@tanstack/router-core 1.159.9 → 1.160.0

package/dist/cjs/router.d.cts

@@ -333,6 +333,14 @@ export interface RouterOptions<TRouteTree extends AnyRoute, TTrailingSlashOption
      * @default false
      */
     disableGlobalCatchBoundary?: boolean;
+    /**
+     * An array of URL protocols to allow in links, redirects, and navigation.
+     * Absolute URLs with protocols not in this list will be rejected.
+     *
+     * @default DEFAULT_PROTOCOL_ALLOWLIST (http:, https:, mailto:, tel:)
+     * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RouterOptionsType#protocolallowlist-property)
+     */
+    protocolAllowlist?: Array<string>;
     serializationAdapters?: ReadonlyArray<AnySerializationAdapter>;
     /**
      * Configures how the router will rewrite the location between the actual href and the internal href of the router.
@@ -586,6 +594,7 @@ export declare class RouterCore<in out TRouteTree extends AnyRoute, in out TTrai
     resolvePathCache: LRUCache<string, string>;
     isServer: boolean;
     pathParamsDecoder?: (encoded: string) => string;
+    protocolAllowlist: Set<string>;
     /**
      * @deprecated Use the `createRouter` function instead
      */

package/dist/cjs/utils.cjs

@@ -187,12 +187,19 @@ function decodeSegment(segment) {
   }
   return sanitizePathSegment(decoded);
 }
-const SAFE_URL_PROTOCOLS = ["http:", "https:", "mailto:", "tel:"];
-function isDangerousProtocol(url) {
+const DEFAULT_PROTOCOL_ALLOWLIST = [
+  // Standard web navigation
+  "http:",
+  "https:",
+  // Common browser-safe actions
+  "mailto:",
+  "tel:"
+];
+function isDangerousProtocol(url, allowlist) {
   if (!url) return false;
   try {
     const parsed = new URL(url);
-    return !SAFE_URL_PROTOCOLS.includes(parsed.protocol);
+    return !allowlist.has(parsed.protocol);
   } catch {
     return false;
   }
@@ -238,7 +245,7 @@ function buildDevStylesUrl(basepath, routeIds) {
   const normalizedBasepath = trimmedBasepath === "" ? "" : `/${trimmedBasepath}`;
   return `${normalizedBasepath}/@tanstack-start/styles.css?routes=${encodeURIComponent(routeIds.join(","))}`;
 }
-exports.SAFE_URL_PROTOCOLS = SAFE_URL_PROTOCOLS;
+exports.DEFAULT_PROTOCOL_ALLOWLIST = DEFAULT_PROTOCOL_ALLOWLIST;
 exports.buildDevStylesUrl = buildDevStylesUrl;
 exports.createControlledPromise = createControlledPromise;
 exports.decodePath = decodePath;

