xpine 0.0.58 → 0.0.60

package/dist/index.js

@@ -326,6 +326,9 @@ var regex_default = {
   configFile: /\+config\.[tj]sx?/g,
   dynamicRoutes: /(\[)(.*?)(\])/g,
   isDynamicRoute: /\[(.*)\]/g,
+  // Multi-segment (slash-containing) dynamic route, e.g. [...slug]
+  spreadRoute: /\[\.\.\.(.*?)\]/g,
+  isSpreadRoute: /\[\.\.\..*?\]/,
   endsWithTSX: /\.tsx$/,
   endsWithJSX: /\.jsx$/,
   endsWithJs: /\.js$/,
@@ -467,6 +470,12 @@ import { globSync } from "glob";
 // src/auth.ts
 import jsonwebtoken from "jsonwebtoken";
 var { verify, sign } = jsonwebtoken;
+var JWT_ALGORITHM = "HS256";
+function getSecret() {
+  const secret = process.env.JWT_PRIVATE_KEY;
+  if (!secret) throw new Error("JWT_PRIVATE_KEY is not set");
+  return secret;
+}
 async function signUser(email, username) {
   return new Promise((resolve, reject) => {
     sign(
@@ -476,11 +485,10 @@ async function signUser(email, username) {
           username
         }
       },
-      // @ts-ignore
-      process.env.JWT_PRIVATE_KEY,
-      { expiresIn: "30d" },
+      getSecret(),
+      { expiresIn: "30d", algorithm: JWT_ALGORITHM },
       (err, token) => {
-        if (err) reject(err);
+        if (err) return reject(err);
         resolve(token);
       }
     );
@@ -488,8 +496,8 @@ async function signUser(email, username) {
 }
 async function verifyUser(token) {
   return new Promise((resolve, reject) => {
-    verify(token, process.env.JWT_PRIVATE_KEY, (err, authorizedData) => {
-      if (err) reject(err);
+    verify(token, getSecret(), { algorithms: [JWT_ALGORITHM] }, (err, authorizedData) => {
+      if (err) return reject(err);
       resolve(authorizedData);
     });
   });
@@ -506,8 +514,163 @@ import requestIP from "request-ip";
 import fs5 from "fs-extra";
 import path5 from "path";
 import EventEmitter from "events";
+
+// src/csrf.ts
+import crypto from "crypto";
+var SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function resolveSecret(options) {
+  const secret = options?.secret || process.env.CSRF_SECRET || process.env.JWT_PRIVATE_KEY;
+  if (!secret) throw new Error("CSRF secret is not set (set CSRF_SECRET or JWT_PRIVATE_KEY)");
+  return secret;
+}
+function hmac(value, secret) {
+  return crypto.createHmac("sha256", secret).update(value).digest("base64url");
+}
+function issueToken(secret) {
+  const random = crypto.randomBytes(32).toString("base64url");
+  return `${random}.${hmac(random, secret)}`;
+}
+function isValidToken(token, secret) {
+  if (typeof token !== "string" || !token) return false;
+  const idx = token.lastIndexOf(".");
+  if (idx <= 0 || idx === token.length - 1) return false;
+  const random = token.slice(0, idx);
+  const signature = token.slice(idx + 1);
+  return timingSafeEqual(signature, hmac(random, secret));
+}
+function timingSafeEqual(a, b) {
+  const ab = Buffer.from(String(a));
+  const bb = Buffer.from(String(b));
+  if (ab.length !== bb.length) return false;
+  return crypto.timingSafeEqual(ab, bb);
+}
+function readSubmittedToken(req, headerName, fieldName) {
+  const header = req.headers[headerName];
+  const fromHeader = Array.isArray(header) ? header[0] : header;
+  if (fromHeader) return fromHeader;
+  if (req.body && typeof req.body[fieldName] === "string") return req.body[fieldName];
+  return "";
+}
+function createCsrfMiddleware(options) {
+  const secret = resolveSecret(options);
+  const cookieName = options?.cookieName || "csrfToken";
+  const headerName = (options?.headerName || "x-csrf-token").toLowerCase();
+  const fieldName = options?.fieldName || "_csrf";
+  const ignorePaths = options?.ignorePaths || [];
+  const cookieOptions = {
+    httpOnly: false,
+    // must be readable by client JS for the double-submit
+    sameSite: options?.cookie?.sameSite ?? "lax",
