@tanstack/router-core 1.171.15 → 1.171.16

package/dist/esm/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":[],"sources":["../../src/utils.ts"],"sourcesContent":["import { isServer } from '@tanstack/router-core/isServer'\nimport type { RouteIds } from './routeInfo'\nimport type { AnyRouter } from './router'\n\nexport type Awaitable<T> = T | Promise<T>\nexport type NoInfer<T> = [T][T extends any ? 0 : never]\nexport type IsAny<TValue, TYesResult, TNoResult = TValue> = 1 extends 0 & TValue\n  ? TYesResult\n  : TNoResult\n\nexport type PickAsRequired<TValue, TKey extends keyof TValue> = Omit<\n  TValue,\n  TKey\n> &\n  Required<Pick<TValue, TKey>>\n\nexport type PickRequired<T> = {\n  [K in keyof T as undefined extends T[K] ? never : K]: T[K]\n}\n\nexport type PickOptional<T> = {\n  [K in keyof T as undefined extends T[K] ? K : never]: T[K]\n}\n\n// from https://stackoverflow.com/a/76458160\nexport type WithoutEmpty<T> = T extends any ? ({} extends T ? never : T) : never\n\nexport type Expand<T> = T extends object\n  ? T extends infer O\n    ? O extends Function\n      ? O\n      : { [K in keyof O]: O[K] }\n    : never\n  : T\n\nexport type DeepPartial<T> = T extends object\n  ? {\n      [P in keyof T]?: DeepPartial<T[P]>\n    }\n  : T\n\nexport type MakeDifferenceOptional<TLeft, TRight> = keyof TLeft &\n  keyof TRight extends never\n  ? TRight\n  : Omit<TRight, keyof TLeft & keyof TRight> & {\n      [K in keyof TLeft & keyof TRight]?: TRight[K]\n    }\n\n// from https://stackoverflow.com/a/53955431\n// eslint-disable-next-line @typescript-eslint/naming-convention\nexport type IsUnion<T, U extends T = T> = (\n  T extends any ? (U extends T ? false : true) : never\n) extends false\n  ? false\n  : true\n\nexport type IsNonEmptyObject<T> = T extends object\n  ? keyof T extends never\n    ? false\n    : true\n  : false\n\nexport type Assign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : keyof TLeft & keyof TRight extends never\n          ? TLeft & TRight\n          : Omit<TLeft, keyof TRight> & TRight\n    : never\n  : never\n\nexport type IntersectAssign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : TRight & TLeft\n    : never\n  : never\n\nexport type Timeout = ReturnType<typeof setTimeout>\n\nexport type Updater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev?: TPrevious) => TResult)\n\nexport type NonNullableUpdater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev: TPrevious) => TResult)\n\nexport type ExtractObjects<TUnion> = TUnion extends MergeAllPrimitive\n  ? never\n  : TUnion\n\nexport type PartialMergeAllObject<TUnion> =\n  ExtractObjects<TUnion> extends infer TObj\n    ? [TObj] extends [never]\n      ? never\n      : {\n          [TKey in TObj extends any ? keyof TObj : never]?: TObj extends any\n            ? TKey extends keyof TObj\n              ? TObj[TKey]\n              : never\n            : never\n        }\n    : never\n\nexport type MergeAllPrimitive =\n  | ReadonlyArray<any>\n  | number\n  | string\n  | bigint\n  | boolean\n  | symbol\n  | undefined\n  | null\n\nexport type ExtractPrimitives<TUnion> = TUnion extends MergeAllPrimitive\n  ? TUnion\n  : TUnion extends object\n    ? never\n    : TUnion\n\nexport type PartialMergeAll<TUnion> =\n  | ExtractPrimitives<TUnion>\n  | PartialMergeAllObject<TUnion>\n\nexport type Constrain<T, TConstraint, TDefault = TConstraint> =\n  | (T extends TConstraint ? T : never)\n  | TDefault\n\nexport type ConstrainLiteral<T, TConstraint, TDefault = TConstraint> =\n  | (T & TConstraint)\n  | TDefault\n\n/**\n * To be added to router types\n */\nexport type UnionToIntersection<T> = (\n  T extends any ? (arg: T) => any : never\n) extends (arg: infer T) => any\n  ? T\n  : never\n\n/**\n * Merges everything in a union into one object.\n * This mapped type is homomorphic which means it preserves stuff! :)\n */\nexport type MergeAllObjects<\n  TUnion,\n  TIntersected = UnionToIntersection<ExtractObjects<TUnion>>,\n> = [keyof TIntersected] extends [never]\n  ? never\n  : {\n      [TKey in keyof TIntersected]: TUnion extends any\n        ? TUnion[TKey & keyof TUnion]\n        : never\n    }\n\nexport type MergeAll<TUnion> =\n  | MergeAllObjects<TUnion>\n  | ExtractPrimitives<TUnion>\n\nexport type ValidateJSON<T> = ((...args: Array<any>) => any) extends T\n  ? unknown extends T\n    ? never\n    : 'Function is not serializable'\n  : { [K in keyof T]: ValidateJSON<T[K]> }\n\nexport type LooseReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn\n  : never\n\nexport type LooseAsyncReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn extends Promise<infer TReturn>\n    ? TReturn\n    : TReturn\n  : never\n\n/**\n * Return the last element of an array.\n * Intended for non-empty arrays used within router internals.\n */\nexport function last<T>(arr: ReadonlyArray<T>) {\n  return arr[arr.length - 1]\n}\n\nfunction isFunction(d: any): d is Function {\n  return typeof d === 'function'\n}\n\n/**\n * Apply a value-or-updater to a previous value.\n * Accepts either a literal value or a function of the previous value.\n */\nexport function functionalUpdate<TPrevious, TResult = TPrevious>(\n  updater: Updater<TPrevious, TResult> | NonNullableUpdater<TPrevious, TResult>,\n  previous: TPrevious,\n): TResult {\n  if (isFunction(updater)) {\n    return updater(previous)\n  }\n\n  return updater\n}\n\nexport const hasOwn = Object.prototype.hasOwnProperty\nconst isEnumerable = Object.prototype.propertyIsEnumerable\n\nexport function hasKeys(obj: Record<string, unknown>) {\n  for (const key in obj) {\n    if (hasOwn.call(obj, key)) return true\n  }\n  return false\n}\n\nexport const createNull = () => Object.create(null)\nexport const nullReplaceEqualDeep: typeof replaceEqualDeep = (prev, next) =>\n  replaceEqualDeep(prev, next, createNull)\n\n/**\n * This function returns `prev` if `_next` is deeply equal.\n * If not, it will replace any deeply equal children of `b` with those of `a`.\n * This can be used for structural sharing between immutable JSON values for example.\n * Do not use this with signals\n */\nexport function replaceEqualDeep<T>(\n  prev: any,\n  _next: T,\n  _makeObj = () => ({}),\n  _depth = 0,\n): T {\n  if (isServer) {\n    return _next\n  }\n  if (prev === _next) {\n    return prev\n  }\n\n  if (_depth > 500) return _next\n\n  const next = _next as any\n\n  const array = isPlainArray(prev) && isPlainArray(next)\n\n  if (!array && !(isPlainObject(prev) && isPlainObject(next))) return next\n\n  const prevItems = array ? prev : getEnumerableOwnKeys(prev)\n  if (!prevItems) return next\n  const nextItems = array ? next : getEnumerableOwnKeys(next)\n  if (!nextItems) return next\n  const prevSize = prevItems.length\n  const nextSize = nextItems.length\n  const copy: any = array ? new Array(nextSize) : _makeObj()\n\n  let equalItems = 0\n\n  for (let i = 0; i < nextSize; i++) {\n    const key = array ? i : (nextItems[i] as any)\n    const p = prev[key]\n    const n = next[key]\n\n    if (p === n) {\n      copy[key] = p\n      if (array ? i < prevSize : hasOwn.call(prev, key)) equalItems++\n      continue\n    }\n\n    if (\n      p === null ||\n      n === null ||\n      typeof p !== 'object' ||\n      typeof n !== 'object'\n    ) {\n      copy[key] = n\n      continue\n    }\n\n    const v = replaceEqualDeep(p, n, _makeObj, _depth + 1)\n    copy[key] = v\n    if (v === p) equalItems++\n  }\n\n  return prevSize === nextSize && equalItems === prevSize ? prev : copy\n}\n\n/**\n * Equivalent to `Reflect.ownKeys`, but ensures that objects are \"clone-friendly\":\n * will return false if object has any non-enumerable properties.\n *\n * Optimized for the common case where objects have no symbol properties.\n */\nfunction getEnumerableOwnKeys(o: object) {\n  const names = Object.getOwnPropertyNames(o)\n\n  // Fast path: check all string property names are enumerable\n  for (const name of names) {\n    if (!isEnumerable.call(o, name)) return false\n  }\n\n  // Only check symbols if the object has any (most plain objects don't)\n  const symbols = Object.getOwnPropertySymbols(o)\n\n  // Fast path: no symbols, return names directly (avoids array allocation/concat)\n  if (symbols.length === 0) return names\n\n  // Slow path: has symbols, need to check and merge\n  const keys: Array<string | symbol> = names\n  for (const symbol of symbols) {\n    if (!isEnumerable.call(o, symbol)) return false\n    keys.push(symbol)\n  }\n  return keys\n}\n\n// Copied from: https://github.com/jonschlinkert/is-plain-object\nexport function isPlainObject(o: any) {\n  if (!hasObjectPrototype(o)) {\n    return false\n  }\n\n  // If has modified constructor\n  const ctor = o.constructor\n  if (typeof ctor === 'undefined') {\n    return true\n  }\n\n  // If has modified prototype\n  const prot = ctor.prototype\n  if (!hasObjectPrototype(prot)) {\n    return false\n  }\n\n  // If constructor does not have an Object-specific method\n  if (!prot.hasOwnProperty('isPrototypeOf')) {\n    return false\n  }\n\n  // Most likely a plain Object\n  return true\n}\n\nfunction hasObjectPrototype(o: any) {\n  return Object.prototype.toString.call(o) === '[object Object]'\n}\n\n/**\n * Check if a value is a \"plain\" array (no extra enumerable keys).