@benjavicente/router-core 1.168.9 → 1.169.2

package/dist/esm/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":[],"sources":["../../src/utils.ts"],"sourcesContent":["import { isServer } from '@benjavicente/router-core/isServer'\nimport type { RouteIds } from './routeInfo'\nimport type { AnyRouter } from './router'\n\nexport type Awaitable<T> = T | Promise<T>\nexport type NoInfer<T> = [T][T extends any ? 0 : never]\nexport type IsAny<TValue, TYesResult, TNoResult = TValue> = 1 extends 0 & TValue\n  ? TYesResult\n  : TNoResult\n\nexport type PickAsRequired<TValue, TKey extends keyof TValue> = Omit<\n  TValue,\n  TKey\n> &\n  Required<Pick<TValue, TKey>>\n\nexport type PickRequired<T> = {\n  [K in keyof T as undefined extends T[K] ? never : K]: T[K]\n}\n\nexport type PickOptional<T> = {\n  [K in keyof T as undefined extends T[K] ? K : never]: T[K]\n}\n\n// from https://stackoverflow.com/a/76458160\nexport type WithoutEmpty<T> = T extends any ? ({} extends T ? never : T) : never\n\nexport type Expand<T> = T extends object\n  ? T extends infer O\n    ? O extends Function\n      ? O\n      : { [K in keyof O]: O[K] }\n    : never\n  : T\n\nexport type DeepPartial<T> = T extends object\n  ? {\n      [P in keyof T]?: DeepPartial<T[P]>\n    }\n  : T\n\nexport type MakeDifferenceOptional<TLeft, TRight> = keyof TLeft &\n  keyof TRight extends never\n  ? TRight\n  : Omit<TRight, keyof TLeft & keyof TRight> & {\n      [K in keyof TLeft & keyof TRight]?: TRight[K]\n    }\n\n// from https://stackoverflow.com/a/53955431\n// eslint-disable-next-line @typescript-eslint/naming-convention\nexport type IsUnion<T, U extends T = T> = (\n  T extends any ? (U extends T ? false : true) : never\n) extends false\n  ? false\n  : true\n\nexport type IsNonEmptyObject<T> = T extends object\n  ? keyof T extends never\n    ? false\n    : true\n  : false\n\nexport type Assign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : keyof TLeft & keyof TRight extends never\n          ? TLeft & TRight\n          : Omit<TLeft, keyof TRight> & TRight\n    : never\n  : never\n\nexport type IntersectAssign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : TRight & TLeft\n    : never\n  : never\n\nexport type Timeout = ReturnType<typeof setTimeout>\n\nexport type Updater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev?: TPrevious) => TResult)\n\nexport type NonNullableUpdater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev: TPrevious) => TResult)\n\nexport type ExtractObjects<TUnion> = TUnion extends MergeAllPrimitive\n  ? never\n  : TUnion\n\nexport type PartialMergeAllObject<TUnion> =\n  ExtractObjects<TUnion> extends infer TObj\n    ? [TObj] extends [never]\n      ? never\n      : {\n          [TKey in TObj extends any ? keyof TObj : never]?: TObj extends any\n            ? TKey extends keyof TObj\n              ? TObj[TKey]\n              : never\n            : never\n        }\n    : never\n\nexport type MergeAllPrimitive =\n  | ReadonlyArray<any>\n  | number\n  | string\n  | bigint\n  | boolean\n  | symbol\n  | undefined\n  | null\n\nexport type ExtractPrimitives<TUnion> = TUnion extends MergeAllPrimitive\n  ? TUnion\n  : TUnion extends object\n    ? never\n    : TUnion\n\nexport type PartialMergeAll<TUnion> =\n  | ExtractPrimitives<TUnion>\n  | PartialMergeAllObject<TUnion>\n\nexport type Constrain<T, TConstraint, TDefault = TConstraint> =\n  | (T extends TConstraint ? T : never)\n  | TDefault\n\nexport type ConstrainLiteral<T, TConstraint, TDefault = TConstraint> =\n  | (T & TConstraint)\n  | TDefault\n\n/**\n * To be added to router types\n */\nexport type UnionToIntersection<T> = (\n  T extends any ? (arg: T) => any : never\n) extends (arg: infer T) => any\n  ? T\n  : never\n\n/**\n * Merges everything in a union into one object.\n * This mapped type is homomorphic which means it preserves stuff! :)\n */\nexport type MergeAllObjects<\n  TUnion,\n  TIntersected = UnionToIntersection<ExtractObjects<TUnion>>,\n> = [keyof TIntersected] extends [never]\n  ? never\n  : {\n      [TKey in keyof TIntersected]: TUnion extends any\n        ? TUnion[TKey & keyof TUnion]\n        : never\n    }\n\nexport type MergeAll<TUnion> =\n  | MergeAllObjects<TUnion>\n  | ExtractPrimitives<TUnion>\n\nexport type ValidateJSON<T> = ((...args: Array<any>) => any) extends T\n  ? unknown extends T\n    ? never\n    : 'Function is not serializable'\n  : { [K in keyof T]: ValidateJSON<T[K]> }\n\nexport type LooseReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn\n  : never\n\nexport type LooseAsyncReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn extends Promise<infer TReturn>\n    ? TReturn\n    : TReturn\n  : never\n\n/**\n * Return the last element of an array.\n * Intended for non-empty arrays used within router internals.\n */\nexport function last<T>(arr: ReadonlyArray<T>) {\n  return arr[arr.length - 1]\n}\n\nfunction isFunction(d: any): d is Function {\n  return typeof d === 'function'\n}\n\n/**\n * Apply a value-or-updater to a previous value.\n * Accepts either a literal value or a function of the previous value.\n */\nexport function functionalUpdate<TPrevious, TResult = TPrevious>(\n  updater: Updater<TPrevious, TResult> | NonNullableUpdater<TPrevious, TResult>,\n  previous: TPrevious,\n): TResult {\n  if (isFunction(updater)) {\n    return updater(previous)\n  }\n\n  return updater\n}\n\nconst hasOwn = Object.prototype.hasOwnProperty\nconst isEnumerable = Object.prototype.propertyIsEnumerable\n\nconst createNull = () => Object.create(null)\nexport const nullReplaceEqualDeep: typeof replaceEqualDeep = (prev, next) =>\n  replaceEqualDeep(prev, next, createNull)\n\n/**\n * This function returns `prev` if `_next` is deeply equal.\n * If not, it will replace any deeply equal children of `b` with those of `a`.\n * This can be used for structural sharing between immutable JSON values for example.\n * Do not use this with signals\n */\nexport function replaceEqualDeep<T>(\n  prev: any,\n  _next: T,\n  _makeObj = () => ({}),\n  _depth = 0,\n): T {\n  if (isServer) {\n    return _next\n  }\n  if (prev === _next) {\n    return prev\n  }\n\n  if (_depth > 500) return _next\n\n  const next = _next as any\n\n  const array = isPlainArray(prev) && isPlainArray(next)\n\n  if (!array && !(isPlainObject(prev) && isPlainObject(next))) return next\n\n  const prevItems = array ? prev : getEnumerableOwnKeys(prev)\n  if (!prevItems) return next\n  const nextItems = array ? next : getEnumerableOwnKeys(next)\n  if (!nextItems) return next\n  const prevSize = prevItems.length\n  const nextSize = nextItems.length\n  const copy: any = array ? new Array(nextSize) : _makeObj()\n\n  let equalItems = 0\n\n  for (let i = 0; i < nextSize; i++) {\n    const key = array ? i : (nextItems[i] as any)\n    const p = prev[key]\n    const n = next[key]\n\n    if (p === n) {\n      copy[key] = p\n      if (array ? i < prevSize : hasOwn.call(prev, key)) equalItems++\n      continue\n    }\n\n    if (\n      p === null ||\n      n === null ||\n      typeof p !== 'object' ||\n      typeof n !== 'object'\n    ) {\n      copy[key] = n\n      continue\n    }\n\n    const v = replaceEqualDeep(p, n, _makeObj, _depth + 1)\n    copy[key] = v\n    if (v === p) equalItems++\n  }\n\n  return prevSize === nextSize && equalItems === prevSize ? prev : copy\n}\n\n/**\n * Equivalent to `Reflect.ownKeys`, but ensures that objects are \"clone-friendly\":\n * will return false if object has any non-enumerable properties.\n *\n * Optimized for the common case where objects have no symbol properties.\n */\nfunction getEnumerableOwnKeys(o: object) {\n  const names = Object.getOwnPropertyNames(o)\n\n  // Fast path: check all string property names are enumerable\n  for (const name of names) {\n    if (!isEnumerable.call(o, name)) return false\n  }\n\n  // Only check symbols if the object has any (most plain objects don't)\n  const symbols = Object.getOwnPropertySymbols(o)\n\n  // Fast path: no symbols, return names directly (avoids array allocation/concat)\n  if (symbols.length === 0) return names\n\n  // Slow path: has symbols, need to check and merge\n  const keys: Array<string | symbol> = names\n  for (const symbol of symbols) {\n    if (!isEnumerable.call(o, symbol)) return false\n    keys.push(symbol)\n  }\n  return keys\n}\n\n// Copied from: https://github.com/jonschlinkert/is-plain-object\nexport function isPlainObject(o: any) {\n  if (!hasObjectPrototype(o)) {\n    return false\n  }\n\n  // If has modified constructor\n  const ctor = o.constructor\n  if (typeof ctor === 'undefined') {\n    return true\n  }\n\n  // If has modified prototype\n  const prot = ctor.prototype\n  if (!hasObjectPrototype(prot)) {\n    return false\n  }\n\n  // If constructor does not have an Object-specific method\n  if (!prot.hasOwnProperty('isPrototypeOf')) {\n    return false\n  }\n\n  // Most likely a plain Object\n  return true\n}\n\nfunction hasObjectPrototype(o: any) {\n  return Object.prototype.toString.call(o) === '[object Object]'\n}\n\n/**\n * Check if a value is a \"plain\" array (no extra enumerable keys).