astro 4.13.2 → 4.13.4

package/dist/@types/astro.d.ts

@@ -1842,25 +1842,29 @@ export interface AstroUserConfig {
          * @version 4.10.0
          * @description
          *
-         * Enables experimental `astro:env` features .
+         * Enables experimental `astro:env` features.
          *
          * The `astro:env` API lets you configure a type-safe schema for your environment variables, and indicate whether they should be available on the server or the client. Import and use your defined variables from the appropriate `/client` or `/server` module:
          *
          * ```astro
          * ---
-         * import { APP_ID } from "astro:env/client"
-         * import { API_URL, API_TOKEN, getSecret } from "astro:env/server"
-         * const NODE_ENV = getSecret("NODE_ENV")
+         * import { API_URL } from "astro:env/client"
+         * import { API_SECRET_TOKEN } from "astro:env/server"
          *
          * const data = await fetch(`${API_URL}/users`, {
-         * 	method: "POST",
+         * 	method: "GET",
          * 	headers: {
          * 		"Content-Type": "application/json",
-         * 		"Authorization": `Bearer ${API_TOKEN}`
+         * 		"Authorization": `Bearer ${API_SECRET_TOKEN}`
          * 	},
-         * 	body: JSON.stringify({ appId: APP_ID, nodeEnv: NODE_ENV })
          * })
          * ---
+         *
+         * <script>
+         * import { API_URL } from "astro:env/client"
+         *
+         * fetch(`${API_URL}/ping`)
+         * </script>
          * ```
          *
          * To define the data type and properties of your environment variables, declare a schema in your Astro config in `experimental.env.schema`. The `envField` helper allows you define your variable as a string, number, or boolean and pass properties in an object:
@@ -1898,7 +1902,7 @@ export interface AstroUserConfig {
          *     import { PORT } from "astro:env/server"
          *     ```
          *
-         * - **Secret server variables**: These variables are not part of your final bundle and can be accessed on the server through the `astro:env/server` module. The `getSecret()` helper function can be used to retrieve secrets not specified in the schema:
+         * - **Secret server variables**: These variables are not part of your final bundle and can be accessed on the server through the `astro:env/server` module. The `getSecret()` helper function can be used to retrieve secrets not specified in the schema. Its implementation is provided by your adapter and defaults to `process.env`:
          *
          *     ```js
          *     import { API_SECRET, getSecret } from "astro:env/server"
@@ -2163,7 +2167,7 @@ export type GetDataEntryInfoReturnType = {
 };
 export interface AstroAdapterFeatures {
     /**
-     * Creates and edge function that will communiate with the Astro middleware
+     * Creates an edge function that will communiate with the Astro middleware
      */
     edgeMiddleware: boolean;
     /**
@@ -2956,6 +2960,7 @@ export interface SSRResult {
     cookies: AstroCookies | undefined;
     serverIslandNameMap: Map<string, string>;
     trailingSlash: AstroConfig['trailingSlash'];
+    key: Promise<CryptoKey>;
     _metadata: SSRMetadata;
 }
 /**

package/dist/actions/consts.d.ts

@@ -4,3 +4,8 @@ export declare const ACTIONS_TYPES_FILE = "actions.d.ts";
 export declare const VIRTUAL_INTERNAL_MODULE_ID = "astro:internal-actions";
 export declare const RESOLVED_VIRTUAL_INTERNAL_MODULE_ID = "\0astro:internal-actions";
 export declare const NOOP_ACTIONS = "\0noop-actions";
+export declare const ACTION_QUERY_PARAMS: {
+    actionName: string;
+    actionPayload: string;
+    actionRedirect: string;
+};

package/dist/actions/consts.js

@@ -4,8 +4,14 @@ const ACTIONS_TYPES_FILE = "actions.d.ts";
 const VIRTUAL_INTERNAL_MODULE_ID = "astro:internal-actions";
 const RESOLVED_VIRTUAL_INTERNAL_MODULE_ID = "\0astro:internal-actions";
 const NOOP_ACTIONS = "\0noop-actions";
+const ACTION_QUERY_PARAMS = {
+  actionName: "_astroAction",
+  actionPayload: "_astroActionPayload",
+  actionRedirect: "_astroActionRedirect"
+};
 export {
   ACTIONS_TYPES_FILE,
+  ACTION_QUERY_PARAMS,
   NOOP_ACTIONS,
   RESOLVED_VIRTUAL_INTERNAL_MODULE_ID,
   RESOLVED_VIRTUAL_MODULE_ID,

package/dist/actions/runtime/middleware.d.ts

@@ -1,8 +1,9 @@
 import { type SerializedActionResult } from './virtual/shared.js';
+export type ActionPayload = {
+    actionResult: SerializedActionResult;
+    actionName: string;
+};
 export type Locals = {
-    _actionsInternal: {
-        actionResult: SerializedActionResult;
-        actionName: string;
-    };
+    _actionPayload: ActionPayload;
 };
 export declare const onRequest: import("../../@types/astro.js").MiddlewareHandler;

