@bleedingdev/modern-js-code-tools 3.9.0-ultramodern.11 → 3.9.0-ultramodern.13

package/dist/esm-node/microvertical-api-boundary.js

@@ -2,8 +2,9 @@ import "node:module";
 import node_fs from "node:fs";
 import node_path from "node:path";
 import { parse } from "@babel/parser";
-import { configuredMicroVerticalApiStem, consumerParserPlugins, microVerticalApiBaselineViolation } from "./microvertical-api-baseline.js";
+import { configuredMicroVerticalApiStem, microVerticalApiBaselineViolation } from "./microvertical-api-baseline.js";
 import { baselinePackage, resolveBaselinePackageDirectory } from "./microvertical-api-owner.js";
+import { consumerParserPlugins } from "./source-analysis.js";
 import { createEffectApiImportResolver, strictEffectRuntimeTopologyViolation } from "./strict-effect-runtime.js";
 import * as __rspack_external__babel_types_6e8337dd from "@babel/types";
 const ignored = new Set([
@@ -20,13 +21,42 @@ const normalize = (file)=>file.split(node_path.sep).join('/').replace(/^\.\//u,
 const errorMessage = (error)=>error instanceof Error ? error.message : String(error);
 const apiApp = (app)=>'vertical' === app.kind && 'ui-only' !== app.surfaceProfile && 'horizontal-remote' !== app.deliveryUnitKind;
 function configuredApps(root, supplied) {
-    const source = supplied ?? JSON.parse(node_fs.readFileSync(node_path.join(root, '.modernjs/ultramodern.json'), 'utf8')).topology?.apps;
-    if (!Array.isArray(source)) throw new Error('.modernjs/ultramodern.json: topology.apps must be an array');
+    const topology = supplied ? void 0 : JSON.parse(node_fs.readFileSync(node_path.join(root, 'topology/reference-topology.json'), 'utf8'));
+    if (topology && (!topology.shell || !Array.isArray(topology.verticals) || void 0 !== topology.shells && !Array.isArray(topology.shells))) throw new Error('topology/reference-topology.json: shell and verticals must be present');
+    const entries = topology?.shell ? [
+        topology.shell,
+        ...topology.shells ?? [],
+        ...topology.verticals ?? []
+    ] : void 0;
+    const source = supplied ?? entries?.map((entry)=>{
+        if (!entry || 'string' != typeof entry.path || !entry.path || node_path.isAbsolute(entry.path) || entry.path.split(/[\\/]/u).includes('..')) throw new Error('topology/reference-topology.json: each app must have an explicit workspace path');
+        const packageFile = node_path.join(root, entry.path, 'package.json');
+        const manifest = JSON.parse(node_fs.readFileSync(packageFile, 'utf8'));
+        if ('string' != typeof manifest.name || !manifest.name || void 0 !== entry.package && entry.package !== manifest.name) throw new Error(`${entry.path}/package.json: package name must match topology`);
+        const api = entry.api;
+        const stem = api?.stem ?? api?.readiness?.endpoint?.match(/^\/([a-z0-9]+(?:-[a-z0-9]+)*)\/readiness$/u)?.[1];
+        return {
+            id: entry.id,
+            kind: entry.kind,
+            path: entry.path,
+            package: manifest.name,
+            surfaceProfile: entry.surfaceProfile,
+            deliveryUnitKind: entry.deliveryUnitKind,
+            ...void 0 === api ? {} : {
+                api: {
+                    stem,
+                    prefix: api.bff?.prefix,
+                    protocol: api.protocol
+                }
+            }
+        };
+    });
+    if (!Array.isArray(source)) throw new Error('topology/reference-topology.json: shell and verticals must describe apps');
     const paths = new Set();
     for (const app of source){
-        if (!app || 'object' != typeof app || 'string' != typeof app.path || !app.path || node_path.isAbsolute(app.path) || app.path.split(/[\\/]/u).includes('..')) throw new Error('.modernjs/ultramodern.json: each app must have a relative workspace path');
+        if (!app || 'object' != typeof app || 'string' != typeof app.path || !app.path || node_path.isAbsolute(app.path) || app.path.split(/[\\/]/u).includes('..')) throw new Error('topology/reference-topology.json: each app must have a relative workspace path');
         const key = normalize(app.path);
-        if (paths.has(key)) throw new Error(`.modernjs/ultramodern.json: duplicate app path ${key}`);
+        if (paths.has(key)) throw new Error(`topology/reference-topology.json: duplicate app path ${key}`);
         paths.add(key);
         for (const name of [
             'id',
@@ -35,7 +65,7 @@ function configuredApps(root, supplied) {
