astro 7.0.0-alpha.2 → 7.0.0-beta.4

package/dist/core/middleware/vite-plugin.js

@@ -11,6 +11,9 @@ import { normalizePath } from "../viteUtils.js";
 const MIDDLEWARE_MODULE_ID = "virtual:astro:middleware";
 const MIDDLEWARE_RESOLVED_MODULE_ID = "\0" + MIDDLEWARE_MODULE_ID;
 const NOOP_MIDDLEWARE = "\0noop-middleware";
+function isMiddlewarePath(relativePath) {
+  return relativePath.startsWith(`${MIDDLEWARE_PATH_SEGMENT_NAME}.`) || relativePath.startsWith(`${MIDDLEWARE_PATH_SEGMENT_NAME}/`);
+}
 function vitePluginMiddleware({ settings }) {
   let resolvedMiddlewareId = void 0;
   const hasIntegrationMiddleware = settings.middlewares.pre.length > 0 || settings.middlewares.post.length > 0;
@@ -26,7 +29,7 @@ function vitePluginMiddleware({ settings }) {
         const normalizedPath = viteNormalizePath(path);
         if (!normalizedPath.startsWith(normalizedSrcDir)) return;
         const relativePath = normalizedPath.slice(normalizedSrcDir.length);
-        if (!relativePath.startsWith(`${MIDDLEWARE_PATH_SEGMENT_NAME}.`)) return;
+        if (!isMiddlewarePath(relativePath)) return;
         for (const name of [
           ASTRO_VITE_ENVIRONMENT_NAMES.ssr,
           ASTRO_VITE_ENVIRONMENT_NAMES.astro
@@ -135,6 +138,7 @@ function vitePluginMiddlewareBuild(opts, internals) {
 }
 export {
   MIDDLEWARE_MODULE_ID,
+  isMiddlewarePath,
   vitePluginMiddleware,
   vitePluginMiddlewareBuild
 };

package/dist/core/util/normalized-url.js

@@ -1,15 +1,12 @@
 import { collapseDuplicateSlashes } from "@astrojs/internal-helpers/path";
-import { MultiLevelEncodingError, validateAndDecodePathname } from "./pathname.js";
+import { validateAndDecodePathname } from "./pathname.js";
 function createNormalizedUrl(requestUrl) {
   return normalizeUrl(new URL(requestUrl));
 }
 function normalizeUrl(url) {
   try {
     url.pathname = validateAndDecodePathname(url.pathname);
-  } catch (e) {
-    if (e instanceof MultiLevelEncodingError) {
-      throw e;
-    }
+  } catch {
     try {
       url.pathname = decodeURI(url.pathname);
     } catch {

package/dist/core/util/pathname.d.ts

@@ -2,18 +2,24 @@
  * Error thrown when multi-level URL encoding is detected in a pathname.
  * This is a distinct error type so callers can handle it specifically
  * (e.g., returning a 400 response) rather than falling back to partial decoding.
+ *
+ * @deprecated No longer thrown internally — multi-level encoding is now
+ * decoded iteratively instead of rejected. Kept for backwards compatibility
+ * in case third-party code references the class.
  */
 export declare class MultiLevelEncodingError extends Error {
     constructor();
 }
 /**
- * Validates that a pathname is not multi-level encoded.
- * Detects if a pathname contains encoding that was encoded again (e.g., %2561dmin where %25 decodes to %).
- * This prevents double/triple encoding bypasses of security checks.
+ * Decodes a pathname iteratively until stable, collapsing all levels of
+ * percent-encoding into a single canonical form. This prevents
+ * double/triple encoding from bypassing middleware authorization checks
+ * (CVE-2025-66202) — instead of rejecting multi-level encoding, we
+ * fully resolve it so middleware always sees the true decoded path.
  *
- * @param pathname - The pathname to validate
- * @returns The decoded pathname if valid
- * @throws MultiLevelEncodingError if multi-level encoding is detected
- * @throws Error if the pathname contains invalid URL encoding
+ * @param pathname - The pathname to decode
+ * @returns The fully decoded pathname
+ * @throws Error if the pathname contains invalid URL encoding that
+ *   cannot be decoded at all (e.g., a bare `%` not followed by hex digits)
  */
 export declare function validateAndDecodePathname(pathname: string): string;

