@pracht/core 0.2.7 → 0.4.0

package/dist/index.mjs

@@ -172,14 +172,26 @@ function buildPathFromSegments(segments, params) {
 	return normalizeRoutePath("/" + segments.map((segment) => {
 		if (segment.type === "static") return segment.value;
 		if (segment.type === "param") return encodeURIComponent(params[segment.name] ?? "");
-		return params["*"] ?? "";
+		return (params["*"] ?? "").split("/").map((part) => encodeCatchAllSegment(part)).join("/");
 	}).join("/"));
 }
 /**
+* Encode a single path segment for a catch-all route. `encodeURIComponent`
+* leaves unreserved characters (including `.`) intact, so `..` would
+* round-trip unchanged and still resolve as parent-dir in `path.join`.
+* Explicitly percent-encode `.` / `..` segments to neutralise them.
+*/
+function encodeCatchAllSegment(part) {
+	if (part === ".") return "%2E";
+	if (part === "..") return "%2E%2E";
+	return encodeURIComponent(part);
+}
+/**
 * Convert a list of file paths from `import.meta.glob` into resolved API routes.
 *
 * Example: `"/src/api/health.ts"` → path `/api/health`
 *          `"/src/api/users/[id].ts"` → path `/api/users/:id`
+*          `"/src/api/files/[...path].ts"` → path `/api/files/*`
 *          `"/src/api/index.ts"` → path `/api`
 */
 function resolveApiRoutes(files, apiDir = "/src/api") {
@@ -189,6 +201,7 @@ function resolveApiRoutes(files, apiDir = "/src/api") {
 		if (relative.startsWith(normalizedDir)) relative = relative.slice(normalizedDir.length);
 		relative = relative.replace(/\.(ts|tsx|js|jsx)$/, "");
 		if (relative.endsWith("/index")) relative = relative.slice(0, -6) || "/";
+		relative = relative.replace(/\[\.\.\.[^\]]+\]/g, "*");
 		relative = relative.replace(/\[([^\]]+)\]/g, ":$1");
 		const path = normalizeRoutePath(`/api${relative}`);
 		return {
@@ -309,18 +322,257 @@ function useIsHydrated() {
 	return hydrated;
 }
 //#endregion
-//#region src/runtime.ts
+//#region src/runtime-constants.ts
 const SAFE_METHODS = new Set(["GET", "HEAD"]);
 const HYDRATION_STATE_ELEMENT_ID = "pracht-state";
 const ROUTE_STATE_REQUEST_HEADER = "x-pracht-route-state-request";
 const ROUTE_STATE_CACHE_CONTROL = "no-store";
 const EMPTY_ROUTE_PARAMS = {};
-let _renderToStringAsync;
-async function getRenderToStringAsync() {
-	if (_renderToStringAsync) return _renderToStringAsync;
-	_renderToStringAsync = (await import("preact-render-to-string")).renderToStringAsync;
-	return _renderToStringAsync;
+//#endregion
+//#region src/runtime-errors.ts
+function isPrachtHttpError(error) {
+	return error instanceof Error && error.name === "PrachtHttpError" && "status" in error;
+}
+let warnedAboutProductionDebugErrors = false;
+/**
+* `debugErrors: true` opts into surfacing stack traces, module paths,
+* and middleware names in error responses. That is great in dev and
+* dangerous in production — a misconfigured deploy would leak internals
+* to the public. When `NODE_ENV === "production"` we refuse to honor
+* the flag and emit a single console warning so the misconfiguration
+* is visible in logs.
+*/
+function shouldExposeServerErrors(options) {
+	if (options.debugErrors !== true) return false;
+	if ((typeof process !== "undefined" && process.env ? process.env.NODE_ENV : typeof globalThis !== "undefined" && globalThis.process ? globalThis.process?.env?.NODE_ENV : void 0) === "production") {
+		if (!warnedAboutProductionDebugErrors) {
+			warnedAboutProductionDebugErrors = true;
+			console.warn("[pracht] debugErrors is ignored in production builds. Remove it to silence this warning.");
+		}
+		return false;
+	}
+	return true;
+}
+function createSerializedRouteError(message, status, options = {}) {
+	return {
+		message,
+		name: options.name ?? "Error",
+		status,
+		...options.diagnostics ? { diagnostics: options.diagnostics } : {}
+	};
+}
+function buildRuntimeDiagnostics(options) {
+	const route = options.route;
+	const routeId = route && "id" in route ? route.id : void 0;
+	return {
+		phase: options.phase,
+		routeId,
+		routePath: route?.path,
+		routeFile: route?.file,
+		loaderFile: options.loaderFile,
+		shellFile: options.shellFile,
+		middlewareFiles: options.middlewareFiles ? [...options.middlewareFiles] : [],
+		status: options.status
+	};
+}
+function normalizeRouteError(error, options) {
+	if (isPrachtHttpError(error)) {
+		const status = typeof error.status === "number" ? error.status : 500;
+		if (status >= 400 && status < 500) return {
+			message: error.message,
+			name: error.name,
+			status
+		};
+		if (options.exposeDetails) return {
+			message: error.message || "Internal Server Error",
+			name: error.name || "Error",
+			status
+		};
+		return {
+			message: "Internal Server Error",
+			name: "Error",
+			status
+		};
+	}
+	if (error instanceof Error) {
+		if (options.exposeDetails) return {
+			message: error.message || "Internal Server Error",
+			name: error.name || "Error",
+			status: 500
+		};
+		return {
+			message: "Internal Server Error",
+			name: "Error",
+			status: 500
+		};
+	}
+	if (options.exposeDetails) return {
+		message: typeof error === "string" && error ? error : "Internal Server Error",
+		name: "Error",
+		status: 500
+	};
+	return {
+		message: "Internal Server Error",
+		name: "Error",
+		status: 500
+	};
+}
+function deserializeRouteError(error) {
+	const result = new Error(error.message);
+	result.name = error.name;
+	result.status = error.status;
+	result.diagnostics = error.diagnostics;
+	return result;
+}
+//#endregion
+//#region src/runtime-headers.ts
+const HEADER_CRLF_RE = /[\r\n]/;
+/**
+* Reject header values containing CR/LF. Some runtimes (Node `undici`
+* Headers) throw on their own, but Web-runtime fetch implementations
+* vary, and a user-supplied `headers()` value is never trusted input.
+* Keeping the check here means response-splitting can't slip through on
+* any adapter.
