Kristian WindandClaude Opus 5
12a9597919
The interface for phase 1: sign-in and first-run setup, Today, Upcoming, project views, sharing, Cmd+K search and the keyboard shortcuts. Quick add highlights what the parser understood underneath the text as you type — a mirrored layer behind a transparent input, sliced by byte offset because the server counts bytes and JavaScript counts UTF-16 units, which disagree on exactly the Danish letters this app is full of. Every local action is optimistic and reconciled afterwards: ticking a task off strikes it through and animates it out before the request leaves, and rolls back with a message if the server disagrees. The Content-Security-Policy is computed at startup by hashing the inline scripts in the built index.html. Both of them change on every frontend build, so a hard-coded hash would go stale silently and show up only as a blank page in production. The alternative, 'unsafe-inline', would drop the one protection that makes an injected script in a task title inert. Today is derived from the store by date rather than from the ids that came back with the first request — filtering against a captured list meant a task added through quick add never appeared until a reload. Co-Authored-By: Claude Opus 5 <[email protected]>
20 lines
526 B
JavaScript
20 lines
526 B
JavaScript
import { sveltekit } from '@sveltejs/kit/vite';
|
|
|
|
export default {
|
|
plugins: [sveltekit()],
|
|
server: {
|
|
port: 5173,
|
|
// In development the app runs on 5173 and the API on 8080. Proxying rather
|
|
// than pointing fetch at another origin keeps the session cookie
|
|
// first-party, which is what production looks like — otherwise every
|
|
// cookie and CSRF behaviour would differ between dev and the real thing.
|
|
proxy: {
|
|
'/api': {
|
|
target: 'http://localhost:8080',
|
|
changeOrigin: false,
|
|
ws: true
|
|
}
|
|
}
|
|
}
|
|
};
|