package/dist/core/util/pathname.js

@@ -4,19 +4,22 @@ class MultiLevelEncodingError extends Error {
     this.name = "MultiLevelEncodingError";
   }
 }
-const ENCODING_REGEX = /%25[0-9a-fA-F]{2}/;
 function validateAndDecodePathname(pathname) {
-  if (ENCODING_REGEX.test(pathname)) {
-    throw new MultiLevelEncodingError();
-  }
   let decoded;
   try {
     decoded = decodeURI(pathname);
   } catch (_e) {
     throw new Error("Invalid URL encoding");
   }
-  if (ENCODING_REGEX.test(decoded)) {
-    throw new MultiLevelEncodingError();
+  let iterations = 0;
+  while (decoded !== pathname && iterations < 10) {
+    pathname = decoded;
+    try {
+      decoded = decodeURI(pathname);
+    } catch {
+      break;
+    }
+    iterations++;
   }
   return decoded;
 }

package/dist/i18n/index.js

@@ -1,4 +1,8 @@
-import { appendForwardSlash, joinPaths } from "@astrojs/internal-helpers/path";
+import {
+  appendForwardSlash,
+  joinPaths,
+  removeTrailingForwardSlash
+} from "@astrojs/internal-helpers/path";
 import { shouldAppendForwardSlash } from "../core/build/util.js";
 import { REROUTE_DIRECTIVE_HEADER } from "../core/constants.js";
 import { i18nNoLocaleFoundInPath, MissingLocale } from "../core/errors/errors-data.js";
@@ -55,7 +59,7 @@ function getLocaleRelativeUrl({
   if (shouldAppendForwardSlash(trailingSlash, format)) {
     relativePath = appendForwardSlash(joinPaths(...pathsToJoin));
   } else {
-    relativePath = joinPaths(...pathsToJoin);
+    relativePath = removeTrailingForwardSlash(joinPaths(...pathsToJoin));
   }
   if (relativePath === "") {
     return "/";

package/dist/manifest/serialized.js

@@ -142,9 +142,9 @@ async function createSerializedManifest(settings, encodedKey) {
       isStrictDynamic: getStrictDynamic(settings.config.security.csp)
     };
   }
-  let experimentalLogger = void 0;
-  if (settings.config.experimental.logger) {
-    experimentalLogger = settings.config.experimental.logger;
+  let loggerConfig = void 0;
+  if (settings.config.logger) {
+    loggerConfig = settings.config.logger;
   }
   return {
     rootDir: settings.config.root.toString(),
@@ -199,8 +199,7 @@ async function createSerializedManifest(settings, encodedKey) {
     },
     logLevel: settings.logLevel,
     shouldInjectCspMetaTags: false,
-    experimentalQueuedRendering: settings.config.experimental?.queuedRendering,
-    experimentalLogger
+    loggerConfig
   };
 }
 export {

package/dist/runtime/server/index.d.ts

@@ -4,7 +4,7 @@ export { renderEndpoint } from './endpoint.js';
 export { escapeHTML, HTMLBytes, HTMLString, isHTMLString, markHTMLString, unescapeHTML, } from './escape.js';
 export { renderJSX } from './jsx.js';
 export type { AstroComponentFactory, AstroComponentInstance, ComponentSlots, RenderInstruction, } from './render/index.js';
-export { addAttribute, createHeadAndContent, defineScriptVars, Fragment, maybeRenderHead, Renderer as Renderer, renderComponent, renderHead, renderHTMLElement, renderPage, renderScript, renderScriptElement, renderSlot, renderSlotToString, renderTemplate as render, renderTemplate, renderToString, renderUniqueStylesheet, voidElementNames, } from './render/index.js';
+export { addAttribute, chunkToString, createHeadAndContent, defineScriptVars, Fragment, maybeRenderHead, Renderer as Renderer, renderComponent, renderHead, renderHTMLElement, renderPage, renderScript, renderScriptElement, renderSlot, renderSlotToString, renderStreaming, renderTemplate as render, renderTemplate, renderToString, renderUniqueStylesheet, voidElementNames, } from './render/index.js';
 export type { ServerIslandComponent } from './render/server-islands.js';
 export { templateEnter, templateExit } from './render/template-depth.js';
 export { createTransitionScope, renderTransition } from './transition.js';

