@rangojs/router 0.22.1 → 0.24.0

package/src/router/match-middleware/background-revalidation.ts

@@ -109,10 +109,12 @@ import { INTERNAL_RANGO_DEBUG } from "../../internal-debug.js";
 import { getContext } from "../../server/context.js";
 import { executionStart } from "../../cache/tag-invalidation.js";
 import {
+  bindRes,
   createRequestContext,
   runWithRequestContext,
   type RequestContext,
 } from "../../server/request-context.js";
+import { recordUse } from "../segment-resolution/prefetch-deferral.js";
 
 /**
  * Re-render a cached route in the background and write it with
@@ -165,9 +167,7 @@ export async function rerenderAndCacheRoute<TEnv>(
     themeConfig: requestCtx._themeConfig,
   });
   const renderCtx: RequestContext<TEnv> = Object.assign(
-    Object.create(requestCtx, {
-      res: Object.getOwnPropertyDescriptor(sink, "res")!,
-    }),
+    Object.create(requestCtx),
     {
       _handleStore: handleStore,
       _metricsStore: undefined,
@@ -184,6 +184,8 @@ export async function rerenderAndCacheRoute<TEnv>(
       _setKeepCacheDirective: sink._setKeepCacheDirective,
     },
   );
+  // ctx.res reads the sink's stub, not the live request's.
+  bindRes(renderCtx, () => sink.res);
   const store = Object.assign(Object.create(ctx.Store), { metrics: undefined });
   const runInStore = <T>(fn: () => T): T =>
     getContext().runWithStore(
@@ -281,7 +283,17 @@ export function withBackgroundRevalidation<TEnv>(
     // Only trigger background revalidation if:
     // 1. Cache was hit and stale
     // 2. Cache scope exists
-    if (!state.shouldRevalidate || !state.cacheHit || !ctx.cacheScope) {
+    // 3. The request may refresh the record (RecordUse.refresh): a fill may
+    //    not (prefetch: false). It runs no handler of a segment the client
+    //    holds, and the re-render runs every handler of the route. The record
+    //    stays stale until a request that reads it arrives: the prefetch
+    //    before the fill already was one.
+    if (
+      !state.shouldRevalidate ||
+      !state.cacheHit ||
+      !ctx.cacheScope ||
+      !recordUse(ctx.handlerContext).refresh
+    ) {
       return;
     }
 

package/src/router/match-middleware/cache-lookup.ts

@@ -99,6 +99,10 @@ import { observeEvent } from "../instrument.js";
 import { pushRevalidationTraceEntry, isTraceActive } from "../logging.js";
 import { treeHasStreaming } from "./segment-resolution.js";
 import { loaderPins } from "../segment-resolution/loader-cache.js";
+import {
+  fillSends,
+  recordUse,
+} from "../segment-resolution/prefetch-deferral.js";
 import type { PrerenderStore, PrerenderEntry } from "../../prerender/store.js";
 import {
   isStoredEntryStale,
@@ -345,14 +349,20 @@ async function* yieldFromStore<TEnv>(
   for (const segment of segments) {
     if (
       !ctx.isFullMatch &&
-      !paramsChanged &&
       ctx.clientSegmentSet.has(segment.id) &&
-      !(
-        resendRouteSegments &&
-        (segment.type === "route" || segment.belongsToRoute === true)
-      )
+      // A stored intercept segment is re-sent, as on the runtime cache path:
+      // its loaders run (handleCacheHitIntercept), and a kept (null) one would
+      // be left out of the response with its loaders' new data.
+      !segment.namespace?.startsWith("intercept:")
     ) {
-      keepClientSegment(segment);
+      // A fill keeps it (fillSends); otherwise it is sent again when the
+      // params changed or an action re-sends the route's own segments.
+      const sends =
+        fillSends(ctx.handlerContext, segment.id, ctx.clientSegmentSet) ??
+        (paramsChanged ||
+          (resendRouteSegments &&
+            (segment.type === "route" || segment.belongsToRoute === true)));
+      if (!sends) keepClientSegment(segment);
     }
     yield segment;
   }
@@ -725,7 +735,15 @@ export function withCacheLookup<TEnv>(
       throw new ShellRecordUnavailableError(tailMarker.fixedDocKey);
     }
 
