@void/edge 0.26.1 → 0.28.0

package/dist/index.d.mts

@@ -57,17 +57,23 @@ export declare function applyHeaderRules(response: Response, pathname: string, r
 //#endregion
 //#region src/pattern.d.ts
 type CompiledPattern = Readonly<{
+  /**
+   * @deprecated Built on first read for older callers; Void does not use it.
+   * It can backtrack and fails past engine size limits. Use `matchPattern` or
+   * `matchPatternCaptures`.
+   */
   regex: RegExp;
   paramNames: ReadonlyArray<string>;
 }>;
+/**
+ * Parse a capture pattern. Throws a SyntaxError for a malformed one: a repeated
+ * name (`/:id/:id`, `/:splat/*`) or a name that starts with a digit (`/:1`).
+ */
 export declare function compilePattern(source: string): CompiledPattern;
 /**
  * Match a pattern against a pathname. Returns captured params, or null.
- *
- * Returns null (rather than throwing) when the pattern itself is malformed —
- * e.g. multiple `*` producing duplicate `splat` capture names. Framework and
- * API ingest both reject those, but a hand-crafted manifest could still reach
- * the edge, and a single bad rule shouldn't 500 unrelated traffic.
+ * A malformed pattern (e.g. a repeated name like `/:splat/*`) also returns
+ * null, so one bad rule cannot fail unrelated requests.
  */
 export declare function matchPatternCaptures(pattern: string, pathname: string): Record<string, string> | null;
 /**
@@ -87,36 +93,13 @@ export declare function matchPattern(pattern: string, pathname: string): boolean
  */
 export declare function matchLiteralPattern(pattern: string, pathname: string): boolean;
 /**
- * Match a REVALIDATE ROUTE pattern against a pathname using SEGMENT-ANCHORED
- * semantics. Like `matchLiteralPattern` except a WHOLE-SEGMENT `:name` (a `:`
- * right after `/` or at the start of the pattern, whose name is any non-empty
- * run of non-`/` characters — NOT just JS-identifier chars, so `:post-id`,
- * `:post.id`, etc. all anchor — running up to the next `/` or end of string)
- * matches exactly ONE non-empty path segment (`[^/]+`). A whole-segment NAMED
- * CATCH-ALL `:name{.+}` (a named catch-all page `[...path]` → `/docs/:path{.+}`)
- * matches ONE-OR-MORE characters that MAY cross `/` (`.+`, so `/docs/a` and
- * `/docs/a/b` both match, but bare `/docs` / `/docs/` do NOT). Only the exact
- * `{.+}` constraint widens — a REGEX-constrained param like `:path{[0-9]+}`
- * keeps its single-segment `[^/]+` meaning. `*` still expands to a catch-all
- * that crosses `/`. A mid-segment `:` (e.g. `/api/v1:health`,
- * `/api/documents:batchGet`) stays a LITERAL — only whole-segment `:name` /
- * `:name{.+}` anchors.
- *
- * This is for `routing.revalidate` keys ONLY. Those keys are machine-generated
- * from page routes on the deploy write side (`[slug]` → `/blog/:slug`,
- * `[...path]` → `/docs/:path{.+}`), so the `:name` here is a real route param
- * and MUST bind the same way the framework's own client route matcher
- * (`patternToRegex` in `pages/manifest.ts`) binds it.
- *
- * It is intentionally NOT used for user-authored header rules
- * (`applyHeaderRules`) or `revalidateQueryAllowlist` keys
- * (`buildVariantOriginalUrl`), where `:name` must stay a literal — those keep
- * using `matchLiteralPattern`. Sharing the segment behaviour there would make a
- * user rule like `/:batchGet` over-match every single-segment path.
- *
- * NOTE: this matcher has its OWN regex cache — the same pattern string compiles
- * to a DIFFERENT regex than `matchLiteralPattern` produces, so the caches must
- * not be shared or they would cross-contaminate.
