react-router 7.18.2 → 7.18.4

package/dist/production/{chunk-TP6EHSSF.js → chunk-YNGRUB6F.js}

@@ -1,5 +1,5 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }/**
- * react-router v7.18.2
+ * react-router v7.18.4
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -784,13 +784,16 @@ function matchPathImpl(pattern, pathname, matcher, compiledParams) {
   let match = pathname.match(matcher);
   if (!match) return null;
   let matchedPathname = match[0];
-  let pathnameBase = matchedPathname.replace(/(.)\/+$/, "$1");
+  let pathnameBase = removeTrailingSlash(matchedPathname, 1);
   let captureGroups = match.slice(1);
   let params = compiledParams.reduce(
     (memo2, { paramName, isOptional }, index) => {
       if (paramName === "*") {
         let splatValue = captureGroups[index] || "";
-        pathnameBase = matchedPathname.slice(0, matchedPathname.length - splatValue.length).replace(/(.)\/+$/, "$1");
+        pathnameBase = removeTrailingSlash(
+          matchedPathname.slice(0, matchedPathname.length - splatValue.length),
+          1
+        );
       }
       const value = captureGroups[index];
       if (isOptional && !value) {
@@ -880,7 +883,7 @@ function resolvePath(to, fromPathname = "/") {
   let pathname;
   if (toPathname) {
     toPathname = removeDoubleSlashes(toPathname);
-    if (toPathname.startsWith("/")) {
+    if (toPathname.startsWith("/") || toPathname.startsWith("\\")) {
       pathname = resolvePathname(toPathname.substring(1), "/");
     } else {
       pathname = resolvePathname(toPathname, fromPathname);
@@ -968,7 +971,13 @@ function resolveTo(toArg, routePathnames, locationPathname, isPathRelative = fal
 }
 var removeDoubleSlashes = (path) => path.replace(/[\\/]{2,}/g, "/");
 var joinPaths = (paths) => removeDoubleSlashes(paths.join("/"));
-var removeTrailingSlash = (path) => path.replace(/\/+$/, "");
+function removeTrailingSlash(path, minLength = 0) {
+  let end = path.length;
+  while (end > minLength && path.charCodeAt(end - 1) === 47) {
+    end--;
+  }
+  return end === path.length ? path : path.slice(0, end);
+}
 var normalizePathname = (pathname) => removeTrailingSlash(pathname).replace(/^\/*/, "/");
 var normalizeSearch = (search) => !search || search === "?" ? "" : search.startsWith("?") ? search : "?" + search;
 var normalizeHash = (hash) => !hash || hash === "#" ? "" : hash.startsWith("#") ? hash : "#" + hash;
@@ -1341,6 +1350,51 @@ function isPlainObject(thing) {
   return proto === Object.prototype || proto === null || Object.getOwnPropertyNames(proto).sort().join("\0") === objectProtoNames;
 }
 
+// lib/router/navigation.ts
+var DEFAULT_NAVIGATION_URL = new URL("http://localhost");
+function getNavigatorCurrentUrl(navigator) {
+  if (navigator.createURL) {
+    return navigator.createURL("/");
+  }
+  try {
+    return new URL(navigator.createHref("/"), DEFAULT_NAVIGATION_URL);
+  } catch (e2) {
+    return DEFAULT_NAVIGATION_URL;
+  }
+}
+function isSameOrigin(a, b) {
+  return a.origin === b.origin && (a.origin !== "null" || a.protocol === b.protocol && a.host === b.host);
+}
+function isExplicitUrl(destination, target) {
+  if (destination.startsWith("//")) {
+    return true;
+  }
+  let protocol = target.protocol.toLowerCase();
+  if (!destination.toLowerCase().startsWith(protocol)) {
+    return false;
+  }
+  return target.host === "" || destination.slice(protocol.length).startsWith("//");
+}
+function validateNavigationTarget(original, resolved, currentUrl, externalPolicy) {
+  let originalUrl = null;
+  try {
+    originalUrl = original == null ? null : new URL(original, currentUrl);
+  } catch (e3) {
+  }
+  let resolvedUrl = new URL(resolved, currentUrl);
+  let originalIsExternal = originalUrl != null && !isSameOrigin(originalUrl, currentUrl);
+  let resolvedIsExternal = !isSameOrigin(resolvedUrl, currentUrl);
+  if (externalPolicy === "reject") {
+    if (originalIsExternal || resolvedIsExternal) {
+      throw new Error("External navigation is not allowed");
+    }
+  } else if (resolvedIsExternal) {
+    if (originalUrl == null || !isExplicitUrl(original, originalUrl) || !isSameOrigin(originalUrl, resolvedUrl)) {
+      throw new Error("External navigation is not allowed");
+    }
+  }
+}
+
 // lib/router/router.ts
 var validMutationMethodsArr = [
   "POST",
@@ -1764,7 +1818,7 @@ function createRouter(init) {
       init.history.replace(location, location.state);
     }
     let viewTransitionOpts;
-    if (pendingAction === "POP" /* Pop */) {
+    if (pendingAction === "POP" /* Pop */ && !isUninterruptedRevalidation && location !== state.location) {
       let priorPaths = appliedViewTransitions.get(state.location.pathname);
       if (priorPaths && priorPaths.has(location.pathname)) {
         viewTransitionOpts = {
@@ -1852,11 +1906,21 @@ function createRouter(init) {
         ...opts.mask
       };
       maskPath = {
-        pathname: "",
-        search: "",
-        hash: "",
-        ...partialPath
+        pathname: _nullishCoalesce(partialPath.pathname, () => ( "")),
+        search: _nullishCoalesce(partialPath.search, () => ( "")),
+        hash: _nullishCoalesce(partialPath.hash, () => ( ""))
       };
+      if (PROTOCOL_RELATIVE_URL_REGEX.test(maskPath.pathname)) {
+        throw new Error("External navigation is not allowed");
+      } else if (maskPath.pathname.startsWith("\\")) {
+        maskPath.pathname = maskPath.pathname.replace(/^\\+/, "/");
+      }
+      validateNavigationTarget(
+        typeof opts.mask === "string" ? opts.mask : createPath(opts.mask),
+        createPath(maskPath),
+        init.history.createURL("/"),
+        "reject"
+      );
     }
     let currentLocation = state.location;
     let nextLocation = createLocation(
@@ -1870,6 +1934,12 @@ function createRouter(init) {
       ...nextLocation,
       ...init.history.encodeLocation(nextLocation)
     };
+    validateNavigationTarget(
+      to == null ? init.history.createHref(state.location) : typeof to === "string" ? to : createPath(to),
+      init.history.createHref(nextLocation.mask || nextLocation),
+      init.history.createURL("/"),
+      "reject"
+    );
     let userReplace = opts && opts.replace != null ? opts.replace : void 0;
     let historyAction = "PUSH" /* Push */;
     if (userReplace === true) {
@@ -2880,12 +2950,20 @@ function createRouter(init) {
     }
     let location = redirect2.response.headers.get("Location");
     invariant(location, "Expected a Location header on the redirect Response");
+    let originalLocation = location;
+    let currentUrl = new URL(request.url);
     location = normalizeRedirectLocation(
       location,
-      new URL(request.url),
+      currentUrl,
       basename,
       init.history
     );
+    validateNavigationTarget(
+      originalLocation,
+      location,
+      currentUrl,
+      "allow-explicit"
+    );
     let redirectLocation = createLocation(state.location, location, {
       _isRedirect: true
     });
@@ -3404,6 +3482,7 @@ function createRouter(init) {
     // Passthrough to history-aware createHref used by useHref so we get proper
     // hash-aware URLs in DOM paths
     createHref: (to) => init.history.createHref(to),
+    createURL: (to) => init.history.createURL(to),
     encodeLocation: (to) => init.history.encodeLocation(to),
     getFetcher,
     resetFetcher,
@@ -5244,7 +5323,7 @@ var invalidProtocols = [
 function hasInvalidProtocol(location) {
   try {
     return invalidProtocols.includes(new URL(location).protocol);
-  } catch (e2) {
+  } catch (e4) {
     return false;
   }
 }
@@ -6514,6 +6593,9 @@ var ESCAPE_REGEX = /[&><\u2028\u2029]/g;
 function escapeHtml(html) {
   return html.replace(ESCAPE_REGEX, (match) => ESCAPE_LOOKUP[match]);
 }
+function escapeAttribute(value) {
+  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
 
