create-nextly-app 0.0.2-alpha.71 → 0.0.2-alpha.72

package/dist/{create-nextly-5wiGMVI6.mjs → create-nextly-CyI8XgVc.mjs}

@@ -8053,6 +8053,38 @@ var require_utils$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return output.join("");
 	}
 	/**
+	* Removes dot segments from the path of a relative reference (a path that does
+	* not start with "/") without changing what it resolves to against any base.
+	* Unlike `removeDotSegments`, leading ".." segments that cannot be collapsed
+	* are kept, the result never becomes root-relative, and a result that would be
+	* empty or start with an empty segment is prefixed with "." (an empty path
+	* means "same document" and a leading "//" would introduce an authority).
+	*
+	* @param {string} path
+	* @returns {string}
+	*/
+	function removeDotSegmentsRelative(path) {
+		if (path === "" || path[0] === "/") return removeDotSegments(path);
+		const segments = path.split("/");
+		const last = segments.length - 1;
+		/** @type {string[]} */
+		const output = [];
+		let trailingDirectory = false;
+		for (let i = 0; i <= last; i++) {
+			const segment = segments[i];
+			if (segment === "." || segment === "..") {
+				if (segment === "..") {
+					if (output.length !== 0 && output[output.length - 1] !== "..") output.pop();
+					else output.push("..");
+				}
+				trailingDirectory = i === last;
+			} else output.push(segment);
+		}
+		if (trailingDirectory && output[output.length - 1] !== "..") output.push("");
+		if (output.length === 0 || output[0] === "" || output[0].includes(":")) output.unshift(".");
+		return output.join("/");
+	}
+	/**
 	* Re-escape RFC 3986 gen-delims that must not appear literally in the host.
 	* After the URI regex parses, these characters cannot be literal in the host
 	* field, so any that appear after decoding came from percent-encoding and
@@ -8356,6 +8388,7 @@ var require_utils$3 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		encodeFragment,
 		escapePreservingEscapes,
 		removeDotSegments,
+		removeDotSegmentsRelative,
 		isIPv4,
 		isUUID,
 		normalizeIPv6,
@@ -8545,18 +8578,24 @@ var require_schemes = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils$3();
+	const { normalizeIPv6, removeDotSegments, removeDotSegmentsRelative, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils$3();
 	const { SCHEMES, getSchemeHandler } = require_schemes();
 	const VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
 	const MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+	const MALFORMED_HOST_ERROR = "URI host is malformed.";
+	const FORBIDDEN_DOMAIN_HOST_CHARACTER = /[\0-\x20"#/:<>?@[\\\]^`{|}\x7F]/u;
 	/**
+	* RFC 3986 section 3.1 does not allow percent-encoding in a scheme, so the
+	* scheme is validated as-is and never decoded. Decoding would let inert input
+	* such as `%6Aavascript:` become a live `javascript:` scheme.
+	*
 	* @param {string} scheme
 	* @returns {string}
 	*/
-	function decodeValidScheme(scheme) {
-		const decodedScheme = unescape(String(scheme));
-		if (!VALID_SCHEME.test(decodedScheme)) throw new TypeError(MALFORMED_SCHEME_ERROR);
-		return decodedScheme;
+	function validateScheme(scheme) {
+		const stringScheme = String(scheme);
+		if (!VALID_SCHEME.test(stringScheme)) throw new TypeError(MALFORMED_SCHEME_ERROR);
+		return stringScheme;
 	}
 	/**
 	* @template {import('./types/index').URIComponent|string} T
@@ -8584,6 +8623,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
 		const resolvedHost = resolved.host;
 		const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+		if (hasForbiddenDomainHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP)) throw new Error(MALFORMED_HOST_ERROR);
 		canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
 		const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !/\P{ASCII}/u.test(resolvedHost);
 		if (resolved.error && !encodedASCIIHost) throw new Error(resolved.error);
@@ -8627,10 +8667,11 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				} else {
 					if (relative.path[0] === "/") target.path = removeDotSegments(relative.path);
 					else {
-						if ((base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0) && !base.path) target.path = "/" + relative.path;
+						const baseHasAuthority = base.userinfo !== void 0 || base.host !== void 0 || base.port !== void 0;
+						if (baseHasAuthority && !base.path) target.path = "/" + relative.path;
 						else if (!base.path) target.path = relative.path;
 						else target.path = base.path.slice(0, base.path.lastIndexOf("/") + 1) + relative.path;
-						target.path = removeDotSegments(target.path);
+						target.path = base.scheme === void 0 && !baseHasAuthority && target.path[0] !== "/" ? removeDotSegmentsRelative(target.path) : removeDotSegments(target.path);
 					}
 					target.query = relative.query;
 				}
@@ -8678,17 +8719,18 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		};
 		const options = Object.assign({}, opts);
 		const uriTokens = [];
-		if (component.scheme) component.scheme = decodeValidScheme(component.scheme);
+		if (component.scheme) component.scheme = validateScheme(component.scheme);
 		const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
 		if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
 		const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
-		const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
+		const schemelessReference = (component.scheme === void 0 || options.reference === "suffix") && !hasAuthority;
+		const pathNoScheme = !options.skipEscape && schemelessReference;
 		if (component.path !== void 0) {
 			if (!options.skipEscape) component.path = serializePathEncoding(component.path, pathNoScheme);
 			else component.path = normalizePercentEncoding(component.path);
