astro 7.0.9 → 7.1.1

package/dist/integrations/hooks.js

@@ -14,6 +14,7 @@ import { validateSetAdapter } from "../core/dev/adapter-validation.js";
 import { getRouteGenerator } from "../core/routing/generator.js";
 import { getClientOutputDirectory } from "../prerender/utils.js";
 import { validateSupportedFeatures } from "./features-validation.js";
+import { loadLoggerDestination } from "../core/logger/load.js";
 async function withTakingALongTimeMsg({
   name,
   hookName,
@@ -139,6 +140,7 @@ async function runHookConfigSetup({
   let astroJSXRenderer = null;
   for (let i = 0; i < updatedConfig.integrations.length; i++) {
     const integration = updatedConfig.integrations[i];
+    let isLoggerUpdated = false;
     const { integrationLogger } = await runHookInternal({
       integration,
       hookName: "astro:config:setup",
@@ -169,6 +171,9 @@ async function runHookConfigSetup({
             updatedSettings.scripts.push({ stage, content });
           },
           updateConfig: (newConfig) => {
+            if (newConfig.logger?.entrypoint) {
+              isLoggerUpdated = true;
+            }
             updatedConfig = mergeConfig(updatedConfig, newConfig);
             return { ...updatedConfig };
           },
@@ -254,6 +259,9 @@ async function runHookConfigSetup({
     }
     try {
       updatedConfig = await validateConfigRefined(updatedConfig);
+      if (isLoggerUpdated) {
+        logger.setDestination(await loadLoggerDestination(updatedConfig.logger));
+      }
     } catch (error) {
       integrationLogger.error("An error occurred while updating the config");
       throw error;

package/dist/manifest/serialized.js

@@ -14,6 +14,7 @@ import {
   getStyleResources,
   shouldTrackCspHashes
 } from "../core/csp/common.js";
+import { partitionByKind } from "../core/csp/runtime.js";
 import { createKey, encodeKey, getEnvironmentKey, hasEnvironmentKey } from "../core/encryption.js";
 import { MIDDLEWARE_MODULE_ID } from "../core/middleware/vite-plugin.js";
 import { SERVER_ISLAND_MANIFEST } from "../core/server-islands/vite-plugin-server-islands.js";
@@ -131,15 +132,29 @@ async function createSerializedManifest(settings, encodedKey) {
     };
   }
   if (shouldTrackCspHashes(settings.config.security.csp)) {
+    const cspConfig = settings.config.security.csp;
+    const scriptDirective = {
+      resources: getScriptResources(cspConfig),
+      hashes: getScriptHashes(cspConfig),
+      strictDynamic: getStrictDynamic(cspConfig)
+    };
+    const styleDirective = {
+      resources: getStyleResources(cspConfig),
+      hashes: getStyleHashes(cspConfig)
+    };
+    const scriptDefault = partitionByKind(scriptDirective).default;
+    const styleDefault = partitionByKind(styleDirective).default;
     csp = {
       cspDestination: settings.adapter?.adapterFeatures?.staticHeaders ? "adapter" : void 0,
-      scriptHashes: getScriptHashes(settings.config.security.csp),
-      scriptResources: getScriptResources(settings.config.security.csp),
-      styleHashes: getStyleHashes(settings.config.security.csp),
-      styleResources: getStyleResources(settings.config.security.csp),
-      algorithm: getAlgorithm(settings.config.security.csp),
+      algorithm: getAlgorithm(cspConfig),
       directives: getDirectives(settings),
-      isStrictDynamic: getStrictDynamic(settings.config.security.csp)
+      scriptHashes: scriptDefault.hashes,
+      scriptResources: scriptDefault.resources,
+      isStrictDynamic: scriptDirective.strictDynamic,
+      styleHashes: styleDefault.hashes,
+      styleResources: styleDefault.resources,
+      scriptDirective,
+      styleDirective
     };
   }
   let loggerConfig = void 0;

package/dist/runtime/server/escape.d.ts

@@ -7,6 +7,8 @@ export declare const escapeHTML: (str: string) => string;
  * @see https://mathiasbynens.be/notes/etago
  */
 export declare function stringifyForScript(value: any): string;
+/** Escapes CSS text so it can be embedded inside a `<style>` tag. */
+export declare function escapeStyleText(value: string): string;
 export declare class HTMLBytes extends Uint8Array {
 }
 declare const htmlStringSymbol: unique symbol;