+*/
+function assertSafeHeaderValue(name, value) {
+	if (HEADER_CRLF_RE.test(value)) throw new Error(`Refused to set header "${name}": value contains CR or LF`);
+}
+function applyHeaders(headers, init) {
+	for (const [key, value] of iterateHeaderInit(init)) assertSafeHeaderValue(key, value);
+	new Headers(init).forEach((value, key) => {
+		headers.set(key, value);
+	});
+}
+function* iterateHeaderInit(init) {
+	if (init instanceof Headers) {
+		for (const entry of init.entries()) yield entry;
+		return;
+	}
+	if (Array.isArray(init)) {
+		for (const entry of init) if (entry && entry.length >= 2) yield [entry[0], entry[1]];
+		return;
+	}
+	for (const [key, value] of Object.entries(init)) yield [key, value];
+}
+function applyDefaultSecurityHeaders(headers) {
+	if (!headers.has("permissions-policy")) headers.set("permissions-policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()");
+	if (!headers.has("referrer-policy")) headers.set("referrer-policy", "strict-origin-when-cross-origin");
+	if (!headers.has("x-content-type-options")) headers.set("x-content-type-options", "nosniff");
+	if (!headers.has("x-frame-options")) headers.set("x-frame-options", "SAMEORIGIN");
+	return headers;
+}
+function applySecurityAndRouteHeaders(headers, options) {
+	applyDefaultSecurityHeaders(headers);
+	if (options) {
+		appendVaryHeader(headers, ROUTE_STATE_REQUEST_HEADER);
+		if (options.isRouteStateRequest && !headers.has("cache-control")) headers.set("cache-control", ROUTE_STATE_CACHE_CONTROL);
+	}
+	return headers;
+}
+function withDefaultSecurityHeaders(response) {
+	const headers = new Headers(response.headers);
+	applySecurityAndRouteHeaders(headers);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+function withRouteResponseHeaders(response, options) {
+	const headers = new Headers(response.headers);
+	applySecurityAndRouteHeaders(headers, options);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+function appendVaryHeader(headers, value) {
+	const current = headers.get("vary");
+	if (!current) {
+		headers.set("vary", value);
+		return;
+	}
+	const values = current.split(",").map((part) => part.trim().toLowerCase()).filter(Boolean);
+	if (values.includes("*") || values.includes(value.toLowerCase())) return;
+	headers.set("vary", `${current}, ${value}`);
+}
+//#endregion
+//#region src/runtime-client-fetch.ts
+const SAFE_NAVIGATION_PROTOCOLS = new Set(["http:", "https:"]);
+/**
+* Parse a possibly-server-supplied redirect target against a base URL and
+* return it only if it uses a safe navigation scheme (`http:` or `https:`).
+*
+* `javascript:`, `data:`, `vbscript:`, `blob:`, `file:` and similar schemes
+* can execute script or bypass same-origin assumptions when assigned to
+* `window.location.href` — a server-controlled redirect (from a loader,
+* middleware, form action response, or API route) must never be able to
+* trigger them. Returns `null` for unsafe or unparseable inputs.
+*/
+function parseSafeNavigationUrl(location, base) {
+	let targetUrl;
+	try {
+		targetUrl = new URL(location, base);
+	} catch {
+		return null;
+	}
+	if (!SAFE_NAVIGATION_PROTOCOLS.has(targetUrl.protocol)) return null;
+	return targetUrl;
+}
+function buildRouteStateUrl(url) {
+	return `${url}${url.includes("?") ? "&" : "?"}_data=1`;
+}
+async function fetchPrachtRouteState(url, options) {
+	const fetchUrl = options?.useDataParam ? buildRouteStateUrl(url) : url;
+	const response = await fetch(fetchUrl, {
+		headers: options?.useDataParam ? {} : {
+			[ROUTE_STATE_REQUEST_HEADER]: "1",
+			"Cache-Control": "no-cache"
+		},
+		redirect: "manual"
+	});
+	if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) return {
+		location: response.headers.get("location") ?? url,
+		type: "redirect"
+	};
+	const json = await response.json();
+	if (json.redirect) return {
+		location: json.redirect,
+		type: "redirect"
+	};
+	if (!response.ok) {
+		if (json.error) return {
+			error: json.error,
+			type: "error"
+		};
+		throw new Error(`Failed to fetch route state (${response.status})`);
+	}
+	return {
+		data: json.data,
+		type: "data"
+	};
+}
+async function navigateToClientLocation(location, options) {
+	if (typeof window === "undefined") return;
+	const targetUrl = parseSafeNavigationUrl(location, window.location.href);
+	if (!targetUrl) {
+		console.error(`[pracht] refused to navigate to unsafe URL: ${location}`);
+		return;
+	}
+	const target = targetUrl.pathname + targetUrl.search + targetUrl.hash;
+	if (targetUrl.origin === window.location.origin && window.__PRACHT_NAVIGATE__) {
+		await window.__PRACHT_NAVIGATE__(target, options);
+		return;
+	}
+	if (options?.replace) {
+		window.location.replace(targetUrl.toString());
+		return;
+	}
+	window.location.href = targetUrl.toString();
 }
+//#endregion
+//#region src/runtime-hooks.ts
 const RouteDataContext = createContext(void 0);
 function PrachtRuntimeProvider({ children, data, params = EMPTY_ROUTE_PARAMS, routeId, stateVersion = 0, url }) {
 	const [routeDataState, setRouteDataState] = useState({
@@ -428,251 +680,60 @@ function Form(props) {
 		}
 	});
 }
-async function fetchPrachtRouteState(url, options) {
-	const fetchUrl = options?.useDataParam ? buildRouteStateUrl(url) : url;
-	const response = await fetch(fetchUrl, {
-		headers: options?.useDataParam ? {} : {
-			[ROUTE_STATE_REQUEST_HEADER]: "1",
-			"Cache-Control": "no-cache"
-		},
-		redirect: "manual"
-	});
-	if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) return {
-		location: response.headers.get("location") ?? url,
-		type: "redirect"
-	};
-	const json = await response.json();
-	if (json.redirect) return {
-		location: json.redirect,
-		type: "redirect"
-	};
-	if (!response.ok) {
-		if (json.error) return {
-			error: json.error,
-			type: "error"
-		};
-		throw new Error(`Failed to fetch route state (${response.status})`);
-	}
+function parseLocation(value) {
+	const url = new URL(value, "http://pracht.local");
 	return {
-		data: json.data,
-		type: "data"
+		pathname: url.pathname,
+		search: url.search
 	};
 }
-function buildRouteStateUrl(url) {
-	return `${url}${url.includes("?") ? "&" : "?"}_data=1`;
+//#endregion
+//#region src/runtime-html.ts
+function escapeHtml(str) {
+	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
-async function handlePrachtRequest(options) {
-	const url = new URL(options.request.url);
-	const hasDataParam = url.searchParams.get("_data") === "1";
-	if (hasDataParam) url.searchParams.delete("_data");
-	const requestPath = getRequestPath(url);
-	const registry = options.registry ?? {};
-	const isRouteStateRequest = options.request.headers.get(ROUTE_STATE_REQUEST_HEADER) === "1" || hasDataParam;
