create-basalt 1.12.0 → 1.14.0

package/README.md

@@ -273,7 +273,11 @@ newest release **on the app's current major** (a newer major is listed as
 `minimumReleaseAge`, read from the project's `pnpm-workspace.yaml` when set) is
 left for later so the install cannot refuse it. When a framework release
 declares a peer range the app would not meet (say `zod ^5` while zod is held on
-4), the plan warns before anything is written.
+4), the plan warns before anything is written. When a framework release
+requires an `@basaltkit/*` peer the app does not list (`@basaltkit/testing` 3
+takes `@basaltkit/mailer`), the plan adds it at its latest version (in
+`dependencies` when a runtime dependency needs it, else `devDependencies`), or
+warns when it cannot; optional peers are never added.
 
 Both `package.json` and `web/package.json` are updated, **in place**: only the
 version strings change — order, indentation and range style (`^`, `~`, exact)
@@ -466,7 +470,7 @@ Detects the manager that invoked the command from `npm_config_user_agent` (or th
 | --- | --- |
 | `runProjectCommand(argv, deps)` | Runs `update`/`add`/`doctor`/`info` and returns the exit code; every side effect (output, prompts, package-manager runs, registry fetch, codemods) is injected through `deps` |
 | `loadProject(dir, pm?)` | Reads an app: package.json (+ `web/`), manifest, detected features and package manager. Throws `NotABasaltAppError` |
-| `planUpdate(ctx, { major?, only?, tooling?, registry? })` | The update plan — entries, the full before/after of every file, tooling, warnings, framework majors. Writes nothing |
+| `planUpdate(ctx, { major?, only?, tooling?, registry? })` | The update plan — entries, the full before/after of every file, tooling, warnings, framework majors, required peers it adds (`addedPeers`). Writes nothing |
 | `planAdd(ctx, feature, { force?, resolveLatest?, registry? })` | The add plan — created/merged/skipped files and manual steps. Writes nothing |
 | `runDoctor(ctx, options)` | Doctor findings (`{ level: 'ok' \| 'info' \| 'warn' \| 'error', area, message }`) |
 | `MANIFEST_PATH`, `readManifest(dir)`, `hashContent(text)` | The scaffold manifest |

package/dist/index.js

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { mkdir, readdir, writeFile } from 'node:fs/promises';
 import { dirname, join, resolve } from 'node:path';
-import { appTest, appTs, dbTs, devEnvFile, devTs, dockerfile, dockerignore, envExample, envTs, gitignore, mcpJson, basaltBin, packageJson, pnpmWorkspaceYaml, prismaConfigTs, prismaSchema, prismaSeedTs, readme, routesTs, serverTs, tsconfigBuildJson, tsconfigJson, } from './templates.js';
+import { appTest, appTs, dbTs, devEnvFile, devTs, dockerfile, dockerignore, envExample, envTs, deployConfigTs, gitignore, mcpJson, basaltBin, packageJson, pnpmWorkspaceYaml, prismaConfigTs, prismaSchema, prismaSeedTs, readme, routesTs, serverTs, tsconfigBuildJson, tsconfigJson, } from './templates.js';
 import { uiFiles } from './templates-ui.js';
 import { INSECURE_SECRET } from './project/doctor.js';
 import { createManifest, MANIFEST_PATH, serializeManifest } from './project/manifest.js';
@@ -51,6 +51,7 @@ export function scaffoldFiles(options) {
         'README.md': readme(options),
         'pnpm-workspace.yaml': pnpmWorkspaceYaml(options),
         'src/env.ts': envTs(options),
+        'deploy.config.ts': deployConfigTs(options),
         'src/app.ts': appTs(options),
         'src/routes.ts': routesTs(options),
         'src/server.ts': serverTs(),

package/dist/latest-versions.d.ts

@@ -114,6 +114,8 @@ export interface LatestInfo {
     latest?: string;
     /** `peerDependencies` declared by that latest version. */
     peers: Record<string, string>;
+    /** The peers its `peerDependenciesMeta` marks optional (absent: none). */
+    optionalPeers?: string[];
     /**
      * Release age of `latest` against the window: `mature` (provably older, or
      * not probed), `recent` (inside the window) or `unknown` (could not prove it).

