@nifrajs/cli 3.3.0 → 3.5.0

package/src/scaffold.ts

@@ -45,11 +45,35 @@ function segmentToFile(seg: string): string {
   return seg
 }
 
+/** Reject syntax that could be interpreted by the host filesystem rather than the route mapper. */
+function assertSafeRouteSegment(segment: string, urlPath: string): void {
+  if (segment === "." || segment === ".." || segment.includes("\0") || segment.includes("\\")) {
+    throw new Error(
+      `invalid route segment in ${JSON.stringify(urlPath)}: ${JSON.stringify(segment)}`,
+    )
+  }
+  const fileSegment = segmentToFile(segment)
+  if (
+    fileSegment === "." ||
+    fileSegment === ".." ||
+    fileSegment.includes("\0") ||
+    fileSegment.includes("/") ||
+    fileSegment.includes("\\") ||
+    fileSegment.includes(":") ||
+    /^[A-Za-z]:/.test(fileSegment)
+  ) {
+    throw new Error(
+      `invalid route segment in ${JSON.stringify(urlPath)}: ${JSON.stringify(segment)}`,
+    )
+  }
+}
+
 /** Map a URL path to its `routes/` file path (relative to `routes/`, without extension prefix dir).
  * `/` → `index`; `/users/:id` → `users/[id]`; `/blog/*slug` → `blog/[...slug]`. */
 export function routePathToFile(urlPath: string, ext: string): string {
   const segments = urlPath.split("/").filter((s) => s.length > 0)
   if (segments.length === 0) return `routes/index.${ext}`
+  for (const segment of segments) assertSafeRouteSegment(segment, urlPath)
   const last = segments.length - 1
   // Catch-all must be the final segment (mirrors @nifrajs/web); flag it rather than emit an invalid file.
   for (let i = 0; i < last; i++) {
@@ -268,11 +292,12 @@ export function scaffoldRoute(
   }
 }
 
-function resolveInsideCwd(cwd: string, relativeFile: string): string {
+function resolveInsideRoutes(cwd: string, relativeFile: string): string {
   const root = resolve(cwd)
+  const routesRoot = resolve(root, "routes")
   const target = resolve(root, relativeFile)
-  if (target !== root && !target.startsWith(`${root}${sep}`)) {
-    throw new Error(`refusing to write outside project root: ${relativeFile}`)
+  if (target === routesRoot || !target.startsWith(`${routesRoot}${sep}`)) {
+    throw new Error(`refusing to write outside routes directory: ${relativeFile}`)
   }
   return target
 }
@@ -325,7 +350,7 @@ export async function writeScaffoldRoute(
       reason: "no verified ready-to-write stub for this framework; use nifra_example for the body",
     }
   }
-  const target = resolveInsideCwd(cwd, result.file)
+  const target = resolveInsideRoutes(cwd, result.file)
   await assertNoSymlinkedAncestors(cwd, target)
   await mkdir(dirname(target), { recursive: true })
   await assertNoSymlinkedAncestors(cwd, target)

package/src/verification-plan.ts

@@ -102,6 +102,18 @@ const GATES = Object.freeze([
     "Run `bun run check:core-performance` and investigate the measured performance regression.",
     { workflowRequired: false },
   ),
+  gate(
+    "middleware-performance",
+    [["run", "check:middleware-overhead"]],
+    "Run `bun run check:middleware-overhead` and investigate the middleware-chain regression.",
+    { workflowRequired: false },
+  ),
+  gate(
+    "edge-startup",
+    [["run", "check:edge-startup"]],
+    "Run `bun run check:edge-startup` and investigate edge/Workers import-time growth.",
+    { workflowRequired: false },
+  ),
   gate(
     "publish",
     [["run", "check:publish"]],
@@ -187,6 +199,8 @@ const RELEASE_PLAN = Object.freeze([
   "plugin-manifest",
   "size",
   "core-performance",
+  "middleware-performance",
+  "edge-startup",
   "publish",
   "consumer",
   "cold-start",

package/src/work-graph.ts

@@ -9,7 +9,12 @@
 import { existsSync } from "node:fs"
 import { readFile, stat } from "node:fs/promises"
 import { basename, resolve } from "node:path"
-import { type ReflectedRoute, reflectRoutes } from "@nifrajs/core/reflection"
+import {
+  type ProjectEvidenceSnapshot,
+  reflectedRoutesFromEvidence,
+  snapshotProjectEvidence,
+} from "@nifrajs/core/evidence"
+import type { ReflectedRoute } from "@nifrajs/core/reflection"
 import { Glob } from "bun"
 import { digestRoute } from "./contracts.ts"
 
@@ -52,6 +57,8 @@ export interface WorkGraphSourceFile {
 
 export interface WorkGraphBuildInput {
   readonly source: unknown
+  /** Reuse a canonical route-evidence pass when the caller already has one. */
+  readonly evidence?: ProjectEvidenceSnapshot
   readonly files?: readonly WorkGraphSourceFile[]
   readonly freshness?: BuildFreshness
 }
@@ -224,7 +231,8 @@ export async function buildProjectWorkGraph(
 ): Promise<ProjectWorkGraphResult> {
   const freshness = input.freshness ?? { ok: true }
   if (!freshness.ok) throw new StaleBuildError(freshness)
-  const graph = await buildWorkGraph(input)
+  const projectEvidence = input.evidence ?? snapshotProjectEvidence(input.source)
+  const graph = await buildWorkGraph({ ...input, evidence: projectEvidence })
   const impact = queryImpact(graph, options.changedFiles ?? [])
   const plan = planProofs(graph, impact, options.minLevel ?? 1)
   const evidence = createEvidenceBundle(graph, impact, plan)
@@ -232,7 +240,9 @@ export async function buildProjectWorkGraph(
 }
 
 export async function buildWorkGraph(input: WorkGraphBuildInput): Promise<WorkGraph> {
-  const routes = reflectRoutes(input.source)
+  const routes = reflectedRoutesFromEvidence(
+    input.evidence ?? snapshotProjectEvidence(input.source),
+  )
   const files = input.files ?? []
   const nodes = new Map<string, WorkGraphNode>()
   const edges: WorkGraphEdge[] = []