-	const exposeDiagnostics = shouldExposeServerErrors(options);
-	if (options.apiRoutes?.length) {
-		const apiMatch = matchApiRoute(options.apiRoutes, url.pathname);
-		if (apiMatch) {
-			const apiMiddlewareFiles = (options.app.api.middleware ?? []).flatMap((name) => {
-				const middlewareFile = options.app.middleware[name];
-				return middlewareFile ? [middlewareFile] : [];
-			});
-			let currentPhase = "middleware";
-			try {
-				const middlewareResult = await runMiddlewareChain({
-					context: options.context ?? {},
-					middlewareFiles: apiMiddlewareFiles,
-					params: apiMatch.params,
-					registry,
-					request: options.request,
-					route: apiMatch.route,
-					url
-				});
-				if (middlewareResult.response) return middlewareResult.response;
-				currentPhase = "api";
-				const apiModule = await resolveRegistryModule(registry.apiModules, apiMatch.route.file);
-				if (!apiModule) throw new Error("API route module not found");
-				const handler = apiModule[options.request.method.toUpperCase()] ?? apiModule.default;
-				if (!handler) return withDefaultSecurityHeaders(new Response("Method not allowed", {
-					status: 405,
-					headers: { "content-type": "text/plain; charset=utf-8" }
-				}));
-				return withDefaultSecurityHeaders(await handler({
-					request: options.request,
-					params: apiMatch.params,
-					context: middlewareResult.context,
-					signal: AbortSignal.timeout(3e4),
-					url,
-					route: apiMatch.route
-				}));
-			} catch (error) {
-				return renderApiErrorResponse({
-					error,
-					middlewareFiles: apiMiddlewareFiles,
-					options,
-					phase: currentPhase,
-					route: apiMatch.route
-				});
-			}
-		}
-	}
-	const match = matchAppRoute(options.app, url.pathname);
-	if (!match) {
-		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Not found", 404, {
-			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
-				phase: "match",
-				status: 404
-			}) : void 0,
-			name: "Error"
-		}), { isRouteStateRequest: true });
-		return withDefaultSecurityHeaders(new Response("Not found", {
-			status: 404,
-			headers: { "content-type": "text/plain; charset=utf-8" }
-		}));
-	}
-	if (!SAFE_METHODS.has(options.request.method)) {
-		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Method not allowed", 405, {
-			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
-				middlewareFiles: match.route.middlewareFiles,
-				phase: "action",
-				route: match.route,
-				shellFile: match.route.shellFile,
-				status: 405
-			}) : void 0,
-			name: "Error"
-		}), { isRouteStateRequest: true });
-		return withRouteResponseHeaders(new Response("Method not allowed", {
-			status: 405,
-			headers: { "content-type": "text/plain; charset=utf-8" }
-		}), { isRouteStateRequest });
-	}
-	let routeArgs = {
-		request: options.request,
-		params: match.params,
-		context: options.context ?? {},
-		signal: AbortSignal.timeout(3e4),
-		url,
-		route: match.route
-	};
-	let routeModule;
-	let shellModule;
-	let loaderFile;
-	let currentPhase = "middleware";
-	try {
-		const middlewarePromise = runMiddlewareChain({
-			context: routeArgs.context,
-			middlewareFiles: match.route.middlewareFiles,
-			params: match.params,
-			registry,
-			request: options.request,
-			route: match.route,
-			url
-		});
-		const routeModulePromise = resolveRegistryModule(registry.routeModules, match.route.file);
-		const shellModulePromise = match.route.shellFile ? resolveRegistryModule(registry.shellModules, match.route.shellFile) : Promise.resolve(void 0);
-		const dataFunctionsPromise = routeModulePromise.then((mod) => resolveDataFunctions(match.route, mod, registry));
-		routeModulePromise.catch(() => {});
-		shellModulePromise.catch(() => {});
-		dataFunctionsPromise.catch(() => {});
-		const middlewareResult = await middlewarePromise;
-		if (middlewareResult.response) return normalizePageResponse(middlewareResult.response, { isRouteStateRequest });
-		routeArgs = {
-			...routeArgs,
-			context: middlewareResult.context
-		};
-		currentPhase = "render";
-		routeModule = await routeModulePromise;
-		if (!routeModule) throw new Error("Route module not found");
-		currentPhase = "loader";
-		const { loader, loaderFile: resolvedLoaderFile } = await dataFunctionsPromise;
-		loaderFile = resolvedLoaderFile;
-		const loaderResult = loader ? await loader(routeArgs) : void 0;
-		if (loaderResult instanceof Response) return normalizePageResponse(loaderResult, { isRouteStateRequest });
-		const data = loaderResult;
-		if (isRouteStateRequest) return withRouteResponseHeaders(Response.json({ data }), { isRouteStateRequest: true });
-		currentPhase = "render";
-		shellModule = await shellModulePromise;
-		const [head, documentHeaders] = await Promise.all([mergeHeadMetadata(shellModule, routeModule, routeArgs, data), mergeDocumentHeaders(shellModule, routeModule, routeArgs, data)]);
-		const cssUrls = resolvePageCssUrls(options, match.route.shellFile, match.route.file);
-		const modulePreloadUrls = resolvePageJsUrls(options, match.route.shellFile, match.route.file);
-		if (match.route.render === "spa") {
-			let body = "";
-			if (shellModule?.Shell || shellModule?.Loading) {
-				const Shell = shellModule?.Shell;
-				const Loading = shellModule?.Loading;
-				const loadingTree = Shell != null ? h(Shell, null, Loading ? h(Loading, null) : null) : Loading ? h(Loading, null) : null;
-				if (loadingTree) body = await (await getRenderToStringAsync())(loadingTree);
-			}
-			return htmlResponse(buildHtmlDocument({
-				head,
-				body,
-				hydrationState: {
-					url: requestPath,
-					routeId: match.route.id ?? "",
-					data: null,
-					error: null,
-					pending: true
-				},
-				clientEntryUrl: options.clientEntryUrl,
-				cssUrls,
-				modulePreloadUrls,
-				routeStatePreloadUrl: loader ? buildRouteStateUrl(requestPath) : void 0
-			}), 200, documentHeaders);
-		}
-		const DefaultComponent = typeof routeModule.default === "function" ? routeModule.default : void 0;
-		const Component = routeModule.Component ?? DefaultComponent;
-		if (!Component) throw new Error("Route has no Component or default export");
-		const Shell = shellModule?.Shell;
-		const Comp = Component;
-		const componentProps = {
-			data,
-			params: match.params
-		};
-		const componentTree = Shell ? h(Shell, null, h(Comp, componentProps)) : h(Comp, componentProps);
-		const tree = h(PrachtRuntimeProvider, {
-			data,
-			params: match.params,
-			routeId: match.route.id ?? "",
-			url: requestPath
-		}, componentTree);
-		return htmlResponse(buildHtmlDocument({
