@pracht/cli 1.3.0 → 1.3.2

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @pracht/cli
 
+## 1.3.2
+
+### Patch Changes
+
+- [`0bd717f`](https://github.com/JoviDeCroock/pracht/commit/0bd717f280bc69a65efa6c4cb3142140ec88c9ac) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - Tighten framework and deployment DX after the framework review: add shell-level error boundaries and clearer debug errors without route boundaries, fix pages-router route specificity and `.tsrx` server discovery, correct the dev error overlay import, expose generated-entry context factories for built-in adapters, add configurable Node/dev request body limits, fix CLI version reporting, refresh starter defaults, and align docs/onboarding examples with the current package names and adapter APIs.
+
+- [`e7be45d`](https://github.com/JoviDeCroock/pracht/commit/e7be45da86eb8d04d2e5dc6c1c76547c2491cd2d) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - Tighten prerender path safety by rejecting dynamic dot segments and unsafe static route segments, and by bounding SSG/ISG writes to `dist/client`. Deduplicate the default Node adapter entry generation and preserve multiple `Set-Cookie` headers in Node responses.
+
+- Updated dependencies [[`0bd717f`](https://github.com/JoviDeCroock/pracht/commit/0bd717f280bc69a65efa6c4cb3142140ec88c9ac), [`e7be45d`](https://github.com/JoviDeCroock/pracht/commit/e7be45da86eb8d04d2e5dc6c1c76547c2491cd2d)]:
+  - @pracht/core@0.6.0
+
+## 1.3.1
+
+### Patch Changes
+
+- [#137](https://github.com/JoviDeCroock/pracht/pull/137) [`ac32c2c`](https://github.com/JoviDeCroock/pracht/commit/ac32c2cb9ce5e86a38cde1167269e368f41dea0e) Thanks [@JoviDeCroock](https://github.com/JoviDeCroock)! - Harden same-origin request checks and HTML head rendering, improve client prefetch/navigation behavior, fix cross-platform path handling, stream and conditionally revalidate Node static responses, de-document Cloudflare runtime ISG revalidation, and align starter/docs with the current CLI/runtime behavior.
+
+- Updated dependencies [[`ac32c2c`](https://github.com/JoviDeCroock/pracht/commit/ac32c2cb9ce5e86a38cde1167269e368f41dea0e), [`49d6348`](https://github.com/JoviDeCroock/pracht/commit/49d6348bc984464cdb0e8c54c5ef9ba5cdec911e)]:
+  - @pracht/core@0.5.0
+
 ## 1.3.0
 
