@reckona/mreact-router 0.0.202 → 0.0.204

package/dist/node-server.js

@@ -1,6 +1,7 @@
 import { createServer } from "node:http";
 import { nodeRequestToWebRequest, sendResponse } from "./http.js";
 import { emitRouterLog, logDurationMs, logError, logNow, nodeRequestPath, requestLogFields, } from "./logger.js";
+import { assertValidHttpUpgradeOriginPolicy, closeServerWithUpgrades, createManagedHttpUpgradeLifecycle, validateHttpUpgradeOrigin, } from "./upgrade.js";
 export function resolveNodeRequestProtocol(options) {
     if (options.encrypted) {
         return "https";
@@ -15,6 +16,10 @@ export function resolveNodeRequestProtocol(options) {
     return first === "https" ? "https" : "http";
 }
 export async function startNodeRequestServer(options) {
+    const upgradeCloseTimeoutMs = finiteNonNegativeTimeout(options.upgradeCloseTimeoutMs, 1_000, "upgradeCloseTimeoutMs");
+    const upgradeDecisionTimeoutMs = finiteNonNegativeTimeout(options.upgradeDecisionTimeoutMs, 1_000, "upgradeDecisionTimeoutMs");
+    assertValidHttpUpgradeOriginPolicy(options.upgradeOriginPolicy);
+    let listeningPort = options.port;
     const server = createServer(async (incoming, outgoing) => {
         const startedAt = logNow();
         const fallbackRequestFields = {
@@ -23,7 +28,7 @@ export async function startNodeRequestServer(options) {
             runtime: "node",
         };
         try {
-            const fallbackHost = `${options.hostname ?? "127.0.0.1"}:${options.port}`;
+            const fallbackHost = formatNodeAuthority(options.hostname ?? "127.0.0.1", options.port);
             const host = (options.resolveHost ?? defaultResolveRequestHost)({
                 allowedHosts: options.allowedHosts,
                 fallbackHost,
@@ -35,7 +40,7 @@ export async function startNodeRequestServer(options) {
                 forwardedProto: incoming.headers["x-forwarded-proto"],
                 trustForwardedProto: options.trustForwardedProto,
             });
-            const request = nodeRequestToWebRequest(incoming, `${protocol}://${host}`);
+            const request = nodeRequestToWebRequest(incoming, `${protocol}://${host}`, outgoing);
             const logFields = requestLogFields(request, "node");
             emitRouterLog(options.logger, "info", {
                 ...logFields,
@@ -75,18 +80,82 @@ export async function startNodeRequestServer(options) {
             outgoing.end(payload.body);
         }
     });
-    if (options.onUpgrade !== undefined) {
-        server.on("upgrade", options.onUpgrade);
+    const upgradeLifecycle = options.onUpgrade === undefined
+        ? undefined
+        : createManagedHttpUpgradeLifecycle({
+            decisionTimeoutMs: upgradeDecisionTimeoutMs,
+            handler: options.onUpgrade,
+            isOriginAllowed: (request) => validateNodeUpgradeOrigin(request, {
+                ...options,
+                listeningPort,
+            }),
+            logger: options.logger,
+        });
+    if (upgradeLifecycle !== undefined) {
+        server.on("upgrade", upgradeLifecycle.handle);
     }
     await new Promise((resolve) => server.listen(options.port, options.hostname ?? "127.0.0.1", resolve));
     const address = server.address();
     const port = typeof address === "object" && address !== null ? address.port : options.port;
+    listeningPort = port;
+    let closePromise;
     return {
         server,
-        url: `http://${options.hostname ?? "127.0.0.1"}:${port}`,
-        close: () => new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve()))),
+        url: `http://${formatNodeAuthority(options.hostname ?? "127.0.0.1", port)}`,
+        close: () => {
+            closePromise ??=
+                upgradeLifecycle === undefined
+                    ? new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())))
+                    : closeServerWithUpgrades({
+                        lifecycle: upgradeLifecycle,
+                        server,
+                        timeoutMs: upgradeCloseTimeoutMs,
+                    });
+            return closePromise;
+        },
     };
 }
+function validateNodeUpgradeOrigin(request, options) {
+    const policy = options.upgradeOriginPolicy ?? "same-origin";
+    if (policy === "unchecked") {
+        return { ok: true, origin: request.headers.origin };
+    }
+    if (typeof policy === "object") {
+        return validateHttpUpgradeOrigin(request, policy);
+    }
+    const fallbackHost = formatNodeAuthority(options.hostname ?? "127.0.0.1", options.listeningPort);
+    const host = (options.resolveHost ?? defaultResolveRequestHost)({
+        allowedHosts: options.allowedHosts,
+        fallbackHost,
+        hostPolicy: options.hostPolicy,
+        rawHost: request.headers.host,
+    });
+    const protocol = resolveNodeRequestProtocol({
+        encrypted: request.socket.encrypted === true,
+        forwardedProto: request.headers["x-forwarded-proto"],
+        trustForwardedProto: options.trustForwardedProto,
+    });
+    try {
+        return validateHttpUpgradeOrigin(request, { allowedOrigins: [`${protocol}://${host}`] });
+    }
+    catch {
+        return { ok: false, reason: "malformed-origin" };
+    }
+}
+function formatNodeAuthority(hostname, port) {
+    const host = hostname.includes(":") && !hostname.startsWith("[") ? `[${hostname}]` : hostname;
+    return `${host}:${port}`;
+}
+function finiteNonNegativeTimeout(value, fallback, name) {
+    const timeout = value ?? fallback;
+    if (!Number.isFinite(timeout) ||
+        timeout < 0 ||
+        !Number.isSafeInteger(timeout) ||
+        timeout > 2_147_483_647) {
+        throw new TypeError(`${name} must be a finite non-negative safe integer no greater than 2147483647.`);
+    }
+    return timeout;
+}
 function defaultResolveRequestHost(options) {
     const raw = options.rawHost;
     if (raw === undefined || raw === "")

package/dist/node-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-server.js","sourceRoot":"","sources":["../src/node-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EACL,aAAa,EACb,aAAa,EACb,QAAQ,EACR,MAAM,EACN,eAAe,EACf,gBAAgB,GAEjB,MAAM,aAAa,CAAC;AAyBrB,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC3B,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAsC;IAEtC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;QAC3B,MAAM,qBAAqB,GAAG;YAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,KAAK;YAChC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;YACnC,OAAO,EAAE,MAAe;SACzB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,WAAW,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1E,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,yBAAyB,CAAC,CAAC;gBAC9D,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,YAAY;gBACZ,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI;aAC/B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,0BAA0B,CAAC;gBAC1C,SAAS,EAAG,QAAQ,CAAC,MAAkC,CAAC,SAAS,KAAK,IAAI;gBAC1E,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC;gBACrD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;aACjD,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,EAAE,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC;YAC3E,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACpD,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE;gBACpC,GAAG,SAAS;gBACZ,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE;gBACpC,GAAG,SAAS;gBACZ,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC;gBACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,oBAAoB;aAC3B,CAAC,CAAC;YAEH,MAAM,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kEAAkE;YAClE,yDAAyD;YACzD,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;gBACrC,GAAG,qBAAqB;gBACxB,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC;gBACpC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;gBACtB,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY;gBAClC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;gBAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACnD,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;YACrC,QAAQ,CAAC,SAAS,CAChB,cAAc,EACd,OAAO,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,IAAI,2BAA2B,CACjE,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;gBAClE,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;oBAAE,SAAS;gBACpD,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,EAAE,OAAO,CAAC,CACtE,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAE3F,OAAO;QACL,MAAM;QACN,GAAG,EAAE,UAAU,OAAO,CAAC,QAAQ,IAAI,WAAW,IAAI,IAAI,EAAE;QACxD,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACpC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC7D;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,OAKlC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC;IACjE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,CAAC;IACD,OAAO,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;AACzE,CAAC","sourcesContent":["import { createServer, type Server } from \"node:http\";\nimport { nodeRequestToWebRequest, sendResponse } from \"./http.js\";\nimport {\n  emitRouterLog,\n  logDurationMs,\n  logError,\n  logNow,\n  nodeRequestPath,\n  requestLogFields,\n  type AppRouterLogger,\n} from \"./logger.js\";\nimport type { HttpUpgradeHandler } from \"./upgrade.js\";\n\nexport interface StartNodeRequestServerOptions {\n  allowedHosts?: readonly string[] | undefined;\n  errorHandler?: ((error: unknown) => {\n    body: string;\n    status: number;\n    headers?: Record<string, string>;\n  }) | undefined;\n  hostname?: string | undefined;\n  hostPolicy?: \"strict\" | \"trusted-proxy\" | undefined;\n  logger?: AppRouterLogger | undefined;\n  onUpgrade?: HttpUpgradeHandler | undefined;\n  port: number;\n  render(request: Request): Promise<Response>;\n  resolveHost?: ((options: {\n    allowedHosts?: readonly string[] | undefined;\n    fallbackHost: string;\n    hostPolicy?: \"strict\" | \"trusted-proxy\" | undefined;\n    rawHost: string | undefined;\n  }) => string) | undefined;\n  trustForwardedProto?: boolean | undefined;\n}\n\nexport function resolveNodeRequestProtocol(options: {\n  encrypted: boolean;\n  forwardedProto: string | readonly string[] | undefined;\n  trustForwardedProto?: boolean | undefined;\n}): \"http\" | \"https\" {\n  if (options.encrypted) {\n    return \"https\";\n  }\n\n  if (options.trustForwardedProto !== true) {\n    return \"http\";\n  }\n\n  const forwarded = Array.isArray(options.forwardedProto)\n    ? options.forwardedProto[0]\n    : options.forwardedProto;\n  const first = forwarded?.split(\",\", 1)[0]?.trim().toLowerCase();\n  return first === \"https\" ? \"https\" : \"http\";\n}\n\nexport async function startNodeRequestServer(\n  options: StartNodeRequestServerOptions,\n): Promise<{ close(): Promise<void>; server: Server; url: string }> {\n  const server = createServer(async (incoming, outgoing) => {\n    const startedAt = logNow();\n    const fallbackRequestFields = {\n      method: incoming.method ?? \"GET\",\n      path: nodeRequestPath(incoming.url),\n      runtime: \"node\" as const,\n    };\n\n    try {\n      const fallbackHost = `${options.hostname ?? \"127.0.0.1\"}:${options.port}`;\n      const host = (options.resolveHost ?? defaultResolveRequestHost)({\n        allowedHosts: options.allowedHosts,\n        fallbackHost,\n        hostPolicy: options.hostPolicy,\n        rawHost: incoming.headers.host,\n      });\n      const protocol = resolveNodeRequestProtocol({\n        encrypted: (incoming.socket as { encrypted?: boolean }).encrypted === true,\n        forwardedProto: incoming.headers[\"x-forwarded-proto\"],\n        trustForwardedProto: options.trustForwardedProto,\n      });\n      const request = nodeRequestToWebRequest(incoming, `${protocol}://${host}`);\n      const logFields = requestLogFields(request, \"node\");\n      emitRouterLog(options.logger, \"info\", {\n        ...logFields,\n        type: \"router:request:start\",\n      });\n      const response = await options.render(request);\n      emitRouterLog(options.logger, \"info\", {\n        ...logFields,\n        durationMs: logDurationMs(startedAt),\n        status: response.status,\n        type: \"router:request:end\",\n      });\n\n      await sendResponse(outgoing, response);\n    } catch (error) {\n      // Log the full stack to stderr for operator visibility; never put\n      // it in the response body where attackers can scrape it.\n      emitRouterLog(options.logger, \"error\", {\n        ...fallbackRequestFields,\n        durationMs: logDurationMs(startedAt),\n        error: logError(error),\n        type: \"router:request:error\",\n      });\n      if (options.logger === undefined) {\n        console.error(\"[mreact] startServer request failed:\", error);\n      }\n      const payload = options.errorHandler\n        ? options.errorHandler(error)\n        : { body: \"Internal Server Error\", status: 500 };\n      outgoing.statusCode = payload.status;\n      outgoing.setHeader(\n        \"content-type\",\n        payload.headers?.[\"content-type\"] ?? \"text/plain; charset=utf-8\",\n      );\n      for (const [name, value] of Object.entries(payload.headers ?? {})) {\n        if (name.toLowerCase() === \"content-type\") continue;\n        outgoing.setHeader(name, value);\n      }\n      outgoing.end(payload.body);\n    }\n  });\n\n  if (options.onUpgrade !== undefined) {\n    server.on(\"upgrade\", options.onUpgrade);\n  }\n\n  await new Promise<void>((resolve) =>\n    server.listen(options.port, options.hostname ?? \"127.0.0.1\", resolve),\n  );\n  const address = server.address();\n  const port = typeof address === \"object\" && address !== null ? address.port : options.port;\n\n  return {\n    server,\n    url: `http://${options.hostname ?? \"127.0.0.1\"}:${port}`,\n    close: () =>\n      new Promise<void>((resolve, reject) =>\n        server.close((error) => (error ? reject(error) : resolve())),\n      ),\n  };\n}\n\nfunction defaultResolveRequestHost(options: {\n  allowedHosts?: readonly string[] | undefined;\n  fallbackHost: string;\n  hostPolicy?: \"strict\" | \"trusted-proxy\" | undefined;\n  rawHost: string | undefined;\n}): string {\n  const raw = options.rawHost;\n  if (raw === undefined || raw === \"\") return options.fallbackHost;\n  if (options.allowedHosts === undefined) {\n    return options.hostPolicy === \"strict\" ? options.fallbackHost : raw;\n  }\n  return options.allowedHosts.includes(raw) ? raw : options.fallbackHost;\n}\n"]}
