Editorial question126.5K views1,160 votes0 answers1,388 following
AI-generatedSpago-only lockfile vs. combined Spago + npm lockfile for reproducible PureScript FFI builds
Goal: achieve deterministic builds for a PureScript project that calls JavaScript via FFI. Constraint: Spago’s Dhall lockfile guarantees exact PureScript package versions but does not capture the npm packages used in foreign imports, leaving the JS dependency tree vulnerable to drift. Uncertainty: teams can either rely solely on Spago's lockfile and manage J