@zenithbuild/cli 0.7.3 → 0.7.4

package/dist/dev-server.js

@@ -15,11 +15,17 @@ import { existsSync, watch } from 'node:fs';
 import { readFile, stat } from 'node:fs/promises';
 import { performance } from 'node:perf_hooks';
 import { basename, dirname, extname, isAbsolute, join, relative, resolve } from 'node:path';
+import { appLocalRedirectLocation, imageEndpointPath, normalizeBasePath, routeCheckPath, stripBasePath } from './base-path.js';
+import { resolveBuildAdapter } from './adapters/resolve-adapter.js';
 import { createDevBuildSession } from './dev-build-session.js';
 import { createStartupProfiler } from './startup-profile.js';
 import { createSilentLogger } from './ui/logger.js';
 import { readChangeFingerprint } from './dev-watch.js';
-import { defaultRouteDenyMessage, executeServerRoute, injectSsrPayload, loadRouteManifest, resolveWithinDist, toStaticFilePath } from './preview.js';
+import { createTrustedOriginResolver, publicHost } from './request-origin.js';
+import { encodeRequestBodyBase64, readRequestBodyBuffer } from './request-body.js';
+import { supportsTargetRouteCheck } from './route-check-support.js';
+import { clientFacingRouteMessage, defaultRouteDenyMessage, logServerException, sanitizeRouteResult } from './server-error.js';
+import { executeServerRoute, injectSsrPayload, loadRouteManifest, resolveWithinDist, toStaticFilePath } from './preview.js';
 import { materializeImageMarkup } from './images/materialize.js';
 import { injectImageRuntimePayload } from './images/payload.js';
 import { handleImageRequest } from './images/service.js';
@@ -37,6 +43,9 @@ const MIME_TYPES = {
     '.avif': 'image/avif',
     '.gif': 'image/gif'
 };
+const IMAGE_RUNTIME_TAG_RE = new RegExp('<' + 'script\\b[^>]*\\bid=(["\'])zenith-image-runtime\\1[^>]*>[\\s\\S]*?<\\/' + 'script>', 'i');
+const EVENT_STREAM_MIME = ['text', 'event-stream'].join('/');
+const LEGACY_DEV_STREAM_PATH = ['/__zenith', '_hmr'].join('');
 // Note: V0 HMR script injection has been moved to the runtime client.
 // This server purely hosts the V1 HMR contract endpoints.
 /**
@@ -50,6 +59,8 @@ export async function createDevServer(options) {
     const { pagesDir, outDir, port = 3000, host = '127.0.0.1', config = {}, logger: providedLogger = null } = options;
     const logger = providedLogger || createSilentLogger();
     const buildSession = createDevBuildSession({ pagesDir, outDir, config, logger });
+    const configuredBasePath = normalizeBasePath(config.basePath || '/');
+    const routeCheckEnabled = supportsTargetRouteCheck(resolveBuildAdapter(config).target);
     const resolvedPagesDir = resolve(pagesDir);
     const resolvedOutDir = resolve(outDir);
     const resolvedOutDirTmp = resolve(dirname(resolvedOutDir), `${basename(resolvedOutDir)}.tmp`);
@@ -86,17 +97,19 @@ export async function createDevServer(options) {
     let currentCssHref = '';
     let currentCssContent = '';
     let actualPort = port;
+    const resolveServerOrigin = createTrustedOriginResolver({
+        host,
+        getPort: () => actualPort,
+        label: 'dev server'
+    });
     let currentRoutes = [];
     const rebuildDebounceMs = 5;
     const queuedRebuildDebounceMs = 5;
     function _publicHost() {
-        if (host === '0.0.0.0' || host === '::') {
-            return '127.0.0.1';
-        }
-        return host;
+        return publicHost(host);
     }
     function _serverOrigin() {
-        return `http://${_publicHost()}:${actualPort}`;
+        return resolveServerOrigin();
     }
     function _trace(event, payload = {}) {
         if (!traceEnabled)
@@ -208,6 +221,9 @@ export async function createDevServer(options) {
         throw lastError;
     }
     function _buildNotFoundPayload(pathname, category, cause) {
+        const hintedPath = category === 'page'
+            ? (stripBasePath(pathname, configuredBasePath) || pathname)
+            : pathname;
         const payload = {
             kind: 'zenith_dev_not_found',
             category,
@@ -235,7 +251,7 @@ export async function createDevServer(options) {
             payload.docsLink = '/docs/documentation/contracts/hmr-v1-contract.md';
             return payload;
         }
-        const routeFile = _routeFileHint(pathname);
+        const routeFile = _routeFileHint(hintedPath);
         payload.routeFile = routeFile;
         payload.cause = `no route file found at ${routeFile}`;
         payload.hint = `Create ${routeFile} or verify router manifest output.`;
@@ -452,15 +468,12 @@ export async function createDevServer(options) {
         }
     }
     const server = createServer(async (req, res) => {
-        const requestBase = typeof req.headers.host === 'string' && req.headers.host.length > 0
-            ? `http://${req.headers.host}`
-            : _serverOrigin();
-        const url = new URL(req.url, requestBase);
+        const url = new URL(req.url, _serverOrigin());
         let pathname = url.pathname;
         // Legacy HMR endpoint (deprecated but kept alive to avoid breaking old caches instantly)
-        if (pathname === '/__zenith_hmr') {
+        if (pathname === LEGACY_DEV_STREAM_PATH) {
             res.writeHead(200, {
-                'Content-Type': 'text/event-stream',
+                'Content-Type': EVENT_STREAM_MIME,
                 'Cache-Control': 'no-store',
                 'Connection': 'keep-alive',
                 'X-Zenith-Deprecated': 'true'
@@ -498,7 +511,7 @@ export async function createDevServer(options) {
         // V1 Dev Events Endpoint (SSE)
         if (pathname === '/__zenith_dev/events') {
             res.writeHead(200, {
-                'Content-Type': 'text/event-stream',
+                'Content-Type': EVENT_STREAM_MIME,
