chore: COD-28 harden dependencies and public assets

test/frontend-public-tooling.test.ts

@@ -0,0 +1,31 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { describe, expect, it } from 'vitest';
+
+const repoRoot = resolve(import.meta.dirname, '..');
+
+describe('frontend public asset tooling', () => {
+  it('exposes a public asset check script', () => {
+    const pkg = JSON.parse(readFileSync(resolve(repoRoot, 'package.json'), 'utf8')) as {
+      scripts?: Record<string, string>;
+    };
+
+    expect(pkg.scripts?.['check:public-assets']).toContain('scripts/check-public-assets.mjs');
+  });
+
+  it('keeps app.js free of literal NUL bytes', () => {
+    const appJs = readFileSync(resolve(repoRoot, 'src/web/public/app.js'));
+
+    expect(appJs.includes(0)).toBe(false);
+  });
+
+  it('runs the public asset check script', () => {
+    expect(() => {
+      execFileSync('npm', ['run', 'check:public-assets', '--silent'], {
+        cwd: repoRoot,
+        stdio: 'pipe',
+      });
+    }).not.toThrow();
+  });
+});