nitro 3.0.260415-beta → 3.0.260429-beta

package/dist/_libs/{unimport+unplugin.mjs → unimport+unplugin+oxc-parser.mjs}

@@ -1,47 +1,46 @@
-import { i as __toESM } from "../_common.mjs";
-import { N as require_picomatch, S as MagicString, T as parse$1, b as getMagicString, ct as join$1, dt as resolve$1, st as isAbsolute$2, y as createUnimport } from "../_build/common.mjs";
+import { i as __toESM, n as __exportAll } from "../_common.mjs";
+import { N as require_picomatch, S as MagicString, T as parse$2, b as getMagicString, ct as isAbsolute$2, ft as resolve$1, lt as join$1, y as createUnimport } from "../_build/common.mjs";
 import { t as walk } from "./estree-walker.mjs";
 import { t as remapping } from "./remapping.mjs";
 import { createRequire } from "node:module";
 import fs, { promises } from "node:fs";
 import path, { basename, dirname, extname, isAbsolute, normalize, resolve } from "node:path";
 import process$1 from "node:process";
+import { parseSync } from "rolldown/utils";
 import { Buffer } from "node:buffer";
 import * as querystring from "node:querystring";
-async function detectImportsAcorn(code, ctx, options) {
-	const s = getMagicString(code);
-	const map = await ctx.getImportMap();
-	let matchedImports = [];
-	const enableAutoImport = options?.autoImport !== false;
-	const enableTransformVirtualImports = options?.transformVirtualImports !== false && ctx.options.virtualImports?.length;
-	if (enableAutoImport || enableTransformVirtualImports) {
-		const ast = parse$1(s.original, {
-			sourceType: "module",
-			ecmaVersion: "latest",
-			locations: true
-		});
-		const virtualImports = createVirtualImportsAcronWalker(map, ctx.options.virtualImports);
-		const scopes = traveseScopes(ast, enableTransformVirtualImports ? virtualImports.walk : {});
-		if (enableAutoImport) {
-			const identifiers = scopes.unmatched;
-			matchedImports.push(...Array.from(identifiers).map((name) => {
-				const item = map.get(name);
-				if (item && !item.disabled) return item;
-				return null;
-			}).filter(Boolean));
-			for (const addon of ctx.addons) matchedImports = await addon.matchImports?.call(ctx, identifiers, matchedImports) || matchedImports;
+function createEstreeDetector(parse) {
+	return async (code, ctx, options) => {
+		const s = getMagicString(code);
+		const map = await ctx.getImportMap();
+		let matchedImports = [];
+		const enableAutoImport = options?.autoImport !== false;
+		const enableTransformVirtualImports = options?.transformVirtualImports !== false && ctx.options.virtualImports?.length;
+		if (enableAutoImport || enableTransformVirtualImports) {
+			const ast = parse(s.original);
+			const virtualImports = createVirtualImports(map, ctx.options.virtualImports);
+			const scopes = traveseScopes(ast, enableTransformVirtualImports ? virtualImports.walk : {});
+			if (enableAutoImport) {
+				const identifiers = scopes.unmatched;
+				matchedImports.push(...Array.from(identifiers).map((name) => {
+					const item = map.get(name);
+					if (item && !item.disabled) return item;
+					return null;
+				}).filter(Boolean));
+				for (const addon of ctx.addons) matchedImports = await addon.matchImports?.call(ctx, identifiers, matchedImports) || matchedImports;
+			}
+			virtualImports.ranges.forEach(([start, end]) => {
+				s.remove(start, end);
+			});
+			matchedImports.push(...virtualImports.imports);
 		}
-		virtualImports.ranges.forEach(([start, end]) => {
-			s.remove(start, end);
-		});
-		matchedImports.push(...virtualImports.imports);
-	}
-	return {
-		s,
-		strippedCode: code.toString(),
-		matchedImports,
-		isCJSContext: false,
-		firstOccurrence: 0
+		return {
+			s,
+			strippedCode: code.toString(),
+			matchedImports,
+			isCJSContext: false,
+			firstOccurrence: 0
+		};
 	};
 }
 function traveseScopes(ast, additionalWalk) {
@@ -164,7 +163,7 @@ function traveseScopes(ast, additionalWalk) {
 		scopes
 	};
 }
-function createVirtualImportsAcronWalker(importMap, virtualImports = []) {
+function createVirtualImports(importMap, virtualImports = []) {
 	const imports = [];
 	const ranges = [];
 	return {
@@ -190,6 +189,14 @@ function createVirtualImportsAcronWalker(importMap, virtualImports = []) {
 		} }
 	};
 }
+var detect_acorn_exports = /* @__PURE__ */ __exportAll({ detectImportsAcorn: () => detectImportsAcorn });
+const detectImportsAcorn = createEstreeDetector((code) => parse$2(code, {
+	sourceType: "module",
+	ecmaVersion: "latest",
+	locations: true
+}));
+var detect_oxc_exports = /* @__PURE__ */ __exportAll({ detectImportsOxc: () => detectImportsOxc });
+const detectImportsOxc = createEstreeDetector((code) => parseSync("", code, { sourceType: "module" }).program);
 var import_picomatch = /* @__PURE__ */ __toESM(require_picomatch(), 1);
 function toArray$2(array) {
 	array = array || [];
@@ -1602,6 +1609,11 @@ function createFilter(include, exclude, options) {
 		return !includeMatchers.length;
 	};
 }
+var unplugin_exports = /* @__PURE__ */ __exportAll({
+	default: () => unplugin,
+	defaultExcludes: () => defaultExcludes,
+	defaultIncludes: () => defaultIncludes
+});
 const defaultIncludes = [
 	/\.[jt]sx?$/,
 	/\.vue$/,
@@ -1638,4 +1650,4 @@ const unplugin = createUnplugin((options = {}) => {
 		}
 	};
 });
-export { detectImportsAcorn as a, createVirtualImportsAcronWalker as i, defaultIncludes as n, traveseScopes as o, unplugin as r, defaultExcludes as t };
+export { detect_oxc_exports as n, detect_acorn_exports as r, unplugin_exports as t };

