@pracht/core 0.5.0 → 0.6.1

package/dist/index.d.mts

@@ -203,6 +203,7 @@ interface RouteModule<TContext = any, TLoader extends LoaderLike = undefined> {
 interface ShellModule<TContext = any> {
   Shell: FunctionComponent<ShellProps>;
   Loading?: FunctionComponent;
+  ErrorBoundary?: FunctionComponent<ErrorBoundaryProps>;
   head?: (args: BaseRouteArgs<TContext>) => MaybePromise<HeadMetadata>;
   headers?: (args: BaseRouteArgs<TContext>) => MaybePromise<HeadersInit>;
 }

package/dist/index.mjs

@@ -154,6 +154,7 @@ function parseRouteSegments(path) {
 			type: "param",
 			name: segment.slice(1)
 		};
+		assertSafeStaticRouteSegment(segment);
 		return {
 			type: "static",
 			value: segment
@@ -163,6 +164,10 @@ function parseRouteSegments(path) {
 function splitPathSegments(path) {
 	return normalizeRoutePath(path).split("/").filter(Boolean);
 }
+function assertSafeStaticRouteSegment(segment) {
+	if (segment === "." || segment === "..") throw new Error(`Unsafe static route segment "${segment}" is not allowed.`);
+	if (segment.includes("\0") || /[\r\n\\]/.test(segment)) throw new Error(`Unsafe static route segment "${segment}" contains a forbidden character.`);
+}
 function mergeRoutePaths(prefix, path) {
 	if (!path) return normalizeRoutePath(prefix);
 	const normalizedPrefix = normalizeRoutePath(prefix);
@@ -179,19 +184,18 @@ function normalizeRoutePath(path) {
 function buildPathFromSegments(segments, params) {
 	return normalizeRoutePath("/" + segments.map((segment) => {
 		if (segment.type === "static") return segment.value;
-		if (segment.type === "param") return encodeURIComponent(params[segment.name] ?? "");
-		return (params[segment.name] ?? params["*"] ?? "").split("/").map((part) => encodeCatchAllSegment(part)).join("/");
+		if (segment.type === "param") return encodeDynamicPathSegment(params[segment.name] ?? "");
+		return (params[segment.name] ?? params["*"] ?? "").split("/").map((part) => encodeDynamicPathSegment(part)).join("/");
 	}).join("/"));
 }
 /**
-* Encode a single path segment for a catch-all route. `encodeURIComponent`
-* leaves unreserved characters (including `.`) intact, so `..` would
-* round-trip unchanged and still resolve as parent-dir in `path.join`.
-* Explicitly percent-encode `.` / `..` segments to neutralise them.
+* Encode one dynamic URL path segment for SSG/ISG output. `encodeURIComponent`
+* leaves unreserved characters (including `.`) intact, and even percent-encoded
+* dot segments are normalized by URL parsers. Reject exact `.` / `..` segments
+* instead of allowing them to reach filesystem output path construction.
 */
-function encodeCatchAllSegment(part) {
-	if (part === ".") return "%2E";
-	if (part === "..") return "%2E%2E";
+function encodeDynamicPathSegment(part) {
+	if (part === "." || part === "..") throw new Error(`Unsafe dynamic route param segment "${part}" is not allowed.`);
 	return encodeURIComponent(part);
 }
 /**
@@ -1170,25 +1174,26 @@ async function renderRouteErrorResponse(options) {
 			status: routeError.status
 		})
 	} : routeError;
-	if (!options.routeModule?.ErrorBoundary) {
-		if (options.isRouteStateRequest) return jsonErrorResponse(routeErrorWithDiagnostics, { isRouteStateRequest: true });
-		const message = routeErrorWithDiagnostics.status >= 500 ? "Internal Server Error" : routeErrorWithDiagnostics.message;
-		return withDefaultSecurityHeaders(new Response(message, {
