xpine 0.0.56 → 0.0.59

package/.claude/settings.local.json

@@ -0,0 +1,32 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(npm run *)",
+      "Bash(PORT=8888 node ./dist/server/run/prod.js)",
+      "Bash(curl -s -o /dev/null -w \"%{http_code}\" http://localhost:8888/)",
+      "Bash(break)",
+      "Bash(curl -s -o /dev/null -w \"status=%{http_code}\\\\n\" http://localhost:8888/blog/technology/devops/my-blog-post)",
+      "Bash(curl -s http://localhost:8888/blog/technology/devops/my-blog-post)",
+      "Bash(curl -s -o /dev/null -w \"status=%{http_code}\\\\n\" http://localhost:8888/blog/preview/some/new/post)",
+      "Bash(curl -s http://localhost:8888/blog/preview/some/new/post)",
+      "Bash(curl -s -o /dev/null -w \"status=%{http_code}\\\\n\" http://localhost:8888/blog/totally/unknown/path)",
+      "Bash(curl -s http://localhost:8888/blog/totally/unknown/path)",
+      "Bash(curl -s -o /dev/null -w \"status=%{http_code}\\\\n\" http://localhost:8888/some-totally-random-route-xyz)",
+      "Bash(curl -s http://localhost:8888/some-totally-random-route-xyz)",
+      "Bash(curl -s http://localhost:8888/some-random-xyz)",
+      "Bash(curl -s -o /dev/null -w \"status=%{http_code}\\\\n\" http://localhost:8888/blog/nope)",
+      "Bash(curl -s http://localhost:8888/blog/nope)",
+      "Bash(PORT=8888 npx playwright test app-build --grep \"multi-segment\")",
+      "Bash(PORT=8888 npx playwright test)",
+      "Bash(npx eslint *)",
+      "Bash(echo \"=== exit: $? ===\")",
+      "Bash(git stash *)",
+      "Bash(PORT=8888 npx playwright test app-build --grep \"traverse\")",
+      "Bash(node -e \"console.log\\(require\\('./node_modules/jsonwebtoken/package.json'\\).version\\)\")",
+      "Bash(JWT_PRIVATE_KEY=test-secret-123 node --input-type=module -e ' *)",
+      "Bash(node --input-type=module -e ' *)",
+      "Bash(CSRF_SECRET='csrf-secret-xyz' node /tmp/csrf-test.mjs)",
+      "Bash(CSRF_SECRET='csrf-secret-xyz' node csrf-test.mjs)"
+    ]
+  }
+}

package/README.md

@@ -155,6 +155,47 @@ You can create catch all routes by naming the file \_all\_.(jsx|tsx|js|ts). You
 
 You can get the route param in your function with req.params[0], such as how express handles catch all routes.
 
+### Multi-segment dynamic routes (`[...slug]`)
+
+Catch all (`_all_`) routes register a single Express wildcard, which means they match _every_ path under their prefix — including paths that should not exist. For deeply nested but known dynamic routes (e.g. a blog post at `/blog/technology/devops/my-blog-post`), use a multi-segment dynamic param instead. Name the file `[...slug].(jsx|tsx|js|ts)`; the captured value (which may contain slashes) is available as `req.params.slug`.
+
+Instead of a wildcard, XPine registers an **explicit Express route for each slug** returned by the `staticPaths` config function, so unknown paths safely fall through to your 404 page:
+
+```
+// /src/pages/blog/+config.ts
+export default {
+  staticPaths() {
+    // Slugs can come from a CMS/database
+    return [
+      { slug: 'technology/devops/my-blog-post' },
+    ];
+  },
+};
+```
+
+```
+// /src/pages/blog/[...slug].tsx
+import { PageProps } from 'xpine/dist/types';
+
+export default function BlogPost({ req }: PageProps) {
+  return <div>{req.params.slug}</div>;
+}
+```
+
+Each slug from `staticPaths` is also statically generated at build time. To allow slugs that are not known at build time (without falling back to an unsafe catch-all), add an `isValid` function to the config. It receives the requested slug and runs at request time; return `false` (the default for unknown slugs) to fall through to the 404 handler:
+
+```
+export default {
+  staticPaths() {
+    return [{ slug: 'technology/devops/my-blog-post' }];
+  },
+  // Resolve newly-published slugs without a rebuild
+  async isValid(slug, req) {
+    return await postExists(slug);
+  },
+};
+```
+
 ### Route specific middleware
 
 If you need route specific middleware, e.g. for file uploads, you can specify a `routeMiddleware` function in a config variable in the endpoint file:
@@ -168,6 +209,58 @@ export const config = {
 }
 ```
 
+### CSRF protection
+
+Because authentication is cookie based, state-changing requests (POST/PUT/PATCH/DELETE) are exposed to cross-site request forgery. Enable the built-in guard by setting `csrf` in your `xpine.config.mjs`:
+
+```
+export default {
+  csrf: true,
+}
+```
+
+It uses a stateless **signed double-submit cookie**. On safe requests (GET/HEAD/OPTIONS) it sets a `csrfToken` cookie (readable by client JS). On state-changing requests it requires that same token to be echoed back in an `x-csrf-token` header (or a `_csrf` form field) — a cross-site attacker can make the browser send the cookie but cannot read it or set the header, so forged requests are rejected with a 403. The token is HMAC-signed so it can't be forged even by an attacker who can plant a cookie.
+
+Set a secret via the `CSRF_SECRET` env var (it falls back to `JWT_PRIVATE_KEY`). The server fails to start if neither is set.