package/dist/cjs/utils.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"utils.cjs","sources":["../../src/utils.ts"],"sourcesContent":["import { isServer } from '@tanstack/router-core/isServer'\nimport type { RouteIds } from './routeInfo'\nimport type { AnyRouter } from './router'\n\nexport type Awaitable<T> = T | Promise<T>\nexport type NoInfer<T> = [T][T extends any ? 0 : never]\nexport type IsAny<TValue, TYesResult, TNoResult = TValue> = 1 extends 0 & TValue\n  ? TYesResult\n  : TNoResult\n\nexport type PickAsRequired<TValue, TKey extends keyof TValue> = Omit<\n  TValue,\n  TKey\n> &\n  Required<Pick<TValue, TKey>>\n\nexport type PickRequired<T> = {\n  [K in keyof T as undefined extends T[K] ? never : K]: T[K]\n}\n\nexport type PickOptional<T> = {\n  [K in keyof T as undefined extends T[K] ? K : never]: T[K]\n}\n\n// from https://stackoverflow.com/a/76458160\nexport type WithoutEmpty<T> = T extends any ? ({} extends T ? never : T) : never\n\nexport type Expand<T> = T extends object\n  ? T extends infer O\n    ? O extends Function\n      ? O\n      : { [K in keyof O]: O[K] }\n    : never\n  : T\n\nexport type DeepPartial<T> = T extends object\n  ? {\n      [P in keyof T]?: DeepPartial<T[P]>\n    }\n  : T\n\nexport type MakeDifferenceOptional<TLeft, TRight> = keyof TLeft &\n  keyof TRight extends never\n  ? TRight\n  : Omit<TRight, keyof TLeft & keyof TRight> & {\n      [K in keyof TLeft & keyof TRight]?: TRight[K]\n    }\n\n// from https://stackoverflow.com/a/53955431\n// eslint-disable-next-line @typescript-eslint/naming-convention\nexport type IsUnion<T, U extends T = T> = (\n  T extends any ? (U extends T ? false : true) : never\n) extends false\n  ? false\n  : true\n\nexport type IsNonEmptyObject<T> = T extends object\n  ? keyof T extends never\n    ? false\n    : true\n  : false\n\nexport type Assign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : keyof TLeft & keyof TRight extends never\n          ? TLeft & TRight\n          : Omit<TLeft, keyof TRight> & TRight\n    : never\n  : never\n\nexport type IntersectAssign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : TRight & TLeft\n    : never\n  : never\n\nexport type Timeout = ReturnType<typeof setTimeout>\n\nexport type Updater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev?: TPrevious) => TResult)\n\nexport type NonNullableUpdater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev: TPrevious) => TResult)\n\nexport type ExtractObjects<TUnion> = TUnion extends MergeAllPrimitive\n  ? never\n  : TUnion\n\nexport type PartialMergeAllObject<TUnion> =\n  ExtractObjects<TUnion> extends infer TObj\n    ? [TObj] extends [never]\n      ? never\n      : {\n          [TKey in TObj extends any ? keyof TObj : never]?: TObj extends any\n            ? TKey extends keyof TObj\n              ? TObj[TKey]\n              : never\n            : never\n        }\n    : never\n\nexport type MergeAllPrimitive =\n  | ReadonlyArray<any>\n  | number\n  | string\n  | bigint\n  | boolean\n  | symbol\n  | undefined\n  | null\n\nexport type ExtractPrimitives<TUnion> = TUnion extends MergeAllPrimitive\n  ? TUnion\n  : TUnion extends object\n    ? never\n    : TUnion\n\nexport type PartialMergeAll<TUnion> =\n  | ExtractPrimitives<TUnion>\n  | PartialMergeAllObject<TUnion>\n\nexport type Constrain<T, TConstraint, TDefault = TConstraint> =\n  | (T extends TConstraint ? T : never)\n  | TDefault\n\nexport type ConstrainLiteral<T, TConstraint, TDefault = TConstraint> =\n  | (T & TConstraint)\n  | TDefault\n\n/**\n * To be added to router types\n */\nexport type UnionToIntersection<T> = (\n  T extends any ? (arg: T) => any : never\n) extends (arg: infer T) => any\n  ? T\n  : never\n\n/**\n * Merges everything in a union into one object.\n * This mapped type is homomorphic which means it preserves stuff! :)\n */\nexport type MergeAllObjects<\n  TUnion,\n  TIntersected = UnionToIntersection<ExtractObjects<TUnion>>,\n> = [keyof TIntersected] extends [never]\n  ? never\n  : {\n      [TKey in keyof TIntersected]: TUnion extends any\n        ? TUnion[TKey & keyof TUnion]\n        : never\n    }\n\nexport type MergeAll<TUnion> =\n  | MergeAllObjects<TUnion>\n  | ExtractPrimitives<TUnion>\n\nexport type ValidateJSON<T> = ((...args: Array<any>) => any) extends T\n  ? unknown extends T\n    ? never\n    : 'Function is not serializable'\n  : { [K in keyof T]: ValidateJSON<T[K]> }\n\nexport type LooseReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn\n  : never\n\nexport type LooseAsyncReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn extends Promise<infer TReturn>\n    ? TReturn\n    : TReturn\n  : never\n\n/**\n * Return the last element of an array.\n * Intended for non-empty arrays used within router internals.\n */\nexport function last<T>(arr: ReadonlyArray<T>) {\n  return arr[arr.length - 1]\n}\n\nfunction isFunction(d: any): d is Function {\n  return typeof d === 'function'\n}\n\n/**\n * Apply a value-or-updater to a previous value.\n * Accepts either a literal value or a function of the previous value.\n */\nexport function functionalUpdate<TPrevious, TResult = TPrevious>(\n  updater: Updater<TPrevious, TResult> | NonNullableUpdater<TPrevious, TResult>,\n  previous: TPrevious,\n): TResult {\n  if (isFunction(updater)) {\n    return updater(previous)\n  }\n\n  return updater\n}\n\nconst hasOwn = Object.prototype.hasOwnProperty\nconst isEnumerable = Object.prototype.propertyIsEnumerable\n\n/**\n * This function returns `prev` if `_next` is deeply equal.\n * If not, it will replace any deeply equal children of `b` with those of `a`.\n * This can be used for structural sharing between immutable JSON values for example.\n * Do not use this with signals\n */\nexport function replaceEqualDeep<T>(prev: any, _next: T, _depth = 0): T {\n  if (isServer) {\n    return _next\n  }\n  if (prev === _next) {\n    return prev\n  }\n\n  if (_depth > 500) return _next\n\n  const next = _next as any\n\n  const array = isPlainArray(prev) && isPlainArray(next)\n\n  if (!array && !(isPlainObject(prev) && isPlainObject(next))) return next\n\n  const prevItems = array ? prev : getEnumerableOwnKeys(prev)\n  if (!prevItems) return next\n  const nextItems = array ? next : getEnumerableOwnKeys(next)\n  if (!nextItems) return next\n  const prevSize = prevItems.length\n  const nextSize = nextItems.length\n  const copy: any = array ? new Array(nextSize) : {}\n\n  let equalItems = 0\n\n  for (let i = 0; i < nextSize; i++) {\n    const key = array ? i : (nextItems[i] as any)\n    const p = prev[key]\n    const n = next[key]\n\n    if (p === n) {\n      copy[key] = p\n      if (array ? i < prevSize : hasOwn.call(prev, key)) equalItems++\n      continue\n    }\n\n    if (\n      p === null ||\n      n === null ||\n      typeof p !== 'object' ||\n      typeof n !== 'object'\n    ) {\n      copy[key] = n\n      continue\n    }\n\n    const v = replaceEqualDeep(p, n, _depth + 1)\n    copy[key] = v\n    if (v === p) equalItems++\n  }\n\n  return prevSize === nextSize && equalItems === prevSize ? prev : copy\n}\n\n/**\n * Equivalent to `Reflect.ownKeys`, but ensures that objects are \"clone-friendly\":\n * will return false if object has any non-enumerable properties.\n *\n * Optimized for the common case where objects have no symbol properties.\n */\nfunction getEnumerableOwnKeys(o: object) {\n  const names = Object.getOwnPropertyNames(o)\n\n  // Fast path: check all string property names are enumerable\n  for (const name of names) {\n    if (!isEnumerable.call(o, name)) return false\n  }\n\n  // Only check symbols if the object has any (most plain objects don't)\n  const symbols = Object.getOwnPropertySymbols(o)\n\n  // Fast path: no symbols, return names directly (avoids array allocation/concat)\n  if (symbols.length === 0) return names\n\n  // Slow path: has symbols, need to check and merge\n  const keys: Array<string | symbol> = names\n  for (const symbol of symbols) {\n    if (!isEnumerable.call(o, symbol)) return false\n    keys.push(symbol)\n  }\n  return keys\n}\n\n// Copied from: https://github.com/jonschlinkert/is-plain-object\nexport function isPlainObject(o: any) {\n  if (!hasObjectPrototype(o)) {\n    return false\n  }\n\n  // If has modified constructor\n  const ctor = o.constructor\n  if (typeof ctor === 'undefined') {\n    return true\n  }\n\n  // If has modified prototype\n  const prot = ctor.prototype\n  if (!hasObjectPrototype(prot)) {\n    return false\n  }\n\n  // If constructor does not have an Object-specific method\n  if (!prot.hasOwnProperty('isPrototypeOf')) {\n    return false\n  }\n\n  // Most likely a plain Object\n  return true\n}\n\nfunction hasObjectPrototype(o: any) {\n  return Object.prototype.toString.call(o) === '[object Object]'\n}\n\n/**\n * Check if a value is a \"plain\" array (no extra enumerable keys).\n */\nexport function isPlainArray(value: unknown): value is Array<unknown> {\n  return Array.isArray(value) && value.length === Object.keys(value).length\n}\n\n/**\n * Perform a deep equality check with options for partial comparison and\n * ignoring `undefined` values. Optimized for router state comparisons.\n */\nexport function deepEqual(\n  a: any,\n  b: any,\n  opts?: { partial?: boolean; ignoreUndefined?: boolean },\n): boolean {\n  if (a === b) {\n    return true\n  }\n\n  if (typeof a !== typeof b) {\n    return false\n  }\n\n  if (Array.isArray(a) && Array.isArray(b)) {\n    if (a.length !== b.length) return false\n    for (let i = 0, l = a.length; i < l; i++) {\n      if (!deepEqual(a[i], b[i], opts)) return false\n    }\n    return true\n  }\n\n  if (isPlainObject(a) && isPlainObject(b)) {\n    const ignoreUndefined = opts?.ignoreUndefined ?? true\n\n    if (opts?.partial) {\n      for (const k in b) {\n        if (!ignoreUndefined || b[k] !== undefined) {\n          if (!deepEqual(a[k], b[k], opts)) return false\n        }\n      }\n      return true\n    }\n\n    let aCount = 0\n    if (!ignoreUndefined) {\n      aCount = Object.keys(a).length\n    } else {\n      for (const k in a) {\n        if (a[k] !== undefined) aCount++\n      }\n    }\n\n    let bCount = 0\n    for (const k in b) {\n      if (!ignoreUndefined || b[k] !== undefined) {\n        bCount++\n        if (bCount > aCount || !deepEqual(a[k], b[k], opts)) return false\n      }\n    }\n\n    return aCount === bCount\n  }\n\n  return false\n}\n\nexport type StringLiteral<T> = T extends string\n  ? string extends T\n    ? string\n    : T\n  : never\n\nexport type ThrowOrOptional<T, TThrow extends boolean> = TThrow extends true\n  ? T\n  : T | undefined\n\nexport type StrictOrFrom<\n  TRouter extends AnyRouter,\n  TFrom,\n  TStrict extends boolean = true,\n> = TStrict extends false\n  ? {\n      from?: never\n      strict: TStrict\n    }\n  : {\n      from: ConstrainLiteral<TFrom, RouteIds<TRouter['routeTree']>>\n      strict?: TStrict\n    }\n\nexport type ThrowConstraint<\n  TStrict extends boolean,\n  TThrow extends boolean,\n> = TStrict extends false ? (TThrow extends true ? never : TThrow) : TThrow\n\nexport type ControlledPromise<T> = Promise<T> & {\n  resolve: (value: T) => void\n  reject: (value: any) => void\n  status: 'pending' | 'resolved' | 'rejected'\n  value?: T\n}\n\n/**\n * Create a promise with exposed resolve/reject and status fields.\n * Useful for coordinating async router lifecycle operations.\n */\nexport function createControlledPromise<T>(onResolve?: (value: T) => void) {\n  let resolveLoadPromise!: (value: T) => void\n  let rejectLoadPromise!: (value: any) => void\n\n  const controlledPromise = new Promise<T>((resolve, reject) => {\n    resolveLoadPromise = resolve\n    rejectLoadPromise = reject\n  }) as ControlledPromise<T>\n\n  controlledPromise.status = 'pending'\n\n  controlledPromise.resolve = (value: T) => {\n    controlledPromise.status = 'resolved'\n    controlledPromise.value = value\n    resolveLoadPromise(value)\n    onResolve?.(value)\n  }\n\n  controlledPromise.reject = (e) => {\n    controlledPromise.status = 'rejected'\n    rejectLoadPromise(e)\n  }\n\n  return controlledPromise\n}\n\n/**\n * Heuristically detect dynamic import \"module not found\" errors\n * across major browsers for lazy route component handling.\n */\nexport function isModuleNotFoundError(error: any): boolean {\n  // chrome: \"Failed to fetch dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // firefox: \"error loading dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // safari: \"Importing a module script failed.\"\n  if (typeof error?.message !