package/dist/latest-versions.js

@@ -153,6 +153,15 @@ function peersOf(body) {
     }
     return peers;
 }
+/** The peers `peerDependenciesMeta` marks `optional: true`. */
+function optionalPeersOf(body) {
+    const raw = body?.peerDependenciesMeta;
+    if (!raw || typeof raw !== 'object')
+        return [];
+    return Object.entries(raw)
+        .filter(([, meta]) => typeof meta === 'object' && meta !== null && meta.optional === true)
+        .map(([name]) => name);
+}
 async function lookupLatest(fetchImpl, registry, name, signal) {
     try {
         const response = await fetchImpl(latestUrl(registry, name), {
@@ -165,7 +174,9 @@ async function lookupLatest(fetchImpl, registry, name, signal) {
             return 'miss';
         const body = (await response.json());
         const version = body?.version;
-        return typeof version === 'string' && STABLE_SEMVER.test(version) ? { version, peers: peersOf(body) } : 'miss';
+        return typeof version === 'string' && STABLE_SEMVER.test(version)
+            ? { version, peers: peersOf(body), optionalPeers: optionalPeersOf(body) }
+            : 'miss';
     }
     catch {
         // Network error, per-request timeout, or malformed JSON.
@@ -223,7 +234,7 @@ export async function lookupLatestVersions(names, shouldProbe, options = {}) {
                 const age = windowMs === 0 || !shouldProbe(name, found.version)
                     ? 'mature'
                     : await probeAge(fetchImpl, registry, name, windowMs, now, AbortSignal.any([AbortSignal.timeout(timeoutMs), overall.signal]));
-                results.set(name, { latest: found.version, peers: found.peers, age });
+                results.set(name, { latest: found.version, peers: found.peers, optionalPeers: found.optionalPeers, age });
             }
         };
         const pool = Math.max(1, Math.min(options.concurrency ?? CONCURRENCY, names.length));

package/dist/project/add.js

@@ -2,7 +2,7 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { basaltBin } from '../bin-template.js';
 import { collectDependencies, resolveFileVersions, resolveLatestVersions, } from '../latest-versions.js';
-import { appTs, BASALT_PROJECT_SCRIPT, gitignore, mcpJson, pnpmWorkspaceYaml, readme, readmeCliSection, readmeMcpSection, readmeUiSection, routesTs, versionOf, webDevScript, } from '../templates.js';
+import { appTs, BASALT_PROJECT_SCRIPT, gitignore, mcpJson, pnpmWorkspaceYaml, readme, deployConfigTs, readmeCliSection, readmeMcpSection, readmeUiSection, routesTs, versionOf, webDevScript, } from '../templates.js';
 import { uiFiles } from '../templates-ui.js';
 import { createManifest, extendManifest, isPristine, MANIFEST_PATH, serializeManifest } from './manifest.js';
 import { mergePackageJson } from './package-json.js';
@@ -255,6 +255,10 @@ export async function planAdd(ctx, feature, options = {}) {
         const ignore = await readOptional(ctx.dir, '.gitignore');
         plannedEdit(b, '.gitignore', ignore, ignore === undefined ? gitignore(next) : ensureGitignore(ignore, ['node_modules/', 'dist/']), 'ignore web/ build output');
         await plannedReadme(b, regenOptions, '## Web UI', readmeUiSection(next));
+        // The deploy builds web/ too (served as web/dist by the proxy).
+        if ((await readOptional(ctx.dir, 'deploy.config.ts')) !== undefined) {
+            await plannedSource(b, 'deploy.config.ts', regenOptions ? () => deployConfigTs(regenOptions) : undefined, (source) => (/\bweb:/.test(source) ? source : /build: \{ ([^}\n]*) \}/.test(source) ? source.replace(/build: \{ ([^}\n]*) \}/, "build: { $1, web: 'web' }") : undefined), "add web: 'web' to build in deploy.config.ts, so the deploy builds the frontend.");
+        }
         b.notes.push('No CORS change needed: the Vite dev server proxies /api to the API on :3000.');
     }
     if (feature === 'cli') {