+
+For `fetch`/Alpine requests, read the cookie and send it back:
+```
+const token = document.cookie.split('; ').find(c => c.startsWith('csrfToken='))?.split('=')[1];
+await fetch('/api/thing', {
+  method: 'POST',
+  headers: { 'x-csrf-token': decodeURIComponent(token) },
+});
+```
+For server-rendered HTML forms, the token is available on `res.locals.csrfToken` (pages receive `res`); render it as a hidden `<input name="_csrf">`.
+
+You can customize the cookie/header/field names, cookie attributes, and skip specific path prefixes (e.g. signed webhooks):
+```
+export default {
+  csrf: {
+    headerName: 'x-csrf-token',
+    cookie: { sameSite: 'strict', secure: true },
+    ignorePaths: ['/api/webhooks/'],
+  },
+}
+```
+
+### HTML escaping (XSS protection)
+
+Values interpolated into JSX are HTML-escaped by default, so rendering user input is safe:
+```
+// req.params.slug = '<img src=x onerror=alert(1)>'
+<div>{req.params.slug}</div>   // renders &lt;img src=x onerror=alert(1)&gt;
+```
+Nested components and elements are not re-escaped, and attribute values are escaped too. Text inside `<script>`/`<style>` is left raw (it isn't HTML) — never interpolate untrusted data there.
+
+If you have trusted HTML that should render as-is, opt out explicitly with `raw()`:
+```
+import { raw } from 'xpine';
+
+<div>{raw(trustedHtmlString)}</div>
+```
+Only use `raw()` with HTML you control — never with user input.
+
 ### Static Site Generation
 
 Generate path specific static pages by specifying in the config of either the page's file, such as `/src/pages/about.tsx` with a config export:

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export * from './src/util/env';
 export * from './src/util/get-config';
 export * from './src/scripts/build';
 export * from './src/auth';
+export * from './src/csrf';
 export * from './src/util/html';
 export * from './src/context';
 export * from './src/util/web';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,YAAY,CAAC;AAC3B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,gBAAgB,CAAC"}

package/dist/index.js

@@ -326,6 +326,9 @@ var regex_default = {
   configFile: /\+config\.[tj]sx?/g,
   dynamicRoutes: /(\[)(.*?)(\])/g,
   isDynamicRoute: /\[(.*)\]/g,
+  // Multi-segment (slash-containing) dynamic route, e.g. [...slug]
+  spreadRoute: /\[\.\.\.(.*?)\]/g,
+  isSpreadRoute: /\[\.\.\..*?\]/,
   endsWithTSX: /\.tsx$/,
   endsWithJSX: /\.jsx$/,
   endsWithJs: /\.js$/,
@@ -467,6 +470,12 @@ import { globSync } from "glob";
 // src/auth.ts
 import jsonwebtoken from "jsonwebtoken";
 var { verify, sign } = jsonwebtoken;
+var JWT_ALGORITHM = "HS256";
+function getSecret() {
+  const secret = process.env.JWT_PRIVATE_KEY;
+  if (!secret) throw new Error("JWT_PRIVATE_KEY is not set");
+  return secret;
+}
 async function signUser(email, username) {
   return new Promise((resolve, reject) => {
     sign(
@@ -476,11 +485,10 @@ async function signUser(email, username) {
           username
         }
       },
-      // @ts-ignore
-      process.env.JWT_PRIVATE_KEY,
-      { expiresIn: "30d" },
+      getSecret(),
+      { expiresIn: "30d", algorithm: JWT_ALGORITHM },
       (err, token) => {
-        if (err) reject(err);
+        if (err) return reject(err);
         resolve(token);
       }
     );
@@ -488,8 +496,8 @@ async function signUser(email, username) {
 }
 async function verifyUser(token) {
   return new Promise((resolve, reject) => {
-    verify(token, process.env.JWT_PRIVATE_KEY, (err, authorizedData) => {
-      if (err) reject(err);
+    verify(token, getSecret(), { algorithms: [JWT_ALGORITHM] }, (err, authorizedData) => {
+      if (err) return reject(err);
       resolve(authorizedData);
     });
   });
@@ -506,8 +514,163 @@ import requestIP from "request-ip";
 import fs5 from "fs-extra";
 import path5 from "path";
 import EventEmitter from "events";
+
+// src/csrf.ts
+import crypto from "crypto";
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function resolveSecret(options) {
+  const secret = options?.secret || process.env.CSRF_SECRET || process.env.JWT_PRIVATE_KEY;
+  if (!secret) throw new Error("CSRF secret is not set (set CSRF_SECRET or JWT_PRIVATE_KEY)");
+  return secret;
+}
+function hmac(value, secret) {
+  return crypto.createHmac("sha256", secret).update(value).digest("base64url");
+}
+function issueToken(secret) {
+  const random = crypto.randomBytes(32).toString("base64url");
+  return `${random}.${hmac(random, secret)}`;
+}
+function isValidToken(token, secret) {
+  if (typeof token !== "string" || !token) return false;
+  const idx = token.lastIndexOf(".");
+  if (idx <= 0 || idx === token.length - 1) return false;
+  const random = token.slice(0, idx);
+  const signature = token.slice(idx + 1);
+  return timingSafeEqual(signature, hmac(random, secret));
+}
+function timingSafeEqual(a, b) {
+  const ab = Buffer.from(String(a));
+  const bb = Buffer.from(String(b));
+  if (ab.length !== bb.length) return false;
+  return crypto.timingSafeEqual(ab, bb);
+}
+function readSubmittedToken(req, headerName, fieldName) {
+  const header = req.headers[headerName];
+  const fromHeader = Array.isArray(header) ? header[0] : header;
+  if (fromHeader) return fromHeader;
+  if (req.body && typeof req.body[fieldName] === "string") return req.body[fieldName];
+  return "";
+}
+function createCsrfMiddleware(options) {
+  const secret = resolveSecret(options);
+  const cookieName = options?.cookieName || "csrfToken";
+  const headerName = (options?.headerName || "x-csrf-token").toLowerCase();
+  const fieldName = options?.fieldName || "_csrf";
+  const ignorePaths = options?.ignorePaths || [];
+  const cookieOptions = {
+    httpOnly: false,
+    // must be readable by client JS for the double-submit
+    sameSite: options?.cookie?.sameSite ?? "lax",
+    secure: options?.cookie?.secure ?? process.env.NODE_ENV !== "development",
+    path: options?.cookie?.path ?? "/",
+    maxAge: options?.cookie?.maxAge
+  };
+  return function csrfMiddleware(req, res, next) {
+    const existing = req.cookies?.[cookieName] || "";
+    let token = existing;
+    if (!isValidToken(existing, secret)) {
+      token = issueToken(secret);
+      res.cookie(cookieName, token, cookieOptions);
+    }
+    res.locals.csrfToken = token;
+    if (SAFE_METHODS.has(req.method)) return next();
+    if (ignorePaths.some((prefix) => req.path.startsWith(prefix))) return next();
+    const submitted = readSubmittedToken(req, headerName, fieldName);
+    if (isValidToken(existing, secret) && timingSafeEqual(submitted, existing)) {
+      return next();
+    }
+    res.status(403).json({ message: "Invalid CSRF token" });
+  };
+}
+
+// src/express.ts
 var methods = ["get", "post", "put", "patch", "delete"];
 var isDev = process.env.NODE_ENV === "development";
+function parseRoutePath(route) {
+  const slugRoute = route.replace(/[ ]/g, "");
+  const foundMethod = methods.find((method) => slugRoute.toUpperCase().endsWith(`.${method.toUpperCase()}`));
+  const templateRoute = foundMethod ? slugRoute.slice(0, -(foundMethod.length + 1)) : slugRoute;
+  let formattedRouteItem = templateRoute.replace(regex_default.spreadRoute, (_match, name) => ":" + name);
+  if (slugRoute.match(regex_default.isDynamicRoute)) {
+    for (const match of formattedRouteItem.matchAll(regex_default.dynamicRoutes)) {
+      formattedRouteItem = formattedRouteItem.replace(match[0], ":" + match[2]);
+    }
+  }
+  if (formattedRouteItem.match(regex_default.catchAllRoute)) {
+    formattedRouteItem = formattedRouteItem.replace(regex_default.catchAllRoute, "/*");
+  }
+  return {
+    foundMethod,
+    formattedRouteItem,
+    templateRoute,
+    isSpread: regex_default.isSpreadRoute.test(templateRoute)
+  };
+}
+function spreadConcretePath(templateRoute, entry) {
+  return templateRoute.replace(regex_default.spreadRoute, (_match, name) => entry[name] ?? "").replace(regex_default.dynamicRoutes, (_match, _open, name) => entry[name] ?? "").replace(/\/{2,}/g, "/");
+}
+function spreadWildcardPath(templateRoute) {
+  return templateRoute.replace(regex_default.spreadRoute, "*").replace(regex_default.dynamicRoutes, (_match, _open, name) => ":" + name);
+}
+function spreadSlugName(templateRoute) {
+  const match = templateRoute.match(/\[\.\.\.(.*?)\]/);
+  return match ? match[1] : null;
+}
+async function resolveConfig(configFilePaths, componentImport) {
+  const baseConfig = configFilePaths ? await getCompleteConfig(configFilePaths, Date.now()) : {};
+  return componentImport?.config ? { ...baseConfig, ...componentImport.config } : baseConfig;
+}
+async function renderJSX(componentFn, config2, req, res, urlPath) {
+  const data = config2?.data ? await config2.data(req) : null;
+  const children = await componentFn({ req, res, data, config: config2, routePath: urlPath });
+  const output = config2?.wrapper ? await config2.wrapper({ req, children, config: config2, data, routePath: urlPath }) : children;
+  return doctypeHTML + output;
+}
+async function resolveSpreadRoute(templateRoute, config2, originalRoute) {
+  let entries = [];
+  if (typeof config2?.staticPaths === "function") {
+    try {
+      entries = await config2.staticPaths() || [];
+    } catch (err) {
+      console.error(err);
+      console.error("Could not resolve staticPaths for spread route", originalRoute);
+    }
+  }
+  return {
+    templateRoute,
+    entries,
+    validator: config2?.isValid || null
+  };
+}
+function registerSpreadRoutes(register, spread) {
+  const slugName = spreadSlugName(spread.templateRoute);
+  for (const entry of spread.entries) {
+    register(spreadConcretePath(spread.templateRoute, entry), [
+      (req, _res, next) => {
+        Object.assign(req.params, entry);
+        next();
+      }
+    ]);
+  }
+  const { validator } = spread;
+  if (validator) {
+    register(spreadWildcardPath(spread.templateRoute), [
+      async (req, _res, next) => {
+        const slug = req.params[0];
+        if (slugName) req.params[slugName] = slug;
+        try {
+          if (await validator(slug, req)) {
+            next();
+            return;
+          }
+        } catch (err) {
+          console.error(err);
+        }
+        next("route");
+      }
+    ]);
+  }
+}
 var OnInitEmitter = class extends EventEmitter {
 };
 var onInitEmitter = new OnInitEmitter();
@@ -532,33 +695,12 @@ function getAllBuiltRoutes() {
 }
 async function createRouteFunction(route, configFiles) {
   const isJSX = route.originalRoute.endsWith(".tsx") || route.originalRoute.endsWith(".jsx");
-  const slugRoute = route.route.replace(/[ ]/g, "");
-  const foundMethod = methods.find((method) => slugRoute.toUpperCase().endsWith(`.${method.toUpperCase()}`));
-  const isDynamicRoute = slugRoute.match(regex_default.isDynamicRoute);
-  let formattedRouteItem = slugRoute;
-  if (foundMethod) formattedRouteItem = formattedRouteItem.split(".").shift();
-  if (isDynamicRoute) {
-    const result = [...formattedRouteItem.matchAll(regex_default.dynamicRoutes)];
-    for (const match of result) {
-      formattedRouteItem = formattedRouteItem.replace(match[0], ":" + match[2]);
-    }
-  }
-  const hasCatchAll = formattedRouteItem.match(regex_default.catchAllRoute);
-  if (hasCatchAll) formattedRouteItem = formattedRouteItem.replace(regex_default.catchAllRoute, "/*");
+  const { foundMethod, formattedRouteItem, templateRoute, isSpread } = parseRoutePath(route.route);
   const componentImport = await import(route.path);
   const componentFn = isDev ? null : componentImport?.default;
-  if (componentImport?.config?.onInit) {
-    await componentImport.config?.onInit();
-  }
-  let config2 = {};
+  if (componentImport?.config?.onInit) await componentImport.config.onInit();
   const configFilePaths = getConfigFiles(route.originalRoute, configFiles);
-  config2 = configFilePaths && await getCompleteConfig(configFilePaths, Date.now());
-  if (componentImport?.config) {
-    config2 = {
-      ...config2,
-      ...componentImport.config
-    };
-  }
+  const config2 = await resolveConfig(configFilePaths, componentImport);
   async function routeFn(req, res) {
     const urlPath = req?.route?.path || "/";
     try {
@@ -568,47 +710,37 @@ async function createRouteFunction(route, configFiles) {
         return;
       }
       if (componentFn && !isDev) {
-        if (isJSX) {
-          const data = config2?.data ? await config2.data(req) : null;
-          const originalResult = await componentFn({ req, res, data, routePath: urlPath });
-          const output = config2?.wrapper ? await config2.wrapper({ req, children: originalResult, config: config2, data, routePath: urlPath }) : originalResult;
-          res.send(doctypeHTML + output);
-        } else {
-          await componentFn(req, res);
-        }
+        if (isJSX) res.send(await renderJSX(componentFn, config2, req, res, urlPath));
+        else await componentFn(req, res);
         return;
       }
       await triggerXPineOnLoad(true);
-      const componentImportDev = await import(route.path + `?cache=${Date.now()}`);
-      const componentFnDev = componentImportDev.default;
+      const devImport = await import(route.path + `?cache=${Date.now()}`);
       onInitEmitter.emit("triggerOnInit", getAllBuiltRoutes());
       if (isJSX) {
-        let config3 = configFilePaths && await getCompleteConfig(configFilePaths, Date.now());
-        if (componentImportDev?.config) {
-          config3 = {
-            ...config3,
-            ...componentImportDev.config
-          };
-        }
-        const data = config3?.data ? await config3.data(req) : null;
-        const originalResult = await componentFnDev({ req, res, data, config: config3, routePath: urlPath });
-        const output = config3?.wrapper ? await config3.wrapper({ req, children: originalResult, config: config3, data, routePath: urlPath }) : originalResult;
+        const devConfig = await resolveConfig(configFilePaths, devImport);
+        const html2 = await renderJSX(devImport.default, devConfig, req, res, urlPath);
         context.clear();
-        res.send(doctypeHTML + output);
+        res.send(html2);
       } else {
-        await componentFnDev(req, res);
+        await devImport.default(req, res);
       }
     } catch (err) {
       console.error(err);
-      res.status(err?.status || 500).send(err?.message || "Error");
+      const status = err?.status || 500;
+      const message = isDev || err?.status ? err?.message || "Error" : "Internal Server Error";
+      res.status(status).send(message);
     }
   }
-  return {
-    formattedRouteItem,
-    foundMethod,
-    route,
-    config: config2,
-    routeFn
+  const spread = isSpread ? await resolveSpreadRoute(templateRoute, config2, route.originalRoute) : null;
+  return { formattedRouteItem, foundMethod, route, config: config2, routeFn, spread };
+}
+function buildRouteRegister(router, method, config2, routeFn) {
+  return (routePath, preHandlers = []) => {
+    const handlers = [...preHandlers];
+    if (config2?.routeMiddleware) handlers.push(config2.routeMiddleware);
+    handlers.push(routeFn);
+    router[method](routePath, ...handlers);
   };
 }
 async function createRouter() {
@@ -619,46 +751,50 @@ async function createRouter() {
   await triggerXPineOnLoad();
   for (const route of routeMap) {
     try {
-      const { formattedRouteItem, foundMethod, config: config2, routeFn } = await createRouteFunction(route, configFiles);
-      if (config2?.routeMiddleware) {
-        router[foundMethod || "get"](formattedRouteItem, config2.routeMiddleware, routeFn);
-      } else {
-        router[foundMethod || "get"](formattedRouteItem, routeFn);
-      }
-      routeResults.push({
-        formattedRouteItem,
-        foundMethod,
-        route,
-        routeFn
-      });
+      const { formattedRouteItem, foundMethod, config: routeConfig, routeFn, spread } = await createRouteFunction(route, configFiles);
