@timber-js/app 0.2.0-alpha.147 → 0.2.0-alpha.148

package/dist/_chunks/{define-C3RvHQPK.js → define-CFmvb4Bt.js}

@@ -1,5 +1,5 @@
 import { n as useQueryStates } from "./use-query-states-CbeQmext.js";
-import { i as isStandardSchema, n as fromSchema, r as isCodec } from "./schema-bridge-DK_89h8O.js";
+import { i as isStandardSchema, n as fromSchema, o as validateSync, r as isCodec } from "./schema-bridge-BY3QLBL7.js";
 //#region src/search-params/define.ts
 /**
 * defineSearchParams — factory for SearchParamsDefinition<T>.
@@ -31,7 +31,7 @@ function getSearchParamsFromAls() {
 */
 function normalizeRaw(raw) {
 	if (raw instanceof URLSearchParams) {
-		const result = {};
+		const result = Object.create(null);
 		for (const key of new Set(raw.keys())) {
 			const values = raw.getAll(key);
 			result[key] = values.length === 1 ? values[0] : values;
@@ -57,7 +57,10 @@ function resolveField(fieldName, value) {
 		codec: value,
 		urlKey: value.urlKey
 	};
-	if (isStandardSchema(value)) return { codec: fromSchema(value) };
+	if (isStandardSchema(value)) {
+		if (validateSync(value, void 0).issues) throw new Error(`[timber] defineSearchParams: field '${fieldName}' has no default value and rejects undefined input.\n  Search params are optional — the URL might not contain ?${fieldName}=anything.\n  Add .default() to your schema: z.coerce.number().int().min(1).default(1)\n  Or use .optional() if the field is truly optional.`);
+		return { codec: fromSchema(value) };
+	}
 	throw new Error(`[timber] defineSearchParams: field '${fieldName}' is not a valid codec or Standard Schema. Expected an object with { parse, serialize } methods, or a Standard Schema object (Zod, Valibot, ArkType).`);
 }
 /**
@@ -152,21 +155,26 @@ function buildDefinition(codecMap, urlKeys) {
 			resolvedNewCodecs[key] = resolved.codec;
 			if (resolved.urlKey) newUrlKeys[key] = resolved.urlKey;
 		}
-		return buildDefinition({
+		const combinedCodecs = {
 			...codecMap,
 			...resolvedNewCodecs
-		}, {
+		};
+		const combinedUrlKeys = {
 			...urlKeys,
 			...newUrlKeys
-		});
+		};
+		validateDefaults(combinedCodecs);
+		return buildDefinition(combinedCodecs, combinedUrlKeys);
 	}
 	function pick(...keys) {
 		const pickedCodecs = {};
 		const pickedUrlKeys = {};
 		for (const key of keys) {
+			if (!(key in codecMap)) throw new Error(`[timber] pick('${key}'): unknown key. Available keys: ${Object.keys(codecMap).map((k) => `'${k}'`).join(", ")}.`);
 			pickedCodecs[key] = codecMap[key];
 			if (key in urlKeys) pickedUrlKeys[key] = urlKeys[key];
 		}
+		validateDefaults(pickedCodecs);
 		return buildDefinition(pickedCodecs, pickedUrlKeys);
 	}
 	function useQueryStates$1(options) {
@@ -192,4 +200,4 @@ function buildDefinition(codecMap, urlKeys) {
 //#endregion
 export { defineSearchParams as n, _setGetSearchParamsFn as t };
 
-//# sourceMappingURL=define-C3RvHQPK.js.map
+//# sourceMappingURL=define-CFmvb4Bt.js.map

package/dist/_chunks/define-CFmvb4Bt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-CFmvb4Bt.js","names":[],"sources":["../../src/search-params/define.ts"],"sourcesContent":["/**\n * defineSearchParams — factory for SearchParamsDefinition<T>.\n *\n * Creates a typed, composable definition for a route's search parameters.\n * Accepts both SearchParamCodec values and Standard Schema objects (Zod,\n * Valibot, ArkType) with auto-detection. Supports URL key aliasing via\n * withUrlKey(), default-omission serialization, and composition via\n * .extend() / .pick().\n *\n * Design doc: design/23-search-params.md §\"defineSearchParams — The Factory\"\n */\n\nimport { useQueryStates as clientUseQueryStates } from '../client/use-query-states.js';\nimport { fromSchema, isStandardSchema, isCodec, validateSync } from '../schema-bridge.js';\nimport type { StandardSchemaV1 } from '../schema-bridge.js';\nimport type { Codec } from '../codec.js';\n\n// Server-only reference for .get() — avoids pulling server ALS into client bundles.\n// In client environments, .get() throws before reaching this code path.\n//\n// IMPORTANT: This is set eagerly via _setGetSearchParamsFn() at server startup\n// (called from request-context.ts module initialization). It must NOT use\n// dynamic `await import()` at call time because the async microtask from the\n// dynamic import loses AsyncLocalStorage context in React's RSC Flight renderer,\n// breaking getSearchParams() in parallel slot pages. See TIM-523.\nlet _getSearchParamsFn: (() => URLSearchParams) | undefined;\n\n/**\n * Register the getSearchParams function. Called once at module load time\n * from request-context.ts to avoid dynamic import at call time.\n * @internal\n */\nexport function _setGetSearchParamsFn(fn: () => URLSearchParams): void {\n  _getSearchParamsFn = fn;\n}\n\nfunction getSearchParamsFromAls(): URLSearchParams {\n  if (!_getSearchParamsFn) {\n    throw new Error(\n      '[timber] searchParams.get() is only available on the server. ' +\n        'Use searchParams.useQueryStates() on the client.'\n    );\n  }\n  return _getSearchParamsFn();\n}\n\n// ---------------------------------------------------------------------------\n// Types\n// ---------------------------------------------------------------------------\n\n/**\n * A codec that converts between URL string values and typed values.\n *\n * nuqs parsers implement this interface natively — no adapter needed.\n * Standard Schema objects (Zod, Valibot, ArkType) are auto-detected\n * by defineSearchParams and wrapped via fromSchema.\n */\nexport interface SearchParamCodec<T> extends Codec<T> {\n  /** Optional URL key alias, set by withUrlKey(). */\n  urlKey?: string;\n}\n\n/** A codec with a URL key alias attached via withUrlKey(). */\nexport interface SearchParamCodecWithUrlKey<T> extends SearchParamCodec<T> {\n  urlKey: string;\n}\n\n/** Infer the output type of a codec. */\nexport type InferCodec<C> = C extends SearchParamCodec<infer T> ? T : never;\n\n/** Map of property names to codecs. */\nexport type CodecMap<T extends Record<string, unknown>> = {\n  [K in keyof T]: SearchParamCodec<T[K]>;\n};\n\n/** Options for useQueryStates setter. */\nexport interface SetParamsOptions {\n  /** Update URL without server roundtrip (default: false). */\n  shallow?: boolean;\n  /** Scroll to top after update (default: true). */\n  scroll?: boolean;\n  /** 'push' (default) or 'replace' for history state. */\n  history?: 'push' | 'replace';\n}\n\n/** Setter function returned by useQueryStates. */\nexport type SetParams<T> = (values: Partial<T>, options?: SetParamsOptions) => void;\n\n/** Options for useQueryStates hook. */\nexport interface QueryStatesOptions {\n  /** Update URL without server roundtrip (default: false). */\n  shallow?: boolean;\n  /** Scroll to top after update (default: true). */\n  scroll?: boolean;\n  /** 'push' (default) or 'replace' for history state. */\n  history?: 'push' | 'replace';\n}\n\n/**\n * A fully typed, composable search params definition.