fg-devkit 1.0.0

package/scripts/fg-devkit.mjs

@@ -0,0 +1,247 @@
+#!/usr/bin/env node
+/**
+ * fg-devkit CLI: dependency policy, editor/tooling config sync, and VS Code settings.
+ *
+ * Non-interactive (for scripts and automation):
+ *   pnpm exec fg-devkit check-deps [policy-file]
+ *   pnpm exec fg-devkit sync-deps [policy-file]
+ *   pnpm exec fg-devkit sync-project-configs   (VS Code + Prettier + ESLint stub + tsconfig app template)
+ *   pnpm exec fg-devkit sync-tooling-configs   (Prettier + ESLint stub + tsconfig app template only)
+ *   pnpm exec fg-devkit sync-vscode-settings
+ *   pnpm exec fg-devkit create-release [patch|minor|major]
+ *   pnpm exec fg-devkit commit [cz-args...]   (Commitizen; uses package.json config.commitizen.path)
+ *   pnpm exec fg-devkit commit-vuln           (staged package.json version bumps → vuln() commit)
+ * Interactive menu (no subcommand):
+ *   pnpm exec fg-devkit
+ *
+ * Maintainer-only policy regeneration is not exposed here; run
+ * node node_modules/fg-devkit/scripts/refresh-dependency-policy-from-repos.mjs from a checkout when needed.
+ */
+
+import { spawnSync } from 'node:child_process'
+import fs from 'node:fs'
+import readline from 'node:readline/promises'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { stdin as input, stdout as output } from 'node:process'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+
+/** Run another script in this package via Node; inherits stdio and returns the child exit code. */
+function runNode(scriptRelative, args = [], options = {}) {
+  const scriptPath = path.join(scriptDir, scriptRelative)
+  if (!fs.existsSync(scriptPath)) {
+    console.error(`[fg-devkit] Missing script: ${scriptPath}`)
+    return 1
+  }
+  const r = spawnSync(process.execPath, [scriptPath, ...args], {
+    stdio: 'inherit',
+    cwd: options.cwd ?? process.cwd(),
+    env: process.env,
+  })
+  if (r.error) {
+    console.error('[fg-devkit]', r.error.message)
+    return 1
+  }
+  return r.status ?? 1
+}
+
+/**
+ * Run release.sh (pnpm version bump, git push, gh release). Uses consumer cwd.
+ * Optional first arg: patch | minor | major (otherwise the script prompts interactively).
+ */
+function runReleaseScript(args = []) {
+  const shPath = path.join(scriptDir, 'release.sh')
+  if (!fs.existsSync(shPath)) {
+    console.error(`[fg-devkit] Missing release.sh: ${shPath}`)
+    return 1
+  }
+  const r = spawnSync('bash', [shPath, ...args], {
+    stdio: 'inherit',
+    cwd: process.cwd(),
+    env: process.env,
+  })
+  if (r.error) {
+    console.error('[fg-devkit]', r.error.message)
+    return 1
+  }
+  return r.status ?? 1
+}
+
+/**
+ * Run Commitizen in the consumer repo (reads config.commitizen.path from package.json).
+ * Tries pnpm exec cz, then pnpm exec git-cz, then npx commitizen git-cz.
+ */
+function runCommitizen(args = []) {
+  const cwd = process.cwd()
+  const attempts = [
+    () => spawnSync('pnpm', ['exec', 'cz', ...args], { stdio: 'inherit', cwd, env: process.env }),
+    () => spawnSync('pnpm', ['exec', 'git-cz', ...args], { stdio: 'inherit', cwd, env: process.env }),
+    () =>
+      spawnSync('npx', ['--yes', 'commitizen', 'git-cz', ...args], {
+        stdio: 'inherit',
+        cwd,
+        env: process.env,
+      }),
+  ]
+  for (const run of attempts) {
+    const r = run()
+    if (r.error) {
+      if (r.error.code === 'ENOENT') {
+        continue
+      }
+      console.error('[fg-devkit]', r.error.message)
+      return 1
+    }
+    return r.status ?? 1
+  }
+  console.error(
+    '[fg-devkit] Commitizen not found. Add devDependency "commitizen", set config.commitizen.path, then retry.',
+  )
+  return 1
+}
+
+/** Map subcommand name → script file (extra argv after subcommand is forwarded). */
+const DIRECT_COMMANDS = {
+  'check-deps': 'check-dependency-policy.mjs',
+  'sync-deps': 'sync-dependency-policy.mjs',
+  'sync-project-configs': 'sync-project-configs.mjs',
+  'sync-tooling-configs': 'sync-tooling-configs.mjs',
+  'sync-vscode-settings': 'sync-vscode-settings.mjs',
+}
+
+function printHelp() {
+  console.log(`Usage:
+  pnpm exec fg-devkit [command] [args...]
