@demiurgejs/core 0.1.1 → 0.2.0-beta.2

package/dist/index.js

@@ -1,33 +1,93 @@
-import { jsx as H } from "react/jsx-runtime";
-import { createContext as W, useState as I, useRef as k, useEffect as C, useMemo as _, createElement as f, useContext as V, Component as G } from "react";
-import { e as K, H as Y, f as Z } from "./chunks/ssr-BJejKlkZ.js";
-import { r as pr } from "./chunks/ssr-BJejKlkZ.js";
-import { g as Q, t as X, p as D, s as J, i as ee, c as P, l as te, j as L, k as re, N as z, m as ne, n as ae, o as ie, q as oe, H as se, u as ce, B as ue, v as le, w as fe, x as de, y as he, z as me, R as pe, A } from "./chunks/testing-DR3eQAvY.js";
-import { C as wr, D as yr, E as vr, F as br, G as Sr, I as Er, J as Rr, K as $r, b as xr, L as Ar, d as Tr, M as Ir, O as kr, P as Cr, Q as Dr, S as zr, T as Or, U as Pr, V as Lr, W as Nr, X as Ur, h as Mr, Y as Fr, Z as jr, _ as qr, $ as Br, a0 as Hr, a1 as Wr, a2 as _r, a3 as Vr, a4 as Gr, a5 as Kr, a6 as Yr, a7 as Zr, a8 as Qr, a9 as Xr, aa as Jr, ab as en, ac as tn, ad as rn, ae as nn, af as an, ag as on, ah as sn, ai as cn, aj as un, ak as ln, al as fn, am as dn, an as hn, ao as mn, ap as pn } from "./chunks/testing-DR3eQAvY.js";
-import { a as wn, c as yn, d as vn } from "./chunks/index-BnX9Qxbm.js";
+import { jsx as z } from "react/jsx-runtime";
+import { createContext as _, useState as T, useRef as I, useEffect as D, useMemo as V, createElement as f, useContext as W, Component as K } from "react";
+import { g as G, H as Z, h as N, i as Y, j as A } from "./chunks/request-metadata-D5NrT8ks.js";
+import { k as jt, l as Ft, m as Ht, d as Bt, n as qt, o as _t, q as Vt, t as Wt, u as Kt, p as Gt, a as Zt, v as Yt, w as Xt } from "./chunks/request-metadata-D5NrT8ks.js";
+import { p as C, l as X, n as J, t as Q, o as ee, R as te, q as $, u as re, k as M, w as ne, x as P, y as ae, N as O, z as ie, A as oe, B as se, C as ce, H as ue, D as le, E as fe, F as de } from "./chunks/testing-B_iMFYz_.js";
+import { G as Qt, I as er, J as tr, K as rr, L as nr, M as ar, O as ir, P as or, Q as sr, d as cr, c as ur, S as lr, f as fr, e as dr, T as mr, U as hr, V as pr, W as gr, X as wr, Y as yr, Z as vr, _ as br, $ as Sr, h as Er, a0 as Rr, a1 as Ar, a2 as xr, a3 as $r, a4 as kr, a5 as Tr, a6 as Ir, m as Dr, a7 as Nr, a8 as Cr, a9 as Or, aa as Lr, ab as zr, ac as Mr, ad as Pr, s as Ur, ae as jr, af as Fr, ag as Hr, ah as Br, ai as qr, aj as _r, ak as Vr, al as Wr, v as Kr, g as Gr, a as Zr } from "./chunks/testing-B_iMFYz_.js";
+import { k as me } from "./chunks/images-B9MqcjSA.js";
+import { d as Xr, l as Jr, m as Qr, n as en, f as tn, o as rn, q as nn, a as an, s as on, t as sn, b as cn, h as un, j as ln, r as fn } from "./chunks/images-B9MqcjSA.js";
 import "react-dom/server";
-function Ut(e) {
+const he = "24h", pe = 1e4;
+function mt(e = {}) {
+  const t = e.now ?? Date.now, r = e.defaultTtl ?? he, n = e.maximumEntries ?? pe;
+  if (!Number.isSafeInteger(n) || n <= 0)
+    throw new Error(
+      "Demiurge idempotency maximumEntries must be a positive integer."
+    );
+  const a = C(r);
+  if (!Number.isFinite(a))
+    throw new Error("Demiurge idempotency defaultTtl must be finite.");
+  const i = /* @__PURE__ */ new Map();
+  return {
+    async run(s) {
+      const o = X(s.key), u = t();
+      ge(i, u);
+      const d = i.get(o);
+      if (d && (d.pending || d.expiresAt > u))
+        return {
+          key: o,
+          replayed: !0,
+          value: await d.value
+        };
+      if (i.size >= n && we(i), i.size >= n)
+        throw new Error(
+          "Demiurge idempotency store is at capacity with in-flight mutations."
+        );
+      const g = Promise.resolve().then(s.fn), c = {
+        expiresAt: Number.POSITIVE_INFINITY,
+        pending: !0,
+        value: g
+      };
+      i.set(o, c);
+      try {
+        const l = await g;
+        return c.pending = !1, c.expiresAt = t() + C(s.ttl ?? r), {
+          key: o,
+          replayed: !1,
+          value: l
+        };
+      } catch (l) {
+        throw i.get(o) === c && i.delete(o), l;
+      }
+    }
+  };
+}
+function ge(e, t) {
+  for (const [r, n] of e)
+    !n.pending && n.expiresAt <= t && e.delete(r);
+}
+function we(e) {
+  for (const [t, r] of e)
+    if (!r.pending) {
+      e.delete(t);
+      return;
+    }
+}
+function ht(e, t) {
+  return e.run(t);
+}
+function pt(e) {
   return {
     entries: e
   };
 }
-function Mt(e) {
+function gt(e) {
   return [
     '<?xml version="1.0" encoding="UTF-8"?>',
     `<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"${e.entries.some((r) => r.alternates?.length) ? ' xmlns:xhtml="http://www.w3.org/1999/xhtml"' : ""}>`,
-    ...e.entries.map(we),
+    ...e.entries.map(ve),
     "</urlset>",
     ""
   ].join(`
 `);
 }
-function Ft(e) {
+function wt(e) {
   return e;
 }
-function jt(e) {
+function yt(e) {
   return e;
 }
-function qt(e) {
+function vt(e) {
   const t = [];
   for (const r of e.rules ?? []) {
     for (const n of b(r.userAgent))
@@ -45,9 +105,9 @@ function qt(e) {
 `).replace(/\n+$/, "")}
 `;
 }
-function ge(e) {
-  const t = e.width ?? 1200, r = e.height ?? 630, n = e.background ?? "#101820", a = e.foreground ?? "#ffffff", i = $(e.title, 120), s = e.subtitle ? $(e.subtitle, 160) : void 0, o = e.brand ? $(e.brand, 80) : void 0;
-  return be(t, r), [
+function ye(e) {
+  const t = e.width ?? 1200, r = e.height ?? 630, n = e.background ?? "#101820", a = e.foreground ?? "#ffffff", i = x(e.title, 120), s = e.subtitle ? x(e.subtitle, 160) : void 0, o = e.brand ? x(e.brand, 80) : void 0;
+  return Ee(t, r), [
     `<svg xmlns="http://www.w3.org/2000/svg" width="${t}" height="${r}" viewBox="0 0 ${t} ${r}" role="img" aria-label="${p(i)}">`,
     `  <rect width="100%" height="100%" fill="${p(n)}" />`,
     o ? `  <text x="72" y="96" fill="${p(a)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="32" font-weight="700">${w(o)}</text>` : null,
@@ -57,21 +117,21 @@ function ge(e) {
   ].filter((u) => !!u).join(`
 `);
 }
-function Bt(e) {
-  return new Response(ge(e), {
+function bt(e) {
+  return new Response(ye(e), {
     headers: {
       "cache-control": "public, max-age=31536000, immutable",
       "content-type": "image/svg+xml; charset=utf-8"
     }
   });
 }
-function we(e) {
+function ve(e) {
   return [
     "  <url>",
     `    <loc>${w(e.url)}</loc>`,
-    e.lastModified ? `    <lastmod>${w(ye(e.lastModified))}</lastmod>` : null,
+    e.lastModified ? `    <lastmod>${w(be(e.lastModified))}</lastmod>` : null,
     e.changeFrequency ? `    <changefreq>${e.changeFrequency}</changefreq>` : null,
-    e.priority !== void 0 ? `    <priority>${ve(e.priority)}</priority>` : null,
+    e.priority !== void 0 ? `    <priority>${Se(e.priority)}</priority>` : null,
     ...(e.alternates ?? []).map(
       (t) => `    <xhtml:link rel="alternate" hreflang="${p(t.hrefLang)}" href="${p(t.href)}" />`
     ),
@@ -79,10 +139,10 @@ function we(e) {
   ].filter((t) => !!t).join(`
 `);
 }
-function ye(e) {
+function be(e) {
   return e instanceof Date ? e.toISOString() : e;
 }
-function ve(e) {
+function Se(e) {
   if (e < 0 || e > 1)
     throw new Error("Sitemap entry priority must be between 0 and 1.");
   return String(e);
@@ -96,22 +156,22 @@ function w(e) {
 function p(e) {
   return w(e).replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 }
