vinext 1.0.0-beta.1 → 1.0.0-beta.2

package/dist/server/dev-server.js

@@ -4,6 +4,7 @@ import { createValidFileMatcher, findFileWithExtensions, findFileWithExts } from
 import { patternToNextFormat } from "../routing/route-validation.js";
 import { matchRoute } from "../routing/pages-router.js";
 import { NEXTJS_DEPLOYMENT_ID_HEADER } from "./headers.js";
+import { isDangerousScheme } from "../shims/url-safety.js";
 import { importModule, reportRequestError } from "./instrumentation.js";
 import { buildCacheStateHeaders } from "./cache-headers.js";
 import { isUnknownRecord } from "../utils/record.js";
@@ -175,6 +176,17 @@ function writeGsspRedirect(res, redirect, isDataReq, props) {
 	const status = redirect.statusCode ?? (redirect.permanent ? 308 : 307);
 	let dest = redirect.destination;
 	if (!dest.startsWith("http://") && !dest.startsWith("https://")) dest = dest.replace(/^[\\/]+/, "/");
+	if (isDangerousScheme(dest)) {
+		const deploymentId = process.env.__VINEXT_DEPLOYMENT_ID || process.env.NEXT_DEPLOYMENT_ID;
+		const headers = {
+			"Cache-Control": "private, no-cache, no-store, max-age=0, must-revalidate",
+			"Content-Type": "text/plain; charset=utf-8"
+		};
+		if (deploymentId) headers[NEXTJS_DEPLOYMENT_ID_HEADER] = deploymentId;
+		res.writeHead(500, headers);
+		res.end("Invalid redirect destination");
+		return;
+	}
 	if (isDataReq) {
 		const deploymentId = process.env.__VINEXT_DEPLOYMENT_ID || process.env.NEXT_DEPLOYMENT_ID;
 		const dataHeaders = { "Content-Type": "application/json" };
@@ -376,9 +388,9 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 		const parsedResolvedUrl = new URL(localeStrippedUrl, "http://vinext.local");
 		const originalRequestSearch = new URL(originalUrl, "http://vinext.local").search;
 		const gsspResolvedUrl = parsedResolvedUrl.pathname + originalRequestSearch;
-		const requestAsPath = isDataReq ? gsspResolvedUrl : i18nConfig ? extractLocaleFromUrl$1(originalUrl, i18nConfig, locale).url : originalUrl;
+		let requestAsPath = isDataReq ? gsspResolvedUrl : i18nConfig ? extractLocaleFromUrl$1(originalUrl, i18nConfig, locale).url : originalUrl;
 		const userFacingParams = route.isDynamic ? params : null;
-		const query = mergeRouteParamsIntoQuery(parseQueryString(url), params);
+		let query = mergeRouteParamsIntoQuery(parseQueryString(url), params);
 		return runWithRequestContext(createRequestContext(), async () => {
 			ensureFetchPatch();
 			try {
@@ -396,6 +408,11 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 					});
 				}
 				const pageModule = await importModule(runner, route.filePath);
+				const isStaticPropsRender = typeof pageModule.getStaticProps === "function" && typeof pageModule.getServerSideProps !== "function";
+				if (isStaticPropsRender) {
+					query = mergeRouteParamsIntoQuery({}, params);
+					requestAsPath = localeStrippedUrl.split("?")[0];
+				}
 				const requestPreview = typeof pageModule.getStaticProps === "function" || typeof pageModule.getServerSideProps === "function" ? getPagesPreviewState(req.headers.cookie, { isOnDemandRevalidate: isOnDemandRevalidateRequest(req.headers[PRERENDER_REVALIDATE_HEADER]) }) : {
 					data: false,
 					shouldClear: false
@@ -414,7 +431,7 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 					}),
 					...requestPreviewData === false ? {} : { isPreview: true }
 				};
-				const navigationIsReady = typeof routerShim.getPagesNavigationIsReadyFromSerializedState === "function" ? routerShim.getPagesNavigationIsReadyFromSerializedState(patternToNextFormat(route.pattern), new URL(url, "http://_").search, pagesNextData) : true;
+				const navigationIsReady = isStaticPropsRender ? false : typeof routerShim.getPagesNavigationIsReadyFromSerializedState === "function" ? routerShim.getPagesNavigationIsReadyFromSerializedState(patternToNextFormat(route.pattern), new URL(url, "http://_").search, pagesNextData) : true;
 				if (typeof routerShim.setSSRContext === "function") routerShim.setSSRContext({
 					pathname: patternToNextFormat(route.pattern),
 					query,
@@ -487,8 +504,8 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 						isFallbackRender = (await isrGet(pagesIsrCacheKey(url.split("?")[0])))?.value.value?.kind !== "PAGES";
 						if (isFallbackRender && typeof routerShim.setSSRContext === "function") routerShim.setSSRContext({
 							pathname: patternToNextFormat(route.pattern),
-							query,
-							asPath: requestAsPath,
+							query: {},
+							asPath: patternToNextFormat(route.pattern),
 							navigationIsReady: false,
 							locale: locale ?? currentDefaultLocale,
 							locales: i18nConfig?.locales,
@@ -520,6 +537,7 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 						pathname: patternToNextFormat(route.pattern),
 						query,
 						asPath: requestAsPath,
+						router: routerShim.default,
 						locale: locale ?? currentDefaultLocale,
 						locales: i18nConfig?.locales,
 						defaultLocale: currentDefaultLocale
@@ -692,11 +710,7 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 											return typeof routerShim.wrapWithRouterContext === "function" ? routerShim.wrapWithRouterContext(appTree) : appTree;
 										},
 										Component: pageModule.default,
-										router: {
-											pathname: patternToNextFormat(route.pattern),
-											query,
-											asPath: requestAsPath
-										},
+										router: routerShim.default,
 										ctx: {
 											req: regenReq,
 											res: regenRes,
@@ -771,7 +785,8 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 												...pagesNextData.__vinext,
 												pageModuleUrl: regenPageUrl,
 												appModuleUrl: regenAppUrl,
-												hasMiddleware
+												hasMiddleware,
+												routeUrl: requestAsPath
 											}
 										};
 										const freshHtml = `<!DOCTYPE html><html><head></head><body><div id="__next">${freshBody}</div>${`<script id="__NEXT_DATA__" type="application/json">${safeJsonStringify({
@@ -966,7 +981,8 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 						...pagesNextData.__vinext,
 						pageModuleUrl,
 						appModuleUrl,
-						hasMiddleware
+						hasMiddleware,
+						routeUrl: requestAsPath
 					}
 				};
 				const hydrationScript = createPagesDevHydrationScript({
@@ -979,7 +995,7 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 				const nextDataScript = `<script id="__NEXT_DATA__" type="application/json"${nonceAttr}>${safeJsonStringify({
 					props: renderProps,
 					page: patternToNextFormat(route.pattern),
-					query: params,
+					query: isFallbackRender ? {} : params,
 					buildId: process.env.__VINEXT_BUILD_ID,
 					isFallback: isFallbackRender,
 					locale: locale ?? currentDefaultLocale,

