workspace:, link: and file: resolve only inside the monorepo that
declares them, so any of the three in a published manifest is a
consumer install that dies. The rewrite handled workspace: alone, and
it trusted the manifest it had just written — but npm pack runs
prepack and prepare, which are free to rewrite package.json again.
Cover all three protocols and read the manifest back out of the
archive before pushing it. A version is immutable once it lands:
@hanzogui/[email protected] still carries eleven of these and no publish can
repair it.
Co-authored-by: Hanzo Dev <[email protected]>
zeekayandHanzo Dev
e87d0068c8