astro 7.0.5 → 7.0.7

package/components/Picture.astro

@@ -1,7 +1,13 @@
 ---
-import { getImage, imageConfig, type LocalImageProps, type RemoteImageProps } from 'astro:assets';
+import {
+	getImage,
+	imageConfig,
+	inferRemoteSize,
+	type LocalImageProps,
+	type RemoteImageProps,
+} from 'astro:assets';
 import * as mime from 'mrmime';
-import { isESMImportedImage, resolveSrc } from '../dist/assets/utils/imageKind.js';
+import { isESMImportedImage, isRemoteImage, resolveSrc } from '../dist/assets/utils/imageKind.js';
 import { AstroError, AstroErrorData } from '../dist/core/errors/index.js';
 import type {
 	GetImageResult,
@@ -62,6 +68,17 @@ for (const key in props) {
 }
 
 const originalSrc = await resolveSrc(props.src);
+
+// When inferSize is set for a remote image, resolve dimensions once and thread them through
+// to all getImage() calls. This avoids multiple redundant HTTP requests to the same URL,
+// which can trigger rate-limiting (HTTP 429) on servers like Wikimedia.
+if (props.inferSize && isRemoteImage(originalSrc)) {
+	const remoteSize = await inferRemoteSize(originalSrc);
+	delete props.inferSize;
+	props.width ??= remoteSize.width;
+	props.height ??= remoteSize.height;
+}
+
 const optimizedImages: GetImageResult[] = await Promise.all(
 	formats.map(
 		async (format) =>

package/dist/actions/handler.js

@@ -1,3 +1,7 @@
+import {
+  createCrossOriginForbiddenResponse,
+  isForbiddenCrossOriginRequest
+} from "../core/app/origin-check.js";
 import { PipelineFeatures } from "../core/base-pipeline.js";
 import { getActionContext, serializeActionResult } from "./runtime/server.js";
 class ActionHandler {
@@ -18,6 +22,9 @@ class ActionHandler {
     if (!action) {
       return void 0;
     }
+    if (state.pipeline.manifest.checkOrigin && isForbiddenCrossOriginRequest(apiContext.request, apiContext.url, apiContext.isPrerendered)) {
+      return Promise.resolve(createCrossOriginForbiddenResponse(apiContext.request));
+    }
     return this.#executeAction(action, setActionResult);
   }
   async #executeAction(action, setActionResult) {

package/dist/cli/infra/build-time-astro-version-provider.js

@@ -1,6 +1,6 @@
 class BuildTimeAstroVersionProvider {
   // Injected during the build through esbuild define
-  version = "7.0.5";
+  version = "7.0.7";
 }
 export {
   BuildTimeAstroVersionProvider

package/dist/cli/install-package.js

@@ -1,4 +1,5 @@
 import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
 import * as clack from "@clack/prompts";
 import ci from "ci-info";
 import { detect, resolveCommand } from "package-manager-detector";
@@ -8,8 +9,8 @@ const require2 = createRequire(import.meta.url);
 const { bold, cyan, dim, magenta } = colors;
 async function getPackage(packageName, logger, options, otherDeps = []) {
   try {
-    require2.resolve(packageName, { paths: [options.cwd ?? process.cwd()] });
-    const packageImport = await import(packageName);
+    const resolved = require2.resolve(packageName, { paths: [options.cwd ?? process.cwd()] });
+    const packageImport = await import(pathToFileURL(resolved).href);
     return packageImport;
   } catch {
     if (options.optional) return void 0;
@@ -25,7 +26,8 @@ async function getPackage(packageName, logger, options, otherDeps = []) {
     }
     const result = await installPackage([packageName, ...otherDeps], options, logger);
     if (result) {
-      const packageImport = await import(packageName);
+      const resolved = require2.resolve(packageName, { paths: [options.cwd ?? process.cwd()] });
+      const packageImport = await import(pathToFileURL(resolved).href);
       return packageImport;
     } else {
       return void 0;

package/dist/container/index.js

@@ -14,6 +14,8 @@ import { validateSegment } from "../core/routing/segment.js";
 import { SlotString } from "../runtime/server/render/slot.js";
 import { ContainerPipeline } from "./pipeline.js";
 import { createConsoleLogger } from "../core/logger/impls/console.js";
+const { gfm: _, smartypants: __, ...containerMarkdownDefaults } = ASTRO_CONFIG_DEFAULTS.markdown;
+const CONTAINER_CONFIG_DEFAULTS = { ...ASTRO_CONFIG_DEFAULTS, markdown: containerMarkdownDefaults };
 function createManifest(manifest, renderers, middleware) {
   function middlewareInstance() {
     return {
@@ -113,7 +115,7 @@ class experimental_AstroContainer {
    */
   static async create(containerOptions = {}) {
     const { streaming = false, manifest, renderers = [], resolve } = containerOptions;
-    const astroConfig = await validateConfig(ASTRO_CONFIG_DEFAULTS, process.cwd(), "container");
+    const astroConfig = await validateConfig(CONTAINER_CONFIG_DEFAULTS, process.cwd(), "container");
     return new experimental_AstroContainer({
       streaming,
       manifest,
@@ -206,7 +208,7 @@ class experimental_AstroContainer {
   // NOTE: we keep this private via TS instead via `#` so it's still available on the surface, so we can play with it.
   // @ts-expect-error @ematipico: I plan to use it for a possible integration that could help people
   static async createFromManifest(manifest) {
-    const astroConfig = await validateConfig(ASTRO_CONFIG_DEFAULTS, process.cwd(), "container");
+    const astroConfig = await validateConfig(CONTAINER_CONFIG_DEFAULTS, process.cwd(), "container");
     const container = new experimental_AstroContainer({
       manifest,
       astroConfig

