vinext 1.0.1 → 1.2.0

package/dist/shims/server.js

@@ -131,7 +131,8 @@ var NextRequest = class extends Request {
 			basePath: _nextConfig.basePath,
 			nextConfig: {
 				i18n,
-				trailingSlash: _nextConfig.trailingSlash
+				trailingSlash: _nextConfig.trailingSlash,
+				skipTrailingSlashRedirect: _nextConfig.skipTrailingSlashRedirect
 			}
 		} : void 0;
 		this._nextUrl = new NextURL(url, void 0, urlConfig);
@@ -266,6 +267,8 @@ var NextURL = class NextURL {
 	*/
 	_configBasePath;
 	_basePath;
+	_configTrailingSlash;
+	_manualTrailingSlash;
 	_trailingSlash;
 	_locale;
 	_configDefaultLocale;
@@ -277,7 +280,10 @@ var NextURL = class NextURL {
 		this._url = new URL(input.toString(), base);
 		this._configBasePath = config?.basePath ?? "";
 		this._basePath = this._configBasePath;
-		this._trailingSlash = config?.nextConfig?.trailingSlash ?? false;
+		this._configTrailingSlash = config?.nextConfig?.trailingSlash ?? false;
+		this._manualTrailingSlash = config?.nextConfig?.skipTrailingSlashRedirect === true;
+		this._trailingSlash = this._configTrailingSlash;
+		this._analyzeTrailingSlash();
 		this._stripBasePath();
 		const i18n = config?.nextConfig?.i18n;
 		if (i18n) {
@@ -290,6 +296,15 @@ var NextURL = class NextURL {
 			this._analyzeI18n();
 		}
 	}
+	/**
+	* With `skipTrailingSlashRedirect`, take the slash from the parsed pathname
+	* (before basePath and locale are stripped), as getNextPathnameInfo does.
+	*/
+	_analyzeTrailingSlash() {
+		if (!this._manualTrailingSlash) return;
+		const { pathname } = this._url;
+		this._trailingSlash = pathname !== "/" ? pathname.endsWith("/") : this._configTrailingSlash;
+	}
 	/** Strip basePath prefix from the internal pathname.
 	* Mirrors Next.js's getNextPathnameInfo (re-run by NextURL.analyze() on
 	* every parse, including `href` reassignment): basePath is only considered
@@ -348,7 +363,8 @@ var NextURL = class NextURL {
 	*/
 	_applyTrailingSlash(pathname) {
 		if (pathname === "" || pathname === "/") return pathname;
-		if ((this._basePath ? stripBasePath(pathname, this._basePath) : pathname).startsWith("/_next/")) return removeTrailingSlash(pathname);
+		const pathnameWithoutBasePath = this._basePath ? stripBasePath(pathname, this._basePath) : pathname;
+		if (!this._manualTrailingSlash && pathnameWithoutBasePath.startsWith("/_next/")) return removeTrailingSlash(pathname);
 		if (this._trailingSlash) return pathname.endsWith("/") ? pathname : pathname + "/";
 		return pathname.endsWith("/") ? pathname.slice(0, -1) : pathname;
 	}
@@ -361,6 +377,7 @@ var NextURL = class NextURL {
 	}
 	set href(value) {
 		this._url.href = value;
+		this._analyzeTrailingSlash();
 		this._stripBasePath();
 		this._analyzeI18n();
 	}
@@ -467,7 +484,10 @@ var NextURL = class NextURL {
 				locales: domain.locales ? [...domain.locales] : void 0
 			}))
 		};
-		if (this._trailingSlash) nextConfig.trailingSlash = true;
+		if (this._manualTrailingSlash) {
+			nextConfig.skipTrailingSlashRedirect = true;
+			if (this._configTrailingSlash) nextConfig.trailingSlash = true;
+		} else if (this._trailingSlash) nextConfig.trailingSlash = true;
 		const config = {
 			basePath: this._configBasePath,
 			nextConfig: Object.keys(nextConfig).length > 0 ? nextConfig : void 0

