@pwa-platform/sw-runtime 0.1.0-beta.0

package/dist/recovery-worker/index.js

@@ -0,0 +1,60 @@
+// Recovery worker (service worker scope): activates at once, deletes this app's caches and offline-write database, then claims clients.
+// It imports no package, so the recovery artifact never carries Workbox or a fetch listener.
+import { validateRecoveryWorkerConfig } from "../shared/config.js";
+/**
+ * Registers the recovery worker (ADR-0005): it takes over immediately only after it removes every cache and the
+ * identity-derived offline-write database of this app in this environment, then serves nothing, so page requests go
+ * straight to the network. On activation it also cancels this registration's push subscription, after deletion and
+ * before claiming clients, so the business backend starts seeing failed sends and can clean up (ADR-0021, "对
+ * ADR-0012 的修订").
+ *
+ * It registers only `install` and `activate`; it never registers `fetch`, `push` or `notificationclick`, never opens
+ * a cache and never deletes a cache outside `config.appCachePrefix`.
+ */
+export function registerRecoveryWorker({ scope, config }) {
+    const { appCachePrefix, offlineWriteDatabaseName } = validateRecoveryWorkerConfig(config);
+    scope.addEventListener("install", (event) => {
+        // Recovery never waits for a reload: the broken worker must stop controlling pages as soon as possible.
+        event.waitUntil(scope.skipWaiting());
+    });
+    scope.addEventListener("activate", (event) => {
+        event.waitUntil(recover(scope, appCachePrefix, offlineWriteDatabaseName));
+    });
+}
+/**
+ * Deletes this app's caches and identity-derived queue database, cancels this registration's push subscription (if
+ * any), then claims the open clients so they stop being controlled by the broken worker. Cancelling the subscription
+ * never blocks deletion or takeover: it runs after deletion and before claim, and its own failure is swallowed.
+ */
+async function recover(scope, appCachePrefix, offlineWriteDatabaseName) {
+    for (const name of await scope.caches.keys()) {
+        if (name.startsWith(appCachePrefix))
+            await scope.caches.delete(name);
+    }
+    await deleteOfflineWriteDatabase(offlineWriteDatabaseName);
+    await cancelPushSubscription(scope);
+    await scope.clients.claim();
+}
+/** Rejects on failure or blocked deletion so recovery does not take control while sensitive queue data remains. */
+function deleteOfflineWriteDatabase(name) {
+    return new Promise((resolve, reject) => {
+        const request = indexedDB.deleteDatabase(name);
+        request.onsuccess = () => resolve();
+        request.onerror = () => reject(request.error ?? new Error("offline-write database deletion failed"));
+        request.onblocked = () => reject(new Error("offline-write database deletion blocked"));
+    });
+}
+/** Best-effort: environments without a `pushManager` are skipped, and any rejection here is swallowed (ADR-0021). */
+async function cancelPushSubscription(scope) {
+    if (!("pushManager" in scope.registration))
+        return;
+    try {
+        const subscription = await scope.registration.pushManager.getSubscription();
+        if (subscription !== null)
+            await subscription.unsubscribe();
+    }
+    catch {
+        // Swallowed: cancelling the subscription must never block cache deletion or client takeover.
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/recovery-worker/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/recovery-worker/index.ts"],"names":[],"mappings":"AAAA,wIAAwI;AACxI,6FAA6F;AAC7F,OAAO,EAAE,4BAA4B,EAAgC,MAAM,qBAAqB,CAAC;AAQjG;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAE,KAAK,EAAE,MAAM,EAA4B;IAChF,MAAM,EAAE,cAAc,EAAE,wBAAwB,EAAE,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;IAE1F,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;QAC1C,wGAAwG;QACxG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE;QAC3C,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CAAC,KAA+B,EAAE,cAAsB,EAAE,wBAAgC;IAC9G,KAAK,MAAM,IAAI,IAAI,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,0BAA0B,CAAC,wBAAwB,CAAC,CAAC;IAC3D,MAAM,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED,mHAAmH;AACnH,SAAS,0BAA0B,CAAC,IAAY;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,SAAS,GAAG,GAAS,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1C,OAAO,CAAC,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC,CAAC;QAC3G,OAAO,CAAC,SAAS,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qHAAqH;AACrH,KAAK,UAAU,sBAAsB,CAAC,KAA+B;IACnE,IAAI,CAAC,CAAC,aAAa,IAAI,KAAK,CAAC,YAAY,CAAC;QAAE,OAAO;IACnD,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;QAC5E,IAAI,YAAY,KAAK,IAAI;YAAE,MAAM,YAAY,CAAC,WAAW,EAAE,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;IAC/F,CAAC;AACH,CAAC"}

