vinext 0.0.12 → 0.0.14

package/dist/index.js

@@ -585,7 +585,15 @@ export async function runMiddleware(request) {
 
   if (!matchesMiddleware(normalizedPathname, matcher)) return { continue: true };
 
-  var nextRequest = request instanceof NextRequest ? request : new NextRequest(request);
+   // Construct a new Request with the decoded + normalized pathname so middleware
+   // always sees the same canonical path that the router uses.
+  var mwRequest = request;
+  if (normalizedPathname !== url.pathname) {
+    var mwUrl = new URL(url);
+    mwUrl.pathname = normalizedPathname;
+    mwRequest = new Request(mwUrl, request);
+  }
+  var nextRequest = mwRequest instanceof NextRequest ? mwRequest : new NextRequest(mwRequest);
   var response;
   try { response = await middlewareFn(nextRequest); }
   catch (e) {
@@ -598,7 +606,9 @@ export async function runMiddleware(request) {
   if (response.headers.get("x-middleware-next") === "1") {
     var rHeaders = new Headers();
     for (var [key, value] of response.headers) {
-      if (key !== "x-middleware-next" && key !== "x-middleware-rewrite") rHeaders.set(key, value);
+      // Strip ALL x-middleware-* headers — they are internal routing signals
+      // and must never reach clients.
+      if (!key.startsWith("x-middleware-")) rHeaders.set(key, value);
     }
     return { continue: true, responseHeaders: rHeaders };
   }
@@ -611,7 +621,7 @@ export async function runMiddleware(request) {
   var rewriteUrl = response.headers.get("x-middleware-rewrite");
   if (rewriteUrl) {
     var rwHeaders = new Headers();
-    for (var [k, v] of response.headers) { if (k !== "x-middleware-rewrite") rwHeaders.set(k, v); }
+    for (var [k, v] of response.headers) { if (!k.startsWith("x-middleware-")) rwHeaders.set(k, v); }
     var rewritePath;
     try { var parsed = new URL(rewriteUrl, request.url); rewritePath = parsed.pathname + parsed.search; }
     catch { rewritePath = rewriteUrl; }
@@ -692,7 +702,8 @@ ${apiRouteEntries.join(",\n")}
 function matchRoute(url, routes) {
   const pathname = url.split("?")[0];
   let normalizedUrl = pathname === "/" ? "/" : pathname.replace(/\\/$/, "");
-  try { normalizedUrl = decodeURIComponent(normalizedUrl); } catch {}
+  // NOTE: Do NOT decodeURIComponent here. The pathname is already decoded at
+  // the entry point. Decoding again would create a double-decode vector.
   for (const route of routes) {
     const params = matchPattern(normalizedUrl, route.pattern);
     if (params !== null) return { route, params };
@@ -1518,6 +1529,7 @@ hydrate();
             });
         });
     }
+    const imageImportDimCache = new Map();
     const plugins = [
         // Resolve tsconfig paths/baseUrl aliases so real-world Next.js repos
         // that use @/*, #/*, or baseUrl imports work out of the box.
@@ -2379,7 +2391,7 @@ hydrate();
             name: "vinext:image-imports",
             enforce: "pre",
             // Cache of image dimensions to avoid re-reading files
-            _dimCache: new Map(),
+            _dimCache: imageImportDimCache,
             resolveId: {
                 filter: { id: /\?vinext-meta$/ },
                 handler(source, _importer) {
@@ -2395,7 +2407,7 @@ hydrate();
                     return null;
                 const imagePath = id.replace("\0vinext-image-meta:", "");
                 // Read from cache first
-                const cache = this._dimCache;
+                const cache = imageImportDimCache;
                 let dims = cache.get(imagePath);
                 if (!dims) {
                     try {
@@ -3047,20 +3059,21 @@ export function matchConfigPattern(pathname, pattern) {
     // the whole segment (":path*.md") as a named parameter and matches everything.
     if (pattern.includes("(") ||
         pattern.includes("\\") ||
-        /:\w+[*+][^/]/.test(pattern)) {
+        /:[\w-]+[*+][^/]/.test(pattern)) {
         try {
             // Extract named params and their constraints from the pattern.
             // :param(constraint) -> use constraint as the regex group
             // :param -> ([^/]+)
             // :param* -> (.*)
             // :param+ -> (.+)
+            // Param names may contain hyphens (e.g. :auth-method, :sign-in).
             const paramNames = [];
             // Single-pass conversion with procedural suffix handling. The tokenizer
             // matches only simple, non-overlapping tokens; quantifier/constraint
             // suffixes after :param are consumed procedurally to avoid polynomial
             // backtracking in the regex engine.
             let regexStr = "";
-            const tokenRe = /:(\w+)|[.]|[^:.]+/g; // lgtm[js/redos] — alternatives are non-overlapping (`:` and `.` excluded from `[^:.]+`)
+            const tokenRe = /:([\w-]+)|[.]|[^:.]+/g; // lgtm[js/redos] — alternatives are non-overlapping (`:` and `.` excluded from `[^:.]+`)
             let tok;
             while ((tok = tokenRe.exec(pattern)) !== null) {
                 if (tok[1] !== undefined) {
@@ -3110,7 +3123,8 @@ export function matchConfigPattern(pathname, pattern) {
         }
     }
     // Check for catch-all patterns (:param* or :param+) without regex groups
-    const catchAllMatch = pattern.match(/:(\w+)(\*|\+)$/);
+    // Param names may contain hyphens (e.g. :sign-in*, :sign-up+).
+    const catchAllMatch = pattern.match(/:([\w-]+)(\*|\+)$/);
     if (catchAllMatch) {
         const prefix = pattern.slice(0, pattern.lastIndexOf(":"));
         const paramName = catchAllMatch[1];
@@ -3123,10 +3137,8 @@ export function matchConfigPattern(pathname, pattern) {
             return null;
         // For :path* zero segments is fine
         let restValue = rest.startsWith("/") ? rest.slice(1) : rest;
-        try {
-            restValue = decodeURIComponent(restValue);
-        }
-        catch { /* malformed percent-encoding */ }
+        // NOTE: Do NOT decodeURIComponent here. The pathname is already decoded at
+        // the entry point. Decoding again would create a double-decode vector.
         return { [paramName]: restValue };
     }
     // Simple segment-based matching for exact patterns and :param