-function $(e, t) {
+function x(e, t) {
   return e.length > t ? `${e.slice(0, t - 3)}...` : e;
 }
-function be(e, t) {
+function Ee(e, t) {
   if (!Number.isSafeInteger(e) || e <= 0)
     throw new Error("OG image width must be a positive integer.");
   if (!Number.isSafeInteger(t) || t <= 0)
     throw new Error("OG image height must be a positive integer.");
 }
-function Ht(e) {
-  return Q(
+function St(e) {
+  return J(
     async (t) => {
       const r = e.input ? await e.input(t) : void 0, n = {
         ...t,
         input: r
-      }, a = async () => await Se(
+      }, a = async () => await Re(
         await e.handler(n),
         t
       );
@@ -131,7 +191,7 @@ function Ht(e) {
     }
   );
 }
-const Wt = {
+const Et = {
   async formData({ request: e }) {
     return await e.formData();
   },
@@ -142,10 +202,10 @@ const Wt = {
     return await e.text();
   }
 };
-async function Se(e, t) {
-  return e instanceof Response ? e : await X(e, t);
+async function Re(e, t) {
+  return e instanceof Response ? e : await Q(e, t);
 }
-function _t(e) {
+function Rt(e) {
   return typeof e == "function" ? {
     kind: "page",
     render: { mode: "ssr" },
@@ -158,7 +218,10 @@ function _t(e) {
     view: e.view
   };
 }
-const Vt = {
+function At(e) {
+  return e;
+}
+const xt = {
   hmac(e) {
     return {
       kind: "response",
@@ -166,7 +229,7 @@ const Vt = {
         const r = new Uint8Array(await t.request.arrayBuffer()), n = t.request.headers.get(
           e.header ?? "x-webhook-signature"
         );
-        return n ? await Ee(r, n, e) ? await e.handler({
+        return n ? await Ae(r, n, e) ? await e.handler({
           ...t,
           rawBody: r,
           text: () => new TextDecoder().decode(r)
@@ -182,8 +245,8 @@ const Vt = {
     };
   }
 };
-async function Ee(e, t, r) {
-  const n = r.algorithm ?? "SHA-256", a = r.encoding ?? "hex", i = Re(
+async function Ae(e, t, r) {
+  const n = r.algorithm ?? "SHA-256", a = r.encoding ?? "hex", i = xe(
     t,
     n,
     r.prefix
@@ -207,7 +270,7 @@ async function Ee(e, t, r) {
     Uint8Array.from(e).buffer
   );
 }
-function Re(e, t, r) {
+function xe(e, t, r) {
   const n = e.trim(), a = r === void 0 ? `${t.toLowerCase().replace("-", "")}=` : r;
   return a !== !1 && n.startsWith(a) ? n.slice(a.length).trim() : n;
 }
@@ -228,514 +291,709 @@ function $e(e, t) {
     return null;
   }
 }
-const xe = "24h", Ae = 1e4;
-function Gt(e = {}) {
-  const t = e.now ?? Date.now, r = e.defaultTtl ?? xe, n = e.maximumEntries ?? Ae;
-  if (!Number.isSafeInteger(n) || n <= 0)
-    throw new Error(
-      "Demiurge idempotency maximumEntries must be a positive integer."
-    );
-  const a = D(r);
-  if (!Number.isFinite(a))
-    throw new Error("Demiurge idempotency defaultTtl must be finite.");
-  const i = /* @__PURE__ */ new Map();
-  return {
-    async run(s) {
-      const o = J(s.key), u = t();
-      Te(i, u);
-      const d = i.get(o);
-      if (d && (d.pending || d.expiresAt > u))
-        return {
-          key: o,
-          replayed: !0,
-          value: await d.value
-        };
-      if (i.size >= n && Ie(i), i.size >= n)
-        throw new Error(
-          "Demiurge idempotency store is at capacity with in-flight mutations."
-        );
-      const g = Promise.resolve().then(s.fn), c = {
-        expiresAt: Number.POSITIVE_INFINITY,
-        pending: !0,
-        value: g
-      };
-      i.set(o, c);
-      try {
-        const l = await g;
-        return c.pending = !1, c.expiresAt = t() + D(s.ttl ?? r), {
-          key: o,
-          replayed: !1,
-          value: l
-        };
-      } catch (l) {
-        throw i.get(o) === c && i.delete(o), l;
-      }
-    }
-  };
-}
-function Te(e, t) {
-  for (const [r, n] of e)
-    !n.pending && n.expiresAt <= t && e.delete(r);
-}
-function Ie(e) {
-  for (const [t, r] of e)
-    if (!r.pending) {
-      e.delete(t);
-      return;
-    }
+class ke extends Error {
+  issues;
+  constructor(t) {
+    super(Le(t)), this.name = "EnvValidationError", this.issues = t;
+  }
 }
-function Kt(e, t) {
-  return e.run(t);
+function $t(e) {
+  return e;
 }
-function ke(e) {
-  const t = P(e.routes), r = e.loadNavigationData ?? U;
-  return function() {
-    const [a, i] = I(() => S()), [s, o] = I(
-      () => e.initialMatch ?? { status: "loading" }
-    ), u = k(!!e.initialMatch), d = k(0);
-    C(() => {
-      function c() {
-        i(S());
+function kt(e, t) {
+  const r = [], n = {};
+  for (const a of Object.keys(e)) {
+    const i = e[a], s = t[String(a)];
+    if (s === void 0 || s === "") {
+      if (i.optional) {
+        n[a] = void 0;
+        continue;
       }
-      return window.addEventListener("popstate", c), () => window.removeEventListener("popstate", c);
-    }, []), C(() => {
-      let c = !1, l = !1;
-      const h = ++d.current, R = new AbortController(), v = () => !c && h === d.current;
-      if (u.current && De(e.initialMatch) === a.pathname)
-        return u.current = !1, () => {
-          c = !0;
-        };
-      o({ status: "loading" }), te(t, a.pathname).then((m) => {
-        v() && !l && m && o({ loading: m, status: "loading" });
-      }).catch(() => {
+      r.push({
+        code: "missing",
+        key: String(a),
+        message: `Environment variable ${String(a)} is required.`
+      });
+      continue;
+    }
+    try {
+      n[a] = i.parse(String(a), s);
+    } catch (o) {
+      r.push({
+        code: "invalid",
+        key: String(a),
+        message: o instanceof Error ? o.message : `Environment variable ${String(a)} is invalid.`
       });
-      const T = new Request(a.href, { signal: R.signal });
-      return Promise.resolve(r(T)).then(
-        (m) => L(
-          t,
-          a.pathname,
-          T,
-          m,
-          void 0,
-          { documentContributions: !1 }
-        )
-      ).then((m) => {
-        l = !0, v() && o(m);
-      }).catch(async (m) => {
-        if (l = !0, !v() || R.signal.aborted)
-          return;
-        const B = await re(
-          t,
-          a.pathname
-        );
-        v() && o({
-          Error: B,
-          error: m,
-          pathname: a.pathname,
-          status: "error"
-        });
-      }), () => {
-        c = !0, R.abort();
-      };
-    }, [a.pathname, a.search]);
-    const g = _(
-      () => ({
-        navigation: e.navigation ?? "server",
-        push(c) {
-          const l = S();
-          window.history.pushState(null, "", c);
-          const h = S();
-          i(h), l.pathname === h.pathname && l.search === h.search && l.hash !== h.hash && Ne(h.hash);
-        }
-      }),
-      []
-    );
-    return f(M.Provider, {
-      value: g,
-      children: f(Oe, {
-        key: `${a.pathname}${a.search}`,
-        Loading: e.loading,
-        NotFound: e.notFound,
-        match: s
-      })
-    });
-  };
-}
-function Ce(e, t) {
-  const r = t.getAttribute(Z);
-  return e.status === "not-found" ? r === "not-found" : e.status === "ready" && r === null;
-}
-function De(e) {
-  if (e)
-    return e.status === "ready" ? e.match.pathname : e.status === "loading" ? void 0 : e.pathname;
-}
-async function Yt(e) {
-  const t = e.root ?? document.getElementById("root");
-  if (!t)
-    throw new Error(
-      "Demiurge expected a #root element in the framework document."