package/dist/server/isr-cache.d.ts

@@ -1,8 +1,8 @@
 import { OnRequestErrorContext } from "./instrumentation.js";
 import { RenderObservation } from "./cache-proof.js";
+import { AppRscRenderMode } from "./app-rsc-render-mode.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { CacheHandlerValue, CachedAppPageValue, CachedPagesValue, IncrementalCacheValue } from "../shims/cache-handler.js";
-import { AppRscRenderMode } from "./app-rsc-render-mode.js";
 
 //#region src/server/isr-cache.d.ts
 /**

package/dist/server/middleware-matcher-pattern.d.ts

@@ -0,0 +1,22 @@
+import { HasCondition } from "../config/next-config.js";
+
+//#region src/server/middleware-matcher-pattern.d.ts
+type CompiledMiddlewareMatcherPattern = {
+  regexp: RegExp;
+  error?: never;
+} | {
+  regexp?: never;
+  error: string;
+  kind: "invalid" | "unsafe";
+};
+type MiddlewareMatcherObject = {
+  source: string;
+  locale?: false;
+  has?: HasCondition[];
+  missing?: HasCondition[];
+};
+declare function isValidMiddlewareMatcherObjectConfig(value: unknown): value is MiddlewareMatcherObject;
+declare function compileMiddlewareMatcherPattern(source: string): CompiledMiddlewareMatcherPattern;
+declare function validateMiddlewareMatcherPatterns(value: unknown): void;
+//#endregion
+export { CompiledMiddlewareMatcherPattern, MiddlewareMatcherObject, compileMiddlewareMatcherPattern, isValidMiddlewareMatcherObjectConfig, validateMiddlewareMatcherPatterns };