== 'string') return false\n  return (\n    error.message.startsWith('Failed to fetch dynamically imported module') ||\n    error.message.startsWith('error loading dynamically imported module') ||\n    error.message.startsWith('Importing a module script failed')\n  )\n}\n\nexport function isPromise<T>(\n  value: Promise<Awaited<T>> | T,\n): value is Promise<Awaited<T>> {\n  return Boolean(\n    value &&\n    typeof value === 'object' &&\n    typeof (value as Promise<T>).then === 'function',\n  )\n}\n\nexport function findLast<T>(\n  array: ReadonlyArray<T>,\n  predicate: (item: T) => boolean,\n): T | undefined {\n  for (let i = array.length - 1; i >= 0; i--) {\n    const item = array[i]!\n    if (predicate(item)) return item\n  }\n  return undefined\n}\n\n/**\n * Remove control characters that can cause open redirect vulnerabilities.\n * Characters like \\r (CR) and \\n (LF) can trick URL parsers into interpreting\n * paths like \"/\\r/evil.com\" as \"http://evil.com\".\n */\nfunction sanitizePathSegment(segment: string): string {\n  // Remove ASCII control characters (0x00-0x1F) and DEL (0x7F)\n  // These include CR (\\r = 0x0D), LF (\\n = 0x0A), and other potentially dangerous characters\n  // eslint-disable-next-line no-control-regex\n  return segment.replace(/[\\x00-\\x1f\\x7f]/g, '')\n}\n\nfunction decodeSegment(segment: string): string {\n  let decoded: string\n  try {\n    decoded = decodeURI(segment)\n  } catch {\n    // if the decoding fails, try to decode the various parts leaving the malformed tags in place\n    decoded = segment.replaceAll(/%[0-9A-F]{2}/gi, (match) => {\n      try {\n        return decodeURI(match)\n      } catch {\n        return match\n      }\n    })\n  }\n  return sanitizePathSegment(decoded)\n}\n\n/**\n * List of URL protocols that are safe for navigation.\n * Only these protocols are allowed in redirects and navigation.\n */\nexport const SAFE_URL_PROTOCOLS = ['http:', 'https:', 'mailto:', 'tel:']\n\n/**\n * Check if a URL string uses a protocol that is not in the safe list.\n * Returns true for dangerous protocols like javascript:, data:, vbscript:, etc.\n *\n * The URL constructor correctly normalizes:\n * - Mixed case (JavaScript: → javascript:)\n * - Whitespace/control characters (java\\nscript: → javascript:)\n * - Leading whitespace\n *\n * For relative URLs (no protocol), returns false (safe).\n *\n * @param url - The URL string to check\n * @returns true if the URL uses a dangerous (non-whitelisted) protocol\n */\nexport function isDangerousProtocol(url: string): boolean {\n  if (!url) return false\n\n  try {\n    // Use the URL constructor - it correctly normalizes protocols\n    // per WHATWG URL spec, handling all bypass attempts automatically\n    const parsed = new URL(url)\n    return !SAFE_URL_PROTOCOLS.includes(parsed.protocol)\n  } catch {\n    // URL constructor throws for relative URLs (no protocol)\n    // These are safe - they can't execute scripts\n    return false\n  }\n}\n\n// This utility is based on https://github.com/zertosh/htmlescape\n// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE\nconst HTML_ESCAPE_LOOKUP: { [match: string]: string } = {\n  '&': '\\\\u0026',\n  '>': '\\\\u003e',\n  '<': '\\\\u003c',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\nconst HTML_ESCAPE_REGEX = /[&><\\u2028\\u2029]/g\n\n/**\n * Escape HTML special characters in a string to prevent XSS attacks\n * when embedding strings in script tags during SSR.\n *\n * This is essential for preventing XSS vulnerabilities when user-controlled\n * content is embedded in inline scripts.\n */\nexport function escapeHtml(str: string): string {\n  return str.replace(HTML_ESCAPE_REGEX, (match) => HTML_ESCAPE_LOOKUP[match]!)\n}\n\nexport function decodePath(path: string) {\n  if (!path) return { path, handledProtocolRelativeURL: false }\n\n  // Fast path: most paths are already decoded and safe.\n  // Only fall back to the slower scan/regex path when we see a '%' (encoded),\n  // a backslash (explicitly handled), a control character, or a protocol-relative\n  // prefix which needs collapsing.\n  // eslint-disable-next-line no-control-regex\n  if (!/[%\\\\\\x00-\\x1f\\x7f]/.test(path) && !path.startsWith('//')) {\n    return { path, handledProtocolRelativeURL: false }\n  }\n\n  const re = /%25|%5C/gi\n  let cursor = 0\n  let result = ''\n  let match\n  while (null !== (match = re.exec(path))) {\n    result += decodeSegment(path.slice(cursor, match.index)) + match[0]\n    cursor = re.lastIndex\n  }\n  result = result + decodeSegment(cursor ? path.slice(cursor) : path)\n\n  // Prevent open redirect via protocol-relative URLs (e.g. \"//evil.com\")\n  // After sanitizing control characters, paths like \"/\\r/evil.com\" become \"//evil.com\"\n  // Collapse leading double slashes to a single slash\n  let handledProtocolRelativeURL = false\n  if (result.startsWith('//')) {\n    handledProtocolRelativeURL = true\n    result = '/' + result.replace(/^\\/+/, '')\n  }\n\n  return { path: result, handledProtocolRelativeURL }\n}\n\n/**\n * Encodes a path the same way `new URL()` would, but without the overhead of full URL parsing.\n *\n * This function encodes:\n * - Whitespace characters (spaces → %20, tabs → %09, etc.)\n * - Non-ASCII/Unicode characters (emojis, accented characters, etc.)\n *\n * It preserves:\n * - Already percent-encoded sequences (won't double-encode %2F, %25, etc.)\n * - ASCII special characters valid in URL paths (@, $, &, +, etc.)\n * - Forward slashes as path separators\n *\n * Used to generate proper href values for SSR without constructing URL objects.\n *\n * @example\n * encodePathLikeUrl('/path/file name.pdf') // '/path/file%20name.pdf'\n * encodePathLikeUrl('/path/日本語') // '/path/%E6%97%A5%E6%9C%AC%E8%AA%9E'\n * encodePathLikeUrl('/path/already%20encoded') // '/path/already%20encoded' (preserved)\n */\nexport function encodePathLikeUrl(path: string): string {\n  // Encode whitespace and non-ASCII characters that browsers encode in URLs\n\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  if (!/\\s|[^\\u0000-\\u007F]/.test(path)) return path\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  return path.replace(/\\s|[^\\u0000-\\u007F]/gu, encodeURIComponent)\n}\n\n/**\n * Builds the dev-mode CSS styles URL for route-scoped CSS collection.\n * Used by HeadContent components in all framework implementations to construct\n * the URL for the `/@tanstack-start/styles.css` endpoint.\n *\n * @param basepath - The router's basepath (may or may not have leading slash)\n * @param routeIds - Array of matched route IDs to include in the CSS collection\n * @returns The full URL path for the dev styles CSS endpoint\n */\nexport function buildDevStylesUrl(\n  basepath: string,\n  routeIds: Array<string>,\n): string {\n  // Trim all leading and trailing slashes from basepath\n  const trimmedBasepath = basepath.replace(/^\\/+|\\/+$/g, '')\n  // Build normalized basepath: empty string for root, or '/path' for non-root\n  const normalizedBasepath = trimmedBasepath === '' ? '' : `/${trimmedBasepath}`\n  return `${normalizedBasepath}/@tanstack-start/styles.css?routes=${encodeURIComponent(routeIds.join(','))}`\n}\n"],"names":["isServer"],"mappings":";;;AA+LO,SAAS,KAAQ,KAAuB;AAC7C,SAAO,IAAI,IAAI,SAAS,CAAC;AAC3B;AAEA,SAAS,WAAW,GAAuB;AACzC,SAAO,OAAO,MAAM;AACtB;AAMO,SAAS,iBACd,SACA,UACS;AACT,MAAI,WAAW,OAAO,GAAG;AACvB,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAEA,SAAO;AACT;AAEA,MAAM,SAAS,OAAO,UAAU;AAChC,MAAM,eAAe,OAAO,UAAU;AAQ/B,SAAS,iBAAoB,MAAW,OAAU,SAAS,GAAM;AACtE,MAAIA,mBAAU;AACZ,WAAO;AAAA,EACT;AACA,MAAI,SAAS,OAAO;AAClB,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,IAAK,QAAO;AAEzB,QAAM,OAAO;AAEb,QAAM,QAAQ,aAAa,IAAI,KAAK,aAAa,IAAI;AAErD,MAAI,CAAC,SAAS,EAAE,cAAc,IAAI,KAAK,cAAc,IAAI,GAAI,QAAO;AAEpE,QAAM,YAAY,QAAQ,OAAO,qBAAqB,IAAI;AAC1D,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,YAAY,QAAQ,OAAO,qBAAqB,IAAI;AAC1D,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,WAAW,UAAU;AAC3B,QAAM,WAAW,UAAU;AAC3B,QAAM,OAAY,QAAQ,IAAI,MAAM,QAAQ,IAAI,CAAA;AAEhD,MAAI,aAAa;AAEjB,WAAS,IAAI,GAAG,IAAI,UAAU,KAAK;AACjC,UAAM,MAAM,QAAQ,IAAK,UAAU,CAAC;AACpC,UAAM,IAAI,KAAK,GAAG;AAClB,UAAM,IAAI,KAAK,GAAG;AAElB,QAAI,MAAM,GAAG;AACX,WAAK,GAAG,IAAI;AACZ,UAAI,QAAQ,IAAI,WAAW,OAAO,KAAK,MAAM,GAAG,EAAG;AACnD;AAAA,IACF;AAEA,QACE,MAAM,QACN,MAAM,QACN,OAAO,MAAM,YACb,OAAO,MAAM,UACb;AACA,WAAK,GAAG,IAAI;AACZ;AAAA,IACF;AAEA,UAAM,IAAI,iBAAiB,GAAG,GAAG,SAAS,CAAC;AAC3C,SAAK,GAAG,IAAI;AACZ,QAAI,MAAM,EAAG;AAAA,EACf;AAEA,SAAO,aAAa,YAAY,eAAe,WAAW,OAAO;AACnE;AAQA,SAAS,qBAAqB,GAAW;AACvC,QAAM,QAAQ,OAAO,oBAAoB,CAAC;AAG1C,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,aAAa,KAAK,GAAG,IAAI,EAAG,QAAO;AAAA,EAC1C;AAGA,QAAM,UAAU,OAAO,sBAAsB,CAAC;AAG9C,MAAI,QAAQ,WAAW,EAAG,QAAO;AAGjC,QAAM,OAA+B;AACrC,aAAW,UAAU,SAAS;AAC5B,QAAI,CAAC,aAAa,KAAK,GAAG,MAAM,EAAG,QAAO;AAC1C,SAAK,KAAK,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAGO,SAAS,cAAc,GAAQ;AACpC,MAAI,CAAC,mBAAmB,CAAC,GAAG;AAC1B,WAAO;AAAA,EACT;AAGA,QAAM,OAAO,EAAE;AACf,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO;AAAA,EACT;AAGA,QAAM,OAAO,KAAK;AAClB,MAAI,CAAC,mBAAmB,IAAI,GAAG;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,CAAC,KAAK,eAAe,eAAe,GAAG;AACzC,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAEA,SAAS,mBAAmB,GAAQ;AAClC,SAAO,OAAO,UAAU,SAAS,KAAK,CAAC,MAAM;AAC/C;AAKO,SAAS,aAAa,OAAyC;AACpE,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE;AACrE;AAMO,SAAS,UACd,GACA,GACA,MACS;AACT,MAAI,MAAM,GAAG;AACX,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,MAAM,OAAO,GAAG;AACzB,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,CAAC,KAAK,MAAM,QAAQ,CAAC,GAAG;AACxC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,aAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAI,GAAG,KAAK;AACxC,UAAI,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAG,QAAO;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AAEA,MAAI,cAAc,CAAC,KAAK,cAAc,CAAC,GAAG;AACxC,UAAM,kBAAkB,MAAM,mBAAmB;AAEjD,QAAI,MAAM,SAAS;AACjB,iBAAW,KAAK,GAAG;AACjB,YAAI,CAAC,mBAAmB,EAAE,CAAC,MAAM,QAAW;AAC1C,cAAI,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAG,QAAO;AAAA,QAC3C;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAEA,QAAI,SAAS;AACb,QAAI,CAAC,iBAAiB;AACpB,eAAS,OAAO,KAAK,CAAC,EAAE;AAAA,IAC1B,OAAO;AACL,iBAAW,KAAK,GAAG;AACjB,YAAI,EAAE,CAAC,MAAM,OAAW;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,SAAS;AACb,eAAW,KAAK,GAAG;AACjB,UAAI,CAAC,mBAAmB,EAAE,CAAC,MAAM,QAAW;AAC1C;AACA,YAAI,SAAS,UAAU,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAG,QAAO;AAAA,MAC9D;AAAA,IACF;AAEA,WAAO,WAAW;AAAA,EACpB;AAEA,SAAO;AACT;AA0CO,SAAS,wBAA2B,WAAgC;AACzE,MAAI;AACJ,MAAI;AAEJ,QAAM,oBAAoB,IAAI,QAAW,CAAC,SAAS,WAAW;AAC5D,yBAAqB;AACrB,wBAAoB;AAAA,EACtB,CAAC;AAED,oBAAkB,SAAS;AAE3B,oBAAkB,UAAU,CAAC,UAAa;AACxC,sBAAkB,SAAS;AAC3B,sBAAkB,QAAQ;AAC1B,uBAAmB,KAAK;AACxB,gBAAY,KAAK;AAAA,EACnB;AAEA,oBAAkB,SAAS,CAAC,MAAM;AAChC,sBAAkB,SAAS;AAC3B,sBAAkB,CAAC;AAAA,EACrB;AAEA,SAAO;AACT;AAMO,SAAS,sBAAsB,OAAqB;AAIzD,MAAI,OAAO,OAAO,YAAY,SAAU,QAAO;AAC/C,SACE,MAAM,QAAQ,WAAW,6CAA6C,KACtE,MAAM,QAAQ,WAAW,2CAA2C,KACpE,MAAM,QAAQ,WAAW,kCAAkC;AAE/D;AAEO,SAAS,UACd,OAC8B;AAC9B,SAAO;AAAA,IACL,SACA,OAAO,UAAU,YACjB,OAAQ,MAAqB,SAAS;AAAA,EAAA;AAE1C;AAEO,SAAS,SACd,OACA,WACe;AACf,WAAS,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;AAC1C,UAAM,OAAO,MAAM,CAAC;AACpB,QAAI,UAAU,IAAI,EAAG,QAAO;AAAA,EAC9B;AACA,SAAO;AACT;AAOA,SAAS,oBAAoB,SAAyB;AAIpD,SAAO,QAAQ,QAAQ,oBAAoB,EAAE;AAC/C;AAEA,SAAS,cAAc,SAAyB;AAC9C,MAAI;AACJ,MAAI;AACF,cAAU,UAAU,OAAO;AAAA,EAC7B,QAAQ;AAEN,cAAU,QAAQ,WAAW,kBAAkB,CAAC,UAAU;AACxD,UAAI;AACF,eAAO,UAAU,KAAK;AAAA,MACxB,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,oBAAoB,OAAO;AACpC;AAMO,MAAM,qBAAqB,CAAC,SAAS,UAAU,WAAW,MAAM;AAgBhE,SAAS,oBAAoB,KAAsB;AACxD,MAAI,CAAC,IAAK,QAAO;AAEjB,MAAI;AAGF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,WAAO,CAAC,mBAAmB,SAAS,OAAO,QAAQ;AAAA,EACrD,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAIA,MAAM,qBAAkD;AAAA,EACtD,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,UAAU;AAAA,EACV,UAAU;AACZ;AAEA,MAAM,oBAAoB;AASnB,SAAS,WAAW,KAAqB;AAC9C,SAAO,IAAI,QAAQ,mBAAmB,CAAC,UAAU,mBAAmB,KAAK,CAAE;AAC7E;AAEO,SAAS,WAAW,MAAc;AACvC,MAAI,CAAC,KAAM,QAAO,EAAE,MAAM,4BAA4B,MAAA;AAOtD,MAAI,CAAC,qBAAqB,KAAK,IAAI,KAAK,CAAC,KAAK,WAAW,IAAI,GAAG;AAC9D,WAAO,EAAE,MAAM,4BAA4B,MAAA;AAAA,EAC7C;AAEA,QAAM,KAAK;AACX,MAAI,SAAS;AACb,MAAI,SAAS;AACb,MAAI;AACJ,SAAO,UAAU,QAAQ,GAAG,KAAK,IAAI,IAAI;AACvC,cAAU,cAAc,KAAK,MAAM,QAAQ,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC;AAClE,aAAS,GAAG;AAAA,EACd;AACA,WAAS,SAAS,cAAc,SAAS,KAAK,MAAM,MAAM,IAAI,IAAI;AAKlE,MAAI,6BAA6B;AACjC,MAAI,OAAO,WAAW,IAAI,GAAG;AAC3B,iCAA6B;AAC7B,aAAS,MAAM,OAAO,QAAQ,QAAQ,EAAE;AAAA,EAC1C;AAEA,SAAO,EAAE,MAAM,QAAQ,2BAAA;AACzB;AAqBO,SAAS,kBAAkB,MAAsB;AAKtD,MAAI,CAAC,sBAAsB,KAAK,IAAI,EAAG,QAAO;AAG9C,SAAO,KAAK,QAAQ,yBAAyB,kBAAkB;AACjE;AAWO,SAAS,kBACd,UACA,UACQ;AAER,QAAM,kBAAkB,SAAS,QAAQ,cAAc,EAAE;AAEzD,QAAM,qBAAqB,oBAAoB,KAAK,KAAK,IAAI,eAAe;AAC5E,SAAO,GAAG,kBAAkB,sCAAsC,mBAAmB,SAAS,KAAK,GAAG,CAAC,CAAC;AAC1G;;;;;;;;;;;;;;;;;"}