\n */\nexport function isPlainArray(value: unknown): value is Array<unknown> {\n  return Array.isArray(value) && value.length === Object.keys(value).length\n}\n\n/**\n * Perform a deep equality check with options for partial comparison and\n * ignoring `undefined` values. Optimized for router state comparisons.\n */\nexport function deepEqual(\n  a: any,\n  b: any,\n  opts?: { partial?: boolean; ignoreUndefined?: boolean },\n): boolean {\n  if (a === b) {\n    return true\n  }\n\n  if (typeof a !== typeof b) {\n    return false\n  }\n\n  if (Array.isArray(a) && Array.isArray(b)) {\n    if (a.length !== b.length) return false\n    for (let i = 0, l = a.length; i < l; i++) {\n      if (!deepEqual(a[i], b[i], opts)) return false\n    }\n    return true\n  }\n\n  if (isPlainObject(a) && isPlainObject(b)) {\n    const ignoreUndefined = opts?.ignoreUndefined ?? true\n\n    if (opts?.partial) {\n      for (const k in b) {\n        if (!ignoreUndefined || b[k] !== undefined) {\n          if (!deepEqual(a[k], b[k], opts)) return false\n        }\n      }\n      return true\n    }\n\n    let aCount = 0\n    if (!ignoreUndefined) {\n      aCount = Object.keys(a).length\n    } else {\n      for (const k in a) {\n        if (a[k] !== undefined) aCount++\n      }\n    }\n\n    let bCount = 0\n    for (const k in b) {\n      if (!ignoreUndefined || b[k] !== undefined) {\n        bCount++\n        if (bCount > aCount || !deepEqual(a[k], b[k], opts)) return false\n      }\n    }\n\n    return aCount === bCount\n  }\n\n  return false\n}\n\nexport type StringLiteral<T> = T extends string\n  ? string extends T\n    ? string\n    : T\n  : never\n\nexport type ThrowOrOptional<T, TThrow extends boolean> = TThrow extends true\n  ? T\n  : T | undefined\n\nexport type StrictOrFrom<\n  TRouter extends AnyRouter,\n  TFrom,\n  TStrict extends boolean = true,\n> = TStrict extends false\n  ? {\n      from?: never\n      strict: TStrict\n    }\n  : {\n      from: ConstrainLiteral<TFrom, RouteIds<TRouter['routeTree']>>\n      strict?: TStrict\n    }\n\nexport type ThrowConstraint<\n  TStrict extends boolean,\n  TThrow extends boolean,\n> = TStrict extends false ? (TThrow extends true ? never : TThrow) : TThrow\n\nexport type ControlledPromise<T> = Promise<T> & {\n  resolve: (value: T) => void\n  reject: (value: any) => void\n  status: 'pending' | 'resolved' | 'rejected'\n  value?: T\n}\n\n/**\n * Create a promise with exposed resolve/reject and status fields.\n * Useful for coordinating async router lifecycle operations.\n */\nexport function createControlledPromise<T>(onResolve?: (value: T) => void) {\n  let resolveLoadPromise!: (value: T) => void\n  let rejectLoadPromise!: (value: any) => void\n\n  const controlledPromise = new Promise<T>((resolve, reject) => {\n    resolveLoadPromise = resolve\n    rejectLoadPromise = reject\n  }) as ControlledPromise<T>\n\n  controlledPromise.status = 'pending'\n\n  controlledPromise.resolve = (value: T) => {\n    controlledPromise.status = 'resolved'\n    controlledPromise.value = value\n    resolveLoadPromise(value)\n    onResolve?.(value)\n  }\n\n  controlledPromise.reject = (e) => {\n    controlledPromise.status = 'rejected'\n    rejectLoadPromise(e)\n  }\n\n  return controlledPromise\n}\n\n/**\n * Heuristically detect dynamic import \"module not found\" errors\n * across major browsers for lazy route component handling.\n */\nexport function isModuleNotFoundError(error: any): boolean {\n  // chrome: \"Failed to fetch dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // firefox: \"error loading dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // safari: \"Importing a module script failed.\"\n  if (typeof error?.message !== 'string') return false\n  return (\n    error.message.startsWith('Failed to fetch dynamically imported module') ||\n    error.message.startsWith('error loading dynamically imported module') ||\n    error.message.startsWith('Importing a module script failed')\n  )\n}\n\nexport function isPromise<T>(\n  value: Promise<Awaited<T>> | T,\n): value is Promise<Awaited<T>> {\n  return Boolean(\n    value &&\n    typeof value === 'object' &&\n    typeof (value as Promise<T>).then === 'function',\n  )\n}\n\nexport function findLast<T>(\n  array: ReadonlyArray<T>,\n  predicate: (item: T) => boolean,\n): T | undefined {\n  for (let i = array.length - 1; i >= 0; i--) {\n    const item = array[i]!\n    if (predicate(item)) return item\n  }\n  return undefined\n}\n\n/**\n * Re-encode characters that are unsafe in URL paths.\n * Includes ASCII control characters (0x00-0x1F, 0x7F) and a subset of the\n * WHATWG URL \"path percent-encode set\" (\", <, >, `, {, }).\n *\n * Space (0x20) is intentionally excluded — decodeURI decodes %20 to space\n * and the router stores decoded spaces in location.pathname. The existing\n * encodePathLikeUrl already handles re-encoding spaces for outgoing URLs.\n *\n * These characters are decoded by decodeURI but must remain percent-encoded\n * in paths to match how upstream layers (CDNs, edge middleware, browsers)\n * interpret the URL, preventing infinite redirect loops and path mismatches.\n */\n// eslint-disable-next-line no-control-regex\nconst PATH_UNSAFE_RE = /[\\x00-\\x1f\\x7f\"<>`{}]/g\n\nfunction sanitizePathSegment(segment: string): string {\n  return segment.replace(\n    PATH_UNSAFE_RE,\n    (ch) => '%' + ch.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'),\n  )\n}\n\nfunction decodeSegment(segment: string): string {\n  let decoded: string\n  try {\n    decoded = decodeURI(segment)\n  } catch {\n    // if the decoding fails, try to decode the various parts leaving the malformed tags in place\n    decoded = segment.replaceAll(/%[0-9A-F]{2}/gi, (match) => {\n      try {\n        return decodeURI(match)\n      } catch {\n        return match\n      }\n    })\n  }\n  return sanitizePathSegment(decoded)\n}\n\n/**\n * Default list of URL protocols to allow in links, redirects, and navigation.\n * Any absolute URL protocol not in this list is treated as dangerous by default.\n */\nexport const DEFAULT_PROTOCOL_ALLOWLIST = [\n  // Standard web navigation\n  'http:',\n  'https:',\n\n  // Common browser-safe actions\n  'mailto:',\n  'tel:',\n]\n\n/**\n * Check if a URL string uses a protocol that is not in the allowlist.\n * Returns true for blocked protocols like javascript:, blob:, data:, etc.\n *\n * The URL constructor correctly normalizes:\n * - Mixed case (JavaScript: → javascript:)\n * - Whitespace/control characters (java\\nscript: → javascript:)\n * - Leading whitespace\n *\n * For relative URLs (no protocol), returns false (safe).\n *\n * @param url - The URL string to check\n * @param allowlist - Set of protocols to allow\n * @returns true if the URL uses a protocol that is not allowed\n */\nexport function isDangerousProtocol(\n  url: string,\n  allowlist: Set<string>,\n): boolean {\n  if (!url) return false\n\n  try {\n    // Use the URL constructor - it correctly normalizes protocols\n    // per WHATWG URL spec, handling all bypass attempts automatically\n    const parsed = new URL(url)\n    return !allowlist.has(parsed.protocol)\n  } catch {\n    // URL constructor throws for relative URLs (no protocol)\n    // These are safe - they can't execute scripts\n    return false\n  }\n}\n\n// This utility is based on https://github.com/zertosh/htmlescape\n// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE\nconst HTML_ESCAPE_LOOKUP: { [match: string]: string } = {\n  '&': '\\\\u0026',\n  '>': '\\\\u003e',\n  '<': '\\\\u003c',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\nconst HTML_ESCAPE_REGEX = /[&><\\u2028\\u2029]/g\n\n/**\n * Escape HTML special characters in a string to prevent XSS attacks\n * when embedding strings in script tags during SSR.\n *\n * This is essential for preventing XSS vulnerabilities when user-controlled\n * content is embedded in inline scripts.\n */\nexport function escapeHtml(str: string): string {\n  return str.replace(HTML_ESCAPE_REGEX, (match) => HTML_ESCAPE_LOOKUP[match]!)\n}\n\nexport function decodePath(path: string) {\n  if (!path) return { path, handledProtocolRelativeURL: false }\n\n  // Fast path: most paths are already decoded and safe.\n  // Only fall back to the slower scan/regex path when we see a '%' (encoded),\n  // a backslash (explicitly handled), a control character, or a protocol-relative\n  // prefix which needs collapsing.\n  // eslint-disable-next-line no-control-regex\n  if (!/[%\\\\\\x00-\\x1f\\x7f]/.test(path) && !path.startsWith('//')) {\n    return { path, handledProtocolRelativeURL: false }\n  }\n\n  const re = /%25|%5C/gi\n  let cursor = 0\n  let result = ''\n  let match\n  while (null !