astro 5.16.5 → 6.0.0-alpha.1

package/dist/core/app/manifest.js

@@ -0,0 +1,107 @@
+import { decodeKey } from "../encryption.js";
+import { NOOP_MIDDLEWARE_FN } from "../middleware/noop-middleware.js";
+function deserializeManifest(serializedManifest, routesList) {
+  const routes = [];
+  if (serializedManifest.routes) {
+    for (const serializedRoute of serializedManifest.routes) {
+      routes.push({
+        ...serializedRoute,
+        routeData: deserializeRouteData(serializedRoute.routeData)
+      });
+      const route = serializedRoute;
+      route.routeData = deserializeRouteData(serializedRoute.routeData);
+    }
+  }
+  if (routesList) {
+    for (const route of routesList?.routes) {
+      routes.push({
+        file: "",
+        links: [],
+        scripts: [],
+        styles: [],
+        routeData: route
+      });
+    }
+  }
+  const assets = new Set(serializedManifest.assets);
+  const componentMetadata = new Map(serializedManifest.componentMetadata);
+  const inlinedScripts = new Map(serializedManifest.inlinedScripts);
+  const clientDirectives = new Map(serializedManifest.clientDirectives);
+  const key = decodeKey(serializedManifest.key);
+  return {
+    // in case user middleware exists, this no-op middleware will be reassigned (see plugin-ssr.ts)
+    middleware() {
+      return { onRequest: NOOP_MIDDLEWARE_FN };
+    },
+    ...serializedManifest,
+    rootDir: new URL(serializedManifest.rootDir),
+    srcDir: new URL(serializedManifest.srcDir),
+    publicDir: new URL(serializedManifest.publicDir),
+    outDir: new URL(serializedManifest.outDir),
+    cacheDir: new URL(serializedManifest.cacheDir),
+    buildClientDir: new URL(serializedManifest.buildClientDir),
+    buildServerDir: new URL(serializedManifest.buildServerDir),
+    assets,
+    componentMetadata,
+    inlinedScripts,
+    clientDirectives,
+    routes,
+    key
+  };
+}
+function serializeRouteData(routeData, trailingSlash) {
+  return {
+    ...routeData,
+    pattern: routeData.pattern.source,
+    redirectRoute: routeData.redirectRoute ? serializeRouteData(routeData.redirectRoute, trailingSlash) : void 0,
+    fallbackRoutes: routeData.fallbackRoutes.map((fallbackRoute) => {
+      return serializeRouteData(fallbackRoute, trailingSlash);
+    }),
+    _meta: { trailingSlash }
+  };
+}
+function deserializeRouteData(rawRouteData) {
+  return {
+    route: rawRouteData.route,
+    type: rawRouteData.type,
+    pattern: new RegExp(rawRouteData.pattern),
+    params: rawRouteData.params,
+    component: rawRouteData.component,
+    pathname: rawRouteData.pathname || void 0,
+    segments: rawRouteData.segments,
+    prerender: rawRouteData.prerender,
+    redirect: rawRouteData.redirect,
+    redirectRoute: rawRouteData.redirectRoute ? deserializeRouteData(rawRouteData.redirectRoute) : void 0,
+    fallbackRoutes: rawRouteData.fallbackRoutes.map((fallback) => {
+      return deserializeRouteData(fallback);
+    }),
+    isIndex: rawRouteData.isIndex,
+    origin: rawRouteData.origin,
+    distURL: rawRouteData.distURL
+  };
+}
+function serializeRouteInfo(routeInfo, trailingSlash) {
+  return {
+    styles: routeInfo.styles,
+    file: routeInfo.file,
+    links: routeInfo.links,
+    scripts: routeInfo.scripts,
+    routeData: serializeRouteData(routeInfo.routeData, trailingSlash)
+  };
+}
+function deserializeRouteInfo(rawRouteInfo) {
+  return {
+    styles: rawRouteInfo.styles,
+    file: rawRouteInfo.file,
+    links: rawRouteInfo.links,
+    scripts: rawRouteInfo.scripts,
+    routeData: deserializeRouteData(rawRouteInfo.routeData)
+  };
+}
+export {
+  deserializeManifest,
+  deserializeRouteData,
+  deserializeRouteInfo,
+  serializeRouteData,
+  serializeRouteInfo
+};

package/dist/core/app/middlewares.js

@@ -1,4 +1,4 @@
-import { defineMiddleware } from "../middleware/index.js";
+import { defineMiddleware } from "../middleware/defineMiddleware.js";
 const FORM_CONTENT_TYPES = [
   "application/x-www-form-urlencoded",
   "multipart/form-data",

