@bygghammar/cms-platform 0.91.0 → 0.92.0

package/src/site/route-index.ts

@@ -0,0 +1,641 @@
+/**
+ * What makes two URLs the same URL.
+ *
+ * A route collision is not a comparison of slugs. Two pages collide when the
+ * address a browser actually sends is the same address, and browsers agree
+ * about far more than string equality: `/OM-OSS` and `/om-oss` on a site that
+ * folds case, `/om//oss` and `/om/oss`, `/om-oss/` and `/om-oss`,
+ * `/caf%C3%A9` and `/café`, `café` written composed and `café` written with a
+ * combining accent, `https://voyara.se:443` and `https://voyara.se`. Every one
+ * of those pairs is one served URL, and a CMS that lets both be claimed has
+ * published a site that serves two different pages at one address depending on
+ * how the link was typed.
+ *
+ * So this module answers one question — what is the exact normalized served
+ * URL — and answers it in one place. It does not answer whether a claim
+ * succeeds. `cms_route_claim_apply` does, and it does so with a primary key on
+ * `(origin, path)` rather than a lookup, because a lookup is a read followed by
+ * a write and two concurrent editors both read the path as free. What this
+ * module decides is what the key is being asked *about*.
+ *
+ * The identity, in the order it is applied:
+ *
+ *   1. Scheme and host lowercased.
+ *   2. Port preserved. Only `:80` on http and `:443` on https are dropped,
+ *      because `https://x` and `https://x:8443` are different sites.
+ *   3. Unicode NFC normalization of host and path.
+ *   4. Percent-decode, then re-encode canonically: unreserved characters end up
+ *      literal, everything else escaped with uppercase hex.
+ *   5. Duplicate slashes collapse; `.` and `..` segments are removed.
+ *   6. The registry's trailing-slash policy applied exactly once.
+ *   7. The registry's case policy; a leading locale prefix is always lowercased.
+ *
+ * Two notes on step 4, because it is the step with a choice in it. Decoding
+ * everything and re-encoding merges `/a%3Db` with `/a=b`, which strict RFC 3986
+ * equivalence would keep apart. That direction is deliberate: over-merging
+ * refuses two pages that differ only by how a character was written, while
+ * under-merging lets both be claimed and publishes the ambiguity. Refusing a
+ * pair a pedant would allow costs an editor one rename; allowing a pair a
+ * browser cannot tell apart costs the site a URL that serves two pages. And a
+ * segment whose escapes are malformed is not a character sequence at all, so
+ * there is nothing to normalize — it keeps the bytes it was given, with the hex
+ * uppercased, which is still a stable identity.
+ *
+ * Dot-segment removal is not in the list this design was written from. It is
+ * here because leaving it out is an under-merge: `/a/../b` and `/b` are the
+ * same address to every client that resolves a reference, and two claims for
+ * one served URL is the failure this whole mechanism exists to prevent. It runs
+ * twice, before and after decoding, because the parser browsers actually use
+ * treats `%2E%2E` as a double-dot segment as well: `/om/%2E%2E/oss` is a
+ * request for `/oss`, and an identity that stored the literal spelling would
+ * hold an address no request can arrive at.
+ *
+ * Pure module — no database, no filesystem, no network, no clock.
+ */
+
+import { domainOrigin } from "./host";
+
+/** Whether a served path keeps a trailing slash. Fixed per release. */
+export type TrailingSlashPolicy = "never" | "always";
+
+/**
+ * The release's own account of its routes: the `snapshot` column of
+ * `cms_route_registry`, written once per deploy by `cms_route_registry_set`.
+ *
+ * The database cannot infer any of this. Which paths belong to the API and the
+ * backoffice, which locales exist, which domain serves which language, whether
+ * a trailing slash is kept, whether case is folded — each is decided by the
+ * application at build time, and each changes what two URLs have to agree about
+ * before they count as the same URL. The snapshot is how those decisions reach
+ * the authority, and `release_sha` is how a claim normalized under one set of
+ * them is told apart from a claim normalized under the set before.
+ */
+export type RouteRegistry = {
+  /** Every origin this release serves, canonical and sorted. */
+  origins: string[];
+  /** Locale tags the release publishes, e.g. `["sv", "en"]`. */
+  locales: string[];
+  /** The locale that carries no URL prefix. */
+  defaultLocale: string;
+  /** Locale → the origin that serves it. Empty means one origin serves all. */
+  localeDomains: Record<string, string>;
+  /** Paths the release keeps for itself, normalized like any other path. */
+  reservedPaths: string[];
+  trailingSlash: TrailingSlashPolicy;
+  caseSensitive: boolean;
+  /**
+   * What the release believed each page's slug was, per locale.
