fix(build): align dist dependencies and add depcruise checks

[ikeyan]

Description

This PR adds dependency-cruiser checks for built dist outputs and aligns Rollup externals plus package metadata with what the generated files actually reference.

Build helpers and Rollup externals

• add shared build helpers to scripts/build-utils.js
• in each rollup.config.js, use those helpers to:
  • derive Rollup externals from package.json metadata instead of manually maintaining package-specific lists
  • include both bare and node:-prefixed builtin modules
  • allow package-specific self-import allowlists where needed
• remove the old Vite types resolve workaround from the dts build helper
• set inputBase: 'src' for @vitest/browser dts generation so temporary declaration files stay under .types

Package metadata changes in @vitest/ws-client

• @vitest/ws-client: add optional peer dependency on vitest
• ws: removed because it was completely unused
• flatted: moved to devDependencies because it is bundled

depcruise

• rules: .dependency-cruiser.cjs
• baseline: .dependency-cruiser-known-violations.json
• scripts:
  • pnpm depcruise to check built dist dependencies while ignoring the current baseline
  • pnpm depcruise:baseline to regenerate the current baseline
• this PR adds local configuration and scripts only
• it does not add a CI check; wiring depcruise into CI can be done in a follow-up PR

The depcruise rules currently check built dist files for:

• unresolved dependencies
• undeclared or dev-only npm dependencies
• sharp imports
• ancestor npm dependencies
• circular dependencies
• orphaned (unused) dist files
• deprecated npm packages
• undetermined dependencies

depcruise helps catch regressions like:

• missing @opentelemetry/api types in published vitest declarations ([4.0.11] @opentelemetry/api type error with new release #9064)
• vite type surface mismatches leaking through published vitest declarations (Vitest 4.x internal typescript error with Vite <=7.1.0 #9055)

UI virtual module import

• change the UI global setup import from uno.css to virtual:uno.css
• this makes the dependency explicit for depcruise, since uno.css is a Vite virtual module and would otherwise be treated as an unknown dependency

Bundled ws optional peers

• in the vitest bundle, define both process.env.WS_NO_UTF_8_VALIDATE and process.env.WS_NO_BUFFER_UTIL
• this removes runtime references from bundled ws code to its optional native peers utf-8-validate and bufferutil

Dist changes

• in the published @vitest/browser package, the following temporary declaration files disappear:
  • dist/shared/screenshotMatcher/types.d.ts
  • dist/types.d.ts
• the published vitest dist no longer references utf-8-validate or bufferutil
• other generated js / d.ts changes are the expected result of the externals cleanup above

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. If the feature is substantial or introduces breaking changes without a discussion, PR might be closed.
• Ideally, include a test that fails without this PR but passes with it.
• Please, don't make changes to pnpm-lock.yaml unless you introduce a new test example.
  • Added dependency-cruiser to the root package.json, so pnpm-lock.yaml is changed.
  • pnpm depcruise can be seen as a new test.
• Please check Allow edits by maintainers to make review process faster. Note that this option is not available for repositories that are owned by Github organizations.

Tests

• Run the tests with pnpm test:ci.
  • Executed locally.
  • Current failures also reproduce on main after pnpm build, for example:
    • pnpm -C test/cli test test/list.test.ts -t 'browser.enabled'
    • pnpm -C test/cli test test/mocking.test.ts -t 'playwright'

Documentation

• If you introduce new functionality, document it. You can run documentation with pnpm run docs command.
  • No new feature.

Changesets

• Changes in changelog are generated from PR name. Please, make sure that it explains your changes in an understandable manner. Please, prefix changeset messages with feat:, fix:, perf:, docs:, or chore:.

Notes

• AI assistance disclosure: this PR was prepared with help from Codex.

[netlify]

✅ Deploy Preview for vitest-dev ready!

Built without sensitive environment variables

Name	Link
🔨 Latest commit	6e89298
🔍 Latest deploy log	https://app.netlify.com/projects/vitest-dev/deploys/69cd634cbe29130008000a7c
😎 Deploy Preview	https://deploy-preview-10003--vitest-dev.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[sheremet-va]

Thanks for finding peer dependency issues. I made to PRs to resolve them, since they are not supposed to be in the bundle:

• fix(expect): don't leak "runner" types #10004
• fix(ui): don't leak vite types #10005

The ws-client is deprecated, so I am not fixing it there.

[sheremet-va]

I am actually working on another PR where I removed tsconfig.paths in favor of exports field. It should address at least that, but it's good to have a dist analyser because otherwise no one imports from there.