vinext 1.2.1 → 1.3.1

package/dist/server/dev-lockfile.js

@@ -1,5 +1,6 @@
 import path from "../deps/.pnpm/pathslash@0.1.0/deps/pathslash/dist/index.js";
 import fs from "node:fs";
+import os from "node:os";
 //#region src/server/dev-lockfile.ts
 /**
 * Dev server lock file.
@@ -21,6 +22,9 @@ import fs from "node:fs";
 *   (`process.kill(pid, 0)`), which is good enough for the dev-server
 *   "another server is running" use case. Race conditions on lock acquisition
 *   are tolerated: at worst, two dev servers race and one fails to bind a port.
+*   Unlike a `flock()`, the lock file survives a hard restart, so a lock
+*   written before the current boot is treated as stale whatever its PID: the
+*   PID may now belong to an unrelated process. See `predatesCurrentBoot()`.
 * - Lock file lives in `<root>/.vinext/dev/lock.json` (mirroring Next.js'
 *   `.next/dev/lock` layout). `.vinext/` is already used by the fonts plugin
 *   to cache self-hosted Google Fonts, so this re-uses the same project-local
@@ -71,6 +75,46 @@ function isPidAlive(pid) {
 	}
 }
 /**
+* Slack for the boot-time comparison in `predatesCurrentBoot`. `os.uptime()`
+* has whole-second resolution on some platforms (macOS derives it from
+* `kern.boottime`), so the derived boot time is only accurate to about a
+* second.
+*/
+const BOOT_TIME_TOLERANCE_MS = 5e3;
+/**
+* Returns true if a lock with the given `startedAt` was written before the
+* machine last booted.
+*
+* Such a lock was left behind by a session whose exit handler never ran (a
+* crash, a forced restart, power loss). PIDs are handed out again after a
+* boot, so the lock's PID may be held by an unrelated process, and
+* `isPidAlive()` alone would report the dead server as running.
+*
+* The boot time is derived from `Date.now() - os.uptime()`. Stepping the wall
+* clock forward moves it too (`os.uptime()` doesn't change), so a forward
+* step larger than the uptime at which a server started makes its lock look
+* stale, e.g. a VM resuming after the host slept. The second `vinext dev`
+* then takes over, as in the acquisition race tolerated below: Vite moves it
+* to another port, or it fails to bind with `strictPort`.
+*
+* Known limitations, where a lock is still checked by PID alone:
+* - A wall clock that comes back from a reboot behind the previous session
+*   (an RTC running slow, or NTP stepping it back) can leave the lock's
+*   `startedAt` after the derived boot time.
+* - Windows Fast Startup shuts down by hibernating the kernel, so
+*   `os.uptime()` keeps counting across that shutdown.
+* - A container restart doesn't reset the host's uptime.
+*/
+function predatesCurrentBoot(startedAt) {
+	let uptime;
+	try {
+		uptime = os.uptime();
+	} catch {
+		return false;
+	}
+	return startedAt < Date.now() - uptime * 1e3 - BOOT_TIME_TOLERANCE_MS;
+}
+/**
 * Writes the lock file with the given content. Creates the parent directory
 * if it doesn't exist.
 *
@@ -128,7 +172,7 @@ function tryAcquireLockfile(opts) {
 	const lockfilePath = getLockfilePath(root);
 	const existing = readLockfile(lockfilePath);
 	if (existing) {
-		if (isPidAlive(existing.pid)) return {
+		if (!predatesCurrentBoot(existing.startedAt) && isPidAlive(existing.pid)) return {
 			ok: false,
 			existing,
 			lockfilePath
@@ -178,4 +222,4 @@ function tryAcquireLockfile(opts) {
 	};
 }
 //#endregion
-export { formatAlreadyRunningError, getLockfilePath, isPidAlive, readLockfile, tryAcquireLockfile };
+export { formatAlreadyRunningError, getLockfilePath, isPidAlive, predatesCurrentBoot, readLockfile, tryAcquireLockfile };

