@kirchdev/duxt 0.5.1-dev-main.48-5d5fca9 → 0.6.1-dev-main.51-119d6cc

package/app/utils/request-samples.ts

@@ -62,10 +62,50 @@ function inlineList(items: unknown[], rendered: string[]): string | undefined {
 /** A JavaScript key that needs no quotes. */
 const bareKey = /^[A-Za-z_$][\w$]*$/;
 
+/*
+ * EVERY STRING IN A SAMPLE IS DATA, and is written with an encoder that is
+ * complete for its language. The URL, the method, the headers and the body all
+ * come from a document this layer did not write — a server URL holding
+ * `'+(…)+'` must stay one string literal, not become an expression in a snippet
+ * a reader copies and runs. Escaping the quote alone is not enough: a value
+ * ending in a backslash escapes the closing quote instead.
+ */
+
+/** A JavaScript string literal, single-quoted as a person writes one. */
+function jsString(value: string): string {
+  const inner = JSON.stringify(value)
+    .slice(1, -1)
+    .replaceAll('\\"', '"')
+    .replaceAll("'", "\\'");
+
+  return `'${inner}'`;
+}
+
+/**
+ * A Python or Go string literal. JSON's escapes are a subset of both
+ * languages' double-quoted strings, so `JSON.stringify` is complete for them.
+ */
+const quoted = (value: string) => JSON.stringify(value);
+
+/** A PHP single-quoted literal, whose only escapes are `\\` and `\'`. */
+function phpString(value: string): string {
+  return `'${value.replaceAll('\\', '\\\\').replaceAll("'", "\\'")}'`;
+}
+
+/**
+ * The response type as a type argument, or nothing.
+ *
+ * The name is a component key out of the document, and a key is any string:
+ * only one that is an identifier — optionally an array of one — is code.
+ */
+function typeArgument(name?: string): string {
+  return name && /^[A-Za-z_$][\w$]*(?:\[\])?$/.test(name) ? `<${name}>` : '';
+}
+
 /** A value as a JavaScript literal, indented for the depth it sits at. */
 function js(value: unknown, depth = 1): string {
   if (value === null) return 'null';
-  if (typeof value === 'string') return `'${value.replaceAll("'", "\\'")}'`;
+  if (typeof value === 'string') return jsString(value);
   if (typeof value === 'number' || typeof value === 'boolean') {
     return String(value);
   }
@@ -89,7 +129,7 @@ function js(value: unknown, depth = 1): string {
 
   const written = entries
     .map(([key, item]) => {
-      const name = bareKey.test(key) ? key : `'${key}'`;
+      const name = bareKey.test(key) ? key : jsString(key);
       return `${pad(depth + 1)}${name}: ${js(item, depth + 1)}`;
     })
     .join(',\n');
@@ -104,7 +144,7 @@ function py(value: unknown, depth = 1): string {
   if (value === null) return 'None';
   if (typeof value === 'boolean') return value ? 'True' : 'False';
   if (typeof value === 'number') return String(value);
-  if (typeof value === 'string') return `"${value.replaceAll('"', '\\"')}"`;
+  if (typeof value === 'string') return quoted(value);
 
   if (Array.isArray(value)) {
     if (!value.length) return '[]';
@@ -126,7 +166,7 @@ function py(value: unknown, depth = 1): string {
   const written = entries
     .map(
       ([key, item]) =>
-        `${step(depth + 1)}"${key.replaceAll('"', '\\"')}": ${py(item, depth + 1)}`
+        `${step(depth + 1)}${quoted(key)}: ${py(item, depth + 1)}`
     )
     .join(',\n');
 
@@ -140,7 +180,7 @@ function php(value: unknown, depth = 1): string {
   if (value === null) return 'null';
   if (typeof value === 'boolean') return value ? 'true' : 'false';
   if (typeof value === 'number') return String(value);
-  if (typeof value === 'string') return `'${value.replaceAll("'", "\\'")}'`;
+  if (typeof value === 'string') return phpString(value);
 
   if (Array.isArray(value)) {
     if (!value.length) return '[]';
@@ -162,7 +202,7 @@ function php(value: unknown, depth = 1): string {
   const written = entries
     .map(
       ([key, item]) =>
-        `${step(depth + 1)}'${key.replaceAll("'", "\\'")}' => ${php(item, depth + 1)}`
+        `${step(depth + 1)}${phpString(key)} => ${php(item, depth + 1)}`
     )
     .join(',\n');
 
