vinext 1.0.0-beta.0 → 1.0.0-beta.2

package/dist/server/dev-stack-sourcemap.js

@@ -1,3 +1,4 @@
+import { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { VINEXT_ORIGINAL_STACK_TRACE_ENDPOINT } from "../utils/dev-stack-sourcemap-endpoint.js";
 import { readFile } from "node:fs/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -184,7 +185,7 @@ function extractV8ParenMethodName(prefix) {
 }
 function normalizeProjectRoot(root) {
 	if (!root) return void 0;
-	return root.replaceAll("\\", "/").replace(/\/+$/, "") || (root.startsWith("/") ? "/" : void 0);
+	return toSlash(root).replace(/\/+$/, "") || (root.startsWith("/") ? "/" : void 0);
 }
 function stripTrailingSlash(value) {
 	return value?.replace(/[\\/]+$/, "");
@@ -240,7 +241,7 @@ function isWindowsAbsolutePath(value) {
 	return /^[A-Za-z]:[\\/]/.test(value);
 }
 function normalizeLocalPathForCompare(value) {
-	const normalized = (stripTrailingSlash(value.replaceAll("\\", "/")) ?? "").replace(/\/+/g, "/");
+	const normalized = (stripTrailingSlash(toSlash(value)) ?? "").replace(/\/+/g, "/");
 	return /^[A-Za-z]:\//.test(normalized) ? normalized.toLowerCase() : normalized;
 }
 function normalizeIgnoreListPath(value) {
@@ -255,7 +256,7 @@ function normalizeIgnoreListPath(value) {
 	try {
 		path = decodeURIComponent(path);
 	} catch {}
-	return path.replaceAll("\\", "/").toLowerCase();
+	return toSlash(path).toLowerCase();
 }
 function isExternalHttpFrame(file, requestHost) {
 	if (!/^https?:\/\//i.test(file) || !requestHost) return false;

package/dist/server/headers.d.ts

@@ -56,6 +56,8 @@ declare const VINEXT_CLIENT_REUSE_MANIFEST_HEADER = "X-Vinext-Client-Reuse-Manif
  * cheap way to detect the redirect ahead of stream decode.
  */
 declare const VINEXT_RSC_REDIRECT_HEADER = "X-Vinext-Rsc-Redirect";
+/** History update mode encoded by a streamed RSC redirect. */
+declare const VINEXT_RSC_REDIRECT_TYPE_HEADER = "X-Vinext-Rsc-Redirect-Type";
 /** Standard RSC header — value "1" indicates an RSC payload request. */
 declare const RSC_HEADER = "RSC";
 /** Server Action invocation header (vinext/vite-rsc protocol). */
@@ -105,4 +107,4 @@ declare const INTERNAL_HEADERS: string[];
 /** Vinext-only internal headers stripped alongside Next.js protocol internals. */
 declare const VINEXT_INTERNAL_HEADERS: string[];
 //#endregion
-export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };
+export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };

package/dist/server/headers.js

@@ -55,6 +55,8 @@ const VINEXT_CLIENT_REUSE_MANIFEST_HEADER = "X-Vinext-Client-Reuse-Manifest";
 * cheap way to detect the redirect ahead of stream decode.
 */
 const VINEXT_RSC_REDIRECT_HEADER = "X-Vinext-Rsc-Redirect";
+/** History update mode encoded by a streamed RSC redirect. */
+const VINEXT_RSC_REDIRECT_TYPE_HEADER = "X-Vinext-Rsc-Redirect-Type";
 /** Standard RSC header — value "1" indicates an RSC payload request. */
 const RSC_HEADER = "RSC";
 /** Server Action invocation header (vinext/vite-rsc protocol). */
@@ -128,4 +130,4 @@ const VINEXT_INTERNAL_HEADERS = [
 	VINEXT_PRERENDER_CACHE_LIFE_HEADER
 ];
 //#endregion
-export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };
+export { ACTION_FORWARDED_HEADER, ACTION_REDIRECT_HEADER, ACTION_REDIRECT_STATUS_HEADER, ACTION_REDIRECT_TYPE_HEADER, ACTION_REVALIDATED_HEADER, FLIGHT_HEADERS, INTERNAL_HEADERS, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_NEXT_HEADER, MIDDLEWARE_REWRITE_HEADER, MIDDLEWARE_SET_COOKIE_HEADER, MIDDLEWARE_SKIP_HEADER, NEXTJS_ACTION_NOT_FOUND_HEADER, NEXTJS_CACHE_HEADER, NEXTJS_DEPLOYMENT_ID_HEADER, NEXT_ACTION_HEADER, NEXT_HTML_REQUEST_ID_HEADER, NEXT_REQUEST_ID_HEADER, NEXT_ROUTER_PREFETCH_HEADER, NEXT_ROUTER_SEGMENT_PREFETCH_HEADER, NEXT_ROUTER_STATE_TREE_HEADER, NEXT_URL_HEADER, RSC_ACTION_HEADER, RSC_HEADER, VINEXT_CACHE_HEADER, VINEXT_CLIENT_REUSE_MANIFEST_HEADER, VINEXT_DYNAMIC_STALE_TIME_HEADER, VINEXT_INTERCEPTION_CONTEXT_HEADER, VINEXT_INTERNAL_HEADERS, VINEXT_MOUNTED_SLOTS_HEADER, VINEXT_MW_CTX_HEADER, VINEXT_PARAMS_HEADER, VINEXT_PRERENDER_CACHE_LIFE_HEADER, VINEXT_PRERENDER_PAGES_STATIC_PATHS_PATH, VINEXT_PRERENDER_ROUTE_PARAMS_HEADER, VINEXT_PRERENDER_SECRET_HEADER, VINEXT_PRERENDER_SPECULATIVE_HEADER, VINEXT_PRERENDER_STATIC_PARAMS_PATH, VINEXT_RENDERED_PATH_AND_SEARCH_HEADER, VINEXT_REVALIDATE_HEADER, VINEXT_RSC_MARKER_HEADER, VINEXT_RSC_REDIRECT_HEADER, VINEXT_RSC_REDIRECT_TYPE_HEADER, VINEXT_RSC_RENDER_MODE_HEADER, VINEXT_STATIC_FILE_HEADER, VINEXT_TIMING_HEADER };

package/dist/server/image-optimization.js

@@ -87,7 +87,7 @@ function resolveDevImageRedirect(requestUrl, allowedWidths = [...DEFAULT_DEVICE_
 * https://github.com/vercel/next.js/blob/canary/test/integration/image-optimizer/test/index.test.ts
 */
 function parseImageParams(url, allowedWidths = [...DEFAULT_DEVICE_SIZES, ...DEFAULT_IMAGE_SIZES], allowedQualities, options = {}) {
-	const allowedParamNames = new Set([
+	const allowedParamNames = /* @__PURE__ */ new Set([
 		"url",
 		"w",
 		"q",
@@ -150,7 +150,7 @@ const IMAGE_CONTENT_SECURITY_POLICY = "script-src 'none'; frame-src 'none'; sand
 * SVG is intentionally excluded — it can contain embedded JavaScript and is
 * essentially an XML document, not a safe raster image format.
 */
-const SAFE_IMAGE_CONTENT_TYPES = new Set([
+const SAFE_IMAGE_CONTENT_TYPES = /* @__PURE__ */ new Set([
 	"image/jpeg",
 	"image/png",
 	"image/gif",