package/dist/actions/runtime/middleware.js

@@ -2,6 +2,7 @@ import { yellow } from "kleur/colors";
 import { ActionQueryStringInvalidError } from "../../core/errors/errors-data.js";
 import { AstroError } from "../../core/errors/errors.js";
 import { defineMiddleware } from "../../core/middleware/index.js";
+import { ACTION_QUERY_PARAMS } from "../consts.js";
 import { formContentTypes, hasContentType } from "./utils.js";
 import { getAction } from "./virtual/get-action.js";
 import {
@@ -10,7 +11,14 @@ import {
 const onRequest = defineMiddleware(async (context, next) => {
   const locals = context.locals;
   const { request } = context;
-  if (locals._actionsInternal) return next();
+  if (locals._actionPayload) return next();
+  const actionPayload = context.cookies.get(ACTION_QUERY_PARAMS.actionPayload)?.json();
+  if (actionPayload) {
+    if (!isActionPayload(actionPayload)) {
+      throw new Error("Internal: Invalid action payload in cookie.");
+    }
+    return renderResult({ context, next, ...actionPayload });
+  }
   if (import.meta.env.DEV && request.method === "POST" && request.body === null) {
     console.warn(
       yellow("[astro:actions]"),
@@ -18,7 +26,7 @@ const onRequest = defineMiddleware(async (context, next) => {
     );
     return next();
   }
-  const actionName = context.url.searchParams.get("_astroAction");
+  const actionName = context.url.searchParams.get(ACTION_QUERY_PARAMS.actionName);
   if (context.request.method === "POST" && actionName) {
     return handlePost({ context, next, actionName });
   }
@@ -27,6 +35,25 @@ const onRequest = defineMiddleware(async (context, next) => {
   }
   return next();
 });
+async function renderResult({
+  context,
+  next,
+  actionResult,
+  actionName
+}) {
+  const locals = context.locals;
+  locals._actionPayload = { actionResult, actionName };
+  const response = await next();
+  context.cookies.delete(ACTION_QUERY_PARAMS.actionPayload);
+  if (actionResult.type === "error") {
+    return new Response(response.body, {
+      status: actionResult.status,
+      statusText: actionResult.type,
+      headers: response.headers
+    });
+  }
+  return response;
+}
 async function handlePost({
   context,
   next,
@@ -47,28 +74,33 @@ async function handlePost({
   }
   const action = baseAction.bind(context);
   const actionResult = await action(formData);
-  return handleResult({ context, next, actionName, actionResult });
+  if (context.url.searchParams.get(ACTION_QUERY_PARAMS.actionRedirect) === "false") {
+    return renderResult({
+      context,
+      next,
+      actionName,
+      actionResult: serializeActionResult(actionResult)
+    });
+  }
+  return redirectWithResult({ context, actionName, actionResult });
 }
-async function handleResult({
+async function redirectWithResult({
   context,
-  next,
   actionName,
   actionResult
 }) {
-  const locals = context.locals;
-  locals._actionsInternal = {
+  context.cookies.set(ACTION_QUERY_PARAMS.actionPayload, {
     actionName,
     actionResult: serializeActionResult(actionResult)
-  };
-  const response = await next();
+  });
   if (actionResult.error) {
-    return new Response(response.body, {
-      status: actionResult.error.status,
-      statusText: actionResult.error.type,
-      headers: response.headers
-    });
+    const referer = context.request.headers.get("Referer");
+    if (!referer) {
+      throw new Error("Internal: Referer unexpectedly missing from Action POST request.");
+    }
+    return context.redirect(referer);
   }
-  return response;
+  return context.redirect(context.url.pathname);
 }
 async function handlePostLegacy({ context, next }) {
   const { request } = context;
@@ -79,7 +111,7 @@ async function handlePostLegacy({ context, next }) {
     formData = await request.clone().formData();
   }
   if (!formData) return next();
-  const actionName = formData.get("_astroAction");
+  const actionName = formData.get(ACTION_QUERY_PARAMS.actionName);
   if (!actionName) return next();
   const baseAction = await getAction(actionName);
   if (!baseAction) {
@@ -90,7 +122,13 @@ async function handlePostLegacy({ context, next }) {
   }
   const action = baseAction.bind(context);
   const actionResult = await action(formData);
-  return handleResult({ context, next, actionName, actionResult });
+  return redirectWithResult({ context, actionName, actionResult });
+}
+function isActionPayload(json) {
+  if (typeof json !== "object" || json == null) return false;
+  if (!("actionResult" in json) || typeof json.actionResult !== "object") return false;
+  if (!("actionName" in json) || typeof json.actionName !== "string") return false;
+  return true;
 }
 export {
   onRequest

package/dist/actions/runtime/virtual/server.d.ts

@@ -10,7 +10,7 @@ export type ActionReturnType<T extends ActionHandler<any, any>> = Awaited<Return
 export type ActionClient<TOutput, TAccept extends ActionAccept | undefined, TInputSchema extends ActionInputSchema<TAccept> | undefined> = TInputSchema extends z.ZodType ? ((input: TAccept extends 'form' ? FormData : z.input<TInputSchema>) => Promise<SafeResult<z.input<TInputSchema> extends ErrorInferenceObject ? z.input<TInputSchema> : ErrorInferenceObject, Awaited<TOutput>>>) & {
     queryString: string;
     orThrow: (input: TAccept extends 'form' ? FormData : z.input<TInputSchema>) => Promise<Awaited<TOutput>>;
-} : (input?: any) => Promise<SafeResult<never, Awaited<TOutput>>> & {
+} : ((input?: any) => Promise<SafeResult<never, Awaited<TOutput>>>) & {
     orThrow: (input?: any) => Promise<Awaited<TOutput>>;
 };
 export declare function defineAction<TOutput, TAccept extends ActionAccept | undefined = undefined, TInputSchema extends ActionInputSchema<ActionAccept> | undefined = TAccept extends 'form' ? z.ZodType<FormData> : undefined>({ accept, input: inputSchema, handler, }: {