package/dist/runtime/server/escape.js

@@ -4,6 +4,9 @@ const escapeHTML = escape;
 function stringifyForScript(value) {
   return JSON.stringify(value)?.replace(/</g, "\\u003c");
 }
+function escapeStyleText(value) {
+  return value.replaceAll("<", "\\3C ");
+}
 class HTMLBytes extends Uint8Array {
 }
 Object.defineProperty(HTMLBytes.prototype, Symbol.toStringTag, {
@@ -77,6 +80,7 @@ export {
   HTMLBytes,
   HTMLString,
   escapeHTML,
+  escapeStyleText,
   isHTMLBytes,
   isHTMLString,
   markHTMLString,

package/dist/runtime/server/render/csp.js

@@ -1,34 +1,95 @@
+import { partitionByKind } from "../../../core/csp/runtime.js";
 function renderCspContent(result) {
+  const { scriptDirective, styleDirective, directives } = result;
+  const script = partitionByKind(scriptDirective);
+  const style = partitionByKind(styleDirective);
   const finalScriptHashes = /* @__PURE__ */ new Set();
-  const finalStyleHashes = /* @__PURE__ */ new Set();
-  for (const scriptHash of result.scriptHashes) {
+  for (const scriptHash of script.default.hashes) {
     finalScriptHashes.add(`'${scriptHash}'`);
   }
-  for (const styleHash of result.styleHashes) {
+  for (const scriptHash of result._metadata.extraScriptHashes) {
+    finalScriptHashes.add(`'${scriptHash}'`);
+  }
+  const finalStyleHashes = /* @__PURE__ */ new Set();
+  for (const styleHash of style.default.hashes) {
     finalStyleHashes.add(`'${styleHash}'`);
   }
   for (const styleHash of result._metadata.extraStyleHashes) {
     finalStyleHashes.add(`'${styleHash}'`);
   }
-  for (const scriptHash of result._metadata.extraScriptHashes) {
-    finalScriptHashes.add(`'${scriptHash}'`);
-  }
-  let directives;
-  if (result.directives.length > 0) {
-    directives = result.directives.join(";") + ";";
+  let directivesContent;
+  if (directives.length > 0) {
+    directivesContent = directives.join(";") + ";";
   }
-  let scriptResources = "'self'";
-  if (result.scriptResources.length > 0) {
-    scriptResources = result.scriptResources.map((r) => `${r}`).join(" ");
+  const scriptResources = script.default.resources.length > 0 ? script.default.resources.join(" ") : "'self'";
+  const styleResources = style.default.resources.length > 0 ? style.default.resources.join(" ") : "'self'";
+  const scriptElementDefaultResource = script.default.resources.length > 0 ? "" : "'self'";
+  const styleElementDefaultResource = style.default.resources.length > 0 ? "" : "'self'";
+  const scriptElemActive = isEnabled(script.element);
+  const styleElemActive = isEnabled(style.element);
+  const strictDynamicSuffix = scriptDirective.strictDynamic ? ` 'strict-dynamic'` : "";
+  const scriptBaselineTokens = [
+    ...scriptElemActive ? [] : [...finalScriptHashes],
+    ...scriptDirective.strictDynamic ? [`'strict-dynamic'`] : []
+  ];
+  const scriptSrc = `script-src ${scriptResources} ${scriptBaselineTokens.join(" ")};`;
+  const styleSrc = `style-src ${styleResources} ${(styleElemActive ? [] : [...finalStyleHashes]).join(" ")};`;
+  const scriptSrcElem = scriptElemActive ? renderSpecificDirective(
+    "script-src-elem",
+    script.element.resources,
+    scriptElementDefaultResource,
+    finalScriptHashes,
+    script.element.hashes,
+    strictDynamicSuffix
+  ) : void 0;
+  const scriptSrcAttr = isEnabled(script.attribute) ? renderSpecificDirective(
+    "script-src-attr",
+    script.attribute.resources,
+    "'none'",
+    void 0,
+    script.attribute.hashes
+  ) : void 0;
+  const styleSrcElem = styleElemActive ? renderSpecificDirective(
+    "style-src-elem",
+    style.element.resources,
+    styleElementDefaultResource,
+    finalStyleHashes,
+    style.element.hashes
+  ) : void 0;
+  const styleSrcAttr = isEnabled(style.attribute) ? renderSpecificDirective(
+    "style-src-attr",
+    style.attribute.resources,
+    "'none'",
+    void 0,
+    style.attribute.hashes
+  ) : void 0;
+  return [
+    directivesContent,
+    scriptSrc,
+    scriptSrcElem,
+    scriptSrcAttr,
+    styleSrc,
+    styleSrcElem,
+    styleSrcAttr
+  ].filter(Boolean).join(" ");
+}
+function isEnabled(sources) {
+  return sources.resources.length > 0 || sources.hashes.length > 0;
+}
+function renderSpecificDirective(name, resources, defaultResource, sharedHashes, ownHashes, suffix = "") {
+  const hashes = new Set(sharedHashes);
+  for (const hash of ownHashes) {
+    hashes.add(`'${hash}'`);
   }
-  let styleResources = "'self'";
-  if (result.styleResources.length > 0) {
-    styleResources = result.styleResources.map((r) => `${r}`).join(" ");
+  let finalResources;
+  if (resources.length > 0) {
+    finalResources = resources.map((r) => `${r}`).join(" ");
+  } else if (defaultResource === "'none'" && hashes.size > 0) {
+    finalResources = "";
+  } else {
+    finalResources = defaultResource;
   }
-  const strictDynamic = result.isStrictDynamic ? ` 'strict-dynamic'` : "";
-  const scriptSrc = `script-src ${scriptResources} ${Array.from(finalScriptHashes).join(" ")}${strictDynamic};`;
-  const styleSrc = `style-src ${styleResources} ${Array.from(finalStyleHashes).join(" ")};`;
-  return [directives, scriptSrc, styleSrc].filter(Boolean).join(" ");
+  return `${name} ${[finalResources, ...hashes].filter(Boolean).join(" ")}${suffix};`;
 }
 export {
   renderCspContent