package/dist/shims/thenable-params.d.ts

@@ -5,5 +5,9 @@ export type ThenableParamsObserver = Readonly<{
   observeParamAccess: (keys: readonly string[]) => void;
   observeReactPromiseStatus?: boolean;
 }>;
+/** Serialize backing values without reading a framework fallback-key proxy. */
+export declare function getFallbackParamsSnapshot(value: unknown): Promise<Record<string, unknown>> | undefined;
+/** Reattach only framework metadata; argument values always come from the decoder. */
+export declare function restoreThenableParams<T extends Record<string, unknown>>(decoded: T, original: unknown): ThenableParams<T>;
 export declare function makeThenableParams<T extends Record<string, unknown>>(obj: T, observer?: ThenableParamsObserver): ThenableParams<T>;
 //#endregion

package/dist/shims/thenable-params.js

@@ -4,6 +4,20 @@ import { isOwnPropertyCheck, isWellKnownProperty } from "./internal/thenable-wel
 function hasParamProperty(obj, prop) {
 	return Object.prototype.hasOwnProperty.call(obj, prop);
 }
+const paramsState = /* @__PURE__ */ new WeakMap();
+function getParamsState(value) {
+	return value !== null && typeof value === "object" ? paramsState.get(value) : void 0;
+}
+/** Serialize backing values without reading a framework fallback-key proxy. */
+function getFallbackParamsSnapshot(value) {
+	const state = getParamsState(value);
+	return state?.fallbackShellState ? Promise.resolve(state.plain) : void 0;
+}
+/** Reattach only framework metadata; argument values always come from the decoder. */
+function restoreThenableParams(decoded, original) {
+	const state = getParamsState(original);
+	return createThenableParams(decoded, state?.observer, state?.fallbackShellState ?? null);
+}
 function observeParamKeys(observer, keys) {
 	if (observer) observer.observeParamAccess(keys);
 }
@@ -81,8 +95,10 @@ function createThenableParamsProxy(promise, handler) {
 	return new Proxy(promise, handler);
 }
 function makeThenableParams(obj, observer) {
+	return createThenableParams(obj, observer, getPprFallbackShellState());
+}
+function createThenableParams(obj, observer, fallbackShellState) {
 	const plain = { ...obj };
-	const fallbackShellState = getPprFallbackShellState();
 	const fallbackParamNames = fallbackShellState && Object.keys(plain).some((key) => fallbackShellState.fallbackParamNames.has(key)) ? fallbackShellState.fallbackParamNames : null;
 	let fallbackShellPromise = null;
 	let fallbackShellPromiseController = null;
@@ -98,7 +114,7 @@ function makeThenableParams(obj, observer) {
 	function isFallbackParam(prop) {
 		return typeof prop === "string" && (fallbackParamNames?.has(prop) ?? false);
 	}
-	return createThenableParamsProxy(promise, {
+	const params = createThenableParamsProxy(promise, {
 		get(target, prop, receiver) {
 			if (isPromiseContinuation(prop)) {
 				const value = Reflect.get(target, prop, receiver);
@@ -150,6 +166,12 @@ function makeThenableParams(obj, observer) {
 			return Reflect.ownKeys(plain).filter((prop) => !isWellKnownProperty(prop));
 		}
 	});
+	paramsState.set(params, {
+		plain,
+		observer,
+		fallbackShellState: fallbackParamNames ? fallbackShellState : null
+	});
+	return params;
 }
 //#endregion
-export { makeThenableParams };
+export { getFallbackParamsSnapshot, makeThenableParams, restoreThenableParams };

package/dist/shims/unified-request-context.d.ts

@@ -1,7 +1,7 @@
 import { ExecutionContextLike } from "./request-context.js";
 import { CacheState } from "./cache-request-state.js";
 import { RootParamsState } from "./root-params.js";
-import { FetchCacheState } from "./fetch-cache.js";
+import { FetchCacheState } from "./fetch-cache-state.js";
 import { VinextHeadersShimState } from "./internal/headers-state.js";
 import { RouterState } from "./router-state.js";
 import { markFullyBufferedBody, preserveFullyBufferedBodyMetadata } from "../server/fully-buffered-response.js";

package/dist/shims/unified-request-context.js

@@ -17,6 +17,7 @@ function createRequestContext(opts) {
 	return {
 		headersContext: null,
 		actionRevalidationKind: 0,
+		cacheLifeSink: null,
 		pendingRevalidatedTags: /* @__PURE__ */ new Set(),
 		pendingRevalidations: /* @__PURE__ */ new Set(),
 		dynamicUsageDetected: false,

