Install Contentsquare Tag

You are helping a developer install and verify the Contentsquare tracking tag in their web project. Follow this document step by step. Do not skip sections.

Rules (read first, apply throughout)

• The package is exactly @contentsquare/tag-sdk. The function is exactly injectContentsquareScript. The only required option is clientId. Do not substitute, rename, or invent alternatives.
• injectContentsquareScript must run in a browser context only — never during SSR. If you're placing it in a file that runs on the server (Next.js Server Component, Nuxt server route, SvelteKit +page.server.ts, etc.), it is wrong.
• The hashed project ID (a.k.a. tag ID) is a lowercase hex string, ~13 characters (e.g. 81c677ba742d7). If what you have looks like a plain decimal number, an email, a URL, or anything else — stop and ask for the hashed project ID. Never hash, transform, generate, or guess the ID yourself.
• Base framework detection only on actual command output. If detection is ambiguous or package.json is missing, ask the developer.
• Never start, restart, or kill the dev server. Always ask the developer to do it.
• Never modify CSP unless a CSP violation is detected, or you find an existing CSP missing Contentsquare domains. Do not preventively add CSP headers to a project that has none.
• Run npm install (or equivalent) only after confirming the package manager and that you are in the project root.
• After 2 failed verification attempts, stop modifying code and ask the developer for guidance.
• If the project has no tsconfig.json, use .js/.jsx extensions instead of .ts/.tsx in all file paths and templates below.