package/dist/runtime/server/render/server-islands.js

@@ -5,6 +5,7 @@ import { createThinHead } from "./astro/head-and-content.js";
 import { createRenderInstruction } from "./instruction.js";
 import { SERVER_ISLAND_START } from "./server-islands-shared.js";
 import { renderSlotToString } from "./slot.js";
+import { toAttributeString } from "./util.js";
 const internalProps = /* @__PURE__ */ new Set([
   "server:component-path",
   "server:component-export",
@@ -148,16 +149,17 @@ class ServerIslandComponent {
       serverIslandUrl += "?" + potentialSearchParams.toString();
       this.result._metadata.extraHead.push(
         markHTMLString(
-          `<link rel="preload" as="fetch" href="${serverIslandUrl}" crossorigin="anonymous">`
+          `<link rel="preload" as="fetch" href="${toAttributeString(serverIslandUrl)}" crossorigin="anonymous">`
         )
       );
     }
     const adapterHeaders = this.result.internalFetchHeaders || {};
     const headersJson = stringifyForScript(adapterHeaders);
+    const serverIslandUrlJson = stringifyForScript(serverIslandUrl);
     const method = useGETRequest ? (
       // GET request
       `const headers = new Headers(${headersJson});
-let response = await fetch('${serverIslandUrl}', { headers });`
+let response = await fetch(${serverIslandUrlJson}, { headers });`
     ) : (
       // POST request
       `let data = {
@@ -166,13 +168,13 @@ let response = await fetch('${serverIslandUrl}', { headers });`
 	encryptedSlots: ${stringifyForScript(slotsEncrypted)},
 };
 const headers = new Headers({ 'Content-Type': 'application/json', ...${headersJson} });
-let response = await fetch('${serverIslandUrl}', {
+let response = await fetch(${serverIslandUrlJson}, {
 	method: 'POST',
 	body: JSON.stringify(data),
 	headers,
 });`
     );
-    this.islandContent = `${method}replaceServerIsland('${hostId}', response);`;
+    this.islandContent = `${method}replaceServerIsland(${stringifyForScript(hostId)}, response);`;
     return this.islandContent;
   }
 }

