# Utah Vehicle Health dashboard

This directory is a dependency-free static prototype. It uses semantic HTML,
CSS, vanilla ES modules, and inline SVG generated from approved aggregate JSON.
It has no database client, server credential, analytics SDK, or external CDN.

## Run locally from the repository root

```bash
node dashboard/server.mjs
```

Open `http://127.0.0.1:4173`. Do not open `index.html` directly with a `file:`
URL; browsers will block the JSON module requests. To use another port:

```bash
PORT=8080 node dashboard/server.mjs
```

Run the dependency-free contract checks with:

```bash
node --test dashboard/tests/contract.test.mjs
```

## Public-data boundary

The browser requires and validates these files beneath `public/data/`:

- `data_manifest.json`
- `overview_period_county.json`
- `age_risk_curve.json`
- `cohort_scorecard.json`
- `model_diagnostics.json`
- `coverage_quality.json`
- `filter_catalog.json`
- `sha256_manifest.json`

If any file is missing, malformed, has inconsistent publication flags, or
contains a denied identifier-like field, the dashboard shows an unavailable
state and no estimates. Regenerate assets with the repository's private local
pipeline; never hand-edit public JSON to bypass suppression.

The next-test estimator is intentionally disabled. It must remain disabled
until a separately reviewed and suppressed `prediction_lookup` contract is
approved. Do not add a connection from this site to `countydata`.

## Import into Bolt

The recommended publication boundary is a separate static Bolt project (and,
ideally, a separate deployment repository) containing only the contents of
`dashboard/`. Upload or copy this directory's contents so `index.html` is at the
new project root. There is no install or build step. If Bolt asks for a preview
command, use `node server.mjs` with `HOST=0.0.0.0`; Bolt supplies `PORT`.

Before publishing, confirm that `/public/data/data_manifest.json` resolves,
the development-preview banner remains visible, and the contract test passes.
The generated JSON bundle must also complete its privacy review.

Importing the whole source repository is a discouraged fallback because Bolt
would receive SQL, database tooling, and other files that are not needed by the
public site. If that has already happened, set the project/working root to
`dashboard`, never serve the repository root, and create a dashboard-only
project before production publication. Do not copy private `data/`,
`artifacts/`, `models/`, `.env`, or database tooling into the public project.

No publishing action is performed by this repository.