create-react-admin-template 0.0.0-stage → 0.1.0

package/template/tests/unit/config/componentGovernance.test.mjs

@@ -0,0 +1,156 @@
+import assert from 'node:assert/strict'
+import { spawnSync } from 'node:child_process'
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+
+const strProjectRoot = path.resolve(import.meta.dirname, '../../..')
+const strGovernanceScript = path.resolve(
+  strProjectRoot,
+  'tools/component-governance/check.mjs'
+)
+
+const fnRunGovernance = (...arrArguments) =>
+  spawnSync(process.execPath, [strGovernanceScript, ...arrArguments], {
+    cwd: strProjectRoot,
+    encoding: 'utf8',
+  })
+
+const fnRunGit = (strDirectory, ...arrArguments) => {
+  const objResult = spawnSync('git', ['-C', strDirectory, ...arrArguments], {
+    encoding: 'utf8',
+  })
+  assert.equal(objResult.status, 0, objResult.stderr)
+  return objResult.stdout.trim()
+}
+
+test('component governance validates source, regression and license evidence', async () => {
+  const objManifest = JSON.parse(
+    await readFile(
+      path.join(strProjectRoot, 'tools/component-governance/manifest.json'),
+      'utf8'
+    )
+  )
+  const objResult = fnRunGovernance('check')
+
+  assert.equal(objResult.status, 0, objResult.stderr || objResult.stdout)
+  assert.match(objResult.stdout, /COMPONENT_GOVERNANCE_READY/)
+  assert.match(
+    objResult.stdout,
+    new RegExp(`${objManifest.components.length} 个内建组件`)
+  )
+  assert.match(
+    objResult.stdout,
+    new RegExp(`${objManifest.thirdParty.length} 个第三方许可证边界`)
+  )
+})
+
+test('component diff reports a clean forward-only upgrade without mutating source', async () => {
+  const strTemporaryRoot = await mkdtemp(
+    path.join(os.tmpdir(), 'component-governance-')
+  )
+  const strSourceRoot = path.resolve(strTemporaryRoot, 'page-form')
+  const strSourceFile = path.resolve(
+    strSourceRoot,
+    'packages/core/src/value.ts'
+  )
+  const strAddedFile = path.resolve(strSourceRoot, 'packages/core/src/added.ts')
+  const strManifestPath = path.resolve(strTemporaryRoot, 'manifest.json')
+
+  try {
+    await mkdir(path.dirname(strSourceFile), { recursive: true })
+    fnRunGit(strTemporaryRoot, 'init', strSourceRoot)
+    fnRunGit(strSourceRoot, 'config', 'user.name', 'Component Test')
+    fnRunGit(strSourceRoot, 'config', 'user.email', 'component@example.test')
+    fnRunGit(
+      strSourceRoot,
+      'remote',
+      'add',
+      'origin',
+      'ssh://git@example.test/frontend/package/page-form.git'
+    )
+    await writeFile(strSourceFile, 'export const nValue = 1\n')
+    fnRunGit(strSourceRoot, 'add', '.')
+    fnRunGit(strSourceRoot, 'commit', '-m', 'feat: initial source')
+    const strBaseRevision = fnRunGit(strSourceRoot, 'rev-parse', 'HEAD')
+
+    await writeFile(strSourceFile, 'export const nValue = 2\n')
+    await writeFile(strAddedFile, 'export const bAdded = true\n')
+    fnRunGit(strSourceRoot, 'add', '.')
