@real-router/core 0.112.0 → 0.113.0

package/dist/cjs/engine/validation/route-batch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route-batch.d.ts","names":[],"sources":["../../../../src/engine/validation/route-batch.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2ZgB,cACd,gBACA,oBACA,WAAW,WACX,qBACA,YAAY,aACZ,oBAAoB,YAAY,uBACvB,SAAS"}
+{"version":3,"file":"route-batch.d.ts","names":[],"sources":["../../../../src/engine/validation/route-batch.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyXgB,cACd,gBACA,oBACA,WAAW,WACX,qBACA,YAAY,aACZ,oBAAoB,YAAY,uBACvB,SAAS"}

package/dist/cjs/index.js

@@ -1,2 +1,2 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./ingest-DxGcWzr6.js"),t=require("./Router-BI9R0HoU.js"),n=(e=[],n={},r={})=>new t.t(e,n,r),r=new WeakMap,i=e=>{let t=r.get(e);return t||(t=Object.freeze({navigate:e.navigate,getState:e.getState,isActiveRoute:e.isActiveRoute,canNavigateTo:e.canNavigateTo,subscribe:e.subscribe,subscribeLeave:e.subscribeLeave,isLeaveApproved:e.isLeaveApproved}),r.set(e,t)),t};exports.Router=t.t,exports.RouterError=t.n,exports.UNKNOWN_ROUTE=e.d,exports.constants=e.p,exports.createRouter=n,exports.errorCodes=e.m,exports.events=e.h,exports.getNavigator=i,exports.resolveForwardChain=t.b;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./ingest-DxGcWzr6.js"),t=require("./Router-COsWo_pH.js"),n=(e=[],n={},r={})=>new t.t(e,n,r),r=new WeakMap,i=e=>{let t=r.get(e);return t||(t=Object.freeze({navigate:e.navigate,getState:e.getState,isActiveRoute:e.isActiveRoute,canNavigateTo:e.canNavigateTo,subscribe:e.subscribe,subscribeLeave:e.subscribeLeave,isLeaveApproved:e.isLeaveApproved}),r.set(e,t)),t};exports.Router=t.t,exports.RouterError=t.n,exports.UNKNOWN_ROUTE=e.d,exports.constants=e.p,exports.createRouter=n,exports.errorCodes=e.m,exports.events=e.h,exports.getNavigator=i,exports.resolveForwardChain=t.x;
 //# sourceMappingURL=index.js.map

package/dist/cjs/namespaces/RoutesNamespace/routesStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routesStore.d.ts","names":[],"sources":["../../../../src/namespaces/RoutesNamespace/routesStore.ts"],"mappings":";;;;;;UAgEiB,YACf,qBAAqB,sBAAsB;;;;;;;;;;;;;WAclC,aAAa;WACb,QAAQ;EACjB,MAAM;EACN,SAAS;;;;;;;WAOA,gBAAgB;;;;;;;;WAQhB,kBAAkB;EAC3B,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;EAyBpB;EACA,mBAAmB,eAAe;EAClC;WACS,gBAAgB;EACzB,WAAW,mBAAmB;EAC9B,oBAAoB,wBAAwB;WACnC,oBAAoB,YAAY,eAAe;WAC/C,sBAAsB,YAAY,eAAe"}
+{"version":3,"file":"routesStore.d.ts","names":[],"sources":["../../../../src/namespaces/RoutesNamespace/routesStore.ts"],"mappings":";;;;;;UAkEiB,YACf,qBAAqB,sBAAsB;;;;;;;;;;;;;WAclC,aAAa;WACb,QAAQ;EACjB,MAAM;EACN,SAAS;;;;;;;WAOA,gBAAgB;;;;;;;;WAQhB,kBAAkB;EAC3B,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;EAyBpB;EACA,mBAAmB,eAAe;EAClC;WACS,gBAAgB;EACzB,WAAW,mBAAmB;EAC9B,oBAAoB,wBAAwB;WACnC,oBAAoB,YAAY,eAAe;WAC/C,sBAAsB,YAAY,eAAe"}

package/dist/cjs/{buildParamMeta-L7xMPkKw.js → route-name-BBu872EN.js}

@@ -1,2 +1,2 @@
-const e=require("./ingest-DxGcWzr6.js"),t=Object.hasOwn;function n(e,n){if(n.length!==0&&e!==void 0)for(let r of n){if(!t(e,r))continue;let n;try{n=e[r]}catch{return}if(n!==void 0)return r}}function r(e,t,r,i,o,s){let c=n(r,i);if(c!==void 0)throw TypeError(`[router.${e}] ${a(t,c,typeof o==`function`?o():o,s)}`)}function i(e,t,n,i){r(e,t,n,i,"the `params` bag this call is about to ship — the channel check above it read a different value, so the caller's object answered differently between the two reads")}function a(e,t,n="the `params` argument",r="Pass it in `search` instead"){return`Route "${e}" declares \`${t}\` as a query param, but it was given in ${n} — the path channel. ${r}; the two channels are separate since RFC-4 M2 and the router never moves a key between them.`}const o=new WeakMap;function s(e){let t=o.get(e);if(!t)throw TypeError(`[real-router] Invalid router instance — not found in internals registry`);return t}function c(e,t,n,i){r(t,n,i,e.getQueryParams(n))}function l(e,t){o.set(e,t)}function u(e,t,n,r){let i=t;for(let t of e){let e=i,n=r===void 0?e:(...t)=>r(e(...t));i=(...e)=>t(n,...e)}return i(...n)}function d(e,t,n){return((...r)=>{let i=n.get(e);return!i||i.length===0?t(...r):u(i,t,r)})}function f(e,t,n,r){return(i,a,o)=>{let s=n.get(e);return!s||s.length===0?t(i,a,o):u(s,t,[i,a,o],r)}}const p=e=>e===58||e===42;function m(e){let t=[],n=0;for(let r=0;r<e.length;r+=1)e.charCodeAt(r)===47&&(t.push(e.slice(n,r)),n=r+1);return t.push(e.slice(n)),t}function h(e){let t=e.length;if(t===0)return{kind:`static`,text:``};if(!p(e.charCodeAt(0))){for(let n=0;n<t;n+=1){let r=e.charCodeAt(n);if(r===60||r===62)return{error:`constraint-removed`};if(p(r)&&n+1<t)return{error:`fused-marker`}}return e.charCodeAt(t-1)===63?{error:`name-less`}:{kind:`static`,text:e}}let n=e.charCodeAt(0)===42,r=1;for(;r<t;){let t=e.charCodeAt(r);if(t===60||t===62||t===63)break;r+=1}let i=e.slice(1,r);return i.length===0?{error:`name-less`}:p(i.charCodeAt(i.length-1))?{error:`trailing-marker`}:r<t?e.charCodeAt(r)===63?{error:`optional-removed`}:{error:`constraint-removed`}:n?{kind:`splat`,name:i}:{kind:`param`,name:i}}function g(e){for(let t of m(e)){let e=h(t);if(`error`in e)return e.error}}function _(e){let t=m(e);for(let e=0;e<t.length;e+=1){let n=h(t[e]);if(`error`in n){if(n.error===`optional-removed`){let n=t[e],r=[...t];return r[e]=n.slice(0,n.indexOf(`?`)),{code:`optional-removed`,segment:n,withoutSegment:t.filter((t,n)=>n!==e).join(`/`),requiredForm:r.join(`/`)}}return n.error===`constraint-removed`?{code:`constraint-removed`,segment:t[e]}:void 0}}}const v=/[<>]/u;function y(e){for(let t=0;t<e.length;t+=1){if(e.codePointAt(t)!==63)continue;let n=t+1<e.length?e.codePointAt(t+1):-1;if(n!==-1&&n!==47&&n!==63&&n!==60)return t}return-1}const b=Object.freeze([]),x=Object.freeze({}),S=Object.freeze({urlParams:b,queryParams:b,paramTypeMap:x,pathPattern:``});function C(e,t,n){for(let r of m(e)){if(r.length===0)continue;let e=h(r);`error`in e||e.kind===`static`||(t.push(e.name),n[e.name]=`url`)}}function w(t){let n=[],r=[],i=e.r(),a=y(t);if(a!==-1){let e=t.slice(a+1).split(`&`);for(let t of e){let e=t.trim();e.length>0&&(r.push(e),i[e]=`query`)}t=t.slice(0,a)}return C(t,n,i),T(n,r,e.i(i),t)}function T(e,t,n,r){return{urlParams:e.length===0?b:e,queryParams:t.length===0?b:t,paramTypeMap:e.length===0&&t.length===0?x:n,pathPattern:r}}Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return g}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return d}}),Object.defineProperty(exports,"d",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"f",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"g",{enumerable:!0,get:function(){return a}}),Object.defineProperty(exports,"h",{enumerable:!0,get:function(){return n}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return _}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return f}}),Object.defineProperty(exports,"m",{enumerable:!0,get:function(){return i}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return v}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return h}}),Object.defineProperty(exports,"p",{enumerable:!0,get:function(){return r}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return w}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return m}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return S}}),Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return s}});
-//# sourceMappingURL=buildParamMeta-L7xMPkKw.js.map
+const e=require("./ingest-DxGcWzr6.js"),t=Object.hasOwn;function n(e,n){if(n.length!==0&&e!==void 0)for(let r of n){if(!t(e,r))continue;let n;try{n=e[r]}catch{return}if(n!==void 0)return r}}function r(e,t,r,i,o,s){let c=n(r,i);if(c!==void 0)throw TypeError(`[router.${e}] ${a(t,c,typeof o==`function`?o():o,s)}`)}function i(e,t,n,i){r(e,t,n,i,"the `params` bag this call is about to ship — the channel check above it read a different value, so the caller's object answered differently between the two reads")}function a(e,t,n="the `params` argument",r="Pass it in `search` instead"){return`Route "${e}" declares \`${t}\` as a query param, but it was given in ${n} — the path channel. ${r}; the two channels are separate since RFC-4 M2 and the router never moves a key between them.`}const o=new WeakMap;function s(e){let t=o.get(e);if(!t)throw TypeError(`[real-router] Invalid router instance — not found in internals registry`);return t}function c(e,t,n,i){r(t,n,i,e.getQueryParams(n))}function l(e,t){o.set(e,t)}function u(e,t,n,r){let i=t;for(let t of e){let e=i,n=r===void 0?e:(...t)=>r(e(...t));i=(...e)=>t(n,...e)}return i(...n)}function d(e,t,n){return((...r)=>{let i=n.get(e);return!i||i.length===0?t(...r):u(i,t,r)})}function f(e,t,n,r){return(i,a,o)=>{let s=n.get(e);return!s||s.length===0?t(i,a,o):u(s,t,[i,a,o],r)}}const p=e=>e===58||e===42;function m(e){let t=[],n=0;for(let r=0;r<e.length;r+=1)e.charCodeAt(r)===47&&(t.push(e.slice(n,r)),n=r+1);return t.push(e.slice(n)),t}function h(e){let t=e.length;if(t===0)return{kind:`static`,text:``};if(!p(e.charCodeAt(0))){for(let n=0;n<t;n+=1){let r=e.charCodeAt(n);if(r===60||r===62)return{error:`constraint-removed`};if(p(r)&&n+1<t)return{error:`fused-marker`}}return e.charCodeAt(t-1)===63?{error:`name-less`}:{kind:`static`,text:e}}let n=e.charCodeAt(0)===42,r=1;for(;r<t;){let t=e.charCodeAt(r);if(t===60||t===62||t===63)break;r+=1}let i=e.slice(1,r);return i.length===0?{error:`name-less`}:p(i.charCodeAt(i.length-1))?{error:`trailing-marker`}:r<t?e.charCodeAt(r)===63?{error:`optional-removed`}:{error:`constraint-removed`}:n?{kind:`splat`,name:i}:{kind:`param`,name:i}}function g(e){for(let t of m(e)){let e=h(t);if(`error`in e)return e.error}}function _(e){let t=m(e);for(let e=0;e<t.length;e+=1){let n=h(t[e]);if(`error`in n){if(n.error===`optional-removed`){let n=t[e],r=[...t];return r[e]=n.slice(0,n.indexOf(`?`)),{code:`optional-removed`,segment:n,withoutSegment:t.filter((t,n)=>n!==e).join(`/`),requiredForm:r.join(`/`)}}return n.error===`constraint-removed`?{code:`constraint-removed`,segment:t[e]}:void 0}}}const v=/[<>]/u;function y(e){for(let t=0;t<e.length;t+=1){if(e.codePointAt(t)!==63)continue;let n=t+1<e.length?e.codePointAt(t+1):-1;if(n!==-1&&n!==47&&n!==63&&n!==60)return t}return-1}const b=Object.freeze([]),x=Object.freeze({}),S=Object.freeze({urlParams:b,queryParams:b,paramTypeMap:x,pathPattern:``});function C(e,t,n){for(let r of m(e)){if(r.length===0)continue;let e=h(r);`error`in e||e.kind===`static`||(t.push(e.name),n[e.name]=`url`)}}function w(t){let n=[],r=[],i=e.r(),a=y(t);if(a!==-1){let e=t.slice(a+1).split(`&`);for(let t of e){let e=t.trim();e.length>0&&(r.push(e),i[e]=`query`)}t=t.slice(0,a)}return C(t,n,i),T(n,r,e.i(i),t)}function T(e,t,n,r){return{urlParams:e.length===0?b:e,queryParams:t.length===0?b:t,paramTypeMap:e.length===0&&t.length===0?x:n,pathPattern:r}}const E=/^[A-Z_a-z][\w-]*$/,D=/\S/,O=1e4;function k(e,t){if(e===``)throw TypeError(`[router.${t}] Route name cannot be empty`)}function A(e,t){if(!D.test(e))throw TypeError(`[router.${t}] Route name cannot contain only whitespace`)}function j(e,t){if(e.length>O)throw TypeError(`[router.${t}] Route name exceeds maximum length of ${O} characters`)}function M(e,t){if(e.includes(`.`))throw TypeError(`[router.${t}] Route name "${e}" cannot contain dots. Use children array or { parent } option in addRoute() instead.`)}function N(e,t){if(!E.test(e))throw TypeError(`[router.${t}] Invalid route name "${e}". Name must start with a letter or underscore, followed by letters, numbers, underscores, or hyphens.`)}Object.defineProperty(exports,"_",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return j}}),Object.defineProperty(exports,"b",{enumerable:!0,get:function(){return n}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return w}}),Object.defineProperty(exports,"d",{enumerable:!0,get:function(){return h}}),Object.defineProperty(exports,"f",{enumerable:!0,get:function(){return m}}),Object.defineProperty(exports,"g",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"h",{enumerable:!0,get:function(){return s}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return A}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return _}}),Object.defineProperty(exports,"m",{enumerable:!0,get:function(){return f}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return N}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return S}}),Object.defineProperty(exports,"p",{enumerable:!0,get:function(){return d}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return k}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return v}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return M}}),Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return g}}),Object.defineProperty(exports,"v",{enumerable:!0,get:function(){return r}}),Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return a}}),Object.defineProperty(exports,"y",{enumerable:!0,get:function(){return i}});
+//# sourceMappingURL=route-name-BBu872EN.js.map

package/dist/cjs/route-name-BBu872EN.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-name-BBu872EN.js","names":["LT","QUESTION","SLASH","emptyRecord","publishRecord"],"sources":["../../src/channels/guard.ts","../../src/internals.ts","../../src/engine/path-matcher/parseSegment.ts","../../src/engine/path-matcher/buildParamMeta.ts","../../src/engine/validation/route-name.ts"],"sourcesContent":["// packages/core/src/channels/guard.ts\n\nimport type { Params } from \"../types\";\n\n/**\n * Intrinsics captured at module load: `hasOwn`.\n *\n * ⚑ A guard is only as strong as the intrinsic it reads WHEN IT RUNS, and an\n * application can re-point any of these AFTER boot — which is what this closes.\n * Measured on the uncaptured form: one naive `Object.hasOwn` polyfill walked\n * straight through five sibling readers while the single captured guard held.\n *\n * ⚠ It does NOT close a shim evaluated BEFORE this module — the ordinary\n * polyfill order. Measured: a naive `Object.hasOwn` imported ahead of core\n * reproduces #1798 verbatim (`buildPath` prints the native method into the\n * URL). Two earlier revisions of this header said \"before any application\n * code can run\", which is the sentence a future reader would have trusted.\n */\nconst hasOwn = Object.hasOwn;\n\n/**\n * THE predicate of the always-on channel guard: the first key the caller put in\n * the PATH bag while the route declares it as a QUERY param, or `undefined`\n * when the bag is channel-correct.\n *\n * A DETECTOR, not a normaliser — the key is never moved. Moving it is what\n * `separateChannels` (stage ②) used to do — a function that no longer exists.\n * Channel-correctness is the producer's contract now, not a repair the pipeline\n * performs behind everyone's back.\n *\n * Scans `queryNames` (a route's declared query names — small, cached) rather\n * than the bag, so there is no `Object.keys` allocation, and short-circuits on\n * a route with no query declarations, which is the common case.\n *\n * `undefined` is absence on both sides (#1550 / #1551), so an\n * `undefined`-valued key is NOT a mis-channel: it is the documented removal\n * marker `persistent-params` relies on, and it never reaches a built state\n * anyway. A name that also occupies a path slot (`/items/:id?id`) is absent\n * from `queryNames` by construction (#843 / #1549 carve-out), so the collision\n * form is legitimately path-owned and passes.\n *\n * @internal\n */\nexport function findMisChanneledKey(\n  params: Params | undefined,\n  queryNames: readonly string[],\n): string | undefined {\n  if (queryNames.length === 0 || params === undefined) {\n    return undefined;\n  }\n\n  for (const key of queryNames) {\n    if (!hasOwn(params, key)) {\n      continue;\n    }\n\n    let value: unknown;\n\n    try {\n      value = params[key];\n    } catch {\n      // A DIAGNOSTIC must never become the thing that throws. The bag may be\n      // backed by accessors (a Proxy, a getter, a framework's reactive object),\n      // and reading one here happens EARLIER than any consumer would have read\n      // it — so an accessor that throws would surface from the guard instead of\n      // from the code that actually needed the value, moving the origin of an\n      // existing failure. Treat it as \"nothing to report\" and let the real\n      // consumer hit the same accessor exactly as it did before.\n      return undefined;\n    }\n\n    if (value !== undefined) {\n      return key;\n    }\n  }\n\n  return undefined;\n}\n\n/**\n * THE centralized channel check — the single place a mis-channelled bag is\n * refused, wherever it came from.\n *\n * Replaces the repair `separateChannels` (stage ②, since deleted) used to\n * perform at the `forwardState` seam. A key the route declares with `?`, sitting in the PATH\n * bag, is a producer's mistake — the producer named the route, so it knows the\n * declaration — and the router now says so instead of quietly moving the field\n * into the other object. Moving it was invisible: the caller kept believing\n * their bag was the one that shipped, and two producers of the SAME intent\n * could disagree about which channel a key ended up in.\n *\n * `source` names WHOSE bag is wrong, which is the whole diagnostic value at a\n * seam: the caller's argument, a `forwardState` interceptor's return, or the\n * output of a route's own `decodeParams`. It takes a THUNK as well as a string\n * because the seam sits on the navigation hot path — a source that has to be\n * composed (naming the route a chain forwarded from) must not build its string\n * on every call just to discard it on the 99.99% of calls that pass.\n *\n * @internal\n */\nexport function assertChannelCorrect(\n  method: string,\n  routeName: string,\n  params: Params | undefined,\n  queryNames: readonly string[],\n  source?: string | (() => string),\n  remedy?: string,\n): void {\n  const key = findMisChanneledKey(params, queryNames);\n\n  if (key !== undefined) {\n    throw new TypeError(\n      `[router.