ci(test): six heavy packages split test into test and test:repo so package suites cache again (#16560)

* ci(test): six heavy packages split `test` into `test` and `test:repo` so package suites cache again

Every file stays where it is. spec, core, types, runtime, objectql and rest
each define two vitest projects in one config -- `local` (every other test
file) and `repo` (the tests that read outside the package, listed in a
vitest.repo-tests.json sidecar) -- and two turbo tasks: `test` keeps
package-local inputs, `test:repo` takes the wide `$TURBO_ROOT$` inputs that
used to invalidate the whole suite on any change inside the radius.

check-cross-package-test-inputs gains the split rule: for a package whose
manifest declares `test:repo`, the declared globs must hash on `PKG#test:repo`,
`PKG#test` must carry no repo-wide input, and the sidecar list must equal the
gate's own scan in both directions (16 new self-test cases in a declared
battery). check-test-completeness reads `test:repo` summaries, group headers,
bare headers and `Failed:` rosters as the same package. ci.yml's Test Core
whole leg runs `turbo run test test:repo`; the cli slice leg is unchanged.

Collected files before/after (vitest list --filesOnly): spec 482 = 456 + 26,
core 51 = 49 + 2, types 20 = 19 + 1, runtime 238 = 236 + 2, objectql 284 =
283 + 1, rest 187 = 186 + 1; no overlap; each repo project equals its sidecar.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019RfFHiRCSs3JXLK4cwcfox

* test(vitest): each project re-declares the root block's test options

A root-level `env` / `disableConsoleIntercept` is inert for a project run
(measured on vitest 4.1.10; check-registry-log-declared and
check-console-intercept-disarm both pin it), so `local` and `repo` carry the
root block's options themselves. Collected files re-proved on the merged
tree against main's own config: 484 = 458 + 26, 51 = 49 + 2, 20 = 19 + 1,
238 = 236 + 2, 285 = 284 + 1, 188 = 187 + 1; overlap 0.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019RfFHiRCSs3JXLK4cwcfox

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.github/workflows/ci.yml

@@ -550,13 +550,23 @@ jobs:
           # a second full suite to a job that is already red and already inside a
           # 30-minute wall — turning an informative red into a killed job with no
           # attestation at all, which is the #16173 failure mode itself.
+          #
+          # `test test:repo` (#16466): six heavy packages split their suite into
+          # two turbo tasks -- `test` (package-local inputs) and `test:repo`
+          # (the repo-scanning tests, hashed on the wide `$TURBO_ROOT$` inputs
+          # that used to sit on `test`). Naming both runs a split package whole
+          # and is a no-op for every package without a `test:repo` script. The
+          # per-shard Turbo cache restored above (main-seeded) is what carries
+          # an unmoved `PKG#test` across a change outside the package; the
+          # completeness guard below reads both tasks' summaries. The cli slice
+          # leg stays `test`-only: cli is not split.
           STATUS=0
           LOGS=""
           for LEG in __whole__ $SLICES; do
             if [ "$LEG" = __whole__ ]; then
               [ -n "$FILTERS" ] || continue
               LOG="$RUNNER_TEMP/test-core-packages.log"
-              set -- pnpm turbo run test $FILTERS --concurrency=4 --summarize --log-order=stream
+              set -- pnpm turbo run test test:repo $FILTERS --concurrency=4 --summarize --log-order=stream
             else
               PKG="${LEG%%=*}"
               SLICE="${LEG#*=}"

package.json

@@ -10,7 +10,7 @@
     "dev:crm": "node scripts/check-dev-prereqs.mjs && pnpm check:console-sha && pnpm --filter @objectstack/example-crm dev",
     "dev:todo": "node scripts/check-dev-prereqs.mjs && pnpm check:console-sha && pnpm --filter @objectstack/example-todo dev",
     "spec:rebuild": "turbo run build --filter=...@objectstack/spec",
-    "test": "VITEST_MAX_WORKERS=$(node scripts/vitest-worker-cap.mjs) turbo run test --concurrency=50%",
+    "test": "VITEST_MAX_WORKERS=$(node scripts/vitest-worker-cap.mjs) turbo run test test:repo --concurrency=50%",
     "test:smoke": "turbo run test:smoke",
     "typecheck": "turbo run typecheck",
     "clean": "turbo run clean && rm -rf dist",

packages/core/package.json

@@ -23,7 +23,8 @@
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.examples.json && pnpm check:test-typecheck",
     "check:test-typecheck": "tsx ../../scripts/check-test-typecheck.mts --self-test && tsx ../../scripts/check-test-typecheck.mts --package packages/core --project tsconfig.test.json",
     "gen:test-typecheck-debt": "tsx ../../scripts/check-test-typecheck.mts --update --package packages/core --project tsconfig.test.json",
-    "test": "vitest run",
+    "test": "vitest run --project local",
+    "test:repo": "vitest run --project repo",
     "test:watch": "vitest"
   },
   "devDependencies": {

packages/core/vitest.config.ts

@@ -1,10 +1,49 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import { defineConfig } from 'vitest/config';
+import { configDefaults, defineConfig } from 'vitest/config';
+import { readFileSync } from 'node:fs';
 import path from 'path';
 
