fix(api): handle malformed URI parameters gracefully in router

src/services/api/router.ts

@@ -66,7 +66,12 @@ export class Router {
         const seg = route.segments[i]!;
         const part = parts[i]!;
         if (seg.startsWith(":")) {
-          params[seg.slice(1)] = decodeURIComponent(part);
+          try {
+            params[seg.slice(1)] = decodeURIComponent(part);
+          } catch {
+            ok = false;
+            break;
+          }
         } else if (seg !== part) {
           ok = false;
           break;

tests/api.test.ts

@@ -1155,4 +1155,13 @@ describe("Router param decoding", () => {
     expect(router.match("GET", "/v1/users/123/extra")).toBeNull();
     expect(router.match("POST", "/v1/users/123")).toBeNull();
   });
+
+  it("handles malformed URI parameters gracefully without throwing", () => {
+    const router = new Router();
+    const handler = vi.fn();
+    router.get("/v1/users/:id", handler);
+
+    expect(router.match("GET", "/v1/users/%FF")).toBeNull();
+    expect(router.match("GET", "/v1/users/%c0%af")).toBeNull();
+  });
 });