Runtime

bundle lock

Write bundle.lock.json from the current delegation closure.

Synopsis

Shell

$ phrony bundles lock BUNDLE

Description

Walks the bundle closure starting at spec.root and writes bundle.lock.json beside the bundle manifest. This is the only command that writes the lock file.

Vendored-only bundles are fully offline. When the closure includes pinned external refs, the command resolves each external member's content_hash from the runtime catalog via GetAgentVersion. Set --runtime-addr or PHRONY_RUNTIME_ADDR to the environment whose catalog should author the lock.

Commit the generated lock in version control so PRs and CI can diff closure changes before publish. The lock records closure content only—it does not include or update metadata.version semver in bundle.yaml.

Lock also validates the secret union across closure members. If two members use the same secret name with different fromEnv values, lock fails with a message naming both members.

BUNDLE is the path to the kind: Bundle YAML file (for example support/bundle.yaml).

Example

Shell

$ phrony bundles lock ./support/bundle.yaml
$ phrony bundles lock ./support/bundle.yaml --runtime-addr 127.0.0.1:7777 # when closure has external refs

On success:

Text

locked: support/support sha256:…
members: 3 (root: orchestrator)

Up next

bundle validate

Verify the closure and compare against the committed lock.

Bundle spec

Lockfile fields and vendored vs external members.