package/dist/server/middleware-matcher-pattern.js

@@ -0,0 +1,219 @@
+import { analyzeRegexSafety, regexAtomsMayOverlap } from "../utils/regex-safety.js";
+import { middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath } from "./middleware-path-to-regexp.js";
+//#region src/server/middleware-matcher-pattern.ts
+const MATCHER_OBJECT_KEYS = /* @__PURE__ */ new Set([
+	"source",
+	"locale",
+	"has",
+	"missing"
+]);
+const CONDITION_TYPES_WITH_KEY = /* @__PURE__ */ new Set([
+	"header",
+	"query",
+	"cookie"
+]);
+function invalidConditionReason(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return "has and missing entries must be objects";
+	const condition = value;
+	const type = condition.type;
+	if (typeof type === "string" && CONDITION_TYPES_WITH_KEY.has(type)) {
+		for (const key of Object.keys(condition)) if (key !== "type" && key !== "key" && key !== "value") return `condition contains unsupported field "${key}"`;
+		if (typeof condition.key !== "string") return `condition type "${type}" requires a string key`;
+		if (condition.value !== void 0 && typeof condition.value !== "string") return `condition type "${type}" requires value to be a string`;
+		return null;
+	}
+	if (type === "host") {
+		for (const key of Object.keys(condition)) if (key !== "type" && key !== "value") return `host condition contains unsupported field "${key}"`;
+		return typeof condition.value === "string" ? null : "host condition requires a string value";
+	}
+	return "condition type must be header, query, cookie, or host";
+}
+function invalidConditionsReason(value, field) {
+	if (value === void 0) return null;
+	if (!Array.isArray(value)) return `${field} must be an array`;
+	for (const condition of value) {
+		const reason = invalidConditionReason(condition);
+		if (reason) return `${field} ${reason}`;
+	}
+	return null;
+}
+function matcherObjectSource(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return { error: "matcher entries must be strings or objects" };
+	const matcher = value;
+	for (const key of Object.keys(matcher)) if (!MATCHER_OBJECT_KEYS.has(key)) return { error: `matcher object contains unsupported field "${key}"` };
+	if (typeof matcher.source !== "string") return { error: "matcher object requires a string source" };
+	if (matcher.locale !== void 0 && matcher.locale !== false) return { error: "matcher object locale must be false when provided" };
+	const invalidHas = invalidConditionsReason(matcher.has, "has");
+	if (invalidHas) return { error: invalidHas };
+	const invalidMissing = invalidConditionsReason(matcher.missing, "missing");
+	if (invalidMissing) return { error: invalidMissing };
+	return { source: matcher.source };
+}
+function isValidMiddlewareMatcherObjectConfig(value) {
+	return matcherObjectSource(value).error === void 0;
+}
+function patternMatches(pattern, value) {
+	try {
+		return new RegExp(`^(?:${pattern})$`).test(value);
+	} catch {
+		return false;
+	}
+}
+function atomsOverlap(left, right) {
+	return regexAtomsMayOverlap(left, right, true);
+}
+function groupCanMatchEmpty(group) {
+	if (/^\?(?:[=!]|<[=!])/.test(group)) return true;
+	return patternMatches(group.startsWith("?:") ? group.slice(2) : group, "");
+}
+function hasOverlappingSequentialRepetition(pattern) {
+	const repeatedAtDepth = [[]];
+	const groupStarts = [];
+	let depth = 0;
+	for (let index = 0; index < pattern.length; index++) {
+		const character = pattern[index];
+		if (character === "(") {
+			groupStarts.push(index);
+			depth++;
+			repeatedAtDepth[depth] = [];
+			if (pattern[index + 1] === "?") {
+				index++;
+				if (pattern[index + 1] === "<" && /[=!]/.test(pattern[index + 2] ?? "")) index += 2;
+				else if (/[=:!]/.test(pattern[index + 1] ?? "")) index++;
+			}
+			continue;
+		}
+		if (character === ")") {
+			const groupStart = groupStarts.pop();
+			repeatedAtDepth[depth] = [];
+			depth = Math.max(0, depth - 1);
+			if (groupStart !== void 0) {
+				const modifier = pattern[index + 1];
+				if (!(modifier === "*" || modifier === "?" || modifier === "{" && /^\{0(?:,\d*)?\}/.test(pattern.slice(index + 1))) && !groupCanMatchEmpty(pattern.slice(groupStart + 1, index))) repeatedAtDepth[depth] = [];
+			}
+			continue;
+		}
+		if (character === "|") {
+			repeatedAtDepth[depth] = [];
+			continue;
+		}
+		if (character === "^" || character === "$") continue;
+		if (character === "*" || character === "+" || character === "?" || character === "{") continue;