+      const register = buildRouteRegister(router, foundMethod || "get", routeConfig, routeFn);
+      if (spread) registerSpreadRoutes(register, spread);
+      else register(formattedRouteItem);
+      routeResults.push({ formattedRouteItem, foundMethod, route, routeFn });
     } catch (err) {
       console.error(err);
     }
   }
-  return {
-    router,
-    routeResults
-  };
+  return { router, routeResults };
 }
 async function verifyUserMiddleware(req, _res, next) {
-  const { usertoken } = req.cookies;
+  const usertoken = req.cookies?.usertoken;
   if (!usertoken) {
     req.user = null;
+    next();
+    return;
   }
   try {
     const { user } = await verifyUser(usertoken);
     req.user = user;
-  } catch (err) {
+  } catch {
     req.user = null;
   }
   next();
 }
 async function verifyAuthenticatedBundleMiddleware(req, res, next) {
-  if (!req?.originalUrl?.startsWith("/scripts/")) {
+  let decodedPath;
+  try {
+    decodedPath = decodeURIComponent(req?.path || "");
+  } catch {
+    next();
+    return;
+  }
+  if (!decodedPath.startsWith("/scripts/")) {
+    next();
+    return;
+  }
+  const fileName = decodedPath.split("/").pop() || "";
+  if (!fileName.endsWith(".js")) {
     next();
     return;
   }
-  const bundle = req?.originalUrl?.split("/")?.pop()?.split(".js")?.shift();
+  const bundle = fileName.slice(0, -".js".length);
   const foundBundle = config?.bundles?.find((bundleItem) => bundleItem?.id === bundle);
   if (!foundBundle) {
     next();
@@ -677,6 +813,9 @@ async function createXPineRouter(app, beforeErrorRoute) {
   app.use(verifyAuthenticatedBundleMiddleware);
   app.use(express.static(config.distPublicDir));
   app.use(requestIP.mw());
+  if (config?.csrf) {
+    app.use(createCsrfMiddleware(typeof config.csrf === "object" ? config.csrf : void 0));
+  }
   const { router, routeResults } = await createRouter();
   app.use(function replaceableRouter(req, res, next) {
     router(req, res, next);
@@ -696,11 +835,13 @@ function routeHasStaticPath(route, params) {
   const paramEntries = Object.entries(params);
   let routeToStaticPath = route;
   for (const [key, value] of paramEntries) {
-    routeToStaticPath = routeToStaticPath.replace(`:${key}`, value);
-    if (key === "0") routeToStaticPath = routeToStaticPath.replace(/\/\*/g, `/${value}`);
+    routeToStaticPath = routeToStaticPath.replace(`:${key}`, () => value);
+    if (key === "0") routeToStaticPath = routeToStaticPath.replace(/\/\*/g, () => `/${value}`);
   }
   routeToStaticPath += "/index.html";
-  const outputPath = path5.join(config.distPagesDir, routeToStaticPath);
+  const pagesDir = path5.resolve(config.distPagesDir);
+  const outputPath = path5.resolve(pagesDir, "." + path5.posix.normalize("/" + routeToStaticPath));
+  if (outputPath !== pagesDir && !outputPath.startsWith(pagesDir + path5.sep)) return false;
   if (fs5.existsSync(outputPath)) return outputPath;
   return false;
 }
@@ -1118,7 +1259,7 @@ async function buildStaticFiles(config2, component, componentImport, builtCompon
 function determineOutputPathForStaticPath(builtComponentPath, componentDynamicPaths) {
   if (componentDynamicPaths?.length) {
     return componentDynamicPaths.reduce((total, current) => {
-      return total.replace(`/[${current}]`, "");
+      return total.replace(`/[...${current}]`, "").replace(`/[${current}]`, "");
     }, path6.dirname(builtComponentPath));
   } else {
     if (builtComponentPath?.match(regex_default.endsWithIndex)) {
@@ -1134,7 +1275,8 @@ function getComponentDynamicPaths(componentPath) {
   if (!matches?.length) return null;
   const output = [];
   for (const match of matches) {
-    output.push(match[2]);
+    if (!match[2]) continue;
+    output.push(match[2].replace(/^\.\.\./, ""));
   }
   return output;
 }
@@ -1316,9 +1458,9 @@ async function runDevServer() {
   });
 }
 function asyncServerClose(server) {
-  return new Promise((resolve, reject) => {
-    server.close();
-    resolve(true);
+  return new Promise((resolve) => {
+    server.close(() => resolve(true));
+    server.closeAllConnections?.();
   });
 }
 function createRebuildEmitter(delay = 500) {
@@ -1326,39 +1468,51 @@ function createRebuildEmitter(delay = 500) {
   }
   ;
   const rebuildEmitter = new RebuildEmitter();
-  let start = 0;
-  let hasEmitted = false;
+  let timeout = null;
   rebuildEmitter.on("rebuild-server", () => {
-    hasEmitted = false;
-    trigger();
+    if (timeout) clearTimeout(timeout);
+    timeout = setTimeout(() => {
+      timeout = null;
+      rebuildEmitter.emit("done");
+    }, delay);
   });
-  function trigger() {
-    start = Date.now();
-    const interval = setInterval(() => {
-      if (hasEmitted) return;
-      const now = Date.now();
-      if (now - start >= delay) {
-        rebuildEmitter.emit("done");
-        clearInterval(interval);
-        hasEmitted = true;
-      }
-    }, 100);
-  }
   return rebuildEmitter;
 }
 
 // src/util/html.ts
+var RawHtml = class {
+  constructor(value) {
+    this.value = value;
+  }
+  toString() {
+    return this.value;
+  }
+};
+var RAW_TEXT_ELEMENTS = /* @__PURE__ */ new Set(["script", "style"]);
+function escapeHtml(value) {
