what-router 0.12.3 → 0.13.0

package/dist/index.min.js

@@ -1,8 +1,8 @@
-import{signal as v,effect as I,computed as b,batch as M,h as c,ErrorBoundary as X}from"what-core";function O(e){let t=e.replace(/\([\w-]+\)\//g,"").replace(/\[\.\.\.(\w+)\]/g,(i,l)=>`*:${l}`).replace(/\[(\w+)\]/g,":$1"),n=[],r=null,o=t.split("/").map(i=>i.startsWith("*:")?(r=i.slice(2),n.push(r),"(.+)"):i==="*"?(r="rest",n.push("rest"),"(.+)"):i.startsWith(":")?(n.push(i.slice(1)),"([^/]+)"):i.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")).join("/");return{regex:new RegExp(`^${o}$`),paramNames:n,catchAll:r}}var _=new Map,F=1e3;function H(e){let t=_.get(e);return t||(t=O(e),_.size>=F&&_.clear(),_.set(e,t)),t}function K(e,t){let n;try{n=decodeURIComponent(e)}catch{return null}let r=n.split(/[/\\]/);return!t&&r.length>1||r.includes("..")?null:n}function A(e,t){let n=t.filter(r=>r.path);n.sort((r,o)=>{let a=(r.path.match(/:/g)||[]).length+(r.path.includes("*")?100:0),i=(o.path.match(/:/g)||[]).length+(o.path.includes("*")?100:0);return a-i});for(let r of n){let{regex:o,paramNames:a,catchAll:i}=H(r.path),l=e.match(o);if(l){let p={},u=!1;if(a.forEach((s,d)=>{let g=K(l[d+1],s===i);if(g===null){u=!0;return}p[s]=g}),u)continue;return{route:r,params:p}}}return null}function C(e){let t=Object.create(null);if(!e)return t;let n=e.startsWith("?")?e.slice(1):e;for(let r of n.split("&")){let[o,a]=r.split("=");if(!o)continue;let i=decodeURIComponent(o),l=a?decodeURIComponent(a):"";Object.prototype.hasOwnProperty.call(t,i)?Array.isArray(t[i])?t[i].push(l):t[i]=[t[i],l]:t[i]=l}return t}var Q=new Set(["http:","https:","mailto:","tel:"]);function k(e){if(typeof e!="string")return!1;let n=e.trim().replace(/[\s\x00-\x1f]/g,"").toLowerCase();if(n.startsWith("javascript:")||n.startsWith("data:")||n.startsWith("vbscript:")||/^[/\\]{2}/.test(n))return!1;let r=n.match(/^([a-z][a-z0-9+.-]*:)/);return r?Q.has(r[1]):!n.includes("\\")}var h=v(typeof location<"u"?location.pathname+location.search+location.hash:"/"),G=v({}),D=v({}),y=v(!1),x=v(null),V=v(null),m={get url(){return h()},get path(){return h().split("?")[0].split("#")[0]},get params(){return G()},get query(){return D()},get hash(){let e=h().split("#")[1];return e?"#"+e:""},get isNavigating(){return y()},get error(){return V()}},T=[],q=[];function z(e,t){return e.push(t),()=>{let n=e.indexOf(t);n!==-1&&e.splice(n,1)}}function ue(e){return z(T,e)}function le(e){return z(q,e)}async function R(e,t={}){let{replace:n=!1,state:r=null,transition:o=!0,_fromPopstate:a=!1,_redirectChain:i=!1}=t;if(i||(w.length=0),!k(e)){typeof console<"u"&&console.warn("[what-router] Blocked navigation to unsafe URL:",e);return}if(typeof window<"u"&&e.startsWith("#")){let d=h().split("#")[0]+e;history.replaceState(r,"",d),h.set(d);let g=document.querySelector(e);g&&g.scrollIntoView({behavior:"smooth"});return}if(e===h()||y.peek())return;y.set(!0),x.set(e);let l=h();if(T.length){let u=!1;try{for(let s of T.slice())if(await s(e,l)===!1){u=!0;break}}catch(s){throw y.set(!1),x.set(null),s}if(u){y.set(!1),x.set(null),a&&typeof history<"u"&&history.pushState(null,"",l);return}}V.set(null);let p=()=>{a||(typeof window<"u"&&E.set(h(),{x:window.scrollX,y:window.scrollY}),n?history.replaceState(r,"",e):history.pushState(r,"",e)),h.set(e),y.set(!1),x.set(null)};if(o&&typeof document<"u"&&document.startViewTransition)try{let u=document.startViewTransition(p);u.ready&&typeof u.ready.catch=="function"&&u.ready.catch(()=>{}),await u.finished}catch{}else p();if(q.length)for(let u of q.slice())u(e,l)}var B=Symbol.for("what.router.redirect"),Y=Symbol.for("what.navigation.signal");function fe(e,t={}){if(!k(e)){let r=typeof e=="string"?e:Object.prototype.toString.call(e),o=new Error(`[what-router] redirect() refused an unsafe target: ${r}`);throw o.code="ERR_UNSAFE_REDIRECT",o.suggestion='redirect() accepts same-origin paths and http:, https:, mailto: or tel: URLs only. Protocol-relative ("//host"), backslash-smuggled and javascript:/data: targets are open-redirect vectors. Check a user-supplied target against an allowlist first.',o.codeExample=`// Bad - a user-controlled target can leave your origin:
