react-router 8.3.0 → 8.4.0

package/dist/development/lib/rsc/browser.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -11,6 +11,7 @@
 import { PROTOCOL_RELATIVE_URL_REGEX } from "../router/url.js";
 import { createBrowserHistory, createPath, invariant } from "../router/history.js";
 import { ErrorResponseImpl, createContext, resolvePath } from "../router/utils.js";
+import { validateNavigationTarget } from "../router/navigation.js";
 import { createRouter, hasInvalidProtocol, isMutationMethod } from "../router/router.js";
 import { RSCRouterContext } from "../context.js";
 import { RouterProvider } from "../components.js";
@@ -82,6 +83,7 @@ function createCallServer({ createFromReadableStream, createTemporaryReferenceSe
 		React$1.startTransition(() => Promise.resolve(payloadPromise).then(async (payload) => {
 			if (payload.type === "redirect") {
 				let location = normalizeRedirectLocation(payload.location);
+				validateNavigationTarget(payload.location, location, new URL(window.location.href), "allow-explicit");
 				if (payload.reload || isExternalLocation(location)) {
 					if (hasInvalidProtocol(location)) throw new Error("Invalid redirect location");
 					window.location.href = location;
@@ -97,6 +99,7 @@ function createCallServer({ createFromReadableStream, createTemporaryReferenceSe
 			if (rerender && landedActionId < actionId && globalVar.__routerActionID <= actionId) {
 				if (rerender.type === "redirect") {
 					let location = normalizeRedirectLocation(rerender.location);
+					validateNavigationTarget(rerender.location, location, new URL(window.location.href), "allow-explicit");
 					if (rerender.reload || isExternalLocation(location)) {
 						if (hasInvalidProtocol(location)) throw new Error("Invalid redirect location");
 						window.location.href = location;
@@ -166,6 +169,7 @@ function createRouterFromPayload({ fetchImplementation, createFromReadableStream
 			},
 			location: payload.location,
 			basename: payload.basename,
+			future: {},
 			isSpaMode: false
 		}),
 		async patchRoutesOnNavigation({ path, signal, fetcherKey }) {

package/dist/development/lib/rsc/errorBoundaries.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/rsc/html-stream/browser.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/rsc/html-stream/server.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -8,6 +8,7 @@
  *
  * @license MIT
  */
+import { escapeAttribute } from "../../dom/ssr/markup.js";
 //#region lib/rsc/html-stream/server.ts
 const encoder = new TextEncoder();
 const trailer = "</body></html>";
@@ -73,7 +74,7 @@ async function writeRSCStream(reader, controller, isCancelled, nonce) {
 			const chunk = read.value;
 			try {
 				writeChunk(JSON.stringify(decoder.decode(chunk, { stream: true })), controller, nonce);
-			} catch (e) {
+			} catch {
 				writeChunk(`Uint8Array.from(atob(${JSON.stringify(btoa(String.fromCodePoint(...chunk)))}), m => m.codePointAt(0))`, controller, nonce);
 			}
 		}
@@ -87,9 +88,6 @@ function writeChunk(chunk, controller, nonce) {
 	let nonceAttr = nonce == null ? "" : ` nonce="${escapeAttribute(nonce)}"`;
 	controller.enqueue(encoder.encode(`<script${nonceAttr}>${escapeScript(`(self.__FLIGHT_DATA||=[]).push(${chunk})`)}<\/script>`));
 }
-function escapeAttribute(value) {
-	return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
 function escapeScript(script) {
 	return script.replace(/<!--/g, "<\\!--").replace(/<\/(script)/gi, "</\\$1");
 }

package/dist/development/lib/rsc/route-modules.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/rsc/server.rsc.d.ts

@@ -116,6 +116,13 @@ type RouteDiscovery = {
  * encoding an {@link unstable_RSCPayload} for consumption by an [RSC](https://react.dev/reference/rsc/server-components)
  * enabled client router.
  *
+ * Treat every React Server Function as a public endpoint. Server Functions are
+ * not inherently associated with a route. Any route middleware that runs is
+ * selected from the URL used to call a Server Function, but the client controls
+ * both the Server Function identifier and the URL. Perform all access control
+ * checks within each Server Function, or use a route action for
+ * middleware-driven access control.
+ *
  * @example
  * import {
  *   createTemporaryReferenceSet,

