[Pkg] Move the tooling devDependencies of the packages to the root package.json

.github/dependabot.yml

@@ -16,10 +16,7 @@ updates:
 
     # npm, but only for the tooling (build, lint, tests). bin/update_tooling_dependencies.ts updates the same list locally.
     - package-ecosystem: 'npm'
-      directories:
-          - '/'
-          - '/src/*/assets'
-          - '/src/*/src/Bridge/*/assets'
+      directory: '/'
       schedule:
           interval: 'weekly'
       allow:

.github/workflows/code-quality.yaml

@@ -144,6 +144,18 @@ jobs:
                       done
                   done
 
+            # An app installs a package through "file:vendor/...", and npm then installs its devDependencies too
+            - name: Check all package.json devDependencies are peerDependencies of the exact same version
+              if: always()
+              run: |
+                  for file in $(find src/ -mindepth 2 -type f -name package.json -not -path "*/tests/*" -not -path "*/vendor/*" -not -path "*/node_modules/*"); do
+                      devDependencies=$(jq -r '(.peerDependencies // {}) as $peers | (.devDependencies // {}) | to_entries[] | select($peers[.key] != .value) | .key' "$file")
+                      if [ -n "$devDependencies" ]; then
+                          echo "File $file has devDependencies that are not peerDependencies of the exact same version, move them to the root package.json:" $devDependencies;
+                          exit 1;
+                      fi
+                  done
+
             - name: Check all package.json have a README.md next to them
               if: always()
               run: |

AGENTS.md

@@ -147,6 +147,7 @@ apps/
 
 - **Dist files committed**: after TS source change, run `pnpm run build` + commit `dist/`.
 - **pnpm workspaces**: `src/*/assets` and `src/*/src/Bridge/*/assets`.
+- **devDependencies**: a package only repeats its `peerDependencies` there; tools and types go in the root `package.json`, because npm installs them in every app requiring the package through `file:vendor/...` (checked by the `validate-packages` CI job).
 - **Peer dependency matrix**: JS unit tests may run against multiple peer dep versions (via `bin/unit_test_package.sh`).
 - **PHPStan**: only configured for `src/Turbo` (`phpstan.dist.neon`).
 - **Snapshot tests**: Toolkit uses PHPUnit snapshots — update with `php vendor/bin/phpunit -d --update-snapshots`.

package.json

@@ -34,18 +34,36 @@
         "@puppeteer/browsers": "^3.2.4",
         "@testing-library/dom": "^10.4.2",
         "@testing-library/jest-dom": "^7.0.1",
+        "@testing-library/user-event": "^14.6.7",
         "@tsdown/css": "^0.23.1",
+        "@types/google.maps": "^3.55.9",
+        "@types/hotwired__turbo": "^8.0.4",
+        "@types/leaflet": "^1.9.12",
         "@types/node": "^22.20.5",
+        "@types/node-fetch": "^2.6.13",
+        "@types/react": "^18.0 || ^19.0",
+        "@types/react-dom": "^18.0 || ^19.0",
+        "@types/webpack-env": "^1.18.8",
+        "@vitejs/plugin-react": "^6.1.2",
+        "@vitejs/plugin-vue": "^6.0.10",
         "browserslist": "^4.29.3",
+        "idiomorph": "^0.7.4",
+        "jsdom": "^29.1.1",
         "lightningcss": "^1.33.0",
+        "node-fetch": "^3.3.2",
         "oxc-parser": "^0.153.0",
         "oxfmt": "^0.72.0",
         "oxlint": "^1.87.0",
         "pkg-types": "^2.3.3",
         "proxy-agent": "^8.0.2",
+        "resize-observer-polyfill": "^1.5.1",
         "tinyglobby": "^0.2.17",
         "tsdown": "^0.23.1",
+        "tslib": "^2.8.1",
+        "typescript": "^6.0.3",
         "vitest": "^5.0.3",
+        "vitest-canvas-mock": "^1.2.0",
+        "vitest-fetch-mock": "^0.4.5",
         "web-features": "^3.42.0",
         "yaml": "^2.9.1"
     }