+
+Commands:
+  check-deps [policy-file]        Validate package.json + pins against policy
+  sync-deps [policy-file]         Align declared versions to policy (existing keys only)
+  sync-project-configs            VS Code settings + Prettier + ESLint + tsconfig (app template)
+  sync-tooling-configs            Prettier + ESLint + tsconfig (app template; no VS Code)
+  sync-vscode-settings            Copy shared VS Code settings into .vscode/settings.json
+  create-release [bump]         Version bump, git push, GitHub release (patch|minor|major; omit = prompt)
+                                 (alias: createRelease)
+  commit [args...]              Commitizen (git-cz); uses config.commitizen.path in package.json
+  commit-vuln                   Commit staged dependency bumps as vuln() (alias: vuln-commit)
+
+With no command, opens an interactive menu.
+
+Options:
+  -h, --help                     Show this help`)
+}
+
+/** Numbered actions shown in the interactive menu (keys must match user input). */
+const MENU = [
+  {
+    key: '1',
+    label: 'Check dependency policy against package.json (check-deps)',
+    run: () => runNode('check-dependency-policy.mjs'),
+  },
+  {
+    key: '2',
+    label: 'Sync dependency versions from policy (sync-deps)',
+    run: () => runNode('sync-dependency-policy.mjs'),
+  },
+  {
+    key: '3',
+    label: 'Sync project configs (VS Code + Prettier + ESLint + tsconfig app template)',
+    run: () => runNode('sync-project-configs.mjs'),
+  },
+  {
+    key: '4',
+    label: 'Create release (version bump, push, gh release — run from package repo root)',
+    run: () => runReleaseScript(),
+  },
+  {
+    key: '5',
+    label: 'Commit (Commitizen — interactive conventional commit)',
+    run: () => runCommitizen(),
+  },
+  {
+    key: '6',
+    label: 'Commit vulnerability bumps (staged package.json → vuln() message)',
+    run: () => runNode('vuln-commit.mjs'),
+  },
+]
+
+async function runInteractiveMenu() {
+  const rl = readline.createInterface({ input, output })
+
+  console.log(`\nfg-devkit — choose a task (cwd: ${process.cwd()})\n`)
+
+  for (const item of MENU) {
+    console.log(`  ${item.key}) ${item.label}`)
+  }
+  console.log('  0) Exit\n')
+
+  const choice = (await rl.question('Number: ')).trim()
+
+  if (choice === '0' || choice === '') {
+    rl.close()
+    return 0
+  }
+
+  const item = MENU.find((m) => m.key === choice)
+  if (!item) {
+    console.error('[fg-devkit] Unknown option. Run again and choose a number from the list.')
+    rl.close()
+    return 1
+  }
+
+  let exitCode = 0
+  try {
+    const out = item.run()
+    if (typeof out === 'object' && out !== null && typeof out.then === 'function') {
+      exitCode = await out
+    } else if (typeof out === 'number') {
+      exitCode = out
+    }
+  } finally {
+    rl.close()
+  }
+  return exitCode
+}
+
+async function main() {
+  const [, , sub, ...rest] = process.argv
+
+  if (sub === '--help' || sub === '-h') {
+    printHelp()
+    return
+  }
+
+  if (sub) {
+    if (sub === 'create-release' || sub === 'createRelease') {
+      process.exitCode = runReleaseScript(rest)
+      return
+    }
+    if (sub === 'commit') {
+      process.exitCode = runCommitizen(rest)
+      return
+    }
+    if (sub === 'commit-vuln' || sub === 'vuln-commit' || sub === 'commit:vuln') {
+      process.exitCode = runNode('vuln-commit.mjs', rest)
+      return
+    }
+    const script = DIRECT_COMMANDS[sub]
+    if (!script) {
+      console.error(`[fg-devkit] Unknown command: ${sub}`)
+      console.error('[fg-devkit] Run with --help for usage.')
