@reckona/mreact-router 0.0.152 → 0.0.154

package/dist/navigation.js

@@ -46,6 +46,11 @@ function throwUnsafeRedirect(location) {
 function throwUnsafeRewrite(location) {
     throw new TypeError(`unsafe rewrite target: ${JSON.stringify(location)}`);
 }
+/**
+ * Throws an internal redirect for loaders, middleware, route handlers, or server actions.
+ *
+ * The target must be same-origin or relative; use `redirectExternal()` for trusted `http` or `https` destinations. The default status is `303`.
+ */
 export function redirect(location, options = {}) {
     if (!isSafeInternalRedirect(location)) {
         throwUnsafeRedirect(location);
@@ -56,6 +61,11 @@ export function redirect(location, options = {}) {
         status: options.status ?? 303,
     });
 }
+/**
+ * Throws an external redirect for trusted `http` or `https` destinations.
+ *
+ * This helper is intentionally separate from `redirect()` so off-site navigation is explicit. The default status is `307`.
+ */
 export function redirectExternal(location, options = {}) {
     if (!isSafeExternalRedirect(location)) {
         throwUnsafeRedirect(location);
@@ -66,6 +76,11 @@ export function redirectExternal(location, options = {}) {
         status: options.status ?? 307,
     });
 }
+/**
+ * Creates a same-origin `303 See Other` redirect response.
+ *
+ * Use this from route handlers when returning a `Response` is more convenient than throwing through the app-router control flow.
+ */
 export function redirect303(location, init = {}) {
     if (!isSafeInternalRedirect(location)) {
         throwUnsafeRedirect(location);
@@ -78,6 +93,9 @@ export function redirect303(location, init = {}) {
         status: 303,
     });
 }
+/**
+ * Creates a plain-text error response with a default `text/plain` content type.
+ */
 export function textError(message, status = 400, init = {}) {
     const headers = new Headers(init.headers);
     if (!headers.has("content-type")) {
@@ -93,18 +111,34 @@ export async function parseForm(request, schema) {
     const form = await request.formData();
     return schema === undefined ? form : schema.parse(form);
 }
+/**
+ * Throws a route-level 404 control error.
+ *
+ * Use this from loaders, metadata, middleware, or route handlers when the matched route is valid but the requested resource is absent.
+ */
 export function notFound() {
     throw Object.assign(new Error("Not Found"), {
         name: notFoundErrorName,
         status: 404,
     });
 }
+/**
+ * Alias for `notFound()` for codebases that prefer an explicit throwing helper name.
+ */
 export function throwNotFound() {
     return notFound();
 }
+/**
+ * Continues middleware processing without changing the request.
+ */
 export function next() {
     return undefined;
 }
+/**
+ * Creates an internal rewrite response consumed by app-router middleware.
+ *
+ * The target must be a same-origin route path, query, hash, or relative URL; protocol-relative, external, and control-character targets are rejected.
+ */
 export function rewrite(location, init = {}) {
     if (!isSafeInternalRedirect(location)) {
         throwUnsafeRewrite(location);
@@ -120,9 +154,15 @@ export function rewrite(location, init = {}) {
     });
     return response;
 }
+/**
+ * Creates a JSON response using the platform `Response.json()` implementation.
+ */
 export function json(value, init) {
     return Response.json(value, init);
 }
+/**
+ * Creates an HTML response and defaults the content type to `text/html; charset=utf-8`.
+ */
 export function html(value, init = {}) {
     if (init.headers === undefined) {
         return new Response(value, {
@@ -139,9 +179,17 @@ export function html(value, init = {}) {
         headers,
     });
 }
+/**
+ * Returns the request headers object for route code that follows app-router helper naming.
+ */
 export function headers(request) {
     return request.headers;
 }
+/**
+ * Parses request cookies into a small read-only helper.
+ *
+ * Values are decoded with `decodeURIComponent`; malformed encoded values are ignored rather than throwing during request handling.
+ */
 export function cookies(request) {
     let values;
     const cookieValues = () => {

package/dist/navigation.js.map

@@ -1 +1 @@
-{"version":3,"file":"navigation.js","sourceRoot":"","sources":["../src/navigation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAY1E,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,SAAS,+BAA+B,CAAC,KAAa;IACpD,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/D,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,+EAA+E;AAC/E,uEAAuE;AACvE,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,sDAAsD;IACtD,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC;AACjD,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,IAAI,SAAS,CACjB,2BAA2B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mFAAmF,CACvI,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,SAAS,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,UAA2B,EAAE;IACtE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,QAAQ,EAAE,CAAC,EAAE;QACxD,QAAQ;QACR,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,UAA2B,EAAE;IAE7B,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,QAAQ,EAAE,CAAC,EAAE;QACxD,QAAQ;QACR,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG;KAC9B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,OAAqB,EAAE;IACnE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAElC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,GAAG,IAAI;QACP,OAAO;QACP,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG,EAAE,OAAqB,EAAE;IAC9E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC3B,GAAG,IAAI;QACP,OAAO;QACP,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAgB,EAChB,MAAuB;IAEvB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAEtC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE;QAC1C,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,QAAQ,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,IAAI;IAClB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,OAAqB,EAAE;IAC/D,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QAClC,GAAG,IAAI;QACP,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG;KAC3B,CAAC,CAAC;IAEH,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,qBAAqB,EAAE;QACrD,YAAY,EAAE,KAAK;QACnB,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAc,EAAE,IAAmB;IACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,OAAqB,EAAE;IACzD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE;YACzB,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE;QACzB,GAAG,IAAI;QACP,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAgB;IACtC,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAQD,MAAM,UAAU,OAAO,CAAC,OAAgB;IACtC,IAAI,MAA+C,CAAC;IACpD,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,MAAM,KAAK,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE;QACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;QACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAkB;IAChD,MAAM,MAAM,GAAI,QAAkD,CAAC,qBAAqB,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ;QAC1C,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;IAEzD,OAAO,SAAS,KAAK,SAAS,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,KAAK,YAAY,KAAK;QAC3B,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAChC,OAAQ,KAAgC,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC;AACpE,CAAC","sourcesContent":["import { parseCookieHeader } from \"./cookies.js\";\n\nconst redirectErrorName = \"MReactRedirect\";\nconst notFoundErrorName = \"MReactNotFound\";\nconst rewriteHeaderName = \"x-mreact-rewrite\";\nconst rewriteLocationSymbol = Symbol.for(\"mreact.router.rewriteLocation\");\n\nexport interface RedirectOptions {\n  status?: 301 | 302 | 303 | 307 | 308;\n}\n\nexport type MiddlewareNext = undefined;\n\nexport interface ParseSchema<T> {\n  parse(value: FormData): T;\n}\n\n// Strip leading C0 controls + ASCII whitespace per WHATWG URL parsing.\n// Browsers ignore these characters when resolving the Location header,\n// so attacker payloads must be rejected after the same normalization.\nfunction stripLeadingControlOrWhitespace(value: string): string {\n  let start = 0;\n\n  while (start < value.length && value.charCodeAt(start) <= 0x20) {\n    start += 1;\n  }\n\n  return value.slice(start);\n}\n\n// Returns true if `location` is safe to use as a same-origin Location header.\n// Allowed: path-absolute (`/foo`), query-only (`?x=1`), hash-only (`#x`),\n// relative (`foo`). Rejected: protocol-relative (`//evil`), backslash variants\n// (`/\\evil`, `\\\\evil`), and anything with a scheme like `javascript:`.\nfunction isSafeInternalRedirect(location: string): boolean {\n  const trimmed = stripLeadingControlOrWhitespace(location);\n  if (trimmed === \"\") return false;\n  if (trimmed.startsWith(\"//\")) return false;\n  if (trimmed.startsWith(\"/\\\\\")) return false;\n  if (trimmed.startsWith(\"\\\\\")) return false;\n  // Reject anything that parses as a URL with a scheme.\n  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) return false;\n  return true;\n}\n\nfunction isSafeExternalRedirect(location: string): boolean {\n  const trimmed = stripLeadingControlOrWhitespace(location);\n  const match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(trimmed);\n  if (match === null || match[1] === undefined) return false;\n  const scheme = match[1].toLowerCase();\n  return scheme === \"http\" || scheme === \"https\";\n}\n\nfunction throwUnsafeRedirect(location: string): never {\n  throw new TypeError(\n    `unsafe redirect target: ${JSON.stringify(location)} - use redirectExternal() for off-site destinations and ensure the URL is http(s)`,\n  );\n}\n\nfunction throwUnsafeRewrite(location: string): never {\n  throw new TypeError(`unsafe rewrite target: ${JSON.stringify(location)}`);\n}\n\nexport function redirect(location: string, options: RedirectOptions = {}): never {\n  if (!isSafeInternalRedirect(location)) {\n    throwUnsafeRedirect(location);\n  }\n  throw Object.assign(new Error(`Redirect to ${location}`), {\n    location,\n    name: redirectErrorName,\n    status: options.status ?? 303,\n  });\n}\n\nexport function redirectExternal(\n  location: string,\n  options: RedirectOptions = {},\n): never {\n  if (!isSafeExternalRedirect(location)) {\n    throwUnsafeRedirect(location);\n  }\n  throw Object.assign(new Error(`Redirect to ${location}`), {\n    location,\n    name: redirectErrorName,\n    status: options.status ?? 307,\n  });\n}\n\nexport function redirect303(location: string, init: ResponseInit = {}): Response {\n  if (!isSafeInternalRedirect(location)) {\n    throwUnsafeRedirect(location);\n  }\n\n  const headers = new Headers(init.headers);\n  headers.set(\"location\", location);\n\n  return new Response(null, {\n    ...init,\n    headers,\n    status: 303,\n  });\n}\n\nexport function textError(message: string, status = 400, init: ResponseInit = {}): Response {\n  const headers = new Headers(init.headers);\n\n  if (!headers.has(\"content-type\")) {\n    headers.set(\"content-type\", \"text/plain; charset=utf-8\");\n  }\n\n  return new Response(message, {\n    ...init,\n    headers,\n    status,\n  });\n}\n\nexport async function parseForm(request: Request): Promise<FormData>;\nexport async function parseForm<T>(request: Request, schema: ParseSchema<T>): Promise<T>;\nexport async function parseForm<T>(\n  request: Request,\n  schema?: ParseSchema<T>,\n): Promise<FormData | T> {\n  const form = await request.formData();\n\n  return schema === undefined ? form : schema.parse(form);\n}\n\nexport function notFound(): never {\n  throw Object.assign(new Error(\"Not Found\"), {\n    name: notFoundErrorName,\n    status: 404,\n  });\n}\n\nexport function throwNotFound(): never {\n  return notFound();\n}\n\nexport function next(): MiddlewareNext {\n  return undefined;\n}\n\nexport function rewrite(location: string, init: ResponseInit = {}): Response {\n  if (!isSafeInternalRedirect(location)) {\n    throwUnsafeRewrite(location);\n  }\n\n  const response = new Response(null, {\n    ...init,\n    status: init.status ?? 200,\n  });\n\n  Object.defineProperty(response, rewriteLocationSymbol, {\n    configurable: false,\n    enumerable: false,\n    value: location,\n  });\n\n  return response;\n}\n\nexport function json(value: unknown, init?: ResponseInit): Response {\n  return Response.json(value, init);\n}\n\nexport function html(value: string, init: ResponseInit = {}): Response {\n  if (init.headers === undefined) {\n    return new Response(value, {\n      ...init,\n      headers: { \"content-type\": \"text/html; charset=utf-8\" },\n    });\n  }\n\n  const headers = new Headers(init.headers);\n\n  if (!headers.has(\"content-type\")) {\n    headers.set(\"content-type\", \"text/html; charset=utf-8\");\n  }\n\n  return new Response(value, {\n    ...init,\n    headers,\n  });\n}\n\nexport function headers(request: Request): Headers {\n  return request.headers;\n}\n\nexport interface RequestCookies {\n  entries(): IterableIterator<[string, string]>;\n  get(name: string): string | undefined;\n  has(name: string): boolean;\n}\n\nexport function cookies(request: Request): RequestCookies {\n  let values: ReadonlyMap<string, string> | undefined;\n  const cookieValues = () => {\n    values ??= parseCookieHeader(request.headers.get(\"cookie\"));\n    return values;\n  };\n\n  return {\n    entries: () => cookieValues().entries(),\n    get: (name) => cookieValues().get(name),\n    has: (name) => cookieValues().has(name),\n  };\n}\n\nexport function rewriteLocation(response: Response): string | undefined {\n  const marked = (response as { [rewriteLocationSymbol]?: unknown })[rewriteLocationSymbol];\n  const candidate = typeof marked === \"string\"\n    ? marked\n    : response.headers.get(rewriteHeaderName) ?? undefined;\n\n  return candidate !== undefined && isSafeInternalRedirect(candidate) ? candidate : undefined;\n}\n\nexport function isRedirectError(error: unknown): error is Error & { location: string; status: number } {\n  return error instanceof Error &&\n    error.name === redirectErrorName &&\n    typeof (error as { location?: unknown }).location === \"string\";\n}\n\nexport function isNotFoundError(error: unknown): boolean {\n  return error instanceof Error && error.name === notFoundErrorName;\n}\n"]}