 ### Minor Changes

package/dist/{build-DkP2ffu9.mjs → build-B7_6RUBf.mjs}

@@ -2,7 +2,8 @@ import { r as VERSION } from "./index.mjs";
 import { t as readClientBuildAssets } from "./build-metadata-BOChHO8g.mjs";
 import { defineCommand } from "citty";
 import { cpSync, existsSync, mkdirSync, readdirSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { pathToFileURL } from "node:url";
 import { build } from "vite";
 //#region src/build-shared.ts
 const ROUTE_STATE_REQUEST_HEADER = "x-pracht-route-state-request";
@@ -145,7 +146,8 @@ var build_default = defineCommand({
 			root,
 			build: {
 				outDir: "dist/server",
-				ssr: "virtual:pracht/server"
+				rollupOptions: { input: "virtual:pracht/server" },
+				ssr: true
 			}
 		});
 		const serverEntry = resolve(root, "dist/server/server.js");
@@ -168,7 +170,7 @@ var build_default = defineCommand({
 		const publicDir = resolve(root, "public");
 		if (existsSync(publicDir)) cpSync(publicDir, clientDir, { recursive: true });
 		if (existsSync(serverEntry)) {
-			const serverMod = await import(serverEntry);
+			const serverMod = await import(pathToFileURL(serverEntry).href);
 			const { prerenderApp } = serverMod;
 			const { clientEntryUrl, cssManifest, jsManifest } = readClientBuildAssets(root);
 			const { pages, isgManifest } = await prerenderApp({
@@ -177,13 +179,14 @@ var build_default = defineCommand({
 				cssManifest,
 				jsManifest,
 				registry: serverMod.registry,
-				withISGManifest: true
+				withISGManifest: true,
+				concurrency: serverMod.prerenderConcurrency
 			});
 			const headersManifest = Object.fromEntries(pages.map((page) => [page.path, page.headers ?? {}]));
 			if (pages.length > 0) {
 				console.log(`\n  Prerendering ${pages.length} SSG/ISG route(s)...\n`);
 				for (const page of pages) {
-					const filePath = page.path === "/" ? join(clientDir, "index.html") : join(clientDir, page.path, "index.html");
+					const filePath = resolvePrerenderOutputPath(clientDir, page.path);
 					mkdirSync(dirname(filePath), { recursive: true });
 					writeFileSync(filePath, page.html, "utf-8");
 					console.log(`    ${page.path} → ${filePath.replace(root + "/", "")}`);
@@ -200,6 +203,7 @@ var build_default = defineCommand({
 				console.log(`\n  ISG manifest → dist/server/isg-manifest.json (${Object.keys(isgManifest).length} route(s))\n`);
 			}
 			if (serverMod.buildTarget === "cloudflare") {
+				if (Object.keys(isgManifest).length > 0) console.warn("\n  Warning: Cloudflare adapter currently serves prerendered ISG HTML as static assets and does not perform runtime revalidation. Use SSR/SSG on Cloudflare, or deploy ISG routes to Node until Cloudflare ISG support is added.\n");
 				console.log("\n  Cloudflare worker → dist/server/server.js\n");
 				console.log("  Deploy with: wrangler deploy\n");
 			}
@@ -218,5 +222,13 @@ var build_default = defineCommand({
 		console.log("\n  Build complete.\n");
 	}
 });
+function resolvePrerenderOutputPath(clientDir, routePath) {
+	if (routePath.includes("\0")) throw new Error(`Refusing to write prerendered route "${routePath}" with a NUL byte.`);
+	const root = resolve(clientDir);
+	const filePath = routePath === "/" ? resolve(root, "index.html") : resolve(root, `.${routePath}`, "index.html");
+	const relativePath = relative(root, filePath);
+	if (relativePath === "" || relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) throw new Error(`Refusing to write prerendered route "${routePath}" outside dist/client (${filePath}).`);
+	return filePath;
+}
 //#endregion
 export { build_default as default };

package/dist/{doctor-B5qYLJF8.mjs → doctor-DyOWEA42.mjs}

@@ -1,4 +1,4 @@
-import { t as runDoctor } from "./verification-WP-KTb41.mjs";
+import { t as runDoctor } from "./verification-CSj-ngqk.mjs";
 import { defineCommand } from "citty";
 //#region src/commands/doctor.ts
 var doctor_default = defineCommand({

package/dist/{generate-C9AMSGsv.mjs → generate-V7pQExlW.mjs}

@@ -1,4 +1,4 @@
-import { _ as requireEnum, a as readProjectConfig, c as resolveProjectPath, d as writeGeneratedFile, f as ensureTrailingNewline, g as quote, h as parseCommaList, l as resolveRouteModulePath, m as parseApiMethods, n as displayPath, o as resolveApiModulePath, s as resolvePagesRouteModulePath, t as assertFileExists, u as resolveScopedFile, v as requirePositiveInteger } from "./project-BdMiN3s7.mjs";
+import { _ as requireEnum, a as readProjectConfig, c as resolveProjectPath, d as writeGeneratedFile, f as ensureTrailingNewline, g as quote, h as parseCommaList, l as resolveRouteModulePath, m as parseApiMethods, n as displayPath, o as resolveApiModulePath, s as resolvePagesRouteModulePath, t as assertFileExists, u as resolveScopedFile, v as requirePositiveInteger } from "./project-voPTS9UC.mjs";
 import { a as toManifestModulePath, i as insertArrayItem, n as extractRegistryEntries, o as upsertObjectEntry, t as ensureCoreNamedImport } from "./manifest-Bs5hp3gA.mjs";
 import { defineCommand } from "citty";
 import { readFileSync, writeFileSync } from "node:fs";

