castle-web-cli 0.4.40 → 0.4.41

package/dist/init.js

@@ -223,12 +223,15 @@ function hasPnpm() {
 // store is baked in, so this is near-instant (hardlinks from the store, no
 // download). Fall back to npm when pnpm isn't on PATH (e.g. a laptop that never
 // installed it). --prefer-offline uses the store/cache first; --ignore-scripts
-// skips dep build scripts (pnpm 10 gates them and exits non-zero otherwise, and
-// the deck's deps are all prebuilt pure JS that don't need them).
-function installDeps(projectDir) {
+// skips dep build scripts (pnpm 10+ gates them and exits non-zero otherwise,
+// and the deck's deps are all prebuilt pure JS that don't need them). `frozen`
+// installs straight from the shipped lockfile (skips resolution -> no network,
+// fast + deterministic); used in published mode where the kit lockfile matches.
+function installDeps(projectDir, frozen) {
     if (hasPnpm()) {
         console.log('Installing deps (pnpm)...');
-        execSync('pnpm install --prefer-offline --ignore-scripts', {
+        const frozenFlag = frozen ? '--frozen-lockfile ' : '';
+        execSync(`pnpm install ${frozenFlag}--prefer-offline --ignore-scripts`, {
             cwd: projectDir,
             stdio: 'inherit',
         });
@@ -259,10 +262,20 @@ export async function init(dir, opts = {}) {
     // Always install deps so the deck is ready to serve/edit immediately.
     // `--no-serve` only skips the serve step below (callers like the cloud
     // launcher run their own serve, but still want deps in place).
+    //
+    // Published kit decks ship a matching pnpm-lock.yaml -> frozen install (no
+    // resolution, no network; hardlinks from the template's warm store). Workspace
+    // decks rewrite the sdk to file:../../sdk, which the shipped (published)
+    // lockfile won't match -> drop it and let pnpm resolve. Bare decks have no
+    // lockfile -> non-frozen.
+    const lockPath = path.join(projectDir, 'pnpm-lock.yaml');
+    if (resolveScaffoldRefs().workspaceMode)
+        fs.rmSync(lockPath, { force: true });
+    const frozen = fs.existsSync(lockPath);
     console.log('');
     let installed = false;
     try {
-        installDeps(projectDir);
+        installDeps(projectDir, frozen);
         installed = true;
     }
     catch {