@demiurgejs/core 0.1.1 → 0.2.0-beta.1

package/dist/index.js

@@ -1,33 +1,91 @@
 import { jsx as H } from "react/jsx-runtime";
-import { createContext as W, useState as I, useRef as k, useEffect as C, useMemo as _, createElement as f, useContext as V, Component as G } from "react";
-import { e as K, H as Y, f as Z } from "./chunks/ssr-BJejKlkZ.js";
-import { r as pr } from "./chunks/ssr-BJejKlkZ.js";
-import { g as Q, t as X, p as D, s as J, i as ee, c as P, l as te, j as L, k as re, N as z, m as ne, n as ae, o as ie, q as oe, H as se, u as ce, B as ue, v as le, w as fe, x as de, y as he, z as me, R as pe, A } from "./chunks/testing-DR3eQAvY.js";
-import { C as wr, D as yr, E as vr, F as br, G as Sr, I as Er, J as Rr, K as $r, b as xr, L as Ar, d as Tr, M as Ir, O as kr, P as Cr, Q as Dr, S as zr, T as Or, U as Pr, V as Lr, W as Nr, X as Ur, h as Mr, Y as Fr, Z as jr, _ as qr, $ as Br, a0 as Hr, a1 as Wr, a2 as _r, a3 as Vr, a4 as Gr, a5 as Kr, a6 as Yr, a7 as Zr, a8 as Qr, a9 as Xr, aa as Jr, ab as en, ac as tn, ad as rn, ae as nn, af as an, ag as on, ah as sn, ai as cn, aj as un, ak as ln, al as fn, am as dn, an as hn, ao as mn, ap as pn } from "./chunks/testing-DR3eQAvY.js";
-import { a as wn, c as yn, d as vn } from "./chunks/index-BnX9Qxbm.js";
+import { createContext as _, useState as I, useRef as T, useEffect as C, useMemo as V, createElement as f, useContext as W, Component as G } from "react";
+import { g as K, H as Y, h as Z, i as Q } from "./chunks/request-metadata-DwEO1EAS.js";
+import { j as Qt, k as Xt, l as Jt, d as er, m as tr, r as rr, n as nr } from "./chunks/request-metadata-DwEO1EAS.js";
+import { p as z, k as X, l as J, t as ee, n as te, R as re, o as x, q as ne, j as O, u as ae, w as L, x as ie, N as D, y as oe, z as se, A as ce, B as ue, H as le, C as fe, D as de, E as me } from "./chunks/testing-DBjVCN5v.js";
+import { F as ir, G as or, I as sr, J as cr, K as ur, L as lr, M as fr, O as dr, P as mr, a as hr, Q as gr, S as pr, d as wr, b as yr, T as vr, U as br, V as Er, W as Sr, X as Rr, Y as Ar, Z as $r, _ as xr, $ as kr, a0 as Ir, h as Tr, a1 as Cr, a2 as zr, a3 as Dr, a4 as Nr, a5 as Or, a6 as Lr, a7 as Mr, m as Pr, a8 as Ur, a9 as Fr, aa as jr, ab as Br, ac as qr, ad as Hr, ae as _r, af as Vr, ag as Wr, ah as Gr, ai as Kr, s as Yr, aj as Zr, ak as Qr, al as Xr, am as Jr, an as en, ao as tn, ap as rn, aq as nn, e as an, f as on, v as sn } from "./chunks/testing-DBjVCN5v.js";
 import "react-dom/server";
-function Ut(e) {
+const he = "24h", ge = 1e4;
+function vt(e = {}) {
+  const t = e.now ?? Date.now, r = e.defaultTtl ?? he, n = e.maximumEntries ?? ge;
+  if (!Number.isSafeInteger(n) || n <= 0)
+    throw new Error(
+      "Demiurge idempotency maximumEntries must be a positive integer."
+    );
+  const a = z(r);
+  if (!Number.isFinite(a))
+    throw new Error("Demiurge idempotency defaultTtl must be finite.");
+  const i = /* @__PURE__ */ new Map();
+  return {
+    async run(s) {
+      const o = X(s.key), u = t();
+      pe(i, u);
+      const d = i.get(o);
+      if (d && (d.pending || d.expiresAt > u))
+        return {
+          key: o,
+          replayed: !0,
+          value: await d.value
+        };
+      if (i.size >= n && we(i), i.size >= n)
+        throw new Error(
+          "Demiurge idempotency store is at capacity with in-flight mutations."
+        );
+      const p = Promise.resolve().then(s.fn), c = {
+        expiresAt: Number.POSITIVE_INFINITY,
+        pending: !0,
+        value: p
+      };
+      i.set(o, c);
+      try {
+        const l = await p;
+        return c.pending = !1, c.expiresAt = t() + z(s.ttl ?? r), {
+          key: o,
+          replayed: !1,
+          value: l
+        };
+      } catch (l) {
+        throw i.get(o) === c && i.delete(o), l;
+      }
+    }
+  };
+}
+function pe(e, t) {
+  for (const [r, n] of e)
+    !n.pending && n.expiresAt <= t && e.delete(r);
+}
+function we(e) {
+  for (const [t, r] of e)
+    if (!r.pending) {
+      e.delete(t);
+      return;
+    }
+}
+function bt(e, t) {
+  return e.run(t);
+}
+function Et(e) {
   return {
     entries: e
   };
 }
-function Mt(e) {
+function St(e) {
   return [
     '<?xml version="1.0" encoding="UTF-8"?>',
     `<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"${e.entries.some((r) => r.alternates?.length) ? ' xmlns:xhtml="http://www.w3.org/1999/xhtml"' : ""}>`,
-    ...e.entries.map(we),
+    ...e.entries.map(ve),
     "</urlset>",
     ""
   ].join(`
 `);
 }
-function Ft(e) {
+function Rt(e) {
   return e;
 }
-function jt(e) {
+function At(e) {
   return e;
 }
-function qt(e) {
+function $t(e) {
   const t = [];
   for (const r of e.rules ?? []) {
     for (const n of b(r.userAgent))
@@ -45,44 +103,44 @@ function qt(e) {
 `).replace(/\n+$/, "")}
 `;
 }
-function ge(e) {
-  const t = e.width ?? 1200, r = e.height ?? 630, n = e.background ?? "#101820", a = e.foreground ?? "#ffffff", i = $(e.title, 120), s = e.subtitle ? $(e.subtitle, 160) : void 0, o = e.brand ? $(e.brand, 80) : void 0;
-  return be(t, r), [
-    `<svg xmlns="http://www.w3.org/2000/svg" width="${t}" height="${r}" viewBox="0 0 ${t} ${r}" role="img" aria-label="${p(i)}">`,
-    `  <rect width="100%" height="100%" fill="${p(n)}" />`,
-    o ? `  <text x="72" y="96" fill="${p(a)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="32" font-weight="700">${w(o)}</text>` : null,
-    `  <text x="72" y="${s ? 300 : 340}" fill="${p(a)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="76" font-weight="800">${w(i)}</text>`,
-    s ? `  <text x="72" y="392" fill="${p(a)}" fill-opacity="0.78" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="38" font-weight="500">${w(s)}</text>` : null,
+function ye(e) {
+  const t = e.width ?? 1200, r = e.height ?? 630, n = e.background ?? "#101820", a = e.foreground ?? "#ffffff", i = A(e.title, 120), s = e.subtitle ? A(e.subtitle, 160) : void 0, o = e.brand ? A(e.brand, 80) : void 0;
+  return Se(t, r), [
+    `<svg xmlns="http://www.w3.org/2000/svg" width="${t}" height="${r}" viewBox="0 0 ${t} ${r}" role="img" aria-label="${g(i)}">`,
+    `  <rect width="100%" height="100%" fill="${g(n)}" />`,
+    o ? `  <text x="72" y="96" fill="${g(a)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="32" font-weight="700">${w(o)}</text>` : null,
+    `  <text x="72" y="${s ? 300 : 340}" fill="${g(a)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="76" font-weight="800">${w(i)}</text>`,
+    s ? `  <text x="72" y="392" fill="${g(a)}" fill-opacity="0.78" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="38" font-weight="500">${w(s)}</text>` : null,
     "</svg>"
   ].filter((u) => !!u).join(`
 `);
 }
-function Bt(e) {
-  return new Response(ge(e), {
+function xt(e) {
+  return new Response(ye(e), {
     headers: {
       "cache-control": "public, max-age=31536000, immutable",
       "content-type": "image/svg+xml; charset=utf-8"
     }
   });
 }
-function we(e) {
+function ve(e) {
   return [
     "  <url>",
     `    <loc>${w(e.url)}</loc>`,
-    e.lastModified ? `    <lastmod>${w(ye(e.lastModified))}</lastmod>` : null,
+    e.lastModified ? `    <lastmod>${w(be(e.lastModified))}</lastmod>` : null,
     e.changeFrequency ? `    <changefreq>${e.changeFrequency}</changefreq>` : null,
-    e.priority !== void 0 ? `    <priority>${ve(e.priority)}</priority>` : null,
+    e.priority !== void 0 ? `    <priority>${Ee(e.priority)}</priority>` : null,
     ...(e.alternates ?? []).map(
-      (t) => `    <xhtml:link rel="alternate" hreflang="${p(t.hrefLang)}" href="${p(t.href)}" />`
+      (t) => `    <xhtml:link rel="alternate" hreflang="${g(t.hrefLang)}" href="${g(t.href)}" />`
     ),
     "  </url>"
   ].filter((t) => !!t).join(`
 `);
 }
-function ye(e) {
+function be(e) {
   return e instanceof Date ? e.toISOString() : e;
 }
-function ve(e) {
+function Ee(e) {
   if (e < 0 || e > 1)
     throw new Error("Sitemap entry priority must be between 0 and 1.");
