Two runtime imports are missing from dependencies, breaking npm ci --omit=dev

Start with package.json and the imports in lib/metadataTypes/DataFilter.js and lib/index.js, then run the provided npm ci --omit=dev reproduction. Verify that both runtime imports resolve from a production-only install; done means the import command completes without ERR_MODULE_NOT_FOUND.

Summary

On mcdev 9.0.3, two packages that shipped code imports at runtime are absent from dependencies. Both installs fine with a plain npm install and break under a production-only install.

1. fast-xml-parser is declared under devDependencies

lib/metadataTypes/DataFilter.js:8:

import { XMLBuilder, XMLParser } from 'fast-xml-parser';

package.json has it only in devDependencies (5.5.9), not dependencies.

This is normally invisible for two reasons: a plain npm install installs dev dependencies anyway, and sfmc-sdk declares fast-xml-parser as a production dependency, so the transitive path supplies a copy.

It becomes visible under npm ci --omit=dev, and deterministically so if the consumer also has an overrides entry for fast-xml-parser — the override collapses mcdev's dev declaration and sfmc-sdk's production one onto a single resolution, which the prune then removes:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package 'fast-xml-parser'
  imported from /opt/mce/node_modules/mcdev/lib/metadataTypes/DataFilter.js

We hit the override case because fast-xml-parser@5.5.9 carries an XMLBuilder CDATA-injection advisory and sfmc-sdk pins it exactly, so forcing a patched version is the only way to resolve it.

2. @inquirer/prompts is not declared at all

lib/index.js, the package's main entry point, imports @inquirer/prompts. It appears in neither dependencies nor devDependencies.

It resolves today only because inquirer (a real production dependency) requires @inquirer/prompts@^8.3.2, so a hoisted copy happens to be present. That breaks whenever inquirer changes or drops that dependency.

Reproduction

mkdir t && cd t
npm init -y
npm pkg set dependencies.mcdev=9.0.3
npm install --package-lock-only
npm ci --omit=dev --ignore-scripts
node --input-type=module -e "await import('./node_modules/mcdev/lib/metadataTypes/DataFilter.js')"

Suggested fix

Move fast-xml-parser from devDependencies to dependencies, and add @inquirer/prompts. Both are one-line changes.

Found by diffing every bare import specifier under lib/ against the declared production dependencies, so those two are the complete set for 9.0.3.

Workaround

Consumers can declare both at their own top level, which is what we have done.