${method}] ${misChanneledKeyMessage(\n        routeName,\n        key,\n        typeof source === \"function\" ? source() : source,\n        remedy,\n      )}`,\n    );\n  }\n}\n\n/**\n * The guard's actionable message. One builder for every position, so the\n * wording a user sees does not depend on which door they came through — the\n * facade's `TypeError`, the seam's, the decoder's, and `navigateToState`'s\n * `RouterError(WRONG_CHANNEL)`, which needs the wording WITHOUT the throw and is\n * why this is a separate function from {@link assertChannelCorrect}.\n *\n * @internal\n */\n/**\n * The channel verdict, re-asked on the bag that actually SHIPS (#1927).\n *\n * Every position above a producer reads the CALLER's object — P1 at the door,\n * the `forwardState` seam, the `decodeParams` boundary. The canonical bag is\n * then built by a SECOND read of that same object, and between the two it still\n * belongs to the application: a Proxy, a framework's reactive object, a plain\n * getter. Measured before this existed: `makeState` read the bag twice and\n * `navigate` three times, and a bag answering `undefined` while the guards\n * looked — the documented removal marker, correctly waved through — committed a\n * declared query name into `state.params` while `state.path` printed without it.\n *\n * The SAME predicate, one position later, on core's own object. A canonical bag\n * has no accessors, so this verdict cannot be overtaken: the invariant is\n * structural rather than maintained by care.\n *\n * ⚑ Called by the four doors that PUBLISH a State, and by no one else. The two\n * render-path predicates — `buildPath` (a string) and `isActiveRoute` (a boolean)\n * — ship no value for a verdict to vouch for, and #1572 / #1581 record that they\n * are deliberately not instrumented: detecting there is fine, throwing is not.\n * They express that the way they always have, by not calling.\n *\n * ⚠ `canNavigateTo` produces a State too and is deliberately NOT here — measured,\n * not assumed. It discards the state, so nothing ships for a verdict to vouch\n * for, and every bag this check would refuse it already answers `false` to: the\n * seam sees the same key one read earlier. Adding the call changed no answer for\n * any blindness from 0 to 3 reads, while costing one predicate call on the render\n * path, which runs per `<Link>` per render.\n *\n * ⚑ On a canonical bag the `value !== undefined` arm is vacuous — those keys are\n * already dropped — so `undefined` stays the removal marker (#1550 / #1551).\n *\n * ⚑ The declarations are the RESOLVED route's, which is why callers pass\n * `canonical.name`: the bag came out of the chain, and the resolved route owns\n * the URL that gets printed — the same authority the seam names.\n */\nexport function assertShippedChannelCorrect(\n  method: string,\n  routeName: string,\n  shipped: Params,\n  queryNames: readonly string[],\n): void {\n  assertChannelCorrect(\n    method,\n    routeName,\n    shipped,\n    queryNames,\n    \"the `params` bag this call is about to ship — the channel check above it read a different value, so the caller's object answered differently between the two reads\",\n  );\n}\n\nexport function misChanneledKeyMessage(\n  routeName: string,\n  key: string,\n  source = \"the `params` argument\",\n  remedy = \"Pass it in `search` instead\",\n): string {\n  return `Route \"${routeName}\" declares \\`${key}\\` as a query param, but it was given in ${source} — the path channel. ${remedy}; the two channels are separate since RFC-4 M2 and the router never moves a key between them.`;\n}\n","import { assertChannelCorrect } from \"./channels\";\n\nimport type { RouteTree } from \"./engine\";\nimport type { DependenciesStore } from \"./namespaces\";\nimport type { RoutesStore } from \"./namespaces/RoutesNamespace\";\nimport type { RouteResolver } from \"./pipeline\";\nimport type { Router as RouterClass } from \"./Router\";\nimport type {\n  AnyOptions,\n  DefaultDependencies,\n  EventName,\n  LoggerConfig,\n  NavigationOptions,\n  Options,\n  Params,\n  Plugin,\n  Router as RouterInterface,\n  RouterLogger,\n  RouteTreeState,\n  SearchParams,\n  SerializedRouterState,\n  SimpleState,\n  State,\n  TreeChangedEvent,\n  Unsubscribe,\n  EventMethodMap,\n  PluginFactory,\n} from \"./types\";\nimport type { Limits } from \"./types/internal\";\nimport type { RouterValidator } from \"./types/RouterValidator\";\n\nexport interface RouterInternals<\n  D extends DefaultDependencies = DefaultDependencies,\n> {\n  readonly makeState: <\n    P extends Params = Params,\n    S extends SearchParams = SearchParams,\n  >(\n    name: string,\n    params?: P,\n    search?: S,\n    path?: string,\n  ) => State<P, S>;\n\n  /**\n   * Per-segment param-source map for a route name (`{ segment: { param: \"url\" |\n   * \"query\" } }`), read from the live matcher — the ownership channel for\n   * `getTransitionPath` (RFC-4 M2 / #1548, replaced the removed per-State\n   * `stateMetaStore` WeakMap). `undefined` when the name is not in the tree.\n   */\n  readonly getMetaForState: (\n    name: string,\n  ) => Record<string, Record<string, \"url\" | \"query\">> | undefined;\n\n  /**\n   * The route's DECLARED query-param names — the same registry the URL build\n   * prints from (#1556), minus path slots. Feeds the always-on channel guard\n   * (#1572); read here rather than re-derived, so classification cannot drift.\n   */\n  readonly getQueryParams: (name: string) => readonly string[];\n\n  readonly forwardState: <\n    P extends Params = Params,\n    S extends SearchParams = SearchParams,\n  >(\n    routeName: string,\n    routeParams: P,\n    routeSearch?: S,\n  ) => SimpleState<P, S>;\n\n  readonly buildStateResolved: (\n    resolvedName: string,\n    resolvedParams: Params,\n  ) => RouteTreeState | undefined;\n\n  readonly matchPath: <P extends Params = Params>(\n    path: string,\n    options?: AnyOptions,\n  ) => State<P> | undefined;\n\n  readonly getOptions: () => Options<D>;\n\n  readonly addEventListener: <E extends EventName>(\n    eventName: E,\n    cb: Plugin[EventMethodMap[E]],\n  ) => Unsubscribe;\n\n  /**\n   * Route-tree mutation channel — internal access for the `getRoutesApi`\n   * wrapper. A dedicated bridge is required because the public\n   * `addEventListener<E extends EventName>` structurally rejects\n   * `\"TREE_CHANGED\"` (it is not in the public `EventName` union), is strict on\n   * duplicates, and exposes neither `emit` nor `listenerCount`.\n   */\n  readonly treeChanged: {\n    readonly emit: (event: TreeChangedEvent) => void;\n    readonly subscribe: (\n      handler: (event: TreeChangedEvent) => void,\n    ) => Unsubscribe;\n    readonly listenerCount: () => number;\n    /**\n     * True while a `TREE_CHANGED` emit is on the stack — `getRoutesApi` reads it\n     * to reject reentrant route-CRUD from a `subscribeChanges` handler (#1032).\n     */\n    readonly isEmitting: () => boolean;\n  };\n\n  readonly buildPath: (\n    route: string,\n    params?: Params,\n    search?: SearchParams,\n  ) => string;\n\n  /**\n   * The navigation pipeline's read-model, for entry points that live on this\n   * plugin-facing surface rather than in a namespace. Resolved LAZILY: the port\n   * is created during wiring, and `registerInternals` runs before that, so the\n   * accessor is a closure rather than a value — the same shape the interceptable\n   * methods above already use.\n   */\n  readonly port: () => RouteResolver;\n\n  readonly emitTransitionError: (error: Error) => void;\n\n  /**\n   * Commits the not-found (`UNKNOWN_ROUTE`) state for `path` and emits\n   * `TRANSITION_SUCCESS` — the `NavigationNamespace.navigateToNotFound`\n   * primitive. `replace()` uses it when a structural replace drops the active\n   * route, so subscribers are notified instead of the state silently clearing\n   * (#950).\n   */\n  readonly navigateToNotFound: (path: string) => State;\n\n  /**\n   * The `replace()` revalidation's twin of the above: commits `UNKNOWN_ROUTE`\n   * WITHOUT consulting the departing route's `canDeactivate` (#1652, #1981).\n   * A tree swap is not a departure the user chose.\n   */\n  readonly revalidateToNotFound: (path: string) => State;\n\n  readonly start: (path: string) => Promise<State>;\n\n  /**\n   * Plugin-only navigation entry point — delegates to\n   * `NavigationNamespace.navigateToState` (`getPluginApi(router).navigateToState`).\n   * Hidden from `Router`/`Navigator` to keep the userland surface minimal;\n   * see `core-types/src/api.ts` for usage docs.\n   */\n  readonly navigateToState: (\n    state: State,\n    options?: NavigationOptions,\n  ) => Promise<State>;\n\n  /* eslint-disable @typescript-eslint/no-explicit-any -- heterogeneous map: stores different InterceptorFn<M> types under different keys */\n  readonly interceptors: Map<\n    string,\n    ((next: (...args: any[]) => any, ...args: any[]) => any)[]\n  >;\n  /* eslint-enable @typescript-eslint/no-explicit-any */\n\n  readonly setRootPath: (rootPath: string) => void;\n  readonly getRootPath: () => string;\n\n  readonly getTree: () => RouteTree;\n\n  readonly isDisposed: () => boolean;\n\n  validator: RouterValidator | null;\n\n  // Per-router logger instance (built from `options.logger` in the Router\n  // constructor). The facade reads it as `getInternals(this).logger`; namespaces\n  // receive it via their deps at wiring; plugins reach it through\n  // `getPluginApi(router).logger`. Replaces the former process-global singleton\n  // from the standalone `@real-router/logger` package (now folded into\n  // `utils/logger`), whose `configure()` leaked across routers (#724).\n  readonly logger: RouterLogger;\n\n  // Dependencies (issue #172)\n  readonly dependenciesGetStore: () => DependenciesStore<D>;\n\n  // Clone support (issue #173, consolidated #964). One accessor for the\n  // source-side snapshot a clone carries over besides the route store, so a new\n  // clone-relevant subsystem is wired in a single place instead of being spread\n  // across separate methods.\n  readonly getCloneState: () => {\n    options: Options<D>;\n    dependencies: Record<string, unknown>;\n    pluginFactories: PluginFactory<D>[];\n    // Resolved logger config of the base router, so a clone can build its OWN\n    // logger inheriting the base's level/callback. Frozen `options` do NOT carry\n    // `logger` (stripped in the constructor), so `options` above can't convey it;\n    // cloneRouter merges a per-request override (traceId) over this snapshot.\n    loggerConfig: LoggerConfig;\n    // Resolved limits of the base router (#1880). Same reason as `loggerConfig`\n    // one line up: `options.limits` is the caller's own bag, so a clone built\n    // from it re-invokes an accessor there and can end up with a different cap\n    // than its base. The base already resolved them to numbers; the clone\n    // inherits that rather than re-reading.\n    limits: Limits;\n    // The KEY SET the base was CONSTRUCTED with (#1961). `limits` above carries\n    // the resolved VALUES, which is what #1880 needed; the clone also needs to\n    // know which of them the caller actually passed, because substituting the\n    // whole resolved bag materialises the unset defaults into the clone's\n    // reported options and `validation-plugin` refuses one such pair at install.\n    //\n    // ⚠ A snapshot rather than `Object.keys(options.limits)` at clone time,\n    // which is what this replaced: `options.limits` is the caller's own object\n    // and, for a bag `deepFreeze` does not reach, still mutable. Deleting a key\n    // after construction left the base capped and every later clone uncapped.\n    //\n    // `undefined` — not `[]` — when the caller passed no bag at all, so the\n    // clone can tell \"nothing to substitute\" from \"an empty bag\", which\n    // `options.limits` itself still distinguishes (`undefined` vs `null` vs\n    // `{}`) and which the clone must not flatten.\n    //\n    // ⚠ Handed out BY REFERENCE and therefore FROZEN at the source, exactly as\n    // `limits` above is: `readonly string[]` is a compile-time claim and this\n    // surface is reached by plugins through `@real-router/core/validation`.\n    limitKeys: readonly string[] | undefined;\n  };\n\n  // Consolidated route data store (issue #174 Phase 2)\n  readonly routeGetStore: () => RoutesStore<D>;\n\n  // Cross-namespace state (issue #174)\n  readonly getStateName: () => string | undefined;\n  readonly isTransitioning: () => boolean;\n  /**\n   * Commit a state that is NOT the product of a navigation — the 404 bypass and\n   * `replace()`'s revalidation. Writes AND announces through the FSM\n   * `SYSTEM_COMMIT` action, so neither half happens outside the table.\n   *\n   * THROWS when the machine has no edge to take. The throw is NOT redundant\n   * with the table: a refusal there is silent (a `send` from a state without an\n   * edge is a no-op), and the contract these callers already had promises an\n   * error, not a quietly skipped commit (#1186).\n   *\n   * Two codes, and the split is #1644's: `ROUTER_DISPOSED` only for a router\n   * that IS disposed, `ROUTER_NOT_STARTED` for every other refusal — stopped,\n   * never started, still STARTING, or mid-transition — because `SYSTEM_COMMIT`\n   * is declared on `READY` alone and therefore also refuses routers that are\n   * very much alive. The phase rides the message rather than the code.\n   */\n  readonly systemCommit: (\n    toState: State,\n    fromState: State | undefined,\n    opts: NavigationOptions,\n  ) => State;\n  readonly routerExtensions: { keys: string[] }[];\n  readonly contextClaimRecords: Set<string>;\n\n  /**\n   * One-shot hydration scratchpad populated by `hydrateRouter` immediately\n   * before delegating to `router.start(parsed.path)` and cleared in the\n   * matching `finally`. SSR loader plugins read this slot directly via\n   * `getInternals(router).hydrationState` to short-circuit their own loader\n   * call when the server-resolved namespace value is already present in the\n   * parsed state (#596). `null` outside of an active `hydrateRouter`\n   * invocation.\n   */\n  hydrationState: SerializedRouterState | null;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any -- existential type: stores RouterInternals for all Dependencies types\nconst internals = new WeakMap<object, RouterInternals<any>>();\n\nexport function getInternals<D extends DefaultDependencies>(\n  router: RouterInterface<D>,\n): RouterInternals<D> {\n  const ctx = internals.get(router);\n\n  if (!ctx) {\n    throw new TypeError(\n      \"[real-router] Invalid router instance — not found in internals registry\",\n    );\n  }\n\n  return ctx as RouterInternals<D>;\n}\n\n/**\n * Channel guard, position P1 (#1572) — the caller's RAW `params` argument, at\n * the API boundary and BEFORE any interceptor runs, so what it reports is what\n * the CALLER wrote (a plugin's later injection is P2's population, not this one).\n *\n * THROWS. The warn-first step (#1572) announced the contract so every call site\n * could identify itself in the logs; this is the promotion it announced.\n *\n * A `TypeError`, synchronous, rather than a `RouterError` on a rejected promise:\n * this is an ARGUMENT-shape defect at the API boundary, caught before any\n * interceptor or transition exists — the same class as the `subscribe` /\n * `navigateToNotFound` / `start` guards beside it. Rejecting instead would let a\n * `.catch()` written for navigation failures swallow a programming error.\n *\n * P3 (`navigateToState`) keeps REJECTING — deliberately asymmetric, because it\n * takes a ready-made `State` from a popstate handler, where a new synchronous\n * throw would change an existing method's failure shape.\n *\n * The predicates (`buildPath` / `isActiveRoute` / `canNavigateTo`) are still NOT\n * instrumented: they run on every `<Link>` render, an answer there is read\n * immediately and corrupts nothing, and throwing inside a render in six adapters\n * is not a trade this guard is worth.\n *\n * ⚠ Not instrumented ≠ blind. `canNavigateTo` answers whether `navigate` WOULD\n * work, so it consults {@link findMisChanneledKey} directly and returns `false`\n * for a shape this function would have thrown on (#1576) — an answer, not a\n * throw, so the render-path trade above is untouched. `buildPath` /\n * `isActiveRoute` ask a different question and are unchanged.\n *\n * @internal\n */\nexport function throwOnMisChanneledKey<D extends DefaultDependencies>(\n  ctx: RouterInternals<D>,\n  method: string,\n  routeName: string,\n  params: Params | undefined,\n): void {\n  assertChannelCorrect(\n    method,\n    routeName,\n    params,\n    ctx.getQueryParams(routeName),\n  );\n}\n\nexport function registerInternals<D extends DefaultDependencies>(\n  router: RouterClass<D>,\n  ctx: RouterInternals<D>,\n): void {\n  internals.set(router, ctx);\n}\n\n/* eslint-disable @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-argument -- internal chain execution: type safety enforced at public API boundary (PluginApi.addInterceptor) */\nfunction executeInterceptorChain<T>(\n  interceptors: ((next: (...args: any[]) => any, ...args: any[]) => any)[],\n  original: (...args: any[]) => T,\n  args: any[],\n  sanitiseNext?: (result: T) => T,\n): T {\n  let chain = original as (...args: any[]) => any;\n\n  for (const interceptor of interceptors) {\n    const prev = chain;\n    // ⚑ The `next` an interceptor RECEIVES is wrapped, not the value it returns\n    // (#1986). This covers exactly the boundaries nothing else does — `original`\n    // into the first interceptor, and each interceptor into the one outside it —\n    // and leaves the outermost hop's result to the seam's own exit copy.\n    //\n    // ⚠ The alternative, wrapping the RETURN, was built and measured rather\n    // than argued about. It puts two mechanisms on that last boundary, and one\n    // cell stops discriminating: \"an interceptor's OWN poison does not leave the\n    // door either\". It does NOT make the exit copy redundant — the\n    // no-interceptor fast path skips this chain entirely, so two other cells\n    // still red that copy's removal either way.