package/dist/content/content-layer.js

@@ -197,7 +197,7 @@ ${contentConfig.error.message}`
       logger.info("Content config changed");
       shouldClear = true;
     }
-    if (previousAstroVersion && previousAstroVersion !== "7.0.5") {
+    if (previousAstroVersion && previousAstroVersion !== "7.0.7") {
       logger.info("Astro version changed");
       shouldClear = true;
     }
@@ -205,8 +205,8 @@ ${contentConfig.error.message}`
       logger.info("Clearing content store");
       this.#store.clearAll();
     }
-    if ("7.0.5") {
-      this.#store.metaStore().set("astro-version", "7.0.5");
+    if ("7.0.7") {
+      this.#store.metaStore().set("astro-version", "7.0.7");
     }
     if (currentConfigDigest) {
       this.#store.metaStore().set("content-config-digest", currentConfigDigest);

package/dist/content/vite-plugin-content-assets.d.ts

@@ -3,8 +3,12 @@ import { type Plugin } from 'vite';
 import type { BuildInternals } from '../core/build/internal.js';
 import type { ExtractedChunk } from '../core/build/static-build.js';
 import type { AstroSettings } from '../types/astro.js';
-export declare function astroContentAssetPropagationPlugin({ settings, }: {
+export declare function astroContentAssetPropagationPlugin({ settings, cssContentCache, }: {
     settings: AstroSettings;
+    /** Shared cache of CSS content populated by the dev-css plugin's transform hook.
+     *  Used to retrieve already-processed CSS for CSS modules without re-importing
+     *  via `?inline`, which would produce different scoped-name hashes with Lightning CSS. */
+    cssContentCache?: Map<string, string>;
 }): Plugin;
 /**
  * Post-build hook that injects propagated styles into content collection chunks.

package/dist/content/vite-plugin-content-assets.js

@@ -19,7 +19,8 @@ import { joinPaths, prependForwardSlash, slash } from "@astrojs/internal-helpers
 import { ASTRO_VITE_ENVIRONMENT_NAMES } from "../core/constants.js";
 import { isAstroServerEnvironment } from "../environments.js";
 function astroContentAssetPropagationPlugin({
-  settings
+  settings,
+  cssContentCache
 }) {
   let environment = void 0;
   return {
@@ -84,7 +85,7 @@ function astroContentAssetPropagationPlugin({
               styles,
               urls,
               crawledFiles: styleCrawledFiles
-            } = await getStylesForURL(basePath, environment);
+            } = await getStylesForURL(basePath, environment, cssContentCache);
             for (const file of styleCrawledFiles) {
               if (!file.includes("node_modules")) {
                 this.addWatchFile(file);
@@ -113,7 +114,7 @@ function astroContentAssetPropagationPlugin({
   };
 }
 const INLINE_QUERY_REGEX = /(?:\?|&)inline(?:$|&)/;
-async function getStylesForURL(filePath, environment) {
+async function getStylesForURL(filePath, environment, cssContentCache) {
   const importedCssUrls = /* @__PURE__ */ new Set();
   const importedStylesMap = /* @__PURE__ */ new Map();
   const crawledFiles = /* @__PURE__ */ new Set();
@@ -125,6 +126,8 @@ async function getStylesForURL(filePath, environment) {
       let css = "";
       if (typeof importedModule.ssrModule?.default === "string") {
         css = importedModule.ssrModule.default;
+      } else if (importedModule.id && cssContentCache?.has(importedModule.id)) {
+        css = cssContentCache.get(importedModule.id);
       } else {
         let modId = importedModule.url;
         if (!INLINE_QUERY_REGEX.test(importedModule.url)) {

package/dist/core/app/origin-check.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Home of the `security.checkOrigin` logic. Exposes the shared predicate and
+ * response used to reject cross-site submissions, plus the middleware factory
+ * that installs the check in the request pipeline. Consumers (the pipeline
+ * middleware and the Astro Actions dispatch) import from here so the check
+ * stays consistent regardless of where it runs.
+ */
+import type { MiddlewareHandler } from '../../types/public/common.js';
+/**
+ * Determines whether a request should be rejected because it is a cross-site
+ * submission for a route rendered on demand.
+ *
+ * This encapsulates the shared logic used by both the origin-check middleware
+ * and the Astro Actions dispatch, so the check is applied consistently
+ * regardless of where the request is handled.
+ *
+ * @private
+ */
+export declare function isForbiddenCrossOriginRequest(request: Request, url: URL, isPrerendered: boolean): boolean;
+/**
+ * Builds the 403 response returned when a cross-site submission is rejected.
+ *
+ * @private
+ */
+export declare function createCrossOriginForbiddenResponse(request: Request): Response;
+/**
+ * Returns a middleware function in charge to check the `origin` header.
+ *
+ * @private
+ */
+export declare function createOriginCheckMiddleware(): MiddlewareHandler;
+export declare function hasFormLikeHeader(contentType: string | null): boolean;

