Npm fod build

[mulatta]

Summary

• Add Nix packaging using buildNpmPackage with platform-independent npmDepsHash
• Support CUDA/Vulkan GPU acceleration
• Add CI workflow with fail-fast validation
• Add update-lockfile.sh script using prefetch-npm-deps

Test plan

• CPU-only build (vulkanSupport = false)
• Vulkan build (Linux default)
• CUDA build (cudaSupport = true)
• Runtime tests (qmd --help, qmd status)
• update-lockfile.sh idempotency test
• CI workflow validation on GitHub

---

Things done

GPU options in packages

In src/llm.ts:494 getLlama(), node-llama-cpp automatically choose backend. So i set vulkanSupport = true by default in linux (nixos).

node-llama-cpp auto-selects: CUDA > Vulkan > Metal > CPU

npmDepsHash

Bun downloads platform-specific binaries, causing hash variance. npmDepsHash includes only
pure JS dependencies.
see: PR #55

patch for node-llama-cpp

nix/node-llama-cpp-detectGlibc.patch:

node-llama-cpp checks FHS paths (/lib/x86_64-linux-gnu/libc.so.6) to detect glibc. NixOS doesn't use FHS, so the check fails and triggers musl build. This patch assumes glibc exists on Linux.
see: numtide/llm-agents.nix#2180

CI

• Fail-fast: Build only runs after checks pass
• No nix flake check: nix build already runs installCheckPhase

Dependency Updates

When package.json changes:

.github/actions/update-lockfile.sh

This script:

1. Generates package-lock.json via npm install --package-lock-only
2. Removes win32 optional dependency
3. Computes hash via prefetch-npm-deps (no failing build required)
4. Updates nix/package.nix if hash changed

CI validates lockfile sync but does not auto-update.