                 'Cache-Control': 'no-store',
                 'Connection': 'keep-alive',
                 'X-Accel-Buffering': 'no'
@@ -565,7 +578,7 @@ export async function createDevServer(options) {
             res.end(currentCssContent);
             return;
         }
-        if (pathname === '/_zenith/image') {
+        if (pathname === imageEndpointPath(configuredBasePath)) {
             await handleImageRequest(req, res, {
                 requestUrl: url,
                 projectRoot,
@@ -573,8 +586,13 @@ export async function createDevServer(options) {
             });
             return;
         }
-        if (pathname === '/__zenith/route-check') {
+        if (pathname === routeCheckPath(configuredBasePath)) {
             try {
+                if (!routeCheckEnabled) {
+                    res.writeHead(501, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+                    res.end(JSON.stringify({ error: 'route_check_unsupported' }));
+                    return;
+                }
                 if (!initialBuildSettled && buildStatus === 'building') {
                     res.writeHead(503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
                     res.end(JSON.stringify({
@@ -602,8 +620,16 @@ export async function createDevServer(options) {
                     res.end(JSON.stringify({ error: 'external_route_evaluation_forbidden' }));
                     return;
                 }
+                const canonicalTargetPath = stripBasePath(targetUrl.pathname, configuredBasePath);
+                if (canonicalTargetPath === null) {
+                    res.writeHead(404, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ error: 'route_not_found' }));
+                    return;
+                }
+                const canonicalTargetUrl = new URL(targetUrl.toString());
+                canonicalTargetUrl.pathname = canonicalTargetPath;
                 const routes = await _loadRoutesForRequests();
-                const resolvedCheck = resolveRequestRoute(targetUrl, routes);
+                const resolvedCheck = resolveRequestRoute(canonicalTargetUrl, routes);
                 if (!resolvedCheck.matched || !resolvedCheck.route) {
                     res.writeHead(404, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({ error: 'route_not_found' }));
@@ -623,16 +649,17 @@ export async function createDevServer(options) {
                 });
                 // Security: Enforce relative or same-origin redirects
                 if (checkResult && checkResult.result && checkResult.result.kind === 'redirect') {
-                    const loc = String(checkResult.result.location || '/');
+                    const loc = appLocalRedirectLocation(checkResult.result.location || '/', configuredBasePath);
+                    checkResult.result.location = loc;
                     if (loc.includes('://') || loc.startsWith('//')) {
                         try {
                             const parsedLoc = new URL(loc);
                             if (parsedLoc.origin !== targetUrl.origin) {
-                                checkResult.result.location = '/'; // Fallback to root for open redirect attempt
+                                checkResult.result.location = appLocalRedirectLocation('/', configuredBasePath);
                             }
                         }
                         catch {
-                            checkResult.result.location = '/';
+                            checkResult.result.location = appLocalRedirectLocation('/', configuredBasePath);
                         }
                     }
                 }
@@ -644,7 +671,7 @@ export async function createDevServer(options) {
                     'Vary': 'Cookie'
                 });
                 res.end(JSON.stringify({
-                    result: checkResult?.result || checkResult,
+                    result: sanitizeRouteResult(checkResult?.result || checkResult),
                     routeId: resolvedCheck.route.route_id || '',
                     to: targetUrl.toString()
                 }));
@@ -659,6 +686,7 @@ export async function createDevServer(options) {
         let resolvedPathFor404 = null;
         let staticRootFor404 = null;
         try {
+            const canonicalPath = stripBasePath(pathname, configuredBasePath);
             if (!initialBuildSettled && buildStatus === 'building') {
                 const pendingPayload = {
                     kind: 'zenith_dev_build_pending',
@@ -689,9 +717,12 @@ export async function createDevServer(options) {
                 ].join(''));
                 return;
             }
-            const requestExt = extname(pathname);
+            if (canonicalPath === null) {
+                throw new Error('not found');
+            }
+            const requestExt = extname(canonicalPath);
             if (requestExt && requestExt !== '.html') {
-                const assetPath = join(outDir, pathname);
+                const assetPath = join(outDir, canonicalPath);
                 resolvedPathFor404 = assetPath;
                 staticRootFor404 = outDir;
                 const asset = await _readFileForRequest(assetPath);
@@ -701,7 +732,9 @@ export async function createDevServer(options) {
                 return;
             }
             const routes = await _loadRoutesForRequests();
-            const resolved = resolveRequestRoute(url, routes);
+            const canonicalUrl = new URL(url.toString());
+            canonicalUrl.pathname = canonicalPath;
+            const resolved = resolveRequestRoute(canonicalUrl, routes);
             let filePath = null;
             if (resolved.matched && resolved.route) {