-			head,
-			body: await (await getRenderToStringAsync())(tree),
-			hydrationState: {
-				url: requestPath,
-				routeId: match.route.id ?? "",
-				data,
-				error: null
-			},
-			clientEntryUrl: options.clientEntryUrl,
-			cssUrls,
-			modulePreloadUrls
-		}), 200, documentHeaders);
-	} catch (error) {
-		return renderRouteErrorResponse({
-			error,
-			isRouteStateRequest,
-			loaderFile,
-			options,
-			phase: currentPhase,
-			routeArgs,
-			routeId: match.route.id ?? "",
-			routeModule,
-			shellFile: match.route.shellFile,
-			shellModule,
-			requestPath
-		});
-	}
+function serializeJsonForHtml(value) {
+	return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
-function parseLocation(value) {
-	const url = new URL(value, "http://pracht.local");
-	return {
-		pathname: url.pathname,
-		search: url.search
-	};
+function buildHtmlDocument(options) {
+	const { head, body, hydrationState, clientEntryUrl, cssUrls = [], modulePreloadUrls = [], routeStatePreloadUrl } = options;
+	const titleTag = head.title ? `<title>${escapeHtml(head.title)}</title>` : "";
+	const metaTags = (head.meta ?? []).map((m) => `<meta ${Object.entries(m).map(([k, v]) => `${k}="${escapeHtml(v)}"`).join(" ")}>`).join("\n    ");
+	const linkTags = (head.link ?? []).map((l) => `<link ${Object.entries(l).map(([k, v]) => `${k}="${escapeHtml(v)}"`).join(" ")}>`).join("\n    ");
+	const cssTags = cssUrls.map((url) => `<link rel="stylesheet" href="${escapeHtml(url)}">`).join("\n    ");
+	const modulePreloadTags = modulePreloadUrls.map((url) => `<link rel="modulepreload" href="${escapeHtml(url)}">`).join("\n    ");
+	const routeStatePreloadTag = routeStatePreloadUrl ? `<link rel="preload" as="fetch" href="${escapeHtml(routeStatePreloadUrl)}" crossorigin="anonymous">` : "";
+	const stateScript = `<script id="${HYDRATION_STATE_ELEMENT_ID}" type="application/json">${serializeJsonForHtml(hydrationState)}<\/script>`;
+	const entryScript = clientEntryUrl ? `<script type="module" src="${escapeHtml(clientEntryUrl)}"><\/script>` : "";
+	return `<!DOCTYPE html>
+<html${head.lang ? ` lang="${escapeHtml(head.lang)}"` : ""}>
+  <head>
+    <meta charset="utf-8">
+    ${titleTag}
+    ${metaTags}
+    ${linkTags}
+    ${cssTags}
+    ${modulePreloadTags}
+    ${routeStatePreloadTag}
+  </head>
+  <body>
+    <div id="pracht-root">${body}</div>
+    ${stateScript}
+    ${entryScript}
+  </body>
+</html>`;
 }
-function getRequestPath(url) {
-	return `${url.pathname}${url.search}`;
+function htmlResponse(html, status = 200, initHeaders) {
+	const headers = new Headers({ "content-type": "text/html; charset=utf-8" });
+	if (initHeaders) applyHeaders(headers, initHeaders);
+	applySecurityAndRouteHeaders(headers, { isRouteStateRequest: false });
+	return new Response(html, {
+		status,
+		headers
+	});
 }
+//#endregion
+//#region src/runtime-manifest.ts
 /** Strip leading `./` and `/` so all module paths share one canonical form. */
 function normalizeModulePath(path) {
 	return path.replace(/^\.?\//, "");
@@ -713,104 +774,122 @@ function resolvePageUrlsFromManifest(manifest, shellFile, routeFile) {
 	add(routeFile);
 	return [...urls];
 }
-function resolvePageCssUrls(options, shellFile, routeFile) {
-	if (!options.cssManifest) return [];
-	return resolvePageUrlsFromManifest(options.cssManifest, shellFile, routeFile);
+function resolvePageCssUrls(cssManifest, shellFile, routeFile) {
+	if (!cssManifest) return [];
+	return resolvePageUrlsFromManifest(cssManifest, shellFile, routeFile);
 }
-function resolvePageJsUrls(options, shellFile, routeFile) {
-	if (!options.jsManifest) return [];
-	return resolvePageUrlsFromManifest(options.jsManifest, shellFile, routeFile);
+function resolvePageJsUrls(jsManifest, shellFile, routeFile) {
+	if (!jsManifest) return [];
+	return resolvePageUrlsFromManifest(jsManifest, shellFile, routeFile);
 }
-async function navigateToClientLocation(location, options) {
-	if (typeof window === "undefined") return;
-	const targetUrl = new URL(location, window.location.href);
-	const target = targetUrl.pathname + targetUrl.search + targetUrl.hash;
-	if (targetUrl.origin === window.location.origin && window.__PRACHT_NAVIGATE__) {
-		await window.__PRACHT_NAVIGATE__(target, options);
-		return;
-	}
-	if (options?.replace) {
-		window.location.replace(targetUrl.toString());
-		return;
-	}
-	window.location.href = targetUrl.toString();
-}
-function isPrachtHttpError(error) {
-	return error instanceof Error && error.name === "PrachtHttpError" && "status" in error;
-}
-function shouldExposeServerErrors(options) {
-	return options.debugErrors === true;
+async function resolveRegistryModule(modules, file) {
+	if (!modules) return void 0;
+	if (file in modules) return modules[file]();
+	const resolved = getSuffixIndex(modules).get(normalizeModulePath(file));
+	if (resolved) return modules[resolved]();
 }
-function createSerializedRouteError(message, status, options = {}) {
+async function resolveDataFunctions(route, routeModule, registry) {
+	let loader = routeModule?.loader;
+	let loaderFile = routeModule?.loader ? route.file : void 0;
+	if (route.loaderFile) {
+		const dataModule = await resolveRegistryModule(registry.dataModules, route.loaderFile);
+		if (dataModule?.loader) {
+			loader = dataModule.loader;
+			loaderFile = route.loaderFile;
+		}
+	}
 	return {
-		message,
-		name: options.name ?? "Error",
-		status,
-		...options.diagnostics ? { diagnostics: options.diagnostics } : {}
+		loader,
+		loaderFile
 	};
 }
-function buildRuntimeDiagnostics(options) {
-	const route = options.route;
-	const routeId = route && "id" in route ? route.id : void 0;
-	return {
-		phase: options.phase,
-		routeId,
-		routePath: route?.path,
-		routeFile: route?.file,
-		loaderFile: options.loaderFile,
-		shellFile: options.shellFile,
-		middlewareFiles: options.middlewareFiles ? [...options.middlewareFiles] : [],
-		status: options.status
-	};
+//#endregion
+//#region src/runtime-middleware.ts
+const DEFAULT_REDIRECT_STATUS_SAFE = 302;
+const DEFAULT_REDIRECT_STATUS_UNSAFE = 303;
+/**
+* Build a safe redirect response from middleware/loader output. Rejects
+* non-http(s) schemes (no `javascript:`/`data:`/etc.) and CR/LF injection
+* against the `Location` header. When status is omitted, non-GET/HEAD
+* requests default to 303 so the browser does not resend the body to the
+* redirect target; safe methods default to 302.
+*
+* The original `target` string is preserved on success (relative paths
+* stay relative) — we only parse it to validate scheme, not to rewrite
+* it. Both the original input and its resolved URL must be CR/LF-free.
