From 2a67cc0e695408be976cd5a2b3d5269aac445fd4 Mon Sep 17 00:00:00 2001
From: iris <iris@hyperhive.local>
Date: Sun, 16 Aug 2026 15:18:53 +0200
Subject: [PATCH] nix: single-source frontend npmDepsHash into
 frontend/npm-deps-hash

The hash was hardcoded independently in nix/packages/frontend.nix,
nix/packages/swarm-ui.nix, and nix/checks.nix's inline
swarm-ui-typecheck derivation, all three building from the one
frontend/package-lock.json. Nothing enforced the three copies staying
in sync, and on a recent PR only some of them got updated when the
lockfile changed.

Moved the hash into a new file, frontend/npm-deps-hash (plain text, no
trailing newline, co-located with package-lock.json so it reads as
the lockfile's other half), and all three derivations now
builtins.readFile it instead of hardcoding their own copy. A lockfile
change now only needs prefetch-npm-deps + one file overwrite; the
other two derivations pick it up automatically.

Verified: nix eval against all three derivations' npmDepsHash
attribute (eval-only, not a build) confirms all three resolve to the
same value read from the one file.
---
 frontend/npm-deps-hash    |  1 +
 nix/checks.nix            | 10 ++++++----
 nix/packages/frontend.nix | 15 +++++++++------
 nix/packages/swarm-ui.nix | 17 +++++++++--------
 4 files changed, 25 insertions(+), 18 deletions(-)
 create mode 100644 frontend/npm-deps-hash

diff --git a/frontend/npm-deps-hash b/frontend/npm-deps-hash
new file mode 100644
index 00000000..fcb93e72
--- /dev/null
+++ b/frontend/npm-deps-hash
@@ -0,0 +1 @@
+sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=
\ No newline at end of file
diff --git a/nix/checks.nix b/nix/checks.nix
index ee4ca537..c5d461f8 100644
--- a/nix/checks.nix
+++ b/nix/checks.nix
@@ -149,10 +149,12 @@ in
     version = "0.0.0";
     src = ../frontend;
 
-    # Same lockfile as `frontend`/`swarm-ui` above — recompute in
-    # lockstep with those two whenever `frontend/package-lock.json`
-    # changes (`prefetch-npm-deps frontend/package-lock.json`).
-    npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
+    # Same lockfile as `frontend`/`swarm-ui` above — reads the same
+    # `frontend/npm-deps-hash` file both of those do, so this stays in
+    # lockstep automatically. Regenerate that file with
+    # `prefetch-npm-deps frontend/package-lock.json` when the lockfile
+    # changes.
+    npmDepsHash = builtins.readFile ../frontend/npm-deps-hash;
 
     buildPhase = ''
       runHook preBuild
diff --git a/nix/packages/frontend.nix b/nix/packages/frontend.nix
index e97c24f0..406065bd 100644
--- a/nix/packages/frontend.nix
+++ b/nix/packages/frontend.nix
@@ -35,12 +35,15 @@ buildNpmPackage {
   version = "0.0.0";
   src = ../../frontend;
 
-  # Computed from `frontend/package-lock.json` via
-  #   prefetch-npm-deps frontend/package-lock.json
-  # Update whenever the lockfile changes. Recompute locally with the
-  # same command (`pkgs.prefetch-npm-deps`), or let the build fail
-  # and copy the actual hash from the error message.
-  npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
+  # Read from `../../frontend/npm-deps-hash`, the single source of
+  # truth `./swarm-ui.nix` and `../checks.nix`'s `swarm-ui-typecheck`
+  # also read — all three build from the one `frontend/package-lock.json`,
+  # so one file keeps them from drifting independently (this used to be
+  # a hardcoded copy per derivation, and only some of the three got
+  # updated the one time the lockfile changed). Regenerate with
+  # `prefetch-npm-deps frontend/package-lock.json` and overwrite the
+  # file whenever the lockfile changes.
+  npmDepsHash = builtins.readFile ../../frontend/npm-deps-hash;
 
   # `npm run build` recurses into all workspaces (`--workspaces
   # --if-present`). The workspaces' build scripts each run their own
diff --git a/nix/packages/swarm-ui.nix b/nix/packages/swarm-ui.nix
index 3d2c0d23..bf9ade44 100644
--- a/nix/packages/swarm-ui.nix
+++ b/nix/packages/swarm-ui.nix
@@ -19,10 +19,12 @@
 # against authelia is figured out) has something to point at.
 #
 # Shares `frontend/package-lock.json` with `./frontend.nix` (same repo,
-# same npm workspace root) — `npmDepsHash` must be updated in lockstep
-# with that file's whenever the lockfile changes, since both hash the
-# same file. Scoped to build only the `swarm-ui` workspace (not the
-# whole `npm run build --workspaces` frontend.nix runs) via an explicit
+# same npm workspace root) — `npmDepsHash` is read from
+# `../../frontend/npm-deps-hash`, the same file `./frontend.nix` and
+# `../checks.nix`'s `swarm-ui-typecheck` read, so all three stay in
+# lockstep automatically instead of needing 3 separate hand-edits.
+# Scoped to build only the `swarm-ui` workspace (not the whole
+# `npm run build --workspaces` frontend.nix runs) via an explicit
 # `npm run build --workspace=…` buildPhase, so a dashboard/agent-only
 # change doesn't need to rebuild (or re-review the output of) this
 # derivation.
@@ -32,10 +34,9 @@ buildNpmPackage {
   version = "0.0.0";
   src = ../../frontend;
 
-  # Recompute with `prefetch-npm-deps frontend/package-lock.json`
-  # whenever the lockfile changes — same value as `./frontend.nix`'s
-  # `npmDepsHash`, both hash the one shared lockfile.
-  npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
+  # See `./frontend.nix`'s comment on the same line — one shared file,
+  # regenerate with `prefetch-npm-deps frontend/package-lock.json`.
+  npmDepsHash = builtins.readFile ../../frontend/npm-deps-hash;
 
   buildPhase = ''
     runHook preBuild