+{"version":3,"file":"navigation.js","sourceRoot":"","sources":["../src/navigation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,iBAAiB,GAAG,gBAAgB,CAAC;AAC3C,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAC7C,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAY1E,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,SAAS,+BAA+B,CAAC,KAAa;IACpD,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;QAC/D,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IAED,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,+EAA+E;AAC/E,uEAAuE;AACvE,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,sDAAsD;IACtD,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,OAAO,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC;AACjD,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,IAAI,SAAS,CACjB,2BAA2B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,mFAAmF,CACvI,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,IAAI,SAAS,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,UAA2B,EAAE;IACtE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,QAAQ,EAAE,CAAC,EAAE;QACxD,QAAQ;QACR,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG;KAC9B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,UAA2B,EAAE;IAE7B,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,QAAQ,EAAE,CAAC,EAAE;QACxD,QAAQ;QACR,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,GAAG;KAC9B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,OAAqB,EAAE;IACnE,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAElC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,GAAG,IAAI;QACP,OAAO;QACP,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,MAAM,GAAG,GAAG,EAAE,OAAqB,EAAE;IAC9E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;QAC3B,GAAG,IAAI;QACP,OAAO;QACP,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAgB,EAChB,MAAuB;IAEvB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IAEtC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,EAAE;QAC1C,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,GAAG;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,QAAQ,EAAE,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI;IAClB,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,OAAqB,EAAE;IAC/D,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QAClC,GAAG,IAAI;QACP,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG;KAC3B,CAAC,CAAC;IAEH,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,qBAAqB,EAAE;QACrD,YAAY,EAAE,KAAK;QACnB,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IAEH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI,CAAC,KAAc,EAAE,IAAmB;IACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,IAAI,CAAC,KAAa,EAAE,OAAqB,EAAE;IACzD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE;YACzB,GAAG,IAAI;YACP,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE;QACzB,GAAG,IAAI;QACP,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,OAAgB;IACtC,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,OAAgB;IACtC,IAAI,MAA+C,CAAC;IACpD,MAAM,YAAY,GAAG,GAAG,EAAE;QACxB,MAAM,KAAK,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,OAAO;QACL,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE;QACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;QACvC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAkB;IAChD,MAAM,MAAM,GAAI,QAAkD,CAAC,qBAAqB,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,OAAO,MAAM,KAAK,QAAQ;QAC1C,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,SAAS,CAAC;IAEzD,OAAO,SAAS,KAAK,SAAS,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,KAAK,YAAY,KAAK;QAC3B,KAAK,CAAC,IAAI,KAAK,iBAAiB;QAChC,OAAQ,KAAgC,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAAC;AACpE,CAAC","sourcesContent":["import { parseCookieHeader } from \"./cookies.js\";\n\nconst redirectErrorName = \"MReactRedirect\";\nconst notFoundErrorName = \"MReactNotFound\";\nconst rewriteHeaderName = \"x-mreact-rewrite\";\nconst rewriteLocationSymbol = Symbol.for(\"mreact.router.rewriteLocation\");\n\nexport interface RedirectOptions {\n  status?: 301 | 302 | 303 | 307 | 308;\n}\n\nexport type MiddlewareNext = undefined;\n\nexport interface ParseSchema<T> {\n  parse(value: FormData): T;\n}\n\n// Strip leading C0 controls + ASCII whitespace per WHATWG URL parsing.\n// Browsers ignore these characters when resolving the Location header,\n// so attacker payloads must be rejected after the same normalization.\nfunction stripLeadingControlOrWhitespace(value: string): string {\n  let start = 0;\n\n  while (start < value.length && value.charCodeAt(start) <= 0x20) {\n    start += 1;\n  }\n\n  return value.slice(start);\n}\n\n// Returns true if `location` is safe to use as a same-origin Location header.\n// Allowed: path-absolute (`/foo`), query-only (`?x=1`), hash-only (`#x`),\n// relative (`foo`). Rejected: protocol-relative (`//evil`), backslash variants\n// (`/\\evil`, `\\\\evil`), and anything with a scheme like `javascript:`.\nfunction isSafeInternalRedirect(location: string): boolean {\n  const trimmed = stripLeadingControlOrWhitespace(location);\n  if (trimmed === \"\") return false;\n  if (trimmed.startsWith(\"//\")) return false;\n  if (trimmed.startsWith(\"/\\\\\")) return false;\n  if (trimmed.startsWith(\"\\\\\")) return false;\n  // Reject anything that parses as a URL with a scheme.\n  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(trimmed)) return false;\n  return true;\n}\n\nfunction isSafeExternalRedirect(location: string): boolean {\n  const trimmed = stripLeadingControlOrWhitespace(location);\n  const match = /^([a-zA-Z][a-zA-Z0-9+.