astro 5.16.2 → 5.16.4

package/dist/assets/fonts/infra/require-local-provider-url-resolver.js

@@ -1,17 +1,22 @@
 import { fileURLToPath } from "node:url";
 import { resolveEntrypoint } from "../utils.js";
-function createRequireLocalProviderUrlResolver({
-  root,
-  intercept
-}) {
-  return {
-    resolve(input) {
-      const path = fileURLToPath(resolveEntrypoint(root, input));
-      intercept?.(path);
-      return path;
-    }
-  };
+class RequireLocalProviderUrlResolver {
+  #root;
+  // TODO: remove when stabilizing
+  #intercept;
+  constructor({
+    root,
+    intercept
+  }) {
+    this.#root = root;
+    this.#intercept = intercept;
+  }
+  resolve(input) {
+    const path = fileURLToPath(resolveEntrypoint(this.#root, input));
+    this.#intercept?.(path);
+    return path;
+  }
 }
 export {
-  createRequireLocalProviderUrlResolver
+  RequireLocalProviderUrlResolver
 };

package/dist/assets/fonts/infra/system-fallbacks-provider.d.ts

@@ -1,11 +1,6 @@
 import type { SystemFallbacksProvider } from '../definitions.js';
-export declare const DEFAULT_FALLBACKS: {
-    serif: "Times New Roman"[];
-    'sans-serif': "Arial"[];
-    monospace: "Courier New"[];
-    'system-ui': ("Arial" | "BlinkMacSystemFont" | "Segoe UI" | "Roboto" | "Helvetica Neue")[];
-    'ui-serif': "Times New Roman"[];
-    'ui-sans-serif': "Arial"[];
-    'ui-monospace': "Courier New"[];
-};
-export declare function createSystemFallbacksProvider(): SystemFallbacksProvider;
+import type { FontFaceMetrics, GenericFallbackName } from '../types.js';
+export declare class RealSystemFallbacksProvider implements SystemFallbacksProvider {
+    getLocalFonts(fallback: GenericFallbackName): Array<string> | null;
+    getMetricsForLocalFont(family: string): FontFaceMetrics;
+}

package/dist/assets/fonts/infra/system-fallbacks-provider.js

@@ -58,17 +58,14 @@ const DEFAULT_FALLBACKS = {
   "ui-sans-serif": ["Arial"],
   "ui-monospace": ["Courier New"]
 };
-function createSystemFallbacksProvider() {
-  return {
-    getLocalFonts(fallback) {
-      return DEFAULT_FALLBACKS[fallback] ?? null;
-    },
-    getMetricsForLocalFont(family) {
-      return SYSTEM_METRICS[family];
-    }
-  };
+class RealSystemFallbacksProvider {
+  getLocalFonts(fallback) {
+    return DEFAULT_FALLBACKS[fallback] ?? null;
+  }
+  getMetricsForLocalFont(family) {
+    return SYSTEM_METRICS[family];
+  }
 }
 export {
-  DEFAULT_FALLBACKS,
-  createSystemFallbacksProvider
+  RealSystemFallbacksProvider
 };

package/dist/assets/fonts/infra/unstorage-fs-storage.d.ts

@@ -0,0 +1,11 @@
+import type { Storage } from '../definitions.js';
+export declare class UnstorageFsStorage implements Storage {
+    #private;
+    constructor({ base }: {
+        base: URL;
+    });
+    getItem(key: string): Promise<any | null>;
+    getItemRaw(key: string): Promise<Buffer | null>;
+    setItem(key: string, value: any): Promise<void>;
+    setItemRaw(key: string, value: any): Promise<void>;
+}

package/dist/assets/fonts/infra/unstorage-fs-storage.js

@@ -0,0 +1,26 @@
+import { fileURLToPath } from "node:url";
+import * as unstorage from "unstorage";
+import fsLiteDriver from "unstorage/drivers/fs-lite";
+class UnstorageFsStorage {
+  #unstorage;
+  constructor({ base }) {
+    this.#unstorage = unstorage.createStorage({
+      driver: fsLiteDriver({ base: fileURLToPath(base) })
+    });
+  }
+  async getItem(key) {
+    return await this.#unstorage.getItem(key);
+  }
+  async getItemRaw(key) {
+    return await this.#unstorage.getItemRaw(key);
+  }
+  async setItem(key, value) {
+    return await this.#unstorage.setItem(key, value);
+  }
+  async setItemRaw(key, value) {
+    return await this.#unstorage.setItemRaw(key, value);
+  }
+}
+export {
+  UnstorageFsStorage
+};