package/dist/core/app/node.d.ts

@@ -1,10 +1,8 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { RemotePattern } from '../../types/public/config.js';
-import type { RouteData } from '../../types/public/internal.js';
 import type { RenderOptions } from './index.js';
 import { App } from './index.js';
 import type { NodeAppHeadersJson, SSRManifest } from './types.js';
-export { apply as applyPolyfills } from '../polyfill.js';
 /**
  * Allow the request body to be explicitly overridden. For example, this
  * is used by the Express JSON middleware.
@@ -15,13 +13,8 @@ interface NodeRequest extends IncomingMessage {
 export declare class NodeApp extends App {
     headersMap: NodeAppHeadersJson | undefined;
     setHeadersMap(headers: NodeAppHeadersJson): void;
-    match(req: NodeRequest | Request, allowPrerenderedRoutes?: boolean): RouteData | undefined;
+    match(req: NodeRequest | Request, allowPrerenderedRoutes?: boolean): import("../../index.js").RouteData | undefined;
     render(request: NodeRequest | Request, options?: RenderOptions): Promise<Response>;
-    /**
-     * @deprecated Instead of passing `RouteData` and locals individually, pass an object with `routeData` and `locals` properties.
-     * See https://github.com/withastro/astro/pull/9199 for more information.
-     */
-    render(request: NodeRequest | Request, routeData?: RouteData, locals?: object): Promise<Response>;
     /**
      * Converts a NodeJS IncomingMessage into a web standard Request.
      * ```js
@@ -58,3 +51,4 @@ export declare class NodeApp extends App {
 }
 export declare function loadManifest(rootFolder: URL): Promise<SSRManifest>;
 export declare function loadApp(rootFolder: URL): Promise<NodeApp>;
+export {};

package/dist/core/app/node.js

@@ -1,10 +1,10 @@
 import fs from "node:fs";
 import { Http2ServerResponse } from "node:http2";
 import { clientAddressSymbol, nodeRequestAbortControllerCleanupSymbol } from "../constants.js";
-import { deserializeManifest } from "./common.js";
+import { deserializeManifest } from "./manifest.js";
 import { createOutgoingHttpHeaders } from "./createOutgoingHttpHeaders.js";
 import { App } from "./index.js";
-import { apply } from "../polyfill.js";
+import { sanitizeHost, validateForwardedHeaders } from "./validate-forwarded-headers.js";
 class NodeApp extends App {
   headersMap = void 0;
   setHeadersMap(headers) {
@@ -19,13 +19,13 @@ class NodeApp extends App {
     }
     return super.match(req, allowPrerenderedRoutes);
   }
-  render(req, routeDataOrOptions, maybeLocals) {
-    if (!(req instanceof Request)) {
-      req = NodeApp.createRequest(req, {
+  render(request, options) {
+    if (!(request instanceof Request)) {
+      request = NodeApp.createRequest(request, {
         allowedDomains: this.manifest.allowedDomains
       });
     }
-    return super.render(req, routeDataOrOptions, maybeLocals);
+    return super.render(request, options);
   }
   /**
    * Converts a NodeJS IncomingMessage into a web standard Request.
@@ -51,14 +51,14 @@ class NodeApp extends App {
     };
     const providedProtocol = isEncrypted ? "https" : "http";
     const providedHostname = req.headers.host ?? req.headers[":authority"];
-    const validated = App.validateForwardedHeaders(
+    const validated = validateForwardedHeaders(
       getFirstForwardedValue(req.headers["x-forwarded-proto"]),
       getFirstForwardedValue(req.headers["x-forwarded-host"]),
       getFirstForwardedValue(req.headers["x-forwarded-port"]),
       allowedDomains
     );
     const protocol = validated.protocol ?? providedProtocol;
-    const sanitizedProvidedHostname = App.sanitizeHost(
+    const sanitizedProvidedHostname = sanitizeHost(
       typeof providedHostname === "string" ? providedHostname : void 0
     );
     const hostname = validated.host ?? sanitizedProvidedHostname;
@@ -258,7 +258,6 @@ async function loadApp(rootFolder) {
 }
 export {
   NodeApp,
-  apply as applyPolyfills,
   loadApp,
   loadManifest
 };

