From 98c7e312e050e600c43bb787cff68d73e9444dd6 Mon Sep 17 00:00:00 2001
From: defiQUG <defi@defi-oracle.io>
Date: Sun, 12 Apr 2026 06:44:13 -0700
Subject: [PATCH] docs(thirdweb-2103): npm-only vendor deps; avoid nested
 lib/contracts

Document foundry remappings via node_modules and that embedded lib/contracts
clones break parent git; quick forge:build check after npm install.

Made-with: Cursor
---
 thirdweb-core-2103-test/README.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/thirdweb-core-2103-test/README.md b/thirdweb-core-2103-test/README.md
index e3bda9e7..244166e7 100644
--- a/thirdweb-core-2103-test/README.md
+++ b/thirdweb-core-2103-test/README.md
@@ -42,6 +42,19 @@ Use **`--legacy --with-gas-price 1000000000`** on Foundry for Besu chain minimum
 
 OpenZeppelin is pinned to **4.8.3** so Thirdweb 3.15 compiles (avoids `_contextSuffixLength` conflicts with OZ 4.9+).
 
+## Dependencies (npm only — no `lib/contracts` clone)
+
+Foundry remappings in `foundry.toml` point Thirdweb and OpenZeppelin at **`node_modules/`** (for example `tw/=node_modules/@thirdweb-dev/contracts/`). You do **not** need a separate git checkout under `lib/contracts/`.
+
+If you previously cloned Thirdweb (or another vendor) into `lib/contracts`, remove that directory and rely on `npm install` only. A nested `.git` there breaks the parent monorepo (`git add` warns about embedded repositories); the parent workspace intentionally **ignores** `thirdweb-core-2103-test/lib/contracts/` in `.gitignore` so accidental clones stay local.
+
+Quick compile check after install:
+
+```bash
+npm install
+npm run forge:build
+```
+
 ## CREATE2 on VMID 2103
 
 `Create2Factory` + `Create2Probe` (`src/`) and `script/Create2DeployTest.s.sol` deploy via OpenZeppelin `Create2`, assert `predictProbe(salt) == deployProbe(salt)`, and read `VMID_TAG == 2103`.