package/dist/shared/config.d.ts

@@ -0,0 +1,71 @@
+/** contracts' `REQUEST_BASELINE_DENIALS`, in the same canonical order (a unit test keeps them equal). */
+export declare const WORKER_BASELINE_DENIALS: readonly ["non-get", "cross-origin", "no-store", "opaque-response", "redirect", "websocket", "unclassified"];
+/**
+ * `"exclude"` and `"deny"` followed by contracts' `CACHE_STRATEGIES` (a unit test keeps them equal). `"exclude"` only
+ * appears in a shared-origin root app's plan, once per child scope (ADR-0019).
+ */
+export declare const WORKER_PATH_RULE_ACTIONS: readonly ["exclude", "deny", "none", "cache-first", "network-first", "stale-while-revalidate"];
+export type PwaWorkerBaselineDenial = (typeof WORKER_BASELINE_DENIALS)[number];
+export type PwaWorkerPathRuleAction = (typeof WORKER_PATH_RULE_ACTIONS)[number];
+export type PwaWorkerPath = `/${string}`;
+export type PwaWorkerPathRule = {
+    /** Canonical absolute path prefix, in the plan's spelling. */
+    readonly pathPrefix: PwaWorkerPath;
+    readonly action: PwaWorkerPathRuleAction;
+};
+export type PwaWorkerOfflineWriteTarget = {
+    readonly id: string;
+    readonly pathPrefix: PwaWorkerPath;
+    readonly maxBodyBytes: number;
+};
+export type PwaWorkerOfflineWrites = {
+    readonly enabled: false;
+} | {
+    readonly enabled: true;
+    readonly databaseName: string;
+    readonly maxEntries: number;
+    readonly maxTotalBodyBytes: number;
+    readonly targets: readonly PwaWorkerOfflineWriteTarget[];
+};
+export type PwaPlatformWorkerConfig = {
+    readonly kind: "platform";
+    readonly version: 1;
+    /** Audit only: the worker derives its origin from `scope.location`, so nothing reads this field at runtime. */
+    readonly scope: PwaWorkerPath;
+    /** contracts `cacheName(identity, "precache")`. */
+    readonly precacheCacheName: string;
+    /**
+     * Audit only: the request-level denials are enforced by the decision table itself and the response-level ones
+     * govern runtime caching, which v1 does not do. Validation still requires this list to equal
+     * `WORKER_BASELINE_DENIALS` exactly, so adding a denial in contracts without updating that constant makes an
+     * already published worker fail to start — a deliberate fail-closed coupling, kept in step by a unit test.
+     */
+    readonly requestBaselineDenials: readonly PwaWorkerBaselineDenial[];
+    /** In plan order: the first matching rule applies. */
+    readonly pathRules: readonly PwaWorkerPathRule[];
+    readonly offlineFallback: {
+        readonly enabled: false;
+    } | {
+        readonly enabled: true;
+        readonly path: PwaWorkerPath;
+    };
+    readonly updateMode: "prompt";
+    /** Closed configuration for explicit offline writes; `false` for every v1 plan. */
+    readonly offlineWrites: PwaWorkerOfflineWrites;
+};
+export type PwaRecoveryWorkerConfig = {
+    readonly kind: "recovery";
+    readonly version: 1;
+    /** contracts `appCachePrefix(identity)`: every cache of this app in this environment, across identity revisions. */
+    readonly appCachePrefix: string;
+    /** The only IndexedDB database recovery may delete: derived from this exact app identity. */
+    readonly offlineWriteDatabaseName: string;
+};
+export type PwaWorkerConfig = PwaPlatformWorkerConfig | PwaRecoveryWorkerConfig;
+/** Validates a platform worker config and returns a fresh copy with keys in canonical order. Messages name fields only. */
+export declare function validatePlatformWorkerConfig(value: unknown): PwaPlatformWorkerConfig;
+/** Validates a recovery worker config and returns a fresh copy with keys in canonical order. Messages name fields only. */
+export declare function validateRecoveryWorkerConfig(value: unknown): PwaRecoveryWorkerConfig;
+/** Validates either config, selected by its `kind`. */
+export declare function validateWorkerConfig(value: unknown): PwaWorkerConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/shared/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/shared/config.ts"],"names":[],"mappings":"AAGA,yGAAyG;AACzG,eAAO,MAAM,uBAAuB,8GAQ1B,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,wBAAwB,gGAAiG,CAAC;AAEvI,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/E,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,aAAa,GAAG,IAAI,MAAM,EAAE,CAAC;AAEzC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;CAAE,GAC3B;IACE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,2BAA2B,EAAE,CAAC;CAC1D,CAAC;AAEN,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,+GAA+G;IAC/G,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,mDAAmD;IACnD,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,sBAAsB,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,SAAS,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAA;KAAE,GAAG;QAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;KAAE,CAAC;IACjH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;IAC9B,mFAAmF;IACnF,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,oHAAoH;IACpH,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,6FAA6F;IAC7F,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;AAwBhF,2HAA2H;AAC3H,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CA4DpF;AAED,2HAA2H;AAC3H,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,uBAAuB,CAcpF;AAED,uDAAuD;AACvD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAKpE"}

