@hublo/sentinel 1.2.0-alpha.2 → 1.2.0-alpha.21

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   registerAdapters,
   resolve,
   setDefaultRunner
-} from "./chunk-SA2RMTVI.js";
+} from "./chunk-RKVGZNJ7.js";
 export {
   BaseAdapter,
   all,

package/dist/roles/build/nest/toolchain.d.ts

@@ -0,0 +1,130 @@
+import { UserConfig, Plugin } from 'vite';
+export { Plugin, PluginOption, UserConfig, UserConfigExport, defineConfig, loadEnv, mergeConfig } from 'vite';
+
+/** A transformer as the target declares it, passed through to the config unchanged. */
+interface TransformerDeclaration$1 {
+    name: string;
+    options?: Record<string, unknown>;
+}
+/** An asset as the target declares it, in `@nx/webpack`'s own shape. */
+interface AssetDeclaration {
+    glob: string;
+    /** Relative to the workspace root, as the target declares it. */
+    input: string;
+    /** Relative to the output directory. */
+    output: string;
+}
+
+interface NestServiceOptions {
+    /** The nx project name. Keys the dependency graph, and names the module in messages. */
+    project: string;
+    /** Absolute path to the module's directory, normally `__dirname`. */
+    root: string;
+    /** Absolute path to the workspace root. */
+    workspaceRoot: string;
+    /** Entry point, relative to `root`. */
+    entry?: string;
+    /**
+     * The tsconfig whose emit must be preserved, when the service uses neither conventional name.
+     *
+     * Relative to `root`. Defaults to `tsconfig.app.json`, then `tsconfig.json`.
+     */
+    tsconfig?: string;
+    /** Output directory, relative to `workspaceRoot`. */
+    outDir?: string;
+    /**
+     * TypeScript transformers this service compiles with, as its build target declared them.
+     *
+     * Read off the webpack target by `--init` and written here, never inferred: what a service
+     * compiles with is the service's own. Eight services and BFFs run `@nestjs/swagger/plugin`,
+     * which writes the `@ApiProperty` decorators their DTOs do not declare by hand. Building
+     * without it succeeds and silently costs them most of their published contract (measured on
+     * `institution`: 385 insertions, 1378 deletions in the committed OpenAPI document).
+     */
+    transformers?: readonly TransformerDeclaration$1[];
+    /**
+     * Files copied into the output beside the bundle, in the shape `@nx/webpack` declared them.
+     *
+     * One service here uses it: `planning-period` ships the pug, css and ttf templates it renders
+     * printed documents from. Without them the service starts and fails on its first print.
+     */
+    assets?: readonly AssetDeclaration[];
+    /**
+     * Anything this service needs that the shape does not give it.
+     *
+     * Merged with Vite's own `mergeConfig`, never with a merge of our own: plugins concatenate
+     * and aliases stack the way Vite does it everywhere else, so there is no second set of
+     * semantics to learn or to document.
+     */
+    overrides?: UserConfig;
+}
+declare const nestService: (options: NestServiceOptions) => UserConfig;
+
+/** A TypeScript transformer a service runs at build time, as its build target declares it. */
+interface TransformerDeclaration {
+    /** The package to load it from, e.g. `@nestjs/swagger/plugin`. */
+    name: string;
+    /** Passed to the transformer's own factory, unread here. */
+    options?: Record<string, unknown>;
+}
+interface DecoratorMetadataOptions {
+    /** The module being built. Its tsconfig is the one whose emit must be preserved. */
+    root: string;
+    /**
+     * An explicit tsconfig, when the service does not use either conventional name.
+     *
+     * Relative paths resolve against `root`.
+     */
+    tsconfig?: string;
+    /** The transformers this service declared, translated from its webpack target. */
+    transformers?: readonly TransformerDeclaration[];
+}
+declare const decoratorMetadata: (options: DecoratorMetadataOptions) => Plugin;
+
+interface NodeManifestOptions {
+    /** The nx project name, which is how the graph is keyed. */
+    project: string;
+    /** Absolute path to the workspace root. */
+    workspaceRoot: string;
+    /** Where the bundle is written; the two files land beside it. */
+    outDir: string;
+    /** Entry file name, written as `main` so `node .` resolves inside the image. */
+    entry?: string;
+    /**
+     * Packages the IMAGE provides, which are therefore allowed to be required without being
+     * declared in the manifest.
