@tschk/moonshine-router 0.4.0 → 0.4.4

package/README.md

@@ -1,22 +1,57 @@
 # `@tschk/moonshine-router`
 
-Renderer-neutral route graph and matcher. Optional React navigation helpers.
+Use the neutral subpaths without installing React:
+
+```ts
+import { createRouteGraph, matchRoutes } from "@tschk/moonshine-router/graph";
+import {
+  createMoonshineRouter,
+  splitLocation,
+} from "@tschk/moonshine-router/runtime";
+```
+
+The graph provides pattern matching, ambiguity detection, and precedence:
+`static > dynamic > optional > rest`. The browser runtime provides isolated
+location and history signals, push/replace navigation, and explicit browser
+history synchronization. Relative destinations resolve against the owning
+runtime's current location. Location signals contain pathname and query;
+fragments are passed to browser history. It does not fetch route data or mount
+page components.
+
+```ts
+const router = createMoonshineRouter();
+const output = document.querySelector("output")!;
+const update = () => {
+  output.textContent = router.getLocation();
+};
+const unsubscribe = router.location.subscribe(update);
+const sync = () => router.syncFromBrowser();
+window.addEventListener("popstate", sync);
+update();
+
+router.navigate("/counter?start=2", { state: { from: "home" } });
+
+// When this app is removed:
+unsubscribe();
+window.removeEventListener("popstate", sync);
+```
+
+The package root retains React navigation exports and requires React installed.
+Existing React imports remain supported:
 
 ```ts
-import { createRouteGraph, matchRoutes } from "@tschk/moonshine-router";
 import {
   MoonshineRouter,
   Link,
   useParams,
   useNavigate,
-} from "@tschk/moonshine/router";
+} from "@tschk/moonshine-router";
 ```
 
-Features:
-
-- Pattern compiler with static, dynamic, optional, and rest segments.
-- Route graph with ambiguity detection.
-- Match precedence: `static > dynamic > optional > rest`.
-- `MoonshineRouter`, `Link`, `useParams`, `useNavigate`, `useLocation`.
-
 See [docs/ROUTING.md](../../docs/ROUTING.md).
+
+Each router runtime owns a `fragment` signal containing its current hash,
+including `#`. Navigation and browser synchronization update it alongside
+history and location. `getLocation()` and `location` retain pathname plus query
+only. An explicit initial URL supplies its own fragment; the default runtime
+starts from the browser URL.

package/package.json

@@ -1,14 +1,19 @@
 {
   "name": "@tschk/moonshine-router",
-  "version": "0.4.0",
+  "version": "0.4.4",
   "description": "Renderer-neutral route graph and matcher with optional React navigation",
   "license": "ISC",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./src/index.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": "./src/index.ts",
+    "./graph": "./src/graph.ts",
+    "./runtime": "./src/runtime.ts"
   },
+  "files": [
+    "src"
+  ],
   "scripts": {
     "format": "bunx prettier --check .",
     "lint": "bunx oxlint .",
@@ -16,8 +21,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@tschk/moonshine": "^0.3.6",
-    "@tschk/moonshine-framework": "^0.3.6"
+    "@tschk/moonshine": "^0.4.4",
+    "@tschk/moonshine-framework": "^0.4.4"
   },
   "devDependencies": {
     "@types/bun": "1.3.14",

package/src/index.ts

@@ -11,10 +11,10 @@ export { createRouteGraph, matchRoutes } from "./graph.js";
 export type { RouteGraph, RouteMatch } from "./graph.js";
 
 export {
-  createMoonshineRouter,
   navigate,
   getLocation,
   useLocation,
+  useHistory,
   useParams,
   useNavigate,
   useRouter,
@@ -24,7 +24,9 @@ export {
   safeHref,
 } from "./navigation.js";
 export type {
-  MoonshineRouterInstance,
   MoonshineRouterProps,
   MoonshineRouteDefinition,
 } from "./navigation.js";
+
+export { createMoonshineRouter, splitLocation } from "./runtime.js";
+export type { MoonshineRouterInstance, HistorySnapshot } from "./runtime.js";

package/src/navigation.ts

@@ -1,4 +1,3 @@
-import { createSignal, type Signal } from "@tschk/moonshine";
 import {
   createContext,
   createElement,
@@ -12,86 +11,35 @@ import {
 import { type RouteDefinition } from "@tschk/moonshine-framework";
 import { createRouteGraph, matchRoutes, type RouteMatch } from "./graph.js";
 
-export type RouteParams = Record<string, string>;
-
-/**
- * The location the signal carries: pathname plus query.
- *
- * The query has to be in the signal, not read off `window.location` at render
- * time. A navigation that changes only the query would otherwise write the
- * same pathname back, notify no subscriber, and leave every `useSearchParams`
- * caller rendering the previous query — a tab bar driven by `?section=` would
- * change the URL and not the page. The hash stays out: it is still pushed to
- * history, but these hooks do not read it and including it would corrupt the
- * query when consumers split on the first "?".
- */
-function getBrowserPath(): string {
-  if (typeof window === "undefined") return "/";
-  return (window.location.pathname || "/") + window.location.search;
-}
-
-/** Splits `"/a/b?x=1"` into its pathname and its raw query string. */
-export function splitLocation(location: string): [string, string] {
-  const index = location.indexOf("?");
-  return index === -1
-    ? [location, ""]
-    : [location.slice(0, index), location.slice(index + 1)];
-}
+import {
+  createMoonshineRouter,
+  getBrowserPath,
+  splitLocation,
+  type HistorySnapshot,
+  type MoonshineRouterInstance,
+} from "./runtime.js";
 
-export type MoonshineRouterInstance = {
-  /** Navigate via History API (no full reload). */
-  navigate: (to: string, options?: { replace?: boolean }) => void;
-  /** Current pathname and query (reactive signal). */
-  getLocation: () => string;
-  /** Subscribe-friendly location signal, carrying pathname and query. */
-  location: Signal<string>;
-  /** Sync signal from `window.location`. */
-  syncFromBrowser: () => void;
-};
+export type RouteParams = Record<string, string>;
 
-/** Create an isolated router runtime (no shared global path). */
-export function createMoonshineRouter(
-  initialPath = getBrowserPath(),
-): MoonshineRouterInstance {
-  const location = createSignal(initialPath);
+export { createMoonshineRouter, splitLocation } from "./runtime.js";
+export type { MoonshineRouterInstance } from "./runtime.js";
 
-  const syncFromBrowser = () => {
-    location.set(getBrowserPath());
-  };
+const INITIAL_HISTORY: HistorySnapshot = { action: "POP", state: null };
 
-  const navigate = (to: string, options?: { replace?: boolean }) => {
-    if (typeof window === "undefined") {
-      location.set(to);
-      return;
-    }
-    const url = new URL(to, window.location.origin);
-    if (options?.replace) {
-      window.history.replaceState({}, "", url.pathname + url.search + url.hash);
-    } else {
-      window.history.pushState({}, "", url.pathname + url.search + url.hash);
-    }
-    location.set(url.pathname + url.search);
-  };
-
-  return {
-    navigate,
-    getLocation: () => location(),
-    location,
-    syncFromBrowser,
-  };
-}
-
-/** Active mounted router for module-level navigate/getLocation. */
-let activeRouter: MoonshineRouterInstance | null = null;
+/** Mount tokens keep module-level navigation valid regardless of unmount order. */
+const mountedRouters: Array<{ runtime: MoonshineRouterInstance }> = [];
 /** Fallback when nothing mounted (tests / early navigate). */
 const fallbackRouter = createMoonshineRouter();
 
 function currentRouter(): MoonshineRouterInstance {
-  return activeRouter ?? fallbackRouter;
+  return mountedRouters.at(-1)?.runtime ?? fallbackRouter;
 }
 
 /** Navigate via History API (targets active mounted router). */
-export function navigate(to: string, options?: { replace?: boolean }): void {
+export function navigate(
+  to: string,
+  options?: { replace?: boolean; state?: unknown },
+): void {
   currentRouter().navigate(to, options);
 }
 
@@ -106,7 +54,18 @@ export function useLocation(): string {
   return useSyncExternalStore(
     source.subscribe,
     () => source.peek(),
-    () => "/",
+    () => ctx?.runtime.location.peek() ?? "/",
+  );
+}
+
+/** Read scoped history without leaking process-level fallback state into SSR. */
+export function useHistory(): HistorySnapshot {
+  const ctx = useContext(RouterContext);
+  const source = ctx?.runtime.history ?? fallbackRouter.history;
+  return useSyncExternalStore(
+    source.subscribe,
+    source.peek,
+    () => ctx?.runtime.history.peek() ?? INITIAL_HISTORY,
   );
 }
 
@@ -195,20 +154,22 @@ export function MoonshineRouter(props: MoonshineRouterProps): ReactNode {
   );
 
   useEffect(() => {
-    const prev = activeRouter;
-    activeRouter = runtime;
+    const mounted = { runtime };
+    mountedRouters.push(mounted);
+    const deactivate = () => {
+      const index = mountedRouters.indexOf(mounted);
+      if (index !== -1) mountedRouters.splice(index, 1);
+    };
     if (props.path === undefined) {
       runtime.syncFromBrowser();
       const onPop = () => runtime.syncFromBrowser();
       window.addEventListener("popstate", onPop);
       return () => {
         window.removeEventListener("popstate", onPop);
-        activeRouter = prev;
+        deactivate();
       };
     }
-    return () => {
-      activeRouter = prev;
-    };
+    return deactivate;
   }, [runtime, props.path]);
 