package/dist/runtime/server/transition.js

@@ -1,6 +1,6 @@
 import cssesc from "../../transitions/cssesc.js";
 import { fade, slide } from "../../transitions/index.js";
-import { markHTMLString } from "./escape.js";
+import { escapeStyleText, markHTMLString } from "./escape.js";
 const transitionNameMap = /* @__PURE__ */ new WeakMap();
 function incrementTransitionNumber(result) {
   let num = 1;
@@ -56,7 +56,7 @@ function renderTransition(result, hash, animationName, transitionName) {
     sheet.addAnimationRaw("new", "animation: none; mix-blend-mode: normal;");
     sheet.addModern("group", "animation: none");
   }
-  const css = sheet.toString();
+  const css = escapeStyleText(sheet.toString());
   result._metadata.extraHead.push(markHTMLString(`<style>${css}</style>`));
   return scope;
 }

package/dist/types/astro.d.ts

@@ -1,4 +1,5 @@
 import type { Server } from 'node:http';
+import type { CspHash } from '../core/csp/config.js';
 import type { AstroTimer } from '../core/config/timer.js';
 import type { TSConfig } from '../core/config/tsconfig.js';
 import type { AstroLogger, AstroLoggerLevel } from '../core/logger/core.js';
@@ -18,7 +19,6 @@ export type SerializedRouteData = Omit<RouteData, 'generate' | 'pattern' | 'redi
         trailingSlash: AstroConfig['trailingSlash'];
     };
 };
-type CspObject = Required<Exclude<AstroConfig['security']['csp'], boolean>>;
 export interface AstroSettings {
     config: AstroConfig;
     adapter: AstroAdapter | undefined;
@@ -64,7 +64,7 @@ export interface AstroSettings {
     buildOutput: undefined | 'static' | 'server';
     injectedCsp: {
         fontResources: Set<string>;
-        styleHashes: Required<CspObject['styleDirective']>['hashes'];
+        styleHashes: CspHash[];
     };
     logLevel: AstroLoggerLevel;
     fontsHttpServer: Server | null;
@@ -89,4 +89,3 @@ export interface ImportedDevStyle {
     url: string;
     content: string;
 }
-export {};

package/dist/types/public/common.d.ts

@@ -36,6 +36,19 @@ export interface PaginateOptions<PaginateProps extends Props, PaginateParams ext
     params?: PaginateParams;
     /** object of props to forward to `page` result */
     props?: PaginateProps;
+    /**
+     * Transform each pagination URL before it is set on the page result.
+     * Useful for adding a file extension (e.g. `.html`) when deploying to a
+     * static file server that does not support clean URLs.
+     *
+     * @example
+     * ```ts
+     * paginate(items, {
+     *   format: (url) => `${url}.html`,
+     * })
+     * ```
+     */
+    format?: (url: string) => string;
 }
 /**
  * Represents a single page of data in a paginated collection