+ * Match a `routing.revalidate` key or page pattern against a pathname. Like
+ * `matchLiteralPattern`, except for whole-segment params:
+ *   `:name`      — exactly one non-empty path segment (any non-`/` name)
+ *   `:name{.+}`  — one or more characters that may cross `/`
+ * A mid-segment `:` (`/api/v1:health`) stays literal, and any other `{...}`
+ * constraint keeps the single-segment meaning. Has its own cache because the
+ * same source parses differently here.
  */
 export declare function matchSegmentPattern(pattern: string, pathname: string): boolean;
 /**

package/dist/index.mjs

@@ -1,20 +1,21 @@
 //#region src/pattern.ts
 /**
-* Shared path-pattern compiler used by header rules and routing rules.
+* Path-pattern matchers shared by routing, header, and revalidate rules.
 *
-* Syntax:
+* Each pattern is parsed once into tokens, and matching walks those tokens
+* over the pathname. No RegExp is built from pattern text, so a pattern cannot
+* hit engine size limits or backtrack: a match costs at most
+* (steps) x (path length - pattern minimum + 1).
+*
+* `compilePattern` syntax:
 *   `:name`   — single path segment, captured as `name`
 *   `:name*`  — zero or more path segments, captured as `name`
 *   `*`       — zero or more path segments, captured as `splat` (legacy)
 *
 * When a legacy pattern contains multiple anonymous `*`, the first captures
-* as `splat` and later wildcards are non-capturing. Boolean matching remains
-* backward compatible for existing header/revalidate patterns.
+* as `splat` and later wildcards are non-capturing.
 */
 const MAX_CACHE = 256;
-const compileCache = /* @__PURE__ */ new Map();
-const REGEX_SPECIAL = /[.+?^${}()|[\]\\]/;
-const PARAM_CHAR = /[A-Za-z0-9_]/;
 /** LRU read: re-inserting a hit moves it to the most-recently-used end of Map order. */
 function lruGet(cache, key) {
 	const value = cache.get(key);
@@ -32,84 +33,289 @@ function lruSet(cache, key, value) {
 	}
 	cache.set(key, value);
 }
-function compilePattern(source) {
-	const cached = lruGet(compileCache, source);
-	if (cached) return cached;
+/** `[A-Za-z0-9_]` */
+function isNameChar(code) {
+	return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 95;
+}
+/** Whether a wildcard of this kind may take the code unit. */
+function accepts(kind, code) {
+	if (kind === "seg") return code !== 47;
+	return code !== 10 && code !== 13 && code !== 8232 && code !== 8233;
+}
+function pushText(tokens, text) {
+	if (!text) return;
+	const last = tokens[tokens.length - 1];
+	if (last?.kind === "text") last.text += text;
+	else tokens.push({
+		kind: "text",
+		text
+	});
+}
+/** `compilePattern` syntax, read left to right. */
+function parseCapture(source) {
+	const tokens = [];
 	const paramNames = [];
-	let legacySplatCaptured = false;
-	let pattern = "";
+	let splatTaken = false;
 	let index = 0;
 	while (index < source.length) {
 		const character = source[index];
 		if (character === ":") {
-			let nameEnd = index + 1;
-			while (nameEnd < source.length && PARAM_CHAR.test(source[nameEnd])) nameEnd++;
-			const name = source.slice(index + 1, nameEnd);
-			if (!name) {
-				pattern += "\\:";
+			let end = index + 1;
+			while (end < source.length && isNameChar(source.charCodeAt(end))) end++;
+			if (end === index + 1) {
+				pushText(tokens, ":");
 				index++;
 				continue;
 			}
+			const name = source.slice(index + 1, end);
 			paramNames.push(name);
-			if (source[nameEnd] === "*") {
-				pattern += `(?<${name}>.*)`;
-				index = nameEnd + 1;
-			} else {
-				pattern += `(?<${name}>[^/]+)`;
-				index = nameEnd;
-			}
+			const rest = source[end] === "*";
+			tokens.push({
+				kind: rest ? "any" : "seg",
+				name
+			});
+			index = rest ? end + 1 : end;
 		} else if (character === "*") {
-			if (legacySplatCaptured) pattern += `.*`;
+			if (splatTaken) tokens.push({ kind: "any" });
 			else {
 				paramNames.push("splat");
-				pattern += `(?<splat>.*)`;
-				legacySplatCaptured = true;