== (match = re.exec(path))) {\n    result += decodeSegment(path.slice(cursor, match.index)) + match[0]\n    cursor = re.lastIndex\n  }\n  result = result + decodeSegment(cursor ? path.slice(cursor) : path)\n\n  // Prevent open redirect via protocol-relative URLs (e.g. \"//evil.com\")\n  // This is defense-in-depth: since control characters are no longer decoded,\n  // paths like \"/%0d/evil.com\" can no longer become \"//evil.com\". But we keep\n  // this check to guard against other edge cases.\n  let handledProtocolRelativeURL = false\n  if (result.startsWith('//')) {\n    handledProtocolRelativeURL = true\n    result = '/' + result.replace(/^\\/+/, '')\n  }\n\n  return { path: result, handledProtocolRelativeURL }\n}\n\n/**\n * Encodes a path the same way `new URL()` would, but without the overhead of full URL parsing.\n *\n * This function encodes:\n * - Whitespace characters (spaces → %20, tabs → %09, etc.)\n * - Non-ASCII/Unicode characters (emojis, accented characters, etc.)\n *\n * It preserves:\n * - Already percent-encoded sequences (won't double-encode %2F, %25, etc.)\n * - ASCII special characters valid in URL paths (@, $, &, +, etc.)\n * - Forward slashes as path separators\n *\n * Used to generate proper href values for SSR without constructing URL objects.\n *\n * @example\n * encodePathLikeUrl('/path/file name.pdf') // '/path/file%20name.pdf'\n * encodePathLikeUrl('/path/日本語') // '/path/%E6%97%A5%E6%9C%AC%E8%AA%9E'\n * encodePathLikeUrl('/path/already%20encoded') // '/path/already%20encoded' (preserved)\n */\nexport function encodePathLikeUrl(path: string): string {\n  // Encode whitespace and non-ASCII characters that browsers encode in URLs\n\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  if (!/\\s|[^\\u0000-\\u007F]/.test(path)) return path\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  return path.replace(/\\s|[^\\u0000-\\u007F]/gu, encodeURIComponent)\n}\n\n/**\n * Builds the dev-mode CSS styles URL for route-scoped CSS collection.\n * Used by HeadContent components in all framework implementations to construct\n * the URL for the `/@tanstack-start/styles.css` endpoint.\n *\n * @param basepath - The router's basepath (may or may not have leading slash)\n * @param routeIds - Array of matched route IDs to include in the CSS collection\n * @returns The full URL path for the dev styles CSS endpoint\n */\nexport function buildDevStylesUrl(\n  basepath: string,\n  routeIds: Array<string>,\n): string {\n  // Trim all leading and trailing slashes from basepath\n  const trimmedBasepath = basepath.replace(/^\\/+|\\/+$/g, '')\n  // Build normalized basepath: empty string for root, or '/path' for non-root\n  const normalizedBasepath = trimmedBasepath === '' ? '' : `/${trimmedBasepath}`\n  return `${normalizedBasepath}/@tanstack-start/styles.css?routes=${encodeURIComponent(routeIds.join(','))}`\n}\n\nexport function arraysEqual<T>(a: Array<T>, b: Array<T>) {\n  if (a === b) return true\n  if (a.length !== b.length) return false\n  for (let i = 0; i < a.length; i++) {\n    if (a[i] !== b[i]) return false\n  }\n  return true\n}\n"],"mappings":";;;;;;AA+LA,SAAgB,KAAQ,KAAuB;CAC7C,OAAO,IAAI,IAAI,SAAS;AAC1B;AAEA,SAAS,WAAW,GAAuB;CACzC,OAAO,OAAO,MAAM;AACtB;;;;;AAMA,SAAgB,iBACd,SACA,UACS;CACT,IAAI,WAAW,OAAO,GACpB,OAAO,QAAQ,QAAQ;CAGzB,OAAO;AACT;AAEA,MAAa,SAAS,OAAO,UAAU;AACvC,MAAM,eAAe,OAAO,UAAU;AAEtC,SAAgB,QAAQ,KAA8B;CACpD,KAAK,MAAM,OAAO,KAChB,IAAI,OAAO,KAAK,KAAK,GAAG,GAAG,OAAO;CAEpC,OAAO;AACT;AAEA,MAAa,mBAAmB,OAAO,OAAO,IAAI;AAClD,MAAa,wBAAiD,MAAM,SAClE,iBAAiB,MAAM,MAAM,UAAU;;;;;;;AAQzC,SAAgB,iBACd,MACA,OACA,kBAAkB,CAAC,IACnB,SAAS,GACN;CACH,IAAI,UACF,OAAO;CAET,IAAI,SAAS,OACX,OAAO;CAGT,IAAI,SAAS,KAAK,OAAO;CAEzB,MAAM,OAAO;CAEb,MAAM,QAAQ,aAAa,IAAI,KAAK,aAAa,IAAI;CAErD,IAAI,CAAC,SAAS,EAAE,cAAc,IAAI,KAAK,cAAc,IAAI,IAAI,OAAO;CAEpE,MAAM,YAAY,QAAQ,OAAO,qBAAqB,IAAI;CAC1D,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,YAAY,QAAQ,OAAO,qBAAqB,IAAI;CAC1D,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,WAAW,UAAU;CAC3B,MAAM,WAAW,UAAU;CAC3B,MAAM,OAAY,QAAQ,IAAI,MAAM,QAAQ,IAAI,SAAS;CAEzD,IAAI,aAAa;CAEjB,KAAK,IAAI,IAAI,GAAG,IAAI,UAAU,KAAK;EACjC,MAAM,MAAM,QAAQ,IAAK,UAAU;EACnC,MAAM,IAAI,KAAK;EACf,MAAM,IAAI,KAAK;EAEf,IAAI,MAAM,GAAG;GACX,KAAK,OAAO;GACZ,IAAI,QAAQ,IAAI,WAAW,OAAO,KAAK,MAAM,GAAG,GAAG;GACnD;EACF;EAEA,IACE,MAAM,QACN,MAAM,QACN,OAAO,MAAM,YACb,OAAO,MAAM,UACb;GACA,KAAK,OAAO;GACZ;EACF;EAEA,MAAM,IAAI,iBAAiB,GAAG,GAAG,UAAU,SAAS,CAAC;EACrD,KAAK,OAAO;EACZ,IAAI,MAAM,GAAG;CACf;CAEA,OAAO,aAAa,YAAY,eAAe,WAAW,OAAO;AACnE;;;;;;;AAQA,SAAS,qBAAqB,GAAW;CACvC,MAAM,QAAQ,OAAO,oBAAoB,CAAC;CAG1C,KAAK,MAAM,QAAQ,OACjB,IAAI,CAAC,aAAa,KAAK,GAAG,IAAI,GAAG,OAAO;CAI1C,MAAM,UAAU,OAAO,sBAAsB,CAAC;CAG9C,IAAI,QAAQ,WAAW,GAAG,OAAO;CAGjC,MAAM,OAA+B;CACrC,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,CAAC,aAAa,KAAK,GAAG,MAAM,GAAG,OAAO;EAC1C,KAAK,KAAK,MAAM;CAClB;CACA,OAAO;AACT;AAGA,SAAgB,cAAc,GAAQ;CACpC,IAAI,CAAC,mBAAmB,CAAC,GACvB,OAAO;CAIT,MAAM,OAAO,EAAE;CACf,IAAI,OAAO,SAAS,aAClB,OAAO;CAIT,MAAM,OAAO,KAAK;CAClB,IAAI,CAAC,mBAAmB,IAAI,GAC1B,OAAO;CAIT,IAAI,CAAC,KAAK,eAAe,eAAe,GACtC,OAAO;CAIT,OAAO;AACT;AAEA,SAAS,mBAAmB,GAAQ;CAClC,OAAO,OAAO,UAAU,SAAS,KAAK,CAAC,MAAM;AAC/C;;;;AAKA,SAAgB,aAAa,OAAyC;CACpE,OAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE;AACrE;;;;;AAMA,SAAgB,UACd,GACA,GACA,MACS;CACT,IAAI,MAAM,GACR,OAAO;CAGT,IAAI,OAAO,MAAM,OAAO,GACtB,OAAO;CAGT,IAAI,MAAM,QAAQ,CAAC,KAAK,MAAM,QAAQ,CAAC,GAAG;EACxC,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;EAClC,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAI,GAAG,KACnC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,OAAO;EAE3C,OAAO;CACT;CAEA,IAAI,cAAc,CAAC,KAAK,cAAc,CAAC,GAAG;EACxC,MAAM,kBAAkB,MAAM,mBAAmB;EAEjD,IAAI,MAAM,SAAS;GACjB,KAAK,MAAM,KAAK,GACd,IAAI,CAAC,mBAAmB,EAAE,OAAO,KAAA;QAC3B,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,OAAO;GAAA;GAG7C,OAAO;EACT;EAEA,IAAI,SAAS;EACb,IAAI,CAAC,iBACH,SAAS,OAAO,KAAK,CAAC,EAAE;OAExB,KAAK,MAAM,KAAK,GACd,IAAI,EAAE,OAAO,KAAA,GAAW;EAI5B,IAAI,SAAS;EACb,KAAK,MAAM,KAAK,GACd,IAAI,CAAC,mBAAmB,EAAE,OAAO,KAAA,GAAW;GAC1C;GACA,IAAI,SAAS,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,OAAO;EAC9D;EAGF,OAAO,WAAW;CACpB;CAEA,OAAO;AACT;;;;;AA0CA,SAAgB,wBAA2B,WAAgC;CACzE,IAAI;CACJ,IAAI;CAEJ,MAAM,oBAAoB,IAAI,SAAY,SAAS,WAAW;EAC5D,qBAAqB;EACrB,oBAAoB;CACtB,CAAC;CAED,kBAAkB,SAAS;CAE3B,kBAAkB,WAAW,UAAa;EACxC,kBAAkB,SAAS;EAC3B,kBAAkB,QAAQ;EAC1B,mBAAmB,KAAK;EACxB,YAAY,KAAK;CACnB;CAEA,kBAAkB,UAAU,MAAM;EAChC,kBAAkB,SAAS;EAC3B,kBAAkB,CAAC;CACrB;CAEA,OAAO;AACT;;;;;AAMA,SAAgB,sBAAsB,OAAqB;CAIzD,IAAI,OAAO,OAAO,YAAY,UAAU,OAAO;CAC/C,OACE,MAAM,QAAQ,WAAW,6CAA6C,KACtE,MAAM,QAAQ,WAAW,2CAA2C,KACpE,MAAM,QAAQ,WAAW,kCAAkC;AAE/D;AAEA,SAAgB,UACd,OAC8B;CAC9B,OAAO,QACL,SACA,OAAO,UAAU,YACjB,OAAQ,MAAqB,SAAS,UACxC;AACF;AAEA,SAAgB,SACd,OACA,WACe;CACf,KAAK,IAAI,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;EAC1C,MAAM,OAAO,MAAM;EACnB,IAAI,UAAU,IAAI,GAAG,OAAO;CAC9B;AAEF;;;;;;;;;;;;;;AAgBA,MAAM,iBAAiB;AAEvB,SAAS,oBAAoB,SAAyB;CACpD,OAAO,QAAQ,QACb,iBACC,OAAO,MAAM,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,CAC3E;AACF;AAEA,SAAS,cAAc,SAAyB;CAC9C,IAAI;CACJ,IAAI;EACF,UAAU,UAAU,OAAO;CAC7B,QAAQ;EAEN,UAAU,QAAQ,WAAW,mBAAmB,UAAU;GACxD,IAAI;IACF,OAAO,UAAU,KAAK;GACxB,QAAQ;IACN,OAAO;GACT;EACF,CAAC;CACH;CACA,OAAO,oBAAoB,OAAO;AACpC;;;;;AAMA,MAAa,6BAA6B;CAExC;CACA;CAGA;CACA;AACF;;;;;;;;;;;;;;;;AAiBA,SAAgB,oBACd,KACA,WACS;CACT,IAAI,CAAC,KAAK,OAAO;CAEjB,IAAI;EAGF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,OAAO,CAAC,UAAU,IAAI,OAAO,QAAQ;CACvC,QAAQ;EAGN,OAAO;CACT;AACF;AAIA,MAAM,qBAAkD;CACtD,KAAK;CACL,KAAK;CACL,KAAK;CACL,UAAU;CACV,UAAU;AACZ;AAEA,MAAM,oBAAoB;;;;;;;;AAS1B,SAAgB,WAAW,KAAqB;CAC9C,OAAO,IAAI,QAAQ,oBAAoB,UAAU,mBAAmB,MAAO;AAC7E;AAEA,SAAgB,WAAW,MAAc;CACvC,IAAI,CAAC,MAAM,OAAO;EAAE;EAAM,4BAA4B;CAAM;CAO5D,IAAI,CAAC,qBAAqB,KAAK,IAAI,KAAK,CAAC,KAAK,WAAW,IAAI,GAC3D,OAAO;EAAE;EAAM,4BAA4B;CAAM;CAGnD,MAAM,KAAK;CACX,IAAI,SAAS;CACb,IAAI,SAAS;CACb,IAAI;CACJ,OAAO,UAAU,QAAQ,GAAG,KAAK,IAAI,IAAI;EACvC,UAAU,cAAc,KAAK,MAAM,QAAQ,MAAM,KAAK,CAAC,IAAI,MAAM;EACjE,SAAS,GAAG;CACd;CACA,SAAS,SAAS,cAAc,SAAS,KAAK,MAAM,MAAM,IAAI,IAAI;CAMlE,IAAI,6BAA6B;CACjC,IAAI,OAAO,WAAW,IAAI,GAAG;EAC3B,6BAA6B;EAC7B,SAAS,MAAM,OAAO,QAAQ,QAAQ,EAAE;CAC1C;CAEA,OAAO;EAAE,MAAM;EAAQ;CAA2B;AACpD;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,kBAAkB,MAAsB;CAKtD,IAAI,CAAC,sBAAsB,KAAK,IAAI,GAAG,OAAO;CAG9C,OAAO,KAAK,QAAQ,yBAAyB,kBAAkB;AACjE;;;;;;;;;;AAWA,SAAgB,kBACd,UACA,UACQ;CAER,MAAM,kBAAkB,SAAS,QAAQ,cAAc,EAAE;CAGzD,OAAO,GADoB,oBAAoB,KAAK,KAAK,IAAI,kBAChC,qCAAqC,mBAAmB,SAAS,KAAK,GAAG,CAAC;AACzG;AAEA,SAAgB,YAAe,GAAa,GAAa;CACvD,IAAI,MAAM,GAAG,OAAO;CACpB,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;CAClC,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAC5B,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO;CAE5B,OAAO;AACT"}
