chore: pre-public hardening — fix lockfile, bin, license, README - #38
Merged
Conversation
package.json declares GPL-2.0-or-later and lists LICENSE in the files allowlist, but no license text was ever committed. Add the full GPL-2.0 text.
The committed lockfile on main contained hundreds of unresolved git merge-conflict markers (<<<<<<< / ======= / >>>>>>>), so npm ci failed. Regenerate it cleanly from package.json (npm audit: 0 vulnerabilities).
package.json declared bin.wp-tooling -> ./bin/wp-tooling.js and listed "bin" in files, but no bin/ directory exists on main — the package is consumed through its subpath exports, not as a CLI. Remove the bin field and the bin allowlist entry so npm install no longer creates a broken wp-tooling command. The CLI returns when the engine on the release/v1.0.0 line merges.
The old README advertised a scaffold registry, release scripts, git hooks, CI helpers and a version monitor as if present, but those are empty stubs on main. Rewrite it to separate what works today (TTY UI kit, shared ESLint/Stylelint/Tailwind configs) from the planned stubs, document the subpath-export usage, and drop the .claude references.
Delete the .claude/ work-logs (not for a public repo) and .npmignore (the files allowlist governs publishing, and .npmignore referenced a nonexistent .eslintrc.js).
There was a problem hiding this comment.
Pull request overview
This PR hardens the @rtcamp/wp-tooling package for pre-public consumption by fixing install/publish footguns and aligning repository metadata/docs with what’s actually shipped (library subpath exports, no CLI).
Changes:
- Regenerates
package-lock.jsonto remove merge-conflict corruption sonpm ciworks reliably. - Removes the broken CLI packaging surface (
bin+filesallowlist entry) frompackage.json. - Adds the GPL-2.0 license text, rewrites
README.mdto reflect current vs stubbed exports, and removes internal.claude/work logs plus the redundant.npmignore.
Reviewed changes
Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| README.md | Updates documentation to describe subpath-export usage, current modules, and stubbed modules. |
| package.json | Removes nonexistent CLI bin entry and stops publishing a nonexistent bin/ path. |
| package-lock.json | Re-generated lockfile (verified no remaining merge-conflict markers). |
| LICENSE | Adds full GPL v2 license text to match the package’s declared licensing. |
| .npmignore | Deletes redundant ignore file (publish is controlled via files allowlist). |
| .claude/issues/4-lint-configs.md | Removes internal engineering work log. |
| .claude/issues/13-tailwind-config.md | Removes internal engineering work log. |
| .claude/issues/1-tty-ui-kit.md | Removes internal engineering work log. |
| .claude/issues/_TEMPLATE.md | Removes internal issue-log template. |
| .claude/commands/handoff.md | Removes internal workflow/command documentation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The LICENSE shipped the plain GPL v2 text while composer.json/package.json (and plugin headers) declare GPL-2.0-or-later. Prepend the standard 'version 2 or later' grant + SPDX-License-Identifier so the file matches the declaration.
The package can be consumed from the public repo without publishing to a registry (npm install github:rtCamp/wp-tooling), which sidesteps the restricted publishConfig. Add that alongside the registry install.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 10 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
README.md:8
- README says both lint and Tailwind toolchains are "optional peer dependencies", but only Tailwind peers are marked optional via peerDependenciesMeta. Installing the package without ESLint/Stylelint deps will still raise peer-dependency warnings, so this sentence is currently inaccurate.
**Node 22+.** The UI kit has zero runtime dependencies; the lint/Tailwind configs
declare their toolchains as optional peer dependencies (install only what you use).
The description advertised the scaffold registry/release/hooks/CI/version-monitor that are stubs on main; narrow it to what ships (TTY UI + lint/Tailwind configs). Mark every peer dependency optional in peerDependenciesMeta: the package is consumed via subpath exports, so a consumer only needs the peers for the subpath it imports (and the README's 'optional peer dependencies' claim is now accurate).
'no CLI on this branch' is ambiguous in published docs; say it exposes no command-line binary.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 9 out of 10 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
README.md:8
- Because the lint/Tailwind toolchains are marked as optional peer dependencies in
package.json, consumers can install@rtcamp/wp-toolingwithout any peer-dep warnings but then hit runtimeCannot find module ...errors when they import.../eslint-config,.../stylelint-config, or.../tailwind-config. Please add a brief note pointing users to install the relevant peer deps when they use those subpath exports.
**Node 22+.** The UI kit has zero runtime dependencies; the lint/Tailwind configs
declare their toolchains as optional peer dependencies (install only what you use).
pratik-londhe4
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Pre-public hardening for
@rtcamp/wp-tooling. Fixes the packaging defects that makemainbroken to install and adds the missing license. No behavioral change to the shipped modules.Changes
package-lock.json— the committed lockfile onmaincontained hundreds of unresolved git merge-conflict markers, sonpm cifailed. Regenerated cleanly (npm audit: 0 vulnerabilities).binentry —package.jsondeclaredbin.wp-tooling → ./bin/wp-tooling.jsand listedbininfiles, but there is nobin/onmain. The package is consumed through its subpathexports, not as a CLI, sonpm i -gwas installing a broken command. Removedbin+ thebinallowlist entry.LICENSE— full GPL-2.0 text, matching the declaredGPL-2.0-or-later(already in thefilesallowlist).README.md— it advertised a scaffold registry, release scripts, git hooks, CI helpers and a version monitor as if present; those are empty stubs onmain. Now separates what works today (TTY UI kit, shared ESLint/Stylelint/Tailwind configs) from the planned stubs, and documents subpath-export usage..claude/internal work-logs and the redundant.npmignore(thefilesallowlist governs publishing;.npmignorealso referenced a nonexistent.eslintrc.js).How I verified
Reviewer notes
publishConfigstill targets GitHub Packages withaccess: "restricted"(private publish) — decide the public target/visibility before release.symfony/http-foundationadvisory is on therelease/v1.0.0branch'scomposer.lock, not onmain(which has no composer files) — needs a separate fix on that branch.mainremains a library stub: the real scaffold/release/CI engine lives on the unmergedrelease/v1.0.0line.