package/dist/project/update.d.ts

@@ -76,6 +76,17 @@ export interface UpdatePlan {
         to: string;
         changelog: string;
     }[];
+    /**
+     * Required `@basaltkit/*` peers of the framework releases the app ends up on
+     * that its package.json did not list (testing 3 takes mailer): added at their
+     * latest version, in `dependencies` when a runtime dependency needs them.
+     */
+    addedPeers: {
+        name: string;
+        range: string;
+        section: 'dependencies' | 'devDependencies';
+        requiredBy: string[];
+    }[];
     registry: string;
 }
 export interface UpdateOptions {

package/dist/project/update.js

@@ -277,6 +277,50 @@ export async function planUpdate(ctx, options = {}) {
             }
         }
     }
+    // A required @basaltkit peer the app never declared: pnpm and npm may
+    // auto-install it, but yarn PnP, `auto-install-peers=false` or
+    // `--legacy-peer-deps` do not, and `doctor` checks installed versions, not
+    // the manifest. Add it at its latest version; when that is impossible
+    // (registry, release-age window, out of range), say so.
+    const declared = new Set(entries.filter((entry) => entry.file === 'package.json').map((entry) => entry.name));
+    const missing = new Map();
+    for (const entry of entries) {
+        if (!entry.framework || (entry.status !== 'update' && entry.status !== 'current') || entry.file !== 'package.json')
+            continue;
+        const info = results.get(entry.name);
+        for (const [peer, wanted] of Object.entries(info?.peers ?? {})) {
+            if (!isFramework(peer) || declared.has(peer) || info?.optionalPeers?.includes(peer))
+                continue;
+            const prior = missing.get(peer);
+            const section = entry.section === 'dependencies' || prior?.section === 'dependencies' ? 'dependencies' : 'devDependencies';
+            const requiredBy = [...(prior?.requiredBy ?? []), `${entry.name}@${info?.latest}`];
+            missing.set(peer, { wanted: prior?.wanted ?? wanted, requiredBy: [...new Set(requiredBy)], section });
+        }
+    }
+    const addedPeers = [];
+    if (missing.size > 0) {
+        const peerLookup = await lookupLatestVersions([...missing.keys()].sort(), (name) => !exempt(name), {
+            ...options.registry,
+            minimumReleaseAge: window,
+        });
+        const additions = { dependencies: {}, devDependencies: {} };
+        for (const [peer, need] of missing) {
+            const found = peerLookup.results.get(peer);
+            if (found?.latest !== undefined && found.age === 'mature' && satisfies(found.latest, need.wanted) === true) {
+                const range = `^${found.latest}`;
+                additions[need.section][peer] = range;
+                addedPeers.push({ name: peer, range, section: need.section, requiredBy: need.requiredBy });
+            }
+            else {
+                warnings.push(`${need.requiredBy.join(', ')} requires ${peer} ${need.wanted}, which package.json does not list — add it (${ctx.pm} add ${need.section === 'devDependencies' ? '-D ' : ''}${peer})`);
+            }
+        }
+        if (addedPeers.length > 0) {
+            const merged = mergePackageJson(files['package.json']?.after ?? ctx.packageJsonText, additions);
+            if (merged.changes.length > 0)
+                files['package.json'] = { before: ctx.packageJsonText, after: merged.text };
+        }
+    }
     const failed = entries.filter((entry) => entry.status === 'failed').map((entry) => entry.name);
     if (failed.length > 0)
         warnings.push(`The registry did not answer for ${[...new Set(failed)].join(', ')} — left unchanged.`);
@@ -289,7 +333,7 @@ export async function planUpdate(ctx, options = {}) {
         changelog: changelogUrl(entry.name),
     }))
         .filter((major, i, all) => all.findIndex((other) => other.name === major.name) === i);
-    return { entries, updates, files, tooling: toolingNotes, manual, warnings, majors, registry };
+    return { entries, updates, files, tooling: toolingNotes, manual, warnings, majors, addedPeers, registry };
 }
 /** The plan as terminal lines: the update table, then notes, tooling, warnings and majors. */
 export function renderUpdatePlan(plan, colors) {
@@ -328,6 +372,12 @@ export function renderUpdatePlan(plan, colors) {
             lines.push(`  ${major.name} ${major.from} → ${major.to}: ${major.changelog}`);
         lines.push(`  Upgrade notes: ${DOCS_UPGRADING_URL}`);
     }
+    if (plan.addedPeers.length > 0) {
+        lines.push('', colors.bold('Required peers the app did not list (added):'));
+        for (const peer of plan.addedPeers) {
+            lines.push(`  ${colors.cyan(peer.name)} ${peer.range} (${peer.section}) — required by ${peer.requiredBy.join(', ')}`);
+        }
+    }
     if (plan.tooling.length > 0) {
         lines.push('', colors.bold('Project tooling:'));
         for (const note of plan.tooling)

package/dist/templates.d.ts

@@ -20,8 +20,8 @@ export { basaltBin } from './bin-template.js';
 export { SCAFFOLD_VERSIONS } from './versions.js';
 export { THIRD_PARTY_VERSIONS } from './latest-versions.js';
 /**
- * The dependency range for a @basaltkit/* package: the current release line
- * (`^<major>.<minor>.0`) of its workspace version, from the generated
+ * The dependency range for a @basaltkit/* package: its workspace version as
+ * the floor (`^<major>.<minor>.<patch>`), from the generated
  * {@link SCAFFOLD_VERSIONS} map. Throws for an unknown package rather than
  * guessing a range — a stale guess once pinned new apps to frozen 1.x lines.
  */
@@ -155,6 +155,18 @@ export declare function mcpJson(_options: ProjectOptions): string;
  * `certs/server.key` through.
  */
 export declare function dockerignore(): string;
+/**
+ * The C4 owner label `@basaltkit/deploy` names everything with
+ * (`[a-z][a-z0-9-]{1,30}`), from the package name.
+ */
+export declare function deployAppName(name: string): string;
+/**
+ * `deploy.config.ts` (RFC 0007 §3): what `basalt-deploy init` writes for this
+ * scaffold — PM2 behind Apache, a dedicated Postgres when the app has one, the
+ * compiled build, the app's own secret generated on the server. Typed by
+ * src/env.ts. The domain is the one thing to change.
+ */
+export declare function deployConfigTs(options: ProjectOptions): string;
 export declare function gitignore(options: ProjectOptions): string;
 /**
  * pnpm settings: esbuild's build script is required by tsx; with --prisma,

package/dist/templates.js

@@ -5,8 +5,8 @@ export { basaltBin } from './bin-template.js';
 export { SCAFFOLD_VERSIONS } from './versions.js';
 export { THIRD_PARTY_VERSIONS } from './latest-versions.js';
 /**
- * The dependency range for a @basaltkit/* package: the current release line
- * (`^<major>.<minor>.0`) of its workspace version, from the generated
+ * The dependency range for a @basaltkit/* package: its workspace version as
+ * the floor (`^<major>.<minor>.<patch>`), from the generated
  * {@link SCAFFOLD_VERSIONS} map. Throws for an unknown package rather than
  * guessing a range — a stale guess once pinned new apps to frozen 1.x lines.
  */
@@ -104,9 +104,16 @@ export function packageJson(options) {
     }
     const devDependencies = {
         '@basaltkit/testing': versionOf('@basaltkit/testing'),
+        // @basaltkit/testing's peer: fakeMailer() binds the app's own MAILER token,
+        // so the copy must be the app's (a package manager that skips peers would
+        // otherwise leave `@basaltkit/testing` unable to load).
+        '@basaltkit/mailer': versionOf('@basaltkit/mailer'),
         // The project commands (\`pnpm basalt update | add | doctor | info\`) — dev
         // tooling with no dependencies of its own, never imported by the app.
         'create-basalt': versionOf('create-basalt'),
+        // Production deploy (deploy.config.ts): dev tooling, run on the server as
+        // `node node_modules/@basaltkit/deploy/dist/bin.js run`, never imported by the app.
+        '@basaltkit/deploy': versionOf('@basaltkit/deploy'),
     };
     for (const pkg of ['@types/node', 'pino-pretty', 'tsx', 'typescript', 'vitest']) {
         devDependencies[pkg] = thirdPartyVersionOf(pkg);
@@ -725,9 +732,17 @@ model AuthApiKey {
   expiresAt  DateTime?
   lastUsedAt DateTime?
   revokedAt  DateTime?
+  // 3.0: API key lifecycle (migration \`add_api_key_lifecycle\`).
+  serviceId             String?
+  previousHash          String?   @unique
+  previousHashExpiresAt DateTime?
+  rotatedAt             DateTime?
+  allowedIps            String[]  @default([])
+  meta                  Json?
 
   @@index([tenantId])
   @@index([userId])
+  @@index([serviceId])
   @@map("auth_api_keys")
 }
 
@@ -1274,6 +1289,64 @@ export function mcpJson(_options) {
 export function dockerignore() {
     return DOCKERIGNORE;
 }
+/**
+ * The C4 owner label `@basaltkit/deploy` names everything with
+ * (`[a-z][a-z0-9-]{1,30}`), from the package name.
+ */
+export function deployAppName(name) {
+    // Trimmed in linear time: an anchored `-+$` regex backtracks on long runs of '-'.
+    const base = name.replace(/^@[^/]+\//, '').toLowerCase().replace(/[^a-z0-9]+/g, '-');
+    let start = 0;
+    while (start < base.length && !(base[start] >= 'a' && base[start] <= 'z'))
+        start++;
+    let end = Math.min(base.length, start + 31);
+    while (end > start && base[end - 1] === '-')
+        end--;
+    const slug = base.slice(start, end);
+    return /^[a-z][a-z0-9-]{1,30}$/.test(slug) ? slug : 'app';
+}
+/**
+ * `deploy.config.ts` (RFC 0007 §3): what `basalt-deploy init` writes for this
+ * scaffold — PM2 behind Apache, a dedicated Postgres when the app has one, the
+ * compiled build, the app's own secret generated on the server. Typed by
+ * src/env.ts. The domain is the one thing to change.
+ */
+export function deployConfigTs(options) {
+    const app = deployAppName(options.name);
+    const helpers = ['apache', 'defineDeploy', ...(options.prisma ? ['dockerInfra'] : []), 'pm2', ...(options.auth ? ['secret'] : [])];
+    const build = [...(options.prisma ? [`prisma: ['prisma.config.ts']`] : []), `script: 'build'`, ...(options.ui ? [`web: 'web'`] : [])];
+    return `/**
+ * Production deploy with @basaltkit/deploy, on one Linux server. Holds no secrets.
+ *
+ *   node node_modules/@basaltkit/deploy/dist/bin.js check   # this file, without a server (CI)
+ *   node node_modules/@basaltkit/deploy/dist/bin.js plan    # on the server: what run would do
+ *   node node_modules/@basaltkit/deploy/dist/bin.js run
+ *
+ * Rewrite it from the project at any time:
+ *   node node_modules/@basaltkit/deploy/dist/bin.js init --force --domain=<host>
+ */
+import type { env } from './src/env.js'
+import { ${helpers.join(', ')} } from '@basaltkit/deploy'
+
+export default defineDeploy<typeof env>({
+  app: '${app}',
+  domain: '${app}.example.com', // the domain the app answers on
+
+  env: {
+    schema: 'src/env.ts',
+    fixed: { NODE_ENV: 'production', HOST: '127.0.0.1' },${options.auth ? `
+    generate: { APP_SECRET: secret(32) },` : ''}
+  },${options.prisma ? `
+  infra: dockerInfra('${app}', { redis: false }),` : ''}
+  build: { ${build.join(', ')} },${options.prisma ? `
+  migrate: { central: true },` : ''}
+
+  runtime: pm2(),
+  proxy: apache(),
+  health: { path: '/health' },
+})
+`;
+}
 export function gitignore(options) {
     return `node_modules/
 dist/

package/dist/versions.js

@@ -1,29 +1,32 @@
 // GENERATED by scripts/sync-versions.mjs (runs before every build) — do not edit.
 // The dependency range a new app gets for each @basaltkit/* package: the
-// current release line (^<major>.<minor>.0) of the workspace version.
+// workspace version as the floor (^<major>.<minor>.<patch>), so a new app never
+// resolves an older patch of the same line.
 export const SCAFFOLD_VERSIONS = {
     '@basaltkit/admin': '^2.0.0',
-    '@basaltkit/admin-shadcn': '^1.1.0',
+    '@basaltkit/admin-shadcn': '^1.1.1',
     '@basaltkit/ai-mcp': '^0.4.0',
-    '@basaltkit/auth': '^4.2.0',
-    '@basaltkit/auth-prisma': '^2.1.0',
-    '@basaltkit/cli': '^1.4.0',
-    '@basaltkit/config': '^1.1.0',
+    '@basaltkit/auth': '^5.0.0',
+    '@basaltkit/auth-prisma': '^3.0.0',
+    '@basaltkit/cli': '^1.4.1',
+    '@basaltkit/config': '^1.1.2',
     '@basaltkit/core': '^1.6.0',
-    '@basaltkit/env': '^3.1.0',
+    '@basaltkit/deploy': '^0.3.0',
+    '@basaltkit/env': '^3.1.1',
     '@basaltkit/events': '^1.3.0',
-    '@basaltkit/fastify': '^2.6.0',
+    '@basaltkit/fastify': '^3.0.0',
     '@basaltkit/generator': '^1.6.0',
     '@basaltkit/logger': '^1.3.0',
-    '@basaltkit/mcp': '^5.1.0',
-    '@basaltkit/prisma': '^3.1.0',
+    '@basaltkit/mailer': '^2.1.0',
+    '@basaltkit/mcp': '^6.0.0',
+    '@basaltkit/prisma': '^4.0.0',
     '@basaltkit/sdk': '^2.1.0',
-    '@basaltkit/subscriptions': '^5.0.0',
-    '@basaltkit/subscriptions-prisma': '^3.0.0',
-    '@basaltkit/teams': '^4.1.0',
+    '@basaltkit/subscriptions': '^6.0.0',
+    '@basaltkit/subscriptions-prisma': '^4.0.0',
+    '@basaltkit/teams': '^4.1.1',
     '@basaltkit/teams-prisma': '^1.1.0',
-    '@basaltkit/tenancy': '^3.2.0',
-    '@basaltkit/tenancy-prisma': '^2.1.0',
-    '@basaltkit/testing': '^2.0.0',
-    'create-basalt': '^1.12.0',
+    '@basaltkit/tenancy': '^4.0.0',
+    '@basaltkit/tenancy-prisma': '^3.0.0',
+    '@basaltkit/testing': '^3.0.0',
+    'create-basalt': '^1.14.0',
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-basalt",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "engines": {
     "node": ">=22.5.0"
   },
@@ -32,26 +32,27 @@
     "typescript": "^7.0.2",
     "vitest": "^5.0.1",
     "zod": "^4.6.5",
-    "@basaltkit/auth": "^4.2.0",
-    "@basaltkit/auth-prisma": "^2.1.0",
-    "@basaltkit/cli": "^1.4.0",
+    "@basaltkit/auth": "^5.0.0",
+    "@basaltkit/auth-prisma": "^3.0.0",
+    "@basaltkit/cli": "^1.4.1",
+    "@basaltkit/config": "^1.1.2",
     "@basaltkit/core": "^1.6.0",
+    "@basaltkit/env": "^3.1.1",
     "@basaltkit/events": "^1.3.0",
-    "@basaltkit/fastify": "^2.6.0",
-    "@basaltkit/config": "^1.1.2",
+    "@basaltkit/fastify": "^3.0.0",
     "@basaltkit/generator": "^1.6.0",
     "@basaltkit/logger": "^1.3.0",
-    "@basaltkit/env": "^3.1.1",
-    "@basaltkit/mcp": "^5.1.0",
-    "@basaltkit/prisma": "^3.1.0",
-    "@basaltkit/subscriptions": "^5.0.0",
-    "@basaltkit/subscriptions-prisma": "^3.0.0",
-    "@basaltkit/teams": "^4.1.0",
-    "@basaltkit/tenancy": "^3.2.0",
+    "@basaltkit/prisma": "^4.0.0",
+    "@basaltkit/subscriptions": "^6.0.0",
+    "@basaltkit/deploy": "^0.3.0",
+    "@basaltkit/mcp": "^6.0.0",
+    "@basaltkit/teams": "^4.1.1",
+    "@basaltkit/subscriptions-prisma": "^4.0.0",
+    "@basaltkit/tenancy-prisma": "^3.0.0",
     "@basaltkit/teams-prisma": "^1.1.0",
-    "@basaltkit/tenancy-prisma": "^2.1.0",
-    "@basaltkit/tsconfig": "^0.24.0",
-    "@basaltkit/testing": "^2.0.3"
+    "@basaltkit/testing": "^3.0.0",
+    "@basaltkit/tenancy": "^4.0.0",
+    "@basaltkit/tsconfig": "^0.24.0"
   },
   "publishConfig": {
     "access": "public"