+     *
+     * The generated Prisma clients are the case this exists for: the Dockerfile copies
+     * `node_modules/@prisma` from its own stage, so they resolve at runtime while no module
+     * declares them. Everything else that is required and undeclared is a bug, and the check
+     * below refuses the build.
+     */
+    providedByImage?: readonly string[];
+}
+/**
+ * Writes the manifest and lockfile once the bundle is on disk.
+ *
+ * `closeBundle` rather than `writeBundle`, so the files land after Vite has finished with the
+ * directory and cannot be cleared by `emptyOutDir`.
+ *
+ * `closeBundle` also runs after a FAILED build, where there is no directory to write into. Left
+ * alone this hook then threw `ENOENT` on the manifest, and since it is the last error raised it
+ * became the one Vite printed, hiding the failure that actually stopped the build. It cost two
+ * diagnoses before being recognised, so the missing directory is now read as what it is: the
+ * bundle was never written, and this plugin has nothing to say about why.
+ */
+declare const nodeManifest: (options: NodeManifestOptions) => Plugin;
+
+interface Alias {
+    find: RegExp;
+    replacement: string;
+}
+/**
+ * Read the mappings from the workspace's base tsconfig.
+ *
+ * Longest pattern first, because Vite takes the first alias that matches and the mappings
+ * overlap by design: `@front/theme/node` must not be swallowed by `@front/theme`.
+ */
+declare const tsconfigAliases: (workspaceRoot: string, file?: string) => Alias[];
+
+export { type Alias, type DecoratorMetadataOptions, type NestServiceOptions, type NodeManifestOptions, decoratorMetadata, nestService, nodeManifest, tsconfigAliases };

package/dist/roles/build/nest/toolchain.js

@@ -0,0 +1,403 @@
+// src/roles/build/nest/nest-service.ts
+import { join as join4 } from "path";
+import { mergeConfig } from "vite";
+
+// src/roles/build/nest/copy-assets.ts
+import { cpSync, existsSync, mkdirSync, readdirSync, statSync } from "fs";
+import { dirname, join, relative, sep } from "path";
+function globToRegExp(glob) {
+  let pattern = "";
+  for (let index = 0; index < glob.length; index++) {
+    const char = glob[index] ?? "";
+    if (char === "*") {
+      if (glob[index + 1] === "*") {
+        pattern += glob[index + 2] === "/" ? "(?:.*/)?" : ".*";
+        index += glob[index + 2] === "/" ? 2 : 1;
+      } else {
+        pattern += "[^/]*";
+      }
+      continue;
+    }
+    if (char === "{") {
+      const close = glob.indexOf("}", index);
+      if (close === -1)
+        throw new Error(`sentinel build(nest): unbalanced \`{\` in asset glob ${glob}`);
+      const alternatives = glob.slice(index + 1, close).split(",");
+      pattern += `(?:${alternatives.map((one) => one.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})`;
+      index = close;
+      continue;
+    }
+    pattern += char.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${pattern}$`);
+}
+function filesUnder(root) {
+  const found = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir)) {
+      const full = join(dir, entry);
+      if (statSync(full).isDirectory()) walk(full);
+      else found.push(relative(root, full).split(sep).join("/"));
+    }
+  };
+  walk(root);
+  return found;
+}
+function resolveAssets(options) {
+  const copies = [];
+  for (const asset of options.assets) {
+    const input = join(options.workspaceRoot, asset.input);
+    if (!existsSync(input)) {
+      throw new Error(
+        `sentinel build(nest): the build target declares an asset from \`${asset.input}\`, which does not exist. webpack copied it into the output, so the built service would be missing files it reads at runtime.`
+      );
+    }
+    const matcher = globToRegExp(asset.glob);
+    const matched = filesUnder(input).filter((file) => matcher.test(file));
+    if (matched.length === 0) {
+      throw new Error(
+        `sentinel build(nest): the asset glob \`${asset.glob}\` under \`${asset.input}\` matches no file. An entry that matches nothing is the same silent loss as no entry at all.`
+      );
+    }
+    for (const file of matched) {
+      copies.push({ from: join(input, file), to: join(options.outDir, asset.output, file) });
+    }
+  }
+  return copies;
+}
+var copyAssets = (options) => ({
+  name: "sentinel:copy-assets",
+  // After the bundle is written and the output directory has stopped being emptied.
