@demiurgejs/core 0.0.0 → 0.1.1

package/dist/index.js

@@ -0,0 +1,1328 @@
+import { jsx as H } from "react/jsx-runtime";
+import { createContext as W, useState as I, useRef as k, useEffect as C, useMemo as _, createElement as f, useContext as V, Component as G } from "react";
+import { e as K, H as Y, f as Z } from "./chunks/ssr-BJejKlkZ.js";
+import { r as pr } from "./chunks/ssr-BJejKlkZ.js";
+import { g as Q, t as X, p as D, s as J, i as ee, c as P, l as te, j as L, k as re, N as z, m as ne, n as ae, o as ie, q as oe, H as se, u as ce, B as ue, v as le, w as fe, x as de, y as he, z as me, R as pe, A } from "./chunks/testing-DR3eQAvY.js";
+import { C as wr, D as yr, E as vr, F as br, G as Sr, I as Er, J as Rr, K as $r, b as xr, L as Ar, d as Tr, M as Ir, O as kr, P as Cr, Q as Dr, S as zr, T as Or, U as Pr, V as Lr, W as Nr, X as Ur, h as Mr, Y as Fr, Z as jr, _ as qr, $ as Br, a0 as Hr, a1 as Wr, a2 as _r, a3 as Vr, a4 as Gr, a5 as Kr, a6 as Yr, a7 as Zr, a8 as Qr, a9 as Xr, aa as Jr, ab as en, ac as tn, ad as rn, ae as nn, af as an, ag as on, ah as sn, ai as cn, aj as un, ak as ln, al as fn, am as dn, an as hn, ao as mn, ap as pn } from "./chunks/testing-DR3eQAvY.js";
+import { a as wn, c as yn, d as vn } from "./chunks/index-BnX9Qxbm.js";
+import "react-dom/server";
+function Ut(e) {
+  return {
+    entries: e
+  };
+}
+function Mt(e) {
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    `<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"${e.entries.some((r) => r.alternates?.length) ? ' xmlns:xhtml="http://www.w3.org/1999/xhtml"' : ""}>`,
+    ...e.entries.map(we),
+    "</urlset>",
+    ""
+  ].join(`
+`);
+}
+function Ft(e) {
+  return e;
+}
+function jt(e) {
+  return e;
+}
+function qt(e) {
+  const t = [];
+  for (const r of e.rules ?? []) {
+    for (const n of b(r.userAgent))
+      t.push(`User-agent: ${n}`);
+    for (const n of b(r.allow))
+      t.push(`Allow: ${n}`);
+    for (const n of b(r.disallow))
+      t.push(`Disallow: ${n}`);
+    t.push("");
+  }
+  e.host && t.push(`Host: ${e.host}`);
+  for (const r of b(e.sitemap))
+    t.push(`Sitemap: ${r}`);
+  return `${t.join(`
+`).replace(/\n+$/, "")}
+`;
+}
+function ge(e) {
+  const t = e.width ?? 1200, r = e.height ?? 630, n = e.background ?? "#101820", a = e.foreground ?? "#ffffff", i = $(e.title, 120), s = e.subtitle ? $(e.subtitle, 160) : void 0, o = e.brand ? $(e.brand, 80) : void 0;
+  return be(t, r), [
+    `<svg xmlns="http://www.w3.org/2000/svg" width="${t}" height="${r}" viewBox="0 0 ${t} ${r}" role="img" aria-label="${p(i)}">`,
+    `  <rect width="100%" height="100%" fill="${p(n)}" />`,
+    o ? `  <text x="72" y="96" fill="${p(a)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="32" font-weight="700">${w(o)}</text>` : null,
+    `  <text x="72" y="${s ? 300 : 340}" fill="${p(a)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="76" font-weight="800">${w(i)}</text>`,
+    s ? `  <text x="72" y="392" fill="${p(a)}" fill-opacity="0.78" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="38" font-weight="500">${w(s)}</text>` : null,
+    "</svg>"
+  ].filter((u) => !!u).join(`
+`);
+}
+function Bt(e) {
+  return new Response(ge(e), {
+    headers: {
+      "cache-control": "public, max-age=31536000, immutable",
+      "content-type": "image/svg+xml; charset=utf-8"
+    }
+  });
+}
+function we(e) {
+  return [
+    "  <url>",
+    `    <loc>${w(e.url)}</loc>`,
+    e.lastModified ? `    <lastmod>${w(ye(e.lastModified))}</lastmod>` : null,
+    e.changeFrequency ? `    <changefreq>${e.changeFrequency}</changefreq>` : null,
+    e.priority !== void 0 ? `    <priority>${ve(e.priority)}</priority>` : null,
+    ...(e.alternates ?? []).map(
+      (t) => `    <xhtml:link rel="alternate" hreflang="${p(t.hrefLang)}" href="${p(t.href)}" />`
+    ),
+    "  </url>"
+  ].filter((t) => !!t).join(`
+`);
+}
+function ye(e) {
+  return e instanceof Date ? e.toISOString() : e;
+}
+function ve(e) {
+  if (e < 0 || e > 1)
+    throw new Error("Sitemap entry priority must be between 0 and 1.");
+  return String(e);
+}
+function b(e) {
+  return e === void 0 ? [] : Array.isArray(e) ? e : [e];
+}
+function w(e) {
+  return e.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+function p(e) {