package/dist/assets/fonts/infra/url-proxy.d.ts

@@ -1,7 +1,16 @@
-import type { DataCollector, UrlProxy, UrlProxyHashResolver, UrlResolver } from '../definitions.js';
-export declare function createUrlProxy({ hashResolver, dataCollector, urlResolver, cssVariable, }: {
-    hashResolver: UrlProxyHashResolver;
-    dataCollector: DataCollector;
-    urlResolver: UrlResolver;
-    cssVariable: string;
-}): UrlProxy;
+import type { DataCollector, ProxyData, UrlProxy, UrlProxyHashResolver, UrlResolver } from '../definitions.js';
+import type { FontFileData, FontType } from '../types.js';
+export declare class RealUrlProxy implements UrlProxy {
+    #private;
+    constructor({ hashResolver, dataCollector, urlResolver, cssVariable, }: {
+        hashResolver: UrlProxyHashResolver;
+        dataCollector: DataCollector;
+        urlResolver: UrlResolver;
+        cssVariable: string;
+    });
+    proxy({ url: originalUrl, type, data, collectPreload, init, }: Pick<FontFileData, 'url' | 'init'> & {
+        type: FontType;
+        collectPreload: boolean;
+        data: ProxyData;
+    }): string;
+}

package/dist/assets/fonts/infra/url-proxy.js

@@ -1,31 +1,50 @@
 import { renderFontWeight } from "../utils.js";
-function createUrlProxy({
-  hashResolver,
-  dataCollector,
-  urlResolver,
-  cssVariable
-}) {
-  return {
-    proxy({ url: originalUrl, type, data, collectPreload, init }) {
-      const hash = hashResolver.resolve({ cssVariable, data, originalUrl, type });
-      const url = urlResolver.resolve(hash);
-      dataCollector.collect({
-        url: originalUrl,
-        hash,
-        preload: collectPreload ? {
-          url,
-          type,
-          weight: renderFontWeight(data.weight),
-          style: data.style,
-          subset: data.subset
-        } : null,
-        data,
-        init
-      });
-      return url;
-    }
-  };
+class RealUrlProxy {
+  #hashResolver;
+  #dataCollector;
+  #urlResolver;
+  #cssVariable;
+  constructor({
+    hashResolver,
+    dataCollector,
+    urlResolver,
+    cssVariable
+  }) {
+    this.#hashResolver = hashResolver;
+    this.#dataCollector = dataCollector;
+    this.#urlResolver = urlResolver;
+    this.#cssVariable = cssVariable;
+  }
+  proxy({
+    url: originalUrl,
+    type,
+    data,
+    collectPreload,
+    init
+  }) {
+    const hash = this.#hashResolver.resolve({
+      cssVariable: this.#cssVariable,
+      data,
+      originalUrl,
+      type
+    });
+    const url = this.#urlResolver.resolve(hash);
+    this.#dataCollector.collect({
+      url: originalUrl,
+      hash,
+      preload: collectPreload ? {
+        url,
+        type,
+        weight: renderFontWeight(data.weight),
+        style: data.style,
+        subset: data.subset
+      } : null,
+      data,
+      init
+    });
+    return url;
+  }
 }
 export {
-  createUrlProxy
+  RealUrlProxy
 };

package/dist/assets/fonts/infra/xxhash-hasher.d.ts

@@ -1,2 +1,7 @@
 import type { Hasher } from '../definitions.js';
-export declare function createXxhashHasher(): Promise<Hasher>;
+export declare class XxhashHasher implements Hasher {
+    hashString: (input: string) => string;
+    private constructor();
+    static create(): Promise<XxhashHasher>;
+    hashObject(input: Record<string, any>): string;
+}

