@tokenoftrust/cli 2.0.17 → 2.0.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tokenoftrust/cli",
-  "version": "2.0.17",
+  "version": "2.0.18",
   "description": "Token of Trust developer CLI — clone a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.",
   "license": "Apache-2.0",
   "author": "Token of Trust",

package/src/commands/dev.mjs

@@ -1039,6 +1039,36 @@ function sourceVersionKey(source) {
  * @param {{ log?: (m: string) => void, cacheRoot?: string }} [opts]
  * @returns {Promise<string>} the cached, installed runner tree's root directory.
  */
+/**
+ * Rename the runner's shipped lockfile back to the name pnpm reads, so a pinned runner
+ * version pins the graph it RUNS rather than just its own source.
+ *
+ * npm strips `pnpm-lock.yaml` from published tarballs unconditionally (the same
+ * always-excluded list as package-lock.json / yarn.lock), so build-runner.mjs emits a
+ * second copy as `pnpm-lock.runner.yaml`, which survives the publish. Verified both
+ * directions: the published 2.0.33 tarball carries pnpm-workspace.yaml and no lock,
+ * and a packed 2.0.34 tree delivers only the alias.
+ *
+ * Why it matters: without the restore, every developer resolves their own graph. Runner
+ * 2.0.33 was built against vite 8.1.0 / rolldown 1.1.3 and installed as 8.2.2 / 1.2.8,
+ * where an .astro parse regression failed the dependency scan — and Vite answers a
+ * failed scan by skipping pre-bundling for the whole app rather than erroring, silently
+ * disabling the SSR prebundle the renderer's own config depends on. Pages still
+ * rendered, so nothing caught it.
+ *
+ * Never clobbers an existing `pnpm-lock.yaml`: the entitled .tar.gz path is a plain
+ * tarball rather than an npm publish, so it already carries the real name.
+ * @param {string} dir the extracted runner tree
+ * @returns {boolean} whether a lock was restored
+ */
+export function restoreShippedLock(dir) {
+  const alias = join(dir, "pnpm-lock.runner.yaml");
+  const real = join(dir, "pnpm-lock.yaml");
+  if (!existsSync(alias) || existsSync(real)) return false;
+  renameSync(alias, real);
+  return true;
+}
+
 export async function installRunnerTarball(
   { source, version, isUrl = true, strip = 0, integrity = null },
   { log = (m) => console.error(m), cacheRoot = RENDERER_CACHE_ROOT } = {},
@@ -1137,6 +1167,8 @@ export async function installRunnerTarball(
         /** @type {any} */ (err).permanent = true;
         throw err;
       }
+      // Must run BEFORE the install, or it has no effect at all.
+      restoreShippedLock(stagingDir);
       // Pin the runner install to PUBLIC npm. The moat-free runner has only public
       // deps, but the HOST's global ~/.npmrc may point `registry` at a private
       // mirror (an internal proxy that 502s, or one an invited developer can't