+*/
+function buildRedirectResponse(target, options) {
+	if (/[\r\n]/.test(target)) throw new Error("Refused redirect target containing CR/LF");
+	if (!parseSafeNavigationUrl(target, options.baseUrl)) throw new Error("Refused unsafe redirect target");
+	const method = (options.method ?? "GET").toUpperCase();
+	const defaultStatus = SAFE_METHODS.has(method) ? DEFAULT_REDIRECT_STATUS_SAFE : DEFAULT_REDIRECT_STATUS_UNSAFE;
+	const status = options.status ?? defaultStatus;
+	return new Response(null, {
+		status,
+		headers: { location: target }
+	});
 }
-function normalizeRouteError(error, options) {
-	if (isPrachtHttpError(error)) {
-		const status = typeof error.status === "number" ? error.status : 500;
-		if (status >= 400 && status < 500) return {
-			message: error.message,
-			name: error.name,
-			status
-		};
-		if (options.exposeDetails) return {
-			message: error.message || "Internal Server Error",
-			name: error.name || "Error",
-			status
-		};
-		return {
-			message: "Internal Server Error",
-			name: "Error",
-			status
-		};
-	}
-	if (error instanceof Error) {
-		if (options.exposeDetails) return {
-			message: error.message || "Internal Server Error",
-			name: error.name || "Error",
-			status: 500
-		};
-		return {
-			message: "Internal Server Error",
-			name: "Error",
-			status: 500
+async function runMiddlewareChain(options) {
+	let context = options.context;
+	const modulePromises = options.middlewareFiles.map((mwFile) => resolveRegistryModule(options.registry.middlewareModules, mwFile));
+	for (const p of modulePromises) p.catch(() => {});
+	for (const modulePromise of modulePromises) {
+		const mwModule = await modulePromise;
+		if (!mwModule?.middleware) continue;
+		const result = await mwModule.middleware({
+			request: options.request,
+			params: options.params,
+			context,
+			signal: AbortSignal.timeout(3e4),
+			url: options.url,
+			route: options.route
+		});
+		if (!result) continue;
+		if (result instanceof Response) return { response: withDefaultSecurityHeaders(result) };
+		if ("redirect" in result) {
+			const status = "status" in result ? result.status : void 0;
+			return { response: withDefaultSecurityHeaders(buildRedirectResponse(result.redirect, {
+				baseUrl: options.request.url,
+				method: options.request.method,
+				status
+			})) };
+		}
+		if ("context" in result) context = {
+			...context,
+			...result.context
 		};
 	}
-	if (options.exposeDetails) return {
-		message: typeof error === "string" && error ? error : "Internal Server Error",
-		name: "Error",
-		status: 500
-	};
+	return { context };
+}
+async function mergeHeadMetadata(shellModule, routeModule, routeArgs, data) {
+	const [shellHead, routeHead] = await Promise.all([shellModule?.head ? shellModule.head(routeArgs) : Promise.resolve({}), routeModule?.head ? routeModule.head({
+		...routeArgs,
+		data
+	}) : Promise.resolve({})]);
 	return {
-		message: "Internal Server Error",
-		name: "Error",
-		status: 500
+		title: routeHead.title ?? shellHead.title,
+		lang: routeHead.lang ?? shellHead.lang,
+		meta: [...shellHead.meta ?? [], ...routeHead.meta ?? []],
+		link: [...shellHead.link ?? [], ...routeHead.link ?? []]
 	};
 }
-function deserializeRouteError(error) {
-	const result = new Error(error.message);
-	result.name = error.name;
-	result.status = error.status;
-	result.diagnostics = error.diagnostics;
-	return result;
+async function mergeDocumentHeaders(shellModule, routeModule, routeArgs, data) {
+	const headers = new Headers();
+	const [shellHeaders, routeHeaders] = await Promise.all([shellModule?.headers ? shellModule.headers(routeArgs) : Promise.resolve(void 0), routeModule?.headers ? routeModule.headers({
+		...routeArgs,
+		data
+	}) : Promise.resolve(void 0)]);
+	if (shellHeaders) applyHeaders(headers, shellHeaders);
+	if (routeHeaders) applyHeaders(headers, routeHeaders);
+	return headers;
+}
+//#endregion
+//#region src/runtime-response.ts
+let _renderToStringAsync;
+async function getRenderToStringAsync() {
+	if (_renderToStringAsync) return _renderToStringAsync;
+	_renderToStringAsync = (await import("preact-render-to-string")).renderToStringAsync;
+	return _renderToStringAsync;
 }
 function jsonErrorResponse(routeError, options) {
 	const headers = applySecurityAndRouteHeaders(new Headers({ "content-type": "application/json; charset=utf-8" }), options.isRouteStateRequest ? { isRouteStateRequest: true } : void 0);
@@ -882,8 +961,8 @@ async function renderRouteErrorResponse(options) {
 	const shellModule = options.shellModule ?? (options.shellFile ? await resolveRegistryModule(options.options.registry?.shellModules, options.shellFile) : void 0);
 	const head = shellModule?.head ? await shellModule.head(options.routeArgs) : {};
 	const documentHeaders = await mergeDocumentHeaders(shellModule, void 0, options.routeArgs, void 0);
-	const cssUrls = resolvePageCssUrls(options.options, options.shellFile, options.routeArgs.route.file);
-	const modulePreloadUrls = resolvePageJsUrls(options.options, options.shellFile, options.routeArgs.route.file);
+	const cssUrls = resolvePageCssUrls(options.options.cssManifest, options.shellFile, options.routeArgs.route.file);
+	const modulePreloadUrls = resolvePageJsUrls(options.options.jsManifest, options.shellFile, options.routeArgs.route.file);
 	const renderToString = await getRenderToStringAsync();
 	const ErrorBoundary = options.routeModule.ErrorBoundary;
 	const Shell = shellModule?.Shell;
@@ -903,172 +982,328 @@ async function renderRouteErrorResponse(options) {
 			error: routeErrorWithDiagnostics
 		},
 		clientEntryUrl: options.options.clientEntryUrl,
-		cssUrls,
-		modulePreloadUrls
-	}), routeErrorWithDiagnostics.status, documentHeaders);
-}
-async function runMiddlewareChain(options) {
-	let context = options.context;
-	const modulePromises = options.middlewareFiles.map((mwFile) => resolveRegistryModule(options.registry.middlewareModules, mwFile));
-	for (const p of modulePromises) p.catch(() => {});
-	for (const modulePromise of modulePromises) {
-		const mwModule = await modulePromise;
-		if (!mwModule?.middleware) continue;
-		const result = await mwModule.middleware({
-			request: options.request,
-			params: options.params,
-			context,
-			signal: AbortSignal.timeout(3e4),
-			url: options.url,
-			route: options.route
-		});
-		if (!result) continue;
-		if (result instanceof Response) return { response: withDefaultSecurityHeaders(result) };
-		if ("redirect" in result) return { response: withDefaultSecurityHeaders(new Response(null, {
-			status: 302,
-			headers: { location: result.redirect }
-		})) };
-		if ("context" in result) context = {
-			...context,
-			...result.context
-		};
-	}
-	return { context };
-}
-async function resolveDataFunctions(route, routeModule, registry) {
-	let loader = routeModule?.loader;
-	let loaderFile = routeModule?.loader ? route.file : void 0;
-	if (route.loaderFile) {