package/dist/server/implicit-tags.js

@@ -33,7 +33,8 @@ function buildAppPageTags(cleanPathname, extraTags, routeSegments) {
 	return buildPageCacheTags(cleanPathname, extraTags, [...routeSegments], "page");
 }
 function buildPageCacheTags(pathname, extraTags, routeSegments, leafKind) {
-	const tags = [pathname, `${NEXT_CACHE_IMPLICIT_TAG_ID}${pathname.length > 1 && pathname.endsWith("/") ? pathname.slice(0, -1) : pathname}`];
+	const normalizedPathname = pathname.length > 1 && pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
+	const tags = [pathname, `${NEXT_CACHE_IMPLICIT_TAG_ID}${normalizedPathname}`];
 	if (pathname === "/") appendUnique(tags, `${NEXT_CACHE_IMPLICIT_TAG_ID}/index`);
 	if (pathname === "/index") appendUnique(tags, `${NEXT_CACHE_IMPLICIT_TAG_ID}/`);
 	appendDerivedTags(tags, buildRouteCachePath(routeSegments, leafKind));

package/dist/server/instrumentation.js

@@ -1,6 +1,6 @@
+import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { getRequestExecutionContext } from "../shims/request-context.js";
 import fs from "node:fs";
-import path from "node:path";
 //#region src/server/instrumentation.ts
 /**
 * instrumentation.ts support
@@ -51,7 +51,7 @@ async function importModule(runner, id) {
 const INSTRUMENTATION_LOCATIONS = ["", "src/"];
 function findInstrumentationHookFile(root, basename, fileMatcher) {
 	for (const dir of INSTRUMENTATION_LOCATIONS) for (const ext of fileMatcher.dottedExtensions) {
-		const fullPath = path.posix.join(root, dir, `${basename}${ext}`);
+		const fullPath = path.join(root, dir, `${basename}${ext}`);
 		if (fs.existsSync(fullPath)) return fullPath;
 	}
 	return null;

package/dist/server/isr-cache.d.ts

@@ -1,8 +1,8 @@
 import { OnRequestErrorContext } from "./instrumentation.js";
 import { RenderObservation } from "./cache-proof.js";
+import { AppRscRenderMode } from "./app-rsc-render-mode.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { CacheHandlerValue, CachedAppPageValue, CachedPagesValue, IncrementalCacheValue } from "../shims/cache-handler.js";
-import { AppRscRenderMode } from "./app-rsc-render-mode.js";
 
 //#region src/server/isr-cache.d.ts
 /**

package/dist/server/isr-cache.js

@@ -62,7 +62,7 @@ function getRevalidateSecret() {
 	const baked = process.env.__VINEXT_REVALIDATE_SECRET;
 	if (baked) return baked;
 	if (devRevalidateSecret === void 0) {
-		const bytes = new Uint8Array(32);
+		const bytes = /* @__PURE__ */ new Uint8Array(32);
 		crypto.getRandomValues(bytes);
 		devRevalidateSecret = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
 	}

package/dist/server/metadata-routes.js

@@ -1,6 +1,6 @@
+import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { matchRoutePattern } from "../routing/route-pattern.js";
 import fs from "node:fs";
-import path from "node:path";
 //#region src/server/metadata-routes.ts
 /**
 * File-based metadata route handling.
@@ -292,7 +292,7 @@ function computeMetadataRouteSuffix(appDirPath, leafName) {
 	};
 }
 function getMetadataRouteFilename(appDirPath, lastSegment) {
-	const ext = path.posix.extname(lastSegment);
+	const ext = path.extname(lastSegment);
 	const name = lastSegment.slice(0, -ext.length || void 0);
 	const { suffix } = computeMetadataRouteSuffix(appDirPath, name);
 	return `${name}${suffix ? `-${suffix}` : ""}${ext}`;
@@ -339,8 +339,8 @@ function metadataRouteSuffix(parentSegments, metaType) {
 }
 function withMetadataSuffix(urlPath, suffix) {
 	if (!suffix) return urlPath;
-	const parsed = path.posix.parse(urlPath);
-	return path.posix.join(parsed.dir || "/", `${parsed.name}-${suffix}${parsed.ext}`);
+	const parsed = path.parse(urlPath);
+	return path.join(parsed.dir || "/", `${parsed.name}-${suffix}${parsed.ext}`);
 }
 function getMetadataServedUrl(metaType, config, ext, isDynamic, suffix, routeBaseName) {
 	if (isDynamic && (metaType === "icon" || metaType === "apple-icon" || metaType === "opengraph-image" || metaType === "twitter-image")) return withMetadataSuffix(`/${routeBaseName}`, suffix);