+				tokens.push({
+					kind: "any",
+					name: "splat"
+				});
+				splatTaken = true;
 			}
 			index++;
 		} else {
-			if (REGEX_SPECIAL.test(character)) pattern += "\\";
-			pattern += character;
-			index++;
+			let end = index + 1;
+			while (end < source.length && source[end] !== ":" && source[end] !== "*") end++;
+			pushText(tokens, source.slice(index, end));
+			index = end;
 		}
 	}
-	const compiled = {
-		regex: new RegExp(`^${pattern}$`),
+	return {
+		tokens,
 		paramNames
 	};
+}
+/** Text in which only `*` is special. */
+function parseStars(tokens, text) {
+	const parts = text.split("*");
+	pushText(tokens, parts[0]);
+	for (let k = 1; k < parts.length; k++) {
+		tokens.push({ kind: "any" });
+		pushText(tokens, parts[k]);
+	}
+}
+/** `routing.revalidate` / page syntax: params are whole segments. */
+function parseSegments(source) {
+	const tokens = [];
+	const segments = source.split("/");
+	for (let k = 0; k < segments.length; k++) {
+		const segment = segments[k];
+		if (k > 0) pushText(tokens, "/");
+		const name = segment.slice(1, -4);
+		if (segment[0] !== ":" || segment.length < 2) parseStars(tokens, segment);
+		else if (segment.length > 5 && segment.endsWith("{.+}") && !name.includes("{") && !name.includes("}")) tokens.push({ kind: "plus" });
+		else tokens.push({ kind: "seg" });
+	}
+	return tokens;
+}
+/**
+* Drop an `any` that directly follows another `any`: the first takes every
+* unit the pair could take, so the second always matches ''. Every other step
+* needs at least one unit, so a path of length m faces at most 2m + 1 steps.
+*/
+function prepare(tokens) {
+	const steps = [];
+	for (const token of tokens) if (!(token.kind === "any" && steps[steps.length - 1]?.kind === "any")) steps.push(token);
+	const starts = new Int32Array(steps.length + 1);
+	steps.forEach((step, i) => {
+		const shortest = step.kind === "text" ? step.text.length : step.kind === "any" ? 0 : 1;
+		starts[i + 1] = starts[i] + shortest;
+	});
+	return {
+		steps,
+		starts,
+		minLength: starts[steps.length]
+	};
+}
+function stepBack(step, path, start, next, row) {
+	let found = 0;
+	if (step.kind === "text") {
+		for (let d = row.length - 1; d >= 0; d--) {
+			const value = next[d] === 1 && path.startsWith(step.text, start + d) ? 1 : 0;
+			row[d] = value;
+			found |= value;
+		}
+		return found === 1;
+	}
+	const kind = step.kind;
+	let after = 0;
+	for (let d = row.length - 1; d >= 0; d--) {
+		const value = kind === "any" ? next[d] === 1 || after === 1 && accepts(kind, path.charCodeAt(start + d)) : (next[d] === 1 || after === 1) && accepts(kind, path.charCodeAt(start + d));
+		row[d] = value ? 1 : 0;
+		after = row[d];
+		found |= after;
+	}
+	return found === 1;
+}
+/** The row after the last step: only the end of the path (d = slack) finishes. */
+function endRow(width) {
+	const row = new Uint8Array(width);
+	row[width - 1] = 1;
+	return row;
+}
+/** Checks that reject most paths before any row is built. */
+function quickReject({ steps, minLength }, path) {
+	const first = steps[0];
+	const last = steps[steps.length - 1];
+	return path.length < minLength || first?.kind === "text" && !path.startsWith(first.text) || last?.kind === "text" && !path.endsWith(last.text);
+}
+/** Whether the steps match the whole path. Keeps two rows. */
+function matches(prepared, path) {
+	if (quickReject(prepared, path)) return false;
+	const { steps, starts, minLength } = prepared;
+	let next = endRow(path.length - minLength + 1);
+	let row = new Uint8Array(next.length);
+	const first = steps[0]?.kind === "text" ? 1 : 0;
+	for (let i = steps.length - 1; i >= first; i--) {
+		if (!stepBack(steps[i], path, starts[i], next, row)) return false;
+		const done = next;
+		next = row;
+		row = done;
+	}
+	return next[0] === 1;
+}
+/**
+* Where a step that begins at p (row index d) ends: the longest choice after
+* which the rest still matches. `next` is the row of the following step.
