slp-modular-cms/aidlc-docs/_shared/reverse-engineering/dependencies.md

Dependencies

Internal Dependencies

graph TD
    api["SlpModularCms.Api<br/>Client"]
    slave["SlpModularCms.Api.Slave<br/>Client"]
    core["SlpModularCms.Core"]
    mid["Modules.Identity"]
    mav["Modules.Availability"]
    mma["Modules.Master"]
    tcore["Core.Tests"]
    tid["Modules.Identity.Tests"]
    tav["Modules.Availability.Tests"]
    tma["Modules.Master.Tests"]
    fe["frontend<br/>admin SPA"]

    api --> core
    api --> mid
    api --> mav
    api --> mma
    slave --> core
    slave --> mid
    slave --> mav
    mid --> core
    mav --> core
    mma --> core
    tcore --> core
    tid --> mid
    tav --> mav
    tma --> mma
    fe -->|"REST at runtime"| api
    api -->|"pnpm build at publish"| fe

    classDef client fill:#90cdf4,stroke:#2b6cb0,stroke-width:1px,color:#000;
    classDef corelayer fill:#fbd38d,stroke:#c05621,stroke-width:1px,color:#000;
    classDef module fill:#9ae6b4,stroke:#2f855a,stroke-width:1px,color:#000;
    classDef test fill:#e2e8f0,stroke:#4a5568,stroke-width:1px,color:#000;
    classDef frontend fill:#d6bcfa,stroke:#6b46c1,stroke-width:1px,color:#000;
    class api,slave client;
    class core corelayer;
    class mid,mav,mma module;
    class tcore,tid,tav,tma test;
    class fe frontend;

Text alternative: Both host projects reference Core and their modules; every module references only Core; each test project targets its own production project; the admin SPA calls the API at runtime and is itself built by the API project at publish time — a bidirectional coupling between backend and frontend.

Dependency Details

SlpModularCms.Api → SlpModularCms.Core

• Type: Compile
• Reason: AddCoreInfrastructure, AddCmsCors, AddCmsRateLimiting, ModuleOrchestrator, ApiPrefixConvention.

SlpModularCms.Api → Modules.Identity, Modules.Availability, Modules.Master

• Type: Compile (present to force the module DLLs into the output directory)
• Reason: ModuleOrchestrator discovers modules by globbing SlpModularCms.Modules.*.dll in the app base directory, so a project reference is how a module ends up deployed. The code itself does not call into the modules directly. Consequence for deployment: which modules an instance has is determined by which DLLs the published output contains.

SlpModularCms.Api.Slave → Core, Modules.Identity, Modules.Availability

• Type: Compile
• Reason: Same as above, minus the Master module — the omission is the entire point of this host.

Modules.Identity → Core

• Type: Compile
• Reason: Identity entities, IAuthService, IInvitationService, ISetupService, request/response models, authorization policies.

Modules.Availability → Core

• Type: Compile
• Reason: IAvailabilityService, AvailabilityStatus, AvailabilityOptions, MasterControlledAvailabilityException, IModule.

Modules.Master → Core

• Type: Compile
• Reason: IModule, authorization policies, shared exception types.

Test projects → their production project (and transitively Core)

• Type: Test
• Reason: Each suite mirrors one production project, per the solution-folder rules in CLAUDE.md.

frontend → SlpModularCms.Api

• Type: Runtime (HTTP/REST)
• Reason: All data comes from /api/v1/** at VITE_API_BASE_URL, with credentials so the refresh cookie travels.

SlpModularCms.Api → frontend (build-time, reverse direction)

• Type: Build
• Reason: The BuildAndCopyAdminFrontend MSBuild target runs pnpm install --frozen-lockfile and pnpm build in frontend/ before publish and copies dist/** into wwwroot/admin/. This makes Node and pnpm hard prerequisites of dotnet publish on any build agent.

Cross-instance runtime dependencies

Not project references, but real coupling between deployed instances:

• A Master instance calls each registered slave's POST /api/v1/master/register and POST /api/v1/master/status, authenticated with X-Master-Api-Key, through a resilience pipeline (2 retries, exponential backoff with jitter, configurable timeout).
• Each slave calls its Master's GET /api/v1/SlaveStatus on a timer (MasterPolling:PollIntervalSeconds), and fails open to Available after MasterPolling:FailOpenAfterMinutes of unreachability.
• Both directions require the two instances to be reachable over HTTP from one another, which is a deployment/network consideration rather than a code one.

