@pracht/cli 1.2.0 → 1.2.2

package/CHANGELOG.md

@@ -1,5 +1,90 @@
 # @pracht/cli
 
+## 1.2.2
+
+### Patch Changes
+
+- [#124](https://github.com/JoviDeCroock/pracht/pull/124) [`8f662c0`](https://github.com/JoviDeCroock/pracht/commit/8f662c0b78b1911a7534ffd7aa4e919cf22a3a42) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - Internal refactor: split several large modules into smaller, focused files to improve maintainability. Public APIs are unchanged.
+
+- [#132](https://github.com/JoviDeCroock/pracht/pull/132) [`30d867f`](https://github.com/JoviDeCroock/pracht/commit/30d867f4a4cd41107a1ed60c607afe0d51848c3b) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - Follow-up security hardening after the main audit fixes.
+
+  - `@pracht/adapter-node` now supports `canonicalOrigin` so apps can pin
+    `request.url` to a known public origin instead of depending on untrusted
+    `Host` values. The adapter also treats both `x-pracht-route-state-request`
+    and `?_data=1` as route-state transports before any static/ISG HTML serving,
+    and ISG regeneration now uses a clean HTML request instead of replaying the
+    triggering user's cookies or authorization headers.
+  - `@pracht/adapter-cloudflare` now bypasses static asset serving for both
+    route-state transports (`x-pracht-route-state-request` and `?_data=1`).
+  - `@pracht/cli` now emits a Vercel Build Output rule that sends `?_data=1`
+    requests to the render function before static rewrites can serve prerendered
+    HTML.
+
+- [#131](https://github.com/JoviDeCroock/pracht/pull/131) [`015e987`](https://github.com/JoviDeCroock/pracht/commit/015e987a2de471980fab557e3dbf3d52937ad0ac) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - Security hardening across request handling, redirects, and build output.
+
+  **Framework (`@pracht/core`)**
+
+  - **Middleware/loader redirects are now validated.** `javascript:`, `data:`,
+    `vbscript:`, `blob:`, and `file:` targets are refused server-side (they
+    were already refused on the client) and CR/LF in the `Location` value
+    throws instead of producing a split response. Non-safe-method redirects
+    now default to **303 See Other** rather than 302 so browsers don't
+    resend the POST body to the redirect target. `MiddlewareResult`'s
+    `redirect` form now accepts an optional `status` override.
+  - **CSRF protection for mutating API routes.** Non-GET API requests are
+    rejected with 403 unless the browser signals a same-origin/same-site
+    fetch (`Sec-Fetch-Site`) or the `Origin` header matches the request
+    URL's origin. Opt out per-app via `defineApp({ api: { requireSameOrigin: false } })`.
+  - **`_data=1` route-state bypass is now gated.** The query-param form of
+    the route-state endpoint now requires `Sec-Fetch-Site: same-origin`/
+    `same-site` (or a matching `Origin`). The explicit
+    `x-pracht-route-state-request` header is still accepted unconditionally
+    (CORS-protected).
+  - **Catch-all path traversal at build time is closed.**
+    `buildPathFromSegments` now percent-encodes catch-all components
+    individually and explicitly neutralises `.` / `..` segments, so a
+    `getStaticPaths` returning `{ "*": "../../etc/passwd" }` can no longer
+    escape `dist/client/` at SSG/ISG write time.
