astro 7.0.9 → 7.1.1

package/dist/types/public/context.d.ts

@@ -1,6 +1,6 @@
 import type { ActionClient, ActionReturnType } from '../../actions/runtime/types.js';
 import type { AstroCookies } from '../../core/cookies/cookies.js';
-import type { CspDirective, CspHash } from '../../core/csp/config.js';
+import type { CspDirective, CspHashEntry, CspResourceEntry } from '../../core/csp/config.js';
 import type { CacheLike } from '../../core/cache/runtime/cache.js';
 import type { AstroSession } from '../../core/session/runtime.js';
 import type { AstroComponentFactory } from '../../runtime/server/index.js';
@@ -493,61 +493,77 @@ export interface APIContext<Props extends Record<string, any> = Record<string, a
          */
         insertDirective: (directive: CspDirective) => void;
         /**
-         * It set the resource for the directive `style-src` in the route being rendered. It overrides Astro's default.
+         * It sets the resource for the `style-src` family of directives in the route being rendered. It overrides Astro's default.
          *
-         * @param {string} payload - The source to insert in the `style-src` directive.
+         * Pass a bare string to add the source to `style-src`, or an object with a `kind` to scope it:
+         * `"element"` → `style-src-elem`, `"attribute"` → `style-src-attr`, `"default"` → `style-src`.
+         *
+         * @param {string | { resource: string; kind?: "element" | "attribute" | "default" }} payload - The source to insert.
          *
          * ## Example
          *
          * ```js
          * ctx.insertStyleResource("https://styles.cdn.example.com/")
+         * ctx.insertStyleResource({ resource: "'unsafe-inline'", kind: "attribute" })
          * ```
          *
          * [Astro reference](https://docs.astro.build/en/reference/experimental-flags/csp/#cspinsertstyleresource)
          */
-        insertStyleResource: (payload: string) => void;
+        insertStyleResource: (payload: CspResourceEntry) => void;
         /**
          * Insert a single style hash to the route being rendered.
          *
-         * @param {CspHash} hash - The hash to insert in the `style-src` directive.
+         * Pass a bare hash to add it to `style-src`, or an object with a `kind` to scope it:
+         * `"element"` → `style-src-elem`, `"attribute"` → `style-src-attr`, `"default"` → `style-src`.
+         *
+         * @param {CspHash | { hash: CspHash; kind?: "element" | "attribute" | "default" }} payload - The hash to insert.
          *
          * ## Example
          *
          * ```js
          * ctx.insertStyleHash("sha256-1234567890abcdef1234567890")
+         * ctx.insertStyleHash({ hash: "sha256-1234567890abcdef1234567890", kind: "element" })
          * ```
          *
          * [Astro reference](https://docs.astro.build/en/reference/experimental-flags/csp/#cspinsertstylehash)
          */
-        insertStyleHash: (hash: CspHash) => void;
+        insertStyleHash: (payload: CspHashEntry) => void;
         /**
-         * It set the resource for the directive `script-src` in the route being rendered.
+         * It sets the resource for the `script-src` family of directives in the route being rendered.
          *
-         * @param {string} resource - The source to insert in the `script-src` directive.
+         * Pass a bare string to add the source to `script-src`, or an object with a `kind` to scope it:
+         * `"element"` → `script-src-elem`, `"attribute"` → `script-src-attr`, `"default"` → `script-src`.
+         *
+         * @param {string | { resource: string; kind?: "element" | "attribute" | "default" }} payload - The source to insert.
          *
          * ## Example
          *
          * ```js
          * ctx.insertScriptResource("https://scripts.cdn.example.com/")
+         * ctx.insertScriptResource({ resource: "https://scripts.cdn.example.com/", kind: "element" })
          * ```
          *
          * [Astro reference](https://docs.astro.build/en/reference/experimental-flags/csp/#cspinsertscriptresource)
          */
-        insertScriptResource: (resource: string) => void;
+        insertScriptResource: (payload: CspResourceEntry) => void;
         /**
          * Insert a single script hash to the route being rendered.
          *
-         * @param {CspHash} hash - The hash to insert in the `script-src` directive.
+         * Pass a bare hash to add it to `script-src`, or an object with a `kind` to scope it:
+         * `"element"` → `script-src-elem`, `"attribute"` → `script-src-attr`, `"default"` → `script-src`.
+         *
+         * @param {CspHash | { hash: CspHash; kind?: "element" | "attribute" | "default" }} payload - The hash to insert.
          *
          * ## Example
          *
          * ```js
          * ctx.insertScriptHash("sha256-1234567890abcdef1234567890")
+         * ctx.insertScriptHash({ hash: "sha256-1234567890abcdef1234567890", kind: "element" })
          * ```
          *
          * [Astro reference](https://docs.astro.build/en/reference/experimental-flags/csp/#cspinsertscripthash)
          */
-        insertScriptHash: (hash: CspHash) => void;
+        insertScriptHash: (payload: CspHashEntry) => void;
     } | undefined;
     /**
      * It exposes utilities for logging messages.