package/dist/index.mjs

@@ -1,6 +1,14 @@
 import { defineCommand, runMain } from "citty";
+import { readFileSync } from "node:fs";
 //#region src/constants.ts
-const VERSION = "0.0.0";
+const VERSION = readPackageVersion();
+function readPackageVersion() {
+	try {
+		return JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf-8")).version ?? "0.0.0";
+	} catch {
+		return "0.0.0";
+	}
+}
 const PROJECT_DEFAULTS = {
 	apiDir: "/src/api",
 	appFile: "/src/routes.ts",
@@ -22,6 +30,10 @@ const HTTP_METHODS = new Set([
 ]);
 //#endregion
 //#region src/index.ts
+if (process.argv.includes("--version") || process.argv.includes("-v")) {
+	console.log(VERSION);
+	process.exit(0);
+}
 runMain(defineCommand({
 	meta: {
 		name: "pracht",
@@ -29,12 +41,12 @@ runMain(defineCommand({
 		description: "The pracht CLI"
 	},
 	subCommands: {
-		build: () => import("./build-DkP2ffu9.mjs").then((m) => m.default),
+		build: () => import("./build-B7_6RUBf.mjs").then((m) => m.default),
 		dev: () => import("./dev-BCFe3g38.mjs").then((m) => m.default),
-		doctor: () => import("./doctor-B5qYLJF8.mjs").then((m) => m.default),
-		generate: () => import("./generate-C9AMSGsv.mjs").then((m) => m.default),
-		inspect: () => import("./inspect-MseHPU9s.mjs").then((m) => m.default),
-		verify: () => import("./verify-Do8bG-fq.mjs").then((m) => m.default)
+		doctor: () => import("./doctor-DyOWEA42.mjs").then((m) => m.default),
+		generate: () => import("./generate-V7pQExlW.mjs").then((m) => m.default),
+		inspect: () => import("./inspect-CFD3-dna.mjs").then((m) => m.default),
+		verify: () => import("./verify-D0pGwcyf.mjs").then((m) => m.default)
 	}
 }));
 //#endregion

package/dist/{inspect-MseHPU9s.mjs → inspect-CFD3-dna.mjs}

@@ -1,6 +1,6 @@
 import { t as HTTP_METHODS } from "./index.mjs";
 import { t as readClientBuildAssets } from "./build-metadata-BOChHO8g.mjs";
-import { a as readProjectConfig, c as resolveProjectPath, p as handleCliError } from "./project-BdMiN3s7.mjs";
+import { a as readProjectConfig, c as resolveProjectPath, p as handleCliError } from "./project-voPTS9UC.mjs";
 import { defineCommand } from "citty";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{project-BdMiN3s7.mjs → project-voPTS9UC.mjs}

