@pracht/cli 1.2.1 → 1.3.0

package/CHANGELOG.md

@@ -1,5 +1,90 @@
 # @pracht/cli
 
+## 1.3.0
+
+### Minor Changes
+
+- [#133](https://github.com/JoviDeCroock/pracht/pull/133) [`f8c5c1f`](https://github.com/JoviDeCroock/pracht/commit/f8c5c1fe1a7c7b5d7accd8028e8c12929a218081) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - API routes now support catch-all segments (e.g. `src/api/files/[...path].ts` → `/api/files/*`), matching the existing page-routing convention. The matched rest-path is exposed on the route params as `"*"`. Previously `[...param]` was silently turned into a `:...param` dynamic segment with a broken name.
+
+### Patch Changes
+
+- Updated dependencies [[`f8c5c1f`](https://github.com/JoviDeCroock/pracht/commit/f8c5c1fe1a7c7b5d7accd8028e8c12929a218081)]:
+  - @pracht/core@0.4.0
+
+## 1.2.2
+
+### Patch Changes
+
+- [#124](https://github.com/JoviDeCroock/pracht/pull/124) [`8f662c0`](https://github.com/JoviDeCroock/pracht/commit/8f662c0b78b1911a7534ffd7aa4e919cf22a3a42) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - Internal refactor: split several large modules into smaller, focused files to improve maintainability. Public APIs are unchanged.
+
+- [#132](https://github.com/JoviDeCroock/pracht/pull/132) [`30d867f`](https://github.com/JoviDeCroock/pracht/commit/30d867f4a4cd41107a1ed60c607afe0d51848c3b) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - Follow-up security hardening after the main audit fixes.
+
+  - `@pracht/adapter-node` now supports `canonicalOrigin` so apps can pin
+    `request.url` to a known public origin instead of depending on untrusted
+    `Host` values. The adapter also treats both `x-pracht-route-state-request`
+    and `?_data=1` as route-state transports before any static/ISG HTML serving,
+    and ISG regeneration now uses a clean HTML request instead of replaying the
+    triggering user's cookies or authorization headers.
+  - `@pracht/adapter-cloudflare` now bypasses static asset serving for both
+    route-state transports (`x-pracht-route-state-request` and `?_data=1`).
+  - `@pracht/cli` now emits a Vercel Build Output rule that sends `?_data=1`
+    requests to the render function before static rewrites can serve prerendered
+    HTML.
+
+- [#131](https://github.com/JoviDeCroock/pracht/pull/131) [`015e987`](https://github.com/JoviDeCroock/pracht/commit/015e987a2de471980fab557e3dbf3d52937ad0ac) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - Security hardening across request handling, redirects, and build output.
+
+  **Framework (`@pracht/core`)**
+
+  - **Middleware/loader redirects are now validated.** `javascript:`, `data:`,
+    `vbscript:`, `blob:`, and `file:` targets are refused server-side (they
+    were already refused on the client) and CR/LF in the `Location` value
+    throws instead of producing a split response. Non-safe-method redirects
+    now default to **303 See Other** rather than 302 so browsers don't
+    resend the POST body to the redirect target. `MiddlewareResult`'s
+    `redirect` form now accepts an optional `status` override.
+  - **CSRF protection for mutating API routes.** Non-GET API requests are
+    rejected with 403 unless the browser signals a same-origin/same-site
+    fetch (`Sec-Fetch-Site`) or the `Origin` header matches the request
+    URL's origin. Opt out per-app via `defineApp({ api: { requireSameOrigin: false } })`.
+  - **`_data=1` route-state bypass is now gated.** The query-param form of
+    the route-state endpoint now requires `Sec-Fetch-Site: same-origin`/
+    `same-site` (or a matching `Origin`). The explicit
+    `x-pracht-route-state-request` header is still accepted unconditionally
+    (CORS-protected).
+  - **Catch-all path traversal at build time is closed.**
+    `buildPathFromSegments` now percent-encodes catch-all components
+    individually and explicitly neutralises `.` / `..` segments, so a
+    `getStaticPaths` returning `{ "*": "../../etc/passwd" }` can no longer
+    escape `dist/client/` at SSG/ISG write time.
+  - **`headers()` values are validated for CR/LF.** `applyHeaders` now
+    throws a consistent framework error on response-splitting attempts,
+    regardless of adapter-specific Headers implementation behaviour.
+  - **`debugErrors` is ignored in production.** When `NODE_ENV=production`,
+    `debugErrors: true` is refused (with a one-shot console warning) so a
+    misconfigured deploy cannot leak stack traces and module paths.
+
+  **Adapter (`@pracht/adapter-node`)**
+
+  - **Symlinks are no longer followed by the static server.** `resolveStaticFile`
+    now uses `lstat` and rejects files whose inode is a symlink, preventing
+    a malicious build artifact from exposing files outside `dist/client/`.
+  - **ISG cache is path-contained.** The on-disk write path is now
+    `resolve()`-checked against the static root, rejecting any URL path
+    that would escape via `..`, encoded separators, or NUL bytes.
+  - **ISG skips the on-disk cache when the response is user-specific.**
+    Responses that set `Cache-Control: no-store`/`private`, `Set-Cookie`,
+    or a `Vary` covering `cookie`/`authorization`/`*` are served through
+    but not written to disk, closing a per-user cache-poisoning window.
+
+  **Packaging**
+
+  - `@pracht/cli` now has an explicit `files` allowlist so future
+    workdir additions can't accidentally ship in the npm tarball.
+  - `create-pracht`'s bin entry is now executable in the repository.
+
+- Updated dependencies [[`caae3cb`](https://github.com/JoviDeCroock/pracht/commit/caae3cb53e0b6136ef78c3ac189a0d0ab82e4df7), [`8f662c0`](https://github.com/JoviDeCroock/pracht/commit/8f662c0b78b1911a7534ffd7aa4e919cf22a3a42), [`901ef5b`](https://github.com/JoviDeCroock/pracht/commit/901ef5b7958e4066d5382f836d098bded8bfe320), [`015e987`](https://github.com/JoviDeCroock/pracht/commit/015e987a2de471980fab557e3dbf3d52937ad0ac)]:
+  - @pracht/core@0.3.0
+
 ## 1.2.1
 