package/dist/shims/url-utils.d.ts

@@ -30,6 +30,8 @@ export declare function toSameOriginAppPath(url: string, basePath: string): stri
  *   `.well-known`-aware redirect rule shipped in `routes-manifest.json`.
  * - Query strings and hash fragments are preserved verbatim.
  * - Idempotent: already-canonical paths round-trip unchanged.
+ * - With `skipTrailingSlashRedirect`, every path is returned as written, like
+ *   Next.js's `__NEXT_MANUAL_TRAILING_SLASH` short-circuit.
  */
 export declare function normalizePathTrailingSlash(path: string, trailingSlash: boolean): string;
 /**

package/dist/shims/url-utils.js

@@ -99,9 +99,11 @@ function removeRouteTrailingSlash(route) {
 *   `.well-known`-aware redirect rule shipped in `routes-manifest.json`.
 * - Query strings and hash fragments are preserved verbatim.
 * - Idempotent: already-canonical paths round-trip unchanged.
+* - With `skipTrailingSlashRedirect`, every path is returned as written, like
+*   Next.js's `__NEXT_MANUAL_TRAILING_SLASH` short-circuit.
 */
 function normalizePathTrailingSlash(path, trailingSlash) {
-	if (!path.startsWith("/") || path.startsWith("//")) return path;
+	if (!path.startsWith("/") || path.startsWith("//") || process.env.__VINEXT_MANUAL_TRAILING_SLASH === "true") return path;
 	const { pathname, query, hash } = parsePath(path);
 	if (trailingSlash) {
 		if (/\.[^/]+\/?$/.test(pathname)) return `${removeRouteTrailingSlash(pathname)}${query}${hash}`;

package/dist/utils/client-runtime-metadata.js

@@ -1,8 +1,8 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { isAbsoluteAssetPrefix, resolveAssetsDir } from "./asset-prefix.js";
 import { manifestFileWithAssetPrefix, manifestFileWithBase } from "./manifest-paths.js";
-import { findClientEntryFile, findPagesClientEntryFile, readClientBuildManifest } from "./client-build-manifest.js";
 import { findClientEntryFileFromVinextManifest, findPagesClientEntryFileFromVinextManifest, readClientEntryManifest } from "./client-entry-manifest.js";
+import { findClientEntryFile, findPagesClientEntryFile, readClientBuildManifest } from "./client-build-manifest.js";
 import { computeDynamicImportPreloads, computeLazyChunks, dynamicImportPreloadsWithBase } from "./lazy-chunks.js";
 //#region src/utils/client-runtime-metadata.ts
 function collectCssGraph(buildManifest, applyBase) {

package/dist/utils/hash.d.ts

@@ -20,4 +20,11 @@ export declare function fnv1a64(input: string): string;
  * key format and produces different values. Do not swap one for the other.
  */
 export declare function fnv1a52(str: string): number;
+/**
+ * Hex-encoded SHA-256 digest of a string's UTF-8 bytes, via Web Crypto so it
+ * runs unchanged in Node.js, Workers and browsers. Used for cache keys built
+ * from inputs a request can influence, where crafted inputs could collide
+ * under a non-cryptographic hash like `fnv1a64`.
+ */
+export declare function sha256Hex(input: string): Promise<string>;
 //#endregion

package/dist/utils/hash.js

@@ -51,5 +51,15 @@ function fnv1a52(str) {
 	}
 	return (v3 & 15) * 281474976710656 + v2 * 4294967296 + v1 * 65536 + (v0 ^ v3 >> 4);
 }
+/**
+* Hex-encoded SHA-256 digest of a string's UTF-8 bytes, via Web Crypto so it
+* runs unchanged in Node.js, Workers and browsers. Used for cache keys built
+* from inputs a request can influence, where crafted inputs could collide
+* under a non-cryptographic hash like `fnv1a64`.
+*/
+async function sha256Hex(input) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+	return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
+}
 //#endregion
-export { fnv1a52, fnv1a64 };
+export { fnv1a52, fnv1a64, sha256Hex };

