feat: make the nix package locked for the wasm

flake.nix

@@ -15,25 +15,73 @@
             extensions = [ "rust-src" ];
             targets = [ "wasm32-unknown-unknown" ];
           });
-        website = pkgs.stdenv.mkDerivation {
+
+        # Stage 1: Build the WASM crate (FOD — network allowed, output content-addressed)
+        cgol-wasm = pkgs.stdenv.mkDerivation {
+          pname = "cgol-wasm";
+          version = "0.1.0";
+          src = ./cgol;
+
+          nativeBuildInputs = [ rustToolchain pkgs.wasm-pack pkgs.binaryen pkgs.cacert ];
+
+          buildPhase = ''
+            export HOME=$TMPDIR
+            export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+            wasm-pack build --release --target web
+            wasm-opt pkg/cgol_bg.wasm -o pkg/cgol_bg.wasm -O4 \
+              --enable-bulk-memory --enable-nontrapping-float-to-int \
+              --enable-sign-ext --low-memory-unused --converge
+          '';
+
+          installPhase = ''
+            mkdir -p $out
+            cp pkg/cgol_bg.wasm $out/
+            cp pkg/cgol.js $out/
+            cp pkg/cgol.d.ts $out/
+            cp pkg/cgol_bg.wasm.d.ts $out/ 2>/dev/null || true
+            cat > $out/package.json <<'EOF'
+            {
+              "name": "cgol",
+              "type": "module",
+              "version": "0.1.0",
+              "files": ["cgol_bg.wasm", "cgol.js", "cgol.d.ts"],
+              "main": "cgol.js",
+              "types": "cgol.d.ts",
+              "sideEffects": ["./snippets/*"]
+            }
+            EOF
+          '';
+
+          outputHashAlgo = "sha256";
+          outputHashMode = "recursive";
+          outputHash = "sha256-WWAks6h5xq/+neppEtn32FhDq/WRy5CsMXtDTYaOFvA=";
+        };
+
+        # Stage 2: Build the website with npm
+        website = pkgs.buildNpmPackage {
           pname = "jet-website";
           version = "0.1.0";
           src = pkgs.lib.cleanSource ./.;
-          nativeBuildInputs = [ pkgs.nodejs rustToolchain pkgs.wasm-pack pkgs.binaryen pkgs.pkg-config ];
-          buildPhase = ''
-            export HOME=$TMPDIR
-            cd cgol && wasm-pack build --release --target web && cd ..
-            wasm-opt cgol/pkg/cgol_bg.wasm -o cgol/pkg/cgol_bg.wasm -O4 --enable-bulk-memory --enable-nontrapping-float-to-int --enable-sign-ext --low-memory-unused --converge
-            npm ci
-            npm run build
+          npmDepsHash = "sha256-040ZUXj0k4RauBpCtwQ4A2/3CrhdAUIOaejwmPqwtLA=";
+
+          # Inject the Nix-built WASM before npm install resolves file: dep
+          postPatch = ''
+            mkdir -p cgol/pkg
+            cp -r ${cgol-wasm}/* cgol/pkg/
           '';
+
           installPhase = ''
+            runHook preInstall
             mkdir -p $out
             cp -r dist/* $out/
+            runHook postInstall
           '';
         };
       in {
-        packages = { default = website; };
+        packages = {
+          default = website;
+          cgol-wasm = cgol-wasm;
+        };
         devShells.default = pkgs.mkShell {
           buildInputs = with pkgs; [
             nodejs git curl typescript-language-server