 // lib/dom/ssr/invariant.ts
 function invariant2(value, message) {
@@ -7085,7 +7167,7 @@ function decodeRedirectErrorDigest(digest) {
       if (typeof parsed === "object" && parsed && typeof parsed.status === "number" && typeof parsed.statusText === "string" && typeof parsed.location === "string" && typeof parsed.reloadDocument === "boolean" && typeof parsed.replace === "boolean") {
         return parsed;
       }
-    } catch (e3) {
+    } catch (e5) {
     }
   }
 }
@@ -7102,7 +7184,7 @@ function decodeRouteErrorResponseDigest(digest) {
           parsed.data
         );
       }
-    } catch (e4) {
+    } catch (e6) {
     }
   }
 }
@@ -7195,6 +7277,12 @@ function useNavigateUnstable() {
       if (dataRouterContext == null && basename !== "/") {
         path.pathname = path.pathname === "/" ? basename : joinPaths([basename, path.pathname]);
       }
+      validateNavigationTarget(
+        typeof to === "string" ? to : createPath(to),
+        navigator.createHref(path),
+        getNavigatorCurrentUrl(navigator),
+        "reject"
+      );
       (!!options.replace ? navigator.replace : navigator.push)(
         path,
         options.state,
@@ -7436,7 +7524,7 @@ function RSCErrorHandler({
   children,
   error
 }) {
-  let { basename } = React3.useContext(NavigationContext);
+  let { basename, navigator } = React3.useContext(NavigationContext);
   if (typeof error === "object" && error && "digest" in error && typeof error.digest === "string") {
     let redirect2 = decodeRedirectErrorDigest(error.digest);
     if (redirect2) {
@@ -7444,6 +7532,12 @@ function RSCErrorHandler({
       if (existingRedirect) throw existingRedirect;
       let parsed = parseToInfo(redirect2.location, basename);
       let target = parsed.absoluteURL || parsed.to;
+      validateNavigationTarget(
+        redirect2.location,
+        target,
+        getNavigatorCurrentUrl(navigator),
+        "allow-explicit"
+      );
       if (hasInvalidProtocol(target)) {
         throw new Error("Invalid redirect location");
       }
@@ -8685,7 +8779,7 @@ async function fetchAndApplyManifestPatches(paths, errorReloadPath, manifest, ro
           return;
         }
         sessionStorage.setItem(MANIFEST_VERSION_STORAGE_KEY, manifest.version);
-      } catch (e5) {
+      } catch (e7) {
       }
       window.location.href = errorReloadPath;
       console.warn("Detected manifest version mismatch, reloading...");
@@ -8696,7 +8790,7 @@ async function fetchAndApplyManifestPatches(paths, errorReloadPath, manifest, ro
     }
     try {
       sessionStorage.removeItem(MANIFEST_VERSION_STORAGE_KEY);
-    } catch (e6) {
+    } catch (e8) {
     }
     serverPatches = await res.json();
   } catch (e) {
@@ -9730,6 +9824,7 @@ function RouterProvider({
   let navigator = React9.useMemo(() => {
     return {
       createHref: router.createHref,
+      createURL: router.createURL,
       encodeLocation: router.encodeLocation,
       go: (n) => router.navigate(n),
       push: (to, state2, opts) => router.navigate(to, {
@@ -9862,7 +9957,7 @@ function Navigate({
     // the router loaded. We can help them understand how to avoid that.
     `<Navigate> may be used only in the context of a <Router> component.`
   );
-  let { static: isStatic } = React9.useContext(NavigationContext);
+  let { static: isStatic, navigator } = React9.useContext(NavigationContext);
   warning(
     !isStatic,
     `<Navigate> must not be used on the initial render in a <StaticRouter>. This is a no-op, but you should modify your code so the <Navigate> is only ever rendered in response to some user interaction or state change.`
@@ -9876,6 +9971,12 @@ function Navigate({
     locationPathname,
     relative === "path"
   );
+  validateNavigationTarget(
+    typeof to === "string" ? to : createPath(to),
+    navigator.createHref(path),
+    getNavigatorCurrentUrl(navigator),
+    "reject"
+  );
   let jsonPath = JSON.stringify(path);
   React9.useEffect(() => {
     navigate(JSON.parse(jsonPath), { replace: replace2, state, relative });
@@ -10304,4 +10405,6 @@ function withErrorBoundaryProps(ErrorBoundary) {
 
