@rangojs/router 0.0.0-experimental.124 → 0.0.0-experimental.126

package/src/router/middleware.ts

@@ -1,13 +1,4 @@
 /// <reference types="vite/types/importMeta.d.ts" />
-/**
- * Middleware Execution
- *
- * True middleware that wraps the entire RSC handler.
- * - `await next()` returns actual Response
- * - Can modify response headers
- * - Can catch errors from RSC rendering
- * - Forgiving API: if middleware doesn't return, original response is used
- */
 
 import { contextGet, contextSet } from "../context-var.js";
 import { safeDecodeURIComponent } from "./url-params.js";
@@ -21,28 +12,28 @@ import type {
   ResponseHolder,
 } from "./middleware-types.js";
 import { _getRequestContext } from "../server/request-context.js";
+import {
+  EXTERNAL_REDIRECT_MARKER,
+  isExternalRedirect,
+  markExternalRedirect,
+} from "../redirect-origin.js";
 import { isAutoGeneratedRouteName } from "../route-name.js";
 import { appendMetric, createMetricsStore } from "./metrics.js";
 import { stripInternalParams } from "./handler-context.js";
 import { isWebSocketUpgradeResponse } from "../response-utils.js";
 
-// Re-export types and cookie utilities for backward compatibility
+// Re-export types consumed through this module's path.
 export type {
   CookieOptions,
-  CollectedMiddleware,
-  MiddlewareCollectableEntry,
   MiddlewareContext,
   MiddlewareEntry,
   MiddlewareFn,
-  ResponseHolder,
 } from "./middleware-types.js";
-export { parseCookies, serializeCookie } from "./middleware-cookies.js";
 
 const MIDDLEWARE_METRIC_DEPTH = 1;
-/** Ignore post-next() durations below this threshold (measurement noise). */
 const POST_METRIC_MIN_DURATION_MS = 0.01;
 
-function getMiddlewareMetricBase<TEnv>(
+function getMiddlewareMetricLabel<TEnv>(
   entry: MiddlewareEntry<TEnv>,
   ordinal: number,
 ): string {
@@ -50,23 +41,12 @@ function getMiddlewareMetricBase<TEnv>(
   const scope = entry.pattern ?? "*";
 
   if (handlerName) {
-    return `${handlerName}@${scope}`;
+    return `middleware:${handlerName}@${scope}`;
   }
 
-  return `${scope}#${ordinal + 1}`;
+  return `middleware:${scope}#${ordinal + 1}`;
 }
 
-function getMiddlewareMetricLabel<TEnv>(
-  entry: MiddlewareEntry<TEnv>,
-  ordinal: number,
-): string {
-  return `middleware:${getMiddlewareMetricBase(entry, ordinal)}`;
-}
-
-/**
- * Parse a route pattern into regex and param names
- * Supports: *, /path, /path/*, /path/:param, /path/:param/*
- */
 export function parsePattern(pattern: string): {
   regex: RegExp;
   paramNames: string[];
@@ -261,9 +241,13 @@ export function createMiddlewareContext<TEnv>(
 
     reverse:
       reverse ??
-      ((name: string) => {
+      ((
+        name: string,
+        _params?: Record<string, string>,
+        _search?: Record<string, unknown>,
+      ) => {
         throw new Error(
-          `ctx.reverse() is not available - route map was not provided to middleware context`,
+          `ctx.reverse(${JSON.stringify(name)}) is not available: no route map is bound to this middleware context.`,
         );
       }),
 
@@ -316,6 +300,10 @@ function mergeStubHeaders(
   stubOverridesNonCookie: boolean,
 ): void {
   stub.forEach((value, name) => {
+    // The reserved external-redirect marker is internal and never a trust
+    // signal; never copy a stub value (e.g. a stray ctx.header() call) onto a
+    // browser-facing response. The opt-in is the out-of-band brand.
+    if (name.toLowerCase() === EXTERNAL_REDIRECT_MARKER) return;
     if (name.toLowerCase() === "set-cookie") {
       target.append(name, value);
     } else if (stubOverridesNonCookie || !target.has(name)) {
@@ -341,12 +329,50 @@ function mergeReqCtxStub(
     }
   }
   reqCtx.res.headers.forEach((value, name) => {
+    // Never propagate the reserved external-redirect marker (see mergeStubHeaders).
+    if (name.toLowerCase() === EXTERNAL_REDIRECT_MARKER) return;
     if (name !== "set-cookie" && !target.has(name)) {
       target.set(name, value);
     }
   });
 }
 