+{"version":3,"file":"utils.cjs","sources":["../../src/utils.ts"],"sourcesContent":["import { isServer } from '@tanstack/router-core/isServer'\nimport type { RouteIds } from './routeInfo'\nimport type { AnyRouter } from './router'\n\nexport type Awaitable<T> = T | Promise<T>\nexport type NoInfer<T> = [T][T extends any ? 0 : never]\nexport type IsAny<TValue, TYesResult, TNoResult = TValue> = 1 extends 0 & TValue\n  ? TYesResult\n  : TNoResult\n\nexport type PickAsRequired<TValue, TKey extends keyof TValue> = Omit<\n  TValue,\n  TKey\n> &\n  Required<Pick<TValue, TKey>>\n\nexport type PickRequired<T> = {\n  [K in keyof T as undefined extends T[K] ? never : K]: T[K]\n}\n\nexport type PickOptional<T> = {\n  [K in keyof T as undefined extends T[K] ? K : never]: T[K]\n}\n\n// from https://stackoverflow.com/a/76458160\nexport type WithoutEmpty<T> = T extends any ? ({} extends T ? never : T) : never\n\nexport type Expand<T> = T extends object\n  ? T extends infer O\n    ? O extends Function\n      ? O\n      : { [K in keyof O]: O[K] }\n    : never\n  : T\n\nexport type DeepPartial<T> = T extends object\n  ? {\n      [P in keyof T]?: DeepPartial<T[P]>\n    }\n  : T\n\nexport type MakeDifferenceOptional<TLeft, TRight> = keyof TLeft &\n  keyof TRight extends never\n  ? TRight\n  : Omit<TRight, keyof TLeft & keyof TRight> & {\n      [K in keyof TLeft & keyof TRight]?: TRight[K]\n    }\n\n// from https://stackoverflow.com/a/53955431\n// eslint-disable-next-line @typescript-eslint/naming-convention\nexport type IsUnion<T, U extends T = T> = (\n  T extends any ? (U extends T ? false : true) : never\n) extends false\n  ? false\n  : true\n\nexport type IsNonEmptyObject<T> = T extends object\n  ? keyof T extends never\n    ? false\n    : true\n  : false\n\nexport type Assign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : keyof TLeft & keyof TRight extends never\n          ? TLeft & TRight\n          : Omit<TLeft, keyof TRight> & TRight\n    : never\n  : never\n\nexport type IntersectAssign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : TRight & TLeft\n    : never\n  : never\n\nexport type Timeout = ReturnType<typeof setTimeout>\n\nexport type Updater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev?: TPrevious) => TResult)\n\nexport type NonNullableUpdater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev: TPrevious) => TResult)\n\nexport type ExtractObjects<TUnion> = TUnion extends MergeAllPrimitive\n  ? never\n  : TUnion\n\nexport type PartialMergeAllObject<TUnion> =\n  ExtractObjects<TUnion> extends infer TObj\n    ? [TObj] extends [never]\n      ? never\n      : {\n          [TKey in TObj extends any ? keyof TObj : never]?: TObj extends any\n            ? TKey extends keyof TObj\n              ? TObj[TKey]\n              : never\n            : never\n        }\n    : never\n\nexport type MergeAllPrimitive =\n  | ReadonlyArray<any>\n  | number\n  | string\n  | bigint\n  | boolean\n  | symbol\n  | undefined\n  | null\n\nexport type ExtractPrimitives<TUnion> = TUnion extends MergeAllPrimitive\n  ? TUnion\n  : TUnion extends object\n    ? never\n    : TUnion\n\nexport type PartialMergeAll<TUnion> =\n  | ExtractPrimitives<TUnion>\n  | PartialMergeAllObject<TUnion>\n\nexport type Constrain<T, TConstraint, TDefault = TConstraint> =\n  | (T extends TConstraint ? T : never)\n  | TDefault\n\nexport type ConstrainLiteral<T, TConstraint, TDefault = TConstraint> =\n  | (T & TConstraint)\n  | TDefault\n\n/**\n * To be added to router types\n */\nexport type UnionToIntersection<T> = (\n  T extends any ? (arg: T) => any : never\n) extends (arg: infer T) => any\n  ? T\n  : never\n\n/**\n * Merges everything in a union into one object.\n * This mapped type is homomorphic which means it preserves stuff! :)\n */\nexport type MergeAllObjects<\n  TUnion,\n  TIntersected = UnionToIntersection<ExtractObjects<TUnion>>,\n> = [keyof TIntersected] extends [never]\n  ? never\n  : {\n      [TKey in keyof TIntersected]: TUnion extends any\n        ? TUnion[TKey & keyof TUnion]\n        : never\n    }\n\nexport type MergeAll<TUnion> =\n  | MergeAllObjects<TUnion>\n  | ExtractPrimitives<TUnion>\n\nexport type ValidateJSON<T> = ((...args: Array<any>) => any) extends T\n  ? unknown extends T\n    ? never\n    : 'Function is not serializable'\n  : { [K in keyof T]: ValidateJSON<T[K]> }\n\nexport type LooseReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn\n  : never\n\nexport type LooseAsyncReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn extends Promise<infer TReturn>\n    ? TReturn\n    : TReturn\n  : never\n\n/**\n * Return the last element of an array.\n * Intended for non-empty arrays used within router internals.\n */\nexport function last<T>(arr: ReadonlyArray<T>) {\n  return arr[arr.length - 1]\n}\n\nfunction isFunction(d: any): d is Function {\n  return typeof d === 'function'\n}\n\n/**\n * Apply a value-or-updater to a previous value.\n * Accepts either a literal value or a function of the previous value.\n */\nexport function functionalUpdate<TPrevious, TResult = TPrevious>(\n  updater: Updater<TPrevious, TResult> | NonNullableUpdater<TPrevious, TResult>,\n  previous: TPrevious,\n): TResult {\n  if (isFunction(updater)) {\n    return updater(previous)\n  }\n\n  return updater\n}\n\nconst hasOwn = Object.prototype.hasOwnProperty\nconst isEnumerable = Object.prototype.propertyIsEnumerable\n\n/**\n * This function returns `prev` if `_next` is deeply equal.\n * If not, it will replace any deeply equal children of `b` with those of `a`.\n * This can be used for structural sharing between immutable JSON values for example.\n * Do not use this with signals\n */\nexport function replaceEqualDeep<T>(prev: any, _next: T, _depth = 0): T {\n  if (isServer) {\n    return _next\n  }\n  if (prev === _next) {\n    return prev\n  }\n\n  if (_depth > 500) return _next\n\n  const next = _next as any\n\n  const array = isPlainArray(prev) && isPlainArray(next)\n\n  if (!array && !(isPlainObject(prev) && isPlainObject(next))) return next\n\n  const prevItems = array ? prev : getEnumerableOwnKeys(prev)\n  if (!prevItems) return next\n  const nextItems = array ? next : getEnumerableOwnKeys(next)\n  if (!nextItems) return next\n  const prevSize = prevItems.length\n  const nextSize = nextItems.length\n  const copy: any = array ? new Array(nextSize) : {}\n\n  let equalItems = 0\n\n  for (let i = 0; i < nextSize; i++) {\n    const key = array ? i : (nextItems[i] as any)\n    const p = prev[key]\n    const n = next[key]\n\n    if (p === n) {\n      copy[key] = p\n      if (array ? i < prevSize : hasOwn.call(prev, key)) equalItems++\n      continue\n    }\n\n    if (\n      p === null ||\n      n === null ||\n      typeof p !== 'object' ||\n      typeof n !== 'object'\n    ) {\n      copy[key] = n\n      continue\n    }\n\n    const v = replaceEqualDeep(p, n, _depth + 1)\n    copy[key] = v\n    if (v === p) equalItems++\n  }\n\n  return prevSize === nextSize && equalItems === prevSize ? prev : copy\n}\n\n/**\n * Equivalent to `Reflect.ownKeys`, but ensures that objects are \"clone-friendly\":\n * will return false if object has any non-enumerable properties.\n *\n * Optimized for the common case where objects have no symbol properties.\n */\nfunction getEnumerableOwnKeys(o: object) {\n  const names = Object.getOwnPropertyNames(o)\n\n  // Fast path: check all string property names are enumerable\n  for (const name of names) {\n    if (!isEnumerable.call(o, name)) return false\n  }\n\n  // Only check symbols if the object has any (most plain objects don't)\n  const symbols = Object.getOwnPropertySymbols(o)\n\n  // Fast path: no symbols, return names directly (avoids array allocation/concat)\n  if (symbols.length === 0) return names\n\n  // Slow path: has symbols, need to check and merge\n  const keys: Array<string | symbol> = names\n  for (const symbol of symbols) {\n    if (!isEnumerable.call(o, symbol)) return false\n    keys.push(symbol)\n  }\n  return keys\n}\n\n// Copied from: https://github.com/jonschlinkert/is-plain-object\nexport function isPlainObject(o: any) {\n  if (!hasObjectPrototype(o)) {\n    return false\n  }\n\n  // If has modified constructor\n  const ctor = o.constructor\n  if (typeof ctor === 'undefined') {\n    return true\n  }\n\n  // If has modified prototype\n  const prot = ctor.prototype\n  if (!hasObjectPrototype(prot)) {\n    return false\n  }\n\n  // If constructor does not have an Object-specific method\n  if (!prot.hasOwnProperty('isPrototypeOf')) {\n    return false\n  }\n\n  // Most likely a plain Object\n  return true\n}\n\nfunction hasObjectPrototype(o: any) {\n  return Object.prototype.toString.call(o) === '[object Object]'\n}\n\n/**\n * Check if a value is a \"plain\" array (no extra enumerable keys).\n */\nexport function isPlainArray(value: unknown): value is Array<unknown> {\n  return Array.isArray(value) && value.length === Object.keys(value).length\n}\n\n/**\n * Perform a deep equality check with options for partial comparison and\n * ignoring `undefined` values. Optimized for router state comparisons.\n */\nexport function deepEqual(\n  a: any,\n  b: any,\n  opts?: { partial?: boolean; ignoreUndefined?: boolean },\n): boolean {\n  if (a === b) {\n    return true\n  }\n\n  if (typeof a !== typeof b) {\n    return false\n  }\n\n  if (Array.isArray(a) && Array.isArray(b)) {\n    if (a.length !== b.length) return false\n    for (let i = 0, l = a.length; i < l; i++) {\n      if (!deepEqual(a[i], b[i], opts)) return false\n    }\n    return true\n  }\n\n  if (isPlainObject(a) && isPlainObject(b)) {\n    const ignoreUndefined = opts?.ignoreUndefined ?? true\n\n    if (opts?.partial) {\n      for (const k in b) {\n        if (!ignoreUndefined || b[k] !== undefined) {\n          if (!deepEqual(a[k], b[k], opts)) return false\n        }\n      }\n      return true\n    }\n\n    let aCount = 0\n    if (!ignoreUndefined) {\n      aCount = Object.keys(a).length\n    } else {\n      for (const k in a) {\n        if (a[k] !== undefined) aCount++\n      }\n    }\n\n    let bCount = 0\n    for (const k in b) {\n      if (!ignoreUndefined || b[k] !== undefined) {\n        bCount++\n        if (bCount > aCount || !deepEqual(a[k], b[k], opts)) return false\n      }\n    }\n\n    return aCount === bCount\n  }\n\n  return false\n}\n\nexport type StringLiteral<T> = T extends string\n  ? string extends T\n    ? string\n    : T\n  : never\n\nexport type ThrowOrOptional<T, TThrow extends boolean> = TThrow extends true\n  ? T\n  : T | undefined\n\nexport type StrictOrFrom<\n  TRouter extends AnyRouter,\n  TFrom,\n  TStrict extends boolean = true,\n> = TStrict extends false\n  ? {\n      from?: never\n      strict: TStrict\n    }\n  : {\n      from: ConstrainLiteral<TFrom, RouteIds<TRouter['routeTree']>>\n      strict?: TStrict\n    }\n\nexport type ThrowConstraint<\n  TStrict extends boolean,\n  TThrow extends boolean,\n> = TStrict extends false ? (TThrow extends true ? never : TThrow) : TThrow\n\nexport type ControlledPromise<T> = Promise<T> & {\n  resolve: (value: T) => void\n  reject: (value: any) => void\n  status: 'pending' | 'resolved' | 'rejected'\n  value?: T\n}\n\n/**\n * Create a promise with exposed resolve/reject and status fields.\n * Useful for coordinating async router lifecycle operations.\n */\nexport function createControlledPromise<T>(onResolve?: (value: T) => void) {\n  let resolveLoadPromise!: (value: T) => void\n  let rejectLoadPromise!: (value: any) => void\n\n  const controlledPromise = new Promise<T>((resolve, reject) => {\n    resolveLoadPromise = resolve\n    rejectLoadPromise = reject\n  }) as ControlledPromise<T>\n\n  controlledPromise.status = 'pending'\n\n  controlledPromise.resolve = (value: T) => {\n    controlledPromise.status = 'resolved'\n    controlledPromise.value = value\n    resolveLoadPromise(value)\n    onResolve?.(value)\n  }\n\n  controlledPromise.reject = (e) => {\n    controlledPromise.status = 'rejected'\n    rejectLoadPromise(e)\n  }\n\n  return controlledPromise\n}\n\n/**\n * Heuristically detect dynamic import \"module not found\" errors\n * across major browsers for lazy route component handling.\n */\nexport function isModuleNotFoundError(error: any): boolean {\n  // chrome: \"Failed to fetch dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // firefox: \"error loading dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // safari: \"Importing a module script failed.\"\n  if (typeof error?.message !