package/dist/development/lib/rsc/server.ssr.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -9,10 +9,10 @@
  * @license MIT
  */
 import { isRouteErrorResponse } from "../router/utils.js";
-import { hasInvalidProtocol } from "../router/router.js";
+import { createDataRouteMatcher, hasInvalidProtocol } from "../router/router.js";
 import { RSCRouterContext } from "../context.js";
 import { decodeRedirectErrorDigest, decodeRouteErrorResponseDigest } from "../errors.js";
-import { escapeHtml } from "../dom/ssr/markup.js";
+import { escapeAttribute } from "../dom/ssr/markup.js";
 import { shouldHydrateRouteLoader } from "../dom/ssr/routes.js";
 import { FrameworkContext } from "../dom/ssr/components.js";
 import { StaticRouterProvider, createStaticRouter } from "../dom/server.js";
@@ -179,7 +179,7 @@ async function routeRSCServerRequest({ request, serverResponse, createFromReadab
 		const redirectTransform = new TransformStream({ flush(controller) {
 			if (renderRedirect) {
 				if (hasInvalidProtocol(renderRedirect.location)) return;
-				controller.enqueue(new TextEncoder().encode(`<meta http-equiv="refresh" content="0;url=${escapeHtml(renderRedirect.location)}"/>`));
+				controller.enqueue(new TextEncoder().encode(`<meta http-equiv="refresh" content="0;url=${escapeAttribute(renderRedirect.location)}"/>`));
 			}
 		} });
 		if (!hydrate) return new Response(html.pipeThrough(redirectTransform), {
@@ -258,7 +258,7 @@ async function routeRSCServerRequest({ request, serverResponse, createFromReadab
 			const retryRedirectTransform = new TransformStream({ flush(controller) {
 				if (retryRedirect) {
 					if (hasInvalidProtocol(retryRedirect.location)) return;
-					controller.enqueue(new TextEncoder().encode(`<meta http-equiv="refresh" content="0;url=${escapeHtml(retryRedirect.location)}"/>`));
+					controller.enqueue(new TextEncoder().encode(`<meta http-equiv="refresh" content="0;url=${escapeAttribute(retryRedirect.location)}"/>`));
 				}
 			} });
 			if (!hydrate) return new Response(html.pipeThrough(retryRedirectTransform), {
@@ -273,7 +273,7 @@ async function routeRSCServerRequest({ request, serverResponse, createFromReadab
 				statusText,
 				headers
 			});
-		} catch (error2) {}
+		} catch {}
 		throw error;
 	}
 }
@@ -333,6 +333,24 @@ function RSCStaticRouter({ getPayload, nonce }) {
 	if (payload.type !== "render") return null;
 	let patchedLoaderData = { ...payload.loaderData };
 	for (const match of payload.matches) if (shouldHydrateRouteLoader(match.id, match.clientLoader, match.hasLoader, false) && (match.hydrateFallbackElement || !match.hasLoader)) delete patchedLoaderData[match.id];
+	const routes = payload.matches.reduceRight((previous, match) => {
+		const route = {
+			id: match.id,
+			action: match.hasAction || !!match.clientAction,
+			element: match.element,
+			errorElement: match.errorElement,
+			handle: match.handle,
+			hydrateFallbackElement: match.hydrateFallbackElement,
+			index: match.index,
+			loader: match.hasLoader || !!match.clientLoader,
+			path: match.path,
+			shouldRevalidate: match.shouldRevalidate
+		};
+		if (previous.length > 0) route.children = previous;
+		return [route];
+	}, []);
+	const dataRouteMatcher = createDataRouteMatcher({}, payload.basename || "/");
+	dataRouteMatcher.update(routes);
 	const context = {
 		get _deepestRenderedBoundaryId() {
 			return decoded._deepestRenderedBoundaryId ?? null;
@@ -348,6 +366,7 @@ function RSCStaticRouter({ getPayload, nonce }) {
 		loaderHeaders: {},
 		location: payload.location,
 		statusCode: 200,
+		_match: (locationArg) => dataRouteMatcher.match(locationArg),
 		matches: payload.matches.map((match) => ({
 			params: match.params,
 			pathname: match.pathname,
@@ -363,22 +382,7 @@ function RSCStaticRouter({ getPayload, nonce }) {
 			}
 		}))
 	};
-	const router = createStaticRouter(payload.matches.reduceRight((previous, match) => {
-		const route = {
-			id: match.id,
-			action: match.hasAction || !!match.clientAction,
-			element: match.element,
-			errorElement: match.errorElement,
-			handle: match.handle,
-			hydrateFallbackElement: match.hydrateFallbackElement,
-			index: match.index,
-			loader: match.hasLoader || !!match.clientLoader,
-			path: match.path,
-			shouldRevalidate: match.shouldRevalidate
-		};
-		if (previous.length > 0) route.children = previous;
-		return [route];
-	}, []), context);
+	const router = createStaticRouter(routes, context);
 	const frameworkContext = {
 		future: {},
 		isSpaMode: false,