+// Clone `base` with stub headers merged into a fresh Headers (the clone keeps
+// the body mutable for post-next() modifications). Set-Cookie is always
+// appended; other headers obey stubOverridesNonCookie (see mergeStubHeaders).
+// mergeReqCtx folds in RequestContext stub cookies/headers; the intercept
+// short-circuit path passes false (its reqCtx headers are not merged here),
+// which is the one deliberate divergence between the call sites.
+function mergeResponse(
+  base: Response,
+  stub: Headers,
+  opts: { stubOverridesNonCookie: boolean; mergeReqCtx: boolean },
+): Response {
+  const mergedHeaders = new Headers(base.headers);
+  // The reserved external-redirect marker is never a trust signal and must never
+  // reach the browser. The guard strips it on 3xx redirects; strip it here too so
+  // a forged value cannot ride a non-3xx middleware response (which the 3xx-only
+  // guard would not touch) to the client. The opt-in is the out-of-band brand.
+  mergedHeaders.delete(EXTERNAL_REDIRECT_MARKER);
+  mergeStubHeaders(mergedHeaders, stub, opts.stubOverridesNonCookie);
+  if (opts.mergeReqCtx) {
+    mergeReqCtxStub(mergedHeaders, _getRequestContext());
+  }
+  const merged = new Response(base.body, {
+    status: base.status,
+    statusText: base.statusText,
+    headers: mergedHeaders,
+  });
+  // Transfer the out-of-band external-redirect brand across this rebuild: a
+  // middleware short-circuit `return redirect(url, { external: true })` reaches
+  // the open-redirect guard only after this merge, and the brand lives on the
+  // Response object, not in its headers.
+  if (isExternalRedirect(base)) {
+    markExternalRedirect(merged);
+  }
+  return merged;
+}
+
 /**
  * Execute middleware chain
  *
@@ -355,7 +381,7 @@ function mergeReqCtxStub(
  * - `ctx.headers` available before and after `await next()`
  * - `ctx.header()` shorthand for setting a single header
  * - Forgiving: if middleware doesn't return, uses the downstream response
- * - Short-circuit: return Response to stop chain
+ * - Short-circuit: return OR throw a Response to stop chain
  * - Error catching: try/catch around `next()` works
  */
 export async function executeMiddleware<TEnv>(
@@ -385,20 +411,16 @@ export async function executeMiddleware<TEnv>(
       // End of chain - call actual RSC handler
       const response = await finalHandler();
 
-      const mergedHeaders = new Headers(response.headers);
-      mergeStubHeaders(mergedHeaders, stubResponse.headers, true);
-      mergeReqCtxStub(mergedHeaders, _getRequestContext());
-
       if (isWebSocketUpgradeResponse(response)) {
         responseHolder.response = response;
         return response;
       }
 
-      // Clone response with merged headers (mutable for post-next() modifications)
-      responseHolder.response = new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: mergedHeaders,
+      // Chain ran to completion: stub headers overwrite (stubOverridesNonCookie)
+      // and reqCtx stub headers are merged in.
+      responseHolder.response = mergeResponse(response, stubResponse.headers, {
+        stubOverridesNonCookie: true,
+        mergeReqCtx: true,
       });
 
       return responseHolder.response;
@@ -490,20 +512,18 @@ export async function executeMiddleware<TEnv>(
 