\n */\nexport function isPlainArray(value: unknown): value is Array<unknown> {\n  return Array.isArray(value) && value.length === Object.keys(value).length\n}\n\n/**\n * Perform a deep equality check with options for partial comparison and\n * ignoring `undefined` values. Optimized for router state comparisons.\n */\nexport function deepEqual(\n  a: any,\n  b: any,\n  opts?: { partial?: boolean; ignoreUndefined?: boolean },\n): boolean {\n  if (a === b) {\n    return true\n  }\n\n  if (typeof a !== typeof b) {\n    return false\n  }\n\n  if (Array.isArray(a) && Array.isArray(b)) {\n    if (a.length !== b.length) return false\n    for (let i = 0, l = a.length; i < l; i++) {\n      if (!deepEqual(a[i], b[i], opts)) return false\n    }\n    return true\n  }\n\n  if (isPlainObject(a) && isPlainObject(b)) {\n    const ignoreUndefined = opts?.ignoreUndefined ?? true\n\n    if (opts?.partial) {\n      for (const k in b) {\n        if (!ignoreUndefined || b[k] !== undefined) {\n          if (!deepEqual(a[k], b[k], opts)) return false\n        }\n      }\n      return true\n    }\n\n    let aCount = 0\n    if (!ignoreUndefined) {\n      aCount = Object.keys(a).length\n    } else {\n      for (const k in a) {\n        if (a[k] !== undefined) aCount++\n      }\n    }\n\n    let bCount = 0\n    for (const k in b) {\n      if (!ignoreUndefined || b[k] !== undefined) {\n        bCount++\n        if (bCount > aCount || !deepEqual(a[k], b[k], opts)) return false\n      }\n    }\n\n    return aCount === bCount\n  }\n\n  return false\n}\n\nexport type StringLiteral<T> = T extends string\n  ? string extends T\n    ? string\n    : T\n  : never\n\nexport type ThrowOrOptional<T, TThrow extends boolean> = TThrow extends true\n  ? T\n  : T | undefined\n\nexport type StrictOrFrom<\n  TRouter extends AnyRouter,\n  TFrom,\n  TStrict extends boolean = true,\n> = TStrict extends false\n  ? {\n      from?: never\n      strict: TStrict\n    }\n  : {\n      from: ConstrainLiteral<TFrom, RouteIds<TRouter['routeTree']>>\n      strict?: TStrict\n    }\n\nexport type ThrowConstraint<\n  TStrict extends boolean,\n  TThrow extends boolean,\n> = TStrict extends false ? (TThrow extends true ? never : TThrow) : TThrow\n\nexport type ControlledPromise<T> = Promise<T> & {\n  resolve: (value: T) => void\n  reject: (value: any) => void\n  status: 'pending' | 'resolved' | 'rejected'\n  value?: T\n}\n\n/**\n * Create a promise with exposed resolve/reject and status fields.\n * Useful for coordinating async router lifecycle operations.\n */\nexport function createControlledPromise<T>(onResolve?: (value: T) => void) {\n  let resolveLoadPromise!: (value: T) => void\n  let rejectLoadPromise!: (value: any) => void\n\n  const controlledPromise = new Promise<T>((resolve, reject) => {\n    resolveLoadPromise = resolve\n    rejectLoadPromise = reject\n  }) as ControlledPromise<T>\n\n  controlledPromise.status = 'pending'\n\n  controlledPromise.resolve = (value: T) => {\n    controlledPromise.status = 'resolved'\n    controlledPromise.value = value\n    resolveLoadPromise(value)\n    onResolve?.(value)\n  }\n\n  controlledPromise.reject = (e) => {\n    controlledPromise.status = 'rejected'\n    rejectLoadPromise(e)\n  }\n\n  return controlledPromise\n}\n\n/**\n * Heuristically detect dynamic import \"module not found\" errors\n * across major browsers for lazy route component handling.\n */\nexport function isModuleNotFoundError(error: any): boolean {\n  // chrome: \"Failed to fetch dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // firefox: \"error loading dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // safari: \"Importing a module script failed.\"\n  if (typeof error?.message !== 'string') return false\n  return (\n    error.message.startsWith('Failed to fetch dynamically imported module') ||\n    error.message.startsWith('error loading dynamically imported module') ||\n    error.message.startsWith('Importing a module script failed')\n  )\n}\n\nexport function isPromise<T>(\n  value: Promise<Awaited<T>> | T,\n): value is Promise<Awaited<T>> {\n  return Boolean(\n    value &&\n    typeof value === 'object' &&\n    typeof (value as Promise<T>).then === 'function',\n  )\n}\n\nexport function findLast<T>(\n  array: ReadonlyArray<T>,\n  predicate: (item: T) => boolean,\n): T | undefined {\n  for (let i = array.length - 1; i >= 0; i--) {\n    const item = array[i]!\n    if (predicate(item)) return item\n  }\n  return undefined\n}\n\n/**\n * Remove control characters that can cause open redirect vulnerabilities.\n * Characters like \\r (CR) and \\n (LF) can trick URL parsers into interpreting\n * paths like \"/\\r/evil.com\" as \"http://evil.com\".\n */\nfunction sanitizePathSegment(segment: string): string {\n  // Remove ASCII control characters (0x00-0x1F) and DEL (0x7F)\n  // These include CR (\\r = 0x0D), LF (\\n = 0x0A), and other potentially dangerous characters\n  // eslint-disable-next-line no-control-regex\n  return segment.replace(/[\\x00-\\x1f\\x7f]/g, '')\n}\n\nfunction decodeSegment(segment: string): string {\n  let decoded: string\n  try {\n    decoded = decodeURI(segment)\n  } catch {\n    // if the decoding fails, try to decode the various parts leaving the malformed tags in place\n    decoded = segment.replaceAll(/%[0-9A-F]{2}/gi, (match) => {\n      try {\n        return decodeURI(match)\n      } catch {\n        return match\n      }\n    })\n  }\n  return sanitizePathSegment(decoded)\n}\n\n/**\n * Default list of URL protocols to allow in links, redirects, and navigation.\n * Any absolute URL protocol not in this list is treated as dangerous by default.\n */\nexport const DEFAULT_PROTOCOL_ALLOWLIST = [\n  // Standard web navigation\n  'http:',\n  'https:',\n\n  // Common browser-safe actions\n  'mailto:',\n  'tel:',\n]\n\n/**\n * Check if a URL string uses a protocol that is not in the allowlist.\n * Returns true for blocked protocols like javascript:, blob:, data:, etc.\n *\n * The URL constructor correctly normalizes:\n * - Mixed case (JavaScript: → javascript:)\n * - Whitespace/control characters (java\\nscript: → javascript:)\n * - Leading whitespace\n *\n * For relative URLs (no protocol), returns false (safe).\n *\n * @param url - The URL string to check\n * @param allowlist - Set of protocols to allow\n * @returns true if the URL uses a protocol that is not allowed\n */\nexport function isDangerousProtocol(\n  url: string,\n  allowlist: Set<string>,\n): boolean {\n  if (!url) return false\n\n  try {\n    // Use the URL constructor - it correctly normalizes protocols\n    // per WHATWG URL spec, handling all bypass attempts automatically\n    const parsed = new URL(url)\n    return !allowlist.has(parsed.protocol)\n  } catch {\n    // URL constructor throws for relative URLs (no protocol)\n    // These are safe - they can't execute scripts\n    return false\n  }\n}\n\n// This utility is based on https://github.com/zertosh/htmlescape\n// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE\nconst HTML_ESCAPE_LOOKUP: { [match: string]: string } = {\n  '&': '\\\\u0026',\n  '>': '\\\\u003e',\n  '<': '\\\\u003c',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\nconst HTML_ESCAPE_REGEX = /[&><\\u2028\\u2029]/g\n\n/**\n * Escape HTML special characters in a string to prevent XSS attacks\n * when embedding strings in script tags during SSR.\n *\n * This is essential for preventing XSS vulnerabilities when user-controlled\n * content is embedded in inline scripts.\n */\nexport function escapeHtml(str: string): string {\n  return str.replace(HTML_ESCAPE_REGEX, (match) => HTML_ESCAPE_LOOKUP[match]!)\n}\n\nexport function decodePath(path: string) {\n  if (!path) return { path, handledProtocolRelativeURL: false }\n\n  // Fast path: most paths are already decoded and safe.\n  // Only fall back to the slower scan/regex path when we see a '%' (encoded),\n  // a backslash (explicitly handled), a control character, or a protocol-relative\n  // prefix which needs collapsing.\n  // eslint-disable-next-line no-control-regex\n  if (!/[%\\\\\\x00-\\x1f\\x7f]/.test(path) && !path.startsWith('//')) {\n    return { path, handledProtocolRelativeURL: false }\n  }\n\n  const re = /%25|%5C/gi\n  let cursor = 0\n  let result = ''\n  let match\n  while (null !