\n    const next =\n      sanitiseNext === undefined\n        ? prev\n        : (...nextArgs: any[]) => sanitiseNext(prev(...nextArgs) as T);\n\n    chain = (...chainArgs: any[]) => interceptor(next, ...chainArgs);\n  }\n\n  return chain(...args) as T;\n}\n\n/**\n * Variadic interceptor wrapper — wraps a function of any arity, returning the\n * same callable type `T`. Use {@link createTernaryInterceptable} instead when\n * the wrapped method takes exactly three args and the caller needs the precise\n * `(a, b, c) => r` signature preserved (the variadic form widens args to\n * `any[]`).\n */\nexport function createInterceptable<T extends (...args: any[]) => any>(\n  name: string,\n  original: T,\n  interceptors: Map<\n    string,\n    ((next: (...args: any[]) => any, ...args: any[]) => any)[]\n  >,\n): T {\n  return ((...args: any[]) => {\n    const chain = interceptors.get(name);\n\n    if (!chain || chain.length === 0) {\n      return original(...args);\n    }\n\n    return executeInterceptorChain(chain, original, args);\n  }) as T;\n}\n\n/**\n * Three-argument interceptor wrapper — preserves the exact\n * `(a: A, b: B, c: C) => R` signature that the variadic\n * {@link createInterceptable} widens to `any[]`. Backs both search-aware\n * interceptables — `buildPath(route, params, search)` and\n * `forwardState(name, params, search)` (RFC-4 M2 / #1548). Every first-party\n * plugin registers the full three-argument form; a shorter-arity interceptor\n * from a third party remains type-valid (TS allows fewer params, and `next(a,\n * b)` leaves the third arg `undefined`).\n *\n * ⚑ `sanitiseNext` is applied to whatever `next` hands an interceptor, at every\n * hop (#1986). It exists because `forwardState` returns CONTAINERS a plugin is\n * documented to merge, so what one interceptor hands the next is a hand-out in\n * the #1957 sense; `buildPath` returns a string and passes nothing. The seam\n * that needs it owns the function — this module only applies it.\n *\n * ⚠ It does NOT reach the chain's own return value. That one goes to the caller,\n * which is the seam's own business and already has an exit copy.\n */\nexport function createTernaryInterceptable<A, B, C, R>(\n  name: string,\n  original: (a: A, b: B, c: C) => R,\n  interceptors: Map<\n    string,\n    ((next: (...args: any[]) => any, ...args: any[]) => any)[]\n  >,\n  sanitiseNext?: (result: R) => R,\n): (a: A, b: B, c: C) => R {\n  return (arg1: A, arg2: B, arg3: C) => {\n    const chain = interceptors.get(name);\n\n    if (!chain || chain.length === 0) {\n      return original(arg1, arg2, arg3);\n    }\n\n    return executeInterceptorChain(\n      chain,\n      original,\n      [arg1, arg2, arg3],\n      sanitiseNext,\n    );\n  };\n}\n/* eslint-enable @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-argument */\n","/**\n * Canonical route-segment tokenizer.\n *\n * The single owner of \"where does a name / marker / constraint end\" for ONE\n * path segment (post-`/`-split). It replaces the five name-boundary compositions\n * of `PARAM_NAME_PATTERN` currently spread across `buildParamMeta` (L1),\n * `registration` (L2 build + L3 trie), and `route-tree`'s validation gate (L4),\n * so those layers can never disagree on a boundary (the gate↔backstop drift\n * class — #858 / #1050 / #1150 / #1311 / #1149 / #1324).\n *\n * A single left-to-right `charCodeAt` scan produces either a token tuple or a\n * typed error. Grammar — **3 tokens only** (`static | :param | *splat`); the\n * grammar has no optional `:x?` or `<re>` constraint forms. Any `<`/`>` or a\n * post-name `?` in the path is a *registration error* carrying a replacement\n * recipe (`optional-removed` / `constraint-removed`), not a token:\n * 1. Leading `:`/`*` → param/splat; otherwise `static` (a marker glued *after* a\n *    static prefix ⇒ `fused-marker`; any `<`/`>` (a former constraint) ⇒\n *    `constraint-removed`; a trailing `?` on a marker-less segment ⇒ `name-less`\n *    — the modifier has no param name, #1241 / `/faq?`).\n * 2. name = any char except `<`/`?` (no `/` remains inside a segment); a name\n *    ending in a bare `:`/`*` ⇒ `trailing-marker` (#1324). A *mid* marker stays\n *    a name char — `:a:b` → name `a:b`, preserved.\n * 3. empty name ⇒ `name-less` (#858).\n * 4. a `<` after the name (a former `<re>` constraint) ⇒ `constraint-removed`.\n * 5. a post-name `?` (a former optional modifier, on `:param` or `*splat`) ⇒\n *    `optional-removed`.\n *\n * @module parseSegment\n */\n\n/* eslint-disable unicorn/prefer-code-point, unicorn/prefer-includes-over-repeated-comparisons, sonarjs/cognitive-complexity -- charCodeAt code-unit scan + a single inlined branchy pass are this RFC's char-scan perf basis (§9); the same deliberate choices as registration/trie.ts hasNonAsciiSegment (#1285) and SegmentMatcher's inlined #traverseFrom. A `[LT,GT,QUESTION].includes(code)` boundary check would allocate an array literal per scanned char. Markers compared are ASCII (`:` `*` `<` `>` `?`, < 0x80). */\n\n/** A successfully tokenized segment (3-token grammar: `static | :param | *splat`). */\nexport type SegmentTokens =\n  | { readonly kind: \"static\"; readonly text: string }\n  | { readonly kind: \"param\"; readonly name: string }\n  | { readonly kind: \"splat\"; readonly name: string };\n\n/** Grammar-shape rejections, each mirroring a registration guard. */\nexport type SegmentErrorCode =\n  | \"name-less\" // #858 — a marker with no name\n  | \"trailing-marker\" // #1324 — a param name ending in a bare `:`/`*`\n  | \"fused-marker\" // #1050 — a marker glued after a static prefix\n  | \"optional-removed\" // M1 — a `:x?`/`*x?` optional modifier (removed; two sibling routes)\n  | \"constraint-removed\"; // M1 — a `<re>` constraint or stray `<`/`>` (removed; validate in a guard)\n\nexport interface SegmentError {\n  readonly error: SegmentErrorCode;\n}\n\nconst COLON = 58; // :\nconst STAR = 42; // *\nconst LT = 60; // <\nconst GT = 62; // >\nconst QUESTION = 63; // ?\nconst SLASH = 47; // /\n\nconst isMarker = (code: number): boolean => code === COLON || code === STAR;\n\n/**\n * Splits a path into its `/`-delimited segments. A plain `/`-split (M1): the\n * 3-token grammar has no `<...>` constraint whose body could legally contain a\n * `/`, so no constraint-awareness is needed — a stray `<`/`>` is a\n * `constraint-removed` error, caught per segment by `parseSegment`. This is the\n * **segmentation** half of the path-grammar unification: `parseSegment` owns the\n * per-segment grammar, `splitPathSegments` owns where a segment begins and ends.\n *\n * @param path - a route path (query already stripped by the caller)\n * @returns the segments in order, including empty leading/trailing/`//` segments\n *   (the caller skips empties, matching the current behaviour)\n */\nexport function splitPathSegments(path: string): string[] {\n  const segments: string[] = [];\n  let start = 0;\n\n  for (let i = 0; i < path.length; i += 1) {\n    if (path.charCodeAt(i) !== SLASH) {\n      continue;\n    }\n\n    segments.push(path.slice(start, i));\n    start = i + 1;\n  }\n\n  segments.push(path.slice(start));\n\n  return segments;\n}\n\n/**\n * Tokenizes a single path segment (already split on `/`).\n *\n * @param segment - one `/`-delimited segment of a route path\n * @returns the segment's tokens, or a typed grammar error\n */\nexport function parseSegment(segment: string): SegmentTokens | SegmentError {\n  const length = segment.length;\n\n  if (length === 0) {\n    return { kind: \"static\", text: \"\" };\n  }\n\n  // ---- static segment (no leading marker) -------------------------------\n  if (!isMarker(segment.charCodeAt(0))) {\n    for (let i = 0; i < length; i += 1) {\n      const code = segment.charCodeAt(i);\n\n      // A `<`/`>` (a former `<re>` constraint or a stray delimiter) is no longer\n      // grammar — M1 removed constraints. Reject with the constraint recipe.\n      if (code === LT || code === GT) {\n        return { error: \"constraint-removed\" };\n      }\n\n      // A marker glued after a static prefix is extracted as a param by build/meta\n      // but compiled as a static literal by the trie (#1050) — reject it as fused.\n      // A marker ENDING the segment (a static ending in `:`/`*` — `/a:`, `/a*`, F2)\n      // is NOT fused: caught by `i + 1 < length` being false. Every other following\n      // char is fused — including a `?` (`a:?`): that shape never reaches the\n      // tokenizer through a real path (a `?` after a bare marker is not a valid\n      // `:name?` form, so the query mask strips it before `/`-segmentation), so a\n      // direct call correctly reports fused-marker. (`a<`/`a>` already returned\n      // `constraint-removed` above, so no `<`-follows exception is needed here.)\n      if (isMarker(code) && i + 1 < length) {\n        return { error: \"fused-marker\" };\n      }\n    }\n\n    // A trailing `?` is a former optional modifier; on a marker-less segment (no\n    // param name) it is a modifier-with-no-name — name-less (#858/#1241, `/faq?`),\n    // NOT `optional-removed` (there is no param to route to two siblings). The\n    // backstop rejects it by the SAME rule: `processSegment` asks this tokenizer\n    // for the segment's kind (#1998). Owning the `?` here (not\n    // only in the marker branch) is what lets the gate and backstop agree on it —\n    // otherwise the gate reads `faq?` as a valid static (#1324 §4).\n    if (segment.charCodeAt(length - 1) === QUESTION) {\n      return { error: \"name-less\" };\n    }\n\n    return { kind: \"static\", text: segment };\n  }\n\n  const splat = segment.charCodeAt(0) === STAR;\n\n  // ---- name: up to the first `<`/`>` (former constraint delimiter, reserved —\n  // В1.3) or `?` (former optional). A segment holds no `/`. -----------------\n  let cursor = 1;\n\n  while (cursor < length) {\n    const code = segment.charCodeAt(cursor);\n\n    if (code === LT || code === GT || code === QUESTION) {\n      break;\n    }\n\n    cursor += 1;\n  }\n\n  const name = segment.slice(1, cursor);\n\n  if (name.length === 0) {\n    return { error: \"name-less\" }; // #858\n  }\n\n  if (isMarker(name.charCodeAt(name.length - 1))) {\n    return { error: \"trailing-marker\" }; // #1324\n  }\n\n  // ---- former constraint / optional modifiers (removed in M1) ------------\n  // The name scan stops at the first `<`/`>` or `?`. Either is a form removed\n  // in M1: a `<re>` constraint (also a stray `<`/`>` — В1.3), or a `:x?`/`*x?`\n  // optional. Only `?` is the optional; `<`/`>` are the constraint recipe.\n  // Reject with the matching replacement recipe rather than tokenize it.\n  if (cursor < length) {\n    return segment.charCodeAt(cursor) === QUESTION\n      ? { error: \"optional-removed\" }\n      : { error: \"constraint-removed\" }; // LT or GT\n  }\n\n  return splat ? { kind: \"splat\", name } : { kind: \"param\", name };\n}\n\n/**\n * Returns the first per-segment grammar error in a path, or `undefined` if every\n * segment tokenizes cleanly.\n *\n * The **validation-facing** entry over the tokenizer: `route-tree`'s\n * `validateRoutePath` calls this instead of re-running its own split+parse loop,\n * so the gate and the matcher's own grammar cannot drift (#1324) and the loop\n * stays single-sourced here — the tokenizer primitives (`parseSegment`,\n * `splitPathSegments`) need not leak into the package's public surface. An empty\n * segment tokenizes as `static` (never an error), so leading/trailing/`//`\n * empties are skipped naturally.\n *\n * @param path - a route path (query already stripped by the caller)\n * @returns the first `SegmentErrorCode` (scanned left to right), or `undefined`\n */\nexport function findSegmentGrammarError(\n  path: string,\n): SegmentErrorCode | undefined {\n  for (const segment of splitPathSegments(path)) {\n    const token = parseSegment(segment);\n\n    if (\"error\" in token) {\n      return token.error;\n    }\n  }\n\n  return undefined;\n}\n\n/** A removed-form (M1) match, describing the offending segment and — for an\n * optional — the two sibling paths that replace it (path without the optional\n * segment + path with the param made required). The route-tree gate uses this to\n * build a route-contextual replacement recipe; the matcher backstop uses only the\n * error code (a shorter, path-free recipe). */\nexport type RemovedForm =\n  | {\n      readonly code: \"optional-removed\";\n      readonly segment: string;\n      readonly withoutSegment: string;\n      readonly requiredForm: string;\n    }\n  | { readonly code: \"constraint-removed\"; readonly segment: string };\n\n/**\n * The rich (route-tree gate) view over the tokenizer for a removed form: finds\n * the first `optional-removed` / `constraint-removed` segment and, for an\n * optional, computes its two replacement sibling paths from the ACTUAL path\n * (dropping the segment → without-form; dropping the trailing `?` → required\n * form). Returns `undefined` if no removed form is present (the gate then uses\n * `findSegmentGrammarError` for a surviving grammar rejection).\n *\n * @param path - a route path (query already stripped by the caller)\n */\nexport function describeRemovedForm(path: string): RemovedForm | undefined {\n  const segments = splitPathSegments(path);\n\n  for (let i = 0; i < segments.length; i += 1) {\n    const token = parseSegment(segments[i]);\n\n    if (!(\"error\" in token)) {\n      continue;\n    }\n\n    // First error wins (mirrors `findSegmentGrammarError`): describe it ONLY if\n    // it is a removed form, else return undefined so the caller falls to the\n    // surviving-code message — this keeps the gate's reason in lockstep with the\n    // matcher backstop's first-error verdict.\n    if (token.error === \"optional-removed\") {\n      const segment = segments[i];\n      const required = [...segments];\n\n      // Drop the `?` optional modifier AND everything after it (the tokenizer\n      // stopped the name at the first `?`, so it is the modifier). Using the `?`\n      // index — not a blind `slice(0, -1)` — keeps the required sibling VALID for\n      // a reverse/compound form whose `?` is not the last char: `:b?<x>` → `:b`\n      // (not `:b?<x`), `:id??` → `:id` (not `:id?`). #1516\n      required[i] = segment.slice(0, segment.indexOf(\"?\"));\n\n      return {\n        code: \"optional-removed\",\n        segment,\n        withoutSegment: segments.filter((_, j) => j !== i).join(\"/\"),\n        requiredForm: required.join(\"/\"),\n      };\n    }\n\n    return token.error === \"constraint-removed\"\n      ? { code: \"constraint-removed\", segment: segments[i] }\n      : undefined;\n  }\n\n  return undefined;\n}\n","/**\n * Route Parameter Metadata Extraction.\n *\n * Extracts parameter metadata from route path patterns without requiring\n * a full path-parser instance. Replaces parser.urlParams/queryParams.\n *\n * @module buildParamMeta\n */\n\nimport { parseSegment, splitPathSegments } from \"./parseSegment\";\nimport { emptyRecord, publishRecord } from \"../../utils/ingest\";\n\nimport type { ParamMeta } from \"./types\";\n\n/**\n * A query-param NAME may not contain `<`/`>` (#1242 §5.1) — a constraint\n * delimiter leaked into the query via a reverse-order modifier typo (`/a/:b?<c>`\n * parses the `?` as the query start, making `<c>` the query name). Consumed by\n * the route-tree gate and the `registerTree` backstop; relocated here from the\n * deleted `constraint-grammar.ts` when M1 removed constraints (query-param name\n * validation is a query concern, and this module owns query extraction).\n */\nexport const INVALID_QUERY_NAME_RGX = /[<>]/u;\n\nconst QUESTION = 0x3f; // ?\nconst SLASH = 0x2f; // /\nconst LT = 0x3c; // <\n\n/**\n * Locates the query separator `?` in a route path — the FIRST `?` whose tail is\n * non-empty and does not begin with `/`, `?`, or `<` (M1 §3.3). The 3-token\n * grammar leaves `?` a single role (there is no optional modifier and no\n * constraint body to hide one), so no length-preserving mask is needed. The three\n * excluded tails keep a REMOVED form in the path part, where `parseSegment`\n * rejects it with a recipe instead of mis-reading it as a query declaration:\n * - end-of-string (`/:id?`) and `/` (`/:id?/edit`) → a bare `:x?` optional;\n * - `?` (`/:id??tab`) → the leading `?` is the optional, the later `?` the query;\n * - `<` (`/a/:b?<x>`) → a reverse-order `:b?<x>` (optional then a former constraint).\n *\n * @param path - a route path\n * @returns the index of the query separator, or -1 if there is none\n */\nfunction findQuerySeparator(path: string): number {\n  for (let i = 0; i < path.length; i += 1) {\n    if (path.codePointAt(i) !== QUESTION) {\n      continue;\n    }\n\n    // `next` is the code point after the `?`, or the `-1` sentinel at end-of-string.\n    // The `-1` sentinel is the SOLE end-of-string guard — the former separate\n    // `next !== undefined` conjunct was dead (the ternary bounds the index, so\n    // `codePointAt` never returns `undefined`; the `!` is a type assertion, not a\n    // runtime branch, so it keeps the scan at 100% coverage). Mirrors `#scanPath`.\n    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- ternary-bounded in-range index; codePointAt is defined\n    const next = i + 1 < path.length ? path.codePointAt(i + 1)! : -1;\n\n    if (next !== -1 && next !== SLASH && next !== QUESTION && next !== LT) {\n      return i;\n    }\n  }\n\n  return -1;\n}\n\n/**\n * Builds parameter metadata from a route path pattern.\n *\n * Extracts URL parameters, query parameters, and splat parameters\n * from the path pattern string.\n *\n * @param path - Route path pattern (e.g., \"/users/:id/posts/:postId?q\")\n * @returns Parameter metadata object\n *\n * @example\n * ```typescript\n * buildParamMeta(\"/users/:id\")\n * // → { urlParams: [\"id\"], queryParams: [], paramTypeMap: { id: \"url\" } }\n *\n * buildParamMeta(\"/search?q&page\")\n * // → { urlParams: [], queryParams: [\"q\", \"page\"],\n * //     paramTypeMap: { q: \"query\", page: \"query\" } }\n *\n * buildParamMeta(\"/files/*path\")\n * // → { urlParams: [\"path\"], queryParams: [], paramTypeMap: { path: \"url\" } }\n * ```\n */\n// Shared frozen sentinels for the common no-params case — avoid a fresh empty\n// array/object per route (#1009). ParamMeta fields are Readonly*; match/build\n// only read them, and computeCaches' Object.freeze on the arrays/object is a\n// no-op on an already-frozen shared instance.