package/dist/server/middleware-matcher-pattern.d.ts

@@ -0,0 +1,22 @@
+import { HasCondition } from "../config/next-config.js";
+
+//#region src/server/middleware-matcher-pattern.d.ts
+type CompiledMiddlewareMatcherPattern = {
+  regexp: RegExp;
+  error?: never;
+} | {
+  regexp?: never;
+  error: string;
+  kind: "invalid" | "unsafe";
+};
+type MiddlewareMatcherObject = {
+  source: string;
+  locale?: false;
+  has?: HasCondition[];
+  missing?: HasCondition[];
+};
+declare function isValidMiddlewareMatcherObjectConfig(value: unknown): value is MiddlewareMatcherObject;
+declare function compileMiddlewareMatcherPattern(source: string): CompiledMiddlewareMatcherPattern;
+declare function validateMiddlewareMatcherPatterns(value: unknown): void;
+//#endregion
+export { CompiledMiddlewareMatcherPattern, MiddlewareMatcherObject, compileMiddlewareMatcherPattern, isValidMiddlewareMatcherObjectConfig, validateMiddlewareMatcherPatterns };

package/dist/server/middleware-matcher-pattern.js

@@ -0,0 +1,219 @@
+import { analyzeRegexSafety, regexAtomsMayOverlap } from "../utils/regex-safety.js";
+import { middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath } from "./middleware-path-to-regexp.js";
+//#region src/server/middleware-matcher-pattern.ts
+const MATCHER_OBJECT_KEYS = /* @__PURE__ */ new Set([
+	"source",
+	"locale",
+	"has",
+	"missing"
+]);
+const CONDITION_TYPES_WITH_KEY = /* @__PURE__ */ new Set([
+	"header",
+	"query",
+	"cookie"
+]);
+function invalidConditionReason(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return "has and missing entries must be objects";
+	const condition = value;
+	const type = condition.type;
+	if (typeof type === "string" && CONDITION_TYPES_WITH_KEY.has(type)) {
+		for (const key of Object.keys(condition)) if (key !== "type" && key !== "key" && key !== "value") return `condition contains unsupported field "${key}"`;
+		if (typeof condition.key !== "string") return `condition type "${type}" requires a string key`;
+		if (condition.value !== void 0 && typeof condition.value !== "string") return `condition type "${type}" requires value to be a string`;
+		return null;
+	}
+	if (type === "host") {
+		for (const key of Object.keys(condition)) if (key !== "type" && key !== "value") return `host condition contains unsupported field "${key}"`;
+		return typeof condition.value === "string" ? null : "host condition requires a string value";
+	}
+	return "condition type must be header, query, cookie, or host";
+}
+function invalidConditionsReason(value, field) {
+	if (value === void 0) return null;
+	if (!Array.isArray(value)) return `${field} must be an array`;
+	for (const condition of value) {
+		const reason = invalidConditionReason(condition);
+		if (reason) return `${field} ${reason}`;
+	}
+	return null;
+}
+function matcherObjectSource(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return { error: "matcher entries must be strings or objects" };
+	const matcher = value;
+	for (const key of Object.keys(matcher)) if (!MATCHER_OBJECT_KEYS.has(key)) return { error: `matcher object contains unsupported field "${key}"` };
+	if (typeof matcher.source !== "string") return { error: "matcher object requires a string source" };
