feat: scaffold Astro + Tailwind project

node_modules/astro/dist/core/util/normalized-url.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Creates a normalized URL from a request URL string.
+ * Decodes and validates the pathname, collapses duplicate slashes.
+ */
+export declare function createNormalizedUrl(requestUrl: string): URL;
+/**
+ * Normalizes an already-parsed URL in place: decodes and validates the
+ * pathname, collapses duplicate slashes. Returns the same URL object.
+ */
+export declare function normalizeUrl(url: URL): URL;

node_modules/astro/dist/core/util/normalized-url.js

@@ -0,0 +1,21 @@
+import { collapseDuplicateSlashes } from "@astrojs/internal-helpers/path";
+import { validateAndDecodePathname } from "./pathname.js";
+function createNormalizedUrl(requestUrl) {
+  return normalizeUrl(new URL(requestUrl));
+}
+function normalizeUrl(url) {
+  try {
+    url.pathname = validateAndDecodePathname(url.pathname);
+  } catch {
+    try {
+      url.pathname = decodeURI(url.pathname);
+    } catch {
+    }
+  }
+  url.pathname = collapseDuplicateSlashes(url.pathname);
+  return url;
+}
+export {
+  createNormalizedUrl,
+  normalizeUrl
+};

node_modules/astro/dist/core/util/pathname.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Validates that a pathname is not multi-level encoded.
+ * Detects if a pathname contains encoding that was encoded again (e.g., %2561dmin where %25 decodes to %).
+ * This prevents double/triple encoding bypasses of security checks.
+ *
+ * @param pathname - The pathname to validate
+ * @returns The decoded pathname if valid
+ * @throws Error if multi-level encoding is detected
+ */
+export declare function validateAndDecodePathname(pathname: string): string;

node_modules/astro/dist/core/util/pathname.js

@@ -0,0 +1,17 @@
+function validateAndDecodePathname(pathname) {
+  let decoded;
+  try {
+    decoded = decodeURI(pathname);
+  } catch (_e) {
+    throw new Error("Invalid URL encoding");
+  }
+  const hasDecoding = decoded !== pathname;
+  const decodedStillHasEncoding = /%[0-9a-fA-F]{2}/.test(decoded);
+  if (hasDecoding && decodedStillHasEncoding) {
+    throw new Error("Multi-level URL encoding is not allowed");
+  }
+  return decoded;
+}
+export {
+  validateAndDecodePathname
+};