// Content Security Policy helpers. // // Authoritative: ADR 018, docs/foundation/csp-strategy.md. // // Design principles: // 1. The policy lives in one place (this module). proxy.ts consumes it // per-request so a fresh nonce is generated on every HTML response. // 2. `script-src` uses a per-request nonce + `'strict-dynamic'`. In // production that removes `'unsafe-inline'` and `'unsafe-eval'` from // scripts entirely. // 3. `style-src` keeps `'unsafe-inline'` because the app uses inline // `style={{...}}` attributes (e.g. tenant branding CSS variables in // `app/layout.tsx`). CSP nonces do not cover attribute-style // inline styles — only `