+{"version":3,"file":"node-server.js","sourceRoot":"","sources":["../src/node-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAClE,OAAO,EACL,aAAa,EACb,aAAa,EACb,QAAQ,EACR,MAAM,EACN,eAAe,EACf,gBAAgB,GAEjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kCAAkC,EAClC,uBAAuB,EACvB,iCAAiC,EACjC,yBAAyB,GAI1B,MAAM,cAAc,CAAC;AA+BtB,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACzC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC;QACrD,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC3B,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC3B,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAsC;IAEtC,MAAM,qBAAqB,GAAG,wBAAwB,CACpD,OAAO,CAAC,qBAAqB,EAC7B,KAAK,EACL,uBAAuB,CACxB,CAAC;IACF,MAAM,wBAAwB,GAAG,wBAAwB,CACvD,OAAO,CAAC,wBAAwB,EAChC,KAAK,EACL,0BAA0B,CAC3B,CAAC;IACF,kCAAkC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChE,IAAI,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;QACvD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;QAC3B,MAAM,qBAAqB,GAAG;YAC5B,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,KAAK;YAChC,IAAI,EAAE,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;YACnC,OAAO,EAAE,MAAe;SACzB,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,IAAI,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,yBAAyB,CAAC,CAAC;gBAC9D,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,YAAY;gBACZ,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI;aAC/B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,0BAA0B,CAAC;gBAC1C,SAAS,EAAG,QAAQ,CAAC,MAAkC,CAAC,SAAS,KAAK,IAAI;gBAC1E,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC;gBACrD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;aACjD,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,uBAAuB,CAAC,QAAQ,EAAE,GAAG,QAAQ,MAAM,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;YACrF,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACpD,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE;gBACpC,GAAG,SAAS;gBACZ,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE;gBACpC,GAAG,SAAS;gBACZ,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC;gBACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,IAAI,EAAE,oBAAoB;aAC3B,CAAC,CAAC;YAEH,MAAM,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,kEAAkE;YAClE,yDAAyD;YACzD,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE;gBACrC,GAAG,qBAAqB;gBACxB,UAAU,EAAE,aAAa,CAAC,SAAS,CAAC;gBACpC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;gBACtB,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY;gBAClC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC;gBAC7B,CAAC,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACnD,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;YACrC,QAAQ,CAAC,SAAS,CAChB,cAAc,EACd,OAAO,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,IAAI,2BAA2B,CACjE,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;gBAClE,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,cAAc;oBAAE,SAAS;gBACpD,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GACpB,OAAO,CAAC,SAAS,KAAK,SAAS;QAC7B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,iCAAiC,CAAC;YAChC,iBAAiB,EAAE,wBAAwB;YAC3C,OAAO,EAAE,OAAO,CAAC,SAAS;YAC1B,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAC3B,yBAAyB,CAAC,OAAO,EAAE;gBACjC,GAAG,OAAO;gBACV,aAAa;aACd,CAAC;YACJ,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACT,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAClC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,WAAW,EAAE,OAAO,CAAC,CACtE,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3F,aAAa,GAAG,IAAI,CAAC;IACrB,IAAI,YAAuC,CAAC;IAE5C,OAAO;QACL,MAAM;QACN,GAAG,EAAE,UAAU,mBAAmB,CAAC,OAAO,CAAC,QAAQ,IAAI,WAAW,EAAE,IAAI,CAAC,EAAE;QAC3E,KAAK,EAAE,GAAG,EAAE;YACV,YAAY;gBACV,gBAAgB,KAAK,SAAS;oBAC5B,CAAC,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACpC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC7D;oBACH,CAAC,CAAC,uBAAuB,CAAC;wBACtB,SAAS,EAAE,gBAAgB;wBAC3B,MAAM;wBACN,SAAS,EAAE,qBAAqB;qBACjC,CAAC,CAAC;YACT,OAAO,YAAY,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA4C,EAC5C,OAAkE;IAElE,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,IAAI,aAAa,CAAC;IAC5D,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,yBAAyB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,IAAI,WAAW,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,yBAAyB,CAAC,CAAC;QAC9D,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,YAAY;QACZ,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;KAC9B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,0BAA0B,CAAC;QAC1C,SAAS,EAAG,OAAO,CAAC,MAAkC,CAAC,SAAS,KAAK,IAAI;QACzE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC;QACpD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,OAAO,yBAAyB,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,CAAC,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB,EAAE,IAAY;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9F,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAyB,EACzB,QAAgB,EAChB,IAAY;IAEZ,MAAM,OAAO,GAAG,KAAK,IAAI,QAAQ,CAAC;IAClC,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QACzB,OAAO,GAAG,CAAC;QACX,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;QAC9B,OAAO,GAAG,aAAa,EACvB,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,GAAG,IAAI,yEAAyE,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAAC,OAKlC;IACC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC;IACjE,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;IACtE,CAAC;IACD,OAAO,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;AACzE,CAAC","sourcesContent":["import { createServer, type Server } from \"node:http\";\nimport { nodeRequestToWebRequest, sendResponse } from \"./http.js\";\nimport {\n  emitRouterLog,\n  logDurationMs,\n  logError,\n  logNow,\n  nodeRequestPath,\n  requestLogFields,\n  type AppRouterLogger,\n} from \"./logger.js\";\nimport {\n  assertValidHttpUpgradeOriginPolicy,\n  closeServerWithUpgrades,\n  createManagedHttpUpgradeLifecycle,\n  validateHttpUpgradeOrigin,\n  type HttpUpgradeOriginPolicy,\n  type HttpUpgradeOriginValidation,\n  type ManagedHttpUpgradeHandler,\n} from \"./upgrade.js\";\n\nexport interface StartNodeRequestServerOptions {\n  allowedHosts?: readonly string[] | undefined;\n  errorHandler?:\n    | ((error: unknown) => {\n        body: string;\n        status: number;\n        headers?: Record<string, string>;\n      })\n    | undefined;\n  hostname?: string | undefined;\n  hostPolicy?: \"strict\" | \"trusted-proxy\" | undefined;\n  logger?: AppRouterLogger | undefined;\n  onUpgrade?: ManagedHttpUpgradeHandler | undefined;\n  port: number;\n  render(request: Request): Promise<Response>;\n  resolveHost?:\n    | ((options: {\n        allowedHosts?: readonly string[] | undefined;\n        fallbackHost: string;\n        hostPolicy?: \"strict\" | \"trusted-proxy\" | undefined;\n        rawHost: string | undefined;\n      }) => string)\n    | undefined;\n  trustForwardedProto?: boolean | undefined;\n  upgradeCloseTimeoutMs?: number | undefined;\n  upgradeDecisionTimeoutMs?: number | undefined;\n  upgradeOriginPolicy?: HttpUpgradeOriginPolicy | undefined;\n}\n\nexport function resolveNodeRequestProtocol(options: {\n  encrypted: boolean;\n  forwardedProto: string | readonly string[] | undefined;\n  trustForwardedProto?: boolean | undefined;\n}): \"http\" | \"https\" {\n  if (options.encrypted) {\n    return \"https\";\n  }\n\n  if (options.trustForwardedProto !