@pracht/cli 1.2.2 → 1.3.1

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @pracht/cli
 
+## 1.3.1
+
+### Patch Changes
+
+- [#137](https://github.com/JoviDeCroock/pracht/pull/137) [`ac32c2c`](https://github.com/JoviDeCroock/pracht/commit/ac32c2cb9ce5e86a38cde1167269e368f41dea0e) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - Harden same-origin request checks and HTML head rendering, improve client prefetch/navigation behavior, fix cross-platform path handling, stream and conditionally revalidate Node static responses, de-document Cloudflare runtime ISG revalidation, and align starter/docs with the current CLI/runtime behavior.
+
+- Updated dependencies [[`ac32c2c`](https://github.com/JoviDeCroock/pracht/commit/ac32c2cb9ce5e86a38cde1167269e368f41dea0e), [`49d6348`](https://github.com/JoviDeCroock/pracht/commit/49d6348bc984464cdb0e8c54c5ef9ba5cdec911e)]:
+  - @pracht/core@0.5.0
+
+## 1.3.0
+
+### Minor Changes
+
+- [#133](https://github.com/JoviDeCroock/pracht/pull/133) [`f8c5c1f`](https://github.com/JoviDeCroock/pracht/commit/f8c5c1fe1a7c7b5d7accd8028e8c12929a218081) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - API routes now support catch-all segments (e.g. `src/api/files/[...path].ts` → `/api/files/*`), matching the existing page-routing convention. The matched rest-path is exposed on the route params as `"*"`. Previously `[...param]` was silently turned into a `:...param` dynamic segment with a broken name.
+
+### Patch Changes
+
+- Updated dependencies [[`f8c5c1f`](https://github.com/JoviDeCroock/pracht/commit/f8c5c1fe1a7c7b5d7accd8028e8c12929a218081)]:
+  - @pracht/core@0.4.0
+
 ## 1.2.2
 
 ### Patch Changes

package/dist/{build-DkP2ffu9.mjs → build-CiFKxDlE.mjs}

@@ -3,6 +3,7 @@ import { t as readClientBuildAssets } from "./build-metadata-BOChHO8g.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
 import { build } from "vite";
 //#region src/build-shared.ts
 const ROUTE_STATE_REQUEST_HEADER = "x-pracht-route-state-request";
@@ -145,7 +146,8 @@ var build_default = defineCommand({
 			root,
 			build: {
 				outDir: "dist/server",
-				ssr: "virtual:pracht/server"
+				rollupOptions: { input: "virtual:pracht/server" },
+				ssr: true
 			}
 		});
 		const serverEntry = resolve(root, "dist/server/server.js");
@@ -168,7 +170,7 @@ var build_default = defineCommand({
 		const publicDir = resolve(root, "public");
 		if (existsSync(publicDir)) cpSync(publicDir, clientDir, { recursive: true });
 		if (existsSync(serverEntry)) {
-			const serverMod = await import(serverEntry);
+			const serverMod = await import(pathToFileURL(serverEntry).href);
 			const { prerenderApp } = serverMod;
 			const { clientEntryUrl, cssManifest, jsManifest } = readClientBuildAssets(root);
 			const { pages, isgManifest } = await prerenderApp({
@@ -177,7 +179,8 @@ var build_default = defineCommand({
 				cssManifest,
 				jsManifest,
 				registry: serverMod.registry,
-				withISGManifest: true
+				withISGManifest: true,
+				concurrency: serverMod.prerenderConcurrency
 			});
 			const headersManifest = Object.fromEntries(pages.map((page) => [page.path, page.headers ?? {}]));
 			if (pages.length > 0) {
@@ -200,6 +203,7 @@ var build_default = defineCommand({
 				console.log(`\n  ISG manifest → dist/server/isg-manifest.json (${Object.keys(isgManifest).length} route(s))\n`);
 			}
 			if (serverMod.buildTarget === "cloudflare") {
+				if (Object.keys(isgManifest).length > 0) console.warn("\n  Warning: Cloudflare adapter currently serves prerendered ISG HTML as static assets and does not perform runtime revalidation. Use SSR/SSG on Cloudflare, or deploy ISG routes to Node until Cloudflare ISG support is added.\n");
 				console.log("\n  Cloudflare worker → dist/server/server.js\n");
 				console.log("  Deploy with: wrangler deploy\n");
 			}