package/dist/_libs/unplugin+unimport.d.mts

@@ -367,7 +367,7 @@ interface InjectImportsOptions {
    *
    * @default 'regex'
    */
-  parser?: 'acorn' | 'regex';
+  parser?: 'acorn' | 'oxc' | 'regex';
   /**
    * Inject the imports at the end of other imports
    *

package/dist/_presets.mjs

@@ -1,4 +1,4 @@
-import { B as f, F as prettyPath$1, G as findNearestFile, H as v, J as readPackageJSON, L as writeFile$2, M as glob, R, W as findFile, Y as i, Z as a, at as dirname$1, ct as join$1, dt as resolve$1, et as r, nt as resolveModulePath, q as readGitConfig, ut as relative$1 } from "./_build/common.mjs";
+import { F as prettyPath$1, G as findFile, J as readGitConfig, K as findNearestFile, L as writeFile$2, M as glob, Q as a, U as v, V as f, X as i, Y as readPackageJSON, dt as relative$1, ft as resolve$1, lt as join$1, ot as dirname$1, rt as resolveModulePath, tt as r, z as R } from "./_build/common.mjs";
 import { r as resolveCompatibilityDatesFromEnv, t as formatCompatibilityDate } from "./_libs/compatx.mjs";
 import { t as Router } from "./_chunks/nitro3.mjs";
 import { t as importDep } from "./_chunks/utils.mjs";
@@ -1365,6 +1365,7 @@ async function generateFunctionFiles(nitro) {
 		launcherType: "Nodejs",
 		shouldAddHelpers: false,
 		supportsResponseStreaming: true,
+		...nitro.options.sourcemap ? { shouldAddSourcemapSupport: true } : {},
 		...nitro.options.vercel?.functions
 	};
 	if (Array.isArray(baseFunctionConfig.experimentalTriggers) && baseFunctionConfig.experimentalTriggers.length > 0) nitro.logger.warn("`experimentalTriggers` on the base `vercel.functions` config applies to the catch-all function and is likely not what you want. Routes with queue triggers are not accessible on the web. Use `vercel.functionRules` to attach triggers to specific routes instead.");