   return String(e);
@@ -93,25 +151,25 @@ function b(e) {
 function w(e) {
   return e.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
-function p(e) {
+function g(e) {
   return w(e).replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 }
-function $(e, t) {
+function A(e, t) {
   return e.length > t ? `${e.slice(0, t - 3)}...` : e;
 }
-function be(e, t) {
+function Se(e, t) {
   if (!Number.isSafeInteger(e) || e <= 0)
     throw new Error("OG image width must be a positive integer.");
   if (!Number.isSafeInteger(t) || t <= 0)
     throw new Error("OG image height must be a positive integer.");
 }
-function Ht(e) {
-  return Q(
+function kt(e) {
+  return J(
     async (t) => {
       const r = e.input ? await e.input(t) : void 0, n = {
         ...t,
         input: r
-      }, a = async () => await Se(
+      }, a = async () => await Re(
         await e.handler(n),
         t
       );
@@ -131,7 +189,7 @@ function Ht(e) {
     }
   );
 }
-const Wt = {
+const It = {
   async formData({ request: e }) {
     return await e.formData();
   },
@@ -142,10 +200,10 @@ const Wt = {
     return await e.text();
   }
 };
-async function Se(e, t) {
-  return e instanceof Response ? e : await X(e, t);
+async function Re(e, t) {
+  return e instanceof Response ? e : await ee(e, t);
 }
-function _t(e) {
+function Tt(e) {
   return typeof e == "function" ? {
     kind: "page",
     render: { mode: "ssr" },
@@ -158,7 +216,10 @@ function _t(e) {
     view: e.view
   };
 }
-const Vt = {
+function Ct(e) {
+  return e;
+}
+const zt = {
   hmac(e) {
     return {
       kind: "response",
@@ -166,7 +227,7 @@ const Vt = {
         const r = new Uint8Array(await t.request.arrayBuffer()), n = t.request.headers.get(
           e.header ?? "x-webhook-signature"
         );
-        return n ? await Ee(r, n, e) ? await e.handler({
+        return n ? await Ae(r, n, e) ? await e.handler({
           ...t,
           rawBody: r,
           text: () => new TextDecoder().decode(r)
@@ -182,12 +243,12 @@ const Vt = {
     };
   }
 };
-async function Ee(e, t, r) {
-  const n = r.algorithm ?? "SHA-256", a = r.encoding ?? "hex", i = Re(
+async function Ae(e, t, r) {
+  const n = r.algorithm ?? "SHA-256", a = r.encoding ?? "hex", i = $e(
     t,
     n,
     r.prefix
-  ), s = $e(i, a);
+  ), s = xe(i, a);
   if (!s)
     return !1;
   const o = await globalThis.crypto.subtle.importKey(
@@ -207,11 +268,11 @@ async function Ee(e, t, r) {
     Uint8Array.from(e).buffer
   );
 }
-function Re(e, t, r) {
+function $e(e, t, r) {
   const n = e.trim(), a = r === void 0 ? `${t.toLowerCase().replace("-", "")}=` : r;
   return a !== !1 && n.startsWith(a) ? n.slice(a.length).trim() : n;
 }
-function $e(e, t) {
+function xe(e, t) {
   if (t === "hex")
     return /^(?:[0-9a-f]{2})+$/i.test(e) ? Uint8Array.from(
       e.match(/.{2}/g) ?? [],
@@ -228,412 +289,650 @@ function $e(e, t) {
     return null;
   }
 }
-const xe = "24h", Ae = 1e4;
-function Gt(e = {}) {
-  const t = e.now ?? Date.now, r = e.defaultTtl ?? xe, n = e.maximumEntries ?? Ae;
-  if (!Number.isSafeInteger(n) || n <= 0)
-    throw new Error(
-      "Demiurge idempotency maximumEntries must be a positive integer."
-    );
-  const a = D(r);
-  if (!Number.isFinite(a))
-    throw new Error("Demiurge idempotency defaultTtl must be finite.");
-  const i = /* @__PURE__ */ new Map();
-  return {
-    async run(s) {
-      const o = J(s.key), u = t();
-      Te(i, u);
-      const d = i.get(o);
-      if (d && (d.pending || d.expiresAt > u))
-        return {
-          key: o,
-          replayed: !0,
-          value: await d.value
-        };
-      if (i.size >= n && Ie(i), i.size >= n)
-        throw new Error(
-          "Demiurge idempotency store is at capacity with in-flight mutations."
-        );
-      const g = Promise.resolve().then(s.fn), c = {
-        expiresAt: Number.POSITIVE_INFINITY,
-        pending: !0,
-        value: g
-      };
-      i.set(o, c);
-      try {
-        const l = await g;
-        return c.pending = !1, c.expiresAt = t() + D(s.ttl ?? r), {
-          key: o,
-          replayed: !1,
-          value: l
-        };
-      } catch (l) {
-        throw i.get(o) === c && i.delete(o), l;
-      }
-    }
-  };
-}
-function Te(e, t) {
-  for (const [r, n] of e)
-    !n.pending && n.expiresAt <= t && e.delete(r);
-}
-function Ie(e) {
-  for (const [t, r] of e)
-    if (!r.pending) {
-      e.delete(t);
-      return;
-    }
+class ke extends Error {
+  issues;
+  constructor(t) {
+    super(Oe(t)), this.name = "EnvValidationError", this.issues = t;
+  }
 }
-function Kt(e, t) {
-  return e.run(t);
+function Dt(e) {
+  return e;
 }
-function ke(e) {
-  const t = P(e.routes), r = e.loadNavigationData ?? U;
-  return function() {
-    const [a, i] = I(() => S()), [s, o] = I(
-      () => e.initialMatch ?? { status: "loading" }
-    ), u = k(!!e.initialMatch), d = k(0);
-    C(() => {
-      function c() {
-        i(S());
+function Nt(e, t) {
+  const r = [], n = {};
+  for (const a of Object.keys(e)) {
+    const i = e[a], s = t[String(a)];
+    if (s === void 0 || s === "") {
+      if (i.optional) {
+        n[a] = void 0;
+        continue;
       }
-      return window.addEventListener("popstate", c), () => window.removeEventListener("popstate", c);
-    }, []), C(() => {
-      let c = !1, l = !1;
-      const h = ++d.current, R = new AbortController(), v = () => !c && h === d.current;
-      if (u.current && De(e.initialMatch) === a.pathname)
-        return u.current = !1, () => {
-          c = !0;
-        };
-      o({ status: "loading" }), te(t, a.pathname).then((m) => {
-        v() && !l && m && o({ loading: m, status: "loading" });
-      }).catch(() => {
+      r.push({
+        code: "missing",
+        key: String(a),
+        message: `Environment variable ${String(a)} is required.`
+      });
+      continue;
+    }
+    try {
+      n[a] = i.parse(String(a), s);
+    } catch (o) {
+      r.push({
+        code: "invalid",
+        key: String(a),
+        message: o instanceof Error ? o.message : `Environment variable ${String(a)} is invalid.`
       });
-      const T = new Request(a.href, { signal: R.signal });
-      return Promise.resolve(r(T)).then(
-        (m) => L(
-          t,
-          a.pathname,
-          T,
-          m,
-          void 0,
-          { documentContributions: !1 }
-        )
-      ).then((m) => {
-        l = !0, v() && o(m);
-      }).catch(async (m) => {
-        if (l = !0, !v() || R.signal.aborted)
-          return;
-        const B = await re(
-          t,
-          a.pathname
-        );
-        v() && o({
-          Error: B,
-          error: m,
-          pathname: a.pathname,
-          status: "error"
-        });
-      }), () => {
-        c = !0, R.abort();
-      };
-    }, [a.pathname, a.search]);
-    const g = _(
-      () => ({
-        navigation: e.navigation ?? "server",
-        push(c) {
-          const l = S();
-          window.history.pushState(null, "", c);
-          const h = S();
-          i(h), l.pathname === h.pathname && l.search === h.search && l.hash !== h.hash && Ne(h.hash);
-        }
-      }),
-      []
-    );
-    return f(M.Provider, {
-      value: g,
-      children: f(Oe, {
-        key: `${a.pathname}${a.search}`,
-        Loading: e.loading,
-        NotFound: e.notFound,
-        match: s
-      })
-    });
-  };
-}
-function Ce(e, t) {
-  const r = t.getAttribute(Z);
-  return e.status === "not-found" ? r === "not-found" : e.status === "ready" && r === null;
-}
-function De(e) {
-  if (e)
-    return e.status === "ready" ? e.match.pathname : e.status === "loading" ? void 0 : e.pathname;
-}
-async function Yt(e) {
-  const t = e.root ?? document.getElementById("root");
-  if (!t)
-    throw new Error(
-      "Demiurge expected a #root element in the framework document."