== (match = re.exec(path))) {\n    result += decodeSegment(path.slice(cursor, match.index)) + match[0]\n    cursor = re.lastIndex\n  }\n  result = result + decodeSegment(cursor ? path.slice(cursor) : path)\n\n  // Prevent open redirect via protocol-relative URLs (e.g. \"//evil.com\")\n  // After sanitizing control characters, paths like \"/\\r/evil.com\" become \"//evil.com\"\n  // Collapse leading double slashes to a single slash\n  let handledProtocolRelativeURL = false\n  if (result.startsWith('//')) {\n    handledProtocolRelativeURL = true\n    result = '/' + result.replace(/^\\/+/, '')\n  }\n\n  return { path: result, handledProtocolRelativeURL }\n}\n\n/**\n * Encodes a path the same way `new URL()` would, but without the overhead of full URL parsing.\n *\n * This function encodes:\n * - Whitespace characters (spaces → %20, tabs → %09, etc.)\n * - Non-ASCII/Unicode characters (emojis, accented characters, etc.)\n *\n * It preserves:\n * - Already percent-encoded sequences (won't double-encode %2F, %25, etc.)\n * - ASCII special characters valid in URL paths (@, $, &, +, etc.)\n * - Forward slashes as path separators\n *\n * Used to generate proper href values for SSR without constructing URL objects.\n *\n * @example\n * encodePathLikeUrl('/path/file name.pdf') // '/path/file%20name.pdf'\n * encodePathLikeUrl('/path/日本語') // '/path/%E6%97%A5%E6%9C%AC%E8%AA%9E'\n * encodePathLikeUrl('/path/already%20encoded') // '/path/already%20encoded' (preserved)\n */\nexport function encodePathLikeUrl(path: string): string {\n  // Encode whitespace and non-ASCII characters that browsers encode in URLs\n\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  if (!/\\s|[^\\u0000-\\u007F]/.test(path)) return path\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  return path.replace(/\\s|[^\\u0000-\\u007F]/gu, encodeURIComponent)\n}\n\n/**\n * Builds the dev-mode CSS styles URL for route-scoped CSS collection.\n * Used by HeadContent components in all framework implementations to construct\n * the URL for the `/@tanstack-start/styles.css` endpoint.\n *\n * @param basepath - The router's basepath (may or may not have leading slash)\n * @param routeIds - Array of matched route IDs to include in the CSS collection\n * @returns The full URL path for the dev styles CSS endpoint\n */\nexport function buildDevStylesUrl(\n  basepath: string,\n  routeIds: Array<string>,\n): string {\n  // Trim all leading and trailing slashes from basepath\n  const trimmedBasepath = basepath.replace(/^\\/+|\\/+$/g, '')\n  // Build normalized basepath: empty string for root, or '/path' for non-root\n  const normalizedBasepath = trimmedBasepath === '' ? '' : `/${trimmedBasepath}`\n  return `${normalizedBasepath}/@tanstack-start/styles.css?routes=${encodeURIComponent(routeIds.join(','))}`\n}\n\nexport function arraysEqual<T>(a: Array<T>, b: Array<T>) {\n  if (a === b) return true\n  if (a.length !== b.length) return false\n  for (let i = 0; i < a.length; i++) {\n    if (a[i] !== b[i]) return false\n  }\n  return true\n}\n"],"mappings":";;;;;;AA+LA,SAAgB,KAAQ,KAAuB;AAC7C,QAAO,IAAI,IAAI,SAAS;;AAG1B,SAAS,WAAW,GAAuB;AACzC,QAAO,OAAO,MAAM;;;;;;AAOtB,SAAgB,iBACd,SACA,UACS;AACT,KAAI,WAAW,QAAQ,CACrB,QAAO,QAAQ,SAAS;AAG1B,QAAO;;AAGT,IAAM,SAAS,OAAO,UAAU;AAChC,IAAM,eAAe,OAAO,UAAU;AAEtC,IAAM,mBAAmB,OAAO,OAAO,KAAK;AAC5C,IAAa,wBAAiD,MAAM,SAClE,iBAAiB,MAAM,MAAM,WAAW;;;;;;;AAQ1C,SAAgB,iBACd,MACA,OACA,kBAAkB,EAAE,GACpB,SAAS,GACN;AACH,KAAI,SACF,QAAO;AAET,KAAI,SAAS,MACX,QAAO;AAGT,KAAI,SAAS,IAAK,QAAO;CAEzB,MAAM,OAAO;CAEb,MAAM,QAAQ,aAAa,KAAK,IAAI,aAAa,KAAK;AAEtD,KAAI,CAAC,SAAS,EAAE,cAAc,KAAK,IAAI,cAAc,KAAK,EAAG,QAAO;CAEpE,MAAM,YAAY,QAAQ,OAAO,qBAAqB,KAAK;AAC3D,KAAI,CAAC,UAAW,QAAO;CACvB,MAAM,YAAY,QAAQ,OAAO,qBAAqB,KAAK;AAC3D,KAAI,CAAC,UAAW,QAAO;CACvB,MAAM,WAAW,UAAU;CAC3B,MAAM,WAAW,UAAU;CAC3B,MAAM,OAAY,QAAQ,IAAI,MAAM,SAAS,GAAG,UAAU;CAE1D,IAAI,aAAa;AAEjB,MAAK,IAAI,IAAI,GAAG,IAAI,UAAU,KAAK;EACjC,MAAM,MAAM,QAAQ,IAAK,UAAU;EACnC,MAAM,IAAI,KAAK;EACf,MAAM,IAAI,KAAK;AAEf,MAAI,MAAM,GAAG;AACX,QAAK,OAAO;AACZ,OAAI,QAAQ,IAAI,WAAW,OAAO,KAAK,MAAM,IAAI,CAAE;AACnD;;AAGF,MACE,MAAM,QACN,MAAM,QACN,OAAO,MAAM,YACb,OAAO,MAAM,UACb;AACA,QAAK,OAAO;AACZ;;EAGF,MAAM,IAAI,iBAAiB,GAAG,GAAG,UAAU,SAAS,EAAE;AACtD,OAAK,OAAO;AACZ,MAAI,MAAM,EAAG;;AAGf,QAAO,aAAa,YAAY,eAAe,WAAW,OAAO;;;;;;;;AASnE,SAAS,qBAAqB,GAAW;CACvC,MAAM,QAAQ,OAAO,oBAAoB,EAAE;AAG3C,MAAK,MAAM,QAAQ,MACjB,KAAI,CAAC,aAAa,KAAK,GAAG,KAAK,CAAE,QAAO;CAI1C,MAAM,UAAU,OAAO,sBAAsB,EAAE;AAG/C,KAAI,QAAQ,WAAW,EAAG,QAAO;CAGjC,MAAM,OAA+B;AACrC,MAAK,MAAM,UAAU,SAAS;AAC5B,MAAI,CAAC,aAAa,KAAK,GAAG,OAAO,CAAE,QAAO;AAC1C,OAAK,KAAK,OAAO;;AAEnB,QAAO;;AAIT,SAAgB,cAAc,GAAQ;AACpC,KAAI,CAAC,mBAAmB,EAAE,CACxB,QAAO;CAIT,MAAM,OAAO,EAAE;AACf,KAAI,OAAO,SAAS,YAClB,QAAO;CAIT,MAAM,OAAO,KAAK;AAClB,KAAI,CAAC,mBAAmB,KAAK,CAC3B,QAAO;AAIT,KAAI,CAAC,KAAK,eAAe,gBAAgB,CACvC,QAAO;AAIT,QAAO;;AAGT,SAAS,mBAAmB,GAAQ;AAClC,QAAO,OAAO,UAAU,SAAS,KAAK,EAAE,KAAK;;;;;AAM/C,SAAgB,aAAa,OAAyC;AACpE,QAAO,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW,OAAO,KAAK,MAAM,CAAC;;;;;;AAOrE,SAAgB,UACd,GACA,GACA,MACS;AACT,KAAI,MAAM,EACR,QAAO;AAGT,KAAI,OAAO,MAAM,OAAO,EACtB,QAAO;AAGT,KAAI,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ,EAAE,EAAE;AACxC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,OAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAI,GAAG,IACnC,KAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,KAAK,CAAE,QAAO;AAE3C,SAAO;;AAGT,KAAI,cAAc,EAAE,IAAI,cAAc,EAAE,EAAE;EACxC,MAAM,kBAAkB,MAAM,mBAAmB;AAEjD,MAAI,MAAM,SAAS;AACjB,QAAK,MAAM,KAAK,EACd,KAAI,CAAC,mBAAmB,EAAE,OAAO,KAAA;QAC3B,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,KAAK,CAAE,QAAO;;AAG7C,UAAO;;EAGT,IAAI,SAAS;AACb,MAAI,CAAC,gBACH,UAAS,OAAO,KAAK,EAAE,CAAC;MAExB,MAAK,MAAM,KAAK,EACd,KAAI,EAAE,OAAO,KAAA,EAAW;EAI5B,IAAI,SAAS;AACb,OAAK,MAAM,KAAK,EACd,KAAI,CAAC,mBAAmB,EAAE,OAAO,KAAA,GAAW;AAC1C;AACA,OAAI,SAAS,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,KAAK,CAAE,QAAO;;AAIhE,SAAO,WAAW;;AAGpB,QAAO;;;;;;AA2CT,SAAgB,wBAA2B,WAAgC;CACzE,IAAI;CACJ,IAAI;CAEJ,MAAM,oBAAoB,IAAI,SAAY,SAAS,WAAW;AAC5D,uBAAqB;AACrB,sBAAoB;GACpB;AAEF,mBAAkB,SAAS;AAE3B,mBAAkB,WAAW,UAAa;AACxC,oBAAkB,SAAS;AAC3B,oBAAkB,QAAQ;AAC1B,qBAAmB,MAAM;AACzB,cAAY,MAAM;;AAGpB,mBAAkB,UAAU,MAAM;AAChC,oBAAkB,SAAS;AAC3B,oBAAkB,EAAE;;AAGtB,QAAO;;;;;;AAOT,SAAgB,sBAAsB,OAAqB;AAIzD,KAAI,OAAO,OAAO,YAAY,SAAU,QAAO;AAC/C,QACE,MAAM,QAAQ,WAAW,8CAA8C,IACvE,MAAM,QAAQ,WAAW,4CAA4C,IACrE,MAAM,QAAQ,WAAW,mCAAmC;;AAIhE,SAAgB,UACd,OAC8B;AAC9B,QAAO,QACL,SACA,OAAO,UAAU,YACjB,OAAQ,MAAqB,SAAS,WACvC;;AAGH,SAAgB,SACd,OACA,WACe;AACf,MAAK,IAAI,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;EAC1C,MAAM,OAAO,MAAM;AACnB,MAAI,UAAU,KAAK,CAAE,QAAO;;;;;;;;AAUhC,SAAS,oBAAoB,SAAyB;AAIpD,QAAO,QAAQ,QAAQ,oBAAoB,GAAG;;AAGhD,SAAS,cAAc,SAAyB;CAC9C,IAAI;AACJ,KAAI;AACF,YAAU,UAAU,QAAQ;SACtB;AAEN,YAAU,QAAQ,WAAW,mBAAmB,UAAU;AACxD,OAAI;AACF,WAAO,UAAU,MAAM;WACjB;AACN,WAAO;;IAET;;AAEJ,QAAO,oBAAoB,QAAQ;;;;;;AAOrC,IAAa,6BAA6B;CAExC;CACA;CAGA;CACA;CACD;;;;;;;;;;;;;;;;AAiBD,SAAgB,oBACd,KACA,WACS;AACT,KAAI,CAAC,IAAK,QAAO;AAEjB,KAAI;EAGF,MAAM,SAAS,IAAI,IAAI,IAAI;AAC3B,SAAO,CAAC,UAAU,IAAI,OAAO,SAAS;SAChC;AAGN,SAAO;;;AAMX,IAAM,qBAAkD;CACtD,KAAK;CACL,KAAK;CACL,KAAK;CACL,UAAU;CACV,UAAU;CACX;AAED,IAAM,oBAAoB;;;;;;;;AAS1B,SAAgB,WAAW,KAAqB;AAC9C,QAAO,IAAI,QAAQ,oBAAoB,UAAU,mBAAmB,OAAQ;;AAG9E,SAAgB,WAAW,MAAc;AACvC,KAAI,CAAC,KAAM,QAAO;EAAE;EAAM,4BAA4B;EAAO;AAO7D,KAAI,CAAC,qBAAqB,KAAK,KAAK,IAAI,CAAC,KAAK,WAAW,KAAK,CAC5D,QAAO;EAAE;EAAM,4BAA4B;EAAO;CAGpD,MAAM,KAAK;CACX,IAAI,SAAS;CACb,IAAI,SAAS;CACb,IAAI;AACJ,QAAO,UAAU,QAAQ,GAAG,KAAK,KAAK,GAAG;AACvC,YAAU,cAAc,KAAK,MAAM,QAAQ,MAAM,MAAM,CAAC,GAAG,MAAM;AACjE,WAAS,GAAG;;AAEd,UAAS,SAAS,cAAc,SAAS,KAAK,MAAM,OAAO,GAAG,KAAK;CAKnE,IAAI,6BAA6B;AACjC,KAAI,OAAO,WAAW,KAAK,EAAE;AAC3B,+BAA6B;AAC7B,WAAS,MAAM,OAAO,QAAQ,QAAQ,GAAG;;AAG3C,QAAO;EAAE,MAAM;EAAQ;EAA4B;;;;;;;;;;;;;;;;;;;;;AAsBrD,SAAgB,kBAAkB,MAAsB;AAKtD,KAAI,CAAC,sBAAsB,KAAK,KAAK,CAAE,QAAO;AAG9C,QAAO,KAAK,QAAQ,yBAAyB,mBAAmB;;;;;;;;;;;AAYlE,SAAgB,kBACd,UACA,UACQ;CAER,MAAM,kBAAkB,SAAS,QAAQ,cAAc,GAAG;AAG1D,QAAO,GADoB,oBAAoB,KAAK,KAAK,IAAI,kBAChC,qCAAqC,mBAAmB,SAAS,KAAK,IAAI,CAAC;;AAG1G,SAAgB,YAAe,GAAa,GAAa;AACvD,KAAI,MAAM,EAAG,QAAO;AACpB,KAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAC5B,KAAI,EAAE,OAAO,EAAE,GAAI,QAAO;AAE5B,QAAO"}
