@opengroundplan/core 0.1.1

package/templates/architectures/microservices/files/docs/architecture/microservices.go.md

@@ -0,0 +1,77 @@
+# Architecture — Microservices (Go)
+
+Two or more independently deployable services, each owning a bounded context **and its own
+datastore**, aligned to a team. `go build ./services/...` produces one binary per service.
+
+## The one rule that matters
+
+> **No service imports another service's source.** The only packages allowed to cross a
+> boundary live under `contracts/`. Everything else goes over the network.
+
+The moment one service imports another's code, you have a distributed monolith: two deploy
+pipelines that must ship together, with the latency of a network in between and none of the
+autonomy you paid for.
+
+## Layout
+
+```
+services/
+  {{ firstService | lower }}/                       # one folder per independently deployable service
+    main.go                     # package main — this service's binary
+    Dockerfile                  # per-service image, built from the repo root
+    internal/
+      config/config.go          # this service's only reader of the environment
+contracts/
+  {{ firstService | lower }}/                       # published contract — the only cross-boundary code
+    contract.go                 #   message shapes, route names, topic, ContractVersion
+internal/
+  architecture/
+    boundary_test.go            # fails `go test ./...` on a cross-service import
+```
+
+Package names use `lower`, not `kebab`: a Go package identifier cannot contain a hyphen.
+
+## How services talk
+
+- **Ask for data:** HTTP or gRPC to `config.PeerURL("billing")`, which reads
+  `SERVICE_URL_BILLING`. A peer's address is configuration at run time, never an import at
+  build time.
+- **Announce a fact:** publish on the contract's `ChangedTopic`. Consumers subscribe without
+  the publisher knowing they exist.
+- **Share a type:** add it to the contract package and bump `ContractVersion`.
+
+Across a service boundary you get BASE, not ACID — plan for compensation and eventual
+consistency rather than discovering them in production.
+
+## Enforcement
+
+Two gates, one of them unbypassable:
+
+- **`go build ./...`** — `services/{{ firstService | lower }}/internal/...` can be imported only by packages
+  under `services/{{ firstService | lower }}/`. That is a language guarantee, not a convention, and it is a
+  **compile error** for any other service.
+- **`go test ./internal/architecture/`** — `boundary_test.go` is stricter than the compiler:
+  it forbids a service from importing *any* package of another service, not just its
+  internals, and forbids a contract from depending on a service. It reads the module path from
+  `go.mod`, so nothing is hardcoded, and `TestBoundaryRuleStillDetectsAViolation` asserts the
+  rule still fires against six known cases so a refactor cannot silently neuter it.
+
+Code outside every service (`cmd/`, a tool, a test) may reference a service — only
+service-to-service coupling is a violation.
+
+## What is not enforced mechanically
+
+- **Root-level `internal/` is shared by every service.** The Go base ships packages there and
+  the boundary test does not forbid using them. That shared code is a coupling point: anything
+  you put in it must be released with every service that depends on it. Keep it to genuinely
+  generic helpers, or move it into a contract.
+- **One datastore per service.** Nothing here can see your connection strings, and it is the
+  defining constraint of the style. Two services sharing a schema are one service with two
+  deployments.
+- **Chattiness.** A→B→C latency chains are the coupling symptom Azure names, and no import
+  check detects them. Watch traces, not imports.
+
+Sources: [Fowler & Lewis — Microservices](https://martinfowler.com/articles/microservices.html) ·
+[MicroservicePrerequisites](https://martinfowler.com/bliki/MicroservicePrerequisites.html) ·
+[Azure — Microservices architecture style](https://learn.microsoft.com/en-us/azure/architecture/guide/architecture-styles/microservices) ·
+[Go internal packages](https://go.dev/doc/go1.4#internalpackages).

package/templates/architectures/microservices/files/docs/architecture/microservices.node.md

