@real-router/core 0.126.6 → 0.126.8

package/dist/cjs/index.js

@@ -1,2 +1,2 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./ingest-C6HQ7xXf.js"),t=require("./Router-ChxUQY0x.js"),n=require("./RouterError-DCVsSNgX.js"),r=(e=[],n={},r={})=>new t.t(e,n,r),i=Object.freeze,a=new WeakMap,o=e=>{let t=a.get(e);return t||(t=i({navigate:e.navigate,getState:e.getState,isActiveRoute:e.isActiveRoute,canNavigateTo:e.canNavigateTo,subscribe:e.subscribe,subscribeLeave:e.subscribeLeave,isLeaveApproved:e.isLeaveApproved}),a.set(e,t)),t};exports.Router=t.t,exports.RouterError=n.t,exports.UNKNOWN_ROUTE=e.d,exports.constants=e.p,exports.createRouter=r,exports.errorCodes=e.m,exports.events=e.h,exports.getNavigator=o,exports.resolveForwardChain=t.y;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./ingest-C6HQ7xXf.js"),t=require("./Router-C6aK-Oax.js"),n=require("./RouterError-DCVsSNgX.js"),r=(e=[],n={},r={})=>new t.t(e,n,r),i=Object.freeze,a=new WeakMap,o=e=>{let t=a.get(e);return t||(t=i({navigate:e.navigate,getState:e.getState,isActiveRoute:e.isActiveRoute,canNavigateTo:e.canNavigateTo,subscribe:e.subscribe,subscribeLeave:e.subscribeLeave,isLeaveApproved:e.isLeaveApproved}),a.set(e,t)),t};exports.Router=t.t,exports.RouterError=n.t,exports.UNKNOWN_ROUTE=e.d,exports.constants=e.p,exports.createRouter=r,exports.errorCodes=e.m,exports.events=e.h,exports.getNavigator=o,exports.resolveForwardChain=t.y;
 //# sourceMappingURL=index.js.map

package/dist/cjs/ingest-C6HQ7xXf.js.map

@@ -1 +1 @@
-{"version":3,"file":"ingest-C6HQ7xXf.js","names":[],"sources":["../../src/constants.ts","../../src/utils/ingest.ts"],"sourcesContent":["// packages/core/src/constants.ts\n\nimport type {\n  EventToNameMap,\n  EventToPluginMap,\n  ErrorCodeToValueMap,\n  ErrorCodeKeys,\n  ErrorCodeValues,\n  TransitionMeta,\n} from \"./types\";\n\nexport type ConstantsKeys = \"UNKNOWN_ROUTE\";\n\nexport type Constants = Readonly<Record<ConstantsKeys, string>>;\n\n// =============================================================================\n// Error Codes (migrated from router-error)\n// =============================================================================\n\nexport type ErrorCodes = Record<ErrorCodeKeys, ErrorCodeValues>;\n\n/**\n * Error codes for router operations.\n * Used to identify specific failure scenarios in navigation and lifecycle.\n * Frozen to prevent accidental modifications.\n */\nexport const errorCodes: ErrorCodeToValueMap = Object.freeze({\n  ROUTER_NOT_STARTED: \"NOT_STARTED\", // navigate() called before start()\n  NO_START_PATH_OR_STATE: \"NO_START_PATH_OR_STATE\", // start() without initial route\n  ROUTER_ALREADY_STARTED: \"ALREADY_STARTED\", // start() called twice\n  ROUTE_NOT_FOUND: \"ROUTE_NOT_FOUND\", // Navigation to non-existent route\n  SAME_STATES: \"SAME_STATES\", // Navigate to current route without reload\n  CANNOT_DEACTIVATE: \"CANNOT_DEACTIVATE\", // canDeactivate guard blocked navigation\n  CANNOT_ACTIVATE: \"CANNOT_ACTIVATE\", // canActivate guard blocked navigation\n  TRANSITION_ERR: \"TRANSITION_ERR\", // Generic transition failure\n  TRANSITION_CANCELLED: \"CANCELLED\", // Navigation cancelled by user or new navigation\n  ROUTER_DISPOSED: \"DISPOSED\", // Router has been disposed\n  PLUGIN_CONFLICT: \"PLUGIN_CONFLICT\", // Plugin tried to extend router with already-existing property\n  CONTEXT_NAMESPACE_ALREADY_CLAIMED: \"CONTEXT_NAMESPACE_ALREADY_CLAIMED\", // Plugin tried to claim a context namespace already owned by another plugin\n  REENTRANT_NAVIGATION: \"REENTRANT_NAVIGATION\", // navigate() called synchronously from inside a transition-event listener (banned — use await/async listener)\n  REENTRANT_TREE_MUTATION: \"REENTRANT_TREE_MUTATION\", // a tree mutator — route-CRUD or setRootPath (#1751) — called synchronously from inside a subscribeChanges handler (banned — use await/async/queueMicrotask)\n  ROUTER_NOT_STOPPED: \"NOT_STOPPED\", // clear() called while a state is committed — tear down with stop() first, or swap the tree with replace() (#1612)\n  WRONG_CHANNEL: \"WRONG_CHANNEL\", // a declared query key was supplied in the path channel (`params`) instead of `search` (#1572)\n});\n\n/**\n * General router constants.\n * Special route names and identifiers.\n */\nexport const UNKNOWN_ROUTE = \"@@router/UNKNOWN_ROUTE\";\n\n/**\n * The one key the router will not copy into a state channel (#1792), and — at\n * `getDependenciesApi.getAll` — will not hand back out of a container either.\n *\n * `__proto__` is the only ACCESSOR among `Object.prototype`'s twelve own\n * members, so `target[key] = value` for that one name reaches the inherited\n * setter: no own key is created, the value vanishes with no error and no log,\n * and an OBJECT value replaces the target's prototype instead.\n *\n * ⚠ Core REFUSES it nowhere — not at a door, not at registration. It is dropped\n * where core copies into a CHANNEL and kept everywhere else, because a route's\n * custom fields and a plugin's context namespace are not containers a consumer\n * merges.\n *\n * ⚠ A `grep` for this constant does not find the sites carrying the opposite\n * contract: they go through `putField` (#1852), which keeps every name.\n *\n * The rule this serves, the doors exempt from it and the level it closes are\n * `INVARIANTS.md` — *Supported input shapes*, *WRITE* (#1852) and *HAND-OUT*\n * (#1957), with `handed-out-containers-1957.test.ts` as the authority. They are\n * deliberately not restated here: this docblock carried a second copy of that\n * section, and the two had already diverged.\n */\nexport const UNSAFE_KEY = \"__proto__\";\n\nexport const constants: Constants = Object.freeze({\n  UNKNOWN_ROUTE,\n});\n\n/**\n * Plugin method names.\n * Maps to methods that plugins can implement to hook into router lifecycle.\n */\nexport const plugins: EventToPluginMap = Object.freeze({\n  ROUTER_START: \"onStart\", // Plugin method called when router starts\n  ROUTER_STOP: \"onStop\", // Plugin method called when router stops\n  TRANSITION_START: \"onTransitionStart\", // Plugin method called when navigation begins\n  TRANSITION_LEAVE_APPROVE: \"onTransitionLeaveApprove\", // Plugin method called when deactivation guards pass\n  TRANSITION_CANCEL: \"onTransitionCancel\", // Plugin method called when navigation cancelled\n  TRANSITION_SUCCESS: \"onTransitionSuccess\", // Plugin method called when navigation succeeds\n  TRANSITION_ERROR: \"onTransitionError\", // Plugin method called when navigation fails\n});\n\n/**\n * Event names for router event system.\n * Used with addEventListener/removeEventListener for reactive subscriptions.\n */\nexport const events: EventToNameMap = Object.freeze({\n  ROUTER_START: \"$start\", // Emitted when router.start() succeeds\n  ROUTER_STOP: \"$stop\", // Emitted when router.stop() is called\n  TRANSITION_START: \"$$start\", // Emitted when navigation begins\n  TRANSITION_LEAVE_APPROVE: \"$$leaveApprove\", // Emitted when deactivation guards pass\n  TRANSITION_CANCEL: \"$$cancel\", // Emitted when navigation is cancelled\n  TRANSITION_SUCCESS: \"$$success\", // Emitted when navigation completes successfully\n  TRANSITION_ERROR: \"$$error\", // Emitted when navigation fails\n});\n\nexport const DEFAULT_LIMITS = Object.freeze({\n  maxDependencies: 100,\n  maxPlugins: 50,\n  maxListeners: 10_000,\n  warnListeners: 1000,\n  maxLifecycleHandlers: 200,\n} as const);\n\nexport const EMPTY_PARAMS: Readonly<Record<string, never>> = Object.freeze({});\n\n/**\n * Shared frozen empty query bag reused for `State.search` when a navigation\n * carries no query params — the search-channel twin of {@link EMPTY_PARAMS}\n * (RFC-4 M2 / #1548). Lets `makeState` reuse one frozen `{}` (zero transient\n * allocation, #1027) instead of minting an object per query-less state.