-]*):/.exec(trimmed);\n  if (match === null || match[1] === undefined) return false;\n  const scheme = match[1].toLowerCase();\n  return scheme === \"http\" || scheme === \"https\";\n}\n\nfunction throwUnsafeRedirect(location: string): never {\n  throw new TypeError(\n    `unsafe redirect target: ${JSON.stringify(location)} - use redirectExternal() for off-site destinations and ensure the URL is http(s)`,\n  );\n}\n\nfunction throwUnsafeRewrite(location: string): never {\n  throw new TypeError(`unsafe rewrite target: ${JSON.stringify(location)}`);\n}\n\n/**\n * Throws an internal redirect for loaders, middleware, route handlers, or server actions.\n *\n * The target must be same-origin or relative; use `redirectExternal()` for trusted `http` or `https` destinations. The default status is `303`.\n */\nexport function redirect(location: string, options: RedirectOptions = {}): never {\n  if (!isSafeInternalRedirect(location)) {\n    throwUnsafeRedirect(location);\n  }\n  throw Object.assign(new Error(`Redirect to ${location}`), {\n    location,\n    name: redirectErrorName,\n    status: options.status ?? 303,\n  });\n}\n\n/**\n * Throws an external redirect for trusted `http` or `https` destinations.\n *\n * This helper is intentionally separate from `redirect()` so off-site navigation is explicit. The default status is `307`.\n */\nexport function redirectExternal(\n  location: string,\n  options: RedirectOptions = {},\n): never {\n  if (!isSafeExternalRedirect(location)) {\n    throwUnsafeRedirect(location);\n  }\n  throw Object.assign(new Error(`Redirect to ${location}`), {\n    location,\n    name: redirectErrorName,\n    status: options.status ?? 307,\n  });\n}\n\n/**\n * Creates a same-origin `303 See Other` redirect response.\n *\n * Use this from route handlers when returning a `Response` is more convenient than throwing through the app-router control flow.\n */\nexport function redirect303(location: string, init: ResponseInit = {}): Response {\n  if (!isSafeInternalRedirect(location)) {\n    throwUnsafeRedirect(location);\n  }\n\n  const headers = new Headers(init.headers);\n  headers.set(\"location\", location);\n\n  return new Response(null, {\n    ...init,\n    headers,\n    status: 303,\n  });\n}\n\n/**\n * Creates a plain-text error response with a default `text/plain` content type.\n */\nexport function textError(message: string, status = 400, init: ResponseInit = {}): Response {\n  const headers = new Headers(init.headers);\n\n  if (!headers.has(\"content-type\")) {\n    headers.set(\"content-type\", \"text/plain; charset=utf-8\");\n  }\n\n  return new Response(message, {\n    ...init,\n    headers,\n    status,\n  });\n}\n\n/**\n * Reads `request.formData()` and optionally validates it with a schema-like parser.\n *\n * Pass a schema object with `parse(FormData)` when a route handler or server action should receive typed form data.\n */\nexport async function parseForm(request: Request): Promise<FormData>;\nexport async function parseForm<T>(request: Request, schema: ParseSchema<T>): Promise<T>;\nexport async function parseForm<T>(\n  request: Request,\n  schema?: ParseSchema<T>,\n): Promise<FormData | T> {\n  const form = await request.formData();\n\n  return schema === undefined ? form : schema.parse(form);\n}\n\n/**\n * Throws a route-level 404 control error.\n *\n * Use this from loaders, metadata, middleware, or route handlers when the matched route is valid but the requested resource is absent.\n */\nexport function notFound(): never {\n  throw Object.assign(new Error(\"Not Found\"), {\n    name: notFoundErrorName,\n    status: 404,\n  });\n}\n\n/**\n * Alias for `notFound()` for codebases that prefer an explicit throwing helper name.\n */\nexport function throwNotFound(): never {\n  return notFound();\n}\n\n/**\n * Continues middleware processing without changing the request.\n */\nexport function next(): MiddlewareNext {\n  return undefined;\n}\n\n/**\n * Creates an internal rewrite response consumed by app-router middleware.\n *\n * The target must be a same-origin route path, query, hash, or relative URL; protocol-relative, external, and control-character targets are rejected.\n */\nexport function rewrite(location: string, init: ResponseInit = {}): Response {\n  if (!isSafeInternalRedirect(location)) {\n    throwUnsafeRewrite(location);\n  }\n\n  const response = new Response(null, {\n    ...init,\n    status: init.status ?? 200,\n  });\n\n  Object.defineProperty(response, rewriteLocationSymbol, {\n    configurable: false,\n    enumerable: false,\n    value: location,\n  });\n\n  return response;\n}\n\n/**\n * Creates a JSON response using the platform `Response.json()` implementation.\n */\nexport function json(value: unknown, init?: ResponseInit): Response {\n  return Response.json(value, init);\n}\n\n/**\n * Creates an HTML response and defaults the content type to `text/html; charset=utf-8`.\n */\nexport function html(value: string, init: ResponseInit = {}): Response {\n  if (init.headers === undefined) {\n    return new Response(value, {\n      ...init,\n      headers: { \"content-type\": \"text/html; charset=utf-8\" },\n    });\n  }\n\n  const headers = new Headers(init.headers);\n\n  if (!headers.has(\"content-type\")) {\n    headers.set(\"content-type\", \"text/html; charset=utf-8\");\n  }\n\n  return new Response(value, {\n    ...init,\n    headers,\n  });\n}\n\n/**\n * Returns the request headers object for route code that follows app-router helper naming.\n */\nexport function headers(request: Request): Headers {\n  return request.headers;\n}\n\nexport interface RequestCookies {\n  entries(): IterableIterator<[string, string]>;\n  get(name: string): string | undefined;\n  has(name: string): boolean;\n}\n\n/**\n * Parses request cookies into a small read-only helper.\n *\n * Values are decoded with `decodeURIComponent`; malformed encoded values are ignored rather than throwing during request handling.\n */\nexport function cookies(request: Request): RequestCookies {\n  let values: ReadonlyMap<string, string> | undefined;\n  const cookieValues = () => {\n    values ??= parseCookieHeader(request.headers.get(\"cookie\"));\n    return values;\n  };\n\n  return {\n    entries: () => cookieValues().entries(),\n    get: (name) => cookieValues().get(name),\n    has: (name) => cookieValues().has(name),\n  };\n}\n\nexport function rewriteLocation(response: Response): string | undefined {\n  const marked = (response as { [rewriteLocationSymbol]?: unknown })[rewriteLocationSymbol];\n  const candidate = typeof marked === \"string\"\n    ? marked\n    : response.headers.get(rewriteHeaderName) ?? undefined;\n\n  return candidate !== undefined && isSafeInternalRedirect(candidate) ? candidate : undefined;\n}\n\nexport function isRedirectError(error: unknown): error is Error & { location: string; status: number } {\n  return error instanceof Error &&\n    error.name === redirectErrorName &&\n    typeof (error as { location?: unknown }).location === \"string\";\n}\n\nexport function isNotFoundError(error: unknown): boolean {\n  return error instanceof Error && error.name === notFoundErrorName;\n}\n"]}