package/dist/utils/mdx-scan.d.ts

@@ -5,6 +5,11 @@ export declare const mdxScanCache: Map<string, boolean>;
  * Check if the project has .mdx files in app/ or pages/ directories.
  */
 export declare function hasMdxFiles(root: string, appDir: string | null, pagesDir: string | null): boolean;
+/**
+ * Whether page extensions discover MDX sources, including compound extensions
+ * such as `page.mdx`.
+ */
+export declare function pageExtensionsIncludeMdx(pageExtensions: readonly string[]): boolean;
 /**
  * Load a reader that keeps only the ESM of an MDX module, so the JavaScript
  * export helpers can read it. It takes the ESM nodes from the MDX parser that

package/dist/utils/mdx-scan.js

@@ -33,6 +33,13 @@ function scanDirForMdx(dir) {
 	return false;
 }
 /**
+* Whether page extensions discover MDX sources, including compound extensions
+* such as `page.mdx`.
+*/
+function pageExtensionsIncludeMdx(pageExtensions) {
+	return pageExtensions.some((extension) => extension.toLowerCase().split(".").at(-1) === "mdx");
+}
+/**
 * Load a reader that keeps only the ESM of an MDX module, so the JavaScript
 * export helpers can read it. It takes the ESM nodes from the MDX parser that
 * `@mdx-js/rollup` compiles with, resolved beside the plugin vinext
@@ -57,4 +64,4 @@ async function loadMdxEsmReader(root) {
 	return (source) => processor.parse(source).children.flatMap((node) => node.type === "mdxjsEsm" && typeof node.value === "string" ? [node.value] : []).join("\n\n");
 }
 //#endregion
-export { hasMdxFiles, loadMdxEsmReader, mdxScanCache };
+export { hasMdxFiles, loadMdxEsmReader, mdxScanCache, pageExtensionsIncludeMdx };

package/dist/utils/package-name.d.ts

@@ -7,4 +7,10 @@ export declare const BARE_PACKAGE_SPECIFIER_RE: RegExp;
  * scoped names, and Node builtins are not npm package references.
  */
 export declare function packageNameFromSpecifier(specifier: string): string | null;
+/**
+ * Turbopack's "foreign code" condition: a module under node_modules whose
+ * package is not in the (Turbopack) transpile list. Next.js skips its
+ * app-code transforms, such as next/dynamic, for foreign code.
+ */
+export declare function isForeignNodeModule(id: string, transpiledPackages: readonly string[]): boolean;
 //#endregion

package/dist/utils/package-name.js

@@ -1,3 +1,4 @@
+import { toSlash } from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import { builtinModules } from "node:module";
 //#region src/utils/package-name.ts
 const BUILTIN_MODULES = new Set(builtinModules.flatMap((name) => name.startsWith("node:") ? [name, name.slice(5)] : [name, `node:${name}`]));
@@ -14,5 +15,15 @@ function packageNameFromSpecifier(specifier) {
 	if (!packageName || BUILTIN_MODULES.has(packageName)) return null;
 	return packageName;
 }
+/**
+* Turbopack's "foreign code" condition: a module under node_modules whose
+* package is not in the (Turbopack) transpile list. Next.js skips its
+* app-code transforms, such as next/dynamic, for foreign code.
+*/
+function isForeignNodeModule(id, transpiledPackages) {
+	const normalizedId = toSlash(id);
+	if (!normalizedId.includes("/node_modules/")) return false;
+	return !transpiledPackages.some((packageName) => normalizedId.includes(`/node_modules/${packageName}/`));
+}
 //#endregion
-export { BARE_PACKAGE_SPECIFIER_RE, packageNameFromSpecifier };
+export { BARE_PACKAGE_SPECIFIER_RE, isForeignNodeModule, packageNameFromSpecifier };

package/dist/utils/plugin-rsc-version.d.ts

@@ -0,0 +1,4 @@
+//#region src/utils/plugin-rsc-version.d.ts
+/** Return the installed @vitejs/plugin-rsc version, or throw if it is unsupported. */
+export declare function assertPluginRscVersion(resolvedRscPath: string): string;
+//#endregion