package/dist/core/app/pipeline.d.ts

@@ -1,13 +1,14 @@
 import type { ComponentInstance } from '../../types/astro.js';
 import type { RewritePayload } from '../../types/public/common.js';
-import type { RouteData, SSRResult } from '../../types/public/internal.js';
-import { Pipeline, type TryRewriteResult } from '../base-pipeline.js';
+import type { RouteData } from '../../types/public/internal.js';
+import { type HeadElements, Pipeline, type TryRewriteResult } from '../base-pipeline.js';
 import type { SinglePageBuiltModule } from '../build/types.js';
 export declare class AppPipeline extends Pipeline {
-    static create({ logger, manifest, runtimeMode, renderers, resolve, serverLike, streaming, defaultRoutes, }: Pick<AppPipeline, 'logger' | 'manifest' | 'runtimeMode' | 'renderers' | 'resolve' | 'serverLike' | 'streaming' | 'defaultRoutes'>): AppPipeline;
-    headElements(routeData: RouteData): Pick<SSRResult, 'scripts' | 'styles' | 'links'>;
+    getName(): string;
+    static create({ manifest, streaming }: Pick<AppPipeline, 'manifest' | 'streaming'>): AppPipeline;
+    headElements(routeData: RouteData): Promise<HeadElements>;
     componentMetadata(): void;
     getComponentByRoute(routeData: RouteData): Promise<ComponentInstance>;
-    tryRewrite(payload: RewritePayload, request: Request): Promise<TryRewriteResult>;
     getModuleForRoute(route: RouteData): Promise<SinglePageBuiltModule>;
+    tryRewrite(payload: RewritePayload, request: Request): Promise<TryRewriteResult>;
 }