+      process.exitCode = 1
+      return
+    }
+    process.exitCode = runNode(script, rest)
+    return
+  }
+
+  const code = await runInteractiveMenu()
+  if (code) {
+    process.exitCode = code
+  }
+}
+
+main().catch((err) => {
+  console.error('[fg-devkit]', err)
+  process.exitCode = 1
+})

package/scripts/refresh-dependency-policy-from-repos.mjs

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+/**
+ * Rebuilds dependency-policy.vue-workspace.json from the union of all npm packages
+ * declared in Vue projects under a given projects root (not limited to keys that
+ * already exist in the policy).
+ *
+ * Classification:
+ * - Package appears only as dependencies everywhere → managedDependencies.dependencies
+ * - Package appears only as devDependencies → managedDependencies.devDependencies
+ * - Package appears as both (across or within repos) → managedAnywhere
+ *
+ * Version per package: highest semver among all parseable version strings (ignores
+ * file:, workspace:, link:). Packages with no parseable semver are skipped (e.g. only file:).
+ *
+ * Rules:
+ * - A package.json is considered a Vue project only if it lists "vue" in dependencies or devDependencies.
+ *
+ * Runs entirely on the local filesystem (no registry or network).
+ *
+ * Usage:
+ *   node scripts/refresh-dependency-policy-from-repos.mjs [projectsRoot] [policyFile]
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { collectPinViolations } from './dependency-policy-pins.mjs'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const fgDevkitRoot = path.resolve(scriptDir, '..')
+
+const projectsRoot = process.argv[2]
+  ? path.resolve(process.cwd(), process.argv[2])
+  : path.resolve(scriptDir, '../..')
+
+const policyPath = process.argv[3]
+  ? path.resolve(process.cwd(), process.argv[3])
+  : path.join(fgDevkitRoot, 'configs/dependency-policy.vue-workspace.json')
+
+/** Relative paths under projectsRoot whose package.json files are ignored (maintainer choice). */
+/** Relative path prefixes under projectsRoot to skip when scanning (add repo names as needed). */
+const SKIP_DIR_PREFIXES = []
+
+/** Recursively collect every package.json path under dir, skipping node_modules and .git. */
+function walk(dir, acc = []) {
+  for (const name of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (name.name === 'node_modules' || name.name === '.git') continue
+    const p = path.join(dir, name.name)
+    if (name.isDirectory()) walk(p, acc)
+    else if (name.name === 'package.json') acc.push(p)
+  }
+  return acc
+}
+
+function shouldSkipPackageJson(relDir) {
+  for (const prefix of SKIP_DIR_PREFIXES) {
+    if (relDir === prefix || relDir.startsWith(`${prefix}${path.sep}`)) return true
+  }
+  return false
+}
+
+function isVueProject(j) {
+  const d = { ...j.dependencies, ...j.devDependencies }
+  return Boolean(d.vue)
+}
+
+/**
+ * Parse a version range string into [major, minor, patch] for comparison, or null if not usable.
+ * Strips common range prefixes; returns null for file/workspace/link/local paths.
+ */
+function coerceParts(spec) {
+  if (typeof spec !== 'string') return null
+  const s = spec.trim()
+  if (/^(file:|workspace:|link:|\.\/|\.\.\/)/.test(s)) return null
+  let t = s.replace(/^>=|^<=|^>|^</, '').trim()
+  t = t.replace(/^[\^~]/, '')
+  const base = t.split(/[-+]/)[0]
+  let m = base.match(/^(\d+)\.(\d+)\.(\d+)/)
+  if (m) return [+m[1], +m[2], +m[3]]
+  m = base.match(/^(\d+)\.(\d+)$/)
+  if (m) return [+m[1], +m[2], 0]
+  m = base.match(/^(\d+)$/)
+  if (m) return [+m[0], 0, 0]
+  return null
+}
+
+/** Lexicographic semver compare on numeric [major, minor, patch] tuples. */
+function compareParts(a, b) {
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] - b[i]
+  }
+  return 0
+}
+
+/** Stable sort keys alphabetically for readable JSON diffs. */
+function sortRecord(obj) {
+  return Object.keys(obj)
+    .sort((a, b) => a.localeCompare(b))
+    .reduce((o, k) => {
+      o[k] = obj[k]
+      return o
+    }, {})
+}
+
+const pkgPaths = walk(projectsRoot).filter((pkgPath) => {
+  const rel = path.relative(projectsRoot, path.dirname(pkgPath))
+  return !shouldSkipPackageJson(rel || '.')
