npm ci
npm test            # unit tests: URL parsing, pagination, retries, errors, vault crypto
npm run build       # → dist/, static files
npx playwright install chromium
npm run e2e         # self-test: the built site against a mock Dynatrace (mock/), 26 scenarios
node scripts/screenshot.mjs   # docs/thumb.png and docs/demo.gif from a real run (mock data)
DT_DEMO_TOKEN=… node scripts/screenshot.mjs           # the same, on the Dynatrace Playground
DT_URL=abc12345 DT_TOKEN=… node scripts/smoke-live.mjs # every page against a real tenant

Both live scripts only read: every request that would change something is blocked before it leaves the browser.

The hosted site's "Try it live" uses a read-only Playground token stored as the DMM_PLAYGROUND_TOKEN repository secret and injected only into the GitHub Pages build (VITE_PLAYGROUND_TOKEN). When the Playground is reset, create a new read-only token there, update the secret, and re-run the workflow on main.

npm run mock starts the mock on http://localhost:8787/e/production (also staging, development; token dt0c01.MOCK…). All its data is invented.

Every push runs the tests on Linux, Windows and macOS and the end-to-end self-test. A push to main then deploys GitHub Pages; a tag v* attaches the zipped site with its .sha256 to the GitHub release. The version lives only in package.json.