+   *
+   * Carried so an operator reading the registry can see which build wrote it.
+   * Nothing consults it to decide anything; the claims are the decision.
+   */
+  pages?: Record<string, Record<string, string>>;
+};
+
+/** The part of the registry a path is normalized against. */
+export type RoutePathPolicy = {
+  trailingSlash?: TrailingSlashPolicy;
+  caseSensitive?: boolean;
+  locales?: readonly string[];
+};
+
+/** What a claim is: the page's own address, an old one, or the release's. */
+export type RouteClaimKind = "page" | "redirect" | "reserved";
+
+/** One row of `cms_route_claims`. */
+export type RouteClaim = {
+  origin: string;
+  path: string;
+  kind: RouteClaimKind;
+  /** The locale served here, or `null` for a reserved path. */
+  locale: string | null;
+  /** The page holding it, or `null`/absent when the release holds it. */
+  pageId?: string | null;
+};
+
+/** Sub-delimiters RFC 3986 allows to stand unencoded inside a path segment. */
+const SEGMENT_LITERALS: [string, string][] = [
+  ["%24", "$"],
+  ["%26", "&"],
+  ["%2B", "+"],
+  ["%2C", ","],
+  ["%3A", ":"],
+  ["%3B", ";"],
+  ["%3D", "="],
+  ["%40", "@"],
+];
+
+/** Uppercase the hex of every percent-escape and touch nothing else. */
+function upperEscapes(value: string): string {
+  return value.replace(/%[0-9a-f]{2}/gi, (escape) => escape.toUpperCase());
+}
+
+/** The decoded segment, or `null` when its escapes are not decodable. */
+function decodeSegment(segment: string): string | null {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * A segment encoded the one canonical way.
+ *
+ * `encodeURIComponent` escapes `/`, which is what keeps `%2F` from merging two
+ * segments into one, and emits uppercase hex, which is step 4. It also escapes
+ * eight sub-delimiters that are legal unencoded in a path, so those are put
+ * back — a server sees `/a=b`, and an identity that wrote `/a%3Db` would be
+ * comparing something the site never serves.
+ */
+function encodeSegment(value: string): string {
+  let encoded = encodeURIComponent(value);
+  for (const [escape, literal] of SEGMENT_LITERALS) {
+    encoded = encoded.split(escape).join(literal);
+  }
+  return encoded;
+}
+
+/**
+ * One segment reduced to its identity.
+ *
+ * The NFC pass runs after the case fold rather than before it, because folding
+ * case can itself change which code points are present, and normalizing before
+ * the last transform that can move them normalizes the wrong string.
+ */
+function canonicalSegment(segment: string, fold: boolean): string {
+  const decoded = decodeSegment(segment);
+  // Nothing to normalize: escapes that do not decode are not a character
+  // sequence. The case policy still applies to the letters that are there, or
+  // one page would have two identities on a site that folds case.
+  if (decoded === null) return upperEscapes(fold ? segment.toLowerCase() : segment);
+  const cased = fold ? decoded.toLowerCase() : decoded;
+  return encodeSegment(cased.normalize("NFC"));
+}
+
+/**
+ * `.` and `..` resolved away, never above the root.
+ *
+ * RFC 3986 removes these during reference resolution, so a client removes them
+ * before the request is sent and the server never sees them. A claim that kept
+ * them would be a claim on an address nobody can ask for.
+ */
+function removeDotSegments(segments: string[]): string[] {
+  const kept: string[] = [];
+  for (const segment of segments) {
+    if (segment === ".") continue;
+    if (segment === "..") {
+      kept.pop();
+      continue;
+    }
+    kept.push(segment);
+  }
+  return kept;
+}
+
+/** Whether a raw segment names one of the release's locales. */
+function namesLocale(segment: string, locales: Set<string>): boolean {
+  const decoded = decodeSegment(segment) ?? segment;
+  return locales.has(decoded.toLowerCase());
+}
+
+/**
+ * `scheme://host[:port]`, or "" when the value cannot be an origin.
+ *
+ * The WHATWG parser is the whole of steps 1 to 3 for the host: it lowercases
+ * the scheme and the host, applies IDNA — which carries the Unicode
+ * normalization with it — and drops the port only when it is the scheme's
+ * default. Nothing here re-implements any of that.