-    );
-  const r = P(e.routes), n = e.loadNavigationData ?? U, a = e.initialData ?? K(document), i = await L(
-    r,
-    window.location.pathname,
-    new Request(window.location.href),
-    a ?? await n(new Request(window.location.href)),
-    void 0,
-    { documentContributions: !1 }
-  ), s = Ce(i, t), o = ke(
-    s ? {
-      ...e,
-      initialMatch: i,
-      loadNavigationData: n,
-      navigation: a?.navigation ?? e.navigation
-    } : {
-      ...e,
-      loadNavigationData: n,
-      navigation: a?.navigation ?? e.navigation
     }
-  ), { createRoot: u, hydrateRoot: d } = ze(
-    await import("react-dom/client")
-  );
-  if (s && t.hasAttribute(Y)) {
-    d(t, f(o));
-    return;
   }
-  t.replaceChildren(), u(t).render(f(o));
+  if (r.length)
+    throw new ke(r);
+  return n;
 }
-function ze(e) {
-  const t = typeof e.createRoot == "function" && typeof e.hydrateRoot == "function" ? e : e.default;
-  if (!t || typeof t.createRoot != "function" || typeof t.hydrateRoot != "function")
+function Ie(e = {}) {
+  return y(e, !1, (t, r) => {
+    if (r === "true" || r === "1")
+      return !0;
+    if (r === "false" || r === "0")
+      return !1;
+    throw new Error(`Environment variable ${t} must be true, false, 1, or 0.`);
+  });
+}
+function Te(e, t = {}) {
+  return y(t, !1, (r, n) => {
+    if (e.includes(n))
+      return n;
     throw new Error(
-      "Demiurge could not load the React DOM client from the Vite module."
+      `Environment variable ${r} must be one of: ${e.join(", ")}.`
     );
-  return t;
+  });
 }
-function Zt(e) {
-  const t = Me(), r = ee(e);
-  return /* @__PURE__ */ H(
-    "a",
-    {
-      className: e.className,
-      href: r,
-      onClick: (n) => {
-        t.navigation === "server" && Ue(n) && (n.preventDefault(), t.push(r));
-      },
-      children: e.children
-    }
+function Ce(e = {}) {
+  return y(e, !1, (t, r) => {
+    if (!/^-?\d+$/.test(r))
+      throw new Error(`Environment variable ${t} must be an integer.`);
+    const n = Number(r);
+    if (!Number.isSafeInteger(n))
+      throw new Error(`Environment variable ${t} must be a safe integer.`);
+    if (e.min !== void 0 && n < e.min)
+      throw new Error(
+        `Environment variable ${t} must be greater than or equal to ${e.min}.`
+      );
+    if (e.max !== void 0 && n > e.max)
+      throw new Error(
+        `Environment variable ${t} must be less than or equal to ${e.max}.`
+      );
+    return n;
+  });
+}
+function ze(e = {}) {
+  return y(
+    e,
+    !0,
+    (t, r) => M(t, r, e)
   );
 }
-function Oe({
-  Loading: e,
-  NotFound: t,
-  match: r
-}) {
-  if (r.status === "loading") {
-    const c = r.loading ?? e;
-    return c ? f(c) : null;
-  }
-  if (r.status === "not-found") {
-    const c = r.notFound ?? t ?? ue;
-    return r.layouts.reduceRight(
-      (l, h) => f(h, {
-        children: l,
-        path: {},
-        pathname: r.pathname
-      }),
-      f(c, { pathname: r.pathname })
-    );
-  }
-  if (r.status === "error")
-    return r.Error ? f(r.Error, {
-      error: r.error,
-      pathname: r.pathname,
-      status: N(r.error)
-    }) : null;
-  const { data: n, error: a, page: i, layouts: s, path: o, pathname: u } = r.match, d = f(i, { data: n, path: o, pathname: u }), g = s.reduceRight(
-    (c, l) => f(l, { path: o, pathname: u, children: c }),
-    d
+function De(e = {}) {
+  return y(
+    e,
+    !1,
+    (t, r) => M(t, r, e)
   );
-  return f(Pe, {
-    Error: a,
-    children: g,
-    pathname: u
-  });
-}
-class Pe extends G {
-  static getDerivedStateFromError(t) {
-    return { error: t };
-  }
-  state = {};
-  componentDidUpdate(t) {
-    this.state.error !== void 0 && t.pathname !== this.props.pathname && this.setState({ error: void 0 });
-  }
-  render() {
-    return this.state.error !== void 0 ? this.props.Error ? f(this.props.Error, {
-      error: this.state.error,
-      pathname: this.props.pathname,
-      status: N(this.state.error)
-    }) : null : this.props.children;
-  }
 }
-function N(e) {
-  return le(e) ? e.status : 500;
+function Ne(e = {}) {
+  return y(e, !1, (t, r) => {
+    let n;
+    try {
+      n = new URL(r);
+    } catch {
+      throw new Error(`Environment variable ${t} must be a valid URL.`);
+    }
+    if (e.protocols?.length && !e.protocols.includes(n.protocol))
+      throw new Error(
+        `Environment variable ${t} must use one of these protocols: ${e.protocols.join(", ")}.`
+      );
+    return n;
+  });
 }
-function S() {
+const Ot = {
+  boolean: Ie,
+  enum: Te,
+  integer: Ce,
+  secret: ze,
+  string: De,
+  url: Ne
+};
+function y(e, t, r) {
   return {
-    hash: window.location.hash,
-    href: window.location.href,
-    pathname: window.location.pathname,
-    search: window.location.search
+    optional: e.optional ?? !1,
+    parse: r,
+    sensitive: t
   };
 }
-async function U(e) {
-  const t = new Headers(e.headers);
-  t.set("accept", "application/json"), t.set(z, ne);
-  const r = await fetch(new Request(e, {
-    credentials: "same-origin",
-    headers: t
-  })), n = r.headers.get(z);
-  if (n === ae) {
-    const a = await r.json();
-    if (a.hasData !== !0)
-      throw new Error("Demiurge received malformed navigation route data.");
-    return { data: a.data, hasData: !0 };
-  }
-  if (n === ie)
-    return { hasData: !0 };
-  if (n === oe || !r.ok) {
-    const a = await Le(r), i = se.includes(
-      r.status
-    ) ? r.status : 500;
-    throw ce(i, {
-      detail: typeof a?.detail == "string" ? a.detail : void 0,
-      title: typeof a?.title == "string" ? a.title : void 0
-    });
-  }
-  throw new Error(
-    "Demiurge expected a navigation data response from the application server."