@@ -0,0 +1,88 @@
+# Architecture — Microservices (Node / TypeScript)
+
+Two or more independently deployable services, each owning a bounded context **and its own
+datastore**, aligned to a team. One folder per service, one shared folder of published
+contracts, one deployment artifact per service.
+
+## The one rule that matters
+
+> **No service imports another service's source.** The only code allowed to cross a boundary
+> is a package published under `contracts/`, consumed by name like any other dependency.
+> Everything else goes over the network.
+
+The moment one service imports another's code, you have a distributed monolith: two deploy
+pipelines that must ship together, with the latency of a network in between and none of the
+autonomy you paid for. That is the failure the check below exists to prevent.
+
+## Layout
+
+```
+services/
+  {{ firstService | kebab }}/                     # one folder per independently deployable service
+    package.json                # its own manifest and dependencies
+    Dockerfile                  # per-service image, built from the repo root
+    src/
+      config.ts                 # this service's only reader of process.env
+      index.ts                  # composition root
+contracts/
+  {{ firstService | kebab }}/                     # published contract — the only cross-boundary code
+    package.json                #   @{{ solutionName | kebab }}/contract-{{ firstService | kebab }}
+    src/index.ts                #   message shapes, route names, topic names, version
+scripts/
+  check-service-boundaries.mjs  # fails the build on a cross-service import
+```
+
+`workspaces: ["services/*", "contracts/*"]` in the root `package.json` is what makes a contract
+resolvable by package name. On pnpm, mirror those globs in `pnpm-workspace.yaml` — pnpm ignores
+the `workspaces` field.
+
+## How services talk
+
+- **Ask for data:** HTTP or gRPC to `peerUrl('billing')`, which reads `SERVICE_URL_BILLING`
+  from the environment. A peer's address is configuration at run time, never an import at
+  build time.
+- **Announce a fact:** publish on the contract's topic (`CHANGED_TOPIC`). Consumers subscribe
+  without the publisher knowing they exist.
+- **Share a type:** add it to the contract package and bump `CONTRACT_VERSION`. Callers deploy
+  on their own schedule and must be able to pin.
+
+There is no distributed transaction here. Across a service boundary you get BASE, not ACID —
+plan for compensation and eventual consistency rather than discovering them in production.
+
+## Enforcement
+
+```bash
+npm run check:services      # scripts/check-service-boundaries.mjs
+```
+
+Exits non-zero — wire it into `lint` and into CI. It fails on four things:
+
+| Violation | Message |
+|---|---|
+| `services/a` imports `services/b` by relative path | *b is a separate deployable; call it over the network* |
+| `services/a` imports service b's **package name** | same |
+| `services/a` reaches a contract by relative path | *reach a contract by package name, not by relative path* |
+| `contracts/*` imports anything under `services/` | *a contract must not depend on a service* |
+
+The rule itself is self-tested: the script asserts it still detects seven known cases before it
+inspects your code, so a refactor that neuters the check fails loudly instead of passing
+silently. `node scripts/check-service-boundaries.mjs --self-test` runs just that part. Finding
+no services at all is also a failure, not a pass.
+
+Code **outside** every service (a launcher, an integration test, a script) may reference a
+service — only service-to-service coupling is a violation.
+
+## What is not enforced mechanically
+
+- **One datastore per service.** Nothing here can see your connection strings. It is the
+  defining constraint of the style and it is on you: two services sharing a schema are one
+  service with two deployments.
+- **Chattiness.** A→B→C latency chains are the coupling symptom Azure names, and no import
+  check detects them. Watch traces, not imports.
+- **Contract compatibility.** `CONTRACT_VERSION` is a convention; add consumer-driven contract
+  tests if you need it verified.
+
+Sources: [Fowler & Lewis — Microservices](https://martinfowler.com/articles/microservices.html) ·
+[MicroservicePrerequisites](https://martinfowler.com/bliki/MicroservicePrerequisites.html) ·
+[Azure — Microservices architecture style](https://learn.microsoft.com/en-us/azure/architecture/guide/architecture-styles/microservices) ·
+[Segment — Goodbye Microservices](https://www.twilio.com/en-us/blog/developers/best-practices/goodbye-microservices).

package/templates/architectures/microservices/files/docs/architecture/microservices.python.md