\n *\n * Returned by defineSearchParams(). Carries a phantom _type property\n * for build-time type extraction.\n */\nexport interface SearchParamsDefinition<T extends Record<string, unknown>> {\n  /** Parse raw URL search params into typed values. */\n  parse(raw: URLSearchParams | Record<string, string | string[] | undefined>): T;\n  /** Parse a Promise of URLSearchParams (e.g., from the ALS `searchParams()` API). */\n  parse(raw: Promise<URLSearchParams | Record<string, string | string[] | undefined>>): Promise<T>;\n\n  /**\n   * Get typed search params from the current request context (ALS-backed).\n   *\n   * Server-only, sync. Reads getSearchParams() from ALS and parses through codecs.\n   * Throws on client.\n   *\n   * ```tsx\n   * // app/products/page.tsx\n   * import { searchParams } from './params'\n   * export default function Page() {\n   *   const { page, category } = searchParams.get()\n   * }\n   * ```\n   */\n  get(): T;\n\n  /** Client hook — reads current URL params and returns typed values + setter. */\n  useQueryStates(options?: QueryStatesOptions): [T, SetParams<T>];\n\n  /** Extend with additional codecs or Standard Schema objects. */\n  extend<U extends Record<string, SearchParamCodec<unknown> | StandardSchemaV1<unknown>>>(\n    codecs: U\n  ): SearchParamsDefinition<T & { [K in keyof U]: InferField<U[K]> }>;\n\n  /** Pick a subset of keys. Preserves codecs and aliases. */\n  pick<K extends keyof T & string>(...keys: K[]): SearchParamsDefinition<Pick<T, K>>;\n\n  /** Serialize values to a query string (no leading '?'), omitting defaults. */\n  serialize(values: Partial<T>): string;\n\n  /** Build a full path with query string, omitting defaults. */\n  href(pathname: string, values: Partial<T>): string;\n\n  /** Build a URLSearchParams instance, omitting defaults. */\n  toSearchParams(values: Partial<T>): URLSearchParams;\n\n  /** Read-only codec map for spreading into .extend(). */\n  codecs: { [K in keyof T]: SearchParamCodec<T[K]> };\n\n  /** Read-only URL key alias map. Maps property names to URL query parameter keys. */\n  readonly urlKeys: Readonly<Record<string, string>>;\n\n  /**\n   * Phantom property for build-time type extraction.\n   * Never set at runtime — exists only in the type system.\n   */\n  readonly _type?: T;\n}\n\n// StandardSchemaV1 is imported from schema-bridge.ts — single source of truth.\n// Re-export for consumers that import it from this module.\nexport type { StandardSchemaV1 } from '../schema-bridge.js';\n\n// ---------------------------------------------------------------------------\n// Type-level helpers\n// ---------------------------------------------------------------------------\n\n/** Infer the output type from either a SearchParamCodec or a StandardSchemaV1. */\nexport type InferField<V> =\n  V extends SearchParamCodec<infer T> ? T : V extends StandardSchemaV1<infer T> ? T : never;\n\n/** Acceptable field value for defineSearchParams: a codec or a Standard Schema. */\nexport type SearchParamField<T = unknown> = SearchParamCodec<T> | StandardSchemaV1<T>;\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Convert URLSearchParams or a plain record to a normalized record\n * where repeated keys produce arrays.\n */\nfunction normalizeRaw(\n  raw: URLSearchParams | Record<string, string | string[] | undefined>\n): Record<string, string | string[] | undefined> {\n  if (raw instanceof URLSearchParams) {\n    const result: Record<string, string | string[] | undefined> = Object.create(null);\n    for (const key of new Set(raw.keys())) {\n      const values = raw.getAll(key);\n      result[key] = values.length === 1 ? values[0] : values;\n    }\n    return result;\n  }\n  return raw;\n}\n\n/**\n * Compute the serialized default value for a codec. Used for\n * default-omission: when serialize(value) === serialize(parse(undefined)),\n * the field is omitted from the URL.\n */\nfunction getDefaultSerialized<T>(codec: SearchParamCodec<T>): string | null {\n  return codec.serialize(codec.parse(undefined));\n}\n\n// isStandardSchema and isCodec are imported from schema-bridge.ts.\n\n/**\n * Resolve a field value to a SearchParamCodec. Auto-detects Standard Schema\n * objects and wraps them with fromSchema. Reads .urlKey from codecs.\n */\nfunction resolveField(\n  fieldName: string,\n  value: SearchParamField\n): { codec: SearchParamCodec<unknown>; urlKey?: string } {\n  // Check for codec first (codecs may also have '~standard' if they're nuqs parsers)\n  if (isCodec(value)) {\n    return { codec: value, urlKey: value.urlKey };\n  }\n\n  // Auto-detect Standard Schema\n  if (isStandardSchema(value)) {\n    // Validate that the schema handles absent params (undefined input).\n    // Search params are optional — the URL might not contain the param.\n    // If the schema rejects undefined and has no default, the codec would\n    // return `undefined as T`, making the type lie. Catch this at definition\n    // time instead. design/23-search-params.md §\"Default Validation\"\n    const absentCheck = validateSync(value, undefined);\n    if (absentCheck.issues) {\n      throw new Error(\n        `[timber] defineSearchParams: field '${fieldName}' has no default value and rejects undefined input.\\n` +\n          `  Search params are optional — the URL might not contain ?${fieldName}=anything.\\n` +\n          `  Add .default() to your schema: z.coerce.number().int().min(1).default(1)\\n` +\n          `  Or use .optional() if the field is truly optional.`\n      );\n    }\n    return { codec: fromSchema(value) };\n  }\n\n  throw new Error(\n    `[timber] defineSearchParams: field '${fieldName}' is not a valid codec or Standard Schema. ` +\n      `Expected an object with { parse, serialize } methods, or a Standard Schema object ` +\n      `(Zod, Valibot, ArkType).