   const matched = matchRoutes<InternalRoute>(graph, pathname);
@@ -263,7 +224,8 @@ export function safeHref(href: string): string {
  * carrying a scheme (`https:`, `mailto:`, `tel:`), a protocol-relative `//host`,
  * a bare fragment, or an explicit non-`_self` target belongs to the browser: it
  * opens a mail client, a new tab, or another origin, none of which this router
- * can do.
+ * can do. A present `download` attribute also belongs to the browser; null
+ * and false match React's omitted-attribute behavior.
  *
  * `safeHref` deliberately allows those schemes through — it only strips ones
  * that could execute. Allowing a scheme is not the same as claiming to handle
@@ -276,7 +238,12 @@ export function safeHref(href: string): string {
  * a copy — three of them already did, byte for byte, and the copy this module
  * lacked is exactly the one that was wrong.
  */
-export function isExternal(href: string, target?: string): boolean {
+export function isExternal(
+  href: string,
+  target?: string,
+  download?: unknown,
+): boolean {
+  if (download != null && download !== false) return true;
   if (target && target !== "_self") return true;
   return (
     /^[a-zA-Z][a-zA-Z\d+\-.]*:/.test(href) ||

package/src/pattern.ts

@@ -44,9 +44,12 @@ function decodePart(part: string): string | null {
   }
 }
 
-export function compilePattern(pattern: string): CompiledPattern {
-  const raw = pattern.replace(/\/+$/, "").replace(/^\/+/, "");
-  const parts = raw === "" ? [] : raw.split("/").filter(Boolean);
+function parsePattern(pattern: string): {
+  segments: Segment[];
+  precedence: number[];
+  normalized: string;
+} {
+  const parts = splitPath(pattern);
   const segments: Segment[] = [];
   const precedence: number[] = [];
   let normalized = "";
@@ -75,113 +78,123 @@ export function compilePattern(pattern: string): CompiledPattern {
     normalized = "/";
   }
 
-  let pathParts: string[] = [];
-
-  /**
-   * Decodes the tail a `*rest` segment captures.
-   *
-   * Per part, not on the joined string. Decoding after the join lets an encoded
-   * separator smuggle structure past the router: `/files/%2e%2e%2fsecret` used
-   * to arrive as `path: "../secret"`, and a handler doing the obvious
-   * `join(dir, params.path)` then read outside its directory. `a%2Fb` and `a/b`
-   * were likewise indistinguishable. Same rules the static server already
-   * applies in `resolveStaticPath`, so the two agree about what a path segment
-   * may contain.
-   */
-  const decodeRest = (parts: readonly string[]): string | null => {
-    const decoded: string[] = [];
-    for (const part of parts) {
-      const d = decodePart(part);
-      if (
-        d === null ||
-        d === "." ||
-        d === ".." ||
-        d.includes("\0") ||
-        d.includes("/")
-      ) {
-        return null;
-      }
-      decoded.push(d);
+  return { segments, precedence, normalized };
+}
+
+/**
+ * Decodes the tail a `*rest` segment captures.
+ *
+ * Per part, not on the joined string. Decoding after the join lets an encoded
+ * separator smuggle structure past the router: `/files/%2e%2e%2fsecret` used
+ * to arrive as `path: "../secret"`, and a handler doing the obvious
+ * `join(dir, params.path)` then read outside its directory. `a%2Fb` and `a/b`
+ * were likewise indistinguishable. Same rules the static server already
+ * applies in `resolveStaticPath`, so the two agree about what a path segment
+ * may contain.
+ */
+function decodeRest(parts: readonly string[]): string | null {
+  const decoded: string[] = [];
+  for (const part of parts) {
+    const d = decodePart(part);
+    if (
+      d === null ||
+      d === "." ||
+      d === ".." ||
+      d.includes("\0") ||
+      d.includes("/")
+    ) {
+      return null;
     }
-    return decoded.join("/");
+    decoded.push(d);
+  }
+  return decoded.join("/");
+}
+
+function withHead(
+  rest: MatchResult,
+  points: number,
+  binding?: [string, string],
+): MatchResult {
+  return {
+    params: binding
+      ? { [binding[0]]: binding[1], ...rest.params }
+      : rest.params,
+    score: [points, ...rest.score],
   };
+}
 
-  /**
-   * Matches `segments` from `si` against `pathParts` from `pi`.
-   *
-   * Recursive because an optional segment has to be able to give its part back.
-   * The old linear pass consumed a part whenever one was present, so
-   * `/:lang?/about` matched `/en/about` and then failed `/about` — the i18n
-   * prefix route 404ing on its own default locale, silently, because a failed
-   * match is indistinguishable from no route. Consuming is tried first so the
-   * greedy reading still wins where both work.
-   */
-  const matchFrom = (si: number, pi: number): MatchResult | null => {
-    if (si === segments.length) {
-      return pi === pathParts.length ? { params: {}, score: [] } : null;
-    }
+/**
+ * Matches `segments` from `si` against `pathParts` from `pi`.
+ *
+ * Recursive because an optional segment has to be able to give its part back.
+ * The old linear pass consumed a part whenever one was present, so
+ * `/:lang?/about` matched `/en/about` and then failed `/about` — the i18n
+ * prefix route 404ing on its own default locale, silently, because a failed
+ * match is indistinguishable from no route. Consuming is tried first so the
+ * greedy reading still wins where both work.
+ */
+function matchSegments(
+  segments: readonly Segment[],
+  pathParts: readonly string[],
+  si: number = 0,
+  pi: number = 0,
+): MatchResult | null {
+  if (si === segments.length) {
+    return pi === pathParts.length ? { params: {}, score: [] } : null;
+  }
 