== 'string') return false\n  return (\n    error.message.startsWith('Failed to fetch dynamically imported module') ||\n    error.message.startsWith('error loading dynamically imported module') ||\n    error.message.startsWith('Importing a module script failed')\n  )\n}\n\nexport function isPromise<T>(\n  value: Promise<Awaited<T>> | T,\n): value is Promise<Awaited<T>> {\n  return Boolean(\n    value &&\n    typeof value === 'object' &&\n    typeof (value as Promise<T>).then === 'function',\n  )\n}\n\nexport function findLast<T>(\n  array: ReadonlyArray<T>,\n  predicate: (item: T) => boolean,\n): T | undefined {\n  for (let i = array.length - 1; i >= 0; i--) {\n    const item = array[i]!\n    if (predicate(item)) return item\n  }\n  return undefined\n}\n\n/**\n * Remove control characters that can cause open redirect vulnerabilities.\n * Characters like \\r (CR) and \\n (LF) can trick URL parsers into interpreting\n * paths like \"/\\r/evil.com\" as \"http://evil.com\".\n */\nfunction sanitizePathSegment(segment: string): string {\n  // Remove ASCII control characters (0x00-0x1F) and DEL (0x7F)\n  // These include CR (\\r = 0x0D), LF (\\n = 0x0A), and other potentially dangerous characters\n  // eslint-disable-next-line no-control-regex\n  return segment.replace(/[\\x00-\\x1f\\x7f]/g, '')\n}\n\nfunction decodeSegment(segment: string): string {\n  let decoded: string\n  try {\n    decoded = decodeURI(segment)\n  } catch {\n    // if the decoding fails, try to decode the various parts leaving the malformed tags in place\n    decoded = segment.replaceAll(/%[0-9A-F]{2}/gi, (match) => {\n      try {\n        return decodeURI(match)\n      } catch {\n        return match\n      }\n    })\n  }\n  return sanitizePathSegment(decoded)\n}\n\n/**\n * Default list of URL protocols to allow in links, redirects, and navigation.\n * Any absolute URL protocol not in this list is treated as dangerous by default.\n */\nexport const DEFAULT_PROTOCOL_ALLOWLIST = [\n  // Standard web navigation\n  'http:',\n  'https:',\n\n  // Common browser-safe actions\n  'mailto:',\n  'tel:',\n]\n\n/**\n * Check if a URL string uses a protocol that is not in the allowlist.\n * Returns true for blocked protocols like javascript:, blob:, data:, etc.\n *\n * The URL constructor correctly normalizes:\n * - Mixed case (JavaScript: → javascript:)\n * - Whitespace/control characters (java\\nscript: → javascript:)\n * - Leading whitespace\n *\n * For relative URLs (no protocol), returns false (safe).\n *\n * @param url - The URL string to check\n * @param allowlist - Set of protocols to allow\n * @returns true if the URL uses a protocol that is not allowed\n */\nexport function isDangerousProtocol(\n  url: string,\n  allowlist: Set<string>,\n): boolean {\n  if (!url) return false\n\n  try {\n    // Use the URL constructor - it correctly normalizes protocols\n    // per WHATWG URL spec, handling all bypass attempts automatically\n    const parsed = new URL(url)\n    return !allowlist.has(parsed.protocol)\n  } catch {\n    // URL constructor throws for relative URLs (no protocol)\n    // These are safe - they can't execute scripts\n    return false\n  }\n}\n\n// This utility is based on https://github.com/zertosh/htmlescape\n// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE\nconst HTML_ESCAPE_LOOKUP: { [match: string]: string } = {\n  '&': '\\\\u0026',\n  '>': '\\\\u003e',\n  '<': '\\\\u003c',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\nconst HTML_ESCAPE_REGEX = /[&><\\u2028\\u2029]/g\n\n/**\n * Escape HTML special characters in a string to prevent XSS attacks\n * when embedding strings in script tags during SSR.\n *\n * This is essential for preventing XSS vulnerabilities when user-controlled\n * content is embedded in inline scripts.\n */\nexport function escapeHtml(str: string): string {\n  return str.replace(HTML_ESCAPE_REGEX, (match) => HTML_ESCAPE_LOOKUP[match]!)\n}\n\nexport function decodePath(path: string) {\n  if (!path) return { path, handledProtocolRelativeURL: false }\n\n  // Fast path: most paths are already decoded and safe.\n  // Only fall back to the slower scan/regex path when we see a '%' (encoded),\n  // a backslash (explicitly handled), a control character, or a protocol-relative\n  // prefix which needs collapsing.\n  // eslint-disable-next-line no-control-regex\n  if (!/[%\\\\\\x00-\\x1f\\x7f]/.test(path) && !path.startsWith('//')) {\n    return { path, handledProtocolRelativeURL: false }\n  }\n\n  const re = /%25|%5C/gi\n  let cursor = 0\n  let result = ''\n  let match\n  while (null !== (match = re.exec(path))) {\n    result += decodeSegment(path.slice(cursor, match.index)) + match[0]\n    cursor = re.lastIndex\n  }\n  result = result + decodeSegment(cursor ? path.slice(cursor) : path)\n\n  // Prevent open redirect via protocol-relative URLs (e.g. \"//evil.com\")\n  // After sanitizing control characters, paths like \"/\\r/evil.com\" become \"//evil.com\"\n  // Collapse leading double slashes to a single slash\n  let handledProtocolRelativeURL = false\n  if (result.startsWith('//')) {\n    handledProtocolRelativeURL = true\n    result = '/' + result.replace(/^\\/+/, '')\n  }\n\n  return { path: result, handledProtocolRelativeURL }\n}\n\n/**\n * Encodes a path the same way `new URL()` would, but without the overhead of full URL parsing.\n *\n * This function encodes:\n * - Whitespace characters (spaces → %20, tabs → %09, etc.)\n * - Non-ASCII/Unicode characters (emojis, accented characters, etc.)\n *\n * It preserves:\n * - Already percent-encoded sequences (won't double-encode %2F, %25, etc.)\n * - ASCII special characters valid in URL paths (@, $, &, +, etc.)\n * - Forward slashes as path separators\n *\n * Used to generate proper href values for SSR without constructing URL objects.\n *\n * @example\n * encodePathLikeUrl('/path/file name.pdf') // '/path/file%20name.pdf'\n * encodePathLikeUrl('/path/日本語') // '/path/%E6%97%A5%E6%9C%AC%E8%AA%9E'\n * encodePathLikeUrl('/path/already%20encoded') // '/path/already%20encoded' (preserved)\n */\nexport function encodePathLikeUrl(path: string): string {\n  // Encode whitespace and non-ASCII characters that browsers encode in URLs\n\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  if (!/\\s|[^\\u0000-\\u007F]/.test(path)) return path\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  return path.replace(/\\s|[^\\u0000-\\u007F]/gu, encodeURIComponent)\n}\n\n/**\n * Builds the dev-mode CSS styles URL for route-scoped CSS collection.\n * Used by HeadContent components in all framework implementations to construct\n * the URL for the `/@tanstack-start/styles.css` endpoint.\n *\n * @param basepath - The router's basepath (may or may not have leading slash)\n * @param routeIds - Array of matched route IDs to include in the CSS collection\n * @returns The full URL path for the dev styles CSS endpoint\n */\nexport function buildDevStylesUrl(\n  basepath: string,\n  routeIds: Array<string>,\n): string {\n  // Trim all leading and trailing slashes from basepath\n  const trimmedBasepath = basepath.replace(/^\\/+|\\/+$/g, '')\n  // Build normalized basepath: empty string for root, or '/path' for non-root\n  const normalizedBasepath = trimmedBasepath === '' ? '' : `/${trimmedBasepath}`\n  return `${normalizedBasepath}/@tanstack-start/styles.css?routes=${encodeURIComponent(routeIds.join(','))}`\n}\n"],"names":["isServer"],"mappings":";;;AA+LO,SAAS,KAAQ,KAAuB;AAC7C,SAAO,IAAI,IAAI,SAAS,CAAC;AAC3B;AAEA,SAAS,WAAW,GAAuB;AACzC,SAAO,OAAO,MAAM;AACtB;AAMO,SAAS,iBACd,SACA,UACS;AACT,MAAI,WAAW,OAAO,GAAG;AACvB,WAAO,QAAQ,QAAQ;AAAA,EACzB;AAEA,SAAO;AACT;AAEA,MAAM,SAAS,OAAO,UAAU;AAChC,MAAM,eAAe,OAAO,UAAU;AAQ/B,SAAS,iBAAoB,MAAW,OAAU,SAAS,GAAM;AACtE,MAAIA,mBAAU;AACZ,WAAO;AAAA,EACT;AACA,MAAI,SAAS,OAAO;AAClB,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,IAAK,QAAO;AAEzB,QAAM,OAAO;AAEb,QAAM,QAAQ,aAAa,IAAI,KAAK,aAAa,IAAI;AAErD,MAAI,CAAC,SAAS,EAAE,cAAc,IAAI,KAAK,cAAc,IAAI,GAAI,QAAO;AAEpE,QAAM,YAAY,QAAQ,OAAO,qBAAqB,IAAI;AAC1D,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,YAAY,QAAQ,OAAO,qBAAqB,IAAI;AAC1D,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,WAAW,UAAU;AAC3B,QAAM,WAAW,UAAU;AAC3B,QAAM,OAAY,QAAQ,IAAI,MAAM,QAAQ,IAAI,CAAA;AAEhD,MAAI,aAAa;AAEjB,WAAS,IAAI,GAAG,IAAI,UAAU,KAAK;AACjC,UAAM,MAAM,QAAQ,IAAK,UAAU,CAAC;AACpC,UAAM,IAAI,KAAK,GAAG;AAClB,UAAM,IAAI,KAAK,GAAG;AAElB,QAAI,MAAM,GAAG;AACX,WAAK,GAAG,IAAI;AACZ,UAAI,QAAQ,IAAI,WAAW,OAAO,KAAK,MAAM,GAAG,EAAG;AACnD;AAAA,IACF;AAEA,QACE,MAAM,QACN,MAAM,QACN,OAAO,MAAM,YACb,OAAO,MAAM,UACb;AACA,WAAK,GAAG,IAAI;AACZ;AAAA,IACF;AAEA,UAAM,IAAI,iBAAiB,GAAG,GAAG,SAAS,CAAC;AAC3C,SAAK,GAAG,IAAI;AACZ,QAAI,MAAM,EAAG;AAAA,EACf;AAEA,SAAO,aAAa,YAAY,eAAe,WAAW,OAAO;AACnE;AAQA,SAAS,qBAAqB,GAAW;AACvC,QAAM,QAAQ,OAAO,oBAAoB,CAAC;AAG1C,aAAW,QAAQ,OAAO;AACxB,QAAI,CAAC,aAAa,KAAK,GAAG,IAAI,EAAG,QAAO;AAAA,EAC1C;AAGA,QAAM,UAAU,OAAO,sBAAsB,CAAC;AAG9C,MAAI,QAAQ,WAAW,EAAG,QAAO;AAGjC,QAAM,OAA+B;AACrC,aAAW,UAAU,SAAS;AAC5B,QAAI,CAAC,aAAa,KAAK,GAAG,MAAM,EAAG,QAAO;AAC1C,SAAK,KAAK,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAGO,SAAS,cAAc,GAAQ;AACpC,MAAI,CAAC,mBAAmB,CAAC,GAAG;AAC1B,WAAO;AAAA,EACT;AAGA,QAAM,OAAO,EAAE;AACf,MAAI,OAAO,SAAS,aAAa;AAC/B,WAAO;AAAA,EACT;AAGA,QAAM,OAAO,KAAK;AAClB,MAAI,CAAC,mBAAmB,IAAI,GAAG;AAC7B,WAAO;AAAA,EACT;AAGA,MAAI,CAAC,KAAK,eAAe,eAAe,GAAG;AACzC,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAEA,SAAS,mBAAmB,GAAQ;AAClC,SAAO,OAAO,UAAU,SAAS,KAAK,CAAC,MAAM;AAC/C;AAKO,SAAS,aAAa,OAAyC;AACpE,SAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE;AACrE;AAMO,SAAS,UACd,GACA,GACA,MACS;AACT,MAAI,MAAM,GAAG;AACX,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,MAAM,OAAO,GAAG;AACzB,WAAO;AAAA,EACT;AAEA,MAAI,MAAM,QAAQ,CAAC,KAAK,MAAM,QAAQ,CAAC,GAAG;AACxC,QAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,aAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAI,GAAG,KAAK;AACxC,UAAI,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAG,QAAO;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AAEA,MAAI,cAAc,CAAC,KAAK,cAAc,CAAC,GAAG;AACxC,UAAM,kBAAkB,MAAM,mBAAmB;AAEjD,QAAI,MAAM,SAAS;AACjB,iBAAW,KAAK,GAAG;AACjB,YAAI,CAAC,mBAAmB,EAAE,CAAC,MAAM,QAAW;AAC1C,cAAI,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAG,QAAO;AAAA,QAC3C;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAEA,QAAI,SAAS;AACb,QAAI,CAAC,iBAAiB;AACpB,eAAS,OAAO,KAAK,CAAC,EAAE;AAAA,IAC1B,OAAO;AACL,iBAAW,KAAK,GAAG;AACjB,YAAI,EAAE,CAAC,MAAM,OAAW;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,SAAS;AACb,eAAW,KAAK,GAAG;AACjB,UAAI,CAAC,mBAAmB,EAAE,CAAC,MAAM,QAAW;AAC1C;AACA,YAAI,SAAS,UAAU,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAG,QAAO;AAAA,MAC9D;AAAA,IACF;AAEA,WAAO,WAAW;AAAA,EACpB;AAEA,SAAO;AACT;AA0CO,SAAS,wBAA2B,WAAgC;AACzE,MAAI;AACJ,MAAI;AAEJ,QAAM,oBAAoB,IAAI,QAAW,CAAC,SAAS,WAAW;AAC5D,yBAAqB;AACrB,wBAAoB;AAAA,EACtB,CAAC;AAED,oBAAkB,SAAS;AAE3B,oBAAkB,UAAU,CAAC,UAAa;AACxC,sBAAkB,SAAS;AAC3B,sBAAkB,QAAQ;AAC1B,uBAAmB,KAAK;AACxB,gBAAY,KAAK;AAAA,EACnB;AAEA,oBAAkB,SAAS,CAAC,MAAM;AAChC,sBAAkB,SAAS;AAC3B,sBAAkB,CAAC;AAAA,EACrB;AAEA,SAAO;AACT;AAMO,SAAS,sBAAsB,OAAqB;AAIzD,MAAI,OAAO,OAAO,YAAY,SAAU,QAAO;AAC/C,SACE,MAAM,QAAQ,WAAW,6CAA6C,KACtE,MAAM,QAAQ,WAAW,2CAA2C,KACpE,MAAM,QAAQ,WAAW,kCAAkC;AAE/D;AAEO,SAAS,UACd,OAC8B;AAC9B,SAAO;AAAA,IACL,SACA,OAAO,UAAU,YACjB,OAAQ,MAAqB,SAAS;AAAA,EAAA;AAE1C;AAEO,SAAS,SACd,OACA,WACe;AACf,WAAS,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;AAC1C,UAAM,OAAO,MAAM,CAAC;AACpB,QAAI,UAAU,IAAI,EAAG,QAAO;AAAA,EAC9B;AACA,SAAO;AACT;AAOA,SAAS,oBAAoB,SAAyB;AAIpD,SAAO,QAAQ,QAAQ,oBAAoB,EAAE;AAC/C;AAEA,SAAS,cAAc,SAAyB;AAC9C,MAAI;AACJ,MAAI;AACF,cAAU,UAAU,OAAO;AAAA,EAC7B,QAAQ;AAEN,cAAU,QAAQ,WAAW,kBAAkB,CAAC,UAAU;AACxD,UAAI;AACF,eAAO,UAAU,KAAK;AAAA,MACxB,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,oBAAoB,OAAO;AACpC;AAMO,MAAM,6BAA6B;AAAA;AAAA,EAExC;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF;AAiBO,SAAS,oBACd,KACA,WACS;AACT,MAAI,CAAC,IAAK,QAAO;AAEjB,MAAI;AAGF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,WAAO,CAAC,UAAU,IAAI,OAAO,QAAQ;AAAA,EACvC,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAIA,MAAM,qBAAkD;AAAA,EACtD,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,UAAU;AAAA,EACV,UAAU;AACZ;AAEA,MAAM,oBAAoB;AASnB,SAAS,WAAW,KAAqB;AAC9C,SAAO,IAAI,QAAQ,mBAAmB,CAAC,UAAU,mBAAmB,KAAK,CAAE;AAC7E;AAEO,SAAS,WAAW,MAAc;AACvC,MAAI,CAAC,KAAM,QAAO,EAAE,MAAM,4BAA4B,MAAA;AAOtD,MAAI,CAAC,qBAAqB,KAAK,IAAI,KAAK,CAAC,KAAK,WAAW,IAAI,GAAG;AAC9D,WAAO,EAAE,MAAM,4BAA4B,MAAA;AAAA,EAC7C;AAEA,QAAM,KAAK;AACX,MAAI,SAAS;AACb,MAAI,SAAS;AACb,MAAI;AACJ,SAAO,UAAU,QAAQ,GAAG,KAAK,IAAI,IAAI;AACvC,cAAU,cAAc,KAAK,MAAM,QAAQ,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC;AAClE,aAAS,GAAG;AAAA,EACd;AACA,WAAS,SAAS,cAAc,SAAS,KAAK,MAAM,MAAM,IAAI,IAAI;AAKlE,MAAI,6BAA6B;AACjC,MAAI,OAAO,WAAW,IAAI,GAAG;AAC3B,iCAA6B;AAC7B,aAAS,MAAM,OAAO,QAAQ,QAAQ,EAAE;AAAA,EAC1C;AAEA,SAAO,EAAE,MAAM,QAAQ,2BAAA;AACzB;AAqBO,SAAS,kBAAkB,MAAsB;AAKtD,MAAI,CAAC,sBAAsB,KAAK,IAAI,EAAG,QAAO;AAG9C,SAAO,KAAK,QAAQ,yBAAyB,kBAAkB;AACjE;AAWO,SAAS,kBACd,UACA,UACQ;AAER,QAAM,kBAAkB,SAAS,QAAQ,cAAc,EAAE;AAEzD,QAAM,qBAAqB,oBAAoB,KAAK,KAAK,IAAI,eAAe;AAC5E,SAAO,GAAG,kBAAkB,sCAAsC,mBAAmB,SAAS,KAAK,GAAG,CAAC,CAAC;AAC1G;;;;;;;;;;;;;;;;;"}

