mirror of
https://github.com/luxfi/bridge.git
synced 2026-09-24 00:26:46 +00:00
zeekayandHanzo Dev
d7ec4757da
@luxfi/[email protected] is broken on npm right now: its published manifest carries `"@luxfi/threshold": "workspace:*"`, a specifier that only resolves inside this monorepo. Every external consumer fails at install. Cause: `workspace:*` is rewritten to a real version by `pnpm publish` and NOT by `npm publish`. This package had no publish script, so it was published by hand with npm and shipped the specifier verbatim. The source still declares it, so the next hand-publish breaks again the same way. The defect is invisible in CI and inside the monorepo — pnpm resolves workspace:* fine locally, and only an external consumer ever sees it. So the check belongs at publish time and has to fail closed: prepublishOnly now refuses unless the publishing client is pnpm, including when the user agent is absent. Verified: refuses under npm, refuses with no user agent, passes under pnpm. Not done here: republishing 1.0.7. That is outward-facing and affects anyone already pinned, so it needs an owner. Co-authored-by: Hanzo Dev <[email protected]>
31 lines
1.2 KiB
JavaScript
31 lines
1.2 KiB
JavaScript
// Refuse to publish under npm.
|
|
//
|
|
// Packages in this workspace declare `workspace:*` dependencies (pkg/bridge
|
|
// depends on @luxfi/threshold that way). Only `pnpm publish` rewrites that
|
|
// specifier to a real version on the way out. `npm publish` ships it verbatim,
|
|
// and every consumer then fails at install with:
|
|
//
|
|
// ERR_PNPM_WORKSPACE_PKG_NOT_FOUND "@luxfi/threshold@workspace:*" is in the
|
|
// dependencies but no package named "@luxfi/threshold" is present in the workspace
|
|
//
|
|
// That is exactly how @luxfi/[email protected] shipped broken. The mistake is
|
|
// invisible in CI and inside the monorepo — only an external consumer ever
|
|
// sees it — so the check has to happen at publish time, and has to fail closed.
|
|
|
|
const ua = process.env.npm_config_user_agent ?? '';
|
|
|
|
if (!/\bpnpm\//.test(ua)) {
|
|
console.error(`
|
|
Refusing to publish: this package has workspace:* dependencies.
|
|
|
|
Only \`pnpm publish\` rewrites them to real versions. \`npm publish\` ships
|
|
them verbatim and no consumer can install the result — see
|
|
@luxfi/[email protected], which is broken on npm for this exact reason.
|
|
|
|
Use: pnpm publish --access public
|
|
|
|
(detected user agent: ${ua || '<none>'})
|
|
`);
|
|
process.exit(1);
|
|
}
|