@outloud/bundler

Vendor installed scoped packages into tarballs so pnpm projects can build without registry access in production CI or Docker.

pnpm add -D @outloud/bundler
pnpm bundler --prefix=@outloud
pnpm install

The first pnpm install still needs registry access. After bundling, commit the generated tarballs and lockfile changes.

CLI

bundler --prefix=@outloud [--packages-dir=packages] [--cwd=.]

Flags:

• --prefix: required package scope or prefix. Repeat it to bundle multiple scopes.
• --packages-dir: output directory for .tgz files. Defaults to packages.
• --cwd: project root. Defaults to the current working directory.
• --dry-run: discover and print planned actions without writing.
• --no-write: pack tarballs, but print config changes instead of editing files.

What It Does

1. Scans node_modules for installed packages matching the requested prefix.
2. Supports pnpm's hoisted layout and .pnpm/@scope+name@*/node_modules/@scope/name layout.
3. Runs npm pack inside each package directory.
4. Writes stable tarballs such as packages/@outloud_vue-3.2.32.tgz.
5. Updates direct root dependencies and devDependencies to file: tarballs.
6. Writes pnpm-workspace.yaml overrides for every discovered package, including transitives.

Important Notes

Bundled tarballs still contain their own dependency ranges. If a bundled package depends on another private package, pnpm would normally resolve it from the registry. The generated overrides block forces those dependencies to use committed tarballs instead.

Optional peer dependencies are not installed automatically from file: tarballs. Bundler reads each package's peerDependencies and peerDependenciesMeta and warns when optional peers are missing from the root project.

Docker builds should copy packages/ before installing:

COPY package.json pnpm-*.yaml ./
COPY packages ./packages
RUN pnpm install --loglevel error --prefer-offline

Do not copy .npmrc or registry tokens into production images.