-  );
+function M(e, t, r) {
+  if (r.minLength !== void 0 && t.length < r.minLength)
+    throw new Error(
+      `Environment variable ${e} must be at least ${r.minLength} characters.`
+    );
+  return t;
 }
-async function Le(e) {
-  try {
-    return await e.json();
-  } catch {
-    return;
-  }
+function Oe(e) {
+  return e.length === 1 ? e[0].message : `Environment validation failed with ${e.length} issues.`;
 }
-function Ne(e) {
-  queueMicrotask(() => {
-    if (!e) {
-      window.scrollTo?.(0, 0);
-      return;
-    }
-    let t;
+function Lt(e = {}) {
+  return async function(r) {
+    if (r.method.toUpperCase() !== "POST")
+      return new Response(null, {
+        headers: {
+          allow: "POST"
+        },
+        status: 405
+      });
+    const n = Me(r);
+    if (n)
+      return n;
+    const a = Pe(e, r);
+    if (a)
+      return a;
+    e.maxBodySize !== void 0 && (r = te({ maxBodySize: e.maxBodySize }, r));
+    let i;
     try {
-      t = decodeURIComponent(e.slice(1));
-    } catch {
-      t = e.slice(1);
+      i = await r.json();
+    } catch (o) {
+      return o instanceof re ? new Response("Security report body too large.", { status: 413 }) : new Response("Invalid security report JSON.", {
+        status: 400
+      });
     }
-    document.getElementById(t)?.scrollIntoView?.();
+    const s = Ue(i);
+    for (let o = 0; o < s.length; o += 1)
+      await e.onReport?.(s[o], {
+        index: o,
+        request: r
+      });
+    return new Response(null, {
+      status: 204
+    });
+  };
+}
+const Le = /* @__PURE__ */ new Set([
+  "application/csp-report",
+  "application/reports+json"
+]);
+function Me(e) {
+  const t = e.headers.get("content-type");
+  if (!t)
+    return null;
+  const r = t.split(";", 1)[0]?.trim().toLowerCase();
+  return r && Le.has(r) ? null : new Response("Unsupported security report Content-Type.", {
+    status: 415
+  });
+}
+function Pe(e, t) {
+  if (e.maxBodySize === void 0)
+    return null;
+  const r = t.headers.get("content-length");
+  if (!r)
+    return null;
+  if (!/^\d+$/.test(r))
+    return new Response("Invalid Content-Length.", {
+      status: 400
+    });
+  const n = Number(r);
+  return Number.isSafeInteger(n) ? n > x(e.maxBodySize) ? new Response("Security report body too large.", {
+    status: 413
+  }) : null : new Response("Invalid Content-Length.", {
+    status: 400
   });
 }
 function Ue(e) {
-  return e.button === 0 && !e.metaKey && !e.altKey && !e.ctrlKey && !e.shiftKey;
+  return Array.isArray(e) ? e : Fe(e) && "csp-report" in e ? [e["csp-report"]] : [e];
 }
-const M = W({
-  navigation: "document",
-  push(e) {
-    window.location.href = e;
+function Fe(e) {
+  return typeof e == "object" && e !== null;
+}
+function Mt(e, t) {
+  const r = {}, n = [];
+  let a = 0;
+  for (const [i, s] of Object.entries(t.files)) {
+    const o = e.getAll(i).filter(qe);
+    r[i] = o, s.required && o.length === 0 && n.push({
+      code: "file-missing",
+      field: i,
+      message: `Upload field ${i} requires at least one file.`
+    });
+    for (const u of o)
+      a += u.size, je(i, u, s, n);
   }
-});
-function Me() {
-  return V(M);
+  return t.maxTotalSize !== void 0 && a > x(t.maxTotalSize) && n.push({
+    code: "total-upload-too-large",
+    field: "*",
+    message: `Uploaded files exceed the maximum total size of ${t.maxTotalSize}.`
+  }), {
+    files: r,
+    issues: n,
+    ok: n.length === 0,
+    totalSize: a
+  };
 }
-const Fe = "/_demiurge/image";
-function Qt(e) {
-  return e;
+function je(e, t, r, n) {
+  r.maxSize !== void 0 && t.size > x(r.maxSize) && n.push({
+    code: "file-too-large",
+    field: e,
+    message: `Upload field ${e} contains ${t.name || "a file"} larger than ${r.maxSize}.`
+  }), r.types?.length && !Be(t.type, r.types) && n.push({
+    code: "file-type-not-allowed",
+    field: e,
+    message: `Upload field ${e} contains ${t.name || "a file"} with disallowed type ${t.type || "unknown"}.`
+  });
 }
-function Xt(e, t = {}) {
-  return F(e, t) !== null;
+function Be(e, t) {
+  return t.some((r) => r.endsWith("/*") ? e.startsWith(r.slice(0, -1)) : e === r);
+}
+function qe(e) {
+  return e instanceof File;
 }
-function Jt(e, t = {}) {
-  const r = F(e.src, t);
+function He(e, t) {
+  const r = t.headers.get("origin");
   if (!r)
-    throw new Error(`Image source "${e.src}" is not allowed by the image policy.`);
-  x("width", e.width), x("height", e.height), We(e.quality);
-  const n = e.format ?? "auto", i = _e(e.width, e.widths).map((o) => {
-    const u = Math.round(e.height / e.width * o);
     return {
-      format: n,
-      height: u,
-      src: Ve({
-        format: n,
-        optimizerPath: t.optimizerPath ?? Fe,
-        quality: e.quality,
-        src: e.src,
-        width: o
-      }),
-      width: o
+      allowed: !!e.allowMissingOrigin,
+      expected: e.origins,
+      origin: r,
+      reason: e.allowMissingOrigin ? void 0 : "missing-origin"
     };
-  }), s = i[0];
+  const n = P(r);
+  if (!n)
+    return {
+      allowed: !1,
+      expected: e.origins,
+      origin: r,
+      reason: "invalid-origin"
+    };
+  const a = _e(e, n, t);
   return {
-    alt: e.alt,
-    decoding: "async",
-    fetchPriority: e.priority ? "high" : void 0,
-    height: e.height,
-    loading: e.priority ? "eager" : "lazy",
-    sizes: e.sizes,
-    source: r,
-    src: s.src,
-    srcSet: i.map((o) => `${o.src} ${o.width}w`).join(", "),
-    variants: i,
-    width: e.width
+    allowed: a,
+    expected: e.origins,
+    origin: n,
+    reason: a ? void 0 : "origin-not-allowed"
   };
 }
-function F(e, t) {
-  if (e.startsWith("/") && !e.startsWith("//"))
-    return t.local === !1 ? null : { kind: "local", src: e };
-  let r;
+function Pt(e, t) {
+  return !e || He(e, t).allowed ? null : new Response("WebSocket origin not allowed.", {
+    status: 403
+  });
+}
+function _e(e, t, r) {
+  return e.origins === "same-origin" ? t === new URL(r.url).origin : e.origins.some(
+    (n) => Ve(n, t)
+  );
+}
+function Ve(e, t) {
+  return e === "null" ? t === "null" : P(e) === t;
+}
+function P(e) {
+  if (e === "null")
+    return e;
   try {
-    r = new URL(e);
+    if (e !== e.trim())
+      return null;
+    const t = e.indexOf("://");
+    if (t === -1)
+      return null;
+    const r = e.slice(t + 3);
+    if (!r || /[/?#]/.test(r))
+      return null;
+    const n = new URL(e);
+    return n.protocol !== "http:" && n.protocol !== "https:" || n.username || n.password ? null : n.origin;
   } catch {
     return null;
   }
-  return r.protocol !== "https:" && r.protocol !== "http:" ? null : je(r, t.remote ?? []) ? { kind: "remote", src: r.toString() } : null;
 }
-function je(e, t) {
-  return t.some(
-    (r) => typeof r == "string" ? qe(e, r) : Be(e, r)
-  );
+function We(e) {
+  const t = O(e.routes), r = e.loadNavigationData ?? F;
+  return function() {
+    const [a, i] = I(() => E()), [s, o] = I(
+      () => e.initialMatch ?? { status: "loading" }
+    ), u = T(!!e.initialMatch), d = T(0);
+    C(() => {
+      function c() {
+        i(E());
+      }
+      return window.addEventListener("popstate", c), () => window.removeEventListener("popstate", c);
+    }, []), C(() => {
+      let c = !1, l = !1;
+      const m = ++d.current, R = new AbortController(), v = () => !c && m === d.current;
+      if (u.current && Ke(e.initialMatch) === a.pathname)
+        return u.current = !1, () => {
+          c = !0;
+        };
+      o({ status: "loading" }), ae(t, a.pathname).then((h) => {
+        v() && !l && h && o({ loading: h, status: "loading" });
+      }).catch(() => {
+      });
+      const k = new Request(a.href, { signal: R.signal });
+      return Promise.resolve(r(k)).then(
+        (h) => L(
+          t,
+          a.pathname,
+          k,
+          h,
+          void 0,
+          { documentContributions: !1 }
+        )
+      ).then((h) => {
+        l = !0, v() && o(h);
+      }).catch(async (h) => {
+        if (l = !0, !v() || R.signal.aborted)
+          return;
+        const q = await ie(
+          t,
+          a.pathname
+        );
+        v() && o({
+          Error: q,
+          error: h,
+          pathname: a.pathname,
+          status: "error"
+        });
+      }), () => {
+        c = !0, R.abort();
+      };
+    }, [a.pathname, a.search]);
+    const p = V(
+      () => ({
+        navigation: e.navigation ?? "server",
+        push(c) {
+          const l = E();
+          window.history.pushState(null, "", c);
+          const m = E();
+          i(m), l.pathname === m.pathname && l.search === m.search && l.hash !== m.hash && Je(m.hash);
+        }
+      }),
+      []
+    );
+    return f(j.Provider, {
+      value: p,
+      children: f(Ze, {
+        key: `${a.pathname}${a.search}`,
+        Loading: e.loading,
+        NotFound: e.notFound,
+        match: s
+      })
+    });
+  };
+}
+function Ge(e, t) {
+  const r = t.getAttribute(Z);
+  return e.status === "not-found" ? r === "not-found" : e.status === "ready" && r === null;
+}
+function Ke(e) {
+  if (e)
+    return e.status === "ready" ? e.match.pathname : e.status === "loading" ? void 0 : e.pathname;
+}
+async function Ut(e) {
+  const t = e.root ?? document.getElementById("root");
+  if (!t)
+    throw new Error(
+      "Demiurge expected a #root element in the framework document."
