zooqueenandHanzo Dev 9b817c6652 asset URLs name their version, and Lux points at the package that has it ...

Every logoUrl and faviconUrl floated on `@latest`, which resolves when the
browser asks: the bytes behind a login page could change with no release here,
and nothing recorded which version a visitor got. jsDelivr also keeps serving a
path from a version that no longer ships it — @luxfi/brand@latest answers
assets/logo/logo.svg with a 120-byte triangle that no explicit version of that
package contains, because every version from 1.0.7 dropped assets/ entirely.

Lux publishes its mark in @luxfi/logo, which its own brand.json already names,
so that is where this points now: svg/lux-icon-white.svg and svg/lux-favicon.svg
at 1.0.8, both verified to serve. Hanzo pins 1.4.7 and Zoo 1.4.1, likewise
verified. @parsdao/brand ships no assets/ at any version, so its URL is a 404
either way; pinning it names the gap rather than leaving an alias to hide it.

A test walks the registry and refuses a URL that omits its version.

Co-authored-by: Hanzo Dev <[email protected]>

2026-08-24 22:11:51 -07:00

..

brand-json-consistency.test.mjs

a brand is called Brand

2026-08-24 11:00:47 -07:00

registry.test.mjs

asset URLs name their version, and Lux points at the package that has it

2026-08-24 22:11:51 -07:00