Release 0.2.11: the runtime dependency range changed
reflect-metadata moved from ^0.2 to ^0.2.2 in dependencies, not
devDependencies. A consumer of 0.2.10 can still resolve 0.2.0, and the
tightening exists because that is not enough -- so the published range
is wrong until a version carries the corrected one.
The other work sitting on this branch does not need a release of its
own: devDependencies are not installed by a consumer, the CI is not
published, and scripts/copy-napi.mjs is referenced only by build:napi
with no postinstall hook, so it never runs on a consumer's machine --
its CARGO_TARGET_DIR fix changes where CI finds the binary, not what
ships.
Read the artifact where cargo actually wrote it
The NAPI copy script looked under <package>/target unconditionally. Cargo
writes elsewhere whenever CARGO_TARGET_DIR is set — a shared cache, a CI mount,
a read-only external directory — so the build produced the library and then
failed to find it, or silently copied a stale one from a previous run.
CARGO_TARGET_DIR is honoured now, resolved against the package root when it
is relative, as cargo resolves it. All fourteen scripts had the same line; an
audit reported it in ream-mcp alone.
Verified end to end, not by reading: a real cargo build redirected to a
temporary directory, the artifact copied out of it, and the package suite green
on that binary.
Keep the dev-dependency alignment, drop the workspace: protocol
The internal ranges had been rewritten to workspace:^. That resolves inside
this monorepo and nowhere else: every package CI checks out its own repository
alone and runs pnpm install, where the protocol has no workspace to point at
and fails with ERR_PNPM_WORKSPACE_PKG_NOT_FOUND before a single test runs. The
concrete ranges are back; the dev-dependency bumps that came with the same edit
are kept, and now match what the lockfile already resolved.
Changes since v0.2.10.