+  closeBundle() {
+    for (const { from, to } of resolveAssets(options)) {
+      mkdirSync(dirname(to), { recursive: true });
+      cpSync(from, to);
+    }
+  }
+});
+
+// src/roles/build/nest/decorator-metadata.ts
+import { existsSync as existsSync2 } from "fs";
+import { createRequire } from "module";
+import path from "path";
+var TYPESCRIPT_SOURCE = /\.ts$/;
+var TSCONFIG_CANDIDATES = ["tsconfig.app.json", "tsconfig.json"];
+function loadCompiler(root) {
+  const require2 = createRequire(path.join(root, "noop.js"));
+  let compiler;
+  try {
+    compiler = require2("typescript");
+  } catch {
+    throw new Error(
+      `sentinel build(nest): no \`typescript\` resolvable from ${root}. The build emits decorator metadata with the module's own compiler, so one has to be installed there.`
+    );
+  }
+  if (typeof compiler.createProgram !== "function") {
+    throw new Error(
+      `sentinel build(nest): the typescript resolved from ${root} (${compiler.version ?? "unknown"}) has no createProgram API. TypeScript 7 is the native port and exposes none; the emit API lives under @typescript/typescript6. Point this module's \`typescript\` at a compiler with an emit API, which is the one its \`typecheck\` target already uses.`
+    );
+  }
+  return compiler;
+}
+function resolveTsconfig(options) {
+  if (options.tsconfig) {
+    const explicit = path.resolve(options.root, options.tsconfig);
+    if (!existsSync2(explicit)) {
+      throw new Error(`sentinel build(nest): tsconfig not found at ${explicit}`);
+    }
+    return explicit;
+  }
+  for (const candidate of TSCONFIG_CANDIDATES) {
+    const found = path.join(options.root, candidate);
+    if (existsSync2(found)) return found;
+  }
+  throw new Error(
+    `sentinel build(nest): no ${TSCONFIG_CANDIDATES.join(" or ")} in ${options.root}. Pass \`tsconfig\` if this service keeps it elsewhere.`
+  );
+}
+function readConfig(ts, options) {
+  const configPath = resolveTsconfig(options);
+  const parsed = ts.getParsedCommandLineOfConfigFile(configPath, {}, {
+    ...ts.sys,
+    onUnRecoverableConfigFileDiagnostic: (diagnostic) => {
+      throw new Error(
+        `sentinel build(nest): could not read ${configPath}: ` + ts.flattenDiagnosticMessageText(diagnostic.messageText, " ")
+      );
+    }
+  });
+  return {
+    fileNames: parsed?.fileNames ?? [],
+    compilerOptions: {
+      ...parsed?.options,
+      // ESM out, so Rollup sees imports and exports rather than an opaque `require` it cannot
+      // follow. The service still SHIPS as CJS: that conversion is the bundler's, further down.
+      module: ts.ModuleKind.ESNext,
+      // Vite consumes the map; the tsconfig's own answer is about a different pipeline.
+      sourceMap: true,
+      inlineSourceMap: false,
+      inlineSources: false,
+      // Types are another target's job, and emitting them here would write into the source tree.
+      declaration: false,
+      declarationMap: false,
+      emitDeclarationOnly: false,
+      noEmit: false,
+      // `composite` projects refuse to emit without a `tsBuildInfoFile`, and there is no
+      // incremental build here to inform.
+      composite: false,
+      incremental: false
+    }
+  };
+}
+function loadTransformers(root, program, declared) {
+  const require2 = createRequire(path.join(root, "noop.js"));
+  return declared.map(({ name, options }) => {
+    let loaded;
+    try {
+      loaded = require2(name);
+    } catch (error) {
+      throw new Error(
+        `sentinel build(nest): the build target declares the transformer \`${name}\`, which cannot be loaded from ${root}: ${error instanceof Error ? error.message : String(error)}`,
+        { cause: error }
+      );
+    }
+    if (typeof loaded.before !== "function") {
+      throw new Error(
+        `sentinel build(nest): \`${name}\` exports no \`before\` factory, so it cannot run as a TypeScript transformer. Building without it would drop whatever it contributes.`
+      );
+    }
+    const factory = loaded.before;
+    return factory(options, program);
+  });
+}
+var decoratorMetadata = (options) => {
+  const typeAware = (options.transformers ?? []).length > 0;
+  let ts;
+  let program;
+  let compilerOptions;
+  let before = [];
+  const withoutTypes = [];
+  return {
+    name: "sentinel:decorator-metadata",
+    // Before Vite's own transform, so esbuild never sees the decorators it cannot handle, and so
+    // the source this plugin reads from the Program is still the source on disk.
