@danypops/pi-packed 0.27.5 → 0.27.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danypops/pi-packed",
-  "version": "0.27.5",
+  "version": "0.27.6",
   "description": "Pi package lifecycle, validation, daemon, tools, profiles, and TUI",
   "type": "module",
   "bin": {
@@ -31,7 +31,6 @@
     "@danypops/packed": "^0.7.0",
     "@danypops/pi-extension-harness": "^0.7.0",
     "@danypops/vehicle-client": "^0.10.0",
-    "@danypops/vehicle-client-pi": "^0.40.1",
     "@danypops/vehicle-core": "^0.15.0",
     "@danypops/vehicle-server": "^0.24.2",
     "jiti": "^2.7.0",
@@ -41,9 +40,11 @@
   },
   "devDependencies": {
     "@danypops/pi-tui-harness": "^0.0.1",
+    "@danypops/vehicle-client-pi": "^0.41.3",
     "@types/semver": "^7.7.1"
   },
   "peerDependencies": {
+    "@danypops/vehicle-client-pi": "^0.41.3",
     "@earendil-works/pi-coding-agent": "*",
     "@earendil-works/pi-tui": "*",
     "typebox": "*"

package/service/src/adoption/check.ts

@@ -566,8 +566,14 @@ function dependencyCheck(context: Context): void {
 						path: file,
 						message: `${name} must be declared as peerDependencies[${name}] = *`,
 					});
-			} else if (dependencies[name] === undefined && optional[name] === undefined) {
-				const misplaced = dev[name] !== undefined ? "devDependency" : peers[name] !== undefined ? "peerDependency" : undefined;
+			} else if (dependencies[name] === undefined && optional[name] === undefined && peers[name] === undefined) {
+				// A real (non-"*") peerDependency range genuinely satisfies this -- npm's own
+				// documented mechanism for "a real runtime dependency the host is expected to
+				// already share a single instance of," distinct from CORE_PACKAGES' own stricter
+				// peers[name] === "*" contract (Pi's own always-exactly-one-host-version packages,
+				// checked separately above). A devDependency alone still doesn't count -- it
+				// guarantees nothing for a real consumer's own install.
+				const misplaced = dev[name] !== undefined ? "devDependency" : undefined;
 				context.add({
 					code: "RUNTIME_DEPENDENCY_MISSING",
 					severity: "error",

package/service/test/check.test.ts

@@ -441,4 +441,37 @@ describe("dependencyCheck false-positive regressions (packed check)", () => {
 		const report = await checkPackage(root, { generic: false });
 		expect(codes(report.diagnostics)).not.toContain("RUNTIME_DEPENDENCY_MISSING");
 	});
+
+	it("a real (non-*) peerDependency range genuinely satisfies a shipped-code import -- npm's own documented mechanism for a shared-singleton runtime dependency, distinct from CORE_PACKAGES' own peers[name] === '*' contract", async () => {
+		const root = fixture(
+			{
+				...base,
+				files: ["extensions", "README.md", "LICENSE"],
+				peerDependencies: { ...base.peerDependencies, "@scope/shared-singleton": "^1.2.3" },
+				devDependencies: { "@scope/shared-singleton": "^1.2.3" },
+			},
+			{
+				"extensions/index.ts": 'import { thing } from "@scope/shared-singleton";\nexport default function () { return thing; }\n',
+				"README.md": "# Example",
+				LICENSE: "MIT",
+			},
+		);
+		const report = await checkPackage(root, { generic: false });
+		expect(codes(report.diagnostics)).not.toContain("RUNTIME_DEPENDENCY_MISSING");
+	});
+
+	it("still flags a shipped-code import declared only as a devDependency, even though a peerDependency-shaped exception now exists", async () => {
+		const root = fixture(
+			{ ...base, files: ["extensions", "README.md", "LICENSE"], devDependencies: { "leftover-dev-only": "1.0.0" } },
+			{
+				"extensions/index.ts": 'import thing from "leftover-dev-only";\nexport default function () { return thing; }\n',
+				"README.md": "# Example",
+				LICENSE: "MIT",
+			},
+		);
+		const report = await checkPackage(root, { generic: false });
+		expect(codes(report.diagnostics)).toContain("RUNTIME_DEPENDENCY_MISSING");
+		const diagnostic = report.diagnostics.find((d) => d.code === "RUNTIME_DEPENDENCY_MISSING")!;
+		expect(diagnostic.message).toContain("only a devDependency");
+	});
 });