     // Explicit return takes precedence (middleware short-circuit).
     // Merge stub headers (from ctx.header before this point) and
-    // RequestContext stub headers (from ctx.setCookie) into the
+    // RequestContext stub headers (from cookies().set()) into the
     // returned Response so they are not lost.
     if (result instanceof Response) {
       if (isWebSocketUpgradeResponse(result)) {
         responseHolder.response = result;
         return result;
       }
-      const mergedHeaders = new Headers(result.headers);
-      mergeStubHeaders(mergedHeaders, stubResponse.headers, false);
-      mergeReqCtxStub(mergedHeaders, _getRequestContext());
-      const merged = new Response(result.body, {
-        status: result.status,
-        statusText: result.statusText,
-        headers: mergedHeaders,
+      // Explicit short-circuit: the returned Response's own headers win
+      // (stubOverridesNonCookie=false); reqCtx stub headers still merge in.
+      const merged = mergeResponse(result, stubResponse.headers, {
+        stubOverridesNonCookie: false,
+        mergeReqCtx: true,
       });
       responseHolder.response = merged;
       return merged;
@@ -564,7 +584,7 @@ export async function executeMiddleware<TEnv>(
  *
  * Intercepts use a shared stubResponse from the request context. This function:
  * - Runs middleware in sequence with a simple next() chain
- * - Returns Response if any middleware short-circuits (returns Response or redirects BEFORE next())
+ * - Returns Response if any middleware short-circuits (returns OR throws a Response, or redirects, BEFORE next())
  * - Returns null if all middleware calls next() - headers set after next() remain on stubResponse
  *
  * @param middlewares - Array of middleware functions
@@ -658,15 +678,13 @@ export async function executeInterceptMiddleware<TEnv>(
     });
 
     if (hasStubHeaders) {
-      // Clone and merge headers from stub into early response.
-      // Only fill in missing headers — the returned Response's explicit
-      // headers take precedence, matching executeMiddleware behavior.
-      const mergedHeaders = new Headers(response.headers);
-      mergeStubHeaders(mergedHeaders, stubResponse.headers, false);
-      return new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: mergedHeaders,
+      // Only fill in missing headers — the returned Response's explicit headers
+      // take precedence (stubOverridesNonCookie=false), matching executeMiddleware.
+      // mergeReqCtx=false: the intercept path deliberately does NOT merge reqCtx
+      // stub headers here (pinned by intercept-middleware-headers.test.ts).
+      return mergeResponse(response, stubResponse.headers, {
+        stubOverridesNonCookie: false,
+        mergeReqCtx: false,
       });
     }
     return response;
@@ -707,7 +725,6 @@ export async function executeLoaderMiddleware<TEnv>(
       regex: null,
       paramNames: [],
       handler,
-      mountPrefix: null,
     } as MiddlewareEntry<TEnv>,
     params,
   }));

package/src/router/navigation-snapshot.ts

@@ -1,58 +1,26 @@
-/**
- * Navigation Snapshot
- *
- * Pure data type representing the navigation-specific state for partial requests.
- * Consolidates the header parsing, previous-route matching, intercept-context
- * detection, and segment ID filtering that previously lived inline in
- * createMatchContextForPartial (match-api.ts).
- *
- * resolveNavigation() is the factory: given a request + URL + current route key,
- * it returns a NavigationSnapshot (or null if no previous URL).
- */
-
 import type { RouteMatchResult } from "./pattern-matching.js";
 
-/**
- * Snapshot of navigation state for a partial (navigation/action) request.
- *
- * Contains the "where are we coming from?" data: previous route, intercept
- * source, client segment state, and derived flags.
- */
 export interface NavigationSnapshot {
-  /** Previous page URL (from X-RSC-Router-Client-Path or Referer) */
   prevUrl: URL;
-  /** Params from the previous route match */
   prevParams: Record<string, string>;
-  /** Previous route match result (null if prev URL doesn't match any route) */
   prevMatch: RouteMatchResult | null;
 
-  /** URL used as intercept context source */
   interceptContextUrl: URL;
-  /** Route match for the intercept context URL */
   interceptContextMatch: RouteMatchResult | null;
 
-  /** Raw segment IDs the client currently has */
   clientSegmentIds: string[];
-  /** Set version for O(1) lookup */
   clientSegmentSet: Set<string>;
-  /** Segment IDs filtered to remove parallel (.@) and loader (D\d+.) entries */
   filteredSegmentIds: string[];
 
-  /** Whether client considers its cache stale */
   stale: boolean;
 
-  /** Whether the intercept context route is the same as the current route */
   isSameRouteNavigation: boolean;
 
-  /** Effective "from" URL (intercept source URL when present, else prevUrl) */
   effectiveFromUrl: URL;
-  /** Effective "from" match (intercept source match when present, else prevMatch) */
   effectiveFromMatch: RouteMatchResult | null;
 
-  /** Whether an intercept source header was present */
   hasInterceptSource: boolean;
 