package/dist/actions/runtime/virtual/server.js

@@ -62,11 +62,17 @@ function formDataToObject(formData, schema) {
   const obj = {};
   for (const [key, baseValidator] of Object.entries(schema.shape)) {
     let validator = baseValidator;
-    while (validator instanceof z.ZodOptional || validator instanceof z.ZodNullable) {
+    while (validator instanceof z.ZodOptional || validator instanceof z.ZodNullable || validator instanceof z.ZodDefault) {
+      if (validator instanceof z.ZodDefault && !formData.has(key)) {
+        obj[key] = validator._def.defaultValue();
+      }
       validator = validator._def.innerType;
     }
-    if (validator instanceof z.ZodBoolean) {
-      obj[key] = formData.has(key);
+    if (!formData.has(key) && key in obj) {
+      continue;
+    } else if (validator instanceof z.ZodBoolean) {
+      const val = formData.get(key);
+      obj[key] = val === "true" ? true : val === "false" ? false : formData.has(key);
     } else if (validator instanceof z.ZodArray) {
       obj[key] = handleFormDataGetAll(key, formData, validator);
     } else {

package/dist/actions/runtime/virtual/shared.d.ts

@@ -1,5 +1,10 @@
 import type { z } from 'zod';
 import type { ErrorInferenceObject, MaybePromise } from '../utils.js';
+export declare const ACTION_QUERY_PARAMS: {
+    actionName: string;
+    actionPayload: string;
+    actionRedirect: string;
+};
 export declare const ACTION_ERROR_CODES: readonly ["BAD_REQUEST", "UNAUTHORIZED", "FORBIDDEN", "NOT_FOUND", "TIMEOUT", "CONFLICT", "PRECONDITION_FAILED", "PAYLOAD_TOO_LARGE", "UNSUPPORTED_MEDIA_TYPE", "UNPROCESSABLE_CONTENT", "TOO_MANY_REQUESTS", "CLIENT_CLOSED_REQUEST", "INTERNAL_SERVER_ERROR"];
 export type ActionErrorCode = (typeof ACTION_ERROR_CODES)[number];
 export declare class ActionError<T extends ErrorInferenceObject = ErrorInferenceObject> extends Error {

package/dist/actions/runtime/virtual/shared.js

@@ -1,4 +1,6 @@
 import { parse as devalueParse, stringify as devalueStringify } from "devalue";
+import { ACTION_QUERY_PARAMS as _ACTION_QUERY_PARAMS } from "../../consts.js";
+const ACTION_QUERY_PARAMS = _ACTION_QUERY_PARAMS;
 const ACTION_ERROR_CODES = [
   "BAD_REQUEST",
   "UNAUTHORIZED",
@@ -113,7 +115,7 @@ async function callSafely(handler) {
   }
 }
 function getActionQueryString(name) {
-  const searchParams = new URLSearchParams({ _astroAction: name });
+  const searchParams = new URLSearchParams({ [_ACTION_QUERY_PARAMS.actionName]: name });
   return `?${searchParams.toString()}`;
 }
 function getActionProps(action) {
@@ -130,14 +132,16 @@ function getActionProps(action) {
 }
 function serializeActionResult(res) {
   if (res.error) {
+    if (import.meta.env?.DEV) {
+      actionResultErrorStack.set(res.error.stack);
+    }
     return {
       type: "error",
       status: res.error.status,
       contentType: "application/json",
       body: JSON.stringify({
         ...res.error,
-        message: res.error.message,
-        stack: import.meta.env.PROD ? void 0 : res.error.stack
+        message: res.error.message
       })
     };
   }
@@ -159,7 +163,16 @@ function serializeActionResult(res) {
 }
 function deserializeActionResult(res) {
   if (res.type === "error") {
-    return { error: ActionError.fromJson(JSON.parse(res.body)), data: void 0 };
+    if (import.meta.env?.PROD) {
+      return { error: ActionError.fromJson(JSON.parse(res.body)), data: void 0 };
+    } else {
+      const error = ActionError.fromJson(JSON.parse(res.body));
+      error.stack = actionResultErrorStack.get();
+      return {
+        error,
+        data: void 0
+      };
+    }
   }
   if (res.type === "empty") {
     return { data: void 0, error: void 0 };
@@ -171,8 +184,20 @@ function deserializeActionResult(res) {
     error: void 0
   };
 }
+const actionResultErrorStack = /* @__PURE__ */ function actionResultErrorStackFn() {
+  let errorStack;
+  return {
+    set(stack) {
+      errorStack = stack;
+    },
+    get() {
+      return errorStack;
+    }
+  };
+}();
 export {
   ACTION_ERROR_CODES,
+  ACTION_QUERY_PARAMS,
   ActionError,
   ActionInputError,
   callSafely,