+  return w(e).replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+}
+function $(e, t) {
+  return e.length > t ? `${e.slice(0, t - 3)}...` : e;
+}
+function be(e, t) {
+  if (!Number.isSafeInteger(e) || e <= 0)
+    throw new Error("OG image width must be a positive integer.");
+  if (!Number.isSafeInteger(t) || t <= 0)
+    throw new Error("OG image height must be a positive integer.");
+}
+function Ht(e) {
+  return Q(
+    async (t) => {
+      const r = e.input ? await e.input(t) : void 0, n = {
+        ...t,
+        input: r
+      }, a = async () => await Se(
+        await e.handler(n),
+        t
+      );
+      if (!e.idempotency)
+        return await a();
+      const i = typeof e.idempotency.key == "function" ? e.idempotency.key(n) : e.idempotency.key;
+      return (await e.idempotency.store.run({
+        fn: a,
+        key: i,
+        ttl: e.idempotency.ttl
+      })).value;
+    },
+    {
+      cors: e.cors,
+      security: e.security,
+      timing: e.timing
+    }
+  );
+}
+const Wt = {
+  async formData({ request: e }) {
+    return await e.formData();
+  },
+  async json({ request: e }) {
+    return await e.json();
+  },
+  async text({ request: e }) {
+    return await e.text();
+  }
+};
+async function Se(e, t) {
+  return e instanceof Response ? e : await X(e, t);
+}
+function _t(e) {
+  return typeof e == "function" ? {
+    kind: "page",
+    render: { mode: "ssr" },
+    view: e
+  } : {
+    data: e.data,
+    kind: "page",
+    layout: e.layout,
+    render: e.render ?? { mode: "ssr" },
+    view: e.view
+  };
+}
+const Vt = {
+  hmac(e) {
+    return {
+      kind: "response",
+      response: async (t) => {
+        const r = new Uint8Array(await t.request.arrayBuffer()), n = t.request.headers.get(
+          e.header ?? "x-webhook-signature"
+        );
+        return n ? await Ee(r, n, e) ? await e.handler({
+          ...t,
+          rawBody: r,
+          text: () => new TextDecoder().decode(r)
+        }) : new Response("Invalid webhook signature.", {
+          status: 401
+        }) : new Response("Missing webhook signature.", {
+          status: 401
+        });
+      },
+      security: {
+        csrf: !1
+      }
+    };
+  }
+};
+async function Ee(e, t, r) {
+  const n = r.algorithm ?? "SHA-256", a = r.encoding ?? "hex", i = Re(
+    t,
+    n,
+    r.prefix
+  ), s = $e(i, a);
+  if (!s)
+    return !1;
+  const o = await globalThis.crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(r.secret),
+    {
+      hash: n,
+      name: "HMAC"
+    },
+    !1,
+    ["verify"]
+  );
+  return await globalThis.crypto.subtle.verify(
+    "HMAC",
+    o,
+    s,
+    Uint8Array.from(e).buffer
+  );
+}
+function Re(e, t, r) {
+  const n = e.trim(), a = r === void 0 ? `${t.toLowerCase().replace("-", "")}=` : r;
+  return a !== !1 && n.startsWith(a) ? n.slice(a.length).trim() : n;
+}
+function $e(e, t) {
+  if (t === "hex")
+    return /^(?:[0-9a-f]{2})+$/i.test(e) ? Uint8Array.from(
+      e.match(/.{2}/g) ?? [],
+      (r) => Number.parseInt(r, 16)
+    ) : null;
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(
+    e
+  ))
+    return null;
+  try {
+    const r = typeof atob == "function" ? atob(e) : Buffer.from(e, "base64").toString("binary");
+    return Uint8Array.from(r, (n) => n.charCodeAt(0));
+  } catch {
+    return null;
+  }
+}
+const xe = "24h", Ae = 1e4;
+function Gt(e = {}) {
+  const t = e.now ?? Date.now, r = e.defaultTtl ?? xe, n = e.maximumEntries ?? Ae;
+  if (!Number.isSafeInteger(n) || n <= 0)
+    throw new Error(
+      "Demiurge idempotency maximumEntries must be a positive integer."
+    );
+  const a = D(r);
+  if (!Number.isFinite(a))
+    throw new Error("Demiurge idempotency defaultTtl must be finite.");
+  const i = /* @__PURE__ */ new Map();
+  return {
+    async run(s) {
+      const o = J(s.key), u = t();
+      Te(i, u);
+      const d = i.get(o);
+      if (d && (d.pending || d.expiresAt > u))
+        return {
+          key: o,
+          replayed: !0,
+          value: await d.value
+        };
+      if (i.size >= n && Ie(i), i.size >= n)
+        throw new Error(
+          "Demiurge idempotency store is at capacity with in-flight mutations."
