astro 7.0.0-alpha.0 → 7.0.0-alpha.2

package/dist/assets/services/sharp.js

@@ -1,4 +1,6 @@
 import { AstroError, AstroErrorData } from "../../core/errors/index.js";
+import { resolveDefaultOutputFormat } from "../utils/inferSourceFormat.js";
+import { detector } from "../utils/vendor/image-size/detector.js";
 import {
   baseService,
   parseQuality
@@ -20,6 +22,9 @@ function resolveSharpQuality(quality) {
 }
 function resolveSharpEncoderOptions(transform, inputFormat, serviceConfig = {}) {
   const quality = resolveSharpQuality(transform.quality);
+  if (transform.format === void 0) {
+    return quality === void 0 ? void 0 : { quality };
+  }
   switch (transform.format) {
     case "jpg":
     case "jpeg":
@@ -81,14 +86,35 @@ const sharpService = {
     if (!sharp) sharp = await loadSharp();
     const transform = transformOptions;
     const kernel = config.service.config.kernel;
-    if (transform.format === "svg") return { data: inputBuffer, format: "svg" };
+    const bufferFormat = detector(inputBuffer);
+    const outputFormat = transform.format ?? resolveDefaultOutputFormat(bufferFormat);
+    if (outputFormat === "svg") {
+      if (bufferFormat && bufferFormat !== "svg") {
+        console.warn(
+          `\u26A0\uFE0F  Astro expected an SVG for "${transform.src}" but the source is ${bufferFormat}. Passing it through as ${bufferFormat} instead.`
+        );
+        return { data: inputBuffer, format: bufferFormat };
+      }
+      return { data: inputBuffer, format: "svg" };
+    }
+    if (!bufferFormat) {
+      throw new AstroError({
+        ...AstroErrorData.NoImageMetadata,
+        message: AstroErrorData.NoImageMetadata.message(transform.src)
+      });
+    }
+    if (bufferFormat === "svg" && !config.dangerouslyProcessSVG) {
+      throw new AstroError({
+        ...AstroErrorData.UnsupportedImageFormat,
+        message: `SVG image processing is disabled, but the source for "${transform.src}" is an SVG. Pass it through unchanged by setting \`format="svg"\` on the component, or set \`image.dangerouslyProcessSVG: true\` to rasterize SVG sources.`
+      });
+    }
     const result = sharp(inputBuffer, {
       failOnError: false,
       pages: -1,
       limitInputPixels: config.service.config.limitInputPixels
     });
     result.rotate();
-    const { format } = await result.metadata();
     if (transform.width && transform.height) {
       const fit = transform.fit ? fitMap[transform.fit] ?? "inside" : void 0;
       result.resize({
@@ -115,23 +141,32 @@ const sharpService = {
     if (transform.background) {
       result.flatten({ background: transform.background });
     }
-    if (transform.format) {
-      const encoderOptions = resolveSharpEncoderOptions(transform, format, config.service.config);
-      if (transform.format === "webp" && format === "gif") {
-        result.webp(encoderOptions);
-      } else if (transform.format === "webp") {
-        result.webp(encoderOptions);
-      } else if (transform.format === "png") {
-        result.png(encoderOptions);
-      } else if (transform.format === "avif") {
-        result.avif(encoderOptions);
-      } else if (transform.format === "jpeg" || transform.format === "jpg") {
-        result.jpeg(encoderOptions);
-      } else {
-        result.toFormat(transform.format, encoderOptions);
-      }
+    const encoderOptions = resolveSharpEncoderOptions(
+      { format: outputFormat, quality: transform.quality },
+      bufferFormat,
+      config.service.config
+    );
+    if (outputFormat === "webp") {
+      result.webp(encoderOptions);
+    } else if (outputFormat === "png") {
+      result.png(encoderOptions);
+    } else if (outputFormat === "avif") {
+      result.avif(encoderOptions);
+    } else if (outputFormat === "jpeg" || outputFormat === "jpg") {
+      result.jpeg(encoderOptions);
+    } else {
+      result.toFormat(outputFormat, encoderOptions);
+    }
+    let data;
+    let info;
+    try {
+      ({ data, info } = await result.toBuffer({ resolveWithObject: true }));
+    } catch {
+      console.warn(
+        `\u26A0\uFE0F  Astro could not optimize image "${transform.src}". Sharp doesn't support this format. The image will be used unoptimized. Consider converting to WebP or placing in the public/ folder.`
+      );
+      return { data: inputBuffer, format: bufferFormat };
     }
-    const { data, info } = await result.toBuffer({ resolveWithObject: true });
     const needsCopy = "buffer" in data && data.buffer instanceof SharedArrayBuffer;
     return {
       data: needsCopy ? new Uint8Array(data) : data,

