react-router 7.11.0 → 7.12.0

package/dist/development/dom-export.js

@@ -1,5 +1,5 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }/**
- * react-router v7.11.0
+ * react-router v7.12.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -13,7 +13,7 @@
 
 
 
-var _chunkGNDLROV6js = require('./chunk-GNDLROV6.js');
+var _chunkG2I2SRFAjs = require('./chunk-G2I2SRFA.js');
 
 
 
@@ -32,7 +32,7 @@ var _chunkGNDLROV6js = require('./chunk-GNDLROV6.js');
 
 
 
-var _chunkSZQUWNVJjs = require('./chunk-SZQUWNVJ.js');
+var _chunk2BEI23B2js = require('./chunk-2BEI23B2.js');
 
 // lib/dom-export/dom-router-provider.tsx
 var _react = require('react'); var React = _interopRequireWildcard(_react); var React2 = _interopRequireWildcard(_react); var React3 = _interopRequireWildcard(_react);
@@ -166,7 +166,8 @@ function createHydratedRouter({
       ssrInfo.manifest,
       ssrInfo.routeModules,
       ssrInfo.context.ssr,
-      ssrInfo.context.basename
+      ssrInfo.context.basename,
+      ssrInfo.context.future.unstable_trailingSlashAwareDataRequests
     ),
     patchRoutesOnNavigation: _reactrouter.UNSAFE_getPatchRoutesOnNavigationFunction.call(void 0, 
       ssrInfo.manifest,
@@ -204,7 +205,7 @@ function HydratedRouter(props) {
   }, []);
   React2.useEffect(() => {
     if (process.env.NODE_ENV === "development" && criticalCss === void 0) {
-      document.querySelectorAll(`[${_chunkSZQUWNVJjs.CRITICAL_CSS_DATA_ATTRIBUTE}]`).forEach((element) => element.remove());
+      document.querySelectorAll(`[${_chunk2BEI23B2js.CRITICAL_CSS_DATA_ATTRIBUTE}]`).forEach((element) => element.remove());
     }
   }, [criticalCss]);
   let [location2, setLocation] = React2.useState(router.state.location);
@@ -376,10 +377,10 @@ function createRouterFromPayload({
     };
   if (payload.type !== "render") throw new Error("Invalid payload type");
   globalVar.__reactRouterRouteModules = _nullishCoalesce(globalVar.__reactRouterRouteModules, () => ( {}));
-  _chunkGNDLROV6js.populateRSCRouteModules.call(void 0, globalVar.__reactRouterRouteModules, payload.matches);
+  _chunkG2I2SRFAjs.populateRSCRouteModules.call(void 0, globalVar.__reactRouterRouteModules, payload.matches);
   let patches = /* @__PURE__ */ new Map();
   _optionalChain([payload, 'access', _22 => _22.patches, 'optionalAccess', _23 => _23.forEach, 'call', _24 => _24((patch) => {
-    _chunkSZQUWNVJjs.invariant.call(void 0, patch.parentId, "Invalid patch parentId");
+    _chunk2BEI23B2js.invariant.call(void 0, patch.parentId, "Invalid patch parentId");
     if (!patches.has(patch.parentId)) {
       patches.set(patch.parentId, []);
     }
@@ -401,12 +402,12 @@ function createRouterFromPayload({
     }
     return [route];
   }, []);
-  globalVar.__reactRouterDataRouter = _chunkSZQUWNVJjs.createRouter.call(void 0, {
+  globalVar.__reactRouterDataRouter = _chunk2BEI23B2js.createRouter.call(void 0, {
     routes,
     getContext,
     basename: payload.basename,
-    history: _chunkSZQUWNVJjs.createBrowserHistory.call(void 0, ),
-    hydrationData: _chunkGNDLROV6js.getHydrationData.call(void 0, {
+    history: _chunk2BEI23B2js.createBrowserHistory.call(void 0, ),
+    hydrationData: _chunkG2I2SRFAjs.getHydrationData.call(void 0, {
       state: {
         loaderData: payload.loaderData,
         actionData: payload.actionData,
@@ -415,7 +416,7 @@ function createRouterFromPayload({
       routes,
       getRouteInfo: (routeId) => {
         let match = payload.matches.find((m) => m.id === routeId);
-        _chunkSZQUWNVJjs.invariant.call(void 0, match, "Route not found in payload");
+        _chunk2BEI23B2js.invariant.call(void 0, match, "Route not found in payload");
         return {
           clientLoader: match.clientLoader,
           hasLoader: match.hasLoader,
@@ -513,9 +514,9 @@ function createRouterFromPayload({