-    );
-  const r = P(e.routes), n = e.loadNavigationData ?? U, a = e.initialData ?? K(document), i = await L(
-    r,
-    window.location.pathname,
-    new Request(window.location.href),
-    a ?? await n(new Request(window.location.href)),
-    void 0,
-    { documentContributions: !1 }
-  ), s = Ce(i, t), o = ke(
-    s ? {
-      ...e,
-      initialMatch: i,
-      loadNavigationData: n,
-      navigation: a?.navigation ?? e.navigation
-    } : {
-      ...e,
-      loadNavigationData: n,
-      navigation: a?.navigation ?? e.navigation
     }
-  ), { createRoot: u, hydrateRoot: d } = ze(
-    await import("react-dom/client")
-  );
-  if (s && t.hasAttribute(Y)) {
-    d(t, f(o));
-    return;
   }
-  t.replaceChildren(), u(t).render(f(o));
+  if (r.length)
+    throw new ke(r);
+  return n;
 }
-function ze(e) {
-  const t = typeof e.createRoot == "function" && typeof e.hydrateRoot == "function" ? e : e.default;
-  if (!t || typeof t.createRoot != "function" || typeof t.hydrateRoot != "function")
+function Te(e = {}) {
+  return y(e, !1, (t, r) => {
+    if (r === "true" || r === "1")
+      return !0;
+    if (r === "false" || r === "0")
+      return !1;
+    throw new Error(`Environment variable ${t} must be true, false, 1, or 0.`);
+  });
+}
+function Ie(e, t = {}) {
+  return y(t, !1, (r, n) => {
+    if (e.includes(n))
+      return n;
     throw new Error(
-      "Demiurge could not load the React DOM client from the Vite module."
+      `Environment variable ${r} must be one of: ${e.join(", ")}.`
     );
-  return t;
+  });
 }
-function Zt(e) {
-  const t = Me(), r = ee(e);
-  return /* @__PURE__ */ H(
-    "a",
-    {
-      className: e.className,
-      href: r,
-      onClick: (n) => {
-        t.navigation === "server" && Ue(n) && (n.preventDefault(), t.push(r));
-      },
-      children: e.children
-    }
+function De(e = {}) {
+  return y(e, !1, (t, r) => {
+    if (!/^-?\d+$/.test(r))
+      throw new Error(`Environment variable ${t} must be an integer.`);
+    const n = Number(r);
+    if (!Number.isSafeInteger(n))
+      throw new Error(`Environment variable ${t} must be a safe integer.`);
+    if (e.min !== void 0 && n < e.min)
+      throw new Error(
+        `Environment variable ${t} must be greater than or equal to ${e.min}.`
+      );
+    if (e.max !== void 0 && n > e.max)
+      throw new Error(
+        `Environment variable ${t} must be less than or equal to ${e.max}.`
+      );
+    return n;
+  });
+}
+function Ne(e = {}) {
+  return y(
+    e,
+    !0,
+    (t, r) => U(t, r, e)
   );
 }
-function Oe({
-  Loading: e,
-  NotFound: t,
-  match: r
-}) {
-  if (r.status === "loading") {
-    const c = r.loading ?? e;
-    return c ? f(c) : null;
-  }
-  if (r.status === "not-found") {
-    const c = r.notFound ?? t ?? ue;
-    return r.layouts.reduceRight(
-      (l, h) => f(h, {
-        children: l,
-        path: {},
-        pathname: r.pathname
-      }),
-      f(c, { pathname: r.pathname })
-    );
-  }
-  if (r.status === "error")
-    return r.Error ? f(r.Error, {
-      error: r.error,
-      pathname: r.pathname,
-      status: N(r.error)
-    }) : null;
-  const { data: n, error: a, page: i, layouts: s, path: o, pathname: u } = r.match, d = f(i, { data: n, path: o, pathname: u }), g = s.reduceRight(
-    (c, l) => f(l, { path: o, pathname: u, children: c }),
-    d
+function Ce(e = {}) {
+  return y(
+    e,
+    !1,
+    (t, r) => U(t, r, e)
   );
-  return f(Pe, {
-    Error: a,
-    children: g,
-    pathname: u
-  });
-}
-class Pe extends G {
-  static getDerivedStateFromError(t) {
-    return { error: t };
-  }
-  state = {};
-  componentDidUpdate(t) {
-    this.state.error !== void 0 && t.pathname !== this.props.pathname && this.setState({ error: void 0 });
-  }
-  render() {
-    return this.state.error !== void 0 ? this.props.Error ? f(this.props.Error, {
-      error: this.state.error,
-      pathname: this.props.pathname,
-      status: N(this.state.error)
-    }) : null : this.props.children;
-  }
 }
-function N(e) {
-  return le(e) ? e.status : 500;
+function Oe(e = {}) {
+  return y(e, !1, (t, r) => {
+    let n;
+    try {
+      n = new URL(r);
+    } catch {
+      throw new Error(`Environment variable ${t} must be a valid URL.`);
+    }
+    if (e.protocols?.length && !e.protocols.includes(n.protocol))
+      throw new Error(
+        `Environment variable ${t} must use one of these protocols: ${e.protocols.join(", ")}.`
+      );
+    return n;
+  });
 }
-function S() {
+const Tt = {
+  boolean: Te,
+  enum: Ie,
+  integer: De,
+  secret: Ne,
+  string: Ce,
+  url: Oe
+};
+function y(e, t, r) {
   return {
-    hash: window.location.hash,
-    href: window.location.href,
-    pathname: window.location.pathname,
-    search: window.location.search
+    optional: e.optional ?? !1,
+    parse: r,
+    sensitive: t
   };
 }
-async function U(e) {
-  const t = new Headers(e.headers);
-  t.set("accept", "application/json"), t.set(z, ne);
-  const r = await fetch(new Request(e, {
-    credentials: "same-origin",
-    headers: t
-  })), n = r.headers.get(z);
-  if (n === ae) {
-    const a = await r.json();
-    if (a.hasData !== !0)
-      throw new Error("Demiurge received malformed navigation route data.");
-    return { data: a.data, hasData: !0 };
-  }
-  if (n === ie)
-    return { hasData: !0 };
-  if (n === oe || !r.ok) {
-    const a = await Le(r), i = se.includes(
-      r.status
-    ) ? r.status : 500;
-    throw ce(i, {
-      detail: typeof a?.detail == "string" ? a.detail : void 0,
-      title: typeof a?.title == "string" ? a.title : void 0
-    });
-  }
-  throw new Error(
-    "Demiurge expected a navigation data response from the application server."
-  );
+function U(e, t, r) {
+  if (r.minLength !== void 0 && t.length < r.minLength)
+    throw new Error(
+      `Environment variable ${e} must be at least ${r.minLength} characters.`
+    );
+  return t;
 }
-async function Le(e) {
-  try {
-    return await e.json();
-  } catch {
-    return;
-  }
+function Le(e) {
+  return e.length === 1 ? e[0].message : `Environment validation failed with ${e.length} issues.`;
 }
-function Ne(e) {
-  queueMicrotask(() => {
-    if (!e) {
-      window.scrollTo?.(0, 0);
-      return;
-    }
-    let t;
+function It(e = {}) {
+  return async function(r) {
+    if (r.method.toUpperCase() !== "POST")
+      return new Response(null, {
+        headers: {
+          allow: "POST"
+        },
+        status: 405
+      });
+    const n = Me(r);
+    if (n)
+      return n;
+    const a = Pe(e, r);
+    if (a)
+      return a;
+    e.maxBodySize !== void 0 && (r = ee({ maxBodySize: e.maxBodySize }, r));
+    let i;
     try {
-      t = decodeURIComponent(e.slice(1));
-    } catch {
-      t = e.slice(1);
+      i = await r.json();
+    } catch (o) {
+      return o instanceof te ? new Response("Security report body too large.", { status: 413 }) : new Response("Invalid security report JSON.", {
+        status: 400
+      });
     }
-    document.getElementById(t)?.scrollIntoView?.();
+    const s = Ue(i);
+    for (let o = 0; o < s.length; o += 1)
+      await e.onReport?.(s[o], {
+        index: o,
+        request: r
+      });
+    return new Response(null, {
+      status: 204
+    });
+  };
+}
+const ze = /* @__PURE__ */ new Set([
+  "application/csp-report",
+  "application/reports+json"
+]);
+function Me(e) {
+  const t = e.headers.get("content-type");
+  if (!t)
+    return null;
+  const r = t.split(";", 1)[0]?.trim().toLowerCase();
+  return r && ze.has(r) ? null : new Response("Unsupported security report Content-Type.", {
+    status: 415
+  });
+}
+function Pe(e, t) {
+  if (e.maxBodySize === void 0)
+    return null;
+  const r = t.headers.get("content-length");
+  if (!r)
+    return null;
+  if (!/^\d+$/.test(r))
+    return new Response("Invalid Content-Length.", {
+      status: 400
+    });
+  const n = Number(r);
+  return Number.isSafeInteger(n) ? n > $(e.maxBodySize) ? new Response("Security report body too large.", {
+    status: 413
+  }) : null : new Response("Invalid Content-Length.", {
+    status: 400
   });
 }
 function Ue(e) {
-  return e.button === 0 && !e.metaKey && !e.altKey && !e.ctrlKey && !e.shiftKey;
+  return Array.isArray(e) ? e : je(e) && "csp-report" in e ? [e["csp-report"]] : [e];
 }
-const M = W({
-  navigation: "document",
-  push(e) {
-    window.location.href = e;
+function je(e) {
+  return typeof e == "object" && e !== null;
+}
+function Dt(e, t) {
+  const r = {}, n = [];
+  let a = 0;
+  for (const [i, s] of Object.entries(t.files)) {
+    const o = e.getAll(i).filter(Be);
+    r[i] = o, s.required && o.length === 0 && n.push({
+      code: "file-missing",
+      field: i,
+      message: `Upload field ${i} requires at least one file.`