                 if (verboseLogging) {
@@ -713,7 +746,7 @@ export async function createDevServer(options) {
                 filePath = resolveWithinDist(outDir, output);
             }
             else {
-                filePath = toStaticFilePath(outDir, pathname);
+                filePath = toStaticFilePath(outDir, canonicalPath);
             }
             resolvedPathFor404 = filePath;
             staticRootFor404 = outDir;
@@ -721,39 +754,46 @@ export async function createDevServer(options) {
                 throw new Error('not found');
             }
             let ssrPayload = null;
+            let routeExecution = null;
             if (resolved.matched && resolved.route?.server_script && resolved.route.prerender !== true) {
-                let routeExecution = null;
                 try {
+                    const requestMethod = req.method || 'GET';
+                    const requestBodyBuffer = requestMethod === 'GET' || requestMethod === 'HEAD'
+                        ? null
+                        : await readRequestBodyBuffer(req);
                     routeExecution = await executeServerRoute({
                         source: resolved.route.server_script,
                         sourcePath: resolved.route.server_script_path || '',
                         params: resolved.params,
                         requestUrl: url.toString(),
-                        requestMethod: req.method || 'GET',
+                        requestMethod,
                         requestHeaders: req.headers,
+                        requestBodyBase64: encodeRequestBodyBase64(requestBodyBuffer),
                         routePattern: resolved.route.path,
                         routeFile: resolved.route.server_script_path || '',
                         routeId: resolved.route.route_id || ''
                     });
                 }
                 catch (error) {
+                    logServerException('dev server route execution failed', error);
                     ssrPayload = {
                         __zenith_error: {
+                            status: 500,
                             code: 'LOAD_FAILED',
-                            message: error instanceof Error ? error.message : String(error)
+                            message: error instanceof Error ? error.message : String(error || '')
                         }
                     };
                 }
-                const trace = routeExecution?.trace || { guard: 'none', load: 'none' };
+                const trace = routeExecution?.trace || { guard: 'none', action: 'none', load: 'none' };
                 const routeId = resolved.route.route_id || '';
                 if (verboseLogging) {
-                    logger.router(`${routeId || resolved.route.path} guard=${trace.guard} load=${trace.load}`);
+                    logger.router(`${routeId || resolved.route.path} guard=${trace.guard} action=${trace.action} load=${trace.load}`);
                 }
                 const result = routeExecution?.result;
                 if (result && result.kind === 'redirect') {
                     const status = Number.isInteger(result.status) ? result.status : 302;
                     res.writeHead(status, {
-                        Location: result.location,
+                        Location: appLocalRedirectLocation(result.location, configuredBasePath),
                         'Cache-Control': 'no-store'
                     });
                     res.end('');
@@ -762,7 +802,7 @@ export async function createDevServer(options) {
                 if (result && result.kind === 'deny') {
                     const status = Number.isInteger(result.status) ? result.status : 403;
                     res.writeHead(status, { 'Content-Type': 'text/plain; charset=utf-8' });
-                    res.end(result.message || defaultRouteDenyMessage(status));
+                    res.end(clientFacingRouteMessage(status, result.message));
                     return;
                 }
                 if (result && result.kind === 'data' && result.data && typeof result.data === 'object' && !Array.isArray(result.data)) {
@@ -770,21 +810,24 @@ export async function createDevServer(options) {
                 }
             }
             let content = await _readFileForRequest(filePath, 'utf8');
-            if (resolved.matched && resolved.route?.page_asset) {
-                const pageAssetPath = resolveWithinDist(outDir, resolved.route.page_asset);
+            if (resolved.matched) {
                 content = await materializeImageMarkup({
                     html: content,
-                    pageAssetPath,
                     payload: buildSession.getImageRuntimePayload(),
-                    ssrData: ssrPayload,
-                    routePathname: resolved.route.path || pathname
+                    imageMaterialization: Array.isArray(resolved.route?.image_materialization)
+                        ? resolved.route.image_materialization
+                        : []
                 });
             }
             if (ssrPayload) {
                 content = injectSsrPayload(content, ssrPayload);
             }
-            content = injectImageRuntimePayload(content, buildSession.getImageRuntimePayload());
-            res.writeHead(200, { 'Content-Type': 'text/html' });
+            if (!IMAGE_RUNTIME_TAG_RE.test(content)) {
+                content = injectImageRuntimePayload(content, buildSession.getImageRuntimePayload());
+            }
+            res.writeHead(Number.isInteger(routeExecution?.status) ? routeExecution.status : 200, {
+                'Content-Type': 'text/html'
+            });
             res.end(content);
         }
         catch (error) {