+  - **`headers()` values are validated for CR/LF.** `applyHeaders` now
+    throws a consistent framework error on response-splitting attempts,
+    regardless of adapter-specific Headers implementation behaviour.
+  - **`debugErrors` is ignored in production.** When `NODE_ENV=production`,
+    `debugErrors: true` is refused (with a one-shot console warning) so a
+    misconfigured deploy cannot leak stack traces and module paths.
+
+  **Adapter (`@pracht/adapter-node`)**
+
+  - **Symlinks are no longer followed by the static server.** `resolveStaticFile`
+    now uses `lstat` and rejects files whose inode is a symlink, preventing
+    a malicious build artifact from exposing files outside `dist/client/`.
+  - **ISG cache is path-contained.** The on-disk write path is now
+    `resolve()`-checked against the static root, rejecting any URL path
+    that would escape via `..`, encoded separators, or NUL bytes.
+  - **ISG skips the on-disk cache when the response is user-specific.**
+    Responses that set `Cache-Control: no-store`/`private`, `Set-Cookie`,
+    or a `Vary` covering `cookie`/`authorization`/`*` are served through
+    but not written to disk, closing a per-user cache-poisoning window.
+
+  **Packaging**
+
+  - `@pracht/cli` now has an explicit `files` allowlist so future
+    workdir additions can't accidentally ship in the npm tarball.
+  - `create-pracht`'s bin entry is now executable in the repository.
+
+- Updated dependencies [[`caae3cb`](https://github.com/JoviDeCroock/pracht/commit/caae3cb53e0b6136ef78c3ac189a0d0ab82e4df7), [`8f662c0`](https://github.com/JoviDeCroock/pracht/commit/8f662c0b78b1911a7534ffd7aa4e919cf22a3a42), [`901ef5b`](https://github.com/JoviDeCroock/pracht/commit/901ef5b7958e4066d5382f836d098bded8bfe320), [`015e987`](https://github.com/JoviDeCroock/pracht/commit/015e987a2de471980fab557e3dbf3d52937ad0ac)]:
+  - @pracht/core@0.3.0
+
+## 1.2.1
+
+### Patch Changes
+
+- [#116](https://github.com/JoviDeCroock/pracht/pull/116) [`411da18`](https://github.com/JoviDeCroock/pracht/commit/411da18d0fa8bbc20270729584c6677376be7f24) Thanks [@kinngh](https://github.com/kinngh)! - Strip server-only route and shell exports from client module imports so inline loaders can statically import server-only dependencies without evaluating them in browser bundles.
+
+- [#117](https://github.com/JoviDeCroock/pracht/pull/117) [`39a226d`](https://github.com/JoviDeCroock/pracht/commit/39a226d1023317c357df8b72e020034a2c68d896) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - Copy public/ folder contents to dist/client/ during build so that static assets like favicons and robots.txt are available for deployment platforms
+
+- Updated dependencies [[`f0ed41e`](https://github.com/JoviDeCroock/pracht/commit/f0ed41e4b886e751fbdfd29ae10f880c3aa364d4), [`49732fc`](https://github.com/JoviDeCroock/pracht/commit/49732fc78a776cbaabe9579e5a7f2fb154497479), [`d88c9e4`](https://github.com/JoviDeCroock/pracht/commit/d88c9e4b8347c4d3ecacdbc5f7674ee38af0092e), [`7ee2a93`](https://github.com/JoviDeCroock/pracht/commit/7ee2a936357a0f0b4ff7f5a7f6f3206b070f3890), [`00c4014`](https://github.com/JoviDeCroock/pracht/commit/00c401410b13c2d904c0beafc4da62dfb8f0f91e), [`f0ed41e`](https://github.com/JoviDeCroock/pracht/commit/f0ed41e4b886e751fbdfd29ae10f880c3aa364d4)]:
+  - @pracht/core@0.2.7
+
 ## 1.2.0
 
