layero 0.8.1 → 0.8.2

package/dist/commands/deploy.js

@@ -196,6 +196,13 @@ async function packAndUpload(api, cwd, project, prebuiltDir) {
         sha256: pack.sha256,
         ...(prebuiltDir ? { prebuilt_dir: prebuiltDir } : {}),
     });
+    // A gitignored lockfile is force-included so the build can do a frozen
+    // install; warn (to stderr, off the --json stdout stream) that the ignore
+    // rule was overridden for it.
+    if (pack.forcedLockfiles?.length) {
+        process.stderr.write(chalk.yellow(`! including gitignored lockfile(s) so the build uses a frozen install: ` +
+            `${pack.forcedLockfiles.join(", ")}\n`));
+    }
     const init = await api.initUpload(project.id);
     emit({ event: "uploading" });
     await uploadArchive(init, pack.archivePath);

package/dist/pack.js

@@ -41,11 +41,26 @@ async function readIgnoreFile(filePath) {
         throw err;
     }
 }
+// Lockfiles the server needs for a frozen/reproducible install. A gitignored
+// (or .layeroignore'd) lockfile would otherwise be dropped from the upload →
+// the builder falls back to a non-frozen install (re-resolves deps). Force them
+// back in with negation patterns applied AFTER the ignore layers. They live at
+// repo root, so no ignored parent dir can block the re-include.
+const FORCE_INCLUDE_LOCKFILES = [
+    "bun.lockb",
+    "bun.lock",
+    "package-lock.json",
+    "yarn.lock",
+    "pnpm-lock.yaml",
+    "npm-shrinkwrap.json",
+];
 async function buildIgnore(cwd) {
     const ig = ignore();
     ig.add(DEFAULT_IGNORE);
     ig.add(await readIgnoreFile(path.join(cwd, ".gitignore")));
     ig.add(await readIgnoreFile(path.join(cwd, ".layeroignore")));
+    // Negations last so they win over any ignore rule above.
+    ig.add(FORCE_INCLUDE_LOCKFILES.map((f) => `!/${f}`));
     return ig;
 }
 async function walk(cwd, ig) {
@@ -80,6 +95,30 @@ async function sha256OfFile(p) {
     }
     return hash.digest("hex");
 }
+/** Lockfiles present on disk that WOULD have been dropped by the ignore rules
+ * if not force-included. Built from the same ignore layers minus the lockfile
+ * negations, so it reflects exactly what the user's .gitignore/.layeroignore
+ * would have excluded. */
+async function detectForcedLockfiles(cwd) {
+    const probe = ignore();
+    probe.add(DEFAULT_IGNORE);
+    probe.add(await readIgnoreFile(path.join(cwd, ".gitignore")));
+    probe.add(await readIgnoreFile(path.join(cwd, ".layeroignore")));
+    const forced = [];
+    for (const lf of FORCE_INCLUDE_LOCKFILES) {
+        if (!probe.ignores(lf))
+            continue; // not ignored → nothing forced
+        try {
+            const st = await fs.stat(path.join(cwd, lf));
+            if (st.isFile())
+                forced.push(lf);
+        }
+        catch {
+            // absent on disk — nothing to force-include
+        }
+    }
+    return forced;
+}
 /** Pack only the contents of an already-built artifact directory.
  *
  * Used by `layero deploy --prebuilt`. We deliberately bypass DEFAULT_IGNORE
@@ -139,6 +178,7 @@ export async function packCwd(cwd, projectName) {
         throw new Error("no files to upload after applying .gitignore/.layeroignore — " +
             "check that you're in the right directory");
     }
+    const forcedLockfiles = await detectForcedLockfiles(cwd);
     const stamp = Date.now();
     const safeName = projectName.replace(/[^a-zA-Z0-9._-]/g, "_");
     const archivePath = path.join(tmpdir(), `layero-${safeName}-${stamp}.tgz`);
@@ -159,5 +199,11 @@ export async function packCwd(cwd, projectName) {
             "Add large directories to .layeroignore.");
     }
     const sha256 = await sha256OfFile(archivePath);
-    return { archivePath, sha256, size: stat.size, fileCount: files.length };
+    return {
+        archivePath,
+        sha256,
+        size: stat.size,
+        fileCount: files.length,
+        ...(forcedLockfiles.length ? { forcedLockfiles } : {}),
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "layero",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Layero CLI — publish a local site with one command. No git, no GitHub, agent-friendly (Cursor, Claude Code).",
   "license": "MIT",
   "type": "module",