+ *
+ * What is refused rather than repaired: a value with no scheme, because
+ * `localhost:8443` parses as the scheme `localhost` and the platform would be
+ * guessing which of two readings was meant; and a value carrying a path, query,
+ * fragment or credentials, because dropping them would answer about
+ * `https://example.com` when the caller asked about `https://example.com/sv`,
+ * and an origin that quietly means something else than it says is the failure
+ * this module exists to prevent.
+ */
+export function normalizeOrigin(value: string | null | undefined): string {
+  const raw = (value ?? "").trim();
+  if (!/^https?:\/\//i.test(raw)) return "";
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return "";
+  }
+  if (url.username || url.password) return "";
+  if (url.search || url.hash) return "";
+  if (url.pathname !== "" && url.pathname !== "/") return "";
+  return url.origin;
+}
+
+/**
+ * A served path reduced to its identity: steps 3 to 7.
+ *
+ * A query string and a fragment are removed first. Neither reaches the server
+ * as part of the path a route is matched on — a fragment never leaves the
+ * client at all — so a claim that kept them would be a claim on an address
+ * nobody can request.
+ *
+ * The empty path is the root. That is not a fallback for unusable input: a page
+ * with no slug is the site's front page, and `/` is the address it serves.
+ */
+export function normalizeRoutePath(
+  input: string | null | undefined,
+  policy: RoutePathPolicy = {},
+): string {
+  const raw = (input ?? "").trim().split("#")[0].split("?")[0];
+  const locales = new Set((policy.locales ?? []).map((locale) => locale.toLowerCase()));
+  const foldEverything = policy.caseSensitive !== true;
+
+  // An empty segment is a duplicate slash, a leading slash or a trailing one.
+  // All three are the same non-event, and dropping them is step 5.
+  const kept = removeDotSegments(raw.split("/").filter((segment) => segment !== ""));
+
+  // Dot segments are removed a second time, on the decoded forms, because
+  // `%2E%2E` is a double-dot segment to a browser as surely as `..` is.
+  const canonical = removeDotSegments(
+    kept.map((segment, index) =>
+      canonicalSegment(segment, foldEverything || (index === 0 && namesLocale(segment, locales))),
+    ),
+  );
+
+  const path = canonical.length === 0 ? "/" : `/${canonical.join("/")}`;
+  return policy.trailingSlash === "always" && path !== "/" ? `${path}/` : path;
+}
+
+/**
+ * The path a site serves for one slug in one locale, before normalization.
+ *
+ * The default locale carries no prefix and every other locale does — on its own
+ * domain as much as on a shared one, because the prefix is what makes a Swedish
+ * and an English page with the same slug two addresses instead of one
+ * collision. An empty slug is the front page.
+ *
+ * Everything that needs this answer calls this function: the site's own route
+ * builder, the conflict pre-check the backoffice runs while an editor types,
+ * and the resolver that turns an incoming request into a page. A second
+ * implementation of it is how a page comes to claim an address it does not
+ * serve.
+ */
+export function servedPath(
+  slug: string | null | undefined,
+  locale: string,
+  defaultLocale: string,
+): string {
+  const prefix = locale === defaultLocale ? "" : `/${locale}`;
+  const trimmed = (slug ?? "").trim().replace(/^\/+|\/+$/g, "");
+  const full = `${prefix}${trimmed ? `/${trimmed}` : ""}`;
+  return full === "" ? "/" : full;
+}
+
+/** The address a claim is stored and compared at. */
+export function routeKey(origin: string, path: string): string {
+  return `${origin}${path}`;
+}
+
+/**
+ * A whole URL split into the two halves the authority stores, or `null`.
+ *
+ * For the cases where a person hands the system an address rather than a route:
+ * a redirect source typed into the backoffice, an operator asking who holds a
+ * URL that turned up in a log.
+ */
+export function normalizeRouteUrl(
+  value: string | null | undefined,
+  policy: RoutePathPolicy = {},
+): { origin: string; path: string } | null {
+  const raw = (value ?? "").trim();
+  if (!/^https?:\/\//i.test(raw)) return null;
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  const origin = normalizeOrigin(url.origin);
+  if (!origin) return null;
+  return { origin, path: normalizeRoutePath(url.pathname, policy) };
+}
+
+/** Rows of `locale_domains`, in the shape the table stores them. */
+export type LocaleDomainRow = { locale: string; domain: string };
+
+export type RouteRegistryInput = {
+  /** The origin this deployment advertises when no locale mapping applies. */
+  publicOrigin: string;
+  locales: string[];
+  defaultLocale: string;
+  localeDomains?: LocaleDomainRow[];
+  reservedPaths?: string[];
+  trailingSlash?: TrailingSlashPolicy;
+  caseSensitive?: boolean;
+  pages?: Record<string, Record<string, string>>;
+};
+
+export type RouteRegistryResult =
+  | { ok: true; registry: RouteRegistry }
+  | { ok: false; problem: string };
+
+/**
+ * The snapshot a deploy step sends to `cms_route_registry_set`.