package/dist/server/dev-module-runner.d.ts

@@ -25,4 +25,5 @@ type DevEnvironmentLike = {
  *   Typically `server.environments["ssr"]`.
  */
 export declare function createDirectRunner(environment: DevEnvironmentLike | DevEnvironment): ModuleRunner;
-//#endregion
+//#endregion
+export {};

package/dist/server/dev-server.js

@@ -41,7 +41,7 @@ import { PAGES_PREVIEW_CACHE_CONTROL, appendPagesPreviewClearCookies, getPagesPr
 import { attachPagesRequestCookies } from "./pages-node-compat.js";
 import { randomUUID } from "node:crypto";
 import React from "react";
-import { renderToReadableStream } from "react-dom/server.edge";
+import { renderToReadableStream } from "react-dom/server";
 //#region src/server/dev-server.ts
 /**
 * Render a React element to a string using renderToReadableStream.
@@ -112,6 +112,7 @@ function writeGsspRedirect(res, redirect, isDataReq, props, options) {
 		...props,
 		pageProps: props.pageProps
 	});
+	if (options.method === "getServerSideProps" && !res.getHeader("Cache-Control")) res.setHeader("Cache-Control", NEVER_CACHE_CONTROL);
 	const gsspHeaders = Object.fromEntries(Object.entries(res.getHeaders()).filter((entry) => entry[1] !== void 0));
 	if (isDangerousScheme(resolved.destination)) {
 		const deploymentId = process.env.__VINEXT_DEPLOYMENT_ID || process.env.NEXT_DEPLOYMENT_ID;
@@ -643,14 +644,17 @@ function createSSRHandler(server, runner, routes, pagesDir, i18nConfig, fileMatc
 							const deploymentId = process.env.__VINEXT_DEPLOYMENT_ID || process.env.NEXT_DEPLOYMENT_ID;
 							stripDevPagesNotFoundFramingHeaders(res);
 							if (!res.hasHeader("Content-Type")) res.setHeader("Content-Type", "application/json");
+							if (!res.getHeader("Cache-Control")) res.setHeader("Cache-Control", NEVER_CACHE_CONTROL);
 							if (deploymentId && !res.hasHeader("x-nextjs-deployment-id")) res.setHeader(NEXTJS_DEPLOYMENT_ID_HEADER, deploymentId);
 							res.writeHead(404);
 							res.end("{\"notFound\":true}");
 							return;
 						}
+						if (!res.getHeader("Cache-Control")) res.setHeader("Cache-Control", NEVER_CACHE_CONTROL);
 						await renderErrorPage(server, runner, req, res, url, pagesDir, 404, routerShim.wrapWithRouterContext, void 0, void 0, reactStrictMode, {
 							...errorPageContext,
-							notFoundSrcPage: patternToNextFormat(route.pattern)
+							notFoundSrcPage: patternToNextFormat(route.pattern),
+							cacheControl: requestPreview.data === false && !requestPreview.shouldClear ? DEV_PAGES_CACHE_CONTROL : PAGES_PREVIEW_CACHE_CONTROL
 						});
 						return;
 					}
@@ -1130,7 +1134,8 @@ async function renderErrorPage(server, runner, req, res, url, pagesDir, statusCo
 				getTailHeadHTML: () => getClientTraceMetadataHTML(context.clientTraceMetadata),
 				setDocumentInitialHead: typeof headShim.setDocumentInitialHead === "function" ? headShim.setDocumentInitialHead : void 0,
 				crossOrigin: context.crossOrigin,
-				preserveExistingContentType: statusCode === 404
+				preserveExistingContentType: statusCode === 404,
+				extraHeaders: context.cacheControl ? { "Cache-Control": context.cacheControl } : void 0
 			});
 			else {
 				const bodyHtml = await tracePagesDocument(errorPage, () => renderToStringAsync(element));
@@ -1155,6 +1160,7 @@ async function renderErrorPage(server, runner, req, res, url, pagesDir, statusCo
 					configuredCrossOrigin: context.crossOrigin,
 					protectedAssetMarker
 				}), protectedAssetMarker);
+				if (context.cacheControl) res.setHeader("Cache-Control", context.cacheControl);
 				res.writeHead(statusCode, statusCode === 404 && res.hasHeader("Content-Type") ? void 0 : { "Content-Type": "text/html; charset=utf-8" });
 				res.end(transformedHtml);
 			}
@@ -1173,6 +1179,7 @@ async function renderErrorPage(server, runner, req, res, url, pagesDir, statusCo
 		defaultResponse.headers.forEach((value, key) => {
 			headers[key] = value;
 		});
+		if (context.cacheControl) headers["cache-control"] = context.cacheControl;
 		res.writeHead(defaultResponse.status, headers);
 		res.end(await defaultResponse.text());
 		return;

