frontend/npm-deps-hash

@@ -1 +0,0 @@
-sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=

nix/checks.nix

@@ -149,8 +149,10 @@ in
     version = "0.0.0";
     src = ../frontend;
 
-    # See `nix/packages/frontend.nix`'s comment on the same line.
+    # Same lockfile as `frontend`/`swarm-ui` above — recompute in
-    npmDepsHash = builtins.readFile ../frontend/npm-deps-hash;
+    # lockstep with those two whenever `frontend/package-lock.json`
+    # changes (`prefetch-npm-deps frontend/package-lock.json`).
+    npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
 
     buildPhase = ''
       runHook preBuild

nix/packages/frontend.nix

@@ -35,15 +35,12 @@ buildNpmPackage {
   version = "0.0.0";
   src = ../../frontend;
 
-  # Read from `../../frontend/npm-deps-hash`, the single source of
+  # Computed from `frontend/package-lock.json` via
-  # truth `./swarm-ui.nix` and `../checks.nix`'s `swarm-ui-typecheck`
+  #   prefetch-npm-deps frontend/package-lock.json
-  # also read — all three build from the one `frontend/package-lock.json`,
+  # Update whenever the lockfile changes. Recompute locally with the
-  # so one file keeps them from drifting independently (this used to be
+  # same command (`pkgs.prefetch-npm-deps`), or let the build fail
-  # a hardcoded copy per derivation, and only some of the three got
+  # and copy the actual hash from the error message.
-  # updated the one time the lockfile changed). Regenerate with
+  npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
-  # `prefetch-npm-deps frontend/package-lock.json` and overwrite the
-  # file whenever the lockfile changes.
-  npmDepsHash = builtins.readFile ../../frontend/npm-deps-hash;
 
   # `npm run build` recurses into all workspaces (`--workspaces
   # --if-present`). The workspaces' build scripts each run their own

nix/packages/swarm-ui.nix

@@ -19,12 +19,10 @@
 # against authelia is figured out) has something to point at.
 #
 # Shares `frontend/package-lock.json` with `./frontend.nix` (same repo,
-# same npm workspace root) — `npmDepsHash` is read from
+# same npm workspace root) — `npmDepsHash` must be updated in lockstep
-# `../../frontend/npm-deps-hash`, the same file `./frontend.nix` and
+# with that file's whenever the lockfile changes, since both hash the
-# `../checks.nix`'s `swarm-ui-typecheck` read, so all three stay in
+# same file. Scoped to build only the `swarm-ui` workspace (not the
-# lockstep automatically instead of needing 3 separate hand-edits.
+# whole `npm run build --workspaces` frontend.nix runs) via an explicit
-# Scoped to build only the `swarm-ui` workspace (not the whole
-# `npm run build --workspaces` frontend.nix runs) via an explicit
 # `npm run build --workspace=…` buildPhase, so a dashboard/agent-only
 # change doesn't need to rebuild (or re-review the output of) this
 # derivation.
@@ -34,8 +32,10 @@ buildNpmPackage {
   version = "0.0.0";
   src = ../../frontend;
 
-  # See `./frontend.nix`'s comment on the same line.
+  # Recompute with `prefetch-npm-deps frontend/package-lock.json`
-  npmDepsHash = builtins.readFile ../../frontend/npm-deps-hash;
+  # whenever the lockfile changes — same value as `./frontend.nix`'s
+  # `npmDepsHash`, both hash the one shared lockfile.
+  npmDepsHash = "sha256-8mYI9b1nuQ8YNFkW/ezJwO5Qw6NJTDG+kspYozs/5cI=";
 
   buildPhase = ''
     runHook preBuild