+        );
+      const g = Promise.resolve().then(s.fn), c = {
+        expiresAt: Number.POSITIVE_INFINITY,
+        pending: !0,
+        value: g
+      };
+      i.set(o, c);
+      try {
+        const l = await g;
+        return c.pending = !1, c.expiresAt = t() + D(s.ttl ?? r), {
+          key: o,
+          replayed: !1,
+          value: l
+        };
+      } catch (l) {
+        throw i.get(o) === c && i.delete(o), l;
+      }
+    }
+  };
+}
+function Te(e, t) {
+  for (const [r, n] of e)
+    !n.pending && n.expiresAt <= t && e.delete(r);
+}
+function Ie(e) {
+  for (const [t, r] of e)
+    if (!r.pending) {
+      e.delete(t);
+      return;
+    }
+}
+function Kt(e, t) {
+  return e.run(t);
+}
+function ke(e) {
+  const t = P(e.routes), r = e.loadNavigationData ?? U;
+  return function() {
+    const [a, i] = I(() => S()), [s, o] = I(
+      () => e.initialMatch ?? { status: "loading" }
+    ), u = k(!!e.initialMatch), d = k(0);
+    C(() => {
+      function c() {
+        i(S());
+      }
+      return window.addEventListener("popstate", c), () => window.removeEventListener("popstate", c);
+    }, []), C(() => {
+      let c = !1, l = !1;
+      const h = ++d.current, R = new AbortController(), v = () => !c && h === d.current;
+      if (u.current && De(e.initialMatch) === a.pathname)
+        return u.current = !1, () => {
+          c = !0;
+        };
+      o({ status: "loading" }), te(t, a.pathname).then((m) => {
+        v() && !l && m && o({ loading: m, status: "loading" });
+      }).catch(() => {
+      });
+      const T = new Request(a.href, { signal: R.signal });
+      return Promise.resolve(r(T)).then(
+        (m) => L(
+          t,
+          a.pathname,
+          T,
+          m,
+          void 0,
+          { documentContributions: !1 }
+        )
+      ).then((m) => {
+        l = !0, v() && o(m);
+      }).catch(async (m) => {
+        if (l = !0, !v() || R.signal.aborted)
+          return;
+        const B = await re(
+          t,
+          a.pathname
+        );
+        v() && o({
+          Error: B,
+          error: m,
+          pathname: a.pathname,
+          status: "error"
+        });
+      }), () => {
+        c = !0, R.abort();
+      };
+    }, [a.pathname, a.search]);
+    const g = _(
+      () => ({
+        navigation: e.navigation ?? "server",
+        push(c) {
+          const l = S();
+          window.history.pushState(null, "", c);
+          const h = S();
+          i(h), l.pathname === h.pathname && l.search === h.search && l.hash !== h.hash && Ne(h.hash);
+        }
+      }),
+      []
+    );
+    return f(M.Provider, {
+      value: g,
+      children: f(Oe, {
+        key: `${a.pathname}${a.search}`,
+        Loading: e.loading,
+        NotFound: e.notFound,
+        match: s
+      })
+    });
+  };
+}
+function Ce(e, t) {
+  const r = t.getAttribute(Z);
+  return e.status === "not-found" ? r === "not-found" : e.status === "ready" && r === null;
+}
+function De(e) {
+  if (e)
+    return e.status === "ready" ? e.match.pathname : e.status === "loading" ? void 0 : e.pathname;
+}
+async function Yt(e) {
+  const t = e.root ?? document.getElementById("root");
+  if (!t)
+    throw new Error(
+      "Demiurge expected a #root element in the framework document."
+    );
+  const r = P(e.routes), n = e.loadNavigationData ?? U, a = e.initialData ?? K(document), i = await L(
+    r,
+    window.location.pathname,
+    new Request(window.location.href),
+    a ?? await n(new Request(window.location.href)),
+    void 0,
+    { documentContributions: !1 }
+  ), s = Ce(i, t), o = ke(
+    s ? {
+      ...e,
+      initialMatch: i,
+      loadNavigationData: n,
+      navigation: a?.navigation ?? e.navigation
+    } : {
+      ...e,
+      loadNavigationData: n,
+      navigation: a?.navigation ?? e.navigation
+    }
+  ), { createRoot: u, hydrateRoot: d } = ze(
+    await import("react-dom/client")
+  );
+  if (s && t.hasAttribute(Y)) {
+    d(t, f(o));
+    return;
+  }
+  t.replaceChildren(), u(t).render(f(o));
+}
+function ze(e) {
+  const t = typeof e.createRoot == "function" && typeof e.hydrateRoot == "function" ? e : e.default;
+  if (!t || typeof t.createRoot != "function" || typeof t.hydrateRoot != "function")
+    throw new Error(
+      "Demiurge could not load the React DOM client from the Vite module."