package/dist/server/fetch-handler.js

@@ -1,3 +1,2 @@
-import virtual_vinext_worker_entry_default from "virtual:vinext-worker-entry";
+export { default } from "virtual:vinext-worker-entry";
 export * from "virtual:vinext-worker-entry";
-export { virtual_vinext_worker_entry_default as default };

package/dist/server/file-based-metadata.d.ts

@@ -24,4 +24,5 @@ type FileBasedMetadataOptions = {
   basePath?: string;
 };
 export declare function applyFileBasedMetadata(metadata: Metadata | null, routePath: string, params: AppPageParams, metadataRoutes: readonly MetadataFileRoute[] | null | undefined, options?: FileBasedMetadataOptions): Promise<Metadata | null>;
-//#endregion
+//#endregion
+export {};

package/dist/server/framework-tracer.d.ts

@@ -43,4 +43,5 @@ export type FrameworkTracer = {
 };
 export declare function recordFrameworkSpanError(span: FrameworkSpan, error: unknown): void;
 export declare function createFrameworkTracer(integrations: readonly FrameworkTracingIntegration[]): FrameworkTracer;
-//#endregion
+//#endregion
+export {};

package/dist/server/html.d.ts

@@ -1,5 +1,6 @@
 //#region src/server/html.d.ts
 export declare function safeJsonStringify(data: unknown): string;
+export declare function scriptSafeJsonStringify(data: unknown): string;
 export declare function escapeHtmlAttr(value: string): string;
 export declare function htmlTokenListContains(value: string | null, token: string): boolean;
 export declare function createNonceAttribute(nonce?: string): string;

package/dist/server/html.js

@@ -37,6 +37,24 @@ function safeJsonStringify(data) {
 	if (!HTML_UNSAFE_JSON_CHAR_RE.test(json)) return json;
 	return json.replace(HTML_UNSAFE_JSON_CHARS_RE, escapeHtmlUnsafeJsonChar);
 }
+/**
+* Minimal escaping for JSON that is only ever embedded as the content of a
+* classic inline <script> element. The HTML spec only forbids "<!--",
+* "<script" and "<\/script" (ASCII case-insensitive) in script content, so
+* only a '<' that begins one of those is escaped; '>' and '&' have no
+* meaning there.
+* https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements
+*
+* Used for the large RSC payload chunks: leaving markup such as "<p>" intact
+* lets compression match it against the identical SSR markup. Do not use
+* this for values that can land outside a script element.
+*/
+const SCRIPT_UNSAFE_JSON_CHARS_RE = /<(?=!--|\/?script)|[\u2028\u2029]/gi;
+function scriptSafeJsonStringify(data) {
+	const json = JSON.stringify(data);
+	if (json === void 0) throw new TypeError("Cannot serialize value as JSON");
+	return json.replace(SCRIPT_UNSAFE_JSON_CHARS_RE, escapeHtmlUnsafeJsonChar);
+}
 function escapeHtmlAttr(value) {
 	return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -53,4 +71,4 @@ function createInlineScriptTag(content, nonce) {
 	return `<script${createNonceAttribute(nonce)}>${content}<\/script>`;
 }
 //#endregion
-export { createInlineScriptTag, createNonceAttribute, escapeHtmlAttr, htmlTokenListContains, safeJsonStringify };
+export { createInlineScriptTag, createNonceAttribute, escapeHtmlAttr, htmlTokenListContains, safeJsonStringify, scriptSafeJsonStringify };