-  /** Whether an HMR request header was present */
   isHmr: boolean;
 }
 
@@ -60,23 +28,12 @@ export interface ResolveNavigationDeps {
   findMatch: (pathname: string) => RouteMatchResult | null;
 }
 
-/**
- * Resolve navigation state from a partial request.
- *
- * Returns null if no previous URL is available (required for partial navigation).
- *
- * @param request - The incoming HTTP request
- * @param url - Parsed URL of the request
- * @param currentRouteKey - Route key of the current (target) route match
- * @param deps - Dependencies (findMatch)
- */
 export function resolveNavigation(
   request: Request,
   url: URL,
   currentRouteKey: string,
   deps: ResolveNavigationDeps,
 ): NavigationSnapshot | null {
-  // Parse client state from RSC request params/headers
   const clientSegmentIds =
     url.searchParams.get("_rsc_segments")?.split(",").filter(Boolean) || [];
   const stale = url.searchParams.get("_rsc_stale") === "true";
@@ -92,7 +49,6 @@ export function resolveNavigation(
     return null;
   }
 
-  // Parse previous URL
   let prevUrl: URL;
   try {
     prevUrl = new URL(previousUrl, url.origin);
@@ -100,7 +56,6 @@ export function resolveNavigation(
     return null;
   }
 
-  // Parse intercept context URL
   let interceptContextUrl: URL;
   try {
     interceptContextUrl = interceptSourceUrl
@@ -110,14 +65,12 @@ export function resolveNavigation(
     interceptContextUrl = prevUrl;
   }
 
-  // Match previous and intercept context routes
   const prevMatch = deps.findMatch(prevUrl.pathname);
   const prevParams = prevMatch?.params || {};
   const interceptContextMatch = interceptSourceUrl
     ? deps.findMatch(interceptContextUrl.pathname)
     : prevMatch;
 
-  // Derived state
   const isSameRouteNavigation = !!(
     interceptContextMatch && interceptContextMatch.routeKey === currentRouteKey
   );
@@ -128,7 +81,6 @@ export function resolveNavigation(
     ? interceptContextMatch
     : prevMatch;
 
-  // Filter segment IDs: remove parallel (.@) and loader (D\d+.) entries
   const filteredSegmentIds = clientSegmentIds.filter((id) => {
     if (id.includes(".@")) return false;
     if (/D\d+\./.test(id)) return false;
@@ -155,9 +107,6 @@ export function resolveNavigation(
   };
 }
 
-/**
- * Test helper: create a NavigationSnapshot with sensible defaults and overrides.
- */
 export function createNavigationSnapshot(
   overrides?: Partial<NavigationSnapshot>,
 ): NavigationSnapshot {

package/src/router/params-util.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared route-param comparison helpers.
+ */
+
+/**
+ * Shallow equality for two route-param records. Same-reference is a fast path;
+ * otherwise compares key count then each value.
+ */
+export function paramsEqual(
+  a: Record<string, string>,
+  b: Record<string, string>,
+): boolean {
+  if (a === b) return true;
+
+  const keysA = Object.keys(a);
+  if (keysA.length !== Object.keys(b).length) return false;
+
+  for (const key of keysA) {
+    if (a[key] !== b[key]) return false;
+  }
+
+  return true;
+}

package/src/router/pattern-matching.ts

@@ -33,13 +33,6 @@ export interface ParsedSegment {
  */
 export function parsePattern(pattern: string): ParsedSegment[] {
   const segments: ParsedSegment[] = [];
-  // Match: /segment where segment can be:
-  // - static text
-  // - :param
-  // - :param?
-  // - :param(a|b)
-  // - :param(a|b)?
-  // - *
   const segmentRegex =
     /\/(:([a-zA-Z_][a-zA-Z0-9_]*)(\(([^)]+)\))?(\?)?([^/]*)|(\*)|([^/]+))/g;
 
