diff --git a/index.tsx b/index.tsx
index a4e14015..b340b597 100644
--- a/index.tsx
+++ b/index.tsx
@@ -49,6 +49,14 @@ import '@fontsource/noto-sans/greek-700.css';
import './index.css';
import './register-sw';
+// QNBS-v3: Disable Aurora on low-end hardware (≤4 logical CPUs) to prevent GPU/battery drain;
+// prefers-reduced-data handled in CSS. Moved out of an inline bodies in index.html that have no `src` attribute and non-empty content. */
+function inlineScriptContents(html: string): string[] {
+ const results: string[] = [];
+ for (const m of html.matchAll(/
]*)>([\s\S]*?)<\/script>/g)) {
+ const attrs = m[1] ?? '';
+ const body = m[2] ?? '';
+ if (!/\bsrc\s*=/.test(attrs) && body.trim().length > 0) {
+ results.push(body);
+ }
+ }
+ return results;
+}
+
+const namedCsps: readonly [name: string, csp: string][] = [
+ ['index.html (meta)', webCsp()],
+ ['vercel.json (header)', extractVercelHeaderValue(vercelJson, 'Content-Security-Policy')],
+ ['public/_headers (Cloudflare)', extractHeadersFileValue(headersFile, 'Content-Security-Policy')],
+ ['src-tauri/tauri.conf.json (Tauri WebView)', tauriCsp()],
+ ...nginxCsps().map((csp, i) => [`nginx.conf (block ${i + 1})`, csp] as [string, string]),
+];
+
+describe('CSP correctness — Layer B (functional directives, not cross-surface consistency)', () => {
+ it('nginx.conf has exactly 3 Content-Security-Policy add_header blocks', () => {
+ expect(nginxCsps()).toHaveLength(3);
+ });
+
+ it('covers all 5 deployment surfaces (4 header/meta files + 3 nginx blocks = 7 CSP strings)', () => {
+ expect(namedCsps).toHaveLength(7);
+ });
+
+ it.each(namedCsps)(
+ "%s: script-src contains 'wasm-unsafe-eval' (WebLLM/ONNX Runtime Web/Transformers.js/DuckDB-WASM/Whisper-STT/Kokoro-TTS)",
+ (_name, csp) => {
+ const tokens = directiveTokens(csp, 'script-src');
+ expect(tokens, 'script-src directive must exist').toBeDefined();
+ expect(tokens).toContain("'wasm-unsafe-eval'");
+ },
+ );
+
+ it.each(namedCsps)("%s: script-src does NOT contain 'unsafe-eval'", (_name, csp) => {
+ const tokens = directiveTokens(csp, 'script-src') ?? [];
+ expect(tokens).not.toContain("'unsafe-eval'");
+ });
+
+ it.each(namedCsps)("%s: script-src does NOT contain 'unsafe-inline'", (_name, csp) => {
+ const tokens = directiveTokens(csp, 'script-src') ?? [];
+ expect(tokens).not.toContain("'unsafe-inline'");
+ });
+
+ it.each(namedCsps)(
+ '%s: frame-src (or child-src) allows blob: (Binder/ManuscriptResearchSplit PDF-preview iframes)',
+ (_name, csp) => {
+ const tokens = directiveTokens(csp, 'frame-src') ?? directiveTokens(csp, 'child-src');
+ expect(tokens, 'frame-src or child-src directive must exist').toBeDefined();
+ expect(tokens).toContain('blob:');
+ },
+ );
+
+ it.each(namedCsps)(
+ '%s: worker-src allows blob: (regression guard — DuckDB/inference workers)',
+ (_name, csp) => {
+ expect(directiveTokens(csp, 'worker-src')).toContain('blob:');
+ },
+ );
+
+ it.each(namedCsps)('%s: img-src allows blob: (regression guard)', (_name, csp) => {
+ expect(directiveTokens(csp, 'img-src')).toContain('blob:');
+ });
+
+ it.each(namedCsps)("%s: object-src is 'none'", (_name, csp) => {
+ expect(directiveTokens(csp, 'object-src')).toEqual(["'none'"]);
+ });
+
+ it.each(namedCsps)("%s: base-uri is 'self'", (_name, csp) => {
+ expect(directiveTokens(csp, 'base-uri')).toEqual(["'self'"]);
+ });
+
+ it.each(namedCsps)(
+ "%s: frame-ancestors is 'none' (inert in the meta tag, effective as a header)",
+ (_name, csp) => {
+ expect(directiveTokens(csp, 'frame-ancestors')).toEqual(["'none'"]);
+ },
+ );
+});
+
+describe('CSP correctness — no ungehashtes (unhashed) inline bodies in index.html that have no `src` attribute and non-empty content. */
+/**
+ * All inline bodies in index.html that have no `src` attribute and non-empty
+ * content. Case-insensitive (`i` flag) — HTML tag names are case-insensitive per spec, and an
+ * uppercase `