package/dist/runtime/server/index.js

@@ -12,6 +12,7 @@ import {
 import { renderJSX } from "./jsx.js";
 import {
   addAttribute,
+  chunkToString,
   createHeadAndContent,
   defineScriptVars,
   Fragment,
@@ -25,6 +26,7 @@ import {
   renderScriptElement,
   renderSlot,
   renderSlotToString,
+  renderStreaming,
   renderTemplate,
   renderTemplate as renderTemplate2,
   renderToString,
@@ -91,6 +93,7 @@ export {
   Renderer,
   __astro_tag_component__,
   addAttribute,
+  chunkToString,
   createAstro,
   createComponent,
   createHeadAndContent,
@@ -113,6 +116,7 @@ export {
   renderScriptElement,
   renderSlot,
   renderSlotToString,
+  renderStreaming,
   renderTemplate2 as renderTemplate,
   renderToString,
   renderTransition,

package/dist/runtime/server/jsx.js

@@ -87,7 +87,7 @@ Did you forget to import the component or is it possible there is a typo?`);
           _slots.default.push(child);
           return;
         }
-        if ("slot" in child.props) {
+        if ("slot" in child.props && !isCustomElement) {
           _slots[child.props.slot] = [..._slots[child.props.slot] ?? [], child];
           delete child.props.slot;
           return;
@@ -116,6 +116,7 @@ Did you forget to import the component or is it possible there is a typo?`);
       const _slots = {
         default: []
       };
+      const isCustomElement = typeof vnode.type === "string" && vnode.type.includes("-");
       extractSlots2(children);
       for (const [key, value] of Object.entries(props)) {
         if (value?.["$$slot"]) {

package/dist/runtime/server/render/astro/render-template.d.ts

@@ -2,7 +2,7 @@ import type { RenderDestination } from '../common.js';
 declare const renderTemplateResultSym: unique symbol;
 export declare class RenderTemplateResult {
     [renderTemplateResultSym]: boolean;
-    private htmlParts;
+    readonly htmlParts: TemplateStringsArray;
     expressions: any[];
     private error;
     constructor(htmlParts: TemplateStringsArray, expressions: unknown[]);

package/dist/runtime/server/render/astro/render.d.ts

@@ -1,9 +1,5 @@
 import type { RouteData, SSRResult } from '../../../../types/public/internal.js';
 import type { AstroComponentFactory } from './factory.js';
-/**
- * Queue-based rendering to AsyncIterable
- * NOTE: Currently disabled for .astro files. Kept for potential future use.
- */
 export declare function renderToString(result: SSRResult, componentFactory: AstroComponentFactory, props: any, children: any, isPage?: boolean, route?: RouteData): Promise<string | Response>;
 export declare function renderToReadableStream(result: SSRResult, componentFactory: AstroComponentFactory, props: any, children: any, isPage?: boolean, route?: RouteData): Promise<ReadableStream | Response>;
 export declare function bufferHeadContent(result: SSRResult): Promise<void>;