+{"version":3,"file":"utils.js","names":[],"sources":["../../src/utils.ts"],"sourcesContent":["import { isServer } from '@benjavicente/router-core/isServer'\nimport type { RouteIds } from './routeInfo'\nimport type { AnyRouter } from './router'\n\nexport type Awaitable<T> = T | Promise<T>\nexport type NoInfer<T> = [T][T extends any ? 0 : never]\nexport type IsAny<TValue, TYesResult, TNoResult = TValue> = 1 extends 0 & TValue\n  ? TYesResult\n  : TNoResult\n\nexport type PickAsRequired<TValue, TKey extends keyof TValue> = Omit<\n  TValue,\n  TKey\n> &\n  Required<Pick<TValue, TKey>>\n\nexport type PickRequired<T> = {\n  [K in keyof T as undefined extends T[K] ? never : K]: T[K]\n}\n\nexport type PickOptional<T> = {\n  [K in keyof T as undefined extends T[K] ? K : never]: T[K]\n}\n\n// from https://stackoverflow.com/a/76458160\nexport type WithoutEmpty<T> = T extends any ? ({} extends T ? never : T) : never\n\nexport type Expand<T> = T extends object\n  ? T extends infer O\n    ? O extends Function\n      ? O\n      : { [K in keyof O]: O[K] }\n    : never\n  : T\n\nexport type DeepPartial<T> = T extends object\n  ? {\n      [P in keyof T]?: DeepPartial<T[P]>\n    }\n  : T\n\nexport type MakeDifferenceOptional<TLeft, TRight> = keyof TLeft &\n  keyof TRight extends never\n  ? TRight\n  : Omit<TRight, keyof TLeft & keyof TRight> & {\n      [K in keyof TLeft & keyof TRight]?: TRight[K]\n    }\n\n// from https://stackoverflow.com/a/53955431\n// eslint-disable-next-line @typescript-eslint/naming-convention\nexport type IsUnion<T, U extends T = T> = (\n  T extends any ? (U extends T ? false : true) : never\n) extends false\n  ? false\n  : true\n\nexport type IsNonEmptyObject<T> = T extends object\n  ? keyof T extends never\n    ? false\n    : true\n  : false\n\nexport type Assign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : keyof TLeft & keyof TRight extends never\n          ? TLeft & TRight\n          : Omit<TLeft, keyof TRight> & TRight\n    : never\n  : never\n\nexport type IntersectAssign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : TRight & TLeft\n    : never\n  : never\n\nexport type Timeout = ReturnType<typeof setTimeout>\n\nexport type Updater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev?: TPrevious) => TResult)\n\nexport type NonNullableUpdater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev: TPrevious) => TResult)\n\nexport type ExtractObjects<TUnion> = TUnion extends MergeAllPrimitive\n  ? never\n  : TUnion\n\nexport type PartialMergeAllObject<TUnion> =\n  ExtractObjects<TUnion> extends infer TObj\n    ? [TObj] extends [never]\n      ? never\n      : {\n          [TKey in TObj extends any ? keyof TObj : never]?: TObj extends any\n            ? TKey extends keyof TObj\n              ? TObj[TKey]\n              : never\n            : never\n        }\n    : never\n\nexport type MergeAllPrimitive =\n  | ReadonlyArray<any>\n  | number\n  | string\n  | bigint\n  | boolean\n  | symbol\n  | undefined\n  | null\n\nexport type ExtractPrimitives<TUnion> = TUnion extends MergeAllPrimitive\n  ? TUnion\n  : TUnion extends object\n    ? never\n    : TUnion\n\nexport type PartialMergeAll<TUnion> =\n  | ExtractPrimitives<TUnion>\n  | PartialMergeAllObject<TUnion>\n\nexport type Constrain<T, TConstraint, TDefault = TConstraint> =\n  | (T extends TConstraint ? T : never)\n  | TDefault\n\nexport type ConstrainLiteral<T, TConstraint, TDefault = TConstraint> =\n  | (T & TConstraint)\n  | TDefault\n\n/**\n * To be added to router types\n */\nexport type UnionToIntersection<T> = (\n  T extends any ? (arg: T) => any : never\n) extends (arg: infer T) => any\n  ? T\n  : never\n\n/**\n * Merges everything in a union into one object.\n * This mapped type is homomorphic which means it preserves stuff! :)\n */\nexport type MergeAllObjects<\n  TUnion,\n  TIntersected = UnionToIntersection<ExtractObjects<TUnion>>,\n> = [keyof TIntersected] extends [never]\n  ? never\n  : {\n      [TKey in keyof TIntersected]: TUnion extends any\n        ? TUnion[TKey & keyof TUnion]\n        : never\n    }\n\nexport type MergeAll<TUnion> =\n  | MergeAllObjects<TUnion>\n  | ExtractPrimitives<TUnion>\n\nexport type ValidateJSON<T> = ((...args: Array<any>) => any) extends T\n  ? unknown extends T\n    ? never\n    : 'Function is not serializable'\n  : { [K in keyof T]: ValidateJSON<T[K]> }\n\nexport type LooseReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn\n  : never\n\nexport type LooseAsyncReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn extends Promise<infer TReturn>\n    ? TReturn\n    : TReturn\n  : never\n\n/**\n * Return the last element of an array.\n * Intended for non-empty arrays used within router internals.\n */\nexport function last<T>(arr: ReadonlyArray<T>) {\n  return arr[arr.length - 1]\n}\n\nfunction isFunction(d: any): d is Function {\n  return typeof d === 'function'\n}\n\n/**\n * Apply a value-or-updater to a previous value.\n * Accepts either a literal value or a function of the previous value.\n */\nexport function functionalUpdate<TPrevious, TResult = TPrevious>(\n  updater: Updater<TPrevious, TResult> | NonNullableUpdater<TPrevious, TResult>,\n  previous: TPrevious,\n): TResult {\n  if (isFunction(updater)) {\n    return updater(previous)\n  }\n\n  return updater\n}\n\nconst hasOwn = Object.prototype.hasOwnProperty\nconst isEnumerable = Object.prototype.propertyIsEnumerable\n\nexport function hasKeys(obj: Record<string, unknown>) {\n  for (const key in obj) {\n    if (hasOwn.call(obj, key)) return true\n  }\n  return false\n}\n\nconst createNull = () => Object.create(null)\nexport const nullReplaceEqualDeep: typeof replaceEqualDeep = (prev, next) =>\n  replaceEqualDeep(prev, next, createNull)\n\n/**\n * This function returns `prev` if `_next` is deeply equal.\n * If not, it will replace any deeply equal children of `b` with those of `a`.\n * This can be used for structural sharing between immutable JSON values for example.\n * Do not use this with signals\n */\nexport function replaceEqualDeep<T>(\n  prev: any,\n  _next: T,\n  _makeObj = () => ({}),\n  _depth = 0,\n): T {\n  if (isServer) {\n    return _next\n  }\n  if (prev === _next) {\n    return prev\n  }\n\n  if (_depth > 500) return _next\n\n  const next = _next as any\n\n  const array = isPlainArray(prev) && isPlainArray(next)\n\n  if (!array && !(isPlainObject(prev) && isPlainObject(next))) return next\n\n  const prevItems = array ? prev : getEnumerableOwnKeys(prev)\n  if (!prevItems) return next\n  const nextItems = array ? next : getEnumerableOwnKeys(next)\n  if (!nextItems) return next\n  const prevSize = prevItems.length\n  const nextSize = nextItems.length\n  const copy: any = array ? new Array(nextSize) : _makeObj()\n\n  let equalItems = 0\n\n  for (let i = 0; i < nextSize; i++) {\n    const key = array ? i : (nextItems[i] as any)\n    const p = prev[key]\n    const n = next[key]\n\n    if (p === n) {\n      copy[key] = p\n      if (array ? i < prevSize : hasOwn.call(prev, key)) equalItems++\n      continue\n    }\n\n    if (\n      p === null ||\n      n === null ||\n      typeof p !== 'object' ||\n      typeof n !== 'object'\n    ) {\n      copy[key] = n\n      continue\n    }\n\n    const v = replaceEqualDeep(p, n, _makeObj, _depth + 1)\n    copy[key] = v\n    if (v === p) equalItems++\n  }\n\n  return prevSize === nextSize && equalItems === prevSize ? prev : copy\n}\n\n/**\n * Equivalent to `Reflect.ownKeys`, but ensures that objects are \"clone-friendly\":\n * will return false if object has any non-enumerable properties.\n *\n * Optimized for the common case where objects have no symbol properties.\n */\nfunction getEnumerableOwnKeys(o: object) {\n  const names = Object.getOwnPropertyNames(o)\n\n  // Fast path: check all string property names are enumerable\n  for (const name of names) {\n    if (!isEnumerable.call(o, name)) return false\n  }\n\n  // Only check symbols if the object has any (most plain objects don't)\n  const symbols = Object.getOwnPropertySymbols(o)\n\n  // Fast path: no symbols, return names directly (avoids array allocation/concat)\n  if (symbols.length === 0) return names\n\n  // Slow path: has symbols, need to check and merge\n  const keys: Array<string | symbol> = names\n  for (const symbol of symbols) {\n    if (!isEnumerable.call(o, symbol)) return false\n    keys.push(symbol)\n  }\n  return keys\n}\n\n// Copied from: https://github.com/jonschlinkert/is-plain-object\nexport function isPlainObject(o: any) {\n  if (!hasObjectPrototype(o)) {\n    return false\n  }\n\n  // If has modified constructor\n  const ctor = o.constructor\n  if (typeof ctor === 'undefined') {\n    return true\n  }\n\n  // If has modified prototype\n  const prot = ctor.prototype\n  if (!hasObjectPrototype(prot)) {\n    return false\n  }\n\n  // If constructor does not have an Object-specific method\n  if (!prot.hasOwnProperty('isPrototypeOf')) {\n    return false\n  }\n\n  // Most likely a plain Object\n  return true\n}\n\nfunction hasObjectPrototype(o: any) {\n  return Object.prototype.toString.call(o) === '[object Object]'\n}\n\n/**\n * Check if a value is a \"plain\" array (no extra enumerable keys).