     routeModules: globalVar.__reactRouterRouteModules
   };
 }
-var renderedRoutesContext = _chunkSZQUWNVJjs.createContext.call(void 0, );
+var renderedRoutesContext = _chunk2BEI23B2js.createContext.call(void 0, );
 function getRSCSingleFetchDataStrategy(getRouter, ssr, basename, createFromReadableStream, fetchImplementation) {
-  let dataStrategy = _chunkSZQUWNVJjs.getSingleFetchDataStrategyImpl.call(void 0, 
+  let dataStrategy = _chunk2BEI23B2js.getSingleFetchDataStrategyImpl.call(void 0, 
     getRouter,
     (match) => {
       let M = match;
@@ -532,6 +533,8 @@ function getRSCSingleFetchDataStrategy(getRouter, ssr, basename, createFromReada
     getFetchAndDecodeViaRSC(createFromReadableStream, fetchImplementation),
     ssr,
     basename,
+    // .rsc requests are always trailing slash aware
+    true,
     // If the route has a component but we don't have an element, we need to hit
     // the server loader flow regardless of whether the client loader calls
     // `serverLoader` or not, otherwise we'll have nothing to render.
@@ -569,22 +572,22 @@ function getRSCSingleFetchDataStrategy(getRouter, ssr, basename, createFromReada
   });
 }
 function getFetchAndDecodeViaRSC(createFromReadableStream, fetchImplementation) {
-  return async (args, basename, targetRoutes) => {
+  return async (args, basename, trailingSlashAware, targetRoutes) => {
     let { request, context } = args;
-    let url = _chunkSZQUWNVJjs.singleFetchUrl.call(void 0, request.url, basename, "rsc");
+    let url = _chunk2BEI23B2js.singleFetchUrl.call(void 0, request.url, basename, trailingSlashAware, "rsc");
     if (request.method === "GET") {
-      url = _chunkSZQUWNVJjs.stripIndexParam.call(void 0, url);
+      url = _chunk2BEI23B2js.stripIndexParam.call(void 0, url);
       if (targetRoutes) {
         url.searchParams.set("_routes", targetRoutes.join(","));
       }
     }
     let res = await fetchImplementation(
-      new Request(url, await _chunkSZQUWNVJjs.createRequestInit.call(void 0, request))
+      new Request(url, await _chunk2BEI23B2js.createRequestInit.call(void 0, request))
     );
     if (res.status >= 400 && !res.headers.has("X-Remix-Response")) {
-      throw new (0, _chunkSZQUWNVJjs.ErrorResponseImpl)(res.status, res.statusText, await res.text());
+      throw new (0, _chunk2BEI23B2js.ErrorResponseImpl)(res.status, res.statusText, await res.text());
     }
-    _chunkSZQUWNVJjs.invariant.call(void 0, res.body, "No response body to decode");
+    _chunk2BEI23B2js.invariant.call(void 0, res.body, "No response body to decode");
     try {
       const payload = await createFromReadableStream(res.body, {
         temporaryReferences: void 0
@@ -608,7 +611,7 @@ function getFetchAndDecodeViaRSC(createFromReadableStream, fetchImplementation)
       }
       context.get(renderedRoutesContext).push(...payload.matches);
       let results = { routes: {} };
-      const dataKey = _chunkSZQUWNVJjs.isMutationMethod.call(void 0, request.method) ? "actionData" : "loaderData";
+      const dataKey = _chunk2BEI23B2js.isMutationMethod.call(void 0, request.method) ? "actionData" : "loaderData";
       for (let [routeId, data] of Object.entries(payload[dataKey] || {})) {
         results.routes[routeId] = { data };
       }
@@ -641,7 +644,7 @@ function RSCHydratedRouter({
     [createFromReadableStream, payload, fetchImplementation, getContext]
   );
   React3.useEffect(() => {
-    _chunkSZQUWNVJjs.setIsHydrated.call(void 0, );
+    _chunk2BEI23B2js.setIsHydrated.call(void 0, );
   }, []);
   React3.useLayoutEffect(() => {
     const globalVar = window;
@@ -726,7 +729,9 @@ function RSCHydratedRouter({
       // These flags have no runtime impact so can always be false.  If we add
       // flags that drive runtime behavior they'll need to be proxied through.
       v8_middleware: false,
-      unstable_subResourceIntegrity: false