package/dist/utils/plugin-rsc-version.js

@@ -0,0 +1,15 @@
+import { findPackageVersion, isVersionBelow } from "./react-version.js";
+//#region src/utils/plugin-rsc-version.ts
+const MINIMUM_PLUGIN_RSC_VERSION = [
+	0,
+	5,
+	37
+];
+/** Return the installed @vitejs/plugin-rsc version, or throw if it is unsupported. */
+function assertPluginRscVersion(resolvedRscPath) {
+	const version = findPackageVersion(resolvedRscPath, "@vitejs/plugin-rsc");
+	if (!version || isVersionBelow(version, MINIMUM_PLUGIN_RSC_VERSION)) throw new Error(`vinext: App Router requires @vitejs/plugin-rsc ${MINIMUM_PLUGIN_RSC_VERSION.join(".")} or newer (found ${version ?? "an unknown version"}). Upgrade @vitejs/plugin-rsc.`);
+	return version;
+}
+//#endregion
+export { assertPluginRscVersion };

package/dist/utils/prerender-output-paths.js

@@ -1,11 +1,22 @@
 //#region src/utils/prerender-output-paths.ts
 /**
+* Map a prerendered URL to the file path its artifacts are written under, as
+* Next.js's `normalizePagePath` does. `/index` becomes `/index/index` (and
+* `/index/foo` becomes `/index/index/foo`) so it never shares `/`'s files.
+* Unlike Next.js, dynamic fallback-shell paths such as `/index/[slug]` are
+* also prefixed; build and seed both use this mapping, so they stay in step.
+* Source: https://github.com/vercel/next.js/blob/canary/packages/next/src/shared/lib/page-path/normalize-page-path.ts
+*/
+function toOutputUrlPath(urlPath) {
+	return /^\/index(?:\/|$)/.test(urlPath) ? `/index${urlPath}` : urlPath;
+}
+/**
 * Determine the HTML output file path for a prerendered URL.
 * Respects trailingSlash config.
 */
 function getOutputPath(urlPath, trailingSlash, basePath = "") {
 	if (urlPath === "/" && basePath === "") return "index.html";
-	const clean = (basePath === "" ? urlPath : urlPath === "/" ? trailingSlash ? `${basePath}/` : basePath : `${basePath}${urlPath}`).replace(/^\//, "").replace(/\/$/, "");
+	const clean = (basePath === "" ? toOutputUrlPath(urlPath) : urlPath === "/" ? trailingSlash ? `${basePath}/` : basePath : `${basePath}${toOutputUrlPath(urlPath)}`).replace(/^\//, "").replace(/\/$/, "");
 	if (trailingSlash) return `${clean}/index.html`;
 	return `${clean}.html`;
 }
@@ -19,16 +30,16 @@ function getRscOutputPath(urlPath, options = {
 			const cleanBasePath = options.basePath?.replace(/^\//, "");
 			return cleanBasePath ? `${cleanBasePath}/index.txt` : "index.txt";
 		}
-		const clean = (options.basePath ? `${options.basePath}${urlPath}` : urlPath).replace(/^\//, "").replace(/\/$/, "");
+		const clean = `${options.basePath ?? ""}${toOutputUrlPath(urlPath)}`.replace(/^\//, "").replace(/\/$/, "");
 		return options.trailingSlash ? `${clean}/index.txt` : `${clean}.txt`;
 	}
 	if (urlPath === "/") return "index.rsc";
-	return urlPath.replace(/^\//, "") + ".rsc";
+	return toOutputUrlPath(urlPath).replace(/^\//, "") + ".rsc";
 }
 /** Determine the binary artifact path for a prerendered App Route response. */
 function getAppRouteOutputPath(urlPath) {
 	if (urlPath === "/") return "index.route";
-	return urlPath.replace(/^\//, "") + ".route";
+	return toOutputUrlPath(urlPath).replace(/^\//, "") + ".route";
 }
 //#endregion
 export { getAppRouteOutputPath, getOutputPath, getRscOutputPath };

package/dist/utils/public-file-path.d.ts

@@ -1,4 +1,12 @@
 //#region src/utils/public-file-path.d.ts
-/** Precompute keys for both encoded requests and decoded proxy/dev variants. */
-export declare function publicFilePathVariants(pathname: string): string[];
+/**
+ * Key a public file by the normalized pathname a request for it matches with.
+ *
+ * Request pathnames are decoded once per segment with path delimiters kept
+ * encoded, so `public/a b.txt` is `/a b.txt` and `public/C#.txt` is
+ * `/C%23.txt`. Keying only this form keeps a double-encoded alias such as
+ * `/a%2520b.txt`, which middleware matchers see as `/a%20b.txt`, from
+ * reaching `public/a b.txt`.
+ */
+export declare function publicFileRouteKey(pathname: string): string;
 //#endregion