== true) {\n    return \"http\";\n  }\n\n  const forwarded = Array.isArray(options.forwardedProto)\n    ? options.forwardedProto[0]\n    : options.forwardedProto;\n  const first = forwarded?.split(\",\", 1)[0]?.trim().toLowerCase();\n  return first === \"https\" ? \"https\" : \"http\";\n}\n\nexport async function startNodeRequestServer(\n  options: StartNodeRequestServerOptions,\n): Promise<{ close(): Promise<void>; server: Server; url: string }> {\n  const upgradeCloseTimeoutMs = finiteNonNegativeTimeout(\n    options.upgradeCloseTimeoutMs,\n    1_000,\n    \"upgradeCloseTimeoutMs\",\n  );\n  const upgradeDecisionTimeoutMs = finiteNonNegativeTimeout(\n    options.upgradeDecisionTimeoutMs,\n    1_000,\n    \"upgradeDecisionTimeoutMs\",\n  );\n  assertValidHttpUpgradeOriginPolicy(options.upgradeOriginPolicy);\n  let listeningPort = options.port;\n  const server = createServer(async (incoming, outgoing) => {\n    const startedAt = logNow();\n    const fallbackRequestFields = {\n      method: incoming.method ?? \"GET\",\n      path: nodeRequestPath(incoming.url),\n      runtime: \"node\" as const,\n    };\n\n    try {\n      const fallbackHost = formatNodeAuthority(options.hostname ?? \"127.0.0.1\", options.port);\n      const host = (options.resolveHost ?? defaultResolveRequestHost)({\n        allowedHosts: options.allowedHosts,\n        fallbackHost,\n        hostPolicy: options.hostPolicy,\n        rawHost: incoming.headers.host,\n      });\n      const protocol = resolveNodeRequestProtocol({\n        encrypted: (incoming.socket as { encrypted?: boolean }).encrypted === true,\n        forwardedProto: incoming.headers[\"x-forwarded-proto\"],\n        trustForwardedProto: options.trustForwardedProto,\n      });\n      const request = nodeRequestToWebRequest(incoming, `${protocol}://${host}`, outgoing);\n      const logFields = requestLogFields(request, \"node\");\n      emitRouterLog(options.logger, \"info\", {\n        ...logFields,\n        type: \"router:request:start\",\n      });\n      const response = await options.render(request);\n      emitRouterLog(options.logger, \"info\", {\n        ...logFields,\n        durationMs: logDurationMs(startedAt),\n        status: response.status,\n        type: \"router:request:end\",\n      });\n\n      await sendResponse(outgoing, response);\n    } catch (error) {\n      // Log the full stack to stderr for operator visibility; never put\n      // it in the response body where attackers can scrape it.\n      emitRouterLog(options.logger, \"error\", {\n        ...fallbackRequestFields,\n        durationMs: logDurationMs(startedAt),\n        error: logError(error),\n        type: \"router:request:error\",\n      });\n      if (options.logger === undefined) {\n        console.error(\"[mreact] startServer request failed:\", error);\n      }\n      const payload = options.errorHandler\n        ? options.errorHandler(error)\n        : { body: \"Internal Server Error\", status: 500 };\n      outgoing.statusCode = payload.status;\n      outgoing.setHeader(\n        \"content-type\",\n        payload.headers?.[\"content-type\"] ?? \"text/plain; charset=utf-8\",\n      );\n      for (const [name, value] of Object.entries(payload.headers ?? {})) {\n        if (name.toLowerCase() === \"content-type\") continue;\n        outgoing.setHeader(name, value);\n      }\n      outgoing.end(payload.body);\n    }\n  });\n\n  const upgradeLifecycle =\n    options.onUpgrade === undefined\n      ? undefined\n      : createManagedHttpUpgradeLifecycle({\n          decisionTimeoutMs: upgradeDecisionTimeoutMs,\n          handler: options.onUpgrade,\n          isOriginAllowed: (request) =>\n            validateNodeUpgradeOrigin(request, {\n              ...options,\n              listeningPort,\n            }),\n          logger: options.logger,\n        });\n  if (upgradeLifecycle !== undefined) {\n    server.on(\"upgrade\", upgradeLifecycle.handle);\n  }\n\n  await new Promise<void>((resolve) =>\n    server.listen(options.port, options.hostname ?? \"127.0.0.1\", resolve),\n  );\n  const address = server.address();\n  const port = typeof address === \"object\" && address !== null ? address.port : options.port;\n  listeningPort = port;\n  let closePromise: Promise<void> | undefined;\n\n  return {\n    server,\n    url: `http://${formatNodeAuthority(options.hostname ?? \"127.0.0.1\", port)}`,\n    close: () => {\n      closePromise ??=\n        upgradeLifecycle === undefined\n          ? new Promise<void>((resolve, reject) =>\n              server.close((error) => (error ? reject(error) : resolve())),\n            )\n          : closeServerWithUpgrades({\n              lifecycle: upgradeLifecycle,\n              server,\n              timeoutMs: upgradeCloseTimeoutMs,\n            });\n      return closePromise;\n    },\n  };\n}\n\nfunction validateNodeUpgradeOrigin(\n  request: import(\"node:http\").IncomingMessage,\n  options: StartNodeRequestServerOptions & { listeningPort: number },\n): HttpUpgradeOriginValidation {\n  const policy = options.upgradeOriginPolicy ?? \"same-origin\";\n  if (policy === \"unchecked\") {\n    return { ok: true, origin: request.headers.origin };\n  }\n  if (typeof policy === \"object\") {\n    return validateHttpUpgradeOrigin(request, policy);\n  }\n\n  const fallbackHost = formatNodeAuthority(options.hostname ?? \"127.0.0.1\", options.listeningPort);\n  const host = (options.resolveHost ?? defaultResolveRequestHost)({\n    allowedHosts: options.allowedHosts,\n    fallbackHost,\n    hostPolicy: options.hostPolicy,\n    rawHost: request.headers.host,\n  });\n  const protocol = resolveNodeRequestProtocol({\n    encrypted: (request.socket as { encrypted?: boolean }).encrypted === true,\n    forwardedProto: request.headers[\"x-forwarded-proto\"],\n    trustForwardedProto: options.trustForwardedProto,\n  });\n  try {\n    return validateHttpUpgradeOrigin(request, { allowedOrigins: [`${protocol}://${host}`] });\n  } catch {\n    return { ok: false, reason: \"malformed-origin\" };\n  }\n}\n\nfunction formatNodeAuthority(hostname: string, port: number): string {\n  const host = hostname.includes(\":\") && !hostname.startsWith(\"[\") ? `[${hostname}]` : hostname;\n  return `${host}:${port}`;\n}\n\nfunction finiteNonNegativeTimeout(\n  value: number | undefined,\n  fallback: number,\n  name: string,\n): number {\n  const timeout = value ?? fallback;\n  if (\n    !Number.isFinite(timeout) ||\n    timeout < 0 ||\n    !Number.isSafeInteger(timeout) ||\n    timeout > 2_147_483_647\n  ) {\n    throw new TypeError(\n      `${name} must be a finite non-negative safe integer no greater than 2147483647.`,\n    );\n  }\n  return timeout;\n}\n\nfunction defaultResolveRequestHost(options: {\n  allowedHosts?: readonly string[] | undefined;\n  fallbackHost: string;\n  hostPolicy?: \"strict\" | \"trusted-proxy\" | undefined;\n  rawHost: string | undefined;\n}): string {\n  const raw = options.rawHost;\n  if (raw === undefined || raw === \"\") return options.fallbackHost;\n  if (options.allowedHosts === undefined) {\n    return options.hostPolicy === \"strict\" ? options.fallbackHost : raw;\n  }\n  return options.allowedHosts.includes(raw) ? raw : options.fallbackHost;\n}\n"]}

package/dist/prerender-entry.d.ts

@@ -1,5 +1,21 @@
 import type { BuiltPrerenderedRoute } from "./build.js";
-export declare const PRERENDERED_ROUTE_SCHEMA_VERSION = 2;
+export declare const PRERENDERED_ROUTE_SCHEMA_VERSION = 4;
 export declare function isCurrentPrerenderedRoute(value: unknown): value is BuiltPrerenderedRoute;
+/**
+ * Returns a navigation variant only after validating its route marker.