@@ -218,7 +258,7 @@ function jsOptions(
   const options: string[] = [];
 
   if (request.method !== 'GET') {
-    options.push(`  method: '${request.method}'`);
+    options.push(`  method: ${jsString(request.method)}`);
   }
 
   if (hasHeaders(request)) {
@@ -256,13 +296,13 @@ function jsCall(
   body: 'stringify' | 'object',
   typed = false
 ): string {
-  const generic =
-    typed && request.responseType ? `<${request.responseType}>` : '';
+  const generic = typed ? typeArgument(request.responseType) : '';
+  const url = jsString(request.url);
 
   const options = jsOptions(request, body);
-  if (!options.length) return `${call}${generic}('${request.url}');`;
+  if (!options.length) return `${call}${generic}(${url});`;
 
-  return `${call}${generic}('${request.url}', {\n${options.join(',\n')}\n});`;
+  return `${call}${generic}(${url}, {\n${options.join(',\n')}\n});`;
 }
 
 /** The request as a `fetch` call. A JSON body is written as the data it is. */
@@ -290,8 +330,8 @@ export function openApiUseFetch(request: DuxtOpenApiRequest): string {
 /** axios through its uniform form, so the shape does not change per method. */
 export function openApiAxios(request: DuxtOpenApiRequest): string {
   const options = [
-    `  method: '${request.method.toLowerCase()}'`,
-    `  url: '${request.url}'`
+    `  method: ${jsString(request.method.toLowerCase())}`,
+    `  url: ${jsString(request.url)}`
   ];
 
   if (hasHeaders(request)) options.push(`  headers: ${js(request.headers)}`);
@@ -301,7 +341,7 @@ export function openApiAxios(request: DuxtOpenApiRequest): string {
     options.push(`  data: ${data === undefined ? js(request.body) : js(data)}`);
   }
 
-  const generic = request.responseType ? `<${request.responseType}>` : '';
+  const generic = typeArgument(request.responseType);
 
   return `await axios${generic}({\n${options.join(',\n')}\n});`;
 }
@@ -316,8 +356,8 @@ function pyCall(module: string, request: DuxtOpenApiRequest): string {
     : `${module}.request(`;
 
   const args = known
-    ? [`    "${request.url}"`]
-    : [`    "${request.method}"`, `    "${request.url}"`];
+    ? [`    ${quoted(request.url)}`]
+    : [`    ${quoted(request.method)}`, `    ${quoted(request.url)}`];
 
   if (hasHeaders(request)) args.push(`    headers=${py(request.headers)}`);
 
@@ -349,7 +389,10 @@ export function openApiUrllib(request: DuxtOpenApiRequest): string {
     ? 'import json\nimport urllib.request'
     : 'import urllib.request';
 
-  const args = [`    "${request.url}"`, `    method="${request.method}"`];
+  const args = [
+    `    ${quoted(request.url)}`,
+    `    method=${quoted(request.method)}`
+  ];
 
   if (hasHeaders(request)) args.push(`    headers=${py(request.headers)}`);
 
@@ -392,7 +435,7 @@ export function openApiGo(request: DuxtOpenApiRequest): string {
   }
 
   lines.push(
-    `req, err := http.NewRequest("${request.method}", "${request.url}", ${request.body ? 'body' : 'nil'})`,
+    `req, err := http.NewRequest(${quoted(request.method)}, ${quoted(request.url)}, ${request.body ? 'body' : 'nil'})`,
     'if err != nil {',
     '\treturn err',
     '}'
@@ -401,7 +444,7 @@ export function openApiGo(request: DuxtOpenApiRequest): string {
   if (hasHeaders(request)) {
     lines.push('');
     for (const [name, value] of Object.entries(request.headers)) {
-      lines.push(`req.Header.Set("${name}", "${value}")`);
+      lines.push(`req.Header.Set(${quoted(name)}, ${quoted(value)})`);
     }
   }
 