 ### Patch Changes

package/dist/{build-DlABFPbG.mjs → build-DkP2ffu9.mjs}

@@ -36,6 +36,14 @@ function createVercelOutputConfig({ functionName, headersManifest, staticRoutes,
 			value: "1"
 		}],
 		src: "/(.*)"
+	}, {
+		dest: target,
+		has: [{
+			type: "query",
+			key: "_data",
+			value: "1"
+		}],
+		src: "/(.*)"
 	}];
 	for (const route of sortStaticRoutes(staticRoutes)) routes.push({
 		dest: routeToStaticHtmlPath(route),

package/dist/{doctor-CQq64tfW.mjs → doctor-B5qYLJF8.mjs}

@@ -1,4 +1,4 @@
-import { t as runDoctor } from "./verification-CId4crSF.mjs";
+import { t as runDoctor } from "./verification-WP-KTb41.mjs";
 import { defineCommand } from "citty";
 //#region src/commands/doctor.ts
 var doctor_default = defineCommand({

package/dist/{generate-sHtRHRAH.mjs → generate-C9AMSGsv.mjs}

@@ -1,7 +1,146 @@
-import { a as toManifestModulePath, i as insertArrayItem, n as extractRegistryEntries, o as upsertObjectEntry, t as ensureCoreNamedImport } from "./manifest-DGq1n5LT.mjs";
-import { _ as requireEnum, a as readProjectConfig, c as resolveProjectPath, d as writeGeneratedFile, f as ensureTrailingNewline, g as quote, h as parseCommaList, l as resolveRouteModulePath, m as parseApiMethods, n as displayPath, o as resolveApiModulePath, s as resolvePagesRouteModulePath, t as assertFileExists, u as resolveScopedFile, v as requirePositiveInteger } from "./project-DUyH_7eJ.mjs";
+import { _ as requireEnum, a as readProjectConfig, c as resolveProjectPath, d as writeGeneratedFile, f as ensureTrailingNewline, g as quote, h as parseCommaList, l as resolveRouteModulePath, m as parseApiMethods, n as displayPath, o as resolveApiModulePath, s as resolvePagesRouteModulePath, t as assertFileExists, u as resolveScopedFile, v as requirePositiveInteger } from "./project-BdMiN3s7.mjs";
+import { a as toManifestModulePath, i as insertArrayItem, n as extractRegistryEntries, o as upsertObjectEntry, t as ensureCoreNamedImport } from "./manifest-Bs5hp3gA.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";
+//#region src/commands/generate-paths.ts
+function normalizeRoutePathString(value) {
+	if (!value || value === "/") return "/";
+	const normalized = `/${value}`.replace(/\/+/g, "/");
+	return normalized !== "/" && normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
+}
+function normalizeApiPath(value) {
+	return normalizeRoutePathString(value).replace(/^\/api(?=\/|$)/, "") || "/";
+}
+function hasDynamicSegments(routePath) {
+	return routePath.split("/").some((segment) => segment.startsWith(":") || segment === "*");
+}
+function dynamicParamNames(routePath) {
+	return routePath.split("/").filter(Boolean).map((segment) => {
+		if (segment.startsWith(":")) return segment.slice(1);
+		if (segment === "*") return "slug";
+		return null;
+	}).filter((s) => s !== null);
+}
+function routeIdFromPath(routePath) {
+	if (routePath === "/") return "index";
+	return routePath.split("/").filter(Boolean).map((segment) => segment.replace(/^:/, "").replace(/\*/g, "splat")).join("-");
+}
+function titleFromPath(routePath) {
+	if (routePath === "/") return "Home";
+	return titleCase((routePath.split("/").filter(Boolean).at(-1) ?? "Page").replace(/^:/, "").replace(/\*/g, "slug"));
+}
+function titleCase(value) {
+	return value.split(/[-_/]/).filter(Boolean).map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1)).join(" ");
+}
+//#endregion
+//#region src/commands/generate-source.ts