 
 
-exports.ABSOLUTE_URL_REGEX = ABSOLUTE_URL_REGEX; exports.PROTOCOL_RELATIVE_URL_REGEX = PROTOCOL_RELATIVE_URL_REGEX; exports.Action = Action; exports.createMemoryHistory = createMemoryHistory; exports.createBrowserHistory = createBrowserHistory; exports.createHashHistory = createHashHistory; exports.invariant = invariant; exports.warning = warning; exports.createPath = createPath; exports.parsePath = parsePath; exports.createContext = createContext; exports.RouterContextProvider = RouterContextProvider; exports.convertRoutesToDataRoutes = convertRoutesToDataRoutes; exports.matchRoutes = matchRoutes; exports.matchRoutesImpl = matchRoutesImpl; exports.generatePath = generatePath; exports.matchPath = matchPath; exports.stripBasename = stripBasename; exports.resolvePath = resolvePath; exports.resolveTo = resolveTo; exports.joinPaths = joinPaths; exports.data = data; exports.redirect = redirect; exports.redirectDocument = redirectDocument; exports.replace = replace; exports.SUPPORTED_ERROR_TYPES = SUPPORTED_ERROR_TYPES; exports.ErrorResponseImpl = ErrorResponseImpl; exports.isRouteErrorResponse = isRouteErrorResponse; exports.parseToInfo = parseToInfo; exports.escapeHtml = escapeHtml; exports.encode = encode; exports.instrumentHandler = instrumentHandler; exports.IDLE_NAVIGATION = IDLE_NAVIGATION; exports.IDLE_FETCHER = IDLE_FETCHER; exports.IDLE_BLOCKER = IDLE_BLOCKER; exports.createRouter = createRouter; exports.createStaticHandler = createStaticHandler; exports.getStaticContextFromError = getStaticContextFromError; exports.hasInvalidProtocol = hasInvalidProtocol; exports.isDataWithResponseInit = isDataWithResponseInit; exports.isResponse = isResponse; exports.isRedirectStatusCode = isRedirectStatusCode; exports.isRedirectResponse = isRedirectResponse; exports.isMutationMethod = isMutationMethod; exports.createRequestInit = createRequestInit; exports.SingleFetchRedirectSymbol = SingleFetchRedirectSymbol; exports.SINGLE_FETCH_REDIRECT_STATUS = SINGLE_FETCH_REDIRECT_STATUS; exports.NO_BODY_STATUS_CODES = NO_BODY_STATUS_CODES; exports.StreamTransfer = StreamTransfer; exports.getTurboStreamSingleFetchDataStrategy = getTurboStreamSingleFetchDataStrategy; exports.getSingleFetchDataStrategyImpl = getSingleFetchDataStrategyImpl; exports.stripIndexParam = stripIndexParam; exports.singleFetchUrl = singleFetchUrl; exports.decodeViaTurboStream = decodeViaTurboStream; exports.DataRouterContext = DataRouterContext; exports.DataRouterStateContext = DataRouterStateContext; exports.RSCRouterContext = RSCRouterContext; exports.ViewTransitionContext = ViewTransitionContext; exports.FetchersContext = FetchersContext; exports.AwaitContextProvider = AwaitContextProvider; exports.NavigationContext = NavigationContext; exports.LocationContext = LocationContext; exports.RouteContext = RouteContext; exports.ENABLE_DEV_WARNINGS = ENABLE_DEV_WARNINGS; exports.warnOnce = warnOnce; exports.decodeRedirectErrorDigest = decodeRedirectErrorDigest; exports.decodeRouteErrorResponseDigest = decodeRouteErrorResponseDigest; exports.useHref = useHref; exports.useInRouterContext = useInRouterContext; exports.useLocation = useLocation; exports.useNavigationType = useNavigationType; exports.useMatch = useMatch; exports.useNavigate = useNavigate; exports.useOutletContext = useOutletContext; exports.useOutlet = useOutlet; exports.useParams = useParams; exports.useResolvedPath = useResolvedPath; exports.useRoutes = useRoutes; exports.useRouteId = useRouteId; exports.useNavigation = useNavigation; exports.useRevalidator = useRevalidator; exports.useMatches = useMatches; exports.useLoaderData = useLoaderData; exports.useRouteLoaderData = useRouteLoaderData; exports.useActionData = useActionData; exports.useRouteError = useRouteError; exports.useAsyncValue = useAsyncValue; exports.useAsyncError = useAsyncError; exports.useBlocker = useBlocker; exports.useRoute = useRoute; exports.useRouterState = useRouterState; exports.RemixErrorBoundary = RemixErrorBoundary; exports.createServerRoutes = createServerRoutes; exports.createClientRoutesWithHMRRevalidationOptOut = createClientRoutesWithHMRRevalidationOptOut; exports.noActionDefinedError = noActionDefinedError; exports.createClientRoutes = createClientRoutes; exports.shouldHydrateRouteLoader = shouldHydrateRouteLoader; exports.URL_LIMIT = URL_LIMIT; exports.getPathsWithAncestors = getPathsWithAncestors; exports.getPatchRoutesOnNavigationFunction = getPatchRoutesOnNavigationFunction; exports.useFogOFWarDiscovery = useFogOFWarDiscovery; exports.getManifestPath = getManifestPath; exports.FrameworkContext = FrameworkContext; exports.usePrefetchBehavior = usePrefetchBehavior; exports.CRITICAL_CSS_DATA_ATTRIBUTE = CRITICAL_CSS_DATA_ATTRIBUTE; exports.Links = Links; exports.PrefetchPageLinks = PrefetchPageLinks; exports.Meta = Meta; exports.setIsHydrated = setIsHydrated; exports.Scripts = Scripts; exports.mergeRefs = mergeRefs; exports.mapRouteProperties = mapRouteProperties; exports.hydrationRouteProperties = hydrationRouteProperties; exports.createMemoryRouter = createMemoryRouter; exports.RouterProvider = RouterProvider; exports.DataRoutes = DataRoutes2; exports.MemoryRouter = MemoryRouter; exports.Navigate = Navigate; exports.Outlet = Outlet; exports.Route = Route; exports.Router = Router; exports.Routes = Routes; exports.Await = Await; exports.createRoutesFromChildren = createRoutesFromChildren; exports.createRoutesFromElements = createRoutesFromElements; exports.renderMatches = renderMatches; exports.WithComponentProps = WithComponentProps; exports.withComponentProps = withComponentProps; exports.WithHydrateFallbackProps = WithHydrateFallbackProps; exports.withHydrateFallbackProps = withHydrateFallbackProps; exports.WithErrorBoundaryProps = WithErrorBoundaryProps; exports.withErrorBoundaryProps = withErrorBoundaryProps;
+
+
+exports.ABSOLUTE_URL_REGEX = ABSOLUTE_URL_REGEX; exports.PROTOCOL_RELATIVE_URL_REGEX = PROTOCOL_RELATIVE_URL_REGEX; exports.Action = Action; exports.createMemoryHistory = createMemoryHistory; exports.createBrowserHistory = createBrowserHistory; exports.createHashHistory = createHashHistory; exports.invariant = invariant; exports.warning = warning; exports.createPath = createPath; exports.parsePath = parsePath; exports.createContext = createContext; exports.RouterContextProvider = RouterContextProvider; exports.convertRoutesToDataRoutes = convertRoutesToDataRoutes; exports.matchRoutes = matchRoutes; exports.matchRoutesImpl = matchRoutesImpl; exports.generatePath = generatePath; exports.matchPath = matchPath; exports.stripBasename = stripBasename; exports.resolvePath = resolvePath; exports.resolveTo = resolveTo; exports.joinPaths = joinPaths; exports.data = data; exports.redirect = redirect; exports.redirectDocument = redirectDocument; exports.replace = replace; exports.SUPPORTED_ERROR_TYPES = SUPPORTED_ERROR_TYPES; exports.ErrorResponseImpl = ErrorResponseImpl; exports.isRouteErrorResponse = isRouteErrorResponse; exports.parseToInfo = parseToInfo; exports.escapeHtml = escapeHtml; exports.escapeAttribute = escapeAttribute; exports.encode = encode; exports.instrumentHandler = instrumentHandler; exports.validateNavigationTarget = validateNavigationTarget; exports.IDLE_NAVIGATION = IDLE_NAVIGATION; exports.IDLE_FETCHER = IDLE_FETCHER; exports.IDLE_BLOCKER = IDLE_BLOCKER; exports.createRouter = createRouter; exports.createStaticHandler = createStaticHandler; exports.getStaticContextFromError = getStaticContextFromError; exports.hasInvalidProtocol = hasInvalidProtocol; exports.isDataWithResponseInit = isDataWithResponseInit; exports.isResponse = isResponse; exports.isRedirectStatusCode = isRedirectStatusCode; exports.isRedirectResponse = isRedirectResponse; exports.isMutationMethod = isMutationMethod; exports.createRequestInit = createRequestInit; exports.SingleFetchRedirectSymbol = SingleFetchRedirectSymbol; exports.SINGLE_FETCH_REDIRECT_STATUS = SINGLE_FETCH_REDIRECT_STATUS; exports.NO_BODY_STATUS_CODES = NO_BODY_STATUS_CODES; exports.StreamTransfer = StreamTransfer; exports.getTurboStreamSingleFetchDataStrategy = getTurboStreamSingleFetchDataStrategy; exports.getSingleFetchDataStrategyImpl = getSingleFetchDataStrategyImpl; exports.stripIndexParam = stripIndexParam; exports.singleFetchUrl = singleFetchUrl; exports.decodeViaTurboStream = decodeViaTurboStream; exports.DataRouterContext = DataRouterContext; exports.DataRouterStateContext = DataRouterStateContext; exports.RSCRouterContext = RSCRouterContext; exports.ViewTransitionContext = ViewTransitionContext; exports.FetchersContext = FetchersContext; exports.AwaitContextProvider = AwaitContextProvider; exports.NavigationContext = NavigationContext; exports.LocationContext = LocationContext; exports.RouteContext = RouteContext; exports.ENABLE_DEV_WARNINGS = ENABLE_DEV_WARNINGS; exports.warnOnce = warnOnce; exports.decodeRedirectErrorDigest = decodeRedirectErrorDigest; exports.decodeRouteErrorResponseDigest = decodeRouteErrorResponseDigest; exports.useHref = useHref; exports.useInRouterContext = useInRouterContext; exports.useLocation = useLocation; exports.useNavigationType = useNavigationType; exports.useMatch = useMatch; exports.useNavigate = useNavigate; exports.useOutletContext = useOutletContext; exports.useOutlet = useOutlet; exports.useParams = useParams; exports.useResolvedPath = useResolvedPath; exports.useRoutes = useRoutes; exports.useRouteId = useRouteId; exports.useNavigation = useNavigation; exports.useRevalidator = useRevalidator; exports.useMatches = useMatches; exports.useLoaderData = useLoaderData; exports.useRouteLoaderData = useRouteLoaderData; exports.useActionData = useActionData; exports.useRouteError = useRouteError; exports.useAsyncValue = useAsyncValue; exports.useAsyncError = useAsyncError; exports.useBlocker = useBlocker; exports.useRoute = useRoute; exports.useRouterState = useRouterState; exports.RemixErrorBoundary = RemixErrorBoundary; exports.createServerRoutes = createServerRoutes; exports.createClientRoutesWithHMRRevalidationOptOut = createClientRoutesWithHMRRevalidationOptOut; exports.noActionDefinedError = noActionDefinedError; exports.createClientRoutes = createClientRoutes; exports.shouldHydrateRouteLoader = shouldHydrateRouteLoader; exports.URL_LIMIT = URL_LIMIT; exports.getPathsWithAncestors = getPathsWithAncestors; exports.getPatchRoutesOnNavigationFunction = getPatchRoutesOnNavigationFunction; exports.useFogOFWarDiscovery = useFogOFWarDiscovery; exports.getManifestPath = getManifestPath; exports.FrameworkContext = FrameworkContext; exports.usePrefetchBehavior = usePrefetchBehavior; exports.CRITICAL_CSS_DATA_ATTRIBUTE = CRITICAL_CSS_DATA_ATTRIBUTE; exports.Links = Links; exports.PrefetchPageLinks = PrefetchPageLinks; exports.Meta = Meta; exports.setIsHydrated = setIsHydrated; exports.Scripts = Scripts; exports.mergeRefs = mergeRefs; exports.mapRouteProperties = mapRouteProperties; exports.hydrationRouteProperties = hydrationRouteProperties; exports.createMemoryRouter = createMemoryRouter; exports.RouterProvider = RouterProvider; exports.DataRoutes = DataRoutes2; exports.MemoryRouter = MemoryRouter; exports.Navigate = Navigate; exports.Outlet = Outlet; exports.Route = Route; exports.Router = Router; exports.Routes = Routes; exports.Await = Await; exports.createRoutesFromChildren = createRoutesFromChildren; exports.createRoutesFromElements = createRoutesFromElements; exports.renderMatches = renderMatches; exports.WithComponentProps = WithComponentProps; exports.withComponentProps = withComponentProps; exports.WithHydrateFallbackProps = WithHydrateFallbackProps; exports.withHydrateFallbackProps = withHydrateFallbackProps; exports.WithErrorBoundaryProps = WithErrorBoundaryProps; exports.withErrorBoundaryProps = withErrorBoundaryProps;