@@ -428,9 +471,10 @@ export function openApiGuzzle(request: DuxtOpenApiRequest): string {
   }
 
   const client = '$client = new \\GuzzleHttp\\Client();';
+  const head = `$client->request(${phpString(request.method)}, ${phpString(request.url)}`;
   const call = options.length
-    ? `$client->request('${request.method}', '${request.url}', [\n${options.join(',\n')},\n]);`
-    : `$client->request('${request.method}', '${request.url}');`;
+    ? `${head}, [\n${options.join(',\n')},\n]);`
+    : `${head});`;
 
   return `${client}\n\n${call}`;
 }
@@ -448,12 +492,12 @@ export function openApiLaravelHttp(request: DuxtOpenApiRequest): string {
     ? `, ${data === undefined ? php(request.body) : php(data, 1)}`
     : '';
 
-  return `${head}${verb}('${request.url}'${payload});`;
+  return `${head}${verb}(${phpString(request.url)}${payload});`;
 }
 
 /** The curl extension, for a project with no HTTP client at all. */
 export function openApiPhpCurl(request: DuxtOpenApiRequest): string {
-  const options = [`    CURLOPT_CUSTOMREQUEST => '${request.method}'`];
+  const options = [`    CURLOPT_CUSTOMREQUEST => ${phpString(request.method)}`];
 
   if (hasHeaders(request)) {
     const headers = Object.entries(request.headers).map(
@@ -469,7 +513,7 @@ export function openApiPhpCurl(request: DuxtOpenApiRequest): string {
   options.push('    CURLOPT_RETURNTRANSFER => true');
 
   return [
-    `$ch = curl_init('${request.url}');`,
+    `$ch = curl_init(${phpString(request.url)});`,
     '',
     'curl_setopt_array($ch, [',
     options.join(',\n') + ',',

package/build/bruno/bruno-parse.ts

@@ -524,8 +524,11 @@ export function redactUrl(url: string): { url: string; redacted: boolean } {
       const equals = pair.indexOf('=');
       if (equals < 1) return pair;
 
+      // Classified DECODED: `%61pi_key` is `api_key` to every server that
+      // reads the query, so it has to be `api_key` here too. The name is
+      // published as written.
       const name = pair.slice(0, equals);
-      if (!withheld(name, pair.slice(equals + 1))) return pair;
+      if (!withheld(queryName(name), pair.slice(equals + 1))) return pair;
 
       redacted = true;
       return `${name}=`;
@@ -538,6 +541,15 @@ export function redactUrl(url: string): { url: string; redacted: boolean } {
   };
 }
 
+/** A query name as a server reads it; the raw name if it does not decode. */
+function queryName(name: string): string {
+  try {
+    return decodeURIComponent(name.replaceAll('+', ' '));
+  } catch {
+    return name;
+  }
+}
+
 /** `collection.bru`'s `auth { mode: … }`, which `auth: inherit` resolves to. */
 function sharedAuth(blocks: Block[]): DuxtBrunoAuth | undefined {
   const mode = dictionary(blocks, 'auth').mode;

package/build/openapi/openapi-parse.ts

@@ -80,6 +80,26 @@ const isObject = (value: unknown): value is Node =>
 const str = (value: unknown): string | undefined =>
   typeof value === 'string' ? value : undefined;
 
+/**
+ * A URL the document hands a reader to click, or nothing.
+ *
+ * `http`, `https`, `mailto` or relative, and NOTHING ELSE: these land in an
+ * `href` on the site's own origin, and `javascript:` in a contact or licence URL
+ * is a script this layer would be running for whoever wrote the document. MDC
+ * checks a component's `href` prop, but these arrive nested inside objects it
+ * never looks into. The scheme is read the way a browser reads it — with tabs,
+ * newlines and control characters removed — or `java\tscript:` walks past.
+ */
+const link = (value: unknown): string | undefined => {
+  const url = str(value);
+  if (!url) return undefined;
+
+  const compact = [...url].filter((char) => char > ' ').join('');
+  const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(compact);
+
+  return !scheme || /^(?:https?|mailto)$/i.test(scheme[1]!) ? url : undefined;
+};
+
 const num = (value: unknown): number | undefined =>
   typeof value === 'number' && Number.isFinite(value) ? value : undefined;
 
@@ -205,7 +225,7 @@ function read(document: Node, dialect: '3.0' | '3.1'): DuxtOpenApiSpec {
   /** The externalDocs object, wherever one may appear. */
   const externalDocs = (node: unknown): DuxtOpenApiExternalDocs | undefined => {
     if (!isObject(node)) return undefined;
-    const url = str(node.url);
+    const url = link(node.url);
     return url ? { url, description: str(node.description) } : undefined;
   };
 