\n */\nexport const EMPTY_SEARCH: Readonly<Record<string, never>> = Object.freeze({});\n\n/**\n * Shared frozen empty `NavigationOptions`, substituted by the facade when a\n * caller passes none — the options-channel twin of {@link EMPTY_PARAMS}.\n *\n * ⚑ It lives here rather than in `Router.ts` so the entry door can recognise it\n * by IDENTITY (#1962). `navigate(\"b\")` is the commonest call in the library, and\n * matching this singleton is what keeps the door's cost on it to one comparison\n * instead of a copy nobody asked for.\n */\nexport const EMPTY_OPTS: Readonly<Record<string, never>> = Object.freeze({});\n\nconst FROZEN_EMPTY_SEGMENTS = Object.freeze({\n  deactivated: Object.freeze([]) as unknown as string[],\n  activated: Object.freeze([]) as unknown as string[],\n  intersection: \"\",\n});\n\nexport const DEFAULT_TRANSITION = Object.freeze({\n  phase: \"activating\",\n  reason: \"success\",\n  segments: FROZEN_EMPTY_SEGMENTS,\n}) as TransitionMeta;\n","// packages/core/src/utils/ingest.ts\n//\n// One discipline for the records core BUILDS under a key it did not CHOOSE.\n//\n// Two halves, and they answer different questions — a reader who takes them for\n// one primitive will draw the wrong conclusion from either:\n//\n//   `emptyRecord` / `publishRecord` (#1825) — a record with no prototype for the\n//     BUILD, handed out plain. Used where the record is core's alone:\n//     `buildParamMeta`, the segment-meta walk.\n//   `putField` / `copyFields` (#1852) — a guarded WRITE for the records that\n//     cannot be prototype-less because they are published, read on every render,\n//     or belong to someone else. Used across core and, through\n//     `@real-router/core/utils`, by four plugins.\n//     ⚠ The site COUNTS deliberately do not live here. This comment carried\n//     \"twenty-one in core, fourteen across four plugins\" and both halves were\n//     wrong (22 and 13, measured) — a second copy of a number `CLAUDE.md`\n//     already calls descriptive-not-contract. The count lives in `CLAUDE.md`\n//     (\"The WRITE side of the same rule\"); the CONTRACT is the derived set in\n//     `tests/functional/computed-key-write-authority-1852.test.ts`.\n//\n// ⚠ Neither decides whether a key is PUBLISHED. `__proto__` stays out of\n// `state.params` / `state.search` by a separate skip at the channel copy sites\n// in `helpers.ts`, and stays IN a route's custom fields and a plugin's context\n// namespace, because those are not containers a consumer merges. See `putField`'s\n// docblock for that split.\n//\n//   `concealUnsafeKey` (#1957) is the one member of this file that DOES decide\n//     that — for exactly one record, `buildMeta`'s, which core both hands out\n//     and reads back by key. It withholds the name from ENUMERATION rather than\n//     removing it, because removing it is a measured behaviour loss there. The\n//     doors that only hand a container OUT drop the key instead\n//     (`dropUnsafeKey`, `helpers.ts`).\n//\n// ⚠ The rest are WRITE-side primitives only, and the boundary is deliberate. A\n// READ-side primitive that walks a caller's prototype chain was written here,\n// wired, measured — and removed: `CLAUDE.md` \"Supported Input Shapes\" settles\n// that axis already (\"own enumerable properties only\", owner decision\n// 2026-08-18), and core is the layer that DEGRADES on a violation while\n// `@real-router/validation-plugin` is the layer that reports it. A primitive\n// that honoured inherited keys would have made core contradict its own canon,\n// and it additionally admitted the ambient `Object.prototype` — the #1840\n// class, introduced by the fix.\n//\n// So what is left is the half the canon does not cover: what happens when core\n// writes into a record of its own under a key it did not choose.\n\nimport { UNSAFE_KEY } from \"../constants\";\n\n/** Captured like the deciding seven, but this one BUILDS the guarantee (#2072). */\nconst objectCreate = Object.create;\n\nconst objectEntries = Object.entries;\n\n/**\n * The target discipline: a record with NO prototype.\n *\n * ⚑ This one line closes two axes at once, which is why it is a primitive and\n * not an idiom. #1856 tabulates them as a structural trade — a key-by-key copy\n * fixes `\"__proto__\"` but turns a `[[DefineOwnProperty]]` into a `[[Set]]`, so\n * an ambient accessor starts throwing — and calls the conflict unavoidable. It\n * is unavoidable only while the target inherits from `Object.prototype`:\n *\n *   - `\"__proto__\"` (#1825, #1794, #1809) is an ordinary key here, because the\n *     magic accessor lives on `Object.prototype` and this object has none.\n *   - an ambient accessor named `id` / `page` / `tab` (#1852) cannot hijack the\n *     write for the same reason. #1852 notes the key's provenance is\n *     irrelevant — `SegmentMatcher` writes a name from the ROUTE TABLE and\n *     throws just the same — so a name-based skip cannot close it and this can.\n */\nexport function emptyRecord<V>(): Record<string, V> {\n  return objectCreate(null) as Record<string, V>;\n}\n\n/**\n * Hand a privately-built record out with the ORDINARY prototype, keeping every\n * own key — including a literal `\"__proto__\"`.\n *\n * Discovered by measurement, not designed: wiring `emptyRecord` into\n * `buildParamMeta` alone reds **21** existing tests, all of the shape\n * `expected { id: 'url' } to strictly equal { id: 'url' }` — identical content,\n * different prototype, because `toStrictEqual` compares prototypes and\n * `paramTypeMap` is published through `getPluginApi(router).getTree()`. A\n * prototype-less record is not a drop-in at a published surface.\n *\n * The spread is what makes this work rather than undo it: it\n * `[[DefineOwnProperty]]`s, so an own `\"__proto__\"` carried on the private\n * record lands as an ordinary own key here (measured: own keys\n * `[\"__proto__\",\"keep\"]`, value intact, prototype back to `Object.prototype`).\n * Writing that same key into a fresh `{}` with `[[Set]]` loses it entirely\n * (measured: own keys `[]`) — which is the defect the private record exists to\n * avoid.\n *\n * So the rule is: **build private, publish plain.** The window in which the\n * ambient-accessor hazard (#1852) could bite is the build, and the build never\n * touches `Object.prototype`.\n */\nexport function publishRecord<V>(source: Record<string, V>): Record<string, V> {\n  return { ...source };\n}\n\n/**\n * Captured at module load for the reason `helpers.ts` gives for `freeze` /\n * `hasOwn` / `objectKeys`: this is the operation {@link putField} writes\n * through, so a guard reading it late would be reading whatever an application\n * had re-pointed it to.\n */\nconst defineProperty = Object.defineProperty;\nconst hasOwn = Object.hasOwn;\n\n/**\n * Withhold `UNSAFE_KEY` from ENUMERATION on a record core hands out AND reads\n * back by key (#1957).\n *\n * ⚑ The hazard is the CONSUMER's merge, not core's own write. `Object.assign`\n * and a `for…in` copy `[[Set]]` each own ENUMERABLE key on the TARGET, where\n * `Object.prototype`'s `\"__proto__\"` accessor replaces that target's prototype\n * instead of adding an entry.\n *\n * ⚠ A SPREAD is NOT in that list. `{ ...source }` performs `CreateDataProperty`,\n * i.e. `[[DefineOwnProperty]]`, which never reaches an inherited accessor —\n * measured on the poisoned bag, on a null-prototype carrier and through a\n * pass-through Proxy, a spread swaps in none of the three. The list is exactly\n * `Object.assign` or a `for…in` copy (#1823), and the hazard is that narrow.