+    );
+  return t;
+}
+function Zt(e) {
+  const t = Me(), r = ee(e);
+  return /* @__PURE__ */ H(
+    "a",
+    {
+      className: e.className,
+      href: r,
+      onClick: (n) => {
+        t.navigation === "server" && Ue(n) && (n.preventDefault(), t.push(r));
+      },
+      children: e.children
+    }
+  );
+}
+function Oe({
+  Loading: e,
+  NotFound: t,
+  match: r
+}) {
+  if (r.status === "loading") {
+    const c = r.loading ?? e;
+    return c ? f(c) : null;
+  }
+  if (r.status === "not-found") {
+    const c = r.notFound ?? t ?? ue;
+    return r.layouts.reduceRight(
+      (l, h) => f(h, {
+        children: l,
+        path: {},
+        pathname: r.pathname
+      }),
+      f(c, { pathname: r.pathname })
+    );
+  }
+  if (r.status === "error")
+    return r.Error ? f(r.Error, {
+      error: r.error,
+      pathname: r.pathname,
+      status: N(r.error)
+    }) : null;
+  const { data: n, error: a, page: i, layouts: s, path: o, pathname: u } = r.match, d = f(i, { data: n, path: o, pathname: u }), g = s.reduceRight(
+    (c, l) => f(l, { path: o, pathname: u, children: c }),
+    d
+  );
+  return f(Pe, {
+    Error: a,
+    children: g,
+    pathname: u
+  });
+}
+class Pe extends G {
+  static getDerivedStateFromError(t) {
+    return { error: t };
+  }
+  state = {};
+  componentDidUpdate(t) {
+    this.state.error !== void 0 && t.pathname !== this.props.pathname && this.setState({ error: void 0 });
+  }
+  render() {
+    return this.state.error !== void 0 ? this.props.Error ? f(this.props.Error, {
+      error: this.state.error,
+      pathname: this.props.pathname,
+      status: N(this.state.error)
+    }) : null : this.props.children;
+  }
+}
+function N(e) {
+  return le(e) ? e.status : 500;
+}
+function S() {
+  return {
+    hash: window.location.hash,
+    href: window.location.href,
+    pathname: window.location.pathname,
+    search: window.location.search
+  };
+}
+async function U(e) {
+  const t = new Headers(e.headers);
+  t.set("accept", "application/json"), t.set(z, ne);
+  const r = await fetch(new Request(e, {
+    credentials: "same-origin",
+    headers: t
+  })), n = r.headers.get(z);
+  if (n === ae) {
+    const a = await r.json();
+    if (a.hasData !== !0)
+      throw new Error("Demiurge received malformed navigation route data.");
+    return { data: a.data, hasData: !0 };
+  }
+  if (n === ie)
+    return { hasData: !0 };
+  if (n === oe || !r.ok) {
+    const a = await Le(r), i = se.includes(
+      r.status
+    ) ? r.status : 500;
+    throw ce(i, {
+      detail: typeof a?.detail == "string" ? a.detail : void 0,
+      title: typeof a?.title == "string" ? a.title : void 0
+    });
+  }
+  throw new Error(
+    "Demiurge expected a navigation data response from the application server."
+  );
+}
+async function Le(e) {
+  try {
+    return await e.json();
+  } catch {
+    return;
+  }
+}
+function Ne(e) {
+  queueMicrotask(() => {
+    if (!e) {
+      window.scrollTo?.(0, 0);
+      return;
+    }
+    let t;
+    try {
+      t = decodeURIComponent(e.slice(1));
+    } catch {
+      t = e.slice(1);
+    }
+    document.getElementById(t)?.scrollIntoView?.();
+  });
+}
+function Ue(e) {
+  return e.button === 0 && !e.metaKey && !e.altKey && !e.ctrlKey && !e.shiftKey;
+}
+const M = W({
+  navigation: "document",
+  push(e) {
+    window.location.href = e;
+  }
+});
+function Me() {
+  return V(M);
+}
+const Fe = "/_demiurge/image";
+function Qt(e) {
+  return e;
+}
+function Xt(e, t = {}) {
+  return F(e, t) !== null;
+}
+function Jt(e, t = {}) {
+  const r = F(e.src, t);
+  if (!r)
+    throw new Error(`Image source "${e.src}" is not allowed by the image policy.`);
+  x("width", e.width), x("height", e.height), We(e.quality);
+  const n = e.format ?? "auto", i = _e(e.width, e.widths).map((o) => {
+    const u = Math.round(e.height / e.width * o);
+    return {
+      format: n,
+      height: u,
+      src: Ve({
+        format: n,
+        optimizerPath: t.optimizerPath ?? Fe,
+        quality: e.quality,
+        src: e.src,
+        width: o
+      }),
+      width: o
+    };
+  }), s = i[0];
+  return {
+    alt: e.alt,
+    decoding: "async",
+    fetchPriority: e.priority ? "high" : void 0,
+    height: e.height,
+    loading: e.priority ? "eager" : "lazy",
+    sizes: e.sizes,
+    source: r,
+    src: s.src,
+    srcSet: i.map((o) => `${o.src} ${o.width}w`).join(", "),
+    variants: i,
+    width: e.width
+  };
+}
+function F(e, t) {
+  if (e.startsWith("/") && !e.startsWith("//"))
+    return t.local === !1 ? null : { kind: "local", src: e };
+  let r;
+  try {
+    r = new URL(e);
+  } catch {
+    return null;
+  }
+  return r.protocol !== "https:" && r.protocol !== "http:" ? null : je(r, t.remote ?? []) ? { kind: "remote", src: r.toString() } : null;
+}
+function je(e, t) {
+  return t.some(
+    (r) => typeof r == "string" ? qe(e, r) : Be(e, r)
+  );
+}