package/dist/types/public/config.d.ts

@@ -9,7 +9,7 @@ import type { AssetsPrefix } from '../../core/app/types.js';
 import type { CacheProviderConfig, RouteRules } from '../../core/cache/types.js';
 import type { AstroConfigType } from '../../core/config/schemas/index.js';
 import type { REDIRECT_STATUS_CODES } from '../../core/constants.js';
-import type { CspAlgorithm, CspDirective, CspHash } from '../../core/csp/config.js';
+import type { CspAlgorithm, CspDirective, CspHash, CspHashEntry, CspKind, CspResourceEntry } from '../../core/csp/config.js';
 import type { AstroLoggerLevel } from '../../core/logger/core.js';
 import type { SessionConfig, SessionDriverConfig, SessionDriverName } from '../../core/session/types.js';
 import type { EnvSchema } from '../../env/schema.js';
@@ -21,16 +21,16 @@ export type Locales = (string | {
     path: string;
 })[];
 export type { FontProvider };
-export type { CspAlgorithm, CspHash };
+export type { CspAlgorithm, CspHash, CspKind, CspResourceEntry, CspHashEntry };
 export type { RemotePattern };
 export type { SvgOptimizer };
 export type CspStyleDirective = {
-    hashes?: CspHash[];
-    resources?: string[];
+    hashes?: CspHashEntry[];
+    resources?: CspResourceEntry[];
 };
 export type CspScriptDirective = {
-    hashes?: CspHash[];
-    resources?: string[];
+    hashes?: CspHashEntry[];
+    resources?: CspResourceEntry[];
     strictDynamic?: boolean;
 };
 type NormalizeLocales<T extends Locales> = {
@@ -776,7 +776,7 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
                  * @docs
                  * @name security.csp.styleDirective.hashes
                  * @kind h6
-                 * @type {CspHash[]}
+                 * @type {CspHashEntry[]}
                  * @default `[]`
                  * @version 6.0.0
                  * @description
@@ -785,6 +785,13 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
                  *
                  * You must provide hashes that start with `sha384-`, `sha512-` or `sha256-`. Other values will cause a validation error. These hashes are added to all pages.
                  *
+                 * Since Astro v7.1, each entry can be a string or an object. The object allows changing the scope of the hash via the `kind` field. The `kind` field accepts:
+                 * - `"element"`: it will store the hash in the `style-src-elem` directive
+                 * - `"attribute"`: it will store the hash in the `style-src-attr` directive
+                 * - `"default"`: it will store the hash in the `style-src` directive
+                 *
+                 * A `"default"` hash goes on `style-src`, or on `style-src-elem` instead once you use `kind: "element"`. It is never added to `style-src-attr`. Astro's generated hashes follow the same rule.
+                 *
                  * ```js title="astro.config.mjs"
                  * import { defineConfig } from 'astro/config';
                  *
@@ -813,19 +820,56 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
                  *   "
                  * >
                  * ```
+                 *
+                 * Scoping a hash to `"element"` stores it in `style-src-elem` instead. Astro's generated hashes move there too:
+                 *
+                 * ```js title="astro.config.mjs"
+                 * import { defineConfig } from 'astro/config';
+                 *
+                 * export default defineConfig({
+                 *   security: {
+                 *     csp: {
+                 *       styleDirective: {
+                 *         hashes: [{ hash: "sha256-styleHash", kind: "element" }]
+                 *       }
+                 *     }
+                 *   }
+                 * });
+                 * ```
+                 *
+                 * After the build, the `<meta>` element will include the hash in the `style-src-elem` directive instead of `style-src`:
+                 *
+                 * ```html
+                 * <meta
+                 *   http-equiv="content-security-policy"
+                 *   content="
+                 *     style-src 'self';
+                 *     style-src-elem 'self' 'sha256-styleHash' 'sha256-generatedByAstro';
+                 *   "
+                 * >
+                 * ```
                  */
-                hashes?: CspHash[];
+                hashes?: CspHashEntry[];
                 /**
                  * @docs
                  * @name security.csp.styleDirective.resources
                  * @kind h6
-                 * @type {string[]}
+                 * @type {CspResourceEntry[]}
                  * @default `[]`
                  * @version 6.0.0
                  * @description
                  *
                  * A list of valid sources for `style-src` directives to override Astro's default sources. This will not include `'self'` by default, and must be included in this list if you wish to keep it. These resources are added to all pages.
                  *
+                 * Since Astro v7.1, each entry can be a string or an object. The object allows changing the scope of the source via the `kind` field. The `kind` field accepts:
+                 * - `"element"`: it will store the source in the `style-src-elem` directive
+                 * - `"attribute"`: it will store the source in the `style-src-attr` directive
+                 * - `"default"`: it will store the source in the `style-src` directive
+                 *
+                 * `"attribute"` sources must be one of `'none'`, `'unsafe-hashes'`, `'unsafe-inline'`, or `'report-sample'`, and `'unsafe-hashes'` cannot be used with `"element"`. A common use is allowing inline `style` attributes (for example, from `define:vars` or Shiki) with `{ resource: "'unsafe-inline'", kind: "attribute" }`.