\n *\n * So the SOURCE's own prototype decides nothing either — measured, an\n * `Object.create(null)` source swaps the target exactly the same — and the only\n * two fixes are removing the key or removing it from enumeration.\n *\n * ⚠ **Dropping is not a milder fix here, it is a WRONG one.** The route-meta\n * record is core's working table: `segmentParamsEqual` reads `meta[segmentName]`\n * on every navigation, so with the entry gone the read reaches the INHERITED\n * accessor and answers `Object.prototype` — an object, whose `Object.keys` is\n * `[]`, so the segment reports \"params unchanged\". Measured end to end on a\n * route named `__proto__`: `/p/1` → `/p/2` activates `[\"__proto__\"]` today and\n * `[]` with the entry deleted. Core accepts that name (#1801), so the loss is\n * real and silent.\n *\n * Non-enumerable keeps the read exact for core AND for a consumer asking by\n * key, while `Object.assign` / a spread / `for…in` skip it — measured, all\n * three.\n *\n * ⚠ NOT applied by {@link publishRecord} itself. Its other caller is\n * `buildParamMeta`, whose map core ENUMERATES (`Object.keys` in\n * `segmentParamsEqual`, `for…in` in `hasAnyParam`) and which is not a swap\n * primitive anyway: a param's value is the string `\"url\"` / `\"query\"`, and the\n * inherited setter ignores primitives.\n *\n * Returns the input untouched, with no descriptor write, when the key is absent\n * — which is every ordinary route.\n */\nexport function concealUnsafeKey<V>(\n  record: Record<string, V>,\n): Record<string, V> {\n  if (!hasOwn(record, UNSAFE_KEY)) {\n    return record;\n  }\n\n  defineProperty(record, UNSAFE_KEY, {\n    value: record[UNSAFE_KEY],\n    writable: true,\n    enumerable: false,\n    configurable: true,\n  });\n\n  return record;\n}\n\n/**\n * Write one field of a record core BUILDS under a key it did not choose.\n *\n * ⚑ The rule this exists to enforce: **a caller's object contributes DATA, and\n * nothing else.** No trap, no accessor, no inherited member of a bag handed to\n * the router may change what the router ends up holding — which is what\n * \"treat it as a pure dictionary\" means on the WRITE side. `Object.keys` and\n * the one-read-per-key discipline (#1854 / #1899) already say it on the read\n * side; this is the other half.\n *\n * Plain `target[key] = value` cannot say it. `[[Set]]` walks the prototype\n * chain first, so a key that resolves to an accessor or a non-writable data\n * property up there is HIJACKED — the write dispatches into application code\n * (or is silently dropped in sloppy mode, and throws in a module). The key's\n * provenance is irrelevant: `SegmentMatcher` writes a name straight off the\n * ROUTE TABLE, so `id` / `tab` / `page` are as exposed as `__proto__` (#1852),\n * and a name-based skip therefore cannot close it.\n *\n * `Object.defineProperty` CAN say it — it ignores the chain entirely — but it\n * measures ~100 ns per field against ~0 for a store, which is why #1852 priced\n * it as unaffordable on a path that runs per navigation and per `<Link>`\n * render.\n *\n * So the write is guarded rather than replaced: **ask the chain first, and pay\n * only where it answers.** In a pristine environment `in` answers `false` for\n * every name an application routes under, so the store is taken and nothing is\n * paid. It covers both halves of the hazard, which a `__proto__` name test does\n * not: an accessor (getter-only THROWS, getter+setter silently diverts the\n * value) and a **non-writable** data property. Verified on all four shapes plus\n * the overwrite cases.\n *\n * ⚠ It asks `key in target`, NOT `key in Object.prototype`, and the difference\n * is the whole robustness of the primitive rather than a style choice. The\n * cheaper form is right only while every target is a fresh `{}`, i.e. while its\n * chain IS `Object.prototype` — measured, a target inheriting the accessor from\n * anywhere else walks straight past that predicate and throws. Asking the\n * object\n * being written to cannot be wrong for any target. Measured cost of the\n * difference, measured when the two forms were compared directly: a wash on\n * every arc, bought for a predicate with no precondition. ⚠ Those figures\n * predate both the `!hasOwn` term and the restored channel skips, and the\n * number\n * that supersedes them is below — the whole guard sits under the noise floor,\n * so\n * the choice between the two predicates cannot be visible in it.\n *\n * ⚑ **`&& !hasOwn`, and that second term is not an optimisation — it is what\n * keeps this a guarded WRITE instead of a redefinition.** When the key is\n * already an OWN property of the target, `[[Set]]` finds it and never consults\n * the chain, so a plain store is both safe AND semantically right there.\n * `defineProperty` is not: it replaces the whole DESCRIPTOR with this\n * function's\n * fixed one, and three consequences of that were measured before the term was\n * added.\n *\n *   - It **throws where a plain store works**: a `configurable: false` own key\n *     (a sealed target, an array's `length`) refuses `defineProperty` while\n *     accepting an assignment.\n *   - It **silently unlocks**: an own `writable: false` key was overwritten and\n *     came back writable, and an own `enumerable: false` key came back\n *     enumerable — a \"guarded write\" that also removes the guard.\n *   - It **changed a shipped shape**, which is how this was caught rather than\n *     reasoned about. `RouterError`'s own `stack` is a non-enumerable accessor;\n *     `wrapSyncError` passes `stack` through here, so every error built from a\n *     thrown one gained an own enumerable `stack`. `Object.keys(err)` changed,\n *     and two errors differing only in stack stopped comparing equal under\n *     `isDeepStrictEqual` / `toEqual`. The two arms of `rethrowAsRouterError`\n *     disagreed with each other, because one of them assigns.\n *\n * `in` answers `false` for a fresh bag's new key and short-circuits, so\n * `hasOwn`\n * runs only on the rare branch it disambiguates. ⚠ That short-circuit does NOT\n * leave the hot path untouched — one dictionary lookup per written field is the\n * price, and it is measured below.\n *\n * ⚠ The alternative that looks equivalent and is not: a prototype-less target.\n * It also closes the axis, and it costs far MORE, because the price is not on\n * the write at all — V8 puts such an object in dictionary mode, so every later\n * READ of the bag pays. Re-measured on the SHIPPED tree rather than carried\n * over from an earlier one: `buildPath` goes **+65.4 %** (one path slot) and\n * **+36.2 %** (slot + query). `{ __proto__: null }` as a literal is no better\n * (76 ns vs 70 ns for `Object.create(null)`, against 7.5 ns plain).\n *\n * ⚑ **The guard COSTS, and \"not measurable\" is a resolution artefact.** Medians\n * of five floor at an A/A of 5-6 %, which hides it; on a quiet machine this\n * harness floors at 0.1-1.7 %, and at that resolution the cost is plain.\n * Same-session A/B, ALTERNATING PROCESSES (two\n * copies of the module in one process is not a valid A/B), medians of 20 pairs,\n * against the SHIPPED bundle rather than `src`, each arc's own A/A floor in\n * brackets:\n *\n *     buildPath, splat param     232.4 -> 260.3 ns   +12.0 %  (0.7 %)\n *     isActiveRoute, exact       117.5 -> 125.4 ns    +6.8 %  (0.1 %)\n *     matchPath, path params     664.0 -> 693.8 ns    +4.5 %  (0.8 %)\n *     buildPath, static           97.5 ->  99.2 ns    +1.7 %  (1.7 %)\n *     buildPath, one path slot   145.0 -> 140.5 ns    -3.1 %  (1.0 %)\n *     isActiveRoute, sibling      38.4 ->  38.3 ns    -0.3 %  (0.3 %)\n *\n * Isolated by building the tree with the predicate replaced by `false`: it is\n * worth -6.1 % on the splat arc and -7.5 % on the exact one, i.e. the whole of\n * the regression there; the rest of `matchPath`'s is `withoutUnsafeKey`\n * (#1904), -2.1 %.