+    fnRunGit(strSourceRoot, 'commit', '-m', 'feat: candidate source')
+
+    await writeFile(
+      strManifestPath,
+      JSON.stringify({
+        schemaVersion: 1,
+        components: [
+          {
+            name: 'AppPageForm',
+            localPath: 'src/components/AppPageForm',
+            publicEntry: 'src/components/AppPageForm/index.ts',
+            sourceNote: 'src/components/AppPageForm/SOURCE.md',
+            source: {
+              repository: 'frontend/package/page-form',
+              revision: strBaseRevision,
+              packageVersion: '0.1.0',
+              importedAt: '2026-08-27',
+              includedPaths: ['packages/core/src'],
+              excludedCapabilities: ['examples'],
+              license: {
+                status: 'not-provided',
+                distributionPolicy: 'internal-only',
+              },
+            },
+            localAdaptations: ['application boundary'],
+            regressionTests: ['tests/unit/components/PageForm.test.tsx'],
+            requiredCommands: ['pnpm components:check', 'pnpm verify'],
+          },
+        ],
+        thirdParty: [],
+      })
+    )
+
+    const objResult = fnRunGovernance(
+      'diff',
+      '--',
+      '--component',
+      'AppPageForm',
+      '--source-root',
+      strSourceRoot,
+      '--manifest',
+      strManifestPath
+    )
+
+    assert.equal(objResult.status, 0, objResult.stderr || objResult.stdout)
+    assert.match(objResult.stdout, /COMPONENT_UPGRADE_AVAILABLE/)
+    assert.match(objResult.stdout, /M\s+packages\/core\/src\/value\.ts/)
+    assert.match(objResult.stdout, /A\s+packages\/core\/src\/added\.ts/)
+    assert.match(objResult.stdout, /本命令不会修改本地组件或清单/)
+    assert.equal(fnRunGit(strSourceRoot, 'status', '--porcelain=v1'), '')
+
+    await writeFile(strAddedFile, 'export const bAdded = false\n')
+    const objDirtyResult = fnRunGovernance(
+      'diff',
+      '--',
+      '--component',
+      'AppPageForm',
+      '--source-root',
+      strSourceRoot,
+      '--manifest',
+      strManifestPath
+    )
+    assert.equal(objDirtyResult.status, 1)
+    assert.match(objDirtyResult.stderr, /COMPONENT_SOURCE_DIRTY/)
+  } finally {
+    await rm(strTemporaryRoot, { recursive: true, force: true })
+  }
+})
+
+test('component governance rejects unsupported commands with a stable fix', () => {
+  const objResult = fnRunGovernance('sync')
+
+  assert.equal(objResult.status, 1)
+  assert.match(objResult.stderr, /COMPONENT_GOVERNANCE_ARGUMENT_INVALID/)
+  assert.match(objResult.stderr, /pnpm components:check/)
+})

package/template/tests/unit/config/deployConfig.test.mjs

@@ -0,0 +1,211 @@
+import assert from 'node:assert/strict'
+import { readFile } from 'node:fs/promises'
+import path from 'node:path'
+import test from 'node:test'
+import { fileURLToPath } from 'node:url'
+
+const strProjectRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '../../..'
+)
+
+async function fnReadProjectFile(strPath) {
+  return readFile(path.resolve(strProjectRoot, strPath), 'utf8')
+}
+
+test('GitLab promotes one verified artifact by immutable image digest', async () => {
+  const strPipeline = await fnReadProjectFile('.gitlab-ci.yml')
+  const strDockerfile = await fnReadProjectFile('Dockerfile')
+  const strBrowserSmoke = await fnReadProjectFile(
+    'tools/deployment/browser-smoke.sh'
+  )
+  const strLocalBrowserSmoke = await fnReadProjectFile(
+    'tools/deployment/browser-smoke.mjs'
+  )
+  const objPackage = JSON.parse(await fnReadProjectFile('package.json'))
+  const strPackageJob = strPipeline.slice(
+    strPipeline.indexOf('\npackage:'),
+    strPipeline.indexOf('\ndeploy:')
+  )
