{
  "workspaces": ["packages/*", "functions", "portal", "apps/*"],
  "scripts": {
    "dev": "vite --port 3000",
    "dev:start": "firebase emulators:start --import=./seed-data --export-on-exit",
    "dev:all": "concurrently \"npm run dev:start\" \"npm run dev\"",
    "dev:all:fresh": "concurrently \"npm run dev:start -- --clear\" \"npm run dev\"",
    "build": "tsc --noEmit && vite build",
    "build:staging": "vite build --mode staging",
    "test": "vitest",
    "test:coverage": "vitest run --coverage",
    "test:e2e": "playwright test",
    "lint": "eslint . --ext .ts,.tsx",
    "lint:fix": "eslint . --ext .ts,.tsx --fix"
  }
}

// src/core/BaseService.ts
export abstract class BaseService<T extends BaseEntity> {
  protected collectionName: string;
  protected logger: Logger;
  protected eventBus: EventBus;
  
  // Built-in: tenant isolation, validation, logging, quota checks
  abstract validate(data: Partial<T>): ValidationResult;
  
  async create(data: Omit<T, 'id'>, organizationId: string): Promise<T> { /* ... */ }
  async update(id: string, data: Partial<T>, organizationId: string): Promise<T> { /* ... */ }
  async delete(id: string, organizationId: string): Promise<void> { /* ... */ }
  async getById(id: string, organizationId: string): Promise<T | null> { /* ... */ }
  async query(filters: QueryFilters, organizationId: string): Promise<T[]> { /* ... */ }
}

// src/core/EventBus.ts
class EventBus {
  emit<T>(event: TypedEvent<T>): void;
  on<T>(eventType: string, handler: (payload: T) => void): Unsubscribe;
}

<GlobalProviders>        ← Auth, Theme, i18n, Sentry, QueryClient
  <DomainProviders>      ← Organization/Tenant, Feature flags, Permissions
    <FeatureProviders>   ← Per-feature contexts (grants, expenses, etc.)
      <App />
    </FeatureProviders>
  </DomainProviders>
</GlobalProviders>

src/features/[feature]/
├── components/
│   ├── pages/          # Route-level page components
│   ├── tabs/           # Tab content components
│   ├── sections/       # Page sections
│   └── cards/          # Feature-specific cards
├── hooks/
│   ├── use[Feature].ts           # Main query/mutation hook
│   └── use[Feature]Selectors.ts  # Derived/filtered data hooks
├── services/
│   └── [feature]Service.ts       # BaseService<T> extension
├── schemas/
│   └── [feature].schema.ts       # Zod schemas (source of truth for types)
├── contracts.ts                   # Enums, interfaces, state types
├── [Feature]Context.tsx           # Feature-level React Context (if needed)
└── index.ts                       # Barrel export — PUBLIC API only

// src/routes/lazyComponents.tsx — all route components lazy-loaded
export const DashboardPage = React.lazy(() => import('@/features/dashboard/components/pages/DashboardPage'));
export const ProjectsPage = React.lazy(() => import('@/features/projects/components/pages/ProjectsPage'));

// src/routes/routeConfig.tsx — centralized route definitions
export const routes: RouteConfig[] = [
  { path: '/dashboard', element: <DashboardPage />, label: 'Dashboard', icon: LayoutDashboard },
  { path: '/projects', element: <ProjectsPage />, label: 'Projects', icon: FolderOpen },
  // ...
];

// functions/src/index.ts
function registerModuleExports(modulePath: string) {
  const mod = require(modulePath);
  Object.assign(module.exports, mod);
  Object.assign(exports, mod);
}

// Production: load all modules
registerModuleExports('./stripe');
registerModuleExports('./genkit');
// ... 20+ modules

// Emulator: load selectively for fast cold starts
if (process.env.FUNCTIONS_EMULATOR) {
  registerModuleExports('./genkit'); // minimal set
}

// functions/src/core/sentry.ts
// MUST lazy-load Sentry — @sentry/node registers OpenTelemetry hooks at import time
// which causes Firebase CLI's 10s function-discovery timeout to be exceeded
let _sentry: typeof import('@sentry/node') | null = null;
export function getSentry() {
  if (!_sentry) _sentry = require('@sentry/node');
  return _sentry;
}

# scripts/prepare-functions.sh — firebase.json predeploy hook
# Step 1: Validate lockfile integrity
# Step 2: Sync shared packages → functions/shared/
# Step 3: Compile shared with esbuild
# Step 4: Vendor into functions/node_modules/ (Cloud Build can only see functions/)
# Step 5: Build functions with esbuild → lib/
# Step 6: Cold-start load budget verification (target 12s, hard limit 18s)

rules_version = '2';
service cloud.firestore {
match /databases/{database}/documents {
// ALL collections nested under organization for tenant isolation
match /organizations/{orgId} {
// Helper functions
function belongsToOrg() { return request.auth.token.organizationId == orgId; }
function isAdmin() { return belongsToOrg() && request.auth.token.role in ['admin', 'superadmin']; }
function isManagerOrHigher() { return belongsToOrg() && request.auth.token.role in ['manager', 'admin', 'superadmin']; }
  match /[collection]/{docId} {
    allow read: if belongsToOrg();
    allow create: if isManagerOrHigher();
    allow update: if isManagerOrHigher() && !request.resource.data.diff(resource.data).affectedKeys().hasAny(['organizationId']);
    allow delete: if isAdmin();
  }
}
}
}

// vitest.config.ts
export default defineConfig({
  test: {
    environment: 'jsdom',
    setupFiles: ['tests/setup.ts'],
    coverage: {
      provider: 'v8',
      thresholds: { lines: 30, functions: 24, branches: 20, statements: 30 }
    },
    testTimeout: 15000
  }
});

// playwright.config.ts
projects: [
  { name: 'setup', testMatch: '*.setup.ts' },                    // Auth state setup
  { name: 'admin', testMatch: '*admin.spec.ts', dependencies: ['setup'] },
  { name: 'manager', testMatch: '*manager.spec.ts', dependencies: ['setup'] },
  { name: 'employee', testMatch: '*employee.spec.ts', dependencies: ['setup'] },
]
// Auth states stored in tests/.auth/{role}.json

// .firebaserc
{
  "projects": {
    "default": "[app]-local",
    "production": "[app]-prod",
    "staging": "[app]-staging"
  }
}