-    const segment = segments[si];
-    const part = pathParts[pi];
-
-    const withHead = (
-      rest: MatchResult,
-      points: number,
-      binding?: [string, string],
-    ): MatchResult => ({
-      params: binding
-        ? { [binding[0]]: binding[1], ...rest.params }
-        : rest.params,
-      score: [points, ...rest.score],
-    });
-
-    if (segment.kind === "rest") {
-      const value = decodeRest(pathParts.slice(pi));
-      if (value === null) return null;
-      const rest = matchFrom(si + 1, pathParts.length);
-      return (
-        rest && withHead(rest, SEGMENT_PRECEDENCE.rest, [segment.name, value])
-      );
-    }
+  const segment = segments[si];
+  const part = pathParts[pi];
 
-    if (segment.kind === "static") {
-      if (part === undefined) return null;
-      const decoded = decodePart(part);
-      if (decoded === null || decoded !== segment.value) return null;
-      const rest = matchFrom(si + 1, pi + 1);
-      return rest && withHead(rest, SEGMENT_PRECEDENCE.static);
-    }
+  if (segment.kind === "rest") {
+    const value = decodeRest(pathParts.slice(pi));
+    if (value === null) return null;
+    const rest = matchSegments(segments, pathParts, si + 1, pathParts.length);
+    return (
+      rest && withHead(rest, SEGMENT_PRECEDENCE.rest, [segment.name, value])
+    );
+  }
 
-    if (segment.kind === "dynamic") {
-      if (part === undefined) return null;
-      const decoded = decodePart(part);
-      if (decoded === null) return null;
-      const rest = matchFrom(si + 1, pi + 1);
-      return (
-        rest &&
-        withHead(rest, SEGMENT_PRECEDENCE.dynamic, [segment.name, decoded])
-      );
-    }
+  if (segment.kind === "static") {
+    if (part === undefined) return null;
+    const decoded = decodePart(part);
+    if (decoded === null || decoded !== segment.value) return null;
+    const rest = matchSegments(segments, pathParts, si + 1, pi + 1);
+    return rest && withHead(rest, SEGMENT_PRECEDENCE.static);
+  }
+
+  if (segment.kind === "dynamic") {
+    if (part === undefined) return null;
+    const decoded = decodePart(part);
+    if (decoded === null) return null;
+    const rest = matchSegments(segments, pathParts, si + 1, pi + 1);
+    return (
+      rest &&
+      withHead(rest, SEGMENT_PRECEDENCE.dynamic, [segment.name, decoded])
+    );
+  }
 
-    // optional: consume first, then fall back to skipping.
-    if (part !== undefined) {
-      const decoded = decodePart(part);
-      if (decoded !== null) {
-        const rest = matchFrom(si + 1, pi + 1);
-        if (rest)
-          return withHead(rest, SEGMENT_PRECEDENCE.optional, [
-            segment.name,
-            decoded,
-          ]);
-      }
+  // optional: consume first, then fall back to skipping.
+  if (part !== undefined) {
+    const decoded = decodePart(part);
+    if (decoded !== null) {
+      const rest = matchSegments(segments, pathParts, si + 1, pi + 1);
+      if (rest)
+        return withHead(rest, SEGMENT_PRECEDENCE.optional, [
+          segment.name,
+          decoded,
+        ]);
     }
-    const skipped = matchFrom(si + 1, pi);
-    return skipped && withHead(skipped, 0);
-  };
+  }
+  const skipped = matchSegments(segments, pathParts, si + 1, pi);
+  return skipped && withHead(skipped, 0);
+}
+
+export function compilePattern(pattern: string): CompiledPattern {
+  const { segments, precedence, normalized } = parsePattern(pattern);
 
   const match = (pathname: string): MatchResult | null => {
-    pathParts = splitPath(pathname);
-    return matchFrom(0, 0);
+    return matchSegments(segments, splitPath(pathname));
   };
 
   return { pattern, segments, precedence, normalized, match };

package/src/runtime.ts

@@ -0,0 +1,108 @@
+import { batch, createSignal, type Signal } from "@tschk/moonshine";
+
+/**
+ * The location the signal carries: pathname plus query.
+ *
+ * The query has to be in the signal, not read off `window.location` at render
+ * time. A navigation that changes only the query would otherwise write the
+ * same pathname back, notify no subscriber, and leave every `useSearchParams`
+ * caller rendering the previous query — a tab bar driven by `?section=` would
+ * change the URL and not the page. The hash stays out: it is still pushed to
+ * history and retained in its own fragment signal; including it here would
+ * corrupt the query when consumers split on the first "?".
+ */
+export function getBrowserPath(): string {
+  if (typeof window === "undefined") return "/";
+  return (window.location.pathname || "/") + window.location.search;
+}
+
+/** Splits `"/a/b?x=1"` into its pathname and its raw query string. */
+export function splitLocation(location: string): [string, string] {
+  const index = location.indexOf("?");
+  return index === -1
+    ? [location, ""]
+    : [location.slice(0, index), location.slice(index + 1)];
+}
+
+export type HistorySnapshot = {
+  action: "POP" | "PUSH" | "REPLACE";
+  state: unknown;
+};
+
+export type MoonshineRouterInstance = {
+  /** Navigate via History API (no full reload). */
+  navigate: (
+    to: string,
+    options?: { replace?: boolean; state?: unknown },
+  ) => void;
+  /** Current pathname and query (reactive signal). */
+  getLocation: () => string;
+  /** Subscribe-friendly location signal, carrying pathname and query. */
+  location: Signal<string>;
+  /** Reactive history metadata, including same-path state-only navigation. */
+  history: Signal<HistorySnapshot>;
+  /** Current fragment including #, independently owned from path/query. */
+  fragment: Signal<string>;
+  /** Sync signals from browser location and history (a POP navigation). */
+  syncFromBrowser: () => void;
+};
+
+/** Create an isolated router runtime (no shared global path). */
+export function createMoonshineRouter(
+  initialPath = getBrowserPath() +
+    (typeof window === "undefined" ? "" : window.location.hash),
+): MoonshineRouterInstance {
+  const origin =
+    typeof window === "undefined"
+      ? "http://moonshine.invalid"
+      : window.location.origin;
+  const initial = new URL(initialPath, origin);
+  const location = createSignal(initial.pathname + initial.search);
+  const fragment = createSignal(initial.hash);
+  const history = createSignal<{
+    action: "POP" | "PUSH" | "REPLACE";
+    state: unknown;
+  }>({
+    action: "POP",
+    state: typeof window === "undefined" ? null : window.history.state,
+  });
+
+  const syncFromBrowser = () => {
+    batch(() => {
+      history.set({
+        action: "POP",
+        state: typeof window === "undefined" ? null : window.history.state,
+      });
+      location.set(getBrowserPath());
+      fragment.set(typeof window === "undefined" ? "" : window.location.hash);
+    });
+  };
+
+  const navigate = (
+    to: string,
+    options?: { replace?: boolean; state?: unknown },
+  ) => {
+    const url = new URL(to, new URL(location.peek(), origin));
+    const nextLocation = url.pathname + url.search;
+    const state = options?.state ?? null;
+    if (typeof window !== "undefined") {
+      const href = url.pathname + url.search + url.hash;
+      if (options?.replace) window.history.replaceState(state, "", href);
+      else window.history.pushState(state, "", href);
+    }
+    batch(() => {
+      history.set({ action: options?.replace ? "REPLACE" : "PUSH", state });
+      location.set(nextLocation);
+      fragment.set(url.hash);
+    });
+  };
+
+  return {
+    navigate,
+    getLocation: () => location(),
+    location,
+    history,
+    fragment,
+    syncFromBrowser,
+  };
+}

package/test/dom.ts

@@ -1,109 +0,0 @@
-import { GlobalRegistrator } from "@happy-dom/global-registrator";
-import { act } from "react";
-import { createRoot } from "react-dom/client";
-import type { ReactNode } from "react";
-
-/**
- * `bun test` shares one process across files, so registering happy-dom leaks
- * its browser implementations into every other suite: its `Request` strips
- * forbidden headers like `Cookie`, and its streams are not the ones SSR
- * renderers write to. Keep the DOM, put Bun's platform globals back.
- */
-const keepNative = [
-  "Request",
-  "Response",
-  "Headers",
-  "fetch",
-  "ReadableStream",
-  "WritableStream",
-  "TransformStream",
-  "TextEncoder",
-  "TextDecoder",
-  "AbortController",
-  "AbortSignal",
-  "Blob",
-  "FormData",
-  "URL",
-  "URLSearchParams",
-  "setTimeout",
-  "clearTimeout",
-  "setInterval",
-  "clearInterval",
-  "queueMicrotask",
-] as const;
-
-if (!("happyDOM" in globalThis)) {
-  const scope = globalThis as unknown as Record<string, unknown>;
-  const native = Object.fromEntries(keepNative.map((key) => [key, scope[key]]));
-  GlobalRegistrator.register({ url: "https://example.com/start" });
-  Object.assign(scope, native);
-}
-
-(
-  globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }
-).IS_REACT_ACT_ENVIRONMENT = true;
-
-const mounted: { unmount(): void }[] = [];
-
-/** Mounts `element` into a fresh detached container and flushes effects. */
-export async function render(element: ReactNode): Promise<HTMLElement> {
-  const container = document.createElement("div");
-  document.body.append(container);
-  const root = createRoot(container);
-  mounted.push(root);
-  await act(async () => {
-    root.render(element);
-  });
-  return container;
-}
-
-/**
- * Unmounts every root from the current test. Without this, trees left
- * subscribed to the router signal re-render on the next test's navigation.
- */
-export async function cleanup(): Promise<void> {
-  await act(async () => {
-    for (const root of mounted.splice(0)) root.unmount();
-  });
-  document.body.replaceChildren();
-}
-
-/**
- * Dispatches a real bubbling click so React's root listener runs, and reports
- * whether the handler claimed the event.
- *
- * A document-level guard records `defaultPrevented` and then cancels the event
- * regardless, so happy-dom does not follow un-intercepted anchors and leave the
- * document on a URL later tests cannot navigate from.
- */
-export async function click(
-  node: Element,
-  init: MouseEventInit = {},
-): Promise<{ defaultPrevented: boolean }> {
-  let defaultPrevented = false;
-  const guard = (event: Event): void => {
-    defaultPrevented = event.defaultPrevented;
-    event.preventDefault();
-  };
-  document.addEventListener("click", guard);
-  try {
-    await act(async () => {
-      node.dispatchEvent(
-        new MouseEvent("click", {
-          bubbles: true,
-          cancelable: true,
-          button: 0,
-          ...init,
-        }),
-      );
-    });
-  } finally {
-    document.removeEventListener("click", guard);
-  }
-  return { defaultPrevented };
-}
-
-/** Resets the document location between navigation assertions. */
-export function setLocation(url: string): void {
-  window.history.replaceState({}, "", new URL(url, "https://example.com").href);
-}

package/test/graph.test.ts

@@ -1,23 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { createRouteGraph, matchRoutes } from "../src/graph";
-
-describe("createRouteGraph", () => {
-  test("static beats dynamic beats rest", () => {
-    const graph = createRouteGraph([
-      { id: "rest", path: "/blog/*rest", file: "rest.tsx" },
-      { id: "slug", path: "/blog/:slug", file: "slug.tsx" },
-      { id: "new", path: "/blog/new", file: "new.tsx" },
-    ]);
-    expect(matchRoutes(graph, "/blog/new")?.route.id).toBe("new");
-    expect(matchRoutes(graph, "/blog/post")?.params).toEqual({ slug: "post" });
-  });
-
-  test("throws for ambiguous routes", () => {
-    expect(() =>
-      createRouteGraph([
-        { id: "a", path: "/users/:param", file: "a.tsx" },
-        { id: "b", path: "/users/:id", file: "b.tsx" },
-      ]),
-    ).toThrow(/Ambiguous routes "a" and "b" both match \/users\/:param/);
-  });
-});

package/test/link.test.tsx

@@ -1,94 +0,0 @@
-import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { createElement } from "react";
-import { renderToStaticMarkup } from "react-dom/server";
-import { isExternal, Link, safeHref } from "../src/navigation";
-import { click, render, setLocation, cleanup } from "./dom";
-
-function hrefOf(href: string): string {
-  const html = renderToStaticMarkup(createElement(Link, { href }, "go"));
-  return /href="([^"]*)"/.exec(html)?.[1] ?? "";
-}
-
-describe("safeHref", () => {
-  test("neutralizes script-bearing schemes", () => {
-    expect(safeHref("javascript:alert(1)")).toBe("#");
-    expect(safeHref("JavaScript:alert(1)")).toBe("#");
-    expect(safeHref("  javascript:alert(1)")).toBe("#");
-    expect(safeHref("java\tscript:alert(1)")).toBe("#");
-    expect(safeHref("data:text/html,<script>alert(1)</script>")).toBe("#");
-    expect(safeHref("vbscript:msgbox(1)")).toBe("#");
-    expect(safeHref("")).toBe("#");
-  });
-
-  test("preserves relative and known-safe absolute targets", () => {
-    expect(safeHref("/users/1")).toBe("/users/1");
-    expect(safeHref("users/1")).toBe("users/1");
-    expect(safeHref("?q=1")).toBe("?q=1");
-    expect(safeHref("#anchor")).toBe("#anchor");
-    expect(safeHref("//example.com/x")).toBe("//example.com/x");
-    expect(safeHref("https://example.com/x")).toBe("https://example.com/x");
-    expect(safeHref("mailto:a@b.c")).toBe("mailto:a@b.c");
-  });
-});
-
-describe("Link", () => {
-  test("does not render a script-bearing href", () => {
-    expect(hrefOf("javascript:alert(1)")).toBe("#");
-    expect(hrefOf("/ok")).toBe("/ok");
-  });
-});
-
-describe("isExternal", () => {
-  test("a scheme, a protocol-relative host, a fragment or a target is the browser's", () => {
-    expect(isExternal("https://github.com/me")).toBe(true);
-    expect(isExternal("mailto:me@example.com")).toBe(true);
-    expect(isExternal("tel:+15551234")).toBe(true);
-    expect(isExternal("//cdn.example.com/x")).toBe(true);
-    expect(isExternal("#section")).toBe(true);
-    expect(isExternal("/about", "_blank")).toBe(true);
-  });
-
-  test("a same-document path is the router's", () => {
-    expect(isExternal("/about")).toBe(false);
-    expect(isExternal("/about", "_self")).toBe(false);
-    expect(isExternal("/a?b=1")).toBe(false);
-  });
-});
-
-describe("Link and external targets", () => {
-  // The regression: safeHref *allows* https/mailto/tel — it only strips schemes
-  // that could execute — and Link took that as permission to intercept them.
-  // preventDefault ran, navigate rebuilt the URL against the current origin, and
-  // `https://github.com/me` became a push to `/me` on this app. The href looked
-  // correct the whole time, so it only surfaced as a 404 on click.
-  afterEach(cleanup);
-  beforeEach(() => setLocation("/start"));
-
-  async function clicked(href: string, target?: string) {
-    const container = await render(createElement(Link, { href, target }, "go"));
-    const node = container.querySelector("a");
-    if (!node) throw new Error("Link did not render an anchor");
-    return click(node);
-  }
-
-  test("leaves an external URL to the browser", async () => {
-    expect((await clicked("https://github.com/me")).defaultPrevented).toBe(
-      false,
-    );
-  });
-
-  test("leaves mailto and tel to the browser", async () => {
-    expect((await clicked("mailto:me@example.com")).defaultPrevented).toBe(
-      false,
-    );
-    expect((await clicked("tel:+15551234")).defaultPrevented).toBe(false);
-  });
-
-  test("leaves an explicit target to the browser", async () => {
-    expect((await clicked("/about", "_blank")).defaultPrevented).toBe(false);
-  });
-
-  test("still intercepts a same-document path", async () => {
-    expect((await clicked("/about")).defaultPrevented).toBe(true);
-  });
-});

package/test/navigation.test.ts

@@ -1,76 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { splitLocation, safeHref, isExternal } from "../src/navigation";
-
-describe("splitLocation", () => {
-  test("splits path and query", () => {
-    expect(splitLocation("/path?query=1")).toEqual(["/path", "query=1"]);
-  });
-  test("handles no query string", () => {
-    expect(splitLocation("/path")).toEqual(["/path", ""]);
-  });
-  test("handles empty string", () => {
-    expect(splitLocation("")).toEqual(["", ""]);
-  });
-  test("handles query string only", () => {
-    expect(splitLocation("?query=1")).toEqual(["", "query=1"]);
-  });
-  test("handles multiple question marks by splitting on the first", () => {
-    expect(splitLocation("/path?query=1?other=2")).toEqual([
-      "/path",
-      "query=1?other=2",
-    ]);
-  });
-});
-
-describe("safeHref", () => {
-  test("allows safe schemes", () => {
-    expect(safeHref("http://example.com")).toBe("http://example.com");
-    expect(safeHref("https://example.com")).toBe("https://example.com");
-    expect(safeHref("mailto:user@example.com")).toBe("mailto:user@example.com");
-    expect(safeHref("tel:+1234567890")).toBe("tel:+1234567890");
-    expect(safeHref("ftp://example.com")).toBe("ftp://example.com");
-  });
-  test("allows relative paths", () => {
-    expect(safeHref("/path")).toBe("/path");
-    expect(safeHref("?query=1")).toBe("?query=1");
-    expect(safeHref("#hash")).toBe("#hash");
-    expect(safeHref("path")).toBe("path");
-  });
-  test("rewrites unsafe schemes to #", () => {
-    expect(safeHref("javascript:alert(1)")).toBe("#");
-    expect(safeHref("vbscript:msgbox(1)")).toBe("#");
-    expect(safeHref("data:text/html,<h1>hello</h1>")).toBe("#");
-  });
-  test("strips control characters to prevent evasion", () => {
-    expect(safeHref("java\x09script:alert(1)")).toBe("#");
-    expect(safeHref("java\nscript:alert(1)")).toBe("#");
-  });
-  test("handles empty string and spaces", () => {
-    expect(safeHref("")).toBe("#");
-    expect(safeHref("   ")).toBe("#");
-  });
-});
-
-describe("isExternal", () => {
-  test("identifies scheme-bearing URLs as external", () => {
-    expect(isExternal("http://example.com")).toBe(true);
-    expect(isExternal("https://example.com")).toBe(true);
-    expect(isExternal("mailto:test@test.com")).toBe(true);
-  });
-  test("identifies protocol-relative URLs as external", () => {
-    expect(isExternal("//example.com")).toBe(true);
-  });
-  test("identifies hash-only URLs as external (browser handles them)", () => {
-    expect(isExternal("#section")).toBe(true);
-  });
-  test("identifies target other than _self as external", () => {
-    expect(isExternal("/path", "_blank")).toBe(true);
-    expect(isExternal("/path", "_parent")).toBe(true);
-  });
-  test("identifies same-document relative paths as internal", () => {
-    expect(isExternal("/path")).toBe(false);
-    expect(isExternal("path")).toBe(false);
-    expect(isExternal("/path?query=1")).toBe(false);
-    expect(isExternal("/path", "_self")).toBe(false);
-  });
-});