@@ -0,0 +1,92 @@
+# Architecture — Microservices (Python)
+
+Two or more independently deployable services, each owning a bounded context **and its own
+datastore**, aligned to a team. One sub-package per service, one shared contracts package, one
+deployment artifact per service.
+
+## The one rule that matters
+
+> **No service imports another service's source.** The only importable shared code is
+> `{{ solutionName | snake }}.contracts`. Everything else goes over the network.
+
+The moment one service imports another's code, you have a distributed monolith: two deploy
+pipelines that must ship together, with the latency of a network in between and none of the
+autonomy you paid for.
+
+## Layout
+
+```
+src/{{ solutionName | snake }}/
+  services/
+    {{ firstService | snake }}/                     # one sub-package per independently deployable service
+      config.py                 # this service's only reader of os.environ
+      service.py                # implementation — private to this package
+  contracts/
+    {{ firstService | snake }}/                     # published contract — the only cross-boundary code
+      __init__.py               #   dataclasses, route names, topic, CONTRACT_VERSION
+deploy/
+  {{ firstService | kebab }}/
+    Dockerfile                  # per-service image, built from the repo root
+tests/architecture/
+  test_service_boundaries.py    # fails pytest on a cross-service import
+.importlinter                   # `lint-imports` contracts
+```
+
+The Dockerfiles live under `deploy/` rather than beside the service: a src-layout package
+directory is not a place a Dockerfile can sensibly sit.
+
+## How services talk
+
+- **Ask for data:** HTTP or gRPC to `peer_url("billing")`, which reads `SERVICE_URL_BILLING`.
+  A peer's address is configuration at run time, never an import at build time.
+- **Announce a fact:** publish on the contract's `CHANGED_TOPIC`. Consumers subscribe without
+  the publisher knowing they exist.
+- **Share a type:** add it to the contract package and bump `CONTRACT_VERSION`.
+
+Across a service boundary you get BASE, not ACID — plan for compensation and eventual
+consistency rather than discovering them in production.
+
+## Enforcement
+
+Two gates, deliberately overlapping:
+
+```bash
+pytest tests/architecture/          # the generic rule, no per-service upkeep
+lint-imports                        # import-linter contracts
+```
+
+`tests/architecture/test_service_boundaries.py` walks every import in `src/` and fails on:
+
+| Violation | Message |
+|---|---|
+| `…services.a` imports `…services.b` | *b is a separate deployable — call it over the network* |
+| `…contracts.*` imports `…services.*` | *a contract must not depend on a service* |
+
+It also runs standalone (`python tests/architecture/test_service_boundaries.py`), so a repo
+without the test layer still has the guard, and `test_the_rule_still_detects_a_violation`
+asserts the rule fires against five known cases so a refactor cannot silently neuter it.
+
+`.importlinter` states the same boundaries in the standard tool: a `forbidden` contract keeps
+contracts below services, and an `independence` contract proves services never couple in
+either direction. **The independence contract needs one line per service** — add each new
+service to it. The pytest fitness test is what covers you between those edits.
+
+Code outside every service (an entrypoint, a test, a script) may reference a service — only
+service-to-service coupling is a violation.
+
+## What is not enforced mechanically
+
+- **One datastore per service.** Nothing here can see your connection strings, and it is the
+  defining constraint of the style. Two services sharing a schema are one service with two
+  deployments.
+- **Independent packaging.** These services share one distribution, so "independently
+  deployable" is true of the folder layout but not yet of the build. Split into per-service
+  `pyproject.toml` files, or per-service images that install only what they need, before
+  claiming deploy autonomy.
+- **Chattiness.** A→B→C latency chains are the coupling symptom Azure names, and no import
+  check detects them. Watch traces, not imports.
+
+Sources: [Fowler & Lewis — Microservices](https://martinfowler.com/articles/microservices.html) ·
+[MicroservicePrerequisites](https://martinfowler.com/bliki/MicroservicePrerequisites.html) ·
+[Azure — Microservices architecture style](https://learn.microsoft.com/en-us/azure/architecture/guide/architecture-styles/microservices) ·
+[import-linter contracts](https://import-linter.readthedocs.io/en/stable/contract_types.html).

package/templates/architectures/microservices/files/internal/architecture/boundary_test.go