 ### Minor Changes

package/dist/{build-BzQAQjuy.mjs → build-DkP2ffu9.mjs}

@@ -1,5 +1,5 @@
 import { r as VERSION } from "./index.mjs";
-import { t as readClientBuildAssets } from "./build-metadata-IABPFFKk.mjs";
+import { t as readClientBuildAssets } from "./build-metadata-BOChHO8g.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
@@ -36,6 +36,14 @@ function createVercelOutputConfig({ functionName, headersManifest, staticRoutes,
 			value: "1"
 		}],
 		src: "/(.*)"
+	}, {
+		dest: target,
+		has: [{
+			type: "query",
+			key: "_data",
+			value: "1"
+		}],
+		src: "/(.*)"
 	}];
 	for (const route of sortStaticRoutes(staticRoutes)) routes.push({
 		dest: routeToStaticHtmlPath(route),
@@ -157,6 +165,8 @@ var build_default = defineCommand({
 				});
 			}
 		}
+		const publicDir = resolve(root, "public");
+		if (existsSync(publicDir)) cpSync(publicDir, clientDir, { recursive: true });
 		if (existsSync(serverEntry)) {
 			const serverMod = await import(serverEntry);
 			const { prerenderApp } = serverMod;

package/dist/{build-metadata-IABPFFKk.mjs → build-metadata-BOChHO8g.mjs}

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/build-metadata.ts
 const MANIFEST_PATHS = ["dist/client/.vite/manifest.json", "dist/.vite/manifest.json"];
+const PRACHT_CLIENT_MODULE_QUERY = "pracht-client";
 function readClientBuildAssets(root = process.cwd()) {
 	const manifestPath = MANIFEST_PATHS.map((candidate) => resolve(root, candidate)).find((path) => existsSync(path));
 	if (!manifestPath) return {
@@ -36,8 +37,9 @@ function readClientBuildAssets(root = process.cwd()) {
 	for (const [key, entry] of Object.entries(manifest)) {
 		if (!entry.src) continue;
 		const deps = collectTransitiveDeps(key);
-		if (deps.css.length > 0) cssManifest[key] = deps.css.map((file) => `/${file}`);
-		if (deps.js.length > 0) jsManifest[key] = deps.js.map((file) => `/${file}`);
+		const manifestKey = stripPrachtClientModuleQuery(entry.src);
+		if (deps.css.length > 0) cssManifest[manifestKey] = deps.css.map((file) => `/${file}`);
+		if (deps.js.length > 0) jsManifest[manifestKey] = deps.js.map((file) => `/${file}`);
 	}
 	return {
 		clientEntryUrl: clientEntry ? `/${clientEntry.file}` : null,
@@ -45,5 +47,12 @@ function readClientBuildAssets(root = process.cwd()) {
 		jsManifest
 	};
 }
+function stripPrachtClientModuleQuery(id) {
+	const queryStart = id.indexOf("?");
+	if (queryStart === -1) return id;
+	const path = id.slice(0, queryStart);
+	const query = id.slice(queryStart + 1).split("&").filter((part) => part !== PRACHT_CLIENT_MODULE_QUERY);
+	return query.length > 0 ? `${path}?${query.join("&")}` : path;
+}
 //#endregion
 export { readClientBuildAssets as t };

package/dist/{doctor-BcoqyBk-.mjs → doctor-CwQJjJ83.mjs}

@@ -1,4 +1,4 @@
-import { t as runDoctor } from "./verification-Dfl3X4Zo.mjs";
+import { t as runDoctor } from "./verification-Dwf1ZuNn.mjs";
 import { defineCommand } from "citty";
 //#region src/commands/doctor.ts
 var doctor_default = defineCommand({