\n */\nexport function isPlainArray(value: unknown): value is Array<unknown> {\n  return Array.isArray(value) && value.length === Object.keys(value).length\n}\n\n/**\n * Perform a deep equality check with options for partial comparison and\n * ignoring `undefined` values. Optimized for router state comparisons.\n */\nexport function deepEqual(\n  a: any,\n  b: any,\n  opts?: { partial?: boolean; ignoreUndefined?: boolean },\n): boolean {\n  if (a === b) {\n    return true\n  }\n\n  if (typeof a !== typeof b) {\n    return false\n  }\n\n  if (Array.isArray(a) && Array.isArray(b)) {\n    if (a.length !== b.length) return false\n    for (let i = 0, l = a.length; i < l; i++) {\n      if (!deepEqual(a[i], b[i], opts)) return false\n    }\n    return true\n  }\n\n  if (isPlainObject(a) && isPlainObject(b)) {\n    const ignoreUndefined = opts?.ignoreUndefined ?? true\n\n    if (opts?.partial) {\n      for (const k in b) {\n        if (!ignoreUndefined || b[k] !== undefined) {\n          if (!deepEqual(a[k], b[k], opts)) return false\n        }\n      }\n      return true\n    }\n\n    let aCount = 0\n    if (!ignoreUndefined) {\n      aCount = Object.keys(a).length\n    } else {\n      for (const k in a) {\n        if (a[k] !== undefined) aCount++\n      }\n    }\n\n    let bCount = 0\n    for (const k in b) {\n      if (!ignoreUndefined || b[k] !== undefined) {\n        bCount++\n        if (bCount > aCount || !deepEqual(a[k], b[k], opts)) return false\n      }\n    }\n\n    return aCount === bCount\n  }\n\n  return false\n}\n\nexport type StringLiteral<T> = T extends string\n  ? string extends T\n    ? string\n    : T\n  : never\n\nexport type ThrowOrOptional<T, TThrow extends boolean> = TThrow extends true\n  ? T\n  : T | undefined\n\nexport type StrictOrFrom<\n  TRouter extends AnyRouter,\n  TFrom,\n  TStrict extends boolean = true,\n> = TStrict extends false\n  ? {\n      from?: never\n      strict: TStrict\n    }\n  : {\n      from: ConstrainLiteral<TFrom, RouteIds<TRouter['routeTree']>>\n      strict?: TStrict\n    }\n\nexport type ThrowConstraint<\n  TStrict extends boolean,\n  TThrow extends boolean,\n> = TStrict extends false ? (TThrow extends true ? never : TThrow) : TThrow\n\nexport type ControlledPromise<T> = Promise<T> & {\n  resolve: (value: T) => void\n  reject: (value: any) => void\n  status: 'pending' | 'resolved' | 'rejected'\n  value?: T\n}\n\n/**\n * Create a promise with exposed resolve/reject and status fields.\n * Useful for coordinating async router lifecycle operations.\n */\nexport function createControlledPromise<T>(onResolve?: (value: T) => void) {\n  let resolveLoadPromise!: (value: T) => void\n  let rejectLoadPromise!: (value: any) => void\n\n  const controlledPromise = new Promise<T>((resolve, reject) => {\n    resolveLoadPromise = resolve\n    rejectLoadPromise = reject\n  }) as ControlledPromise<T>\n\n  controlledPromise.status = 'pending'\n\n  controlledPromise.resolve = (value: T) => {\n    controlledPromise.status = 'resolved'\n    controlledPromise.value = value\n    resolveLoadPromise(value)\n    onResolve?.(value)\n  }\n\n  controlledPromise.reject = (e) => {\n    controlledPromise.status = 'rejected'\n    rejectLoadPromise(e)\n  }\n\n  return controlledPromise\n}\n\n/**\n * Heuristically detect dynamic import \"module not found\" errors\n * across major browsers for lazy route component handling.\n */\nexport function isModuleNotFoundError(error: any): boolean {\n  // chrome: \"Failed to fetch dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // firefox: \"error loading dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // safari: \"Importing a module script failed.\"\n  if (typeof error?.message !== 'string') return false\n  return (\n    error.message.startsWith('Failed to fetch dynamically imported module') ||\n    error.message.startsWith('error loading dynamically imported module') ||\n    error.message.startsWith('Importing a module script failed')\n  )\n}\n\nexport function isPromise<T>(\n  value: Promise<Awaited<T>> | T,\n): value is Promise<Awaited<T>> {\n  return Boolean(\n    value &&\n    typeof value === 'object' &&\n    typeof (value as Promise<T>).then === 'function',\n  )\n}\n\nexport function findLast<T>(\n  array: ReadonlyArray<T>,\n  predicate: (item: T) => boolean,\n): T | undefined {\n  for (let i = array.length - 1; i >= 0; i--) {\n    const item = array[i]!\n    if (predicate(item)) return item\n  }\n  return undefined\n}\n\n/**\n * Remove control characters that can cause open redirect vulnerabilities.\n * Characters like \\r (CR) and \\n (LF) can trick URL parsers into interpreting\n * paths like \"/\\r/evil.com\" as \"http://evil.com\".\n */\nfunction sanitizePathSegment(segment: string): string {\n  // Remove ASCII control characters (0x00-0x1F) and DEL (0x7F)\n  // These include CR (\\r = 0x0D), LF (\\n = 0x0A), and other potentially dangerous characters\n  // eslint-disable-next-line no-control-regex\n  return segment.replace(/[\\x00-\\x1f\\x7f]/g, '')\n}\n\nfunction decodeSegment(segment: string): string {\n  let decoded: string\n  try {\n    decoded = decodeURI(segment)\n  } catch {\n    // if the decoding fails, try to decode the various parts leaving the malformed tags in place\n    decoded = segment.replaceAll(/%[0-9A-F]{2}/gi, (match) => {\n      try {\n        return decodeURI(match)\n      } catch {\n        return match\n      }\n    })\n  }\n  return sanitizePathSegment(decoded)\n}\n\n/**\n * Default list of URL protocols to allow in links, redirects, and navigation.\n * Any absolute URL protocol not in this list is treated as dangerous by default.\n */\nexport const DEFAULT_PROTOCOL_ALLOWLIST = [\n  // Standard web navigation\n  'http:',\n  'https:',\n\n  // Common browser-safe actions\n  'mailto:',\n  'tel:',\n]\n\n/**\n * Check if a URL string uses a protocol that is not in the allowlist.\n * Returns true for blocked protocols like javascript:, blob:, data:, etc.\n *\n * The URL constructor correctly normalizes:\n * - Mixed case (JavaScript: → javascript:)\n * - Whitespace/control characters (java\\nscript: → javascript:)\n * - Leading whitespace\n *\n * For relative URLs (no protocol), returns false (safe).\n *\n * @param url - The URL string to check\n * @param allowlist - Set of protocols to allow\n * @returns true if the URL uses a protocol that is not allowed\n */\nexport function isDangerousProtocol(\n  url: string,\n  allowlist: Set<string>,\n): boolean {\n  if (!url) return false\n\n  try {\n    // Use the URL constructor - it correctly normalizes protocols\n    // per WHATWG URL spec, handling all bypass attempts automatically\n    const parsed = new URL(url)\n    return !allowlist.has(parsed.protocol)\n  } catch {\n    // URL constructor throws for relative URLs (no protocol)\n    // These are safe - they can't execute scripts\n    return false\n  }\n}\n\n// This utility is based on https://github.com/zertosh/htmlescape\n// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE\nconst HTML_ESCAPE_LOOKUP: { [match: string]: string } = {\n  '&': '\\\\u0026',\n  '>': '\\\\u003e',\n  '<': '\\\\u003c',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\nconst HTML_ESCAPE_REGEX = /[&><\\u2028\\u2029]/g\n\n/**\n * Escape HTML special characters in a string to prevent XSS attacks\n * when embedding strings in script tags during SSR.\n *\n * This is essential for preventing XSS vulnerabilities when user-controlled\n * content is embedded in inline scripts.\n */\nexport function escapeHtml(str: string): string {\n  return str.replace(HTML_ESCAPE_REGEX, (match) => HTML_ESCAPE_LOOKUP[match]!)\n}\n\nexport function decodePath(path: string) {\n  if (!path) return { path, handledProtocolRelativeURL: false }\n\n  // Fast path: most paths are already decoded and safe.\n  // Only fall back to the slower scan/regex path when we see a '%' (encoded),\n  // a backslash (explicitly handled), a control character, or a protocol-relative\n  // prefix which needs collapsing.\n  // eslint-disable-next-line no-control-regex\n  if (!/[%\\\\\\x00-\\x1f\\x7f]/.test(path) && !path.startsWith('//')) {\n    return { path, handledProtocolRelativeURL: false }\n  }\n\n  const re = /%25|%5C/gi\n  let cursor = 0\n  let result = ''\n  let match\n  while (null !== (match = re.exec(path))) {\n    result += decodeSegment(path.slice(cursor, match.index)) + match[0]\n    cursor = re.lastIndex\n  }\n  result = result + decodeSegment(cursor ? path.slice(cursor) : path)\n\n  // Prevent open redirect via protocol-relative URLs (e.g. \"//evil.com\")\n  // After sanitizing control characters, paths like \"/\\r/evil.com\" become \"//evil.com\"\n  // Collapse leading double slashes to a single slash\n  let handledProtocolRelativeURL = false\n  if (result.startsWith('//')) {\n    handledProtocolRelativeURL = true\n    result = '/' + result.replace(/^\\/+/, '')\n  }\n\n  return { path: result, handledProtocolRelativeURL }\n}\n\n/**\n * Encodes a path the same way `new URL()` would, but without the overhead of full URL parsing.