             'surfaceProfile',
             'deliveryUnitKind'
         ])if (void 0 !== app[name] && 'string' != typeof app[name]) throw new Error(`${key}: ${name} must be a string`);
-        for (const [field, allowed] of Object.entries({
+        const allowedFields = {
             kind: [
                 'shell',
                 'vertical'
@@ -49,7 +79,11 @@ function configuredApps(root, supplied) {
                 'microvertical',
                 'horizontal-remote'
             ]
-        }))if (void 0 !== app[field] && !allowed.includes(app[field])) throw new Error(`${key}: invalid ${field}`);
+        };
+        for (const field of Object.keys(allowedFields)){
+            const value = app[field];
+            if (void 0 !== value && !allowedFields[field].includes(value)) throw new Error(`${key}: invalid ${field}`);
+        }
         if (void 0 !== app.api) {
             if (!app.api || 'object' != typeof app.api || Array.isArray(app.api)) throw new Error(`${key}: api must be an object`);
             if (void 0 !== app.api.protocol && ![
@@ -137,12 +171,27 @@ function check(options, topology) {
                 `${base}/index.tsx`
             ].find((candidate)=>exists(candidate));
         };
-        const composedModules = (file)=>{
+        const clientExportFile = (appPath, exported)=>{
+            if ('string' != typeof exported || !exported.startsWith('./') || exported.split(/[\\/]/u).includes('..') || !/\.[cm]?[jt]sx?$/u.test(exported)) return;
+            const appDirectory = absolute(appPath);
+            const candidate = node_path.resolve(appDirectory, exported);
+            try {
+                const workspace = node_fs.realpathSync(root);
+                const owner = node_fs.realpathSync(appDirectory);
+                const real = node_fs.realpathSync(candidate);
+                if (!owner.startsWith(`${workspace}${node_path.sep}`) || !real.startsWith(`${owner}${node_path.sep}`) || !node_fs.statSync(real).isFile()) return;
+            } catch  {
+                return;
+            }
+            return normalize(node_path.relative(root, candidate));
+        };
+        const composedModules = (file, appPath)=>{
             const order = [];
             const seen = new Set();
             const queue = [
                 file
             ];
+            const owner = node_fs.realpathSync(absolute(appPath));
             while(queue.length > 0 && order.length < 128){
                 const current = queue.shift();
                 if (seen.has(current)) continue;
@@ -153,16 +202,19 @@ function check(options, topology) {
                 for (const statement of ast.program.body){
                     const source = (__rspack_external__babel_types_6e8337dd.isImportDeclaration(statement) || __rspack_external__babel_types_6e8337dd.isExportNamedDeclaration(statement) || __rspack_external__babel_types_6e8337dd.isExportAllDeclaration(statement)) && statement.source ? statement.source.value : void 0;
                     const resolved = void 0 === source ? void 0 : resolveRelative(current, source);
-                    if (void 0 !== resolved && !seen.has(resolved)) queue.push(resolved);
+                    if (void 0 !== resolved && !seen.has(resolved)) {
+                        const real = node_fs.realpathSync(absolute(resolved));
+                        if (real.startsWith(`${owner}${node_path.sep}`)) queue.push(resolved);
+                    }
                 }
             }
             return order;
         };
-        const moduleShape = (file, imports, calls, patterns = [], defaultExport, composed = false)=>{
+        const moduleShape = (file, imports, calls, patterns = [], defaultExport, composedAppPath)=>{
             if (!exists(file)) return;
             const ast = parseFile(file);
             if (!ast) return;
-            const shapeFiles = composed ? composedModules(file) : [
+            const shapeFiles = composedAppPath ? composedModules(file, composedAppPath) : [
                 file
             ];
             const body = shapeFiles.flatMap((shapeFile)=>parseFile(shapeFile)?.program.body ?? []);
@@ -272,19 +324,25 @@ function check(options, topology) {
                 }
                 return;
             }
-            if (app?.kind === 'vertical') assert(void 0 !== app.api, `${appPath}: vertical must declare its Effect API in .modernjs/ultramodern.json`);
