A CDN in front of the site caches /style.css for hours, so a redeploy served
new HTML with the old stylesheet. The Dockerfile now rewrites the link to
style.css?v=<hash> in the built image (source stays unversioned) and fails
the build if the rewrite does not apply.
49 tests run in headless Chrome via tests/run.sh: unit tests for the pure
modules plus integration tests that drive the real page in an iframe
(filtering, URL state, bag, limits, cross-tab sync, checkout, dialogs,
accessibility and overflow checks).
Strict Content-Security-Policy (the site has no inline script or style),
nosniff, referrer and permissions policies, no Server header, no-cache for
HTML and five-minute caching for unfingerprinted assets.
Split the 100-line script into catalog, cart, format, dom and main modules.
Money is integer cents, the bag is capped and sanitised and syncs across
tabs, and the view (category, sort) lives in the URL. Templates escape every
interpolation.
Rewrite the minified stylesheet as cascade layers on design tokens. Fixes
heading tracking that collapsed word gaps, a 2.6:1 focus ring on the hero,
1.3:1 control borders, misaligned cart quantities, uneven product cards and
undersized touch targets. Adds a favicon and a resolvable dialog label.
jzzliu