+function buildManifestRouteModuleSource(opts) {
+	const sections = buildRouteModuleSections(opts);
+	const componentIdx = sections.findIndex((s) => s.startsWith("export function Component"));
+	const insertAt = componentIdx === -1 ? sections.length : componentIdx;
+	sections.splice(insertAt, 0, "export function head() {", `  return { title: ${quote(opts.title)} };`, "}", "");
+	return `${sections.join("\n")}\n`;
+}
+function buildPagesRouteModuleSource(opts) {
+	const sections = buildRouteModuleSections(opts);
+	const firstExportIdx = sections.findIndex((s) => s.startsWith("export"));
+	const insertAt = firstExportIdx === -1 ? sections.length : firstExportIdx;
+	sections.splice(insertAt, 0, `export const RENDER_MODE = ${quote(opts.render)};`, "");
+	return `${sections.join("\n")}\n`;
+}
+function buildShellModuleSource(name) {
+	const title = titleCase(name);
+	return [
+		"import type { ShellProps } from \"@pracht/core\";",
+		"",
+		"export function Shell({ children }: ShellProps) {",
+		"  return (",
+		`    <div class=${quote(`${name}-shell`)}>`,
+		"      <main>{children}</main>",
+		"    </div>",
+		"  );",
+		"}",
+		"",
+		"export function head() {",
+		`  return { title: ${quote(title)} };`,
+		"}",
+		""
+	].join("\n");
+}
+function buildMiddlewareModuleSource() {
+	return [
+		"import type { MiddlewareFn } from \"@pracht/core\";",
+		"",
+		"export const middleware: MiddlewareFn = async (_args) => {",
+		"  return;",
+		"};",
+		""
+	].join("\n");
+}
+function buildApiRouteSource({ endpointPath, methods }) {
+	return [
+		"import type { BaseRouteArgs } from \"@pracht/core\";",
+		"",
+		...methods.flatMap((method, index) => {
+			const lines = buildApiMethodSource(method, methods, endpointPath);
+			if (index === methods.length - 1) return lines;
+			return [...lines, ""];
+		}),
+		""
+	].join("\n");
+}
+function buildRouteModuleSections(opts) {
+	const { includeErrorBoundary, includeLoader, includeStaticPaths, routePath, title } = opts;
+	const params = dynamicParamNames(routePath);
+	const imports = [];
+	const sections = [];
+	if (includeLoader) imports.push("LoaderArgs", "RouteComponentProps");
+	if (includeErrorBoundary) imports.push("ErrorBoundaryProps");
+	if (imports.length > 0) {
+		sections.push(`import type { ${imports.join(", ")} } from "@pracht/core";`);
+		sections.push("");
+	}
+	if (includeLoader) sections.push("export async function loader(_args: LoaderArgs) {", `  return { message: ${quote(`Welcome to ${title}.`)} };`, "}", "");
+	if (includeStaticPaths) sections.push("export function getStaticPaths() {", `  return [${buildStaticPathsStub(params)}];`, "}", "");
+	if (includeLoader) sections.push("export function Component({ data }: RouteComponentProps<typeof loader>) {", "  return (", "    <section>", `      <h1>${escapeJsxText(title)}</h1>`, "      <p>{data.message}</p>", "    </section>", "  );", "}");
+	else sections.push("export function Component() {", "  return (", "    <section>", `      <h1>${escapeJsxText(title)}</h1>`, "    </section>", "  );", "}");
+	if (includeErrorBoundary) sections.push("", "export function ErrorBoundary({ error }: ErrorBoundaryProps) {", "  return <p>{error.message}</p>;", "}");
+	return sections;
+}
+function buildApiMethodSource(method, methods, endpointPath) {
+	if (method === "DELETE" || method === "HEAD") return [
+		`export function ${method}(_args: BaseRouteArgs) {`,
+		"  return new Response(null, { status: 204 });",