package/dist/cli/_chunks/build.mjs

@@ -1,4 +1,4 @@
-import { dt as resolve } from "../../_build/common.mjs";
+import { ft as resolve } from "../../_build/common.mjs";
 import { t as defineCommand } from "../../_libs/citty.mjs";
 import { t as commonArgs } from "./common.mjs";
 import { build, copyPublicAssets, createNitro, prepare, prerender } from "nitro/builder";

package/dist/cli/_chunks/deploy.mjs

@@ -1,4 +1,4 @@
-import { dt as resolve, m as getBuildInfo, ut as relative } from "../../_build/common.mjs";
+import { dt as relative, ft as resolve, m as getBuildInfo } from "../../_build/common.mjs";
 import { t as defineCommand } from "../../_libs/citty.mjs";
 import build_default, { buildArgs } from "./build.mjs";
 import consola from "consola";

package/dist/cli/_chunks/dev.mjs

@@ -1,4 +1,4 @@
-import { dt as resolve } from "../../_build/common.mjs";
+import { ft as resolve } from "../../_build/common.mjs";
 import { t as NitroDevServer } from "../../_dev.mjs";
 import { t as defineCommand } from "../../_libs/citty.mjs";
 import { t as commonArgs } from "./common.mjs";

package/dist/cli/_chunks/list.mjs

@@ -1,4 +1,4 @@
-import { dt as resolve } from "../../_build/common.mjs";
+import { ft as resolve } from "../../_build/common.mjs";
 import { t as defineCommand } from "../../_libs/citty.mjs";
 import { consola as consola$1 } from "consola";
 import { listTasks, loadOptions } from "nitro/builder";

package/dist/cli/_chunks/prepare.mjs

@@ -1,4 +1,4 @@
-import { dt as resolve } from "../../_build/common.mjs";
+import { ft as resolve } from "../../_build/common.mjs";
 import { t as defineCommand } from "../../_libs/citty.mjs";
 import { t as commonArgs } from "./common.mjs";
 import { createNitro, writeTypes } from "nitro/builder";

package/dist/cli/_chunks/preview.mjs

@@ -1,4 +1,4 @@
-import { dt as resolve } from "../../_build/common.mjs";
+import { ft as resolve } from "../../_build/common.mjs";
 import { t as defineCommand } from "../../_libs/citty.mjs";
 import { t as startPreview } from "../../_chunks/nitro4.mjs";
 import { t as commonArgs } from "./common.mjs";

package/dist/cli/_chunks/run.mjs

@@ -1,4 +1,4 @@
-import { dt as resolve } from "../../_build/common.mjs";
+import { ft as resolve } from "../../_build/common.mjs";
 import { t as defineCommand } from "../../_libs/citty.mjs";
 import { consola as consola$1 } from "consola";
 import destr from "destr";

package/dist/docs/0.docs/5.cache.md

@@ -357,7 +357,59 @@ When `swr` is disabled and a cached value has expired:
 1. The stale entry is cleared.
 2. The client waits for the function/handler to resolve with a fresh value.
 