+    });
+    for (const u of o)
+      a += u.size, Fe(i, u, s, n);
   }
-});
-function Me() {
-  return V(M);
+  return t.maxTotalSize !== void 0 && a > $(t.maxTotalSize) && n.push({
+    code: "total-upload-too-large",
+    field: "*",
+    message: `Uploaded files exceed the maximum total size of ${t.maxTotalSize}.`
+  }), {
+    files: r,
+    issues: n,
+    ok: n.length === 0,
+    totalSize: a
+  };
 }
-const Fe = "/_demiurge/image";
-function Qt(e) {
-  return e;
+function Fe(e, t, r, n) {
+  r.maxSize !== void 0 && t.size > $(r.maxSize) && n.push({
+    code: "file-too-large",
+    field: e,
+    message: `Upload field ${e} contains ${t.name || "a file"} larger than ${r.maxSize}.`
+  }), r.types?.length && !He(t.type, r.types) && n.push({
+    code: "file-type-not-allowed",
+    field: e,
+    message: `Upload field ${e} contains ${t.name || "a file"} with disallowed type ${t.type || "unknown"}.`
+  });
+}
+function He(e, t) {
+  return t.some((r) => r.endsWith("/*") ? e.startsWith(r.slice(0, -1)) : e === r);
 }
-function Xt(e, t = {}) {
-  return F(e, t) !== null;
+function Be(e) {
+  return e instanceof File;
 }
-function Jt(e, t = {}) {
-  const r = F(e.src, t);
+function qe(e, t) {
+  const r = t.headers.get("origin");
   if (!r)
-    throw new Error(`Image source "${e.src}" is not allowed by the image policy.`);
-  x("width", e.width), x("height", e.height), We(e.quality);
-  const n = e.format ?? "auto", i = _e(e.width, e.widths).map((o) => {
-    const u = Math.round(e.height / e.width * o);
     return {
-      format: n,
-      height: u,
-      src: Ve({
-        format: n,
-        optimizerPath: t.optimizerPath ?? Fe,
-        quality: e.quality,
-        src: e.src,
-        width: o
-      }),
-      width: o
+      allowed: !!e.allowMissingOrigin,
+      expected: e.origins,
+      origin: r,
+      reason: e.allowMissingOrigin ? void 0 : "missing-origin"
+    };
+  const n = j(r);
+  if (!n)
+    return {
+      allowed: !1,
+      expected: e.origins,
+      origin: r,
+      reason: "invalid-origin"
     };
-  }), s = i[0];
+  const a = _e(e, n, t);
   return {
-    alt: e.alt,
-    decoding: "async",
-    fetchPriority: e.priority ? "high" : void 0,
-    height: e.height,
-    loading: e.priority ? "eager" : "lazy",
-    sizes: e.sizes,
-    source: r,
-    src: s.src,
-    srcSet: i.map((o) => `${o.src} ${o.width}w`).join(", "),
-    variants: i,
-    width: e.width
+    allowed: a,
+    expected: e.origins,
+    origin: n,
+    reason: a ? void 0 : "origin-not-allowed"
   };
 }
-function F(e, t) {
-  if (e.startsWith("/") && !e.startsWith("//"))
-    return t.local === !1 ? null : { kind: "local", src: e };
-  let r;
-  try {
-    r = new URL(e);
-  } catch {
-    return null;
-  }
-  return r.protocol !== "https:" && r.protocol !== "http:" ? null : je(r, t.remote ?? []) ? { kind: "remote", src: r.toString() } : null;
+function Nt(e, t) {
+  return !e || qe(e, t).allowed ? null : new Response("WebSocket origin not allowed.", {
+    status: 403
+  });
 }
-function je(e, t) {
-  return t.some(
-    (r) => typeof r == "string" ? qe(e, r) : Be(e, r)
+function _e(e, t, r) {
+  return e.origins === "same-origin" ? t === new URL(r.url).origin : e.origins.some(
+    (n) => Ve(n, t)
   );
 }
-function qe(e, t) {
+function Ve(e, t) {
+  return e === "null" ? t === "null" : j(e) === t;
+}
+function j(e) {
+  if (e === "null")
+    return e;
   try {
-    return e.origin === new URL(t).origin;
+    if (e !== e.trim())
+      return null;
+    const t = e.indexOf("://");
+    if (t === -1)
+      return null;
+    const r = e.slice(t + 3);
+    if (!r || /[/?#]/.test(r))
+      return null;
+    const n = new URL(e);
+    return n.protocol !== "http:" && n.protocol !== "https:" || n.username || n.password ? null : n.origin;
   } catch {
-    return !1;
+    return null;
   }
 }
-function Be(e, t) {
-  return t.protocol && e.protocol !== t.protocol || e.hostname !== t.hostname || t.port !== void 0 && e.port !== t.port ? !1 : t.pathname ? He(e.pathname, t.pathname) : !0;
-}
-function He(e, t) {
-  return t.endsWith("*") ? e.startsWith(t.slice(0, -1)) : e === t;
-}
-function x(e, t) {
-  if (!Number.isInteger(t) || t <= 0)
-    throw new Error(`Image ${e} must be a positive integer.`);
-}
 function We(e) {
-  if (e !== void 0 && (!Number.isInteger(e) || e < 1 || e > 100))
-    throw new Error("Image quality must be an integer between 1 and 100.");
-}
-function _e(e, t) {
-  const r = t ?? [e, e * 2], n = [...new Set(r)];
-  for (const a of n)
-    x("width", a);
-  return n.sort((a, i) => a - i);
-}
-function Ve({
-  format: e,
-  optimizerPath: t,
-  quality: r,
-  src: n,
-  width: a
-}) {
-  const i = new URLSearchParams({
-    src: n,
-    w: String(a)
-  });
-  return r !== void 0 && i.set("q", String(r)), e !== "auto" && i.set("f", e), `${t}?${i.toString()}`;
-}
-const er = {
-  google(e) {
-    return {
-      display: e.display ?? "swap",
-      family: e.family,
-      kind: "font",
-      source: "google",
-      src: e.src,
-      style: e.style ?? "normal",
-      weight: e.weight ?? 400
-    };
-  },
-  local(e) {
-    if (!e.src.trim())
-      throw new Error("Local font source must not be empty.");
-    return {
-      display: e.display ?? "swap",
-      family: e.name,
-      kind: "font",
-      source: "local",
-      src: e.src,
-      style: e.style ?? "normal",
-      weight: e.weight ?? 400
-    };
-  }
-};
-function tr(e) {
-  return [...e];
-}
-function rr(e) {
-  return e.filter((t) => t.src).map((t) => ({
-    as: "font",
-    crossOrigin: "anonymous",
-    href: t.src,
-    kind: "link",
-    rel: "preload",
-    type: Ge(t.src)
-  }));
-}
-function nr(e) {
-  return e.filter((t) => t.source === "local" && t.src).map((t) => {
-    const r = t.src;
-    return [
-      "@font-face {",
-      `  font-family: "${O(t.family)}";`,
-      `  src: url("${O(r)}") format("${Ke(r)}");`,
-      `  font-style: ${t.style};`,
-      `  font-weight: ${t.weight};`,
-      `  font-display: ${t.display};`,
-      "}"
-    ].join(`
-`);
-  }).join(`
-`);
-}
-function Ge(e) {
-  return e.split("?")[0].split("#")[0].split(".").pop()?.toLowerCase() === "woff" ? "font/woff" : "font/woff2";
+  const t = M(e.routes), r = e.loadNavigationData ?? H;
+  return function() {
+    const [a, i] = T(() => S()), [s, o] = T(
+      () => e.initialMatch ?? { status: "loading" }
+    ), u = I(!!e.initialMatch), d = I(0);
+    D(() => {
+      function c() {
+        i(S());
+      }
+      return window.addEventListener("popstate", c), () => window.removeEventListener("popstate", c);
+    }, []), D(() => {
+      let c = !1, l = !1;
+      const m = ++d.current, R = new AbortController(), v = () => !c && m === d.current;
+      if (u.current && Ge(e.initialMatch) === a.pathname)
+        return u.current = !1, () => {
+          c = !0;
+        };
+      o({ status: "loading" }), ne(t, a.pathname).then((h) => {
+        v() && !l && h && o({ loading: h, status: "loading" });
+      }).catch(() => {
+      });
+      const k = new Request(a.href, { signal: R.signal });
+      return Promise.resolve(r(k)).then(
+        (h) => P(
+          t,
+          a.pathname,
+          k,
+          h,
+          void 0,
+          { documentContributions: !1 }
+        )
+      ).then((h) => {
+        l = !0, v() && o(h);
+      }).catch(async (h) => {
+        if (l = !0, !v() || R.signal.aborted)
+          return;
+        const q = await ae(
+          t,
+          a.pathname
+        );
+        v() && o({
+          Error: q,
+          error: h,
+          pathname: a.pathname,
+          status: "error"
+        });
+      }), () => {
+        c = !0, R.abort();
+      };
+    }, [a.pathname, a.search]);
+    const g = V(
+      () => ({
+        navigation: e.navigation ?? "server",
+        push(c) {
+          const l = S();
+          window.history.pushState(null, "", c);
+          const m = S();
+          i(m), l.pathname === m.pathname && l.search === m.search && l.hash !== m.hash && Qe(m.hash);
+        }
+      }),
+      []
+    );
+    return f(B.Provider, {
+      value: g,
+      children: f(Ye, {
+        key: `${a.pathname}${a.search}`,
+        Loading: e.loading,
+        NotFound: e.notFound,
+        match: s
+      })
+    });
+  };
+}
+function Ke(e, t) {
+  const r = t.getAttribute(Y);
+  return e.status === "not-found" ? r === "not-found" : e.status === "ready" && r === null;
+}
+function Ge(e) {
+  if (e)
+    return e.status === "ready" ? e.match.pathname : e.status === "loading" ? void 0 : e.pathname;
+}
+async function Ct(e) {
+  const t = e.root ?? document.getElementById("root");
+  if (!t)
+    throw new Error(
+      "Demiurge expected a #root element in the framework document."