package/dist/cjs/utils.d.cts

@@ -112,13 +112,13 @@ export declare function isModuleNotFoundError(error: any): boolean;
 export declare function isPromise<T>(value: Promise<Awaited<T>> | T): value is Promise<Awaited<T>>;
 export declare function findLast<T>(array: ReadonlyArray<T>, predicate: (item: T) => boolean): T | undefined;
 /**
- * List of URL protocols that are safe for navigation.
- * Only these protocols are allowed in redirects and navigation.
+ * Default list of URL protocols to allow in links, redirects, and navigation.
+ * Any absolute URL protocol not in this list is treated as dangerous by default.
  */
-export declare const SAFE_URL_PROTOCOLS: string[];
+export declare const DEFAULT_PROTOCOL_ALLOWLIST: string[];
 /**
- * Check if a URL string uses a protocol that is not in the safe list.
- * Returns true for dangerous protocols like javascript:, data:, vbscript:, etc.
+ * Check if a URL string uses a protocol that is not in the allowlist.
+ * Returns true for blocked protocols like javascript:, blob:, data:, etc.
  *
  * The URL constructor correctly normalizes:
  * - Mixed case (JavaScript: → javascript:)
@@ -128,9 +128,10 @@ export declare const SAFE_URL_PROTOCOLS: string[];
  * For relative URLs (no protocol), returns false (safe).
  *
  * @param url - The URL string to check
- * @returns true if the URL uses a dangerous (non-whitelisted) protocol
+ * @param allowlist - Set of protocols to allow
+ * @returns true if the URL uses a protocol that is not allowed
  */
-export declare function isDangerousProtocol(url: string): boolean;
+export declare function isDangerousProtocol(url: string, allowlist: Set<string>): boolean;
 /**
  * Escape HTML special characters in a string to prevent XSS attacks
  * when embedding strings in script tags during SSR.

package/dist/esm/index.d.ts

@@ -24,7 +24,7 @@ export { retainSearchParams, stripSearchParams } from './searchMiddleware.js';
 export { defaultParseSearch, defaultStringifySearch, parseSearchWith, stringifySearchWith, } from './searchParams.js';
 export type { SearchSerializer, SearchParser } from './searchParams.js';
 export type { OptionalStructuralSharing } from './structuralSharing.js';
-export { last, functionalUpdate, replaceEqualDeep, isPlainObject, isPlainArray, deepEqual, createControlledPromise, isModuleNotFoundError, decodePath, escapeHtml, isDangerousProtocol, buildDevStylesUrl, } from './utils.js';
+export { last, functionalUpdate, replaceEqualDeep, isPlainObject, isPlainArray, deepEqual, createControlledPromise, isModuleNotFoundError, decodePath, DEFAULT_PROTOCOL_ALLOWLIST, escapeHtml, isDangerousProtocol, buildDevStylesUrl, } from './utils.js';
 export type { NoInfer, IsAny, PickAsRequired, PickRequired, PickOptional, WithoutEmpty, Expand, DeepPartial, MakeDifferenceOptional, IsUnion, IsNonEmptyObject, Assign, IntersectAssign, Timeout, Updater, NonNullableUpdater, StringLiteral, ThrowOrOptional, ThrowConstraint, ControlledPromise, ExtractObjects, PartialMergeAllObject, MergeAllPrimitive, ExtractPrimitives, PartialMergeAll, Constrain, ConstrainLiteral, UnionToIntersection, MergeAllObjects, MergeAll, ValidateJSON, StrictOrFrom, LooseReturnType, LooseAsyncReturnType, Awaitable, } from './utils.js';
 export type { StandardSchemaValidatorProps, StandardSchemaValidator, AnyStandardSchemaValidator, StandardSchemaValidatorTypes, AnyStandardSchemaValidateSuccess, AnyStandardSchemaValidateFailure, AnyStandardSchemaValidateIssue, AnyStandardSchemaValidateInput, AnyStandardSchemaValidate, ValidatorObj, AnyValidatorObj, ValidatorAdapter, AnyValidatorAdapter, AnyValidatorFn, ValidatorFn, Validator, AnyValidator, AnySchema, DefaultValidator, ResolveSearchValidatorInputFn, ResolveSearchValidatorInput, ResolveValidatorInputFn, ResolveValidatorInput, ResolveValidatorOutputFn, ResolveValidatorOutput, } from './validators.js';
 export type { UseRouteContextBaseOptions, UseRouteContextOptions, UseRouteContextResult, } from './useRouteContext.js';