package/dist/shared/config.js

@@ -0,0 +1,216 @@
+// Worker config shapes and their validation, shared by the build-time entry and both workers. It imports nothing,
+// so the same rules run before injection and again when a worker starts.
+/** contracts' `REQUEST_BASELINE_DENIALS`, in the same canonical order (a unit test keeps them equal). */
+export const WORKER_BASELINE_DENIALS = [
+    "non-get",
+    "cross-origin",
+    "no-store",
+    "opaque-response",
+    "redirect",
+    "websocket",
+    "unclassified",
+];
+/**
+ * `"exclude"` and `"deny"` followed by contracts' `CACHE_STRATEGIES` (a unit test keeps them equal). `"exclude"` only
+ * appears in a shared-origin root app's plan, once per child scope (ADR-0019).
+ */
+export const WORKER_PATH_RULE_ACTIONS = ["exclude", "deny", "none", "cache-first", "network-first", "stale-while-revalidate"];
+// contracts escapes every segment with encodeURIComponent, so a segment never contains ":". Matching the whole
+// structure keeps a truncated prefix such as "pwa:" from ever selecting other apps' caches.
+const PRECACHE_CACHE_NAME = /^pwa:[^:]+:[^:]+:[^:]+:precache$/;
+const APP_CACHE_PREFIX = /^pwa:[^:]+:[^:]+:$/;
+const OFFLINE_WRITE_DATABASE_NAME = /^pwa-offline-write:[^:]+:[^:]+:[^:]+$/;
+const OFFLINE_WRITE_ID = /^[a-z][a-z0-9-]{0,63}$/;
+// Only used to check the form of paths; never requested.
+const PATH_BASE = "https://sw-runtime.invalid";
+const PLATFORM_KEYS = [
+    "kind",
+    "version",
+    "scope",
+    "precacheCacheName",
+    "requestBaselineDenials",
+    "pathRules",
+    "offlineFallback",
+    "updateMode",
+    "offlineWrites",
+];
+const RECOVERY_KEYS = ["kind", "version", "appCachePrefix", "offlineWriteDatabaseName"];
+/** Validates a platform worker config and returns a fresh copy with keys in canonical order. Messages name fields only. */
+export function validatePlatformWorkerConfig(value) {
+    const config = plainObject(value, "config");
+    exactKeys(config, PLATFORM_KEYS, "config");
+    if (config["kind"] !== "platform")
+        fail('config.kind must be "platform"');
+    if (config["version"] !== 1)
+        fail("config.version must be 1");
+    const scope = canonicalPath(config["scope"], "config.scope");
+    if (!scope.endsWith("/"))
+        fail('config.scope must end with "/"');
+    const precacheCacheName = config["precacheCacheName"];
+    if (typeof precacheCacheName !== "string" || !PRECACHE_CACHE_NAME.test(precacheCacheName)) {
+        fail('config.precacheCacheName must have the form "pwa:<app>:<environment>:<seed>:precache"');
+    }
+    const denials = config["requestBaselineDenials"];
+    const completeDenials = Array.isArray(denials) &&
+        denials.length === WORKER_BASELINE_DENIALS.length &&
+        WORKER_BASELINE_DENIALS.every((denial, index) => denials[index] === denial);
+    if (!completeDenials)
+        fail("config.requestBaselineDenials must list every baseline denial once, in canonical order");
+    const rules = config["pathRules"];
+    if (!Array.isArray(rules))
+        fail("config.pathRules must be an array");
+    const pathRules = rules.map((entry, index) => {
+        const label = `config.pathRules[${index}]`;
+        const rule = plainObject(entry, label);
+        exactKeys(rule, ["pathPrefix", "action"], label);
+        const pathPrefix = canonicalPath(rule["pathPrefix"], `${label}.pathPrefix`);
+        const action = rule["action"];
+        if (!WORKER_PATH_RULE_ACTIONS.some((known) => known === action))
+            fail(`${label}.action must be "exclude", "deny" or a cache strategy`);
+        return { pathPrefix, action: action };
+    });
+    const fallback = plainObject(config["offlineFallback"], "config.offlineFallback");
+    let offlineFallback;
+    if (fallback["enabled"] === false) {
+        exactKeys(fallback, ["enabled"], "config.offlineFallback");
+        offlineFallback = { enabled: false };
+    }
+    else if (fallback["enabled"] === true) {
+        exactKeys(fallback, ["enabled", "path"], "config.offlineFallback");
+        offlineFallback = { enabled: true, path: canonicalPath(fallback["path"], "config.offlineFallback.path") };
+    }
+    else {
+        fail("config.offlineFallback.enabled must be true or false");
+    }
+    if (config["updateMode"] !== "prompt")
+        fail('config.updateMode must be "prompt"');
+    const offlineWrites = offlineWriteConfig(config["offlineWrites"], scope);
+    return {
+        kind: "platform",
+        version: 1,
+        scope,
+        precacheCacheName: precacheCacheName,
+        requestBaselineDenials: [...WORKER_BASELINE_DENIALS],
+        pathRules,
+        offlineFallback,
+        updateMode: "prompt",
+        offlineWrites,
+    };
+}
+/** Validates a recovery worker config and returns a fresh copy with keys in canonical order. Messages name fields only. */
+export function validateRecoveryWorkerConfig(value) {
+    const config = plainObject(value, "config");
+    exactKeys(config, RECOVERY_KEYS, "config");
+    if (config["kind"] !== "recovery")
+        fail('config.kind must be "recovery"');
+    if (config["version"] !== 1)
+        fail("config.version must be 1");
+    const appCachePrefix = config["appCachePrefix"];
+    if (typeof appCachePrefix !== "string" || !APP_CACHE_PREFIX.test(appCachePrefix)) {