package/dist/assets/utils/generateImageStylesCSS.js

@@ -1,4 +1,20 @@
 import { cssFitValues } from "../internal.js";
+const POSITION_KEYWORDS = ["top", "bottom", "left", "right", "center"];
+function getPositionEntries() {
+  const entries = [];
+  for (const kw of POSITION_KEYWORDS) {
+    entries.push([kw, kw]);
+  }
+  for (const a of POSITION_KEYWORDS) {
+    for (const b of POSITION_KEYWORDS) {
+      if (a === b) continue;
+      const cssValue = `${a} ${b}`;
+      const dataAttr = `${a}-${b}`;
+      entries.push([dataAttr, cssValue]);
+    }
+  }
+  return entries;
+}
 function generateImageStylesCSS(defaultObjectFit, defaultObjectPosition) {
   const fitStyles = cssFitValues.map(
     (fit) => `
@@ -10,11 +26,14 @@ function generateImageStylesCSS(defaultObjectFit, defaultObjectPosition) {
 :where([data-astro-image]:not([data-astro-image-fit])) {
   object-fit: ${defaultObjectFit};
 }` : "";
-  const positionStyle = defaultObjectPosition ? `
-[data-astro-image-pos="${defaultObjectPosition.replace(/\s+/g, "-")}"] {
-  object-position: ${defaultObjectPosition};
-}
-
+  const positionEntries = getPositionEntries();
+  const positionStyles = positionEntries.map(
+    ([dataAttr, cssValue]) => `
+[data-astro-image-pos="${dataAttr}"] {
+  object-position: ${cssValue};
+}`
+  ).join("\n");
+  const defaultPositionStyle = defaultObjectPosition ? `
 :where([data-astro-image]:not([data-astro-image-pos])) {
   object-position: ${defaultObjectPosition};
 }` : "";
@@ -30,7 +49,8 @@ function generateImageStylesCSS(defaultObjectFit, defaultObjectPosition) {
 }
 ${fitStyles}
 ${defaultFitStyle}
-${positionStyle}
+${positionStyles}
+${defaultPositionStyle}
 `.trim();
 }
 export {

package/dist/assets/utils/index.d.ts

@@ -10,3 +10,4 @@ export { isESMImportedImage, isRemoteImage, resolveSrc } from './imageKind.js';
 export { imageMetadata } from './metadata.js';
 export { getOrigQueryParams } from './queryParams.js';
 export { inferRemoteSize } from './remoteProbe.js';
+export { fetchWithRedirects } from './redirectValidation.js';

package/dist/assets/utils/index.js

@@ -7,8 +7,10 @@ import { isESMImportedImage, isRemoteImage, resolveSrc } from "./imageKind.js";
 import { imageMetadata } from "./metadata.js";
 import { getOrigQueryParams } from "./queryParams.js";
 import { inferRemoteSize } from "./remoteProbe.js";
+import { fetchWithRedirects } from "./redirectValidation.js";
 export {
   emitClientAsset,
+  fetchWithRedirects,
   getOrigQueryParams,
   imageMetadata,
   inferRemoteSize,

package/dist/assets/utils/inferSourceFormat.d.ts

@@ -1,6 +1,11 @@
 /**
- * Infer the image format from a source path or URL by examining
- * the file extension. For data: URIs, the MIME type is extracted.
- * Returns undefined if the format cannot be determined.
+ * Infer the image format from a source path or URL.
+ *
+ * For `data:` URIs the MIME is read up to the first `;` or `,` (whichever comes first),
+ * so both `data:image/svg+xml;base64,...` and `data:image/svg+xml,<svg>...` work.
+ * `image/svg+xml` normalizes to `svg`; otherwise the subtype after the slash is returned.
+ *
+ * Returns undefined when the format cannot be determined.
  */
 export declare function inferSourceFormat(src: string): string | undefined;
+export declare function resolveDefaultOutputFormat(sourceFormat: string | undefined): string;