package/dist/{generate-BXkePCIx.mjs → generate-C9AMSGsv.mjs}

@@ -1,7 +1,146 @@
-import { a as toManifestModulePath, i as insertArrayItem, n as extractRegistryEntries, o as upsertObjectEntry, t as ensureCoreNamedImport } from "./manifest-DGq1n5LT.mjs";
-import { _ as requireEnum, a as readProjectConfig, c as resolveProjectPath, d as writeGeneratedFile, f as ensureTrailingNewline, g as quote, h as parseCommaList, l as resolveRouteModulePath, m as parseApiMethods, n as displayPath, o as resolveApiModulePath, s as resolvePagesRouteModulePath, t as assertFileExists, u as resolveScopedFile, v as requirePositiveInteger } from "./project-DydjqBoS.mjs";
+import { _ as requireEnum, a as readProjectConfig, c as resolveProjectPath, d as writeGeneratedFile, f as ensureTrailingNewline, g as quote, h as parseCommaList, l as resolveRouteModulePath, m as parseApiMethods, n as displayPath, o as resolveApiModulePath, s as resolvePagesRouteModulePath, t as assertFileExists, u as resolveScopedFile, v as requirePositiveInteger } from "./project-BdMiN3s7.mjs";
+import { a as toManifestModulePath, i as insertArrayItem, n as extractRegistryEntries, o as upsertObjectEntry, t as ensureCoreNamedImport } from "./manifest-Bs5hp3gA.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
+//#region src/commands/generate-paths.ts
+function normalizeRoutePathString(value) {
+	if (!value || value === "/") return "/";
+	const normalized = `/${value}`.replace(/\/+/g, "/");
+	return normalized !== "/" && normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
+}
+function normalizeApiPath(value) {
+	return normalizeRoutePathString(value).replace(/^\/api(?=\/|$)/, "") || "/";
+}
+function hasDynamicSegments(routePath) {
+	return routePath.split("/").some((segment) => segment.startsWith(":") || segment === "*");
+}
+function dynamicParamNames(routePath) {
+	return routePath.split("/").filter(Boolean).map((segment) => {
+		if (segment.startsWith(":")) return segment.slice(1);
+		if (segment === "*") return "slug";
+		return null;
+	}).filter((s) => s !== null);
+}
+function routeIdFromPath(routePath) {
+	if (routePath === "/") return "index";
+	return routePath.split("/").filter(Boolean).map((segment) => segment.replace(/^:/, "").replace(/\*/g, "splat")).join("-");
+}
+function titleFromPath(routePath) {
+	if (routePath === "/") return "Home";
+	return titleCase((routePath.split("/").filter(Boolean).at(-1) ?? "Page").replace(/^:/, "").replace(/\*/g, "slug"));
+}
+function titleCase(value) {
+	return value.split(/[-_/]/).filter(Boolean).map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1)).join(" ");
+}
+//#endregion
+//#region src/commands/generate-source.ts
+function buildManifestRouteModuleSource(opts) {
+	const sections = buildRouteModuleSections(opts);
+	const componentIdx = sections.findIndex((s) => s.startsWith("export function Component"));
+	const insertAt = componentIdx === -1 ? sections.length : componentIdx;
+	sections.splice(insertAt, 0, "export function head() {", `  return { title: ${quote(opts.title)} };`, "}", "");
+	return `${sections.join("\n")}\n`;
+}
+function buildPagesRouteModuleSource(opts) {
+	const sections = buildRouteModuleSections(opts);
+	const firstExportIdx = sections.findIndex((s) => s.startsWith("export"));
+	const insertAt = firstExportIdx === -1 ? sections.length : firstExportIdx;
+	sections.splice(insertAt, 0, `export const RENDER_MODE = ${quote(opts.render)};`, "");
