fix(httpx): wildcard route params keep gin's leading slash on all backends

After the seam migration c.Param("rest") for a *rest route returned "app.js"
on stdlib (ServeMux drops the slash) and "" on chi (capture stored under "*"),
where gin gave "/app.js". The dashboard builds "assets"+c.Param("filepath"),
so its assets 404'd and JS modules were served with an empty MIME type and
blocked by the browser. Normalize the wildcard capture to gin's leading-slash
form (new httpx.WildcardName helper) so c.Param is identical on gin/chi/stdlib.

Author: Manpaul1

CHANGELOG.md

@@ -6,6 +6,23 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.20.4] - 2026-06-19
+
+### Fixed — wildcard route params now match gin's convention on every backend
+
+- **`c.Param("rest")` for a `*rest` route again returns a leading-slash suffix
+  on the stdlib and chi backends.** gin exposes a `*filepath` capture as
+  `/app.js` (leading slash); after the router-seam migration the stdlib backend
+  returned `app.js` (ServeMux's `{rest...}` drops the slash) and the chi backend
+  returned `""` (chi stores the capture under the key `*`, so the original name
+  missed entirely). Handlers that build a path from the capture — notably the
+  dashboard's `"assets" + c.Param("filepath")` — resolved to `assetsapp.js` /
+  `assets`, 404'd, and served assets with an **empty MIME type**, so browsers
+  blocked the dashboard's own JS module (`/__nexus/assets/index-*.js`). The
+  seam now normalizes the wildcard capture to gin's leading-slash form via the
+  new `httpx.WildcardName` helper, so `c.Param` behaves identically on gin,
+  chi, and stdlib. Named (`:id`) params are unaffected.
+
 ## [1.20.3] - 2026-06-19
 
 ### Fixed — `stdrouter` treated `GET /` as a catch-all, swallowing assets

httpx/chirouter/chi.go

@@ -24,8 +24,9 @@ func New() *Router { return &Router{mux: chi.NewRouter()} }
 func (r *Router) Handle(method, path string, chain ...httpx.HandlerFunc) {
 	r.routes = append(r.routes, httpx.RouteInfo{Method: method, Path: path})
 	full := append([]httpx.HandlerFunc{}, chain...)
+	wild := httpx.WildcardName(path)
 	r.mux.Method(method, toChi(path), http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-		httpx.Serve(full, w, req, path, func(k string) string { return chi.URLParam(req, k) })
+		httpx.Serve(full, w, req, path, paramFn(req, wild))
 	}))
 }
 
@@ -42,11 +43,26 @@ func (r *Router) HEAD(path string, chain ...httpx.HandlerFunc) { r.Handle("HEAD"
 func (r *Router) Any(path string, chain ...httpx.HandlerFunc) {
 	r.routes = append(r.routes, httpx.RouteInfo{Method: "ANY", Path: path})
 	full := append([]httpx.HandlerFunc{}, chain...)
+	wild := httpx.WildcardName(path)
 	r.mux.HandleFunc(toChi(path), func(w http.ResponseWriter, req *http.Request) {
-		httpx.Serve(full, w, req, path, func(k string) string { return chi.URLParam(req, k) })
+		httpx.Serve(full, w, req, path, paramFn(req, wild))
 	})
 }
 
+// paramFn returns a path-param lookup that matches gin's convention. chi rewrites
+// "*rest" to its "*" catch-all and stores the suffix under the key "*" without a
+// leading slash; gin exposes it under the original name WITH a leading slash
+// ("/app.js"). Map the route's wildcard name onto chi's "*" key and re-add the
+// slash so c.Param("rest") behaves identically on every backend.
+func paramFn(req *http.Request, wild string) func(string) string {
+	return func(k string) string {
+		if wild != "" && k == wild {
+			return "/" + chi.URLParam(req, "*")
+		}
+		return chi.URLParam(req, k)
+	}
+}
+
 func (r *Router) Use(mw ...httpx.HandlerFunc) { r.global = append(r.global, mw...) }
 
 func (r *Router) Group(prefix string, mw ...httpx.HandlerFunc) httpx.Group {

httpx/chirouter/chi_test.go

@@ -0,0 +1,44 @@
+package chirouter
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/paulmanoni/nexus/httpx"
+)
+
+// chi stores the catch-all under the key "*"; the seam must expose it under the
+// route's wildcard name WITH gin's leading slash, so c.Param("filepath") on
+// /assets/*filepath returns "/index.js" (not "" and not "index.js").
+func TestWildcardParamGinCompatible(t *testing.T) {
+	r := New()
+	var named, suffix string
+	r.Handle("GET", "/assets/*filepath", func(c *httpx.Ctx) {
+		named = c.Param("filepath")
+		suffix = "assets" + named
+		c.String(200, suffix)
+	})
+	req := httptest.NewRequest("GET", "/assets/index-Cv7AL3WY.js", nil)
+	r.ServeHTTP(httptest.NewRecorder(), req)
+	if named != "/index-Cv7AL3WY.js" {
+		t.Fatalf(`c.Param("filepath") = %q, want /index-Cv7AL3WY.js`, named)
+	}
+	if suffix != "assets/index-Cv7AL3WY.js" {
+		t.Fatalf("joined path = %q, want assets/index-Cv7AL3WY.js", suffix)
+	}
+}
+
+// Named (non-wildcard) params still resolve normally.
+func TestNamedParam(t *testing.T) {
+	r := New()
+	var id string
+	r.Handle("GET", "/users/:id", func(c *httpx.Ctx) {
+		id = c.Param("id")
+		c.String(200, id)
+	})
+	req := httptest.NewRequest("GET", "/users/42", nil)
+	r.ServeHTTP(httptest.NewRecorder(), req)
+	if id != "42" {
+		t.Fatalf(`c.Param("id") = %q, want 42`, id)
+	}
+}

httpx/httpx.go

@@ -223,6 +223,21 @@ func (c *Ctx) Param(key string) string {
 	return c.param(key)
 }
 