@@ -731,11 +751,11 @@ function read(document: Node, dialect: '3.0' | '3.1'): DuxtOpenApiSpec {
       version: str(info.version) ?? '',
       summary: str(info.summary),
       description: str(info.description),
-      termsOfService: str(info.termsOfService),
+      termsOfService: link(info.termsOfService),
       contact: isObject(info.contact)
         ? {
             name: str(info.contact.name),
-            url: str(info.contact.url),
+            url: link(info.contact.url),
             email: str(info.contact.email)
           }
         : undefined,
@@ -743,7 +763,7 @@ function read(document: Node, dialect: '3.0' | '3.1'): DuxtOpenApiSpec {
         ? {
             name: str(info.license.name) ?? '',
             identifier: str(info.license.identifier),
-            url: str(info.license.url)
+            url: link(info.license.url)
           }
         : undefined
     },

package/build/sections/section-input.ts

@@ -12,8 +12,14 @@
  * documents: a resolver that understood a Bruno collection would have to
  * understand the next type's tree as well.
  */
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
-import { join, relative, sep } from 'node:path';
+import {
+  existsSync,
+  readFileSync,
+  readdirSync,
+  realpathSync,
+  statSync
+} from 'node:fs';
+import { isAbsolute, join, relative, sep } from 'node:path';
 import type { DuxtSectionInput, DuxtSectionType } from './sections-resolve';
 
 /**
@@ -36,18 +42,50 @@ export function sectionInputKind(type: DuxtSectionType): 'file' | 'directory' {
  * A directory where a file was declared is as missing as nothing at all — the
  * type would read it and find nothing — and saying so here is what lets
  * `missingSectionArtefact` keep one message for both.
+ *
+ * `checkout`, for a REMOTE repository, is the directory the artefact must stay
+ * inside once every symlink is resolved. The walk below already refuses a
+ * symlinked CHILD, but the declared path itself is joined as a string: a
+ * repository that commits `CHANGELOG.md` as a link to `/proc/self/environ`
+ * would otherwise have the build read that file and publish it as its release
+ * history. A repository controls the bytes of its own checkout, not the
+ * machine that downloads it, so an artefact that resolves outside it fails the
+ * build rather than reading as missing — a missing file and a link out are
+ * different things to fix. Omitted for a local section, whose path the
+ * operator wrote and may legitimately point past the repository.
  */
 export function sectionArtefactExists(
   absolute: string,
-  kind: 'file' | 'directory'
+  kind: 'file' | 'directory',
+  checkout?: string
 ): boolean {
   if (!existsSync(absolute)) return false;
 
+  if (checkout) assertInsideCheckout(absolute, checkout);
+
   const stats = statSync(absolute);
 
   return kind === 'directory' ? stats.isDirectory() : stats.isFile();
 }
 
+/** Whether `absolute`, symlinks resolved, lies inside `checkout`. */
+export function resolvesInside(absolute: string, checkout: string): boolean {
+  const rel = relative(realpathSync(checkout), realpathSync(absolute));
+
+  return !(rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel));
+}
+
+/** Throws when `absolute`, symlinks resolved, lies outside `checkout`. */
+function assertInsideCheckout(absolute: string, checkout: string): void {
+  if (!resolvesInside(absolute, checkout)) {
+    throw new Error(
+      `duxt: "${absolute}" resolves outside its checkout (${checkout}). ` +
+        'A generated section reads only files inside the repository it is ' +
+        'declared on; replace the symlink with the file itself.'
+    );
+  }
+}
+
 /**
  * The artefact at `absolute`, as the type reads it.
  *

package/build/sections/sections.ts

@@ -152,7 +152,7 @@ function remoteCollection(entry: DuxtResolvedSource, type: DuxtSectionType) {
 