-    if (ctx.isAction || !ctx.cacheScope?.enabled) {
+    // A prefetch that defers a layout above the boundary (prefetch: false)
+    // emits nothing the record holds: reading it would replay the handle
+    // pushes of segments the response does not carry. withCacheStore skips
+    // the write for the same request.
+    if (
+      ctx.isAction ||
+      !ctx.cacheScope?.enabled ||
+      !recordUse(ctx.handlerContext).read
+    ) {
       yield* source;
       if (ms) {
         ms.metrics.push({
@@ -919,6 +937,16 @@ export function withCacheLookup<TEnv>(
         continue;
       }
 
+      // A fill keeps a held segment outright (fillSends).
+      if (
+        fillSends(ctx.handlerContext, segment.id, ctx.clientSegmentSet) ===
+        false
+      ) {
+        keepClientSegment(segment);
+        yield segment;
+        continue;
+      }
+
       const entryInfo = entryRevalidateMap?.get(segment.id);
 
       const searchChanged = ctx.prevUrl.search !== ctx.url.search;

package/src/router/match-middleware/cache-store.ts

@@ -114,6 +114,7 @@ import { debugLog, debugWarn, getOrCreateRequestId } from "../logging.js";
 import { INTERNAL_RANGO_DEBUG } from "../../internal-debug.js";
 import type { GeneratorMiddleware } from "./cache-lookup.js";
 import { rerenderAndCacheRoute } from "./background-revalidation.js";
+import { recordUse } from "../segment-resolution/prefetch-deferral.js";
 
 /**
  * Creates cache store middleware
@@ -149,11 +150,15 @@ export function withCacheStore<TEnv>(
     // segments were collected into allSegments either way).
     recordShellCaptureDocRecord(ctx, state, allSegments);
 
+    // prefetch: false (prefetch-deferral.ts). A prefetch that deferred a
+    // layout above the boundary did not read the record (withCacheLookup)
+    // and could only write an incomplete one.
     if (
       !ctx.cacheScope?.enabled ||
       ctx.isAction ||
       state.cacheHit ||
-      ctx.request.method !== "GET"
+      ctx.request.method !== "GET" ||
+      !recordUse(ctx.handlerContext).write
     ) {
       if (ms) {
         ms.metrics.push({
@@ -192,6 +197,15 @@ export function withCacheStore<TEnv>(
         cacheScope.covers(s.id, s.namespace),
     );
 
+    // The client holds part of what the record covers, so writing it takes
+    // the proactive re-render below, which a request that may not refresh
+    // the record (RecordUse.refresh) does not start. That is a fill: it
+    // renders what the client is missing and nothing else, and writes like
+    // any other request only when that is everything the record covers. The
+    // stale-hit refresh skips it for the same reason
+    // (withBackgroundRevalidation).
+    if (hasNullComponents && !recordUse(ctx.handlerContext).refresh) return;
+
     const requestCtx = getRequestContext();
     if (!requestCtx) return;
 

package/src/router/match-middleware/intercept-resolution.ts

@@ -260,7 +260,9 @@ async function handleCacheHitIntercept<TEnv>(
         interceptMainSegment.loaderIds = freshLoaderResult.loaderIds;
         debugLog(
           "matchPartial.intercept",
-          "cache hit with fresh intercept loaders",
+          freshLoaderResult.loaderIds.length > 0
+            ? "cache hit with fresh intercept loaders"
+            : "cache hit, every intercept loader held",
           {
             routeName: ctx.localRouteName,
             slotName,
@@ -270,7 +272,7 @@ async function handleCacheHitIntercept<TEnv>(
     } else {
       debugLog(
         "matchPartial.intercept",
-        "cache hit without intercept loader revalidation",
+        "cache hit, intercept has no loaders",
         {
           routeName: ctx.localRouteName,
           slotName,

package/src/router/match-result.ts

@@ -108,6 +108,7 @@
  *   4. Render slot content if slots present
  */
 import type { MatchResult, ResolvedSegment } from "../types.js";
+import { isPlaceholder } from "../types/segments.js";
 import type { MatchContext, MatchPipelineState } from "./match-context.js";
 import { debugLog } from "./logging.js";
 import { appendMetric } from "./metrics.js";
@@ -229,12 +230,23 @@ export function buildMatchResult<TEnv>(
     allIds = [...new Set(allIds)];
 
