@hot-updater/console 1.0.4 → 1.0.5

package/.output/server/_ssr/{server-BfFN4fJ8.mjs → server-DLJxXUG3.mjs}

@@ -1,10 +1,10 @@
 import "../_runtime.mjs";
-import { _ as safeObjectMerge, a as TSS_SERVER_FUNCTION, c as createMiddleware, d as flattenMiddlewares, f as getStartContext, g as runWithStartContext, h as mergeHeaders, i as TSS_FORMDATA_CONTEXT, l as createNullProtoObject, m as isRedirect, n as MAX_FRAME_PAYLOAD_SIZE, o as X_TSS_RAW_RESPONSE, p as getStartOptions, r as TSS_CONTENT_TYPE_FRAMED_VERSIONED, s as X_TSS_SERIALIZED, t as MAX_FRAMED_STREAMS } from "./createMiddleware-Cm6Tn0_Y.mjs";
-import { t as getServerFnById } from "../__23tanstack-start-server-fn-resolver-By_583eX.mjs";
+import { _ as parseSetCookie, a as TSS_SERVER_FUNCTION, b as serialize, c as createMiddleware, d as flattenMiddlewares, f as getStartContext, g as parse, h as mergeHeaders, i as TSS_FORMDATA_CONTEXT, l as createNullProtoObject, m as isRedirect, n as MAX_FRAME_PAYLOAD_SIZE, o as X_TSS_RAW_RESPONSE, p as getStartOptions, r as TSS_CONTENT_TYPE_FRAMED_VERSIONED, s as X_TSS_SERIALIZED, t as MAX_FRAMED_STREAMS, v as runWithStartContext, x as splitSetCookieString, y as safeObjectMerge } from "./createMiddleware-B1iPez7u.mjs";
+import { t as getServerFnById } from "../__23tanstack-start-server-fn-resolver-jmie-36L.mjs";
 import { _t as require_react, gt as require_jsx_runtime } from "../_libs/@base-ui/react+[...].mjs";
 import { l as RouterProvider, n as renderRouterToString, r as defineHandlerCallback, t as renderRouterToStream } from "../_libs/@tanstack/react-router+[...].mjs";
 import { t as __exportAll } from "./rolldown-runtime-rSIU-vHC.mjs";
-import { PassThrough, Readable } from "node:stream";
+import { Readable } from "node:stream";
 import { AsyncLocalStorage } from "node:async_hooks";
 require_react();
 var import_jsx_runtime = require_jsx_runtime();
@@ -22,1661 +22,12 @@ var defaultRenderHandler = defineHandlerCallback(({ router, responseHeaders }) =
 	responseHeaders,
 	children: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(StartServer, { router })
 }));
-var NullProtoObj = /* @__PURE__ */ (() => {
-	const e = function() {};
-	return e.prototype = Object.create(null), Object.freeze(e.prototype), e;
-})();
-function lazyInherit(target, source, sourceKey) {
-	for (const key of [...Object.getOwnPropertyNames(source), ...Object.getOwnPropertySymbols(source)]) {
-		if (key === "constructor") continue;
-		const targetDesc = Object.getOwnPropertyDescriptor(target, key);
-		const desc = Object.getOwnPropertyDescriptor(source, key);
-		let modified = false;
-		if (desc.get) {
-			modified = true;
-			desc.get = targetDesc?.get || function() {
-				return this[sourceKey][key];
-			};
-		}
-		if (desc.set) {
-			modified = true;
-			desc.set = targetDesc?.set || function(value) {
-				this[sourceKey][key] = value;
-			};
-		}
-		if (!targetDesc?.value && typeof desc.value === "function") {
-			modified = true;
-			desc.value = function(...args) {
-				return this[sourceKey][key](...args);
-			};
-		}
-		if (modified) Object.defineProperty(target, key, desc);
-	}
-}
-var _needsNormRE = /(?:(?:^|\/)(?:\.|\.\.|%2e|%2e\.|\.%2e|%2e%2e)(?:\/|$))|[\\^#"<>{}`\x80-\uffff]/i;
-var _searchNeedsNormRE = /[#"'<>]/;
-var FastURL = /* @__PURE__ */ (() => {
-	const NativeURL = globalThis.URL;
-	const FastURL = class URL {
-		#url;
-		#href;
-		#protocol;
-		#host;
-		#pathname;
-		#search;
-		#searchParams;
-		#pos;
-		constructor(url) {
-			if (typeof url === "string") {
-				const isOriginForm = url[0] === "/";
-				if (isOriginForm && !_searchNeedsNormRE.test(url)) this.#href = url;
-				else this.#url = new NativeURL(isOriginForm ? `http://localhost${url}` : url);
-			} else if (_needsNormRE.test(url.pathname) || url.search && _searchNeedsNormRE.test(url.search)) this.#url = new NativeURL(`${url.protocol || "http:"}//${url.host || "localhost"}${url.pathname}${url.search || ""}`);
-			else {
-				this.#protocol = url.protocol;
-				this.#host = url.host;
-				this.#pathname = url.pathname;
-				this.#search = url.search;
-			}
-		}
-		static [Symbol.hasInstance](val) {
-			return val instanceof NativeURL;
-		}
-		get _url() {
-			if (this.#url) return this.#url;
-			this.#url = new NativeURL(this.href);
-			this.#href = void 0;
-			this.#protocol = void 0;
-			this.#host = void 0;
-			this.#pathname = void 0;
-			this.#search = void 0;
-			this.#searchParams = void 0;
-			this.#pos = void 0;
-			return this.#url;
-		}
-		get href() {
-			if (this.#url) return this.#url.href;
-			if (!this.#href) this.#href = `${this.#protocol || "http:"}//${this.#host || "localhost"}${this.#pathname || "/"}${this.#search || ""}`;
-			return this.#href;
-		}
-		#getPos() {
-			if (!this.#pos) {
-				const url = this.href;
-				const protoIndex = url.indexOf("://");
-				const pathnameIndex = protoIndex === -1 ? -1 : url.indexOf("/", protoIndex + 4);
-				this.#pos = [
-					protoIndex,
-					pathnameIndex,
-					pathnameIndex === -1 ? -1 : url.indexOf("?", pathnameIndex)
-				];
-			}
-			return this.#pos;
-		}
-		get pathname() {
-			if (this.#url) return this.#url.pathname;
-			if (this.#pathname === void 0) {
-				const [, pathnameIndex, queryIndex] = this.#getPos();
-				if (pathnameIndex === -1) return this._url.pathname;
-				this.#pathname = this.href.slice(pathnameIndex, queryIndex === -1 ? void 0 : queryIndex);
-			}
-			return this.#pathname;
-		}
-		get search() {
-			if (this.#url) return this.#url.search;
-			if (this.#search === void 0) {
-				const [, pathnameIndex, queryIndex] = this.#getPos();
-				if (pathnameIndex === -1) return this._url.search;
-				const url = this.href;
-				this.#search = queryIndex === -1 || queryIndex === url.length - 1 ? "" : url.slice(queryIndex);
-			}
-			return this.#search;
-		}
-		get searchParams() {
-			if (this.#url) return this.#url.searchParams;
-			if (!this.#searchParams) this.#searchParams = new URLSearchParams(this.search);
-			return this.#searchParams;
-		}
-		get protocol() {
-			if (this.#url) return this.#url.protocol;
-			if (this.#protocol === void 0) {
-				const [protocolIndex] = this.#getPos();
-				if (protocolIndex === -1) return this._url.protocol;
-				this.#protocol = this.href.slice(0, protocolIndex + 1);
-			}
-			return this.#protocol;
-		}
-		toString() {
-			return this.href;
-		}
-		toJSON() {
-			return this.href;
-		}
-	};
-	lazyInherit(FastURL.prototype, NativeURL.prototype, "_url");
-	Object.setPrototypeOf(FastURL.prototype, NativeURL.prototype);
-	Object.setPrototypeOf(FastURL, NativeURL);
-	return FastURL;
-})();
-var NodeResponse = /* @__PURE__ */ (() => {
-	const NativeResponse = globalThis.Response;
-	const STATUS_CODES = globalThis.process?.getBuiltinModule?.("node:http")?.STATUS_CODES || {};
-	class NodeResponse {
-		#body;
-		#init;
-		#headers;
-		#response;
-		constructor(body, init) {
-			this.#body = body;
-			this.#init = init;
-		}
-		static [Symbol.hasInstance](val) {
-			return val instanceof NativeResponse;
-		}
-		get status() {
-			return this.#response?.status || this.#init?.status || 200;
-		}
-		get statusText() {
-			return this.#response?.statusText || this.#init?.statusText || STATUS_CODES[this.status] || "";
-		}
-		get headers() {
-			if (this.#response) return this.#response.headers;
-			if (this.#headers) return this.#headers;
-			const initHeaders = this.#init?.headers;
-			return this.#headers = initHeaders instanceof Headers ? initHeaders : new Headers(initHeaders);
-		}
-		get ok() {
-			if (this.#response) return this.#response.ok;
-			const status = this.status;
-			return status >= 200 && status < 300;
-		}
-		get _response() {
-			if (this.#response) return this.#response;
-			let body = this.#body;
-			if (body && typeof body.pipe === "function" && !(body instanceof Readable)) {
-				const stream = new PassThrough();
-				body.pipe(stream);
-				const abort = body.abort;
-				if (abort) stream.once("close", () => abort());
-				body = stream;
-			}
-			this.#response = new NativeResponse(body, this.#headers ? {
-				...this.#init,
-				headers: this.#headers
-			} : this.#init);
-			this.#init = void 0;
-			this.#headers = void 0;
-			this.#body = void 0;
-			return this.#response;
-		}
-		_toNodeResponse() {
-			const status = this.status;
-			const statusText = this.statusText;
-			let body;
-			let contentType;
-			let contentLength;
-			if (this.#response) body = this.#response.body;
-			else if (this.#body) if (this.#body instanceof ReadableStream) body = this.#body;
-			else if (typeof this.#body === "string") {
-				body = this.#body;
-				contentType = "text/plain; charset=UTF-8";
-				contentLength = Buffer.byteLength(this.#body);
-			} else if (this.#body instanceof ArrayBuffer) {
-				body = Buffer.from(this.#body);
-				contentLength = this.#body.byteLength;
-			} else if (this.#body instanceof Uint8Array) {
-				body = this.#body;
-				contentLength = this.#body.byteLength;
-			} else if (this.#body instanceof DataView) {
-				body = Buffer.from(this.#body.buffer);
-				contentLength = this.#body.byteLength;
-			} else if (this.#body instanceof Blob) {
-				body = this.#body.stream();
-				contentType = this.#body.type;
-				contentLength = this.#body.size;
-			} else if (typeof this.#body.pipe === "function") body = this.#body;
-			else body = this._response.body;
-			const headers = [];
-			const initHeaders = this.#init?.headers;
-			const headerEntries = this.#response?.headers || this.#headers || (initHeaders ? Array.isArray(initHeaders) ? initHeaders : initHeaders?.entries ? initHeaders.entries() : Object.entries(initHeaders) : void 0);
-			let hasContentTypeHeader;
-			let hasContentLength;
-			if (headerEntries) for (const [key, value] of headerEntries) {
-				const lowerKey = typeof key === "string" ? key.toLowerCase() : String(key);
-				if (Array.isArray(value)) for (const v of value) headers.push(lowerKey, v);
-				else headers.push(lowerKey, value);
-				if (lowerKey === "content-type") hasContentTypeHeader = true;
-				else if (lowerKey === "content-length") hasContentLength = true;
-			}
-			if (contentType && !hasContentTypeHeader) headers.push("content-type", contentType);
-			if (contentLength && !hasContentLength) headers.push("content-length", String(contentLength));
-			this.#init = void 0;
-			this.#headers = void 0;
-			this.#response = void 0;
-			this.#body = void 0;
-			return {
-				status,
-				statusText,
-				headers,
-				body
-			};
-		}
-	}
-	lazyInherit(NodeResponse.prototype, NativeResponse.prototype, "_response");
-	Object.setPrototypeOf(NodeResponse, NativeResponse);
-	Object.setPrototypeOf(NodeResponse.prototype, NativeResponse.prototype);
-	return NodeResponse;
-})();
-function decodePathname(pathname) {
-	return decodeURI(pathname.includes("%25") ? pathname.replace(/%25/g, "%2525") : pathname);
-}
-var kEventNS = "h3.internal.event.";
-var kEventRes = /* @__PURE__ */ Symbol.for(`${kEventNS}res`);
-var kEventResHeaders = /* @__PURE__ */ Symbol.for(`${kEventNS}res.headers`);
-var kEventResErrHeaders = /* @__PURE__ */ Symbol.for(`${kEventNS}res.err.headers`);
-var H3Event = class {
-	app;
-	req;
-	url;
-	context;
-	static __is_event__ = true;
-	constructor(req, context, app) {
-		this.context = context || req.context || new NullProtoObj();
-		this.req = req;
-		this.app = app;
-		const _url = req._url;
-		const url = _url && _url instanceof URL ? _url : new FastURL(req.url);
-		if (url.pathname.includes("%")) url.pathname = decodePathname(url.pathname);
-		this.url = url;
-	}
-	get res() {
-		return this[kEventRes] ||= new H3EventResponse();
-	}
-	get runtime() {
-		return this.req.runtime;
-	}
-	waitUntil(promise) {
-		this.req.waitUntil?.(promise);
-	}
-	toString() {
-		return `[${this.req.method}] ${this.req.url}`;
-	}
-	toJSON() {
-		return this.toString();
-	}
-	get node() {
-		return this.req.runtime?.node;
-	}
-	get headers() {
-		return this.req.headers;
-	}
-	get path() {
-		return this.url.pathname + this.url.search;
-	}
-	get method() {
-		return this.req.method;
-	}
-};
-var H3EventResponse = class {
-	status;
-	statusText;
-	get headers() {
-		return this[kEventResHeaders] ||= new Headers();
-	}
-	get errHeaders() {
-		return this[kEventResErrHeaders] ||= new Headers();
-	}
-};
-var DISALLOWED_STATUS_CHARS = /[^\u0009\u0020-\u007E]/g;
-function sanitizeStatusMessage(statusMessage = "") {
-	return statusMessage.replace(DISALLOWED_STATUS_CHARS, "");
-}
-function sanitizeStatusCode(statusCode, defaultStatusCode = 200) {
-	if (!statusCode) return defaultStatusCode;
-	if (typeof statusCode === "string") statusCode = +statusCode;
-	if (statusCode < 100 || statusCode > 599) return defaultStatusCode;
-	return statusCode;
-}
-var HTTPError = class HTTPError extends Error {
-	get name() {
-		return "HTTPError";
-	}
-	status;
-	statusText;
-	headers;
-	cause;
-	data;
-	body;
-	unhandled;
-	static isError(input) {
-		return input instanceof Error && input?.name === "HTTPError";
-	}
-	static status(status, statusText, details) {
-		return new HTTPError({
-			...details,
-			statusText,
-			status
-		});
-	}
-	constructor(arg1, arg2) {
-		let messageInput;
-		let details;
-		if (typeof arg1 === "string") {
-			messageInput = arg1;
-			details = arg2;
-		} else details = arg1;
-		const status = sanitizeStatusCode(details?.status || details?.statusCode || (details?.cause)?.status || (details?.cause)?.statusCode, 500);
-		const statusText = sanitizeStatusMessage(details?.statusText || details?.statusMessage || (details?.cause)?.statusText || (details?.cause)?.statusMessage);
-		const message = messageInput || details?.message || (details?.cause)?.message || details?.statusText || details?.statusMessage || [
-			"HTTPError",
-			status,
-			statusText
-		].filter(Boolean).join(" ");
-		super(message, { cause: details });
-		this.cause = details;
-		this.status = status;
-		this.statusText = statusText || void 0;
-		const rawHeaders = details?.headers || (details?.cause)?.headers;
-		this.headers = rawHeaders ? new Headers(rawHeaders) : void 0;
-		this.unhandled = details?.unhandled ?? (details?.cause)?.unhandled ?? void 0;
-		this.data = details?.data;
-		this.body = details?.body;
-	}
-	get statusCode() {
-		return this.status;
-	}
-	get statusMessage() {
-		return this.statusText;
-	}
-	toJSON() {
-		const unhandled = this.unhandled;
-		return {
-			status: this.status,
-			statusText: this.statusText,
-			unhandled,
-			message: unhandled ? "HTTPError" : this.message,
-			data: unhandled ? void 0 : this.data,
-			...unhandled ? void 0 : this.body
-		};
-	}
-};
-function isJSONSerializable(value, _type) {
-	if (value === null || value === void 0) return true;
-	if (_type !== "object") return _type === "boolean" || _type === "number" || _type === "string";
-	if (typeof value.toJSON === "function") return true;
-	if (Array.isArray(value)) return true;
-	if (typeof value.pipe === "function" || typeof value.pipeTo === "function") return false;
-	if (value instanceof NullProtoObj) return true;
-	const proto = Object.getPrototypeOf(value);
-	return proto === Object.prototype || proto === null;
-}
-var kNotFound = /* @__PURE__ */ Symbol.for("h3.notFound");
-var kHandled = /* @__PURE__ */ Symbol.for("h3.handled");
-function toResponse(val, event, config = {}) {
-	if (typeof val?.then === "function") return (val.catch?.((error) => error) || Promise.resolve(val)).then((resolvedVal) => toResponse(resolvedVal, event, config));
-	const response = prepareResponse(val, event, config);
-	if (typeof response?.then === "function") return toResponse(response, event, config);
-	const { onResponse } = config;
-	return onResponse ? Promise.resolve(onResponse(response, event)).then(() => response) : response;
-}
-var HTTPResponse = class {
-	#headers;
-	#init;
-	body;
-	constructor(body, init) {
-		this.body = body;
-		this.#init = init;
-	}
-	get status() {
-		return this.#init?.status || 200;
-	}
-	get statusText() {
-		return this.#init?.statusText || "OK";
-	}
-	get headers() {
-		return this.#headers ||= new Headers(this.#init?.headers);
-	}
-};
-function prepareResponse(val, event, config, nested) {
-	if (val === kHandled) return new NodeResponse(null);
-	if (val === kNotFound) val = new HTTPError({
-		status: 404,
-		message: `Cannot find any route matching [${event.req.method}] ${event.url}`
-	});
-	if (val && val instanceof Error) {
-		const isHTTPError = HTTPError.isError(val);
-		const error = isHTTPError ? val : new HTTPError(val);
-		if (!isHTTPError) {
-			error.unhandled = true;
-			if (val?.stack) error.stack = val.stack;
-		}
-		if (error.unhandled && !config.silent) console.error(error);
-		const { onError } = config;
-		const errHeaders = event[kEventRes]?.[kEventResErrHeaders];
-		return onError && !nested ? Promise.resolve(onError(error, event)).catch((error) => error).then((newVal) => prepareResponse(newVal ?? val, event, config, true)) : errorResponse(error, config.debug, errHeaders);
-	}
-	const preparedRes = event[kEventRes];
-	const preparedHeaders = preparedRes?.[kEventResHeaders];
-	event[kEventRes] = void 0;
-	if (!(val instanceof Response)) {
-		const res = prepareResponseBody(val, event, config);
-		const status = res.status || preparedRes?.status;
-		return new NodeResponse(nullBody(event.req.method, status) ? null : res.body, {
-			status,
-			statusText: res.statusText || preparedRes?.statusText,
-			headers: res.headers && preparedHeaders ? mergeHeaders$1(res.headers, preparedHeaders) : res.headers || preparedHeaders
-		});
-	}
-	if (!preparedHeaders || nested || !val.ok) return val;
-	try {
-		mergeHeaders$1(val.headers, preparedHeaders, val.headers);
-		return val;
-	} catch {
-		return new NodeResponse(nullBody(event.req.method, val.status) ? null : val.body, {
-			status: val.status,
-			statusText: val.statusText,