package/dist/assets/fonts/infra/xxhash-hasher.js

@@ -1,14 +1,18 @@
 import xxhash from "xxhash-wasm";
 import { sortObjectByKey } from "../utils.js";
-async function createXxhashHasher() {
-  const { h64ToString: hashString } = await xxhash();
-  return {
-    hashString,
-    hashObject(input) {
-      return hashString(JSON.stringify(sortObjectByKey(input)));
-    }
-  };
+class XxhashHasher {
+  hashString;
+  constructor(hashString) {
+    this.hashString = hashString;
+  }
+  static async create() {
+    const { h64ToString } = await xxhash();
+    return new XxhashHasher(h64ToString);
+  }
+  hashObject(input) {
+    return this.hashString(JSON.stringify(sortObjectByKey(input)));
+  }
 }
 export {
-  createXxhashHasher
+  XxhashHasher
 };

package/dist/assets/fonts/orchestrate.d.ts

@@ -1,6 +1,5 @@
-import type { Storage } from 'unstorage';
 import type { Logger } from '../../core/logger/core.js';
-import type { CssRenderer, FontFileReader, FontMetricsResolver, FontTypeExtractor, Hasher, LocalProviderUrlResolver, RemoteFontProviderResolver, StringMatcher, SystemFallbacksProvider, UrlProxy } from './definitions.js';
+import type { CssRenderer, FontFileReader, FontMetricsResolver, FontTypeExtractor, Hasher, LocalProviderUrlResolver, RemoteFontProviderResolver, Storage, StringMatcher, SystemFallbacksProvider, UrlProxy } from './definitions.js';
 import type { ConsumableMap, CreateUrlProxyParams, Defaults, FontFamily, FontFileDataMap, InternalConsumableMap } from './types.js';
 /**
  * Manages how fonts are resolved:

package/dist/assets/fonts/utils.d.ts

@@ -1,6 +1,5 @@
 import type * as unifont from 'unifont';
-import type { Storage } from 'unstorage';
-import type { CssProperties } from './definitions.js';
+import type { CssProperties, Storage } from './definitions.js';
 import type { FontType, GenericFallbackName, ResolvedFontFamily } from './types.js';
 /**
  * Turns unifont font face data into generic CSS properties, to be consumed by the CSS renderer.

