Fix invalid package name in package.json causing Netlify deploy error

[netlify-coding]

Bugfix Pull Request

Linked issues

Related Linear issue: TOA-2. No closing link is proposed.

Context

The production deploy failed during npm dependency installation with EINVALIDPACKAGENAME, before the Vite application build.

Observed environment: Node 24.21.0, npm 11.19.0.

Implementation context is recorded in the Netlify agent run.

Reproduction

1. Deploy main revision 0aa668191a225f981bb3cfdca7806438acc0651e.
2. Netlify attempts npm dependency installation.
3. Installation fails on malformed dependency keys such as @emotion/react@11.14.0.

Expected: dependencies install and the application builds.

Root Cause

package.json at the failed revision contains version-suffixed dependency keys alongside canonical entries.

The implementation report also describes a subsequent build failure involving missing figma:asset/... images expected under src/assets. That directory was absent from the inspected source listing; the reported count of 56 missing imports has not been independently verified.

Fix Summary

The merged changes:

• Remove malformed duplicate dependency keys from package.json.
• Add package-lock.json.
• Update vite.config.ts to resolve exported images where available, otherwise supply neutral grey placeholders and log missing filenames.
• Add .gitignore entries for generated dependency, build and Netlify directories.

Original artwork still needs exporting under its expected filenames to replace placeholders.

Verification

Netlify reported the deploy preview ready for commit 62bf2693bca01613dedc5409ebe87aa485247092; the deploy log provides the deployment evidence.

GitHub reports three neutral Netlify checks and two skipped dependency-validation checks. These do not establish complete QA or production deployment success.

• Tests added/updated to cover the bug
• Manual verification steps (browsers/devices)
• Negative/edge cases checked

Risk & Rollback

Risk assessment remains unverified. Placeholder images permit builds without restoring intended artwork, so visual review is still required.

A rollback would require a separately reviewed revert of the merged changes and would reintroduce the original dependency-installation defect.

Changelog

Added

• npm dependency lockfile.

Changed

• Missing Figma image assets use neutral placeholders with filename warnings.

Fixed

• Invalid duplicate dependency names blocking npm installation.

Removed

• Malformed version-suffixed dependency keys.

---

Checklist (Global DoD / PR)

• Code review approved
• Netlify deploy preview succeeds
• Clean dependency installation and build verified
• Placeholder-image behaviour visually reviewed
• Production deployment succeeds and its link is recorded
• Active Netlify package-manager and runtime configuration confirmed

---

[netlify]

✅ Deploy Preview for thisonetimeonacidcom ready!

Name	Link
🔨 Latest commit	62bf269
🔍 Latest deploy log	https://app.netlify.com/projects/thisonetimeonacidcom/deploys/6abfb269c882a5000924e8e9
😎 Deploy Preview	https://deploy-preview-1--thisonetimeonacidcom.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[linear-code]

TOA-2

[ashleyshaw]

State and merge-readiness verdict

This PR merged into main on 2 October 2026 at 13:33:03 UTC. This metadata audit does not constitute a code review or a new approval.

• The recorded approval covers head commit 62bf2693bca01613dedc5409ebe87aa485247092.
• No review threads are recorded.
• GitHub’s current mergeable_state=unknown is not evidence of a blocker for an already merged PR.
• Required-check and branch-protection settings were not verified, so this audit cannot retrospectively certify compliance with every merge gate.

Checks and deployment evidence

The combined commit status is successful for the Netlify deploy-preview context. However, the five check runs comprise:

• Neutral: Redirect rules, Header rules and Pages changed.
• Skipped: dependency-validation and dependency-validation (dependabot, hosted).

These are not five passing checks. In particular, there is no passing dependency-validation check, and neutral Netlify checks do not establish routing or header correctness.

Netlify’s comment links the preview deployment log.

The linked Linear issue subsequently records successful production dependency installation, build and deployment, using Node 24.21.0, npm 11.19.0 and Vite 6.3.5. This is later production evidence—not proof that every check passed on this PR’s head.

Metadata and template findings

1. Title: The existing title describes the defect but lacks the fix: prefix required by title governance. Suggested title:
   fix: netlify - Remove invalid dependency names blocking deployment
2. Classification: The PR has no labels. Its purpose is fixing broken installation, not a routine dependency upgrade. The canonical type:bug label is available in this repository and is the proposed classification. The Linear issue’s label does not automatically label the GitHub PR.
3. Description: The body follows the shared bug-template sections, but substitutes a shorter deployment checklist for the complete template Definition of Done. Its unchecked production-deployment item is stale relative to the later Linear evidence. Only evidence-backed items should be marked complete.

The historical branch name also lacks the governed fix/ prefix. This does not explain the skipped checks and does not justify recreating the merged PR.

Remaining uncertainties and scope boundaries

This audit did not verify clean-checkout installation, browser/device coverage, accessibility, placeholder-image appearance, preservation of Vite behaviour or a committed changelog entry. It also did not independently recheck current production health.

Current AGENTS.md and CONTRIBUTING.md prescribe pnpm, conflicting with README guidance and the recorded npm deployment. Those instructions were added after this PR merged. Resolve that conflict before future implementation; do not silently switch package managers or rewrite historical deployment evidence.

Routing and artwork follow-ups remain separate from the original dependency-name defect.

Conclusion: Already merged with recorded approval and successful preview status; later production success is documented in Linear. Complete QA and comprehensive merge-gate compliance are not established by this audit.