@pyreon/zero 0.14.0 → 0.16.0

package/lib/api-routes-Ci0kVmM4.js

@@ -0,0 +1,146 @@
+import { t as __exportAll } from "./rolldown-runtime-CjeV3_4I.js";
+
+//#region src/api-routes.ts
+var api_routes_exports = /* @__PURE__ */ __exportAll({
+	apiFilePathToPattern: () => apiFilePathToPattern,
+	createApiMiddleware: () => createApiMiddleware,
+	generateApiRouteModule: () => generateApiRouteModule,
+	isApiRoute: () => isApiRoute,
+	matchApiRoute: () => matchApiRoute
+});
+/**
+* Match a URL path against an API route pattern.
+* Returns extracted params or null if no match.
+*/
+function matchApiRoute(pattern, path) {
+	const patternParts = pattern.split("/").filter(Boolean);
+	const pathParts = path.split("/").filter(Boolean);
+	const params = {};
+	for (let i = 0; i < patternParts.length; i++) {
+		const pp = patternParts[i];
+		if (!pp) continue;
+		if (pp.endsWith("*")) {
+			const paramName = pp.slice(1, -1);
+			params[paramName] = pathParts.slice(i).join("/");
+			return params;
+		}
+		if (i >= pathParts.length) return null;
+		if (pp.startsWith(":")) {
+			params[pp.slice(1)] = pathParts[i];
+			continue;
+		}
+		if (pp !== pathParts[i]) return null;
+	}
+	return patternParts.length === pathParts.length ? params : null;
+}
+const HTTP_METHODS = [
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+	"HEAD",
+	"OPTIONS"
+];
+/**
+* Create a middleware that dispatches API route requests.
+* API routes are matched by URL pattern and HTTP method.
+*/
+function createApiMiddleware(routes) {
+	return async (ctx) => {
+		for (const route of routes) {
+			const params = matchApiRoute(route.pattern, ctx.path);
+			if (!params) continue;
+			const method = ctx.req.method.toUpperCase();
+			const handler = route.module[method];
+			if (!handler) {
+				const allowed = HTTP_METHODS.filter((m) => route.module[m]).join(", ");
+				return new Response(null, {
+					status: 405,
+					headers: {
+						Allow: allowed,
+						"Content-Type": "application/json"
+					}
+				});
+			}
+			return handler({
+				request: ctx.req,
+				url: ctx.url,
+				path: ctx.path,
+				params,
+				headers: ctx.req.headers
+			});
+		}
+	};
+}
+/**
+* Detect whether a route file is an API route.
+* API routes are `.ts` or `.js` files inside an `api/` directory.
+*/
+function isApiRoute(filePath) {
+	const normalized = filePath.replace(/\\/g, "/");
+	return normalized.startsWith("api/") && (normalized.endsWith(".ts") || normalized.endsWith(".js")) && !normalized.endsWith(".tsx") && !normalized.endsWith(".jsx");
+}
+/**
+* Convert an API route file path to a URL pattern.
+*
+* Examples:
+*   "api/posts.ts"        → "/api/posts"
+*   "api/posts/index.ts"  → "/api/posts"
+*   "api/posts/[id].ts"   → "/api/posts/:id"
+*   "api/[...path].ts"    → "/api/:path*"
+*/
+function apiFilePathToPattern(filePath) {
+	let route = filePath;
+	for (const ext of [".ts", ".js"]) if (route.endsWith(ext)) {
+		route = route.slice(0, -ext.length);
+		break;
+	}
+	const segments = route.split("/");
+	const urlSegments = [];
+	for (const seg of segments) {
+		if (seg === "index") continue;
+		const catchAll = seg.match(/^\[\.\.\.(\w+)\]$/);
+		if (catchAll) {
+			urlSegments.push(`:${catchAll[1]}*`);
+			continue;
+		}
+		const dynamic = seg.match(/^\[(\w+)\]$/);
+		if (dynamic) {
+			urlSegments.push(`:${dynamic[1]}`);
+			continue;
+		}
+		urlSegments.push(seg);
+	}
+	return `/${urlSegments.join("/")}`;
+}
+/**
+* Generate a virtual module that exports API route entries.
