@skyf0xx/hedgehog-core-full-stack-app 1.0.14 → 1.2.0

package/CLAUDE.core.md

@@ -22,46 +22,25 @@ steps from memory:
   `hedgehog verify`, which commits it on a pass. Also holds the Correction
   Protocol for fixing a wrong upstream step. Invoke it at the start of any
   build session and for "what's next".
+<!-- hedgehog:bootstrap-only start -->
 - **`hedgehog-bootstrap`** — run **once**, at project start, to scaffold
   the core stack, the enforcement config, and whichever add-ons (Auth,
   Queue, Mobile) planning intake turned on. Skip if `nx.json` already
   exists.
+<!-- hedgehog:bootstrap-only end -->
 - **`conventional-commits`** — when a change spans several steps in one
   working-tree pass and needs splitting back into per-step commits (mainly
   Correction Protocol cleanups).
 
 ### The agents — delegate the judgment calls
 
-- **`planner`** — planning intake (which core applies, then
-  `hedgehog-planning-intake`'s BMAD-METHOD brainstorming/brief/PRD/UX-spec
-  shelf, mined into intent records, the Add-ons decision, and domain
-  vocabulary) at project start. Writes intents via `hedgehog intent add`,
-  `.hedgehog/addons.yaml`, and `.hedgehog/BMAD/`. On first run, hands off
-  to the `bootstrap` agent once Confirm & Lock holds. Runs again whenever
-  new scope enters play — including after the build is complete — taking
-  `hedgehog-planning-intake`'s **Re-entry pass**: the BMAD shelf and
-  `bootstrap` are both skipped, new modules are mined into additional
-  intents, and `hedgehog plan` appends their tasks without touching
-  anything already built.
-- **`bootstrap`** — runs `hedgehog-bootstrap`'s core steps (always) plus
-  whichever add-on steps planning intake turned on. Triggered
-  automatically by `planner` after its first run; skip if `nx.json`
-  already exists.
-- **`backend-eng`** — builds each module's Phase A layers (schema →
-  contract → repository → service → controller → queue?), one
-  `hedgehog claim`ed packet at a time, gated by `hedgehog verify`.
-- **`ux-planner`** — once per module in Phase B, after the hook exists and
-  before the screen: writes `docs/design/<module>.md`, reading
-  `.hedgehog/BMAD/05-ux-spec/` directly (or
-  `docs/design/<module>-notes.md` if a prior run already filed one). Where
-  the archive holds no UX spec, it asks for visual input rather than
-  inferring a direction.
-- **`front-end-eng`** — builds each module's Phase B layers (hook, screen)
-  from the ux-planner rationale, one `hedgehog claim`ed packet at a time,
-  gated by `hedgehog verify`.
-- **`reviewer`** — phase-transition and Correction Protocol checks the
-  mechanical gate can't make (port discipline, FK-by-ID discipline,
-  contract shape).
+`backend-eng` builds each module's Phase A layers (schema → contract →
+repository → service → controller → queue?), one `hedgehog claim`ed
+packet at a time, gated by `hedgehog verify`. `front-end-eng` builds
+each module's Phase B layers (hook, screen) from `ux-planner`'s
+rationale, the same way. See `hedgehog-loop` for exactly which agent
+owns which layer and the claim/verify sequencing — that skill is the
+source, not restated here.
 
 ## The constants (do not deviate)
 
@@ -121,9 +100,6 @@ docs/
   design     <module>.md (ux-planner, reading .hedgehog/BMAD/05-ux-spec/ directly)
 ```
 
-Check `.hedgehog/addons.yaml` before assuming any "only if" line above is
-actually present in this codebase.
-
 ### Core rules
 
 - **One table = one domain module.** Each carries the full step sequence.

package/README.md

@@ -1,80 +1,57 @@
-# @skyf0xx/hedgehog-core-full-stack-app
+# Hedgehog Full-Stack App Core ⭐
 
-Hedgehog's full-stack-app core: a pre-built, pre-verified Nx/pnpm
-workspace (NestJS + Drizzle + PostgreSQL on the backend, Next.js +
-ShadCN + Tailwind on the frontend, ts-rest contracts, TanStack Query
-hooks) plus the agents, skills, and manifest that drive a Hedgehog
-project built on it.
+### For: Well Architechted Full Stack Apps
 
-## Contents
+Every AI coding tool can scaffold an app. Most let the backend rot as it
+grows: auth logic scattered across routes, contracts drifting from the
+client, schema changes nobody tested.