+  return String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function raw(value) {
+  return new RawHtml(value);
+}
+function renderChild(child, rawText) {
+  if (Array.isArray(child)) return child.map((item) => renderChild(item, rawText)).join("");
+  if (child instanceof RawHtml) return child.value;
+  if (!child) return "";
+  return rawText ? String(child) : escapeHtml(child);
+}
 var html = class {
+  static raw = raw;
   static attributeObjectToString(props) {
     if (!props) return "";
     return Object.entries(props).filter(([, value]) => value !== null && value !== void 0).map(([key, value], index) => {
       const start = index === 0 ? " " : "";
-      return `${start}${key}="${value}"`;
+      return `${start}${key}="${escapeHtml(value)}"`;
     }).join(" ");
   }
   static async fragment(props) {
     const childrenResult = await Promise.all(props.children.flat());
-    return childrenResult.filter(Boolean).join("");
+    return new RawHtml(childrenResult.map((child) => renderChild(child, false)).join(""));
   }
   static async createElement(type, props, ...children) {
     const childrenResult = await Promise.all(children.flat());
@@ -1366,7 +1520,9 @@ var html = class {
       const result = await type({ ...props, children: childrenResult });
       return result;
     }
-    return `<${type}${this.attributeObjectToString(props)}>${childrenResult.filter(Boolean).join("")}</${type}>`;
+    const rawText = RAW_TEXT_ELEMENTS.has(type);
+    const inner = childrenResult.map((child) => renderChild(child, rawText)).join("");
+    return new RawHtml(`<${type}${this.attributeObjectToString(props)}>${inner}</${type}>`);
   }
 };
 function JSXRuntime() {
@@ -1379,6 +1535,7 @@ function getCurrentBreakpoint() {
 }
 export {
   JSXRuntime,
+  RawHtml,
   addToContextArray,
   buildApp,
   buildFilesWithConfigs,
@@ -1389,9 +1546,11 @@ export {
   config,
   context,
   createContext,
+  createCsrfMiddleware,
   createRouter,
   createXPineRouter,
   determineOutputPathForStaticPath,
+  escapeHtml,
   filePathToURLPath,
   fromRoot,
   getComponentDynamicPaths,
@@ -1399,9 +1558,13 @@ export {
   getTokenFromRequest,
   html,
   logSize,
+  raw,
   routeHasStaticPath,
   runDevServer,
   setupEnv,
   signUser,
+  spreadConcretePath,
+  spreadSlugName,
+  spreadWildcardPath,
   verifyUser
 };

package/dist/src/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,wBAAsB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,oBAiB7D;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAQ5D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,UAMrD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAgBzC,wBAAsB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,oBAgB7D;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAO5D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,UAKrD"}

package/dist/src/csrf.d.ts

@@ -0,0 +1,16 @@
+import { NextFunction, Request, Response } from 'express';
+export type CsrfOptions = {
+    cookieName?: string;
+    headerName?: string;
+    fieldName?: string;
+    secret?: string;
+    cookie?: {
+        sameSite?: boolean | 'lax' | 'strict' | 'none';
+        secure?: boolean;
+        path?: string;
+        maxAge?: number;
+    };
+    ignorePaths?: string[];
+};
+export declare function createCsrfMiddleware(options?: CsrfOptions): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/src/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/csrf.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAK1D,MAAM,MAAM,WAAW,GAAG;IAExB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QAC/C,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IAEF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAoDF,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,WAAW,SAepB,OAAO,OAAO,QAAQ,QAAQ,YAAY,UAqB/E"}

package/dist/src/express.d.ts

@@ -1,4 +1,9 @@
 import { Express } from 'express';
+export declare function spreadConcretePath(templateRoute: string, entry: {
+    [key: string]: string;
+}): string;
+export declare function spreadWildcardPath(templateRoute: string): string;
+export declare function spreadSlugName(templateRoute: string): string | null;
 export declare function createRouter(): Promise<{
     router: import("express-serve-static-core").Router;
     routeResults: any[];

package/dist/src/express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/express.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAgB,OAAO,EAAqB,MAAM,SAAS,CAAC;AAqJ5E,wBAAsB,YAAY;;;GAkCjC;AAsCD,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,iBA0B1F;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,KAAK,CAanG;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAE,OAAc,UAQzE"}
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/express.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAgB,OAAO,EAA6C,MAAM,SAAS,CAAC;AA8FpG,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,CAKlG;AAGD,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAIhE;AAGD,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGnE;AAqLD,wBAAsB,YAAY;;;GAuBjC;AAuDD,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,iBAgC1F;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,KAAK,CAoBnG;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAE,OAAc,UAQzE"}