+*/
+function greedyEnd(step, path, p, d, next) {
+	if (step.kind === "text") return p + step.text.length;
+	const shortest = step.kind === "any" ? 0 : 1;
+	const longest = next.length - 1 - d + shortest;
+	let k = 0;
+	while (k < longest && accepts(step.kind, path.charCodeAt(p + k))) k++;
+	while (k > shortest && next[d + k - shortest] !== 1) k--;
+	return p + k;
+}
+/**
+* End positions of steps 0..upTo in the match that JS backtracking returns
+* (each wildcard, left to right, takes the longest run that still lets the
+* rest match), or null. The backward pass keeps a copy of every `size`-th
+* row; the forward pass rebuilds one block of rows at a time into a fixed
+* pool. About 2 * sqrt(n) rows are alive at once, and each row is computed at
+* most twice.
+*/
+function greedyEnds(prepared, path, upTo) {
+	if (quickReject(prepared, path)) return null;
+	const { steps, starts, minLength } = prepared;
+	const n = steps.length;
+	const width = path.length - minLength + 1;
+	const size = n * width <= 65536 ? 1 : Math.ceil(Math.sqrt(n));
+	const saved = /* @__PURE__ */ new Map([[n, endRow(width)]]);
+	let next = endRow(width);
+	let row = new Uint8Array(width);
+	const first = steps[0]?.kind === "text" ? 1 : 0;
+	for (let i = n - 1; i >= first; i--) {
+		if (!stepBack(steps[i], path, starts[i], next, row)) return null;
+		if (i % size === 0) saved.set(i, row.slice());
+		const done = next;
+		next = row;
+		row = done;
+	}
+	if (next[0] !== 1) return null;
+	const pool = Array.from({ length: size }, () => new Uint8Array(width));
+	let top = 0;
+	const rowAt = (r) => r === top ? saved.get(r) : pool[r % size];
+	const ends = new Int32Array(upTo + 1);
+	let p = 0;
+	for (let i = 0; i <= upTo; i++) {
+		if (i + 1 > top) {
+			top = Math.min(n, Math.ceil((i + 1) / size) * size);
+			for (let r = top - 1; r > i; r--) stepBack(steps[r], path, starts[r], rowAt(r + 1), pool[r % size]);
+		}
+		p = greedyEnd(steps[i], path, p, p - starts[i], rowAt(i + 1));
+		ends[i] = p;
+	}
+	return ends;
+}
+/** The regex the earlier string-building compiler produced, for the deprecated `regex` view. */
+function toRegExp(tokens) {
+	let body = "";
+	for (const token of tokens) if (token.kind === "text") body += token.text.replace(/[.+?^${}()|[\]\\:]/g, "\\$&");
+	else if (token.kind === "seg") body += `(?<${token.name}>[^/]+)`;
+	else body += token.name ? `(?<${token.name}>.*)` : ".*";
+	return new RegExp(`^${body}$`);
+}
+const compileCache = /* @__PURE__ */ new Map();
+function compile(source) {
+	const cached = lruGet(compileCache, source);
+	if (cached) return cached;
+	const { tokens, paramNames } = parseCapture(source);
+	let error;
+	const seen = /* @__PURE__ */ new Set();
+	for (const name of paramNames) {
+		if (seen.has(name)) error ??= `Duplicate capture group name "${name}"`;
+		else if (name.charCodeAt(0) >= 48 && name.charCodeAt(0) <= 57) error ??= `Invalid capture group name "${name}"`;