package/dist/render.d.ts

@@ -1,3 +1,4 @@
+import type { ServerOutputMode, TransformOutput } from "@reckona/mreact-shared/compiler-contract";
 import { type QueryClient } from "@reckona/mreact-query";
 import { type ClientRouteInferenceCache } from "./client-route-inference.js";
 import type { AppRoute, MatchedRoute, RouteMatcher } from "./routes.js";
@@ -36,6 +37,7 @@ export interface RenderAppRequestOptions {
     routes?: readonly AppRoute[] | undefined;
     serverModules?: ReadonlyMap<string, BuiltServerModuleArtifact> | undefined;
     serverModuleCacheVersion?: string | undefined;
+    dev?: boolean | undefined;
     serverSourceFiles?: ReadonlyMap<string, string> | undefined;
     serverActions?: AppRouterServerActionOptions | undefined;
     serverActionReferencesByFile?: ReadonlyMap<string, readonly PreparedFormActionReference[]> | undefined;
@@ -92,6 +94,21 @@ export declare function bundleMiddlewareModuleCode(options: {
     importPolicy?: AppRouterImportPolicy | undefined;
     vitePlugins?: readonly PluginOption[] | undefined;
 }): Promise<string>;
+declare function transformServerModule(options: {
+    code: string;
+    clientBoundaryImports?: readonly string[];
+    clientBoundaryFallbackImports?: readonly string[];
+    filename: string;
+    serverModules?: ReadonlyMap<string, BuiltServerModuleArtifact> | undefined;
+    serverOutput: ServerOutputMode;
+    serverAwaitHydration?: boolean;
+}): TransformOutput;
+export declare const __transformServerModuleForTesting: typeof transformServerModule;
+export declare function __resetProductionRenderWarningsForTesting(): void;
+export declare function __warnProductionRenderWithoutPrebuiltModulesForTesting(options: {
+    dev?: boolean | undefined;
+    serverModules?: ReadonlyMap<string, BuiltServerModuleArtifact> | undefined;
+}): void;
 export declare function bundleRouteLoaderModuleCode(options: {
     appDir: string;
     code: string;
@@ -101,5 +118,22 @@ export declare function bundleRouteLoaderModuleCode(options: {
     importPolicy?: AppRouterImportPolicy | undefined;
     vitePlugins?: readonly PluginOption[] | undefined;
 }): Promise<string>;
+declare function composedRouteMetadataCacheKey(options: {
+    appDir: string;
+    code: string;
+    define?: UserConfig["define"] | undefined;
+    filename: string;
+    importPolicy?: AppRouterImportPolicy | undefined;
+    serverModuleCacheVersion?: string | undefined;
+    vitePlugins?: readonly PluginOption[] | undefined;
+}): string | undefined;
+export declare const __composedRouteMetadataCacheKeyForTesting: typeof composedRouteMetadataCacheKey;
+interface InlineCspTag {
+    attributes: ReadonlyMap<string, string>;
+    content: string;
+    name: "script" | "style";
+}
+declare function inlineCspTags(html: string): InlineCspTag[];
+export declare const __inlineCspTagsForTesting: typeof inlineCspTags;
 export {};
 //# sourceMappingURL=render.d.ts.map

package/dist/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAUA,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAIL,KAAK,yBAAyB,EAE/B,MAAM,6BAA6B,CAAC;AAUrC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAGjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,cAAc,EAMpB,MAAM,YAAY,CAAC;AAUpB,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEnG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,KAAK,EAAmC,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAU7F,OAAO,EAAwC,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;AA8CzB,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,yBAAyB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACrC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,UAAU,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC/C,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAC7B,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,UAAU,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACxC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,CAAC;IACzC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,aAAa,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACzD,4BAA4B,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC,GAC3D,SAAS,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,OAAO,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,EAAE,eAAe,CAAC;CACvB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,4BAA4B,KAClC,QAAQ,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;AAExE,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,EAAE,MAAM,CAAC;IACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,IAAI,CAAC,CA4EhB;AAmND,wBAAgB,6BAA6B,IAAI,sBAAsB,EAAE,CAyDxE;AAiCD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuB1F;AA2FD,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACtC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAE7C,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,iBAAiB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAiBrC;AAgrDD,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB;AAyzDD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,8BAA8B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAEV,gBAAgB,EAChB,eAAe,EAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAIL,KAAK,yBAAyB,EAE/B,MAAM,6BAA6B,CAAC;AAUrC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAGjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,cAAc,EAMpB,MAAM,YAAY,CAAC;AAUpB,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEnG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,KAAK,EAAmC,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAU7F,OAAO,EAAwC,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;AA+CzB,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,yBAAyB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACrC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,UAAU,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC/C,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAC7B,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,UAAU,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACxC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,CAAC;IACzC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAG9C,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,aAAa,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACzD,4BAA4B,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC,GAC3D,SAAS,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,OAAO,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