@demiurgejs/core 0.2.0-beta.1 → 0.2.0-beta.3

package/dist/chunks/{testing-DBjVCN5v.js → testing-CRflAw4X.js}

@@ -1,196 +1,218 @@
-import { n as Dt, o as Je, w as Ke, e as Ye, p as $t, q as Nt, k as Ot, r as Lt } from "./request-metadata-DwEO1EAS.js";
-import { createElement as ue } from "react";
-import { renderToString as Ze } from "react-dom/server";
-import { jsxs as I, jsx as M } from "react/jsx-runtime";
-const ke = ["build", "private", "public"], It = {
+import { x as It, w as Ut, y as Qe, z as Xe, e as et, F as Ft, A as Ht, B as jt, l as Wt, a as zt } from "./request-metadata-DaIYq4Ea.js";
+import { createElement as de } from "react";
+import { renderToString as tt } from "react-dom/server";
+import { jsxs as H, jsx as j } from "react/jsx-runtime";
+const Ne = ["build", "private", "public"], Bt = {
   app: "demiurge-memory",
   environment: "local",
   schemaVersion: 1
-}, Mt = 1e4, Ut = 3e4;
-function ti(e) {
+}, qt = 1e4, Gt = 3e4;
+function Eo(e) {
   return (...t) => ({
     fn: () => e.fn(...t),
     key: e.key(...t),
+    notFoundTtl: e.notFoundTtl,
     scope: e.scope,
     staleWhileRevalidate: e.staleWhileRevalidate,
     tags: e.tags?.(...t),
     ttl: e.ttl
   });
 }
-function ri(e) {
+class A extends Error {
+  constructor(t) {
+    super(t ?? "Not found"), this.name = "CacheNotFoundError";
+  }
+}
+function vo(e) {
+  throw new A(e);
+}
+function Ro(e) {
+  return e instanceof A;
+}
+function bo(e) {
   return { id: e };
 }
-function ni(e) {
+function To(e) {
   return e;
 }
-function Qe(e) {
-  const t = e.now ?? Date.now, r = Wt(e.refreshLeaseTtl), n = Xe(e.namespace), s = /* @__PURE__ */ new Map(), i = /* @__PURE__ */ new Map();
+function rt(e) {
+  const t = e.now ?? Date.now, r = Kt(e.refreshLeaseTtl), n = nt(e.namespace), s = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map();
   return {
-    async get(o) {
-      const a = o.scope ?? "request";
+    async get(i) {
+      const a = i.scope ?? "request";
       if (a === "none")
-        return await o.fn();
-      const c = Ae(o.key);
+        return await i.fn();
+      const c = Le(i.key);
       if (a === "request")
-        return await Ft(s, c, o, t);
-      const u = De(n, a, c), f = (o.tags ?? []).map(
-        (g) => $e(n, a, fe(g))
-      ), l = await e.store.get(u);
-      if (l && (l.expiresAt === null || l.expiresAt > t()))
-        return l.value;
-      if (l && qt(l, t())) {
-        const g = zt(e.store), k = globalThis.crypto.randomUUID();
-        if (await g.acquireRefreshLease(
+        return await Jt(s, c, i, t);
+      const u = Me(n, a, c), l = (i.tags ?? []).map(
+        (m) => Ie(n, a, he(m))
+      ), f = await e.store.get(u);
+      if (f && (f.expiresAt === null || f.expiresAt > t())) {
+        if (f.negative)
+          throw new A(
+            typeof f.value == "string" ? f.value : void 0
+          );
+        return f.value;
+      }
+      if (f && Yt(f, t())) {
+        const m = Zt(e.store), k = globalThis.crypto.randomUUID();
+        if (await m.acquireRefreshLease(
           u,
           k,
           t() + r
         )) {
-          const ee = Bt({
+          const N = Qt({
             key: u,
             now: t,
             onBackgroundError: e.onBackgroundError,
-            refreshStore: g,
-            request: o,
-            tags: f,
+            refreshStore: m,
+            request: i,
+            tags: l,
             token: k
           });
-          e.waitUntil?.(ee);
+          e.waitUntil?.(N);
         }
-        return l.value;
+        return f.value;
       }
-      l && await e.store.delete(u);
-      const m = i.get(u);
