;

tests/fixtures/boundaries/legal-generated-bootstrap/apps/api/src/index.ts

@@ -0,0 +1,3 @@
+import { installedModules } from "../../../generated/module-registry.js";
+
+export const bootstrap = installedModules;

tests/fixtures/boundaries/legal-generated-bootstrap/generated/module-registry.ts

@@ -0,0 +1,3 @@
+import { calendar } from "../modules/calendar/src/index.js";
+
+export const installedModules = [calendar];

tests/fixtures/boundaries/legal-generated-bootstrap/modules/calendar/src/index.ts

@@ -0,0 +1 @@
+export const calendar = "calendar";

tests/fixtures/boundaries/legal/packages/conditional/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@ekklesia/conditional",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    "types": "./src/index.ts",
+    "import": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "shared"
+  }
+}

tests/fixtures/boundaries/legal/packages/conditional/src/index.ts

@@ -0,0 +1 @@
+export const conditional = "conditional";

tests/fixtures/boundaries/legal/packages/consumer/package.json

@@ -0,0 +1,15 @@
+{
+  "name": "@ekklesia/consumer",
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {
+    "@ekklesia/conditional": "workspace:*",
+    "@ekklesia/contracts": "workspace:*"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "shared"
+  }
+}

tests/fixtures/boundaries/legal/packages/consumer/src/index.ts

@@ -0,0 +1,9 @@
+import type { HealthContract } from "@ekklesia/contracts";
+import { conditional } from "@ekklesia/conditional";
+import {
+  publicValue,
+} from "@ekklesia/contracts/public/value";
+
+export const health: HealthContract = { status: "ok" };
+export { conditional };
+export { publicValue };

tests/fixtures/boundaries/legal/packages/contracts/package.json

@@ -3,7 +3,8 @@
   "version": "0.0.0",
   "type": "module",
   "exports": {
-    ".": "./src/index.ts"
+    ".": "./src/index.ts",
+    "./public/*": "./src/public/*.ts"
   },
   "ekklesia": {
     "layer": "contracts"

tests/fixtures/boundaries/legal/packages/contracts/src/public/value.ts

@@ -0,0 +1 @@
+export const publicValue = "public";

tests/fixtures/boundaries/module-has-ui/modules/calendar/src/view.ASTRO

@@ -0,0 +1 @@
+<main>Modules do not own UI.</main>

tests/fixtures/boundaries/module-imports-core/core/src/index.ts

@@ -0,0 +1 @@
+export const core = "core";

tests/fixtures/boundaries/module-imports-core/modules/calendar/src/index.ts

@@ -0,0 +1,3 @@
+import { core } from "../../../core/src/index.js";
+
+export const invalidCoreImport = core;

tests/fixtures/boundaries/module-imports-ui-package/modules/calendar/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/module-calendar",
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {
+    "@ekklesia/ui": "workspace:*"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}

tests/fixtures/boundaries/module-imports-ui-package/modules/calendar/src/index.ts

@@ -0,0 +1,3 @@
+import { button } from "@ekklesia/ui";
+
+export const invalidModuleUiDependency = button;

tests/fixtures/boundaries/module-imports-ui-package/packages/ui/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/ui",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "ui"
+  }
+}

tests/fixtures/boundaries/module-imports-ui-package/packages/ui/src/index.ts

@@ -0,0 +1 @@
+export const button = "button";

tests/fixtures/boundaries/module-ui-framework/modules/calendar/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@ekklesia/module-calendar",
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {
+    "compat": "npm:[email protected]",
+    "preact": "10.27.2"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}

tests/fixtures/boundaries/module-ui-framework/modules/calendar/src/index.ts

@@ -0,0 +1,3 @@
+import { h } from "preact";
+
+export const invalidUiFramework = h;

tests/fixtures/boundaries/module-ui-framework/modules/calendar/src/view.mdx

@@ -0,0 +1 @@
+# Modules do not own views

tests/fixtures/boundaries/non-workspace-version/core/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@ekklesia/core",
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {
+    "@ekklesia/contracts": "^1.0.0"
+  },
+  "devDependencies": {
+    "@ekklesia/testing": "1.0.0"
+  },
+  "optionalDependencies": {
+    "@ekklesia/module-sdk": "~1.0.0"
+  },
+  "peerDependencies": {
+    "@ekklesia/surface-sdk": ">=1.0.0"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}