+		"}"
+	];
+	if (method === "OPTIONS") return [
+		`export function ${method}(_args: BaseRouteArgs) {`,
+		"  return new Response(null, {",
+		`    headers: { allow: ${quote(methods.join(", "))} },`,
+		"    status: 204,",
+		"  });",
+		"}"
+	];
+	if (method === "GET") return [
+		`export function ${method}(_args: BaseRouteArgs) {`,
+		`  return Response.json({ endpoint: ${quote(`/api${endpointPath}`)}, ok: true });`,
+		"}"
+	];
+	const status = method === "POST" ? 201 : 200;
+	return [
+		`export async function ${method}({ request }: BaseRouteArgs) {`,
+		"  const body = await request.json();",
+		`  return Response.json({ body, ok: true }, { status: ${status} });`,
+		"}"
+	];
+}
+function buildStaticPathsStub(params) {
+	if (params.length === 0) return "{}";
+	return `{ ${params.map((name) => `${name}: ${quote(`example-${name}`)}`).join(", ")} }`;
+}
+function escapeJsxText(value) {
+	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
 var generate_default = defineCommand({
 	meta: {
 		name: "generate",
@@ -260,141 +399,5 @@ function generateApi(args, project) {
 		updated: []
 	};
 }
-function buildRouteModuleSections(opts) {
-	const { includeErrorBoundary, includeLoader, includeStaticPaths, routePath, title } = opts;
-	const params = dynamicParamNames(routePath);
-	const imports = [];
-	const sections = [];
-	if (includeLoader) imports.push("LoaderArgs", "RouteComponentProps");
-	if (includeErrorBoundary) imports.push("ErrorBoundaryProps");
-	if (imports.length > 0) {
-		sections.push(`import type { ${imports.join(", ")} } from "@pracht/core";`);
-		sections.push("");
-	}
-	if (includeLoader) sections.push("export async function loader(_args: LoaderArgs) {", `  return { message: ${quote(`Welcome to ${title}.`)} };`, "}", "");
-	if (includeStaticPaths) sections.push("export function getStaticPaths() {", `  return [${buildStaticPathsStub(params)}];`, "}", "");
-	if (includeLoader) sections.push("export function Component({ data }: RouteComponentProps<typeof loader>) {", "  return (", "    <section>", `      <h1>${escapeJsxText(title)}</h1>`, "      <p>{data.message}</p>", "    </section>", "  );", "}");
-	else sections.push("export function Component() {", "  return (", "    <section>", `      <h1>${escapeJsxText(title)}</h1>`, "    </section>", "  );", "}");
-	if (includeErrorBoundary) sections.push("", "export function ErrorBoundary({ error }: ErrorBoundaryProps) {", "  return <p>{error.message}</p>;", "}");
-	return sections;
-}
-function buildManifestRouteModuleSource(opts) {
-	const sections = buildRouteModuleSections(opts);
-	const componentIdx = sections.findIndex((s) => s.startsWith("export function Component"));
-	const insertAt = componentIdx === -1 ? sections.length : componentIdx;
-	sections.splice(insertAt, 0, "export function head() {", `  return { title: ${quote(opts.title)} };`, "}", "");
-	return `${sections.join("\n")}\n`;
-}
-function buildPagesRouteModuleSource(opts) {
-	const sections = buildRouteModuleSections(opts);
-	const firstExportIdx = sections.findIndex((s) => s.startsWith("export"));
-	const insertAt = firstExportIdx === -1 ? sections.length : firstExportIdx;
-	sections.splice(insertAt, 0, `export const RENDER_MODE = ${quote(opts.render)};`, "");
-	return `${sections.join("\n")}\n`;
-}
-function buildShellModuleSource(name) {
-	const title = titleCase(name);
-	return [
-		"import type { ShellProps } from \"@pracht/core\";",
-		"",
