Lucas WintherandClaude Opus 5.5
0da35ec6f8
The proxy, its internal server, Unix socket and NO_PROXY changes are gone; main.ts serves the HTML import directly again. apps/web/index.html carries the SPA policy as <meta http-equiv=CSP> ahead of every script (script-src 'self' plus the hash of Bun's dev-server helper, no unsafe-inline/eval; no frame-ancestors, which meta cannot carry). Dev HMR connects under it. The runner frame keeps its header CSP. Tests: the served index.html (prod and dev, in a subprocess) has the meta policy and every inline script is hash-covered; the XSS browser test fails with the sanitizer disabled and passes with it, and the meta CSP alone blocks unsanitized handlers (with a no-CSP control); no source assigns proxy env vars, and the feature leaves them untouched at runtime. Contract request 5 asks core for frame-ancestors/X-Frame-Options. Co-Authored-By: Claude Opus 5.5 <[email protected]>
8 lines
359 B
TypeScript
8 lines
359 B
TypeScript
// Server
|
|
export { migrationsDirs, runMigrations } from "./server/migrate";
|
|
export { learnerFeature } from "./server/feature";
|
|
// Browser (also available without the server half as "@stc/feature-learner/web")
|
|
export { learnerWeb, LessonView, type LessonViewProps, ensureLearnerStyles } from "./web";
|
|
// Shared JSON shapes
|
|
export type * from "./shared/types";
|