+    );
+  const r = M(e.routes), n = e.loadNavigationData ?? H, a = e.initialData ?? G(document), i = await P(
+    r,
+    window.location.pathname,
+    new Request(window.location.href),
+    a ?? await n(new Request(window.location.href)),
+    void 0,
+    { documentContributions: !1 }
+  ), s = Ke(i, t), o = We(
+    s ? {
+      ...e,
+      initialMatch: i,
+      loadNavigationData: n,
+      navigation: a?.navigation ?? e.navigation
+    } : {
+      ...e,
+      loadNavigationData: n,
+      navigation: a?.navigation ?? e.navigation
+    }
+  ), { createRoot: u, hydrateRoot: d } = Ze(
+    await import("react-dom/client")
+  );
+  if (s && t.hasAttribute(Z)) {
+    d(t, f(o)), N();
+    return;
+  }
+  t.replaceChildren(), u(t).render(f(o)), N();
+}
+function Ze(e) {
+  const t = typeof e.createRoot == "function" && typeof e.hydrateRoot == "function" ? e : e.default;
+  if (!t || typeof t.createRoot != "function" || typeof t.hydrateRoot != "function")
+    throw new Error(
+      "Demiurge could not load the React DOM client from the Vite module."
+    );
+  return t;
+}
+function Ot(e) {
+  const t = tt(), r = re(e);
+  return /* @__PURE__ */ z(
+    "a",
+    {
+      className: e.className,
+      href: r,
+      onClick: (n) => {
+        t.navigation === "server" && et(n) && (n.preventDefault(), t.push(r));
+      },
+      children: e.children
+    }
+  );
+}
+function Ye({
+  Loading: e,
+  NotFound: t,
+  match: r
+}) {
+  if (r.status === "loading") {
+    const c = r.loading ?? e;
+    return c ? f(c) : null;
+  }
+  if (r.status === "not-found") {
+    const c = r.notFound ?? t ?? fe;
+    return r.layouts.reduceRight(
+      (l, m) => f(m, {
+        children: l,
+        path: {},
+        pathname: r.pathname
+      }),
+      f(c, { pathname: r.pathname })
+    );
+  }
+  if (r.status === "error")
+    return r.Error ? f(r.Error, {
+      error: r.error,
+      pathname: r.pathname,
+      status: F(r.error)
+    }) : null;
+  const { data: n, error: a, page: i, layouts: s, path: o, pathname: u } = r.match, d = f(i, { data: n, path: o, pathname: u }), g = s.reduceRight(
+    (c, l) => f(l, { path: o, pathname: u, children: c }),
+    d
+  );
+  return f(Xe, {
+    Error: a,
+    children: g,
+    pathname: u
+  });
 }
-function Ke(e) {
-  return e.split("?")[0].split("#")[0].split(".").pop()?.toLowerCase() === "woff" ? "woff" : "woff2";
+class Xe extends K {
+  static getDerivedStateFromError(t) {
+    return { error: t };
+  }
+  state = {};
+  componentDidUpdate(t) {
+    this.state.error !== void 0 && t.pathname !== this.props.pathname && this.setState({ error: void 0 });
+  }
+  render() {
+    return this.state.error !== void 0 ? this.props.Error ? f(this.props.Error, {
+      error: this.state.error,
+      pathname: this.props.pathname,
+      status: F(this.state.error)
+    }) : null : this.props.children;
+  }
+}
+function F(e) {
+  return de(e) ? e.status : 500;
+}
+function S() {
+  return {
+    hash: window.location.hash,
+    href: window.location.href,
+    pathname: window.location.pathname,
+    search: window.location.search
+  };
+}
+async function H(e) {
+  const t = new Headers(e.headers);
+  t.set("accept", "application/json"), t.set(O, ie);
+  const r = await fetch(new Request(e, {
+    credentials: "same-origin",
+    headers: t
+  })), n = r.headers.get(O);
+  if (n === oe) {
+    const a = await r.json();
+    if (a.hasData !== !0)
+      throw new Error("Demiurge received malformed navigation route data.");
+    return { data: a.data, hasData: !0 };
+  }
+  if (n === se)
+    return { hasData: !0 };
+  if (n === ce || !r.ok) {
+    const a = await Je(r), i = ue.includes(
+      r.status
+    ) ? r.status : 500;
+    throw le(i, {
+      detail: typeof a?.detail == "string" ? a.detail : void 0,
+      title: typeof a?.title == "string" ? a.title : void 0
+    });
+  }
+  throw new Error(
+    "Demiurge expected a navigation data response from the application server."
+  );
+}
+async function Je(e) {
+  try {
+    return await e.json();
+  } catch {
+    return;
+  }
+}
+function Qe(e) {
+  queueMicrotask(() => {
+    if (!e) {
+      window.scrollTo?.(0, 0);
+      return;
+    }
+    let t;
+    try {
+      t = decodeURIComponent(e.slice(1));
+    } catch {
+      t = e.slice(1);
+    }
+    document.getElementById(t)?.scrollIntoView?.();
+  });
+}
+function et(e) {
+  return e.button === 0 && !e.metaKey && !e.altKey && !e.ctrlKey && !e.shiftKey;
 }
-function O(e) {
-  return e.replace(/[\\"]/g, "\\$&");
+const B = _({
+  navigation: "document",
+  push(e) {
+    window.location.href = e;
+  }
+});
+function tt() {
+  return W(B);
+}
+function Lt({ className: e, id: t, policy: r, ...n }) {
+  const a = me(n, r);
+  return /* @__PURE__ */ z(
+    "img",
+    {
+      alt: a.alt,
+      className: e,
+      decoding: a.decoding,
+      fetchPriority: a.fetchPriority,
+      height: a.height,
+      id: t,
+      loading: a.loading,
+      sizes: a.sizes,
+      src: a.src,
+      srcSet: a.srcSet,
+      width: a.width
+    }
+  );
 }
-const ar = {
+const rt = "https://js.sentry-cdn.com", zt = {
+  /**
+   * Plausible loads one script and posts events to its own API. The snippet
+   * carries configuration in `data-domain`, so no inline code is involved.
+   * `endpoint` accepts a same-origin path prefix for a proxied deployment.
+   */
   plausible(e) {
-    const t = Ye(e.domain), r = Ze(e.endpoint ?? "https://plausible.io");
+    const t = nt(e.domain), r = L(e.endpoint ?? "https://plausible.io");
     return {
-      connectSrc: r.origin,
       consent: e.consent ?? !1,
       domain: t,
       kind: "analytics",
+      needs: {
+        connect: [r.source],
+        script: [r.source]
+      },
       provider: "plausible",
-      script: fe({
-        dataApi: `${r.origin}/api/event`,
-        dataDomain: t,
-        purpose: "analytics",
-        src: `${r.origin}/js/script.js`,
-        strategy: e.strategy ?? "afterInteractive"
-      })
+      scripts: [
+        A({
+          dataApi: `${r.base}/api/event`,
+          dataDomain: t,
+          defer: !0,
+          needs: { connect: [r.source] },
+          purpose: "analytics",
+          src: `${r.base}/js/script.js`,
+          strategy: e.strategy ?? "afterInteractive"
+        })
+      ]
+    };
+  },
+  /**
+   * The Sentry loader script carries the DSN in its own filename, so a page
+   * needs no inline configuration call. Events go to the DSN host, which is
+   * why the integration also declares a `connect-src` need.