-		const dataModule = await resolveRegistryModule(registry.dataModules, route.loaderFile);
-		if (dataModule?.loader) {
-			loader = dataModule.loader;
-			loaderFile = route.loaderFile;
-		}
-	}
-	return {
-		loader,
-		loaderFile
-	};
-}
-async function resolveRegistryModule(modules, file) {
-	if (!modules) return void 0;
-	if (file in modules) return modules[file]();
-	const resolved = getSuffixIndex(modules).get(normalizeModulePath(file));
-	if (resolved) return modules[resolved]();
-}
-async function mergeHeadMetadata(shellModule, routeModule, routeArgs, data) {
-	const [shellHead, routeHead] = await Promise.all([shellModule?.head ? shellModule.head(routeArgs) : Promise.resolve({}), routeModule?.head ? routeModule.head({
-		...routeArgs,
-		data
-	}) : Promise.resolve({})]);
-	return {
-		title: routeHead.title ?? shellHead.title,
-		lang: routeHead.lang ?? shellHead.lang,
-		meta: [...shellHead.meta ?? [], ...routeHead.meta ?? []],
-		link: [...shellHead.link ?? [], ...routeHead.link ?? []]
-	};
-}
-async function mergeDocumentHeaders(shellModule, routeModule, routeArgs, data) {
-	const headers = new Headers();
-	const [shellHeaders, routeHeaders] = await Promise.all([shellModule?.headers ? shellModule.headers(routeArgs) : Promise.resolve(void 0), routeModule?.headers ? routeModule.headers({
-		...routeArgs,
-		data
-	}) : Promise.resolve(void 0)]);
-	if (shellHeaders) applyHeaders(headers, shellHeaders);
-	if (routeHeaders) applyHeaders(headers, routeHeaders);
-	return headers;
-}
-function applyHeaders(headers, init) {
-	new Headers(init).forEach((value, key) => {
-		headers.set(key, value);
-	});
-}
-function buildHtmlDocument(options) {
-	const { head, body, hydrationState, clientEntryUrl, cssUrls = [], modulePreloadUrls = [], routeStatePreloadUrl } = options;
-	const titleTag = head.title ? `<title>${escapeHtml(head.title)}</title>` : "";
-	const metaTags = (head.meta ?? []).map((m) => `<meta ${Object.entries(m).map(([k, v]) => `${k}="${escapeHtml(v)}"`).join(" ")}>`).join("\n    ");
-	const linkTags = (head.link ?? []).map((l) => `<link ${Object.entries(l).map(([k, v]) => `${k}="${escapeHtml(v)}"`).join(" ")}>`).join("\n    ");
-	const cssTags = cssUrls.map((url) => `<link rel="stylesheet" href="${escapeHtml(url)}">`).join("\n    ");
-	const modulePreloadTags = modulePreloadUrls.map((url) => `<link rel="modulepreload" href="${escapeHtml(url)}">`).join("\n    ");
-	const routeStatePreloadTag = routeStatePreloadUrl ? `<link rel="preload" as="fetch" href="${escapeHtml(routeStatePreloadUrl)}" crossorigin="anonymous">` : "";
-	const stateScript = `<script id="${HYDRATION_STATE_ELEMENT_ID}" type="application/json">${serializeJsonForHtml(hydrationState)}<\/script>`;
-	const entryScript = clientEntryUrl ? `<script type="module" src="${escapeHtml(clientEntryUrl)}"><\/script>` : "";
-	return `<!DOCTYPE html>
-<html${head.lang ? ` lang="${escapeHtml(head.lang)}"` : ""}>
-  <head>
-    <meta charset="utf-8">
-    ${titleTag}
-    ${metaTags}
-    ${linkTags}
-    ${cssTags}
-    ${modulePreloadTags}
-    ${routeStatePreloadTag}
-  </head>
-  <body>
-    <div id="pracht-root">${body}</div>
-    ${stateScript}
-    ${entryScript}
-  </body>
-</html>`;
-}
-function htmlResponse(html, status = 200, initHeaders) {
-	const headers = new Headers({ "content-type": "text/html; charset=utf-8" });
-	if (initHeaders) applyHeaders(headers, initHeaders);
-	applySecurityAndRouteHeaders(headers, { isRouteStateRequest: false });
-	return new Response(html, {
-		status,
-		headers
-	});
-}
-function applyDefaultSecurityHeaders(headers) {
-	if (!headers.has("permissions-policy")) headers.set("permissions-policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()");
-	if (!headers.has("referrer-policy")) headers.set("referrer-policy", "strict-origin-when-cross-origin");
-	if (!headers.has("x-content-type-options")) headers.set("x-content-type-options", "nosniff");
-	if (!headers.has("x-frame-options")) headers.set("x-frame-options", "SAMEORIGIN");
-	return headers;
-}
-function applySecurityAndRouteHeaders(headers, options) {
-	applyDefaultSecurityHeaders(headers);
-	if (options) {
-		appendVaryHeader(headers, ROUTE_STATE_REQUEST_HEADER);
-		if (options.isRouteStateRequest && !headers.has("cache-control")) headers.set("cache-control", ROUTE_STATE_CACHE_CONTROL);
-	}
-	return headers;
+		cssUrls,
+		modulePreloadUrls
+	}), routeErrorWithDiagnostics.status, documentHeaders);
 }
-function withDefaultSecurityHeaders(response) {
-	const headers = new Headers(response.headers);
-	applySecurityAndRouteHeaders(headers);
-	return new Response(response.body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers
+//#endregion
+//#region src/runtime-negotiation.ts
+const MARKDOWN_MEDIA_TYPE = "text/markdown";
+function parseAccept(header) {
+	if (!header) return [];
+	const entries = [];
+	for (const raw of header.split(",")) {
+		const parts = raw.trim().split(";");
+		const type = parts.shift()?.trim().toLowerCase();
+		if (!type) continue;
+		let quality = 1;
+		for (const param of parts) {
+			const [key, value] = param.split("=").map((p) => p.trim());
+			if (key === "q" && value != null) {
+				const parsed = Number.parseFloat(value);
+				if (!Number.isNaN(parsed)) quality = parsed;
+			}
+		}
+		entries.push({
+			type,
+			quality
+		});
+	}
+	return entries;
+}
+function prefersMarkdown(accept) {
+	const entries = parseAccept(accept);
+	if (!entries.length) return false;
+	const md = entries.find((e) => e.type === MARKDOWN_MEDIA_TYPE);
+	if (!md || md.quality === 0) return false;
+	const html = entries.find((e) => e.type === "text/html");
+	if (!html) return true;
+	return md.quality >= html.quality;
+}
+function markdownResponse(source) {
+	const headers = new Headers({
+		"content-type": "text/markdown; charset=utf-8",
+		"cache-control": "public, max-age=0, must-revalidate"
 	});
-}
-function withRouteResponseHeaders(response, options) {
-	const headers = new Headers(response.headers);
-	applySecurityAndRouteHeaders(headers, options);
-	return new Response(response.body, {
-		status: response.status,
-		statusText: response.statusText,
+	appendVaryHeader(headers, "Accept");
+	applyDefaultSecurityHeaders(headers);
+	return new Response(source, {
+		status: 200,
 		headers
 	});
 }
-function appendVaryHeader(headers, value) {
-	const current = headers.get("vary");
-	if (!current) {
-		headers.set("vary", value);
-		return;
+//#endregion
+//#region src/runtime.ts
+const FIRST_PARTY_FETCH_SITES = new Set(["same-origin", "same-site"]);
+/**
+* Stricter variant of first-party detection used for CSRF protection on
+* state-changing API requests. Unlike `isFirstPartyFetch`, this *only*
+* accepts explicit positive evidence that the request came from this
+* origin — a cross-origin form POST will send `Origin` from the
+* attacker, and a missing `Origin` on POST is unusual enough to block.