+        fail('config.appCachePrefix must have the form "pwa:<app>:<environment>:"');
+    }
+    const offlineWriteDatabaseName = config["offlineWriteDatabaseName"];
+    if (typeof offlineWriteDatabaseName !== "string" || !OFFLINE_WRITE_DATABASE_NAME.test(offlineWriteDatabaseName)) {
+        fail('config.offlineWriteDatabaseName must have the form "pwa-offline-write:<app>:<environment>:<seed>"');
+    }
+    return { kind: "recovery", version: 1, appCachePrefix: appCachePrefix, offlineWriteDatabaseName };
+}
+/** Validates either config, selected by its `kind`. */
+export function validateWorkerConfig(value) {
+    const kind = plainObject(value, "config")["kind"];
+    if (kind === "platform")
+        return validatePlatformWorkerConfig(value);
+    if (kind === "recovery")
+        return validateRecoveryWorkerConfig(value);
+    return fail('config.kind must be "platform" or "recovery"');
+}
+function fail(detail) {
+    throw new Error(`Invalid sw-runtime worker config: ${detail}`);
+}
+function plainObject(value, label) {
+    const prototype = typeof value === "object" && value !== null ? Object.getPrototypeOf(value) : undefined;
+    if (Array.isArray(value) || (prototype !== Object.prototype && prototype !== null))
+        fail(`${label} must be a plain object`);
+    return value;
+}
+function exactKeys(record, keys, label) {
+    const actual = Reflect.ownKeys(record);
+    if (actual.length !== keys.length || !keys.every((key) => Object.hasOwn(record, key))) {
+        fail(`${label} must have exactly the fields ${keys.join(", ")}`);
+    }
+}
+function offlineWriteConfig(value, scope) {
+    const config = plainObject(value, "config.offlineWrites");
+    if (config["enabled"] === false) {
+        exactKeys(config, ["enabled"], "config.offlineWrites");
+        return { enabled: false };
+    }
+    if (config["enabled"] !== true)
+        fail("config.offlineWrites.enabled must be true or false");
+    exactKeys(config, ["enabled", "databaseName", "maxEntries", "maxTotalBodyBytes", "targets"], "config.offlineWrites");
+    const databaseName = config["databaseName"];
+    if (typeof databaseName !== "string" || !OFFLINE_WRITE_DATABASE_NAME.test(databaseName)) {
+        fail('config.offlineWrites.databaseName must have the form "pwa-offline-write:<app>:<environment>:<seed>"');
+    }
+    const maxEntries = boundedPositiveInteger(config["maxEntries"], 50, "config.offlineWrites.maxEntries");
+    const maxTotalBodyBytes = boundedPositiveInteger(config["maxTotalBodyBytes"], 524_288, "config.offlineWrites.maxTotalBodyBytes");
+    const rawTargets = config["targets"];
+    if (!Array.isArray(rawTargets) || rawTargets.length === 0)
+        fail("config.offlineWrites.targets must be a non-empty array");
+    const targetIds = new Set();
+    const targetPaths = new Set();
+    const targets = rawTargets.map((entry, index) => {
+        const label = `config.offlineWrites.targets[${index}]`;
+        const target = plainObject(entry, label);
+        exactKeys(target, ["id", "pathPrefix", "maxBodyBytes"], label);
+        const id = target["id"];
+        if (typeof id !== "string" || !OFFLINE_WRITE_ID.test(id))
+            fail(`${label}.id must be an ASCII slug`);
+        const pathPrefix = canonicalPath(target["pathPrefix"], `${label}.pathPrefix`);
+        if (!isWithinScope(pathPrefix, scope))
+            fail(`${label}.pathPrefix must be inside config.scope`);
+        const maxBodyBytes = boundedPositiveInteger(target["maxBodyBytes"], 16_384, `${label}.maxBodyBytes`);
+        if (targetIds.has(id))
+            fail(`${label}.id must be unique`);
+        const pathKey = decodedPathKey(pathPrefix, `${label}.pathPrefix`);
+        if (targetPaths.has(pathKey))
+            fail(`${label}.pathPrefix must be unique after URL decoding`);
+        targetIds.add(id);
+        targetPaths.add(pathKey);
+        return { id, pathPrefix, maxBodyBytes };
+    });
+    return { enabled: true, databaseName, maxEntries, maxTotalBodyBytes, targets };
+}
+function boundedPositiveInteger(value, maximum, label) {
+    if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > maximum) {
+        fail(`${label} must be an integer between 1 and ${maximum}`);
+    }
+    return value;
+}
+function isWithinScope(path, scope) {
+    return scope === "/" || path === scope.slice(0, -1) || path.startsWith(scope);
+}
+function decodedPathKey(path, label) {
+    try {
+        return path.split("/").map(decodeURIComponent).join("/");
+    }
+    catch {
+        fail(`${label} must contain valid percent escapes`);
+    }
+}
+/**
+ * The rule contracts' `isCanonicalPath` applies to plan paths: an absolute path already in WHATWG URL serialized form,
+ * without "//", backslashes, query, fragment or characters the URL parser would change.
+ */
+function canonicalPath(value, label) {
+    const canonical = typeof value === "string" &&
+        value.startsWith("/") &&
+        !value.includes("//") &&
+        !value.includes("\\") &&
+        URL.canParse(value, PATH_BASE) &&
+        new URL(value, PATH_BASE).pathname === value;
+    if (!canonical)
+        fail(`${label} must be a canonical absolute path`);
+    return value;
+}
+//# sourceMappingURL=config.js.map