package/dist/development/lib/server-runtime/cookies.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -95,7 +95,7 @@ function encodeData(value) {
 function decodeData(value) {
 	try {
 		return JSON.parse(decodeURIComponent(myEscape(atob(value))));
-	} catch (e) {
+	} catch {
 		return {};
 	}
 }

package/dist/development/lib/server-runtime/crypto.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -26,7 +26,7 @@ const unsign = async (cookie, secret) => {
 	try {
 		let signature = byteStringToUint8Array(atob(hash));
 		return await crypto.subtle.verify("HMAC", key, signature, data) ? value : false;
-	} catch (e) {
+	} catch {
 		return false;
 	}
 };

package/dist/development/lib/server-runtime/data.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/dev.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -19,7 +19,7 @@ function getDevServerHooks() {
 function getBuildTimeHeader(request, headerName) {
 	if (typeof process !== "undefined") try {
 		if (process.env.hasOwnProperty("IS_RR_BUILD_REQUEST") && process.env.IS_RR_BUILD_REQUEST === "yes") return request.headers.get(headerName);
-	} catch (e) {}
+	} catch {}
 	return null;
 }
 //#endregion

package/dist/development/lib/server-runtime/entry.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/errors.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/headers.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/invariant.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/mode.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/routeMatching.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -8,11 +8,10 @@
  *
  * @license MIT
  */
-import { matchRoutesImpl } from "../router/utils.js";
 import invariant from "./invariant.js";
 //#region lib/server-runtime/routeMatching.ts
-function matchServerRoutes(manifest, dataRoutes, branches, pathname, basename) {
-	let matches = matchRoutesImpl(dataRoutes, pathname, basename ?? "/", false, branches);
+function matchServerRoutes(manifest, staticHandler, pathname) {
+	let matches = staticHandler.match(pathname);
 	if (!matches) return null;
 	return matches.map((match) => {
 		let route = manifest[match.route.id];

package/dist/development/lib/server-runtime/routes.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/server.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -90,12 +90,12 @@ function derive(build, mode) {
 		}
 		let manifestUrl = getManifestPath(build.routeDiscovery.manifestPath, build.basename);
 		if (build.routeDiscovery.mode === "lazy" && requestUrl.pathname === manifestUrl) try {
-			return await handleManifestRequest(build, staticHandler.dataRoutes, staticHandler._internalRouteBranches, requestUrl);
+			return await handleManifestRequest(build, staticHandler, requestUrl);
 		} catch (e) {
 			handleError(e);
 			return new Response("Unknown Server Error", { status: 500 });
 		}
-		let matches = matchServerRoutes(build.routes, staticHandler.dataRoutes, staticHandler._internalRouteBranches, normalizedPathname, build.basename);
+		let matches = matchServerRoutes(build.routes, staticHandler, normalizedPathname);
 		if (matches && matches.length > 0) Object.assign(params, matches[0].params);
 		if (requestHandlerInstrumentations?.length) loadContext.set(instrumentationResultMetaContext, {
 			url: createDataFunctionUrl(request, normalizedPath),
@@ -173,7 +173,7 @@ const createRequestHandler = (build, mode) => {
 		return _requestHandler(request, initialContext);
 	};
 };
-async function handleManifestRequest(build, dataRoutes, branches, url) {
+async function handleManifestRequest(build, staticHandler, url) {
 	if (url.toString().length > 7680) return new Response(null, {
 		statusText: "Bad Request",
 		status: 400
@@ -188,7 +188,7 @@ async function handleManifestRequest(build, dataRoutes, branches, url) {
 		let paths = new Set(pathParam.split(",").filter(Boolean));
 		for (let path of paths) {
 			if (!path.startsWith("/")) path = `/${path}`;
-			let matches = matchServerRoutes(build.routes, dataRoutes, branches, path, build.basename);
+			let matches = matchServerRoutes(build.routes, staticHandler, path);
 			if (matches) for (let match of matches) {
 				let routeId = match.route.id;
 				let route = build.assets.routes[routeId];
@@ -256,7 +256,7 @@ async function handleDocumentRequest(serverMode, build, staticHandler, request,
 		};
 		let entryContext = {
 			manifest: build.assets,
-			branches: staticHandler._internalRouteBranches,
+			branches: [],
 			routeModules: createEntryRouteModules(build.routes),
 			staticHandlerContext: context,
 			criticalCss,
@@ -281,7 +281,7 @@ async function handleDocumentRequest(serverMode, build, staticHandler, request,
 			if (isResponse(error)) try {
 				let data = await unwrapResponse(error);
 				errorForSecondRender = new ErrorResponseImpl(error.status, error.statusText, data);
-			} catch (e) {}
+			} catch {}
 			context = getStaticContextFromError(staticHandler.dataRoutes, context, errorForSecondRender);
 			if (context.errors) context.errors = sanitizeErrors(context.errors, serverMode);
 			let state = {
@@ -291,6 +291,7 @@ async function handleDocumentRequest(serverMode, build, staticHandler, request,
 			};
 			entryContext = {
 				...entryContext,
+				branches: [],
 				staticHandlerContext: context,
 				serverHandoffString: createServerHandoffString(baseServerHandoff),
 				serverHandoffStream: encodeViaTurboStream(state, request.signal, build.entry.module.streamTimeout, serverMode),