-      if (m)
-        return await m.promise;
-      const d = { invalidated: !1 }, P = Promise.resolve().then(o.fn).then(async (g) => (d.invalidated || await e.store.set(u, {
-        expiresAt: et(t(), o.ttl),
-        staleUntil: tt(
-          t(),
-          o.ttl,
-          o.staleWhileRevalidate
-        ),
-        tags: f,
-        value: g
-      }), g)), A = {
-        promise: P,
+      f && await e.store.delete(u);
+      const h = o.get(u);
+      if (h)
+        return await h.promise;
+      const d = { invalidated: !1 }, D = Promise.resolve().then(i.fn).then(
+        async (m) => (d.invalidated || await e.store.set(u, {
+          expiresAt: Se(t(), i.ttl),
+          staleUntil: Ee(
+            t(),
+            i.ttl,
+            i.staleWhileRevalidate
+          ),
+          tags: l,
+          value: m
+        }), m),
+        async (m) => {
+          throw !d.invalidated && m instanceof A && await e.store.set(u, st(t(), i, l, m)), m;
+        }
+      ), $ = {
+        promise: D,
         state: d,
-        tags: f
+        tags: l
       };
-      i.set(u, A);
+      o.set(u, $);
       try {
-        return await P;
+        return await D;
       } finally {
-        i.get(u) === A && i.delete(u);
+        o.get(u) === $ && o.delete(u);
       }
     },
-    async invalidateKey(o) {
-      const a = Ae(o), c = s.delete(a);
+    async invalidateKey(i) {
+      const a = Le(i), c = s.delete(a);
       let u = !1;
-      const f = await Promise.all(
-        ke.map((l) => {
-          const m = De(n, l, a), d = i.get(m);
-          return d && (d.state.invalidated = !0, u = !0), e.store.delete(m);
+      const l = await Promise.all(
+        Ne.map((f) => {
+          const h = Me(n, f, a), d = o.get(h);
+          return d && (d.state.invalidated = !0, u = !0), e.store.delete(h);
         })
       );
-      return c || u || f.some(Boolean);
+      return c || u || l.some(Boolean);
     },
-    async invalidateTags(o) {
-      const a = o.map(fe), c = Gt(
+    async invalidateTags(i) {
+      const a = i.map(he), c = Xt(
         s,
         new Set(a)
       ), u = new Set(
-        ke.flatMap(
-          (m) => a.map((d) => $e(n, m, d))
+        Ne.flatMap(
+          (h) => a.map((d) => Ie(n, h, d))
         )
       );
-      let f = 0;
-      for (const m of i.values())
-        !m.state.invalidated && m.tags.some((d) => u.has(d)) && (m.state.invalidated = !0, f += 1);
-      const l = await e.store.invalidateTags([...u]);
-      return c + f + l;
+      let l = 0;
+      for (const h of o.values())
+        !h.state.invalidated && h.tags.some((d) => u.has(d)) && (h.state.invalidated = !0, l += 1);
+      const f = await e.store.invalidateTags([...u]);
+      return c + l + f;
     }
   };
 }
-function ge(e = {}) {
+function we(e = {}) {
   const t = e.now ?? Date.now;
-  return Qe({
-    namespace: It,
+  return rt({
+    namespace: Bt,
     now: t,
     onBackgroundError: e.onBackgroundError,
     refreshLeaseTtl: e.refreshLeaseTtl,
-    store: Ht({
+    store: _t({
       maximumEntries: e.maximumEntries,
       now: t
     }),
     waitUntil: e.waitUntil
   });
 }
-function Ht(e = {}) {
-  const t = e.entries ?? /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), n = e.maximumEntries ?? Mt, s = e.now ?? Date.now;
+function _t(e = {}) {
+  const t = e.entries ?? /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), n = e.maximumEntries ?? qt, s = e.now ?? Date.now;
   if (!Number.isSafeInteger(n) || n <= 0)
     throw new Error(
       "Demiurge memory cache maximumEntries must be a positive integer."
