@warlock.js/web 5.2.0 → 5.2.1

package/esm/context.d.mts

@@ -1,7 +1,7 @@
 import { SharedContext } from "./index.mjs";
 import { HttpContext, Request } from "@warlock.js/core";
 
-//#region web/src/context.d.ts
+//#region ../web/src/context.d.ts
 type HttpContext$1<TRequest extends Request = Request> = HttpContext<TRequest>;
 type PageContext<TRequest extends Request = Request> = HttpContext<TRequest> & {
   shared: SharedContext;

package/esm/hydration/index.mjs

@@ -5,7 +5,7 @@ import { NavigationRoot } from "../client/navigation/navigation-root.mjs";
 import { createElement } from "react";
 import { pages } from "virtual:warlock/pages";
 
-//#region web/src/hydration/index.ts
+//#region ../web/src/hydration/index.ts
 /**
 * The client entry: registry in, hydration out. No page names, no app paths.
 *

package/esm/hydration/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["C:/Work/Warlock.js/web/src/hydration/index.ts"],"sourcesContent":["/**\n * The client entry: registry in, hydration out. No page names, no app paths.\n *\n * The page graph arrives from the Vite virtual module the build plugin serves,\n * so this file works for ANY page in ANY app. The previous version imported one\n * page and one layout by relative path into the monorepo's reference app, which\n * both hydrated every URL as the home page and made `@warlock.js/web`\n * uninstallable anywhere outside this checkout. Neither a page name nor an app\n * path appears here now, and nothing about the composition lives here either -\n * that is `buildHydratedTree`, which takes the registry as an argument and is\n * therefore testable without a bundler.\n */\nimport { createElement } from \"react\";\nimport { pages } from \"virtual:warlock/pages\";\nimport { buildHydratedTree } from \"../client/build-hydrated-tree\";\nimport { hydratePage } from \"../client/hydrate-page\";\nimport { NavigationRoot } from \"../client/navigation/navigation-root\";\nimport { publishRouteTable } from \"../routing/route-table\";\n\n/*\n  BEFORE the mount, not after: `<Link>` resolves its URL through the route table\n  during render, and the first render is the hydration render. Publishing\n  afterwards would make every anchor in the initial tree throw.\n\n  The registry entries already carry `name` and `path` - the same pair the\n  server registered its routes from, out of the same discovery result - so the\n  browser's table cannot drift from the server's without the two being built\n  from different page graphs, which hydration already refuses.\n*/\npublishRouteTable(pages, \"hydration client entry\");\n\n/*\n  The hydrated tree is wrapped in `NavigationRoot` so the page can be REPLACED\n  later without a document load. The first render is still exactly the tree the\n  server produced - `NavigationRoot` renders `initialTree` verbatim and adds no\n  markup of its own - so hydration still matches the server byte for byte, and\n  the wrapper only starts to matter on the first navigation.\n\n  NO MRR HISTORY BRIDGE IS INSTALLED HERE YET, and that is a pending decision\n  rather than an oversight. This runtime drives `window.history` itself and is\n  complete without MRR. Handing history to `@mongez/react-router` as well means\n  `@warlock.js/web` importing it, which puts MRR in the bundle of EVERY app that\n  uses this package - a packaging choice (dependency vs. peer vs. app-level\n  opt-in) with consequences for apps that never navigate through MRR. The bridge\n  itself is written and documented in\n  `conversations/2026-08-24-production-ssr-session.md`; it lands the moment that\n  choice is made.\n*/\nhydratePage(async (payload) => {\n  const tree = await buildHydratedTree(pages, payload);\n\n  return createElement(NavigationRoot, {\n    pages,\n    initialPayload: payload,\n    initialTree: tree,\n    buildTree: buildHydratedTree,\n  });\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA6BA,kBAAkB,OAAO,wBAAwB;AAmBjD,YAAY,OAAO,YAAY;CAG7B,OAAO,cAAc,gBAAgB;EACnC;EACA,gBAAgB;EAChB,aAAa,MALI,kBAAkB,OAAO,OAAO;EAMjD,WAAW;CACb,CAAC;AACH,CAAC"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../../../../../../web/src/hydration/index.ts"],"sourcesContent":["/**\n * The client entry: registry in, hydration out. No page names, no app paths.\n *\n * The page graph arrives from the Vite virtual module the build plugin serves,\n * so this file works for ANY page in ANY app. The previous version imported one\n * page and one layout by relative path into the monorepo's reference app, which\n * both hydrated every URL as the home page and made `@warlock.js/web`\n * uninstallable anywhere outside this checkout. Neither a page name nor an app\n * path appears here now, and nothing about the composition lives here either -\n * that is `buildHydratedTree`, which takes the registry as an argument and is\n * therefore testable without a bundler.\n */\nimport { createElement } from \"react\";\nimport { pages } from \"virtual:warlock/pages\";\nimport { buildHydratedTree } from \"../client/build-hydrated-tree\";\nimport { hydratePage } from \"../client/hydrate-page\";\nimport { NavigationRoot } from \"../client/navigation/navigation-root\";\nimport { publishRouteTable } from \"../routing/route-table\";\n\n/*\n  BEFORE the mount, not after: `<Link>` resolves its URL through the route table\n  during render, and the first render is the hydration render. Publishing\n  afterwards would make every anchor in the initial tree throw.\n\n  The registry entries already carry `name` and `path` - the same pair the\n  server registered its routes from, out of the same discovery result - so the\n  browser's table cannot drift from the server's without the two being built\n  from different page graphs, which hydration already refuses.\n*/\npublishRouteTable(pages, \"hydration client entry\");\n\n/*\n  The hydrated tree is wrapped in `NavigationRoot` so the page can be REPLACED\n  later without a document load. The first render is still exactly the tree the\n  server produced - `NavigationRoot` renders `initialTree` verbatim and adds no\n  markup of its own - so hydration still matches the server byte for byte, and\n  the wrapper only starts to matter on the first navigation.\n\n  NO MRR HISTORY BRIDGE IS INSTALLED HERE YET, and that is a pending decision\n  rather than an oversight. This runtime drives `window.history` itself and is\n  complete without MRR. Handing history to `@mongez/react-router` as well means\n  `@warlock.js/web` importing it, which puts MRR in the bundle of EVERY app that\n  uses this package - a packaging choice (dependency vs. peer vs. app-level\n  opt-in) with consequences for apps that never navigate through MRR. The bridge\n  itself is written and documented in\n  `conversations/2026-08-24-production-ssr-session.md`; it lands the moment that\n  choice is made.\n*/\nhydratePage(async (payload) => {\n  const tree = await buildHydratedTree(pages, payload);\n\n  return createElement(NavigationRoot, {\n    pages,\n    initialPayload: payload,\n    initialTree: tree,\n    buildTree: buildHydratedTree,\n  });\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA6BA,kBAAkB,OAAO,wBAAwB;AAmBjD,YAAY,OAAO,YAAY;CAG7B,OAAO,cAAc,gBAAgB;EACnC;EACA,gBAAgB;EAChB,aAAa,MALI,kBAAkB,OAAO,OAAO;EAMjD,WAAW;CACb,CAAC;AACH,CAAC"}

package/esm/hydration-payload.mjs

@@ -1,6 +1,6 @@
 import { PAYLOAD_SCRIPT_ID } from "./components/document-context.mjs";
 
-//#region web/src/hydration-payload.ts
+//#region ../web/src/hydration-payload.ts
 /**
 * Exported so a payload-shape assertion can be written against the contract
 * itself. A spec that hardcodes its own copy of this list silently becomes a

package/esm/hydration-payload.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"hydration-payload.mjs","names":[],"sources":["C:/Work/Warlock.js/web/src/hydration-payload.ts"],"sourcesContent":["import {\n  PAYLOAD_SCRIPT_ID,\n  type HydrationDocumentPayloadSource,\n} from \"./components/document-context\";\n\nexport type { HydrationDocumentPayloadSource } from \"./components/document-context\";\nexport type {\n  ErrorPageProps,\n  SerializedErrorPageProps,\n  SerializedPageError,\n} from \"./components/document-context\";\n\n/**\n * Exported so a payload-shape assertion can be written against the contract\n * itself. A spec that hardcodes its own copy of this list silently becomes a\n * claim about a PAST revision — that is exactly how the rev. 3 keys landed with\n * two specs still asserting the rev. 2 shape.\n */\nexport const REQUIRED_PAYLOAD_KEYS = [\n  \"appData\",\n  \"layoutData\",\n  \"pageData\",\n  \"shared\",\n  \"name\",\n] as const;\n\nconst ABSENT_PAYLOAD_MESSAGE =\n  `Warlock hydration payload is absent: #${PAYLOAD_SCRIPT_ID}, owned by ` +\n  \"web/src/components/document-context.ts, was not found.\";\nconst MALFORMED_PAYLOAD_MESSAGE =\n  `Warlock hydration payload was found at #${PAYLOAD_SCRIPT_ID} but could not be read.`;\n\nfunction malformedPayload(): never {\n  throw new Error(MALFORMED_PAYLOAD_MESSAGE);\n}\n\n/**\n * The keys that are allowed to be ABSENT but not allowed to be wrong.\n *\n * `metadata`, `params` and `errorPage` are optional because the server is right\n * always produce them — a page with no `metadata` export resolves none, and a\n * older payload carries none of these additions. Failing a whole page over an\n * absent accessor would turn a compatible payload into a blank screen, so\n * absence is accepted.\n *\n * Present-but-not-an-object is a different claim entirely: it means something\n * produced a payload with these names meaning something else, and every reader\n * downstream would then be indexing a string. That is MALFORMED under the same\n * rule the required keys live by, so it throws. Arrays included — `typeof []`\n * is `\"object\"`, and an array of params is not params.\n */\nexport const OPTIONAL_OBJECT_PAYLOAD_KEYS = [\"metadata\", \"params\", \"errorPage\"] as const;\n\nfunction isPlainObject(value: unknown): boolean {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction hasExactStringKeys(\n  value: Record<PropertyKey, unknown>,\n  required: readonly string[],\n  optional: readonly string[] = [],\n): boolean {\n  const allowed = new Set([...required, ...optional]);\n  const keys = Reflect.ownKeys(value);\n\n  return (\n    required.every((key) => Object.prototype.hasOwnProperty.call(value, key)) &&\n    keys.every((key) => typeof key === \"string\" && allowed.has(key))\n  );\n}\n\n/**\n * Validate the explicit serialization boundary, not an `Error` instance.\n * `JSON.stringify(new Error(\"boom\"))` is normally `{}` because its useful\n * fields are non-enumerable; accepting that would hydrate an error page with a\n * different contract from the one the server rendered.\n */\nfunction requireErrorPagePayload(value: unknown): void {\n  if (!isPlainObject(value)) malformedPayload();\n\n  const errorPage = value as Record<PropertyKey, unknown>;\n\n  if (!hasExactStringKeys(errorPage, [\"error\", \"status\"])) malformedPayload();\n  if (!isPlainObject(errorPage.error)) malformedPayload();\n\n  const error = errorPage.error as Record<PropertyKey, unknown>;\n\n  if (!hasExactStringKeys(error, [\"name\", \"message\"], [\"stack\"])) malformedPayload();\n  if (typeof error.name !== \"string\" || typeof error.message !== \"string\") {\n    malformedPayload();\n  }\n  if (error.stack !== undefined && typeof error.stack !== \"string\") malformedPayload();\n\n  if (\n    typeof errorPage.status !== \"number\" ||\n    !Number.isInteger(errorPage.status) ||\n    errorPage.status < 500 ||\n    errorPage.status > 599\n  ) {\n    malformedPayload();\n  }\n}\n\nfunction requireHydrationPayload(value: unknown): HydrationDocumentPayloadSource {\n  if (!isPlainObject(value)) malformedPayload();\n\n  for (const key of REQUIRED_PAYLOAD_KEYS) {\n    if (!Object.prototype.hasOwnProperty.call(value, key)) malformedPayload();\n  }\n\n  for (const key of OPTIONAL_OBJECT_PAYLOAD_KEYS) {\n    const optional = (value as Record<string, unknown>)[key];\n\n    if (optional !== undefined && !isPlainObject(optional)) malformedPayload();\n  }\n\n  const errorPage = (value as Record<string, unknown>).errorPage;\n  if (errorPage !== undefined) requireErrorPagePayload(errorPage);\n\n  return value as HydrationDocumentPayloadSource;\n}\n\n/**\n * Read the fixed payload script without changing the server-rendered root.\n *\n * Extra fields are ignored. The gate owns the FIVE required keys — absent or\n * malformed, both throw — plus a shape check on the three optional ones\n * ({@link OPTIONAL_OBJECT_PAYLOAD_KEYS}); it deliberately does not require\n * those to be present. `errorPage`, when present, is additionally validated as\n * one atomic `{ error, status }` selection with a serialized error and a 5xx.\n */\nexport function readHydrationPayload(documentNode: Document): HydrationDocumentPayloadSource {\n  const element = documentNode.getElementById(PAYLOAD_SCRIPT_ID);\n\n  if (element === null) throw new Error(ABSENT_PAYLOAD_MESSAGE);\n\n  let parsed: unknown;\n\n  try {\n    parsed = JSON.parse(element.textContent ?? \"\");\n  } catch {\n    malformedPayload();\n  }\n\n  return requireHydrationPayload(parsed);\n}\n"],"mappings":";;;;;;;;;AAkBA,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,yBACJ,yCAAyC,kBAAkB;AAE7D,MAAM,4BACJ,2CAA2C,kBAAkB;AAE/D,SAAS,mBAA0B;CACjC,MAAM,IAAI,MAAM,yBAAyB;AAC3C;;;;;;;;;;;;;;;;AAiBA,MAAa,+BAA+B;CAAC;CAAY;CAAU;AAAW;AAE9E,SAAS,cAAc,OAAyB;CAC9C,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,mBACP,OACA,UACA,WAA8B,CAAC,GACtB;CACT,MAAM,UAAU,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC;CAClD,MAAM,OAAO,QAAQ,QAAQ,KAAK;CAElC,OACE,SAAS,OAAO,QAAQ,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG,CAAC,KACxE,KAAK,OAAO,QAAQ,OAAO,QAAQ,YAAY,QAAQ,IAAI,GAAG,CAAC;AAEnE;;;;;;;AAQA,SAAS,wBAAwB,OAAsB;CACrD,IAAI,CAAC,cAAc,KAAK,GAAG,iBAAiB;CAE5C,MAAM,YAAY;CAElB,IAAI,CAAC,mBAAmB,WAAW,CAAC,SAAS,QAAQ,CAAC,GAAG,iBAAiB;CAC1E,IAAI,CAAC,cAAc,UAAU,KAAK,GAAG,iBAAiB;CAEtD,MAAM,QAAQ,UAAU;CAExB,IAAI,CAAC,mBAAmB,OAAO,CAAC,QAAQ,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,iBAAiB;CACjF,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,YAAY,UAC7D,iBAAiB;CAEnB,IAAI,MAAM,UAAU,UAAa,OAAO,MAAM,UAAU,UAAU,iBAAiB;CAEnF,IACE,OAAO,UAAU,WAAW,YAC5B,CAAC,OAAO,UAAU,UAAU,MAAM,KAClC,UAAU,SAAS,OACnB,UAAU,SAAS,KAEnB,iBAAiB;AAErB;AAEA,SAAS,wBAAwB,OAAgD;CAC/E,IAAI,CAAC,cAAc,KAAK,GAAG,iBAAiB;CAE5C,KAAK,MAAM,OAAO,uBAChB,IAAI,CAAC,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG,GAAG,iBAAiB;CAG1E,KAAK,MAAM,OAAO,8BAA8B;EAC9C,MAAM,WAAY,MAAkC;EAEpD,IAAI,aAAa,UAAa,CAAC,cAAc,QAAQ,GAAG,iBAAiB;CAC3E;CAEA,MAAM,YAAa,MAAkC;CACrD,IAAI,cAAc,QAAW,wBAAwB,SAAS;CAE9D,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,qBAAqB,cAAwD;CAC3F,MAAM,UAAU,aAAa,eAAe,iBAAiB;CAE7D,IAAI,YAAY,MAAM,MAAM,IAAI,MAAM,sBAAsB;CAE5D,IAAI;CAEJ,IAAI;EACF,SAAS,KAAK,MAAM,QAAQ,eAAe,EAAE;CAC/C,QAAQ;EACN,iBAAiB;CACnB;CAEA,OAAO,wBAAwB,MAAM;AACvC"}
+{"version":3,"file":"hydration-payload.mjs","names":[],"sources":["../../../../../../web/src/hydration-payload.ts"],"sourcesContent":["import {\n  PAYLOAD_SCRIPT_ID,\n  type HydrationDocumentPayloadSource,\n} from \"./components/document-context\";\n\nexport type { HydrationDocumentPayloadSource } from \"./components/document-context\";\nexport type {\n  ErrorPageProps,\n  SerializedErrorPageProps,\n  SerializedPageError,\n} from \"./components/document-context\";\n\n/**\n * Exported so a payload-shape assertion can be written against the contract\n * itself. A spec that hardcodes its own copy of this list silently becomes a\n * claim about a PAST revision — that is exactly how the rev. 3 keys landed with\n * two specs still asserting the rev. 2 shape.\n */\nexport const REQUIRED_PAYLOAD_KEYS = [\n  \"appData\",\n  \"layoutData\",\n  \"pageData\",\n  \"shared\",\n  \"name\",\n] as const;\n\nconst ABSENT_PAYLOAD_MESSAGE =\n  `Warlock hydration payload is absent: #${PAYLOAD_SCRIPT_ID}, owned by ` +\n  \"web/src/components/document-context.ts, was not found.\";\nconst MALFORMED_PAYLOAD_MESSAGE =\n  `Warlock hydration payload was found at #${PAYLOAD_SCRIPT_ID} but could not be read.`;\n\nfunction malformedPayload(): never {\n  throw new Error(MALFORMED_PAYLOAD_MESSAGE);\n}\n\n/**\n * The keys that are allowed to be ABSENT but not allowed to be wrong.\n *\n * `metadata`, `params` and `errorPage` are optional because the server is right\n * always produce them — a page with no `metadata` export resolves none, and a\n * older payload carries none of these additions. Failing a whole page over an\n * absent accessor would turn a compatible payload into a blank screen, so\n * absence is accepted.\n *\n * Present-but-not-an-object is a different claim entirely: it means something\n * produced a payload with these names meaning something else, and every reader\n * downstream would then be indexing a string. That is MALFORMED under the same\n * rule the required keys live by, so it throws. Arrays included — `typeof []`\n * is `\"object\"`, and an array of params is not params.\n */\nexport const OPTIONAL_OBJECT_PAYLOAD_KEYS = [\"metadata\", \"params\", \"errorPage\"] as const;\n\nfunction isPlainObject(value: unknown): boolean {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction hasExactStringKeys(\n  value: Record<PropertyKey, unknown>,\n  required: readonly string[],\n  optional: readonly string[] = [],\n): boolean {\n  const allowed = new Set([...required, ...optional]);\n  const keys = Reflect.ownKeys(value);\n\n  return (\n    required.every((key) => Object.prototype.hasOwnProperty.call(value, key)) &&\n    keys.every((key) => typeof key === \"string\" && allowed.has(key))\n  );\n}\n\n/**\n * Validate the explicit serialization boundary, not an `Error` instance.\n * `JSON.stringify(new Error(\"boom\"))` is normally `{}` because its useful\n * fields are non-enumerable; accepting that would hydrate an error page with a\n * different contract from the one the server rendered.\n */\nfunction requireErrorPagePayload(value: unknown): void {\n  if (!isPlainObject(value)) malformedPayload();\n\n  const errorPage = value as Record<PropertyKey, unknown>;\n\n  if (!hasExactStringKeys(errorPage, [\"error\", \"status\"])) malformedPayload();\n  if (!isPlainObject(errorPage.error)) malformedPayload();\n\n  const error = errorPage.error as Record<PropertyKey, unknown>;\n\n  if (!hasExactStringKeys(error, [\"name\", \"message\"], [\"stack\"])) malformedPayload();\n  if (typeof error.name !== \"string\" || typeof error.message !== \"string\") {\n    malformedPayload();\n  }\n  if (error.stack !== undefined && typeof error.stack !== \"string\") malformedPayload();\n\n  if (\n    typeof errorPage.status !== \"number\" ||\n    !Number.isInteger(errorPage.status) ||\n    errorPage.status < 500 ||\n    errorPage.status > 599\n  ) {\n    malformedPayload();\n  }\n}\n\nfunction requireHydrationPayload(value: unknown): HydrationDocumentPayloadSource {\n  if (!isPlainObject(value)) malformedPayload();\n\n  for (const key of REQUIRED_PAYLOAD_KEYS) {\n    if (!Object.prototype.hasOwnProperty.call(value, key)) malformedPayload();\n  }\n\n  for (const key of OPTIONAL_OBJECT_PAYLOAD_KEYS) {\n    const optional = (value as Record<string, unknown>)[key];\n\n    if (optional !== undefined && !isPlainObject(optional)) malformedPayload();\n  }\n\n  const errorPage = (value as Record<string, unknown>).errorPage;\n  if (errorPage !== undefined) requireErrorPagePayload(errorPage);\n\n  return value as HydrationDocumentPayloadSource;\n}\n\n/**\n * Read the fixed payload script without changing the server-rendered root.\n *\n * Extra fields are ignored. The gate owns the FIVE required keys — absent or\n * malformed, both throw — plus a shape check on the three optional ones\n * ({@link OPTIONAL_OBJECT_PAYLOAD_KEYS}); it deliberately does not require\n * those to be present. `errorPage`, when present, is additionally validated as\n * one atomic `{ error, status }` selection with a serialized error and a 5xx.\n */\nexport function readHydrationPayload(documentNode: Document): HydrationDocumentPayloadSource {\n  const element = documentNode.getElementById(PAYLOAD_SCRIPT_ID);\n\n  if (element === null) throw new Error(ABSENT_PAYLOAD_MESSAGE);\n\n  let parsed: unknown;\n\n  try {\n    parsed = JSON.parse(element.textContent ?? \"\");\n  } catch {\n    malformedPayload();\n  }\n\n  return requireHydrationPayload(parsed);\n}\n"],"mappings":";;;;;;;;;AAkBA,MAAa,wBAAwB;CACnC;CACA;CACA;CACA;CACA;AACF;AAEA,MAAM,yBACJ,yCAAyC,kBAAkB;AAE7D,MAAM,4BACJ,2CAA2C,kBAAkB;AAE/D,SAAS,mBAA0B;CACjC,MAAM,IAAI,MAAM,yBAAyB;AAC3C;;;;;;;;;;;;;;;;AAiBA,MAAa,+BAA+B;CAAC;CAAY;CAAU;AAAW;AAE9E,SAAS,cAAc,OAAyB;CAC9C,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,mBACP,OACA,UACA,WAA8B,CAAC,GACtB;CACT,MAAM,UAAU,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC;CAClD,MAAM,OAAO,QAAQ,QAAQ,KAAK;CAElC,OACE,SAAS,OAAO,QAAQ,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG,CAAC,KACxE,KAAK,OAAO,QAAQ,OAAO,QAAQ,YAAY,QAAQ,IAAI,GAAG,CAAC;AAEnE;;;;;;;AAQA,SAAS,wBAAwB,OAAsB;CACrD,IAAI,CAAC,cAAc,KAAK,GAAG,iBAAiB;CAE5C,MAAM,YAAY;CAElB,IAAI,CAAC,mBAAmB,WAAW,CAAC,SAAS,QAAQ,CAAC,GAAG,iBAAiB;CAC1E,IAAI,CAAC,cAAc,UAAU,KAAK,GAAG,iBAAiB;CAEtD,MAAM,QAAQ,UAAU;CAExB,IAAI,CAAC,mBAAmB,OAAO,CAAC,QAAQ,SAAS,GAAG,CAAC,OAAO,CAAC,GAAG,iBAAiB;CACjF,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,YAAY,UAC7D,iBAAiB;CAEnB,IAAI,MAAM,UAAU,UAAa,OAAO,MAAM,UAAU,UAAU,iBAAiB;CAEnF,IACE,OAAO,UAAU,WAAW,YAC5B,CAAC,OAAO,UAAU,UAAU,MAAM,KAClC,UAAU,SAAS,OACnB,UAAU,SAAS,KAEnB,iBAAiB;AAErB;AAEA,SAAS,wBAAwB,OAAgD;CAC/E,IAAI,CAAC,cAAc,KAAK,GAAG,iBAAiB;CAE5C,KAAK,MAAM,OAAO,uBAChB,IAAI,CAAC,OAAO,UAAU,eAAe,KAAK,OAAO,GAAG,GAAG,iBAAiB;CAG1E,KAAK,MAAM,OAAO,8BAA8B;EAC9C,MAAM,WAAY,MAAkC;EAEpD,IAAI,aAAa,UAAa,CAAC,cAAc,QAAQ,GAAG,iBAAiB;CAC3E;CAEA,MAAM,YAAa,MAAkC;CACrD,IAAI,cAAc,QAAW,wBAAwB,SAAS;CAE9D,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,qBAAqB,cAAwD;CAC3F,MAAM,UAAU,aAAa,eAAe,iBAAiB;CAE7D,IAAI,YAAY,MAAM,MAAM,IAAI,MAAM,sBAAsB;CAE5D,IAAI;CAEJ,IAAI;EACF,SAAS,KAAK,MAAM,QAAQ,eAAe,EAAE;CAC/C,QAAQ;EACN,iBAAiB;CACnB;CAEA,OAAO,wBAAwB,MAAM;AACvC"}