+                 *
+                 * Unlike a hash, a `"default"` source is never moved: it stays on `style-src` only. Where there is a mix of "default" and specific resources (e.g. `"element"` or `"attribute"`), Astro emits a warning.
+                 *
                  * ```js title="astro.config.mjs"
                  * import { defineConfig } from 'astro/config';
                  *
@@ -856,9 +900,40 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
                  * </head>
                  * ```
                  *
+                 * A `"default"` source is not copied into the more specific directives. Here, a `"default"` source and an `"element"` source render in different directives:
+                 *
+                 * ```js title="astro.config.mjs"
+                 * import { defineConfig } from 'astro/config';
+                 *
+                 * export default defineConfig({
+                 *   security: {
+                 *     csp: {
+                 *       styleDirective: {
+                 *         resources: [
+                 *           "https://styles.cdn.example.com",
+                 *           { resource: "https://elements.cdn.example.com", kind: "element" }
+                 *         ]
+                 *       }
+                 *     }
+                 *   }
+                 * });
+                 * ```
+                 *
+                 * After the build, the `<meta>` element keeps `https://styles.cdn.example.com` on `style-src` only. This means that this value is not added to `style-src-elem` and does not apply to `<style>` and `<link>` elements (the generated hash, by contrast, does move there):
+                 *
+                 * ```html
+                 * <meta
+                 *   http-equiv="content-security-policy"
+                 *   content="
+                 *     style-src https://styles.cdn.example.com;
+                 *     style-src-elem https://elements.cdn.example.com 'sha256-generatedByAstro';
+                 *   "
+                 * >
+                 * ```
+                 *
                  * When resources are inserted multiple times or from multiple sources (e.g. defined in your `csp` config and added using [the CSP runtime API](/en/reference/api-reference/#csp)), Astro will merge and deduplicate all resources to create your `<meta>` element.
                  */
-                resources?: string[];
+                resources?: CspResourceEntry[];
             };
             /**
              * @docs
@@ -876,7 +951,7 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
                  * @docs
                  * @name security.csp.scriptDirective.hashes
                  * @kind h6
-                 * @type {CspHash[]}
+                 * @type {CspHashEntry[]}
                  * @default `[]`
                  * @version 6.0.0
                  * @description
@@ -885,6 +960,13 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
                  *
                  * You must provide hashes that start with `sha384-`, `sha512-` or `sha256-`. Other values will cause a validation error. These hashes are added to all pages.
                  *
+                 * Since Astro v7.1, each entry can be a string or an object. The object allows changing the scope of the hash via the `kind` field. The `kind` field accepts:
+                 * - `"element"`: it will store the hash in the `script-src-elem` directive
+                 * - `"attribute"`: it will store the hash in the `script-src-attr` directive
+                 * - `"default"`: it will store the hash in the `script-src` directive
+                 *
+                 * A `"default"` hash goes on `script-src`, or on `script-src-elem` instead once you use `kind: "element"`. It is never added to `script-src-attr`. Astro's generated hashes follow the same rule.
+                 *
                  * ```js title="astro.config.mjs"
                  * import { defineConfig } from 'astro/config';
                  *
@@ -913,19 +995,56 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
                  *   "
                  * >
                  * ```
+                 *
+                 * Scoping a hash to `"element"` stores it in `script-src-elem` instead. Astro's generated hashes move there too:
+                 *
+                 * ```js title="astro.config.mjs"
+                 * import { defineConfig } from 'astro/config';
+                 *
+                 * export default defineConfig({
+                 *   security: {
+                 *     csp: {
+                 *       scriptDirective: {
+                 *         hashes: [{ hash: "sha256-scriptHash", kind: "element" }]
+                 *       }
+                 *     }
+                 *   }
+                 * });
+                 * ```
+                 *
+                 * After the build, the `<meta>` element will include the hash in the `script-src-elem` directive instead of `script-src`:
+                 *
+                 * ```html
+                 * <meta
+                 *   http-equiv="content-security-policy"
+                 *   content="
+                 *     script-src 'self';
+                 *     script-src-elem 'self' 'sha256-scriptHash' 'sha256-generatedByAstro';
+                 *   "
+                 * >
+                 * ```
                  */
-                hashes?: CspHash[];
+                hashes?: CspHashEntry[];
                 /**
                  * @docs
                  * @name security.csp.scriptDirective.resources
                  * @kind h6
-                 * @type {string[]}
+                 * @type {CspResourceEntry[]}
                  * @default `[]`
                  * @version 6.0.0
                  * @description
                  *