+		seen.add(name);
+	}
+	const prepared = prepare(tokens);
+	let lastNamed = -1;
+	prepared.steps.forEach((step, i) => {
+		if (step.kind !== "text" && step.name) lastNamed = i;
+	});
+	let regex;
+	const compiled = {
+		...prepared,
+		paramNames,
+		error,
+		lastNamed,
+		get regex() {
+			return regex ??= toRegExp(parseCapture(source).tokens);
+		}
+	};
 	lruSet(compileCache, source, compiled);
 	return compiled;
 }
 /**
+* Parse a capture pattern. Throws a SyntaxError for a malformed one: a repeated
+* name (`/:id/:id`, `/:splat/*`) or a name that starts with a digit (`/:1`).
+*/
+function compilePattern(source) {
+	const compiled = compile(source);
+	if (compiled.error) throw new SyntaxError(compiled.error);
+	return compiled;
+}
+/**
 * Match a pattern against a pathname. Returns captured params, or null.
-*
-* Returns null (rather than throwing) when the pattern itself is malformed —
-* e.g. multiple `*` producing duplicate `splat` capture names. Framework and
-* API ingest both reject those, but a hand-crafted manifest could still reach
-* the edge, and a single bad rule shouldn't 500 unrelated traffic.
+* A malformed pattern (e.g. a repeated name like `/:splat/*`) also returns
+* null, so one bad rule cannot fail unrelated requests.
 */
 function matchPatternCaptures(pattern, pathname) {
-	let compiled;
-	try {
-		compiled = compilePattern(pattern);
-	} catch {
-		return null;
+	const compiled = compile(pattern);
+	if (compiled.error) return null;
+	const { steps, lastNamed } = compiled;
+	const ends = lastNamed === -1 ? void 0 : greedyEnds(compiled, pathname, lastNamed);
+	if (ends === null || ends === void 0 && !matches(compiled, pathname)) return null;
+	const params = Object.create(null);
+	for (const name of compiled.paramNames) params[name] = "";
+	for (let i = 0; ends && i <= lastNamed; i++) {
+		const step = steps[i];
+		if (step.kind !== "text" && step.name) params[step.name] = pathname.slice(i === 0 ? 0 : ends[i - 1], ends[i]);
 	}
-	const match = compiled.regex.exec(pathname);
-	if (!match) return null;
-	return match.groups ?? {};
+	return params;
 }
 /**
 * Match a pattern against a pathname (boolean form). Malformed patterns yield
 * `false` rather than throwing (see `matchPatternCaptures`).
 */
 function matchPattern(pattern, pathname) {
-	try {
-		return compilePattern(pattern).regex.test(pathname);
-	} catch {
-		return false;
-	}
+	const compiled = compile(pattern);
+	return compiled.error === void 0 && matches(compiled, pathname);
 }
-const literalRegexCache = /* @__PURE__ */ new Map();
+const literalCache = /* @__PURE__ */ new Map();
 /**
 * Match a pattern against a pathname using LITERAL semantics — no named
 * captures. Only `*` is special (matches any characters including `/`); every
@@ -121,71 +327,32 @@ const literalRegexCache = /* @__PURE__ */ new Map();
 * (`redirects`/`rewrites`/`fallbacks`) use the capture-aware `compilePattern`.