package/dist/server/http-conditional.d.ts

@@ -29,4 +29,5 @@ type StaticConditionalHeaders = {
 export type StaticPreconditionResult = "proceed" | "not-modified" | "precondition-failed";
 /** Evaluate static representation preconditions in RFC 9110 section 13.2.2 order. */
 export declare function evaluateStaticPreconditions(headers: StaticConditionalHeaders, method: string | undefined, etag: string | undefined, mtimeMs: number): StaticPreconditionResult;
-//#endregion
+//#endregion
+export {};

package/dist/server/http-error-responses.d.ts

@@ -88,4 +88,5 @@ export declare function payloadTooLargeResponse(): Response;
  * to use the canonical "Internal Server Error" body.
  */
 export declare function internalServerErrorResponse(message?: string, init?: ErrorResponseInit): Response;
-//#endregion
+//#endregion
+export {};

package/dist/server/implicit-tags.d.ts

@@ -2,4 +2,5 @@
 type AppCacheLeafKind = "page" | "route";
 export declare function buildAppPageTags(cleanPathname: string, extraTags: string[], routeSegments: readonly string[]): string[];
 export declare function buildPageCacheTags(pathname: string, extraTags: string[], routeSegments: string[], leafKind: AppCacheLeafKind): string[];
-//#endregion
+//#endregion
+export {};

package/dist/server/isolate-shared-promise.d.ts

@@ -0,0 +1,10 @@
+import { ExecutionContextLike } from "../shims/request-context.js";
+//#region src/server/isolate-shared-promise.d.ts
+/**
+ * Register `promise` with the creating request's `waitUntil()` and return it.
+ *
+ * @param ctx - The creating request's execution context. Defaults to the one
+ *   in scope, for callers inside `runWithExecutionContext()`.
+ */
+export declare function shareIsolatePromise<T>(promise: Promise<T>, ctx?: Partial<Pick<ExecutionContextLike, "waitUntil">> | null): Promise<T>;
+//#endregion

package/dist/server/isolate-shared-promise.js

@@ -0,0 +1,33 @@
+import { getRequestExecutionContext } from "../shims/request-context.js";
+//#region src/server/isolate-shared-promise.ts
+/**
+* Keep the request that creates an isolate-shared promise alive until it
+* settles.
+*
+* workerd binds the I/O a promise waits on (timers, fetches, dynamic
+* `import()` under the legacy module registry) to the request that started it.
+* If that request is canceled first, for example because the client navigated
+* away or aborted a prefetch, the continuations are dropped and the promise
+* never settles. A promise memoized for the isolate is awaited by every later
+* request too, so they would all wait forever. `waitUntil()` keeps the creating
+* request's context running after cancellation, so the work finishes for
+* everyone.
+*
+* Call this only where the shared promise is created. Later requests that
+* merely await it need nothing.
+*/
+function ignore() {}
+/**
+* Register `promise` with the creating request's `waitUntil()` and return it.
+*
+* @param ctx - The creating request's execution context. Defaults to the one
+*   in scope, for callers inside `runWithExecutionContext()`.
+*/
+function shareIsolatePromise(promise, ctx) {
+	(typeof ctx?.waitUntil === "function" ? ctx : getRequestExecutionContext())?.waitUntil?.(promise.then(ignore, ignore));
+	return promise;
+}
+const SHARE_ISOLATE_PROMISE_KEY = Symbol.for("vinext.shareIsolatePromise");
+globalThis[SHARE_ISOLATE_PROMISE_KEY] ??= shareIsolatePromise;
+//#endregion
+export { shareIsolatePromise };