+function qe(e, t) {
+  try {
+    return e.origin === new URL(t).origin;
+  } catch {
+    return !1;
+  }
+}
+function Be(e, t) {
+  return t.protocol && e.protocol !== t.protocol || e.hostname !== t.hostname || t.port !== void 0 && e.port !== t.port ? !1 : t.pathname ? He(e.pathname, t.pathname) : !0;
+}
+function He(e, t) {
+  return t.endsWith("*") ? e.startsWith(t.slice(0, -1)) : e === t;
+}
+function x(e, t) {
+  if (!Number.isInteger(t) || t <= 0)
+    throw new Error(`Image ${e} must be a positive integer.`);
+}
+function We(e) {
+  if (e !== void 0 && (!Number.isInteger(e) || e < 1 || e > 100))
+    throw new Error("Image quality must be an integer between 1 and 100.");
+}
+function _e(e, t) {
+  const r = t ?? [e, e * 2], n = [...new Set(r)];
+  for (const a of n)
+    x("width", a);
+  return n.sort((a, i) => a - i);
+}
+function Ve({
+  format: e,
+  optimizerPath: t,
+  quality: r,
+  src: n,
+  width: a
+}) {
+  const i = new URLSearchParams({
+    src: n,
+    w: String(a)
+  });
+  return r !== void 0 && i.set("q", String(r)), e !== "auto" && i.set("f", e), `${t}?${i.toString()}`;
+}
+const er = {
+  google(e) {
+    return {
+      display: e.display ?? "swap",
+      family: e.family,
+      kind: "font",
+      source: "google",
+      src: e.src,
+      style: e.style ?? "normal",
+      weight: e.weight ?? 400
+    };
+  },
+  local(e) {
+    if (!e.src.trim())
+      throw new Error("Local font source must not be empty.");
+    return {
+      display: e.display ?? "swap",
+      family: e.name,
+      kind: "font",
+      source: "local",
+      src: e.src,
+      style: e.style ?? "normal",
+      weight: e.weight ?? 400
+    };
+  }
+};
+function tr(e) {
+  return [...e];
+}
+function rr(e) {
+  return e.filter((t) => t.src).map((t) => ({
+    as: "font",
+    crossOrigin: "anonymous",
+    href: t.src,
+    kind: "link",
+    rel: "preload",
+    type: Ge(t.src)
+  }));
+}
+function nr(e) {
+  return e.filter((t) => t.source === "local" && t.src).map((t) => {
+    const r = t.src;
+    return [
+      "@font-face {",
+      `  font-family: "${O(t.family)}";`,
+      `  src: url("${O(r)}") format("${Ke(r)}");`,
+      `  font-style: ${t.style};`,
+      `  font-weight: ${t.weight};`,
+      `  font-display: ${t.display};`,
+      "}"
+    ].join(`
+`);
+  }).join(`
+`);
+}
+function Ge(e) {
+  return e.split("?")[0].split("#")[0].split(".").pop()?.toLowerCase() === "woff" ? "font/woff" : "font/woff2";
+}
+function Ke(e) {
+  return e.split("?")[0].split("#")[0].split(".").pop()?.toLowerCase() === "woff" ? "woff" : "woff2";
+}
+function O(e) {
+  return e.replace(/[\\"]/g, "\\$&");
+}
+const ar = {
+  plausible(e) {
+    const t = Ye(e.domain), r = Ze(e.endpoint ?? "https://plausible.io");
+    return {
+      connectSrc: r.origin,
+      consent: e.consent ?? !1,
+      domain: t,
+      kind: "analytics",
+      provider: "plausible",
+      script: fe({
+        dataApi: `${r.origin}/api/event`,
+        dataDomain: t,
+        purpose: "analytics",
+        src: `${r.origin}/js/script.js`,
+        strategy: e.strategy ?? "afterInteractive"
+      })
+    };
+  }
+};
+function Ye(e) {
+  const t = e.trim();
+  if (!t || t.includes("/") || t.includes(" "))
+    throw new Error("Analytics domain must be a hostname without a path.");
+  return t;
+}
+function Ze(e) {
+  let t;
+  try {
+    t = new URL(e);
+  } catch {
+    throw new Error("Analytics endpoint must be an absolute URL.");
+  }
+  if (t.protocol !== "https:")
+    throw new Error("Analytics endpoint must use HTTPS.");
+  return t;
+}
+function ir(e = {}) {
+  return {
+    async request(t) {
+      await E({ kind: "request", signal: t }, e);
+    },
+    async serverStart(t = {}) {
+      await E({ kind: "server-start", signal: t }, e);
+    },
+    async trace(t) {
+      await E({ kind: "trace", signal: t }, e);
+    },
+    async reportWebVitals(t) {
+      await E({ kind: "web-vital", signal: t }, e);
+    }
+  };
+}
+async function E(e, t) {
+  await t.onEvent?.(e), e.kind === "request" ? await t.request?.(e.signal) : e.kind === "server-start" ? await t.serverStart?.(e.signal) : e.kind === "trace" ? await t.trace?.(e.signal) : await t.webVitals?.(e.signal);
+}
+const Qe = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]);
+function or(e = {}) {
+  const t = [], r = e.document, n = r ? et(r.policy, r.headers, t) : {};
+  r && Xe(r.policy, t);
+  const a = e.route ? ct(e.route, t) : void 0;
+  return r?.scripts && (tt(
+    r.policy.csp,
+    r.scripts,
+    r.headers,
+    t
+  ), r.scriptDependencies && t.push(
+    ...Je(
+      r.scripts,
+      rt(r.scriptDependencies)
+    )
+  )), {
+    findings: t,
+    headers: n,
+    route: a
+  };
+}
+function Xe(e, t) {
+  if (!e.trustedTypes || e.trustedTypes.mode !== "report-only")
+    return;
+  const r = e.csp || void 0, n = !!r?.reportUri?.length, a = e.headers?.reportingEndpoints, i = !!(r?.reportTo && a && a[r.reportTo]);