@@ -0,0 +1,139 @@
+// Package architecture holds the microservices fitness test. Go's own internal/ rule already
+// fails the build when one service reaches into another's internals; this test is stricter and
+// forbids a service from importing *any* package of another service, plus forbids a contract
+// from depending on a service.
+package architecture
+
+import (
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// Path segments that name the two roots. Overridable, but the defaults match the layout.
+var (
+	servicesSegment  = envOr("ARCH_SERVICES_SEGMENT", "services")
+	contractsSegment = envOr("ARCH_CONTRACTS_SEGMENT", "contracts")
+)
+
+func envOr(key, fallback string) string {
+	if value := os.Getenv(key); value != "" {
+		return value
+	}
+	return fallback
+}
+
+// serviceOf returns the service owning an import path, or "" when the path is outside services.
+func serviceOf(importPath string) string {
+	marker := "/" + servicesSegment + "/"
+	index := strings.Index(importPath, marker)
+	if index < 0 {
+		return ""
+	}
+	return strings.SplitN(importPath[index+len(marker):], "/", 2)[0]
+}
+
+func inContracts(importPath string) bool {
+	marker := "/" + contractsSegment + "/"
+	return strings.Contains(importPath, marker) || strings.HasSuffix(importPath, "/"+contractsSegment)
+}
+
+// violation is the single rule, isolated so the self-test proves it still fires.
+func violation(fromPkg, imported string) string {
+	target := serviceOf(imported)
+	if target == "" {
+		return ""
+	}
+	if inContracts(fromPkg) {
+		return "a contract must not depend on a service: imports " + imported
+	}
+	// Code outside every service (a launcher, a tool, a test) may reference one; only
+	// service-to-service coupling is the failure this test exists to prevent.
+	source := serviceOf(fromPkg)
+	if source == "" || source == target {
+		return ""
+	}
+	return "cross-service source import: " + imported +
+		" (call " + target + " over the network, or share a type under " + contractsSegment + "/)"
+}
+
+func TestBoundaryRuleStillDetectsAViolation(t *testing.T) {
+	cases := []struct {
+		from, imported string
+		want           bool
+	}{
+		{"x/services/orders/internal/store", "x/services/billing/internal/store", true},
+		{"x/services/orders", "x/services/billing", true},
+		{"x/contracts/orders", "x/services/orders", true},
+		{"x/services/orders", "x/contracts/billing", false},
+		{"x/services/orders", "x/services/orders/internal/store", false},
+		{"x/cmd/tool", "x/services/orders", false},
+	}
+	for _, c := range cases {
+		if (violation(c.from, c.imported) != "") != c.want {
+			t.Fatalf("violation(%q, %q): want fail=%v", c.from, c.imported, c.want)
+		}
+	}
+}
+
+func TestNoServiceImportsAnotherServicesSource(t *testing.T) {
+	root, modulePath := repoRoot(t)
+	fset := token.NewFileSet()
+
+	var failures []string
+	err := filepath.WalkDir(root, func(path string, entry os.DirEntry, err error) error {
+		if err != nil || entry.IsDir() || !strings.HasSuffix(path, ".go") {
+			return err
+		}
+		rel, _ := filepath.Rel(root, filepath.Dir(path))
+		fromPkg := modulePath + "/" + filepath.ToSlash(rel)
+
+		file, err := parser.ParseFile(fset, path, nil, parser.ImportsOnly)
+		if err != nil {
+			return err
+		}
+		for _, spec := range file.Imports {
+			imported := strings.Trim(spec.Path.Value, `"`)
+			if message := violation(fromPkg, imported); message != "" {
+				failures = append(failures, fromPkg+": "+message)
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(failures) > 0 {
+		t.Fatalf("service boundary violations:\n%s", strings.Join(failures, "\n"))
+	}
+}
+
+var moduleLine = regexp.MustCompile(`(?m)^module\s+(\S+)`)
+
+// repoRoot walks up from the test's working directory to the go.mod, and returns its module path.
+func repoRoot(t *testing.T) (string, string) {
+	t.Helper()
+	dir, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for {
+		candidate := filepath.Join(dir, "go.mod")
+		if content, err := os.ReadFile(candidate); err == nil {
+			match := moduleLine.FindSubmatch(content)
+			if match == nil {
+				t.Fatalf("no module line in %s", candidate)
+			}
+			return dir, string(match[1])
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			t.Fatal("go.mod not found above the test directory")
+		}
+		dir = parent
+	}
+}

package/templates/architectures/microservices/files/package.json

@@ -0,0 +1,9 @@
+{
+  "workspaces": [
+    "services/*",
+    "contracts/*"
+  ],
+  "scripts": {
+    "check:services": "node scripts/check-service-boundaries.mjs"
+  }
+}

package/templates/architectures/microservices/files/pyproject.toml

@@ -0,0 +1,2 @@
+[dependency-groups]
+dev = ["import-linter==2.13"]

package/templates/architectures/microservices/files/scripts/check-service-boundaries.mjs