package/dist/server/isr-cache.js

@@ -4,6 +4,7 @@ import { getRequestExecutionContext } from "../shims/request-context.js";
 import { isInterceptionMatchedUrlPath } from "./normalize-path.js";
 import { reportRequestError } from "./instrumentation.js";
 import { getCdnCacheAdapter } from "../shims/cdn-cache.js";
+import { shareIsolatePromise } from "./isolate-shared-promise.js";
 import { normalizeMountedSlotsHeader } from "./app-mounted-slots-header.js";
 import { APP_RSC_RENDER_MODE_NAVIGATION, getRscRenderModeCacheVariant } from "./app-rsc-render-mode.js";
 import { getRevalidateSecret, isOnDemandRevalidateRequest, isRevalidateSecret } from "./revalidation-request.js";
@@ -93,9 +94,9 @@ const pendingOnDemandRegenerations = _g[_PENDING_ON_DEMAND_REGEN_KEY] ??= /* @__
 function coalesceOnDemandRevalidation(key, renderFn) {
 	const pending = pendingOnDemandRegenerations.get(key);
 	if (pending) return pending;
-	const promise = Promise.resolve().then(renderFn).finally(() => {
+	const promise = shareIsolatePromise(Promise.resolve().then(renderFn).finally(() => {
 		if (pendingOnDemandRegenerations.get(key) === promise) pendingOnDemandRegenerations.delete(key);
-	});
+	}));
 	pendingOnDemandRegenerations.set(key, promise);
 	return promise;
 }

package/dist/server/metadata-route-build-data.d.ts

@@ -19,4 +19,5 @@ type MetadataRouteEntryData = {
 export declare function createMetadataRouteEntryData(route: MetadataFileRoute): MetadataRouteEntryData;
 export declare function createMetadataRouteEntrySource(input: MetadataRouteEntrySourceInput): string;
 export declare function createMetadataRouteEntriesSource(routes: readonly MetadataFileRoute[], moduleNames: ReadonlyMap<string, string>): string[];
-//#endregion
+//#endregion
+export {};

package/dist/server/metadata-route-build-data.js

@@ -1,6 +1,6 @@
 import { routePatternParts } from "../routing/route-pattern.js";
 import { getMetadataRouteKind } from "./metadata-routes.js";
-import imageSize from "../deps/.pnpm/image-size@2.0.2/deps/image-size/dist/index.js";
+import { imageSize } from "../deps/.pnpm/image-size@2.0.4/deps/image-size/dist/esm/lookup.js";
 import fs from "node:fs";
 import { createHash } from "node:crypto";
 //#region src/server/metadata-route-build-data.ts

package/dist/server/metadata-route-response.d.ts

@@ -37,4 +37,5 @@ export type PrerenderableMetadataRoute = {
 export declare function getPrerenderableMetadataRoutePaths(metadataRoutes: readonly MetadataRuntimeRoute[]): Promise<PrerenderableMetadataRoute[]>;
 export declare function isMetadataRouteRequestPath(metadataRoutes: readonly MetadataRuntimeRoute[], cleanPathname: string): boolean;
 export declare function handleMetadataRouteRequest(options: MetadataRouteRequestOptions): Promise<Response | null>;
-//#endregion
+//#endregion
+export {};

package/dist/server/metadata-route-response.js

@@ -17,8 +17,8 @@ import { ensureFetchPatch, getCollectedFetchTags, setCurrentFetchSoftTags } from
 import { isValidMetadataImageId, manifestToJson, matchMetadataRoutePattern, robotsToText, sitemapToXml } from "./metadata-routes.js";
 import { applyPrerenderCacheLifeHeader, applyPrerenderCacheTagsHeader } from "./prerender-cache-life-header.js";
 import { canonicalizeAppPageParams } from "./app-page-segment-state.js";
-import { buildPageCacheTags } from "./implicit-tags.js";
 import { buildAppRouteCacheValue, buildRouteHandlerCachedResponse } from "./app-route-handler-response.js";
+import { buildPageCacheTags } from "./implicit-tags.js";
 import { createStaticGenerationHeadersContext } from "./app-static-generation.js";
 import { completeAppRouteHandlerResponse } from "./app-route-handler-execution.js";
 //#region src/server/metadata-route-response.ts

package/dist/server/metadata-routes.d.ts

@@ -155,4 +155,5 @@ export declare function invalidateMetadataFileCache(): void;
  * Scan an app directory for metadata files.
  */
 export declare function scanMetadataFiles(appDir: string): MetadataFileRoute[];
-//#endregion
+//#endregion
+export {};

package/dist/server/middleware-matcher-pattern.d.ts

@@ -6,7 +6,6 @@ export type CompiledMiddlewareMatcherPattern = {
 } | {
   regexp?: never;
   error: string;
-  kind: "invalid" | "unsafe";
 };
 export type MiddlewareMatcherObject = {
   source: string;