+	if (matcher.locale !== void 0 && matcher.locale !== false) return { error: "matcher object locale must be false when provided" };
+	const invalidHas = invalidConditionsReason(matcher.has, "has");
+	if (invalidHas) return { error: invalidHas };
+	const invalidMissing = invalidConditionsReason(matcher.missing, "missing");
+	if (invalidMissing) return { error: invalidMissing };
+	return { source: matcher.source };
+}
+function isValidMiddlewareMatcherObjectConfig(value) {
+	return matcherObjectSource(value).error === void 0;
+}
+function patternMatches(pattern, value) {
+	try {
+		return new RegExp(`^(?:${pattern})$`).test(value);
+	} catch {
+		return false;
+	}
+}
+function atomsOverlap(left, right) {
+	return regexAtomsMayOverlap(left, right, true);
+}
+function groupCanMatchEmpty(group) {
+	if (/^\?(?:[=!]|<[=!])/.test(group)) return true;
+	return patternMatches(group.startsWith("?:") ? group.slice(2) : group, "");
+}
+function hasOverlappingSequentialRepetition(pattern) {
+	const repeatedAtDepth = [[]];
+	const groupStarts = [];
+	let depth = 0;
+	for (let index = 0; index < pattern.length; index++) {
+		const character = pattern[index];
+		if (character === "(") {
+			groupStarts.push(index);
+			depth++;
+			repeatedAtDepth[depth] = [];
+			if (pattern[index + 1] === "?") {
+				index++;
+				if (pattern[index + 1] === "<" && /[=!]/.test(pattern[index + 2] ?? "")) index += 2;
+				else if (/[=:!]/.test(pattern[index + 1] ?? "")) index++;
+			}
+			continue;
+		}
+		if (character === ")") {
+			const groupStart = groupStarts.pop();
+			repeatedAtDepth[depth] = [];
+			depth = Math.max(0, depth - 1);
+			if (groupStart !== void 0) {
+				const modifier = pattern[index + 1];
+				if (!(modifier === "*" || modifier === "?" || modifier === "{" && /^\{0(?:,\d*)?\}/.test(pattern.slice(index + 1))) && !groupCanMatchEmpty(pattern.slice(groupStart + 1, index))) repeatedAtDepth[depth] = [];
+			}
+			continue;
+		}
+		if (character === "|") {
+			repeatedAtDepth[depth] = [];
+			continue;
+		}
+		if (character === "^" || character === "$") continue;
+		if (character === "*" || character === "+" || character === "?" || character === "{") continue;
+		let atom = character;
+		if (character === "\\") {
+			if (index + 1 >= pattern.length) return true;
+			atom += pattern[++index];
+		} else if (character === "[") {
+			let classEnd = index + 1;
+			if (pattern[classEnd] === "^") classEnd++;
+			while (classEnd < pattern.length && pattern[classEnd] !== "]") {
+				if (pattern[classEnd] === "\\") classEnd++;
+				classEnd++;
+			}
+			if (classEnd >= pattern.length) return true;
+			atom = pattern.slice(index, classEnd + 1);
+			index = classEnd;
+		} else if (character === ".") atom = ".";
+		const quantifierStart = index + 1;
+		const quantifier = pattern[quantifierStart];
+		let unbounded = quantifier === "*" || quantifier === "+";
+		let canBeEmpty = quantifier === "*";
+		let quantifierEnd = quantifierStart;
+		if (quantifier === "{") {
+			const match = /^\{(\d+),\}/.exec(pattern.slice(quantifierStart));
+			if (match) {
+				unbounded = true;
+				canBeEmpty = Number(match[1]) === 0;
+				quantifierEnd += match[0].length - 1;
+			}
+		}
+		if (!unbounded) {
+			if (quantifier !== "?") repeatedAtDepth[depth] = [];
+			if (quantifier === "?") index = quantifierStart;
