vinext 0.0.0 → 0.0.2

package/dist/server/middleware.js

@@ -0,0 +1,228 @@
+/**
+ * proxy.ts / middleware.ts runner
+ *
+ * Loads and executes the user's proxy.ts (Next.js 16) or middleware.ts file
+ * before routing. Runs in Node (not Edge Runtime), per the vinext design.
+ *
+ * In Next.js 16, proxy.ts replaces middleware.ts:
+ * - proxy.ts: default export function, runs on Node.js runtime
+ * - middleware.ts: deprecated but still supported for Edge runtime use cases
+ *
+ * The proxy/middleware receives a NextRequest and can:
+ * - Return NextResponse.next() to continue to the route
+ * - Return NextResponse.redirect() to redirect
+ * - Return NextResponse.rewrite() to rewrite the URL
+ * - Set/modify headers and cookies
+ * - Return a Response directly (e.g., for auth guards)
+ *
+ * Supports the `config.matcher` export for path filtering.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { NextRequest } from "../shims/server.js";
+import { safeRegExp } from "../config/config-matchers.js";
+/**
+ * Possible proxy/middleware file names.
+ * proxy.ts (Next.js 16) is checked first, then middleware.ts (deprecated).
+ */
+const PROXY_FILES = [
+    "proxy.ts",
+    "proxy.js",
+    "proxy.mjs",
+    "src/proxy.ts",
+    "src/proxy.js",
+    "src/proxy.mjs",
+];
+const MIDDLEWARE_FILES = [
+    "middleware.ts",
+    "middleware.tsx",
+    "middleware.js",
+    "middleware.mjs",
+    "src/middleware.ts",
+    "src/middleware.tsx",
+    "src/middleware.js",
+    "src/middleware.mjs",
+];
+/**
+ * Find the proxy or middleware file in the project root.
+ * Checks for proxy.ts (Next.js 16) first, then falls back to middleware.ts.
+ * If middleware.ts is found, logs a deprecation warning.
+ */
+export function findMiddlewareFile(root) {
+    // Check proxy.ts first (Next.js 16 replacement for middleware.ts)
+    for (const file of PROXY_FILES) {
+        const fullPath = path.join(root, file);
+        if (fs.existsSync(fullPath)) {
+            return fullPath;
+        }
+    }
+    // Fall back to middleware.ts (deprecated in Next.js 16)
+    for (const file of MIDDLEWARE_FILES) {
+        const fullPath = path.join(root, file);
+        if (fs.existsSync(fullPath)) {
+            console.warn("[vinext] middleware.ts is deprecated in Next.js 16. " +
+                "Rename to proxy.ts and export a default function.");
+            return fullPath;
+        }
+    }
+    return null;
+}
+/**
+ * Check if a pathname matches the middleware matcher config.
+ * If no matcher is configured, middleware runs on all paths
+ * except static files and internal Next.js paths.
+ */
+export function matchesMiddleware(pathname, matcher) {
+    if (!matcher) {
+        // Default: match all paths except static files, _next, and favicon
+        return (!pathname.startsWith("/_next") &&
+            !pathname.startsWith("/api") &&
+            !pathname.includes(".") &&
+            pathname !== "/favicon.ico");
+    }
+    const patterns = [];
+    if (typeof matcher === "string") {
+        patterns.push(matcher);
+    }
+    else if (Array.isArray(matcher)) {
+        for (const m of matcher) {
+            if (typeof m === "string") {
+                patterns.push(m);
+            }
+            else if (m && typeof m === "object" && "source" in m) {
+                patterns.push(m.source);
+            }
+        }
+    }
+    return patterns.some((pattern) => matchPattern(pathname, pattern));
+}
+/**
+ * Match a single pattern against a pathname.
+ * Supports Next.js matcher patterns:
+ *   /about          -> exact match
+ *   /dashboard/:path*  -> prefix match with params
+ *   /api/:path+     -> one or more segments
+ *   /((?!api|_next).*)  -> regex patterns
+ */
+export function matchPattern(pathname, pattern) {
+    // Handle regex patterns (starts with /)
+    if (pattern.includes("(") || pattern.includes("\\")) {
+        const re = safeRegExp("^" + pattern + "$");
+        if (re)
+            return re.test(pathname);
+        // Fall through to simple matching
+    }
+    // Convert Next.js path patterns to regex.