\n *\n * This function encodes:\n * - Whitespace characters (spaces → %20, tabs → %09, etc.)\n * - Non-ASCII/Unicode characters (emojis, accented characters, etc.)\n *\n * It preserves:\n * - Already percent-encoded sequences (won't double-encode %2F, %25, etc.)\n * - ASCII special characters valid in URL paths (@, $, &, +, etc.)\n * - Forward slashes as path separators\n *\n * Used to generate proper href values for SSR without constructing URL objects.\n *\n * @example\n * encodePathLikeUrl('/path/file name.pdf') // '/path/file%20name.pdf'\n * encodePathLikeUrl('/path/日本語') // '/path/%E6%97%A5%E6%9C%AC%E8%AA%9E'\n * encodePathLikeUrl('/path/already%20encoded') // '/path/already%20encoded' (preserved)\n */\nexport function encodePathLikeUrl(path: string): string {\n  // Encode whitespace and non-ASCII characters that browsers encode in URLs\n\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  if (!/\\s|[^\\u0000-\\u007F]/.test(path)) return path\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  return path.replace(/\\s|[^\\u0000-\\u007F]/gu, encodeURIComponent)\n}\n\n/**\n * Builds the dev-mode CSS styles URL for route-scoped CSS collection.\n * Used by HeadContent components in all framework implementations to construct\n * the URL for the `/@tanstack-start/styles.css` endpoint.\n *\n * @param basepath - The router's basepath (may or may not have leading slash)\n * @param routeIds - Array of matched route IDs to include in the CSS collection\n * @returns The full URL path for the dev styles CSS endpoint\n */\nexport function buildDevStylesUrl(\n  basepath: string,\n  routeIds: Array<string>,\n): string {\n  // Trim all leading and trailing slashes from basepath\n  const trimmedBasepath = basepath.replace(/^\\/+|\\/+$/g, '')\n  // Build normalized basepath: empty string for root, or '/path' for non-root\n  const normalizedBasepath = trimmedBasepath === '' ? '' : `/${trimmedBasepath}`\n  return `${normalizedBasepath}/@tanstack-start/styles.css?routes=${encodeURIComponent(routeIds.join(','))}`\n}\n\nexport function arraysEqual<T>(a: Array<T>, b: Array<T>) {\n  if (a === b) return true\n  if (a.length !== b.length) return false\n  for (let i = 0; i < a.length; i++) {\n    if (a[i] !== b[i]) return false\n  }\n  return true\n}\n"],"mappings":";;;;;;AA+LA,SAAgB,KAAQ,KAAuB;AAC7C,QAAO,IAAI,IAAI,SAAS;;AAG1B,SAAS,WAAW,GAAuB;AACzC,QAAO,OAAO,MAAM;;;;;;AAOtB,SAAgB,iBACd,SACA,UACS;AACT,KAAI,WAAW,QAAQ,CACrB,QAAO,QAAQ,SAAS;AAG1B,QAAO;;AAGT,MAAM,SAAS,OAAO,UAAU;AAChC,MAAM,eAAe,OAAO,UAAU;AAEtC,SAAgB,QAAQ,KAA8B;AACpD,MAAK,MAAM,OAAO,IAChB,KAAI,OAAO,KAAK,KAAK,IAAI,CAAE,QAAO;AAEpC,QAAO;;AAGT,MAAM,mBAAmB,OAAO,OAAO,KAAK;AAC5C,MAAa,wBAAiD,MAAM,SAClE,iBAAiB,MAAM,MAAM,WAAW;;;;;;;AAQ1C,SAAgB,iBACd,MACA,OACA,kBAAkB,EAAE,GACpB,SAAS,GACN;AACH,KAAI,SACF,QAAO;AAET,KAAI,SAAS,MACX,QAAO;AAGT,KAAI,SAAS,IAAK,QAAO;CAEzB,MAAM,OAAO;CAEb,MAAM,QAAQ,aAAa,KAAK,IAAI,aAAa,KAAK;AAEtD,KAAI,CAAC,SAAS,EAAE,cAAc,KAAK,IAAI,cAAc,KAAK,EAAG,QAAO;CAEpE,MAAM,YAAY,QAAQ,OAAO,qBAAqB,KAAK;AAC3D,KAAI,CAAC,UAAW,QAAO;CACvB,MAAM,YAAY,QAAQ,OAAO,qBAAqB,KAAK;AAC3D,KAAI,CAAC,UAAW,QAAO;CACvB,MAAM,WAAW,UAAU;CAC3B,MAAM,WAAW,UAAU;CAC3B,MAAM,OAAY,QAAQ,IAAI,MAAM,SAAS,GAAG,UAAU;CAE1D,IAAI,aAAa;AAEjB,MAAK,IAAI,IAAI,GAAG,IAAI,UAAU,KAAK;EACjC,MAAM,MAAM,QAAQ,IAAK,UAAU;EACnC,MAAM,IAAI,KAAK;EACf,MAAM,IAAI,KAAK;AAEf,MAAI,MAAM,GAAG;AACX,QAAK,OAAO;AACZ,OAAI,QAAQ,IAAI,WAAW,OAAO,KAAK,MAAM,IAAI,CAAE;AACnD;;AAGF,MACE,MAAM,QACN,MAAM,QACN,OAAO,MAAM,YACb,OAAO,MAAM,UACb;AACA,QAAK,OAAO;AACZ;;EAGF,MAAM,IAAI,iBAAiB,GAAG,GAAG,UAAU,SAAS,EAAE;AACtD,OAAK,OAAO;AACZ,MAAI,MAAM,EAAG;;AAGf,QAAO,aAAa,YAAY,eAAe,WAAW,OAAO;;;;;;;;AASnE,SAAS,qBAAqB,GAAW;CACvC,MAAM,QAAQ,OAAO,oBAAoB,EAAE;AAG3C,MAAK,MAAM,QAAQ,MACjB,KAAI,CAAC,aAAa,KAAK,GAAG,KAAK,CAAE,QAAO;CAI1C,MAAM,UAAU,OAAO,sBAAsB,EAAE;AAG/C,KAAI,QAAQ,WAAW,EAAG,QAAO;CAGjC,MAAM,OAA+B;AACrC,MAAK,MAAM,UAAU,SAAS;AAC5B,MAAI,CAAC,aAAa,KAAK,GAAG,OAAO,CAAE,QAAO;AAC1C,OAAK,KAAK,OAAO;;AAEnB,QAAO;;AAIT,SAAgB,cAAc,GAAQ;AACpC,KAAI,CAAC,mBAAmB,EAAE,CACxB,QAAO;CAIT,MAAM,OAAO,EAAE;AACf,KAAI,OAAO,SAAS,YAClB,QAAO;CAIT,MAAM,OAAO,KAAK;AAClB,KAAI,CAAC,mBAAmB,KAAK,CAC3B,QAAO;AAIT,KAAI,CAAC,KAAK,eAAe,gBAAgB,CACvC,QAAO;AAIT,QAAO;;AAGT,SAAS,mBAAmB,GAAQ;AAClC,QAAO,OAAO,UAAU,SAAS,KAAK,EAAE,KAAK;;;;;AAM/C,SAAgB,aAAa,OAAyC;AACpE,QAAO,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW,OAAO,KAAK,MAAM,CAAC;;;;;;AAOrE,SAAgB,UACd,GACA,GACA,MACS;AACT,KAAI,MAAM,EACR,QAAO;AAGT,KAAI,OAAO,MAAM,OAAO,EACtB,QAAO;AAGT,KAAI,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ,EAAE,EAAE;AACxC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,OAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAI,GAAG,IACnC,KAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,KAAK,CAAE,QAAO;AAE3C,SAAO;;AAGT,KAAI,cAAc,EAAE,IAAI,cAAc,EAAE,EAAE;EACxC,MAAM,kBAAkB,MAAM,mBAAmB;AAEjD,MAAI,MAAM,SAAS;AACjB,QAAK,MAAM,KAAK,EACd,KAAI,CAAC,mBAAmB,EAAE,OAAO,KAAA;QAC3B,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,KAAK,CAAE,QAAO;;AAG7C,UAAO;;EAGT,IAAI,SAAS;AACb,MAAI,CAAC,gBACH,UAAS,OAAO,KAAK,EAAE,CAAC;MAExB,MAAK,MAAM,KAAK,EACd,KAAI,EAAE,OAAO,KAAA,EAAW;EAI5B,IAAI,SAAS;AACb,OAAK,MAAM,KAAK,EACd,KAAI,CAAC,mBAAmB,EAAE,OAAO,KAAA,GAAW;AAC1C;AACA,OAAI,SAAS,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,KAAK,CAAE,QAAO;;AAIhE,SAAO,WAAW;;AAGpB,QAAO;;;;;;AA2CT,SAAgB,wBAA2B,WAAgC;CACzE,IAAI;CACJ,IAAI;CAEJ,MAAM,oBAAoB,IAAI,SAAY,SAAS,WAAW;AAC5D,uBAAqB;AACrB,sBAAoB;GACpB;AAEF,mBAAkB,SAAS;AAE3B,mBAAkB,WAAW,UAAa;AACxC,oBAAkB,SAAS;AAC3B,oBAAkB,QAAQ;AAC1B,qBAAmB,MAAM;AACzB,cAAY,MAAM;;AAGpB,mBAAkB,UAAU,MAAM;AAChC,oBAAkB,SAAS;AAC3B,oBAAkB,EAAE;;AAGtB,QAAO;;;;;;AAOT,SAAgB,sBAAsB,OAAqB;AAIzD,KAAI,OAAO,OAAO,YAAY,SAAU,QAAO;AAC/C,QACE,MAAM,QAAQ,WAAW,8CAA8C,IACvE,MAAM,QAAQ,WAAW,4CAA4C,IACrE,MAAM,QAAQ,WAAW,mCAAmC;;AAIhE,SAAgB,UACd,OAC8B;AAC9B,QAAO,QACL,SACA,OAAO,UAAU,YACjB,OAAQ,MAAqB,SAAS,WACvC;;AAGH,SAAgB,SACd,OACA,WACe;AACf,MAAK,IAAI,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;EAC1C,MAAM,OAAO,MAAM;AACnB,MAAI,UAAU,KAAK,CAAE,QAAO;;;;;;;;AAUhC,SAAS,oBAAoB,SAAyB;AAIpD,QAAO,QAAQ,QAAQ,oBAAoB,GAAG;;AAGhD,SAAS,cAAc,SAAyB;CAC9C,IAAI;AACJ,KAAI;AACF,YAAU,UAAU,QAAQ;SACtB;AAEN,YAAU,QAAQ,WAAW,mBAAmB,UAAU;AACxD,OAAI;AACF,WAAO,UAAU,MAAM;WACjB;AACN,WAAO;;IAET;;AAEJ,QAAO,oBAAoB,QAAQ;;;;;;AAOrC,MAAa,6BAA6B;CAExC;CACA;CAGA;CACA;CACD;;;;;;;;;;;;;;;;AAiBD,SAAgB,oBACd,KACA,WACS;AACT,KAAI,CAAC,IAAK,QAAO;AAEjB,KAAI;EAGF,MAAM,SAAS,IAAI,IAAI,IAAI;AAC3B,SAAO,CAAC,UAAU,IAAI,OAAO,SAAS;SAChC;AAGN,SAAO;;;AAMX,MAAM,qBAAkD;CACtD,KAAK;CACL,KAAK;CACL,KAAK;CACL,UAAU;CACV,UAAU;CACX;AAED,MAAM,oBAAoB;;;;;;;;AAS1B,SAAgB,WAAW,KAAqB;AAC9C,QAAO,IAAI,QAAQ,oBAAoB,UAAU,mBAAmB,OAAQ;;AAG9E,SAAgB,WAAW,MAAc;AACvC,KAAI,CAAC,KAAM,QAAO;EAAE;EAAM,4BAA4B;EAAO;AAO7D,KAAI,CAAC,qBAAqB,KAAK,KAAK,IAAI,CAAC,KAAK,WAAW,KAAK,CAC5D,QAAO;EAAE;EAAM,4BAA4B;EAAO;CAGpD,MAAM,KAAK;CACX,IAAI,SAAS;CACb,IAAI,SAAS;CACb,IAAI;AACJ,QAAO,UAAU,QAAQ,GAAG,KAAK,KAAK,GAAG;AACvC,YAAU,cAAc,KAAK,MAAM,QAAQ,MAAM,MAAM,CAAC,GAAG,MAAM;AACjE,WAAS,GAAG;;AAEd,UAAS,SAAS,cAAc,SAAS,KAAK,MAAM,OAAO,GAAG,KAAK;CAKnE,IAAI,6BAA6B;AACjC,KAAI,OAAO,WAAW,KAAK,EAAE;AAC3B,+BAA6B;AAC7B,WAAS,MAAM,OAAO,QAAQ,QAAQ,GAAG;;AAG3C,QAAO;EAAE,MAAM;EAAQ;EAA4B;;;;;;;;;;;;;;;;;;;;;AAsBrD,SAAgB,kBAAkB,MAAsB;AAKtD,KAAI,CAAC,sBAAsB,KAAK,KAAK,CAAE,QAAO;AAG9C,QAAO,KAAK,QAAQ,yBAAyB,mBAAmB;;;;;;;;;;;AAYlE,SAAgB,kBACd,UACA,UACQ;CAER,MAAM,kBAAkB,SAAS,QAAQ,cAAc,GAAG;AAG1D,QAAO,GADoB,oBAAoB,KAAK,KAAK,IAAI,kBAChC,qCAAqC,mBAAmB,SAAS,KAAK,IAAI,CAAC;;AAG1G,SAAgB,YAAe,GAAa,GAAa;AACvD,KAAI,MAAM,EAAG,QAAO;AACpB,KAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAC5B,KAAI,EAAE,OAAO,EAAE,GAAI,QAAO;AAE5B,QAAO"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@benjavicente/router-core",
-  "version": "1.168.9",
+  "version": "1.169.2",
   "description": "Modern and scalable routing for React applications",
   "author": "Tanner Linsley",
   "license": "MIT",
@@ -167,21 +167,17 @@
     "node": ">=20.19"
   },
   "dependencies": {
-    "cookie-es": "^2.0.0",
-    "seroval": "^1.4.2",
-    "seroval-plugins": "^1.4.2",
+    "cookie-es": "^3.0.0",
+    "seroval": "^1.5.4",
+    "seroval-plugins": "^1.5.4",
     "@benjavicente/history": "1.161.6"
   },
   "devDependencies": {
-    "@tanstack/intent": "^0.0.14",
     "@tanstack/store": "^0.9.3",
     "@types/node": "25.0.9",
     "esbuild": "^0.27.4",
     "vite": "*"
   },
-  "bin": {
-    "intent": "./bin/intent.js"
-  },
   "scripts": {
     "clean": "rimraf ./dist && rimraf ./coverage",
     "test:eslint": "eslint ./src",