tests/fixtures/boundaries/non-workspace-version/core/src/index.ts

@@ -0,0 +1 @@
+export const core = "core";

tests/fixtures/boundaries/non-workspace-version/packages/contracts/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/contracts",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "contracts"
+  }
+}

tests/fixtures/boundaries/non-workspace-version/packages/contracts/src/index.ts

@@ -0,0 +1 @@
+export const contract = "contract";

tests/fixtures/boundaries/non-workspace-version/packages/module-sdk/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/module-sdk",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "module-sdk"
+  }
+}

tests/fixtures/boundaries/non-workspace-version/packages/module-sdk/src/index.ts

@@ -0,0 +1 @@
+export const moduleSdk = "module-sdk";

tests/fixtures/boundaries/non-workspace-version/packages/surface-sdk/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/surface-sdk",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "surface-sdk"
+  }
+}

tests/fixtures/boundaries/non-workspace-version/packages/surface-sdk/src/index.ts

@@ -0,0 +1 @@
+export const surfaceSdk = "surface-sdk";

tests/fixtures/boundaries/non-workspace-version/packages/testing/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/testing",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "testing"
+  }
+}

tests/fixtures/boundaries/non-workspace-version/packages/testing/src/index.ts

@@ -0,0 +1 @@
+export const testing = "testing";

tests/fixtures/boundaries/package-boundary-direction/modules/calendar/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/module-calendar",
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {
+    "@ekklesia/surface-dashboard": "workspace:*"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}

tests/fixtures/boundaries/package-boundary-direction/modules/calendar/src/index.ts

@@ -0,0 +1 @@
+export const calendar = "calendar";

tests/fixtures/boundaries/package-boundary-direction/surfaces/dashboard/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "@ekklesia/surface-dashboard",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}

tests/fixtures/boundaries/package-boundary-direction/surfaces/dashboard/src/index.ts

@@ -0,0 +1 @@
+export const dashboard = "dashboard";

tests/fixtures/boundaries/package-cycle/packages/one/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@ekklesia/one",
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {
+    "@ekklesia/two": "workspace:*"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "shared"
+  }
+}

tests/fixtures/boundaries/package-cycle/packages/one/src/index.ts

@@ -0,0 +1 @@
+export const one = 1;

tests/fixtures/boundaries/package-cycle/packages/two/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "@ekklesia/two",
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {
+    "@ekklesia/one": "workspace:*"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "shared"
+  }
+}

tests/fixtures/boundaries/package-cycle/packages/two/src/index.ts

@@ -0,0 +1 @@
+export const two = 2;

tests/fixtures/boundaries/package-without-exports/core/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/core",
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {
+    "@ekklesia/contracts": "workspace:*"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}

tests/fixtures/boundaries/package-without-exports/core/src/index.ts

@@ -0,0 +1,3 @@
+import { contract } from "@ekklesia/contracts";
+
+export const invalidImport = contract;

tests/fixtures/boundaries/package-without-exports/packages/contracts/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "@ekklesia/contracts",
+  "version": "0.0.0",
+  "type": "module",
+  "ekklesia": {
+    "layer": "contracts"
+  }
+}

tests/fixtures/boundaries/package-without-exports/packages/contracts/src/index.ts

@@ -0,0 +1 @@
+export const contract = "contract";

tests/fixtures/boundaries/private-package-import/core/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/core",
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {
+    "@ekklesia/contracts": "workspace:*"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}

tests/fixtures/boundaries/private-package-import/core/src/index.ts

@@ -0,0 +1,3 @@
+import { privateValue } from "@ekklesia/contracts/abcdzz";
+
+export const invalidPrivateImport = privateValue;

tests/fixtures/boundaries/private-package-import/packages/contracts/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "@ekklesia/contracts",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./a*cdzz": "./src/index.ts",
+    "./ab*zz": null
+  },
+  "ekklesia": {
+    "layer": "contracts"
+  }
+}

tests/fixtures/boundaries/private-package-import/packages/contracts/src/index.ts

@@ -0,0 +1 @@
+export const privateValue = "private";

tests/fixtures/boundaries/sdk-imports-core/core/src/index.ts

@@ -0,0 +1 @@
+export const core = "core";