+* Each entry maps a URL pattern to a module with HTTP method handlers.
+*/
+function generateApiRouteModule(files, routesDir) {
+	const apiFiles = files.filter(isApiRoute);
+	if (apiFiles.length === 0) return "export const apiRoutes = []\n";
+	const imports = [];
+	const entries = [];
+	for (let i = 0; i < apiFiles.length; i++) {
+		const name = `_api${i}`;
+		const file = apiFiles[i];
+		if (!file) continue;
+		const fullPath = `${routesDir}/${file}`;
+		const pattern = apiFilePathToPattern(file);
+		imports.push(`import * as ${name} from "${fullPath}"`);
+		entries.push(`  { pattern: ${JSON.stringify(pattern)}, module: ${name} }`);
+	}
+	return [
+		...imports,
+		"",
+		"export const apiRoutes = [",
+		entries.join(",\n"),
+		"]"
+	].join("\n");
+}
+
+//#endregion
+export { matchApiRoute as i, createApiMiddleware as n, generateApiRouteModule as r, api_routes_exports as t };
+//# sourceMappingURL=api-routes-Ci0kVmM4.js.map

package/lib/client.js

@@ -14,9 +14,12 @@ function createApp(options) {
 		routes: options.routes,
 		mode: options.routerMode ?? "history",
 		...options.url ? { url: options.url } : {},
+		...options.base && options.base !== "/" ? { base: options.base } : {},
 		scrollBehavior: "top"
 	});
-	const Layout = options.layout ?? DefaultLayout;
+	const hasLayoutInRoutes = options.layout !== void 0 && options.routes.some((r) => r.component === options.layout);
+	if (hasLayoutInRoutes && process.env.NODE_ENV !== "production") console.warn("[Pyreon] `createApp({ layout })` was passed a component that is ALSO a parent route in the matched chain (likely an fs-router `_layout.tsx`). The explicit `layout` option is being ignored to prevent double-mount. Remove the `layout` argument from `createApp`/`startClient` — the fs-router-emitted route handles it.");
+	const Layout = hasLayoutInRoutes ? DefaultLayout : options.layout ?? DefaultLayout;
 	function App() {
 		return h(HeadProvider, null, h(RouterProvider, { router }, h(Layout, null, h(RouterView, null))));
 	}
@@ -70,10 +73,12 @@ function startClient(options) {
 	if (typeof document === "undefined") throw new Error("[Pyreon] startClient() can only be called in the browser.");
 	const container = document.getElementById("app");
 	if (!container) throw new Error("[Pyreon] Missing #app container element");
+	const base = typeof __ZERO_BASE__ !== "undefined" && __ZERO_BASE__ !== "/" ? __ZERO_BASE__ : void 0;
 	const { App, router } = createApp({
 		routes: options.routes,
 		routerMode: "history",
-		...options.layout ? { layout: options.layout } : {}
+		...options.layout ? { layout: options.layout } : {},
+		...base ? { base } : {}
 	});
 	const ssrLoaderData = window.__PYREON_LOADER_DATA__;
 	const hasSSRLoaderData = ssrLoaderData !== void 0 && typeof ssrLoaderData === "object" && ssrLoaderData !== null;

package/lib/csp.js

@@ -63,17 +63,27 @@ function buildCspHeader(directives, nonce) {
 	return parts.join("; ");
 }
 /**
-* Generate a random nonce string (base64, 16 bytes).
+* Generate a cryptographically-random nonce string (base64, 16 bytes).
+*
+* Throws when `crypto.getRandomValues` is unavailable. CSP nonces protect
+* against XSS by gating inline script execution; a predictable nonce
+* (`Math.random` ~31 bits of entropy) bypasses CSP entirely. Silent
+* degradation here was a security anti-pattern — we surface the
+* misconfiguration loudly instead.