-		"export function Shell({ children }: ShellProps) {",
-		"  return (",
-		`    <div class=${quote(`${name}-shell`)}>`,
-		"      <main>{children}</main>",
-		"    </div>",
-		"  );",
-		"}",
-		"",
-		"export function head() {",
-		`  return { title: ${quote(title)} };`,
-		"}",
-		""
-	].join("\n");
-}
-function buildMiddlewareModuleSource() {
-	return [
-		"import type { MiddlewareFn } from \"@pracht/core\";",
-		"",
-		"export const middleware: MiddlewareFn = async (_args) => {",
-		"  return;",
-		"};",
-		""
-	].join("\n");
-}
-function buildApiRouteSource({ endpointPath, methods }) {
-	return [
-		"import type { BaseRouteArgs } from \"@pracht/core\";",
-		"",
-		...methods.flatMap((method, index) => {
-			const lines = buildApiMethodSource(method, methods, endpointPath);
-			if (index === methods.length - 1) return lines;
-			return [...lines, ""];
-		}),
-		""
-	].join("\n");
-}
-function buildApiMethodSource(method, methods, endpointPath) {
-	if (method === "DELETE" || method === "HEAD") return [
-		`export function ${method}(_args: BaseRouteArgs) {`,
-		"  return new Response(null, { status: 204 });",
-		"}"
-	];
-	if (method === "OPTIONS") return [
-		`export function ${method}(_args: BaseRouteArgs) {`,
-		"  return new Response(null, {",
-		`    headers: { allow: ${quote(methods.join(", "))} },`,
-		"    status: 204,",
-		"  });",
-		"}"
-	];
-	if (method === "GET") return [
-		`export function ${method}(_args: BaseRouteArgs) {`,
-		`  return Response.json({ endpoint: ${quote(`/api${endpointPath}`)}, ok: true });`,
-		"}"
-	];
-	const status = method === "POST" ? 201 : 200;
-	return [
-		`export async function ${method}({ request }: BaseRouteArgs) {`,
-		"  const body = await request.json();",
-		`  return Response.json({ body, ok: true }, { status: ${status} });`,
-		"}"
-	];
-}
-function normalizeRoutePathString(value) {
-	if (!value || value === "/") return "/";
-	const normalized = `/${value}`.replace(/\/+/g, "/");
-	return normalized !== "/" && normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
-}
-function normalizeApiPath(value) {
-	return normalizeRoutePathString(value).replace(/^\/api(?=\/|$)/, "") || "/";
-}
-function hasDynamicSegments(routePath) {
-	return routePath.split("/").some((segment) => segment.startsWith(":") || segment === "*");
-}
-function dynamicParamNames(routePath) {
-	return routePath.split("/").filter(Boolean).map((segment) => {
-		if (segment.startsWith(":")) return segment.slice(1);
-		if (segment === "*") return "slug";
-		return null;
-	}).filter((s) => s !== null);
-}
-function routeIdFromPath(routePath) {
-	if (routePath === "/") return "index";
-	return routePath.split("/").filter(Boolean).map((segment) => segment.replace(/^:/, "").replace(/\*/g, "splat")).join("-");
-}
-function titleFromPath(routePath) {
-	if (routePath === "/") return "Home";
-	return titleCase((routePath.split("/").filter(Boolean).at(-1) ?? "Page").replace(/^:/, "").replace(/\*/g, "slug"));
-}
-function titleCase(value) {
-	return value.split(/[-_/]/).filter(Boolean).map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1)).join(" ");
-}
-function buildStaticPathsStub(params) {
-	if (params.length === 0) return "{}";
-	return `{ ${params.map((name) => `${name}: ${quote(`example-${name}`)}`).join(", ")} }`;
-}
-function escapeJsxText(value) {
-	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-}
 //#endregion
 export { generate_default as default };