 
-- `workspace/` — the workspace a Hedgehog install copies to a
-  project's repo root: Nx configuration, `packages/config`,
-  `packages/db`, `apps/api`, `apps/web`, and every enforcement file
-  (lefthook, commitlint, the CI phase gate).
-- `agents/` — `backend-eng`, `ux-planner`, `front-end-eng`.
-- `skills/` — `hedgehog-loop`, `hedgehog-bootstrap`,
-  `hedgehog-bootstrap-full-stack-app-core`, and the Nx tooling skills
-  (`nx-generate`, `nx-run-tasks`, `nx-workspace`,
-  `link-workspace-packages`).
-- `vendor-skills/GSAP` — the vendored asset set `hedgehog-loop`'s
-  build steps reference.
-- `CLAUDE.core.md` — fills a Hedgehog project's root `CLAUDE.md`
-  `{{CORE_SECTION}}` placeholder for this core.
-- `hedgehog-core.yaml` — this package's manifest: name, flag, the
-  selection prose the Hedgehog planner matches a project description
-  against, and which agents/skills/vendor skills it carries.
-- `scripts/regenerate-full-stack-app-core.sh` — the deterministic
-  generator that regenerates `workspace/` from scratch. Run by hand
-  when a workspace dependency needs bumping; not part of any install
-  path.
-- `repro/` — reproductions that drive `workspace/`'s real lefthook
-  configuration and pinned lefthook binary against a real `git commit`,
-  proving the commit gate runs on a fresh install and fails closed when
-  its tooling is missing.
+This core gives Hedgehog a backend that stays honest as it grows: one
+opinionated stack, one enforced build order, and a phase gate that
+blocks the next layer until the current one passes.
 
-## Using this package
+```mermaid
+flowchart LR
+    A[Schema] --> B[Contract]
+    B --> C[Repository]
+    C --> D[Service]
+    D --> E[Controller]
+    E --> F[Hook]
+    F --> G[Screen]
+```
 
-A Hedgehog installation depends on this package for the `full-stack-app`
-core rather than carrying its content directly. See the Hedgehog engine
-(`@skyf0xx/hedgehog`) for the installer and build-graph tooling that
-consumes it.
+## What you get
 
-## Working on this core
+- **NestJS + Drizzle + PostgreSQL** on the backend, **Next.js + ShadCN +
+  Tailwind** on the frontend, locked in once so every feature reuses the
+  same stack.
+- **ts-rest contracts** so the client can't drift from the API: one
+  shared type definition feeds both sides.
+- **TanStack Query hooks**, generated straight from the contracts.
+- **A commit gate** (lefthook + commitlint) that blocks a broken build
+  from ever reaching your history.
 
-This is a versioned npm package that the Hedgehog engine's `init` fetches
-by name, carrying `full-stack-app`'s own agents, skills, a pre-built
-workspace, and the `hedgehog-core.yaml` manifest that names all three to
-the engine. See the engine repo
-([`skyf0xx/hedgehog`](https://github.com/skyf0xx/hedgehog)) and its
-[`ARCHITECTURE.md`](https://github.com/skyf0xx/hedgehog/blob/master/ARCHITECTURE.md)
-for how `init` resolves and fetches a core package — that mechanism lives
-there, not here.
+## Built for production backend work
 
-No root `CLAUDE.md` lives in this repo. `CLAUDE.core.md` is a payload
-file: its content is installed into a *consuming project's* generated
-`CLAUDE.md`, filling that project's `{{CORE_SECTION}}` placeholder. A
-plain root `CLAUDE.md` here would auto-load into any coding agent working
-on this package itself, bleeding project-build context into a repo where
-no Hedgehog build ever runs — build guidance for a project using this
-core lives in that project's own generated `CLAUDE.md`, never here.
+Reach for this core when the project needs authorization beyond
+per-object rules, background jobs, scheduled work, webhooks, or
+server-rendered pages. These are the features that turn "add a database"
+into an ongoing maintenance job.
 
-Changing this core means editing one of: the `workspace/` template (the
-scaffold a Hedgehog install copies into a project's repo root), an agent
-under `agents/`, a skill under `skills/`, or the vendored asset set under
-`vendor-skills/GSAP`. `scripts/regenerate-full-stack-app-core.sh` is the
-deterministic generator that rebuilds `workspace/` from scratch — run it
-by hand after bumping a workspace dependency, then diff the result before
-committing. A change here is a release of this package, not of the
-engine: bump `package.json`'s version, commit, and merge to `main` — this
-repo's own `publish.yml` tags and publishes from there.
