fix(deps): repair incomplete bundled-dep entries in demo/package-lock.json

[dreadster3]

Problem

Renovate updates root package.json + package-lock.json and demo/package.json fine, but has never been able to update demo/package-lock.json — every Renovate dependency PR (e.g. #41, #44, #35, #47) ships manifest bumps without the demo lockfile update and carries:

• a renovate/artifacts status = FAILURE
• an "⚠️ Artifact update problem" comment like:

##### File name: demo/package-lock.json

npm error code EALLOWREMOTE
npm error Fetching packages of type "remote" have been disabled
npm error Refusing to fetch "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.3.tgz"

Because the lockfile is left stale, the Demo workflow's npm ci fails on such PRs with the familiar mismatch (from #41):

npm error Invalid: lock file's katex@0.16.47 does not satisfy katex@0.19.0

Root cause

@tailwindcss/oxide-wasm32-wasi (optional wasm32 dep of tailwindcss@4.3.3 locked in the demo) ships bundled dependencies (@emnapi/*, @napi-rs/wasm-runtime, @tybys/wasm-util, tslib). The old lockfile entry declared bundleDependencies but was missing its nested inBundle child entries — an incomplete lockfile round-trip (npm bug family, e.g. npm/cli#9821).

So whenever npm rebuilds the demo tree (including Renovate's npm install --package-lock-only --no-audit --ignore-scripts artifact update), npm tries to repair the inconsistency by refetching the tarball. With allow-remote fetch gating enabled (as in Renovate's npm environment) the fetch is refused → EALLOWREMOTE → lockfile update fails. The root lockfile is unaffected because its oxide-wasm32-wasi@4.2.2 entry is complete (all 6 bundled children recorded).

Reproduced locally: the exact Renovate command fails in demo/ (crash in idealTree:buildDeps on oxide-wasm32-wasi) but succeeds at the repo root; after this fix it passes in demo/ too, even with allow-remote=none.

Fix

Delete the incomplete @tailwindcss/oxide-wasm32-wasi@4.3.3 entries from demo/package-lock.json and re-resolve with npm install --package-lock-only, which writes the entry back complete with all six bundled children. The diff is purely additive (+66 lines, no version changes) — it now matches the structure the root lockfile already has.

After merging, Renovate's lockfile updates for the demo will succeed, so demo/package-lock.json will be updated in lockstep with demo/package.json going forward. To refresh the existing open Renovate PRs, tick their rebase/retry checkbox (or rename titles to start with rebase!).

[dreadster3]

Created in the wrong repository by accident — closing.