feat(ql3): apply legacy data transformation

test/back/ql3ClusterDependencyAudit.test.cjs

@@ -1914,6 +1914,110 @@ test('confines adoption and Package command authorities to owner CLI subpaths',
   );
 });
 
+test('confines data-directory application authority to exact reviewed owners', (t) => {
+  const root = fs.mkdtempSync(
+    path.join(os.tmpdir(), 'ql3-data-directory-application-boundary-'),
+  );
+  const ownerApplicationDirectory = path.join(
+    root,
+    'packages/ql3-local-owner-cli/src/lifecycle/data-directory-adoption/application',
+  );
+  const adminAdoptionDirectory = path.join(
+    root,
+    'packages/ql3-local-admin/src/data-directory-adoption',
+  );
+  fs.mkdirSync(ownerApplicationDirectory, { recursive: true });
+  fs.mkdirSync(adminAdoptionDirectory, { recursive: true });
+  fs.writeFileSync(
+    path.join(ownerApplicationDirectory, 'application.ts'),
+    [
+      "import { application } from '@qinglong/local-admin/data-directory-adoption';",
+      "import { secrets } from '@qinglong/local-secret';",
+      "import { authenticated } from '@qinglong/local-owner-console/authenticated-command';",
+      "import { bootstrap } from '@qinglong/local-sqlite/bootstrap';",
+    ].join('\n'),
+  );
+  fs.writeFileSync(
+    path.join(ownerApplicationDirectory, 'cleanup.ts'),
+    "import { cleanup } from '@qinglong/local-sqlite/data-directory-adoption';",
+  );
+  fs.writeFileSync(
+    path.join(ownerApplicationDirectory, 'neighbor.ts'),
+    [
+      "import { application } from '@qinglong/local-admin/data-directory-adoption';",
+      "import { secrets } from '@qinglong/local-secret';",
+      "import { cleanup } from '@qinglong/local-sqlite/data-directory-adoption';",
+    ].join('\n'),
+  );
+  fs.writeFileSync(
+    path.join(adminAdoptionDirectory, 'dataDirectoryAdoption.ts'),
+    [
+      "import { database } from '@qinglong/local-sqlite/data-directory-adoption';",
+      "import type { secret } from '@qinglong/runtime-core/local-secret';",
+      "import { policy } from '@qinglong/runtime-core/project-policy';",
+      "import type { decision } from '@qinglong/runtime-core/security';",
+      "import type { audit } from '@qinglong/runtime-core/security-audit';",
+    ].join('\n'),
+  );
+  fs.writeFileSync(
+    path.join(adminAdoptionDirectory, 'neighbor.ts'),
+    [
+      "import { database } from '@qinglong/local-sqlite/data-directory-adoption';",
+      "import type { secret } from '@qinglong/runtime-core/local-secret';",
+    ].join('\n'),
+  );
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+
+  const ownerFindings = [];
+  auditSourceImports(root, 'packages/ql3-local-owner-cli', ownerFindings);
+  assert.deepEqual(
+    ownerFindings.map(({ code, file, specifier }) => ({
+      code,
+      file,
+      specifier,
+    })),
+    [
+      {
+        code: 'FORBIDDEN_LOCAL_ADOPTION_CLI_AUTHORITY_IMPORT',
+        file: 'packages/ql3-local-owner-cli/src/lifecycle/data-directory-adoption/application/neighbor.ts',
+        specifier: '@qinglong/local-admin/data-directory-adoption',
+      },
+      {
+        code: 'FORBIDDEN_PACKAGE_SOURCE_IMPORT',
+        file: 'packages/ql3-local-owner-cli/src/lifecycle/data-directory-adoption/application/neighbor.ts',
+        specifier: '@qinglong/local-secret',
+      },
+      {
+        code: 'FORBIDDEN_LOCAL_ADOPTION_CLI_AUTHORITY_IMPORT',
+        file: 'packages/ql3-local-owner-cli/src/lifecycle/data-directory-adoption/application/neighbor.ts',
+        specifier: '@qinglong/local-sqlite/data-directory-adoption',
+      },
+    ],
+  );
+
+  const adminFindings = [];
+  auditSourceImports(root, 'packages/ql3-local-admin', adminFindings);
+  assert.deepEqual(
+    adminFindings.map(({ code, file, specifier }) => ({
+      code,
+      file,
+      specifier,
+    })),
+    [
+      {
+        code: 'FORBIDDEN_LOCAL_ADMIN_SQLITE_ENTRYPOINT',
+        file: 'packages/ql3-local-admin/src/data-directory-adoption/neighbor.ts',
+        specifier: '@qinglong/local-sqlite/data-directory-adoption',
+      },
+      {
+        code: 'FORBIDDEN_LOCAL_ADMIN_RUNTIME_CORE_ENTRYPOINT',
+        file: 'packages/ql3-local-admin/src/data-directory-adoption/neighbor.ts',
+        specifier: '@qinglong/runtime-core/local-secret',
+      },
+    ],
+  );
+});
+
 test('confines fresh setup authority to the reviewed owner CLI subpath', (t) => {
   const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ql3-setup-boundary-'));
   const sourceDirectory = path.join(root, 'packages/ql3-local-owner-cli/src');

test/back/ql3PackageBoundaryAudit.test.cjs

@@ -79,7 +79,7 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       },
       {
         directory: 'packages/ql3-local-sqlite/src/migrations',
-        directSourceFiles: 99,
+        directSourceFiles: 101,
         reviewKind: 'ordered_ledger',
       },
     ],
@@ -97,10 +97,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       rootSourceFileRoles: localAdmin.rootSourceFileRoles,
     },
     {
-      sourceFiles: 44,
+      sourceFiles: 45,
       rootSourceFiles: 1,
       rootSourceLines: 9,
-      nestedSourceFiles: 43,
+      nestedSourceFiles: 44,
       rootSourceFileRoles: { 'runtime.ts': 'public_export' },
     },
   );
@@ -207,10 +207,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       rootSourceFileRoles: localOwnerCli.rootSourceFileRoles,
     },
     {
-      sourceFiles: 129,
+      sourceFiles: 131,
       rootSourceFiles: 1,
       rootSourceLines: 50,
-      nestedSourceFiles: 128,
+      nestedSourceFiles: 130,
       rootSourceFileRoles: { 'cli.ts': 'binary_entry' },
     },
   );
@@ -540,10 +540,10 @@ test('current QL3 workspace has exactly eighteen reviewed package boundaries', (
       rootSourceFileRoles: localSqlite.rootSourceFileRoles,
     },
     {
-      sourceFiles: 197,
+      sourceFiles: 201,
       rootSourceFiles: 1,
       rootSourceLines: 31,
-      nestedSourceFiles: 196,
+      nestedSourceFiles: 200,
       rootSourceFileRoles: { 'index.ts': 'public_export' },
     },
   );