From 254793288ed74b6b8945802434bab39c898554d8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 29 Oct 2026 10:24:33 +0000
Subject: [PATCH] perf(router): add a `__proto__` param with a computed key,
 not defineProperty

A computed key in an object literal defines an own property, so spreading
the params into a new object with the `__proto__` key keeps it off the
prototype, as `Object.defineProperty` did, in less code. It runs only for
a param named `__proto__`, so the spread is not repeated per param.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VVaw7Sutbw6xMTMyDFeNfw
---
 packages/router/src/index.ts | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/packages/router/src/index.ts b/packages/router/src/index.ts
index d8b4d56..a91bc23 100644
--- a/packages/router/src/index.ts
+++ b/packages/router/src/index.ts
@@ -638,8 +638,10 @@ function matchesSegment(expected: string | undefined, segment: string): boolean
   return expected === undefined ? segment !== '' : segment === expected
 }
 
+// `params` is spread only for a param named `__proto__`, not on every pass.
+/* oxlint-disable oxc/no-accumulating-spread */
 function toParams<T>(route: Route<T>, segments: readonly string[]): Record<string, string> {
-  const params: Record<string, string> = {}
+  let params: Record<string, string> = {}
   const end = segments.length - route.tail
 
   for (const { name, index, catchAll } of route.params!) {
@@ -652,14 +654,10 @@ function toParams<T>(route: Route<T>, segments: readonly string[]): Record<strin
       }
     }
 
-    // Assigning `__proto__` would set the prototype instead of adding a key.
+    // Assigning `__proto__` would set the prototype, where a computed key in
+    // an object literal adds it.
     if (name === '__proto__') {
-      Object.defineProperty(params, name, {
-        configurable: true,
-        enumerable: true,
-        value,
-        writable: true,
-      })
+      params = { ...params, [name]: value }
     } else {
       params[name] = value
     }
@@ -667,3 +665,4 @@ function toParams<T>(route: Route<T>, segments: readonly string[]): Record<strin
 
   return params
 }
+/* oxlint-enable oxc/no-accumulating-spread */