package/dist/esm/index.js

@@ -10,7 +10,7 @@ import { PathParamError, RouterCore, SearchParamError, defaultSerializeError, ge
 import { createRouterConfig } from "./config.js";
 import { retainSearchParams, stripSearchParams } from "./searchMiddleware.js";
 import { defaultParseSearch, defaultStringifySearch, parseSearchWith, stringifySearchWith } from "./searchParams.js";
-import { buildDevStylesUrl, createControlledPromise, decodePath, deepEqual, escapeHtml, functionalUpdate, isDangerousProtocol, isModuleNotFoundError, isPlainArray, isPlainObject, last, replaceEqualDeep } from "./utils.js";
+import { DEFAULT_PROTOCOL_ALLOWLIST, buildDevStylesUrl, createControlledPromise, decodePath, deepEqual, escapeHtml, functionalUpdate, isDangerousProtocol, isModuleNotFoundError, isPlainArray, isPlainObject, last, replaceEqualDeep } from "./utils.js";
 import { isRedirect, isResolvedRedirect, parseRedirect, redirect } from "./redirect.js";
 import { isNotFound, notFound } from "./not-found.js";
 import { defaultGetScrollRestorationKey, getCssSelector, handleHashScroll, restoreScroll, scrollRestorationCache, setupScrollRestoration, storageKey } from "./scroll-restoration.js";
@@ -22,6 +22,7 @@ export {
   BaseRootRoute,
   BaseRoute,
   BaseRouteApi,
+  DEFAULT_PROTOCOL_ALLOWLIST,
   PathParamError,
   RawStream,
   RawStreamSSRPlugin,

package/dist/esm/redirect.js

@@ -1,11 +1,5 @@
-import { isDangerousProtocol, SAFE_URL_PROTOCOLS } from "./utils.js";
 function redirect(opts) {
   opts.statusCode = opts.statusCode || opts.code || 307;
-  if (!opts._builtLocation && typeof opts.href === "string" && isDangerousProtocol(opts.href)) {
-    throw new Error(
-      `Redirect blocked: unsafe protocol in href "${opts.href}". Only ${SAFE_URL_PROTOCOLS.join(", ")} protocols are allowed.`
-    );
-  }
   if (!opts._builtLocation && !opts.reloadDocument && typeof opts.href === "string") {
     try {
       new URL(opts.href);

package/dist/esm/redirect.js.map

@@ -1 +1 @@
-{"version":3,"file":"redirect.js","sources":["../../src/redirect.ts"],"sourcesContent":["import { SAFE_URL_PROTOCOLS, isDangerousProtocol } from './utils'\nimport type { NavigateOptions } from './link'\nimport type { AnyRouter, RegisteredRouter } from './router'\nimport type { ParsedLocation } from './location'\n\nexport type AnyRedirect = Redirect<any, any, any, any, any>\n\n/**\n * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType)\n */\nexport type Redirect<\n  TRouter extends AnyRouter = RegisteredRouter,\n  TFrom extends string = string,\n  TTo extends string | undefined = undefined,\n  TMaskFrom extends string = TFrom,\n  TMaskTo extends string = '.',\n> = Response & {\n  options: NavigateOptions<TRouter, TFrom, TTo, TMaskFrom, TMaskTo> & {\n    /**\n     * @internal\n     * A **trusted** built location that can be used to redirect to.\n     */\n    _builtLocation?: ParsedLocation\n  }\n  redirectHandled?: boolean\n}\n\nexport type RedirectOptions<\n  TRouter extends AnyRouter = RegisteredRouter,\n  TFrom extends string = string,\n  TTo extends string | undefined = undefined,\n  TMaskFrom extends string = TFrom,\n  TMaskTo extends string = '.',\n> = {\n  href?: string\n  /**\n   * @deprecated Use `statusCode` instead\n   **/\n  code?: number\n  /**\n   * The HTTP status code to use when redirecting.\n   * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType#statuscode-property)\n   */\n  statusCode?: number\n  /**\n   * If provided, will throw the redirect object instead of returning it. This can be useful in places where `throwing` in a function might cause it to have a return type of `never`. In that case, you can use `redirect({ throw: true })` to throw the redirect object instead of returning it.\n   * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType#throw-property)\n   */\n  throw?: any\n  /**\n   * The HTTP headers to use when redirecting.\n   * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType#headers-property)\n   */\n  headers?: HeadersInit\n  /**\n   * @internal\n   * A **trusted** built location that can be used to redirect to.\n   */\n  _builtLocation?: ParsedLocation\n} & NavigateOptions<TRouter, TFrom, TTo, TMaskFrom, TMaskTo>\n\nexport type ResolvedRedirect<\n  TRouter extends AnyRouter = RegisteredRouter,\n  TFrom extends string = string,\n  TTo extends string = '',\n  TMaskFrom extends string = TFrom,\n  TMaskTo extends string = '',\n> = Redirect<TRouter, TFrom, TTo, TMaskFrom, TMaskTo>\n\n/**\n * Options for route-bound redirect, where 'from' is automatically set.\n * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType)\n */\nexport type RedirectOptionsRoute<\n  TDefaultFrom extends string = string,\n  TRouter extends AnyRouter = RegisteredRouter,\n  TTo extends string | undefined = undefined,\n  TMaskTo extends string = '',\n> = Omit<\n  RedirectOptions<TRouter, TDefaultFrom, TTo, TDefaultFrom, TMaskTo>,\n  'from'\n>\n\n/**\n * A redirect function bound to a specific route, with 'from' pre-set to the route's fullPath.\n * This enables relative redirects like `Route.redirect({ to: './overview' })`.\n * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType)\n */\nexport interface RedirectFnRoute<in out TDefaultFrom extends string = string> {\n  <\n    TRouter extends AnyRouter = RegisteredRouter,\n    const TTo extends string | undefined = undefined,\n    const TMaskTo extends string = '',\n  >(\n    opts: RedirectOptionsRoute<TDefaultFrom, TRouter, TTo, TMaskTo>,\n  ): Redirect<TRouter, TDefaultFrom, TTo, TDefaultFrom, TMaskTo>\n}\n\n/**\n * Create a redirect Response understood by TanStack Router.\n *\n * Use from route `loader`/`beforeLoad` or server functions to trigger a\n * navigation. If `throw: true` is set, the redirect is thrown instead of\n * returned. When an absolute `href` is supplied and `reloadDocument` is not\n * set, a full-document navigation is inferred.\n *\n * @param opts Options for the redirect. Common fields:\n * - `href`: absolute URL for external redirects; infers `reloadDocument`.\n * - `statusCode`: HTTP status code to use (defaults to 307).\n * - `headers`: additional headers to include on the Response.\n * - Standard navigation options like `to`, `params`, `search`, `replace`,\n *   and `reloadDocument` for internal redirects.\n * @returns A Response augmented with router navigation options.\n * @link https://tanstack.com/router/latest/docs/framework/react/api/router/redirectFunction\n */\nexport function redirect<\n  TRouter extends AnyRouter = RegisteredRouter,\n  const TTo extends string | undefined = '.',\n  const TFrom extends string = string,\n  const TMaskFrom extends string = TFrom,\n  const TMaskTo extends string = '',\n>(\n  opts: RedirectOptions<TRouter, TFrom, TTo, TMaskFrom, TMaskTo>,\n): Redirect<TRouter, TFrom, TTo, TMaskFrom, TMaskTo> {\n  opts.statusCode = opts.statusCode || opts.code || 307\n\n  // Block dangerous protocols in redirect href\n  if (\n    !opts._builtLocation &&\n    typeof opts.href === 'string' &&\n    isDangerousProtocol(opts.href)\n  ) {\n    throw new Error(\n      `Redirect blocked: unsafe protocol in href \"${opts.href}\". Only ${SAFE_URL_PROTOCOLS.join(', ')} protocols are allowed.`,\n    )\n  }\n\n  if (\n    !opts._builtLocation &&\n    !opts.reloadDocument &&\n    typeof opts.href === 'string'\n  ) {\n    try {\n      new URL(opts.href)\n      opts.reloadDocument = true\n    } catch {}\n  }\n\n  const headers = new Headers(opts.headers)\n  if (opts.href && headers.get('Location') === null) {\n    headers.set('Location', opts.href)\n  }\n\n  const response = new Response(null, {\n    status: opts.statusCode,\n    headers,\n  })\n\n  ;(response as Redirect<TRouter, TFrom, TTo, TMaskFrom, TMaskTo>).options =\n    opts\n\n  if (opts.throw) {\n    throw response\n  }\n\n  return response as Redirect<TRouter, TFrom, TTo, TMaskFrom, TMaskTo>\n}\n\n/** Check whether a value is a TanStack Router redirect Response. */\n/** Check whether a value is a TanStack Router redirect Response. */\nexport function isRedirect(obj: any): obj is AnyRedirect {\n  return obj instanceof Response && !!(obj as any).options\n}\n\n/** True if value is a redirect with a resolved `href` location. */\n/** True if value is a redirect with a resolved `href` location. */\nexport function isResolvedRedirect(\n  obj: any,\n): obj is AnyRedirect & { options: { href: string } } {\n  return isRedirect(obj) && !!obj.options.href\n}\n\n/** Parse a serialized redirect object back into a redirect Response. */\n/** Parse a serialized redirect object back into a redirect Response. */\nexport function parseRedirect(obj: any) {\n  if (obj !== null && typeof obj === 'object' && obj.isSerializedRedirect) {\n    return redirect(obj)\n  }\n\n  return undefined\n}\n"],"names":[],"mappings":";AAmHO,SAAS,SAOd,MACmD;AACnD,OAAK,aAAa,KAAK,cAAc,KAAK,QAAQ;AAGlD,MACE,CAAC,KAAK,kBACN,OAAO,KAAK,SAAS,YACrB,oBAAoB,KAAK,IAAI,GAC7B;AACA,UAAM,IAAI;AAAA,MACR,8CAA8C,KAAK,IAAI,WAAW,mBAAmB,KAAK,IAAI,CAAC;AAAA,IAAA;AAAA,EAEnG;AAEA,MACE,CAAC,KAAK,kBACN,CAAC,KAAK,kBACN,OAAO,KAAK,SAAS,UACrB;AACA,QAAI;AACF,UAAI,IAAI,KAAK,IAAI;AACjB,WAAK,iBAAiB;AAAA,IACxB,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,QAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,MAAI,KAAK,QAAQ,QAAQ,IAAI,UAAU,MAAM,MAAM;AACjD,YAAQ,IAAI,YAAY,KAAK,IAAI;AAAA,EACnC;AAEA,QAAM,WAAW,IAAI,SAAS,MAAM;AAAA,IAClC,QAAQ,KAAK;AAAA,IACb;AAAA,EAAA,CACD;AAEC,WAA+D,UAC/D;AAEF,MAAI,KAAK,OAAO;AACd,UAAM;AAAA,EACR;AAEA,SAAO;AACT;AAIO,SAAS,WAAW,KAA8B;AACvD,SAAO,eAAe,YAAY,CAAC,CAAE,IAAY;AACnD;AAIO,SAAS,mBACd,KACoD;AACpD,SAAO,WAAW,GAAG,KAAK,CAAC,CAAC,IAAI,QAAQ;AAC1C;AAIO,SAAS,cAAc,KAAU;AACtC,MAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,IAAI,sBAAsB;AACvE,WAAO,SAAS,GAAG;AAAA,EACrB;AAEA,SAAO;AACT;"}
+{"version":3,"file":"redirect.js","sources":["../../src/redirect.ts"],"sourcesContent":["import type { NavigateOptions } from './link'\nimport type { AnyRouter, RegisteredRouter } from './router'\nimport type { ParsedLocation } from './location'\n\nexport type AnyRedirect = Redirect<any, any, any, any, any>\n\n/**\n * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType)\n */\nexport type Redirect<\n  TRouter extends AnyRouter = RegisteredRouter,\n  TFrom extends string = string,\n  TTo extends string | undefined = undefined,\n  TMaskFrom extends string = TFrom,\n  TMaskTo extends string = '.',\n> = Response & {\n  options: NavigateOptions<TRouter, TFrom, TTo, TMaskFrom, TMaskTo> & {\n    /**\n     * @internal\n     * A **trusted** built location that can be used to redirect to.\n     */\n    _builtLocation?: ParsedLocation\n  }\n  redirectHandled?: boolean\n}\n\nexport type RedirectOptions<\n  TRouter extends AnyRouter = RegisteredRouter,\n  TFrom extends string = string,\n  TTo extends string | undefined = undefined,\n  TMaskFrom extends string = TFrom,\n  TMaskTo extends string = '.',\n> = {\n  href?: string\n  /**\n   * @deprecated Use `statusCode` instead\n   **/\n  code?: number\n  /**\n   * The HTTP status code to use when redirecting.\n   * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType#statuscode-property)\n   */\n  statusCode?: number\n  /**\n   * If provided, will throw the redirect object instead of returning it. This can be useful in places where `throwing` in a function might cause it to have a return type of `never`. In that case, you can use `redirect({ throw: true })` to throw the redirect object instead of returning it.\n   * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType#throw-property)\n   */\n  throw?: any\n  /**\n   * The HTTP headers to use when redirecting.\n   * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType#headers-property)\n   */\n  headers?: HeadersInit\n  /**\n   * @internal\n   * A **trusted** built location that can be used to redirect to.\n   */\n  _builtLocation?: ParsedLocation\n} & NavigateOptions<TRouter, TFrom, TTo, TMaskFrom, TMaskTo>\n\nexport type ResolvedRedirect<\n  TRouter extends AnyRouter = RegisteredRouter,\n  TFrom extends string = string,\n  TTo extends string = '',\n  TMaskFrom extends string = TFrom,\n  TMaskTo extends string = '',\n> = Redirect<TRouter, TFrom, TTo, TMaskFrom, TMaskTo>\n\n/**\n * Options for route-bound redirect, where 'from' is automatically set.\n * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType)\n */\nexport type RedirectOptionsRoute<\n  TDefaultFrom extends string = string,\n  TRouter extends AnyRouter = RegisteredRouter,\n  TTo extends string | undefined = undefined,\n  TMaskTo extends string = '',\n> = Omit<\n  RedirectOptions<TRouter, TDefaultFrom, TTo, TDefaultFrom, TMaskTo>,\n  'from'\n>\n\n/**\n * A redirect function bound to a specific route, with 'from' pre-set to the route's fullPath.\n * This enables relative redirects like `Route.redirect({ to: './overview' })`.\n * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RedirectType)\n */\nexport interface RedirectFnRoute<in out TDefaultFrom extends string = string> {\n  <\n    TRouter extends AnyRouter = RegisteredRouter,\n    const TTo extends string | undefined = undefined,\n    const TMaskTo extends string = '',\n  >(\n    opts: RedirectOptionsRoute<TDefaultFrom, TRouter, TTo, TMaskTo>,\n  ): Redirect<TRouter, TDefaultFrom, TTo, TDefaultFrom, TMaskTo>\n}\n\n/**\n * Create a redirect Response understood by TanStack Router.\n *\n * Use from route `loader`/`beforeLoad` or server functions to trigger a\n * navigation. If `throw: true` is set, the redirect is thrown instead of\n * returned. When an absolute `href` is supplied and `reloadDocument` is not\n * set, a full-document navigation is inferred.\n *\n * @param opts Options for the redirect. Common fields:\n * - `href`: absolute URL for external redirects; infers `reloadDocument`.\n * - `statusCode`: HTTP status code to use (defaults to 307).\n * - `headers`: additional headers to include on the Response.\n * - Standard navigation options like `to`, `params`, `search`, `replace`,\n *   and `reloadDocument` for internal redirects.\n * @returns A Response augmented with router navigation options.\n * @link https://tanstack.com/router/latest/docs/framework/react/api/router/redirectFunction\n */\nexport function redirect<\n  TRouter extends AnyRouter = RegisteredRouter,\n  const TTo extends string | undefined = '.',\n  const TFrom extends string = string,\n  const TMaskFrom extends string = TFrom,\n  const TMaskTo extends string = '',\n>(\n  opts: RedirectOptions<TRouter, TFrom, TTo, TMaskFrom, TMaskTo>,\n): Redirect<TRouter, TFrom, TTo, TMaskFrom, TMaskTo> {\n  opts.statusCode = opts.statusCode || opts.code || 307\n\n  if (\n    !opts._builtLocation &&\n    !opts.reloadDocument &&\n    typeof opts.href === 'string'\n  ) {\n    try {\n      new URL(opts.href)\n      opts.reloadDocument = true\n    } catch {}\n  }\n\n  const headers = new Headers(opts.headers)\n  if (opts.href && headers.get('Location') === null) {\n    headers.set('Location', opts.href)\n  }\n\n  const response = new Response(null, {\n    status: opts.statusCode,\n    headers,\n  })\n\n  ;(response as Redirect<TRouter, TFrom, TTo, TMaskFrom, TMaskTo>).options =\n    opts\n\n  if (opts.throw) {\n    throw response\n  }\n\n  return response as Redirect<TRouter, TFrom, TTo, TMaskFrom, TMaskTo>\n}\n\n/** Check whether a value is a TanStack Router redirect Response. */\n/** Check whether a value is a TanStack Router redirect Response. */\nexport function isRedirect(obj: any): obj is AnyRedirect {\n  return obj instanceof Response && !!(obj as any).options\n}\n\n/** True if value is a redirect with a resolved `href` location. */\n/** True if value is a redirect with a resolved `href` location. */\nexport function isResolvedRedirect(\n  obj: any,\n): obj is AnyRedirect & { options: { href: string } } {\n  return isRedirect(obj) && !!obj.options.href\n}\n\n/** Parse a serialized redirect object back into a redirect Response. */\n/** Parse a serialized redirect object back into a redirect Response. */\nexport function parseRedirect(obj: any) {\n  if (obj !== null && typeof obj === 'object' && obj.isSerializedRedirect) {\n    return redirect(obj)\n  }\n\n  return undefined\n}\n"],"names":[],"mappings":"AAkHO,SAAS,SAOd,MACmD;AACnD,OAAK,aAAa,KAAK,cAAc,KAAK,QAAQ;AAElD,MACE,CAAC,KAAK,kBACN,CAAC,KAAK,kBACN,OAAO,KAAK,SAAS,UACrB;AACA,QAAI;AACF,UAAI,IAAI,KAAK,IAAI;AACjB,WAAK,iBAAiB;AAAA,IACxB,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,QAAM,UAAU,IAAI,QAAQ,KAAK,OAAO;AACxC,MAAI,KAAK,QAAQ,QAAQ,IAAI,UAAU,MAAM,MAAM;AACjD,YAAQ,IAAI,YAAY,KAAK,IAAI;AAAA,EACnC;AAEA,QAAM,WAAW,IAAI,SAAS,MAAM;AAAA,IAClC,QAAQ,KAAK;AAAA,IACb;AAAA,EAAA,CACD;AAEC,WAA+D,UAC/D;AAEF,MAAI,KAAK,OAAO;AACd,UAAM;AAAA,EACR;AAEA,SAAO;AACT;AAIO,SAAS,WAAW,KAA8B;AACvD,SAAO,eAAe,YAAY,CAAC,CAAE,IAAY;AACnD;AAIO,SAAS,mBACd,KACoD;AACpD,SAAO,WAAW,GAAG,KAAK,CAAC,CAAC,IAAI,QAAQ;AAC1C;AAIO,SAAS,cAAc,KAAU;AACtC,MAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,IAAI,sBAAsB;AACvE,WAAO,SAAS,GAAG;AAAA,EACrB;AAEA,SAAO;AACT;"}

