@arcote.tech/arc-cli 0.6.1 → 0.6.2

package/dist/index.js

@@ -26446,7 +26446,7 @@ ${colors3.yellow}Type declaration errors:${colors3.reset}`);
 }
 
 // src/platform/shared.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync11, readdirSync as readdirSync6, rmSync as rmSync3, writeFileSync as writeFileSync10 } from "fs";
+import { copyFileSync, existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync11, readdirSync as readdirSync6, rmSync as rmSync3, writeFileSync as writeFileSync10 } from "fs";
 import { dirname as dirname6, join as join12 } from "path";
 
 // src/builder/module-builder.ts
@@ -27254,7 +27254,7 @@ async function buildStyles(rootDir, arcDir, packages, themePath, cache, noCache)
 
 // src/builder/dependency-collector.ts
 import { createHash } from "crypto";
-import { copyFileSync, existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
 import { basename as basename3, join as join10 } from "path";
 var FRAMEWORK_PEERS = [
   "@arcote.tech/arc",
@@ -27276,16 +27276,22 @@ function collectFrameworkDeps(arcDir, rootDir, packages) {
   const manifestPath = join10(arcDir, "package.json");
   writeFileSync8(manifestPath, JSON.stringify(manifest, null, 2) + `
 `);
-  const rootLock = join10(rootDir, "bun.lock");
   const targetLock = join10(arcDir, "bun.lock");
-  if (existsSync9(rootLock)) {
-    copyFileSync(rootLock, targetLock);
-  }
-  const hash = sha256OfFiles2([manifestPath, targetLock]);
+  writeFileSync8(targetLock, "");
+  const hash = sha256ConcatHex([manifestPath, targetLock]);
   writeFileSync8(join10(arcDir, ".deps-hash"), hash + `
 `);
   return { hash, manifestPath };
 }
+function sha256ConcatHex(paths) {
+  const hash = createHash("sha256");
+  for (const p of paths) {
+    if (existsSync9(p)) {
+      hash.update(readFileSync9(p));
+    }
+  }
+  return hash.digest("hex");
+}
 function collectModuleDeps(arcDir, pkg) {
   const safeName = basename3(pkg.path);
   const moduleDir = join10(arcDir, "modules", safeName);
@@ -27613,7 +27619,7 @@ async function copyBrowserAssets(ws, cache, noCache) {
   for (const asset of assets) {
     const dest = join12(ws.assetsDir, asset.to);
     mkdirSync10(dirname6(dest), { recursive: true });
-    copyFileSync2(asset.src, dest);
+    copyFileSync(asset.src, dest);
     outputHashes[asset.to] = sha256Hex(readFileSync11(dest));
   }
   updateCache(cache, unitId, inputHash, { outputHashes });
@@ -28786,10 +28792,7 @@ async function syncEnv(inputs) {
       console.log("[arc] Pushing framework deps...");
       const form = new FormData;
       form.append("package.json", new Blob([readFileSync13(join17(ws.arcDir, "package.json"))]), "package.json");
-      const lockPath = join17(ws.arcDir, "bun.lock");
-      if (existsSync13(lockPath)) {
-        form.append("bun.lock", new Blob([readFileSync13(lockPath)]), "bun.lock");
-      }
+      form.append("bun.lock", new Blob([""]), "bun.lock");
       const res = await fetch(`${base2()}/api/deploy/framework`, {
         method: "POST",
         body: form
@@ -31191,7 +31194,7 @@ function createDeployApiHandler(opts) {
       writeFileSync15(join19(opts.ws.arcDir, "package.json"), Buffer.from(await pkgFile.arrayBuffer()));
       writeFileSync15(join19(opts.ws.arcDir, "bun.lock"), Buffer.from(await lockFile.arrayBuffer()));
       const start = Date.now();
-      const installOk = await runBun(["install", "--production", "--frozen-lockfile"], opts.ws.arcDir);
+      const installOk = await runBun(["install", "--production"], opts.ws.arcDir);
       if (!installOk) {
         return Response.json({ error: "bun install failed" }, { status: 500, headers: cors });
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcote.tech/arc-cli",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "CLI tool for Arc framework",
   "module": "index.ts",
   "main": "dist/index.js",
@@ -12,12 +12,12 @@
     "build": "bun build --target=bun ./src/index.ts --outdir=dist --external @arcote.tech/arc --external @arcote.tech/arc-ds --external @arcote.tech/arc-react --external @arcote.tech/platform && chmod +x dist/index.js"
   },
   "dependencies": {
-    "@arcote.tech/arc": "^0.6.1",
-    "@arcote.tech/arc-ds": "^0.6.1",
-    "@arcote.tech/arc-react": "^0.6.1",
-    "@arcote.tech/arc-host": "^0.6.1",
-    "@arcote.tech/arc-adapter-db-sqlite": "^0.6.1",
-    "@arcote.tech/platform": "^0.6.1",
+    "@arcote.tech/arc": "^0.6.2",
+    "@arcote.tech/arc-ds": "^0.6.2",
+    "@arcote.tech/arc-react": "^0.6.2",
+    "@arcote.tech/arc-host": "^0.6.2",
+    "@arcote.tech/arc-adapter-db-sqlite": "^0.6.2",
+    "@arcote.tech/platform": "^0.6.2",
     "@clack/prompts": "^0.9.0",
     "commander": "^11.1.0",
     "chokidar": "^3.5.3",