+*
+* Realistic deployments always have `crypto.getRandomValues`: Node 18+,
+* Bun, Deno, browsers, edge workers (Cloudflare/Vercel/Netlify), and
+* vitest/happy-dom all expose it via `globalThis.crypto`. If you hit
+* this throw, your environment is unusual — fix the env, don't downgrade
+* the security primitive.
 */
 function generateNonce() {
-	if (typeof crypto !== "undefined" && crypto.getRandomValues) {
-		const bytes = new Uint8Array(16);
-		crypto.getRandomValues(bytes);
-		let binary = "";
-		for (const byte of bytes) binary += String.fromCharCode(byte);
-		return typeof btoa === "function" ? btoa(binary) : Buffer.from(bytes).toString("base64");
-	}
-	return Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2);
+	if (typeof crypto === "undefined" || !crypto.getRandomValues) throw new Error("[Pyreon] CSP nonce generation requires `crypto.getRandomValues` (Web Crypto API). No secure RNG is available in this environment. CSP nonces must be cryptographically random — falling back to `Math.random` would silently weaken XSS protection. Ensure Node 18+, Bun, Deno, an edge runtime, or a browser environment.");
+	const bytes = new Uint8Array(16);
+	crypto.getRandomValues(bytes);
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return typeof btoa === "function" ? btoa(binary) : Buffer.from(bytes).toString("base64");
 }
 /**
 * CSP middleware — sets Content-Security-Policy header.

package/lib/env.js

@@ -148,11 +148,11 @@ function toValidator(value) {
 * })
 * ```
 */
-function validateEnv(schema, source) {
+function validateEnv(envSchema, source) {
 	const env = source ?? (typeof process !== "undefined" ? process.env : {});
 	const result = {};
 	const errors = [];
-	for (const [key, entry] of Object.entries(schema)) {
+	for (const [key, entry] of Object.entries(envSchema)) {
 		const validator = toValidator(entry);
 		try {
 			result[key] = validator.parse(env[key], key);
@@ -167,17 +167,17 @@ function validateEnv(schema, source) {
 	}
 	return result;
 }
-function publicEnv(schema) {
+function publicEnv(envSchema) {
 	const prefix = "ZERO_PUBLIC_";
 	const env = typeof process !== "undefined" ? process.env : {};
-	if (!schema) {
+	if (!envSchema) {
 		const result = {};
 		for (const [key, value] of Object.entries(env)) if (key.startsWith(prefix) && value !== void 0) result[key.slice(12)] = value;
 		return result;
 	}
 	const prefixedSource = {};
-	for (const key of Object.keys(schema)) prefixedSource[key] = env[`${prefix}${key}`];
-	return validateEnv(schema, prefixedSource);
+	for (const key of Object.keys(envSchema)) prefixedSource[key] = env[`${prefix}${key}`];
+	return validateEnv(envSchema, prefixedSource);
 }
 /**
 * Create an env validator from a custom parse function.

package/lib/font.js

@@ -46,10 +46,10 @@ function parseGoogleFamily(input) {
 			const entries = afterAt.split(";").filter(Boolean);
 			const weights = /* @__PURE__ */ new Set();
 			for (const entry of entries) if (entry.includes(",")) {
-				const parts = entry.split(",");
-				const weight = Number(parts[parts.length - 1]);
+				const tuple = entry.split(",");
+				const weight = Number(tuple[tuple.length - 1]);
 				if (weight > 0) weights.add(weight);
-				if (parts[0] === "1") italic = true;
+				if (tuple[0] === "1") italic = true;
 			} else if (entry.includes("..")) {} else {
 				const weight = Number(entry);
 				if (weight > 0) weights.add(weight);

package/lib/{fs-router-CQ7Zxeca.js → fs-router-MewHc5SB.js}

@@ -1,23 +1,7 @@
+import { t as __exportAll } from "./rolldown-runtime-CjeV3_4I.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) {
-		__defProp(target, name, {
-			get: all[name],
-			enumerable: true
-		});
-	}
-	if (!no_symbols) {
-		__defProp(target, Symbol.toStringTag, { value: "Module" });
-	}
-	return target;
-};
-
-//#endregion
 //#region src/fs-router.ts
 var fs_router_exports = /* @__PURE__ */ __exportAll({
 	detectRouteExports: () => detectRouteExports,
@@ -44,7 +28,11 @@ const ROUTE_EXPORT_NAMES = [
 	"meta",
 	"renderMode",
 	"error",
-	"middleware"
+	"middleware",
+	"loaderKey",
+	"gcTime",
+	"getStaticPaths",
+	"revalidate"
 ];
 /**
 * Detect which optional metadata exports a route file source declares.
@@ -74,10 +62,13 @@ function detectRouteExports(source) {
 	} else for (const name of tok.names) if (ROUTE_EXPORT_NAMES.includes(name)) found.add(name);
 	const rawMeta = found.has("meta") ? extractLiteralExport(source, "meta") : void 0;
 	const rawRenderMode = found.has("renderMode") ? extractLiteralExport(source, "renderMode") : void 0;
+	const rawRevalidate = found.has("revalidate") ? extractLiteralExport(source, "revalidate") : void 0;
 	const cleanMeta = rawMeta !== void 0 ? stripTypeAssertions(rawMeta) : void 0;
 	const cleanRenderMode = rawRenderMode !== void 0 ? stripTypeAssertions(rawRenderMode) : void 0;
+	const cleanRevalidate = rawRevalidate !== void 0 ? stripTypeAssertions(rawRevalidate) : void 0;
 	const metaLiteral = cleanMeta !== void 0 && isPureLiteral(cleanMeta) ? cleanMeta : void 0;
 	const renderModeLiteral = cleanRenderMode !== void 0 && isPureLiteral(cleanRenderMode) ? cleanRenderMode : void 0;
+	const revalidateLiteral = cleanRevalidate !== void 0 && isPureLiteral(cleanRevalidate) ? cleanRevalidate : void 0;
 	return {
 		hasLoader: found.has("loader"),
 		hasGuard: found.has("guard"),
@@ -85,8 +76,13 @@ function detectRouteExports(source) {
 		hasRenderMode: found.has("renderMode"),
 		hasError: found.has("error"),
 		hasMiddleware: found.has("middleware"),
+		hasLoaderKey: found.has("loaderKey"),
+		hasGcTime: found.has("gcTime"),
+		hasGetStaticPaths: found.has("getStaticPaths"),
+		hasRevalidate: found.has("revalidate"),
 		...metaLiteral !== void 0 ? { metaLiteral } : {},
-		...renderModeLiteral !== void 0 ? { renderModeLiteral } : {}
+		...renderModeLiteral !== void 0 ? { renderModeLiteral } : {},
+		...revalidateLiteral !== void 0 ? { revalidateLiteral } : {}
 	};
 }
 /**
@@ -568,7 +564,11 @@ const EMPTY_EXPORTS = {
 	hasMeta: false,
 	hasRenderMode: false,
 	hasError: false,
-	hasMiddleware: false
+	hasMiddleware: false,
+	hasLoaderKey: false,
+	hasGcTime: false,
+	hasGetStaticPaths: false,
+	hasRevalidate: false
 };
 /**
 * True if a route file declares ANY metadata export.
@@ -576,7 +576,7 @@ const EMPTY_EXPORTS = {
 * `import * as mod` (for metadata access) instead of lazy().
 */
 function hasAnyMetaExport(exports) {
-	return exports.hasLoader || exports.hasGuard || exports.hasMeta || exports.hasRenderMode || exports.hasError || exports.hasMiddleware;
+	return exports.hasLoader || exports.hasGuard || exports.hasMeta || exports.hasRenderMode || exports.hasError || exports.hasMiddleware || exports.hasLoaderKey || exports.hasGcTime || exports.hasGetStaticPaths;
 }
 /**
 * Parse a set of file paths (relative to routes dir) into FileRoute objects.