+// WildcardName returns the name of the trailing wildcard segment in a canonical
+// route path ("/assets/*filepath" -> "filepath"), or "" when the path has no
+// wildcard. Router adapters use it to normalize the wildcard param value to
+// gin's convention — a leading-slash suffix (gin's c.Param("filepath") for
+// /assets/app.js is "/app.js") — on every backend, so handlers that build paths
+// like "assets"+c.Param("filepath") behave identically on gin, chi, and stdlib.
+func WildcardName(path string) string {
+	for _, seg := range strings.Split(path, "/") {
+		if strings.HasPrefix(seg, "*") {
+			return seg[1:]
+		}
+	}
+	return ""
+}
+
 func (c *Ctx) Query(key string) string { return c.Request.URL.Query().Get(key) }
 
 func (c *Ctx) DefaultQuery(key, def string) string {

httpx/stdrouter/std.go

@@ -23,8 +23,9 @@ func New() *Router { return &Router{mux: http.NewServeMux()} }
 func (r *Router) Handle(method, path string, chain ...httpx.HandlerFunc) {
 	r.routes = append(r.routes, httpx.RouteInfo{Method: method, Path: path})
 	full := append([]httpx.HandlerFunc{}, chain...)
+	wild := httpx.WildcardName(path)
 	r.mux.HandleFunc(method+" "+toStd(path), func(w http.ResponseWriter, req *http.Request) {
-		httpx.Serve(full, w, req, path, req.PathValue)
+		httpx.Serve(full, w, req, path, paramFn(req, wild))
 	})
 }
 
@@ -44,11 +45,29 @@ func (r *Router) Any(path string, chain ...httpx.HandlerFunc) {
 	// matching HEAD, so an explicit "GET /x" + "HEAD /x" pair conflicts.
 	r.routes = append(r.routes, httpx.RouteInfo{Method: "ANY", Path: path})
 	full := append([]httpx.HandlerFunc{}, chain...)
+	wild := httpx.WildcardName(path)
 	r.mux.HandleFunc(toStd(path), func(w http.ResponseWriter, req *http.Request) {
-		httpx.Serve(full, w, req, path, req.PathValue)
+		httpx.Serve(full, w, req, path, paramFn(req, wild))
 	})
 }
 
+// paramFn returns a path-param lookup that matches gin's convention. ServeMux's
+// "{rest...}" wildcard yields the matched suffix WITHOUT a leading slash
+// ("app.js"); gin's "*rest" includes it ("/app.js"). For the wildcard param we
+// re-add the slash so handlers that do "assets"+c.Param("rest") work the same on
+// every backend. Non-wildcard params pass straight through.
+func paramFn(req *http.Request, wild string) func(string) string {
+	if wild == "" {
+		return req.PathValue
+	}
+	return func(k string) string {
+		if k == wild {
+			return "/" + req.PathValue(k)
+		}
+		return req.PathValue(k)
+	}
+}
+
 func (r *Router) Use(mw ...httpx.HandlerFunc) { r.global = append(r.global, mw...) }
 
 func (r *Router) Group(prefix string, mw ...httpx.HandlerFunc) httpx.Group {

httpx/stdrouter/std_test.go

@@ -46,8 +46,8 @@ func TestTrailingSlashExactVsWildcard(t *testing.T) {
 
 	cases := map[string]string{
 		"/admin/":       "admin-root",
-		"/admin/users":  "miss",       // exact: sub-path is NOT swallowed
-		"/files/a/b.js": "file:a/b.js", // ServeMux {rest...} drops the leading slash
+		"/admin/users":  "miss",        // exact: sub-path is NOT swallowed
+		"/files/a/b.js": "file:/a/b.js", // wildcard param keeps gin's leading slash
 	}
 	for path, want := range cases {
 		req := httptest.NewRequest("GET", path, nil)
@@ -59,6 +59,23 @@ func TestTrailingSlashExactVsWildcard(t *testing.T) {
 	}
 }
 
+// The wildcard param must carry gin's leading slash so the dashboard's
+// `name := "assets" + c.Param("filepath")` resolves to "assets/index.js", not
+// "assetsindex.js" (which 404s and serves the JS with an empty MIME type).
+func TestWildcardParamLeadingSlash(t *testing.T) {
+	r := New()
+	var got string
+	r.Handle("GET", "/assets/*filepath", func(c *httpx.Ctx) {
+		got = "assets" + c.Param("filepath")
+		c.String(200, got)
+	})
+	req := httptest.NewRequest("GET", "/assets/index-Cv7AL3WY.js", nil)
+	r.ServeHTTP(httptest.NewRecorder(), req)
+	if got != "assets/index-Cv7AL3WY.js" {
+		t.Fatalf(`c.Param("filepath") path = %q, want assets/index-Cv7AL3WY.js`, got)
+	}
+}
+
 // Static must coexist with a catch-all "GET /" route. A method-less static
 // registration ("/media/") panics against "GET /" under Go 1.22's ServeMux
 // (more specific path but more methods → ambiguous). Scoping Static to GET