The server is a placeholder for the one in docs/ARCHITECTURE.md — it serves public/ and a health endpoint, nothing more. Reads are confined to public/ by resolving the path and checking it stays inside the root; string-matching ".." is not enough, since encodings and URL normalisation both change what the string looks like and only the resolved path says which file would open. The image runs typecheck and tests during build, ships no source or toolchain, and runs unprivileged. CI's feed job fails if the event count collapses. A source that quietly stops yielding events is what a parser-only pipeline is most prone to, and nothing else would surface it. Everything is offline, so a red pipeline always means the code changed rather than a wiki being down. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
31 lines
1.1 KiB
JSON
31 lines
1.1 KiB
JSON
{
|
|
"name": "gacha-event-tracker",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"test": "bun test",
|
|
"typecheck": "tsc --noEmit",
|
|
"parse": "bun run scripts/parse-fixture.ts",
|
|
"build:feed": "bun run scripts/build-feed.ts",
|
|
"build:css": "bunx @tailwindcss/cli -i src/client/styles.css -o public/styles.css --minify",
|
|
"build:js": "bun build src/client/main.tsx --outfile public/main.js --minify",
|
|
"build": "bun run build:feed && bun run build:css && bun run build:js && bun run build:static",
|
|
"dev": "bun run build && bun run serve.ts",
|
|
"build:static": "cp index.html public/index.html && cp src/client/sw.js public/sw.js && cp src/client/manifest.webmanifest public/manifest.webmanifest && cp src/client/icon.svg public/icon.svg",
|
|
"serve": "bun run serve.ts"
|
|
},
|
|
"dependencies": {
|
|
"react": "^19.2.8",
|
|
"react-dom": "^19.2.8",
|
|
"zod": "^3.23.8"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/cli": "^4.3.3",
|
|
"@types/bun": "^1.1.10",
|
|
"@types/react": "^19.2.18",
|
|
"@types/react-dom": "^19.2.4",
|
|
"tailwindcss": "^4.3.3",
|
|
"typescript": "^5.6.3"
|
|
}
|
|
}
|