+	return `${sections.join("\n")}\n`;
+}
+function buildShellModuleSource(name) {
+	const title = titleCase(name);
+	return [
+		"import type { ShellProps } from \"@pracht/core\";",
+		"",
+		"export function Shell({ children }: ShellProps) {",
+		"  return (",
+		`    <div class=${quote(`${name}-shell`)}>`,
+		"      <main>{children}</main>",
+		"    </div>",
+		"  );",
+		"}",
+		"",
+		"export function head() {",
+		`  return { title: ${quote(title)} };`,
+		"}",
+		""
+	].join("\n");
+}
+function buildMiddlewareModuleSource() {
+	return [
+		"import type { MiddlewareFn } from \"@pracht/core\";",
+		"",
+		"export const middleware: MiddlewareFn = async (_args) => {",
+		"  return;",
+		"};",
+		""
+	].join("\n");
+}
+function buildApiRouteSource({ endpointPath, methods }) {
+	return [
+		"import type { BaseRouteArgs } from \"@pracht/core\";",
+		"",
+		...methods.flatMap((method, index) => {
+			const lines = buildApiMethodSource(method, methods, endpointPath);
+			if (index === methods.length - 1) return lines;
+			return [...lines, ""];
+		}),
+		""
+	].join("\n");
+}
+function buildRouteModuleSections(opts) {
+	const { includeErrorBoundary, includeLoader, includeStaticPaths, routePath, title } = opts;
+	const params = dynamicParamNames(routePath);
+	const imports = [];
+	const sections = [];
+	if (includeLoader) imports.push("LoaderArgs", "RouteComponentProps");
+	if (includeErrorBoundary) imports.push("ErrorBoundaryProps");
+	if (imports.length > 0) {
+		sections.push(`import type { ${imports.join(", ")} } from "@pracht/core";`);
+		sections.push("");
+	}
+	if (includeLoader) sections.push("export async function loader(_args: LoaderArgs) {", `  return { message: ${quote(`Welcome to ${title}.`)} };`, "}", "");
+	if (includeStaticPaths) sections.push("export function getStaticPaths() {", `  return [${buildStaticPathsStub(params)}];`, "}", "");
+	if (includeLoader) sections.push("export function Component({ data }: RouteComponentProps<typeof loader>) {", "  return (", "    <section>", `      <h1>${escapeJsxText(title)}</h1>`, "      <p>{data.message}</p>", "    </section>", "  );", "}");
+	else sections.push("export function Component() {", "  return (", "    <section>", `      <h1>${escapeJsxText(title)}</h1>`, "    </section>", "  );", "}");
+	if (includeErrorBoundary) sections.push("", "export function ErrorBoundary({ error }: ErrorBoundaryProps) {", "  return <p>{error.message}</p>;", "}");
+	return sections;
+}
+function buildApiMethodSource(method, methods, endpointPath) {
+	if (method === "DELETE" || method === "HEAD") return [
+		`export function ${method}(_args: BaseRouteArgs) {`,
+		"  return new Response(null, { status: 204 });",
+		"}"
+	];
+	if (method === "OPTIONS") return [
+		`export function ${method}(_args: BaseRouteArgs) {`,
+		"  return new Response(null, {",
+		`    headers: { allow: ${quote(methods.join(", "))} },`,
+		"    status: 204,",
+		"  });",
+		"}"
+	];
+	if (method === "GET") return [
+		`export function ${method}(_args: BaseRouteArgs) {`,
+		`  return Response.json({ endpoint: ${quote(`/api${endpointPath}`)}, ok: true });`,
+		"}"
+	];
+	const status = method === "POST" ? 201 : 200;
+	return [
+		`export async function ${method}({ request }: BaseRouteArgs) {`,
+		"  const body = await request.json();",
+		`  return Response.json({ body, ok: true }, { status: ${status} });`,
+		"}"
+	];
+}
+function buildStaticPathsStub(params) {
