/**
 * Reject requests with malformed URI before they reach Vite.
 * Vite's static middleware calls decodeURI() and throws "URI malformed" on invalid sequences (e.g. %2: or %91).
 */
export default defineEventHandler((event) => {
  const path = event.path ?? event.node.req.url ?? ''
  try {
    decodeURI(path)
  } catch {
    throw createError({ statusCode: 400, statusMessage: 'Bad Request' })
  }
})