+ *
+ * Stored entries are stable objects during a runtime's lifetime, so the
+ * marker scan is cached by identity. Document requests never call this
+ * function and therefore never inspect navigation HTML.
+ */
+export declare function validatedPrerenderedNavigationHtml(entry: BuiltPrerenderedRoute): string | undefined;
+/**
+ * Adds a regenerated navigation variant only when it satisfies the marker
+ * contract. Invalid navigation output must not replace a valid document.
+ */
+export declare function mergePrerenderedNavigationHtml(entry: BuiltPrerenderedRoute, navigationHtml: string): BuiltPrerenderedRoute;
 export declare function isVisitorDependentResponse(response: Response): boolean;
+export declare function protectNonceBearingResponse(response: Response): Response;
+export declare function storedPrerenderedRouteHeaders(headers: Headers): Record<string, string>;
+export declare function replayedPrerenderedRouteHeaders(entry: BuiltPrerenderedRoute, request: Request): Headers;
 //# sourceMappingURL=prerender-entry.d.ts.map

package/dist/prerender-entry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prerender-entry.d.ts","sourceRoot":"","sources":["../src/prerender-entry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExD,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAElD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAgBxF;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAEtE"}
+{"version":3,"file":"prerender-entry.d.ts","sourceRoot":"","sources":["../src/prerender-entry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAIxD,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAIlD,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,qBAAqB,CAmBxF;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,KAAK,EAAE,qBAAqB,GAC3B,MAAM,GAAG,SAAS,CAWpB;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,qBAAqB,EAC5B,cAAc,EAAE,MAAM,GACrB,qBAAqB,CAEvB;AAkBD,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAEtE;AAED,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAaxE;AAED,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUtF;AAED,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,OAAO,GACf,OAAO,CAYT"}

package/dist/prerender-entry.js

@@ -1,4 +1,7 @@
-export const PRERENDERED_ROUTE_SCHEMA_VERSION = 2;
+import { responseHeadersContainCspNonce } from "./csp.js";
+import { hasNavigationRouteMarker } from "./navigation-marker.js";
+export const PRERENDERED_ROUTE_SCHEMA_VERSION = 4;
+const validatedNavigationHtmlByEntry = new WeakMap();
 export function isCurrentPrerenderedRoute(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
         return false;
@@ -7,15 +10,101 @@ export function isCurrentPrerenderedRoute(value) {
     return (entry.schemaVersion === PRERENDERED_ROUTE_SCHEMA_VERSION &&
         isStringRecord(entry.headers) &&
         isShareableHeaderRecord(entry.headers) &&
+        hasRequiredNavigationVary(entry.headers) &&
+        !hasStoredHstsHeader(entry.headers) &&
+        isCanonicalHstsHeader(entry.strictTransportSecurity) &&
         typeof entry.html === "string" &&
         typeof entry.status === "number" &&
         Number.isInteger(entry.status) &&
         entry.status >= 100 &&
         entry.status <= 599);
 }
+/**
+ * Returns a navigation variant only after validating its route marker.
+ *
+ * Stored entries are stable objects during a runtime's lifetime, so the
+ * marker scan is cached by identity. Document requests never call this
+ * function and therefore never inspect navigation HTML.
+ */
+export function validatedPrerenderedNavigationHtml(entry) {
+    const cached = validatedNavigationHtmlByEntry.get(entry);
+    if (cached !== undefined) {
+        return cached === null ? undefined : cached;
+    }
+    const candidate = entry.navigationHtml;
+    const validated = typeof candidate === "string" && hasNavigationRouteMarker(candidate) ? candidate : null;
+    validatedNavigationHtmlByEntry.set(entry, validated);
+    return validated === null ? undefined : validated;
+}
+/**
+ * Adds a regenerated navigation variant only when it satisfies the marker
+ * contract. Invalid navigation output must not replace a valid document.
+ */
+export function mergePrerenderedNavigationHtml(entry, navigationHtml) {
+    return hasNavigationRouteMarker(navigationHtml) ? { ...entry, navigationHtml } : entry;
+}
+function hasStoredHstsHeader(headers) {
+    try {
+        return new Headers(headers).has("strict-transport-security");
+    }
+    catch {
+        return true;
+    }
+}
+function isCanonicalHstsHeader(value) {
+    return (value === undefined ||
+        (typeof value === "string" &&
+            /^max-age=(?:0|[1-9][0-9]*)(?:; includeSubDomains)?(?:; preload)?$/.test(value)));
+}
 export function isVisitorDependentResponse(response) {
     return isVisitorDependentHeaders(response.headers);
 }
+export function protectNonceBearingResponse(response) {
+    if (!responseHeadersContainCspNonce(response.headers)) {
+        return response;
+    }
+    const headers = new Headers(response.headers);
+    headers.set("cache-control", "private, no-store");
+    headers.set("x-mreact-cache", "DYNAMIC");
+    return new Response(response.body, {
+        headers,
+        status: response.status,
+        statusText: response.statusText,
+    });
+}
+export function storedPrerenderedRouteHeaders(headers) {
+    const stored = {};
+    headers.forEach((value, key) => {
+        if (key !== "strict-transport-security") {
+            stored[key] = value;
+        }
+    });
+    return stored;
+}
+export function replayedPrerenderedRouteHeaders(entry, request) {
+    const headers = new Headers(entry.headers);
+    if (!hasNavigationVary(headers)) {
+        headers.append("vary", "x-mreact-navigation");
+    }
+    if (entry.strictTransportSecurity !== undefined && request.url.startsWith("https://")) {
+        headers.set("strict-transport-security", entry.strictTransportSecurity);
+    }
+    return headers;
+}
+function hasRequiredNavigationVary(headers) {
+    try {
+        return hasNavigationVary(new Headers(headers));
+    }
+    catch {
+        return false;
+    }
+}
+function hasNavigationVary(headers) {
+    return (headers
+        .get("vary")
+        ?.split(",")
+        .some((value) => value.trim().toLowerCase() === "x-mreact-navigation") === true);
+}
 function isShareableHeaderRecord(headers) {
     try {
         return !isVisitorDependentHeaders(new Headers(headers));
@@ -26,10 +115,16 @@ function isShareableHeaderRecord(headers) {
 }
 function isVisitorDependentHeaders(headers) {
     const cacheControl = headers.get("cache-control") ?? "";
-    const forbidsSharedStorage = cacheControl.split(",").some((directive) => /^(?:private|no-cache|no-store)(?:=|$)/i.test(directive.trim()));
+    const vary = headers.get("vary");
+    const hasVisitorDependentVary = vary !== null &&
+        vary.split(",").some((value) => value.trim().toLowerCase() !== "x-mreact-navigation");
+    const forbidsSharedStorage = cacheControl
+        .split(",")
+        .some((directive) => /^(?:private|no-cache|no-store)(?:=|$)/i.test(directive.trim()));
     return (headers.get("x-mreact-cache")?.toUpperCase() === "DYNAMIC" ||
         headers.has("set-cookie") ||
-        headers.has("vary") ||
+        responseHeadersContainCspNonce(headers) ||
+        hasVisitorDependentVary ||
         forbidsSharedStorage);
 }
 function isStringRecord(value) {

package/dist/prerender-entry.js.map

@@ -1 +1 @@
-{"version":3,"file":"prerender-entry.js","sourceRoot":"","sources":["../src/prerender-entry.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,KAAuC,CAAC;IACtD,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,gCAAgC;QACxD,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,KAAK,CAAC,MAAM,IAAI,GAAG,CACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,OAAO,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,uBAAuB,CAAC,OAA+B;IAC9D,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAgB;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,oBAAoB,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACtE,wCAAwC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAChE,CAAC;IAEF,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,KAAK,SAAS;QAC1D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;QACnB,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CACjE,CAAC;AACJ,CAAC","sourcesContent":["import type { BuiltPrerenderedRoute } from \"./build.js\";\n\nexport const PRERENDERED_ROUTE_SCHEMA_VERSION = 2;\n\nexport function isCurrentPrerenderedRoute(value: unknown): value is BuiltPrerenderedRoute {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false;\n  }\n\n  const entry = value as Partial<BuiltPrerenderedRoute>;\n  return (\n    entry.schemaVersion === PRERENDERED_ROUTE_SCHEMA_VERSION &&\n    isStringRecord(entry.headers) &&\n    isShareableHeaderRecord(entry.headers) &&\n    typeof entry.html === \"string\" &&\n    typeof entry.status === \"number\" &&\n    Number.isInteger(entry.status) &&\n    entry.status >= 100 &&\n    entry.status <= 599\n  );\n}\n\nexport function isVisitorDependentResponse(response: Response): boolean {\n  return isVisitorDependentHeaders(response.headers);\n}\n\nfunction isShareableHeaderRecord(headers: Record<string, string>): boolean {\n  try {\n    return !isVisitorDependentHeaders(new Headers(headers));\n  } catch {\n    return false;\n  }\n}\n\nfunction isVisitorDependentHeaders(headers: Headers): boolean {\n  const cacheControl = headers.get(\"cache-control\") ?? \"\";\n  const forbidsSharedStorage = cacheControl.split(\",\").some((directive) =>\n    /^(?:private|no-cache|no-store)(?:=|$)/i.test(directive.trim()),\n  );\n\n  return (\n    headers.get(\"x-mreact-cache\")?.toUpperCase() === \"DYNAMIC\" ||\n    headers.has(\"set-cookie\") ||\n    headers.has(\"vary\") ||\n    forbidsSharedStorage\n  );\n}\n\nfunction isStringRecord(value: unknown): value is Record<string, string> {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    !Array.isArray(value) &&\n    Object.values(value).every((entry) => typeof entry === \"string\")\n  );\n}\n"]}
+{"version":3,"file":"prerender-entry.js","sourceRoot":"","sources":["../src/prerender-entry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,8BAA8B,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD,MAAM,8BAA8B,GAAG,IAAI,OAAO,EAAyB,CAAC;AAE5E,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,KAAuC,CAAC;IACtD,OAAO,CACL,KAAK,CAAC,aAAa,KAAK,gCAAgC;QACxD,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC7B,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC;QACtC,yBAAyB,CAAC,KAAK,CAAC,OAAO,CAAC;QACxC,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,qBAAqB,CAAC,KAAK,CAAC,uBAAuB,CAAC;QACpD,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;QAChC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,KAAK,CAAC,MAAM,IAAI,GAAG;QACnB,KAAK,CAAC,MAAM,IAAI,GAAG,CACpB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,KAA4B;IAE5B,MAAM,MAAM,GAAG,8BAA8B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC;IACvC,MAAM,SAAS,GACb,OAAO,SAAS,KAAK,QAAQ,IAAI,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,8BAA8B,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACrD,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,KAA4B,EAC5B,cAAsB;IAEtB,OAAO,wBAAwB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACzF,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA+B;IAC1D,IAAI,CAAC;QACH,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,KAAK,KAAK,SAAS;QACnB,CAAC,OAAO,KAAK,KAAK,QAAQ;YACxB,mEAAmE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACnF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,OAAO,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,QAAkB;IAC5D,IAAI,CAAC,8BAA8B,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACzC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,OAAO;QACP,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAAgB;IAC5D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC7B,IAAI,GAAG,KAAK,2BAA2B,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,KAA4B,EAC5B,OAAgB;IAEhB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAE3C,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,KAAK,CAAC,uBAAuB,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAAC,OAA+B;IAChE,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,CACL,OAAO;SACJ,GAAG,CAAC,MAAM,CAAC;QACZ,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,qBAAqB,CAAC,KAAK,IAAI,CAClF,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAA+B;IAC9D,IAAI,CAAC;QACH,OAAO,CAAC,yBAAyB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAgB;IACjD,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,uBAAuB,GAC3B,IAAI,KAAK,IAAI;QACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,qBAAqB,CAAC,CAAC;IACxF,MAAM,oBAAoB,GAAG,YAAY;SACtC,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,wCAAwC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAExF,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,KAAK,SAAS;QAC1D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACzB,8BAA8B,CAAC,OAAO,CAAC;QACvC,uBAAuB;QACvB,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CACjE,CAAC;AACJ,CAAC","sourcesContent":["import type { BuiltPrerenderedRoute } from \"./build.js\";\nimport { responseHeadersContainCspNonce } from \"./csp.js\";\nimport { hasNavigationRouteMarker } from \"./navigation-marker.js\";\n\nexport const PRERENDERED_ROUTE_SCHEMA_VERSION = 4;\n\nconst validatedNavigationHtmlByEntry = new WeakMap<object, string | null>();\n\nexport function isCurrentPrerenderedRoute(value: unknown): value is BuiltPrerenderedRoute {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    return false;\n  }\n\n  const entry = value as Partial<BuiltPrerenderedRoute>;\n  return (\n    entry.schemaVersion === PRERENDERED_ROUTE_SCHEMA_VERSION &&\n    isStringRecord(entry.headers) &&\n    isShareableHeaderRecord(entry.headers) &&\n    hasRequiredNavigationVary(entry.headers) &&\n    !hasStoredHstsHeader(entry.headers) &&\n    isCanonicalHstsHeader(entry.strictTransportSecurity) &&\n    typeof entry.html === \"string\" &&\n    typeof entry.status === \"number\" &&\n    Number.isInteger(entry.status) &&\n    entry.status >= 100 &&\n    entry.status <= 599\n  );\n}\n\n/**\n * Returns a navigation variant only after validating its route marker.