+	if (options.isRouteStateRequest) return jsonErrorResponse(routeErrorWithDiagnostics, { isRouteStateRequest: true });
+	const shellModule = options.shellModule ?? (options.shellFile ? await resolveRegistryModule(options.options.registry?.shellModules, options.shellFile) : void 0);
+	const ErrorBoundary = options.routeModule?.ErrorBoundary ?? shellModule?.ErrorBoundary;
+	if (!ErrorBoundary) {
+		const message = routeErrorWithDiagnostics.status >= 500 && !exposeDetails ? "Internal Server Error" : routeErrorWithDiagnostics.message;
+		const diagnostics = exposeDetails && routeErrorWithDiagnostics.diagnostics ? `\n\n${JSON.stringify(routeErrorWithDiagnostics.diagnostics, null, 2)}` : "";
+		return withDefaultSecurityHeaders(new Response(`${message}${diagnostics}`, {
 			status: routeErrorWithDiagnostics.status,
 			headers: { "content-type": "text/plain; charset=utf-8" }
 		}));
 	}
-	if (options.isRouteStateRequest) return jsonErrorResponse(routeErrorWithDiagnostics, { isRouteStateRequest: true });
-	const shellModule = options.shellModule ?? (options.shellFile ? await resolveRegistryModule(options.options.registry?.shellModules, options.shellFile) : void 0);
 	const head = shellModule?.head ? await shellModule.head(options.routeArgs) : {};
 	const documentHeaders = await mergeDocumentHeaders(shellModule, void 0, options.routeArgs, void 0);
 	const cssUrls = resolvePageCssUrls(options.options.cssManifest, options.shellFile, options.routeArgs.route.file);
 	const modulePreloadUrls = resolvePageJsUrls(options.options.jsManifest, options.shellFile, options.routeArgs.route.file);
 	const renderToString = await getRenderToStringAsync();
-	const ErrorBoundary = options.routeModule.ErrorBoundary;
+	const Boundary = ErrorBoundary;
 	const Shell = shellModule?.Shell;
 	const errorValue = deserializeRouteError(routeErrorWithDiagnostics);
-	const componentTree = Shell ? h(Shell, null, h(ErrorBoundary, { error: errorValue })) : h(ErrorBoundary, { error: errorValue });
+	const componentTree = Shell ? h(Shell, null, h(Boundary, { error: errorValue })) : h(Boundary, { error: errorValue });
 	return htmlResponse(buildHtmlDocument({
 		head,
 		body: await renderToString(h(PrachtRuntimeProvider, {
@@ -1721,7 +1726,8 @@ async function initClientRouter(options) {
 		const resolvedShell = await (shellModPromise ?? startShellImport(match));
 		if (resolvedShell) Shell = resolvedShell.Shell;
 		const DefaultComponent = typeof routeMod.default === "function" ? routeMod.default : void 0;
-		const Component = state.error ? routeMod.ErrorBoundary : routeMod.Component ?? DefaultComponent;
+		const ErrorBoundary = routeMod.ErrorBoundary ?? resolvedShell?.ErrorBoundary;
+		const Component = state.error ? ErrorBoundary : routeMod.Component ?? DefaultComponent;
 		if (!Component) return null;
 		const componentProps = state.error ? { error: deserializeRouteError(state.error) } : {
 			data: state.data,

package/package.json

@@ -1,6 +1,19 @@
 {
   "name": "@pracht/core",
-  "version": "0.5.0",
+  "version": "0.6.1",
+  "description": "Core runtime for Pracht, a full-stack Preact framework with per-route SSR, SSG, ISG, SPA, loaders, and API routes.",
+  "keywords": [
+    "pracht",
+    "preact",
+    "framework",
+    "full-stack",
+    "ssr",
+    "ssg",
+    "isg",
+    "routing",
+    "loaders",
+    "api-routes"
+  ],
   "license": "MIT",
   "homepage": "https://github.com/JoviDeCroock/pracht/tree/main/packages/framework",
   "bugs": {