agent-bundle's `typescript-5` alias dependency shadows the consumer's `tsc` bin under npm (tsc 5.6.1-rc rejects ES2024 tsconfig)

[ScriptedAlchemy]

Summary

packages/agent-bundle/package.json depends on "typescript-5": "npm:typescript@5.6.1-rc" (since #135, a7d42cf; used by src/routes/{contract,config-extract,input-schema}.ts). Under npm, an aliased package still contributes its bin entries, and npm hoists typescript-5 into the consumer's top-level node_modules and links node_modules/.bin/tsc -> ../typescript-5/bin/tsc. The consumer's own typescript devDependency (5.9.x) loses the bin race, so npx tsc / npm run typecheck (tsc -p tsconfig.json --noEmit) silently runs TypeScript 5.6.1-rc.

Observed on framework main af1c185 (agent-bundle@0.0.0-preview-af1c185) installed with npm 12.0.2 / Node 22.23.2 into a plain (non-workspace) consumer project. It did not happen at preview 28830bd5, which predates the alias.

Repro

mkdir repro && cd repro && npm init -y >/dev/null
printf 'allow-remote=root\n' > .npmrc   # npm 12 refuses tarball deps otherwise
npm i -D typescript@^5.9.0 https://pkg.pr.new/ScriptedAlchemy/agent-bundle/agent-bundle@af1c185
readlink node_modules/.bin/tsc          # -> ../typescript-5/bin/tsc
npx tsc --version                       # Version 5.6.1-rc
node node_modules/typescript/bin/tsc --version   # Version 5.9.3

With a modern tsconfig ("lib": ["ES2024"], "target": "ES2024") the shadowed tsc fails:

tsconfig.json(7,7): error TS6046: Argument for '--lib' option must be: 'es5', ... 'es2023', 'esnext', ...
tsconfig.json(17,15): error TS6046: Argument for '--target' option must be: ... 'es2023', 'esnext'.

Expected

Consumers' tsc should resolve to their own TypeScript. Options: depend on the alias without exposing bins (e.g. move the extraction to the consumer-resolved typescript the way lib.dts already does — docs/entry-conventions.md says declaration generation "resolves typescript from the project"), pin the alias as an optionalDependency/bundledDependency that npm does not bin-link, or at least document the collision and a node ./node_modules/typescript/bin/tsc workaround in docs/preview-packages.md.

Context

Hit while re-porting ScriptedAlchemy/movie-library onto af1c185; the consumer worked around it by changing its typecheck script to node ./node_modules/typescript/bin/tsc -p tsconfig.json --noEmit.

[ScriptedAlchemy]

Fixed in #405 (merged as 56b77db).

• typescript-5 moved from dependencies to devDependencies (pinned npm:typescript@5.9.3) and is bundled into the package by rslib, so an npm install agent-bundle never links a tsc bin and never hoists a typescript-5 copy. The bundled parser's eager getNodeSystem() reads CommonJS __filename/__dirname, so the build prepends an import.meta.url-derived shim to the chunk that references them.
• Evidence: new packed-pool proof packages/agent-bundle/tests/packed-consumer-typescript.test.ts installs the packed tarball beside the consumer's own typescript and asserts node_modules/.bin/tsc → ../typescript/bin/tsc, no node_modules/typescript-5, tsc --version reports the consumer's version, the installed manifest has no typescript-5 dependency, and the packed CLI still statically parses route config (inspect --routes). Startup cost is unchanged versus the external dependency (same parser bytes, now inside the tarball).