+import{signal as R,effect as $,computed as b,batch as M,h as c,ErrorBoundary as X}from"what-core";function O(e){let n=e.replace(/\([\w-]+\)\//g,"").replace(/\[\.\.\.(\w+)\]/g,(i,u)=>`*:${u}`).replace(/\[(\w+)\]/g,":$1"),t=[],r=null,o=n.split("/").map(i=>i.startsWith("*:")?(r=i.slice(2),t.push(r),"(.+)"):i==="*"?(r="rest",t.push("rest"),"(.+)"):i.startsWith(":")?(t.push(i.slice(1)),"([^/]+)"):i.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")).join("/");return{regex:new RegExp(`^${o}$`),paramNames:t,catchAll:r}}var S=new Map,z=1e3;function H(e){let n=S.get(e);return n||(n=O(e),S.size>=z&&S.clear(),S.set(e,n)),n}function K(e,n){let t;try{t=decodeURIComponent(e)}catch{return null}let r=t.split(/[/\\]/);return!n&&r.length>1||r.includes("..")?null:t}function _(e,n){let t=n.filter(r=>r.path);t.sort((r,o)=>{let s=(r.path.match(/:/g)||[]).length+(r.path.includes("*")?100:0),i=(o.path.match(/:/g)||[]).length+(o.path.includes("*")?100:0);return s-i});for(let r of t){let{regex:o,paramNames:s,catchAll:i}=H(r.path),u=e.match(o);if(u){let p={},l=!1;if(s.forEach((a,d)=>{let m=K(u[d+1],a===i);if(m===null){l=!0;return}p[a]=m}),l)continue;return{route:r,params:p}}}return null}function A(e){let n=Object.create(null);if(!e)return n;let t=e.startsWith("?")?e.slice(1):e;for(let r of t.split("&")){let[o,s]=r.split("=");if(!o)continue;let i=decodeURIComponent(o),u=s?decodeURIComponent(s):"";Object.prototype.hasOwnProperty.call(n,i)?Array.isArray(n[i])?n[i].push(u):n[i]=[n[i],u]:n[i]=u}return n}var Q=new Set(["http:","https:","mailto:","tel:"]);function C(e){if(typeof e!="string")return!1;let t=e.trim().replace(/[\s\x00-\x1f]/g,"").toLowerCase();if(t.startsWith("javascript:")||t.startsWith("data:")||t.startsWith("vbscript:")||/^[/\\]{2}/.test(t))return!1;let r=t.match(/^([a-z][a-z0-9+.-]*:)/);return r?Q.has(r[1]):!t.includes("\\")}var h=R(typeof location<"u"?location.pathname+location.search+location.hash:"/"),G=R({}),F=R({}),y=R(!1),x=R(null),B=R(null),g={get url(){return h()},get path(){return h().split("?")[0].split("#")[0]},get params(){return G()},get query(){return F()},get hash(){let e=h().split("#")[1];return e?"#"+e:""},get isNavigating(){return y()},get error(){return B()}},q=[],P=[];function D(e,n){return e.push(n),()=>{let t=e.indexOf(n);t!==-1&&e.splice(t,1)}}function ue(e){return D(q,e)}function le(e){return D(P,e)}async function v(e,n={}){let{replace:t=!1,state:r=null,transition:o=!0,_fromPopstate:s=!1,_redirectChain:i=!1}=n;if(i||(w.length=0),!C(e)){typeof console<"u"&&console.warn("[what-router] Blocked navigation to unsafe URL:",e);return}if(typeof window<"u"&&e.startsWith("#")){let d=h().split("#")[0]+e;history.replaceState(r,"",d),h.set(d);let m=document.querySelector(e);m&&m.scrollIntoView({behavior:"smooth"});return}if(e===h()||y.peek())return;y.set(!0),x.set(e);let u=h();if(q.length){let l=!1;try{for(let a of q.slice())if(await a(e,u)===!1){l=!0;break}}catch(a){throw y.set(!1),x.set(null),a}if(l){y.set(!1),x.set(null),s&&typeof history<"u"&&history.pushState(null,"",u);return}}B.set(null);let p=()=>{s||(typeof window<"u"&&k.set(h(),{x:window.scrollX,y:window.scrollY}),t?history.replaceState(r,"",e):history.pushState(r,"",e)),h.set(e),y.set(!1),x.set(null)};if(o&&typeof document<"u"&&document.startViewTransition)try{let l=document.startViewTransition(p);l.ready&&typeof l.ready.catch=="function"&&l.ready.catch(()=>{}),await l.finished}catch{}else p();if(P.length)for(let l of P.slice())l(e,u)}var V=Symbol.for("what.router.redirect"),Y=Symbol.for("what.navigation.signal");function fe(e,n={}){if(!C(e)){let r=typeof e=="string"?e:Object.prototype.toString.call(e),o=new Error(`[what-router] redirect() refused an unsafe target: ${r}`);throw o.code="ERR_UNSAFE_REDIRECT",o.suggestion='redirect() accepts same-origin paths and http:, https:, mailto: or tel: URLs only. Protocol-relative ("//host"), backslash-smuggled and javascript:/data: targets are open-redirect vectors. Check a user-supplied target against an allowlist first.',o.codeExample=`// Bad - a user-controlled target can leave your origin:
 redirect(query.next);
 