+  !n && !i && t.push({
+    code: "report-only-target-missing",
+    message: "Trusted Types report-only mode has no deliverable target. Configure CSP reportTo with a matching Reporting-Endpoints member, reportUri for compatibility, or both.",
+    severity: "warning"
+  });
+}
+function Je(e, t = {}) {
+  const r = t.requirePurpose ?? !0, n = [];
+  for (const a of e) {
+    const i = ft(a);
+    i && (r && !a.purpose && n.push({
+      code: "script-purpose-missing",
+      message: `Third-party script ${a.src} should declare a purpose for audits and consent flows.`,
+      severity: "warning"
+    }), t.requireIntegrity && !a.integrity && n.push({
+      code: "script-integrity-missing",
+      message: `Third-party script ${a.src} should declare an integrity hash or an explicit trust-boundary exception.`,
+      severity: "warning"
+    }), a.strategy === "beforeInteractive" && !t.allowBeforeInteractiveThirdParty && n.push({
+      code: "script-third-party-before-interactive",
+      message: `Third-party script ${a.src} runs before the app is interactive and should be justified by policy.`,
+      severity: "warning"
+    }), dt(i) && n.push({
+      code: "script-gtm-wide-trust-boundary",
+      message: "Google Tag Manager can load additional scripts at runtime and should be treated as a wide trust boundary.",
+      severity: "warning"
+    }));
+  }
+  return n;
+}
+function et(e, t, r) {
+  try {
+    return Object.fromEntries(de(e, t));
+  } catch (n) {
+    return r.push({
+      code: "security-header-render-failed",
+      message: n instanceof Error ? n.message : "Security headers failed to render.",
+      severity: "error"
+    }), {};
+  }
+}
+function tt(e, t, r, n) {
+  if (!e)
+    return;
+  const a = nt(e);
+  for (const i of t) {
+    if (at(a) && !i.nonce) {
+      n.push({
+        code: "csp-script-missing-nonce",
+        message: `Document script ${i.src} needs a nonce for the effective script-src policy.`,
+        severity: "error"
+      });
+      continue;
+    }
+    i.nonce && r?.nonce && i.nonce === r.nonce || it(a, i.src) || n.push({
+      code: "csp-script-src-blocked",
+      message: `Document script ${i.src} is not allowed by the effective script-src policy.`,
+      severity: "error"
+    });
+  }
+}
+function rt(e) {
+  return typeof e == "boolean" ? {} : e;
+}
+function nt(e) {
+  return e.scriptSrc ?? e.defaultSrc ?? [];
+}
+function at(e) {
+  return e.some((t) => t.includes("'nonce-{nonce}'"));
+}
+function it(e, t) {
+  return e.includes("*") ? !0 : e.includes("'none'") || e.some((r) => r.startsWith("'nonce-")) ? !1 : e.includes("'self'") && ot(t) || t.startsWith("https:") && e.includes("https:") || t.startsWith("http:") && e.includes("http:") ? !0 : e.some((r) => st(r, t));
+}
+function ot(e) {
+  return e.startsWith("/") && !e.startsWith("//");
+}
+function st(e, t) {
+  if (e.startsWith("'"))
+    return !1;
+  try {
+    const r = new URL(e), n = new URL(t);
+    return n.protocol === r.protocol && n.hostname === r.hostname && n.port === r.port && (r.pathname === "/" || n.pathname.startsWith(r.pathname));
+  } catch {
+    return !1;
+  }
+}
+function ct(e, t) {
+  return ut(e.cors, t), lt(e.method, e.security, t), {
+    cors: e.cors,
+    method: e.method,
+    security: e.security
+  };
+}
+function ut(e, t) {
+  if (e)
+    try {
+      he(e);
+    } catch (r) {
+      t.push({
+        code: "cors-invalid",
+        message: r instanceof Error ? r.message : "CORS policy is invalid.",
+        severity: "error"
+      });
+    }
+}
+function lt(e, t, r) {
+  Qe.has(e) && (t?.csrf === !1 && r.push({
+    code: "csrf-disabled",
+    message: "CSRF protection is explicitly disabled for this unsafe route.",
+    severity: "info"
+  }), t?.rateLimit || r.push({
+    code: "rate-limit-missing",
+    message: "Unsafe routes should declare rate limiting.",
+    severity: "warning"
+  }), t?.request?.maxBodySize || r.push({
+    code: "request-body-limit-missing",
+    message: "Unsafe routes should declare a request body size limit.",
+    severity: "warning"
+  }));
+}
+function ft(e) {
+  try {
+    const t = new URL(e.src);
+    if (t.protocol === "http:" || t.protocol === "https:")
+      return t;
+  } catch {
+    return null;
+  }
+  return null;
+}
+function dt(e) {
+  return e.hostname === "www.googletagmanager.com" && (e.pathname === "/gtm.js" || e.pathname === "/ns.html");
+}
+class ht extends Error {
+  issues;
+  constructor(t) {
+    super(bt(t)), this.name = "EnvValidationError", this.issues = t;
+  }
+}
+function sr(e) {
+  return e;
+}
+function cr(e, t) {
+  const r = [], n = {};
+  for (const a of Object.keys(e)) {
+    const i = e[a], s = t[String(a)];
+    if (s === void 0 || s === "") {
+      if (i.optional) {
+        n[a] = void 0;
+        continue;
+      }
+      r.push({
+        code: "missing",