package/esm/index.d.mts

@@ -14,7 +14,7 @@ import { refresh } from "./client/navigation/refresh.mjs";
 import { Head } from "./components/head.mjs";
 import { Scripts } from "./components/scripts.mjs";
 
-//#region web/src/index.d.ts
+//#region ../web/src/index.d.ts
 /**
  * THE AUDIT SURFACE — everything the browser receives, declared by the app.
  *

package/esm/loaders.d.mts

@@ -4,7 +4,7 @@ import { PageValidation, ValidatedOutput } from "./validation.mjs";
 import { SharedContext } from "./index.mjs";
 import { Request, Response } from "@warlock.js/core";
 
-//#region web/src/loaders.d.ts
+//#region ../web/src/loaders.d.ts
 type PageLoaderContext<TValidation extends PageValidation | undefined, _TRoute extends RouteDeclaration | undefined> = {
   request: Request<ValidatedOutput<TValidation>>;
   response: Response;

package/esm/metadata.d.mts

@@ -1,7 +1,7 @@
 import { LoaderData, LoaderFunction } from "./props.mjs";
 import { SharedContext } from "./index.mjs";
 
-//#region web/src/metadata.d.ts
+//#region ../web/src/metadata.d.ts
 /**
  * What the `metadata` export may produce. The pipeline injects it into
  * `<head>` before the first byte; `<Head />` only decides placement.

package/esm/metadata.mjs

@@ -1,4 +1,4 @@
-//#region web/src/metadata.ts
+//#region ../web/src/metadata.ts
 /**
 * The SAME key set as {@link MetadataOutput}, as a value.
 *

package/esm/metadata.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.mjs","names":[],"sources":["C:/Work/Warlock.js/web/src/metadata.ts"],"sourcesContent":["import type { SharedContext } from \"./index\";\r\nimport type { LoaderData, LoaderFunction } from \"./props\";\r\n\r\n/**\r\n * What the `metadata` export may produce. The pipeline injects it into\r\n * `<head>` before the first byte; `<Head />` only decides placement.\r\n *\r\n * **Every member here is a member something READS.** The two renderers are\r\n * `components/head.ts:28-70` (the SSR'd document) and\r\n * `client/navigation/navigation-root.tsx:105-123` (the same head, rewritten\r\n * after a client navigation), and they agree key for key. This type is the list\r\n * of those keys and deliberately not one entry longer: a field the type promises\r\n * and no renderer consumes is the same silence as an unknown key — the page is\r\n * served without it and nothing says so.\r\n *\r\n * Adding a member is therefore a two-file change by construction. Add it here\r\n * and {@link METADATA_KEYS} stops matching, which is a compile error\r\n * ({@link MetadataKeysAreExact}); make it match and the build gate in\r\n * `build/discover-pages.ts` accepts the key — but until a renderer emits a tag\r\n * for it, the key still does nothing. Write the renderer.\r\n */\r\nexport type MetadataOutput = {\r\n  title?: string;\r\n  description?: string;\r\n  keywords?: string | readonly string[];\r\n  canonical?: string;\r\n  robots?: string;\r\n  /**\r\n   * `og:title`/`og:description` fall back to the top-level `title`/\r\n   * `description` when `openGraph` is present but the member is absent —\r\n   * no other member has a fallback.\r\n   */\r\n  openGraph?: {\r\n    title?: string;\r\n    description?: string;\r\n    image?: string;\r\n    url?: string;\r\n    type?: string;\r\n  };\r\n  twitter?: {\r\n    card?: string;\r\n    title?: string;\r\n    description?: string;\r\n    image?: string;\r\n  };\r\n};\r\n\r\n/**\r\n * The SAME key set as {@link MetadataOutput}, as a value.\r\n *\r\n * It exists because the defect this guards is one a type cannot reach.\r\n * `export const metadata = { tittle: \"x\" }` — no annotation — is a well-typed\r\n * program: TypeScript infers `{ tittle: string }` and has nothing to compare it\r\n * against, so the page is served with no title and the build says nothing. The\r\n * only place left to catch it is where pages are DISCOVERED, and discovery\r\n * refuses to run application code — it parses. A parser cannot ask a type what\r\n * its keys are, so the keys have to exist at runtime too.\r\n *\r\n * Two lists of one thing is exactly the drift this codebase refuses elsewhere,\r\n * so they are not two lists: {@link MetadataKeysAreExact} makes any\r\n * disagreement a compile error, in either direction. Add a key to the type\r\n * alone and this file stops compiling; add it here alone, likewise.\r\n */\r\nexport const METADATA_KEYS = [\r\n  \"title\",\r\n  \"description\",\r\n  \"keywords\",\r\n  \"canonical\",\r\n  \"robots\",\r\n  \"openGraph\",\r\n  \"twitter\",\r\n] as const;\r\n\r\n/** The members of `openGraph`, on the same terms as {@link METADATA_KEYS}. */\r\nexport const OPEN_GRAPH_KEYS = [\"title\", \"description\", \"image\", \"url\", \"type\"] as const;\r\n\r\n/** The members of `twitter`, on the same terms as {@link METADATA_KEYS}. */\r\nexport const TWITTER_KEYS = [\"card\", \"title\", \"description\", \"image\"] as const;\r\n\r\n/**\r\n * Instantiates only when `Difference` is empty. When it is not, the compiler\r\n * names the offending key in the error — \"Type '\\\"tittle\\\"' does not satisfy\r\n * the constraint 'never'\" — which is the whole message a drift needs.\r\n *\r\n * A mutual `extends` (`Exactly<A extends B, B extends A>`) says the same thing\r\n * more directly and TypeScript rejects it as a circular constraint (TS2313), so\r\n * the sets are compared by difference instead, once in each direction. BOTH\r\n * directions matter: a list that has fallen behind the type makes the build gate\r\n * reject a key it should accept, and a list that has run ahead makes it accept\r\n * one nothing renders.\r\n */\r\ntype NoDifference<Difference extends never> = Difference;\r\n\r\n/**\r\n * The drift guards, written out per key set rather than through one generic\r\n * helper: a `SameKeys<List, Keys>` alias would apply `NoDifference` to an\r\n * UNRESOLVED `Exclude<List, Keys>`, which the compiler cannot show is empty and\r\n * so rejects at the declaration (TS2344) whatever the real key sets are. Passed\r\n * concrete types, it resolves and checks the thing it is meant to check.\r\n *\r\n * Exported so they are not \"unused\", and named so a failure reads as what it\r\n * is: the key list and the type have diverged.\r\n */\r\nexport type MetadataKeysAreExact = [\r\n  NoDifference<Exclude<(typeof METADATA_KEYS)[number], keyof MetadataOutput>>,\r\n  NoDifference<Exclude<keyof MetadataOutput, (typeof METADATA_KEYS)[number]>>,\r\n];\r\n\r\ntype OpenGraphKey = keyof NonNullable<MetadataOutput[\"openGraph\"]>;\r\n\r\nexport type OpenGraphKeysAreExact = [\r\n  NoDifference<Exclude<(typeof OPEN_GRAPH_KEYS)[number], OpenGraphKey>>,\r\n  NoDifference<Exclude<OpenGraphKey, (typeof OPEN_GRAPH_KEYS)[number]>>,\r\n];\r\n\r\ntype TwitterKey = keyof NonNullable<MetadataOutput[\"twitter\"]>;\r\n\r\nexport type TwitterKeysAreExact = [\r\n  NoDifference<Exclude<(typeof TWITTER_KEYS)[number], TwitterKey>>,\r\n  NoDifference<Exclude<TwitterKey, (typeof TWITTER_KEYS)[number]>>,\r\n];\r\n\r\n/**\r\n * Static object OR a function of the loader's data (products.page.tsx:81-84,\r\n * product-details.page.tsx:71-74). The function form runs server-side, after\r\n * the loader, with the same `data` the component will receive — which is why\r\n * it can describe the page instead of guessing at it.\r\n *\r\n * **`data` is always present, and that is now true rather than merely\r\n * declared.** The function form runs only when the loader resolved; when it\r\n * rejected, the framework emits `ERROR_PAGE_METADATA` and this never runs\r\n * (`server/resolve-page-metadata.ts`, which explains why at length). An earlier\r\n * revision passed `{ data: undefined, error }` on the boundary path while\r\n * declaring `data` non-optional — every page that read `data` unguarded then\r\n * threw a `TypeError` that replaced the loader's real error.\r\n */\r\nexport type PageMetadata<TLoader extends LoaderFunction | undefined = undefined> =\r\n  | MetadataOutput\r\n  | ((context: {\r\n      data: LoaderData<TLoader>;\r\n      shared: Readonly<SharedContext>;\r\n    }) => MetadataOutput);\r\n"],"mappings":";;;;;;;;;;;;;;;;;AA+DA,MAAa,gBAAgB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,kBAAkB;CAAC;CAAS;CAAe;CAAS;CAAO;AAAM;;AAG9E,MAAa,eAAe;CAAC;CAAQ;CAAS;CAAe;AAAO"}
+{"version":3,"file":"metadata.mjs","names":[],"sources":["../../../../../../web/src/metadata.ts"],"sourcesContent":["import type { SharedContext } from \"./index\";\r\nimport type { LoaderData, LoaderFunction } from \"./props\";\r\n\r\n/**\r\n * What the `metadata` export may produce. The pipeline injects it into\r\n * `<head>` before the first byte; `<Head />` only decides placement.\r\n *\r\n * **Every member here is a member something READS.** The two renderers are\r\n * `components/head.ts:28-70` (the SSR'd document) and\r\n * `client/navigation/navigation-root.tsx:105-123` (the same head, rewritten\r\n * after a client navigation), and they agree key for key. This type is the list\r\n * of those keys and deliberately not one entry longer: a field the type promises\r\n * and no renderer consumes is the same silence as an unknown key — the page is\r\n * served without it and nothing says so.\r\n *\r\n * Adding a member is therefore a two-file change by construction. Add it here\r\n * and {@link METADATA_KEYS} stops matching, which is a compile error\r\n * ({@link MetadataKeysAreExact}); make it match and the build gate in\r\n * `build/discover-pages.ts` accepts the key — but until a renderer emits a tag\r\n * for it, the key still does nothing. Write the renderer.\r\n */\r\nexport type MetadataOutput = {\r\n  title?: string;\r\n  description?: string;\r\n  keywords?: string | readonly string[];\r\n  canonical?: string;\r\n  robots?: string;\r\n  /**\r\n   * `og:title`/`og:description` fall back to the top-level `title`/\r\n   * `description` when `openGraph` is present but the member is absent —\r\n   * no other member has a fallback.\r\n   */\r\n  openGraph?: {\r\n    title?: string;\r\n    description?: string;\r\n    image?: string;\r\n    url?: string;\r\n    type?: string;\r\n  };\r\n  twitter?: {\r\n    card?: string;\r\n    title?: string;\r\n    description?: string;\r\n    image?: string;\r\n  };\r\n};\r\n\r\n/**\r\n * The SAME key set as {@link MetadataOutput}, as a value.\r\n *\r\n * It exists because the defect this guards is one a type cannot reach.\r\n * `export const metadata = { tittle: \"x\" }` — no annotation — is a well-typed\r\n * program: TypeScript infers `{ tittle: string }` and has nothing to compare it\r\n * against, so the page is served with no title and the build says nothing. The\r\n * only place left to catch it is where pages are DISCOVERED, and discovery\r\n * refuses to run application code — it parses. A parser cannot ask a type what\r\n * its keys are, so the keys have to exist at runtime too.\r\n *\r\n * Two lists of one thing is exactly the drift this codebase refuses elsewhere,\r\n * so they are not two lists: {@link MetadataKeysAreExact} makes any\r\n * disagreement a compile error, in either direction. Add a key to the type\r\n * alone and this file stops compiling; add it here alone, likewise.\r\n */\r\nexport const METADATA_KEYS = [\r\n  \"title\",\r\n  \"description\",\r\n  \"keywords\",\r\n  \"canonical\",\r\n  \"robots\",\r\n  \"openGraph\",\r\n  \"twitter\",\r\n] as const;\r\n\r\n/** The members of `openGraph`, on the same terms as {@link METADATA_KEYS}. */\r\nexport const OPEN_GRAPH_KEYS = [\"title\", \"description\", \"image\", \"url\", \"type\"] as const;\r\n\r\n/** The members of `twitter`, on the same terms as {@link METADATA_KEYS}. */\r\nexport const TWITTER_KEYS = [\"card\", \"title\", \"description\", \"image\"] as const;\r\n\r\n/**\r\n * Instantiates only when `Difference` is empty. When it is not, the compiler\r\n * names the offending key in the error — \"Type '\\\"tittle\\\"' does not satisfy\r\n * the constraint 'never'\" — which is the whole message a drift needs.\r\n *\r\n * A mutual `extends` (`Exactly<A extends B, B extends A>`) says the same thing\r\n * more directly and TypeScript rejects it as a circular constraint (TS2313), so\r\n * the sets are compared by difference instead, once in each direction. BOTH\r\n * directions matter: a list that has fallen behind the type makes the build gate\r\n * reject a key it should accept, and a list that has run ahead makes it accept\r\n * one nothing renders.\r\n */\r\ntype NoDifference<Difference extends never> = Difference;\r\n\r\n/**\r\n * The drift guards, written out per key set rather than through one generic\r\n * helper: a `SameKeys<List, Keys>` alias would apply `NoDifference` to an\r\n * UNRESOLVED `Exclude<List, Keys>`, which the compiler cannot show is empty and\r\n * so rejects at the declaration (TS2344) whatever the real key sets are. Passed\r\n * concrete types, it resolves and checks the thing it is meant to check.\r\n *\r\n * Exported so they are not \"unused\", and named so a failure reads as what it\r\n * is: the key list and the type have diverged.\r\n */\r\nexport type MetadataKeysAreExact = [\r\n  NoDifference<Exclude<(typeof METADATA_KEYS)[number], keyof MetadataOutput>>,\r\n  NoDifference<Exclude<keyof MetadataOutput, (typeof METADATA_KEYS)[number]>>,\r\n];\r\n\r\ntype OpenGraphKey = keyof NonNullable<MetadataOutput[\"openGraph\"]>;\r\n\r\nexport type OpenGraphKeysAreExact = [\r\n  NoDifference<Exclude<(typeof OPEN_GRAPH_KEYS)[number], OpenGraphKey>>,\r\n  NoDifference<Exclude<OpenGraphKey, (typeof OPEN_GRAPH_KEYS)[number]>>,\r\n];\r\n\r\ntype TwitterKey = keyof NonNullable<MetadataOutput[\"twitter\"]>;\r\n\r\nexport type TwitterKeysAreExact = [\r\n  NoDifference<Exclude<(typeof TWITTER_KEYS)[number], TwitterKey>>,\r\n  NoDifference<Exclude<TwitterKey, (typeof TWITTER_KEYS)[number]>>,\r\n];\r\n\r\n/**\r\n * Static object OR a function of the loader's data (products.page.tsx:81-84,\r\n * product-details.page.tsx:71-74). The function form runs server-side, after\r\n * the loader, with the same `data` the component will receive — which is why\r\n * it can describe the page instead of guessing at it.\r\n *\r\n * **`data` is always present, and that is now true rather than merely\r\n * declared.** The function form runs only when the loader resolved; when it\r\n * rejected, the framework emits `ERROR_PAGE_METADATA` and this never runs\r\n * (`server/resolve-page-metadata.ts`, which explains why at length). An earlier\r\n * revision passed `{ data: undefined, error }` on the boundary path while\r\n * declaring `data` non-optional — every page that read `data` unguarded then\r\n * threw a `TypeError` that replaced the loader's real error.\r\n */\r\nexport type PageMetadata<TLoader extends LoaderFunction | undefined = undefined> =\r\n  | MetadataOutput\r\n  | ((context: {\r\n      data: LoaderData<TLoader>;\r\n      shared: Readonly<SharedContext>;\r\n    }) => MetadataOutput);\r\n"],"mappings":";;;;;;;;;;;;;;;;;AA+DA,MAAa,gBAAgB;CAC3B;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;AAGA,MAAa,kBAAkB;CAAC;CAAS;CAAe;CAAS;CAAO;AAAM;;AAG9E,MAAa,eAAe;CAAC;CAAQ;CAAS;CAAe;AAAO"}

package/esm/props.d.mts

@@ -2,7 +2,7 @@ import { SharedContext } from "./index.mjs";
 import { ReactNode } from "react";
 import { Response } from "@warlock.js/core";
 