 // Good - allowlist the target first:
-redirect(ALLOWED.has(query.next) ? query.next : '/');`,o}let n=new Error(`[what-router] redirect to ${e}`);throw n.name="RouterRedirect",n.code="ERR_REDIRECT_NOT_CAUGHT",n.suggestion="Seeing this signal in your console means nothing caught it. redirect() works from route middleware and from a component body, where the Router catches it. From an event handler, a promise callback or a timer, call navigate(to) instead. A try/catch around the redirect() call also swallows it.",n.codeExample=`// Bad - an event handler runs long after the render the Router caught:
+redirect(ALLOWED.has(query.next) ? query.next : '/');`,o}let t=new Error(`[what-router] redirect to ${e}`);throw t.name="RouterRedirect",t.code="ERR_REDIRECT_NOT_CAUGHT",t.suggestion="Seeing this signal in your console means nothing caught it. redirect() works from route middleware and from a component body, where the Router catches it. From an event handler, a promise callback or a timer, call navigate(to) instead. A try/catch around the redirect() call also swallows it.",t.codeExample=`// Bad - an event handler runs long after the render the Router caught:
 <button onclick={() => redirect('/login')}>Sign in</button>
 
 // Good - navigate() from a handler:
@@ -12,4 +12,4 @@ redirect(ALLOWED.has(query.next) ? query.next : '/');`,o}let n=new Error(`[what-
 function Private() {
   if (!user()) redirect('/login');
   return <Secret />;
-}`,n[B]=!0,n[Y]=()=>{L(e,t)},n.to=e,n.options=t,n}typeof window<"u"&&window.addEventListener("popstate",()=>{E.set(h(),{x:window.scrollX,y:window.scrollY});let e=location.pathname+location.search+location.hash;R(e,{replace:!0,_fromPopstate:!0,transition:!1}).then(()=>{let t=E.get(e);t&&requestAnimationFrame(()=>window.scrollTo(t.x,t.y))})});function J(e,t){let n=[];if(!e.path)return n;let r=e.path.split("/").filter(Boolean),o="";for(let a of r){o+="/"+a;let i=t.find(l=>l.layout&&l.path===o+"/_layout");i&&n.push(i.layout)}return e.layout&&n.push(e.layout),n}var w=[],Z=10;function W(e){return c("div",{class:"what-redirect-loop"},c("h1",null,"Redirect Loop"),c("p",null,e))}function L(e,t){if(x.peek()===e)return null;if(w.push(e),w.length>Z){let o=w.slice(-5).join(" \u2192 ");return w.length=0,console.error(`[what-router] Redirect loop detected: ${o}`),y.set(!1),x.set(null),W("Too many redirects. Check your middleware configuration.")}let n=new Set,r=!1;for(let o of w){if(n.has(o)){r=!0;break}n.add(o)}if(r){let o=w.join(" \u2192 ");return w.length=0,console.error(`[what-router] Redirect cycle detected: ${o}`),y.set(!1),x.set(null),W("Circular redirect detected. Check your middleware configuration.")}return R(e,{replace:!0,...t,_redirectChain:!0}),null}function ee(e,t,n){if(!e)return null;let r=e.split("?")[0].split("#")[0],o=A(r,t);return!o||o.route===n?null:o.route.loading||null}function te({routes:e,fallback:t,globalLayout:n}){let r=()=>{let a=h(),i=a.split("?")[0].split("#")[0],l=a.split("?")