package/dist/framework-components/Image.zen

@@ -335,4 +335,4 @@ const imageHtml = renderImage();
 const imagePayload = serializeImageProps();
 </script>
 
-<span class="contents" data-zenith-image={imagePayload} innerHTML={imageHtml}></span>
+<span class="contents" data-zenith-image={imagePayload} unsafeHTML={imageHtml}></span>

package/dist/images/materialization-plan.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/images/materialization-plan.js

@@ -0,0 +1,6 @@
+/**
+ * Static Image props are evaluated in the Rust compiler (`zenith-compiler --merge-image-materialization`).
+ * See `mergePageImageMaterialization` in `build/compiler-runtime.js` and `packages/compiler/zenith_compiler/src/image_materialization.rs`.
+ * Legacy CLI-side TypeScript reconstruction was removed in Phase 2 Track B Sub-step 2.
+ */
+export {};

package/dist/images/materialize.d.ts

@@ -3,12 +3,14 @@ type ImagePayload = {
     config: Record<string, unknown>;
     localImages: Record<string, unknown>;
 };
+type ImageMaterializationEntry = {
+    selector?: string;
+    props?: Record<string, unknown> | null;
+};
 export declare function materializeImageMarkup(options: {
     html: string;
-    pageAssetPath?: string | null;
     payload: ImagePayload;
-    ssrData?: Record<string, unknown> | null;
-    routePathname?: string;
+    imageMaterialization?: ImageMaterializationEntry[] | null;
 }): Promise<string>;
 export declare function materializeImageMarkupInHtmlFiles(options: {
     distDir: string;

