astro 7.0.8 → 7.1.0

package/dist/core/config/schemas/relative.d.ts

@@ -256,12 +256,40 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
             }>>>;
             directives: z.ZodOptional<z.ZodArray<z.ZodCustom<`base-uri${string}` | `child-src${string}` | `connect-src${string}` | `default-src${string}` | `fenced-frame-src${string}` | `font-src${string}` | `form-action${string}` | `frame-ancestors${string}` | `frame-src${string}` | `img-src${string}` | `manifest-src${string}` | `media-src${string}` | `object-src${string}` | `referrer${string}` | `report-to${string}` | `report-uri${string}` | `require-trusted-types-for${string}` | `sandbox${string}` | `trusted-types${string}` | `upgrade-insecure-requests${string}` | `worker-src${string}`, `base-uri${string}` | `child-src${string}` | `connect-src${string}` | `default-src${string}` | `fenced-frame-src${string}` | `font-src${string}` | `form-action${string}` | `frame-ancestors${string}` | `frame-src${string}` | `img-src${string}` | `manifest-src${string}` | `media-src${string}` | `object-src${string}` | `referrer${string}` | `report-to${string}` | `report-uri${string}` | `require-trusted-types-for${string}` | `sandbox${string}` | `trusted-types${string}` | `upgrade-insecure-requests${string}` | `worker-src${string}`>>>;
             styleDirective: z.ZodOptional<z.ZodObject<{
-                resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                hashes: z.ZodOptional<z.ZodArray<z.ZodCustom<`sha256-${string}` | `sha384-${string}` | `sha512-${string}`, `sha256-${string}` | `sha384-${string}` | `sha512-${string}`>>>;
+                resources: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                    resource: z.ZodString;
+                    kind: z.ZodEnum<{
+                        default: "default";
+                        attribute: "attribute";
+                        element: "element";
+                    }>;
+                }, z.core.$strip>]>>>;
+                hashes: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodCustom<`sha256-${string}` | `sha384-${string}` | `sha512-${string}`, `sha256-${string}` | `sha384-${string}` | `sha512-${string}`>, z.ZodObject<{
+                    hash: z.ZodCustom<`sha256-${string}` | `sha384-${string}` | `sha512-${string}`, `sha256-${string}` | `sha384-${string}` | `sha512-${string}`>;
+                    kind: z.ZodEnum<{
+                        default: "default";
+                        attribute: "attribute";
+                        element: "element";
+                    }>;
+                }, z.core.$strip>]>>>;
             }, z.core.$strip>>;
             scriptDirective: z.ZodOptional<z.ZodObject<{
-                resources: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                hashes: z.ZodOptional<z.ZodArray<z.ZodCustom<`sha256-${string}` | `sha384-${string}` | `sha512-${string}`, `sha256-${string}` | `sha384-${string}` | `sha512-${string}`>>>;
+                resources: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                    resource: z.ZodString;
+                    kind: z.ZodEnum<{
+                        default: "default";
+                        attribute: "attribute";
+                        element: "element";
+                    }>;
+                }, z.core.$strip>]>>>;
+                hashes: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodCustom<`sha256-${string}` | `sha384-${string}` | `sha512-${string}`, `sha256-${string}` | `sha384-${string}` | `sha512-${string}`>, z.ZodObject<{
+                    hash: z.ZodCustom<`sha256-${string}` | `sha384-${string}` | `sha512-${string}`, `sha256-${string}` | `sha384-${string}` | `sha512-${string}`>;
+                    kind: z.ZodEnum<{
+                        default: "default";
+                        attribute: "attribute";
+                        element: "element";
+                    }>;
+                }, z.core.$strip>]>>>;
                 strictDynamic: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>>;
         }, z.core.$strip>]>>>;
@@ -346,7 +374,7 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
     }>>>;
     fetchFile: z.ZodDefault<z.ZodOptional<z.ZodNullable<z.ZodString>>>;
     logger: z.ZodOptional<z.ZodObject<{
-        entrypoint: z.ZodString;
+        entrypoint: z.ZodUnion<readonly [z.ZodString, z.ZodCustom<URL, URL>]>;
         config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     }, z.core.$strip>>;
     fonts: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -412,6 +440,10 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
             name: z.ZodString;
             optimize: z.ZodCustom<(contents: string) => string | Promise<string>, (contents: string) => string | Promise<string>>;
         }, z.core.$strip>>;
+        collectionStorage: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+            "single-file": "single-file";
+            chunked: "chunked";
+        }>>>;
     }, z.core.$strict>>;
     legacy: z.ZodPrefault<z.ZodObject<{
         collectionsBackwardsCompat: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
@@ -528,12 +560,24 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
             algorithm: "SHA-256" | "SHA-384" | "SHA-512";