+		let atom = character;
+		if (character === "\\") {
+			if (index + 1 >= pattern.length) return true;
+			atom += pattern[++index];
+		} else if (character === "[") {
+			let classEnd = index + 1;
+			if (pattern[classEnd] === "^") classEnd++;
+			while (classEnd < pattern.length && pattern[classEnd] !== "]") {
+				if (pattern[classEnd] === "\\") classEnd++;
+				classEnd++;
+			}
+			if (classEnd >= pattern.length) return true;
+			atom = pattern.slice(index, classEnd + 1);
+			index = classEnd;
+		} else if (character === ".") atom = ".";
+		const quantifierStart = index + 1;
+		const quantifier = pattern[quantifierStart];
+		let unbounded = quantifier === "*" || quantifier === "+";
+		let canBeEmpty = quantifier === "*";
+		let quantifierEnd = quantifierStart;
+		if (quantifier === "{") {
+			const match = /^\{(\d+),\}/.exec(pattern.slice(quantifierStart));
+			if (match) {
+				unbounded = true;
+				canBeEmpty = Number(match[1]) === 0;
+				quantifierEnd += match[0].length - 1;
+			}
+		}
+		if (!unbounded) {
+			if (quantifier !== "?") repeatedAtDepth[depth] = [];
+			if (quantifier === "?") index = quantifierStart;
+			continue;
+		}
+		if (repeatedAtDepth[depth].some((previous) => atomsOverlap(previous, atom))) return true;
+		repeatedAtDepth[depth] = canBeEmpty ? [...repeatedAtDepth[depth], atom] : [atom];
+		index = quantifierEnd;
+	}
+	return false;
+}
+function unsafeTokenReason(token) {
+	const regexSafetyIssue = analyzeRegexSafety(token.pattern, { ignoreCase: true });
+	if (regexSafetyIssue) {
+		if (regexSafetyIssue === "analysis budget exceeded") return `parameter "${token.name}" exceeds the regex analysis budget`;
+		return `parameter "${token.name}" contains ${regexSafetyIssue}`;
+	}
+	if (hasOverlappingSequentialRepetition(token.pattern)) return `parameter "${token.name}" contains overlapping sequential repetition`;
+	if (token.modifier !== "*" && token.modifier !== "+") return null;
+	if (patternMatches(token.pattern, "") || patternMatches(token.pattern, "/")) return `repeated parameter "${token.name}" may match an empty value or path delimiter`;
+	return null;
+}
+function validateTokens(tokens) {
+	for (const token of tokens) {
+		if (typeof token === "string") continue;
+		const reason = unsafeTokenReason(token);
+		if (reason) return reason;
+	}
+	return null;
+}
+function compileMiddlewareMatcherPattern(source) {
+	if (!source.startsWith("/")) return {
+		kind: "invalid",
+		error: "source must start with /"
+	};
+	if (source.length > 4096) return {
+		kind: "invalid",
+		error: "source exceeds max built length of 4096"
+	};
+	let tokens;
+	try {
+		tokens = parseMiddlewarePath(source);
+	} catch (error) {
+		return {
+			kind: "invalid",
+			error: error instanceof Error ? error.message : "matcher could not be parsed"
+		};
+	}
+	const unsafeReason = validateTokens(tokens);
+	if (unsafeReason) return {
+		kind: "unsafe",
+		error: unsafeReason
+	};
+	try {
+		return { regexp: middlewarePathTokensToRegExp(tokens) };
+	} catch {
+		const normalizedTokens = normalizeMiddlewarePathTokens(tokens);
+		const normalizedUnsafeReason = validateTokens(normalizedTokens);
+		if (normalizedUnsafeReason) return {
+			kind: "unsafe",
+			error: normalizedUnsafeReason
+		};
+		try {
+			return { regexp: middlewarePathTokensToRegExp(normalizedTokens) };
+		} catch (error) {
+			return {
+				kind: "invalid",
+				error: error instanceof Error ? error.message : "matcher could not be compiled"
+			};
+		}
+	}
+}
+function validateMiddlewareMatcherPatterns(value) {
+	const sources = [];
+	if (typeof value === "string") sources.push(value);
+	else if (Array.isArray(value)) for (const matcher of value) if (typeof matcher === "string") sources.push(matcher);
+	else {
+		const result = matcherObjectSource(matcher);
+		if (result.error) throw new Error(`Invalid middleware matcher config: ${result.error}.`);
+		sources.push(result.source);
+	}
+	else throw new Error("Invalid middleware matcher config: matcher must be a string or an array of strings or objects.");
+	for (const source of sources) {
+		const result = compileMiddlewareMatcherPattern(source);
+		if (result.regexp) continue;
+		throw new Error(`Invalid middleware matcher "${source}": ${result.error}.`);
+	}
+}
+//#endregion
+export { compileMiddlewareMatcherPattern, isValidMiddlewareMatcherObjectConfig, validateMiddlewareMatcherPatterns };