package/dist/{doctor-CwQJjJ83.mjs → doctor-pY1BYaFH.mjs}

@@ -1,4 +1,4 @@
-import { t as runDoctor } from "./verification-Dwf1ZuNn.mjs";
+import { t as runDoctor } from "./verification-ClzkW6_q.mjs";
 import { defineCommand } from "citty";
 //#region src/commands/doctor.ts
 var doctor_default = defineCommand({

package/dist/{generate-C9AMSGsv.mjs → generate-DqKWCmIu.mjs}

@@ -1,4 +1,4 @@
-import { _ as requireEnum, a as readProjectConfig, c as resolveProjectPath, d as writeGeneratedFile, f as ensureTrailingNewline, g as quote, h as parseCommaList, l as resolveRouteModulePath, m as parseApiMethods, n as displayPath, o as resolveApiModulePath, s as resolvePagesRouteModulePath, t as assertFileExists, u as resolveScopedFile, v as requirePositiveInteger } from "./project-BdMiN3s7.mjs";
+import { _ as requireEnum, a as readProjectConfig, c as resolveProjectPath, d as writeGeneratedFile, f as ensureTrailingNewline, g as quote, h as parseCommaList, l as resolveRouteModulePath, m as parseApiMethods, n as displayPath, o as resolveApiModulePath, s as resolvePagesRouteModulePath, t as assertFileExists, u as resolveScopedFile, v as requirePositiveInteger } from "./project-CfxHKBzP.mjs";
 import { a as toManifestModulePath, i as insertArrayItem, n as extractRegistryEntries, o as upsertObjectEntry, t as ensureCoreNamedImport } from "./manifest-Bs5hp3gA.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";

package/dist/index.mjs

@@ -29,12 +29,12 @@ runMain(defineCommand({
 		description: "The pracht CLI"
 	},
 	subCommands: {
-		build: () => import("./build-DkP2ffu9.mjs").then((m) => m.default),
+		build: () => import("./build-CiFKxDlE.mjs").then((m) => m.default),
 		dev: () => import("./dev-BCFe3g38.mjs").then((m) => m.default),
-		doctor: () => import("./doctor-CwQJjJ83.mjs").then((m) => m.default),
-		generate: () => import("./generate-C9AMSGsv.mjs").then((m) => m.default),
-		inspect: () => import("./inspect-MseHPU9s.mjs").then((m) => m.default),
-		verify: () => import("./verify-o0G5Xuff.mjs").then((m) => m.default)
+		doctor: () => import("./doctor-pY1BYaFH.mjs").then((m) => m.default),
+		generate: () => import("./generate-DqKWCmIu.mjs").then((m) => m.default),
+		inspect: () => import("./inspect-vYYIN8Ju.mjs").then((m) => m.default),
+		verify: () => import("./verify-eRkOdBaK.mjs").then((m) => m.default)
 	}
 }));
 //#endregion

package/dist/{inspect-MseHPU9s.mjs → inspect-vYYIN8Ju.mjs}

@@ -1,6 +1,6 @@
 import { t as HTTP_METHODS } from "./index.mjs";
 import { t as readClientBuildAssets } from "./build-metadata-BOChHO8g.mjs";
-import { a as readProjectConfig, c as resolveProjectPath, p as handleCliError } from "./project-BdMiN3s7.mjs";
+import { a as readProjectConfig, c as resolveProjectPath, p as handleCliError } from "./project-CfxHKBzP.mjs";
 import { defineCommand } from "citty";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{project-BdMiN3s7.mjs → project-CfxHKBzP.mjs}