 		}
 		if (options.reference !== "suffix" && component.scheme) {
-			component.scheme = decodeValidScheme(component.scheme);
+			component.scheme = validateScheme(component.scheme);
 			uriTokens.push(component.scheme, ":");
 		}
 		const authority = recomposeAuthority(component);
@@ -8699,8 +8741,8 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 		if (component.path !== void 0) {
 			let s = component.path;
-			if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) s = removeDotSegments(s);
-			if (pathNoScheme) s = serializePathEncoding(s, true);
+			if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) s = schemelessReference && s[0] !== "/" ? removeDotSegmentsRelative(s) : removeDotSegments(s);
+			if (schemelessReference) s = serializePathEncoding(s, true);
 			if (authority === void 0 && s[0] === "/" && s[1] === "/") s = "/%2F" + s.slice(2);
 			uriTokens.push(s);
 		}
@@ -8764,15 +8806,50 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @returns {boolean} whether host conversion failed
 	*/
 	function canonicalizeHost(parsed, options, schemeHandler, isIP) {
-		if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) try {
-			parsed.host = new URL("http://" + parsed.host).hostname;
-		} catch (e) {
-			parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+		if (hasForbiddenDomainHost(parsed, options, schemeHandler, isIP)) {
+			parsed.error = parsed.error || MALFORMED_HOST_ERROR;
 			return true;
 		}
+		if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+			let url;
+			try {
+				url = new URL("http://" + parsed.host);
+			} catch (e) {
+				parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+				return true;
+			}
+			if (!isHostOnlyURL(url)) {
+				parsed.error = parsed.error || MALFORMED_HOST_ERROR;
+				return true;
+			}
+			parsed.host = url.hostname;
+		}
 		return false;
 	}
 	/**
+	* Whether a domain host contains an ASCII character that RFC 3986 does not
+	* allow in a reg-name (unreserved, sub-delims, or pct-encoded). Such a host is
+	* rejected instead of being handed to the WHATWG URL parser, which would treat
+	* "@" as a userinfo delimiter (silently dropping the data before it) and strip
+	* TAB, LF, and CR. Non-ASCII characters remain allowed for IDNs.
+	*
+	* @param {import('./types/index').URIComponent} parsed
+	* @param {import('./types/index').Options} options
+	* @param {{ domainHost?: boolean }|undefined} schemeHandler
+	* @param {boolean} isIP
+	* @returns {boolean}
+	*/
+	function hasForbiddenDomainHost(parsed, options, schemeHandler, isIP) {
+		return Boolean(parsed.host && isIP === false && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && FORBIDDEN_DOMAIN_HOST_CHARACTER.test(parsed.host));
+	}
+	/**
+	* @param {URL} url
+	* @returns {boolean}
+	*/
+	function isHostOnlyURL(url) {
+		return url.username === "" && url.password === "" && url.port === "" && url.pathname === "/" && url.search === "" && url.hash === "" && url.hostname !== "";
+	}
+	/**
 	* @param {string} uri
 	* @param {import('./types/index').Options} [opts]
 	* @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
@@ -8829,8 +8906,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			parsed.query = matches[7];
 			parsed.fragment = matches[8];
 			if (parsed.scheme !== void 0) {
-				const decodedScheme = unescape(parsed.scheme);
-				if (VALID_SCHEME.test(decodedScheme)) parsed.scheme = decodedScheme.toLowerCase();
+				if (VALID_SCHEME.test(parsed.scheme)) parsed.scheme = parsed.scheme.toLowerCase();
 				else {
 					parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
 					malformedScheme = true;
@@ -8853,7 +8929,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 					malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
 					parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
 					if (malformedIPLiteral) {
-						parsed.error = parsed.error || "URI host is malformed.";
+						parsed.error = parsed.error || MALFORMED_HOST_ERROR;
 						malformedAuthorityOrPort = true;
 					}
 				} else isIP = true;
@@ -8865,13 +8941,12 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (options.reference && options.reference !== "suffix" && options.reference !== parsed.reference) parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
 			const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
 			if (!malformedIPLiteral) malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+			if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
+				let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+				if (!isIP) host = normalizePercentEncoding(host.toLowerCase());
+				parsed.host = isIP || options.scheme !== "null" ? reescapeHostDelimiters(host, isIP) : host;
+			}
 			if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
-				if (uri.indexOf("%") !== -1) {
-					if (parsed.host !== void 0 && !malformedIPLiteral) {
-						const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-						parsed.host = reescapeHostDelimiters(host, isIP);
-					}
-				}
 				if (parsed.path) parsed.path = normalizePathEncoding(parsed.path);
 				if (parsed.query) parsed.query = normalizeQueryFragmentEncoding(parsed.query);
 				if (parsed.fragment) parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
@@ -46917,17 +46992,22 @@ async function generateRoutes(cwd, projectInfo) {
 *   lists and deletes media, every request checked against the signed-in
 *   caller's media permissions (`requireAuth: true` in the template);
 * - the public media route, `api/media/...`, which serves reads only;
+* - the uploads route, `uploads/...`, which serves files stored on local disk
+*   that `next start` has no static file for, those uploaded since it started;
 * - the health check.