+    secure: options?.cookie?.secure ?? process.env.NODE_ENV !== "development",
+    path: options?.cookie?.path ?? "/",
+    maxAge: options?.cookie?.maxAge
+  };
+  return function csrfMiddleware(req, res, next) {
+    const existing = req.cookies?.[cookieName] || "";
+    let token = existing;
+    if (!isValidToken(existing, secret)) {
+      token = issueToken(secret);
+      res.cookie(cookieName, token, cookieOptions);
+    }
+    res.locals.csrfToken = token;
+    if (SAFE_METHODS.has(req.method)) return next();
+    if (ignorePaths.some((prefix) => req.path.startsWith(prefix))) return next();
+    const submitted = readSubmittedToken(req, headerName, fieldName);
+    if (isValidToken(existing, secret) && timingSafeEqual(submitted, existing)) {
+      return next();
+    }
+    res.status(403).json({ message: "Invalid CSRF token" });
+  };
+}
+
+// src/express.ts
 var methods = ["get", "post", "put", "patch", "delete"];
 var isDev = process.env.NODE_ENV === "development";
+function parseRoutePath(route) {
+  const slugRoute = route.replace(/[ ]/g, "");
+  const foundMethod = methods.find((method) => slugRoute.toUpperCase().endsWith(`.${method.toUpperCase()}`));
+  const templateRoute = foundMethod ? slugRoute.slice(0, -(foundMethod.length + 1)) : slugRoute;
+  let formattedRouteItem = templateRoute.replace(regex_default.spreadRoute, (_match, name) => ":" + name);
+  if (slugRoute.match(regex_default.isDynamicRoute)) {
+    for (const match of formattedRouteItem.matchAll(regex_default.dynamicRoutes)) {
+      formattedRouteItem = formattedRouteItem.replace(match[0], ":" + match[2]);
+    }
+  }
+  if (formattedRouteItem.match(regex_default.catchAllRoute)) {
+    formattedRouteItem = formattedRouteItem.replace(regex_default.catchAllRoute, "/*");
+  }
+  return {
+    foundMethod,
+    formattedRouteItem,
+    templateRoute,
+    isSpread: regex_default.isSpreadRoute.test(templateRoute)
+  };
+}
+function spreadConcretePath(templateRoute, entry) {
+  return templateRoute.replace(regex_default.spreadRoute, (_match, name) => entry[name] ?? "").replace(regex_default.dynamicRoutes, (_match, _open, name) => entry[name] ?? "").replace(/\/{2,}/g, "/");
+}
+function spreadWildcardPath(templateRoute) {
+  return templateRoute.replace(regex_default.spreadRoute, "*").replace(regex_default.dynamicRoutes, (_match, _open, name) => ":" + name);
+}
+function spreadSlugName(templateRoute) {
+  const match = templateRoute.match(/\[\.\.\.(.*?)\]/);
+  return match ? match[1] : null;
+}
+async function resolveConfig(configFilePaths, componentImport) {
+  const baseConfig = configFilePaths ? await getCompleteConfig(configFilePaths, Date.now()) : {};
+  return componentImport?.config ? { ...baseConfig, ...componentImport.config } : baseConfig;
+}
+async function renderJSX(componentFn, config2, req, res, urlPath) {
+  const data = config2?.data ? await config2.data(req) : null;
+  const children = await componentFn({ req, res, data, config: config2, routePath: urlPath });
+  const output = config2?.wrapper ? await config2.wrapper({ req, children, config: config2, data, routePath: urlPath }) : children;
+  return doctypeHTML + output;
+}
+async function resolveSpreadRoute(templateRoute, config2, originalRoute) {
+  let entries = [];
+  if (typeof config2?.staticPaths === "function") {
+    try {
+      entries = await config2.staticPaths() || [];
+    } catch (err) {
+      console.error(err);
+      console.error("Could not resolve staticPaths for spread route", originalRoute);
+    }
+  }
+  return {
+    templateRoute,
+    entries,
+    validator: config2?.isValid || null
+  };
+}
+function registerSpreadRoutes(register, spread) {
+  const slugName = spreadSlugName(spread.templateRoute);
+  for (const entry of spread.entries) {
