X_CSP_DIRECTIVE_INVALID

a csp extension would emit something other than the directive it names

a security.csp.extend key that is not a CSP directive token, or a source carrying one of the header's own separators — { 'x; script-src *': [] } is not one badly named directive, it is a second directive nobody declared, widening the one the framework locks down hardest. Refused at defineHttpConfig, because there is no encoding for a CSP directive and escaping it at emission time is not a repair

in the configureHttp({ security: { csp: { extend } } }) call write one entry per directive, each source its own array element — a directive name is [a-z][a-z0-9-]*, and no source may contain a space, a comma or a semicolon