till
dd8061d838
CI / check (push) Has been cancelled
Astro 7 moved `csp` out of `experimental` — but to `security.csp`, not to the top level, and I put it at the top level. Astro's config schema drops keys it does not know without a word: the build stayed green, the types stayed green, and every response went out with no Content-Security-Policy at all. Only looking at a live response header showed it. Fixed, and now guarded: tests/config.test.ts reads the config and asserts the policy sits where Astro actually reads it. Checked that the test goes red against the broken config before trusting it green against this one. Verified on a running instance: the header is back, with the same per-script hashes as before.