package/skills/router-core/auth-and-guards/SKILL.md

@@ -21,6 +21,10 @@ sources:
 
 # Auth and Guards
 
+> **This skill covers the routing side of auth.** For the **server-side primitives** — session cookies (`HttpOnly`/`Secure`/`SameSite`), `useSession`-style helpers, OAuth `state` + PKCE, password-reset enumeration defense, CSRF, rate limiting — see [start-core/auth-server-primitives](../../../../start-client-core/skills/start-core/auth-server-primitives/SKILL.md). The two skills are designed to be used together.
+>
+> **CRITICAL**: A route guard (`beforeLoad`) does NOT protect a `createServerFn` declared on that route. Server functions are RPC endpoints reachable by direct POST regardless of which route renders them. See "Route guards do not protect server functions" below.
+
 ## Setup
 
 Protect routes with `beforeLoad` + `redirect()` in a pathless layout route (`_authenticated`):
@@ -371,6 +375,41 @@ export const Route = createFileRoute('/_authenticated')({
 
 ## Common Mistakes
 
+### CRITICAL: Route guards do not protect server functions
+
+A `beforeLoad` redirect protects the **route's UI**, not the **server functions** declared on it. `createServerFn` produces an RPC endpoint reachable by direct POST regardless of which route renders the calling UI. An attacker doesn't have to load `/_authenticated/orders` — they can curl the RPC endpoint directly.
+
+```tsx
+// WRONG — handler has no auth check; the route guard doesn't help
+import { createServerFn } from '@benjavicente/react-start'
+import { createFileRoute, redirect } from '@benjavicente/react-router'
+
+const getMyOrders = createServerFn({ method: 'GET' }).handler(async () => {
+  return db.orders.findMany() // ← anyone can hit the RPC
+})
+
+export const Route = createFileRoute('/_authenticated/orders')({
+  beforeLoad: ({ context }) => {
+    if (!context.auth.isAuthenticated) throw redirect({ to: '/login' })
+  },
+  loader: () => getMyOrders(),
+})
+```
+
+```tsx
+// CORRECT — auth enforced on the handler itself, via middleware
+import { createServerFn } from '@benjavicente/react-start'
+import { authMiddleware } from '~/server/auth-middleware'
+
+const getMyOrders = createServerFn({ method: 'GET' })
+  .middleware([authMiddleware])
+  .handler(async ({ context }) => {
+    return db.orders.findMany({ where: { userId: context.session.userId } })
+  })
+```
+
+Rule of thumb: every `createServerFn` that touches user data needs `authMiddleware` (or an equivalent in-handler check). The route guard is for the page experience; the RPC guard is for the data. See [start-core/auth-server-primitives](../../../../start-client-core/skills/start-core/auth-server-primitives/SKILL.md) for the full session/middleware pattern.
+
 ### HIGH: Auth check in component instead of beforeLoad
 
 Component-level auth checks cause a **flash of protected content** before the redirect:
@@ -456,3 +495,5 @@ Place protected routes as children of the `_authenticated` layout route. Public
 ## Cross-References
 
 - See also: **router-core/data-loading/SKILL.md** — `beforeLoad` runs before `loader`; auth context flows into loader via route context
+- See also: **start-core/auth-server-primitives/SKILL.md** — server-side session cookies, OAuth state + PKCE, CSRF, password-reset hardening, rate limiting (the server half of authentication)
+- See also: **start-core/middleware/SKILL.md** — `authMiddleware` factory pattern for protecting individual `createServerFn` calls

package/skills/router-core/ssr/SKILL.md

@@ -391,22 +391,74 @@ component: () => {
 }
 ```
 
-### 3. CRITICAL: Generating Next.js or Remix SSR patterns
+### 3. CRITICAL: Generating Next.js, Remix, or React Router DOM patterns
 
-TanStack Router does NOT use `getServerSideProps`, `getStaticProps`, App Router `page.tsx`, or Remix-style server-only `loader` exports.
+TanStack Router does NOT use `getServerSideProps`, `getStaticProps`, App Router `page.tsx`, Remix-style server-only `loader` exports, or anything from `react-router-dom`.
+
+#### Wrong file structures
+
+```text
+WRONG (Next.js Pages Router):
+  src/pages/index.tsx
+  src/pages/_app.tsx
+  src/pages/posts/[id].tsx
+
+WRONG (Next.js App Router):
+  app/layout.tsx
+  app/page.tsx
+  app/posts/[id]/page.tsx
+
+WRONG (Next.js custom App):
+  _app/index.tsx
+  pages/_app.tsx, pages/_document.tsx
+
+CORRECT (TanStack Router file-based routing):
+  src/routes/__root.tsx
+  src/routes/index.tsx
+  src/routes/posts/$postId.tsx
+```
+
+#### Wrong imports
 
 ```tsx
-// WRONG — Next.js patterns
+// WRONG — react-router-dom is a different library
+import {
+  Link,
+  useNavigate,
+  BrowserRouter,
+  Route,
+  Routes,
+} from 'react-router-dom'
+
+// WRONG — Next.js Link/router
+import Link from 'next/link'
+import { useRouter } from 'next/router' // Pages Router
+import { useRouter } from 'next/navigation' // App Router
+
+// CORRECT — everything routing-related lives in @benjavicente/react-router
+import {
+  Link,
+  useNavigate,
+  useRouter,
+  useLocation,
+  redirect,
+} from '@benjavicente/react-router'
+```
+
+#### Wrong loader/data-fetching patterns
+
+```tsx
+// WRONG — Next.js Pages Router
 export async function getServerSideProps() {
   return { props: { data: await fetchData() } }
 }
 
-// WRONG — Remix patterns
+// WRONG — Remix
 export async function loader({ request }: LoaderFunctionArgs) {
   return json({ data: await fetchData() })
 }
 
-// CORRECT — TanStack Router pattern
+// CORRECT — TanStack Router
 export const Route = createFileRoute('/data')({
   loader: async () => {
     const data = await fetchData()
@@ -421,6 +473,8 @@ function DataPage() {
 }
 ```
 
+If you see `src/pages/`, `app/layout.tsx`, `react-router-dom`, or any of the above in agent output, the agent is generating for the wrong framework. The build will either fail or produce duplicate `/` routes that conflict at runtime.
+
 ## Tension: Client-First Loaders vs SSR
 
 TanStack Router loaders are client-first by design. When SSR is enabled, they run in both environments. This means:

package/skills/router-core/type-safety/SKILL.md

@@ -313,7 +313,9 @@ export function NavItem(props: NavItemProps): React.ReactNode {
 <NavItem label="Post" linkOptions={{ to: '/posts/$postId', params: { postId: '1' } }} />
 ```
 