package/dist/images/materialize.js

@@ -1,29 +1,9 @@
 import { readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-const RUNTIME_EXPORTS = {
-    hydrate: () => () => { },
-    signal: (value) => value,
-    state: (value) => value,
-    ref: () => ({ current: null }),
-    zeneffect: () => () => { },
-    zenEffect: () => () => { },
-    zenMount: () => { },
-    zenWindow: () => undefined,
-    zenDocument: () => undefined,
-    zenOn: () => () => { },
-    zenResize: () => () => { },
-    collectRefs: (...refs) => refs.filter(Boolean)
-};
+import { renderImageHtmlWithPayload, replaceImageMarkers, serializeImageProps } from './runtime.js';
 function escapeRegex(value) {
     return value.replace(/[|\\{}()[\]^$+?.]/g, '\\$&');
 }
-function escapeHtml(value) {
-    return String(value ?? '')
-        .replace(/&/g, '&')
-        .replace(/"/g, '"')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;');
-}
 function parseMarkerSelector(selector) {
     const match = selector.match(/^\[([^\]=]+)=["']([^"']+)["']\]$/);
     if (!match)
@@ -41,7 +21,7 @@ function upsertAttributeMarkup(attributes, attrName, value) {
     if (value === null || value === undefined || value === false || value === '') {
         return attributes.replace(attrPattern, '');
     }
-    const serialized = ` ${trimmedName}="${escapeHtml(value)}"`;
+    const serialized = ` ${trimmedName}="${String(value)}"`;
     if (attrPattern.test(attributes)) {
         return attributes.replace(attrPattern, serialized);
     }
@@ -52,7 +32,7 @@ function applyAttributeMarker(html, selector, attrName, value) {
     if (!parsed)
         return html;
     const markerRe = new RegExp(`<([A-Za-z][\\w:-]*)([^>]*\\s${escapeRegex(parsed.attrName)}=(["'])${escapeRegex(parsed.attrValue)}\\3[^>]*)>`, 'g');
-    return html.replace(markerRe, (match, tagName, attrs) => {
+    return html.replace(markerRe, (_match, tagName, attrs) => {
         const nextAttrs = upsertAttributeMarkup(String(attrs || ''), attrName, value);
         return `<${tagName}${nextAttrs}>`;
     });
@@ -65,95 +45,33 @@ function applyInnerHtmlMarker(html, selector, value) {
     const replacement = value === null || value === undefined || value === false ? '' : String(value);
     return html.replace(markerRe, (_match, tagName, attrs) => `<${tagName}${attrs}>${replacement}</${tagName}>`);
 }
-function stripModuleSyntax(source) {
-    let next = source.replace(/^import\s+[^;]+;\s*$/gm, '');
-    if (/(^|\n)\s*import\s+/m.test(next)) {
-        throw new Error('[Zenith:Image] Cannot materialize page asset with unresolved imports');
-    }
-    next = next.replace(/^export\s+default\s+function\s+/gm, 'function ');
-    next = next.replace(/^export\s+function\s+/gm, 'function ');
-    next = next.replace(/^export\s+const\s+/gm, 'const ');
-    next = next.replace(/^export\s+let\s+/gm, 'let ');
-    next = next.replace(/^export\s+var\s+/gm, 'var ');
-    next = next.replace(/\bexport\s*\{[^}]*\};?/g, '');
-    return next;
-}
-async function evaluatePageModule(assetPath, payload, ssrData, routePathname) {
-    const source = stripModuleSyntax(await readFile(assetPath, 'utf8'));
-    const runtimeNames = Object.keys(RUNTIME_EXPORTS);
-    const evaluator = new Function('runtime', 'payload', 'ssrData', 'routePathname', [
-        '"use strict";',
-        `const { ${runtimeNames.join(', ')} } = runtime;`,
-        'const document = {};',
-        'const location = { pathname: routePathname || "/" };',
-        'const Document = class ZenithServerDocument {};',
-        'const globalThis = {',
-        '  __zenith_image_runtime: payload,',
-        '  document,',
-        '  location,',
-        '  Document',
-        '};',
-        'if (ssrData && typeof ssrData === "object" && !Array.isArray(ssrData)) {',
-        '  globalThis.__zenith_ssr_data = ssrData;',
-        '}',
-        'globalThis.globalThis = globalThis;',
-        'globalThis.window = globalThis;',
-        'globalThis.self = globalThis;',
-        source,
-        'return {',
-        '  __zenith_markers: typeof __zenith_markers !== "undefined" ? __zenith_markers : [],',
-        '  __zenith_expression_bindings: typeof __zenith_expression_bindings !== "undefined" ? __zenith_expression_bindings : [],',
-        '  __zenith_expr_fns: typeof __zenith_expr_fns !== "undefined" ? __zenith_expr_fns : []',
-        '};'
-    ].join('\n'));
-    return evaluator(RUNTIME_EXPORTS, payload, ssrData, routePathname);
+function isPlainObject(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