[1]?.split("#")[0]||"",p=y(),u=A(i,e);if(u){M(()=>{G.set(u.params),D.set(C(l))});let{route:s,params:d}=u,g=C(l);if(s.middleware&&s.middleware.length>0)for(let P of s.middleware){let N=P({path:i,params:d,query:g,route:s});if(N===!1)return t?c(t,{}):c("div",{class:"what-403"},c("h1",null,"403"),c("p",null,"Access denied"));if(typeof N=="string")return L(N)}let f,S=p?ee(x(),e,s):null;S?f=c(S,{}):s.loading&&p?f=c(s.loading,{}):f=c(s.component,{params:d,query:g,route:s}),s.error&&(f=c(X,{fallback:s.error},f));let j=J(s,e);for(let P of j.reverse())f=c(P,{params:d,query:g},f);return f}return t?c(t,{}):c("div",{class:"what-404"},c("h1",null,"404"),c("p",null,"Page not found"))},o=()=>{let a=null;try{return r()}catch(i){if(!i||!i[B])throw i;a=i}return L(a.to,a.options)};return n?c(n,{},o):o}function ne({href:e,class:t,className:n,children:r,replace:o,prefetch:a=!0,activeClass:i="active",exactActiveClass:l="exact-active",transition:p=!0,...u}){let s=k(e)?e:"about:blank";!k(e)&&typeof console<"u"&&console.warn("[what-router] Link blocked unsafe href:",e);let d=s.split("?")[0].split("#")[0];return c("a",{href:s,class:()=>{let f=m.path,S=d==="/"?f==="/":f===d||f.startsWith(d+"/");return[t||n,S&&i,f===d&&l].filter(Boolean).join(" ")||void 0},onclick:f=>{f.ctrlKey||f.metaKey||f.shiftKey||f.altKey||f.button!==0||(f.preventDefault(),R(s,{replace:o,transition:p}))},onmouseenter:a?()=>U(s):void 0,...u},...Array.isArray(r)?r:[r])}function de(e){return ne(e)}function pe(e){return Object.entries(e).map(([t,n])=>typeof n=="function"?{path:t,component:n}:{path:t,...n})}function re(e,t){let n=e.endsWith("/")?e.slice(0,-1):e,r=!t||t==="/"?"/":t.startsWith("/")?t:`/${t}`;return r==="/"?n||"/":n+r}function he(e,t,n={}){let{layout:r,loading:o,error:a}=n;return t.map(i=>({...i,path:re(e,i.path),layout:i.layout||r,loading:i.loading||o,error:i.error||a}))}function me(e,t,n={}){let{layout:r,middleware:o}=n;return t.map(a=>({...a,_group:e,layout:a.layout||r,middleware:[...a.middleware||[],...o||[]]}))}function ge({to:e}){return R(e,{replace:!0}),null}function ye(e,t){return n=>function(o){let a=e(o);return a instanceof Promise?c("div",{class:"what-guard-loading"},"Loading..."):a?c(n,o):typeof t=="string"?(R(t,{replace:!0}),null):c(t,o)}}function we(e,t={}){let{fallback:n="/login",loading:r=null}=t;return o=>function(i){let l=v("pending"),p=v(null),u=!1;return I(()=>(u=!1,Promise.resolve(e(i)).then(s=>{u||(p.set(s),l.set(s?"allowed":"denied"))}).catch(()=>{u||l.set("denied")}),()=>{u=!0})),()=>{let s=l();return s==="pending"?r?c(r,{}):null:s==="allowed"?c(o,i):typeof n=="string"?(R(n,{replace:!0}),null):c(n,i)}}}var $=new Set;function U(e){if(typeof document>"u"||$.has(e))return;$.add(e);let t=document.createElement("link");t.rel="prefetch",t.href=e,document.head.appendChild(t)}var E=new Map;function xe(){typeof window>"u"||(window.addEventListener("beforeunload",()=>{E.set(location.pathname,window.scrollY)}),I(()=>{let e=m.path,t=E.get(e);requestAnimationFrame(()=>{t!==void 0?window.scrollTo(0,t):m.hash?document.querySelector(m.hash)?.scrollIntoView():window.scrollTo(0,0)})}))}function ve(e){return{style:{viewTransitionName:e}}}function Re(e){typeof document>"u"||(document.documentElement.dataset.transition=e)}function be(){return{path:b(()=>m.path),params:b(()=>m.params),query:b(()=>m.query),hash:b(()=>m.hash),isNavigating:b(()=>m.isNavigating),navigate:R,prefetch:U}}function Ee(){return m.params}function Se(){return m.query}function _e(){return R}function Ae(e){U(e)}function Ce({children:e}){return e||null}function ke({routes:e,layout:t,fallback:n,error:r}){let o=e.map(a=>({path:a.path,component:a.component,layout:a.layout||void 0,loading:a.loading||void 0,error:a.error||r||void 0,_mode:a.mode||"client"}));return te({routes:o,globalLayout:t,fallback:n||oe})}function oe(){return c("div",{style:"text-align:center;padding:60px 20px"},c("h1",{style:"font-size:48px;margin-bottom:8px"},"404"),c("p",{style:"color:#64748b"},"Page not found"))}export{ke as FileRouter,ne as Link,de as NavLink,Ce as Outlet,ge as Redirect,te as Router,le as afterNavigate,we as asyncGuard,ue as beforeNavigate,O as compilePath,pe as defineRoutes,xe as enableScrollRestoration,ye as guard,k as isSafeUrl,A as matchRoute,R as navigate,he as nestedRoutes,C as parseQuery,U as prefetch,Ae as prefetchRoute,fe as redirect,m as route,me as routeGroup,Re as setViewTransition,_e as useNavigate,Ee as useParams,be as useRoute,Se as useSearch,ve as viewTransitionName};