package/dist/development/lib/server-runtime/serverHandoff.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/sessions/cookieStorage.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/sessions/memoryStorage.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/sessions.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/single-fetch.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -23,7 +23,7 @@ async function singleFetchAction(build, serverMode, staticHandler, request, load
 	try {
 		try {
 			throwIfPotentialCSRFAttack(request, Array.isArray(build.allowedActionOrigins) ? build.allowedActionOrigins : []);
-		} catch (e) {
+		} catch {
 			return handleQueryError(/* @__PURE__ */ new Error("Bad Request"), 400);
 		}
 		return handleQueryResult(await staticHandler.query(request, {

package/dist/development/lib/server-runtime/urls.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/server-runtime/warnings.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/lib/types/internal.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/route-pattern.d.ts

@@ -0,0 +1,3 @@
+
+import { unstable_preloadRoutePattern } from "./lib/router/matcher-route-pattern.preload.js";
+export { unstable_preloadRoutePattern };

package/dist/development/route-pattern.js

@@ -0,0 +1,12 @@
+/**
+ * react-router v8.4.0
+ *
+ * Copyright (c) Remix Software Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE.md file in the root directory of this source tree.
+ *
+ * @license MIT
+ */
+import { unstable_preloadRoutePattern } from "./lib/router/matcher-route-pattern.preload.js";
+export { unstable_preloadRoutePattern };

package/dist/development/vendor/turbo-stream-v2/flatten.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/vendor/turbo-stream-v2/turbo-stream.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *
@@ -41,7 +41,7 @@ async function decodeInitial(reader) {
 	let line;
 	try {
 		line = JSON.parse(read.value);
-	} catch (reason) {
+	} catch {
 		throw new SyntaxError();
 	}
 	return {
@@ -64,7 +64,7 @@ async function decodeDeferred(reader) {
 				let jsonLine;
 				try {
 					jsonLine = JSON.parse(lineData);
-				} catch (reason) {
+				} catch {
 					throw new SyntaxError();
 				}
 				const value = unflatten.call(this, jsonLine);
@@ -80,7 +80,7 @@ async function decodeDeferred(reader) {
 				let jsonLine;
 				try {
 					jsonLine = JSON.parse(lineData);
-				} catch (reason) {
+				} catch {
 					throw new SyntaxError();
 				}
 				const value = unflatten.call(this, jsonLine);

package/dist/development/vendor/turbo-stream-v2/unflatten.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/development/vendor/turbo-stream-v2/utils.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/dom-export.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *

package/dist/production/index-react-server-client.js

@@ -1,5 +1,5 @@
 /**
- * react-router v8.3.0
+ * react-router v8.4.0
  *
  * Copyright (c) Remix Software Inc.
  *