Browser-local exact-byte planning

Import Map CSP Hash Planner

Compute SHA-256 CSP sources for inline import maps without sending final HTML, import-map text, or policy anywhere.

Hash final bytes, then re-run after every build change

The file path can preserve strict UTF-8 and line endings for the supplied final HTML. Browser text controls can normalize pasted line endings, and direct text cannot prove how a build inserts it. Review-only hashes are labeled rather than claimed authoritative.

Inline script data keeps literal entity text: this scanner does not HTML-decode entities. Leading and trailing whitespace are hashed. Minification, formatting, line-ending conversion, asset fingerprinting, or any import-map byte change requires a new hash.

Input 1 · transient local source

Final HTML or direct import-map text

When a file is selected, it takes precedence over the paste field. It is read locally as strict UTF-8.

Nothing is uploaded. Do not place source in a URL, email, screenshot, or shared report.

Input 2 · optional

Current CSP text

The bounded check selects script-src-elem when present, otherwise script-src. It checks computed sources, 'unsafe-inline', duplicates, and missing script directives; it is not a complete CSP parser or enforcement model.

Bounded semantics and non-goals

HTML mode scans only inline <script type="importmap"> blocks. External src, malformed or unclosed tags, multiple candidates, duplicate attributes, entity-encoded attributes, and unsupported attribute shapes produce fixed error or review findings. JSON checks stop at parseability and top-level imports/scopes object shape.

This tool does not fetch an endpoint, modify a build pipeline, integrate a nonce or server, design a full CSP, guarantee import-map or CSP browser support, or reproduce a browser HTML/CSP engine. The report contains hashes and fixed metadata, never entered HTML, JSON, CSP, specifiers, or URLs.

Optional manual review

Final import-map hash check — USD 19

One final HTML file, one CSP, a hash manifest and policy checklist, and one revision.

Email winni80@gmail.com. In the first email, do not send a source archive, proprietary HTML, import-map content, URL, or token. Send only the value-free report and framework/build-tool version.

There is no payment link. This offer and contact address are not evidence of an inquiry, lead, customer, payment, or revenue.