-			headers: mergeHeaders$1(val.headers, preparedHeaders)
-		});
-	}
-}
-function mergeHeaders$1(base, overrides, target = new Headers(base)) {
-	for (const [name, value] of overrides) if (name === "set-cookie") target.append(name, value);
-	else target.set(name, value);
-	return target;
-}
-var frozen = (name) => (...args) => {
-	throw new Error(`Headers are frozen (${name} ${args.join(", ")})`);
-};
-var FrozenHeaders = class extends Headers {
-	set = frozen("set");
-	append = frozen("append");
-	delete = frozen("delete");
-};
-var emptyHeaders = /* @__PURE__ */ new FrozenHeaders({ "content-length": "0" });
-var jsonHeaders = /* @__PURE__ */ new FrozenHeaders({ "content-type": "application/json;charset=UTF-8" });
-function prepareResponseBody(val, event, config) {
-	if (val === null || val === void 0) return {
-		body: "",
-		headers: emptyHeaders
-	};
-	const valType = typeof val;
-	if (valType === "string") return { body: val };
-	if (val instanceof Uint8Array) {
-		event.res.headers.set("content-length", val.byteLength.toString());
-		return { body: val };
-	}
-	if (val instanceof HTTPResponse || val?.constructor?.name === "HTTPResponse") return val;
-	if (isJSONSerializable(val, valType)) return {
-		body: JSON.stringify(val, void 0, config.debug ? 2 : void 0),
-		headers: jsonHeaders
-	};
-	if (valType === "bigint") return {
-		body: val.toString(),
-		headers: jsonHeaders
-	};
-	if (val instanceof Blob) {
-		const headers = new Headers({
-			"content-type": val.type,
-			"content-length": val.size.toString()
-		});
-		let filename = val.name;
-		if (filename) {
-			filename = encodeURIComponent(filename);
-			headers.set("content-disposition", `filename="${filename}"; filename*=UTF-8''${filename}`);
-		}
-		return {
-			body: val.stream(),
-			headers
-		};
-	}
-	if (valType === "symbol") return { body: val.toString() };
-	if (valType === "function") return { body: `${val.name}()` };
-	return { body: val };
-}
-function nullBody(method, status) {
-	return method === "HEAD" || status === 100 || status === 101 || status === 102 || status === 204 || status === 205 || status === 304;
-}
-function errorResponse(error, debug, errHeaders) {
-	let headers = error.headers ? mergeHeaders$1(jsonHeaders, error.headers) : new Headers(jsonHeaders);
-	if (errHeaders) headers = mergeHeaders$1(headers, errHeaders);
-	return new NodeResponse(JSON.stringify({
-		...error.toJSON(),
-		stack: debug && error.stack ? error.stack.split("\n").map((l) => l.trim()) : void 0
-	}, void 0, debug ? 2 : void 0), {
-		status: error.status,
-		statusText: error.statusText,
-		headers
-	});
-}
-var plusRegex = /\+/g;
-function parseQuery(input) {
-	const params = new NullProtoObj();
-	if (!input || input === "?") return params;
-	const inputLength = input.length;
-	let key = "";
-	let value = "";
-	let startingIndex = -1;
-	let equalityIndex = -1;
-	let shouldDecodeKey = false;
-	let shouldDecodeValue = false;
-	let keyHasPlus = false;
-	let valueHasPlus = false;
-	let hasBothKeyValuePair = false;
-	let c = 0;
-	for (let i = 0; i < inputLength + 1; i++) {
-		c = i === inputLength ? 38 : input.charCodeAt(i);
-		switch (c) {
-			case 38:
-				hasBothKeyValuePair = equalityIndex > startingIndex;
-				if (!hasBothKeyValuePair) equalityIndex = i;
-				key = input.slice(startingIndex + 1, equalityIndex);
-				if (hasBothKeyValuePair || key.length > 0) {
-					if (keyHasPlus) key = key.replace(plusRegex, " ");
-					if (shouldDecodeKey) try {
-						key = decodeURIComponent(key);
-					} catch {}
-					if (hasBothKeyValuePair) {
-						value = input.slice(equalityIndex + 1, i);
-						if (valueHasPlus) value = value.replace(plusRegex, " ");
-						if (shouldDecodeValue) try {
-							value = decodeURIComponent(value);
-						} catch {}
-					}
-					const currentValue = params[key];
-					if (currentValue === void 0) params[key] = value;
-					else if (Array.isArray(currentValue)) currentValue.push(value);
-					else params[key] = [currentValue, value];
-				}
-				value = "";
-				startingIndex = i;
-				equalityIndex = i;
-				shouldDecodeKey = false;
-				shouldDecodeValue = false;
-				keyHasPlus = false;
-				valueHasPlus = false;
-				break;
-			case 61:
-				if (equalityIndex <= startingIndex) equalityIndex = i;
-				else shouldDecodeValue = true;
-				break;
-			case 43:
-				if (equalityIndex > startingIndex) valueHasPlus = true;
-				else keyHasPlus = true;
-				break;
-			case 37:
-				if (equalityIndex > startingIndex) shouldDecodeValue = true;
-				else shouldDecodeKey = true;
-				break;
-		}
-	}
-	return params;
-}
-var VALIDATION_FAILED = "Validation failed";
-async function validateData(data, fn, options) {
-	if ("~standard" in fn) {
-		const result = await fn["~standard"].validate(data);
-		if (result.issues) throw createValidationError(options?.onError?.(result) || {
-			message: VALIDATION_FAILED,
-			issues: result.issues
-		});
-		return result.value;
-	}
-	try {
-		const res = await fn(data);
-		if (res === false) throw createValidationError(options?.onError?.({ issues: [{ message: VALIDATION_FAILED }] }) || { message: VALIDATION_FAILED });
-		if (res === true) return data;
-		return res ?? data;
-	} catch (error) {
-		throw createValidationError(error);
-	}
-}
-function createValidationError(cause) {
-	return HTTPError.isError(cause) ? cause : new HTTPError({
-		cause,
-		status: cause?.status || 400,
-		statusText: cause?.statusText || VALIDATION_FAILED,
-		message: cause?.message || VALIDATION_FAILED,
-		data: {
-			issues: cause?.issues,
-			message: cause instanceof Error ? VALIDATION_FAILED : cause?.message || VALIDATION_FAILED
-		}
-	});
-}
-function getEventContext(event) {
-	if (event.context) return event.context;
-	event.req.context ??= {};
-	return event.req.context;
-}
-function getQuery(event) {
-	return parseQuery((event.url || new URL(event.req.url)).search.slice(1));
-}
-function getValidatedQuery$1(event, validate, options) {
-	return validateData(getQuery(event), validate, options);
-}
-function getRequestHost$1(event, opts = {}) {
-	if (opts.xForwardedHost) {
-		const xForwardedHost = (event.req.headers.get("x-forwarded-host") || "").split(",").shift()?.trim();
-		if (xForwardedHost) return xForwardedHost;
-	}
-	return event.req.headers.get("host") || "";
-}
-function getRequestProtocol$1(event, opts = {}) {
-	if (opts.xForwardedProto !== false) {
-		const forwardedProto = event.req.headers.get("x-forwarded-proto");
-		if (forwardedProto === "https") return "https";
-		if (forwardedProto === "http") return "http";
-	}
-	return (event.url || new URL(event.req.url)).protocol.slice(0, -1);
-}
-function getRequestURL(event, opts = {}) {
-	const url = new URL(event.url || event.req.url);
-	url.protocol = getRequestProtocol$1(event, opts);
-	if (opts.xForwardedHost) {
-		const host = getRequestHost$1(event, opts);
-		if (host) {
-			url.host = host;
-			if (!/:\d+$/.test(host)) url.port = "";
-		}
-	}
-	return url;
-}
-function getRequestIP$1(event, opts = {}) {
-	if (opts.xForwardedFor) {
-		const _header = event.req.headers.get("x-forwarded-for");
-		if (_header) {
-			const xForwardedFor = _header.split(",")[0].trim();
-			if (xForwardedFor) return xForwardedFor;
-		}
-	}
-	return event.req.context?.clientAddress || event.req.ip || void 0;
-}
-var textEncoder$4 = /* @__PURE__ */ new TextEncoder();
-var textDecoder$1 = /* @__PURE__ */ new TextDecoder();
-var base64Code = [
-	65,
-	66,
-	67,
-	68,
-	69,
-	70,
-	71,
-	72,
-	73,
-	74,
-	75,
-	76,
-	77,
-	78,
-	79,
-	80,
-	81,
-	82,
-	83,
-	84,
-	85,
-	86,
-	87,
-	88,
-	89,
-	90,
-	97,
-	98,
-	99,
-	100,
-	101,
-	102,
-	103,
-	104,
-	105,
-	106,
-	107,
-	108,
-	109,
-	110,
-	111,
-	112,
-	113,
-	114,
-	115,
-	116,
-	117,
-	118,
-	119,
-	120,
-	121,
-	122,
-	48,
-	49,
-	50,
-	51,
-	52,
-	53,
-	54,
-	55,
-	56,
-	57,
-	45,
-	95
-];
-function base64Encode(data) {
-	const buff = validateBinaryLike(data);
-	if (globalThis.Buffer) return globalThis.Buffer.from(buff).toString("base64url");
-	const bytes = [];
-	let i;
-	const len = buff.length;
-	for (i = 2; i < len; i += 3) bytes.push(base64Code[buff[i - 2] >> 2], base64Code[(buff[i - 2] & 3) << 4 | buff[i - 1] >> 4], base64Code[(buff[i - 1] & 15) << 2 | buff[i] >> 6], base64Code[buff[i] & 63]);
-	if (i === len + 1) bytes.push(base64Code[buff[i - 2] >> 2], base64Code[(buff[i - 2] & 3) << 4]);
-	if (i === len) bytes.push(base64Code[buff[i - 2] >> 2], base64Code[(buff[i - 2] & 3) << 4 | buff[i - 1] >> 4], base64Code[(buff[i - 1] & 15) << 2]);
-	return String.fromCharCode(...bytes);
-}
-function base64Decode(b64Url) {
-	if (globalThis.Buffer) return new Uint8Array(globalThis.Buffer.from(b64Url, "base64url"));
-	const b64 = b64Url.replace(/-/g, "+").replace(/_/g, "/");
-	const binString = atob(b64);
-	const size = binString.length;
-	const bytes = new Uint8Array(size);
-	for (let i = 0; i < size; i++) bytes[i] = binString.charCodeAt(i);
-	return bytes;
-}
-function validateBinaryLike(source) {
-	if (typeof source === "string") return textEncoder$4.encode(source);
-	else if (source instanceof Uint8Array) return source;
-	else if (source instanceof ArrayBuffer) return new Uint8Array(source);
-	throw new TypeError(`The input must be a Uint8Array, a string, or an ArrayBuffer.`);
-}
-var COOKIE_MAX_AGE_LIMIT = 3456e4;
-function endIndex(str, min, len) {
-	const index = str.indexOf(";", min);
-	return index === -1 ? len : index;
-}
-function eqIndex(str, min, max) {
-	const index = str.indexOf("=", min);
-	return index < max ? index : -1;
-}
-function valueSlice(str, min, max) {
-	if (min === max) return "";
-	let start = min;
-	let end = max;
-	do {
-		const code = str.charCodeAt(start);
-		if (code !== 32 && code !== 9) break;
-	} while (++start < end);
-	while (end > start) {
-		const code = str.charCodeAt(end - 1);
-		if (code !== 32 && code !== 9) break;
-		end--;
-	}
-	return str.slice(start, end);
-}
-var NullObject = /* @__PURE__ */ (() => {
-	const C = function() {};
-	C.prototype = Object.create(null);
-	return C;
-})();
-function parse(str, options) {
-	const obj = new NullObject();
-	const len = str.length;
-	if (len < 2) return obj;
-	const dec = options?.decode || decode;
-	const allowMultiple = options?.allowMultiple || false;
-	let index = 0;
-	do {
-		const eqIdx = eqIndex(str, index, len);
-		if (eqIdx === -1) break;
-		const endIdx = endIndex(str, index, len);
-		if (eqIdx > endIdx) {
-			index = str.lastIndexOf(";", eqIdx - 1) + 1;
-			continue;
-		}
-		const key = valueSlice(str, index, eqIdx);
-		if (options?.filter && !options.filter(key)) {
-			index = endIdx + 1;
-			continue;
-		}
-		const val = dec(valueSlice(str, eqIdx + 1, endIdx));
-		if (allowMultiple) {
-			const existing = obj[key];
-			if (existing === void 0) obj[key] = val;
-			else if (Array.isArray(existing)) existing.push(val);
-			else obj[key] = [existing, val];
-		} else if (obj[key] === void 0) obj[key] = val;
-		index = endIdx + 1;
-	} while (index < len);
-	return obj;
-}
-function decode(str) {
-	if (!str.includes("%")) return str;
-	try {
-		return decodeURIComponent(str);
-	} catch {
-		return str;
-	}
-}
-var cookieNameRegExp = /^[\u0021-\u003A\u003C\u003E-\u007E]+$/;
-var cookieValueRegExp = /^[\u0021-\u003A\u003C-\u007E]*$/;
-var domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
-var pathValueRegExp = /^[\u0020-\u003A\u003C-\u007E]*$/;
-var __toString = Object.prototype.toString;
-function serialize(_a0, _a1, _a2) {
-	const isObj = typeof _a0 === "object" && _a0 !== null;
-	const options = isObj ? _a1 : _a2;
-	const stringify = options?.stringify || JSON.stringify;
-	const cookie = isObj ? _a0 : {
-		..._a2,
-		name: _a0,
-		value: _a1 == void 0 ? "" : typeof _a1 === "string" ? _a1 : stringify(_a1)
-	};
-	const enc = options?.encode || encodeURIComponent;
-	if (!cookieNameRegExp.test(cookie.name)) throw new TypeError(`argument name is invalid: ${cookie.name}`);
-	const value = cookie.value ? enc(cookie.value) : "";
-	if (!cookieValueRegExp.test(value)) throw new TypeError(`argument val is invalid: ${cookie.value}`);
-	if (!cookie.secure) {
-		if (cookie.partitioned) throw new TypeError(`Partitioned cookies must have the Secure attribute`);
-		if (cookie.sameSite && String(cookie.sameSite).toLowerCase() === "none") throw new TypeError(`SameSite=None cookies must have the Secure attribute`);
-		if (cookie.name.length > 9 && cookie.name.charCodeAt(0) === 95 && cookie.name.charCodeAt(1) === 95) {
-			const nameLower = cookie.name.toLowerCase();
-			if (nameLower.startsWith("__secure-") || nameLower.startsWith("__host-")) throw new TypeError(`${cookie.name} cookies must have the Secure attribute`);
-		}
-	}
-	if (cookie.name.length > 7 && cookie.name.charCodeAt(0) === 95 && cookie.name.charCodeAt(1) === 95 && cookie.name.toLowerCase().startsWith("__host-")) {
-		if (cookie.path !== "/") throw new TypeError(`__Host- cookies must have Path=/`);
-		if (cookie.domain) throw new TypeError(`__Host- cookies must not have a Domain attribute`);
-	}
-	let str = cookie.name + "=" + value;
-	if (cookie.maxAge !== void 0) {
-		if (!Number.isInteger(cookie.maxAge)) throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);
-		str += "; Max-Age=" + Math.max(0, Math.min(cookie.maxAge, COOKIE_MAX_AGE_LIMIT));
-	}
-	if (cookie.domain) {
-		if (!domainValueRegExp.test(cookie.domain)) throw new TypeError(`option domain is invalid: ${cookie.domain}`);
-		str += "; Domain=" + cookie.domain;
-	}
-	if (cookie.path) {
-		if (!pathValueRegExp.test(cookie.path)) throw new TypeError(`option path is invalid: ${cookie.path}`);
-		str += "; Path=" + cookie.path;
-	}
-	if (cookie.expires) {
-		if (!isDate(cookie.expires) || !Number.isFinite(cookie.expires.valueOf())) throw new TypeError(`option expires is invalid: ${cookie.expires}`);
-		str += "; Expires=" + cookie.expires.toUTCString();
-	}
-	if (cookie.httpOnly) str += "; HttpOnly";
-	if (cookie.secure) str += "; Secure";
-	if (cookie.partitioned) str += "; Partitioned";
-	if (cookie.priority) switch (typeof cookie.priority === "string" ? cookie.priority.toLowerCase() : void 0) {
-		case "low":
-			str += "; Priority=Low";
-			break;
-		case "medium":
-			str += "; Priority=Medium";
-			break;
-		case "high":
-			str += "; Priority=High";
-			break;
-		default: throw new TypeError(`option priority is invalid: ${cookie.priority}`);
-	}
-	if (cookie.sameSite) switch (typeof cookie.sameSite === "string" ? cookie.sameSite.toLowerCase() : cookie.sameSite) {
-		case true:
-		case "strict":
-			str += "; SameSite=Strict";
-			break;
-		case "lax":
-			str += "; SameSite=Lax";
-			break;
-		case "none":
-			str += "; SameSite=None";
-			break;
-		default: throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);
-	}
-	return str;
-}
-function isDate(val) {
-	return __toString.call(val) === "[object Date]";
-}
-var maxAgeRegExp = /^-?\d+$/;
-var _nullProto = /* @__PURE__ */ Object.getPrototypeOf({});
-function parseSetCookie(str, options) {
-	const len = str.length;
-	let _endIdx = len;
-	let eqIdx = -1;
-	for (let i = 0; i < len; i++) {
-		const c = str.charCodeAt(i);
-		if (c === 59) {
-			_endIdx = i;
-			break;
-		}
-		if (c === 61 && eqIdx === -1) eqIdx = i;
-	}
-	if (eqIdx >= _endIdx) eqIdx = -1;
-	const name = eqIdx === -1 ? "" : _trim(str, 0, eqIdx);
-	if (name && name in _nullProto) return void 0;
-	let value = eqIdx === -1 ? _trim(str, 0, _endIdx) : _trim(str, eqIdx + 1, _endIdx);
-	if (!name && !value) return void 0;
-	if (name.length + value.length > 4096) return void 0;
-	if (options?.decode !== false) value = _decode(value, options?.decode);
-	const setCookie = {
-		name,
-		value
-	};
-	let index = _endIdx + 1;
-	while (index < len) {
-		let endIdx = len;
-		let attrEqIdx = -1;
-		for (let i = index; i < len; i++) {
-			const c = str.charCodeAt(i);
-			if (c === 59) {
-				endIdx = i;
-				break;
-			}
-			if (c === 61 && attrEqIdx === -1) attrEqIdx = i;
-		}
-		if (attrEqIdx >= endIdx) attrEqIdx = -1;
-		const attr = attrEqIdx === -1 ? _trim(str, index, endIdx) : _trim(str, index, attrEqIdx);
-		const val = attrEqIdx === -1 ? void 0 : _trim(str, attrEqIdx + 1, endIdx);
-		if (val === void 0 || val.length <= 1024) switch (attr.toLowerCase()) {
-			case "httponly":
-				setCookie.httpOnly = true;
-				break;
-			case "secure":
-				setCookie.secure = true;
-				break;
-			case "partitioned":
-				setCookie.partitioned = true;
-				break;
-			case "domain":
-				if (val) setCookie.domain = (val.charCodeAt(0) === 46 ? val.slice(1) : val).toLowerCase();
-				break;
-			case "path":
-				setCookie.path = val;
-				break;
-			case "max-age":
-				if (val && maxAgeRegExp.test(val)) setCookie.maxAge = Math.min(Number(val), COOKIE_MAX_AGE_LIMIT);
-				break;
-			case "expires": {
-				if (!val) break;
-				const date = new Date(val);
-				if (Number.isFinite(date.valueOf())) {
-					const maxDate = new Date(Date.now() + COOKIE_MAX_AGE_LIMIT * 1e3);
-					setCookie.expires = date > maxDate ? maxDate : date;
-				}
-				break;
-			}
-			case "priority": {
-				if (!val) break;
-				const priority = val.toLowerCase();
-				if (priority === "low" || priority === "medium" || priority === "high") setCookie.priority = priority;
-				break;
-			}
-			case "samesite": {
-				if (!val) break;
-				const sameSite = val.toLowerCase();
-				if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") setCookie.sameSite = sameSite;
-				else setCookie.sameSite = "lax";
-				break;
-			}
-			default: {
-				const attrLower = attr.toLowerCase();
-				if (attrLower && !(attrLower in _nullProto)) setCookie[attrLower] = val;
-			}
-		}
-		index = endIdx + 1;
-	}
-	return setCookie;
-}
-function _trim(str, start, end) {
-	if (start === end) return "";
-	let s = start;
-	let e = end;
-	while (s < e && (str.charCodeAt(s) === 32 || str.charCodeAt(s) === 9)) s++;