package/dist/assets/fonts/vite-plugin-fonts.js

@@ -17,29 +17,27 @@ import {
   RESOLVED_VIRTUAL_MODULE_ID,
   VIRTUAL_MODULE_ID
 } from "./constants.js";
-import { createBuildRemoteFontProviderModResolver } from "./infra/build-remote-font-provider-mod-resolver.js";
-import { createBuildUrlProxyHashResolver } from "./infra/build-url-proxy-hash-resolver.js";
-import { createBuildUrlResolver } from "./infra/build-url-resolver.js";
-import { createCachedFontFetcher } from "./infra/cached-font-fetcher.js";
-import { createCapsizeFontMetricsResolver } from "./infra/capsize-font-metrics-resolver.js";
-import { createDataCollector } from "./infra/data-collector.js";
-import { createDevServerRemoteFontProviderModResolver } from "./infra/dev-remote-font-provider-mod-resolver.js";
-import { createDevUrlProxyHashResolver } from "./infra/dev-url-proxy-hash-resolver.js";
-import { createDevUrlResolver } from "./infra/dev-url-resolver.js";
-import { createFontTypeExtractor } from "./infra/font-type-extractor.js";
-import { createFontaceFontFileReader } from "./infra/fontace-font-file-reader.js";
-import { createFsStorage } from "./infra/fs-storage.js";
-import { createLevenshteinStringMatcher } from "./infra/levenshtein-string-matcher.js";
-import { createMinifiableCssRenderer } from "./infra/minifiable-css-renderer.js";
-import { createRemoteFontProviderResolver } from "./infra/remote-font-provider-resolver.js";
-import { createRequireLocalProviderUrlResolver } from "./infra/require-local-provider-url-resolver.js";
-import { createSystemFallbacksProvider } from "./infra/system-fallbacks-provider.js";
-import { createUrlProxy } from "./infra/url-proxy.js";
-import {
-  createLocalUrlProxyContentResolver,
-  createRemoteUrlProxyContentResolver
-} from "./infra/url-proxy-content-resolver.js";
-import { createXxhashHasher } from "./infra/xxhash-hasher.js";
+import { BuildRemoteFontProviderModResolver } from "./infra/build-remote-font-provider-mod-resolver.js";
+import { BuildUrlProxyHashResolver } from "./infra/build-url-proxy-hash-resolver.js";
+import { BuildUrlResolver } from "./infra/build-url-resolver.js";
+import { CachedFontFetcher } from "./infra/cached-font-fetcher.js";
+import { CapsizeFontMetricsResolver } from "./infra/capsize-font-metrics-resolver.js";
+import { RealDataCollector } from "./infra/data-collector.js";
+import { DevServerRemoteFontProviderModResolver } from "./infra/dev-remote-font-provider-mod-resolver.js";
+import { DevUrlProxyHashResolver } from "./infra/dev-url-proxy-hash-resolver.js";
+import { DevUrlResolver } from "./infra/dev-url-resolver.js";
+import { RealFontTypeExtractor } from "./infra/font-type-extractor.js";
+import { FontaceFontFileReader } from "./infra/fontace-font-file-reader.js";
+import { LevenshteinStringMatcher } from "./infra/levenshtein-string-matcher.js";
+import { LocalUrlProxyContentResolver } from "./infra/local-url-proxy-content-resolver.js";
+import { MinifiableCssRenderer } from "./infra/minifiable-css-renderer.js";
+import { RealRemoteFontProviderResolver } from "./infra/remote-font-provider-resolver.js";
+import { RemoteUrlProxyContentResolver } from "./infra/remote-url-proxy-content-resolver.js";
+import { RequireLocalProviderUrlResolver } from "./infra/require-local-provider-url-resolver.js";
+import { RealSystemFallbacksProvider } from "./infra/system-fallbacks-provider.js";
+import { UnstorageFsStorage } from "./infra/unstorage-fs-storage.js";
+import { RealUrlProxy } from "./infra/url-proxy.js";
+import { XxhashHasher } from "./infra/xxhash-hasher.js";
 import { orchestrate } from "./orchestrate.js";
 function fontsPlugin({ settings, sync, logger }) {
   if (!settings.config.experimental.fonts) {
@@ -83,13 +81,13 @@ function fontsPlugin({ settings, sync, logger }) {
     createHashResolver
   }) {
     const { root } = settings.config;
-    const hasher = await createXxhashHasher();
-    const remoteFontProviderResolver = createRemoteFontProviderResolver({
+    const hasher = await XxhashHasher.create();
+    const remoteFontProviderResolver = new RealRemoteFontProviderResolver({
       root,
       modResolver
     });
     const pathsToWarn = /* @__PURE__ */ new Set();
-    const localProviderUrlResolver = createRequireLocalProviderUrlResolver({
+    const localProviderUrlResolver = new RequireLocalProviderUrlResolver({
       root,
       intercept: (path) => {