`\n  );\n}\n\n/**\n * Validate that all codecs handle absent params (parse(undefined) doesn't throw).\n * Catches schemas that throw on missing input. `undefined` and `null` are both\n * valid defaults — `undefined` is correct for optional fields (e.g., `z.string().optional()`).\n */\nfunction validateDefaults(codecMap: Record<string, SearchParamCodec<unknown>>): void {\n  for (const [key, codec] of Object.entries(codecMap)) {\n    try {\n      codec.parse(undefined);\n    } catch {\n      throw new Error(\n        `[timber] defineSearchParams: field '${key}' throws when the param is absent.\\n` +\n          `  Search params are optional — the URL might not contain ?${key}=anything.\\n` +\n          `  Add .default() or .optional() to your schema, or wrap with withDefault().`\n      );\n    }\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Factory\n// ---------------------------------------------------------------------------\n\n/**\n * Create a SearchParamsDefinition from a map of codecs and/or Standard Schema\n * objects. Accepts both SearchParamCodec values and raw Zod/Valibot/ArkType\n * schemas with auto-detection.\n *\n * ```ts\n * import { defineSearchParams, withDefault, withUrlKey } from '@timber-js/app/search-params'\n * import { parseAsString, parseAsStringEnum } from 'nuqs'\n * import { z } from 'zod/v4'\n *\n * export const searchParams = defineSearchParams({\n *   page: z.coerce.number().int().min(1).default(1),     // Standard Schema — auto-wrapped\n *   q: withUrlKey(parseAsString, 'search'),                // nuqs codec with URL alias\n *   sort: withDefault(parseAsStringEnum(['price', 'name']), 'price'),\n * })\n * ```\n */\n/**\n * Overload: accept a Standard Schema object schema (e.g., z.object({...})).\n *\n * The schema must have a `.shape` property whose values are themselves\n * Standard Schema objects. Each shape property becomes a field codec\n * via fromSchema().\n *\n * ```ts\n * const searchParams = defineSearchParams(\n *   z.object({ page: z.coerce.number().default(1), q: z.string().optional() })\n * )\n * ```\n */\nexport function defineSearchParams<T extends Record<string, unknown>>(\n  schema: StandardSchemaV1<T> & { shape: Record<string, StandardSchemaV1<unknown>> }\n): SearchParamsDefinition<T>;\n\n/**\n * Overload: accept a map of codecs and/or Standard Schema objects.\n */\nexport function defineSearchParams<C extends Record<string, SearchParamField>>(\n  codecs: C\n): SearchParamsDefinition<{ [K in keyof C]: InferField<C[K]> }>;\n\nexport function defineSearchParams(\n  codecsOrSchema:\n    | Record<string, SearchParamField>\n    | (StandardSchemaV1<unknown> & { shape: Record<string, StandardSchemaV1<unknown>> })\n): SearchParamsDefinition<Record<string, unknown>> {\n  // Detect Standard Schema object with .shape (e.g., z.object(...))\n  if (isStandardSchema(codecsOrSchema) && hasShape(codecsOrSchema)) {\n    const fieldCodecs: Record<string, SearchParamField> = {};\n    for (const [key, fieldSchema] of Object.entries(codecsOrSchema.shape)) {\n      if (isStandardSchema(fieldSchema)) {\n        fieldCodecs[key] = fieldSchema;\n      } else {\n        throw new Error(\n          `[timber] defineSearchParams: field '${key}' in schema.shape is not a Standard Schema. ` +\n            `All shape properties must be Standard Schema objects (Zod, Valibot, ArkType).`\n        );\n      }\n    }\n    return defineSearchParamsFromMap(fieldCodecs);\n  }\n\n  return defineSearchParamsFromMap(codecsOrSchema as Record<string, SearchParamField>);\n}\n\n/** Check if a schema has a .shape property with object-type values. */\nfunction hasShape(schema: unknown): schema is { shape: Record<string, unknown> } {\n  return (\n    typeof schema === 'object' &&\n    schema !== null &&\n    'shape' in schema &&\n    typeof (schema as { shape: unknown }).shape === 'object' &&\n    (schema as { shape: unknown }).shape !== null\n  );\n}\n\nfunction defineSearchParamsFromMap(\n  codecs: Record<string, SearchParamField>\n): SearchParamsDefinition<Record<string, unknown>> {\n  const resolvedCodecs: Record<string, SearchParamCodec<unknown>> = {};\n  const urlKeys: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(codecs)) {\n    const resolved = resolveField(key, value as SearchParamField);\n    resolvedCodecs[key] = resolved.codec;\n    if (resolved.urlKey) {\n      urlKeys[key] = resolved.urlKey;\n    }\n  }\n\n  // Validate that all codecs handle absent params\n  validateDefaults(resolvedCodecs);\n\n  return buildDefinition(resolvedCodecs as unknown as CodecMap<Record<string, unknown>>, urlKeys);\n}\n\n// ---------------------------------------------------------------------------\n// Internal: build the definition object\n// ---------------------------------------------------------------------------\n\n/**\n * Internal: build a SearchParamsDefinition from a typed codec map and url keys.\n */\nfunction buildDefinition<T extends Record<string, unknown>>(\n  codecMap: CodecMap<T>,\n  urlKeys: Record<string, string>\n): SearchParamsDefinition<T> {\n  // Pre-compute default serialized values for omission check\n  const defaultSerialized: Record<string, string | null> = {};\n  for (const key of Object.keys(codecMap)) {\n    defaultSerialized[key] = getDefaultSerialized(codecMap[key as keyof T]);\n  }\n\n  function getUrlKey(prop: string): string {\n    return urlKeys[prop] ?? prop;\n  }\n\n  // ---- parse ----\n  function parseSync(raw: URLSearchParams | Record<string, string | string[] | undefined>): T {\n    const normalized = normalizeRaw(raw);\n    const result: Record<string, unknown> = {};\n\n    for (const prop of Object.keys(codecMap)) {\n      const urlKey = getUrlKey(prop);\n      const rawValue = normalized[urlKey];\n      result[prop] = (codecMap[prop as keyof T] as SearchParamCodec<unknown>).parse(rawValue);\n    }\n\n    return result as T;\n  }\n\n  // Overloaded parse: sync when given raw params, async when given a Promise.\n  // This enables the ergonomic pattern: await def.parse(searchParams())\n  function parse(raw: URLSearchParams | Record<string, string | string[] | undefined>): T;\n  function parse(\n    raw: Promise<URLSearchParams | Record<string, string | string[] | undefined>>\n  ): Promise<T>;\n  function parse(\n    raw:\n      | URLSearchParams\n      | Record<string, string | string[] | undefined>\n      | Promise<URLSearchParams | Record<string, string | string[] | undefined>>\n  ): T | Promise<T> {\n    if (raw instanceof Promise) {\n      return raw.then(parseSync);\n    }\n    return parseSync(raw);\n  }\n\n  // ---- serialize ----\n  function serialize(values: Partial<T>): string {\n    const parts: string[] = [];\n\n    for (const prop of Object.keys(codecMap)) {\n      if (!(prop in values)) continue;\n      const codec = codecMap[prop as keyof T] as SearchParamCodec<unknown>;\n      const serialized = codec.serialize(values[prop as keyof T] as unknown);\n\n      // Omit if serialized value matches the default\n      if (serialized === defaultSerialized[prop]) continue;\n      if (serialized === null) continue;\n\n      parts.push(`${encodeURIComponent(getUrlKey(prop))}=${encodeURIComponent(serialized)}`);\n    }\n\n    return parts.join('&');\n  }\n\n  // ---- href ----\n  function href(pathname: string, values: Partial<T>): string {\n    const qs = serialize(values);\n    return qs ? `${pathname}?${qs}` : pathname;\n  }\n\n  // ---- toSearchParams ----\n  function toSearchParams(values: Partial<T>): URLSearchParams {\n    const usp = new URLSearchParams();\n\n    for (const prop of Object.keys(codecMap)) {\n      if (!(prop in values)) continue;\n      const codec = codecMap[prop as keyof T] as SearchParamCodec<unknown>;\n      const serialized = codec.serialize(values[prop as keyof T] as unknown);\n\n      if (serialized === defaultSerialized[prop]) continue;\n      if (serialized === null) continue;\n\n      usp.set(getUrlKey(prop), serialized);\n    }\n\n    return usp;\n  }\n\n  // ---- extend ----\n  function extend<U extends Record<string, SearchParamCodec<unknown> | StandardSchemaV1<unknown>>>(\n    newCodecs: U\n  ): SearchParamsDefinition<T & { [K in keyof U]: InferField<U[K]> }> {\n    type Combined = T & { [K in keyof U]: InferField<U[K]> };\n\n    // Resolve any Standard Schema objects in the extension\n    const resolvedNewCodecs: Record<string, SearchParamCodec<unknown>> = {};\n    const newUrlKeys: Record<string, string> = {};\n    for (const [key, value] of Object.entries(newCodecs)) {\n      const resolved = resolveField(key, value as SearchParamField);\n      resolvedNewCodecs[key] = resolved.codec;\n      if (resolved.urlKey) {\n        newUrlKeys[key] = resolved.urlKey;\n      }\n    }\n\n    const combinedCodecs = {\n      ...codecMap,\n      ...resolvedNewCodecs,\n    } as unknown as CodecMap<Combined>;\n\n    // Merge URL keys: base keys + new codec urlKeys from withUrlKey\n    const combinedUrlKeys: Record<string, string> = { ...urlKeys, ...newUrlKeys };\n\n    // Same definition-time guard as defineSearchParams — a throw-on-absent\n    // codec added via extend() gets the friendly guidance error, not a\n    // crash on first parse (TIM-1066).\n    validateDefaults(combinedCodecs as Record<string, SearchParamCodec<unknown>>);\n\n    return buildDefinition<Combined>(combinedCodecs, combinedUrlKeys);\n  }\n\n  // ---- pick ----\n  function pick<K extends keyof T & string>(...keys: K[]): SearchParamsDefinition<Pick<T, K>> {\n    const pickedCodecs: Record<string, SearchParamCodec<unknown>> = {};\n    const pickedUrlKeys: Record<string, string> = {};\n\n    for (const key of keys) {\n      // Explicit guard — TypeScript prevents this, but JS callers and\n      // casts reach here, and \"Cannot read properties of undefined\n      // (reading 'serialize')\" is no help (TIM-1066).\n      if (!(key in codecMap)) {\n        throw new Error(\n          `[timber] pick('${key}'): unknown key. ` +\n            `Available keys: ${Object.keys(codecMap)\n              .map((k) => `'${k}'`)\n              .join(', ')}.`\n        );\n      }\n      pickedCodecs[key] = codecMap[key] as SearchParamCodec<unknown>;\n      if (key in urlKeys) {\n        pickedUrlKeys[key] = urlKeys[key];\n      }\n    }\n\n    validateDefaults(pickedCodecs);\n\n    return buildDefinition<Pick<T, K>>(\n      pickedCodecs as unknown as CodecMap<Pick<T, K>>,\n      pickedUrlKeys\n    );\n  }\n\n  // ---- useQueryStates ----\n  // Delegates to the 'use client' implementation from use-query-states.ts.\n  //\n  // In the RSC environment: use-query-states.ts is transformed by the RSC\n  //   plugin into a client reference proxy. Calling it throws — correct,\n  //   because hooks can't run during server component rendering.\n  // In SSR: use-query-states.ts is the real nuqs-backed function. Hooks\n  //   work during SSR's renderToReadableStream, so this works correctly.\n  // On the client: same as SSR — the real function is available.\n  function useQueryStates(options?: QueryStatesOptions): [T, SetParams<T>] {\n    return clientUseQueryStates(codecMap, options, Object.freeze({ ...urlKeys })) as [\n      T,\n      SetParams<T>,\n    ];\n  }\n\n  // ---- get ----\n  // ALS-backed: reads getSearchParams() from the current request context\n  // and parses through codecs. Server-only, sync.\n  function get(): T {\n    if (typeof window !== 'undefined') {\n      throw new Error(\n        '[timber] searchParams.get() is server-only. ' +\n          'Use searchParams.useQueryStates() on the client.'\n      );\n    }\n    const raw = getSearchParamsFromAls();\n    return parseSync(raw);\n  }\n\n  const definition: SearchParamsDefinition<T> = {\n    parse,\n    get,\n    useQueryStates,\n    extend,\n    pick,\n    serialize,\n    href,\n    toSearchParams,\n    codecs: codecMap,\n    urlKeys: Object.freeze({ ...urlKeys }),\n  };\n\n  return definition;\n}\n"],"mappings":";;;;;;;;;;;;;;AAyBA,IAAI;;;;;;AAOJ,SAAgB,sBAAsB,IAAiC;CACrE,qBAAqB;AACvB;AAEA,SAAS,yBAA0C;CACjD,IAAI,CAAC,oBACH,MAAM,IAAI,MACR,+GAEF;CAEF,OAAO,mBAAmB;AAC5B;;;;;AA0IA,SAAS,aACP,KAC+C;CAC/C,IAAI,eAAe,iBAAiB;EAClC,MAAM,SAAwD,OAAO,OAAO,IAAI;EAChF,KAAK,MAAM,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,GAAG;GACrC,MAAM,SAAS,IAAI,OAAO,GAAG;GAC7B,OAAO,OAAO,OAAO,WAAW,IAAI,OAAO,KAAK;EAClD;EACA,OAAO;CACT;CACA,OAAO;AACT;;;;;;AAOA,SAAS,qBAAwB,OAA2C;CAC1E,OAAO,MAAM,UAAU,MAAM,MAAM,KAAA,CAAS,CAAC;AAC/C;;;;;AAQA,SAAS,aACP,WACA,OACuD;CAEvD,IAAI,QAAQ,KAAK,GACf,OAAO;EAAE,OAAO;EAAO,QAAQ,MAAM;CAAO;CAI9C,IAAI,iBAAiB,KAAK,GAAG;EAO3B,IADoB,aAAa,OAAO,KAAA,CACpC,EAAY,QACd,MAAM,IAAI,MACR,uCAAuC,UAAU,iHACc,UAAU,6IAG3E;EAEF,OAAO,EAAE,OAAO,WAAW,KAAK,EAAE;CACpC;CAEA,MAAM,IAAI,MACR,uCAAuC,UAAU,sJAGnD;AACF;;;;;;AAOA,SAAS,iBAAiB,UAA2D;CACnF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GAChD,IAAI;EACF,MAAM,MAAM,KAAA,CAAS;CACvB,QAAQ;EACN,MAAM,IAAI,MACR,uCAAuC,IAAI,gGACoB,IAAI,wFAErE;CACF;AAEJ;AA+CA,SAAgB,mBACd,gBAGiD;CAEjD,IAAI,iBAAiB,cAAc,KAAK,SAAS,cAAc,GAAG;EAChE,MAAM,cAAgD,CAAC;EACvD,KAAK,MAAM,CAAC,KAAK,gBAAgB,OAAO,QAAQ,eAAe,KAAK,GAClE,IAAI,iBAAiB,WAAW,GAC9B,YAAY,OAAO;OAEnB,MAAM,IAAI,MACR,uCAAuC,IAAI,0HAE7C;EAGJ,OAAO,0BAA0B,WAAW;CAC9C;CAEA,OAAO,0BAA0B,cAAkD;AACrF;;AAGA,SAAS,SAAS,QAA+D;CAC/E,OACE,OAAO,WAAW,YAClB,WAAW,QACX,WAAW,UACX,OAAQ,OAA8B,UAAU,YAC/C,OAA8B,UAAU;AAE7C;AAEA,SAAS,0BACP,QACiD;CACjD,MAAM,iBAA4D,CAAC;CACnE,MAAM,UAAkC,CAAC;CAEzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;EACjD,MAAM,WAAW,aAAa,KAAK,KAAyB;EAC5D,eAAe,OAAO,SAAS;EAC/B,IAAI,SAAS,QACX,QAAQ,OAAO,SAAS;CAE5B;CAGA,iBAAiB,cAAc;CAE/B,OAAO,gBAAgB,gBAAgE,OAAO;AAChG;;;;AASA,SAAS,gBACP,UACA,SAC2B;CAE3B,MAAM,oBAAmD,CAAC;CAC1D,KAAK,MAAM,OAAO,OAAO,KAAK,QAAQ,GACpC,kBAAkB,OAAO,qBAAqB,SAAS,IAAe;CAGxE,SAAS,UAAU,MAAsB;EACvC,OAAO,QAAQ,SAAS;CAC1B;CAGA,SAAS,UAAU,KAAyE;EAC1F,MAAM,aAAa,aAAa,GAAG;EACnC,MAAM,SAAkC,CAAC;EAEzC,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,GAAG;GAExC,MAAM,WAAW,WADF,UAAU,IACG;GAC5B,OAAO,QAAS,SAAS,MAA+C,MAAM,QAAQ;EACxF;EAEA,OAAO;CACT;CAQA,SAAS,MACP,KAIgB;EAChB,IAAI,eAAe,SACjB,OAAO,IAAI,KAAK,SAAS;EAE3B,OAAO,UAAU,GAAG;CACtB;CAGA,SAAS,UAAU,QAA4B;EAC7C,MAAM,QAAkB,CAAC;EAEzB,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,GAAG;GACxC,IAAI,EAAE,QAAQ,SAAS;GAEvB,MAAM,aADQ,SAAS,MACE,UAAU,OAAO,KAA2B;GAGrE,IAAI,eAAe,kBAAkB,OAAO;GAC5C,IAAI,eAAe,MAAM;GAEzB,MAAM,KAAK,GAAG,mBAAmB,UAAU,IAAI,CAAC,EAAE,GAAG,mBAAmB,UAAU,GAAG;EACvF;EAEA,OAAO,MAAM,KAAK,GAAG;CACvB;CAGA,SAAS,KAAK,UAAkB,QAA4B;EAC1D,MAAM,KAAK,UAAU,MAAM;EAC3B,OAAO,KAAK,GAAG,SAAS,GAAG,OAAO;CACpC;CAGA,SAAS,eAAe,QAAqC;EAC3D,MAAM,MAAM,IAAI,gBAAgB;EAEhC,KAAK,MAAM,QAAQ,OAAO,KAAK,QAAQ,GAAG;GACxC,IAAI,EAAE,QAAQ,SAAS;GAEvB,MAAM,aADQ,SAAS,MACE,UAAU,OAAO,KAA2B;GAErE,IAAI,eAAe,kBAAkB,OAAO;GAC5C,IAAI,eAAe,MAAM;GAEzB,IAAI,IAAI,UAAU,IAAI,GAAG,UAAU;EACrC;EAEA,OAAO;CACT;CAGA,SAAS,OACP,WACkE;EAIlE,MAAM,oBAA+D,CAAC;EACtE,MAAM,aAAqC,CAAC;EAC5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,GAAG;GACpD,MAAM,WAAW,aAAa,KAAK,KAAyB;GAC5D,kBAAkB,OAAO,SAAS;GAClC,IAAI,SAAS,QACX,WAAW,OAAO,SAAS;EAE/B;EAEA,MAAM,iBAAiB;GACrB,GAAG;GACH,GAAG;EACL;EAGA,MAAM,kBAA0C;GAAE,GAAG;GAAS,GAAG;EAAW;EAK5E,iBAAiB,cAA2D;EAE5E,OAAO,gBAA0B,gBAAgB,eAAe;CAClE;CAGA,SAAS,KAAiC,GAAG,MAA+C;EAC1F,MAAM,eAA0D,CAAC;EACjE,MAAM,gBAAwC,CAAC;EAE/C,KAAK,MAAM,OAAO,MAAM;GAItB,IAAI,EAAE,OAAO,WACX,MAAM,IAAI,MACR,kBAAkB,IAAI,mCACD,OAAO,KAAK,QAAQ,EACpC,KAAK,MAAM,IAAI,EAAE,EAAE,EACnB,KAAK,IAAI,EAAE,EAClB;GAEF,aAAa,OAAO,SAAS;GAC7B,IAAI,OAAO,SACT,cAAc,OAAO,QAAQ;EAEjC;EAEA,iBAAiB,YAAY;EAE7B,OAAO,gBACL,cACA,aACF;CACF;CAWA,SAAS,iBAAe,SAAiD;EACvE,OAAO,eAAqB,UAAU,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;CAI9E;CAKA,SAAS,MAAS;EAChB,IAAI,OAAO,WAAW,aACpB,MAAM,IAAI,MACR,8FAEF;EAGF,OAAO,UADK,uBACK,CAAG;CACtB;CAeA,OAAO;EAZL;EACA;EACA,gBAAA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;EACR,SAAS,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC;CAGhC;AACT"}

package/dist/_chunks/{href-validation-DyZIzfMJ.js → href-validation-FiA_rToW.js}

@@ -110,6 +110,7 @@ var ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\d+\-.]*:|\/\/)/;
 function assertRelativeRedirectPath(path) {
 	const cleaned = path.replace(CONTROL_CHARS_RE, "").trimStart().replaceAll("\\", "/");
 	if (ABSOLUTE_URL_RE.test(cleaned)) throw new Error(`redirect() only accepts relative URLs. Got absolute URL: "${path}". Use redirectExternal(url, allowList) for external redirects.`);
+	if (/[\x00-\x1f]/.test(path)) throw new Error("redirect() received a path containing control characters (U+0000–U+001F). Sanitize user input before passing it to redirect().");
 }
 var SAFE_REDIRECT_SCHEMES = new Set(["http:", "https:"]);
 /**
@@ -137,4 +138,4 @@ function validateExternalRedirectUrl(url, allowList) {
 //#endregion
 export { mergePreservedSearchParams as a, validateNavigationHref as i, isInternalHref as n, validateExternalRedirectUrl as r, assertRelativeRedirectPath as t };
 
-//# sourceMappingURL=href-validation-DyZIzfMJ.js.map
+//# sourceMappingURL=href-validation-FiA_rToW.js.map

package/dist/_chunks/{href-validation-DyZIzfMJ.js.map → href-validation-FiA_rToW.js.map}

@@ -1 +1 @@
-{"version":3,"file":"href-validation-DyZIzfMJ.js","names":[],"sources":["../../src/shared/merge-search-params.ts","../../src/shared/href-validation.ts"],"sourcesContent":["/**\n * Shared utility for merging preserved search params into a target URL.\n *\n * Used by both <Link> (client) and redirect() (server). Extracted to a shared\n * module to avoid importing client code ('use client') from server modules.\n */\n\n/**\n * Merge preserved search params from the current URL into a target href.\n *\n * When `preserve` is `true`, all current search params are merged.\n * When `preserve` is a `string[]`, only the named params are merged.\n *\n * The target href's own search params take precedence — preserved params\n * are only added if the target doesn't already define them.\n *\n * @param targetHref - The resolved target href (may already contain query string)\n * @param currentSearch - The current URL's search string (e.g. \"?private=access&page=2\")\n * @param preserve - `true` to preserve all, or `string[]` to preserve specific params\n * @returns The target href with preserved search params merged in\n */\nexport function mergePreservedSearchParams(\n  targetHref: string,\n  currentSearch: string,\n  preserve: true | string[]\n): string {\n  const currentParams = new URLSearchParams(currentSearch);\n  if (currentParams.size === 0) return targetHref;\n\n  // Split hash fragment from target before processing query params.\n  // Hash must come after query string: /path?query=value#hash\n  const hashIdx = targetHref.indexOf('#');\n  const hrefWithoutHash = hashIdx >= 0 ? targetHref.slice(0, hashIdx) : targetHref;\n  const hash = hashIdx >= 0 ? targetHref.slice(hashIdx) : '';\n\n  // Split target into path and existing query\n  const qIdx = hrefWithoutHash.indexOf('?');\n  const targetPath = qIdx >= 0 ? hrefWithoutHash.slice(0, qIdx) : hrefWithoutHash;\n  const targetParams = new URLSearchParams(qIdx >= 0 ? hrefWithoutHash.slice(qIdx + 1) : '');\n\n  // Collect params to preserve (that aren't already in the target)\n  const merged = new URLSearchParams(targetParams);\n  for (const [key, value] of currentParams) {\n    // Only preserve if: (a) not already in target, and (b) included in preserve list\n    if (!targetParams.has(key)) {\n      if (preserve === true || preserve.includes(key)) {\n        merged.append(key, value);\n      }\n    }\n  }\n\n  const qs = merged.toString();\n  const pathWithQuery = qs ? `${targetPath}?${qs}` : targetPath;\n  return pathWithQuery + hash;\n}\n","/**\n * Shared href/URL validation for all navigation sinks.\n *\n * Used by <Link>, useRouter().push/replace, and redirectExternal().\n * Single source of truth for dangerous-scheme detection — prevents\n * control-character smuggling that bypasses naive regex checks.\n *\n * See design/13-security.md §\"Link scheme injection\" (test #9)\n * and design/07-routing.md §\"<Link> Scheme Validation\".\n */\n\n/**\n * All C0 control characters (U+0000–U+001F) that browsers strip during\n * URL preprocessing. Browsers and `new URL()` strip the full C0 range,\n * not just tab/LF/CR — so we must match that behavior to prevent\n * bypass vectors like `\\x00javascript:alert(1)`.\n */\n// eslint-disable-next-line no-control-regex -- intentional: must match all C0 controls to prevent bypass\nconst CONTROL_CHARS_RE = /[\\x00-\\x1f]/g;\n\nconst DANGEROUS_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:']);\n\n/**\n * Strip C0 control chars and leading whitespace, then extract the scheme.\n * Returns the lowercase scheme (e.g. \"javascript:\") or null if no scheme.\n */\nfunction extractScheme(href: string): string | null {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart();\n  const match = /^([a-z][a-z0-9+.-]*:)/i.exec(cleaned);\n  return match ? match[1].toLowerCase() : null;\n}\n\n/**\n * Validate an href for navigation sinks (<Link>, useRouter, etc.).\n *\n * Rejects dangerous schemes (javascript:, data:, vbscript:) even when\n * control characters are embedded to bypass naive regex checks.\n * Also rejects protocol-relative URLs (//evil.com).\n *\n * Throws on rejection. Safe hrefs pass through silently.\n */\nexport function validateNavigationHref(href: string): void {\n  // Normalize for validation: strip C0 controls, trim, then replace backslashes\n  // with forward slashes. Browsers normalize \\ → / during URL resolution, so\n  // \"/\\evil.com\" becomes \"//evil.com\" (protocol-relative open redirect).\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  // Protocol-relative URLs can redirect to attacker-controlled origins\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `Navigation received a protocol-relative or backslash-prefixed URL: \"${href}\". ` +\n        'Use an absolute URL with an explicit scheme or a relative path.'\n    );\n  }\n\n  const scheme = extractScheme(href);\n  if (scheme && DANGEROUS_SCHEMES.has(scheme)) {\n    throw new Error(\n      `Navigation received a dangerous href: \"${href}\". ` +\n        'javascript:, data:, and vbscript: URLs are not allowed.'\n    );\n  }\n}\n\n/**\n * Check if an href is internal (same-origin navigation) or external.\n *\n * Strips control characters before checking so that \"java\\tscript:\" is\n * correctly identified as having a scheme (and thus not internal).\n */\nexport function isInternalHref(href: string): boolean {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  if (cleaned.startsWith('//')) return false;\n  if (cleaned.startsWith('/') || cleaned.startsWith('#') || cleaned.startsWith('?')) return true;\n\n  const scheme = extractScheme(href);\n  if (scheme) return false;\n\n  return true;\n}\n\n/** Pattern matching absolute URLs: any scheme (http:, javascript:, …) or protocol-relative // */\nconst ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\\d+\\-.]*:|\\/\\/)/;\n\n/**\n * Assert that a redirect target is a relative path — rejects absolute and\n * protocol-relative URLs. Used by both the server `redirect()` primitive and\n * the client next/navigation shim so they enforce identical semantics.\n *\n * Normalizes for validation only: strips C0 controls, trims, then replaces\n * backslashes with forward slashes. Browsers normalize \\ → / during URL\n * resolution, so \"/\\evil.com\" becomes \"//evil.com\" (protocol-relative open\n * redirect). See design/13-security.md tests #8, #8a–#8c.\n */\nexport function assertRelativeRedirectPath(path: string): void {\n  const cleaned = path.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  if (ABSOLUTE_URL_RE.test(cleaned)) {\n    throw new Error(\n      `redirect() only accepts relative URLs. Got absolute URL: \"${path}\". ` +\n        'Use redirectExternal(url, allowList) for external redirects.'\n    );\n  }\n}\n\nconst SAFE_REDIRECT_SCHEMES = new Set(['http:', 'https:']);\n\n/**\n * Validate and canonicalize an external redirect URL.\n *\n * Requires http: or https: scheme and checks origin against an allow-list.\n * Returns the parsed canonical URL string (from URL.href) to prevent\n * raw user input from reaching the Location header.\n *\n * @throws On invalid URL, dangerous scheme, or origin not in allow-list.\n */\nexport function validateExternalRedirectUrl(url: string, allowList: string[]): string {\n  // Strip control chars before parsing to prevent scheme smuggling\n  const cleaned = url.replace(CONTROL_CHARS_RE, '').trimStart();\n\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `redirectExternal() received a protocol-relative URL: \"${url}\". ` +\n        'Use an absolute URL with http: or https: scheme.'\n    );\n  }\n\n  let parsed: URL;\n  try {\n    parsed = new URL(cleaned);\n  } catch {\n    throw new Error(`redirectExternal() received an invalid URL: \"${url}\"`);\n  }\n\n  if (!SAFE_REDIRECT_SCHEMES.has(parsed.protocol)) {\n    throw new Error(\n      `redirectExternal() received a non-http(s) URL: \"${url}\". ` +\n        'Only http: and https: schemes are allowed for external redirects.'