@real-router/core 0.119.0 → 0.119.2

package/dist/cjs/types/api.d.ts

@@ -36,8 +36,11 @@ type InterceptorFn<M extends keyof InterceptableMethodMap> = (next: Interceptabl
  * The plugin must call {@link release} in its `teardown()` so another plugin
  * can reclaim the same namespace.
  *
- * The core runtime enforces one invariant: a namespace can be held by at most
- * one claim at a time. Double-claiming throws `CONTEXT_NAMESPACE_ALREADY_CLAIMED`.
+ * The core runtime enforces one invariant, from both sides. A namespace can be
+ * held by at most one claim at a time — double-claiming throws
+ * `CONTEXT_NAMESPACE_ALREADY_CLAIMED` — and a claim acts only while it is the
+ * holder, so {@link write} and {@link release} are both no-ops once the claim
+ * has been released.
  *
  * @example
  * ```typescript

package/dist/cjs/types/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","names":[],"sources":["../../../src/types/api.ts"],"mappings":";;;;;;;;;;;;;;;;UAoCiB;EACf,QAAQ,kBAAkB,QAAQ;EAClC,YAAY,eAAe,SAAS,QAAQ,SAAS;EACrD,eACE,mBACA,aAAa,QACb,cAAc,iBACX;;;;;;KAOK,cAAc,gBAAgB,2BACxC,MAAM,uBAAuB,OAC1B,MAAM,WAAW,uBAAuB,QACxC,WAAW,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAqCtB,sBAAsB;EACrC,QAAQ,OAAO,OAAO,OAAO;EAC7B;;;;;;UAOe;EACf,YAAY,UAAU,SAAS,QAAQ,UAAU,eAAe,cAC9D,cACA,SAAS,GACT,SAAS,GACT,kBACG,MAAM,GAAG;EAEd,eACE,UAAU,SAAS,QACnB,UAAU,eAAe,cAEzB,mBACA,aAAa,GACb,cAAc,MACX,YAAY,GAAG;EAEpB,YAAY,UAAU,SAAS,QAAQ,iBAAiB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+B9D,kBACE,OAAO,OACP,UAAU,sBACP,QAAQ;;;;;;;EAQb,cAAc;EACd;EAEA,mBAAmB,UAAU,WAC3B,WAAW,GACX,IAAI,OAAO,eAAe,QACvB;;;;;;;;;;;;EAaL,uBACE,cACA,SAAS,QACT,SAAS,iBACN;EAEL,kBAAkB;EAElB;EAEA,iBAAiB,gBAAgB,wBAC/B,QAAQ,GACR,IAAI,cAAc,OACf;EAEL,eAAe,YAAY,4BAA4B;;;;;;;;;;;;;;;EAgBvD,sBAAsB,OAAO;EAE7B;KAEG,gBAAgB,uBACf,WAAW,IACV,sBAAsB,aAAa;KACrC,oBAAoB;;;;;;;;;;;;;;;;;;;EAoBvB,iBAAiB,iBAAiB;;;;;UAMnB,UACf,qBAAqB,sBAAsB;EAE3C,MACE,QAAQ,MAAM,kBAAkB,MAAM,eACtC;IAAY;;EAGd,SAAS;;;;;;;;;;;EAYT,SAAS,cAAc,SAAS,kBAAkB;EAElD;EAEA,UAAU,QAAQ,MAAM,kBAAkB,MAAM;EAEhD,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BN,MAAM,iBAAiB,MAAM;;;;;;;;;;;;;EAc7B,mBACE,UAAU,OAAO,iBAAiB,2BAC/B;;;;;UAMU,gBACf,qBAAqB,sBAAsB;EAE3C,MAAM,gBAAgB,cAAc,KAAK,MAAM,aAAa;EAC5D,cAAc,QAAQ;EACtB,MAAM,gBAAgB,uBACpB,MAAM,GACN,OAAO,aAAa;EAEtB,SAAS,MAAM;EACf,SAAS,YAAY;EACrB;EACA,MAAM,YAAY;;;;;UAMH,aACf,qBAAqB,sBAAsB;EAE3C,mBACE,cACA,oBAAoB,eAAe;EAErC,qBACE,cACA,sBAAsB,eAAe;EAEvC,sBAAsB;EACtB,wBAAwB"}
+{"version":3,"file":"api.d.ts","names":[],"sources":["../../../src/types/api.ts"],"mappings":";;;;;;;;;;;;;;;;UAoCiB;EACf,QAAQ,kBAAkB,QAAQ;EAClC,YAAY,eAAe,SAAS,QAAQ,SAAS;EACrD,eACE,mBACA,aAAa,QACb,cAAc,iBACX;;;;;;KAOK,cAAc,gBAAgB,2BACxC,MAAM,uBAAuB,OAC1B,MAAM,WAAW,uBAAuB,QACxC,WAAW,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAwCtB,sBAAsB;EACrC,QAAQ,OAAO,OAAO,OAAO;EAC7B;;;;;;UAOe;EACf,YAAY,UAAU,SAAS,QAAQ,UAAU,eAAe,cAC9D,cACA,SAAS,GACT,SAAS,GACT,kBACG,MAAM,GAAG;EAEd,eACE,UAAU,SAAS,QACnB,UAAU,eAAe,cAEzB,mBACA,aAAa,GACb,cAAc,MACX,YAAY,GAAG;EAEpB,YAAY,UAAU,SAAS,QAAQ,iBAAiB,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+B9D,kBACE,OAAO,OACP,UAAU,sBACP,QAAQ;;;;;;;EAQb,cAAc;EACd;EAEA,mBAAmB,UAAU,WAC3B,WAAW,GACX,IAAI,OAAO,eAAe,QACvB;;;;;;;;;;;;EAaL,uBACE,cACA,SAAS,QACT,SAAS,iBACN;EAEL,kBAAkB;EAElB;EAEA,iBAAiB,gBAAgB,wBAC/B,QAAQ,GACR,IAAI,cAAc,OACf;EAEL,eAAe,YAAY,4BAA4B;;;;;;;;;;;;;;;EAgBvD,sBAAsB,OAAO;EAE7B;KAEG,gBAAgB,uBACf,WAAW,IACV,sBAAsB,aAAa;KACrC,oBAAoB;;;;;;;;;;;;;;;;;;;EAoBvB,iBAAiB,iBAAiB;;;;;UAMnB,UACf,qBAAqB,sBAAsB;EAE3C,MACE,QAAQ,MAAM,kBAAkB,MAAM,eACtC;IAAY;;EAGd,SAAS;;;;;;;;;;;EAYT,SAAS,cAAc,SAAS,kBAAkB;EAElD;EAEA,UAAU,QAAQ,MAAM,kBAAkB,MAAM;EAEhD,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BN,MAAM,iBAAiB,MAAM;;;;;;;;;;;;;EAc7B,mBACE,UAAU,OAAO,iBAAiB,2BAC/B;;;;;UAMU,gBACf,qBAAqB,sBAAsB;EAE3C,MAAM,gBAAgB,cAAc,KAAK,MAAM,aAAa;EAC5D,cAAc,QAAQ;EACtB,MAAM,gBAAgB,uBACpB,MAAM,GACN,OAAO,aAAa;EAEtB,SAAS,MAAM;EACf,SAAS,YAAY;EACrB;EACA,MAAM,YAAY;;;;;UAMH,aACf,qBAAqB,sBAAsB;EAE3C,mBACE,cACA,oBAAoB,eAAe;EAErC,qBACE,cACA,sBAAsB,eAAe;EAEvC,sBAAsB;EACtB,wBAAwB"}

package/dist/cjs/utils/ingest.d.ts

@@ -70,9 +70,9 @@
  *
  * `in` answers `false` for a fresh bag's new key and short-circuits, so
  * `hasOwn`
- * runs only on the rare branch it disambiguates. ⚠ That short-circuit is why an
- * earlier revision called the hot path "untouched"; it is not — one dictionary
- * lookup per written field is the price, and it is measured below.
+ * runs only on the rare branch it disambiguates. ⚠ That short-circuit does NOT
+ * leave the hot path untouched — one dictionary lookup per written field is the
+ * price, and it is measured below.
  *
  * ⚠ The alternative that looks equivalent and is not: a prototype-less target.
  * It also closes the axis, and it costs far MORE, because the price is not on
@@ -82,10 +82,10 @@
  * **+36.2 %** (slot + query). `{ __proto__: null }` as a literal is no better
  * (76 ns vs 70 ns for `Object.create(null)`, against 7.5 ns plain).
  *
- * ⚑ **The guard costs, and two earlier revisions of this docblock denied it.**
- * The last one said "NOT MEASURABLE" on medians-of-five whose A/A floors were
- * 5-6 %; on a quiet machine this harness floors at 0.1-1.7 %, and at that
- * resolution the cost is plain. Same-session A/B, ALTERNATING PROCESSES (two
+ * ⚑ **The guard COSTS, and "not measurable" is a resolution artefact.** Medians
+ * of five floor at an A/A of 5-6 %, which hides it; on a quiet machine this
+ * harness floors at 0.1-1.7 %, and at that resolution the cost is plain.
+ * Same-session A/B, ALTERNATING PROCESSES (two
  * copies of the module in one process is not a valid A/B), medians of 20 pairs,
  * against the SHIPPED bundle rather than `src`, each arc's own A/A floor in
  * brackets:
@@ -186,8 +186,7 @@ declare function putField<V>(target: Record<string, V>, key: string, value: V):
  * between the test and the use (#1899). It is also the idiom the sibling copy
  * loops use.
  *
- * ⚠ **Two things it does NOT buy, both measured after an earlier revision of
- * this docblock claimed them.**
+ * ⚠ **Two things it does NOT buy, both measured.**
  *
  *   - It is **not** a filter against a lying Proxy source. `ownKeys` is asked
  *     first, so a key that list does not contain cannot appear — but a source
@@ -197,9 +196,8 @@ declare function putField<V>(target: Record<string, V>, key: string, value: V):
  *   - It is **not** a drop-in for `Object.assign`. `Object.entries` is
  *     string-keyed, so own enumerable SYMBOL entries are dropped where
  *     `Object.assign` copies them. That matches core's stated policy for the
- * channels ("symbols are dropped, always") and is a real behaviour change at
- *     the one call site that used to be an `Object.assign`
- *     (`persistent-params`' factory). ⚠ It also disagrees with `publishRecord`
+ * channels ("symbols are dropped, always") and is a real behaviour difference
+ *     from `Object.assign` at one call site (`persistent-params`' factory). ⚠ It also disagrees with `publishRecord`
  *     two functions up, which spreads and therefore keeps symbols — the same
  *     internal split `helpers.ts` records as the #1792 defect.