package/dist/server/middleware-matcher-pattern.js

@@ -1,5 +1,4 @@
-import { analyzeRegexSafety, mayHaveNamedGroups, regexAtomsMayOverlap } from "../utils/regex-safety.js";
-import { middlewarePathTokensToRegExp, normalizeMiddlewarePathTokens, parseMiddlewarePath } from "./middleware-path-to-regexp.js";
+import { normalizePathTokens, parsePathPattern, pathTokensToRegExpSource } from "../utils/path-to-regexp.js";
 //#region src/server/middleware-matcher-pattern.ts
 const MATCHER_OBJECT_KEYS = /* @__PURE__ */ new Set([
 	"source",
@@ -52,154 +51,26 @@ function matcherObjectSource(value) {
 function isValidMiddlewareMatcherObjectConfig(value) {
 	return matcherObjectSource(value).error === void 0;
 }
-function patternMatches(pattern, value) {
-	try {
-		return new RegExp(`^(?:${pattern})$`).test(value);
-	} catch {
-		return false;
-	}
-}
-function atomsOverlap(left, right) {
-	return regexAtomsMayOverlap(left, right, true);
-}
-function groupCanMatchEmpty(group) {
-	if (/^\?(?:[=!]|<[=!])/.test(group)) return true;
-	return patternMatches(group.startsWith("?:") ? group.slice(2) : group, "");
-}
-function hasOverlappingSequentialRepetition(pattern) {
-	const repeatedAtDepth = [[]];
-	const groupStarts = [];
-	let depth = 0;
-	for (let index = 0; index < pattern.length; index++) {
-		const character = pattern[index];
-		if (character === "(") {
-			groupStarts.push(index);
-			depth++;
-			repeatedAtDepth[depth] = [];
-			if (pattern[index + 1] === "?") {
-				index++;
-				if (pattern[index + 1] === "<" && /[=!]/.test(pattern[index + 2] ?? "")) index += 2;
-				else if (/[=:!]/.test(pattern[index + 1] ?? "")) index++;
-			}
-			continue;
-		}
-		if (character === ")") {
-			const groupStart = groupStarts.pop();
-			repeatedAtDepth[depth] = [];
-			depth = Math.max(0, depth - 1);
-			if (groupStart !== void 0) {
-				const modifier = pattern[index + 1];
-				if (!(modifier === "*" || modifier === "?" || modifier === "{" && /^\{0(?:,\d*)?\}/.test(pattern.slice(index + 1))) && !groupCanMatchEmpty(pattern.slice(groupStart + 1, index))) repeatedAtDepth[depth] = [];
-			}
-			continue;
-		}
-		if (character === "|") {
-			repeatedAtDepth[depth] = [];
-			continue;
-		}
-		if (character === "^" || character === "$") continue;
-		if (character === "*" || character === "+" || character === "?" || character === "{") continue;
-		let atom = character;
-		if (character === "\\") {
-			if (index + 1 >= pattern.length) return true;
-			atom += pattern[++index];
-		} else if (character === "[") {
-			let classEnd = index + 1;
-			if (pattern[classEnd] === "^") classEnd++;
-			while (classEnd < pattern.length && pattern[classEnd] !== "]") {
-				if (pattern[classEnd] === "\\") classEnd++;
-				classEnd++;
-			}
-			if (classEnd >= pattern.length) return true;
-			atom = pattern.slice(index, classEnd + 1);
-			index = classEnd;
-		} else if (character === ".") atom = ".";
-		const quantifierStart = index + 1;
-		const quantifier = pattern[quantifierStart];
-		let unbounded = quantifier === "*" || quantifier === "+";
-		let canBeEmpty = quantifier === "*";
-		let quantifierEnd = quantifierStart;
-		if (quantifier === "{") {
-			const match = /^\{(\d+),\}/.exec(pattern.slice(quantifierStart));
-			if (match) {
-				unbounded = true;
-				canBeEmpty = Number(match[1]) === 0;