\nconst EMPTY_PARAM_NAMES: readonly string[] = Object.freeze([]);\nconst EMPTY_PARAM_TYPE_MAP: Readonly<Record<string, \"url\" | \"query\">> =\n  Object.freeze({});\n\n// Whole-meta shared sentinel for the fully-static case: every collection is a\n// #1009 sentinel AND pathPattern degenerates to the input path itself (no query\n// to strip), so the wrapper carries zero per-route information. The RETAINING\n// caller (route-tree's computeCaches) swaps a matching fresh result for this\n// instance — buildParamMeta itself keeps returning fresh objects so the\n// validation gate can read the real pathPattern of arbitrary input paths.\n// `pathPattern` is \"\" here; the one stored-meta reader (`registerNode`) falls\n// back to `node.path` on identity match.\nexport const EMPTY_PARAM_META: ParamMeta = Object.freeze({\n  urlParams: EMPTY_PARAM_NAMES,\n  queryParams: EMPTY_PARAM_NAMES,\n  paramTypeMap: EMPTY_PARAM_TYPE_MAP,\n  pathPattern: \"\",\n});\n\n/**\n * Extracts URL params (including splats) from a path's segments into the given accumulators\n * via the canonical `parseSegment` tokenizer. Split out of `buildParamMeta` so\n * the builder stays under the cognitive-complexity budget. A malformed segment\n * (token errors) or a `static` segment contributes nothing — a malformed route is\n * rejected downstream before it compiles, so its meta is moot.\n */\nfunction collectUrlParams(\n  path: string,\n  urlParams: string[],\n  paramTypeMap: Record<string, \"url\" | \"query\">,\n): void {\n  for (const segment of splitPathSegments(path)) {\n    if (segment.length === 0) {\n      continue;\n    }\n\n    const token = parseSegment(segment);\n\n    if (\"error\" in token || token.kind === \"static\") {\n      continue;\n    }\n\n    urlParams.push(token.name);\n    paramTypeMap[token.name] = \"url\";\n  }\n}\n\nexport function buildParamMeta(path: string): ParamMeta {\n  const urlParams: string[] = [];\n  const queryParams: string[] = [];\n  const paramTypeMap = emptyRecord<\"url\" | \"query\">();\n\n  // Locate the real query separator (M1 §3.3: first `?` whose tail is not a\n  // former optional/reverse form).\n  const separator = findQuerySeparator(path);\n\n  if (separator !== -1) {\n    const queryString = path.slice(separator + 1);\n    const params = queryString.split(\"&\");\n\n    for (const param of params) {\n      const paramName = param.trim();\n\n      if (paramName.length > 0) {\n        queryParams.push(paramName);\n        paramTypeMap[paramName] = \"query\";\n      }\n    }\n\n    path = path.slice(0, separator);\n  }\n\n  collectUrlParams(path, urlParams, paramTypeMap);\n\n  return shareEmptyCollections(\n    urlParams,\n    queryParams,\n    publishRecord(paramTypeMap),\n    path,\n  );\n}\n\n// #1009: swap each freshly-built empty collection for a shared frozen sentinel\n// — factored out of buildParamMeta so the hot builder stays under the cognitive-\n// complexity budget. match/build only read these (Readonly*), and computeCaches'\n// Object.freeze is a no-op on an already-frozen shared instance.\nfunction shareEmptyCollections(\n  urlParams: string[],\n  queryParams: string[],\n  paramTypeMap: Record<string, \"url\" | \"query\">,\n  pathPattern: string,\n): ParamMeta {\n  return {\n    urlParams: urlParams.length === 0 ? EMPTY_PARAM_NAMES : urlParams,\n    queryParams: queryParams.length === 0 ? EMPTY_PARAM_NAMES : queryParams,\n    paramTypeMap:\n      urlParams.length === 0 && queryParams.length === 0\n        ? EMPTY_PARAM_TYPE_MAP\n        : paramTypeMap,\n    pathPattern,\n  };\n}\n","/**\n * The route-name rules, one named predicate each — the name-side counterpart to\n * {@link validateRoutePath} in `./routes`.\n *\n * Two layers apply them, and they apply different subsets. Bare-core\n * registration (`namespaces/RoutesNamespace/routesStore.ts`) applies the dotted\n * rule on every door; {@link validateRoute} — which core exports for\n * `@real-router/validation-plugin` and never calls itself — applies all of\n * them.\n *\n * ⚑ One owner per rule is the point of this file: putting a rule on the live\n * path is a CALL, never a second copy of its message (#2035).\n */\n\n/**\n * Route names are ASCII — a letter or underscore, then letters, digits,\n * underscores or hyphens.\n */\nconst ROUTE_NAME_PATTERN = /^[A-Z_a-z][\\w-]*$/;\n\n/**\n * Matches when the name carries at least one non-whitespace character.\n */\nconst HAS_NON_WHITESPACE = /\\S/;\n\n/**\n * Maximum route name length, bounding DoS and performance risk.\n */\nconst MAX_ROUTE_NAME_LENGTH = 10_000;\n\n/**\n * Refuses `{ name: \"\" }`.\n */\nexport function assertRouteNameNotEmpty(\n  name: string,\n  methodName: string,\n): void {\n  if (name === \"\") {\n    throw new TypeError(`[router.${methodName}] Route name cannot be empty`);\n  }\n}\n\n/**\n * Refuses a name built only of whitespace.\n */\nexport function assertRouteNameNotWhitespaceOnly(\n  name: string,\n  methodName: string,\n): void {\n  if (!HAS_NON_WHITESPACE.test(name)) {\n    throw new TypeError(\n      `[router.${methodName}] Route name cannot contain only whitespace`,\n    );\n  }\n}\n\n/**\n * Refuses a name longer than {@link MAX_ROUTE_NAME_LENGTH}.\n */\nexport function assertRouteNameWithinLength(\n  name: string,\n  methodName: string,\n): void {\n  if (name.length > MAX_ROUTE_NAME_LENGTH) {\n    throw new TypeError(\n      `[router.${methodName}] Route name exceeds maximum length of ${MAX_ROUTE_NAME_LENGTH} characters`,\n    );\n  }\n}\n\n/**\n * Refuses a BARE route name carrying a dot — `{ name: \"users.view\" }` where the\n * nesting must be spelled with `children` or `{ parent }` (#1763).\n *\n * ⚠ Carries no \"@@\" exemption. {@link validateRoute} returns early on a\n * reserved name before reaching this predicate, and bare-core registration\n * refuses one outright, so neither caller needs one.\n */\nexport function assertNoDottedRouteName(\n  name: string,\n  methodName: string,\n): void {\n  if (name.includes(\".\")) {\n    throw new TypeError(\n      `[router.${methodName}] Route name \"${name}\" cannot contain dots. ` +\n        `Use children array or { parent } option in addRoute() instead.`,\n    );\n  }\n}\n\n/**\n * Refuses a name outside {@link ROUTE_NAME_PATTERN}.\n */\nexport function assertRouteNameMatchesPattern(\n  name: string,\n  methodName: string,\n): void {\n  if (!ROUTE_NAME_PATTERN.test(name)) {\n    throw new TypeError(\n      `[router.${methodName}] Invalid route name \"${name}\". ` +\n        `Name must start with a letter or underscore, ` +\n        `followed by letters, numbers, underscores, or hyphens.`,\n    );\n  }\n}\n"],"mappings":"wCAkBM,EAAS,OAAO,OAyBtB,SAAgB,EACd,EACA,EACoB,CAChB,KAAW,SAAW,GAAK,IAAW,IAAA,GAI1C,IAAK,IAAM,KAAO,EAAY,CAC5B,GAAI,CAAC,EAAO,EAAQ,CAAG,EACrB,SAGF,IAAI,EAEJ,GAAI,CACF,EAAQ,EAAO,EACjB,MAAQ,CAQN,MACF,CAEA,GAAI,IAAU,IAAA,GACZ,OAAO,CAEX,CAGF,CAuBA,SAAgB,EACd,EACA,EACA,EACA,EACA,EACA,EACM,CACN,IAAM,EAAM,EAAoB,EAAQ,CAAU,EAElD,GAAI,IAAQ,IAAA,GACV,MAAU,UACR,WAAW,EAAO,IAAI,EACpB,EACA,EACA,OAAO,GAAW,WAAa,EAAO,EAAI,EAC1C,CACF,GACF,CAEJ,CA+CA,SAAgB,EACd,EACA,EACA,EACA,EACM,CACN,EACE,EACA,EACA,EACA,EACA,oKACF,CACF,CAEA,SAAgB,EACd,EACA,EACA,EAAS,wBACT,EAAS,8BACD,CACR,MAAO,UAAU,EAAU,eAAe,EAAI,2CAA2C,EAAO,uBAAuB,EAAO,8FAChI,CC2EA,MAAM,EAAY,IAAI,QAEtB,SAAgB,EACd,EACoB,CACpB,IAAM,EAAM,EAAU,IAAI,CAAM,EAEhC,GAAI,CAAC,EACH,MAAU,UACR,yEACF,EAGF,OAAO,CACT,CAiCA,SAAgB,EACd,EACA,EACA,EACA,EACM,CACN,EACE,EACA,EACA,EACA,EAAI,eAAe,CAAS,CAC9B,CACF,CAEA,SAAgB,EACd,EACA,EACM,CACN,EAAU,IAAI,EAAQ,CAAG,CAC3B,CAGA,SAAS,EACP,EACA,EACA,EACA,EACG,CACH,IAAI,EAAQ,EAEZ,IAAK,IAAM,KAAe,EAAc,CACtC,IAAM,EAAO,EAYP,EACJ,IAAiB,IAAA,GACb,GACC,GAAG,IAAoB,EAAa,EAAK,GAAG,CAAQ,CAAM,EAEjE,GAAS,GAAG,IAAqB,EAAY,EAAM,GAAG,CAAS,CACjE,CAEA,OAAO,EAAM,GAAG,CAAI,CACtB,CASA,SAAgB,EACd,EACA,EACA,EAIG,CACH,QAAS,GAAG,IAAgB,CAC1B,IAAM,EAAQ,EAAa,IAAI,CAAI,EAMnC,MAJI,CAAC,GAAS,EAAM,SAAW,EACtB,EAAS,GAAG,CAAI,EAGlB,EAAwB,EAAO,EAAU,CAAI,CACtD,EACF,CAqBA,SAAgB,EACd,EACA,EACA,EAIA,EACyB,CACzB,OAAQ,EAAS,EAAS,IAAY,CACpC,IAAM,EAAQ,EAAa,IAAI,CAAI,EAMnC,MAJI,CAAC,GAAS,EAAM,SAAW,EACtB,EAAS,EAAM,EAAM,CAAI,EAG3B,EACL,EACA,EACA,CAAC,EAAM,EAAM,CAAI,EACjB,CACF,CACF,CACF,CC/XA,MAOM,EAAY,GAA0B,IAAS,IAAS,IAAS,GAcvE,SAAgB,EAAkB,EAAwB,CACxD,IAAM,EAAqB,CAAC,EACxB,EAAQ,EAEZ,IAAK,IAAI,EAAI,EAAG,EAAI,EAAK,OAAQ,GAAK,EAChC,EAAK,WAAW,CAAC,IAAME,KAI3B,EAAS,KAAK,EAAK,MAAM,EAAO,CAAC,CAAC,EAClC,EAAQ,EAAI,GAKd,OAFA,EAAS,KAAK,EAAK,MAAM,CAAK,CAAC,EAExB,CACT,CAQA,SAAgB,EAAa,EAA+C,CAC1E,IAAM,EAAS,EAAQ,OAEvB,GAAI,IAAW,EACb,MAAO,CAAE,KAAM,SAAU,KAAM,EAAG,EAIpC,GAAI,CAAC,EAAS,EAAQ,WAAW,CAAC,CAAC,EAAG,CACpC,IAAK,IAAI,EAAI,EAAG,EAAI,EAAQ,GAAK,EAAG,CAClC,IAAM,EAAO,EAAQ,WAAW,CAAC,EAIjC,GAAI,IAASF,IAAM,IAAS,GAC1B,MAAO,CAAE,MAAO,oBAAqB,EAYvC,GAAI,EAAS,CAAI,GAAK,EAAI,EAAI,EAC5B,MAAO,CAAE,MAAO,cAAe,CAEnC,CAaA,OAJI,EAAQ,WAAW,EAAS,CAAC,IAAMC,GAC9B,CAAE,MAAO,WAAY,EAGvB,CAAE,KAAM,SAAU,KAAM,CAAQ,CACzC,CAEA,IAAM,EAAQ,EAAQ,WAAW,CAAC,IAAM,GAIpC,EAAS,EAEb,KAAO,EAAS,GAAQ,CACtB,IAAM,EAAO,EAAQ,WAAW,CAAM,EAEtC,GAAI,IAASD,IAAM,IAAS,IAAM,IAASC,GACzC,MAGF,GAAU,CACZ,CAEA,IAAM,EAAO,EAAQ,MAAM,EAAG,CAAM,EAqBpC,OAnBI,EAAK,SAAW,EACX,CAAE,MAAO,WAAY,EAG1B,EAAS,EAAK,WAAW,EAAK,OAAS,CAAC,CAAC,EACpC,CAAE,MAAO,iBAAkB,EAQhC,EAAS,EACJ,EAAQ,WAAW,CAAM,IAAMA,GAClC,CAAE,MAAO,kBAAmB,EAC5B,CAAE,MAAO,oBAAqB,EAG7B,EAAQ,CAAE,KAAM,QAAS,MAAK,EAAI,CAAE,KAAM,QAAS,MAAK,CACjE,CAiBA,SAAgB,EACd,EAC8B,CAC9B,IAAK,IAAM,KAAW,EAAkB,CAAI,EAAG,CAC7C,IAAM,EAAQ,EAAa,CAAO,EAElC,GAAI,UAAW,EACb,OAAO,EAAM,KAEjB,CAGF,CA0BA,SAAgB,EAAoB,EAAuC,CACzE,IAAM,EAAW,EAAkB,CAAI,EAEvC,IAAK,IAAI,EAAI,EAAG,EAAI,EAAS,OAAQ,GAAK,EAAG,CAC3C,IAAM,EAAQ,EAAa,EAAS,EAAE,EAEhC,aAAW,EAQjB,IAAI,EAAM,QAAU,mBAAoB,CACtC,IAAM,EAAU,EAAS,GACnB,EAAW,CAAC,GAAG,CAAQ,EAS7B,MAFA,GAAS,GAAK,EAAQ,MAAM,EAAG,EAAQ,QAAQ,GAAG,CAAC,EAE5C,CACL,KAAM,mBACN,UACA,eAAgB,EAAS,QAAQ,EAAG,IAAM,IAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAC3D,aAAc,EAAS,KAAK,GAAG,CACjC,CACF,CAEA,OAAO,EAAM,QAAU,qBACnB,CAAE,KAAM,qBAAsB,QAAS,EAAS,EAAG,EACnD,IAAA,EAJJ,CAKF,CAGF,CC3PA,MAAa,EAAyB,QAoBtC,SAAS,EAAmB,EAAsB,CAChD,IAAK,IAAI,EAAI,EAAG,EAAI,EAAK,OAAQ,GAAK,EAAG,CACvC,GAAI,EAAK,YAAY,CAAC,IAAM,GAC1B,SASF,IAAM,EAAO,EAAI,EAAI,EAAK,OAAS,EAAK,YAAY,EAAI,CAAC,EAAK,GAE9D,GAAI,IAAS,IAAM,IAAS,IAAS,IAAS,IAAY,IAAS,GACjE,OAAO,CAEX,CAEA,MAAO,EACT,CA4BA,MAAM,EAAuC,OAAO,OAAO,CAAC,CAAC,EACvD,EACJ,OAAO,OAAO,CAAC,CAAC,EAUL,EAA8B,OAAO,OAAO,CACvD,UAAW,EACX,YAAa,EACb,aAAc,EACd,YAAa,EACf,CAAC,EASD,SAAS,EACP,EACA,EACA,EACM,CACN,IAAK,IAAM,KAAW,EAAkB,CAAI,EAAG,CAC7C,GAAI,EAAQ,SAAW,EACrB,SAGF,IAAM,EAAQ,EAAa,CAAO,EAE9B,UAAW,GAAS,EAAM,OAAS,WAIvC,EAAU,KAAK,EAAM,IAAI,EACzB,EAAa,EAAM,MAAQ,MAC7B,CACF,CAEA,SAAgB,EAAe,EAAyB,CACtD,IAAM,EAAsB,CAAC,EACvB,EAAwB,CAAC,EACzB,EAAeE,EAAAA,EAA6B,EAI5C,EAAY,EAAmB,CAAI,EAEzC,GAAI,IAAc,GAAI,CAEpB,IAAM,EADc,EAAK,MAAM,EAAY,CAClB,CAAC,CAAC,MAAM,GAAG,EAEpC,IAAK,IAAM,KAAS,EAAQ,CAC1B,IAAM,EAAY,EAAM,KAAK,EAEzB,EAAU,OAAS,IACrB,EAAY,KAAK,CAAS,EAC1B,EAAa,GAAa,QAE9B,CAEA,EAAO,EAAK,MAAM,EAAG,CAAS,CAChC,CAIA,OAFA,EAAiB,EAAM,EAAW,CAAY,EAEvC,EACL,EACA,EACAC,EAAAA,EAAc,CAAY,EAC1B,CACF,CACF,CAMA,SAAS,EACP,EACA,EACA,EACA,EACW,CACX,MAAO,CACL,UAAW,EAAU,SAAW,EAAI,EAAoB,EACxD,YAAa,EAAY,SAAW,EAAI,EAAoB,EAC5D,aACE,EAAU,SAAW,GAAK,EAAY,SAAW,EAC7C,EACA,EACN,aACF,CACF,CC7KA,MAAM,EAAqB,oBAKrB,EAAqB,KAKrB,EAAwB,IAK9B,SAAgB,EACd,EACA,EACM,CACN,GAAI,IAAS,GACX,MAAU,UAAU,WAAW,EAAW,6BAA6B,CAE3E,CAKA,SAAgB,EACd,EACA,EACM,CACN,GAAI,CAAC,EAAmB,KAAK,CAAI,EAC/B,MAAU,UACR,WAAW,EAAW,4CACxB,CAEJ,CAKA,SAAgB,EACd,EACA,EACM,CACN,GAAI,EAAK,OAAS,EAChB,MAAU,UACR,WAAW,EAAW,yCAAyC,EAAsB,YACvF,CAEJ,CAUA,SAAgB,EACd,EACA,EACM,CACN,GAAI,EAAK,SAAS,GAAG,EACnB,MAAU,UACR,WAAW,EAAW,gBAAgB,EAAK,sFAE7C,CAEJ,CAKA,SAAgB,EACd,EACA,EACM,CACN,GAAI,CAAC,EAAmB,KAAK,CAAI,EAC/B,MAAU,UACR,WAAW,EAAW,wBAAwB,EAAK,uGAGrD,CAEJ"}

package/dist/cjs/validation.js

@@ -1,2 +1,2 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./buildParamMeta-L7xMPkKw.js");function t(e,t){return TypeError(`[router.${e}] ${t}`)}function n(e,n,r,i){let a=new Set;for(let o of e){if(a.has(o))throw t(r,`Invalid path for route "${n}": duplicate parameter name ':${o}' in "${i}" (a param name must be unique within a route — the second binding would overwrite the first)`);a.add(o)}}function r(n,r,i,a){for(let o of n)if(e.n.test(o))throw t(i,`Invalid path for route "${r}": invalid query-param name "${o}" in "${a}" (a query-param name cannot contain '<' or '>' — it would never round-trip; rename the query param)`)}function i(e){let t=!0,n=!1;for(let r of e){if(r===`/`){t=!0;continue}if(t&&=(n=r===`:`||r===`*`,!1),!n&&r.codePointAt(0)>=128)return!0}return!1}function a(e,t,n){switch(e){case`name-less`:case`trailing-marker`:return`Invalid path for route "${t}": parameter marker (':' or '*') without a name in "${n}"`;case`fused-marker`:return`Invalid path for route "${t}": parameter marker (':' or '*') must begin a segment, but "${n}" fuses one to a static prefix (use a boundary marker like "/a/:b")`}}function o(e,t){return e.code===`optional-removed`?`Invalid path for route "${t}": optional params are not supported — "${e.segment}". Declare two sibling routes instead: "${e.withoutSegment}" and "${e.requiredForm}" (the route hierarchy already expresses optionality)`:`Invalid path for route "${t}": regex constraints are not supported — '<' and '>' are reserved in path segments ("${e.segment}"). Match the segment as a plain string and validate the value in a guard (canActivate) or app code`}function s(s,c,l,u){if(typeof s!=`string`){let e;throw e=s===null?`null`:Array.isArray(s)?`array`:typeof s,t(l,`Route path must be a string, got ${e}`)}if(s===``)return;if(/\s/.test(s))throw t(l,`Invalid path for route "${c}": whitespace not allowed in "${s}"`);if(!/^([/?~]|[^/]+$)/.test(s))throw t(l,`Route "${c}" has invalid path format: "${s}". Path should start with '/', '~', '?' or be a relative segment.`);if(s.includes(`//`))throw t(l,`Invalid path for route "${c}": double slashes not allowed in "${s}"`);let{pathPattern:d,urlParams:f,queryParams:p}=e.r(s);n(f,c,l,s),r(p,c,l,s);let m=e.i(d);if(m!==void 0)throw t(l,o(m,c));let h=e.a(d);if(h!==void 0)throw t(l,a(h,c,s));if(i(d))throw t(l,`Invalid path for route "${c}": non-ASCII static segment in "${s}" — match compares static segments raw and rejects non-ASCII input, so this route would never match. Percent-encode it (e.g. '/caf%C3%A9') or use a param`);let g=u&&u.paramMeta.urlParams.length>0;if(s.startsWith(`~`)&&g)throw t(l,`Absolute path "${s}" cannot be used under parent route with URL parameters`)}const c=Object.getOwnPropertyDescriptor,l=Object.keys,u=Object.getPrototypeOf,d=/^[A-Z_a-z][\w-]*$/,f=/\S/,p=1e4;function m(e){if(e===null)return`null`;if(typeof e==`object`){try{let t=e.constructor;if(typeof t==`function`&&t.name!==`Object`)return t.name||`object`}catch{}return`object`}return typeof e}function h(e){for(let t of l(e)){let n=c(e,t);if(n&&(n.get||n.set))return!0}return!1}function g(e,t){if(!e||typeof e!=`object`)throw TypeError(`[router.${t}] Route must be an object, got ${m(e)}`);let n=u(e);if(n!==Object.prototype&&n!==null)throw TypeError(`[router.${t}] Route must be a plain object, got ${m(e)}`);if(h(e))throw TypeError(`[router.${t}] Route must not have getters or setters`)}function _(e,t){if(e.encodeParams!==void 0&&typeof e.encodeParams!=`function`)throw TypeError(`[router.${t}] Route "${String(e.name)}" encodeParams must be a function`)}function v(e,t){if(e.decodeParams!==void 0&&typeof e.decodeParams!=`function`)throw TypeError(`[router.${t}] Route "${String(e.name)}" decodeParams must be a function`)}function y(e,t){if(typeof e.name!=`string`)throw TypeError(`[router.${t}] Route name must be a string, got ${m(e.name)}`);let n=e.name;if(n===``)throw TypeError(`[router.${t}] Route name cannot be empty`);if(!f.test(n))throw TypeError(`[router.${t}] Route name cannot contain only whitespace`);if(n.length>p)throw TypeError(`[router.${t}] Route name exceeds maximum length of ${p} characters`);if(!n.startsWith(`@@`)){if(n.includes(`.`))throw TypeError(`[router.${t}] Route name "${n}" cannot contain dots. Use children array or { parent } option in addRoute() instead.`);if(!d.test(n))throw TypeError(`[router.${t}] Invalid route name "${n}". Name must start with a letter or underscore, followed by letters, numbers, underscores, or hyphens.`)}}function b(e,t){if(!t.includes(`.`))return e.children.get(t);let n=e;for(let e of t.split(`.`))if(n=n.children.get(e),!n)return;return n}function x(e,t,n){if(b(e,t))throw Error(`[router.${n}] Route "${t}" already exists`)}function S(e,t,n){if(e.has(t))throw Error(`[router.${n}] Duplicate route "${t}" in batch`);e.add(t)}function C(e,t,n,r){let i=t===``?e:b(e,t);if(i){for(let e of i.children.values())if(e.path===n)throw Error(`[router.${r}] Path "${n}" is already defined`)}}function w(e,t,n,r){let i=e.get(t);if(i?.has(n))throw Error(`[router.${r}] Path "${n}" is already defined`);i?i.add(n):e.set(t,new Set([n]))}function T(e,t,n,r=``,i,a){g(e,t);let o=e;y(o,t),s(o.path,o.name,t,n),_(o,t),v(o,t);let c=o.name,l=r?`${r}.${c}`:c;n&&l&&x(n,l,t),i&&S(i,l,t);let u=o.path,d=r;if(n&&C(n,d,u,t),a&&w(a,d,u,t),o.children!==void 0){if(!Array.isArray(o.children))throw TypeError(`[router.${t}] Route "${c}" children must be an array, got ${m(o.children)}`);for(let e of o.children)T(e,t,n,l,i,a)}}exports.getInternals=e.u,exports.validateRoute=T;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./route-name-BBu872EN.js");function t(e,t){return TypeError(`[router.