  */

package/dist/cjs/utils/ingest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest.d.ts","names":[],"sources":["../../../src/utils/ingest.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6UgB,SAAS,GACvB,QAAQ,eAAe,IACvB,aACA,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmDO,WAAW,GACzB,QAAQ,eAAe,IACvB,QAAQ,eAAe"}
+{"version":3,"file":"ingest.d.ts","names":[],"sources":["../../../src/utils/ingest.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2UgB,SAAS,GACvB,QAAQ,eAAe,IACvB,aACA,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiDO,WAAW,GACzB,QAAQ,eAAe,IACvB,QAAQ,eAAe"}

package/dist/cjs/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","names":["INVALID_QUERY_NAME_RGX","buildParamMeta","describeRemovedForm","findSegmentGrammarError"],"sources":["../../src/engine/validation/routes.ts","../../src/engine/validation/route-batch.ts"],"sourcesContent":["import {\n  buildParamMeta,\n  describeRemovedForm,\n  findSegmentGrammarError,\n  INVALID_QUERY_NAME_RGX,\n} from \"../path-matcher\";\n\nimport type { RemovedForm, SegmentErrorCode } from \"../path-matcher\";\nimport type { RouteTree } from \"../types\";\n\n/**\n * Creates a TypeError with consistent router error message format.\n *\n * @param methodName - Name of the method that triggered the error\n * @param message - Error message\n * @returns TypeError with formatted message\n * @internal\n */\nfunction createRouterError(methodName: string, message: string): TypeError {\n  return new TypeError(`[router.${methodName}] ${message}`);\n}\n\n/**\n * Rejects a param name repeated within one route's own path (`/:id/:id`, a\n * param+splat clash `/:x/*x`, #1151). `buildParamMeta.urlParams` lists every\n * path-binding name — params AND splats — in order, keeping duplicates (`/:x/*x`\n * → `[\"x\", \"x\"]`), so a single pass over it catches both. The trie binds the\n * duplicates at different positions under one name, so match's later capture\n * silently overwrites the earlier and `rewritePathOnMatch` then rewrites the\n * user's URL from the single survivor. The #736 conflict guard only fires on\n * DIFFERENTLY-named params at one position, so this same-name case slips through.\n * path-matcher's `registerTree` backstop additionally catches CROSS-level dups (a\n * parent's param reused by a child), which this per-path gate cannot see. ⚠ With\n * a hole, stated as its CAUSE rather than as a list of shapes, because the list\n * is longer than it looks: that backstop reads the names off `buildParamSlots`,\n * and #1568's finality rule drops a NON-final splat before it becomes a slot.\n * So the rule is about FINALITY, not about levels: **a collision is admitted iff\n * one of the colliding bindings is a NON-final splat.** Measured, 8/8 — admitted:\n * `/p/*x/:x`, `/p/*x/*x`, and the cross-level `*`+`:` and `*`+`*` (an ancestor's\n * marker is never final, since a descendant path follows it); refused:\n * `/p/:x/*x`, `/z/:x/:x`, and the cross-level `:`+`*` and `:`+`:`. The same cause\n * opens a door at the ROOT, which is an ancestor like any other:\n * `setRootPath(\"/app/:x\")` + a route `/:x/e` throws, `setRootPath(\"/app/*x\")` +\n * the same route registers. Nothing is bound twice in any of them (the dropped\n * splat binds nothing), and since #1975 the surviving `:x` takes the param\n * encoder, so they round-trip instead of needing a refusal.\n * Extracted so `validateRoutePath` stays within the cognitive-complexity budget.\n */\nfunction validateUniqueParamNames(\n  urlParams: readonly string[],\n  routeName: string,\n  methodName: string,\n  path: string,\n): void {\n  const seen = new Set<string>();\n\n  for (const name of urlParams) {\n    if (seen.has(name)) {\n      throw createRouterError(\n        methodName,\n        `Invalid path for route \"${routeName}\": duplicate parameter name ':${name}' in \"${path}\" (a param name must be unique within a route — the second binding would overwrite the first)`,\n      );\n    }\n\n    seen.add(name);\n  }\n}\n\n/**\n * #1242 §5.1/§5.3: rejects a malformed query-param declaration — a query name\n * carrying `<`/`>` (`/a?fil<ter` — a `<` in a plain query tail; never round-trips),\n * or one that collides with a path-param name (`/a/:tab?tab`, where buildPath emits\n * the value twice). Narrow to `<>`: a `=` in the declaration (`?tab=1`, §5.2) is\n * tolerated today and left as a separate call. (Under M1 a reverse-order typo\n * `/a/:b?<c>` is caught earlier as optional-removed — the `?<` keeps it in the\n * path, §3.3.) path-matcher's `registerTree` backstops both; this gate adds the\n * route-contextual message.\n */\nfunction validateQueryParamDeclarations(\n  queryParams: readonly string[],\n  routeName: string,\n  methodName: string,\n  path: string,\n): void {\n  // A path/query name collision (`/a/:tab?tab`) is legal under M2: `tab` lives\n  // in both `state.params` and `state.search` as separate channels (RFC-4 M2 /\n  // #1548), so the former \"declared as both\" rejection is gone. Only a query\n  // name that can never round-trip (contains `<`/`>`) is still rejected.\n  for (const name of queryParams) {\n    if (INVALID_QUERY_NAME_RGX.test(name)) {\n      throw createRouterError(\n        methodName,\n        `Invalid path for route \"${routeName}\": invalid query-param name \"${name}\" in \"${path}\" (a query-param name cannot contain '<' or '>' — it would never round-trip; rename the query param)`,\n      );\n    }\n  }\n}\n\n/**\n * Reports whether a path has a raw non-ASCII code point (≥ U+0080) in a STATIC\n * segment (`/café`, `/меню`, #1154). match rejects any non-ASCII input byte\n * (`#scanPath`) and compares static trie keys raw, so such a route registers but\n * is unmatchable — `buildPath` emits `/café`, which its own `match` rejects. Only\n * static text is flagged: a marker-led segment (`:café`, a non-ASCII param NAME)\n * is skipped. A `for…of` code-point scan tracking segment start. Runs AFTER the\n * removed-form / grammar rejections, so no `<`/`>` (a former constraint) can\n * reach it — the 3-token grammar has no constraint body to skip (M1, #1516).\n */\nfunction hasNonAsciiStatic(path: string): boolean {\n  let atSegmentStart = true;\n  let segmentIsMarker = false;\n\n  for (const char of path) {\n    if (char === \"/\") {\n      atSegmentStart = true;\n\n      continue;\n    }\n\n    if (atSegmentStart) {\n      segmentIsMarker = char === \":\" || char === \"*\";\n      atSegmentStart = false;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- non-empty code point from for-of\n    if (!segmentIsMarker && char.codePointAt(0)! >= 0x80) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Maps a SURVIVING per-segment grammar error code (from `findSegmentGrammarError`)\n * to the gate's route-contextual message. The removed-form codes (`optional-removed`\n * / `constraint-removed`) are NOT handled here — they carry a richer replacement\n * recipe built by `removedFormMessage` from `describeRemovedForm`.\n */\nfunction gateGrammarMessage(\n  code: Exclude<SegmentErrorCode, \"optional-removed\" | \"constraint-removed\">,\n  routeName: string,\n  path: string,\n): string {\n  switch (code) {\n    case \"name-less\":\n    case \"trailing-marker\": {\n      return `Invalid path for route \"${routeName}\": parameter marker (':' or '*') without a name in \"${path}\"`;\n    }\n    case \"fused-marker\": {\n      return `Invalid path for route \"${routeName}\": parameter marker (':' or '*') must begin a segment, but \"${path}\" fuses one to a static prefix (use a boundary marker like \"/a/:b\")`;\n    }\n  }\n}\n\n/**\n * Builds the route-contextual replacement recipe for a removed form (M1) — the\n * RICH tier (the matcher backstop uses a shorter, path-free recipe). For an\n * optional it names the offending segment and the two concrete sibling paths that\n * replace it (computed from the actual path by `describeRemovedForm`); for a\n * constraint it names the offending segment and points to a guard.\n */\nfunction removedFormMessage(removed: RemovedForm, routeName: string): string {\n  if (removed.code === \"optional-removed\") {\n    return `Invalid path for route \"${routeName}\": optional params are not supported — \"${removed.segment}\". Declare two sibling routes instead: \"${removed.withoutSegment}\" and \"${removed.requiredForm}\" (the route hierarchy already expresses optionality)`;\n  }\n\n  return `Invalid path for route \"${routeName}\": regex constraints are not supported — '<' and '>' are reserved in path segments (\"${removed.segment}\"). Match the segment as a plain string and validate the value in a guard (canActivate) or app code`;\n}\n\n/**\n * Validates route path format.\n * Throws a descriptive error if validation fails.\n *\n * Allows:\n * - Empty string (for grouping/root routes)\n * - Absolute paths: /path, ~path\n * - Query strings: ?query\n * - Relative segments: segment\n *\n * Prevents:\n * - Non-string values\n * - Double slashes (//)\n * - Absolute paths (~) under parameterized parent nodes\n *\n * @param path - Route path to validate\n * @param routeName - Name of route (for error messages)\n * @param methodName - Name of calling method for error messages\n * @param parentNode - Optional parent node for context validation\n * @throws {TypeError} If path is invalid\n *\n * @example\n * // Valid paths\n * validateRoutePath(\"\", \"home\", \"add\");              // ok (empty for grouping)\n * validateRoutePath(\"/users\", \"users\", \"add\");       // ok (absolute)\n * validateRoutePath(\"~dashboard\", \"dash\", \"add\");    // ok (absolute, if no parameterized parent)\n * validateRoutePath(\"?tab=1\", \"home\", \"add\");        // ok (query)\n * validateRoutePath(\"profile\", \"users.profile\", \"add\"); // ok (relative)\n *\n * @example\n * // Invalid paths (throws)\n * validateRoutePath(\"/users//list\", \"users.list\", \"add\");           // throws (double slash)\n * validateRoutePath(\"~dash\", \"dash\", \"add\", paramParent);           // throws (~ under parameterized parent)\n */\n// A format-validation gate: a flat sequence of INDEPENDENT guard clauses (type,\n// whitespace, format, double-slash, dup-param, query-decl, the M1 removed-form\n// recipe, surviving grammar markers (name-less / fused / trailing), non-ASCII\n// static, absolute-under-param). Each is a simple early throw; extracting them\n// would only scatter one checklist.