package/dist/{development/context-CeD5LmaF.d.mts → production/context-nqAapj74.d.mts}

@@ -207,6 +207,14 @@ interface Router$1 {
      * @param location
      */
     createHref(location: Location | URL): string;
+    /**
+     * @private
+     * PRIVATE - DO NOT USE
+     *
+     * Utility function to create a URL for the given location
+     * @param location
+     */
+    createURL?(to: To): URL;
     /**
      * @private
      * PRIVATE - DO NOT USE
@@ -1751,6 +1759,7 @@ interface NavigateOptions {
  */
 interface Navigator {
     createHref: History["createHref"];
+    createURL?: History["createURL"];
     encodeLocation?: History["encodeLocation"];
     go: History["go"];
     push(to: To, state?: any, opts?: NavigateOptions): void;

package/dist/production/dom-export.d.mts

@@ -1,6 +1,6 @@
 import * as React from 'react';
-import { a as RouterProviderProps$1, R as RouterInit, C as ClientInstrumentation, b as ClientOnErrorFunction } from './context-CeD5LmaF.mjs';
-export { D as unstable_DecodeActionFunction, a as unstable_DecodeFormStateFunction, b as unstable_DecodeReplyFunction, R as unstable_RSCHydratedRouter, d as unstable_RSCManifestPayload, e as unstable_RSCPayload, f as unstable_RSCRenderPayload, c as unstable_createCallServer } from './browser-DBmQ1yAR.mjs';
+import { a as RouterProviderProps$1, R as RouterInit, C as ClientInstrumentation, b as ClientOnErrorFunction } from './context-nqAapj74.mjs';
+export { D as unstable_DecodeActionFunction, a as unstable_DecodeFormStateFunction, b as unstable_DecodeReplyFunction, R as unstable_RSCHydratedRouter, d as unstable_RSCManifestPayload, e as unstable_RSCPayload, f as unstable_RSCRenderPayload, c as unstable_createCallServer } from './browser-BR5QG7ZC.mjs';
 import './data-DEjBmEfD.mjs';
 
 type RouterProviderProps = Omit<RouterProviderProps$1, "flushSync">;