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+/**
+ * Architecture fitness test for microservices.
+ *
+ * One rule: no service imports another service's source. The only code allowed to cross a
+ * boundary is a package published under contracts/, consumed by name like any other
+ * dependency. Exits non-zero on a violation, so it belongs in `lint` and in CI, not a README.
+ *
+ * Import specifiers are read as written and never resolved on disk, so the check is immune to
+ * TypeScript/bundler resolution differences and works the same on .ts, .js and workspace code.
+ */
+import { readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+import process from 'node:process';
+
+/** Every tunable lives here. Nothing below reads the environment directly. */
+const config = {
+  serviceRoots: split(process.env.ARCH_SERVICE_ROOTS) ?? ['services', 'apps'],
+  contractRoots: split(process.env.ARCH_CONTRACT_ROOTS) ?? ['contracts'],
+  extensions: ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'],
+  skipDirs: ['node_modules', 'dist', 'build', 'out', 'coverage', '.git', '.turbo', '.next'],
+};
+
+function split(value) {
+  return value ? value.split(',').map((entry) => entry.trim()).filter(Boolean) : undefined;
+}
+
+const SPECIFIER_PATTERNS = [
+  /(?:^|[\s;}])(?:import|export)[^;]*?\sfrom\s*['"]([^'"]+)['"]/g,
+  /(?:^|[\s;}])import\s*['"]([^'"]+)['"]/g,
+  /\bimport\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+  /\brequire\s*\(\s*['"]([^'"]+)['"]\s*\)/g,
+];
+
+export function specifiersOf(source) {
+  const found = new Set();
+  for (const pattern of SPECIFIER_PATTERNS) {
+    pattern.lastIndex = 0;
+    for (const match of source.matchAll(pattern)) found.add(match[1]);
+  }
+  return [...found];
+}
+
+/** Longest matching directory from `dirs`, or null when the path is outside all of them. */
+export function ownerOf(filePath, dirs) {
+  return dirs.find((dir) => filePath === dir || filePath.startsWith(dir + '/')) ?? null;
+}
+
+/** A bare specifier resolves to whichever workspace package declared that name. */
+function packageDirOf(specifier, packages) {
+  const parts = specifier.split('/');
+  const root = specifier.startsWith('@') ? parts.slice(0, 2).join('/') : parts[0];
+  return packages.get(root) ?? null;
+}
+
+/** The single rule, isolated so `--self-test` can prove it still fires. */
+export function violationOf(fromFile, specifier, layout) {
+  const fromService = ownerOf(fromFile, layout.services);
+  const fromContract = ownerOf(fromFile, layout.contracts);
+
+  const target = specifier.startsWith('.')
+    ? path.posix.normalize(path.posix.join(path.posix.dirname(fromFile), specifier))
+    : packageDirOf(specifier, layout.packages);
+  if (target === null) return null;
+
+  const toService = ownerOf(target, layout.services);
+  const toContract = ownerOf(target, layout.contracts);
+
+  if (fromContract && toService) {
+    return `imports "${specifier}" — a contract must not depend on a service`;
+  }
+  // Code outside every service (a launcher, a test, a script) may reference one; only
+  // service-to-service coupling is the failure this check exists to prevent.
+  if (toService && fromService && toService !== fromService) {
+    return `imports "${specifier}" — ${toService} is a separate deployable; call it over the network`;
+  }
+  if (fromService && toContract && specifier.startsWith('.')) {
+    return `imports "${specifier}" — reach a contract by package name, not by relative path`;
+  }
+  return null;
+}
+
+async function listFiles(root) {
+  const found = [];
+  const walk = async (dir) => {
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const child = path.posix.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (!config.skipDirs.includes(entry.name)) await walk(child);
+      } else if (config.extensions.includes(path.extname(entry.name))) {
+        found.push(child);
+      }
+    }
+  };
+  await walk(root);
+  return found;
+}
+
+/** Immediate children of each root, plus the package name each one publishes. */
+async function discover(roots) {
+  const dirs = [];
+  const packages = new Map();
+
+  for (const root of roots) {
+    const entries = await readdir(root, { withFileTypes: true }).catch(() => []);
+    for (const entry of entries.filter((candidate) => candidate.isDirectory())) {
+      const dir = path.posix.join(root, entry.name);
