OxidizeLabs · TKorr · Apr 27, 2026 · Apr 27, 2026 · Apr 27, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/bench-support/Cargo.toml b/bench-support/Cargo.toml
@@ -14,3 +14,10 @@ rand = "0.10.1"
 rand_distr = "0.6"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+
+# `sha2` + `base64` compute the inline-script CSP hash from its body
+# at render time so the body and the CSP hash-source can never drift
+# (the body lives in Rust, the rendered HTML is generated, the hash is
+# a function of the body). Also re-used by tests to validate SRI shapes.
+sha2 = "0.11"
+base64 = "0.22"
diff --git a/bench-support/src/bin/charts_template.css b/bench-support/src/bin/charts_template.css
@@ -0,0 +1,182 @@
+/*!
+ * charts.css — sibling stylesheet for charts.html.
+ * Sized to run under `style-src 'self'` with no 'unsafe-inline'.
+ *
+ * Coordinated tokens with charts.html:
+ *   - `.no-js #loading { display: none; }` cooperates with the parser-
+ *     blocking inline script in <head>, which strips the `no-js` class
+ *     before <body> paints so JS-enabled users immediately see the
+ *     "Loading…" placeholder. JS-disabled users keep the class and the
+ *     <noscript> block carries the "JavaScript is required" messaging.
+ *   - `.hidden { display: none; }` is the class-based replacement for
+ *     `style="display: none"` attributes on #error and #content; the JS
+ *     path toggles via `classList`/`style.display` (DOM mutation, which
+ *     CSP does not gate).
+ */
+
+* {
+    margin: 0;
+    padding: 0;
+    box-sizing: border-box;
+}
+
+body {
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+    line-height: 1.6;
+    color: #333;
+    background: #f5f5f5;
+    padding: 20px;
+}
+
+.container {
+    max-width: 1400px;
+    margin: 0 auto;
+    background: white;
+    padding: 30px;
+    border-radius: 8px;
+    box-shadow: 0 2px 4px rgba(0, 0, 0, 0.1);
+}
+
+h1 {
+    color: #2c3e50;
+    margin-bottom: 10px;
+    font-size: 2em;
+}
+
+.metadata {
+    background: #f8f9fa;
+    padding: 15px;
+    border-radius: 4px;
+    margin-bottom: 30px;
+    font-size: 0.9em;
+}
+
+.metadata-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));
+    gap: 10px;
+}
+
+.metadata-item {
+    display: flex;
+    gap: 5px;
+}
+
+.metadata-label {
+    font-weight: 600;
+    color: #555;
+}
+
+.chart-section {
+    margin-bottom: 40px;
+}
+
+.chart-section h2 {
+    color: #34495e;
+    margin-bottom: 15px;
+    padding-bottom: 10px;
+    border-bottom: 2px solid #3498db;
+}
+
+.chart-container {
+    position: relative;
+    height: 400px;
+    margin-bottom: 20px;
+}
+
+.chart-description {
+    color: #666;
+    font-size: 0.9em;
+    margin-bottom: 15px;
+    font-style: italic;
+}
+
+.links {
+    margin-top: 30px;
+    padding-top: 20px;
+    border-top: 1px solid #ddd;
+    display: flex;
+    gap: 20px;
+    flex-wrap: wrap;
+}
+
+.links a {
+    color: #3498db;
+    text-decoration: none;
+    padding: 8px 16px;
+    border: 1px solid #3498db;
+    border-radius: 4px;
+    transition: all 0.3s;
+}
+
+.links a:hover {
+    background: #3498db;
+    color: white;
+}
+
+.error {
+    background: #fee;
+    color: #c33;
+    padding: 20px;
+    border-radius: 4px;
+    border-left: 4px solid #c33;
+    white-space: pre-line;
+    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+}
+
+.error code {
+    font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+    background: rgba(0, 0, 0, 0.05);
+    padding: 1px 4px;
+    border-radius: 3px;
+}
+
+.loading {
+    text-align: center;
+    padding: 40px;
+    color: #666;
+}
+
+.chart-empty {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    height: 100%;
+    color: #888;
+    font-style: italic;
+    background: #fafafa;
+    border: 1px dashed #ddd;
+    border-radius: 4px;
+    padding: 20px;
+    text-align: center;
+}
+
+/* Class-based hiding for elements that start invisible (#error, #content);
+   pairs with `style-src 'self'` since `style="display: none"` would require
+   'unsafe-inline'. JS toggles via element.style.display (a DOM property
+   mutation, which CSP does not gate). */
+.hidden {
+    display: none;
+}
+
+/* When scripting is disabled, hide the misleading "Loading..." placeholder
+   and let the <noscript> error block carry the message. The parser-blocking
+   inline script in charts.html's <head> removes `no-js` from <html> before
+   <body> paints, so JS-enabled users never see this rule applied. */
+.no-js #loading {
+    display: none;
+}
+
+@media (max-width: 768px) {
+    .container {
+        padding: 15px;
+    }
+
+    h1 {
+        font-size: 1.5em;
+    }
+
+    .chart-container {
+        height: 300px;
+    }
+}