-function buildExpressionContext(ssrData) {
-    return {
-        signalMap: new Map(),
-        params: {},
-        props: {},
-        ssrData: ssrData || {},
-        componentBindings: {},
-        zenhtml: null,
-        fragment: null
-    };
+function hasUnmaterializedImageMarkers(html) {
+    const matches = html.match(/<span\b[^>]*\bdata-zx-(?:data-zenith-image|unsafeHTML)=(["'])[^"']+\1[^>]*>/gi) || [];
+    return matches.some((tag) => /\sdata-zenith-image=/.test(tag) === false);
 }
 export async function materializeImageMarkup(options) {
-    const { html, pageAssetPath, payload, ssrData = null, routePathname = '/' } = options;
-    if (!pageAssetPath || !html.includes('data-zx-data-zenith-image')) {
-        return html;
-    }
-    const namespace = await evaluatePageModule(pageAssetPath, payload, ssrData, routePathname);
-    if (!namespace) {
-        return html;
-    }
-    const markers = Array.isArray(namespace.__zenith_markers) ? namespace.__zenith_markers : [];
-    const bindings = Array.isArray(namespace.__zenith_expression_bindings) ? namespace.__zenith_expression_bindings : [];
-    const exprFns = Array.isArray(namespace.__zenith_expr_fns) ? namespace.__zenith_expr_fns : [];
-    if (markers.length === 0 || bindings.length === 0 || exprFns.length === 0) {
+    const { html, payload, imageMaterialization = [] } = options;
+    const entries = Array.isArray(imageMaterialization) ? imageMaterialization : [];
+    if (typeof html !== 'string' || html.length === 0) {
         return html;
     }
-    const markerByIndex = new Map(markers.map((marker) => [marker.index, marker]));
     let nextHtml = html;
-    const context = buildExpressionContext(ssrData);
-    for (const binding of bindings) {
-        const marker = markerByIndex.get(Number(binding.marker_index));
-        const exprFn = Number.isInteger(binding.fn_index) ? exprFns[binding.fn_index] : null;
-        if (!marker ||
-            typeof exprFn !== 'function' ||
-            marker.kind !== 'attr' ||
-            typeof marker.selector !== 'string' ||
-            marker.selector.includes('data-zx-data-zenith-image') === false &&
-                marker.selector.includes('data-zx-innerHTML') === false) {
+    for (const entry of entries) {
+        if (!entry || typeof entry.selector !== 'string' || !isPlainObject(entry.props)) {
             continue;
         }
-        const value = exprFn(context);
-        if (marker.attr === 'innerHTML') {
-            nextHtml = applyInnerHtmlMarker(nextHtml, marker.selector, value);
-            continue;
-        }
-        nextHtml = applyAttributeMarker(nextHtml, marker.selector, marker.attr || '', value);
+        const encodedProps = serializeImageProps(entry.props);
+        const renderedHtml = renderImageHtmlWithPayload(entry.props, payload);
+        nextHtml = applyAttributeMarker(nextHtml, entry.selector, 'data-zenith-image', encodedProps);
+        nextHtml = applyInnerHtmlMarker(nextHtml, entry.selector, renderedHtml);
+    }
+    nextHtml = replaceImageMarkers(nextHtml, payload);
+    if (hasUnmaterializedImageMarkers(nextHtml)) {
+        throw new Error('[Zenith:Image] Unresolved Image markers require a compiler-owned image materialization artifact. ' +
+            'Dynamic image props are currently unsupported.');
     }
     return nextHtml;
 }
@@ -175,11 +93,9 @@ export async function materializeImageMarkupInHtmlFiles(options) {
             continue;
         }
         const outputPath = typeof route.output === 'string' ? route.output.replace(/^\//, '') : '';
-        const assetPath = typeof route.page_asset === 'string' ? route.page_asset.replace(/^\//, '') : '';
-        if (!outputPath || !assetPath)
+        if (!outputPath)
             continue;
         const fullHtmlPath = join(distDir, outputPath);
-        const fullAssetPath = join(distDir, assetPath);
         let html = '';
         try {
             html = await readFile(fullHtmlPath, 'utf8');
@@ -189,9 +105,8 @@ export async function materializeImageMarkupInHtmlFiles(options) {
         }
         const nextHtml = await materializeImageMarkup({
             html,
-            pageAssetPath: fullAssetPath,
             payload,
-            routePathname: typeof route.path === 'string' ? route.path : '/'
+            imageMaterialization: Array.isArray(route.image_materialization) ? route.image_materialization : []
         });
         if (nextHtml !== html) {
             await writeFile(fullHtmlPath, nextHtml, 'utf8');