                  * A list of valid sources for the `script-src` directives to override Astro's default sources. This will not include `'self'` by default, and must be included in this list if you wish to keep it. These resources are added to all pages.
                  *
+                 * Since Astro v7.1, each entry can be a string or an object. The object allows changing the scope of the source via the `kind` field. The `kind` field accepts:
+                 * - `"element"`: it will store the source in the `script-src-elem` directive
+                 * - `"attribute"`: it will store the source in the `script-src-attr` directive
+                 * - `"default"`: it will store the source in the `script-src` directive
+                 *
+                 * `"attribute"` sources must be one of `'none'`, `'unsafe-hashes'`, `'unsafe-inline'`, or `'report-sample'`, and `'unsafe-hashes'` cannot be used with `"element"`.
+                 *
+                 * Unlike a hash, a `"default"` source is never moved and stays on `script-src` only. This does not apply where you also scope `"element"` or `"attribute"` sources, since browsers do not fall back. Astro warns when this happens. Add it to the more specific directive as well, if necessary.
+                 *
                  * ```js title="astro.config.mjs"
                  * import { defineConfig } from 'astro/config';
                  *
@@ -955,9 +1074,40 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
                  * </head>
                  * ```
                  *
+                 * A `"default"` source is not copied into the more specific directives. Here, a `"default"` source and an `"element"` source render in different directives:
+                 *
+                 * ```js title="astro.config.mjs"
+                 * import { defineConfig } from 'astro/config';
+                 *
+                 * export default defineConfig({
+                 *   security: {
+                 *     csp: {
+                 *       scriptDirective: {
+                 *         resources: [
+                 *           "https://cdn.example.com",
+                 *           { resource: "https://elements.cdn.example.com", kind: "element" }
+                 *         ]
+                 *       }
+                 *     }
+                 *   }
+                 * });
+                 * ```
+                 *
+                 * After the build, the `<meta>` element keeps `https://cdn.example.com` on `script-src` only. This means that this value is not added to `script-src-elem` and does not apply to `<script>` elements (the generated hash, by contrast, does move there):
+                 *
+                 * ```html
+                 * <meta
+                 *   http-equiv="content-security-policy"
+                 *   content="
+                 *     script-src https://cdn.example.com;
+                 *     script-src-elem https://elements.cdn.example.com 'sha256-generatedByAstro';
+                 *   "
+                 * >
+                 * ```
+                 *
                  * When resources are inserted multiple times or from multiple sources (e.g. defined in your `csp` config and added using [the CSP runtime API](/en/reference/api-reference/#csp)), Astro will merge and deduplicate all resources to create your `<meta>` element.
                  */
-                resources?: string[];
+                resources?: CspResourceEntry[];
                 /**
                  * @docs
                  * @name security.csp.scriptDirective.strictDynamic
@@ -982,6 +1132,8 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
                  *   }
                  * });
                  * ```
+                 *
+                 * This applies to `script-src`. When you also scope `script` resources or hashes to `script-src-elem` (using `kind: "element"`), `strict-dynamic` is inherited by `script-src-elem` so that dynamically injected `<script>` elements continue to work.
                  */
                 strictDynamic?: boolean;
             };
@@ -1379,7 +1531,7 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
     /**
      * @docs
      * @name logger.entrypoint
-     * @type {string}
+     * @type {string | URL}
      * @version 7.0.0
      * @description
      *
@@ -2974,6 +3126,35 @@ export interface AstroUserConfig<TLocales extends Locales = never, TDriver exten
          * See the [experimental SVG optimization docs](https://docs.astro.build/en/reference/experimental-flags/svg-optimization/) for more information.
          */
         svgOptimizer?: SvgOptimizer;
+        /**
+         * @name experimental.collectionStorage
+         * @type {'single-file' | 'chunked'}
+         * @default `'single-file'`
+         * @version 7.1.0
+         * @description
+         *
+         * Controls how Astro persists the content layer data store.
+         *
+         * By default, the entire store is written to a single `data-store.json`
+         * file. For very large content collections, this file can grow large
+         * enough to hit platform file-size limits.
+         *
+         * When set to `'chunked'`, the store is split across many smaller,
+         * content-addressed files so that no single file grows unbounded.
+         *
+         * ```js
+         * import { defineConfig } from 'astro/config';
+         *
+         * export default defineConfig({
+         *   experimental: {
+         *     collectionStorage: 'chunked',
+         *   },
+         * });
+         * ```
+         *
+         * See the [experimental data store chunking documentation](https://docs.astro.build/en/reference/experimental-flags/collection-storage/) for more information.
+         */
+        collectionStorage?: 'single-file' | 'chunked';
     };
 }
 /**