package/dist/actions/utils.d.ts

@@ -1,6 +1,6 @@
 import type { APIContext } from '../@types/astro.js';
 import type { Locals } from './runtime/middleware.js';
 import { type ActionAPIContext } from './runtime/utils.js';
-export declare function hasActionsInternal(locals: APIContext['locals']): locals is Locals;
+export declare function hasActionPayload(locals: APIContext['locals']): locals is Locals;
 export declare function createGetActionResult(locals: APIContext['locals']): APIContext['getActionResult'];
 export declare function createCallAction(context: ActionAPIContext): APIContext['callAction'];

package/dist/actions/utils.js

@@ -1,14 +1,14 @@
 import {} from "./runtime/utils.js";
 import { deserializeActionResult, getActionQueryString } from "./runtime/virtual/shared.js";
-function hasActionsInternal(locals) {
-  return "_actionsInternal" in locals;
+function hasActionPayload(locals) {
+  return "_actionPayload" in locals;
 }
 function createGetActionResult(locals) {
   return (actionFn) => {
-    if (!hasActionsInternal(locals) || actionFn.toString() !== getActionQueryString(locals._actionsInternal.actionName)) {
+    if (!hasActionPayload(locals) || actionFn.toString() !== getActionQueryString(locals._actionPayload.actionName)) {
       return void 0;
     }
-    return deserializeActionResult(locals._actionsInternal.actionResult);
+    return deserializeActionResult(locals._actionPayload.actionResult);
   };
 }
 function createCallAction(context) {
@@ -20,5 +20,5 @@ function createCallAction(context) {
 export {
   createCallAction,
   createGetActionResult,
-  hasActionsInternal
+  hasActionPayload
 };

package/dist/container/index.js

@@ -2,6 +2,7 @@ import { posix } from "node:path";
 import { getDefaultClientDirectives } from "../core/client-directive/index.js";
 import { ASTRO_CONFIG_DEFAULTS } from "../core/config/schema.js";
 import { validateConfig } from "../core/config/validate.js";
+import { createKey } from "../core/encryption.js";
 import { Logger } from "../core/logger/core.js";
 import { nodeLogDestination } from "../core/logger/node.js";
 import { removeLeadingForwardSlash } from "../core/path.js";
@@ -31,7 +32,8 @@ function createManifest(manifest, renderers, middleware) {
     i18n: manifest?.i18n,
     checkOrigin: false,
     middleware: manifest?.middleware ?? middleware ?? defaultMiddleware,
-    experimentalEnvGetSecretEnabled: false
+    experimentalEnvGetSecretEnabled: false,
+    key: createKey()
   };
 }
 class experimental_AstroContainer {

package/dist/core/app/common.js

@@ -1,3 +1,4 @@
+import { decodeKey } from "../encryption.js";
 import { deserializeRouteData } from "../routing/manifest/serialization.js";
 function deserializeManifest(serializedManifest) {
   const routes = [];
@@ -14,6 +15,7 @@ function deserializeManifest(serializedManifest) {
   const inlinedScripts = new Map(serializedManifest.inlinedScripts);
   const clientDirectives = new Map(serializedManifest.clientDirectives);
   const serverIslandNameMap = new Map(serializedManifest.serverIslandNameMap);
+  const key = decodeKey(serializedManifest.key);
   return {
     // in case user middleware exists, this no-op middleware will be reassigned (see plugin-ssr.ts)
     middleware(_, next) {
@@ -25,7 +27,8 @@ function deserializeManifest(serializedManifest) {
     inlinedScripts,
     clientDirectives,
     routes,
-    serverIslandNameMap
+    serverIslandNameMap,
+    key
   };
 }
 export {

package/dist/core/app/index.js

@@ -298,9 +298,11 @@ class App {
           `${this.#baseWithoutTrailingSlash}/${status}${maybeDotHtml}`,
           url
         );
-        const response2 = await fetch(statusURL.toString());
-        const override = { status };
-        return this.#mergeResponses(response2, originalResponse, override);
+        if (statusURL.toString() !== request.url) {
+          const response2 = await fetch(statusURL.toString());
+          const override = { status };
+          return this.#mergeResponses(response2, originalResponse, override);
+        }
       }
       const mod = await this.#pipeline.getModuleForRoute(errorRouteData);
       try {

package/dist/core/app/types.d.ts

@@ -52,6 +52,7 @@ export type SSRManifest = {
     pageMap?: Map<ComponentPath, ImportComponentInstance>;
     serverIslandMap?: Map<string, () => Promise<ComponentInstance>>;
     serverIslandNameMap?: Map<string, string>;
+    key: Promise<CryptoKey>;
     i18n: SSRManifestI18n | undefined;
     middleware: MiddlewareHandler;
     checkOrigin: boolean;
@@ -64,11 +65,12 @@ export type SSRManifestI18n = {
     defaultLocale: string;
     domainLookupTable: Record<string, string>;
 };
-export type SerializedSSRManifest = Omit<SSRManifest, 'middleware' | 'routes' | 'assets' | 'componentMetadata' | 'inlinedScripts' | 'clientDirectives' | 'serverIslandNameMap'> & {
+export type SerializedSSRManifest = Omit<SSRManifest, 'middleware' | 'routes' | 'assets' | 'componentMetadata' | 'inlinedScripts' | 'clientDirectives' | 'serverIslandNameMap' | 'key'> & {
     routes: SerializedRouteInfo[];
     assets: string[];
     componentMetadata: [string, SSRComponentMetadata][];
     inlinedScripts: [string, string][];
     clientDirectives: [string, string][];
     serverIslandNameMap: [string, string][];
+    key: string;
 };