+    enforce: "pre",
+    buildStart() {
+      ts = loadCompiler(options.root);
+      const config = readConfig(ts, options);
+      compilerOptions = config.compilerOptions;
+      if (!typeAware) return;
+      program = ts.createProgram(config.fileNames, config.compilerOptions);
+      before = loadTransformers(options.root, program, options.transformers ?? []);
+    },
+    transform(code, id) {
+      if (!TYPESCRIPT_SOURCE.test(id) || id.includes("node_modules")) return null;
+      if (ts === void 0 || compilerOptions === void 0) {
+        throw new Error(
+          `sentinel build(nest): the compiler was never prepared, so ${id} would be emitted with defaults rather than this module's tsconfig.`
+        );
+      }
+      const sourceFile = program?.getSourceFile(id);
+      if (program === void 0 || sourceFile === void 0 || sourceFile.text !== code) {
+        if (typeAware) withoutTypes.push(id);
+        const output = ts.transpileModule(code, { fileName: id, compilerOptions });
+        return { code: output.outputText, map: output.sourceMapText ?? null };
+      }
+      let emitted;
+      let map;
+      program.emit(
+        sourceFile,
+        (fileName, text) => {
+          if (fileName.endsWith(".map")) map = text;
+          else emitted = text;
+        },
+        void 0,
+        false,
+        { before }
+      );
+      if (emitted === void 0) {
+        throw new Error(`sentinel build(nest): TypeScript emitted nothing for ${id}.`);
+      }
+      return { code: emitted, map: map ?? null };
+    },
+    closeBundle() {
+      if (withoutTypes.length === 0) return;
+      const shown = withoutTypes.slice(0, 5).map((file) => path.relative(options.root, file));
+      this.warn(
+        `sentinel build(nest): ${withoutTypes.length} file(s) were emitted without type information, so their decorator metadata may differ from what ts-loader produced (${shown.join(", ")}${withoutTypes.length > shown.length ? ", \u2026" : ""}). They are outside this module's tsconfig, or another plugin rewrote them first.`
+      );
+    }
+  };
+};
+
+// src/roles/build/nest/node-manifest.ts
+import { existsSync as existsSync3, writeFileSync } from "fs";
+import { isBuiltin } from "module";
+import { join as join2 } from "path";
+var DEFAULT_PROVIDED_BY_IMAGE = ["@prisma"];
+var externalPackages = (bundle) => {
+  const emitted = new Set(Object.keys(bundle));
+  const packages = /* @__PURE__ */ new Set();
+  for (const emittedFile of Object.values(bundle)) {
+    if (emittedFile.type !== "chunk") continue;
+    for (const imported of emittedFile.imports) {
+      if (emitted.has(imported)) continue;
+      if (imported.startsWith(".") || imported.startsWith("/")) continue;
+      if (isBuiltin(imported)) continue;
+      const parts = imported.split("/");
+      const name = imported.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+      if (name) packages.add(name);
+    }
+  }
+  return packages;
+};
+var nodeManifest = (options) => {
+  let required;
+  return {
+    name: "sentinel:node-manifest",
+    apply: "build",
+    generateBundle(_outputOptions, bundle) {
+      required = externalPackages(bundle);
+    },
+    async closeBundle() {
+      const entry = options.entry ?? "main.js";
+      if (!existsSync3(join2(options.outDir, entry))) return;
+      const { createProjectGraphAsync } = await import("nx/src/devkit-exports.js");
+      const { createPackageJson, createLockFile, getLockFileName } = await import("@nx/js");
+      const graph = await createProjectGraphAsync({ exitOnError: false });
+      const manifest = createPackageJson(options.project, graph, {
+        root: options.workspaceRoot,
+        isProduction: true
+      });
+      manifest.main = entry;
+      if (required === void 0) {
+        throw new Error(
+          `sentinel build(nest): the bundle was written but never inspected, so the manifest could not be checked against what it requires. Refusing to write one that might not install.`
+        );
+      }
+      assertManifestCovers(required, manifest, options);