+  const strDeployJob = strPipeline.slice(strPipeline.indexOf('\ndeploy:'))
+
+  assert.match(strPipeline, /CI_COMMIT_BRANCH == "main"/)
+  assert.match(strPipeline, /docker build/)
+  assert.match(strPipeline, /APP_COMMIT_SHA="\$CI_COMMIT_SHA"/)
+  assert.match(strPipeline, /pnpm release:prepare/)
+  assert.match(strPipeline, /pnpm release:verify --commit/)
+  assert.match(strPipeline, /tar -cf - tools\/release\/artifact\.mjs/)
+  assert.doesNotMatch(strPipeline, /-v "\$CI_PROJECT_DIR:\/workspace"/)
+  assert.match(strPipeline, /\.artifacts\/release\//)
+  assert.match(strPipeline, /RELEASE_IMAGE_TAG.*CI_COMMIT_SHA/)
+  assert.match(strPipeline, /docker push "\$RELEASE_IMAGE_TAG"/)
+  assert.match(strPipeline, /RELEASE_IMAGE_DIGEST/)
+  assert.match(strPipeline, /dotenv: release\.env/)
+  assert.match(strPipeline, /ENABLE_PRODUCTION_DEPLOY: 'false'/)
+  assert.match(strPipeline, /ENABLE_PRODUCTION_DEPLOY == "true"/)
+  assert.match(strPipeline, /when: manual/)
+  assert.match(strPipeline, /ADMIN_PUBLIC_URL.*必须使用 HTTPS/s)
+  assert.match(strPipeline, /ADMIN_PUBLIC_URL 不能使用示例域名/)
+  assert.match(strPipeline, /ADMIN_RUNTIME_CONFIG_FILE/)
+  assert.match(strPipeline, /docker cp.*runtime-config\.json/s)
+  assert.match(strPipeline, /readFileSync\(0, 'utf8'\)/)
+  assert.doesNotMatch(
+    strPipeline,
+    /ADMIN_RUNTIME_CONFIG_FILE:\/runtime-config\.json/
+  )
+  assert.doesNotMatch(strPipeline, /\(200\|301\|302\|401\|403\|404\|502\)/)
+  assert.match(strPipeline, /candidate-\$\{CI_COMMIT_SHORT_SHA\}/)
+  assert.match(
+    strDeployJob,
+    /--network "container:\$CI_PROJECT_NAME-candidate-\$\{CI_COMMIT_SHORT_SHA\}"/
+  )
+  assert.match(strDeployJob, /mcr\.microsoft\.com\/playwright:v1\.59\.1-noble/)
+  assert.match(
+    strDeployJob,
+    /sh -s -- http:\/\/127\.0\.0\.1\/sign-in[\s\S]*browser-smoke\.sh/
+  )
+  assert.doesNotMatch(strDeployJob, /docker exec.*wget -q --spider/s)
+  assert.match(strBrowserSmoke, /--dump-dom/)
+  assert.match(strBrowserSmoke, /--timeout=10000/)
+  assert.match(strBrowserSmoke, /<form\(\[\[:space:\]>\]\)/)
+  assert.match(strBrowserSmoke, /DEPLOY_BROWSER_SMOKE_APP_NOT_READY/)
+  assert.match(strBrowserSmoke, /DEPLOY_BROWSER_SMOKE_TIMEOUT/)
+  assert.equal(
+    objPackage.scripts['deployment:smoke'],
+    'node tools/deployment/browser-smoke.mjs'
+  )
+  assert.match(strLocalBrowserSmoke, /from 'playwright'/)
+  assert.match(strLocalBrowserSmoke, /locator\('form'\)/)
+  assert.match(strLocalBrowserSmoke, /DEPLOY_BROWSER_SMOKE_APP_NOT_READY/)
+  assert.match(strDeployJob, /docker pull "\$RELEASE_IMAGE_DIGEST"/)
+  assert.match(strDeployJob, /org\.opencontainers\.image\.revision/)
+  assert.match(strDeployJob, /sha256sum -c/)
+  assert.doesNotMatch(strDeployJob, /docker build/)
+  assert.ok(
+    strPackageJob.indexOf('artifact.mjs verify') <
+      strPackageJob.indexOf('docker build')
+  )
+  assert.ok(
+    strPackageJob.indexOf('docker build') < strPackageJob.indexOf('docker push')
+  )
+  assert.match(strPipeline, /ADMIN_WEB_HOST_PORT: '8084'/)
+  assert.match(strPipeline, /127\.0\.0\.1:\$\{ADMIN_WEB_HOST_PORT\}:80/)
+  assert.doesNotMatch(strDeployJob, /chroot \/host nginx/)
+  assert.match(strDockerfile, /ARG APP_COMMIT_SHA=unknown/)
+  assert.match(strDockerfile, /org\.opencontainers\.image\.revision/)
+  assert.match(strDockerfile, /artifact-manifest\.sha256/)
+  assert.match(strDockerfile, /sha256sum -c/)
+  assert.match(strDockerfile, /test ! -e runtime-config\.json/)
+  assert.doesNotMatch(strDockerfile, /FROM node|pnpm install|pnpm verify/)
+  assert.match(strDeployJob, /trap fnRollbackPromotion EXIT HUP INT TERM/)
+  assert.match(
+    strDeployJob,
+    /docker rename "\$CI_PROJECT_NAME" "\$strRollbackName"/