${e}] ${t}`)}function n(e,n,r,i){let a=new Set;for(let o of e){if(a.has(o))throw t(r,`Invalid path for route "${n}": duplicate parameter name ':${o}' in "${i}" (a param name must be unique within a route — the second binding would overwrite the first)`);a.add(o)}}function r(n,r,i,a){for(let o of n)if(e.s.test(o))throw t(i,`Invalid path for route "${r}": invalid query-param name "${o}" in "${a}" (a query-param name cannot contain '<' or '>' — it would never round-trip; rename the query param)`)}function i(e){let t=!0,n=!1;for(let r of e){if(r===`/`){t=!0;continue}if(t&&=(n=r===`:`||r===`*`,!1),!n&&r.codePointAt(0)>=128)return!0}return!1}function a(e,t,n){switch(e){case`name-less`:case`trailing-marker`:return`Invalid path for route "${t}": parameter marker (':' or '*') without a name in "${n}"`;case`fused-marker`:return`Invalid path for route "${t}": parameter marker (':' or '*') must begin a segment, but "${n}" fuses one to a static prefix (use a boundary marker like "/a/:b")`}}function o(e,t){return e.code===`optional-removed`?`Invalid path for route "${t}": optional params are not supported — "${e.segment}". Declare two sibling routes instead: "${e.withoutSegment}" and "${e.requiredForm}" (the route hierarchy already expresses optionality)`:`Invalid path for route "${t}": regex constraints are not supported — '<' and '>' are reserved in path segments ("${e.segment}"). Match the segment as a plain string and validate the value in a guard (canActivate) or app code`}function s(s,c,l,u){if(typeof s!=`string`){let e;throw e=s===null?`null`:Array.isArray(s)?`array`:typeof s,t(l,`Route path must be a string, got ${e}`)}if(s===``)return;if(/\s/.test(s))throw t(l,`Invalid path for route "${c}": whitespace not allowed in "${s}"`);if(!/^([/?~]|[^/]+$)/.test(s))throw t(l,`Route "${c}" has invalid path format: "${s}". Path should start with '/', '~', '?' or be a relative segment.`);if(s.includes(`//`))throw t(l,`Invalid path for route "${c}": double slashes not allowed in "${s}"`);let{pathPattern:d,urlParams:f,queryParams:p}=e.c(s);n(f,c,l,s),r(p,c,l,s);let m=e.l(d);if(m!==void 0)throw t(l,o(m,c));let h=e.u(d);if(h!==void 0)throw t(l,a(h,c,s));if(i(d))throw t(l,`Invalid path for route "${c}": non-ASCII static segment in "${s}" — match compares static segments raw and rejects non-ASCII input, so this route would never match. Percent-encode it (e.g. '/caf%C3%A9') or use a param`);let g=u&&u.paramMeta.urlParams.length>0;if(s.startsWith(`~`)&&g)throw t(l,`Absolute path "${s}" cannot be used under parent route with URL parameters`)}const c=Object.getOwnPropertyDescriptor,l=Object.keys,u=Object.getPrototypeOf;function d(e){if(e===null)return`null`;if(typeof e==`object`){try{let t=e.constructor;if(typeof t==`function`&&t.name!==`Object`)return t.name||`object`}catch{}return`object`}return typeof e}function f(e){for(let t of l(e)){let n=c(e,t);if(n&&(n.get||n.set))return!0}return!1}function p(e,t){if(!e||typeof e!=`object`)throw TypeError(`[router.${t}] Route must be an object, got ${d(e)}`);let n=u(e);if(n!==Object.prototype&&n!==null)throw TypeError(`[router.${t}] Route must be a plain object, got ${d(e)}`);if(f(e))throw TypeError(`[router.${t}] Route must not have getters or setters`)}function m(e,t){if(e.encodeParams!==void 0&&typeof e.encodeParams!=`function`)throw TypeError(`[router.${t}] Route "${String(e.name)}" encodeParams must be a function`)}function h(e,t){if(e.decodeParams!==void 0&&typeof e.decodeParams!=`function`)throw TypeError(`[router.${t}] Route "${String(e.name)}" decodeParams must be a function`)}function g(t,n){if(typeof t.name!=`string`)throw TypeError(`[router.${n}] Route name must be a string, got ${d(t.name)}`);let r=t.name;e.r(r,n),e.i(r,n),e.a(r,n),!r.startsWith(`@@`)&&(e.t(r,n),e.n(r,n))}function _(e,t){if(!t.includes(`.`))return e.children.get(t);let n=e;for(let e of t.split(`.`))if(n=n.children.get(e),!n)return;return n}function v(e,t,n){if(_(e,t))throw Error(`[router.${n}] Route "${t}" already exists`)}function y(e,t,n){if(e.has(t))throw Error(`[router.${n}] Duplicate route "${t}" in batch`);e.add(t)}function b(e,t,n,r){let i=t===``?e:_(e,t);if(i){for(let e of i.children.values())if(e.path===n)throw Error(`[router.${r}] Path "${n}" is already defined`)}}function x(e,t,n,r){let i=e.get(t);if(i?.has(n))throw Error(`[router.${r}] Path "${n}" is already defined`);i?i.add(n):e.set(t,new Set([n]))}function S(e,t,n,r=``,i,a){p(e,t);let o=e;g(o,t),s(o.path,o.name,t,n),m(o,t),h(o,t);let c=o.name,l=r?`${r}.${c}`:c;n&&l&&v(n,l,t),i&&y(i,l,t);let u=o.path,f=r;if(n&&b(n,f,u,t),a&&x(a,f,u,t),o.children!==void 0){if(!Array.isArray(o.children))throw TypeError(`[router.${t}] Route "${c}" children must be an array, got ${d(o.children)}`);for(let e of o.children)S(e,t,n,l,i,a)}}exports.getInternals=e.h,exports.validateRoute=S;
 //# sourceMappingURL=validation.js.map

package/dist/cjs/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","names":["INVALID_QUERY_NAME_RGX","buildParamMeta","describeRemovedForm","findSegmentGrammarError"],"sources":["../../src/engine/validation/routes.ts","../../src/engine/validation/route-batch.ts"],"sourcesContent":["import {\n  buildParamMeta,\n  describeRemovedForm,\n  findSegmentGrammarError,\n  INVALID_QUERY_NAME_RGX,\n} from \"../path-matcher\";\n\nimport type { RemovedForm, SegmentErrorCode } from \"../path-matcher\";\nimport type { RouteTree } from \"../types\";\n\n/**\n * Creates a TypeError with consistent router error message format.\n *\n * @param methodName - Name of the method that triggered the error\n * @param message - Error message\n * @returns TypeError with formatted message\n * @internal\n */\nfunction createRouterError(methodName: string, message: string): TypeError {\n  return new TypeError(`[router.${methodName}] ${message}`);\n}\n\n/**\n * Rejects a param name repeated within one route's own path (`/:id/:id`, a\n * param+splat clash `/:x/*x`, #1151). `buildParamMeta.urlParams` lists every\n * path-binding name — params AND splats — in order, keeping duplicates (`/:x/*x`\n * → `[\"x\", \"x\"]`), so a single pass over it catches both. The trie binds the\n * duplicates at different positions under one name, so match's later capture\n * silently overwrites the earlier and `rewritePathOnMatch` then rewrites the\n * user's URL from the single survivor. The #736 conflict guard only fires on\n * DIFFERENTLY-named params at one position, so this same-name case slips through.\n * path-matcher's `registerTree` backstop additionally catches CROSS-level dups (a\n * parent's param reused by a child), which this per-path gate cannot see. ⚠ With\n * a hole, stated as its CAUSE rather than as a list of shapes, because the list\n * is longer than it looks: that backstop reads the names off `buildParamSlots`,\n * and #1568's finality rule drops a NON-final splat before it becomes a slot.\n * So the rule is about FINALITY, not about levels: **a collision is admitted iff\n * one of the colliding bindings is a NON-final splat.** Measured, 8/8 — admitted:\n * `/p/*x/:x`, `/p/*x/*x`, and the cross-level `*`+`:` and `*`+`*` (an ancestor's\n * marker is never final, since a descendant path follows it); refused:\n * `/p/:x/*x`, `/z/:x/:x`, and the cross-level `:`+`*` and `:`+`:`. The same cause\n * opens a door at the ROOT, which is an ancestor like any other:\n * `setRootPath(\"/app/:x\")` + a route `/:x/e` throws, `setRootPath(\"/app/*x\")` +\n * the same route registers. Nothing is bound twice in any of them (the dropped\n * splat binds nothing), and since #1975 the surviving `:x` takes the param\n * encoder, so they round-trip instead of needing a refusal.\n * Extracted so `validateRoutePath` stays within the cognitive-complexity budget.\n */\nfunction validateUniqueParamNames(\n  urlParams: readonly string[],\n  routeName: string,\n  methodName: string,\n  path: string,\n): void {\n  const seen = new Set<string>();\n\n  for (const name of urlParams) {\n    if (seen.has(name)) {\n      throw createRouterError(\n        methodName,\n        `Invalid path for route \"${routeName}\": duplicate parameter name ':${name}' in \"${path}\" (a param name must be unique within a route — the second binding would overwrite the first)`,\n      );\n    }\n\n    seen.add(name);\n  }\n}\n\n/**\n * #1242 §5.1/§5.3: rejects a malformed query-param declaration — a query name\n * carrying `<`/`>` (`/a?fil<ter` — a `<` in a plain query tail; never round-trips),\n * or one that collides with a path-param name (`/a/:tab?tab`, where buildPath emits\n * the value twice). Narrow to `<>`: a `=` in the declaration (`?tab=1`, §5.2) is\n * tolerated today and left as a separate call. (Under M1 a reverse-order typo\n * `/a/:b?<c>` is caught earlier as optional-removed — the `?<` keeps it in the\n * path, §3.3.) path-matcher's `registerTree` backstops both; this gate adds the\n * route-contextual message.\n */\nfunction validateQueryParamDeclarations(\n  queryParams: readonly string[],\n  routeName: string,\n  methodName: string,\n  path: string,\n): void {\n  // A path/query name collision (`/a/:tab?tab`) is legal under M2: `tab` lives\n  // in both `state.params` and `state.search` as separate channels (RFC-4 M2 /\n  // #1548), so the former \"declared as both\" rejection is gone. Only a query\n  // name that can never round-trip (contains `<`/`>`) is still rejected.\n  for (const name of queryParams) {\n    if (INVALID_QUERY_NAME_RGX.test(name)) {\n      throw createRouterError(\n        methodName,\n        `Invalid path for route \"${routeName}\": invalid query-param name \"${name}\" in \"${path}\" (a query-param name cannot contain '<' or '>' — it would never round-trip; rename the query param)`,\n      );\n    }\n  }\n}\n\n/**\n * Reports whether a path has a raw non-ASCII code point (≥ U+0080) in a STATIC\n * segment (`/café`, `/меню`, #1154). match rejects any non-ASCII input byte\n * (`#scanPath`) and compares static trie keys raw, so such a route registers but\n * is unmatchable — `buildPath` emits `/café`, which its own `match` rejects. Only\n * static text is flagged: a marker-led segment (`:café`, a non-ASCII param NAME)\n * is skipped. A `for…of` code-point scan tracking segment start. Runs AFTER the\n * removed-form / grammar rejections, so no `<`/`>` (a former constraint) can\n * reach it — the 3-token grammar has no constraint body to skip (M1, #1516).\n */\nfunction hasNonAsciiStatic(path: string): boolean {\n  let atSegmentStart = true;\n  let segmentIsMarker = false;\n\n  for (const char of path) {\n    if (char === \"/\") {\n      atSegmentStart = true;\n\n      continue;\n    }\n\n    if (atSegmentStart) {\n      segmentIsMarker = char === \":\" || char === \"*\";\n      atSegmentStart = false;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- non-empty code point from for-of\n    if (!segmentIsMarker && char.codePointAt(0)! >= 0x80) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Maps a SURVIVING per-segment grammar error code (from `findSegmentGrammarError`)\n * to the gate's route-contextual message. The removed-form codes (`optional-removed`\n * / `constraint-removed`) are NOT handled here — they carry a richer replacement\n * recipe built by `removedFormMessage` from `describeRemovedForm`.\n */\nfunction gateGrammarMessage(\n  code: Exclude<SegmentErrorCode, \"optional-removed\" | \"constraint-removed\">,\n  routeName: string,\n  path: string,\n): string {\n  switch (code) {\n    case \"name-less\":\n    case \"trailing-marker\": {\n      return `Invalid path for route \"${routeName}\": parameter marker (':' or '*') without a name in \"${path}\"`;\n    }\n    case \"fused-marker\": {\n      return `Invalid path for route \"${routeName}\": parameter marker (':' or '*') must begin a segment, but \"${path}\" fuses one to a static prefix (use a boundary marker like \"/a/:b\")`;\n    }\n  }\n}\n\n/**\n * Builds the route-contextual replacement recipe for a removed form (M1) — the\n * RICH tier (the matcher backstop uses a shorter, path-free recipe). For an\n * optional it names the offending segment and the two concrete sibling paths that\n * replace it (computed from the actual path by `describeRemovedForm`); for a\n * constraint it names the offending segment and points to a guard.\n */\nfunction removedFormMessage(removed: RemovedForm, routeName: string): string {\n  if (removed.code === \"optional-removed\") {\n    return `Invalid path for route \"${routeName}\": optional params are not supported — \"${removed.segment}\". Declare two sibling routes instead: \"${removed.withoutSegment}\" and \"${removed.requiredForm}\" (the route hierarchy already expresses optionality)`;\n  }\n\n  return `Invalid path for route \"${routeName}\": regex constraints are not supported — '<' and '>' are reserved in path segments (\"${removed.segment}\"). Match the segment as a plain string and validate the value in a guard (canActivate) or app code`;\n}\n\n/**\n * Validates route path format.\n * Throws a descriptive error if validation fails.\n *\n * Allows:\n * - Empty string (for grouping/root routes)\n * - Absolute paths: /path, ~path\n * - Query strings: ?query\n * - Relative segments: segment\n *\n * Prevents:\n * - Non-string values\n * - Double slashes (//)\n * - Absolute paths (~) under parameterized parent nodes\n *\n * @param path - Route path to validate\n * @param routeName - Name of route (for error messages)\n * @param methodName - Name of calling method for error messages\n * @param parentNode - Optional parent node for context validation\n * @throws {TypeError} If path is invalid\n *\n * @example\n * // Valid paths\n * validateRoutePath(\"\", \"home\", \"add\");              // ok (empty for grouping)\n * validateRoutePath(\"/users\", \"users\", \"add\");       // ok (absolute)\n * validateRoutePath(\"~dashboard\", \"dash\", \"add\");    // ok (absolute, if no parameterized parent)\n * validateRoutePath(\"?tab=1\", \"home\", \"add\");        // ok (query)\n * validateRoutePath(\"profile\", \"users.profile\", \"add\"); // ok (relative)\n *\n * @example\n * // Invalid paths (throws)\n * validateRoutePath(\"/users//list\", \"users.list\", \"add\");           // throws (double slash)\n * validateRoutePath(\"~dash\", \"dash\", \"add\", paramParent);           // throws (~ under parameterized parent)\n */\n// A format-validation gate: a flat sequence of INDEPENDENT guard clauses (type,\n// whitespace, format, double-slash, dup-param, query-decl, the M1 removed-form\n// recipe, surviving grammar markers (name-less / fused / trailing), non-ASCII\n// static, absolute-under-param). Each is a simple early throw; extracting them\n// would only scatter one checklist.\n\nexport function validateRoutePath(\n  path: unknown,\n  routeName: string,\n  methodName: string,\n  parentNode?: RouteTree,\n): asserts path is string {\n  // Type check\n  if (typeof path !== \"string\") {\n    // Get type description for error message\n    let typeDesc: string;\n\n    if (path === null) {\n      typeDesc = \"null\";\n    } else if (Array.isArray(path)) {\n      typeDesc = \"array\";\n    } else {\n      typeDesc = typeof path;\n    }\n\n    throw createRouterError(\n      methodName,\n      `Route path must be a string, got ${typeDesc}`,\n    );\n  }\n\n  // Empty path is valid (for grouping/root)\n  if (path === \"\") {\n    return;\n  }\n\n  // No whitespace characters (spaces, tabs, newlines)\n  if (/\\s/.test(path)) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": whitespace not allowed in \"${path}\"`,\n    );\n  }\n\n  // Valid path pattern\n  if (!/^([/?~]|[^/]+$)/.test(path)) {\n    throw createRouterError(\n      methodName,\n      `Route \"${routeName}\" has invalid path format: \"${path}\". Path should start with '/', '~', '?' or be a relative segment.`,\n    );\n  }\n\n  // No double slashes\n  if (path.includes(\"//\")) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": double slashes not allowed in \"${path}\"`,\n    );\n  }\n\n  // The grammar checks below scan only the URL-path portion: `buildParamMeta`\n  // strips the query the same way the trie does, so a `:`/`*` inside a query\n  // declaration is not falsely flagged. (`buildParamMeta` is total — the 3-token\n  // grammar has no constraint body to compile, so it never throws — M1, #1516.)\n  const { pathPattern, urlParams, queryParams } = buildParamMeta(path);\n\n  // Duplicate param name within this route's own path (`/:id/:id`, `/:x/*x`, #1151).\n  validateUniqueParamNames(urlParams, routeName, methodName, path);\n\n  // Malformed query-param declarations (#1242 §5.1): a query name with `<>`\n  // (never round-trips). Name collisions with a path param are legal under M2\n  // (separate params/search channels, #1548).\n  validateQueryParamDeclarations(queryParams, routeName, methodName, path);\n\n  // Removed-form (M1) rejection first — a `:x?` optional or a `<re>` constraint —\n  // with the RICH route-contextual replacement recipe (the offending segment plus,\n  // for an optional, the two computed sibling paths). Returns undefined when the\n  // path's first grammar error is a SURVIVING code, so the fall-through below runs.\n  const removed = describeRemovedForm(pathPattern);\n\n  if (removed !== undefined) {\n    throw createRouterError(methodName, removedFormMessage(removed, routeName));\n  }\n\n  // Surviving per-segment grammar rejections via the canonical `parseSegment`\n  // tokenizer: name-less (#858/#863), fused-marker (#1050), trailing-marker\n  // (#1324). `findSegmentGrammarError` runs the same split+parse the matcher uses,\n  // so the gate cannot drift. (Only removed-form codes reach `removed` above; the\n  // first error here is therefore always a surviving code.)\n  const grammarError = findSegmentGrammarError(pathPattern);\n\n  if (grammarError !== undefined) {\n    throw createRouterError(\n      methodName,\n      gateGrammarMessage(\n        grammarError as Exclude<\n          SegmentErrorCode,\n          \"optional-removed\" | \"constraint-removed\"\n        >,\n        routeName,\n        path,\n      ),\n    );\n  }\n\n  // Raw non-ASCII in a STATIC segment (`/café`, `/меню`, #1154). match rejects\n  // non-ASCII input and compares static keys raw, so the route registers but never\n  // matches. Reject with the percent-encode workaround (path-matcher backstops at\n  // `registerTree`); a non-ASCII param NAME or constraint body is unaffected.