@@ -1,6 +1,6 @@
 import { n as PROJECT_DEFAULTS, t as HTTP_METHODS } from "./index.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { basename, dirname, relative, resolve } from "node:path";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 //#region src/utils.ts
 function quote(value) {
 	return JSON.stringify(value);
@@ -64,34 +64,47 @@ function resolveProjectPath(root, configPath) {
 	return resolve(root, `.${configPath}`);
 }
 function resolveScopedFile(root, configDir, fileName) {
-	return resolve(resolveProjectPath(root, configDir), fileName);
+	assertSafePathSegment(fileName.replace(/\.(ts|tsx|js|jsx)$/, ""));
+	const baseDir = resolveProjectPath(root, configDir);
+	const filePath = resolve(baseDir, fileName);
+	assertInsideDirectory(baseDir, filePath);
+	return filePath;
 }
 function resolveRouteModulePath(project, routePath, extension) {
 	const segments = segmentsFromPath(routePath);
 	const relativePath = segments.length === 0 ? `index${extension}` : `${segments.join("/")}${extension}`;
+	const baseDir = resolveProjectPath(project.root, project.routesDir);
+	const absolutePath = resolve(baseDir, relativePath);
+	assertInsideDirectory(baseDir, absolutePath);
 	return {
-		absolutePath: resolve(resolveProjectPath(project.root, project.routesDir), relativePath),
+		absolutePath,
 		relativePath
 	};
 }
 function resolvePagesRouteModulePath(project, routePath, extension) {
 	const segments = segmentsFromPath(routePath);
 	const relativePath = segments.length === 0 ? `index${extension}` : `${segments.join("/")}${extension}`;
+	const baseDir = resolveProjectPath(project.root, project.pagesDir);
+	const absolutePath = resolve(baseDir, relativePath);
+	assertInsideDirectory(baseDir, absolutePath);
 	return {
-		absolutePath: resolve(resolveProjectPath(project.root, project.pagesDir), relativePath),
+		absolutePath,
 		relativePath
 	};
 }
 function resolveApiModulePath(project, endpointPath) {
 	const segments = segmentsFromPath(endpointPath);
 	const relativePath = segments.length === 0 ? "index.ts" : `${segments.join("/")}.ts`;
+	const baseDir = resolveProjectPath(project.root, project.apiDir);
+	const absolutePath = resolve(baseDir, relativePath);
+	assertInsideDirectory(baseDir, absolutePath);
 	return {
-		absolutePath: resolve(resolveProjectPath(project.root, project.apiDir), relativePath),
+		absolutePath,
 		relativePath
 	};
 }
 function displayPath(root, filePath) {
-	return relative(root, filePath) || ".";
+	return (relative(root, filePath) || ".").replace(/\\/g, "/");
 }
 function writeGeneratedFile(filePath, source) {
 	if (existsSync(filePath)) throw new Error(`Refusing to overwrite existing file ${filePath}.`);
@@ -111,7 +124,7 @@ function listFilesRecursively(dir) {
 	return files;
 }
 function hasPagesAppShell(filePath) {
-	return /^_app\.(ts|tsx|js|jsx)$/.test(basename(filePath));
+	return /^_app\.(ts|tsx|tsrx|js|jsx)$/.test(basename(filePath));
 }
 function findConfigFile(root) {
 	for (const name of [
@@ -139,10 +152,23 @@ function normalizeConfigPath(value) {
 }
 function segmentsFromPath(path) {
 	return path.split("/").filter(Boolean).map((segment) => {
-		if (segment.startsWith(":")) return `[${segment.slice(1)}]`;
+		assertSafePathSegment(segment);
+		if (segment.startsWith(":")) {
+			const name = segment.endsWith("*") ? segment.slice(1, -1) : segment.slice(1);
+			assertSafePathSegment(name);
+			return segment.endsWith("*") ? `[...${name || "slug"}]` : `[${name}]`;
+		}
 		if (segment === "*") return "[...slug]";
 		return segment;
 	});
 }
+function assertSafePathSegment(segment) {
+	if (!segment || segment === "." || segment === ".." || segment.includes("/") || segment.includes("\\") || segment.includes("\0")) throw new Error(`Unsafe path segment: ${JSON.stringify(segment)}.`);
+}
+function assertInsideDirectory(baseDir, filePath) {
+	const relativePath = relative(baseDir, filePath);
+	if (relativePath === "" || !relativePath.startsWith("..") && !isAbsolute(relativePath)) return;
+	throw new Error(`Refusing to write outside ${baseDir}.`);
+}
 //#endregion
 export { requireEnum as _, readProjectConfig as a, resolveProjectPath as c, writeGeneratedFile as d, ensureTrailingNewline as f, quote as g, parseCommaList as h, listFilesRecursively as i, resolveRouteModulePath as l, parseApiMethods as m, displayPath as n, resolveApiModulePath as o, handleCliError as p, hasPagesAppShell as r, resolvePagesRouteModulePath as s, assertFileExists as t, resolveScopedFile as u, requirePositiveInteger as v };