+})
+
+/**
+ * Per package name: whether it appears in dependencies and/or devDependencies, and all parseable semver tuples.
+ * @type {Map<string, { hasDep: boolean, hasDev: boolean, partsList: number[][] }>}
+ */
+const usage = new Map()
+
+// Aggregate usage across all Vue package.json files under projectsRoot.
+for (const pkgPath of pkgPaths) {
+  let j
+  try {
+    j = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+  } catch {
+    continue
+  }
+  if (!isVueProject(j)) continue
+
+  const deps = j.dependencies ?? {}
+  const devs = j.devDependencies ?? {}
+  const names = new Set([...Object.keys(deps), ...Object.keys(devs)])
+
+  for (const name of names) {
+    if (!usage.has(name)) {
+      usage.set(name, { hasDep: false, hasDev: false, partsList: [] })
+    }
+    const u = usage.get(name)
+    if (deps[name] !== undefined) u.hasDep = true
+    if (devs[name] !== undefined) u.hasDev = true
+    const v = deps[name] ?? devs[name]
+    const parts = coerceParts(v)
+    if (parts) u.partsList.push(parts)
+  }
+}
+
+const outDeps = {}
+const outDev = {}
+const outAny = {}
+
+// Pick highest semver per package and assign to dependencies, devDependencies, or managedAnywhere.
+for (const [name, u] of usage) {
+  if (u.partsList.length === 0) {
+    continue
+  }
+  let best = u.partsList[0]
+  for (const p of u.partsList) {
+    if (compareParts(p, best) > 0) best = p
+  }
+  const pinned = `${best[0]}.${best[1]}.${best[2]}`
+  const mixed = u.hasDep && u.hasDev
+  if (mixed) outAny[name] = pinned
+  else if (u.hasDep) outDeps[name] = pinned
+  else outDev[name] = pinned
+}
+
+const policy = {
+  managedDependencies: {
+    dependencies: sortRecord(outDeps),
+    devDependencies: sortRecord(outDev),
+  },
+  managedAnywhere: sortRecord(outAny),
+}
+
+const policyErrors = [
+  ...Object.entries(policy.managedDependencies).flatMap(([section, deps]) =>
+    collectPinViolations(`managedDependencies.${section}.`, deps),
+  ),
+  ...collectPinViolations('managedAnywhere.', policy.managedAnywhere),
+]
+
+if (policyErrors.length > 0) {
+  console.error('[refresh-policy] Generated policy has invalid pins:')
+  for (const e of policyErrors) console.error(`- ${e}`)
+  process.exit(1)
+}
+
+fs.writeFileSync(policyPath, `${JSON.stringify(policy, null, 2)}\n`)
+
+console.log(`[refresh-policy] projectsRoot=${projectsRoot}`)
+console.log(`[refresh-policy] policy=${policyPath}`)
+console.log(
+  `[refresh-policy] wrote union: ${Object.keys(outDeps).length} dependencies, ${Object.keys(outDev).length} devDependencies, ${Object.keys(outAny).length} managedAnywhere (${usage.size} package names seen)`,
+)

package/scripts/release.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+#
+# Interactive or scripted release for this package: bumps version with pnpm, pushes commits/tags,
+# and creates a GitHub Release with generated notes (requires gh CLI, authenticated).
+#
+# Usage: ./scripts/release.sh [major|minor|patch]
+#   With no argument, prompts for patch/minor/major.
+
+set -euo pipefail
+
+bump_type="${1:-}"
+
+if [[ -z "$bump_type" ]]; then
+  echo "Select release type:"
+  echo "  1) patch"
+  echo "  2) minor"
+  echo "  3) major"
+  read -r -p "Enter choice [1-3] (default: 1): " release_choice
+  release_choice="${release_choice:-1}"
+  case "$release_choice" in
+    1) bump_type="patch" ;;
+    2) bump_type="minor" ;;
+    3) bump_type="major" ;;
+    *)
+      echo "Invalid choice: $release_choice"
+      exit 1
+      ;;
+  esac
+fi
+
+if [[ "$bump_type" != "major" && "$bump_type" != "minor" && "$bump_type" != "patch" ]]; then
+  echo "Usage: ./scripts/release.sh [major|minor|patch]"
+  exit 1
+fi
+
+if ! command -v gh >/dev/null 2>&1; then
+  echo "GitHub CLI (gh) is required but not installed."