\n\nexport function validateRoutePath(\n  path: unknown,\n  routeName: string,\n  methodName: string,\n  parentNode?: RouteTree,\n): asserts path is string {\n  // Type check\n  if (typeof path !== \"string\") {\n    // Get type description for error message\n    let typeDesc: string;\n\n    if (path === null) {\n      typeDesc = \"null\";\n    } else if (Array.isArray(path)) {\n      typeDesc = \"array\";\n    } else {\n      typeDesc = typeof path;\n    }\n\n    throw createRouterError(\n      methodName,\n      `Route path must be a string, got ${typeDesc}`,\n    );\n  }\n\n  // Empty path is valid (for grouping/root)\n  if (path === \"\") {\n    return;\n  }\n\n  // No whitespace characters (spaces, tabs, newlines)\n  if (/\\s/.test(path)) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": whitespace not allowed in \"${path}\"`,\n    );\n  }\n\n  // Valid path pattern\n  if (!/^([/?~]|[^/]+$)/.test(path)) {\n    throw createRouterError(\n      methodName,\n      `Route \"${routeName}\" has invalid path format: \"${path}\". Path should start with '/', '~', '?' or be a relative segment.`,\n    );\n  }\n\n  // No double slashes\n  if (path.includes(\"//\")) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": double slashes not allowed in \"${path}\"`,\n    );\n  }\n\n  // The grammar checks below scan only the URL-path portion: `buildParamMeta`\n  // strips the query the same way the trie does, so a `:`/`*` inside a query\n  // declaration is not falsely flagged. (`buildParamMeta` is total — the 3-token\n  // grammar has no constraint body to compile, so it never throws — M1, #1516.)\n  const { pathPattern, urlParams, queryParams } = buildParamMeta(path);\n\n  // Duplicate param name within this route's own path (`/:id/:id`, `/:x/*x`, #1151).\n  validateUniqueParamNames(urlParams, routeName, methodName, path);\n\n  // Malformed query-param declarations (#1242 §5.1): a query name with `<>`\n  // (never round-trips). Name collisions with a path param are legal under M2\n  // (separate params/search channels, #1548).\n  validateQueryParamDeclarations(queryParams, routeName, methodName, path);\n\n  // Removed-form (M1) rejection first — a `:x?` optional or a `<re>` constraint —\n  // with the RICH route-contextual replacement recipe (the offending segment plus,\n  // for an optional, the two computed sibling paths). Returns undefined when the\n  // path's first grammar error is a SURVIVING code, so the fall-through below runs.\n  const removed = describeRemovedForm(pathPattern);\n\n  if (removed !== undefined) {\n    throw createRouterError(methodName, removedFormMessage(removed, routeName));\n  }\n\n  // Surviving per-segment grammar rejections via the canonical `parseSegment`\n  // tokenizer: name-less (#858/#863), fused-marker (#1050), trailing-marker\n  // (#1324). `findSegmentGrammarError` runs the same split+parse the matcher uses,\n  // so the gate cannot drift. (Only removed-form codes reach `removed` above; the\n  // first error here is therefore always a surviving code.)\n  const grammarError = findSegmentGrammarError(pathPattern);\n\n  if (grammarError !== undefined) {\n    throw createRouterError(\n      methodName,\n      gateGrammarMessage(\n        grammarError as Exclude<\n          SegmentErrorCode,\n          \"optional-removed\" | \"constraint-removed\"\n        >,\n        routeName,\n        path,\n      ),\n    );\n  }\n\n  // Raw non-ASCII in a STATIC segment (`/café`, `/меню`, #1154). match rejects\n  // non-ASCII input and compares static keys raw, so the route registers but never\n  // matches. Reject with the percent-encode workaround (path-matcher backstops at\n  // `registerTree`); a non-ASCII param NAME or constraint body is unaffected.\n  if (hasNonAsciiStatic(pathPattern)) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": non-ASCII static segment in \"${path}\" — match compares static segments raw and rejects non-ASCII input, so this route would never match. Percent-encode it (e.g. '/caf%C3%A9') or use a param`,\n    );\n  }\n\n  // Absolute paths under parameterized parents\n  // Check if parent has URL parameters via paramTypeMap\n  const hasUrlParams = parentNode && parentNode.paramMeta.urlParams.length > 0;\n\n  if (path.startsWith(\"~\") && hasUrlParams) {\n    throw createRouterError(\n      methodName,\n      `Absolute path \"${path}\" cannot be used under parent route with URL parameters`,\n    );\n  }\n}\n","/**\n * Batch route validation utilities.\n *\n * Provides validation for adding routes with cross-batch duplicate detection.\n * Used by router.addRoute() to ensure atomicity - all routes validated before any modification.\n */\n\nimport {\n  assertNoDottedRouteName,\n  assertRouteNameMatchesPattern,\n  assertRouteNameNotEmpty,\n  assertRouteNameNotWhitespaceOnly,\n  assertRouteNameWithinLength,\n} from \"./route-name\";\nimport { validateRoutePath } from \"./routes\";\n\nimport type { RouteDefinition, RouteTree } from \"../types\";\n\n/**\n * Intrinsics captured at module load: `getOwnPropertyDescriptor`, `objectKeys`, `getPrototypeOf`.\n *\n * ⚑ A guard is only as strong as the intrinsic it reads WHEN IT RUNS, and an\n * application can re-point any of these AFTER boot — which is what this closes.\n * Measured on the uncaptured form: one naive `Object.hasOwn` polyfill walked\n * straight through five sibling readers while the single captured guard held.\n *\n * ⚠ It does NOT close a shim evaluated BEFORE this module — the ordinary\n * polyfill order. Measured: a naive `Object.hasOwn` imported ahead of core\n * reproduces #1798 verbatim (`buildPath` prints the native method into the\n * URL). Two earlier revisions of this header said \"before any application\n * code can run\", which is the sentence a future reader would have trusted.\n */\nconst getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;\nconst objectKeys = Object.keys;\nconst getPrototypeOf = Object.getPrototypeOf;\n\n/**\n * Gets a human-readable description of a value's type.\n * Used for error messages to provide helpful debugging information.\n */\nfunction getTypeDescription(value: unknown): string {\n  // Handle null explicitly (typeof null === \"object\")\n  if (value === null) {\n    return \"null\";\n  }\n\n  if (typeof value === \"object\") {\n    // Read `constructor`/`.name` defensively: an adversarial own `constructor`\n    // (null, a string, a number, …) is not a real constructor and must not crash\n    // here nor yield a non-string (#903); a THROWING accessor — a `constructor`\n    // getter, a function constructor with a throwing `.name` getter, or a Proxy\n    // that throws on [[Get]] — must not crash either (#1052). Both fall back to\n    // \"object\". (Byte-identical twin of type-guards' getTypeDescription —\n    // route-tree has no type-guards dependency, so the hardening is duplicated.)\n    try {\n      const ctor: unknown = (value as { constructor?: unknown }).constructor;\n\n      // Return constructor name for class instances\n      if (typeof ctor === \"function\" && ctor.name !== \"Object\") {\n        return ctor.name || \"object\"; // empty name (anonymous class) → \"object\"\n      }\n    } catch {\n      // Throwing constructor/.name getter or Proxy [[Get]] → fall through (#1052).\n    }\n\n    // Plain object\n    return \"object\";\n  }\n\n  // Primitive types (string, number, boolean, undefined, etc.)\n  return typeof value;\n}\n\n/**\n * Checks if an object has getters or setters.\n * Used to detect potentially malicious route objects that could mutate during processing.\n *\n * @param obj - Object to check\n * @returns true if object has getters or setters\n */\nfunction hasGettersOrSetters(obj: Record<string, unknown>): boolean {\n  for (const key of objectKeys(obj)) {\n    const descriptor = getOwnPropertyDescriptor(obj, key);\n\n    if (descriptor && (descriptor.get || descriptor.set)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Validates that route is a plain object without getters/setters.\n * Prevents malicious objects that could mutate during processing.\n *\n * @param route - Route to validate\n * @param methodName - Calling method for error context\n * @throws {TypeError} If route is not a plain object\n */\nfunction validateRouteType(\n  route: unknown,\n  methodName: string,\n): asserts route is Record<string, unknown> {\n  if (!route || typeof route !== \"object\") {\n    throw new TypeError(\n      `[router.${methodName}] Route must be an object, got ${getTypeDescription(route)}`,\n    );\n  }\n\n  // Check for plain object (prototype must be Object.prototype or null)\n  const proto: object | null = getPrototypeOf(route) as object | null;\n\n  if (proto !== Object.prototype && proto !== null) {\n    throw new TypeError(\n      `[router.