Constant DEFAULT_CSP_POLICY_TEMPLATE 

pub const DEFAULT_CSP_POLICY_TEMPLATE: &str = "default-src 'self'; script-src 'self'{script_hashes}; style-src 'self'{style_hashes}; img-src 'self' https: data:; font-src 'self' https:; connect-src 'self'; frame-ancestors 'none'";

Content-Security-Policy template with {script_hashes} and {style_hashes} slots (spec B4, v0.0.47 plan §3 item 2.4).

render_policy_template expands each slot into zero or more space-prefixed 'sha256-…' source expressions. With both slots empty the rendered string is byte-identical to DEFAULT_CSP_POLICY, so pages without inline blocks fall back to exactly the global policy — the invariant is pinned by a unit test in this module.

This constant is the single template notion for the CSP plugin; a future [security.csp] template knob in ssg.toml overrides it by passing the configured string to render_policy_template — the rendering path already accepts an arbitrary template.

Examples

use ssg::csp::{
    render_policy_template, DEFAULT_CSP_POLICY, DEFAULT_CSP_POLICY_TEMPLATE,
};

assert!(DEFAULT_CSP_POLICY_TEMPLATE.contains("{script_hashes}"));
assert!(DEFAULT_CSP_POLICY_TEMPLATE.contains("{style_hashes}"));

// Both slots empty ⇒ byte-identical to the global policy.
let rendered =
    render_policy_template(DEFAULT_CSP_POLICY_TEMPLATE, &[], &[]);
assert_eq!(rendered, DEFAULT_CSP_POLICY);