mirror of
https://github.com/luxfi/bridge.git
synced 2026-09-24 00:26:46 +00:00
zeekayandHanzo Dev
d7ec4757da
@luxfi/[email protected] is broken on npm right now: its published manifest carries `"@luxfi/threshold": "workspace:*"`, a specifier that only resolves inside this monorepo. Every external consumer fails at install. Cause: `workspace:*` is rewritten to a real version by `pnpm publish` and NOT by `npm publish`. This package had no publish script, so it was published by hand with npm and shipped the specifier verbatim. The source still declares it, so the next hand-publish breaks again the same way. The defect is invisible in CI and inside the monorepo — pnpm resolves workspace:* fine locally, and only an external consumer ever sees it. So the check belongs at publish time and has to fail closed: prepublishOnly now refuses unless the publishing client is pnpm, including when the user agent is absent. Verified: refuses under npm, refuses with no user agent, passes under pnpm. Not done here: republishing 1.0.7. That is outward-facing and affects anyone already pinned, so it needs an owner. Co-authored-by: Hanzo Dev <[email protected]>