+  exit 1
+fi
+
+if ! gh auth status >/dev/null 2>&1; then
+  echo "GitHub CLI is not authenticated. Run: gh auth login"
+  exit 1
+fi
+
+if [[ -n "$(git status --porcelain)" ]]; then
+  echo "Git working tree is not clean. Commit or stash changes first."
+  exit 1
+fi
+
+previous_tag="$(git describe --tags --abbrev=0 2>/dev/null || true)"
+
+pnpm version "$bump_type"
+
+new_version="$(node -p "require('./package.json').version")"
+new_tag="v${new_version}"
+
+git push
+git push --tags
+
+if [[ -n "$previous_tag" ]]; then
+  gh release create "$new_tag" \
+    --latest \
+    --generate-notes \
+    --notes-start-tag "$previous_tag"
+else
+  gh release create "$new_tag" \
+    --latest \
+    --generate-notes
+fi
+
+echo "Release created: ${new_tag}"

package/scripts/resolve-dependency-policy-path.mjs

@@ -0,0 +1,32 @@
+/**
+ * Resolves which dependency policy JSON file check/sync scripts should load.
+ *
+ * Used by check-dependency-policy.mjs and sync-dependency-policy.mjs so both tools share one rule:
+ * optional argv[2] override, otherwise the packaged default next to this package.
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+const DEFAULT_POLICY = 'dependency-policy.vue-workspace.json'
+
+/**
+ * First CLI argument selects the policy file (optional).
+ * - Omitted: fg-devkit/configs/dependency-policy.vue-workspace.json
+ * - Absolute path: used as-is
+ * - Relative path: if it exists under cwd, use it; else fg-devkit/configs/<arg>
+ */
+export function resolveDependencyPolicyPath(scriptDir, cwd, argv) {
+  const arg = argv[2]
+  if (!arg) {
+    return path.resolve(scriptDir, '../configs', DEFAULT_POLICY)
+  }
+  if (path.isAbsolute(arg)) {
+    return arg
+  }
+  const fromCwd = path.resolve(cwd, arg)
+  if (fs.existsSync(fromCwd)) {
+    return fromCwd
+  }
+  return path.resolve(scriptDir, '../configs', arg)
+}

package/scripts/sync-dependency-policy.mjs

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+/**
+ * Rewrites version fields in the current package.json so they match the shared dependency policy.
+ *
+ * Only updates keys that already exist in package.json (does not add new dependencies from the policy).
+ * Aligns managedDependencies, managedAnywhere (only where the package is already declared), optional
+ * policy overrides into pnpm.overrides, and logs each change.
+ *
+ * Refuses to run if the policy file contains any non-pinned versions.
+ *
+ * Policy path: first CLI argument, or default under fg-devkit/configs/.
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { collectPinViolations } from './dependency-policy-pins.mjs'
+import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
+
+const cwd = process.cwd()
+const pkgPath = path.resolve(cwd, 'package.json')
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const policyPath = resolveDependencyPolicyPath(scriptDir, cwd, process.argv)
+
+if (!fs.existsSync(pkgPath)) {
+  console.error('[sync-deps] Could not find package.json in current working directory')
+  process.exit(1)
+}
+
+if (!fs.existsSync(policyPath)) {
+  console.error(`[sync-deps] Could not find dependency policy: ${policyPath}`)
+  console.error(
+    '[sync-deps] Usage: node …/sync-dependency-policy.mjs [policy-file]\n' +
+      '  policy-file: absolute path, path relative to cwd, or filename under fg-devkit/configs/ (default: dependency-policy.vue-workspace.json)',
+  )
+  process.exit(1)
+}
+
+const policy = JSON.parse(fs.readFileSync(policyPath, 'utf8'))
+const policyErrors = [
+  ...Object.entries(policy.managedDependencies ?? {}).flatMap(([section, deps]) =>
+    collectPinViolations(`managedDependencies.${section}.`, deps),
+  ),
+  ...collectPinViolations('managedAnywhere.', policy.managedAnywhere ?? {}),
+  ...collectPinViolations('overrides.', policy.overrides ?? {}),
+]
+
+if (policyErrors.length > 0) {
+  console.error('[sync-deps] Policy file contains non-pinned versions:')
+  for (const err of policyErrors) {
+    console.error(`- ${err}`)
+  }
+  process.exit(1)
+}
+
+const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+const changes = []
+
+// Bump versions for managed dependencies / devDependencies where the key already exists.
