fix(qmd): resolve hoisted dependencies from package context

shared/qmd/qmd-config.mjs

@@ -1,8 +1,7 @@
 // shared/qmd/qmd-config.mjs — edits only the models: block and setup-owned collection ignore lists in QMD's index.yml.
 import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { MODELS, qmdConfigPath, qmdPackageDir, writeTextAtomic } from './qmd-lib.mjs';
+import { MODELS, importQmdDependency, qmdConfigPath, writeTextAtomic } from './qmd-lib.mjs';
 
 export function setModels(text, YAML) {
   const document = YAML.parseDocument(text || '');
@@ -45,7 +44,7 @@ export function setCollectionIgnore(text, YAML, name, ignore) {
 
 async function main(action, argument) {
   if (!['set-models', 'unset-models', 'restore-models'].includes(action)) throw new Error('usage: qmd-config.mjs set-models|unset-models|restore-models <json>');
-  const YAML = await import(pathToFileURL(join(qmdPackageDir(), 'node_modules', 'yaml', 'dist', 'index.js')).href);
+  const YAML = await importQmdDependency('yaml');
   const path = qmdConfigPath();
   const current = existsSync(path) ? readFileSync(path, 'utf8') : '';
   let next;

shared/qmd/qmd-daemon.mjs

@@ -6,7 +6,7 @@ import { createServer as createHttpServer } from 'node:http';
 import { dirname, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { setCollectionIgnore } from './qmd-config.mjs';
-import { MASK, collectionName, idleMinutes, importQmd, qmdConfigPath, qmdDbPath, readJson, runQmdCli, stateDir, writePrivateJson, writeTextAtomic } from './qmd-lib.mjs';
+import { MASK, collectionName, idleMinutes, importQmd, importQmdDependency, qmdConfigPath, qmdDbPath, readJson, runQmdCli, stateDir, writePrivateJson, writeTextAtomic } from './qmd-lib.mjs';
 
 const MAX_BODY = 64 * 1024;
 
@@ -204,8 +204,8 @@ async function main() {
   keepModelsLoaded(store);
   // QMD keeps index.yml authoritative: createStore and the CLI re-sync it into SQLite, and its addCollection
   // write-through drops `ignore`, so the list is written into index.yml and re-synced the way QMD does it.
-  const fastGlob = (await importQmd(join('node_modules', 'fast-glob', 'out', 'index.js'))).default;
-  const YAML = await importQmd(join('node_modules', 'yaml', 'dist', 'index.js'));
+  const fastGlob = (await importQmdDependency('fast-glob')).default;
+  const YAML = await importQmdDependency('yaml');
   const { loadConfig } = await importQmd(join('dist', 'collections.js'));
   const { syncConfigToDb } = await importQmd(join('dist', 'store.js'));
   const collectionsFile = join(dir, 'collections.json');

shared/qmd/qmd-lib.mjs

@@ -3,6 +3,7 @@ import { createHash } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
+import { createRequire } from 'node:module';
 import { dirname, join, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
@@ -82,6 +83,12 @@ export function importQmd(subpath = join('dist', 'index.js')) {
   return import(pathToFileURL(join(qmdPackageDir(), subpath)).href);
 }
 
+// Resolve from QMD so both nested and hoisted dependency installations work.
+export function importQmdDependency(name) {
+  const require = createRequire(pathToFileURL(join(qmdPackageDir(), 'package.json')));
+  return import(pathToFileURL(require.resolve(name)).href);
+}
+
 // Runs the QMD CLI through node without a shell, so free-text arguments are never re-parsed.
 export function runQmdCli(args, options = {}) {
   return execFileSync(process.execPath, [join(qmdPackageDir(), 'dist', 'cli', 'qmd.js'), ...args], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, ...options });