+{"version":3,"file":"utils.js","names":[],"sources":["../../src/utils.ts"],"sourcesContent":["import { isServer } from '@tanstack/router-core/isServer'\nimport type { RouteIds } from './routeInfo'\nimport type { AnyRouter } from './router'\n\nexport type Awaitable<T> = T | Promise<T>\nexport type NoInfer<T> = [T][T extends any ? 0 : never]\nexport type IsAny<TValue, TYesResult, TNoResult = TValue> = 1 extends 0 & TValue\n  ? TYesResult\n  : TNoResult\n\nexport type PickAsRequired<TValue, TKey extends keyof TValue> = Omit<\n  TValue,\n  TKey\n> &\n  Required<Pick<TValue, TKey>>\n\nexport type PickRequired<T> = {\n  [K in keyof T as undefined extends T[K] ? never : K]: T[K]\n}\n\nexport type PickOptional<T> = {\n  [K in keyof T as undefined extends T[K] ? K : never]: T[K]\n}\n\n// from https://stackoverflow.com/a/76458160\nexport type WithoutEmpty<T> = T extends any ? ({} extends T ? never : T) : never\n\nexport type Expand<T> = T extends object\n  ? T extends infer O\n    ? O extends Function\n      ? O\n      : { [K in keyof O]: O[K] }\n    : never\n  : T\n\nexport type DeepPartial<T> = T extends object\n  ? {\n      [P in keyof T]?: DeepPartial<T[P]>\n    }\n  : T\n\nexport type MakeDifferenceOptional<TLeft, TRight> = keyof TLeft &\n  keyof TRight extends never\n  ? TRight\n  : Omit<TRight, keyof TLeft & keyof TRight> & {\n      [K in keyof TLeft & keyof TRight]?: TRight[K]\n    }\n\n// from https://stackoverflow.com/a/53955431\n// eslint-disable-next-line @typescript-eslint/naming-convention\nexport type IsUnion<T, U extends T = T> = (\n  T extends any ? (U extends T ? false : true) : never\n) extends false\n  ? false\n  : true\n\nexport type IsNonEmptyObject<T> = T extends object\n  ? keyof T extends never\n    ? false\n    : true\n  : false\n\nexport type Assign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : keyof TLeft & keyof TRight extends never\n          ? TLeft & TRight\n          : Omit<TLeft, keyof TRight> & TRight\n    : never\n  : never\n\nexport type IntersectAssign<TLeft, TRight> = TLeft extends any\n  ? TRight extends any\n    ? IsNonEmptyObject<TLeft> extends false\n      ? TRight\n      : IsNonEmptyObject<TRight> extends false\n        ? TLeft\n        : TRight & TLeft\n    : never\n  : never\n\nexport type Timeout = ReturnType<typeof setTimeout>\n\nexport type Updater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev?: TPrevious) => TResult)\n\nexport type NonNullableUpdater<TPrevious, TResult = TPrevious> =\n  | TResult\n  | ((prev: TPrevious) => TResult)\n\nexport type ExtractObjects<TUnion> = TUnion extends MergeAllPrimitive\n  ? never\n  : TUnion\n\nexport type PartialMergeAllObject<TUnion> =\n  ExtractObjects<TUnion> extends infer TObj\n    ? [TObj] extends [never]\n      ? never\n      : {\n          [TKey in TObj extends any ? keyof TObj : never]?: TObj extends any\n            ? TKey extends keyof TObj\n              ? TObj[TKey]\n              : never\n            : never\n        }\n    : never\n\nexport type MergeAllPrimitive =\n  | ReadonlyArray<any>\n  | number\n  | string\n  | bigint\n  | boolean\n  | symbol\n  | undefined\n  | null\n\nexport type ExtractPrimitives<TUnion> = TUnion extends MergeAllPrimitive\n  ? TUnion\n  : TUnion extends object\n    ? never\n    : TUnion\n\nexport type PartialMergeAll<TUnion> =\n  | ExtractPrimitives<TUnion>\n  | PartialMergeAllObject<TUnion>\n\nexport type Constrain<T, TConstraint, TDefault = TConstraint> =\n  | (T extends TConstraint ? T : never)\n  | TDefault\n\nexport type ConstrainLiteral<T, TConstraint, TDefault = TConstraint> =\n  | (T & TConstraint)\n  | TDefault\n\n/**\n * To be added to router types\n */\nexport type UnionToIntersection<T> = (\n  T extends any ? (arg: T) => any : never\n) extends (arg: infer T) => any\n  ? T\n  : never\n\n/**\n * Merges everything in a union into one object.\n * This mapped type is homomorphic which means it preserves stuff! :)\n */\nexport type MergeAllObjects<\n  TUnion,\n  TIntersected = UnionToIntersection<ExtractObjects<TUnion>>,\n> = [keyof TIntersected] extends [never]\n  ? never\n  : {\n      [TKey in keyof TIntersected]: TUnion extends any\n        ? TUnion[TKey & keyof TUnion]\n        : never\n    }\n\nexport type MergeAll<TUnion> =\n  | MergeAllObjects<TUnion>\n  | ExtractPrimitives<TUnion>\n\nexport type ValidateJSON<T> = ((...args: Array<any>) => any) extends T\n  ? unknown extends T\n    ? never\n    : 'Function is not serializable'\n  : { [K in keyof T]: ValidateJSON<T[K]> }\n\nexport type LooseReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn\n  : never\n\nexport type LooseAsyncReturnType<T> = T extends (\n  ...args: Array<any>\n) => infer TReturn\n  ? TReturn extends Promise<infer TReturn>\n    ? TReturn\n    : TReturn\n  : never\n\n/**\n * Return the last element of an array.\n * Intended for non-empty arrays used within router internals.\n */\nexport function last<T>(arr: ReadonlyArray<T>) {\n  return arr[arr.length - 1]\n}\n\nfunction isFunction(d: any): d is Function {\n  return typeof d === 'function'\n}\n\n/**\n * Apply a value-or-updater to a previous value.\n * Accepts either a literal value or a function of the previous value.\n */\nexport function functionalUpdate<TPrevious, TResult = TPrevious>(\n  updater: Updater<TPrevious, TResult> | NonNullableUpdater<TPrevious, TResult>,\n  previous: TPrevious,\n): TResult {\n  if (isFunction(updater)) {\n    return updater(previous)\n  }\n\n  return updater\n}\n\nexport const hasOwn = Object.prototype.hasOwnProperty\nconst isEnumerable = Object.prototype.propertyIsEnumerable\n\nexport function hasKeys(obj: Record<string, unknown>) {\n  for (const key in obj) {\n    if (hasOwn.call(obj, key)) return true\n  }\n  return false\n}\n\nexport const createNull = () => Object.create(null)\nexport const nullReplaceEqualDeep: typeof replaceEqualDeep = (prev, next) =>\n  replaceEqualDeep(prev, next, createNull)\n\n/**\n * This function returns `prev` if `_next` is deeply equal.\n * If not, it will replace any deeply equal children of `b` with those of `a`.\n * This can be used for structural sharing between immutable JSON values for example.\n * Do not use this with signals\n */\nexport function replaceEqualDeep<T>(\n  prev: any,\n  _next: T,\n  _makeObj = () => ({}),\n  _depth = 0,\n): T {\n  if (isServer) {\n    return _next\n  }\n  if (prev === _next) {\n    return prev\n  }\n\n  if (_depth > 500) return _next\n\n  const next = _next as any\n\n  const array = isPlainArray(prev) && isPlainArray(next)\n\n  if (!array && !(isPlainObject(prev) && isPlainObject(next))) return next\n\n  const prevItems = array ? prev : getEnumerableOwnKeys(prev)\n  if (!prevItems) return next\n  const nextItems = array ? next : getEnumerableOwnKeys(next)\n  if (!nextItems) return next\n  const prevSize = prevItems.length\n  const nextSize = nextItems.length\n  const copy: any = array ? new Array(nextSize) : _makeObj()\n\n  let equalItems = 0\n\n  for (let i = 0; i < nextSize; i++) {\n    const key = array ? i : (nextItems[i] as any)\n    const p = prev[key]\n    const n = next[key]\n\n    if (p === n) {\n      copy[key] = p\n      if (array ? i < prevSize : hasOwn.call(prev, key)) equalItems++\n      continue\n    }\n\n    if (\n      p === null ||\n      n === null ||\n      typeof p !== 'object' ||\n      typeof n !== 'object'\n    ) {\n      copy[key] = n\n      continue\n    }\n\n    const v = replaceEqualDeep(p, n, _makeObj, _depth + 1)\n    copy[key] = v\n    if (v === p) equalItems++\n  }\n\n  return prevSize === nextSize && equalItems === prevSize ? prev : copy\n}\n\n/**\n * Equivalent to `Reflect.ownKeys`, but ensures that objects are \"clone-friendly\":\n * will return false if object has any non-enumerable properties.\n *\n * Optimized for the common case where objects have no symbol properties.\n */\nfunction getEnumerableOwnKeys(o: object) {\n  const names = Object.getOwnPropertyNames(o)\n\n  // Fast path: check all string property names are enumerable\n  for (const name of names) {\n    if (!isEnumerable.call(o, name)) return false\n  }\n\n  // Only check symbols if the object has any (most plain objects don't)\n  const symbols = Object.getOwnPropertySymbols(o)\n\n  // Fast path: no symbols, return names directly (avoids array allocation/concat)\n  if (symbols.length === 0) return names\n\n  // Slow path: has symbols, need to check and merge\n  const keys: Array<string | symbol> = names\n  for (const symbol of symbols) {\n    if (!isEnumerable.call(o, symbol)) return false\n    keys.push(symbol)\n  }\n  return keys\n}\n\n// Copied from: https://github.com/jonschlinkert/is-plain-object\nexport function isPlainObject(o: any) {\n  if (!hasObjectPrototype(o)) {\n    return false\n  }\n\n  // If has modified constructor\n  const ctor = o.constructor\n  if (typeof ctor === 'undefined') {\n    return true\n  }\n\n  // If has modified prototype\n  const prot = ctor.prototype\n  if (!hasObjectPrototype(prot)) {\n    return false\n  }\n\n  // If constructor does not have an Object-specific method\n  if (!prot.hasOwnProperty('isPrototypeOf')) {\n    return false\n  }\n\n  // Most likely a plain Object\n  return true\n}\n\nfunction hasObjectPrototype(o: any) {\n  return Object.prototype.toString.call(o) === '[object Object]'\n}\n\n/**\n * Check if a value is a \"plain\" array (no extra enumerable keys).\n */\nexport function isPlainArray(value: unknown): value is Array<unknown> {\n  return Array.isArray(value) && value.length === Object.keys(value).length\n}\n\n/**\n * Perform a deep equality check with options for partial comparison and\n * ignoring `undefined` values. Optimized for router state comparisons.