+      unstable_subResourceIntegrity: false,
+      unstable_trailingSlashAwareDataRequests: true
+      // always on for RSC
     },
     isSpaMode: false,
     ssr: true,
@@ -743,8 +748,8 @@ function RSCHydratedRouter({
     routeDiscovery: { mode: "lazy", manifestPath: "/__manifest" },
     routeModules
   };
-  return /* @__PURE__ */ React3.createElement(_chunkSZQUWNVJjs.RSCRouterContext.Provider, { value: true }, /* @__PURE__ */ React3.createElement(_chunkGNDLROV6js.RSCRouterGlobalErrorBoundary, { location: state.location }, /* @__PURE__ */ React3.createElement(_chunkSZQUWNVJjs.FrameworkContext.Provider, { value: frameworkContext }, /* @__PURE__ */ React3.createElement(
-    _chunkSZQUWNVJjs.RouterProvider,
+  return /* @__PURE__ */ React3.createElement(_chunk2BEI23B2js.RSCRouterContext.Provider, { value: true }, /* @__PURE__ */ React3.createElement(_chunkG2I2SRFAjs.RSCRouterGlobalErrorBoundary, { location: state.location }, /* @__PURE__ */ React3.createElement(_chunk2BEI23B2js.FrameworkContext.Provider, { value: frameworkContext }, /* @__PURE__ */ React3.createElement(
+    _chunk2BEI23B2js.RouterProvider,
     {
       router: transitionEnabledRouter,
       flushSync: ReactDOM2.flushSync
@@ -760,8 +765,8 @@ function createRouteFromServerManifest(match, payload) {
   // the server loader flow regardless of whether the client loader calls
   // `serverLoader` or not, otherwise we'll have nothing to render.
   match.hasComponent && !match.element;
-  _chunkSZQUWNVJjs.invariant.call(void 0, window.__reactRouterRouteModules);
-  _chunkGNDLROV6js.populateRSCRouteModules.call(void 0, window.__reactRouterRouteModules, match);
+  _chunk2BEI23B2js.invariant.call(void 0, window.__reactRouterRouteModules);
+  _chunkG2I2SRFAjs.populateRSCRouteModules.call(void 0, window.__reactRouterRouteModules, match);
   let dataRoute = {
     id: match.id,
     element: match.element,
@@ -811,7 +816,7 @@ function createRouteFromServerManifest(match, payload) {
         return await callSingleFetch(singleFetch);
       }
     }) : match.hasAction ? (_, singleFetch) => callSingleFetch(singleFetch) : () => {
-      throw _chunkSZQUWNVJjs.noActionDefinedError.call(void 0, "action", match.id);
+      throw _chunk2BEI23B2js.noActionDefinedError.call(void 0, "action", match.id);
     },
     path: match.path,
     shouldRevalidate: match.shouldRevalidate,
@@ -824,7 +829,7 @@ function createRouteFromServerManifest(match, payload) {
     hasShouldRevalidate: match.shouldRevalidate != null
   };
   if (typeof dataRoute.loader === "function") {
-    dataRoute.loader.hydrate = _chunkSZQUWNVJjs.shouldHydrateRouteLoader.call(void 0, 
+    dataRoute.loader.hydrate = _chunk2BEI23B2js.shouldHydrateRouteLoader.call(void 0, 
       match.id,
       match.clientLoader,
       match.hasLoader,
@@ -834,7 +839,7 @@ function createRouteFromServerManifest(match, payload) {
   return dataRoute;
 }
 function callSingleFetch(singleFetch) {
-  _chunkSZQUWNVJjs.invariant.call(void 0, typeof singleFetch === "function", "Invalid singleFetch parameter");
+  _chunk2BEI23B2js.invariant.call(void 0, typeof singleFetch === "function", "Invalid singleFetch parameter");
   return singleFetch();
 }
 function preventInvalidServerHandlerCall(type, routeId, hasHandler) {
@@ -842,7 +847,7 @@ function preventInvalidServerHandlerCall(type, routeId, hasHandler) {
     let fn = type === "action" ? "serverAction()" : "serverLoader()";
     let msg = `You are trying to call ${fn} on a route that does not have a server ${type} (routeId: "${routeId}")`;
     console.error(msg);
-    throw new (0, _chunkSZQUWNVJjs.ErrorResponseImpl)(400, "Bad Request", new Error(msg), true);
+    throw new (0, _chunk2BEI23B2js.ErrorResponseImpl)(400, "Bad Request", new Error(msg), true);
   }
 }
 var nextPaths = /* @__PURE__ */ new Set();