${methodName}] Route must be a plain object, got ${getTypeDescription(route)}`,\n    );\n  }\n\n  // Check for getters/setters (could cause mutations during processing)\n  if (hasGettersOrSetters(route as Record<string, unknown>)) {\n    throw new TypeError(\n      `[router.${methodName}] Route must not have getters or setters`,\n    );\n  }\n}\n\n/**\n * Validates that encodeParams is a function if provided.\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If encodeParams is not a function\n */\nfunction validateEncodeParams(\n  route: Record<string, unknown>,\n  methodName: string,\n): void {\n  if (\n    route.encodeParams !== undefined &&\n    typeof route.encodeParams !== \"function\"\n  ) {\n    throw new TypeError(\n      `[router.${methodName}] Route \"${String(route.name)}\" encodeParams must be a function`,\n    );\n  }\n}\n\n/**\n * Validates that decodeParams is a function if provided.\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If decodeParams is not a function\n */\nfunction validateDecodeParams(\n  route: Record<string, unknown>,\n  methodName: string,\n): void {\n  if (\n    route.decodeParams !== undefined &&\n    typeof route.decodeParams !== \"function\"\n  ) {\n    throw new TypeError(\n      `[router.${methodName}] Route \"${String(route.name)}\" decodeParams must be a function`,\n    );\n  }\n}\n\n/**\n * Validates that route name is a valid string matching the expected format.\n *\n * Route name rules:\n * - Must be a string\n * - Cannot be empty or whitespace-only\n * - Cannot contain dots (use children array or { parent } option instead)\n * - Must match [a-zA-Z_][a-zA-Z0-9_-]*\n *\n * ⚠ The string check stays inline rather than joining `./route-name`: core\n * carries two wordings for it — this one reports `getTypeDescription`, and\n * `assertNoInternalRouteName` reports bare `typeof` to mirror the plugin — so\n * sharing one predicate would change a message rather than move it.\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If name is missing, not a string, or invalid format\n */\nfunction validateRouteName(\n  route: Record<string, unknown>,\n  methodName: string,\n): asserts route is Record<string, unknown> & { name: string } {\n  if (typeof route.name !== \"string\") {\n    throw new TypeError(\n      `[router.${methodName}] Route name must be a string, got ${getTypeDescription(route.name)}`,\n    );\n  }\n\n  const name = route.name;\n\n  assertRouteNameNotEmpty(name, methodName);\n  assertRouteNameNotWhitespaceOnly(name, methodName);\n  assertRouteNameWithinLength(name, methodName);\n\n  // System routes bypass the spelling rules (e.g., @@router/UNKNOWN_ROUTE).\n  if (name.startsWith(\"@@\")) {\n    return;\n  }\n\n  assertNoDottedRouteName(name, methodName);\n  assertRouteNameMatchesPattern(name, methodName);\n}\n\n/**\n * Finds a node by its fullName in the tree.\n * Even though user-provided route names cannot contain dots,\n * fullName is computed during validation (e.g., \"parent.child\").\n *\n * @param rootNode - Root node to start from\n * @param fullName - Full route name (e.g., \"users.profile\")\n * @returns The resolved node, or undefined if not found\n */\nfunction findNodeByFullName(\n  rootNode: RouteTree,\n  fullName: string,\n): RouteTree | undefined {\n  // Fast path: single-segment names don't need splitting\n  // Stryker disable next-line ConditionalExpression,StringLiteral,BlockStatement: equivalent — the fast path is a pure optimization; for a dotless name the general path below yields the identical result (`name.split(\".\")` → `[name]`, a one-iteration `children.get(name)`). (BooleanLiteral stays live: dropping the `!` runs the fast path for a dotted name → `children.get(\"a.b\")` is undefined = killed.)\n  if (!fullName.includes(\".\")) {\n    return rootNode.children.get(fullName);\n  }\n\n  let current: RouteTree | undefined = rootNode;\n\n  for (const segment of fullName.split(\".\")) {\n    current = current.children.get(segment);\n\n    if (!current) {\n      return undefined;\n    }\n  }\n\n  return current;\n}\n\n/**\n * Checks for duplicate route name in existing tree.\n *\n * @param rootNode - Root node to search in\n * @param fullName - Full route name (dot-notation)\n * @param methodName - Calling method for error context\n * @throws {Error} If route name already exists\n */\nfunction checkTreeNameDuplicate(\n  rootNode: RouteTree,\n  fullName: string,\n  methodName: string,\n): void {\n  if (findNodeByFullName(rootNode, fullName)) {\n    throw new Error(\n      `[router.${methodName}] Route \"${fullName}\" already exists`,\n    );\n  }\n}\n\n/**\n * Checks for duplicate route name in current batch.\n *\n * @param seenNames - Set of names already seen in batch\n * @param fullName - Full route name to check\n * @param methodName - Calling method for error context\n * @throws {Error} If duplicate name in batch\n */\nfunction checkBatchNameDuplicate(\n  seenNames: Set<string>,\n  fullName: string,\n  methodName: string,\n): void {\n  if (seenNames.has(fullName)) {\n    throw new Error(\n      `[router.${methodName}] Duplicate route \"${fullName}\" in batch`,\n    );\n  }\n\n  seenNames.add(fullName);\n}\n\n/**\n * Checks for duplicate path in existing tree at same parent level.\n *\n * @param rootNode - Root node to search in\n * @param parentName - Parent route name (empty string for root level)\n * @param routePath - Path to check for duplicates\n * @throws {Error} If path already exists at this level\n */\nfunction checkTreePathDuplicate(\n  rootNode: RouteTree,\n  parentName: string,\n  routePath: string,\n  methodName: string,\n): void {\n  const parentNode =\n    parentName === \"\" ? rootNode : findNodeByFullName(rootNode, parentName);\n\n  if (!parentNode) {\n    return; // Parent doesn't exist, so no duplicate\n  }\n\n  for (const child of parentNode.children.values()) {\n    if (child.path === routePath) {\n      throw new Error(\n        `[router.${methodName}] Path \"${routePath}\" is already defined`,\n      );\n    }\n  }\n}\n\n/**\n * Checks for duplicate path in current batch at same parent level.\n *\n * @param seenPathsByParent - Map of paths by parent name\n * @param parentName - Parent route name (empty string for root level)\n * @param routePath - Path to check for duplicates\n * @throws {Error} If path already exists at this level in batch\n */\nfunction checkBatchPathDuplicate(\n  seenPathsByParent: Map<string, Set<string>>,\n  parentName: string,\n  routePath: string,\n  methodName: string,\n): void {\n  const pathsAtLevel = seenPathsByParent.get(parentName);\n\n  if (pathsAtLevel?.has(routePath)) {\n    throw new Error(\n      `[router.${methodName}] Path \"${routePath}\" is already defined`,\n    );\n  }\n\n  if (pathsAtLevel) {\n    pathsAtLevel.add(routePath);\n  } else {\n    seenPathsByParent.set(parentName, new Set([routePath]));\n  }\n}\n\n/**\n * Validates route structure for add operations.\n *\n * Performs comprehensive validation including:\n * - Type check (must be object)\n * - Name validation\n * - Path validation\n * - Duplicate name detection (in tree and batch)\n * - Duplicate path detection (in tree and batch)\n * - Recursive children validation\n *\n * @param route - Route to validate\n * @param methodName - Calling method for error context\n * @param rootNode - Optional root node for duplicate checking\n * @param parentName - Parent route name for building full path (used in recursion)\n * @param seenNames - Set of names already seen in this batch\n * @param seenPathsByParent - Map of paths by parent for path duplicate detection\n * @throws {TypeError} If route structure is invalid\n * @throws {Error} If route already exists (duplicate)\n * @throws {Error} If path already defined (duplicate)\n *\n * @example\n * ```typescript\n * const seenNames = new Set<string>();\n * const seenPaths = new Map<string, Set<string>>();\n *\n * // Validate routes before adding\n * for (const route of routes) {\n *   validateRoute(route, \"add\", rootNode, \"\", seenNames, seenPaths);\n * }\n * ```\n */\nexport function validateRoute(\n  route: unknown,\n  methodName: string,\n  rootNode?: RouteTree,\n  parentName = \"\",\n  seenNames?: Set<string>,\n  seenPathsByParent?: Map<string, Set<string>>,\n): asserts route is RouteDefinition {\n  validateRouteType(route, methodName);\n\n  const routeDef = route;\n\n  // Validate that name is a non-empty string\n  validateRouteName(routeDef, methodName);\n\n  // Validate path structure\n  validateRoutePath(routeDef.path, routeDef.name, methodName, rootNode);\n\n  // Validate optional function properties\n  validateEncodeParams(routeDef, methodName);\n  validateDecodeParams(routeDef, methodName);\n\n  const routeName = routeDef.name;\n  const fullName = parentName ? `${parentName}.${routeName}` : routeName;\n\n  // Check for duplicate name in existing tree\n  if (rootNode && fullName) {\n    checkTreeNameDuplicate(rootNode, fullName, methodName);\n  }\n\n  // Check for duplicate name in current batch\n  if (seenNames) {\n    checkBatchNameDuplicate(seenNames, fullName, methodName);\n  }\n\n  const routePath = routeDef.path;\n  const pathCheckParent = parentName;\n\n  // Check for duplicate path in existing tree\n  if (rootNode) {\n    checkTreePathDuplicate(rootNode, pathCheckParent, routePath, methodName);\n  }\n\n  // Check for duplicate path in current batch\n  if (seenPathsByParent) {\n    checkBatchPathDuplicate(\n      seenPathsByParent,\n      pathCheckParent,\n      routePath,\n      methodName,\n    );\n  }\n\n  // Validate children recursively\n  if (routeDef.children !== undefined) {\n    if (!Array.isArray(routeDef.children)) {\n      throw new TypeError(\n        `[router.