     // One pass over allSegments: keep renderable segments and collect the
-    // handler-ran ids (resolvedIds) together.
+    // ids that ran (resolvedIds) together. A partial match resolves only the
+    // loaders it runs (revalidation.ts), so each loader segment here ran:
+    // the browser replaces that loader's handle pushes, and keeps those of a
+    // loader it skipped (handles/pushed-by.ts).
     const clientIdSet = new Set(ctx.clientSegmentIds);
     segmentsToRender = [];
     resolvedIds = [];
     for (const s of allSegments) {
-      if (s._handlerRan) resolvedIds.push(s.id);
+      // A deferred loader (prefetch: false) did not run in this response:
+      // its pushes arrive with the fill, which lists it then.
+      if (s._handlerRan || (s.type === "loader" && !isPlaceholder(s))) {
+        resolvedIds.push(s.id);
+      }
+      // A deferred unit (prefetch: false) has a null component and is sent:
+      // only a segment the client does not hold is ever deferred, and
+      // deferral reads these same ids (prefetch-deferral.ts
+      // PrefetchDeferral.held), not the set the match forces renders with.
       if (
         s.component !== null ||
         s.type === "loader" ||

package/src/router/middleware-types.ts

@@ -8,6 +8,7 @@ import type { GlobalReverseFunction } from "../reverse.js";
 import type { Theme } from "../theme/types.js";
 import type { LocationStateEntry } from "../browser/react/location-state-shared.js";
 import type { RequestScope } from "../types/request-scope.js";
+import type { Rewrite } from "../route-definition/rewrite.js";
 
 type GetVariableFn = {
   <T>(contextVar: ContextVar<T>): T | undefined;
@@ -81,6 +82,21 @@ export interface MiddlewareContext<
 
   /** Global route names only; see {@link GlobalReverseFunction}. */
   reverse: GlobalReverseFunction<DefaultReverseRouteMap>;
+
+  /**
+   * Whether `value` is a `rewrite()` thrown downstream. A middleware that
+   * wraps `next()` in try/catch rethrows it, so the request re-dispatches:
+   *
+   * ```ts
+   * try {
+   *   return await next();
+   * } catch (error) {
+   *   if (ctx.isRewrite(error)) throw error;
+   *   return new Response("Error", { status: 500 });
+   * }
+   * ```
+   */
+  isRewrite(value: unknown): value is Rewrite;
 }
 
 export type MiddlewareFn<

package/src/router/middleware.ts

@@ -32,7 +32,14 @@ import {
 import { getCacheExecScope } from "../cache/cache-exec-scope.js";
 import { assertNonCacheableReadAllowed } from "../server/context.js";
 import { readGuardedTheme } from "../server/cookie-store.js";
+import { defineSlot, slotAccessor } from "../server/slot-accessors.js";
 import type { Theme } from "../theme/types.js";
+import {
+  isRewrite,
+  rewriteNotSupported,
+  type Rewrite,
+} from "../route-definition/rewrite.js";
+import { defineRewrittenFrom } from "../server/rewrite-trail.js";
 
 // Re-export types consumed through this module's path.
 export type {
@@ -43,19 +50,54 @@ export type {
 } from "./middleware-types.js";
 