package/dist/server/middleware-matcher.d.ts

@@ -1,12 +1,7 @@
-import { HasCondition, NextI18nConfig } from "../config/next-config.js";
+import { NextI18nConfig } from "../config/next-config.js";
+import { MiddlewareMatcherObject } from "./middleware-matcher-pattern.js";
 
 //#region src/server/middleware-matcher.d.ts
-type MiddlewareMatcherObject = {
-  source: string;
-  locale?: false;
-  has?: HasCondition[];
-  missing?: HasCondition[];
-};
 type MatcherConfig = string | Array<string | MiddlewareMatcherObject>;
 declare function matchesMiddleware(pathname: string, matcher: MatcherConfig | undefined, request?: Request, i18nConfig?: NextI18nConfig | null): boolean;
 declare function matchPattern(pathname: string, pattern: string): boolean;

package/dist/server/middleware-matcher.js

@@ -1,5 +1,7 @@
 import { removeTrailingSlash } from "../utils/base-path.js";
-import { checkHasConditions, isSafeRegex, requestContextFromRequest, safeRegExp } from "../config/config-matchers.js";
+import { requestContextFromRequest } from "../config/request-context.js";
+import { checkHasConditions } from "../config/config-matchers.js";
+import { compileMiddlewareMatcherPattern, isValidMiddlewareMatcherObjectConfig } from "./middleware-matcher-pattern.js";
 //#region src/server/middleware-matcher.ts
 const EMPTY_MIDDLEWARE_REQUEST_CONTEXT = {
 	headers: new Headers(),
@@ -12,30 +14,20 @@ const _mwPatternCache = /* @__PURE__ */ new Map();
 function matchesMiddleware(pathname, matcher, request, i18nConfig) {
 	if (!matcher) return true;
 	if (typeof matcher === "string") return matchMatcherPattern(pathname, matcher, i18nConfig);
-	if (!Array.isArray(matcher)) return false;
+	if (!Array.isArray(matcher)) return true;
 	const requestContext = request ? requestContextFromRequest(request) : EMPTY_MIDDLEWARE_REQUEST_CONTEXT;
 	for (const m of matcher) {
 		if (typeof m === "string") {
 			if (matchMatcherPattern(pathname, m, i18nConfig)) return true;
 			continue;
 		}
-		if (isValidMiddlewareMatcherObject(m)) {
-			if (!matchObjectMatcher(pathname, m, i18nConfig)) continue;
-			if (!checkHasConditions(m.has, m.missing, requestContext)) continue;
-			return true;
-		}
+		if (!isValidMiddlewareMatcherObjectConfig(m)) return true;
+		if (!matchObjectMatcher(pathname, m, i18nConfig)) continue;
+		if (!checkHasConditions(m.has, m.missing, requestContext)) continue;
+		return true;
 	}
 	return false;
 }
-function isValidMiddlewareMatcherObject(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-	if (!("source" in value) || typeof value.source !== "string") return false;
-	for (const key of Object.keys(value)) if (key !== "source" && key !== "locale" && key !== "has" && key !== "missing") return false;
-	if ("locale" in value && value.locale !== void 0 && value.locale !== false) return false;
-	if ("has" in value && value.has !== void 0 && !Array.isArray(value.has)) return false;
-	if ("missing" in value && value.missing !== void 0 && !Array.isArray(value.missing)) return false;
-	return true;
-}
 function matchMatcherPattern(pathname, pattern, i18nConfig) {
 	if (!i18nConfig) return matchPattern(pathname, pattern);
 	return matchPattern(stripLocalePrefix(pathname, i18nConfig) ?? pathname, pattern);
@@ -58,54 +50,15 @@ function matchPattern(pathname, pattern) {
 		_mwPatternCache.set(normalizedPattern, cached);
 	}
 	if (cached === UNSAFE_MATCHER_PATTERN) return true;
-	if (cached === null) return removeTrailingSlash(pathname) === normalizedPattern;