package/dist/shared/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/shared/config.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,yEAAyE;AAEzE,yGAAyG;AACzG,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS;IACT,cAAc;IACd,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,WAAW;IACX,cAAc;CACN,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,CAAU,CAAC;AA6DvI,+GAA+G;AAC/G,4FAA4F;AAC5F,MAAM,mBAAmB,GAAG,kCAAkC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAC9C,MAAM,2BAA2B,GAAG,uCAAuC,CAAC;AAC5E,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,yDAAyD;AACzD,MAAM,SAAS,GAAG,4BAA4B,CAAC;AAE/C,MAAM,aAAa,GAAG;IACpB,MAAM;IACN,SAAS;IACT,OAAO;IACP,mBAAmB;IACnB,wBAAwB;IACxB,WAAW;IACX,iBAAiB;IACjB,YAAY;IACZ,eAAe;CACP,CAAC;AACX,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,0BAA0B,CAAU,CAAC;AAEjG,2HAA2H;AAC3H,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,UAAU;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAE9D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAEjE,MAAM,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,OAAO,iBAAiB,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC1F,IAAI,CAAC,uFAAuF,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACjD,MAAM,eAAe,GACnB,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACtB,OAAO,CAAC,MAAM,KAAK,uBAAuB,CAAC,MAAM;QACjD,uBAAuB,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,CAAC;IAC9E,IAAI,CAAC,eAAe;QAAE,IAAI,CAAC,wFAAwF,CAAC,CAAC;IAErH,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,KAAa,EAAqB,EAAE;QAC/E,MAAM,KAAK,GAAG,oBAAoB,KAAK,GAAG,CAAC;QAC3C,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvC,SAAS,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;YAAE,IAAI,CAAC,GAAG,KAAK,uDAAuD,CAAC,CAAC;QACvI,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAiC,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAClF,IAAI,eAA2D,CAAC;IAChE,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;QAClC,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3D,eAAe,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;SAAM,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QACxC,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,wBAAwB,CAAC,CAAC;QACnE,eAAe,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,6BAA6B,CAAC,EAAE,CAAC;IAC5G,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,sDAAsD,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAElF,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC;IAEzE,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,CAAC;QACV,KAAK;QACL,iBAAiB,EAAE,iBAA2B;QAC9C,sBAAsB,EAAE,CAAC,GAAG,uBAAuB,CAAC;QACpD,SAAS;QACT,eAAe;QACf,UAAU,EAAE,QAAQ;QACpB,aAAa;KACd,CAAC;AACJ,CAAC;AAED,2HAA2H;AAC3H,MAAM,UAAU,4BAA4B,CAAC,KAAc;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,UAAU;QAAE,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAChD,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,qEAAqE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,wBAAwB,GAAG,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACpE,IAAI,OAAO,wBAAwB,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC;QAChH,IAAI,CAAC,mGAAmG,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,cAAwB,EAAE,wBAAwB,EAAE,CAAC;AAC9G,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACpE,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,8CAA8C,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IAChD,MAAM,SAAS,GAAY,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IAC5H,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,MAA+B,EAAE,IAAuB,EAAE,KAAa;IACxF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC,GAAG,KAAK,iCAAiC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,KAAoB;IAC9D,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;QAChC,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI;QAAE,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAC3F,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAErH,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,qGAAqG,CAAC,CAAC;IAC9G,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,iCAAiC,CAAC,CAAC;IACvG,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,wCAAwC,CAAC,CAAC;IACjI,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAE1H,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAA+B,EAAE;QAC3E,MAAM,KAAK,GAAG,gCAAgC,KAAK,GAAG,CAAC;QACvD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzC,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;QACpG,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;QAC9E,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,CAAC;YAAE,IAAI,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;QAC/F,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;QACrG,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,KAAK,oBAAoB,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;QAC5F,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAc,EAAE,OAAe,EAAE,KAAa;IAC5E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;QAC1F,IAAI,CAAC,GAAG,KAAK,qCAAqC,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAmB,EAAE,KAAoB;IAC9D,OAAO,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,cAAc,CAAC,IAAmB,EAAE,KAAa;IACxD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,MAAM,SAAS,GACb,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QACrB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QACrB,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;QAC9B,IAAI,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC;IAC/C,IAAI,CAAC,SAAS;QAAE,IAAI,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IACnE,OAAO,KAAsB,CAAC;AAChC,CAAC"}