+      dirs.push(dir);
+      const manifest = await readFile(path.posix.join(dir, 'package.json'), 'utf8').catch(() => null);
+      if (manifest === null) continue;
+      try {
+        const { name } = JSON.parse(manifest);
+        if (name) packages.set(name, dir);
+      } catch {
+        // A malformed manifest is npm's error to report, not this check's.
+      }
+    }
+  }
+  return { dirs, packages };
+}
+
+const SELF_TEST_LAYOUT = {
+  services: ['services/orders', 'services/billing'],
+  contracts: ['contracts/orders'],
+  packages: new Map([
+    ['@example/service-billing', 'services/billing'],
+    ['@example/contract-orders', 'contracts/orders'],
+  ]),
+};
+
+const SELF_TEST_CASES = [
+  ['services/orders/src/index.ts', '../../billing/src/repo.js', true],
+  ['services/orders/src/index.ts', '@example/service-billing', true],
+  ['services/orders/src/index.ts', '../../../contracts/orders/src/index.js', true],
+  ['contracts/orders/src/index.ts', '../../../services/orders/src/thing.js', true],
+  ['services/orders/src/index.ts', '@example/contract-orders', false],
+  ['services/orders/src/index.ts', './config.js', false],
+  ['scripts/dev.mjs', '../services/orders/src/index.js', false],
+];
+
+function selfTest() {
+  const wrong = SELF_TEST_CASES.filter(
+    ([file, specifier, expected]) =>
+      Boolean(violationOf(file, specifier, SELF_TEST_LAYOUT)) !== expected,
+  );
+  for (const [file, specifier] of wrong) console.error(`self-test failed: ${file} -> ${specifier}`);
+  return wrong.length === 0;
+}
+
+async function main() {
+  if (process.argv.includes('--self-test')) {
+    if (!selfTest()) process.exit(1);
+    console.log(`service boundary rule verified against ${SELF_TEST_CASES.length} cases`);
+    return;
+  }
+
+  const services = await discover(config.serviceRoots);
+  const contracts = await discover(config.contractRoots);
+  if (services.dirs.length === 0) {
+    // A silent pass over an empty file set is the failure mode this check exists to avoid.
+    console.error(`No services found under ${config.serviceRoots.join(', ')} — is ARCH_SERVICE_ROOTS right?`);
+    process.exit(1);
+  }
+
+  const layout = {
+    services: services.dirs,
+    contracts: contracts.dirs,
+    packages: new Map([...services.packages, ...contracts.packages]),
+  };
+
+  const roots = [...new Set([...config.serviceRoots, ...config.contractRoots, 'src', 'scripts'])];
+  const files = (await Promise.all(roots.map(listFiles))).flat();
+
+  const violations = [];
+  for (const file of [...new Set(files)]) {
+    const source = await readFile(file, 'utf8');
+    for (const specifier of specifiersOf(source)) {
+      const violation = violationOf(file, specifier, layout);
+      if (violation) violations.push(`${file}: ${violation}`);
+    }
+  }
+
+  if (violations.length > 0) {
+    console.error(`Service boundary violations (${violations.length}):\n` + violations.join('\n'));
+    process.exit(1);
+  }
+  console.log(`Service boundaries hold across ${layout.services.length} service(s), ${files.length} file(s).`);
+}
+
+if (!selfTest()) {
+  console.error('The boundary rule no longer detects a known violation — fix violationOf().');
+  process.exit(1);
+}
+await main();

package/templates/architectures/microservices/files/services/__firstService.kebab__/Dockerfile

@@ -0,0 +1,19 @@
+# Per-service image: one service, one image, one deploy. Build with the repo root as context
+#   docker build -f services/{{ firstService | kebab }}/Dockerfile .
+# so the workspace can resolve the contract package.
+ARG NODE_IMAGE=node:22-alpine
+
+FROM ${NODE_IMAGE} AS build
+WORKDIR /app
+COPY . .
+RUN npm ci --workspaces --include-workspace-root
+RUN {{ buildCommand }}
+
+FROM ${NODE_IMAGE} AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+COPY --from=build /app /app
+USER node
+# No EXPOSE and no port baked in: host, port and every peer URL come from the environment,
+# so the same image runs in every environment unchanged.
+CMD ["node", "services/{{ firstService | kebab }}/dist/index.js"]

package/templates/architectures/microservices/files/services/__firstService.kebab__/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "@{{ solutionName | kebab }}/service-{{ firstService | kebab }}",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@{{ solutionName | kebab }}/contract-{{ firstService | kebab }}": "*"
+  }
+}