package/dist/development/dom-export.mjs

@@ -1,5 +1,5 @@
 /**
- * react-router v7.11.0
+ * react-router v7.12.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -14,7 +14,7 @@ import {
   deserializeErrors,
   getHydrationData,
   populateRSCRouteModules
-} from "./chunk-YNUBSHFH.mjs";
+} from "./chunk-FNSCYPCZ.mjs";
 import {
   CRITICAL_CSS_DATA_ATTRIBUTE,
   ErrorResponseImpl,
@@ -42,7 +42,7 @@ import {
   singleFetchUrl,
   stripIndexParam,
   useFogOFWarDiscovery
-} from "./chunk-JMJ3UQ3L.mjs";
+} from "./chunk-EPOLDU6W.mjs";
 
 // lib/dom-export/dom-router-provider.tsx
 import * as React from "react";
@@ -158,7 +158,8 @@ function createHydratedRouter({
       ssrInfo.manifest,
       ssrInfo.routeModules,
       ssrInfo.context.ssr,
-      ssrInfo.context.basename
+      ssrInfo.context.basename,
+      ssrInfo.context.future.unstable_trailingSlashAwareDataRequests
     ),
     patchRoutesOnNavigation: getPatchRoutesOnNavigationFunction(
       ssrInfo.manifest,
@@ -524,6 +525,8 @@ function getRSCSingleFetchDataStrategy(getRouter, ssr, basename, createFromReada
     getFetchAndDecodeViaRSC(createFromReadableStream, fetchImplementation),
     ssr,
     basename,
+    // .rsc requests are always trailing slash aware
+    true,
     // If the route has a component but we don't have an element, we need to hit
     // the server loader flow regardless of whether the client loader calls
     // `serverLoader` or not, otherwise we'll have nothing to render.
@@ -561,9 +564,9 @@ function getRSCSingleFetchDataStrategy(getRouter, ssr, basename, createFromReada
   });
 }
 function getFetchAndDecodeViaRSC(createFromReadableStream, fetchImplementation) {
-  return async (args, basename, targetRoutes) => {
+  return async (args, basename, trailingSlashAware, targetRoutes) => {
     let { request, context } = args;
-    let url = singleFetchUrl(request.url, basename, "rsc");
+    let url = singleFetchUrl(request.url, basename, trailingSlashAware, "rsc");
     if (request.method === "GET") {
       url = stripIndexParam(url);
       if (targetRoutes) {
@@ -718,7 +721,9 @@ function RSCHydratedRouter({
       // These flags have no runtime impact so can always be false.  If we add
       // flags that drive runtime behavior they'll need to be proxied through.
       v8_middleware: false,
-      unstable_subResourceIntegrity: false
+      unstable_subResourceIntegrity: false,
+      unstable_trailingSlashAwareDataRequests: true
+      // always on for RSC
     },
     isSpaMode: false,
     ssr: true,

package/dist/development/{index-react-server-client-P7VgYu6T.d.mts → index-react-server-client-IoJGLOqV.d.mts}

@@ -1,4 +1,4 @@
-import { bE as RouteManifest, q as RouteModules, W as HydrationState, a3 as DataRouteObject, a as ClientLoaderFunction, a7 as StaticHandlerContext, bF as ServerRouteModule, s as MiddlewareEnabled, c as RouterContextProvider, t as AppLoadContext, an as LoaderFunctionArgs, ae as ActionFunctionArgs, aw as unstable_ServerInstrumentation, al as HTMLFormMethod, aj as FormEncType, y as RelativeRoutingType, bh as PageLinkDescriptor, T as To, bG as History, a6 as GetScrollRestorationKeyFunction, e as RouterInit, bH as FutureConfig$1, u as unstable_ClientInstrumentation, r as DataStrategyFunction, a2 as PatchRoutesOnNavigationFunction, v as NavigateOptions, a8 as Fetcher, Q as RouteObject, p as Router, x as SerializeFrom, B as BlockerFunction, L as Location, bI as CreateStaticHandlerOptions$1, a4 as StaticHandler } from './router-5fbeEIMQ.mjs';
+import { bG as RouteManifest, q as RouteModules, W as HydrationState, a3 as DataRouteObject, a as ClientLoaderFunction, a7 as StaticHandlerContext, bH as ServerRouteModule, s as MiddlewareEnabled, c as RouterContextProvider, t as AppLoadContext, an as LoaderFunctionArgs, ae as ActionFunctionArgs, aw as unstable_ServerInstrumentation, al as HTMLFormMethod, aj as FormEncType, y as RelativeRoutingType, bh as PageLinkDescriptor, T as To, bI as History, a6 as GetScrollRestorationKeyFunction, e as RouterInit, bJ as FutureConfig$1, u as unstable_ClientInstrumentation, r as DataStrategyFunction, a2 as PatchRoutesOnNavigationFunction, v as NavigateOptions, a8 as Fetcher, Q as RouteObject, p as Router, x as SerializeFrom, B as BlockerFunction, L as Location, bK as CreateStaticHandlerOptions$1, a4 as StaticHandler } from './router-5iOvts3c.mjs';
 import * as React from 'react';
 
 interface Route {
@@ -59,6 +59,7 @@ interface EntryContext extends FrameworkContextObject {
 }
 interface FutureConfig {
     unstable_subResourceIntegrity: boolean;
+    unstable_trailingSlashAwareDataRequests: boolean;
     v8_middleware: boolean;
 }
 type CriticalCss = string | {
@@ -113,6 +114,7 @@ interface ServerBuild {
         mode: "lazy" | "initial";
         manifestPath: string;
     };
+    allowedActionOrigins?: string[] | false;
 }
 interface HandleDocumentRequestFunction {
     (request: Request, responseStatusCode: number, responseHeaders: Headers, context: EntryContext, loadContext: MiddlewareEnabled extends true ? RouterContextProvider : AppLoadContext): Promise<Response> | Response;

package/dist/{production/index-react-server-client-Cv5Q9lf0.d.ts → development/index-react-server-client-gGyf-7Xp.d.ts}