+    );
+  const r = O(e.routes), n = e.loadNavigationData ?? F, a = e.initialData ?? K(document), i = await L(
+    r,
+    window.location.pathname,
+    new Request(window.location.href),
+    a ?? await n(new Request(window.location.href)),
+    void 0,
+    { documentContributions: !1 }
+  ), s = Ge(i, t), o = We(
+    s ? {
+      ...e,
+      initialMatch: i,
+      loadNavigationData: n,
+      navigation: a?.navigation ?? e.navigation
+    } : {
+      ...e,
+      loadNavigationData: n,
+      navigation: a?.navigation ?? e.navigation
+    }
+  ), { createRoot: u, hydrateRoot: d } = Ye(
+    await import("react-dom/client")
+  );
+  if (s && t.hasAttribute(Y)) {
+    d(t, f(o));
+    return;
+  }
+  t.replaceChildren(), u(t).render(f(o));
+}
+function Ye(e) {
+  const t = typeof e.createRoot == "function" && typeof e.hydrateRoot == "function" ? e : e.default;
+  if (!t || typeof t.createRoot != "function" || typeof t.hydrateRoot != "function")
+    throw new Error(
+      "Demiurge could not load the React DOM client from the Vite module."
+    );
+  return t;
+}
+function Ft(e) {
+  const t = tt(), r = ne(e);
+  return /* @__PURE__ */ H(
+    "a",
+    {
+      className: e.className,
+      href: r,
+      onClick: (n) => {
+        t.navigation === "server" && et(n) && (n.preventDefault(), t.push(r));
+      },
+      children: e.children
+    }
+  );
+}
+function Ze({
+  Loading: e,
+  NotFound: t,
+  match: r
+}) {
+  if (r.status === "loading") {
+    const c = r.loading ?? e;
+    return c ? f(c) : null;
+  }
+  if (r.status === "not-found") {
+    const c = r.notFound ?? t ?? de;
+    return r.layouts.reduceRight(
+      (l, m) => f(m, {
+        children: l,
+        path: {},
+        pathname: r.pathname
+      }),
+      f(c, { pathname: r.pathname })
+    );
+  }
+  if (r.status === "error")
+    return r.Error ? f(r.Error, {
+      error: r.error,
+      pathname: r.pathname,
+      status: U(r.error)
+    }) : null;
+  const { data: n, error: a, page: i, layouts: s, path: o, pathname: u } = r.match, d = f(i, { data: n, path: o, pathname: u }), p = s.reduceRight(
+    (c, l) => f(l, { path: o, pathname: u, children: c }),
+    d
+  );
+  return f(Qe, {
+    Error: a,
+    children: p,
+    pathname: u
+  });
+}
+class Qe extends G {
+  static getDerivedStateFromError(t) {
+    return { error: t };
+  }
+  state = {};
+  componentDidUpdate(t) {
+    this.state.error !== void 0 && t.pathname !== this.props.pathname && this.setState({ error: void 0 });
+  }
+  render() {
+    return this.state.error !== void 0 ? this.props.Error ? f(this.props.Error, {
+      error: this.state.error,
+      pathname: this.props.pathname,
+      status: U(this.state.error)
+    }) : null : this.props.children;
+  }
+}
+function U(e) {
+  return me(e) ? e.status : 500;
+}
+function E() {
+  return {
+    hash: window.location.hash,
+    href: window.location.href,
+    pathname: window.location.pathname,
+    search: window.location.search
+  };
+}
+async function F(e) {
+  const t = new Headers(e.headers);
+  t.set("accept", "application/json"), t.set(D, oe);
+  const r = await fetch(new Request(e, {
+    credentials: "same-origin",
+    headers: t
+  })), n = r.headers.get(D);
+  if (n === se) {
+    const a = await r.json();
+    if (a.hasData !== !0)
+      throw new Error("Demiurge received malformed navigation route data.");
+    return { data: a.data, hasData: !0 };
+  }
+  if (n === ce)
+    return { hasData: !0 };
+  if (n === ue || !r.ok) {
+    const a = await Xe(r), i = le.includes(
+      r.status
+    ) ? r.status : 500;
+    throw fe(i, {
+      detail: typeof a?.detail == "string" ? a.detail : void 0,
+      title: typeof a?.title == "string" ? a.title : void 0
+    });
+  }
+  throw new Error(
+    "Demiurge expected a navigation data response from the application server."
+  );
+}
+async function Xe(e) {
+  try {
+    return await e.json();
+  } catch {
+    return;
+  }
+}
+function Je(e) {
+  queueMicrotask(() => {
+    if (!e) {
+      window.scrollTo?.(0, 0);
+      return;
+    }
+    let t;
+    try {
+      t = decodeURIComponent(e.slice(1));
+    } catch {
+      t = e.slice(1);
+    }
+    document.getElementById(t)?.scrollIntoView?.();
+  });
+}
+function et(e) {
+  return e.button === 0 && !e.metaKey && !e.altKey && !e.ctrlKey && !e.shiftKey;
+}
+const j = _({
+  navigation: "document",
+  push(e) {
+    window.location.href = e;
+  }
+});
+function tt() {
+  return W(j);
+}
+const rt = "/_demiurge/image";
+function jt(e) {
+  return e;
+}
+function Bt(e, t = {}) {
+  return B(e, t) !== null;
+}
+function qt(e, t = {}) {
+  const r = B(e.src, t);
+  if (!r)
+    throw new Error(`Image source "${e.src}" is not allowed by the image policy.`);
+  $("width", e.width), $("height", e.height), st(e.quality);
+  const n = e.format ?? "auto", i = ct(e.width, e.widths).map((o) => {
+    const u = Math.round(e.height / e.width * o);
+    return {
+      format: n,
+      height: u,
+      src: ut({
+        format: n,
+        optimizerPath: t.optimizerPath ?? rt,
+        quality: e.quality,
+        src: e.src,
+        width: o
+      }),
+      width: o
+    };
+  }), s = i[0];
+  return {
+    alt: e.alt,
+    decoding: "async",
+    fetchPriority: e.priority ? "high" : void 0,
+    height: e.height,
+    loading: e.priority ? "eager" : "lazy",
+    sizes: e.sizes,
+    source: r,
+    src: s.src,
+    srcSet: i.map((o) => `${o.src} ${o.width}w`).join(", "),
+    variants: i,
+    width: e.width
+  };
+}
+function B(e, t) {
+  if (e.startsWith("/") && !e.startsWith("//"))
+    return t.local === !1 ? null : { kind: "local", src: e };
+  let r;
+  try {
+    r = new URL(e);
+  } catch {
+    return null;
+  }
+  return r.protocol !== "https:" && r.protocol !== "http:" ? null : nt(r, t.remote ?? []) ? { kind: "remote", src: r.toString() } : null;
+}
+function nt(e, t) {
+  return t.some(
+    (r) => typeof r == "string" ? at(e, r) : it(e, r)
+  );
 }
-function qe(e, t) {
+function at(e, t) {
   try {
     return e.origin === new URL(t).origin;
   } catch {
     return !1;
   }
 }
-function Be(e, t) {
-  return t.protocol && e.protocol !== t.protocol || e.hostname !== t.hostname || t.port !== void 0 && e.port !== t.port ? !1 : t.pathname ? He(e.pathname, t.pathname) : !0;
+function it(e, t) {
+  return t.protocol && e.protocol !== t.protocol || e.hostname !== t.hostname || t.port !== void 0 && e.port !== t.port ? !1 : t.pathname ? ot(e.pathname, t.pathname) : !0;
 }
-function He(e, t) {
+function ot(e, t) {
   return t.endsWith("*") ? e.startsWith(t.slice(0, -1)) : e === t;
 }
-function x(e, t) {
+function $(e, t) {
   if (!Number.isInteger(t) || t <= 0)
     throw new Error(`Image ${e} must be a positive integer.`);
 }
-function We(e) {
+function st(e) {
   if (e !== void 0 && (!Number.isInteger(e) || e < 1 || e > 100))
     throw new Error("Image quality must be an integer between 1 and 100.");
 }
-function _e(e, t) {
+function ct(e, t) {
   const r = t ?? [e, e * 2], n = [...new Set(r)];
   for (const a of n)
-    x("width", a);
+    $("width", a);
   return n.sort((a, i) => a - i);
 }
-function Ve({