package/dist/utils/public-file-path.js

@@ -1,12 +1,16 @@
+import { normalizePathnameForRouteMatch } from "../routing/utils.js";
 //#region src/utils/public-file-path.ts
-/** Encode each pathname segment without encoding `/` separators. */
-function encodePublicFilePath(pathname) {
-	return pathname.split("/").map((segment) => encodeURIComponent(segment)).join("/");
-}
-/** Precompute keys for both encoded requests and decoded proxy/dev variants. */
-function publicFilePathVariants(pathname) {
-	const encoded = encodePublicFilePath(pathname);
-	return encoded === pathname ? [pathname] : [pathname, encoded];
+/**
+* Key a public file by the normalized pathname a request for it matches with.
+*
+* Request pathnames are decoded once per segment with path delimiters kept
+* encoded, so `public/a b.txt` is `/a b.txt` and `public/C#.txt` is
+* `/C%23.txt`. Keying only this form keeps a double-encoded alias such as
+* `/a%2520b.txt`, which middleware matchers see as `/a%20b.txt`, from
+* reaching `public/a b.txt`.
+*/
+function publicFileRouteKey(pathname) {
+	return normalizePathnameForRouteMatch(pathname.split("/").map((segment) => encodeURIComponent(segment)).join("/"));
 }
 //#endregion
-export { publicFilePathVariants };
+export { publicFileRouteKey };

package/dist/utils/public-routes.js

@@ -1,5 +1,5 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
-import { publicFilePathVariants } from "./public-file-path.js";
+import { publicFileRouteKey } from "./public-file-path.js";
 import fs from "node:fs";
 //#region src/utils/public-routes.ts
 function scanPublicFileRoutes(root, configuredPublicDir = "public") {
@@ -37,7 +37,7 @@ function scanPublicFileRoutes(root, configuredPublicDir = "public") {
 				if (!stat.isFile()) continue;
 			} else if (!entry.isFile()) continue;
 			const relativePath = path.relative(publicDir, fullPath);
-			routes.push(...publicFilePathVariants("/" + relativePath));
+			routes.push(publicFileRouteKey("/" + relativePath));
 		}
 	}
 	if (fs.existsSync(publicDir)) try {

package/dist/utils/react-version.d.ts

@@ -2,4 +2,7 @@
 export declare function getReactUpgradeDeps(root: string, options?: {
   fromManifest?: boolean;
 }): string[];
+export declare function isVersionBelow(version: string, minimum: [number, number, number]): boolean;
+/** Walk up from a resolved module entry to find its package version. */
+export declare function findPackageVersion(resolvedEntry: string, packageName: string): string | null;
 //#endregion

package/dist/utils/react-version.js

@@ -59,4 +59,4 @@ function findPackageVersion(resolvedEntry, packageName) {
 	return null;
 }
 //#endregion
-export { getReactUpgradeDeps };
+export { findPackageVersion, getReactUpgradeDeps, isVersionBelow };

package/dist/utils/regex-safety.d.ts

@@ -1,7 +1,17 @@
 //#region src/utils/regex-safety.d.ts
 export type RegexSafetyIssue = "nested repetition" | "ambiguous alternatives under repetition" | "ambiguous sequence expansion" | "overlapping sequential repetition" | "analysis budget exceeded";
+/**
+ * Whether a RegExp source declares a named group, which turns `\k<name>` into
+ * a backreference. Escaped characters and character classes cannot open one.
+ */
+export declare function mayHaveNamedGroups(pattern: string): boolean;
+/**
+ * `namedGroups` must describe the whole compiled RegExp when `pattern` is only
+ * a fragment of it. It defaults to scanning `pattern` itself.
+ */
 export declare function analyzeRegexSafety(pattern: string, options?: {
   ignoreCase?: boolean;
+  namedGroups?: boolean;
 }): RegexSafetyIssue | null;
 export declare function regexAtomsMayOverlap(left: string, right: string, ignoreCase?: boolean): boolean;
 //#endregion