package/dist/shared/path-match.d.ts

@@ -0,0 +1,20 @@
+export type PwaPathMatcher<Rule> = {
+    /** The first rule whose prefix contains `path`, or `undefined` when no rule matches (unclassified). */
+    match(path: string): Rule | undefined;
+};
+/**
+ * Comparison key for a path, decoded per segment like the URL standard: valid `%XX` escapes become bytes, invalid
+ * escapes stay literal, and bytes that are not UTF-8 become U+FFFD. Distinct spellings can only collapse into one
+ * key, never split.
+ */
+export declare function decodedPathKey(path: string): string;
+/** Whole-segment containment of decoded keys: `/app/api/x` is within `/app/api`, `/app/apis` is not. */
+export declare function isWithinPrefix(pathKey: string, prefixKey: string): boolean;
+/**
+ * Matcher over the plan's path rules, whose order is the evaluation order. Prefix keys are decoded once, so each
+ * request only decodes its own path. The query and fragment are ignored.
+ */
+export declare function createPathMatcher<Rule extends {
+    readonly pathPrefix: string;
+}>(rules: readonly Rule[]): PwaPathMatcher<Rule>;
+//# sourceMappingURL=path-match.d.ts.map

package/dist/shared/path-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-match.d.ts","sourceRoot":"","sources":["../../src/shared/path-match.ts"],"names":[],"mappings":"AASA,MAAM,MAAM,cAAc,CAAC,IAAI,IAAI;IACjC,uGAAuG;IACvG,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKnD;AAED,wGAAwG;AACxG,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,SAAS;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAS5H"}

package/dist/shared/path-match.js

@@ -0,0 +1,56 @@
+// Runtime path matching: the same decoding and whole-segment rules policy-compiler applies when it orders rules and
+// selects precache entries (a parity test against core keeps them equal). Imports nothing, so it runs in a worker.
+// `%2F` must not become a segment boundary the URL does not have, so it is replaced by a lone surrogate: UTF-8
+// decoding never produces one, so it cannot collide with decoded text.
+const ENCODED_SLASH = "\uD800";
+const UTF8_DECODER = new TextDecoder("utf-8", { ignoreBOM: true });
+const UTF8_ENCODER = new TextEncoder();
+/**
+ * Comparison key for a path, decoded per segment like the URL standard: valid `%XX` escapes become bytes, invalid
+ * escapes stay literal, and bytes that are not UTF-8 become U+FFFD. Distinct spellings can only collapse into one
+ * key, never split.
+ */
+export function decodedPathKey(path) {
+    return path
+        .split("/")
+        .map((segment) => segment.split(/%2f/i).map(percentDecode).join(ENCODED_SLASH))
+        .join("/");
+}
+/** Whole-segment containment of decoded keys: `/app/api/x` is within `/app/api`, `/app/apis` is not. */
+export function isWithinPrefix(pathKey, prefixKey) {
+    return prefixKey === "/" || pathKey === prefixKey || pathKey.startsWith(`${prefixKey}/`);
+}
+/**
+ * Matcher over the plan's path rules, whose order is the evaluation order. Prefix keys are decoded once, so each
+ * request only decodes its own path. The query and fragment are ignored.
+ */
+export function createPathMatcher(rules) {
+    const prefixKeys = rules.map((rule) => decodedPathKey(rule.pathPrefix));
+    return {
+        match(path) {
+            const pathKey = decodedPathKey(pathOnly(path));
+            const index = prefixKeys.findIndex((prefixKey) => isWithinPrefix(pathKey, prefixKey));
+            return index === -1 ? undefined : rules[index];
+        },
+    };
+}
+function pathOnly(path) {
+    const end = path.search(/[?#]/);
+    return end === -1 ? path : path.slice(0, end);
+}
+function percentDecode(text) {
+    const bytes = [];
+    for (let index = 0; index < text.length; index += 1) {
+        const escape = text.slice(index + 1, index + 3);
+        if (text[index] === "%" && /^[0-9A-Fa-f]{2}$/.test(escape)) {
+            bytes.push(Number.parseInt(escape, 16));
+            index += 2;
+            continue;
+        }
+        const character = String.fromCodePoint(text.codePointAt(index) ?? 0);
+        bytes.push(...UTF8_ENCODER.encode(character));
+        index += character.length - 1;
+    }
+    return UTF8_DECODER.decode(Uint8Array.from(bytes));
+}
+//# sourceMappingURL=path-match.js.map

package/dist/shared/path-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-match.js","sourceRoot":"","sources":["../../src/shared/path-match.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,mHAAmH;AAEnH,+GAA+G;AAC/G,uEAAuE;AACvE,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACnE,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC;AAOvC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;SAC9E,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,SAAiB;IAC/D,OAAO,SAAS,KAAK,GAAG,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC;AAC3F,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAA+C,KAAsB;IACpG,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,OAAO;QACL,KAAK,CAAC,IAAY;YAChB,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;YACtF,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;YACxC,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9C,KAAK,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACrD,CAAC"}