+* Non-browser callers (curl, server-to-server) should set the header
+* explicitly or pre-flight via middleware.
+*/
+function isSameOriginMutation(request, url) {
+	const site = request.headers.get("sec-fetch-site");
+	if (site) return FIRST_PARTY_FETCH_SITES.has(site);
+	const origin = request.headers.get("origin");
+	if (origin) try {
+		return new URL(origin).origin === url.origin;
+	} catch {
+		return false;
 	}
-	const values = current.split(",").map((part) => part.trim().toLowerCase()).filter(Boolean);
-	if (values.includes("*") || values.includes(value.toLowerCase())) return;
-	headers.set("vary", `${current}, ${value}`);
+	const referer = request.headers.get("referer");
+	if (referer) try {
+		return new URL(referer).origin === url.origin;
+	} catch {
+		return false;
+	}
+	return true;
 }
-function escapeHtml(str) {
-	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+/**
+* Heuristic "this request came from our own page" check. Used to gate
+* the `_data=1` query-param form of the route-state endpoint, which is
+* otherwise reachable via any cross-origin `<a href>` / redirect.
+*
+* Accepts a request as first-party when:
+*   - Sec-Fetch-Site is `same-origin` or `same-site` (modern browsers),
+*   - OR Sec-Fetch-Site is absent AND the Origin header matches the
+*     request URL's origin (older clients that still send Origin),
+*   - OR no Origin/Sec-Fetch-Site is present AND there is no Referer
+*     (non-browser clients like curl — CSRF is not the threat model
+*     there; blocking would break tests and CLIs).
+*
+* Cross-origin browser navigations set Sec-Fetch-Site to `cross-site`
+* or `none` (for user-typed URLs Sec-Fetch-Site: none, Referer absent,
+* Origin absent — handled by the "no headers → allow" branch since that
+* matches a first-party typed URL too).
+*/
+function isFirstPartyFetch(request) {
+	const site = request.headers.get("sec-fetch-site");
+	if (site) return FIRST_PARTY_FETCH_SITES.has(site);
+	const origin = request.headers.get("origin");
+	if (origin) try {
+		return new URL(origin).origin === new URL(request.url).origin;
+	} catch {
+		return false;
+	}
+	return true;
 }
-function serializeJsonForHtml(value) {
-	return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+async function handlePrachtRequest(options) {
+	const url = new URL(options.request.url);
+	const hasDataParam = url.searchParams.get("_data") === "1";
+	if (hasDataParam) url.searchParams.delete("_data");
+	const requestPath = getRequestPath(url);
+	const registry = options.registry ?? {};
+	const headerSignalsRouteState = options.request.headers.get(ROUTE_STATE_REQUEST_HEADER) === "1";
+	const dataParamIsFirstParty = hasDataParam && isFirstPartyFetch(options.request);
+	const isRouteStateRequest = headerSignalsRouteState || dataParamIsFirstParty;
+	const exposeDiagnostics = shouldExposeServerErrors(options);
+	if (options.apiRoutes?.length) {
+		const apiMatch = matchApiRoute(options.apiRoutes, url.pathname);
+		if (apiMatch) {
+			const apiMiddlewareFiles = (options.app.api.middleware ?? []).flatMap((name) => {
+				const middlewareFile = options.app.middleware[name];
+				return middlewareFile ? [middlewareFile] : [];
+			});
+			let currentPhase = "middleware";
+			if ((options.app.api.requireSameOrigin ?? true) && !SAFE_METHODS.has(options.request.method) && !isSameOriginMutation(options.request, url)) return withDefaultSecurityHeaders(new Response("Cross-origin request blocked", {
+				status: 403,
+				headers: { "content-type": "text/plain; charset=utf-8" }
+			}));
+			try {
+				const middlewareResult = await runMiddlewareChain({
+					context: options.context ?? {},
+					middlewareFiles: apiMiddlewareFiles,
+					params: apiMatch.params,
+					registry,
+					request: options.request,
+					route: apiMatch.route,
+					url
+				});
+				if (middlewareResult.response) return middlewareResult.response;
+				currentPhase = "api";
+				const apiModule = await resolveRegistryModule(registry.apiModules, apiMatch.route.file);
+				if (!apiModule) throw new Error("API route module not found");
+				const handler = apiModule[options.request.method.toUpperCase()] ?? apiModule.default;
+				if (!handler) return withDefaultSecurityHeaders(new Response("Method not allowed", {
+					status: 405,
+					headers: { "content-type": "text/plain; charset=utf-8" }
+				}));
+				return withDefaultSecurityHeaders(await handler({
+					request: options.request,
+					params: apiMatch.params,
+					context: middlewareResult.context,
+					signal: AbortSignal.timeout(3e4),
+					url,
+					route: apiMatch.route
+				}));
+			} catch (error) {
+				return renderApiErrorResponse({
+					error,
+					middlewareFiles: apiMiddlewareFiles,
+					options,
+					phase: currentPhase,
+					route: apiMatch.route
+				});
+			}
+		}
+	}
+	const match = matchAppRoute(options.app, url.pathname);
+	if (!match) {
+		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Not found", 404, {
+			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
+				phase: "match",
+				status: 404
+			}) : void 0,
+			name: "Error"
+		}), { isRouteStateRequest: true });
+		return withDefaultSecurityHeaders(new Response("Not found", {
+			status: 404,
+			headers: { "content-type": "text/plain; charset=utf-8" }
+		}));
+	}
+	if (!SAFE_METHODS.has(options.request.method)) {
+		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Method not allowed", 405, {
+			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
+				middlewareFiles: match.route.middlewareFiles,
+				phase: "action",
+				route: match.route,
+				shellFile: match.route.shellFile,
+				status: 405
+			}) : void 0,
+			name: "Error"
+		}), { isRouteStateRequest: true });
+		return withRouteResponseHeaders(new Response("Method not allowed", {
+			status: 405,
+			headers: { "content-type": "text/plain; charset=utf-8" }
+		}), { isRouteStateRequest });
+	}
+	let routeArgs = {
+		request: options.request,
+		params: match.params,
+		context: options.context ?? {},
+		signal: AbortSignal.timeout(3e4),
+		url,
+		route: match.route
+	};
+	let routeModule;
+	let shellModule;
+	let loaderFile;
+	let currentPhase = "middleware";
+	try {
+		const middlewarePromise = runMiddlewareChain({
+			context: routeArgs.context,
+			middlewareFiles: match.route.middlewareFiles,