\n */\nexport function deepEqual(\n  a: any,\n  b: any,\n  opts?: { partial?: boolean; ignoreUndefined?: boolean },\n): boolean {\n  if (a === b) {\n    return true\n  }\n\n  if (typeof a !== typeof b) {\n    return false\n  }\n\n  if (Array.isArray(a) && Array.isArray(b)) {\n    if (a.length !== b.length) return false\n    for (let i = 0, l = a.length; i < l; i++) {\n      if (!deepEqual(a[i], b[i], opts)) return false\n    }\n    return true\n  }\n\n  if (isPlainObject(a) && isPlainObject(b)) {\n    const ignoreUndefined = opts?.ignoreUndefined ?? true\n\n    if (opts?.partial) {\n      for (const k in b) {\n        if (!ignoreUndefined || b[k] !== undefined) {\n          if (!deepEqual(a[k], b[k], opts)) return false\n        }\n      }\n      return true\n    }\n\n    let aCount = 0\n    if (!ignoreUndefined) {\n      aCount = Object.keys(a).length\n    } else {\n      for (const k in a) {\n        if (a[k] !== undefined) aCount++\n      }\n    }\n\n    let bCount = 0\n    for (const k in b) {\n      if (!ignoreUndefined || b[k] !== undefined) {\n        bCount++\n        if (bCount > aCount || !deepEqual(a[k], b[k], opts)) return false\n      }\n    }\n\n    return aCount === bCount\n  }\n\n  return false\n}\n\nexport type StringLiteral<T> = T extends string\n  ? string extends T\n    ? string\n    : T\n  : never\n\nexport type ThrowOrOptional<T, TThrow extends boolean> = TThrow extends true\n  ? T\n  : T | undefined\n\nexport type StrictOrFrom<\n  TRouter extends AnyRouter,\n  TFrom,\n  TStrict extends boolean = true,\n> = TStrict extends false\n  ? {\n      from?: never\n      strict: TStrict\n    }\n  : {\n      from: ConstrainLiteral<TFrom, RouteIds<TRouter['routeTree']>>\n      strict?: TStrict\n    }\n\nexport type ThrowConstraint<\n  TStrict extends boolean,\n  TThrow extends boolean,\n> = TStrict extends false ? (TThrow extends true ? never : TThrow) : TThrow\n\nexport type ControlledPromise<T> = Promise<T> & {\n  resolve: (value: T) => void\n  reject: (value: any) => void\n  status: 'pending' | 'resolved' | 'rejected'\n  value?: T\n}\n\n/**\n * Create a promise with exposed resolve/reject and status fields.\n * Useful for coordinating async router lifecycle operations.\n */\nexport function createControlledPromise<T>(onResolve?: (value: T) => void) {\n  let resolveLoadPromise!: (value: T) => void\n  let rejectLoadPromise!: (value: any) => void\n\n  const controlledPromise = new Promise<T>((resolve, reject) => {\n    resolveLoadPromise = resolve\n    rejectLoadPromise = reject\n  }) as ControlledPromise<T>\n\n  controlledPromise.status = 'pending'\n\n  controlledPromise.resolve = (value: T) => {\n    controlledPromise.status = 'resolved'\n    controlledPromise.value = value\n    resolveLoadPromise(value)\n    onResolve?.(value)\n  }\n\n  controlledPromise.reject = (e) => {\n    controlledPromise.status = 'rejected'\n    rejectLoadPromise(e)\n  }\n\n  return controlledPromise\n}\n\n/**\n * Heuristically detect dynamic import \"module not found\" errors\n * across major browsers for lazy route component handling.\n */\nexport function isModuleNotFoundError(error: any): boolean {\n  // chrome: \"Failed to fetch dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // firefox: \"error loading dynamically imported module: http://localhost:5173/src/routes/posts.index.tsx?tsr-split\"\n  // safari: \"Importing a module script failed.\"\n  if (typeof error?.message !== 'string') return false\n  return (\n    error.message.startsWith('Failed to fetch dynamically imported module') ||\n    error.message.startsWith('error loading dynamically imported module') ||\n    error.message.startsWith('Importing a module script failed')\n  )\n}\n\nexport function isPromise<T>(\n  value: Promise<Awaited<T>> | T,\n): value is Promise<Awaited<T>> {\n  return Boolean(\n    value &&\n    typeof value === 'object' &&\n    typeof (value as Promise<T>).then === 'function',\n  )\n}\n\nexport function findLast<T>(\n  array: ReadonlyArray<T>,\n  predicate: (item: T) => boolean,\n): T | undefined {\n  for (let i = array.length - 1; i >= 0; i--) {\n    const item = array[i]!\n    if (predicate(item)) return item\n  }\n  return undefined\n}\n\n/**\n * Re-encode characters that are unsafe in URL paths.\n * Includes ASCII control characters (0x00-0x1F, 0x7F) and a subset of the\n * WHATWG URL \"path percent-encode set\" (\", <, >, `, {, }).\n *\n * Space (0x20) is intentionally excluded — decodeURI decodes %20 to space\n * and the router stores decoded spaces in location.pathname. The existing\n * encodePathLikeUrl already handles re-encoding spaces for outgoing URLs.\n *\n * These characters are decoded by decodeURI but must remain percent-encoded\n * in paths to match how upstream layers (CDNs, edge middleware, browsers)\n * interpret the URL, preventing infinite redirect loops and path mismatches.\n */\n// eslint-disable-next-line no-control-regex\nconst PATH_UNSAFE_RE = /[\\x00-\\x1f\\x7f\"<>`{}]/g\n\nfunction sanitizePathSegment(segment: string): string {\n  return segment.replace(\n    PATH_UNSAFE_RE,\n    (ch) => '%' + ch.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'),\n  )\n}\n\nfunction decodeSegment(segment: string): string {\n  let decoded: string\n  try {\n    decoded = decodeURI(segment)\n  } catch {\n    // if the decoding fails, try to decode the various parts leaving the malformed tags in place\n    decoded = segment.replaceAll(/%[0-9A-F]{2}/gi, (match) => {\n      try {\n        return decodeURI(match)\n      } catch {\n        return match\n      }\n    })\n  }\n  return sanitizePathSegment(decoded)\n}\n\n/**\n * Default list of URL protocols to allow in links, redirects, and navigation.\n * Any absolute URL protocol not in this list is treated as dangerous by default.\n */\nexport const DEFAULT_PROTOCOL_ALLOWLIST = [\n  // Standard web navigation\n  'http:',\n  'https:',\n\n  // Common browser-safe actions\n  'mailto:',\n  'tel:',\n]\n\n/**\n * Check if a URL string uses a protocol that is not in the allowlist.\n * Returns true for blocked protocols like javascript:, blob:, data:, etc.\n *\n * The URL constructor correctly normalizes:\n * - Mixed case (JavaScript: → javascript:)\n * - Whitespace/control characters (java\\nscript: → javascript:)\n * - Leading whitespace\n *\n * For relative URLs (no protocol), returns false (safe).\n *\n * @param url - The URL string to check\n * @param allowlist - Set of protocols to allow\n * @returns true if the URL uses a protocol that is not allowed\n */\nexport function isDangerousProtocol(\n  url: string,\n  allowlist: Set<string>,\n): boolean {\n  if (!url) return false\n\n  try {\n    // Use the URL constructor - it correctly normalizes protocols\n    // per WHATWG URL spec, handling all bypass attempts automatically\n    const parsed = new URL(url)\n    return !allowlist.has(parsed.protocol)\n  } catch {\n    // URL constructor throws for relative URLs (no protocol)\n    // These are safe - they can't execute scripts\n    return false\n  }\n}\n\n// This utility is based on https://github.com/zertosh/htmlescape\n// License: https://github.com/zertosh/htmlescape/blob/0527ca7156a524d256101bb310a9f970f63078ad/LICENSE\nconst HTML_ESCAPE_LOOKUP: { [match: string]: string } = {\n  '&': '\\\\u0026',\n  '>': '\\\\u003e',\n  '<': '\\\\u003c',\n  '\\u2028': '\\\\u2028',\n  '\\u2029': '\\\\u2029',\n}\n\nconst HTML_ESCAPE_REGEX = /[&><\\u2028\\u2029]/g\n\n/**\n * Escape HTML special characters in a string to prevent XSS attacks\n * when embedding strings in script tags during SSR.\n *\n * This is essential for preventing XSS vulnerabilities when user-controlled\n * content is embedded in inline scripts.\n */\nexport function escapeHtml(str: string): string {\n  return str.replace(HTML_ESCAPE_REGEX, (match) => HTML_ESCAPE_LOOKUP[match]!)\n}\n\nexport function decodePath(path: string) {\n  if (!path) return { path, handledProtocolRelativeURL: false }\n\n  // Fast path: most paths are already decoded and safe.\n  // Only fall back to the slower scan/regex path when we see a '%' (encoded),\n  // a backslash (explicitly handled), a control character, or a protocol-relative\n  // prefix which needs collapsing.\n  // eslint-disable-next-line no-control-regex\n  if (!/[%\\\\\\x00-\\x1f\\x7f]/.test(path) && !path.startsWith('//')) {\n    return { path, handledProtocolRelativeURL: false }\n  }\n\n  const re = /%25|%5C/gi\n  let cursor = 0\n  let result = ''\n  let match\n  while (null !== (match = re.exec(path))) {\n    result += decodeSegment(path.slice(cursor, match.index)) + match[0]\n    cursor = re.lastIndex\n  }\n  result = result + decodeSegment(cursor ? path.slice(cursor) : path)\n\n  // Prevent open redirect via protocol-relative URLs (e.g. \"//evil.com\")\n  // This is defense-in-depth: since control characters are no longer decoded,\n  // paths like \"/%0d/evil.com\" can no longer become \"//evil.com\". But we keep\n  // this check to guard against other edge cases.