+}`,t[V]=!0,t[Y]=()=>{L(e,n)},t.to=e,t.options=n,t}typeof window<"u"&&window.addEventListener("popstate",()=>{k.set(h(),{x:window.scrollX,y:window.scrollY});let e=location.pathname+location.search+location.hash;v(e,{replace:!0,_fromPopstate:!0,transition:!1}).then(()=>{let n=k.get(e);n&&requestAnimationFrame(()=>window.scrollTo(n.x,n.y))})});function J(e,n){let t=[];if(!e.path)return t;let r=e.path.split("/").filter(Boolean),o="";for(let s of r){o+="/"+s;let i=n.find(u=>u.layout&&u.path===o+"/_layout");i&&t.push(i.layout)}return e.layout&&t.push(e.layout),t}var w=[],Z=10;function I(e){return c("div",{class:"what-redirect-loop"},c("h1",null,"Redirect Loop"),c("p",null,e))}function L(e,n){if(x.peek()===e)return null;if(w.push(e),w.length>Z){let o=w.slice(-5).join(" \u2192 ");return w.length=0,console.error(`[what-router] Redirect loop detected: ${o}`),y.set(!1),x.set(null),I("Too many redirects. Check your middleware configuration.")}let t=new Set,r=!1;for(let o of w){if(t.has(o)){r=!0;break}t.add(o)}if(r){let o=w.join(" \u2192 ");return w.length=0,console.error(`[what-router] Redirect cycle detected: ${o}`),y.set(!1),x.set(null),I("Circular redirect detected. Check your middleware configuration.")}return v(e,{replace:!0,...n,_redirectChain:!0}),null}function ee(e,n,t){if(!e)return null;let r=e.split("?")[0].split("#")[0],o=_(r,n);return!o||o.route===t?null:o.route.loading||null}function te({routes:e,fallback:n,globalLayout:t}){let r=()=>{let s=h(),i=s.split("?")[0].split("#")[0],u=s.split("?")[1]?.split("#")[0]||"",p=y(),l=_(i,e);if(l){M(()=>{G.set(l.params),F.set(A(u))});let{route:a,params:d}=l,m=A(u);if(a.middleware&&a.middleware.length>0)for(let N of a.middleware){let T=N({path:i,params:d,query:m,route:a});if(T===!1)return n?c(n,{}):c("div",{class:"what-403"},c("h1",null,"403"),c("p",null,"Access denied"));if(typeof T=="string")return L(T)}let f,E=p?ee(x(),e,a):null;E?f=c(E,{}):a.loading&&p?f=c(a.loading,{}):f=c(a.component,{params:d,query:m,route:a}),a.error&&(f=c(X,{fallback:a.error},f));let j=J(a,e);for(let N of j.reverse())f=c(N,{params:d,query:m},f);return f}return n?c(n,{}):c("div",{class:"what-404"},c("h1",null,"404"),c("p",null,"Page not found"))},o=()=>{let s=null;try{return r()}catch(i){if(!i||!i[V])throw i;s=i}return L(s.to,s.options)};return t?c(t,{},o):o}function ne({href:e,class:n,className:t,children:r,replace:o,prefetch:s=!0,activeClass:i="active",exactActiveClass:u="exact-active",transition:p=!0,...l}){let a=C(e)?e:"about:blank";!C(e)&&typeof console<"u"&&console.warn("[what-router] Link blocked unsafe href:",e);let d=a.split("?")[0].split("#")[0];return c("a",{href:a,class:()=>{let f=g.path,E=d==="/"?f==="/":f===d||f.startsWith(d+"/");return[n||t,E&&i,f===d&&u].filter(Boolean).join(" ")||void 0},onclick:f=>{f.ctrlKey||f.metaKey||f.shiftKey||f.altKey||f.button!==0||(f.preventDefault(),v(a,{replace:o,transition:p}))},onmouseenter:s?()=>U(a):void 0,...l},...Array.isArray(r)?r:[r])}function de(e){return ne(e)}function pe(e){return Object.entries(e).map(([n,t])=>typeof t=="function"?