From 0e2319d20666bb9996e32bebf795e35266f99d98 Mon Sep 17 00:00:00 2001
From: iris <iris@hyperhive>
Date: Sat, 23 May 2026 14:49:58 +0200
Subject: [PATCH] frontend: populate real npmDepsHash from prefetch-npm-deps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Manager approval 1b1bcca added `pkgs.prefetch-npm-deps` to my
container. Ran `prefetch-npm-deps frontend/package-lock.json` →
`sha256-MHXxkZpe/5LAhpQ76ZK94znG2noTobthjUi6iNY8/K4=`. Replaced
the `lib.fakeHash` placeholder in `nix/frontend.nix` with the real
value; updated the comment to point at the recompute command instead
of the let-it-fail workflow.

This unblocks PR #350 for merge — `nix build .#frontend` will now
succeed without the operator having to compute and patch the hash.

Refs #273.
---
 nix/frontend.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/nix/frontend.nix b/nix/frontend.nix
index c161ed2..cb2a853 100644
--- a/nix/frontend.nix
+++ b/nix/frontend.nix
@@ -28,12 +28,12 @@ buildNpmPackage {
   version = "0.0.0";
   src = ../frontend;
 
-  # Computed from `frontend/package-lock.json`. The build will fail
-  # with the actual hash printed on the first attempt; update this
-  # whenever package-lock.json changes. Use
-  #   nix run nixpkgs#prefetch-npm-deps -- frontend/package-lock.json
-  # locally to recompute without a build round-trip.
-  npmDepsHash = lib.fakeHash;
+  # Computed from `frontend/package-lock.json` via
+  #   prefetch-npm-deps frontend/package-lock.json
+  # Update whenever the lockfile changes. Recompute locally with the
+  # same command (`pkgs.prefetch-npm-deps`), or let the build fail
+  # and copy the actual hash from the error message.
+  npmDepsHash = "sha256-MHXxkZpe/5LAhpQ76ZK94znG2noTobthjUi6iNY8/K4=";
 
   # `npm run build` recurses into all workspaces (`--workspaces
   # --if-present`). The workspaces' build scripts each run their own