-//#region web/src/props.d.ts
+//#region ../web/src/props.d.ts
 /** Any loader authored with `satisfies` — the concrete function type. */
 type LoaderFunction = (...args: any[]) => unknown;
 /**

package/esm/route.d.mts

@@ -1,4 +1,4 @@
-//#region web/src/route.d.ts
+//#region ../web/src/route.d.ts
 /**
  * The `route` export's accepted shapes: the configured object
  * (`{ path, name } as const` — the `as const` is what keeps `path` a literal

package/esm/routing/compose-route-path.d.mts

@@ -1,4 +1,4 @@
-//#region web/src/routing/compose-route-path.d.ts
+//#region ../web/src/routing/compose-route-path.d.ts
 /**
  * Route-path composition — the single, pure rule for turning a layout's
  * declared `prefix` and a page's declared `route.path` into the page's

package/esm/routing/compose-route-path.mjs

@@ -1,4 +1,4 @@
-//#region web/src/routing/compose-route-path.ts
+//#region ../web/src/routing/compose-route-path.ts
 /**
 * Route-path composition — the single, pure rule for turning a layout's
 * declared `prefix` and a page's declared `route.path` into the page's

package/esm/routing/compose-route-path.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"compose-route-path.mjs","names":[],"sources":["C:/Work/Warlock.js/web/src/routing/compose-route-path.ts"],"sourcesContent":["/**\n * Route-path composition — the single, pure rule for turning a layout's\n * declared `prefix` and a page's declared `route.path` into the page's\n * effective, registered path. Previously three hand-written copies: the dev\n * installer (`web/src/server/install-page-routes.ts`), the production\n * manifest installer (`web/src/server/install-page-routes-from-manifest.ts`)\n * and build discovery (`web/src/build/discover-pages.ts`) each carried this\n * exact rule so build and boot could not quietly disagree about it; all\n * three now delegate here instead.\n *\n * DIRECTORY CONTRACT — applies to everything in `web/src/routing/`: nothing\n * here may import `node:fs`, `node:path`, `vite`, or `fastify`. This module\n * receives canonical values and trusts nothing about them beyond the input\n * contract asserted below — it asserts rather than trusts, but it never\n * repairs.\n */\n\n/**\n * A page's effective path: its nearest layout's `prefix` followed by its own\n * declared `route.path`. A root prefix (\"/\") and a root path (\"/\") each\n * contribute nothing, so neither adds a slash of its own; every other case\n * joins on the slash `routePath` already starts with, which is what keeps a\n * double slash out of the result, and an empty concatenation is the site\n * root.\n */\nexport function composeRoutePath(layoutPrefix: string, routePath: string): string {\n  const normalizedPrefix = layoutPrefix === \"/\" ? \"\" : layoutPrefix.replace(/\\/+$/, \"\");\n  const normalizedRoute = routePath === \"/\" ? \"\" : routePath;\n  const composed = `${normalizedPrefix}${normalizedRoute}`;\n\n  return composed === \"\" ? \"/\" : composed;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,iBAAiB,cAAsB,WAA2B;CAGhF,MAAM,WAAW,GAFQ,iBAAiB,MAAM,KAAK,aAAa,QAAQ,QAAQ,EAAE,IAC5D,cAAc,MAAM,KAAK;CAGjD,OAAO,aAAa,KAAK,MAAM;AACjC"}
+{"version":3,"file":"compose-route-path.mjs","names":[],"sources":["../../../../../../../web/src/routing/compose-route-path.ts"],"sourcesContent":["/**\n * Route-path composition — the single, pure rule for turning a layout's\n * declared `prefix` and a page's declared `route.path` into the page's\n * effective, registered path. Previously three hand-written copies: the dev\n * installer (`web/src/server/install-page-routes.ts`), the production\n * manifest installer (`web/src/server/install-page-routes-from-manifest.ts`)\n * and build discovery (`web/src/build/discover-pages.ts`) each carried this\n * exact rule so build and boot could not quietly disagree about it; all\n * three now delegate here instead.\n *\n * DIRECTORY CONTRACT — applies to everything in `web/src/routing/`: nothing\n * here may import `node:fs`, `node:path`, `vite`, or `fastify`. This module\n * receives canonical values and trusts nothing about them beyond the input\n * contract asserted below — it asserts rather than trusts, but it never\n * repairs.\n */\n\n/**\n * A page's effective path: its nearest layout's `prefix` followed by its own\n * declared `route.path`. A root prefix (\"/\") and a root path (\"/\") each\n * contribute nothing, so neither adds a slash of its own; every other case\n * joins on the slash `routePath` already starts with, which is what keeps a\n * double slash out of the result, and an empty concatenation is the site\n * root.\n */\nexport function composeRoutePath(layoutPrefix: string, routePath: string): string {\n  const normalizedPrefix = layoutPrefix === \"/\" ? \"\" : layoutPrefix.replace(/\\/+$/, \"\");\n  const normalizedRoute = routePath === \"/\" ? \"\" : routePath;\n  const composed = `${normalizedPrefix}${normalizedRoute}`;\n\n  return composed === \"\" ? \"/\" : composed;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,SAAgB,iBAAiB,cAAsB,WAA2B;CAGhF,MAAM,WAAW,GAFQ,iBAAiB,MAAM,KAAK,aAAa,QAAQ,QAAQ,EAAE,IAC5D,cAAc,MAAM,KAAK;CAGjD,OAAO,aAAa,KAAK,MAAM;AACjC"}

package/esm/routing/data-request.mjs

@@ -1,4 +1,4 @@
-//#region web/src/routing/data-request.ts
+//#region ../web/src/routing/data-request.ts
 /**
 * The marker that turns a page request into a DATA request.
 *

package/esm/routing/data-request.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"data-request.mjs","names":[],"sources":["C:/Work/Warlock.js/web/src/routing/data-request.ts"],"sourcesContent":["/**\n * The marker that turns a page request into a DATA request.\n *\n * A client navigation needs exactly what a full page load needs — middleware,\n * validation, loaders, redirects, cookies, the settled status — and differs in\n * one respect only: it wants the hydration payload as JSON instead of a\n * rendered document. So it is deliberately NOT a separate `/_loader` route.\n *\n * WHY NOT A SEPARATE ROUTE. A `/_loader?path=/products/42` endpoint has to\n * resolve that path to a page itself, which is a SECOND implementation of route\n * semantics living beside the server's. This codebase already refuses that\n * bargain for the browser — the hydration payload carries the route `name` so\n * the client never re-matches — and the same reasoning applies here with more\n * force: a loader endpoint that disagreed with the real route about params,\n * prefixes or which page owns a path would answer a different request than the\n * one the user navigated to. Same URL, same route, same matcher, same pipeline;\n * only the final representation differs.\n *\n * WHY A HEADER AND NOT `?_data=1`. The query string belongs to the page — it is\n * what `validation` and loaders read. Injecting a framework key into it means a\n * page with strict query validation rejects its own client navigations, and\n * every loader that echoes its query starts leaking a private flag.\n *\n * Responses to a data request must carry `Vary: <this header>` so a shared\n * cache can never hand a document to a client that asked for JSON, or the\n * reverse. Page responses are `private, no-store` today, which makes that\n * theoretical — `Vary` is what keeps it theoretical if the caching policy\n * changes.\n */\nexport const WARLOCK_DATA_REQUEST_HEADER = \"x-warlock-data\";\n\n/**\n * The value the client sends. Any non-empty value is honoured on the way in —\n * the header's PRESENCE is the signal — but the client sends this one so the\n * traffic is self-describing in a log or a network panel.\n */\nexport const WARLOCK_DATA_REQUEST_VALUE = \"1\";\n\n/**\n * Declared explicitly because the payload goes on the wire ALREADY SERIALIZED,\n * as a string, and core only auto-picks `application/json` for object bodies.\n * See the send site for why it must be a string.\n */\nexport const DATA_RESPONSE_CONTENT_TYPE = \"application/json\";\n\n/**\n * Whether a request asked for the payload rather than the document.\n *\n * Presence-based on purpose: a proxy that rewrites the value, or a client on a\n * newer version that sends something more specific, still means \"data\". Only an\n * absent or empty header means \"render the document\".\n */\nexport function isDataRequest(headerValue: string | string[] | undefined): boolean {\n  const value = Array.isArray(headerValue) ? headerValue[0] : headerValue;\n\n  return typeof value === \"string\" && value.length > 0;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAa,8BAA8B;;;;;;AAc3C,MAAa,6BAA6B;;;;;;;;AAS1C,SAAgB,cAAc,aAAqD;CACjF,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,YAAY,KAAK;CAE5D,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD"}
+{"version":3,"file":"data-request.mjs","names":[],"sources":["../../../../../../../web/src/routing/data-request.ts"],"sourcesContent":["/**\n * The marker that turns a page request into a DATA request.\n *\n * A client navigation needs exactly what a full page load needs — middleware,\n * validation, loaders, redirects, cookies, the settled status — and differs in\n * one respect only: it wants the hydration payload as JSON instead of a\n * rendered document. So it is deliberately NOT a separate `/_loader` route.\n *\n * WHY NOT A SEPARATE ROUTE. A `/_loader?path=/products/42` endpoint has to\n * resolve that path to a page itself, which is a SECOND implementation of route\n * semantics living beside the server's. This codebase already refuses that\n * bargain for the browser — the hydration payload carries the route `name` so\n * the client never re-matches — and the same reasoning applies here with more\n * force: a loader endpoint that disagreed with the real route about params,\n * prefixes or which page owns a path would answer a different request than the\n * one the user navigated to. Same URL, same route, same matcher, same pipeline;\n * only the final representation differs.\n *\n * WHY A HEADER AND NOT `?_data=1`. The query string belongs to the page — it is\n * what `validation` and loaders read. Injecting a framework key into it means a\n * page with strict query validation rejects its own client navigations, and\n * every loader that echoes its query starts leaking a private flag.\n *\n * Responses to a data request must carry `Vary: <this header>` so a shared\n * cache can never hand a document to a client that asked for JSON, or the\n * reverse. Page responses are `private, no-store` today, which makes that\n * theoretical — `Vary` is what keeps it theoretical if the caching policy\n * changes.\n */\nexport const WARLOCK_DATA_REQUEST_HEADER = \"x-warlock-data\";\n\n/**\n * The value the client sends. Any non-empty value is honoured on the way in —\n * the header's PRESENCE is the signal — but the client sends this one so the\n * traffic is self-describing in a log or a network panel.\n */\nexport const WARLOCK_DATA_REQUEST_VALUE = \"1\";\n\n/**\n * Declared explicitly because the payload goes on the wire ALREADY SERIALIZED,\n * as a string, and core only auto-picks `application/json` for object bodies.\n * See the send site for why it must be a string.\n */\nexport const DATA_RESPONSE_CONTENT_TYPE = \"application/json\";\n\n/**\n * Whether a request asked for the payload rather than the document.\n *\n * Presence-based on purpose: a proxy that rewrites the value, or a client on a\n * newer version that sends something more specific, still means \"data\". Only an\n * absent or empty header means \"render the document\".\n */\nexport function isDataRequest(headerValue: string | string[] | undefined): boolean {\n  const value = Array.isArray(headerValue) ? headerValue[0] : headerValue;\n\n  return typeof value === \"string\" && value.length > 0;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,MAAa,8BAA8B;;;;;;AAc3C,MAAa,6BAA6B;;;;;;;;AAS1C,SAAgB,cAAc,aAAqD;CACjF,MAAM,QAAQ,MAAM,QAAQ,WAAW,IAAI,YAAY,KAAK;CAE5D,OAAO,OAAO,UAAU,YAAY,MAAM,SAAS;AACrD"}

package/esm/routing/filesystem-route.mjs

@@ -1,4 +1,4 @@
-//#region web/src/routing/filesystem-route.ts
+//#region ../web/src/routing/filesystem-route.ts
 function isGroup(segment) {
 	return /^\([^/]+\)$/.test(segment);
 }

package/esm/routing/filesystem-route.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-route.mjs","names":[],"sources":["C:/Work/Warlock.js/web/src/routing/filesystem-route.ts"],"sourcesContent":["export type FilesystemRouteInput = {\n  /** POSIX path relative to `src/web`, ending in `.page.tsx`. */\n  pageFile: string;\n  /** Layout prefixes keyed by their POSIX directory relative to `src/web`; root uses `\"\"`. */\n  layoutPrefixes?: Readonly<Record<string, string>>;\n};\n\nfunction isGroup(segment: string): boolean {\n  return /^\\([^/]+\\)$/.test(segment);\n}\n\nfunction routeSegment(segment: string): string {\n  const dynamic = /^\\[([A-Za-z_][A-Za-z0-9_]*)\\]$/.exec(segment);\n\n  return dynamic ? `:${dynamic[1]}` : segment;\n}\n\nfunction prefixSegments(prefix: string): string[] {\n  return prefix.split(\"/\").filter(Boolean);\n}\n\nfunction pageParts(pageFile: string): { directories: string[]; basename: string } {\n  if (pageFile.includes(\"\\\\\")) {\n    throw new Error(`filesystem-route: pageFile must use POSIX separators: \"${pageFile}\"`);\n  }\n\n  if (!pageFile.endsWith(\".page.tsx\")) {\n    throw new Error(`filesystem-route: pageFile must end in .page.tsx: \"${pageFile}\"`);\n  }\n\n  const parts = pageFile.split(\"/\");\n  const filename = parts.pop() as string;\n\n  return {\n    directories: parts,\n    basename: filename.slice(0, -\".page.tsx\".length),\n  };\n}\n\n/** Derive the effective URL for a page with no explicit `route` export. */\nexport function deriveFilesystemRoutePath(input: FilesystemRouteInput): string {\n  const { directories, basename } = pageParts(input.pageFile);\n  const prefixes = input.layoutPrefixes ?? {};\n  const segments = [...prefixSegments(prefixes[\"\"] ?? \"\")];\n\n  for (let index = 0; index < directories.length; index++) {\n    const directory = directories[index];\n    const directoryPath = directories.slice(0, index + 1).join(\"/\");\n    const prefix = prefixes[directoryPath];\n\n    if (prefix !== undefined) {\n      segments.push(...prefixSegments(prefix));\n    } else if (!isGroup(directory)) {\n      segments.push(routeSegment(directory));\n    }\n  }\n\n  if (basename !== \"index\") {\n    segments.push(routeSegment(basename));\n  }\n\n  return segments.length === 0 ? \"/\" : `/${segments.join(\"/\")}`;\n}\n\n/** Derive the stable dotted route name from a page's filesystem identity. */\nexport function deriveFilesystemRouteName(pageFile: string): string {\n  const { directories, basename } = pageParts(pageFile);\n  const segments = directories.filter((segment) => !isGroup(segment)).map(routeSegment);\n\n  if (basename !== \"index\") {\n    segments.push(routeSegment(basename));\n  }\n\n  return segments.map((segment) => segment.replace(/^:/, \"\")).join(\".\") || \"index\";\n}\n"],"mappings":";AAOA,SAAS,QAAQ,SAA0B;CACzC,OAAO,cAAc,KAAK,OAAO;AACnC;AAEA,SAAS,aAAa,SAAyB;CAC7C,MAAM,UAAU,iCAAiC,KAAK,OAAO;CAE7D,OAAO,UAAU,IAAI,QAAQ,OAAO;AACtC;AAEA,SAAS,eAAe,QAA0B;CAChD,OAAO,OAAO,MAAM,GAAG,EAAE,OAAO,OAAO;AACzC;AAEA,SAAS,UAAU,UAA+D;CAChF,IAAI,SAAS,SAAS,IAAI,GACxB,MAAM,IAAI,MAAM,0DAA0D,SAAS,EAAE;CAGvF,IAAI,CAAC,SAAS,SAAS,WAAW,GAChC,MAAM,IAAI,MAAM,sDAAsD,SAAS,EAAE;CAGnF,MAAM,QAAQ,SAAS,MAAM,GAAG;CAGhC,OAAO;EACL,aAAa;EACb,UAJe,MAAM,IAIJ,EAAE,MAAM,GAAG,EAAmB;CACjD;AACF;;AAGA,SAAgB,0BAA0B,OAAqC;CAC7E,MAAM,EAAE,aAAa,aAAa,UAAU,MAAM,QAAQ;CAC1D,MAAM,WAAW,MAAM,kBAAkB,CAAC;CAC1C,MAAM,WAAW,CAAC,GAAG,eAAe,SAAS,OAAO,EAAE,CAAC;CAEvD,KAAK,IAAI,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS;EACvD,MAAM,YAAY,YAAY;EAE9B,MAAM,SAAS,SADO,YAAY,MAAM,GAAG,QAAQ,CAAC,EAAE,KAAK,GACvB;EAEpC,IAAI,WAAW,QACb,SAAS,KAAK,GAAG,eAAe,MAAM,CAAC;OAClC,IAAI,CAAC,QAAQ,SAAS,GAC3B,SAAS,KAAK,aAAa,SAAS,CAAC;CAEzC;CAEA,IAAI,aAAa,SACf,SAAS,KAAK,aAAa,QAAQ,CAAC;CAGtC,OAAO,SAAS,WAAW,IAAI,MAAM,IAAI,SAAS,KAAK,GAAG;AAC5D;;AAGA,SAAgB,0BAA0B,UAA0B;CAClE,MAAM,EAAE,aAAa,aAAa,UAAU,QAAQ;CACpD,MAAM,WAAW,YAAY,QAAQ,YAAY,CAAC,QAAQ,OAAO,CAAC,EAAE,IAAI,YAAY;CAEpF,IAAI,aAAa,SACf,SAAS,KAAK,aAAa,QAAQ,CAAC;CAGtC,OAAO,SAAS,KAAK,YAAY,QAAQ,QAAQ,MAAM,EAAE,CAAC,EAAE,KAAK,GAAG,KAAK;AAC3E"}
+{"version":3,"file":"filesystem-route.mjs","names":[],"sources":["../../../../../../../web/src/routing/filesystem-route.ts"],"sourcesContent":["export type FilesystemRouteInput = {\n  /** POSIX path relative to `src/web`, ending in `.page.tsx`. */\n  pageFile: string;\n  /** Layout prefixes keyed by their POSIX directory relative to `src/web`; root uses `\"\"`. */\n  layoutPrefixes?: Readonly<Record<string, string>>;\n};\n\nfunction isGroup(segment: string): boolean {\n  return /^\\([^/]+\\)$/.test(segment);\n}\n\nfunction routeSegment(segment: string): string {\n  const dynamic = /^\\[([A-Za-z_][A-Za-z0-9_]*)\\]$/.exec(segment);\n\n  return dynamic ? `:${dynamic[1]}` : segment;\n}\n\nfunction prefixSegments(prefix: string): string[] {\n  return prefix.split(\"/\").filter(Boolean);\n}\n\nfunction pageParts(pageFile: string): { directories: string[]; basename: string } {\n  if (pageFile.includes(\"\\\\\")) {\n    throw new Error(`filesystem-route: pageFile must use POSIX separators: \"${pageFile}\"`);\n  }\n\n  if (!pageFile.endsWith(\".page.tsx\")) {\n    throw new Error(`filesystem-route: pageFile must end in .page.tsx: \"${pageFile}\"`);\n  }\n\n  const parts = pageFile.split(\"/\");\n  const filename = parts.pop() as string;\n\n  return {\n    directories: parts,\n    basename: filename.slice(0, -\".page.tsx\".length),\n  };\n}\n\n/** Derive the effective URL for a page with no explicit `route` export. */\nexport function deriveFilesystemRoutePath(input: FilesystemRouteInput): string {\n  const { directories, basename } = pageParts(input.pageFile);\n  const prefixes = input.layoutPrefixes ?? {};\n  const segments = [...prefixSegments(prefixes[\"\"] ?? \"\")];\n\n  for (let index = 0; index < directories.length; index++) {\n    const directory = directories[index];\n    const directoryPath = directories.slice(0, index + 1).join(\"/\");\n    const prefix = prefixes[directoryPath];\n\n    if (prefix !== undefined) {\n      segments.push(...prefixSegments(prefix));\n    } else if (!isGroup(directory)) {\n      segments.push(routeSegment(directory));\n    }\n  }\n\n  if (basename !== \"index\") {\n    segments.push(routeSegment(basename));\n  }\n\n  return segments.length === 0 ? \"/\" : `/${segments.join(\"/\")}`;\n}\n\n/** Derive the stable dotted route name from a page's filesystem identity. */\nexport function deriveFilesystemRouteName(pageFile: string): string {\n  const { directories, basename } = pageParts(pageFile);\n  const segments = directories.filter((segment) => !isGroup(segment)).map(routeSegment);\n\n  if (basename !== \"index\") {\n    segments.push(routeSegment(basename));\n  }\n\n  return segments.map((segment) => segment.replace(/^:/, \"\")).join(\".\") || \"index\";\n}\n"],"mappings":";AAOA,SAAS,QAAQ,SAA0B;CACzC,OAAO,cAAc,KAAK,OAAO;AACnC;AAEA,SAAS,aAAa,SAAyB;CAC7C,MAAM,UAAU,iCAAiC,KAAK,OAAO;CAE7D,OAAO,UAAU,IAAI,QAAQ,OAAO;AACtC;AAEA,SAAS,eAAe,QAA0B;CAChD,OAAO,OAAO,MAAM,GAAG,EAAE,OAAO,OAAO;AACzC;AAEA,SAAS,UAAU,UAA+D;CAChF,IAAI,SAAS,SAAS,IAAI,GACxB,MAAM,IAAI,MAAM,0DAA0D,SAAS,EAAE;CAGvF,IAAI,CAAC,SAAS,SAAS,WAAW,GAChC,MAAM,IAAI,MAAM,sDAAsD,SAAS,EAAE;CAGnF,MAAM,QAAQ,SAAS,MAAM,GAAG;CAGhC,OAAO;EACL,aAAa;EACb,UAJe,MAAM,IAIJ,EAAE,MAAM,GAAG,EAAmB;CACjD;AACF;;AAGA,SAAgB,0BAA0B,OAAqC;CAC7E,MAAM,EAAE,aAAa,aAAa,UAAU,MAAM,QAAQ;CAC1D,MAAM,WAAW,MAAM,kBAAkB,CAAC;CAC1C,MAAM,WAAW,CAAC,GAAG,eAAe,SAAS,OAAO,EAAE,CAAC;CAEvD,KAAK,IAAI,QAAQ,GAAG,QAAQ,YAAY,QAAQ,SAAS;EACvD,MAAM,YAAY,YAAY;EAE9B,MAAM,SAAS,SADO,YAAY,MAAM,GAAG,QAAQ,CAAC,EAAE,KAAK,GACvB;EAEpC,IAAI,WAAW,QACb,SAAS,KAAK,GAAG,eAAe,MAAM,CAAC;OAClC,IAAI,CAAC,QAAQ,SAAS,GAC3B,SAAS,KAAK,aAAa,SAAS,CAAC;CAEzC;CAEA,IAAI,aAAa,SACf,SAAS,KAAK,aAAa,QAAQ,CAAC;CAGtC,OAAO,SAAS,WAAW,IAAI,MAAM,IAAI,SAAS,KAAK,GAAG;AAC5D;;AAGA,SAAgB,0BAA0B,UAA0B;CAClE,MAAM,EAAE,aAAa,aAAa,UAAU,QAAQ;CACpD,MAAM,WAAW,YAAY,QAAQ,YAAY,CAAC,QAAQ,OAAO,CAAC,EAAE,IAAI,YAAY;CAEpF,IAAI,aAAa,SACf,SAAS,KAAK,aAAa,QAAQ,CAAC;CAGtC,OAAO,SAAS,KAAK,YAAY,QAAQ,QAAQ,MAAM,EAAE,CAAC,EAAE,KAAK,GAAG,KAAK;AAC3E"}