+    // Escape dots FIRST (before replacements that produce regex metacharacters
+    // like .* and .+ which must not be escaped).
+    const regexStr = pattern
+        // Escape dots in the literal path segments
+        .replace(/\./g, "\\.")
+        // /:path* -> optionally match slash + zero or more segments
+        .replace(/\/:(\w+)\*/g, "(?:/.*)?")
+        // /:path+ -> match slash + one or more segments
+        .replace(/\/:(\w+)\+/g, "(?:/.+)")
+        // :param -> match one segment
+        .replace(/:(\w+)/g, "([^/]+)");
+    const re = safeRegExp("^" + regexStr + "$");
+    if (re)
+        return re.test(pathname);
+    return pathname === pattern;
+}
+/**
+ * Load and execute middleware for a given request.
+ *
+ * @param server - Vite dev server (for SSR module loading)
+ * @param middlewarePath - Absolute path to the middleware file
+ * @param request - The incoming Request object
+ * @returns Middleware result describing what action to take
+ */
+export async function runMiddleware(server, middlewarePath, request) {
+    // Load the middleware module via Vite's SSR module loader
+    const mod = await server.ssrLoadModule(middlewarePath);
+    // Accept: default export, named "proxy" (Next.js 16), or named "middleware"
+    const middlewareFn = mod.default ?? mod.proxy ?? mod.middleware;
+    if (typeof middlewareFn !== "function") {
+        // No proxy/middleware function exported — continue as normal
+        return { continue: true };
+    }
+    // Check matcher config
+    const config = mod.config;
+    const matcher = config?.matcher;
+    const url = new URL(request.url);
+    if (!matchesMiddleware(url.pathname, matcher)) {
+        return { continue: true };
+    }
+    // Wrap in NextRequest so middleware gets .nextUrl, .cookies, .geo, .ip, etc.
+    const nextRequest = request instanceof NextRequest ? request : new NextRequest(request);
+    // Execute the middleware
+    let response;
+    try {
+        response = await middlewareFn(nextRequest);
+    }
+    catch (e) {
+        console.error("[vinext] Middleware error:", e);
+        return {
+            continue: false,
+            response: new Response("Middleware Error: " + (e?.message ?? String(e)), {
+                status: 500,
+            }),
+        };
+    }
+    // No response = continue
+    if (!response) {
+        return { continue: true };
+    }
+    // Check for x-middleware-next header (NextResponse.next())
+    if (response.headers.get("x-middleware-next") === "1") {
+        // Continue to the route, but apply any headers the middleware set
+        const responseHeaders = new Headers();
+        for (const [key, value] of response.headers) {
+            if (key !== "x-middleware-next" &&
+                key !== "x-middleware-rewrite") {
+                responseHeaders.set(key, value);
+            }
+        }
+        return { continue: true, responseHeaders };
+    }
+    // Check for redirect (3xx status)
+    if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("Location") ?? response.headers.get("location");
+        if (location) {
+            return {
+                continue: false,
+                redirectUrl: location,
+                redirectStatus: response.status,
+            };
+        }
+    }
+    // Check for rewrite (x-middleware-rewrite header)
+    const rewriteUrl = response.headers.get("x-middleware-rewrite");
+    if (rewriteUrl) {
+        // Continue to the route but with a rewritten URL
+        const responseHeaders = new Headers();
+        for (const [key, value] of response.headers) {
+            if (key !== "x-middleware-rewrite") {
+                responseHeaders.set(key, value);
+            }
+        }
+        // Parse the rewrite URL — may be absolute or relative
+        let rewritePath;
+        try {
+            const rewriteParsed = new URL(rewriteUrl, request.url);
+            rewritePath = rewriteParsed.pathname + rewriteParsed.search;
+        }
+        catch {
+            rewritePath = rewriteUrl;
+        }
+        return {
+            continue: true,
+            rewriteUrl: rewritePath,
+            rewriteStatus: response.status !== 200 ? response.status : undefined,
+            responseHeaders,
+        };
+    }
