Add make add-dependency and make tidy (closes #45)

No entrypoint could change yarn.lock or go.mod: script/bootstrap
installs with --frozen-lockfile, so adding a package meant running
yarn by hand. make add-dependency PACKAGE=<name>@<version> shims to
the new script/add-dependency: yarn add --dev, then yarn install
--frozen-lockfile. make tidy shims to the new script/tidy, go mod
tidy in backend/; a Go module is added by importing it, or moved by
editing its require line, then make tidy. script/bootstrap is
unchanged.

Model: opus-5-5

Makefile

@@ -1,5 +1,5 @@
 .PHONY: bootstrap setup dev build test lint fmt fmt-check check \
-	frontend-check frontend-viewport-test docker hooks
+	add-dependency tidy frontend-check frontend-viewport-test docker hooks
 
 # Standard targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -34,6 +34,13 @@ fmt-check:
 check:
 	@script/check
 
+# make add-dependency PACKAGE=<name>@<version>
+add-dependency:
+	@script/add-dependency "$(PACKAGE)"
+
+tidy:
+	@script/tidy
+
 # The frontend tests and format check, for Dockerfile's frontend stage,
 # which has neither Go nor Docker. Use check everywhere else.
 frontend-check:

README.md

@@ -58,6 +58,13 @@ halves, so the root `make check` fails if either one is broken. We provide:
 - `script/fmt` — format all files (writes): prettier, then gofmt over `backend/`
 - `script/fmt-check` — check formatting (read-only): prettier, then gofmt
 - `script/check` — run test, lint, and fmt-check
+- `script/add-dependency` — add a frontend package, or move one to another
+  version: `make add-dependency PACKAGE=<name>@<version>` runs `yarn add --dev`,
+  which changes `package.json` and `yarn.lock` together, then
+  `yarn install --frozen-lockfile`
+- `script/tidy` — run `go mod tidy` in `backend/`: to add a Go module, import it
+  and run `make tidy`; to move one to another version, edit its `require` line
+  in `backend/go.mod`, then run `make tidy`
 - `script/frontend-test` — run the unit tests in `test/unit/` with Node's
   built-in test runner, through the `test` script in `package.json`, and if any
   fails, run them again listing every test, and fail; then the production build.

TODO.md

@@ -23,6 +23,14 @@ latest run passes.
 
 # Completed Steps
 
+- 2026-10-04: a dependency can be added without running yarn or go by hand
+  (issue #45): `make add-dependency PACKAGE=<name>@<version>` shims to the new
+  `script/add-dependency`, which runs `yarn add --dev`, so `package.json` and
+  `yarn.lock` change together, then `yarn install --frozen-lockfile`; the same
+  command moves a package to another version. `make tidy` shims to the new
+  `script/tidy`, which runs `go mod tidy` in `backend/`: a Go module is added by
+  importing it, or moved by editing its `require` line, then `make tidy`.
+  `script/bootstrap` still installs with `--frozen-lockfile`
 - 2026-10-04: `script/` and `Makefile` follow the org models (issue #28):
   `make dev` shims to the new `script/dev`, the Vite dev server, and the new
   `make build` to `script/build`, the frontend production build.

script/add-dependency

@@ -0,0 +1,21 @@
+#!/bin/sh
+# script/add-dependency: add a frontend package, or move one to another
+# version, with yarn add, which changes package.json and yarn.lock
+# together; then install from yarn.lock with --frozen-lockfile, as
+# script/bootstrap does, to show it installs as written. --dev because
+# every frontend package is used only at build time.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    if [ -z "${1:-}" ]; then
+        echo "usage: make add-dependency PACKAGE=<name>@<version>" >&2
+        exit 2
+    fi
+    cd "$ROOT"
+    yarn add --dev "$1"
+    yarn install --frozen-lockfile
+}
+
+main "$@"

script/tidy

@@ -0,0 +1,13 @@
+#!/bin/sh
+# script/tidy: run go mod tidy in backend/, which adds the modules the
+# Go sources import, drops those they no longer do, and updates go.sum.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT/backend"
+    go mod tidy
+}
+
+main "$@"