@theweave/wdocker published package contains workspace-local file: dependency paths

[evangineer]

Problem

The published @theweave/wdocker@0.15.3 package on npm contains file: workspace paths for internal monorepo dependencies in its package.json:

"@theweave/utils": "file:../shared/utils",
"@theweave/group-client": "file:../shared/group-client",
"@theweave/api": "file:../libs/api"

These paths only exist within the monorepo. When a consumer installs @theweave/wdocker standalone (outside the monorepo), npm cannot resolve them and the package is broken.

Steps to reproduce

npm install -g @theweave/wdocker@0.15.3
# Results in missing @theweave/utils, @theweave/group-client, @theweave/api

At runtime, any import of these packages throws:

Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@theweave/utils'

Workaround

Patch package.json after global install and re-run npm install with the published npm versions:

npm install -g @theweave/wdocker@0.15.3
cd /usr/local/lib/node_modules/@theweave/wdocker
jq '.dependencies["@theweave/utils"] = "latest" | .dependencies["@theweave/group-client"] = "latest" | .dependencies["@theweave/api"] = "latest"' package.json > /tmp/pkg.json
mv /tmp/pkg.json package.json
npm install --ignore-scripts

The --ignore-scripts is also required because bufferutil (a transitive dependency) has no pre-built binary for Linux arm64 and requires node-gyp to compile, which may not be available in all environments. Since bufferutil and utf-8-validate are optional WebSocket optimisations with pure-JS fallbacks, skipping install scripts is safe.

Expected behaviour

The published package should reference versioned npm package names for @theweave/utils, @theweave/group-client, and @theweave/api, not monorepo-local file: paths. This is typically handled by the npm publish pipeline replacing file: references with the actual published versions.

Environment

• @theweave/wdocker version: 0.15.3
• npm version: 10.x
• Node.js: v25.8.1
• Platform: Linux amd64 + arm64