@@ -776,6 +776,9 @@ function generateRouteModuleFromRoutes(routes, routesDir, options) {
 			props.push(`${indent}  component: ${mod}.default`);
 			if (exp.hasLoader) props.push(`${indent}  loader: ${mod}.loader`);
 			if (exp.hasGuard) props.push(`${indent}  beforeEnter: ${mod}.guard`);
+			if (exp.hasLoaderKey) props.push(`${indent}  loaderKey: ${mod}.loaderKey`);
+			if (exp.hasGcTime) props.push(`${indent}  gcTime: ${mod}.gcTime`);
+			if (exp.hasGetStaticPaths) props.push(`${indent}  getStaticPaths: ${mod}.getStaticPaths`);
 			if (exp.hasMeta || exp.hasRenderMode) {
 				const metaParts = [];
 				if (exp.hasMeta) metaParts.push(`...${mod}.meta`);
@@ -793,7 +796,7 @@ function generateRouteModuleFromRoutes(routes, routesDir, options) {
 		}
 		else {
 			const inlineableMeta = (!exp.hasMeta || exp.metaLiteral !== void 0) && (!exp.hasRenderMode || exp.renderModeLiteral !== void 0);
-			const needsFunctionExports = exp.hasLoader || exp.hasGuard || exp.hasError;
+			const needsFunctionExports = exp.hasLoader || exp.hasGuard || exp.hasError || exp.hasGetStaticPaths;
 			if (hasMeta && inlineableMeta && !needsFunctionExports) {
 				const comp = nextLazy(page.filePath, loadingName, errorName);
 				props.push(`${indent}  component: ${comp}`);
@@ -805,6 +808,18 @@ function generateRouteModuleFromRoutes(routes, routesDir, options) {
 				props.push(`${indent}  component: ${comp}`);
 				if (exp.hasLoader) props.push(`${indent}  loader: (ctx) => import("${fullPath}").then((m) => m.loader(ctx))`);
 				if (exp.hasGuard) props.push(`${indent}  beforeEnter: (to, from) => import("${fullPath}").then((m) => m.guard(to, from))`);
+				if (exp.hasLoaderKey) {
+					const mod = nextModuleImport(page.filePath);
+					props.push(`${indent}  loaderKey: ${mod}.loaderKey`);
+				}
+				if (exp.hasGcTime) {
+					const mod = nextModuleImport(page.filePath);
+					props.push(`${indent}  gcTime: ${mod}.gcTime`);
+				}
+				if (exp.hasGetStaticPaths) {
+					const mod = nextModuleImport(page.filePath);
+					props.push(`${indent}  getStaticPaths: ${mod}.getStaticPaths`);
+				}
 				emitInlineMeta(exp, props, indent);
 				if (errorName) {
 					const errorRef = exp.hasError ? `lazy(() => import("${fullPath}").then((m) => ({ default: m.error })))` : errorName;
@@ -816,6 +831,9 @@ function generateRouteModuleFromRoutes(routes, routesDir, options) {
 				props.push(`${indent}  component: ${mod}.default`);
 				if (exp.hasLoader) props.push(`${indent}  loader: ${mod}.loader`);
 				if (exp.hasGuard) props.push(`${indent}  beforeEnter: ${mod}.guard`);
+				if (exp.hasLoaderKey) props.push(`${indent}  loaderKey: ${mod}.loaderKey`);
+				if (exp.hasGcTime) props.push(`${indent}  gcTime: ${mod}.gcTime`);
+				if (exp.hasGetStaticPaths) props.push(`${indent}  getStaticPaths: ${mod}.getStaticPaths`);
 				if (exp.hasMeta || exp.hasRenderMode) {
 					const metaParts = [];
 					if (exp.hasMeta) metaParts.push(`...${mod}.meta`);
@@ -849,6 +867,8 @@ function generateRouteModuleFromRoutes(routes, routesDir, options) {
 		if (layoutMod !== void 0) {
 			if (exp.hasLoader) props.push(`${indent}loader: ${layoutMod}.loader`);
 			if (exp.hasGuard) props.push(`${indent}beforeEnter: ${layoutMod}.guard`);
+			if (exp.hasLoaderKey) props.push(`${indent}loaderKey: ${layoutMod}.loaderKey`);
+			if (exp.hasGcTime) props.push(`${indent}gcTime: ${layoutMod}.gcTime`);
 			if (exp.hasMeta || exp.hasRenderMode) {
 				const metaParts = [];
 				if (exp.hasMeta) metaParts.push(`...${layoutMod}.meta`);
@@ -885,6 +905,12 @@ function generateRouteModuleFromRoutes(routes, routesDir, options) {
 /**
 * Generate a virtual module that maps URL patterns to their middleware exports.
 * Used by the server entry to dispatch per-route middleware.
+*
+* Detects whether each route file actually exports `middleware` (via
+* `detectRouteExports` source scanning) and only emits an import for files
+* that do. The `lazy()` import path tolerates missing exports, but the SSG
+* static-import path fails Rolldown's missing-export check at build time —
+* skipping no-middleware files keeps both paths working.
 */
 function generateMiddlewareModule(files, routesDir) {
 	const routes = parseFileRoutes(files);
@@ -893,6 +919,11 @@ function generateMiddlewareModule(files, routesDir) {
 	let counter = 0;
 	for (const route of routes) {
 		if (route.isLayout || route.isError || route.isLoading || route.isNotFound) continue;
+		let hasMw = false;
+		try {
+			hasMw = detectRouteExports(readFileSync(`${routesDir}/${route.filePath}`, "utf-8")).hasMiddleware;
+		} catch {}
+		if (!hasMw) continue;
 		const name = `_mw${counter++}`;
 		const fullPath = `${routesDir}/${route.filePath}`;
 		imports.push(`import { middleware as ${name} } from "${fullPath}"`);
@@ -937,7 +968,8 @@ async function scanRouteFiles(routesDir) {
 */
 async function scanRouteFilesWithExports(routesDir, defaultMode = "ssr") {
 	const { readFile } = await import("node:fs/promises");
-	const files = await scanRouteFiles(routesDir);
+	const { isApiRoute } = await import("./api-routes-Ci0kVmM4.js").then((n) => n.t);
+	const files = (await scanRouteFiles(routesDir)).filter((f) => !isApiRoute(f));
 	const exportsMap = /* @__PURE__ */ new Map();
 	await Promise.all(files.map(async (filePath) => {
 		try {
@@ -952,4 +984,4 @@ async function scanRouteFilesWithExports(routesDir, defaultMode = "ssr") {
 
 //#endregion
 export { generateRouteModuleFromRoutes as a, scanRouteFilesWithExports as c, generateRouteModule as i, fs_router_exports as n, parseFileRoutes as o, generateMiddlewareModule as r, scanRouteFiles as s, filePathToUrlPath as t };
-//# sourceMappingURL=fs-router-CQ7Zxeca.js.map
+//# sourceMappingURL=fs-router-MewHc5SB.js.map

package/lib/i18n-routing.js

@@ -42,6 +42,117 @@ function buildLocalePath(path, locale, defaultLocale, strategy) {
 	return `/${locale}${clean}`;
 }
 /**
+* Fan a `FileRoute[]` into per-locale duplicates so the file-system router
+* knows about every localized URL pattern at build time. PR H — was the
+* missing half of the i18n story before this PR (the `i18nRouting()` Vite
+* plugin only handled request-time locale detection; routes themselves
+* were never duplicated, so static-host SSG outputs and SSR matching had
+* no `/de/about` / `/cs/about` records to render against).