External Dependencies

Backend — SlpModularCms.Core

Package	Version	Purpose	License
Microsoft.EntityFrameworkCore.SqlServer	10.0.9	SQL Server persistence	MIT
Microsoft.AspNetCore.Identity.EntityFrameworkCore	10.0.9	Users, roles, password hashing	MIT
Microsoft.AspNetCore.Authentication.JwtBearer	10.0.9	Bearer token validation	MIT
Microsoft.AspNetCore.OpenApi	10.0.9	OpenAPI document generation	MIT
Asp.Versioning.Mvc	10.0.0	API version reporting	MIT
Microsoft.Extensions.DependencyInjection.Abstractions	10.0.9	DI abstractions	MIT
Microsoft.Extensions.Hosting.Abstractions	10.0.9	Hosting abstractions	MIT
Microsoft.Extensions.Logging.Abstractions	10.0.9	Logging abstractions	MIT
FrameworkReference: Microsoft.AspNetCore.App	net10.0	Lets a class library use ASP.NET Core types, incl. Data Protection	MIT

Backend — SlpModularCms.Api

Package	Version	Purpose	License
Asp.Versioning.Mvc	10.0.0	API versioning	MIT
Microsoft.AspNetCore.Authentication.JwtBearer	10.0.9	Bearer auth	MIT
Microsoft.AspNetCore.OpenApi	10.0.9	OpenAPI	MIT
Microsoft.EntityFrameworkCore.Design	10.0.9 (PrivateAssets)	dotnet ef tooling	MIT
Scalar.AspNetCore	2.16.3	/scalar API reference, Development only	MIT

SlpModularCms.Api.Slave carries Microsoft.EntityFrameworkCore.Design and Scalar.AspNetCore at the same versions.

Backend — modules

Project	Package	Version	Purpose	License
Modules.Master	Microsoft.Extensions.Http.Resilience	9.6.0	Retry/timeout for master→slave calls (pulls in Polly)	MIT
Modules.Availability	—	—	No external packages beyond Core's transitives	—
Modules.Identity	—	—	No external packages beyond Core's transitives	—

Version note: Microsoft.Extensions.Http.Resilience 9.6.0 is a 9.x package on net10.0 targets. It works, but it is the one dependency out of step with the otherwise uniform 10.0.x line — worth pinning deliberately rather than by accident in any CI setup.

Backend — test projects (all four, identical set)

Package	Version	Purpose	License
Microsoft.NET.Test.Sdk	17.14.1	Test host	MIT
xunit	2.9.3	Test framework	Apache-2.0
xunit.runner.visualstudio	3.1.4	Test adapter	Apache-2.0
FluentAssertions	8.10.0	Assertions	Dual: free for non-commercial / paid commercial from v8 — worth verifying against how this project is used
NSubstitute	5.3.0	Mocking	BSD-3-Clause
AutoFixture	4.18.1	Test data generation	MIT
Microsoft.EntityFrameworkCore.InMemory	10.0.9	In-memory provider for tests	MIT
coverlet.collector	6.0.4	Coverage collection	MIT

Frontend — runtime (frontend/package.json dependencies)

Package	Version	Purpose	License
react, react-dom	^19.2.6	UI framework	MIT
@tanstack/react-router	^1.170.16	Routing (honours BASE_URL, so /admin works)	MIT
@tanstack/react-query	^5.101.0	Server state	MIT
@radix-ui/react-{dialog,dropdown-menu,label,select,slot}	1.x–2.x	Accessible primitives	MIT
react-hook-form	^7.79.0	Forms	MIT
@hookform/resolvers	^5.4.0	Validation bridge	MIT
zod	^4.4.3	Schema validation (also validates app config)	MIT
i18next, react-i18next, i18next-browser-languagedetector	26 / 17 / 8	NL/EN localisation	MIT
lucide-react	^1.21.0	Icons	ISC
sonner	^2.0.7	Toasts	MIT
class-variance-authority, clsx, tailwind-merge	0.7 / 2.1 / 3.6	Class composition	MIT

Frontend — build and test (devDependencies)

Package	Version	Purpose	License
vite	^8.0.12	Build tool / dev server	MIT
@vitejs/plugin-react	^6.0.1	React support	MIT
typescript	~6.0.2	Type checking (tsc -b gates the build)	Apache-2.0
tailwindcss, @tailwindcss/vite	^4.3.1	Styling	MIT
vitest, @vitest/coverage-v8	^4.1.9	Tests and coverage	MIT
jsdom	^29.1.1	DOM for tests	MIT
@testing-library/{react,jest-dom,user-event}	16.3 / 6.9 / 14.6	Component testing	MIT
msw	^2.14.6	Request mocking	MIT
eslint, typescript-eslint, eslint-plugin-react-hooks, eslint-plugin-react-refresh, @eslint/js, globals	10 / 8.59 / 7.1 / 0.5 / 10 / 17.6	Linting	MIT
prettier	^3.8.4	Formatting	MIT
concurrently	^9.1.2	Runs dev:all (master + slave dev servers)	MIT
@types/{node,react,react-dom}	24 / 19.2 / 19.2	Type definitions	MIT

Lockfiles and reproducibility

• frontend/pnpm-lock.yaml exists, and the publish target uses --frozen-lockfile, so frontend installs are reproducible.
• There is no packages.lock.json for any .NET project — NuGet restore is not locked, so dotnet restore can resolve differently over time on floating transitive versions. Relevant if reproducible CI builds matter.

Dependencies that are absent but expected by this feature

No package currently provides uptime, analytics, error tracking or structured logging. Adding Sentry (a Sentry.AspNetCore package on the backend and @sentry/react on the frontend) and Umami (a script tag, no package) would be new dependencies; UptimeRobot is external and needs only an HTTP endpoint to probe.