@kya-os/checkpoint-wasm-runtime 1.4.3 → 1.4.4

package/CHANGELOG.md

@@ -1,6 +1,39 @@
 # @kya-os/checkpoint-wasm-runtime
 
-## 1.4.3 — 2026-05-18
+## 1.4.4 — 2026-05-18
+
+**Third recovery release. Do NOT use 1.4.3 — the published manifest
+shipped `@kya-os/checkpoint-shared: "workspace:*"` instead of the
+resolved version. Consumers can't install with any package manager
+(pnpm errors with `ERR_PNPM_WORKSPACE_PKG_NOT_FOUND`; npm/yarn try to
+fetch `workspace:*` from the registry and fail).**
+
+### What 1.4.3 got wrong (and 1.4.4 fixes)
+
+The new publish workflow (#2675/#2676) uses `npm pack --ignore-scripts`
+so it can skip `prepublishOnly` (which would re-introduce the wasm-pack
+`.gitignore` poison that broke 1.4.1/1.4.2). The trade-off we missed:
+`pnpm publish` and `pnpm pack` rewrite the `workspace:` protocol to
+concrete versions at pack-time; `npm pack` does NOT. So the new
+workflow shipped a manifest that no package manager outside the source
+workspace could resolve.
+
+Fix in this release:
+
+1. **Pre-pack substitution step** in `pack-and-verify-tarball`: reads
+   `@kya-os/checkpoint-shared`'s actual version from the workspace and
+   rewrites `workspace:*` → `1.1.0` (or whatever the workspace publishes)
+   in the wasm-runtime manifest before `npm pack` runs.
+2. **New `MANIFEST GATE`** in the same job: extracts the packed
+   `package.json` from the tarball and asserts zero `workspace:`
+   substrings in any dependency field. The 1.4.3 publish would have
+   failed at this gate.
+
+Two artifact-shape gates (1.4.1/1.4.2 failure) + two manifest gates
+(1.4.3 failure) + a post-publish re-fetch gate now stand between any
+future publish and a broken registry entry.
+
+## 1.4.3 — 2026-05-18 — DEPRECATED (workspace:\* leak)
 
 **Second recovery release. Do NOT use 1.4.1 OR 1.4.2 — both shipped
 broken tarballs missing `wasm/kya-os-engine/*` (nodejs target) and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/checkpoint-wasm-runtime",
-  "version": "1.4.3",
+  "version": "1.4.4",
   "description": "Checkpoint WASM runtime for AI agent detection across all environments (formerly @kya-os/agentshield-wasm-runtime)",
   "keywords": [
     "ai",
@@ -148,7 +148,7 @@
     "wasm:rebuild": "bash ../../rust/scripts/build-engine-wasm.sh"
   },
   "dependencies": {
-    "@kya-os/checkpoint-shared": "workspace:*",
+    "@kya-os/checkpoint-shared": "1.1.0",
     "multiformats": "^13"
   },
   "devDependencies": {