-	while (e > s && (str.charCodeAt(e - 1) === 32 || str.charCodeAt(e - 1) === 9)) e--;
-	return str.slice(s, e);
-}
-function _decode(value, decode) {
-	if (!decode && !value.includes("%")) return value;
-	try {
-		return (decode || decodeURIComponent)(value);
-	} catch {
-		return value;
-	}
-}
-var CHUNKED_COOKIE = "__chunked__";
-var CHUNKS_MAX_LENGTH = 4e3;
-function parseCookies(event) {
-	return parse(event.req.headers.get("cookie") || "");
-}
-function getCookie$1(event, name) {
-	return parseCookies(event)[name];
-}
-function setCookie$1(event, name, value, options) {
-	const newCookie = serialize({
-		name,
-		value,
-		path: "/",
-		...options
-	});
-	const currentCookies = event.res.headers.getSetCookie();
-	if (currentCookies.length === 0) {
-		event.res.headers.set("set-cookie", newCookie);
-		return;
-	}
-	const newCookieKey = _getDistinctCookieKey(name, options || {});
-	event.res.headers.delete("set-cookie");
-	for (const cookie of currentCookies) {
-		const parsed = parseSetCookie(cookie);
-		if (!parsed) continue;
-		if (_getDistinctCookieKey(cookie.split("=")?.[0], parsed) === newCookieKey) continue;
-		event.res.headers.append("set-cookie", cookie);
-	}
-	event.res.headers.append("set-cookie", newCookie);
-}
-function deleteCookie$1(event, name, serializeOptions) {
-	setCookie$1(event, name, "", {
-		...serializeOptions,
-		maxAge: 0
-	});
-}
-function getChunkedCookie(event, name) {
-	const mainCookie = getCookie$1(event, name);
-	if (!mainCookie || !mainCookie.startsWith(CHUNKED_COOKIE)) return mainCookie;
-	const chunksCount = getChunkedCookieCount(mainCookie);
-	if (chunksCount === 0) return;
-	const chunks = [];
-	for (let i = 1; i <= chunksCount; i++) {
-		const chunk = getCookie$1(event, chunkCookieName(name, i));
-		if (!chunk) return;
-		chunks.push(chunk);
-	}
-	return chunks.join("");
-}
-function setChunkedCookie(event, name, value, options) {
-	const chunkMaxLength = options?.chunkMaxLength || CHUNKS_MAX_LENGTH;
-	const chunkCount = Math.ceil(value.length / chunkMaxLength);
-	const previousCookie = getCookie$1(event, name);
-	if (previousCookie?.startsWith(CHUNKED_COOKIE)) {
-		const previousChunkCount = getChunkedCookieCount(previousCookie);
-		if (previousChunkCount > chunkCount) for (let i = chunkCount; i <= previousChunkCount; i++) deleteCookie$1(event, chunkCookieName(name, i), options);
-	}
-	if (chunkCount <= 1) {
-		setCookie$1(event, name, value, options);
-		return;
-	}
-	setCookie$1(event, name, `${CHUNKED_COOKIE}${chunkCount}`, options);
-	for (let i = 1; i <= chunkCount; i++) {
-		const start = (i - 1) * chunkMaxLength;
-		const end = start + chunkMaxLength;
-		const chunkValue = value.slice(start, end);
-		setCookie$1(event, chunkCookieName(name, i), chunkValue, options);
-	}
-}
-function deleteChunkedCookie(event, name, serializeOptions) {
-	const mainCookie = getCookie$1(event, name);
-	deleteCookie$1(event, name, serializeOptions);
-	const chunksCount = getChunkedCookieCount(mainCookie);
-	if (chunksCount >= 0) for (let i = 0; i < chunksCount; i++) deleteCookie$1(event, chunkCookieName(name, i + 1), serializeOptions);
-}
-function _getDistinctCookieKey(name, options) {
-	return [
-		name,
-		options.domain || "",
-		options.path || "/"
-	].join(";");
-}
-var MAX_CHUNKED_COOKIE_COUNT = 100;
-function getChunkedCookieCount(cookie) {
-	if (!cookie?.startsWith(CHUNKED_COOKIE)) return NaN;
-	const count = Number.parseInt(cookie.slice(11));
-	if (Number.isNaN(count) || count < 0 || count > MAX_CHUNKED_COOKIE_COUNT) return NaN;
-	return count;
-}
-function chunkCookieName(name, chunkNumber) {
-	return `${name}.${chunkNumber}`;
-}
-var defaults = /* @__PURE__ */ Object.freeze({
-	ttl: 0,
-	timestampSkewSec: 60,
-	localtimeOffsetMsec: 0,
-	encryption: /* @__PURE__ */ Object.freeze({
-		saltBits: 256,
-		algorithm: "aes-256-cbc",
-		iterations: 1,
-		minPasswordlength: 32
-	}),
-	integrity: /* @__PURE__ */ Object.freeze({
-		saltBits: 256,
-		algorithm: "sha256",
-		iterations: 1,
-		minPasswordlength: 32
-	})
-});
-var algorithms = /* @__PURE__ */ Object.freeze({
-	"aes-128-ctr": /* @__PURE__ */ Object.freeze({
-		keyBits: 128,
-		ivBits: 128,
-		name: "AES-CTR"
-	}),
-	"aes-256-cbc": /* @__PURE__ */ Object.freeze({
-		keyBits: 256,
-		ivBits: 128,
-		name: "AES-CBC"
-	}),
-	sha256: /* @__PURE__ */ Object.freeze({
-		keyBits: 256,
-		ivBits: 128,
-		name: "SHA-256"
-	})
-});
-var macPrefix = "Fe26.2";
-async function seal(object, password, opts) {
-	const now = Date.now() + (opts.localtimeOffsetMsec || 0);
-	if (!password) throw new Error("Empty password");
-	const { id = "", encryption, integrity } = normalizePassword(password);
-	if (id && !/^\w+$/.test(id)) throw new Error("Invalid password id");
-	const { encrypted, key } = await encrypt(encryption, opts.encryption, JSON.stringify(object));
-	const encryptedB64 = base64Encode(encrypted);
-	const iv = base64Encode(key.iv);
-	const expiration = opts.ttl ? now + opts.ttl : "";
-	const macBaseString = `${macPrefix}*${id}*${key.salt}*${iv}*${encryptedB64}*${expiration}`;
-	const mac = await hmacWithPassword(integrity, opts.integrity, macBaseString);
-	return `${macBaseString}*${mac.salt}*${mac.digest}`;
-}
-async function unseal(sealed, password, opts) {
-	const now = Date.now() + (opts.localtimeOffsetMsec || 0);
-	if (!password) throw new Error("Empty password");
-	const parts = sealed.split("*");
-	if (parts.length !== 8) throw new Error("Incorrect number of sealed components");
-	const [prefix, passwordId, encryptionSalt, encryptionIv, encryptedB64, expiration, hmacSalt, hmac] = parts;
-	const macBaseString = `${prefix}*${passwordId}*${encryptionSalt}*${encryptionIv}*${encryptedB64}*${expiration}`;
-	if ("Fe26.2" !== prefix) throw new Error("Wrong mac prefix");
-	if (expiration) {
-		if (!/^\d+$/.test(expiration)) throw new Error("Invalid expiration");
-		if (Number.parseInt(expiration, 10) <= now - opts.timestampSkewSec * 1e3) throw new Error("Expired seal");
-	}
-	let pass = "";
-	const _passwordId = passwordId || "default";
-	if (typeof password === "string" || password instanceof Uint8Array) pass = password;
-	else if (_passwordId in password) pass = password[_passwordId];
-	else throw new Error(`Cannot find password: ${_passwordId}`);
-	pass = normalizePassword(pass);
-	if (!fixedTimeComparison((await hmacWithPassword(pass.integrity, {
-		...opts.integrity,
-		salt: hmacSalt
-	}, macBaseString)).digest, hmac)) throw new Error("Bad hmac value");
-	const encrypted = base64Decode(encryptedB64);
-	const decryptOptions = {
-		...opts.encryption,
-		salt: encryptionSalt,
-		iv: base64Decode(encryptionIv)
-	};
-	const decrypted = await decrypt(pass.encryption, decryptOptions, encrypted);
-	return decrypted ? JSON.parse(decrypted) : null;
-}
-async function hmacWithPassword(password, options, data) {
-	const key = await generateKey(password, {
-		...options,
-		hmac: true
-	});
-	const textBuffer = textEncoder$4.encode(data);
-	const signed = await crypto.subtle.sign({ name: "HMAC" }, key.key, textBuffer);
-	return {
-		digest: base64Encode(new Uint8Array(signed)),
-		salt: key.salt
-	};
-}
-async function generateKey(password, options) {
-	if (!password?.length) throw new Error("Empty password");
-	if (options == null || typeof options !== "object") throw new Error("Bad options");
-	if (!(options.algorithm in algorithms)) throw new Error(`Unknown algorithm: ${options.algorithm}`);
-	const algorithm = algorithms[options.algorithm];
-	let resultKey;
-	let resultSalt;
-	let resultIV;
-	const hmac = options.hmac ?? false;
-	const id = hmac ? {
-		name: "HMAC",
-		hash: algorithm.name
-	} : { name: algorithm.name };
-	const usage = hmac ? ["sign", "verify"] : ["encrypt", "decrypt"];
-	if (typeof password === "string") {
-		if (password.length < options.minPasswordlength) throw new Error(`Password string too short (min ${options.minPasswordlength} characters required)`);
-		let { salt = "" } = options;
-		if (!salt) {
-			const { saltBits = 0 } = options;
-			if (!saltBits) throw new Error("Missing salt and saltBits options");
-			const randomSalt = randomBits(saltBits);
-			salt = [...new Uint8Array(randomSalt)].map((x) => x.toString(16).padStart(2, "0")).join("");
-		}
-		const derivedKey = await pbkdf2(password, salt, options.iterations, algorithm.keyBits / 8, "SHA-1");
-		resultKey = await crypto.subtle.importKey("raw", derivedKey, id, false, usage);
-		resultSalt = salt;
-	} else {
-		if (password.length < algorithm.keyBits / 8) throw new Error("Key buffer (password) too small");
-		resultKey = await crypto.subtle.importKey("raw", password, id, false, usage);
-		resultSalt = "";
-	}
-	if (options.iv) resultIV = options.iv;
-	else if ("ivBits" in algorithm) resultIV = randomBits(algorithm.ivBits);
-	else throw new Error("Missing IV");
-	return {
-		key: resultKey,
-		salt: resultSalt,
-		iv: resultIV
-	};
-}
-async function pbkdf2(password, salt, iterations, keyLength, hash) {
-	const passwordBuffer = textEncoder$4.encode(password);
-	const importedKey = await crypto.subtle.importKey("raw", passwordBuffer, { name: "PBKDF2" }, false, ["deriveBits"]);
-	const params = {
-		name: "PBKDF2",
-		hash,
-		salt: textEncoder$4.encode(salt),
-		iterations
-	};
-	return await crypto.subtle.deriveBits(params, importedKey, keyLength * 8);
-}
-async function encrypt(password, options, data) {
-	const key = await generateKey(password, options);
-	const encrypted = await crypto.subtle.encrypt(...getEncryptParams(options.algorithm, key, data));
-	return {
-		encrypted: new Uint8Array(encrypted),
-		key
-	};
-}
-async function decrypt(password, options, data) {
-	const key = await generateKey(password, options);
-	const decrypted = await crypto.subtle.decrypt(...getEncryptParams(options.algorithm, key, data));
-	return textDecoder$1.decode(decrypted);
-}
-function getEncryptParams(algorithm, key, data) {
-	return [
-		algorithm === "aes-128-ctr" ? {
-			name: "AES-CTR",
-			counter: key.iv,
-			length: 128
-		} : {
-			name: "AES-CBC",
-			iv: key.iv
-		},
-		key.key,
-		typeof data === "string" ? textEncoder$4.encode(data) : data
-	];
-}
-function fixedTimeComparison(a, b) {
-	let mismatch = a.length === b.length ? 0 : 1;
-	if (mismatch) b = a;
-	for (let i = 0; i < a.length; i += 1) mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
-	return mismatch === 0;
-}
-function normalizePassword(password) {
-	if (typeof password === "string" || password instanceof Uint8Array) return {
-		encryption: password,
-		integrity: password
-	};
-	if ("secret" in password) return {
-		id: password.id,
-		encryption: password.secret,
-		integrity: password.secret
-	};
-	return {
-		id: password.id,
-		encryption: password.encryption,
-		integrity: password.integrity
-	};
-}
-function randomBits(bits) {
-	if (bits < 1) throw new Error("Invalid random bits count");
-	return randomBytes(Math.ceil(bits / 8));
-}
-function randomBytes(size) {
-	const bytes = new Uint8Array(size);
-	crypto.getRandomValues(bytes);
-	return bytes;
-}
-var kGetSession = /* @__PURE__ */ Symbol.for("h3.internal.session.promise");
-var DEFAULT_SESSION_COOKIE = {
-	path: "/",
-	secure: true,
-	httpOnly: true
-};
-async function useSession$1(event, config) {
-	const sessionName = config.name || "h3";
-	await getSession$1(event, config);
-	const sessionManager = {
-		get id() {
-			return getEventContext(event)?.sessions?.[sessionName]?.id;
-		},
-		get data() {
-			return getEventContext(event).sessions?.[sessionName]?.data || {};
-		},
-		update: async (update) => {
-			await updateSession$1(event, config, update);
-			return sessionManager;
-		},
-		clear: () => {
-			clearSession$1(event, config);
-			return Promise.resolve(sessionManager);
-		}
-	};
-	return sessionManager;
-}
-async function getSession$1(event, config) {
-	const sessionName = config.name || "h3";
-	const context = getEventContext(event);
-	if (!context.sessions) context.sessions = new NullProtoObj();
-	const existingSession = context.sessions[sessionName];
-	if (existingSession) return existingSession[kGetSession] || existingSession;
-	const session = {
-		id: "",
-		createdAt: 0,
-		data: new NullProtoObj()
-	};
-	context.sessions[sessionName] = session;
-	let sealedSession;
-	if (config.sessionHeader !== false) {
-		const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-		const headerValue = event.req.headers.get(headerName);
-		if (typeof headerValue === "string") sealedSession = headerValue;
-	}
-	if (!sealedSession) sealedSession = getChunkedCookie(event, sessionName);
-	if (sealedSession) {
-		const promise = unsealSession$1(event, config, sealedSession).catch(() => {}).then((unsealed) => {
-			Object.assign(session, unsealed);
-			delete context.sessions[sessionName][kGetSession];
-			return session;
-		});
-		context.sessions[sessionName][kGetSession] = promise;
-		await promise;
-	}
-	if (!session.id) {
-		session.id = config.generateId?.() ?? (config.crypto || crypto).randomUUID();
-		session.createdAt = Date.now();
-		await updateSession$1(event, config);
-	}
-	return session;
-}
-async function updateSession$1(event, config, update) {
-	const sessionName = config.name || "h3";
-	const session = getEventContext(event).sessions?.[sessionName] || await getSession$1(event, config);
-	if (typeof update === "function") update = update(session.data);
-	if (update) Object.assign(session.data, update);
-	if (config.cookie !== false && event.res) setChunkedCookie(event, sessionName, await sealSession$1(event, config), {
-		...DEFAULT_SESSION_COOKIE,
-		expires: config.maxAge ? new Date(session.createdAt + config.maxAge * 1e3) : void 0,
-		...config.cookie
-	});
-	return session;
-}
-async function sealSession$1(event, config) {
-	const sessionName = config.name || "h3";
-	return await seal(getEventContext(event).sessions?.[sessionName] || await getSession$1(event, config), config.password, {
-		...defaults,
-		ttl: config.maxAge ? config.maxAge * 1e3 : 0,
-		...config.seal
-	});
-}
-async function unsealSession$1(_event, config, sealed) {
-	const unsealed = await unseal(sealed, config.password, {
-		...defaults,
-		ttl: config.maxAge ? config.maxAge * 1e3 : 0,
-		...config.seal
-	});
-	if (config.maxAge) {
-		if (Date.now() - (unsealed.createdAt || Number.NEGATIVE_INFINITY) > config.maxAge * 1e3) throw new Error("Session expired!");
-	}
-	return unsealed;
-}
-function clearSession$1(event, config) {
-	const context = getEventContext(event);
-	const sessionName = config.name || "h3";
-	if (context.sessions?.[sessionName]) delete context.sessions[sessionName];
-	if (event.res && config.cookie !== false) deleteChunkedCookie(event, sessionName, {
-		...DEFAULT_SESSION_COOKIE,
-		...config.cookie
-	});
-	return Promise.resolve();
-}
-var GLOBAL_EVENT_STORAGE_KEY = Symbol.for("tanstack-start:event-storage");
-var globalObj = globalThis;
-if (!globalObj[GLOBAL_EVENT_STORAGE_KEY]) globalObj[GLOBAL_EVENT_STORAGE_KEY] = new AsyncLocalStorage();
-var eventStorage = globalObj[GLOBAL_EVENT_STORAGE_KEY];
-function isPromiseLike(value) {
-	return (typeof value === "object" || typeof value === "function") && value !== null && typeof value.then === "function";
-}
-function getSetCookieValues(headers) {
-	const headersWithSetCookie = headers;
-	if (typeof headersWithSetCookie.getSetCookie === "function") return headersWithSetCookie.getSetCookie();
-	const value = headers.get("set-cookie");
-	return value ? [value] : [];
-}
-function mergeEventResponseHeaders(response, event) {
-	if (response.ok) return;
-	const eventSetCookies = getSetCookieValues(event.res.headers);
-	if (eventSetCookies.length === 0) return;
-	const responseSetCookies = getSetCookieValues(response.headers);
-	response.headers.delete("set-cookie");
-	for (const cookie of responseSetCookies) response.headers.append("set-cookie", cookie);
-	for (const cookie of eventSetCookies) response.headers.append("set-cookie", cookie);
-}
-function finalizeResponse(value, event) {
-	const response = ensureResponse(value);
-	mergeEventResponseHeaders(response, event);
-	return response;
-}
-function finalizeMaybeResponse(value, event) {
-	if (isPromiseLike(value)) return Promise.resolve(value).then((resolved) => finalizeResponse(resolved, event), (error) => finalizeResponse(handleResponseError(error), event));
-	return finalizeResponse(value, event);
-}
-function ensureResponse(value) {
-	if (value instanceof Response) return value;
-	return new Response("Internal Server Error", { status: 500 });
-}
-function handleResponseError(error) {
-	if (error instanceof Response) return error;
-	if (error instanceof Error) throw error;
-	return new Response("Internal Server Error", { status: 500 });
-}
-function requestHandler(handler) {
-	return (request, requestOpts) => {
-		let h3Event;
-		try {
-			h3Event = new H3Event(request);
-		} catch (error) {
-			if (error instanceof URIError) return new Response(null, {
-				status: 400,
-				statusText: "Bad Request"
-			});
-			throw error;
-		}
-		let response;
-		try {
-			response = eventStorage.run({ h3Event }, () => handler(request, requestOpts));
-		} catch (error) {
-			response = handleResponseError(error);
-		}
-		return toResponse(finalizeMaybeResponse(response, h3Event), h3Event);
-	};
-}
-function getH3Event() {
-	const event = eventStorage.getStore();
-	if (!event) throw new Error(`No StartEvent found in AsyncLocalStorage. Make sure you are using the function within the server runtime.`);
-	return event.h3Event;
-}
-function getRequest() {
-	return getH3Event().req;
-}
-function getRequestHeaders$1() {
-	return getH3Event().req.headers;
-}
-function getRequestHeader(name) {
-	return getRequestHeaders$1().get(name) || void 0;
-}
-function getRequestIP(opts) {
-	return getRequestIP$1(getH3Event(), opts);
-}
-/**
-* Get the request hostname.
