@mercury-fw/cli 0.38.0 → 0.38.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @mercury-fw/cli
 
+## 0.38.1
+
+### Patch Changes
+
+- 972a17f: - `mfw local-packages` and `mfw create --local-packages` name each tarball in `.packs/` after its content, so a package repacked at the same version is installed anew instead of kept from Bun's cache or refused by the lockfile's integrity check
+  - @mercury-fw/core@0.38.1
+  - @mercury-fw/utils@0.38.1
+
 ## 0.38.0
 
 ### Minor Changes

package/README.md

@@ -222,7 +222,7 @@ Makes the app install `@mercury-fw/*` packages from local tarballs instead of th
 
 Overrides, and not the dependencies themselves, because a packed package names the packages it depends on by version, and the registry has those versions too: only an override sends them to the tarballs as well (a packed `@mercury-fw/core` depends on `@mercury-fw/plugin-types`, for example). The Dockerfile `mfw create` writes copies `.packs/` before installing, so the image gets the same packages (an app created before 0.31.0 needs `COPY --chown=mercury:mercury .pack[s] ./.packs/` added after the line copying `package.json`); `.gitignore` leaves it out of the repository.
 
-Run it again after packing anew: it replaces the tarballs and the overrides of the previous run, and leaves alone the overrides you wrote yourself. `--off` takes the app back to the registry: the overrides it wrote and `.packs/` go, then `bun install`. After either, `mfw start` rebuilds the image with the packages now installed.
+Run it again after packing anew: it replaces the tarballs and the overrides of the previous run, and leaves alone the overrides you wrote yourself. In `.packs/` each tarball is named after its content (`mercury-fw-core-0.38.0-1a2b3c4d.tgz`): Bun doesn't look again at a tarball whose override didn't change, it keeps what its lockfile and its cache hold, so a repack at the same version needs a new name to be installed. `--off` takes the app back to the registry: the overrides it wrote and `.packs/` go, then `bun install`. After either, `mfw start` rebuilds the image with the packages now installed.
 
 ```bash
 mfw local-packages ../mercury-fw/apps/testbed/.packs

package/dist/src/app/local-packages.d.ts

@@ -4,7 +4,10 @@
  * which the image copies before `bun install`. Overrides, and not the
  * dependencies themselves, because a packed package names its siblings by
  * version, which the registry has too: only an override sends those
- * transitive dependencies to the tarballs as well.
+ * transitive dependencies to the tarballs as well. Each tarball is named
+ * after its content there: Bun takes a `file:` tarball whose spec didn't
+ * change for the one in its lockfile, so a repack at the same version needs
+ * another name to be installed.
  */
 /** The tarballs' folder inside the app, as the Dockerfile copies it. */
 export declare const LOCAL_PACKS_DIR = ".packs";
@@ -20,8 +23,10 @@ export declare function withLocalOverrides(pkg: Manifest, packs: Array<{
 /** `pkg` without the overrides this command writes; without `overrides` at
  * all when none of the user's own is left. */
 export declare function withoutLocalOverrides(pkg: Manifest): Manifest;
-/** A local tarball: its file name in the folder, and the package it holds. */
+/** A local tarball: its file name in the folder (`source`), its name in the
+ * app's `.packs/` (`file`), and the package it holds. */
 export type Pack = {
+    source: string;
     file: string;
     name: string;
     version: string;
@@ -33,9 +38,10 @@ export declare function packageOf(tarball: string): Promise<{
     version: string;
 }>;
 /** The tarballs in `from`, in file-name order, each with the package it
- * holds, for an app in `appDir`. Throws when `from` doesn't exist, holds no
- * tarball, or is the app's own `.packs/` (which the copy replaces). */
+ * holds and its name after its content, for an app in `appDir`. Throws when
+ * `from` doesn't exist, holds no tarball, or is the app's own `.packs/`
+ * (which the copy replaces). */
 export declare function readPacks(from: string, appDir: string): Promise<Pack[]>;
-/** Copies `packs` from `from` into the app's `.packs/`, in place of whatever was there. */
+/** Copies `packs` from `from` into the app's `.packs/` under their content names, in place of whatever was there. */
 export declare function copyPacks(from: string, appDir: string, packs: Pack[]): void;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mercury-fw/cli",
-  "version": "0.38.0",
+  "version": "0.38.1",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -41,8 +41,8 @@