     );
-  te(t, r, s()), jt(t, n);
-  let i = re(t);
+  se(t, r, s()), Vt(t, n);
+  let o = oe(t);
   return {
-    acquireRefreshLease(o, a, c) {
-      const u = s(), f = r.get(o);
-      return f && f.expiresAt > u ? !1 : (r.set(o, { expiresAt: c, token: a }), !0);
+    acquireRefreshLease(i, a, c) {
+      const u = s(), l = r.get(i);
+      return l && l.expiresAt > u ? !1 : (r.set(i, { expiresAt: c, token: a }), !0);
     },
-    delete(o) {
-      return r.delete(o), t.delete(o);
+    delete(i) {
+      return r.delete(i), t.delete(i);
     },
-    get(o) {
-      return s() >= i && (te(t, r, s()), i = re(t)), t.get(o);
+    get(i) {
+      return s() >= o && (se(t, r, s()), o = oe(t)), t.get(i);
     },
-    invalidateTags(o) {
-      const a = new Set(o);
+    invalidateTags(i) {
+      const a = new Set(i);
       let c = 0;
-      for (const [u, f] of t)
-        f.tags.some((l) => a.has(l)) && (t.delete(u), r.delete(u), c += 1);
+      for (const [u, l] of t)
+        l.tags.some((f) => a.has(f)) && (t.delete(u), r.delete(u), c += 1);
       return c;
     },
-    publishRefresh(o, a, c) {
-      const u = r.get(o);
-      return !u || u.token !== a || u.expiresAt <= s() ? !1 : (Ce(
+    publishRefresh(i, a, c) {
+      const u = r.get(i);
+      return !u || u.token !== a || u.expiresAt <= s() ? !1 : (Oe(
         t,
         r,
         n,
-        o,
+        i,
         c
-      ), r.delete(o), c.staleUntil !== null && (i = Math.min(i, c.staleUntil)), !0);
+      ), r.delete(i), c.staleUntil !== null && (o = Math.min(o, c.staleUntil)), !0);
     },
-    releaseRefreshLease(o, a) {
-      r.get(o)?.token === a && r.delete(o);
+    releaseRefreshLease(i, a) {
+      r.get(i)?.token === a && r.delete(i);
     },
-    set(o, a) {
+    set(i, a) {
       const c = s();
-      c >= i && (te(t, r, c), i = re(t)), r.delete(o), Ce(
+      c >= o && (se(t, r, c), o = oe(t)), r.delete(i), Oe(
         t,
         r,
         n,
-        o,
+        i,
         a
-      ), a.staleUntil !== null && (i = Math.min(i, a.staleUntil));
+      ), a.staleUntil !== null && (o = Math.min(o, a.staleUntil));
     }
   };
 }
-function te(e, t, r) {
+function se(e, t, r) {
   for (const [n, s] of e)
     s.staleUntil !== null && s.staleUntil <= r && (e.delete(n), t.delete(n));
 }
-function Ce(e, t, r, n, s) {
+function Oe(e, t, r, n, s) {
   if (!e.has(n) && e.size >= r)
     for (; e.size >= r; ) {
-      const i = e.keys().next().value;
-      if (i === void 0)
+      const o = e.keys().next().value;
+      if (o === void 0)
         break;
-      e.delete(i), t.delete(i);
+      e.delete(o), t.delete(o);
     }
   e.set(n, s);
 }
-function jt(e, t) {
+function Vt(e, t) {
   for (; e.size > t; ) {
     const r = e.keys().next().value;
     if (r === void 0)
@@ -198,14 +220,14 @@ function jt(e, t) {
     e.delete(r);
   }
 }
-function re(e) {
+function oe(e) {
   let t = Number.POSITIVE_INFINITY;
   for (const r of e.values())
     r.staleUntil !== null && (t = Math.min(t, r.staleUntil));
   return t;
 }
-function Xe(e) {
-  const t = ne("app", e.app), r = ne(
+function nt(e) {
+  const t = ie("app", e.app), r = ie(
     "environment",
     e.environment
   );
@@ -213,13 +235,13 @@ function Xe(e) {
     throw new Error(
       "Demiurge cache namespace schemaVersion must be a non-negative integer or string."
