@hot-updater/console 0.36.15 → 0.36.17

package/.output/server/_libs/tanstack__history.mjs

@@ -1,7 +1,25 @@
-//#region ../../node_modules/.pnpm/@tanstack+history@1.162.0/node_modules/@tanstack/history/dist/esm/index.js
+//#region ../../node_modules/.pnpm/@tanstack+history@1.162.4/node_modules/@tanstack/history/dist/esm/index.js
 var stateIndexKey = "__TSR_index";
 var popStateEvent = "popstate";
 var beforeUnloadEvent = "beforeunload";
+/**
+* Turn protocol-relative inputs such as "//evil.example" into paths
+* such as "/evil.example", keeping navigation on the current origin.
+*
+* For HTTP(S) URLs, WHATWG parsing ignores leading C0 controls and spaces,
+* removes tabs/newlines, and treats backslashes as slashes, so inputs like
+* "/\evil.example" also need normalization. This only allocates when those
+* rules would make the input protocol-relative.
+*/
+var protocolRelativePrefix = /^[\x00-\x20]*(?:[\\/][\t\n\r]*){2,}/;
+function normalizeProtocolRelative(url) {
+	const match = protocolRelativePrefix.exec(url);
+	return match ? "/" + url.slice(match[0].length) : url;
+}
+function normalizeHref(href) {
+	if (/[\x00-\x1f\x7f]/.test(href)) href = href.replace(/[\x00-\x1f\x7f]/g, (character) => "	\n\r".includes(character) ? "" : encodeURIComponent(character));
+	return normalizeProtocolRelative(href);
+}
 function createHistory(opts) {
 	let location = opts.getLocation();
 	const subscribers = /* @__PURE__ */ new Set();
@@ -81,7 +99,7 @@ function createHistory(opts) {
 		go: (index, navigateOpts) => {
 			tryNavigation({
 				task: () => {
-					opts.go(index);
+					opts.go(index, navigateOpts?.ignoreBlocker ?? false);
 					handleIndexChange({
 						type: "GO",
 						index
@@ -124,11 +142,11 @@ function createHistory(opts) {
 		},
 		flush: () => opts.flush?.(),
 		destroy: () => opts.destroy?.(),
-		notify
+		notify,
+		_getBlockers: () => opts.getBlockers?.() ?? []
 	};
 }
 function assignKeyAndIndex(index, state) {
-	if (!state) state = {};
 	const key = createRandomKey();
 	return {
 		...state,
@@ -160,7 +178,7 @@ function createBrowserHistory(opts) {
 	let blockers = [];
 	const _getBlockers = () => blockers;
 	const _setBlockers = (newBlockers) => blockers = newBlockers;
-	const createHref = opts?.createHref ?? ((path) => path);
+	const createHref = (path) => normalizeHref(opts?.createHref ? opts.createHref(path) : path);
 	const parseLocation = opts?.parseLocation ?? (() => parseHref(`${win.location.pathname}${win.location.search}${win.location.hash}`, win.history.state));
 	if (!win.history.state?.__TSR_key && !win.history.state?.key) {
 		const addedKey = createRandomKey();
@@ -178,32 +196,32 @@ function createBrowserHistory(opts) {
 	let ignoreNextBeforeUnload = false;
 	const getLocation = () => currentLocation;
 	let next;
-	let scheduled;
 	const flush = () => {
 		if (!next) return;
 		history._ignoreSubscribers = true;
-		(next.isPush ? win.history.pushState : win.history.replaceState)(next.state, "", next.href);
+		(next[2] ? win.history.pushState : win.history.replaceState)(next[1], "", next[0]);
 		history._ignoreSubscribers = false;
 		next = void 0;
-		scheduled = void 0;
 		rollbackLocation = void 0;
 	};
-	const queueHistoryAction = (type, destHref, state) => {
-		const href = createHref(destHref);
-		if (!scheduled) rollbackLocation = currentLocation;
+	const queueHistoryAction = (isPush, destHref, state) => {
+		const href = opts?.createHref ? createHref(destHref) : void 0;
+		const hasPendingAction = !!next;
+		if (!hasPendingAction) rollbackLocation = currentLocation;
 		currentLocation = parseHref(destHref, state);
-		next = {
-			href,
+		next = [
+			href ?? currentLocation.href,
 			state,
-			isPush: next?.isPush || type === "push"
-		};
-		if (!scheduled) scheduled = Promise.resolve().then(() => flush());
+			next?.[2] || isPush
+		];
