pi-client 0.1.0

package/README.md

@@ -0,0 +1,29 @@
+# pi-client
+
+> **This is a namespace reservation package.** Install [`@marcfargas/pi-client`](https://www.npmjs.com/package/@marcfargas/pi-client) for the real package.
+
+## Why does this package exist?
+
+This unscoped wrapper exists to prevent supply-chain attacks. Without it, a
+malicious actor could publish a package named `pi-client` on npm. Anyone who
+then ran `npx pi-client` without having installed the scoped package first
+would unknowingly execute the attacker's code.
+
+By holding this name, `npx pi-client` safely delegates to the real
+`@marcfargas/pi-client` package.
+
+## Usage
+
+```bash
+# These all work:
+npx pi-client connect ws://localhost:3333
+npx @marcfargas/pi-client connect ws://localhost:3333
+
+# Or install globally:
+npm install -g pi-client
+pi-client connect ws://localhost:3333
+```
+
+## License
+
+MIT

package/cli.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+// Thin wrapper — delegates to @marcfargas/pi-client.
+// This unscoped package exists to prevent supply-chain attacks via npm name
+// squatting. The real implementation lives in @marcfargas/pi-client.
+import("@marcfargas/pi-client/cli");

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "pi-client",
+  "version": "0.1.0",
+  "description": "Namespace reservation for @marcfargas/pi-client. This package exists solely to prevent supply-chain attacks via npm name squatting. Install @marcfargas/pi-client for the real package.",
+  "type": "module",
+  "bin": {
+    "pi-client": "./cli.js"
+  },
+  "dependencies": {
+    "@marcfargas/pi-client": "0.1.0"
+  },
+  "license": "MIT",
+  "author": "Marc Fargas",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/marcfargas/pi-server"
+  }
+}