tests/fixtures/boundaries/sdk-imports-core/packages/module-sdk/src/index.ts

@@ -0,0 +1,3 @@
+import { core } from "../../../core/src/index.js";
+
+export const invalidSdk = core;

tests/fixtures/boundaries/shared-role-order/packages/contracts/src/index.ts

@@ -0,0 +1,3 @@
+import { moduleSdk } from "../../module-sdk/src/index.js";
+
+export const invalidContractDependency = moduleSdk;

tests/fixtures/boundaries/shared-role-order/packages/module-sdk/src/index.ts

@@ -0,0 +1,3 @@
+import { surfaceSdk } from "../../surface-sdk/src/index.js";
+
+export const moduleSdk = surfaceSdk;

tests/fixtures/boundaries/shared-role-order/packages/surface-sdk/src/index.ts

@@ -0,0 +1 @@
+export const surfaceSdk = "surface-sdk";

tests/fixtures/boundaries/surface-imports-module/modules/calendar/src/index.ts

@@ -0,0 +1 @@
+export const calendar = "calendar";

tests/fixtures/boundaries/surface-imports-module/surfaces/dashboard/src/index.ts

@@ -0,0 +1,3 @@
+import { calendar } from "../../../modules/calendar/src/index.js";
+
+export const invalidSurfaceFeature = calendar;

tests/fixtures/boundaries/undeclared-workspace-dependency/packages/consumer/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/consumer",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "shared"
+  }
+}

tests/fixtures/boundaries/undeclared-workspace-dependency/packages/consumer/src/index.ts

@@ -0,0 +1,3 @@
+import { contract } from "@ekklesia/contracts";
+
+export const invalidUndeclaredDependency = contract;

tests/fixtures/boundaries/undeclared-workspace-dependency/packages/contracts/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/contracts",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "contracts"
+  }
+}

tests/fixtures/boundaries/undeclared-workspace-dependency/packages/contracts/src/index.ts

@@ -0,0 +1 @@
+export const contract = "contract";

tests/fixtures/boundaries/unknown-shared-role/packages/mystery/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/mystery",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "mystery"
+  }
+}

tests/fixtures/boundaries/unknown-shared-role/packages/mystery/src/index.ts

@@ -0,0 +1 @@
+export const mystery = "mystery";

tests/fixtures/boundaries/workspace-alias/modules/calendar/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "@ekklesia/module-calendar",
+  "version": "0.0.0",
+  "type": "module",
+  "dependencies": {
+    "@ekklesia/contracts": "workspace:@ekklesia/surface-dashboard@*",
+    "dashboard-data": "workspace:@ekklesia/surface-dashboard@*"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}

tests/fixtures/boundaries/workspace-alias/modules/calendar/src/index.ts

@@ -0,0 +1,4 @@
+import { dashboard } from "dashboard-data";
+import { hiddenDashboard } from "@ekklesia/contracts";
+
+export const invalidAlias = [dashboard, hiddenDashboard];

tests/fixtures/boundaries/workspace-alias/packages/contracts/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/contracts",
+  "version": "0.0.0",
+  "type": "module",
+  "ekklesia": {
+    "layer": "contracts"
+  },
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}

tests/fixtures/boundaries/workspace-alias/packages/contracts/src/index.ts

@@ -0,0 +1 @@
+export const hiddenDashboard = "contracts";

tests/fixtures/boundaries/workspace-alias/surfaces/dashboard/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "@ekklesia/surface-dashboard",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  }
+}

tests/fixtures/boundaries/workspace-alias/surfaces/dashboard/src/index.ts

@@ -0,0 +1 @@
+export const dashboard = "dashboard";

tests/fixtures/boundaries/workspace-exclusion/packages/excluded/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "@ekklesia/included",
+  "version": "0.0.0",
+  "type": "module"
+}

tests/fixtures/boundaries/workspace-exclusion/packages/excluded/src/index.ts

@@ -0,0 +1 @@
+export const excluded = true;

tests/fixtures/boundaries/workspace-exclusion/packages/included/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/included",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "tooling"
+  }
+}

tests/fixtures/boundaries/workspace-exclusion/packages/included/src/index.ts

@@ -0,0 +1 @@
+export const included = true;

tests/fixtures/boundaries/workspace-exclusion/pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+packages:
+  - "packages/*"
+  - "!packages/excluded"

tests/fixtures/boundaries/workspace-unsupported-pattern/packages/example/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ekklesia/example",
+  "version": "0.0.0",
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "ekklesia": {
+    "layer": "tooling"
+  }
+}

tests/fixtures/boundaries/workspace-unsupported-pattern/packages/example/src/index.ts