+    register(spreadConcretePath(spread.templateRoute, entry), [
+      (req, _res, next) => {
+        Object.assign(req.params, entry);
+        next();
+      }
+    ]);
+  }
+  const { validator } = spread;
+  if (validator) {
+    register(spreadWildcardPath(spread.templateRoute), [
+      async (req, _res, next) => {
+        const slug = req.params[0];
+        if (slugName) req.params[slugName] = slug;
+        try {
+          if (await validator(slug, req)) {
+            next();
+            return;
+          }
+        } catch (err) {
+          console.error(err);
+        }
+        next("route");
+      }
+    ]);
+  }
+}
 var OnInitEmitter = class extends EventEmitter {
 };
 var onInitEmitter = new OnInitEmitter();
@@ -532,33 +695,12 @@ function getAllBuiltRoutes() {
 }
 async function createRouteFunction(route, configFiles) {
   const isJSX = route.originalRoute.endsWith(".tsx") || route.originalRoute.endsWith(".jsx");
-  const slugRoute = route.route.replace(/[ ]/g, "");
-  const foundMethod = methods.find((method) => slugRoute.toUpperCase().endsWith(`.${method.toUpperCase()}`));
-  const isDynamicRoute = slugRoute.match(regex_default.isDynamicRoute);
-  let formattedRouteItem = slugRoute;
-  if (foundMethod) formattedRouteItem = formattedRouteItem.split(".").shift();
-  if (isDynamicRoute) {
-    const result = [...formattedRouteItem.matchAll(regex_default.dynamicRoutes)];
-    for (const match of result) {
-      formattedRouteItem = formattedRouteItem.replace(match[0], ":" + match[2]);
-    }
-  }
-  const hasCatchAll = formattedRouteItem.match(regex_default.catchAllRoute);
-  if (hasCatchAll) formattedRouteItem = formattedRouteItem.replace(regex_default.catchAllRoute, "/*");
+  const { foundMethod, formattedRouteItem, templateRoute, isSpread } = parseRoutePath(route.route);
   const componentImport = await import(route.path);
   const componentFn = isDev ? null : componentImport?.default;
-  if (componentImport?.config?.onInit) {
-    await componentImport.config?.onInit();
-  }
-  let config2 = {};
+  if (componentImport?.config?.onInit) await componentImport.config.onInit();
   const configFilePaths = getConfigFiles(route.originalRoute, configFiles);
-  config2 = configFilePaths && await getCompleteConfig(configFilePaths, Date.now());
-  if (componentImport?.config) {
-    config2 = {
-      ...config2,
-      ...componentImport.config
-    };
-  }
+  const config2 = await resolveConfig(configFilePaths, componentImport);
   async function routeFn(req, res) {
     const urlPath = req?.route?.path || "/";
     try {
@@ -568,47 +710,37 @@ async function createRouteFunction(route, configFiles) {
         return;
       }
       if (componentFn && !isDev) {
-        if (isJSX) {
-          const data = config2?.data ? await config2.data(req) : null;
-          const originalResult = await componentFn({ req, res, data, routePath: urlPath });
-          const output = config2?.wrapper ? await config2.wrapper({ req, children: originalResult, config: config2, data, routePath: urlPath }) : originalResult;
-          res.send(doctypeHTML + output);
-        } else {
-          await componentFn(req, res);
-        }
+        if (isJSX) res.send(await renderJSX(componentFn, config2, req, res, urlPath));
+        else await componentFn(req, res);
         return;
       }
       await triggerXPineOnLoad(true);
-      const componentImportDev = await import(route.path + `?cache=${Date.now()}`);
-      const componentFnDev = componentImportDev.default;
+      const devImport = await import(route.path + `?cache=${Date.now()}`);
       onInitEmitter.emit("triggerOnInit", getAllBuiltRoutes());
       if (isJSX) {
-        let config3 = configFilePaths && await getCompleteConfig(configFilePaths, Date.now());