+    // Middleware returned a full Response (e.g., blocking, custom body)
+    return { continue: false, response };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/server/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D;;;GAGG;AACH,MAAM,WAAW,GAAG;IAClB,UAAU;IACV,UAAU;IACV,WAAW;IACX,cAAc;IACd,cAAc;IACd,eAAe;CAChB,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;CACrB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CACV,sDAAsD;gBACpD,mDAAmD,CACtD,CAAC;YACF,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAgB,EAChB,OAAkC;IAElC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,mEAAmE;QACnE,OAAO,CACL,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC;YAC9B,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5B,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvB,QAAQ,KAAK,cAAc,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;iBAAM,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBACvD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,OAAe;IAC5D,wCAAwC;IACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC;QAC3C,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjC,kCAAkC;IACpC,CAAC;IAED,0CAA0C;IAC1C,2EAA2E;IAC3E,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,OAAO;QACtB,2CAA2C;SAC1C,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QACtB,4DAA4D;SAC3D,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC;QACnC,gDAAgD;SAC/C,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC;QAClC,8BAA8B;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEjC,MAAM,EAAE,GAAG,UAAU,CAAC,GAAG,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC;IAC5C,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,QAAQ,KAAK,OAAO,CAAC;AAC9B,CAAC;AAoBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,cAAsB,EACtB,OAAgB;IAEhB,0DAA0D;IAC1D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;IAEvD,4EAA4E;IAC5E,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC;IAChE,IAAI,OAAO,YAAY,KAAK,UAAU,EAAE,CAAC;QACvC,6DAA6D;QAC7D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,uBAAuB;IACvB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,6EAA6E;IAC7E,MAAM,WAAW,GAAG,OAAO,YAAY,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAExF,yBAAyB;IACzB,IAAI,QAA8B,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC;QAC/C,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI,QAAQ,CAAC,oBAAoB,GAAG,CAAC,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;gBACvE,MAAM,EAAE,GAAG;aACZ,CAAC;SACH,CAAC;IACJ,CAAC;IAED,yBAAyB;IACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,2DAA2D;IAC3D,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,EAAE,CAAC;QACtD,kEAAkE;QAClE,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC5C,IACE,GAAG,KAAK,mBAAmB;gBAC3B,GAAG,KAAK,sBAAsB,EAC9B,CAAC;gBACD,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtF,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,QAAQ;gBACrB,cAAc,EAAE,QAAQ,CAAC,MAAM;aAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAChE,IAAI,UAAU,EAAE,CAAC;QACf,iDAAiD;QACjD,MAAM,eAAe,GAAG,IAAI,OAAO,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC5C,IAAI,GAAG,KAAK,sBAAsB,EAAE,CAAC;gBACnC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,sDAAsD;QACtD,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACvD,WAAW,GAAG,aAAa,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,UAAU,CAAC;QAC3B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,WAAW;YACvB,aAAa,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACpE,eAAe;SAChB,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC","sourcesContent":["/**\n * proxy.ts / middleware.ts runner\n *\n * Loads and executes the user's proxy.ts (Next.js 16) or middleware.ts file\n * before routing. Runs in Node (not Edge Runtime), per the vinext design.\n *\n * In Next.js 16, proxy.ts replaces middleware.ts:\n * - proxy.ts: default export function, runs on Node.js runtime\n * - middleware.ts: deprecated but still supported for Edge runtime use cases\n *\n * The proxy/middleware receives a NextRequest and can:\n * - Return NextResponse.next() to continue to the route\n * - Return NextResponse.redirect() to redirect\n * - Return NextResponse.rewrite() to rewrite the URL\n * - Set/modify headers and cookies\n * - Return a Response directly (e.g., for auth guards)\n *\n * Supports the `config.matcher` export for path filtering.