     // The artefact is read from the download; the HISTORY, where the download
     // is this repository, from the checkout that has all of it.
-    pages = sectionArtefactExists(file, kind)
+    pages = sectionArtefactExists(file, kind, source.cwd)
       ? sectionPages(
           entry,
           type,

package/build/sources/sources-cache.ts

@@ -251,17 +251,15 @@ export function duxtSourcesCacheKey(
     };
   }
 
-  for (const source of sources) {
-    for (const repo of [
-      source.repo,
-      ...(source.locales ?? []).map((locale) =>
-        typeof locale === 'string' ? undefined : locale.repo
-      )
-    ]) {
-      const reason = repo ? privateRemoteReason(repo) : undefined;
-      if (reason)
-        return { cacheable: false, reason, key: '', entries, ...where };
-    }
+  // Over the SAME expansion the entries came from, so every repository that is
+  // downloaded is one that was checked. Walking `source.repo` and
+  // `source.locales` by hand missed a private repository named by a locale
+  // override inside `refs[]` — downloaded, cached, and never looked at.
+  for (const { effective } of expandSources(sources, options)) {
+    const reason = effective.repo
+      ? privateRemoteReason(effective.repo)
+      : undefined;
+    if (reason) return { cacheable: false, reason, key: '', entries, ...where };
   }
 
   // A SPACE AND A NEWLINE are enough to separate the fields unambiguously: git

package/build/sources/sources.ts

@@ -13,6 +13,7 @@ import { resolveLatestRefs } from './sources-git';
 // Re-exported under the name it has always had here: it moved out so a Nuxt
 // module could reach it without this file's imports coming with it.
 import { repositoryRoot } from './repository-root';
+import { resolvesInside } from '../sections/section-input';
 export { repositoryRoot };
 export type {
   DuxtResolvedSource,
@@ -285,7 +286,7 @@ export function duxtSources(
         (other) => `${other.effective.path.slice(effective.path.length + 1)}/**`
       );
 
-    collections[entry.collection] = defineCollection({
+    const collection = defineCollection({
       type: 'page',
       schema: pageSchema,
       source: effective.repo
@@ -311,6 +312,10 @@ export function duxtSources(
             prefix: entry.prefix
           }
     });
+
+    containedKeys(collection);
+
+    collections[entry.collection] = collection;
   });
 
   // One partials collection per LANGUAGE, named the way the page collections
@@ -322,6 +327,40 @@ export function duxtSources(
   return collections;
 }
 
+/**
+ * Keep a downloaded repository's keys to files that are inside its checkout.
+ *
+ * Content globs a repository source with symlinks followed and reads every key
+ * it finds, so a repository that commits `docs/env.md` as a link to
+ * `/proc/self/environ` would have the build read that file and publish it as a
+ * page. A repository controls the bytes of its own checkout, not the machine
+ * that downloads it: a key that resolves outside the checkout is dropped. A
+ * link to another file inside the checkout is still a page. Local sources are
+ * left alone — their paths are the operator's own.
+ *
+ * A key is resolved the way Content's `getItem` resolves it: against the part
+ * of the include before its first `*`.
+ */
+function containedKeys(collection: ReturnType<typeof defineCollection>) {
+  for (const source of collection.source ?? []) {
+    if (!source.repository) continue;
+
+    const keys = source.getKeys!;
+    const base = source.include.includes('*')
+      ? source.include.split('*')[0]!
+      : '';
+
+    source.getKeys = async () =>
+      (await keys()).filter((key) => {
+        try {
+          return resolvesInside(join(source.cwd, base, key), source.cwd);
+        } catch {
+          return false;
+        }
+      });
+  }
+}
+
 /** One folder list per language: where that language's `_partials/` live. */
 function partialFolders(
   resolved: DuxtResolvedSource[],
@@ -392,9 +431,13 @@ function definePartials(
   // `select('rawbody')` in the layer stops compiling. The cost is that partials
   // carry a `sitemap` field too, which is why `/_partials/**` is excluded in
   // `nuxt.config.ts`.
-  return defineCollection({
+  const collection = defineCollection({
     type: 'page',
     source: entries,
     schema: pageSchema
   });
+
+  containedKeys(collection);
+
+  return collection;
 }

package/i18n/locales/de/duxt/openapi.json

@@ -76,7 +76,11 @@
         "json": "JSON",
         "format": "Formatieren",
         "invalidJson": "Noch kein gültiges JSON — die Anfrage wird so gesendet, wie sie dasteht.",
-        "noForm": "Dieser Body lässt sich nicht als Formular darstellen: bitte als JSON bearbeiten."
+        "noForm": "Dieser Body lässt sich nicht als Formular darstellen: bitte als JSON bearbeiten.",
+        "cancel": "Abbrechen",
+        "cancelled": "Anfrage abgebrochen.",
+        "timeout": "Zeitüberschreitung nach 30 Sekunden.",
+        "truncated": "Antwortvorschau auf 1 MiB begrenzt."
       },
       "version": "API-Version",
       "operations": "Operationen",