     );
-  const n = ne(
+  const n = ie(
     "schemaVersion",
     String(e.schemaVersion)
   );
   return `${t}:${r}:${n}`;
 }
-function si(e) {
+function xo(e) {
   return {
     async key(t) {
       return {
@@ -250,7 +272,7 @@ function si(e) {
     }
   };
 }
-function U(e) {
+function P(e) {
   if (e === void 0)
     return Number.POSITIVE_INFINITY;
   if (typeof e == "number") {
@@ -264,40 +286,52 @@ function U(e) {
   const r = Number(t[1]), n = t[2];
   return n === "h" ? r * 36e5 : n === "m" ? r * 6e4 : n === "s" ? r * 1e3 : r;
 }
-function Ae(e) {
-  return le(e, /* @__PURE__ */ new Set());
+function Le(e) {
+  return me(e, /* @__PURE__ */ new Set());
 }
-function fe(e) {
+function he(e) {
   return e.id;
 }
-async function Ft(e, t, r, n) {
+async function Jt(e, t, r, n) {
   const s = e.get(t);
   if (s && s.expiresAt > n())
     return await s.value;
-  const i = Promise.resolve().then(r.fn), o = {
-    expiresAt: n() + U(r.ttl),
-    tags: (r.tags ?? []).map(fe),
-    value: i
+  const o = Promise.resolve().then(r.fn), i = {
+    expiresAt: n() + P(r.ttl),
+    tags: (r.tags ?? []).map(he),
+    value: o
   };
-  e.set(t, o);
+  e.set(t, i);
   try {
-    return await i;
+    return await o;
   } catch (a) {
-    throw e.get(t) === o && e.delete(t), a;
+    throw e.get(t) === i && (a instanceof A ? i.expiresAt = n() + P(r.notFoundTtl ?? r.ttl) : e.delete(t)), a;
   }
 }
-function De(e, t, r) {
+function Me(e, t, r) {
   return `${e}:${t}:key:${r}`;
 }
-function $e(e, t, r) {
+function Ie(e, t, r) {
   return `${e}:${t}:tag:${r}`;
 }
-function et(e, t) {
-  const r = U(t);
+function Se(e, t) {
+  const r = P(t);
   return Number.isFinite(r) ? e + r : null;
 }
-function tt(e, t, r) {
-  const n = U(t);
+function st(e, t, r, n) {
+  const s = t.notFoundTtl ?? t.ttl;
+  return {
+    expiresAt: Se(e, s),
+    negative: !0,
+    // Negative entries do not participate in stale-while-revalidate: they
+    // expire outright and recompute on the next request.
+    staleUntil: Ee(e, s, void 0),
+    tags: r,
+    value: n.message
+  };
+}
+function Ee(e, t, r) {
+  const n = P(t);
   if (!Number.isFinite(n)) {
     if (r !== void 0)
       throw new Error(
@@ -305,32 +339,32 @@ function tt(e, t, r) {
       );
     return null;
   }
-  return e + n + U(r ?? 0);
+  return e + n + P(r ?? 0);
 }
-function Wt(e) {
-  const t = U(e ?? Ut);
+function Kt(e) {
+  const t = P(e ?? Gt);
   if (!Number.isFinite(t) || t <= 0)
     throw new Error(
       "Demiurge cache refreshLeaseTtl must be a positive finite duration."
     );
   return t;
 }
-function qt(e, t) {
+function Yt(e, t) {
   return e.expiresAt !== null && e.expiresAt <= t && (e.staleUntil === null || e.staleUntil > t);
 }
-function zt(e) {
+function Zt(e) {
   if (!e.acquireRefreshLease || !e.publishRefresh || !e.releaseRefreshLease)
     throw new Error(
       "Demiurge staleWhileRevalidate requires a cache store with acquireRefreshLease, publishRefresh, and releaseRefreshLease coordination methods."