package/esm/routing/layout-policy.mjs

@@ -1,4 +1,4 @@
-//#region web/src/routing/layout-policy.ts
+//#region ../web/src/routing/layout-policy.ts
 /**
 * Raised when a `chain` passed to {@link selectPageLayout} contains an empty
 * layout identifier. An empty string is not a layout identifier a caller could

package/esm/routing/layout-policy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"layout-policy.mjs","names":[],"sources":["C:/Work/Warlock.js/web/src/routing/layout-policy.ts"],"sourcesContent":["/**\n * Layout policy — the single, pure rule for turning a page's ENUMERATED\n * layout chain into a selection decision.\n *\n * Enumeration and selection are deliberately separate concerns. Discovery\n * ({@link \"../build/discover-pages.ts\"}'s `layoutChainFor`) walks a page's\n * directory ancestry and reports every `layout.tsx` it finds, outermost\n * first, honestly and unfiltered — it does not decide whether that chain is\n * usable. This module is the one place that decision is made: given a chain,\n * how many layouts does composition get to use, and which one(s)?\n *\n * THE RULE COUNTS RENDERING LAYOUTS, NOT FILES. A layout that contributes no\n * element to the document — one with no default export, carrying only\n * `prefix`, `middleware` or other named exports — is not a second wrapper and\n * never was. Counting files instead of wrappers made an authorization boundary\n * indistinguishable from a nested layout, and the resulting refusal told app\n * authors to delete the boundary to make the build pass. Nested RENDERING\n * layouts remain unsupported; everything else composes freely.\n *\n * DIRECTORY CONTRACT — applies to everything in `web/src/routing/`: nothing\n * here may import `node:fs`, `node:path`, `vite`, or `fastify`. This module\n * receives a canonical chain and trusts nothing about it beyond the input\n * contract asserted below — it asserts rather than trusts, but it never\n * repairs. It therefore never DECIDES what renders either: that answer needs\n * the filesystem, so the caller — which has it — classifies each entry and\n * passes the classification in. Discovery owns the fact; this module owns the\n * rule. The `layout` identifiers are opaque (paths, in practice) and this\n * module never inspects their shape; it only counts and selects.\n *\n * REJECTION IS DATA, NOT A THROW: a chain with two or more rendering layouts\n * does not make {@link selectPageLayout} raise — it returns the rejected\n * rendering layouts, in order. What a rejection MEANS to the user is\n * nonetheless fixed here: {@link NestedLayoutsNotSupportedError} is the single\n * error contract for it — one class, one message shape, built from the\n * rejection data plus caller-supplied page identity. Callers decide only WHEN\n * to raise it and supply that context; none of them wraps the rejection in a\n * category or wording of its own. A shared policy whose failure semantics fork\n * per caller is shared in the happy path and forked in the sad one — and the\n * sad path is the one users meet.\n */\n\n/**\n * One layout in a chain, with the caller's answer to the only question this\n * module needs about it: does it render?\n *\n * `renders` is true when the layout's module has a default export — the thing\n * that puts an element in the document. Everything else it exports (`prefix`,\n * `middleware`, helpers) is invisible to this rule.\n */\nexport type LayoutChainEntry = {\n  /** Opaque identifier for the layout — an app-root-relative POSIX path, in practice. */\n  layout: string;\n  /** Whether this layout contributes an element to the document. */\n  renders: boolean;\n};\n\n/**\n * A chain as {@link selectPageLayout} accepts it: classified entries, or bare\n * identifiers for a caller that has not classified its chain yet.\n *\n * TRANSITIONAL: a bare string is read as a RENDERING layout, which is the\n * conservative reading (it can only make the rule stricter, never looser) and\n * reproduces this module's pre-classification behaviour exactly. It exists so\n * the boot-time manifest installer — which holds loaded modules rather than\n * source files — keeps working unchanged until it classifies too; remove the\n * string arm once every caller passes {@link LayoutChainEntry}s.\n */\nexport type LayoutChainInput = readonly (string | LayoutChainEntry)[];\n\n/**\n * The policy's decision for one page's layout chain:\n *\n * - `\"none\"` — no layout on the chain renders; the page composes against no\n *   layout. A chain of three middleware-only layouts lands here exactly as an\n *   empty chain does, because neither has a wrapper in it.\n * - `\"selected\"` — exactly one layout renders; `layout` is that element, which,\n *   being the only rendering one, is simultaneously the outermost and the\n *   nearest rendering layout — there is no distinction to draw between the two\n *   when there is only one.\n * - `\"rejected\"` — more than one layout renders; `layouts` carries the\n *   RENDERING layouts only, outermost-first, in chain order, so a consumer can\n *   name every layout actually at fault without naming the guards between them.\n */\nexport type LayoutPolicyResult =\n  | { type: \"none\" }\n  | { type: \"selected\"; layout: string }\n  | { type: \"rejected\"; layouts: readonly string[] };\n\n/**\n * Raised when a `chain` passed to {@link selectPageLayout} contains an empty\n * layout identifier. An empty string is not a layout identifier a caller could\n * have meant; this module refuses it rather than silently treating it as\n * absent or as a real selection.\n */\nexport class EmptyLayoutChainEntryError extends Error {\n  public constructor(public readonly chain: readonly string[]) {\n    super(\n      `layout-policy: chain [${chain.map((entry) => `\"${entry}\"`).join(\", \")}] contains an empty ` +\n        \"string. Every element of a layout chain passed to selectPageLayout must be a non-empty \" +\n        \"layout identifier — omit the entry entirely rather than passing an empty string for it.\",\n    );\n    this.name = \"EmptyLayoutChainEntryError\";\n  }\n}\n\n/**\n * The single error contract for a `rejected` selection — the one class and\n * one message every caller of {@link selectPageLayout} raises when it refuses\n * a page whose path holds more than one RENDERING layout. `pageFile` and\n * `layoutFiles` are the caller's context (its audience-appropriate identifiers\n * for the page and the rejected rendering layouts — app-root-relative POSIX\n * paths, in practice); the category and wording are this module's.\n *\n * The wording names the rendering layouts and ONLY the rendering layouts, and\n * it does not offer removal as a remedy. Its predecessor said \"remove or\n * consolidate the extra layout\", which, on a chain whose second element was a\n * `middleware`-only authorization boundary, instructed the reader to delete\n * their security guard to make the build pass.\n */\nexport class NestedLayoutsNotSupportedError extends Error {\n  public constructor(\n    public readonly pageFile: string,\n    public readonly layoutFiles: readonly string[],\n  ) {\n    super(\n      `\"${pageFile}\" has more than one layout on its path that renders: ` +\n        `${layoutFiles.map((file) => `\"${file}\"`).join(\", \")}. Pages currently support at most one ` +\n        \"RENDERING layout — a layout with a default export — and nesting more than one is not yet \" +\n        \"supported. Layouts that render nothing, such as a `prefix`- or `middleware`-only layout, \" +\n        \"do not count against this and may nest freely. To fix: consolidate the rendering layouts \" +\n        \"named above into one — and do not remove a middleware-only layout to satisfy this, since \" +\n        \"none of them is what this refuses.\",\n    );\n    this.name = \"NestedLayoutsNotSupportedError\";\n  }\n}\n\n/** The classified form of an entry, whichever way the caller spelled it. */\nfunction toEntry(entry: string | LayoutChainEntry): LayoutChainEntry {\n  return typeof entry === \"string\" ? { layout: entry, renders: true } : entry;\n}\n\n/**\n * Selects which layout, if any, a page RENDERS inside, given its layout chain\n * as enumerated outermost-first.\n *\n * Only entries with `renders: true` are counted: no rendering layout yields\n * `{ type: \"none\" }`; exactly one yields `{ type: \"selected\"; layout }`; more\n * than one yields `{ type: \"rejected\"; layouts }` carrying just those rendering\n * layouts — this function throws nothing for that case; see the module doc for\n * why rejection is data, not a throw.\n *\n * Throws {@link EmptyLayoutChainEntryError} when any entry's identifier is an\n * empty string — the one input-contract violation this module refuses rather\n * than passes through as a selection.\n */\nexport function selectPageLayout(chain: LayoutChainInput): LayoutPolicyResult {\n  const entries = chain.map(toEntry);\n\n  if (entries.some((entry) => entry.layout === \"\")) {\n    throw new EmptyLayoutChainEntryError(entries.map((entry) => entry.layout));\n  }\n\n  const rendering = entries.filter((entry) => entry.renders).map((entry) => entry.layout);\n\n  if (rendering.length === 0) {\n    return { type: \"none\" };\n  }\n\n  if (rendering.length === 1) {\n    return { type: \"selected\", layout: rendering[0] };\n  }\n\n  return { type: \"rejected\", layouts: rendering };\n}\n"],"mappings":";;;;;;;AA8FA,IAAa,6BAAb,cAAgD,MAAM;CACjB;CAAnC,AAAO,YAAY,AAAgB,OAA0B;EAC3D,MACE,yBAAyB,MAAM,KAAK,UAAU,IAAI,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE,mMAGzE;EALiC;EAMjC,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;;AAgBA,IAAa,iCAAb,cAAoD,MAAM;CAEtC;CACA;CAFlB,AAAO,YACL,AAAgB,UAChB,AAAgB,aAChB;EACA,MACE,IAAI,SAAS,uDACR,YAAY,KAAK,SAAS,IAAI,KAAK,EAAE,EAAE,KAAK,IAAI,EAAE,ibAMzD;EAXgB;EACA;EAWhB,KAAK,OAAO;CACd;AACF;;AAGA,SAAS,QAAQ,OAAoD;CACnE,OAAO,OAAO,UAAU,WAAW;EAAE,QAAQ;EAAO,SAAS;CAAK,IAAI;AACxE;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAA6C;CAC5E,MAAM,UAAU,MAAM,IAAI,OAAO;CAEjC,IAAI,QAAQ,MAAM,UAAU,MAAM,WAAW,EAAE,GAC7C,MAAM,IAAI,2BAA2B,QAAQ,KAAK,UAAU,MAAM,MAAM,CAAC;CAG3E,MAAM,YAAY,QAAQ,QAAQ,UAAU,MAAM,OAAO,EAAE,KAAK,UAAU,MAAM,MAAM;CAEtF,IAAI,UAAU,WAAW,GACvB,OAAO,EAAE,MAAM,OAAO;CAGxB,IAAI,UAAU,WAAW,GACvB,OAAO;EAAE,MAAM;EAAY,QAAQ,UAAU;CAAG;CAGlD,OAAO;EAAE,MAAM;EAAY,SAAS;CAAU;AAChD"}
+{"version":3,"file":"layout-policy.mjs","names":[],"sources":["../../../../../../../web/src/routing/layout-policy.ts"],"sourcesContent":["/**\n * Layout policy — the single, pure rule for turning a page's ENUMERATED\n * layout chain into a selection decision.\n *\n * Enumeration and selection are deliberately separate concerns. Discovery\n * ({@link \"../build/discover-pages.ts\"}'s `layoutChainFor`) walks a page's\n * directory ancestry and reports every `layout.tsx` it finds, outermost\n * first, honestly and unfiltered — it does not decide whether that chain is\n * usable. This module is the one place that decision is made: given a chain,\n * how many layouts does composition get to use, and which one(s)?\n *\n * THE RULE COUNTS RENDERING LAYOUTS, NOT FILES. A layout that contributes no\n * element to the document — one with no default export, carrying only\n * `prefix`, `middleware` or other named exports — is not a second wrapper and\n * never was. Counting files instead of wrappers made an authorization boundary\n * indistinguishable from a nested layout, and the resulting refusal told app\n * authors to delete the boundary to make the build pass. Nested RENDERING\n * layouts remain unsupported; everything else composes freely.\n *\n * DIRECTORY CONTRACT — applies to everything in `web/src/routing/`: nothing\n * here may import `node:fs`, `node:path`, `vite`, or `fastify`. This module\n * receives a canonical chain and trusts nothing about it beyond the input\n * contract asserted below — it asserts rather than trusts, but it never\n * repairs. It therefore never DECIDES what renders either: that answer needs\n * the filesystem, so the caller — which has it — classifies each entry and\n * passes the classification in. Discovery owns the fact; this module owns the\n * rule. The `layout` identifiers are opaque (paths, in practice) and this\n * module never inspects their shape; it only counts and selects.\n *\n * REJECTION IS DATA, NOT A THROW: a chain with two or more rendering layouts\n * does not make {@link selectPageLayout} raise — it returns the rejected\n * rendering layouts, in order. What a rejection MEANS to the user is\n * nonetheless fixed here: {@link NestedLayoutsNotSupportedError} is the single\n * error contract for it — one class, one message shape, built from the\n * rejection data plus caller-supplied page identity. Callers decide only WHEN\n * to raise it and supply that context; none of them wraps the rejection in a\n * category or wording of its own. A shared policy whose failure semantics fork\n * per caller is shared in the happy path and forked in the sad one — and the\n * sad path is the one users meet.\n */\n\n/**\n * One layout in a chain, with the caller's answer to the only question this\n * module needs about it: does it render?\n *\n * `renders` is true when the layout's module has a default export — the thing\n * that puts an element in the document. Everything else it exports (`prefix`,\n * `middleware`, helpers) is invisible to this rule.\n */\nexport type LayoutChainEntry = {\n  /** Opaque identifier for the layout — an app-root-relative POSIX path, in practice. */\n  layout: string;\n  /** Whether this layout contributes an element to the document. */\n  renders: boolean;\n};\n\n/**\n * A chain as {@link selectPageLayout} accepts it: classified entries, or bare\n * identifiers for a caller that has not classified its chain yet.\n *\n * TRANSITIONAL: a bare string is read as a RENDERING layout, which is the\n * conservative reading (it can only make the rule stricter, never looser) and\n * reproduces this module's pre-classification behaviour exactly. It exists so\n * the boot-time manifest installer — which holds loaded modules rather than\n * source files — keeps working unchanged until it classifies too; remove the\n * string arm once every caller passes {@link LayoutChainEntry}s.\n */\nexport type LayoutChainInput = readonly (string | LayoutChainEntry)[];\n\n/**\n * The policy's decision for one page's layout chain:\n *\n * - `\"none\"` — no layout on the chain renders; the page composes against no\n *   layout. A chain of three middleware-only layouts lands here exactly as an\n *   empty chain does, because neither has a wrapper in it.\n * - `\"selected\"` — exactly one layout renders; `layout` is that element, which,\n *   being the only rendering one, is simultaneously the outermost and the\n *   nearest rendering layout — there is no distinction to draw between the two\n *   when there is only one.\n * - `\"rejected\"` — more than one layout renders; `layouts` carries the\n *   RENDERING layouts only, outermost-first, in chain order, so a consumer can\n *   name every layout actually at fault without naming the guards between them.\n */\nexport type LayoutPolicyResult =\n  | { type: \"none\" }\n  | { type: \"selected\"; layout: string }\n  | { type: \"rejected\"; layouts: readonly string[] };\n\n/**\n * Raised when a `chain` passed to {@link selectPageLayout} contains an empty\n * layout identifier. An empty string is not a layout identifier a caller could\n * have meant; this module refuses it rather than silently treating it as\n * absent or as a real selection.\n */\nexport class EmptyLayoutChainEntryError extends Error {\n  public constructor(public readonly chain: readonly string[]) {\n    super(\n      `layout-policy: chain [${chain.map((entry) => `\"${entry}\"`).join(\", \")}] contains an empty ` +\n        \"string. Every element of a layout chain passed to selectPageLayout must be a non-empty \" +\n        \"layout identifier — omit the entry entirely rather than passing an empty string for it.\",\n    );\n    this.name = \"EmptyLayoutChainEntryError\";\n  }\n}\n\n/**\n * The single error contract for a `rejected` selection — the one class and\n * one message every caller of {@link selectPageLayout} raises when it refuses\n * a page whose path holds more than one RENDERING layout. `pageFile` and\n * `layoutFiles` are the caller's context (its audience-appropriate identifiers\n * for the page and the rejected rendering layouts — app-root-relative POSIX\n * paths, in practice); the category and wording are this module's.\n *\n * The wording names the rendering layouts and ONLY the rendering layouts, and\n * it does not offer removal as a remedy. Its predecessor said \"remove or\n * consolidate the extra layout\", which, on a chain whose second element was a\n * `middleware`-only authorization boundary, instructed the reader to delete\n * their security guard to make the build pass.\n */\nexport class NestedLayoutsNotSupportedError extends Error {\n  public constructor(\n    public readonly pageFile: string,\n    public readonly layoutFiles: readonly string[],\n  ) {\n    super(\n      `\"${pageFile}\" has more than one layout on its path that renders: ` +\n        `${layoutFiles.map((file) => `\"${file}\"`).join(\", \")}. Pages currently support at most one ` +\n        \"RENDERING layout — a layout with a default export — and nesting more than one is not yet \" +\n        \"supported. Layouts that render nothing, such as a `prefix`- or `middleware`-only layout, \" +\n        \"do not count against this and may nest freely. To fix: consolidate the rendering layouts \" +\n        \"named above into one — and do not remove a middleware-only layout to satisfy this, since \" +\n        \"none of them is what this refuses.\",\n    );\n    this.name = \"NestedLayoutsNotSupportedError\";\n  }\n}\n\n/** The classified form of an entry, whichever way the caller spelled it. */\nfunction toEntry(entry: string | LayoutChainEntry): LayoutChainEntry {\n  return typeof entry === \"string\" ? { layout: entry, renders: true } : entry;\n}\n\n/**\n * Selects which layout, if any, a page RENDERS inside, given its layout chain\n * as enumerated outermost-first.\n *\n * Only entries with `renders: true` are counted: no rendering layout yields\n * `{ type: \"none\" }`; exactly one yields `{ type: \"selected\"; layout }`; more\n * than one yields `{ type: \"rejected\"; layouts }` carrying just those rendering\n * layouts — this function throws nothing for that case; see the module doc for\n * why rejection is data, not a throw.\n *\n * Throws {@link EmptyLayoutChainEntryError} when any entry's identifier is an\n * empty string — the one input-contract violation this module refuses rather\n * than passes through as a selection.\n */\nexport function selectPageLayout(chain: LayoutChainInput): LayoutPolicyResult {\n  const entries = chain.map(toEntry);\n\n  if (entries.some((entry) => entry.layout === \"\")) {\n    throw new EmptyLayoutChainEntryError(entries.map((entry) => entry.layout));\n  }\n\n  const rendering = entries.filter((entry) => entry.renders).map((entry) => entry.layout);\n\n  if (rendering.length === 0) {\n    return { type: \"none\" };\n  }\n\n  if (rendering.length === 1) {\n    return { type: \"selected\", layout: rendering[0] };\n  }\n\n  return { type: \"rejected\", layouts: rendering };\n}\n"],"mappings":";;;;;;;AA8FA,IAAa,6BAAb,cAAgD,MAAM;CACjB;CAAnC,AAAO,YAAY,AAAgB,OAA0B;EAC3D,MACE,yBAAyB,MAAM,KAAK,UAAU,IAAI,MAAM,EAAE,EAAE,KAAK,IAAI,EAAE,mMAGzE;EALiC;EAMjC,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;;;AAgBA,IAAa,iCAAb,cAAoD,MAAM;CAEtC;CACA;CAFlB,AAAO,YACL,AAAgB,UAChB,AAAgB,aAChB;EACA,MACE,IAAI,SAAS,uDACR,YAAY,KAAK,SAAS,IAAI,KAAK,EAAE,EAAE,KAAK,IAAI,EAAE,ibAMzD;EAXgB;EACA;EAWhB,KAAK,OAAO;CACd;AACF;;AAGA,SAAS,QAAQ,OAAoD;CACnE,OAAO,OAAO,UAAU,WAAW;EAAE,QAAQ;EAAO,SAAS;CAAK,IAAI;AACxE;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAA6C;CAC5E,MAAM,UAAU,MAAM,IAAI,OAAO;CAEjC,IAAI,QAAQ,MAAM,UAAU,MAAM,WAAW,EAAE,GAC7C,MAAM,IAAI,2BAA2B,QAAQ,KAAK,UAAU,MAAM,MAAM,CAAC;CAG3E,MAAM,YAAY,QAAQ,QAAQ,UAAU,MAAM,OAAO,EAAE,KAAK,UAAU,MAAM,MAAM;CAEtF,IAAI,UAAU,WAAW,GACvB,OAAO,EAAE,MAAM,OAAO;CAGxB,IAAI,UAAU,WAAW,GACvB,OAAO;EAAE,MAAM;EAAY,QAAQ,UAAU;CAAG;CAGlD,OAAO;EAAE,MAAM;EAAY,SAAS;CAAU;AAChD"}

package/esm/routing/navigator.mjs

@@ -1,4 +1,4 @@
-//#region web/src/routing/navigator.ts
+//#region ../web/src/routing/navigator.ts
 let navigator;
 /**
 * Installed by the navigation runtime at mount, and torn down with `undefined`.