package/dist/utils/regex-safety.js

@@ -88,13 +88,15 @@ function simpleClassSymbol(raw, ignoreCase) {
 var RegexParser = class {
 	pattern;
 	ignoreCase;
+	namedGroups;
 	index = 0;
 	nodes = 0;
 	depth = 0;
 	exceededBudget = false;
-	constructor(pattern, ignoreCase) {
+	constructor(pattern, ignoreCase, namedGroups) {
 		this.pattern = pattern;
 		this.ignoreCase = ignoreCase;
+		this.namedGroups = namedGroups;
 	}
 	parse() {
 		return this.parseAlternation();
@@ -157,7 +159,7 @@ var RegexParser = class {
 			kind: "atom",
 			symbol: {
 				kind: "opaque",
-				key: ".",
+				key: "opaque:.",
 				pattern: ".",
 				ignoreCase: this.ignoreCase
 			},
@@ -240,7 +242,7 @@ var RegexParser = class {
 			kind: "atom",
 			symbol: simpleClassSymbol(raw, this.ignoreCase) ?? {
 				kind: "opaque",
-				key: raw,
+				key: `opaque:${raw}`,
 				pattern: raw,
 				ignoreCase: this.ignoreCase
 			},
@@ -267,6 +269,15 @@ var RegexParser = class {
 			symbol: shorthand,
 			fixedWidth: true
 		});
+		if (escaped === "k" && this.namedGroups && this.pattern[this.index] === "<") {
+			const nameEnd = this.pattern.indexOf(">", this.index);
+			this.index = nameEnd === -1 ? this.pattern.length : nameEnd + 1;
+			return this.node({
+				kind: "atom",
+				symbol: null,
+				fixedWidth: false
+			});
+		}
 		if (/\d/.test(escaped)) return this.node({
 			kind: "atom",
 			symbol: null,
@@ -279,6 +290,15 @@ var RegexParser = class {
 		} else if (escaped === "u" && /^[\da-fA-F]{4}/.test(this.pattern.slice(this.index, this.index + 4))) {
 			literal = String.fromCharCode(Number.parseInt(this.pattern.slice(this.index, this.index + 4), 16));
 			this.index += 4;
+		} else if (escaped === "c") {
+			const letter = this.pattern[this.index];
+			if (letter !== void 0 && /[A-Za-z]/.test(letter)) {
+				literal = String.fromCharCode(letter.charCodeAt(0) % 32);
+				this.index++;
+			} else {
+				literal = "\\";
+				this.index--;
+			}
 		} else if ("nrtvf0".includes(escaped)) literal = {
 			n: "\n",
 			r: "\r",
@@ -298,7 +318,7 @@ var RegexParser = class {
 			kind: "atom",
 			symbol: {
 				kind: "opaque",
-				key: raw,
+				key: `opaque:${raw}`,
 				pattern: raw,
 				ignoreCase: this.ignoreCase
 			},
@@ -444,11 +464,12 @@ function fixedWords(node, budget) {
 			return words;
 		}
 		case "repeat": {
-			if (node.min !== node.max || !Number.isFinite(node.max)) return null;
+			if (!Number.isFinite(node.max) || node.min > node.max) return null;
 			let words = [[]];
 			const childWords = fixedWords(node.child, budget);
 			if (!childWords) return null;
-			for (let count = 0; count < node.min; count++) {
+			const repeated = node.min === 0 ? [[]] : [];
+			for (let count = 1; count <= node.max; count++) {
 				const next = [];
 				for (const prefix of words) for (const suffix of childWords) {
 					if (++budget.words > MAX_WORDS) {
@@ -464,8 +485,9 @@ function fixedWords(node, budget) {
 					next.push(word);
 				}
 				words = next;
+				if (count >= node.min) repeated.push(...words);
 			}
-			return words;
+			return repeated;
 		}
 	}
 }
@@ -508,17 +530,27 @@ function symbolsMayOverlap(left, right) {
 	if (left.kind === "literal" && right.kind === "opaque") return opaqueMatchesLiteral(right, left);
 	return true;
 }
+function wordMayCollide(node, word, index, comparisons, branched) {
+	if (node.terminal) return true;
+	if (index === word.length) return node.edges.size > 0;
+	if (branched && ++comparisons.count > MAX_OPAQUE_COMPARISONS) return true;
+	const symbol = word[index];
+	const exact = node.edges.get(symbol.key);
+	if (exact && wordMayCollide(exact.node, word, index + 1, comparisons, branched)) return true;
