From dabcc68b210420f2bac18ba99d64454f5fef9294 Mon Sep 17 00:00:00 2001
From: cesnimda <connor.babbington@cesnimda.co.uk>
Date: Sat, 11 Jul 2026 13:17:24 +0200
Subject: [PATCH] fix: externalize hoisted scripts so CSP script-src 'self'
 allows them

Astro was inlining the theme/nav/observer bundle as <script type="module">.
The deployed nginx CSP blocks inline scripts, so the reveal observer never
ran and every [data-reveal] section stayed at opacity:0 (space reserved,
nothing visible). Force JS external via assetsInlineLimit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 site/astro.config.mjs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/site/astro.config.mjs b/site/astro.config.mjs
index 473603b..c3ab04b 100644
--- a/site/astro.config.mjs
+++ b/site/astro.config.mjs
@@ -26,6 +26,10 @@ export default defineConfig({
   compressHTML: true,
   vite: {
     plugins: [tailwindcss()],
+    // Never inline JS: the deployed CSP is `script-src 'self'`, which blocks inline
+    // <script> modules. Keep hoisted scripts as external /_astro/*.js so CSP allows them.
+    // (Images etc. fall back to the default inline threshold.)
+    build: { assetsInlineLimit: (file) => (file.endsWith('.js') ? false : undefined) },
     resolve: {
       alias: {
         '@': r('./src'),