-        if (componentImportDev?.config) {
-          config3 = {
-            ...config3,
-            ...componentImportDev.config
-          };
-        }
-        const data = config3?.data ? await config3.data(req) : null;
-        const originalResult = await componentFnDev({ req, res, data, config: config3, routePath: urlPath });
-        const output = config3?.wrapper ? await config3.wrapper({ req, children: originalResult, config: config3, data, routePath: urlPath }) : originalResult;
+        const devConfig = await resolveConfig(configFilePaths, devImport);
+        const html2 = await renderJSX(devImport.default, devConfig, req, res, urlPath);
         context.clear();
-        res.send(doctypeHTML + output);
+        res.send(html2);
       } else {
-        await componentFnDev(req, res);
+        await devImport.default(req, res);
       }
     } catch (err) {
       console.error(err);
-      res.status(err?.status || 500).send(err?.message || "Error");
+      const status = err?.status || 500;
+      const message = isDev || err?.status ? err?.message || "Error" : "Internal Server Error";
+      res.status(status).send(message);
     }
   }
-  return {
-    formattedRouteItem,
-    foundMethod,
-    route,
-    config: config2,
-    routeFn
+  const spread = isSpread ? await resolveSpreadRoute(templateRoute, config2, route.originalRoute) : null;
+  return { formattedRouteItem, foundMethod, route, config: config2, routeFn, spread };
+}
+function buildRouteRegister(router, method, config2, routeFn) {
+  return (routePath, preHandlers = []) => {
+    const handlers = [...preHandlers];
+    if (config2?.routeMiddleware) handlers.push(config2.routeMiddleware);
+    handlers.push(routeFn);
+    router[method](routePath, ...handlers);
   };
 }
 async function createRouter() {
@@ -619,46 +751,50 @@ async function createRouter() {
   await triggerXPineOnLoad();
   for (const route of routeMap) {
     try {
-      const { formattedRouteItem, foundMethod, config: config2, routeFn } = await createRouteFunction(route, configFiles);
-      if (config2?.routeMiddleware) {
-        router[foundMethod || "get"](formattedRouteItem, config2.routeMiddleware, routeFn);
-      } else {
-        router[foundMethod || "get"](formattedRouteItem, routeFn);
-      }
-      routeResults.push({
-        formattedRouteItem,
-        foundMethod,
-        route,
-        routeFn
-      });
+      const { formattedRouteItem, foundMethod, config: routeConfig, routeFn, spread } = await createRouteFunction(route, configFiles);
+      const register = buildRouteRegister(router, foundMethod || "get", routeConfig, routeFn);
+      if (spread) registerSpreadRoutes(register, spread);
+      else register(formattedRouteItem);
+      routeResults.push({ formattedRouteItem, foundMethod, route, routeFn });
     } catch (err) {
       console.error(err);
     }
   }
-  return {
-    router,
-    routeResults
-  };
+  return { router, routeResults };
 }
 async function verifyUserMiddleware(req, _res, next) {
-  const { usertoken } = req.cookies;
+  const usertoken = req.cookies?.usertoken;
   if (!usertoken) {
     req.user = null;
+    next();
+    return;
   }
   try {
     const { user } = await verifyUser(usertoken);
     req.user = user;
-  } catch (err) {
+  } catch {
     req.user = null;
   }
   next();
 }
 async function verifyAuthenticatedBundleMiddleware(req, res, next) {
-  if (!req?.originalUrl?.startsWith("/scripts/")) {
+  let decodedPath;
+  try {
+    decodedPath = decodeURIComponent(req?.path || "");
+  } catch {
+    next();
+    return;
+  }
+  if (!decodedPath.startsWith("/scripts/")) {
+    next();
+    return;
+  }
+  const fileName = decodedPath.split("/").pop() || "";
+  if (!fileName.endsWith(".js")) {