-## Cache keys and invalidation
+## Cache invalidation
+Cached entries can be invalidated programmatically at runtime (for example from a webhook when the underlying data changes) without waiting for `maxAge` to expire.
+
+### `.invalidate()` method
+
+Every function created with `defineCachedFunction` exposes an `.invalidate()` method. Arguments are passed through `getKey` to generate the cache key.
+
+```ts
+import { defineCachedFunction } from "nitro/cache";
+
+const cachedGHStars = defineCachedFunction(async (repo: string) => {
+  const data = await fetch(`https://api.github.com/repos/${repo}`).then(res => res.json());
+  return data.stargazers_count;
+}, {
+  maxAge: 60 * 60,
+  name: "ghStars",
+  getKey: (repo: string) => repo,
+});
+
+await cachedGHStars("unjs/nitro"); // populates the cache
+await cachedGHStars.invalidate("unjs/nitro"); // removes the entry
+await cachedGHStars("unjs/nitro"); // re-invokes the function
+```
+
+If no cached entry matches the given arguments, `.invalidate()` resolves without error and leaves storage unchanged.
+
+### `invalidateCache()` helper
+
+`invalidateCache` is a helper from `ocache`. It invalidates a cached entry from the cache options used to define it, so invalidation can live anywhere in your app, independent of where the cached function is defined.
+
+Pass the same `name`, `group`, `base`, and `getKey` used when defining the function, along with the `args` identifying the entry to remove:
+
+```ts
+import { invalidateCache } from "ocache";
+
+await invalidateCache({
+  options: {
+    name: "ghStars",
+    group: "nitro/functions",
+    getKey: (repo: string) => repo,
+  },
+  args: ["unjs/nitro"],
+});
+```
+
+<important>
+
+The `name`, `group`, `base`, and `getKey` passed to `invalidateCache` must match the ones used when the cached function was defined. Mismatched options resolve to a different storage key and will not invalidate the intended entry. :br :br
+Nitro defaults to `group: 'nitro/functions'` for cached functions and `group: 'nitro/handlers'` for cached handlers (or `'nitro/route-rules'` when using [route rules](#using-route-rules)).
+</important>
+
+## Cache keys
+
 When using the `defineCachedFunction` or `defineCachedHandler` functions, the cache key is generated using the following pattern:
 
 ```ts
@@ -384,14 +436,6 @@ Will generate the following cache key:
 cache:nitro/functions:getAccessToken:default.json
 ```
 
-You can invalidate the cached function entry with:
-
-```ts
-import { useStorage } from "nitro/storage";
-
-await useStorage('cache').removeItem('nitro/functions:getAccessToken:default.json')
-```
-
 <note>
 
 For cached handlers, the cache key includes a hash of the URL path and, when using the [`varies`](#handler-only-options) option, hashes of the specified header values appended to the key.

package/dist/node_modules/ufo/dist/index.mjs

@@ -286,8 +286,8 @@ function withoutBase(input, base) {
   if (nextChar && nextChar !== "/" && nextChar !== "?") {
     return input;
   }
-  const trimmed = input.slice(_base.length);
-  return trimmed[0] === "/" ? trimmed : "/" + trimmed;
+  const trimmed = input.slice(_base.length).replace(/^\/+/, "");
+  return "/" + trimmed;
 }
 function withQuery(input, query) {
   const parsed = parseURL(input);

package/dist/node_modules/ufo/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ufo",
-  "version": "1.6.3",
+  "version": "1.6.4",
   "description": "URL utils for humans",
   "repository": "unjs/ufo",
   "license": "MIT",
@@ -31,18 +31,18 @@
     "test": "pnpm lint && vitest run --typecheck"
   },
   "devDependencies": {
-    "@types/node": "^25.0.8",
-    "@vitest/coverage-v8": "^4.0.17",
-    "automd": "^0.4.2",
+    "@types/node": "^25.6.0",
+    "@vitest/coverage-v8": "^4.1.5",
+    "automd": "^0.4.3",
     "changelogen": "^0.6.2",
-    "eslint": "^9.39.2",
+    "eslint": "^10.2.1",
     "eslint-config-unjs": "^0.6.2",
     "jiti": "^2.6.1",
-    "prettier": "^3.7.4",
-    "typescript": "^5.9.3",
+    "prettier": "^3.8.3",
+    "typescript": "^6.0.3",
     "unbuild": "^3.6.1",
     "untyped": "^2.0.0",
-    "vitest": "^4.0.17"
+    "vitest": "^4.1.5"
   },
-  "packageManager": "pnpm@10.28.0"
+  "packageManager": "pnpm@10.33.2"
 }

