Single-file project artifact

This whole page is one file at static/spa/example-single/index.html, served at /spa/example-single/. Its styles and its script are inline, and both are allowed by the production policy through a SHA-256 hash the build computed from these exact bytes.

Nothing here is fetched from another origin, nothing calls eval, and no element carries an onclick attribute: the click is wired with addEventListener. Those are the rules the build-time guard enforces, and an artifact that breaks one of them fails the build instead of failing in a visitor's browser.