\n */\n\nimport type { ViteDevServer } from \"vite\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport { NextRequest } from \"../shims/server.js\";\nimport { safeRegExp } from \"../config/config-matchers.js\";\n\n/**\n * Possible proxy/middleware file names.\n * proxy.ts (Next.js 16) is checked first, then middleware.ts (deprecated).\n */\nconst PROXY_FILES = [\n  \"proxy.ts\",\n  \"proxy.js\",\n  \"proxy.mjs\",\n  \"src/proxy.ts\",\n  \"src/proxy.js\",\n  \"src/proxy.mjs\",\n];\n\nconst MIDDLEWARE_FILES = [\n  \"middleware.ts\",\n  \"middleware.tsx\",\n  \"middleware.js\",\n  \"middleware.mjs\",\n  \"src/middleware.ts\",\n  \"src/middleware.tsx\",\n  \"src/middleware.js\",\n  \"src/middleware.mjs\",\n];\n\n/**\n * Find the proxy or middleware file in the project root.\n * Checks for proxy.ts (Next.js 16) first, then falls back to middleware.ts.\n * If middleware.ts is found, logs a deprecation warning.\n */\nexport function findMiddlewareFile(root: string): string | null {\n  // Check proxy.ts first (Next.js 16 replacement for middleware.ts)\n  for (const file of PROXY_FILES) {\n    const fullPath = path.join(root, file);\n    if (fs.existsSync(fullPath)) {\n      return fullPath;\n    }\n  }\n\n  // Fall back to middleware.ts (deprecated in Next.js 16)\n  for (const file of MIDDLEWARE_FILES) {\n    const fullPath = path.join(root, file);\n    if (fs.existsSync(fullPath)) {\n      console.warn(\n        \"[vinext] middleware.ts is deprecated in Next.js 16. \" +\n          \"Rename to proxy.ts and export a default function.\",\n      );\n      return fullPath;\n    }\n  }\n  return null;\n}\n\n/** Matcher pattern from middleware config export. */\ntype MatcherConfig =\n  | string\n  | string[]\n  | { source: string; regexp?: string; locale?: boolean; has?: any[]; missing?: any[] }[];\n\n/**\n * Check if a pathname matches the middleware matcher config.\n * If no matcher is configured, middleware runs on all paths\n * except static files and internal Next.js paths.\n */\nexport function matchesMiddleware(\n  pathname: string,\n  matcher: MatcherConfig | undefined,\n): boolean {\n  if (!matcher) {\n    // Default: match all paths except static files, _next, and favicon\n    return (\n      !pathname.startsWith(\"/_next\") &&\n      !pathname.startsWith(\"/api\") &&\n      !pathname.includes(\".\") &&\n      pathname !== \"/favicon.ico\"\n    );\n  }\n\n  const patterns: string[] = [];\n  if (typeof matcher === \"string\") {\n    patterns.push(matcher);\n  } else if (Array.isArray(matcher)) {\n    for (const m of matcher) {\n      if (typeof m === \"string\") {\n        patterns.push(m);\n      } else if (m && typeof m === \"object\" && \"source\" in m) {\n        patterns.push(m.source);\n      }\n    }\n  }\n\n  return patterns.some((pattern) => matchPattern(pathname, pattern));\n}\n\n/**\n * Match a single pattern against a pathname.\n * Supports Next.js matcher patterns:\n *   /about          -> exact match\n *   /dashboard/:path*  -> prefix match with params\n *   /api/:path+     -> one or more segments\n *   /((?!api|_next).*)  -> regex patterns\n */\nexport function matchPattern(pathname: string, pattern: string): boolean {\n  // Handle regex patterns (starts with /)\n  if (pattern.includes(\"(\") || pattern.includes(\"\\\\\")) {\n    const re = safeRegExp(\"^\" + pattern + \"$\");\n    if (re) return re.test(pathname);\n    // Fall through to simple matching\n  }\n\n  // Convert Next.js path patterns to regex.\n  // Escape dots FIRST (before replacements that produce regex metacharacters\n  // like .* and .+ which must not be escaped).\n  const regexStr = pattern\n    // Escape dots in the literal path segments\n    .replace(/\\./g, \"\\\\.\")\n    // /:path* -> optionally match slash + zero or more segments\n    .replace(/\\/:(\\w+)\\*/g, \"(?:/.*)?\")\n    // /:path+ -> match slash + one or more segments\n    .replace(/\\/:(\\w+)\\+/g, \"(?:/.