package/dist/presets/azure/runtime/azure-swa.mjs

@@ -16,6 +16,8 @@ export async function handle(context, req) {
 	}
 	const request = new Request(url, {
 		method: req.method || undefined,
+		
+		
 		body: req.bufferBody ?? req.rawBody
 	});
 	const response = await nitroApp.fetch(request);

package/dist/runtime/internal/route-rules.d.mts

@@ -8,4 +8,5 @@ export declare const redirect: RouteRuleCtor<"redirect">;
 export declare const proxy: RouteRuleCtor<"proxy">;
 export declare const cache: RouteRuleCtor<"cache">;
 export declare const basicAuth: RouteRuleCtor<"auth">;
+export declare function isPathInScope(pathname: string, base: string): boolean;
 export {};

package/dist/runtime/internal/route-rules.mjs

@@ -1,4 +1,4 @@
-import { proxyRequest, redirect as sendRedirect, requireBasicAuth } from "h3";
+import { HTTPError, proxyRequest, redirect as sendRedirect, requireBasicAuth } from "h3";
 import { joinURL, withQuery, withoutBase } from "ufo";
 import { defineCachedHandler } from "./cache.mjs";
 
@@ -17,7 +17,12 @@ export const redirect = ((m) => function redirectRouteRule(event) {
 		let targetPath = event.url.pathname + event.url.search;
 		const strpBase = m.options._redirectStripBase;
 		if (strpBase) {
+			if (!isPathInScope(event.url.pathname, strpBase)) {
+				throw new HTTPError({ status: 400 });
+			}
 			targetPath = withoutBase(targetPath, strpBase);
+		} else if (targetPath.startsWith("//")) {
+			targetPath = targetPath.replace(/^\/+/, "/");
 		}
 		target = joinURL(target.slice(0, -3), targetPath);
 	} else if (event.url.search) {
@@ -35,7 +40,12 @@ export const proxy = ((m) => function proxyRouteRule(event) {
 		let targetPath = event.url.pathname + event.url.search;
 		const strpBase = m.options._proxyStripBase;
 		if (strpBase) {
+			if (!isPathInScope(event.url.pathname, strpBase)) {
+				throw new HTTPError({ status: 400 });
+			}
 			targetPath = withoutBase(targetPath, strpBase);
+		} else if (targetPath.startsWith("//")) {
+			targetPath = targetPath.replace(/^\/+/, "/");
 		}
 		target = joinURL(target.slice(0, -3), targetPath);
 	} else if (event.url.search) {
@@ -72,3 +82,21 @@ export const basicAuth = /* @__PURE__ */ Object.assign(((m) => async function au
 	await requireBasicAuth(event, m.options);
 	return next();
 }), { order: -1 });
+
+
+
+
+
+
+
+
+export function isPathInScope(pathname, base) {
+	let canonical;
+	try {
+		const pre = pathname.replace(/%2f/gi, "/").replace(/%5c/gi, "\\");
+		canonical = new URL(pre, "http://_").pathname;
+	} catch {
+		return false;
+	}
+	return !base || canonical === base || canonical.startsWith(base + "/");
+}

package/dist/runtime/internal/routes/scalar.mjs

@@ -11,6 +11,7 @@ export default defineHandler((event) => {
 	const scalarConfig = {
 		..._config,
 		url: openAPIEndpoint,
+		// @ts-expect-error
 		spec: {
 			url: openAPIEndpoint,
 			..._config?.spec