-*
-* If `xForwardedHost` is `true`, it will use the `x-forwarded-host` header if it exists.
-*
-* If no host header is found, it will default to "localhost".
-*/
-function getRequestHost(opts) {
-	return getRequestHost$1(getH3Event(), opts);
-}
-/**
-* Get the full incoming request URL.
-*
-* If `xForwardedHost` is `true`, it will use the `x-forwarded-host` header if it exists.
-*
-* If `xForwardedProto` is `false`, it will not use the `x-forwarded-proto` header.
-*/
-function getRequestUrl(opts) {
-	return getRequestURL(getH3Event(), opts);
-}
-/**
-* Get the request protocol.
-*
-* If `x-forwarded-proto` header is set to "https", it will return "https". You can disable this behavior by setting `xForwardedProto` to `false`.
-*
-* If protocol cannot be determined, it will default to "http".
-*/
-function getRequestProtocol(opts) {
-	return getRequestProtocol$1(getH3Event(), opts);
-}
-function setResponseHeaders(headers) {
-	const event = getH3Event();
-	if (event.res.headers === headers) return;
-	let previousName = "";
-	for (const [name, value] of headers) {
-		event.res.headers[name === previousName ? "append" : "set"](name, value);
-		previousName = name;
-	}
-}
-function getResponseHeaders() {
-	return getH3Event().res.headers;
-}
-function getResponseHeader(name) {
-	return getH3Event().res.headers.get(name) || void 0;
-}
-function setResponseHeader(name, value) {
-	const event = getH3Event();
-	if (Array.isArray(value)) {
-		event.res.headers.delete(name);
-		for (const valueItem of value) event.res.headers.append(name, valueItem);
-	} else event.res.headers.set(name, value);
-}
-function removeResponseHeader(name) {
-	getH3Event().res.headers.delete(name);
-}
-function clearResponseHeaders(headerNames) {
-	const event = getH3Event();
-	if (headerNames && headerNames.length > 0) for (const name of headerNames) event.res.headers.delete(name);
-	else for (const name of event.res.headers.keys()) event.res.headers.delete(name);
-}
-function getResponseStatus() {
-	return getH3Event().res.status || 200;
-}
-function setResponseStatus(code, text) {
-	const event = getH3Event();
-	if (code) event.res.status = sanitizeStatusCode(code, event.res.status);
-	if (text) event.res.statusText = sanitizeStatusMessage(text);
-}
-/**
-* Parse the request to get HTTP Cookie header string and return an object of all cookie name-value pairs.
-* @returns Object of cookie name-value pairs
-* ```ts
-* const cookies = getCookies()
-* ```
-*/
-function getCookies() {
-	const cookies = parseCookies(getH3Event());
-	const definedCookies = Object.create(null);
-	for (const [name, value] of Object.entries(cookies)) if (value !== void 0) definedCookies[name] = value;
-	return definedCookies;
-}
-/**
-* Get a cookie value by name.
-* @param name Name of the cookie to get
-* @returns {*} Value of the cookie (String or undefined)
-* ```ts
-* const authorization = getCookie('Authorization')
-* ```
-*/
-function getCookie(name) {
-	return getCookies()[name];
-}
-/**
-* Set a cookie value by name.
-* @param name Name of the cookie to set
-* @param value Value of the cookie to set
-* @param options {CookieSerializeOptions} Options for serializing the cookie
-* ```ts
-* setCookie('Authorization', '1234567')
-* ```
-*/
-function setCookie(name, value, options) {
-	setCookie$1(getH3Event(), name, value, options);
-}
-/**
-* Remove a cookie by name.
-* @param name Name of the cookie to delete
-* @param serializeOptions {CookieSerializeOptions} Cookie options
-* ```ts
-* deleteCookie('SessionId')
-* ```
-*/
-function deleteCookie(name, options) {
-	deleteCookie$1(getH3Event(), name, options);
-}
-function getDefaultSessionConfig(config) {
-	return {
-		name: "start",
-		...config
-	};
-}
-/**
-* Create a session manager for the current request.
-*/
-function useSession(config) {
-	return useSession$1(getH3Event(), getDefaultSessionConfig(config));
-}
-/**
-* Get the session for the current request
-*/
-function getSession(config) {
-	return getSession$1(getH3Event(), getDefaultSessionConfig(config));
-}
-/**
-* Update the session data for the current request.
-*/
-function updateSession(config, update) {
-	return updateSession$1(getH3Event(), getDefaultSessionConfig(config), update);
-}
-/**
-* Encrypt and sign the session data for the current request.
-*/
-function sealSession(config) {
-	return sealSession$1(getH3Event(), getDefaultSessionConfig(config));
-}
-/**
-* Decrypt and verify the session data for the current request.
-*/
-function unsealSession(config, sealed) {
-	return unsealSession$1(getH3Event(), getDefaultSessionConfig(config), sealed);
-}
-/**
-* Clear the session data for the current request.
-*/
-function clearSession(config) {
-	return clearSession$1(getH3Event(), {
-		name: "start",
-		...config
-	});
-}
-function getResponse() {
-	return getH3Event().res;
-}
-function getValidatedQuery(schema) {
-	return getValidatedQuery$1(getH3Event(), schema);
+function getSetCookieValues(headers) {
+	const headersWithSetCookie = headers;
+	if (typeof headersWithSetCookie.getSetCookie === "function") return headersWithSetCookie.getSetCookie();
+	const value = headers.get("set-cookie");
+	return value ? splitSetCookieString(value) : [];
 }
-var HEADERS = { TSS_SHELL: "X-TSS_SHELL" };
 /** Determine if a value is a TanStack Router not-found error. */
 function isNotFound(obj) {
 	return obj?.isNotFound === true;
@@ -1684,7 +35,7 @@ function isNotFound(obj) {
 /** Stable identifier used for the root route in a route tree. */
 var rootRouteId = "__root__";
 function dehydrateSsrMatchId(id) {
-	return id.replaceAll("~", "~~").replaceAll("\0", "~0").replaceAll("�", "~r").replaceAll("/", "\0");
+	return id.replaceAll("/", "#");
 }
 /**
 * A fixed-capacity cache using the SIEVE eviction algorithm
@@ -1743,15 +94,6 @@ function createSieveCache(max) {
 function invariant() {
 	throw new Error("Invariant failed");
 }
-/** Execute a location input rewrite if provided. */
-function executeRewriteInput(rewrite, url) {
-	const res = rewrite?.input?.({ url });
-	if (res) {
-		if (typeof res === "string") return new URL(res);
-		else if (res instanceof URL) return res;
-	}
-	return url;
-}
 var stateIndexKey = "__TSR_index";
 /**
 * Turn protocol-relative inputs such as "//evil.example" into paths
@@ -1824,14 +166,14 @@ function parseHref(href, state) {
 	}
 	return {
 		href: sanitizedHref,
-		pathname: sanitizedHref.substring(0, hashIndex > 0 ? searchIndex > 0 ? Math.min(hashIndex, searchIndex) : hashIndex : searchIndex > 0 ? searchIndex : sanitizedHref.length),
-		hash: hashIndex > -1 ? sanitizedHref.substring(hashIndex) : "",
+		pathname: sanitizedHref.slice(0, hashIndex > -1 ? searchIndex > -1 ? Math.min(hashIndex, searchIndex) : hashIndex : searchIndex > -1 ? searchIndex : sanitizedHref.length),
+		hash: hashIndex > -1 ? sanitizedHref.slice(hashIndex) : "",
 		search: searchIndex > -1 ? sanitizedHref.slice(searchIndex, hashIndex === -1 ? void 0 : hashIndex) : "",
 		state
 	};
 }
 function createRandomKey() {
-	return (Math.random() + 1).toString(36).substring(7);
+	return (Math.random() + 1).toString(36).slice(7);
 }
 /** Return the structural lane through the first terminal render boundary. */
 function _getRenderedMatches(matches) {
@@ -4803,56 +3145,817 @@ function fromJSON(source, options = {}) {
 		disabledFeatures
 	}), source.t);
 }
-/** Create a Seroval plugin for client/server symmetric (de)serialization. */
-/* @__NO_SIDE_EFFECTS__ */
-function makeSerovalPlugin(serializationAdapter) {
-	return /* @__PURE__ */ createPlugin({
-		tag: "$TSR/t/" + serializationAdapter.key,
-		test: serializationAdapter.test,
-		parse: {
-			sync(value, ctx) {
-				return { v: ctx.parse(serializationAdapter.toSerializable(value)) };
-			},
-			async async(value, ctx) {
-				return { v: await ctx.parse(serializationAdapter.toSerializable(value)) };
-			},
-			stream(value, ctx) {
-				return { v: ctx.parse(serializationAdapter.toSerializable(value)) };
-			}
-		},
-		serialize: void 0,
-		deserialize(node, ctx) {
-			return serializationAdapter.fromSerializable(ctx.deserialize(node.v));
+/** Create a Seroval plugin for client/server symmetric (de)serialization. */
+/* @__NO_SIDE_EFFECTS__ */
+function makeSerovalPlugin(serializationAdapter) {
+	return /* @__PURE__ */ createPlugin({
+		tag: "$TSR/t/" + serializationAdapter.key,
+		test: serializationAdapter.test,
+		parse: {
+			sync(value, ctx) {
+				return { v: ctx.parse(serializationAdapter.toSerializable(value)) };
+			},
+			async async(value, ctx) {
+				return { v: await ctx.parse(serializationAdapter.toSerializable(value)) };
+			},
+			stream(value, ctx) {
+				return { v: ctx.parse(serializationAdapter.toSerializable(value)) };
+			}
+		},
+		serialize: void 0,
+		deserialize(node, ctx) {
+			return serializationAdapter.fromSerializable(ctx.deserialize(node.v));
+		}
+	});
+}
+/**
+* Marker class for ReadableStream<Uint8Array> that should be serialized
+* with base64/text encoding (JSON and SSR) or binary framing
+* (server-function responses).
+*
+* Wrap your binary streams with this to get efficient serialization:
+* ```ts
+* // For binary data (files, images, etc.)
+* return { data: new RawStream(file.stream()) }
+*
+* // For text-heavy data (RSC payloads, etc.)
+* return { data: new RawStream(rscStream, { hint: 'text' }) }
+* ```
+*
+* RawStreams returned from one server function share one ordered response.
+* Arbitrary or sequential consumption can require potentially unbounded client
+* buffering for unread data. Cancelling one RawStream discards it locally;
+* abort the whole server-function call to cancel the response and server work.
+* Consume streams concurrently, cancel unused streams promptly, or use separate
+* calls when independent backpressure is required.
+*/
+var RawStream = class {
+	constructor(stream, options) {
+		this.stream = stream;
+		this.hint = options?.hint ?? "binary";
+	}
+};
+var GLOBAL_EVENT_STORAGE_KEY = Symbol.for("tanstack-start:event-storage");
+var globalObj = globalThis;
+if (!globalObj[GLOBAL_EVENT_STORAGE_KEY]) globalObj[GLOBAL_EVENT_STORAGE_KEY] = new AsyncLocalStorage();
+var eventStorage = globalObj[GLOBAL_EVENT_STORAGE_KEY];
+var PROTECTED_RESPONSE_HEADERS = Symbol.for("tanstack-start:protected-response-headers");
+function getProtectedResponseHeaders(response) {
+	return response[PROTECTED_RESPONSE_HEADERS];
+}
+function installProtectedResponseHeaders(response, headers) {
+	Object.defineProperty(response, PROTECTED_RESPONSE_HEADERS, {
+		value: headers,
+		configurable: true
+	});
+}
+/** Transport requirements belong to the encoded body, not its wrapper. */
+function transferResponseProtocol(source, target) {
+	const protectedHeaders = getProtectedResponseHeaders(source);
+	if (protectedHeaders && getProtectedResponseHeaders(target) !== protectedHeaders) installProtectedResponseHeaders(target, protectedHeaders);
+}
+/** Preserve metadata when Start reconstructs an existing response. */
+function transferResponseMetadata(source, target) {
+	transferResponseProtocol(source, target);
+	const event = eventStorage.getStore();
+	const appliedHeaderAppends = event?.responseHeaderAppends?.get(source);
+	if (appliedHeaderAppends) event.responseHeaderAppends.set(target, appliedHeaderAppends);
+}
+function normalizeHeaderName(name) {
+	return name.toLowerCase();
+}
+function sanitizeStatusMessage(statusMessage) {
+	return statusMessage.replace(/[^\t\x20-\x7e]/g, "");
+}
+function sanitizeStatusCode(statusCode) {
+	const code = typeof statusCode === "string" ? Number(statusCode) : statusCode;
+	if (code === void 0 || !Number.isInteger(code) || code < 200 || code > 599) return;
+	return code;
+}
+function getObjectProperty(value, key) {
+	if (typeof value === "object" && value || typeof value === "function") return value[key];
+}
+function getStatusCodeProperty(value, key) {
+	const property = getObjectProperty(value, key);
+	if (typeof property === "string" || typeof property === "number") return property;
+}
+function getErrorStatus(error) {
+	const cause = getObjectProperty(error, "cause");
+	return sanitizeStatusCode(getStatusCodeProperty(error, "status") ?? getStatusCodeProperty(error, "statusCode") ?? getStatusCodeProperty(cause, "status") ?? getStatusCodeProperty(cause, "statusCode"));
+}
+function getErrorStatusText(error) {
+	const cause = getObjectProperty(error, "cause");
+	const statusText = getObjectProperty(error, "statusText") ?? getObjectProperty(error, "statusMessage") ?? getObjectProperty(cause, "statusText") ?? getObjectProperty(cause, "statusMessage");
+	if (typeof statusText === "string") return sanitizeStatusMessage(statusText);
+}
+var GENERATED_BODY_EXCLUDED_HEADERS = /* @__PURE__ */ new Set([
+	"connection",
+	"content-encoding",
+	"content-length",
+	"keep-alive",
+	"proxy-connection",
+	"te",
+	"trailer",
+	"transfer-encoding"
+]);
+function isResponse(value) {
+	return value instanceof Response || Object.prototype.toString.call(value) === "[object Response]";
+}
+function getErrorHeaders(error) {
+	let init = getObjectProperty(error, "headers");
+	if (!init) {
+		const cause = getObjectProperty(error, "cause");
+		if (isResponse(cause)) return;
+		init = getObjectProperty(cause, "headers");
+	}
+	if (!init) return;
+	let headers;
+	try {
+		headers = new Headers(init);
+	} catch {
+		return;
+	}
+	for (const name of GENERATED_BODY_EXCLUDED_HEADERS) headers.delete(name);
+	return headers;
+}
+function getResponseState(event) {
+	return event.responseState ||= {
+		headers: new Headers(),
+		clearHeaders: false
+	};
+}
+function setHeaderState(event, name, value) {
+	const state = getResponseState(event);
+	const normalizedName = normalizeHeaderName(name);
+	state.headers.set(name, value);
+	state.headerAppends?.delete(normalizedName);
+	state.removedHeaders?.delete(normalizedName);
+	if (normalizedName === "set-cookie") state.setCookieBehavior = "replace";
+}
+function appendHeaderState(event, name, value) {
+	const state = getResponseState(event);
+	const normalizedName = normalizeHeaderName(name);
+	const appendToReturnedHeader = normalizedName !== "set-cookie" && !state.clearHeaders && !state.removedHeaders?.has(normalizedName) && (!state.headers.has(normalizedName) || state.headerAppends?.has(normalizedName));
+	state.headers.append(name, value);
+	if (appendToReturnedHeader) {
+		const appends = state.headerAppends ||= /* @__PURE__ */ new Map();
+		appends.set(normalizedName, {
+			value,
+			previous: appends.get(normalizedName)
+		});
+	}
+	state.removedHeaders?.delete(normalizedName);
+	if (normalizedName === "set-cookie" && state.setCookieBehavior !== "replace") state.setCookieBehavior = "merge";
+}
+function deleteHeaderState(event, name) {
+	const state = getResponseState(event);
+	const normalizedName = normalizeHeaderName(name);
+	state.headers.delete(name);
+	state.headerAppends?.delete(normalizedName);
+	(state.removedHeaders ||= /* @__PURE__ */ new Set()).add(normalizedName);
+	if (normalizedName === "set-cookie") state.setCookieBehavior = "replace";
+}
+function getDistinctCookieKey(name, options, defaultPath = "") {
+	return [
+		name,
+		options.domain || "",
+		options.path ?? defaultPath
+	].join(";");
+}
+function getDistinctCookieKeyFromHeader(cookie) {
+	const parsed = parseSetCookie(cookie);
+	return parsed ? getDistinctCookieKey(parsed.name, parsed) : `\0${cookie}`;
+}
+function replaceSetCookieValues(headers, cookies) {
+	headers.delete("set-cookie");
+	for (const cookie of cookies) headers.append("set-cookie", cookie);
+}
+function getCookieKey(state, cookie) {
+	const keys = state.setCookieKeys ||= /* @__PURE__ */ new Map();
+	let key = keys.get(cookie);
+	if (key === void 0) {
+		key = getDistinctCookieKeyFromHeader(cookie);
+		keys.set(cookie, key);
+	}
+	return key;
+}
+function getMergedSetCookieValues(state, currentCookies, cookiesToMerge) {
+	if (currentCookies.length === 0) return cookiesToMerge;
+	const cookieKeysToMerge = /* @__PURE__ */ new Set();
+	for (const cookie of cookiesToMerge) cookieKeysToMerge.add(getCookieKey(state, cookie));
+	return currentCookies.filter((cookie) => !cookieKeysToMerge.has(getCookieKey(state, cookie))).concat(cookiesToMerge);
+}
+function mergeStartSetCookieValues(event, cookies) {
+	if (cookies.length === 0) return;
+	const state = getResponseState(event);
+	state.removedHeaders?.delete("set-cookie");
+	if (state.setCookieBehavior !== "replace") state.setCookieBehavior = "merge";
+	replaceSetCookieValues(state.headers, getMergedSetCookieValues(state, getSetCookieValues(state.headers), cookies));
+}
+function hasProtectedHeaderChanges(response, protectedHeaders) {
+	const headers = response.headers;
+	for (const [name, value] of protectedHeaders) if (headers.get(name) !== value) return true;
+	return false;
+}
+function applyProtectedHeaders(protectedHeaders, headers) {
+	for (const [name, value] of protectedHeaders) if (value === null) headers.delete(name);
+	else headers.set(name, value);
+}
+function applyHeaderState(target, state, generatedBody, protectedHeaders, appliedHeaderAppends) {
+	let headers = target;
+	const mutableHeaders = () => {
+		if (headers === target) headers = new Headers(target);
+		return headers;
+	};
+	if (state.clearHeaders) {
+		for (const name of Array.from(target.keys())) if (!protectedHeaders?.has(name)) mutableHeaders().delete(name);
+	}
+	if (!state.clearHeaders && state.removedHeaders) {
+		for (const name of state.removedHeaders) if (!protectedHeaders?.has(name) && headers.has(name)) mutableHeaders().delete(name);
+	}
+	for (const [name, value] of state.headers) if (name !== "set-cookie" && !protectedHeaders?.has(name) && !(generatedBody && GENERATED_BODY_EXCLUDED_HEADERS.has(name))) {
+		let append = state.headerAppends?.get(name);
+		if (!append) {
+			if (headers.get(name) !== value) mutableHeaders().set(name, value);
+			continue;
+		}
+		const applied = appliedHeaderAppends?.get(name);
+		const pending = [];
+		while (append && append !== applied) {
+			pending.push(append.value);
+			append = append.previous;
+		}
+		for (let index = pending.length - 1; index >= 0; index--) mutableHeaders().append(name, pending[index]);
+	}
+	if (state.setCookieBehavior && !protectedHeaders?.has("set-cookie")) {
+		const eventSetCookies = getSetCookieValues(state.headers);
+		const currentCookies = getSetCookieValues(headers);
+		const cookies = state.setCookieBehavior === "replace" ? eventSetCookies : getMergedSetCookieValues(state, currentCookies, eventSetCookies);
+		if (cookies.length !== currentCookies.length || cookies.some((cookie, index) => cookie !== currentCookies[index])) replaceSetCookieValues(mutableHeaders(), cookies);
+	}
+	return headers;
+}
+function canHaveBody(method, status) {
+	return method !== "HEAD" && status !== 204 && status !== 205 && status !== 304;
+}
+/** A protected content type marks a Start-serialized body the client decodes. */
+function isSerializedResponse(protectedHeaders) {
+	return typeof protectedHeaders?.get("content-type") === "string";
+}
+/**
+* A helper status that forbids a body never applies to a serialized
+* server-function reply, because the client must decode it. Only a HEAD request
+* drops its body.
+*/
+function getHelperStatus(state, serialized) {
+	const status = state?.status;
+	if (!serialized || status === void 0 || canHaveBody("GET", status)) return status;
+}
+/** Helper status text describes the helper status and is ignored with it. */
+function getHelperStatusText(state, helperStatus) {
+	return helperStatus === state?.status ? state?.statusText : void 0;
+}
+function cancelDroppedBody(response, reason) {
+	try {
+		response.body?.cancel(reason).catch(() => {});
+	} catch {}
+}
+function createReconciledResponse(body, status, statusText, headers) {
+	try {
+		return new Response(body, {
+			status,
+			statusText,
+			headers
+		});
+	} catch (cause) {
+		throw new Error("Unable to reconcile response because its body has already been consumed or locked.", { cause });
+	}
+}
+/** Apply helper state to a response that leaves Start. */
+function finalizeResponse(response, event) {
+	return applyResponseState(response, event, event.request.method);
+}
+/**
+* Apply helper state with the body rules of `method`. Request middleware still
+* reads a HEAD response's body, so the pipeline applies GET rules and strips a
+* HEAD body only when the response leaves it.
+*/
+function applyResponseState(response, event, method, disposeBody) {
+	const protectedHeaders = getProtectedResponseHeaders(response);
+	const serialized = isSerializedResponse(protectedHeaders);
+	let helperStatus = getHelperStatus(event.responseState, serialized);
+	const mustDropBody = !canHaveBody(method, helperStatus ?? response.status) && response.body !== null;
+	if (mustDropBody) {
+		const reason = method === "HEAD" ? "HEAD body stripped" : "Response body dropped by Start reconciliation";
+		if (disposeBody) disposeBody(reason);
+		else cancelDroppedBody(response, reason);
+		helperStatus = getHelperStatus(event.responseState, serialized);
+	}
+	const state = event.responseState;
+	if (!state && !mustDropBody) {
+		event.currentResponse = response;
+		return response;
+	}
+	const status = helperStatus ?? response.status;
+	const statusText = getHelperStatusText(state, helperStatus) ?? response.statusText;
+	const statusChanged = status !== response.status;
+	const statusTextChanged = statusText !== response.statusText;
+	const headers = state ? applyHeaderState(response.headers, state, serialized, protectedHeaders, event.responseHeaderAppends?.get(response)) : response.headers;
+	const reconciled = statusChanged || statusTextChanged || mustDropBody || headers !== response.headers ? createReconciledResponse(mustDropBody ? null : response.body, status, statusText, headers) : response;
+	if (protectedHeaders && reconciled !== response) installProtectedResponseHeaders(reconciled, protectedHeaders);
+	return publishResponse(reconciled, event);
+}
+function publishResponse(response, event) {
+	const headerAppends = event.responseState?.headerAppends;
+	if (headerAppends?.size) (event.responseHeaderAppends ||= /* @__PURE__ */ new WeakMap()).set(response, new Map(headerAppends));
+	event.currentResponse = response;
+	return response;
+}
+function getHttpErrorStatus(status) {
+	return status !== void 0 && status >= 400 ? status : void 0;
+}
+/**
+* Status for a response built from an uncaught error. Only an error status
+* (400-599) from a helper or from error metadata describes the failure, so a
+* success or redirect status set before the throw cannot hide it. The error is
+* logged unless its own metadata marks it as an HTTP error. Reporting runs
+* before helper state is read, so hooks that write helpers are included.
+*/
+function resolveErrorStatus(error, event) {
+	const metadataStatus = getErrorStatus(error);
+	const errorStatus = getHttpErrorStatus(metadataStatus);
+	if (errorStatus === void 0) console.error(error);
+	const state = event?.responseState;
+	const helperStatus = getHttpErrorStatus(state?.status);
+	const status = helperStatus ?? errorStatus ?? 500;
+	const statusText = getHelperStatusText(state, helperStatus) ?? (status === errorStatus || metadataStatus === void 0 ? getErrorStatusText(error) : void 0) ?? "";
+	if (state && state.status !== helperStatus) {
+		state.status = void 0;
+		state.statusText = void 0;
+	}
+	return {
+		status,
+		statusText
+	};
+}
+/**
+* Internal: status and status text for a serialized server-function error.
+* Logs the error and discards a non-error helper status, like any error
+* response Start builds.
+*/
+function resolveErrorResponseStatus(error) {
+	return resolveErrorStatus(error, eventStorage.getStore());
+}
+function createErrorResponse(error, event) {
+	let headers = getErrorHeaders(error) ?? new Headers();
+	const { status, statusText } = resolveErrorStatus(error, event);
+	const state = event.responseState;
+	const body = canHaveBody(event.request.method, status) ? JSON.stringify({
+		status,
+		statusText,
+		unhandled: true,
+		message: "HTTPError"
+	}) : null;
+	if (!headers.has("content-type")) headers.set("content-type", "application/json");
+	if (state) headers = applyHeaderState(headers, state, true);
+	return publishResponse(new Response(body !== null && !headers.has("content-type") ? new TextEncoder().encode(body) : body, {
+		status,
+		statusText,
+		headers
+	}), event);
+}
+function finalizeError(error, event) {
+	if (error instanceof Response) return finalizeResponse(error, event);
+	return createErrorResponse(error, event);
+}
+function handleStartError(error) {
+	const event = eventStorage.getStore();
+	if (event) return finalizeError(error, event);
+	if (error instanceof Response) return error;
+	const request = new Request("http://localhost");
+	return createErrorResponse(error, {
+		request,
+		requestUrl: new URL(request.url)
+	});
+}
+/** Apply helper state to a response inside the request middleware pipeline. */
+function reconcileResponse(response, event, disposeBody) {
+	if (!event.responseState && (response === event.currentResponse || canHaveBody("GET", response.status)) || isRedirect(response)) {
+		event.currentResponse = response;
+		return response;
+	}
+	return applyResponseState(response, event, "GET", disposeBody);
+}
+/**
+* Restore protocol headers that middleware changed directly on the response.
+* Start does this once, when the response leaves the request middleware
+* pipeline; helper writes never override them.
+*/
+function restoreResponseProtocol(response, event) {
+	const protectedHeaders = getProtectedResponseHeaders(response);
+	if (!protectedHeaders || !hasProtectedHeaderChanges(response, protectedHeaders)) return response;
+	const headers = new Headers(response.headers);
+	applyProtectedHeaders(protectedHeaders, headers);
+	const restored = createReconciledResponse(response.body, response.status, response.statusText, headers);
+	transferResponseMetadata(response, restored);
+	event.currentResponse = restored;
+	return restored;
+}
+/**
+* Build a Start-owned serialized reply with already normalized protocol
+* headers. A bodyless helper status never applies to it; only a HEAD request
+* drops its body.
+*/
+function createFinalizedResponse(body, headers, protectedHeaders, event) {
+	const state = event.responseState;
+	let status = 200;
+	let statusText = "";
+	if (state) {
+		const helperStatus = getHelperStatus(state, true);
+		status = helperStatus ?? 200;
+		statusText = getHelperStatusText(state, helperStatus) ?? "";
+		headers = applyHeaderState(headers, state, true, protectedHeaders);
+	}
+	const response = new Response(canHaveBody(event.request.method, status) ? body : null, {
+		status,
+		statusText,
+		headers
+	});
+	installProtectedResponseHeaders(response, protectedHeaders);
+	return publishResponse(response, event);
+}
+function protectResponseHeaders(response, headers) {
+	const previous = getProtectedResponseHeaders(response);
+	if (previous === headers) return;
+	if (previous) {
+		const merged = new Map(previous);
+		for (const [name, value] of headers) merged.set(name, value);
+		headers = merged;
+	}
+	installProtectedResponseHeaders(response, headers);
+}
+/**
+* Set and protect transport headers on a new response. Reuse the body stream
+* without cloning or teeing it; callers transfer ownership to the result.
+*/
+function setProtectedResponseHeaders(response, headers) {
+	let next;
+	try {
+		next = new Response(response.body, response);
+		applyProtectedHeaders(headers, next.headers);
+	} catch (cause) {
+		throw new Error("Unable to set response header because its body has already been consumed or locked.", { cause });
+	}
+	transferResponseMetadata(response, next);
+	protectResponseHeaders(next, headers);
+	return next;
+}
+function decodePathname(pathname) {
+	try {
+		return decodeURI(pathname);
+	} catch (error) {
+		if (error instanceof URIError) return;
+		throw error;
+	}
+}
+function runInStartRequest(request, requestOpts, handler) {
+	let requestUrl;
+	try {
+		requestUrl = new URL(request.url);
+	} catch (error) {
+		if (error instanceof TypeError) return new Response(null, {
+			status: 400,
+			statusText: "Bad Request"
+		});
+		throw error;
+	}
+	const pathname = requestUrl.pathname;
+	if (pathname.includes("%") && decodePathname(pathname) === void 0) return new Response(null, {
+		status: 400,
+		statusText: "Bad Request"
+	});
+	const event = {
+		request,
+		requestUrl
+	};
+	return eventStorage.run(event, handler, request, requestOpts, event);
+}
+/**
+* Keep the complete server entry, including custom error handling, inside one
+* request scope. A custom returned response is used as-is; call handleStartError
+* in a custom catch to preserve Start's response helper state.
+*/
+function createServerEntry(entry) {
+	return { fetch: withStartRequest(async (request, requestOpts) => {
+		try {
+			return await entry.fetch(request, requestOpts);
+		} catch (error) {
+			return handleStartError(error);
+		}
+	}) };
+}
+/**
+* Establish request scope; the response pipeline owns reconciliation. A nested
+* handler delegating the same request participates in its scope. Independent
+* fetch invocations and different requests get a fresh event.
+*/
+function withStartRequest(handler) {
+	return (request, requestOpts) => {
+		const event = eventStorage.getStore();
+		if (event?.request === request) return handler(request, requestOpts, event);
+		return runInStartRequest(request, requestOpts, handler);
+	};
+}
+function getStartEvent() {
+	const event = eventStorage.getStore();
+	if (!event) throw new Error(`No StartEvent found in AsyncLocalStorage. Make sure you are using the function within the server runtime.`);
+	return event;
+}
+/**
+* Internal: returns the per-request parsed URL for `request`, memoized on the
+* Start event so the framework parses each request URL only once. Falls back
+* to parsing when called outside a Start event (e.g. in unit tests) or for a
+* foreign request. Callers MUST NOT mutate the returned URL.
+*/
+function getParsedRequestUrl(request) {
+	const event = eventStorage.getStore();
+	if (event && event.request === request) return event.requestUrl;
+	return new URL(request.url);
+}
+function getRequest() {
+	return getStartEvent().request;
+}
+function getRequestHeaders$1() {
+	return getStartEvent().request.headers;
+}
+function getRequestHeader(name) {
+	return getRequestHeaders$1().get(name) ?? void 0;
+}
+function getRequestIP(opts) {
+	const request = getRequest();
+	if (opts?.xForwardedFor) {
+		const forwardedIp = request.headers.get("x-forwarded-for")?.split(",", 1)[0]?.trim();
+		if (forwardedIp) return forwardedIp;
+	}
+	return request.context?.clientAddress || request.ip || void 0;
+}
+/**
+* Get the request hostname.
+*
+* If `xForwardedHost` is `true`, it will use the `x-forwarded-host` header if it exists.
+*
+* If no host header is found, it uses the request URL's host.
+*/
+function getRequestHost(opts) {
+	const headers = getRequestHeaders$1();
+	if (opts?.xForwardedHost) {
+		const host = headers.get("x-forwarded-host")?.split(",", 1)[0]?.trim();
+		if (host) return host;
+	}
+	return headers.get("host") || getStartEvent().requestUrl.host || "localhost";
+}
+/**
+* Get the full incoming request URL.
+*
+* If `xForwardedHost` is `true`, it will use the `x-forwarded-host` header if it exists.
+*
+* If `xForwardedProto` is `false`, it will not use the `x-forwarded-proto` header.
+*/
+function getRequestUrl(opts) {
+	const event = getStartEvent();
+	const url = new URL(event.requestUrl);
+	url.protocol = getRequestProtocol(opts);
+	if (opts?.xForwardedHost) {
+		const host = getRequestHost(opts);
+		if (host) {
+			url.host = host;
+			if (!/:\d+$/.test(host)) url.port = "";
+		}
+	}
+	return url;
+}
+/**
+* Get the request protocol.
+*
+* If `x-forwarded-proto` header is set to "https", it will return "https". You can disable this behavior by setting `xForwardedProto` to `false`.
+*
+* If protocol cannot be determined, it will default to "http".
+*/
+function getRequestProtocol(opts) {
+	const request = getRequest();
+	if (opts?.xForwardedProto !== false) {
+		const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",", 1)[0]?.trim().toLowerCase();
+		if (forwardedProto === "https") return "https";
+		if (forwardedProto === "http") return "http";
+	}
+	return getStartEvent().requestUrl.protocol.slice(0, -1);
+}
+function setResponseHeaders(headers) {
+	if (headers instanceof Headers) {
+		for (const [name, value] of headers) if (name !== "set-cookie") setResponseHeader(name, value);
+		const cookies = getSetCookieValues(headers);
+		if (cookies.length > 0) setResponseHeader("set-cookie", cookies.length === 1 ? cookies[0] : cookies);
+		return;
+	}
+	if (!Array.isArray(headers)) {
+		for (const [name, value] of Object.entries(headers)) setResponseHeader(name, value);
+		return;
+	}
+	const groupedHeaders = /* @__PURE__ */ new Map();
+	const addHeader = (name, value) => {
+		const normalizedName = normalizeHeaderName(name);
+		let header = groupedHeaders.get(normalizedName);
+		if (!header) {
+			header = {
+				name,
+				values: []
+			};
+			groupedHeaders.set(normalizedName, header);
 		}
-	});
+		header.values.push(value);
+	};
+	for (const [name, value] of headers) addHeader(name, value);
+	for (const { name, values } of groupedHeaders.values()) setResponseHeader(name, values.length === 1 ? values[0] : values);
 }
 /**
-* Marker class for ReadableStream<Uint8Array> that should be serialized
-* with base64/text encoding (JSON and SSR) or binary framing
-* (server-function responses).
+* Outside production, return the snapshot as a Headers subclass that warns when
+* code tries to change the outgoing response through it. Its contents and
+* behavior are identical to the production snapshot.
+*/
+function toResponseHeadersSnapshot(headers) {
+	return headers;
+}
+/**
+* Read a detached snapshot of the effective response headers.
+* Use response header and cookie helpers to change the outgoing response.
+*/
+function getResponseHeaders() {
+	const event = getStartEvent();
+	const state = event.responseState;
+	const currentResponse = event.currentResponse;
+	if (!currentResponse) return toResponseHeadersSnapshot(state ? new Headers(state.headers) : new Headers());
+	const protectedHeaders = getProtectedResponseHeaders(currentResponse);
+	let headers = currentResponse.headers;
+	if (state) headers = applyHeaderState(headers, state, isSerializedResponse(protectedHeaders), protectedHeaders, event.responseHeaderAppends?.get(currentResponse));
+	if (headers === currentResponse.headers) headers = new Headers(headers);
+	if (protectedHeaders) applyProtectedHeaders(protectedHeaders, headers);
+	return toResponseHeadersSnapshot(headers);
+}
+function getResponseHeader(name) {
+	const event = getStartEvent();
+	const normalizedName = normalizeHeaderName(name);
+	if (normalizedName === "set-cookie" || event.responseState?.headerAppends?.has(normalizedName)) return getResponseHeaders().get(name) ?? void 0;
+	const currentResponse = event.currentResponse;
+	const protectedHeaders = currentResponse ? getProtectedResponseHeaders(currentResponse) : void 0;
+	if (protectedHeaders?.has(normalizedName)) return protectedHeaders.get(normalizedName) ?? void 0;
+	if (GENERATED_BODY_EXCLUDED_HEADERS.has(normalizedName) && isSerializedResponse(protectedHeaders)) return currentResponse.headers.get(name) ?? void 0;
+	const state = event.responseState;
+	if (state) {
+		const stateValue = state.headers.get(name);
+		if (stateValue !== null) return stateValue;
+		if (state.clearHeaders) return;
+		if (state.removedHeaders?.has(normalizedName)) return;
+	}
+	return currentResponse?.headers.get(name) ?? void 0;
+}
+function setResponseHeader(name, value) {
+	const event = getStartEvent();
+	if (Array.isArray(value)) {
+		deleteHeaderState(event, name);
+		for (const valueItem of value) appendHeaderState(event, name, valueItem);
+	} else setHeaderState(event, name, value);
+}
+/**
+* Append a response header value without replacing existing values.
 *
-* Wrap your binary streams with this to get efficient serialization:
-* ```ts
-* // For binary data (files, images, etc.)
-* return { data: new RawStream(file.stream()) }
+* Ordinary values are appended once per returned response. Start transfers
+* that application state when it reconstructs a response. A new response
+* created by application code is fresh input: copying already-reconciled
+* headers into it also copies their appended values, and helper appends apply
+* again. Mutate the current response or pass its middleware result through
+* when preserving an existing response's headers.
 *
-* // For text-heavy data (RSC payloads, etc.)
-* return { data: new RawStream(rscStream, { hint: 'text' }) }
-* ```
+* For `set-cookie`, values must be fully serialized cookie strings; they are
+* merged into the outgoing cookies and deduped by cookie identity
+* (name + domain + path), exactly like `setCookie`. A value that cannot be
+* parsed is identified by its exact string. This is the primitive to
+* use when bridging external session/auth libraries that produce raw
+* `Set-Cookie` strings.
 *
-* RawStreams returned from one server function share one ordered response.
-* Arbitrary or sequential consumption can require potentially unbounded client
-* buffering for unread data. Cancelling one RawStream discards it locally;
-* abort the whole server-function call to cancel the response and server work.
-* Consume streams concurrently, cancel unused streams promptly, or use separate
-* calls when independent backpressure is required.
