Switch from regenerating package-lock.json inside fetchNpmDeps
(which produced different bytes per platform, causing FOD hash
drift across @ofborg) to vendoring a committed lockfile copied
in via postPatch, mirroring eslint/i18next-cli/markdownlint-cli2.
Drop the npm pkg set/delete rewrite that promoted @ghui/keymap
from a workspace:* devDep to a file: runtime dep -- that
promotion was the sole reason regeneration was needed. Instead,
restore the workspace symlink after npm prune --omit=dev so
keymap remains importable at runtime.
Wire passthru.updateScript with --generate-lockfile so r-ryantm
can keep the vendored lockfile in sync on future version bumps.
The committed lockfile is byte-identical to what
nix-update --generate-lockfile reproduces (drift-gate verified).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
MP
45fa1fff16