package/dist/{verification-WP-KTb41.mjs → verification-CSj-ngqk.mjs}

@@ -1,7 +1,7 @@
-import { a as readProjectConfig, c as resolveProjectPath, i as listFilesRecursively, n as displayPath, r as hasPagesAppShell } from "./project-BdMiN3s7.mjs";
+import { a as readProjectConfig, c as resolveProjectPath, i as listFilesRecursively, n as displayPath, r as hasPagesAppShell } from "./project-voPTS9UC.mjs";
 import { n as extractRegistryEntries, r as extractRelativeModulePaths } from "./manifest-Bs5hp3gA.mjs";
 import { existsSync, readFileSync } from "node:fs";
-import { basename, dirname, relative, resolve } from "node:path";
+import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 //#region src/verification-helpers.ts
 const CONFIG_FILE_NAMES = new Set([
@@ -12,8 +12,8 @@ const CONFIG_FILE_NAMES = new Set([
 	"vite.config.cjs",
 	"vite.config.cts"
 ]);
-const MODULE_SOURCE_RE = /\.(ts|tsx|js|jsx)$/;
-const PAGE_SOURCE_RE = /\.(ts|tsx|js|jsx|md|mdx)$/;
+const MODULE_SOURCE_RE = /\.(ts|tsx|tsrx|js|jsx)$/;
+const PAGE_SOURCE_RE = /\.(ts|tsx|tsrx|js|jsx|md|mdx)$/;
 function createCheck(status, message) {
 	return {
 		message,
@@ -22,7 +22,7 @@ function createCheck(status, message) {
 }
 function isWithinDirectory(filePath, directoryPath) {
 	const relativePath = relative(directoryPath, filePath);
-	return relativePath === "" || !relativePath.startsWith("..") && !relativePath.startsWith("../");
+	return relativePath === "" || !relativePath.startsWith("..") && !isAbsolute(relativePath);
 }
 function normalizePath(value) {
 	return value.replace(/\\/g, "/");
@@ -52,7 +52,7 @@ function scanPagesDirectory(pagesDir) {
 	return listFilesRecursively(pagesDir).filter((file) => PAGE_SOURCE_RE.test(file)).map((file) => describePagesFile(pagesDir, file));
 }
 function describePagesFile(pagesDir, file) {
-	const routePath = relative(pagesDir, file).replace(/\\/g, "/").replace(/\.(tsx?|jsx?|mdx?)$/, "");
+	const routePath = relative(pagesDir, file).replace(/\\/g, "/").replace(/\.(tsx?|tsrx|jsx?|mdx?)$/, "");
 	const name = basename(routePath);
 	if (hasPagesAppShell(file)) return {
 		file,
@@ -271,9 +271,9 @@ function collectChangedFiles(root) {
 			if (!record) continue;
 			if (record.includes(" -> ")) {
 				const [from, to] = record.split(" -> ");
-				addChangedFile(files, repoRoot, prefix, from);
-				addChangedFile(files, repoRoot, prefix, to);
-			} else addChangedFile(files, repoRoot, prefix, record);
+				addChangedFile(files, root, prefix, from);
+				addChangedFile(files, root, prefix, to);
+			} else addChangedFile(files, root, prefix, record);
 		}
 		return {
 			files: [...files],
@@ -286,11 +286,11 @@ function collectChangedFiles(root) {
 		};
 	}
 }
-function addChangedFile(files, repoRoot, prefix, repoRelativePath) {
+function addChangedFile(files, projectRoot, prefix, repoRelativePath) {
 	if (prefix && !repoRelativePath.startsWith(prefix)) return;
 	const projectRelativePath = prefix ? repoRelativePath.slice(prefix.length) : repoRelativePath;
 	if (!projectRelativePath) return;
-	files.add(resolve(repoRoot, projectRelativePath));
+	files.add(resolve(projectRoot, projectRelativePath));
 }
 function filterFrameworkFiles(project, files, packageJsonPath) {
 	const appFile = resolveProjectPath(project.root, project.appFile);

package/dist/{verify-Do8bG-fq.mjs → verify-D0pGwcyf.mjs}

@@ -1,4 +1,4 @@
-import { n as runVerification } from "./verification-WP-KTb41.mjs";
+import { n as runVerification } from "./verification-CSj-ngqk.mjs";
 import { defineCommand } from "citty";
 //#region src/commands/verify.ts
 var verify_default = defineCommand({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pracht/cli",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "license": "MIT",
   "homepage": "https://github.com/JoviDeCroock/pracht/tree/main/packages/cli",
   "bugs": {
@@ -27,7 +27,7 @@
   },
   "dependencies": {
     "citty": "^0.1.6",
-    "@pracht/core": "0.4.0"
+    "@pracht/core": "0.6.0"
   },
   "scripts": {
     "build": "tsdown"