http-server-csharp: npm install loads two incompatible @alloy-js/core versions ('Multiple versions of Alloy are loaded')

[timotheeguerin]

Describe the bug

Compiling a project that uses @typespec/http-server-csharp with npm fails at load time:

error js-error: Failed to load .../node_modules/@typespec/http-server-csharp/dist/src/index.js due to the following JS error: Multiple versions of Alloy are loaded for this project. This will likely cause undesirable behavior.

Two incompatible versions of @alloy-js/core end up installed and both get loaded at runtime:

• node_modules/@alloy-js/core → 0.24.1 (hoisted)
• node_modules/@typespec/http-canonicalization/node_modules/@alloy-js/core → 0.22.0 (nested)

Root cause

@alloy-js/core is a peerDependency of @typespec/emitter-framework@0.17.0 with range ^0.22.0 (i.e. >=0.22.0 <0.23.0), which 0.24.1 does not satisfy.

The old emitter-framework@0.17 is dragged in transitively:

@typespec/http-server-csharp@0.58.0-alpha.30
  ├─ @alloy-js/core@^0.24.1                 → 0.24.1
  ├─ @typespec/emitter-framework@^0.19.0    → 0.19.0  (peer alloy ^0.24)
  └─ @typespec/http-canonicalization@^0.16.1 → 0.16.1
        └─ @typespec/emitter-framework@^0.17.0 → 0.17.0
              └─ peerDep @alloy-js/core @^0.22.0   ← forces a 2nd copy

npm 7+ auto-installs unmet peer dependencies, so it installs a second nested copy of @alloy-js/core@0.22.0 to satisfy the ^0.22.0 peer of emitter-framework@0.17. Both copies load and Alloy's runtime guard reports the conflict.

http-server-csharp effectively depends on two different major-ish lines of Alloy at once: 0.24 (directly and via emitter-framework@0.19) and 0.22 (via http-canonicalization@0.16.1 → emitter-framework@0.17).

Reproduction

package.json:

{
  "dependencies": {
    "@typespec/compiler": "^1.14.0",
    "@typespec/http": "^1.14.0",
    "@typespec/http-server-csharp": "^0.58.0-alpha.20"
  }
}

npm install
npx tsp compile .

Why it only fails with npm

• npm: auto-installs the unmet ^0.22.0 peer → second Alloy copy → error.
• pnpm: satisfies the peer with the single provided 0.24.1 (peer-range warning only) → one Alloy copy → works.
• Workaround: forcing a single version via npm overrides also works:

  "overrides": { "@alloy-js/core": "0.24.1" }

Suggested fix

Bump @typespec/http-server-csharp's dependency on @typespec/http-canonicalization to a release that uses @typespec/emitter-framework@0.19 (Alloy 0.24), so a single Alloy line is required across the tree.

Environment

• @typespec/compiler: 1.14.0
• @typespec/http-server-csharp: 0.58.0-alpha.30
• @typespec/http-canonicalization: 0.16.1 (pulls @typespec/emitter-framework@0.17.0)
• @alloy-js/core: 0.24.1 (hoisted) + 0.22.0 (nested)
• npm with Node.js v26.5.0

[github-actions]

🎯 Issue Triage

Using http-server-csharp with npm results in a fatal load-time error because two incompatible versions of @alloy-js/core (0.22.0 and 0.24.1) end up installed — one nested under http-canonicalization which pulls emitter-framework@0.17 (peer: ^0.22.0), conflicting with the top-level 0.24.x used by the rest of the tree.

Category: Bug
Area: emitter:service:csharp

🔍 Analysis

Root cause: http-server-csharp@0.58.0-alpha.30 depends on http-canonicalization@^0.16.1, which requires emitter-framework@^0.17.0. That version of emitter-framework has a peer dependency on alloy-js/core@^0.22.0. Since 0.24.1 (used everywhere else in the tree) doesn't satisfy ^0.22.0, npm 7+ auto-installs a second nested copy (0.22.0), and Alloy's runtime singleton guard fires.

Why pnpm works: pnpm satisfies peer dependencies using already-installed packages even outside their declared range, issuing a warning but not duplicating the package.

Affected components:

• http-server-csharp
• http-canonicalization
• emitter-framework (two incompatible versions in tree)
• alloy-js/core (duplicated)

Fix: Bump http-canonicalization to a version that depends on emitter-framework@^0.19.0 (Alloy ^0.24), then update http-server-csharp's constraint accordingly, so the whole dependency tree shares a single Alloy line.

Workaround available: Users on npm can add "overrides": { "@alloy-js/core": "0.24.1" } to their package.json.

📝 Suggested next steps

• Release a new version of http-canonicalization that upgrades its emitter-framework dependency to ^0.19.0
• Bump http-server-csharp's dependency on http-canonicalization to the new release
• Consider adding an integration test that verifies a plain npm install produces a working single-Alloy installation

Generated by Agentic Triage