     );
   return e;
 }
-async function Bt(e) {
+async function Qt(e) {
   try {
     const t = await e.request.fn(), r = e.now();
     await e.refreshStore.publishRefresh(e.key, e.token, {
-      expiresAt: et(r, e.request.ttl),
-      staleUntil: tt(
+      expiresAt: Se(r, e.request.ttl),
+      staleUntil: Ee(
         r,
         e.request.ttl,
         e.request.staleWhileRevalidate
@@ -339,12 +373,20 @@ async function Bt(e) {
       value: t
     });
   } catch (t) {
+    if (t instanceof A) {
+      await e.refreshStore.publishRefresh(
+        e.key,
+        e.token,
+        st(e.now(), e.request, e.tags, t)
+      );
+      return;
+    }
     e.onBackgroundError ? e.onBackgroundError(t) : console.error("Demiurge stale cache refresh failed.", t);
   } finally {
     await e.refreshStore.releaseRefreshLease(e.key, e.token);
   }
 }
-function ne(e, t) {
+function ie(e, t) {
   const r = [...t].some((n) => {
     const s = n.charCodeAt(0);
     return s <= 31 || s === 127;
@@ -355,13 +397,13 @@ function ne(e, t) {
     );
   return t;
 }
-function Gt(e, t) {
+function Xt(e, t) {
   let r = 0;
   for (const [n, s] of e)
-    s.tags.some((i) => t.has(i)) && (e.delete(n), r += 1);
+    s.tags.some((o) => t.has(o)) && (e.delete(n), r += 1);
   return r;
 }
-function le(e, t) {
+function me(e, t) {
   if (e === null || typeof e == "boolean" || typeof e == "string")
     return JSON.stringify(e);
   if (typeof e == "number") {
@@ -378,18 +420,18 @@ function le(e, t) {
   if (t.has(e))
     throw new Error("Demiurge cache keys cannot contain circular references.");
   if (t.add(e), Array.isArray(e)) {
-    const o = Reflect.ownKeys(e), a = [
-      ...Array.from({ length: e.length }, (u, f) => String(f)),
+    const i = Reflect.ownKeys(e), a = [
+      ...Array.from({ length: e.length }, (u, l) => String(l)),
       "length"
     ];
-    if (o.length !== a.length || o.some((u, f) => u !== a[f]) || a.slice(0, -1).some((u) => {
-      const f = Object.getOwnPropertyDescriptor(e, u);
-      return !f?.enumerable || !("value" in f);
+    if (i.length !== a.length || i.some((u, l) => u !== a[l]) || a.slice(0, -1).some((u) => {
+      const l = Object.getOwnPropertyDescriptor(e, u);
+      return !l?.enumerable || !("value" in l);
     }))
       throw t.delete(e), new Error(
         "Demiurge cache key arrays must be dense and cannot contain accessors or custom properties."
       );
-    const c = `[${e.map((u) => le(u, t)).join(",")}]`;
+    const c = `[${e.map((u) => me(u, t)).join(",")}]`;
     return t.delete(e), c;
   }
   const r = Object.getPrototypeOf(e);
@@ -398,107 +440,47 @@ function le(e, t) {
       "Demiurge cache keys accept only primitives, arrays, and plain objects."
     );
   const n = Reflect.ownKeys(e);
-  if (n.some((o) => typeof o == "symbol") || n.some((o) => {
-    const a = Object.getOwnPropertyDescriptor(e, o);
+  if (n.some((i) => typeof i == "symbol") || n.some((i) => {
+    const a = Object.getOwnPropertyDescriptor(e, i);
     return !a?.enumerable || !("value" in a);
   }))
     throw new Error(
       "Demiurge cache key objects require enumerable string data properties."
     );
-  const s = e, i = `{${Object.keys(s).sort().map(
-    (o) => `${JSON.stringify(o)}:${le(s[o], t)}`
+  const s = e, o = `{${Object.keys(s).sort().map(
+    (i) => `${JSON.stringify(i)}:${me(s[i], t)}`
   ).join(",")}}`;
-  return t.delete(e), i;
-}
-function ii(e) {
-  return e;
-}
-function oi(e, t = {}) {
-  return {
-    ...t,
-    href: e,
-    kind: "link",
-    rel: "preconnect"
-  };
-}
-function ai(e, t) {
-  return {
-    ...t,
-    href: e,
-    kind: "link",
-    rel: "preload"
-  };
-}
-function ci(e) {
-  return {
-    href: e,
-    kind: "link",
-    rel: "modulepreload"
-  };
-}
-async function _t(e, t) {
-  const r = [];
-  for (const n of e) {
-    if (!n)
-      continue;
-    const s = typeof n == "function" ? await n(t) : n;