+ *
+ * An unusable locale mapping stops the deploy here, and says which row. This is
+ * stricter than `originForLocale` in `routes.ts`, which skips a bad row and
+ * keeps scanning so that one broken mapping cannot hide a good one for the same
+ * language — and the difference is deliberate. That function is serving a site
+ * that is already running, where the only thing worse than a bad mapping is a
+ * blank page. This one runs at the moment somebody can still fix the row, and
+ * the alternative to refusing is a release that claims one set of URLs and
+ * serves another, with a canonical tag pointing at a host nobody deployed.
+ * There is no fallback to single-origin mode.
+ *
+ * The reserved paths are normalized with the same function that normalizes a
+ * page's path, which is the only reason reserving `/API` refuses a page at
+ * `/api`. A reserved list held to a different standard than the paths it is
+ * compared against reserves nothing.
+ */
+export function buildRouteRegistry(input: RouteRegistryInput): RouteRegistryResult {
+  const origin = normalizeOrigin(input.publicOrigin);
+  if (!origin) {
+    return {
+      ok: false,
+      problem:
+        `The deployment's public origin is ${describe(input.publicOrigin)}, which is not an ` +
+        `origin. Every claim is stored against one, so there is nothing to normalize against.`,
+    };
+  }
+
+  const locales = input.locales.map((locale) => locale.trim()).filter(Boolean);
+  if (locales.length === 0) {
+    return { ok: false, problem: "The route registry has to name the locales the release serves." };
+  }
+  const defaultLocale = input.defaultLocale.trim();
+  if (!locales.includes(defaultLocale)) {
+    return {
+      ok: false,
+      problem:
+        `The default locale ${describe(input.defaultLocale)} is not one of the locales this ` +
+        `release serves (${locales.join(", ")}). The locale that carries no URL prefix has to ` +
+        `be one of them, or every unprefixed path belongs to a language nobody publishes.`,
+    };
+  }
+
+  const localeDomains: Record<string, string> = {};
+  for (const row of input.localeDomains ?? []) {
+    const locale = row.locale.trim();
+    if (!locales.includes(locale)) {
+      return {
+        ok: false,
+        problem:
+          `The domain ${describe(row.domain)} is mapped to the locale ${describe(row.locale)}, ` +
+          `which this release does not serve. A mapping for a language that is not published ` +
+          `is a mapping nobody has checked.`,
+      };
+    }
+    // `locale_domains` stores a hostname without a port, so this is always a
+    // default-port origin. A port survives normalization everywhere it can
+    // appear — a configured public origin, an explicit claim — it just cannot
+    // appear here.
+    const mapped = domainOrigin(row.domain);
+    if (!mapped) {
+      return {
+        ok: false,
+        problem:
+          `The locale ${locale} is mapped to ${describe(row.domain)}, which is not a hostname ` +
+          `this release can serve from. Fix or remove the mapping and deploy again; a locale ` +
+          `whose domain cannot be read is refused rather than served from the default origin.`,
+      };
+    }
+    if (localeDomains[locale] && localeDomains[locale] !== mapped) {
+      return {
+        ok: false,
+        problem:
+          `The locale ${locale} is mapped to both ${localeDomains[locale]} and ${mapped}. One ` +
+          `language cannot be canonical on two hosts; pick the one the site advertises.`,
+      };
+    }
+    localeDomains[locale] = mapped;
+  }
+
+  const trailingSlash: TrailingSlashPolicy = input.trailingSlash ?? "never";
+  const caseSensitive = input.caseSensitive === true;
+  const policy: RoutePathPolicy = { trailingSlash, caseSensitive, locales };
+
+  const reserved = new Set<string>();
+  for (const path of input.reservedPaths ?? []) {
+    const normalized = normalizeRoutePath(path, policy);
+    reserved.add(normalized);
+  }
+
+  const origins = new Set<string>([origin, ...Object.values(localeDomains)]);
+
+  return {
+    ok: true,
+    registry: {
+      origins: [...origins].sort(),
+      locales,
+      defaultLocale,
+      localeDomains,
+      reservedPaths: [...reserved].sort(),
+      trailingSlash,
+      caseSensitive,
+      ...(input.pages ? { pages: input.pages } : {}),
+    },
+  };
+}
+
+/** One address a page serves, as the site's own route builder produced it. */
+export type PageRoute = {
+  locale: string;
+  /** The path the site serves, e.g. `/en/about`. Normalized here, not before. */
+  path: string;
+  /** `page` for an address it serves, `redirect` for one it used to. */
+  kind?: "page" | "redirect";
+  /** An origin other than the one the locale maps to. Rare; kept explicit. */
+  origin?: string;
+};
+
+export type PageClaimsResult =
+  | {
+      ok: true;
+      claims: RouteClaim[];
+      /** Locales left unclaimed, with the reason, so a deploy step can log it. */
+      skipped: { locale: string; reason: string }[];
+    }
+  | { ok: false; problem: string };
+
+/**
+ * One page's complete claim set, ready for `cms_route_claim_apply`.