package/dist/src/scripts/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/scripts/build.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,UAAU,EAA2B,aAAa,EAAE,MAAM,aAAa,CAAC;AAajF,KAAK,YAAY,GAAG;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAA;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,iBAgDhD;AA4JD,wBAAsB,yBAAyB,kBAiC9C;AAED,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,WAAkB,iBAa9F;AAED,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,aAAa,EAAE,iBAezE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,iBA2FpI;AAED,wBAAgB,gCAAgC,CAAC,kBAAkB,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,EAAE,UAe5G;AAED,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAQxE;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ,CAAA;AAGD,wBAAsB,eAAe,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,KAAK,CAAC,EAAE,OAAO,iBAoDpF;AAED,wBAAsB,YAAY,kBA4CjC"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/scripts/build.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,UAAU,EAA2B,aAAa,EAAE,MAAM,aAAa,CAAC;AAajF,KAAK,YAAY,GAAG;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAA;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,iBAgDhD;AA4JD,wBAAsB,yBAAyB,kBAiC9C;AAED,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,WAAkB,iBAa9F;AAED,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,aAAa,EAAE,iBAezE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,iBA2FpI;AAED,wBAAgB,gCAAgC,CAAC,kBAAkB,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,EAAE,UAgB5G;AAED,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAUxE;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ,CAAA;AAGD,wBAAsB,eAAe,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,KAAK,CAAC,EAAE,OAAO,iBAoDpF;AAED,wBAAsB,YAAY,kBA4CjC"}

package/dist/src/scripts/xpine-build.js

@@ -321,6 +321,9 @@ var regex_default = {
   configFile: /\+config\.[tj]sx?/g,
   dynamicRoutes: /(\[)(.*?)(\])/g,
   isDynamicRoute: /\[(.*)\]/g,
+  // Multi-segment (slash-containing) dynamic route, e.g. [...slug]
+  spreadRoute: /\[\.\.\.(.*?)\]/g,
+  isSpreadRoute: /\[\.\.\..*?\]/,
   endsWithTSX: /\.tsx$/,
   endsWithJSX: /\.jsx$/,
   endsWithJs: /\.js$/,
@@ -891,7 +894,7 @@ async function buildStaticFiles(config2, component, componentImport, builtCompon
 function determineOutputPathForStaticPath(builtComponentPath, componentDynamicPaths) {
   if (componentDynamicPaths?.length) {
     return componentDynamicPaths.reduce((total, current) => {
-      return total.replace(`/[${current}]`, "");
+      return total.replace(`/[...${current}]`, "").replace(`/[${current}]`, "");
     }, path5.dirname(builtComponentPath));
   } else {
     if (builtComponentPath?.match(regex_default.endsWithIndex)) {
@@ -907,7 +910,8 @@ function getComponentDynamicPaths(componentPath) {
   if (!matches?.length) return null;
   const output = [];
   for (const match of matches) {
-    output.push(match[2]);
+    if (!match[2]) continue;
+    output.push(match[2].replace(/^\.\.\./, ""));
   }
   return output;
 }

package/dist/src/scripts/xpine-dev.js

@@ -328,6 +328,9 @@ var regex_default = {
   configFile: /\+config\.[tj]sx?/g,
   dynamicRoutes: /(\[)(.*?)(\])/g,
   isDynamicRoute: /\[(.*)\]/g,
+  // Multi-segment (slash-containing) dynamic route, e.g. [...slug]
+  spreadRoute: /\[\.\.\.(.*?)\]/g,
+  isSpreadRoute: /\[\.\.\..*?\]/,
   endsWithTSX: /\.tsx$/,
   endsWithJSX: /\.jsx$/,
   endsWithJs: /\.js$/,
@@ -898,7 +901,7 @@ async function buildStaticFiles(config2, component, componentImport, builtCompon
 function determineOutputPathForStaticPath(builtComponentPath, componentDynamicPaths) {
   if (componentDynamicPaths?.length) {
     return componentDynamicPaths.reduce((total, current) => {
-      return total.replace(`/[${current}]`, "");
+      return total.replace(`/[...${current}]`, "").replace(`/[${current}]`, "");
     }, path5.dirname(builtComponentPath));
   } else {
     if (builtComponentPath?.match(regex_default.endsWithIndex)) {
@@ -914,7 +917,8 @@ function getComponentDynamicPaths(componentPath) {
   if (!matches?.length) return null;
   const output = [];
   for (const match of matches) {
-    output.push(match[2]);
+    if (!match[2]) continue;
+    output.push(match[2].replace(/^\.\.\./, ""));
   }
   return output;
 }
@@ -1096,9 +1100,9 @@ async function runDevServer() {
   });
 }
 function asyncServerClose(server) {
-  return new Promise((resolve, reject) => {
-    server.close();
-    resolve(true);
+  return new Promise((resolve) => {
+    server.close(() => resolve(true));
+    server.closeAllConnections?.();
   });
 }
 function createRebuildEmitter(delay = 500) {
@@ -1106,24 +1110,14 @@ function createRebuildEmitter(delay = 500) {
   }
   ;
   const rebuildEmitter = new RebuildEmitter();
-  let start = 0;
-  let hasEmitted = false;
+  let timeout = null;
   rebuildEmitter.on("rebuild-server", () => {
-    hasEmitted = false;
-    trigger();
+    if (timeout) clearTimeout(timeout);
+    timeout = setTimeout(() => {
+      timeout = null;
+      rebuildEmitter.emit("done");
+    }, delay);
   });
-  function trigger() {
-    start = Date.now();
-    const interval = setInterval(() => {
-      if (hasEmitted) return;
-      const now = Date.now();
-      if (now - start >= delay) {
-        rebuildEmitter.emit("done");
-        clearInterval(interval);
