@skyf0xx/hedgehog 4.1.0 → 4.2.2

package/src/golden-cores/full-stack-app/packages/config/eslint-base.js

@@ -7,6 +7,15 @@ import nx from '@nx/eslint-plugin';
  * `.claude/skills/hedgehog-bootstrap` and `.claude/skills/hedgehog-loop`
  * for the discipline this enforces.
  *
+ * The constraints below describe the project shape `core.yaml`'s compiled
+ * layer sequence actually produces. One layer, `repository`, lands a
+ * module's port interface AND its Drizzle adapter in the same lib
+ * (`libs/<module>/repository`, tagged `type:adapter`) — there is no
+ * separate `type:port` project, so a tag constraint alone cannot say
+ * "import the interface, not the concrete class." The
+ * `no-restricted-imports` block below carries that half of port
+ * discipline; the tag graph carries the rest.
+ *
  * Tag reference:
  *   apps/api             -> scope:api
  *   apps/worker           -> scope:worker
@@ -18,7 +27,6 @@ import nx from '@nx/eslint-plugin';
  *   packages/auth         -> scope:auth,      type:adapter
  *   packages/config       -> scope:config,    type:util
  *   packages/shared       -> scope:shared,    type:util
- *   libs/<module>/port       -> scope:<module>, type:port
  *   libs/<module>/repository -> scope:<module>, type:adapter
  *   libs/<module>/service    -> scope:<module>, type:service
  */
@@ -42,20 +50,49 @@ export default [
       '@nx/enforce-module-boundaries': [
         'error',
         {
-          enforceBuildableLibDependency: true,
+          // `false`, not `true`: `packages/contracts` and `packages/hooks`
+          // are source-only by this core's design — they have no `build`
+          // target and are consumed as TypeScript sources. With this on,
+          // `apps/web` (a real Next build target) importing either one
+          // fails lint purely for that structural choice, not for any
+          // dependency that's actually wrong.
+          enforceBuildableLibDependency: false,
           allow: ['^.*/eslint(\\.base)?\\.config\\.[cm]?[jt]s$'],
           depConstraints: [
-            // domain services never import adapters directly — only ports
+            // domain services reach storage through their own module's
+            // repository lib, which holds the port interface alongside the
+            // Drizzle adapter (`type:adapter`). Which symbol a service may
+            // import out of that lib is the no-restricted-imports rule
+            // below, not something a tag can express.
             {
               sourceTag: 'type:service',
-              onlyDependOnLibsWithTags: ['type:port', 'type:util'],
+              onlyDependOnLibsWithTags: [
+                'type:adapter',
+                'type:contract',
+                'type:util',
+              ],
             },
-            // adapters (repositories, db client, auth config) may depend on
-            // shared utils only — never reach across into another module's
-            // service/port
+            // adapters (repositories, db client, auth config) depend on
+            // packages/db and shared utils — never reach across into
+            // another module's service
             {
               sourceTag: 'type:adapter',
-              onlyDependOnLibsWithTags: ['type:util'],
+              onlyDependOnLibsWithTags: [
+                'type:adapter',
+                'type:contract',
+                'type:util',
+              ],
+            },
+            // the ts-rest/Zod contract is derived from the Drizzle schema
+            // (`drizzle-zod`), so it reaches packages/db and nothing else
+            {
+              sourceTag: 'type:contract',
+              onlyDependOnLibsWithTags: ['type:adapter', 'type:util'],
+            },
+            // TanStack Query hooks are typed by the contract they call
+            {
+              sourceTag: 'type:hook',
+              onlyDependOnLibsWithTags: ['type:contract', 'type:util'],
             },
             // shared utils (packages/config, packages/shared) depend on
             // nothing else in the workspace — they're the floor
@@ -81,24 +118,32 @@ export default [
                 'scope:contracts',
                 'scope:hooks',
                 'scope:shared',
+                'type:util',
               ],
             },
-            // worker only reaches domain logic through ports, same as api
+            // worker reaches domain logic the same way api does
             {
               sourceTag: 'scope:worker',
               onlyDependOnLibsWithTags: [
-                'type:port',
+                'type:adapter',
+                'type:service',
+                'type:contract',
                 'type:util',
                 'scope:shared',
               ],
             },
-            // api reaches storage/domain logic through a module's port/service
-            // only — never packages/db directly
+            // api is the composition root: its NestJS module is the only
+            // place that constructs a module's concrete adapter and binds
+            // it to the port's DI token, so it reaches `type:adapter` by
+            // necessity. It also serves the ts-rest contract, hence
+            // `type:contract`. What it may NOT do is inject an adapter
+            // into a controller — that's the no-restricted-imports rule.
             {
               sourceTag: 'scope:api',
               onlyDependOnLibsWithTags: [
-                'type:port',
+                'type:adapter',
                 'type:service',
+                'type:contract',
                 'type:util',
               ],
             },
@@ -107,4 +152,54 @@ export default [
       ],
     },
   },
+  {
+    // Port discipline, the half tags can't express. A module's port
+    // interface and its Drizzle adapter live in the same lib, so
+    // `type:service -> type:adapter` has to be allowed above; this is what
+    // stops a service from importing the concrete adapter through it.
+    // Services see the port only. Deep paths are named rather than the
+    // package entry point, because the entry point is also how the port
+    // itself is imported.
+    files: ['libs/*/service/**/*.ts'],
+    rules: {
+      'no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              group: ['**/*.adapter', '**/*.adapter.js', '**/*.adapter.ts'],
+              message:
+                'A service depends on its module\'s port interface, never the concrete adapter. Import the port from the repository lib\'s entry point and let apps/api bind the adapter to its DI token.',
+            },
+            {
+              group: ['@app/db', '@app/db/*', 'db', 'db/*', 'drizzle-orm', 'drizzle-orm/*'],
+              message:
+                'A service never talks to the database directly — that is the repository adapter\'s job, reached through the port.',
+            },
+          ],
+        },
+      ],
+    },
+  },
+  {
+    // The same rule one layer up, minus the composition root. A NestJS
+    // module file (`*.module.ts`) is where the adapter is constructed and
+    // bound, so it is exempt; a controller injecting an adapter is not.
+    files: ['apps/api/**/*.ts'],
+    ignores: ['apps/api/**/*.module.ts'],
+    rules: {
+      'no-restricted-imports': [
+        'error',
+        {
+          patterns: [
+            {
+              group: ['**/*.adapter', '**/*.adapter.js', '**/*.adapter.ts'],
+              message:
+                'Only a NestJS module (*.module.ts) constructs a concrete adapter. A controller depends on the service, or on the port token the module bound.',
+            },
+          ],
+        },
+      ],
+    },
+  },
 ];