     next();
     return;
   }
-  const bundle = req?.originalUrl?.split("/")?.pop()?.split(".js")?.shift();
+  const bundle = fileName.slice(0, -".js".length);
   const foundBundle = config?.bundles?.find((bundleItem) => bundleItem?.id === bundle);
   if (!foundBundle) {
     next();
@@ -677,6 +813,9 @@ async function createXPineRouter(app, beforeErrorRoute) {
   app.use(verifyAuthenticatedBundleMiddleware);
   app.use(express.static(config.distPublicDir));
   app.use(requestIP.mw());
+  if (config?.csrf) {
+    app.use(createCsrfMiddleware(typeof config.csrf === "object" ? config.csrf : void 0));
+  }
   const { router, routeResults } = await createRouter();
   app.use(function replaceableRouter(req, res, next) {
     router(req, res, next);
@@ -696,11 +835,13 @@ function routeHasStaticPath(route, params) {
   const paramEntries = Object.entries(params);
   let routeToStaticPath = route;
   for (const [key, value] of paramEntries) {
-    routeToStaticPath = routeToStaticPath.replace(`:${key}`, value);
-    if (key === "0") routeToStaticPath = routeToStaticPath.replace(/\/\*/g, `/${value}`);
+    routeToStaticPath = routeToStaticPath.replace(`:${key}`, () => value);
+    if (key === "0") routeToStaticPath = routeToStaticPath.replace(/\/\*/g, () => `/${value}`);
   }
   routeToStaticPath += "/index.html";
-  const outputPath = path5.join(config.distPagesDir, routeToStaticPath);
+  const pagesDir = path5.resolve(config.distPagesDir);
+  const outputPath = path5.resolve(pagesDir, "." + path5.posix.normalize("/" + routeToStaticPath));
+  if (outputPath !== pagesDir && !outputPath.startsWith(pagesDir + path5.sep)) return false;
   if (fs5.existsSync(outputPath)) return outputPath;
   return false;
 }
@@ -1118,7 +1259,7 @@ async function buildStaticFiles(config2, component, componentImport, builtCompon
 function determineOutputPathForStaticPath(builtComponentPath, componentDynamicPaths) {
   if (componentDynamicPaths?.length) {
     return componentDynamicPaths.reduce((total, current) => {
-      return total.replace(`/[${current}]`, "");
+      return total.replace(`/[...${current}]`, "").replace(`/[${current}]`, "");
     }, path6.dirname(builtComponentPath));
   } else {
     if (builtComponentPath?.match(regex_default.endsWithIndex)) {
@@ -1134,7 +1275,8 @@ function getComponentDynamicPaths(componentPath) {
   if (!matches?.length) return null;
   const output = [];
   for (const match of matches) {
-    output.push(match[2]);
+    if (!match[2]) continue;
+    output.push(match[2].replace(/^\.\.\./, ""));
   }
   return output;
 }
@@ -1316,9 +1458,9 @@ async function runDevServer() {
   });
 }
 function asyncServerClose(server) {
-  return new Promise((resolve, reject) => {
-    server.close();
-    resolve(true);
+  return new Promise((resolve) => {
+    server.close(() => resolve(true));
+    server.closeAllConnections?.();
   });
 }
 function createRebuildEmitter(delay = 500) {
@@ -1326,39 +1468,51 @@ function createRebuildEmitter(delay = 500) {
   }
   ;
   const rebuildEmitter = new RebuildEmitter();
-  let start = 0;
-  let hasEmitted = false;
+  let timeout = null;
   rebuildEmitter.on("rebuild-server", () => {
-    hasEmitted = false;
-    trigger();
+    if (timeout) clearTimeout(timeout);
+    timeout = setTimeout(() => {
+      timeout = null;
+      rebuildEmitter.emit("done");
+    }, delay);
   });
-  function trigger() {
-    start = Date.now();
-    const interval = setInterval(() => {
-      if (hasEmitted) return;
-      const now = Date.now();
-      if (now - start >= delay) {
-        rebuildEmitter.emit("done");
-        clearInterval(interval);
-        hasEmitted = true;
-      }
-    }, 100);
-  }
   return rebuildEmitter;
 }
 
 // src/util/html.ts
+var RawHtml = class {