+            if (app?.kind === 'vertical') assert(void 0 !== app.api, `${appPath}: vertical must declare its Effect API in topology/reference-topology.json`);
             const stem = app?.api?.stem ?? node_path.posix.basename(appPath);
             const rpc = app?.api?.protocol === 'rpc';
             const contract = `${appPath}/shared/${rpc ? 'rpc' : 'api'}.ts`;
-            const client = `${appPath}/src/api/${stem}-${rpc ? 'rpc-client' : 'client'}.ts`;
             const entry = `${appPath}/api/index.ts`;
             for (const file of [
                 entry,
-                contract,
-                client
+                contract
             ])assert(exists(file), `${file}: required API surface is missing`);
+            const packageFile = `${appPath}/package.json`;
+            assert(exists(packageFile), `${packageFile}: required API package is missing`);
+            if (!exists(packageFile)) return;
+            const manifest = JSON.parse(read(packageFile));
+            assert(manifest.exports?.['./api'] === `./shared/${rpc ? 'rpc' : 'api'}.ts`, `${packageFile}: invalid ./api export`);
+            const clientKey = `./api/${rpc ? 'rpc-client' : 'client'}`;
+            const client = clientExportFile(appPath, manifest.exports?.[clientKey]);
+            assert(void 0 !== client, `${packageFile}: invalid API client export`);
+            assert(manifest.exports?.[`./api/${rpc ? 'client' : 'rpc-client'}`] === void 0, `${packageFile}: forbidden opposite protocol client export`);
             noPath(`${appPath}/shared/${rpc ? 'api' : 'rpc'}.ts`, `must not emit a ${rpc ? 'REST' : 'RPC'} contract`);
-            noPath(`${appPath}/src/api/${stem}-${rpc ? 'client' : 'rpc-client'}.ts`, `must not emit a ${rpc ? 'REST' : 'RPC'} client`);
             if (rpc) {
                 moduleShape(entry, [
                     [
@@ -350,21 +408,24 @@ function check(options, topology) {
                 const violation = microVerticalApiBaselineViolation(stem, absolute(contract), expectation);
                 if (violation) diagnostics.push(`${contract}: ${violation}`);
             }
-            moduleShape(client, [
-                [
-                    effect,
+            if (client) {
+                const relativeContract = node_path.posix.relative(node_path.posix.dirname(client), contract);
+                moduleShape(client, [
+                    [
+                        effect,
+                        [
+                            'Effect',
+                            rpc ? 'makeEffectRpcClient' : 'makeEffectHttpApiClient'
+                        ]
+                    ],
                     [
-                        'Effect',
-                        rpc ? 'makeEffectRpcClient' : 'makeEffectHttpApiClient'
+                        relativeContract.startsWith('.') ? relativeContract : `./${relativeContract}`,
+                        []
                     ]
-                ],
-                [
-                    rpc ? '../../shared/rpc.ts' : '../../shared/api',
-                    []
-                ]
-            ], [
-                rpc ? 'makeEffectRpcClient' : 'makeEffectHttpApiClient'
-            ], [], void 0, true);
+                ], [
+                    rpc ? 'makeEffectRpcClient' : 'makeEffectHttpApiClient'
+                ], [], void 0, appPath);
+            }
             moduleShape(`${appPath}/api/effect-api.ts`, [], [], [
                 [
                     /\bbackendFederationContract\b/u,
@@ -405,13 +466,6 @@ function check(options, topology) {
                     'must enable strictEffectApproach'
                 ]
             ]);
-            const packageFile = `${appPath}/package.json`;
-            if (exists(packageFile)) {
-                const manifest = JSON.parse(read(packageFile));
-                assert(manifest.exports?.['./api'] === `./shared/${rpc ? 'rpc' : 'api'}.ts`, `${packageFile}: invalid ./api export`);
-                assert(manifest.exports?.[`./api/${rpc ? 'rpc-client' : 'client'}`] === `./src/api/${stem}-${rpc ? 'rpc-client' : 'client'}.ts`, `${packageFile}: invalid API client export`);
-                assert(manifest.exports?.[`./api/${rpc ? 'client' : 'rpc-client'}`] === void 0, `${packageFile}: forbidden opposite protocol client export`);
-            }
         });
         const shell = 'apps/shell-super-app';
         const verticals = apps.filter((app)=>app.path.startsWith('verticals/') && apiApp(app));