\n    );\n  }\n\n  if (!allowList.includes(parsed.origin)) {\n    throw new Error(\n      `redirectExternal() target \"${parsed.origin}\" is not in the allow-list. ` +\n        `Allowed: [${allowList.join(', ')}]`\n    );\n  }\n\n  return parsed.href;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,2BACd,YACA,eACA,UACQ;CACR,MAAM,gBAAgB,IAAI,gBAAgB,aAAa;CACvD,IAAI,cAAc,SAAS,GAAG,OAAO;CAIrC,MAAM,UAAU,WAAW,QAAQ,GAAG;CACtC,MAAM,kBAAkB,WAAW,IAAI,WAAW,MAAM,GAAG,OAAO,IAAI;CACtE,MAAM,OAAO,WAAW,IAAI,WAAW,MAAM,OAAO,IAAI;CAGxD,MAAM,OAAO,gBAAgB,QAAQ,GAAG;CACxC,MAAM,aAAa,QAAQ,IAAI,gBAAgB,MAAM,GAAG,IAAI,IAAI;CAChE,MAAM,eAAe,IAAI,gBAAgB,QAAQ,IAAI,gBAAgB,MAAM,OAAO,CAAC,IAAI,EAAE;CAGzF,MAAM,SAAS,IAAI,gBAAgB,YAAY;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,eAEzB,IAAI,CAAC,aAAa,IAAI,GAAG;MACnB,aAAa,QAAQ,SAAS,SAAS,GAAG,GAC5C,OAAO,OAAO,KAAK,KAAK;CAAA;CAK9B,MAAM,KAAK,OAAO,SAAS;CAE3B,QADsB,KAAK,GAAG,WAAW,GAAG,OAAO,cAC5B;AACzB;;;;;;;;;;;;;;;;;;;ACpCA,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,IAAI,IAAI;CAAC;CAAe;CAAS;AAAW,CAAC;;;;;AAMvE,SAAS,cAAc,MAA6B;CAClD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU;CAC7D,MAAM,QAAQ,yBAAyB,KAAK,OAAO;CACnD,OAAO,QAAQ,MAAM,GAAG,YAAY,IAAI;AAC1C;;;;;;;;;;AAWA,SAAgB,uBAAuB,MAAoB;CAOzD,IAHgB,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU,EAAE,WAAW,MAAM,GAG5E,EAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,uEAAuE,KAAK,mEAE9E;CAGF,MAAM,SAAS,cAAc,IAAI;CACjC,IAAI,UAAU,kBAAkB,IAAI,MAAM,GACxC,MAAM,IAAI,MACR,0CAA0C,KAAK,2DAEjD;AAEJ;;;;;;;AAQA,SAAgB,eAAe,MAAuB;CACpD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU,EAAE,WAAW,MAAM,GAAG;CAEnF,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,GAAG,OAAO;CAG1F,IADe,cAAc,IACzB,GAAQ,OAAO;CAEnB,OAAO;AACT;;AAGA,IAAM,kBAAkB;;;;;;;;;;;AAYxB,SAAgB,2BAA2B,MAAoB;CAC7D,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU,EAAE,WAAW,MAAM,GAAG;CAEnF,IAAI,gBAAgB,KAAK,OAAO,GAC9B,MAAM,IAAI,MACR,6DAA6D,KAAK,gEAEpE;AAEJ;AAEA,IAAM,wBAAwB,IAAI,IAAI,CAAC,SAAS,QAAQ,CAAC;;;;;;;;;;AAWzD,SAAgB,4BAA4B,KAAa,WAA6B;CAEpF,MAAM,UAAU,IAAI,QAAQ,kBAAkB,EAAE,EAAE,UAAU;CAE5D,IAAI,QAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,yDAAyD,IAAI,oDAE/D;CAGF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,OAAO;CAC1B,QAAQ;EACN,MAAM,IAAI,MAAM,gDAAgD,IAAI,EAAE;CACxE;CAEA,IAAI,CAAC,sBAAsB,IAAI,OAAO,QAAQ,GAC5C,MAAM,IAAI,MACR,mDAAmD,IAAI,qEAEzD;CAGF,IAAI,CAAC,UAAU,SAAS,OAAO,MAAM,GACnC,MAAM,IAAI,MACR,8BAA8B,OAAO,OAAO,wCAC7B,UAAU,KAAK,IAAI,EAAE,EACtC;CAGF,OAAO,OAAO;AAChB"}
+{"version":3,"file":"href-validation-FiA_rToW.js","names":[],"sources":["../../src/shared/merge-search-params.ts","../../src/shared/href-validation.ts"],"sourcesContent":["/**\n * Shared utility for merging preserved search params into a target URL.\n *\n * Used by both <Link> (client) and redirect() (server). Extracted to a shared\n * module to avoid importing client code ('use client') from server modules.\n */\n\n/**\n * Merge preserved search params from the current URL into a target href.\n *\n * When `preserve` is `true`, all current search params are merged.\n * When `preserve` is a `string[]`, only the named params are merged.\n *\n * The target href's own search params take precedence — preserved params\n * are only added if the target doesn't already define them.\n *\n * @param targetHref - The resolved target href (may already contain query string)\n * @param currentSearch - The current URL's search string (e.g. \"?private=access&page=2\")\n * @param preserve - `true` to preserve all, or `string[]` to preserve specific params\n * @returns The target href with preserved search params merged in\n */\nexport function mergePreservedSearchParams(\n  targetHref: string,\n  currentSearch: string,\n  preserve: true | string[]\n): string {\n  const currentParams = new URLSearchParams(currentSearch);\n  if (currentParams.size === 0) return targetHref;\n\n  // Split hash fragment from target before processing query params.\n  // Hash must come after query string: /path?query=value#hash\n  const hashIdx = targetHref.indexOf('#');\n  const hrefWithoutHash = hashIdx >= 0 ? targetHref.slice(0, hashIdx) : targetHref;\n  const hash = hashIdx >= 0 ? targetHref.slice(hashIdx) : '';\n\n  // Split target into path and existing query\n  const qIdx = hrefWithoutHash.indexOf('?');\n  const targetPath = qIdx >= 0 ? hrefWithoutHash.slice(0, qIdx) : hrefWithoutHash;\n  const targetParams = new URLSearchParams(qIdx >= 0 ? hrefWithoutHash.slice(qIdx + 1) : '');\n\n  // Collect params to preserve (that aren't already in the target)\n  const merged = new URLSearchParams(targetParams);\n  for (const [key, value] of currentParams) {\n    // Only preserve if: (a) not already in target, and (b) included in preserve list\n    if (!targetParams.has(key)) {\n      if (preserve === true || preserve.includes(key)) {\n        merged.append(key, value);\n      }\n    }\n  }\n\n  const qs = merged.toString();\n  const pathWithQuery = qs ? `${targetPath}?${qs}` : targetPath;\n  return pathWithQuery + hash;\n}\n","/**\n * Shared href/URL validation for all navigation sinks.\n *\n * Used by <Link>, useRouter().push/replace, and redirectExternal().\n * Single source of truth for dangerous-scheme detection — prevents\n * control-character smuggling that bypasses naive regex checks.\n *\n * See design/13-security.md §\"Link scheme injection\" (test #9)\n * and design/07-routing.md §\"<Link> Scheme Validation\".\n */\n\n/**\n * All C0 control characters (U+0000–U+001F) that browsers strip during\n * URL preprocessing. Browsers and `new URL()` strip the full C0 range,\n * not just tab/LF/CR — so we must match that behavior to prevent\n * bypass vectors like `\\x00javascript:alert(1)`.\n */\n// eslint-disable-next-line no-control-regex -- intentional: must match all C0 controls to prevent bypass\nconst CONTROL_CHARS_RE = /[\\x00-\\x1f]/g;\n\nconst DANGEROUS_SCHEMES = new Set(['javascript:', 'data:', 'vbscript:']);\n\n/**\n * Strip C0 control chars and leading whitespace, then extract the scheme.\n * Returns the lowercase scheme (e.g. \"javascript:\") or null if no scheme.\n */\nfunction extractScheme(href: string): string | null {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart();\n  const match = /^([a-z][a-z0-9+.-]*:)/i.exec(cleaned);\n  return match ? match[1].toLowerCase() : null;\n}\n\n/**\n * Validate an href for navigation sinks (<Link>, useRouter, etc.).\n *\n * Rejects dangerous schemes (javascript:, data:, vbscript:) even when\n * control characters are embedded to bypass naive regex checks.\n * Also rejects protocol-relative URLs (//evil.com).\n *\n * Throws on rejection. Safe hrefs pass through silently.\n */\nexport function validateNavigationHref(href: string): void {\n  // Normalize for validation: strip C0 controls, trim, then replace backslashes\n  // with forward slashes. Browsers normalize \\ → / during URL resolution, so\n  // \"/\\evil.com\" becomes \"//evil.com\" (protocol-relative open redirect).