Merge branch 'main' into fix/local-install-skips-new-dependencies

Starting the stack locally failed to build with four copies of

    error TS2307: Cannot find module '@simplewebauthn/server'

naming a package that is right there in package.json. That reads as a broken checkout rather than a missing install, which is why it costs more than it should.

The cause is one line in Install-IfMissing. It asked whether node_modules existed and returned early if it did, which is true for anyone who has ever run the script. So a branch that ADDS a dependency never installs it: the pull brings a new package.json and a new lockfile, the script says dependencies already installed, and the build then fails on an import the source is entirely right to make.

The passkeys work is what surfaced it, adding @simplewebauthn/server to the backend and @simplewebauthn/browser to the frontend, but nothing about it is specific to those. Any dependency added on any branch would have done the same, and the failure would have looked equally unrelated to its cause each time.

It now compares timestamps instead. npm writes node_modules/.package-lock.json describing exactly what it put there, so holding that against package-lock.json answers the question actually being asked: is what is installed what is currently asked for. A pull that changes dependencies makes the lockfile newer and this notices; a pull that does not leaves the check skipping the install exactly as before, which is the whole reason the check exists.

Both branches were exercised against the real working tree: stale before installing, up to date after.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/start-local.ps1

@@ -280,11 +280,36 @@ Reserved ranges: netsh interface ipv4 show excludedportrange protocol=tcp
 function Install-IfMissing {
     param([string]$Directory)
     $name = Split-Path -Leaf $Directory
-    if (Test-Path (Join-Path $Directory 'node_modules')) {
+
-        Write-Note "$name dependencies already installed"
+    # Whether node_modules matches the lockfile, not merely whether it exists.
-        return
+    #
+    # This used to ask only `Test-Path node_modules`, which meant a branch that
+    # ADDED a dependency never installed it for anyone who already had the
+    # directory — and almost everyone always does. The build then failed on
+    # "Cannot find module", naming a package that is right there in
+    # package.json, which reads as a broken checkout rather than a missing
+    # install. It cost an afternoon the first time #37 added @simplewebauthn.
+    #
+    # npm writes node_modules/.package-lock.json describing exactly what it put
+    # there, so comparing its timestamp against package-lock.json answers the
+    # real question: is what is installed what is currently asked for. A pull
+    # that changes dependencies makes the lockfile newer, and this notices.
+    $lockfile = Join-Path $Directory 'package-lock.json'
+    $installed = Join-Path $Directory 'node_modules/.package-lock.json'
+
+    if ((Test-Path $installed) -and (Test-Path $lockfile)) {
+        $lockTime = (Get-Item $lockfile).LastWriteTimeUtc
+        $installedTime = (Get-Item $installed).LastWriteTimeUtc
+        if ($installedTime -ge $lockTime) {
+            Write-Note "$name dependencies are up to date"
+            return
+        }
+        Write-Step "Installing $name dependencies (the lockfile has changed)"
     }
-    Write-Step "Installing $name dependencies"
+    else {
+        Write-Step "Installing $name dependencies"
+    }
+
     Push-Location $Directory
     try { Invoke-Checked { npm install } "$name npm install" } finally { Pop-Location }
 }