+function ut({
   format: e,
   optimizerPath: t,
   quality: r,
@@ -646,7 +945,7 @@ function Ve({
   });
   return r !== void 0 && i.set("q", String(r)), e !== "auto" && i.set("f", e), `${t}?${i.toString()}`;
 }
-const er = {
+const Ht = {
   google(e) {
     return {
       display: e.display ?? "swap",
@@ -672,26 +971,26 @@ const er = {
     };
   }
 };
-function tr(e) {
+function _t(e) {
   return [...e];
 }
-function rr(e) {
+function Vt(e) {
   return e.filter((t) => t.src).map((t) => ({
     as: "font",
     crossOrigin: "anonymous",
     href: t.src,
     kind: "link",
     rel: "preload",
-    type: Ge(t.src)
+    type: lt(t.src)
   }));
 }
-function nr(e) {
+function Wt(e) {
   return e.filter((t) => t.source === "local" && t.src).map((t) => {
     const r = t.src;
     return [
       "@font-face {",
-      `  font-family: "${O(t.family)}";`,
-      `  src: url("${O(r)}") format("${Ke(r)}");`,
+      `  font-family: "${N(t.family)}";`,
+      `  src: url("${N(r)}") format("${ft(r)}");`,
       `  font-style: ${t.style};`,
       `  font-weight: ${t.weight};`,
       `  font-display: ${t.display};`,
@@ -701,25 +1000,25 @@ function nr(e) {
   }).join(`
 `);
 }
-function Ge(e) {
+function lt(e) {
   return e.split("?")[0].split("#")[0].split(".").pop()?.toLowerCase() === "woff" ? "font/woff" : "font/woff2";
 }
-function Ke(e) {
+function ft(e) {
   return e.split("?")[0].split("#")[0].split(".").pop()?.toLowerCase() === "woff" ? "woff" : "woff2";
 }
-function O(e) {
+function N(e) {
   return e.replace(/[\\"]/g, "\\$&");
 }
-const ar = {
+const Gt = {
   plausible(e) {
-    const t = Ye(e.domain), r = Ze(e.endpoint ?? "https://plausible.io");
+    const t = dt(e.domain), r = mt(e.endpoint ?? "https://plausible.io");
     return {
       connectSrc: r.origin,
       consent: e.consent ?? !1,
       domain: t,
       kind: "analytics",
       provider: "plausible",
-      script: fe({
+      script: Q({
         dataApi: `${r.origin}/api/event`,
         dataDomain: t,
         purpose: "analytics",
@@ -729,13 +1028,13 @@ const ar = {
     };
   }
 };
-function Ye(e) {
+function dt(e) {
   const t = e.trim();
   if (!t || t.includes("/") || t.includes(" "))
     throw new Error("Analytics domain must be a hostname without a path.");
   return t;
 }
-function Ze(e) {
+function mt(e) {
   let t;
   try {
     t = new URL(e);
@@ -746,583 +1045,132 @@ function Ze(e) {
     throw new Error("Analytics endpoint must use HTTPS.");
   return t;
 }
-function ir(e = {}) {
+function Kt(e = {}) {
   return {
     async request(t) {
-      await E({ kind: "request", signal: t }, e);
+      await S({ kind: "request", signal: t }, e);
     },
     async serverStart(t = {}) {
-      await E({ kind: "server-start", signal: t }, e);
+      await S({ kind: "server-start", signal: t }, e);
     },
     async trace(t) {
-      await E({ kind: "trace", signal: t }, e);
+      await S({ kind: "trace", signal: t }, e);
     },
     async reportWebVitals(t) {
-      await E({ kind: "web-vital", signal: t }, e);
+      await S({ kind: "web-vital", signal: t }, e);
     }
   };
 }
-async function E(e, t) {
+async function S(e, t) {
   await t.onEvent?.(e), e.kind === "request" ? await t.request?.(e.signal) : e.kind === "server-start" ? await t.serverStart?.(e.signal) : e.kind === "trace" ? await t.trace?.(e.signal) : await t.webVitals?.(e.signal);
 }
-const Qe = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]);
-function or(e = {}) {
-  const t = [], r = e.document, n = r ? et(r.policy, r.headers, t) : {};
-  r && Xe(r.policy, t);
-  const a = e.route ? ct(e.route, t) : void 0;
-  return r?.scripts && (tt(
-    r.policy.csp,
-    r.scripts,
-    r.headers,
-    t
-  ), r.scriptDependencies && t.push(
-    ...Je(
-      r.scripts,
-      rt(r.scriptDependencies)
-    )
-  )), {
-    findings: t,
-    headers: n,
-    route: a
-  };
-}
-function Xe(e, t) {
-  if (!e.trustedTypes || e.trustedTypes.mode !== "report-only")
-    return;
-  const r = e.csp || void 0, n = !!r?.reportUri?.length, a = e.headers?.reportingEndpoints, i = !!(r?.reportTo && a && a[r.reportTo]);
-  !n && !i && t.push({
-    code: "report-only-target-missing",
-    message: "Trusted Types report-only mode has no deliverable target. Configure CSP reportTo with a matching Reporting-Endpoints member, reportUri for compatibility, or both.",
-    severity: "warning"
-  });
-}
-function Je(e, t = {}) {
-  const r = t.requirePurpose ?? !0, n = [];
-  for (const a of e) {
-    const i = ft(a);
-    i && (r && !a.purpose && n.push({
-      code: "script-purpose-missing",
-      message: `Third-party script ${a.src} should declare a purpose for audits and consent flows.`,
-      severity: "warning"
-    }), t.requireIntegrity && !a.integrity && n.push({
-      code: "script-integrity-missing",
-      message: `Third-party script ${a.src} should declare an integrity hash or an explicit trust-boundary exception.`,
-      severity: "warning"
-    }), a.strategy === "beforeInteractive" && !t.allowBeforeInteractiveThirdParty && n.push({
-      code: "script-third-party-before-interactive",
-      message: `Third-party script ${a.src} runs before the app is interactive and should be justified by policy.`,
-      severity: "warning"
-    }), dt(i) && n.push({
-      code: "script-gtm-wide-trust-boundary",
-      message: "Google Tag Manager can load additional scripts at runtime and should be treated as a wide trust boundary.",
-      severity: "warning"
-    }));
-  }
-  return n;
-}
-function et(e, t, r) {
-  try {
-    return Object.fromEntries(de(e, t));
-  } catch (n) {
-    return r.push({
-      code: "security-header-render-failed",
-      message: n instanceof Error ? n.message : "Security headers failed to render.",
-      severity: "error"
-    }), {};
-  }
-}
-function tt(e, t, r, n) {
-  if (!e)
-    return;
-  const a = nt(e);
-  for (const i of t) {
-    if (at(a) && !i.nonce) {
-      n.push({
-        code: "csp-script-missing-nonce",
-        message: `Document script ${i.src} needs a nonce for the effective script-src policy.`,
-        severity: "error"
-      });
-      continue;
-    }
-    i.nonce && r?.nonce && i.nonce === r.nonce || it(a, i.src) || n.push({
-      code: "csp-script-src-blocked",
-      message: `Document script ${i.src} is not allowed by the effective script-src policy.`,
-      severity: "error"
-    });
-  }
-}
-function rt(e) {
-  return typeof e == "boolean" ? {} : e;
-}
-function nt(e) {
-  return e.scriptSrc ?? e.defaultSrc ?? [];
-}
-function at(e) {
-  return e.some((t) => t.includes("'nonce-{nonce}'"));
-}
-function it(e, t) {
-  return e.includes("*") ? !0 : e.includes("'none'") || e.some((r) => r.startsWith("'nonce-")) ? !1 : e.includes("'self'") && ot(t) || t.startsWith("https:") && e.includes("https:") || t.startsWith("http:") && e.includes("http:") ? !0 : e.some((r) => st(r, t));
-}
-function ot(e) {
-  return e.startsWith("/") && !e.startsWith("//");
-}
-function st(e, t) {
-  if (e.startsWith("'"))
-    return !1;
-  try {
-    const r = new URL(e), n = new URL(t);
-    return n.protocol === r.protocol && n.hostname === r.hostname && n.port === r.port && (r.pathname === "/" || n.pathname.startsWith(r.pathname));
