conformance-cli 0.6.x depends on @kehto/paja <0.22, whose peers exclude the @napplet/core it pins #324

@napplet/conformance-cli 0.6.0 through 0.6.3 pin @napplet/core and @napplet/nap exactly (0.6.1: core 0.38.0, nap 0.37.0). They also depend on @kehto/paja >=0.21.0 <0.22.0.

Every @kehto/paja 0.21.x release declares peers @napplet/core >=0.32.0 <0.35.0 and @napplet/nap >=0.32.0 <0.35.0, and depends on the Kehto 0.24 line (@kehto/shell ^0.24, @kehto/runtime ^0.26, @kehto/acl ^0.19, @kehto/services ^0.24). So conformance-cli can't install as a single coherent generation: it brings a second, older Kehto/core line along with it.

Repro

mkdir cc && cd cc && npm init -y >/dev/null
npm i -D --ignore-scripts @napplet/conformance-cli@0.6.1
npm ls @kehto/paja @napplet/core

npm 11 resolves this by installing a second core generation just for paja:

└─┬ @napplet/conformance-cli@0.6.1
  ├─┬ @kehto/paja@0.21.4
  │ ├─┬ @kehto/shell@0.24.5
  │ ├─┬ @kehto/runtime@0.26.1
  │ ├── @napplet/core@0.34.0
  │ └─┬ @napplet/nap@0.34.0
  ├── @napplet/core@0.38.0
  ├─┬ @napplet/nap@0.37.0

pnpm 10 (which doesn't auto-install mismatched peers) reports them as unmet:

@napplet/conformance-cli 0.6.1
└─┬ @kehto/paja 0.21.4
  ├── ✕ unmet peer @napplet/core@">=0.32.0 <0.35.0": found 0.38.0
  └── ✕ unmet peer @napplet/nap@">=0.32.0 <0.35.0": found 0.37.0

Either way, the runtime paja drives the conformance run against comes from a different core/nap generation than the one conformance-cli pins and checks against.

Expected

conformance-cli's @kehto/paja range should match the core/nap generation it pins. For core 0.38 / nap 0.37 that's @kehto/paja 0.32.x, which peers on @napplet/core >=0.38.0 <0.39.0.

Versions

• @napplet/conformance-cli 0.6.0–0.6.3 (all have @kehto/paja >=0.21.0 <0.22.0)
• @kehto/paja 0.21.0–0.21.4
• npm 11, pnpm 10.32.1, Node 26