,EAAE,eAAe,CAAC;CACvB;AAED,MAAM,MAAM,qBAAqB,GAAG,CAClC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,4BAA4B,KAClC,QAAQ,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;AAExE,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,EAAE,MAAM,CAAC;IACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,IAAI,CAAC,CA4EhB;AAsND,wBAAgB,6BAA6B,IAAI,sBAAsB,EAAE,CAyDxE;AAiCD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuB1F;AA4GD,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACtC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAE7C,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,iBAAiB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAiBrC;AA0tDD,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB;AA4CD,iBAAS,qBAAqB,CAAC,OAAO,EAAE;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,YAAY,EAAE,gBAAgB,CAAC;IAC/B,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,eAAe,CAsFlB;AAED,eAAO,MAAM,iCAAiC,8BAAwB,CAAC;AAIvE,wBAAgB,yCAAyC,IAAI,IAAI,CAGhE;AAKD,wBAAgB,sDAAsD,CAAC,OAAO,EAAE;IAC9E,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;CAC5E,GAAG,IAAI,CAEP;AA6uDD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,8BAA8B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB;AA8MD,iBAAS,6BAA6B,CAAC,OAAO,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,MAAM,GAAG,SAAS,CAIrB;AAED,eAAO,MAAM,yCAAyC,sCAAgC,CAAC;AAkMvF,UAAU,YAAY;IACpB,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC1B;AAED,iBAAS,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAmDnD;AAED,eAAO,MAAM,yBAAyB,sBAAgB,CAAC"}

package/dist/render.js

@@ -29,7 +29,7 @@ import { invokeRouterInstrumentation, traceContextFromRequest, } from "./trace.j
 import { mergeRouteMiddlewareControls, middlewareMatches, parseRouteMiddlewareControl, parseStaticMiddlewareConfig, shouldSkipMiddleware, validateRouteMiddlewareControl, } from "./middleware.js";
 import { applyFileConventionMetadata, injectHeadMetadata, mergeRouteMetadata, responseHeadersForMetadata, serializeRobots, serializeSitemap, validateRouteMetadata, } from "./metadata.js";
 import { createSlotRenderContext, markShellBoundary, shellBoundaryId, splitLayoutSlot, warnUnconsumedRouteSlots, } from "./layout-composer.js";
-import { importPolicyCacheKey, memoizedHashText, prebuiltRequestModuleArtifact, prebuiltRouteLoaderModuleArtifact, prebuiltServerComponentModuleCode, prebuiltServerModuleOutputMatches, } from "./route-module-loader.js";
+import { importPolicyCacheKey, memoizedHashText, prebuiltRequestModuleArtifact, prebuiltRouteLoaderModuleArtifact, prebuiltServerComponentModuleCode, prebuiltServerModuleOutputMatches, prebuiltServerModuleOutputOptionsMatch, } from "./route-module-loader.js";
 const nativeEscapeTransform = {
     batchImportName: "escapeHtmlBatch",
     batchImportSource: "@reckona/mreact-router/native-escape",
@@ -134,7 +134,7 @@ async function preloadBuiltPageRouteModules(options) {
             serverAwaitHydration: options.analysis.clientInference.client,
         });
         assertNoFatalServerDiagnostics(options.file, streamOutput.diagnostics);
-        await loadServerStreamModule(streamOutput.code, options.file, options.serverModules, options.serverModuleCacheVersion, options.define, options.vitePlugins);
+        await loadServerStreamModule(streamOutput.code, options.file, options.serverModules, options.serverModuleCacheVersion, options.define, options.vitePlugins, undefined, { serverAwaitHydration: options.analysis.clientInference.client });
     }
     await preloadShellModulesForPage({
         appDir: options.appDir,
@@ -193,6 +193,7 @@ function assertNoFatalServerDiagnostics(filename, diagnostics) {
 }
 const serverTransformCache = new Map();
 const serverTransformCacheCounters = createRouterRuntimeCacheCounters();
+const productionDynamicServerTransformWarned = new Set();
 const serverSourceFileCache = new Map();
 const serverSourceFileCacheCounters = createRouterRuntimeCacheCounters();
 const routeSourceAnalysisCache = new Map();
@@ -275,12 +276,25 @@ function finishRenderTimingPhase(timing, startedAt, phaseName) {
     }
     timing.phases[phaseName] = logDurationMs(startedAt);
 }
+async function readSettledPromiseAtNextTask(promise) {
+    return await Promise.race([
+        promise.then((value) => ({ settled: true, value })),
+        new Promise((resolve) => {
+            setTimeout(() => resolve({ settled: false }), 0);
+        }),
+    ]);
+}
 function addRenderTimingPhaseDuration(timing, startedAt, phaseName) {
     if (timing === undefined || startedAt === undefined) {
         return;
     }
     timing.phases[phaseName] = (timing.phases[phaseName] ?? 0) + logDurationMs(startedAt);
 }
+function routeLoaderMayReturnControlResponse(code) {
+    return /\b(?:redirect|redirectExternal|rewrite|notFound|throwNotFound)\s*\(/.test(code) ||
+        /\bnew\s+Response\s*\(/.test(code) ||
+        /\bResponse\.(?:redirect|json)\s*\(/.test(code);
+}
 async function waitForRenderPreload(options, timing) {
     if (options.preload?.wait !== "before-render") {
         return;
@@ -333,6 +347,7 @@ export async function resolveAppRouterMiddleware(options) {
     return { response: middlewareResponse, type: "response" };
 }
 async function renderAppRequestInternal(options) {
+    warnProductionRenderWithoutPrebuiltModules(options);
     const timing = createRenderTiming(options.logger);
     const clientRouteInferenceCache = options.clientRouteInferenceCache ?? createClientRouteInferenceCache();
     let phaseStartedAt = renderTimingPhaseStartedAt(timing);
@@ -413,6 +428,7 @@ async function renderAppRequestInternal(options) {
             appDir: options.appDir,
             filename: "not-found.mreact.tsx",
             pathname: url.pathname,
+            serverSourceFiles: options.serverSourceFiles,
         });
         const response = await renderSpecialRoute({
             appDir: options.appDir,
@@ -735,8 +751,9 @@ async function renderAppRequestInternal(options) {
                 return response;
             }
             let streamData;
-            if (loadingFile === undefined) {
-                phaseStartedAt = renderTimingPhaseStartedAt(timing);
+            let streamDataPromise = dataPromise ?? Promise.resolve(undefined);
+            phaseStartedAt = renderTimingPhaseStartedAt(timing);
+            if (loadingFile === undefined || routeLoaderMayReturnControlResponse(code)) {
                 try {
                     streamData = dataPromise === undefined ? undefined : await dataPromise;
                 }
@@ -747,6 +764,22 @@ async function renderAppRequestInternal(options) {
                     emitRenderTiming(options, timing, streamData.status);