package/dist/assets/utils/inferSourceFormat.js

@@ -1,21 +1,32 @@
 import { removeQueryString } from "@astrojs/internal-helpers/path";
+import { DEFAULT_OUTPUT_FORMAT } from "../consts.js";
 const DATA_PREFIX = "data:";
 function inferSourceFormat(src) {
   if (src.startsWith(DATA_PREFIX)) {
-    const mime = src.slice(DATA_PREFIX.length, src.indexOf(";"));
+    const sepIndex = src.indexOf(";");
+    const commaIndex = src.indexOf(",");
+    const mimeEnd = sepIndex === -1 ? commaIndex : commaIndex === -1 ? sepIndex : Math.min(sepIndex, commaIndex);
+    if (mimeEnd === -1) return void 0;
+    const mime = src.slice(DATA_PREFIX.length, mimeEnd);
     if (mime === "image/svg+xml") return "svg";
     const sub = mime.split("/")[1];
     return sub || void 0;
   }
   try {
     const cleanSrc = removeQueryString(src).split("#")[0];
-    const lastDot = cleanSrc.lastIndexOf(".");
+    const lastSlash = cleanSrc.lastIndexOf("/");
+    const basename = lastSlash === -1 ? cleanSrc : cleanSrc.slice(lastSlash + 1);
+    const lastDot = basename.lastIndexOf(".");
     if (lastDot === -1) return void 0;
-    return cleanSrc.slice(lastDot + 1).toLowerCase();
+    return basename.slice(lastDot + 1).toLowerCase();
   } catch {
     return void 0;
   }
 }
+function resolveDefaultOutputFormat(sourceFormat) {
+  return sourceFormat === "svg" ? "svg" : DEFAULT_OUTPUT_FORMAT;
+}
 export {
-  inferSourceFormat
+  inferSourceFormat,
+  resolveDefaultOutputFormat
 };

package/dist/assets/utils/metadata.js

@@ -10,7 +10,7 @@ async function imageMetadata(data, src) {
       message: AstroErrorData.NoImageMetadata.message(src)
     });
   }
-  if (!result.height || !result.width || !result.type) {
+  if (result.height == null || result.width == null || !result.type) {
     throw new AstroError({
       ...AstroErrorData.NoImageMetadata,
       message: AstroErrorData.NoImageMetadata.message(src)

package/dist/assets/utils/redirectValidation.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Utilities for handling HTTP redirects with validation
+ */
+import type { AstroConfig } from '../../types/public/config.js';
+export type RemoteImageConfig = Pick<AstroConfig['image'], 'remotePatterns' | 'domains'>;
+export type FetchRedirectOptions = {
+    /**
+     * URL to fetch (either string or URL object)
+     */
+    url: string | URL;
+    /**
+     * Headers to include in the request (optional)
+     */
+    headers?: Headers;
+    /**
+     * Image config for validating redirect destinations (optional)
+     */
+    imageConfig: RemoteImageConfig;
+    /**
+     * Fetch function to use (default: globalThis.fetch)
+     */
+    fetchFn?: typeof fetch;
+    /**
+     * Maximum number of redirects to follow (default: 10)
+     */
+    redirectLimit?: number;
+    /**
+     * Error handler for redirect depth exceeded (default: generic Error)
+     */
+    onMaxRedirectsExceeded?: (url: string) => Error;
+    /**
+     * Error handler for missing Location header (default: generic Error)
+     */
+    onMissingLocationHeader?: (status: number, url: string) => Error;
+    /**
+     * Error handler for disallowed redirect (default: generic Error)
+     */
+    onDisallowedRedirect?: (currentUrl: string, targetUrl: string) => Error;
+};
+/**
+ * Recursively follows HTTP redirects with validation according to the image configuration.
+ *
+ * If any of the domains in the redirect chain are not allowed by either `image.remotePatterns`
+ * or `image.domains`, this function will throw an error for a disallowed redirect.
+ *
+ * @param options The options for this fetch call.
+ */
+export declare function fetchWithRedirects(options: FetchRedirectOptions): Promise<Response>;