@@ -81,7 +74,6 @@ export function parsePattern(pattern: string): ParsedSegment[] {
 export interface CompiledPattern {
   regex: RegExp;
   paramNames: string[];
-  optionalParams: Set<string>;
   hasTrailingSlash: boolean;
   /**
    * Param-name → allowed values for constrained params (e.g. `:lang(en|gb)`).
@@ -149,7 +141,6 @@ export function compilePattern(pattern: string): CompiledPattern {
 
   const segments = parsePattern(normalizedPattern);
   const paramNames: string[] = [];
-  const optionalParams = new Set<string>();
   let constraints: Record<string, string[]> | undefined;
 
   let regexPattern = "";
@@ -171,7 +162,6 @@ export function compilePattern(pattern: string): CompiledPattern {
       }
 
       if (segment.optional) {
-        optionalParams.add(segment.value);
         // Optional: make the whole /segment optional
         regexPattern += `(?:/${valuePattern}${suffixPattern})?`;
       } else {
@@ -183,7 +173,6 @@ export function compilePattern(pattern: string): CompiledPattern {
     }
   }
 
-  // Handle root path
   if (regexPattern === "") {
     regexPattern = "/";
   }
@@ -210,7 +199,6 @@ export function compilePattern(pattern: string): CompiledPattern {
   return {
     regex: new RegExp(`^${regexPattern}$`),
     paramNames,
-    optionalParams,
     hasTrailingSlash,
     ...(constraints ? { constraints } : {}),
   };
@@ -285,7 +273,6 @@ function buildParamsFromMatch(
 export function extractStaticPrefix(pattern: string): string {
   if (!pattern || pattern === "/") return "";
 
-  // Find the first occurrence of : or *
   const paramIndex = pattern.indexOf(":");
   const wildcardIndex = pattern.indexOf("*");
 
@@ -299,16 +286,13 @@ export function extractStaticPrefix(pattern: string): string {
   }
 
   if (cutIndex === -1) {
-    // No params or wildcards - entire pattern is static
     return pattern;
   }
 
   if (cutIndex === 0) {
-    // Pattern starts with : or * - no static prefix
     return "";
   }
 
-  // Find the last / before the param
   const lastSlash = pattern.lastIndexOf("/", cutIndex - 1);
   if (lastSlash === -1 || lastSlash === 0) {
     return "";
@@ -337,8 +321,8 @@ export function joinPrefix(base: string | undefined, prefix: string): string {
  *
  * Note: Optional params that are absent in the path are omitted from the
  * returned `params` (read as `undefined`), matching the trie matcher and
- * the `ExtractParams<"/:locale?/...">` type. Use the pattern definition or
- * `optionalParams` to determine which keys are optional.
+ * the `ExtractParams<"/:locale?/...">` type. Use the pattern definition to
+ * determine which keys are optional.
  *
  * Trailing slash handling (priority order):
  * 1. Per-route `trailingSlash` config from route()
@@ -356,7 +340,6 @@ export interface RouteMatchResult<TEnv = any> {
   entry: RouteEntry<TEnv>;
   routeKey: string;
   params: Record<string, string>;
-  optionalParams: Set<string>;
   redirectTo?: string;
   /** Route has pre-rendered data available (from trie) */
   pr?: true;
@@ -435,8 +418,6 @@ export function findMatch<TEnv>(
     : pathname + "/";
 
   for (const entry of routesEntries) {
-    // Short-circuit: skip entry if pathname doesn't start with static prefix
-    // staticPrefix is pre-computed at registration time, so this is O(1)
     if (entry.staticPrefix && !pathname.startsWith(entry.staticPrefix)) {
       if (effectiveDebug) {
         debugStats.entriesSkipped++;
@@ -448,8 +429,6 @@ export function findMatch<TEnv>(
       continue;
     }
 
-    // Check if this is a lazy entry that needs evaluation
-    // When staticPrefix matches but routes are not yet populated, signal caller to evaluate
     if (entry.lazy && !entry.lazyEvaluated) {
       if (effectiveDebug) {
         debugLog("findMatch", "lazy entry requires evaluation", {
@@ -470,7 +449,6 @@ export function findMatch<TEnv>(
         debugStats.routesChecked++;
       }
 
-      // Join prefix and pattern, handling edge cases
       let fullPattern: string;
       if (entry.prefix === "" || entry.prefix === "/") {
         fullPattern = pattern;
@@ -480,19 +458,12 @@ export function findMatch<TEnv>(
         fullPattern = entry.prefix + pattern;
       }
 
-      const {
-        regex,
-        paramNames,
-        optionalParams,
-        hasTrailingSlash,
-        constraints,
-      } = getCompiledPattern(fullPattern);
+      const { regex, paramNames, hasTrailingSlash, constraints } =
+        getCompiledPattern(fullPattern);
 
