From ceba0b5d43b25872ba20d7393d6036517de5e093 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=B0=8F=E6=A9=98?= <xiaoju@shazhou.work>
Date: Sun, 31 May 2026 23:43:51 +0000
Subject: [PATCH] chore: add prepublishOnly workspace:* guard

Checks for unresolved workspace:* dependencies before publish.
Changesets resolves these automatically, so normal release flow
passes through. Direct npm publish with workspace deps is blocked.
---
 packages/cli-json-cas/package.json | 3 ++-
 packages/json-cas-fs/package.json  | 3 ++-
 packages/json-cas/package.json     | 3 ++-
 scripts/check-workspace-deps.sh    | 8 ++++++++
 4 files changed, 14 insertions(+), 3 deletions(-)
 create mode 100755 scripts/check-workspace-deps.sh

diff --git a/packages/cli-json-cas/package.json b/packages/cli-json-cas/package.json
index 53f1f0d..a5cf494 100644
--- a/packages/cli-json-cas/package.json
+++ b/packages/cli-json-cas/package.json
@@ -7,7 +7,8 @@
     "ucas": "./src/index.ts"
   },
   "scripts": {
-    "test": "bun test"
+    "test": "bun test",
+    "prepublishOnly": "bash ../../scripts/check-workspace-deps.sh"
   },
   "dependencies": {
     "@uncaged/json-cas": "^0.6.0",
diff --git a/packages/json-cas-fs/package.json b/packages/json-cas-fs/package.json
index f987a9f..e50997e 100644
--- a/packages/json-cas-fs/package.json
+++ b/packages/json-cas-fs/package.json
@@ -15,7 +15,8 @@
     "src"
   ],
   "scripts": {
-    "test": "bun test"
+    "test": "bun test",
+    "prepublishOnly": "bash ../../scripts/check-workspace-deps.sh"
   },
   "dependencies": {
     "@uncaged/json-cas": "^0.6.0",
diff --git a/packages/json-cas/package.json b/packages/json-cas/package.json
index 589505a..122c52b 100644
--- a/packages/json-cas/package.json
+++ b/packages/json-cas/package.json
@@ -15,7 +15,8 @@
     "src"
   ],
   "scripts": {
-    "test": "bun test"
+    "test": "bun test",
+    "prepublishOnly": "bash ../../scripts/check-workspace-deps.sh"
   },
   "dependencies": {
     "ajv": "^8.20.0",
diff --git a/scripts/check-workspace-deps.sh b/scripts/check-workspace-deps.sh
new file mode 100755
index 0000000..c56f777
--- /dev/null
+++ b/scripts/check-workspace-deps.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# Prevent publishing packages that still reference workspace:* dependencies
+if grep -q '"workspace:' package.json 2>/dev/null; then
+  echo "❌ Found workspace:* dependencies in package.json — cannot publish directly."
+  echo "   Use 'changeset publish' which resolves workspace protocol automatically."
+  grep '"workspace:' package.json
+  exit 1
+fi