package/dist/production/dom-export.d.ts

@@ -1,7 +1,7 @@
 import * as React from 'react';
 import { RouterProviderProps as RouterProviderProps$1, RouterInit, ClientOnErrorFunction } from 'react-router';
-import { C as ClientInstrumentation } from './instrumentation-Dkmpzd13.js';
-export { D as unstable_DecodeActionFunction, a as unstable_DecodeFormStateFunction, b as unstable_DecodeReplyFunction, R as unstable_RSCHydratedRouter, d as unstable_RSCManifestPayload, e as unstable_RSCPayload, f as unstable_RSCRenderPayload, c as unstable_createCallServer } from './browser-B2PdsXXH.js';
+import { C as ClientInstrumentation } from './instrumentation-B7w3_Eo9.js';
+export { D as unstable_DecodeActionFunction, a as unstable_DecodeFormStateFunction, b as unstable_DecodeReplyFunction, R as unstable_RSCHydratedRouter, d as unstable_RSCManifestPayload, e as unstable_RSCPayload, f as unstable_RSCRenderPayload, c as unstable_createCallServer } from './browser-eq4RgLsD.js';
 import './data-CjO11-hU.js';
 
 type RouterProviderProps = Omit<RouterProviderProps$1, "flushSync">;

package/dist/production/dom-export.js

@@ -1,5 +1,5 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }/**
- * react-router v7.18.2
+ * react-router v7.18.4
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -13,7 +13,7 @@
 
 
 
-var _chunkVJZ67BZEjs = require('./chunk-VJZ67BZE.js');
+var _chunkQURBR4FZjs = require('./chunk-QURBR4FZ.js');
 
 
 
@@ -37,7 +37,8 @@ var _chunkVJZ67BZEjs = require('./chunk-VJZ67BZE.js');
 
 
 
-var _chunkTP6EHSSFjs = require('./chunk-TP6EHSSF.js');
+
+var _chunkYNGRUB6Fjs = require('./chunk-YNGRUB6F.js');
 