+* ```ts
+* appendResponseHeader('set-cookie', await externalLib.commitSession(session))
+* ```
 */
-var RawStream = class {
-	constructor(stream, options) {
-		this.stream = stream;
-		this.hint = options?.hint ?? "binary";
+function appendResponseHeader(name, value) {
+	const event = getStartEvent();
+	const values = Array.isArray(value) ? value : [value];
+	if (normalizeHeaderName(name) === "set-cookie") {
+		for (const valueItem of values) mergeStartSetCookieValues(event, getSetCookieValues(new Headers({ "set-cookie": valueItem })));
+		return;
 	}
-};
+	for (const valueItem of values) appendHeaderState(event, name, valueItem);
+}
+function removeResponseHeader(name) {
+	deleteHeaderState(getStartEvent(), name);
+}
+function clearResponseHeaders(headerNames) {
+	const event = getStartEvent();
+	if (headerNames && headerNames.length > 0) {
+		for (const name of headerNames) deleteHeaderState(event, name);
+		return;
+	}
+	const state = getResponseState(event);
+	state.clearHeaders = true;
+	state.headers = new Headers();
+	state.headerAppends = void 0;
+}
+function getResponseStatus() {
+	const event = getStartEvent();
+	const currentResponse = event.currentResponse;
+	const serialized = !!currentResponse && isSerializedResponse(getProtectedResponseHeaders(currentResponse));
+	return getHelperStatus(event.responseState, serialized) ?? currentResponse?.status ?? 200;
+}
+function setResponseStatus(code, text) {
+	const event = getStartEvent();
+	if (code !== void 0) {
+		const status = sanitizeStatusCode(code);
+		if (status === void 0) return;
+		getResponseState(event).status = status;
+	}
+	if (text) getResponseState(event).statusText = sanitizeStatusMessage(text);
+}
+/**
+* Parse the request to get HTTP Cookie header string and return an object of all cookie name-value pairs.
+* @returns Object of cookie name-value pairs
+* ```ts
+* const cookies = getCookies()
+* ```
+*/
+function getCookies() {
+	const cookies = parse(getRequestHeaders$1().get("cookie") || "");
+	const definedCookies = Object.create(null);
+	for (const [name, value] of Object.entries(cookies)) if (value !== void 0) definedCookies[name] = value;
+	return definedCookies;
+}
+/**
+* Get a cookie value by name.
+* @param name Name of the cookie to get
+* @returns {*} Value of the cookie (String or undefined)
+* ```ts
+* const authorization = getCookie('Authorization')
+* ```
+*/
+function getCookie(name) {
+	return getCookies()[name];
+}
+/**
+* Set a cookie value by name.
+* @param name Name of the cookie to set
+* @param value Value of the cookie to set
+* @param options {CookieSerializeOptions} Options for serializing the cookie
+* ```ts
+* setCookie('Authorization', '1234567')
+* ```
+*/
+function setCookie(name, value, options) {
+	const { encode, stringify, ...attrs } = options ?? {};
+	mergeStartSetCookieValues(getStartEvent(), [serialize({
+		name,
+		value,
+		path: "/",
+		...attrs
+	}, {
+		encode,
+		stringify
+	})]);
+}
+/**
+* Remove a cookie by name.
+* @param name Name of the cookie to delete
+* @param serializeOptions {CookieSerializeOptions} Cookie options
+* ```ts
+* deleteCookie('SessionId')
+* ```
+*/
+function deleteCookie(name, options) {
+	setCookie(name, "", {
+		...options,
+		maxAge: 0
+	});
+}
+/**
+* Internal: helper status state for a serialized server-function reply.
+* Bodyless statuses never apply to it and are omitted with their status text.
+*/
+function getSerializedResponseState() {
+	const state = getStartEvent().responseState;
+	const status = getHelperStatus(state, true);
+	return {
+		status,
+		statusText: getHelperStatusText(state, status)
+	};
+}
+var HEADERS = { TSS_SHELL: "X-TSS_SHELL" };
 /**
 * @description Returns the router manifest data that should be sent to the client.
 * This includes only the assets and preloads for the current route and any
@@ -4863,7 +3966,7 @@ var RawStream = class {
 * the dev styles URL for route-scoped CSS collection.
 */
 async function getStartManifest(matchedRoutes) {
-	const { tsrStartManifest } = await import("../_tanstack-start-manifest_v-DaM-WBL0.mjs");
+	const { tsrStartManifest } = await import("../_tanstack-start-manifest_v-DTOQk1l4.mjs");
 	const startManifest = tsrStartManifest();
 	let routes = startManifest.routes;
 	routes[rootRouteId];
@@ -5223,7 +4326,7 @@ function getSerovalPlugins(routerPlugins) {
 /** Cached TextEncoder for frame encoding */
 var textEncoder$2 = new TextEncoder();
 /** Shared empty payload for END frames - avoids allocation per call */
-var EMPTY_PAYLOAD = new Uint8Array(0);
+var EMPTY_PAYLOAD = /* @__PURE__ */ new Uint8Array(0);
 var MAX_ERROR_MESSAGE_CODE_UNITS = 4096;
 /**
 * Encodes a single frame with header and payload.
@@ -5409,19 +4512,33 @@ function createMultiplexedStream(recordStream, options = {}) {
 	});
 }
 var innerCreateCsrfMiddleware = (opts = {}) => {
-	return createMiddleware().server(async (ctx) => {
+	const continueRequest = (result, ctx) => {
+		return isValidationResultAllowed(result, opts) ? ctx.next() : getFailureResponse(opts, ctx);
+	};
+	const validateRequest = (ctx) => {
+		const result = validateCsrfRequest(opts, ctx);
+		if (isPromise(result)) return result.then((result) => continueRequest(result, ctx));
+		return continueRequest(result, ctx);
+	};
+	return createMiddleware().server((ctx) => {
 		const csrfCtx = ctx;
-		if (opts.filter && !await opts.filter(csrfCtx)) return ctx.next();
-		if (await isCsrfRequestAllowed(opts, csrfCtx)) return ctx.next();
-		return getFailureResponse(opts, csrfCtx);
+		try {
+			if (opts.filter) {
+				const shouldValidate = opts.filter(csrfCtx);
+				if (isPromise(shouldValidate)) return shouldValidate.then((shouldValidate) => shouldValidate ? validateRequest(csrfCtx) : ctx.next());
+				if (!shouldValidate) return ctx.next();
+			}
+			return validateRequest(csrfCtx);
+		} catch (error) {
+			return Promise.reject(error);
+		}
 	});
 };
 var createCsrfMiddleware = innerCreateCsrfMiddleware;
-async function isCsrfRequestAllowed(opts, ctx) {
-	const result = await getCsrfRequestValidationResult(opts, ctx);
+function isValidationResultAllowed(result, opts) {
 	return result === true || result === void 0 && opts.allowRequestsWithoutOriginCheck === true;
 }
-async function getCsrfRequestValidationResult(opts, ctx) {
+function validateCsrfRequest(opts, ctx) {
 	const fetchSite = ctx.request.headers.get("Sec-Fetch-Site");
 	if (fetchSite !== null) return matchValue(opts.secFetchSite ?? "same-origin", fetchSite, ctx);
 	const origin = ctx.request.headers.get("Origin");
@@ -5438,7 +4555,7 @@ async function getCsrfRequestValidationResult(opts, ctx) {
 	}
 	return isRefererSameOrigin(referer, new URL(ctx.request.url).origin);
 }
-async function matchValue(matcher, value, ctx) {
+function matchValue(matcher, value, ctx) {
 	if (typeof matcher === "function") return matcher(value, ctx);
 	if (Array.isArray(matcher)) return matcher.includes(value);
 	return value === matcher;
@@ -5457,7 +4574,7 @@ function isRefererSameOrigin(referer, requestOrigin) {
 	const code = referer.charCodeAt(requestOrigin.length);
 	return code === 47 || code === 63 || code === 35;
 }
-async function getFailureResponse(opts, ctx) {
+function getFailureResponse(opts, ctx) {
 	if (typeof opts.failureResponse === "function") return opts.failureResponse(ctx);
 	return opts.failureResponse?.clone() ?? new Response("Forbidden", { status: 403 });
 }
@@ -5555,12 +4672,12 @@ function getExactBytesPrefixAtEnd(value, pattern, startIndex = 0) {
 }
 var encoder = new TextEncoder();
 var SOURCE_SEPARATOR = ";";
-var MAX_INITIAL_SOURCE_CODE_UNITS = 16 * 1024;
-var MAX_BACKLOG_CODE_UNITS = 16 * 1024 * 1024;
+var MAX_INITIAL_SOURCE_CODE_UNITS = 16384;
+var MAX_BACKLOG_CODE_UNITS = 16777216;
 var MAX_BACKLOG_SOURCES = 4096;
 var MIN_OUTPUT_BYTES = 256;
-var MAX_DIRECT_CODE_UNITS = 16 * 1024;
-var MAX_HYDRATION_OUTPUT_CHUNK_BYTES = 64 * 1024;
+var MAX_DIRECT_CODE_UNITS = 16384;
+var MAX_HYDRATION_OUTPUT_CHUNK_BYTES = 65536;
 var MAX_DYNAMIC_RECORD_CODE_UNITS = MAX_HYDRATION_OUTPUT_CHUNK_BYTES;
 var STREAM_PART_ATTRIBUTE = "data-tsr-stream-part";
 var INITIAL_CLEANUP_SOURCE = `{let s=document.currentScript,p;while((p=s.previousElementSibling)&&p.hasAttribute('${STREAM_PART_ATTRIBUTE}'))p.remove();s.remove()}`;
@@ -6319,8 +5436,7 @@ function getOrigin(request) {
 	return "http://localhost";
 }
 function getNormalizedURL(url, base) {
-	if (typeof url === "string") url = url.replace("\\", "%5C");
-	const rawUrl = new URL(url, base);
+	const rawUrl = typeof url === "string" ? new URL(url.replace("\\", "%5C"), base) : url;
 	const handledProtocolRelativeURL = rawUrl.pathname.startsWith("//");
 	const decodedPathname = decodePath(handledProtocolRelativeURL ? rawUrl.pathname.replace(/^\/+/, "/") : rawUrl.pathname);
 	const searchParams = new URLSearchParams(rawUrl.search);
@@ -6380,13 +5496,6 @@ function bindSsrResponseToRequest(router, result, signal) {
 	});
 	return ssrResponse;
 }
-function replaceSsrResponse(result, response, reason) {
-	disposeSsrResponse(result, reason);
-	return {
-		response,
-		serverSsrCleanup: "none"
-	};
-}
 function stripSsrResponseBody(result, reason) {
 	const ssrResponse = normalizeSsrResponse(result);
 	disposeSsrResponse(ssrResponse, reason);
@@ -6423,7 +5532,10 @@ function createRequestHandler({ createRouter, request, getRouterManifest }) {
 				history,
 				origin: router.options.origin ?? origin
 			});
-			await router.load({ _signal: signal });
+			await router.load({
+				_signal: signal,
+				_skipLocationUpdate: true
+			});
 			signal.throwIfAborted();
 			const result = router._serverResult;
 			if (result?.type === "redirect") return result.redirect;
@@ -6455,7 +5567,7 @@ function transformPipeableStreamWithRouter(router, routerStream, opts) {
 }
 var DEFAULT_SERIALIZATION_TIMEOUT_MS = 6e4;
 var MIN_APPLICATION_STRING_CHUNK_BYTES = 256;
-var MAX_APPLICATION_STRING_CHUNK_BYTES = 64 * 1024;
+var MAX_APPLICATION_STRING_CHUNK_BYTES = 65536;
 var ApplicationPhase = {
 	BeforeBoundary: 0,
 	Merge: 1,
@@ -6943,11 +6055,42 @@ function makeMergeStream(serverSsr, reader, hydrationOutput, opts) {
 	disarmLifecycle = armStreamLifecycle(serverSsr, opts, () => terminal, terminate);
 	return stream;
 }
-var serovalPlugins = void 0;
-var FORM_DATA_CONTENT_TYPES = ["multipart/form-data", "application/x-www-form-urlencoded"];
+var SERIALIZED_JSON_HEADERS = /* @__PURE__ */ new Map([
+	["content-type", "application/json"],
+	[X_TSS_SERIALIZED, "true"],
+	[X_TSS_RAW_RESPONSE, null],
+	["location", null]
+]);
+var SERIALIZED_JSON_HEADER_INIT = new Headers({
+	"content-type": "application/json",
+	[X_TSS_SERIALIZED]: "true"
+});
+/** Completed bytes own no stream until the request pipeline accepts them. */
+var DeferredResponse = class {
+	constructor(body) {
+		this.body = body;
+	}
+	createResponse(event) {
+		return createFinalizedResponse(this.body, SERIALIZED_JSON_HEADER_INIT, SERIALIZED_JSON_HEADERS, event);
+	}
+};
+var SERIALIZED_FRAMED_HEADERS = /* @__PURE__ */ new Map([
+	["content-type", TSS_CONTENT_TYPE_FRAMED_VERSIONED],
+	[X_TSS_SERIALIZED, "true"],
+	[X_TSS_RAW_RESPONSE, null],
+	["location", null]
+]);
+var NOT_FOUND_HEADERS = /* @__PURE__ */ new Map([
+	["content-type", "application/json"],
+	[X_TSS_SERIALIZED, null],
+	[X_TSS_RAW_RESPONSE, null],
+	["location", null]
+]);
+var RAW_RESPONSE_HEADERS = /* @__PURE__ */ new Map([[X_TSS_RAW_RESPONSE, "true"]]);
+var THROWN_RESPONSE_HEADERS = /* @__PURE__ */ new Map([[X_TSS_RAW_RESPONSE, "thrown"]]);
 var MAX_PAYLOAD_SIZE = 1e6;
 var MAX_PENDING_SERIALIZATION_RECORDS = 1024;
-var MAX_PENDING_SERIALIZATION_BYTES = 32 * 1024 * 1024;
+var MAX_PENDING_SERIALIZATION_BYTES = 33554432;
 var textEncoder = new TextEncoder();
 function encodeSerializationRecord(value) {
 	return textEncoder.encode(JSON.stringify(value));
@@ -6963,86 +6106,103 @@ function runSerializationCleanup(dispose) {
 function cancelRawStream(stream, reason) {
 	stream.cancel(reason).catch(() => {});
 }
-var handleServerAction = async ({ request, context, serverFnId }) => {
+/**
+* Marks a Response thrown during a server-function request so the client
+* rejects the call with it. Redirects keep their own protocol.
+*/
+function toThrownServerFnResponse(response) {
+	return isRedirect(response) ? response : setProtectedResponseHeaders(response, THROWN_RESPONSE_HEADERS);
+}
+/**
+* Builds the reply for a server-function request that failed outside the
+* function, such as in request middleware. Like a failed call, it carries
+* only the thrown value under an `error` key, so the client rethrows it.
+*/
+async function createServerFnErrorResponse(error, serovalPlugins) {
+	if (isNotFound(error)) return isNotFoundResponse(error);
+	const headers = getErrorHeaders(error) ?? new Headers();
+	const { status, statusText } = resolveErrorResponseStatus(error);
+	headers.set("Content-Type", "application/json");
+	headers.set(X_TSS_SERIALIZED, "true");
+	headers.delete(X_TSS_RAW_RESPONSE);
+	headers.delete("location");
+	const plugins = serovalPlugins ?? getSerovalPlugins(defaultSerovalDeserializerPlugins);
+	let serializedError;
+	try {
+		serializedError = JSON.stringify(await toCrossJSONAsync({ error }, {
+			refs: /* @__PURE__ */ new Map(),
+			plugins
+		}));
+	} catch (serializationError) {
+		serializedError = JSON.stringify(await toCrossJSONAsync({ error: serializationError }, {
+			refs: /* @__PURE__ */ new Map(),
+			plugins
+		}));
+	}
+	const errorResponse = new Response(serializedError, {
+		status,
+		statusText,
+		headers
+	});
+	protectResponseHeaders(errorResponse, SERIALIZED_JSON_HEADERS);
+	return errorResponse;
+}
+var handleServerAction = async ({ request, serverFnId }) => {
 	const methodUpper = request.method.toUpperCase();
-	const url = new URL(request.url);
 	const action = await getServerFnById(serverFnId, { origin: "client" });
 	if (action.method && methodUpper !== action.method) return new Response(`expected ${action.method} method. Got ${methodUpper}`, {
 		status: 405,
 		headers: { Allow: action.method }
 	});
-	const isServerFn = request.headers.get("x-tsr-serverFn") === "true";
-	serovalPlugins ??= getSerovalPlugins(defaultSerovalDeserializerPlugins);
-	const contentType = request.headers.get("Content-Type");
+	const headers = request.headers;
+	const isServerFn = headers.get("x-tsr-serverfn") === "true";
+	let serovalPlugins;
+	const getRequestSerovalPlugins = () => {
+		return serovalPlugins ??= getSerovalPlugins(defaultSerovalDeserializerPlugins);
+	};
+	const contentType = headers.get("content-type");
 	try {
 		let res;
-		if (FORM_DATA_CONTENT_TYPES.some((type) => contentType && contentType.includes(type))) {
+		if (contentType && (contentType.includes("multipart/form-data") || contentType.includes("application/x-www-form-urlencoded"))) {
 			if (methodUpper === "GET") invariant();
 			const formData = await request.formData();
 			const serializedContext = formData.get(TSS_FORMDATA_CONTEXT);
 			formData.delete(TSS_FORMDATA_CONTEXT);
 			const params = {
-				context,
 				data: formData,
 				method: methodUpper
 			};
 			if (typeof serializedContext === "string") try {
-				const deserializedContext = fromJSON(JSON.parse(serializedContext), { plugins: serovalPlugins });
-				if (typeof deserializedContext === "object" && deserializedContext) params.context = safeObjectMerge(deserializedContext, context);
+				const deserializedContext = fromJSON(JSON.parse(serializedContext), { plugins: getRequestSerovalPlugins() });
+				if (typeof deserializedContext === "object" && deserializedContext) params.context = deserializedContext;
 			} catch (e) {}
 			res = await action(params);
-		} else if (methodUpper === "GET") {
-			const payloadParam = url.searchParams.get("payload");
-			if (payloadParam && payloadParam.length > MAX_PAYLOAD_SIZE) throw new Error("Payload too large");
-			const payload = payloadParam ? fromJSON(JSON.parse(payloadParam), { plugins: serovalPlugins }) : void 0;
-			res = await action({
-				data: payload?.data,
-				context: safeObjectMerge(payload?.context, context),
-				method: methodUpper
-			});
 		} else {
-			const payload = contentType?.includes("application/json") ? fromJSON(await request.json(), { plugins: serovalPlugins }) : void 0;
+			let json;
+			if (methodUpper === "GET") {
+				const payloadParam = getParsedRequestUrl(request).searchParams.get("payload");
+				if (payloadParam && payloadParam.length > MAX_PAYLOAD_SIZE) throw new Error("Payload too large");
+				json = payloadParam ? JSON.parse(payloadParam) : void 0;
+			} else if (contentType?.includes("application/json")) json = await request.json();
+			const payload = json === void 0 ? void 0 : fromJSON(json, { plugins: getRequestSerovalPlugins() });
 			res = await action({
 				data: payload?.data,
-				context: safeObjectMerge(payload?.context, context),
+				context: payload?.context,
 				method: methodUpper
 			});
 		}
-		const unwrapped = res.error !== void 0 ? res.error : res.result;
-		if (isNotFound(res)) res = isNotFoundResponse(res);
+		const failed = "error" in res;
+		const unwrapped = failed ? res.error : res.result;
 		if (!isServerFn && (unwrapped instanceof Response || unwrapped === null || typeof unwrapped !== "object")) return unwrapped;
 		if (unwrapped instanceof Response) {
+			if (failed) return toThrownServerFnResponse(unwrapped);
 			if (isRedirect(unwrapped)) return unwrapped;
-			unwrapped.headers.set(X_TSS_RAW_RESPONSE, "true");
-			return unwrapped;
+			return setProtectedResponseHeaders(unwrapped, RAW_RESPONSE_HEADERS);
 		}
-		return serializeResult(res, request.signal, serovalPlugins);
+		return serializeResult(res, request, getRequestSerovalPlugins());
 	} catch (error) {
 		if (error instanceof Response) return error;
-		if (isNotFound(error)) return isNotFoundResponse(error);
-		console.error("Server Fn Error!", error);
-		const serializedError = JSON.stringify(await toCrossJSONAsync(error, {
-			refs: /* @__PURE__ */ new Map(),
-			plugins: serovalPlugins
-		}));
-		const response = getResponse();
-		const headers = {
-			"Content-Type": "application/json",
-			[X_TSS_SERIALIZED]: "true"
-		};
-		try {
-			return new Response(serializedError, {
-				status: response.status ?? 500,
-				statusText: response.statusText,
-				headers
-			});
-		} catch {
-			return new Response(serializedError, {
-				status: 500,
-				statusText: "",
-				headers
-			});
-		}
+		return createServerFnErrorResponse(error, serovalPlugins);
 	}
 };
 /**
@@ -7050,8 +6210,7 @@ var handleServerAction = async ({ request, context, serverFnId }) => {
 * synchronously without RawStreams becomes plain JSON; everything else is a
 * framed response whose records and raw streams are multiplexed in order.
