[GH-ISSUE #519] scanMetadataFiles should ignore @slot and _private directories #111

New issue

Closed

opened 2026-05-06 12:37:18 +02:00 by BreizhHardware · 0 comments

BreizhHardware commented

2026-05-06 12:37:18 +02:00

Owner

Originally created by @NathanDrake2406 on GitHub (Mar 13, 2026).
Original GitHub issue: https://github.com/cloudflare/vinext/issues/519

Summary

scanMetadataFiles() currently recurses into every directory except route groups, so metadata files under parallel-route slots and private folders become public metadata URLs.

Reproduction

Given an app dir with:

app/
  @slot/icon.png
  _private/icon.png

scanMetadataFiles(appDir) currently returns routes with:

servedUrl: "/@slot/icon"
servedUrl: "/_private/icon"

Expected

@slot directories should not produce public metadata URL segments. They are parallel-route internals, not part of the URL space.
_private directories should be skipped entirely, matching Next.js private-folder behavior.

Why this looks wrong

The app router scanner already excludes @slot and _private directories when discovering routes.
isInvisibleSegment() already treats @slot segments as invisible in URLs.
Next.js private folders opt the folder and its subfolders out of routing: https://nextjs.org/docs/app/getting-started/project-structure#private-folders

Likely fix

Teach scanMetadataFiles() to:

Skip _private directories entirely
Recurse into @slot directories without adding them to urlPrefix
Add coverage in tests/metadata-routes.test.ts for both cases

Originally created by @NathanDrake2406 on GitHub (Mar 13, 2026). Original GitHub issue: https://github.com/cloudflare/vinext/issues/519 ## Summary `scanMetadataFiles()` currently recurses into every directory except route groups, so metadata files under parallel-route slots and private folders become public metadata URLs. ## Reproduction Given an app dir with: ``` app/ @slot/icon.png _private/icon.png ``` `scanMetadataFiles(appDir)` currently returns routes with: - `servedUrl: "/@slot/icon"` - `servedUrl: "/_private/icon"` ## Expected - `@slot` directories should not produce public metadata URL segments. They are parallel-route internals, not part of the URL space. - `_private` directories should be skipped entirely, matching Next.js private-folder behavior. ## Why this looks wrong - The app router scanner already excludes `@slot` and `_private` directories when discovering routes. - `isInvisibleSegment()` already treats `@slot` segments as invisible in URLs. - Next.js private folders opt the folder and its subfolders out of routing: https://nextjs.org/docs/app/getting-started/project-structure#private-folders ## Likely fix Teach `scanMetadataFiles()` to: 1. Skip `_private` directories entirely 2. Recurse into `@slot` directories without adding them to `urlPrefix` 3. Add coverage in `tests/metadata-routes.test.ts` for both cases