fix(head): avoid CSP warnings when disabled

.changeset/quiet-heads-rest.md

@@ -0,0 +1,5 @@
+---
+"emdash": patch
+---
+
+Avoid production render warnings when Astro's built-in CSP is disabled while preserving JSON-LD script hashes when it is enabled.

packages/core/src/astro/integration/index.ts

@@ -381,6 +381,9 @@ export function emdash(config: EmDashConfig = {}): AstroIntegration {
 				if (astroVersion !== undefined) {
 					serializableConfig.astroVersion = astroVersion;
 				}
+				// EmDashHead must not access Astro.csp when the host has disabled
+				// Astro's built-in CSP runtime; Astro logs a warning for that access.
+				serializableConfig.astroCspEnabled = Boolean(astroConfig.security.csp);
 				// Extract i18n config from Astro config
 				// Astro locales can be strings OR { path, codes } objects — normalize to paths
 				if (astroConfig.i18n) {

packages/core/src/components/EmDashHead.astro

@@ -17,8 +17,10 @@
  * ```
  */
 import type { PublicPageContext, PageMetadataContribution } from "../plugins/types.js";
+// @ts-ignore - virtual module
+import virtualConfig from "virtual:emdash/config";
 import {
-	createSha256CspHash,
+	registerJsonLdCspHashes,
 	resolvePageMetadata,
 	renderPageMetadata,
 	type ResolvedPageMetadata,
@@ -124,13 +126,7 @@ if (runtime) {
 	metadataHtml = renderPageMetadata(resolved, { includeJsonLd: false });
 }
 
-if (Astro.csp && jsonLdScripts.length > 0) {
-	await Promise.all(
-		jsonLdScripts.map(async ({ json }) => {
-			Astro.csp?.insertScriptHash(await createSha256CspHash(json));
-		}),
-	);
-}
+await registerJsonLdCspHashes(virtualConfig.astroCspEnabled === true, () => Astro.csp, jsonLdScripts);
 ---
 
 <Fragment set:html={metadataHtml} />

packages/core/src/page/metadata.ts

@@ -80,6 +80,33 @@ export async function createSha256CspHash(value: string): Promise<string> {
 	return `sha256-${btoa(binary)}`;
 }
 
+interface CspScriptHashSink {
+	insertScriptHash(hash: string): void;
+}
+
+/**
+ * Register JSON-LD hashes with Astro's CSP runtime when CSP is enabled.
+ *
+ * The getter stays lazy because Astro warns when `Astro.csp` is accessed on a
+ * project that has not enabled its built-in CSP support.
+ */
+export async function registerJsonLdCspHashes(
+	enabled: boolean,
+	getCsp: () => CspScriptHashSink | undefined,
+	scripts: ReadonlyArray<{ json: string }>,
+): Promise<void> {
+	if (!enabled || scripts.length === 0) return;
+
+	const csp = getCsp();
+	if (!csp) return;
+
+	await Promise.all(
+		scripts.map(async ({ json }) => {
+			csp.insertScriptHash(await createSha256CspHash(json));
+		}),
+	);
+}
+
 // ── Merge / dedupe ──────────────────────────────────────────────
 
 /**

packages/core/src/virtual-modules.d.ts

@@ -21,6 +21,7 @@ declare module "virtual:emdash/config" {
 		authProviders?: AuthProviderDescriptor[];
 		i18n?: I18nConfig | null;
 		toolbar?: "server" | "client" | false;
+		astroCspEnabled?: boolean;
 	}
 
 	const config: VirtualConfig;

packages/core/tests/unit/plugins/page-metadata.test.ts

@@ -8,14 +8,15 @@
  * - HTML attribute escaping
  */
 
-import { describe, it, expect } from "vitest";
+import { describe, it, expect, vi } from "vitest";
 
 import {
 	resolvePageMetadata,
 	renderPageMetadata,
 	safeJsonLdSerialize,
 	escapeHtmlAttr,
 	createSha256CspHash,
+	registerJsonLdCspHashes,
 } from "../../../src/page/metadata.js";
 import type { PageMetadataContribution } from "../../../src/plugins/types.js";
 
@@ -317,6 +318,33 @@ describe("createSha256CspHash", () => {
 	});
 });
 
+describe("registerJsonLdCspHashes", () => {
+	it("does not access Astro's CSP getter when CSP is disabled", async () => {
+		const getCsp = vi.fn(() => {
+			throw new Error("CSP getter must stay lazy");
+		});
+
+		await registerJsonLdCspHashes(false, getCsp, [{ json: '{"@type":"WebSite"}' }]);
+
+		expect(getCsp).not.toHaveBeenCalled();
+	});
+
+	it("registers every JSON-LD hash when CSP is enabled", async () => {
+		const insertScriptHash = vi.fn();
+		const getCsp = vi.fn(() => ({ insertScriptHash }));
+		const scripts = [{ json: '{"@type":"WebSite"}' }, { json: '{"@type":"Organization"}' }];
+
+		await registerJsonLdCspHashes(true, getCsp, scripts);
+		const hash0 = await createSha256CspHash(scripts[0].json);
+		const hash1 = await createSha256CspHash(scripts[1].json);
+
+		expect(getCsp).toHaveBeenCalledOnce();
+		expect(insertScriptHash).toHaveBeenCalledTimes(2);
+		expect(insertScriptHash).toHaveBeenCalledWith(hash0);
+		expect(insertScriptHash).toHaveBeenCalledWith(hash1);
+	});
+});
+
 describe("escapeHtmlAttr", () => {
 	it("escapes double quotes", () => {
 		expect(escapeHtmlAttr('say "hello"')).toBe("say "hello"");