+for (const [section, dependencies] of Object.entries(policy.managedDependencies ?? {})) {
+  pkg[section] ||= {}
+
+  for (const [name, version] of Object.entries(dependencies)) {
+    if (pkg[section][name] === undefined) {
+      continue
+    }
+    if (pkg[section][name] !== version) {
+      changes.push(`${section}.${name}: ${pkg[section][name]} -> ${version}`)
+      pkg[section][name] = version
+    }
+  }
+}
+
+// Same for packages that may live in either dependencies or devDependencies.
+for (const [name, version] of Object.entries(policy.managedAnywhere ?? {})) {
+  pkg.dependencies ||= {}
+  pkg.devDependencies ||= {}
+  const inDep = pkg.dependencies[name] !== undefined
+  const inDev = pkg.devDependencies[name] !== undefined
+  if (inDep && inDev) {
+    if (pkg.dependencies[name] !== version) {
+      changes.push(`dependencies.${name}: ${pkg.dependencies[name]} -> ${version}`)
+      pkg.dependencies[name] = version
+    }
+    if (pkg.devDependencies[name] !== version) {
+      changes.push(`devDependencies.${name}: ${pkg.devDependencies[name]} -> ${version}`)
+      pkg.devDependencies[name] = version
+    }
+  } else if (inDep) {
+    if (pkg.dependencies[name] !== version) {
+      changes.push(`dependencies.${name}: ${pkg.dependencies[name] ?? '(missing)'} -> ${version}`)
+      pkg.dependencies[name] = version
+    }
+  } else if (inDev) {
+    if (pkg.devDependencies[name] !== version) {
+      changes.push(`devDependencies.${name}: ${pkg.devDependencies[name] ?? '(missing)'} -> ${version}`)
+      pkg.devDependencies[name] = version
+    }
+  }
+}
+
+pkg.pnpm ||= {}
+pkg.pnpm.overrides ||= {}
+
+// Apply policy-defined override versions when present in the policy.
+for (const [name, version] of Object.entries(policy.overrides ?? {})) {
+  if (pkg.pnpm.overrides[name] !== version) {
+    changes.push(`pnpm.overrides.${name}: ${pkg.pnpm.overrides[name] ?? '(missing)'} -> ${version}`)
+    pkg.pnpm.overrides[name] = version
+  }
+}
+
+if (changes.length === 0) {
+  console.log('[sync-deps] package.json already matches dependency policy')
+  process.exit(0)
+}
+
+fs.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`)
+console.log('[sync-deps] Updated package.json to match dependency policy')
+for (const change of changes) {
+  console.log(`- ${change}`)
+}

package/scripts/sync-peers-from-dev.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+/**
+ * For library packages: copies versions from devDependencies/dependencies into peerDependencies
+ * for every key already listed in peerDependencies, so declared peers stay aligned with local installs.
+ *
+ * Does not add new peer keys; warns and skips peers that have no matching dev/dependency entry.
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+const pkgPath = path.resolve(process.cwd(), 'package.json')
+const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+
+const sources = { ...pkg.devDependencies, ...pkg.dependencies }
+
+pkg.peerDependencies = pkg.peerDependencies || {}
+const peerKeys = Object.keys(pkg.peerDependencies)
+
+for (const name of peerKeys) {
+  const version = sources[name]
+  if (version) {
+    pkg.peerDependencies[name] = version
+  } else {
+    // If missing locally, leave existing peer version untouched
+    console.warn(`[sync-peers] Skipping ${name} (not found in devDependencies/dependencies)`)
+  }
+}
+
+fs.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`)
+console.warn('[sync-peers] peerDependencies updated from devDependencies')