package/src/builder/dependency-collector.ts

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { basename, join } from "path";
 import type { WorkspacePackage } from "./module-builder";
 
@@ -59,20 +59,32 @@ export function collectFrameworkDeps(
   const manifestPath = join(arcDir, "package.json");
   writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + "\n");
 
-  // Copy workspace bun.lock so the container can use --frozen-lockfile for
-  // deterministic framework installs. Per-module installs run without it (no
-  // per-module lockfile in MVP).
-  const rootLock = join(rootDir, "bun.lock");
+  // Empty bun.lock placeholder. We CAN'T copy the workspace bun.lock — it
+  // contains the full dep graph (workspaces, dev deps) but our framework
+  // manifest is just the singleton peers. `bun install --frozen-lockfile`
+  // would reject as "lockfile had changes". An empty lockfile is harmless
+  // when server runs `bun install --production` without freeze.
   const targetLock = join(arcDir, "bun.lock");
-  if (existsSync(rootLock)) {
-    copyFileSync(rootLock, targetLock);
-  }
+  writeFileSync(targetLock, "");
 
-  const hash = sha256OfFiles([manifestPath, targetLock]);
+  // Hash MUST match the server-side computation in deploy-api.ts
+  // (sha256 over concat of raw bytes) — otherwise every deploy would think
+  // framework changed and re-install in a loop.
+  const hash = sha256ConcatHex([manifestPath, targetLock]);
   writeFileSync(join(arcDir, ".deps-hash"), hash + "\n");
   return { hash, manifestPath };
 }
 
+function sha256ConcatHex(paths: string[]): string {
+  const hash = createHash("sha256");
+  for (const p of paths) {
+    if (existsSync(p)) {
+      hash.update(readFileSync(p));
+    }
+  }
+  return hash.digest("hex");
+}
+
 // ---------------------------------------------------------------------------
 // Per-module deps
 // ---------------------------------------------------------------------------

package/src/deploy/remote-sync.ts

@@ -116,14 +116,12 @@ export async function syncEnv(inputs: SyncInputs): Promise<SyncOutcome> {
         new Blob([readFileSync(join(ws.arcDir, "package.json"))]),
         "package.json",
       );
-      const lockPath = join(ws.arcDir, "bun.lock");
-      if (existsSync(lockPath)) {
-        form.append(
-          "bun.lock",
-          new Blob([readFileSync(lockPath)]),
-          "bun.lock",
-        );
-      }
+      // Ship a placeholder bun.lock (server validates its presence) but
+      // intentionally empty — workspace bun.lock has the full dep graph and
+      // would trip --frozen-lockfile against our slim framework package.json.
+      // The server side runs `bun install --production` without freeze, so an
+      // empty lock is harmless: bun re-resolves against package.json.
+      form.append("bun.lock", new Blob([""]), "bun.lock");
       const res = await fetch(`${base()}/api/deploy/framework`, {
         method: "POST",
         body: form,

package/src/platform/deploy-api.ts

@@ -98,8 +98,12 @@ export function createDeployApiHandler(opts: DeployApiOptions): ArcHttpHandler {
       );
 
       const start = Date.now();
+      // No --frozen-lockfile: workspace bun.lock from the source project
+      // contains the full dep graph, but our framework manifest is a subset.
+      // Bun would reject as "lockfile had changes". Let bun re-resolve against
+      // the framework-only package.json.
       const installOk = await runBun(
-        ["install", "--production", "--frozen-lockfile"],
+        ["install", "--production"],
         opts.ws.arcDir,
       );
       if (!installOk) {