package/dist/core/build/generate.js

@@ -54,7 +54,8 @@ async function generatePages(options, internals) {
       options.settings,
       internals,
       renderers.renderers,
-      middleware
+      middleware,
+      options.key
     );
   }
   const pipeline = BuildPipeline.create({ internals, manifest, options });
@@ -358,7 +359,7 @@ function getPrettyRouteName(route) {
     return route.component;
   }
 }
-function createBuildManifest(settings, internals, renderers, middleware) {
+function createBuildManifest(settings, internals, renderers, middleware, key) {
   let i18nManifest = void 0;
   if (settings.config.i18n) {
     i18nManifest = {
@@ -388,6 +389,7 @@ function createBuildManifest(settings, internals, renderers, middleware) {
     buildFormat: settings.config.build.format,
     middleware,
     checkOrigin: settings.config.security?.checkOrigin ?? false,
+    key,
     experimentalEnvGetSecretEnabled: false
   };
 }

package/dist/core/build/index.js

@@ -15,6 +15,7 @@ import { resolveConfig } from "../config/config.js";
 import { createNodeLogger } from "../config/logging.js";
 import { createSettings } from "../config/settings.js";
 import { createVite } from "../create-vite.js";
+import { createKey } from "../encryption.js";
 import { levels, timerMessage } from "../logger/core.js";
 import { apply as applyPolyfill } from "../polyfill.js";
 import { createRouteManifest } from "../routing/index.js";
@@ -135,7 +136,8 @@ class AstroBuilder {
       origin: this.origin,
       pageNames,
       teardownCompiler: this.teardownCompiler,
-      viteConfig
+      viteConfig,
+      key: createKey()
     };
     const { internals, ssrOutputChunkNames, contentFileNames } = await viteBuild(opts);
     await staticBuild(opts, internals, ssrOutputChunkNames, contentFileNames);

package/dist/core/build/plugins/plugin-manifest.js

@@ -5,6 +5,7 @@ import { normalizeTheLocale } from "../../../i18n/index.js";
 import { toRoutingStrategy } from "../../../i18n/utils.js";
 import { runHookBuildSsr } from "../../../integrations/hooks.js";
 import { BEFORE_HYDRATION_SCRIPT_ID, PAGE_SCRIPT_ID } from "../../../vite-plugin-scripts/index.js";
+import { encodeKey } from "../../encryption.js";
 import { fileExtension, joinPaths, prependForwardSlash } from "../../path.js";
 import { serializeRouteData } from "../../routing/index.js";
 import { addRollupInput } from "../add-rollup-input.js";
@@ -103,7 +104,8 @@ async function createManifest(buildOpts, internals) {
     internals.staticFiles.add(file);
   }
   const staticFiles = internals.staticFiles;
-  return buildManifest(buildOpts, internals, Array.from(staticFiles));
+  const encodedKey = await encodeKey(await buildOpts.key);
+  return buildManifest(buildOpts, internals, Array.from(staticFiles), encodedKey);
 }
 function injectManifest(manifest, chunk) {
   const code = chunk.code;
@@ -111,7 +113,7 @@ function injectManifest(manifest, chunk) {
     return JSON.stringify(manifest);
   });
 }
-function buildManifest(opts, internals, staticFiles) {
+function buildManifest(opts, internals, staticFiles, encodedKey) {
   const { settings } = opts;
   const routes = [];
   const domainLookupTable = {};
@@ -214,6 +216,7 @@ function buildManifest(opts, internals, staticFiles) {
     buildFormat: settings.config.build.format,
     checkOrigin: settings.config.security?.checkOrigin ?? false,
     serverIslandNameMap: Array.from(settings.serverIslandNameMap),
+    key: encodedKey,
     experimentalEnvGetSecretEnabled: settings.config.experimental.env !== void 0 && (settings.adapter?.supportedAstroFeatures.envGetSecret ?? "unsupported") !== "unsupported"
   };
 }

package/dist/core/build/plugins/plugin-ssr.js

@@ -24,6 +24,10 @@ function vitePluginSSR(internals, adapter, options) {
         }
         inputs.add(getVirtualModulePageName(ASTRO_PAGE_MODULE_ID, pageData.component));
       }
+      const adapterServerEntrypoint = options.settings.adapter?.serverEntrypoint;
+      if (adapterServerEntrypoint) {
+        inputs.add(adapterServerEntrypoint);
+      }
       inputs.add(SSR_VIRTUAL_MODULE_ID);
       return addRollupInput(opts, Array.from(inputs));
     },
@@ -195,8 +199,8 @@ function generateSSRCode(settings, adapter, middlewareId) {
   const pageMap = isFunctionPerRouteEnabled(adapter) ? "pageModule" : "pageMap";
   const imports = [
     `import { renderers } from '${RENDERERS_MODULE_ID}';`,
-    `import { manifest as defaultManifest } from '${SSR_MANIFEST_VIRTUAL_MODULE_ID}';`,
     `import * as serverEntrypointModule from '${adapter.serverEntrypoint}';`,
+    `import { manifest as defaultManifest } from '${SSR_MANIFEST_VIRTUAL_MODULE_ID}';`,
     edgeMiddleware ? `` : `import { onRequest as middleware } from '${middlewareId}';`,
     settings.config.experimental.serverIslands ? `import { serverIslandMap } from '${VIRTUAL_ISLAND_MAP_ID}';` : ""
   ];