+## Easy to install and use
 
-When `workspace/`'s template needs a new piece of repeatable boilerplate
-— a new module shape, a new generated file type — prefer building or
-extending a generator over hand-authoring the output once. This core
-already models the pattern: `workspace/tools/generators/` carries Nx
-generators for every domain-module layer (`schema`, `contract`,
-`repository`, `service`, `controller`, `hook`, `screen`) that
-`nx-generate` drives instead of an agent writing that boilerplate
-freehand. Other cores and future add-ons should model new scaffolding
-against this one.
+Ask your agent:
+*"Install Hedgehog and build me a [your app idea]"*
+
+<details>
+<summary>For your agent</summary>
+
+```
+npx @skyf0xx/hedgehog init
+```
+
+```
+npx @skyf0xx/hedgehog init --ts-full-stack-app
+```
+
+Technical details: [ARCHITECTURE.md](ARCHITECTURE.md)

package/agents/backend-eng.md

@@ -51,12 +51,12 @@ catch.
 ## Core Responsibilities
 
 - **`schema`**: define the table in `packages/db` (Drizzle). One domain
-  module = one table. Cross-module references are FK-by-ID columns
-  only — never a foreign schema import. Add one re-export line for the
-  module to `packages/db/src/schema/index.ts` (in scope for this
-  layer) so the table is importable outside `packages/db` — the
-  package's own `src/index.ts` re-exports that barrel and never
-  changes after bootstrap.
+  module per table, cross-module references FK-by-ID only (root
+  CLAUDE.md's Core rules) — never a foreign schema import. Add one
+  re-export line for the module to `packages/db/src/schema/index.ts`
+  (in scope for this layer) so the table is importable outside
+  `packages/db` — the package's own `src/index.ts` re-exports that
+  barrel and never changes after bootstrap.
 - **`contract`**: derive the Zod schema from Drizzle (`drizzle-zod`) and
   wire the ts-rest contract in `packages/contracts`. A `date`-mode
   `timestamp` column reflected through `createSelectSchema` is overridden
@@ -101,8 +101,7 @@ catch.
    the packet's scope and rules don't account for; your own tests prove
    internal consistency, never coverage of what was asked. INHERITED DEBT
    is what the layers you depend on declared they left for you; declare
-   your own with `hedgehog debt add <task-id> "<note>"` rather than a
-   code comment nothing reads. Its WHY NOW section
+   your own with `hedgehog debt add <task-id> "<note>"`. Its WHY NOW section
    already confirms the module is in scope and every dependency is
    `complete` — no need to re-derive that by hand. Cross-module FK
    targets should already have their own schema landed (the packet's
@@ -122,14 +121,10 @@ catch.
    name the shared files that changed (typically `pnpm-lock.yaml`, root
    `tsconfig.json`) in your report — the orchestrating session commits
    them separately, since you report but never commit (next step).
-3. **Report the work as done; do not commit it yourself.** Per the build
-   graph's design, an agent reporting success never moves a task — only
-   `hedgehog verify <task-id>`'s passing exit code does. It checks your
-   changes against the packet's ALLOWED SCOPE, re-runs the real
-   verification command, and on a pass writes the commit (the packet's
-   exact Conventional Commit message) itself. Any shared workspace files
-   you flagged in step 2 are a separate commit the orchestrating session
-   makes before dispatching `hedgehog verify`, not something you commit.
+3. **Report the work as done; do not commit it yourself.** Any shared
+   workspace files you flagged in step 2 are a separate commit the
+   orchestrating session makes before dispatching `hedgehog verify`, not
+   something you commit.
 4. One layer at a time — never start the next layer before
    `hedgehog verify` reports the current one `complete`.
 5. Once `hedgehog verify` reports the `controller` layer (and any bundled
@@ -154,7 +149,7 @@ catch.
   reported rather than chosen here. `verify` cannot check any of this,
   which is exactly why it's on you.
 - Never import another module's repository, service, or schema directly
-  — cross-module references are FK-by-ID, resolved at the
+  — FK-by-ID only (root CLAUDE.md's Core rules), resolved at the
   contract/controller layer (parallel calls) or via a same-repository
   Drizzle join against the other module's *schema*, never its adapter.