package/dist/esm-node/oxlint-plugin/rules/strict-effect-api-boundaries.js

@@ -21,7 +21,7 @@ const createStrictEffectApiBoundariesRule = ()=>({
                     });
                     reportProgramPattern(context, node, source, /@modern-js\/plugin-bff\/(?:server|hono-server)(?![\w-])/u, 'UltraModern API workspaces must not import Hono server helpers; use @modern-js/bff-effect/effect-edge and HttpApi.');
                     reportProgramPattern(context, node, source, /\bruntimeFramework\s*(?::|=)\s*['"]hono['"]/u, 'UltraModern API apps must use bff.runtimeFramework: "effect".');
-                    reportProgramPattern(context, node, source, /(?:from|import)\s*['"][^'"]*(?:api\/effect|shared\/effect)[^'"]*['"]|shared-effect-api/u, 'Import API code from direct api/index.ts, shared/api.ts or src/api/* paths, not api/effect, shared/effect or shared Effect API packages.');
+                    reportProgramPattern(context, node, source, /(?:from|import)\s*['"][^'"]*(?:api\/effect|shared\/effect)(?=\/|\.[cm]?[jt]sx?['"]|['"])[^'"]*['"]|shared-effect-api/u, 'Import API code from direct api/index.ts, shared/api.ts or src/api/* paths, not api/effect, shared/effect or shared Effect API packages.');
                     reportProgramPattern(context, node, source, /\bstrictEffectApproach\s*(?::|=)\s*false\b/u, 'UltraModern API apps must keep strictEffectApproach enabled.');
                     if (isApiEntryFile(filename)) {
                         const violation = strictEffectRuntimeTopologyViolation(source, createEffectApiImportResolver(filename));

package/dist/esm-node/source-analysis.js

@@ -0,0 +1,45 @@
+import "node:module";
+import { parse } from "@babel/parser";
+import traverse, { Hub, NodePath } from "@babel/traverse";
+import * as __rspack_external__babel_types_6e8337dd from "@babel/types";
+const consumerParserPlugins = (filePath)=>/\.[jt]sx$/u.test(filePath) ? [
+        "typescript",
+        'jsx'
+    ] : [
+        "typescript"
+    ];
+class SourceSyntaxError extends Error {
+}
+class SourceValidationHub extends Hub {
+    buildError(_node, message) {
+        return new SourceSyntaxError(message);
+    }
+}
+function parseSource(source, filename, syntaxMessage) {
+    try {
+        return parse(source, {
+            sourceType: 'module',
+            sourceFilename: filename,
+            plugins: consumerParserPlugins(filename)
+        });
+    } catch (cause) {
+        if ('object' == typeof cause && null !== cause && 'code' in cause && 'BABEL_PARSER_SYNTAX_ERROR' === cause.code && 'reasonCode' in cause && 'string' == typeof cause.reasonCode) throw new SourceSyntaxError(syntaxMessage ?? (cause instanceof Error ? cause.message : String(cause)));
+        throw cause;
+    }
+}
+function traverseSource(file, visitor) {
+    const program = NodePath.get({
+        hub: new SourceValidationHub(),
+        parentPath: void 0,
+        parent: file,
+        container: file,
+        key: 'program'
+    });
+    program.setContext();
+    traverse(file, visitor, program.scope, void 0, program);
+}
+function unwrapExpression(node, includeAssertions = false) {
+    while(__rspack_external__babel_types_6e8337dd.isTSAsExpression(node) || __rspack_external__babel_types_6e8337dd.isParenthesizedExpression(node) || __rspack_external__babel_types_6e8337dd.isTSSatisfiesExpression(node) || includeAssertions && (__rspack_external__babel_types_6e8337dd.isTSTypeAssertion(node) || __rspack_external__babel_types_6e8337dd.isTSNonNullExpression(node)))node = node.expression;
+    return node;
+}
+export { SourceSyntaxError, consumerParserPlugins, parseSource, traverseSource, unwrapExpression };

