discussion: rainix-managed npm deps via buildNpmPackage

[thedavidmeister]

Discussion

Long-term: have rainix expose a buildNpmPackage builder that takes a consumer's package.json + package-lock.json + an npmDepsHash and produces a nix-managed node_modules tree. Devshells, CI, and the pre-commit hooks all read from the same nix-built tree instead of from a separately-managed npm install output.

Why

• Hermetic builds: no npm install step in dev or CI; nix develop brings up a fully populated tree.
• Lockfile + hash become the single source of truth.
• Eliminates BIN-vs-deps version skew (the class of bug fixed by pre-commit prettier hook strips TypeScript enum bodies in Svelte files #117 / fix(prettier): use consumer's pinned prettier so plugin chain stays in sync #118).
• Cache-friendly: once the hash is pinned, every CI run reuses the same store path.

Cost

• Consumers must commit an npmDepsHash and re-pin it whenever package-lock.json changes.
• Native modules (esbuild, sharp, anything node-gyp) often need --ignore-scripts plus a post-install rebuild step. Per-consumer wrinkles likely on first setup.
• Documentation + a worked example (cyclofinance/cyclo.site or a fixture under test/fixture) needed before downstream uptake.

Out of scope for now

This is a tracking issue for future work. The immediate prettier-skew bug is solved by the much cheaper option in #117 / #118 (rainix-curated prettier bundle as the hook BIN). This issue is for the broader "nix owns all npm deps" direction.