-    r.push(...s);
-  }
-  return Vt(r).sort(Jt);
-}
-function Vt(e) {
-  const t = /* @__PURE__ */ new Map();
-  for (const r of e)
-    t.set(Ne(r), {
-      ...t.get(Ne(r)),
-      ...r
-    });
-  return [...t.values()];
-}
-function Ne(e) {
-  return [
-    e.rel,
-    e.href,
-    e.as ?? "",
-    e.type ?? "",
-    e.crossOrigin ?? ""
-  ].join("\0");
-}
-function Jt(e, t) {
-  return Oe(e.rel) - Oe(t.rel) || e.href.localeCompare(t.href);
+  return t.delete(e), o;
 }
-function Oe(e) {
-  return e === "preconnect" ? 0 : e === "preload" ? 1 : e === "modulepreload" ? 2 : 3;
-}
-function ui(e) {
+function Ao(e) {
   return e;
 }
-function fi(e) {
+function Po(e) {
   return {
     ...e,
     kind: "meta"
   };
 }
-function li(e) {
+function Co(e) {
   return {
     ...e,
     kind: "link"
   };
 }
-function di(e) {
+function Do(e) {
   return {
     kind: "structured-data",
     value: e
   };
 }
-function v(...e) {
+function R(...e) {
   const t = {
     custom: [],
     structuredData: []
   };
-  for (const i of e)
-    i && Kt(t, i);
-  const r = Zt(t), n = t.description, s = Qt(t.openGraph, r, n);
+  for (const o of e)
+    o && er(t, o);
+  const r = rr(t), n = t.description, s = nr(t.openGraph, r, n);
   return {
     canonical: t.canonical,
     charset: "utf-8",
@@ -511,8 +493,8 @@ function v(...e) {
     viewport: "width=device-width, initial-scale=1"
   };
 }
-function Kt(e, t) {
-  Yt(e, t.title), t.description !== void 0 && (e.description = t.description), t.canonical !== void 0 && (e.canonical = t.canonical), t.robots && (e.robots = {
+function er(e, t) {
+  tr(e, t.title), t.description !== void 0 && (e.description = t.description), t.canonical !== void 0 && (e.canonical = t.canonical), t.robots && (e.robots = {
     ...e.robots ?? {},
     ...t.robots
   }), t.openGraph && (e.openGraph = {
@@ -520,7 +502,7 @@ function Kt(e, t) {
     ...t.openGraph
   }), t.custom && e.custom.push(...t.custom), t.structuredData && e.structuredData.push(...t.structuredData);
 }
-function Yt(e, t) {
+function tr(e, t) {
   if (t !== void 0) {
     if (typeof t == "string") {
       e.title = t;
@@ -529,10 +511,10 @@ function Yt(e, t) {
     t.default !== void 0 && (e.titleDefault = t.default), t.format && (e.titleFormat = t.format);
   }
 }
-function Zt(e) {
+function rr(e) {
   return e.title === void 0 ? e.titleDefault : e.titleFormat ? e.titleFormat(e.title) : e.title;
 }
-function Qt(e, t, r) {
+function nr(e, t, r) {
   if (!(!e && !t && !r))
     return {
       ...t ? { title: t } : {},
@@ -540,7 +522,7 @@ function Qt(e, t, r) {
       ...e ?? {}
     };
 }
-function rt(e) {
+function ot(e) {
   const t = {
     fallbacks: {
       error: [],
@@ -553,57 +535,57 @@ function rt(e) {
     policies: []
   };
   for (const [r, n] of Object.entries(e)) {
-    const s = r.replace(/^\/src\/routes\//, "").replace(/^\.\/routes\//, "").replace(/\.tsx?$/, "").split("/"), i = s.at(-1);
-    if (i === "@layout") {
+    const s = r.replace(/^\/src\/routes\//, "").replace(/^\.\/routes\//, "").replace(/\.tsx?$/, "").split("/"), o = s.at(-1);
+    if (o === "@layout") {
       t.layouts.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
     }
-    if (i === "@policy") {
+    if (o === "@policy") {
       t.policies.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
     }
-    if (i === "@middleware") {
+    if (o === "@middleware") {
       t.middlewares.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
     }
-    if (i === "@loading") {
+    if (o === "@loading") {
       t.fallbacks.loading.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
     }
-    if (i === "@error") {
+    if (o === "@error") {
       t.fallbacks.error.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
     }
-    if (i === "@not-found") {
+    if (o === "@not-found") {
       t.fallbacks.notFound.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