package/i18n/locales/en/duxt/openapi.json

@@ -76,7 +76,11 @@
         "json": "JSON",
         "format": "Format",
         "invalidJson": "Not valid JSON yet — the request will be sent as written.",
-        "noForm": "This body cannot be drawn as a form: edit it as JSON."
+        "noForm": "This body cannot be drawn as a form: edit it as JSON.",
+        "cancel": "Cancel",
+        "cancelled": "Request cancelled.",
+        "timeout": "The request timed out after 30 seconds.",
+        "truncated": "Response preview limited to 1 MiB."
       },
       "version": "API version",
       "operations": "Operations",

package/i18n/locales/es/duxt/openapi.json

@@ -76,7 +76,11 @@
         "json": "JSON",
         "format": "Formatear",
         "invalidJson": "Todavía no es JSON válido: la petición se enviará tal cual.",
-        "noForm": "Este cuerpo no puede mostrarse como formulario: edítalo como JSON."
+        "noForm": "Este cuerpo no puede mostrarse como formulario: edítalo como JSON.",
+        "cancel": "Cancelar",
+        "cancelled": "Solicitud cancelada.",
+        "timeout": "La solicitud superó los 30 segundos.",
+        "truncated": "Vista previa limitada a 1 MiB."
       },
       "version": "Versión de la API",
       "operations": "Operaciones",

package/i18n/locales/fr/duxt/openapi.json

@@ -76,7 +76,11 @@
         "json": "JSON",
         "format": "Formater",
         "invalidJson": "Ce n'est pas encore du JSON valide — la requête sera envoyée telle quelle.",
-        "noForm": "Ce corps ne peut pas être présenté sous forme de formulaire : modifiez-le en JSON."
+        "noForm": "Ce corps ne peut pas être présenté sous forme de formulaire : modifiez-le en JSON.",
+        "cancel": "Annuler",
+        "cancelled": "Requête annulée.",
+        "timeout": "La requête a dépassé 30 secondes.",
+        "truncated": "Aperçu de la réponse limité à 1 Mio."
       },
       "version": "Version de l’API",
       "operations": "Opérations",

package/i18n/locales/pt/duxt/openapi.json

@@ -76,7 +76,11 @@
         "json": "JSON",
         "format": "Formatar",
         "invalidJson": "Ainda não é JSON válido — o pedido será enviado tal como está.",
-        "noForm": "Este corpo não pode ser apresentado como formulário: edite-o como JSON."
+        "noForm": "Este corpo não pode ser apresentado como formulário: edite-o como JSON.",
+        "cancel": "Cancelar",
+        "cancelled": "Pedido cancelado.",
+        "timeout": "O pedido excedeu 30 segundos.",
+        "truncated": "Pré-visualização limitada a 1 MiB."
       },
       "version": "Versão da API",
       "operations": "Operações",

package/modules/redirects.ts

@@ -130,7 +130,7 @@ export function redirectRules(
 
   for (const page of pages) {
     for (const from of page.redirectFrom) {
-      if (!from.startsWith('/')) continue;
+      if (!isLiteralPath(from)) continue;
 
       const source = isInsidePrefix(from, page.prefix)
         ? from
@@ -151,5 +151,31 @@ export function redirectRules(
   return rules;
 }
 
+/**
+ * A former URL written out in full: one path, not a pattern.
+ *
+ * Route rules are matched by pattern, so `/**` or `/:slug` in a page's
+ * frontmatter would be a rule over every URL it matches — the whole site, the
+ * MCP endpoint and `llms.txt` included — written by whoever may edit a page.
+ * A page owns the URLs it used to live at, so only a literal path is one: no
+ * wildcard or parameter segment, no `.`/`..` segment, no empty segment, no
+ * backslash.
+ */
+export function isLiteralPath(path: string): boolean {
+  if (!path.startsWith('/') || path.includes('\\')) return false;
+
+  return path
+    .slice(1)
+    .split('/')
+    .every(
+      (segment, index, all) =>
+        (segment !== '' || index === all.length - 1) &&
+        segment !== '.' &&
+        segment !== '..' &&
+        !segment.includes('*') &&
+        !segment.startsWith(':')
+    );
+}
+
 const isInsidePrefix = (path: string, prefix: string) =>
   Boolean(prefix) && (path === prefix || path.startsWith(`${prefix}/`));