Files
marketplaces/package.json
sdarbinyan 6e47d01c32 ci: ratchet the bundle budget and scan builds for credentials (FH-3.3, FH-3.5)
Bundle budget was warning-only: initial warning 700 kB, error 1.8 MB.
Measured today the initial bundle is 1.55 MB raw / 324.58 kB transfer -
up from the 1.15 MB measured on 11 August, so it had been growing with
nothing to stop it.

Lowers maximumError to 1.6 MB. That is a ratchet, not a target: just
above today's size so the bundle cannot grow, with the 700 kB warning
left in place as the goal. Lower it each time the number comes down.

Adds scripts/ci/scan-bundle.sh (npm run scan:bundle), run in CI after
the build. Seven patterns: both provider auth headers, the partner ID
shape, client_secret, private key blocks, AWS keys, Telegram bot
tokens. The legacy payment code that put credentials in the browser is
already deleted; this is what stops it coming back. Verified in both
directions - clean against the real dist, exit 1 against a planted
credential.

Measurement also corrected two assumptions recorded in the harvest
TODO: admin and editor code is already lazy-loaded, so the initial
bundle is main alone rather than a deployable-split problem; and mock
gateway fixtures do reach production chunks, which is now filed as
FH-E.6 with the cause identified.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-21 10:36:37 +04:00

61 lines
2.3 KiB
JSON

{
"name": "dexarmarket",
"version": "0.0.0",
"scripts": {
"ng": "ng",
"start": "ng serve",
"dexar": "ng serve --configuration=development --port 4200",
"start:dexar": "ng serve --configuration=development --port 4200",
"build": "ng build",
"build:dexar": "ng build --configuration=production",
"test": "ng test --watch=false --browsers=ChromeHeadlessNoSandbox",
"test:coverage": "ng test --watch=false --browsers=ChromeHeadlessNoSandbox --code-coverage",
"watch": "ng build --watch --configuration development",
"arch:check:boundaries": "node tools/architecture/check-boundaries.mjs",
"arch:check:cycles": "npx --yes madge --circular --extensions ts src/app --ts-config tsconfig.app.json",
"arch:check": "npm run arch:check:boundaries ; npm run arch:check:cycles",
"scan:bundle": "bash scripts/ci/scan-bundle.sh",
"barry": "barry-cache",
"barry:validate": "barry-cache validate",
"barry:resume": "barry-cache resume",
"barry:finalize": "barry-cache finalize",
"barry:failure": "barry-cache failure",
"e2e": "playwright test",
"e2e:ui": "playwright test --ui",
"e2e:report": "playwright show-report"
},
"private": true,
"dependencies": {
"@angular/animations": "22.0.8",
"@angular/cdk": "22.0.6",
"@angular/common": "22.0.8",
"@angular/compiler": "22.0.8",
"@angular/core": "22.0.8",
"@angular/forms": "22.0.8",
"@angular/platform-browser": "22.0.8",
"@angular/router": "22.0.8",
"@angular/service-worker": "22.0.8",
"@marketplaces/auth": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/auth",
"@marketplaces/payment": "git+https://sources.vitanova.network/sdarbinyan/vitanovaPackages.git#release/payment",
"rxjs": "~7.8.0",
"tslib": "^2.8.0",
"zone.js": "~0.16.0"
},
"devDependencies": {
"@angular/build": "22.0.8",
"@angular/cli": "22.0.8",
"@angular/compiler-cli": "22.0.8",
"@playwright/test": "^1.62.1",
"@types/jasmine": "~5.1.0",
"barry-cache": "^0.9.3",
"istanbul-lib-instrument": "^6.0.3",
"jasmine-core": "~5.5.0",
"karma": "~6.4.0",
"karma-chrome-launcher": "~3.2.0",
"karma-coverage": "^2.2.1",
"karma-jasmine": "~5.1.0",
"karma-jasmine-html-reporter": "~2.1.0",
"typescript": "~6.0.3"
}
}