+      writeFileSync(join2(options.outDir, "package.json"), `${JSON.stringify(manifest, null, 2)}
+`);
+      writeFileSync(
+        join2(options.outDir, getLockFileName("pnpm")),
+        createLockFile(manifest, graph, "pnpm")
+      );
+    }
+  };
+};
+var assertManifestCovers = (required, manifest, options) => {
+  const declared = new Set(Object.keys(manifest.dependencies ?? {}));
+  const provided = options.providedByImage ?? DEFAULT_PROVIDED_BY_IMAGE;
+  const missing = [...required].filter((name) => !declared.has(name)).filter((name) => !provided.some((prefix) => name === prefix || name.startsWith(`${prefix}/`))).sort();
+  if (missing.length === 0) return;
+  throw new Error(
+    `sentinel build(nest): the bundle requires ${missing.length} package(s) the generated manifest does not declare, so the image would not install them: ${missing.join(", ")}. Either declare them in the module's package.json, inline them with \`ssr.noExternal\`, or list them in \`providedByImage\` if the Dockerfile copies them in.`
+  );
+};
+
+// src/roles/build/nest/tsconfig-aliases.ts
+import { readFileSync } from "fs";
+import { join as join3 } from "path";
+var stripLineComments = (json) => json.replace(/^\s*\/\/.*$/gm, "");
+var toAlias = (workspaceRoot, pattern, target) => {
+  const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\\\*/g, "(.*)");
+  return {
+    find: new RegExp(`^${escaped}$`),
+    replacement: join3(workspaceRoot, target.replace(/\*/g, "$1"))
+  };
+};
+var tsconfigAliases = (workspaceRoot, file = "tsconfig.base.json") => {
+  const raw = readFileSync(join3(workspaceRoot, file), "utf8");
+  const { compilerOptions } = JSON.parse(stripLineComments(raw));
+  return Object.entries(compilerOptions?.paths ?? {}).flatMap(([pattern, targets]) => {
+    const [target] = targets;
+    return target === void 0 ? [] : [toAlias(workspaceRoot, pattern, target)];
+  }).sort((a, b) => b.find.source.length - a.find.source.length);
+};
+
+// src/roles/build/nest/nest-service.ts
+var baseConfig = (options) => {
+  const outDir = join4(options.workspaceRoot, options.outDir ?? `dist/${options.project}`);
+  const entry = join4(options.root, options.entry ?? "src/main.ts");
+  return {
+    plugins: [
+      decoratorMetadata({
+        root: options.root,
+        tsconfig: options.tsconfig,
+        transformers: options.transformers
+      }),
+      ...options.assets?.length ? [copyAssets({ workspaceRoot: options.workspaceRoot, outDir, assets: options.assets })] : [],
+      nodeManifest({
+        project: options.project,
+        workspaceRoot: options.workspaceRoot,
+        outDir
+      })
+    ],
+    resolve: { alias: tsconfigAliases(options.workspaceRoot) },
+    ssr: {
+      // `importHelpers: true` in the workspace tsconfig makes TypeScript emit `require("tslib")`
+      // for `__decorate` and `__metadata`, so every decorated file depends on it. Hoisted into
+      // one scope Rollup inlined it and nobody noticed; preserving modules left it external, and
+      // the manifest nx generates from the project graph does not list it, because no module
+      // DECLARES tslib. The image therefore did not install it and the service died on its first
+      // require, only in the image: locally and in CI the workspace root has tslib.
+      noExternal: ["tslib"]
+    },
+    build: {
+      // An SSR build targets Node and leaves real packages external, which is what
+      // `webpack-node-externals` did: the image installs them from the generated manifest.
+      ssr: entry,
+      outDir,
+      emptyOutDir: true,
+      sourcemap: true,
+      target: "node20",
+      // The bundle is read by humans when a stack trace points into it, and minifying a
+      // server bundle buys nothing: it is never downloaded.
+      minify: false,
+      rollupOptions: {
+        output: {
+          format: "cjs",
+          // One output file per source module, instead of hoisting everything into one scope.
+          //
+          // This is not a preference, it is the only shape that keeps the OpenAPI contract.