 */
 function matchLiteralPattern(pattern, pathname) {
-	let regex = lruGet(literalRegexCache, pattern);
-	if (!regex) {
-		try {
-			const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
-			regex = new RegExp(`^${escaped}$`);
-		} catch {
-			return false;
-		}
-		lruSet(literalRegexCache, pattern, regex);
-	}
-	try {
-		return regex.test(pathname);
-	} catch {
-		return false;
+	let prepared = lruGet(literalCache, pattern);
+	if (!prepared) {
+		const tokens = [];
+		parseStars(tokens, pattern);
+		prepared = prepare(tokens);
+		lruSet(literalCache, pattern, prepared);
 	}
+	return matches(prepared, pathname);
 }
-const segmentRegexCache = /* @__PURE__ */ new Map();
+const segmentCache = /* @__PURE__ */ new Map();
 /**
-* Match a REVALIDATE ROUTE pattern against a pathname using SEGMENT-ANCHORED
-* semantics. Like `matchLiteralPattern` except a WHOLE-SEGMENT `:name` (a `:`
-* right after `/` or at the start of the pattern, whose name is any non-empty
-* run of non-`/` characters — NOT just JS-identifier chars, so `:post-id`,
-* `:post.id`, etc. all anchor — running up to the next `/` or end of string)
-* matches exactly ONE non-empty path segment (`[^/]+`). A whole-segment NAMED
-* CATCH-ALL `:name{.+}` (a named catch-all page `[...path]` → `/docs/:path{.+}`)
-* matches ONE-OR-MORE characters that MAY cross `/` (`.+`, so `/docs/a` and
-* `/docs/a/b` both match, but bare `/docs` / `/docs/` do NOT). Only the exact
-* `{.+}` constraint widens — a REGEX-constrained param like `:path{[0-9]+}`
-* keeps its single-segment `[^/]+` meaning. `*` still expands to a catch-all
-* that crosses `/`. A mid-segment `:` (e.g. `/api/v1:health`,
-* `/api/documents:batchGet`) stays a LITERAL — only whole-segment `:name` /
-* `:name{.+}` anchors.
-*
-* This is for `routing.revalidate` keys ONLY. Those keys are machine-generated
-* from page routes on the deploy write side (`[slug]` → `/blog/:slug`,
-* `[...path]` → `/docs/:path{.+}`), so the `:name` here is a real route param
-* and MUST bind the same way the framework's own client route matcher
-* (`patternToRegex` in `pages/manifest.ts`) binds it.
-*
-* It is intentionally NOT used for user-authored header rules
-* (`applyHeaderRules`) or `revalidateQueryAllowlist` keys
-* (`buildVariantOriginalUrl`), where `:name` must stay a literal — those keep
-* using `matchLiteralPattern`. Sharing the segment behaviour there would make a
-* user rule like `/:batchGet` over-match every single-segment path.
-*
-* NOTE: this matcher has its OWN regex cache — the same pattern string compiles
-* to a DIFFERENT regex than `matchLiteralPattern` produces, so the caches must
-* not be shared or they would cross-contaminate.
+* Match a `routing.revalidate` key or page pattern against a pathname. Like
+* `matchLiteralPattern`, except for whole-segment params:
+*   `:name`      — exactly one non-empty path segment (any non-`/` name)
+*   `:name{.+}`  — one or more characters that may cross `/`
+* A mid-segment `:` (`/api/v1:health`) stays literal, and any other `{...}`
+* constraint keeps the single-segment meaning. Has its own cache because the
+* same source parses differently here.