\n  let handledProtocolRelativeURL = false\n  if (result.startsWith('//')) {\n    handledProtocolRelativeURL = true\n    result = '/' + result.replace(/^\\/+/, '')\n  }\n\n  return { path: result, handledProtocolRelativeURL }\n}\n\n/**\n * Encodes a path the same way `new URL()` would, but without the overhead of full URL parsing.\n *\n * This function encodes:\n * - Whitespace characters (spaces → %20, tabs → %09, etc.)\n * - Non-ASCII/Unicode characters (emojis, accented characters, etc.)\n *\n * It preserves:\n * - Already percent-encoded sequences (won't double-encode %2F, %25, etc.)\n * - ASCII special characters valid in URL paths (@, $, &, +, etc.)\n * - Forward slashes as path separators\n *\n * Used to generate proper href values for SSR without constructing URL objects.\n *\n * @example\n * encodePathLikeUrl('/path/file name.pdf') // '/path/file%20name.pdf'\n * encodePathLikeUrl('/path/日本語') // '/path/%E6%97%A5%E6%9C%AC%E8%AA%9E'\n * encodePathLikeUrl('/path/already%20encoded') // '/path/already%20encoded' (preserved)\n */\nexport function encodePathLikeUrl(path: string): string {\n  // Encode whitespace and non-ASCII characters that browsers encode in URLs\n\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  if (!/\\s|[^\\u0000-\\u007F]/.test(path)) return path\n  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional ASCII range check\n  // eslint-disable-next-line no-control-regex\n  return path.replace(/\\s|[^\\u0000-\\u007F]/gu, encodeURIComponent)\n}\n\n/**\n * Builds the dev-mode CSS styles URL for route-scoped CSS collection.\n * Used by HeadContent components in all framework implementations to construct\n * the URL for the `/@tanstack-start/styles.css` endpoint.\n *\n * @param basepath - The router's basepath (may or may not have leading slash)\n * @param routeIds - Array of matched route IDs to include in the CSS collection\n * @returns The full URL path for the dev styles CSS endpoint\n */\nexport function buildDevStylesUrl(\n  basepath: string,\n  routeIds: Array<string>,\n): string {\n  // Trim all leading and trailing slashes from basepath\n  const trimmedBasepath = basepath.replace(/^\\/+|\\/+$/g, '')\n  // Build normalized basepath: empty string for root, or '/path' for non-root\n  const normalizedBasepath = trimmedBasepath === '' ? '' : `/${trimmedBasepath}`\n  return `${normalizedBasepath}/@tanstack-start/styles.css?routes=${encodeURIComponent(routeIds.join(','))}`\n}\n\nexport function arraysEqual<T>(a: Array<T>, b: Array<T>) {\n  if (a === b) return true\n  if (a.length !== b.length) return false\n  for (let i = 0; i < a.length; i++) {\n    if (a[i] !== b[i]) return false\n  }\n  return true\n}\n"],"mappings":";;;;;;AA+LA,SAAgB,KAAQ,KAAuB;CAC7C,OAAO,IAAI,IAAI,SAAS;AAC1B;AAEA,SAAS,WAAW,GAAuB;CACzC,OAAO,OAAO,MAAM;AACtB;;;;;AAMA,SAAgB,iBACd,SACA,UACS;CACT,IAAI,WAAW,OAAO,GACpB,OAAO,QAAQ,QAAQ;CAGzB,OAAO;AACT;AAEA,MAAa,SAAS,OAAO,UAAU;AACvC,MAAM,eAAe,OAAO,UAAU;AAEtC,SAAgB,QAAQ,KAA8B;CACpD,KAAK,MAAM,OAAO,KAChB,IAAI,OAAO,KAAK,KAAK,GAAG,GAAG,OAAO;CAEpC,OAAO;AACT;AAEA,MAAa,mBAAmB,OAAO,OAAO,IAAI;AAClD,MAAa,wBAAiD,MAAM,SAClE,iBAAiB,MAAM,MAAM,UAAU;;;;;;;AAQzC,SAAgB,iBACd,MACA,OACA,kBAAkB,CAAC,IACnB,SAAS,GACN;CACH,IAAI,UACF,OAAO;CAET,IAAI,SAAS,OACX,OAAO;CAGT,IAAI,SAAS,KAAK,OAAO;CAEzB,MAAM,OAAO;CAEb,MAAM,QAAQ,aAAa,IAAI,KAAK,aAAa,IAAI;CAErD,IAAI,CAAC,SAAS,EAAE,cAAc,IAAI,KAAK,cAAc,IAAI,IAAI,OAAO;CAEpE,MAAM,YAAY,QAAQ,OAAO,qBAAqB,IAAI;CAC1D,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,YAAY,QAAQ,OAAO,qBAAqB,IAAI;CAC1D,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,WAAW,UAAU;CAC3B,MAAM,WAAW,UAAU;CAC3B,MAAM,OAAY,QAAQ,IAAI,MAAM,QAAQ,IAAI,SAAS;CAEzD,IAAI,aAAa;CAEjB,KAAK,IAAI,IAAI,GAAG,IAAI,UAAU,KAAK;EACjC,MAAM,MAAM,QAAQ,IAAK,UAAU;EACnC,MAAM,IAAI,KAAK;EACf,MAAM,IAAI,KAAK;EAEf,IAAI,MAAM,GAAG;GACX,KAAK,OAAO;GACZ,IAAI,QAAQ,IAAI,WAAW,OAAO,KAAK,MAAM,GAAG,GAAG;GACnD;EACF;EAEA,IACE,MAAM,QACN,MAAM,QACN,OAAO,MAAM,YACb,OAAO,MAAM,UACb;GACA,KAAK,OAAO;GACZ;EACF;EAEA,MAAM,IAAI,iBAAiB,GAAG,GAAG,UAAU,SAAS,CAAC;EACrD,KAAK,OAAO;EACZ,IAAI,MAAM,GAAG;CACf;CAEA,OAAO,aAAa,YAAY,eAAe,WAAW,OAAO;AACnE;;;;;;;AAQA,SAAS,qBAAqB,GAAW;CACvC,MAAM,QAAQ,OAAO,oBAAoB,CAAC;CAG1C,KAAK,MAAM,QAAQ,OACjB,IAAI,CAAC,aAAa,KAAK,GAAG,IAAI,GAAG,OAAO;CAI1C,MAAM,UAAU,OAAO,sBAAsB,CAAC;CAG9C,IAAI,QAAQ,WAAW,GAAG,OAAO;CAGjC,MAAM,OAA+B;CACrC,KAAK,MAAM,UAAU,SAAS;EAC5B,IAAI,CAAC,aAAa,KAAK,GAAG,MAAM,GAAG,OAAO;EAC1C,KAAK,KAAK,MAAM;CAClB;CACA,OAAO;AACT;AAGA,SAAgB,cAAc,GAAQ;CACpC,IAAI,CAAC,mBAAmB,CAAC,GACvB,OAAO;CAIT,MAAM,OAAO,EAAE;CACf,IAAI,OAAO,SAAS,aAClB,OAAO;CAIT,MAAM,OAAO,KAAK;CAClB,IAAI,CAAC,mBAAmB,IAAI,GAC1B,OAAO;CAIT,IAAI,CAAC,KAAK,eAAe,eAAe,GACtC,OAAO;CAIT,OAAO;AACT;AAEA,SAAS,mBAAmB,GAAQ;CAClC,OAAO,OAAO,UAAU,SAAS,KAAK,CAAC,MAAM;AAC/C;;;;AAKA,SAAgB,aAAa,OAAyC;CACpE,OAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,OAAO,KAAK,KAAK,EAAE;AACrE;;;;;AAMA,SAAgB,UACd,GACA,GACA,MACS;CACT,IAAI,MAAM,GACR,OAAO;CAGT,IAAI,OAAO,MAAM,OAAO,GACtB,OAAO;CAGT,IAAI,MAAM,QAAQ,CAAC,KAAK,MAAM,QAAQ,CAAC,GAAG;EACxC,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;EAClC,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAI,GAAG,KACnC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,OAAO;EAE3C,OAAO;CACT;CAEA,IAAI,cAAc,CAAC,KAAK,cAAc,CAAC,GAAG;EACxC,MAAM,kBAAkB,MAAM,mBAAmB;EAEjD,IAAI,MAAM,SAAS;GACjB,KAAK,MAAM,KAAK,GACd,IAAI,CAAC,mBAAmB,EAAE,OAAO,KAAA;QAC3B,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,OAAO;GAAA;GAG7C,OAAO;EACT;EAEA,IAAI,SAAS;EACb,IAAI,CAAC,iBACH,SAAS,OAAO,KAAK,CAAC,EAAE;OAExB,KAAK,MAAM,KAAK,GACd,IAAI,EAAE,OAAO,KAAA,GAAW;EAI5B,IAAI,SAAS;EACb,KAAK,MAAM,KAAK,GACd,IAAI,CAAC,mBAAmB,EAAE,OAAO,KAAA,GAAW;GAC1C;GACA,IAAI,SAAS,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,OAAO;EAC9D;EAGF,OAAO,WAAW;CACpB;CAEA,OAAO;AACT;;;;;AA0CA,SAAgB,wBAA2B,WAAgC;CACzE,IAAI;CACJ,IAAI;CAEJ,MAAM,oBAAoB,IAAI,SAAY,SAAS,WAAW;EAC5D,qBAAqB;EACrB,oBAAoB;CACtB,CAAC;CAED,kBAAkB,SAAS;CAE3B,kBAAkB,WAAW,UAAa;EACxC,kBAAkB,SAAS;EAC3B,kBAAkB,QAAQ;EAC1B,mBAAmB,KAAK;EACxB,YAAY,KAAK;CACnB;CAEA,kBAAkB,UAAU,MAAM;EAChC,kBAAkB,SAAS;EAC3B,kBAAkB,CAAC;CACrB;CAEA,OAAO;AACT;;;;;AAMA,SAAgB,sBAAsB,OAAqB;CAIzD,IAAI,OAAO,OAAO,YAAY,UAAU,OAAO;CAC/C,OACE,MAAM,QAAQ,WAAW,6CAA6C,KACtE,MAAM,QAAQ,WAAW,2CAA2C,KACpE,MAAM,QAAQ,WAAW,kCAAkC;AAE/D;AAYA,SAAgB,SACd,OACA,WACe;CACf,KAAK,IAAI,IAAI,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK;EAC1C,MAAM,OAAO,MAAM;EACnB,IAAI,UAAU,IAAI,GAAG,OAAO;CAC9B;AAEF;;;;;;;;;;;;;;AAgBA,MAAM,iBAAiB;AAEvB,SAAS,oBAAoB,SAAyB;CACpD,OAAO,QAAQ,QACb,iBACC,OAAO,MAAM,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,SAAS,GAAG,GAAG,CAC3E;AACF;AAEA,SAAS,cAAc,SAAyB;CAC9C,IAAI;CACJ,IAAI;EACF,UAAU,UAAU,OAAO;CAC7B,QAAQ;EAEN,UAAU,QAAQ,WAAW,mBAAmB,UAAU;GACxD,IAAI;IACF,OAAO,UAAU,KAAK;GACxB,QAAQ;IACN,OAAO;GACT;EACF,CAAC;CACH;CACA,OAAO,oBAAoB,OAAO;AACpC;;;;;AAMA,MAAa,6BAA6B;CAExC;CACA;CAGA;CACA;AACF;;;;;;;;;;;;;;;;AAiBA,SAAgB,oBACd,KACA,WACS;CACT,IAAI,CAAC,KAAK,OAAO;CAEjB,IAAI;EAGF,MAAM,SAAS,IAAI,IAAI,GAAG;EAC1B,OAAO,CAAC,UAAU,IAAI,OAAO,QAAQ;CACvC,QAAQ;EAGN,OAAO;CACT;AACF;AAIA,MAAM,qBAAkD;CACtD,KAAK;CACL,KAAK;CACL,KAAK;CACL,UAAU;CACV,UAAU;AACZ;AAEA,MAAM,oBAAoB;;;;;;;;AAS1B,SAAgB,WAAW,KAAqB;CAC9C,OAAO,IAAI,QAAQ,oBAAoB,UAAU,mBAAmB,MAAO;AAC7E;AAEA,SAAgB,WAAW,MAAc;CACvC,IAAI,CAAC,MAAM,OAAO;EAAE;EAAM,4BAA4B;CAAM;CAO5D,IAAI,CAAC,qBAAqB,KAAK,IAAI,KAAK,CAAC,KAAK,WAAW,IAAI,GAC3D,OAAO;EAAE;EAAM,4BAA4B;CAAM;CAGnD,MAAM,KAAK;CACX,IAAI,SAAS;CACb,IAAI,SAAS;CACb,IAAI;CACJ,OAAO,UAAU,QAAQ,GAAG,KAAK,IAAI,IAAI;EACvC,UAAU,cAAc,KAAK,MAAM,QAAQ,MAAM,KAAK,CAAC,IAAI,MAAM;EACjE,SAAS,GAAG;CACd;CACA,SAAS,SAAS,cAAc,SAAS,KAAK,MAAM,MAAM,IAAI,IAAI;CAMlE,IAAI,6BAA6B;CACjC,IAAI,OAAO,WAAW,IAAI,GAAG;EAC3B,6BAA6B;EAC7B,SAAS,MAAM,OAAO,QAAQ,QAAQ,EAAE;CAC1C;CAEA,OAAO;EAAE,MAAM;EAAQ;CAA2B;AACpD;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,kBAAkB,MAAsB;CAKtD,IAAI,CAAC,sBAAsB,KAAK,IAAI,GAAG,OAAO;CAG9C,OAAO,KAAK,QAAQ,yBAAyB,kBAAkB;AACjE;;;;;;;;;;AAWA,SAAgB,kBACd,UACA,UACQ;CAER,MAAM,kBAAkB,SAAS,QAAQ,cAAc,EAAE;CAGzD,OAAO,GADoB,oBAAoB,KAAK,KAAK,IAAI,kBAChC,qCAAqC,mBAAmB,SAAS,KAAK,GAAG,CAAC;AACzG;AAEA,SAAgB,YAAe,GAAa,GAAa;CACvD,IAAI,MAAM,GAAG,OAAO;CACpB,IAAI,EAAE,WAAW,EAAE,QAAQ,OAAO;CAClC,KAAK,IAAI,IAAI,GAAG,IAAI,EAAE,QAAQ,KAC5B,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO;CAE5B,OAAO;AACT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tanstack/router-core",
-  "version": "1.171.15",
+  "version": "1.171.16",
   "description": "Modern and scalable routing for React applications",
   "author": "Tanner Linsley",
   "license": "MIT",
@@ -182,12 +182,12 @@
     "clean": "rimraf ./dist && rimraf ./coverage",
     "test:eslint": "eslint ./src",
     "test:types": "pnpm run \"/^test:types:ts[0-9]{2}$/\"",
-    "test:types:ts55": "node ../../node_modules/typescript55/lib/tsc.js",
     "test:types:ts56": "node ../../node_modules/typescript56/lib/tsc.js",
     "test:types:ts57": "node ../../node_modules/typescript57/lib/tsc.js",
     "test:types:ts58": "node ../../node_modules/typescript58/lib/tsc.js",
     "test:types:ts59": "node ../../node_modules/typescript59/lib/tsc.js",
-    "test:types:ts60": "tsc",
+    "test:types:ts60": "tsc6",
+    "test:types:ts70": "tsc",
     "test:build": "publint --strict && attw --ignore-rules no-resolution --pack .",
     "test:unit": "vitest",
     "test:unit:dev": "pnpm run test:unit --watch",