package/dist/worker/decide.d.ts

@@ -0,0 +1,65 @@
+import type { PwaPlatformWorkerConfig } from "../shared/config.js";
+export type PwaPassthroughReason = 
+/** Baseline denials that are visible on the request itself. */
+"non-get" | "cross-origin"
+/**
+ * The first matching path rule is a shared-origin root's exclude rule: the path belongs to a child app on the same
+ * origin, and this worker answers nothing there — not even an offline page, unlike `denied` (ADR-0019).
+ */
+ | "excluded"
+/**
+ * The first matching path rule denies caching. A denied *navigation* is only passed through when there is no
+ * offline page to fall back to; otherwise it is a `navigate` decision whose only fallback is that page.
+ */
+ | "denied" | "unclassified"
+/** An allowed request the plan does not precache; the platform has no runtime cache in v1. */
+ | "not-precached"
+/** A URL the worker cannot parse. */
+ | "unparsable"
+/**
+ * A manifest-hit, non-navigation request that carries a `Range` header (any value). The precache stores full
+ * responses, so `engine.match` cannot answer with a genuine partial response; the network answers instead
+ * (ADR-0023). Only used where the decision would otherwise be `precache`: a denied, excluded, unclassified or
+ * not-precached request keeps its own reason.
+ */
+ | "range";
+export type PwaRequestDecision = 
+/** The worker does not call `respondWith`: the request behaves exactly as it would without a worker. */
+{
+    readonly kind: "passthrough";
+    readonly reason: PwaPassthroughReason;
+}
+/** Read this exact manifest URL from the precache. */
+ | {
+    readonly kind: "precache";
+    readonly manifestUrl: string;
+}
+/**
+ * Network first; only when the network fails, try `fallbacks` in order, then fail. Nothing is ever written to a
+ * cache on this path, whatever the network returns.
+ */
+ | {
+    readonly kind: "navigate";
+    readonly fallbacks: readonly string[];
+};
+export type PwaRequestInput = {
+    readonly method: string;
+    /** Absolute request URL. */
+    readonly url: string;
+    /** `request.mode === "navigate"`. */
+    readonly navigation: boolean;
+    /** `request.headers.has("range")`, whatever the header's value. Ignored for navigations (ADR-0023). */
+    readonly range: boolean;
+};
+export type PwaRouterOptions = {
+    readonly config: PwaPlatformWorkerConfig;
+    /** The injected manifest's URLs, as the engine reports them (paths, without a query). */
+    readonly manifestUrls: readonly string[];
+    /** The worker's own origin; every other origin is a baseline denial. */
+    readonly origin: string;
+};
+export type PwaRouter = {
+    decide(request: PwaRequestInput): PwaRequestDecision;
+};
+export declare function createRouter({ config, manifestUrls, origin }: PwaRouterOptions): PwaRouter;
+//# sourceMappingURL=decide.d.ts.map

package/dist/worker/decide.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.d.ts","sourceRoot":"","sources":["../../src/worker/decide.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAGnE,MAAM,MAAM,oBAAoB;AAC9B,+DAA+D;AAC7D,SAAS,GACT,cAAc;AAChB;;;GAGG;GACD,UAAU;AACZ;;;GAGG;GACD,QAAQ,GACR,cAAc;AAChB,8FAA8F;GAC5F,eAAe;AACjB,qCAAqC;GACnC,YAAY;AACd;;;;;GAKG;GACD,OAAO,CAAC;AAEZ,MAAM,MAAM,kBAAkB;AAC5B,wGAAwG;AACtG;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE;AACzE,sDAAsD;GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AAC7D;;;GAGG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEzE,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4BAA4B;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,uGAAuG;IACvG,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,yFAAyF;IACzF,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IAAE,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,kBAAkB,CAAA;CAAE,CAAC;AAIjF,wBAAgB,YAAY,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,gBAAgB,GAAG,SAAS,CAmC1F"}