${methodName}] Route \"${routeName}\" children must be an array, got ${getTypeDescription(routeDef.children)}`,\n      );\n    }\n\n    for (const child of routeDef.children) {\n      validateRoute(\n        child,\n        methodName,\n        rootNode,\n        fullName,\n        seenNames,\n        seenPathsByParent,\n      );\n    }\n  }\n}\n"],"mappings":"+GAkBA,SAAS,EAAkB,EAAoB,EAA4B,CACzE,OAAW,UAAU,WAAW,EAAW,IAAI,GAAS,CAC1D,CA4BA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EAAO,IAAI,IAEjB,IAAK,IAAM,KAAQ,EAAW,CAC5B,GAAI,EAAK,IAAI,CAAI,EACf,MAAM,EACJ,EACA,2BAA2B,EAAU,gCAAgC,EAAK,QAAQ,EAAK,8FACzF,EAGF,EAAK,IAAI,CAAI,CACf,CACF,CAYA,SAAS,EACP,EACA,EACA,EACA,EACM,CAKN,IAAK,IAAM,KAAQ,EACjB,GAAIA,EAAAA,EAAuB,KAAK,CAAI,EAClC,MAAM,EACJ,EACA,2BAA2B,EAAU,+BAA+B,EAAK,QAAQ,EAAK,qGACxF,CAGN,CAYA,SAAS,EAAkB,EAAuB,CAChD,IAAI,EAAiB,GACjB,EAAkB,GAEtB,IAAK,IAAM,KAAQ,EAAM,CACvB,GAAI,IAAS,IAAK,CAChB,EAAiB,GAEjB,QACF,CAQA,GANA,AAEE,KADA,EAAkB,IAAS,KAAO,IAAS,IAC1B,IAIf,CAAC,GAAmB,EAAK,YAAY,CAAC,GAAM,IAC9C,MAAO,EAEX,CAEA,MAAO,EACT,CAQA,SAAS,EACP,EACA,EACA,EACQ,CACR,OAAQ,EAAR,CACE,IAAK,YACL,IAAK,kBACH,MAAO,2BAA2B,EAAU,sDAAsD,EAAK,GAEzG,IAAK,eACH,MAAO,2BAA2B,EAAU,8DAA8D,EAAK,oEAEnH,CACF,CASA,SAAS,EAAmB,EAAsB,EAA2B,CAK3E,OAJI,EAAQ,OAAS,mBACZ,2BAA2B,EAAU,0CAA0C,EAAQ,QAAQ,0CAA0C,EAAQ,eAAe,SAAS,EAAQ,aAAa,uDAGhM,2BAA2B,EAAU,uFAAuF,EAAQ,QAAQ,oGACrJ,CA0CA,SAAgB,EACd,EACA,EACA,EACA,EACwB,CAExB,GAAI,OAAO,GAAS,SAAU,CAE5B,IAAI,EAUJ,KARA,CAKE,EALE,IAAS,KACA,OACF,MAAM,QAAQ,CAAI,EAChB,QAEA,OAAO,EAGd,EACJ,EACA,oCAAoC,GACtC,CACF,CAGA,GAAI,IAAS,GACX,OAIF,GAAI,KAAK,KAAK,CAAI,EAChB,MAAM,EACJ,EACA,2BAA2B,EAAU,gCAAgC,EAAK,EAC5E,EAIF,GAAI,CAAC,kBAAkB,KAAK,CAAI,EAC9B,MAAM,EACJ,EACA,UAAU,EAAU,8BAA8B,EAAK,kEACzD,EAIF,GAAI,EAAK,SAAS,IAAI,EACpB,MAAM,EACJ,EACA,2BAA2B,EAAU,oCAAoC,EAAK,EAChF,EAOF,GAAM,CAAE,cAAa,YAAW,eAAgBC,EAAAA,EAAe,CAAI,EAGnE,EAAyB,EAAW,EAAW,EAAY,CAAI,EAK/D,EAA+B,EAAa,EAAW,EAAY,CAAI,EAMvE,IAAM,EAAUC,EAAAA,EAAoB,CAAW,EAE/C,GAAI,IAAY,IAAA,GACd,MAAM,EAAkB,EAAY,EAAmB,EAAS,CAAS,CAAC,EAQ5E,IAAM,EAAeC,EAAAA,EAAwB,CAAW,EAExD,GAAI,IAAiB,IAAA,GACnB,MAAM,EACJ,EACA,EACE,EAIA,EACA,CACF,CACF,EAOF,GAAI,EAAkB,CAAW,EAC/B,MAAM,EACJ,EACA,2BAA2B,EAAU,kCAAkC,EAAK,0JAC9E,EAKF,IAAM,EAAe,GAAc,EAAW,UAAU,UAAU,OAAS,EAE3E,GAAI,EAAK,WAAW,GAAG,GAAK,EAC1B,MAAM,EACJ,EACA,kBAAkB,EAAK,wDACzB,CAEJ,CC1SA,MAAM,EAA2B,OAAO,yBAClC,EAAa,OAAO,KACpB,EAAiB,OAAO,eAM9B,SAAS,EAAmB,EAAwB,CAElD,GAAI,IAAU,KACZ,MAAO,OAGT,GAAI,OAAO,GAAU,SAAU,CAQ7B,GAAI,CACF,IAAM,EAAiB,EAAoC,YAG3D,GAAI,OAAO,GAAS,YAAc,EAAK,OAAS,SAC9C,OAAO,EAAK,MAAQ,QAExB,MAAQ,CAER,CAGA,MAAO,QACT,CAGA,OAAO,OAAO,CAChB,CASA,SAAS,EAAoB,EAAuC,CAClE,IAAK,IAAM,KAAO,EAAW,CAAG,EAAG,CACjC,IAAM,EAAa,EAAyB,EAAK,CAAG,EAEpD,GAAI,IAAe,EAAW,KAAO,EAAW,KAC9C,MAAO,EAEX,CAEA,MAAO,EACT,CAUA,SAAS,EACP,EACA,EAC0C,CAC1C,GAAI,CAAC,GAAS,OAAO,GAAU,SAC7B,MAAU,UACR,WAAW,EAAW,iCAAiC,EAAmB,CAAK,GACjF,EAIF,IAAM,EAAuB,EAAe,CAAK,EAEjD,GAAI,IAAU,OAAO,WAAa,IAAU,KAC1C,MAAU,UACR,WAAW,EAAW,sCAAsC,EAAmB,CAAK,GACtF,EAIF,GAAI,EAAoB,CAAgC,EACtD,MAAU,UACR,WAAW,EAAW,yCACxB,CAEJ,CASA,SAAS,EACP,EACA,EACM,CACN,GACE,EAAM,eAAiB,IAAA,IACvB,OAAO,EAAM,cAAiB,WAE9B,MAAU,UACR,WAAW,EAAW,WAAW,OAAO,EAAM,IAAI,EAAE,kCACtD,CAEJ,CASA,SAAS,EACP,EACA,EACM,CACN,GACE,EAAM,eAAiB,IAAA,IACvB,OAAO,EAAM,cAAiB,WAE9B,MAAU,UACR,WAAW,EAAW,WAAW,OAAO,EAAM,IAAI,EAAE,kCACtD,CAEJ,CAoBA,SAAS,EACP,EACA,EAC6D,CAC7D,GAAI,OAAO,EAAM,MAAS,SACxB,MAAU,UACR,WAAW,EAAW,qCAAqC,EAAmB,EAAM,IAAI,GAC1F,EAGF,IAAM,EAAO,EAAM,KAEnB,EAAA,EAAwB,EAAM,CAAU,EACxC,EAAA,EAAiC,EAAM,CAAU,EACjD,EAAA,EAA4B,EAAM,CAAU,EAGxC,GAAK,WAAW,IAAI,IAIxB,EAAA,EAAwB,EAAM,CAAU,EACxC,EAAA,EAA8B,EAAM,CAAU,EAChD,CAWA,SAAS,EACP,EACA,EACuB,CAGvB,GAAI,CAAC,EAAS,SAAS,GAAG,EACxB,OAAO,EAAS,SAAS,IAAI,CAAQ,EAGvC,IAAI,EAAiC,EAErC,IAAK,IAAM,KAAW,EAAS,MAAM,GAAG,EAGtC,GAFA,EAAU,EAAQ,SAAS,IAAI,CAAO,EAElC,CAAC,EACH,OAIJ,OAAO,CACT,CAUA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,EAAmB,EAAU,CAAQ,EACvC,MAAU,MACR,WAAW,EAAW,WAAW,EAAS,iBAC5C,CAEJ,CAUA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,EAAU,IAAI,CAAQ,EACxB,MAAU,MACR,WAAW,EAAW,qBAAqB,EAAS,WACtD,EAGF,EAAU,IAAI,CAAQ,CACxB,CAUA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EACJ,IAAe,GAAK,EAAW,EAAmB,EAAU,CAAU,EAEnE,KAIL,KAAK,IAAM,KAAS,EAAW,SAAS,OAAO,EAC7C,GAAI,EAAM,OAAS,EACjB,MAAU,MACR,WAAW,EAAW,UAAU,EAAU,qBAC5C,CAAA,CAGN,CAUA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EAAe,EAAkB,IAAI,CAAU,EAErD,GAAI,GAAc,IAAI,CAAS,EAC7B,MAAU,MACR,WAAW,EAAW,UAAU,EAAU,qBAC5C,EAGE,EACF,EAAa,IAAI,CAAS,EAE1B,EAAkB,IAAI,EAAY,IAAI,IAAI,CAAC,CAAS,CAAC,CAAC,CAE1D,CAkCA,SAAgB,EACd,EACA,EACA,EACA,EAAa,GACb,EACA,EACkC,CAClC,EAAkB,EAAO,CAAU,EAEnC,IAAM,EAAW,EAGjB,EAAkB,EAAU,CAAU,EAGtC,EAAkB,EAAS,KAAM,EAAS,KAAM,EAAY,CAAQ,EAGpE,EAAqB,EAAU,CAAU,EACzC,EAAqB,EAAU,CAAU,EAEzC,IAAM,EAAY,EAAS,KACrB,EAAW,EAAa,GAAG,EAAW,GAAG,IAAc,EAGzD,GAAY,GACd,EAAuB,EAAU,EAAU,CAAU,EAInD,GACF,EAAwB,EAAW,EAAU,CAAU,EAGzD,IAAM,EAAY,EAAS,KACrB,EAAkB,EAkBxB,GAfI,GACF,EAAuB,EAAU,EAAiB,EAAW,CAAU,EAIrE,GACF,EACE,EACA,EACA,EACA,CACF,EAIE,EAAS,WAAa,IAAA,GAAW,CACnC,GAAI,CAAC,MAAM,QAAQ,EAAS,QAAQ,EAClC,MAAU,UACR,WAAW,EAAW,WAAW,EAAU,mCAAmC,EAAmB,EAAS,QAAQ,GACpH,EAGF,IAAK,IAAM,KAAS,EAAS,SAC3B,EACE,EACA,EACA,EACA,EACA,EACA,CACF,CAEJ,CACF"}
+{"version":3,"file":"validation.js","names":["INVALID_QUERY_NAME_RGX","buildParamMeta","describeRemovedForm","findSegmentGrammarError"],"sources":["../../src/engine/validation/routes.ts","../../src/engine/validation/route-batch.ts"],"sourcesContent":["import {\n  buildParamMeta,\n  describeRemovedForm,\n  findSegmentGrammarError,\n  INVALID_QUERY_NAME_RGX,\n} from \"../path-matcher\";\n\nimport type { RemovedForm, SegmentErrorCode } from \"../path-matcher\";\nimport type { RouteTree } from \"../types\";\n\n/**\n * Creates a TypeError with consistent router error message format.\n *\n * @param methodName - Name of the method that triggered the error\n * @param message - Error message\n * @returns TypeError with formatted message\n * @internal\n */\nfunction createRouterError(methodName: string, message: string): TypeError {\n  return new TypeError(`[router.${methodName}] ${message}`);\n}\n\n/**\n * Rejects a param name repeated within one route's own path (`/:id/:id`, a\n * param+splat clash `/:x/*x`, #1151). `buildParamMeta.urlParams` lists every\n * path-binding name — params AND splats — in order, keeping duplicates (`/:x/*x`\n * → `[\"x\", \"x\"]`), so a single pass over it catches both. The trie binds the\n * duplicates at different positions under one name, so match's later capture\n * silently overwrites the earlier and `rewritePathOnMatch` then rewrites the\n * user's URL from the single survivor. The #736 conflict guard only fires on\n * DIFFERENTLY-named params at one position, so this same-name case slips through.\n * path-matcher's `registerTree` backstop additionally catches CROSS-level dups (a\n * parent's param reused by a child), which this per-path gate cannot see. ⚠ With\n * a hole, stated as its CAUSE rather than as a list of shapes, because the list\n * is longer than it looks: that backstop reads the names off `buildParamSlots`,\n * and #1568's finality rule drops a NON-final splat before it becomes a slot.\n * So the rule is about FINALITY, not about levels: **a collision is admitted iff\n * one of the colliding bindings is a NON-final splat.** Measured, 8/8 — admitted:\n * `/p/*x/:x`, `/p/*x/*x`, and the cross-level `*`+`:` and `*`+`*` (an ancestor's\n * marker is never final, since a descendant path follows it); refused:\n * `/p/:x/*x`, `/z/:x/:x`, and the cross-level `:`+`*` and `:`+`:`. The same cause\n * opens a door at the ROOT, which is an ancestor like any other:\n * `setRootPath(\"/app/:x\")` + a route `/:x/e` throws, `setRootPath(\"/app/*x\")` +\n * the same route registers. Nothing is bound twice in any of them (the dropped\n * splat binds nothing), and since #1975 the surviving `:x` takes the param\n * encoder, so they round-trip instead of needing a refusal.\n * Extracted so `validateRoutePath` stays within the cognitive-complexity budget.\n */\nfunction validateUniqueParamNames(\n  urlParams: readonly string[],\n  routeName: string,\n  methodName: string,\n  path: string,\n): void {\n  const seen = new Set<string>();\n\n  for (const name of urlParams) {\n    if (seen.has(name)) {\n      throw createRouterError(\n        methodName,\n        `Invalid path for route \"${routeName}\": duplicate parameter name ':${name}' in \"${path}\" (a param name must be unique within a route — the second binding would overwrite the first)`,\n      );\n    }\n\n    seen.add(name);\n  }\n}\n\n/**\n * #1242 §5.1/§5.3: rejects a malformed query-param declaration — a query name\n * carrying `<`/`>` (`/a?fil<ter` — a `<` in a plain query tail; never round-trips),\n * or one that collides with a path-param name (`/a/:tab?tab`, where buildPath emits\n * the value twice). Narrow to `<>`: a `=` in the declaration (`?tab=1`, §5.2) is\n * tolerated today and left as a separate call. (Under M1 a reverse-order typo\n * `/a/:b?<c>` is caught earlier as optional-removed — the `?<` keeps it in the\n * path, §3.3.) path-matcher's `registerTree` backstops both; this gate adds the\n * route-contextual message.\n */\nfunction validateQueryParamDeclarations(\n  queryParams: readonly string[],\n  routeName: string,\n  methodName: string,\n  path: string,\n): void {\n  // A path/query name collision (`/a/:tab?tab`) is legal under M2: `tab` lives\n  // in both `state.params` and `state.search` as separate channels (RFC-4 M2 /\n  // #1548), so the former \"declared as both\" rejection is gone. Only a query\n  // name that can never round-trip (contains `<`/`>`) is still rejected.