+)\")\n    // :param -> match one segment\n    .replace(/:(\\w+)/g, \"([^/]+)\");\n\n  const re = safeRegExp(\"^\" + regexStr + \"$\");\n  if (re) return re.test(pathname);\n  return pathname === pattern;\n}\n\n/** Result of running middleware. */\nexport interface MiddlewareResult {\n  /** Whether to continue to the route handler. */\n  continue: boolean;\n  /** If set, redirect to this URL. */\n  redirectUrl?: string;\n  /** HTTP status for redirect (default 307). */\n  redirectStatus?: number;\n  /** If set, rewrite to this URL (internal). */\n  rewriteUrl?: string;\n  /** HTTP status for rewrite (e.g. 403 from NextResponse.rewrite(url, { status: 403 })). */\n  rewriteStatus?: number;\n  /** Headers to set on the response. */\n  responseHeaders?: Headers;\n  /** If the middleware returned a full Response, use it directly. */\n  response?: Response;\n}\n\n/**\n * Load and execute middleware for a given request.\n *\n * @param server - Vite dev server (for SSR module loading)\n * @param middlewarePath - Absolute path to the middleware file\n * @param request - The incoming Request object\n * @returns Middleware result describing what action to take\n */\nexport async function runMiddleware(\n  server: ViteDevServer,\n  middlewarePath: string,\n  request: Request,\n): Promise<MiddlewareResult> {\n  // Load the middleware module via Vite's SSR module loader\n  const mod = await server.ssrLoadModule(middlewarePath);\n\n  // Accept: default export, named \"proxy\" (Next.js 16), or named \"middleware\"\n  const middlewareFn = mod.default ?? mod.proxy ?? mod.middleware;\n  if (typeof middlewareFn !== \"function\") {\n    // No proxy/middleware function exported — continue as normal\n    return { continue: true };\n  }\n\n  // Check matcher config\n  const config = mod.config;\n  const matcher = config?.matcher;\n  const url = new URL(request.url);\n\n  if (!matchesMiddleware(url.pathname, matcher)) {\n    return { continue: true };\n  }\n\n  // Wrap in NextRequest so middleware gets .nextUrl, .cookies, .geo, .ip, etc.\n  const nextRequest = request instanceof NextRequest ? request : new NextRequest(request);\n\n  // Execute the middleware\n  let response: Response | undefined;\n  try {\n    response = await middlewareFn(nextRequest);\n  } catch (e: any) {\n    console.error(\"[vinext] Middleware error:\", e);\n    return {\n      continue: false,\n      response: new Response(\"Middleware Error: \" + (e?.message ?? String(e)), {\n        status: 500,\n      }),\n    };\n  }\n\n  // No response = continue\n  if (!response) {\n    return { continue: true };\n  }\n\n  // Check for x-middleware-next header (NextResponse.next())\n  if (response.headers.get(\"x-middleware-next\") === \"1\") {\n    // Continue to the route, but apply any headers the middleware set\n    const responseHeaders = new Headers();\n    for (const [key, value] of response.headers) {\n      if (\n        key !== \"x-middleware-next\" &&\n        key !== \"x-middleware-rewrite\"\n      ) {\n        responseHeaders.set(key, value);\n      }\n    }\n    return { continue: true, responseHeaders };\n  }\n\n  // Check for redirect (3xx status)\n  if (response.status >= 300 && response.status < 400) {\n    const location = response.headers.get(\"Location\") ?? response.headers.get(\"location\");\n    if (location) {\n      return {\n        continue: false,\n        redirectUrl: location,\n        redirectStatus: response.status,\n      };\n    }\n  }\n\n  // Check for rewrite (x-middleware-rewrite header)\n  const rewriteUrl = response.headers.get(\"x-middleware-rewrite\");\n  if (rewriteUrl) {\n    // Continue to the route but with a rewritten URL\n    const responseHeaders = new Headers();\n    for (const [key, value] of response.headers) {\n      if (key !== \"x-middleware-rewrite\") {\n        responseHeaders.set(key, value);\n      }\n    }\n    // Parse the rewrite URL — may be absolute or relative\n    let rewritePath: string;\n    try {\n      const rewriteParsed = new URL(rewriteUrl, request.url);\n      rewritePath = rewriteParsed.pathname + rewriteParsed.search;\n    } catch {\n      rewritePath = rewriteUrl;\n    }\n    return {\n      continue: true,\n      rewriteUrl: rewritePath,\n      rewriteStatus: response.status !== 200 ? response.status : undefined,\n      responseHeaders,\n    };\n  }\n\n  // Middleware returned a full Response (e.g., blocking, custom body)\n  return { continue: false, response };\n}\n"]}

package/dist/server/prod-server.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Production server for vinext.