+   */
+  sentry(e) {
+    const t = ot(e.dsn), r = it(
+      e.loaderHost ?? rt,
+      "Sentry loader host"
+    );
+    return {
+      consent: e.consent ?? !1,
+      ingestOrigin: t.origin,
+      kind: "analytics",
+      needs: {
+        connect: [t.origin],
+        script: [r]
+      },
+      projectId: t.projectId,
+      provider: "sentry",
+      scripts: [
+        A({
+          crossOrigin: "anonymous",
+          needs: { connect: [t.origin] },
+          purpose: "error-monitoring",
+          src: `${r}/${t.publicKey}.min.js`,
+          // Errors thrown before the app is interactive are the ones an
+          // application can least afford to lose.
+          strategy: e.strategy ?? "beforeInteractive"
+        })
+      ]
+    };
+  },
+  /**
+   * OpenTelemetry publishes no hosted browser loader. Browser instrumentation
+   * is application code bundled from npm packages, so this helper describes
+   * the part a policy has to know about: the OTLP endpoint the exporter posts
+   * to, and an optional same-origin entry script that starts the SDK.
+   */
+  openTelemetry(e) {
+    const t = L(e.endpoint), r = e.script;
+    if (r !== void 0 && !r.startsWith("/"))
+      throw new Error(
+        "OpenTelemetry browser instrumentation must be a same-origin script path."
+      );
+    return {
+      consent: e.consent ?? !1,
+      endpoint: t.base || "/",
+      kind: "analytics",
+      needs: r ? { connect: [t.source], script: ["'self'"] } : { connect: [t.source] },
+      provider: "opentelemetry",
+      scripts: r ? [
+        A({
+          needs: { connect: [t.source] },
+          purpose: "observability",
+          src: r,
+          strategy: e.strategy ?? "module"
+        })
+      ] : []
     };
+  },
+  /** Merges the CSP needs of every integration into one route policy. */
+  policy(...e) {
+    const t = {};
+    for (const r of e)
+      for (const n of ["connect", "img", "script"]) {
+        const a = r.needs[n];
+        !a || a.length === 0 || (t[n] = [.../* @__PURE__ */ new Set([...t[n] ?? [], ...a])]);
+      }
+    return { security: { needs: t } };
+  },
+  /** Collects the script contributions of every integration. */
+  scripts(...e) {
+    return e.flatMap((t) => [...t.scripts]);
   }
 };
-function Ye(e) {
+function nt(e) {
   const t = e.trim();
   if (!t || t.includes("/") || t.includes(" "))
     throw new Error("Analytics domain must be a hostname without a path.");
   return t;
 }
-function Ze(e) {
+function L(e) {
+  if (e.startsWith("/")) {
+    if (e.startsWith("//"))
+      throw new Error("Analytics endpoint must not be a scheme-relative URL.");
+    return {
+      base: e === "/" ? "" : e.replace(/\/+$/, ""),
+      source: "'self'"
+    };
+  }
+  const t = at(e);
+  return { base: t.origin, source: t.origin };
+}
+function at(e) {
   let t;
   try {
     t = new URL(e);
@@ -746,7 +1004,40 @@ function Ze(e) {
     throw new Error("Analytics endpoint must use HTTPS.");
   return t;
 }
-function ir(e = {}) {
+function it(e, t) {
+  let r;
+  try {
+    r = new URL(e);
+  } catch {
+    throw new Error(`${t} must be an absolute URL.`);
+  }
+  if (r.protocol !== "https:")
+    throw new Error(`${t} must use HTTPS.`);
+  return r.origin;
+}
+function ot(e) {
+  let t;
+  try {
+    t = new URL(e);
+  } catch {
+    throw new Error("Sentry DSN must be an absolute URL.");
+  }
+  if (t.protocol !== "https:")
+    throw new Error("Sentry DSN must use HTTPS.");
+  const r = t.pathname.replace(/^\//, "");
+  if (!t.username || t.password)
+    throw new Error(
+      "Sentry DSN must carry a public key and no secret key."
+    );
+  if (!/^[A-Za-z0-9_-]+$/.test(r))
+    throw new Error("Sentry DSN must end with a project identifier.");
+  return {
+    origin: t.origin,
+    projectId: r,
+    publicKey: t.username
+  };
+}
+function Mt(e = {}) {
   return {
     async request(t) {
       await E({ kind: "request", signal: t }, e);
@@ -765,564 +1056,124 @@ function ir(e = {}) {
 async function E(e, t) {
   await t.onEvent?.(e), e.kind === "request" ? await t.request?.(e.signal) : e.kind === "server-start" ? await t.serverStart?.(e.signal) : e.kind === "trace" ? await t.trace?.(e.signal) : await t.webVitals?.(e.signal);
 }
-const Qe = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]);
-function or(e = {}) {
-  const t = [], r = e.document, n = r ? et(r.policy, r.headers, t) : {};
-  r && Xe(r.policy, t);
-  const a = e.route ? ct(e.route, t) : void 0;
-  return r?.scripts && (tt(
-    r.policy.csp,
-    r.scripts,
-    r.headers,
-    t
-  ), r.scriptDependencies && t.push(
-    ...Je(
-      r.scripts,
-      rt(r.scriptDependencies)
-    )
-  )), {
-    findings: t,
-    headers: n,
-    route: a
-  };
-}
-function Xe(e, t) {
-  if (!e.trustedTypes || e.trustedTypes.mode !== "report-only")
-    return;
-  const r = e.csp || void 0, n = !!r?.reportUri?.length, a = e.headers?.reportingEndpoints, i = !!(r?.reportTo && a && a[r.reportTo]);
-  !n && !i && t.push({
-    code: "report-only-target-missing",
-    message: "Trusted Types report-only mode has no deliverable target. Configure CSP reportTo with a matching Reporting-Endpoints member, reportUri for compatibility, or both.",
-    severity: "warning"
-  });
-}
-function Je(e, t = {}) {
-  const r = t.requirePurpose ?? !0, n = [];
-  for (const a of e) {
-    const i = ft(a);
-    i && (r && !a.purpose && n.push({
-      code: "script-purpose-missing",
-      message: `Third-party script ${a.src} should declare a purpose for audits and consent flows.`,
-      severity: "warning"
-    }), t.requireIntegrity && !a.integrity && n.push({
-      code: "script-integrity-missing",
-      message: `Third-party script ${a.src} should declare an integrity hash or an explicit trust-boundary exception.`,
-      severity: "warning"
-    }), a.strategy === "beforeInteractive" && !t.allowBeforeInteractiveThirdParty && n.push({
-      code: "script-third-party-before-interactive",
-      message: `Third-party script ${a.src} runs before the app is interactive and should be justified by policy.`,
-      severity: "warning"
-    }), dt(i) && n.push({
-      code: "script-gtm-wide-trust-boundary",
-      message: "Google Tag Manager can load additional scripts at runtime and should be treated as a wide trust boundary.",
-      severity: "warning"
-    }));
-  }
-  return n;
-}
-function et(e, t, r) {
-  try {
-    return Object.fromEntries(de(e, t));
-  } catch (n) {
-    return r.push({
-      code: "security-header-render-failed",
-      message: n instanceof Error ? n.message : "Security headers failed to render.",
-      severity: "error"
-    }), {};
-  }
-}
-function tt(e, t, r, n) {
-  if (!e)
-    return;
-  const a = nt(e);
-  for (const i of t) {
-    if (at(a) && !i.nonce) {
-      n.push({
-        code: "csp-script-missing-nonce",
-        message: `Document script ${i.src} needs a nonce for the effective script-src policy.`,
-        severity: "error"
-      });
-      continue;
-    }
-    i.nonce && r?.nonce && i.nonce === r.nonce || it(a, i.src) || n.push({
-      code: "csp-script-src-blocked",
-      message: `Document script ${i.src} is not allowed by the effective script-src policy.`,
-      severity: "error"
-    });
-  }
-}
-function rt(e) {
-  return typeof e == "boolean" ? {} : e;
-}
-function nt(e) {
-  return e.scriptSrc ?? e.defaultSrc ?? [];
-}
-function at(e) {
-  return e.some((t) => t.includes("'nonce-{nonce}'"));
-}
-function it(e, t) {