+	const candidates = symbol.kind === "literal" ? node.complexEdges : node.edges.values();
+	for (const candidate of candidates) {
+		if (candidate === exact) continue;
+		if (++comparisons.count > MAX_OPAQUE_COMPARISONS) return true;
+		if (symbolsMayOverlap(candidate.symbol, symbol) && wordMayCollide(candidate.node, word, index + 1, comparisons, true)) return true;
+	}
+	return false;
+}
 function insertPrefixFreeWord(root, word, comparisons) {
+	if (wordMayCollide(root, word, 0, comparisons, false)) return false;
 	let node = root;
 	for (const symbol of word) {
-		if (node.terminal) return false;
 		let edge = node.edges.get(symbol.key);
 		if (!edge) {
-			const candidates = symbol.kind === "literal" ? node.complexEdges : node.edges.values();
-			for (const candidate of candidates) {
-				if (++comparisons.count > MAX_OPAQUE_COMPARISONS) return false;
-				if (symbolsMayOverlap(candidate.symbol, symbol)) return false;
-			}
 			edge = {
 				symbol,
 				node: createTrieNode()
@@ -528,7 +560,6 @@ function insertPrefixFreeWord(root, word, comparisons) {
 		}
 		node = edge.node;
 	}
-	if (node.terminal || node.edges.size > 0) return false;
 	node.terminal = true;
 	return true;
 }
@@ -578,6 +609,7 @@ function ambiguousExpansionFactor(node) {
 		case "repeat": {
 			if (node.min !== node.max || !Number.isFinite(node.max)) return 1;
 			const childFactor = ambiguousExpansionFactor(node.child);
+			if (childFactor === 1) return 1;
 			let factor = 1;
 			for (let count = 0; count < node.max; count++) {
 				factor *= childFactor;
@@ -705,16 +737,36 @@ function findSafetyIssue(node) {
 		}
 	}
 }
+/**
+* Whether a RegExp source declares a named group, which turns `\k<name>` into
+* a backreference. Escaped characters and character classes cannot open one.
+*/
+function mayHaveNamedGroups(pattern) {
+	let inClass = false;
+	for (let index = 0; index < pattern.length; index++) {
+		const character = pattern[index];
+		if (character === "\\") index++;
+		else if (inClass) {
+			if (character === "]") inClass = false;
+		} else if (character === "[") inClass = true;
+		else if (character === "(" && pattern.startsWith("?<", index + 1) && pattern[index + 3] !== "=" && pattern[index + 3] !== "!") return true;
+	}
+	return false;
+}
+/**
+* `namedGroups` must describe the whole compiled RegExp when `pattern` is only
+* a fragment of it. It defaults to scanning `pattern` itself.
+*/
 function analyzeRegexSafety(pattern, options = {}) {
 	if (pattern.length > MAX_PATTERN_LENGTH) return "analysis budget exceeded";
-	const parser = new RegexParser(pattern, options.ignoreCase === true);
+	const parser = new RegexParser(pattern, options.ignoreCase === true, options.namedGroups ?? mayHaveNamedGroups(pattern));
 	const node = parser.parse();
 	if (parser.exceededBudget) return "analysis budget exceeded";
 	return findSafetyIssue(node);
 }
 function regexAtomsMayOverlap(left, right, ignoreCase = false) {
-	const leftParser = new RegexParser(left, ignoreCase);
-	const rightParser = new RegexParser(right, ignoreCase);
+	const leftParser = new RegexParser(left, ignoreCase, true);
+	const rightParser = new RegexParser(right, ignoreCase, true);
 	const leftNode = leftParser.parse();
 	const rightNode = rightParser.parse();
 	const leftWords = fixedWords(leftNode, {
@@ -734,4 +786,4 @@ function regexAtomsMayOverlap(left, right, ignoreCase = false) {
 	return symbolsMayOverlap(leftSymbol, rightSymbol);
 }
 //#endregion
-export { analyzeRegexSafety, regexAtomsMayOverlap };
+export { analyzeRegexSafety, mayHaveNamedGroups, regexAtomsMayOverlap };