create-packkit 3.0.0 → 3.1.0

package/src/core/features/service.js

@@ -1,3 +1,4 @@
+import { V } from '../versions.js';
 // HTTP service target. Supports Hono (default), Fastify and Express. Splits the
 // app (testable) from the server entry (which listens), adds start/dev scripts,
 // and a production Dockerfile.
@@ -24,7 +25,7 @@ export default {
         },
         dependencies: deps(fw),
         devDependencies: {
-          ...(cfg.isTs ? { tsx: '^4.0.0' } : {}),
+          ...(cfg.isTs ? { tsx: V.tsx } : {}),
           ...(cfg.isTs ? typeDeps(fw) : {}),
         },
       },
@@ -33,13 +34,13 @@ export default {
 };
 
 function deps(fw) {
-  if (fw === 'fastify') return { fastify: '^5.0.0' };
-  if (fw === 'express') return { express: '^5.0.0' };
-  return { hono: '^4.5.0', '@hono/node-server': '^2.0.0' };
+  if (fw === 'fastify') return { fastify: V.fastify };
+  if (fw === 'express') return { express: V.express };
+  return { hono: V.hono, '@hono/node-server': V['@hono/node-server'] };
 }
 
 function typeDeps(fw) {
-  if (fw === 'express') return { '@types/express': '^5.0.0' };
+  if (fw === 'express') return { '@types/express': V['@types/express'] };
   return {};
 }
 

package/src/core/features/sizelimit.js

@@ -2,6 +2,7 @@
 // brotli-compressed size of the built entry and fails when it exceeds the
 // limit — cheap insurance against a dependency silently bloating the package.
 import { toJson } from '../render.js';
+import { V } from '../versions.js';
 
 export default {
   id: 'sizelimit',
@@ -14,8 +15,8 @@ export default {
       pkg: {
         scripts: { size: 'size-limit' },
         devDependencies: {
-          'size-limit': '^11.0.0',
-          '@size-limit/preset-small-lib': '^11.0.0',
+          'size-limit': V['size-limit'],
+          '@size-limit/preset-small-lib': V['@size-limit/preset-small-lib'],
         },
       },
     };

package/src/core/features/storybook.js

@@ -1,3 +1,4 @@
+import { V } from '../versions.js';
 // Storybook for component libraries (React / Vue / Svelte), on the Vite builder.
 
 const FW = {
@@ -37,10 +38,10 @@ export default {
           'build-storybook': 'storybook build',
         },
         devDependencies: {
-          storybook: '^10.0.0',
-          [fw.builder]: '^10.0.0',
-          [fw.renderer]: '^10.0.0',
-          vite: '^8.0.0',
+          storybook: V.storybook,
+          [fw.builder]: V[fw.builder],
+          [fw.renderer]: V[fw.renderer],
+          vite: V.vite,
         },
       },
     };

package/src/core/features/test.js

@@ -1,4 +1,4 @@
-import { toJson } from '../render.js';
+import { V } from '../versions.js';
 
 export default {
   id: 'test',
@@ -38,40 +38,40 @@ export default {
       ].filter((l) => l !== null).join('\n');
       pkg.scripts.test = 'vitest run';
       pkg.scripts['test:watch'] = 'vitest';
-      pkg.devDependencies.vitest = '^4.0.0';
+      pkg.devDependencies.vitest = V.vitest;
       if (cfg.hasFramework) {
-        pkg.devDependencies.jsdom = '^29.0.0';
-        pkg.devDependencies['@testing-library/dom'] = '^10.0.0';
-        if (cfg.isReact) pkg.devDependencies['@testing-library/react'] = '^16.0.0';
-        if (cfg.isVue) pkg.devDependencies['@testing-library/vue'] = '^8.1.0';
-        if (cfg.isSvelte) pkg.devDependencies['@testing-library/svelte'] = '^5.2.0';
+        pkg.devDependencies.jsdom = V.jsdom;
+        pkg.devDependencies['@testing-library/dom'] = V['@testing-library/dom'];
+        if (cfg.isReact) pkg.devDependencies['@testing-library/react'] = V['@testing-library/react'];
+        if (cfg.isVue) pkg.devDependencies['@testing-library/vue'] = V['@testing-library/vue'];
+        if (cfg.isSvelte) pkg.devDependencies['@testing-library/svelte'] = V['@testing-library/svelte'];
       }
       if (cfg.coverage) {
         pkg.scripts.coverage = 'vitest run --coverage';
-        pkg.devDependencies['@vitest/coverage-v8'] = '^4.0.0';
+        pkg.devDependencies['@vitest/coverage-v8'] = V['@vitest/coverage-v8'];
       }
       files[`src/index.test.${testExt}`] = exampleTest('vitest', cfg);
     } else if (cfg.test === 'jest') {
       files['jest.config.js'] = jestConfig(cfg);
       pkg.scripts.test = 'jest';
       pkg.scripts['test:watch'] = 'jest --watch';
-      pkg.devDependencies.jest = '^30.0.0';
+      pkg.devDependencies.jest = V.jest;
       if (cfg.isTs) {
-        pkg.devDependencies['ts-jest'] = '^29.0.0';
-        pkg.devDependencies['@types/jest'] = '^30.0.0';
+        pkg.devDependencies['ts-jest'] = V['ts-jest'];
+        pkg.devDependencies['@types/jest'] = V['@types/jest'];
       }
       if (cfg.coverage) pkg.scripts.coverage = 'jest --coverage';
       files[`src/index.test.${testExt}`] = exampleTest('jest', cfg);
     } else if (cfg.test === 'node') {
       pkg.scripts.test = cfg.isTs ? 'node --import tsx --test "src/**/*.test.ts"' : 'node --test';
-      if (cfg.isTs) pkg.devDependencies.tsx = '^4.0.0';
+      if (cfg.isTs) pkg.devDependencies.tsx = V.tsx;
       files[`src/index.test.${testExt}`] = exampleTest('node', cfg);
     }
 
     // Express services test through supertest (no built-in inject).
     if (cfg.hasService && cfg.serviceFramework === 'express') {
-      pkg.devDependencies.supertest = '^7.0.0';
-      if (cfg.isTs) pkg.devDependencies['@types/supertest'] = '^6.0.0';
+      pkg.devDependencies.supertest = V.supertest;
+      if (cfg.isTs) pkg.devDependencies['@types/supertest'] = V['@types/supertest'];
     }
 
     return { files, pkg };
@@ -159,7 +159,6 @@ function exampleTest(runner, cfg) {
     ].join('\n');
   }
   const api = runner === 'jest' ? `` : `import { describe, it, expect } from 'vitest';\n`;
-  const expectApi = runner === 'jest' ? '' : '';
   return [
     api + `import { greet } from '${imp}';`,
     ``,

package/src/core/features/typescript.js

@@ -1,4 +1,5 @@
 import { toJson } from '../render.js';
+import { V } from '../versions.js';
 
 export default {
   id: 'typescript',
@@ -45,7 +46,7 @@ export default {
       },
       pkg: {
         devDependencies: {
-          typescript: '^5.9.3',
+          typescript: V.typescript,
           '@types/node': `^${cfg.nodeVersion}.0.0`,
         },
       },

package/src/core/features/vite.js

@@ -1,12 +1,13 @@
+import { V } from '../versions.js';
 // Vite build path: powers Vite SPA apps (React/Vue/Svelte) and Vue component
 // libraries (SFCs need a real compiler). Owns the vite config, build scripts,
 // and — for libraries — the package entry points. index.html + source come
 // from frameworks.js. Svelte libraries ship source and don't come through here.
 
 const PLUGIN = {
-  react: { import: `import react from '@vitejs/plugin-react';`, call: 'react()', dep: { '@vitejs/plugin-react': '^6.0.0' } },
-  vue: { import: `import vue from '@vitejs/plugin-vue';`, call: 'vue()', dep: { '@vitejs/plugin-vue': '^6.0.0' } },
-  svelte: { import: `import { svelte } from '@sveltejs/vite-plugin-svelte';`, call: 'svelte()', dep: { '@sveltejs/vite-plugin-svelte': '^7.0.0' } },
+  react: { import: `import react from '@vitejs/plugin-react';`, call: 'react()', dep: { '@vitejs/plugin-react': V['@vitejs/plugin-react'] } },
+  vue: { import: `import vue from '@vitejs/plugin-vue';`, call: 'vue()', dep: { '@vitejs/plugin-vue': V['@vitejs/plugin-vue'] } },
+  svelte: { import: `import { svelte } from '@sveltejs/vite-plugin-svelte';`, call: 'svelte()', dep: { '@sveltejs/vite-plugin-svelte': V['@sveltejs/vite-plugin-svelte'] } },
 };
 
 export default {
@@ -14,10 +15,10 @@ export default {
   active: (cfg) => cfg.viteBuild,
   apply(cfg) {
     const files = {};
-    const pkg = { scripts: {}, devDependencies: { vite: '^8.0.0' } };
+    const pkg = { scripts: {}, devDependencies: { vite: V.vite } };
     const p = PLUGIN[cfg.framework];
     Object.assign(pkg.devDependencies, p.dep);
-    if (cfg.isVue && cfg.isTs) pkg.devDependencies['vue-tsc'] = '^3.0.0';
+    if (cfg.isVue && cfg.isTs) pkg.devDependencies['vue-tsc'] = V['vue-tsc'];
 
     if (cfg.hasApp) {
       // Front-end SPA — not a published package.
@@ -48,8 +49,8 @@ export default {
       ].join('\n');
       pkg.scripts.build = 'vite build';
       pkg.scripts.dev = 'vite build --watch';
-      pkg.devDependencies['vite-plugin-dts'] = '^5.0.0';
-      if (cfg.isVue) pkg.devDependencies['vue-tsc'] = '^3.0.0';
+      pkg.devDependencies['vite-plugin-dts'] = V['vite-plugin-dts'];
+      if (cfg.isVue) pkg.devDependencies['vue-tsc'] = V['vue-tsc'];
       // entry points
       pkg.files = ['dist'];
       pkg.type = 'module';
@@ -60,7 +61,7 @@ export default {
     }
 
     pkg.scripts.clean = 'rimraf dist';
-    pkg.devDependencies.rimraf = '^6.0.0';
+    pkg.devDependencies.rimraf = V.rimraf;
     return { files, pkg };
   },
 };

package/src/core/monorepo.js

@@ -7,6 +7,7 @@ import community from './features/community.js';
 import agents from './features/agents.js';
 import gitfiles from './features/gitfiles.js';
 import { provenance } from './provenance.js';
+import { V } from './versions.js';
 
 export function buildMonorepo(cfg) {
   // Two genuinely different shapes: a set of publishable libraries, or a
@@ -22,10 +23,7 @@ export function buildMonorepo(cfg) {
   const utils = `@${scope}/utils`;
   const wsProto = pm === 'pnpm' ? 'workspace:*' : '*';
 
-  // Reuse the package-agnostic root files (LICENSE, community, AGENTS.md, gitignore).
-  for (const feat of [community, agents, gitfiles]) {
-    if (feat.active(cfg)) Object.assign(files, feat.apply(cfg).files);
-  }
+  Object.assign(files, workspaceScaffold(cfg, { workspaceGlobs: ['packages/*'] }));
 
   // ---- root ----
   const rootPkg = {
@@ -46,22 +44,20 @@ export function buildMonorepo(cfg) {
       release: 'turbo build && changeset publish',
     },
     devDependencies: {
-      turbo: '^2.0.0',
-      typescript: '^5.9.3',
-      tsup: '^8.0.0',
-      vitest: '^4.0.0',
-      eslint: '^10.0.0',
-      '@eslint/js': '^10.0.0',
-      'typescript-eslint': '^8.0.0',
-      prettier: '^3.3.0',
-      '@changesets/cli': '^2.27.0',
+      turbo: V.turbo,
+      typescript: V.typescript,
+      tsup: V.tsup,
+      vitest: V.vitest,
+      eslint: V.eslint,
+      '@eslint/js': V['@eslint/js'],
+      'typescript-eslint': V['typescript-eslint'],
+      prettier: V.prettier,
+      '@changesets/cli': V['@changesets/cli'],
       '@types/node': `^${cfg.nodeVersion}.0.0`,
     },
   };
   files['package.json'] = toJson(rootPkg);
 
-  if (pm === 'pnpm') files['pnpm-workspace.yaml'] = 'packages:\n  - "packages/*"\n';
-
   files['turbo.json'] = toJson({
     $schema: 'https://turbo.build/schema.json',
     tasks: {
@@ -73,21 +69,6 @@ export function buildMonorepo(cfg) {
     },
   });
 
-  files['tsconfig.base.json'] = toJson({
-    $schema: 'https://json.schemastore.org/tsconfig',
-    compilerOptions: {
-      target: 'ES2022',
-      module: 'ESNext',
-      moduleResolution: 'Bundler',
-      lib: ['ES2022'],
-      strict: true,
-      esModuleInterop: true,
-      skipLibCheck: true,
-      declaration: true,
-      noEmit: true,
-    },
-  });
-
   files['.changeset/config.json'] = toJson({
     $schema: 'https://unpkg.com/@changesets/config@3.0.0/schema.json',
     changelog: '@changesets/cli/changelog',
@@ -97,22 +78,7 @@ export function buildMonorepo(cfg) {
   });
   files['.changeset/README.md'] = '# Changesets\n\nRun `npx changeset` to record a version bump for your next release.\n';
 
-  files['eslint.config.js'] = [
-    `import js from '@eslint/js';`,
-    `import tseslint from 'typescript-eslint';`,
-    ``,
-    `export default tseslint.config(`,
-    `\tjs.configs.recommended,`,
-    `\t...tseslint.configs.recommended,`,
-    `\t{ ignores: ['**/dist'] },`,
-    `);`,
-    ``,
-  ].join('\n');
-  files['.prettierrc.json'] = toJson({ useTabs: true, singleQuote: true, semi: true, printWidth: 100, trailingComma: 'all' });
-
   files['README.md'] = rootReadme(cfg, pm, core, utils);
-  files['packkit.json'] = provenance(cfg);
-  files['.github/workflows/ci.yml'] = ciWorkflow(cfg, pm);
 
   // ---- packages ----
   addPackage(files, {
@@ -145,7 +111,6 @@ export function buildMonorepo(cfg) {
     deps: { [core]: wsProto },
   });
 
-  const install = pm === 'npm' ? 'npm install' : `${pm} install`;
   return {
     config: cfg,
     files,
@@ -173,11 +138,9 @@ function buildFullstack(cfg) {
   const scope = cfg.name.replace(/^@/, '').split('/')[0];
   const shared = `@${scope}/shared`;
   const wsProto = pm === 'pnpm' ? 'workspace:*' : '*';
-  const run = (s) => (pm === 'npm' ? `npm run ${s}` : `${pm} ${s}`);
 
-  for (const feat of [community, agents, gitfiles]) {
-    if (feat.active(cfg)) Object.assign(files, feat.apply(cfg).files);
-  }
+  // apps/* + packages/*, and the DOM lib the web app's JSX needs.
+  Object.assign(files, workspaceScaffold(cfg, { workspaceGlobs: ['apps/*', 'packages/*'], tsconfigLib: ['ES2022', 'DOM'] }));
 
   files['package.json'] = toJson({
     name: cfg.name,
@@ -198,21 +161,17 @@ function buildFullstack(cfg) {
       typecheck: 'turbo typecheck',
     },
     devDependencies: {
-      turbo: '^2.0.0',
-      typescript: '^5.9.3',
-      vitest: '^4.0.0',
-      eslint: '^10.0.0',
-      '@eslint/js': '^10.0.0',
-      'typescript-eslint': '^8.0.0',
-      prettier: '^3.3.0',
+      turbo: V.turbo,
+      typescript: V.typescript,
+      vitest: V.vitest,
+      eslint: V.eslint,
+      '@eslint/js': V['@eslint/js'],
+      'typescript-eslint': V['typescript-eslint'],
+      prettier: V.prettier,
       '@types/node': `^${cfg.nodeVersion}.0.0`,
     },
   });
 
-  if (pm === 'pnpm') {
-    files['pnpm-workspace.yaml'] = 'packages:\n  - "apps/*"\n  - "packages/*"\n';
-  }
-
   files['turbo.json'] = toJson({
     $schema: 'https://turbo.build/schema.json',
     tasks: {
@@ -226,36 +185,7 @@ function buildFullstack(cfg) {
     },
   });
 
-  files['tsconfig.base.json'] = toJson({
-    $schema: 'https://json.schemastore.org/tsconfig',
-    compilerOptions: {
-      target: 'ES2022',
-      module: 'ESNext',
-      moduleResolution: 'Bundler',
-      lib: ['ES2022', 'DOM'],
-      strict: true,
-      esModuleInterop: true,
-      skipLibCheck: true,
-      declaration: true,
-      noEmit: true,
-    },
-  });
-
-  files['eslint.config.js'] = [
-    `import js from '@eslint/js';`,
-    `import tseslint from 'typescript-eslint';`,
-    ``,
-    `export default tseslint.config(`,
-    `\tjs.configs.recommended,`,
-    `\t...tseslint.configs.recommended,`,
-    `\t{ ignores: ['**/dist'] },`,
-    `);`,
-    ``,
-  ].join('\n');
-  files['.prettierrc.json'] = toJson({ useTabs: true, singleQuote: true, semi: true, printWidth: 100, trailingComma: 'all' });
-  files['.github/workflows/ci.yml'] = ciWorkflow(cfg, pm);
   files['README.md'] = fullstackReadme(cfg, pm, shared);
-  files['packkit.json'] = provenance(cfg);
 
   // ---- packages/shared: the contract both sides compile against ----
   files['packages/shared/package.json'] = toJson({
@@ -272,7 +202,7 @@ function buildFullstack(cfg) {
       typecheck: 'tsc --noEmit',
       lint: 'eslint .',
     },
-    devDependencies: { tsup: '^8.0.0' },
+    devDependencies: { tsup: V.tsup },
   });
   files['packages/shared/tsconfig.json'] = toJson({ extends: '../../tsconfig.base.json', include: ['src'] });
   files['packages/shared/src/index.ts'] = [
@@ -307,8 +237,8 @@ function buildFullstack(cfg) {
       typecheck: 'tsc --noEmit',
       lint: 'eslint .',
     },
-    dependencies: { hono: '^4.5.0', '@hono/node-server': '^2.0.0', [shared]: wsProto },
-    devDependencies: { tsx: '^4.0.0', tsup: '^8.0.0' },
+    dependencies: { hono: V.hono, '@hono/node-server': V['@hono/node-server'], [shared]: wsProto },
+    devDependencies: { tsx: V.tsx, tsup: V.tsup },
   });
   files['apps/server/tsconfig.json'] = toJson({ extends: '../../tsconfig.base.json', include: ['src'] });
   files['apps/server/src/app.ts'] = [
@@ -368,17 +298,17 @@ function buildFullstack(cfg) {
       typecheck: 'tsc --noEmit',
       lint: 'eslint .',
     },
-    dependencies: { react: '^19.0.0', 'react-dom': '^19.0.0', [shared]: wsProto },
+    dependencies: { react: V.react, 'react-dom': V['react-dom'], [shared]: wsProto },
     devDependencies: {
-      vite: '^8.0.0',
-      '@vitejs/plugin-react': '^6.0.0',
+      vite: V.vite,
+      '@vitejs/plugin-react': V['@vitejs/plugin-react'],
       // Without the React types, `turbo typecheck` fails on the very first run
       // with TS7016/TS7026 on every JSX element.
-      '@types/react': '^19.0.0',
-      '@types/react-dom': '^19.0.0',
-      '@testing-library/react': '^16.0.0',
-      '@testing-library/dom': '^10.0.0',
-      jsdom: '^29.0.0',
+      '@types/react': V['@types/react'],
+      '@types/react-dom': V['@types/react-dom'],
+      '@testing-library/react': V['@testing-library/react'],
+      '@testing-library/dom': V['@testing-library/dom'],
+      jsdom: V.jsdom,
     },
   });
   files['apps/web/tsconfig.json'] = toJson({
@@ -515,6 +445,50 @@ function fullstackReadme(cfg, pm, shared) {
   ].join('\n');
 }
 
+// Root-level scaffolding shared by both monorepo layouts: workspace globs, the
+// TypeScript base config, lint/format config, community files, CI, and
+// provenance. Each layout adds its own root package.json, turbo tasks, and
+// packages on top. Extracted so these aren't maintained twice.
+function workspaceScaffold(cfg, { workspaceGlobs, tsconfigLib = ['ES2022'] }) {
+  const files = {};
+  // Reuse the package-agnostic root files (LICENSE, community, AGENTS.md, gitignore).
+  for (const feat of [community, agents, gitfiles]) {
+    if (feat.active(cfg)) Object.assign(files, feat.apply(cfg).files);
+  }
+  if (cfg.packageManager === 'pnpm') {
+    files['pnpm-workspace.yaml'] = 'packages:\n' + workspaceGlobs.map((g) => `  - "${g}"\n`).join('');
+  }
+  files['tsconfig.base.json'] = toJson({
+    $schema: 'https://json.schemastore.org/tsconfig',
+    compilerOptions: {
+      target: 'ES2022',
+      module: 'ESNext',
+      moduleResolution: 'Bundler',
+      lib: tsconfigLib,
+      strict: true,
+      esModuleInterop: true,
+      skipLibCheck: true,
+      declaration: true,
+      noEmit: true,
+    },
+  });
+  files['eslint.config.js'] = [
+    `import js from '@eslint/js';`,
+    `import tseslint from 'typescript-eslint';`,
+    ``,
+    `export default tseslint.config(`,
+    `\tjs.configs.recommended,`,
+    `\t...tseslint.configs.recommended,`,
+    `\t{ ignores: ['**/dist'] },`,
+    `);`,
+    ``,
+  ].join('\n');
+  files['.prettierrc.json'] = toJson({ useTabs: true, singleQuote: true, semi: true, printWidth: 100, trailingComma: 'all' });
+  files['.github/workflows/ci.yml'] = ciWorkflow(cfg, cfg.packageManager);
+  files['packkit.json'] = provenance(cfg);
+  return files;
+}
+
 function addPackage(files, { name, dir, src, test, deps }) {
   const pkg = {
     name,

package/src/core/options.js

@@ -353,5 +353,28 @@ export function normalizeConfig(input = {}, diagnostics = null) {
   if (cfg.release !== 'changesets') coerce('canary', false, 'CANARY_REQUIRES_CHANGESETS', 'Canary releases were disabled because they require the Changesets release flow.');
   // JSR is TypeScript-first, ESM, and for plain (non-framework) libraries.
   if (!(cfg.isTs && cfg.hasLibrary && !cfg.hasFramework && !cfg.hasApp)) coerce('jsr', false, 'JSR_REQUIRES_PLAIN_TS_LIBRARY', 'JSR publishing was disabled because it applies only to a plain TypeScript library.');
+
+  cfg.resolved = resolvedView(cfg);
   return cfg;
 }
+
+/**
+ * A grouped, read-only view of the derived state — the same booleans the flat
+ * `cfg.has*`/`is*` flags expose, organized by concern. Consumers that prefer
+ * structured access (`cfg.resolved.targets.app`) can use it instead of
+ * re-interpreting raw selections; the flat flags remain for existing code.
+ *
+ * It is derived purely from the flags computed above, and test/invariants.test.js
+ * asserts the two never disagree and that the state is internally consistent —
+ * so the derived model can't silently contradict itself.
+ */
+function resolvedView(cfg) {
+  return {
+    targets: { library: cfg.hasLibrary, cli: cfg.hasCli, service: cfg.hasService, app: cfg.hasApp },
+    language: { typescript: cfg.isTs, ext: cfg.ext, srcExt: cfg.srcExt },
+    framework: { name: cfg.framework, react: cfg.isReact, vue: cfg.isVue, svelte: cfg.isSvelte, any: cfg.hasFramework },
+    build: { vite: cfg.viteBuild, custom: cfg.customBuild, usesVite: cfg.usesVite, has: cfg.hasBuild },
+    module: { format: cfg.moduleFormat, esm: cfg.hasEsm, cjs: cfg.hasCjs },
+    package: { publishable: cfg.publishable, monorepo: cfg.monorepo },
+  };
+}

package/src/core/versions.js

@@ -0,0 +1,121 @@
+// The single source of truth for every dependency version Packkit writes into
+// generated projects. Feature modules reference these by name instead of
+// hard-coding a spec, so a bump happens in one place and the freshness workflow
+// (scripts/check-template-deps.mjs) has one authoritative list to check.
+//
+// A conformance test (test/versions.test.js) asserts that every version in the
+// generated output comes from this catalog, so nothing can drift back into a
+// feature module unnoticed.
+//
+// When you bump anything here, update LAST_REVIEWED.
+
+export const LAST_REVIEWED = '2026-07-26';
+
+// name → npm spec. Deps that ship at one version everywhere.
+export const V = {
+  // toolchain
+  typescript: '^5.9.3',
+  'typescript-eslint': '^8.0.0',
+  eslint: '^10.0.0',
+  '@eslint/js': '^10.0.0',
+  prettier: '^3.3.0',
+  '@biomejs/biome': '^2.0.0',
+  oxlint: '^1.0.0',
+  turbo: '^2.0.0',
+  rimraf: '^6.0.0',
+  '@types/node': '^24.0.0',
+
+  // build
+  tsup: '^8.0.0',
+  tsdown: '^0.6.0',
+  unbuild: '^3.0.0',
+  rollup: '^4.0.0',
+  '@rollup/plugin-typescript': '^12.0.0',
+  '@rollup/plugin-terser': '^1.0.0',
+  tslib: '^2.6.0',
+  tsx: '^4.0.0',
+  vite: '^8.0.0',
+  'vite-plugin-dts': '^5.0.0',
+
+  // test
+  vitest: '^4.0.0',
+  '@vitest/coverage-v8': '^4.0.0',
+  jsdom: '^29.0.0',
+  jest: '^30.0.0',
+  '@types/jest': '^30.0.0',
+  'ts-jest': '^29.0.0',
+  supertest: '^7.0.0',
+  '@types/supertest': '^6.0.0',
+  '@playwright/test': '^1.50.0',
+
+  // release / package checks
+  '@changesets/cli': '^2.27.0',
+  'release-it': '^21.0.0',
+  np: '^12.0.0',
+  publint: '^0.3.0',
+  '@arethetypeswrong/cli': '^0.18.0',
+  knip: '^5.0.0',
+  'size-limit': '^11.0.0',
+  '@size-limit/preset-small-lib': '^11.0.0',
+
+  // git hooks
+  'simple-git-hooks': '^2.11.0',
+  husky: '^9.1.0',
+  lefthook: '^2.0.0',
+  'lint-staged': '^16.2.0',
+
+  // react
+  react: '^19.0.0',
+  'react-dom': '^19.0.0',
+  '@types/react': '^19.0.0',
+  '@types/react-dom': '^19.0.0',
+  '@vitejs/plugin-react': '^6.0.0',
+  '@testing-library/react': '^16.0.0',
+  '@testing-library/dom': '^10.0.0',
+
+  // vue
+  vue: '^3.4.0',
+  'vue-tsc': '^3.0.0',
+  '@vitejs/plugin-vue': '^6.0.0',
+  '@testing-library/vue': '^8.1.0',
+
+  // svelte
+  svelte: '^5.0.0',
+  'svelte-check': '^4.0.0',
+  '@sveltejs/vite-plugin-svelte': '^7.0.0',
+  '@testing-library/svelte': '^5.2.0',
+
+  // storybook
+  storybook: '^10.0.0',
+  '@storybook/react': '^10.0.0',
+  '@storybook/react-vite': '^10.0.0',
+  '@storybook/vue3': '^10.0.0',
+  '@storybook/vue3-vite': '^10.0.0',
+  '@storybook/svelte': '^10.0.0',
+  '@storybook/svelte-vite': '^10.0.0',
+
+  // services
+  hono: '^4.5.0',
+  '@hono/node-server': '^2.0.0',
+  fastify: '^5.0.0',
+  express: '^5.0.0',
+  '@types/express': '^5.0.0',
+  zod: '^4.0.0',
+};
+
+// Peer-dependency ranges — deliberately looser than the direct-dependency spec,
+// so a component library declares broad compatibility rather than a hard pin.
+export const PEER = {
+  react: '>=18',
+  'react-dom': '>=18',
+  vue: '>=3',
+  svelte: '>=5',
+};
+
+// Deps intentionally held below their latest major, with the reason. The
+// freshness check reads this so a held-back dep is reported, not failed.
+export const HELD = {
+  typescript: 'typescript-eslint peers typescript <6.1.0 (no TS 7 support yet)',
+  knip: 'v6 crashes on the oxc-parser native binding',
+  'lint-staged': 'v17 requires Node >=22.22.1, above our Node 22 engines floor; hold at 16 to keep the Maintenance-LTS line working',
+};