package/dist/core/app/origin-check.js

@@ -0,0 +1,52 @@
+import { defineMiddleware } from "../middleware/defineMiddleware.js";
+const FORM_CONTENT_TYPES = [
+  "application/x-www-form-urlencoded",
+  "multipart/form-data",
+  "text/plain"
+];
+const SAFE_METHODS = ["GET", "HEAD", "OPTIONS"];
+function isForbiddenCrossOriginRequest(request, url, isPrerendered) {
+  if (isPrerendered) {
+    return false;
+  }
+  if (SAFE_METHODS.includes(request.method)) {
+    return false;
+  }
+  const isSameOrigin = request.headers.get("origin") === url.origin;
+  const hasContentType = request.headers.has("content-type");
+  if (hasContentType) {
+    const formLikeHeader = hasFormLikeHeader(request.headers.get("content-type"));
+    return formLikeHeader && !isSameOrigin;
+  }
+  return !isSameOrigin;
+}
+function createCrossOriginForbiddenResponse(request) {
+  return new Response(`Cross-site ${request.method} form submissions are forbidden`, {
+    status: 403
+  });
+}
+function createOriginCheckMiddleware() {
+  return defineMiddleware((context, next) => {
+    const { request, url, isPrerendered } = context;
+    if (isForbiddenCrossOriginRequest(request, url, isPrerendered)) {
+      return createCrossOriginForbiddenResponse(request);
+    }
+    return next();
+  });
+}
+function hasFormLikeHeader(contentType) {
+  if (contentType) {
+    for (const FORM_CONTENT_TYPE of FORM_CONTENT_TYPES) {
+      if (contentType.toLowerCase().includes(FORM_CONTENT_TYPE)) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+export {
+  createCrossOriginForbiddenResponse,
+  createOriginCheckMiddleware,
+  hasFormLikeHeader,
+  isForbiddenCrossOriginRequest
+};

package/dist/core/base-pipeline.js

@@ -1,5 +1,5 @@
 import { NOOP_ACTIONS_MOD } from "../actions/noop-actions.js";
-import { createOriginCheckMiddleware } from "./app/middlewares.js";
+import { createOriginCheckMiddleware } from "./app/origin-check.js";
 import { ActionNotFoundError } from "./errors/errors-data.js";
 import { AstroError } from "./errors/index.js";
 import { NOOP_MIDDLEWARE_FN } from "./middleware/noop-middleware.js";

package/dist/core/build/plugins/plugin-scripts.d.ts

@@ -1,6 +1,16 @@
-import type { Plugin as VitePlugin } from 'vite';
+import type { BuildOptions, Plugin as VitePlugin, Rollup } from 'vite';
 import type { BuildInternals } from '../internal.js';
+type GetModuleInfo = (moduleId: string) => Rollup.ModuleInfo | null;
+export type ScriptChunkInfo = Pick<Rollup.OutputChunk, 'code' | 'facadeModuleId' | 'fileName' | 'imports' | 'dynamicImports' | 'moduleIds'>;
+export declare function chunkHasDynamicImports(output: Pick<ScriptChunkInfo, 'dynamicImports' | 'moduleIds'>, getModuleInfo: GetModuleInfo): boolean;
+export declare function shouldInlineScriptChunk(output: ScriptChunkInfo, { discoveredScripts, importedIds, assetInlineLimit, getModuleInfo, }: {
+    discoveredScripts: Set<string>;
+    importedIds: Set<string>;
+    assetInlineLimit: NonNullable<BuildOptions['assetsInlineLimit']>;
+    getModuleInfo: GetModuleInfo;
+}): boolean;
 /**
  * Inline scripts from Astro files directly into the HTML.
  */
 export declare function pluginScripts(internals: BuildInternals): VitePlugin;
+export {};

package/dist/core/build/plugins/plugin-scripts.js

@@ -1,5 +1,18 @@
 import { shouldInlineAsset } from "./util.js";
 import { ASTRO_VITE_ENVIRONMENT_NAMES } from "../../constants.js";
+function chunkHasDynamicImports(output, getModuleInfo) {
+  return output.dynamicImports.length > 0 || output.moduleIds.some((id) => (getModuleInfo(id)?.dynamicallyImportedIds.length ?? 0) > 0);
+}
+function shouldInlineScriptChunk(output, {
+  discoveredScripts,
+  importedIds,
+  assetInlineLimit,
+  getModuleInfo
+}) {
+  const facadeModuleId = output.facadeModuleId;
+  if (facadeModuleId === null) return false;
+  return discoveredScripts.has(facadeModuleId) && !importedIds.has(output.fileName) && output.imports.length === 0 && !chunkHasDynamicImports(output, getModuleInfo) && shouldInlineAsset(output.code, output.fileName, assetInlineLimit);
+}
 function pluginScripts(internals) {
   let assetInlineLimit;
   return {
@@ -20,8 +33,14 @@ function pluginScripts(internals) {
           }
         }
       }
+      const getModuleInfo = this.getModuleInfo.bind(this);
       for (const output of outputs) {
-        if (output.type === "chunk" && output.facadeModuleId && internals.discoveredScripts.has(output.facadeModuleId) && !importedIds.has(output.fileName) && output.imports.length === 0 && output.dynamicImports.length === 0 && shouldInlineAsset(output.code, output.fileName, assetInlineLimit)) {
+        if (output.type === "chunk" && shouldInlineScriptChunk(output, {
+          discoveredScripts: internals.discoveredScripts,
+          importedIds,
+          assetInlineLimit,
+          getModuleInfo
+        })) {
           internals.inlinedScripts.set(output.facadeModuleId, output.code.trim());
           delete bundle[output.fileName];
         }
@@ -30,5 +49,7 @@ function pluginScripts(internals) {
   };
 }
 export {
-  pluginScripts
+  chunkHasDynamicImports,
+  pluginScripts,
+  shouldInlineScriptChunk
 };

package/dist/core/build/runtime.d.ts

@@ -21,6 +21,11 @@ export declare function cssOrder(a: OrderInfo, b: OrderInfo): 1 | -1;
 /**
  * Merges inline CSS into as few stylesheets as possible,
  * preserving ordering when there are non-inlined in between.
+ *
+ * CSS chunks containing `@import` are never merged with other chunks.
+ * Per CSS spec, `@import` rules must appear at the top of a stylesheet
+ * or browsers silently ignore them. Keeping these chunks as separate
+ * `<style>` tags ensures the `@import` stays at the top of its own stylesheet.
  */
 export declare function mergeInlineCss(acc: Array<StylesheetAsset>, current: StylesheetAsset): Array<StylesheetAsset>;
 export {};

package/dist/core/build/runtime.js

@@ -31,9 +31,13 @@ function mergeInlineCss(acc, current) {
   const lastWasInline = lastAdded?.type === "inline";
   const currentIsInline = current?.type === "inline";
   if (lastWasInline && currentIsInline) {
-    const merged = { type: "inline", content: lastAdded.content + current.content };
-    acc[acc.length - 1] = merged;
-    return acc;
+    const currentHasImport = current.content.includes("@import");
+    const lastHasImport = lastAdded.content.includes("@import");
+    if (!currentHasImport && !lastHasImport) {
+      const merged = { type: "inline", content: lastAdded.content + current.content };
+      acc[acc.length - 1] = merged;
+      return acc;
+    }
   }
   acc.push(current);
   return acc;

package/dist/core/constants.js

@@ -1,4 +1,4 @@
-const ASTRO_VERSION = "7.0.5";
+const ASTRO_VERSION = "7.0.7";
 const ASTRO_GENERATOR = `Astro v${ASTRO_VERSION}`;
 const ASTRO_ERROR_HEADER = "X-Astro-Error";
 const DEFAULT_404_COMPONENT = "astro-default-404.astro";

package/dist/core/create-vite.js

@@ -108,6 +108,7 @@ async function createVite(commandConfig, { settings, logger, mode, command, fs =
     config: settings.config
   });
   const serverIslandsState = new ServerIslandsState();
+  const cssContentCache = /* @__PURE__ */ new Map();
   validateEnvPrefixAgainstSchema(settings.config);
   const commonConfig = {
     // Tell Vite not to combine config from vite.config.js with our provided inline config
@@ -156,7 +157,7 @@ async function createVite(commandConfig, { settings, logger, mode, command, fs =
       vitePluginFetchable({ settings }),
       command === "dev" && vitePluginAstroServer({ settings, logger }),
       command === "dev" && vitePluginAstroServerClient(),
-      astroDevCssPlugin({ routesList, command }),
+      astroDevCssPlugin({ routesList, command, cssContentCache }),
       importMetaEnv({ envLoader }),
       astroEnv({ settings, sync, envLoader }),
       vitePluginAdapterConfig(settings),
@@ -167,7 +168,7 @@ async function createVite(commandConfig, { settings, logger, mode, command, fs =
       astroHeadPlugin(),
       astroContentVirtualModPlugin({ fs, settings }),
       astroContentImportPlugin({ fs, settings, logger }),
-      astroContentAssetPropagationPlugin({ settings }),
+      astroContentAssetPropagationPlugin({ settings, cssContentCache }),
       vitePluginMiddleware({ settings }),
       astroAssetsPlugin({ fs, settings, sync, logger }),
       astroPrefetch({ settings }),

package/dist/core/dev/dev.js

@@ -26,7 +26,7 @@ async function dev(inlineConfig) {
   await telemetry.record([]);
   const restart = await createContainerWithAutomaticRestart({ inlineConfig, fs });
   const logger = restart.container.logger;
-  const currentVersion = "7.0.5";
+  const currentVersion = "7.0.7";
   const isPrerelease = currentVersion.includes("-");
   if (!isPrerelease) {
     try {

package/dist/core/messages/runtime.js

@@ -269,7 +269,7 @@ function printHelp({
     message.push(
       linebreak(),
       `  ${bgGreen(black(` ${commandName} `))} ${green(
-        `v${"7.0.5"}`
+        `v${"7.0.7"}`
       )} ${headline}`
     );
   }

package/dist/core/pages/handler.js

@@ -1,6 +1,10 @@
 import { renderEndpoint } from "../../runtime/server/endpoint.js";
 import { renderPage } from "../../runtime/server/index.js";
 import { ASTRO_ERROR_HEADER } from "../constants.js";
+import {
+  createCrossOriginForbiddenResponse,
+  isForbiddenCrossOriginRequest
+} from "../app/origin-check.js";
 import { getCookiesFromResponse } from "../cookies/response.js";
 const EMPTY_SLOTS = Object.freeze({});
 class PagesHandler {
@@ -78,8 +82,12 @@ class PagesHandler {
     if (!state.routeData) {
       return new Response(null, { status: 404, headers: { [ASTRO_ERROR_HEADER]: "true" } });
     }
+    const ctx = state.getAPIContext();
+    if (this.#pipeline.manifest.checkOrigin && isForbiddenCrossOriginRequest(ctx.request, ctx.url, ctx.isPrerendered)) {
+      return createCrossOriginForbiddenResponse(ctx.request);
+    }
     try {
-      return await this.handle(state, state.getAPIContext());
+      return await this.handle(state, ctx);
     } catch (err) {
       app.logger.error(null, err.stack || err.message || String(err));
       return app.renderError(state.request, {

package/dist/core/render/params-and-props.js

@@ -44,9 +44,14 @@ async function getProps(opts) {
 }
 function getParams(route, pathname) {
   if (!route.params.length) return {};
-  const path = pathname.endsWith(".html") && route.type === "page" && !routeHasHtmlExtension(route) ? pathname.slice(0, -5) : pathname;
+  const hasHtmlSuffix = pathname.endsWith(".html") && !routeHasHtmlExtension(route);
+  const path = hasHtmlSuffix && route.type === "page" ? pathname.slice(0, -".html".length) : pathname;
   const allPatterns = [route, ...route.fallbackRoutes].map((r) => r.pattern);
-  const paramsMatch = allPatterns.map((pattern) => pattern.exec(path)).find((x) => x);
+  let paramsMatch = allPatterns.map((pattern) => pattern.exec(path)).find((x) => x);
+  if (!paramsMatch && hasHtmlSuffix && route.type !== "page") {
+    const strippedPath = pathname.endsWith("/index.html") ? pathname.slice(0, -"/index.html".length) || "/" : pathname.slice(0, -".html".length);
+    paramsMatch = allPatterns.map((pattern) => pattern.exec(strippedPath)).find((x) => x);
+  }
   if (!paramsMatch) return {};
   const params = {};
   route.params.forEach((key, i) => {

package/dist/core/routing/generator.js

@@ -11,10 +11,10 @@ function sanitizeParams(params) {
 }
 function getParameter(part, params) {
   if (part.spread) {
-    return params[part.content.slice(3)] || "";
+    return params[part.content.slice(3)] ?? "";
   }
   if (part.dynamic) {
-    if (!params[part.content]) {
+    if (params[part.content] === void 0) {
       throw new TypeError(`Missing parameter: ${part.content}`);
     }
     return params[part.content];

package/dist/core/util.d.ts

@@ -24,6 +24,14 @@ export declare function resolvePages(config: AstroConfig): URL;
 export declare function isPage(file: URL, settings: AstroSettings): boolean;
 export declare function isEndpoint(file: URL, settings: AstroSettings): boolean;
 export declare function resolveJsToTs(filePath: string): string;
+/**
+ * Resolve a path that doesn't name a file on disk (e.g. produced by an
+ * extensionless import like `import { Counter } from './Counter'`) to the file
+ * Vite would load, by probing Vite's default extension order and directory
+ * `index` files. Returns the path unchanged when it already exists as a file
+ * or when no candidate is found.
+ */
+export declare function resolveExtensionlessPath(filePath: string): string;
 /**
  * Set a default NODE_ENV so Vite doesn't set an incorrect default when loading the Astro config
  */

package/dist/core/util.js

@@ -94,6 +94,28 @@ function resolveJsToTs(filePath) {
   }
   return filePath;
 }
+const VITE_DEFAULT_RESOLVE_EXTENSIONS = [".mjs", ".js", ".mts", ".ts", ".jsx", ".tsx", ".json"];
+function resolveExtensionlessPath(filePath) {
+  const stat = fs.statSync(filePath, { throwIfNoEntry: false });
+  if (stat?.isFile()) {
+    return filePath;
+  }
+  for (const ext of VITE_DEFAULT_RESOLVE_EXTENSIONS) {
+    const tryPath = filePath + ext;
+    if (fs.existsSync(tryPath)) {
+      return tryPath;
+    }
+  }
+  if (stat?.isDirectory()) {
+    for (const ext of VITE_DEFAULT_RESOLVE_EXTENSIONS) {
+      const tryPath = `${filePath}/index${ext}`;
+      if (fs.existsSync(tryPath)) {
+        return tryPath;
+      }
+    }
+  }
+  return filePath;
+}
 function ensureProcessNodeEnv(defaultNodeEnv) {
   if (!process.env.NODE_ENV) {
     process.env.NODE_ENV = defaultNodeEnv;
@@ -106,6 +128,7 @@ export {
   isMarkdownFile,
   isPage,
   parseNpmName,
+  resolveExtensionlessPath,
   resolveJsToTs,
   resolvePages,
   unwrapId,

package/dist/core/viteUtils.d.ts

@@ -9,6 +9,9 @@ export declare function normalizePath(id: string): string;
  * Examples:
  * - `./components/Button.jsx` from `/app/src/pages/index.astro`
  *   -> `/app/src/pages/components/Button.tsx` (when `.tsx` exists)
+ * - `../components/Counter` from `/app/src/pages/index.astro`
+ *   -> `/app/src/components/Counter.tsx` (extensionless imports probe Vite's
+ *   default extension order, then directory `index` files)
  * - `#components/react/Counter.tsx`
  *   -> `/app/src/components/react/Counter.tsx` via package `imports`
  */

package/dist/core/viteUtils.js

@@ -2,7 +2,13 @@ import { createRequire } from "node:module";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { prependForwardSlash, slash } from "../core/path.js";
-import { resolveJsToTs, unwrapId, VALID_ID_PREFIX, viteID } from "./util.js";
+import {
+  resolveExtensionlessPath,
+  resolveJsToTs,
+  unwrapId,
+  VALID_ID_PREFIX,
+  viteID
+} from "./util.js";
 const isWindows = typeof process !== "undefined" && process.platform === "win32";
 function normalizePath(id) {
   return path.posix.normalize(isWindows ? slash(id) : id);
@@ -10,7 +16,7 @@ function normalizePath(id) {
 function resolvePath(specifier, importer) {
   if (specifier.startsWith(".")) {
     const absoluteSpecifier = path.resolve(path.dirname(importer), specifier);
-    return resolveJsToTs(normalizePath(absoluteSpecifier));
+    return resolveExtensionlessPath(resolveJsToTs(normalizePath(absoluteSpecifier)));
   } else if (specifier.startsWith("#")) {
     try {
       const resolved = createRequire(pathToFileURL(importer)).resolve(specifier);

package/dist/runtime/server/render/common.js

@@ -103,7 +103,13 @@ function stringifyChunk(result, chunk) {
         out += stringifyChunk(result, instr);
       }
     }
-    out += chunk.toString();
+    if (c.chunks.length) {
+      for (const part of c.chunks) {
+        out += typeof part === "string" ? part : stringifyChunk(result, part);
+      }
+    } else {
+      out += chunk.toString();
+    }
     return out;
   }
   return chunk.toString();

package/dist/runtime/server/render/dom.js

@@ -1,6 +1,6 @@
 import { markHTMLString } from "../escape.js";
 import { renderSlotToString } from "./slot.js";
-import { toAttributeString } from "./util.js";
+import { INVALID_ATTR_NAME_CHAR, toAttributeString } from "./util.js";
 function componentIsHTMLElement(Component) {
   return typeof HTMLElement !== "undefined" && HTMLElement.isPrototypeOf(Component);
 }
@@ -8,6 +8,9 @@ async function renderHTMLElement(result, constructor, props, slots) {
   const name = getHTMLElementName(constructor);
   let attrHTML = "";
   for (const attr in props) {
+    if (INVALID_ATTR_NAME_CHAR.test(attr)) {
+      continue;
+    }
     attrHTML += ` ${attr}="${toAttributeString(await props[attr])}"`;
   }
   return markHTMLString(

package/dist/runtime/server/render/instruction.d.ts

@@ -35,3 +35,4 @@ export type TemplateExitInstruction = {
 export type RenderInstruction = RenderDirectiveInstruction | RenderHeadInstruction | MaybeRenderHeadInstruction | RendererHydrationScriptInstruction | ServerIslandRuntimeInstruction | RenderScriptInstruction | TemplateEnterInstruction | TemplateExitInstruction;
 export declare function createRenderInstruction<T extends RenderInstruction>(instruction: T): T;
 export declare function isRenderInstruction(chunk: any): chunk is RenderInstruction;
+export declare function isScriptInstruction(chunk: any): chunk is RenderScriptInstruction;

package/dist/runtime/server/render/instruction.js

@@ -7,7 +7,11 @@ function createRenderInstruction(instruction) {
 function isRenderInstruction(chunk) {
   return chunk && typeof chunk === "object" && chunk[RenderInstructionSymbol];
 }
+function isScriptInstruction(chunk) {
+  return chunk && typeof chunk === "object" && "type" in chunk && chunk.type === "script";
+}
 export {
   createRenderInstruction,
-  isRenderInstruction
+  isRenderInstruction,
+  isScriptInstruction
 };

package/dist/runtime/server/render/server-islands.js

@@ -115,14 +115,14 @@ class ServerIslandComponent {
     for (const name in this.slots) {
       if (name !== "fallback") {
         const content = await renderSlotToString(this.result, this.slots[name]);
-        let slotHtml = content.toString();
         const slotContent = content;
-        if (Array.isArray(slotContent.instructions)) {
-          for (const instruction of slotContent.instructions) {
-            if (instruction.type === "script") {
-              slotHtml += instruction.content;
-            }
+        let slotHtml = "";
+        if (slotContent.chunks?.length) {
+          for (const part of slotContent.chunks) {
+            slotHtml += typeof part === "string" ? part : part.content;
           }
+        } else {
+          slotHtml = content.toString();
         }
         renderedSlots[name] = slotHtml;
       }

package/dist/runtime/server/render/slot.d.ts

@@ -2,15 +2,28 @@ import type { SSRResult } from '../../../types/public/internal.js';
 import { HTMLString } from '../escape.js';
 import { renderTemplate } from './astro/render-template.js';
 import { type RenderInstance } from './common.js';
-import type { RenderInstruction } from './instruction.js';
+import { type RenderInstruction, type RenderScriptInstruction } from './instruction.js';
 type RenderTemplateResult = ReturnType<typeof renderTemplate>;
 export type ComponentSlots = Record<string, ComponentSlotValue>;
 export type ComponentSlotValue = (result: SSRResult) => RenderTemplateResult | Promise<RenderTemplateResult>;
 declare const slotString: unique symbol;
+/**
+ * A part of a slot's content stream: either already-stringified HTML or a
+ * position-sensitive script instruction that is resolved (and deduplicated)
+ * lazily when the slot is finally stringified.
+ */
+export type SlotStringChunk = string | RenderScriptInstruction;
 export declare class SlotString extends HTMLString {
     instructions: null | RenderInstruction[];
+    /**
+     * The slot's content as an ordered stream. Unlike `instructions` (which holds
+     * position-independent instructions like head/hydration content), scripts are
+     * kept inline here so they render at their original position instead of being
+     * hoisted to the start of the slot output.
+     */
+    chunks: SlotStringChunk[];
     [slotString]: boolean;
-    constructor(content: string, instructions: null | RenderInstruction[]);
+    constructor(content: string, instructions: null | RenderInstruction[], chunks?: SlotStringChunk[]);
 }
 export declare function isSlotString(str: string): str is any;
 /**

package/dist/runtime/server/render/slot.js

@@ -2,13 +2,24 @@ import { HTMLString, markHTMLString, unescapeHTML } from "../escape.js";
 import { renderChild } from "./any.js";
 import { renderTemplate } from "./astro/render-template.js";
 import { chunkToString } from "./common.js";
+import {
+  isScriptInstruction
+} from "./instruction.js";
 const slotString = /* @__PURE__ */ Symbol.for("astro:slot-string");
 class SlotString extends HTMLString {
   instructions;
+  /**
+   * The slot's content as an ordered stream. Unlike `instructions` (which holds
+   * position-independent instructions like head/hydration content), scripts are
+   * kept inline here so they render at their original position instead of being
+   * hoisted to the start of the slot output.
+   */
+  chunks;
   [slotString];
-  constructor(content, instructions) {
+  constructor(content, instructions, chunks = []) {
     super(content);
     this.instructions = instructions;
+    this.chunks = chunks;
     this[slotString] = true;
   }
 }
@@ -35,25 +46,35 @@ function renderSlot(result, slotted, fallback) {
 async function renderSlotToString(result, slotted, fallback) {
   let content = "";
   let instructions = null;
+  const chunks = [];
   const temporaryDestination = {
     write(chunk) {
       if (chunk instanceof SlotString) {
         content += chunk;
+        if (chunk.chunks.length) {
+          chunks.push(...chunk.chunks);
+        }
         instructions = mergeSlotInstructions(instructions, chunk);
       } else if (chunk instanceof Response) return;
       else if (typeof chunk === "object" && "type" in chunk && typeof chunk.type === "string") {
-        if (instructions === null) {
-          instructions = [];
+        if (isScriptInstruction(chunk)) {
+          chunks.push(chunk);
+        } else {
+          if (instructions === null) {
+            instructions = [];
+          }
+          instructions.push(chunk);
         }
-        instructions.push(chunk);
       } else {
-        content += chunkToString(result, chunk);
+        const str = chunkToString(result, chunk);
+        content += str;
+        chunks.push(str);
       }
     }
   };
   const renderInstance = renderSlot(result, slotted, fallback);
   await renderInstance.render(temporaryDestination);
-  return markHTMLString(new SlotString(content, instructions));
+  return markHTMLString(new SlotString(content, instructions, chunks));
 }
 async function renderSlots(result, slots = {}) {
   let slotInstructions = null;
@@ -68,6 +89,16 @@ async function renderSlots(result, slots = {}) {
             }
             slotInstructions.push(...output.instructions);
           }
+          if (output.chunks) {
+            for (const part of output.chunks) {
+              if (typeof part !== "string") {
+                if (slotInstructions === null) {
+                  slotInstructions = [];
+                }
+                slotInstructions.push(part);
+              }
+            }
+          }
           children[key] = output;
         })
       )

package/dist/runtime/server/render/util.d.ts

@@ -1,6 +1,7 @@
 import type { SSRElement } from '../../../types/public/internal.js';
 import type { RenderDestination, RenderFunction } from './common.js';
 export declare const voidElementNames: RegExp;
+export declare const INVALID_ATTR_NAME_CHAR: RegExp;
 export declare const toAttributeString: (value: any, shouldEscape?: boolean) => any;
 export declare const toStyleString: (obj: Record<string, any>) => string;
 export declare function defineScriptVars(vars: Record<any, any>): any;

package/dist/runtime/server/render/util.js

@@ -168,6 +168,7 @@ function promiseWithResolvers() {
   };
 }
 export {
+  INVALID_ATTR_NAME_CHAR,
   addAttribute,
   createBufferedRenderer,
   defineScriptVars,

package/dist/vite-plugin-app/app.js

@@ -167,27 +167,31 @@ class AstroServerApp extends BaseApp {
         } else {
           socket.on("close", onSocketClose);
         }
-        const request = createRequest({
-          url,
-          headers: incomingRequest.headers,
-          method: incomingRequest.method,
-          body,
-          logger: self.logger,
-          isPrerendered: matchedRoute.routeData.prerender,
-          routePattern: matchedRoute.routeData.component,
-          init: { signal: abortController.signal }
-        });
-        const locals = Reflect.get(incomingRequest, clientLocalsSymbol);
-        for (const [name, value] of Object.entries(self.settings.config.server.headers ?? {})) {
-          if (value) incomingResponse.setHeader(name, value);
+        try {
+          const request = createRequest({
+            url,
+            headers: incomingRequest.headers,
+            method: incomingRequest.method,
+            body,
+            logger: self.logger,
+            isPrerendered: matchedRoute.routeData.prerender,
+            routePattern: matchedRoute.routeData.component,
+            init: { signal: abortController.signal }
+          });
+          const locals = Reflect.get(incomingRequest, clientLocalsSymbol);
+          for (const [name, value] of Object.entries(self.settings.config.server.headers ?? {})) {
+            if (value) incomingResponse.setHeader(name, value);
+          }
+          const clientAddress = incomingRequest.socket.remoteAddress;
+          const response = await self.render(request, {
+            locals,
+            routeData: matchedRoute.routeData,
+            clientAddress
+          });
+          await writeSSRResult(request, response, incomingResponse);
+        } finally {
+          socket.off("close", onSocketClose);
         }
-        const clientAddress = incomingRequest.socket.remoteAddress;
-        const response = await self.render(request, {
-          locals,
-          routeData: matchedRoute.routeData,
-          clientAddress
-        });
-        await writeSSRResult(request, response, incomingResponse);
       },
       onError(_err) {
         const error = createSafeError(_err);

package/dist/vite-plugin-astro-server/plugin.js

@@ -25,6 +25,9 @@ function createVitePluginAstroServer({
       return environment.name === ASTRO_VITE_ENVIRONMENT_NAMES.ssr;
     },
     async configureServer(viteServer) {
+      if (process.env.VITEST) {
+        return;
+      }
       const ssrEnvironment = viteServer.environments[ASTRO_VITE_ENVIRONMENT_NAMES.ssr];
       const prerenderEnvironment = viteServer.environments[ASTRO_VITE_ENVIRONMENT_NAMES.prerender];
       const runnableSsrEnvironment = isRunnableDevEnvironment(ssrEnvironment) ? ssrEnvironment : void 0;

package/dist/vite-plugin-css/index.d.ts

@@ -3,6 +3,11 @@ import type { RoutesList } from '../types/astro.js';
 interface AstroVitePluginOptions {
     routesList: RoutesList;
     command: 'dev' | 'build';
+    /** Shared cache of CSS content by module ID. Populated by the transform hook and
+     *  consumed by the content asset propagation plugin to avoid re-processing CSS
+     *  modules with `?inline` (which can produce different scoped-name hashes with
+     *  Lightning CSS). */
+    cssContentCache: Map<string, string>;
 }
 /**
  * This plugin tracks the CSS that should be applied by route.
@@ -14,5 +19,5 @@ interface AstroVitePluginOptions {
  *
  * @param routesList
  */
-export declare function astroDevCssPlugin({ routesList, command }: AstroVitePluginOptions): Plugin[];
+export declare function astroDevCssPlugin({ routesList, command, cssContentCache, }: AstroVitePluginOptions): Plugin[];
 export {};

package/dist/vite-plugin-css/index.js

@@ -60,9 +60,12 @@ function* collectCSSWithOrder(id, mod, seen = /* @__PURE__ */ new Set()) {
     }
   }
 }
-function astroDevCssPlugin({ routesList, command }) {
+function astroDevCssPlugin({
+  routesList,
+  command,
+  cssContentCache
+}) {
   let server;
-  const cssContentCache = /* @__PURE__ */ new Map();
   function getCurrentEnvironment(pluginEnv) {
     return pluginEnv ?? server?.environments[ASTRO_VITE_ENVIRONMENT_NAMES.ssr];
   }
@@ -122,7 +125,7 @@ function astroDevCssPlugin({ routesList, command }) {
             }
             for (const collected of collectCSSWithOrder(componentPageId, mod)) {
               if (!cssWithOrder.has(collected.idKey)) {
-                const content = cssContentCache.get(collected.id) || collected.content;
+                const content = cssContentCache.get(collected.idKey) || collected.content;
                 cssWithOrder.set(collected.idKey, { ...collected, content });
               }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro",
-  "version": "7.0.5",
+  "version": "7.0.7",
   "description": "Astro is a modern site builder with web best practices, performance, and DX front-of-mind.",
   "type": "module",
   "author": "withastro",
@@ -146,15 +146,15 @@
     "xxhash-wasm": "^1.1.0",
     "yargs-parser": "^22.0.0",
     "zod": "^4.3.6",
-    "@astrojs/internal-helpers": "0.10.0",
-    "@astrojs/markdown-satteri": "0.3.2",
-    "@astrojs/telemetry": "3.3.2"
+    "@astrojs/markdown-satteri": "0.3.3",
+    "@astrojs/internal-helpers": "0.10.1",
+    "@astrojs/telemetry": "3.3.3"
   },
   "optionalDependencies": {
     "sharp": "^0.34.0 || ^0.35.0"
   },
   "peerDependencies": {
-    "@astrojs/markdown-remark": "7.2.0"
+    "@astrojs/markdown-remark": "7.2.1"
   },
   "peerDependenciesMeta": {
     "@astrojs/markdown-remark": {
@@ -186,8 +186,8 @@
     "typescript": "^6.0.3",
     "undici": "^7.22.0",
     "vitest": "^4.1.0",
+    "@astrojs/markdown-remark": "7.2.1",
     "@astrojs/check": "0.9.9",
-    "@astrojs/markdown-remark": "7.2.0",
     "astro-scripts": "0.0.14"
   },
   "engines": {

package/templates/content/types.d.ts

@@ -85,6 +85,10 @@ declare module 'astro:content' {
 		entry: DataEntryMap[C][string],
 	): Promise<RenderResult>;
 
+	export function render<C extends keyof LiveContentConfig['collections']>(
+		entry: import('astro').LiveDataEntry<LiveLoaderDataType<C>>,
+	): Promise<RenderResult>;
+
 	export function reference<
 		C extends
 			| keyof DataEntryMap

package/dist/core/app/middlewares.d.ts

@@ -1,8 +0,0 @@
-import type { MiddlewareHandler } from '../../types/public/common.js';
-/**
- * Returns a middleware function in charge to check the `origin` header.
- *
- * @private
- */
-export declare function createOriginCheckMiddleware(): MiddlewareHandler;
-export declare function hasFormLikeHeader(contentType: string | null): boolean;

package/dist/core/app/middlewares.js

@@ -1,49 +0,0 @@
-import { defineMiddleware } from "../middleware/defineMiddleware.js";
-const FORM_CONTENT_TYPES = [
-  "application/x-www-form-urlencoded",
-  "multipart/form-data",
-  "text/plain"
-];
-const SAFE_METHODS = ["GET", "HEAD", "OPTIONS"];
-function createOriginCheckMiddleware() {
-  return defineMiddleware((context, next) => {
-    const { request, url, isPrerendered } = context;
-    if (isPrerendered) {
-      return next();
-    }
-    if (SAFE_METHODS.includes(request.method)) {
-      return next();
-    }
-    const isSameOrigin = request.headers.get("origin") === url.origin;
-    const hasContentType = request.headers.has("content-type");
-    if (hasContentType) {
-      const formLikeHeader = hasFormLikeHeader(request.headers.get("content-type"));
-      if (formLikeHeader && !isSameOrigin) {
-        return new Response(`Cross-site ${request.method} form submissions are forbidden`, {
-          status: 403
-        });
-      }
-    } else {
-      if (!isSameOrigin) {
-        return new Response(`Cross-site ${request.method} form submissions are forbidden`, {
-          status: 403
-        });
-      }
-    }
-    return next();
-  });
-}
-function hasFormLikeHeader(contentType) {
-  if (contentType) {
-    for (const FORM_CONTENT_TYPE of FORM_CONTENT_TYPES) {
-      if (contentType.toLowerCase().includes(FORM_CONTENT_TYPE)) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-export {
-  createOriginCheckMiddleware,
-  hasFormLikeHeader
-};