atxp-client (and others) pin exact @atxp/* versions (e.g. @atxp/common@0.11.11) that can diverge from the workspace version. On a non-clean install this leaves a stale nested node_modules/@atxp/common shadowing the workspace package. Concrete evidence: a stale nested @atxp/common@0.11.7 was resolved over the fixed 0.11.10, and 0.11.7 has a seconds-vs-ms token-expiry bug (expiresAt < Date.now() vs * 1000) → every token read as expired. Matches the existing CLAUDE.md note about nested @atxp/* shadowing.
Proposed: use workspace:* (or a range) for cross-package @atxp/* deps so installs always link the workspace package; optionally a CI guard against nested @atxp/*.
atxp-client(and others) pin exact@atxp/*versions (e.g.@atxp/common@0.11.11) that can diverge from the workspace version. On a non-clean install this leaves a stale nestednode_modules/@atxp/commonshadowing the workspace package. Concrete evidence: a stale nested@atxp/common@0.11.7was resolved over the fixed0.11.10, and 0.11.7 has a seconds-vs-ms token-expiry bug (expiresAt < Date.now()vs* 1000) → every token read as expired. Matches the existing CLAUDE.md note about nested@atxp/*shadowing.Proposed: use
workspace:*(or a range) for cross-package@atxp/*deps so installs always link the workspace package; optionally a CI guard against nested@atxp/*.