         if (path.startsWith(fileURLToPath(settings.config.publicDir))) {
@@ -104,13 +102,13 @@ function fontsPlugin({ settings, sync, logger }) {
         }
       }
     });
-    const storage = createFsStorage({ base: cacheDir });
-    const systemFallbacksProvider = createSystemFallbacksProvider();
-    fontFetcher = createCachedFontFetcher({ storage, fetch, readFile });
-    const fontMetricsResolver = createCapsizeFontMetricsResolver({ fontFetcher, cssRenderer });
-    fontTypeExtractor = createFontTypeExtractor();
-    const fontFileReader = createFontaceFontFileReader();
-    const stringMatcher = createLevenshteinStringMatcher();
+    const storage = new UnstorageFsStorage({ base: cacheDir });
+    const systemFallbacksProvider = new RealSystemFallbacksProvider();
+    fontFetcher = new CachedFontFetcher({ storage, fetch, readFile });
+    const fontMetricsResolver = new CapsizeFontMetricsResolver({ fontFetcher, cssRenderer });
+    fontTypeExtractor = new RealFontTypeExtractor();
+    const fontFileReader = new FontaceFontFileReader();
+    const stringMatcher = new LevenshteinStringMatcher();
     const res = await orchestrate({
       families: settings.config.experimental.fonts,
       hasher,
@@ -124,9 +122,9 @@ function fontsPlugin({ settings, sync, logger }) {
       fontFileReader,
       logger,
       createUrlProxy: ({ local, cssVariable, ...params }) => {
-        const dataCollector = createDataCollector(params);
-        const contentResolver = local ? createLocalUrlProxyContentResolver() : createRemoteUrlProxyContentResolver();
-        return createUrlProxy({
+        const dataCollector = new RealDataCollector(params);
+        const contentResolver = local ? new LocalUrlProxyContentResolver() : new RemoteUrlProxyContentResolver();
+        return new RealUrlProxy({
           urlResolver,
           hashResolver: createHashResolver({ hasher, contentResolver }),
           dataCollector,
@@ -145,8 +143,7 @@ function fontsPlugin({ settings, sync, logger }) {
       for (const { css } of internalConsumableMap.values()) {
         settings.injectedCsp.styleHashes.push(await generateCspDigest(css, algorithm));
       }
-      const resources = urlResolver.getCspResources();
-      for (const resource of resources) {
+      for (const resource of urlResolver.cspResources) {
         settings.injectedCsp.fontResources.add(resource);
       }
     }
@@ -160,14 +157,14 @@ function fontsPlugin({ settings, sync, logger }) {
       if (isBuild) {
         await initialize({
           cacheDir: new URL(CACHE_DIR, settings.config.cacheDir),
-          modResolver: createBuildRemoteFontProviderModResolver(),
-          cssRenderer: createMinifiableCssRenderer({ minify: true }),
-          urlResolver: createBuildUrlResolver({
+          modResolver: new BuildRemoteFontProviderModResolver(),
+          cssRenderer: new MinifiableCssRenderer({ minify: true }),
+          urlResolver: new BuildUrlResolver({
             base: baseUrl,
             assetsPrefix: settings.config.build.assetsPrefix,
             searchParams: settings.adapter?.client?.assetQueryParams ?? new URLSearchParams()
           }),
-          createHashResolver: createBuildUrlProxyHashResolver
+          createHashResolver: (dependencies) => new BuildUrlProxyHashResolver(dependencies)
         });
       }
     },
@@ -175,13 +172,13 @@ function fontsPlugin({ settings, sync, logger }) {
       await initialize({
         // In dev, we cache fonts data in .astro so it can be easily inspected and cleared
         cacheDir: new URL(CACHE_DIR, settings.dotAstroDir),
-        modResolver: createDevServerRemoteFontProviderModResolver({ server }),
-        cssRenderer: createMinifiableCssRenderer({ minify: false }),
-        urlResolver: createDevUrlResolver({
+        modResolver: new DevServerRemoteFontProviderModResolver({ server }),
+        cssRenderer: new MinifiableCssRenderer({ minify: false }),
+        urlResolver: new DevUrlResolver({
           base: baseUrl,
           searchParams: settings.adapter?.client?.assetQueryParams ?? new URLSearchParams()
         }),
-        createHashResolver: createDevUrlProxyHashResolver
+        createHashResolver: (dependencies) => new DevUrlProxyHashResolver(dependencies)
       });
       const localPaths = [...fontFileDataMap.values()].filter(({ url }) => isAbsolute(url)).map((v) => v.url);
       server.watcher.on("change", (path) => {