 *
 * `segment` is the URL each route answers. A handler already answering it
 * means the app has its own route there, which is left alone. Next.js leaves
 * route groups `(name)` and slots `@name` out of the URL wherever they sit,
 * and never routes a private folder `_name`, so the folders that answer a URL
-* are found by that rule rather than by name. `catchAll` marks the optional
+* are found by that rule rather than by name. `catchAll` marks the
 * catch-alls, which serve everything below their URL too: a child folder
-* holding a handler is weighed by {@link childFinding}.
+* holding a handler is weighed by {@link childFinding}. The uploads route is
+* a required catch-all rather than an optional one, and is weighed the same
+* way: a handler at `/uploads` itself, or any route below it, is the app's
+* own and leaves it unwritten.
 *
-* `role` says what Nextly's route does there, for a media route the app
+* `role` says what Nextly's route does there, for a media or uploads route the app
 * already has something in place of; the report then carries the route to
 * add by hand.
 */
@@ -46955,6 +47035,20 @@ const ROUTES = [
 	}
 ];
 /**
+* The uploads route, written by {@link generateUploadsRoute} beside the media
+* routes. Apart from them because it is a different concern: it serves the
+* files local storage keeps, where they serve the media library's records.
+*/
+const UPLOADS_ROUTE = {
+	path: "uploads/[...path]/route.ts",
+	segment: "uploads",
+	catchAll: true,
+	importsConfig: true,
+	role: (file) => `Nextly's uploads route at ${file} serves files stored on local disk at /uploads, which a production server otherwise answers 404 for until it restarts`
+};
+/** Every route the existing-app path writes, read from the templates together. */
+const ALL_ROUTES = [...ROUTES, UPLOADS_ROUTE];
+/**
 * The import that brings in the Nextly config: the template spells it through
 * the `@nextly-config` alias or a path relative to its own layout, neither of
 * which an existing app is guaranteed to resolve.
@@ -47041,7 +47135,7 @@ var UnreadableFolder = class extends Error {
 */
 async function readMediaRouteTemplates(templatesDir = resolveTemplatePath()) {
 	const texts = /* @__PURE__ */ new Map();
-	for (const route of ROUTES) {
+	for (const route of ALL_ROUTES) {
 		const relative = `base/src/app/${route.path}`;
 		let text;
 		try {
@@ -47071,7 +47165,20 @@ async function readMediaRouteTemplates(templatesDir = resolveTemplatePath()) {
 * is for such an app.
 */
 async function generateMediaRoutes(cwd, projectInfo, templates) {
-	const prepared = ROUTES.map((route) => prepareRoute(cwd, projectInfo, templates, route));
+	return writeRoutes(cwd, projectInfo, templates, ROUTES);
+}
+/**
+* Write the uploads route into an existing app, by the same rules as
+* {@link generateMediaRoutes}: never where the app already answers
+* `/uploads`, never through a link, and under `pageExtensions` reported with
+* its content rather than written.
+*/
+async function generateUploadsRoute(cwd, projectInfo, templates) {
+	return writeRoutes(cwd, projectInfo, templates, [UPLOADS_ROUTE]);
+}
+/** Write each of `routes` where nothing answers its URL, reporting the rest. */
+async function writeRoutes(cwd, projectInfo, templates, routes) {
+	const prepared = routes.map((route) => prepareRoute(cwd, projectInfo, templates, route));
 	const pages = await appPageExtensions(cwd);
 	if (pages.extensions !== "absent") {
 		const { configName, extensions } = pages;
@@ -47875,6 +47982,7 @@ async function generateIntoExistingApp(cwd, projectType, projectInfo, database,
 		await generateRoutes(cwd, projectInfo),
 		await generateAdminPage(cwd, projectInfo),
 		await generateMediaRoutes(cwd, projectInfo, templates),
+		await generateUploadsRoute(cwd, projectInfo, templates),
 		await generateInstrumentation(cwd, projectInfo),
 		await generateTypesDirectory(cwd, projectInfo),
 		nextConfigFiles(await patchNextConfig(cwd, database)),
@@ -52547,4 +52655,4 @@ async function createNextly(options = {}) {
 }
 export { getAvailableTemplateNames as a, init as c, __require as d, __toESM$1 as f, validateTemplateName as i, shutdown as l, resolveProjectArg as n, packageVersion as o, validateProjectName as r, capture as s, createNextly as t, __commonJSMin$1 as u };
 
-//# sourceMappingURL=create-nextly-5wiGMVI6.mjs.map
+//# sourceMappingURL=create-nextly-CyI8XgVc.mjs.map