                     return streamData;
                 }
+                streamDataPromise = Promise.resolve(streamData);
+            }
+            else {
+                try {
+                    const settledData = await readSettledPromiseAtNextTask(streamDataPromise);
+                    if (settledData.settled) {
+                        if (settledData.value instanceof Response) {
+                            emitRenderTiming(options, timing, settledData.value.status);
+                            return settledData.value;
+                        }
+                        streamDataPromise = Promise.resolve(settledData.value);
+                    }
+                }
+                finally {
+                    finishRenderTimingPhase(timing, phaseStartedAt, "loaderWaitMs");
+                }
             }
             await waitForRenderPreload(options, timing);
             await loadServerRenderArtifacts(options, matched.route.file, timing);
@@ -774,7 +807,7 @@ async function renderAppRequestInternal(options) {
                     appDir: options.appDir,
                     assetBaseUrl: options.assetBaseUrl,
                     clientRoute,
-                    data: dataPromise ?? Promise.resolve(undefined),
+                    data: streamDataPromise,
                     define: options.define,
                     loadingFile,
                     pageFile: matched.route.file,
@@ -1149,17 +1182,24 @@ async function nearestBoundaryFileForPath(options) {
     const parts = options.pathname
         .replace(/^\/+|\/+$/g, "")
         .split("/")
-        .filter((part) => part.length > 0);
-    return nearestBoundaryFileFromParts({
+        .filter((part) => part.length > 0 && part !== "." && part !== "..");
+    return await nearestBoundaryFileFromParts({
         appDir: options.appDir,
         filename: options.filename,
         parts,
+        serverSourceFiles: options.serverSourceFiles,
     });
 }
 async function nearestBoundaryFileFromParts(options) {
     for (let count = options.parts.length; count >= 0; count -= 1) {
         for (const filename of boundaryFilenameCandidates(options.filename)) {
             const candidate = join(options.appDir, ...options.parts.slice(0, count), filename);
+            if (options.serverSourceFiles !== undefined) {
+                if (options.serverSourceFiles.has(candidate)) {
+                    return candidate;
+                }
+                continue;
+            }
             try {
                 await access(candidate);
                 return candidate;
@@ -1200,11 +1240,18 @@ function boundaryFilenameCandidates(filename) {
     return [standardFilename, filename];
 }
 async function renderSpecialRoute(options) {
-    try {
-        await access(options.routeFile);
+    if (options.serverSourceFiles !== undefined) {
+        if (!options.serverSourceFiles.has(options.routeFile)) {
+            return new Response(options.textFallback, { status: options.status });
+        }
     }
-    catch {
-        return new Response(options.textFallback, { status: options.status });
+    else {
+        try {
+            await access(options.routeFile);
+        }
+        catch {
+            return new Response(options.textFallback, { status: options.status });
+        }
     }
     const props = {
         data: undefined,
@@ -1286,7 +1333,10 @@ async function dispatchServerRoute(options) {
     const module = await loadServerRouteModule(options);
     const handler = module[options.request.method] ?? module.ALL ?? module.default;
     if (typeof handler !== "function") {
-        return new Response("Method Not Allowed", { status: 405 });
+        return new Response("Method Not Allowed", {
+            headers: { allow: allowedServerRouteMethods(module).join(", ") },
+            status: 405,
+        });
     }
     let response;
     try {
@@ -1307,6 +1357,9 @@ async function dispatchServerRoute(options) {
         ? response
         : new Response("Invalid route response", { status: 500 });
 }
+function allowedServerRouteMethods(module) {
+    return ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].filter((method) => typeof module[method] === "function");
+}
 async function dispatchConventionAssetRoute(options) {
     if (options.request.method !== "GET" && options.request.method !== "HEAD") {
         return new Response("Method Not Allowed", {
@@ -1664,7 +1717,7 @@ function transformServerModule(options) {
     const artifact = options.serverModules?.get(options.filename)?.[options.serverOutput];
     if (artifact !== undefined &&
         artifact.sourceHash === sourceHash &&
-        options.serverAwaitHydration !== true) {
+        prebuiltServerModuleOutputOptionsMatch(artifact, options.serverAwaitHydration === true ? { serverAwaitHydration: true } : {})) {
         return {
             code: artifact.code,
             diagnostics: [],
@@ -1690,6 +1743,15 @@ function transformServerModule(options) {
     if (cached !== undefined) {
         return cached;
     }
+    // Only renders that were handed a prebuild map can have a prebuild gap;
+    // dev servers pass no serverModules and transform at request time by design.
+    if (options.serverModules !== undefined) {
+        warnProductionDynamicServerTransform(options.filename, options.serverOutput, artifact === undefined
+            ? "no prebuilt server module for this output mode"
+            : !prebuiltServerModuleOutputOptionsMatch(artifact, options.serverAwaitHydration === true ? { serverAwaitHydration: true } : {})
+                ? `serverAwaitHydration mismatch (artifact=${artifact.metadata?.serverAwaitHydration === true}, requested=${options.serverAwaitHydration === true})`
+                : "stale prebuilt server module (source hash changed)");
+    }
     const output = transform({
         code: options.code,
         ...(options.clientBoundaryImports === undefined
@@ -1708,6 +1770,39 @@ function transformServerModule(options) {
     setBoundedCacheEntry(serverTransformCache, key, output, maxServerTransformCacheEntries, serverTransformCacheCounters);
     return output;
 }
+export const __transformServerModuleForTesting = transformServerModule;
+let productionRenderWithoutPrebuiltModulesWarned = false;
+export function __resetProductionRenderWarningsForTesting() {
+    productionRenderWithoutPrebuiltModulesWarned = false;
+    productionDynamicServerTransformWarned.clear();
+}
+// Covers the deployment that forgot prebuilt modules entirely; per-module
+// gaps inside a provided prebuild map are reported by
+// warnProductionDynamicServerTransform with the affected file instead.
