@gjsify/oxfmt-native 0.24.1 → 0.24.2

package/README.md

@@ -40,6 +40,31 @@ git submodule update --init refs/oxc
 gjsify workspace @gjsify/oxfmt-native build:prebuilds   # needs meson + vala + cargo
 ```
 
+### Dependency lock
+
+`src/rust/Cargo.lock` is **committed**. It pins the crates.io half of the graph the way
+[`scripts/check-refs-pin.mjs`](../../../scripts/check-refs-pin.mjs) pins the `refs/` half, so the
+prebuild in this repository can be re-linked against the exact transitive set it was built from.
+CI builds with `--locked` (`${CI:+--locked}` on the `cargo build` in `meson.build`; every CI leg
+runs with `CI=true`), so a lock that no longer satisfies `Cargo.toml` fails the run instead of
+being silently rewritten. Local builds are unlocked, so editing `Cargo.toml` still just works —
+commit the resulting lock diff with the change.
+
+Updating a dependency is a deliberate act:
+
+```bash
+cd packages/infra/oxfmt-native/src/rust
+cargo update -p <crate>        # or plain `cargo update` for the whole registry side
+cargo tree -d                  # no crate may appear as BOTH a path and a registry entry
+cd -
+gjsify workspace @gjsify/oxfmt-native build:prebuilds
+```
+
+The `cargo tree -d` step is not optional here: `refs/oxc` publishes `oxc_allocator` to crates.io
+*and* path-deps it in-tree, so the `[patch.crates-io]` table in `src/rust/Cargo.toml` is what keeps
+the graph to a single crate identity. Bumping `refs/oxc` moves the path crates' own versions and
+therefore invalidates the lock — regenerate it in the same commit as the submodule pin.
+
 ## Platform coverage
 
 | Platform | Prebuild | Built by |

package/meson.build

@@ -70,16 +70,24 @@ cargo = find_program('cargo')
 
 rust_sources = files(
     'src/rust/Cargo.toml',
+    'src/rust/Cargo.lock',
     'src/rust/src/lib.rs',
 )
 
 rust_target_dir = meson.current_build_dir() / 'cargo-target'
 
+# `${CI:+--locked}` — on a CI runner (GitHub Actions always exports CI=true) the
+# committed src/rust/Cargo.lock is ENFORCED: cargo fails loudly instead of
+# re-resolving the registry and rewriting the lock, so a lock that no longer
+# satisfies Cargo.toml (or a refs/oxc bump that moved a path crate's version)
+# reds the run rather than silently shipping a differently-linked prebuild.
+# Locally the flag expands to nothing, so editing Cargo.toml still just works —
+# commit the resulting lock diff together with the change.
 rust_cdylib = custom_target('gjsify-oxfmt-rust',
     input:  rust_sources,
     output: rust_cdylib_name,
     command: ['sh', '-c',
-              'cargo build --release --manifest-path "$1" --target-dir "$2" && cp "$2/release/'
+              'cargo build --release ${CI:+--locked} --manifest-path "$1" --target-dir "$2" && cp "$2/release/'
                   + rust_cdylib_name + '" "$3"' + rust_cdylib_post,
               'sh',
               meson.current_source_dir() / 'src/rust/Cargo.toml',

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gjsify/oxfmt-native",
-    "version": "0.24.1",
+    "version": "0.24.2",
     "description": "Vala/GObject + Rust cdylib bridge to oxc's formatter (oxfmt) for GJS. Formats JavaScript/TypeScript/JSX under GJS without a Node runtime — the Node-free counterpart to the npm `oxfmt` native napi binary, backing `gjsify format` under GJS. Wraps oxc_formatter (Prettier-compatible) via a single-shot FFI; the embedded CSS/HTML/Markdown ExternalFormatter (Prettier-NAPI) is out of scope.",
     "type": "module",
     "main": "lib/esm/index.js",
@@ -62,7 +62,7 @@
         "@girs/gobject-2.0": "^4.1.0"
     },
     "devDependencies": {
-        "@gjsify/cli": "^0.24.1",
+        "@gjsify/cli": "^0.24.2",
         "@types/node": "^25.9.2",
         "typescript": "^6.0.3"
     },