@@ -611,12 +593,12 @@ function rt(e) {
     t.routes.push({
       file: r,
       fileSegments: s,
-      segments: R(s),
-      score: pr(s),
+      segments: v(s),
+      score: Er(s),
       load: n
     });
   }
-  return Xt(t.routes), t.routes.sort(rr), t.layouts.sort(
+  return sr(t.routes), t.routes.sort(ar), t.layouts.sort(
     (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
   ), t.policies.sort(
     (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
@@ -630,48 +612,48 @@ function rt(e) {
     (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
   ), t;
 }
-function Xt(e) {
+function sr(e) {
   const t = /* @__PURE__ */ new Map();
   for (const r of e) {
     const n = r.segments.findIndex(
-      (o) => o.startsWith("*")
+      (i) => i.startsWith("*")
     );
     if (n !== -1 && n !== r.segments.length - 1)
       throw new Error(
         `Catchall route segment in "${r.file}" must be the final URL segment.`
       );
-    const s = r.segments.map(er).join("/"), i = t.get(s);
-    if (i)
+    const s = r.segments.map(or).join("/"), o = t.get(s);
+    if (o)
       throw new Error(
-        `Ambiguous routes "${i.file}" and "${r.file}" have the same runtime shape and both match "${tr(r.segments)}".`
+        `Ambiguous routes "${o.file}" and "${r.file}" have the same runtime shape and both match "${ir(r.segments)}".`
       );
     t.set(s, r);
   }
 }
-function er(e) {
+function or(e) {
   return e.startsWith("*") ? "*" : e.startsWith(":") ? ":" : `=${e}`;
 }
-function tr(e) {
+function ir(e) {
   return e.length === 0 ? "/" : `/${e.map((t) => t.startsWith(":") || t.startsWith("*") ? "example" : t).join("/")}`;
 }
-function rr(e, t) {
+function ar(e, t) {
   const r = Math.max(e.segments.length, t.segments.length);
   for (let n = 0; n < r; n += 1) {
-    const s = Le(t.segments[n]) - Le(e.segments[n]);
+    const s = Ue(t.segments[n]) - Ue(e.segments[n]);
     if (s !== 0)
       return s;
   }
   return e.file.localeCompare(t.file);
 }
-function Le(e) {
+function Ue(e) {
   return e === void 0 ? 4 : e.startsWith("*") ? 1 : e.startsWith(":") ? 2 : 3;
 }
-async function nt(e, t, r = new Request(`http://demiurge.local${t}`), n, s = ge(), i = {}) {
-  const o = i.documentContributions ?? !0, a = j(e.routes, t);
+async function it(e, t, r = new Request(`http://demiurge.local${t}`), n, s = we(), o = {}) {
+  const i = o.documentContributions ?? !0, a = B(e.routes, t);
   if (!a)
     return {
-      ...await de(e, t, {
-        documentContributions: o
+      ...await pe(e, t, {
+        documentContributions: i
       }),
       status: "not-found"
     };
@@ -680,136 +662,136 @@ async function nt(e, t, r = new Request(`http://demiurge.local${t}`), n, s = ge(
   ), u = await a.route.load();
   if (!u.GET || u.GET.kind !== "page")
     return {
-      ...await de(e, t, {
-        fallback: ye(
+      ...await pe(e, t, {
+        fallback: ve(
           e.fallbacks.notFound,
           a.route
         ),
-        documentContributions: o,
+        documentContributions: i,
         layouts: c
       }),
       status: "not-found"
     };
-  const f = u.GET.layout === !1 ? [] : await Promise.all(c.map((d) => d.load())), l = new URL(r.url), m = {
+  const l = u.GET.layout === !1 ? [] : await Promise.all(c.map((d) => d.load())), f = new URL(r.url), h = {
     cache: s,
-    context: i.requestContext ?? {},
+    context: o.requestContext ?? {},
     path: a.path,
     pathname: t,
     request: r,
-    search: l.searchParams,
-    url: l
+    search: f.searchParams,
+    url: f
   };
   return {
     status: "ready",
     match: {
-      data: u.GET.data && !n?.hasData ? await u.GET.data(m) : n?.data,
-      error: await st(e, a.route),
-      links: o ? await _t(
+      data: u.GET.data && !n?.hasData ? await u.GET.data(h) : n?.data,
+      error: await at(e, a.route),
+      links: i ? await Ut(
         [