@@ -1,4 +1,4 @@
-import { bE as RouteManifest, o as RouteModules, Q as HydrationState, a1 as DataRouteObject, a as ClientLoaderFunction, a5 as StaticHandlerContext, bF as ServerRouteModule, q as MiddlewareEnabled, c as RouterContextProvider, r as AppLoadContext, al as LoaderFunctionArgs, ac as ActionFunctionArgs, au as unstable_ServerInstrumentation, aj as HTMLFormMethod, ah as FormEncType, w as RelativeRoutingType, bh as PageLinkDescriptor, T as To, bG as History, a4 as GetScrollRestorationKeyFunction, e as RouterInit, bH as FutureConfig$1, u as unstable_ClientInstrumentation, p as DataStrategyFunction, a0 as PatchRoutesOnNavigationFunction, s as NavigateOptions, a6 as Fetcher, K as RouteObject, n as Router, v as SerializeFrom, B as BlockerFunction, L as Location, bI as CreateStaticHandlerOptions$1, a2 as StaticHandler } from './instrumentation-BlrVzjbg.js';
+import { bG as RouteManifest, o as RouteModules, Q as HydrationState, a1 as DataRouteObject, a as ClientLoaderFunction, a5 as StaticHandlerContext, bH as ServerRouteModule, q as MiddlewareEnabled, c as RouterContextProvider, r as AppLoadContext, al as LoaderFunctionArgs, ac as ActionFunctionArgs, au as unstable_ServerInstrumentation, aj as HTMLFormMethod, ah as FormEncType, w as RelativeRoutingType, bh as PageLinkDescriptor, T as To, bI as History, a4 as GetScrollRestorationKeyFunction, e as RouterInit, bJ as FutureConfig$1, u as unstable_ClientInstrumentation, p as DataStrategyFunction, a0 as PatchRoutesOnNavigationFunction, s as NavigateOptions, a6 as Fetcher, K as RouteObject, n as Router, v as SerializeFrom, B as BlockerFunction, L as Location, bK as CreateStaticHandlerOptions$1, a2 as StaticHandler } from './instrumentation-DvHY1sgY.js';
 import * as React from 'react';
 
 interface Route {
@@ -59,6 +59,7 @@ interface EntryContext extends FrameworkContextObject {
 }
 interface FutureConfig {
     unstable_subResourceIntegrity: boolean;
+    unstable_trailingSlashAwareDataRequests: boolean;
     v8_middleware: boolean;
 }
 type CriticalCss = string | {
@@ -113,6 +114,7 @@ interface ServerBuild {
         mode: "lazy" | "initial";
         manifestPath: string;
     };
+    allowedActionOrigins?: string[] | false;
 }
 interface HandleDocumentRequestFunction {
     (request: Request, responseStatusCode: number, responseHeaders: Headers, context: EntryContext, loadContext: MiddlewareEnabled extends true ? RouterContextProvider : AppLoadContext): Promise<Response> | Response;

package/dist/development/index-react-server-client.d.mts

@@ -1,3 +1,3 @@
-export { b2 as MemoryRouter, b3 as Navigate, b4 as Outlet, b5 as Route, b6 as Router, b7 as RouterProvider, b8 as Routes, aR as UNSAFE_AwaitContextProvider, by as UNSAFE_WithComponentProps, bC as UNSAFE_WithErrorBoundaryProps, bA as UNSAFE_WithHydrateFallbackProps } from './router-5fbeEIMQ.mjs';
-export { l as BrowserRouter, q as Form, m as HashRouter, n as Link, X as Links, W as Meta, p as NavLink, r as ScrollRestoration, T as StaticRouter, V as StaticRouterProvider, o as unstable_HistoryRouter } from './index-react-server-client-P7VgYu6T.mjs';
+export { b2 as MemoryRouter, b3 as Navigate, b4 as Outlet, b5 as Route, b6 as Router, b7 as RouterProvider, b8 as Routes, aR as UNSAFE_AwaitContextProvider, bA as UNSAFE_WithComponentProps, bE as UNSAFE_WithErrorBoundaryProps, bC as UNSAFE_WithHydrateFallbackProps } from './router-5iOvts3c.mjs';
+export { l as BrowserRouter, q as Form, m as HashRouter, n as Link, X as Links, W as Meta, p as NavLink, r as ScrollRestoration, T as StaticRouter, V as StaticRouterProvider, o as unstable_HistoryRouter } from './index-react-server-client-IoJGLOqV.mjs';
 import 'react';