package/esm/routing/navigator.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"navigator.mjs","names":[],"sources":["C:/Work/Warlock.js/web/src/routing/navigator.ts"],"sourcesContent":["/**\n * The one seam between `<Link>` and the client navigation runtime.\n *\n * `<Link>` is UNIVERSAL — the same component renders on the server and in the\n * browser — so it cannot import the runtime: doing so would drag `fetch`, the\n * page registry and React state into the server render, and into the bundle of\n * any app that never navigates client-side.\n *\n * So the runtime REGISTERS itself here instead, and `<Link>` asks. On the\n * server nothing has registered, `currentNavigator()` is `undefined`, and the\n * anchor behaves as a plain anchor — which is exactly right, because on the\n * server it IS a plain anchor.\n *\n * This is also what makes the feature progressively enhancing rather than\n * load-bearing: until the hydration bundle has run and registered, every link\n * on the page still works as an ordinary link.\n */\n\n/**\n * @returns `true` if the runtime accepted the navigation and the caller should\n * suppress the browser's default. `false` means \"not mine\" — let the browser do\n * what it was going to do.\n */\nexport type Navigator = (url: string, options?: { replace?: boolean }) => boolean;\n\nlet navigator: Navigator | undefined;\n\n/**\n * Installed by the navigation runtime at mount, and torn down with `undefined`.\n *\n * @returns the previous navigator, so a caller that installs one can restore\n * what was there — the same shape the other `connect*` seams in this package\n * use, and what makes a test able to leave the module as it found it.\n */\nexport function connectNavigator(next: Navigator | undefined): Navigator | undefined {\n  const previous = navigator;\n\n  navigator = next;\n\n  return previous;\n}\n\nexport function currentNavigator(): Navigator | undefined {\n  return navigator;\n}\n"],"mappings":";AAyBA,IAAI;;;;;;;;AASJ,SAAgB,iBAAiB,MAAoD;CACnF,MAAM,WAAW;CAEjB,YAAY;CAEZ,OAAO;AACT;AAEA,SAAgB,mBAA0C;CACxD,OAAO;AACT"}
+{"version":3,"file":"navigator.mjs","names":[],"sources":["../../../../../../../web/src/routing/navigator.ts"],"sourcesContent":["/**\n * The one seam between `<Link>` and the client navigation runtime.\n *\n * `<Link>` is UNIVERSAL — the same component renders on the server and in the\n * browser — so it cannot import the runtime: doing so would drag `fetch`, the\n * page registry and React state into the server render, and into the bundle of\n * any app that never navigates client-side.\n *\n * So the runtime REGISTERS itself here instead, and `<Link>` asks. On the\n * server nothing has registered, `currentNavigator()` is `undefined`, and the\n * anchor behaves as a plain anchor — which is exactly right, because on the\n * server it IS a plain anchor.\n *\n * This is also what makes the feature progressively enhancing rather than\n * load-bearing: until the hydration bundle has run and registered, every link\n * on the page still works as an ordinary link.\n */\n\n/**\n * @returns `true` if the runtime accepted the navigation and the caller should\n * suppress the browser's default. `false` means \"not mine\" — let the browser do\n * what it was going to do.\n */\nexport type Navigator = (url: string, options?: { replace?: boolean }) => boolean;\n\nlet navigator: Navigator | undefined;\n\n/**\n * Installed by the navigation runtime at mount, and torn down with `undefined`.\n *\n * @returns the previous navigator, so a caller that installs one can restore\n * what was there — the same shape the other `connect*` seams in this package\n * use, and what makes a test able to leave the module as it found it.\n */\nexport function connectNavigator(next: Navigator | undefined): Navigator | undefined {\n  const previous = navigator;\n\n  navigator = next;\n\n  return previous;\n}\n\nexport function currentNavigator(): Navigator | undefined {\n  return navigator;\n}\n"],"mappings":";AAyBA,IAAI;;;;;;;;AASJ,SAAgB,iBAAiB,MAAoD;CACnF,MAAM,WAAW;CAEjB,YAAY;CAEZ,OAAO;AACT;AAEA,SAAgB,mBAA0C;CACxD,OAAO;AACT"}

package/esm/routing/query-string.d.mts

@@ -1,4 +1,4 @@
-//#region web/src/routing/query-string.d.ts
+//#region ../web/src/routing/query-string.d.ts
 /**
  * The query string: BOTH directions, one grammar, one file.
  *

package/esm/routing/query-string.mjs

@@ -1,4 +1,4 @@
-//#region web/src/routing/query-string.ts
+//#region ../web/src/routing/query-string.ts
 /**
 * Thrown when a query value has a shape the wire format cannot carry.
 *

package/esm/routing/query-string.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"query-string.mjs","names":[],"sources":["C:/Work/Warlock.js/web/src/routing/query-string.ts"],"sourcesContent":["/**\n * The query string: BOTH directions, one grammar, one file.\n *\n * ── The rule this module exists to obey ──────────────────────────────────────\n *\n * `queryStringOf` is what `href(name, params, query)` appends, and therefore\n * what every `<Link>` puts in the document; `queryString.parse` is what reads it\n * back. They live together because a second, independently-written\n * query-string implementation would mean one thing writes URLs and a different\n * thing reads them. Query-string libraries genuinely disagree about arrays,\n * nested objects and space escaping, so the moment the two drift the round trip\n * loses data SILENTLY — the wrong value renders and no error is raised\n * anywhere. That is the two-route-matchers failure class (canon 9c8f878b) one\n * layer down.\n *\n * Escaping is not two rules that agree today. Both directions stand on\n * `URLSearchParams`: the encoder builds one and calls `.toString()`, the decoder\n * hands the string back to `new URLSearchParams(...)`. `+`-for-space and every\n * percent-encoding rule are therefore ONE rule and cannot drift.\n *\n * ── The grammar, and why it is not ours to choose ────────────────────────────\n *\n * Structure — arrays and nested objects — is the part `URLSearchParams` has no\n * opinion about, so it was read off the SERVER rather than invented. Warlock is\n * a backend framework and core already parses query strings for list endpoints\n * and filters; a client that emitted anything else would not have fixed this\n * module's bug, it would have moved it across the wire where it is harder to\n * see. Measured, with file:line, in\n * `reports/query-grammar-findings-2026-08-24.md`:\n *\n *   - `core/src/http/server.ts:14-36` configures Fastify with NO\n *     `querystringParser`, so find-my-way's `fast-querystring` default applies:\n *     flat keys, `+` is a space, a repeated key collapses to an array.\n *   - `core/src/http/request.ts:491` then runs `request.query` through\n *     `parseBody` — the SAME bracket-aware parser as the request body.\n *   - `core/src/http/request.ts:516-520` reads `key[]` as an array marker, and\n *     `:568-575` wraps a single `key[]=a` into the one-element array `[\"a\"]`.\n *   - `core/src/http/request.ts:557-561` turns `key[sub]=v` into\n *     `{key: {sub: v}}`, one level deep.\n *\n * So: `tags[]=a&tags[]=b` for arrays, `filter[status]=active` for objects,\n * `filter[tags][]=a` for an array inside an object. Bare repeated keys\n * (`tags=a&tags=b`) would also reach core as an array, but only at cardinality\n * two or more — `tags=a` comes back as the scalar `\"a\"`, and a shape that\n * changes with the number of matches is a `TypeError` waiting for the day a\n * filter matches one item. `[]` is the form core wrote a branch for.\n *\n * ── What is REFUSED, and why refusing is the safe answer ─────────────────────\n *\n * Two levels of nesting is not a gap in core, it is measured data loss:\n * `a[b][c]=x` takes the `][` branch at `core/src/http/request.ts:528-551`,\n * computes `Number(\"b\")` as `NaN`, and the value lands on a `NaN` index and\n * vanishes — core answers `{a: []}`. So the encoder throws\n * {@link UnserializableQueryValueError} rather than write it. `href()` already\n * throws on a missing route parameter rather than emit a link that renders\n * correctly and 404s; this is the same call.\n *\n * ── What the encoder still normalises, and what that costs ───────────────────\n *\n * Leaf values are serialised with `String(value)`, so every value arrives back\n * as a `string`: `href(\"p\", {}, { page: 2 })` writes `?page=2`, and `2` and\n * `\"2\"` are the same URL. The round-trip law that can actually hold is\n * `parse(encode(query)) === query with String() applied to its leaves and\n * undefined dropped`, and that is what the spec asserts. Asserting anything\n * stronger would be asserting a decoder that guesses types, which is how\n * `?zip=01234` becomes the number `1234`.\n *\n * The decoder does NOT split values on `,`: that would turn the legitimate\n * string `\"Doe, John\"` into `[\"Doe\", \" John\"]`, trading a visible limitation for\n * a silent corruption of ordinary data. Arrays are carried by `[]`, which is\n * unambiguous, so there is nothing left to guess at.\n *\n * ── Universal by requirement, not by accident ────────────────────────────────\n *\n * `web` renders on the server first, so every export here is safe to import and\n * to CALL with no DOM. `@mongez/react-router`'s equivalent reads\n * `window.location.search` unguarded (query-string.ts:22) and throws under SSR.\n * Here the browser-only readers return their empty answer instead — see\n * `queryString.all` for the hydration caveat that comes with that.\n *\n * ── Still NOT here: `toQueryString` and `update` ─────────────────────────────\n *\n * MRR exposes `toQueryString(params)` and `update(params)`, which SERIALISE.\n * The serialiser they need is no longer module-private — `queryStringOf` is\n * exported from here — so the old blocker is gone. What remains is that\n * `web/src/index.ts` does not re-export it yet, and the barrel is owned\n * elsewhere. That is a one-line follow-up, not a redesign.\n */\n\n/** A decoded leaf. Always a `string` — see the header on `String(value)`. */\nexport type QueryStringLeaf = string;\n\n/**\n * The inside of a `key[sub]` bag: one level deep, exactly as far as core parses.\n *\n * There is no deeper case to model. `key[sub][deeper]` is refused by the encoder\n * and carried verbatim as a literal key by the decoder, so a nested bag only\n * ever holds a leaf or an array of leaves.\n */\nexport type QueryStringNested = Record<string, QueryStringLeaf | QueryStringLeaf[]>;\n\n/** A decoded value: a leaf, a `key[]` array, or a `key[sub]` bag. */\nexport type QueryStringValue = QueryStringLeaf | QueryStringLeaf[] | QueryStringNested;\n\n/** A decoded query string. */\nexport type QueryStringObject = Record<string, QueryStringValue>;\n\n/** What {@link queryStringOf} accepts. Values are validated, not trusted. */\nexport type QueryStringInput = Readonly<Record<string, unknown>>;\n\n/**\n * Thrown when a query value has a shape the wire format cannot carry.\n *\n * Deliberately LOUD. The alternative is emitting something core silently\n * mangles — `a[b][c]=x` arrives as `{a: []}` — which is this defect all over\n * again, one layer further from where anyone would look for it.\n */\nexport class UnserializableQueryValueError extends Error {\n  public constructor(\n    public readonly queryKey: string,\n    public readonly shape: string,\n  ) {\n    super(\n      `Warlock cannot put ${shape} in a query string at \"${queryKey}\". The wire format is the ` +\n        \"one @warlock.js/core parses (core/src/http/request.ts:503-591): a value may be a \" +\n        \"scalar, an array of scalars (`key[]=a&key[]=b`), or an object one level deep whose \" +\n        \"values are scalars or arrays of scalars (`key[sub]=a`, `key[sub][]=a`). Anything \" +\n        \"deeper is refused rather than written, because core reads `a[b][c]=x` back as \" +\n        \"`{a: []}` — the value is destroyed on arrival with no error. Flatten the value, or \" +\n        \"JSON.stringify it into a single scalar and parse it on the server.\",\n    );\n    this.name = \"UnserializableQueryValueError\";\n  }\n}\n\n/**\n * Is this a BAG of query keys, as opposed to a value with its own string form?\n *\n * A `Date`, a `URL` or anything else carrying its own `toString` is a scalar\n * here — `String(value)` is meaningful for it, and turning it into\n * `since[getTime]=...` would be absurd. A plain object, or a class instance that\n * would otherwise stringify to the useless `\"[object Object]\"`, is a bag and\n * gets enumerated.\n *\n * The `typeof` check matters for null-prototype objects: they have no\n * `toString` at all, and `String()` on one THROWS.\n */\nfunction isKeyBag(value: object): boolean {\n  const stringForm = (value as { toString?: unknown }).toString;\n\n  return typeof stringForm !== \"function\" || stringForm === Object.prototype.toString;\n}\n\n/** Refuse anything that is not a leaf. Used everywhere a leaf is the only legal shape. */\nfunction requireLeaf(key: string, value: unknown): void {\n  if (Array.isArray(value)) {\n    throw new UnserializableQueryValueError(key, \"a nested array\");\n  }\n\n  if (typeof value === \"object\" && value !== null && isKeyBag(value)) {\n    throw new UnserializableQueryValueError(key, \"a nested object\");\n  }\n}\n\n/**\n * Append `key[]=element` per element.\n *\n * An `undefined` element is skipped, matching the top-level rule. Because the\n * `[]` form carries no indices, skipping shortens the array rather than leaving\n * a hole — there is no hole to leave.\n *\n * An EMPTY array appends nothing, so the key is absent from the URL. The format\n * has no way to say \"an array with no elements\": `key[]=` means the one-element\n * array `[\"\"]`, which is a different value. A visible limitation beats a guess.\n */\nfunction appendArray(search: URLSearchParams, key: string, value: readonly unknown[]): void {\n  const arrayKey = `${key}[]`;\n\n  for (const element of value) {\n    if (element === undefined) continue;\n\n    requireLeaf(arrayKey, element);\n\n    search.append(arrayKey, String(element));\n  }\n}\n\n/** Append `key[sub]=value`, or `key[sub][]=value` when the member is an array. */\nfunction appendBag(search: URLSearchParams, key: string, value: object): void {\n  for (const [subKey, subValue] of Object.entries(value)) {\n    if (subValue === undefined) continue;\n\n    const nestedKey = `${key}[${subKey}]`;\n\n    if (Array.isArray(subValue)) {\n      appendArray(search, nestedKey, subValue);\n      continue;\n    }\n\n    requireLeaf(nestedKey, subValue);\n\n    search.append(nestedKey, String(subValue));\n  }\n}\n\n/**\n * Serialise a query object to a search string, INCLUDING the leading `?`.\n *\n * Returns `\"\"` — not `\"?\"` — when there is nothing to write, so the result can\n * always be concatenated onto a path. `href()` is the primary caller; the\n * grammar it emits is the one core parses, and the whole justification is in the\n * module header.\n *\n * @throws {UnserializableQueryValueError} when a value nests deeper than the\n * wire format can carry.\n */\nexport function queryStringOf(query: QueryStringInput | undefined): string {\n  if (query === undefined) return \"\";\n\n  const search = new URLSearchParams();\n\n  for (const [key, value] of Object.entries(query)) {\n    if (value === undefined) continue;\n\n    if (Array.isArray(value)) {\n      appendArray(search, key, value);\n      continue;\n    }\n\n    if (typeof value === \"object\" && value !== null && isKeyBag(value)) {\n      appendBag(search, key, value);\n      continue;\n    }\n\n    search.append(key, String(value));\n  }\n\n  const serialized = search.toString();\n\n  return serialized === \"\" ? \"\" : `?${serialized}`;\n}\n\n/**\n * What to do when the same PLAIN key appears more than once, e.g. `?tag=a&tag=b`.\n *\n * - `\"last\"` — keep the final occurrence. Matches `URLSearchParams.get()`, the\n *   read side of the primitive the encoder writes with, and keeps every value a\n *   `string`.\n * - `\"first\"` — keep the earliest occurrence.\n * - `\"array\"` — collect every occurrence. Under this strategy a key that occurs\n *   ONCE is still an array of one, because a shape that changes with the number\n *   of values is a `TypeError` waiting for the day a filter matches a single\n *   item.\n *\n * It does NOT govern `key[]` or `key[sub]`; those are shapes the encoder writes\n * deliberately, and their meaning is fixed. See {@link QueryStringOptions}.\n */\nexport type RepeatedKeyStrategy = \"last\" | \"first\" | \"array\";\n\n/**\n * The whole option surface.\n *\n * ── Why this is one flag and not MRR's pluggable parsers ─────────────────────\n *\n * MRR's `setQueryStringOptions` swaps `objectParser` and `stringParser`\n * (query-string.ts:10-15). Neither survives contact with a fixed, shared\n * encoder:\n *\n *   - A pluggable `objectParser` is a licence to install a READER that disagrees\n *     with the writer. It is precisely the silent round-trip break this module\n *     was written to prevent, offered as a supported API.\n *   - A pluggable `stringParser` would be worse: it cannot reach `href()`, which\n *     calls `queryStringOf` directly with no hook. Setting it would change what\n *     this module emits while every `<Link>` on the page kept emitting the old\n *     format — two writers, disagreeing, by configuration.\n *\n * `repeatedKeys` is safe for one specific reason, and the reason survived the\n * move to bracket notation: `queryStringOf` iterates `Object.entries`, so it can\n * never emit a duplicate PLAIN key. It now does emit duplicate `key[]` pairs —\n * that is how an array is written — but those go down the array branch of the\n * decoder, which this flag does not touch. Were the flag to govern the bracket\n * forms as well, `repeatedKeys: \"array\"` would decode `filter[x]=1` as\n * `{filter: {x: [\"1\"]}}` and break the round trip BY CONFIGURATION.\n *\n * So the flag still decides only something the encoder has no opinion about: a\n * repeated plain key, which can only arrive from a URL this package did not\n * write — hand-typed, external links, `GET` forms.\n *\n * Set it at BOOT, not per request: this is process-global config, and a\n * request-scoped write would be read by whatever request happens to be\n * rendering (the defect catalogued at route-table.ts:10-25).\n */\nexport type QueryStringOptions = {\n  readonly repeatedKeys?: RepeatedKeyStrategy;\n};\n\ntype ResolvedQueryStringOptions = Required<QueryStringOptions>;\n\nconst DEFAULT_OPTIONS: ResolvedQueryStringOptions = {\n  repeatedKeys: \"last\",\n};\n\n/**\n * Held on `globalThis`, not in a module binding, for the reason measured and\n * written up at route-table.ts:43-65: in dev the process runs two module graphs\n * over these files (tsx/Node and Vite's SSR runner), so a `let` written by boot\n * code is not the `let` a component reads. A split here would be quiet — the\n * second graph would silently fall back to the defaults and decode a repeated\n * key the other way.\n */\nconst OPTIONS_SLOT = Symbol.for(\"warlock.web.queryStringOptions\");\n\ntype OptionsHost = typeof globalThis & {\n  [OPTIONS_SLOT]?: ResolvedQueryStringOptions;\n};\n\nfunction currentOptions(): ResolvedQueryStringOptions {\n  return (globalThis as OptionsHost)[OPTIONS_SLOT] ?? DEFAULT_OPTIONS;\n}\n\n/**\n * Merge query-string options over the current ones.\n *\n * Named for `@mongez/react-router`'s function so migrating call sites keep\n * compiling; the OPTIONS are deliberately narrower, and `QueryStringOptions`\n * explains exactly which ones were refused and why.\n */\nexport function setQueryStringOptions(options: QueryStringOptions): void {\n  (globalThis as OptionsHost)[OPTIONS_SLOT] = { ...currentOptions(), ...options };\n}\n\n/**\n * Drop back to the defaults.\n *\n * Exists because the options are process-global: a test that set one would\n * otherwise leak it into every later test in the same worker, passing in file\n * order and failing under `--shuffle`. Same reasoning as `resetRouteTable`.\n */\nexport function resetQueryStringOptions(): void {\n  delete (globalThis as OptionsHost)[OPTIONS_SLOT];\n}\n\n/**\n * The search string of the current document, or `\"\"` when there is no document.\n *\n * The `typeof` guard is the SSR contract: no export in this module may touch a\n * DOM global without one.\n */\nfunction browserSearch(): string {\n  if (typeof window === \"undefined\") return \"\";\n\n  return window.location?.search ?? \"\";\n}\n\n/**\n * Reduce anything search-shaped to the pairs themselves.\n *\n * Accepts `\"?a=1\"`, `\"a=1\"`, `\"/path?a=1\"` and a full URL, because\n * `location.href`, `location.search` and a hand-written literal all turn up at\n * this door and `new URLSearchParams(\"/path?a=1\")` would answer with the key\n * `\"/path?a\"` — a wrong answer with no error. Cutting at the first `?` and the\n * first `#` is safe rather than heuristic: `queryStringOf` percent-encodes both\n * characters inside values (`%3F`, `%23`), so a literal one is always a\n * delimiter.\n */\nfunction searchPairsOf(source: string): string {\n  const withoutHash = source.split(\"#\", 1)[0];\n  const questionMark = withoutHash.indexOf(\"?\");\n\n  return questionMark === -1 ? withoutHash : withoutHash.slice(questionMark + 1);\n}\n\n/**\n * The three key shapes the encoder writes. Everything else is a literal key.\n *\n * The character classes exclude brackets, so each pattern matches exactly one\n * shape: `tags[]` cannot satisfy `NESTED`, and `a[b][c]` satisfies none of them.\n */\nconst ARRAY_KEY = /^([^[\\]]+)\\[\\]$/;\nconst NESTED_KEY = /^([^[\\]]+)\\[([^[\\]]+)\\]$/;\nconst NESTED_ARRAY_KEY = /^([^[\\]]+)\\[([^[\\]]+)\\]\\[\\]$/;\n\ntype ParsedKey =\n  | { kind: \"plain\"; name: string }\n  | { kind: \"array\"; name: string }\n  | { kind: \"nested\"; name: string; subKey: string }\n  | { kind: \"nestedArray\"; name: string; subKey: string };\n\n/**\n * Classify a decoded key.\n *\n * A shape neither side produces — `a[b][c]`, `items[0][name]`, an unbalanced\n * `a[` — falls through to `\"plain\"` and is carried VERBATIM. Those can only come\n * from a URL warlock did not write, and guessing at them is exactly how a\n * decoder drifts from its writer. Carrying the key as text loses nothing.\n */\nfunction parseKey(key: string): ParsedKey {\n  const nestedArray = NESTED_ARRAY_KEY.exec(key);\n\n  if (nestedArray) {\n    return { kind: \"nestedArray\", name: nestedArray[1], subKey: nestedArray[2] };\n  }\n\n  const array = ARRAY_KEY.exec(key);\n\n  if (array) return { kind: \"array\", name: array[1] };\n\n  const nested = NESTED_KEY.exec(key);\n\n  if (nested) return { kind: \"nested\", name: nested[1], subKey: nested[2] };\n\n  return { kind: \"plain\", name: key };\n}\n\n/** A fresh bag with NO prototype. See {@link decode} for why that is not optional. */\nfunction emptyBag<T extends object>(): T {\n  return Object.create(null) as T;\n}\n\nfunction isBag(value: unknown): value is QueryStringNested {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * The array living at `container[name]`, created if it is not there yet.\n *\n * A conflicting earlier shape is REPLACED rather than written into. `?a=1&a[]=2`\n * is not something the encoder can emit, so it is a foreign URL contradicting\n * itself; appending to a string would be a silent no-op, and last-shape-wins at\n * least matches how `repeatedKeys: \"last\"` resolves the scalar version.\n */\nfunction arrayAt(container: Record<string, unknown>, name: string): string[] {\n  const existing = container[name];\n\n  if (Array.isArray(existing)) return existing;\n\n  const created: string[] = [];\n\n  container[name] = created;\n\n  return created;\n}\n\n/** The bag living at `result[name]`, created if absent. Same last-shape-wins rule. */\nfunction bagAt(result: QueryStringObject, name: string): QueryStringNested {\n  const existing = result[name];\n\n  if (isBag(existing)) return existing;\n\n  const created = emptyBag<QueryStringNested>();\n\n  result[name] = created;\n\n  return created;\n}\n\n/**\n * The single decode path. Every reader below goes through here.\n *\n * Every container has a NULL PROTOTYPE — the result and each `key[sub]` bag.\n * Query keys are attacker-controlled, and assigning `?__proto__=x` onto a `{}`\n * literal hits the inherited setter, which DISCARDS the key: data loss with no\n * error. Bracket parsing makes this sharper than it was when this decoder was\n * flat, because `?filter[__proto__]=x` now reaches a nested container too —\n * which is why `bagAt` builds with `Object.create(null)` rather than `{}`.\n * MRR's parser walks `key.split(\"[\")` onto plain objects and needs the blocklist\n * at query-string-parsers.ts:7 as a result; with no prototype there is no setter\n * to hit and the key is stored as the ordinary data it is.\n */\nfunction decode(source: string): QueryStringObject {\n  const pairs = searchPairsOf(source);\n  const result = emptyBag<QueryStringObject>();\n\n  if (pairs === \"\") return result;\n\n  const { repeatedKeys } = currentOptions();\n\n  for (const [key, value] of new URLSearchParams(pairs)) {\n    const parsed = parseKey(key);\n\n    if (parsed.kind === \"array\") {\n      arrayAt(result, parsed.name).push(value);\n      continue;\n    }\n\n    if (parsed.kind === \"nestedArray\") {\n      arrayAt(bagAt(result, parsed.name), parsed.subKey).push(value);\n      continue;\n    }\n\n    if (parsed.kind === \"nested\") {\n      // Last wins. The encoder cannot repeat a `key[sub]` pair — `Object.entries`\n      // yields each sub-key once — so this only arises from a foreign URL, and\n      // `repeatedKeys` deliberately does not reach here (QueryStringOptions).\n      bagAt(result, parsed.name)[parsed.subKey] = value;\n      continue;\n    }\n\n    if (!(parsed.name in result)) {\n      result[parsed.name] = repeatedKeys === \"array\" ? [value] : value;\n      continue;\n    }\n\n    if (repeatedKeys === \"first\") continue;\n\n    if (repeatedKeys === \"last\") {\n      result[parsed.name] = value;\n      continue;\n    }\n\n    arrayAt(result, parsed.name).push(value);\n  }\n\n  return result;\n}\n\n/**\n * Reading the current query string, and any query string.\n *\n * Named for `@mongez/react-router`'s object so the familiar calls keep working;\n * the implementation is not ported — see the module header for what changed and\n * why.\n */\nexport const queryString = {\n  /**\n   * The current document's query string, decoded.\n   *\n   * On the server this is `{}`, because the browser location is the only source\n   * this module has and a per-request one would be module state two concurrent\n   * requests could race over (route-table.ts:10-25).\n   *\n   * That makes it a HYDRATION HAZARD in a component: the server renders `{}`\n   * and the browser renders the real values, so the two trees differ. In a\n   * component, take the query from the page's own props and hand it to\n   * {@link queryString.parse}, which is universal. `all()` is for browser-only\n   * code — an event handler, an effect, a client-side helper.\n   */\n  all(): QueryStringObject {\n    return decode(browserSearch());\n  },\n\n  /**\n   * Decode a query string that was handed to you.\n   *\n   * Universal: it reads no globals, so this is the entry point that is safe on\n   * the server. Accepts a bare pair list, a leading `?`, a path, or a full URL.\n   */\n  parse(search: string): QueryStringObject {\n    return decode(search);\n  },\n\n  /**\n   * One key from the current query string.\n   *\n   * PRESENCE, not truthiness. MRR returns `all[key] || defaultValue`\n   * (query-string.ts:43), which hands back the default for `?a=` — so a\n   * deliberately-cleared filter reads as though it was never set, and the page\n   * shows the default instead of the empty state. Here `?a=` returns `\"\"`, and\n   * only an absent key returns the default.\n   *\n   * @param defaultValue returned only when the key is absent. Defaults to\n   * `null`, as MRR's does.\n   */\n  get<T = null>(key: string, defaultValue: T = null as T): QueryStringValue | T {\n    const all = decode(browserSearch());\n\n    return key in all ? all[key] : defaultValue;\n  },\n\n  /**\n   * The current query string verbatim, without the leading `?`.\n   *\n   * `\"\"` on the server, and `\"\"` when there is no query — the same two cases\n   * `queryStringOf` collapses when it writes.\n   */\n  toString(): string {\n    return searchPairsOf(browserSearch());\n  },\n};\n"],"mappings":";;;;;;;;AAqHA,IAAa,gCAAb,cAAmD,MAAM;CAErC;CACA;CAFlB,AAAO,YACL,AAAgB,UAChB,AAAgB,OAChB;EACA,MACE,sBAAsB,MAAM,yBAAyB,SAAS,6fAOhE;EAXgB;EACA;EAWhB,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;AAcA,SAAS,SAAS,OAAwB;CACxC,MAAM,aAAc,MAAiC;CAErD,OAAO,OAAO,eAAe,cAAc,eAAe,OAAO,UAAU;AAC7E;;AAGA,SAAS,YAAY,KAAa,OAAsB;CACtD,IAAI,MAAM,QAAQ,KAAK,GACrB,MAAM,IAAI,8BAA8B,KAAK,gBAAgB;CAG/D,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS,KAAK,GAC/D,MAAM,IAAI,8BAA8B,KAAK,iBAAiB;AAElE;;;;;;;;;;;;AAaA,SAAS,YAAY,QAAyB,KAAa,OAAiC;CAC1F,MAAM,WAAW,GAAG,IAAI;CAExB,KAAK,MAAM,WAAW,OAAO;EAC3B,IAAI,YAAY,QAAW;EAE3B,YAAY,UAAU,OAAO;EAE7B,OAAO,OAAO,UAAU,OAAO,OAAO,CAAC;CACzC;AACF;;AAGA,SAAS,UAAU,QAAyB,KAAa,OAAqB;CAC5E,KAAK,MAAM,CAAC,QAAQ,aAAa,OAAO,QAAQ,KAAK,GAAG;EACtD,IAAI,aAAa,QAAW;EAE5B,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO;EAEnC,IAAI,MAAM,QAAQ,QAAQ,GAAG;GAC3B,YAAY,QAAQ,WAAW,QAAQ;GACvC;EACF;EAEA,YAAY,WAAW,QAAQ;EAE/B,OAAO,OAAO,WAAW,OAAO,QAAQ,CAAC;CAC3C;AACF;;;;;;;;;;;;AAaA,SAAgB,cAAc,OAA6C;CACzE,IAAI,UAAU,QAAW,OAAO;CAEhC,MAAM,SAAS,IAAI,gBAAgB;CAEnC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,QAAW;EAEzB,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,YAAY,QAAQ,KAAK,KAAK;GAC9B;EACF;EAEA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS,KAAK,GAAG;GAClE,UAAU,QAAQ,KAAK,KAAK;GAC5B;EACF;EAEA,OAAO,OAAO,KAAK,OAAO,KAAK,CAAC;CAClC;CAEA,MAAM,aAAa,OAAO,SAAS;CAEnC,OAAO,eAAe,KAAK,KAAK,IAAI;AACtC;AA0DA,MAAM,kBAA8C,EAClD,cAAc,OAChB;;;;;;;;;AAUA,MAAM,eAAe,OAAO,IAAI,gCAAgC;AAMhE,SAAS,iBAA6C;CACpD,OAAQ,WAA2B,iBAAiB;AACtD;;;;;;;;AASA,SAAgB,sBAAsB,SAAmC;CACvE,AAAC,WAA2B,gBAAgB;EAAE,GAAG,eAAe;EAAG,GAAG;CAAQ;AAChF;;;;;;;;AASA,SAAgB,0BAAgC;CAC9C,OAAQ,WAA2B;AACrC;;;;;;;AAQA,SAAS,gBAAwB;CAC/B,IAAI,OAAO,WAAW,aAAa,OAAO;CAE1C,OAAO,OAAO,UAAU,UAAU;AACpC;;;;;;;;;;;;AAaA,SAAS,cAAc,QAAwB;CAC7C,MAAM,cAAc,OAAO,MAAM,KAAK,CAAC,EAAE;CACzC,MAAM,eAAe,YAAY,QAAQ,GAAG;CAE5C,OAAO,iBAAiB,KAAK,cAAc,YAAY,MAAM,eAAe,CAAC;AAC/E;;;;;;;AAQA,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,mBAAmB;;;;;;;;;AAgBzB,SAAS,SAAS,KAAwB;CACxC,MAAM,cAAc,iBAAiB,KAAK,GAAG;CAE7C,IAAI,aACF,OAAO;EAAE,MAAM;EAAe,MAAM,YAAY;EAAI,QAAQ,YAAY;CAAG;CAG7E,MAAM,QAAQ,UAAU,KAAK,GAAG;CAEhC,IAAI,OAAO,OAAO;EAAE,MAAM;EAAS,MAAM,MAAM;CAAG;CAElD,MAAM,SAAS,WAAW,KAAK,GAAG;CAElC,IAAI,QAAQ,OAAO;EAAE,MAAM;EAAU,MAAM,OAAO;EAAI,QAAQ,OAAO;CAAG;CAExE,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACpC;;AAGA,SAAS,WAAgC;CACvC,OAAO,OAAO,OAAO,IAAI;AAC3B;AAEA,SAAS,MAAM,OAA4C;CACzD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;;;;;;;AAUA,SAAS,QAAQ,WAAoC,MAAwB;CAC3E,MAAM,WAAW,UAAU;CAE3B,IAAI,MAAM,QAAQ,QAAQ,GAAG,OAAO;CAEpC,MAAM,UAAoB,CAAC;CAE3B,UAAU,QAAQ;CAElB,OAAO;AACT;;AAGA,SAAS,MAAM,QAA2B,MAAiC;CACzE,MAAM,WAAW,OAAO;CAExB,IAAI,MAAM,QAAQ,GAAG,OAAO;CAE5B,MAAM,UAAU,SAA4B;CAE5C,OAAO,QAAQ;CAEf,OAAO;AACT;;;;;;;;;;;;;;AAeA,SAAS,OAAO,QAAmC;CACjD,MAAM,QAAQ,cAAc,MAAM;CAClC,MAAM,SAAS,SAA4B;CAE3C,IAAI,UAAU,IAAI,OAAO;CAEzB,MAAM,EAAE,iBAAiB,eAAe;CAExC,KAAK,MAAM,CAAC,KAAK,UAAU,IAAI,gBAAgB,KAAK,GAAG;EACrD,MAAM,SAAS,SAAS,GAAG;EAE3B,IAAI,OAAO,SAAS,SAAS;GAC3B,QAAQ,QAAQ,OAAO,IAAI,EAAE,KAAK,KAAK;GACvC;EACF;EAEA,IAAI,OAAO,SAAS,eAAe;GACjC,QAAQ,MAAM,QAAQ,OAAO,IAAI,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK;GAC7D;EACF;EAEA,IAAI,OAAO,SAAS,UAAU;GAI5B,MAAM,QAAQ,OAAO,IAAI,EAAE,OAAO,UAAU;GAC5C;EACF;EAEA,IAAI,EAAE,OAAO,QAAQ,SAAS;GAC5B,OAAO,OAAO,QAAQ,iBAAiB,UAAU,CAAC,KAAK,IAAI;GAC3D;EACF;EAEA,IAAI,iBAAiB,SAAS;EAE9B,IAAI,iBAAiB,QAAQ;GAC3B,OAAO,OAAO,QAAQ;GACtB;EACF;EAEA,QAAQ,QAAQ,OAAO,IAAI,EAAE,KAAK,KAAK;CACzC;CAEA,OAAO;AACT;;;;;;;;AASA,MAAa,cAAc;;;;;;;;;;;;;;CAczB,MAAyB;EACvB,OAAO,OAAO,cAAc,CAAC;CAC/B;;;;;;;CAQA,MAAM,QAAmC;EACvC,OAAO,OAAO,MAAM;CACtB;;;;;;;;;;;;;CAcA,IAAc,KAAa,eAAkB,MAAiC;EAC5E,MAAM,MAAM,OAAO,cAAc,CAAC;EAElC,OAAO,OAAO,MAAM,IAAI,OAAO;CACjC;;;;;;;CAQA,WAAmB;EACjB,OAAO,cAAc,cAAc,CAAC;CACtC;AACF"}