package/dist/core/app/pipeline.js

@@ -1,25 +1,36 @@
 import { Pipeline } from "../base-pipeline.js";
-import { RedirectSinglePageBuiltModule } from "../redirects/component.js";
-import { createModuleScriptElement, createStylesheetElementSet } from "../render/ssr-element.js";
+import { RedirectSinglePageBuiltModule } from "../redirects/index.js";
+import {
+  createAssetLink,
+  createModuleScriptElement,
+  createStylesheetElementSet
+} from "../render/ssr-element.js";
+import { getFallbackRoute, routeIsFallback, routeIsRedirect } from "../routing/helpers.js";
 import { findRouteToRewrite } from "../routing/rewrite.js";
+import { createConsoleLogger } from "./logging.js";
 class AppPipeline extends Pipeline {
-  static create({
-    logger,
-    manifest,
-    runtimeMode,
-    renderers,
-    resolve,
-    serverLike,
-    streaming,
-    defaultRoutes
-  }) {
+  getName() {
+    return "AppPipeline";
+  }
+  static create({ manifest, streaming }) {
+    const resolve = async function resolve2(specifier) {
+      if (!(specifier in manifest.entryModules)) {
+        throw new Error(`Unable to resolve [${specifier}]`);
+      }
+      const bundlePath = manifest.entryModules[specifier];
+      if (bundlePath.startsWith("data:") || bundlePath.length === 0) {
+        return bundlePath;
+      } else {
+        return createAssetLink(bundlePath, manifest.base, manifest.assetsPrefix);
+      }
+    };
+    const logger = createConsoleLogger(manifest.logLevel);
     const pipeline = new AppPipeline(
       logger,
       manifest,
-      runtimeMode,
-      renderers,
+      "production",
+      manifest.renderers,
       resolve,
-      serverLike,
       streaming,
       void 0,
       void 0,
@@ -28,16 +39,16 @@ class AppPipeline extends Pipeline {
       void 0,
       void 0,
       void 0,
-      void 0,
-      defaultRoutes
+      void 0
     );
     return pipeline;
   }
-  headElements(routeData) {
+  async headElements(routeData) {
+    const { assetsPrefix, base } = this.manifest;
     const routeInfo = this.manifest.routes.find((route) => route.routeData === routeData);
     const links = /* @__PURE__ */ new Set();
     const scripts = /* @__PURE__ */ new Set();
-    const styles = createStylesheetElementSet(routeInfo?.styles ?? []);
+    const styles = createStylesheetElementSet(routeInfo?.styles ?? [], base, assetsPrefix);
     for (const script of routeInfo?.scripts ?? []) {
       if ("stage" in script) {
         if (script.stage === "head-inline") {
@@ -47,7 +58,7 @@ class AppPipeline extends Pipeline {
           });
         }
       } else {
-        scripts.add(createModuleScriptElement(script));
+        scripts.add(createModuleScriptElement(script, base, assetsPrefix));
       }
     }
     return { links, styles, scripts };
@@ -58,6 +69,39 @@ class AppPipeline extends Pipeline {
     const module = await this.getModuleForRoute(routeData);
     return module.page();
   }
+  async getModuleForRoute(route) {
+    for (const defaultRoute of this.defaultRoutes) {
+      if (route.component === defaultRoute.component) {
+        return {
+          page: () => Promise.resolve(defaultRoute.instance)
+        };
+      }
+    }
+    let routeToProcess = route;
+    if (routeIsRedirect(route)) {
+      if (route.redirectRoute) {
+        routeToProcess = route.redirectRoute;
+      } else {
+        return RedirectSinglePageBuiltModule;
+      }
+    } else if (routeIsFallback(route)) {
+      routeToProcess = getFallbackRoute(route, this.manifest.routes);
+    }
+    if (this.manifest.pageMap) {
+      const importComponentInstance = this.manifest.pageMap.get(routeToProcess.component);
+      if (!importComponentInstance) {
+        throw new Error(
+          `Unexpectedly unable to find a component instance for route ${route.route}`
+        );
+      }
+      return await importComponentInstance();
+    } else if (this.manifest.pageModule) {
+      return this.manifest.pageModule;
+    }
+    throw new Error(
+      "Astro couldn't find the correct page to render, probably because it wasn't correctly mapped for SSR usage. This is an internal error, please file an issue."
+    );
+  }
   async tryRewrite(payload, request) {
     const { newUrl, pathname, routeData } = findRouteToRewrite({
       payload,
@@ -66,39 +110,11 @@ class AppPipeline extends Pipeline {
       trailingSlash: this.manifest.trailingSlash,
       buildFormat: this.manifest.buildFormat,
       base: this.manifest.base,
-      outDir: this.serverLike ? this.manifest.buildClientDir : this.manifest.outDir
+      outDir: this.manifest?.serverLike ? this.manifest.buildClientDir : this.manifest.outDir
     });
     const componentInstance = await this.getComponentByRoute(routeData);
     return { newUrl, pathname, componentInstance, routeData };
   }
-  async getModuleForRoute(route) {
-    for (const defaultRoute of this.defaultRoutes) {
-      if (route.component === defaultRoute.component) {
-        return {
-          page: () => Promise.resolve(defaultRoute.instance),
-          renderers: []
-        };
-      }
-    }
-    if (route.type === "redirect") {
-      return RedirectSinglePageBuiltModule;
-    } else {
-      if (this.manifest.pageMap) {
-        const importComponentInstance = this.manifest.pageMap.get(route.component);
-        if (!importComponentInstance) {
-          throw new Error(
-            `Unexpectedly unable to find a component instance for route ${route.route}`
-          );
-        }
-        return await importComponentInstance();
-      } else if (this.manifest.pageModule) {
-        return this.manifest.pageModule;
-      }
-      throw new Error(
-        "Astro couldn't find the correct page to render, probably because it wasn't correctly mapped for SSR usage. This is an internal error, please file an issue."
-      );
-    }
-  }
 }
 export {
   AppPipeline