+  )
+  assert.match(
+    strDeployJob,
+    /docker rename "\$strRollbackName" "\$CI_PROJECT_NAME"/
+  )
+  assert.ok(
+    strDeployJob.indexOf('wget -q --spider "$ADMIN_PUBLIC_URL/sign-in"') <
+      strDeployJob.lastIndexOf('docker rm -f "$strRollbackName"')
+  )
+})
+
+test('GitLab verifies branches and merge requests before deployment', async () => {
+  const strPipeline = await fnReadProjectFile('.gitlab-ci.yml')
+
+  assert.match(strPipeline, /stages:\s+- verify\s+- package\s+- deploy/s)
+  assert.match(strPipeline, /CI_PIPELINE_SOURCE == "merge_request_event"/)
+  assert.match(strPipeline, /CI_COMMIT_BRANCH && \$CI_OPEN_MERGE_REQUESTS/)
+  assert.match(
+    strPipeline,
+    /verify:\s+stage: verify[\s\S]*pnpm install --frozen-lockfile[\s\S]*pnpm verify/
+  )
+  assert.match(
+    strPipeline,
+    /package:\s+stage: package[\s\S]*needs:\s+- job: verify\s+artifacts: true/
+  )
+  assert.match(
+    strPipeline,
+    /deploy:\s+stage: deploy[\s\S]*needs:\s+- job: package\s+artifacts: true/
+  )
+})
+
+test('runtime image only packages the verified static artifact', async () => {
+  const strPipeline = await fnReadProjectFile('.gitlab-ci.yml')
+  const strDockerfile = await fnReadProjectFile('Dockerfile')
+  const strDockerIgnore = await fnReadProjectFile('.dockerignore')
+  const strEslintConfig = await fnReadProjectFile('eslint.config.js')
+  const strGitIgnore = await fnReadProjectFile('.gitignore')
+
+  assert.doesNotMatch(strPipeline, /CI_JOB_TOKEN|gitlab_job_token/)
+  assert.doesNotMatch(strDockerfile, /gitlab-ci-token|gitlab_job_token/)
+  assert.doesNotMatch(strDockerfile, /101\.96\.199\.120/)
+  assert.doesNotMatch(strDockerfile, /--mount=type=ssh/)
+  assert.doesNotMatch(strDockerfile, /package\.json|pnpm-lock|node_modules/)
+  assert.match(strDockerfile, /FROM nginx:stable-alpine@sha256:[a-f0-9]{64}/)
+  assert.match(strDockerfile, /COPY \.artifacts\/release\/site/)
+  assert.match(strDockerIgnore, /^\*\*/m)
+  assert.doesNotMatch(strDockerIgnore, /!package\.json|!pnpm-lock/)
+  assert.match(strEslintConfig, /ignores:\s*\[[\s\S]*?'\.artifacts'/)
+  assert.match(strGitIgnore, /^\.artifacts\/$/m)
+})
+
+test('nginx serves the SPA and keeps host config route-only', async () => {
+  const [strContainerConfig, strApiConfig, strWebConfig] = await Promise.all([
+    fnReadProjectFile('deploy/nginx.conf'),
+    fnReadProjectFile('deploy/host-nginx/react-admin-api.conf'),
+    fnReadProjectFile('deploy/host-nginx/react-admin-web.conf'),
+  ])
+
+  assert.match(strContainerConfig, /try_files \$uri \$uri\/ \/index\.html/)
+  const strExpectedCsp =
+    "default-src 'self'; base-uri 'self'; connect-src 'self'; " +
+    "font-src 'self' data:; form-action 'self'; frame-ancestors 'none'; " +
+    "frame-src 'self' blob: https:; img-src 'self' blob: data: https:; " +
+    "object-src 'none'; script-src 'self'; script-src-attr 'none'; " +
+    "style-src 'self' 'unsafe-inline'"
+  const objCspMatch = strContainerConfig.match(
+    /add_header Content-Security-Policy "([^"]+)" always;/
+  )
+
+  assert.equal(objCspMatch?.[1], strExpectedCsp)
+  assert.doesNotMatch(
+    objCspMatch?.[1] ?? '',
+    /unsafe-eval|script-src[^;]*unsafe-inline/
+  )
+  assert.match(strContainerConfig, /Strict-Transport-Security/)
+  assert.match(strContainerConfig, /Cross-Origin-Opener-Policy "same-origin"/)
+  assert.match(strContainerConfig, /Cross-Origin-Resource-Policy "same-origin"/)
+  assert.match(strContainerConfig, /Permissions-Policy "camera=\(\)/)
+  assert.match(strContainerConfig, /X-Frame-Options "DENY"/)
+  assert.match(strContainerConfig, /X-Content-Type-Options "nosniff"/)
+  assert.match(
+    strContainerConfig,
