# Step Away Pack Manager v2.1

## What changed

The app no longer needs direct browser access to `data/cards.json`. Public launch content is served through `api.php?endpoint=content`, so the protected `/data` folder can stay private while the app still loads correctly.

## Adding new content

You do not regenerate the app for normal case content. Create a self-contained JSON pack, upload it through `admin.php`, validate it, then import it.

A self-contained pack can contain:

- `cases`: full case objects
- `campaigns`: optional campaign objects
- `wrinkles`: optional hard/easy wrinkle objects
- `settings`: optional settings merge

Template: `content/pack_templates/self-contained-case-pack-template.json`

## Deployment check

Make sure PHP is enabled and these paths are writable:

- `data/community.json`
- `data/global-log.json`
- `data/profiles.json`
- `data/submissions.json`
- `data/share-index.json`
- `data/installed-packs.json`
- `data/saves/`
- `content/packs/` if you want admin uploads

## Security note

`data/.htaccess` denies direct JSON reads. Public app content is whitelisted through `api.php?endpoint=content`.
