@lanes-sh/link 0.6.3 → 0.6.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@lanes-sh/link",
|
|
3
|
-
"version": "0.6.
|
|
3
|
+
"version": "0.6.4",
|
|
4
4
|
"description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"homepage": "https://lanes.sh/link",
|
|
@@ -43,7 +43,6 @@
|
|
|
43
43
|
"instructions",
|
|
44
44
|
"README.md",
|
|
45
45
|
"LICENSE",
|
|
46
|
-
"bun.lock",
|
|
47
46
|
"bunfig.toml",
|
|
48
47
|
".dockerignore"
|
|
49
48
|
],
|
|
@@ -18,9 +18,31 @@ WORKDIR /app
|
|
|
18
18
|
# The manifest first, so a source-only change reuses the install layer. One
|
|
19
19
|
# package now, rather than fifteen manifests copied ahead of the install to
|
|
20
20
|
# satisfy workspace resolution.
|
|
21
|
-
|
|
21
|
+
#
|
|
22
|
+
# `bun.lock*`, not `bun.lock`, and the star is the whole point: **npm strips a
|
|
23
|
+
# root lockfile out of a published tarball whatever `files` says.** Verified
|
|
24
|
+
# against npm 12, which is what `release.yml` installs before publishing; npm
|
|
25
|
+
# 11.6 still packs it, so a local `npm pack` says the opposite and the gap only
|
|
26
|
+
# shows up in what people actually install.
|
|
27
|
+
#
|
|
28
|
+
# This image is built from whichever tree `lanes link deploy` is run against, and
|
|
29
|
+
# there are two of them. From a checkout the lockfile is present and pins the
|
|
30
|
+
# whole transitive set. From a bun-global install — the only install method this
|
|
31
|
+
# CLI documents — it cannot be there at all, and naming it outright made deploy
|
|
32
|
+
# impossible for every one of those users: the build pulled the base image,
|
|
33
|
+
# pushed a context, and then died on `stat bun.lock: file does not exist`.
|
|
34
|
+
COPY package.json bunfig.toml bun.lock* ./
|
|
22
35
|
|
|
23
|
-
|
|
36
|
+
# Not `--frozen-lockfile || bun install`: that swallows a genuine
|
|
37
|
+
# lockfile-versus-manifest disagreement in a checkout build, which is the one
|
|
38
|
+
# thing the frozen flag is for. The branch says which tree it is building and
|
|
39
|
+
# holds the guarantee that tree can offer.
|
|
40
|
+
#
|
|
41
|
+
# What the fallback gives up is narrower than it looks. Every runtime dependency
|
|
42
|
+
# in `package.json` is an exact version, so the direct set is identical either
|
|
43
|
+
# way; the lockfile pins what those depend on in turn, and a published package
|
|
44
|
+
# has never been able to carry one.
|
|
45
|
+
RUN if [ -f bun.lock ]; then bun install --frozen-lockfile; else bun install; fi
|
|
24
46
|
|
|
25
47
|
COPY src/ src/
|
|
26
48
|
|