+*
+* Strategy semantics:
+*
+* - **`prefix-except-default`** (default): the default locale's routes
+*   keep their original `urlPath` unchanged (`/about` stays `/about`); all
+*   non-default locales get a prefix (`/de/about`, `/cs/about`). Best for
+*   SEO-on-default-locale apps — search engines see canonical URLs at
+*   `/about` while non-default speakers get explicit prefixes.
+*
+* - **`prefix`**: every locale gets its own prefix, including the default
+*   (`/en/about`, `/de/about`, `/cs/about`). Root `/` becomes `/en` /
+*   `/de` / `/cs`. Better when no locale is "primary" — every URL
+*   self-identifies its locale.
+*
+* Layouts, error boundaries, loading components, and 404 pages duplicate
+* along with their pages — same source file (same `filePath`), new
+* locale-prefixed `urlPath` / `dirPath` / `depth`. The route tree built
+* from the expanded array therefore has one fully-formed subtree per
+* locale, so layout matching, dynamic params (`[id]` → `:id`), and
+* catch-all routes (`[...slug]` → `:slug*`) all compose naturally with
+* the locale prefix — no special cases.
+*
+* `getStaticPaths` composition (for SSG): each duplicate route inherits
+* the same `exports.getStaticPaths`. The SSG plugin's `expandUrlPattern`
+* step then expands `/blog/[slug]` × `[en, de]` × `getStaticPaths()
+* → ['a', 'b']` into `/blog/a`, `/blog/b`, `/de/blog/a`, `/de/blog/b`
+* (or all six prefixed forms under `'prefix'` strategy). Cardinality
+* compounds, which is by design — `ssg.concurrency` (PR D) limits
+* in-flight renders independent of route count.
+*
+* No-op when `config.locales` is empty or contains only the default
+* locale (prefix-except-default strategy with no other locales) — returns
+* the input array unchanged. Always return a fresh array on duplication
+* so callers don't accidentally mutate cached input.
+*
+* Reference: the helper is called from `vite-plugin.ts`'s virtual route
+* module load AND `ssg-plugin.ts`'s pre-render path expansion. Tested in
+* isolation — duplication is a pure transform on FileRoute[] with no
+* filesystem or network side effects.
+*/
+function expandRoutesForLocales(routes, config) {
+	const strategy = config.strategy ?? "prefix-except-default";
+	const { locales, defaultLocale } = config;
+	if (locales.length === 0) return routes;
+	for (const locale of locales) validateLocale(locale);
+	validateLocale(defaultLocale);
+	if (strategy === "prefix-except-default" && locales.length === 1 && locales[0] === defaultLocale) return routes;
+	const expanded = [];
+	for (const route of routes) for (const locale of locales) {
+		if (strategy === "prefix-except-default" && locale === defaultLocale) {
+			expanded.push(route);
+			continue;
+		}
+		if (strategy === "prefix-except-default" && route.isLayout && route.urlPath === "/") continue;
+		const newUrlPath = prefixUrlPath(route.urlPath, locale);
+		const newDirPath = route.dirPath === "" ? locale : `${locale}/${route.dirPath}`;
+		const newDepth = newUrlPath === "/" ? 0 : newUrlPath.split("/").filter(Boolean).length;
+		expanded.push({
+			...route,
+			urlPath: newUrlPath,
+			dirPath: newDirPath,
+			depth: newDepth
+		});
+	}
+	return expanded;
+}
+/**
+* Prepend `/locale` to a URL pattern. Handles three shapes:
+*   `/`         → `/de`
+*   `/about`    → `/de/about`
+*   `/users/:id` / `/blog/:slug*` → `/de/users/:id` / `/de/blog/:slug*`
+*
+* Internal helper to `expandRoutesForLocales`; not exported because the
+* public surface for path-building is `buildLocalePath` (which strips
+* existing locale prefixes — different semantics).
+*/
+function prefixUrlPath(urlPath, locale) {
+	if (urlPath === "/") return `/${locale}`;
+	return `/${locale}${urlPath}`;
+}
+/**
+* Validate a locale string (PR L2).
