[gitsad]

What this changes

@mobile-reality/mdma-mcp@0.3.0 fails tools/list in a clean install with MCP error -32603: Cannot read properties of undefined (reading 'def'). src/index.ts imports zod at runtime but zod was only a devDependency, so a clean npm install hoists zod 4.6.7 for the MCP while @mobile-reality/mdma-spec keeps its own zod 3. The SDK then fails converting build-system-prompt's input schema, which mixes a zod 3 spec schema into the MCP's z. This PR declares zod: ^3.24.0 (the spec's range) in dependencies and adds two guards so it cannot recur unnoticed.

Key files

• packages/mcp/package.json — zod moved from devDependencies to dependencies (^3.24.0); new smoke:pack script. pnpm-lock.yaml follows (importer entry only).
• packages/mcp/tests/dependencies.test.ts — scans src/**/*.ts import statements (relative and node: ignored, scoped names reduced to @scope/name) and asserts each package is in dependencies or peerDependencies. Fails on main (['zod']), passes now.
• packages/mcp/scripts/smoke-pack.mjs — pnpm pack, install the tarball into a fresh temp dir with a fresh npm cache and --ignore-scripts, start dist/bin/mdma-mcp.js over stdio with the SDK client from that install, call tools/list and get-spec, compare tool names with manifest.json, print version, tools and PASS/FAIL, exit non-zero on failure.
• packages/mcp/README.md — one added line in the Release checklist ("Bump + test") for pnpm smoke:pack.
• .changeset/declare-mcp-zod.md — patch for @mobile-reality/mdma-mcp.

Before / after

pnpm --filter @mobile-reality/mdma-mcp smoke:pack on current main code (before the fix):

> @mobile-reality/mdma-mcp@0.3.0 smoke:pack
> node scripts/smoke-pack.mjs

FAIL MCP error -32603: Cannot read properties of undefined (reading 'def')
 ERR_PNPM_RECURSIVE_RUN_FIRST_FAIL  @mobile-reality/mdma-mcp@0.3.0 smoke:pack: `node scripts/smoke-pack.mjs`
Exit status 1

After the fix:

> @mobile-reality/mdma-mcp@0.3.0 smoke:pack
> node scripts/smoke-pack.mjs

serverInfo.version: 0.3.0
tools (8): build-system-prompt, get-doc, get-prompt, get-spec, list-docs, list-packages, list-prompt-variants, validate-prompt
get-spec: ok
PASS

The new test before the fix: expected [ 'zod' ] to deeply equal []; after: 53 of 53 pass.

Verified with pnpm install --frozen-lockfile, pnpm build, pnpm typecheck, pnpm lint, pnpm --filter @mobile-reality/mdma-mcp test, smoke:pack and root pnpm test, all green. Unreviewed fixes: none (the review verdict was merge-with-followups, BLOCKING 0; the only follow-up, a long commit subject, was fixed by amending before the push).

Decisions

• Parser audit: left unchanged. Installed published @mobile-reality/mdma-parser@0.3.1 into an empty dir with a fresh cache and --prefer-online, then forced zod 4.6.7 to the top level (spec nests its zod 3): importing and processing an mdma block through remarkMdma works in both cases. All three zod imports in packages/parser/src are import type, so the compiled JS never loads zod; only the .d.ts files reference ZodType. No runtime breakage, so no change (and no parser changeset).
• Validator: left unchanged. No zod import statement in src; the only references are type-position import('zod').ZodType casts.
• The new test matches line-start import/export ... from statements only, so package names inside string literals (e.g. list-packages.ts usage text) are not counted.
• smoke-pack.mjs checks the served tool names against the tools list in manifest.json instead of a hard-coded count.

Before publishing the patch

After the Version Packages PR bumps @mobile-reality/mdma-mcp, align the version strings by hand before publishing: server.json (top-level and packages[0].version), manifest.json (same two), and the McpServer({ version }) call in src/index.ts. Then run pnpm smoke:pack and expect PASS.