package/dist/cli/infra/build-time-astro-version-provider.js

@@ -1,6 +1,6 @@
 class BuildTimeAstroVersionProvider {
   // Injected during the build through esbuild define
-  version = "5.16.2";
+  version = "5.16.4";
 }
 export {
   BuildTimeAstroVersionProvider

package/dist/content/content-layer.js

@@ -164,7 +164,7 @@ ${contentConfig.error.message}`);
       logger.info("Content config changed");
       shouldClear = true;
     }
-    if (previousAstroVersion && previousAstroVersion !== "5.16.2") {
+    if (previousAstroVersion && previousAstroVersion !== "5.16.4") {
       logger.info("Astro version changed");
       shouldClear = true;
     }
@@ -172,8 +172,8 @@ ${contentConfig.error.message}`);
       logger.info("Clearing content store");
       this.#store.clearAll();
     }
-    if ("5.16.2") {
-      await this.#store.metaStore().set("astro-version", "5.16.2");
+    if ("5.16.4") {
+      await this.#store.metaStore().set("astro-version", "5.16.4");
     }
     if (currentConfigDigest) {
       await this.#store.metaStore().set("content-config-digest", currentConfigDigest);

package/dist/core/app/index.js

@@ -30,6 +30,7 @@ import { ensure404Route } from "../routing/astro-designed-error-pages.js";
 import { createDefaultRoutes } from "../routing/default.js";
 import { matchRoute } from "../routing/match.js";
 import { PERSIST_SYMBOL } from "../session.js";
+import { validateAndDecodePathname } from "../util/pathname.js";
 import { AppPipeline } from "./pipeline.js";
 import { deserializeManifest } from "./common.js";
 class App {
@@ -197,7 +198,7 @@ class App {
     const url = new URL(request.url);
     const pathname = prependForwardSlash(this.removeBase(url.pathname));
     try {
-      return decodeURI(pathname);
+      return validateAndDecodePathname(pathname);
     } catch (e) {
       this.getAdapterLogger().error(e.toString());
       return pathname;
@@ -218,7 +219,12 @@ class App {
     if (!pathname) {
       pathname = prependForwardSlash(this.removeBase(url.pathname));
     }
-    let routeData = matchRoute(decodeURI(pathname), this.#manifestData);
+    try {
+      pathname = validateAndDecodePathname(pathname);
+    } catch {
+      return void 0;
+    }
+    let routeData = matchRoute(pathname, this.#manifestData);
     if (!routeData) return void 0;
     if (allowPrerenderedRoutes) {
       return routeData;

package/dist/core/constants.js

@@ -1,4 +1,4 @@
-const ASTRO_VERSION = "5.16.2";
+const ASTRO_VERSION = "5.16.4";
 const REROUTE_DIRECTIVE_HEADER = "X-Astro-Reroute";
 const REWRITE_DIRECTIVE_HEADER_KEY = "X-Astro-Rewrite";
 const REWRITE_DIRECTIVE_HEADER_VALUE = "yes";

package/dist/core/csp/runtime.d.ts

@@ -0,0 +1,11 @@
+import type { SSRManifestCSP } from '../app/types.js';
+import type { CspDirective } from './config.js';
+/**
+ * `existingDirective` is something like `img-src 'self'`. Same as `newDirective`.
+ *
+ * Returns `undefined` if no directive has been deduped
+ * @param existingDirective
+ * @param newDirective
+ */
+export declare function deduplicateDirectiveValues(existingDirective: CspDirective, newDirective: CspDirective): CspDirective | undefined;
+export declare function pushDirective(directives: SSRManifestCSP['directives'], newDirective: CspDirective): SSRManifestCSP['directives'];

package/dist/core/csp/runtime.js

@@ -0,0 +1,35 @@
+function deduplicateDirectiveValues(existingDirective, newDirective) {
+  const [directiveName, ...existingValues] = existingDirective.split(/\s+/).filter(Boolean);
+  const [newDirectiveName, ...newValues] = newDirective.split(/\s+/).filter(Boolean);
+  if (directiveName !== newDirectiveName) {
+    return void 0;
+  }
+  const finalDirectives = Array.from(/* @__PURE__ */ new Set([...existingValues, ...newValues]));
+  return `${directiveName} ${finalDirectives.join(" ")}`;
+}
+function pushDirective(directives, newDirective) {
+  let deduplicated = false;
+  if (directives.length === 0) {
+    return [newDirective];
+  }
+  const finalDirectives = [];
+  for (const directive of directives) {
+    if (deduplicated) {
+      finalDirectives.push(directive);
+      continue;
+    }
+    const result = deduplicateDirectiveValues(directive, newDirective);
+    if (result) {
+      finalDirectives.push(result);
+      deduplicated = true;
+    } else {
+      finalDirectives.push(directive);
+      finalDirectives.push(newDirective);
+    }
+  }
+  return finalDirectives;
+}
+export {
+  deduplicateDirectiveValues,
+  pushDirective
+};

