mirror of
https://github.com/tiennm99/loto.git
synced 2026-05-20 22:24:04 +00:00
tiennm99
7c893aa3b5
Postbuild script computes SHA-256 of every inline <script> in build/index.html and rewrites build/_headers — replacing the script-src 'unsafe-inline' relaxation with the matching hashes. The hash regenerates per build (SvelteKit bootstrap embeds a per-build registration call) so the script must run on every build; chain it into both `npm run build` and `build:gh`. verify-build extended to assert build/_headers script-src no longer contains 'unsafe-inline', so the inject step's output is enforced in CI. style-src 'unsafe-inline' stays — Svelte's `style:` directives emit inline attributes that hashes can't cover.
42 lines
1.1 KiB
JSON
42 lines
1.1 KiB
JSON
{
|
|
"name": "loto",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite dev",
|
|
"dev:codeserver": "VITE_DEV_PROFILE=codeserver vite dev --host 0.0.0.0",
|
|
"build": "vite build && node scripts/inject-csp-hashes.mjs",
|
|
"build:gh": "BUILD_PROFILE=gh vite build && node scripts/inject-csp-hashes.mjs",
|
|
"preview": "vite preview",
|
|
"lint": "eslint .",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"verify:build": "node scripts/verify-build-inline-scripts.mjs"
|
|
},
|
|
"optionalDependencies": {
|
|
"lightningcss-linux-x64-gnu": "1.32.0"
|
|
},
|
|
"overrides": {
|
|
"serialize-javascript": "^7.0.5",
|
|
"cookie": "^0.7.2"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9",
|
|
"@fontsource/roboto-condensed": "^5.2.8",
|
|
"@sveltejs/adapter-static": "^3",
|
|
"@sveltejs/kit": "^2",
|
|
"@sveltejs/vite-plugin-svelte": "^6",
|
|
"@tailwindcss/vite": "^4",
|
|
"@vite-pwa/sveltekit": "^1.1.0",
|
|
"eslint": "^9",
|
|
"eslint-plugin-svelte": "^2",
|
|
"globals": "^15",
|
|
"happy-dom": "20.9.0",
|
|
"svelte": "^5",
|
|
"tailwindcss": "^4",
|
|
"vite": "^7",
|
|
"vitest": "4.1.5"
|
|
}
|
|
}
|