+	if (params.length === 0) return "{}";
+	return `{ ${params.map((name) => `${name}: ${quote(`example-${name}`)}`).join(", ")} }`;
+}
+function escapeJsxText(value) {
+	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
 var generate_default = defineCommand({
 	meta: {
 		name: "generate",
@@ -260,145 +399,5 @@ function generateApi(args, project) {
 		updated: []
 	};
 }
-function buildManifestRouteModuleSource({ includeErrorBoundary, includeLoader, includeStaticPaths, routePath, title }) {
-	const params = dynamicParamNames(routePath);
-	const imports = [];
-	const sections = [];
-	if (includeLoader) imports.push("LoaderArgs", "RouteComponentProps");
-	if (includeErrorBoundary) imports.push("ErrorBoundaryProps");
-	if (imports.length > 0) {
-		sections.push(`import type { ${imports.join(", ")} } from "@pracht/core";`);
-		sections.push("");
-	}
-	if (includeLoader) sections.push("export async function loader(_args: LoaderArgs) {", `  return { message: ${quote(`Welcome to ${title}.`)} };`, "}", "");
-	if (includeStaticPaths) sections.push("export function getStaticPaths() {", `  return [${buildStaticPathsStub(params)}];`, "}", "");
-	sections.push("export function head() {", `  return { title: ${quote(title)} };`, "}", "");
-	if (includeLoader) sections.push("export function Component({ data }: RouteComponentProps<typeof loader>) {", "  return (", "    <section>", `      <h1>${escapeJsxText(title)}</h1>`, "      <p>{data.message}</p>", "    </section>", "  );", "}");
-	else sections.push("export function Component() {", "  return (", "    <section>", `      <h1>${escapeJsxText(title)}</h1>`, "    </section>", "  );", "}");
-	if (includeErrorBoundary) sections.push("", "export function ErrorBoundary({ error }: ErrorBoundaryProps) {", "  return <p>{error.message}</p>;", "}");
-	return `${sections.join("\n")}\n`;
-}
-function buildPagesRouteModuleSource({ includeErrorBoundary, includeLoader, includeStaticPaths, render, routePath, title }) {
-	const params = dynamicParamNames(routePath);
-	const imports = [];
-	const sections = [];
-	if (includeLoader) imports.push("LoaderArgs", "RouteComponentProps");
-	if (includeErrorBoundary) imports.push("ErrorBoundaryProps");
-	if (imports.length > 0) {
-		sections.push(`import type { ${imports.join(", ")} } from "@pracht/core";`);
-		sections.push("");
-	}
-	sections.push(`export const RENDER_MODE = ${quote(render)};`, "");
-	if (includeLoader) sections.push("export async function loader(_args: LoaderArgs) {", `  return { message: ${quote(`Welcome to ${title}.`)} };`, "}", "");
-	if (includeStaticPaths) sections.push("export function getStaticPaths() {", `  return [${buildStaticPathsStub(params)}];`, "}", "");
-	if (includeLoader) sections.push("export function Component({ data }: RouteComponentProps<typeof loader>) {", "  return (", "    <section>", `      <h1>${escapeJsxText(title)}</h1>`, "      <p>{data.message}</p>", "    </section>", "  );", "}");
-	else sections.push("export function Component() {", "  return (", "    <section>", `      <h1>${escapeJsxText(title)}</h1>`, "    </section>", "  );", "}");
-	if (includeErrorBoundary) sections.push("", "export function ErrorBoundary({ error }: ErrorBoundaryProps) {", "  return <p>{error.message}</p>;", "}");
-	return `${sections.join("\n")}\n`;
-}
-function buildShellModuleSource(name) {
-	const title = titleCase(name);
-	return [
-		"import type { ShellProps } from \"@pracht/core\";",
-		"",