package/skills/router-core/SKILL.md

@@ -5,9 +5,10 @@ description: >-
   createRouter, createRoute, createRootRoute, createRootRouteWithContext,
   addChildren, Register type declaration, route matching, route sorting,
   file naming conventions. Entry point for all router skills.
-type: core
-library: tanstack-router
-library_version: '1.166.2'
+metadata:
+  type: core
+  library: tanstack-router
+  library_version: '1.171.15'
 ---
 
 # TanStack Router Core
@@ -18,6 +19,8 @@ TanStack Router is a type-safe router for React and Solid with built-in SWR cach
 
 > **CRITICAL**: TanStack Router is CLIENT-FIRST. Loaders run on the client by default, NOT server-only like Remix/Next.js. Do not confuse TanStack Router APIs with Next.js or React Router.
 
+Use this entry skill to choose one primary sub-skill. Do not load the full catalog. Load a second sub-skill only when the task crosses a real boundary, such as an authenticated loader that needs both `auth-and-guards` and `data-loading`.
+
 ## Sub-Skills
 
 | Task                                               | Sub-Skill                                                                    |
@@ -66,6 +69,22 @@ Need server-side rendering?
   → router-core/ssr
 ```
 
+## Cross-Cutting Completion Checks
+
+For route refactors:
+
+1. Rename or move the route file; do not hand-edit the generated `createFileRoute` path.
+2. Regenerate `routeTree.gen.ts` with the configured Router plugin or CLI.
+3. Update links, redirects, `from` narrowing, params, and tests that reference the old route.
+4. Run type tests and a production build. A typecheck alone does not prove route generation or bundling works.
+
+For response schema changes:
+
+1. Update the source model and shared validation schema.
+2. Update the server function or API serializer so the field exists at runtime.
+3. Update loader and component consumers without casts.
+4. Assert the actual response payload in a unit or integration test. Typechecking cannot catch a serializer that omits the new field.
+
 ## Minimal Working Example
 
 ```tsx
@@ -136,4 +155,4 @@ The plugin auto-generates this string. If you rename a route file, the plugin up
 
 ## Version Note
 
-This skill targets `@tanstack/router-core` v1.166.2 and `@tanstack/react-router` v1.166.2. APIs are stable. Splat routes use `$` (not `*`); the `*` compat alias will be removed in v2.
+This skill targets `@tanstack/router-core` v1.171.15. Splat routes use `$` (not `*`); the `*` compat alias will be removed in v2.

package/skills/router-core/auth-and-guards/SKILL.md

@@ -1,17 +1,17 @@
 ---
-name: router-core/auth-and-guards
+name: auth-and-guards
 description: >-
   Route protection with beforeLoad, redirect()/throw redirect(),
   isRedirect helper, authenticated layout routes (_authenticated),
   non-redirect auth (inline login), RBAC with roles and permissions,
   auth provider integration (Auth0, Clerk, Supabase), router context
   for auth state.
-type: sub-skill
-library: tanstack-router
-library_version: '1.166.2'
+metadata:
+  type: sub-skill
+  library: tanstack-router
+  library_version: '1.171.15'
 requires:
   - router-core
-  - router-core/data-loading
 sources:
   - TanStack/router:docs/router/guide/authenticated-routes.md
   - TanStack/router:docs/router/how-to/setup-authentication.md
@@ -377,7 +377,7 @@ export const Route = createFileRoute('/_authenticated')({
 
 ### CRITICAL: Route guards do not protect server functions
 
-A `beforeLoad` redirect protects the **route's UI**, not the **server functions** declared on it. `createServerFn` produces an RPC endpoint reachable by direct POST regardless of which route renders the calling UI. An attacker doesn't have to load `/_authenticated/orders` — they can curl the RPC endpoint directly.
+A `beforeLoad` redirect protects the **route's UI**, not the **server functions** declared on it. `createServerFn` produces an RPC endpoint reachable directly with its declared HTTP method regardless of which route renders the calling UI. An attacker doesn't have to load `/_authenticated/orders` — they can call this GET RPC endpoint directly.
 
 ```tsx
 // WRONG — handler has no auth check; the route guard doesn't help
@@ -410,6 +410,10 @@ const getMyOrders = createServerFn({ method: 'GET' })
 
 Rule of thumb: every `createServerFn`, server route, or API endpoint that touches user data needs `authMiddleware` (or an equivalent in-handler check). The route guard is for the page experience; the endpoint guard is for the data. See [start-core/auth-server-primitives](../../../../start-client-core/skills/start-core/auth-server-primitives/SKILL.md) for the full session/middleware pattern.
 
+### CRITICAL: The anonymous destination can still disclose protected data
+
+Protect the entire anonymous response, not only the API call. A public login or unauthorized page still leaks data if its title, copy, search params, or serialized loader state names the protected user, tenant, record, or resource. Test a direct anonymous request and follow redirects. Assert that the handler rejects before reading private data, no protected loader runs, the final HTML and serialized state contain no protected identity, and the redirect contains only a sanitized relative return URL.
+
 ### HIGH: Auth check in component instead of beforeLoad
 
 Component-level auth checks cause a **flash of protected content** before the redirect:
@@ -435,8 +439,6 @@ export const Route = createFileRoute('/_authenticated/dashboard')({
 })
 ```
 
-`beforeLoad` runs before any component rendering and before the loader. It completely prevents the flash.
-
 ### HIGH: Not re-throwing redirects in try/catch
 
 `redirect()` works by throwing. If `beforeLoad` has a try/catch, the redirect gets swallowed:
@@ -490,8 +492,6 @@ export const Route = createFileRoute('/_authenticated')({
 
 Place protected routes as children of the `_authenticated` layout route. Public routes (login, home, etc.) live outside it.
 
----
-
 ## Cross-References
 
 - See also: **router-core/data-loading/SKILL.md** — `beforeLoad` runs before `loader`; auth context flows into loader via route context

package/skills/router-core/code-splitting/SKILL.md

@@ -1,13 +1,14 @@
 ---
-name: router-core/code-splitting
+name: code-splitting
 description: >-
   Automatic code splitting (autoCodeSplitting), .lazy.tsx convention,
   createLazyFileRoute, createLazyRoute, lazyRouteComponent, getRouteApi
   for typed hooks in split files, codeSplitGroupings per-route override,
   splitBehavior programmatic config, critical vs non-critical properties.
-type: sub-skill
-library: tanstack-router
-library_version: '1.166.2'
+metadata:
+  type: sub-skill
+  library: tanstack-router
+  library_version: '1.171.15'
 requires:
   - router-core
 sources:

package/skills/router-core/data-loading/SKILL.md

@@ -1,14 +1,15 @@
 ---
-name: router-core/data-loading
+name: data-loading
 description: >-
   Route loader option, loaderDeps for cache keys, staleTime/gcTime/
   defaultPreloadStaleTime SWR caching, pendingComponent/pendingMs/
   pendingMinMs, errorComponent/onError/onCatch, beforeLoad, router
   context and createRootRouteWithContext DI pattern, router.invalidate,
   Await component, deferred data loading with unawaited promises.
-type: sub-skill
-library: tanstack-router
-library_version: '1.166.2'
+metadata:
+  type: sub-skill
+  library: tanstack-router
+  library_version: '1.171.15'
 requires:
   - router-core
 sources:
@@ -216,13 +217,29 @@ Route-level context via `beforeLoad`:
 
 ```tsx
 export const Route = createFileRoute('/posts')({
-  beforeLoad: () => ({
-    fetchPosts: () => fetch('/api/posts').then((r) => r.json()),
+  beforeLoad: ({ context }) => ({
+    fetchPosts: context.fetchPosts,
   }),
   loader: ({ context: { fetchPosts } }) => fetchPosts(),
 })
 ```
 