+    /runtime-config\.json "no-store, no-cache, must-revalidate"/
+  )
+  assert.doesNotMatch(strApiConfig, /server\s*{/)
+  assert.doesNotMatch(strWebConfig, /server\s*{/)
+  assert.match(strApiConfig, /location \/api\//)
+  assert.match(strApiConfig, /proxy_pass http:\/\/127\.0\.0\.1:18085/)
+  assert.match(strWebConfig, /proxy_pass http:\/\/127\.0\.0\.1:8084/)
+})
+
+test('CI blocks high-severity dependency advisories before packaging', async () => {
+  const [strPackage, strPipeline] = await Promise.all([
+    fnReadProjectFile('package.json'),
+    fnReadProjectFile('.gitlab-ci.yml'),
+  ])
+  const objPackage = JSON.parse(strPackage)
+
+  assert.equal(
+    objPackage.scripts['security:audit'],
+    'pnpm audit --audit-level high'
+  )
+  assert.match(strPipeline, /pnpm verify\s+- pnpm security:audit/)
+  assert.ok(
+    strPipeline.indexOf('pnpm security:audit') <
+      strPipeline.indexOf('pnpm release:prepare')
+  )
+})

package/template/tests/unit/config/eslintConfig.test.mjs

@@ -0,0 +1,101 @@
+import { ESLint } from 'eslint'
+import assert from 'node:assert/strict'
+import nodePath from 'node:path'
+import test from 'node:test'
+
+const strProjectRoot = nodePath.resolve(import.meta.dirname, '../../..')
+const strBusinessFile = nodePath.join(
+  strProjectRoot,
+  'src/components/layout/AppHeader/AppHeader.tsx'
+)
+const strBoundaryFile = nodePath.join(strProjectRoot, 'src/api/hooks/error.ts')
+const objEslint = new ESLint({ cache: false, cwd: strProjectRoot })
+
+async function fnReadRuleIds(strSource, strFilePath = strBusinessFile) {
+  const [objResult] = await objEslint.lintText(strSource, {
+    filePath: strFilePath,
+  })
+  return objResult.messages.map((objMessage) => objMessage.ruleId)
+}
+
+test('TypeScript rules reject explicit and propagated any values', async () => {
+  const arrExplicitAnyRules = await fnReadRuleIds(
+    'const objValue: any = null\nvoid objValue\n'
+  )
+  const arrPropagatedAnyRules = await fnReadRuleIds(
+    "const objPayload = JSON.parse('{}')\nvoid objPayload.strValue\n"
+  )
+
+  assert.ok(arrExplicitAnyRules.includes('@typescript-eslint/no-explicit-any'))
+  assert.ok(
+    arrPropagatedAnyRules.includes('@typescript-eslint/no-unsafe-assignment')
+  )
+  assert.ok(
+    arrPropagatedAnyRules.includes('@typescript-eslint/no-unsafe-member-access')
+  )
+})
+
+test('unknown is restricted to declared external-data boundaries', async () => {
+  const strSource = 'const objValue: unknown = null\nvoid objValue\n'
+  const arrBusinessRuleIds = await fnReadRuleIds(strSource)
+  const arrBoundaryRuleIds = await fnReadRuleIds(strSource, strBoundaryFile)
+
+  assert.ok(
+    arrBusinessRuleIds.includes('@typescript-eslint/no-restricted-types')
+  )
+  assert.ok(
+    !arrBoundaryRuleIds.includes('@typescript-eslint/no-restricted-types')
+  )
+})
+
+test('exported TypeScript contracts must be declared in types.ts', async () => {
+  const strSource = 'export interface ISharedContract { strValue: string }\n'
+  const arrImplementationRuleIds = await fnReadRuleIds(strSource)
+  const arrTypesRuleIds = await fnReadRuleIds(
+    strSource,
+    nodePath.join(strProjectRoot, 'src/context/types.ts')
+  )
+
+  assert.ok(
+    arrImplementationRuleIds.includes(
+      'project-naming/public-types-in-types-file'
+    )
+  )
+  assert.ok(
+    !arrTypesRuleIds.includes('project-naming/public-types-in-types-file')
+  )
+})
+
+test('Swagger DTO fields preserve external names without disabling owned naming rules', async () => {
+  const strTypesFile = nodePath.join(
+    strProjectRoot,
+    'src/features/auth/signIn/types.ts'
+  )
+  const arrDtoRuleIds = await fnReadRuleIds(