package/dist/development/index-react-server-client.d.ts

@@ -1,3 +1,3 @@
-export { b2 as MemoryRouter, b3 as Navigate, b4 as Outlet, b5 as Route, b6 as Router, b7 as RouterProvider, b8 as Routes, aP as UNSAFE_AwaitContextProvider, by as UNSAFE_WithComponentProps, bC as UNSAFE_WithErrorBoundaryProps, bA as UNSAFE_WithHydrateFallbackProps } from './instrumentation-BlrVzjbg.js';
-export { l as BrowserRouter, q as Form, m as HashRouter, n as Link, X as Links, W as Meta, p as NavLink, r as ScrollRestoration, T as StaticRouter, V as StaticRouterProvider, o as unstable_HistoryRouter } from './index-react-server-client-Cv5Q9lf0.js';
+export { b2 as MemoryRouter, b3 as Navigate, b4 as Outlet, b5 as Route, b6 as Router, b7 as RouterProvider, b8 as Routes, aP as UNSAFE_AwaitContextProvider, bA as UNSAFE_WithComponentProps, bE as UNSAFE_WithErrorBoundaryProps, bC as UNSAFE_WithHydrateFallbackProps } from './instrumentation-DvHY1sgY.js';
+export { l as BrowserRouter, q as Form, m as HashRouter, n as Link, X as Links, W as Meta, p as NavLink, r as ScrollRestoration, T as StaticRouter, V as StaticRouterProvider, o as unstable_HistoryRouter } from './index-react-server-client-gGyf-7Xp.js';
 import 'react';

package/dist/development/index-react-server-client.js

@@ -1,5 +1,5 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true});/**
- * react-router v7.11.0
+ * react-router v7.12.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -19,7 +19,7 @@
 
 
 
-var _chunk2JY4UAJAjs = require('./chunk-2JY4UAJA.js');
+var _chunk7ZCBDOCZjs = require('./chunk-7ZCBDOCZ.js');
 
 
 
@@ -34,7 +34,7 @@ var _chunk2JY4UAJAjs = require('./chunk-2JY4UAJA.js');
 
 
 
-var _chunkSZQUWNVJjs = require('./chunk-SZQUWNVJ.js');
+var _chunk2BEI23B2js = require('./chunk-2BEI23B2.js');
 
 
 
@@ -58,4 +58,4 @@ var _chunkSZQUWNVJjs = require('./chunk-SZQUWNVJ.js');
 
 
 
-exports.BrowserRouter = _chunk2JY4UAJAjs.BrowserRouter; exports.Form = _chunk2JY4UAJAjs.Form; exports.HashRouter = _chunk2JY4UAJAjs.HashRouter; exports.Link = _chunk2JY4UAJAjs.Link; exports.Links = _chunkSZQUWNVJjs.Links; exports.MemoryRouter = _chunkSZQUWNVJjs.MemoryRouter; exports.Meta = _chunkSZQUWNVJjs.Meta; exports.NavLink = _chunk2JY4UAJAjs.NavLink; exports.Navigate = _chunkSZQUWNVJjs.Navigate; exports.Outlet = _chunkSZQUWNVJjs.Outlet; exports.Route = _chunkSZQUWNVJjs.Route; exports.Router = _chunkSZQUWNVJjs.Router; exports.RouterProvider = _chunkSZQUWNVJjs.RouterProvider; exports.Routes = _chunkSZQUWNVJjs.Routes; exports.ScrollRestoration = _chunk2JY4UAJAjs.ScrollRestoration; exports.StaticRouter = _chunk2JY4UAJAjs.StaticRouter; exports.StaticRouterProvider = _chunk2JY4UAJAjs.StaticRouterProvider; exports.UNSAFE_AwaitContextProvider = _chunkSZQUWNVJjs.AwaitContextProvider; exports.UNSAFE_WithComponentProps = _chunkSZQUWNVJjs.WithComponentProps; exports.UNSAFE_WithErrorBoundaryProps = _chunkSZQUWNVJjs.WithErrorBoundaryProps; exports.UNSAFE_WithHydrateFallbackProps = _chunkSZQUWNVJjs.WithHydrateFallbackProps; exports.unstable_HistoryRouter = _chunk2JY4UAJAjs.HistoryRouter;
+exports.BrowserRouter = _chunk7ZCBDOCZjs.BrowserRouter; exports.Form = _chunk7ZCBDOCZjs.Form; exports.HashRouter = _chunk7ZCBDOCZjs.HashRouter; exports.Link = _chunk7ZCBDOCZjs.Link; exports.Links = _chunk2BEI23B2js.Links; exports.MemoryRouter = _chunk2BEI23B2js.MemoryRouter; exports.Meta = _chunk2BEI23B2js.Meta; exports.NavLink = _chunk7ZCBDOCZjs.NavLink; exports.Navigate = _chunk2BEI23B2js.Navigate; exports.Outlet = _chunk2BEI23B2js.Outlet; exports.Route = _chunk2BEI23B2js.Route; exports.Router = _chunk2BEI23B2js.Router; exports.RouterProvider = _chunk2BEI23B2js.RouterProvider; exports.Routes = _chunk2BEI23B2js.Routes; exports.ScrollRestoration = _chunk7ZCBDOCZjs.ScrollRestoration; exports.StaticRouter = _chunk7ZCBDOCZjs.StaticRouter; exports.StaticRouterProvider = _chunk7ZCBDOCZjs.StaticRouterProvider; exports.UNSAFE_AwaitContextProvider = _chunk2BEI23B2js.AwaitContextProvider; exports.UNSAFE_WithComponentProps = _chunk2BEI23B2js.WithComponentProps; exports.UNSAFE_WithErrorBoundaryProps = _chunk2BEI23B2js.WithErrorBoundaryProps; exports.UNSAFE_WithHydrateFallbackProps = _chunk2BEI23B2js.WithHydrateFallbackProps; exports.unstable_HistoryRouter = _chunk7ZCBDOCZjs.HistoryRouter;