+{"version":3,"file":"query-string.mjs","names":[],"sources":["../../../../../../../web/src/routing/query-string.ts"],"sourcesContent":["/**\n * The query string: BOTH directions, one grammar, one file.\n *\n * ── The rule this module exists to obey ──────────────────────────────────────\n *\n * `queryStringOf` is what `href(name, params, query)` appends, and therefore\n * what every `<Link>` puts in the document; `queryString.parse` is what reads it\n * back. They live together because a second, independently-written\n * query-string implementation would mean one thing writes URLs and a different\n * thing reads them. Query-string libraries genuinely disagree about arrays,\n * nested objects and space escaping, so the moment the two drift the round trip\n * loses data SILENTLY — the wrong value renders and no error is raised\n * anywhere. That is the two-route-matchers failure class (canon 9c8f878b) one\n * layer down.\n *\n * Escaping is not two rules that agree today. Both directions stand on\n * `URLSearchParams`: the encoder builds one and calls `.toString()`, the decoder\n * hands the string back to `new URLSearchParams(...)`. `+`-for-space and every\n * percent-encoding rule are therefore ONE rule and cannot drift.\n *\n * ── The grammar, and why it is not ours to choose ────────────────────────────\n *\n * Structure — arrays and nested objects — is the part `URLSearchParams` has no\n * opinion about, so it was read off the SERVER rather than invented. Warlock is\n * a backend framework and core already parses query strings for list endpoints\n * and filters; a client that emitted anything else would not have fixed this\n * module's bug, it would have moved it across the wire where it is harder to\n * see. Measured, with file:line, in\n * `reports/query-grammar-findings-2026-08-24.md`:\n *\n *   - `core/src/http/server.ts:14-36` configures Fastify with NO\n *     `querystringParser`, so find-my-way's `fast-querystring` default applies:\n *     flat keys, `+` is a space, a repeated key collapses to an array.\n *   - `core/src/http/request.ts:491` then runs `request.query` through\n *     `parseBody` — the SAME bracket-aware parser as the request body.\n *   - `core/src/http/request.ts:516-520` reads `key[]` as an array marker, and\n *     `:568-575` wraps a single `key[]=a` into the one-element array `[\"a\"]`.\n *   - `core/src/http/request.ts:557-561` turns `key[sub]=v` into\n *     `{key: {sub: v}}`, one level deep.\n *\n * So: `tags[]=a&tags[]=b` for arrays, `filter[status]=active` for objects,\n * `filter[tags][]=a` for an array inside an object. Bare repeated keys\n * (`tags=a&tags=b`) would also reach core as an array, but only at cardinality\n * two or more — `tags=a` comes back as the scalar `\"a\"`, and a shape that\n * changes with the number of matches is a `TypeError` waiting for the day a\n * filter matches one item. `[]` is the form core wrote a branch for.\n *\n * ── What is REFUSED, and why refusing is the safe answer ─────────────────────\n *\n * Two levels of nesting is not a gap in core, it is measured data loss:\n * `a[b][c]=x` takes the `][` branch at `core/src/http/request.ts:528-551`,\n * computes `Number(\"b\")` as `NaN`, and the value lands on a `NaN` index and\n * vanishes — core answers `{a: []}`. So the encoder throws\n * {@link UnserializableQueryValueError} rather than write it. `href()` already\n * throws on a missing route parameter rather than emit a link that renders\n * correctly and 404s; this is the same call.\n *\n * ── What the encoder still normalises, and what that costs ───────────────────\n *\n * Leaf values are serialised with `String(value)`, so every value arrives back\n * as a `string`: `href(\"p\", {}, { page: 2 })` writes `?page=2`, and `2` and\n * `\"2\"` are the same URL. The round-trip law that can actually hold is\n * `parse(encode(query)) === query with String() applied to its leaves and\n * undefined dropped`, and that is what the spec asserts. Asserting anything\n * stronger would be asserting a decoder that guesses types, which is how\n * `?zip=01234` becomes the number `1234`.\n *\n * The decoder does NOT split values on `,`: that would turn the legitimate\n * string `\"Doe, John\"` into `[\"Doe\", \" John\"]`, trading a visible limitation for\n * a silent corruption of ordinary data. Arrays are carried by `[]`, which is\n * unambiguous, so there is nothing left to guess at.\n *\n * ── Universal by requirement, not by accident ────────────────────────────────\n *\n * `web` renders on the server first, so every export here is safe to import and\n * to CALL with no DOM. `@mongez/react-router`'s equivalent reads\n * `window.location.search` unguarded (query-string.ts:22) and throws under SSR.\n * Here the browser-only readers return their empty answer instead — see\n * `queryString.all` for the hydration caveat that comes with that.\n *\n * ── Still NOT here: `toQueryString` and `update` ─────────────────────────────\n *\n * MRR exposes `toQueryString(params)` and `update(params)`, which SERIALISE.\n * The serialiser they need is no longer module-private — `queryStringOf` is\n * exported from here — so the old blocker is gone. What remains is that\n * `web/src/index.ts` does not re-export it yet, and the barrel is owned\n * elsewhere. That is a one-line follow-up, not a redesign.\n */\n\n/** A decoded leaf. Always a `string` — see the header on `String(value)`. */\nexport type QueryStringLeaf = string;\n\n/**\n * The inside of a `key[sub]` bag: one level deep, exactly as far as core parses.\n *\n * There is no deeper case to model. `key[sub][deeper]` is refused by the encoder\n * and carried verbatim as a literal key by the decoder, so a nested bag only\n * ever holds a leaf or an array of leaves.\n */\nexport type QueryStringNested = Record<string, QueryStringLeaf | QueryStringLeaf[]>;\n\n/** A decoded value: a leaf, a `key[]` array, or a `key[sub]` bag. */\nexport type QueryStringValue = QueryStringLeaf | QueryStringLeaf[] | QueryStringNested;\n\n/** A decoded query string. */\nexport type QueryStringObject = Record<string, QueryStringValue>;\n\n/** What {@link queryStringOf} accepts. Values are validated, not trusted. */\nexport type QueryStringInput = Readonly<Record<string, unknown>>;\n\n/**\n * Thrown when a query value has a shape the wire format cannot carry.\n *\n * Deliberately LOUD. The alternative is emitting something core silently\n * mangles — `a[b][c]=x` arrives as `{a: []}` — which is this defect all over\n * again, one layer further from where anyone would look for it.\n */\nexport class UnserializableQueryValueError extends Error {\n  public constructor(\n    public readonly queryKey: string,\n    public readonly shape: string,\n  ) {\n    super(\n      `Warlock cannot put ${shape} in a query string at \"${queryKey}\". The wire format is the ` +\n        \"one @warlock.js/core parses (core/src/http/request.ts:503-591): a value may be a \" +\n        \"scalar, an array of scalars (`key[]=a&key[]=b`), or an object one level deep whose \" +\n        \"values are scalars or arrays of scalars (`key[sub]=a`, `key[sub][]=a`). Anything \" +\n        \"deeper is refused rather than written, because core reads `a[b][c]=x` back as \" +\n        \"`{a: []}` — the value is destroyed on arrival with no error. Flatten the value, or \" +\n        \"JSON.stringify it into a single scalar and parse it on the server.\",\n    );\n    this.name = \"UnserializableQueryValueError\";\n  }\n}\n\n/**\n * Is this a BAG of query keys, as opposed to a value with its own string form?\n *\n * A `Date`, a `URL` or anything else carrying its own `toString` is a scalar\n * here — `String(value)` is meaningful for it, and turning it into\n * `since[getTime]=...` would be absurd. A plain object, or a class instance that\n * would otherwise stringify to the useless `\"[object Object]\"`, is a bag and\n * gets enumerated.\n *\n * The `typeof` check matters for null-prototype objects: they have no\n * `toString` at all, and `String()` on one THROWS.\n */\nfunction isKeyBag(value: object): boolean {\n  const stringForm = (value as { toString?: unknown }).toString;\n\n  return typeof stringForm !== \"function\" || stringForm === Object.prototype.toString;\n}\n\n/** Refuse anything that is not a leaf. Used everywhere a leaf is the only legal shape. */\nfunction requireLeaf(key: string, value: unknown): void {\n  if (Array.isArray(value)) {\n    throw new UnserializableQueryValueError(key, \"a nested array\");\n  }\n\n  if (typeof value === \"object\" && value !== null && isKeyBag(value)) {\n    throw new UnserializableQueryValueError(key, \"a nested object\");\n  }\n}\n\n/**\n * Append `key[]=element` per element.\n *\n * An `undefined` element is skipped, matching the top-level rule. Because the\n * `[]` form carries no indices, skipping shortens the array rather than leaving\n * a hole — there is no hole to leave.\n *\n * An EMPTY array appends nothing, so the key is absent from the URL. The format\n * has no way to say \"an array with no elements\": `key[]=` means the one-element\n * array `[\"\"]`, which is a different value. A visible limitation beats a guess.\n */\nfunction appendArray(search: URLSearchParams, key: string, value: readonly unknown[]): void {\n  const arrayKey = `${key}[]`;\n\n  for (const element of value) {\n    if (element === undefined) continue;\n\n    requireLeaf(arrayKey, element);\n\n    search.append(arrayKey, String(element));\n  }\n}\n\n/** Append `key[sub]=value`, or `key[sub][]=value` when the member is an array. */\nfunction appendBag(search: URLSearchParams, key: string, value: object): void {\n  for (const [subKey, subValue] of Object.entries(value)) {\n    if (subValue === undefined) continue;\n\n    const nestedKey = `${key}[${subKey}]`;\n\n    if (Array.isArray(subValue)) {\n      appendArray(search, nestedKey, subValue);\n      continue;\n    }\n\n    requireLeaf(nestedKey, subValue);\n\n    search.append(nestedKey, String(subValue));\n  }\n}\n\n/**\n * Serialise a query object to a search string, INCLUDING the leading `?`.\n *\n * Returns `\"\"` — not `\"?\"` — when there is nothing to write, so the result can\n * always be concatenated onto a path. `href()` is the primary caller; the\n * grammar it emits is the one core parses, and the whole justification is in the\n * module header.\n *\n * @throws {UnserializableQueryValueError} when a value nests deeper than the\n * wire format can carry.\n */\nexport function queryStringOf(query: QueryStringInput | undefined): string {\n  if (query === undefined) return \"\";\n\n  const search = new URLSearchParams();\n\n  for (const [key, value] of Object.entries(query)) {\n    if (value === undefined) continue;\n\n    if (Array.isArray(value)) {\n      appendArray(search, key, value);\n      continue;\n    }\n\n    if (typeof value === \"object\" && value !== null && isKeyBag(value)) {\n      appendBag(search, key, value);\n      continue;\n    }\n\n    search.append(key, String(value));\n  }\n\n  const serialized = search.toString();\n\n  return serialized === \"\" ? \"\" : `?${serialized}`;\n}\n\n/**\n * What to do when the same PLAIN key appears more than once, e.g. `?tag=a&tag=b`.\n *\n * - `\"last\"` — keep the final occurrence. Matches `URLSearchParams.get()`, the\n *   read side of the primitive the encoder writes with, and keeps every value a\n *   `string`.\n * - `\"first\"` — keep the earliest occurrence.\n * - `\"array\"` — collect every occurrence. Under this strategy a key that occurs\n *   ONCE is still an array of one, because a shape that changes with the number\n *   of values is a `TypeError` waiting for the day a filter matches a single\n *   item.\n *\n * It does NOT govern `key[]` or `key[sub]`; those are shapes the encoder writes\n * deliberately, and their meaning is fixed. See {@link QueryStringOptions}.\n */\nexport type RepeatedKeyStrategy = \"last\" | \"first\" | \"array\";\n\n/**\n * The whole option surface.\n *\n * ── Why this is one flag and not MRR's pluggable parsers ─────────────────────\n *\n * MRR's `setQueryStringOptions` swaps `objectParser` and `stringParser`\n * (query-string.ts:10-15). Neither survives contact with a fixed, shared\n * encoder:\n *\n *   - A pluggable `objectParser` is a licence to install a READER that disagrees\n *     with the writer. It is precisely the silent round-trip break this module\n *     was written to prevent, offered as a supported API.\n *   - A pluggable `stringParser` would be worse: it cannot reach `href()`, which\n *     calls `queryStringOf` directly with no hook. Setting it would change what\n *     this module emits while every `<Link>` on the page kept emitting the old\n *     format — two writers, disagreeing, by configuration.\n *\n * `repeatedKeys` is safe for one specific reason, and the reason survived the\n * move to bracket notation: `queryStringOf` iterates `Object.entries`, so it can\n * never emit a duplicate PLAIN key. It now does emit duplicate `key[]` pairs —\n * that is how an array is written — but those go down the array branch of the\n * decoder, which this flag does not touch. Were the flag to govern the bracket\n * forms as well, `repeatedKeys: \"array\"` would decode `filter[x]=1` as\n * `{filter: {x: [\"1\"]}}` and break the round trip BY CONFIGURATION.\n *\n * So the flag still decides only something the encoder has no opinion about: a\n * repeated plain key, which can only arrive from a URL this package did not\n * write — hand-typed, external links, `GET` forms.\n *\n * Set it at BOOT, not per request: this is process-global config, and a\n * request-scoped write would be read by whatever request happens to be\n * rendering (the defect catalogued at route-table.ts:10-25).\n */\nexport type QueryStringOptions = {\n  readonly repeatedKeys?: RepeatedKeyStrategy;\n};\n\ntype ResolvedQueryStringOptions = Required<QueryStringOptions>;\n\nconst DEFAULT_OPTIONS: ResolvedQueryStringOptions = {\n  repeatedKeys: \"last\",\n};\n\n/**\n * Held on `globalThis`, not in a module binding, for the reason measured and\n * written up at route-table.ts:43-65: in dev the process runs two module graphs\n * over these files (tsx/Node and Vite's SSR runner), so a `let` written by boot\n * code is not the `let` a component reads. A split here would be quiet — the\n * second graph would silently fall back to the defaults and decode a repeated\n * key the other way.\n */\nconst OPTIONS_SLOT = Symbol.for(\"warlock.web.queryStringOptions\");\n\ntype OptionsHost = typeof globalThis & {\n  [OPTIONS_SLOT]?: ResolvedQueryStringOptions;\n};\n\nfunction currentOptions(): ResolvedQueryStringOptions {\n  return (globalThis as OptionsHost)[OPTIONS_SLOT] ?? DEFAULT_OPTIONS;\n}\n\n/**\n * Merge query-string options over the current ones.\n *\n * Named for `@mongez/react-router`'s function so migrating call sites keep\n * compiling; the OPTIONS are deliberately narrower, and `QueryStringOptions`\n * explains exactly which ones were refused and why.\n */\nexport function setQueryStringOptions(options: QueryStringOptions): void {\n  (globalThis as OptionsHost)[OPTIONS_SLOT] = { ...currentOptions(), ...options };\n}\n\n/**\n * Drop back to the defaults.\n *\n * Exists because the options are process-global: a test that set one would\n * otherwise leak it into every later test in the same worker, passing in file\n * order and failing under `--shuffle`. Same reasoning as `resetRouteTable`.\n */\nexport function resetQueryStringOptions(): void {\n  delete (globalThis as OptionsHost)[OPTIONS_SLOT];\n}\n\n/**\n * The search string of the current document, or `\"\"` when there is no document.\n *\n * The `typeof` guard is the SSR contract: no export in this module may touch a\n * DOM global without one.\n */\nfunction browserSearch(): string {\n  if (typeof window === \"undefined\") return \"\";\n\n  return window.location?.search ?? \"\";\n}\n\n/**\n * Reduce anything search-shaped to the pairs themselves.\n *\n * Accepts `\"?a=1\"`, `\"a=1\"`, `\"/path?a=1\"` and a full URL, because\n * `location.href`, `location.search` and a hand-written literal all turn up at\n * this door and `new URLSearchParams(\"/path?a=1\")` would answer with the key\n * `\"/path?a\"` — a wrong answer with no error. Cutting at the first `?` and the\n * first `#` is safe rather than heuristic: `queryStringOf` percent-encodes both\n * characters inside values (`%3F`, `%23`), so a literal one is always a\n * delimiter.\n */\nfunction searchPairsOf(source: string): string {\n  const withoutHash = source.split(\"#\", 1)[0];\n  const questionMark = withoutHash.indexOf(\"?\");\n\n  return questionMark === -1 ? withoutHash : withoutHash.slice(questionMark + 1);\n}\n\n/**\n * The three key shapes the encoder writes. Everything else is a literal key.\n *\n * The character classes exclude brackets, so each pattern matches exactly one\n * shape: `tags[]` cannot satisfy `NESTED`, and `a[b][c]` satisfies none of them.\n */\nconst ARRAY_KEY = /^([^[\\]]+)\\[\\]$/;\nconst NESTED_KEY = /^([^[\\]]+)\\[([^[\\]]+)\\]$/;\nconst NESTED_ARRAY_KEY = /^([^[\\]]+)\\[([^[\\]]+)\\]\\[\\]$/;\n\ntype ParsedKey =\n  | { kind: \"plain\"; name: string }\n  | { kind: \"array\"; name: string }\n  | { kind: \"nested\"; name: string; subKey: string }\n  | { kind: \"nestedArray\"; name: string; subKey: string };\n\n/**\n * Classify a decoded key.\n *\n * A shape neither side produces — `a[b][c]`, `items[0][name]`, an unbalanced\n * `a[` — falls through to `\"plain\"` and is carried VERBATIM. Those can only come\n * from a URL warlock did not write, and guessing at them is exactly how a\n * decoder drifts from its writer. Carrying the key as text loses nothing.\n */\nfunction parseKey(key: string): ParsedKey {\n  const nestedArray = NESTED_ARRAY_KEY.exec(key);\n\n  if (nestedArray) {\n    return { kind: \"nestedArray\", name: nestedArray[1], subKey: nestedArray[2] };\n  }\n\n  const array = ARRAY_KEY.exec(key);\n\n  if (array) return { kind: \"array\", name: array[1] };\n\n  const nested = NESTED_KEY.exec(key);\n\n  if (nested) return { kind: \"nested\", name: nested[1], subKey: nested[2] };\n\n  return { kind: \"plain\", name: key };\n}\n\n/** A fresh bag with NO prototype. See {@link decode} for why that is not optional. */\nfunction emptyBag<T extends object>(): T {\n  return Object.create(null) as T;\n}\n\nfunction isBag(value: unknown): value is QueryStringNested {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * The array living at `container[name]`, created if it is not there yet.\n *\n * A conflicting earlier shape is REPLACED rather than written into. `?a=1&a[]=2`\n * is not something the encoder can emit, so it is a foreign URL contradicting\n * itself; appending to a string would be a silent no-op, and last-shape-wins at\n * least matches how `repeatedKeys: \"last\"` resolves the scalar version.\n */\nfunction arrayAt(container: Record<string, unknown>, name: string): string[] {\n  const existing = container[name];\n\n  if (Array.isArray(existing)) return existing;\n\n  const created: string[] = [];\n\n  container[name] = created;\n\n  return created;\n}\n\n/** The bag living at `result[name]`, created if absent. Same last-shape-wins rule. */\nfunction bagAt(result: QueryStringObject, name: string): QueryStringNested {\n  const existing = result[name];\n\n  if (isBag(existing)) return existing;\n\n  const created = emptyBag<QueryStringNested>();\n\n  result[name] = created;\n\n  return created;\n}\n\n/**\n * The single decode path. Every reader below goes through here.\n *\n * Every container has a NULL PROTOTYPE — the result and each `key[sub]` bag.\n * Query keys are attacker-controlled, and assigning `?__proto__=x` onto a `{}`\n * literal hits the inherited setter, which DISCARDS the key: data loss with no\n * error. Bracket parsing makes this sharper than it was when this decoder was\n * flat, because `?filter[__proto__]=x` now reaches a nested container too —\n * which is why `bagAt` builds with `Object.create(null)` rather than `{}`.\n * MRR's parser walks `key.split(\"[\")` onto plain objects and needs the blocklist\n * at query-string-parsers.ts:7 as a result; with no prototype there is no setter\n * to hit and the key is stored as the ordinary data it is.\n */\nfunction decode(source: string): QueryStringObject {\n  const pairs = searchPairsOf(source);\n  const result = emptyBag<QueryStringObject>();\n\n  if (pairs === \"\") return result;\n\n  const { repeatedKeys } = currentOptions();\n\n  for (const [key, value] of new URLSearchParams(pairs)) {\n    const parsed = parseKey(key);\n\n    if (parsed.kind === \"array\") {\n      arrayAt(result, parsed.name).push(value);\n      continue;\n    }\n\n    if (parsed.kind === \"nestedArray\") {\n      arrayAt(bagAt(result, parsed.name), parsed.subKey).push(value);\n      continue;\n    }\n\n    if (parsed.kind === \"nested\") {\n      // Last wins. The encoder cannot repeat a `key[sub]` pair — `Object.entries`\n      // yields each sub-key once — so this only arises from a foreign URL, and\n      // `repeatedKeys` deliberately does not reach here (QueryStringOptions).\n      bagAt(result, parsed.name)[parsed.subKey] = value;\n      continue;\n    }\n\n    if (!(parsed.name in result)) {\n      result[parsed.name] = repeatedKeys === \"array\" ? [value] : value;\n      continue;\n    }\n\n    if (repeatedKeys === \"first\") continue;\n\n    if (repeatedKeys === \"last\") {\n      result[parsed.name] = value;\n      continue;\n    }\n\n    arrayAt(result, parsed.name).push(value);\n  }\n\n  return result;\n}\n\n/**\n * Reading the current query string, and any query string.\n *\n * Named for `@mongez/react-router`'s object so the familiar calls keep working;\n * the implementation is not ported — see the module header for what changed and\n * why.\n */\nexport const queryString = {\n  /**\n   * The current document's query string, decoded.\n   *\n   * On the server this is `{}`, because the browser location is the only source\n   * this module has and a per-request one would be module state two concurrent\n   * requests could race over (route-table.ts:10-25).\n   *\n   * That makes it a HYDRATION HAZARD in a component: the server renders `{}`\n   * and the browser renders the real values, so the two trees differ. In a\n   * component, take the query from the page's own props and hand it to\n   * {@link queryString.parse}, which is universal. `all()` is for browser-only\n   * code — an event handler, an effect, a client-side helper.\n   */\n  all(): QueryStringObject {\n    return decode(browserSearch());\n  },\n\n  /**\n   * Decode a query string that was handed to you.\n   *\n   * Universal: it reads no globals, so this is the entry point that is safe on\n   * the server. Accepts a bare pair list, a leading `?`, a path, or a full URL.\n   */\n  parse(search: string): QueryStringObject {\n    return decode(search);\n  },\n\n  /**\n   * One key from the current query string.\n   *\n   * PRESENCE, not truthiness. MRR returns `all[key] || defaultValue`\n   * (query-string.ts:43), which hands back the default for `?a=` — so a\n   * deliberately-cleared filter reads as though it was never set, and the page\n   * shows the default instead of the empty state. Here `?a=` returns `\"\"`, and\n   * only an absent key returns the default.\n   *\n   * @param defaultValue returned only when the key is absent. Defaults to\n   * `null`, as MRR's does.\n   */\n  get<T = null>(key: string, defaultValue: T = null as T): QueryStringValue | T {\n    const all = decode(browserSearch());\n\n    return key in all ? all[key] : defaultValue;\n  },\n\n  /**\n   * The current query string verbatim, without the leading `?`.\n   *\n   * `\"\"` on the server, and `\"\"` when there is no query — the same two cases\n   * `queryStringOf` collapses when it writes.\n   */\n  toString(): string {\n    return searchPairsOf(browserSearch());\n  },\n};\n"],"mappings":";;;;;;;;AAqHA,IAAa,gCAAb,cAAmD,MAAM;CAErC;CACA;CAFlB,AAAO,YACL,AAAgB,UAChB,AAAgB,OAChB;EACA,MACE,sBAAsB,MAAM,yBAAyB,SAAS,6fAOhE;EAXgB;EACA;EAWhB,KAAK,OAAO;CACd;AACF;;;;;;;;;;;;;AAcA,SAAS,SAAS,OAAwB;CACxC,MAAM,aAAc,MAAiC;CAErD,OAAO,OAAO,eAAe,cAAc,eAAe,OAAO,UAAU;AAC7E;;AAGA,SAAS,YAAY,KAAa,OAAsB;CACtD,IAAI,MAAM,QAAQ,KAAK,GACrB,MAAM,IAAI,8BAA8B,KAAK,gBAAgB;CAG/D,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS,KAAK,GAC/D,MAAM,IAAI,8BAA8B,KAAK,iBAAiB;AAElE;;;;;;;;;;;;AAaA,SAAS,YAAY,QAAyB,KAAa,OAAiC;CAC1F,MAAM,WAAW,GAAG,IAAI;CAExB,KAAK,MAAM,WAAW,OAAO;EAC3B,IAAI,YAAY,QAAW;EAE3B,YAAY,UAAU,OAAO;EAE7B,OAAO,OAAO,UAAU,OAAO,OAAO,CAAC;CACzC;AACF;;AAGA,SAAS,UAAU,QAAyB,KAAa,OAAqB;CAC5E,KAAK,MAAM,CAAC,QAAQ,aAAa,OAAO,QAAQ,KAAK,GAAG;EACtD,IAAI,aAAa,QAAW;EAE5B,MAAM,YAAY,GAAG,IAAI,GAAG,OAAO;EAEnC,IAAI,MAAM,QAAQ,QAAQ,GAAG;GAC3B,YAAY,QAAQ,WAAW,QAAQ;GACvC;EACF;EAEA,YAAY,WAAW,QAAQ;EAE/B,OAAO,OAAO,WAAW,OAAO,QAAQ,CAAC;CAC3C;AACF;;;;;;;;;;;;AAaA,SAAgB,cAAc,OAA6C;CACzE,IAAI,UAAU,QAAW,OAAO;CAEhC,MAAM,SAAS,IAAI,gBAAgB;CAEnC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,UAAU,QAAW;EAEzB,IAAI,MAAM,QAAQ,KAAK,GAAG;GACxB,YAAY,QAAQ,KAAK,KAAK;GAC9B;EACF;EAEA,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,SAAS,KAAK,GAAG;GAClE,UAAU,QAAQ,KAAK,KAAK;GAC5B;EACF;EAEA,OAAO,OAAO,KAAK,OAAO,KAAK,CAAC;CAClC;CAEA,MAAM,aAAa,OAAO,SAAS;CAEnC,OAAO,eAAe,KAAK,KAAK,IAAI;AACtC;AA0DA,MAAM,kBAA8C,EAClD,cAAc,OAChB;;;;;;;;;AAUA,MAAM,eAAe,OAAO,IAAI,gCAAgC;AAMhE,SAAS,iBAA6C;CACpD,OAAQ,WAA2B,iBAAiB;AACtD;;;;;;;;AASA,SAAgB,sBAAsB,SAAmC;CACvE,AAAC,WAA2B,gBAAgB;EAAE,GAAG,eAAe;EAAG,GAAG;CAAQ;AAChF;;;;;;;;AASA,SAAgB,0BAAgC;CAC9C,OAAQ,WAA2B;AACrC;;;;;;;AAQA,SAAS,gBAAwB;CAC/B,IAAI,OAAO,WAAW,aAAa,OAAO;CAE1C,OAAO,OAAO,UAAU,UAAU;AACpC;;;;;;;;;;;;AAaA,SAAS,cAAc,QAAwB;CAC7C,MAAM,cAAc,OAAO,MAAM,KAAK,CAAC,EAAE;CACzC,MAAM,eAAe,YAAY,QAAQ,GAAG;CAE5C,OAAO,iBAAiB,KAAK,cAAc,YAAY,MAAM,eAAe,CAAC;AAC/E;;;;;;;AAQA,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,mBAAmB;;;;;;;;;AAgBzB,SAAS,SAAS,KAAwB;CACxC,MAAM,cAAc,iBAAiB,KAAK,GAAG;CAE7C,IAAI,aACF,OAAO;EAAE,MAAM;EAAe,MAAM,YAAY;EAAI,QAAQ,YAAY;CAAG;CAG7E,MAAM,QAAQ,UAAU,KAAK,GAAG;CAEhC,IAAI,OAAO,OAAO;EAAE,MAAM;EAAS,MAAM,MAAM;CAAG;CAElD,MAAM,SAAS,WAAW,KAAK,GAAG;CAElC,IAAI,QAAQ,OAAO;EAAE,MAAM;EAAU,MAAM,OAAO;EAAI,QAAQ,OAAO;CAAG;CAExE,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACpC;;AAGA,SAAS,WAAgC;CACvC,OAAO,OAAO,OAAO,IAAI;AAC3B;AAEA,SAAS,MAAM,OAA4C;CACzD,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;;;;;;;AAUA,SAAS,QAAQ,WAAoC,MAAwB;CAC3E,MAAM,WAAW,UAAU;CAE3B,IAAI,MAAM,QAAQ,QAAQ,GAAG,OAAO;CAEpC,MAAM,UAAoB,CAAC;CAE3B,UAAU,QAAQ;CAElB,OAAO;AACT;;AAGA,SAAS,MAAM,QAA2B,MAAiC;CACzE,MAAM,WAAW,OAAO;CAExB,IAAI,MAAM,QAAQ,GAAG,OAAO;CAE5B,MAAM,UAAU,SAA4B;CAE5C,OAAO,QAAQ;CAEf,OAAO;AACT;;;;;;;;;;;;;;AAeA,SAAS,OAAO,QAAmC;CACjD,MAAM,QAAQ,cAAc,MAAM;CAClC,MAAM,SAAS,SAA4B;CAE3C,IAAI,UAAU,IAAI,OAAO;CAEzB,MAAM,EAAE,iBAAiB,eAAe;CAExC,KAAK,MAAM,CAAC,KAAK,UAAU,IAAI,gBAAgB,KAAK,GAAG;EACrD,MAAM,SAAS,SAAS,GAAG;EAE3B,IAAI,OAAO,SAAS,SAAS;GAC3B,QAAQ,QAAQ,OAAO,IAAI,EAAE,KAAK,KAAK;GACvC;EACF;EAEA,IAAI,OAAO,SAAS,eAAe;GACjC,QAAQ,MAAM,QAAQ,OAAO,IAAI,GAAG,OAAO,MAAM,EAAE,KAAK,KAAK;GAC7D;EACF;EAEA,IAAI,OAAO,SAAS,UAAU;GAI5B,MAAM,QAAQ,OAAO,IAAI,EAAE,OAAO,UAAU;GAC5C;EACF;EAEA,IAAI,EAAE,OAAO,QAAQ,SAAS;GAC5B,OAAO,OAAO,QAAQ,iBAAiB,UAAU,CAAC,KAAK,IAAI;GAC3D;EACF;EAEA,IAAI,iBAAiB,SAAS;EAE9B,IAAI,iBAAiB,QAAQ;GAC3B,OAAO,OAAO,QAAQ;GACtB;EACF;EAEA,QAAQ,QAAQ,OAAO,IAAI,EAAE,KAAK,KAAK;CACzC;CAEA,OAAO;AACT;;;;;;;;AASA,MAAa,cAAc;;;;;;;;;;;;;;CAczB,MAAyB;EACvB,OAAO,OAAO,cAAc,CAAC;CAC/B;;;;;;;CAQA,MAAM,QAAmC;EACvC,OAAO,OAAO,MAAM;CACtB;;;;;;;;;;;;;CAcA,IAAc,KAAa,eAAkB,MAAiC;EAC5E,MAAM,MAAM,OAAO,cAAc,CAAC;EAElC,OAAO,OAAO,MAAM,IAAI,OAAO;CACjC;;;;;;;CAQA,WAAmB;EACjB,OAAO,cAAc,cAAc,CAAC;CACtC;AACF"}