package/dist/assets/utils/redirectValidation.js

@@ -0,0 +1,48 @@
+import { isRemoteAllowed } from "@astrojs/internal-helpers/remote";
+async function fetchWithRedirects(options) {
+  const {
+    url,
+    headers,
+    imageConfig,
+    fetchFn = globalThis.fetch,
+    redirectLimit = 10,
+    onMaxRedirectsExceeded = (_u) => new Error("Maximum redirect depth exceeded"),
+    onMissingLocationHeader = (_s, _u) => new Error(`Redirect response ${_s} missing Location header`),
+    onDisallowedRedirect = (_current, _target) => new Error(
+      `The image at ${_current} redirected to ${_target}, which is not an allowed remote location.`
+    )
+  } = options;
+  if (redirectLimit <= 0) {
+    throw onMaxRedirectsExceeded(typeof url === "string" ? url : url.toString());
+  }
+  const urlString = typeof url === "string" ? url : url.toString();
+  const req = new Request(url, { headers });
+  const res = await fetchFn(req, { redirect: "manual" });
+  if ([301, 302, 303, 307, 308].includes(res.status)) {
+    const location = res.headers.get("Location");
+    if (!location) {
+      throw onMissingLocationHeader(res.status, urlString);
+    }
+    const redirectUrl = new URL(location, urlString).toString();
+    if (!isRemoteAllowed(redirectUrl, {
+      domains: imageConfig.domains ?? [],
+      remotePatterns: imageConfig.remotePatterns ?? []
+    })) {
+      throw onDisallowedRedirect(urlString, redirectUrl);
+    }
+    return fetchWithRedirects({
+      url: redirectUrl,
+      headers,
+      imageConfig,
+      fetchFn,
+      redirectLimit: redirectLimit - 1,
+      onMaxRedirectsExceeded,
+      onMissingLocationHeader,
+      onDisallowedRedirect
+    });
+  }
+  return res;
+}
+export {
+  fetchWithRedirects
+};

package/dist/assets/utils/remoteProbe.js

@@ -1,6 +1,7 @@
 import { isRemoteAllowed } from "@astrojs/internal-helpers/remote";
 import { AstroError, AstroErrorData } from "../../core/errors/index.js";
 import { imageMetadata } from "./metadata.js";
+import { fetchWithRedirects } from "./redirectValidation.js";
 async function inferRemoteSize(url, imageConfig) {
   if (!URL.canParse(url)) {
     throw new AstroError({
@@ -27,13 +28,35 @@ async function inferRemoteSize(url, imageConfig) {
       message: AstroErrorData.RemoteImageNotAllowed.message(url)
     });
   }
-  const response = await fetch(url, { redirect: "manual" });
-  if (response.status >= 300 && response.status < 400) {
+  let response;
+  try {
+    response = await fetchWithRedirects({
+      url,
+      onMaxRedirectsExceeded: (u) => new AstroError({
+        ...AstroErrorData.FailedToFetchRemoteImageDimensions,
+        message: AstroErrorData.FailedToFetchRemoteImageDimensions.message(u)
+      }),
+      onMissingLocationHeader: (_status, u) => new AstroError({
+        ...AstroErrorData.FailedToFetchRemoteImageDimensions,
+        message: AstroErrorData.FailedToFetchRemoteImageDimensions.message(u)
+      }),
+      imageConfig: imageConfig ?? {
+        remotePatterns: [],
+        domains: []
+      }
+    });
+  } catch (_err) {
     throw new AstroError({
       ...AstroErrorData.FailedToFetchRemoteImageDimensions,
       message: AstroErrorData.FailedToFetchRemoteImageDimensions.message(url)
     });
   }
+  if (allowlistConfig && !isRemoteAllowed(response.url, allowlistConfig)) {
+    throw new AstroError({
+      ...AstroErrorData.RemoteImageNotAllowed,
+      message: AstroErrorData.RemoteImageNotAllowed.message(url)
+    });
+  }
   if (!response.body || !response.ok) {
     throw new AstroError({
       ...AstroErrorData.FailedToFetchRemoteImageDimensions,

