From 680953d2dbcf159ac9c593eeaa458569eaf99f28 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 23:02:39 +0000
Subject: [PATCH 1/9] url: accept IDNA hostnames reclassified from disallowed
 to mapped in Unicode 16.0

The bundled ICU prebuilts (75.1 on Linux/musl, 73.2 on Windows) derive their
uts46.nrm from Unicode 15.x's IdnaMappingTable.txt, which marks a family of
late-casefolded capitals as 'disallowed': U+04C0 CYRILLIC LETTER PALOCHKA,
U+10A0..10C5 Georgian capitals, U+2132 TURNED CAPITAL F, U+2183 ROMAN NUMERAL
REVERSED ONE HUNDRED, plus several format controls. Unicode 16.0's
IdnaMappingTable.txt changed these to 'mapped'/'ignored', so WHATWG URL now
expects them to parse.

Ship a uts46.nrm regenerated from Unicode 16.0's data in Nrm2 format version 4
(readable by ICU 73/75) and swap it in via the existing ICU udata hook
(bun_icu_maybe_decompress), matched by its exact 48-byte header prefix. The
override is a no-op on macOS (system ICU) and self-disables once the prebuilts
bundle ICU 76 or later.
---
 scripts/regenerate-uts46-override.sh    |  46 ++++++++++++++++++++++
 src/jsc/bindings/bun_icu_decompress.cpp |  38 +++++++++++++++++-
 src/jsc/bindings/icu_uts46_override.nrm | Bin 0 -> 60252 bytes
 test/js/web/url/url.test.ts             |  50 +++++++++++++++++++++++-
 4 files changed, 132 insertions(+), 2 deletions(-)
 create mode 100755 scripts/regenerate-uts46-override.sh
 create mode 100644 src/jsc/bindings/icu_uts46_override.nrm

diff --git a/scripts/regenerate-uts46-override.sh b/scripts/regenerate-uts46-override.sh
new file mode 100755
index 000000000000..abcc0e442ca4
--- /dev/null
+++ b/scripts/regenerate-uts46-override.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Regenerates src/jsc/bindings/icu_uts46_override.nrm.
+#
+# The bundled ICU prebuilts (ICU 75.1 on Linux/musl, ICU 73.2 on Windows) ship
+# uts46.nrm data derived from Unicode 15.x's IdnaMappingTable.txt, which marks
+# several late-casefolded capitals as "disallowed" (U+04C0, U+10A0..10C5,
+# U+2132, U+2183, ...). Unicode 16.0's IdnaMappingTable.txt changed these to
+# "mapped". This script produces a uts46.nrm carrying the Unicode 16.0 mappings
+# in Nrm2 format version 4 (the format ICU 73/75's Normalizer2 reads), which
+# bun_icu_decompress.cpp swaps in at runtime via the udata hook.
+#
+# Delete the override once the oven-sh/WebKit prebuilt bundles ICU 76 or later.
+set -euo pipefail
+
+ICU_TOOLCHAIN_TAG=release-75-1   # whose gennorm2 to use (emits Nrm2 format v4)
+ICU_TOOLCHAIN_SRC=icu4c-75_1-src.tgz
+ICU_DATA_TAG=release-76-1        # whose norm2/uts46.txt to compile
+
+cd "$(dirname "$0")/.."
+OUT="src/jsc/bindings/icu_uts46_override.nrm"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+curl -fL "https://github.com/unicode-org/icu/releases/download/${ICU_TOOLCHAIN_TAG}/${ICU_TOOLCHAIN_SRC}" \
+  | tar -xz -C "$WORK"
+pushd "$WORK/icu/source" >/dev/null
+./configure --enable-static --disable-shared --with-data-packaging=archive \
+  --disable-samples --disable-tests --disable-extras --disable-icuio >/dev/null
+make -j"$(nproc)" >/dev/null
+popd >/dev/null
+
+curl -fL "https://raw.githubusercontent.com/unicode-org/icu/${ICU_DATA_TAG}/icu4c/source/data/unidata/norm2/uts46.txt" \
+  -o "$WORK/icu/source/data/unidata/norm2/uts46.txt"
+
+LD_LIBRARY_PATH="$WORK/icu/source/lib:$WORK/icu/source/stubdata" \
+  "$WORK/icu/source/bin/gennorm2" -o "$OUT" \
+  -s "$WORK/icu/source/data/unidata/norm2" nfc.txt uts46.txt
+
+# Format-version sanity check: byte 16 must be 4.
+fmt=$(od -An -t u1 -j 16 -N 1 "$OUT" | tr -d ' ')
+if [ "$fmt" != "4" ]; then
+  echo "error: generated $OUT has Nrm2 format version $fmt, expected 4" >&2
+  exit 1
+fi
+
+echo "wrote $OUT ($(wc -c <"$OUT") bytes)"
diff --git a/src/jsc/bindings/bun_icu_decompress.cpp b/src/jsc/bindings/bun_icu_decompress.cpp
index d17798d3023f..dd0cf9195774 100644
--- a/src/jsc/bindings/bun_icu_decompress.cpp
+++ b/src/jsc/bindings/bun_icu_decompress.cpp
@@ -46,6 +46,42 @@ extern "C" __attribute__((weak)) const unsigned int bun_icu_zstd_dict_size;
 
 namespace Bun {
 
+// Replacement uts46.nrm carrying the Unicode 16.0 IdnaMappingTable (UTS #46
+// rev. 33) in Nrm2 format version 4, readable by the ICU 73/75 the prebuilts
+// bundle. Regenerate via scripts/regenerate-uts46-override.sh.
+alignas(16) static constexpr uint8_t s_uts46Override[] = {
+#embed "icu_uts46_override.nrm"
+};
+
+// The bundled prebuilts' uts46.nrm predates Unicode 16.0, which reclassified
+// U+04C0, U+10A0..10C5, U+2132, U+2183 et al. from "disallowed" to "mapped".
+// Match by 48-byte prefix (DataHeader + first four Nrm2 indexes, unique per *.nrm).
+static const void* maybeOverrideUTS46(const void* p, int32_t* length)
+{
+    // clang-format off
+    static constexpr uint8_t kUTS46Prefix75[48] = {
+        0x20, 0x00, 0xda, 0x27, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x4e, 0x72, 0x6d, 0x32,
+        0x04, 0x00, 0x00, 0x00, 0x0f, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x50, 0x00, 0x00, 0x00, 0xc0, 0x93, 0x00, 0x00, 0x8c, 0xe8, 0x00, 0x00, 0x8c, 0xe9, 0x00, 0x00,
+    };
+    static constexpr uint8_t kUTS46Prefix73[48] = {
+        0x20, 0x00, 0xda, 0x27, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x4e, 0x72, 0x6d, 0x32,
+        0x04, 0x00, 0x00, 0x00, 0x0f, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x50, 0x00, 0x00, 0x00, 0x84, 0x93, 0x00, 0x00, 0x4c, 0xe8, 0x00, 0x00, 0x4c, 0xe9, 0x00, 0x00,
+    };
+    // clang-format on
+    static_assert(s_uts46Override[12] == 'N' && s_uts46Override[13] == 'r' && s_uts46Override[16] == 4,
+        "icu_uts46_override.nrm must be Nrm2 format version 4");
+
+    if (*length >= static_cast<int32_t>(sizeof(kUTS46Prefix75))
+        && (std::memcmp(p, kUTS46Prefix75, sizeof(kUTS46Prefix75)) == 0
+            || std::memcmp(p, kUTS46Prefix73, sizeof(kUTS46Prefix73)) == 0)) {
+        *length = static_cast<int32_t>(sizeof(s_uts46Override));
+        return s_uts46Override;
+    }
+    return p;
+}
+
 class ICUDecompressor {
 public:
     static ICUDecompressor& get()
@@ -119,7 +155,7 @@ extern "C" const void* bun_icu_maybe_decompress(const void* p, int32_t* length)
     uint32_t magic;
     std::memcpy(&magic, p, sizeof(magic));
     if (magic != ZSTD_MAGICNUMBER) [[likely]]
-        return p;
+        return Bun::maybeOverrideUTS46(p, length);
     return Bun::ICUDecompressor::get().decompress(p, length);
 }
 
diff --git a/src/jsc/bindings/icu_uts46_override.nrm b/src/jsc/bindings/icu_uts46_override.nrm
new file mode 100644
index 0000000000000000000000000000000000000000..5fd716d8577dbb40bb9dbf6c770044a5126221d2
GIT binary patch
literal 60252
zcmeEv2Y6IP*Z<v`gd~Kt-R!1qNiW+s$tKxsdJjDyB0_+ONH3AzC5V7Z6A<YrA}Syt
z(gZ|Ant+IO5fKm(5s?=X+W$9m_hxrPKtSK`d;ZV!WuD(TXU?2+=FHr=bMLkr1#==g
zfFXZ;rfL6P1|cLL9#v4%9CY&xhDrYwxcnfp&`$8Nm|;3e7-nQSDt8#>1rLT9Udk|E
zwq}^2(0v3o`7?I!4~^I>CS$Z<Oajl1VKSM~%r=JM*?6OPn|XJ5Y5eZ|#r&W6DnVz#
zV!=-WrLd!Lf$+GnktjzrPP9dIL!=S+7B3W^5nmA}y7h2d;daW+&%LGl8}57E8+jCY
zOz`;1L(nLv(bz`Y8r^SX^BnHE#`C(T(W}4LCtiPg>Am}Uuk^m^t!>=1@rR9nZ5-#L
z5m)-W>vP^m+$6opkR}@OswNkkMEbV&9pd|r?`B_(_`!19H`uSe-(0_we!l)K{Db}a
z`7iQ6>#q!`2$&VHE#Pc`GO$zN!oVK`10<P};gZIFn<aN7>C)lSb<!JBb5K>#x}Y0D
zW?7YNo$Q9pEFUOeE59x`1`h~c6MP|99nv{uamcX{aVXobKD1xx>d<TU+Jm{&*F=UH
z!ZhOUKy}z=&^uuX;XT7&4c{JqEnKf?q0oq@Dh?^GDfG&I%GJtiO1-L|YNhI`N~`Xp
zUa4N~e^srG=o7Ir;%bC8vQOm7$oldBul|2C@P9M#KRW}Sepl<xLqSwd)VQc6QRkup
zqgzG45xqOwBSs@GiWwHOJmykNY;5<~<*_?sMRB=t1LM}l{S{}5Pmj-yFO5%$&x|jO
z|G(P5ITNGfH^kS(TM~vOjA@{3r@FseDGho4|ES|7W+jeE+@8qOWNF4|wrhCWEbS=m
zX6+qqx^B2`v+j;ARX<d}QD3W1H4HUuFw__<#v#TH#>SqBp2eQsJtv~Pg)8-8&-4G4
zBJ!#+YQ$nwW79&>LJ^r^*CP|))+m5zc6xF81)@cwQ4D7pYN~%!G~z|L6Cq_36Chqp
z<&7R1aey1qC7Lwicc|nM@CohDYO<R0pmmgmqChvIEr*u%mr@Unc&(_?RB7sOdf#od
z-D5c8@OzXLgb1IAq;6vp-ZU*Vtuk$^%ljaWbOLm#y_W@|$uu)E7nh*lg0b&|CtKKF
z-ov<*bZj?F2QfO4S>h(K`)kD9>;#%gzohIyj5mS9sH@Ez?eRG~Vj;2jU^J7GX=eQl
zjR<dU4uoGP^GndKZNz25<+Fh1F~B^MQF&7x^(AvQ)x6M5MzIQ%@Wtp?Bj$3_h_{)^
z7!JbzNAnePjd=uSQ{oorRs&zRBxw>m?-5CCE*h~3l1elTR`0{YmNb&CgE0w(N$<dm
zwQ8Fb=(gAWr28VbZb>gERVPhPnwzwOMp){$HfdYZS4kuXwtSy-n#N#jSCa0)*L8H<
z7&T(A<dEcqWal;7(Q6nJ=(dQCi9|?BCOHg8P8#tfuhrQ9gBpy+^`D>Y+*c=aC;Oa7
zc(qCHoU9S|PmXZP=XEdA$Ln6B;l<{=H+miVV2j+J%pF_E3_3@4$fSKF$(hd8o5`PG
z_Sv&VDO&92$o3DcD2;ew@=A<oD>7Li+7HPQ=Rt`aH;s5X@VQrKp8zM@QTDuc)g47H
z&%fuceLCAOpsT=H<B-V_c+%qV)`+>8B=byW=${mJ*C7!cv-@PZvAw&_gmVP8oy`6M
z(bBqX7hn&=5fq)q(IdrM@`-4n+xu?cK<n&1Cc&}poR1o}#x&w3_Lzy-2{_MT%oTfF
zHu{rOZbxm%lkCd@jkx`Y>+?zZWx9qNitnr&!T4f7yPNEh;;em8COg-oi?dGvb_I!>
zEG0JO(LT<t&i<~lCFNRZ(ck39?mKKe;=K?@&9Tq2@woHCHG2ITyW-!VyG^^4?kR&(
zUP0e)rp!<I7@VvT&SP`E(UBZja26zk2an^$(3_!GLhpuN58ani6M8lDe(153Us7(R
zxLeqk0851BQfL#4$&zci5qdfFHeP2td@hBuKCUgTEnO`GEw5N+SYEOWwY+BOWa(=e
zZF$r3g5^0&HPF*C+_KcN*0Ry^sfEjq<BLU~iBx}kd>zM%oN0S3j(UCRgykp89~LIH
zNva}MmpUflFS)A)>35MRGj-`h`qYS1J=j?;b#q+zU1K<ExH_jke0N~uEO|&zjwp|k
zI;FB#cy7L&`JzUBF~Ttkqf<wxzMiTPzx|L=sqDMRu)4jO)v(vohI;=Xbz|zD)Dx+{
zq~1z(PYX(mNlQs909ae@%HNPDt0P&mcW+$2!<hv*&ZLliy=~h5&~9lLLkFd4#1jCG
zcvc#h%@kNHOIx3|EA437#k8Ag?46=(UtH9O@%M0_%H4@_Hp}d@K<a^Ri*X;zWhk}Z
zzmR=#p=hy)8z1NSFg~1Fh+g)=i<U-<5Z7@Z=<r&`S-|emdkGn(!|zcNcgOXh4cUF3
zzKpE9lX;pL-2Dde<&LN8k^8%vTe>toIz2hPAiZsRxAZ~j6Vhj;FH2vazAOD``o;8{
z>26l3HQJhNEwHw=cC!w$PO#3hF0-z;?y?@WUbNn{x@AZ+{;rQlwLk8t9rqTG>%rPR
zs&CR(i&ujWFJltS!g67iaHepb@QCn+&_|>dH52s_y&+mDIv~0#Y9v0$#EFZ=qXlf~
zi26Zh6s1Hu$c%^lZe2TP$MJRcmV?X@@oMokCqLHP*Nt$!8)yG8p6%AzZAhKfoH~iv
zZ@_)f?{1CVHSSH_4>G;oM+-)}&v#$v{<Zrr?(QC=1xk-Bj|z`59tW8j9&0@gKr>pv
z_WtzrDxx`;`yOG9oa+Y}Q@y%#s|{_>H{!-RveA4hJ6o{w=k;P7uJhr1pOpXJh{ycz
z6d~izc+tLZ)jqn^G|=vxa}%aH^BmKcd6n6RWAGc}#mnWD@;dPb^IqY-&-;bPWB%YZ
z;V1A*`Lp>8`J4G)@_*wy{3|5?tW-)Iv552{>b<FMcsY;hPo*J}5t7l82~>VfGF37I
z(j3Vm$#U>JwT^PjN#?XQE;=6LY*SN<{ychntP&6O_)2_GEEJp&5A_)B@w2$vW3tCI
zkJ%ozVjeT!W2wgn9zr*{TY?*p@e-`^_|#*wN0QqY9z5o24`J;$K&hLs_6Yb1;78yB
z@Eh=_2M>J+YdfR;7V7r^Q6ph(BcKT&0YU&Z5YvdY)j&1@sX$hvRT$%^l20YV+5*(e
zu-=5VEg`i7o^P~8!uoVYtq0Jz(HC}2U-bAgG{fyt$3mV6ybg>++YIozz^jlKfxl<B
zn}+&3z=zO%0(=H+1-=CKG#XhdtUU<nd*D=~uaVn++8@c{5S5Ndj<Xu(wB)ShJe4m=
zuE6q|<c7V4$J9vfLc^1yUpL}QAd(X5A*Jg9k~dnnx%o;1sh+e2u@YJJsIld>Qc^;s
zq^M{S*8YU-egS?5{sQg*Vo%ICAonCQ7y(HGBzuxb!rFAm*}w^myac?JXFJarDJhs`
zPp#B)OIX_#`kp`)Fbo(CR0ETNX~1k?KCl${09XZl3Ty_x0KNvkvG@0#r;&`4jDq(6
zGy44<I0c&vz%9ss5RPmeC7F&tO=`3I=12>qC3UmIMWfuw%i;g;NlgS#AFHXfm9&lY
zS*h|??5!5Jo|krJkN6X0{DQQnw7+z)bfokZ>U%}<n)GYQ>(c2@9ElypzPokhex1bX
z?(ZWS4tEdU|IA(v-d}Z>lRvvZ1Ld>3Y?*O)hNFe(*cSNl@7c>8&J&SQzG}U%^}f5`
zwm#N+wsfC8KHEa<hL<~JQr~x<&0^pEZ|{GH!co?$A<C_cdG>WfcI<`rxmqS&A?0@P
z(UOm)3AfivBW{yYA-Mzmb^EW|Jg-}|HM9`Ufz@#J3JIw@?8yG>;pO8M=oRdx_6o4C
z7ae#e(AsJJ421lOy*}B_KNRrY1Ki`i^j^tcmRgS*ea)LS`)bzKjHxNA!7;O+H;>DU
zZVkRQ<`$2U-MV#?^)9-_o+X>4TctasGfLkn-6dUGx>tHY`mOZC(xcLo(lgR?(zT_V
zOTR3=C}l^*j+?#K-f<eK^E|lD0XHAp=%~I1-6uFE_)+k)!0PpveWbVS{EnS_3E4H-
z1U!JsIbKCxJf<0d9Z*<KIg#6YRd{tHwa1(drZz+<tnKCXfIZ__Gqmr=jQ2pCr||1n
zE36&xU`AXd?94;Fgteong|K$K7gMXi7$!kC6_{n$&x5=KSdR7xw6BD`4%h^22X+Db
z?Y4&>-W%8JKjamXA-A8Tkh71@`xESdkG8*TKeru`D<ov!U<)U0rh5se<@OzRXChkG
zZu9-GAqU)(+zYxVzZY^Z?4IJD>R!aXD3q9carYAL@fZ!DyJr9;UOXn^9=D@#{L%S7
zthFI;PUp%Sir^R-E2ZDdxR;3>ooD-)*AHIjy)JuQ^NO*bcMU~qSZ9JqiZJP3%DvQk
zZ0ziNx%bHRgY5Z^-dUN<%cDy^a%0Oi=}qZfsUV1}|8Mb|Ug^TSb^A@jS!4<Y-aIB(
z=ol}N$Q*MTGJfJq>OAIgXM=c<W6Wa;>*l553?8lJ)-l&Fdj;hv$%(W$gJkc#Mjjpi
zpS8NKV%OR~i~KNe?x?VwjN8?c<nZ@v)!B!O=s4n>hQwxNj+5Ho&+gOAKD%$Ru^;B|
zm|y4o8<HKCtVHs6?2Kd-4S79@&M`-9Ty{k|wDl!!2j|u?+s^v3dl07~+%?*h<n=hV
zg+dRU^Nvy~^g+G3FwjNIV;bLa*wmN&>}NH5?s4<!9@ID}AV?mh2#N|y2r~TR9q_@G
zz^)K(Z>gWv!|U}Ukvg|FST9m*j8QR8qb9o6xK0or?5*@Bqh`Gvl)1ynDM1-Q6_VV#
zQ4{^cGitbn-Fr!!t1s6F+v3{Ra3qJezBQ>ABU2o6O4%_r##Nv7X{awh`#nMZ@wW+j
zE~qm`Tp@W8v7C#e|A$G=)~w9+|DcB>w+GuEuHn2m3%2g8CH<14?kHR<%h_?)A9elA
zId7up<oevz$F-I7;<%%gi^y?D%cG_Gk=VMkmPBl5y+0?6_9ktK-bSo<A~^~<I~?o1
zchErl`eAb+c8|`=VdseXU}oHGbJj27476ZxVtt5~_;7w)uZ~t{%ZBpd`sU7bw%$`X
zke=x_?>z4k`^dRStc7FbTm)y{P)`l(99|8#6D>EB9Dlf_Ys=r;lir<Ie1&8%#@zzP
zoQ+ifn7@DTQ|xeT8}Vi5gzJ^na5V>ajPYR>Ttrvyi128M%gEKrSxfq5$2nZs7ORIn
z+7*(~!VcbDFxn{h9?;ewt@HZkGIvDfG_JimA1z|>V5x8KsB^J7?r8bvlHWaYz2a6m
ziB}<+ESy1C`2g=B-lORCj6I%?kvZGD=HRe#)&E_M8ym+TZO_i$qir5+Z74R;J(x2a
z->>ef?L1!AgU8Gkj>p>2xli$)>Fs*fKiIQ#A8hRUv>~5=TQ{ukuH&0~-{81&In?jx
z`+IDuudiR{{QoH@ak*LL`e^7_acvFr`Vm~M#?+1dw|l?QHBZ_}<_<eH!e95;!s?yd
zoh>UQ6N0ADnE%G;9g!W<HS#WK1BKl8H>Cf29q}Vr<>EiRZe|=~ol~b<P$#`xC#|TH
z>i4<Y-oniZ|Gx14kFDMB|I+%?pv^&F2JHzFLPHAi6yE=%HF+gNb|Av*M`P=U>w0tK
zcf3w_rcOFvCta?S>PNh0Z*fE-7OwN@+U6R88`nSQu5tfKZK-fB_95ruyj!t)a*bnm
zdS^Rl*>w(_Tb$*aLAQhM2MJ_uGEbS0%wHyz1<S%^YFV@_UZ#~9Wy!KMnN5}>E0C4Q
zn#o$p+REC?I?B4py2*OT`p5>z2FZrWM#;v>CdekqDkN_JT$xT~=f3_;x#kudjgMaw
z{(bp3dv=XAynJ{$bMJABtM5OrJ#N38-9PW~X(Kq!L9#wvqma5o_h7rL_2bn3-Dr=_
z?n(M`*gnoE9>>NJ@!y!Y`aP1EWFLRnPF~->p*o4dm4@2?TRPI`h8jm9^{4HN&Hrh=
zpWcs~w<qhLTo+tDN$v5oVBh6?`UnqtvYLlyz-7nsC-;AN<fmyNd-~(}vGY{l^5O55
zJCCcr7pebUJC7lmvE}Lf8}fQw-PgFAb7c6qUjK%jqgRLY&*F0H?ZGHq4-d9%#xD37
z{TzhYaC7mX-9Oi`@wqr$My{M|{kJ*S%iqQ2><DkzmbGZO?a8!c-dT@__x5BFD<ln{
zyA4HQuYV3oa^UiDwP#2C@NxfLI~R@EIr?KiEn+FrlD@gmlUUB$I%Ma5{yQ?4DUW$y
zxXAlM;WF=4!jHVy3fFjlCfq<@yKEM2t@j$n;q&-X<9m)*KHG#ly}uOh_5ND8Pk6}t
zsP{qPY5O}_&hZ|$8l7z(CUc)^Ip+Rhmj6Wm=vQq|9@+U_U1#rx?gE_K|NAoeY>5;{
zPqSomW%FfAWXn)i$X3eM$jJAR9BXvFY?ExOY=>-@Y_IHq?6B;p?4<0B?40bP?6T~t
z?7Hlx?6&N_OdxlYd&+&}{&J~2SRO7{%cJG-a;@AbPnM_2ZSov>fxJZCOx{Y~R^DFT
zQBLA_k$02#kUKJAB}dP!#2$Gb!@uV^>)3OSJO4<VbKxSo?g-rdGVygDA7}k<^WKu)
z^8Ogz%krV}(~^<$rqZ$UHqvVOYtq-`uR}jWGF|?b{8{PS^7-=TrM)Ff<jdqM;6d!k
z_kCB&N5TsB@-^}ql0y=YTOPOGk`rs$ts2Rv@~m5%<Xh!C<h$g1<zo?NzWh@;(R@QS
z4<F6p2WI@?w$3d_<tOB4<mcoo<rn0a<yZ04nj4a9lAH25w{FYt%MaZW1iJ-$2H%zV
z1p5c`q|)HvU=L|{aDmiUstyjsw`-$<<Ab%qK~iHdd-T}j%29Tw{O<mT*h^>N2>n~-
zAij0=HDazs#BagLeuD2cd*ge}z*XP|a2F6Z#<$6VCV&(O0U`hmkOZUyc|aM^5_kr9
z9_R}60Qv$i10#WIU@|ZbNOc$1z74(@cpvx}SPN_dwgF!O`+#qO6Tr{F@4zj9=Oe6j
z1H6D-#0dZo0aQR!)Z@TSKn9Qxlmab*XMpE{uE0w`e_%N93NQ(H6L<@F2UrX&2UY^>
zfQ`U5U>C68=Ubm+K0o;U?2{avK;PZ529s}jKZCx1Mf;z?9YEX!^9IO)2tWg*0NFq(
z@B-{xgFg#&26_T71EYc0fN8*NpfBv^gTDu?0yY9)0^b0~fS-Whfd2rDudvn~XbeaI
z1rP_AfD9lXC<9so&-glj$8xCqWcLc+9==t+qkJd&PWRnh<67psf9O8XcbV^M-%Y+`
z4{~lL^^NZP+;{pO@ICH(&i9J%%?JE{aR0-d=jZ7c=oju6>u2<H_9rsmqlt&rufVSb
zo+H&z{4fulN2OmMzaf6({HFNLg3aa{XJmV{_E_Y%!f&15R=?eThaZT4(r;hsS-<Z}
zFZ!J-z2f(C>2<%~N^AW7D!uP_r<C+3ENfgAQkGDbURGN6Tv^Yu`t`wOW6RzwTUfTL
zY+KpEvLDOp*MBSfPnoc3K+}k(rlz?~TQ{v=7x{bocWRm${8G~jiLd{_rew?`o9-*k
z49*WO1)2x939fGXeDIrSm-@fmbZOJ?N<VCRs`UBbuE9Nn2L^}wtNr8sKSgVW#OR;q
zPyDwv{TaCr4}K+ha&V4+5uUuYr)fL?j{cSYy=eP)P5&zWvSvo`$I^Mh#P3wog~1mP
zq00Y{rnOCfE9E!4Q@SvCwB$XsRyJ7J*O$Z>zp!xnRNzCb_=XFyCDttGDEB*@HNhL;
zxjlGSo&Nzy-__OFm?wkJ24AeFbMEa*y|zjT_iA%^IoBiRrS3K8@ba6%W9ilPcJTdR
zL5N$3XNXUTKYr994+#%ZhrBMo89Y@&eh1WWdxfO8WGJpTuS?HLn$}&d-jaVUd7DOc
zzH?ynj0$ni_wQv#)(uHy-zV2{ZvSVm>!ij-<|NjN?C3<|?hV*i`VB>9bqOJ+kQ4HB
z<eVK+9D-lfFfBvKwV5sLLdN1+iYqj}_xrm1IXbep<Xu9Z#jh-$rQZd9A*5%>K<J}z
zT!z|twY*WY{<u0qgKPH%`SIG<FoUB)#)V7>nS_Xl6*4PiE3VD6Lgvz#WGpY!D?Pa<
z;6_IHf{<k)D?>JfY!BHTawz0@$k~ufA=g4`LU^Gbp}wKA(6REc(1_54&`;%t(3H^3
z(Bjb7rOiXzguW&{fq1VW`$xCi`>J*H*)f#J+>CvP&!mq5rvR=D^B?2S$&ca_9>Z#i
z|8)O3{y!r6&%iHEy*w)NleYaPTwu@T58=Cz{t~WujNBZ(+!C(#zaw1l<kKy*7v`xd
zbQqm2hb1R5B39Z0AE9W6zdP!?{k=p7>@k|y+d2D&`4RsB(Mfm&i9+hxpY^}!f5rd0
ze~rIF6d}6rFA9heC5Su&d;@eMlPE=$PVJ=up#hnqT#-5;HlR>cD$)j+16+G*E^1vb
zvTHk!dB&;zIZ-Fnx{A^QvH}VM%4n<?MLk7*MFX9z>PL9IdaHnT0UZM>UGnP@&@W(6
zzz7%J<3;;Bt8t+d9&+UV&hydj+<Egjyx~ZX<H_1QxNlDiof<kTbYAF^(B+{kL)V3F
z3f&&MD|CP8k<inj=kfH58+iVOD9k%7Ff2SQHq01i4J!z15!ODeGOSP7kg&(?d0g0}
zu<2oQ!<K}t2wM}jDQrjB-mt@AC&SK#T@Je*b~{WE?iubM9vrR?j}JG7r-kQ)mxTA0
zkR6e{mbrk}F|MzDW=PmQm0VNEtCr`buj99CQNd5+bF<#{vEeypwXMP*)%tI?Jr~|J
z{H3SvZNO7|KIs_93V0HqC$oOM$WQVMpQo{XyeuAJg=^)I@Dbr-*rP(OoOUdey9F<i
zAC=oRtiJB5*+%-Qe0=!CaL)RFjn`#F$7s);y}u$kId*|Z%z<l+$Edm97qh+moAF63
zN9IJDh<kQdjce`k-(6<&boC}R*ZiNn&fU{KEqCqz$!ZUd=E*fr)+1}}n58NIL%Z74
z@Q00TX84@&dEtw~-wj_L{!#eq@O9xE!nfer$UDP#hwl$R6n-T9c=+k?v*G8%FNI&h
z6O(U**M#2<=P5)A4~4hFR}rX?DMA%WMWiBDk*Lrs%nFObs>o90DT)+jc)D`AqMf3H
zqC!!r=&tCc=%=Vs3{i|wj8TkNOjJx!OjXQO%u&o!EK<CySg!a;v0AZCu|cs#v0brK
zv0JfUaY%7Qaa?g)aaM6&aY=CnPielPs8QTi@RTB@htgZ=s|-}il%YzcGEy0<OjPQX
zW~D`GRc0yklts!iWea7wvYoPnvO-y@?5^yECp=dvhbTuV$0)}uCn~2Xrz&SE=P2hX
z7b)LWE?0hp=RdDgZcuJfZddM9?pE$s9#S4r9#@`Lo>iV#UQ%Ac)1hxDYm|4DJUq(C
zL*=dVRRyYKs!)|u6{(6<C93o)v&y2fs<Kphsv=dHs)edt)lStxRiUa>byxMmlclRv
zLsTPFV^rf+6ID}GQ&lrnb5!$Gi&XEbma9HetyZm5ZBT7dZCCA7?N;qq9a0@p9ao)J
zomHJzT~a;l82%GId1Zb@^)##a;XZ5e?&87wo9}N!ake^+cgwDYUsK(1>d$d5@R-4M
z_s_#c;{ryDCI-ABdL!Uf(aeC!qPYQYiWUXT5G@OsE&3?n9nqSAg`y1sOGR4)-WTn}
zz43>ly#cF4hXU4$jyl~be<nH|a4uk*=u*JdfUiY20&WK!6!8Mx0*{Hj1N{S?b9<C5
zqn2cro7`z~=a%Z8>PJy{ph)fP^K)J9zlb6Oe-p(A{vpx_{v}Edyd|;*-Vx;lGUB2@
zp}1L~ySO~iOWZ!NiMS##K->+ngT%c8L&O6D72+XIIYo#^1&$9)5Kju68fX&F3Y-_1
zE?yG2JTO<hGH{)fopTn>a;dnvxV88hJY!@NwcZ}MD{z0{VJbf-J|5Ue?N~R?e*d0~
z`BDd{|I<21UEBIz>kzd<9iirzi_068H!k-pmz2k<6Vy7jNo`T5t25QP>Oys?y1BZw
z`Wf|e>P~8Td04rsJgPjdTvKi+PbyC>&nV9>&o3`7Z(826yiNJD<<FOQE`Oo?CA`m5
zsqU`srS7M$QV&s&P>)fMS5H(=QBPIRRL@b*Q!i4#t6r}DNWEIUPQ5|BMZI0UQ@vZg
zUwue@M15R+T76c1UVTY@MSV?uLtUf3tL8<BB0M74l{pi;qIZOEL|}w0A~Zr7@osoz
zL~KN2gg#>3Ki<2|5!Q&jh_Z<Chz=2z5xpX+B1S}vkC+lMGh$wZtXX_BYqMs}Dw+*w
zHon=cX3LvxYPP@GnP%6T37Q8sk8PgQyh8GB#77b9BDO^AjMyJ>B;s_$`G_kKHzMvv
zh$6is10zEtBO?<d&5_o~yvVZ1^2iR6m65$7t0G54j*pxYIWuxz<hzj{MXrn761g*S
zcjP?9{>b`A{$S+s$TN}WBQHl@i@X_mH&PJg5#<vV7!@3)jEas*jB26|QitG}lB1YT
zkDue{wQT-u^Ulp*YTm#3(B@;Czt((O^S7HXZvH{@PnvIR{#Em1&3|srW4O6BMkPn3
zMQsnaMO_QufPMZvt^kQDUtA4xq6(r)qMAjuifS9xKB{9>m#A)0v5Fp1eWC_L4T>5T
zH40Duo)E<zn@Le`L`{#H6*V_%0iFiFENVs6%BVF_8=|&G?Tp$Rbtvj+)M-2;{8H4_
zs2fqYqj=G7(caPi(X#09=*Z~!Xnk~Yv^6>>x&+S<e>S>P^o!BGqX$I~iyj$0E_y=r
zYtgSqPm6vl`t9iX(Tk(si~b<`<LFPKKaJiP{dx2k(YvDeMjwbi9DOwUMD!2QKSf`N
z{x$k)^!4bQ(YK@TM+;)yVmxDfV*K&Im*AN27*$MEOk9j6#u)Qgb4!e8i<}rmi{hA8
zF)1zD$8?S96;l;6JZ3^nQH$~xU0d{PF*Rm<i@7liS}cnBIA&#wO)ZYJ*c9_+%>I~P
zTO5fw6LYV{uQ7kdc(n{_scv~Yh8HW2Z5*4>GQDL{%eF1Mwd~(=M9Vi@N@5qaRK~`}
zu4=ilr78BSmd9FNX!&PLrj<3;uT@TLNo=dw4zXQhd&XA9j)|QV8{aCURf|?rW4pGR
z8@nWSMeMrRL9HgW+7!E_)wbB(u?J$0#GZ^j8+$SKO6>L6n%MhzuDW+zU|eWiWL#pL
zInElF7grWn9@inRGOkx#Row8nSK?ladoyl!-2AwuaVz51#BGe*9=9uQf861?<8eR5
z{Sx;(p2%Js$Ha@{z2g1i<?#{maq+tNBs`-%8&79%8s8@V`S=&&d&duq9~wV8zB+z#
z{IvMl@$=)C#;=H96Tc~bd;ISBL-EJs&%|GdzZ(Bj+^u*f!9Af#LQq0vf*~O#AtNC-
zp*W#=LYsu=5;_AfCiG4im@qV9G*F!|IiW%_Jz;jj{Dh^DK2BJhurXm<!dD6V5|+k)
zn{X`QhlHOKeoGL?|Cvymz)!4@xF<GAlq7~EsuE)ob%~ZlTVh^fNn(q{wuv1QyCil`
z?2|Ysaa7`j#5WRWB`!!@mbfx;ed5-{U5N)0k0zc;yqI`3@n+)vL^q9(Myd(ZxSns0
z-I$YH+yDI<*U#Va|LUtWeE*&sSwpV@Xq)}@*^}n6LKdwdF}e8vEndHm`t$j(^!une
zAg?_i)&4KEIe+?NACEn1yyk(v+1J8ozb>b?T>npyXDjJSe4eh=+(ZPUCRuY^p7vlr
z_P9fC1qa*eT63sGjseMwT*c{?oXY{cKvVw+J-mJb@6~k)p(AA4g_O9Qvrqc!`BCeD
z`zCBdHqO~K)c)VpIrmLut}in7hqZAw9Cx;B=p3)F<NW?z&VCy9crm%7;heei=pQeN
zs}&o|RrlYjJ?y(y<hM8v@6&N~U2V8oaMeCd?O{DUO{~Z9;WBsdM|lyehT0#dZ^-s(
zb>u2V&I9)QS*}+Uwni)*<9Iyj>9T2P^*cwZKOYU%UGsDHw(rO6HG<NHXWiAO;aW4z
z?ps5`r#gKzfwOBxcWN$+wwm^uj+!o-ZkisNKAHiVL7HKjQJQg@37ScoH#E~Vvov!x
z3p7hK%QP!AD>Z90>ouD+TQxg0yEJ<>2Q-H@M>QukXEf(D7d4kPS2fo)H#N64_ca2o
zo7Pk7qxIKHwZYnOty&wcjn`_mMs2b-O>5KUXbZF@+Gg5T+P2#E+K$>T+HTq&+CJI=
z+Ckc3_+K#Nv=g+Gv~OsqYq_ldea;@shT?K_L-@zyZXQol{(tdv9;>t5(7ZV7I9q4k
ze@Ete8d>gII6ZgPaCK)+JRDh(v&p&DSsrQseoW_(k>#&ulNPo&ubj_YS4ez9p8ia9
z^j}}%Vv^ptHitwsT!w@2ZKnDbT-*N^cm77v|3(h8v~#uIss-95+GW}m+VglHc%?Q`
zwMM&MyGgrMyF<H6yH|Tadsur^ds2Hwdro^%ds%x`dtG}|ds};7E6};=Jas-gf1Okp
ztP9tvb<w(bomOYmCF|03HeHUcKv$w`rfa1euWYMpuj{DmqU)yXq3fd?pc|wcrW>VO
zt{SJCpqr$7LpNPFOE*`yK(|D<Ot(U}QnyC8UbjiNRkuU8OSe~dKzCSoRCiK$Mt4qk
zQFmE)RC`r-U3XJ=TX$b4(7Wk9^*(xky;L8p57(>p(fWA3R&UfN>(lgsDw{q>U!X71
zH`BM$x7D}Tchq;$chmRK_t6i~57NgfhUrJ?$LS~NC+XkNPuI`VpAMg^U!Y&2U#4H7
zU#VZCU$5V!->ToC-=*KHKcGLXKdL{eKchdVzo@^gzluJt>u>6B>+kCY1~-GJ!N+h@
z=Wmc2f(_vYwISLNZ_pZyhGavU!Dh%Y6c|bj%?zy!Z4K=W9SujdT@2j}Jq&#eXH^3X
zgABtAqYUE=6AY6KZy2T<W*O!h78sJFmKc^9Rv1<q))>|sHW{`Wb{OvKb{X~>4j2v_
zjv7uH&KS-aE*dTyt{SczZW>}$w+;6V0;8MJ)97RLH{#2`#&DzB7;TI<Rw}hdqcPc-
zX0#b|j0MILV>4qbV_Rc;V@G2bV>e?D;~`}q<7wpp;~?WOBRN+_fsUin1mh&*8^-Cz
zS;o1>1;!=DWyUc|9<u^%D{1>0<9f>Rez0+?affl2aj)@!@v!lz@ucyL@tpCZ@v`x%
z@w)M*@wV~4F;5{dxtTmoJ|=&Y)D&zAH>pk0rg)RqWHcq4(o7{$HdBtNz*J&tAJxp%
z%GB1>-qg{wOW(!R&D6ux$27n+2xXXQlxdu4f@zZJ4bybfEYlj}T+;&664Nr%3e##6
zIiJ><Hkh`UwwrdEcANH_4w)_+kC={|PMby<&zjDgE}5>Fu9<F_YD{-cJhRB`VfHqA
zntaVZra-gI9BNjYBhBNC@w!-ZqItI>O+Ue)H=E7zCW~2XvYNBZdFDyRB6FF!g}L0^
z&isb4gSo<7Y3^?BW$tJ0XsR*~G4IlkF!wQyF^@M-G*2;4HIFmRG_N$yF;6gE)y*?c
zGA%MsH@$0KZvM!;+Puy@*R;gA!Mwn<#k|C{-F#lP)4bPw$b8g%(tO5z&V0#y)qDg0
zOY7g<C+?W}N$yFFlO#!DC=ZJqnG~O-PfAX*I$2~VneG)PHA@<W@7uLXYMazPsbf-?
zq;5(6AulEM#sB9TiT}_wIcZwb?4<cgOOrlGT9x!Eyf-I(k@R)aH%Z??J^}ogbOH3Y
zq(4D#CEZIBCO1lMk}Sc0<WeQaBx{q+C>DFcKW3mME14~M$!sY~W=mNzTUsQur97D}
z?ULEjA(<@|$!w`iu1xNZ(hH>@N)^fwlo2Rn>}7m1TP7y6WlAzzrY28Ko@p<iwECpg
z>}0mgOJ>W$<b}x_TWxH`U2huV51VaH|86o{mM1Sy{s?6?%3bNY<aNm#P`03Kx0jvC
zJCna?^+l_FDBq);MY)V}1LZy~`1&%+?qs(3w+?L`jk>P&{^Y~S$CJ+_pHKcZ`C9VL
z<h#j&6pxg~DS;`$Daw?nl*ANciY3LCl9y7F(juj8N{5s#_|HLoQmRshrHo0LkTNA@
zddi%X1u5^QtVmg%vOZ-?%8r!XDF;%Hq?|}On{qMbO3I)3|3CLrL>5nruSIGJwWuty
z7Oll>NwZ{G@-1bSR+e^_j+RRNcb|TiL6#Agah8de*DW(Gb1jQ3?^!;wtg&pcY_;sP
z?6DlQd~Z30|G@LB<xfkkg`e6eHLZ0X#?g$9#6MM*dL}tMm5d}ZH9l34qE96wNlvw<
z2B+ktlF^W?*o?Sb*enWDJ6f8hmZy%hv`;0ypR!b>c1zuA>6J?QC9~BI{dB3DtpTar
zTn#~N#~eA&(5O`BIeKu0$m}@gg`1P{soackvoR@^%*C6j+)T_$C7GN_9)J;&-sh!u
zPg#<>JauI%8B-eOZxS+}mAW={bLy9=`%}M7J)ZhQ>iN`PQ?I4|C-rVBKg}bpaav%S
zJWZJvm6n)hNVBA6q~)cRq_s#}p4v98Lt2-#?rBf!$HiHKeCF8K3#%imq<32Hw1&<E
zXI)j=2$b<@Q_^Op%}aYX?IV=6X<O2ErtMEVl6D&9eA*S18z^_v@FmQ2uk=8aP?X5@
zL=-cMH9a@IEWI41LwaR;&-AMF5h&x+r=-tJe<%Ij^p8;1p=?3fnZ7^$yY$oP=hLsG
z-$*BC-`#YP)!Q0q4YlIqEo&nFWu(=bhf->7ZS7#~YVBnmXdPjF#X7}0(>l+()cT=y
zt#z~YOY1)Cch*zZpRK=H|FVupPj{@s4DXD9jL?ioz&j%$!<3Ppk(*J9dRhA2wALBV
zWpHOZ%N=*CuKLHXb<OCRQI#<&V`9eijCmQ$GFE47%Gi-{DdTnqJIl`BTW?4f**t6&
z5^viwsjn^2CbNa2=3HFgP2;`;&iyWod>344i?qd}kng@H+VnQF&0@3KvTS*_A{+Tm
zXql~rt=!hmM)K)ktFV0+%ogGkYh(MbkSvpWqkmtU(j`u%t-Gz4%|E1{ZJ=$iO^#O-
zBWz=A<82e`vYc$2W}A)J^PyR4`@pu!_Ni^N?F-x2wr_0T*-qHb+IqI`*?J(#aFkb2
zCfm!;wx4a6?B$B>itU=c+_15w#>SSrHn#9G*&@mmWqP1^qxhl(+KVicE%?efEy_$%
zBJCwMlP!svY|&@31^=Lv7E2~uteI@d%4ADkCR>U!*;1CtmgbqwGs$(JbtYS8x1Qbl
zJ(RU5&tyK6Nsb|Twc%^)m|02Zth=pCCOJlAK1H^EwkxV`nGO9?fvkmrnCrnf9usX(
z^NrCCwh=haJu+i$^PcJ(r-`;cnR?rR%t4vMGOwt}`th)h%GAV+%bbuoDf5lY>6x=K
z=VmU*T#~sg^S||}>Wa+1<uBvA0RQAW2bXT2y?y+)^EVF`-JWyX`P&B-x7*!z{sw~b
zw(K_hErgodYqghZS7xrsT%XxrvMF<G=8nwewYxI+WFE-;HuGra$;>mE-D@jq+ts$H
zEvn6`wcsB;#nvioWwpMw9<}5XhHEvK8h9s*-4({vYgul8u8{N2Ok@wLcf5|S-%fs$
zO;(z--mzmi_7ThNM;B**B6HSUg!=7x0oFjNkZ@X7a?Oj4QD4W_*?xG;xy*~1z2%oP
z_hU>~Gp}df%)FgR{!7gLOhJ}gmS<Lu#wY8N#6PQDh%_rWD?Ce`6`iHk#AoTV%vqK!
zTUJh1VOCjIi>xjo<yq~r#)Nmw5=pycb<66J)hEkaIv}e;GAL_U)~Kv;Srf7*WxbI#
zJ!=khTyY*H(Q)t6aC+BVSqswUtaoS|ZXxdoyMBgAJjgG698Y<0epjEohfFN$$K`a+
zdRA9+`_aYO(^cli$*myQR`$PkaR0%gA<o)!QJgvZWPyiYZOJ+&#o33{*-Y5qwAOED
zZJl!@8Zuwp`|hM(zn$yBd5$?dXPvVjD?7JxQ96mw1im1?<n;Zmp7@3qSFSthIi24<
z_DR?5n&GsrPtN2qck#~$@gJ?kgT?Ic=^b_siThOO@iOJCi9d2^;BzC_^<F<e;@8;a
z2|tc?@5qTf1(n2hJU@Xw0wXaiBu`&SFrI-yB-bP3{M<_}8nNP5BFi5fDI1CNaBwa@
zmm_I$9T8h=I3gF7JK_z^7TXtzLe6IA@v<$iiJ3c*60L-}V}Xt9oY(J_^>`R{jZJ*t
z5ib_!NXlqj*T@aW;EuO*zYkinR-BD%JJGU7jMH=T$JIIR$o73Pv1toW*4Ft66kIQ^
zoQuJ7*2|&ejs~Y;eYxYxT9YHi_2U}bH5yxMNJpZRo?N}z-)ItAzlF8)y5~h#wX2t-
z#*K*d=+HVO*D*b)=h_J;t%Q?YxK|Vo4_C?Auc151hVDO|BRKolm*;1_pY=)BwybZm
zPG$X?wd(#V`YTnE6)9h$P70SH$Ju?J+shs2H>auJ3ujSZ&(?2c@w2_M<=HXWN!bls
za9TD_!?W-B6<3AC`3V*e{}mVBO~Wt0$V`o-lsxr<)LzH0V#zPRDkKm4<yVE|0xVsB
zEmrY}UyD^pxL=r&_>QM*G~5sQZF7J8LYA|u!2dsFkEd%stes=ruK94kR?EvSqMs_2
zX0y-XXr5i3{Y<tIzi{u6U6DOOQkmU7yJz;SkZ<J1;C|Uv*@LsmlR8FZ4-FZU{r5io
zvR!?~XE#Ue4v6s$entE!f3^=-`-#~TX|4^e=tt?;*&&o$DTF(;-1=jA{VNjD5?hBA
zE4ymAXp^(2X3vt%$et^ko&8Ss!tABl?`MCMy*hioY+d$-Z1Q}X&Dq<tcV_R--j{tS
z`@8I8*{8G5X8)Z1t@Nn$m+ULq*RmUqK>U}u_^yzBmwf|%2c#FJHQ9Hwc{#3Gl6;-V
z>)2IXwQTJm{V#G4dT_Sv+>z%~ITvo!4(@UL(S?iG5O>V*zWZdC=c1DL5Nd3q%nC_!
zycclS7Kzv6R=jr4!|U}xyw*44y#Nc|DUfAe!}|(6yl<eyI|2GkQO?w4j~s8z3-Paz
zlpzA%iGtLSe}#ne$NMd?)KhEXL44W5`c_D?(8l&%At8MeUt+-n<$R|m<2|1T`et*l
zkhtdV+Bchfg~S8i+}O+TUIaIG(!Z<!gJb71esJcTy>YjeBh3lTQRl?wXmiXtX*pRr
z1v!pm)6j2X%W_VT=kz4Bh8=mPfa|Uk75r?@a|xYtUdZX0GteoLBj(VY(K*%jmdOoT
zIBcio%+8q~&5h+jK2@<GX9+$D|0sM}&WfDGh?O~Oa@OZ`G;GS*nzJKkSI*v?1360N
z;hdv6Cv(o^oXfeGGZViJxSTU7N*3`()YTlG>Uz%2oZC6~a|F2sQ5zI)xt_T`x&FCa
zPtx4*+~{0wZgQ?Iw;;D!Zri#R)}mu>mwFn`ljYrVd*t@X9gsUD_pot9?wH*1xf64b
z8mHt=&7GNh(l|GFLGF^=Ww{^auFl<&vo3d2?$+ELxw~>VnD*u#2|tv3B=>mkX=HRZ
z_k8Yt6ZypNkm*wHm0UOdwcLxw8@V;PcXN4pq=@o7^L+CB^Q3v9dCI)Vyx6?NJbj)y
z&w{sDv-0xtit@@(j+<KKmFKm~>yUTVSdmwm*FCS9u~%NdysEq*c_Z@1<c-gpm^USF
zdfu$Oxp~WS7UV6-TbB1x-kQAid7JXK=IzMamA5zVK;B`Lqj{(E&gR|JozJ_JcQx;N
z-pxF#;&$HsJbVV3@0RbG@0%Z(ADkbaug;IokI&cU8}pO%)ADWkIr#<oW%(`g%k$gi
zN9#J|_fmAp?~>m=zZXis{Hpw6`D60O=TFR^l0P+nX8xS~dHIX--^~}8mgld`Uz5K+
z-^08<e^b7vX>0zD{9XBb^L<R4v<LDJ=O4{KnSUn#T>i!UEBV**Z{*kH-_7S0xD|L7
z_!RgTNDG1s!VA;|(FOjd_yTQ#xxi9jEyyYeHsuu*6_gdUC@3#zSJ0uLqJVrZSy|A%
zpjSb^f<Xnt3Pu%-D+o7DD40?(wP0q!QS+RFc?F9K-Yr;Ou(DuH!TN$t1=|aD7VIwA
zUy!ChRB)u=WWm{jiv^bpt`*!Us42Kxz$;XnCKyD89);e8zJ=1l;KJ}ib)nfDT^L`e
zFEkfg3T=gXg++xHb6H`F!t%m)g&hhj3M&hH6!s~sDjZTcsxZquu5d!(l)|ZnGYjVy
zE-HMtaCzZJg{x846>cajGH)r|UbwSxcj5lR!-Yo+1^Uy4=L#<tUMaj@SW|enu)@qM
zax3yK@-LDVg`!mAQ%_}4WKnEUVv(_^kFJ+FxhSou#FSN3P_)2UR@9=Xt*N}IT~UXk
zE-2lLdKL968dNl_XjIX-qKQRQil!FLESgg^uV_ipvZ575D~r|?tuNYCw7qCo(cYp%
zMMsKG7M&^TV>(xKspx9a^`e@hyG4Rxw_?v?pJM-FX>o9|vN*apvABD_u{gOnt=Lwa
zQ(RD7QrxV#RdL(m_Qf5G3-p!6-HUq__baX{9#TBaG@^J+@%ZA2#Z!u>7tbkPP`spg
zS@DYEmBs6dHxzFz-ch`(cz^NX;-kgwbtj9@6rU@;SbVwoYVkz#_2Qeww~Ox=3rgHd
zJWG5^jwt<0WF?^`%96;E*pkE&V~M52T9Q>V&%DTdO_^6xQqruXRY}{D_9Yc1-Aa0t
z^eGuoGNj~P^N5mhB@;`gluRv|Su(d|LCKPmWhE<0R+g+OSzofHWP8cZlHDZ-N)DGC
zEjd|orsRCd<&vu<*Gq1e+%4giZZU5$yOnyD`j!Tk%1T2^m8FrTv89Qn+s($(<kGZK
zTWL;dL1|fOi_*5G9ZFZLx|D8Lbt~;r+NX3t=@AwAW(~RK-p60x>QlLWtG59^<TB!I
zJihn~o>07#Cl-Ija~JdZUSc<XV{tQK6Y*}IpE%zdAl}Oh62Bt|6Z3^Cu~?Wd&aoDY
z`RUE88^KPTo-b~c-nqJQI$zwFFBJPhC*cQ)<@~1A2Y8UvgT!I{e6c*esaTc%tT+m`
zVd;$cAo~3l{T@NTL#^)OX!IKgUk$&B_<QvGvNcGY#19iULZ6M%=KyO{aVueSv4Q`r
z*pS|-Iw`$zbq4zURUj0n^4-PR>0aUt_-CW<Zv;)N^N~w2>iOwS#7&Vy24WN=hnDHj
ziQ6ED1S=yxh8#{Hhf~O*C1SKe4$q?hGw6RB`d^4K`=NgceBZJ*7eCMMRQ+taQ2Y`<
zsQO0%U)&jSzZK+*UqIa6{La-cA)kThe>le52fD$?btw9J8Tygwjm2Zr^Q)^d_CMkK
zDqk%A3G?$BV!R3a*I_>y_HV&{8f<<>ZWoZ-CFFJ)$7L>Zn~(8y#BsTT{N`IF;>GA|
zDRPt}$1q`%I0w1RwKlIliufO3em+LOAHe4m^zjMiQU$vxjAcFg`WX3sj`sDKr;V`r
z0yaC4$FB5Ju|e3h`g7>M$J}W!4|||L0ezCNsrW18_!Dycfs6w={)HU>gB%ZI{*EHY
z6PUjm<o6BM%@2Hu_$TD}K5~ph-x}mtfgJZ(3&j`Gn~N_X*6%o$zov`DwV0cGh{?BN
zVyr^(ujs$AwTZY9;^?gT)qYm2C2NyvIgZ-}*wmum-(mVE*3JvU#^Ny8-b25?!`=Y<
zUt#kX#-@VbE#z<qV~DbLu8t$V0{7~#1pMlIf}rXj1dRB{48HgoH+OMoo0qtgElSMG
zh!G1iUa9VB!*M{{vu;shWkyW3I)f4ag8Fl)XTc^1Hj`oV8+6aZe=+<Q+M0-GqP+s`
zUC{m^+W$cNZ0N=y#<+|q@z=JP>OIi^1^wIb`vQL3;5Q34i{Q5ee*4gV3+?Yfw;j42
z(ESFx#U4$n-}B&Czvs?~7rJ|iKSq5q_$%NWfzLe{@kV!d@mC&R;{NVUs`tS5Gw^Rb
z+{HgYx7odk_$LoZ^#$1e3j7J206umPtNtB!pF;lL<2|ojulK$3y*`*+?DhWSLZB3Q
z#ryrq?*XH|2TyD1H+WiS;6=aT{%`qzJbkwRaLHSe4<&C(K7MPq<l|W}(&5q>(vN4&
zmJXlwmh{8fZw7rZXSD1U*-Y67ve#uF&UsTdTs}ko@!PZI!{2^OJ|lQ-@O(TQ?DM&s
zgP&Vis(9&BucVhgZ2|-UK|lx)0lW+h1x5p7f$F5b)ux=j)k(l}z}vul;2ppndz>E-
z1QY_Lz*yi_;B{aca02)e_!0OC_yzbC_yhP8VDkD_^MP%^7l1p^2xtQM0bc@N0nY%>
z0?z@@1K$DP1IK_9d4{tw6^663I~mTt11toV0`CJK0;_<vz-Pc_U>ooyum|`C__mXw
z;>S*=vp<1f0RIL2H}K!V{{;UF{1$jEY}3)tFTgXvb3iAcEAS%F6X**J1O@}cfziM#
zz-z$kz_bcO#li~H*~Q@Rfxi#_A^6AOpMb9g{|tO1Y<~y-0R9C20`62yTsu}{QWBa%
zX&cZlik?#u`n+nQY3zZwq97lc9W}|sPZ%6K$uw5;a_pqF+1lZtU-TFlPw30>Q`YiJ
z`x@~7GA>jwe4L?8an=@F#o{(rzv`A&qIJhP{JDTgjc_LaN5J3Hg^7mbm(IUXNqxq`
zXC!=HgHJVly2FQG{XE+H(DwJxz8LKvqx}Q4_hAIsH{VWo7e6a(QazvAkzU#e`4_6-
z%ZNWi`znFE_(SX)YiZwNXged$^N8~j;=F)3m5dPDxO9HChQ=VZ#i+f9+5m<pXk5LA
zN?wq@fmB8Mt^SirLP3-2|D^Me^<jeHwGoj&MdUB6e&Wxur+sDRAFHA*-=pPQwETdU
z6KMI#%HPw6i9xm}XkKoRzQCMRVotoOQxUrlLv)=nmJI?jmZdhnSmE|c^~W~;g`HIM
zB{ZF&`Nqa)zViCQ>w`IO$@t81?*ra5=57q;pX$k|5utxN|5Se}ZG<!cQse4xAyq&U
zil4Q5Rrj{?PgRmy_3M!OQ0WuQ%W8o?`W0eNbH`rhl|eKC(BQHyZUjwZXx34ihzx#p
z46Tv&DAeLmTTk0^VO<F8QmP^C`Op+Y(-fKw)TS#mFGACkYKYAX(7XgqZ)mnsn^zF^
zRaztM)u_FO+D_WG6xQ#<`a`NA?e9VJ0W=>&vzyv{3C-8g?4ufD^A$9Ep!p_4K-Vop
zj|7iW9AT^rqN&6RAQWp6E0SosQ%!fQN&bc2WG&!W5q%%3ucC65T_!d|s62#5sK8p|
z@2S9%=U?bT^<8M3E;!mm;|1E4(n>}QxsvFyDu{h0)pw)z-Dqn!+S-krM;BhC`tCHJ
z?xYvwi3oeTQ{R_J>z*FevM1?xPfxo{dhAU#y{V=*?WGTm--q!;Yk%6>pSJd=tpjMZ
z0YtNBAk`0~`YP&GMb2=XCGg!-MSCAaa~neGP&(?Nbi6~UR|TcrDeYsA<0ZJm<j}KN
zSSRu7Bu6VF_!)L&cM%Gr`9yMq#J_NX&OkRBtq163UJi~=3~ignCu4qzwsoV~^u{qe
zPvbNakfVKpYHv|m!T3N^!T5q!Qn`}K-KpH2%6+KZhsyn_+@H!-RIVa2&b%nlfrR2%
zc?tf5{`%0oZ%|2q+_V@0Iq%5`hF}DH1UdBVCpoRAnXRLAJ*68!_rikg2E<}3r8_Cz
zO=*gdtRb_ItWL9#tYD*%Shk^ZDwR`cYYw%n5|XhdQCVlF#LG<O<J2pO(qu|gge21x
zDrZo7iPADkb7*UhT_!83fXXG5MvGgC`4^(`#0&m~LPAePi_0MwQ_T@dw^RBpp>8oA
z=^lJH9i>J>nOz>AQ+gD%z_X1fp&6961)b)36!a_4&p~%l`W4Z%&-ZHM#b>s99RdBy
zPQUls<CR1AP@>KE&hSPoO7p$jdh<Pwd++f+<(&h5020|_&wxfY(KO*RqF{3{pK+tq
zgHlgQy(#sjG?mhHN;4?6QJPICcH&6PO=ogOoa&6-mr%XnB31>tLXzXvm9}-IZC%mE
z-_w<xb*H*Ai2{GDY<dN&li-2<JdskJAQo$iTvf<Qc!9*Z(2brOFVdJVl9*VJILdoo
zq%mJ)H1O=s=mb}h0l5Z~40@1r;ZzTrK@Vh*9F}u|Twiefah*X%py=^JFM7`OqOp6?
z*uAOTn|k)9mc3!gt$ALZ<Sr<q=P0hebrR{hFOArjX5JsPJ$feBGtzT^5)apCXyHq)
z)oy|cDtSTb0!wneBV!&&vlvLT7)Y}iNN1>ui9nnxjF!+uL3enQ>pM@-gGxf2Tl@<z
zlU?=H%f$P_AiBQ~qFD_h^9Bt$a)W5=U?N`_O!Y&kJe2Hur-ss=hti&3q*)KN`;xtK
z2;DI&7!Scum~(Om#jBH;I?2&05G=yj$Q7KAREZ>p2PcvAS)E6n<nSQtpb|Y1DiHjN
z{>a@IuTEm>B#$~tAlQKZ$UOqNo^>bQSRrIK`au2*F~}VnuTEm>BuA@2upcqV-34E;
z2>FpaCSIMy)JYz75_0C{;C>`n03RG3(q9$&TSboy@#Z9^PI9yghz?%V8#9bO@YE0*
zV+bAn5R9G)&tdO!1UxF?uAolGtJCr7blG*fY(W!v(7PXjFO`Tdr{mS>cmf4l>79^3
zNhM;(>3DTIhh27^E?c032fafQ=&3|}IUTP~$E(w2*Xgnaned=@PJ%2d5noQntJCoW
z&CyElq696dMC>>nuTJN%%dXR93p&Ar-dzbQs6>1@9j{KutJ7uI>9TPwSHqgzK@z&2
z(hZburF18yyD42wcdym-y0}_EeAiRDf$BFv&s`}=tPN=6>cn;@wb}_Q?rKS_w&Sjl
z&;V+YUDrlDc9ZD5H<c-%(<q%m=|M`rqx4%!1uA0WPN^rQYDyz1O{X-6(mYBFDYY`h
ztAfg9l%`Wn2Blr8rjpYBln$WuWl9H8I+W63l#Zoz9HrHiPM~x#rSDU^oYEDP4ySYk
zrBf-LM(HP%uAy`-rRxZFFVW4>@!iWPZANJeN?TD{PH9_8+fmw{(hih%q_l$4u9Ut&
z>5G*1vD3E^zdx1x>xf)M<ti!<rt)Aa52NxhD(6#q9;GWN{fN?)l&+?94W;WST~Fx-
zN;gruh0?8*Zm0B1O24A?Yf2B;Daq<vDt}9RKSJdrR6a)KV^ls#<&#u?kIGjm{e#kL
zl>SNST~MK$@YtMF!ebjx5ovCn^e!tg!ejc=!eh~=g^&z&Qo$MFv5YfBN2IopM8`Iq
z5|Jo&X;q!Hg-V~D79CrOD6q3j;$!C1;$yng_#PTQC05||kAht38C-iH2_YHq8M%?x
zuoE(yaets7cO#4*dc5)m&sCW0+yHK*b#isU6_Dx9;1vhclUWbCnUB{O46e>hD?X2D
z4YUE;0;hRArX6^DpcBvq=nlLH^a1(<RlsOq9Plde8ZZf%#wYPfFTE-4%HWj+GZPW#
z1C<Fp=56p7z(<2mgvVsyMcBLm{t`G|*D$z_Gk9HsF_Y_}f?lx|<Z6u3#!!ubQcsK=
zubY^`z)b!h%oqlD-^>Q&prBG3^w$Lfb{5gH9`#}1!+{Y%OFSdIHBb(;0iFTc0nY;M
zfsR5xQz;rN;xp0Wfnq*WNa-$0iwSiLq<6j&N~M&BP^zR<MQJ>xT1pprY{vcaVoFz1
zYG{<+i0_s{sf1D~r6H8YQ>ye#_vE{&2xZC|8yfSO{f$2XUD0?BrHeqbeb)Q%nNmty
zP}+vl_LOG&tn=ZI{lsUqj{vkEIDhOKT3f@`m}%7R9ZDBb`W~e#D18(D__kdlJ_QE&
zfB+BzB0vnd0q%eY&<OAZyZ~>YG2jC<0ek^Jz#j+z0s#pi1%dz>AP0hh5Fiu?1Hu6X
zpafKa8i)WQfoLERFyNS(fD9lD$OejmE<nk9Jmz2%9&-rz7B~!i2OI&u2aW>AfaAak
z;3RMgI1T&&oB@6W&H_IH=YXGq^S}k*BJc}v3HTMb4EzRM0e%Or0)GJ4fIorjz+b=(
z;6K1k;1*B=)B<;bd%%4FuY8%#Kvw|od@y)@jB}aC;QpV%y*<t~%m>aN+?6u}0ld$_
zG)KJ!z{j)6p93$!`SvpOpJ3gu0oDRv0lR?hfE9Dp5_Wk1gDD691N;S`BjgI85_k!i
z2lN6K0R4czzyM$%Fc=sMtUzBO=$D-PZ=yaG_ze3`1@k$iGuRzg3pUU**dIN!Qnvj(
z#WkK;k5+Ql;+-x#=h-=HMeb-wdjRe>S<ZPgh}Q}6ciZFRKH`*uF(RfxVNeJtH7NLu
z8BbUhP-;d^i9+@n5$tRzghB(@7@^(Apuqo%$9PPD8At+>ffT?3!~=dR%p-UV5DWkQ
z*k1)0wHC9=a=b^wtfI9p(2^aS@G7b$vmMPNJ15?=V){Wh07qAVBU*`Fjt@?bHQqyD
z@bpdQ5b!N<SR}x4s-Sz|HnjPw*sDM?JjvC-f)Nm|NA|472yTFeaMEJ7*9j-r3&Kry
zPTG@DH`_U>r`YWXCwjt@Dd*F8<T`_QyeP%{ao{h5zD#w5;(ah$BNAyH3_2KGKq=um
zM8j2%iC4vAG=#>h_>4xSL5)xi=Gk3`y+%iR)WK4ZLa2dK;;Y9P2sKlhL}@amDU@13
z4RlUoU=@pAV^C+g(aueFZnpCzJ5RRr6g#(o3*k?4;Up51)sd*IMB=g%iOfnQHY<_n
ztVH6o66t}JxIReEY?c*v-r3H(*m+kwue9?Q?7W+uzi8*(?ffM>?_uXX?Yx(r_qOvs
zcHY;{``LMaJ0D=@1MR%Z&R@3kL3Tda&WG6fP;jCBD3jxziekmlv7!hlMU8hlE(NQ*
z2lkH<*jYw^+ki}9e-G?N3vhL6iZc&L0&GA#U_3AxSO{zcY%Q>p0X=}Rz+1oy;78yF
zz_jEsbAcKl5Wi}c11Ufj@Ep(`7z=y~d<~ofj<&(osV#Q=XRzD0!_^N61fqcfK=byv
z+W~F?KF{Im1*8DIfquZr4!DW{*MNIK|L3uD0;7PxfO~*vM_e(1=0F870N4SzcgA>u
z5<pvt-3gcg%mS7I8-O2y^S~c3z`h&i2vA_oIs-$1HNalrJK!YX(-T)_zy$Q@%VXmD
zqYoerumJ@?JD@%AA@Iro+{po_2I5Ku1XW=^fEYjrOai6>FTafA27C-`1%3xk4#L$G
zxDKQa!BqnI92hthIRQ1mfZ>=sAZZk?Xuxa07JxSzcNl;lU<5`16M=JMa0Ldg19t$g
zvACN6!hzmEe_$|BR*mrinXmGgQlJYkaw75tz6F@qu)|O0G5J6_Fc_Ezbe)2$9<T;j
z@j8#$1I&Gc$E*U@0aM@PF-22xbp`eThk!vdu?B#Ux3G4A4Ztrzi&;G8d7v}U9oP$8
z0j>kQ+4z5(z)9c?@YWn2GY9w(c>itOtpI0$$hkQ7fB{Gco(0aogS&wFm=oY#U=y$d
z*bf{6YJj^y;{{k(fC5MZih-8E6yP0TA)sM+OfJ@WUMs%4f+4Ru6%1Z^F|X=g16`y0
z8apxLi+lk-AOM7b2#^C}zzuK*lz<1&2=D~F0B@i%-~%)Pd;vco00;zj0bc|AfNy}q
zz)|2h5CWVA&H$l67@z=DfEtJfVu5%d0Z0TifEF+SNkAr00F(mPfIoq@0RFQZ(++qA
z7!SM(Oa-O^Gl2QPBESRt%E>ku6L=!v2^g^6W#Bv@wjIucw&eQ4__8}U-_8YgF0ym6
zox9n&hn;)cxtE<cwsRjlZ(`@ZcJ62AOjEYM$#(8x=O^2+`Wg0muNG`wV6XSE*E`tj
zS*_T1_iilj(U;|>o-B{C>kmz3>)~x#e!i0BaWAsm!)})`gspqGX8Dl*EMGL4<sIzp
zYg@AQbM`!j+wEUyZ`Z%fa$Yl*@3Q;1w&&Z+9>>?-{_7al?m9S+X;zL`g3t4qH--st
z=S=Rh$Q=Q>k1(JRO70^J^ghBs?;{Mj>mwR+A7Q|qAED$v!btByjMUc%9nlb9BlR`H
z7b^xUp;rr>9pD{+xEHZ<uoGtt!5PpRJ27_BMc7?BpuV;x&TjBztfKDNP2%9!7iZuv
zJ#kiHC-7~CodCKn*sU+%ig6unX~3-ZxMv5>y^NIyn_Y<48v2lSBo~sqk>+lsxf^Nj
zCYrm6=5C_7n`rJPn!AaP+eCd$)Yn9PP1M&+ef7AikeMLVNU4cZGo?wCCR3V1sRfkW
zdFt$(_>(#t;YGZ<5#U(#2gj>#+$joh_dAfj_F0UbW-0I<@ILSXumbo9SP85K)&T2(
z^}q&T6R-u?3Ty|y1ik{uuC)i)3+w~-1K$7#fNy~#z%k$?@B?rL_z^e@`~>_ATmXIn
zE&;y+mx14aE5QHj?abq&DzZI(=}y|r$Ow&~qliXOK-ShQ5Ogqf79b+KEV4)-1TZ9o
zuqhyd3Oa)z=&0b}pun)m4k84iMAoo~ta?TERY7DF-^}Rn^nHKlcK3V!^FE*V&x6nJ
zoKvSxovJ!@>-Mecx}B@w@8CP|J@?6T?O*O1=gi|bosNXw4f&C-Bm3#kwa~}#g`p)#
zarEmtzYBF8&3mLvjb9I)f-em%2wlQrY3OTyEvmw#D`>7GEf1YH$%k|$6fk<4oC@lQ
zx75{0nU&;U4}F5a)o}S=i_LC)ti%6GvtMUz@@m}_X`grn{iuNZh}=F(?lYf$VzwZ(
z4G%~7RV&r$NBSDOcp|ux-?s94>f(DFWxpiH5B0R->h}q&{R%mf6qyrv|J3+pyu_2f
z#&2a^H0zUSt|0js7sVvnS3l$8`MnUDXO@?&jhC^!M4Nn!k7DUX!^bsPTC7!q=mSQR
zj3ygRF`8<$nbGD()1clJ>~WR%u3(SLhtl#QE<fV(Brad#@+R*2)04f@x(9h&EmGR^
zr#q3-gSlJfGB@&!=CXS9JN=PM&<(S-Rxzte<!kjQs+~Y_-IIpcYI8*2s{MUV<NTMq
zvbWW9K!MM>DSy+@IPOYSp18e3%cp&jI*P20GQa98G`S!``<q5|5VdO^o69_nV^6}9
z<RPEjBBNz~$z^`c=|Y>?1x5$6N8qQ7#|tBTP=t>(u5w!c7TPK}&uD?sd~~Wow9GGB
zXz~D~1yH|f)PL!8XZE6@JZWXGb+B?39WSL^X$zeiwMWn=kITNm;-ValfuBBjyo6Mq
z6VDikt5o2B$f~!P)x6p&TILrmG`ZMDtjK7YUn}K8lM5mv$tev=iI(|A3r#MF&|U0U
z6tXAaV+^!oFo6G}d9-=}?eL<UN3O<+JyjyAvD7uBYoQ2Qz<<$^(4lw}<pd3Mn2pg;
z*5&H)5H#Y$;Ofs{QpNmNiDJ9@MntH3F@`$*^r1#=jY6(*&9w6aHPb|sj3ygRF`8<$
znbGD()1aCmp$J!brR70fKE&lkTz<smNnF0f<xSl4r<ta-W}3%6f0}7t+ViJReJ}0#
z(<i@|_WbG7Uuk{*d))Iki2iC{x*dCJPuF6P+Q-u(coB42%HQlnmxuh9N~A%(MLcnn
ze&=SM0l+*kA1na+8<PvcBCr@N0q+6*)yZXGIamQ!f>mHOSOeCA_rW^w0nlHZ+yF|!
zMz9H#0sU3UkHBV74n783z*evgYzI5QPEY}Mf!$ya*b6=Z`+)u$<$iDg90Z5JVQ>U|
z20jNa_yQaS`dgI8z;SQ_oCK%9X>bOd1?RwdZ~<HdUxBZ|C2$#h1FnE?!Bx<P=bax|
z<yOEC6!8?!bJqDTtg?6lf03uXHt>Js@=V3^(d1`Y&9eI2_#&%IR(`L{VD<7OE5$<E
zSWKHnu$T7&d!94-44=)aA77*J6~{AIO`g>nQ}#|)P#t;xx;%_HOlC}3HSX$9KPR!;
z#OH3FE^p--?@4@Kr_4U;n8I_}dY;`*@Qk-Dk2q0hRq`&<rT{*BgR878A7BMIjFsF^
zZ?l8(6e~HN2j6)H|IgEg*N7>r(~~`rpJ2z6)$xRhtRnHV8`~}P|DSKr4)Xi=W`#!`
zM`=S9+SwEz%_gv8K>k76FqLx0XwP172dnLm$p4NyMv*^pD&tCjex|N8`hSsU%WD0I
zC9x^y+4NT8@o(zeOrMs}j^AOkcPJ}mb{lHrXDj)AX+xzktcZ!_d-&N%{9eN5XZ)Uj
zjy?@wM+RRjC_98U>;jW`Hoi!ohLL}eGM~<5cZRlxc~1U@m~O}a&-A4MF<JgP@nseK
zCS$P=?8s-eO&$GTVHW}08H~3>U2hTVI+STUoLvHTDRxu#2iiD{{@2C!TiREL@yQ{!
zw^G-9@FDe8a4l?MEO+7SKj`B)+Peb(Eot8<;&6_3|JaRw^&x)5W(~R__<xJ*D;wX*
zuX4>1%QlSX?`IM34wR?v_vzCH^rtB^1s_K{(gx!DFyl3w{_Ufk;n7?-v}-)=dWn8D
z!Tyi5YaG|qHPDJNom0d*g8F(A!ve;lDt+opJx%EIQ`k4e?`^d061ENK=T!QTNlb1f
z##6|@4}VqY=RjR2)X^Tli^)6B7zOZq2ER|!mrseoX>f)z4>PVCskav8_S4Q;*!{%y
zKcBqrbJ&ez9Nxsw9_svxxsW)HRWtD_FQIS5vj^8zIekv$I%`4wH-Lr2_YiIV47<t1
z;ZDlFPkSDu&5z>u5c%nyDEAmU99&Z)$vZ*10rB2Fnw<|~+7}E2uYhjE`y+f+o5K9&
z8fs1q{}Ws#HrGM@+4z4OAL!QOe+A=mu_JZia~JJ72RhNux2Z4CjqfNyI`u9FdA(WB
zF>Zs2<8<&n=)jnr0W)dWWa2l5_TNs7Y7b-Ai5N93K_*T!pW+&%eQiKTwG&JO(?L4(
zZxSdcUcZ^Z_<|B*AJ27kWfJ4SeCW>gP?h`48=w+#Oaq6Q?+Mem&l9V&^yL@&{vdrE
z)z9a2biX~pl}E|CM0_2+8w@7W+bnUglb-$r9;2tT!5OfYUS{@W^$7YuPP7=2gN(oz
zU<g;xa^Mny_Vhdf^aII^-Zo~(9n7@Opc~Ps$yLw|d`TqsfIEx%B;#(7LNr!_;Y1`b
ziq?W!qq%E>FToEW2fK8zmx!$<D&rW<UR>QRiAZOzoU7pJ7l{&)m;yF4%6q^S@F$|u
zoM@CVy0d4p_xLKa=nZ@mnHz~rwZHhB95?5fXeP9sd*mcz{UDJ_C#LB>r>oocgwN^j
z?kD#N_Yg76n9C^5_3=EbXW4w7heY*EB+ZZr*R#<GdzKm*KbmijN5&5{S^%98(G<q}
zZu%nr{diyS`}p<oL>wFjUxH)cIQR-&iue8g>-dl3eYbrbza`#}Tt>=Is*JQRxS!I#
zYWw3i#QSRON9U_?!017vhm0OJdc^2wMqQ&{7(HtAOQXk(o-lgK=xL*8jh-`l!RSS!
zUl~<fd^IkK-h3p!G~RdXf%whPFO8lP<@+l2YIuM#1o};yiC`>v7Ca3WfQ8@%@I06T
zUIf#?%V0Wq3CsdB!4j|%tOcvVMz9Hd3_bz}!E&$@>;M&D57-WNf&HK@*vq&2^#hHJ
zHa6PCXqM5oMtMumX<#-D0<vikkWGVtY#Ib)(;y(5hGx^y^bJkl(DaS0R3p<jHk-yK
zH!-=1<u)-*l4+7mlVr6dnLfodDJG|yO{!^9%_i0K%}mqG<mN`x%red77AChaxs}PS
z%)XU*Xcf_`FRiT2VapAhK5Tsnn?55@51S10kYP3%<{=}HX?n#Z!|XH6KGQ5S%`($0
zGtFnF*<_kcmf2*PO_teYnN612WSLF2*<_ndw%KHxO}5$aP9pWTHk;O_Z*BV4rq3~b
zj+M=^vN>jxV>UUmsS^qmL+>}*7V5t{(P<axWc<+xZy(_uBD|w`okXXTN^uq4Z}b79
z+0X{2X%LX6K|q>@rfF!JhNj7~cxIbE+w|F{&oNDoX>v?cKhWCzh^9m$DLGsEI<2h@
zIcC$)Xp+%n>uEBw|L*jF*Mszc*MoHavSBAYG_yD~vsk5>oMv(hlUtaaWO9<p$tEY8
z+}PyCCO0y<k;zR=ZentZ$tfnMnw)BKvW-i!jZ3oiDA{_QWHiNSs%Xu6fk${nNOLgD
zxMq>knn&WAJ>t5OJl;6Mo4{2{X<6q)cw4yUnd~*|lrQe-J$ubPFJIRq-*sapJIzC-
z)pC!k&r0j+^|<t!qw=R&s<h^&%8N(SDyMm>v}S6QtDI)5(&DlcmtJ#Ldd*Jx6IWWZ
zEXrlCwCptp)ep@-FW)OCD!sV$;wq<J%dfbn*PTjfue|i?r)HY;;<D51jB?ehIqRjp
zxN64Azqs->3zc6VZ_;agqg?qKS1+xr$s1QM?Uk2zrPW&HD=n@&r?|#T`5Gs2jfc46
z;c>6L?hH!nKH+gsuhuE8_=>B4;u<IMjF>(eFR#7wuYM_CT)DDWw8a%Qaou&r>qqj{
zZlx7B@f7Z<2jOAkaZWvWCNo)5MnLzQID9GQO_5}+mT}r6kQ8V`Dvp-w4yzJv(CN<W
zd2Ji0X7+6ZoE}6kuZc11#F%vgZO<e}RCe-oe_*f4e4pm<1RCNA9)34?7~DeoR!}{W
z)dY9~-8k?JsE)n{s0xDMx8O!l8T=011gd~u*!BT+KwZ!PGzJfWmY_Gd2iyzN9be5v
z=MnA^>D(iHcj&I|tCi?H8t~nj=(LCGuIIZe(dhuyozIt;=yZhY?&sq!&mE9EBeZs+
z(;1o`=*)A$-Jl+*5AFjEKts?7GzLvTQxF38g9ktoNCqh&6*L3QK^kZQT7fXg0GS{Q
zWP{eA4bW$p;><dMp49_QL0>Q)OaPPb<H-p8n<%{t=7Yb1MPLay3(kX!U@N!|u7P=!
zoe!3Qh2U>sNh13l_p&~|n<pypDtHaNgKiJl?_&=I%m(v8{!+@p7l4_ySi`~lf+e6o
z_zRc=27wpAdtj-LPZu|iC+q2pSOr-sUMZ9KfdGfMxt!5hjsas$n}Bu#sl{L+7(~5`
z;KLiSu7ke|=7CwDyb@1*U`r*{^V^f6cXIkR+3kKj*&WE)++??hNr9M@>=tpxHmXl{
zhy5y5{HxUPU!_XSUun$q#+YYM7xnDvqp4_~S5Gu=*m15KTHcIa@D7>78)VK0fOp88
zjbIb_5PSr9gUs0qwgKKFb1J|MwHZBd961z+FTh)5P6|i`%|LU&+hopz;34oZNCz1p
z6J&vG&>FM>kAO!(d+^7Fto7hugO%V@FcT~Voyc1aFXBpl7YyUN4RJTn?yl$qMw5&t
z8%;5qYP6Zr=0?+?e(nn+xG!kOn74A+Ro3qD2zIbVN06^QW^YGXd)tNVYl|ws(Ds}2
z?4<EH{sN0mBk23T?yOe#vUb0n)$3VSh6`BvCgwA%htoq=x-UP$%7T^es)4LJNrzcg
zE@2J*cUHY=>}gbI&Hj3SR>T9Cl{1JoybI|`tkK7^5>3EnBCFXXR;?wJ|9}<qqchc$
zMuTdE#DCM?<1a_}AA5P}(qfNy>F@E+M|=EuXODLus5|7FwC^hI{{!uA4qCPMIq7a~
zu9<$U+cyDUM_K}AgHOR<lX-G?Td+#)O26{Jm`>8%L7CEIW|5^HA@wGC3&39dE<>B=
zo<!@X7bmfM5S|UjfEp?6JkW{&XbT<(BfvA@*)E(o<`28F4_M6p3!0Or8NlqlOzJxj
zAWDA)%|RP57|a9z09A=t7cc<40G5KaU<<gVJD(w-Q#W>bz_*ObKGHvc-yu(hKLEcU
zEbHNOvfOjW*n=VUPY__tYirkn@4U0z#jN48+)K3c8+0|<$*2ch<b3$IsoWz$0@q8+
zUOp$=tsoX#Nx9&fX?{<SejycL&!-FHGN~D(fLsoy^=8%Ko})}gA4wOGiu$k*2gZZb
z;0$QmoV_P_{l1JT7y|k?=RCRl{BbPFU4>>X_@FN{z<rfFSsV9$YOeGgy`k2fShsUG
z(3>9aQOfj3R{+jZ_AU4);B)XJnADGXpT<5+n$KzL9zH>7G;MPEJ_3vdYrq1q5}W{4
zxwdP9K43LC3_1?b-bm$>w3w^^I-0@o=fOG4`Hr00dEAlEECEeg&@a*xz}sL97>aJ_
zK(+k0jL=zT+rOBFZNY615_ND6i&wcCUk48RM03bnK9PG*2D6oPU(khf1?}9e)Yq00
zKcSfnIuGV7yjzIh>Fl=M1*#8WCWHCl5?K7CEaubyFP~&z=OH}uJ!gA&5oNj-aGyg{
z0-p;uS<W=#+uFVHxU7DnT>GIur-NID{bqJUKLLZlE$r;I1Vg}6U~-|X?qpPwNj2rZ
zPy~|xK-`Oza{y02l2bHHslJSD2X{KX*}+{VjoDKZyn%HN{24F?Ea&^^R_?v{%o?se
zyaD)_W71Me)-PdvN_<WyHv#=bQm<Po1>c?B>a=(42<8b`){;+c_y&0Ekvuzr$zV6A
z`7qB>qkK*mH<c1CO?s8xt~Tym>a99jIq%}Ji@O2Zm3=a<1Ii?%D|HRauI~3nZzEz|
z-6TrgIfk(SQ$cn*{lfM!w-zPaKgAVbsk%h@G50N_+iCyhr-@oC`ahOk)UiINn>!wV
z-P}dweT&W)R!aTeF^=6EP!COacOqU7j^~Lb%x)R{EZ|@$Ia9D5@C>tut7s?OH-R{U
z<P6Q9`ZkMN<GrV)zd#!Mta4gX?)7K6#z^&akJ7iEZXJ5nZ=$5dNX1C)+$XR*g6}n4
zss2ek#by#e_`1hsw}@!<bk{-Kxvv?WgMHj{+znr0)?zyoc`A4ttmRI-S{!@`E<ERR
z9(Nz2M6KuP1y~O1fDge%&;{%Ud%>~ieNHdNPqcuj^>U98m4;c|fnVSb25y<`b9%eG
z@t23x%WZ_zhy2_urB>6v-tIxl6rk%kg)1Bk0ZYJ3;HDS3hr#Q^3&0fcIku<amH0m3
zN92Al`J6uPAmaErniC);n<&CJ@wwF3T|xW$y7|QKBlJ7LJAcxy>SF3$%IEIKpyo8L
z{AtoQrA=Wsj=VkS%D~^zhusrs4o~MT0{0+2&2_Kf@6R*nDG1J#rU`wkIg?MES7`}w
z!FcfFYkZphneWKmpRkzvI-}f{XRX)yrraHamkXq}zQK6*A<}Q^Gck)A^4#0$QBe+0
zsNfX(fp#BTlOyR3T65nlNgv?h%q(X7BWPyxv<kL>pTWLId``X_qSo{|d<KAh?bx9P
zgWlGieji@`)lO18H4b)f;@TYS&ZORMkK*C4d;-s9RRnIC%lGxJbK(~#%zLv5{yb*_
zPrVtug|6Rg=olBaUlizMJi*@uu3r`C4%hDr^oHw~1^U4C+X8*z8T@|0GJn{9!(cgF
zzhbZguHP|O3D++f?1k$W3_gMDHw^Z{^(zL>T^T&L-ppGTyrYX$UGH1m1)NONJ9>j7
zme%_kybl^n^VSFH_*h!+aq!k?EPb;-O!|gcy1JzksY&nbmg-$xB-L3vV&lEbTk5Y9
zOM7+R6H9w_-WyAMb=Hlgy*lf~(q5gsH_Pb?)yccGNUF1c#KwEaw$wi$miFq*i>19f
z2gcG~o%yk}SLdKu+N-men)DWKDWfAvvH8Gsic0Za8ZpN|5{=%^EoICk$!dq`WL1Kd
z-r*eym(>hE&nS^!tr(3?@AR%Ro%cHxW6^C#Hy#gqySJ2)mL#wLFrB<Ug_Yg|9uJq*
zd9KA=-pk`;>oT3J%(OGExtu<&@61{i)%b#*=G>a7#vjp)Umw-PM>G|sQB5GCsa_V<
z+z`<$E01b^6VYUDk7{m=XlCq;YAQ!G_4h_KH$^lf_eC{TBAW93QBBo|rt+bvCK%E5
zI1<%Vi)gM_L^YLzMb`IwcEq8Jb6OLJ8-qiFm4gF=OCvekK2uJ1B&V8{aF&HR8=M=Q
zwJOXB>fGSDHDOLs=LW~G4|9q-H&{^`<`i{quzFdTlhnDvW#wT`QRfCTw}<hc8=SE-
z%t`9pVEw&ePEzLvNA3%AnmRXFzCX-~>fB)ELt#!;=LUNm33IYKH`sjdsbxGDo9+6b
zLkq80^w_Dns~+4K92s1-L!OI*^FjwWPp7knS)5q>ls9OV(#g7`P)~a;q_=G6acXZ5
z`c={<c(UI5UCbH7m6Y1W3BK%vXiD$#E(>LHmT|V7<BQ7ILMK8i$e}F>dUII$E3lKi
z2QMo)8CVWi1f{#o>B8Bhb?R{y=lf2n7CY~#x|Lo<>Hn6qW3tXM>a=4S?Y?5Al+ruM
zO0UJ|aaMAf36k{Y@OsV}MtkSU@>-5}uLY(2{Z4+Z1l@Z2n!!0qweCPDo70hsns<Kk
z0QO#bTWEhM3t6rI2Ft@(>MiDZ#7n0(4`ZpcT6GwIlGpOrK_$tvPLb*ys2A60O0|B5
zC%p;1m6j~R@+f6ALLVY!nzSc$FedAa=~3FSf!<~%$nHAjW{18oTeWU8k;vk_=37KY
zXF!jUqc^HABOgbz%StL=xwHA(rI+ZNPGM>+l=6CcIds}aHY4G*jjK``1zkm+Mk$@&
zl*h~jNnR8WBkAsPnRcsvm%(RHm6WXBUM7mFe+^XidMUkeel1iU2w%`|*BpZDcWdef
zGT3eF%3fPkIueuG#H5`uX-7<|h)MfnQrno+C?++INm(%|Cnnt=lOBjk{H|i8RZU`2
z>p*Q<tl#9RW4vqN9=Lv&=iWfrewn8(Y4s!%OFa!}|F8?GI<b`U?p5lT@*WH9422VP
zm0q|o>4M`Itz`6O=yMl%+uZL=dhWU5RZ6PBUl?9xq&Vq`RoK%DvZ4UX!78vCtO0Am
z`(Pc&1^vMQkOu~Wd@u+M21CG;pa2X7g`fxw1I1uCC;=nDNH8ksBuq+}&0+CL32*TN
z=EPqd=hW4VXHOP?`r_vo^0WEht6F7lsg5(?Zr_j<TgrdAx~F6_N&QQACcfl2KPNah
fc<KL7I?LIbe`@0YrAEJF{rKOC)H~*zyXwCH{?1dq

literal 0
HcmV?d00001

diff --git a/test/js/web/url/url.test.ts b/test/js/web/url/url.test.ts
index 4947eb1c13f8..a1f8f92b42af 100755
--- a/test/js/web/url/url.test.ts
+++ b/test/js/web/url/url.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it, test } from "bun:test";
-import { bunEnv, bunExe } from "harness";
+import { bunEnv, bunExe, isLinux, isWindows } from "harness";
 import { resolveObjectURL } from "node:buffer";
+import { domainToASCII } from "node:url";
 
 describe("url", () => {
   it("URL throws", () => {
@@ -332,3 +333,50 @@ describe("object URL prefix check", () => {
     });
   }, 60_000);
 });
+
+// Unicode 16.0 UTS #46 reclassified several codepoints from "disallowed" to
+// "mapped"/"ignored"; the bundled ICU predates that. The uts46.nrm override in
+// bun_icu_decompress.cpp only applies on Linux/Windows (udata hook platforms).
+describe.skipIf(!(isLinux || isWindows))("IDNA UTS #46 Unicode 16.0 mappings", () => {
+  it("maps late-casefolded capitals instead of rejecting them", () => {
+    expect(
+      [
+        "https://\u04C0/", // CYRILLIC LETTER PALOCHKA
+        "https://\u10AC/", // GEORGIAN CAPITAL LETTER NAR
+        "https://a\u10B5/", // a + GEORGIAN CAPITAL LETTER KHAR
+        "https://\u2132/", // TURNED CAPITAL F
+        "https://\u2183/", // ROMAN NUMERAL REVERSED ONE HUNDRED
+        "https://\u1874\u10A0/", // MONGOLIAN LETTER ... + GEORGIAN CAPITAL AN
+        "https://\uA846\u3002\u2183\u0FB5\uB1AE-/", // WPT IdnaTestV2 "V3 (ignored)" case
+      ].map(href => new URL(href).hostname),
+    ).toEqual([
+      "xn--s5a",
+      "xn--3kj",
+      "xn--a-hws",
+      "xn--73g",
+      "xn--r5g",
+      "xn--h9e436h",
+      "xn--fc9a.xn----qmg097k469k",
+    ]);
+  });
+
+  it("ignores format controls reclassified in Unicode 16.0", () => {
+    expect(
+      [
+        "https://a\u180Eb/", // MONGOLIAN VOWEL SEPARATOR
+        "https://a\u2061b/", // FUNCTION APPLICATION
+        "https://a\u3164b/", // HANGUL FILLER
+      ].map(href => new URL(href).hostname),
+    ).toEqual(["ab", "ab", "ab"]);
+  });
+
+  it("node:url domainToASCII applies the same mapping", () => {
+    expect(domainToASCII("\u10AC")).toBe("xn--3kj");
+    expect(domainToASCII("\u2183")).toBe("xn--r5g");
+  });
+
+  it("still maps pre-existing UTS #46 cases", () => {
+    expect(new URL("https://M\u00FCnchen.de/").hostname).toBe("xn--mnchen-3ya.de");
+    expect(new URL("https://\u0391/").hostname).toBe("xn--mxa");
+  });
+});

From d32f0267a910550608f96115622858206285ffdb Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Sun, 19 Jul 2026 23:04:28 +0000
Subject: [PATCH 2/9] [autofix.ci] apply automated fixes

---
 test/js/web/url/url.test.ts | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/test/js/web/url/url.test.ts b/test/js/web/url/url.test.ts
index a1f8f92b42af..e0293a433bea 100755
--- a/test/js/web/url/url.test.ts
+++ b/test/js/web/url/url.test.ts
@@ -349,15 +349,7 @@ describe.skipIf(!(isLinux || isWindows))("IDNA UTS #46 Unicode 16.0 mappings", (
         "https://\u1874\u10A0/", // MONGOLIAN LETTER ... + GEORGIAN CAPITAL AN
         "https://\uA846\u3002\u2183\u0FB5\uB1AE-/", // WPT IdnaTestV2 "V3 (ignored)" case
       ].map(href => new URL(href).hostname),
-    ).toEqual([
-      "xn--s5a",
-      "xn--3kj",
-      "xn--a-hws",
-      "xn--73g",
-      "xn--r5g",
-      "xn--h9e436h",
-      "xn--fc9a.xn----qmg097k469k",
-    ]);
+    ).toEqual(["xn--s5a", "xn--3kj", "xn--a-hws", "xn--73g", "xn--r5g", "xn--h9e436h", "xn--fc9a.xn----qmg097k469k"]);
   });
 
   it("ignores format controls reclassified in Unicode 16.0", () => {

From 45af3b8f86450a462524201dc34eb010bbaf5420 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 19 Jul 2026 23:51:48 +0000
Subject: [PATCH 3/9] ci: retrigger


From 7499cbca18069afbd28c3da423a2a0ab90c483f8 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Mon, 20 Jul 2026 00:03:37 +0000
Subject: [PATCH 4/9] scripts: pin SHA-256 for ICU inputs, use absolute output
 path, trim header comment

---
 scripts/regenerate-uts46-override.sh | 42 +++++++++++++---------------
 1 file changed, 19 insertions(+), 23 deletions(-)

diff --git a/scripts/regenerate-uts46-override.sh b/scripts/regenerate-uts46-override.sh
index abcc0e442ca4..7f3b29b4c360 100755
--- a/scripts/regenerate-uts46-override.sh
+++ b/scripts/regenerate-uts46-override.sh
@@ -1,46 +1,42 @@
 #!/usr/bin/env bash
-# Regenerates src/jsc/bindings/icu_uts46_override.nrm.
-#
-# The bundled ICU prebuilts (ICU 75.1 on Linux/musl, ICU 73.2 on Windows) ship
-# uts46.nrm data derived from Unicode 15.x's IdnaMappingTable.txt, which marks
-# several late-casefolded capitals as "disallowed" (U+04C0, U+10A0..10C5,
-# U+2132, U+2183, ...). Unicode 16.0's IdnaMappingTable.txt changed these to
-# "mapped". This script produces a uts46.nrm carrying the Unicode 16.0 mappings
-# in Nrm2 format version 4 (the format ICU 73/75's Normalizer2 reads), which
-# bun_icu_decompress.cpp swaps in at runtime via the udata hook.
-#
-# Delete the override once the oven-sh/WebKit prebuilt bundles ICU 76 or later.
+# Regenerates src/jsc/bindings/icu_uts46_override.nrm: a Unicode 16.0 UTS #46
+# uts46.nrm in Nrm2 format v4 (readable by the bundled ICU 73/75), swapped in at
+# runtime by bun_icu_decompress.cpp. Drop once the WebKit prebuilt ships ICU 76+.
 set -euo pipefail
 
 ICU_TOOLCHAIN_TAG=release-75-1   # whose gennorm2 to use (emits Nrm2 format v4)
 ICU_TOOLCHAIN_SRC=icu4c-75_1-src.tgz
+ICU_TOOLCHAIN_SHA256=cb968df3e4d2e87e8b11c49a5d01c787bd13b9545280fc6642f826527618caef
 ICU_DATA_TAG=release-76-1        # whose norm2/uts46.txt to compile
+ICU_DATA_SHA256=fda2c1c636d71db2cc685ca7671aff8efa27e83d84ee322cc3ce1375e53300d8
 
-cd "$(dirname "$0")/.."
-OUT="src/jsc/bindings/icu_uts46_override.nrm"
+REPO_ROOT="$(cd -- "$(dirname -- "$0")/.." && pwd)"
+OUT="$REPO_ROOT/src/jsc/bindings/icu_uts46_override.nrm"
 WORK="$(mktemp -d)"
 trap 'rm -rf "$WORK"' EXIT
 
-curl -fL "https://github.com/unicode-org/icu/releases/download/${ICU_TOOLCHAIN_TAG}/${ICU_TOOLCHAIN_SRC}" \
-  | tar -xz -C "$WORK"
+fetch() {
+  curl -fL --proto '=https' --tlsv1.2 "$1" -o "$2"
+  echo "$3  $2" | sha256sum -c -
+}
+
+fetch "https://github.com/unicode-org/icu/releases/download/${ICU_TOOLCHAIN_TAG}/${ICU_TOOLCHAIN_SRC}" \
+  "$WORK/icu.tgz" "$ICU_TOOLCHAIN_SHA256"
+tar -xzf "$WORK/icu.tgz" -C "$WORK"
 pushd "$WORK/icu/source" >/dev/null
 ./configure --enable-static --disable-shared --with-data-packaging=archive \
   --disable-samples --disable-tests --disable-extras --disable-icuio >/dev/null
 make -j"$(nproc)" >/dev/null
 popd >/dev/null
 
-curl -fL "https://raw.githubusercontent.com/unicode-org/icu/${ICU_DATA_TAG}/icu4c/source/data/unidata/norm2/uts46.txt" \
-  -o "$WORK/icu/source/data/unidata/norm2/uts46.txt"
+fetch "https://raw.githubusercontent.com/unicode-org/icu/${ICU_DATA_TAG}/icu4c/source/data/unidata/norm2/uts46.txt" \
+  "$WORK/icu/source/data/unidata/norm2/uts46.txt" "$ICU_DATA_SHA256"
 
 LD_LIBRARY_PATH="$WORK/icu/source/lib:$WORK/icu/source/stubdata" \
   "$WORK/icu/source/bin/gennorm2" -o "$OUT" \
   -s "$WORK/icu/source/data/unidata/norm2" nfc.txt uts46.txt
 
-# Format-version sanity check: byte 16 must be 4.
 fmt=$(od -An -t u1 -j 16 -N 1 "$OUT" | tr -d ' ')
-if [ "$fmt" != "4" ]; then
-  echo "error: generated $OUT has Nrm2 format version $fmt, expected 4" >&2
-  exit 1
-fi
+[ "$fmt" = "4" ] || { echo "error: $OUT has Nrm2 format version $fmt, expected 4" >&2; exit 1; }
 
-echo "wrote $OUT ($(wc -c <"$OUT") bytes)"
+echo "wrote $OUT ($(wc -c <"$OUT") bytes, md5 $(md5sum "$OUT" | cut -d' ' -f1))"

From f8feb903ec8209cbc6393279b120d1bd03c01c01 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Wed, 1 Jul 2026 19:39:52 +0000
Subject: [PATCH 5/9] url: reject invalid Punycode (xn--) labels in
 special-scheme hosts

WTF::URLParser takes an all-ASCII fast path for special-scheme hosts
that never runs UTS-46 "domain to ASCII", so an "xn--" label that does
not decode to a valid IDNA label (for example "xn--a-ecp") parses
successfully. Node and the URL Standard's host parser reject it.

Add Bun::urlHostIsValidIDNA, which re-runs ICU's uidna_nameToASCII on
a parsed special-scheme host, but only when one of its labels starts
with "xn--"; for every other all-ASCII host the fast path is already
equivalent to the spec. Wire it into DOMURL's create, parse, canParse,
and setHref, which also covers the href, host, and hostname setters.

url.domainToASCII had the same all-ASCII early return; gate it on the
same predicate and route ACE labels through the shared helper.
---
 src/jsc/bindings/BunIDNA.cpp                  | 50 ++++++++++++
 src/jsc/bindings/BunIDNA.h                    | 24 ++++++
 src/jsc/bindings/DOMURL.cpp                   | 29 ++++---
 src/jsc/bindings/NodeURL.cpp                  | 25 ++----
 .../node/url/url-domain-ascii-unicode.test.js | 19 +++++
 test/js/web/url/url.test.ts                   | 77 +++++++++++++++++++
 6 files changed, 198 insertions(+), 26 deletions(-)
 create mode 100644 src/jsc/bindings/BunIDNA.cpp
 create mode 100644 src/jsc/bindings/BunIDNA.h

diff --git a/src/jsc/bindings/BunIDNA.cpp b/src/jsc/bindings/BunIDNA.cpp
new file mode 100644
index 000000000000..94aacbd42016
--- /dev/null
+++ b/src/jsc/bindings/BunIDNA.cpp
@@ -0,0 +1,50 @@
+#include "root.h"
+#include "BunIDNA.h"
+
+#include <unicode/uidna.h>
+#include <wtf/URL.h>
+#include <wtf/URLParser.h>
+#include <wtf/text/StringView.h>
+#include <wtf/text/WTFString.h>
+
+namespace Bun {
+
+bool domainHasACELabel(WTF::StringView domain)
+{
+    unsigned labelStart = 0;
+    while (true) {
+        if (domain.substring(labelStart).startsWithIgnoringASCIICase("xn--"_s))
+            return true;
+        size_t dot = domain.find('.', labelStart);
+        if (dot == WTF::notFound)
+            return false;
+        labelStart = static_cast<unsigned>(dot) + 1;
+    }
+}
+
+WTF::String domainToASCII(WTF::StringView domain)
+{
+    std::array<char16_t, WTF::URLParser::hostnameBufferLength> buffer;
+    UErrorCode error = U_ZERO_ERROR;
+    UIDNAInfo processingDetails = UIDNA_INFO_INITIALIZER;
+    int32_t length = uidna_nameToASCII(&WTF::URLParser::internationalDomainNameTranscoder(), domain.upconvertedCharacters(), domain.length(), buffer.data(), WTF::URLParser::hostnameBufferLength, &processingDetails, &error);
+    if (U_SUCCESS(error) && !(processingDetails.errors & ~WTF::URLParser::allowedNameToASCIIErrors) && length > 0)
+        return WTF::String { std::span { buffer }.first(static_cast<size_t>(length)) };
+    return {};
+}
+
+bool urlHostIsValidIDNA(const WTF::URL& url)
+{
+    // Only special-scheme URLs have a domain host; the host of every other
+    // scheme is opaque and the URL Standard does not apply IDNA to it.
+    if (!url.hasSpecialScheme())
+        return true;
+    // A parsed special host is already ASCII; UTS-46 "domain to ASCII" can
+    // only still fail on it when a label uses the Punycode "xn--" prefix.
+    auto host = url.host();
+    if (!domainHasACELabel(host))
+        return true;
+    return !domainToASCII(host).isNull();
+}
+
+} // namespace Bun
diff --git a/src/jsc/bindings/BunIDNA.h b/src/jsc/bindings/BunIDNA.h
new file mode 100644
index 000000000000..982e1b3f68b3
--- /dev/null
+++ b/src/jsc/bindings/BunIDNA.h
@@ -0,0 +1,24 @@
+#pragma once
+
+#include "root.h"
+
+#include <wtf/Forward.h>
+
+namespace Bun {
+
+// Whether any dot-separated label of `domain` starts with the Punycode ACE
+// prefix "xn--" (ASCII case-insensitive). Those are the only all-ASCII
+// labels that UTS-46 "domain to ASCII" can reject.
+bool domainHasACELabel(WTF::StringView domain);
+
+// UTS-46 "domain to ASCII" with the URL Standard's options (beStrict = false):
+// https://url.spec.whatwg.org/#concept-domain-to-ascii
+// Returns a null String when `domain` is not a valid IDNA domain.
+WTF::String domainToASCII(WTF::StringView domain);
+
+// WTF::URLParser never runs UTS-46 on an all-ASCII host, so an "xn--" label
+// that does not decode to a valid IDNA label parses successfully. The URL
+// Standard's host parser requires that to fail; re-check such hosts here.
+bool urlHostIsValidIDNA(const WTF::URL&);
+
+} // namespace Bun
diff --git a/src/jsc/bindings/DOMURL.cpp b/src/jsc/bindings/DOMURL.cpp
index 61af7c63383d..f775d8277268 100644
--- a/src/jsc/bindings/DOMURL.cpp
+++ b/src/jsc/bindings/DOMURL.cpp
@@ -29,6 +29,7 @@
 #include "ActiveDOMObject.h"
 // #include "Blob.h"
 // #include "BlobURL.h"
+#include "BunIDNA.h"
 // #include "MemoryCache.h"
 // #include "PublicURLManager.h"
 // #include "ResourceRequest.h"
@@ -55,6 +56,14 @@ static inline String redact(const String& input)
     return makeString('"', input, '"');
 }
 
+// WTF::URLParser skips UTS-46 validation for all-ASCII hosts, so "xn--"
+// (Punycode) labels that are not valid IDNA parse successfully; the URL
+// Standard's host parser requires them to fail. Re-check them here.
+static bool isValidCompleteURL(const URL& url)
+{
+    return url.isValid() && Bun::urlHostIsValidIDNA(url);
+}
+
 inline DOMURL::DOMURL(URL&& completeURL)
     : m_url(WTF::move(completeURL))
     , m_initialURLCostForGC(static_cast<uint16_t>(std::min<size_t>(m_url.string().impl()->costDuringGC(), std::numeric_limits<uint16_t>::max())))
@@ -65,16 +74,17 @@ inline DOMURL::DOMURL(URL&& completeURL)
 ExceptionOr<Ref<DOMURL>> DOMURL::create(const String& url)
 {
     URL completeURL { url };
-    if (!completeURL.isValid())
+    if (!isValidCompleteURL(completeURL))
         return Exception { InvalidURLError, makeString(redact(url), " cannot be parsed as a URL."_s) };
     return adoptRef(*new DOMURL(WTF::move(completeURL)));
 }
 
 ExceptionOr<Ref<DOMURL>> DOMURL::create(const String& url, const URL& base)
 {
-    ASSERT(base.isValid() || base.isNull());
+    // Private overload: create(url, String base), the only caller, already rejected an invalid base.
+    ASSERT(base.isNull() || isValidCompleteURL(base));
     URL completeURL { base, url };
-    if (!completeURL.isValid())
+    if (!isValidCompleteURL(completeURL))
         return Exception { InvalidURLError, makeString(redact(url), " cannot be parsed as a URL."_s) };
     return adoptRef(*new DOMURL(WTF::move(completeURL)));
 }
@@ -82,7 +92,7 @@ ExceptionOr<Ref<DOMURL>> DOMURL::create(const String& url, const URL& base)
 ExceptionOr<Ref<DOMURL>> DOMURL::create(const String& url, const String& base)
 {
     URL baseURL { base };
-    if (!base.isNull() && !baseURL.isValid())
+    if (!base.isNull() && !isValidCompleteURL(baseURL))
         return Exception { InvalidURLError, makeString(redact(url), " cannot be parsed as a URL against "_s, redact(base)) };
     return create(url, baseURL);
 }
@@ -92,9 +102,12 @@ DOMURL::~DOMURL() = default;
 static URL parseInternal(const String& url, const String& base)
 {
     URL baseURL { base };
-    if (!base.isNull() && !baseURL.isValid())
+    if (!base.isNull() && !isValidCompleteURL(baseURL))
+        return {};
+    URL completeURL { baseURL, url };
+    if (!isValidCompleteURL(completeURL))
         return {};
-    return { baseURL, url };
+    return completeURL;
 }
 
 RefPtr<DOMURL> DOMURL::parse(const String& url, const String& base)
@@ -113,10 +126,8 @@ bool DOMURL::canParse(const String& url, const String& base)
 ExceptionOr<void> DOMURL::setHref(const String& url)
 {
     URL completeURL { URL {}, url };
-    if (!completeURL.isValid()) {
-
+    if (!isValidCompleteURL(completeURL))
         return Exception { InvalidURLError, makeString(redact(url), " cannot be parsed as a URL."_s) };
-    }
     m_url = WTF::move(completeURL);
     if (m_searchParams)
         m_searchParams->updateFromAssociatedURL();
diff --git a/src/jsc/bindings/NodeURL.cpp b/src/jsc/bindings/NodeURL.cpp
index 09af0674a4e9..1a967ffea8d2 100644
--- a/src/jsc/bindings/NodeURL.cpp
+++ b/src/jsc/bindings/NodeURL.cpp
@@ -1,4 +1,5 @@
 #include "NodeURL.h"
+#include "BunIDNA.h"
 #include "wtf/URLParser.h"
 #include <unicode/uidna.h>
 
@@ -50,25 +51,15 @@ JSC_DEFINE_HOST_FUNCTION(jsDomainToASCII, (JSC::JSGlobalObject * globalObject, J
     )
         return JSC::JSValue::encode(jsEmptyString(vm));
 
-    if (domain.containsOnlyASCII())
+    // An "xn--" (ACE) label must decode to a valid IDNA label, so it cannot
+    // take the ASCII fast path: https://url.spec.whatwg.org/#concept-domain-to-ascii
+    if (domain.containsOnlyASCII() && !domainHasACELabel(domain))
         return JSC::JSValue::encode(arg0);
-    if (domain.is8Bit())
-        domain.convertTo16Bit();
 
-    constexpr static int allowedNameToASCIIErrors = UIDNA_ERROR_EMPTY_LABEL | UIDNA_ERROR_LABEL_TOO_LONG | UIDNA_ERROR_DOMAIN_NAME_TOO_LONG | UIDNA_ERROR_LEADING_HYPHEN | UIDNA_ERROR_TRAILING_HYPHEN | UIDNA_ERROR_HYPHEN_3_4;
-    constexpr static size_t hostnameBufferLength = 2048;
-
-    auto encoder = &WTF::URLParser::internationalDomainNameTranscoder();
-    char16_t hostnameBuffer[hostnameBufferLength];
-    UErrorCode error = U_ZERO_ERROR;
-    UIDNAInfo processingDetails = UIDNA_INFO_INITIALIZER;
-    const auto span = domain.span16();
-    int32_t numCharactersConverted = uidna_nameToASCII(encoder, span.data(), span.size(), hostnameBuffer, hostnameBufferLength, &processingDetails, &error);
-
-    if (U_SUCCESS(error) && !(processingDetails.errors & ~allowedNameToASCIIErrors) && numCharactersConverted) {
-        return JSC::JSValue::encode(JSC::jsString(vm, WTF::String(std::span { hostnameBuffer, static_cast<unsigned int>(numCharactersConverted) })));
-    }
-    return JSC::JSValue::encode(jsEmptyString(vm));
+    auto ascii = domainToASCII(domain);
+    if (ascii.isNull())
+        return JSC::JSValue::encode(jsEmptyString(vm));
+    return JSC::JSValue::encode(JSC::jsString(vm, ascii));
 }
 
 JSC_DEFINE_HOST_FUNCTION(jsDomainToUnicode, (JSC::JSGlobalObject * globalObject, JSC::CallFrame* callFrame))
diff --git a/test/js/node/url/url-domain-ascii-unicode.test.js b/test/js/node/url/url-domain-ascii-unicode.test.js
index d46b30f8c2e0..431bb331e864 100644
--- a/test/js/node/url/url-domain-ascii-unicode.test.js
+++ b/test/js/node/url/url-domain-ascii-unicode.test.js
@@ -99,3 +99,22 @@ describe("url.domainToUnicode", () => {
     });
   }
 });
+
+// https://url.spec.whatwg.org/#concept-domain-to-ascii
+// An "xn--" (ACE) label must decode to a valid IDNA label; "xn--a-ecp"
+// decodes to U+0061 U+2488 (DIGIT ONE FULL STOP), which is disallowed.
+describe("url.domainToASCII and invalid Punycode (xn--) labels", () => {
+  const invalidPunycode = ["xn--a-ecp.example", "sub.xn--a-ecp.example", "XN--A-ECP.example", "xn--pokxncvks", "xn--"];
+  for (const domain of invalidPunycode) {
+    test(`-> '${domain}' is ''`, () => {
+      expect(url.domainToASCII(domain)).toBe("");
+    });
+  }
+  test("a valid ACE label is preserved and lowercased", () => {
+    expect(url.domainToASCII("XN--BCHER-KVA.DE")).toBe("xn--bcher-kva.de");
+    expect(url.domainToASCII("xn--fiqs8s")).toBe("xn--fiqs8s");
+  });
+  test("a label that merely contains 'xn--' is not an ACE label", () => {
+    expect(url.domainToASCII("axn--a-ecp.example")).toBe("axn--a-ecp.example");
+  });
+});
diff --git a/test/js/web/url/url.test.ts b/test/js/web/url/url.test.ts
index e0293a433bea..53c241ae1817 100755
--- a/test/js/web/url/url.test.ts
+++ b/test/js/web/url/url.test.ts
@@ -259,6 +259,83 @@ describe("url", () => {
     expect(params.get("second")).toBe("replaced");
     expect(params.get("third")).toBeNull();
   });
+
+  // https://url.spec.whatwg.org/#concept-domain-to-ascii
+  // "xn--a-ecp" decodes to U+0061 U+2488 (DIGIT ONE FULL STOP), which is not a
+  // valid IDNA label, so "domain to ASCII" (and therefore the host parser) must
+  // fail on it. Node and browsers reject it.
+  describe("invalid Punycode (xn--) labels in special-scheme hosts", () => {
+    const invalidHosts = [
+      "xn--a-ecp.example",
+      "sub.xn--a-ecp.example",
+      "XN--A-ECP.example",
+      "xn--a-ecp.xn--fiqs8s",
+      // not decodable as Punycode at all
+      "xn--pokxncvks",
+      // empty ACE label
+      "xn--",
+      // percent-encoded "x": takes URLParser's percent-decoding slow path
+      "%78n--a-ecp.example",
+    ] as const;
+
+    for (const scheme of ["http", "https", "ws", "wss", "ftp", "file"] as const) {
+      it(`${scheme}: the constructor rejects an invalid xn-- label`, () => {
+        expect(() => new URL(`${scheme}://xn--a-ecp.example/`)).toThrow("cannot be parsed as a URL");
+        expect(() => new URL(`${scheme}://xn--a-ecp.example/`)).toThrow(
+          expect.objectContaining({ code: "ERR_INVALID_URL" }),
+        );
+      });
+    }
+
+    for (const host of invalidHosts) {
+      const input = `http://${host}/`;
+      it(`${JSON.stringify(input)} is rejected`, () => {
+        expect(() => new URL(input)).toThrow("cannot be parsed as a URL");
+        expect(URL.canParse(input)).toBe(false);
+        expect(URL.parse(input)).toBeNull();
+      });
+    }
+
+    it("the href setter throws and the host/hostname setters are a no-op", () => {
+      const url = new URL("http://ok.example/p?q#f");
+      expect(() => {
+        url.href = "http://xn--a-ecp.example/";
+      }).toThrow("cannot be parsed as a URL");
+      url.host = "xn--a-ecp.example";
+      url.hostname = "xn--a-ecp.example";
+      expect(url.href).toBe("http://ok.example/p?q#f");
+    });
+
+    it("a base URL with an invalid xn-- label is rejected", () => {
+      expect(() => new URL("//xn--a-ecp.example/x", "http://ok.example/")).toThrow("cannot be parsed as a URL");
+      expect(() => new URL("http://ok.example/", "http://xn--a-ecp.example/")).toThrow("cannot be parsed as a URL");
+      expect(URL.canParse("/x", "http://xn--a-ecp.example/")).toBe(false);
+    });
+
+    it("valid ACE labels and non-ACE ASCII hosts still parse", () => {
+      const accepted = {
+        "http://xn--bcher-kva.de/": "xn--bcher-kva.de",
+        "http://XN--BCHER-KVA.DE/": "xn--bcher-kva.de",
+        "http://xn--fiqs8s/": "xn--fiqs8s",
+        "http://xn--nxasmm1c/": "xn--nxasmm1c",
+        "http://xn--e1afmkfd.xn--p1ai/": "xn--e1afmkfd.xn--p1ai",
+        // "axn--a-ecp" merely contains "xn--"; it is not an ACE label
+        "http://axn--a-ecp.example/": "axn--a-ecp.example",
+        "http://ab--cd.example/": "ab--cd.example",
+        "http://a_b.example/": "a_b.example",
+        "http://r4---sn-a5mlrn7s.gevideo.com/": "r4---sn-a5mlrn7s.gevideo.com",
+        "http://-sn--a5mlrn7s-.gevideo.com/": "-sn--a5mlrn7s-.gevideo.com",
+      };
+      expect(Object.fromEntries(Object.keys(accepted).map(input => [input, new URL(input).hostname]))).toEqual(
+        accepted,
+      );
+    });
+
+    it("opaque hosts of non-special schemes are not IDNA-validated", () => {
+      expect(new URL("foo://xn--a-ecp.example/").hostname).toBe("xn--a-ecp.example");
+      expect(new URL("foo://XN--A-ECP.example/").hostname).toBe("XN--A-ECP.example");
+    });
+  });
 });
 
 describe("object URL prefix check", () => {

From 8fa292a6940cab3769d0242349bd198240bdaba9 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Wed, 1 Jul 2026 20:26:53 +0000
Subject: [PATCH 6/9] url: handle ICU buffer overflow and validate the blob:
 origin's inner host

Bun::domainToASCII used a fixed 2048-code-unit buffer and treated
U_BUFFER_OVERFLOW_ERROR as "invalid IDNA", so an all-ASCII host longer
than that which happens to contain an "xn--" label was newly rejected.
Retry once with a heap buffer of the length ICU reports, following
ICU's preflight convention. The URL Standard puts no length limit on a
domain, and Node accepts these.

URLDecomposition::origin() re-parses a blob: URL's path with a raw
WTF::URL and only checked isValid(), so an invalid "xn--" label in the
inner host still produced a tuple origin. Apply the same host check so
the inner parse fails and the origin serializes to "null", as Node does.
---
 src/jsc/bindings/BunIDNA.cpp                  | 25 +++++++++++++------
 src/jsc/bindings/URLDecomposition.cpp         |  5 +++-
 .../node/url/url-domain-ascii-unicode.test.js |  5 ++++
 test/js/web/url/url.test.ts                   | 15 +++++++++++
 4 files changed, 42 insertions(+), 8 deletions(-)

diff --git a/src/jsc/bindings/BunIDNA.cpp b/src/jsc/bindings/BunIDNA.cpp
index 94aacbd42016..c98870ebd07c 100644
--- a/src/jsc/bindings/BunIDNA.cpp
+++ b/src/jsc/bindings/BunIDNA.cpp
@@ -4,6 +4,7 @@
 #include <unicode/uidna.h>
 #include <wtf/URL.h>
 #include <wtf/URLParser.h>
+#include <wtf/Vector.h>
 #include <wtf/text/StringView.h>
 #include <wtf/text/WTFString.h>
 
@@ -24,13 +25,23 @@ bool domainHasACELabel(WTF::StringView domain)
 
 WTF::String domainToASCII(WTF::StringView domain)
 {
-    std::array<char16_t, WTF::URLParser::hostnameBufferLength> buffer;
-    UErrorCode error = U_ZERO_ERROR;
-    UIDNAInfo processingDetails = UIDNA_INFO_INITIALIZER;
-    int32_t length = uidna_nameToASCII(&WTF::URLParser::internationalDomainNameTranscoder(), domain.upconvertedCharacters(), domain.length(), buffer.data(), WTF::URLParser::hostnameBufferLength, &processingDetails, &error);
-    if (U_SUCCESS(error) && !(processingDetails.errors & ~WTF::URLParser::allowedNameToASCIIErrors) && length > 0)
-        return WTF::String { std::span { buffer }.first(static_cast<size_t>(length)) };
-    return {};
+    std::array<char16_t, WTF::URLParser::hostnameBufferLength> stackBuffer;
+    WTF::Vector<char16_t> heapBuffer;
+    std::span<char16_t> buffer { stackBuffer };
+    while (true) {
+        UErrorCode error = U_ZERO_ERROR;
+        UIDNAInfo processingDetails = UIDNA_INFO_INITIALIZER;
+        int32_t length = uidna_nameToASCII(&WTF::URLParser::internationalDomainNameTranscoder(), domain.upconvertedCharacters(), domain.length(), buffer.data(), static_cast<int32_t>(buffer.size()), &processingDetails, &error);
+        if (U_SUCCESS(error) && !(processingDetails.errors & ~WTF::URLParser::allowedNameToASCIIErrors) && length > 0)
+            return WTF::String { buffer.first(static_cast<size_t>(length)) };
+        // ICU's preflight convention: on overflow, `length` is the required
+        // size. Retry once so a domain longer than the stack buffer (a host
+        // the spec places no length limit on) is not treated as invalid.
+        if (error != U_BUFFER_OVERFLOW_ERROR || length <= 0 || !heapBuffer.isEmpty())
+            return {};
+        heapBuffer.grow(static_cast<size_t>(length));
+        buffer = heapBuffer.mutableSpan();
+    }
 }
 
 bool urlHostIsValidIDNA(const WTF::URL& url)
diff --git a/src/jsc/bindings/URLDecomposition.cpp b/src/jsc/bindings/URLDecomposition.cpp
index 200530bb9eee..4f543221b4a3 100644
--- a/src/jsc/bindings/URLDecomposition.cpp
+++ b/src/jsc/bindings/URLDecomposition.cpp
@@ -25,6 +25,7 @@
 
 #include "URLDecomposition.h"
 
+#include "BunIDNA.h"
 #include <wtf/text/StringToIntegerConversion.h>
 
 namespace WebCore {
@@ -38,7 +39,9 @@ String URLDecomposition::origin() const
     if (fullURL.protocolIsBlob()) {
         const String& path = fullURL.path().toString();
         const URL subUrl { URL {}, path };
-        if (subUrl.isValid()) {
+        // An inner host with an invalid Punycode label makes this parse fail
+        // per the spec, which yields an opaque ("null") origin.
+        if (subUrl.isValid() && Bun::urlHostIsValidIDNA(subUrl)) {
             if (subUrl.protocolIsInHTTPFamily() or subUrl.protocolIsInFTPFamily() or subUrl.protocolIs("ws"_s) or subUrl.protocolIs("wss"_s) or subUrl.protocolIsFile())
                 return subUrl.protocolHostAndPort();
         }
diff --git a/test/js/node/url/url-domain-ascii-unicode.test.js b/test/js/node/url/url-domain-ascii-unicode.test.js
index 431bb331e864..bad9de40b8a3 100644
--- a/test/js/node/url/url-domain-ascii-unicode.test.js
+++ b/test/js/node/url/url-domain-ascii-unicode.test.js
@@ -117,4 +117,9 @@ describe("url.domainToASCII and invalid Punycode (xn--) labels", () => {
   test("a label that merely contains 'xn--' is not an ACE label", () => {
     expect(url.domainToASCII("axn--a-ecp.example")).toBe("axn--a-ecp.example");
   });
+  test("a domain with an ACE label longer than ICU's stack buffer still round-trips", () => {
+    // 3017 code units forces the U_BUFFER_OVERFLOW_ERROR retry in Bun::domainToASCII.
+    const domain = "xn--bcher-kva." + Buffer.alloc(3000, "a").toString() + ".de";
+    expect(url.domainToASCII(domain)).toBe(domain);
+  });
 });
diff --git a/test/js/web/url/url.test.ts b/test/js/web/url/url.test.ts
index 53c241ae1817..e452b9a4d88a 100755
--- a/test/js/web/url/url.test.ts
+++ b/test/js/web/url/url.test.ts
@@ -335,6 +335,21 @@ describe("url", () => {
       expect(new URL("foo://xn--a-ecp.example/").hostname).toBe("xn--a-ecp.example");
       expect(new URL("foo://XN--A-ECP.example/").hostname).toBe("XN--A-ECP.example");
     });
+
+    it("blob: origin re-parses the inner URL with the same host validation", () => {
+      // The origin of a blob: URL is the origin of its parsed path; an invalid
+      // inner host makes that parse fail, which yields an opaque ("null") origin.
+      expect(new URL("blob:http://xn--a-ecp.example/foo").origin).toBe("null");
+      expect(new URL("blob:http://xn--bcher-kva.de/foo").origin).toBe("http://xn--bcher-kva.de");
+      expect(new URL("blob:http://ok.example/foo").origin).toBe("http://ok.example");
+    });
+
+    it("a host with an ACE label longer than ICU's stack buffer still parses", () => {
+      // 3017 code units forces the U_BUFFER_OVERFLOW_ERROR retry in Bun::domainToASCII.
+      const host = "xn--bcher-kva." + Buffer.alloc(3000, "a").toString() + ".de";
+      expect(new URL(`http://${host}/`).hostname).toBe(host);
+      expect(URL.canParse(`http://${host}/`)).toBe(true);
+    });
   });
 });
 

From 4ae7db66b33722564e0a3a2584527ca6410e5554 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 28 Jul 2026 02:21:54 +0000
Subject: [PATCH 7/9] test: add ContextJ (xn--0ug) cases to the Punycode
 harness

---
 test/js/web/url/url.test.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/test/js/web/url/url.test.ts b/test/js/web/url/url.test.ts
index e452b9a4d88a..2cca3bb61232 100755
--- a/test/js/web/url/url.test.ts
+++ b/test/js/web/url/url.test.ts
@@ -270,12 +270,15 @@ describe("url", () => {
       "sub.xn--a-ecp.example",
       "XN--A-ECP.example",
       "xn--a-ecp.xn--fiqs8s",
+      // decodes to U+200D ZWJ: ICU UIDNA_ERROR_CONTEXTJ
+      "xn--0ug",
       // not decodable as Punycode at all
       "xn--pokxncvks",
       // empty ACE label
       "xn--",
       // percent-encoded "x": takes URLParser's percent-decoding slow path
       "%78n--a-ecp.example",
+      "%78n--0ug",
     ] as const;
 
     for (const scheme of ["http", "https", "ws", "wss", "ftp", "file"] as const) {

From f2101099e264a6625f034c83ad7d59a9d67259dc Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 28 Jul 2026 02:24:50 +0000
Subject: [PATCH 8/9] trim multi-line comments to single lines

---
 src/jsc/bindings/BunIDNA.cpp            |  8 +-------
 src/jsc/bindings/BunIDNA.h              | 12 +++---------
 src/jsc/bindings/DOMURL.cpp             |  3 ---
 src/jsc/bindings/NodeURL.cpp            |  2 --
 src/jsc/bindings/URLDecomposition.cpp   |  2 --
 src/jsc/bindings/bun_icu_decompress.cpp |  8 ++------
 6 files changed, 6 insertions(+), 29 deletions(-)

diff --git a/src/jsc/bindings/BunIDNA.cpp b/src/jsc/bindings/BunIDNA.cpp
index c98870ebd07c..577f32dac2c9 100644
--- a/src/jsc/bindings/BunIDNA.cpp
+++ b/src/jsc/bindings/BunIDNA.cpp
@@ -34,9 +34,7 @@ WTF::String domainToASCII(WTF::StringView domain)
         int32_t length = uidna_nameToASCII(&WTF::URLParser::internationalDomainNameTranscoder(), domain.upconvertedCharacters(), domain.length(), buffer.data(), static_cast<int32_t>(buffer.size()), &processingDetails, &error);
         if (U_SUCCESS(error) && !(processingDetails.errors & ~WTF::URLParser::allowedNameToASCIIErrors) && length > 0)
             return WTF::String { buffer.first(static_cast<size_t>(length)) };
-        // ICU's preflight convention: on overflow, `length` is the required
-        // size. Retry once so a domain longer than the stack buffer (a host
-        // the spec places no length limit on) is not treated as invalid.
+        // ICU preflight: on overflow `length` is the required size; retry once with a heap buffer.
         if (error != U_BUFFER_OVERFLOW_ERROR || length <= 0 || !heapBuffer.isEmpty())
             return {};
         heapBuffer.grow(static_cast<size_t>(length));
@@ -46,12 +44,8 @@ WTF::String domainToASCII(WTF::StringView domain)
 
 bool urlHostIsValidIDNA(const WTF::URL& url)
 {
-    // Only special-scheme URLs have a domain host; the host of every other
-    // scheme is opaque and the URL Standard does not apply IDNA to it.
     if (!url.hasSpecialScheme())
         return true;
-    // A parsed special host is already ASCII; UTS-46 "domain to ASCII" can
-    // only still fail on it when a label uses the Punycode "xn--" prefix.
     auto host = url.host();
     if (!domainHasACELabel(host))
         return true;
diff --git a/src/jsc/bindings/BunIDNA.h b/src/jsc/bindings/BunIDNA.h
index 982e1b3f68b3..e6154964cfcd 100644
--- a/src/jsc/bindings/BunIDNA.h
+++ b/src/jsc/bindings/BunIDNA.h
@@ -6,19 +6,13 @@
 
 namespace Bun {
 
-// Whether any dot-separated label of `domain` starts with the Punycode ACE
-// prefix "xn--" (ASCII case-insensitive). Those are the only all-ASCII
-// labels that UTS-46 "domain to ASCII" can reject.
+// Does any dot-separated label start with "xn--" (ASCII case-insensitive)?
 bool domainHasACELabel(WTF::StringView domain);
 
-// UTS-46 "domain to ASCII" with the URL Standard's options (beStrict = false):
-// https://url.spec.whatwg.org/#concept-domain-to-ascii
-// Returns a null String when `domain` is not a valid IDNA domain.
+// https://url.spec.whatwg.org/#concept-domain-to-ascii (beStrict = false); null on failure.
 WTF::String domainToASCII(WTF::StringView domain);
 
-// WTF::URLParser never runs UTS-46 on an all-ASCII host, so an "xn--" label
-// that does not decode to a valid IDNA label parses successfully. The URL
-// Standard's host parser requires that to fail; re-check such hosts here.
+// WTF::URLParser skips UTS-46 for all-ASCII hosts, so an invalid "xn--" label parses; re-check it here.
 bool urlHostIsValidIDNA(const WTF::URL&);
 
 } // namespace Bun
diff --git a/src/jsc/bindings/DOMURL.cpp b/src/jsc/bindings/DOMURL.cpp
index f775d8277268..e70054fb3004 100644
--- a/src/jsc/bindings/DOMURL.cpp
+++ b/src/jsc/bindings/DOMURL.cpp
@@ -56,9 +56,6 @@ static inline String redact(const String& input)
     return makeString('"', input, '"');
 }
 
-// WTF::URLParser skips UTS-46 validation for all-ASCII hosts, so "xn--"
-// (Punycode) labels that are not valid IDNA parse successfully; the URL
-// Standard's host parser requires them to fail. Re-check them here.
 static bool isValidCompleteURL(const URL& url)
 {
     return url.isValid() && Bun::urlHostIsValidIDNA(url);
diff --git a/src/jsc/bindings/NodeURL.cpp b/src/jsc/bindings/NodeURL.cpp
index 1a967ffea8d2..5e1bc78e66dd 100644
--- a/src/jsc/bindings/NodeURL.cpp
+++ b/src/jsc/bindings/NodeURL.cpp
@@ -51,8 +51,6 @@ JSC_DEFINE_HOST_FUNCTION(jsDomainToASCII, (JSC::JSGlobalObject * globalObject, J
     )
         return JSC::JSValue::encode(jsEmptyString(vm));
 
-    // An "xn--" (ACE) label must decode to a valid IDNA label, so it cannot
-    // take the ASCII fast path: https://url.spec.whatwg.org/#concept-domain-to-ascii
     if (domain.containsOnlyASCII() && !domainHasACELabel(domain))
         return JSC::JSValue::encode(arg0);
 
diff --git a/src/jsc/bindings/URLDecomposition.cpp b/src/jsc/bindings/URLDecomposition.cpp
index 4f543221b4a3..ac04439c5f88 100644
--- a/src/jsc/bindings/URLDecomposition.cpp
+++ b/src/jsc/bindings/URLDecomposition.cpp
@@ -39,8 +39,6 @@ String URLDecomposition::origin() const
     if (fullURL.protocolIsBlob()) {
         const String& path = fullURL.path().toString();
         const URL subUrl { URL {}, path };
-        // An inner host with an invalid Punycode label makes this parse fail
-        // per the spec, which yields an opaque ("null") origin.
         if (subUrl.isValid() && Bun::urlHostIsValidIDNA(subUrl)) {
             if (subUrl.protocolIsInHTTPFamily() or subUrl.protocolIsInFTPFamily() or subUrl.protocolIs("ws"_s) or subUrl.protocolIs("wss"_s) or subUrl.protocolIsFile())
                 return subUrl.protocolHostAndPort();
diff --git a/src/jsc/bindings/bun_icu_decompress.cpp b/src/jsc/bindings/bun_icu_decompress.cpp
index dd0cf9195774..a51b7f8e61a0 100644
--- a/src/jsc/bindings/bun_icu_decompress.cpp
+++ b/src/jsc/bindings/bun_icu_decompress.cpp
@@ -46,16 +46,12 @@ extern "C" __attribute__((weak)) const unsigned int bun_icu_zstd_dict_size;
 
 namespace Bun {
 
-// Replacement uts46.nrm carrying the Unicode 16.0 IdnaMappingTable (UTS #46
-// rev. 33) in Nrm2 format version 4, readable by the ICU 73/75 the prebuilts
-// bundle. Regenerate via scripts/regenerate-uts46-override.sh.
+// Unicode 16.0 uts46.nrm in Nrm2 format v4; regenerate via scripts/regenerate-uts46-override.sh.
 alignas(16) static constexpr uint8_t s_uts46Override[] = {
 #embed "icu_uts46_override.nrm"
 };
 
-// The bundled prebuilts' uts46.nrm predates Unicode 16.0, which reclassified
-// U+04C0, U+10A0..10C5, U+2132, U+2183 et al. from "disallowed" to "mapped".
-// Match by 48-byte prefix (DataHeader + first four Nrm2 indexes, unique per *.nrm).
+// Swap the bundled pre-Unicode-16.0 uts46.nrm for s_uts46Override, matched by its 48-byte DataHeader+indexes prefix.
 static const void* maybeOverrideUTS46(const void* p, int32_t* length)
 {
     // clang-format off

From 1d27a31e2f4643fed77421fb04d90dd495099ce5 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Tue, 28 Jul 2026 02:38:16 +0000
Subject: [PATCH 9/9] URLDecomposition: gate setHost/setHostname commit on
 urlHostIsValidIDNA directly

---
 src/jsc/bindings/URLDecomposition.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/jsc/bindings/URLDecomposition.cpp b/src/jsc/bindings/URLDecomposition.cpp
index ac04439c5f88..f85352e328d2 100644
--- a/src/jsc/bindings/URLDecomposition.cpp
+++ b/src/jsc/bindings/URLDecomposition.cpp
@@ -137,7 +137,7 @@ void URLDecomposition::setHost(StringView value)
                 fullURL.setHostAndPort(value.left(separator + 1 + portLength));
         }
     }
-    if (fullURL.isValid())
+    if (fullURL.isValid() && Bun::urlHostIsValidIDNA(fullURL))
         setFullURL(fullURL);
 }
 
@@ -154,7 +154,7 @@ void URLDecomposition::setHostname(StringView host)
     if (fullURL.hasOpaquePath())
         return;
     fullURL.setHost(host);
-    if (fullURL.isValid())
+    if (fullURL.isValid() && Bun::urlHostIsValidIDNA(fullURL))
         setFullURL(fullURL);
 }