{path:n,component:t}:{path:n,...t})}function re(e,n){let t=e.endsWith("/")?e.slice(0,-1):e,r=!n||n==="/"?"/":n.startsWith("/")?n:`/${n}`;return r==="/"?t||"/":t+r}function he(e,n,t={}){let{layout:r,loading:o,error:s}=t;return n.map(i=>({...i,path:re(e,i.path),layout:i.layout||r,loading:i.loading||o,error:i.error||s}))}function me(e,n,t={}){let{layout:r,middleware:o}=t;return n.map(s=>({...s,_group:e,layout:s.layout||r,middleware:[...s.middleware||[],...o||[]]}))}function ge({to:e}){return v(e,{replace:!0}),null}function ye(e,n){return t=>function(o){let s=e(o);return s instanceof Promise?c("div",{class:"what-guard-loading"},"Loading..."):s?c(t,o):typeof n=="string"?(v(n,{replace:!0}),null):c(n,o)}}function we(e,n={}){let{fallback:t="/login",loading:r=null}=n;return o=>function(i){let u=R("pending"),p=R(null),l=!1;return $(()=>(l=!1,Promise.resolve(e(i)).then(a=>{l||(p.set(a),u.set(a?"allowed":"denied"))}).catch(()=>{l||u.set("denied")}),()=>{l=!0})),()=>{let a=u();return a==="pending"?r?c(r,{}):null:a==="allowed"?c(o,i):typeof t=="string"?(v(t,{replace:!0}),null):c(t,i)}}}var W=new Set;function U(e){if(typeof document>"u"||W.has(e))return;W.add(e);let n=document.createElement("link");n.rel="prefetch",n.href=e,document.head.appendChild(n)}var k=new Map;function xe(){if(typeof window>"u")return;let e=!0;$(()=>{let n=g.url,t=k.get(n),r=g.hash,o=e;e=!1,requestAnimationFrame(()=>{r?oe(r)?.scrollIntoView():t?window.scrollTo(t.x,t.y):o||window.scrollTo(0,0)})})}function oe(e){try{return document.querySelector(e)}catch{return document.getElementById(e.slice(1))}}function Re(e){return{style:{viewTransitionName:e}}}function ve(e){typeof document>"u"||(document.documentElement.dataset.transition=e)}function be(){return{path:b(()=>g.path),params:b(()=>g.params),query:b(()=>g.query),hash:b(()=>g.hash),isNavigating:b(()=>g.isNavigating),navigate:v,prefetch:U}}function Ee(){return g.params}function Se(){return g.query}function _e(){return v}function Ae(e){U(e)}function Ce({children:e}){return e||null}function ke({routes:e,layout:n,fallback:t,error:r}){let o=e.map(s=>({path:s.path,component:s.component,layout:s.layout||void 0,loading:s.loading||void 0,error:s.error||r||void 0,_mode:s.mode||"client"}));return te({routes:o,globalLayout:n,fallback:t||ie})}function ie(){return c("div",{style:"text-align:center;padding:60px 20px"},c("h1",{style:"font-size:48px;margin-bottom:8px"},"404"),c("p",{style:"color:#64748b"},"Page not found"))}export{ke as FileRouter,ne as Link,de as NavLink,Ce as Outlet,ge as Redirect,te as Router,le as afterNavigate,we as asyncGuard,ue as beforeNavigate,O as compilePath,pe as defineRoutes,xe as enableScrollRestoration,ye as guard,C as isSafeUrl,_ as matchRoute,v as navigate,he as nestedRoutes,A as parseQuery,U as prefetch,Ae as prefetchRoute,fe as redirect,g as route,me as routeGroup,ve as setViewTransition,_e as useNavigate,Ee as useParams,be as useRoute,Se as useSearch,Re as viewTransitionName};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "what-router",
-  "version": "0.12.3",
+  "version": "0.13.0",
   "description": "What Framework - File-based & programmatic router with View Transitions",
   "type": "module",
   "main": "src/index.js",
@@ -35,7 +35,7 @@
   "license": "MIT",
   "dependencies": {},
   "peerDependencies": {
-    "what-core": "^0.12.3"
+    "what-core": "^0.13.0"
   },
   "repository": {
     "type": "git",