package/esm/routing/route-identity.mjs

@@ -1,4 +1,4 @@
-//#region web/src/routing/route-identity.ts
+//#region ../web/src/routing/route-identity.ts
 /**
 * Raised when a caller passes a `sourceFile` containing a backslash.
 * Canonical means canonical: this module does not normalize Windows path

package/esm/routing/route-identity.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"route-identity.mjs","names":[],"sources":["C:/Work/Warlock.js/web/src/routing/route-identity.ts"],"sourcesContent":["/**\n * Route identity — the single, pure implementation of \"what is this page's\n * route path and name\". The dev installer\n * (`web/src/server/install-page-routes.ts`), the production manifest\n * installer (`web/src/server/install-page-routes-from-manifest.ts`) and\n * discovery (`web/src/build/discover-pages.ts`) each hand-derived this on\n * their own until all three were made to delegate here.\n *\n * Pure string logic only: no `fs`, no `path`, no Node built-ins. Every input\n * this module accepts is already CANONICAL — a POSIX, app-root-relative\n * source path (e.g. `\"src/app/users/web/account/settings.page.tsx\"` or\n * `\"src/web/index.page.tsx\"`) and an already-validated declared route export.\n * Turning an absolute, OS-specific file path into that canonical form is the\n * caller's job; this module refuses (see {@link NonPosixSourceFilePathError})\n * rather than guess at a normalization.\n *\n * Well-formedness of the declared `route` export itself (is it a string or an\n * object, does the object have a `path`) is the extractor's problem — already\n * rejected at build before either derivation function here is called.\n *\n * DIRECTORY CONTRACT — applies to everything in `web/src/routing/`: nothing\n * here may import `node:fs`, `node:path`, `vite`, or `fastify`. Modules in\n * this directory receive canonical values and trust nothing — they assert\n * rather than trust, but they never repair. A module that needs the\n * filesystem does not belong here. The purity is deliberate: it keeps these\n * modules consumable from the dev server, the build, the production runtime,\n * and — if ever needed — the browser client, without dragging any of those\n * environments along.\n */\n\n/** The shape a page's `route` export may declare — mirrors `PageRouteExport` in `install-page-routes.ts`. */\nexport type DeclaredRouteExport = string | { path: string; name?: string };\n\n/** The canonical form every declared `route` export resolves to. */\nexport type CanonicalRoute = {\n  path: string;\n  name?: string;\n};\n\n/** The canonical inputs {@link deriveFallbackRouteName} requires — see the module doc comment for what \"canonical\" means. */\nexport type RouteNameFallbackInput = {\n  /** The page's declared route path, e.g. `\"/settings\"` or `\"/\"`. */\n  routePath: string;\n  /** The page's app-root-relative POSIX source path, e.g. `\"src/app/main/web/contact-us.page.tsx\"`. */\n  sourceFile: string;\n};\n\n/**\n * Raised when a caller passes a `sourceFile` containing a backslash.\n * Canonical means canonical: this module does not normalize Windows path\n * separators on the caller's behalf.\n */\nexport class NonPosixSourceFilePathError extends Error {\n  public constructor(public readonly sourceFile: string) {\n    super(\n      `route-identity: sourceFile \"${sourceFile}\" contains a backslash. This module's inputs ` +\n        \"must already be canonical app-root-relative POSIX paths (forward slashes only) — \" +\n        'normalize with `value.replace(/\\\\\\\\/g, \"/\")` before calling deriveFallbackRouteName.',\n    );\n    this.name = \"NonPosixSourceFilePathError\";\n  }\n}\n\n/**\n * Canonicalizes a declared `route` export — string or `{ path, name? }` —\n * into `{ path, name? }`. Requires well-formed input; an export that is\n * neither a string nor an object with a `path` is the extractor's problem,\n * already rejected before this function is ever called.\n */\nexport function canonicalizeRouteExport(route: DeclaredRouteExport): CanonicalRoute {\n  if (typeof route === \"string\") {\n    return { path: route };\n  }\n\n  return route.name === undefined ? { path: route.path } : { path: route.path, name: route.name };\n}\n\n/** Strips leading and trailing \".\" characters — mirrors `trim(value, \".\")` as used by the installer's `deriveRouteName`. */\nfunction trimDots(value: string): string {\n  return value.replace(/^\\.+|\\.+$/g, \"\");\n}\n\n/**\n * The module segment a canonical source path declares, or `undefined` for a\n * global (`src/web/**`) page. `sourceFile` is `<srcDir>/app/<module>/web/...`\n * or `<srcDir>/web/...` — the first segment is the (arbitrarily named) src\n * dir, so the module test looks at the SECOND segment.\n */\nfunction moduleSegmentFor(sourceFile: string): string | undefined {\n  const segments = sourceFile.split(\"/\");\n\n  return segments[1] === \"app\" ? segments[2] : undefined;\n}\n\n/**\n * Derives the fallback route name for a page whose declared route carries no\n * `name` — the same derivation the dev installer's `deriveRouteName` applies\n * today (`web/src/server/install-page-routes.ts`), expressed against\n * canonical inputs instead of an absolute file path plus an `appSrcRoot`.\n *\n * The installer only ever calls its derivation for a page under\n * `<appSrcRoot>/app/**`, so a global (`src/web/**`) page has no installer\n * behaviour to mirror; for that case this function instead follows\n * discovery's own convention (`routeNameFor` in `discover-pages.ts`) — no\n * module prefix, and `\"index\"` when there is nothing left to say at all.\n *\n * Throws {@link NonPosixSourceFilePathError} when `sourceFile` contains a\n * backslash.\n */\nexport function deriveFallbackRouteName(input: RouteNameFallbackInput): string {\n  const { routePath, sourceFile } = input;\n\n  if (sourceFile.includes(\"\\\\\")) {\n    throw new NonPosixSourceFilePathError(sourceFile);\n  }\n\n  const moduleName = moduleSegmentFor(sourceFile);\n  const suffix = trimDots(routePath.replace(/\\//g, \".\"));\n\n  if (moduleName !== undefined) {\n    return suffix ? `${moduleName}.${suffix}` : moduleName;\n  }\n\n  return suffix || \"index\";\n}\n"],"mappings":";;;;;;AAoDA,IAAa,8BAAb,cAAiD,MAAM;CAClB;CAAnC,AAAO,YAAY,AAAgB,YAAoB;EACrD,MACE,+BAA+B,WAAW,qNAG5C;EALiC;EAMjC,KAAK,OAAO;CACd;AACF;;;;;;;AAQA,SAAgB,wBAAwB,OAA4C;CAClF,IAAI,OAAO,UAAU,UACnB,OAAO,EAAE,MAAM,MAAM;CAGvB,OAAO,MAAM,SAAS,SAAY,EAAE,MAAM,MAAM,KAAK,IAAI;EAAE,MAAM,MAAM;EAAM,MAAM,MAAM;CAAK;AAChG;;AAGA,SAAS,SAAS,OAAuB;CACvC,OAAO,MAAM,QAAQ,cAAc,EAAE;AACvC;;;;;;;AAQA,SAAS,iBAAiB,YAAwC;CAChE,MAAM,WAAW,WAAW,MAAM,GAAG;CAErC,OAAO,SAAS,OAAO,QAAQ,SAAS,KAAK;AAC/C;;;;;;;;;;;;;;;;AAiBA,SAAgB,wBAAwB,OAAuC;CAC7E,MAAM,EAAE,WAAW,eAAe;CAElC,IAAI,WAAW,SAAS,IAAI,GAC1B,MAAM,IAAI,4BAA4B,UAAU;CAGlD,MAAM,aAAa,iBAAiB,UAAU;CAC9C,MAAM,SAAS,SAAS,UAAU,QAAQ,OAAO,GAAG,CAAC;CAErD,IAAI,eAAe,QACjB,OAAO,SAAS,GAAG,WAAW,GAAG,WAAW;CAG9C,OAAO,UAAU;AACnB"}
+{"version":3,"file":"route-identity.mjs","names":[],"sources":["../../../../../../../web/src/routing/route-identity.ts"],"sourcesContent":["/**\n * Route identity — the single, pure implementation of \"what is this page's\n * route path and name\". The dev installer\n * (`web/src/server/install-page-routes.ts`), the production manifest\n * installer (`web/src/server/install-page-routes-from-manifest.ts`) and\n * discovery (`web/src/build/discover-pages.ts`) each hand-derived this on\n * their own until all three were made to delegate here.\n *\n * Pure string logic only: no `fs`, no `path`, no Node built-ins. Every input\n * this module accepts is already CANONICAL — a POSIX, app-root-relative\n * source path (e.g. `\"src/app/users/web/account/settings.page.tsx\"` or\n * `\"src/web/index.page.tsx\"`) and an already-validated declared route export.\n * Turning an absolute, OS-specific file path into that canonical form is the\n * caller's job; this module refuses (see {@link NonPosixSourceFilePathError})\n * rather than guess at a normalization.\n *\n * Well-formedness of the declared `route` export itself (is it a string or an\n * object, does the object have a `path`) is the extractor's problem — already\n * rejected at build before either derivation function here is called.\n *\n * DIRECTORY CONTRACT — applies to everything in `web/src/routing/`: nothing\n * here may import `node:fs`, `node:path`, `vite`, or `fastify`. Modules in\n * this directory receive canonical values and trust nothing — they assert\n * rather than trust, but they never repair. A module that needs the\n * filesystem does not belong here. The purity is deliberate: it keeps these\n * modules consumable from the dev server, the build, the production runtime,\n * and — if ever needed — the browser client, without dragging any of those\n * environments along.\n */\n\n/** The shape a page's `route` export may declare — mirrors `PageRouteExport` in `install-page-routes.ts`. */\nexport type DeclaredRouteExport = string | { path: string; name?: string };\n\n/** The canonical form every declared `route` export resolves to. */\nexport type CanonicalRoute = {\n  path: string;\n  name?: string;\n};\n\n/** The canonical inputs {@link deriveFallbackRouteName} requires — see the module doc comment for what \"canonical\" means. */\nexport type RouteNameFallbackInput = {\n  /** The page's declared route path, e.g. `\"/settings\"` or `\"/\"`. */\n  routePath: string;\n  /** The page's app-root-relative POSIX source path, e.g. `\"src/app/main/web/contact-us.page.tsx\"`. */\n  sourceFile: string;\n};\n\n/**\n * Raised when a caller passes a `sourceFile` containing a backslash.\n * Canonical means canonical: this module does not normalize Windows path\n * separators on the caller's behalf.\n */\nexport class NonPosixSourceFilePathError extends Error {\n  public constructor(public readonly sourceFile: string) {\n    super(\n      `route-identity: sourceFile \"${sourceFile}\" contains a backslash. This module's inputs ` +\n        \"must already be canonical app-root-relative POSIX paths (forward slashes only) — \" +\n        'normalize with `value.replace(/\\\\\\\\/g, \"/\")` before calling deriveFallbackRouteName.',\n    );\n    this.name = \"NonPosixSourceFilePathError\";\n  }\n}\n\n/**\n * Canonicalizes a declared `route` export — string or `{ path, name? }` —\n * into `{ path, name? }`. Requires well-formed input; an export that is\n * neither a string nor an object with a `path` is the extractor's problem,\n * already rejected before this function is ever called.\n */\nexport function canonicalizeRouteExport(route: DeclaredRouteExport): CanonicalRoute {\n  if (typeof route === \"string\") {\n    return { path: route };\n  }\n\n  return route.name === undefined ? { path: route.path } : { path: route.path, name: route.name };\n}\n\n/** Strips leading and trailing \".\" characters — mirrors `trim(value, \".\")` as used by the installer's `deriveRouteName`. */\nfunction trimDots(value: string): string {\n  return value.replace(/^\\.+|\\.+$/g, \"\");\n}\n\n/**\n * The module segment a canonical source path declares, or `undefined` for a\n * global (`src/web/**`) page. `sourceFile` is `<srcDir>/app/<module>/web/...`\n * or `<srcDir>/web/...` — the first segment is the (arbitrarily named) src\n * dir, so the module test looks at the SECOND segment.\n */\nfunction moduleSegmentFor(sourceFile: string): string | undefined {\n  const segments = sourceFile.split(\"/\");\n\n  return segments[1] === \"app\" ? segments[2] : undefined;\n}\n\n/**\n * Derives the fallback route name for a page whose declared route carries no\n * `name` — the same derivation the dev installer's `deriveRouteName` applies\n * today (`web/src/server/install-page-routes.ts`), expressed against\n * canonical inputs instead of an absolute file path plus an `appSrcRoot`.\n *\n * The installer only ever calls its derivation for a page under\n * `<appSrcRoot>/app/**`, so a global (`src/web/**`) page has no installer\n * behaviour to mirror; for that case this function instead follows\n * discovery's own convention (`routeNameFor` in `discover-pages.ts`) — no\n * module prefix, and `\"index\"` when there is nothing left to say at all.\n *\n * Throws {@link NonPosixSourceFilePathError} when `sourceFile` contains a\n * backslash.\n */\nexport function deriveFallbackRouteName(input: RouteNameFallbackInput): string {\n  const { routePath, sourceFile } = input;\n\n  if (sourceFile.includes(\"\\\\\")) {\n    throw new NonPosixSourceFilePathError(sourceFile);\n  }\n\n  const moduleName = moduleSegmentFor(sourceFile);\n  const suffix = trimDots(routePath.replace(/\\//g, \".\"));\n\n  if (moduleName !== undefined) {\n    return suffix ? `${moduleName}.${suffix}` : moduleName;\n  }\n\n  return suffix || \"index\";\n}\n"],"mappings":";;;;;;AAoDA,IAAa,8BAAb,cAAiD,MAAM;CAClB;CAAnC,AAAO,YAAY,AAAgB,YAAoB;EACrD,MACE,+BAA+B,WAAW,qNAG5C;EALiC;EAMjC,KAAK,OAAO;CACd;AACF;;;;;;;AAQA,SAAgB,wBAAwB,OAA4C;CAClF,IAAI,OAAO,UAAU,UACnB,OAAO,EAAE,MAAM,MAAM;CAGvB,OAAO,MAAM,SAAS,SAAY,EAAE,MAAM,MAAM,KAAK,IAAI;EAAE,MAAM,MAAM;EAAM,MAAM,MAAM;CAAK;AAChG;;AAGA,SAAS,SAAS,OAAuB;CACvC,OAAO,MAAM,QAAQ,cAAc,EAAE;AACvC;;;;;;;AAQA,SAAS,iBAAiB,YAAwC;CAChE,MAAM,WAAW,WAAW,MAAM,GAAG;CAErC,OAAO,SAAS,OAAO,QAAQ,SAAS,KAAK;AAC/C;;;;;;;;;;;;;;;;AAiBA,SAAgB,wBAAwB,OAAuC;CAC7E,MAAM,EAAE,WAAW,eAAe;CAElC,IAAI,WAAW,SAAS,IAAI,GAC1B,MAAM,IAAI,4BAA4B,UAAU;CAGlD,MAAM,aAAa,iBAAiB,UAAU;CAC9C,MAAM,SAAS,SAAS,UAAU,QAAQ,OAAO,GAAG,CAAC;CAErD,IAAI,eAAe,QACjB,OAAO,SAAS,GAAG,WAAW,GAAG,WAAW;CAG9C,OAAO,UAAU;AACnB"}

package/esm/routing/route-table.d.mts

@@ -1,6 +1,6 @@
 import { QueryStringInput } from "./query-string.mjs";
 
-//#region web/src/routing/route-table.d.ts
+//#region ../web/src/routing/route-table.d.ts
 /** What `href` accepts for a `:param` segment. Rendered with `String(value)`. */
 type RouteParameters = Readonly<Record<string, unknown>>;
 /**

package/esm/routing/route-table.mjs

@@ -1,6 +1,6 @@
 import { queryStringOf } from "./query-string.mjs";
 
-//#region web/src/routing/route-table.ts
+//#region ../web/src/routing/route-table.ts
 /**
 * The name→URL primitive, and the one route table both sides read.
 *