package/dist/development/index-react-server-client.mjs

@@ -1,5 +1,5 @@
 /**
- * react-router v7.11.0
+ * react-router v7.12.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -32,7 +32,7 @@ import {
   WithComponentProps,
   WithErrorBoundaryProps,
   WithHydrateFallbackProps
-} from "./chunk-JMJ3UQ3L.mjs";
+} from "./chunk-EPOLDU6W.mjs";
 export {
   BrowserRouter,
   Form,

package/dist/development/index-react-server.d.mts

@@ -2238,6 +2238,7 @@ type LoadServerActionFunction = (id: string) => Promise<Function>;
  * @category RSC
  * @mode data
  * @param opts Options
+ * @param opts.allowedActionOrigins Origin patterns that are allowed to execute actions.
  * @param opts.basename The basename to use when matching the request.
  * @param opts.createTemporaryReferenceSet A function that returns a temporary
  * reference set for the request, used to track temporary references in the [RSC](https://react.dev/reference/rsc/server-components)
@@ -2267,7 +2268,8 @@ type LoadServerActionFunction = (id: string) => Promise<Function>;
  * that contains the [RSC](https://react.dev/reference/rsc/server-components)
  * data for hydration.
  */
-declare function matchRSCServerRequest({ createTemporaryReferenceSet, basename, decodeReply, requestContext, loadServerAction, decodeAction, decodeFormState, onError, request, routes, generateResponse, }: {
+declare function matchRSCServerRequest({ allowedActionOrigins, createTemporaryReferenceSet, basename, decodeReply, requestContext, loadServerAction, decodeAction, decodeFormState, onError, request, routes, generateResponse, }: {
+    allowedActionOrigins?: string[];
     createTemporaryReferenceSet: () => unknown;
     basename?: string;
     decodeReply?: DecodeReplyFunction;

package/dist/development/index-react-server.d.ts

@@ -2238,6 +2238,7 @@ type LoadServerActionFunction = (id: string) => Promise<Function>;
  * @category RSC
  * @mode data
  * @param opts Options
+ * @param opts.allowedActionOrigins Origin patterns that are allowed to execute actions.
  * @param opts.basename The basename to use when matching the request.
  * @param opts.createTemporaryReferenceSet A function that returns a temporary
  * reference set for the request, used to track temporary references in the [RSC](https://react.dev/reference/rsc/server-components)
@@ -2267,7 +2268,8 @@ type LoadServerActionFunction = (id: string) => Promise<Function>;
  * that contains the [RSC](https://react.dev/reference/rsc/server-components)
  * data for hydration.
  */
-declare function matchRSCServerRequest({ createTemporaryReferenceSet, basename, decodeReply, requestContext, loadServerAction, decodeAction, decodeFormState, onError, request, routes, generateResponse, }: {
+declare function matchRSCServerRequest({ allowedActionOrigins, createTemporaryReferenceSet, basename, decodeReply, requestContext, loadServerAction, decodeAction, decodeFormState, onError, request, routes, generateResponse, }: {
+    allowedActionOrigins?: string[];
     createTemporaryReferenceSet: () => unknown;
     basename?: string;
     decodeReply?: DecodeReplyFunction;

package/dist/development/index-react-server.js

@@ -27,7 +27,7 @@ function _interopNamespace(e) {
 var React2__namespace = /*#__PURE__*/_interopNamespace(React2);
 
 /**
- * react-router v7.11.0
+ * react-router v7.12.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -166,6 +166,9 @@ function getRouteInstrumentationUpdates(fns, route) {
         (...args) => getHandlerInfo(args[0])
       );
       if (instrumented) {
+        if (key === "loader" && original.hydrate === true) {
+          instrumented.hydrate = true;
+        }
         instrumented[UninstrumentedSymbol] = original;
         updates[key] = instrumented;
       }
@@ -2394,6 +2397,85 @@ function prependCookies(parentHeaders, childHeaders) {
 }
 var SINGLE_FETCH_REDIRECT_STATUS = 202;
 
