fix(publish): refuse to publish under npm — workspace:* must be rewritten

@luxfi/[email protected] is broken on npm right now: its published manifest
carries `"@luxfi/threshold": "workspace:*"`, a specifier that only resolves
inside this monorepo. Every external consumer fails at install.

Cause: `workspace:*` is rewritten to a real version by `pnpm publish` and
NOT by `npm publish`. This package had no publish script, so it was
published by hand with npm and shipped the specifier verbatim. The source
still declares it, so the next hand-publish breaks again the same way.

The defect is invisible in CI and inside the monorepo — pnpm resolves
workspace:* fine locally, and only an external consumer ever sees it. So
the check belongs at publish time and has to fail closed: prepublishOnly
now refuses unless the publishing client is pnpm, including when the user
agent is absent.

Verified: refuses under npm, refuses with no user agent, passes under pnpm.

Not done here: republishing 1.0.7. That is outward-facing and affects
anyone already pinned, so it needs an owner.

Co-authored-by: Hanzo Dev <[email protected]>

pkg/bridge/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@luxfi/bridge",
   "version": "1.0.7",
-  "description": "Lux Bridge SDK \u2014 embed bridge.lux.network into any host application",
+  "description": "Lux Bridge SDK — embed bridge.lux.network into any host application",
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",
     "access": "public",
@@ -73,7 +73,7 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "lat": "npm show @luxfi/bridge version",
-    "prepublishOnly": "pnpm run build",
+    "prepublishOnly": "node ../../scripts/assert-pnpm-publish.mjs && pnpm run build",
     "pub": "npm publish"
   },
   "dependencies": {

scripts/assert-pnpm-publish.mjs

@@ -0,0 +1,30 @@
+// Refuse to publish under npm.
+//
+// Packages in this workspace declare `workspace:*` dependencies (pkg/bridge
+// depends on @luxfi/threshold that way). Only `pnpm publish` rewrites that
+// specifier to a real version on the way out. `npm publish` ships it verbatim,
+// and every consumer then fails at install with:
+//
+//   ERR_PNPM_WORKSPACE_PKG_NOT_FOUND  "@luxfi/threshold@workspace:*" is in the
+//   dependencies but no package named "@luxfi/threshold" is present in the workspace
+//
+// That is exactly how @luxfi/[email protected] shipped broken. The mistake is
+// invisible in CI and inside the monorepo — only an external consumer ever
+// sees it — so the check has to happen at publish time, and has to fail closed.
+
+const ua = process.env.npm_config_user_agent ?? '';
+
+if (!/\bpnpm\//.test(ua)) {
+  console.error(`
+  Refusing to publish: this package has workspace:* dependencies.
+
+  Only \`pnpm publish\` rewrites them to real versions. \`npm publish\` ships
+  them verbatim and no consumer can install the result — see
+  @luxfi/[email protected], which is broken on npm for this exact reason.
+
+  Use:  pnpm publish --access public
+
+  (detected user agent: ${ua || '<none>'})
+`);
+  process.exit(1);
+}