package/dist/images/router-manifest.d.ts

@@ -0,0 +1 @@
+export function injectImageMaterializationIntoRouterManifest(distDir: any, envelopes: any): Promise<void>;

package/dist/images/router-manifest.js

@@ -0,0 +1,49 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+export async function injectImageMaterializationIntoRouterManifest(distDir, envelopes) {
+    const manifestPath = join(distDir, 'assets', 'router-manifest.json');
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(manifestPath, 'utf8'));
+    }
+    catch {
+        return;
+    }
+    const routes = Array.isArray(parsed?.routes) ? parsed.routes : null;
+    if (!routes) {
+        return;
+    }
+    const serverMetadataByRoute = new Map();
+    for (const envelope of Array.isArray(envelopes) ? envelopes : []) {
+        const route = typeof envelope?.route === 'string' ? envelope.route : '';
+        if (!route) {
+            continue;
+        }
+        const routeIr = envelope?.ir && typeof envelope.ir === 'object' ? envelope.ir : {};
+        serverMetadataByRoute.set(route, {
+            guard_module_ref: routeIr.guard_module_ref || null,
+            load_module_ref: routeIr.load_module_ref || null,
+            action_module_ref: routeIr.action_module_ref || null,
+            has_guard: routeIr.has_guard === true,
+            has_load: routeIr.has_load === true,
+            has_action: routeIr.has_action === true
+        });
+    }
+    for (const route of routes) {
+        const routePath = typeof route?.path === 'string' ? route.path : '';
+        if (!routePath) {
+            continue;
+        }
+        const serverMetadata = serverMetadataByRoute.get(routePath);
+        if (!serverMetadata) {
+            continue;
+        }
+        route.guard_module_ref = serverMetadata.guard_module_ref;
+        route.load_module_ref = serverMetadata.load_module_ref;
+        route.action_module_ref = serverMetadata.action_module_ref;
+        route.has_guard = serverMetadata.has_guard;
+        route.has_load = serverMetadata.has_load;
+        route.has_action = serverMetadata.has_action;
+    }
+    await writeFile(manifestPath, `${JSON.stringify(parsed, null, 2)}\n`, 'utf8');
+}