-		"export function Shell({ children }: ShellProps) {",
-		"  return (",
-		`    <div class=${quote(`${name}-shell`)}>`,
-		"      <main>{children}</main>",
-		"    </div>",
-		"  );",
-		"}",
-		"",
-		"export function head() {",
-		`  return { title: ${quote(title)} };`,
-		"}",
-		""
-	].join("\n");
-}
-function buildMiddlewareModuleSource() {
-	return [
-		"import type { MiddlewareFn } from \"@pracht/core\";",
-		"",
-		"export const middleware: MiddlewareFn = async (_args) => {",
-		"  return;",
-		"};",
-		""
-	].join("\n");
-}
-function buildApiRouteSource({ endpointPath, methods }) {
-	return [
-		"import type { BaseRouteArgs } from \"@pracht/core\";",
-		"",
-		...methods.flatMap((method, index) => {
-			const lines = buildApiMethodSource(method, methods, endpointPath);
-			if (index === methods.length - 1) return lines;
-			return [...lines, ""];
-		}),
-		""
-	].join("\n");
-}
-function buildApiMethodSource(method, methods, endpointPath) {
-	if (method === "DELETE" || method === "HEAD") return [
-		`export function ${method}(_args: BaseRouteArgs) {`,
-		"  return new Response(null, { status: 204 });",
-		"}"
-	];
-	if (method === "OPTIONS") return [
-		`export function ${method}(_args: BaseRouteArgs) {`,
-		"  return new Response(null, {",
-		`    headers: { allow: ${quote(methods.join(", "))} },`,
-		"    status: 204,",
-		"  });",
-		"}"
-	];
-	if (method === "GET") return [
-		`export function ${method}(_args: BaseRouteArgs) {`,
-		`  return Response.json({ endpoint: ${quote(`/api${endpointPath}`)}, ok: true });`,
-		"}"
-	];
-	const status = method === "POST" ? 201 : 200;
-	return [
-		`export async function ${method}({ request }: BaseRouteArgs) {`,
-		"  const body = await request.json();",
-		`  return Response.json({ body, ok: true }, { status: ${status} });`,
-		"}"
-	];
-}
-function normalizeRoutePathString(value) {
-	if (!value || value === "/") return "/";
-	const normalized = `/${value}`.replace(/\/+/g, "/");
-	return normalized !== "/" && normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
-}
-function normalizeApiPath(value) {
-	return normalizeRoutePathString(value).replace(/^\/api(?=\/|$)/, "") || "/";
-}
-function hasDynamicSegments(routePath) {
-	return routePath.split("/").some((segment) => segment.startsWith(":") || segment === "*");
-}
-function dynamicParamNames(routePath) {
-	return routePath.split("/").filter(Boolean).map((segment) => {
-		if (segment.startsWith(":")) return segment.slice(1);
-		if (segment === "*") return "slug";
-		return null;
-	}).filter((s) => s !== null);
-}
-function routeIdFromPath(routePath) {
-	if (routePath === "/") return "index";
-	return routePath.split("/").filter(Boolean).map((segment) => segment.replace(/^:/, "").replace(/\*/g, "splat")).join("-");
-}
-function titleFromPath(routePath) {
-	if (routePath === "/") return "Home";
-	return titleCase((routePath.split("/").filter(Boolean).at(-1) ?? "Page").replace(/^:/, "").replace(/\*/g, "slug"));
-}
-function titleCase(value) {
-	return value.split(/[-_/]/).filter(Boolean).map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1)).join(" ");
-}
-function buildStaticPathsStub(params) {
-	if (params.length === 0) return "{}";
-	return `{ ${params.map((name) => `${name}: ${quote(`example-${name}`)}`).join(", ")} }`;
-}
-function escapeJsxText(value) {
-	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-}
 //#endregion
 export { generate_default as default };