package/dist/index.mjs

@@ -29,12 +29,12 @@ runMain(defineCommand({
 		description: "The pracht CLI"
 	},
 	subCommands: {
-		build: () => import("./build-DlABFPbG.mjs").then((m) => m.default),
+		build: () => import("./build-DkP2ffu9.mjs").then((m) => m.default),
 		dev: () => import("./dev-BCFe3g38.mjs").then((m) => m.default),
-		doctor: () => import("./doctor-CQq64tfW.mjs").then((m) => m.default),
-		generate: () => import("./generate-sHtRHRAH.mjs").then((m) => m.default),
-		inspect: () => import("./inspect-DP-h3vLw.mjs").then((m) => m.default),
-		verify: () => import("./verify-D7Bg1Su6.mjs").then((m) => m.default)
+		doctor: () => import("./doctor-B5qYLJF8.mjs").then((m) => m.default),
+		generate: () => import("./generate-C9AMSGsv.mjs").then((m) => m.default),
+		inspect: () => import("./inspect-MseHPU9s.mjs").then((m) => m.default),
+		verify: () => import("./verify-Do8bG-fq.mjs").then((m) => m.default)
 	}
 }));
 //#endregion

package/dist/{inspect-DP-h3vLw.mjs → inspect-MseHPU9s.mjs}

@@ -1,6 +1,6 @@
 import { t as HTTP_METHODS } from "./index.mjs";
 import { t as readClientBuildAssets } from "./build-metadata-BOChHO8g.mjs";
-import { a as readProjectConfig, c as resolveProjectPath, p as handleCliError } from "./project-DUyH_7eJ.mjs";
+import { a as readProjectConfig, c as resolveProjectPath, p as handleCliError } from "./project-BdMiN3s7.mjs";
 import { defineCommand } from "citty";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";