\n  for (const name of queryParams) {\n    if (INVALID_QUERY_NAME_RGX.test(name)) {\n      throw createRouterError(\n        methodName,\n        `Invalid path for route \"${routeName}\": invalid query-param name \"${name}\" in \"${path}\" (a query-param name cannot contain '<' or '>' — it would never round-trip; rename the query param)`,\n      );\n    }\n  }\n}\n\n/**\n * Reports whether a path has a raw non-ASCII code point (≥ U+0080) in a STATIC\n * segment (`/café`, `/меню`, #1154). match rejects any non-ASCII input byte\n * (`#scanPath`) and compares static trie keys raw, so such a route registers but\n * is unmatchable — `buildPath` emits `/café`, which its own `match` rejects. Only\n * static text is flagged: a marker-led segment (`:café`, a non-ASCII param NAME)\n * is skipped. A `for…of` code-point scan tracking segment start. Runs AFTER the\n * removed-form / grammar rejections, so no `<`/`>` (a former constraint) can\n * reach it — the 3-token grammar has no constraint body to skip (M1, #1516).\n */\nfunction hasNonAsciiStatic(path: string): boolean {\n  let atSegmentStart = true;\n  let segmentIsMarker = false;\n\n  for (const char of path) {\n    if (char === \"/\") {\n      atSegmentStart = true;\n\n      continue;\n    }\n\n    if (atSegmentStart) {\n      segmentIsMarker = char === \":\" || char === \"*\";\n      atSegmentStart = false;\n    }\n\n    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- non-empty code point from for-of\n    if (!segmentIsMarker && char.codePointAt(0)! >= 0x80) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Maps a SURVIVING per-segment grammar error code (from `findSegmentGrammarError`)\n * to the gate's route-contextual message. The removed-form codes (`optional-removed`\n * / `constraint-removed`) are NOT handled here — they carry a richer replacement\n * recipe built by `removedFormMessage` from `describeRemovedForm`.\n */\nfunction gateGrammarMessage(\n  code: Exclude<SegmentErrorCode, \"optional-removed\" | \"constraint-removed\">,\n  routeName: string,\n  path: string,\n): string {\n  switch (code) {\n    case \"name-less\":\n    case \"trailing-marker\": {\n      return `Invalid path for route \"${routeName}\": parameter marker (':' or '*') without a name in \"${path}\"`;\n    }\n    case \"fused-marker\": {\n      return `Invalid path for route \"${routeName}\": parameter marker (':' or '*') must begin a segment, but \"${path}\" fuses one to a static prefix (use a boundary marker like \"/a/:b\")`;\n    }\n  }\n}\n\n/**\n * Builds the route-contextual replacement recipe for a removed form (M1) — the\n * RICH tier (the matcher backstop uses a shorter, path-free recipe). For an\n * optional it names the offending segment and the two concrete sibling paths that\n * replace it (computed from the actual path by `describeRemovedForm`); for a\n * constraint it names the offending segment and points to a guard.\n */\nfunction removedFormMessage(removed: RemovedForm, routeName: string): string {\n  if (removed.code === \"optional-removed\") {\n    return `Invalid path for route \"${routeName}\": optional params are not supported — \"${removed.segment}\". Declare two sibling routes instead: \"${removed.withoutSegment}\" and \"${removed.requiredForm}\" (the route hierarchy already expresses optionality)`;\n  }\n\n  return `Invalid path for route \"${routeName}\": regex constraints are not supported — '<' and '>' are reserved in path segments (\"${removed.segment}\"). Match the segment as a plain string and validate the value in a guard (canActivate) or app code`;\n}\n\n/**\n * Validates route path format.\n * Throws a descriptive error if validation fails.\n *\n * Allows:\n * - Empty string (for grouping/root routes)\n * - Absolute paths: /path, ~path\n * - Query strings: ?query\n * - Relative segments: segment\n *\n * Prevents:\n * - Non-string values\n * - Double slashes (//)\n * - Absolute paths (~) under parameterized parent nodes\n *\n * @param path - Route path to validate\n * @param routeName - Name of route (for error messages)\n * @param methodName - Name of calling method for error messages\n * @param parentNode - Optional parent node for context validation\n * @throws {TypeError} If path is invalid\n *\n * @example\n * // Valid paths\n * validateRoutePath(\"\", \"home\", \"add\");              // ok (empty for grouping)\n * validateRoutePath(\"/users\", \"users\", \"add\");       // ok (absolute)\n * validateRoutePath(\"~dashboard\", \"dash\", \"add\");    // ok (absolute, if no parameterized parent)\n * validateRoutePath(\"?tab=1\", \"home\", \"add\");        // ok (query)\n * validateRoutePath(\"profile\", \"users.profile\", \"add\"); // ok (relative)\n *\n * @example\n * // Invalid paths (throws)\n * validateRoutePath(\"/users//list\", \"users.list\", \"add\");           // throws (double slash)\n * validateRoutePath(\"~dash\", \"dash\", \"add\", paramParent);           // throws (~ under parameterized parent)\n */\n// A format-validation gate: a flat sequence of INDEPENDENT guard clauses (type,\n// whitespace, format, double-slash, dup-param, query-decl, the M1 removed-form\n// recipe, surviving grammar markers (name-less / fused / trailing), non-ASCII\n// static, absolute-under-param). Each is a simple early throw; extracting them\n// would only scatter one checklist.\n\nexport function validateRoutePath(\n  path: unknown,\n  routeName: string,\n  methodName: string,\n  parentNode?: RouteTree,\n): asserts path is string {\n  // Type check\n  if (typeof path !== \"string\") {\n    // Get type description for error message\n    let typeDesc: string;\n\n    if (path === null) {\n      typeDesc = \"null\";\n    } else if (Array.isArray(path)) {\n      typeDesc = \"array\";\n    } else {\n      typeDesc = typeof path;\n    }\n\n    throw createRouterError(\n      methodName,\n      `Route path must be a string, got ${typeDesc}`,\n    );\n  }\n\n  // Empty path is valid (for grouping/root)\n  if (path === \"\") {\n    return;\n  }\n\n  // No whitespace characters (spaces, tabs, newlines)\n  if (/\\s/.test(path)) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": whitespace not allowed in \"${path}\"`,\n    );\n  }\n\n  // Valid path pattern\n  if (!/^([/?~]|[^/]+$)/.test(path)) {\n    throw createRouterError(\n      methodName,\n      `Route \"${routeName}\" has invalid path format: \"${path}\". Path should start with '/', '~', '?' or be a relative segment.`,\n    );\n  }\n\n  // No double slashes\n  if (path.includes(\"//\")) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": double slashes not allowed in \"${path}\"`,\n    );\n  }\n\n  // The grammar checks below scan only the URL-path portion: `buildParamMeta`\n  // strips the query the same way the trie does, so a `:`/`*` inside a query\n  // declaration is not falsely flagged. (`buildParamMeta` is total — the 3-token\n  // grammar has no constraint body to compile, so it never throws — M1, #1516.)\n  const { pathPattern, urlParams, queryParams } = buildParamMeta(path);\n\n  // Duplicate param name within this route's own path (`/:id/:id`, `/:x/*x`, #1151).\n  validateUniqueParamNames(urlParams, routeName, methodName, path);\n\n  // Malformed query-param declarations (#1242 §5.1): a query name with `<>`\n  // (never round-trips). Name collisions with a path param are legal under M2\n  // (separate params/search channels, #1548).\n  validateQueryParamDeclarations(queryParams, routeName, methodName, path);\n\n  // Removed-form (M1) rejection first — a `:x?` optional or a `<re>` constraint —\n  // with the RICH route-contextual replacement recipe (the offending segment plus,\n  // for an optional, the two computed sibling paths). Returns undefined when the\n  // path's first grammar error is a SURVIVING code, so the fall-through below runs.\n  const removed = describeRemovedForm(pathPattern);\n\n  if (removed !== undefined) {\n    throw createRouterError(methodName, removedFormMessage(removed, routeName));\n  }\n\n  // Surviving per-segment grammar rejections via the canonical `parseSegment`\n  // tokenizer: name-less (#858/#863), fused-marker (#1050), trailing-marker\n  // (#1324). `findSegmentGrammarError` runs the same split+parse the matcher uses,\n  // so the gate cannot drift. (Only removed-form codes reach `removed` above; the\n  // first error here is therefore always a surviving code.)\n  const grammarError = findSegmentGrammarError(pathPattern);\n\n  if (grammarError !== undefined) {\n    throw createRouterError(\n      methodName,\n      gateGrammarMessage(\n        grammarError as Exclude<\n          SegmentErrorCode,\n          \"optional-removed\" | \"constraint-removed\"\n        >,\n        routeName,\n        path,\n      ),\n    );\n  }\n\n  // Raw non-ASCII in a STATIC segment (`/café`, `/меню`, #1154). match rejects\n  // non-ASCII input and compares static keys raw, so the route registers but never\n  // matches. Reject with the percent-encode workaround (path-matcher backstops at\n  // `registerTree`); a non-ASCII param NAME or constraint body is unaffected.\n  if (hasNonAsciiStatic(pathPattern)) {\n    throw createRouterError(\n      methodName,\n      `Invalid path for route \"${routeName}\": non-ASCII static segment in \"${path}\" — match compares static segments raw and rejects non-ASCII input, so this route would never match. Percent-encode it (e.g. '/caf%C3%A9') or use a param`,\n    );\n  }\n\n  // Absolute paths under parameterized parents\n  // Check if parent has URL parameters via paramTypeMap\n  const hasUrlParams = parentNode && parentNode.paramMeta.urlParams.length > 0;\n\n  if (path.startsWith(\"~\") && hasUrlParams) {\n    throw createRouterError(\n      methodName,\n      `Absolute path \"${path}\" cannot be used under parent route with URL parameters`,\n    );\n  }\n}\n","/**\n * Batch route validation utilities.