+			continue;
+		}
+		if (repeatedAtDepth[depth].some((previous) => atomsOverlap(previous, atom))) return true;
+		repeatedAtDepth[depth] = canBeEmpty ? [...repeatedAtDepth[depth], atom] : [atom];
+		index = quantifierEnd;
+	}
+	return false;
+}
+function unsafeTokenReason(token) {
+	const regexSafetyIssue = analyzeRegexSafety(token.pattern, { ignoreCase: true });
+	if (regexSafetyIssue) {
+		if (regexSafetyIssue === "analysis budget exceeded") return `parameter "${token.name}" exceeds the regex analysis budget`;
+		return `parameter "${token.name}" contains ${regexSafetyIssue}`;
+	}
+	if (hasOverlappingSequentialRepetition(token.pattern)) return `parameter "${token.name}" contains overlapping sequential repetition`;
+	if (token.modifier !== "*" && token.modifier !== "+") return null;
+	if (patternMatches(token.pattern, "") || patternMatches(token.pattern, "/")) return `repeated parameter "${token.name}" may match an empty value or path delimiter`;
+	return null;
+}
+function validateTokens(tokens) {
+	for (const token of tokens) {
+		if (typeof token === "string") continue;
+		const reason = unsafeTokenReason(token);
+		if (reason) return reason;
+	}
+	return null;
+}
+function compileMiddlewareMatcherPattern(source) {
+	if (!source.startsWith("/")) return {
+		kind: "invalid",
+		error: "source must start with /"
+	};
+	if (source.length > 4096) return {
+		kind: "invalid",
+		error: "source exceeds max built length of 4096"
+	};
+	let tokens;
+	try {
+		tokens = parseMiddlewarePath(source);
+	} catch (error) {
+		return {
+			kind: "invalid",
+			error: error instanceof Error ? error.message : "matcher could not be parsed"
+		};
+	}
+	const unsafeReason = validateTokens(tokens);
+	if (unsafeReason) return {
+		kind: "unsafe",
+		error: unsafeReason
+	};
+	try {
+		return { regexp: middlewarePathTokensToRegExp(tokens) };
+	} catch {
+		const normalizedTokens = normalizeMiddlewarePathTokens(tokens);
+		const normalizedUnsafeReason = validateTokens(normalizedTokens);
+		if (normalizedUnsafeReason) return {
+			kind: "unsafe",
+			error: normalizedUnsafeReason
+		};
+		try {
+			return { regexp: middlewarePathTokensToRegExp(normalizedTokens) };
+		} catch (error) {
+			return {
+				kind: "invalid",
+				error: error instanceof Error ? error.message : "matcher could not be compiled"
+			};
+		}
+	}
+}
+function validateMiddlewareMatcherPatterns(value) {
+	const sources = [];
+	if (typeof value === "string") sources.push(value);
+	else if (Array.isArray(value)) for (const matcher of value) if (typeof matcher === "string") sources.push(matcher);
+	else {
+		const result = matcherObjectSource(matcher);
+		if (result.error) throw new Error(`Invalid middleware matcher config: ${result.error}.`);
+		sources.push(result.source);
+	}
+	else throw new Error("Invalid middleware matcher config: matcher must be a string or an array of strings or objects.");
+	for (const source of sources) {
+		const result = compileMiddlewareMatcherPattern(source);
+		if (result.regexp) continue;
+		throw new Error(`Invalid middleware matcher "${source}": ${result.error}.`);
+	}
+}
+//#endregion
+export { compileMiddlewareMatcherPattern, isValidMiddlewareMatcherObjectConfig, validateMiddlewareMatcherPatterns };