 // lib/dom-export/dom-router-provider.tsx
 var _react = require('react'); var React = _interopRequireWildcard(_react); var React2 = _interopRequireWildcard(_react); var React3 = _interopRequireWildcard(_react);
@@ -213,7 +214,7 @@ function HydratedRouter(props) {
   }, []);
   React2.useEffect(() => {
     if (process.env.NODE_ENV === "development" && criticalCss === void 0) {
-      document.querySelectorAll(`[${_chunkTP6EHSSFjs.CRITICAL_CSS_DATA_ATTRIBUTE}]`).forEach((element) => element.remove());
+      document.querySelectorAll(`[${_chunkYNGRUB6Fjs.CRITICAL_CSS_DATA_ATTRIBUTE}]`).forEach((element) => element.remove());
     }
   }, [criticalCss]);
   let [location2, setLocation] = React2.useState(router.state.location);
@@ -307,8 +308,14 @@ function createCallServer({
         Promise.resolve(payloadPromise).then(async (payload) => {
           if (payload.type === "redirect") {
             let location2 = normalizeRedirectLocation(payload.location);
+            _chunkYNGRUB6Fjs.validateNavigationTarget.call(void 0, 
+              payload.location,
+              location2,
+              new URL(window.location.href),
+              "allow-explicit"
+            );
             if (payload.reload || isExternalLocation(location2)) {
-              if (_chunkTP6EHSSFjs.hasInvalidProtocol.call(void 0, location2)) {
+              if (_chunkYNGRUB6Fjs.hasInvalidProtocol.call(void 0, location2)) {
                 throw new Error("Invalid redirect location");
               }
               window.location.href = location2;
@@ -328,8 +335,14 @@ function createCallServer({
           if (rerender && landedActionId < actionId && globalVar.__routerActionID <= actionId) {
             if (rerender.type === "redirect") {
               let location2 = normalizeRedirectLocation(rerender.location);
+              _chunkYNGRUB6Fjs.validateNavigationTarget.call(void 0, 
+                rerender.location,
+                location2,
+                new URL(window.location.href),
+                "allow-explicit"
+              );
               if (rerender.reload || isExternalLocation(location2)) {
-                if (_chunkTP6EHSSFjs.hasInvalidProtocol.call(void 0, location2)) {
+                if (_chunkYNGRUB6Fjs.hasInvalidProtocol.call(void 0, location2)) {
                   throw new Error("Invalid redirect location");
                 }
                 window.location.href = location2;
@@ -394,7 +407,7 @@ function createRouterFromPayload({
     };
   if (payload.type !== "render") throw new Error("Invalid payload type");
   globalVar.__reactRouterRouteModules = _nullishCoalesce(globalVar.__reactRouterRouteModules, () => ( {}));
-  _chunkVJZ67BZEjs.populateRSCRouteModules.call(void 0, globalVar.__reactRouterRouteModules, payload.matches);
+  _chunkQURBR4FZjs.populateRSCRouteModules.call(void 0, globalVar.__reactRouterRouteModules, payload.matches);
   let routes = payload.matches.reduceRight((previous, match) => {
     const route = createRouteFromServerManifest(
       match,
@@ -408,12 +421,12 @@ function createRouterFromPayload({
     return [route];
   }, []);
   let applyPatchesPromise;
-  globalVar.__reactRouterDataRouter = _chunkTP6EHSSFjs.createRouter.call(void 0, {
+  globalVar.__reactRouterDataRouter = _chunkYNGRUB6Fjs.createRouter.call(void 0, {
     routes,
     getContext,
     basename: payload.basename,
-    history: _chunkTP6EHSSFjs.createBrowserHistory.call(void 0, ),
-    hydrationData: _chunkVJZ67BZEjs.getHydrationData.call(void 0, {
+    history: _chunkYNGRUB6Fjs.createBrowserHistory.call(void 0, ),
+    hydrationData: _chunkQURBR4FZjs.getHydrationData.call(void 0, {
       state: {
         loaderData: payload.loaderData,
         actionData: payload.actionData,
@@ -422,7 +435,7 @@ function createRouterFromPayload({
       routes,
       getRouteInfo: (routeId) => {
         let match = payload.matches.find((m) => m.id === routeId);
-        _chunkTP6EHSSFjs.invariant.call(void 0, match, "Route not found in payload");
+        _chunkYNGRUB6Fjs.invariant.call(void 0, match, "Route not found in payload");
         return {
           clientLoader: match.clientLoader,
           hasLoader: match.hasLoader,
@@ -537,9 +550,9 @@ function createRouterFromPayload({
     routeModules: globalVar.__reactRouterRouteModules
   };
 }
-var renderedRoutesContext = _chunkTP6EHSSFjs.createContext.call(void 0, );
+var renderedRoutesContext = _chunkYNGRUB6Fjs.createContext.call(void 0, );
 function getRSCSingleFetchDataStrategy(getRouter, ssr, basename, createFromReadableStream, fetchImplementation) {
-  let dataStrategy = _chunkTP6EHSSFjs.getSingleFetchDataStrategyImpl.call(void 0, 
+  let dataStrategy = _chunkYNGRUB6Fjs.getSingleFetchDataStrategyImpl.call(void 0, 
     getRouter,
     (match) => {
       let M = match;
@@ -596,20 +609,20 @@ function getRSCSingleFetchDataStrategy(getRouter, ssr, basename, createFromReada
 function getFetchAndDecodeViaRSC(createFromReadableStream, fetchImplementation) {
   return async (args, basename, trailingSlashAware, targetRoutes) => {
     let { request, context } = args;
-    let url = _chunkTP6EHSSFjs.singleFetchUrl.call(void 0, request.url, basename, trailingSlashAware, "rsc");
+    let url = _chunkYNGRUB6Fjs.singleFetchUrl.call(void 0, request.url, basename, trailingSlashAware, "rsc");
     if (request.method === "GET") {
-      url = _chunkTP6EHSSFjs.stripIndexParam.call(void 0, url);
+      url = _chunkYNGRUB6Fjs.stripIndexParam.call(void 0, url);
       if (targetRoutes) {
         url.searchParams.set("_routes", targetRoutes.join(","));
       }
     }
     let res = await fetchImplementation(
-      new Request(url, await _chunkTP6EHSSFjs.createRequestInit.call(void 0, request))
+      new Request(url, await _chunkYNGRUB6Fjs.createRequestInit.call(void 0, request))
     );
     if (res.status >= 400 && !res.headers.has("X-Remix-Response")) {
-      throw new (0, _chunkTP6EHSSFjs.ErrorResponseImpl)(res.status, res.statusText, await res.text());