 /**
- * Middleware ctx.theme: the visitor's theme cookie, guarded like the handler
- * ctx.theme and cookies() (#971, #946), so a read inside a "use cache"
- * function the middleware calls throws. Non-enumerable like the handler and
- * request-context getters: a spread of the ctx (inside a "use cache"
- * function, say) does not read it. One shared descriptor, so every ctx keeps
- * the same property shape.
+ * The middleware ctx's accessors: shared descriptors (slot-accessors.ts).
+ * routeName, _routeName, theme and setTheme read only the request context;
+ * headers calls the per-ctx closure in HEADERS_SLOT.
  */
-const MIDDLEWARE_THEME_DESCRIPTOR: PropertyDescriptor = {
-  get(): Theme | undefined {
-    return readGuardedTheme(_getRequestContext(), "ctx.theme");
+const HEADERS_SLOT: unique symbol = Symbol("rango.middlewareContext.headers");
+
+const MIDDLEWARE_ACCESSORS: Record<
+  "routeName" | "_routeName" | "headers" | "setTheme" | "theme",
+  PropertyDescriptor
+> = {
+  // Re-derived from the request context on each access, so global middleware
+  // sees the matched route name after await next().
+  routeName: {
+    get(): string | undefined {
+      const raw = _getRequestContext()?._routeName;
+      return raw && !isAutoGeneratedRouteName(raw) ? raw : undefined;
+    },
+    enumerable: true,
+    configurable: true,
+  },
+  // The matched route key, auto-generated names included (the handler ctx's
+  // _routeName); undefined before routing.
+  _routeName: {
+    get(): string | undefined {
+      return _getRequestContext()?._routeName;
+    },
+    enumerable: true,
+    configurable: true,
+  },
+  headers: slotAccessor(HEADERS_SLOT, true),
+  setTheme: {
+    get(): MiddlewareContext<unknown>["setTheme"] {
+      return _getRequestContext()?.setTheme;
+    },
+    enumerable: true,
+    configurable: true,
+  },
+  // The visitor's theme cookie, guarded like the handler ctx.theme and
+  // cookies() (#971, #946), so a read inside a "use cache" function the
+  // middleware calls throws. Non-enumerable like the handler and
+  // request-context getters: a spread of the ctx does not read it.
+  theme: {
+    get(): Theme | undefined {
+      return readGuardedTheme(_getRequestContext(), "ctx.theme");
+    },
+    enumerable: false,
+    configurable: true,
   },
-  enumerable: false,
-  configurable: true,
 };
 
 const MIDDLEWARE_METRIC_DEPTH = 1;
@@ -252,15 +294,20 @@ export function createMiddlewareContext<TEnv>(
 
   // reqCtx captured once above: the request-scoped platform fields
   // (originalUrl, executionContext, waitUntil) are immutable per request,
-  // so snapshotting beats re-reading ALS on every access. The lazy getters
-  // below (routeName, theme, setTheme) stay lazy because those can change
-  // during `await next()`.
+  // so snapshotting beats re-reading ALS on every access. The accessors
+  // (routeName, _routeName, theme, setTheme: MIDDLEWARE_ACCESSORS) read the
+  // request context on each access because those can change during
+  // `await next()`.
   //
   // Request-scoped like the handler ctx (issue #940): the NOCACHE_SYMBOL brand
   // below makes a "use cache" function taking it key by host, _routeName,
   // pathname, params and search; set/header/headers throw inside that
   // function, and non-cacheable get reads run the shared guard.
-  const ctx: MiddlewareContext<TEnv> & { readonly _routeName?: string } = {
+  // Data members only: the accessors are MIDDLEWARE_ACCESSORS.
+  const fields: Omit<
+    MiddlewareContext<TEnv>,
+    "routeName" | "headers" | "setTheme"
+  > = {
     request,
     url,
     originalUrl: reqCtx?.originalUrl ?? new URL(request.url),
@@ -269,39 +316,12 @@ export function createMiddlewareContext<TEnv>(
     env: env as MiddlewareContext<TEnv>["env"],
     params,
     build: reqCtx?.build ?? false,
+    isRewrite,
     dynamic(): void {
       reqCtx?.dynamic();
     },
     executionContext: reqCtx?.executionContext,
     waitUntil: reqCtx ? reqCtx.waitUntil.bind(reqCtx) : fireAndForgetWaitUntil,
-    // Getter: re-derives from request context on each access so that global
-    // middleware sees the matched route name after await next().
-    get routeName(): MiddlewareContext<TEnv>["routeName"] {
-      const reqCtx = _getRequestContext();
-      const raw = reqCtx?._routeName;
-      return (
-        raw && !isAutoGeneratedRouteName(raw) ? raw : undefined
-      ) as MiddlewareContext<TEnv>["routeName"];
-    },
-
-    // The matched route key, auto-generated names included (the handler
-    // ctx's _routeName); undefined before routing.
-    get _routeName(): string | undefined {
-      return _getRequestContext()?._routeName;
-    },
-
-    // Guarded only inside a "use cache" body: the stamp covers a miss that
-    // took this ctx as an argument, the exec scope a stale refresh (which does
-    // not stamp its args, cache-runtime.ts). A write there is lost on a hit.
-    get headers(): Headers {
-      const headers = getResponse().headers;
-      return (INSIDE_CACHE_EXEC as symbol) in ctx ||
-        getCacheExecScope() !== undefined
-        ? guardHeaderWrites(headers, () =>
-            assertNotInsideCacheExec(ctx, "headers"),
-          )
-        : headers;
-    },
 