package/dist/assets/utils/vendor/image-size/types/svg.js

@@ -77,7 +77,7 @@ const SVG = {
     const root = extractorRegExps.root.exec(toUTF8String(input));
     if (root) {
       const attrs = parseAttributes(root[0]);
-      if (attrs.width && attrs.height) {
+      if (attrs.width != null && attrs.height != null) {
         return calculateByDimensions(attrs);
       }
       if (attrs.viewbox) {

package/dist/cli/add/index.js

@@ -197,12 +197,6 @@ async function add(names, { flags }) {
           logger,
           scripts: { "generate-types": "wrangler types" }
         });
-        await updatePackageJsonOverrides({
-          configURL,
-          flags,
-          logger,
-          overrides: { vite: "^7" }
-        });
       }
       if (integrations.find((integration) => integration.id === "tailwind")) {
         const dir = new URL("./styles/", new URL(userConfig.srcDir ?? "./src/", root));
@@ -590,54 +584,6 @@ async function updateAstroConfig({
     return "cancelled";
   }
 }
-async function updatePackageJsonOverrides({
-  configURL,
-  flags,
-  logger,
-  overrides
-}) {
-  const pkgURL = new URL("./package.json", configURL);
-  if (!existsSync(pkgURL)) {
-    logger.debug("add", "No package.json found, skipping overrides update");
-    return "none";
-  }
-  const pkgPath = fileURLToPath(pkgURL);
-  const input = await fs.readFile(pkgPath, { encoding: "utf-8" });
-  const pkgJson = JSON.parse(input);
-  pkgJson.overrides ??= {};
-  let hasChanges = false;
-  for (const [name, range] of Object.entries(overrides)) {
-    if (!(name in pkgJson.overrides)) {
-      pkgJson.overrides[name] = range;
-      hasChanges = true;
-    }
-  }
-  if (!hasChanges) {
-    return "none";
-  }
-  const output = JSON.stringify(pkgJson, null, 2);
-  const diff = getDiffContent(input, output);
-  if (!diff) {
-    return "none";
-  }
-  logger.info(
-    "SKIP_FORMAT",
-    `
-  ${magenta("Astro will add the following overrides to your package.json:")}`
-  );
-  clack.box(diff, "package.json", {
-    rounded: true,
-    withGuide: false,
-    width: "auto"
-  });
-  if (await askToContinue({ flags, logger })) {
-    await fs.writeFile(pkgPath, output, { encoding: "utf-8" });
-    logger.debug("add", "Updated package.json overrides");
-    return "updated";
-  } else {
-    return "cancelled";
-  }
-}
 async function updatePackageJsonScripts({
   configURL,
   flags,
@@ -898,14 +844,17 @@ async function updateTSConfig(cwd = process.cwd(), logger, integrationsInfo, fla
   }
   let inputConfig = await loadTSConfig(cwd);
   let inputConfigText = "";
-  if (inputConfig === "invalid-config" || inputConfig === "unknown-error") {
+  if (inputConfig.error === "invalid-config") {
+    logger.warn(`add`, `Couldn't parse tsconfig.json or jsconfig.json: ${inputConfig.message}`);
     return "failure";
-  } else if (inputConfig === "missing-config") {
+  } else if (inputConfig.error === "missing-config") {
     logger.debug("add", "Couldn't find tsconfig.json or jsconfig.json, generating one");
+    const tsconfigFile = path.join(cwd, "tsconfig.json");
     inputConfig = {
       tsconfig: defaultTSConfig,
-      tsconfigFile: path.join(cwd, "tsconfig.json"),
-      rawConfig: defaultTSConfig
+      tsconfigFile,
+      rawConfig: defaultTSConfig,
+      sources: [tsconfigFile]
     };
   } else {
     inputConfigText = JSON.stringify(inputConfig.rawConfig, null, 2);

package/dist/cli/dev/background.d.ts

@@ -0,0 +1,16 @@
+import type { AstroLogger } from '../../core/logger/core.js';
+import type { Flags } from '../flags.js';
+export interface BackgroundResult {
+    pid: number;
+    url: string;
+    existing?: boolean;
+}
+export interface BackgroundErrorResult {
+    error: string;
+    message: string;
+}
+export declare function formatBackgroundOutput(result: BackgroundResult | BackgroundErrorResult): string;
+export declare function background({ flags, logger, }: {
+    flags: Flags;
+    logger: AstroLogger;
+}): Promise<void>;