   "comment:shape": "The Mercury CLI (`mfw`). `mfw create <dir>` writes a new Mercury app from the template. The framework packages move in lockstep with it, so a new app gets them at the CLI's own version; plugins and channels at the registry's latest. The plugin and channel packages are devDependencies only for the catalog test. `main(argv)` is exported for create-mercury-agent.",
   "dependencies": {
     "@clack/prompts": "^1.8.1",
-    "@mercury-fw/core": "0.38.0",
-    "@mercury-fw/utils": "0.38.0",
+    "@mercury-fw/core": "0.38.1",
+    "@mercury-fw/utils": "0.38.1",
     "commander": "^15.0.0"
   },
   "devDependencies": {
@@ -50,7 +50,7 @@
     "@mercury-fw/channel-http": "0.4.0",
     "@mercury-fw/auth-oidc": "0.1.0",
     "@mercury-fw/auth-static": "0.1.0",
-    "@mercury-fw/formatter": "0.38.0",
+    "@mercury-fw/formatter": "0.38.1",
     "@mercury-fw/plugin-atlassian-admin": "0.1.2",
     "@mercury-fw/plugin-bitbucket": "0.1.2",
     "@mercury-fw/plugin-jira": "0.4.3",

package/src/app/local-packages.ts

@@ -4,10 +4,14 @@
  * which the image copies before `bun install`. Overrides, and not the
  * dependencies themselves, because a packed package names its siblings by
  * version, which the registry has too: only an override sends those
- * transitive dependencies to the tarballs as well.
+ * transitive dependencies to the tarballs as well. Each tarball is named
+ * after its content there: Bun takes a `file:` tarball whose spec didn't
+ * change for the one in its lockfile, so a repack at the same version needs
+ * another name to be installed.
  */
 
-import { cpSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import { join, resolve } from "node:path";
 
 /** The tarballs' folder inside the app, as the Dockerfile copies it. */
@@ -38,8 +42,15 @@ export function withoutLocalOverrides(pkg: Manifest): Manifest {
   return Object.keys(own).length > 0 ? { ...rest, overrides: own } : rest;
 }
 
-/** A local tarball: its file name in the folder, and the package it holds. */
-export type Pack = { file: string; name: string; version: string };
+/** A local tarball: its file name in the folder (`source`), its name in the
+ * app's `.packs/` (`file`), and the package it holds. */
+export type Pack = { source: string; file: string; name: string; version: string };
+
+/** `file`'s name with the first 8 hex digits of `tarball`'s sha256 before `.tgz`. */
+function contentName(file: string, tarball: string): string {
+  const hash = createHash("sha256").update(readFileSync(tarball)).digest("hex").slice(0, 8);
+  return `${file.slice(0, -".tgz".length)}-${hash}.tgz`;
+}
 
 /** The package name and version in a `bun pm pack` tarball, read from its
  * `package/package.json`. */
@@ -58,8 +69,9 @@ export async function packageOf(tarball: string): Promise<{ name: string; versio
 }
 
 /** The tarballs in `from`, in file-name order, each with the package it
- * holds, for an app in `appDir`. Throws when `from` doesn't exist, holds no
- * tarball, or is the app's own `.packs/` (which the copy replaces). */
+ * holds and its name after its content, for an app in `appDir`. Throws when
+ * `from` doesn't exist, holds no tarball, or is the app's own `.packs/`
+ * (which the copy replaces). */
 export async function readPacks(from: string, appDir: string): Promise<Pack[]> {
   const source = resolve(from);
   if (source === join(resolve(appDir), LOCAL_PACKS_DIR)) {
@@ -68,13 +80,15 @@ export async function readPacks(from: string, appDir: string): Promise<Pack[]> {
   if (!existsSync(source)) throw new Error(`${source} doesn't exist.`);
   const files = readdirSync(source).filter((f) => f.endsWith(".tgz")).sort();
   if (files.length === 0) throw new Error(`No .tgz in ${source}: pack the packages there first (bun pm pack).`);
-  return Promise.all(files.map(async (file) => ({ file, ...(await packageOf(join(source, file))) })));
+  return Promise.all(
+    files.map(async (file) => ({ source: file, file: contentName(file, join(source, file)), ...(await packageOf(join(source, file))) })),
+  );
 }
 
-/** Copies `packs` from `from` into the app's `.packs/`, in place of whatever was there. */
+/** Copies `packs` from `from` into the app's `.packs/` under their content names, in place of whatever was there. */
 export function copyPacks(from: string, appDir: string, packs: Pack[]): void {
   const target = join(appDir, LOCAL_PACKS_DIR);
   rmSync(target, { recursive: true, force: true });
   mkdirSync(target);
-  for (const { file } of packs) cpSync(join(resolve(from), file), join(target, file));
+  for (const { source, file } of packs) cpSync(join(resolve(from), source), join(target, file));
 }