package/src/index.js

@@ -3,7 +3,7 @@
 // route groups, view transitions, and middleware.
 
 import { signal, effect, computed, batch, h, ErrorBoundary } from 'what-core';
-import { compilePath, matchRoute, parseQuery } from './match.js';
+import { matchRoute, parseQuery } from './match.js';
 
 // --- URL Sanitization ---
 // Rejects javascript:, data:, vbscript: protocols (case-insensitive, trimmed),
@@ -166,7 +166,9 @@ export async function navigate(to, opts = {}) {
   const doNavigation = () => {
     // Skip history manipulation on popstate (browser already updated the URL)
     if (!_fromPopstate) {
-      // Save scroll position for current URL before navigating away
+      // Save scroll position for current URL before navigating away.
+      // Full URL as the key, { x, y } as the value: see scrollPositions below,
+      // every writer and the reader must agree on both.
       if (typeof window !== 'undefined') {
         scrollPositions.set(_url(), { x: window.scrollX, y: window.scrollY });
       }
@@ -194,7 +196,7 @@ export async function navigate(to, opts = {}) {
         viewTransition.ready.catch(() => {});
       }
       await viewTransition.finished;
-    } catch (e) {
+    } catch {
       // Transition failed, navigation still happened
     }
   } else {
@@ -227,6 +229,7 @@ const NAV_SIGNAL = Symbol.for('what.navigation.signal');
 export function redirect(to, options = {}) {
   if (!isSafeUrl(to)) {
     const target = typeof to === 'string' ? to : Object.prototype.toString.call(to);
+    /** @type {Error & { code?: string, suggestion?: string, codeExample?: string }} */
     const err = new Error(`[what-router] redirect() refused an unsafe target: ${target}`);
     err.code = 'ERR_UNSAFE_REDIRECT';
     err.suggestion = 'redirect() accepts same-origin paths and http:, https:, mailto: or tel: URLs only. Protocol-relative ("//host"), backslash-smuggled and javascript:/data: targets are open-redirect vectors. Check a user-supplied target against an allowlist first.';
@@ -238,6 +241,7 @@ redirect(ALLOWED.has(query.next) ? query.next : '/');`;
     throw err;
   }
 
+  /** @type {Error & { code?: string, suggestion?: string, codeExample?: string, to?: any, options?: any }} */
   const sig = new Error(`[what-router] redirect to ${to}`);
   sig.name = 'RouterRedirect';
   sig.code = 'ERR_REDIRECT_NOT_CAUGHT';
@@ -716,34 +720,97 @@ export function prefetch(href) {
 