+// lib/actions.ts
+function throwIfPotentialCSRFAttack(headers, allowedActionOrigins) {
+  let originHeader = headers.get("origin");
+  let originDomain = typeof originHeader === "string" && originHeader !== "null" ? new URL(originHeader).host : originHeader;
+  let host = parseHostHeader(headers);
+  if (originDomain && (!host || originDomain !== host.value)) {
+    if (!isAllowedOrigin(originDomain, allowedActionOrigins)) {
+      if (host) {
+        throw new Error(
+          `${host.type} header does not match \`origin\` header from a forwarded action request. Aborting the action.`
+        );
+      } else {
+        throw new Error(
+          "`x-forwarded-host` or `host` headers are not provided. One of these is needed to compare the `origin` header from a forwarded action request. Aborting the action."
+        );
+      }
+    }
+  }
+}
+function matchWildcardDomain(domain, pattern) {
+  const domainParts = domain.split(".");
+  const patternParts = pattern.split(".");
+  if (patternParts.length < 1) {
+    return false;
+  }
+  if (domainParts.length < patternParts.length) {
+    return false;
+  }
+  if (patternParts.length === 1 && (patternParts[0] === "*" || patternParts[0] === "**")) {
+    return false;
+  }
+  while (patternParts.length) {
+    const patternPart = patternParts.pop();
+    const domainPart = domainParts.pop();
+    switch (patternPart) {
+      case "": {
+        return false;
+      }
+      case "*": {
+        if (domainPart) {
+          continue;
+        } else {
+          return false;
+        }
+      }
+      case "**": {
+        if (patternParts.length > 0) {
+          return false;
+        }
+        return domainPart !== void 0;
+      }
+      case void 0:
+      default: {
+        if (domainPart !== patternPart) {
+          return false;
+        }
+      }
+    }
+  }
+  return domainParts.length === 0;
+}
+function isAllowedOrigin(originDomain, allowedActionOrigins = []) {
+  return allowedActionOrigins.some(
+    (allowedOrigin) => allowedOrigin && (allowedOrigin === originDomain || matchWildcardDomain(originDomain, allowedOrigin))
+  );
+}
+function parseHostHeader(headers) {
+  let forwardedHostHeader = headers.get("x-forwarded-host");
+  let forwardedHostValue = forwardedHostHeader?.split(",")[0]?.trim();
+  let hostHeader = headers.get("host");
+  return forwardedHostValue ? {
+    type: "x-forwarded-host",
+    value: forwardedHostValue
+  } : hostHeader ? {
+    type: "host",
+    value: hostHeader
+  } : void 0;
+}
+
 // lib/errors.ts
 var ERROR_DIGEST_BASE = "REACT_ROUTER_ERROR";
 var ERROR_DIGEST_REDIRECT = "REDIRECT";
@@ -2489,6 +2571,7 @@ var Await = async ({
   });
 };
 async function matchRSCServerRequest({
+  allowedActionOrigins,
   createTemporaryReferenceSet,
   basename,
   decodeReply,
@@ -2504,10 +2587,10 @@ async function matchRSCServerRequest({
   let url = new URL(request.url);
   basename = basename || "/";
   let normalizedPath = url.pathname;
-  if (stripBasename(normalizedPath, basename) === "/_root.rsc") {
-    normalizedPath = basename;
-  } else if (normalizedPath.endsWith(".rsc")) {
-    normalizedPath = normalizedPath.replace(/\.rsc$/, "");
+  if (url.pathname.endsWith("/_.rsc")) {
+    normalizedPath = url.pathname.replace(/_\.rsc$/, "");
+  } else if (url.pathname.endsWith(".rsc")) {
+    normalizedPath = url.pathname.replace(/\.rsc$/, "");
   }
   if (stripBasename(normalizedPath, basename) !== "/" && normalizedPath.endsWith("/")) {
     normalizedPath = normalizedPath.slice(0, -1);
@@ -2561,7 +2644,8 @@ async function matchRSCServerRequest({
     decodeFormState,
     onError,
     generateResponse,
-    temporaryReferences
+    temporaryReferences,
+    allowedActionOrigins
   );
   response.headers.set("X-Remix-Response", "yes");
   return response;
@@ -2740,7 +2824,7 @@ async function generateResourceResponse(request, routes, basename, routeId, requ
     });
   }
 }
-async function generateRenderResponse(request, routes, basename, isDataRequest, decodeReply, requestContext, loadServerAction, decodeAction, decodeFormState, onError, generateResponse, temporaryReferences) {
+async function generateRenderResponse(request, routes, basename, isDataRequest, decodeReply, requestContext, loadServerAction, decodeAction, decodeFormState, onError, generateResponse, temporaryReferences, allowedActionOrigins) {
   let statusCode = 200;
   let url = new URL(request.url);
   let isSubmission = isMutationMethod(request.method);
@@ -2766,6 +2850,7 @@ async function generateRenderResponse(request, routes, basename, isDataRequest,
         let formState;
         let skipRevalidation = false;
         if (request.method === "POST") {
+          throwIfPotentialCSRFAttack(request.headers, allowedActionOrigins);
           ctx.runningAction = true;
           let result2 = await processServerAction(
             request,