package/dist/runtime/server/render/astro/render.js

@@ -8,18 +8,11 @@ import {
 } from "../common.js";
 import { promiseWithResolvers } from "../util.js";
 import { bufferPropagatedHead } from "../head-propagation/runtime.js";
+import { renderStreaming } from "../streaming.js";
 import { isHeadAndContent } from "./head-and-content.js";
 import { isRenderTemplateResult } from "./render-template.js";
 const DOCTYPE_EXP = /<!doctype html/i;
-async function renderToString(result, componentFactory, props, children, isPage = false, route) {
-  const templateResult = await callComponentAsTemplateResultOrResponse(
-    result,
-    componentFactory,
-    props,
-    children,
-    route
-  );
-  if (templateResult instanceof Response) return templateResult;
+async function renderStreamToString(result, templateResult, isPage) {
   let str = "";
   let renderedFirstPageChunk = false;
   if (isPage) {
@@ -38,18 +31,10 @@ async function renderToString(result, componentFactory, props, children, isPage
       str += chunkToString(result, chunk);
     }
   };
-  await templateResult.render(destination);
+  await renderStreaming(templateResult, result, destination);
   return str;
 }
-async function renderToReadableStream(result, componentFactory, props, children, isPage = false, route) {
-  const templateResult = await callComponentAsTemplateResultOrResponse(
-    result,
-    componentFactory,
-    props,
-    children,
-    route
-  );
-  if (templateResult instanceof Response) return templateResult;
+async function renderStreamToStream(result, templateResult, isPage, route) {
   let renderedFirstPageChunk = false;
   if (isPage) {
     await bufferHeadContent(result);
@@ -76,7 +61,7 @@ async function renderToReadableStream(result, componentFactory, props, children,
       };
       (async () => {
         try {
-          await templateResult.render(destination);
+          await renderStreaming(templateResult, result, destination);
           controller.close();
         } catch (e) {
           if (AstroError.is(e) && !e.loc) {
@@ -93,55 +78,15 @@ async function renderToReadableStream(result, componentFactory, props, children,
     }
   });
 }
-async function callComponentAsTemplateResultOrResponse(result, componentFactory, props, children, route) {
-  const factoryResult = await componentFactory(result, props, children);
-  if (factoryResult instanceof Response) {
-    return factoryResult;
-  } else if (isHeadAndContent(factoryResult)) {
-    if (!isRenderTemplateResult(factoryResult.content)) {
-      throw new AstroError({
-        ...AstroErrorData.OnlyResponseCanBeReturned,
-        message: AstroErrorData.OnlyResponseCanBeReturned.message(
-          route?.route,
-          typeof factoryResult
-        ),
-        location: {
-          file: route?.component
-        }
-      });
-    }
-    return factoryResult.content;
-  } else if (!isRenderTemplateResult(factoryResult)) {
-    throw new AstroError({
-      ...AstroErrorData.OnlyResponseCanBeReturned,
-      message: AstroErrorData.OnlyResponseCanBeReturned.message(route?.route, typeof factoryResult),
-      location: {
-        file: route?.component
-      }
-    });
-  }
-  return factoryResult;
-}
-async function bufferHeadContent(result) {
-  await bufferPropagatedHead(result);
-}
-async function renderToAsyncIterable(result, componentFactory, props, children, isPage = false, route) {
-  const templateResult = await callComponentAsTemplateResultOrResponse(
-    result,
-    componentFactory,
-    props,
-    children,
-    route
-  );
-  if (templateResult instanceof Response) return templateResult;
+async function renderStreamToAsyncIterable(result, templateResult, isPage, _route) {
   let renderedFirstPageChunk = false;
-  if (isPage) {
-    await bufferHeadContent(result);
-  }
   let error = null;
   let next = null;