\n *\n * Provides validation for adding routes with cross-batch duplicate detection.\n * Used by router.addRoute() to ensure atomicity - all routes validated before any modification.\n */\n\nimport {\n  assertNoDottedRouteName,\n  assertRouteNameMatchesPattern,\n  assertRouteNameNotEmpty,\n  assertRouteNameNotWhitespaceOnly,\n  assertRouteNameWithinLength,\n} from \"./route-name\";\nimport { validateRoutePath } from \"./routes\";\n\nimport type { RouteDefinition, RouteTree } from \"../types\";\n\n/**\n * Intrinsics captured at module load: `getOwnPropertyDescriptor`, `objectKeys`, `getPrototypeOf`.\n *\n * ⚑ A guard is only as strong as the intrinsic it reads WHEN IT RUNS, and an\n * application can re-point any of these AFTER boot — which is what this closes.\n * Measured on the uncaptured form: one naive `Object.hasOwn` polyfill walked\n * straight through five sibling readers while the single captured guard held.\n *\n * ⚠ It does NOT close a shim evaluated BEFORE this module — the ordinary\n * polyfill order. Measured: a naive `Object.hasOwn` imported ahead of core\n * reproduces #1798 verbatim (`buildPath` prints the native method into the\n * URL).\n */\nconst getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;\nconst objectKeys = Object.keys;\nconst getPrototypeOf = Object.getPrototypeOf;\n\n/**\n * Gets a human-readable description of a value's type.\n * Used for error messages to provide helpful debugging information.\n */\nfunction getTypeDescription(value: unknown): string {\n  // Handle null explicitly (typeof null === \"object\")\n  if (value === null) {\n    return \"null\";\n  }\n\n  if (typeof value === \"object\") {\n    // Read `constructor`/`.name` defensively: an adversarial own `constructor`\n    // (null, a string, a number, …) is not a real constructor and must not crash\n    // here nor yield a non-string (#903); a THROWING accessor — a `constructor`\n    // getter, a function constructor with a throwing `.name` getter, or a Proxy\n    // that throws on [[Get]] — must not crash either (#1052). Both fall back to\n    // \"object\". (Byte-identical twin of type-guards' getTypeDescription —\n    // route-tree has no type-guards dependency, so the hardening is duplicated.)\n    try {\n      const ctor: unknown = (value as { constructor?: unknown }).constructor;\n\n      // Return constructor name for class instances\n      if (typeof ctor === \"function\" && ctor.name !== \"Object\") {\n        return ctor.name || \"object\"; // empty name (anonymous class) → \"object\"\n      }\n    } catch {\n      // Throwing constructor/.name getter or Proxy [[Get]] → fall through (#1052).\n    }\n\n    // Plain object\n    return \"object\";\n  }\n\n  // Primitive types (string, number, boolean, undefined, etc.)\n  return typeof value;\n}\n\n/**\n * Checks if an object has getters or setters.\n * Used to detect potentially malicious route objects that could mutate during processing.\n *\n * @param obj - Object to check\n * @returns true if object has getters or setters\n */\nfunction hasGettersOrSetters(obj: Record<string, unknown>): boolean {\n  for (const key of objectKeys(obj)) {\n    const descriptor = getOwnPropertyDescriptor(obj, key);\n\n    if (descriptor && (descriptor.get || descriptor.set)) {\n      return true;\n    }\n  }\n\n  return false;\n}\n\n/**\n * Validates that route is a plain object without getters/setters.\n * Prevents malicious objects that could mutate during processing.\n *\n * @param route - Route to validate\n * @param methodName - Calling method for error context\n * @throws {TypeError} If route is not a plain object\n */\nfunction validateRouteType(\n  route: unknown,\n  methodName: string,\n): asserts route is Record<string, unknown> {\n  if (!route || typeof route !== \"object\") {\n    throw new TypeError(\n      `[router.${methodName}] Route must be an object, got ${getTypeDescription(route)}`,\n    );\n  }\n\n  // Check for plain object (prototype must be Object.prototype or null)\n  const proto: object | null = getPrototypeOf(route) as object | null;\n\n  if (proto !== Object.prototype && proto !== null) {\n    throw new TypeError(\n      `[router.${methodName}] Route must be a plain object, got ${getTypeDescription(route)}`,\n    );\n  }\n\n  // Check for getters/setters (could cause mutations during processing)\n  if (hasGettersOrSetters(route as Record<string, unknown>)) {\n    throw new TypeError(\n      `[router.${methodName}] Route must not have getters or setters`,\n    );\n  }\n}\n\n/**\n * Validates that encodeParams is a function if provided.\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If encodeParams is not a function\n */\nfunction validateEncodeParams(\n  route: Record<string, unknown>,\n  methodName: string,\n): void {\n  if (\n    route.encodeParams !== undefined &&\n    typeof route.encodeParams !== \"function\"\n  ) {\n    throw new TypeError(\n      `[router.${methodName}] Route \"${String(route.name)}\" encodeParams must be a function`,\n    );\n  }\n}\n\n/**\n * Validates that decodeParams is a function if provided.\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If decodeParams is not a function\n */\nfunction validateDecodeParams(\n  route: Record<string, unknown>,\n  methodName: string,\n): void {\n  if (\n    route.decodeParams !== undefined &&\n    typeof route.decodeParams !== \"function\"\n  ) {\n    throw new TypeError(\n      `[router.${methodName}] Route \"${String(route.name)}\" decodeParams must be a function`,\n    );\n  }\n}\n\n/**\n * Validates that route name is a valid string matching the expected format.\n *\n * Route name rules:\n * - Must be a string\n * - Cannot be empty or whitespace-only\n * - Cannot contain dots (use children array or { parent } option instead)\n * - Must match [a-zA-Z_][a-zA-Z0-9_-]*\n *\n * ⚠ The string check stays inline rather than joining `./route-name`: core\n * carries two wordings for it — this one reports `getTypeDescription`, and\n * `assertNoInternalRouteName` reports bare `typeof` to mirror the plugin — so\n * sharing one predicate would change a message rather than move it.\n *\n * @param route - Route configuration\n * @param methodName - Calling method for error context\n * @throws {TypeError} If name is missing, not a string, or invalid format\n */\nfunction validateRouteName(\n  route: Record<string, unknown>,\n  methodName: string,\n): asserts route is Record<string, unknown> & { name: string } {\n  if (typeof route.name !== \"string\") {\n    throw new TypeError(\n      `[router.${methodName}] Route name must be a string, got ${getTypeDescription(route.name)}`,\n    );\n  }\n\n  const name = route.name;\n\n  assertRouteNameNotEmpty(name, methodName);\n  assertRouteNameNotWhitespaceOnly(name, methodName);\n  assertRouteNameWithinLength(name, methodName);\n\n  // System routes bypass the spelling rules (e.g., @@router/UNKNOWN_ROUTE).\n  if (name.startsWith(\"@@\")) {\n    return;\n  }\n\n  assertNoDottedRouteName(name, methodName);\n  assertRouteNameMatchesPattern(name, methodName);\n}\n\n/**\n * Finds a node by its fullName in the tree.\n * Even though user-provided route names cannot contain dots,\n * fullName is computed during validation (e.g., \"parent.child\").\n *\n * @param rootNode - Root node to start from\n * @param fullName - Full route name (e.g., \"users.profile\")\n * @returns The resolved node, or undefined if not found\n */\nfunction findNodeByFullName(\n  rootNode: RouteTree,\n  fullName: string,\n): RouteTree | undefined {\n  // Fast path: single-segment names don't need splitting\n  // Stryker disable next-line ConditionalExpression,StringLiteral,BlockStatement: equivalent — the fast path is a pure optimization; for a dotless name the general path below yields the identical result (`name.split(\".\")` → `[name]`, a one-iteration `children.get(name)`). (BooleanLiteral stays live: dropping the `!` runs the fast path for a dotted name → `children.get(\"a.b\")` is undefined = killed.)\n  if (!fullName.includes(\".\")) {\n    return rootNode.children.get(fullName);\n  }\n\n  let current: RouteTree | undefined = rootNode;\n\n  for (const segment of fullName.split(\".\")) {\n    current = current.children.get(segment);\n\n    if (!current) {\n      return undefined;\n    }\n  }\n\n  return current;\n}\n\n/**\n * Checks for duplicate route name in existing tree.\n *\n * @param rootNode - Root node to search in\n * @param fullName - Full route name (dot-notation)\n * @param methodName - Calling method for error context\n * @throws {Error} If route name already exists\n */\nfunction checkTreeNameDuplicate(\n  rootNode: RouteTree,\n  fullName: string,\n  methodName: string,\n): void {\n  if (findNodeByFullName(rootNode, fullName)) {\n    throw new Error(\n      `[router.${methodName}] Route \"${fullName}\" already exists`,\n    );\n  }\n}\n\n/**\n * Checks for duplicate route name in current batch.\n *\n * @param seenNames - Set of names already seen in batch\n * @param fullName - Full route name to check\n * @param methodName - Calling method for error context\n * @throws {Error} If duplicate name in batch\n */\nfunction checkBatchNameDuplicate(\n  seenNames: Set<string>,\n  fullName: string,\n  methodName: string,\n): void {\n  if (seenNames.has(fullName)) {\n    throw new Error(\n      `[router.