+  constructor(value) {
+    this.value = value;
+  }
+  toString() {
+    return this.value;
+  }
+};
+var RAW_TEXT_ELEMENTS = /* @__PURE__ */ new Set(["script", "style"]);
+function escapeHtml(value) {
+  return String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function raw(value) {
+  return new RawHtml(value);
+}
+function renderChild(child, rawText) {
+  if (Array.isArray(child)) return child.map((item) => renderChild(item, rawText)).join("");
+  if (child instanceof RawHtml) return child.value;
+  if (!child) return "";
+  return rawText ? String(child) : escapeHtml(child);
+}
 var html = class {
+  static raw = raw;
   static attributeObjectToString(props) {
     if (!props) return "";
     return Object.entries(props).filter(([, value]) => value !== null && value !== void 0).map(([key, value], index) => {
       const start = index === 0 ? " " : "";
-      return `${start}${key}="${value}"`;
+      return `${start}${key}="${escapeHtml(value)}"`;
     }).join(" ");
   }
   static async fragment(props) {
     const childrenResult = await Promise.all(props.children.flat());
-    return childrenResult.filter(Boolean).join("");
+    return new RawHtml(childrenResult.map((child) => renderChild(child, false)).join(""));
   }
   static async createElement(type, props, ...children) {
     const childrenResult = await Promise.all(children.flat());
@@ -1366,7 +1520,9 @@ var html = class {
       const result = await type({ ...props, children: childrenResult });
       return result;
     }
-    return `<${type}${this.attributeObjectToString(props)}>${childrenResult.filter(Boolean).join("")}</${type}>`;
+    const rawText = RAW_TEXT_ELEMENTS.has(type);
+    const inner = childrenResult.map((child) => renderChild(child, rawText)).join("");
+    return new RawHtml(`<${type}${this.attributeObjectToString(props)}>${inner}</${type}>`);
   }
 };
 function JSXRuntime() {
@@ -1379,6 +1535,7 @@ function getCurrentBreakpoint() {
 }
 export {
   JSXRuntime,
+  RawHtml,
   addToContextArray,
   buildApp,
   buildFilesWithConfigs,
@@ -1389,9 +1546,11 @@ export {
   config,
   context,
   createContext,
+  createCsrfMiddleware,
   createRouter,
   createXPineRouter,
   determineOutputPathForStaticPath,
+  escapeHtml,
   filePathToURLPath,
   fromRoot,
   getComponentDynamicPaths,
@@ -1399,9 +1558,13 @@ export {
   getTokenFromRequest,
   html,
   logSize,
+  raw,
   routeHasStaticPath,
   runDevServer,
   setupEnv,
   signUser,
+  spreadConcretePath,
+  spreadSlugName,
+  spreadWildcardPath,
   verifyUser
 };

package/dist/src/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,wBAAsB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,oBAiB7D;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAQ5D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,UAMrD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAgBzC,wBAAsB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,oBAgB7D;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAO5D;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,UAKrD"}

package/dist/src/express.d.ts

@@ -1,4 +1,9 @@
 import { Express } from 'express';
+export declare function spreadConcretePath(templateRoute: string, entry: {
+    [key: string]: string;
+}): string;
+export declare function spreadWildcardPath(templateRoute: string): string;
+export declare function spreadSlugName(templateRoute: string): string | null;
 export declare function createRouter(): Promise<{
     router: import("express-serve-static-core").Router;
     routeResults: any[];

package/dist/src/express.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/express.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAgB,OAAO,EAAqB,MAAM,SAAS,CAAC;AAqJ5E,wBAAsB,YAAY;;;GAkCjC;AAsCD,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,iBA0B1F;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,KAAK,CAanG;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAE,OAAc,UAQzE"}