package/dist/core/build/static-build.js

@@ -199,6 +199,8 @@ async function ssrBuild(opts, internals, input, container, logger) {
               return "renderers.mjs";
             } else if (chunkInfo.facadeModuleId === RESOLVED_SSR_MANIFEST_VIRTUAL_MODULE_ID) {
               return "manifest_[hash].mjs";
+            } else if (chunkInfo.facadeModuleId === settings.adapter?.serverEntrypoint) {
+              return "adapter_[hash].mjs";
             } else if (settings.config.experimental.contentCollectionCache && chunkInfo.facadeModuleId && hasAnyContentFlag(chunkInfo.facadeModuleId)) {
               const moduleId = reverseSymlink({
                 symlinks,

package/dist/core/build/types.d.ts

@@ -39,6 +39,7 @@ export interface StaticBuildOptions {
     pageNames: string[];
     viteConfig: InlineConfig;
     teardownCompiler: boolean;
+    key: Promise<CryptoKey>;
 }
 type ImportComponentInstance = () => Promise<ComponentInstance>;
 export interface SinglePageBuiltModule {

package/dist/core/constants.js

@@ -1,4 +1,4 @@
-const ASTRO_VERSION = "4.13.2";
+const ASTRO_VERSION = "4.13.4";
 const REROUTE_DIRECTIVE_HEADER = "X-Astro-Reroute";
 const REWRITE_DIRECTIVE_HEADER_KEY = "X-Astro-Rewrite";
 const REWRITE_DIRECTIVE_HEADER_VALUE = "yes";

package/dist/core/dev/dev.js

@@ -19,7 +19,7 @@ async function dev(inlineConfig) {
   await telemetry.record([]);
   const restart = await createContainerWithAutomaticRestart({ inlineConfig, fs });
   const logger = restart.container.logger;
-  const currentVersion = "4.13.2";
+  const currentVersion = "4.13.4";
   const isPrerelease = currentVersion.includes("-");
   if (!isPrerelease) {
     try {

package/dist/core/encryption.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Creates a CryptoKey object that can be used to encrypt any string.
+ */
+export declare function createKey(): Promise<CryptoKey>;
+/**
+ * Takes a key that has been serialized to an array of bytes and returns a CryptoKey
+ */
+export declare function importKey(bytes: Uint8Array): Promise<CryptoKey>;
+/**
+ * Encodes a CryptoKey to base64 string, so that it can be embedded in JSON / JavaScript
+ */
+export declare function encodeKey(key: CryptoKey): Promise<string>;
+/**
+ * Decodes a base64 string into bytes and then imports the key.
+ */
+export declare function decodeKey(encoded: string): Promise<CryptoKey>;
+/**
+ * Using a CryptoKey, encrypt a string into a base64 string.
+ */
+export declare function encryptString(key: CryptoKey, raw: string): Promise<string>;
+/**
+ * Takes a base64 encoded string, decodes it and returns the decrypted text.
+ */
+export declare function decryptString(key: CryptoKey, encoded: string): Promise<string>;

package/dist/core/encryption.js

@@ -0,0 +1,64 @@
+import { decodeBase64, decodeHex, encodeBase64, encodeHexUpperCase } from "@oslojs/encoding";
+const ALGORITHM = "AES-GCM";
+async function createKey() {
+  const key = await crypto.subtle.generateKey(
+    {
+      name: ALGORITHM,
+      length: 256
+    },
+    true,
+    ["encrypt", "decrypt"]
+  );
+  return key;
+}
+async function importKey(bytes) {
+  const key = await crypto.subtle.importKey("raw", bytes, ALGORITHM, true, ["encrypt", "decrypt"]);
+  return key;
+}
+async function encodeKey(key) {
+  const exported = await crypto.subtle.exportKey("raw", key);
+  const encodedKey = encodeBase64(new Uint8Array(exported));
+  return encodedKey;
+}
+async function decodeKey(encoded) {
+  const bytes = decodeBase64(encoded);
+  return crypto.subtle.importKey("raw", bytes, ALGORITHM, true, ["encrypt", "decrypt"]);
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const IV_LENGTH = 24;
+async function encryptString(key, raw) {
+  const iv = crypto.getRandomValues(new Uint8Array(IV_LENGTH / 2));
+  const data = encoder.encode(raw);
+  const buffer = await crypto.subtle.encrypt(
+    {
+      name: ALGORITHM,
+      iv
+    },
+    key,
+    data
+  );
+  return encodeHexUpperCase(iv) + encodeBase64(new Uint8Array(buffer));
+}
+async function decryptString(key, encoded) {
+  const iv = decodeHex(encoded.slice(0, IV_LENGTH));
+  const dataArray = decodeBase64(encoded.slice(IV_LENGTH));
+  const decryptedBuffer = await crypto.subtle.decrypt(
+    {
+      name: ALGORITHM,
+      iv
+    },
+    key,
+    dataArray
+  );
+  const decryptedString = decoder.decode(decryptedBuffer);
+  return decryptedString;
+}
+export {
+  createKey,
+  decodeKey,
+  decryptString,
+  encodeKey,
+  encryptString,
+  importKey
+};