\n *\n * Stored entries are stable objects during a runtime's lifetime, so the\n * marker scan is cached by identity. Document requests never call this\n * function and therefore never inspect navigation HTML.\n */\nexport function validatedPrerenderedNavigationHtml(\n  entry: BuiltPrerenderedRoute,\n): string | undefined {\n  const cached = validatedNavigationHtmlByEntry.get(entry);\n  if (cached !== undefined) {\n    return cached === null ? undefined : cached;\n  }\n\n  const candidate = entry.navigationHtml;\n  const validated =\n    typeof candidate === \"string\" && hasNavigationRouteMarker(candidate) ? candidate : null;\n  validatedNavigationHtmlByEntry.set(entry, validated);\n  return validated === null ? undefined : validated;\n}\n\n/**\n * Adds a regenerated navigation variant only when it satisfies the marker\n * contract. Invalid navigation output must not replace a valid document.\n */\nexport function mergePrerenderedNavigationHtml(\n  entry: BuiltPrerenderedRoute,\n  navigationHtml: string,\n): BuiltPrerenderedRoute {\n  return hasNavigationRouteMarker(navigationHtml) ? { ...entry, navigationHtml } : entry;\n}\n\nfunction hasStoredHstsHeader(headers: Record<string, string>): boolean {\n  try {\n    return new Headers(headers).has(\"strict-transport-security\");\n  } catch {\n    return true;\n  }\n}\n\nfunction isCanonicalHstsHeader(value: unknown): value is string | undefined {\n  return (\n    value === undefined ||\n    (typeof value === \"string\" &&\n      /^max-age=(?:0|[1-9][0-9]*)(?:; includeSubDomains)?(?:; preload)?$/.test(value))\n  );\n}\n\nexport function isVisitorDependentResponse(response: Response): boolean {\n  return isVisitorDependentHeaders(response.headers);\n}\n\nexport function protectNonceBearingResponse(response: Response): Response {\n  if (!responseHeadersContainCspNonce(response.headers)) {\n    return response;\n  }\n\n  const headers = new Headers(response.headers);\n  headers.set(\"cache-control\", \"private, no-store\");\n  headers.set(\"x-mreact-cache\", \"DYNAMIC\");\n  return new Response(response.body, {\n    headers,\n    status: response.status,\n    statusText: response.statusText,\n  });\n}\n\nexport function storedPrerenderedRouteHeaders(headers: Headers): Record<string, string> {\n  const stored: Record<string, string> = {};\n\n  headers.forEach((value, key) => {\n    if (key !== \"strict-transport-security\") {\n      stored[key] = value;\n    }\n  });\n\n  return stored;\n}\n\nexport function replayedPrerenderedRouteHeaders(\n  entry: BuiltPrerenderedRoute,\n  request: Request,\n): Headers {\n  const headers = new Headers(entry.headers);\n\n  if (!hasNavigationVary(headers)) {\n    headers.append(\"vary\", \"x-mreact-navigation\");\n  }\n\n  if (entry.strictTransportSecurity !== undefined && request.url.startsWith(\"https://\")) {\n    headers.set(\"strict-transport-security\", entry.strictTransportSecurity);\n  }\n\n  return headers;\n}\n\nfunction hasRequiredNavigationVary(headers: Record<string, string>): boolean {\n  try {\n    return hasNavigationVary(new Headers(headers));\n  } catch {\n    return false;\n  }\n}\n\nfunction hasNavigationVary(headers: Headers): boolean {\n  return (\n    headers\n      .get(\"vary\")\n      ?.split(\",\")\n      .some((value) => value.trim().toLowerCase() === \"x-mreact-navigation\") === true\n  );\n}\n\nfunction isShareableHeaderRecord(headers: Record<string, string>): boolean {\n  try {\n    return !isVisitorDependentHeaders(new Headers(headers));\n  } catch {\n    return false;\n  }\n}\n\nfunction isVisitorDependentHeaders(headers: Headers): boolean {\n  const cacheControl = headers.get(\"cache-control\") ?? \"\";\n  const vary = headers.get(\"vary\");\n  const hasVisitorDependentVary =\n    vary !== null &&\n    vary.split(\",\").some((value) => value.trim().toLowerCase() !== \"x-mreact-navigation\");\n  const forbidsSharedStorage = cacheControl\n    .split(\",\")\n    .some((directive) => /^(?:private|no-cache|no-store)(?:=|$)/i.test(directive.trim()));\n\n  return (\n    headers.get(\"x-mreact-cache\")?.toUpperCase() === \"DYNAMIC\" ||\n    headers.has(\"set-cookie\") ||\n    responseHeadersContainCspNonce(headers) ||\n    hasVisitorDependentVary ||\n    forbidsSharedStorage\n  );\n}\n\nfunction isStringRecord(value: unknown): value is Record<string, string> {\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    !Array.isArray(value) &&\n    Object.values(value).every((entry) => typeof entry === \"string\")\n  );\n}\n"]}

package/dist/render.d.ts

@@ -1,5 +1,5 @@
 import type { ServerOutputMode, TransformOutput } from "@reckona/mreact-shared/compiler-contract";
-import { type QueryClient } from "@reckona/mreact-query";
+import { type DehydrateOptions, type QueryClient } from "@reckona/mreact-query";
 import { type ClientRouteInferenceCache } from "./client-route-inference.js";
 import type { AppRoute, MatchedRoute, RouteMatcher } from "./routes.js";
 import { type AppRouterServerActionOptions, type PreparedFormActionReference } from "./actions.js";
@@ -31,6 +31,7 @@ export interface RenderAppRequestOptions {
     clientStylesByFile?: ReadonlyMap<string, readonly string[]>;
     clientStyles?: ReadonlyMap<string, readonly string[]>;
     define?: UserConfig["define"] | undefined;
+    dehydrateOptions?: DehydrateOptions | undefined;
     env?: unknown;
     importPolicy?: AppRouterImportPolicy | undefined;
     instrumentation?: RouterInstrumentation | undefined;
@@ -46,6 +47,7 @@ export interface RenderAppRequestOptions {
     routeMatcher?: RouteMatcher | undefined;
     routes?: readonly AppRoute[] | undefined;
     serverModules?: ReadonlyMap<string, BuiltServerModuleArtifact> | undefined;
+    serverRenderArtifactLoader?: AppRouterServerRenderArtifactLoader | undefined;
     serverModuleCacheVersion?: string | undefined;
     devServerModuleCacheVersion?: string | undefined;
     dev?: boolean | undefined;
@@ -57,6 +59,14 @@ export interface RenderAppRequestOptions {
     vitePlugins?: readonly PluginOption[] | undefined;
 }
 export interface RenderAppRequestRuntimeOptions extends RenderAppRequestOptions {
+    /**
+     * Wraps a server-only page with build-time variant capture comments.
+     *
+     * This is an in-process render signal. It must not be derived from request
+     * headers because network clients are not allowed to change response shape
+     * outside the route-cache key.
+     */
+    prerenderVariantCapture?: boolean | undefined;
     /**
      * Receives whether the render depended on the incoming request headers.