+Keep the implementation SSR-safe when the router is used by TanStack Start. A relative `fetch('/api/posts')` works in a browser event handler, but Node and many server runtimes require an absolute URL during SSR. For app-internal data in Start, call a server function from the loader:
+
+```tsx
+import { createServerFn } from '@tanstack/react-start'
+
+const getPosts = createServerFn({ method: 'GET' }).handler(() => {
+  return db.posts.findMany()
+})
+
+export const Route = createFileRoute('/posts')({
+  loader: () => getPosts(),
+})
+```
+
+Use a server route plus an origin-derived absolute URL only when the HTTP boundary itself is required. Do not hard-code the production origin.
+
 ### Deferred Data Loading
 
 Return unawaited promises from the loader for non-critical data. Use the `Await` component to render them:
@@ -276,19 +293,17 @@ function AddPostButton() {
   const router = useRouter()
 
   const handleAdd = async () => {
-    await fetch('/api/posts', { method: 'POST', body: '...' })
-    router.invalidate()
+    await createPost({ title: 'New post' })
+    await router.invalidate({ sync: true })
   }
 
   return <button onClick={handleAdd}>Add Post</button>
 }
 ```
 
-For synchronous invalidation (wait until loaders finish):
+Use `await router.invalidate({ sync: true })` when the next step requires refreshed loader data.
 
-```tsx
-await router.invalidate({ sync: true })
-```
+Treat the mutation and invalidation as one workflow. The mutation must persist before invalidation starts, and the loader must read from the same authoritative store. Verify create, update, and delete through the rendered route, including a fresh reload; local component state can hide a stale loader or non-persistent write.
 
 ### Error Handling
 
@@ -361,16 +376,13 @@ export const Route = createFileRoute('/posts')({
   },
 })
 
-// CORRECT — loaders run in the browser, use fetch or API calls
+// CORRECT for an SPA — use a client-safe API helper
 export const Route = createFileRoute('/posts')({
-  loader: async () => {
-    const res = await fetch('/api/posts')
-    return res.json()
-  },
+  loader: () => fetchPosts(),
 })
 ```
 
-Do NOT put database queries, filesystem access, or server-only code in loaders unless you are using TanStack Start server functions.
+Do NOT put database queries, filesystem access, or server-only code directly in loaders. In TanStack Start, put that work in a server function and call the function from the loader. Do not use a relative `fetch('/api/...')` in an SSR loader.
 
 ### MEDIUM: Not understanding staleTime default is 0
 

package/skills/router-core/navigation/SKILL.md

@@ -1,14 +1,15 @@
 ---
-name: router-core/navigation
+name: navigation
 description: >-
   Link component, useNavigate, Navigate component, router.navigate,
   ToOptions/NavigateOptions/LinkOptions, from/to relative navigation,
   activeOptions/activeProps, preloading (intent/viewport/render),
   preloadDelay, navigation blocking (useBlocker, Block), createLink,
   linkOptions helper, scroll restoration, MatchRoute.
-type: sub-skill
-library: tanstack-router
-library_version: '1.166.2'
+metadata:
+  type: sub-skill
+  library: tanstack-router
+  library_version: '1.171.15'
 requires:
   - router-core
 sources:

package/skills/router-core/not-found-and-errors/SKILL.md

@@ -1,13 +1,14 @@
 ---
-name: router-core/not-found-and-errors
+name: not-found-and-errors
 description: >-
   notFound() function, notFoundComponent, defaultNotFoundComponent,
   notFoundMode (fuzzy/root), errorComponent, CatchBoundary,
   CatchNotFound, isNotFound, NotFoundRoute (deprecated), route
   masking (mask option, createRouteMask, unmaskOnReload).
-type: sub-skill
-library: tanstack-router
-library_version: '1.166.2'
+metadata:
+  type: sub-skill
+  library: tanstack-router
+  library_version: '1.171.15'
 requires:
   - router-core
 sources:

package/skills/router-core/path-params/SKILL.md

@@ -1,13 +1,14 @@
 ---
-name: router-core/path-params
+name: path-params
 description: >-
   Dynamic path segments ($paramName), splat routes ($ / _splat),
   optional params ({-$paramName}), prefix/suffix patterns ({$param}.ext),
   useParams, params.parse/stringify, pathParamsAllowedCharacters,
   i18n locale patterns.
-type: sub-skill
-library: tanstack-router
-library_version: '1.166.2'
+metadata:
+  type: sub-skill
+  library: tanstack-router
+  library_version: '1.171.15'
 requires:
   - router-core
 sources:

package/skills/router-core/search-params/SKILL.md

@@ -1,13 +1,14 @@
 ---
-name: router-core/search-params
+name: search-params
 description: >-
   validateSearch, search param validation with Zod/Valibot/ArkType adapters,
   fallback(), search middlewares (retainSearchParams, stripSearchParams),
   custom serialization (parseSearch, stringifySearch), search param
   inheritance, loaderDeps for cache keys, reading and writing search params.
-type: sub-skill
-library: tanstack-router
-library_version: '1.166.2'
+metadata:
+  type: sub-skill
+  library: tanstack-router
+  library_version: '1.171.15'
 requires:
   - router-core
 sources:

package/skills/router-core/ssr/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: router-core/ssr
+name: ssr
 description: >-
   Non-streaming and streaming SSR, RouterClient/RouterServer,
   renderRouterToString/renderRouterToStream, createRequestHandler,
@@ -7,9 +7,10 @@ description: >-
   components, head route option (meta/links/styles/scripts),
   ScriptOnce, automatic loader dehydration/hydration, memory
   history on server, data serialization, document head management.
-type: sub-skill
-library: tanstack-router
-library_version: '1.166.2'
+metadata:
+  type: sub-skill
+  library: tanstack-router
+  library_version: '1.171.15'
 requires:
   - router-core
   - router-core/data-loading

package/skills/router-core/type-safety/SKILL.md

@@ -1,14 +1,15 @@
 ---
-name: router-core/type-safety
+name: type-safety
 description: >-
   Full type inference philosophy (never cast, never annotate inferred
   values), Register module declaration, from narrowing on hooks and
   Link, strict:false for shared components, getRouteApi for code-split
   typed access, addChildren with object syntax for TS perf, LinkProps
   and ValidateLinkOptions type utilities, as const satisfies pattern.
-type: sub-skill
-library: tanstack-router
-library_version: '1.166.2'
+metadata:
+  type: sub-skill
+  library: tanstack-router
+  library_version: '1.171.15'
 requires:
   - router-core
 sources:
@@ -489,4 +490,10 @@ const search = Route.useSearch()
 
 If a build error mentions `react-router-dom`, `next/`, `pages/_app`, or duplicate `/` routes, fix the import — don't paper over with type assertions.
 
+### 6. CRITICAL: Treating typecheck as proof of runtime schema propagation
+
+Types can say a field exists while a database projection, API serializer, or server function omits it. When adding or renaming a field, trace the value through storage, validation, handler output, loader data, and rendered UI. Do not cast the response to the desired type.
+Add a runtime assertion against the real handler or serialized response, such as `expect(await getOrder({ data: { id } })).toMatchObject({ totalCents: 2599 })`.
+Then run the route-level test and production build. The type test remains necessary, but it is not the runtime contract test.
+
 See also: router-core (Register setup), router-core/navigation (from narrowing), router-core/code-splitting (getRouteApi).

package/src/Matches.ts

@@ -9,7 +9,7 @@ import type {
   RouteIds,
 } from './routeInfo'
 import type { AnyRouter, RegisteredRouter, SSROption } from './router'
-import type { Constrain, ControlledPromise } from './utils'
+import type { Constrain } from './utils'
 
 export type AnyMatchAndValue = { match: any; value: any }
 
@@ -131,47 +131,32 @@ export interface RouteMatch<
   pathname: string
   params: TAllParams
   _strictParams: TAllParams
-  status: 'pending' | 'success' | 'error' | 'redirected' | 'notFound'
+  status: 'pending' | 'success' | 'error' | 'notFound'
   isFetching: false | 'beforeLoad' | 'loader'
   error: unknown
   paramsError: unknown
   searchError: unknown
   updatedAt: number
-  _nonReactive: {
-    /** @internal */
-    beforeLoadPromise?: ControlledPromise<void>
-    /** @internal */
-    loaderPromise?: ControlledPromise<void>
-    /** @internal */
-    pendingTimeout?: ReturnType<typeof setTimeout>
-    loadPromise?: ControlledPromise<void>
-    displayPendingPromise?: Promise<void>
-    minPendingPromise?: ControlledPromise<void>
-    dehydrated?: boolean
-    /** @internal */
-    error?: unknown
-  }
   loaderData?: TLoaderData
+  /** @internal Exclusive end of the SSR-verified asset prefix. */
+  _assetEnd?: number
   /** @internal */
-  __routeContext?: Record<string, unknown>
+  _ctx?: Record<string, unknown>
   /** @internal */
   __beforeLoadContext?: Record<string, unknown>
   context: TAllContext
   search: TFullSearchSchema
   _strictSearch: TFullSearchSchema
-  fetchCount: number
   abortController: AbortController
   cause: 'preload' | 'enter' | 'stay'
   loaderDeps: TLoaderDeps
   preload: boolean
   invalid: boolean
   headers?: Record<string, string>
-  globalNotFound?: boolean
+  _notFound?: boolean
   staticData: StaticDataRouteOption
   /** This attribute is not reactive */
   ssr?: SSROption
-  _forcePending?: boolean
-  _displayPending?: boolean
 }
 
 export interface PreValidationErrorHandlingRouteMatch<

package/src/await-signal.ts

@@ -0,0 +1,27 @@
+export function waitForReason<T>(
+  value: T | PromiseLike<T>,
+  signal: AbortSignal,
+  onLate?: (value: T) => void,
+): Promise<T> {
+  const promise = Promise.resolve(value)
+  if (signal.aborted) {
+    if (!onLate) {
+      return Promise.race([Promise.reject(signal.reason), promise])
+    }
+    void promise.then(onLate, () => {})
+    return Promise.reject(signal.reason)
+  }
+  return new Promise<T>((resolve, reject) => {
+    const abort = () => reject(signal.reason)
+    signal.addEventListener('abort', abort, { once: true })
+    promise
+      .then((result) => {
+        if (signal.aborted) {
+          onLate?.(result)
+        } else {
+          resolve(result)
+        }
+      }, reject)
+      .finally(() => signal.removeEventListener('abort', abort))
+  })
+}

package/src/index.ts

@@ -103,6 +103,7 @@ export {
   resolveManifestCssLink,
 } from './manifest'
 export { isMatch } from './Matches'
+export { _getAssetMatches, _getRenderedMatches } from './load-client'
 export type {
   AnyMatchAndValue,
   FindValueByIndex,
@@ -242,7 +243,6 @@ export {
   SearchParamError,
   PathParamError,
   getInitialRouterState,
-  getMatchedRoutes,
   trailingSlashOptions,
 } from './router'
 
@@ -274,9 +274,7 @@ export type {
   InjectedHtmlEntry,
   EmitFn,
   LoadFn,
-  GetMatchFn,
   SubscribeFn,
-  UpdateMatchFn,
   CommitLocationFn,
   GetMatchRoutesFn,
   MatchRoutesFn,

package/src/isServer/client.ts

@@ -1 +1,2 @@
 export const isServer = false
+export const loadServerRoute: never = undefined as never