 	if (cached.test(pathname)) return true;
 	return pathname.endsWith("/") && cached.test(removeTrailingSlash(pathname));
 }
-function extractConstraint(str, re) {
-	if (str[re.lastIndex] !== "(") return null;
-	const start = re.lastIndex + 1;
-	let depth = 1;
-	let i = start;
-	while (i < str.length && depth > 0) {
-		if (str[i] === "(") depth++;
-		else if (str[i] === ")") depth--;
-		i++;
-	}
-	if (depth !== 0) return null;
-	re.lastIndex = i;
-	return str.slice(start, i - 1);
-}
 function compileMatcherPattern(pattern) {
-	const hasConstraints = /:[\w-]+[*+]?\(/.test(pattern);
-	if (!hasConstraints && (pattern.includes("(") || pattern.includes("\\"))) return compileMatcherRegExp("^" + pattern + "$", pattern);
-	let regexStr = "";
-	const tokenRe = /\/:([\w-]+)\*|\/:([\w-]+)\+|:([\w-]+)|[.]|[^/:.]+|./g;
-	let tok;
-	while ((tok = tokenRe.exec(pattern)) !== null) if (tok[1] !== void 0) {
-		const constraint = hasConstraints ? extractConstraint(pattern, tokenRe) : null;
-		regexStr += constraint !== null ? `(?:/(${constraint}))?` : "(?:/.*)?";
-	} else if (tok[2] !== void 0) {
-		const constraint = hasConstraints ? extractConstraint(pattern, tokenRe) : null;
-		regexStr += constraint !== null ? `(?:/(${constraint}))` : "(?:/.+)";
-	} else if (tok[3] !== void 0) {
-		const constraint = hasConstraints ? extractConstraint(pattern, tokenRe) : null;
-		const isOptional = pattern[tokenRe.lastIndex] === "?";
-		if (isOptional) tokenRe.lastIndex += 1;
-		const group = constraint !== null ? `(${constraint})` : "([^/]+)";
-		if (isOptional && regexStr.endsWith("/")) regexStr = regexStr.slice(0, -1) + `(?:/${group})?`;
-		else if (isOptional) regexStr += `${group}?`;
-		else regexStr += group;
-	} else if (tok[0] === ".") regexStr += "\\.";
-	else regexStr += tok[0];
-	return compileMatcherRegExp("^" + regexStr + "$", pattern);
-}
-function compileMatcherRegExp(regexPattern, sourcePattern) {
-	if (!isSafeRegex(regexPattern)) {
-		console.warn(`[vinext] Rejecting potentially unsafe middleware matcher (ReDoS risk): ${sourcePattern}\n  Middleware will run for all paths to avoid bypassing request guards.\n  Simplify the matcher to avoid nested repetition.`);
-		return UNSAFE_MATCHER_PATTERN;
-	}
-	return safeRegExp(regexPattern);
+	const result = compileMiddlewareMatcherPattern(pattern);
+	if (result.regexp) return result.regexp;
+	const problem = result.kind === "unsafe" ? "potentially unsafe" : "invalid";
+	console.warn(`[vinext] Rejecting ${problem} middleware matcher: ${pattern}\n  ${result.error}.\n  Middleware will run for all paths to avoid bypassing request guards.`);
+	return UNSAFE_MATCHER_PATTERN;
 }
 //#endregion
 export { matchPattern, matchesMiddleware };

package/dist/server/middleware-path-to-regexp.d.ts

@@ -0,0 +1,14 @@
+//#region src/server/middleware-path-to-regexp.d.ts
+type MiddlewarePathToken = string | MiddlewarePathKey;
+type MiddlewarePathKey = {
+  name: string | number;
+  prefix: string;
+  suffix: string;
+  pattern: string;
+  modifier: string;
+};
+declare function parseMiddlewarePath(value: string): MiddlewarePathToken[];
+declare function normalizeMiddlewarePathTokens(tokens: MiddlewarePathToken[]): MiddlewarePathToken[];
+declare function middlewarePathTokensToRegExp(tokens: MiddlewarePathToken[]): RegExp;
+//#endregion
+export { MiddlewarePathKey, MiddlewarePathToken, middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath };