@uniflowed/router 0.2.0 → 0.4.0

package/internal/flight-browser.js

@@ -39,7 +39,7 @@ import {
 import { requireServerComponentsReact } from "./react-version.js";
 
 /** A module namespace, as far as the loader looks into one. */
-type ModuleNamespace = { +[string]: mixed };
+type ModuleNamespace = { readonly [string]: mixed };
 
 /** The entry a refusal names: the one an application reaches this module through. */
 const ENTRY = "@uniflowed/router/rsc/client";
@@ -86,16 +86,24 @@ export function installBrowserModules(): void {
     throw new Error("@uniflowed/router: a payload asked for an import map, which uf never writes");
   };
   parcelRequire.meta = { publicUrl: "", devServer: null };
-  Object.defineProperty(globalThis, "parcelRequire", {
+  // `Reflect`, because Flow reads a property name given to
+  // `Object.defineProperty` as one the target must already declare, and
+  // `parcelRequire` is exactly the global nothing declares. `Object`'s throws
+  // where this answers `false`, so the throw is kept.
+  const defined = Reflect.defineProperty(globalThis, "parcelRequire", {
     value: parcelRequire,
     writable: true,
     configurable: true,
   });
+  if (!defined) {
+    throw new TypeError("@uniflowed/router: could not install parcelRequire on the global object");
+  }
 }
 
 /** The parts of a `Document` the reader uses. */
 type DocumentLike = interface {
-  readonly querySelectorAll: (selector: string) => Iterable<ElementLike>,
+  // A method, as a `Document`'s is: a method cannot be read off as a property.
+  querySelectorAll(selector: string): Iterable<ElementLike>,
   readonly documentElement: mixed,
 };
 
@@ -222,12 +230,16 @@ export async function fetchFlight(
   const landed = new URL(response.url, window.location.href);
   const document = documentPathOf(landed.pathname);
   const type = response.headers.get("content-type") ?? "";
-  if (
-    landed.origin !== window.location.origin ||
-    document == null ||
-    !type.startsWith(FLIGHT_CONTENT_TYPE)
-  ) {
-    void response.body?.cancel();
+  // A payload file a static host could not type (#1495) is taken for what it
+  // is only after its first bytes say so; see [`untypedPayload`].
+  const payload =
+    landed.origin === window.location.origin && document != null
+      ? type.startsWith(FLIGHT_CONTENT_TYPE)
+        ? response
+        : await untypedPayload(response, type)
+      : null;
+  if (payload == null || document == null) {
+    void response.body?.cancel().catch(() => {});
     // The URL the reader asked for when the redirect did not end on a payload,
     // rather than the one it ended on. A middleware that answered with its
     // sign-in page wrote a `next=` naming the payload URL; loading the document
@@ -237,6 +249,70 @@ export async function fetchFlight(
   return {
     kind: "flight",
     url: `${document}${landed.search}`,
-    root: createFromFetch(Promise.resolve(response)),
+    root: createFromFetch(Promise.resolve(payload)),
   };
 }
+
+/** The types a host sends for a file it does not know, or no type at all. */
+const UNTYPED: $ReadOnlyArray<string> = Object.freeze([
+  "",
+  "application/octet-stream",
+  "binary/octet-stream",
+]);
+
+/** How far into a body to look for the first row before giving up. */
+const SNIFF_LIMIT = 256;
+
+/**
+ * `response` as a payload, when a host served one without saying so.
+ *
+ * A prerendered page's payload is a file, `<route>/__uf.flight`, and a static
+ * host that does not know the extension sends it with no `Content-Type` (the
+ * Workers asset server, Pages) or as `application/octet-stream`. Refusing it
+ * made every client navigation on such a host a full page load. The type
+ * check is not dropped for it, it is replaced by one that cannot be fooled the
+ * same way: the answer has to be a `200` for the payload URL itself (no
+ * redirect — a sign-in page reached by one is what the type check is for),
+ * untyped rather than typed as something else (`text/html` is a document,
+ * whatever its bytes), and its first line has to be a Flight row, `<hex id>:`.
+ * Anything else answers `null` and the router loads the document, as before.
+ *
+ * The bytes read to decide are put back in front of the rest, so React reads
+ * the whole payload.
+ */
+async function untypedPayload(response: Response, type: string): Promise<Response | null> {
+  const media = type.split(";")[0].trim().toLowerCase();
+  if (!UNTYPED.includes(media) || response.status !== 200 || response.redirected) return null;
+  const body = response.body;
+  if (body == null) return null;
+  const reader = body.getReader();
+  const read: Array<Uint8Array> = [];
+  let seen = "";
+  const decoder = new TextDecoder();
+  while (!seen.includes("\n") && seen.length < SNIFF_LIMIT) {
+    const step = await reader.read();
+    if (step.done === true) break;
+    read.push(step.value);
+    seen += decoder.decode(step.value, { stream: true });
+  }
+  if (!/^[0-9a-f]+:/i.test(seen)) {
+    void reader.cancel().catch(() => {});
+    return null;
+  }
+  const replayed = new ReadableStream({
+    start(controller) {
+      for (const chunk of read) controller.enqueue(chunk);
+    },
+    async pull(controller) {
+      const step = await reader.read();
+      if (step.done === true) controller.close();
+      else controller.enqueue(step.value);
+    },
+    cancel(reason) {
+      return reader.cancel(reason);
+    },
+  });
+  const headers = new Headers(response.headers);
+  headers.set("content-type", FLIGHT_CONTENT_TYPE);
+  return new Response(replayed, { status: 200, headers });
+}

package/internal/flight-chunks.js

@@ -142,13 +142,13 @@ export function flightChunkBytes(text: string): Uint8Array | null {
   if (typeof value === "string") {
     return new TextEncoder().encode(value);
   }
-  if (
-    typeof value === "object" &&
-    !Array.isArray(value) &&
-    typeof value.bytes === "string" &&
-    Object.keys(value).length === 1
-  ) {
-    return fromBase64(value.bytes);
+  if (typeof value === "object" && !Array.isArray(value)) {
+    // Read once into a local: a refinement of `value.bytes` does not survive
+    // to the call, a `const` does.
+    const bytes = value.bytes;
+    if (typeof bytes === "string" && Object.keys(value).length === 1) {
+      return fromBase64(bytes);
+    }
   }
   throw new Error(`@uniflowed/router: a ${FLIGHT_CHUNK_ATTRIBUTE} element holds no payload chunk`);
 }

package/internal/flight-rows.js

@@ -39,7 +39,12 @@ const NEWLINE = 0x0a;
 const ERROR_TAG = "E".charCodeAt(0);
 
 /** One row's place in the payload. */
-type Row = {| +start: number, +end: number, +tag: number, +body: number |};
+type Row = {|
+  readonly start: number,
+  readonly end: number,
+  readonly tag: number,
+  readonly body: number,
+|};
 
 /**
  * Every row of a finished payload, in order.
@@ -92,7 +97,7 @@ function rowsOf(bytes: Uint8Array): Array<Row> {
 export function withoutErrorRows(
   payload: Uint8Array,
   left: (digest: string) => boolean,
-): {| +payload: Uint8Array, +removed: number |} {
+): {| readonly payload: Uint8Array, readonly removed: number |} {
   const decoder = new TextDecoder();
   const kept: Array<Uint8Array> = [];
   let removed = 0;

package/internal/flight-ssr.js

@@ -28,7 +28,7 @@ import type { FlightRoot } from "./flight.js";
 import { requireServerComponentsReact } from "./react-version.js";
 
 /** A module namespace, as far as the hook looks into one. */
-type ModuleNamespace = { +[string]: mixed };
+type ModuleNamespace = { readonly [string]: mixed };
 
 /** The server copy of the client module at a browser chunk URL. */
 export type ClientModuleLoader = (url: string) => Promise<ModuleNamespace>;
@@ -64,11 +64,18 @@ export function installServerModules(load: ClientModuleLoader): void {
     throw new Error("@uniflowed/router: a payload asked for an import map, which uf never writes");
   };
   parcelRequire.meta = { publicUrl: "", devServer: null };
-  Object.defineProperty(globalThis, "parcelRequire", {
+  // `Reflect`, because Flow reads a property name given to
+  // `Object.defineProperty` as one the target must already declare, and
+  // `parcelRequire` is exactly the global nothing declares. `Object`'s throws
+  // where this answers `false`, so the throw is kept.
+  const defined = Reflect.defineProperty(globalThis, "parcelRequire", {
     value: parcelRequire,
     writable: true,
     configurable: true,
   });
+  if (!defined) {
+    throw new TypeError("@uniflowed/router: could not install parcelRequire on the global object");
+  }
 }
 
 /**
@@ -82,7 +89,7 @@ export function installServerModules(load: ClientModuleLoader): void {
  */
 export function readPayload(
   stream: ReadableStream<Uint8Array>,
-  options?: {| +partial?: boolean |},
+  options?: {| readonly partial?: boolean |},
 ): Promise<FlightRoot> {
   requireServerComponentsReact(ENTRY);
   return options?.partial === true

package/internal/flight.js

@@ -108,6 +108,38 @@ export type FetchedFlight =
       readonly url: string,
     |};
 
+/**
+ * `error` as it may cross into a Flight payload: a thrown value that is not an
+ * `Error` becomes one.
+ *
+ * The route's error travels to the browser as a prop of the error page and as
+ * part of the route state, and React serialises it the way it serialises any
+ * prop. For an `Error` that is safe by React's own rule: a production payload
+ * carries the digest and none of the message or the stack. A thrown value
+ * that is *not* an `Error` gets no such rule. A string, or a plain object
+ * such as an API client's `{ message, details, hint }`, would be serialised
+ * as the data it is, and a query, a table name or a token in it would be
+ * published to whoever asked for the page.
+ *
+ * So it is wrapped. The message is the value's `String()`, which `uf dev`
+ * shows and which a production payload drops along with every other `Error`
+ * message. The original value is still what the server reported: this is
+ * applied only to the copy that crosses. `unauthorized` and `forbidden` carry
+ * nothing and pass through as they are.
+ */
+export function crossableRouteError(error: ?RouteError): ?RouteError {
+  if (error == null || error.kind !== "thrown" || error.error instanceof Error) {
+    return error;
+  }
+  let text = "a value that is not an Error was thrown";
+  try {
+    text = String(error.error);
+  } catch {
+    // A value whose `toString` throws: the sentence above is all it gets.
+  }
+  return { kind: "thrown", error: new Error(text) };
+}
+
 /** The part of a resolved route that crosses to the browser. */
 export function routeState(resolved: ResolvedRoute): RouteState {
   const interception = resolved.interception;

package/internal/hydration.js

@@ -195,21 +195,26 @@ type DetachedHeadStyle = {|
  * puts them back in the same order.
  */
 export function prepareDevHeadForHydration(document: Document): () => void {
-  for (const script of document.head.querySelectorAll("script")) {
+  // A document without a head has nothing of uf's in it to hide.
+  const head = document.head;
+  if (head == null) {
+    return () => {};
+  }
+  for (const script of head.querySelectorAll("script")) {
     if (isDevHeadScript(script)) {
       script.remove();
     }
   }
-  for (const child of Array.from(document.head.childNodes)) {
+  for (const child of Array.from(head.childNodes)) {
     if (isIgnorableHeadWhitespace(child)) {
-      child.remove();
+      head.removeChild(child);
     }
   }
   const detached = [];
-  for (const style of document.head.querySelectorAll("style")) {
+  for (const style of head.querySelectorAll("style")) {
     if (isViteDevStyle(style)) {
       const anchor = document.createComment("uf dev style");
-      document.head.insertBefore(anchor, style);
+      head.insertBefore(anchor, style);
       style.remove();
       detached.push({ anchor, style });
     }
@@ -243,7 +248,7 @@ function restoreDevHeadStyles(
       parent.insertBefore(style, anchor);
       parent.removeChild(anchor);
     } else {
-      document.head.appendChild(style);
+      document.head?.appendChild(style);
     }
   }
 }

package/internal/navigation-cache.js

@@ -62,7 +62,7 @@ let staleTimeMs: number = 0;
 export function installStaleTime(seconds: number): void {
   staleTimeMs = Number.isFinite(seconds) && seconds > 0 ? seconds * 1000 : 0;
   if (import.meta.hot != null) {
-    Object.defineProperty((globalThis: $FlowFixMe), "__UF_NAVIGATION_CACHE__", {
+    Object.defineProperty(globalThis as $FlowFixMe, "__UF_NAVIGATION_CACHE__", {
       configurable: true,
       value: inspectNavigationCache,
     });

package/internal/payload-rows.js

@@ -81,13 +81,15 @@ export type PayloadReader = {|
 
 /** The parts of a `Document` this module uses, so it needs no DOM lib. */
 type DocumentLike = interface {
-  readonly querySelectorAll: (selector: string) => Iterable<ElementLike>,
-  readonly documentElement: mixed,
+  // Methods rather than function-valued properties: a `Document`'s are
+  // methods, and a method cannot be read off its object as a property.
+  querySelectorAll(selector: string): Iterable<ElementLike>,
+  readonly documentElement: ?Node,
 };
 
 /** The parts of an `Element` this module uses. */
 type ElementLike = interface {
-  readonly getAttribute: (name: string) => string | null,
+  getAttribute(name: string): ?string,
   readonly textContent: string | null,
 };
 
@@ -261,7 +263,6 @@ export function domObserver(
     const observer = new MutationObserver(() => {
       callback();
     });
-    // $FlowFixMe[incompatible-call] `documentElement` is a `Node`; the interface above says only what is read.
     observer.observe(root, { childList: true, subtree: true });
     return () => {
       observer.disconnect();

package/internal/payload.js

@@ -241,8 +241,8 @@ function asThenable(value: mixed): Promise<mixed> | null {
   if (value == null || (typeof value !== "object" && typeof value !== "function")) {
     return null;
   }
-  const then: mixed = (value: $FlowFixMe).then;
-  return typeof then === "function" ? (value: $FlowFixMe) : null;
+  const then: mixed = (value as $FlowFixMe).then;
+  return typeof then === "function" ? (value as $FlowFixMe) : null;
 }
 
 /** Whether a string would be read as a reference and so has to be escaped. */
@@ -315,7 +315,7 @@ function needsEncoding(root: mixed, label: string): boolean {
       continue;
     }
     if (isPlainObject(value)) {
-      const source: { +[string]: mixed } = (value: $FlowFixMe);
+      const source: { readonly [string]: mixed } = value as $FlowFixMe;
       for (const key of Object.keys(source)) {
         stack.push({ value: source[key], path: `${path}.${key}`, depth: depth + 1 });
       }
@@ -381,7 +381,7 @@ export function encodePayload(root: mixed, label: string): EncodedPayload {
       continue;
     }
     if (Array.isArray(value)) {
-      const encoded: Array<mixed> = new Array(value.length).fill(null);
+      const encoded: Array<mixed> = new Array<mixed>(value.length).fill(null);
       emit(encoded);
       // Pushed in reverse so that popping visits index 0 first: the id a
       // promise is given has to follow the order the payload reads in.
@@ -403,7 +403,7 @@ export function encodePayload(root: mixed, label: string): EncodedPayload {
       emit(value);
       continue;
     }
-    const source: { +[string]: mixed } = (value: $FlowFixMe);
+    const source: { readonly [string]: mixed } = value as $FlowFixMe;
     const encoded: { [string]: mixed } = {};
     emit(encoded);
     const keys = Object.keys(source);
@@ -491,7 +491,7 @@ export function decodePayload(root: mixed, resolve: RowResolver, label: string):
       continue;
     }
     if (Array.isArray(value)) {
-      const rebuilt: Array<mixed> = new Array(value.length).fill(null);
+      const rebuilt: Array<mixed> = new Array<mixed>(value.length).fill(null);
       emit(rebuilt);
       for (let index = value.length - 1; index >= 0; index -= 1) {
         stack.push({
@@ -509,7 +509,7 @@ export function decodePayload(root: mixed, resolve: RowResolver, label: string):
       emit(value);
       continue;
     }
-    const source: { +[string]: mixed } = (value: $FlowFixMe);
+    const source: { readonly [string]: mixed } = value as $FlowFixMe;
     const rebuilt: { [string]: mixed } = {};
     emit(rebuilt);
     const keys = Object.keys(source);
@@ -553,7 +553,7 @@ function hasReference(root: mixed, label: string): boolean {
       continue;
     }
     if (isPlainObject(value)) {
-      const source: { +[string]: mixed } = (value: $FlowFixMe);
+      const source: { readonly [string]: mixed } = value as $FlowFixMe;
       for (const key of Object.keys(source)) {
         stack.push({ value: source[key], path: `${path}.${key}`, depth: depth + 1 });
       }
@@ -632,7 +632,13 @@ function parsePayloadRowId(digits: string): number | null {
  * only one of them.
  */
 export function payloadJson(value: mixed): string {
-  return JSON.stringify(value)
+  const text = JSON.stringify(value);
+  if (text === undefined) {
+    // `undefined`, a function or a symbol: nothing JSON can say. This threw
+    // before too, as a `TypeError` about `replace`; now it says what it is.
+    throw new TypeError("@uniflowed/router: a payload value has no JSON form");
+  }
+  return text
     .replace(/</g, "\\u003c")
     .replace(/\u2028/g, "\\u2028")
     .replace(/\u2029/g, "\\u2029");
@@ -660,9 +666,9 @@ export function parseRowMessage(text: string, id: number): PayloadRowMessage {
   if (!isPlainObject(parsed)) {
     throw new PayloadValueError(label, "is not a row message");
   }
-  const message: { +[string]: mixed } = (parsed: $FlowFixMe);
-  const hasValue = Object.prototype.hasOwnProperty.call(message, "value");
-  const hasError = Object.prototype.hasOwnProperty.call(message, "error");
+  const message: { readonly [string]: mixed } = parsed as $FlowFixMe;
+  const hasValue = Object.hasOwn(message, "value");
+  const hasError = Object.hasOwn(message, "error");
   if (hasValue === hasError) {
     throw new PayloadValueError(label, "must carry exactly one of `value` and `error`");
   }

package/internal/prepare-document.js

@@ -19,6 +19,12 @@ export function prepareDocumentForHydration(document: Document): void {
   // document that arrived. See `./deployment.js`.
   rememberDeployment(document);
   const head = document.head;
+  if (head == null) {
+    // Nothing a server wrote into a head to put right; the forms still are.
+    document.getElementById("_R_")?.remove();
+    normalizeReactFormActions(document);
+    return;
+  }
   const envelope = head.querySelector('meta[name="uf:render"]');
   if (envelope != null && head.firstChild !== envelope) {
     head.insertBefore(envelope, head.firstChild);

package/internal/resolve.js

@@ -639,7 +639,7 @@ export function loadOnce<T>(load: () => Promise<T>): Promise<T> {
     pending = load();
     moduleCache.set(load, pending);
   }
-  // $FlowFixMe[incompatible-return] the cache is keyed by the loader, whose result type it stores.
+  // $FlowFixMe[incompatible-type] the cache is keyed by the loader, whose result type it stores.
   return pending;
 }
 
@@ -755,9 +755,12 @@ async function resolveRoute(
         "client JavaScript, so the browser navigates to it rather than rendering it",
     );
   }
-  const [page, ...layouts] = await Promise.all([
+  // A pair rather than one spread array, so that the page stays a
+  // `PageModule` and the layouts `LayoutModule`s: `Promise.all` of a mixed
+  // list answers with the union of the two.
+  const [page, layouts] = await Promise.all([
     loadOnce(load),
-    ...matched.route.layouts.map((layout) => loadOnce(layout)),
+    Promise.all(matched.route.layouts.map((layout) => loadOnce(layout))),
   ]);
   // Started here and awaited at the end: the boundary's module does not depend
   // on the loader, so importing it alongside costs a navigation nothing. It
@@ -1460,11 +1463,11 @@ async function resolveNotFound(
 ): Promise<ResolvedRoute> {
   const record = nearestBoundary(table.notFound, pathname);
   const load = record?.page;
-  const [page, ...layouts] = await Promise.all([
+  const [page, layouts] = await Promise.all([
     load == null
       ? Promise.resolve<PageModule>({ default: DefaultNotFound, metadata: { title: "Not found" } })
       : loadOnce(load),
-    ...(record?.layouts ?? []).map((layout) => loadOnce(layout)),
+    Promise.all((record?.layouts ?? []).map((layout) => loadOnce(layout))),
   ]);
   const metadata = await resolveMetadata(page, layouts, {
     params: {},
@@ -1527,11 +1530,14 @@ async function resolveMetadata(
   }
   if (page.frontmatter != null) {
     const { title, description } = page.frontmatter;
-    merged = {
-      ...merged,
-      ...(title != null ? { title } : {}),
-      ...(description != null ? { description } : {}),
-    };
+    // One field at a time: spreading two conditional objects is a union per
+    // spread, and Flow refuses to multiply them out.
+    if (title != null) {
+      merged = { ...merged, title };
+    }
+    if (description != null) {
+      merged = { ...merged, description };
+    }
   }
   if (page.metadata != null) {
     take(page.metadata);
@@ -1587,7 +1593,7 @@ export function errorTitle(error: RouteError): string {
   return match (error) {
     {kind: "unauthorized"} => "Sign in required",
     {kind: "forbidden"} => "Not allowed",
-    {kind: "thrown"} => "Something went wrong",
+    {kind: "thrown", ...} => "Something went wrong",
   };
 }
 

package/internal/routing.js

@@ -150,7 +150,7 @@ export type RouteTable<
 type UnknownRouteRecord = RouteRecord<mixed, mixed, mixed, mixed, mixed>;
 
 /** A URL matched against a table. */
-export type RouteMatch<TRoute: { +path: string, ... } = UnknownRouteRecord> = {|
+export type RouteMatch<TRoute extends { readonly path: string, ... } = UnknownRouteRecord> = {|
   readonly route: TRoute,
   readonly params: RouteParams,
 |};
@@ -172,7 +172,7 @@ export function routeErrorStatus(error: RouteError): 401 | 403 | 500 {
   return match (error) {
     {kind: "unauthorized"} => 401,
     {kind: "forbidden"} => 403,
-    {kind: "thrown"} => 500,
+    {kind: "thrown", ...} => 500,
   };
 }
 
@@ -200,12 +200,77 @@ export class ForbiddenError extends Error {
   }
 }
 
-/** Thrown by `redirect()`; the renderer answers with a redirect. */
+/**
+ * The URL schemes a navigation never follows, because following one runs
+ * script in the page rather than loading one.
+ *
+ * `javascript:` is the reason. `location.assign("javascript:…")` and
+ * `location.replace("javascript:…")` execute it in the current document, with
+ * the page's origin and its cookies, so a router that hands a caller's string
+ * to either is a DOM XSS sink the moment that string comes from a query
+ * parameter: `redirect(searchParams.get("next"))` is the sign-in flow in half
+ * the applications ever written. React 19 refuses the same scheme in `href`
+ * for the same reason, and `Link` renders through that; this is the half of
+ * the router React never sees. `vbscript:` is the same thing in an older
+ * browser, and `data:` a document of the sender's choosing that browsers now
+ * refuse to navigate to at the top level anyway — refused here too, so the
+ * answer does not depend on which browser was asked.
+ */
+const SCRIPT_SCHEMES: $ReadOnlyArray<string> = ["javascript:", "vbscript:", "data:"];
+
+/**
+ * The scheme `to` would run as script when navigated to, or `null` when it is
+ * a URL a navigation may follow.
+ *
+ * Parsed with the WHATWG URL parser rather than compared as text, because the
+ * browser is what decides and it forgives a great deal: leading spaces and
+ * control characters are stripped, tabs and newlines anywhere are dropped, and
+ * the scheme is case-insensitive — ` JaVa\tScRiPt:` is `javascript:`. The base
+ * only resolves a relative path, which is never one of these.
+ */
+export function scriptSchemeOf(to: string): string | null {
+  let parsed: URL;
+  try {
+    parsed = new URL(to, "http://uf.invalid/");
+  } catch {
+    return null;
+  }
+  return SCRIPT_SCHEMES.includes(parsed.protocol) ? parsed.protocol : null;
+}
+
+/**
+ * Throw unless `to` is a URL a navigation may follow.
+ *
+ * Named after the call that asked (`redirect()`, `router.push()`), so the
+ * stack a developer reads points at the line that built the URL. The URL
+ * itself is not repeated: it is often a value a visitor chose, and an error
+ * message is something applications log.
+ */
+export function refuseScriptUrl(to: string, caller: string): void {
+  const scheme = scriptSchemeOf(to);
+  if (scheme != null) {
+    throw new Error(
+      `@uniflowed/router: ${caller} refused a ${scheme} URL, which a browser would run as ` +
+        "script in this page rather than load. If the URL came from a query parameter, allow " +
+        "only paths on this site before navigating to it.",
+    );
+  }
+}
+
+/**
+ * Thrown by `redirect()`; the renderer answers with a redirect.
+ *
+ * Refuses a script URL when it is built (see [`refuseScriptUrl`]), so every
+ * place that follows one — the server's `Location`, the browser's
+ * `location.replace` in a single-page application, a form's `303` — is
+ * covered by one check rather than by one each.
+ */
 export class RedirectError extends Error {
   to: string;
   permanent: boolean;
 