package/dist/core/app/types.d.ts

@@ -1,12 +1,13 @@
-import type { ZodType } from 'zod';
-import type { ActionAccept, ActionClient } from '../../actions/runtime/server.js';
-import type { RoutingStrategies } from '../../i18n/utils.js';
+import type { ActionClient } from '../../actions/runtime/types.js';
 import type { ComponentInstance, SerializedRouteData } from '../../types/astro.js';
 import type { AstroMiddlewareInstance } from '../../types/public/common.js';
 import type { AstroConfig, CspAlgorithm, Locales, RemotePattern, ResolvedSessionConfig } from '../../types/public/config.js';
 import type { RouteData, SSRComponentMetadata, SSRLoadedRenderer, SSRResult } from '../../types/public/internal.js';
 import type { SinglePageBuiltModule } from '../build/types.js';
 import type { CspDirective } from '../csp/config.js';
+import type { LoggerLevel } from '../logger/core.js';
+import type { SessionDriver } from '../session.js';
+import type { RoutingStrategies } from './common.js';
 type ComponentPath = string;
 export type StylesheetAsset = {
     type: 'inline';
@@ -15,28 +16,32 @@ export type StylesheetAsset = {
     type: 'external';
     src: string;
 };
+type ScriptAsset = {
+    children: string;
+    stage: string;
+} | {
+    type: 'inline' | 'external';
+    value: string;
+};
 export interface RouteInfo {
     routeData: RouteData;
     file: string;
     links: string[];
-    scripts: ({
-        children: string;
-        stage: string;
-    } | {
-        type: 'inline' | 'external';
-        value: string;
-    })[];
+    scripts: ScriptAsset[];
     styles: StylesheetAsset[];
 }
 export type SerializedRouteInfo = Omit<RouteInfo, 'routeData'> & {
     routeData: SerializedRouteData;
 };
 type ImportComponentInstance = () => Promise<SinglePageBuiltModule>;
+export type ServerIslandMappings = {
+    serverIslandMap?: Map<string, () => Promise<ComponentInstance>>;
+    serverIslandNameMap?: Map<string, string>;
+};
 export type AssetsPrefix = string | ({
     fallback: string;
 } & Record<string, string>) | undefined;
 export type SSRManifest = {
-    hrefRoot: string;
     adapterName: string;
     routes: RouteInfo[];
     site?: string;
@@ -53,6 +58,13 @@ export type SSRManifest = {
     compressHTML: boolean;
     assetsPrefix?: AssetsPrefix;
     renderers: SSRLoadedRenderer[];
+    /**
+     * Based on Astro config's `output` option, `true` if "server" or "hybrid".
+     *
+     * Whether this application is SSR-like. If so, this has some implications, such as
+     * the creation of `dist/client` and `dist/server` folders.
+     */
+    serverLike: boolean;
     /**
      * Map of directive name (e.g. `load`) to the directive script code
      */
@@ -63,26 +75,43 @@ export type SSRManifest = {
     componentMetadata: SSRResult['componentMetadata'];
     pageModule?: SinglePageBuiltModule;
     pageMap?: Map<ComponentPath, ImportComponentInstance>;
-    serverIslandMap?: Map<string, () => Promise<ComponentInstance>>;
-    serverIslandNameMap?: Map<string, string>;
+    serverIslandMappings?: () => Promise<ServerIslandMappings> | ServerIslandMappings;
     key: Promise<CryptoKey>;
     i18n: SSRManifestI18n | undefined;
     middleware?: () => Promise<AstroMiddlewareInstance> | AstroMiddlewareInstance;
     actions?: () => Promise<SSRActions> | SSRActions;
+    sessionDriver?: () => Promise<{
+        default: SessionDriver | null;
+    }>;
     checkOrigin: boolean;
     allowedDomains?: Partial<RemotePattern>[];
     sessionConfig?: ResolvedSessionConfig<any>;
-    cacheDir: string | URL;
-    srcDir: string | URL;
-    outDir: string | URL;
-    publicDir: string | URL;
-    buildClientDir: string | URL;
-    buildServerDir: string | URL;
+    cacheDir: URL;
+    srcDir: URL;
+    outDir: URL;
+    rootDir: URL;
+    publicDir: URL;
+    assetsDir: string;
+    buildClientDir: URL;
+    buildServerDir: URL;
     csp: SSRManifestCSP | undefined;
+    devToolbar: {
+        enabled: boolean;
+        /**
+         * Latest version of Astro, will be undefined if:
+         * - unable to check
+         * - the user has disabled the check
+         * - the check has not completed yet
+         * - the user is on the latest version already
+         */
+        latestAstroVersion: string | undefined;
+        debugInfoOutput: string | undefined;
+    };
     internalFetchHeaders?: Record<string, string>;
+    logLevel: LoggerLevel;
 };
 export type SSRActions = {
-    server: Record<string, ActionClient<unknown, ActionAccept, ZodType>>;
+    server: Record<string, ActionClient<any, any, any>>;
 };
 export type SSRManifestI18n = {
     fallback: Record<string, string> | undefined;
@@ -91,6 +120,7 @@ export type SSRManifestI18n = {
     locales: Locales;
     defaultLocale: string;
     domainLookupTable: Record<string, string>;
+    domains: Record<string, string> | undefined;
 };
 export type SSRManifestCSP = {
     cspDestination: 'adapter' | 'meta' | 'header' | undefined;
@@ -103,13 +133,19 @@ export type SSRManifestCSP = {
     directives: CspDirective[];
 };
 /** Public type exposed through the `astro:build:ssr` integration hook */
-export type SerializedSSRManifest = Omit<SSRManifest, 'middleware' | 'routes' | 'assets' | 'componentMetadata' | 'inlinedScripts' | 'clientDirectives' | 'serverIslandNameMap' | 'key'> & {
+export type SerializedSSRManifest = Omit<SSRManifest, 'middleware' | 'routes' | 'assets' | 'componentMetadata' | 'inlinedScripts' | 'clientDirectives' | 'serverIslandNameMap' | 'key' | 'rootDir' | 'srcDir' | 'cacheDir' | 'outDir' | 'publicDir' | 'buildClientDir' | 'buildServerDir'> & {
+    rootDir: string;
+    srcDir: string;
+    cacheDir: string;
+    outDir: string;
+    publicDir: string;
+    buildClientDir: string;
+    buildServerDir: string;
     routes: SerializedRouteInfo[];
     assets: string[];
     componentMetadata: [string, SSRComponentMetadata][];
     inlinedScripts: [string, string][];
     clientDirectives: [string, string][];
-    serverIslandNameMap: [string, string][];
     key: string;
 };
 export type NodeAppHeadersJson = {