+    'interface IGeneratedDto { id: string; name: string; enabled: boolean; revision: number; items: string[]; total: number }\n',
+    strTypesFile
+  )
+  const arrOwnedRuleIds = await fnReadRuleIds(
+    'interface IOwnedModel { title: string }\n',
+    strTypesFile
+  )
+
+  assert.ok(!arrDtoRuleIds.includes('@typescript-eslint/naming-convention'))
+  assert.ok(arrOwnedRuleIds.includes('@typescript-eslint/naming-convention'))
+})
+
+test('owned components expose only their root public entry to application code', async () => {
+  const arrPublicRuleIds = await fnReadRuleIds(
+    "import { AppTable } from '@/components/AppTable'\nvoid AppTable\n"
+  )
+  const arrPrivateRuleIds = await fnReadRuleIds(
+    "import { TableComponent } from '@/components/AppTable/table'\nvoid TableComponent\n"
+  )
+  const arrDynamicRuleIds = await fnReadRuleIds(
+    "void import('@/components/AppPageForm/controller')\n"
+  )
+
+  assert.ok(!arrPublicRuleIds.includes('project-naming/component-boundaries'))
+  assert.ok(arrPrivateRuleIds.includes('project-naming/component-boundaries'))
+  assert.ok(arrDynamicRuleIds.includes('project-naming/component-boundaries'))
+})

package/template/tests/unit/config/featureBoundaries.test.mjs

@@ -0,0 +1,126 @@
+import { ESLint } from 'eslint'
+import assert from 'node:assert/strict'
+import { readFile, readdir } from 'node:fs/promises'
+import nodePath from 'node:path'
+import test from 'node:test'
+
+const strProjectRoot = nodePath.resolve(import.meta.dirname, '../../..')
+const strFeaturesRoot = nodePath.join(strProjectRoot, 'src/features')
+const strRouterFile = nodePath.join(
+  strProjectRoot,
+  'src/router/lazyRouteComponents.ts'
+)
+const strFeatureFile = nodePath.join(strFeaturesRoot, 'home/messages.ts')
+const objEslint = new ESLint({ cache: false, cwd: strProjectRoot })
+
+async function fnReadBoundaryMessages(strSource, strFilePath) {
+  const [objResult] = await objEslint.lintText(strSource, {
+    filePath: strFilePath,
+  })
+
+  return objResult.messages.filter(
+    (objMessage) => objMessage.ruleId === 'project-naming/feature-boundaries'
+  )
+}
+
+test('every top-level Feature exposes one public entry', async () => {
+  const arrEntries = await readdir(strFeaturesRoot, { withFileTypes: true })
+  const arrFeatureNames = arrEntries
+    .filter((objEntry) => objEntry.isDirectory())
+    .map((objEntry) => objEntry.name)
+    .sort()
+  const arrMissingEntries = []
+
+  for (const strFeatureName of arrFeatureNames) {
+    const arrFeatureEntries = await readdir(
+      nodePath.join(strFeaturesRoot, strFeatureName)
+    )
+    if (
+      !arrFeatureEntries.includes('index.ts') &&
+      !arrFeatureEntries.includes('index.tsx')
+    ) {
+      arrMissingEntries.push(strFeatureName)
+    }
+  }
+
+  assert.deepEqual(arrMissingEntries, [])
+})
+
+test('outside consumers can only import a Feature public entry', async () => {
+  const arrRootMessages = await fnReadBoundaryMessages(
+    "import { RouteError } from '@/features/errors'\nvoid RouteError\n",
+    strRouterFile
+  )
+  const arrDeepMessages = await fnReadBoundaryMessages(
+    "import { RouteError } from '@/features/errors/RouteError'\nvoid RouteError\n",
+    strRouterFile
+  )
+  const arrDynamicMessages = await fnReadBoundaryMessages(
+    "void import('@/features/errors/RouteError')\n",
+    strRouterFile
+  )
+  const arrExportMessages = await fnReadBoundaryMessages(
+    "export { RouteError } from '@/features/errors/RouteError'\n",
+    strRouterFile
+  )
+
+  assert.equal(arrRootMessages.length, 0)
+  assert.equal(arrDeepMessages[0]?.messageId, 'privateFeatureImport')
+  assert.equal(arrDynamicMessages[0]?.messageId, 'privateFeatureImport')