+ *
+ * The paths come in already built, by `createSiteRoutes` in `routes.ts`, and
+ * are not rebuilt here. That is the point: the slug, the locale prefix and the
+ * default-locale rule are decided in one place, and this function normalizes
+ * what that place produced. A second implementation of path building, however
+ * careful, is a second opinion, and a second opinion is exactly how a page ends
+ * up claiming an address it does not serve.
+ *
+ * Reserved paths are not checked here either, for the same reason. They are
+ * rows in the same table with the same primary key, so a page sitting on `/api`
+ * is refused by the key that refuses a page sitting on another page's path,
+ * with the same error, through the same code. A separate list of forbidden
+ * strings consulted here would be a second authority waiting to disagree.
+ */
+export function buildPageClaims(
+  routes: PageRoute[],
+  registry: RouteRegistry,
+): PageClaimsResult {
+  const served = new Set(registry.origins);
+  const mapped = registry.localeDomains ?? {};
+  const mappingMode = Object.keys(mapped).length > 0;
+  const claims: RouteClaim[] = [];
+  const skipped: { locale: string; reason: string }[] = [];
+  const seen = new Map<string, PageRoute>();
+
+  for (const route of routes) {
+    let origin: string;
+
+    if (route.origin) {
+      origin = normalizeOrigin(route.origin);
+      if (!origin) {
+        return {
+          ok: false,
+          problem:
+            `The route for ${route.locale} names the origin ${describe(route.origin)}, which is ` +
+            `not an origin.`,
+        };
+      }
+    } else if (mappingMode) {
+      const domain = mapped[route.locale];
+      if (!domain) {
+        skipped.push({
+          locale: route.locale,
+          reason:
+            `this release maps locales to domains and ${route.locale} has none, so the page ` +
+            `serves no address in that language`,
+        });
+        continue;
+      }
+      origin = normalizeOrigin(domain);
+      if (!origin) {
+        return {
+          ok: false,
+          problem:
+            `The locale ${route.locale} is mapped to ${describe(domain)}, which is not an ` +
+            `origin. The claim is refused rather than moved to the default origin.`,
+        };
+      }
+    } else {
+      if (registry.origins.length !== 1) {
+        return {
+          ok: false,
+          problem:
+            `This release serves ${registry.origins.join(", ")} and maps no locale to any of ` +
+            `them, so there is no way to tell which one ${route.locale} belongs on.`,
+        };
+      }
+      origin = registry.origins[0] as string;
+    }
+
+    if (!served.has(origin)) {
+      return {
+        ok: false,
+        problem:
+          `This release serves ${registry.origins.join(", ")}, and ${route.locale} resolves to ` +
+          `${origin}. An origin the release does not serve has no reserved paths on it, so a ` +
+          `claim there would find /api free.`,
+      };
+    }
+
+    const path = normalizeRoutePath(route.path, registry);
+    const key = routeKey(origin, path);
+    const twin = seen.get(key);
+    if (twin) {
+      return {
+        ok: false,
+        problem:
+          `This page serves ${path} on ${origin} in both ${twin.locale} and ${route.locale}. ` +
+          `One page cannot serve one URL two ways — the two locales need different slugs, ` +
+          `different prefixes or different domains.`,
+      };
+    }
+    seen.set(key, route);
+    claims.push({ origin, path, kind: route.kind ?? "page", locale: route.locale });
+  }
+
+  return { ok: true, claims, skipped };
+}
+
+/** What the claims table currently says, keyed for lookup. */
+export type RouteIndex = {
+  /** How many claims the index holds. */
+  size: number;
+  /** The claim at this address, or `null`. The query is normalized; rows are not. */
+  holderOf: (origin: string, path: string) => RouteClaim | null;
+  /** Every claim one page holds. */
+  claimsFor: (pageId: string) => RouteClaim[];
+  /** The claims a proposal would land on that somebody else already holds. */
+  collisions: (proposed: RouteClaim[], pageId?: string | null) => RouteClaim[];
+};
+
+/**
+ * A request-scoped view of `cms_route_claims`.