 */
 function matchSegmentPattern(pattern, pathname) {
-	let regex = lruGet(segmentRegexCache, pattern);
-	if (!regex) {
-		try {
-			const escaped = pattern.replace(/(^|\/):[^/{}]+\{\.\+\}(?=\/|$)/g, "$1").replace(/(^|\/):[^/]+(?=\/|$)/g, "$1").replace(/[.+?^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*").replaceAll("", "[^/]+").replaceAll("", ".+");
-			regex = new RegExp(`^${escaped}$`);
-		} catch {
-			return false;
-		}
-		lruSet(segmentRegexCache, pattern, regex);
-	}
-	try {
-		return regex.test(pathname);
-	} catch {
-		return false;
+	let prepared = lruGet(segmentCache, pattern);
+	if (!prepared) {
+		prepared = prepare(parseSegments(pattern));
+		lruSet(segmentCache, pattern, prepared);
 	}
+	return matches(prepared, pathname);
 }
 /**
 * Substitute `:name` and `:name*` tokens in a destination string with the
@@ -202,20 +369,10 @@ function substituteParams(destination, params) {
 //#endregion
 //#region src/headers.ts
 /**
-* Headers that user header rules may not set at all, because they are always a
-* cookie operation. On the shared *.void.app domain (not on the PSL) void.app
-* is the registrable domain, so a `Set-Cookie` with `Domain=.void.app` is
-* readable by every tenant's subdomain. Dropped wholesale.
-*
-* `Clear-Site-Data` is the other cookie trust-boundary header, but it is NOT a
-* blanket block — see {@link sanitizeClearSiteData}: only its cookie-clearing
-* directives are stripped, since its other directives are origin-scoped.
-*
-* HSTS and other per-host headers are safe — they don't cross subdomain
-* boundaries (includeSubDomains scopes to the responding host's subtree).
-*
-* TODO: Once void.app is registered on the Public Suffix List, these defenses
-* can be removed — browsers will scope cross-subdomain cookies automatically.
+* Headers that rules may never set on a shared domain. void.app is not on the
+* Public Suffix List, so a `Set-Cookie` with `Domain=.void.app` reaches every
+* tenant. `Clear-Site-Data` is filtered per directive by
+* {@link sanitizeClearSiteData}; per-host headers such as HSTS stay allowed.
 */
 const BLOCKED_HEADERS = /* @__PURE__ */ new Set(["set-cookie"]);
 /**
@@ -344,16 +501,15 @@ function applyRoutingRules(pathname, rules, requestHost) {
 	if (!rules?.length) return null;
 	for (const rule of rules) {
 		if (rule.host && rule.host !== requestHost) continue;
-		let regex;
 		try {
-			({regex} = compilePattern(rule.source));
+			compilePattern(rule.source);
 		} catch (err) {
 			console.warn(`[dispatch] skipping routing rule with invalid source ${JSON.stringify(rule.source)}: ${err instanceof Error ? err.message : String(err)}`);
 			continue;
 		}
-		const match = regex.exec(pathname);
-		if (!match) continue;
-		const destination = substituteParams(rule.destination, match.groups ?? {});
+		const params = matchPatternCaptures(rule.source, pathname);
+		if (!params) continue;
+		const destination = substituteParams(rule.destination, params);
 		if (rule.status === 200) return {
 			type: "rewrite",
 			destination
@@ -439,10 +595,9 @@ function rewriteUrl(url, destination) {
 	return rewritten;
 }
 function rewriteRequest(request, url, originalUrl) {
-	const headers = new Headers(request.headers);
-	headers.set("X-Void-Original-URL", originalUrl);
 	const rewritten = new Request(url.toString(), request);
-	return new Request(rewritten, { headers });
+	rewritten.headers.set("X-Void-Original-URL", originalUrl);
+	return rewritten;
 }
 //#endregion
 //#region src/static.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/edge",
-  "version": "0.26.1",
+  "version": "0.28.0",
   "description": "Routing, headers, and static asset helpers for Void runtimes.",
   "homepage": "https://void.cloud",
   "bugs": {
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "0.26.1"
+    "@void/deploy-core": "0.28.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20261009.1",