// Shared CSP constants, kept dependency-free so both svelte.config.js (loaded by
// Node when Vite starts) and the vitest drift-guard test (jsdom env) can import
// it without pulling in adapter-node / esbuild.

// sha256 of the inline theme <script> in src/app.html, base64-encoded, wrapped
// for the CSP `script-src` allowlist. SvelteKit's kit.csp hash mode does not
// cover app.html template scripts, so this is pinned by hand. src/csp-theme-hash.test.ts
// recomputes it from app.html and fails if it drifts.
export const THEME_SCRIPT_HASH =
    "'sha256-qj6Oim9siqow/Su+v47sZHJeJci+M/RQwGXn53eSULQ='";