\n  if (hasNonAsciiStatic(pathPattern)) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": non-ASCII static segment in \"${path}\" — match compares static segments raw and rejects non-ASCII input, so this route would never match. Percent-encode it (e.g. '/caf%C3%A9') or use a param`,\n    );\n  }\n\n  // Absolute paths under parameterized parents\n  // Check if parent has URL parameters via paramTypeMap\n  const hasUrlParams = parentNode && parentNode.paramMeta.urlParams.length > 0;\n\n  if (path.startsWith(\"~\") && hasUrlParams) {\n    throw createRouterError(\n      methodName,\n      `Absolute path \"${path}\" cannot be used under parent route with URL parameters`,\n    );\n  }\n}\n","/**\n * Batch route validation utilities.\n *\n * Provides validation for adding routes with cross-batch duplicate detection.\n * Used by router.addRoute() to ensure atomicity - all routes validated before any modification.\n */\n\nimport { validateRoutePath } from \"./routes\";\n\nimport type { RouteDefinition, RouteTree } from \"../types\";\n\n/**\n * Intrinsics captured at module load: `getOwnPropertyDescriptor`, `objectKeys`, `getPrototypeOf`.\n *\n * ⚑ A guard is only as strong as the intrinsic it reads WHEN IT RUNS, and an\n * application can re-point any of these AFTER boot — which is what this closes.\n * Measured on the uncaptured form: one naive `Object.hasOwn` polyfill walked\n * straight through five sibling readers while the single captured guard held.\n *\n * ⚠ It does NOT close a shim evaluated BEFORE this module — the ordinary\n * polyfill order. Measured: a naive `Object.hasOwn` imported ahead of core\n * reproduces #1798 verbatim (`buildPath` prints the native method into the\n * URL). Two earlier revisions of this header said \"before any application\n * code can run\", which is the sentence a future reader would have trusted.\n */\nconst getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;\nconst objectKeys = Object.keys;\nconst getPrototypeOf = Object.getPrototypeOf;\n/**\n * Pattern for route name validation.\n * Each route name must start with letter/underscore, followed by alphanumeric/hyphen/underscore.\n * Dots are NOT allowed - use children array or { parent } option in addRoute() instead.\n * Rejects: names starting with numbers/hyphens, names containing dots.\n */\nconst ROUTE_NAME_PATTERN = /^[A-Z_a-z][\\w-]*$/;\n\n/**\n * Checks if string contains at least one non-whitespace character.\n */\nconst HAS_NON_WHITESPACE = /\\S/;\n\n/**\n * Maximum route name length to prevent DoS and performance issues.\n */\nconst MAX_ROUTE_NAME_LENGTH = 10_000;\n\n/**\n * Gets a human-readable description of a value's type.\n * Used for error messages to provide helpful debugging information.\n */\nfunction getTypeDescription(value: unknown): string {\n  // Handle null explicitly (typeof null === \"object\")\n  if (value === null) {\n    return \"null\";\n  }\n\n  if (typeof value === \"object\") {\n    // Read `constructor`/`.name` defensively: an adversarial own `constructor`\n    // (null, a string, a number, …) is not a real constructor and must not crash\n    // here nor yield a non-string (#903); a THROWING accessor — a `constructor`\n    // getter, a function constructor with a throwing `.name` getter, or a Proxy\n    // that throws on [[Get]] — must not crash either (#1052). Both fall back to\n    // \"object\". (Byte-identical twin of type-guards' getTypeDescription —\n    // route-tree has no type-guards dependency, so the hardening is duplicated.)\n    try {\n      const ctor: unknown = (value as { constructor?: unknown }).constructor;\n\n      // Return constructor name for class instances\n      if (typeof ctor === \"function\" && ctor.name !== \"Object\") {\n        return ctor.name || \"object\"; // empty name (anonymous class) → \"object\"\n      }\n    } catch {\n      // Throwing constructor/.name getter or Proxy [[Get]] → fall through (#1052).\n    }\n\n    // Plain object\n    return \"object\";\n  }\n\n  // Primitive types (string, number, boolean, undefined, etc.)\n  return typeof value;\n}\n\n/**\n * Checks if an object has getters or setters.\n * Used to detect potentially malicious route objects that could mutate during processing.\n *\n * @param obj - Object to check\n * @returns true if object has getters or setters\n */\nfunction hasGettersOrSetters(obj: Record<string, unknown>): boolean {\n  for (const key of objectKeys(obj)) {\n    const descriptor = getOwnPropertyDescriptor(obj, key);\n\n    if (descriptor && (descriptor.get || descriptor.set)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Validates that route is a plain object without getters/setters.\n * Prevents malicious objects that could mutate during processing.\n *\n * @param route - Route to validate\n * @param methodName - Calling method for error context\n * @throws {TypeError} If route is not a plain object\n */\nfunction validateRouteType(\n  route: unknown,\n  methodName: string,\n): asserts route is Record<string, unknown> {\n  if (!route || typeof route !== \"object\") {\n    throw new TypeError(\n      `[router.${methodName}] Route must be an object, got ${getTypeDescription(route)}`,\n    );\n  }\n\n  // Check for plain object (prototype must be Object.prototype or null)\n  const proto: object | null = getPrototypeOf(route) as object | null;\n\n  if (proto !== Object.prototype && proto !== null) {\n    throw new TypeError(\n      `[router.${methodName}] Route must be a plain object, got ${getTypeDescription(route)}`,\n    );\n  }\n\n  // Check for getters/setters (could cause mutations during processing)\n  if (hasGettersOrSetters(route as Record<string, unknown>)) {\n    throw new TypeError(\n      `[router.${methodName}] Route must not have getters or setters`,\n    );\n  }\n}\n\n/**\n * Validates that encodeParams is a function if provided.\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If encodeParams is not a function\n */\nfunction validateEncodeParams(\n  route: Record<string, unknown>,\n  methodName: string,\n): void {\n  if (\n    route.encodeParams !== undefined &&\n    typeof route.encodeParams !== \"function\"\n  ) {\n    throw new TypeError(\n      `[router.${methodName}] Route \"${String(route.name)}\" encodeParams must be a function`,\n    );\n  }\n}\n\n/**\n * Validates that decodeParams is a function if provided.\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If decodeParams is not a function\n */\nfunction validateDecodeParams(\n  route: Record<string, unknown>,\n  methodName: string,\n): void {\n  if (\n    route.decodeParams !== undefined &&\n    typeof route.decodeParams !== \"function\"\n  ) {\n    throw new TypeError(\n      `[router.${methodName}] Route \"${String(route.name)}\" decodeParams must be a function`,\n    );\n  }\n}\n\n/**\n * Validates that route name is a valid string matching the expected format.\n *\n * Route name rules:\n * - Must be a string\n * - Cannot be empty or whitespace-only\n * - Cannot contain dots (use children array or { parent } option instead)\n * - Must match [a-zA-Z_][a-zA-Z0-9_-]*\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If name is missing, not a string, or invalid format\n */\nfunction validateRouteName(\n  route: Record<string, unknown>,\n  methodName: string,\n): asserts route is Record<string, unknown> & { name: string } {\n  if (typeof route.name !== \"string\") {\n    throw new TypeError(\n      `[router.${methodName}] Route name must be a string, got ${getTypeDescription(route.name)}`,\n    );\n  }\n\n  const name = route.name;\n\n  // Empty string is not allowed for addRoute (unlike root node in type-guards)\n  if (name === \"\") {\n    throw new TypeError(`[router.${methodName}] Route name cannot be empty`);\n  }\n\n  // Whitespace-only strings are invalid\n  if (!HAS_NON_WHITESPACE.test(name)) {\n    throw new TypeError(\n      `[router.${methodName}] Route name cannot contain only whitespace`,\n    );\n  }\n\n  // Length check for technical safety\n  if (name.length > MAX_ROUTE_NAME_LENGTH) {\n    throw new TypeError(\n      `[router.${methodName}] Route name exceeds maximum length of ${MAX_ROUTE_NAME_LENGTH} characters`,\n    );\n  }\n\n  // System routes bypass pattern validation (e.g., @@router/UNKNOWN_ROUTE)\n  if (name.startsWith(\"@@\")) {\n    return;\n  }\n\n  // Dots are not allowed in route names\n  if (name.includes(\".\")) {\n    throw new TypeError(\n      `[router.${methodName}] Route name \"${name}\" cannot contain dots. ` +\n        `Use children array or { parent } option in addRoute() instead.`,\n    );\n  }\n\n  // Validate route pattern (ASCII only: letters, numbers, underscores, hyphens)\n  if (!ROUTE_NAME_PATTERN.test(name)) {\n    throw new TypeError(\n      `[router.${methodName}] Invalid route name \"${name}\". ` +\n        `Name must start with a letter or underscore, ` +\n        `followed by letters, numbers, underscores, or hyphens.`,\n    );\n  }\n}\n\n/**\n * Finds a node by its fullName in the tree.\n * Even though user-provided route names cannot contain dots,\n * fullName is computed during validation (e.g., \"parent.child\").\n *\n * @param rootNode - Root node to start from\n * @param fullName - Full route name (e.g., \"users.profile\")\n * @returns The resolved node, or undefined if not found\n */\nfunction findNodeByFullName(\n  rootNode: RouteTree,\n  fullName: string,\n): RouteTree | undefined {\n  // Fast path: single-segment names don't need splitting\n  // Stryker disable next-line ConditionalExpression,StringLiteral,BlockStatement: equivalent — the fast path is a pure optimization; for a dotless name the general path below yields the identical result (`name.split(\".\")` → `[name]`, a one-iteration `children.get(name)`). (BooleanLiteral stays live: dropping the `!` runs the fast path for a dotted name → `children.get(\"a.b\")` is undefined = killed.)\n  if (!fullName.includes(\".\")) {\n    return rootNode.children.get(fullName);\n  }\n\n  let current: RouteTree | undefined = rootNode;\n\n  for (const segment of fullName.split(\".\")) {\n    current = current.children.get(segment);\n\n    if (!current) {\n      return undefined;\n    }\n  }\n\n  return current;\n}\n\n/**\n * Checks for duplicate route name in existing tree.\n *\n * @param rootNode - Root node to search in\n * @param fullName - Full route name (dot-notation)\n * @param methodName - Calling method for error context\n * @throws {Error} If route name already exists\n */\nfunction checkTreeNameDuplicate(\n  rootNode: RouteTree,\n  fullName: string,\n  methodName: string,\n): void {\n  if (findNodeByFullName(rootNode, fullName)) {\n    throw new Error(\n      `[router.${methodName}] Route \"${fullName}\" already exists`,\n    );\n  }\n}\n\n/**\n * Checks for duplicate route name in current batch.\n *\n * @param seenNames - Set of names already seen in batch\n * @param fullName - Full route name to check\n * @param methodName - Calling method for error context\n * @throws {Error} If duplicate name in batch\n */\nfunction checkBatchNameDuplicate(\n  seenNames: Set<string>,\n  fullName: string,\n  methodName: string,\n): void {\n  if (seenNames.has(fullName)) {\n    throw new Error(\n      `[router.${methodName}] Duplicate route \"${fullName}\" in batch`,\n    );\n  }\n\n  seenNames.add(fullName);\n}\n\n/**\n * Checks for duplicate path in existing tree at same parent level.\n *\n * @param rootNode - Root node to search in\n * @param parentName - Parent route name (empty string for root level)\n * @param routePath - Path to check for duplicates\n * @throws {Error} If path already exists at this level\n */\nfunction checkTreePathDuplicate(\n  rootNode: RouteTree,\n  parentName: string,\n  routePath: string,\n  methodName: string,\n): void {\n  const parentNode =\n    parentName === \"\" ? rootNode : findNodeByFullName(rootNode, parentName);\n\n  if (!parentNode) {\n    return; // Parent doesn't exist, so no duplicate\n  }\n\n  for (const child of parentNode.children.values()) {\n    if (child.path === routePath) {\n      throw new Error(\n        `[router.${methodName}] Path \"${routePath}\" is already defined`,\n      );\n    }\n  }\n}\n\n/**\n * Checks for duplicate path in current batch at same parent level.\n *\n * @param seenPathsByParent - Map of paths by parent name\n * @param parentName - Parent route name (empty string for root level)\n * @param routePath - Path to check for duplicates\n * @throws {Error} If path already exists at this level in batch\n */\nfunction checkBatchPathDuplicate(\n  seenPathsByParent: Map<string, Set<string>>,\n  parentName: string,\n  routePath: string,\n  methodName: string,\n): void {\n  const pathsAtLevel = seenPathsByParent.get(parentName);\n\n  if (pathsAtLevel?.has(routePath)) {\n    throw new Error(\n      `[router.${methodName}] Path \"${routePath}\" is already defined`,\n    );\n  }\n\n  if (pathsAtLevel) {\n    pathsAtLevel.add(routePath);\n  } else {\n    seenPathsByParent.set(parentName, new Set([routePath]));\n  }\n}\n\n/**\n * Validates route structure for add operations.\n *\n * Performs comprehensive validation including:\n * - Type check (must be object)\n * - Name validation\n * - Path validation\n * - Duplicate name detection (in tree and batch)\n * - Duplicate path detection (in tree and batch)\n * - Recursive children validation\n *\n * @param route - Route to validate\n * @param methodName - Calling method for error context\n * @param rootNode - Optional root node for duplicate checking\n * @param parentName - Parent route name for building full path (used in recursion)\n * @param seenNames - Set of names already seen in this batch\n * @param seenPathsByParent - Map of paths by parent for path duplicate detection\n * @throws {TypeError} If route structure is invalid\n * @throws {Error} If route already exists (duplicate)\n * @throws {Error} If path already defined (duplicate)\n *\n * @example\n * ```typescript\n * const seenNames = new Set<string>();\n * const seenPaths = new Map<string, Set<string>>();\n *\n * // Validate routes before adding\n * for (const route of routes) {\n *   validateRoute(route, \"add\", rootNode, \"\", seenNames, seenPaths);\n * }\n * ```\n */\nexport function validateRoute(\n  route: unknown,\n  methodName: string,\n  rootNode?: RouteTree,\n  parentName = \"\",\n  seenNames?: Set<string>,\n  seenPathsByParent?: Map<string, Set<string>>,\n): asserts route is RouteDefinition {\n  validateRouteType(route, methodName);\n\n  const routeDef = route;\n\n  // Validate that name is a non-empty string\n  validateRouteName(routeDef, methodName);\n\n  // Validate path structure\n  validateRoutePath(routeDef.path, routeDef.name, methodName, rootNode);\n\n  // Validate optional function properties\n  validateEncodeParams(routeDef, methodName);\n  validateDecodeParams(routeDef, methodName);\n\n  const routeName = routeDef.name;\n  const fullName = parentName ? `${parentName}.${routeName}` : routeName;\n\n  // Check for duplicate name in existing tree\n  if (rootNode && fullName) {\n    checkTreeNameDuplicate(rootNode, fullName, methodName);\n  }\n\n  // Check for duplicate name in current batch\n  if (seenNames) {\n    checkBatchNameDuplicate(seenNames, fullName, methodName);\n  }\n\n  const routePath = routeDef.path;\n  const pathCheckParent = parentName;\n\n  // Check for duplicate path in existing tree\n  if (rootNode) {\n    checkTreePathDuplicate(rootNode, pathCheckParent, routePath, methodName);\n  }\n\n  // Check for duplicate path in current batch\n  if (seenPathsByParent) {\n    checkBatchPathDuplicate(\n      seenPathsByParent,\n      pathCheckParent,\n      routePath,\n      methodName,\n    );\n  }\n\n  // Validate children recursively\n  if (routeDef.children !== undefined) {\n    if (!Array.isArray(routeDef.children)) {\n      throw new TypeError(\n        `[router.