package/dist/worker/decide.js

@@ -0,0 +1,65 @@
+import { createPathMatcher } from "../shared/path-match.js";
+const PASSTHROUGH = (reason) => ({ kind: "passthrough", reason });
+export function createRouter({ config, manifestUrls, origin }) {
+    const matcher = createPathMatcher(config.pathRules);
+    const manifest = new Set(manifestUrls);
+    return {
+        decide({ method, url, navigation, range }) {
+            if (method !== "GET")
+                return PASSTHROUGH("non-get");
+            if (!URL.canParse(url))
+                return PASSTHROUGH("unparsable");
+            const requested = new URL(url);
+            if (requested.origin !== origin)
+                return PASSTHROUGH("cross-origin");
+            const rule = matcher.match(requested.pathname);
+            if (rule === undefined)
+                return PASSTHROUGH("unclassified");
+            // Checked before `deny` on purpose: a denied navigation may fall back to the offline page, an excluded one never
+            // may — that page belongs to this app, and the excluded path belongs to another app on the same origin.
+            if (rule.action === "exclude")
+                return PASSTHROUGH("excluded");
+            if (rule.action === "deny") {
+                // A denied navigation still never touches a cache: the network answers whenever it responds at all, and only
+                // a failed request falls back — to the offline page, never to anything cached for this path, since a
+                // denied path has nothing in the precache (ADR-0012, 2026-09-17 amendment). Without an offline page there
+                // is nothing to offer, so the worker stays out of the way exactly as before.
+                const offline = navigation ? offlineFallback(config, manifest) : undefined;
+                return offline === undefined ? PASSTHROUGH("denied") : { kind: "navigate", fallbacks: [offline] };
+            }
+            // The manifest is the precache's membership list, so the decision stays synchronous; the query string is part
+            // of the key, so `?utm=…` variants of a precached URL are not precached themselves.
+            const exact = `${requested.pathname}${requested.search}`;
+            if (navigation)
+                return { kind: "navigate", fallbacks: navigationFallbacks(config, manifest, requested) };
+            if (!manifest.has(exact))
+                return PASSTHROUGH("not-precached");
+            // The precache holds full responses, so a Range request would otherwise get a full 200 body instead of a 206;
+            // stepping aside here lets the network answer it directly (ADR-0023). Navigations never look at range.
+            return range ? PASSTHROUGH("range") : { kind: "precache", manifestUrl: exact };
+        },
+    };
+}
+/**
+ * What an offline navigation may fall back to, in order: the requested URL itself, the same route's `index.html`,
+ * and finally the plan's offline fallback page. Nothing else: no other route's cached content may answer a
+ * navigation.
+ *
+ * The route's `index.html` is tried for URLs with and without a trailing slash. Frameworks that prerender write
+ * `about/index.html` but link to `/about` (Nuxt does by default), and a static host serves both spellings from that
+ * one file, so both name the same route (ADR-0012, 2026-09-17 amendment). The query string stays part of every key.
+ */
+function navigationFallbacks(config, manifest, requested) {
+    const { pathname, search } = requested;
+    const candidates = [`${pathname}${search}`];
+    candidates.push(pathname.endsWith("/") ? `${pathname}index.html${search}` : `${pathname}/index.html${search}`);
+    const offline = offlineFallback(config, manifest);
+    if (offline !== undefined)
+        candidates.push(offline);
+    return [...new Set(candidates.filter((candidate) => manifest.has(candidate)))];
+}
+/** The offline page, when the plan enables one and the precache holds it. */
+function offlineFallback(config, manifest) {
+    return config.offlineFallback.enabled && manifest.has(config.offlineFallback.path) ? config.offlineFallback.path : undefined;
+}
+//# sourceMappingURL=decide.js.map

package/dist/worker/decide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide.js","sourceRoot":"","sources":["../../src/worker/decide.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AA4D5D,MAAM,WAAW,GAAG,CAAC,MAA4B,EAAsB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;AAE5G,MAAM,UAAU,YAAY,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAoB;IAC7E,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAEvC,OAAO;QACL,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE;YACvC,IAAI,MAAM,KAAK,KAAK;gBAAE,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,WAAW,CAAC,YAAY,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC;YAEpE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,WAAW,CAAC,cAAc,CAAC,CAAC;YAC3D,iHAAiH;YACjH,wGAAwG;YACxG,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC;YAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3B,6GAA6G;gBAC7G,qGAAqG;gBACrG,0GAA0G;gBAC1G,6EAA6E;gBAC7E,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC3E,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YACpG,CAAC;YAED,8GAA8G;YAC9G,oFAAoF;YACpF,MAAM,KAAK,GAAG,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;YACzD,IAAI,UAAU;gBAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;YACzG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;YAC9D,8GAA8G;YAC9G,uGAAuG;YACvG,OAAO,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,MAA+B,EAAE,QAA6B,EAAE,SAAc;IACzG,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACvC,MAAM,UAAU,GAAG,CAAC,GAAG,QAAQ,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5C,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,aAAa,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,cAAc,MAAM,EAAE,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,MAA+B,EAAE,QAA6B;IACrF,OAAO,MAAM,CAAC,eAAe,CAAC,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/H,CAAC"}

package/dist/worker/handlers.d.ts

@@ -0,0 +1,16 @@
+import type { PwaPrecacheEngine } from "@pwa-platform/engine-workbox/worker";
+import type { PwaPlatformWorkerConfig } from "../shared/config.js";
+export type PwaPlatformWorkerHandlers = {
+    readonly scope: ServiceWorkerGlobalScope;
+    /** Already validated by `registerPlatformWorker`. */
+    readonly config: PwaPlatformWorkerConfig;
+    readonly engine: PwaPrecacheEngine;
+};
+/**
+ * Registers `install`, `activate`, `fetch`, `message`, `push` and `notificationclick`, and nothing else. The worker
+ * never calls `skipWaiting` on its own (updates are prompted) and never claims clients. `push` and
+ * `notificationclick` are always on: see ADR-0021 for why a fixed pair of listeners has no observable effect on an
+ * application that never subscribes to push.
+ */
+export declare function attachPlatformWorker({ scope, config, engine }: PwaPlatformWorkerHandlers): void;
+//# sourceMappingURL=handlers.d.ts.map

package/dist/worker/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/worker/handlers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAI7E,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAOnE,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;IACzC,qDAAqD;IACrD,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;CACpC,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,yBAAyB,GAAG,IAAI,CAmE/F"}