package/dist/cli/dev/background.js

@@ -0,0 +1,116 @@
+import { spawn } from "node:child_process";
+import { existsSync, mkdirSync, openSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import {
+  checkExistingServer,
+  getLogFileURL,
+  readLockFile,
+  removeLockFile,
+  isProcessAlive,
+  GRACEFUL_SHUTDOWN_TIMEOUT
+} from "../../core/dev/lockfile.js";
+import { resolveRoot } from "../../core/config/config.js";
+function formatBackgroundOutput(result) {
+  return JSON.stringify(result);
+}
+async function background({
+  flags,
+  logger
+}) {
+  const root = pathToFileURL(resolveRoot(flags.root) + "/");
+  const existing = checkExistingServer(root);
+  if (existing && !flags.force) {
+    logger.info(
+      "SKIP_FORMAT",
+      `Dev server already running at ${existing.url} (pid ${existing.pid})
+  Stop:   astro dev stop
+  Status: astro dev status
+  Logs:   astro dev logs`
+    );
+    return;
+  }
+  if (existing && flags.force) {
+    try {
+      process.kill(existing.pid, "SIGTERM");
+    } catch {
+    }
+    const deadline2 = Date.now() + GRACEFUL_SHUTDOWN_TIMEOUT;
+    while (Date.now() < deadline2) {
+      if (!isProcessAlive(existing.pid)) break;
+      await new Promise((r) => setTimeout(r, 100));
+    }
+    if (isProcessAlive(existing.pid)) {
+      try {
+        process.kill(existing.pid, "SIGKILL");
+      } catch {
+      }
+    }
+    removeLockFile(root);
+  }
+  const args = ["dev"];
+  if (flags.port) args.push("--port", String(flags.port));
+  if (flags.host != null) {
+    if (typeof flags.host === "string") {
+      args.push("--host", flags.host);
+    } else {
+      args.push("--host");
+    }
+  }
+  if (flags.config) args.push("--config", String(flags.config));
+  if (flags.root) args.push("--root", String(flags.root));
+  if (flags.allowedHosts) args.push("--allowed-hosts", String(flags.allowedHosts));
+  if (flags.experimentalJson) args.push("--experimental-json");
+  const logFileURL = getLogFileURL(root);
+  const logFilePath = fileURLToPath(logFileURL);
+  const dotAstroDir = fileURLToPath(new URL(".astro/", root));
+  if (!existsSync(dotAstroDir)) {
+    mkdirSync(dotAstroDir, { recursive: true });
+  }
+  const logFd = openSync(logFilePath, "w");
+  const rootPath = fileURLToPath(root);
+  const astroBin = resolve(rootPath, "node_modules", ".bin", "astro");
+  const child = spawn(astroBin, args, {
+    detached: true,
+    stdio: ["ignore", logFd, logFd],
+    cwd: rootPath,
+    env: { ...process.env, ASTRO_DEV_BACKGROUND: "1" }
+  });
+  child.unref();
+  const childPid = child.pid;
+  if (!childPid) {
+    logger.error("SKIP_FORMAT", "Failed to spawn background dev server process.");
+    process.exit(1);
+  }
+  const timeout = 3e4;
+  const deadline = Date.now() + timeout;
+  while (Date.now() < deadline) {
+    if (!isProcessAlive(childPid)) {
+      logger.error("SKIP_FORMAT", "Dev server process exited before becoming ready.");
+      process.exit(1);
+    }
+    const lockData = readLockFile(root);
+    if (lockData && lockData.pid === childPid) {
+      logger.info(
+        "SKIP_FORMAT",
+        `Dev server running at ${lockData.url} (pid ${lockData.pid})
+  Stop:   astro dev stop
+  Status: astro dev status
+  Logs:   astro dev logs`
+      );
+      return;
+    }
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  try {
+    process.kill(childPid, "SIGTERM");
+  } catch {
+  }
+  removeLockFile(root);
+  logger.error("SKIP_FORMAT", `Dev server failed to start within ${timeout / 1e3}s.`);
+  process.exit(1);
+}
+export {
+  background,
+  formatBackgroundOutput
+};