     get: ((keyOrVar: any) => {
       // "use cache" only: intercept middleware runs inside a cache()
@@ -338,11 +358,6 @@ export function createMiddlewareContext<TEnv>(
       responseHolder.response.headers.set(name, value);
     },
 
-    // theme: MIDDLEWARE_THEME_DESCRIPTOR, defined after this literal.
-    get setTheme(): MiddlewareContext<TEnv>["setTheme"] {
-      return _getRequestContext()?.setTheme;
-    },
-
     setLocationState(entries) {
       const reqCtx = _getRequestContext();
       if (!reqCtx) {
@@ -376,11 +391,46 @@ export function createMiddlewareContext<TEnv>(
       }
     },
   };
-  Object.defineProperty(ctx, "theme", MIDDLEWARE_THEME_DESCRIPTOR);
+  const ctx = fields as MiddlewareContext<TEnv>;
+  // Guarded only inside a "use cache" body: the stamp covers a miss that
+  // took this ctx as an argument, the exec scope a stale refresh (which does
+  // not stamp its args, cache-runtime.ts). A write there is lost on a hit.
+  defineSlot(ctx, HEADERS_SLOT, (): Headers => {
+    const headers = getResponse().headers;
+    return (INSIDE_CACHE_EXEC as symbol) in ctx ||
+      getCacheExecScope() !== undefined
+      ? guardHeaderWrites(headers, () =>
+          assertNotInsideCacheExec(ctx, "headers"),
+        )
+      : headers;
+  });
+  Object.defineProperty(ctx, "routeName", MIDDLEWARE_ACCESSORS.routeName);
+  Object.defineProperty(ctx, "_routeName", MIDDLEWARE_ACCESSORS._routeName);
+  Object.defineProperty(ctx, "headers", MIDDLEWARE_ACCESSORS.headers);
+  Object.defineProperty(ctx, "setTheme", MIDDLEWARE_ACCESSORS.setTheme);
+  Object.defineProperty(ctx, "theme", MIDDLEWARE_ACCESSORS.theme);
+  defineRewrittenFrom(ctx, reqCtx, "middleware");
   (ctx as any)[NOCACHE_SYMBOL] = true;
   return ctx;
 }
 