package/dist/core/messages.js

@@ -38,7 +38,7 @@ function serverStart({
   host,
   base
 }) {
-  const version = "4.13.2";
+  const version = "4.13.4";
   const localPrefix = `${dim("\u2503")} Local    `;
   const networkPrefix = `${dim("\u2503")} Network  `;
   const emptyPrefix = " ".repeat(11);
@@ -270,7 +270,7 @@ function printHelp({
     message.push(
       linebreak(),
       `  ${bgGreen(black(` ${commandName} `))} ${green(
-        `v${"4.13.2"}`
+        `v${"4.13.4"}`
       )} ${headline}`
     );
   }

package/dist/core/render-context.js

@@ -1,5 +1,5 @@
 import { deserializeActionResult } from "../actions/runtime/virtual/shared.js";
-import { createCallAction, createGetActionResult, hasActionsInternal } from "../actions/utils.js";
+import { createCallAction, createGetActionResult, hasActionPayload } from "../actions/utils.js";
 import {
   computeCurrentLocale,
   computePreferredLocale,
@@ -256,7 +256,7 @@ class RenderContext {
         throw new AstroError(AstroErrorData.AstroResponseHeadersReassigned);
       }
     };
-    const actionResult = hasActionsInternal(this.locals) ? deserializeActionResult(this.locals._actionsInternal.actionResult) : void 0;
+    const actionResult = hasActionPayload(this.locals) ? deserializeActionResult(this.locals._actionPayload.actionResult) : void 0;
     const result = {
       base: manifest.base,
       cancelled: false,
@@ -279,6 +279,7 @@ class RenderContext {
       styles,
       actionResult,
       serverIslandNameMap: manifest.serverIslandNameMap ?? /* @__PURE__ */ new Map(),
+      key: manifest.key,
       trailingSlash: manifest.trailingSlash,
       _metadata: {
         hasHydrationScript: false,

package/dist/core/server-islands/endpoint.js

@@ -3,6 +3,7 @@ import {
   renderTemplate
 } from "../../runtime/server/index.js";
 import { createSlotValueFromString } from "../../runtime/server/render/slot.js";
+import { decryptString } from "../encryption.js";
 import { getPattern } from "../routing/manifest/pattern.js";
 const SERVER_ISLAND_ROUTE = "/_server-islands/[name]";
 const SERVER_ISLAND_COMPONENT = "_server-islands.astro";
@@ -51,7 +52,10 @@ function createEndpoint(manifest) {
         statusText: "Not found"
       });
     }
-    const props = data.props;
+    const key = await manifest.key;
+    const encryptedProps = data.encryptedProps;
+    const propString = await decryptString(key, encryptedProps);
+    const props = JSON.parse(propString);
     const componentModule = await imp();
     const Component = componentModule[data.componentExport];
     const slots = {};

package/dist/runtime/server/render/server-islands.js

@@ -1,3 +1,4 @@
+import { encryptString } from "../../../core/encryption.js";
 import { renderChild } from "./any.js";
 import { renderSlotToString } from "./slot.js";
 const internalProps = /* @__PURE__ */ new Set([
@@ -21,9 +22,9 @@ function renderServerIsland(result, _displayName, props, slots) {
       if (!componentId) {
         throw new Error(`Could not find server component name`);
       }
-      for (const key of Object.keys(props)) {
-        if (internalProps.has(key)) {
-          delete props[key];
+      for (const key2 of Object.keys(props)) {
+        if (internalProps.has(key2)) {
+          delete props[key2];
         }
       }
       destination.write("<!--server-island-start-->");
@@ -36,6 +37,8 @@ function renderServerIsland(result, _displayName, props, slots) {
           await renderChild(destination, slots.fallback(result));
         }
       }
+      const key = await result.key;
+      const propsEncrypted = await encryptString(key, JSON.stringify(props));
       const hostId = crypto.randomUUID();
       const serverIslandUrl = `${result.base}_server-islands/${componentId}${result.trailingSlash === "always" ? "/" : ""}`;
       destination.write(`<script async type="module" data-island-id="${hostId}">
@@ -44,7 +47,7 @@ let componentExport = ${safeJsonStringify(componentExport)};
 let script = document.querySelector('script[data-island-id="${hostId}"]');
 let data = {
 	componentExport,
-	props: ${safeJsonStringify(props)},
+	encryptedProps: ${safeJsonStringify(propsEncrypted)},
 	slots: ${safeJsonStringify(renderedSlots)},
 };
 

package/dist/vite-plugin-astro-server/plugin.js

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { IncomingMessage } from "node:http";
+import { createKey } from "../core/encryption.js";
 import { getViteErrorPayload } from "../core/errors/dev/index.js";
 import { AstroError, AstroErrorData } from "../core/errors/index.js";
 import { patchOverlay } from "../core/errors/overlay.js";
@@ -117,6 +118,7 @@ function createDevelopmentManifest(settings) {
     i18n: i18nManifest,
     checkOrigin: settings.config.security?.checkOrigin ?? false,
     experimentalEnvGetSecretEnabled: false,
+    key: createKey(),
     middleware(_, next) {
       return next();
     }