package/dist/core/app/validate-forwarded-headers.d.ts

@@ -0,0 +1,16 @@
+import { type RemotePattern } from '../../assets/utils/remotePattern.js';
+/**
+ * Validate a hostname by rejecting any with path separators.
+ * Prevents path injection attacks. Invalid hostnames return undefined.
+ */
+export declare function sanitizeHost(hostname: string | undefined): string | undefined;
+/**
+ * Validate forwarded headers (proto, host, port) against allowedDomains.
+ * Returns validated values or undefined for rejected headers.
+ * Uses strict defaults: http/https only for proto, rejects port if not in allowedDomains.
+ */
+export declare function validateForwardedHeaders(forwardedProtocol?: string, forwardedHost?: string, forwardedPort?: string, allowedDomains?: Partial<RemotePattern>[]): {
+    protocol?: string;
+    host?: string;
+    port?: string;
+};

package/dist/core/app/validate-forwarded-headers.js

@@ -0,0 +1,60 @@
+import { matchPattern } from "../../assets/utils/remotePattern.js";
+function sanitizeHost(hostname) {
+  if (!hostname) return void 0;
+  if (/[/\\]/.test(hostname)) return void 0;
+  return hostname;
+}
+function validateForwardedHeaders(forwardedProtocol, forwardedHost, forwardedPort, allowedDomains) {
+  const result = {};
+  if (forwardedProtocol) {
+    if (allowedDomains && allowedDomains.length > 0) {
+      const hasProtocolPatterns = allowedDomains.some((pattern) => pattern.protocol !== void 0);
+      if (hasProtocolPatterns) {
+        try {
+          const testUrl = new URL(`${forwardedProtocol}://example.com`);
+          const isAllowed = allowedDomains.some((pattern) => matchPattern(testUrl, pattern));
+          if (isAllowed) {
+            result.protocol = forwardedProtocol;
+          }
+        } catch {
+        }
+      } else if (/^https?$/.test(forwardedProtocol)) {
+        result.protocol = forwardedProtocol;
+      }
+    } else if (/^https?$/.test(forwardedProtocol)) {
+      result.protocol = forwardedProtocol;
+    }
+  }
+  if (forwardedPort && allowedDomains && allowedDomains.length > 0) {
+    const hasPortPatterns = allowedDomains.some((pattern) => pattern.port !== void 0);
+    if (hasPortPatterns) {
+      const isAllowed = allowedDomains.some((pattern) => pattern.port === forwardedPort);
+      if (isAllowed) {
+        result.port = forwardedPort;
+      }
+    }
+  }
+  if (forwardedHost && forwardedHost.length > 0 && allowedDomains && allowedDomains.length > 0) {
+    const protoForValidation = result.protocol || "https";
+    const sanitized = sanitizeHost(forwardedHost);
+    if (sanitized) {
+      try {
+        const hostnameOnly = sanitized.split(":")[0];
+        const portFromHost = sanitized.includes(":") ? sanitized.split(":")[1] : void 0;
+        const portForValidation = result.port || portFromHost;
+        const hostWithPort = portForValidation ? `${hostnameOnly}:${portForValidation}` : hostnameOnly;
+        const testUrl = new URL(`${protoForValidation}://${hostWithPort}`);
+        const isAllowed = allowedDomains.some((pattern) => matchPattern(testUrl, pattern));
+        if (isAllowed) {
+          result.host = sanitized;
+        }
+      } catch {
+      }
+    }
+  }
+  return result;
+}
+export {
+  sanitizeHost,
+  validateForwardedHeaders
+};