\n *\n * ⚠ The old claim was less a bad measurement than a measurement of the WRONG\n * ARCS. `warm-params` and the sibling arm genuinely do not move — those are the\n * two it sampled — while the splat and exact arms do. Sampling what does not\n * move and generalising to \"not measurable\" is the same trap the reachability\n * arguments elsewhere in this file are written against.\n *\n * The price is ACCEPTED, deliberately, and three cheaper forms were measured\n * and rejected before accepting it:\n *\n *   - asking a captured `Object.prototype` instead of the target, so the `in`\n *     receiver is monomorphic: every arc inside the A/A floor. The cost is the\n *     dictionary lookup, not who is asked.\n *   - a prototype-less accumulator in `normalizeChannel` published through\n *     `publishRecord`: **+134 % … +284 %** — the dictionary-mode price above,\n *     now measured end to end rather than argued.\n *   - an optimistic plain store repaired afterwards (`hasOwn` + `try`/`catch`):\n *     -3.5 % and -2.8 % on two arcs but **+8.3 %** on a third, and it re-opens\n *     the descriptor question `&& !hasOwn(target, key)` exists to close.\n *\n * ⚠ **CodSpeed reports this change at -13.83 %, and that is not the shipped\n * cost.** The gap is measured, not assumed. The suite runs\n * `tsx tests/benchmarks/run.ts` — against `src`, unbundled — so its flamegraph\n * carries ESM module-namespace getter frames (`get (ingest.ts)`, 2.67 % of one\n * arc) that the bundle does not have: `grep -c 'get: ()' dist/esm/index.mjs` is\n * 0. `Simulation` mode additionally over-counts instructions a superscalar CPU\n * hides. On the worst-reported arc the sign inverts — -17.25 % simulated,\n * -3.1 % (i.e. FASTER) in the bundle.\n *\n * A prototype-less channel additionally changes a PUBLISHED shape:\n * `state.params` would stop inheriting from `Object.prototype`, which reds\n * tests across **17 packages**, none of them for a behavioural reason.\n *\n * ⚠ **The package count is the half that holds; the TEST count is not restated,\n * because it moves with the tier while the shape does not.** Published as \"263\n * in 15\", corrected to 352/17 by a full-monorepo run, and 374/17 when re-run on\n * 2026-09-04 — three figures, one answer. Re-run the mutation rather than trust\n * a number here: make the two channel singletons and the channel accumulators\n * `Object.create(null)` and run the monorepo. It was never a question of which\n * sites to mutate, because 17 came back every time.\n *\n * The qualitative half is the load-bearing one: the failures are\n * `AssertionError`, none are thrown; they are `toStrictEqual` cells plus a\n * handful of explicit prototype pins; and NO `toEqual` / `toMatchObject` cell\n * moves, which is the internal control that only the prototype axis shifted.\n *\n * ⚑ `defineProperty` also makes `__proto__` an ordinary own key rather than a\n * write that swaps the target's prototype — which is why the `claim.write`\n * (#1191), `assignParam` (#855) and custom-field (#1788) special cases could be\n * replaced by this one primitive instead of kept beside it.\n *\n * ⚠ **It does NOT decide whether that key is PUBLISHED, and the two questions\n * were briefly conflated here.** The channel copy sites in `helpers.ts` still\n * drop `__proto__` before it reaches `state.params` / `state.search`, and that\n * skip is orthogonal to this primitive: a bag core hands BACK carrying the key\n * is a prototype-swap primitive for any consumer that merges it with\n * `Object.assign` — measured, `?__proto__` alone yields `null` and\n * `?__proto__=1&__proto__=2` an array, and the inherited setter accepts both.\n * `getDependenciesApi.getAll()` deletes the same key for the same reason and in\n * those words. Where the record does NOT escape to a merging consumer — a\n * route's custom fields, a plugin's context namespace — the key stays as data,\n * which is what #1788 and #1191 are about.\n */\nexport function putField<V>(\n  target: Record<string, V>,\n  key: string,\n  value: V,\n): void {\n  if (key in target && !hasOwn(target, key)) {\n    defineProperty(target, key, {\n      value,\n      writable: true,\n      enumerable: true,\n      configurable: true,\n    });\n  } else {\n    target[key] = value;\n  }\n}\n\n/**\n * {@link putField} for a whole source record — what `Object.assign` would do,\n * without the hazard.\n *\n * ⚑ It exists because `Object.assign` IS the hazard, written in a form a census\n * keyed on `dst[key] = value` cannot see. It copies with `[[Set]]`, one key at\n * a\n * time, so every argument in {@link putField}'s docblock applies to it verbatim\n * — and it is the reason this class needed a second look after the obvious\n * sweep: the matcher's junction walk builds `childParams` with a computed-key\n * literal (safe: that DEFINES) and then commits it with `Object.assign` (not).\n * Measured with an ambient setter under a route's own param name, the route\n * still MATCHED and `state.params` came back empty — the URL's parameter gone,\n * with no error anywhere.\n *\n * `Object.entries` for the walk: it hands back the value it already read, so\n * there is exactly ONE read per key and no window for a drifting accessor\n * between the test and the use (#1899). It is also the idiom the sibling copy\n * loops use.\n *\n * ⚠ **Two things it does NOT buy, both measured.**\n *\n *   - It is **not** a filter against a lying Proxy source. `ownKeys` is asked\n *     first, so a key that list does not contain cannot appear — but a source\n *     whose `ownKeys` DOES name a phantom and whose descriptor trap calls it\n *     enumerable gets that phantom copied, identically to `Object.assign`. The\n *     #1854 protection is narrower than \"the trap is never consulted\".\n *   - It is **not** a drop-in for `Object.assign`. `Object.entries` is\n *     string-keyed, so own enumerable SYMBOL entries are dropped where\n *     `Object.assign` copies them. That matches core's stated policy for the\n * channels (\"symbols are dropped, always\") and is a real behaviour difference\n *     from `Object.assign` at one call site (`persistent-params`' factory). ⚠ It also disagrees with `publishRecord`\n *     two functions up, which spreads and therefore keeps symbols — the same\n *     internal split `helpers.ts` records as the #1792 defect.\n */\nexport function copyFields<V>(\n  target: Record<string, V>,\n  source: Record<string, V>,\n): void {\n  for (const [key, value] of objectEntries(source)) {\n    putField(target, key, value);\n  }\n}\n"],"mappings":"AA0BA,MAAa,EAAkC,OAAO,OAAO,CAC3D,mBAAoB,cACpB,uBAAwB,yBACxB,uBAAwB,kBACxB,gBAAiB,kBACjB,YAAa,cACb,kBAAmB,oBACnB,gBAAiB,kBACjB,eAAgB,iBAChB,qBAAsB,YACtB,gBAAiB,WACjB,gBAAiB,kBACjB,kCAAmC,oCACnC,qBAAsB,uBACtB,wBAAyB,0BACzB,mBAAoB,cACpB,cAAe,eACjB,CAAC,EAMY,EAAgB,yBAyBhB,EAAa,YAEb,EAAuB,OAAO,OAAO,CAChD,eACF,CAAC,EAMY,EAA4B,OAAO,OAAO,CACrD,aAAc,UACd,YAAa,SACb,iBAAkB,oBAClB,yBAA0B,2BAC1B,kBAAmB,qBACnB,mBAAoB,sBACpB,iBAAkB,mBACpB,CAAC,EAMY,EAAyB,OAAO,OAAO,CAClD,aAAc,SACd,YAAa,QACb,iBAAkB,UAClB,yBAA0B,iBAC1B,kBAAmB,WACnB,mBAAoB,YACpB,iBAAkB,SACpB,CAAC,EAEY,EAAiB,OAAO,OAAO,CAC1C,gBAAiB,IACjB,WAAY,GACZ,aAAc,IACd,cAAe,IACf,qBAAsB,GACxB,CAAU,EAEG,EAAgD,OAAO,OAAO,CAAC,CAAC,EAQhE,EAAgD,OAAO,OAAO,CAAC,CAAC,EAWhE,EAA8C,OAAO,OAAO,CAAC,CAAC,EAErE,EAAwB,OAAO,OAAO,CAC1C,YAAa,OAAO,OAAO,CAAC,CAAC,EAC7B,UAAW,OAAO,OAAO,CAAC,CAAC,EAC3B,aAAc,EAChB,CAAC,EAEY,EAAqB,OAAO,OAAO,CAC9C,MAAO,aACP,OAAQ,UACR,SAAU,CACZ,CAAC,ECjGK,EAAe,OAAO,OAEtB,EAAgB,OAAO,QAkB7B,SAAgB,GAAoC,CAClD,OAAO,EAAa,IAAI,CAC1B,CAyBA,SAAgB,EAAiB,EAA8C,CAC7E,MAAO,CAAE,GAAG,CAAO,CACrB,CAQA,MAAM,EAAiB,OAAO,eACxB,EAAS,OAAO,OA2CtB,SAAgB,EACd,EACmB,CAYnB,OAXK,EAAO,EAAA,WAAkB,GAI9B,EAAe,EAAQ,EAAY,CACjC,MAAO,EAAO,GACd,SAAU,GACV,WAAY,GACZ,aAAc,EAChB,CAAC,EARQ,CAWX,CAuKA,SAAgB,EACd,EACA,EACA,EACM,CACF,KAAO,GAAU,CAAC,EAAO,EAAQ,CAAG,EACtC,EAAe,EAAQ,EAAK,CAC1B,QACA,SAAU,GACV,WAAY,GACZ,aAAc,EAChB,CAAC,EAED,EAAO,GAAO,CAElB,CAqCA,SAAgB,EACd,EACA,EACM,CACN,IAAK,GAAM,CAAC,EAAK,KAAU,EAAc,CAAM,EAC7C,EAAS,EAAQ,EAAK,CAAK,CAE/B"}