             directives?: (`base-uri${string}` | `child-src${string}` | `connect-src${string}` | `default-src${string}` | `fenced-frame-src${string}` | `font-src${string}` | `form-action${string}` | `frame-ancestors${string}` | `frame-src${string}` | `img-src${string}` | `manifest-src${string}` | `media-src${string}` | `object-src${string}` | `referrer${string}` | `report-to${string}` | `report-uri${string}` | `require-trusted-types-for${string}` | `sandbox${string}` | `trusted-types${string}` | `upgrade-insecure-requests${string}` | `worker-src${string}`)[] | undefined;
             styleDirective?: {
-                resources?: string[] | undefined;
-                hashes?: (`sha256-${string}` | `sha384-${string}` | `sha512-${string}`)[] | undefined;
+                resources?: (string | {
+                    resource: string;
+                    kind: "default" | "attribute" | "element";
+                })[] | undefined;
+                hashes?: (`sha256-${string}` | `sha384-${string}` | `sha512-${string}` | {
+                    hash: `sha256-${string}` | `sha384-${string}` | `sha512-${string}`;
+                    kind: "default" | "attribute" | "element";
+                })[] | undefined;
             } | undefined;
             scriptDirective?: {
-                resources?: string[] | undefined;
-                hashes?: (`sha256-${string}` | `sha384-${string}` | `sha512-${string}`)[] | undefined;
+                resources?: (string | {
+                    resource: string;
+                    kind: "default" | "attribute" | "element";
+                })[] | undefined;
+                hashes?: (`sha256-${string}` | `sha384-${string}` | `sha512-${string}` | {
+                    hash: `sha256-${string}` | `sha384-${string}` | `sha512-${string}`;
+                    kind: "default" | "attribute" | "element";
+                })[] | undefined;
                 strictDynamic?: boolean | undefined;
             } | undefined;
         };
@@ -586,6 +630,7 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
         clientPrerender: boolean;
         contentIntellisense: boolean;
         chromeDevtoolsWorkspace: boolean;
+        collectionStorage: "single-file" | "chunked";
         svgOptimizer?: {
             name: string;
             optimize: (contents: string) => string | Promise<string>;
@@ -664,7 +709,7 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
         ttl?: number | undefined;
     } | undefined;
     logger?: {
-        entrypoint: string;
+        entrypoint: string | URL;
         config?: Record<string, any> | undefined;
     } | undefined;
     fonts?: {
@@ -778,12 +823,24 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
             algorithm: "SHA-256" | "SHA-384" | "SHA-512";
             directives?: (`base-uri${string}` | `child-src${string}` | `connect-src${string}` | `default-src${string}` | `fenced-frame-src${string}` | `font-src${string}` | `form-action${string}` | `frame-ancestors${string}` | `frame-src${string}` | `img-src${string}` | `manifest-src${string}` | `media-src${string}` | `object-src${string}` | `referrer${string}` | `report-to${string}` | `report-uri${string}` | `require-trusted-types-for${string}` | `sandbox${string}` | `trusted-types${string}` | `upgrade-insecure-requests${string}` | `worker-src${string}`)[] | undefined;
             styleDirective?: {
-                resources?: string[] | undefined;
-                hashes?: (`sha256-${string}` | `sha384-${string}` | `sha512-${string}`)[] | undefined;
+                resources?: (string | {
+                    resource: string;
+                    kind: "default" | "attribute" | "element";
+                })[] | undefined;
+                hashes?: (`sha256-${string}` | `sha384-${string}` | `sha512-${string}` | {
+                    hash: `sha256-${string}` | `sha384-${string}` | `sha512-${string}`;
+                    kind: "default" | "attribute" | "element";
+                })[] | undefined;
             } | undefined;
             scriptDirective?: {
-                resources?: string[] | undefined;
-                hashes?: (`sha256-${string}` | `sha384-${string}` | `sha512-${string}`)[] | undefined;
+                resources?: (string | {
+                    resource: string;
+                    kind: "default" | "attribute" | "element";
+                })[] | undefined;
+                hashes?: (`sha256-${string}` | `sha384-${string}` | `sha512-${string}` | {
+                    hash: `sha256-${string}` | `sha384-${string}` | `sha512-${string}`;
+                    kind: "default" | "attribute" | "element";
+                })[] | undefined;
                 strictDynamic?: boolean | undefined;
             } | undefined;
         };
@@ -836,6 +893,7 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
         clientPrerender: boolean;
         contentIntellisense: boolean;
         chromeDevtoolsWorkspace: boolean;
+        collectionStorage: "single-file" | "chunked";
         svgOptimizer?: {
             name: string;
             optimize: (contents: string) => string | Promise<string>;
@@ -914,7 +972,7 @@ export declare function createRelativeSchema(cmd: string, fileProtocolRoot: stri
         ttl?: number | undefined;
     } | undefined;
     logger?: {
-        entrypoint: string;
+        entrypoint: string | URL;
         config?: Record<string, any> | undefined;
     } | undefined;
     fonts?: {

package/dist/core/constants.js

@@ -1,4 +1,4 @@
-const ASTRO_VERSION = "7.0.8";
+const ASTRO_VERSION = "7.1.0";
 const ASTRO_GENERATOR = `Astro v${ASTRO_VERSION}`;
 const ASTRO_ERROR_HEADER = "X-Astro-Error";
 const DEFAULT_404_COMPONENT = "astro-default-404.astro";

package/dist/core/csp/common.d.ts

@@ -1,16 +1,16 @@
 import type { AstroSettings } from '../../types/astro.js';
 import type { AstroConfig, CspAlgorithm } from '../../types/public/index.js';
 import type { BuildInternals } from '../build/internal.js';
-import type { CspDirective } from './config.js';
+import type { CspDirective, CspHash, CspHashEntry, CspResourceEntry } from './config.js';
 type EnabledCsp = Exclude<AstroConfig['security']['csp'], false>;
 export declare function shouldTrackCspHashes(csp: any): csp is EnabledCsp;
 export declare function getAlgorithm(csp: EnabledCsp): CspAlgorithm;
-export declare function getScriptHashes(csp: EnabledCsp): string[];
-export declare function getScriptResources(csp: EnabledCsp): string[];
-export declare function getStyleHashes(csp: EnabledCsp): string[];
-export declare function getStyleResources(csp: EnabledCsp): string[];
+export declare function getScriptResources(csp: EnabledCsp): CspResourceEntry[];
+export declare function getScriptHashes(csp: EnabledCsp): CspHashEntry[];
+export declare function getStyleResources(csp: EnabledCsp): CspResourceEntry[];
+export declare function getStyleHashes(csp: EnabledCsp): CspHashEntry[];
 export declare function getDirectives(settings: AstroSettings): CspDirective[];
 export declare function getStrictDynamic(csp: EnabledCsp): boolean;
-export declare function trackStyleHashes(internals: BuildInternals, settings: AstroSettings, algorithm: CspAlgorithm): Promise<string[]>;
-export declare function trackScriptHashes(internals: BuildInternals, settings: AstroSettings, algorithm: CspAlgorithm): Promise<string[]>;
+export declare function trackStyleHashes(internals: BuildInternals, settings: AstroSettings, algorithm: CspAlgorithm): Promise<CspHash[]>;
+export declare function trackScriptHashes(internals: BuildInternals, settings: AstroSettings, algorithm: CspAlgorithm): Promise<CspHash[]>;
 export {};

package/dist/core/csp/common.js

@@ -13,24 +13,17 @@ function getAlgorithm(csp) {
   }
   return csp.algorithm;
 }
-function getScriptHashes(csp) {
-  if (csp === true) {
-    return [];
-  } else {
-    return csp.scriptDirective?.hashes ?? [];
-  }
-}
 function getScriptResources(csp) {
   if (csp === true) {
     return [];
   }
   return csp.scriptDirective?.resources ?? [];
 }
-function getStyleHashes(csp) {
+function getScriptHashes(csp) {
   if (csp === true) {
     return [];
   }
-  return csp.styleDirective?.hashes ?? [];
+  return csp.scriptDirective?.hashes ?? [];
 }
 function getStyleResources(csp) {
   if (csp === true) {
@@ -38,6 +31,12 @@ function getStyleResources(csp) {
   }
   return csp.styleDirective?.resources ?? [];
 }
+function getStyleHashes(csp) {
+  if (csp === true) {
+    return [];
+  }
+  return csp.styleDirective?.hashes ?? [];
+}
 function getDirectives(settings) {
   const { csp } = settings.config.security;
   if (!shouldTrackCspHashes(csp)) {

package/dist/core/csp/config.d.ts

@@ -13,6 +13,51 @@ export declare const cspAlgorithmSchema: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
 }>>>;
 export declare const cspHashSchema: z.ZodCustom<`sha256-${string}` | `sha384-${string}` | `sha512-${string}`, `sha256-${string}` | `sha384-${string}` | `sha512-${string}`>;
 export type CspHash = z.infer<typeof cspHashSchema>;
+/**
+ * The scope a resource or hash applies to:
+ * - `default`: the generic `script-src`/`style-src` directive (default behavior).
+ * - `element`: the `script-src-elem`/`style-src-elem` directive (`<script>`, `<style>`, `<link rel="stylesheet">`).
+ * - `attribute`: the `script-src-attr`/`style-src-attr` directive (inline event handlers and inline `style` attributes).
+ */
+export declare const CSP_KINDS: readonly ["element", "attribute", "default"];
+export type CspKind = (typeof CSP_KINDS)[number];
+export declare const cspKindSchema: z.ZodEnum<{
+    default: "default";
+    attribute: "attribute";
+    element: "element";
+}>;
+/**
+ * A `script-src`/`style-src` resource. A bare string targets `script-src`/`style-src` (the same as
+ * `kind: 'default'`). Use the object form with an explicit `kind` to target a more specific directive.
+ */
+export type CspResourceEntry = string | {
+    resource: string;
+    kind: CspKind;
+};
+/**
+ * A `script-src`/`style-src` hash. A bare hash (a string) targets `script-src`/`style-src` (the same as
+ * `kind: 'default'`). Use the object form with an explicit `kind` to target a more specific directive.
+ */
+export type CspHashEntry = CspHash | {
+    hash: CspHash;
+    kind: CspKind;
+};
+export declare const cspResourceEntrySchema: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+    resource: z.ZodString;
+    kind: z.ZodEnum<{
+        default: "default";
+        attribute: "attribute";
+        element: "element";
+    }>;
+}, z.core.$strip>]>;
+export declare const cspHashEntrySchema: z.ZodUnion<readonly [z.ZodCustom<`sha256-${string}` | `sha384-${string}` | `sha512-${string}`, `sha256-${string}` | `sha384-${string}` | `sha512-${string}`>, z.ZodObject<{
+    hash: z.ZodCustom<`sha256-${string}` | `sha384-${string}` | `sha512-${string}`, `sha256-${string}` | `sha384-${string}` | `sha512-${string}`>;
+    kind: z.ZodEnum<{
+        default: "default";
+        attribute: "attribute";
+        element: "element";
+    }>;
+}, z.core.$strip>]>;
 declare const ALLOWED_DIRECTIVES: readonly ["base-uri", "child-src", "connect-src", "default-src", "fenced-frame-src", "font-src", "form-action", "frame-ancestors", "frame-src", "img-src", "manifest-src", "media-src", "object-src", "referrer", "report-to", "report-uri", "require-trusted-types-for", "sandbox", "trusted-types", "upgrade-insecure-requests", "worker-src"];
 type AllowedDirectives = (typeof ALLOWED_DIRECTIVES)[number];
 export type CspDirective = `${AllowedDirectives}${string | undefined}`;

package/dist/core/csp/config.js

@@ -14,6 +14,44 @@ const cspHashSchema = z.custom((value) => {
     return value.startsWith(allowedValue);
   });
 });
+const CSP_KINDS = ["element", "attribute", "default"];
+const cspKindSchema = z.enum(CSP_KINDS);
+const ATTRIBUTE_ALLOWED_RESOURCES = [
+  "'none'",
+  "'unsafe-hashes'",
+  "'unsafe-inline'",
+  "'report-sample'"
+];
+const cspResourceEntrySchema = z.union([
+  z.string(),
+  z.object({
+    resource: z.string(),
+    kind: cspKindSchema
+  })
+]).superRefine((value, ctx) => {
+  const resource = typeof value === "string" ? value : value.resource;
+  const kind = typeof value === "string" ? "default" : value.kind;
+  if (kind === "element" && resource === "'unsafe-hashes'") {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: `The source \`'unsafe-hashes'\` is not valid for \`element\` resources (it is rejected by \`script-src-elem\`/\`style-src-elem\`).`,
+      fatal: true
+    });
+  } else if (kind === "attribute" && !ATTRIBUTE_ALLOWED_RESOURCES.includes(resource)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: `The source \`${resource}\` is not valid for \`attribute\` resources. \`script-src-attr\`/\`style-src-attr\` only accept: ${ATTRIBUTE_ALLOWED_RESOURCES.join(", ")}.`,
+      fatal: true
+    });
+  }
+});
+const cspHashEntrySchema = z.union([
+  cspHashSchema,
+  z.object({
+    hash: cspHashSchema,
+    kind: cspKindSchema
+  })
+]);
 const ALLOWED_DIRECTIVES = [
   "base-uri",
   "child-src",
@@ -45,7 +83,7 @@ const allowedDirectivesSchema = z.custom((v) => typeof v === "string").superRefi
     if (value.startsWith("script-src") || value.startsWith("style-src")) {
       ctx.addIssue({
         code: z.ZodIssueCode.custom,
-        message: `Directives \`script-src\` and \`style-src\` are not allowed in \`security.csp.directives\`. Please use \`security.csp.scriptDirective\` and \`security.csp.styleDirective\` instead.`,
+        message: `Directives \`script-src\` and \`style-src\` (including their \`-elem\`/\`-attr\` variants) are not allowed in \`security.csp.directives\`. Please use \`security.csp.scriptDirective\` and \`security.csp.styleDirective\` instead, scoping resources/hashes to the more specific directives with the \`kind\` option (\`"element"\` or \`"attribute"\`).`,
         fatal: true
       });
     } else {
@@ -59,7 +97,11 @@ const allowedDirectivesSchema = z.custom((v) => typeof v === "string").superRefi
 });
 export {
   ALGORITHMS,
+  CSP_KINDS,
   allowedDirectivesSchema,
   cspAlgorithmSchema,
-  cspHashSchema
+  cspHashEntrySchema,
+  cspHashSchema,
+  cspKindSchema,
+  cspResourceEntrySchema
 };

package/dist/core/csp/runtime.d.ts

@@ -1,5 +1,25 @@
 import type { SSRManifestCSP } from '../app/types.js';
-import type { CspDirective } from './config.js';
+import type { CspDirective, CspHash, CspHashEntry, CspKind, CspResourceEntry } from './config.js';
+export declare function normalizeCspResourceEntry(entry: CspResourceEntry): {
+    resource: string;
+    kind: CspKind;
+};
+export declare function normalizeCspHashEntry(entry: CspHashEntry): {
+    hash: CspHash;
+    kind: CspKind;
+};
+/** The resolved sources of a single CSP directive. */
+export type CspDirectiveSources = {
+    resources: string[];
+    hashes: string[];
+};
+/**
+ * Groups a directive's `resources`/`hashes` entries by their `kind`.
+ */
+export declare function partitionByKind(directive: {
+    resources: CspResourceEntry[];
+    hashes: CspHashEntry[];
+}): Record<CspKind, CspDirectiveSources>;
 /**
  * `existingDirective` is something like `img-src 'self'`. Same as `newDirective`.
  *

package/dist/core/csp/runtime.js

@@ -1,3 +1,31 @@
+function normalizeCspResourceEntry(entry) {
+  if (typeof entry === "string") {
+    return { resource: entry, kind: "default" };
+  }
+  return { resource: entry.resource, kind: entry.kind ?? "default" };
+}
+function normalizeCspHashEntry(entry) {
+  if (typeof entry === "string") {
+    return { hash: entry, kind: "default" };
+  }
+  return { hash: entry.hash, kind: entry.kind ?? "default" };
+}
+function partitionByKind(directive) {
+  const groups = {
+    default: { resources: [], hashes: [] },
+    element: { resources: [], hashes: [] },
+    attribute: { resources: [], hashes: [] }
+  };
+  for (const entry of directive.resources) {
+    const { resource, kind } = normalizeCspResourceEntry(entry);
+    groups[kind].resources.push(resource);
+  }
+  for (const entry of directive.hashes) {
+    const { hash, kind } = normalizeCspHashEntry(entry);
+    groups[kind].hashes.push(hash);
+  }
+  return groups;
+}
 function deduplicateDirectiveValues(existingDirective, newDirective) {
   const [directiveName, ...existingValues] = existingDirective.split(/\s+/).filter(Boolean);
   const [newDirectiveName, ...newValues] = newDirective.split(/\s+/).filter(Boolean);
@@ -33,5 +61,8 @@ function pushDirective(directives, newDirective) {
 }
 export {
   deduplicateDirectiveValues,
+  normalizeCspHashEntry,
+  normalizeCspResourceEntry,
+  partitionByKind,
   pushDirective
 };

package/dist/core/dev/dev.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import { performance } from "node:perf_hooks";
 import colors from "piccolore";
 import { gt, major, minor, patch } from "semver";
-import { getDataStoreFile } from "../../content/content-layer.js";
+import { getDataStoreDir, getDataStoreFile } from "../../content/paths.js";
 import { globalContentLayer } from "../../content/instance.js";
 import { attachContentServerListeners } from "../../content/index.js";
 import { MutableDataStore } from "../../content/mutable-data-store.js";
@@ -26,7 +26,7 @@ async function dev(inlineConfig) {
   await telemetry.record([]);
   const restart = await createContainerWithAutomaticRestart({ inlineConfig, fs });
   const logger = restart.container.logger;
-  const currentVersion = "7.0.8";
+  const currentVersion = "7.1.0";
   const isPrerelease = currentVersion.includes("-");
   if (!isPrerelease) {
     try {
@@ -56,8 +56,13 @@ async function dev(inlineConfig) {
   }
   let store;
   try {
-    const dataStoreFile = getDataStoreFile(restart.container.settings, true);
-    store = await MutableDataStore.fromFile(dataStoreFile);
+    if (restart.container.settings.config.experimental.collectionStorage === "chunked") {
+      const dataStoreDir = getDataStoreDir(restart.container.settings, true);
+      store = await MutableDataStore.fromDir(dataStoreDir);
+    } else {
+      const dataStoreFile = getDataStoreFile(restart.container.settings, true);
+      store = await MutableDataStore.fromFile(dataStoreFile);
+    }
   } catch (err) {
     logger.error("content", err.message);
   }

package/dist/core/dev/restart.js

@@ -12,7 +12,11 @@ import { collectErrorMetadata } from "../errors/dev/utils.js";
 import { isAstroConfigZodError } from "../errors/errors.js";
 import { createSafeError } from "../errors/index.js";
 import { loadOrCreateNodeLogger } from "../logger/load.js";
-import { formatErrorMessage, warnIfCspWithShiki } from "../messages/runtime.js";
+import {
+  formatErrorMessage,
+  warnIfCspResourceFallbackShadowing,
+  warnIfCspWithShiki
+} from "../messages/runtime.js";
 import { createRoutesList } from "../routing/create-manifest.js";
 import { createContainer } from "./container.js";
 const configRE = /.*astro.config.(?:mjs|mts|cjs|cts|js|ts)$/;
@@ -46,6 +50,7 @@ async function restartContainerInPlace(container) {
   try {
     const { astroConfig } = await resolveConfig(inlineConfig, "dev", fs);
     warnIfCspWithShiki(astroConfig, logger);
+    warnIfCspResourceFallbackShadowing(astroConfig, logger);
     let settings = await createSettings(
       astroConfig,
       inlineConfig.logLevel,
@@ -100,6 +105,7 @@ async function createContainerWithAutomaticRestart({
   const { userConfig, astroConfig } = await resolveConfig(inlineConfig ?? {}, "dev", fs);
   const logger = await loadOrCreateNodeLogger(astroConfig, inlineConfig ?? {});
   warnIfCspWithShiki(astroConfig, logger);
+  warnIfCspResourceFallbackShadowing(astroConfig, logger);
   telemetry.record(eventCliSession("dev", userConfig));
   const settings = await createSettings(
     astroConfig,

package/dist/core/errors/zod-error-map.js

@@ -122,7 +122,13 @@ const getTypeOrLiteralMsg = (error) => {
 const prefix = (key, msg) => key.length ? `**${key}**: ${msg}` : msg;
 const unionExpectedVals = (expectedVals) => [...expectedVals].map((expectedVal) => stringify(expectedVal)).join(" | ");
 const flattenErrorPath = (errorPath) => errorPath.join(".");
-const stringify = (val) => JSON.stringify(val, null, 1).split(newlinePlusWhitespace).join(" ");
+const stringify = (val) => {
+  const json = JSON.stringify(val, null, 1);
+  if (json === void 0) {
+    return String(val);
+  }
+  return json.split(newlinePlusWhitespace).join(" ");
+};
 const newlinePlusWhitespace = /\n\s*/;
 const leadingPeriod = /^\./;
 export {

package/dist/core/fetch/fetch-state.js

@@ -16,7 +16,7 @@ import {
   pipelineSymbol,
   responseSentSymbol
 } from "../constants.js";
-import { pushDirective } from "../csp/runtime.js";
+import { normalizeCspResourceEntry, pushDirective } from "../csp/runtime.js";
 import { generateCspDigest } from "../encryption.js";
 import { AstroError, AstroErrorData } from "../errors/index.js";
 import {
@@ -304,12 +304,26 @@ class FetchState {
       cspDestination: manifest.csp?.cspDestination ?? (routeData.prerender ? "meta" : "header"),
       shouldInjectCspMetaTags,
       cspAlgorithm,
+      directives: manifest.csp?.directives ? [...manifest.csp.directives] : [],
+      // Deprecated flat fields, kept for back-compat. Seeded from the manifest; the runtime CSP
+      // API updates the structured `scriptDirective`/`styleDirective` below (which the renderer
+      // reads), not these.
       scriptHashes: manifest.csp?.scriptHashes ? [...manifest.csp.scriptHashes] : [],
       scriptResources: manifest.csp?.scriptResources ? [...manifest.csp.scriptResources] : [],
       styleHashes: manifest.csp?.styleHashes ? [...manifest.csp.styleHashes] : [],
       styleResources: manifest.csp?.styleResources ? [...manifest.csp.styleResources] : [],
-      directives: manifest.csp?.directives ? [...manifest.csp.directives] : [],
       isStrictDynamic: manifest.csp?.isStrictDynamic ?? false,
+      // Structured fields (source of truth). Arrays are cloned so per-request runtime inserts
+      // don't mutate the shared manifest.
+      scriptDirective: {
+        resources: manifest.csp?.scriptDirective ? [...manifest.csp.scriptDirective.resources] : [],
+        hashes: manifest.csp?.scriptDirective ? [...manifest.csp.scriptDirective.hashes] : [],
+        strictDynamic: manifest.csp?.scriptDirective?.strictDynamic ?? false
+      },
+      styleDirective: {
+        resources: manifest.csp?.styleDirective ? [...manifest.csp.styleDirective.resources] : [],
+        hashes: manifest.csp?.styleDirective ? [...manifest.csp.styleDirective.hashes] : []
+      },
       internalFetchHeaders: manifest.internalFetchHeaders
     };
     this.result = result;
@@ -451,23 +465,51 @@ class FetchState {
       }
       return void 0;
     }
+    const warnedFallback = /* @__PURE__ */ new Set();
+    const warnFallback = (family, kind) => {
+      if (kind === "default" || !state.result) {
+        return;
+      }
+      const directive = family === "script" ? state.result.scriptDirective : state.result.styleDirective;
+      const defaultResources = directive.resources.map(normalizeCspResourceEntry).filter((entry) => entry.kind === "default").map((entry) => entry.resource);
+      if (defaultResources.length === 0) {
+        return;
+      }
+      const key = `${family}:${kind}`;
+      if (warnedFallback.has(key)) {
+        return;
+      }
+      warnedFallback.add(key);
+      const general = `${family}-src`;
+      const specific = `${general}-${kind === "element" ? "elem" : "attr"}`;
+      pipeline.logger.warn(
+        "csp",
+        `A resource was added to \`${specific}\`, but \`${general}\` also defines custom resources (${defaultResources.join(
+          " "
+        )}). Because \`${specific}\` overrides \`${general}\` for its scope (browsers do not fall back), those resources will not apply there. Add them to \`${specific}\` as well if needed.`
+      );
+    };
     return {
       insertDirective(payload) {
         if (state.result) {
           state.result.directives = pushDirective(state.result.directives, payload);
         }
       },
-      insertScriptResource(resource) {
-        state.result?.scriptResources.push(resource);
+      insertScriptResource(payload) {
+        if (!state.result) return;
+        warnFallback("script", normalizeCspResourceEntry(payload).kind);
+        state.result.scriptDirective.resources.push(payload);
       },
-      insertStyleResource(resource) {
-        state.result?.styleResources.push(resource);
+      insertStyleResource(payload) {
+        if (!state.result) return;
+        warnFallback("style", normalizeCspResourceEntry(payload).kind);
+        state.result.styleDirective.resources.push(payload);
       },
-      insertStyleHash(hash) {
-        state.result?.styleHashes.push(hash);
+      insertStyleHash(payload) {
+        state.result?.styleDirective.hashes.push(payload);
       },
-      insertScriptHash(hash) {
-        state.result?.scriptHashes.push(hash);
+      insertScriptHash(payload) {
+        state.result?.scriptDirective.hashes.push(payload);
       }
     };
   }