+*
+* The locale drives both URL pattern emission AND filesystem writes
+* (see `expandRoutesForLocales` for full rationale). Reject input that
+* would either:
+*   - break path-traversal boundaries (`..`, `/`, `\`)
+*   - produce invalid URL segments (whitespace, NUL)
+*   - create hidden-file artifacts (`.` leading)
+*   - silently kill the app (empty string)
+*
+* Throws with an actionable `[Pyreon]` error message. Called per-locale
+* by `expandRoutesForLocales` after the empty-locales no-op guard.
+*
+* @internal — exported for unit testing.
+*/
+function validateLocale(locale) {
+	if (typeof locale !== "string" || locale === "") throw new Error(`[Pyreon] Invalid i18n locale: ${JSON.stringify(locale)}. Locales must be non-empty strings (e.g. "en", "de", "en-US").`);
+	if (locale.trim() !== locale) throw new Error(`[Pyreon] Invalid i18n locale: ${JSON.stringify(locale)}. Leading or trailing whitespace not allowed.`);
+	if (locale.includes("/") || locale.includes("\\")) throw new Error(`[Pyreon] Invalid i18n locale: ${JSON.stringify(locale)}. Path separators ("/", "\\\\") not allowed — they would break URL emission and could write outside the dist directory.`);
+	if (locale === ".." || locale === ".") throw new Error(`[Pyreon] Invalid i18n locale: ${JSON.stringify(locale)}. Path-traversal segments not allowed.`);
+	if (locale.startsWith(".")) throw new Error(`[Pyreon] Invalid i18n locale: ${JSON.stringify(locale)}. Leading dot not allowed — it would create a hidden-file directory (\`dist/.${locale.slice(1)}/\`) invisible to most file listings.`);
+	if (locale.includes("\0")) throw new Error(`[Pyreon] Invalid i18n locale: ${JSON.stringify(locale)}. NUL characters not allowed.`);
+}
+/**
 * Create a LocaleContext for use in components and loaders.
 */
 function createLocaleContext(locale, path, config) {
@@ -163,5 +274,5 @@ function setLocale(locale, config) {
 }
 
 //#endregion
-export { LocaleCtx, buildLocalePath, createLocaleContext, detectLocaleFromHeader, extractLocaleFromPath, i18nRouting, localeSignal, setLocale, useLocale };
+export { LocaleCtx, buildLocalePath, createLocaleContext, detectLocaleFromHeader, expandRoutesForLocales, extractLocaleFromPath, i18nRouting, localeSignal, setLocale, useLocale, validateLocale };
 //# sourceMappingURL=i18n-routing.js.map

package/lib/image-plugin.js

@@ -11,9 +11,13 @@ function warnSharpMissing() {
 }
 /** Built-in CDN providers. */
 const cdnProviders = {
+	/** Cloudinary: `https://res.cloudinary.com/{cloud}/image/upload/...` */
 	cloudinary: (cloudName) => (src, { width, quality, format }) => `https://res.cloudinary.com/${cloudName}/image/upload/w_${width},q_${quality},f_${format}/${src}`,
+	/** Imgix: `https://{domain}.imgix.net/...?w=...&q=...&fm=...` */
 	imgix: (domain) => (src, { width, quality, format }) => `https://${domain}.imgix.net/${src}?w=${width}&q=${quality}&fm=${format}&auto=format`,
+	/** Vercel Image Optimization: `/_next/image?url=...&w=...&q=...` */
 	vercel: () => (src, { width, quality }) => `/_vercel/image?url=${encodeURIComponent(src)}&w=${width}&q=${quality}`,
+	/** Bunny CDN: `https://{pullZone}.b-cdn.net/...?width=...&quality=...` */
 	bunny: (pullZone) => (src, { width, quality }) => `https://${pullZone}.b-cdn.net/${src}?width=${width}&quality=${quality}`
 };
 const IMAGE_EXT_RE = /\.(jpe?g|png|webp|avif)$/i;