+  assert.equal(arrExportMessages[0]?.messageId, 'privateFeatureImport')
+})
+
+test('Feature code cannot bypass a peer public entry', async () => {
+  const arrRootMessages = await fnReadBoundaryMessages(
+    "import { RouteError } from '@/features/errors'\nvoid RouteError\n",
+    strFeatureFile
+  )
+  const arrDeepMessages = await fnReadBoundaryMessages(
+    "import { RouteError } from '@/features/errors/RouteError'\nvoid RouteError\n",
+    strFeatureFile
+  )
+  const arrRelativeMessages = await fnReadBoundaryMessages(
+    "import { RouteError } from '../errors/RouteError'\nvoid RouteError\n",
+    strFeatureFile
+  )
+  const arrOwnedMessages = await fnReadBoundaryMessages(
+    "import { objHomeMessages } from './messages'\nvoid objHomeMessages\n",
+    strFeatureFile
+  )
+
+  assert.equal(arrRootMessages.length, 0)
+  assert.equal(arrDeepMessages[0]?.messageId, 'privateFeatureImport')
+  assert.equal(arrRelativeMessages[0]?.messageId, 'relativeCrossFeatureImport')
+  assert.equal(arrOwnedMessages.length, 0)
+})
+
+test('Feature code cannot depend on router or application composition', async () => {
+  const arrRouterMessages = await fnReadBoundaryMessages(
+    "import { objRouter } from '@/router/router'\nvoid objRouter\n",
+    strFeatureFile
+  )
+  const arrLayoutMessages = await fnReadBoundaryMessages(
+    "import { AppLayout } from '@/layouts/AppLayout'\nvoid AppLayout\n",
+    strFeatureFile
+  )
+  const arrRelativeRouterMessages = await fnReadBoundaryMessages(
+    "import { objRouter } from '../../router/router'\nvoid objRouter\n",
+    strFeatureFile
+  )
+
+  assert.equal(arrRouterMessages[0]?.messageId, 'reverseApplicationDependency')
+  assert.equal(arrLayoutMessages[0]?.messageId, 'reverseApplicationDependency')
+  assert.equal(
+    arrRelativeRouterMessages[0]?.messageId,
+    'reverseApplicationDependency'
+  )
+})
+
+test('root data entry does not re-export capability barrels', async () => {
+  const strApiEntry = await readFile(
+    nodePath.join(strProjectRoot, 'src/api/index.ts'),
+    'utf8'
+  )
+
+  assert.doesNotMatch(strApiEntry, /export\s+\*\s+from/)
+})

package/template/tests/unit/config/npmPackage.test.mjs

@@ -0,0 +1,37 @@
+import assert from 'node:assert/strict'
+import { readFile } from 'node:fs/promises'
+import path from 'node:path'
+import test from 'node:test'
+import { fnVerifyNpmPackage } from '../../../packages/create-react-admin-template/scripts/smokePackage.mjs'
+
+const strProjectRoot = path.resolve(import.meta.dirname, '../../..')
+
+test('creator package owns its publish lifecycle without publishing the root application', async () => {
+  const objPackage = JSON.parse(
+    await readFile(
+      path.join(
+        strProjectRoot,
+        'packages/create-react-admin-template/package.json'
+      ),
+      'utf8'
+    )
+  )
+  const objRoot = JSON.parse(
+    await readFile(path.join(strProjectRoot, 'package.json'), 'utf8')
+  )
+  assert.equal(objRoot.private, true)
+  assert.equal(objRoot.scripts['npm:pack'], undefined)
+  assert.equal(objPackage.name, 'create-react-admin-template')
+  assert.equal(objPackage.dependencies, undefined)
+  assert.deepEqual(objPackage.bin, {
+    'create-react-admin-template': 'bin/create.mjs',
+  })
+  assert.equal(objPackage.scripts.prepack, 'node scripts/buildTemplate.mjs')
+  assert.equal(objPackage.scripts.prepublishOnly, 'pnpm --dir ../.. verify')
+})
+
+test('packed CLI installs offline and creates core/full projects without maintainer files', async () => {
+  const objResult = await fnVerifyNpmPackage()
+  assert.equal(objResult.strPackageName, 'create-react-admin-template')
+  assert.ok(objResult.nFileCount > 0)
+})