-  return e.includes("*") ? !0 : e.includes("'none'") || e.some((r) => r.startsWith("'nonce-")) ? !1 : e.includes("'self'") && ot(t) || t.startsWith("https:") && e.includes("https:") || t.startsWith("http:") && e.includes("http:") ? !0 : e.some((r) => st(r, t));
-}
-function ot(e) {
-  return e.startsWith("/") && !e.startsWith("//");
-}
-function st(e, t) {
-  if (e.startsWith("'"))
-    return !1;
-  try {
-    const r = new URL(e), n = new URL(t);
-    return n.protocol === r.protocol && n.hostname === r.hostname && n.port === r.port && (r.pathname === "/" || n.pathname.startsWith(r.pathname));
-  } catch {
-    return !1;
-  }
-}
-function ct(e, t) {
-  return ut(e.cors, t), lt(e.method, e.security, t), {
-    cors: e.cors,
-    method: e.method,
-    security: e.security
-  };
-}
-function ut(e, t) {
-  if (e)
-    try {
-      he(e);
-    } catch (r) {
-      t.push({
-        code: "cors-invalid",
-        message: r instanceof Error ? r.message : "CORS policy is invalid.",
-        severity: "error"
-      });
-    }
-}
-function lt(e, t, r) {
-  Qe.has(e) && (t?.csrf === !1 && r.push({
-    code: "csrf-disabled",
-    message: "CSRF protection is explicitly disabled for this unsafe route.",
-    severity: "info"
-  }), t?.rateLimit || r.push({
-    code: "rate-limit-missing",
-    message: "Unsafe routes should declare rate limiting.",
-    severity: "warning"
-  }), t?.request?.maxBodySize || r.push({
-    code: "request-body-limit-missing",
-    message: "Unsafe routes should declare a request body size limit.",
-    severity: "warning"
-  }));
-}
-function ft(e) {
-  try {
-    const t = new URL(e.src);
-    if (t.protocol === "http:" || t.protocol === "https:")
-      return t;
-  } catch {
-    return null;
-  }
-  return null;
-}
-function dt(e) {
-  return e.hostname === "www.googletagmanager.com" && (e.pathname === "/gtm.js" || e.pathname === "/ns.html");
-}
-class ht extends Error {
-  issues;
-  constructor(t) {
-    super(bt(t)), this.name = "EnvValidationError", this.issues = t;
-  }
-}
-function sr(e) {
-  return e;
-}
-function cr(e, t) {
-  const r = [], n = {};
-  for (const a of Object.keys(e)) {
-    const i = e[a], s = t[String(a)];
-    if (s === void 0 || s === "") {
-      if (i.optional) {
-        n[a] = void 0;
-        continue;
-      }
-      r.push({
-        code: "missing",
-        key: String(a),
-        message: `Environment variable ${String(a)} is required.`
-      });
-      continue;
-    }
-    try {
-      n[a] = i.parse(String(a), s);
-    } catch (o) {
-      r.push({
-        code: "invalid",
-        key: String(a),
-        message: o instanceof Error ? o.message : `Environment variable ${String(a)} is invalid.`
-      });
-    }
-  }
-  if (r.length)
-    throw new ht(r);
-  return n;
-}
-function mt(e = {}) {
-  return y(e, !1, (t, r) => {
-    if (r === "true" || r === "1")
-      return !0;
-    if (r === "false" || r === "0")
-      return !1;
-    throw new Error(`Environment variable ${t} must be true, false, 1, or 0.`);
-  });
-}
-function pt(e, t = {}) {
-  return y(t, !1, (r, n) => {
-    if (e.includes(n))
-      return n;
-    throw new Error(
-      `Environment variable ${r} must be one of: ${e.join(", ")}.`
-    );
-  });
-}
-function gt(e = {}) {
-  return y(e, !1, (t, r) => {
-    if (!/^-?\d+$/.test(r))
-      throw new Error(`Environment variable ${t} must be an integer.`);
-    const n = Number(r);
-    if (!Number.isSafeInteger(n))
-      throw new Error(`Environment variable ${t} must be a safe integer.`);
-    if (e.min !== void 0 && n < e.min)
-      throw new Error(
-        `Environment variable ${t} must be greater than or equal to ${e.min}.`
-      );
-    if (e.max !== void 0 && n > e.max)
-      throw new Error(
-        `Environment variable ${t} must be less than or equal to ${e.max}.`
-      );
-    return n;
-  });
-}
-function wt(e = {}) {
-  return y(
-    e,
-    !0,
-    (t, r) => j(t, r, e)
-  );
-}
-function yt(e = {}) {
-  return y(
-    e,
-    !1,
-    (t, r) => j(t, r, e)
-  );
-}
-function vt(e = {}) {
-  return y(e, !1, (t, r) => {
-    let n;
-    try {
-      n = new URL(r);
-    } catch {
-      throw new Error(`Environment variable ${t} must be a valid URL.`);
-    }
-    if (e.protocols?.length && !e.protocols.includes(n.protocol))
-      throw new Error(
-        `Environment variable ${t} must use one of these protocols: ${e.protocols.join(", ")}.`
-      );
-    return n;
-  });
-}
-const ur = {
-  boolean: mt,
-  enum: pt,
-  integer: gt,
-  secret: wt,
-  string: yt,
-  url: vt
-};
-function y(e, t, r) {
-  return {
-    optional: e.optional ?? !1,
-    parse: r,
-    sensitive: t
-  };
-}
-function j(e, t, r) {
-  if (r.minLength !== void 0 && t.length < r.minLength)
-    throw new Error(
-      `Environment variable ${e} must be at least ${r.minLength} characters.`
-    );
-  return t;
-}
-function bt(e) {
-  return e.length === 1 ? e[0].message : `Environment validation failed with ${e.length} issues.`;
-}
-function lr(e = {}) {
-  return async function(r) {
-    if (r.method.toUpperCase() !== "POST")
-      return new Response(null, {
-        headers: {
-          allow: "POST"
-        },
-        status: 405
-      });
-    const n = Et(r);
-    if (n)
-      return n;
-    const a = Rt(e, r);
-    if (a)
-      return a;
-    e.maxBodySize !== void 0 && (r = me({ maxBodySize: e.maxBodySize }, r));
-    let i;
-    try {
-      i = await r.json();
-    } catch (o) {
-      return o instanceof pe ? new Response("Security report body too large.", { status: 413 }) : new Response("Invalid security report JSON.", {
-        status: 400
-      });
-    }
-    const s = $t(i);
-    for (let o = 0; o < s.length; o += 1)
-      await e.onReport?.(s[o], {
-        index: o,
-        request: r
-      });
-    return new Response(null, {
-      status: 204
-    });
-  };
-}
-const St = /* @__PURE__ */ new Set([
-  "application/csp-report",
-  "application/reports+json"
-]);
-function Et(e) {
-  const t = e.headers.get("content-type");
-  if (!t)
-    return null;
-  const r = t.split(";", 1)[0]?.trim().toLowerCase();
-  return r && St.has(r) ? null : new Response("Unsupported security report Content-Type.", {
-    status: 415
-  });
-}
-function Rt(e, t) {
-  if (e.maxBodySize === void 0)
-    return null;
-  const r = t.headers.get("content-length");
-  if (!r)
-    return null;
-  if (!/^\d+$/.test(r))
-    return new Response("Invalid Content-Length.", {
-      status: 400
-    });
-  const n = Number(r);
-  return Number.isSafeInteger(n) ? n > A(e.maxBodySize) ? new Response("Security report body too large.", {
-    status: 413
-  }) : null : new Response("Invalid Content-Length.", {
-    status: 400
-  });
-}
-function $t(e) {
-  return Array.isArray(e) ? e : xt(e) && "csp-report" in e ? [e["csp-report"]] : [e];
-}
-function xt(e) {
-  return typeof e == "object" && e !== null;
-}
-function fr(e, t) {
-  const r = {}, n = [];
-  let a = 0;
-  for (const [i, s] of Object.entries(t.files)) {
-    const o = e.getAll(i).filter(It);
-    r[i] = o, s.required && o.length === 0 && n.push({
-      code: "file-missing",
-      field: i,
-      message: `Upload field ${i} requires at least one file.`
-    });
-    for (const u of o)
-      a += u.size, At(i, u, s, n);
-  }
-  return t.maxTotalSize !== void 0 && a > A(t.maxTotalSize) && n.push({
-    code: "total-upload-too-large",
-    field: "*",
-    message: `Uploaded files exceed the maximum total size of ${t.maxTotalSize}.`
-  }), {
-    files: r,
-    issues: n,
-    ok: n.length === 0,
-    totalSize: a