+{"version":3,"file":"ingest-C6HQ7xXf.js","names":[],"sources":["../../src/constants.ts","../../src/utils/ingest.ts"],"sourcesContent":["// packages/core/src/constants.ts\n\nimport type {\n  EventToNameMap,\n  EventToPluginMap,\n  ErrorCodeToValueMap,\n  ErrorCodeKeys,\n  ErrorCodeValues,\n  TransitionMeta,\n} from \"./types\";\n\nexport type ConstantsKeys = \"UNKNOWN_ROUTE\";\n\nexport type Constants = Readonly<Record<ConstantsKeys, string>>;\n\n// =============================================================================\n// Error Codes (migrated from router-error)\n// =============================================================================\n\nexport type ErrorCodes = Record<ErrorCodeKeys, ErrorCodeValues>;\n\n/**\n * Error codes for router operations.\n * Used to identify specific failure scenarios in navigation and lifecycle.\n * Frozen to prevent accidental modifications.\n */\nexport const errorCodes: ErrorCodeToValueMap = Object.freeze({\n  ROUTER_NOT_STARTED: \"NOT_STARTED\", // navigate() called before start()\n  NO_START_PATH_OR_STATE: \"NO_START_PATH_OR_STATE\", // start() without initial route\n  ROUTER_ALREADY_STARTED: \"ALREADY_STARTED\", // start() called twice\n  ROUTE_NOT_FOUND: \"ROUTE_NOT_FOUND\", // Navigation to non-existent route\n  SAME_STATES: \"SAME_STATES\", // Navigate to current route without reload\n  CANNOT_DEACTIVATE: \"CANNOT_DEACTIVATE\", // canDeactivate guard blocked navigation\n  CANNOT_ACTIVATE: \"CANNOT_ACTIVATE\", // canActivate guard blocked navigation\n  TRANSITION_ERR: \"TRANSITION_ERR\", // Generic transition failure\n  TRANSITION_CANCELLED: \"CANCELLED\", // Navigation cancelled by user or new navigation\n  ROUTER_DISPOSED: \"DISPOSED\", // Router has been disposed\n  PLUGIN_CONFLICT: \"PLUGIN_CONFLICT\", // Plugin tried to extend router with already-existing property\n  CONTEXT_NAMESPACE_ALREADY_CLAIMED: \"CONTEXT_NAMESPACE_ALREADY_CLAIMED\", // Plugin tried to claim a context namespace already owned by another plugin\n  REENTRANT_NAVIGATION: \"REENTRANT_NAVIGATION\", // navigate() called synchronously from inside a transition-event listener (banned — use await/async listener)\n  REENTRANT_TREE_MUTATION: \"REENTRANT_TREE_MUTATION\", // a tree mutator — route-CRUD or setRootPath (#1751) — called synchronously from inside a subscribeChanges handler (banned — use await/async/queueMicrotask)\n  ROUTER_NOT_STOPPED: \"NOT_STOPPED\", // clear() called while a state is committed — tear down with stop() first, or swap the tree with replace() (#1612)\n  WRONG_CHANNEL: \"WRONG_CHANNEL\", // a declared query key was supplied in the path channel (`params`) instead of `search` (#1572)\n});\n\n/**\n * General router constants.\n * Special route names and identifiers.\n */\nexport const UNKNOWN_ROUTE = \"@@router/UNKNOWN_ROUTE\";\n\n/**\n * The one key the router will not copy into a state channel (#1792), and — at\n * `getDependenciesApi.getAll` — will not hand back out of a container either.\n *\n * `__proto__` is the only ACCESSOR among `Object.prototype`'s twelve own\n * members, so `target[key] = value` for that one name reaches the inherited\n * setter: no own key is created, the value vanishes with no error and no log,\n * and an OBJECT value replaces the target's prototype instead.\n *\n * ⚠ Core REFUSES it nowhere — not at a door, not at registration. It is dropped\n * where core copies into a CHANNEL and kept everywhere else, because a route's\n * custom fields and a plugin's context namespace are not containers a consumer\n * merges.\n *\n * ⚠ A `grep` for this constant does not find the sites carrying the opposite\n * contract: they go through `putField` (#1852), which keeps every name.\n *\n * The rule this serves, the doors exempt from it and the level it closes are\n * `INVARIANTS.md` — *Supported input shapes*, *WRITE* (#1852) and *HAND-OUT*\n * (#1957), with `handed-out-containers-1957.test.ts` as the authority. They are\n * deliberately not restated here: this docblock carried a second copy of that\n * section, and the two had already diverged.\n */\nexport const UNSAFE_KEY = \"__proto__\";\n\nexport const constants: Constants = Object.freeze({\n  UNKNOWN_ROUTE,\n});\n\n/**\n * Plugin method names.\n * Maps to methods that plugins can implement to hook into router lifecycle.\n */\nexport const plugins: EventToPluginMap = Object.freeze({\n  ROUTER_START: \"onStart\", // Plugin method called when router starts\n  ROUTER_STOP: \"onStop\", // Plugin method called when router stops\n  TRANSITION_START: \"onTransitionStart\", // Plugin method called when navigation begins\n  TRANSITION_LEAVE_APPROVE: \"onTransitionLeaveApprove\", // Plugin method called when deactivation guards pass\n  TRANSITION_CANCEL: \"onTransitionCancel\", // Plugin method called when navigation cancelled\n  TRANSITION_SUCCESS: \"onTransitionSuccess\", // Plugin method called when navigation succeeds\n  TRANSITION_ERROR: \"onTransitionError\", // Plugin method called when navigation fails\n});\n\n/**\n * Event names for router event system.\n * Used with addEventListener/removeEventListener for reactive subscriptions.\n */\nexport const events: EventToNameMap = Object.freeze({\n  ROUTER_START: \"$start\", // Emitted when router.start() succeeds\n  ROUTER_STOP: \"$stop\", // Emitted when router.stop() is called\n  TRANSITION_START: \"$$start\", // Emitted when navigation begins\n  TRANSITION_LEAVE_APPROVE: \"$$leaveApprove\", // Emitted when deactivation guards pass\n  TRANSITION_CANCEL: \"$$cancel\", // Emitted when navigation is cancelled\n  TRANSITION_SUCCESS: \"$$success\", // Emitted when navigation completes successfully\n  TRANSITION_ERROR: \"$$error\", // Emitted when navigation fails\n});\n\nexport const DEFAULT_LIMITS = Object.freeze({\n  maxDependencies: 100,\n  maxPlugins: 50,\n  maxListeners: 10_000,\n  warnListeners: 1000,\n  maxLifecycleHandlers: 200,\n} as const);\n\nexport const EMPTY_PARAMS: Readonly<Record<string, never>> = Object.freeze({});\n\n/**\n * Shared frozen empty query bag reused for `State.search` when a navigation\n * carries no query params — the search-channel twin of {@link EMPTY_PARAMS}\n * (RFC-4 M2 / #1548). Lets `makeState` reuse one frozen `{}` (zero transient\n * allocation, #1027) instead of minting an object per query-less state.\n */\nexport const EMPTY_SEARCH: Readonly<Record<string, never>> = Object.freeze({});\n\n/**\n * Shared frozen empty `NavigationOptions`, substituted by the facade when a\n * caller passes none — the options-channel twin of {@link EMPTY_PARAMS}.\n *\n * ⚑ It lives here rather than in `Router.ts` so the entry door can recognise it\n * by IDENTITY (#1962). `navigate(\"b\")` is the commonest call in the library, and\n * matching this singleton is what keeps the door's cost on it to one comparison\n * instead of a copy nobody asked for.