   constructor(to: string, permanent: boolean) {
+    refuseScriptUrl(to, permanent ? "permanentRedirect()" : "redirect()");
     super(`redirect to ${to}`);
     this.name = "RedirectError";
     this.to = to;
@@ -241,9 +306,9 @@ function specificity(segments: $ReadOnlyArray<Segment>): number {
   let score = 0;
   for (const segment of segments) {
     score += match (segment) {
-      {kind: "static"} => 3,
-      {kind: "param"} => 2,
-      {kind: "catchAll"} => 1,
+      {kind: "static", ...} => 3,
+      {kind: "param", ...} => 2,
+      {kind: "catchAll", ...} => 1,
     };
   }
   return score;
@@ -338,12 +403,12 @@ function decodeSegment(segment: string): string {
 }
 
 /** Whether this table can render the route in the browser. */
-export function hasClientPage(route: { +page?: mixed, ... }): boolean {
+export function hasClientPage(route: { readonly page?: mixed, ... }): boolean {
   return route.page != null;
 }
 
 /** Match a pathname against the table, preferring the most specific route. */
-export function matchRoute<TRoute: { +path: string, ... }>(
+export function matchRoute<TRoute extends { readonly path: string, ... }>(
   routes: $ReadOnlyArray<TRoute>,
   pathname: string,
 ): ?RouteMatch<TRoute> {
@@ -356,7 +421,7 @@ export function matchRoute<TRoute: { +path: string, ... }>(
  * A slot is a second table matched against the same URL, and it has to be
  * matched by this function rather than by one of its own.
  */
-export function matchIn<TRoute: { +path: string, ... }>(
+export function matchIn<TRoute extends { readonly path: string, ... }>(
   routes: $ReadOnlyArray<TRoute>,
   pathname: string,
 ): ?RouteMatch<TRoute> {
@@ -389,8 +454,8 @@ function covers(segments: $ReadOnlyArray<Segment>, parts: $ReadOnlyArray<string>
   for (const segment of segments) {
     const next = match (segment) {
       {kind: "static", value: const value} => parts[index] === value ? index + 1 : -1,
-      {kind: "param"} => index < parts.length ? index + 1 : -1,
-      {kind: "catchAll"} => parts.length,
+      {kind: "param", ...} => index < parts.length ? index + 1 : -1,
+      {kind: "catchAll", ...} => parts.length,
     };
     if (next === -1) {
       return false;
@@ -401,7 +466,7 @@ function covers(segments: $ReadOnlyArray<Segment>, parts: $ReadOnlyArray<string>
 }
 
 /** The nearest boundary above `pathname`, or `null` when none covers it. */
-export function nearestBoundary<TBoundary: { readonly path: string, ... }>(
+export function nearestBoundary<TBoundary extends { readonly path: string, ... }>(
   boundaries: $ReadOnlyArray<TBoundary>,
   pathname: string,
 ): ?TBoundary {