+        key: String(a),
+        message: `Environment variable ${String(a)} is required.`
+      });
+      continue;
+    }
+    try {
+      n[a] = i.parse(String(a), s);
+    } catch (o) {
+      r.push({
+        code: "invalid",
+        key: String(a),
+        message: o instanceof Error ? o.message : `Environment variable ${String(a)} is invalid.`
+      });
+    }
+  }
+  if (r.length)
+    throw new ht(r);
+  return n;
+}
+function mt(e = {}) {
+  return y(e, !1, (t, r) => {
+    if (r === "true" || r === "1")
+      return !0;
+    if (r === "false" || r === "0")
+      return !1;
+    throw new Error(`Environment variable ${t} must be true, false, 1, or 0.`);
+  });
+}
+function pt(e, t = {}) {
+  return y(t, !1, (r, n) => {
+    if (e.includes(n))
+      return n;
+    throw new Error(
+      `Environment variable ${r} must be one of: ${e.join(", ")}.`
+    );
+  });
+}
+function gt(e = {}) {
+  return y(e, !1, (t, r) => {
+    if (!/^-?\d+$/.test(r))
+      throw new Error(`Environment variable ${t} must be an integer.`);
+    const n = Number(r);
+    if (!Number.isSafeInteger(n))
+      throw new Error(`Environment variable ${t} must be a safe integer.`);
+    if (e.min !== void 0 && n < e.min)
+      throw new Error(
+        `Environment variable ${t} must be greater than or equal to ${e.min}.`
+      );
+    if (e.max !== void 0 && n > e.max)
+      throw new Error(
+        `Environment variable ${t} must be less than or equal to ${e.max}.`
+      );
+    return n;
+  });
+}
+function wt(e = {}) {
+  return y(
+    e,
+    !0,
+    (t, r) => j(t, r, e)
+  );
+}
+function yt(e = {}) {
+  return y(
+    e,
+    !1,
+    (t, r) => j(t, r, e)
+  );
+}
+function vt(e = {}) {
+  return y(e, !1, (t, r) => {
+    let n;
+    try {
+      n = new URL(r);
+    } catch {
+      throw new Error(`Environment variable ${t} must be a valid URL.`);
+    }
+    if (e.protocols?.length && !e.protocols.includes(n.protocol))
+      throw new Error(
+        `Environment variable ${t} must use one of these protocols: ${e.protocols.join(", ")}.`
+      );
+    return n;
+  });
+}
+const ur = {
+  boolean: mt,
+  enum: pt,
+  integer: gt,
+  secret: wt,
+  string: yt,
+  url: vt
+};
+function y(e, t, r) {
+  return {
+    optional: e.optional ?? !1,
+    parse: r,
+    sensitive: t
+  };
+}
+function j(e, t, r) {
+  if (r.minLength !== void 0 && t.length < r.minLength)
+    throw new Error(
+      `Environment variable ${e} must be at least ${r.minLength} characters.`
+    );
+  return t;
+}
+function bt(e) {
+  return e.length === 1 ? e[0].message : `Environment validation failed with ${e.length} issues.`;
+}
+function lr(e = {}) {
+  return async function(r) {
+    if (r.method.toUpperCase() !== "POST")
+      return new Response(null, {
+        headers: {
+          allow: "POST"
+        },
+        status: 405
+      });
+    const n = Et(r);
+    if (n)
+      return n;
+    const a = Rt(e, r);
+    if (a)
+      return a;
+    e.maxBodySize !== void 0 && (r = me({ maxBodySize: e.maxBodySize }, r));
+    let i;
+    try {
+      i = await r.json();
+    } catch (o) {
+      return o instanceof pe ? new Response("Security report body too large.", { status: 413 }) : new Response("Invalid security report JSON.", {
+        status: 400
+      });
+    }
+    const s = $t(i);
+    for (let o = 0; o < s.length; o += 1)
+      await e.onReport?.(s[o], {
+        index: o,
+        request: r
+      });
+    return new Response(null, {
+      status: 204
+    });
+  };
+}
+const St = /* @__PURE__ */ new Set([
+  "application/csp-report",
+  "application/reports+json"
+]);
+function Et(e) {
+  const t = e.headers.get("content-type");
+  if (!t)
+    return null;
+  const r = t.split(";", 1)[0]?.trim().toLowerCase();
+  return r && St.has(r) ? null : new Response("Unsupported security report Content-Type.", {
+    status: 415
+  });
+}
+function Rt(e, t) {
+  if (e.maxBodySize === void 0)
+    return null;
+  const r = t.headers.get("content-length");
+  if (!r)
+    return null;
+  if (!/^\d+$/.test(r))
+    return new Response("Invalid Content-Length.", {
+      status: 400
+    });
+  const n = Number(r);
+  return Number.isSafeInteger(n) ? n > A(e.maxBodySize) ? new Response("Security report body too large.", {
+    status: 413
+  }) : null : new Response("Invalid Content-Length.", {
+    status: 400
+  });
+}
+function $t(e) {
+  return Array.isArray(e) ? e : xt(e) && "csp-report" in e ? [e["csp-report"]] : [e];
+}
+function xt(e) {
+  return typeof e == "object" && e !== null;
+}
+function fr(e, t) {
+  const r = {}, n = [];
+  let a = 0;
+  for (const [i, s] of Object.entries(t.files)) {
+    const o = e.getAll(i).filter(It);
+    r[i] = o, s.required && o.length === 0 && n.push({
+      code: "file-missing",
+      field: i,
+      message: `Upload field ${i} requires at least one file.`
+    });
+    for (const u of o)
+      a += u.size, At(i, u, s, n);
+  }
+  return t.maxTotalSize !== void 0 && a > A(t.maxTotalSize) && n.push({
+    code: "total-upload-too-large",
+    field: "*",
+    message: `Uploaded files exceed the maximum total size of ${t.maxTotalSize}.`
+  }), {
+    files: r,
+    issues: n,
+    ok: n.length === 0,
+    totalSize: a
+  };
+}
+function At(e, t, r, n) {
+  r.maxSize !== void 0 && t.size > A(r.maxSize) && n.push({
+    code: "file-too-large",
+    field: e,
+    message: `Upload field ${e} contains ${t.name || "a file"} larger than ${r.maxSize}.`
+  }), r.types?.length && !Tt(t.type, r.types) && n.push({
+    code: "file-type-not-allowed",
+    field: e,
+    message: `Upload field ${e} contains ${t.name || "a file"} with disallowed type ${t.type || "unknown"}.`
+  });
+}
+function Tt(e, t) {
+  return t.some((r) => r.endsWith("/*") ? e.startsWith(r.slice(0, -1)) : e === r);
+}
+function It(e) {
+  return e instanceof File;
+}
+function kt(e, t) {
+  const r = t.headers.get("origin");
+  if (!r)
+    return {
+      allowed: !!e.allowMissingOrigin,
+      expected: e.origins,
+      origin: r,
+      reason: e.allowMissingOrigin ? void 0 : "missing-origin"
+    };
+  const n = q(r);
+  if (!n)
+    return {
+      allowed: !1,
+      expected: e.origins,
+      origin: r,
+      reason: "invalid-origin"
+    };
+  const a = Ct(e, n, t);
+  return {
+    allowed: a,
+    expected: e.origins,
+    origin: n,
+    reason: a ? void 0 : "origin-not-allowed"
+  };
+}
+function dr(e, t) {
+  return !e || kt(e, t).allowed ? null : new Response("WebSocket origin not allowed.", {
+    status: 403
+  });
+}
+function Ct(e, t, r) {
+  return e.origins === "same-origin" ? t === new URL(r.url).origin : e.origins.some(
+    (n) => Dt(n, t)
+  );
+}
+function Dt(e, t) {
+  return e === "null" ? t === "null" : q(e) === t;
+}
+function q(e) {
+  if (e === "null")
+    return e;
+  try {
+    if (e !== e.trim())
+      return null;
+    const t = e.indexOf("://");
+    if (t === -1)
+      return null;
+    const r = e.slice(t + 3);
+    if (!r || /[/?#]/.test(r))
+      return null;
+    const n = new URL(e);
+    return n.protocol !== "http:" && n.protocol !== "https:" || n.username || n.password ? null : n.origin;
+  } catch {
+    return null;
+  }
+}
+export {
+  ht as EnvValidationError,
+  se as HTTP_ERROR_STATUSES,
+  wr as HttpError,
+  Zt as Link,
+  Ht as action,
+  Wt as actionInput,
+  ar as analytics,
+  wn as assertAdapterCapabilities,
+  Je as auditScriptDependencies,
+  yn as checkAdapterCapabilities,
+  kt as checkWebSocketOrigin,
+  yr as createCache,
+  vr as createCorsHeaders,
+  br as createCsrfCookie,
+  Sr as createCsrfToken,
+  ke as createFileRouter,
+  Er as createInvalidation,
+  Rr as createMemoryCache,
+  $r as createMemoryCacheStore,
+  Gt as createMemoryIdempotencyStore,
+  xr as createMemoryRateLimitStore,
+  Ar as createRequestHandler,
+  or as createSecurityAudit,
+  de as createSecurityHeaders,
+  lr as createSecurityReportHandler,
+  Tr as cspHash,
+  vn as defineAdapter,
+  sr as defineEnvSchema,
+  tr as defineFonts,
+  Qt as defineImages,
+  ir as defineInstrumentation,
+  Ir as defineLinks,
+  kr as defineMetadata,
+  jt as defineOgImage,
+  Ft as defineRobots,
+  Cr as defineRoutePolicy,
+  Dr as defineScripts,
+  zr as defineSecurityPolicy,
+  Ut as defineSitemap,
+  Or as defineTags,
+  Pr as enforceAllowedMethods,
+  Lr as enforceCsrfProtection,
+  Nr as enforceRateLimit,
+  Ur as enforceRequestSecurity,
+  dr as enforceWebSocketOrigin,
+  ur as env,
+  er as font,
+  rr as fontPreloadLinks,
+  Mr as handleRequestWithManifest,
+  ee as href,
+  Fr as html,
+  ce as httpError,
+  Yt as hydrateFileRouter,
+  Xt as isAllowedImageSource,
+  le as isHttpError,
+  jr as issueCsrfToken,
+  qr as json,
+  Br as jsonl,
+  Hr as link,
+  Wr as mergeRoutePolicies,
+  _r as mergeRouteSecurityPolicies,
+  Vr as mergeSecurityPolicies,
+  Gr as meta,
+  Kr as modulePreload,
+  Yr as notFound,
+  _t as page,
+  A as parseBodySize,
+  D as parseCacheDuration,
+  Zr as parseCookieHeader,
+  Qr as parseRateLimitWindow,
+  Jt as planImageTransform,
+  Xr as preconnect,
+  Jr as preload,
+  en as query,
+  tn as redirect,
+  nr as renderFontFaceCss,
+  Bt as renderOgImageResponse,
+  ge as renderOgImageSvg,
+  pr as renderPageResponse,
+  qt as renderRobots,
+  Mt as renderSitemap,
+  rn as resolveLinks,
+  nn as resolveMetadata,
+  an as resolveScripts,
+  Q as response,
+  Kt as runIdempotentMutation,
+  fe as script,
+  on as security,
+  J as serializeCacheKey,
+  sn as serializeCacheNamespace,
+  cn as serializeCacheTag,
+  un as serverTiming,
+  ln as sse,
+  fn as stream,
+  dn as structuredData,
+  hn as tag,
+  mn as text,
+  X as toResponse,
+  he as validateCorsPolicy,
+  cr as validateEnv,
+  pn as validateRateLimitPolicy,
+  fr as validateUploads,
+  Vt as webhook
+};
+//# sourceMappingURL=index.js.map