+		if (!hasPendingAction) queueMicrotask(() => flush());
 	};
 	const onPushPop = (type) => {
 		currentLocation = parseLocation();
 		history.notify({ type });
 	};
 	const onPushPopEvent = async () => {
+		ignoreNextBeforeUnload = false;
 		if (ignoreNextPop) {
 			ignoreNextPop = false;
 			return;
@@ -229,7 +247,7 @@ function createBrowserHistory(opts) {
 					action
 				})) {
 					ignoreNextPop = true;
-					win.history.go(1);
+					win.history.go(-delta);
 					history.notify(notify);
 					return;
 				}
@@ -264,20 +282,28 @@ function createBrowserHistory(opts) {
 	const history = createHistory({
 		getLocation,
 		getLength: () => win.history.length,
-		pushState: (href, state) => queueHistoryAction("push", href, state),
-		replaceState: (href, state) => queueHistoryAction("replace", href, state),
+		pushState: (href, state) => queueHistoryAction(true, href, state),
+		replaceState: (href, state) => queueHistoryAction(false, href, state),
 		back: (ignoreBlocker) => {
-			if (ignoreBlocker) skipBlockerNextPop = true;
-			ignoreNextBeforeUnload = true;
+			if (ignoreBlocker) {
+				skipBlockerNextPop = true;
+				ignoreNextBeforeUnload = true;
+			}
 			return win.history.back();
 		},
 		forward: (ignoreBlocker) => {
-			if (ignoreBlocker) skipBlockerNextPop = true;
-			ignoreNextBeforeUnload = true;
+			if (ignoreBlocker) {
+				skipBlockerNextPop = true;
+				ignoreNextBeforeUnload = true;
+			}
 			win.history.forward();
 		},
-		go: (n) => {
+		go: (n, ignoreBlocker) => {
 			nextPopIsGo = true;
+			if (ignoreBlocker) {
+				skipBlockerNextPop = true;
+				ignoreNextBeforeUnload = true;
+			}
 			win.history.go(n);
 		},
 		createHref: (href) => createHref(href),
@@ -295,6 +321,13 @@ function createBrowserHistory(opts) {
 		setBlockers: _setBlockers,
 		notifyOnIndexChange: false
 	});
+	history._ignoreNextBeforeUnload = (href) => {
+		ignoreNextBeforeUnload = false;
+		try {
+			href = new URL(href, win.document.baseURI).href;
+			ignoreNextBeforeUnload = /^https?:/.test(href) && (!href.includes("#") || href.split("#")[0] !== win.location.href.split("#")[0]);
+		} catch {}
+	};
 	win.addEventListener(beforeUnloadEvent, onBeforeUnload, { capture: true });
 	win.addEventListener(popStateEvent, onPushPopEvent);
 	win.history.pushState = function(...args) {
@@ -309,34 +342,28 @@ function createBrowserHistory(opts) {
 	};
 	return history;
 }
-/**
-* Sanitize a path to prevent open redirect vulnerabilities.
-* Removes control characters and collapses leading double slashes.
-*/
-function sanitizePath(path) {
-	let sanitized = path.replace(/[\x00-\x1f\x7f]/g, "");
-	if (sanitized.startsWith("//")) sanitized = "/" + sanitized.replace(/^\/+/, "");
-	return sanitized;
-}
 function parseHref(href, state) {
-	const sanitizedHref = sanitizePath(href);
+	const sanitizedHref = normalizeHref(href);
 	const hashIndex = sanitizedHref.indexOf("#");
 	const searchIndex = sanitizedHref.indexOf("?");
-	const addedKey = createRandomKey();
+	if (!state) {
+		const key = createRandomKey();
+		state = {
+			[stateIndexKey]: 0,
+			key,
+			__TSR_key: key
+		};
+	}
 	return {
 		href: sanitizedHref,
 		pathname: sanitizedHref.substring(0, hashIndex > 0 ? searchIndex > 0 ? Math.min(hashIndex, searchIndex) : hashIndex : searchIndex > 0 ? searchIndex : sanitizedHref.length),
 		hash: hashIndex > -1 ? sanitizedHref.substring(hashIndex) : "",
 		search: searchIndex > -1 ? sanitizedHref.slice(searchIndex, hashIndex === -1 ? void 0 : hashIndex) : "",
-		state: state || {
-			[stateIndexKey]: 0,
-			key: addedKey,
-			__TSR_key: addedKey
-		}
+		state
 	};
 }
 function createRandomKey() {
 	return (Math.random() + 1).toString(36).substring(7);
 }
 //#endregion
-export { parseHref as n, createBrowserHistory as t };
+export { normalizeProtocolRelative as n, parseHref as r, createBrowserHistory as t };