\n */\nexport const EMPTY_OPTS: Readonly<Record<string, never>> = Object.freeze({});\n\nconst FROZEN_EMPTY_SEGMENTS = Object.freeze({\n  deactivated: Object.freeze([]) as unknown as string[],\n  activated: Object.freeze([]) as unknown as string[],\n  intersection: \"\",\n});\n\nexport const DEFAULT_TRANSITION = Object.freeze({\n  phase: \"activating\",\n  reason: \"success\",\n  segments: FROZEN_EMPTY_SEGMENTS,\n}) as TransitionMeta;\n","// packages/core/src/utils/ingest.ts\n//\n// One discipline for the records core BUILDS under a key it did not CHOOSE.\n//\n// Two halves, and they answer different questions — a reader who takes them for\n// one primitive will draw the wrong conclusion from either:\n//\n//   `emptyRecord` / `publishRecord` (#1825) — a record with no prototype for the\n//     BUILD, handed out plain. Used where the record is core's alone:\n//     `buildParamMeta`, the segment-meta walk.\n//   `putField` / `copyFields` (#1852) — a guarded WRITE for the records that\n//     cannot be prototype-less because they are published, read on every render,\n//     or belong to someone else. Used across core and, through\n//     `@real-router/core/utils`, by four plugins.\n//     ⚠ The site COUNTS deliberately do not live here. This comment carried\n//     \"twenty-one in core, fourteen across four plugins\" and both halves were\n//     wrong (22 and 13, measured) — a second copy of a number `CLAUDE.md`\n//     already calls descriptive-not-contract. The count lives in `CLAUDE.md`\n//     (\"The WRITE side of the same rule\"); the CONTRACT is the derived set in\n//     `tests/functional/computed-key-write-authority-1852.test.ts`.\n//\n// ⚠ Neither decides whether a key is PUBLISHED. `__proto__` stays out of\n// `state.params` / `state.search` by a separate skip at the channel copy sites\n// in `helpers.ts`, and stays IN a route's custom fields and a plugin's context\n// namespace, because those are not containers a consumer merges. See `putField`'s\n// docblock for that split.\n//\n//   `concealUnsafeKey` (#1957) is the one member of this file that DOES decide\n//     that — for exactly one record, `buildMeta`'s, which core both hands out\n//     and reads back by key. It withholds the name from ENUMERATION rather than\n//     removing it, because removing it is a measured behaviour loss there. The\n//     doors that only hand a container OUT drop the key instead\n//     (`dropUnsafeKey`, `helpers.ts`).\n//\n// ⚠ The rest are WRITE-side primitives only, and the boundary is deliberate. A\n// READ-side primitive that walks a caller's prototype chain was written here,\n// wired, measured — and removed: `CLAUDE.md` \"Supported Input Shapes\" settles\n// that axis already (\"own enumerable properties only\", owner decision\n// 2026-08-18), and core is the layer that DEGRADES on a violation while\n// `@real-router/validation-plugin` is the layer that reports it. A primitive\n// that honoured inherited keys would have made core contradict its own canon,\n// and it additionally admitted the ambient `Object.prototype` — the #1840\n// class, introduced by the fix.\n//\n// So what is left is the half the canon does not cover: what happens when core\n// writes into a record of its own under a key it did not choose.\n\nimport { UNSAFE_KEY } from \"../constants\";\n\n/** Captured like the deciding seven, but this one BUILDS the guarantee (#2072). */\nconst objectCreate = Object.create;\n\nconst objectEntries = Object.entries;\n\n/**\n * The target discipline: a record with NO prototype.\n *\n * ⚑ This one line closes two axes at once, which is why it is a primitive and\n * not an idiom. #1856 tabulates them as a structural trade — a key-by-key copy\n * fixes `\"__proto__\"` but turns a `[[DefineOwnProperty]]` into a `[[Set]]`, so\n * an ambient accessor starts throwing — and calls the conflict unavoidable. It\n * is unavoidable only while the target inherits from `Object.prototype`:\n *\n *   - `\"__proto__\"` (#1825, #1794, #1809) is an ordinary key here, because the\n *     magic accessor lives on `Object.prototype` and this object has none.\n *   - an ambient accessor named `id` / `page` / `tab` (#1852) cannot hijack the\n *     write for the same reason. #1852 notes the key's provenance is\n *     irrelevant — `SegmentMatcher` writes a name from the ROUTE TABLE and\n *     throws just the same — so a name-based skip cannot close it and this can.\n */\nexport function emptyRecord<V>(): Record<string, V> {\n  return objectCreate(null) as Record<string, V>;\n}\n\n/**\n * Hand a privately-built record out with the ORDINARY prototype, keeping every\n * own key — including a literal `\"__proto__\"`.\n *\n * Discovered by measurement, not designed: wiring `emptyRecord` into\n * `buildParamMeta` alone reds **21** existing tests, all of the shape\n * `expected { id: 'url' } to strictly equal { id: 'url' }` — identical content,\n * different prototype, because `toStrictEqual` compares prototypes and\n * `paramTypeMap` is published through `getPluginApi(router).getTree()`. A\n * prototype-less record is not a drop-in at a published surface.\n *\n * The spread is what makes this work rather than undo it: it\n * `[[DefineOwnProperty]]`s, so an own `\"__proto__\"` carried on the private\n * record lands as an ordinary own key here (measured: own keys\n * `[\"__proto__\",\"keep\"]`, value intact, prototype back to `Object.prototype`).\n * Writing that same key into a fresh `{}` with `[[Set]]` loses it entirely\n * (measured: own keys `[]`) — which is the defect the private record exists to\n * avoid.\n *\n * So the rule is: **build private, publish plain.** The window in which the\n * ambient-accessor hazard (#1852) could bite is the build, and the build never\n * touches `Object.prototype`.\n */\nexport function publishRecord<V>(source: Record<string, V>): Record<string, V> {\n  return { ...source };\n}\n\n/**\n * Captured at module load for the reason `helpers.ts` gives for `freeze` /\n * `hasOwn` / `objectKeys`: this is the operation {@link putField} writes\n * through, so a guard reading it late would be reading whatever an application\n * had re-pointed it to.\n */\nconst defineProperty = Object.defineProperty;\nconst hasOwn = Object.hasOwn;\n\n/**\n * Withhold `UNSAFE_KEY` from ENUMERATION on a record core hands out AND reads\n * back by key (#1957).\n *\n * ⚑ The hazard is the CONSUMER's merge, not core's own write. `Object.assign`\n * and a `for…in` copy `[[Set]]` each own ENUMERABLE key on the TARGET, where\n * `Object.prototype`'s `\"__proto__\"` accessor replaces that target's prototype\n * instead of adding an entry.\n *\n * ⚠ A SPREAD is NOT in that list. `{ ...source }` performs `CreateDataProperty`,\n * i.e. `[[DefineOwnProperty]]`, which never reaches an inherited accessor —\n * measured on the poisoned bag, on a null-prototype carrier and through a\n * pass-through Proxy, a spread swaps in none of the three. The list is exactly\n * `Object.assign` or a `for…in` copy (#1823), and the hazard is that narrow.\n *\n * So the SOURCE's own prototype decides nothing either — measured, an\n * `Object.create(null)` source swaps the target exactly the same — and the only\n * two fixes are removing the key or removing it from enumeration.\n *\n * ⚠ **Dropping is not a milder fix here, it is a WRONG one.** The route-meta\n * record is core's working table: `segmentParamsEqual` reads `meta[segmentName]`\n * on every navigation, so with the entry gone the read reaches the INHERITED\n * accessor and answers `Object.prototype` — an object, whose `Object.keys` is\n * `[]`, so the segment reports \"params unchanged\". Measured end to end on a\n * route named `__proto__`: `/p/1` → `/p/2` activates `[\"__proto__\"]` today and\n * `[]` with the entry deleted. Core accepts that name (#1801), so the loss is\n * real and silent.