package/dist/esm-node/strict-effect-runtime.js

@@ -1,24 +1,13 @@
 import "node:module";
 import node_fs from "node:fs";
 import node_path from "node:path";
-import { parse } from "@babel/parser";
-import traverse, { Hub, NodePath } from "@babel/traverse";
+import { SourceSyntaxError, parseSource, traverseSource, unwrapExpression } from "./source-analysis.js";
 import * as __rspack_external__babel_types_6e8337dd from "@babel/types";
 const edge = '@modern-js/bff-effect/effect-edge';
 const nodeRuntime = '@modern-js/bff-effect/effect';
-const sharedRuntime = /^@[^/]+\/shared-contracts\/server\/effect-bff-runtime$/u;
-const failure = 'Generated API entries must export defineEffectBff(...) or the server-only shared Effect BFF assembly helper with an explicitly composed handler Layer and an unshadowed executable root; entries must implement handlers through HttpApiBuilder.group.';
-const invalidSources = new WeakSet();
-function invalidSource(message) {
-    const error = new Error(message);
-    invalidSources.add(error);
-    return error;
-}
-class SourceValidationHub extends Hub {
-    buildError(_node, message) {
-        return invalidSource(message);
-    }
-}
+const assembly = '@modern-js/bff-effect/assembly';
+const failure = 'Generated API entries must export defineEffectBff(...) or the native Effect BFF assembly helper with an explicitly composed handler Layer and an unshadowed executable root; entries must implement handlers through HttpApiBuilder.group.';
+const MAX_API_SOURCE_MODULES = 256;
 function createEffectApiImportResolver(filename) {
     const directory = node_fs.realpathSync(node_path.dirname(filename));
     const owner = node_fs.realpathSync(node_path.resolve(directory, '..'));
@@ -50,34 +39,14 @@ function strictEffectRuntimeTopologyViolation(source, resolveImport) {
     const load = (input)=>{
         const existing = modules.get(input.id);
         if (existing) return existing;
-        if (modules.size >= 64 || input.source.length > 1000000) throw invalidSource('API source budget exceeded');
-        let file;
-        try {
-            file = parse(input.source, {
-                sourceType: 'module',
-                sourceFilename: input.id,
-                plugins: [
-                    "typescript"
-                ]
-            });
-        } catch (cause) {
-            if ('object' == typeof cause && null !== cause && 'code' in cause && 'BABEL_PARSER_SYNTAX_ERROR' === cause.code && 'reasonCode' in cause && 'string' == typeof cause.reasonCode) throw invalidSource('Invalid API syntax');
-            throw cause;
-        }
+        if (modules.size >= MAX_API_SOURCE_MODULES || input.source.length > 1000000) throw new SourceSyntaxError('API source budget exceeded');
+        const file = parseSource(input.source, input.id, 'Invalid API syntax');
         const module = {
             ...input,
             file
         };
         modules.set(input.id, module);
-        const program = NodePath.get({
-            hub: new SourceValidationHub(),
-            parentPath: void 0,
-            parent: file,
-            container: file,
-            key: 'program'
-        });
-        program.setContext();
-        traverse(file, {
+        traverseSource(file, {
             enter (nodePath) {
                 paths.set(nodePath.node, nodePath);
                 owners.set(nodePath.node, module);
@@ -96,7 +65,7 @@ function strictEffectRuntimeTopologyViolation(source, resolveImport) {
                     if (binding) mutated.add(binding);
                 }
             }
-        }, program.scope, void 0, program);
+        });
         return module;
     };
     try {
@@ -105,10 +74,7 @@ function strictEffectRuntimeTopologyViolation(source, resolveImport) {
             source,
             resolveImport
         });
-        const unwrap = (node)=>{
-            while(__rspack_external__babel_types_6e8337dd.isParenthesizedExpression(node) || __rspack_external__babel_types_6e8337dd.isTSSatisfiesExpression(node) || __rspack_external__babel_types_6e8337dd.isTSAsExpression(node) || __rspack_external__babel_types_6e8337dd.isTSTypeAssertion(node) || __rspack_external__babel_types_6e8337dd.isTSNonNullExpression(node))node = node.expression;
-            return node;
-        };
+        const unwrap = (node)=>unwrapExpression(node, true);
         const binding = (node)=>{
             node = unwrap(node);
             if (!__rspack_external__babel_types_6e8337dd.isIdentifier(node)) return;
@@ -237,7 +203,7 @@ function strictEffectRuntimeTopologyViolation(source, resolveImport) {
             if (!__rspack_external__babel_types_6e8337dd.isBlockStatement(body)) return body;
             const statements = body.body;
             const last = statements.at(-1);
-            return statements.slice(0, -1).every((statement)=>__rspack_external__babel_types_6e8337dd.isVariableDeclaration(statement)) && __rspack_external__babel_types_6e8337dd.isReturnStatement(last) ? last.argument : void 0;
+            return statements.slice(0, -1).every((statement)=>__rspack_external__babel_types_6e8337dd.isVariableDeclaration(statement) || __rspack_external__babel_types_6e8337dd.isTSTypeAliasDeclaration(statement) || __rspack_external__babel_types_6e8337dd.isTSInterfaceDeclaration(statement)) && __rspack_external__babel_types_6e8337dd.isReturnStatement(last) ? last.argument : void 0;
         };
         const pipe = (node, check)=>__rspack_external__babel_types_6e8337dd.isMemberExpression(node.callee) && !node.callee.computed && __rspack_external__babel_types_6e8337dd.isIdentifier(node.callee.property, {
                 name: 'pipe'
@@ -326,7 +292,7 @@ function strictEffectRuntimeTopologyViolation(source, resolveImport) {
                 if (value?.name === 'defineEffectBff' && [
                     edge,
                     nodeRuntime
-                ].includes(value.specifier) || value?.name === 'assembleEffectBffRuntime' && sharedRuntime.test(value.specifier)) {
+                ].includes(value.specifier) || value?.name === 'assembleEffectBffRuntime' && value.specifier === assembly) {
                     if (1 !== node.arguments.length) return false;
                     const values = properties(node.arguments[0]);
                     if (!values) return false;
@@ -349,7 +315,7 @@ function strictEffectRuntimeTopologyViolation(source, resolveImport) {
         const root = entry.file.program.body.find((statement)=>__rspack_external__babel_types_6e8337dd.isExportDefaultDeclaration(statement));
         return root && runtime(root.declaration) ? void 0 : failure;
     } catch (cause) {
-        if ('object' == typeof cause && null !== cause && invalidSources.has(cause)) return failure;
+        if (cause instanceof SourceSyntaxError) return failure;
         const message = 'object' == typeof cause && null !== cause && 'message' in cause && 'string' == typeof cause.message ? cause.message : String(cause);
         throw new Error(`Strict Effect API analysis failed: ${message}`, {
             cause