package/src/golden-cores/full-stack-app/packages/config/src/env.schema.spec.ts

@@ -1,4 +1,4 @@
-import { envSchema } from './env.schema.js';
+import { envSchema } from './env.schema';
 
 describe('envSchema', () => {
   const valid = {
@@ -22,4 +22,17 @@ describe('envSchema', () => {
     const result = envSchema.safeParse({ ...valid, NODE_ENV: 'staging' });
     expect(result.success).toBe(false);
   });
+
+  it('defaults WEB_ORIGIN when absent', () => {
+    const result = envSchema.safeParse(valid);
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.WEB_ORIGIN).toBe('http://localhost:3000');
+    }
+  });
+
+  it('rejects a non-URL WEB_ORIGIN', () => {
+    const result = envSchema.safeParse({ ...valid, WEB_ORIGIN: 'not-a-url' });
+    expect(result.success).toBe(false);
+  });
 });

package/src/golden-cores/full-stack-app/packages/config/src/env.schema.ts

@@ -3,6 +3,7 @@ import { z } from 'zod';
 export const envSchema = z.object({
   DATABASE_URL: z.string().url(),
   NODE_ENV: z.enum(['development', 'test', 'production']),
+  WEB_ORIGIN: z.string().url().default('http://localhost:3000'),
 });
 
 export type Env = z.infer<typeof envSchema>;

package/src/golden-cores/full-stack-app/packages/config/src/index.ts

@@ -1 +1 @@
-export * from './env.schema.js';
+export * from './env.schema';

package/src/golden-cores/full-stack-app/packages/db/src/index.ts

@@ -1 +1,2 @@
-export * from './lib/db.js';
+export * from './lib/db';
+export * from './schema/index';

package/src/golden-cores/full-stack-app/packages/db/src/lib/db.spec.ts

@@ -15,7 +15,7 @@ describe('db', () => {
   });
 
   it('lazily constructs a single shared pool', async () => {
-    const { getPool, closeDb } = await import('./db.js');
+    const { getPool, closeDb } = await import('./db');
     const first = getPool();
     const second = getPool();
     expect(first).toBe(second);
@@ -23,7 +23,7 @@ describe('db', () => {
   });
 
   it('returns a drizzle client bound to the shared pool', async () => {
-    const { getDb, closeDb } = await import('./db.js');
+    const { getDb, closeDb } = await import('./db');
     const db = getDb();
     expect(db).toBeDefined();
     await closeDb();
@@ -38,7 +38,7 @@ describe('db', () => {
       .spyOn(console, 'error')
       .mockImplementation(() => undefined);
 
-    const { getPool } = await import('./db.js');
+    const { getPool } = await import('./db');
     expect(() => getPool()).toThrow('process.exit called');
     expect(exitSpy).toHaveBeenCalledWith(1);
 

package/src/golden-cores/full-stack-app/packages/db/src/schema/index.ts

@@ -0,0 +1,4 @@
+// Barrel-of-barrels: one re-export line per module, added by that module's
+// own schema layer (in scope — see core.yaml's schema layer). Keeps
+// packages/db/src/index.ts itself static after bootstrap.
+export {};