+// #16466 -- two vitest projects, two turbo tasks. `repo` owns the tests that read
+// outside this package (the list is vitest.repo-tests.json, which
+// check:cross-package-test-inputs holds equal to its own scan); `local` owns
+// every other test file. turbo hashes the wide `$TURBO_ROOT$` inputs on
+// `test:repo` only, so `test` stays cacheable across changes elsewhere in the
+// repo. `extends: true` keeps the root options (aliases included) on both.
+const REPO_TESTS: string[] = JSON.parse(readFileSync(path.join(__dirname, 'vitest.repo-tests.json'), 'utf8'));
+
 export default defineConfig({
   test: {
+    // Each project re-declares the root block's test options: a ROOT-level
+    // value is inert for a project run (measured on vitest 4.1.10, see
+    // check-registry-log-declared / check-console-intercept-disarm).
+    projects: [
+      {
+        extends: true,
+        test: {
+          name: 'local',
+          include: configDefaults.include,
+          exclude: [...configDefaults.exclude, ...REPO_TESTS],
+          globals: true, environment: 'node',
+          // A late console.* must not redden a green suite (#10374); see the root
+          // block. A ROOT-level value is inert for a project run, so it is
+          // declared here as well (scripts/check-console-intercept-disarm.mjs).
+          disableConsoleIntercept: true,
+        },
+      },
+      {
+        extends: true,
+        test: {
+          name: 'repo',
+          include: REPO_TESTS,
+          globals: true, environment: 'node',
+          // A late console.* must not redden a green suite (#10374); see the root
+          // block. A ROOT-level value is inert for a project run, so it is
+          // declared here as well (scripts/check-console-intercept-disarm.mjs).
+          disableConsoleIntercept: true,
+        },
+      },
+    ],
     // A late console.* must not redden a green suite (#10374): vitest's worker
     // forwards console output over RPC and discards the promise, and a write
     // landing after teardown's rpcDone() snapshot is rejected into an unhandled

packages/core/vitest.repo-tests.json

@@ -0,0 +1,4 @@
+[
+  "src/security/authz-store-unavailable.test.ts",
+  "src/security/operation-private-keys.pin.test.ts"
+]

packages/objectql/package.json

@@ -19,7 +19,8 @@
   },
   "scripts": {
     "build": "tsup && node ../../scripts/check-dts-emitted.mjs",
-    "test": "vitest run",
+    "test": "vitest run --project local",
+    "test:repo": "vitest run --project repo",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.scripts.json && pnpm check:test-typecheck",
     "check:test-typecheck": "tsx ../../scripts/check-test-typecheck.mts --self-test && tsx ../../scripts/check-test-typecheck.mts --package packages/objectql --project tsconfig.test.json",
     "gen:test-typecheck-debt": "tsx ../../scripts/check-test-typecheck.mts --update --package packages/objectql --project tsconfig.test.json"

packages/objectql/vitest.config.ts

@@ -40,10 +40,56 @@
 // cannot silently re-point that file's premise. Without those two lines the
 // file's first case stays GREEN while testing `'warn'` under a name that says
 // `info` — measured red before they were added.
-import { defineConfig } from 'vitest/config';
+import { configDefaults, defineConfig } from 'vitest/config';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+
+// #16466 -- two vitest projects, two turbo tasks. `repo` owns the tests that read
+// outside this package (the list is vitest.repo-tests.json, which
+// check:cross-package-test-inputs holds equal to its own scan); `local` owns
+// every other test file. turbo hashes the wide `$TURBO_ROOT$` inputs on
+// `test:repo` only, so `test` stays cacheable across changes elsewhere in the
+// repo. `extends: true` keeps the root options (aliases included) on both.
+const REPO_TESTS: string[] = JSON.parse(readFileSync(path.join(__dirname, 'vitest.repo-tests.json'), 'utf8'));
 
