feat(@astrojs/vercel): add globalCsp option to experimentalStaticHeaders

[moonclavedev]

Changes

• Adds globalCsp option to experimentalStaticHeaders configuration in @astrojs/vercel
• Prevents "Body exceeded 3300kb limit" Vercel build errors for large sites with CSP enabled
• Consolidates duplicate CSP headers into a single catch-all /(.*) route entry
• Reduces .vercel/output/config.json file size from MB to KB for large sites
• Maintains full backward compatibility with existing experimentalStaticHeaders: true usage

Astro Site with ~2,500 static pages:

Before: 15k+ individual CSP route entries → 9MB config file → Vercel build failure
After: 1 global CSP route entry → 10KB config file → Successful builds

Usage:

// Default (unchanged)
experimentalStaticHeaders: true

// New global option
experimentalStaticHeaders: {
  globalCsp: true
}

Reference: #13996 (comment)

Testing

• Extended existing test/static-headers.test.js with global CSP mode tests
• Added test/fixtures/static-headers-global/ fixture to test global CSP functionality
• Verified global mode creates single /(.*) route with CSP header
• Confirmed backward compatibility with existing boolean configuration
• All tests passing: 3 tests, 2 suites, 0 failures

Test command: cd packages/integrations/vercel && node --test test/static-headers.test.js

Docs

This change affects user behavior for large sites experiencing Vercel build size limits. Documentation updates needed for:

• New globalCsp option in Vercel adapter configuration
• When to use global vs per-route CSP (large sites vs granular control)
• Migration guide for sites hitting Vercel build limits

/cc @withastro/maintainers-docs for feedback!

[changeset-bot]

🦋 Changeset detected

Latest commit: 2466f7a

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[ascorbic]

I don't think this belongs in the adapter. If we were to support something like this, it should be part of the CSP feature in core, not the static headers feature in adapters.