\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  // Protocol-relative URLs can redirect to attacker-controlled origins\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `Navigation received a protocol-relative or backslash-prefixed URL: \"${href}\". ` +\n        'Use an absolute URL with an explicit scheme or a relative path.'\n    );\n  }\n\n  const scheme = extractScheme(href);\n  if (scheme && DANGEROUS_SCHEMES.has(scheme)) {\n    throw new Error(\n      `Navigation received a dangerous href: \"${href}\". ` +\n        'javascript:, data:, and vbscript: URLs are not allowed.'\n    );\n  }\n}\n\n/**\n * Check if an href is internal (same-origin navigation) or external.\n *\n * Strips control characters before checking so that \"java\\tscript:\" is\n * correctly identified as having a scheme (and thus not internal).\n */\nexport function isInternalHref(href: string): boolean {\n  const cleaned = href.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  if (cleaned.startsWith('//')) return false;\n  if (cleaned.startsWith('/') || cleaned.startsWith('#') || cleaned.startsWith('?')) return true;\n\n  const scheme = extractScheme(href);\n  if (scheme) return false;\n\n  return true;\n}\n\n/** Pattern matching absolute URLs: any scheme (http:, javascript:, …) or protocol-relative // */\nconst ABSOLUTE_URL_RE = /^(?:[a-zA-Z][a-zA-Z\\d+\\-.]*:|\\/\\/)/;\n\n/**\n * Assert that a redirect target is a relative path — rejects absolute and\n * protocol-relative URLs. Used by both the server `redirect()` primitive and\n * the client next/navigation shim so they enforce identical semantics.\n *\n * Normalizes for validation only: strips C0 controls, trims, then replaces\n * backslashes with forward slashes. Browsers normalize \\ → / during URL\n * resolution, so \"/\\evil.com\" becomes \"//evil.com\" (protocol-relative open\n * redirect). See design/13-security.md tests #8, #8a–#8c.\n */\nexport function assertRelativeRedirectPath(path: string): void {\n  const cleaned = path.replace(CONTROL_CHARS_RE, '').trimStart().replaceAll('\\\\', '/');\n\n  if (ABSOLUTE_URL_RE.test(cleaned)) {\n    throw new Error(\n      `redirect() only accepts relative URLs. Got absolute URL: \"${path}\". ` +\n        'Use redirectExternal(url, allowList) for external redirects.'\n    );\n  }\n\n  // eslint-disable-next-line no-control-regex -- intentional: must match C0 controls\n  if (/[\\x00-\\x1f]/.test(path)) {\n    throw new Error(\n      `redirect() received a path containing control characters (U+0000–U+001F). ` +\n        'Sanitize user input before passing it to redirect().'\n    );\n  }\n}\n\nconst SAFE_REDIRECT_SCHEMES = new Set(['http:', 'https:']);\n\n/**\n * Validate and canonicalize an external redirect URL.\n *\n * Requires http: or https: scheme and checks origin against an allow-list.\n * Returns the parsed canonical URL string (from URL.href) to prevent\n * raw user input from reaching the Location header.\n *\n * @throws On invalid URL, dangerous scheme, or origin not in allow-list.\n */\nexport function validateExternalRedirectUrl(url: string, allowList: string[]): string {\n  // Strip control chars before parsing to prevent scheme smuggling\n  const cleaned = url.replace(CONTROL_CHARS_RE, '').trimStart();\n\n  if (cleaned.startsWith('//')) {\n    throw new Error(\n      `redirectExternal() received a protocol-relative URL: \"${url}\". ` +\n        'Use an absolute URL with http: or https: scheme.'\n    );\n  }\n\n  let parsed: URL;\n  try {\n    parsed = new URL(cleaned);\n  } catch {\n    throw new Error(`redirectExternal() received an invalid URL: \"${url}\"`);\n  }\n\n  if (!SAFE_REDIRECT_SCHEMES.has(parsed.protocol)) {\n    throw new Error(\n      `redirectExternal() received a non-http(s) URL: \"${url}\". ` +\n        'Only http: and https: schemes are allowed for external redirects.'\n    );\n  }\n\n  if (!allowList.includes(parsed.origin)) {\n    throw new Error(\n      `redirectExternal() target \"${parsed.origin}\" is not in the allow-list. ` +\n        `Allowed: [${allowList.join(', ')}]`\n    );\n  }\n\n  return parsed.href;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,2BACd,YACA,eACA,UACQ;CACR,MAAM,gBAAgB,IAAI,gBAAgB,aAAa;CACvD,IAAI,cAAc,SAAS,GAAG,OAAO;CAIrC,MAAM,UAAU,WAAW,QAAQ,GAAG;CACtC,MAAM,kBAAkB,WAAW,IAAI,WAAW,MAAM,GAAG,OAAO,IAAI;CACtE,MAAM,OAAO,WAAW,IAAI,WAAW,MAAM,OAAO,IAAI;CAGxD,MAAM,OAAO,gBAAgB,QAAQ,GAAG;CACxC,MAAM,aAAa,QAAQ,IAAI,gBAAgB,MAAM,GAAG,IAAI,IAAI;CAChE,MAAM,eAAe,IAAI,gBAAgB,QAAQ,IAAI,gBAAgB,MAAM,OAAO,CAAC,IAAI,EAAE;CAGzF,MAAM,SAAS,IAAI,gBAAgB,YAAY;CAC/C,KAAK,MAAM,CAAC,KAAK,UAAU,eAEzB,IAAI,CAAC,aAAa,IAAI,GAAG;MACnB,aAAa,QAAQ,SAAS,SAAS,GAAG,GAC5C,OAAO,OAAO,KAAK,KAAK;CAAA;CAK9B,MAAM,KAAK,OAAO,SAAS;CAE3B,QADsB,KAAK,GAAG,WAAW,GAAG,OAAO,cAC5B;AACzB;;;;;;;;;;;;;;;;;;;ACpCA,IAAM,mBAAmB;AAEzB,IAAM,oBAAoB,IAAI,IAAI;CAAC;CAAe;CAAS;AAAW,CAAC;;;;;AAMvE,SAAS,cAAc,MAA6B;CAClD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU;CAC7D,MAAM,QAAQ,yBAAyB,KAAK,OAAO;CACnD,OAAO,QAAQ,MAAM,GAAG,YAAY,IAAI;AAC1C;;;;;;;;;;AAWA,SAAgB,uBAAuB,MAAoB;CAOzD,IAHgB,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU,EAAE,WAAW,MAAM,GAG5E,EAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,uEAAuE,KAAK,mEAE9E;CAGF,MAAM,SAAS,cAAc,IAAI;CACjC,IAAI,UAAU,kBAAkB,IAAI,MAAM,GACxC,MAAM,IAAI,MACR,0CAA0C,KAAK,2DAEjD;AAEJ;;;;;;;AAQA,SAAgB,eAAe,MAAuB;CACpD,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU,EAAE,WAAW,MAAM,GAAG;CAEnF,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,IAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,GAAG,OAAO;CAG1F,IADe,cAAc,IACzB,GAAQ,OAAO;CAEnB,OAAO;AACT;;AAGA,IAAM,kBAAkB;;;;;;;;;;;AAYxB,SAAgB,2BAA2B,MAAoB;CAC7D,MAAM,UAAU,KAAK,QAAQ,kBAAkB,EAAE,EAAE,UAAU,EAAE,WAAW,MAAM,GAAG;CAEnF,IAAI,gBAAgB,KAAK,OAAO,GAC9B,MAAM,IAAI,MACR,6DAA6D,KAAK,gEAEpE;CAIF,IAAI,cAAc,KAAK,IAAI,GACzB,MAAM,IAAI,MACR,gIAEF;AAEJ;AAEA,IAAM,wBAAwB,IAAI,IAAI,CAAC,SAAS,QAAQ,CAAC;;;;;;;;;;AAWzD,SAAgB,4BAA4B,KAAa,WAA6B;CAEpF,MAAM,UAAU,IAAI,QAAQ,kBAAkB,EAAE,EAAE,UAAU;CAE5D,IAAI,QAAQ,WAAW,IAAI,GACzB,MAAM,IAAI,MACR,yDAAyD,IAAI,oDAE/D;CAGF,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,OAAO;CAC1B,QAAQ;EACN,MAAM,IAAI,MAAM,gDAAgD,IAAI,EAAE;CACxE;CAEA,IAAI,CAAC,sBAAsB,IAAI,OAAO,QAAQ,GAC5C,MAAM,IAAI,MACR,mDAAmD,IAAI,qEAEzD;CAGF,IAAI,CAAC,UAAU,SAAS,OAAO,MAAM,GACnC,MAAM,IAAI,MACR,8BAA8B,OAAO,OAAO,wCAC7B,UAAU,KAAK,IAAI,EAAE,EACtC;CAGF,OAAO,OAAO;AAChB"}