package/dist/server/middleware-matcher.d.ts

@@ -1,12 +1,7 @@
-import { HasCondition, NextI18nConfig } from "../config/next-config.js";
+import { NextI18nConfig } from "../config/next-config.js";
+import { MiddlewareMatcherObject } from "./middleware-matcher-pattern.js";
 
 //#region src/server/middleware-matcher.d.ts
-type MiddlewareMatcherObject = {
-  source: string;
-  locale?: false;
-  has?: HasCondition[];
-  missing?: HasCondition[];
-};
 type MatcherConfig = string | Array<string | MiddlewareMatcherObject>;
 declare function matchesMiddleware(pathname: string, matcher: MatcherConfig | undefined, request?: Request, i18nConfig?: NextI18nConfig | null): boolean;
 declare function matchPattern(pathname: string, pattern: string): boolean;

package/dist/server/middleware-matcher.js

@@ -1,5 +1,7 @@
 import { removeTrailingSlash } from "../utils/base-path.js";
-import { checkHasConditions, isSafeRegex, requestContextFromRequest, safeRegExp } from "../config/config-matchers.js";
+import { requestContextFromRequest } from "../config/request-context.js";
+import { checkHasConditions } from "../config/config-matchers.js";
+import { compileMiddlewareMatcherPattern, isValidMiddlewareMatcherObjectConfig } from "./middleware-matcher-pattern.js";
 //#region src/server/middleware-matcher.ts
 const EMPTY_MIDDLEWARE_REQUEST_CONTEXT = {
 	headers: new Headers(),
@@ -12,30 +14,20 @@ const _mwPatternCache = /* @__PURE__ */ new Map();
 function matchesMiddleware(pathname, matcher, request, i18nConfig) {
 	if (!matcher) return true;
 	if (typeof matcher === "string") return matchMatcherPattern(pathname, matcher, i18nConfig);
-	if (!Array.isArray(matcher)) return false;
+	if (!Array.isArray(matcher)) return true;
 	const requestContext = request ? requestContextFromRequest(request) : EMPTY_MIDDLEWARE_REQUEST_CONTEXT;
 	for (const m of matcher) {
 		if (typeof m === "string") {
 			if (matchMatcherPattern(pathname, m, i18nConfig)) return true;
 			continue;
 		}
-		if (isValidMiddlewareMatcherObject(m)) {
-			if (!matchObjectMatcher(pathname, m, i18nConfig)) continue;
-			if (!checkHasConditions(m.has, m.missing, requestContext)) continue;
-			return true;
-		}
+		if (!isValidMiddlewareMatcherObjectConfig(m)) return true;
+		if (!matchObjectMatcher(pathname, m, i18nConfig)) continue;
+		if (!checkHasConditions(m.has, m.missing, requestContext)) continue;
+		return true;
 	}
 	return false;
 }
-function isValidMiddlewareMatcherObject(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-	if (!("source" in value) || typeof value.source !== "string") return false;
-	for (const key of Object.keys(value)) if (key !== "source" && key !== "locale" && key !== "has" && key !== "missing") return false;
-	if ("locale" in value && value.locale !== void 0 && value.locale !== false) return false;
-	if ("has" in value && value.has !== void 0 && !Array.isArray(value.has)) return false;
-	if ("missing" in value && value.missing !== void 0 && !Array.isArray(value.missing)) return false;
-	return true;
-}
 function matchMatcherPattern(pathname, pattern, i18nConfig) {
 	if (!i18nConfig) return matchPattern(pathname, pattern);
 	return matchPattern(stripLocalePrefix(pathname, i18nConfig) ?? pathname, pattern);
@@ -58,54 +50,15 @@ function matchPattern(pathname, pattern) {
 		_mwPatternCache.set(normalizedPattern, cached);
 	}
 	if (cached === UNSAFE_MATCHER_PATTERN) return true;
-	if (cached === null) return removeTrailingSlash(pathname) === normalizedPattern;
