Introduce components.lock file to track the versions of installed components and simplify upgrading with local changes

[MurzNN]

For now, using the command npx shadcn@latest add [componentName], we just download the latest version of the component files, and later have no information at all about which exact version of the component was installed some time ago.

This brings problems with checking for updates to understand which components are fresh and which are outdated.

There is another topic about the update issues #790, and it seems all we can do for now is just launch the add command again and watch what files were changed, and overwrite them.

But the big issue here is when we change something in the component (just one line), and want to port these changes to the new version: Shadcn just overwrites all your local changes, and all your changes just disappear! And it's not easy at all to understand what exactly you changed before, because there is no diff is possible with the previously installed verson, because that information is not stored anywhere.

A good solution for this issue will be introducing a lock file (components.lock or components.installed.lock) that will just track which exact version of each component was installed. Having this, we can significantly simplify checking what was changed locally after the installation in each component (by running a command like "shadcn diff"), and port these changes to the new version (maybe even automatically, if there are no conflicts with the changes).

Also, we will be able to check for outdated components to understand what can be upgraded.

What do you think about this idea?

[MurzNN]

A good example of the lock file approach for files, that are downloaded to the project, is the skills.sh project: after executing npx skills add <owner/repo> it creates a file skills-lock.json with content like this:

{
  "version": 1,
  "skills": {
    "buzzform": {
      "source": "buildnbuzz/buzzform",
      "sourceType": "github",
      "computedHash": "24705df6c03933a40435209cbc0b03834f2f2d051015ae6640ae28338e538c58"
    },
    "payload": {
      "source": "payloadcms/skills",
      "sourceType": "github",
      "computedHash": "868c518cec5efe3862accee8ef3751b72fac06d7e12a27c263dc17320f27b20c"
    },
    "shadcn": {
      "source": "shadcn/ui",
      "sourceType": "github",
      "computedHash": "873c67922d80775a9fdf596db7964b579f0408c30ec6e3d11989f6055bbec89f"
    }
  }
}

And provides the action npx skills update that updates them.

Can we do the same?

[MurzNN]

One more improvement when we get the lock file: we can make updates automatic without questions "The file COMPONENT.tsx already exists. Would you like to overwrite? › (y/N)" if nothing has changed in this file since the last update.