      *
@@ -69,8 +79,8 @@ export interface RenderAppRequestRuntimeOptions extends RenderAppRequestOptions
      */
     renderSignals?: {
         headerDependent: () => boolean;
+        strictTransportSecurity: () => string | undefined;
     } | undefined;
-    serverRenderArtifactLoader?: AppRouterServerRenderArtifactLoader | undefined;
 }
 export interface AppRouterRenderPreload {
     promise: Promise<void>;
@@ -125,6 +135,10 @@ export declare function resolveAppRouterMiddleware(options: {
     vitePlugins?: readonly PluginOption[] | undefined;
 }): Promise<AppRouterMiddlewareResult>;
 export declare function resolveAppRouterResponseHook(options: Pick<RenderAppRequestOptions, "appDir" | "define" | "devServerModuleCacheVersion" | "importPolicy" | "onResponse" | "serverModules" | "serverModuleCacheVersion" | "serverSourceFiles" | "vitePlugins">): Promise<AppRouterResponseHook | undefined>;
+export declare function prerenderVariantMarkerParts(routePath: string): {
+    prefix: string;
+    suffix: string;
+};
 export declare function bundleMiddlewareModuleCode(options: {
     appDir: string;
     code: string;

package/dist/render.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAEV,gBAAgB,EAChB,eAAe,EAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAIL,KAAK,yBAAyB,EAE/B,MAAM,6BAA6B,CAAC;AAUrC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAIjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,cAAc,EAOpB,MAAM,YAAY,CAAC;AAoBpB,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEnG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,KAAK,EAAmC,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAa7F,OAAO,EAAwC,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;AAqDzB,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,yBAAyB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACrC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,aAAa,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACvD,UAAU,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC/C,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAC7B,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,UAAU,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACxC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,CAAC;IACzC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAGjD,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,aAAa,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACzD,4BAA4B,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC,GAC3D,SAAS,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,OAAO,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,8BAA+B,SAAQ,uBAAuB;IAC7E;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE;QAAE,eAAe,EAAE,MAAM,OAAO,CAAA;KAAE,GAAG,SAAS,CAAC;IAC/D,0BAA0B,CAAC,EAAE,mCAAmC,GAAG,SAAS,CAAC;CAC9E;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,EAAE,eAAe,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,4BAA4B,KAClC,QAAQ,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,EAAE,MAAM,CAAC;IACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,4BAA4B,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC,GAC3D,SAAS,CAAC;IACd,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFhB;AAyND,wBAAgB,6BAA6B,IAAI,sBAAsB,EAAE,CAkExE;AAmBD;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwB1F;AAsID,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACtC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAE7C,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,iBAAiB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAiBrC;AA04BD,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,IAAI,CACX,uBAAuB,EACrB,QAAQ,GACR,QAAQ,GACR,6BAA6B,GAC7B,cAAc,GACd,YAAY,GACZ,eAAe,GACf,0BAA0B,GAC1B,mBAAmB,GACnB,aAAa,CAChB,GACA,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAgD5C;AAi7BD,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CA0BlB;AA6CD,iBAAS,qBAAqB,CAAC,OAAO,EAAE;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,YAAY,EAAE,gBAAgB,CAAC;IAC/B,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,eAAe,CAsFlB;AAED,eAAO,MAAM,iCAAiC,8BAAwB,CAAC;AAIvE,wBAAgB,yCAAyC,IAAI,IAAI,CAGhE;AAKD,wBAAgB,sDAAsD,CAAC,OAAO,EAAE;IAC9E,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;CAC5E,GAAG,IAAI,CAEP;AA+wDD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,8BAA8B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB;AAgRD,iBAAS,6BAA6B,CAAC,OAAO,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,MAAM,GAAG,SAAS,CAOrB;AAED,eAAO,MAAM,yCAAyC,sCAAgC,CAAC;AAqMvF,UAAU,YAAY;IACpB,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC1B;AAED,iBAAS,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAmDnD;AAED,eAAO,MAAM,yBAAyB,sBAAgB,CAAC"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAEV,gBAAgB,EAChB,eAAe,EAChB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAOL,KAAK,gBAAgB,EACrB,KAAK,WAAW,EACjB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAIL,KAAK,yBAAyB,EAE/B,MAAM,6BAA6B,CAAC;AAUrC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EACL,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAIjC,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,cAAc,EAOpB,MAAM,YAAY,CAAC;AAkBpB,OAAO,EAAqC,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAEnG,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,KAAK,EAAmC,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAa7F,OAAO,EAAwC,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAU1B,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAQL,KAAK,sBAAsB,EAC5B,MAAM,iBAAiB,CAAC;AAuDzB,UAAU,YAAY;IACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,yBAAyB,CAAC,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAClE,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,kBAAkB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,gBAAgB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAChD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,MAAM,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;IACrC,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,aAAa,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACvD,UAAU,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IAC/C,WAAW,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC;IAC7B,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,UAAU,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACxC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,MAAM,CAAC,EAAE,SAAS,QAAQ,EAAE,GAAG,SAAS,CAAC;IACzC,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,0BAA0B,CAAC,EAAE,mCAAmC,GAAG,SAAS,CAAC;IAC7E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAGjD,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,aAAa,CAAC,EAAE,4BAA4B,GAAG,SAAS,CAAC;IACzD,4BAA4B,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC,GAC3D,SAAS,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,OAAO,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,WAAW,8BAA+B,SAAQ,uBAAuB;IAC7E;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9C;;;;;;;;;OASG;IACH,aAAa,CAAC,EACV;QACE,eAAe,EAAE,MAAM,OAAO,CAAC;QAC/B,uBAAuB,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;KACnD,GACD,SAAS,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,EAAE,eAAe,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,4BAA4B,KAClC,QAAQ,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,EAAE,MAAM,CAAC;IACjC,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,4BAA4B,CAAC,EACzB,WAAW,CAAC,MAAM,EAAE,SAAS,2BAA2B,EAAE,CAAC,GAC3D,SAAS,CAAC;IACd,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,IAAI,CAAC,CAsFhB;AA8ND,wBAAgB,6BAA6B,IAAI,sBAAsB,EAAE,CAkExE;AAmBD;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0B1F;AA2GD,MAAM,MAAM,yBAAyB,GACjC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GACtC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC;AAE7C,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,eAAe,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACpD,iBAAiB,CAAC,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,iBAAiB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5D,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAiBrC;AAq8BD,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,IAAI,CACX,uBAAuB,EACrB,QAAQ,GACR,QAAQ,GACR,6BAA6B,GAC7B,cAAc,GACd,YAAY,GACZ,eAAe,GACf,0BAA0B,GAC1B,mBAAmB,GACnB,aAAa,CAChB,GACA,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAgD5C;AA6JD,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG;IAC9D,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAMA;AA2zBD,wBAAsB,0BAA0B,CAAC,OAAO,EAAE;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,0BAA0B,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CA0BlB;AA6CD,iBAAS,qBAAqB,CAAC,OAAO,EAAE;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;IAC3E,YAAY,EAAE,gBAAgB,CAAC;IAC/B,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GAAG,eAAe,CAsFlB;AAED,eAAO,MAAM,iCAAiC,8BAAwB,CAAC;AAIvE,wBAAgB,yCAAyC,IAAI,IAAI,CAGhE;AAKD,wBAAgB,sDAAsD,CAAC,OAAO,EAAE;IAC9E,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,aAAa,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,yBAAyB,CAAC,GAAG,SAAS,CAAC;CAC5E,GAAG,IAAI,CAEP;AA8wDD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,8BAA8B,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,OAAO,CAAC,MAAM,CAAC,CAwBlB;AAyRD,iBAAS,6BAA6B,CAAC,OAAO,EAAE;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IAC1C,2BAA2B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,qBAAqB,GAAG,SAAS,CAAC;IACjD,wBAAwB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,WAAW,CAAC,EAAE,SAAS,YAAY,EAAE,GAAG,SAAS,CAAC;CACnD,GAAG,MAAM,GAAG,SAAS,CAOrB;AAED,eAAO,MAAM,yCAAyC,sCAAgC,CAAC;AAqMvF,UAAU,YAAY;IACpB,UAAU,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC1B;AAED,iBAAS,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAmDnD;AAED,eAAO,MAAM,yBAAyB,sBAAgB,CAAC"}