-				quantifierEnd += match[0].length - 1;
-			}
-		}
-		if (!unbounded) {
-			if (quantifier !== "?") repeatedAtDepth[depth] = [];
-			if (quantifier === "?") index = quantifierStart;
-			continue;
-		}
-		if (repeatedAtDepth[depth].some((previous) => atomsOverlap(previous, atom))) return true;
-		repeatedAtDepth[depth] = canBeEmpty ? [...repeatedAtDepth[depth], atom] : [atom];
-		index = quantifierEnd;
-	}
-	return false;
-}
-function unsafeTokenReason(token, namedGroups) {
-	const regexSafetyIssue = analyzeRegexSafety(token.pattern, {
-		ignoreCase: true,
-		namedGroups
-	});
-	if (regexSafetyIssue) {
-		if (regexSafetyIssue === "analysis budget exceeded") return `parameter "${token.name}" exceeds the regex analysis budget`;
-		return `parameter "${token.name}" contains ${regexSafetyIssue}`;
-	}
-	if (hasOverlappingSequentialRepetition(token.pattern)) return `parameter "${token.name}" contains overlapping sequential repetition`;
-	if (token.modifier !== "*" && token.modifier !== "+") return null;
-	if (patternMatches(token.pattern, "") || patternMatches(token.pattern, "/")) return `repeated parameter "${token.name}" may match an empty value or path delimiter`;
-	return null;
-}
-function validateTokens(tokens) {
-	const namedGroups = tokens.some((token) => typeof token !== "string" && mayHaveNamedGroups(token.pattern));
-	for (const token of tokens) {
-		if (typeof token === "string") continue;
-		const reason = unsafeTokenReason(token, namedGroups);
-		if (reason) return reason;
-	}
-	return null;
+function middlewareRegExp(tokens) {
+	return new RegExp(`${pathTokensToRegExpSource(tokens)}[\\/#\\?]?$`);
 }
 function compileMiddlewareMatcherPattern(source) {
-	if (!source.startsWith("/")) return {
-		kind: "invalid",
-		error: "source must start with /"
-	};
-	if (source.length > 4096) return {
-		kind: "invalid",
-		error: "source exceeds max built length of 4096"
-	};
+	if (!source.startsWith("/")) return { error: "source must start with /" };
+	if (source.length > 4096) return { error: "source exceeds max built length of 4096" };
 	let tokens;
 	try {
-		tokens = parseMiddlewarePath(source);
+		tokens = parsePathPattern(source);
 	} catch (error) {
-		return {
-			kind: "invalid",
-			error: error instanceof Error ? error.message : "matcher could not be parsed"
-		};
+		return { error: error instanceof Error ? error.message : "matcher could not be parsed" };
 	}
-	const unsafeReason = validateTokens(tokens);
-	if (unsafeReason) return {
-		kind: "unsafe",
-		error: unsafeReason
-	};
 	try {
-		return { regexp: middlewarePathTokensToRegExp(tokens) };
+		return { regexp: middlewareRegExp(tokens) };
 	} catch {
-		const normalizedTokens = normalizeMiddlewarePathTokens(tokens);
-		const normalizedUnsafeReason = validateTokens(normalizedTokens);
-		if (normalizedUnsafeReason) return {
-			kind: "unsafe",
-			error: normalizedUnsafeReason
-		};
+		const normalizedTokens = normalizePathTokens(tokens);
 		try {
-			return { regexp: middlewarePathTokensToRegExp(normalizedTokens) };
+			return { regexp: middlewareRegExp(normalizedTokens) };
 		} catch (error) {
-			return {
-				kind: "invalid",
-				error: error instanceof Error ? error.message : "matcher could not be compiled"
-			};
+			return { error: error instanceof Error ? error.message : "matcher could not be compiled" };
 		}
 	}
 }