+ *
+ * Read once per render and threaded through, rather than recomputed by
+ * navigation, the page picker, canonical generation and the sitemap in four
+ * places that can disagree. There is no process-global cache: a slug change has
+ * to take effect without a redeploy, and a cached route table is a stale second
+ * opinion with a long memory.
+ *
+ * It reports; it does not decide. Every answer here is what the database said
+ * when the rows were read, and by the time a save runs, another editor may have
+ * taken the address. That is not a gap to be closed with a re-check — it is why
+ * the authority is a primary key inside the writing transaction. Use this to
+ * tell an editor a slug looks taken; never to conclude that one is free.
+ *
+ * Stored rows are keyed exactly as stored. A row written under an earlier
+ * release was normalized under that release's policy, and re-normalizing it
+ * here would file it under an address the database does not hold — inventing
+ * agreement instead of showing the disagreement a policy change caused.
+ */
+export function createRouteIndex(claims: RouteClaim[], registry: RouteRegistry): RouteIndex {
+  const byAddress = new Map<string, RouteClaim>();
+  const byPage = new Map<string, RouteClaim[]>();
+
+  for (const claim of claims) {
+    byAddress.set(routeKey(claim.origin, claim.path), claim);
+    if (claim.pageId) {
+      const held = byPage.get(claim.pageId);
+      if (held) held.push(claim);
+      else byPage.set(claim.pageId, [claim]);
+    }
+  }
+
+  const holderOf = (origin: string, path: string): RouteClaim | null => {
+    const address = routeKey(normalizeOrigin(origin), normalizeRoutePath(path, registry));
+    return byAddress.get(address) ?? null;
+  };
+
+  return {
+    size: byAddress.size,
+    holderOf,
+    claimsFor: (pageId: string) => byPage.get(pageId) ?? [],
+    collisions: (proposed: RouteClaim[], pageId?: string | null) => {
+      const found: RouteClaim[] = [];
+      for (const claim of proposed) {
+        const held = byAddress.get(routeKey(claim.origin, claim.path));
+        if (!held) continue;
+        if (pageId != null && held.pageId === pageId) continue;
+        found.push(held);
+      }
+      return found;
+    },
+  };
+}
+
+/** A value quoted for a message, or named as empty rather than shown as "". */
+function describe(value: string | null | undefined): string {
+  const raw = (value ?? "").trim();
+  return raw === "" ? "empty" : `"${raw}"`;
+}

package/src/site/routes.ts

@@ -17,6 +17,7 @@
 
 import { DEFAULT_LOCALE, SUPPORTED_LOCALES, type Locale } from "../i18n/locales";
 import { domainOrigin, isValidCanonicalDomain } from "./host";
+import { servedPath } from "./route-index";
 import type { Localized, LocalizedImage, LocalizedString } from "../i18n/types";
 import { t, tv } from "../i18n/resolve";
 
@@ -86,10 +87,6 @@ export type SitemapEntry = {
   alternates: Array<{ locale: Locale | "x-default"; url: string }>;
 };
 
-function localePrefix(locale: Locale): string {
-  return locale === DEFAULT_LOCALE ? "" : `/${locale}`;
-}
-
 /**
  * Merge a static page definition with an optional CMS override.
  * Returns a new PageDef; the original inputs are not mutated.
@@ -326,10 +323,7 @@ export function createSiteRoutes(PAGES: Record<string, PageDef>): SiteRoutes {
 
   function pathFromDef(page: PageDef, locale: Locale): string {
     const slug = slugFor(page, locale) ?? slugFor(page, DEFAULT_LOCALE) ?? "";
-    const prefix = localePrefix(locale);
-    const path = slug ? `/${slug}` : "";
-    const full = `${prefix}${path}`;
-    return full === "" ? "/" : full;
+    return servedPath(slug, locale, DEFAULT_LOCALE);
   }
 
   function resolveRoute(