package/dist/vite-plugin-scanner/scan.js

@@ -35,7 +35,7 @@ async function scan(code, id, settings) {
     const { n: name, le: endOfLocalName } = _export;
     if (BOOLEAN_EXPORTS.has(name)) {
       const prefix = code.slice(0, endOfLocalName).split("export").pop().trim().replace("prerender", "").trim();
-      const suffix = code.slice(endOfLocalName).trim().replace(/=/, "").trim().split(/[;\n]/)[0];
+      const suffix = code.slice(endOfLocalName).trim().replace(/=/, "").trim().split(/[;\n\r]/)[0].trim();
       if (prefix !== "const" || !(isTruthy(suffix) || isFalsy(suffix))) {
         throw new AstroError({
           ...AstroErrorData.InvalidPrerenderExport,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro",
-  "version": "4.13.2",
+  "version": "4.13.4",
   "description": "Astro is a modern site builder with web best practices, performance, and DX front-of-mind.",
   "type": "module",
   "author": "withastro",
@@ -107,13 +107,14 @@
     "vendor"
   ],
   "dependencies": {
-    "@astrojs/compiler": "^2.10.1",
+    "@astrojs/compiler": "^2.10.2",
     "@babel/core": "^7.25.2",
     "@babel/generator": "^7.25.0",
     "@babel/parser": "^7.25.3",
     "@babel/plugin-transform-react-jsx": "^7.25.2",
     "@babel/traverse": "^7.25.3",
     "@babel/types": "^7.25.2",
+    "@oslojs/encoding": "^0.4.1",
     "@types/babel__core": "^7.20.5",
     "@types/cookie": "^0.6.0",
     "acorn": "^8.12.1",
@@ -159,22 +160,22 @@
     "tsconfck": "^3.1.1",
     "unist-util-visit": "^5.0.0",
     "vfile": "^6.0.2",
-    "vite": "^5.3.5",
+    "vite": "^5.4.0",
     "vitefu": "^0.2.5",
     "which-pm": "^3.0.0",
     "yargs-parser": "^21.1.1",
     "zod": "^3.23.8",
     "zod-to-json-schema": "^3.23.2",
+    "@astrojs/markdown-remark": "5.2.0",
     "@astrojs/internal-helpers": "0.4.1",
-    "@astrojs/telemetry": "3.1.0",
-    "@astrojs/markdown-remark": "5.2.0"
+    "@astrojs/telemetry": "3.1.0"
   },
   "optionalDependencies": {
     "sharp": "^0.33.3"
   },
   "devDependencies": {
-    "@astrojs/check": "^0.9.1",
-    "@playwright/test": "^1.45.3",
+    "@astrojs/check": "^0.9.2",
+    "@playwright/test": "^1.46.0",
     "@types/aria-query": "^5.0.4",
     "@types/babel__generator": "^7.6.8",
     "@types/babel__traverse": "^7.20.6",
@@ -191,7 +192,7 @@
     "@types/prompts": "^2.4.9",
     "@types/semver": "^7.5.8",
     "@types/yargs-parser": "^21.0.3",
-    "cheerio": "1.0.0-rc.12",
+    "cheerio": "1.0.0",
     "eol": "^0.9.1",
     "expect-type": "^0.19.0",
     "mdast-util-mdx": "^3.0.0",
@@ -205,7 +206,7 @@
     "remark-code-titles": "^0.1.2",
     "rollup": "^4.20.0",
     "sass": "^1.77.8",
-    "undici": "^6.19.5",
+    "undici": "^6.19.7",
     "unified": "^11.0.5",
     "astro-scripts": "0.0.14"
   },

package/templates/actions.mjs

@@ -1,4 +1,9 @@
-import { ActionError, deserializeActionResult, getActionQueryString } from 'astro:actions';
+import {
+	ACTION_QUERY_PARAMS,
+	ActionError,
+	deserializeActionResult,
+	getActionQueryString,
+} from 'astro:actions';
 
 function toActionProxy(actionCallback = {}, aggregatedPath = '') {
 	return new Proxy(actionCallback, {
@@ -16,13 +21,18 @@ function toActionProxy(actionCallback = {}, aggregatedPath = '') {
 				toString: () => action.queryString,
 				// Progressive enhancement info for React.
 				$$FORM_ACTION: function () {
+					const searchParams = new URLSearchParams(action.toString());
+					// Astro will redirect with a GET request by default.
+					// Disable this behavior to preserve form state
+					// for React's progressive enhancement.
+					searchParams.set(ACTION_QUERY_PARAMS.actionRedirect, 'false');
 					return {
 						method: 'POST',
 						// `name` creates a hidden input.
 						// It's unused by Astro, but we can't turn this off.
 						// At least use a name that won't conflict with a user's formData.
 						name: '_astroAction',
-						action: action.toString(),
+						action: '?' + searchParams.toString(),
 					};
 				},
 				// Note: `orThrow` does not have progressive enhancement info.