 // --- Scroll Restoration ---
 
+// Saved viewport offsets. ONE key (the full URL: path + search + hash) and ONE
+// shape ({ x, y }) shared by every writer and by the reader below.
+//
+// They used to disagree on both. navigate() and the popstate handler wrote
+// { x, y } keyed by the full URL, while enableScrollRestoration()'s own
+// beforeunload handler wrote a bare NUMBER keyed by location.pathname, and the
+// restore effect looked the entry up by route.path (the pattern-stripped path,
+// never the query or the hash) and handed it straight to
+// `window.scrollTo(0, savedPosition)`. A hit on a { x, y } record therefore
+// produced `scrollTo(0, NaN)`, which browsers normalize to 0 and which jumps
+// the page to the TOP; a URL carrying a query string or a hash missed the
+// lookup entirely and got the same jump. Restoration could not work at all.
+// If you add a writer, key it by the full URL and store { x, y }.
 const scrollPositions = new Map();
 
 export function enableScrollRestoration() {
   if (typeof window === 'undefined') return;
 
-  // Save scroll position before navigation
-  window.addEventListener('beforeunload', () => {
-    scrollPositions.set(location.pathname, window.scrollY);
-  });
-
-  // Restore scroll position after navigation
+  // There is deliberately no beforeunload writer. scrollPositions is an
+  // in-memory Map that dies with the document, so anything written while the
+  // page is unloading can never be read back. The only case where the write
+  // survived is the one where the document does NOT go away (the user cancels
+  // the "leave site?" prompt), and there it poisoned the map with an entry of
+  // the wrong shape under the wrong key. Restoring scroll across a RELOAD is
+  // the browser's job (history.scrollRestoration), and the first-run guard
+  // below is what keeps this effect out of its way.
+
+  // The effect's first run is the URL the document loaded with, not a
+  // navigation this router performed: the browser has already positioned the
+  // document (top for a fresh load, the previous offset for a reload or a
+  // document-recreating back). Scrolling to the top there would undo exactly
+  // the restoration the comment above defers to. Nothing else is affected,
+  // because scrollPositions is necessarily empty on the first run, so the
+  // guard can only ever suppress the scroll-to-top branch.
+  let firstRun = true;
+
+  // Restore the saved position after each committed navigation. Reading
+  // route.url subscribes to the URL signal, so this re-runs for query-only and
+  // hash-only changes too, which is the granularity the map is keyed at.
   effect(() => {
-    const path = route.path;
-    const savedPosition = scrollPositions.get(path);
+    const url = route.url;
+    const saved = scrollPositions.get(url);
+    // Read inside the effect, not inside the frame callback: by the time the
+    // frame runs another navigation may already have moved the URL on. Same
+    // reason the first-run latch is consumed here rather than in the frame.
+    const hash = route.hash;
+    const isFirstRun = firstRun;
+    firstRun = false;
 
     requestAnimationFrame(() => {
-      if (savedPosition !== undefined) {
-        window.scrollTo(0, savedPosition);
-      } else if (route.hash) {
-        const el = document.querySelector(route.hash);
+      // Hash BEFORE saved, and the order is load-bearing. A URL carrying a
+      // hash is a request for a specific ELEMENT, and it outranks any offset
+      // saved under that same URL: clicking a "/guide#api" link a second time
+      // has to land on #api, not on wherever the user happened to be standing
+      // the last time they left /guide#api. Because navigate() keys the map by
+      // the full URL (hash included), checking `saved` first made this branch
+      // unreachable for every hash URL the user had already visited, and it
+      // also fought navigate()'s own same-page hash handling: that path
+      // scrollIntoViews the anchor synchronously, and a `saved` hit here
+      // clobbered it one frame later.
+      if (hash) {
+        // Deferred to the frame because an SSR-less deep link renders the
+        // target element after the URL commits, so it does not exist yet here.
+        const el = queryFragment(hash);
+        // No fallback when the anchor is missing: it may simply not have
+        // rendered yet, and yanking the page to the top (or to some unrelated
+        // saved offset) is the worse answer to "I asked for #api".
         el?.scrollIntoView();
-      } else {
+      } else if (saved) {
+        window.scrollTo(saved.x, saved.y);
+      } else if (!isFirstRun) {
         window.scrollTo(0, 0);
       }
     });
   });
 }
 
+// Resolve a URL fragment to its element. A fragment is an id, and an id is not
+// necessarily a valid CSS selector: "#1" is legal HTML that browsers navigate
+// to happily, while querySelector('#1') THROWS "Invalid selector". The throw
+// happened inside a requestAnimationFrame callback, where nothing could catch
+// it, so a single numeric anchor took out the frame as an uncaught error.
+function queryFragment(hash) {
+  try {
+    return document.querySelector(hash);
+  } catch {
+    // Not selector-parseable, so ask the way the browser itself does.
+    return document.getElementById(hash.slice(1));
+  }
+}
+
 // --- View Transition Helpers ---
 
 export function viewTransitionName(name) {