temp: patch out broken wasm-pack package

[abcxff]

Description

Please include a summary of the changes and the related issue. Please also include relevant motivation and context.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

Please describe the tests that you ran to verify your changes.

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[railway-app]

🚅 Deployed to the rivet-pr-5039 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
ladle	❌ Build Failed (View Logs)	Web	May 11, 2026 at 11:40 pm
website	❌ Build Failed (View Logs)	Web	May 11, 2026 at 11:40 pm
kitchen-sink	❌ Build Failed (View Logs)	Web	May 11, 2026 at 11:40 pm
frontend-cloud	❌ Build Failed (View Logs)	Web	May 11, 2026 at 11:40 pm
frontend-inspector	❌ Build Failed (View Logs)	Web	May 11, 2026 at 11:30 pm
mcp-hub	✅ Success (View Logs)	Web	May 11, 2026 at 10:19 pm

[abcxff]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• temp: patch out broken wasm-pack package #5039 👈 (View in Graphite)
• feat(rivetkit): add ConnectionMap readonly Map wrapper for actor connections #5021
• fix(rivetkit-core): chunk apply_batch puts/deletes at 128 #5012
• DO NOT MERGE bump #5038
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[claude]

Code Review

Overview

This PR addresses a broken wasm-pack@0.14.0 npm package that downloads its binary from the wrong GitHub URL (drager → wasm-bindgen org), causing wasm builds to fail in CI. It takes a two-pronged approach: apply a pnpm patch to fix the upstream bug, and remove the wasm build from the publish pipeline as a temporary workaround.

---

Issues

The two changes work against each other

The patch in patches/wasm-pack@0.14.0.patch correctly fixes the root cause — the wrong GitHub author in binary.js. If the patch works, the build-wasm job should succeed, and the wasm artifact download/validation steps in publish should stay intact so @rivetkit/rivetkit-wasm continues to be published to npm.

As written, build-wasm still runs (wasting CI time and money) but its output is completely discarded. The wasm package will not be published as part of this change.

Suggested resolution — pick one approach:

1. (Preferred) Apply only the patch, restore the build-wasm dependency in publish, and verify the patch actually fixes the download failure.
2. If the patch is not yet validated, skip the patch for now and just remove build-wasm from publish with a tracking issue for the follow-up.

build-wasm job is orphaned

After this change, build-wasm still executes on every publish trigger, uploads an artifact nobody downloads, and spends real compute budget. If wasm publishing is intentionally being suspended, the job should either be deleted or set to continue-on-error: true with a comment explaining why it is temporarily decoupled.

---

Observations (non-blocking)

• Patch is correct. The one-line change in binary.js accurately reflects the wasm-pack project transfer from drager to the wasm-bindgen org. Pinning to 0.14.0 is fine since the patch is keyed to that exact version.
• Lock file is consistent. pnpm-lock.yaml correctly records the patch hash.
• PR description is empty. Even for a temp fix, a one-line note explaining the issue and intent would help future readers.
• Title prefix temp: is informal. If this is truly temporary, link the follow-up issue or add a TODO comment in the workflow so the bypass does not silently become permanent.

---

Summary

The patch itself is correct and worth keeping. The workflow change as written orphans the build-wasm job and silently stops publishing @rivetkit/rivetkit-wasm. Recommend either validating the patch restores the full pipeline, or cleanly removing build-wasm if wasm publishing needs to be paused intentionally.

[claude]

PR Review: temp: patch out broken wasm-pack package

Overview: This PR applies a pnpm patch to wasm-pack@0.14.0 to fix a broken binary download URL. The binary.js in the published npm package incorrectly references the drager GitHub user instead of the correct wasm-bindgen org, so the binary download fails. The patch corrects the author string used to construct the GitHub release URL.

---

What the patch does

The core fix is one line in binary.js:

- const author = "drager";
+ const author = "wasm-bindgen";

This is a known upstream issue: the wasm-pack project moved from the drager GitHub user to the wasm-bindgen org but the npm package was not updated. Using pnpm patchedDependencies is the correct idiomatic approach for this kind of upstream bug.

---

Code quality

• Patch is minimal and precisely targeted.
• The pnpm lock file is updated with the patch hash, so installs verify patch integrity.
• The unrelated blank-line removal in publish.yaml is harmless but could be a separate commit for clarity.

---

Concerns

1. No upstream tracking reference. Nothing in the patch or package.json points to the upstream bug or PR. Future maintainers will not know when it is safe to remove this patch. Add a short comment near the patchedDependencies entry linking to the upstream issue.

2. Patch maintenance risk. pnpm patches are tied to an exact version. If wasm-pack is ever bumped without regenerating the patch, the build will silently break. Either document this constraint or add a .agent/todo/ entry to remove the patch once a fixed npm release is available.

3. Version upgrade not explored. If a later wasm-pack version already ships the correct author string, upgrading would be cleaner than patching. Worth a quick check before landing.

---

Security

No concerns. wasm-bindgen/wasm-pack is the correct official repository. The pnpm patch hash in the lock file ensures the patch content is verified on every install.

---

Summary

Correct and low-risk build-tooling fix. Main gap is lifecycle documentation: add a comment or todo linking to the upstream bug so the patch gets removed once a fixed npm release is available.