 	if (cached.test(pathname)) return true;
 	return pathname.endsWith("/") && cached.test(removeTrailingSlash(pathname));
 }
-function extractConstraint(str, re) {
-	if (str[re.lastIndex] !== "(") return null;
-	const start = re.lastIndex + 1;
-	let depth = 1;
-	let i = start;
-	while (i < str.length && depth > 0) {
-		if (str[i] === "(") depth++;
-		else if (str[i] === ")") depth--;
-		i++;
-	}
-	if (depth !== 0) return null;
-	re.lastIndex = i;
-	return str.slice(start, i - 1);
-}
 function compileMatcherPattern(pattern) {
-	const hasConstraints = /:[\w-]+[*+]?\(/.test(pattern);
-	if (!hasConstraints && (pattern.includes("(") || pattern.includes("\\"))) return compileMatcherRegExp("^" + pattern + "$", pattern);
-	let regexStr = "";
-	const tokenRe = /\/:([\w-]+)\*|\/:([\w-]+)\+|:([\w-]+)|[.]|[^/:.]+|./g;
-	let tok;
-	while ((tok = tokenRe.exec(pattern)) !== null) if (tok[1] !== void 0) {
-		const constraint = hasConstraints ? extractConstraint(pattern, tokenRe) : null;
-		regexStr += constraint !== null ? `(?:/(${constraint}))?` : "(?:/.*)?";
-	} else if (tok[2] !== void 0) {
-		const constraint = hasConstraints ? extractConstraint(pattern, tokenRe) : null;
-		regexStr += constraint !== null ? `(?:/(${constraint}))` : "(?:/.+)";
-	} else if (tok[3] !== void 0) {
-		const constraint = hasConstraints ? extractConstraint(pattern, tokenRe) : null;
-		const isOptional = pattern[tokenRe.lastIndex] === "?";
-		if (isOptional) tokenRe.lastIndex += 1;
-		const group = constraint !== null ? `(${constraint})` : "([^/]+)";
-		if (isOptional && regexStr.endsWith("/")) regexStr = regexStr.slice(0, -1) + `(?:/${group})?`;
-		else if (isOptional) regexStr += `${group}?`;
-		else regexStr += group;
-	} else if (tok[0] === ".") regexStr += "\\.";
-	else regexStr += tok[0];
-	return compileMatcherRegExp("^" + regexStr + "$", pattern);
-}
-function compileMatcherRegExp(regexPattern, sourcePattern) {
-	if (!isSafeRegex(regexPattern)) {
-		console.warn(`[vinext] Rejecting potentially unsafe middleware matcher (ReDoS risk): ${sourcePattern}\n  Middleware will run for all paths to avoid bypassing request guards.\n  Simplify the matcher to avoid nested repetition.`);
-		return UNSAFE_MATCHER_PATTERN;
-	}
-	return safeRegExp(regexPattern);
+	const result = compileMiddlewareMatcherPattern(pattern);
+	if (result.regexp) return result.regexp;
+	const problem = result.kind === "unsafe" ? "potentially unsafe" : "invalid";
+	console.warn(`[vinext] Rejecting ${problem} middleware matcher: ${pattern}\n  ${result.error}.\n  Middleware will run for all paths to avoid bypassing request guards.`);
+	return UNSAFE_MATCHER_PATTERN;
 }
 //#endregion
 export { matchPattern, matchesMiddleware };

package/dist/server/middleware-path-to-regexp.d.ts

@@ -0,0 +1,14 @@
+//#region src/server/middleware-path-to-regexp.d.ts
+type MiddlewarePathToken = string | MiddlewarePathKey;
+type MiddlewarePathKey = {
+  name: string | number;
+  prefix: string;
+  suffix: string;
+  pattern: string;
+  modifier: string;
+};
+declare function parseMiddlewarePath(value: string): MiddlewarePathToken[];
+declare function normalizeMiddlewarePathTokens(tokens: MiddlewarePathToken[]): MiddlewarePathToken[];
+declare function middlewarePathTokensToRegExp(tokens: MiddlewarePathToken[]): RegExp;
+//#endregion
+export { MiddlewarePathKey, MiddlewarePathToken, middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath };