@rsc-kit/core 0.7.2 → 0.8.0

package/dist/headers.d.ts

@@ -44,6 +44,26 @@ export declare const HEADER: {
      * unconditionally.
      */
     readonly actionPath: '/_rsc/action';
+    /**
+     * Where the browser reads queries.
+     *
+     * A GET, and that is the whole point of it being a separate address: a POST
+     * is cacheable by nothing, so a read routed through the action endpoint can
+     * never be kept by an HTTP cache, a CDN or a service worker. Only functions
+     * declared with `query()` are reachable here — the endpoint checks the mark
+     * before invoking anything, because otherwise this address would run any
+     * registered action over GET.
+     */
+    /**
+     * Sent on every read, and required by the query endpoint.
+     *
+     * A GET with no unusual header is a simple request, so any page could
+     * trigger one with an <img> and the visitor's cookies would ride along.
+     * This header is not CORS-safelisted, so the browser preflights it — the
+     * same thing that makes a POST carrying X-RSC-Action safe.
+     */
+    readonly query: 'X-RSC-Query';
+    readonly queryPath: '/_rsc/query';
     /** Build-time shell for a PPR route, for an edge cache to hold. */
     readonly pprShellPath: '/_rsc/ppr-shell';
     /** Finish a shell an edge cache is already serving. */

package/dist/headers.js

@@ -53,6 +53,26 @@ export const HEADER = {
      * unconditionally.
      */
     actionPath: '/_rsc/action',
+    /**
+     * Where the browser reads queries.
+     *
+     * A GET, and that is the whole point of it being a separate address: a POST
+     * is cacheable by nothing, so a read routed through the action endpoint can
+     * never be kept by an HTTP cache, a CDN or a service worker. Only functions
+     * declared with `query()` are reachable here — the endpoint checks the mark
+     * before invoking anything, because otherwise this address would run any
+     * registered action over GET.
+     */
+    /**
+     * Sent on every read, and required by the query endpoint.
+     *
+     * A GET with no unusual header is a simple request, so any page could
+     * trigger one with an <img> and the visitor's cookies would ride along.
+     * This header is not CORS-safelisted, so the browser preflights it — the
+     * same thing that makes a POST carrying X-RSC-Action safe.
+     */
+    query: 'X-RSC-Query',
+    queryPath: '/_rsc/query',
     /** Build-time shell for a PPR route, for an edge cache to hold. */
     pprShellPath: '/_rsc/ppr-shell',
     /** Finish a shell an edge cache is already serving. */

package/dist/headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,gCAAgC;AAChC,EAAE;AACF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB;;;OAGG;IACH,GAAG,EAAE,OAAO;IAEZ,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB;IAE1B,kEAAkE;IAClE,YAAY,EAAE,qBAAqB;IAEnC,wCAAwC;IACxC,OAAO,EAAE,eAAe;IAExB,gFAAgF;IAChF,OAAO,EAAE,eAAe;IAExB,uDAAuD;IACvD,SAAS,EAAE,iBAAiB;IAE5B,gDAAgD;IAChD,OAAO,EAAE,eAAe;IAExB,uEAAuE;IACvE,UAAU,EAAE,kBAAkB;IAE9B,0CAA0C;IAC1C,MAAM,EAAE,cAAc;IAEtB;;;;;;;OAOG;IACH,QAAQ,EAAE,gBAAgB;IAE1B;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB;IAEjC;;;;;OAKG;IACH,UAAU,EAAE,cAAc;IAC1B,mEAAmE;IACnE,YAAY,EAAE,iBAAiB;IAC/B,uDAAuD;IACvD,aAAa,EAAE,kBAAkB;CACzB,CAAA;AAEV,sBAAsB;AACtB,MAAM,CAAC,MAAM,WAAW,GAAG,iCAAiC,CAAA;AAE5D,2BAA2B;AAC3B,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,CAAC,GAAG;IACV,MAAM,CAAC,QAAQ;IACf,MAAM,CAAC,UAAU;IACjB,MAAM,CAAC,SAAS;IAChB,MAAM,CAAC,OAAO;CACf,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,oCAAoC,CAAA","sourcesContent":["// The wire protocol, as names rather than string literals.\n//\n// A host writing these out by hand is how they drift. Two of them are not\n// negotiable at all — the client sends them or asks for them at fixed\n// addresses, and a host that spells one differently fails silently: the\n// request falls through, the decoder never runs, and a button does nothing\n// with no error on either side.\n//\n// PROTOCOL.md describes what each one means. This is the same list, importable.\n\nexport const HEADER = {\n  /**\n   * Present on a request for a Flight payload rather than the document. One\n   * url serves both, which is why every answer must Vary on it.\n   */\n  rsc: 'X-RSC',\n\n  /** The layout chain the client has mounted, outermost first, comma-separated. */\n  segments: 'X-RSC-Segments',\n\n  /** The boundary the answer replaces. 0 means a whole document. */\n  segmentDepth: 'X-RSC-Segment-Depth',\n\n  /** The chain to send back next time. */\n  layouts: 'X-RSC-Layouts',\n\n  /** Identifies the build, so a client can notice it is talking to an old one. */\n  version: 'X-RSC-Version',\n\n  /** The slot an intercepted navigation is targeting. */\n  intercept: 'X-RSC-Intercept',\n\n  /** Where the navigation or action came from. */\n  referer: 'X-RSC-Referer',\n\n  /** One named region of the current page to render and return alone. */\n  revalidate: 'X-RSC-Revalidate',\n\n  /** The server reference being invoked. */\n  action: 'X-RSC-Action',\n\n  /**\n   * Go here instead.\n   *\n   * Used for a redirect the client has to perform itself: a failed action, and\n   * a navigation whose render redirected. Never a 3xx for those — `fetch`\n   * follows one transparently, so the client would get the destination's HTML\n   * where it expected a Flight payload and decode it as one.\n   */\n  redirect: 'X-RSC-Redirect',\n\n  /**\n   * The body's real type.\n   *\n   * The body itself goes out as application/octet-stream so a host that parses\n   * multipart cannot consume it before the action does — reading Content-Type\n   * instead leaves an upload undecodable.\n   */\n  contentType: 'X-RSC-Content-Type',\n\n  /**\n   * Where the browser posts server actions.\n   *\n   * Not a convention this can choose: the client runtime posts here\n   * unconditionally.\n   */\n  actionPath: '/_rsc/action',\n  /** Build-time shell for a PPR route, for an edge cache to hold. */\n  pprShellPath: '/_rsc/ppr-shell',\n  /** Finish a shell an edge cache is already serving. */\n  pprResumePath: '/_rsc/ppr-resume',\n} as const\n\n/** Flight payload. */\nexport const FLIGHT_TYPE = 'text/x-component; charset=utf-8'\n\n/** A rendered document. */\nexport const HTML_TYPE = 'text/html; charset=utf-8'\n\n/**\n * Every request header that changes what a response body contains.\n *\n * One url answers with a whole document, a partial payload, a named region or\n * an interceptor depending on these — so a cache keyed on the url alone, or on\n * `X-RSC` alone, will hand one client another's answer. They are materially\n * different bodies, not variations in presentation.\n */\nexport const VARY_ON_RSC = [\n  HEADER.rsc,\n  HEADER.segments,\n  HEADER.revalidate,\n  HEADER.intercept,\n  HEADER.referer,\n].join(', ')\n\n/**\n * What a response says about being stored, when it must not be.\n *\n * `Vary` alone is not enough on the platform this targets. Cloudflare ignores\n * `Vary` for everything except `Accept-Encoding`, and this package ships a\n * Workers story as a headline feature — so one url answering with a document,\n * a Flight payload, a segment and an interceptor, keyed only on the url, hands\n * one visitor another's body. Anything narrowed by a request header, and\n * anything behind a guard, says outright that it is not to be stored.\n */\nexport const PER_CLIENT = 'private, no-store'\n\n/**\n * And what a frozen, unguarded page says.\n *\n * Explicit rather than absent: with no directive at all, whether an\n * intermediary stores it comes down to that intermediary's heuristics, which\n * is not a decision this package should be leaving to chance in either\n * direction.\n */\nexport const REVALIDATE = 'public, max-age=0, must-revalidate'\n"]}
+{"version":3,"file":"headers.js","sourceRoot":"","sources":["../src/headers.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,2EAA2E;AAC3E,gCAAgC;AAChC,EAAE;AACF,gFAAgF;AAEhF,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB;;;OAGG;IACH,GAAG,EAAE,OAAO;IAEZ,iFAAiF;IACjF,QAAQ,EAAE,gBAAgB;IAE1B,kEAAkE;IAClE,YAAY,EAAE,qBAAqB;IAEnC,wCAAwC;IACxC,OAAO,EAAE,eAAe;IAExB,gFAAgF;IAChF,OAAO,EAAE,eAAe;IAExB,uDAAuD;IACvD,SAAS,EAAE,iBAAiB;IAE5B,gDAAgD;IAChD,OAAO,EAAE,eAAe;IAExB,uEAAuE;IACvE,UAAU,EAAE,kBAAkB;IAE9B,0CAA0C;IAC1C,MAAM,EAAE,cAAc;IAEtB;;;;;;;OAOG;IACH,QAAQ,EAAE,gBAAgB;IAE1B;;;;;;OAMG;IACH,WAAW,EAAE,oBAAoB;IAEjC;;;;;OAKG;IACH,UAAU,EAAE,cAAc;IAC1B;;;;;;;;;OASG;IACH;;;;;;;OAOG;IACH,KAAK,EAAE,aAAa;IAEpB,SAAS,EAAE,aAAa;IACxB,mEAAmE;IACnE,YAAY,EAAE,iBAAiB;IAC/B,uDAAuD;IACvD,aAAa,EAAE,kBAAkB;CACzB,CAAA;AAEV,sBAAsB;AACtB,MAAM,CAAC,MAAM,WAAW,GAAG,iCAAiC,CAAA;AAE5D,2BAA2B;AAC3B,MAAM,CAAC,MAAM,SAAS,GAAG,0BAA0B,CAAA;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,CAAC,GAAG;IACV,MAAM,CAAC,QAAQ;IACf,MAAM,CAAC,UAAU;IACjB,MAAM,CAAC,SAAS;IAChB,MAAM,CAAC,OAAO;CACf,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAEZ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,mBAAmB,CAAA;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,oCAAoC,CAAA","sourcesContent":["// The wire protocol, as names rather than string literals.\n//\n// A host writing these out by hand is how they drift. Two of them are not\n// negotiable at all — the client sends them or asks for them at fixed\n// addresses, and a host that spells one differently fails silently: the\n// request falls through, the decoder never runs, and a button does nothing\n// with no error on either side.\n//\n// PROTOCOL.md describes what each one means. This is the same list, importable.\n\nexport const HEADER = {\n  /**\n   * Present on a request for a Flight payload rather than the document. One\n   * url serves both, which is why every answer must Vary on it.\n   */\n  rsc: 'X-RSC',\n\n  /** The layout chain the client has mounted, outermost first, comma-separated. */\n  segments: 'X-RSC-Segments',\n\n  /** The boundary the answer replaces. 0 means a whole document. */\n  segmentDepth: 'X-RSC-Segment-Depth',\n\n  /** The chain to send back next time. */\n  layouts: 'X-RSC-Layouts',\n\n  /** Identifies the build, so a client can notice it is talking to an old one. */\n  version: 'X-RSC-Version',\n\n  /** The slot an intercepted navigation is targeting. */\n  intercept: 'X-RSC-Intercept',\n\n  /** Where the navigation or action came from. */\n  referer: 'X-RSC-Referer',\n\n  /** One named region of the current page to render and return alone. */\n  revalidate: 'X-RSC-Revalidate',\n\n  /** The server reference being invoked. */\n  action: 'X-RSC-Action',\n\n  /**\n   * Go here instead.\n   *\n   * Used for a redirect the client has to perform itself: a failed action, and\n   * a navigation whose render redirected. Never a 3xx for those — `fetch`\n   * follows one transparently, so the client would get the destination's HTML\n   * where it expected a Flight payload and decode it as one.\n   */\n  redirect: 'X-RSC-Redirect',\n\n  /**\n   * The body's real type.\n   *\n   * The body itself goes out as application/octet-stream so a host that parses\n   * multipart cannot consume it before the action does — reading Content-Type\n   * instead leaves an upload undecodable.\n   */\n  contentType: 'X-RSC-Content-Type',\n\n  /**\n   * Where the browser posts server actions.\n   *\n   * Not a convention this can choose: the client runtime posts here\n   * unconditionally.\n   */\n  actionPath: '/_rsc/action',\n  /**\n   * Where the browser reads queries.\n   *\n   * A GET, and that is the whole point of it being a separate address: a POST\n   * is cacheable by nothing, so a read routed through the action endpoint can\n   * never be kept by an HTTP cache, a CDN or a service worker. Only functions\n   * declared with `query()` are reachable here — the endpoint checks the mark\n   * before invoking anything, because otherwise this address would run any\n   * registered action over GET.\n   */\n  /**\n   * Sent on every read, and required by the query endpoint.\n   *\n   * A GET with no unusual header is a simple request, so any page could\n   * trigger one with an <img> and the visitor's cookies would ride along.\n   * This header is not CORS-safelisted, so the browser preflights it — the\n   * same thing that makes a POST carrying X-RSC-Action safe.\n   */\n  query: 'X-RSC-Query',\n\n  queryPath: '/_rsc/query',\n  /** Build-time shell for a PPR route, for an edge cache to hold. */\n  pprShellPath: '/_rsc/ppr-shell',\n  /** Finish a shell an edge cache is already serving. */\n  pprResumePath: '/_rsc/ppr-resume',\n} as const\n\n/** Flight payload. */\nexport const FLIGHT_TYPE = 'text/x-component; charset=utf-8'\n\n/** A rendered document. */\nexport const HTML_TYPE = 'text/html; charset=utf-8'\n\n/**\n * Every request header that changes what a response body contains.\n *\n * One url answers with a whole document, a partial payload, a named region or\n * an interceptor depending on these — so a cache keyed on the url alone, or on\n * `X-RSC` alone, will hand one client another's answer. They are materially\n * different bodies, not variations in presentation.\n */\nexport const VARY_ON_RSC = [\n  HEADER.rsc,\n  HEADER.segments,\n  HEADER.revalidate,\n  HEADER.intercept,\n  HEADER.referer,\n].join(', ')\n\n/**\n * What a response says about being stored, when it must not be.\n *\n * `Vary` alone is not enough on the platform this targets. Cloudflare ignores\n * `Vary` for everything except `Accept-Encoding`, and this package ships a\n * Workers story as a headline feature — so one url answering with a document,\n * a Flight payload, a segment and an interceptor, keyed only on the url, hands\n * one visitor another's body. Anything narrowed by a request header, and\n * anything behind a guard, says outright that it is not to be stored.\n */\nexport const PER_CLIENT = 'private, no-store'\n\n/**\n * And what a frozen, unguarded page says.\n *\n * Explicit rather than absent: with no directive at all, whether an\n * intermediary stores it comes down to that intermediary's heuristics, which\n * is not a decision this package should be leaving to chance in either\n * direction.\n */\nexport const REVALIDATE = 'public, max-age=0, must-revalidate'\n"]}

package/dist/host.d.ts

@@ -49,6 +49,17 @@ export interface RscEngine {
     handleAction(actionId: string, body: Uint8Array | string | FormData, contentType?: string, page?: unknown, takeRevalidated?: () => string[]): Promise<{
         stream: ReadableStream;
     }>;
+    /**
+     * Answer one read declared with `query()`, or null if that id is not one.
+     *
+     * Optional so a host can be pointed at a bundle built before queries existed;
+     * without it the endpoint 404s rather than throwing, which is what a client
+     * built against the same old bundle expects anyway.
+     */
+    handleQuery?(id: string, args: string, report?: (error: unknown) => string): Promise<{
+        stream: ReadableStream;
+        cacheControl: string;
+    } | null>;
 }
 export interface RscHostOptions {
     /** The built server bundle — `import * as engine from './build/rsc/index.js'`. */

package/dist/host.js

@@ -179,6 +179,18 @@ export function actionOriginAllowed(request, url) {
         return false;
     }
 }
+/**
+ * How large a query url may be before it is refused.
+ *
+ * Matched to the client's own limit, and enforced here too because the limit is
+ * what keeps an attacker from making this endpoint decode megabytes of
+ * attacker-chosen payload per request.
+ *
+ * Module scope, not inside the handler: everything declared after the handler
+ * is returned never initialises, and a `const` read from the closure then
+ * throws on every request instead of being undefined.
+ */
+const MAX_QUERY = 8_000;
 export function createRscHandler(options) {
     const { engine, assets, version } = options;
     // Annotated rather than inferred: the narrowing below is lost inside the
@@ -303,6 +315,16 @@ export function createRscHandler(options) {
             }
             return await handleAction(request, url);
         }
+        if (request.method === 'GET' && url.pathname === HEADER.queryPath) {
+            // Same check as an action, for a smaller reason: a cross-origin page
+            // cannot read this answer — CORS sees to that — but it can still cause
+            // the read to run with the visitor's cookies. A query is side-effect
+            // free by contract, so this is depth rather than the only defence.
+            if (!actionOriginAllowed(request, url)) {
+                return new Response('Cross-origin query', { status: 403 });
+            }
+            return await handleQuery(request, url);
+        }
         // The two halves an edge cache needs: hand it a shell it may keep, and
         // finish that shell for a visitor it cannot answer for itself.
         if (options.prerendered && url.pathname === HEADER.pprShellPath) {
@@ -846,6 +868,44 @@ export function createRscHandler(options) {
             }),
         });
     }
+    async function handleQuery(request, url) {
+        if (!engine.handleQuery)
+            return null;
+        // Required, and the reason is CSRF rather than routing. A GET carrying no
+        // unusual header is a SIMPLE request: any page anywhere can trigger one
+        // with <img src="…/_rsc/query?…"> and it goes out with the visitor's
+        // cookies. CORS stops them reading the answer; it does not stop the read
+        // running. This header is not CORS-safelisted, so a browser preflights it
+        // and nothing here answers a preflight — the same protection a POST
+        // carrying X-RSC-Action already had.
+        if (!request.headers.get(HEADER.query)) {
+            return new Response('Missing ' + HEADER.query, { status: 400 });
+        }
+        const id = url.searchParams.get('id');
+        const args = url.searchParams.get('args');
+        if (!id || args === null)
+            return new Response('Missing id or args', { status: 400 });
+        // Enforced here as well as in the client, because the limit is what keeps
+        // an attacker from making this endpoint decode megabytes of their payload
+        // per request.
+        if (url.search.length > MAX_QUERY)
+            return new Response('Query too large', { status: 414 });
+        const answered = await engine.handleQuery(id, args);
+        // Unknown id and registered-but-not-a-query are the same answer on purpose.
+        if (!answered)
+            return new Response('No such query', { status: 404 });
+        return new Response(answered.stream, {
+            headers: withVersion({
+                'Content-Type': FLIGHT_TYPE,
+                'Cache-Control': answered.cacheControl,
+                // The answer is narrowed by who is asking whenever a read touches the
+                // session, and the request that carries that is the cookie. Without
+                // this a shared cache keyed on the url alone hands one visitor
+                // another's answer — for any query that opted out of no-store.
+                Vary: 'Cookie, ' + HEADER.referer,
+            }),
+        });
+    }
     async function handleAction(request, url) {
         const actionId = request.headers.get(HEADER.action);
         if (!actionId)

package/dist/host.js.map

@@ -1 +1 @@
-{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,mDAAmD;AACnD,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,6EAA6E;AAC7E,2BAA2B;AAC3B,EAAE;AACF,+DAA+D;AAC/D,gGAAgG;AAEhG,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACpF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAE7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,gFAAgF;AAChF,yEAAyE;AACzE,mDAAmD;AACnD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAEtE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAElG,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAyHpF;;;;;;;;GAQG;AACH;;;;;;;;;;;;;GAaG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AAClC,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAe,EAAE,gBAAyB;IAClE,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;SAC/D,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;KACtD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CACzB,MAAsB,EACtB,KAA+B;IAE/B,2EAA2E;IAC3E,yEAAyE;IACzE,8DAA8D;IAC9D,IAAI,OAAO,MAAM,EAAE,SAAS,KAAK,UAAU;QAAE,OAAO,MAAM,CAAA;IAE1D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAEjC,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,wCAAwC;IACxC,OAAO,IAAI,cAAc,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAE3C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBAEzB,OAAM;YACR,CAAC;YAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;YAElB,6DAA6D;YAC7D,IAAI,EAAE,EAAE,CAAC;gBACP,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAA;YACnG,CAAC;YAED,UAAU,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;QACD,MAAM,CAAC,MAAM;YACX,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,YAAY,yBAAyB;QAAE,OAAO,GAAG,CAAA;IAC1D,IAAI,KAAK,YAAY,wBAAwB;QAAE,OAAO,GAAG,CAAA;IAEzD,yEAAyE;IACzE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,IAAI,GAAI,KAAkC,EAAE,IAAI,CAAA;IAEtD,IAAI,IAAI,KAAK,2BAA2B;QAAE,OAAO,GAAG,CAAA;IACpD,IAAI,IAAI,KAAK,0BAA0B;QAAE,OAAO,GAAG,CAAA;IAEnD,0EAA0E;IAC1E,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,OAAO,GAAI,KAA4C,EAAE,aAAa,CAAA;IAE5E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,IAAI,GAAG;QAAE,OAAO,OAAO,CAAA;IAEnF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,OAAO,GAAI,KAAqC,EAAE,OAAO,CAAA;IAE/D,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,GAAQ;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAA;IAEnG,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAuB;IACtD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3C,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,QAAQ,GAA8B,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAEnF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAkB,QAAQ,CAAA;IAEtC,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,iDAAiD;IACjD,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,SAAS;QAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAEhG,SAAS,oBAAoB,CAC3B,GAAuC,EACvC,MAAmC;QAEnC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,IAAY,EAAE,GAAG,IAAe,EAAE,EAAE;YAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;YAEpB,IAAI,EAAE;gBAAE,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;YAEhC,sEAAsE;YACtE,yEAAyE;YACzE,oDAAoD;YACpD,IAAI,MAAM;gBAAE,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAA;YAE9C,qEAAqE;YACrE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CACzG,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,KAAmB,EAAE,OAAgB;QAC3D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAA;IAC3E,CAAC;IAED,oFAAoF;IACpF,SAAS,WAAW,CAAC,KAAmB,EAAE,KAA8B;QACtE,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,KAAK;YACL,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;YAChC,iEAAiE;YACjE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;SAC/B,CAAA;IACH,CAAC;IAED,SAAS,WAAW,CAAC,OAA+B;QAClD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IACtE,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,EAAE,WAAW,IAAI,EAAE,CAAA;IAErD;;;;;;OAMG;IACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,uBAAuB,CAAC,GAAG,GAAG,CAC9G,CAAA;IAED,SAAS,cAAc,CAAC,QAAgB;QACtC,IAAI,WAAW,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QAEnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEzC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAA;IAC9C,CAAC;IAED,oEAAoE;IACpE,8EAA8E;IAC9E,wEAAwE;IACxE,kBAAkB;IAClB,OAAO,KAAK,UAAU,MAAM,CAAC,OAAgB;QAC3C,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,CACrC,SAAS,CAAC,GAAG,EAAE;QACb,qEAAqE;QACrE,uEAAuE;QACvE,gEAAgE;QAChE,iBAAiB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;YAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;YAErC,IAAI,EAAE,CAAA;YAEN,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAE1B,MAAM,SAAS,GAAG,KAAK,EAAE,CAAA;YAEzB,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBAChC,oEAAoE;gBACpE,mEAAmE;gBACnE,gEAAgE;gBAChE,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,YAAY;oBAAE,OAAM;gBAE/C,+DAA+D;gBAC/D,kEAAkE;gBAClE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACnC,CAAC,CAAC,CAAA;YAEF,yDAAyD;YACzD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;gBAC9C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,QAAQ,CAAA;QACjB,CAAC,CAAC,CACH,CACF,CAAA;IACH,CAAC,CAAA;IAED,KAAK,UAAU,KAAK,CAAC,OAAgB;QACnC,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAE9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,wEAAwE;YACxE,mEAAmE;YACnE,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAE5C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC5B,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;QACjE,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAEjD,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAA;QACzB,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;YACpE,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;gBACvC,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC7D,CAAC;YAED,OAAO,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YAChE,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;QAC/D,CAAC;QAED,IACE,OAAO,CAAC,MAAM,KAAK,MAAM;YACzB,OAAO,CAAC,WAAW;YACnB,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,aAAa,EACrC,CAAC;YACD,OAAO,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAA;QAEtE,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAE3D,IAAI,YAAY,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACtE,OAAO,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,CAAA;QAC3D,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAE3D,IAAI,aAAa,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACvE,OAAO,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAA;QAC3D,CAAC;QAED,2EAA2E;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAE9C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,4CAA4C;YAC5C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAEzD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAE3B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;YAExE,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;QAC3B,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QAClF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAA;QAEjC,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,yEAAyE;YACzE,4BAA4B;YAC5B,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBACxC,mEAAmE;gBACnE,qEAAqE;gBACrE,uEAAuE;gBACvE,0DAA0D;gBAC1D,IAAI,UAA0B,CAAA;gBAE9B,IAAI,CAAC;oBACH,CAAC;oBAAA,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CACjD,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,EACL,OAAO,EACP,KAAK,CAAC,KAAK,CAAC,QAAQ,EACpB,KAAK,CAAC,KAAK,CAAC,KAAK,EACjB,EAAE,EACF,SAAS,EACT,GAAG,CAAC,QAAQ;oBACZ,iEAAiE;oBACjE,mEAAmE;oBACnE,6CAA6C;oBAC7C,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAC/B,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,mEAAmE;oBACnE,qEAAqE;oBACrE,iCAAiC;oBACjC,EAAE;oBACF,mEAAmE;oBACnE,6DAA6D;oBAC7D,iEAAiE;oBACjE,mEAAmE;oBACnE,8CAA8C;oBAC9C,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;oBAEvB,IAAI,OAAO;wBAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;oBAGpD,kEAAkE;oBAClE,0DAA0D;oBAC1D,gEAAgE;oBAChE,kEAAkE;oBAClE,0CAA0C;oBAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;oBAEnC,IAAI,MAAM;wBAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;oBAClE,MAAM,KAAK,CAAA;gBACb,CAAC;gBAED,MAAM,KAAK,GAAG,KAAK,EAAE,CAAA;gBAErB,IAAI,KAAK;oBAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;gBAEhD,OAAO,IAAI,QAAQ,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE;oBACzD,OAAO,EAAE,WAAW,CAAC;wBACnB,cAAc,EAAE,SAAS;wBACzB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;wBACjC,IAAI,EAAE,WAAW;wBACjB,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;qBAC1E,CAAC;iBACH,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;QAErE,0EAA0E;QAC1E,yEAAyE;QACzE,6CAA6C;QAC7C,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,IAAI,MAAsB,CAAA;YAC1B,IAAI,YAAoB,CAAA;YAExB,IAAI,CAAC;gBACH,CAAC;gBAAA,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CACvD,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,EACL,OAAO,EACP,KAAK,CAAC,KAAK,CAAC,QAAQ,EACpB,KAAK,CAAC,KAAK,CAAC,KAAK,EACjB,EAAE,EACF,IAAI,EACJ,GAAG,CAAC,QAAQ,CACb,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mEAAmE;gBACnE,yCAAyC;gBACzC,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;gBAEvB,IAAI,OAAO;oBAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAGnD,qEAAqE;gBACrE,+CAA+C;gBAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;gBAEnC,IAAI,MAAM;oBAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBAClE,MAAM,KAAK,CAAA;YACb,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,EAAE,CAAA;YAErB,sEAAsE;YACtE,wEAAwE;YACxE,gCAAgC;YAChC,IAAI,KAAK;gBAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;YAE/C,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;gBAC1B,OAAO,EAAE,WAAW,CAAC;oBACnB,cAAc,EAAE,WAAW;oBAC3B,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;oBAC3C,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;oBACjC,IAAI,EAAE,WAAW;oBACjB,eAAe,EAAE,UAAU;iBAC5B,CAAC;aACH,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,GAAQ,EACR,IAAgD;QAEhD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAA;QAEtE,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAE1C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,4EAA4E;QAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAA;QAEtE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEhE,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YACnC,OAAO,IAAI,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAA;QACzD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QAEpG,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,QAAQ,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAElF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC,EAAE;YACvE,OAAO,EAAE,WAAW,CAAC;gBACnB,cAAc,EAAE,kBAAkB;gBAClC,sEAAsE;gBACtE,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE;gBACnE,qEAAqE;gBACrE,SAAS;gBACT,EAAE;gBACF,uEAAuE;gBACvE,oEAAoE;gBACpE,qEAAqE;gBACrE,iDAAiD;gBACjD,eAAe,EAAE,sBAAsB;aACxC,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,GAAQ,EACR,IAAgD;QAEhD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAE1C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAA;QACrD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAE1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEhE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAEzD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAE3B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,OAAO,IAAI,QAAQ,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAEvC,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAElC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,KAAK,IAAI;YAAE,QAAQ,GAAG,GAAG,CAAA;aACvD,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,WAAW,CAAC,CAAC,KAAK,IAAI;YAAE,QAAQ,GAAG,OAAO,CAAA;QAEzE,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CAAA;QAEjF,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAE7E,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CACjD,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAClE,KAAK,CAAC,KAAK,CAAC,QAAQ,EACpB,KAAK,CAAC,KAAK,CAAC,KAAK,EACjB,EAAE,EACF,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACjB,SAAS,EACT,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CACjC,CAAA;QAED,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,6BAA6B;QAC7B,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;YAC9B,OAAO,EAAE,WAAW,CAAC;gBACnB,cAAc,EAAE,SAAS;gBACzB,+CAA+C;gBAC/C,eAAe,EAAE,UAAU;aAC5B,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,GAAQ,EACR,MAAkD;QAElD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;QAEvD,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,gBAAgB,CAAC,CAAA;QAEzD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAyC,CAAA;YAE7E,OAAO,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAA;QACvE,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,4CAA4C;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,CAAA;YAEvC,kEAAkE;YAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE;oBACzB,OAAO,EAAE,WAAW,CAAC;wBACnB,cAAc,EAAE,SAAS;wBACzB,IAAI,EAAE,WAAW;wBACjB,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;qBAC3E,CAAC;iBACH,CAAC,CAAA;YACJ,CAAC;YAED,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,QAAQ,GAAkB,IAAI,CAAA;YAClC,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,WAAW,CAAC,CAAA;YAEzC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,QAAQ,GAAG,GAAG,CAAA;YAChB,CAAC;iBAAM,IAAI,KAAK,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBAEvC,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,OAAO,WAAW,CAAC,CAAA;gBAEzC,IAAI,KAAK,KAAK,IAAI;oBAAE,QAAQ,GAAG,OAAO,CAAA;YACxC,CAAC;YAED,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YAEpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CAAA;YAEtD,yEAAyE;YACzE,qEAAqE;YACrE,yEAAyE;YACzE,sDAAsD;YACtD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YAEpE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CACjD,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,MAAM;YACZ,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,kEAAkE;YAClE,uCAAuC;YACvC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAClE,KAAK,CAAC,KAAK,CAAC,QAAQ,EACpB,KAAK,CAAC,KAAK,CAAC,KAAK,EACjB,EAAE,EACF,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACjB,SAAS;YACT,uEAAuE;YACvE,uEAAuE;YACvE,uDAAuD;YACvD,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CACrC,CAAA;YAED,uEAAuE;YACvE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC;gBAC9B,KAAK,CAAC,KAAK,CAAC,UAAU;oBACpB,UAAU,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;oBAEnD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,CAAA;oBAErC,IAAI,CAAC;wBACH,OAAO,IAAI,EAAE,CAAC;4BACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;4BAE3C,IAAI,IAAI;gCAAE,MAAK;4BAEf,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;wBAC3B,CAAC;oBACH,CAAC;4BAAS,CAAC;wBACT,UAAU,CAAC,KAAK,EAAE,CAAA;oBACpB,CAAC;gBACH,CAAC;aACF,CAAC,CAAA;YAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,OAAO,EAAE,WAAW,CAAC;oBACnB,cAAc,EAAE,SAAS;oBACzB,IAAI,EAAE,WAAW;oBACjB,sEAAsE;oBACtE,yCAAyC;oBACzC,eAAe,EAAE,UAAU;iBAC5B,CAAC;aACH,CAAC,CAAA;QACJ,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,8BAA8B;QAE9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,CAAA;QAE3C,2EAA2E;QAC3E,wEAAwE;QACxE,6BAA6B;QAC7B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAE9B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,CAAa,CAAA;QAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;QAEvE,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,OAAO,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5E,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,CAAA;QAExD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAEjC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;YAC3B,OAAO,EAAE,WAAW,CAAC;gBACnB,cAAc,EAAE,WAAW;gBAC3B,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnD,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;gBACjC,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,UAAU;aAC5B,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,KAA0B;QAE1B,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,sDAAsD;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,OAAO,GACX,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAE5F,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QAEzB,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,0CAA0C;QAC1C,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CACjB,gEAAgE;gBAC9D,oDAAoD,EACtD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;QAE1D,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,kBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;gBAEvB,IAAI,OAAO;oBAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;gBAExD,8DAA8D;gBAC9D,oEAAoE;gBACpE,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;gBAEnC,IAAI,MAAM;oBAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBAElE,MAAM,KAAK,CAAA;YACb,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;YAEvB,OAAO,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9D,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,GAAQ,EAAE,MAAc;QACxE,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChC,OAAO,IAAI,QAAQ,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAE9C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEhE,yEAAyE;QACzE,mDAAmD;QACnD,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,IAAI,UAAkB,CAAA;YAEtB,IAAI,CAAC;gBACH,CAAC;gBAAA,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAoB,CAClD,MAAM,EACN,WAAW,CAAC,KAAK,EAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CACnD,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;gBAEvB,IAAI,OAAO;oBAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAEnD,MAAM,KAAK,CAAA;YACb,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;YAEvB,IAAI,OAAO;gBAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEnD,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;gBAC9B,OAAO,EAAE,WAAW,CAAC;oBACnB,cAAc,EAAE,WAAW;oBAC3B,4DAA4D;oBAC5D,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM;oBAC3B,IAAI,EAAE,WAAW;oBACjB,eAAe,EAAE,mBAAmB;iBACrC,CAAC;aACH,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,GAAQ,EAAE,IAAY;QACrE,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAE5D,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEnF,0EAA0E;QAC1E,EAAE;QACF,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,+BAA+B;QAC/B,EAAE;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAEpD,iEAAiE;QACjE,2EAA2E;QAC3E,qEAAqE;QACrE,wEAAwE;QACxE,4CAA4C;QAC5C,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEtE,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QAE/D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAExF,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAA;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAA;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;QAElD,uEAAuE;QACvE,wCAAwC;QACxC,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,KAAK,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;gBAC5D,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,uEAAuE;gBACvE,6BAA6B;gBAC7B,KAAK,EAAE,SAAS,CAAC,MAAM;gBACvB,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,EAAE;gBACZ,oEAAoE;gBACpE,qEAAqE;gBACrE,gBAAgB;gBAChB,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,SAAS,EAAE;aAC/C,CAAC,CAAA;YAEF,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;gBAC9B,OAAO,EAAE,WAAW,CAAC;oBACnB,cAAc,EAAE,WAAW;oBAC3B,+DAA+D;oBAC/D,mDAAmD;oBACnD,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI;oBACzB,IAAI,EAAE,WAAW;oBACjB,mEAAmE;oBACnE,kEAAkE;oBAClE,eAAe,EAAE,mBAAmB;iBACrC,CAAC;aACH,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAC3D,SAAS,EACT,KAAK,EACL,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EACzD,QAAQ,EACR,KAAK,EACL,EAAE,EACF,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,EACxD,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CACjC,CAAA;QAED,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;YAC1B,OAAO,EAAE,WAAW,CAAC;gBACnB,cAAc,EAAE,WAAW;gBAC3B,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3C,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;gBACjC,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,UAAU;aAC5B,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,GAAQ;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAEnD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAE3E,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;QACxD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,0BAA0B,CAAA;QAEzF,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACxF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAEnF,wEAAwE;QACxE,yEAAyE;QACzE,gCAAgC;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,CAAC,KAAK,EAAE,EAAE,CAClD,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAC9D,CAAA;QAED,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;YAC1B,OAAO,EAAE,WAAW,CAAC,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC;SAC5E,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["// Everything a JavaScript host has to do to serve the RSC engine.\n//\n// PHP needs ~2,400 lines for this because it cannot run JavaScript: a socket\n// bridge, a worker pool, a frame protocol. A JS host imports the engine and\n// calls it, and what remains is the part every host would otherwise rewrite —\n// matching a url to a route, negotiating how much of the page to send, and\n// speaking the header protocol the client expects.\n//\n// Deliberately not Hono, or Express, or anything: this takes a Request and\n// returns a Response, so it runs under Bun.serve, Deno, Workers, Node's\n// fetch adapters and any framework built on them. `./hono` is the three-line\n// binding for one of them.\n//\n//   const rsc = createRscHandler({ engine, manifest, assets })\n//   Bun.serve({ fetch: (req) => rsc(req).then((r) => r ?? new Response('', { status: 404 })) })\n\nimport { matchIntercept, matchRoute, retentionKey, sharedDepth } from './routing.js'\nimport { pathKey, patternKey } from './prerender.js'\nimport { withRevalidation } from './revalidate.js'\nexport { revalidate } from './revalidate.js'\nimport { withRedirect } from './redirect.js'\nimport { withCache } from './cache.js'\nimport { withRequest, withResponseDraft } from './request.js'\nimport type { Redirection } from './redirect.js'\nexport { redirect } from './redirect.js'\n// Re-exported, not redefined: routing.ts is the one implementation, shared with\n// the prerenderer and the generated bundle, and this stays the adapter's\n// public surface so a host imports from one place.\nexport { matchIntercept, matchRoute, sharedDepth } from './routing.js'\nexport type { MatchedRoute } from './routing.js'\nimport { FLIGHT_TYPE, HEADER, HTML_TYPE, PER_CLIENT, REVALIDATE, VARY_ON_RSC } from './headers.js'\nimport type { MatchedRoute } from './routing.js'\nimport { ServerAuthenticationError, ServerAuthorizationError } from './js/errors.js'\nimport type { RouteManifest } from './manifest.js'\n\n/** The built server bundle. Only the parts a host calls. */\nexport interface RscEngine {\n  /** The route table this bundle was built from. */\n  manifest?(): RouteManifest\n  installHostFn(fn: (name: string, ...args: unknown[]) => unknown): void\n  handleRscStream(\n    component: string,\n    props?: Record<string, unknown>,\n    layouts?: { component: string; props: Record<string, unknown> }[],\n    loadings?: string[],\n    parallelSlots?: Record<string, string>,\n    slotOverrides?: Record<string, unknown>,\n    from?: number,\n    pageKey?: string,\n  ): Promise<{ stream: ReadableStream; segmentDepth: number }>\n  handleRscHtmlStream(\n    component: string,\n    props?: Record<string, unknown>,\n    layouts?: { component: string; props: Record<string, unknown> }[],\n    loadings?: string[],\n    parallelSlots?: Record<string, string>,\n    slotOverrides?: Record<string, unknown>,\n    nonce?: string,\n    pageKey?: string,\n    bootstrap?: boolean,\n  ): Promise<{ htmlStream: ReadableStream }>\n  /**\n   * Finish a shell frozen at build time, against data that exists now.\n   *\n   * Emits only the boundaries the shell left unfinished, meant to be written\n   * straight after it. Optional so a host can be pointed at an engine built\n   * before resuming existed; without it a shell has no way to be completed and\n   * the page is rendered whole instead.\n   */\n  handleRscResume?(\n    component: string,\n    props?: Record<string, unknown>,\n    layouts?: { component: string; props: Record<string, unknown> }[],\n    loadings?: string[],\n    parallelSlots?: Record<string, string>,\n    slotOverrides?: Record<string, unknown>,\n    postponed?: unknown,\n    nonce?: string,\n    pageKey?: string,\n  ): Promise<{ htmlStream: ReadableStream }>\n  handleRscRevalidate?(target: string, page: unknown): Promise<{ rscPayload: string }>\n  /**\n   * Run a route's middleware without rendering anything.\n   *\n   * For a frozen page: the host reads it from disk and the engine never sees\n   * the request, so the check has to be asked for separately.\n   */\n  runRouteMiddleware?(component: string, props: Record<string, unknown>): Promise<void>\n  handleAction(\n    actionId: string,\n    body: Uint8Array | string | FormData,\n    contentType?: string,\n    page?: unknown,\n    takeRevalidated?: () => string[],\n  ): Promise<{ stream: ReadableStream }>\n}\n\nexport interface RscHostOptions {\n  /** The built server bundle — `import * as engine from './build/rsc/index.js'`. */\n  engine: RscEngine\n  /**\n   * The route table. Defaults to the one the bundle was built with, which is\n   * almost always what you want — a manifest passed separately can go stale\n   * against the bundle it is describing.\n   */\n  manifest?: RouteManifest\n  /**\n   * Functions the app's server components call as `await rpc('name', ...args)`.\n   *\n   * In the Laravel host this crosses a socket into PHP. Here they are just\n   * functions, which is the whole reason a JS host is smaller.\n   */\n  rpc?: Record<string, (...args: unknown[]) => unknown>\n  /**\n   * Where a host call goes when this process cannot answer it.\n   *\n   * `rpc` is checked first, so a host can answer some calls in JS and leave\n   * the rest to a backend. `httpHostCalls` in `@rsc-kit/core/host-calls`\n   * builds one of these over an ordinary POST, which is how a host written in\n   * another language answers without implementing the socket framing.\n   */\n  hostCalls?: (name: string, ...args: unknown[]) => Promise<unknown>\n  /**\n   * Props for a page, given whatever its url bound.\n   *\n   * Defaults to the url params alone. A host that loads a user, reads a\n   * session or resolves a tenant does it here — this is the one place the\n   * engine cannot supply anything for.\n   */\n  props?: (match: MatchedRoute, request: Request) => Record<string, unknown> | Promise<Record<string, unknown>>\n  /**\n   * Reads what the prerenderer wrote, if this build has any.\n   *\n   * A function rather than a directory, because not every host has a\n   * filesystem: on an edge runtime these live in a KV store or a static-asset\n   * binding. `prerenderedFrom` in `@rsc-kit/core/files` is the one for a disk.\n   *\n   * Checked before rendering, and anything it cannot find falls through to\n   * being rendered now — so a partial prerender is a valid state, not a\n   * broken one.\n   */\n  prerendered?: (name: string) => Promise<string | null> | string | null\n  /** Serve a built browser asset. Return null for anything not found. */\n  assets?: (pathname: string, request: Request) => Promise<Response | null> | Response | null\n  /**\n   * Identifies this build to the client, which compares it on every\n   * navigation and falls back to a full load when it changes. Without one a\n   * client keeps talking to a deployment that no longer exists — worst behind\n   * a CDN, where the shell it holds may already be from an older build.\n   */\n  version?: string\n}\n\n/**\n * The answer to a redirect that was decided before anything was written.\n *\n * A document gets a real status code. A payload request must NOT: `fetch`\n * follows a 3xx transparently, so the client would receive the destination's\n * HTML and hand it to the Flight decoder, which reports its own confusion\n * rather than the redirect. It gets 204 and a header instead, and navigates\n * itself — which is also what makes the redirect an SPA one.\n */\n/**\n * A string safe to write inside a <script> element.\n *\n * `JSON.stringify` escapes for JavaScript, and this is not a JavaScript\n * context — it is HTML that happens to contain JavaScript. The parser ends the\n * element at the first `</script`, wherever it appears, so a destination\n * carrying one closes the tag and whatever follows is markup the browser runs.\n *\n * That destination is routinely computed rather than written — redirect()\n * documents \"remembering where someone was going and sending them back to it\"\n * as the usual case, which is a query string or a cookie arriving verbatim\n * here. U+2028 and U+2029 are escaped too: legal in JSON, line terminators in\n * JavaScript.\n */\nfunction inScript(value: string): string {\n  return JSON.stringify(value)\n    .replace(/</g, '\\\\u003c')\n    .replace(/\\u2028/g, '\\\\u2028')\n    .replace(/\\u2029/g, '\\\\u2029')\n}\n\nfunction redirectResponse(to: Redirection, isPayloadRequest: boolean): Response {\n  if (isPayloadRequest) {\n    return new Response(null, {\n      status: 204,\n      headers: { [HEADER.redirect]: to.location, Vary: VARY_ON_RSC },\n    })\n  }\n\n  return new Response(null, {\n    status: to.status,\n    headers: { Location: to.location, Vary: VARY_ON_RSC },\n  })\n}\n\n/**\n * Append the redirect a render asked for after its shell had already gone out.\n *\n * The status line is spent by then, so the instruction travels in the body. A\n * script rather than waiting for hydration to notice the error digest: it runs\n * as the browser parses it, which is sooner, and it is the only path that\n * works at all for a route shipping no client runtime.\n *\n * Read on flush, because that is when the render has finished and a redirect\n * from inside a Suspense boundary is finally known.\n */\nfunction appendLateRedirect(\n  stream: ReadableStream,\n  taken: () => Redirection | null,\n): ReadableStream {\n  // An engine that answered with a finished body rather than a stream has no\n  // late window at all: the render was over before this was called, so the\n  // caller's own check already saw everything there was to see.\n  if (typeof stream?.getReader !== 'function') return stream\n\n  const encoder = new TextEncoder()\n  const reader = stream.getReader()\n\n  // Read-and-re-emit rather than pipeThrough(new TransformStream(...)): a\n  // TransformStream from a different realm than the stream it is piped into\n  // is rejected outright, and a host embedded in a runtime that supplies its\n  // own web streams is exactly that case.\n  return new ReadableStream({\n    async pull(controller) {\n      const { done, value } = await reader.read()\n\n      if (!done) {\n        controller.enqueue(value)\n\n        return\n      }\n\n      const to = taken()\n\n      // replace, so Back does not return to a url that redirected.\n      if (to) {\n        controller.enqueue(encoder.encode(`<script>location.replace(${inScript(to.location)})</script>`))\n      }\n\n      controller.close()\n    },\n    cancel(reason) {\n      return reader.cancel(reason)\n    },\n  })\n}\n\n/**\n * The status a refusal deserves, or null when this was not one.\n *\n * A host answers an unauthenticated call 401 and an unauthorized one 403, and\n * the transport raises each as its own error. Without this they arrive at the\n * render as ordinary failures and leave as 500s — which reads, to anyone\n * looking at a log or a browser, as the application being broken rather than\n * the visitor being turned away.\n */\nfunction refusalStatus(error: unknown): number | null {\n  if (error instanceof ServerAuthenticationError) return 401\n  if (error instanceof ServerAuthorizationError) return 403\n\n  // Named rather than matched by identity, because the error may have been\n  // raised by another copy of the module: an app's actions are bundled apart\n  // from the engine, and instanceof is false across that seam.\n  const name = (error as { name?: string } | null)?.name\n\n  if (name === 'ServerAuthenticationError') return 401\n  if (name === 'ServerAuthorizationError') return 403\n\n  // A status the host chose — a throttle's 429, a policy's 403 — carried on\n  // the error by the transport. Bounded to refusals: a host answering 500\n  // should not be able to make this look like a client's fault, and one\n  // answering 200 should not turn a failed render into a success.\n  const carried = (error as { refusalStatus?: unknown } | null)?.refusalStatus\n\n  if (typeof carried === 'number' && carried >= 400 && carried <= 499) return carried\n\n  return null\n}\n\nfunction refusalMessage(error: unknown): string {\n  const message = (error as { message?: string } | null)?.message\n\n  return typeof message === 'string' && message !== '' ? message : 'Refused.'\n}\n\n/**\n * Whether a browser was told it could post this action.\n *\n * Defence in depth, not the only defence. An action already requires the\n * X-RSC-Action header, which makes a cross-origin post a non-simple request —\n * so the browser must preflight it, and nothing here answers a preflight. A\n * browser can be tricked into sending cookies; it cannot be tricked into\n * sending a header it does not know. This is the belt to that pair of braces,\n * and it is what Next does for server actions.\n *\n * Compared against X-Forwarded-Host first, because a proxied deployment is the\n * normal one: the backend forwards the name the visitor typed, while Host is\n * this process on loopback. Comparing against Host alone would reject every\n * legitimate action that arrived through a proxy — a check that only fires on\n * correct requests is worse than none.\n *\n * No Origin at all is allowed through. It is absent on same-origin requests in\n * some browsers and on anything that is not a browser, and refusing those would\n * break server-to-server callers to catch an attacker who is already blocked by\n * the preflight.\n */\nexport function actionOriginAllowed(request: Request, url: URL): boolean {\n  const origin = request.headers.get('origin')\n\n  if (!origin) return true\n\n  const expected = request.headers.get('x-forwarded-host') ?? request.headers.get('host') ?? url.host\n\n  try {\n    return new URL(origin).host === expected\n  } catch {\n    // An Origin that is not a url is not one this can vouch for.\n    return false\n  }\n}\n\nexport function createRscHandler(options: RscHostOptions): (request: Request) => Promise<Response | null> {\n  const { engine, assets, version } = options\n  // Annotated rather than inferred: the narrowing below is lost inside the\n  // closures that use it, and every one of them runs after the throw.\n  const manifest: RouteManifest | undefined = options.manifest ?? engine.manifest?.()\n\n  if (!manifest) {\n    throw new Error(\n      'No route table. Pass `manifest`, or build with a plugin version that embeds one in the bundle.',\n    )\n  }\n\n  const routes: RouteManifest = manifest\n\n  // Only when this host has functions of its own. Installing unconditionally\n  // overwrites whatever was already registered — a prerenderer sharing the\n  // same engine instance, or a host that set its own up first — and the\n  // symptom is every call failing as unregistered.\n  if (options.rpc || options.hostCalls) installHostFunctions(options.rpc ?? {}, options.hostCalls)\n\n  function installHostFunctions(\n    fns: NonNullable<RscHostOptions['rpc']>,\n    remote: RscHostOptions['hostCalls'],\n  ): void {\n    engine.installHostFn(async (name: string, ...args: unknown[]) => {\n      const fn = fns[name]\n\n      if (fn) return await fn(...args)\n\n      // A remote transport cannot enumerate what the backend registered, so\n      // an unknown name is the backend's to reject — with a message naming the\n      // function, which is more than this side could say.\n      if (remote) return await remote(name, ...args)\n\n      // Louder than returning null: a typo in a server component otherwise\n      // renders as missing data with nothing anywhere saying why.\n      throw new Error(\n        `No host function named ${JSON.stringify(name)}. Registered: ${Object.keys(fns).join(', ') || '(none)'}`,\n      )\n    })\n  }\n\n  async function propsFor(match: MatchedRoute, request: Request): Promise<Record<string, unknown>> {\n    return options.props ? await options.props(match, request) : match.params\n  }\n\n  /** The page a server action was invoked from, so it can re-render regions of it. */\n  function pageContext(match: MatchedRoute, props: Record<string, unknown>) {\n    return {\n      component: match.route.component,\n      props,\n      layouts: match.route.layouts.map((component) => ({ component, props: {} })),\n      loadings: match.route.loadings,\n      parallelSlots: match.route.slots,\n      // What may be named in X-RSC-Revalidate — see renderRevalidated.\n      sections: match.route.sections,\n    }\n  }\n\n  function withVersion(headers: Record<string, string>): Record<string, string> {\n    return version ? { ...headers, [HEADER.version]: version } : headers\n  }\n\n  // A build made for export ships a client that asks for payloads by url,\n  // because a static host cannot read a header. Serving that build from a\n  // server is a reasonable thing to do — previewing an export, or one build\n  // used both ways — and without this every navigation 404s in the console\n  // while the page itself looks fine.\n  const payloadName = manifest.build?.payloadName || ''\n\n  /**\n   * The page a payload url belongs to, if this is one.\n   *\n   * Both the whole-document name and the depth variants beside it: a client\n   * built for export asks for index.seg1.rsc when it already holds a layout,\n   * and matching only the plain name leaves that as a 404 no page reports.\n   */\n  const payloadNames = new RegExp(\n    '/' + payloadName.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&').replace(/^index\\\\\\./, 'index(\\\\.seg\\\\d+)?\\\\.') + '$',\n  )\n\n  function pageForPayload(pathname: string): string | null {\n    if (payloadName === '') return null\n\n    const match = payloadNames.exec(pathname)\n\n    if (!match) return null\n\n    return pathname.slice(0, match.index) || '/'\n  }\n\n  // One memo table per request, opened at the outermost point so that\n  // everything below shares it: middleware, layouts, the page, and an action. A\n  // guard that reads the session and a layout that reads it again are one\n  // query, not two.\n  return async function handle(request: Request): Promise<Response | null> {\n    return await withRequest(request, () =>\n      withCache(() =>\n        // Open for the whole request and sealed the moment an answer exists,\n        // so middleware — which runs before any rendering — can put headers on\n        // it, and a component, which runs after, is told why it cannot.\n        withResponseDraft(async ({ taken, seal }) => {\n          const response = await route(request)\n\n          seal()\n\n          if (!response) return null\n\n          const collected = taken()\n\n          collected.forEach((value, name) => {\n            // Set-Cookie is applied below, once per cookie: iterating a Headers\n            // gives it joined in some runtimes and per-cookie in others, and a\n            // joined one is a single malformed cookie the browser discards.\n            if (name.toLowerCase() === 'set-cookie') return\n\n            // set, not append: a middleware asking for a header means that\n            // value, not that value added to whatever the host already chose.\n            response.headers.set(name, value)\n          })\n\n          // Appended, because several cookies are several headers.\n          for (const cookie of collected.getSetCookie()) {\n            response.headers.append('Set-Cookie', cookie)\n          }\n\n          return response\n        }),\n      ),\n    )\n  }\n\n  async function route(request: Request): Promise<Response | null> {\n    let url = new URL(request.url)\n    const asPayload = pageForPayload(url.pathname)\n\n    if (asPayload !== null) {\n      // Rewritten to the page it is asking about, with the header the rest of\n      // this handler reads — one path through, however the client asked.\n      url = new URL(asPayload + url.search, url.origin)\n      const headers = new Headers(request.headers)\n\n      headers.set(HEADER.rsc, '1')\n      request = new Request(url, { method: request.method, headers })\n    }\n\n    if (assets) {\n      const asset = await assets(url.pathname, request)\n\n      if (asset) return asset\n    }\n\n    if (request.method === 'POST' && url.pathname === HEADER.actionPath) {\n      if (!actionOriginAllowed(request, url)) {\n        return new Response('Cross-origin action', { status: 403 })\n      }\n\n      return await handleAction(request, url)\n    }\n\n    // The two halves an edge cache needs: hand it a shell it may keep, and\n    // finish that shell for a visitor it cannot answer for itself.\n    if (options.prerendered && url.pathname === HEADER.pprShellPath) {\n      return await servePprShell(request, url, options.prerendered)\n    }\n\n    if (\n      request.method === 'POST' &&\n      options.prerendered &&\n      url.pathname === HEADER.pprResumePath\n    ) {\n      return await servePprResume(request, url, options.prerendered)\n    }\n\n    if (request.method !== 'GET' && request.method !== 'HEAD') return null\n\n    // One named region of this page, asked for without mutating anything to\n    // earn it. What an action invalidated does not come through here — that\n    // travels back inside the action's own answer, which is the whole point of\n    // marking rather than telling the client to go and ask.\n    const revalidating = request.headers.get(HEADER.revalidate)\n\n    if (revalidating !== null && request.headers.get(HEADER.rsc) !== null) {\n      return await handleRevalidate(request, url, revalidating)\n    }\n\n    // An intercepted navigation renders the page you are already on, with the\n    // interceptor dropped into one of its slots — so the modal opens over it\n    // and the url changes. Only ever on a client navigation: a hard load has\n    // no referer to open over and gets the real page.\n    const interceptSlot = request.headers.get(HEADER.intercept)\n\n    if (interceptSlot !== null && request.headers.get(HEADER.rsc) !== null) {\n      return await handleIntercept(request, url, interceptSlot)\n    }\n\n    // Only now. A frozen page is a whole page, and both requests above ask for\n    // something smaller than one: answering a named region with the whole\n    // document puts the entire page inside that region, and answering an\n    // interception with it replaces the page the modal was opening over.\n    const match = matchRoute(routes, url.pathname)\n\n    if (options.prerendered) {\n      // A guarded route can still be frozen: whether the content is the same\n      // for everyone, and whether this caller may see it, are different\n      // questions. The build answers the first; this answers the second, and\n      // only then is the frozen page handed over.\n      const refusal = await refuseUnlessAllowed(request, match)\n\n      if (refusal) return refusal\n\n      const frozen = await servePrerendered(request, url, options.prerendered)\n\n      if (frozen) return frozen\n    }\n\n    if (!match) return null\n\n    const props = await propsFor(match, request)\n    const layouts = match.route.layouts.map((component) => ({ component, props: {} }))\n    const chain = match.route.layouts\n\n    // A payload request says so with a header on the page's own url, so one\n    // route serves both the document and the navigation that follows it.\n    if (request.headers.get(HEADER.rsc) === null) {\n      // Scoped to this render, so two requests redirecting at once cannot read\n      // each other's destination.\n      return await withRedirect(async (taken) => {\n        // Awaited, and that await is the whole design: React resolves this\n        // when the SHELL is ready, so a redirect thrown above every Suspense\n        // boundary rejects here — before a byte is written, with a status line\n        // still available. Nothing is buffered to make that true.\n        let htmlStream: ReadableStream\n\n        try {\n          ;({ htmlStream } = await engine.handleRscHtmlStream(\n            match.route.component,\n            props,\n            layouts,\n            match.route.loadings,\n            match.route.slots,\n            {},\n            undefined,\n            url.pathname,\n            // A route that ships no runtime gets no bootstrap and no segment\n            // boundary — the boundary is itself a client component, so leaving\n            // it in means no page could ever be JS-free.\n            match.route.clientJs !== false,\n          ))\n        } catch (error) {\n          // A rejected shell is how a redirect above every boundary arrives:\n          // React could not finish the shell, because the component that would\n          // have produced it left instead.\n          //\n          // The scope decides, not the error. React catches what a component\n          // threw and re-raises its own — whose message is stripped in\n          // production — so testing the caught value for a redirect signal\n          // fails exactly where it matters, and the answer is a 500 with the\n          // destination sitting in a scope nobody read.\n          const refused = taken()\n\n          if (refused) return redirectResponse(refused, false)\n\n\n          // A guard refusing is not a failed render. Without this a visitor\n          // who may not see the page gets a 500, which reads as the\n          // application being broken rather than them being turned away —\n          // and a host middleware refusal arrives exactly here, because the\n          // engine asks before it renders anything.\n          const status = refusalStatus(error)\n\n          if (status) return new Response(refusalMessage(error), { status })\n          throw error\n        }\n\n        const early = taken()\n\n        if (early) return redirectResponse(early, false)\n\n        return new Response(appendLateRedirect(htmlStream, taken), {\n          headers: withVersion({\n            'Content-Type': HTML_TYPE,\n            [HEADER.layouts]: chain.join(','),\n            Vary: VARY_ON_RSC,\n            'Cache-Control': match.route.middleware?.length ? PER_CLIENT : REVALIDATE,\n          }),\n        })\n      })\n    }\n\n    const from = sharedDepth(request.headers.get(HEADER.segments), chain)\n\n    // Proposed by the host, decided by the engine: an interceptor can force a\n    // wider render than the client asked for, so what goes back is the depth\n    // that came out, never the one that went in.\n    return await withRedirect(async (taken) => {\n      let stream: ReadableStream\n      let segmentDepth: number\n\n      try {\n        ;({ stream, segmentDepth } = await engine.handleRscStream(\n          match.route.component,\n          props,\n          layouts,\n          match.route.loadings,\n          match.route.slots,\n          {},\n          from,\n          url.pathname,\n        ))\n      } catch (error) {\n        // Same reasoning as the document path: what the render recorded is\n        // reliable, what React re-raised is not.\n        const refused = taken()\n\n        if (refused) return redirectResponse(refused, true)\n\n\n        // A payload request is guarded exactly as the document is. Narrowing\n        // a request must never narrow what is checked.\n        const status = refusalStatus(error)\n\n        if (status) return new Response(refusalMessage(error), { status })\n        throw error\n      }\n\n      const early = taken()\n\n      // 204 and a header. A payload request that redirected later than this\n      // carries the destination in the error digest instead, and the client's\n      // RedirectBoundary performs it.\n      if (early) return redirectResponse(early, true)\n\n      return new Response(stream, {\n        headers: withVersion({\n          'Content-Type': FLIGHT_TYPE,\n          [HEADER.segmentDepth]: String(segmentDepth),\n          [HEADER.layouts]: chain.join(','),\n          Vary: VARY_ON_RSC,\n          'Cache-Control': PER_CLIENT,\n        }),\n      })\n    })\n  }\n\n  /**\n   * A page rendered at build time, if there is one for this url.\n   *\n   * The payload has to match the depth the client shares, not simply exist.\n   * Serving the whole document to a client that already holds the layouts\n   * replaces the root — and replacing the root unmounts everything retained\n   * behind it, so going back stops restoring what you had.\n   */\n  /**\n   * The shell an edge cache may hold, for a route named by `?url=`.\n   *\n   * Only ever a build artifact, so there is nothing here that belongs to\n   * whoever asked. What it deliberately does NOT return is the postponed\n   * state. Next's protocol hands that to the CDN and takes it back on the\n   * resume, which makes the resume endpoint parse a blob an attacker can write\n   * — the shape of a known denial-of-service against it. Our origin has the\n   * file already, so the state never needs to leave.\n   *\n   * A guarded route is refused outright rather than guarded here. Its shell is\n   * not cacheable by a shared cache at all, so handing one to an edge that\n   * exists to cache things is an invitation to a mistake nobody would see.\n   */\n  async function servePprShell(\n    request: Request,\n    url: URL,\n    read: NonNullable<RscHostOptions['prerendered']>,\n  ): Promise<Response | null> {\n    if (request.method !== 'GET' && request.method !== 'HEAD') return null\n\n    const target = url.searchParams.get('url')\n\n    if (!target || !target.startsWith('/')) {\n      return new Response('A url is required', { status: 400 })\n    }\n\n    // Matched from the url asked for, never from anything else the caller sent.\n    const route = matchRoute(routes, new URL(target, url.origin).pathname)\n\n    if (!route) return new Response('No such page', { status: 404 })\n\n    if (route.route.middleware?.length) {\n      return new Response('This route is not edge-cacheable', { status: 404 })\n    }\n\n    const key = pathKey(new URL(target, url.origin).pathname)\n    const shell = (await read(`${key}.ppr.html`)) ?? (await read(`${patternKey(route.route)}.ppr.html`))\n\n    if (shell === null) return new Response('No shell for this page', { status: 404 })\n\n    return new Response(JSON.stringify({ shell, version: version ?? null }), {\n      headers: withVersion({\n        'Content-Type': 'application/json',\n        // Deliberately NOT the REVALIDATE the rest of the host sends. That is\n        // `max-age=0, must-revalidate`, which a cache honours by treating the\n        // entry as stale the moment it arrives — an edge would store this and\n        // never once serve it, so the whole thing would quietly do nothing\n        // while looking like it worked, because the miss path serves correct\n        // pages.\n        //\n        // This is build output with nothing of the caller in it, and a guarded\n        // route never reaches here at all, so it is genuinely cacheable. An\n        // hour bounds how long a deploy can be served against a stale shell;\n        // the version below catches it sooner than that.\n        'Cache-Control': 'public, max-age=3600',\n      }),\n    })\n  }\n\n  /**\n   * Finish a shell for the visitor this request belongs to.\n   *\n   * The whole security question lives here, because the holes are the part a\n   * guard exists to protect — the shell is chrome, and everything private is\n   * behind the boundaries this fills in. So it runs exactly the guard chain the\n   * page itself would, derived from the url and nothing else, against the\n   * cookies and headers the caller actually sent.\n   *\n   * Which means an edge worker must forward the visitor's request, not make one\n   * of its own. A resume asked for with no cookies is an anonymous visitor and\n   * gets an anonymous answer.\n   */\n  async function servePprResume(\n    request: Request,\n    url: URL,\n    read: NonNullable<RscHostOptions['prerendered']>,\n  ): Promise<Response | null> {\n    const target = url.searchParams.get('url')\n\n    if (!target || !target.startsWith('/')) {\n      return new Response('A url is required', { status: 400 })\n    }\n\n    const pathname = new URL(target, url.origin).pathname\n    const route = matchRoute(routes, pathname)\n\n    if (!route) return new Response('No such page', { status: 404 })\n\n    // The same refusal the document would get, before a byte of the holes is\n    // rendered. Nothing below runs for a caller this turns away.\n    const refusal = await refuseUnlessAllowed(request, route)\n\n    if (refusal) return refusal\n\n    if (!engine.handleRscResume) {\n      return new Response('This engine cannot resume', { status: 500 })\n    }\n\n    const key = pathKey(pathname)\n    const pattern = patternKey(route.route)\n\n    let shellKey: string | null = null\n\n    if ((await read(`${key}.ppr.html`)) !== null) shellKey = key\n    else if ((await read(`${pattern}.ppr.html`)) !== null) shellKey = pattern\n\n    // Read from our own artifacts. Never from the request body — that is the\n    // difference between this and the protocol it is modelled on.\n    const state = shellKey === null ? null : await read(`${shellKey}.postponed.json`)\n\n    if (state === null) return new Response('Nothing to resume', { status: 404 })\n\n    const { htmlStream } = await engine.handleRscResume(\n      route.route.component,\n      route.params,\n      route.route.layouts.map((component) => ({ component, props: {} })),\n      route.route.loadings,\n      route.route.slots,\n      {},\n      JSON.parse(state),\n      undefined,\n      shellKey === key ? pathname : '',\n    )\n\n    // Carries the build version so a caller holding a cached shell can tell\n    // that it no longer belongs to this origin. A shell from an older build\n    // does not make the resume fail — it replays against slots that have moved\n    // and React falls back to client rendering, silently and for good. Nothing\n    // else would ever report it.\n    return new Response(htmlStream, {\n      headers: withVersion({\n        'Content-Type': HTML_TYPE,\n        // Rendered for whoever asked. Never cacheable.\n        'Cache-Control': PER_CLIENT,\n      }),\n    })\n  }\n\n  async function servePrerendered(\n    request: Request,\n    url: URL,\n    source: NonNullable<RscHostOptions['prerendered']>,\n  ): Promise<Response | null> {\n    const key = pathKey(url.pathname)\n    const read = async (name: string) => await source(name)\n\n    // Before anything else: a route that only redirects was frozen as the\n    // redirect itself, so there is no page under this url and never will be.\n    const frozenRedirect = await read(`${key}.redirect.json`)\n\n    if (frozenRedirect !== null) {\n      const to = JSON.parse(frozenRedirect) as { status: number; location: string }\n\n      return redirectResponse(to, request.headers.get(HEADER.rsc) !== null)\n    }\n\n    if (request.headers.get(HEADER.rsc) === null) {\n      // A frozen page first; then a shell, under this url or under the route's\n      // pattern. Nothing in a shell varies by param, so one shell serves every\n      // url its route matches — which is the only way a route whose urls were\n      // never listed gets anything frozen at all.\n      const route = matchRoute(routes, url.pathname)\n      const whole = await read(`${key}.html`)\n\n      // A whole page is finished. Nothing to resume, nothing to render.\n      if (whole !== null) {\n        return new Response(whole, {\n          headers: withVersion({\n            'Content-Type': HTML_TYPE,\n            Vary: VARY_ON_RSC,\n            'Cache-Control': route?.route.middleware?.length ? PER_CLIENT : REVALIDATE,\n          }),\n        })\n      }\n\n      // Then a shell, under this url or under the route's pattern. Which of the\n      // two answered is tracked, because the state that resumes it sits beside\n      // the file that was found rather than beside the url that was asked for.\n      let shellKey: string | null = null\n      let shell = await read(`${key}.ppr.html`)\n\n      if (shell !== null) {\n        shellKey = key\n      } else if (route) {\n        const pattern = patternKey(route.route)\n\n        shell = await read(`${pattern}.ppr.html`)\n\n        if (shell !== null) shellKey = pattern\n      }\n\n      if (shell === null || shellKey === null) return null\n\n      const state = await read(`${shellKey}.postponed.json`)\n\n      // A shell with no state cannot be finished by anyone. It was frozen with\n      // its fallbacks showing and there is no record of what came next, so\n      // serving it would be serving a page that stays on its loading state for\n      // good. Fall through and render the page now instead.\n      if (state === null || !engine.handleRscResume || !route) return null\n\n      const { htmlStream } = await engine.handleRscResume(\n        route.route.component,\n        route.params,\n        // Empty props, because that is what the build passed. Resuming replays\n        // the tree against the slots the shell left, and React matches those by\n        // key — so an argument that differs from the frozen render at all is a\n        // tree that \"doesn't match\", and every boundary falls back to the\n        // client instead of being filled here.\n        route.route.layouts.map((component) => ({ component, props: {} })),\n        route.route.loadings,\n        route.route.slots,\n        {},\n        JSON.parse(state),\n        undefined,\n        // A shell found under the route's pattern was frozen for no particular\n        // url, so it was rendered with no page key. Handing one over now would\n        // key the tree differently from the one being resumed.\n        shellKey === key ? url.pathname : '',\n      )\n\n      // The shell first, then whatever the resume writes. React's own script\n      // travels with the resumed segments and moves them into place, so this is\n      // a plain concatenation and the holes land without hydration.\n      const body = new ReadableStream({\n        async start(controller) {\n          controller.enqueue(new TextEncoder().encode(shell))\n\n          const reader = htmlStream.getReader()\n\n          try {\n            while (true) {\n              const { done, value } = await reader.read()\n\n              if (done) break\n\n              controller.enqueue(value)\n            }\n          } finally {\n            controller.close()\n          }\n        },\n      })\n\n      return new Response(body, {\n        headers: withVersion({\n          'Content-Type': HTML_TYPE,\n          Vary: VARY_ON_RSC,\n          // The shell is cacheable; this response is not. It carries the holes,\n          // which were rendered for whoever asked.\n          'Cache-Control': PER_CLIENT,\n        }),\n      })\n    }\n\n    // Only the document is ever served frozen for a shell. The payload is what\n    // fills it in, and it has to be rendered now — answering with a frozen one\n    // would hand back the same fallbacks the shell already shows, and the page\n    // would never finish loading.\n\n    const meta = await read(`${key}.meta.json`)\n\n    // Both or neither: without the chain there is no way to know which depth a\n    // payload is for, and guessing means handing the client a segment for a\n    // boundary it does not have.\n    if (meta === null) return null\n\n    const chain = (JSON.parse(meta).layouts ?? []) as string[]\n    const shared = sharedDepth(request.headers.get(HEADER.segments), chain)\n\n    // The variant for exactly this depth, or the whole document. Anything else\n    // would be a payload for a boundary the client is not holding.\n    const variant = shared > 0 ? await read(`${key}.seg${shared}.flight`) : null\n    const payload = variant ?? (await read(`${key}.flight`))\n\n    if (payload === null) return null\n\n    return new Response(payload, {\n      headers: withVersion({\n        'Content-Type': FLIGHT_TYPE,\n        [HEADER.segmentDepth]: String(variant ? shared : 0),\n        [HEADER.layouts]: chain.join(','),\n        Vary: VARY_ON_RSC,\n        'Cache-Control': PER_CLIENT,\n      }),\n    })\n  }\n\n  /**\n   * The middleware of a route, or null to go ahead.\n   *\n   * Used wherever a render can be reached without the engine running the chain\n   * itself: a page served from disk, and an interception, which renders a\n   * component the route table did not choose.\n   *\n   * Asked before anything is read or rendered — the answer to a refusal must\n   * not be a page that has already been fetched.\n   */\n  async function refuseUnlessAllowed(\n    request: Request,\n    match: MatchedRoute | null,\n  ): Promise<Response | null> {\n    // hostMiddleware as well as the engine's own. A page served from disk\n    // never touches the engine, so a route guarded only by the host would be\n    // handed over without anyone being asked — the guard would hold right up\n    // until the build froze the page, then silently stop.\n    if (!match) return null\n\n    const guarded =\n      (match.route.middleware?.length ?? 0) > 0 || (match.route.hostMiddleware?.length ?? 0) > 0\n\n    if (!guarded) return null\n\n    // A route that declares middleware and an engine that cannot run it is not\n    // \"no middleware\" — it is a check that silently does not happen. Refusing\n    // is the only safe reading, and it names the cause rather than serving the\n    // guarded page. Reachable when a host runs a bundle built by an older\n    // plugin, where the export did not exist.\n    if (!engine.runRouteMiddleware) {\n      return new Response(\n        'This route declares middleware, and the engine cannot run it. ' +\n          'Rebuild the app against the current @rsc-kit/core.',\n        { status: 500 },\n      )\n    }\n\n    const asPayload = request.headers.get(HEADER.rsc) !== null\n\n    return await withRedirect(async (taken) => {\n      try {\n        await engine.runRouteMiddleware!(match.route.component, await propsFor(match, request))\n      } catch (error) {\n        const refused = taken()\n\n        if (refused) return redirectResponse(refused, asPayload)\n\n        // A visitor who may not see this page has not caused a server\n        // error. Answering 500 makes a guarded route indistinguishable from\n        // a broken one, in the logs and to the person looking at it.\n        const status = refusalStatus(error)\n\n        if (status) return new Response(refusalMessage(error), { status })\n\n        throw error\n      }\n\n      const refused = taken()\n\n      return refused ? redirectResponse(refused, asPayload) : null\n    })\n  }\n\n  async function handleRevalidate(request: Request, url: URL, target: string): Promise<Response> {\n    if (!engine.handleRscRevalidate) {\n      return new Response('This build cannot revalidate', { status: 501 })\n    }\n\n    const match = matchRoute(routes, url.pathname)\n\n    if (!match) return new Response('No such page', { status: 404 })\n\n    // Scoped like the render paths: a guard above the target may refuse, and\n    // that refusal is an answer rather than a failure.\n    return await withRedirect(async (taken) => {\n      let rscPayload: string\n\n      try {\n        ;({ rscPayload } = await engine.handleRscRevalidate!(\n          target,\n          pageContext(match, await propsFor(match, request)),\n        ))\n      } catch (error) {\n        const refused = taken()\n\n        if (refused) return redirectResponse(refused, true)\n\n        throw error\n      }\n\n      const refused = taken()\n\n      if (refused) return redirectResponse(refused, true)\n\n      return new Response(rscPayload, {\n        headers: withVersion({\n          'Content-Type': FLIGHT_TYPE,\n          // Echoed so the client can tell which region it is holding.\n          [HEADER.revalidate]: target,\n          Vary: VARY_ON_RSC,\n          'Cache-Control': 'private, no-store',\n        }),\n      })\n    })\n  }\n\n  async function handleIntercept(request: Request, url: URL, slot: string): Promise<Response> {\n    const intercept = matchIntercept(routes, url.pathname, slot)\n\n    if (!intercept) return new Response('No interceptor for this url', { status: 404 })\n\n    // The guards of the route being intercepted, before anything is rendered.\n    //\n    // An interceptor exists to show the same resource as the route it stands in\n    // for — a modal over /orders/[id] shows that order. So it has to be behind\n    // the same checks, and nothing else in this path runs them: the engine is\n    // handed the interceptor component, which the route table did not choose\n    // and whose middleware chain is keyed off manifest().routes, where an\n    // interceptor does not appear.\n    //\n    // Derived from the url, never from X-RSC-Referer. The referer is a header\n    // the caller writes, and guarding by it means the caller picks the guard.\n    const intercepted = matchRoute(routes, url.pathname)\n\n    // Nothing to guard means nothing to serve. A url that matches an\n    // interceptor but no route has no middleware chain to consult, so there is\n    // no way to know whether this caller may see it — and an interceptor\n    // stands in for a route, so a url with no route behind it is not a page\n    // anyone was entitled to open a modal over.\n    if (!intercepted) return new Response('No such page', { status: 404 })\n\n    const refusal = await refuseUnlessAllowed(request, intercepted)\n\n    if (refusal) return refusal\n\n    const referer = request.headers.get(HEADER.referer)\n    const under = referer ? matchRoute(routes, new URL(referer, url.origin).pathname) : null\n\n    // Without a page to open over there is nothing to intercept: render the\n    // interceptor on its own rather than answering with the wrong page.\n    const component = under ? under.route.component : intercept.component\n    const props = under ? await propsFor(under, request) : intercept.params\n    const chain = under ? under.route.layouts : []\n    const slots = under ? under.route.slots : {}\n    const loadings = under ? under.route.loadings : []\n\n    // The interceptor alone, when there is a page to open it over and this\n    // build can render a region on its own.\n    //\n    // Re-rendering the page underneath would put the modal on screen at the\n    // cost of rebuilding everything below the layout that declares the slot —\n    // so opening a modal from a half-filled form throws the form away. The\n    // page beneath is already mounted and correct; only the slot is new.\n    if (under && engine.handleRscRevalidate) {\n      const { rscPayload } = await engine.handleRscRevalidate(slot, {\n        component: under.route.component,\n        // The target's params, not the page's: a modal for /posts/hello opened\n        // from /feed is about hello.\n        props: intercept.params,\n        layouts: [],\n        loadings: [],\n        // Named as the slot so the renderer finds it there, but pointing at\n        // the interceptor rather than the default this route would otherwise\n        // fill it with.\n        parallelSlots: { [slot]: intercept.component },\n      })\n\n      return new Response(rscPayload, {\n        headers: withVersion({\n          'Content-Type': FLIGHT_TYPE,\n          // Says what this payload is, so the client puts it in the slot\n          // instead of treating it as a segment of the page.\n          [HEADER.revalidate]: slot,\n          Vary: VARY_ON_RSC,\n          // Per-client by construction: which region this is was chosen by a\n          // request header, so a shared cache has nothing useful to key on.\n          'Cache-Control': 'private, no-store',\n        }),\n      })\n    }\n\n    const { stream, segmentDepth } = await engine.handleRscStream(\n      component,\n      props,\n      chain.map((layout) => ({ component: layout, props: {} })),\n      loadings,\n      slots,\n      {},\n      sharedDepth(request.headers.get(HEADER.segments), chain),\n      retentionKey(url.pathname, slot),\n    )\n\n    return new Response(stream, {\n      headers: withVersion({\n        'Content-Type': FLIGHT_TYPE,\n        [HEADER.segmentDepth]: String(segmentDepth),\n        [HEADER.layouts]: chain.join(','),\n        Vary: VARY_ON_RSC,\n        'Cache-Control': PER_CLIENT,\n      }),\n    })\n  }\n\n  async function handleAction(request: Request, url: URL): Promise<Response> {\n    const actionId = request.headers.get(HEADER.action)\n\n    if (!actionId) return new Response('Missing X-RSC-Action', { status: 400 })\n\n    // The body travels as application/octet-stream so a host that parses\n    // multipart cannot consume it first; its real type rides in a header.\n    const body = new Uint8Array(await request.arrayBuffer())\n    const contentType = request.headers.get(HEADER.contentType) ?? 'text/plain;charset=UTF-8'\n\n    // Where it was invoked from, so anything the action invalidates can be\n    // re-rendered against the page that is actually on screen.\n    const referer = request.headers.get(HEADER.referer)\n    const match = referer ? matchRoute(routes, new URL(referer, url.origin).pathname) : null\n    const page = match ? pageContext(match, await propsFor(match, request)) : undefined\n\n    // Scoped to this action: revalidate() called anywhere inside it, at any\n    // depth, marks here and nowhere else — two requests can be in flight and\n    // marking is per-request state.\n    const { stream } = await withRevalidation((taken) =>\n      engine.handleAction(actionId, body, contentType, page, taken),\n    )\n\n    return new Response(stream, {\n      headers: withVersion({ 'Content-Type': 'text/x-component; charset=utf-8' }),\n    })\n  }\n}\n"]}
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,mDAAmD;AACnD,EAAE;AACF,2EAA2E;AAC3E,wEAAwE;AACxE,6EAA6E;AAC7E,2BAA2B;AAC3B,EAAE;AACF,+DAA+D;AAC/D,gGAAgG;AAEhG,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AACpF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAE7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,gFAAgF;AAChF,yEAAyE;AACzE,mDAAmD;AACnD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAEtE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAElG,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAA;AAqIpF;;;;;;;;GAQG;AACH;;;;;;;;;;;;;GAaG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AAClC,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAe,EAAE,gBAAyB;IAClE,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;SAC/D,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE;KACtD,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,kBAAkB,CACzB,MAAsB,EACtB,KAA+B;IAE/B,2EAA2E;IAC3E,yEAAyE;IACzE,8DAA8D;IAC9D,IAAI,OAAO,MAAM,EAAE,SAAS,KAAK,UAAU;QAAE,OAAO,MAAM,CAAA;IAE1D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAEjC,wEAAwE;IACxE,0EAA0E;IAC1E,2EAA2E;IAC3E,wCAAwC;IACxC,OAAO,IAAI,cAAc,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAE3C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;gBAEzB,OAAM;YACR,CAAC;YAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;YAElB,6DAA6D;YAC7D,IAAI,EAAE,EAAE,CAAC;gBACP,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAA;YACnG,CAAC;YAED,UAAU,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;QACD,MAAM,CAAC,MAAM;YACX,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAC9B,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,YAAY,yBAAyB;QAAE,OAAO,GAAG,CAAA;IAC1D,IAAI,KAAK,YAAY,wBAAwB;QAAE,OAAO,GAAG,CAAA;IAEzD,yEAAyE;IACzE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,IAAI,GAAI,KAAkC,EAAE,IAAI,CAAA;IAEtD,IAAI,IAAI,KAAK,2BAA2B;QAAE,OAAO,GAAG,CAAA;IACpD,IAAI,IAAI,KAAK,0BAA0B;QAAE,OAAO,GAAG,CAAA;IAEnD,0EAA0E;IAC1E,wEAAwE;IACxE,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,OAAO,GAAI,KAA4C,EAAE,aAAa,CAAA;IAE5E,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,IAAI,GAAG;QAAE,OAAO,OAAO,CAAA;IAEnF,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,OAAO,GAAI,KAAqC,EAAE,OAAO,CAAA;IAE/D,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAA;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,GAAQ;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE5C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAExB,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAA;IAEnG,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,SAAS,GAAG,KAAK,CAAA;AAEvB,MAAM,UAAU,gBAAgB,CAAC,OAAuB;IACtD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAA;IAC3C,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,QAAQ,GAA8B,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;IAEnF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,gGAAgG,CACjG,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAkB,QAAQ,CAAA;IAEtC,2EAA2E;IAC3E,yEAAyE;IACzE,sEAAsE;IACtE,iDAAiD;IACjD,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,SAAS;QAAE,oBAAoB,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAEhG,SAAS,oBAAoB,CAC3B,GAAuC,EACvC,MAAmC;QAEnC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,IAAY,EAAE,GAAG,IAAe,EAAE,EAAE;YAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;YAEpB,IAAI,EAAE;gBAAE,OAAO,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAA;YAEhC,sEAAsE;YACtE,yEAAyE;YACzE,oDAAoD;YACpD,IAAI,MAAM;gBAAE,OAAO,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAA;YAE9C,qEAAqE;YACrE,4DAA4D;YAC5D,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CACzG,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,QAAQ,CAAC,KAAmB,EAAE,OAAgB;QAC3D,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAA;IAC3E,CAAC;IAED,oFAAoF;IACpF,SAAS,WAAW,CAAC,KAAmB,EAAE,KAA8B;QACtE,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;YAChC,KAAK;YACL,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3E,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;YAC9B,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;YAChC,iEAAiE;YACjE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;SAC/B,CAAA;IACH,CAAC;IAED,SAAS,WAAW,CAAC,OAA+B;QAClD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IACtE,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,oCAAoC;IACpC,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,EAAE,WAAW,IAAI,EAAE,CAAA;IAErD;;;;;;OAMG;IACH,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,uBAAuB,CAAC,GAAG,GAAG,CAC9G,CAAA;IAED,SAAS,cAAc,CAAC,QAAgB;QACtC,IAAI,WAAW,KAAK,EAAE;YAAE,OAAO,IAAI,CAAA;QAEnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAEzC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAA;IAC9C,CAAC;IAED,oEAAoE;IACpE,8EAA8E;IAC9E,wEAAwE;IACxE,kBAAkB;IAClB,OAAO,KAAK,UAAU,MAAM,CAAC,OAAgB;QAC3C,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,CACrC,SAAS,CAAC,GAAG,EAAE;QACb,qEAAqE;QACrE,uEAAuE;QACvE,gEAAgE;QAChE,iBAAiB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;YAC1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAA;YAErC,IAAI,EAAE,CAAA;YAEN,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAE1B,MAAM,SAAS,GAAG,KAAK,EAAE,CAAA;YAEzB,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;gBAChC,oEAAoE;gBACpE,mEAAmE;gBACnE,gEAAgE;gBAChE,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,YAAY;oBAAE,OAAM;gBAE/C,+DAA+D;gBAC/D,kEAAkE;gBAClE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACnC,CAAC,CAAC,CAAA;YAEF,yDAAyD;YACzD,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,YAAY,EAAE,EAAE,CAAC;gBAC9C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;YAC/C,CAAC;YAED,OAAO,QAAQ,CAAA;QACjB,CAAC,CAAC,CACH,CACF,CAAA;IACH,CAAC,CAAA;IAED,KAAK,UAAU,KAAK,CAAC,OAAgB;QACnC,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9B,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAE9C,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,wEAAwE;YACxE,mEAAmE;YACnE,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;YACjD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAE5C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC5B,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;QACjE,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAEjD,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAA;QACzB,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;YACpE,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;gBACvC,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC7D,CAAC;YAED,OAAO,MAAM,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAClE,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,mEAAmE;YACnE,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;gBACvC,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC5D,CAAC;YAED,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACxC,CAAC;QAED,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;YAChE,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;QAC/D,CAAC;QAED,IACE,OAAO,CAAC,MAAM,KAAK,MAAM;YACzB,OAAO,CAAC,WAAW;YACnB,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,aAAa,EACrC,CAAC;YACD,OAAO,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAA;QAEtE,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAE3D,IAAI,YAAY,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACtE,OAAO,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,CAAA;QAC3D,CAAC;QAED,0EAA0E;QAC1E,yEAAyE;QACzE,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAE3D,IAAI,aAAa,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACvE,OAAO,MAAM,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,CAAA;QAC3D,CAAC;QAED,2EAA2E;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAE9C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,4CAA4C;YAC5C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAEzD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAE3B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,CAAA;YAExE,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;QAC3B,CAAC;QAED,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QAClF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAA;QAEjC,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,yEAAyE;YACzE,4BAA4B;YAC5B,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBACxC,mEAAmE;gBACnE,qEAAqE;gBACrE,uEAAuE;gBACvE,0DAA0D;gBAC1D,IAAI,UAA0B,CAAA;gBAE9B,IAAI,CAAC;oBACH,CAAC;oBAAA,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CACjD,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,EACL,OAAO,EACP,KAAK,CAAC,KAAK,CAAC,QAAQ,EACpB,KAAK,CAAC,KAAK,CAAC,KAAK,EACjB,EAAE,EACF,SAAS,EACT,GAAG,CAAC,QAAQ;oBACZ,iEAAiE;oBACjE,mEAAmE;oBACnE,6CAA6C;oBAC7C,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAC/B,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,mEAAmE;oBACnE,qEAAqE;oBACrE,iCAAiC;oBACjC,EAAE;oBACF,mEAAmE;oBACnE,6DAA6D;oBAC7D,iEAAiE;oBACjE,mEAAmE;oBACnE,8CAA8C;oBAC9C,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;oBAEvB,IAAI,OAAO;wBAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;oBAGpD,kEAAkE;oBAClE,0DAA0D;oBAC1D,gEAAgE;oBAChE,kEAAkE;oBAClE,0CAA0C;oBAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;oBAEnC,IAAI,MAAM;wBAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;oBAClE,MAAM,KAAK,CAAA;gBACb,CAAC;gBAED,MAAM,KAAK,GAAG,KAAK,EAAE,CAAA;gBAErB,IAAI,KAAK;oBAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;gBAEhD,OAAO,IAAI,QAAQ,CAAC,kBAAkB,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE;oBACzD,OAAO,EAAE,WAAW,CAAC;wBACnB,cAAc,EAAE,SAAS;wBACzB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;wBACjC,IAAI,EAAE,WAAW;wBACjB,eAAe,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;qBAC1E,CAAC;iBACH,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;QAErE,0EAA0E;QAC1E,yEAAyE;QACzE,6CAA6C;QAC7C,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,IAAI,MAAsB,CAAA;YAC1B,IAAI,YAAoB,CAAA;YAExB,IAAI,CAAC;gBACH,CAAC;gBAAA,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CACvD,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,EACL,OAAO,EACP,KAAK,CAAC,KAAK,CAAC,QAAQ,EACpB,KAAK,CAAC,KAAK,CAAC,KAAK,EACjB,EAAE,EACF,IAAI,EACJ,GAAG,CAAC,QAAQ,CACb,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,mEAAmE;gBACnE,yCAAyC;gBACzC,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;gBAEvB,IAAI,OAAO;oBAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAGnD,qEAAqE;gBACrE,+CAA+C;gBAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;gBAEnC,IAAI,MAAM;oBAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBAClE,MAAM,KAAK,CAAA;YACb,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,EAAE,CAAA;YAErB,sEAAsE;YACtE,wEAAwE;YACxE,gCAAgC;YAChC,IAAI,KAAK;gBAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;YAE/C,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;gBAC1B,OAAO,EAAE,WAAW,CAAC;oBACnB,cAAc,EAAE,WAAW;oBAC3B,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;oBAC3C,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;oBACjC,IAAI,EAAE,WAAW;oBACjB,eAAe,EAAE,UAAU;iBAC5B,CAAC;aACH,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;OAOG;IACH;;;;;;;;;;;;;OAaG;IACH,KAAK,UAAU,aAAa,CAC1B,OAAgB,EAChB,GAAQ,EACR,IAAgD;QAEhD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAA;QAEtE,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAE1C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,4EAA4E;QAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAA;QAEtE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEhE,IAAI,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;YACnC,OAAO,IAAI,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAA;QACzD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;QAEpG,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,QAAQ,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAElF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC,EAAE;YACvE,OAAO,EAAE,WAAW,CAAC;gBACnB,cAAc,EAAE,kBAAkB;gBAClC,sEAAsE;gBACtE,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE;gBACnE,qEAAqE;gBACrE,SAAS;gBACT,EAAE;gBACF,uEAAuE;gBACvE,oEAAoE;gBACpE,qEAAqE;gBACrE,iDAAiD;gBACjD,eAAe,EAAE,sBAAsB;aACxC,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,UAAU,cAAc,CAC3B,OAAgB,EAChB,GAAQ,EACR,IAAgD;QAEhD,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAE1C,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAA;QACrD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAE1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEhE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAEzD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAE3B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,OAAO,IAAI,QAAQ,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnE,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAEvC,IAAI,QAAQ,GAAkB,IAAI,CAAA;QAElC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,KAAK,IAAI;YAAE,QAAQ,GAAG,GAAG,CAAA;aACvD,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,OAAO,WAAW,CAAC,CAAC,KAAK,IAAI;YAAE,QAAQ,GAAG,OAAO,CAAA;QAEzE,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CAAA;QAEjF,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAE7E,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CACjD,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,MAAM,EACZ,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAClE,KAAK,CAAC,KAAK,CAAC,QAAQ,EACpB,KAAK,CAAC,KAAK,CAAC,KAAK,EACjB,EAAE,EACF,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACjB,SAAS,EACT,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CACjC,CAAA;QAED,wEAAwE;QACxE,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,6BAA6B;QAC7B,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;YAC9B,OAAO,EAAE,WAAW,CAAC;gBACnB,cAAc,EAAE,SAAS;gBACzB,+CAA+C;gBAC/C,eAAe,EAAE,UAAU;aAC5B,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,gBAAgB,CAC7B,OAAgB,EAChB,GAAQ,EACR,MAAkD;QAElD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;QAEvD,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,gBAAgB,CAAC,CAAA;QAEzD,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAyC,CAAA;YAE7E,OAAO,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAA;QACvE,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,4CAA4C;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC9C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,CAAA;YAEvC,kEAAkE;YAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,IAAI,QAAQ,CAAC,KAAK,EAAE;oBACzB,OAAO,EAAE,WAAW,CAAC;wBACnB,cAAc,EAAE,SAAS;wBACzB,IAAI,EAAE,WAAW;wBACjB,eAAe,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;qBAC3E,CAAC;iBACH,CAAC,CAAA;YACJ,CAAC;YAED,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,IAAI,QAAQ,GAAkB,IAAI,CAAA;YAClC,IAAI,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,WAAW,CAAC,CAAA;YAEzC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,QAAQ,GAAG,GAAG,CAAA;YAChB,CAAC;iBAAM,IAAI,KAAK,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;gBAEvC,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,OAAO,WAAW,CAAC,CAAA;gBAEzC,IAAI,KAAK,KAAK,IAAI;oBAAE,QAAQ,GAAG,OAAO,CAAA;YACxC,CAAC;YAED,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAA;YAEpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CAAA;YAEtD,yEAAyE;YACzE,qEAAqE;YACrE,yEAAyE;YACzE,sDAAsD;YACtD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YAEpE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CACjD,KAAK,CAAC,KAAK,CAAC,SAAS,EACrB,KAAK,CAAC,MAAM;YACZ,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,kEAAkE;YAClE,uCAAuC;YACvC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAClE,KAAK,CAAC,KAAK,CAAC,QAAQ,EACpB,KAAK,CAAC,KAAK,CAAC,KAAK,EACjB,EAAE,EACF,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACjB,SAAS;YACT,uEAAuE;YACvE,uEAAuE;YACvE,uDAAuD;YACvD,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CACrC,CAAA;YAED,uEAAuE;YACvE,0EAA0E;YAC1E,8DAA8D;YAC9D,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC;gBAC9B,KAAK,CAAC,KAAK,CAAC,UAAU;oBACpB,UAAU,CAAC,OAAO,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;oBAEnD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,CAAA;oBAErC,IAAI,CAAC;wBACH,OAAO,IAAI,EAAE,CAAC;4BACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;4BAE3C,IAAI,IAAI;gCAAE,MAAK;4BAEf,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;wBAC3B,CAAC;oBACH,CAAC;4BAAS,CAAC;wBACT,UAAU,CAAC,KAAK,EAAE,CAAA;oBACpB,CAAC;gBACH,CAAC;aACF,CAAC,CAAA;YAEF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,OAAO,EAAE,WAAW,CAAC;oBACnB,cAAc,EAAE,SAAS;oBACzB,IAAI,EAAE,WAAW;oBACjB,sEAAsE;oBACtE,yCAAyC;oBACzC,eAAe,EAAE,UAAU;iBAC5B,CAAC;aACH,CAAC,CAAA;QACJ,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,2EAA2E;QAC3E,8BAA8B;QAE9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,YAAY,CAAC,CAAA;QAE3C,2EAA2E;QAC3E,wEAAwE;QACxE,6BAA6B;QAC7B,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAE9B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,CAAa,CAAA;QAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAA;QAEvE,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,OAAO,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC5E,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,CAAA;QAExD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QAEjC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE;YAC3B,OAAO,EAAE,WAAW,CAAC;gBACnB,cAAc,EAAE,WAAW;gBAC3B,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnD,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;gBACjC,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,UAAU;aAC5B,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,KAA0B;QAE1B,sEAAsE;QACtE,yEAAyE;QACzE,yEAAyE;QACzE,sDAAsD;QACtD,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QAEvB,MAAM,OAAO,GACX,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAE5F,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QAEzB,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,sEAAsE;QACtE,0CAA0C;QAC1C,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC/B,OAAO,IAAI,QAAQ,CACjB,gEAAgE;gBAC9D,oDAAoD,EACtD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;QACH,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;QAE1D,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,kBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;gBAEvB,IAAI,OAAO;oBAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;gBAExD,8DAA8D;gBAC9D,oEAAoE;gBACpE,6DAA6D;gBAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;gBAEnC,IAAI,MAAM;oBAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBAElE,MAAM,KAAK,CAAA;YACb,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;YAEvB,OAAO,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9D,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,gBAAgB,CAAC,OAAgB,EAAE,GAAQ,EAAE,MAAc;QACxE,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;YAChC,OAAO,IAAI,QAAQ,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACtE,CAAC;QAED,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAE9C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEhE,yEAAyE;QACzE,mDAAmD;QACnD,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YACxC,IAAI,UAAkB,CAAA;YAEtB,IAAI,CAAC;gBACH,CAAC;gBAAA,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAoB,CAClD,MAAM,EACN,WAAW,CAAC,KAAK,EAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CACnD,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;gBAEvB,IAAI,OAAO;oBAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAEnD,MAAM,KAAK,CAAA;YACb,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,EAAE,CAAA;YAEvB,IAAI,OAAO;gBAAE,OAAO,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAEnD,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;gBAC9B,OAAO,EAAE,WAAW,CAAC;oBACnB,cAAc,EAAE,WAAW;oBAC3B,4DAA4D;oBAC5D,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM;oBAC3B,IAAI,EAAE,WAAW;oBACjB,eAAe,EAAE,mBAAmB;iBACrC,CAAC;aACH,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,eAAe,CAAC,OAAgB,EAAE,GAAQ,EAAE,IAAY;QACrE,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QAE5D,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,QAAQ,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEnF,0EAA0E;QAC1E,EAAE;QACF,4EAA4E;QAC5E,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,+BAA+B;QAC/B,EAAE;QACF,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAEpD,iEAAiE;QACjE,2EAA2E;QAC3E,qEAAqE;QACrE,wEAAwE;QACxE,4CAA4C;QAC5C,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEtE,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;QAE/D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAA;QAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAExF,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAA;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAA;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAA;QAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAA;QAElD,uEAAuE;QACvE,wCAAwC;QACxC,EAAE;QACF,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,KAAK,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;gBAC5D,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS;gBAChC,uEAAuE;gBACvE,6BAA6B;gBAC7B,KAAK,EAAE,SAAS,CAAC,MAAM;gBACvB,OAAO,EAAE,EAAE;gBACX,QAAQ,EAAE,EAAE;gBACZ,oEAAoE;gBACpE,qEAAqE;gBACrE,gBAAgB;gBAChB,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,SAAS,EAAE;aAC/C,CAAC,CAAA;YAEF,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;gBAC9B,OAAO,EAAE,WAAW,CAAC;oBACnB,cAAc,EAAE,WAAW;oBAC3B,+DAA+D;oBAC/D,mDAAmD;oBACnD,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI;oBACzB,IAAI,EAAE,WAAW;oBACjB,mEAAmE;oBACnE,kEAAkE;oBAClE,eAAe,EAAE,mBAAmB;iBACrC,CAAC;aACH,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAC3D,SAAS,EACT,KAAK,EACL,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EACzD,QAAQ,EACR,KAAK,EACL,EAAE,EACF,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,EACxD,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CACjC,CAAA;QAED,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;YAC1B,OAAO,EAAE,WAAW,CAAC;gBACnB,cAAc,EAAE,WAAW;gBAC3B,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC;gBAC3C,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;gBACjC,IAAI,EAAE,WAAW;gBACjB,eAAe,EAAE,UAAU;aAC5B,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,OAAgB,EAAE,GAAQ;QACnD,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QAEpC,0EAA0E;QAC1E,wEAAwE;QACxE,qEAAqE;QACrE,yEAAyE;QACzE,0EAA0E;QAC1E,oEAAoE;QACpE,qCAAqC;QACrC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAEzC,IAAI,CAAC,EAAE,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEpF,0EAA0E;QAC1E,0EAA0E;QAC1E,eAAe;QACf,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,SAAS;YAAE,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAE1F,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAEnD,4EAA4E;QAC5E,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,QAAQ,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAEpE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE;YACnC,OAAO,EAAE,WAAW,CAAC;gBACnB,cAAc,EAAE,WAAW;gBAC3B,eAAe,EAAE,QAAQ,CAAC,YAAY;gBACtC,sEAAsE;gBACtE,oEAAoE;gBACpE,+DAA+D;gBAC/D,+DAA+D;gBAC/D,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC,OAAO;aAClC,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,OAAgB,EAAE,GAAQ;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAEnD,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAE3E,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;QACxD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,0BAA0B,CAAA;QAEzF,uEAAuE;QACvE,2DAA2D;QAC3D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACxF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAEnF,wEAAwE;QACxE,yEAAyE;QACzE,gCAAgC;QAChC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,gBAAgB,CAAC,CAAC,KAAK,EAAE,EAAE,CAClD,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAC9D,CAAA;QAED,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;YAC1B,OAAO,EAAE,WAAW,CAAC,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC;SAC5E,CAAC,CAAA;IACJ,CAAC;AACH,CAAC","sourcesContent":["// Everything a JavaScript host has to do to serve the RSC engine.\n//\n// PHP needs ~2,400 lines for this because it cannot run JavaScript: a socket\n// bridge, a worker pool, a frame protocol. A JS host imports the engine and\n// calls it, and what remains is the part every host would otherwise rewrite —\n// matching a url to a route, negotiating how much of the page to send, and\n// speaking the header protocol the client expects.\n//\n// Deliberately not Hono, or Express, or anything: this takes a Request and\n// returns a Response, so it runs under Bun.serve, Deno, Workers, Node's\n// fetch adapters and any framework built on them. `./hono` is the three-line\n// binding for one of them.\n//\n//   const rsc = createRscHandler({ engine, manifest, assets })\n//   Bun.serve({ fetch: (req) => rsc(req).then((r) => r ?? new Response('', { status: 404 })) })\n\nimport { matchIntercept, matchRoute, retentionKey, sharedDepth } from './routing.js'\nimport { pathKey, patternKey } from './prerender.js'\nimport { withRevalidation } from './revalidate.js'\nexport { revalidate } from './revalidate.js'\nimport { withRedirect } from './redirect.js'\nimport { withCache } from './cache.js'\nimport { withRequest, withResponseDraft } from './request.js'\nimport type { Redirection } from './redirect.js'\nexport { redirect } from './redirect.js'\n// Re-exported, not redefined: routing.ts is the one implementation, shared with\n// the prerenderer and the generated bundle, and this stays the adapter's\n// public surface so a host imports from one place.\nexport { matchIntercept, matchRoute, sharedDepth } from './routing.js'\nexport type { MatchedRoute } from './routing.js'\nimport { FLIGHT_TYPE, HEADER, HTML_TYPE, PER_CLIENT, REVALIDATE, VARY_ON_RSC } from './headers.js'\nimport type { MatchedRoute } from './routing.js'\nimport { ServerAuthenticationError, ServerAuthorizationError } from './js/errors.js'\nimport type { RouteManifest } from './manifest.js'\n\n/** The built server bundle. Only the parts a host calls. */\nexport interface RscEngine {\n  /** The route table this bundle was built from. */\n  manifest?(): RouteManifest\n  installHostFn(fn: (name: string, ...args: unknown[]) => unknown): void\n  handleRscStream(\n    component: string,\n    props?: Record<string, unknown>,\n    layouts?: { component: string; props: Record<string, unknown> }[],\n    loadings?: string[],\n    parallelSlots?: Record<string, string>,\n    slotOverrides?: Record<string, unknown>,\n    from?: number,\n    pageKey?: string,\n  ): Promise<{ stream: ReadableStream; segmentDepth: number }>\n  handleRscHtmlStream(\n    component: string,\n    props?: Record<string, unknown>,\n    layouts?: { component: string; props: Record<string, unknown> }[],\n    loadings?: string[],\n    parallelSlots?: Record<string, string>,\n    slotOverrides?: Record<string, unknown>,\n    nonce?: string,\n    pageKey?: string,\n    bootstrap?: boolean,\n  ): Promise<{ htmlStream: ReadableStream }>\n  /**\n   * Finish a shell frozen at build time, against data that exists now.\n   *\n   * Emits only the boundaries the shell left unfinished, meant to be written\n   * straight after it. Optional so a host can be pointed at an engine built\n   * before resuming existed; without it a shell has no way to be completed and\n   * the page is rendered whole instead.\n   */\n  handleRscResume?(\n    component: string,\n    props?: Record<string, unknown>,\n    layouts?: { component: string; props: Record<string, unknown> }[],\n    loadings?: string[],\n    parallelSlots?: Record<string, string>,\n    slotOverrides?: Record<string, unknown>,\n    postponed?: unknown,\n    nonce?: string,\n    pageKey?: string,\n  ): Promise<{ htmlStream: ReadableStream }>\n  handleRscRevalidate?(target: string, page: unknown): Promise<{ rscPayload: string }>\n  /**\n   * Run a route's middleware without rendering anything.\n   *\n   * For a frozen page: the host reads it from disk and the engine never sees\n   * the request, so the check has to be asked for separately.\n   */\n  runRouteMiddleware?(component: string, props: Record<string, unknown>): Promise<void>\n  handleAction(\n    actionId: string,\n    body: Uint8Array | string | FormData,\n    contentType?: string,\n    page?: unknown,\n    takeRevalidated?: () => string[],\n  ): Promise<{ stream: ReadableStream }>\n  /**\n   * Answer one read declared with `query()`, or null if that id is not one.\n   *\n   * Optional so a host can be pointed at a bundle built before queries existed;\n   * without it the endpoint 404s rather than throwing, which is what a client\n   * built against the same old bundle expects anyway.\n   */\n  handleQuery?(\n    id: string,\n    args: string,\n    report?: (error: unknown) => string,\n  ): Promise<{ stream: ReadableStream; cacheControl: string } | null>\n}\n\nexport interface RscHostOptions {\n  /** The built server bundle — `import * as engine from './build/rsc/index.js'`. */\n  engine: RscEngine\n  /**\n   * The route table. Defaults to the one the bundle was built with, which is\n   * almost always what you want — a manifest passed separately can go stale\n   * against the bundle it is describing.\n   */\n  manifest?: RouteManifest\n  /**\n   * Functions the app's server components call as `await rpc('name', ...args)`.\n   *\n   * In the Laravel host this crosses a socket into PHP. Here they are just\n   * functions, which is the whole reason a JS host is smaller.\n   */\n  rpc?: Record<string, (...args: unknown[]) => unknown>\n  /**\n   * Where a host call goes when this process cannot answer it.\n   *\n   * `rpc` is checked first, so a host can answer some calls in JS and leave\n   * the rest to a backend. `httpHostCalls` in `@rsc-kit/core/host-calls`\n   * builds one of these over an ordinary POST, which is how a host written in\n   * another language answers without implementing the socket framing.\n   */\n  hostCalls?: (name: string, ...args: unknown[]) => Promise<unknown>\n  /**\n   * Props for a page, given whatever its url bound.\n   *\n   * Defaults to the url params alone. A host that loads a user, reads a\n   * session or resolves a tenant does it here — this is the one place the\n   * engine cannot supply anything for.\n   */\n  props?: (match: MatchedRoute, request: Request) => Record<string, unknown> | Promise<Record<string, unknown>>\n  /**\n   * Reads what the prerenderer wrote, if this build has any.\n   *\n   * A function rather than a directory, because not every host has a\n   * filesystem: on an edge runtime these live in a KV store or a static-asset\n   * binding. `prerenderedFrom` in `@rsc-kit/core/files` is the one for a disk.\n   *\n   * Checked before rendering, and anything it cannot find falls through to\n   * being rendered now — so a partial prerender is a valid state, not a\n   * broken one.\n   */\n  prerendered?: (name: string) => Promise<string | null> | string | null\n  /** Serve a built browser asset. Return null for anything not found. */\n  assets?: (pathname: string, request: Request) => Promise<Response | null> | Response | null\n  /**\n   * Identifies this build to the client, which compares it on every\n   * navigation and falls back to a full load when it changes. Without one a\n   * client keeps talking to a deployment that no longer exists — worst behind\n   * a CDN, where the shell it holds may already be from an older build.\n   */\n  version?: string\n}\n\n/**\n * The answer to a redirect that was decided before anything was written.\n *\n * A document gets a real status code. A payload request must NOT: `fetch`\n * follows a 3xx transparently, so the client would receive the destination's\n * HTML and hand it to the Flight decoder, which reports its own confusion\n * rather than the redirect. It gets 204 and a header instead, and navigates\n * itself — which is also what makes the redirect an SPA one.\n */\n/**\n * A string safe to write inside a <script> element.\n *\n * `JSON.stringify` escapes for JavaScript, and this is not a JavaScript\n * context — it is HTML that happens to contain JavaScript. The parser ends the\n * element at the first `</script`, wherever it appears, so a destination\n * carrying one closes the tag and whatever follows is markup the browser runs.\n *\n * That destination is routinely computed rather than written — redirect()\n * documents \"remembering where someone was going and sending them back to it\"\n * as the usual case, which is a query string or a cookie arriving verbatim\n * here. U+2028 and U+2029 are escaped too: legal in JSON, line terminators in\n * JavaScript.\n */\nfunction inScript(value: string): string {\n  return JSON.stringify(value)\n    .replace(/</g, '\\\\u003c')\n    .replace(/\\u2028/g, '\\\\u2028')\n    .replace(/\\u2029/g, '\\\\u2029')\n}\n\nfunction redirectResponse(to: Redirection, isPayloadRequest: boolean): Response {\n  if (isPayloadRequest) {\n    return new Response(null, {\n      status: 204,\n      headers: { [HEADER.redirect]: to.location, Vary: VARY_ON_RSC },\n    })\n  }\n\n  return new Response(null, {\n    status: to.status,\n    headers: { Location: to.location, Vary: VARY_ON_RSC },\n  })\n}\n\n/**\n * Append the redirect a render asked for after its shell had already gone out.\n *\n * The status line is spent by then, so the instruction travels in the body. A\n * script rather than waiting for hydration to notice the error digest: it runs\n * as the browser parses it, which is sooner, and it is the only path that\n * works at all for a route shipping no client runtime.\n *\n * Read on flush, because that is when the render has finished and a redirect\n * from inside a Suspense boundary is finally known.\n */\nfunction appendLateRedirect(\n  stream: ReadableStream,\n  taken: () => Redirection | null,\n): ReadableStream {\n  // An engine that answered with a finished body rather than a stream has no\n  // late window at all: the render was over before this was called, so the\n  // caller's own check already saw everything there was to see.\n  if (typeof stream?.getReader !== 'function') return stream\n\n  const encoder = new TextEncoder()\n  const reader = stream.getReader()\n\n  // Read-and-re-emit rather than pipeThrough(new TransformStream(...)): a\n  // TransformStream from a different realm than the stream it is piped into\n  // is rejected outright, and a host embedded in a runtime that supplies its\n  // own web streams is exactly that case.\n  return new ReadableStream({\n    async pull(controller) {\n      const { done, value } = await reader.read()\n\n      if (!done) {\n        controller.enqueue(value)\n\n        return\n      }\n\n      const to = taken()\n\n      // replace, so Back does not return to a url that redirected.\n      if (to) {\n        controller.enqueue(encoder.encode(`<script>location.replace(${inScript(to.location)})</script>`))\n      }\n\n      controller.close()\n    },\n    cancel(reason) {\n      return reader.cancel(reason)\n    },\n  })\n}\n\n/**\n * The status a refusal deserves, or null when this was not one.\n *\n * A host answers an unauthenticated call 401 and an unauthorized one 403, and\n * the transport raises each as its own error. Without this they arrive at the\n * render as ordinary failures and leave as 500s — which reads, to anyone\n * looking at a log or a browser, as the application being broken rather than\n * the visitor being turned away.\n */\nfunction refusalStatus(error: unknown): number | null {\n  if (error instanceof ServerAuthenticationError) return 401\n  if (error instanceof ServerAuthorizationError) return 403\n\n  // Named rather than matched by identity, because the error may have been\n  // raised by another copy of the module: an app's actions are bundled apart\n  // from the engine, and instanceof is false across that seam.\n  const name = (error as { name?: string } | null)?.name\n\n  if (name === 'ServerAuthenticationError') return 401\n  if (name === 'ServerAuthorizationError') return 403\n\n  // A status the host chose — a throttle's 429, a policy's 403 — carried on\n  // the error by the transport. Bounded to refusals: a host answering 500\n  // should not be able to make this look like a client's fault, and one\n  // answering 200 should not turn a failed render into a success.\n  const carried = (error as { refusalStatus?: unknown } | null)?.refusalStatus\n\n  if (typeof carried === 'number' && carried >= 400 && carried <= 499) return carried\n\n  return null\n}\n\nfunction refusalMessage(error: unknown): string {\n  const message = (error as { message?: string } | null)?.message\n\n  return typeof message === 'string' && message !== '' ? message : 'Refused.'\n}\n\n/**\n * Whether a browser was told it could post this action.\n *\n * Defence in depth, not the only defence. An action already requires the\n * X-RSC-Action header, which makes a cross-origin post a non-simple request —\n * so the browser must preflight it, and nothing here answers a preflight. A\n * browser can be tricked into sending cookies; it cannot be tricked into\n * sending a header it does not know. This is the belt to that pair of braces,\n * and it is what Next does for server actions.\n *\n * Compared against X-Forwarded-Host first, because a proxied deployment is the\n * normal one: the backend forwards the name the visitor typed, while Host is\n * this process on loopback. Comparing against Host alone would reject every\n * legitimate action that arrived through a proxy — a check that only fires on\n * correct requests is worse than none.\n *\n * No Origin at all is allowed through. It is absent on same-origin requests in\n * some browsers and on anything that is not a browser, and refusing those would\n * break server-to-server callers to catch an attacker who is already blocked by\n * the preflight.\n */\nexport function actionOriginAllowed(request: Request, url: URL): boolean {\n  const origin = request.headers.get('origin')\n\n  if (!origin) return true\n\n  const expected = request.headers.get('x-forwarded-host') ?? request.headers.get('host') ?? url.host\n\n  try {\n    return new URL(origin).host === expected\n  } catch {\n    // An Origin that is not a url is not one this can vouch for.\n    return false\n  }\n}\n\n/**\n * How large a query url may be before it is refused.\n *\n * Matched to the client's own limit, and enforced here too because the limit is\n * what keeps an attacker from making this endpoint decode megabytes of\n * attacker-chosen payload per request.\n *\n * Module scope, not inside the handler: everything declared after the handler\n * is returned never initialises, and a `const` read from the closure then\n * throws on every request instead of being undefined.\n */\nconst MAX_QUERY = 8_000\n\nexport function createRscHandler(options: RscHostOptions): (request: Request) => Promise<Response | null> {\n  const { engine, assets, version } = options\n  // Annotated rather than inferred: the narrowing below is lost inside the\n  // closures that use it, and every one of them runs after the throw.\n  const manifest: RouteManifest | undefined = options.manifest ?? engine.manifest?.()\n\n  if (!manifest) {\n    throw new Error(\n      'No route table. Pass `manifest`, or build with a plugin version that embeds one in the bundle.',\n    )\n  }\n\n  const routes: RouteManifest = manifest\n\n  // Only when this host has functions of its own. Installing unconditionally\n  // overwrites whatever was already registered — a prerenderer sharing the\n  // same engine instance, or a host that set its own up first — and the\n  // symptom is every call failing as unregistered.\n  if (options.rpc || options.hostCalls) installHostFunctions(options.rpc ?? {}, options.hostCalls)\n\n  function installHostFunctions(\n    fns: NonNullable<RscHostOptions['rpc']>,\n    remote: RscHostOptions['hostCalls'],\n  ): void {\n    engine.installHostFn(async (name: string, ...args: unknown[]) => {\n      const fn = fns[name]\n\n      if (fn) return await fn(...args)\n\n      // A remote transport cannot enumerate what the backend registered, so\n      // an unknown name is the backend's to reject — with a message naming the\n      // function, which is more than this side could say.\n      if (remote) return await remote(name, ...args)\n\n      // Louder than returning null: a typo in a server component otherwise\n      // renders as missing data with nothing anywhere saying why.\n      throw new Error(\n        `No host function named ${JSON.stringify(name)}. Registered: ${Object.keys(fns).join(', ') || '(none)'}`,\n      )\n    })\n  }\n\n  async function propsFor(match: MatchedRoute, request: Request): Promise<Record<string, unknown>> {\n    return options.props ? await options.props(match, request) : match.params\n  }\n\n  /** The page a server action was invoked from, so it can re-render regions of it. */\n  function pageContext(match: MatchedRoute, props: Record<string, unknown>) {\n    return {\n      component: match.route.component,\n      props,\n      layouts: match.route.layouts.map((component) => ({ component, props: {} })),\n      loadings: match.route.loadings,\n      parallelSlots: match.route.slots,\n      // What may be named in X-RSC-Revalidate — see renderRevalidated.\n      sections: match.route.sections,\n    }\n  }\n\n  function withVersion(headers: Record<string, string>): Record<string, string> {\n    return version ? { ...headers, [HEADER.version]: version } : headers\n  }\n\n  // A build made for export ships a client that asks for payloads by url,\n  // because a static host cannot read a header. Serving that build from a\n  // server is a reasonable thing to do — previewing an export, or one build\n  // used both ways — and without this every navigation 404s in the console\n  // while the page itself looks fine.\n  const payloadName = manifest.build?.payloadName || ''\n\n  /**\n   * The page a payload url belongs to, if this is one.\n   *\n   * Both the whole-document name and the depth variants beside it: a client\n   * built for export asks for index.seg1.rsc when it already holds a layout,\n   * and matching only the plain name leaves that as a 404 no page reports.\n   */\n  const payloadNames = new RegExp(\n    '/' + payloadName.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&').replace(/^index\\\\\\./, 'index(\\\\.seg\\\\d+)?\\\\.') + '$',\n  )\n\n  function pageForPayload(pathname: string): string | null {\n    if (payloadName === '') return null\n\n    const match = payloadNames.exec(pathname)\n\n    if (!match) return null\n\n    return pathname.slice(0, match.index) || '/'\n  }\n\n  // One memo table per request, opened at the outermost point so that\n  // everything below shares it: middleware, layouts, the page, and an action. A\n  // guard that reads the session and a layout that reads it again are one\n  // query, not two.\n  return async function handle(request: Request): Promise<Response | null> {\n    return await withRequest(request, () =>\n      withCache(() =>\n        // Open for the whole request and sealed the moment an answer exists,\n        // so middleware — which runs before any rendering — can put headers on\n        // it, and a component, which runs after, is told why it cannot.\n        withResponseDraft(async ({ taken, seal }) => {\n          const response = await route(request)\n\n          seal()\n\n          if (!response) return null\n\n          const collected = taken()\n\n          collected.forEach((value, name) => {\n            // Set-Cookie is applied below, once per cookie: iterating a Headers\n            // gives it joined in some runtimes and per-cookie in others, and a\n            // joined one is a single malformed cookie the browser discards.\n            if (name.toLowerCase() === 'set-cookie') return\n\n            // set, not append: a middleware asking for a header means that\n            // value, not that value added to whatever the host already chose.\n            response.headers.set(name, value)\n          })\n\n          // Appended, because several cookies are several headers.\n          for (const cookie of collected.getSetCookie()) {\n            response.headers.append('Set-Cookie', cookie)\n          }\n\n          return response\n        }),\n      ),\n    )\n  }\n\n  async function route(request: Request): Promise<Response | null> {\n    let url = new URL(request.url)\n    const asPayload = pageForPayload(url.pathname)\n\n    if (asPayload !== null) {\n      // Rewritten to the page it is asking about, with the header the rest of\n      // this handler reads — one path through, however the client asked.\n      url = new URL(asPayload + url.search, url.origin)\n      const headers = new Headers(request.headers)\n\n      headers.set(HEADER.rsc, '1')\n      request = new Request(url, { method: request.method, headers })\n    }\n\n    if (assets) {\n      const asset = await assets(url.pathname, request)\n\n      if (asset) return asset\n    }\n\n    if (request.method === 'POST' && url.pathname === HEADER.actionPath) {\n      if (!actionOriginAllowed(request, url)) {\n        return new Response('Cross-origin action', { status: 403 })\n      }\n\n      return await handleAction(request, url)\n    }\n\n    if (request.method === 'GET' && url.pathname === HEADER.queryPath) {\n      // Same check as an action, for a smaller reason: a cross-origin page\n      // cannot read this answer — CORS sees to that — but it can still cause\n      // the read to run with the visitor's cookies. A query is side-effect\n      // free by contract, so this is depth rather than the only defence.\n      if (!actionOriginAllowed(request, url)) {\n        return new Response('Cross-origin query', { status: 403 })\n      }\n\n      return await handleQuery(request, url)\n    }\n\n    // The two halves an edge cache needs: hand it a shell it may keep, and\n    // finish that shell for a visitor it cannot answer for itself.\n    if (options.prerendered && url.pathname === HEADER.pprShellPath) {\n      return await servePprShell(request, url, options.prerendered)\n    }\n\n    if (\n      request.method === 'POST' &&\n      options.prerendered &&\n      url.pathname === HEADER.pprResumePath\n    ) {\n      return await servePprResume(request, url, options.prerendered)\n    }\n\n    if (request.method !== 'GET' && request.method !== 'HEAD') return null\n\n    // One named region of this page, asked for without mutating anything to\n    // earn it. What an action invalidated does not come through here — that\n    // travels back inside the action's own answer, which is the whole point of\n    // marking rather than telling the client to go and ask.\n    const revalidating = request.headers.get(HEADER.revalidate)\n\n    if (revalidating !== null && request.headers.get(HEADER.rsc) !== null) {\n      return await handleRevalidate(request, url, revalidating)\n    }\n\n    // An intercepted navigation renders the page you are already on, with the\n    // interceptor dropped into one of its slots — so the modal opens over it\n    // and the url changes. Only ever on a client navigation: a hard load has\n    // no referer to open over and gets the real page.\n    const interceptSlot = request.headers.get(HEADER.intercept)\n\n    if (interceptSlot !== null && request.headers.get(HEADER.rsc) !== null) {\n      return await handleIntercept(request, url, interceptSlot)\n    }\n\n    // Only now. A frozen page is a whole page, and both requests above ask for\n    // something smaller than one: answering a named region with the whole\n    // document puts the entire page inside that region, and answering an\n    // interception with it replaces the page the modal was opening over.\n    const match = matchRoute(routes, url.pathname)\n\n    if (options.prerendered) {\n      // A guarded route can still be frozen: whether the content is the same\n      // for everyone, and whether this caller may see it, are different\n      // questions. The build answers the first; this answers the second, and\n      // only then is the frozen page handed over.\n      const refusal = await refuseUnlessAllowed(request, match)\n\n      if (refusal) return refusal\n\n      const frozen = await servePrerendered(request, url, options.prerendered)\n\n      if (frozen) return frozen\n    }\n\n    if (!match) return null\n\n    const props = await propsFor(match, request)\n    const layouts = match.route.layouts.map((component) => ({ component, props: {} }))\n    const chain = match.route.layouts\n\n    // A payload request says so with a header on the page's own url, so one\n    // route serves both the document and the navigation that follows it.\n    if (request.headers.get(HEADER.rsc) === null) {\n      // Scoped to this render, so two requests redirecting at once cannot read\n      // each other's destination.\n      return await withRedirect(async (taken) => {\n        // Awaited, and that await is the whole design: React resolves this\n        // when the SHELL is ready, so a redirect thrown above every Suspense\n        // boundary rejects here — before a byte is written, with a status line\n        // still available. Nothing is buffered to make that true.\n        let htmlStream: ReadableStream\n\n        try {\n          ;({ htmlStream } = await engine.handleRscHtmlStream(\n            match.route.component,\n            props,\n            layouts,\n            match.route.loadings,\n            match.route.slots,\n            {},\n            undefined,\n            url.pathname,\n            // A route that ships no runtime gets no bootstrap and no segment\n            // boundary — the boundary is itself a client component, so leaving\n            // it in means no page could ever be JS-free.\n            match.route.clientJs !== false,\n          ))\n        } catch (error) {\n          // A rejected shell is how a redirect above every boundary arrives:\n          // React could not finish the shell, because the component that would\n          // have produced it left instead.\n          //\n          // The scope decides, not the error. React catches what a component\n          // threw and re-raises its own — whose message is stripped in\n          // production — so testing the caught value for a redirect signal\n          // fails exactly where it matters, and the answer is a 500 with the\n          // destination sitting in a scope nobody read.\n          const refused = taken()\n\n          if (refused) return redirectResponse(refused, false)\n\n\n          // A guard refusing is not a failed render. Without this a visitor\n          // who may not see the page gets a 500, which reads as the\n          // application being broken rather than them being turned away —\n          // and a host middleware refusal arrives exactly here, because the\n          // engine asks before it renders anything.\n          const status = refusalStatus(error)\n\n          if (status) return new Response(refusalMessage(error), { status })\n          throw error\n        }\n\n        const early = taken()\n\n        if (early) return redirectResponse(early, false)\n\n        return new Response(appendLateRedirect(htmlStream, taken), {\n          headers: withVersion({\n            'Content-Type': HTML_TYPE,\n            [HEADER.layouts]: chain.join(','),\n            Vary: VARY_ON_RSC,\n            'Cache-Control': match.route.middleware?.length ? PER_CLIENT : REVALIDATE,\n          }),\n        })\n      })\n    }\n\n    const from = sharedDepth(request.headers.get(HEADER.segments), chain)\n\n    // Proposed by the host, decided by the engine: an interceptor can force a\n    // wider render than the client asked for, so what goes back is the depth\n    // that came out, never the one that went in.\n    return await withRedirect(async (taken) => {\n      let stream: ReadableStream\n      let segmentDepth: number\n\n      try {\n        ;({ stream, segmentDepth } = await engine.handleRscStream(\n          match.route.component,\n          props,\n          layouts,\n          match.route.loadings,\n          match.route.slots,\n          {},\n          from,\n          url.pathname,\n        ))\n      } catch (error) {\n        // Same reasoning as the document path: what the render recorded is\n        // reliable, what React re-raised is not.\n        const refused = taken()\n\n        if (refused) return redirectResponse(refused, true)\n\n\n        // A payload request is guarded exactly as the document is. Narrowing\n        // a request must never narrow what is checked.\n        const status = refusalStatus(error)\n\n        if (status) return new Response(refusalMessage(error), { status })\n        throw error\n      }\n\n      const early = taken()\n\n      // 204 and a header. A payload request that redirected later than this\n      // carries the destination in the error digest instead, and the client's\n      // RedirectBoundary performs it.\n      if (early) return redirectResponse(early, true)\n\n      return new Response(stream, {\n        headers: withVersion({\n          'Content-Type': FLIGHT_TYPE,\n          [HEADER.segmentDepth]: String(segmentDepth),\n          [HEADER.layouts]: chain.join(','),\n          Vary: VARY_ON_RSC,\n          'Cache-Control': PER_CLIENT,\n        }),\n      })\n    })\n  }\n\n  /**\n   * A page rendered at build time, if there is one for this url.\n   *\n   * The payload has to match the depth the client shares, not simply exist.\n   * Serving the whole document to a client that already holds the layouts\n   * replaces the root — and replacing the root unmounts everything retained\n   * behind it, so going back stops restoring what you had.\n   */\n  /**\n   * The shell an edge cache may hold, for a route named by `?url=`.\n   *\n   * Only ever a build artifact, so there is nothing here that belongs to\n   * whoever asked. What it deliberately does NOT return is the postponed\n   * state. Next's protocol hands that to the CDN and takes it back on the\n   * resume, which makes the resume endpoint parse a blob an attacker can write\n   * — the shape of a known denial-of-service against it. Our origin has the\n   * file already, so the state never needs to leave.\n   *\n   * A guarded route is refused outright rather than guarded here. Its shell is\n   * not cacheable by a shared cache at all, so handing one to an edge that\n   * exists to cache things is an invitation to a mistake nobody would see.\n   */\n  async function servePprShell(\n    request: Request,\n    url: URL,\n    read: NonNullable<RscHostOptions['prerendered']>,\n  ): Promise<Response | null> {\n    if (request.method !== 'GET' && request.method !== 'HEAD') return null\n\n    const target = url.searchParams.get('url')\n\n    if (!target || !target.startsWith('/')) {\n      return new Response('A url is required', { status: 400 })\n    }\n\n    // Matched from the url asked for, never from anything else the caller sent.\n    const route = matchRoute(routes, new URL(target, url.origin).pathname)\n\n    if (!route) return new Response('No such page', { status: 404 })\n\n    if (route.route.middleware?.length) {\n      return new Response('This route is not edge-cacheable', { status: 404 })\n    }\n\n    const key = pathKey(new URL(target, url.origin).pathname)\n    const shell = (await read(`${key}.ppr.html`)) ?? (await read(`${patternKey(route.route)}.ppr.html`))\n\n    if (shell === null) return new Response('No shell for this page', { status: 404 })\n\n    return new Response(JSON.stringify({ shell, version: version ?? null }), {\n      headers: withVersion({\n        'Content-Type': 'application/json',\n        // Deliberately NOT the REVALIDATE the rest of the host sends. That is\n        // `max-age=0, must-revalidate`, which a cache honours by treating the\n        // entry as stale the moment it arrives — an edge would store this and\n        // never once serve it, so the whole thing would quietly do nothing\n        // while looking like it worked, because the miss path serves correct\n        // pages.\n        //\n        // This is build output with nothing of the caller in it, and a guarded\n        // route never reaches here at all, so it is genuinely cacheable. An\n        // hour bounds how long a deploy can be served against a stale shell;\n        // the version below catches it sooner than that.\n        'Cache-Control': 'public, max-age=3600',\n      }),\n    })\n  }\n\n  /**\n   * Finish a shell for the visitor this request belongs to.\n   *\n   * The whole security question lives here, because the holes are the part a\n   * guard exists to protect — the shell is chrome, and everything private is\n   * behind the boundaries this fills in. So it runs exactly the guard chain the\n   * page itself would, derived from the url and nothing else, against the\n   * cookies and headers the caller actually sent.\n   *\n   * Which means an edge worker must forward the visitor's request, not make one\n   * of its own. A resume asked for with no cookies is an anonymous visitor and\n   * gets an anonymous answer.\n   */\n  async function servePprResume(\n    request: Request,\n    url: URL,\n    read: NonNullable<RscHostOptions['prerendered']>,\n  ): Promise<Response | null> {\n    const target = url.searchParams.get('url')\n\n    if (!target || !target.startsWith('/')) {\n      return new Response('A url is required', { status: 400 })\n    }\n\n    const pathname = new URL(target, url.origin).pathname\n    const route = matchRoute(routes, pathname)\n\n    if (!route) return new Response('No such page', { status: 404 })\n\n    // The same refusal the document would get, before a byte of the holes is\n    // rendered. Nothing below runs for a caller this turns away.\n    const refusal = await refuseUnlessAllowed(request, route)\n\n    if (refusal) return refusal\n\n    if (!engine.handleRscResume) {\n      return new Response('This engine cannot resume', { status: 500 })\n    }\n\n    const key = pathKey(pathname)\n    const pattern = patternKey(route.route)\n\n    let shellKey: string | null = null\n\n    if ((await read(`${key}.ppr.html`)) !== null) shellKey = key\n    else if ((await read(`${pattern}.ppr.html`)) !== null) shellKey = pattern\n\n    // Read from our own artifacts. Never from the request body — that is the\n    // difference between this and the protocol it is modelled on.\n    const state = shellKey === null ? null : await read(`${shellKey}.postponed.json`)\n\n    if (state === null) return new Response('Nothing to resume', { status: 404 })\n\n    const { htmlStream } = await engine.handleRscResume(\n      route.route.component,\n      route.params,\n      route.route.layouts.map((component) => ({ component, props: {} })),\n      route.route.loadings,\n      route.route.slots,\n      {},\n      JSON.parse(state),\n      undefined,\n      shellKey === key ? pathname : '',\n    )\n\n    // Carries the build version so a caller holding a cached shell can tell\n    // that it no longer belongs to this origin. A shell from an older build\n    // does not make the resume fail — it replays against slots that have moved\n    // and React falls back to client rendering, silently and for good. Nothing\n    // else would ever report it.\n    return new Response(htmlStream, {\n      headers: withVersion({\n        'Content-Type': HTML_TYPE,\n        // Rendered for whoever asked. Never cacheable.\n        'Cache-Control': PER_CLIENT,\n      }),\n    })\n  }\n\n  async function servePrerendered(\n    request: Request,\n    url: URL,\n    source: NonNullable<RscHostOptions['prerendered']>,\n  ): Promise<Response | null> {\n    const key = pathKey(url.pathname)\n    const read = async (name: string) => await source(name)\n\n    // Before anything else: a route that only redirects was frozen as the\n    // redirect itself, so there is no page under this url and never will be.\n    const frozenRedirect = await read(`${key}.redirect.json`)\n\n    if (frozenRedirect !== null) {\n      const to = JSON.parse(frozenRedirect) as { status: number; location: string }\n\n      return redirectResponse(to, request.headers.get(HEADER.rsc) !== null)\n    }\n\n    if (request.headers.get(HEADER.rsc) === null) {\n      // A frozen page first; then a shell, under this url or under the route's\n      // pattern. Nothing in a shell varies by param, so one shell serves every\n      // url its route matches — which is the only way a route whose urls were\n      // never listed gets anything frozen at all.\n      const route = matchRoute(routes, url.pathname)\n      const whole = await read(`${key}.html`)\n\n      // A whole page is finished. Nothing to resume, nothing to render.\n      if (whole !== null) {\n        return new Response(whole, {\n          headers: withVersion({\n            'Content-Type': HTML_TYPE,\n            Vary: VARY_ON_RSC,\n            'Cache-Control': route?.route.middleware?.length ? PER_CLIENT : REVALIDATE,\n          }),\n        })\n      }\n\n      // Then a shell, under this url or under the route's pattern. Which of the\n      // two answered is tracked, because the state that resumes it sits beside\n      // the file that was found rather than beside the url that was asked for.\n      let shellKey: string | null = null\n      let shell = await read(`${key}.ppr.html`)\n\n      if (shell !== null) {\n        shellKey = key\n      } else if (route) {\n        const pattern = patternKey(route.route)\n\n        shell = await read(`${pattern}.ppr.html`)\n\n        if (shell !== null) shellKey = pattern\n      }\n\n      if (shell === null || shellKey === null) return null\n\n      const state = await read(`${shellKey}.postponed.json`)\n\n      // A shell with no state cannot be finished by anyone. It was frozen with\n      // its fallbacks showing and there is no record of what came next, so\n      // serving it would be serving a page that stays on its loading state for\n      // good. Fall through and render the page now instead.\n      if (state === null || !engine.handleRscResume || !route) return null\n\n      const { htmlStream } = await engine.handleRscResume(\n        route.route.component,\n        route.params,\n        // Empty props, because that is what the build passed. Resuming replays\n        // the tree against the slots the shell left, and React matches those by\n        // key — so an argument that differs from the frozen render at all is a\n        // tree that \"doesn't match\", and every boundary falls back to the\n        // client instead of being filled here.\n        route.route.layouts.map((component) => ({ component, props: {} })),\n        route.route.loadings,\n        route.route.slots,\n        {},\n        JSON.parse(state),\n        undefined,\n        // A shell found under the route's pattern was frozen for no particular\n        // url, so it was rendered with no page key. Handing one over now would\n        // key the tree differently from the one being resumed.\n        shellKey === key ? url.pathname : '',\n      )\n\n      // The shell first, then whatever the resume writes. React's own script\n      // travels with the resumed segments and moves them into place, so this is\n      // a plain concatenation and the holes land without hydration.\n      const body = new ReadableStream({\n        async start(controller) {\n          controller.enqueue(new TextEncoder().encode(shell))\n\n          const reader = htmlStream.getReader()\n\n          try {\n            while (true) {\n              const { done, value } = await reader.read()\n\n              if (done) break\n\n              controller.enqueue(value)\n            }\n          } finally {\n            controller.close()\n          }\n        },\n      })\n\n      return new Response(body, {\n        headers: withVersion({\n          'Content-Type': HTML_TYPE,\n          Vary: VARY_ON_RSC,\n          // The shell is cacheable; this response is not. It carries the holes,\n          // which were rendered for whoever asked.\n          'Cache-Control': PER_CLIENT,\n        }),\n      })\n    }\n\n    // Only the document is ever served frozen for a shell. The payload is what\n    // fills it in, and it has to be rendered now — answering with a frozen one\n    // would hand back the same fallbacks the shell already shows, and the page\n    // would never finish loading.\n\n    const meta = await read(`${key}.meta.json`)\n\n    // Both or neither: without the chain there is no way to know which depth a\n    // payload is for, and guessing means handing the client a segment for a\n    // boundary it does not have.\n    if (meta === null) return null\n\n    const chain = (JSON.parse(meta).layouts ?? []) as string[]\n    const shared = sharedDepth(request.headers.get(HEADER.segments), chain)\n\n    // The variant for exactly this depth, or the whole document. Anything else\n    // would be a payload for a boundary the client is not holding.\n    const variant = shared > 0 ? await read(`${key}.seg${shared}.flight`) : null\n    const payload = variant ?? (await read(`${key}.flight`))\n\n    if (payload === null) return null\n\n    return new Response(payload, {\n      headers: withVersion({\n        'Content-Type': FLIGHT_TYPE,\n        [HEADER.segmentDepth]: String(variant ? shared : 0),\n        [HEADER.layouts]: chain.join(','),\n        Vary: VARY_ON_RSC,\n        'Cache-Control': PER_CLIENT,\n      }),\n    })\n  }\n\n  /**\n   * The middleware of a route, or null to go ahead.\n   *\n   * Used wherever a render can be reached without the engine running the chain\n   * itself: a page served from disk, and an interception, which renders a\n   * component the route table did not choose.\n   *\n   * Asked before anything is read or rendered — the answer to a refusal must\n   * not be a page that has already been fetched.\n   */\n  async function refuseUnlessAllowed(\n    request: Request,\n    match: MatchedRoute | null,\n  ): Promise<Response | null> {\n    // hostMiddleware as well as the engine's own. A page served from disk\n    // never touches the engine, so a route guarded only by the host would be\n    // handed over without anyone being asked — the guard would hold right up\n    // until the build froze the page, then silently stop.\n    if (!match) return null\n\n    const guarded =\n      (match.route.middleware?.length ?? 0) > 0 || (match.route.hostMiddleware?.length ?? 0) > 0\n\n    if (!guarded) return null\n\n    // A route that declares middleware and an engine that cannot run it is not\n    // \"no middleware\" — it is a check that silently does not happen. Refusing\n    // is the only safe reading, and it names the cause rather than serving the\n    // guarded page. Reachable when a host runs a bundle built by an older\n    // plugin, where the export did not exist.\n    if (!engine.runRouteMiddleware) {\n      return new Response(\n        'This route declares middleware, and the engine cannot run it. ' +\n          'Rebuild the app against the current @rsc-kit/core.',\n        { status: 500 },\n      )\n    }\n\n    const asPayload = request.headers.get(HEADER.rsc) !== null\n\n    return await withRedirect(async (taken) => {\n      try {\n        await engine.runRouteMiddleware!(match.route.component, await propsFor(match, request))\n      } catch (error) {\n        const refused = taken()\n\n        if (refused) return redirectResponse(refused, asPayload)\n\n        // A visitor who may not see this page has not caused a server\n        // error. Answering 500 makes a guarded route indistinguishable from\n        // a broken one, in the logs and to the person looking at it.\n        const status = refusalStatus(error)\n\n        if (status) return new Response(refusalMessage(error), { status })\n\n        throw error\n      }\n\n      const refused = taken()\n\n      return refused ? redirectResponse(refused, asPayload) : null\n    })\n  }\n\n  async function handleRevalidate(request: Request, url: URL, target: string): Promise<Response> {\n    if (!engine.handleRscRevalidate) {\n      return new Response('This build cannot revalidate', { status: 501 })\n    }\n\n    const match = matchRoute(routes, url.pathname)\n\n    if (!match) return new Response('No such page', { status: 404 })\n\n    // Scoped like the render paths: a guard above the target may refuse, and\n    // that refusal is an answer rather than a failure.\n    return await withRedirect(async (taken) => {\n      let rscPayload: string\n\n      try {\n        ;({ rscPayload } = await engine.handleRscRevalidate!(\n          target,\n          pageContext(match, await propsFor(match, request)),\n        ))\n      } catch (error) {\n        const refused = taken()\n\n        if (refused) return redirectResponse(refused, true)\n\n        throw error\n      }\n\n      const refused = taken()\n\n      if (refused) return redirectResponse(refused, true)\n\n      return new Response(rscPayload, {\n        headers: withVersion({\n          'Content-Type': FLIGHT_TYPE,\n          // Echoed so the client can tell which region it is holding.\n          [HEADER.revalidate]: target,\n          Vary: VARY_ON_RSC,\n          'Cache-Control': 'private, no-store',\n        }),\n      })\n    })\n  }\n\n  async function handleIntercept(request: Request, url: URL, slot: string): Promise<Response> {\n    const intercept = matchIntercept(routes, url.pathname, slot)\n\n    if (!intercept) return new Response('No interceptor for this url', { status: 404 })\n\n    // The guards of the route being intercepted, before anything is rendered.\n    //\n    // An interceptor exists to show the same resource as the route it stands in\n    // for — a modal over /orders/[id] shows that order. So it has to be behind\n    // the same checks, and nothing else in this path runs them: the engine is\n    // handed the interceptor component, which the route table did not choose\n    // and whose middleware chain is keyed off manifest().routes, where an\n    // interceptor does not appear.\n    //\n    // Derived from the url, never from X-RSC-Referer. The referer is a header\n    // the caller writes, and guarding by it means the caller picks the guard.\n    const intercepted = matchRoute(routes, url.pathname)\n\n    // Nothing to guard means nothing to serve. A url that matches an\n    // interceptor but no route has no middleware chain to consult, so there is\n    // no way to know whether this caller may see it — and an interceptor\n    // stands in for a route, so a url with no route behind it is not a page\n    // anyone was entitled to open a modal over.\n    if (!intercepted) return new Response('No such page', { status: 404 })\n\n    const refusal = await refuseUnlessAllowed(request, intercepted)\n\n    if (refusal) return refusal\n\n    const referer = request.headers.get(HEADER.referer)\n    const under = referer ? matchRoute(routes, new URL(referer, url.origin).pathname) : null\n\n    // Without a page to open over there is nothing to intercept: render the\n    // interceptor on its own rather than answering with the wrong page.\n    const component = under ? under.route.component : intercept.component\n    const props = under ? await propsFor(under, request) : intercept.params\n    const chain = under ? under.route.layouts : []\n    const slots = under ? under.route.slots : {}\n    const loadings = under ? under.route.loadings : []\n\n    // The interceptor alone, when there is a page to open it over and this\n    // build can render a region on its own.\n    //\n    // Re-rendering the page underneath would put the modal on screen at the\n    // cost of rebuilding everything below the layout that declares the slot —\n    // so opening a modal from a half-filled form throws the form away. The\n    // page beneath is already mounted and correct; only the slot is new.\n    if (under && engine.handleRscRevalidate) {\n      const { rscPayload } = await engine.handleRscRevalidate(slot, {\n        component: under.route.component,\n        // The target's params, not the page's: a modal for /posts/hello opened\n        // from /feed is about hello.\n        props: intercept.params,\n        layouts: [],\n        loadings: [],\n        // Named as the slot so the renderer finds it there, but pointing at\n        // the interceptor rather than the default this route would otherwise\n        // fill it with.\n        parallelSlots: { [slot]: intercept.component },\n      })\n\n      return new Response(rscPayload, {\n        headers: withVersion({\n          'Content-Type': FLIGHT_TYPE,\n          // Says what this payload is, so the client puts it in the slot\n          // instead of treating it as a segment of the page.\n          [HEADER.revalidate]: slot,\n          Vary: VARY_ON_RSC,\n          // Per-client by construction: which region this is was chosen by a\n          // request header, so a shared cache has nothing useful to key on.\n          'Cache-Control': 'private, no-store',\n        }),\n      })\n    }\n\n    const { stream, segmentDepth } = await engine.handleRscStream(\n      component,\n      props,\n      chain.map((layout) => ({ component: layout, props: {} })),\n      loadings,\n      slots,\n      {},\n      sharedDepth(request.headers.get(HEADER.segments), chain),\n      retentionKey(url.pathname, slot),\n    )\n\n    return new Response(stream, {\n      headers: withVersion({\n        'Content-Type': FLIGHT_TYPE,\n        [HEADER.segmentDepth]: String(segmentDepth),\n        [HEADER.layouts]: chain.join(','),\n        Vary: VARY_ON_RSC,\n        'Cache-Control': PER_CLIENT,\n      }),\n    })\n  }\n\n  async function handleQuery(request: Request, url: URL): Promise<Response | null> {\n    if (!engine.handleQuery) return null\n\n    // Required, and the reason is CSRF rather than routing. A GET carrying no\n    // unusual header is a SIMPLE request: any page anywhere can trigger one\n    // with <img src=\"…/_rsc/query?…\"> and it goes out with the visitor's\n    // cookies. CORS stops them reading the answer; it does not stop the read\n    // running. This header is not CORS-safelisted, so a browser preflights it\n    // and nothing here answers a preflight — the same protection a POST\n    // carrying X-RSC-Action already had.\n    if (!request.headers.get(HEADER.query)) {\n      return new Response('Missing ' + HEADER.query, { status: 400 })\n    }\n\n    const id = url.searchParams.get('id')\n    const args = url.searchParams.get('args')\n\n    if (!id || args === null) return new Response('Missing id or args', { status: 400 })\n\n    // Enforced here as well as in the client, because the limit is what keeps\n    // an attacker from making this endpoint decode megabytes of their payload\n    // per request.\n    if (url.search.length > MAX_QUERY) return new Response('Query too large', { status: 414 })\n\n    const answered = await engine.handleQuery(id, args)\n\n    // Unknown id and registered-but-not-a-query are the same answer on purpose.\n    if (!answered) return new Response('No such query', { status: 404 })\n\n    return new Response(answered.stream, {\n      headers: withVersion({\n        'Content-Type': FLIGHT_TYPE,\n        'Cache-Control': answered.cacheControl,\n        // The answer is narrowed by who is asking whenever a read touches the\n        // session, and the request that carries that is the cookie. Without\n        // this a shared cache keyed on the url alone hands one visitor\n        // another's answer — for any query that opted out of no-store.\n        Vary: 'Cookie, ' + HEADER.referer,\n      }),\n    })\n  }\n\n  async function handleAction(request: Request, url: URL): Promise<Response> {\n    const actionId = request.headers.get(HEADER.action)\n\n    if (!actionId) return new Response('Missing X-RSC-Action', { status: 400 })\n\n    // The body travels as application/octet-stream so a host that parses\n    // multipart cannot consume it first; its real type rides in a header.\n    const body = new Uint8Array(await request.arrayBuffer())\n    const contentType = request.headers.get(HEADER.contentType) ?? 'text/plain;charset=UTF-8'\n\n    // Where it was invoked from, so anything the action invalidates can be\n    // re-rendered against the page that is actually on screen.\n    const referer = request.headers.get(HEADER.referer)\n    const match = referer ? matchRoute(routes, new URL(referer, url.origin).pathname) : null\n    const page = match ? pageContext(match, await propsFor(match, request)) : undefined\n\n    // Scoped to this action: revalidate() called anywhere inside it, at any\n    // depth, marks here and nowhere else — two requests can be in flight and\n    // marking is per-request state.\n    const { stream } = await withRevalidation((taken) =>\n      engine.handleAction(actionId, body, contentType, page, taken),\n    )\n\n    return new Response(stream, {\n      headers: withVersion({ 'Content-Type': 'text/x-component; charset=utf-8' }),\n    })\n  }\n}\n"]}