+      throw new (0, _chunkYNGRUB6Fjs.ErrorResponseImpl)(res.status, res.statusText, await res.text());
     }
-    _chunkTP6EHSSFjs.invariant.call(void 0, res.body, "No response body to decode");
+    _chunkYNGRUB6Fjs.invariant.call(void 0, res.body, "No response body to decode");
     try {
       const payload = await createFromReadableStream(res.body, {
         temporaryReferences: void 0
@@ -633,7 +646,7 @@ function getFetchAndDecodeViaRSC(createFromReadableStream, fetchImplementation)
       }
       context.get(renderedRoutesContext).push(...payload.matches);
       let results = { routes: {} };
-      const dataKey = _chunkTP6EHSSFjs.isMutationMethod.call(void 0, request.method) ? "actionData" : "loaderData";
+      const dataKey = _chunkYNGRUB6Fjs.isMutationMethod.call(void 0, request.method) ? "actionData" : "loaderData";
       for (let [routeId, data] of Object.entries(payload[dataKey] || {})) {
         results.routes[routeId] = { data };
       }
@@ -666,7 +679,7 @@ function RSCHydratedRouter({
     [createFromReadableStream, payload, fetchImplementation, getContext]
   );
   React3.useEffect(() => {
-    _chunkTP6EHSSFjs.setIsHydrated.call(void 0, );
+    _chunkYNGRUB6Fjs.setIsHydrated.call(void 0, );
   }, []);
   React3.useLayoutEffect(() => {
     const globalVar = window;
@@ -774,8 +787,8 @@ function RSCHydratedRouter({
     },
     routeModules
   };
-  return /* @__PURE__ */ React3.createElement(_chunkTP6EHSSFjs.RSCRouterContext.Provider, { value: true }, /* @__PURE__ */ React3.createElement(_chunkVJZ67BZEjs.RSCRouterGlobalErrorBoundary, { location: state.location }, /* @__PURE__ */ React3.createElement(_chunkTP6EHSSFjs.FrameworkContext.Provider, { value: frameworkContext }, /* @__PURE__ */ React3.createElement(
-    _chunkTP6EHSSFjs.RouterProvider,
+  return /* @__PURE__ */ React3.createElement(_chunkYNGRUB6Fjs.RSCRouterContext.Provider, { value: true }, /* @__PURE__ */ React3.createElement(_chunkQURBR4FZjs.RSCRouterGlobalErrorBoundary, { location: state.location }, /* @__PURE__ */ React3.createElement(_chunkYNGRUB6Fjs.FrameworkContext.Provider, { value: frameworkContext }, /* @__PURE__ */ React3.createElement(
+    _chunkYNGRUB6Fjs.RouterProvider,
     {
       router: transitionEnabledRouter,
       flushSync: ReactDOM2.flushSync
@@ -791,8 +804,8 @@ function createRouteFromServerManifest(match, payload) {
   // the server loader flow regardless of whether the client loader calls
   // `serverLoader` or not, otherwise we'll have nothing to render.
   match.hasComponent && !match.element;
-  _chunkTP6EHSSFjs.invariant.call(void 0, window.__reactRouterRouteModules);
-  _chunkVJZ67BZEjs.populateRSCRouteModules.call(void 0, window.__reactRouterRouteModules, match);
+  _chunkYNGRUB6Fjs.invariant.call(void 0, window.__reactRouterRouteModules);
+  _chunkQURBR4FZjs.populateRSCRouteModules.call(void 0, window.__reactRouterRouteModules, match);
   let dataRoute = {
     id: match.id,
     element: match.element,
@@ -840,7 +853,7 @@ function createRouteFromServerManifest(match, payload) {
         return await callSingleFetch(singleFetch);
       }
     }) : match.hasAction ? (_, singleFetch) => callSingleFetch(singleFetch) : () => {
-      throw _chunkTP6EHSSFjs.noActionDefinedError.call(void 0, "action", match.id);
+      throw _chunkYNGRUB6Fjs.noActionDefinedError.call(void 0, "action", match.id);
     },
     path: match.path,
     shouldRevalidate: match.shouldRevalidate,
@@ -852,7 +865,7 @@ function createRouteFromServerManifest(match, payload) {
     hasClientAction: match.clientAction != null
   };
   if (typeof dataRoute.loader === "function") {
-    dataRoute.loader.hydrate = _chunkTP6EHSSFjs.shouldHydrateRouteLoader.call(void 0, 
+    dataRoute.loader.hydrate = _chunkYNGRUB6Fjs.shouldHydrateRouteLoader.call(void 0, 
       match.id,
       match.clientLoader,
       match.hasLoader,
@@ -862,7 +875,7 @@ function createRouteFromServerManifest(match, payload) {
   return dataRoute;
 }
 function callSingleFetch(singleFetch) {
-  _chunkTP6EHSSFjs.invariant.call(void 0, typeof singleFetch === "function", "Invalid singleFetch parameter");
+  _chunkYNGRUB6Fjs.invariant.call(void 0, typeof singleFetch === "function", "Invalid singleFetch parameter");
   return singleFetch();
 }
 function preventInvalidServerHandlerCall(type, routeId, hasHandler) {
@@ -870,7 +883,7 @@ function preventInvalidServerHandlerCall(type, routeId, hasHandler) {
     let fn = type === "action" ? "serverAction()" : "serverLoader()";
     let msg = `You are trying to call ${fn} on a route that does not have a server ${type} (routeId: "${routeId}")`;
     console.error(msg);
-    throw new (0, _chunkTP6EHSSFjs.ErrorResponseImpl)(400, "Bad Request", new Error(msg), true);
+    throw new (0, _chunkYNGRUB6Fjs.ErrorResponseImpl)(400, "Bad Request", new Error(msg), true);
   }
 }
 var nextPaths = /* @__PURE__ */ new Set();
@@ -893,12 +906,12 @@ function getManifestUrl(paths) {
   return url;
 }
 async function fetchAndApplyManifestPatches(paths, createFromReadableStream, fetchImplementation, signal) {
-  paths = _chunkTP6EHSSFjs.getPathsWithAncestors.call(void 0, paths);
+  paths = _chunkYNGRUB6Fjs.getPathsWithAncestors.call(void 0, paths);
   let url = getManifestUrl(paths);
   if (url == null) {
     return;
   }
-  if (url.toString().length > _chunkTP6EHSSFjs.URL_LIMIT) {
+  if (url.toString().length > _chunkYNGRUB6Fjs.URL_LIMIT) {
     nextPaths.clear();
     return;
   }
@@ -942,8 +955,8 @@ function isExternalLocation(location2) {
   return newLocation.origin !== window.location.origin;
 }
 function normalizeRedirectLocation(location2) {
-  if (_chunkTP6EHSSFjs.PROTOCOL_RELATIVE_URL_REGEX.test(location2)) {
-    let path = _chunkTP6EHSSFjs.resolvePath.call(void 0, location2);
+  if (_chunkYNGRUB6Fjs.PROTOCOL_RELATIVE_URL_REGEX.test(location2)) {
+    let path = _chunkYNGRUB6Fjs.resolvePath.call(void 0, location2);
     return path.pathname + path.search + path.hash;
   }
   return location2;