 - Never write queue infra when the Queue add-on is off (per

package/agents/front-end-eng.md

@@ -96,8 +96,7 @@ don't reach for a second one.
    and rules don't account for; your own tests prove internal
    consistency, never coverage of what was asked. INHERITED DEBT is what
    the layers you depend on declared they left for you; declare your own
-   with `hedgehog debt add <task-id> "<note>"` rather than a code comment
-   nothing reads. Its WHY NOW section already
+   with `hedgehog debt add <task-id> "<note>"`. Its WHY NOW section already
    confirms Phase A is closed for this module (the `hook`/`screen`
    layer's dependencies wouldn't be `complete` otherwise) — no need to
    re-derive that by hand. If you're handed a step outside a packet with
@@ -116,12 +115,10 @@ don't reach for a second one.
    the workspace, and name the shared files that changed (typically
    `pnpm-lock.yaml`, root `tsconfig.json`) in your report — the
    orchestrating session commits them separately (next step).
-3. **Report the work as done; do not commit it yourself.** Only
-   `hedgehog verify <task-id>`'s passing exit code moves the task to
-   `complete` and writes the commit (the packet's exact Conventional
-   Commit message). Any shared workspace files you flagged in step 2 are a
-   separate commit the orchestrating session makes before dispatching
-   `hedgehog verify`, not something you commit.
+3. **Report the work as done; do not commit it yourself.** Any shared
+   workspace files you flagged in step 2 are a separate commit the
+   orchestrating session makes before dispatching `hedgehog verify`, not
+   something you commit.
 4. Build the screen consuming the hook the same way — packet, build,
    report, `hedgehog verify`.
 5. One layer at a time — `hook` fully `complete` before the `screen`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skyf0xx/hedgehog-core-full-stack-app",
-  "version": "1.0.14",
+  "version": "1.2.0",
   "description": "Hedgehog's full-stack-app core: an Nx/pnpm/NestJS/Next.js workspace, backend-first domain module build discipline, and the agents and skills that drive it.",
   "type": "module",
   "scripts": {

package/skills/hedgehog-loop/SKILL.md

@@ -44,14 +44,14 @@ Phase A.
 
 ## The Domain Module Pattern
 
-A **domain module = one table.** `users`, `orders`, `order_items` are each
-their own module, carrying the full step sequence below. The schema is the
-source of truth for module boundaries.
+Root CLAUDE.md's Core rules own "one table = one domain module" and
+"FK-by-ID only" — this section is their mechanics. `users`, `orders`,
+`order_items` are each their own module, carrying the full step sequence
+below. The schema is the source of truth for module boundaries.
 
-**Cross-module references are FK-by-ID only.** If `orders.user_id`
-references `users`, the `orders` schema holds a plain FK column. The
-`orders` repository and service depend only on their own ports — a service
-knows related entities only as an ID.
+If `orders.user_id` references `users`, the `orders` schema holds a plain
+FK column. The `orders` repository and service depend only on their own
+ports — a service knows related entities only as an ID.
 
 - Need the related row? Resolve it at the contract/controller layer
   (parallel calls to each module's own endpoint), or join against the
@@ -153,30 +153,48 @@ writes `docs/design/<module>.md`, not its own compiled layer — the
    zero. `hedgehog ready` previews the same decision without claiming
    anything — CLAIMABLE vs HELD BACK, with the reason for each holdback —
    useful for understanding the scheduler before committing to a claim.
-2. **Dispatch each claimed packet to its own subagent** — `backend-eng`
-   (Phase A) or `front-end-eng` (Phase B), matching each packet's ALLOWED
-   SCOPE — in ONE message with parallel tool calls, not one agent call
-   after another. This is a Claude session orchestrating via the Agent
-   tool's parallel-call mechanism: N claimed tasks means N Agent calls in
-   the same message. If a dispatch by name reports the agent as not
-   found — expected right after `init`/`update` installed it this same
+2. **For each claimed packet, decide inline vs. dispatch, then act.**
+   Default to dispatching to its own subagent — `backend-eng` (Phase A)
+   or `front-end-eng` (Phase B), matching the packet's ALLOWED SCOPE —
+   in ONE message with parallel tool calls, not one agent call after
+   another. This is a Claude session orchestrating via the Agent tool's
+   parallel-call mechanism: N claimed tasks dispatched this way means N
+   Agent calls in the same message. Build or confirm the packet
+   directly instead, with no subagent, only when the packet clears one
+   of these from the packet alone:
+   - **ALLOWED SCOPE** names a small, bounded set of files the
+     orchestrator can read directly without ballooning its own context.