\n *\n * Non-enumerable keeps the read exact for core AND for a consumer asking by\n * key, while `Object.assign` / a spread / `for…in` skip it — measured, all\n * three.\n *\n * ⚠ NOT applied by {@link publishRecord} itself. Its other caller is\n * `buildParamMeta`, whose map core ENUMERATES (`Object.keys` in\n * `segmentParamsEqual`, `for…in` in `hasAnyParam`) and which is not a swap\n * primitive anyway: a param's value is the string `\"url\"` / `\"query\"`, and the\n * inherited setter ignores primitives.\n *\n * Returns the input untouched, with no descriptor write, when the key is absent\n * — which is every ordinary route.\n */\nexport function concealUnsafeKey<V>(\n  record: Record<string, V>,\n): Record<string, V> {\n  if (!hasOwn(record, UNSAFE_KEY)) {\n    return record;\n  }\n\n  defineProperty(record, UNSAFE_KEY, {\n    value: record[UNSAFE_KEY],\n    writable: true,\n    enumerable: false,\n    configurable: true,\n  });\n\n  return record;\n}\n\n/**\n * Write one field of a record core BUILDS under a key it did not choose.\n *\n * ⚑ The rule this exists to enforce: **a caller's object contributes DATA, and\n * nothing else.** No trap, no accessor, no inherited member of a bag handed to\n * the router may change what the router ends up holding — which is what\n * \"treat it as a pure dictionary\" means on the WRITE side. `Object.keys` and\n * the one-read-per-key discipline (#1854 / #1899) already say it on the read\n * side; this is the other half.\n *\n * Plain `target[key] = value` cannot say it. `[[Set]]` walks the prototype\n * chain first, so a key that resolves to an accessor or a non-writable data\n * property up there is HIJACKED — the write dispatches into application code\n * (or is silently dropped in sloppy mode, and throws in a module). The key's\n * provenance is irrelevant: `SegmentMatcher` writes a name straight off the\n * ROUTE TABLE, so `id` / `tab` / `page` are as exposed as `__proto__` (#1852),\n * and a name-based skip therefore cannot close it.\n *\n * `Object.defineProperty` CAN say it — it ignores the chain entirely — but it\n * measures ~100 ns per field against ~0 for a store, which is why #1852 priced\n * it as unaffordable on a path that runs per navigation and per `<Link>`\n * render.\n *\n * So the write is guarded rather than replaced: **ask the chain first, and pay\n * only where it answers.** In a pristine environment `in` answers `false` for\n * every name an application routes under, so the store is taken and nothing is\n * paid. It covers both halves of the hazard, which a `__proto__` name test does\n * not: an accessor (getter-only THROWS, getter+setter silently diverts the\n * value) and a **non-writable** data property. Verified on all four shapes plus\n * the overwrite cases.\n *\n * ⚠ It asks `key in target`, NOT `key in Object.prototype`, and the difference\n * is the whole robustness of the primitive rather than a style choice. The\n * cheaper form is right only while every target is a fresh `{}`, i.e. while its\n * chain IS `Object.prototype` — measured, a target inheriting the accessor from\n * anywhere else walks straight past that predicate and throws. Asking the\n * object\n * being written to cannot be wrong for any target. Measured cost of the\n * difference, measured when the two forms were compared directly: a wash on\n * every arc, bought for a predicate with no precondition. ⚠ Those figures\n * predate both the `!hasOwn` term and the restored channel skips, and the\n * number\n * that supersedes them is below — the whole guard sits under the noise floor,\n * so\n * the choice between the two predicates cannot be visible in it.\n *\n * ⚑ **`&& !hasOwn`, and that second term is not an optimisation — it is what\n * keeps this a guarded WRITE instead of a redefinition.** When the key is\n * already an OWN property of the target, `[[Set]]` finds it and never consults\n * the chain, so a plain store is both safe AND semantically right there.\n * `defineProperty` is not: it replaces the whole DESCRIPTOR with this\n * function's\n * fixed one, and that has three measured consequences.\n *\n *   - It **throws where a plain store works**: a `configurable: false` own key\n *     (a sealed target, an array's `length`) refuses `defineProperty` while\n *     accepting an assignment.\n *   - It **silently unlocks**: an own `writable: false` key was overwritten and\n *     came back writable, and an own `enumerable: false` key came back\n *     enumerable — a \"guarded write\" that also removes the guard.\n *   - It **changed a shipped shape**, which is how this was caught rather than\n *     reasoned about. `RouterError`'s own `stack` is a non-enumerable accessor;\n *     `wrapSyncError` passes `stack` through here, so every error built from a\n *     thrown one gained an own enumerable `stack`. `Object.keys(err)` changed,\n *     and two errors differing only in stack stopped comparing equal under\n *     `isDeepStrictEqual` / `toEqual`. The two arms of `rethrowAsRouterError`\n *     disagreed with each other, because one of them assigns.\n *\n * `in` answers `false` for a fresh bag's new key and short-circuits, so\n * `hasOwn`\n * runs only on the rare branch it disambiguates. ⚠ That short-circuit does NOT\n * leave the hot path untouched — one dictionary lookup per written field is the\n * price, and it is measured below.\n *\n * ⚠ The alternative that looks equivalent and is not: a prototype-less target.\n * It also closes the axis, and it costs far MORE, because the price is not on\n * the write at all — V8 puts such an object in dictionary mode, so every later\n * READ of the bag pays. Re-measured on the SHIPPED tree rather than carried\n * over from an earlier one: `buildPath` goes **+65.4 %** (one path slot) and\n * **+36.2 %** (slot + query). `{ __proto__: null }` as a literal is no better\n * (76 ns vs 70 ns for `Object.create(null)`, against 7.5 ns plain).\n *\n * ⚑ **The guard COSTS, and \"not measurable\" is a resolution artefact.** Medians\n * of five floor at an A/A of 5-6 %, which hides it; on a quiet machine this\n * harness floors at 0.1-1.7 %, and at that resolution the cost is plain.\n * Same-session A/B, ALTERNATING PROCESSES (two\n * copies of the module in one process is not a valid A/B), medians of 20 pairs,\n * against the SHIPPED bundle rather than `src`, each arc's own A/A floor in\n * brackets:\n *\n *     buildPath, splat param     232.4 -> 260.3 ns   +12.0 %  (0.7 %)\n *     isActiveRoute, exact       117.5 -> 125.4 ns    +6.8 %  (0.1 %)\n *     matchPath, path params     664.0 -> 693.8 ns    +4.5 %  (0.8 %)\n *     buildPath, static           97.5 ->  99.2 ns    +1.7 %  (1.7 %)\n *     buildPath, one path slot   145.0 -> 140.5 ns    -3.1 %  (1.0 %)\n *     isActiveRoute, sibling      38.4 ->  38.3 ns    -0.3 %  (0.3 %)\n *\n * Isolated by building the tree with the predicate replaced by `false`: it is\n * worth -6.1 % on the splat arc and -7.5 % on the exact one, i.e. the whole of\n * the regression there; the rest of `matchPath`'s is `withoutUnsafeKey`\n * (#1904), -2.1 %.\n *\n * ⚠ The old claim was less a bad measurement than a measurement of the WRONG\n * ARCS. `warm-params` and the sibling arm genuinely do not move — those are the\n * two it sampled — while the splat and exact arms do. Sampling what does not\n * move and generalising to \"not measurable\" is the same trap the reachability\n * arguments elsewhere in this file are written against.