${methodName}] Duplicate route \"${fullName}\" in batch`,\n    );\n  }\n\n  seenNames.add(fullName);\n}\n\n/**\n * Checks for duplicate path in existing tree at same parent level.\n *\n * @param rootNode - Root node to search in\n * @param parentName - Parent route name (empty string for root level)\n * @param routePath - Path to check for duplicates\n * @throws {Error} If path already exists at this level\n */\nfunction checkTreePathDuplicate(\n  rootNode: RouteTree,\n  parentName: string,\n  routePath: string,\n  methodName: string,\n): void {\n  const parentNode =\n    parentName === \"\" ? rootNode : findNodeByFullName(rootNode, parentName);\n\n  if (!parentNode) {\n    return; // Parent doesn't exist, so no duplicate\n  }\n\n  for (const child of parentNode.children.values()) {\n    if (child.path === routePath) {\n      throw new Error(\n        `[router.${methodName}] Path \"${routePath}\" is already defined`,\n      );\n    }\n  }\n}\n\n/**\n * Checks for duplicate path in current batch at same parent level.\n *\n * @param seenPathsByParent - Map of paths by parent name\n * @param parentName - Parent route name (empty string for root level)\n * @param routePath - Path to check for duplicates\n * @throws {Error} If path already exists at this level in batch\n */\nfunction checkBatchPathDuplicate(\n  seenPathsByParent: Map<string, Set<string>>,\n  parentName: string,\n  routePath: string,\n  methodName: string,\n): void {\n  const pathsAtLevel = seenPathsByParent.get(parentName);\n\n  if (pathsAtLevel?.has(routePath)) {\n    throw new Error(\n      `[router.${methodName}] Path \"${routePath}\" is already defined`,\n    );\n  }\n\n  if (pathsAtLevel) {\n    pathsAtLevel.add(routePath);\n  } else {\n    seenPathsByParent.set(parentName, new Set([routePath]));\n  }\n}\n\n/**\n * Validates route structure for add operations.\n *\n * Performs comprehensive validation including:\n * - Type check (must be object)\n * - Name validation\n * - Path validation\n * - Duplicate name detection (in tree and batch)\n * - Duplicate path detection (in tree and batch)\n * - Recursive children validation\n *\n * @param route - Route to validate\n * @param methodName - Calling method for error context\n * @param rootNode - Optional root node for duplicate checking\n * @param parentName - Parent route name for building full path (used in recursion)\n * @param seenNames - Set of names already seen in this batch\n * @param seenPathsByParent - Map of paths by parent for path duplicate detection\n * @throws {TypeError} If route structure is invalid\n * @throws {Error} If route already exists (duplicate)\n * @throws {Error} If path already defined (duplicate)\n *\n * @example\n * ```typescript\n * const seenNames = new Set<string>();\n * const seenPaths = new Map<string, Set<string>>();\n *\n * // Validate routes before adding\n * for (const route of routes) {\n *   validateRoute(route, \"add\", rootNode, \"\", seenNames, seenPaths);\n * }\n * ```\n */\nexport function validateRoute(\n  route: unknown,\n  methodName: string,\n  rootNode?: RouteTree,\n  parentName = \"\",\n  seenNames?: Set<string>,\n  seenPathsByParent?: Map<string, Set<string>>,\n): asserts route is RouteDefinition {\n  validateRouteType(route, methodName);\n\n  const routeDef = route;\n\n  // Validate that name is a non-empty string\n  validateRouteName(routeDef, methodName);\n\n  // Validate path structure\n  validateRoutePath(routeDef.path, routeDef.name, methodName, rootNode);\n\n  // Validate optional function properties\n  validateEncodeParams(routeDef, methodName);\n  validateDecodeParams(routeDef, methodName);\n\n  const routeName = routeDef.name;\n  const fullName = parentName ? `${parentName}.${routeName}` : routeName;\n\n  // Check for duplicate name in existing tree\n  if (rootNode && fullName) {\n    checkTreeNameDuplicate(rootNode, fullName, methodName);\n  }\n\n  // Check for duplicate name in current batch\n  if (seenNames) {\n    checkBatchNameDuplicate(seenNames, fullName, methodName);\n  }\n\n  const routePath = routeDef.path;\n  const pathCheckParent = parentName;\n\n  // Check for duplicate path in existing tree\n  if (rootNode) {\n    checkTreePathDuplicate(rootNode, pathCheckParent, routePath, methodName);\n  }\n\n  // Check for duplicate path in current batch\n  if (seenPathsByParent) {\n    checkBatchPathDuplicate(\n      seenPathsByParent,\n      pathCheckParent,\n      routePath,\n      methodName,\n    );\n  }\n\n  // Validate children recursively\n  if (routeDef.children !== undefined) {\n    if (!Array.isArray(routeDef.children)) {\n      throw new TypeError(\n        `[router.${methodName}] Route \"${routeName}\" children must be an array, got ${getTypeDescription(routeDef.children)}`,\n      );\n    }\n\n    for (const child of routeDef.children) {\n      validateRoute(\n        child,\n        methodName,\n        rootNode,\n        fullName,\n        seenNames,\n        seenPathsByParent,\n      );\n    }\n  }\n}\n"],"mappings":"+GAkBA,SAAS,EAAkB,EAAoB,EAA4B,CACzE,OAAW,UAAU,WAAW,EAAW,IAAI,GAAS,CAC1D,CA4BA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EAAO,IAAI,IAEjB,IAAK,IAAM,KAAQ,EAAW,CAC5B,GAAI,EAAK,IAAI,CAAI,EACf,MAAM,EACJ,EACA,2BAA2B,EAAU,gCAAgC,EAAK,QAAQ,EAAK,8FACzF,EAGF,EAAK,IAAI,CAAI,CACf,CACF,CAYA,SAAS,EACP,EACA,EACA,EACA,EACM,CAKN,IAAK,IAAM,KAAQ,EACjB,GAAIA,EAAAA,EAAuB,KAAK,CAAI,EAClC,MAAM,EACJ,EACA,2BAA2B,EAAU,+BAA+B,EAAK,QAAQ,EAAK,qGACxF,CAGN,CAYA,SAAS,EAAkB,EAAuB,CAChD,IAAI,EAAiB,GACjB,EAAkB,GAEtB,IAAK,IAAM,KAAQ,EAAM,CACvB,GAAI,IAAS,IAAK,CAChB,EAAiB,GAEjB,QACF,CAQA,GANA,AAEE,KADA,EAAkB,IAAS,KAAO,IAAS,IAC1B,IAIf,CAAC,GAAmB,EAAK,YAAY,CAAC,GAAM,IAC9C,MAAO,EAEX,CAEA,MAAO,EACT,CAQA,SAAS,EACP,EACA,EACA,EACQ,CACR,OAAQ,EAAR,CACE,IAAK,YACL,IAAK,kBACH,MAAO,2BAA2B,EAAU,sDAAsD,EAAK,GAEzG,IAAK,eACH,MAAO,2BAA2B,EAAU,8DAA8D,EAAK,oEAEnH,CACF,CASA,SAAS,EAAmB,EAAsB,EAA2B,CAK3E,OAJI,EAAQ,OAAS,mBACZ,2BAA2B,EAAU,0CAA0C,EAAQ,QAAQ,0CAA0C,EAAQ,eAAe,SAAS,EAAQ,aAAa,uDAGhM,2BAA2B,EAAU,uFAAuF,EAAQ,QAAQ,oGACrJ,CA0CA,SAAgB,EACd,EACA,EACA,EACA,EACwB,CAExB,GAAI,OAAO,GAAS,SAAU,CAE5B,IAAI,EAUJ,KARA,CAKE,EALE,IAAS,KACA,OACF,MAAM,QAAQ,CAAI,EAChB,QAEA,OAAO,EAGd,EACJ,EACA,oCAAoC,GACtC,CACF,CAGA,GAAI,IAAS,GACX,OAIF,GAAI,KAAK,KAAK,CAAI,EAChB,MAAM,EACJ,EACA,2BAA2B,EAAU,gCAAgC,EAAK,EAC5E,EAIF,GAAI,CAAC,kBAAkB,KAAK,CAAI,EAC9B,MAAM,EACJ,EACA,UAAU,EAAU,8BAA8B,EAAK,kEACzD,EAIF,GAAI,EAAK,SAAS,IAAI,EACpB,MAAM,EACJ,EACA,2BAA2B,EAAU,oCAAoC,EAAK,EAChF,EAOF,GAAM,CAAE,cAAa,YAAW,eAAgBC,EAAAA,EAAe,CAAI,EAGnE,EAAyB,EAAW,EAAW,EAAY,CAAI,EAK/D,EAA+B,EAAa,EAAW,EAAY,CAAI,EAMvE,IAAM,EAAUC,EAAAA,EAAoB,CAAW,EAE/C,GAAI,IAAY,IAAA,GACd,MAAM,EAAkB,EAAY,EAAmB,EAAS,CAAS,CAAC,EAQ5E,IAAM,EAAeC,EAAAA,EAAwB,CAAW,EAExD,GAAI,IAAiB,IAAA,GACnB,MAAM,EACJ,EACA,EACE,EAIA,EACA,CACF,CACF,EAOF,GAAI,EAAkB,CAAW,EAC/B,MAAM,EACJ,EACA,2BAA2B,EAAU,kCAAkC,EAAK,0JAC9E,EAKF,IAAM,EAAe,GAAc,EAAW,UAAU,UAAU,OAAS,EAE3E,GAAI,EAAK,WAAW,GAAG,GAAK,EAC1B,MAAM,EACJ,EACA,kBAAkB,EAAK,wDACzB,CAEJ,CC3SA,MAAM,EAA2B,OAAO,yBAClC,EAAa,OAAO,KACpB,EAAiB,OAAO,eAM9B,SAAS,EAAmB,EAAwB,CAElD,GAAI,IAAU,KACZ,MAAO,OAGT,GAAI,OAAO,GAAU,SAAU,CAQ7B,GAAI,CACF,IAAM,EAAiB,EAAoC,YAG3D,GAAI,OAAO,GAAS,YAAc,EAAK,OAAS,SAC9C,OAAO,EAAK,MAAQ,QAExB,MAAQ,CAER,CAGA,MAAO,QACT,CAGA,OAAO,OAAO,CAChB,CASA,SAAS,EAAoB,EAAuC,CAClE,IAAK,IAAM,KAAO,EAAW,CAAG,EAAG,CACjC,IAAM,EAAa,EAAyB,EAAK,CAAG,EAEpD,GAAI,IAAe,EAAW,KAAO,EAAW,KAC9C,MAAO,EAEX,CAEA,MAAO,EACT,CAUA,SAAS,EACP,EACA,EAC0C,CAC1C,GAAI,CAAC,GAAS,OAAO,GAAU,SAC7B,MAAU,UACR,WAAW,EAAW,iCAAiC,EAAmB,CAAK,GACjF,EAIF,IAAM,EAAuB,EAAe,CAAK,EAEjD,GAAI,IAAU,OAAO,WAAa,IAAU,KAC1C,MAAU,UACR,WAAW,EAAW,sCAAsC,EAAmB,CAAK,GACtF,EAIF,GAAI,EAAoB,CAAgC,EACtD,MAAU,UACR,WAAW,EAAW,yCACxB,CAEJ,CASA,SAAS,EACP,EACA,EACM,CACN,GACE,EAAM,eAAiB,IAAA,IACvB,OAAO,EAAM,cAAiB,WAE9B,MAAU,UACR,WAAW,EAAW,WAAW,OAAO,EAAM,IAAI,EAAE,kCACtD,CAEJ,CASA,SAAS,EACP,EACA,EACM,CACN,GACE,EAAM,eAAiB,IAAA,IACvB,OAAO,EAAM,cAAiB,WAE9B,MAAU,UACR,WAAW,EAAW,WAAW,OAAO,EAAM,IAAI,EAAE,kCACtD,CAEJ,CAoBA,SAAS,EACP,EACA,EAC6D,CAC7D,GAAI,OAAO,EAAM,MAAS,SACxB,MAAU,UACR,WAAW,EAAW,qCAAqC,EAAmB,EAAM,IAAI,GAC1F,EAGF,IAAM,EAAO,EAAM,KAEnB,EAAA,EAAwB,EAAM,CAAU,EACxC,EAAA,EAAiC,EAAM,CAAU,EACjD,EAAA,EAA4B,EAAM,CAAU,EAGxC,GAAK,WAAW,IAAI,IAIxB,EAAA,EAAwB,EAAM,CAAU,EACxC,EAAA,EAA8B,EAAM,CAAU,EAChD,CAWA,SAAS,EACP,EACA,EACuB,CAGvB,GAAI,CAAC,EAAS,SAAS,GAAG,EACxB,OAAO,EAAS,SAAS,IAAI,CAAQ,EAGvC,IAAI,EAAiC,EAErC,IAAK,IAAM,KAAW,EAAS,MAAM,GAAG,EAGtC,GAFA,EAAU,EAAQ,SAAS,IAAI,CAAO,EAElC,CAAC,EACH,OAIJ,OAAO,CACT,CAUA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,EAAmB,EAAU,CAAQ,EACvC,MAAU,MACR,WAAW,EAAW,WAAW,EAAS,iBAC5C,CAEJ,CAUA,SAAS,EACP,EACA,EACA,EACM,CACN,GAAI,EAAU,IAAI,CAAQ,EACxB,MAAU,MACR,WAAW,EAAW,qBAAqB,EAAS,WACtD,EAGF,EAAU,IAAI,CAAQ,CACxB,CAUA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EACJ,IAAe,GAAK,EAAW,EAAmB,EAAU,CAAU,EAEnE,KAIL,KAAK,IAAM,KAAS,EAAW,SAAS,OAAO,EAC7C,GAAI,EAAM,OAAS,EACjB,MAAU,MACR,WAAW,EAAW,UAAU,EAAU,qBAC5C,CAAA,CAGN,CAUA,SAAS,EACP,EACA,EACA,EACA,EACM,CACN,IAAM,EAAe,EAAkB,IAAI,CAAU,EAErD,GAAI,GAAc,IAAI,CAAS,EAC7B,MAAU,MACR,WAAW,EAAW,UAAU,EAAU,qBAC5C,EAGE,EACF,EAAa,IAAI,CAAS,EAE1B,EAAkB,IAAI,EAAY,IAAI,IAAI,CAAC,CAAS,CAAC,CAAC,CAE1D,CAkCA,SAAgB,EACd,EACA,EACA,EACA,EAAa,GACb,EACA,EACkC,CAClC,EAAkB,EAAO,CAAU,EAEnC,IAAM,EAAW,EAGjB,EAAkB,EAAU,CAAU,EAGtC,EAAkB,EAAS,KAAM,EAAS,KAAM,EAAY,CAAQ,EAGpE,EAAqB,EAAU,CAAU,EACzC,EAAqB,EAAU,CAAU,EAEzC,IAAM,EAAY,EAAS,KACrB,EAAW,EAAa,GAAG,EAAW,GAAG,IAAc,EAGzD,GAAY,GACd,EAAuB,EAAU,EAAU,CAAU,EAInD,GACF,EAAwB,EAAW,EAAU,CAAU,EAGzD,IAAM,EAAY,EAAS,KACrB,EAAkB,EAkBxB,GAfI,GACF,EAAuB,EAAU,EAAiB,EAAW,CAAU,EAIrE,GACF,EACE,EACA,EACA,EACA,CACF,EAIE,EAAS,WAAa,IAAA,GAAW,CACnC,GAAI,CAAC,MAAM,QAAQ,EAAS,QAAQ,EAClC,MAAU,UACR,WAAW,EAAW,WAAW,EAAU,mCAAmC,EAAmB,EAAS,QAAQ,GACpH,EAGF,IAAK,IAAM,KAAS,EAAS,SAC3B,EACE,EACA,EACA,EACA,EACA,EACA,CACF,CAEJ,CACF"}