package/test/pattern.test.ts

@@ -1,114 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { compilePattern, matchPath } from "../src/pattern";
-
-describe("compilePattern", () => {
-  test("static matches exact", () => {
-    const p = compilePattern("/about");
-    expect(p.match("/about")?.params).toEqual({});
-    expect(p.match("/other")).toBeNull();
-  });
-
-  test("dynamic captures a parameter", () => {
-    const p = compilePattern("/users/:id");
-    const m = p.match("/users/42");
-    expect(m?.params).toEqual({ id: "42" });
-    expect(m?.score).toEqual([3, 2]);
-  });
-
-  test("optional segment may be omitted", () => {
-    const p = compilePattern("/:tab?");
-    expect(p.match("/")?.params).toEqual({});
-    expect(p.match("/profile")?.params).toEqual({ tab: "profile" });
-  });
-
-  test("rest captures the remainder", () => {
-    const p = compilePattern("/blog/*rest");
-    const m = p.match("/blog/a/b");
-    expect(m?.params).toEqual({ rest: "a/b" });
-    expect(m?.score).toEqual([3, 0]);
-  });
-
-  test("decodes parameter values", () => {
-    const p = compilePattern("/users/:id");
-    expect(p.match("/users/bob%20smith")?.params.id).toBe("bob smith");
-  });
-
-  test("malformed encoding returns no match", () => {
-    const p = compilePattern("/users/:id");
-    expect(p.match("/users/bob%ZZ")).toBeNull();
-  });
-
-  test("precedence reflects segment kind", () => {
-    const p = compilePattern("/blog/:slug?");
-    expect(p.precedence).toEqual([3, 1]);
-  });
-});
-
-describe("matchPath", () => {
-  test("returns a match object", () => {
-    const m = matchPath("/users/:id", "/users/7");
-    expect(m).not.toBeNull();
-    expect(m!.params.id).toBe("7");
-    expect(m!.pattern).toBe("/users/:id");
-  });
-
-  test("rejects length mismatch", () => {
-    expect(matchPath("/a/b", "/a")).toBeNull();
-  });
-});
-
-describe("optional segments backtrack", () => {
-  // The regression: the matcher consumed a part whenever one was present and
-  // never gave it back, so `/:lang?/about` matched `/en/about` and then failed
-  // `/about` — an i18n prefix route 404ing on its own default locale. A failed
-  // match is indistinguishable from no route, so it surfaced as a bare 404.
-  test("matches with the optional segment absent", () => {
-    expect(matchPath("/:lang?/about", "/about")?.params).toEqual({});
-  });
-
-  test("still binds the optional segment when it is present", () => {
-    expect(matchPath("/:lang?/about", "/en/about")?.params).toEqual({
-      lang: "en",
-    });
-  });
-
-  test("does not match when the rest of the pattern cannot", () => {
-    expect(matchPath("/:lang?/about", "/en/contact")).toBeNull();
-    expect(matchPath("/:lang?/about", "/a/b/about")).toBeNull();
-  });
-
-  test("handles two optionals before a static tail", () => {
-    expect(matchPath("/:a?/:b?/end", "/end")?.params).toEqual({});
-    expect(matchPath("/:a?/:b?/end", "/x/end")?.params).toEqual({ a: "x" });
-    expect(matchPath("/:a?/:b?/end", "/x/y/end")?.params).toEqual({
-      a: "x",
-      b: "y",
-    });
-  });
-});
-
-describe("rest segments decode per part", () => {
-  // Decoding the joined string let an encoded separator smuggle structure past
-  // the router: a handler doing `join(dir, params.path)` on the result read
-  // outside its directory, and `a%2Fb` was indistinguishable from `a/b`.
-  test("rejects an encoded traversal", () => {
-    expect(matchPath("/files/*path", "/files/%2e%2e%2fsecret")).toBeNull();
-    expect(matchPath("/files/*path", "/files/..%2Fsecret")).toBeNull();
-  });
-
-  test("rejects an encoded separator", () => {
-    expect(matchPath("/files/*path", "/files/a%2Fb")).toBeNull();
-  });
-
-  test("still captures an ordinary nested path", () => {
-    expect(matchPath("/files/*path", "/files/a/b/c.txt")?.params).toEqual({
-      path: "a/b/c.txt",
-    });
-  });
-
-  test("still decodes ordinary escapes within a part", () => {
-    expect(matchPath("/files/*path", "/files/my%20file.txt")?.params).toEqual({
-      path: "my file.txt",
-    });
-  });
-});

package/tsconfig.json

@@ -1,4 +0,0 @@
-{
-  "extends": "../../tsconfig.base.json",
-  "include": ["src/**/*", "test/**/*"]
-}