-### `ValidateNavigateOptions` — Type-Safe Navigate in Utilities
+### `ValidateNavigateOptions` and `ValidateRedirectOptions`
+
+Same pattern as `ValidateLinkOptions` above, for `useNavigate` and `redirect`. Declare a generic public overload plus a non-generic implementation signature so the call site stays narrowed and the body works without casts:
 
 ```tsx
 import {
@@ -332,45 +334,15 @@ export function useDelayedNavigate<
 export function useDelayedNavigate(
   options: ValidateNavigateOptions,
   delayMs: number,
-): () => void {
+) {
   const navigate = useNavigate()
   return () => {
     setTimeout(() => navigate(options), delayMs)
   }
 }
-
-// Usage — type-safe
-const go = useDelayedNavigate(
-  { to: '/posts/$postId', params: { postId: '1' } },
-  500,
-)
 ```
 
-### `ValidateRedirectOptions` — Type-Safe Redirect in Utilities
-
-```tsx
-import {
-  redirect,
-  type RegisteredRouter,
-  type ValidateRedirectOptions,
-} from '@benjavicente/react-router'
-
-export async function fetchOrRedirect<
-  TRouter extends RegisteredRouter = RegisteredRouter,
-  TOptions = unknown,
->(
-  url: string,
-  redirectOptions: ValidateRedirectOptions<TRouter, TOptions>,
-): Promise<unknown>
-export async function fetchOrRedirect(
-  url: string,
-  redirectOptions: ValidateRedirectOptions,
-): Promise<unknown> {
-  const response = await fetch(url)
-  if (!response.ok && response.status === 401) throw redirect(redirectOptions)
-  return response.json()
-}
-```
+`ValidateRedirectOptions` works identically — declare a generic overload accepting `ValidateRedirectOptions<TRouter, TOptions>` and an impl signature accepting `ValidateRedirectOptions`, then call `redirect(options)` in the body.
 
 ### Render Props for Maximum Performance
 
@@ -477,21 +449,44 @@ declare module '@benjavicente/react-router' {
 }
 ```
 
-### 5. CRITICAL (cross-skill): Generating Next.js or Remix patterns
+### 5. CRITICAL (cross-skill): Wrong-framework imports and file structure
+
+Wrong-framework code looks plausible (it's React) but breaks the build or produces conflicting `/` routes at runtime.
 
 ```tsx
-// WRONG — these are NOT TanStack Router APIs
-export async function getServerSideProps() { ... }
-export async function loader({ request }) { ... } // Remix-style
-const [searchParams, setSearchParams] = useSearchParams() // React Router
+// WRONG — react-router-dom and next/* are different libraries
+import { Link, useNavigate, useSearchParams } from 'react-router-dom'
+import Link from 'next/link'
+import { useRouter, useParams } from 'next/navigation'
 
-// CORRECT — TanStack Router APIs
+// CORRECT — all routing exports come from @benjavicente/react-router
+import {
+  Link,
+  Outlet,
+  useNavigate,
+  useRouter,
+  useLocation,
+  useParams,
+  redirect,
+} from '@benjavicente/react-router'
+```
+
+```tsx
+// WRONG file structures + APIs:
+//   src/pages/*.tsx with getServerSideProps / getStaticProps  (Next.js Pages Router)
+//   app/layout.tsx + app/page.tsx                              (Next.js App Router)
+//   _app/index.tsx, pages/_app.tsx, pages/_document.tsx        (Next.js custom App)
+//   loader/action exports                                       (Remix)
+
+// CORRECT — TanStack file-based routing at src/routes/*.tsx
 export const Route = createFileRoute('/posts')({
-  loader: async () => { ... },           // TanStack loader
-  validateSearch: zodValidator(schema),   // TanStack search validation
+  loader: async () => { ... },
+  validateSearch: zodValidator(schema),
   component: PostsComponent,
 })
-const search = Route.useSearch()          // TanStack hook
+const search = Route.useSearch()
 ```
 
+If a build error mentions `react-router-dom`, `next/`, `pages/_app`, or duplicate `/` routes, fix the import — don't paper over with type assertions.
+
 See also: router-core (Register setup), router-core/navigation (from narrowing), router-core/code-splitting (getRouteApi).

package/src/hash-scroll.ts

@@ -7,7 +7,7 @@ import type { AnyRouter } from './router'
  */
 export function handleHashScroll(router: AnyRouter) {
   if (typeof document !== 'undefined' && (document as any).querySelector) {
-    const location = router.stores.location.state
+    const location = router.stores.location.get()
     const hashScrollIntoViewOptions =
       location.state.__hashScrollIntoViewOptions ?? true
 

package/src/index.ts

@@ -75,7 +75,13 @@ export type {
   AssetCrossOriginConfig,
   ManifestAssetLink,
 } from './manifest'
-export { getAssetCrossOrigin, resolveManifestAssetLink } from './manifest'
+export {
+  createInlineCssStyleAsset,
+  getAssetCrossOrigin,
+  getStylesheetHref,
+  isInlinableStylesheet,
+  resolveManifestAssetLink,
+} from './manifest'
 export { isMatch } from './Matches'
 export type {
   AnyMatchAndValue,
@@ -285,6 +291,7 @@ export type { OptionalStructuralSharing } from './structuralSharing'
 
 export {
   functionalUpdate,
+  hasKeys,
   replaceEqualDeep,
   isPlainObject,
   isPlainArray,
@@ -437,7 +444,6 @@ export type {
   AnySerializationAdapter,
   SerializationAdapter,
   ValidateSerializableInput,
-  ValidateSerializableInputResult,
   SerializerExtensions,
   ValidateSerializable,
   RegisteredSerializableInput,
@@ -446,6 +452,7 @@ export type {
   Serializable,
   TSR_SERIALIZABLE,
   TsrSerializable,
+  SerializationError,
 } from './ssr/serializer/transformer'
 
 export {

package/src/load-matches.ts

@@ -45,15 +45,13 @@ const triggerOnReady = (inner: InnerLoadContext): void | Promise<void> => {
 }
 
 const hasForcePendingActiveMatch = (router: AnyRouter): boolean => {
-  return router.stores.matchesId.state.some((matchId) => {
-    return router.stores.activeMatchStoresById.get(matchId)?.state._forcePending
+  return router.stores.matchesId.get().some((matchId) => {
+    return router.stores.matchStores.get(matchId)?.get()._forcePending
   })
 }
 
 const resolvePreload = (inner: InnerLoadContext, matchId: string): boolean => {
-  return !!(
-    inner.preload && !inner.router.stores.activeMatchStoresById.has(matchId)
-  )
+  return !!(inner.preload && !inner.router.stores.matchStores.has(matchId))
 }
 
 /**
@@ -138,9 +136,11 @@ const handleRedirectAndNotFound = (
       ...prev,
       status: isRedirect(err)
         ? 'redirected'
-        : prev.status === 'pending'
-          ? 'success'
-          : prev.status,
+        : isNotFound(err)
+          ? 'notFound'
+          : prev.status === 'pending'
+            ? 'success'
+            : prev.status,
       context: buildMatchContext(inner, match.index),
       isFetching: false,
       error: err,
@@ -713,7 +713,7 @@ const runLoader = async (
       const pendingPromise = match._nonReactive.minPendingPromise
       if (pendingPromise) await pendingPromise
 
-      // Last but not least, wait for the the components
+      // Last but not least, wait for the components
       // to be preloaded before we resolve the match
       if (route._componentsPromise) await route._componentsPromise
       inner.updateMatch(matchId, (prev) => ({
@@ -879,17 +879,16 @@ const loadRouteMatch = async (
     }
   } else {
     const prevMatch = inner.router.getMatch(matchId)! // This is where all of the stale-while-revalidate magic happens
-    const activeIdAtIndex = inner.router.stores.matchesId.state[index]
+    const activeIdAtIndex = inner.router.stores.matchesId.get()[index]
     const activeAtIndex =
       (activeIdAtIndex &&
-        inner.router.stores.activeMatchStoresById.get(activeIdAtIndex)) ||
+        inner.router.stores.matchStores.get(activeIdAtIndex)) ||
       null
     const previousRouteMatchId =
       activeAtIndex?.routeId === routeId
         ? activeIdAtIndex
-        : inner.router.stores.activeMatchesSnapshot.state.find(
-            (d) => d.routeId === routeId,
-          )?.id
+        : inner.router.stores.matches.get().find((d) => d.routeId === routeId)
+            ?.id
     const preload = resolvePreload(inner, matchId)
 
     // there is a loaderPromise, so we are in the middle of a load
@@ -923,7 +922,7 @@ const loadRouteMatch = async (
       }
     } else {
       const nextPreload =
-        preload && !inner.router.stores.activeMatchStoresById.has(matchId)
+        preload && !inner.router.stores.matchStores.has(matchId)
       const match = inner.router.getMatch(matchId)!
       match._nonReactive.loaderPromise = createControlledPromise<void>()
       if (nextPreload !== match.preload) {

package/src/manifest.ts

@@ -35,6 +35,9 @@ export function resolveManifestAssetLink(link: ManifestAssetLink) {
 }
 
 export type Manifest = {
+  inlineCss?: {
+    styles: Record<string, string>
+  }
   routes: Record<
     string,
     {
@@ -65,4 +68,47 @@ export type RouterManagedTag =
       tag: 'style'
       attrs?: Record<string, any>
       children?: string
+      inlineCss?: true
     }
+
+export function getStylesheetHref(asset: RouterManagedTag) {
+  if (asset.tag !== 'link') return undefined
+
+  const rel = asset.attrs?.rel
+  const href = asset.attrs?.href
+  if (typeof href !== 'string') return undefined
+
+  const relTokens = typeof rel === 'string' ? rel.split(/\s+/) : []
+  if (!relTokens.includes('stylesheet')) return undefined
+
+  return href
+}
+
+export function isInlinableStylesheet(
+  manifest: Manifest | undefined,
+  asset: RouterManagedTag,
+) {
+  const href = getStylesheetHref(asset)
+  return !!href && manifest?.inlineCss?.styles[href] !== undefined
+}
+
+export function createInlineCssStyleAsset(css: string): RouterManagedTag {
+  return {
+    tag: 'style',
+    attrs: {
+      suppressHydrationWarning: true,
+    },
+    inlineCss: true,
+    children: css,
+  }
+}
+
+export function createInlineCssPlaceholderAsset(): RouterManagedTag {
+  return {
+    tag: 'style',
+    attrs: {
+      suppressHydrationWarning: true,
+    },
+    inlineCss: true,
+  }
+}