package/dist/index.mjs

@@ -29,12 +29,12 @@ runMain(defineCommand({
 		description: "The pracht CLI"
 	},
 	subCommands: {
-		build: () => import("./build-BzQAQjuy.mjs").then((m) => m.default),
+		build: () => import("./build-DkP2ffu9.mjs").then((m) => m.default),
 		dev: () => import("./dev-BCFe3g38.mjs").then((m) => m.default),
-		doctor: () => import("./doctor-BcoqyBk-.mjs").then((m) => m.default),
-		generate: () => import("./generate-BXkePCIx.mjs").then((m) => m.default),
-		inspect: () => import("./inspect-DIjjCfs3.mjs").then((m) => m.default),
-		verify: () => import("./verify-CObGxWtW.mjs").then((m) => m.default)
+		doctor: () => import("./doctor-CwQJjJ83.mjs").then((m) => m.default),
+		generate: () => import("./generate-C9AMSGsv.mjs").then((m) => m.default),
+		inspect: () => import("./inspect-MseHPU9s.mjs").then((m) => m.default),
+		verify: () => import("./verify-o0G5Xuff.mjs").then((m) => m.default)
 	}
 }));
 //#endregion

package/dist/{inspect-DIjjCfs3.mjs → inspect-MseHPU9s.mjs}

@@ -1,8 +1,8 @@
 import { t as HTTP_METHODS } from "./index.mjs";
-import { t as readClientBuildAssets } from "./build-metadata-IABPFFKk.mjs";
-import { a as readProjectConfig, c as resolveProjectPath, p as handleCliError } from "./project-DydjqBoS.mjs";
+import { t as readClientBuildAssets } from "./build-metadata-BOChHO8g.mjs";
+import { a as readProjectConfig, c as resolveProjectPath, p as handleCliError } from "./project-BdMiN3s7.mjs";
 import { defineCommand } from "citty";
-import { readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { createServer } from "vite";
 //#region src/commands/inspect.ts
@@ -45,12 +45,7 @@ async function runInspect(root, { target = "all" } = {}) {
 	if (!project.configFile) throw new Error("Missing vite config. `pracht inspect` requires a project with pracht configured.");
 	if (!project.hasPrachtPlugin) throw new Error("vite.config does not appear to register the pracht plugin.");
 	if (project.mode === "manifest") {
-		const manifestPath = resolveProjectPath(project.root, project.appFile);
-		try {
-			readFileSync(manifestPath, "utf-8");
-		} catch {
-			throw new Error(`App manifest is missing at ${project.appFile}.`);
-		}
+		if (!existsSync(resolveProjectPath(project.root, project.appFile))) throw new Error(`App manifest is missing at ${project.appFile}.`);
 	}
 	const server = await createServer({
 		root,

package/dist/{project-DydjqBoS.mjs → project-BdMiN3s7.mjs}

@@ -67,7 +67,7 @@ function resolveScopedFile(root, configDir, fileName) {
 	return resolve(resolveProjectPath(root, configDir), fileName);
 }
 function resolveRouteModulePath(project, routePath, extension) {
-	const segments = segmentsFromRoutePath(routePath);
+	const segments = segmentsFromPath(routePath);
 	const relativePath = segments.length === 0 ? `index${extension}` : `${segments.join("/")}${extension}`;
 	return {
 		absolutePath: resolve(resolveProjectPath(project.root, project.routesDir), relativePath),
@@ -75,7 +75,7 @@ function resolveRouteModulePath(project, routePath, extension) {
 	};
 }
 function resolvePagesRouteModulePath(project, routePath, extension) {
-	const segments = segmentsFromRoutePath(routePath);
+	const segments = segmentsFromPath(routePath);
 	const relativePath = segments.length === 0 ? `index${extension}` : `${segments.join("/")}${extension}`;
 	return {
 		absolutePath: resolve(resolveProjectPath(project.root, project.pagesDir), relativePath),
@@ -83,7 +83,7 @@ function resolvePagesRouteModulePath(project, routePath, extension) {
 	};
 }
 function resolveApiModulePath(project, endpointPath) {
-	const segments = segmentsFromApiPath(endpointPath);
+	const segments = segmentsFromPath(endpointPath);
 	const relativePath = segments.length === 0 ? "index.ts" : `${segments.join("/")}.ts`;
 	return {
 		absolutePath: resolve(resolveProjectPath(project.root, project.apiDir), relativePath),
@@ -137,15 +137,8 @@ function normalizeConfigPath(value) {
 	if (!value) return value;
 	return value.startsWith("/") ? value : `/${value}`;
 }
-function segmentsFromRoutePath(routePath) {
-	return routePath.split("/").filter(Boolean).map((segment) => {
-		if (segment.startsWith(":")) return `[${segment.slice(1)}]`;
-		if (segment === "*") return "[...slug]";
-		return segment;
-	});
-}
-function segmentsFromApiPath(endpointPath) {
-	return endpointPath.split("/").filter(Boolean).map((segment) => {
+function segmentsFromPath(path) {
+	return path.split("/").filter(Boolean).map((segment) => {
 		if (segment.startsWith(":")) return `[${segment.slice(1)}]`;
 		if (segment === "*") return "[...slug]";
 		return segment;