+export function __warnProductionRenderWithoutPrebuiltModulesForTesting(options) {
+    warnProductionRenderWithoutPrebuiltModules(options);
+}
+function warnProductionRenderWithoutPrebuiltModules(options) {
+    if (process.env.NODE_ENV !== "production" ||
+        options.dev === true ||
+        options.serverModules !== undefined ||
+        productionRenderWithoutPrebuiltModulesWarned) {
+        return;
+    }
+    productionRenderWithoutPrebuiltModulesWarned = true;
+    console.warn("mreact router: production render without prebuilt serverModules. Request-time transforms use development compiler settings; pass the build output's serverModules (or set dev: true for dev servers).");
+}
+function warnProductionDynamicServerTransform(filename, serverOutput, reason) {
+    if (process.env.NODE_ENV !== "production") {
+        return;
+    }
+    const warnedKey = `${filename}\0${serverOutput}`;
+    if (productionDynamicServerTransformWarned.has(warnedKey)) {
+        return;
+    }
+    productionDynamicServerTransformWarned.add(warnedKey);
+    console.warn(`mreact router: dynamic server transform path ran in production for ${filename} (serverOutput=${serverOutput}): ${reason}. Production deployments should provide prebuilt serverModules; otherwise request-time transforms use development compiler settings.`);
+}
 async function analyzeRouteSource(options) {
     const sourceHash = memoizedHashText(options.code);
     if (options.artifact !== undefined &&
@@ -2123,11 +2218,12 @@ async function renderServerStreamSlots(code, options) {
 function hasRouteSlotsExport(code) {
     return /^\s*export\s+const\s+slots\s*=/m.test(code);
 }
-async function loadServerStreamModule(code, sourcefile, serverModules, serverModuleCacheVersion, define, vitePlugins, importPolicy) {
+async function loadServerStreamModule(code, sourcefile, serverModules, serverModuleCacheVersion, define, vitePlugins, importPolicy, outputOptions = {}) {
     const artifactCode = serverModules?.get(sourcefile)?.stream;
     const codeHash = memoizedHashText(code);
-    const prebuiltCode = prebuiltServerComponentModuleCode(artifactCode, code, codeHash);
+    const prebuiltCode = prebuiltServerComponentModuleCode(artifactCode, code, codeHash, outputOptions);
     if (artifactCode !== undefined &&
+        prebuiltServerModuleOutputOptionsMatch(artifactCode, outputOptions) &&
         prebuiltServerModuleOutputMatches(artifactCode, code, codeHash) &&
         artifactCode.moduleFile !== undefined) {
         return await importBuiltServerModuleFile({
@@ -2806,9 +2902,7 @@ async function bundleRouteMetadataModuleCode(options) {
     return code;
 }
 async function loadComposedRouteMetadata(options) {
-    const cacheKey = options.serverModuleCacheVersion === undefined
-        ? undefined
-        : `${options.appDir}\0${options.filename}\0${options.serverModuleCacheVersion}\0${memoizedHashText(options.code)}\0${viteDefineCacheKey(options.define)}\0${vitePluginsCacheKey(options.vitePlugins)}`;
+    const cacheKey = composedRouteMetadataCacheKey(options);
     if (cacheKey !== undefined) {
         const cached = readRouterRuntimeCacheEntry(composedRouteMetadataCache, cacheKey, composedRouteMetadataCacheCounters);
         if (cached !== undefined) {
@@ -2829,6 +2923,12 @@ async function loadComposedRouteMetadata(options) {
         throw error;
     }
 }
+function composedRouteMetadataCacheKey(options) {
+    return options.serverModuleCacheVersion === undefined
+        ? undefined
+        : `${options.appDir}\0${options.filename}\0${options.serverModuleCacheVersion}\0${memoizedHashText(options.code)}\0${importPolicyCacheKey(options.importPolicy)}\0${viteDefineCacheKey(options.define)}\0${vitePluginsCacheKey(options.vitePlugins)}`;
+}
+export const __composedRouteMetadataCacheKeyForTesting = composedRouteMetadataCacheKey;
 async function loadComposedRouteMetadataUncached(options) {
     const layoutFiles = await shellFilesForPage(options.appDir, options.filename, options.serverModuleCacheVersion);
     const metadata = [];
@@ -2951,21 +3051,47 @@ function cspDirectiveNonces(csp, directive) {
 }
 function inlineCspTags(html) {
     const tags = [];
-    const pattern = /<(script|style)\b([^>]*)>([\s\S]*?)<\/\1>/gi;
-    let match;
-    while ((match = pattern.exec(html)) !== null) {
-        const name = match[1]?.toLowerCase();
-        if (name !== "script" && name !== "style") {
+    const lowerHtml = html.toLowerCase();
+    let position = 0;
+    while (position < html.length) {
+        const scriptIndex = lowerHtml.indexOf("<script", position);
+        const styleIndex = lowerHtml.indexOf("<style", position);
+        const openerIndex = scriptIndex === -1
+            ? styleIndex
+            : styleIndex === -1
+                ? scriptIndex
+                : Math.min(scriptIndex, styleIndex);
+        if (openerIndex === -1) {
+            break;
+        }
+        const name = lowerHtml.startsWith("<script", openerIndex) ? "script" : "style";
+        const tagEnd = html.indexOf(">", openerIndex + 1);
+        if (tagEnd === -1) {
+            break;
+        }
+        const closeToken = `</${name}>`;
+        const closeIndex = lowerHtml.indexOf(closeToken, tagEnd + 1);
+        const nextScriptIndex = lowerHtml.indexOf("<script", tagEnd + 1);
+        const nextStyleIndex = lowerHtml.indexOf("<style", tagEnd + 1);
+        const nextOpenerIndex = nextScriptIndex === -1
+            ? nextStyleIndex
+            : nextStyleIndex === -1
+                ? nextScriptIndex
+                : Math.min(nextScriptIndex, nextStyleIndex);
+        if (closeIndex === -1 || (nextOpenerIndex !== -1 && nextOpenerIndex < closeIndex)) {
+            position = tagEnd + 1;
             continue;
         }
         tags.push({
-            attributes: parseTagAttributes(match[2] ?? ""),
-            content: match[3] ?? "",
+            attributes: parseTagAttributes(html.slice(openerIndex + name.length + 1, tagEnd)),
+            content: html.slice(tagEnd + 1, closeIndex),
             name,
         });
+        position = closeIndex + closeToken.length;
     }
     return tags;
 }
+export const __inlineCspTagsForTesting = inlineCspTags;
 function parseTagAttributes(source) {
     const attributes = new Map();
     const pattern = /([^\s=/>]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g;
@@ -2996,7 +3122,7 @@ function injectQueryState(html, state) {
     }
     const script = `<script type="application/json" id="${__MREACT_QUERY_STATE_SCRIPT_ID}">${escapeJsonForHtml(JSON.stringify(state))}</script>`;
     return /<\/body>/i.test(html)
-        ? html.replace(/<\/body>/i, () => `${script}</body>`)
+        ? replaceFinalBodyCloseTag(html, script)
         : `${html}${script}`;
 }
 function injectAuthSessionClaims(html, claims) {
@@ -3005,9 +3131,17 @@ function injectAuthSessionClaims(html, claims) {
     }
     const script = `<script type="application/json" id="${authSessionScriptId}">${escapeJsonForHtml(JSON.stringify(claims))}</script>`;
     return /<\/body>/i.test(html)
-        ? html.replace(/<\/body>/i, () => `${script}</body>`)
+        ? replaceFinalBodyCloseTag(html, script)
         : `${html}${script}`;
 }
+function replaceFinalBodyCloseTag(html, insertion) {
+    const matches = [...html.matchAll(/<\/body>/gi)];
+    const last = matches.at(-1);
+    if (last?.index === undefined) {
+        return `${html}${insertion}`;
+    }
+    return `${html.slice(0, last.index)}${insertion}${html.slice(last.index)}`;
+}
 function authIncludesClaims(code) {
     return /\bexport\s+const\s+auth\s*=\s*["']include-claims["']\s*;?/.test(code);
 }