${methodName}] Route \"${routeName}\" children must be an array, got ${getTypeDescription(routeDef.children)}`,\n      );\n    }\n\n    for (const child of routeDef.children) {\n      validateRoute(\n        child,\n        methodName,\n        rootNode,\n        fullName,\n        seenNames,\n        seenPathsByParent,\n      );\n    }\n  }\n}\n"],"mappings":"mHAkBA,SAAS,EAAkB,EAAoB,EAA4B,CACzE,OAAW,UAAU,WAAW,EAAW,IAAI,GAAS,CAC1D,CA4BA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EAAO,IAAI,IAEjB,IAAK,IAAM,KAAQ,EAAW,CAC5B,GAAI,EAAK,IAAI,CAAI,EACf,MAAM,EACJ,EACA,2BAA2B,EAAU,gCAAgC,EAAK,QAAQ,EAAK,8FACzF,EAGF,EAAK,IAAI,CAAI,CACf,CACF,CAYA,SAAS,EACP,EACA,EACA,EACA,EACM,CAKN,IAAK,IAAM,KAAQ,EACjB,GAAIA,EAAAA,EAAuB,KAAK,CAAI,EAClC,MAAM,EACJ,EACA,2BAA2B,EAAU,+BAA+B,EAAK,QAAQ,EAAK,qGACxF,CAGN,CAYA,SAAS,EAAkB,EAAuB,CAChD,IAAI,EAAiB,GACjB,EAAkB,GAEtB,IAAK,IAAM,KAAQ,EAAM,CACvB,GAAI,IAAS,IAAK,CAChB,EAAiB,GAEjB,QACF,CAQA,GANA,AAEE,KADA,EAAkB,IAAS,KAAO,IAAS,IAC1B,IAIf,CAAC,GAAmB,EAAK,YAAY,CAAC,GAAM,IAC9C,MAAO,EAEX,CAEA,MAAO,EACT,CAQA,SAAS,EACP,EACA,EACA,EACQ,CACR,OAAQ,EAAR,CACE,IAAK,YACL,IAAK,kBACH,MAAO,2BAA2B,EAAU,sDAAsD,EAAK,GAEzG,IAAK,eACH,MAAO,2BAA2B,EAAU,8DAA8D,EAAK,oEAEnH,CACF,CASA,SAAS,EAAmB,EAAsB,EAA2B,CAK3E,OAJI,EAAQ,OAAS,mBACZ,2BAA2B,EAAU,0CAA0C,EAAQ,QAAQ,0CAA0C,EAAQ,eAAe,SAAS,EAAQ,aAAa,uDAGhM,2BAA2B,EAAU,uFAAuF,EAAQ,QAAQ,oGACrJ,CA0CA,SAAgB,EACd,EACA,EACA,EACA,EACwB,CAExB,GAAI,OAAO,GAAS,SAAU,CAE5B,IAAI,EAUJ,KARA,CAKE,EALE,IAAS,KACA,OACF,MAAM,QAAQ,CAAI,EAChB,QAEA,OAAO,EAGd,EACJ,EACA,oCAAoC,GACtC,CACF,CAGA,GAAI,IAAS,GACX,OAIF,GAAI,KAAK,KAAK,CAAI,EAChB,MAAM,EACJ,EACA,2BAA2B,EAAU,gCAAgC,EAAK,EAC5E,EAIF,GAAI,CAAC,kBAAkB,KAAK,CAAI,EAC9B,MAAM,EACJ,EACA,UAAU,EAAU,8BAA8B,EAAK,kEACzD,EAIF,GAAI,EAAK,SAAS,IAAI,EACpB,MAAM,EACJ,EACA,2BAA2B,EAAU,oCAAoC,EAAK,EAChF,EAOF,GAAM,CAAE,cAAa,YAAW,eAAgBC,EAAAA,EAAe,CAAI,EAGnE,EAAyB,EAAW,EAAW,EAAY,CAAI,EAK/D,EAA+B,EAAa,EAAW,EAAY,CAAI,EAMvE,IAAM,EAAUC,EAAAA,EAAoB,CAAW,EAE/C,GAAI,IAAY,IAAA,GACd,MAAM,EAAkB,EAAY,EAAmB,EAAS,CAAS,CAAC,EAQ5E,IAAM,EAAeC,EAAAA,EAAwB,CAAW,EAExD,GAAI,IAAiB,IAAA,GACnB,MAAM,EACJ,EACA,EACE,EAIA,EACA,CACF,CACF,EAOF,GAAI,EAAkB,CAAW,EAC/B,MAAM,EACJ,EACA,2BAA2B,EAAU,kCAAkC,EAAK,0JAC9E,EAKF,IAAM,EAAe,GAAc,EAAW,UAAU,UAAU,OAAS,EAE3E,GAAI,EAAK,WAAW,GAAG,GAAK,EAC1B,MAAM,EACJ,EACA,kBAAkB,EAAK,wDACzB,CAEJ,CCjTA,MAAM,EAA2B,OAAO,yBAClC,EAAa,OAAO,KACpB,EAAiB,OAAO,eAOxB,EAAqB,oBAKrB,EAAqB,KAKrB,EAAwB,IAM9B,SAAS,EAAmB,EAAwB,CAElD,GAAI,IAAU,KACZ,MAAO,OAGT,GAAI,OAAO,GAAU,SAAU,CAQ7B,GAAI,CACF,IAAM,EAAiB,EAAoC,YAG3D,GAAI,OAAO,GAAS,YAAc,EAAK,OAAS,SAC9C,OAAO,EAAK,MAAQ,QAExB,MAAQ,CAER,CAGA,MAAO,QACT,CAGA,OAAO,OAAO,CAChB,CASA,SAAS,EAAoB,EAAuC,CAClE,IAAK,IAAM,KAAO,EAAW,CAAG,EAAG,CACjC,IAAM,EAAa,EAAyB,EAAK,CAAG,EAEpD,GAAI,IAAe,EAAW,KAAO,EAAW,KAC9C,MAAO,EAEX,CAEA,MAAO,EACT,CAUA,SAAS,EACP,EACA,EAC0C,CAC1C,GAAI,CAAC,GAAS,OAAO,GAAU,SAC7B,MAAU,UACR,WAAW,EAAW,iCAAiC,EAAmB,CAAK,GACjF,EAIF,IAAM,EAAuB,EAAe,CAAK,EAEjD,GAAI,IAAU,OAAO,WAAa,IAAU,KAC1C,MAAU,UACR,WAAW,EAAW,sCAAsC,EAAmB,CAAK,GACtF,EAIF,GAAI,EAAoB,CAAgC,EACtD,MAAU,UACR,WAAW,EAAW,yCACxB,CAEJ,CASA,SAAS,EACP,EACA,EACM,CACN,GACE,EAAM,eAAiB,IAAA,IACvB,OAAO,EAAM,cAAiB,WAE9B,MAAU,UACR,WAAW,EAAW,WAAW,OAAO,EAAM,IAAI,EAAE,kCACtD,CAEJ,CASA,SAAS,EACP,EACA,EACM,CACN,GACE,EAAM,eAAiB,IAAA,IACvB,OAAO,EAAM,cAAiB,WAE9B,MAAU,UACR,WAAW,EAAW,WAAW,OAAO,EAAM,IAAI,EAAE,kCACtD,CAEJ,CAeA,SAAS,EACP,EACA,EAC6D,CAC7D,GAAI,OAAO,EAAM,MAAS,SACxB,MAAU,UACR,WAAW,EAAW,qCAAqC,EAAmB,EAAM,IAAI,GAC1F,EAGF,IAAM,EAAO,EAAM,KAGnB,GAAI,IAAS,GACX,MAAU,UAAU,WAAW,EAAW,6BAA6B,EAIzE,GAAI,CAAC,EAAmB,KAAK,CAAI,EAC/B,MAAU,UACR,WAAW,EAAW,4CACxB,EAIF,GAAI,EAAK,OAAS,EAChB,MAAU,UACR,WAAW,EAAW,yCAAyC,EAAsB,YACvF,EAIE,MAAK,WAAW,IAAI,EAKxB,IAAI,EAAK,SAAS,GAAG,EACnB,MAAU,UACR,WAAW,EAAW,gBAAgB,EAAK,sFAE7C,EAIF,GAAI,CAAC,EAAmB,KAAK,CAAI,EAC/B,MAAU,UACR,WAAW,EAAW,wBAAwB,EAAK,uGAGrD,CATA,CAWJ,CAWA,SAAS,EACP,EACA,EACuB,CAGvB,GAAI,CAAC,EAAS,SAAS,GAAG,EACxB,OAAO,EAAS,SAAS,IAAI,CAAQ,EAGvC,IAAI,EAAiC,EAErC,IAAK,IAAM,KAAW,EAAS,MAAM,GAAG,EAGtC,GAFA,EAAU,EAAQ,SAAS,IAAI,CAAO,EAElC,CAAC,EACH,OAIJ,OAAO,CACT,CAUA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,EAAmB,EAAU,CAAQ,EACvC,MAAU,MACR,WAAW,EAAW,WAAW,EAAS,iBAC5C,CAEJ,CAUA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,EAAU,IAAI,CAAQ,EACxB,MAAU,MACR,WAAW,EAAW,qBAAqB,EAAS,WACtD,EAGF,EAAU,IAAI,CAAQ,CACxB,CAUA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EACJ,IAAe,GAAK,EAAW,EAAmB,EAAU,CAAU,EAEnE,KAIL,KAAK,IAAM,KAAS,EAAW,SAAS,OAAO,EAC7C,GAAI,EAAM,OAAS,EACjB,MAAU,MACR,WAAW,EAAW,UAAU,EAAU,qBAC5C,CAAA,CAGN,CAUA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EAAe,EAAkB,IAAI,CAAU,EAErD,GAAI,GAAc,IAAI,CAAS,EAC7B,MAAU,MACR,WAAW,EAAW,UAAU,EAAU,qBAC5C,EAGE,EACF,EAAa,IAAI,CAAS,EAE1B,EAAkB,IAAI,EAAY,IAAI,IAAI,CAAC,CAAS,CAAC,CAAC,CAE1D,CAkCA,SAAgB,EACd,EACA,EACA,EACA,EAAa,GACb,EACA,EACkC,CAClC,EAAkB,EAAO,CAAU,EAEnC,IAAM,EAAW,EAGjB,EAAkB,EAAU,CAAU,EAGtC,EAAkB,EAAS,KAAM,EAAS,KAAM,EAAY,CAAQ,EAGpE,EAAqB,EAAU,CAAU,EACzC,EAAqB,EAAU,CAAU,EAEzC,IAAM,EAAY,EAAS,KACrB,EAAW,EAAa,GAAG,EAAW,GAAG,IAAc,EAGzD,GAAY,GACd,EAAuB,EAAU,EAAU,CAAU,EAInD,GACF,EAAwB,EAAW,EAAU,CAAU,EAGzD,IAAM,EAAY,EAAS,KACrB,EAAkB,EAkBxB,GAfI,GACF,EAAuB,EAAU,EAAiB,EAAW,CAAU,EAIrE,GACF,EACE,EACA,EACA,EACA,CACF,EAIE,EAAS,WAAa,IAAA,GAAW,CACnC,GAAI,CAAC,MAAM,QAAQ,EAAS,QAAQ,EAClC,MAAU,UACR,WAAW,EAAW,WAAW,EAAU,mCAAmC,EAAmB,EAAS,QAAQ,GACpH,EAGF,IAAK,IAAM,KAAS,EAAS,SAC3B,EACE,EACA,EACA,EACA,EACA,EACA,CACF,CAEJ,CACF"}
+{"version":3,"file":"validation.js","names":["INVALID_QUERY_NAME_RGX","buildParamMeta","describeRemovedForm","findSegmentGrammarError"],"sources":["../../src/engine/validation/routes.ts","../../src/engine/validation/route-batch.ts"],"sourcesContent":["import {\n  buildParamMeta,\n  describeRemovedForm,\n  findSegmentGrammarError,\n  INVALID_QUERY_NAME_RGX,\n} from \"../path-matcher\";\n\nimport type { RemovedForm, SegmentErrorCode } from \"../path-matcher\";\nimport type { RouteTree } from \"../types\";\n\n/**\n * Creates a TypeError with consistent router error message format.\n *\n * @param methodName - Name of the method that triggered the error\n * @param message - Error message\n * @returns TypeError with formatted message\n * @internal\n */\nfunction createRouterError(methodName: string, message: string): TypeError {\n  return new TypeError(`[router.${methodName}] ${message}`);\n}\n\n/**\n * Rejects a param name repeated within one route's own path (`/:id/:id`, a\n * param+splat clash `/:x/*x`, #1151). `buildParamMeta.urlParams` lists every\n * path-binding name — params AND splats — in order, keeping duplicates (`/:x/*x`\n * → `[\"x\", \"x\"]`), so a single pass over it catches both. The trie binds the\n * duplicates at different positions under one name, so match's later capture\n * silently overwrites the earlier and `rewritePathOnMatch` then rewrites the\n * user's URL from the single survivor. The #736 conflict guard only fires on\n * DIFFERENTLY-named params at one position, so this same-name case slips through.\n * path-matcher's `registerTree` backstop additionally catches CROSS-level dups (a\n * parent's param reused by a child), which this per-path gate cannot see. ⚠ With\n * a hole, stated as its CAUSE rather than as a list of shapes, because the list\n * is longer than it looks: that backstop reads the names off `buildParamSlots`,\n * and #1568's finality rule drops a NON-final splat before it becomes a slot.\n * So the rule is about FINALITY, not about levels: **a collision is admitted iff\n * one of the colliding bindings is a NON-final splat.** Measured, 8/8 — admitted:\n * `/p/*x/:x`, `/p/*x/*x`, and the cross-level `*`+`:` and `*`+`*` (an ancestor's\n * marker is never final, since a descendant path follows it); refused:\n * `/p/:x/*x`, `/z/:x/:x`, and the cross-level `:`+`*` and `:`+`:`. The same cause\n * opens a door at the ROOT, which is an ancestor like any other:\n * `setRootPath(\"/app/:x\")` + a route `/:x/e` throws, `setRootPath(\"/app/*x\")` +\n * the same route registers. Nothing is bound twice in any of them (the dropped\n * splat binds nothing), and since #1975 the surviving `:x` takes the param\n * encoder, so they round-trip instead of needing a refusal.\n * Extracted so `validateRoutePath` stays within the cognitive-complexity budget.\n */\nfunction validateUniqueParamNames(\n  urlParams: readonly string[],\n  routeName: string,\n  methodName: string,\n  path: string,\n): void {\n  const seen = new Set<string>();\n\n  for (const name of urlParams) {\n    if (seen.has(name)) {\n      throw createRouterError(\n        methodName,\n        `Invalid path for route \"${routeName}\": duplicate parameter name ':${name}' in \"${path}\" (a param name must be unique within a route — the second binding would overwrite the first)`,\n      );\n    }\n\n    seen.add(name);\n  }\n}\n\n/**\n * #1242 §5.1/§5.3: rejects a malformed query-param declaration — a query name\n * carrying `<`/`>` (`/a?fil<ter` — a `<` in a plain query tail; never round-trips),\n * or one that collides with a path-param name (`/a/:tab?tab`, where buildPath emits\n * the value twice). Narrow to `<>`: a `=` in the declaration (`?tab=1`, §5.2) is\n * tolerated today and left as a separate call. (Under M1 a reverse-order typo\n * `/a/:b?<c>` is caught earlier as optional-removed — the `?<` keeps it in the\n * path, §3.3.) path-matcher's `registerTree` backstops both; this gate adds the\n * route-contextual message.\n */\nfunction validateQueryParamDeclarations(\n  queryParams: readonly string[],\n  routeName: string,\n  methodName: string,\n  path: string,\n): void {\n  // A path/query name collision (`/a/:tab?tab`) is legal under M2: `tab` lives\n  // in both `state.params` and `state.search` as separate channels (RFC-4 M2 /\n  // #1548), so the former \"declared as both\" rejection is gone. Only a query\n  // name that can never round-trip (contains `<`/`>`) is still rejected.\n  for (const name of queryParams) {\n    if (INVALID_QUERY_NAME_RGX.test(name)) {\n      throw createRouterError(\n        methodName,\n        `Invalid path for route \"${routeName}\": invalid query-param name \"${name}\" in \"${path}\" (a query-param name cannot contain '<' or '>' — it would never round-trip; rename the query param)`,\n      );\n    }\n  }\n}\n\n/**\n * Reports whether a path has a raw non-ASCII code point (≥ U+0080) in a STATIC\n * segment (`/café`, `/меню`, #1154). match rejects any non-ASCII input byte\n * (`#scanPath`) and compares static trie keys raw, so such a route registers but\n * is unmatchable — `buildPath` emits `/café`, which its own `match` rejects. Only\n * static text is flagged: a marker-led segment (`:café`, a non-ASCII param NAME)\n * is skipped. A `for…of` code-point scan tracking segment start. Runs AFTER the\n * removed-form / grammar rejections, so no `<`/`>` (a former constraint) can\n * reach it — the 3-token grammar has no constraint body to skip (M1, #1516).\n */\nfunction hasNonAsciiStatic(path: string): boolean {\n  let atSegmentStart = true;\n  let segmentIsMarker = false;\n\n  for (const char of path) {\n    if (char === \"/\") {\n      atSegmentStart = true;\n\n      continue;\n    }\n\n    if (atSegmentStart) {\n      segmentIsMarker = char === \":\" || char === \"*\";\n      atSegmentStart = false;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- non-empty code point from for-of\n    if (!segmentIsMarker && char.codePointAt(0)! >= 0x80) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Maps a SURVIVING per-segment grammar error code (from `findSegmentGrammarError`)\n * to the gate's route-contextual message. The removed-form codes (`optional-removed`\n * / `constraint-removed`) are NOT handled here — they carry a richer replacement\n * recipe built by `removedFormMessage` from `describeRemovedForm`.\n */\nfunction gateGrammarMessage(\n  code: Exclude<SegmentErrorCode, \"optional-removed\" | \"constraint-removed\">,\n  routeName: string,\n  path: string,\n): string {\n  switch (code) {\n    case \"name-less\":\n    case \"trailing-marker\": {\n      return `Invalid path for route \"${routeName}\": parameter marker (':' or '*') without a name in \"${path}\"`;\n    }\n    case \"fused-marker\": {\n      return `Invalid path for route \"${routeName}\": parameter marker (':' or '*') must begin a segment, but \"${path}\" fuses one to a static prefix (use a boundary marker like \"/a/:b\")`;\n    }\n  }\n}\n\n/**\n * Builds the route-contextual replacement recipe for a removed form (M1) — the\n * RICH tier (the matcher backstop uses a shorter, path-free recipe). For an\n * optional it names the offending segment and the two concrete sibling paths that\n * replace it (computed from the actual path by `describeRemovedForm`); for a\n * constraint it names the offending segment and points to a guard.\n */\nfunction removedFormMessage(removed: RemovedForm, routeName: string): string {\n  if (removed.code === \"optional-removed\") {\n    return `Invalid path for route \"${routeName}\": optional params are not supported — \"${removed.segment}\". Declare two sibling routes instead: \"${removed.withoutSegment}\" and \"${removed.requiredForm}\" (the route hierarchy already expresses optionality)`;\n  }\n\n  return `Invalid path for route \"${routeName}\": regex constraints are not supported — '<' and '>' are reserved in path segments (\"${removed.segment}\"). Match the segment as a plain string and validate the value in a guard (canActivate) or app code`;\n}\n\n/**\n * Validates route path format.\n * Throws a descriptive error if validation fails.\n *\n * Allows:\n * - Empty string (for grouping/root routes)\n * - Absolute paths: /path, ~path\n * - Query strings: ?query\n * - Relative segments: segment\n *\n * Prevents:\n * - Non-string values\n * - Double slashes (//)\n * - Absolute paths (~) under parameterized parent nodes\n *\n * @param path - Route path to validate\n * @param routeName - Name of route (for error messages)\n * @param methodName - Name of calling method for error messages\n * @param parentNode - Optional parent node for context validation\n * @throws {TypeError} If path is invalid\n *\n * @example\n * // Valid paths\n * validateRoutePath(\"\", \"home\", \"add\");              // ok (empty for grouping)\n * validateRoutePath(\"/users\", \"users\", \"add\");       // ok (absolute)\n * validateRoutePath(\"~dashboard\", \"dash\", \"add\");    // ok (absolute, if no parameterized parent)\n * validateRoutePath(\"?tab=1\", \"home\", \"add\");        // ok (query)\n * validateRoutePath(\"profile\", \"users.profile\", \"add\"); // ok (relative)\n *\n * @example\n * // Invalid paths (throws)\n * validateRoutePath(\"/users//list\", \"users.list\", \"add\");           // throws (double slash)\n * validateRoutePath(\"~dash\", \"dash\", \"add\", paramParent);           // throws (~ under parameterized parent)\n */\n// A format-validation gate: a flat sequence of INDEPENDENT guard clauses (type,\n// whitespace, format, double-slash, dup-param, query-decl, the M1 removed-form\n// recipe, surviving grammar markers (name-less / fused / trailing), non-ASCII\n// static, absolute-under-param). Each is a simple early throw; extracting them\n// would only scatter one checklist.\n\nexport function validateRoutePath(\n  path: unknown,\n  routeName: string,\n  methodName: string,\n  parentNode?: RouteTree,\n): asserts path is string {\n  // Type check\n  if (typeof path !== \"string\") {\n    // Get type description for error message\n    let typeDesc: string;\n\n    if (path === null) {\n      typeDesc = \"null\";\n    } else if (Array.isArray(path)) {\n      typeDesc = \"array\";\n    } else {\n      typeDesc = typeof path;\n    }\n\n    throw createRouterError(\n      methodName,\n      `Route path must be a string, got ${typeDesc}`,\n    );\n  }\n\n  // Empty path is valid (for grouping/root)\n  if (path === \"\") {\n    return;\n  }\n\n  // No whitespace characters (spaces, tabs, newlines)\n  if (/\\s/.test(path)) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": whitespace not allowed in \"${path}\"`,\n    );\n  }\n\n  // Valid path pattern\n  if (!/^([/?~]|[^/]+$)/.test(path)) {\n    throw createRouterError(\n      methodName,\n      `Route \"${routeName}\" has invalid path format: \"${path}\". Path should start with '/', '~', '?' or be a relative segment.`,\n    );\n  }\n\n  // No double slashes\n  if (path.includes(\"//\")) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": double slashes not allowed in \"${path}\"`,\n    );\n  }\n\n  // The grammar checks below scan only the URL-path portion: `buildParamMeta`\n  // strips the query the same way the trie does, so a `:`/`*` inside a query\n  // declaration is not falsely flagged. (`buildParamMeta` is total — the 3-token\n  // grammar has no constraint body to compile, so it never throws — M1, #1516.)\n  const { pathPattern, urlParams, queryParams } = buildParamMeta(path);\n\n  // Duplicate param name within this route's own path (`/:id/:id`, `/:x/*x`, #1151).\n  validateUniqueParamNames(urlParams, routeName, methodName, path);\n\n  // Malformed query-param declarations (#1242 §5.1): a query name with `<>`\n  // (never round-trips). Name collisions with a path param are legal under M2\n  // (separate params/search channels, #1548).\n  validateQueryParamDeclarations(queryParams, routeName, methodName, path);\n\n  // Removed-form (M1) rejection first — a `:x?` optional or a `<re>` constraint —\n  // with the RICH route-contextual replacement recipe (the offending segment plus,\n  // for an optional, the two computed sibling paths). Returns undefined when the\n  // path's first grammar error is a SURVIVING code, so the fall-through below runs.\n  const removed = describeRemovedForm(pathPattern);\n\n  if (removed !== undefined) {\n    throw createRouterError(methodName, removedFormMessage(removed, routeName));\n  }\n\n  // Surviving per-segment grammar rejections via the canonical `parseSegment`\n  // tokenizer: name-less (#858/#863), fused-marker (#1050), trailing-marker\n  // (#1324). `findSegmentGrammarError` runs the same split+parse the matcher uses,\n  // so the gate cannot drift. (Only removed-form codes reach `removed` above; the\n  // first error here is therefore always a surviving code.)\n  const grammarError = findSegmentGrammarError(pathPattern);\n\n  if (grammarError !== undefined) {\n    throw createRouterError(\n      methodName,\n      gateGrammarMessage(\n        grammarError as Exclude<\n          SegmentErrorCode,\n          \"optional-removed\" | \"constraint-removed\"\n        >,\n        routeName,\n        path,\n      ),\n    );\n  }\n\n  // Raw non-ASCII in a STATIC segment (`/café`, `/меню`, #1154). match rejects\n  // non-ASCII input and compares static keys raw, so the route registers but never\n  // matches. Reject with the percent-encode workaround (path-matcher backstops at\n  // `registerTree`); a non-ASCII param NAME or constraint body is unaffected.\n  if (hasNonAsciiStatic(pathPattern)) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": non-ASCII static segment in \"${path}\" — match compares static segments raw and rejects non-ASCII input, so this route would never match. Percent-encode it (e.g. '/caf%C3%A9') or use a param`,\n    );\n  }\n\n  // Absolute paths under parameterized parents\n  // Check if parent has URL parameters via paramTypeMap\n  const hasUrlParams = parentNode && parentNode.paramMeta.urlParams.length > 0;\n\n  if (path.startsWith(\"~\") && hasUrlParams) {\n    throw createRouterError(\n      methodName,\n      `Absolute path \"${path}\" cannot be used under parent route with URL parameters`,\n    );\n  }\n}\n","/**\n * Batch route validation utilities.\n *\n * Provides validation for adding routes with cross-batch duplicate detection.\n * Used by router.addRoute() to ensure atomicity - all routes validated before any modification.\n */\n\nimport {\n  assertNoDottedRouteName,\n  assertRouteNameMatchesPattern,\n  assertRouteNameNotEmpty,\n  assertRouteNameNotWhitespaceOnly,\n  assertRouteNameWithinLength,\n} from \"./route-name\";\nimport { validateRoutePath } from \"./routes\";\n\nimport type { RouteDefinition, RouteTree } from \"../types\";\n\n/**\n * Intrinsics captured at module load: `getOwnPropertyDescriptor`, `objectKeys`, `getPrototypeOf`.\n *\n * ⚑ A guard is only as strong as the intrinsic it reads WHEN IT RUNS, and an\n * application can re-point any of these AFTER boot — which is what this closes.\n * Measured on the uncaptured form: one naive `Object.hasOwn` polyfill walked\n * straight through five sibling readers while the single captured guard held.