package/dist/core/dev/dev.js

@@ -22,7 +22,7 @@ async function dev(inlineConfig) {
   await telemetry.record([]);
   const restart = await createContainerWithAutomaticRestart({ inlineConfig, fs });
   const logger = restart.container.logger;
-  const currentVersion = "5.16.2";
+  const currentVersion = "5.16.4";
   const isPrerelease = currentVersion.includes("-");
   if (!isPrerelease) {
     try {

package/dist/core/messages.js

@@ -38,7 +38,7 @@ function serverStart({
   host,
   base
 }) {
-  const version = "5.16.2";
+  const version = "5.16.4";
   const localPrefix = `${dim("\u2503")} Local    `;
   const networkPrefix = `${dim("\u2503")} Network  `;
   const emptyPrefix = " ".repeat(11);
@@ -275,7 +275,7 @@ function printHelp({
     message.push(
       linebreak(),
       `  ${bgGreen(black(` ${commandName} `))} ${green(
-        `v${"5.16.2"}`
+        `v${"5.16.4"}`
       )} ${headline}`
     );
   }

package/dist/core/render-context.js

@@ -20,6 +20,7 @@ import {
 } from "./constants.js";
 import { AstroCookies, attachCookiesToResponse } from "./cookies/index.js";
 import { getCookiesFromResponse } from "./cookies/response.js";
+import { pushDirective } from "./csp/runtime.js";
 import { generateCspDigest } from "./encryption.js";
 import { CspNotEnabled, ForbiddenRewrite } from "./errors/errors-data.js";
 import { AstroError, AstroErrorData } from "./errors/index.js";
@@ -30,6 +31,7 @@ import { getParams, getProps, Slots } from "./render/index.js";
 import { isRoute404or500, isRouteExternalRedirect, isRouteServerIsland } from "./routing/match.js";
 import { copyRequest, getOriginPathname, setOriginPathname } from "./routing/rewrite.js";
 import { AstroSession } from "./session.js";
+import { validateAndDecodePathname } from "./util/pathname.js";
 const apiContextRoutesSymbol = Symbol.for("context.routes");
 class RenderContext {
   constructor(pipeline, locals, middleware, actions, pathname, request, routeData, status, clientAddress, cookies = new AstroCookies(request), params = getParams(routeData, pathname), url = RenderContext.#createNormalizedUrl(request.url), props = {}, partial = void 0, shouldInjectCspMetaTags = !!pipeline.manifest.csp, session = pipeline.manifest.sessionConfig ? new AstroSession(cookies, pipeline.manifest.sessionConfig, pipeline.runtimeMode) : void 0) {
@@ -53,10 +55,14 @@ class RenderContext {
   static #createNormalizedUrl(requestUrl) {
     const url = new URL(requestUrl);
     try {
-      url.pathname = decodeURI(url.pathname);
-    } finally {
-      return url;
+      url.pathname = validateAndDecodePathname(url.pathname);
+    } catch {
+      try {
+        url.pathname = decodeURI(url.pathname);
+      } catch {
+      }
     }
+    return url;
   }
   /**
    * A flag that tells the render content if the rewriting was triggered
@@ -367,7 +373,14 @@ class RenderContext {
             if (!pipeline.manifest.csp) {
               throw new AstroError(CspNotEnabled);
             }
-            renderContext.result?.directives.push(payload);
+            if (renderContext?.result?.directives) {
+              renderContext.result.directives = pushDirective(
+                renderContext.result.directives,
+                payload
+              );
+            } else {
+              renderContext?.result?.directives.push(payload);
+            }
           },
           insertScriptResource(resource) {
             if (!pipeline.manifest.csp) {
@@ -596,7 +609,14 @@ class RenderContext {
             if (!pipeline.manifest.csp) {
               throw new AstroError(CspNotEnabled);
             }
-            renderContext.result?.directives.push(payload);
+            if (renderContext?.result?.directives) {
+              renderContext.result.directives = pushDirective(
+                renderContext.result.directives,
+                payload
+              );
+            } else {
+              renderContext?.result?.directives.push(payload);
+            }
           },
           insertScriptResource(resource) {
             if (!pipeline.manifest.csp) {