package/dist/esm/router.d.ts

@@ -333,6 +333,14 @@ export interface RouterOptions<TRouteTree extends AnyRoute, TTrailingSlashOption
      * @default false
      */
     disableGlobalCatchBoundary?: boolean;
+    /**
+     * An array of URL protocols to allow in links, redirects, and navigation.
+     * Absolute URLs with protocols not in this list will be rejected.
+     *
+     * @default DEFAULT_PROTOCOL_ALLOWLIST (http:, https:, mailto:, tel:)
+     * @link [API Docs](https://tanstack.com/router/latest/docs/framework/react/api/router/RouterOptionsType#protocolallowlist-property)
+     */
+    protocolAllowlist?: Array<string>;
     serializationAdapters?: ReadonlyArray<AnySerializationAdapter>;
     /**
      * Configures how the router will rewrite the location between the actual href and the internal href of the router.
@@ -586,6 +594,7 @@ export declare class RouterCore<in out TRouteTree extends AnyRoute, in out TTrai
     resolvePathCache: LRUCache<string, string>;
     isServer: boolean;
     pathParamsDecoder?: (encoded: string) => string;
+    protocolAllowlist: Set<string>;
     /**
      * @deprecated Use the `createRouter` function instead
      */

package/dist/esm/router.js

@@ -2,7 +2,7 @@ import { Store } from "@tanstack/store";
 import { createBrowserHistory, parseHref } from "@tanstack/history";
 import { isServer } from "@tanstack/router-core/isServer";
 import { batch } from "./utils/batch.js";
-import { createControlledPromise, isDangerousProtocol, deepEqual, replaceEqualDeep, last, decodePath, functionalUpdate, findLast, encodePathLikeUrl } from "./utils.js";
+import { createControlledPromise, isDangerousProtocol, deepEqual, DEFAULT_PROTOCOL_ALLOWLIST, replaceEqualDeep, last, decodePath, functionalUpdate, findLast, encodePathLikeUrl } from "./utils.js";
 import { processRouteTree, processRouteMasks, findSingleMatch, findRouteMatch, findFlatMatch } from "./new-process-route-tree.js";
 import { compileDecodeCharMap, trimPath, resolvePath, cleanPath, trimPathRight, interpolatePath } from "./path.js";
 import { createLRUCache } from "./lru-cache.js";
@@ -80,6 +80,7 @@ class RouterCore {
         ...newOptions
       };
       this.isServer = this.options.isServer ?? typeof document === "undefined";
+      this.protocolAllowlist = new Set(this.options.protocolAllowlist);
       if (this.options.pathParamsAllowedCharacters)
         this.pathParamsDecoder = compileDecodeCharMap(
           this.options.pathParamsAllowedCharacters
@@ -625,7 +626,7 @@ class RouterCore {
           publicHref = publicHref ?? location.publicHref;
         }
         const reloadHref = !hrefIsUrl && publicHref ? publicHref : href;
-        if (isDangerousProtocol(reloadHref)) {
+        if (isDangerousProtocol(reloadHref, this.protocolAllowlist)) {
           if (process.env.NODE_ENV !== "production") {
             console.warn(
               `Blocked navigation to dangerous protocol: ${reloadHref}`
@@ -921,6 +922,12 @@ class RouterCore {
         } catch {
         }
       }
+      if (redirect2.options.href && !redirect2.options._builtLocation && // Check for dangerous protocols before processing the redirect
+      isDangerousProtocol(redirect2.options.href, this.protocolAllowlist)) {
+        throw new Error(
+          `Redirect blocked: unsafe protocol in href "${redirect2.options.href}". Allowed protocols: ${Array.from(this.protocolAllowlist).join(", ")}.`
+        );
+      }
       if (!redirect2.headers.get("Location")) {
         redirect2.headers.set("Location", redirect2.options.href);
       }
@@ -1068,7 +1075,8 @@ class RouterCore {
       caseSensitive: options.caseSensitive ?? false,
       notFoundMode: options.notFoundMode ?? "fuzzy",
       stringifySearch: options.stringifySearch ?? defaultStringifySearch,
-      parseSearch: options.parseSearch ?? defaultParseSearch
+      parseSearch: options.parseSearch ?? defaultParseSearch,
+      protocolAllowlist: options.protocolAllowlist ?? DEFAULT_PROTOCOL_ALLOWLIST
     });
     if (typeof document !== "undefined") {
       self.__TSR_ROUTER__ = this;