package/dist/production/dom-export.mjs

@@ -1,5 +1,5 @@
 /**
- * react-router v7.18.2
+ * react-router v7.18.4
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -13,7 +13,7 @@ import {
   RSCRouterGlobalErrorBoundary,
   getHydrationData,
   populateRSCRouteModules
-} from "./chunk-SJTG3J2Q.mjs";
+} from "./chunk-G2MPF4YY.mjs";
 import {
   CRITICAL_CSS_DATA_ATTRIBUTE,
   ErrorResponseImpl,
@@ -45,8 +45,9 @@ import {
   shouldHydrateRouteLoader,
   singleFetchUrl,
   stripIndexParam,
-  useFogOFWarDiscovery
-} from "./chunk-YBLPXYCV.mjs";
+  useFogOFWarDiscovery,
+  validateNavigationTarget
+} from "./chunk-Q34X6AWR.mjs";
 
 // lib/dom-export/dom-router-provider.tsx
 import * as React from "react";
@@ -299,6 +300,12 @@ function createCallServer({
         Promise.resolve(payloadPromise).then(async (payload) => {
           if (payload.type === "redirect") {
             let location2 = normalizeRedirectLocation(payload.location);
+            validateNavigationTarget(
+              payload.location,
+              location2,
+              new URL(window.location.href),
+              "allow-explicit"
+            );
             if (payload.reload || isExternalLocation(location2)) {
               if (hasInvalidProtocol(location2)) {
                 throw new Error("Invalid redirect location");
@@ -320,6 +327,12 @@ function createCallServer({
           if (rerender && landedActionId < actionId && globalVar.__routerActionID <= actionId) {
             if (rerender.type === "redirect") {
               let location2 = normalizeRedirectLocation(rerender.location);
+              validateNavigationTarget(
+                rerender.location,
+                location2,
+                new URL(window.location.href),
+                "allow-explicit"
+              );
               if (rerender.reload || isExternalLocation(location2)) {
                 if (hasInvalidProtocol(location2)) {
                   throw new Error("Invalid redirect location");