refactor(layering): R11 lets test support resolve private siblings through devDependencies

[thymikee]

Stacked on #3645 (R83).

What

R11 reads a private package's devDependencies as test-only siblings:

• A test file, *.spec.*, *.fixtures.* file or test tree (anything isProductionSourceFile rejects) may import a sibling the package declares only in devDependencies.
• Production source still needs the production field (dependencies, or devDependencies for a published package, which bundles its siblings). A production import of a dev-only sibling gets its own message: declare it in dependencies or import it from test support only.
• A package's tsconfig references must name both fields (project-references.test.ts unions them), so a dev-only sibling still builds in order.
• @agent-device/daemon moves @agent-device/test-kit from dependencies to devDependencies. It declared test-kit as a runtime dependency; nothing in production source imports it (R83 refuses that). The lockfile changes by that one importer move.

Why now: the test-kit single-entry layer needs every test-kit consumer to declare it as a devDependency, and #3638's @agent-device/proxy flip to devDependencies (declared at runtime only because a test imports it) needs this to land first.

Evidence

• package-boundaries-dev-dependencies.test.ts: dev-only sibling accepted for .test, .spec, __tests__, .fixtures and test/ files; refused with the dev-only message in production source; refused when undeclared for both; a production declaration serves both; a published package is unchanged.
• Gates: pnpm check:quick, check:layering (367 node tests), check:fallow, check:gate-manifest, check:affected --run (the manifest change fails open to the full gate set, which passed), repo-wide pnpm format.

🤖 Generated with Claude Code

[cubic-dev-ai]

All reported issues were addressed across 5 files

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://callstack.github.io/agent-device/pr-preview/pr-3659/
Built to branch gh-pages at 2026-10-15 17:41 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	5.24 MB	5.24 MB	0 B
Package (unpacked)	5.24 MB	5.24 MB	0 B
Package (download)	1.57 MB	1.57 MB	-12 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	26.6 ms	26.2 ms	-0.4 ms
CLI --help	78.7 ms	78.8 ms	+0.1 ms

[thymikee]

The code looks good at 0f751ba, and I found nothing that needs a change before merge. CI is still running: Repo Guards and Lint & Format run the layering scripts this PR changes, so wait for both to finish green. I did not run check:layering or the new node tests; I checked the new rule against the old predicate by reading it. I also did not check whether a bundler or knip gate depends on daemon declaring test-kit in dependencies.

Not blocking, and you can take or leave these: package-export-surface.ts:275 classifies only the importing file, and relative imports skip the sibling check, so a production file could import a dev-only sibling such as a fixtures file through a relative path without a violation (a grep at this commit found no such import today); one rule in the relative branch of checkPackageInternalSites, that a production source file never imports a file isProductionSourceFile rejects, would close this for test-kit and every dev-only sibling. Also, workspaceDevDependencies at package-boundaries.ts:69 is optional, but its only constructor always sets it, so the fallbacks at package-boundaries.ts:287 and project-references.test.ts:168 never apply; making it required like workspaceDependencies would let you drop them.

The Cubic P2 thread on the paths check at project-references.test.ts:174 still stands (#3659 (comment)). The reference union at :168 now includes dev-only siblings, but the paths check at :174 looks only at workspaceDependencies, so a private package with agent-device only in devDependencies would skip it. No package does that today, so this is a small test gap; checking the same union at :174 fixes it. Please reply on that thread once it is done.

[thymikee]

Addressed in the new head: the Cubic thread at project-references.test.ts (paths check reads the same union as references) is fixed and resolved, and workspaceDevDependencies is now required so the ?./?? [] fallbacks are gone. Your relative-import point (a production file reaching a fixtures file by relative path) is real but R83's consumer ban lives in #3645, which you have already read; I'll close it as a follow-up on the R83 predicate rather than reopen that PR.

[thymikee]

This PR is ready at 954dd03. The ! on workspaceDevDependencies that the 0f751ba review flagged is still there, and the Cubic thread on the paths check is now fixed, since it reads the same declared union as the references check.

Not blocking: scripts/layering/package-boundaries-dev-dependencies.test.ts:48 still writes owner!.workspaceDevDependencies!, and the field is now a required ReadonlySet, so the trailing ! asserts nothing and can go, but take it or leave it.

On the open thread, the Cubic P2 about the paths check in project-references.test.ts no longer applies, so please resolve it: #3659 (comment)

I did not run the tests or the gates; I read the tests and the real-tree R11 pass by hand. I did not check whether any bundler or knip gate needs the daemon package to list test-kit under dependencies, and I found no script or config that reads it beyond the layering manifest reader. I also did not check for production files that reach a dev-only sibling through a relative import, which you are deferring to the R83 predicate in #3645.

CI is still pending, and no check has failed. Repo Guards, Lint & Format and Typecheck & Package run the layering scripts and tsc that this diff touches, so they matter most. They should finish green on 954dd03 before merge.

[thymikee]

Taken: the trailing ! on workspaceDevDependencies in package-boundaries-dev-dependencies.test.ts is gone. The Cubic paths thread is resolved.

[thymikee]

The code in 75e42e0 looks good, and I found no problems. The earlier review at 954dd03 was also clean. The Cubic paths thread is now fixed: the root-package paths mapping is checked against both dependency fields in project-references.test.ts, and the trailing ! on workspaceDevDependencies is gone. You can resolve that thread: #3659 (comment)

I read the head source and searched it. I did not run the layering tests, pnpm install, or the full gate. I know of no conflicts. The remaining checks are still queued and none has failed. Nothing is left in the code. Before merge, Repo Guards, Lint & Format, Typecheck & Package and Integration Tests need to finish green, since this change touches scripts/layering, the daemon manifest and the lockfile.