@@ -0,0 +1 @@
+export const example = true;

tests/fixtures/boundaries/workspace-unsupported-pattern/pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+packages:
+  - "packages/{example,other}"

tests/infrastructure.test.ts

@@ -5,6 +5,7 @@ import { describe, expect, it } from "vitest";
 import { parse } from "yaml";
 
 interface ComposeService {
+  environment?: Record<string, string>;
   healthcheck?: unknown;
   image?: string;
   ports?: string[];
@@ -16,6 +17,18 @@ interface ComposeDocument {
   volumes?: Record<string, unknown>;
 }
 
+interface PackageDocument {
+  scripts?: Record<string, string>;
+}
+
+interface TurboDocument {
+  tasks?: Record<string, unknown>;
+}
+
+interface WorkspaceDocument {
+  packages?: string[];
+}
+
 const repositoryRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
 describe("development infrastructure", () => {
@@ -32,6 +45,7 @@ describe("development infrastructure", () => {
     expect(objectStorage?.image).toBe("chrislusf/seaweedfs:4.28");
     expect(postgres?.healthcheck).toBeDefined();
     expect(objectStorage?.healthcheck).toBeDefined();
+    expect(postgres?.environment?.POSTGRES_INITDB_ARGS).toContain("--auth-host=scram-sha-256");
 
     for (const service of [postgres, objectStorage]) {
       expect(service).toBeDefined();
@@ -44,18 +58,47 @@ describe("development infrastructure", () => {
     expect(compose.volumes).toHaveProperty("object-storage-data");
   });
 
-  it("has a parseable CI workflow with a single repository gate", async () => {
+  it("has a parseable CI workflow with static and live infrastructure gates", async () => {
     const source = await readFile(
       path.join(repositoryRoot, ".github", "workflows", "ci.yml"),
       "utf8",
     );
     const workflow = parse(source) as {
-      jobs?: { verify?: { steps?: Array<{ run?: string }> } };
+      jobs?: {
+        "infrastructure-smoke"?: { steps?: Array<{ run?: string }> };
+        verify?: { steps?: Array<{ run?: string }> };
+      };
     };
     const commands = workflow.jobs?.verify?.steps?.flatMap((step) => step.run ?? []) ?? [];
+    const infrastructureCommands =
+      workflow.jobs?.["infrastructure-smoke"]?.steps?.flatMap((step) => step.run ?? []) ?? [];
 
     expect(workflow.jobs?.verify).toBeDefined();
     expect(commands).toContain("pnpm install --frozen-lockfile");
     expect(commands).toContain("pnpm ci");
+    expect(infrastructureCommands).toContain("bash scripts/smoke-infrastructure.sh");
+  });
+
+  it("includes every official platform layer in the workspace", async () => {
+    const source = await readFile(path.join(repositoryRoot, "pnpm-workspace.yaml"), "utf8");
+    const workspace = parse(source) as WorkspaceDocument;
+
+    expect(workspace.packages).toEqual(
+      expect.arrayContaining(["apps/*", "builders/*", "core", "modules/*", "surfaces/*"]),
+    );
+  });
+
+  it("dispatches root and future package quality tasks through Turborepo", async () => {
+    const packageSource = await readFile(path.join(repositoryRoot, "package.json"), "utf8");
+    const turboSource = await readFile(path.join(repositoryRoot, "turbo.json"), "utf8");
+    const packageDocument = JSON.parse(packageSource) as PackageDocument;
+    const turboDocument = JSON.parse(turboSource) as TurboDocument;
+
+    expect(packageDocument.scripts?.lint).toBe("turbo run lint lint:root");
+    expect(packageDocument.scripts?.test).toBe("turbo run test test:root");
+    expect(packageDocument.scripts?.typecheck).toBe("turbo run typecheck typecheck:root");
+    expect(turboDocument.tasks).toHaveProperty("//#lint:root");
+    expect(turboDocument.tasks).toHaveProperty("//#test:root");
+    expect(turboDocument.tasks).toHaveProperty("//#typecheck:root");
   });
 });