+          // Merging every module into one scope forces Rollup to rename duplicate class names,
+          // and `@nestjs/swagger` keys its schemas on `class.name`, so a renamed class silently
+          // becomes a renamed schema in the published API. Measured on `network`, which has two
+          // such collisions: single bundle renames `InvalidPermissionError` and
+          // `PermissionNotFoundError`; preserving modules renames nothing and reproduces the
+          // committed contract byte for byte.
+          //
+          // The cost is 4.5 MB across 2003 files against 2.9 MB in one, still well under
+          // webpack's 6.9 MB for the same service, so nothing regresses against what it replaces.
+          preserveModules: true,
+          // The image runs `./dist/main.js`, so the entry keeps that name at the root while
+          // every other module keeps its own path. Under `preserveModules` a plain string here
+          // would be applied to all of them, which numbers them (`main962.js`) and loses the
+          // entry.
+          entryFileNames: (chunk) => chunk.facadeModuleId === entry ? "main.js" : "[name].js"
+        },
+        // Nest registers metadata as an IMPORT SIDE EFFECT: a decorator writes into a catalog
+        // when its module loads, and nothing references that module afterwards. Rollup may
+        // drop such a module; webpack never did.
+        //
+        // Measured on the first migrated service this changes nothing, so it is insurance
+        // rather than a fix, and it is recorded as such rather than credited with the smaller
+        // bundle (that comes from barrel re-exports the service does not use).
+        treeshake: { moduleSideEffects: true }
+      }
+    }
+  };
+};
+var nestService = (options) => options.overrides === void 0 ? baseConfig(options) : mergeConfig(baseConfig(options), options.overrides);
+
+// src/roles/build/nest/toolchain.ts
+import { defineConfig, loadEnv, mergeConfig as mergeConfig2 } from "vite";
+export {
+  decoratorMetadata,
+  defineConfig,
+  loadEnv,
+  mergeConfig2 as mergeConfig,
+  nestService,
+  nodeManifest,
+  tsconfigAliases
+};
+//# sourceMappingURL=toolchain.js.map

package/dist/roles/test/react/toolchain.d.ts

@@ -0,0 +1,2 @@
+export { ConfigEnv, TestUserConfig, ViteUserConfig, defineConfig, mergeConfig } from 'vitest/config';
+export { loadEnv } from 'vite';

package/dist/roles/test/react/toolchain.js

@@ -0,0 +1,9 @@
+// src/roles/test/react/toolchain.ts
+import { defineConfig, mergeConfig } from "vitest/config";
+import { loadEnv } from "vite";
+export {
+  defineConfig,
+  loadEnv,
+  mergeConfig
+};
+//# sourceMappingURL=toolchain.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hublo/sentinel",
-  "version": "1.2.0-alpha.2",
+  "version": "1.2.0-alpha.21",
   "description": "One CLI that guards code health across Hublo repos: shared lint/typescript/build/test presets, static & dynamic analysis, and architecture checks.",
   "type": "module",
   "license": "MIT",
@@ -41,6 +41,14 @@
     "./build/react": {
       "types": "./dist/roles/build/toolchain.d.ts",
       "import": "./dist/roles/build/toolchain.js"
+    },
+    "./build/nest": {
+      "types": "./dist/roles/build/nest/toolchain.d.ts",
+      "import": "./dist/roles/build/nest/toolchain.js"
+    },
+    "./test/react": {
+      "types": "./dist/roles/test/react/toolchain.d.ts",
+      "import": "./dist/roles/test/react/toolchain.js"
     }
   },
   "files": [
@@ -66,8 +74,10 @@
     "oxfmt": "0.63.0",
     "oxlint": "1.77.0",
     "oxlint-tsgolint": "7.0.2001",
-    "vite": "8.0.8",
-    "vite-plugin-svgr": "5.2.0"
+    "typescript": "5.9.3",
+    "vite": "8.2.2",
+    "vite-plugin-svgr": "5.2.0",
+    "vitest": "4.1.4"
   },
   "devDependencies": {
     "@hublo/sentinel": "link:.",
@@ -96,6 +106,18 @@
       }
     }
   },
+  "peerDependencies": {
+    "@nx/js": ">= 21",
+    "nx": ">= 21"
+  },
+  "peerDependenciesMeta": {
+    "nx": {
+      "optional": true
+    },
+    "@nx/js": {
+      "optional": true
+    }
+  },
   "scripts": {
     "build": "tsup && tsx scripts/build-presets.ts",
     "dev": "tsup --watch",