+/** A middleware threw a Rewrite after its next() started the downstream. */
+function rewriteAfterNextError(handler: Function, rewrite: Rewrite): Error {
+  return new Error(
+    `Middleware "${handler.name || "(anonymous)"}" threw rewrite() after ` +
+      `calling next(). Throw rewrite() before await next().`,
+    { cause: rewrite },
+  );
+}
+
+/** A middleware returned a Rewrite: only a thrown one re-dispatches. */
+function returnedRewriteError(handler: Function): Error {
+  return new Error(
+    `Middleware "${handler.name || "(anonymous)"}" returned a rewrite(). ` +
+      `Throw it instead: \`throw rewrite(...)\`, don't return it.`,
+  );
+}
+
 /**
  * Match middleware entries against a pathname
  * Returns entries that match, with extracted params
@@ -584,6 +634,12 @@ export async function executeMiddleware<TEnv>(
     // downstream chain and overwrite responseHolder.response.
     let nextPromise: Promise<Response> | null = null;
     let nextResolvedAt: number | undefined;
+    // Whether next() rejected with a Rewrite: only then did nothing render
+    // (a downstream middleware rewrote before its own next()). Any other
+    // rejection can come after the route rendered (a route middleware that
+    // throws after its next(), the render's own error), so a rewrite thrown
+    // after it would re-dispatch onto the used handle store.
+    let nextRejectedWithRewrite = false;
     const wrappedNext = (): Promise<Response> => {
       if (nextPromise) {
         throw new Error(
@@ -599,6 +655,7 @@ export async function executeMiddleware<TEnv>(
         },
         (err) => {
           nextResolvedAt = performance.now();
+          nextRejectedWithRewrite = isRewrite(err);
           throw err;
         },
       );
@@ -612,6 +669,11 @@ export async function executeMiddleware<TEnv>(
     // middleware-over-middleware and the core handler underneath. Pass-through
     // when neither surface is active.
     let result: Response | void;
+    // A thrown rewrite() is control flow like a thrown Response: held past
+    // the span (which settles as success) and rethrown below, so it unwinds
+    // to the dispatcher (rsc/handler.ts) with no further code of this
+    // middleware run.
+    let rewrite: Rewrite | undefined;
     try {
       result = await observePhase(PHASES.middleware(metricLabel), async () => {
         try {
@@ -627,6 +689,10 @@ export async function executeMiddleware<TEnv>(
           // this convention (segment-resolution/helpers.ts keeps result handling
           // outside the span). Real errors propagate past the span.
           if (error instanceof Response) return error;
+          if (isRewrite(error)) {
+            rewrite = error;
+            return undefined;
+          }
           throw error;
         }
       });
@@ -635,6 +701,16 @@ export async function executeMiddleware<TEnv>(
       // error paths (idempotent guard in finishMiddleware).
       finishMiddleware();
     }
+    // A rewrite after this middleware's next() started the downstream chain
+    // (resolved, still running, or failed) would leave that render running
+    // against the context the next pass moves, or re-dispatch onto what it
+    // already pushed, and drop the response it built. Only a rewrite after
+    // next() rejected with a Rewrite (nothing rendered) unwinds.
+    if (rewrite && nextPromise && !nextRejectedWithRewrite) {
+      throw rewriteAfterNextError(entry.handler, rewrite);
+    }
+    if (rewrite) throw rewrite;
+    if (isRewrite(result)) throw returnedRewriteError(entry.handler);
 
     // Record post-next() processing time when middleware did work after
     // the downstream chain resolved (e.g. adding headers, logging).
@@ -805,10 +881,12 @@ export async function executeInterceptMiddleware<TEnv>(
           // runner settles rango.middleware as success, not STATUS_ERROR (same
           // reasoning as executeMiddleware's main chain). Real errors propagate.
           if (error instanceof Response) return error;
+          if (isRewrite(error)) throw rewriteNotSupported(error, "intercept");
           throw error;
         }
       },
     );
+    if (isRewrite(result)) throw returnedRewriteError(middleware);
 
     if (result instanceof Response) {
       earlyResponse = result;

package/src/router/navigation-snapshot.ts

@@ -1,3 +1,4 @@
+import { isLoaderSegmentId } from "../browser/react/filter-segment-order.js";
 import { requestHeaders } from "../server/request-headers.js";
 import type { RouteMatchResult } from "./pattern-matching.js";
 
@@ -145,7 +146,7 @@ export async function resolveNavigation(
 
   const filteredSegmentIds = clientSegmentIds.filter((id) => {
     if (id.includes(".@")) return false;
-    if (/D\d+\./.test(id)) return false;
+    if (isLoaderSegmentId(id)) return false;
     return true;
   });
 

package/src/router/revalidation.ts

@@ -20,7 +20,7 @@ import { makeIsAction } from "./is-action.js";
 /**
  * Options for revalidation evaluation
  */
-interface EvaluateRevalidationOptions<TEnv> {
+export interface EvaluateRevalidationOptions<TEnv> {
   /** Current segment to evaluate */
   segment: ResolvedSegment;
   /** Previous route params (from route match, not segment) */