\n *\n * ⚠ It does NOT close a shim evaluated BEFORE this module — the ordinary\n * polyfill order. Measured: a naive `Object.hasOwn` imported ahead of core\n * reproduces #1798 verbatim (`buildPath` prints the native method into the\n * URL). Two earlier revisions of this header said \"before any application\n * code can run\", which is the sentence a future reader would have trusted.\n */\nconst getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;\nconst objectKeys = Object.keys;\nconst getPrototypeOf = Object.getPrototypeOf;\n\n/**\n * Gets a human-readable description of a value's type.\n * Used for error messages to provide helpful debugging information.\n */\nfunction getTypeDescription(value: unknown): string {\n  // Handle null explicitly (typeof null === \"object\")\n  if (value === null) {\n    return \"null\";\n  }\n\n  if (typeof value === \"object\") {\n    // Read `constructor`/`.name` defensively: an adversarial own `constructor`\n    // (null, a string, a number, …) is not a real constructor and must not crash\n    // here nor yield a non-string (#903); a THROWING accessor — a `constructor`\n    // getter, a function constructor with a throwing `.name` getter, or a Proxy\n    // that throws on [[Get]] — must not crash either (#1052). Both fall back to\n    // \"object\". (Byte-identical twin of type-guards' getTypeDescription —\n    // route-tree has no type-guards dependency, so the hardening is duplicated.)\n    try {\n      const ctor: unknown = (value as { constructor?: unknown }).constructor;\n\n      // Return constructor name for class instances\n      if (typeof ctor === \"function\" && ctor.name !== \"Object\") {\n        return ctor.name || \"object\"; // empty name (anonymous class) → \"object\"\n      }\n    } catch {\n      // Throwing constructor/.name getter or Proxy [[Get]] → fall through (#1052).\n    }\n\n    // Plain object\n    return \"object\";\n  }\n\n  // Primitive types (string, number, boolean, undefined, etc.)\n  return typeof value;\n}\n\n/**\n * Checks if an object has getters or setters.\n * Used to detect potentially malicious route objects that could mutate during processing.\n *\n * @param obj - Object to check\n * @returns true if object has getters or setters\n */\nfunction hasGettersOrSetters(obj: Record<string, unknown>): boolean {\n  for (const key of objectKeys(obj)) {\n    const descriptor = getOwnPropertyDescriptor(obj, key);\n\n    if (descriptor && (descriptor.get || descriptor.set)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Validates that route is a plain object without getters/setters.\n * Prevents malicious objects that could mutate during processing.\n *\n * @param route - Route to validate\n * @param methodName - Calling method for error context\n * @throws {TypeError} If route is not a plain object\n */\nfunction validateRouteType(\n  route: unknown,\n  methodName: string,\n): asserts route is Record<string, unknown> {\n  if (!route || typeof route !== \"object\") {\n    throw new TypeError(\n      `[router.${methodName}] Route must be an object, got ${getTypeDescription(route)}`,\n    );\n  }\n\n  // Check for plain object (prototype must be Object.prototype or null)\n  const proto: object | null = getPrototypeOf(route) as object | null;\n\n  if (proto !== Object.prototype && proto !== null) {\n    throw new TypeError(\n      `[router.${methodName}] Route must be a plain object, got ${getTypeDescription(route)}`,\n    );\n  }\n\n  // Check for getters/setters (could cause mutations during processing)\n  if (hasGettersOrSetters(route as Record<string, unknown>)) {\n    throw new TypeError(\n      `[router.${methodName}] Route must not have getters or setters`,\n    );\n  }\n}\n\n/**\n * Validates that encodeParams is a function if provided.\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If encodeParams is not a function\n */\nfunction validateEncodeParams(\n  route: Record<string, unknown>,\n  methodName: string,\n): void {\n  if (\n    route.encodeParams !== undefined &&\n    typeof route.encodeParams !== \"function\"\n  ) {\n    throw new TypeError(\n      `[router.${methodName}] Route \"${String(route.name)}\" encodeParams must be a function`,\n    );\n  }\n}\n\n/**\n * Validates that decodeParams is a function if provided.\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If decodeParams is not a function\n */\nfunction validateDecodeParams(\n  route: Record<string, unknown>,\n  methodName: string,\n): void {\n  if (\n    route.decodeParams !== undefined &&\n    typeof route.decodeParams !== \"function\"\n  ) {\n    throw new TypeError(\n      `[router.${methodName}] Route \"${String(route.name)}\" decodeParams must be a function`,\n    );\n  }\n}\n\n/**\n * Validates that route name is a valid string matching the expected format.\n *\n * Route name rules:\n * - Must be a string\n * - Cannot be empty or whitespace-only\n * - Cannot contain dots (use children array or { parent } option instead)\n * - Must match [a-zA-Z_][a-zA-Z0-9_-]*\n *\n * ⚠ The string check stays inline rather than joining `./route-name`: core\n * carries two wordings for it — this one reports `getTypeDescription`, and\n * `assertNoInternalRouteName` reports bare `typeof` to mirror the plugin — so\n * sharing one predicate would change a message rather than move it.\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If name is missing, not a string, or invalid format\n */\nfunction validateRouteName(\n  route: Record<string, unknown>,\n  methodName: string,\n): asserts route is Record<string, unknown> & { name: string } {\n  if (typeof route.name !== \"string\") {\n    throw new TypeError(\n      `[router.${methodName}] Route name must be a string, got ${getTypeDescription(route.name)}`,\n    );\n  }\n\n  const name = route.name;\n\n  assertRouteNameNotEmpty(name, methodName);\n  assertRouteNameNotWhitespaceOnly(name, methodName);\n  assertRouteNameWithinLength(name, methodName);\n\n  // System routes bypass the spelling rules (e.g., @@router/UNKNOWN_ROUTE).\n  if (name.startsWith(\"@@\")) {\n    return;\n  }\n\n  assertNoDottedRouteName(name, methodName);\n  assertRouteNameMatchesPattern(name, methodName);\n}\n\n/**\n * Finds a node by its fullName in the tree.\n * Even though user-provided route names cannot contain dots,\n * fullName is computed during validation (e.g., \"parent.child\").\n *\n * @param rootNode - Root node to start from\n * @param fullName - Full route name (e.g., \"users.profile\")\n * @returns The resolved node, or undefined if not found\n */\nfunction findNodeByFullName(\n  rootNode: RouteTree,\n  fullName: string,\n): RouteTree | undefined {\n  // Fast path: single-segment names don't need splitting\n  // Stryker disable next-line ConditionalExpression,StringLiteral,BlockStatement: equivalent — the fast path is a pure optimization; for a dotless name the general path below yields the identical result (`name.split(\".\")` → `[name]`, a one-iteration `children.get(name)`). (BooleanLiteral stays live: dropping the `!` runs the fast path for a dotted name → `children.get(\"a.b\")` is undefined = killed.)\n  if (!fullName.includes(\".\")) {\n    return rootNode.children.get(fullName);\n  }\n\n  let current: RouteTree | undefined = rootNode;\n\n  for (const segment of fullName.split(\".\")) {\n    current = current.children.get(segment);\n\n    if (!current) {\n      return undefined;\n    }\n  }\n\n  return current;\n}\n\n/**\n * Checks for duplicate route name in existing tree.\n *\n * @param rootNode - Root node to search in\n * @param fullName - Full route name (dot-notation)\n * @param methodName - Calling method for error context\n * @throws {Error} If route name already exists\n */\nfunction checkTreeNameDuplicate(\n  rootNode: RouteTree,\n  fullName: string,\n  methodName: string,\n): void {\n  if (findNodeByFullName(rootNode, fullName)) {\n    throw new Error(\n      `[router.${methodName}] Route \"${fullName}\" already exists`,\n    );\n  }\n}\n\n/**\n * Checks for duplicate route name in current batch.\n *\n * @param seenNames - Set of names already seen in batch\n * @param fullName - Full route name to check\n * @param methodName - Calling method for error context\n * @throws {Error} If duplicate name in batch\n */\nfunction checkBatchNameDuplicate(\n  seenNames: Set<string>,\n  fullName: string,\n  methodName: string,\n): void {\n  if (seenNames.has(fullName)) {\n    throw new Error(\n      `[router.${methodName}] Duplicate route \"${fullName}\" in batch`,\n    );\n  }\n\n  seenNames.add(fullName);\n}\n\n/**\n * Checks for duplicate path in existing tree at same parent level.\n *\n * @param rootNode - Root node to search in\n * @param parentName - Parent route name (empty string for root level)\n * @param routePath - Path to check for duplicates\n * @throws {Error} If path already exists at this level\n */\nfunction checkTreePathDuplicate(\n  rootNode: RouteTree,\n  parentName: string,\n  routePath: string,\n  methodName: string,\n): void {\n  const parentNode =\n    parentName === \"\" ? rootNode : findNodeByFullName(rootNode, parentName);\n\n  if (!parentNode) {\n    return; // Parent doesn't exist, so no duplicate\n  }\n\n  for (const child of parentNode.children.values()) {\n    if (child.path === routePath) {\n      throw new Error(\n        `[router.${methodName}] Path \"${routePath}\" is already defined`,\n      );\n    }\n  }\n}\n\n/**\n * Checks for duplicate path in current batch at same parent level.\n *\n * @param seenPathsByParent - Map of paths by parent name\n * @param parentName - Parent route name (empty string for root level)\n * @param routePath - Path to check for duplicates\n * @throws {Error} If path already exists at this level in batch\n */\nfunction checkBatchPathDuplicate(\n  seenPathsByParent: Map<string, Set<string>>,\n  parentName: string,\n  routePath: string,\n  methodName: string,\n): void {\n  const pathsAtLevel = seenPathsByParent.get(parentName);\n\n  if (pathsAtLevel?.has(routePath)) {\n    throw new Error(\n      `[router.${methodName}] Path \"${routePath}\" is already defined`,\n    );\n  }\n\n  if (pathsAtLevel) {\n    pathsAtLevel.add(routePath);\n  } else {\n    seenPathsByParent.set(parentName, new Set([routePath]));\n  }\n}\n\n/**\n * Validates route structure for add operations.\n *\n * Performs comprehensive validation including:\n * - Type check (must be object)\n * - Name validation\n * - Path validation\n * - Duplicate name detection (in tree and batch)\n * - Duplicate path detection (in tree and batch)\n * - Recursive children validation\n *\n * @param route - Route to validate\n * @param methodName - Calling method for error context\n * @param rootNode - Optional root node for duplicate checking\n * @param parentName - Parent route name for building full path (used in recursion)\n * @param seenNames - Set of names already seen in this batch\n * @param seenPathsByParent - Map of paths by parent for path duplicate detection\n * @throws {TypeError} If route structure is invalid\n * @throws {Error} If route already exists (duplicate)\n * @throws {Error} If path already defined (duplicate)\n *\n * @example\n * ```typescript\n * const seenNames = new Set<string>();\n * const seenPaths = new Map<string, Set<string>>();\n *\n * // Validate routes before adding\n * for (const route of routes) {\n *   validateRoute(route, \"add\", rootNode, \"\", seenNames, seenPaths);\n * }\n * ```\n */\nexport function validateRoute(\n  route: unknown,\n  methodName: string,\n  rootNode?: RouteTree,\n  parentName = \"\",\n  seenNames?: Set<string>,\n  seenPathsByParent?: Map<string, Set<string>>,\n): asserts route is RouteDefinition {\n  validateRouteType(route, methodName);\n\n  const routeDef = route;\n\n  // Validate that name is a non-empty string\n  validateRouteName(routeDef, methodName);\n\n  // Validate path structure\n  validateRoutePath(routeDef.path, routeDef.name, methodName, rootNode);\n\n  // Validate optional function properties\n  validateEncodeParams(routeDef, methodName);\n  validateDecodeParams(routeDef, methodName);\n\n  const routeName = routeDef.name;\n  const fullName = parentName ? `${parentName}.${routeName}` : routeName;\n\n  // Check for duplicate name in existing tree\n  if (rootNode && fullName) {\n    checkTreeNameDuplicate(rootNode, fullName, methodName);\n  }\n\n  // Check for duplicate name in current batch\n  if (seenNames) {\n    checkBatchNameDuplicate(seenNames, fullName, methodName);\n  }\n\n  const routePath = routeDef.path;\n  const pathCheckParent = parentName;\n\n  // Check for duplicate path in existing tree\n  if (rootNode) {\n    checkTreePathDuplicate(rootNode, pathCheckParent, routePath, methodName);\n  }\n\n  // Check for duplicate path in current batch\n  if (seenPathsByParent) {\n    checkBatchPathDuplicate(\n      seenPathsByParent,\n      pathCheckParent,\n      routePath,\n      methodName,\n    );\n  }\n\n  // Validate children recursively\n  if (routeDef.children !== undefined) {\n    if (!Array.isArray(routeDef.children)) {\n      throw new TypeError(\n        `[router.${methodName}] Route \"${routeName}\" children must be an array, got ${getTypeDescription(routeDef.children)}`,\n      );\n    }\n\n    for (const child of routeDef.children) {\n      validateRoute(\n        child,\n        methodName,\n        rootNode,\n        fullName,\n        seenNames,\n        seenPathsByParent,\n      );\n    }\n  }\n}\n"],"mappings":"+GAkBA,SAAS,EAAkB,EAAoB,EAA4B,CACzE,OAAW,UAAU,WAAW,EAAW,IAAI,GAAS,CAC1D,CA4BA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EAAO,IAAI,IAEjB,IAAK,IAAM,KAAQ,EAAW,CAC5B,GAAI,EAAK,IAAI,CAAI,EACf,MAAM,EACJ,EACA,2BAA2B,EAAU,gCAAgC,EAAK,QAAQ,EAAK,8FACzF,EAGF,EAAK,IAAI,CAAI,CACf,CACF,CAYA,SAAS,EACP,EACA,EACA,EACA,EACM,CAKN,IAAK,IAAM,KAAQ,EACjB,GAAIA,EAAAA,EAAuB,KAAK,CAAI,EAClC,MAAM,EACJ,EACA,2BAA2B,EAAU,+BAA+B,EAAK,QAAQ,EAAK,qGACxF,CAGN,CAYA,SAAS,EAAkB,EAAuB,CAChD,IAAI,EAAiB,GACjB,EAAkB,GAEtB,IAAK,IAAM,KAAQ,EAAM,CACvB,GAAI,IAAS,IAAK,CAChB,EAAiB,GAEjB,QACF,CAQA,GANA,AAEE,KADA,EAAkB,IAAS,KAAO,IAAS,IAC1B,IAIf,CAAC,GAAmB,EAAK,YAAY,CAAC,GAAM,IAC9C,MAAO,EAEX,CAEA,MAAO,EACT,CAQA,SAAS,EACP,EACA,EACA,EACQ,CACR,OAAQ,EAAR,CACE,IAAK,YACL,IAAK,kBACH,MAAO,2BAA2B,EAAU,sDAAsD,EAAK,GAEzG,IAAK,eACH,MAAO,2BAA2B,EAAU,8DAA8D,EAAK,oEAEnH,CACF,CASA,SAAS,EAAmB,EAAsB,EAA2B,CAK3E,OAJI,EAAQ,OAAS,mBACZ,2BAA2B,EAAU,0CAA0C,EAAQ,QAAQ,0CAA0C,EAAQ,eAAe,SAAS,EAAQ,aAAa,uDAGhM,2BAA2B,EAAU,uFAAuF,EAAQ,QAAQ,oGACrJ,CA0CA,SAAgB,EACd,EACA,EACA,EACA,EACwB,CAExB,GAAI,OAAO,GAAS,SAAU,CAE5B,IAAI,EAUJ,KARA,CAKE,EALE,IAAS,KACA,OACF,MAAM,QAAQ,CAAI,EAChB,QAEA,OAAO,EAGd,EACJ,EACA,oCAAoC,GACtC,CACF,CAGA,GAAI,IAAS,GACX,OAIF,GAAI,KAAK,KAAK,CAAI,EAChB,MAAM,EACJ,EACA,2BAA2B,EAAU,gCAAgC,EAAK,EAC5E,EAIF,GAAI,CAAC,kBAAkB,KAAK,CAAI,EAC9B,MAAM,EACJ,EACA,UAAU,EAAU,8BAA8B,EAAK,kEACzD,EAIF,GAAI,EAAK,SAAS,IAAI,EACpB,MAAM,EACJ,EACA,2BAA2B,EAAU,oCAAoC,EAAK,EAChF,EAOF,GAAM,CAAE,cAAa,YAAW,eAAgBC,EAAAA,EAAe,CAAI,EAGnE,EAAyB,EAAW,EAAW,EAAY,CAAI,EAK/D,EAA+B,EAAa,EAAW,EAAY,CAAI,EAMvE,IAAM,EAAUC,EAAAA,EAAoB,CAAW,EAE/C,GAAI,IAAY,IAAA,GACd,MAAM,EAAkB,EAAY,EAAmB,EAAS,CAAS,CAAC,EAQ5E,IAAM,EAAeC,EAAAA,EAAwB,CAAW,EAExD,GAAI,IAAiB,IAAA,GACnB,MAAM,EACJ,EACA,EACE,EAIA,EACA,CACF,CACF,EAOF,GAAI,EAAkB,CAAW,EAC/B,MAAM,EACJ,EACA,2BAA2B,EAAU,kCAAkC,EAAK,0JAC9E,EAKF,IAAM,EAAe,GAAc,EAAW,UAAU,UAAU,OAAS,EAE3E,GAAI,EAAK,WAAW,GAAG,GAAK,EAC1B,MAAM,EACJ,EACA,kBAAkB,EAAK,wDACzB,CAEJ,CC1SA,MAAM,EAA2B,OAAO,yBAClC,EAAa,OAAO,KACpB,EAAiB,OAAO,eAM9B,SAAS,EAAmB,EAAwB,CAElD,GAAI,IAAU,KACZ,MAAO,OAGT,GAAI,OAAO,GAAU,SAAU,CAQ7B,GAAI,CACF,IAAM,EAAiB,EAAoC,YAG3D,GAAI,OAAO,GAAS,YAAc,EAAK,OAAS,SAC9C,OAAO,EAAK,MAAQ,QAExB,MAAQ,CAER,CAGA,MAAO,QACT,CAGA,OAAO,OAAO,CAChB,CASA,SAAS,EAAoB,EAAuC,CAClE,IAAK,IAAM,KAAO,EAAW,CAAG,EAAG,CACjC,IAAM,EAAa,EAAyB,EAAK,CAAG,EAEpD,GAAI,IAAe,EAAW,KAAO,EAAW,KAC9C,MAAO,EAEX,CAEA,MAAO,EACT,CAUA,SAAS,EACP,EACA,EAC0C,CAC1C,GAAI,CAAC,GAAS,OAAO,GAAU,SAC7B,MAAU,UACR,WAAW,EAAW,iCAAiC,EAAmB,CAAK,GACjF,EAIF,IAAM,EAAuB,EAAe,CAAK,EAEjD,GAAI,IAAU,OAAO,WAAa,IAAU,KAC1C,MAAU,UACR,WAAW,EAAW,sCAAsC,EAAmB,CAAK,GACtF,EAIF,GAAI,EAAoB,CAAgC,EACtD,MAAU,UACR,WAAW,EAAW,yCACxB,CAEJ,CASA,SAAS,EACP,EACA,EACM,CACN,GACE,EAAM,eAAiB,IAAA,IACvB,OAAO,EAAM,cAAiB,WAE9B,MAAU,UACR,WAAW,EAAW,WAAW,OAAO,EAAM,IAAI,EAAE,kCACtD,CAEJ,CASA,SAAS,EACP,EACA,EACM,CACN,GACE,EAAM,eAAiB,IAAA,IACvB,OAAO,EAAM,cAAiB,WAE9B,MAAU,UACR,WAAW,EAAW,WAAW,OAAO,EAAM,IAAI,EAAE,kCACtD,CAEJ,CAoBA,SAAS,EACP,EACA,EAC6D,CAC7D,GAAI,OAAO,EAAM,MAAS,SACxB,MAAU,UACR,WAAW,EAAW,qCAAqC,EAAmB,EAAM,IAAI,GAC1F,EAGF,IAAM,EAAO,EAAM,KAEnB,EAAA,EAAwB,EAAM,CAAU,EACxC,EAAA,EAAiC,EAAM,CAAU,EACjD,EAAA,EAA4B,EAAM,CAAU,EAGxC,GAAK,WAAW,IAAI,IAIxB,EAAA,EAAwB,EAAM,CAAU,EACxC,EAAA,EAA8B,EAAM,CAAU,EAChD,CAWA,SAAS,EACP,EACA,EACuB,CAGvB,GAAI,CAAC,EAAS,SAAS,GAAG,EACxB,OAAO,EAAS,SAAS,IAAI,CAAQ,EAGvC,IAAI,EAAiC,EAErC,IAAK,IAAM,KAAW,EAAS,MAAM,GAAG,EAGtC,GAFA,EAAU,EAAQ,SAAS,IAAI,CAAO,EAElC,CAAC,EACH,OAIJ,OAAO,CACT,CAUA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,EAAmB,EAAU,CAAQ,EACvC,MAAU,MACR,WAAW,EAAW,WAAW,EAAS,iBAC5C,CAEJ,CAUA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,EAAU,IAAI,CAAQ,EACxB,MAAU,MACR,WAAW,EAAW,qBAAqB,EAAS,WACtD,EAGF,EAAU,IAAI,CAAQ,CACxB,CAUA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EACJ,IAAe,GAAK,EAAW,EAAmB,EAAU,CAAU,EAEnE,KAIL,KAAK,IAAM,KAAS,EAAW,SAAS,OAAO,EAC7C,GAAI,EAAM,OAAS,EACjB,MAAU,MACR,WAAW,EAAW,UAAU,EAAU,qBAC5C,CAAA,CAGN,CAUA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EAAe,EAAkB,IAAI,CAAU,EAErD,GAAI,GAAc,IAAI,CAAS,EAC7B,MAAU,MACR,WAAW,EAAW,UAAU,EAAU,qBAC5C,EAGE,EACF,EAAa,IAAI,CAAS,EAE1B,EAAkB,IAAI,EAAY,IAAI,IAAI,CAAC,CAAS,CAAC,CAAC,CAE1D,CAkCA,SAAgB,EACd,EACA,EACA,EACA,EAAa,GACb,EACA,EACkC,CAClC,EAAkB,EAAO,CAAU,EAEnC,IAAM,EAAW,EAGjB,EAAkB,EAAU,CAAU,EAGtC,EAAkB,EAAS,KAAM,EAAS,KAAM,EAAY,CAAQ,EAGpE,EAAqB,EAAU,CAAU,EACzC,EAAqB,EAAU,CAAU,EAEzC,IAAM,EAAY,EAAS,KACrB,EAAW,EAAa,GAAG,EAAW,GAAG,IAAc,EAGzD,GAAY,GACd,EAAuB,EAAU,EAAU,CAAU,EAInD,GACF,EAAwB,EAAW,EAAU,CAAU,EAGzD,IAAM,EAAY,EAAS,KACrB,EAAkB,EAkBxB,GAfI,GACF,EAAuB,EAAU,EAAiB,EAAW,CAAU,EAIrE,GACF,EACE,EACA,EACA,EACA,CACF,EAIE,EAAS,WAAa,IAAA,GAAW,CACnC,GAAI,CAAC,MAAM,QAAQ,EAAS,QAAQ,EAClC,MAAU,UACR,WAAW,EAAW,WAAW,EAAU,mCAAmC,EAAmB,EAAS,QAAQ,GACpH,EAGF,IAAK,IAAM,KAAS,EAAS,SAC3B,EACE,EACA,EACA,EACA,EACA,EACA,CACF,CAEJ,CACF"}