 */
-function serializeResult(res, signal, plugins) {
-	const alsResponse = getResponse();
+function serializeResult(res, request, plugins) {
 	const initialRecords = [];
 	let initialBytes = 0;
 	const pendingRawStreams = [];
@@ -7110,14 +6269,7 @@ function serializeResult(res, signal, plugins) {
 		throw serializationFailure[0];
 	}
 	if (!done) disposeSerialization = dispose;
-	if (done && pendingRawStreams.length === 0 && initialRecords.length === 1) return new Response(initialRecords[0], {
-		status: alsResponse.status,
-		statusText: alsResponse.statusText,
-		headers: {
-			"Content-Type": "application/json",
-			[X_TSS_SERIALIZED]: "true"
-		}
-	});
+	if (done && pendingRawStreams.length === 0 && initialRecords.length === 1) return new DeferredResponse(initialRecords[0]);
 	if (done && initialRecords.length === 1) {
 		const json = initialRecords[0];
 		if (json.byteLength > 16777216) {
@@ -7138,7 +6290,7 @@ function serializeResult(res, signal, plugins) {
 			cancel(reason) {
 				for (const registration of rawStreams) cancelRawStream(registration.stream, reason);
 			}
-		}), { signal });
+		}), { signal: request.signal });
 	}
 	const { readable, writable } = new TransformStream();
 	const writer = writable.getWriter();
@@ -7211,37 +6363,49 @@ function serializeResult(res, signal, plugins) {
 		abortRecordStream(error);
 	});
 	return createFramedResponse(readable, {
-		signal: AbortSignal.any([recordAbortController.signal, signal]),
+		signal: AbortSignal.any([recordAbortController.signal, request.signal]),
 		onCancel: abortRecordStream
 	});
-	function createFramedResponse(records, options) {
-		const multiplexedStream = createMultiplexedStream(records, options);
-		try {
-			return new Response(multiplexedStream, {
-				status: alsResponse.status,
-				statusText: alsResponse.statusText,
-				headers: {
-					"Content-Type": TSS_CONTENT_TYPE_FRAMED_VERSIONED,
-					[X_TSS_SERIALIZED]: "true"
-				}
-			});
-		} catch (error) {
-			cancelRawStream(multiplexedStream, error);
-			throw error;
-		}
+}
+function createFramedResponse(records, options) {
+	const multiplexedStream = createMultiplexedStream(records, options);
+	const { status, statusText } = getSerializedResponseState();
+	try {
+		const response = new Response(multiplexedStream, {
+			status,
+			statusText,
+			headers: {
+				"Content-Type": TSS_CONTENT_TYPE_FRAMED_VERSIONED,
+				[X_TSS_SERIALIZED]: "true"
+			}
+		});
+		protectResponseHeaders(response, SERIALIZED_FRAMED_HEADERS);
+		return response;
+	} catch (error) {
+		cancelRawStream(multiplexedStream, error);
+		throw error;
 	}
 }
 function isNotFoundResponse(error) {
 	const { headers, ...rest } = error;
+	let responseHeaders;
+	if (headers) {
+		const copiedHeaders = new Headers(headers);
+		copiedHeaders.set("Content-Type", "application/json");
+		copiedHeaders.delete(X_TSS_SERIALIZED);
+		copiedHeaders.delete(X_TSS_RAW_RESPONSE);
+		copiedHeaders.delete("location");
+		responseHeaders = copiedHeaders;
+	} else responseHeaders = { "Content-Type": "application/json" };
 	const response = new Response(JSON.stringify(rest), {
 		status: 404,
-		headers
+		headers: responseHeaders
 	});
-	response.headers.set("Content-Type", "application/json");
+	protectResponseHeaders(response, NOT_FOUND_HEADERS);
 	return response;
 }
 var LINK_PARAM_TOKEN_RE = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
-var PRELOAD_AS_VALUES = new Set([
+var PRELOAD_AS_VALUES = /* @__PURE__ */ new Set([
 	"fetch",
 	"font",
 	"image",
@@ -7645,14 +6809,20 @@ function buildManifest(source, opts) {
 		routes: { ...source.routes }
 	};
 }
-function getStaticHandlerInlineCssDefault(handlerInlineCss) {
+/**
+* The inline-CSS choice that needs no handler callback: a request override
+* wins, then a static handler option, then the default. Undefined when a
+* handler callback has to decide.
+*/
+function getStaticInlineCss(requestInlineCss, handlerInlineCss) {
+	if (requestInlineCss !== void 0) return requestInlineCss;
 	if (typeof handlerInlineCss === "function") return;
 	return handlerInlineCss ?? true;
 }
 async function resolveInlineCssForRequest(opts) {
-	if (opts.requestInlineCss !== void 0) return opts.requestInlineCss;
-	if (typeof opts.handlerInlineCss === "function") return await opts.handlerInlineCss({ request: opts.request });
-	return opts.handlerInlineCss ?? true;
+	const inlineCss = getStaticInlineCss(opts.requestInlineCss, opts.handlerInlineCss);
+	if (inlineCss !== void 0) return inlineCss;
+	return await opts.handlerInlineCss({ request: opts.request });
 }
 function createCachedBaseManifestLoader(loadBaseManifest) {
 	let baseManifestPromise;
@@ -7691,7 +6861,7 @@ function createFinalManifestTransformResolver(transformAssets, opts) {
 function createFinalManifestResolver(opts) {
 	const finalManifestCache = /* @__PURE__ */ new Map();
 	const transformResolver = createFinalManifestTransformResolver(opts.transformAssets, { cacheCreateTransform: opts.cacheCreateTransform });
-	const handlerDefaultInlineCss = getStaticHandlerInlineCssDefault(opts.inlineCss);
+	const handlerDefaultInlineCss = getStaticInlineCss(void 0, opts.inlineCss);
 	const getRequestManifestOptions = async (requestOpts) => {
 		const transformFn = await transformResolver.getTransformFn({
 			warmup: false,
@@ -7725,25 +6895,35 @@ function createFinalManifestResolver(opts) {
 			getTransformFn: () => transformResolver.getTransformFn({ warmup: true }),
 			onError: transformResolver.clearCachedCreateTransform
 		}),
-		resolveCached: (requestOpts) => resolveRequest(requestOpts, finalManifestCache),
+		resolveCached: (requestOpts) => {
+			const inlineCss = getStaticInlineCss(requestOpts.requestInlineCss, opts.inlineCss);
+			if (transformResolver.cache && inlineCss !== void 0) {
+				const cached = finalManifestCache.get(getFinalManifestCacheKey(inlineCss));
+				if (cached) return cached;
+			}
+			return resolveRequest(requestOpts, finalManifestCache);
+		},
 		resolveUncached: (requestOpts) => resolveRequest(requestOpts, void 0)
 	};
 }
 function getFinalManifestCacheKey(inlineCss) {
 	return inlineCss ? "inline-css" : "linked-css";
 }
-function cacheFinalManifestPromise(cachedFinalManifestPromises, cacheKey, promise) {
-	const cachedFinalManifestPromise = promise.catch((error) => {
-		if (cachedFinalManifestPromises.get(cacheKey) === cachedFinalManifestPromise) cachedFinalManifestPromises.delete(cacheKey);
+function cacheFinalManifestPromise(finalManifestCache, cacheKey, promise) {
+	const cachedPromise = promise.then((manifest) => {
+		if (finalManifestCache.get(cacheKey) === cachedPromise) finalManifestCache.set(cacheKey, manifest);
+		return manifest;
+	}, (error) => {
+		if (finalManifestCache.get(cacheKey) === cachedPromise) finalManifestCache.delete(cacheKey);
 		throw error;
 	});
-	cachedFinalManifestPromises.set(cacheKey, cachedFinalManifestPromise);
-	return cachedFinalManifestPromise;
+	finalManifestCache.set(cacheKey, cachedPromise);
+	return cachedPromise;
 }
-function getOrCreateCachedFinalManifestPromise(cachedFinalManifestPromises, cacheKey, computeFinalManifest) {
-	const cachedFinalManifestPromise = cachedFinalManifestPromises.get(cacheKey);
-	if (cachedFinalManifestPromise) return cachedFinalManifestPromise;
-	return cacheFinalManifestPromise(cachedFinalManifestPromises, cacheKey, Promise.resolve().then(computeFinalManifest));
+function getOrCreateCachedFinalManifest(finalManifestCache, cacheKey, computeFinalManifest) {
+	const cached = finalManifestCache.get(cacheKey);
+	if (cached) return cached;
+	return cacheFinalManifestPromise(finalManifestCache, cacheKey, Promise.resolve().then(computeFinalManifest));
 }
 async function buildFinalManifest(opts) {
 	return opts.transformFn ? await transformManifestAssets(opts.base, opts.transformFn, { inlineCss: opts.inlineCss }) : buildManifest(opts.base, { inlineCss: opts.inlineCss });
@@ -7756,20 +6936,20 @@ async function resolveFinalManifest(opts) {
 			inlineCss: opts.inlineCss
 		});
 	};
-	if (opts.finalManifestCache && (!opts.transformFn || opts.cache)) return getOrCreateCachedFinalManifestPromise(opts.finalManifestCache, getFinalManifestCacheKey(opts.inlineCss), computeFinalManifest);
+	if (opts.finalManifestCache && (!opts.transformFn || opts.cache)) return getOrCreateCachedFinalManifest(opts.finalManifestCache, getFinalManifestCacheKey(opts.inlineCss), computeFinalManifest);
 	return computeFinalManifest();
 }
 function warmupFinalManifest(opts) {
 	if (!opts.enabled || opts.handlerDefaultInlineCss === void 0 || !opts.cache) return;
 	const inlineCss = opts.handlerDefaultInlineCss;
-	const warmupPromise = getOrCreateCachedFinalManifestPromise(opts.finalManifestCache, getFinalManifestCacheKey(inlineCss), async () => {
+	const warmupPromise = cacheFinalManifestPromise(opts.finalManifestCache, getFinalManifestCacheKey(inlineCss), Promise.resolve().then(async () => {
 		const [base, transformFn] = await Promise.all([opts.getBaseManifest(), opts.getTransformFn()]);
 		return buildFinalManifest({
 			base,
 			transformFn,
 			inlineCss
 		});
-	});
+	}));
 	if (opts.onError) warmupPromise.catch(opts.onError);
 	return warmupPromise;
 }
@@ -7789,18 +6969,18 @@ var ServerFunctionSerializationAdapter = createSerializationAdapter({
 				context: opts?.context,
 				method: serverFn.method ?? "GET"
 			}, signal);
-			if (result.error !== void 0) throw result.error;
+			if ("error" in result) throw result.error;
 			return result.result;
 		};
 		return fn;
 	}
 });
-function getStartResponseHeaders(opts) {
-	return mergeHeaders({ "Content-Type": "text/html; charset=utf-8" }, ..._getRenderedMatches(opts.router.stores.matches.get()).map((match) => {
-		return match.headers;
-	}));
+function getStartResponseHeaders(router) {
+	const headers = new Headers({ "content-type": "text/html; charset=utf-8" });
+	const matches = _getRenderedMatches(router.stores.matches.get());
+	return matches.some((match) => match.headers) ? mergeHeaders(headers, ...matches.map((match) => match.headers)) : headers;
 }
-var entriesPromise;
+var cachedEntries;
 var defaultCsrfMiddleware = createCsrfMiddleware({ filter: (ctx) => ctx.handlerType === "serverFn" });
 var getCachedBaseManifest = createCachedBaseManifestLoader(() => getStartManifest());
 var getProdBaseManifest = () => getCachedBaseManifest();
@@ -7808,9 +6988,9 @@ var getBaseManifest = getProdBaseManifest;
 var createEarlyHintsForRequest = createEarlyHintsCollector;
 async function loadEntries() {
 	const [routerEntry, startEntry, pluginAdapters] = await Promise.all([
-		import("./router-CbcgKYjf.mjs"),
-		import("./start-BfFbHKMK.mjs"),
-		import("./empty-plugin-adapters-CPtwX8a7.mjs")
+		import("./router-DzoZ6RiZ.mjs"),
+		import("./start-B6ECIE_7.mjs"),
+		import("./empty-plugin-adapters-CpCHi1TV.mjs")
 	]);
 	return {
 		routerEntry,
@@ -7819,8 +6999,11 @@ async function loadEntries() {
 	};
 }
 function getEntries() {
-	if (!entriesPromise) entriesPromise = loadEntries();
-	return entriesPromise;
+	if (!cachedEntries) cachedEntries = loadEntries().then((entries) => {
+		cachedEntries = entries;
+		return entries;
+	});
+	return cachedEntries;
 }
 var ROUTER_BASEPATH = "/";
 var SERVER_FN_BASE = "/_serverFn/";
@@ -7838,25 +7021,21 @@ function throwIfMayNotDefer() {
 function getResponseFromResult(result) {
 	return isSsrResponse(result) || result instanceof Response ? result : result?.response;
 }
-var responseBodySources = /* @__PURE__ */ new WeakMap();
 function disposeResponseResult(result, reason) {
 	const response = getResponseFromResult(result);
 	if (isSsrResponse(response) || response instanceof Response) disposeSsrResponse(response, reason);
 }
 /**
-* Marks `response` as directly derived from the current `source`.
-* Middleware must consume or cancel any other `clone()` or `tee()` branches.
+* A new body continues the owned one when it is the same stream, or when the
+* owned body is already being read, as by a pipe, a tee, or a `Response` that
+* copies a body by reading it (Bun, or a wrapped global `Response`). Start
+* cannot tell such a reader from one that stops early, so it disposes only an
+* unread body. A stream whose reader stops early ends with the request's abort
+* or the SSR stream's lifetime limit.
 */
-function transferResponseBodyOwnership(source, response) {
-	if (!source.body || !response.body) throw new Error("Response body ownership requires two response bodies");
-	responseBodySources.set(response, source);
-	return response;
-}
-function hasResponseBody(value) {
-	return value instanceof Response && value.body !== null;
-}
-function inheritsResponseOwnership(ownership, candidate) {
-	return hasResponseBody(candidate) && (candidate.body === ownership.response.body || responseBodySources.get(candidate) === ownership.response);
+function inheritsResponseOwnership(ownership, body) {
+	const ownedBody = ownership.response.body;
+	return body === ownedBody || ownedBody.locked;
 }
 function disposeResponseOwnership(ownership, reason) {
 	const { response, sourceBody, streamResponse } = ownership;
@@ -7886,54 +7065,80 @@ function createLateResponseDisposer(signal) {
 * Compose middleware around a terminal response handler. With no middleware
 * the terminal runs directly.