+			params: match.params,
+			registry,
+			request: options.request,
+			route: match.route,
+			url
+		});
+		const routeModulePromise = resolveRegistryModule(registry.routeModules, match.route.file);
+		const shellModulePromise = match.route.shellFile ? resolveRegistryModule(registry.shellModules, match.route.shellFile) : Promise.resolve(void 0);
+		const dataFunctionsPromise = routeModulePromise.then((mod) => resolveDataFunctions(match.route, mod, registry));
+		routeModulePromise.catch(() => {});
+		shellModulePromise.catch(() => {});
+		dataFunctionsPromise.catch(() => {});
+		const middlewareResult = await middlewarePromise;
+		if (middlewareResult.response) return normalizePageResponse(middlewareResult.response, { isRouteStateRequest });
+		routeArgs = {
+			...routeArgs,
+			context: middlewareResult.context
+		};
+		currentPhase = "render";
+		routeModule = await routeModulePromise;
+		if (!routeModule) throw new Error("Route module not found");
+		if (!isRouteStateRequest && typeof routeModule.markdown === "string" && prefersMarkdown(options.request.headers.get("accept"))) return markdownResponse(routeModule.markdown);
+		currentPhase = "loader";
+		const { loader, loaderFile: resolvedLoaderFile } = await dataFunctionsPromise;
+		loaderFile = resolvedLoaderFile;
+		const loaderResult = loader ? await loader(routeArgs) : void 0;
+		if (loaderResult instanceof Response) return normalizePageResponse(loaderResult, { isRouteStateRequest });
+		const data = loaderResult;
+		if (isRouteStateRequest) return withRouteResponseHeaders(Response.json({ data }), { isRouteStateRequest: true });
+		currentPhase = "render";
+		shellModule = await shellModulePromise;
+		const [head, documentHeaders] = await Promise.all([mergeHeadMetadata(shellModule, routeModule, routeArgs, data), mergeDocumentHeaders(shellModule, routeModule, routeArgs, data)]);
+		const cssUrls = resolvePageCssUrls(options.cssManifest, match.route.shellFile, match.route.file);
+		const modulePreloadUrls = resolvePageJsUrls(options.jsManifest, match.route.shellFile, match.route.file);
+		if (match.route.render === "spa") {
+			let body = "";
+			if (shellModule?.Shell || shellModule?.Loading) {
+				const Shell = shellModule?.Shell;
+				const Loading = shellModule?.Loading;
+				const loadingTree = Shell != null ? h(Shell, null, Loading ? h(Loading, null) : null) : Loading ? h(Loading, null) : null;
+				if (loadingTree) body = await (await getRenderToStringAsync())(loadingTree);
+			}
+			return htmlResponse(buildHtmlDocument({
+				head,
+				body,
+				hydrationState: {
+					url: requestPath,
+					routeId: match.route.id ?? "",
+					data: null,
+					error: null,
+					pending: true
+				},
+				clientEntryUrl: options.clientEntryUrl,
+				cssUrls,
+				modulePreloadUrls,
+				routeStatePreloadUrl: loader ? buildRouteStateUrl(requestPath) : void 0
+			}), 200, documentHeaders);
+		}
+		const DefaultComponent = typeof routeModule.default === "function" ? routeModule.default : void 0;
+		const Component = routeModule.Component ?? DefaultComponent;
+		if (!Component) throw new Error("Route has no Component or default export");
+		const Shell = shellModule?.Shell;
+		const Comp = Component;
+		const componentProps = {
+			data,
+			params: match.params
+		};
+		const componentTree = Shell ? h(Shell, null, h(Comp, componentProps)) : h(Comp, componentProps);
+		const tree = h(PrachtRuntimeProvider, {
+			data,
+			params: match.params,
+			routeId: match.route.id ?? "",
+			url: requestPath
+		}, componentTree);
+		return htmlResponse(buildHtmlDocument({
+			head,
+			body: await (await getRenderToStringAsync())(tree),
+			hydrationState: {
+				url: requestPath,
+				routeId: match.route.id ?? "",
+				data,
+				error: null
+			},
+			clientEntryUrl: options.clientEntryUrl,
+			cssUrls,
+			modulePreloadUrls
+		}), 200, documentHeaders);
+	} catch (error) {
+		return renderRouteErrorResponse({
+			error,
+			isRouteStateRequest,
+			loaderFile,
+			options,
+			phase: currentPhase,
+			routeArgs,
+			routeId: match.route.id ?? "",
+			routeModule,
+			shellFile: match.route.shellFile,
+			shellModule,
+			requestPath
+		});
+	}
+}
+function getRequestPath(url) {
+	return `${url.pathname}${url.search}`;
 }
+//#endregion
+//#region src/prerender.ts
 async function prerenderApp(options) {
 	const resolved = resolveApp(options.app);
 	const results = [];
@@ -1349,7 +1584,11 @@ async function initClientRouter(options) {
 		};
 	}
 	function resolveRedirectTarget(location) {
-		const targetUrl = new URL(location, window.location.href);
+		const targetUrl = parseSafeNavigationUrl(location, window.location.href);
+		if (!targetUrl) return {
+			isCurrentLocation: false,
+			unsafe: true
+		};
 		const fullInternalTarget = targetUrl.pathname + targetUrl.search + targetUrl.hash;
 		const internalPath = targetUrl.pathname + targetUrl.search;
 		const currentPath = window.location.pathname + window.location.search + window.location.hash;
@@ -1390,6 +1629,10 @@ async function initClientRouter(options) {
 			if (result.type === "redirect") {
 				if (result.location) {
 					const redirect = resolveRedirectTarget(result.location);
+					if (redirect.unsafe) {
+						console.error(`[pracht] refused to navigate to unsafe URL: ${result.location}`);
+						return;
+					}
 					if (redirect.externalUrl) {
 						window.location.href = redirect.externalUrl;
 						return;
@@ -1403,7 +1646,7 @@ async function initClientRouter(options) {
 						await navigate(redirect.internalPath, opts);
 						return;
 					}
-					window.location.href = result.location;
+					window.location.href = target.browserUrl;
 					return;
 				}
 				window.location.href = target.browserUrl;
@@ -1446,7 +1689,12 @@ async function initClientRouter(options) {
 			try {
 				const result = await dataPromise;
 				if (result.type === "redirect") {
-					window.location.href = result.location;
+					const safeRedirect = parseSafeNavigationUrl(result.location, window.location.href);
+					if (!safeRedirect) {
+						console.error(`[pracht] refused to navigate to unsafe URL: ${result.location}`);
+						return;
+					}
+					window.location.href = safeRedirect.toString();
 					return;
 				}
 				if (result.type === "error") state = {