package/src/router/route-trie-builder.ts

@@ -153,6 +153,31 @@ function sortSuffixParams(node: TrieNode): void {
   }
 }
 
+/**
+ * Give every static-children map in the trie a null prototype, in place, and
+ * return the trie (#1109). The walker indexes `node.s` with raw URL segments,
+ * so a map with Object.prototype would answer `/constructor` or `/__proto__`
+ * with an inherited member. The builder creates null-prototype maps; a trie
+ * that arrives as JSON (the build manifest) or across the dev runner boundary
+ * gets them here. Object.setPrototypeOf keeps a JSON-parsed map's fast
+ * properties, where Object.create(null) starts in dictionary mode.
+ */
+export function nullPrototypeStaticChildren(node: TrieNode): TrieNode {
+  if (node.s) {
+    Object.setPrototypeOf(node.s, null);
+    for (const child of Object.values(node.s)) {
+      nullPrototypeStaticChildren(child);
+    }
+  }
+  if (node.xp) {
+    for (const child of Object.values(node.xp)) {
+      nullPrototypeStaticChildren(child.c);
+    }
+  }
+  if (node.p) nullPrototypeStaticChildren(node.p.c);
+  return node;
+}
+
 /**
  * Insert a route into the trie. Optional params expand into two branches at
  * registration time (skip-first, then present), so each terminal lives at the
@@ -271,7 +296,9 @@ function insertSegments(
   const segment = segments[index];
 
   if (segment.type === "static") {
-    if (!node.s) node.s = {};
+    // Null prototype: a segment named `constructor` or `__proto__` is an own
+    // key, never an inherited member to descend into and write a leaf on.
+    if (!node.s) node.s = Object.create(null) as Record<string, TrieNode>;
     if (!node.s[segment.value]) node.s[segment.value] = {};
     insertSegments(
       node.s[segment.value],

package/src/router/segment-resolution/fresh.ts

@@ -164,17 +164,19 @@ export async function resolveLoaders<TEnv>(
         // key off it.
         ...stampAwaitBeforeFlush(loaderEntry),
         loaderData: deps.wrapLoaderPromise(
-          runInsideLoaderScope(() =>
-            resolveLoaderData(
-              loaderEntry,
-              ctx,
-              ctx.pathname,
-              // The bake key rides for flagged loaders too: ssr:false
-              // bakes at capture regardless of the entry's loading() lane
-              // (loader-cache.ts capture branch) and its HIT-tail seed
-              // overlay needs the same key.
-              bakeLane || loaderEntry.bake === true ? segmentId : null,
-            ),
+          runInsideLoaderScope(
+            () =>
+              resolveLoaderData(
+                loaderEntry,
+                ctx,
+                ctx.pathname,
+                // The bake key rides for flagged loaders too: ssr:false
+                // bakes at capture regardless of the entry's loading() lane
+                // (loader-cache.ts capture branch) and its HIT-tail seed
+                // overlay needs the same key.
+                bakeLane || loaderEntry.bake === true ? segmentId : null,
+              ),
+            loader.$$id,
           ),
           entry,
           segmentId,
@@ -216,13 +218,15 @@ export async function resolveLoaders<TEnv>(
     const { loader } = loaderEntry;
     const segmentId = `${shortCode}D${i}.${loader.$$id}`;
     const wrapped = deps.wrapLoaderPromise(
-      runInsideLoaderScope(() =>
-        resolveLoaderData(
-          loaderEntry,
-          ctx,
-          ctx.pathname,
-          bakeLane || loaderEntry.bake === true ? segmentId : null,
-        ),
+      runInsideLoaderScope(
+        () =>
+          resolveLoaderData(
+            loaderEntry,
+            ctx,
+            ctx.pathname,
+            bakeLane || loaderEntry.bake === true ? segmentId : null,
+          ),
+        loader.$$id,
       ),
       entry,
       segmentId,

package/src/router/segment-resolution/loader-cache.ts

@@ -118,6 +118,7 @@ import {
   isShellCaptureActive,
   createMaskedLoaderPromise,
 } from "./loader-mask.js";
+import { loaderOwner } from "./prefetch-deferral.js";
 // Lazy-loaded to avoid pulling @vitejs/plugin-rsc/rsc into modules that
 // import segment-resolution but never use loader caching.
 let _serializeResult: typeof import("../../cache/segment-codec.js").serializeResult;
@@ -658,7 +659,7 @@ function executeLoaderData<TEnv>(
   // Handle pushes: the store and the owning segment are read synchronously
   // at kickoff, as createLoaderExecutor does for the body's own pushes.
   const handleStore = _getRequestContext()?._handleStore;
-  const owningSegmentId = internal._currentSegmentId;
+  const owningSegmentId = loaderOwner(ctx, loaderId);
   // Record only pushes from THIS loader's body and the loaders it awaits via
   // ctx.use: the handler and sibling loaders push into the same store
   // concurrently. A dependency can still run on a HIT for another reader