 */
-async function executeMiddleware(middlewares, terminal, ctx, signal, terminalNext) {
+async function executeMiddleware(middlewares, terminal, ctx, signal, event, terminalNext) {
 	let index = -1;
 	let responseOwnership;
-	let settled = false;
+	let returnedDepth = Infinity;
 	const disposeAbandonedResult = createLateResponseDisposer(signal);
-	const setResponse = (response) => {
-		const ssrResponse = isSsrResponse(response) ? response : void 0;
-		const streamResponse = ssrResponse?.serverSsrCleanup === "stream" ? ssrResponse : void 0;
-		const exposed = ssrResponse ? ssrResponse.response : response;
+	const adoptResponse = (exposed, streamResponse) => {
 		const current = responseOwnership;
-		if (settled) {
-			if (exposed !== ctx.response) disposeResponseResult(response, "late middleware response");
-			return;
-		}
+		const body = exposed instanceof Response ? exposed.body : null;
+		const response = exposed;
+		if (streamResponse && !body && streamResponse !== current?.streamResponse) streamResponse.dispose("Response body dropped by Start reconciliation");
 		if (current && current.response === exposed) current.streamResponse ??= streamResponse;
-		else if (current && inheritsResponseOwnership(current, exposed)) {
-			current.response = exposed;
+		else if (current && body && inheritsResponseOwnership(current, body)) {
+			if (body === current.response.body) transferResponseProtocol(current.response, response);
+			current.response = response;
 			current.streamResponse ??= streamResponse;
 		} else {
-			if (current) disposeResponseOwnership(current, "middleware response replaced");
-			if (hasResponseBody(exposed)) responseOwnership = {
-				response: exposed,
-				sourceBody: exposed.body,
+			if (current) {
+				responseOwnership = void 0;
+				disposeResponseOwnership(current, "middleware response replaced");
+			}
+			responseOwnership = body ? {
+				response,
+				sourceBody: body,
 				streamResponse
-			};
-			else responseOwnership = void 0;
+			} : void 0;
 		}
 		ctx.response = exposed;
 	};
-	const reconcileCtxResponse = () => {
-		if (ctx.response !== responseOwnership?.response) setResponse(ctx.response);
+	const disposeCurrentBody = (reason) => {
+		const current = responseOwnership;
+		responseOwnership = void 0;
+		if (current) disposeResponseOwnership(current, reason);
+	};
+	const setResponse = (response, caller) => {
+		const owned = response !== void 0 && response === responseOwnership?.response;
+		const ssrResponse = !owned && isSsrResponse(response) ? response : void 0;
+		const exposed = ssrResponse ? ssrResponse.response : response;
+		if (returnedDepth <= caller) {
+			if (exposed !== ctx.response) disposeResponseResult(response, "late middleware response");
+			return;
+		}
+		if (!owned) adoptResponse(exposed, ssrResponse?.serverSsrCleanup === "stream" ? ssrResponse : void 0);
+		if (exposed instanceof Response) {
+			const reconciled = reconcileResponse(exposed, event, disposeCurrentBody);
+			if (reconciled !== exposed) adoptRebuilt(exposed, reconciled);
+		}
+	};
+	const adoptRebuilt = (exposed, rebuilt) => {
+		const current = responseOwnership;
+		if (current?.response === exposed && rebuilt.body) {
+			current.response = rebuilt;
+			ctx.response = rebuilt;
+		} else adoptResponse(rebuilt);
 	};
 	let nextPromise;
 	function next(nextCtx) {
-		const result = runNext(nextCtx);
+		const result = runNext(index, nextCtx);
 		nextPromise = result;
 		return result;
 	}
-	async function runNext(nextCtx) {
+	async function runNext(caller, nextCtx) {
 		signal.throwIfAborted();
 		if (nextCtx) {
 			if (nextCtx.context) ctx.context = safeObjectMerge(ctx.context, nextCtx.context);
-			for (const key of Object.keys(nextCtx)) if (key === "response") setResponse(nextCtx.response);
-			else if (key !== "context") ctx[key] = nextCtx[key];
+			const keys = Object.keys(nextCtx);
+			for (let i = 0; i < keys.length; i++) {
+				const key = keys[i];
+				if (key === "response") setResponse(nextCtx.response, caller);
+				else if (key !== "context") ctx[key] = nextCtx[key];
+			}
 		}
-		index++;
-		const isTerminal = index === middlewares.length;
-		const middleware = index < middlewares.length ? middlewares[index] : isTerminal ? terminal : void 0;
+		const depth = ++index;
+		const isTerminal = depth === middlewares.length;
+		const middleware = depth < middlewares.length ? middlewares[depth] : isTerminal ? terminal : void 0;
 		const middlewareNext = isTerminal && terminalNext ? terminalNext : next;
 		if (!middleware) return ctx;
 		let result;
@@ -7944,45 +7149,61 @@ async function executeMiddleware(middlewares, terminal, ctx, signal, terminalNex
 			});
 			if (nextPromise && pending === nextPromise) {
 				nextPromise = void 0;
-				await pending;
-				if (signal.aborted) throw signal.reason;
-				return ctx;
+				result = await pending;
+				signal.throwIfAborted();
 			} else if (!isPromise(pending)) {
 				result = pending;
 				signal.throwIfAborted();
 			} else result = await waitForReason(pending, signal, disposeAbandonedResult, disposeAbandonedResult);
 		} catch (err) {
-			reconcileCtxResponse();
+			if (depth < returnedDepth) returnedDepth = depth;
+			if (returnedDepth > caller) adoptResponse(ctx.response);
 			if (signal.aborted) {
 				if (result !== void 0) disposeAbandonedResult(result);
 				if (err !== signal.reason) disposeAbandonedResult(err);
 				throw signal.reason;
 			}
 			if (err instanceof Response) {
-				setResponse(err);
+				setResponse(ctx.handlerType === "serverFn" ? toThrownServerFnResponse(err) : err, caller);
 				return ctx;
 			}
 			throw err;
 		}
+		if (depth < returnedDepth) returnedDepth = depth;
 		if (isTerminal && terminalNext && !result) throwRouteHandlerError();
-		reconcileCtxResponse();
+		if (isTerminal && !terminalNext && result instanceof DeferredResponse) {
+			if (returnedDepth > caller) {
+				adoptResponse(void 0);
+				adoptResponse(result.createResponse(event));
+			}
+			return ctx;
+		}
 		if (result && result !== ctx) {
 			const response = getResponseFromResult(result);
-			if (response !== void 0 && response !== ctx.response) setResponse(response);
-			if (response !== result && result.context && result.context !== ctx.context) ctx.context = safeObjectMerge(ctx.context, result.context);
-		}
+			if (response !== void 0) {
+				if (ctx.response !== responseOwnership?.response && ctx.response !== response && returnedDepth > caller) adoptResponse(ctx.response);
+				setResponse(response, caller);
+			} else setResponse(ctx.response, caller);
+			if (returnedDepth > caller && response !== result && result.context && result.context !== ctx.context) ctx.context = safeObjectMerge(ctx.context, result.context);
+		} else setResponse(ctx.response, caller);
 		return ctx;
 	}
 	try {
-		await runNext();
-		const response = ctx.response;
+		await runNext(-1);
+		let response = ctx.response;
 		if (!response) throwRouteHandlerError();
-		reconcileCtxResponse();
 		if (signal.aborted) throw signal.reason;
-		settled = true;
+		returnedDepth = -1;
+		if (middlewares.length && ctx.handlerType === "serverFn") {
+			const restored = restoreResponseProtocol(response, event);
+			if (restored !== response) {
+				adoptRebuilt(response, restored);
+				response = restored;
+			}
+		}
 		return responseOwnership ? getOwnedResponse(responseOwnership) : response;
 	} catch (err) {
-		settled = true;
+		returnedDepth = -1;
 		if (responseOwnership) disposeResponseOwnership(responseOwnership, signal.aborted ? signal.reason : err);
 		throw err;
 	}
@@ -8026,18 +7247,24 @@ function createStartHandler(cbOrOptions) {
 	});
 	const resolveManifestForRequest = finalManifestResolver.resolveCached;
 	finalManifestResolver.warmup({ getBaseManifest: () => getBaseManifest(void 0) });
-	const startRequestResolver = async (request, requestOpts) => {
+	const startRequestResolver = async (request, requestOpts, event) => {
 		const signal = request.signal;
 		let router;
 		let routerPromise;
 		let responseOwnsCleanup = false;
+		let response;
 		try {
 			signal.throwIfAborted();
-			const { url, handledProtocolRelativeURL } = getNormalizedURL(request.url);
-			const href = url.pathname + url.search + url.hash;
-			const origin = url.origin;
-			if (handledProtocolRelativeURL) return Response.redirect(url, 308);
-			const entries = await waitForReason(getEntries(), signal);
+			const requestUrl = event.requestUrl;
+			let url = requestUrl;
+			const pathname = url.pathname;
+			if (!SERVER_FN_BASE || !pathname.startsWith(SERVER_FN_BASE) || pathname.includes("%") || pathname.startsWith("//")) {
+				const normalized = getNormalizedURL(requestUrl);
+				url = normalized.url;
+				if (normalized.handledProtocolRelativeURL) return finalizeResponse(Response.redirect(url, 308), event);
+			}
+			const pendingEntries = getEntries();
+			const entries = isPromise(pendingEntries) ? await waitForReason(pendingEntries, signal) : pendingEntries;
 			const isServerFnRequest = !!SERVER_FN_BASE && url.pathname.startsWith(SERVER_FN_BASE);
 			const startInstance = entries.startEntry.startInstance;
 			let startOptions;
@@ -8057,22 +7284,29 @@ function createStartHandler(cbOrOptions) {
 				requestMiddleware: startInstance ? startOptions.requestMiddleware : isServerFnRequest ? [defaultCsrfMiddleware] : void 0,
 				serializationAdapters
 			};
-			const flattenedRequestMiddlewares = requestStartOptions.requestMiddleware ? flattenMiddlewares(requestStartOptions.requestMiddleware) : [];
-			const executedRequestMiddlewares = new Set(flattenedRequestMiddlewares);
+			const requestMiddleware = requestStartOptions.requestMiddleware;
+			let executedRequestMiddlewares;
+			let flattenedRequestMiddlewares = [];
+			if (requestMiddleware?.length) {
+				executedRequestMiddlewares = /* @__PURE__ */ new Set();
+				flattenedRequestMiddlewares = flattenMiddlewares(requestMiddleware, void 0, executedRequestMiddlewares);
+			}
 			const getRouter = () => {
 				routerPromise ??= (async () => {
 					signal.throwIfAborted();
-					const requestRouter = await waitForReason(entries.routerEntry.getRouter(), signal);
+					const routerUrl = url === requestUrl ? getNormalizedURL(url).url : url;
+					const pendingRouter = entries.routerEntry.getRouter();
+					const requestRouter = isPromise(pendingRouter) ? await waitForReason(pendingRouter, signal) : pendingRouter;
 					let isShell = IS_SHELL_ENV;
 					if (IS_PRERENDERING && !isShell) isShell = request.headers.get(HEADERS.TSS_SHELL) === "true";
-					const history = createServerHistory(href);
+					const history = createServerHistory(routerUrl.pathname + routerUrl.search + routerUrl.hash);
 					requestRouter.update({
 						history,
 						isShell,
 						isPrerendering: IS_PRERENDERING,
-						origin: requestRouter.options.origin ?? origin,
+						origin: requestRouter.options.origin ?? routerUrl.origin,
 						defaultSsr: requestStartOptions.defaultSsr,
-						serializationAdapters: [...requestStartOptions.serializationAdapters, ...requestRouter.options.serializationAdapters || []],
+						serializationAdapters: requestRouter.options.serializationAdapters?.length ? [...requestStartOptions.serializationAdapters, ...requestRouter.options.serializationAdapters] : requestStartOptions.serializationAdapters,
 						basepath: ROUTER_BASEPATH
 					});
 					router = requestRouter;
@@ -8097,51 +7331,49 @@ function createStartHandler(cbOrOptions) {
 					contextAfterGlobalMiddlewares: context
 				}, () => handleServerAction({
 					request,
-					context: requestOpts?.context,
 					serverFnId
 				}));
 			} else {
-				const executeRouter = async (serverContext, matchedRoutes) => {
+				const executeRouter = async (serverContext, matchedRoutes, routerInstance) => {
 					if (!/(^|,)\s*(\*\/\*|text\/html)/.test(request.headers.get("Accept") || "*/*")) return normalizeSsrResponse(Response.json({ error: "Only HTML requests are supported here" }, { status: 406 }));
-					const manifest = await waitForReason(resolveManifestForRequest({
+					const pendingManifest = resolveManifestForRequest({
 						request,
 						requestInlineCss: requestOpts?.inlineCss,
 						getBaseManifest: () => getBaseManifest(matchedRoutes)
-					}), signal);
-					const earlyHints = createEarlyHintsForRequest({
-						onEarlyHints: requestOpts?.onEarlyHints,
-						responseLinkHeader: requestOpts?.responseLinkHeader
 					});
+					const manifest = isPromise(pendingManifest) ? await waitForReason(pendingManifest, signal) : pendingManifest;
+					const earlyHints = createEarlyHintsForRequest(requestOpts);
 					earlyHints?.collectStatic({
 						manifest,
 						matchedRoutes
 					});
-					const routerInstance = await getRouter();
+					const storedStartContext = getStartContext({ throwIfNotFound: false });
 					attachRouterServerSsrUtils({
 						router: routerInstance,
 						manifest,
-						getRequestAssets: () => getStartContext({ throwIfNotFound: false })?.requestAssets
+						getRequestAssets: () => storedStartContext?.requestAssets
 					});
 					routerInstance.options.additionalContext = { serverContext };
-					await routerInstance.load({ _signal: signal });
+					await routerInstance.load({
+						_signal: signal,
+						_skipLocationUpdate: true
+					});
 					signal.throwIfAborted();
 					if (routerInstance._serverResult?.type === "redirect") return normalizeSsrResponse(routerInstance._serverResult.redirect);
 					earlyHints?.collectDynamic(_getRenderedMatches(routerInstance.stores.matches.get()));
-					const ctx = getStartContext({ throwIfNotFound: false });
 					await routerInstance.serverSsr.dehydrate({
-						requestAssets: ctx?.requestAssets,
+						requestAssets: storedStartContext?.requestAssets,
 						signal
 					});
 					signal.throwIfAborted();
-					const responseHeaders = getStartResponseHeaders({ router: routerInstance });
+					const responseHeaders = getStartResponseHeaders(routerInstance);
 					earlyHints?.appendResponseHeaders(responseHeaders);
 					signal.throwIfAborted();
-					const disposeLate = createLateResponseDisposer(signal);
-					return normalizeSsrResponse(await waitForReason(cb({
+					return normalizeSsrResponse(await cb({
 						request,
 						router: routerInstance,
 						responseHeaders
-					}), signal, disposeLate, disposeLate));
+					}));
 				};
 				terminal = ({ context }) => runWithStartContext({
 					...startContext,
@@ -8149,22 +7381,45 @@ function createStartHandler(cbOrOptions) {
 				}, () => handleServerRoutes({
 					getRouter,
 					request,
-					url,
 					executeRouter,
 					context,
-					executedRequestMiddlewares
+					executedRequestMiddlewares,
+					signal,
+					event
 				}));
 			}
-			const middlewareResponse = await executeMiddleware(flattenedRequestMiddlewares.map((d) => d.options.server), terminal, {
+			const middlewareCtx = {
 				request,
 				pathname: url.pathname,
 				handlerType,
 				context: createNullProtoObject(requestOpts?.context)
-			}, signal);
+			};
+			let middlewareResponse;
+			try {
+				if (!isServerFnRequest && flattenedRequestMiddlewares.length === 0) middlewareResponse = await terminal(middlewareCtx);
+				else middlewareResponse = await executeMiddleware(flattenedRequestMiddlewares.map((d) => d.options.server), terminal, middlewareCtx, signal, event);
+			} catch (error) {
+				if (signal.aborted) throw error;
+				if (error instanceof Response) middlewareResponse = reconcileResponse(error, event);
+				else if (!isServerFnRequest) throw error;
+				else {
+					const disposeLate = createLateResponseDisposer(signal);
+					middlewareResponse = await waitForReason(runWithStartContext({
+						...startContext,
+						contextAfterGlobalMiddlewares: middlewareCtx.context
+					}, () => createServerFnErrorResponse(error)), signal, disposeLate, disposeLate);
+					middlewareResponse = reconcileResponse(middlewareResponse, event);
+				}
+			}
 			let result;
 			try {
-				result = await handleRedirectResponse(middlewareResponse, getRouter, signal, isServerFnRequest && request.headers.get("x-tsr-serverFn") === "true");
-				if (request.method === "HEAD") result = stripSsrResponseBody(result, "HEAD body stripped");
+				result = normalizeSsrResponse(middlewareResponse);
+				if (isRedirect(result.response)) result = await handleRedirectResponse(result, getRouter, signal, isServerFnRequest && request.headers.get("x-tsr-serverFn") === "true", event);
+				if (request.method === "HEAD" && result.response.body !== null) {
+					const source = result.response;
+					result = stripSsrResponseBody(result, "HEAD body stripped");
+					transferResponseMetadata(source, result.response);
+				}
 			} catch (error) {
 				disposeResponseResult(middlewareResponse, signal.aborted ? signal.reason : error);
 				throw error;
@@ -8172,17 +7427,26 @@ function createStartHandler(cbOrOptions) {
 			bindSsrResponseToRequest(router, result, signal);
 			signal.throwIfAborted();
 			responseOwnsCleanup = result.serverSsrCleanup === "stream";
-			return result.response;
+			response = result.response;
 		} finally {
-			if (router?.serverSsr && !responseOwnsCleanup) router.serverSsr.cleanup();
+			if (router?.serverSsr && !responseOwnsCleanup) {
+				router.serverSsr.cleanup();
+				if (response) response = finalizeResponse(response, event);
+			}
 		}
+		return response;
 	};
-	return requestHandler(startRequestResolver);
+	return withStartRequest(startRequestResolver);
 }
 var relativeRedirectProtocols = /* @__PURE__ */ new Set();
-async function handleRedirectResponse(response, getRouter, signal, serializeRedirect) {
+var SERIALIZED_REDIRECT_HEADERS = /* @__PURE__ */ new Map([
+	["content-type", "application/json"],
+	["location", null],
+	[X_TSS_RAW_RESPONSE, null],
+	[X_TSS_SERIALIZED, null]
+]);
+async function handleRedirectResponse(ssrResponse, getRouter, signal, serializeRedirect, event) {
 	signal.throwIfAborted();
-	const ssrResponse = normalizeSsrResponse(response);
 	const redirect = ssrResponse.response;
 	if (!isRedirect(redirect)) return ssrResponse;
 	const opts = redirect.options;
@@ -8205,13 +7469,21 @@ async function handleRedirectResponse(response, getRouter, signal, serializeRedi
 	if (serializeRedirect) {
 		const redirectOptions = { ...opts };
 		delete redirectOptions.headers;
+		redirectOptions.isSerializedRedirect = true;
 		const responseHeaders = new Headers(redirect.headers);
 		responseHeaders.set("content-type", "application/json");
-		return replaceSsrResponse(ssrResponse, Response.json({
-			...redirectOptions,
-			isSerializedRedirect: true
-		}, { headers: responseHeaders }), "redirect response replaced");
+		responseHeaders.delete("location");
+		responseHeaders.delete(X_TSS_RAW_RESPONSE);
+		responseHeaders.delete(X_TSS_SERIALIZED);
+		const body = JSON.stringify(redirectOptions);
+		if (body === void 0) throw new TypeError("Value is not JSON serializable");
+		disposeSsrResponse(ssrResponse, "redirect response replaced");
+		return {
+			response: createFinalizedResponse(body, responseHeaders, SERIALIZED_REDIRECT_HEADERS, event),
+			serverSsrCleanup: "none"
+		};
 	}
+	ssrResponse.response = finalizeResponse(redirect, event);
 	return ssrResponse;
 }
 function withParsedParams(handler, matchedRoutes) {
@@ -8228,19 +7500,19 @@ function withParsedParams(handler, matchedRoutes) {
 		});
 	};
 }
-async function handleServerRoutes({ getRouter, request, url, executeRouter, context, executedRequestMiddlewares }) {
+async function handleServerRoutes({ getRouter, request, executeRouter, context, executedRequestMiddlewares, signal, event }) {
 	const router = await getRouter();
-	const pathname = executeRewriteInput(router.rewrite, url).pathname;
+	const { pathname } = router.latestLocation;
 	const [matchedRoutes, rawParams, foundRoute] = router.getMatchedRoutes(pathname);
 	const isExactMatch = foundRoute && rawParams["**"] === void 0;
 	const routeMiddlewares = [];
-	let terminalHandler = (ctx) => executeRouter(ctx.context, matchedRoutes);
+	let terminalHandler = (ctx) => executeRouter(ctx.context, matchedRoutes, router);
 	let terminalNext;
 	for (const route of matchedRoutes) {
 		const serverMiddleware = route.options.server?.middleware;
 		if (serverMiddleware) {
 			const flattened = flattenMiddlewares(serverMiddleware);
-			for (const m of flattened) if (!executedRequestMiddlewares.has(m)) routeMiddlewares.push(m.options.server);
+			for (const m of flattened) if (!executedRequestMiddlewares?.has(m)) routeMiddlewares.push(m.options.server);
 		}
 	}
 	const server = foundRoute?.options.server;
@@ -8272,7 +7544,7 @@ async function handleServerRoutes({ getRouter, request, url, executeRouter, cont
 		params: rawParams,
 		pathname,
 		handlerType: "router"
-	}, request.signal, terminalNext));
+	}, signal, event, terminalNext));
 }
 var VIRTUAL_MODULES = {
 	startManifest: "tanstack-start-manifest:v",
@@ -8283,10 +7555,11 @@ var server_exports = /* @__PURE__ */ __exportAll({
 	HEADERS: () => HEADERS,
 	StartServer: () => StartServer,
 	VIRTUAL_MODULES: () => VIRTUAL_MODULES,
+	appendResponseHeader: () => appendResponseHeader,
 	attachRouterServerSsrUtils: () => attachRouterServerSsrUtils,
 	clearResponseHeaders: () => clearResponseHeaders,
-	clearSession: () => clearSession,
 	createRequestHandler: () => createRequestHandler,
+	createServerEntry: () => createServerEntry,
 	createStartHandler: () => createStartHandler,
 	defaultRenderHandler: () => defaultRenderHandler,
 	defaultStreamHandler: () => defaultStreamHandler,
@@ -8301,25 +7574,17 @@ var server_exports = /* @__PURE__ */ __exportAll({
 	getRequestIP: () => getRequestIP,
 	getRequestProtocol: () => getRequestProtocol,
 	getRequestUrl: () => getRequestUrl,
-	getResponse: () => getResponse,
 	getResponseHeader: () => getResponseHeader,
 	getResponseHeaders: () => getResponseHeaders,
 	getResponseStatus: () => getResponseStatus,
-	getSession: () => getSession,
-	getValidatedQuery: () => getValidatedQuery,
+	handleStartError: () => handleStartError,
 	removeResponseHeader: () => removeResponseHeader,
-	requestHandler: () => requestHandler,
-	sealSession: () => sealSession,
 	setCookie: () => setCookie,
 	setResponseHeader: () => setResponseHeader,
 	setResponseHeaders: () => setResponseHeaders,
 	setResponseStatus: () => setResponseStatus,
-	transferResponseBodyOwnership: () => transferResponseBodyOwnership,
 	transformPipeableStreamWithRouter: () => transformPipeableStreamWithRouter,
-	transformReadableStreamWithRouter: () => transformReadableStreamWithRouter,
-	unsealSession: () => unsealSession,
-	updateSession: () => updateSession,
-	useSession: () => useSession
+	transformReadableStreamWithRouter: () => transformReadableStreamWithRouter
 });
 //#endregion
-export { defaultStreamHandler as i, createStartHandler as n, getRequest as r, server_exports as t };
+export { defaultStreamHandler as a, getRequest as i, createStartHandler as n, createServerEntry as r, server_exports as t };