@@ -1,6 +1,6 @@
 import { n as PROJECT_DEFAULTS, t as HTTP_METHODS } from "./index.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { basename, dirname, relative, resolve } from "node:path";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 //#region src/utils.ts
 function quote(value) {
 	return JSON.stringify(value);
@@ -64,34 +64,47 @@ function resolveProjectPath(root, configPath) {
 	return resolve(root, `.${configPath}`);
 }
 function resolveScopedFile(root, configDir, fileName) {
-	return resolve(resolveProjectPath(root, configDir), fileName);
+	assertSafePathSegment(fileName.replace(/\.(ts|tsx|js|jsx)$/, ""));
+	const baseDir = resolveProjectPath(root, configDir);
+	const filePath = resolve(baseDir, fileName);
+	assertInsideDirectory(baseDir, filePath);
+	return filePath;
 }
 function resolveRouteModulePath(project, routePath, extension) {
 	const segments = segmentsFromPath(routePath);
 	const relativePath = segments.length === 0 ? `index${extension}` : `${segments.join("/")}${extension}`;
+	const baseDir = resolveProjectPath(project.root, project.routesDir);
+	const absolutePath = resolve(baseDir, relativePath);
+	assertInsideDirectory(baseDir, absolutePath);
 	return {
-		absolutePath: resolve(resolveProjectPath(project.root, project.routesDir), relativePath),
+		absolutePath,
 		relativePath
 	};
 }
 function resolvePagesRouteModulePath(project, routePath, extension) {
 	const segments = segmentsFromPath(routePath);
 	const relativePath = segments.length === 0 ? `index${extension}` : `${segments.join("/")}${extension}`;
+	const baseDir = resolveProjectPath(project.root, project.pagesDir);
+	const absolutePath = resolve(baseDir, relativePath);
+	assertInsideDirectory(baseDir, absolutePath);
 	return {
-		absolutePath: resolve(resolveProjectPath(project.root, project.pagesDir), relativePath),
+		absolutePath,
 		relativePath
 	};
 }
 function resolveApiModulePath(project, endpointPath) {
 	const segments = segmentsFromPath(endpointPath);
 	const relativePath = segments.length === 0 ? "index.ts" : `${segments.join("/")}.ts`;
+	const baseDir = resolveProjectPath(project.root, project.apiDir);
+	const absolutePath = resolve(baseDir, relativePath);
+	assertInsideDirectory(baseDir, absolutePath);
 	return {
-		absolutePath: resolve(resolveProjectPath(project.root, project.apiDir), relativePath),
+		absolutePath,
 		relativePath
 	};
 }
 function displayPath(root, filePath) {
-	return relative(root, filePath) || ".";
+	return (relative(root, filePath) || ".").replace(/\\/g, "/");
 }
 function writeGeneratedFile(filePath, source) {
 	if (existsSync(filePath)) throw new Error(`Refusing to overwrite existing file ${filePath}.`);
@@ -139,10 +152,23 @@ function normalizeConfigPath(value) {
 }
 function segmentsFromPath(path) {
 	return path.split("/").filter(Boolean).map((segment) => {
-		if (segment.startsWith(":")) return `[${segment.slice(1)}]`;
+		assertSafePathSegment(segment);
+		if (segment.startsWith(":")) {
+			const name = segment.endsWith("*") ? segment.slice(1, -1) : segment.slice(1);
+			assertSafePathSegment(name);
+			return segment.endsWith("*") ? `[...${name || "slug"}]` : `[${name}]`;
+		}
 		if (segment === "*") return "[...slug]";
 		return segment;
 	});
 }
+function assertSafePathSegment(segment) {
+	if (!segment || segment === "." || segment === ".." || segment.includes("/") || segment.includes("\\") || segment.includes("\0")) throw new Error(`Unsafe path segment: ${JSON.stringify(segment)}.`);
+}
+function assertInsideDirectory(baseDir, filePath) {
+	const relativePath = relative(baseDir, filePath);
+	if (relativePath === "" || !relativePath.startsWith("..") && !isAbsolute(relativePath)) return;
+	throw new Error(`Refusing to write outside ${baseDir}.`);
+}
 //#endregion
 export { requireEnum as _, readProjectConfig as a, resolveProjectPath as c, writeGeneratedFile as d, ensureTrailingNewline as f, quote as g, parseCommaList as h, listFilesRecursively as i, resolveRouteModulePath as l, parseApiMethods as m, displayPath as n, resolveApiModulePath as o, handleCliError as p, hasPagesAppShell as r, resolvePagesRouteModulePath as s, assertFileExists as t, resolveScopedFile as u, requirePositiveInteger as v };