-        hasEmitted = true;
-      }
-    }, 100);
-  }
   return rebuildEmitter;
 }
 

package/dist/src/util/html.d.ts

@@ -1,6 +1,14 @@
+export declare class RawHtml {
+    value: string;
+    constructor(value: string);
+    toString(): string;
+}
+export declare function escapeHtml(value: unknown): string;
+export declare function raw(value: string): RawHtml;
 export declare class html {
+    static raw: typeof raw;
     static attributeObjectToString(props: any): string;
-    static fragment(props: any): Promise<string>;
+    static fragment(props: any): Promise<RawHtml>;
     static createElement(type: any, props: any, ...children: any[]): Promise<any>;
 }
 export declare function JSXRuntime(): boolean;

package/dist/src/util/html.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../../src/util/html.ts"],"names":[],"mappings":"AAAA,qBAAa,IAAI;IAEf,MAAM,CAAC,uBAAuB,CAAC,KAAK,KAAA;WAWvB,QAAQ,CAAC,KAAK,KAAA;WAKd,aAAa,CAAC,IAAI,KAAA,EAAE,KAAK,KAAA,EAAE,GAAG,QAAQ,OAAA;CASpD;AAED,wBAAgB,UAAU,YAEzB"}
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../../../src/util/html.ts"],"names":[],"mappings":"AAGA,qBAAa,OAAO;IACC,KAAK,EAAE,MAAM;gBAAb,KAAK,EAAE,MAAM;IAChC,QAAQ;CACT;AAKD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAOjD;AAID,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1C;AAUD,qBAAa,IAAI;IACf,MAAM,CAAC,GAAG,aAAO;IAEjB,MAAM,CAAC,uBAAuB,CAAC,KAAK,KAAA;WAYvB,QAAQ,CAAC,KAAK,KAAA;WAKd,aAAa,CAAC,IAAI,KAAA,EAAE,KAAK,KAAA,EAAE,GAAG,QAAQ,OAAA;CAWpD;AAED,wBAAgB,UAAU,YAEzB"}

package/dist/src/util/regex.d.ts

@@ -4,6 +4,8 @@ declare const _default: {
     configFile: RegExp;
     dynamicRoutes: RegExp;
     isDynamicRoute: RegExp;
+    spreadRoute: RegExp;
+    isSpreadRoute: RegExp;
     endsWithTSX: RegExp;
     endsWithJSX: RegExp;
     endsWithJs: RegExp;

package/dist/src/util/regex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"regex.d.ts","sourceRoot":"","sources":["../../../src/util/regex.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,wBAiBE"}
+{"version":3,"file":"regex.d.ts","sourceRoot":"","sources":["../../../src/util/regex.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA,wBAoBE"}

package/dist/types.d.ts

@@ -21,10 +21,13 @@ export type WrapperProps = {
 export type ConfigFile = {
     staticPaths?: boolean | (() => Promise<{
         [key: string]: string;
-    }[]>);
+    }[]> | {
+        [key: string]: string;
+    }[]);
     wrapper?: (props: WrapperProps) => Promise<any>;
     data?: (req: ServerRequest) => Promise<any>;
     routeMiddleware?: (req: ServerRequest, res: Response, next: NextFunction) => void;
+    isValid?: (slug: string, req: ServerRequest) => boolean | Promise<boolean>;
 };
 export type PageProps = {
     req: ServerRequest;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,MAAM,WAAW,GAAG;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAA;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IACpC,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,aAAa,CAAC;IACnB,QAAQ,EAAE,GAAG,CAAC;IACd,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC,CAAC;IACrE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;CACnF,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,GAAG,EAAE,QAAQ,CAAC;IACd,IAAI,EAAE,GAAG,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;CACnB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC;CACvB,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,MAAM,WAAW,GAAG;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAA;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IACpC,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,aAAa,CAAC;IACnB,QAAQ,EAAE,GAAG,CAAC;IACd,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAA;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,CAAC,EAAE,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,EAAE,CAAC,GAAG;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,EAAE,CAAC,CAAC;IACnG,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,KAAK,IAAI,CAAC;IAIlF,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC5E,CAAA;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,aAAa,CAAC;IACnB,GAAG,EAAE,QAAQ,CAAC;IACd,IAAI,EAAE,GAAG,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;CACnB,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC;CACvB,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xpine",
-  "version": "0.0.56",
+  "version": "0.0.59",
   "main": "dist/index.js",
   "dependencies": {
     "@aws-sdk/client-secrets-manager": "^3.758.0",

package/types.ts

@@ -24,10 +24,14 @@ export type WrapperProps = {
 }
 
 export type ConfigFile = {
-  staticPaths?: boolean | (() => Promise<{ [key: string]: string }[]>);
+  staticPaths?: boolean | (() => Promise<{ [key: string]: string }[]> | { [key: string]: string }[]);
   wrapper?: (props: WrapperProps) => Promise<any>;
   data?: (req: ServerRequest) => Promise<any>;
   routeMiddleware?: (req: ServerRequest, res: Response, next: NextFunction) => void;
+  // For multi-segment dynamic routes ([...slug]): validate a slug that was not
+  // generated at build time so it can be resolved safely at request time.
+  // Return false (the default for unknown slugs) to fall through to the 404 handler.
+  isValid?: (slug: string, req: ServerRequest) => boolean | Promise<boolean>;
 }
 
 export type PageProps = {