Fix: declare the four hoisted runtime dependencies in the dev workspace

dev/package.json

@@ -42,6 +42,7 @@
   "devDependencies": {
     "@types/cors": "^2.8.19",
     "@types/express": "^4.17.21",
+    "@types/lodash-es": "^4.17.12",
     "@types/node": "^20.12.7",
     "@typescript-eslint/eslint-plugin": "^7.7.1",
     "@typescript-eslint/parser": "^7.7.1",
@@ -55,12 +56,16 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.11.0",
+    "@google-cloud/vertexai": "^1.12.0",
     "@google/adk": "^1.5.0",
+    "@google/genai": "^2.9.0",
     "@mikro-orm/mariadb": "^6.6.6",
     "@mikro-orm/mssql": "^6.6.6",
     "@mikro-orm/mysql": "^6.6.6",
     "@mikro-orm/postgresql": "^6.6.6",
     "@mikro-orm/sqlite": "^6.6.6",
+    "@opentelemetry/api": "1.9.0",
+    "@opentelemetry/sdk-trace-base": "^2.1.0",
     "camelcase-keys": "^6.2.2",
     "commander": "^14.0.0",
     "cors": "^2.8.5",
@@ -70,6 +75,7 @@
     "express": "^4.21.2",
     "fast-glob": "^3.3.3",
     "js-yaml": "^4.1.1",
+    "lodash-es": "^4.18.1",
     "ts-graphviz": "^1.0.1",
     "winston": "^3.19.0",
     "zod": "^4.2.1"

dev/src/cli/deploy/cli_deploy_agent_engine.ts

@@ -6,7 +6,7 @@
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 
-import {Client} from '@google-cloud/vertexai/build/src/genai/client.js';
+import {Client} from '@google-cloud/vertexai';
 import {ReasoningEngine as VertexReasoningEngine} from '@google-cloud/vertexai/build/src/genai/types.js';
 
 import {AgentLoader} from '../../utils/agent_loader.js';

dev/test/cli/cli_deploy_agent_engine_test.ts

@@ -141,7 +141,7 @@ const mockCreateInternal = vi.fn();
 const mockUpdateInternal = vi.fn();
 const mockGetAgentOperationInternal = vi.fn();
 
-vi.mock('@google-cloud/vertexai/build/src/genai/client.js', () => ({
+vi.mock('@google-cloud/vertexai', () => ({
   Client: class {
     agentEnginesInternal = {
       createInternal: mockCreateInternal,

dev/test/package_manifest_test.ts

@@ -0,0 +1,56 @@
+/**
+ * @license
+ * Copyright 2026 Google LLC
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import {readFileSync} from 'node:fs';
+import {fileURLToPath} from 'node:url';
+import {describe, expect, it} from 'vitest';
+
+interface Manifest {
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
+}
+
+function readManifest(relativePath: string): Manifest {
+  return JSON.parse(
+    readFileSync(fileURLToPath(new URL(relativePath, import.meta.url)), 'utf8'),
+  ) as Manifest;
+}
+
+const coreManifest = readManifest('../../core/package.json');
+const devManifest = readManifest('../package.json');
+
+/**
+ * Packages dev/src imports at runtime that core also depends on. Both
+ * workspaces must request the identical range so npm resolves a single copy:
+ * two copies of @opentelemetry/api in one process each carry their own global
+ * tracer registry, and spans recorded against one are invisible to the other.
+ */
+const SHARED_RUNTIME_DEPENDENCIES = [
+  '@google-cloud/vertexai',
+  '@google/genai',
+  '@opentelemetry/api',
+  '@opentelemetry/sdk-trace-base',
+  'lodash-es',
+];
+
+describe('dev package manifest', () => {
+  it.each(SHARED_RUNTIME_DEPENDENCIES)(
+    'declares %s as a runtime dependency matching core',
+    (name) => {
+      expect(coreManifest.dependencies?.[name]).toBeDefined();
+      expect(devManifest.dependencies?.[name]).toBe(
+        coreManifest.dependencies?.[name],
+      );
+    },
+  );
+
+  it('declares @types/lodash-es so lodash-es typechecks in a standalone build', () => {
+    expect(coreManifest.devDependencies?.['@types/lodash-es']).toBeDefined();
+    expect(devManifest.devDependencies?.['@types/lodash-es']).toBe(
+      coreManifest.devDependencies?.['@types/lodash-es'],
+    );
+  });
+});