   const buffer = [];
   let renderingComplete = false;
+  if (isPage) {
+    await bufferHeadContent(result);
+  }
   const iterator = {
     async next() {
       if (result.cancelled) return { done: true, value: void 0 };
@@ -176,7 +121,7 @@ async function renderToAsyncIterable(result, componentFactory, props, children,
           length += bufferEntry.length;
         }
       }
-      let mergedArray = new Uint8Array(length);
+      const mergedArray = new Uint8Array(length);
       let offset = 0;
       for (let i = 0, len = buffer.length; i < len; i++) {
         const item = buffer[i];
@@ -188,8 +133,6 @@ async function renderToAsyncIterable(result, componentFactory, props, children,
       }
       buffer.length = 0;
       const returnValue = {
-        // The iterator is done when rendering has finished
-        // and there are no more chunks to return.
         done: length === 0 && renderingComplete,
         value: mergedArray
       };
@@ -221,7 +164,7 @@ async function renderToAsyncIterable(result, componentFactory, props, children,
       }
     }
   };
-  const renderResult = toPromise(() => templateResult.render(destination));
+  const renderResult = toPromise(() => renderStreaming(templateResult, result, destination));
   renderResult.catch((err) => {
     error = err;
   }).finally(() => {
@@ -234,6 +177,71 @@ async function renderToAsyncIterable(result, componentFactory, props, children,
     }
   };
 }
+async function renderToString(result, componentFactory, props, children, isPage = false, route) {
+  const templateResult = await callComponentAsTemplateResultOrResponse(
+    result,
+    componentFactory,
+    props,
+    children,
+    route
+  );
+  if (templateResult instanceof Response) return templateResult;
+  return await renderStreamToString(result, templateResult, isPage);
+}
+async function renderToReadableStream(result, componentFactory, props, children, isPage = false, route) {
+  const templateResult = await callComponentAsTemplateResultOrResponse(
+    result,
+    componentFactory,
+    props,
+    children,
+    route
+  );
+  if (templateResult instanceof Response) return templateResult;
+  return await renderStreamToStream(result, templateResult, isPage, route);
+}
+async function callComponentAsTemplateResultOrResponse(result, componentFactory, props, children, route) {
+  const factoryResult = await componentFactory(result, props, children);
+  if (factoryResult instanceof Response) {
+    return factoryResult;
+  } else if (isHeadAndContent(factoryResult)) {
+    if (!isRenderTemplateResult(factoryResult.content)) {
+      throw new AstroError({
+        ...AstroErrorData.OnlyResponseCanBeReturned,
+        message: AstroErrorData.OnlyResponseCanBeReturned.message(
+          route?.route,
+          typeof factoryResult
+        ),
+        location: {
+          file: route?.component
+        }
+      });
+    }
+    return factoryResult.content;
+  } else if (!isRenderTemplateResult(factoryResult)) {
+    throw new AstroError({
+      ...AstroErrorData.OnlyResponseCanBeReturned,
+      message: AstroErrorData.OnlyResponseCanBeReturned.message(route?.route, typeof factoryResult),
+      location: {
+        file: route?.component
+      }
+    });
+  }
+  return factoryResult;
+}
+async function bufferHeadContent(result) {
+  await bufferPropagatedHead(result);
+}
+async function renderToAsyncIterable(result, componentFactory, props, children, isPage = false, route) {
+  const templateResult = await callComponentAsTemplateResultOrResponse(
+    result,
+    componentFactory,
+    props,
+    children,
+    route
+  );
+  if (templateResult instanceof Response) return templateResult;
+  return await renderStreamToAsyncIterable(result, templateResult, isPage, route);
+}
 function toPromise(fn) {
   try {
     const result = fn();

package/dist/runtime/server/render/head.js

@@ -51,7 +51,8 @@ function renderAllHeadContent(result) {
   const links = deduplicateElements(Array.from(result.links)).map(
     (link) => renderElement("link", link, false)
   );
-  content += styles.join("\n") + links.join("\n") + scripts.join("\n");
+  const sep = result.compressHTML === true || result.compressHTML === "jsx" ? "" : "\n";
+  content += styles.join(sep) + links.join(sep) + scripts.join(sep);
   content += result._metadata.extraHead.join("");
   return markHTMLString(content);
 }

package/dist/runtime/server/render/index.d.ts

@@ -8,5 +8,6 @@ export type { RenderInstruction } from './instruction.js';
 export { renderPage } from './page.js';
 export { renderScript } from './script.js';
 export { type ComponentSlots, renderSlot, renderSlotToString } from './slot.js';
+export { renderStreaming } from './streaming.js';
 export { renderScriptElement, renderUniqueStylesheet } from './tags.js';
 export { addAttribute, defineScriptVars, voidElementNames } from './util.js';

package/dist/runtime/server/render/index.js

@@ -6,6 +6,7 @@ import { maybeRenderHead, renderHead } from "./head.js";
 import { renderPage } from "./page.js";
 import { renderScript } from "./script.js";
 import { renderSlot, renderSlotToString } from "./slot.js";
+import { renderStreaming } from "./streaming.js";
 import { renderScriptElement, renderUniqueStylesheet } from "./tags.js";
 import { addAttribute, defineScriptVars, voidElementNames } from "./util.js";
 export {
@@ -26,6 +27,7 @@ export {
   renderScriptElement,
   renderSlot,
   renderSlotToString,
+  renderStreaming,
   renderTemplate,
   renderToString,
   renderUniqueStylesheet,

package/dist/runtime/server/render/page.js

@@ -1,57 +1,22 @@
 import { renderToAsyncIterable, renderToReadableStream, renderToString } from "./astro/render.js";
 import { encoder } from "./common.js";
 import { renderComponentToString } from "./component.js";
-import { markHTMLString } from "../escape.js";
 import { renderCspContent } from "./csp.js";
 import { isDeno, isNode } from "./util.js";
 import { isAstroComponentFactory } from "./astro/factory.js";
-import { buildRenderQueue } from "./queue/builder.js";
-import { renderQueue } from "./queue/renderer.js";
-import { chunkToString } from "./common.js";
 async function renderPage(result, componentFactory, props, children, streaming, route) {
   if (!isAstroComponentFactory(componentFactory)) {
     result._metadata.headInTree = result.componentMetadata.get(componentFactory.moduleId)?.containsHead ?? false;
     const pageProps = { ...props ?? {}, "server:root": true };
-    let str;
-    if (result._experimentalQueuedRendering && result._experimentalQueuedRendering.enabled) {
-      let vnode = await componentFactory(pageProps);
-      if (componentFactory["astro:html"] && typeof vnode === "string") {
-        vnode = markHTMLString(vnode);
-      }
-      const queue = await buildRenderQueue(
-        vnode,
-        result,
-        result._experimentalQueuedRendering.pool
-      );
-      let html = "";
-      let renderedFirst = false;
-      const destination = {
-        write(chunk) {
-          if (chunk instanceof Response) return;
-          if (!renderedFirst && !result.partial) {
-            renderedFirst = true;
-            const chunkStr = String(chunk);
-            if (!/<!doctype html/i.test(chunkStr)) {
-              const doctype = result.compressHTML ? "<!DOCTYPE html>" : "<!DOCTYPE html>\n";
-              html += doctype;
-            }
-          }
-          html += chunkToString(result, chunk);
-        }
-      };
-      await renderQueue(queue, destination);
-      str = html;
-    } else {
-      str = await renderComponentToString(
-        result,
-        componentFactory.name,
-        componentFactory,
-        pageProps,
-        {},
-        true,
-        route
-      );
-    }
+    const str = await renderComponentToString(
+      result,
+      componentFactory.name,
+      componentFactory,
+      pageProps,
+      {},
+      true,
+      route
+    );
     const bytes = encoder.encode(str);
     const headers2 = new Headers([
       ["Content-Type", "text/html"],

package/dist/runtime/server/render/streaming.d.ts

@@ -0,0 +1,23 @@
+import type { SSRResult } from '../../../types/public/internal.js';
+import { type RenderDestination } from './common.js';
+/**
+ * Streaming render engine.
+ *
+ * Walks the component tree in a single forward pass (explicit stack), batching
+ * consecutive static fragments into one write. The static structure
+ * (RenderTemplateResult HTML parts, arrays, primitives) never allocates a node
+ * object and never wraps HTML parts in `markHTMLString`, so static-heavy pages
+ * render with minimal overhead.
+ *
+ * Dynamic subtrees (components, render instances, promises, JSX) are rendered
+ * via `renderChild`. While their output stays synchronous, the engine streams
+ * it straight to `destination`. As soon as a dynamic node renders
+ * asynchronously, the engine switches to a buffered tail: every remaining
+ * dynamic node is started eagerly (so async work runs in parallel) and the
+ * buffers are flushed in order. This mirrors `RenderTemplateResult.render`, so
+ * async components render concurrently rather than serially.
+ *
+ * Head propagation is handled by the caller (`bufferHeadContent`) before this
+ * runs.
+ */
+export declare function renderStreaming(root: unknown, result: SSRResult, destination: RenderDestination): Promise<void>;