-  };
-}
-function At(e, t, r, n) {
-  r.maxSize !== void 0 && t.size > A(r.maxSize) && n.push({
-    code: "file-too-large",
-    field: e,
-    message: `Upload field ${e} contains ${t.name || "a file"} larger than ${r.maxSize}.`
-  }), r.types?.length && !Tt(t.type, r.types) && n.push({
-    code: "file-type-not-allowed",
-    field: e,
-    message: `Upload field ${e} contains ${t.name || "a file"} with disallowed type ${t.type || "unknown"}.`
-  });
-}
-function Tt(e, t) {
-  return t.some((r) => r.endsWith("/*") ? e.startsWith(r.slice(0, -1)) : e === r);
-}
-function It(e) {
-  return e instanceof File;
-}
-function kt(e, t) {
-  const r = t.headers.get("origin");
-  if (!r)
-    return {
-      allowed: !!e.allowMissingOrigin,
-      expected: e.origins,
-      origin: r,
-      reason: e.allowMissingOrigin ? void 0 : "missing-origin"
-    };
-  const n = q(r);
-  if (!n)
-    return {
-      allowed: !1,
-      expected: e.origins,
-      origin: r,
-      reason: "invalid-origin"
-    };
-  const a = Ct(e, n, t);
-  return {
-    allowed: a,
-    expected: e.origins,
-    origin: n,
-    reason: a ? void 0 : "origin-not-allowed"
-  };
-}
-function dr(e, t) {
-  return !e || kt(e, t).allowed ? null : new Response("WebSocket origin not allowed.", {
-    status: 403
-  });
-}
-function Ct(e, t, r) {
-  return e.origins === "same-origin" ? t === new URL(r.url).origin : e.origins.some(
-    (n) => Dt(n, t)
-  );
-}
-function Dt(e, t) {
-  return e === "null" ? t === "null" : q(e) === t;
-}
-function q(e) {
-  if (e === "null")
-    return e;
-  try {
-    if (e !== e.trim())
-      return null;
-    const t = e.indexOf("://");
-    if (t === -1)
-      return null;
-    const r = e.slice(t + 3);
-    if (!r || /[/?#]/.test(r))
-      return null;
-    const n = new URL(e);
-    return n.protocol !== "http:" && n.protocol !== "https:" || n.username || n.password ? null : n.origin;
-  } catch {
-    return null;
-  }
-}
 export {
-  ht as EnvValidationError,
-  se as HTTP_ERROR_STATUSES,
-  wr as HttpError,
-  Zt as Link,
-  Ht as action,
-  Wt as actionInput,
-  ar as analytics,
-  wn as assertAdapterCapabilities,
-  Je as auditScriptDependencies,
-  yn as checkAdapterCapabilities,
-  kt as checkWebSocketOrigin,
-  yr as createCache,
-  vr as createCorsHeaders,
-  br as createCsrfCookie,
-  Sr as createCsrfToken,
-  ke as createFileRouter,
-  Er as createInvalidation,
-  Rr as createMemoryCache,
-  $r as createMemoryCacheStore,
-  Gt as createMemoryIdempotencyStore,
-  xr as createMemoryRateLimitStore,
-  Ar as createRequestHandler,
-  or as createSecurityAudit,
-  de as createSecurityHeaders,
-  lr as createSecurityReportHandler,
-  Tr as cspHash,
-  vn as defineAdapter,
-  sr as defineEnvSchema,
-  tr as defineFonts,
-  Qt as defineImages,
-  ir as defineInstrumentation,
-  Ir as defineLinks,
-  kr as defineMetadata,
-  jt as defineOgImage,
-  Ft as defineRobots,
-  Cr as defineRoutePolicy,
-  Dr as defineScripts,
-  zr as defineSecurityPolicy,
-  Ut as defineSitemap,
-  Or as defineTags,
-  Pr as enforceAllowedMethods,
-  Lr as enforceCsrfProtection,
-  Nr as enforceRateLimit,
-  Ur as enforceRequestSecurity,
-  dr as enforceWebSocketOrigin,
-  ur as env,
-  er as font,
-  rr as fontPreloadLinks,
-  Mr as handleRequestWithManifest,
-  ee as href,
-  Fr as html,
-  ce as httpError,
-  Yt as hydrateFileRouter,
-  Xt as isAllowedImageSource,
-  le as isHttpError,
-  jr as issueCsrfToken,
-  qr as json,
-  Br as jsonl,
-  Hr as link,
-  Wr as mergeRoutePolicies,
-  _r as mergeRouteSecurityPolicies,
-  Vr as mergeSecurityPolicies,
-  Gr as meta,
-  Kr as modulePreload,
-  Yr as notFound,
-  _t as page,
-  A as parseBodySize,
-  D as parseCacheDuration,
-  Zr as parseCookieHeader,
-  Qr as parseRateLimitWindow,
-  Jt as planImageTransform,
-  Xr as preconnect,
-  Jr as preload,
-  en as query,
-  tn as redirect,
-  nr as renderFontFaceCss,
-  Bt as renderOgImageResponse,
-  ge as renderOgImageSvg,
-  pr as renderPageResponse,
-  qt as renderRobots,
-  Mt as renderSitemap,
-  rn as resolveLinks,
-  nn as resolveMetadata,
-  an as resolveScripts,
-  Q as response,
-  Kt as runIdempotentMutation,
-  fe as script,
-  on as security,
-  J as serializeCacheKey,
-  sn as serializeCacheNamespace,
-  cn as serializeCacheTag,
-  un as serverTiming,
-  ln as sse,
-  fn as stream,
-  dn as structuredData,
-  hn as tag,
-  mn as text,
-  X as toResponse,
-  he as validateCorsPolicy,
-  cr as validateEnv,
-  pn as validateRateLimitPolicy,
-  fr as validateUploads,
-  Vt as webhook
+  ke as EnvValidationError,
+  ue as HTTP_ERROR_STATUSES,
+  Qt as HttpError,
+  Lt as Image,
+  Ot as Link,
+  jt as Script,
+  St as action,
+  Et as actionInput,
+  zt as analytics,
+  Ft as assertAdapterCapabilities,
+  er as auditScriptDependencies,
+  Ht as checkAdapterCapabilities,
+  qe as checkWebSocketOrigin,
+  tr as createCache,
+  rr as createCorsHeaders,
+  nr as createCsrfCookie,
+  ar as createCsrfToken,
+  We as createFileRouter,
+  ir as createInvalidation,
+  or as createMemoryCache,
+  sr as createMemoryCacheStore,
+  mt as createMemoryIdempotencyStore,
+  cr as createMemoryRateLimitStore,
+  ur as createRequestHandler,
+  lr as createSecurityAudit,
+  fr as createSecurityHeaders,
+  It as createSecurityReportHandler,
+  dr as cspHash,
+  mr as cspNonce,
+  Xr as defaultFontPath,
+  Bt as defineAdapter,
+  $t as defineEnvSchema,
+  Jr as defineFonts,
+  Qr as defineImages,
+  Mt as defineInstrumentation,
+  qt as defineLinks,
+  hr as defineMetadata,
+  At as defineMiddleware,
+  yt as defineOgImage,
+  wt as defineRobots,
+  pr as defineRoutePolicy,
+  _t as defineScripts,
+  gr as defineSecurityPolicy,
+  pt as defineSitemap,
+  wr as defineTags,
+  yr as enforceAllowedMethods,
+  vr as enforceCsrfProtection,
+  br as enforceRateLimit,
+  Sr as enforceRequestSecurity,
+  Nt as enforceWebSocketOrigin,
+  Tt as env,
+  en as font,
+  tn as fontAssetFileName,
+  rn as fontAssetUrl,
+  nn as fontLinks,
+  an as fontMediaType,
+  on as fontPreloadLinks,
+  sn as fontSources,
+  cn as fontStylesheetUrl,
+  Vt as getScriptWorker,
+  Er as handleRequestWithManifest,
+  re as href,
+  Rr as html,
+  le as httpError,
+  Ct as hydrateFileRouter,
+  un as isAllowedImageSource,
+  de as isHttpError,
+  Ar as issueCsrfToken,
+  xr as json,
+  $r as jsonl,
+  kr as link,
+  Tr as mergeRoutePolicies,
+  Ir as mergeRouteSecurityPolicies,
+  Dr as mergeSecurityPolicies,
+  Nr as meta,
+  Wt as modulePreload,
+  Cr as notFound,
+  Rt as page,
+  $ as parseBodySize,
+  C as parseCacheDuration,
+  Or as parseCookieHeader,
+  ln as parseImageOptimizerRequest,
+  Lr as parseRateLimitWindow,
+  me as planImageTransform,
+  Kt as preconnect,
+  Gt as preload,
+  zr as query,
+  Mr as redirect,
+  fn as renderFontFaceCss,
+  bt as renderOgImageResponse,
+  ye as renderOgImageSvg,
+  Zt as renderPageResponse,
+  vt as renderRobots,
+  gt as renderSitemap,
+  Yt as resolveLinks,
+  Pr as resolveMetadata,
+  Xt as resolveScripts,
+  J as response,
+  ht as runIdempotentMutation,
+  A as script,
+  Ur as security,
+  X as serializeCacheKey,
+  jr as serializeCacheNamespace,
+  Fr as serializeCacheTag,
+  Hr as serverTiming,
+  Br as sse,
+  N as startDeferredScripts,
+  qr as stream,
+  _r as structuredData,
+  Vr as tag,
+  Wr as text,
+  Q as toResponse,
+  Kr as validateCorsPolicy,
+  kt as validateEnv,
+  Gr as validateRateLimitPolicy,
+  Zr as validateRouteModules,
+  Dt as validateUploads,
+  xt as webhook
 };
 //# sourceMappingURL=index.js.map