fix(build): fingerprint workspace dependencies and the lockfile

The web app compiles its workspace dependencies from source, so a change in one
of them altered the bundle while the fingerprint stayed put and the freshness
check passed a stale bundle. A dependency resolution change does the same
without touching any tracked source, so the lockfile counts as an input too.

Author: elkaix

apps/pythinker-code/scripts/check-web-assets.mjs

@@ -47,7 +47,7 @@ async function assertWebAssetsCurrent() {
   const { hash, fileCount } = await computeWebInputHash();
   if (recorded.sourceHash !== hash) {
     throw new Error(
-      'The committed web bundle is stale: apps/pythinker-web has changed since ' +
+      'The committed web bundle is stale: a web build input has changed since ' +
         `it was built (bundle ${String(recorded.sourceHash).slice(0, 12)}, ` +
         `source ${hash.slice(0, 12)}; ${recorded.sourceFileCount} -> ${fileCount} files). ` +
         REBUILD,

apps/pythinker-code/scripts/web-bundle-manifest.mjs

@@ -9,8 +9,8 @@
 
 import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
-import { globSync, statSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
+import { existsSync, globSync, readFileSync, statSync } from 'node:fs';
+import { dirname, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const appRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
@@ -19,9 +19,9 @@ export const webRoot = resolve(repoRoot, 'apps/pythinker-web');
 export const bundleRoot = resolve(appRoot, 'dist-web');
 export const MANIFEST_NAME = '.web-bundle-manifest.json';
 
-// Everything the Vite build reads. `public/` is copied verbatim into the
-// bundle, and the configs decide how the source is compiled, so a change to
-// any of them makes the committed bundle stale.
+// Everything the Vite build reads out of a package. `public/` is copied
+// verbatim into the bundle, and the configs decide how the source is compiled,
+// so a change to any of them makes the committed bundle stale.
 const INPUT_GLOBS = [
   'src/**/*',
   'public/**/*',
@@ -31,15 +31,57 @@ const INPUT_GLOBS = [
   'package.json',
 ];
 
-/** Sorted list of build-input paths, relative to apps/pythinker-web. */
+// The web app compiles workspace dependencies from source (they publish
+// `./src/index.ts` directly), so their files are build inputs too. Hashing only
+// apps/pythinker-web would let a change in one of them alter the bundle while
+// the fingerprint stayed put. The lockfile is included because a dependency
+// resolution change alters the bundle without touching any tracked source.
+const EXTRA_INPUTS = ['pnpm-lock.yaml'];
+
+/** Workspace package roots the web app depends on, transitively. */
+function workspaceDependencyRoots() {
+  const roots = [];
+  const pending = [webRoot];
+  const seen = new Set([webRoot]);
+  while (pending.length > 0) {
+    const root = pending.pop();
+    let manifest;
+    try {
+      manifest = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8'));
+    } catch {
+      continue;
+    }
+    const deps = { ...manifest.dependencies, ...manifest.devDependencies };
+    for (const [name, range] of Object.entries(deps)) {
+      if (typeof range !== 'string' || !range.startsWith('workspace:')) continue;
+      const dir = name.replace(/^@[^/]+\//u, '');
+      for (const candidate of [resolve(repoRoot, 'packages', dir), resolve(repoRoot, 'apps', dir)]) {
+        if (seen.has(candidate) || !existsSync(resolve(candidate, 'package.json'))) continue;
+        seen.add(candidate);
+        roots.push(candidate);
+        pending.push(candidate);
+        break;
+      }
+    }
+  }
+  return roots.sort();
+}
+
+/** Sorted list of build-input paths, relative to the repo root. */
 export function webInputFiles() {
   const seen = new Set();
-  for (const pattern of INPUT_GLOBS) {
-    for (const file of globSync(pattern, { cwd: webRoot })) {
-      const normalized = file.split('\\').join('/');
-      if (statSync(resolve(webRoot, normalized)).isFile()) seen.add(normalized);
+  for (const root of [webRoot, ...workspaceDependencyRoots()]) {
+    for (const pattern of INPUT_GLOBS) {
+      for (const file of globSync(pattern, { cwd: root })) {
+        const full = resolve(root, file);
+        if (!statSync(full).isFile()) continue;
+        seen.add(relative(repoRoot, full).split('\\').join('/'));
+      }
     }
   }
+  for (const file of EXTRA_INPUTS) {
+    if (existsSync(resolve(repoRoot, file))) seen.add(file);
+  }
   return [...seen].sort();
 }
 
@@ -53,7 +95,7 @@ export async function computeWebInputHash() {
   for (const file of files) {
     digest.update(file);
     digest.update('\0');
-    digest.update(await readFile(resolve(webRoot, file)));
+    digest.update(await readFile(resolve(repoRoot, file)));
     digest.update('\0');
   }
   return { hash: digest.digest('hex'), fileCount: files.length };