-  } catch {
-    return !1;
-  }
-}
-function ct(e, t) {
-  return ut(e.cors, t), lt(e.method, e.security, t), {
-    cors: e.cors,
-    method: e.method,
-    security: e.security
-  };
-}
-function ut(e, t) {
-  if (e)
-    try {
-      he(e);
-    } catch (r) {
-      t.push({
-        code: "cors-invalid",
-        message: r instanceof Error ? r.message : "CORS policy is invalid.",
-        severity: "error"
-      });
-    }
-}
-function lt(e, t, r) {
-  Qe.has(e) && (t?.csrf === !1 && r.push({
-    code: "csrf-disabled",
-    message: "CSRF protection is explicitly disabled for this unsafe route.",
-    severity: "info"
-  }), t?.rateLimit || r.push({
-    code: "rate-limit-missing",
-    message: "Unsafe routes should declare rate limiting.",
-    severity: "warning"
-  }), t?.request?.maxBodySize || r.push({
-    code: "request-body-limit-missing",
-    message: "Unsafe routes should declare a request body size limit.",
-    severity: "warning"
-  }));
-}
-function ft(e) {
-  try {
-    const t = new URL(e.src);
-    if (t.protocol === "http:" || t.protocol === "https:")
-      return t;
-  } catch {
-    return null;
-  }
-  return null;
-}
-function dt(e) {
-  return e.hostname === "www.googletagmanager.com" && (e.pathname === "/gtm.js" || e.pathname === "/ns.html");
-}
-class ht extends Error {
-  issues;
-  constructor(t) {
-    super(bt(t)), this.name = "EnvValidationError", this.issues = t;
-  }
-}
-function sr(e) {
-  return e;
-}
-function cr(e, t) {
-  const r = [], n = {};
-  for (const a of Object.keys(e)) {
-    const i = e[a], s = t[String(a)];
-    if (s === void 0 || s === "") {
-      if (i.optional) {
-        n[a] = void 0;
-        continue;
-      }
-      r.push({
-        code: "missing",
-        key: String(a),
-        message: `Environment variable ${String(a)} is required.`
-      });
-      continue;
-    }
-    try {
-      n[a] = i.parse(String(a), s);
-    } catch (o) {
-      r.push({
-        code: "invalid",
-        key: String(a),
-        message: o instanceof Error ? o.message : `Environment variable ${String(a)} is invalid.`
-      });
-    }
-  }
-  if (r.length)
-    throw new ht(r);
-  return n;
-}
-function mt(e = {}) {
-  return y(e, !1, (t, r) => {
-    if (r === "true" || r === "1")
-      return !0;
-    if (r === "false" || r === "0")
-      return !1;
-    throw new Error(`Environment variable ${t} must be true, false, 1, or 0.`);
-  });
-}
-function pt(e, t = {}) {
-  return y(t, !1, (r, n) => {
-    if (e.includes(n))
-      return n;
-    throw new Error(
-      `Environment variable ${r} must be one of: ${e.join(", ")}.`
-    );
-  });
-}
-function gt(e = {}) {
-  return y(e, !1, (t, r) => {
-    if (!/^-?\d+$/.test(r))
-      throw new Error(`Environment variable ${t} must be an integer.`);
-    const n = Number(r);
-    if (!Number.isSafeInteger(n))
-      throw new Error(`Environment variable ${t} must be a safe integer.`);
-    if (e.min !== void 0 && n < e.min)
-      throw new Error(
-        `Environment variable ${t} must be greater than or equal to ${e.min}.`
-      );
-    if (e.max !== void 0 && n > e.max)
-      throw new Error(
-        `Environment variable ${t} must be less than or equal to ${e.max}.`
-      );
-    return n;
-  });
-}
-function wt(e = {}) {
-  return y(
-    e,
-    !0,
-    (t, r) => j(t, r, e)
-  );
-}
-function yt(e = {}) {
-  return y(
-    e,
-    !1,
-    (t, r) => j(t, r, e)
-  );
-}
-function vt(e = {}) {
-  return y(e, !1, (t, r) => {
-    let n;
-    try {
-      n = new URL(r);
-    } catch {
-      throw new Error(`Environment variable ${t} must be a valid URL.`);
-    }
-    if (e.protocols?.length && !e.protocols.includes(n.protocol))
-      throw new Error(
-        `Environment variable ${t} must use one of these protocols: ${e.protocols.join(", ")}.`
-      );
-    return n;
-  });
-}
-const ur = {
-  boolean: mt,
-  enum: pt,
-  integer: gt,
-  secret: wt,
-  string: yt,
-  url: vt
-};
-function y(e, t, r) {
-  return {
-    optional: e.optional ?? !1,
-    parse: r,
-    sensitive: t
-  };
-}
-function j(e, t, r) {
-  if (r.minLength !== void 0 && t.length < r.minLength)
-    throw new Error(
-      `Environment variable ${e} must be at least ${r.minLength} characters.`
-    );
-  return t;
-}
-function bt(e) {
-  return e.length === 1 ? e[0].message : `Environment validation failed with ${e.length} issues.`;
-}
-function lr(e = {}) {
-  return async function(r) {
-    if (r.method.toUpperCase() !== "POST")
-      return new Response(null, {
-        headers: {
-          allow: "POST"
-        },
-        status: 405
-      });
-    const n = Et(r);
-    if (n)
-      return n;
-    const a = Rt(e, r);
-    if (a)
-      return a;
-    e.maxBodySize !== void 0 && (r = me({ maxBodySize: e.maxBodySize }, r));
-    let i;
-    try {
-      i = await r.json();
-    } catch (o) {
-      return o instanceof pe ? new Response("Security report body too large.", { status: 413 }) : new Response("Invalid security report JSON.", {
-        status: 400
-      });
-    }
-    const s = $t(i);
-    for (let o = 0; o < s.length; o += 1)
-      await e.onReport?.(s[o], {
-        index: o,
-        request: r
-      });
-    return new Response(null, {
-      status: 204
-    });
-  };
-}
-const St = /* @__PURE__ */ new Set([
-  "application/csp-report",
-  "application/reports+json"
-]);
-function Et(e) {
-  const t = e.headers.get("content-type");
-  if (!t)
-    return null;
-  const r = t.split(";", 1)[0]?.trim().toLowerCase();
-  return r && St.has(r) ? null : new Response("Unsupported security report Content-Type.", {
-    status: 415
-  });
-}
-function Rt(e, t) {
-  if (e.maxBodySize === void 0)
-    return null;
-  const r = t.headers.get("content-length");
-  if (!r)
-    return null;
-  if (!/^\d+$/.test(r))
-    return new Response("Invalid Content-Length.", {
-      status: 400
-    });
-  const n = Number(r);
-  return Number.isSafeInteger(n) ? n > A(e.maxBodySize) ? new Response("Security report body too large.", {
-    status: 413
-  }) : null : new Response("Invalid Content-Length.", {
-    status: 400
-  });
-}
-function $t(e) {
-  return Array.isArray(e) ? e : xt(e) && "csp-report" in e ? [e["csp-report"]] : [e];
-}
-function xt(e) {
-  return typeof e == "object" && e !== null;
-}
-function fr(e, t) {
-  const r = {}, n = [];
-  let a = 0;
-  for (const [i, s] of Object.entries(t.files)) {
-    const o = e.getAll(i).filter(It);
-    r[i] = o, s.required && o.length === 0 && n.push({
-      code: "file-missing",
-      field: i,
-      message: `Upload field ${i} requires at least one file.`
-    });
-    for (const u of o)
-      a += u.size, At(i, u, s, n);
-  }
-  return t.maxTotalSize !== void 0 && a > A(t.maxTotalSize) && n.push({
-    code: "total-upload-too-large",
-    field: "*",
-    message: `Uploaded files exceed the maximum total size of ${t.maxTotalSize}.`
-  }), {
-    files: r,
-    issues: n,
-    ok: n.length === 0,
-    totalSize: a
-  };
-}
-function At(e, t, r, n) {
-  r.maxSize !== void 0 && t.size > A(r.maxSize) && n.push({
-    code: "file-too-large",
-    field: e,
-    message: `Upload field ${e} contains ${t.name || "a file"} larger than ${r.maxSize}.`
-  }), r.types?.length && !Tt(t.type, r.types) && n.push({
-    code: "file-type-not-allowed",
-    field: e,
-    message: `Upload field ${e} contains ${t.name || "a file"} with disallowed type ${t.type || "unknown"}.`
-  });
-}
-function Tt(e, t) {
-  return t.some((r) => r.endsWith("/*") ? e.startsWith(r.slice(0, -1)) : e === r);
-}
-function It(e) {
-  return e instanceof File;
-}
-function kt(e, t) {
-  const r = t.headers.get("origin");
-  if (!r)
-    return {
-      allowed: !!e.allowMissingOrigin,
-      expected: e.origins,
-      origin: r,
-      reason: e.allowMissingOrigin ? void 0 : "missing-origin"
-    };
-  const n = q(r);
-  if (!n)
-    return {
-      allowed: !1,
-      expected: e.origins,
-      origin: r,
-      reason: "invalid-origin"
-    };
-  const a = Ct(e, n, t);
-  return {
-    allowed: a,
-    expected: e.origins,
-    origin: n,
-    reason: a ? void 0 : "origin-not-allowed"
-  };
-}
-function dr(e, t) {
-  return !e || kt(e, t).allowed ? null : new Response("WebSocket origin not allowed.", {
-    status: 403
-  });
-}
-function Ct(e, t, r) {
-  return e.origins === "same-origin" ? t === new URL(r.url).origin : e.origins.some(
-    (n) => Dt(n, t)
-  );
-}
-function Dt(e, t) {
-  return e === "null" ? t === "null" : q(e) === t;
-}
-function q(e) {
-  if (e === "null")
-    return e;
-  try {
-    if (e !== e.trim())
-      return null;
-    const t = e.indexOf("://");
-    if (t === -1)
-      return null;
-    const r = e.slice(t + 3);
-    if (!r || /[/?#]/.test(r))
-      return null;
-    const n = new URL(e);
-    return n.protocol !== "http:" && n.protocol !== "https:" || n.username || n.password ? null : n.origin;
-  } catch {
-    return null;
-  }
-}
 export {
-  ht as EnvValidationError,
-  se as HTTP_ERROR_STATUSES,
-  wr as HttpError,
-  Zt as Link,
-  Ht as action,
-  Wt as actionInput,
-  ar as analytics,
-  wn as assertAdapterCapabilities,
-  Je as auditScriptDependencies,
-  yn as checkAdapterCapabilities,
-  kt as checkWebSocketOrigin,
-  yr as createCache,
-  vr as createCorsHeaders,
-  br as createCsrfCookie,
-  Sr as createCsrfToken,
-  ke as createFileRouter,
-  Er as createInvalidation,
-  Rr as createMemoryCache,
-  $r as createMemoryCacheStore,
-  Gt as createMemoryIdempotencyStore,
-  xr as createMemoryRateLimitStore,
-  Ar as createRequestHandler,
-  or as createSecurityAudit,
-  de as createSecurityHeaders,
-  lr as createSecurityReportHandler,
-  Tr as cspHash,
-  vn as defineAdapter,
-  sr as defineEnvSchema,
-  tr as defineFonts,
-  Qt as defineImages,
-  ir as defineInstrumentation,
-  Ir as defineLinks,
-  kr as defineMetadata,
-  jt as defineOgImage,
-  Ft as defineRobots,
-  Cr as defineRoutePolicy,
-  Dr as defineScripts,
-  zr as defineSecurityPolicy,
-  Ut as defineSitemap,
-  Or as defineTags,
-  Pr as enforceAllowedMethods,
-  Lr as enforceCsrfProtection,
-  Nr as enforceRateLimit,
-  Ur as enforceRequestSecurity,
-  dr as enforceWebSocketOrigin,
-  ur as env,
-  er as font,
-  rr as fontPreloadLinks,
-  Mr as handleRequestWithManifest,
-  ee as href,
-  Fr as html,
-  ce as httpError,
-  Yt as hydrateFileRouter,
-  Xt as isAllowedImageSource,
-  le as isHttpError,
-  jr as issueCsrfToken,
-  qr as json,
-  Br as jsonl,
-  Hr as link,
-  Wr as mergeRoutePolicies,
-  _r as mergeRouteSecurityPolicies,
-  Vr as mergeSecurityPolicies,
-  Gr as meta,
-  Kr as modulePreload,
-  Yr as notFound,
-  _t as page,
-  A as parseBodySize,
-  D as parseCacheDuration,
-  Zr as parseCookieHeader,
-  Qr as parseRateLimitWindow,
-  Jt as planImageTransform,
-  Xr as preconnect,
-  Jr as preload,
-  en as query,
-  tn as redirect,
-  nr as renderFontFaceCss,
-  Bt as renderOgImageResponse,
-  ge as renderOgImageSvg,
-  pr as renderPageResponse,
-  qt as renderRobots,
-  Mt as renderSitemap,
-  rn as resolveLinks,
-  nn as resolveMetadata,
-  an as resolveScripts,
-  Q as response,
-  Kt as runIdempotentMutation,
-  fe as script,
-  on as security,
-  J as serializeCacheKey,
-  sn as serializeCacheNamespace,
-  cn as serializeCacheTag,
-  un as serverTiming,
-  ln as sse,
-  fn as stream,
-  dn as structuredData,
-  hn as tag,
-  mn as text,
-  X as toResponse,
-  he as validateCorsPolicy,
-  cr as validateEnv,
-  pn as validateRateLimitPolicy,
-  fr as validateUploads,
-  Vt as webhook
+  ke as EnvValidationError,
+  le as HTTP_ERROR_STATUSES,
+  ir as HttpError,
+  Ft as Link,
+  Qt as Script,
+  kt as action,
+  It as actionInput,
+  Gt as analytics,
+  Xt as assertAdapterCapabilities,
+  or as auditScriptDependencies,
+  Jt as checkAdapterCapabilities,
+  He as checkWebSocketOrigin,
+  sr as createCache,
+  cr as createCorsHeaders,
+  ur as createCsrfCookie,
+  lr as createCsrfToken,
+  We as createFileRouter,
+  fr as createInvalidation,
+  dr as createMemoryCache,
+  mr as createMemoryCacheStore,
+  vt as createMemoryIdempotencyStore,
+  hr as createMemoryRateLimitStore,
+  gr as createRequestHandler,
+  pr as createSecurityAudit,
+  wr as createSecurityHeaders,
+  Lt as createSecurityReportHandler,
+  yr as cspHash,
+  vr as cspNonce,
+  er as defineAdapter,
+  Dt as defineEnvSchema,
+  _t as defineFonts,
+  jt as defineImages,
+  Kt as defineInstrumentation,
+  br as defineLinks,
+  Er as defineMetadata,
+  Ct as defineMiddleware,
+  At as defineOgImage,
+  Rt as defineRobots,
+  Sr as defineRoutePolicy,
+  tr as defineScripts,
+  Rr as defineSecurityPolicy,
+  Et as defineSitemap,
+  Ar as defineTags,
+  $r as enforceAllowedMethods,
+  xr as enforceCsrfProtection,
+  kr as enforceRateLimit,
+  Ir as enforceRequestSecurity,
+  Pt as enforceWebSocketOrigin,
+  Ot as env,
+  Ht as font,
+  Vt as fontPreloadLinks,
+  Tr as handleRequestWithManifest,
+  ne as href,
+  Cr as html,
+  fe as httpError,
+  Ut as hydrateFileRouter,
+  Bt as isAllowedImageSource,
+  me as isHttpError,
+  zr as issueCsrfToken,
+  Dr as json,
+  Nr as jsonl,
+  Or as link,
+  Lr as mergeRoutePolicies,
+  Mr as mergeRouteSecurityPolicies,
+  Pr as mergeSecurityPolicies,
+  Ur as meta,
+  Fr as modulePreload,
+  jr as notFound,
+  Tt as page,
+  x as parseBodySize,
+  z as parseCacheDuration,
+  Br as parseCookieHeader,
+  qr as parseRateLimitWindow,
+  qt as planImageTransform,
+  Hr as preconnect,
+  _r as preload,
+  Vr as query,
+  Wr as redirect,
+  Wt as renderFontFaceCss,
+  xt as renderOgImageResponse,
+  ye as renderOgImageSvg,
+  rr as renderPageResponse,
+  $t as renderRobots,
+  St as renderSitemap,
+  Gr as resolveLinks,
+  Kr as resolveMetadata,
+  nr as resolveScripts,
+  J as response,
+  bt as runIdempotentMutation,
+  Q as script,
+  Yr as security,
+  X as serializeCacheKey,
+  Zr as serializeCacheNamespace,
+  Qr as serializeCacheTag,
+  Xr as serverTiming,
+  Jr as sse,
+  en as stream,
+  tn as structuredData,
+  rn as tag,
+  nn as text,
+  ee as toResponse,
+  an as validateCorsPolicy,
+  Nt as validateEnv,
+  on as validateRateLimitPolicy,
+  sn as validateRouteModules,
+  Mt as validateUploads,
+  zt as webhook
 };
 //# sourceMappingURL=index.js.map