+ *
+ * Serves the built output from `vinext build`. Handles:
+ * - Static asset serving from client build output
+ * - Pages Router: SSR rendering + API route handling
+ * - App Router: RSC/SSR rendering, route handlers, server actions
+ * - Gzip/Brotli compression for text-based responses
+ * - Streaming SSR for App Router
+ *
+ * Build output for Pages Router:
+ * - dist/client/  — static assets (JS, CSS, images) + .vite/ssr-manifest.json
+ * - dist/server/entry.js — SSR entry point (virtual:vinext-server-entry)
+ *
+ * Build output for App Router:
+ * - dist/client/  — static assets (JS, CSS, images)
+ * - dist/server/index.js — RSC entry (default export: handler(Request) → Response)
+ * - dist/server/ssr/index.js — SSR entry (imported by RSC entry at runtime)
+ */
+import { type IncomingMessage, type ServerResponse } from "node:http";
+export interface ProdServerOptions {
+    /** Port to listen on */
+    port?: number;
+    /** Host to bind to */
+    host?: string;
+    /** Path to the build output directory */
+    outDir?: string;
+    /** Disable compression (default: false) */
+    noCompression?: boolean;
+}
+/** Content types that benefit from compression. */
+declare const COMPRESSIBLE_TYPES: Set<string>;
+/** Minimum size threshold for compression (in bytes). Below this, compression overhead isn't worth it. */
+declare const COMPRESS_THRESHOLD = 1024;
+/**
+ * Parse the Accept-Encoding header and return the best supported encoding.
+ * Preference order: br > gzip > deflate > identity.
+ */
+declare function negotiateEncoding(req: IncomingMessage): "br" | "gzip" | "deflate" | null;
+/**
+ * Send a compressed response if the content type is compressible and the
+ * client supports compression. Otherwise send uncompressed.
+ */
+declare function sendCompressed(req: IncomingMessage, res: ServerResponse, body: string | Buffer, contentType: string, statusCode: number, extraHeaders?: Record<string, string>, compress?: boolean): void;
+/**
+ * Resolve the host for a request, ignoring X-Forwarded-Host to prevent
+ * host header poisoning attacks (open redirects, cache poisoning).
+ *
+ * X-Forwarded-Host is only trusted when the VINEXT_TRUSTED_HOSTS env var
+ * lists the forwarded host value. Without this, an attacker can send
+ * X-Forwarded-Host: evil.com and poison any redirect that resolves
+ * against request.url.
+ *
+ * On Cloudflare Workers, X-Forwarded-Host is always set by Cloudflare
+ * itself, so this is only a concern for the Node.js prod-server.
+ */
+declare function resolveHost(req: IncomingMessage, fallback: string): string;
+/** Hosts that are allowed as X-Forwarded-Host values (stored lowercase). */
+declare const trustedHosts: Set<string>;
+/**
+ * Whether to trust X-Forwarded-Proto from upstream proxies.
+ * Enabled when VINEXT_TRUST_PROXY=1 or when VINEXT_TRUSTED_HOSTS is set
+ * (having trusted hosts implies a trusted proxy).
+ */
+declare const trustProxy: boolean;
+/**
+ * Convert a Node.js IncomingMessage to a Web Request object.
+ */
+declare function nodeToWebRequest(req: IncomingMessage): Request;
+/**
+ * Start the production server.
+ *
+ * Automatically detects whether the build is App Router (dist/server/index.js) or
+ * Pages Router (dist/server/entry.js) and configures the appropriate handler.
+ */
+export declare function startProdServer(options?: ProdServerOptions): Promise<import("node:http").Server<typeof IncomingMessage, typeof ServerResponse>>;
+export { sendCompressed, negotiateEncoding, COMPRESSIBLE_TYPES, COMPRESS_THRESHOLD, resolveHost, trustedHosts, trustProxy, nodeToWebRequest };
+//# sourceMappingURL=prod-server.d.ts.map

package/dist/server/prod-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../../src/server/prod-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAsBpF,MAAM,WAAW,iBAAiB;IAChC,wBAAwB;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,mDAAmD;AACnD,QAAA,MAAM,kBAAkB,aAetB,CAAC;AAEH,0GAA0G;AAC1G,QAAA,MAAM,kBAAkB,OAAO,CAAC;AAEhC;;;GAGG;AACH,iBAAS,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI,CAQjF;AAoBD;;;GAGG;AACH,iBAAS,cAAc,CACrB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,GAAG,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,EACzC,QAAQ,GAAE,OAAc,GACvB,IAAI,CAuBN;AAuFD;;;;;;;;;;;GAWG;AACH,iBAAS,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAcnE;AAED,4EAA4E;AAC5E,QAAA,MAAM,YAAY,EAAE,GAAG,CAAC,MAAM,CAK7B,CAAC;AAEF;;;;GAIG;AACH,QAAA,MAAM,UAAU,SAAkE,CAAC;AAEnF;;GAEG;AACH,iBAAS,gBAAgB,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAmCvD;AAoED;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,GAAE,iBAAsB,sFA6BpE;AA4aD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC"}