+   - **RELEVANT RULES or the module name** make the layer's irrelevance
+     checkable in one read — the task's own rules describe a concern
+     that plainly doesn't touch this layer's area.
+   - The change, once its shape is known, is small and mechanical — a
+     rename, an import fix, a one-line registration — rather than
+     something needing a subagent's isolated, fresh-context judgment.
+
+   Escalate to a full `backend-eng`/`front-end-eng` dispatch mid-layer
+   the moment any of these turns out false — a "quick check" that
+   surfaces real cross-file reasoning, an unclear scope, or a diff
+   bigger than expected. Never lock in "inline" once guessed. Either
+   way, the layer's own VERIFICATION command and ALLOWED SCOPE gate
+   apply identically in step 4 — this choice changes who reads, writes,
+   and checks, never what gets checked before it's accepted. A no-op
+   found inline is still reported per the packet's HONESTY rules, never
+   assumed. If a dispatch by name reports the agent as not found —
+   expected right after `init`/`update` installed it this same
    session — see root CLAUDE.md's "Delegating on this host" note rather
    than treating it as fatal.
-3. Each agent **runs typecheck/lint/test on its own work** (mirrors
-   lefthook, wired at bootstrap) as a sanity check before reporting
-   back — necessary, not sufficient. Per task, per agent: the agent
-   reports its work as done; it does not move the task and does not
-   commit.
+3. Whoever built the packet — the dispatched agent, or the orchestrator
+   itself when it went inline — **runs typecheck/lint/test on that
+   work** (mirrors lefthook, wired at bootstrap) as a sanity check
+   before reporting back — necessary, not sufficient. Per task: the
+   work is reported as done; the task is not moved and nothing is
+   committed yet.
 4. **As each report arrives, verify it — one at a time, serially.** Run
    `hedgehog verify <task-id> --owner <owner>` (the same owner that
    claimed it; verify requires the lease owner). Building happens in
    parallel; verifying does not — verify writes a commit, and commits go
-   through one at a time. It checks the touched files against the
-   packet's ALLOWED SCOPE, runs the layer's VERIFICATION command, and on
-   a pass writes the commit (the exact Conventional Commit message from
-   the tables above, plus the updated build graph) and unlocks the next
-   layer. On a scope violation or a failing check, the task moves to
-   `blocked` with a `blocked_reason` of `scope_violation` or
+   through one at a time. On a scope violation or a failing check, the
+   task moves to `blocked` with a `blocked_reason` of `scope_violation` or
    `verification_failed`, and nothing downstream unlocks. Fix the work,
    then run `hedgehog retry <task-id>` to return the task to `planned`,
    claim it again (by task id — see below), and verify again —
@@ -216,7 +234,7 @@ the built work against it there, because nothing else in the build does.
 A layer that hits a limitation the next layer must compensate for
 declares it with `hedgehog debt add <task-id> "<note>"`; the note lands
 in the **INHERITED DEBT** section of every packet that depends on that
-task. A comment in a source file is not a mechanism — nothing reads it.
+task.
 
 Each `hedgehog verify` call commits exactly one layer, built right for
 what's known now; a wrong layer is fixed forward later via the
@@ -593,8 +611,8 @@ the graph doesn't have a task for.
   committed.
 - The screen step doesn't start blank — `ux-planner` runs once per module,
   after the hook is committed, before `front-end-eng` starts the screen.
-- `packages/config` is the single source for shared config; a per-app
-  override request signals to fix the base config at the source.
+- `packages/config` is the single source for shared config (root
+  CLAUDE.md's Core rules).
 
 ## Stop Condition
 

package/workspace/apps/api/package.json

@@ -46,11 +46,23 @@
         "executor": "@nx/js:prune-lockfile",
         "outputs": [
           "{workspaceRoot}/apps/api/dist/package.json",
-          "{workspaceRoot}/apps/api/dist/pnpm-lock.yaml"
+          "{workspaceRoot}/apps/api/dist/pnpm-lock.yaml",
+          "{workspaceRoot}/apps/api/dist/pnpm-workspace.yaml",
+          "{workspaceRoot}/apps/api/dist/patches",
+          "{workspaceRoot}/apps/api/dist/local_path_modules"
         ],
         "options": {
           "buildTarget": "build"
-        }
+        },
+        "inputs": [
+          "default",
+          "^default",
+          "{workspaceRoot}/pnpm-workspace.yaml",
+          "{workspaceRoot}/package.json",
+          {
+            "runtime": "node -e \"try{console.log('pnpm major '+require('child_process').execSync('pnpm --version',{stdio:['ignore','pipe','ignore']}).toString().trim().split('.')[0])}catch{console.log('pnpm major unavailable')}\""
+          }
+        ]
       },
       "copy-workspace-modules": {
         "dependsOn": [

package/workspace/apps/api/vitest.config.mts

@@ -1,7 +1,7 @@
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig(() => ({
-  root: __dirname,
+  root: import.meta.dirname,
   cacheDir: '../../node_modules/.vite/apps/api',
   test: {
     name: 'api',

package/workspace/apps/api-e2e/vitest.config.mts

@@ -1,7 +1,7 @@
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig(() => ({
-  root: __dirname,
+  root: import.meta.dirname,
   cacheDir: '../../node_modules/.vite/apps/api-e2e',
   test: {
     name: 'api-e2e',

package/workspace/apps/web/AGENTS.md

@@ -0,0 +1,9 @@
+<!-- BEGIN:nextjs-agent-rules -->
+
+# This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->

package/workspace/apps/web/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/workspace/apps/web/next-env.d.ts

@@ -1,7 +1,7 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-import "./.next/types/routes.d.ts";
-import "./.next/types/root-params.d.ts";
+import "./.next/dev/types/routes.d.ts";
+import "./.next/dev/types/root-params.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

package/workspace/apps/web/vitest.config.mts

@@ -3,7 +3,7 @@ import react from '@vitejs/plugin-react';
 import { fileURLToPath } from 'node:url';
 
 export default defineConfig(() => ({
-  root: __dirname,
+  root: import.meta.dirname,
   cacheDir: '../../node_modules/.vite/apps/web',
   plugins: [react()],
   resolve: {

package/workspace/package.json

@@ -14,17 +14,17 @@
     "@nestjs/schematics": "^11.0.0",
     "@nestjs/testing": "^11.0.0",
     "@next/eslint-plugin-next": "^16.1.6",
-    "@nx/devkit": "23.1.2",
-    "@nx/eslint": "23.1.2",
-    "@nx/eslint-plugin": "23.1.2",
-    "@nx/js": "23.1.2",
-    "@nx/nest": "23.1.2",
-    "@nx/next": "23.1.2",
-    "@nx/node": "23.1.2",
-    "@nx/playwright": "23.1.2",
-    "@nx/vitest": "23.1.2",
-    "@nx/web": "23.1.2",
-    "@nx/webpack": "23.1.2",
+    "@nx/devkit": "23.2.0",
+    "@nx/eslint": "23.2.0",
+    "@nx/eslint-plugin": "23.2.0",
+    "@nx/js": "23.2.0",
+    "@nx/nest": "23.2.0",
+    "@nx/next": "23.2.0",
+    "@nx/node": "23.2.0",
+    "@nx/playwright": "23.2.0",
+    "@nx/vitest": "23.2.0",
+    "@nx/web": "23.2.0",
+    "@nx/webpack": "23.2.0",
     "@playwright/test": "^1.37.0",
     "@swc-node/register": "~1.11.1",
     "@swc/cli": "~0.8.1",
@@ -52,7 +52,7 @@
     "eslint-plugin-react-hooks": "7.1.1",
     "jsdom": "^30.0.1",
     "lefthook": "^2.1.10",
-    "nx": "23.1.2",
+    "nx": "23.2.0",
     "prettier": "~3.6.2",
     "tslib": "^2.3.0",
     "typescript": "~6.0.3",
@@ -97,7 +97,7 @@
       }
     },
     "overrides": {
-      "@nx/module-federation": "23.1.2",
+      "@nx/module-federation": "23.2.0",
       "esbuild": "0.25.12",
       "axios": "^1.18.0",
       "brace-expansion@1": "^1.1.18",

package/workspace/packages/config/vitest.config.mts

@@ -1,7 +1,7 @@
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig(() => ({
-  root: __dirname,
+  root: import.meta.dirname,
   cacheDir: '../../node_modules/.vite/packages/config',
   test: {
     name: 'config',

package/workspace/packages/db/vitest.config.mts

@@ -1,7 +1,7 @@
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig(() => ({
-  root: __dirname,
+  root: import.meta.dirname,
   cacheDir: '../../node_modules/.vite/packages/db',
   test: {
     name: 'db',