# Context: Dependency Summary

Key runtime dependencies and why they're there.

## Frontend (Angular)

| Dep                    | Why                                                   |
| ---------------------- | ----------------------------------------------------- |
| `@angular/* 19`        | Standalone + Signals + zoneless-ready                 |
| `@angular/material 19` | Form fields, dialog, button — themed via tokens       |
| `@jsverse/transloco 7` | i18n (TH/EN) with reactive lang switching             |
| `ngx-toastr 19`        | Toast UX                                              |
| `luxon 3`              | Date math + locale-aware formatting (UTC on the wire) |

## Frontend (Next.js)

| Dep           | Why                                             |
| ------------- | ----------------------------------------------- |
| `next 15`     | App Router + Server Components + Server Actions |
| `next-intl 3` | i18n (TH/EN), `as-needed` locale prefix         |
| `zod 3`       | Server Action validation + shared schemas       |

## Backend (.NET 9)

| Dep                                                  | Why                                            |
| ---------------------------------------------------- | ---------------------------------------------- |
| `MediatR`                                            | CQRS pipeline (Logging + Validation behaviors) |
| `FluentValidation`                                   | Request validation                             |
| `EF Core 9` (`Npgsql`, `SqlServer`)                  | ORM — projection-style reads                   |
| `Konscious.Security.Cryptography.Argon2`             | Argon2id password hashing                      |
| `Serilog.AspNetCore` + `Serilog.Sinks.OpenTelemetry` | Structured logs → OTLP                         |
| `OpenTelemetry.Instrumentation.AspNetCore` etc.      | Tracing                                        |
| `Swashbuckle.AspNetCore`                             | OpenAPI/Swagger                                |

## Backend (Node)

| Dep                                                    | Why                                        |
| ------------------------------------------------------ | ------------------------------------------ |
| `@nestjs/* 11`                                         | Modules + DI + guards/filters/interceptors |
| `nestjs-pino` + `pino-pretty`                          | Structured logs                            |
| `@prisma/client 6`                                     | Postgres access                            |
| `bullmq 5` + `ioredis 5`                               | Queue for audit + notifications            |
| `jose 5`                                               | JWT verification (no native deps)          |
| `nodemailer`                                           | SMTP                                       |
| `firebase-admin`                                       | FCM push                                   |
| `@aws-sdk/client-s3` + `@aws-sdk/s3-request-presigner` | S3-compatible storage                      |

## Why each peer/transitive pin in root pnpm.overrides

- `eslint-visitor-keys ^4.2.0`, `@typescript-eslint/* ^8.18` — eslint 10 + visitor-keys 5 require Node ≥ 20.19; our env is 20.11. Bump when Node bumps.
- `OpenTelemetry.Exporter.OpenTelemetryProtocol 1.13.1` (.NET) — security advisory chain; `NoWarn=NU1902` on the Api csproj documents the transitive Grpc.Core remainder.
