perf(stackblitz): commit an npm lockfile so the demo stops re-resolving (#501)

A cold StackBlitz container spent ~6 minutes on `npm install`, almost all of
it in dependency resolution: with no lockfile npm fetches a packument per
package across ~500 transitive deps, which is why the terminal sat silent
for minutes before printing anything.

Commit `package-lock.json` and the install drops to **14 seconds** —
measured in a fresh WebContainer on this branch ("added 414 packages in
14s"). Nothing else in the repo reads the file: pnpm ignores it, CI still
runs `pnpm install --frozen-lockfile`, and local development is unchanged.
Also pass `--prefer-offline` so npm skips revalidating what it has.

The lockfile only helps while it matches package.json, and no other job
would notice drift, so CI now runs `scripts/check-stackblitz-lock.mjs`. It
compares the manifest against the lockfile's root entry rather than
diffing a regenerated lockfile, which would flap with the npm version.
Regeneration steps are in the script's header comment.

Re-verified in the same container: app boots, `sign-in/email` 200,
`get-session` 200, `jwks` 404 (OIDC still off, per #486).

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.github/workflows/ci.yml

@@ -34,6 +34,9 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Check the StackBlitz npm lockfile is in sync
+        run: node scripts/check-stackblitz-lock.mjs
+
       - name: Validate metadata (protocol/schema)
         run: pnpm run validate
 

.stackblitzrc

@@ -1,6 +1,6 @@
 {
   "installDependencies": false,
-  "startCommand": "npm install --omit=dev --omit=optional --no-audit --no-fund && npm run dev",
+  "startCommand": "npm install --omit=dev --omit=optional --prefer-offline --no-audit --no-fund && npm run dev",
   "env": {
     "OS_DATABASE_URL": ".objectstack/data/hotcrm.wasm.db",
     "OS_DATABASE_DRIVER": "sqlite-wasm",

README.md

@@ -21,7 +21,7 @@
 
 HotCRM is a complete, opinionated CRM built as the **first official application** on the [ObjectStack](https://cloud.objectos.app) marketplace. Install it into any ObjectStack environment in one click and get a working CRM in 30 seconds — or fork it as the canonical example of how to build your own marketplace app.
 
-> **Try it in your browser (no install):** click the StackBlitz badge above. It boots HotCRM in a WebContainer using `@objectstack/driver-sqlite-wasm` (sql.js) instead of `better-sqlite3`, which can't compile inside the WebContainer sandbox. `.stackblitzrc` sets `OS_DATABASE_DRIVER=sqlite-wasm` so the runtime picks the WASM driver automatically. The sandbox boots with `npm install --omit=dev --omit=optional` — WebContainers forbid `npm i -g`, and their bundled pnpm 8 can't read this repo's lockfile — so first load takes ~2 min while npm installs. It also sets `OS_OIDC_PROVIDER_ENABLED=false`: the OIDC provider signs tokens with Ed25519, which the WebContainer's WebCrypto can't generate, and the failure surfaced as a 500 on login. Sign in with `admin@objectos.ai` / `admin123`. Local development still uses pnpm 10 with every feature on.
+> **Try it in your browser (no install):** click the StackBlitz badge above. It boots HotCRM in a WebContainer using `@objectstack/driver-sqlite-wasm` (sql.js) instead of `better-sqlite3`, which can't compile inside the WebContainer sandbox. `.stackblitzrc` sets `OS_DATABASE_DRIVER=sqlite-wasm` so the runtime picks the WASM driver automatically. The sandbox boots with `npm install --omit=dev --omit=optional` — WebContainers forbid `npm i -g`, and their bundled pnpm 8 can't read this repo's lockfile. `package-lock.json` is committed for that install only (nothing else in the repo reads it): without it npm re-resolves ~500 packages on every cold container, which is the difference between a 15-second install and a six-minute one. It also sets `OS_OIDC_PROVIDER_ENABLED=false`: the OIDC provider signs tokens with Ed25519, which the WebContainer's WebCrypto can't generate, and the failure surfaced as a 500 on login. Sign in with `admin@objectos.ai` / `admin123`. Local development still uses pnpm 10 with every feature on.
 
 ---