///|
fn main {
  let policy = @csp.parse(
    "default-src 'self'; script-src 'self' 'nonce-demo' https://cdn.example; " +
    "object-src 'none'; base-uri 'self'",
  )
  println(@csp.summary(policy))
  let decision = @csp.allows(
    policy,
    @csp.script_request("https://cdn.example/app.js", "https://app.example"),
  )
  println(decision.reason)
  println(@csp.findings_text(@csp.extended_audit(policy)))
}