package/dist/types/microvertical-api-baseline.d.ts

@@ -1,8 +1,3 @@
-/**
- * Only `.tsx` is JSX. Enabling JSX for a `.ts` file misreads a generic arrow
- * such as `const f = <T>(value: T) => value` as an unclosed JSX element.
- */
-export declare const consumerParserPlugins: (filePath: string) => ('typescript' | 'jsx')[];
 export interface MicroVerticalApiBaselineExpectation {
     /** Optional override for operation IDs outside reachable endpoint naming conventions. */
     readonly operationPaths?: Readonly<Record<string, string>>;

package/dist/types/source-analysis.d.ts

@@ -0,0 +1,10 @@
+import { type Visitor } from '@babel/traverse';
+import * as t from '@babel/types';
+/** Only JSX extensions enable JSX: generic arrows in .ts must remain valid. */
+export declare const consumerParserPlugins: (filePath: string) => ('typescript' | 'jsx')[];
+/** Only parser/binder diagnostics are policy violations; tool failures escape. */
+export declare class SourceSyntaxError extends Error {
+}
+export declare function parseSource(source: string, filename: string, syntaxMessage?: string): t.File;
+export declare function traverseSource(file: t.File, visitor: Visitor): void;
+export declare function unwrapExpression(node: t.Node, includeAssertions?: boolean): t.Node;

package/package.json

@@ -23,7 +23,7 @@
   "engines": {
     "node": ">=20"
   },
-  "version": "3.9.0-ultramodern.11",
+  "version": "3.9.0-ultramodern.13",
   "types": "./dist/types/index.d.ts",
   "main": "./dist/esm-node/index.js",
   "typesVersions": {
@@ -72,15 +72,16 @@
     "bin"
   ],
   "dependencies": {
-    "@babel/parser": "^8.0.4",
-    "@babel/traverse": "^8.0.4",
-    "@babel/types": "^8.0.4",
-    "oxlint": "1.81.0"
+    "@babel/parser": "^8.0.6",
+    "@babel/traverse": "^8.0.6",
+    "@babel/types": "^8.0.6",
+    "oxlint": "1.85.0",
+    "resolve.exports": "2.0.3"
   },
   "devDependencies": {
-    "@rslib/core": "1.0.0",
+    "@rslib/core": "1.0.2",
     "@scripts/rstest-config": "2.66.0",
-    "@types/node": "^26.4.1",
+    "@types/node": "^26.6.2",
     "@typescript/native-preview": "7.0.0-dev.20260707.2"
   },
   "sideEffects": false,