 export default defineConfig({
   test: {
+    // Each project re-declares the root block's test options: a ROOT-level
+    // value is inert for a project run (measured on vitest 4.1.10, see
+    // check-registry-log-declared / check-console-intercept-disarm).
+    projects: [
+      {
+        extends: true,
+        test: {
+          name: 'local',
+          include: configDefaults.include,
+          exclude: [...configDefaults.exclude, ...REPO_TESTS],
+          // #13517: quiet the registry's per-item registration chatter — the
+          // engine's own `OS_REGISTRY_LOG` seam, not a change to its shipped
+          // default. Enforced by scripts/check-registry-log-declared.mjs.
+          env: { OS_REGISTRY_LOG: 'warn' },
+          // A late console.* must not redden a green suite (#10374); see the root
+          // block. A ROOT-level value is inert for a project run, so it is
+          // declared here as well (scripts/check-console-intercept-disarm.mjs).
+          disableConsoleIntercept: true,
+        },
+      },
+      {
+        extends: true,
+        test: {
+          name: 'repo',
+          include: REPO_TESTS,
+          // #13517: quiet the registry's per-item registration chatter — the
+          // engine's own `OS_REGISTRY_LOG` seam, not a change to its shipped
+          // default. Enforced by scripts/check-registry-log-declared.mjs.
+          env: { OS_REGISTRY_LOG: 'warn' },
+          // A late console.* must not redden a green suite (#10374); see the root
+          // block. A ROOT-level value is inert for a project run, so it is
+          // declared here as well (scripts/check-console-intercept-disarm.mjs).
+          disableConsoleIntercept: true,
+        },
+      },
+    ],
     // A late console.* must not redden a green suite (#10374): vitest's worker
     // forwards console output over RPC and discards the promise, and a write
     // landing after teardown's rpcDone() snapshot is rejected into an unhandled

packages/objectql/vitest.repo-tests.json

@@ -0,0 +1,3 @@
+[
+  "src/action-owner-key-single-source.test.ts"
+]

packages/rest/package.json

@@ -21,7 +21,8 @@
   "scripts": {
     "build": "tsup --config ../../tsup.config.ts && node ../../scripts/check-dts-emitted.mjs",
     "dev": "tsc -w",
-    "test": "vitest run",
+    "test": "vitest run --project local",
+    "test:repo": "vitest run --project repo",
     "check:test-typecheck": "tsx ../../scripts/check-test-typecheck.mts --self-test && tsx ../../scripts/check-test-typecheck.mts --package packages/rest --project tsconfig.test.json",
     "gen:test-typecheck-debt": "tsx ../../scripts/check-test-typecheck.mts --update --package packages/rest --project tsconfig.test.json",
     "typecheck": "tsc --noEmit && pnpm check:test-typecheck"

packages/rest/vitest.config.ts

@@ -1,10 +1,57 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import { defineConfig } from 'vitest/config';
+import { configDefaults, defineConfig } from 'vitest/config';
+import { readFileSync } from 'node:fs';
 import path from 'path';
 
+// #16466 -- two vitest projects, two turbo tasks. `repo` owns the tests that read
+// outside this package (the list is vitest.repo-tests.json, which
+// check:cross-package-test-inputs holds equal to its own scan); `local` owns
+// every other test file. turbo hashes the wide `$TURBO_ROOT$` inputs on
+// `test:repo` only, so `test` stays cacheable across changes elsewhere in the
+// repo. `extends: true` keeps the root options (aliases included) on both.
+const REPO_TESTS: string[] = JSON.parse(readFileSync(path.join(__dirname, 'vitest.repo-tests.json'), 'utf8'));
+
 export default defineConfig({
   test: {
+    // Each project re-declares the root block's test options: a ROOT-level
+    // value is inert for a project run (measured on vitest 4.1.10, see
+    // check-registry-log-declared / check-console-intercept-disarm).
+    projects: [
+      {
+        extends: true,
+        test: {
+          name: 'local',
+          include: configDefaults.include,
+          exclude: [...configDefaults.exclude, ...REPO_TESTS],
+          globals: true, environment: 'node',
+          // #13517: quiet the registry's per-item registration chatter — the
+          // engine's own `OS_REGISTRY_LOG` seam, not a change to its shipped
+          // default. Enforced by scripts/check-registry-log-declared.mjs.
+          env: { OS_REGISTRY_LOG: 'warn' },
+          // A late console.* must not redden a green suite (#10374); see the root
+          // block. A ROOT-level value is inert for a project run, so it is
+          // declared here as well (scripts/check-console-intercept-disarm.mjs).
+          disableConsoleIntercept: true,
+        },
+      },
+      {
+        extends: true,
+        test: {
+          name: 'repo',
+          include: REPO_TESTS,
+          globals: true, environment: 'node',
+          // #13517: quiet the registry's per-item registration chatter — the
+          // engine's own `OS_REGISTRY_LOG` seam, not a change to its shipped
+          // default. Enforced by scripts/check-registry-log-declared.mjs.
+          env: { OS_REGISTRY_LOG: 'warn' },
+          // A late console.* must not redden a green suite (#10374); see the root
+          // block. A ROOT-level value is inert for a project run, so it is
+          // declared here as well (scripts/check-console-intercept-disarm.mjs).
+          disableConsoleIntercept: true,
+        },
+      },
+    ],
     // A late console.* must not redden a green suite (#10374): vitest's worker
     // forwards console output over RPC and discards the promise, and a write
     // landing after teardown's rpcDone() snapshot is rejected into an unhandled