package/dist/{verification-Dwf1ZuNn.mjs → verification-ClzkW6_q.mjs}

@@ -1,7 +1,7 @@
-import { a as readProjectConfig, c as resolveProjectPath, i as listFilesRecursively, n as displayPath, r as hasPagesAppShell } from "./project-BdMiN3s7.mjs";
+import { a as readProjectConfig, c as resolveProjectPath, i as listFilesRecursively, n as displayPath, r as hasPagesAppShell } from "./project-CfxHKBzP.mjs";
 import { n as extractRegistryEntries, r as extractRelativeModulePaths } from "./manifest-Bs5hp3gA.mjs";
 import { existsSync, readFileSync } from "node:fs";
-import { basename, dirname, relative, resolve } from "node:path";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 //#region src/verification-helpers.ts
 const CONFIG_FILE_NAMES = new Set([
@@ -22,7 +22,7 @@ function createCheck(status, message) {
 }
 function isWithinDirectory(filePath, directoryPath) {
 	const relativePath = relative(directoryPath, filePath);
-	return relativePath === "" || !relativePath.startsWith("..") && !relativePath.startsWith("../");
+	return relativePath === "" || !relativePath.startsWith("..") && !isAbsolute(relativePath);
 }
 function normalizePath(value) {
 	return value.replace(/\\/g, "/");
@@ -42,6 +42,7 @@ function resolveApiRoutePath(apiDir, file) {
 	relativePath = relativePath.replace(/\.(ts|tsx|js|jsx)$/, "");
 	if (relativePath === "index") relativePath = "";
 	else relativePath = relativePath.replace(/\/index$/, "");
+	relativePath = relativePath.replace(/\[\.\.\.[^\]]+\]/g, "*");
 	relativePath = relativePath.replace(/\[([^\]]+)\]/g, ":$1");
 	return normalizeRoutePath(relativePath ? `/api/${relativePath}` : "/api");
 }
@@ -270,9 +271,9 @@ function collectChangedFiles(root) {
 			if (!record) continue;
 			if (record.includes(" -> ")) {
 				const [from, to] = record.split(" -> ");
-				addChangedFile(files, repoRoot, prefix, from);
-				addChangedFile(files, repoRoot, prefix, to);
-			} else addChangedFile(files, repoRoot, prefix, record);
+				addChangedFile(files, root, prefix, from);
+				addChangedFile(files, root, prefix, to);
+			} else addChangedFile(files, root, prefix, record);
 		}
 		return {
 			files: [...files],
@@ -285,11 +286,11 @@ function collectChangedFiles(root) {
 		};
 	}
 }
-function addChangedFile(files, repoRoot, prefix, repoRelativePath) {
+function addChangedFile(files, projectRoot, prefix, repoRelativePath) {
 	if (prefix && !repoRelativePath.startsWith(prefix)) return;
 	const projectRelativePath = prefix ? repoRelativePath.slice(prefix.length) : repoRelativePath;
 	if (!projectRelativePath) return;
-	files.add(resolve(repoRoot, projectRelativePath));
+	files.add(resolve(projectRoot, projectRelativePath));
 }
 function filterFrameworkFiles(project, files, packageJsonPath) {
 	const appFile = resolveProjectPath(project.root, project.appFile);

package/dist/{verify-o0G5Xuff.mjs → verify-eRkOdBaK.mjs}

@@ -1,4 +1,4 @@
-import { n as runVerification } from "./verification-Dwf1ZuNn.mjs";
+import { n as runVerification } from "./verification-ClzkW6_q.mjs";
 import { defineCommand } from "citty";
 //#region src/commands/verify.ts
 var verify_default = defineCommand({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pracht/cli",
-  "version": "1.2.2",
+  "version": "1.3.1",
   "license": "MIT",
   "homepage": "https://github.com/JoviDeCroock/pracht/tree/main/packages/cli",
   "bugs": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "citty": "^0.1.6",
-    "@pracht/core": "0.3.0"
+    "@pracht/core": "0.5.0"
   },
   "scripts": {
     "build": "tsdown"