package/dist/server/middleware-matcher.js

@@ -8,7 +8,7 @@ const EMPTY_MIDDLEWARE_REQUEST_CONTEXT = {
 	query: new URLSearchParams(),
 	host: ""
 };
-const UNSAFE_MATCHER_PATTERN = Symbol("unsafe matcher pattern");
+const INVALID_MATCHER_PATTERN = Symbol("invalid matcher pattern");
 const _mwPatternCache = /* @__PURE__ */ new Map();
 function matchesMiddleware(pathname, matcher, request, i18nConfig, localeContext) {
 	if (!matcher) return true;
@@ -63,7 +63,7 @@ function matchObjectMatcher(pathname, matcher, i18nConfig, localeContext) {
 	return matchPattern(localeContext?.kind === "defaulted" ? `/${localeContext.defaultLocale}${pathname === "/" ? "" : pathname}` : pathname, matcher.source);
 }
 function matchNextDataPattern(pathname, source, i18nConfig, localized) {
-	if (compiledPattern(source) === UNSAFE_MATCHER_PATTERN) return true;
+	if (compiledPattern(source) === INVALID_MATCHER_PATTERN) return true;
 	return matchPattern(pathname, nextDataMatcherSource(source, i18nConfig, localized));
 }
 /**
@@ -89,7 +89,7 @@ function stripFirstPathSegment(pathname) {
 function matchPattern(pathname, pattern) {
 	if (pattern === "/" && (pathname === "//" || pathname === "/?" || pathname === "/#")) return false;
 	const compiled = compiledPattern(pattern);
-	if (compiled === UNSAFE_MATCHER_PATTERN) return true;
+	if (compiled === INVALID_MATCHER_PATTERN) return true;
 	return compiled.test(pathname);
 }
 function compiledPattern(pattern) {
@@ -103,9 +103,8 @@ function compiledPattern(pattern) {
 function compileMatcherPattern(pattern) {
 	const result = compileMiddlewareMatcherPattern(pattern);
 	if (result.regexp) return result.regexp;
-	const problem = result.kind === "unsafe" ? "potentially unsafe" : "invalid";
-	console.warn(`[vinext] Rejecting ${problem} middleware matcher: ${pattern}\n  ${result.error}.\n  Middleware will run for all paths to avoid bypassing request guards.`);
-	return UNSAFE_MATCHER_PATTERN;
+	console.warn(`[vinext] Rejecting invalid middleware matcher: ${pattern}\n  ${result.error}.\n  Middleware will run for all paths to avoid bypassing request guards.`);
+	return INVALID_MATCHER_PATTERN;
 }
 //#endregion
 export { matchPattern, matchesMiddleware, matchesMiddlewarePathname };

package/dist/server/middleware-response-headers.d.ts

@@ -8,4 +8,35 @@ export declare function mergeVaryHeader(target: Headers, value: string): void;
  * response headers like Cache-Control.
  */
 export declare function mergeMiddlewareResponseHeaders(target: Headers, middlewareHeaders: Headers | null): void;
+export type MiddlewareResponseMergeOptions = {
+  /**
+   * Keep the response's WWW-Authenticate and Proxy-Authenticate after
+   * middleware's, as Next.js does for App route handlers. Pages API handlers
+   * write to the Node response that already holds middleware's headers, so
+   * their callers opt out.
+   */
+  appendResponseChallenges?: boolean;
+};
+/**
+ * Merge middleware response headers onto an already-built response's headers.
+ *
+ * Next.js writes middleware response headers before the handler runs and then
+ * appends the handler response's Set-Cookie, WWW-Authenticate and
+ * Proxy-Authenticate values, so middleware values come first and the
+ * response's own are kept. A handler's cookie for the same name (a logout
+ * deletion or session rotation) is then the one the browser applies last.
+ */
+export declare function mergeMiddlewareResponseHeadersOntoResponse(target: Headers, middlewareHeaders: Headers | null, options?: MiddlewareResponseMergeOptions): void;
+/**
+ * Build the response for an external rewrite from the headers routing staged
+ * before proxying.
+ *
+ * Next.js writes the staged config and middleware headers to its outgoing
+ * response and then proxies, and the proxy sets each upstream header over
+ * them. Its Set-Cookie patch keeps middleware's cookies ahead of the
+ * upstream's, so an upstream cookie replaces a staged config cookie while
+ * middleware's are kept. Without an upstream Set-Cookie the staged cookies
+ * stay as they are.
+ */
+export declare function withExternalRewriteResponseHeaders(upstream: Response, staged: Headers, middlewareCookies: readonly string[]): Response;
 //#endregion