\n *\n * The price is ACCEPTED, deliberately, and three cheaper forms were measured\n * and rejected before accepting it:\n *\n *   - asking a captured `Object.prototype` instead of the target, so the `in`\n *     receiver is monomorphic: every arc inside the A/A floor. The cost is the\n *     dictionary lookup, not who is asked.\n *   - a prototype-less accumulator in `normalizeChannel` published through\n *     `publishRecord`: **+134 % … +284 %** — the dictionary-mode price above,\n *     now measured end to end rather than argued.\n *   - an optimistic plain store repaired afterwards (`hasOwn` + `try`/`catch`):\n *     -3.5 % and -2.8 % on two arcs but **+8.3 %** on a third, and it re-opens\n *     the descriptor question `&& !hasOwn(target, key)` exists to close.\n *\n * ⚠ **CodSpeed reports this change at -13.83 %, and that is not the shipped\n * cost.** The gap is measured, not assumed. The suite runs\n * `tsx tests/benchmarks/run.ts` — against `src`, unbundled — so its flamegraph\n * carries ESM module-namespace getter frames (`get (ingest.ts)`, 2.67 % of one\n * arc) that the bundle does not have: `grep -c 'get: ()' dist/esm/index.mjs` is\n * 0. `Simulation` mode additionally over-counts instructions a superscalar CPU\n * hides. On the worst-reported arc the sign inverts — -17.25 % simulated,\n * -3.1 % (i.e. FASTER) in the bundle.\n *\n * A prototype-less channel additionally changes a PUBLISHED shape:\n * `state.params` would stop inheriting from `Object.prototype`, which reds\n * tests across **17 packages**, none of them for a behavioural reason.\n *\n * ⚠ **The package count is the half that holds; the TEST count is not restated,\n * because it moves with the tier while the shape does not.** Published as \"263\n * in 15\", corrected to 352/17 by a full-monorepo run, and 374/17 when re-run on\n * 2026-09-04 — three figures, one answer. Re-run the mutation rather than trust\n * a number here: make the two channel singletons and the channel accumulators\n * `Object.create(null)` and run the monorepo. It was never a question of which\n * sites to mutate, because 17 came back every time.\n *\n * The qualitative half is the load-bearing one: the failures are\n * `AssertionError`, none are thrown; they are `toStrictEqual` cells plus a\n * handful of explicit prototype pins; and NO `toEqual` / `toMatchObject` cell\n * moves, which is the internal control that only the prototype axis shifted.\n *\n * ⚑ `defineProperty` also makes `__proto__` an ordinary own key rather than a\n * write that swaps the target's prototype — which is why the `claim.write`\n * (#1191), `assignParam` (#855) and custom-field (#1788) special cases could be\n * replaced by this one primitive instead of kept beside it.\n *\n * ⚠ **It does NOT decide whether that key is PUBLISHED, and the two questions\n * were briefly conflated here.** The channel copy sites in `helpers.ts` still\n * drop `__proto__` before it reaches `state.params` / `state.search`, and that\n * skip is orthogonal to this primitive: a bag core hands BACK carrying the key\n * is a prototype-swap primitive for any consumer that merges it with\n * `Object.assign` — measured, `?__proto__` alone yields `null` and\n * `?__proto__=1&__proto__=2` an array, and the inherited setter accepts both.\n * `getDependenciesApi.getAll()` deletes the same key for the same reason and in\n * those words. Where the record does NOT escape to a merging consumer — a\n * route's custom fields, a plugin's context namespace — the key stays as data,\n * which is what #1788 and #1191 are about.\n */\nexport function putField<V>(\n  target: Record<string, V>,\n  key: string,\n  value: V,\n): void {\n  if (key in target && !hasOwn(target, key)) {\n    defineProperty(target, key, {\n      value,\n      writable: true,\n      enumerable: true,\n      configurable: true,\n    });\n  } else {\n    target[key] = value;\n  }\n}\n\n/**\n * {@link putField} for a whole source record — what `Object.assign` would do,\n * without the hazard.\n *\n * ⚑ It exists because `Object.assign` IS the hazard, written in a form a census\n * keyed on `dst[key] = value` cannot see. It copies with `[[Set]]`, one key at\n * a\n * time, so every argument in {@link putField}'s docblock applies to it verbatim\n * — and it is the reason this class needed a second look after the obvious\n * sweep: the matcher's junction walk builds `childParams` with a computed-key\n * literal (safe: that DEFINES) and then commits it with `Object.assign` (not).\n * Measured with an ambient setter under a route's own param name, the route\n * still MATCHED and `state.params` came back empty — the URL's parameter gone,\n * with no error anywhere.\n *\n * `Object.entries` for the walk: it hands back the value it already read, so\n * there is exactly ONE read per key and no window for a drifting accessor\n * between the test and the use (#1899). It is also the idiom the sibling copy\n * loops use.\n *\n * ⚠ **Two things it does NOT buy, both measured.**\n *\n *   - It is **not** a filter against a lying Proxy source. `ownKeys` is asked\n *     first, so a key that list does not contain cannot appear — but a source\n *     whose `ownKeys` DOES name a phantom and whose descriptor trap calls it\n *     enumerable gets that phantom copied, identically to `Object.assign`. The\n *     #1854 protection is narrower than \"the trap is never consulted\".\n *   - It is **not** a drop-in for `Object.assign`. `Object.entries` is\n *     string-keyed, so own enumerable SYMBOL entries are dropped where\n *     `Object.assign` copies them. That matches core's stated policy for the\n * channels (\"symbols are dropped, always\") and is a real behaviour difference\n *     from `Object.assign` at one call site (`persistent-params`' factory). ⚠ It also disagrees with `publishRecord`\n *     two functions up, which spreads and therefore keeps symbols — the same\n *     internal split `helpers.ts` records as the #1792 defect.\n */\nexport function copyFields<V>(\n  target: Record<string, V>,\n  source: Record<string, V>,\n): void {\n  for (const [key, value] of objectEntries(source)) {\n    putField(target, key, value);\n  }\n}\n"],"mappings":"AA0BA,MAAa,EAAkC,OAAO,OAAO,CAC3D,mBAAoB,cACpB,uBAAwB,yBACxB,uBAAwB,kBACxB,gBAAiB,kBACjB,YAAa,cACb,kBAAmB,oBACnB,gBAAiB,kBACjB,eAAgB,iBAChB,qBAAsB,YACtB,gBAAiB,WACjB,gBAAiB,kBACjB,kCAAmC,oCACnC,qBAAsB,uBACtB,wBAAyB,0BACzB,mBAAoB,cACpB,cAAe,eACjB,CAAC,EAMY,EAAgB,yBAyBhB,EAAa,YAEb,EAAuB,OAAO,OAAO,CAChD,eACF,CAAC,EAMY,EAA4B,OAAO,OAAO,CACrD,aAAc,UACd,YAAa,SACb,iBAAkB,oBAClB,yBAA0B,2BAC1B,kBAAmB,qBACnB,mBAAoB,sBACpB,iBAAkB,mBACpB,CAAC,EAMY,EAAyB,OAAO,OAAO,CAClD,aAAc,SACd,YAAa,QACb,iBAAkB,UAClB,yBAA0B,iBAC1B,kBAAmB,WACnB,mBAAoB,YACpB,iBAAkB,SACpB,CAAC,EAEY,EAAiB,OAAO,OAAO,CAC1C,gBAAiB,IACjB,WAAY,GACZ,aAAc,IACd,cAAe,IACf,qBAAsB,GACxB,CAAU,EAEG,EAAgD,OAAO,OAAO,CAAC,CAAC,EAQhE,EAAgD,OAAO,OAAO,CAAC,CAAC,EAWhE,EAA8C,OAAO,OAAO,CAAC,CAAC,EAErE,EAAwB,OAAO,OAAO,CAC1C,YAAa,OAAO,OAAO,CAAC,CAAC,EAC7B,UAAW,OAAO,OAAO,CAAC,CAAC,EAC3B,aAAc,EAChB,CAAC,EAEY,EAAqB,OAAO,OAAO,CAC9C,MAAO,aACP,OAAQ,UACR,SAAU,CACZ,CAAC,ECjGK,EAAe,OAAO,OAEtB,EAAgB,OAAO,QAkB7B,SAAgB,GAAoC,CAClD,OAAO,EAAa,IAAI,CAC1B,CAyBA,SAAgB,EAAiB,EAA8C,CAC7E,MAAO,CAAE,GAAG,CAAO,CACrB,CAQA,MAAM,EAAiB,OAAO,eACxB,EAAS,OAAO,OA2CtB,SAAgB,EACd,EACmB,CAYnB,OAXK,EAAO,EAAA,WAAkB,GAI9B,EAAe,EAAQ,EAAY,CACjC,MAAO,EAAO,GACd,SAAU,GACV,WAAY,GACZ,aAAc,EAChB,CAAC,EARQ,CAWX,CAsKA,SAAgB,EACd,EACA,EACA,EACM,CACF,KAAO,GAAU,CAAC,EAAO,EAAQ,CAAG,EACtC,EAAe,EAAQ,EAAK,CAC1B,QACA,SAAU,GACV,WAAY,GACZ,aAAc,EAChB,CAAC,EAED,EAAO,GAAO,CAElB,CAqCA,SAAgB,EACd,EACA,EACM,CACN,IAAK,GAAM,CAAC,EAAK,KAAU,EAAc,CAAM,EAC7C,EAAS,EAAQ,EAAK,CAAK,CAE/B"}