Toolcraft 0.0.109 can resolve incompatible AJV 6 in mixed npm workspaces

[kamilio]

Summary

Installing toolcraft@0.0.109 in an npm workspace that already contains ajv@6 can leave Toolcraft's required ajv@^8.20.0 unresolved. npm dedupes Toolcraft and tiny-stdio-mcp-server to the incompatible root AJV 6, and imports such as toolcraft/testing or the MCP runtime then fail.

A clean single-package consumer installs AJV 8 correctly, so this appears related to the published bundled-composition metadata interacting with npm workspace resolution.

Reproduction

Environment:

• Node.js 24.14.0
• npm 10.9.7
• macOS
• toolcraft@0.0.109

Workspace shape:

• package A depends on tooling that brings ajv@6.15.0 (ESLint/Homey in the observed repository)
• package B has exact dev dependency toolcraft@0.0.109

After a clean lock regeneration and install:

rm package-lock.json
npm install --package-lock-only --ignore-scripts
rm -rf node_modules
npm ci --ignore-scripts
npm ls toolcraft ajv --all

Observed:

toolcraft@0.0.109
├── ajv@6.15.0 deduped invalid: "^8.20.0"
└─ tiny-stdio-mcp-server@0.1.0
   └── ajv@6.15.0 deduped invalid: "^8.20.0"

The generated lock has no node_modules/toolcraft/node_modules/ajv entry. --install-strategy=nested produces the same result.

Then:

node -e "import('toolcraft/testing')"

fails because the MCP server resolves incompatible or missing AJV files.

Control

A clean non-workspace consumer works:

mkdir clean && cd clean
printf '{"private":true,"type":"module"}\n' > package.json
npm install --ignore-scripts toolcraft@0.0.109
node -e "import('toolcraft/testing').then(()=>console.log('ok'))"
npm ls ajv --all

This installs ajv@8.20.0 and succeeds.

Expected

Toolcraft's published package/composition should cause npm to retain a valid AJV 8 dependency in mixed-version workspaces, without downstream aliases, overrides, manual lock edits, or direct transitive dependency pins.

Acceptance

A clean npm workspace containing an unrelated AJV 6 consumer and toolcraft@0.0.109 (or a fixed later release) should:

1. complete npm ci with a valid dependency tree,
2. import toolcraft/testing and toolcraft/mcp, and
3. start an MCP server without a downstream AJV declaration.

[kamilio]

Resolved by the Toolcraft packaging fix released in commit 945d438 as toolcraft@0.0.111.\n\nI reproduced the reported two-package npm workspace using the exact Node.js 24.14.0 and npm 10.9.7 versions. After clean lock generation and npm ci:\n\n- the unrelated ESLint workspace retained ajv@6.15.0,\n- the Toolcraft workspace retained nested ajv@8.20.0,\n- npm ls toolcraft ajv --all reported a valid tree,\n- toolcraft/testing and toolcraft/mcp both imported, and\n- a real Toolcraft MCP stdio server completed an initialize handshake for protocol 2025-11-25.\n\nNo downstream AJV declaration, alias, override, or lockfile edit was used. This is covered by the standalone mixed-AJV regression added with #511.