package/dist/index.js

@@ -88,9 +88,15 @@ export async function cli(args, cwd) {
         printUsage(logger);
         process.exit(0);
     }
-    if (!command || !COMMANDS.includes(command)) {
+    if (!command) {
         printUsage(logger);
-        process.exit(command ? 1 : 0);
+        process.exit(0);
+    }
+    if (!COMMANDS.includes(command)) {
+        logger.print(`Unknown command: ${command}`);
+        logger.print('');
+        printUsage(logger);
+        process.exit(1);
     }
     const projectRoot = resolve(cwd || process.cwd());
     const config = await loadConfig(projectRoot);

package/dist/manifest.js

@@ -88,12 +88,13 @@ async function _scanDir(dir, root, ext, compilerOpts) {
 function buildManifestEntry({ fullPath, root, routePath, compilerOpts }) {
     const rawSource = readFileSync(fullPath, 'utf8');
     const inlineServerScript = extractServerScript(rawSource, fullPath, compilerOpts).serverScript;
-    const { guardPath, loadPath } = resolveAdjacentServerModules(fullPath);
+    const { guardPath, loadPath, actionPath } = resolveAdjacentServerModules(fullPath);
     const composed = composeServerScriptEnvelope({
         sourceFile: fullPath,
         inlineServerScript,
         adjacentGuardPath: guardPath,
-        adjacentLoadPath: loadPath
+        adjacentLoadPath: loadPath,
+        adjacentActionPath: actionPath
     });
     return {
         path: routePath,

package/dist/preview.d.ts

@@ -39,9 +39,9 @@ export function createPreviewServer(options: {
 export function loadRouteManifest(distDir: string): Promise<PreviewRoute[]>;
 /**
  * @param {{ source: string, sourcePath: string, params: Record<string, string>, requestUrl?: string, requestMethod?: string, requestHeaders?: Record<string, string | string[] | undefined>, routePattern?: string, routeFile?: string, routeId?: string }} input
- * @returns {Promise<{ result: { kind: string, [key: string]: unknown }, trace: { guard: string, load: string } }>}
+ * @returns {Promise<{ result: { kind: string, [key: string]: unknown }, trace: { guard: string, action: string, load: string }, status?: number }>}
  */
-export function executeServerRoute({ source, sourcePath, params, requestUrl, requestMethod, requestHeaders, routePattern, routeFile, routeId, guardOnly }: {
+export function executeServerRoute({ source, sourcePath, params, requestUrl, requestMethod, requestHeaders, requestBodyBase64, routePattern, routeFile, routeId, guardOnly }: {
     source: string;
     sourcePath: string;
     params: Record<string, string>;
@@ -58,10 +58,11 @@ export function executeServerRoute({ source, sourcePath, params, requestUrl, req
     };
     trace: {
         guard: string;
+        action: string;
         load: string;
     };
+    status?: number;
 }>;
-export function defaultRouteDenyMessage(status: any): "Unauthorized" | "Forbidden" | "Not Found" | "Internal Server Error";
 /**
  * @param {{ source: string, sourcePath: string, params: Record<string, string>, requestUrl?: string, requestMethod?: string, requestHeaders?: Record<string, string | string[] | undefined>, routePattern?: string, routeFile?: string, routeId?: string }} input
  * @returns {Promise<Record<string, unknown> | null>}