-      // Get trailing slash mode for this route (per-route config or pattern-based)
       const trailingSlashMode: TrailingSlashMode | undefined =
         entry.trailingSlash?.[routeKey];
 
-      // Prerender flag from entry metadata (set by urls() for prerender handlers)
       const prFlag = entry.prerenderRouteKeys?.has(routeKey)
         ? { pr: true as const }
         : {};
@@ -500,13 +471,10 @@ export function findMatch<TEnv>(
         ? { pt: true as const }
         : {};
 
-      // Try exact match first
       const match = regex.exec(pathname);
       if (match) {
         const params = buildParamsFromMatch(match, paramNames);
 
-        // Validate constraints against decoded values; a failure falls
-        // through to the next route so other patterns can still match.
         if (!satisfiesConstraints(params, constraints)) {
           continue;
         }
@@ -519,29 +487,24 @@ export function findMatch<TEnv>(
           });
         }
 
-        // Check if trailing slash mode requires redirect even on exact match
         if (
           trailingSlashMode === "always" &&
           !pathnameHasTrailingSlash &&
           pathname !== "/"
         ) {
-          // Mode says always have trailing slash, but pathname doesn't have it
           return {
             entry,
             routeKey,
             params,
-            optionalParams,
             redirectTo: pathname + "/",
             ...prFlag,
             ...ptFlag,
           };
         } else if (trailingSlashMode === "never" && pathnameHasTrailingSlash) {
-          // Mode says never have trailing slash, but pathname has it
           return {
             entry,
             routeKey,
             params,
-            optionalParams,
             redirectTo: pathname.slice(0, -1),
             ...prFlag,
             ...ptFlag,
@@ -552,13 +515,11 @@ export function findMatch<TEnv>(
           entry,
           routeKey,
           params,
-          optionalParams,
           ...prFlag,
           ...ptFlag,
         };
       }
 
-      // Try alternate pathname (opposite trailing slash)
       const altMatch = regex.exec(alternatePathname);
       if (altMatch) {
         const params = buildParamsFromMatch(altMatch, paramNames);
@@ -567,25 +528,20 @@ export function findMatch<TEnv>(
           continue;
         }
 
-        // Determine redirect behavior based on mode
         if (trailingSlashMode === "ignore") {
-          // Match without redirect
           return {
             entry,
             routeKey,
             params,
-            optionalParams,
             ...prFlag,
             ...ptFlag,
           };
         } else if (trailingSlashMode === "never") {
-          // Redirect to no trailing slash
           if (pathnameHasTrailingSlash) {
             return {
               entry,
               routeKey,
               params,
-              optionalParams,
               redirectTo: alternatePathname,
               ...prFlag,
               ...ptFlag,
@@ -595,18 +551,15 @@ export function findMatch<TEnv>(
             entry,
             routeKey,
             params,
-            optionalParams,
             ...prFlag,
             ...ptFlag,
           };
         } else if (trailingSlashMode === "always") {
-          // Redirect to with trailing slash
           if (!pathnameHasTrailingSlash) {
             return {
               entry,
               routeKey,
               params,
-              optionalParams,
               redirectTo: alternatePathname,
               ...prFlag,
               ...ptFlag,
@@ -616,13 +569,10 @@ export function findMatch<TEnv>(
             entry,
             routeKey,
             params,
-            optionalParams,
             ...prFlag,
             ...ptFlag,
           };
         } else {
-          // No explicit mode - use pattern-based detection
-          // Redirect to canonical form (what the pattern defines)
           const canonicalPath = hasTrailingSlash
             ? alternatePathname
             : pathname.slice(0, -1);
@@ -630,7 +580,6 @@ export function findMatch<TEnv>(
             entry,
             routeKey,
             params,
-            optionalParams,
             redirectTo: canonicalPath,
             ...prFlag,
             ...ptFlag,
@@ -651,7 +600,7 @@ export function* traverseBack(entry: EntryData): Generator<EntryData> {
   let current: EntryData | null = entry;
   const items = [] as EntryData[];
   while (current !== null) {
-    items.push(current); // Move up to next parent
+    items.push(current);
     current = current.parent;
   }
   for (let i = items.length - 1; i >= 0; i--) {