package/dist/core/logger/config.d.ts

@@ -2,5 +2,5 @@ export interface LoggerHandlerConfig {
     /** Serializable options used by the driver implementation */
     config?: Record<string, any> | undefined;
     /** URL or package import */
-    entrypoint: string;
+    entrypoint: string | URL;
 }

package/dist/core/logger/core.d.ts

@@ -1,8 +1,8 @@
-export interface AstroLoggerDestination<T = unknown> {
+export interface AstroLoggerDestination {
     /**
      * It receives a message and writes it into a destination
      */
-    write: (chunk: T) => void;
+    write: (chunk: AstroLoggerMessage) => void;
     /**
      * It dumps logs without closing the connection to the destination.
      * Method that can be used by specialized loggers.
@@ -31,7 +31,7 @@ export type AstroLoggerLevel = 'debug' | 'info' | 'warn' | 'error' | 'silent';
 declare const AstroLoggerLabels: readonly ["add", "build", "check", "config", "content", "crypto", "deprecated", "markdown", "router", "types", "vite", "watch", "middleware", "preferences", "redirects", "sync", "session", "toolbar", "assets", "env", "update", "adapter", "islands", "cache", "csp", "SKIP_FORMAT"];
 type AstroLoggerLabel = (typeof AstroLoggerLabels)[number];
 export interface AstroLogOptions {
-    destination: AstroLoggerDestination<AstroLoggerMessage>;
+    destination: AstroLoggerDestination;
     level: AstroLoggerLevel;
     /**
      * Optional configuration for the logger destination
@@ -78,7 +78,7 @@ export declare class AstroLogger {
     debug(label: AstroLoggerLabel, ...messages: any[]): void;
     level(): AstroLoggerLevel;
     forkIntegrationLogger(label: string): AstroIntegrationLogger;
-    setDestination(destination: AstroLoggerDestination<AstroLoggerMessage>): void;
+    setDestination(destination: AstroLoggerDestination): void;
     /**
      * It calls the `close` function of the provided destination, if it exists.
      */

package/dist/core/logger/impls/console.d.ts

@@ -1,4 +1,4 @@
-import { type AstroLoggerMessage, type AstroLoggerDestination, type AstroLoggerLevel, AstroLogger } from '../core.js';
+import { type AstroLoggerDestination, type AstroLoggerLevel, AstroLogger } from '../core.js';
 import type { NodeHandlerConfig } from './node.js';
 export type ConsoleHandlerConfig = {
     level?: AstroLoggerLevel;
@@ -6,4 +6,4 @@ export type ConsoleHandlerConfig = {
 export declare function createConsoleLogger({ level }: {
     level: AstroLoggerLevel;
 }): AstroLogger;
-export default function (options?: NodeHandlerConfig): AstroLoggerDestination<AstroLoggerMessage>;
+export default function (options?: NodeHandlerConfig): AstroLoggerDestination;