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../src/express.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAgB,OAAO,EAA6C,MAAM,SAAS,CAAC;AA8FpG,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,CAKlG;AAGD,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAIhE;AAGD,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGnE;AAqLD,wBAAsB,YAAY;;;GAuBjC;AAuDD,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,iBAgC1F;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,KAAK,CAoBnG;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAE,OAAc,UAQzE"}

package/dist/src/scripts/build.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/scripts/build.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,UAAU,EAA2B,aAAa,EAAE,MAAM,aAAa,CAAC;AAajF,KAAK,YAAY,GAAG;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAA;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,iBAgDhD;AA4JD,wBAAsB,yBAAyB,kBAiC9C;AAED,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,WAAkB,iBAa9F;AAED,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,aAAa,EAAE,iBAezE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,iBA2FpI;AAED,wBAAgB,gCAAgC,CAAC,kBAAkB,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,EAAE,UAe5G;AAED,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAQxE;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ,CAAA;AAGD,wBAAsB,eAAe,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,KAAK,CAAC,EAAE,OAAO,iBAoDpF;AAED,wBAAsB,YAAY,kBA4CjC"}
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/scripts/build.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,UAAU,EAA2B,aAAa,EAAE,MAAM,aAAa,CAAC;AAajF,KAAK,YAAY,GAAG;IAClB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAA;AAED,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,iBAgDhD;AA4JD,wBAAsB,yBAAyB,kBAiC9C;AAED,wBAAsB,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,WAAkB,iBAa9F;AAED,wBAAsB,qBAAqB,CAAC,aAAa,EAAE,aAAa,EAAE,iBAezE;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,EAAE,kBAAkB,EAAE,MAAM,iBA2FpI;AAED,wBAAgB,gCAAgC,CAAC,kBAAkB,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE,MAAM,EAAE,UAgB5G;AAED,wBAAgB,wBAAwB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAUxE;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ,CAAA;AAGD,wBAAsB,eAAe,CAAC,aAAa,EAAE,aAAa,EAAE,EAAE,KAAK,CAAC,EAAE,OAAO,iBAoDpF;AAED,wBAAsB,YAAY,kBA4CjC"}

package/dist/src/scripts/xpine-build.js

@@ -321,6 +321,9 @@ var regex_default = {
   configFile: /\+config\.[tj]sx?/g,
   dynamicRoutes: /(\[)(.*?)(\])/g,
   isDynamicRoute: /\[(.*)\]/g,
+  // Multi-segment (slash-containing) dynamic route, e.g. [...slug]
+  spreadRoute: /\[\.\.\.(.*?)\]/g,
+  isSpreadRoute: /\[\.\.\..*?\]/,
   endsWithTSX: /\.tsx$/,
   endsWithJSX: /\.jsx$/,
   endsWithJs: /\.js$/,
@@ -891,7 +894,7 @@ async function buildStaticFiles(config2, component, componentImport, builtCompon
 function determineOutputPathForStaticPath(builtComponentPath, componentDynamicPaths) {
   if (componentDynamicPaths?.length) {
     return componentDynamicPaths.reduce((total, current) => {
-      return total.replace(`/[${current}]`, "");
+      return total.replace(`/[...${current}]`, "").replace(`/[${current}]`, "");
     }, path5.dirname(builtComponentPath));
   } else {
     if (builtComponentPath?.match(regex_default.endsWithIndex)) {
@@ -907,7 +910,8 @@ function getComponentDynamicPaths(componentPath) {
   if (!matches?.length) return null;
   const output = [];
   for (const match of matches) {
-    output.push(match[2]);
+    if (!match[2]) continue;
+    output.push(match[2].replace(/^\.\.\./, ""));
   }
   return output;
 }