package/dist/types/public/internal.d.ts

@@ -210,26 +210,27 @@ export interface SSRResult {
     key: Promise<CryptoKey>;
     _metadata: SSRMetadata;
     /**
-     * `header`:
-     * - <meta> for static pages
-     * - Response header for dynamic pages
-     *
-     * `meta`:
-     * - <meta> for all pages
-     *
-     * `adapter`:
-     * - nothing for static pages (the adapter does this)
-     * - Response header for dynamic pages
+     * `cspDestination`:
+     * - `header`: `<meta>` for static pages, response header for dynamic pages
+     * - `meta`: `<meta>` for all pages
+     * - `adapter`: nothing for static pages (the adapter does this), response header for dynamic pages
      */
     cspDestination: NonNullable<SSRManifestCSP['cspDestination']>;
     shouldInjectCspMetaTags: boolean;
     cspAlgorithm: SSRManifestCSP['algorithm'];
+    directives: SSRManifestCSP['directives'];
+    /** @deprecated Use {@linkcode scriptDirective} instead. Holds the `default`-kind `script-src` hashes. */
     scriptHashes: SSRManifestCSP['scriptHashes'];
+    /** @deprecated Use {@linkcode scriptDirective} instead. Holds the `default`-kind `script-src` resources. */
     scriptResources: SSRManifestCSP['scriptResources'];
+    /** @deprecated Use {@linkcode styleDirective} instead. Holds the `default`-kind `style-src` hashes. */
     styleHashes: SSRManifestCSP['styleHashes'];
+    /** @deprecated Use {@linkcode styleDirective} instead. Holds the `default`-kind `style-src` resources. */
     styleResources: SSRManifestCSP['styleResources'];
-    directives: SSRManifestCSP['directives'];
+    /** @deprecated Use {@linkcode scriptDirective}'s `strictDynamic` instead. */
     isStrictDynamic: SSRManifestCSP['isStrictDynamic'];
+    scriptDirective: SSRManifestCSP['scriptDirective'];
+    styleDirective: SSRManifestCSP['styleDirective'];
     internalFetchHeaders?: Record<string, string>;
 }
 /**

package/dist/vite-plugin-app/pipeline.js

@@ -8,6 +8,7 @@ import { loadRenderer } from "../core/render/index.js";
 import { routeIsRedirect } from "../core/routing/helpers.js";
 import { findRouteToRewrite } from "../core/routing/rewrite.js";
 import { isPage } from "../core/util.js";
+import { stringifyForScript } from "../runtime/server/escape.js";
 import { getComponentMetadata } from "../vite-plugin-astro-server/metadata.js";
 import { createResolve } from "../vite-plugin-astro-server/resolve.js";
 import { PAGE_SCRIPT_ID } from "../vite-plugin-scripts/index.js";
@@ -90,7 +91,7 @@ class RunnablePipeline extends Pipeline {
             debugInfo: await this.getDebugInfo(),
             placement: settings.config.devToolbar.placement
           };
-          const children = `window.__astro_dev_toolbar__ = ${JSON.stringify(additionalMetadata)}`;
+          const children = `window.__astro_dev_toolbar__ = ${stringifyForScript(additionalMetadata)}`;
           scripts.add({ props: {}, children });
         }
       }

package/dist/vite-plugin-astro-server/route-guard.js

@@ -48,9 +48,10 @@ function routeGuardMiddleware(settings) {
     } catch {
       return next();
     }
+    const resolved = new URL("." + pathname, config.root);
     const fsInfo = {
-      existsInPublic: fs.existsSync(new URL("." + pathname, config.publicDir)),
-      existsInSrc: fs.existsSync(new URL("." + pathname, config.srcDir)),
+      existsInPublic: resolved.pathname.startsWith(config.publicDir.pathname) && fs.existsSync(resolved),
+      existsInSrc: resolved.pathname.startsWith(config.srcDir.pathname) && fs.existsSync(resolved),
       existsAtRootAsFile: false
     };
     if (accept.includes("text/html") && !url.includes("?") && !VITE_INTERNAL_PREFIXES.some((prefix) => pathname.startsWith(prefix))) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "astro",
-  "version": "7.0.9",
+  "version": "7.1.1",
   "description": "Astro is a modern site builder with web best practices, performance, and DX front-of-mind.",
   "type": "module",
   "author": "withastro",
@@ -147,8 +147,8 @@
     "yargs-parser": "^22.0.0",
     "zod": "^4.3.6",
     "@astrojs/internal-helpers": "0.10.1",
-    "@astrojs/markdown-satteri": "0.3.4",
-    "@astrojs/telemetry": "3.3.3"
+    "@astrojs/telemetry": "3.3.3",
+    "@astrojs/markdown-satteri": "0.3.4"
   },
   "optionalDependencies": {
     "sharp": "^0.34.0 || ^0.35.0"