fix: make the package installable with strict peer resolution

[razor-x]

Installing nextlove fails with ERESOLVE on every Next.js version. There are two independent blockers, and they are mutually exclusive — there is no Next.js version where the package installs.

Consumer	Failure
Next.js 15/16 + React 19	The required nextjs-server-modules: ">=1" peer resolves to 4.8.2, whose own next peer caps at ^12 || ^13 || ^14
Next.js ≤14 + React 18	The react / react-dom peers of >=19 conflict with the React 18 those Next.js versions pin

So the declared next: ">=12" range is unsatisfiable in both directions.

Reproduced against a packed tarball on Next.js 16:

npm error code ERESOLVE
npm error Found: next@16.3.0
npm error   peer next@">=12" from nextlove@4.0.0-beta.1
npm error Could not resolve dependency:
npm error peer next@"^12.0.0||^13.0.0||^14.0.0" from nextjs-server-modules@4.8.2

and on Next.js 14:

npm error code ERESOLVE
npm error Found: react@18.3.1
npm error   peer react@"^18.2.0" from next@14.2.35
npm error Could not resolve dependency:
npm error peer react@">=19" from nextlove@4.0.0-beta.1

Why CI did not catch this

Two reasons, both of which this PR closes:

• The repository lockfile pins nextjs-server-modules@2.5.1, which declares no next peer, so installs inside the repository resolve fine. Consumers resolving >=1 get 4.8.2.
• The install job ran with --legacy-peer-deps, under a comment describing this exact conflict as an accepted limitation rather than a defect.

Changes

package.json

• Dropped the react and react-dom peers. Nothing in src/ imports React — this is a server-side API library — and Next.js already declares its own React peers, so consumers always have a compatible copy. These peers only ever narrowed the installable set.
• Marked nextjs-server-modules optional. Only the nsm command needs it, and that command is a one-line passthrough; the built dist/ contains no reference to it. npm now skips it rather than pulling in a version that conflicts with the consumer's Next.js.

prettier and typescript stay required — both are genuinely imported at runtime by the generators.

nsm-bin.js — since the peer is no longer auto-installed, the command now explains what to install instead of failing on a bare ERR_MODULE_NOT_FOUND. It still passes through untouched when the package is present.

.github/workflows/check.yml — the install job drops --legacy-peer-deps and gains a Next.js ^16 / ^14 matrix leg, so it now tests for this bug instead of working around it.

Verification

• Both matrix legs install cleanly under strict peer resolution against a packed tarball, and nextlove, nextlove/generators, and nextlove/exception-middleware all import.
• Confirmed nextjs-server-modules is no longer installed into the consumer tree, and that nsm still passes through correctly when it is installed alongside.
• Repository suite: 8/8 tests, typecheck, and lint pass.

Note

Removing a peer dependency and marking one optional are both relaxations, so no consumer that installs today is affected. Committed as fix: rather than fix!: on that basis — flagging it in case you would rather it land as a breaking change given the beta base.

---

Generated by Claude Code