-          ...f.map((d) => d.links),
+          ...l.map((d) => d.links),
           u.links
         ],
-        m
+        h
       ) : [],
       page: u.GET.view,
-      layouts: f.map(
+      layouts: l.map(
         (d) => d.default
       ),
-      metadata: o ? v(
-        ...f.map((d) => d.metadata),
+      metadata: i ? R(
+        ...l.map((d) => d.metadata),
         u.metadata
-      ) : v(),
+      ) : R(),
       path: a.path,
       pathname: t,
       render: u.GET.render,
-      scripts: o ? await Dt(
+      scripts: i ? await It(
         [
-          ...f.map((d) => d.scripts),
+          ...l.map((d) => d.scripts),
           u.scripts
         ],
-        m
+        h
       ) : []
     }
   };
 }
-async function mi(e, t = {}) {
-  const r = ge(), n = [];
+async function $o(e, t = {}) {
+  const r = we(), n = [];
   for (const s of e.routes) {
-    const i = await s.load();
-    if (!i.GET || i.GET.kind !== "page" && !t.includeResources)
+    const o = await s.load();
+    if (!o.GET || o.GET.kind !== "page" && !t.includeResources)
       continue;
-    if (i.GET.kind === "page" && i.GET.render.mode !== "static")
+    if (o.GET.kind === "page" && o.GET.render.mode !== "static")
       throw new Error(
-        `Page route "${s.file}" uses render mode "${i.GET.render.mode}" and cannot be emitted as static output. Set render: { mode: "static" } or deploy a runtime adapter.`
+        `Page route "${s.file}" uses render mode "${o.GET.render.mode}" and cannot be emitted as static output. Set render: { mode: "static" } or deploy a runtime adapter.`
       );
-    const o = ur(s.segments);
-    if (lr(s.segments).length === 0) {
+    const i = mr(s.segments);
+    if (gr(s.segments).length === 0) {
       n.push({
         file: s.file,
         path: {},
-        pattern: o,
-        pathname: o
+        pattern: i,
+        pathname: i
       });
       continue;
     }
-    if (!i.paths)
+    if (!o.paths)
       throw new Error(
-        `Dynamic static route "${s.file}" must export paths for "${o}".`
+        `Dynamic static route "${s.file}" must export paths for "${i}".`
       );
-    const c = await i.paths({ cache: r });
+    const c = await o.paths({ cache: r });
     for (const u of c) {
-      const f = dr(s, o, u);
+      const l = yr(s, i, u);
       n.push({
         file: s.file,
-        path: f,
-        pattern: o,
-        pathname: hr(s.segments, f)
+        path: l,
+        pattern: i,
+        pathname: Sr(s.segments, l)
       });
     }
   }
   return n;
 }
-async function hi(e, t) {
-  const r = j(e.routes, t);
+async function ko(e, t) {
+  const r = B(e.routes, t);
   if (r)
-    return await ar(
-      ye(e.fallbacks.loading, r.route)
+    return await dr(
+      ve(e.fallbacks.loading, r.route)
     );
 }
-async function nr(e, t) {
+async function cr(e, t) {
   let r;
   try {
-    r = j(e.routes, t);
+    r = B(e.routes, t);
   } catch (n) {
-    if (!(n instanceof Ee)) throw n;
-    return await Se(
+    if (!(n instanceof Te)) throw n;
+    return await be(
       e.fallbacks.error.find(
         (s) => s.fileSegments.length === 0
       )
     );
   }
-  return r ? await st(e, r.route) : await sr(e, t);
+  return r ? await at(e, r.route) : await ur(e, t);
 }
-async function st(e, t) {
-  return await Se(
-    ye(e.fallbacks.error, t)
+async function at(e, t) {
+  return await be(
+    ve(e.fallbacks.error, t)
   );
 }
-async function sr(e, t) {
-  return await Se(
-    it(e.fallbacks.error, t)
+async function ur(e, t) {
+  return await be(
+    ct(e.fallbacks.error, t)
   );
 }
-async function de(e, t, r = {}) {
-  const s = await (r.fallback ?? it(e.fallbacks.notFound, t))?.load(), i = s?.default, o = r.documentContributions ?? !0;
+async function pe(e, t, r = {}) {
+  const s = await (r.fallback ?? ct(e.fallbacks.notFound, t))?.load(), o = s?.default, i = r.documentContributions ?? !0;
   if (s?.layout === !1)
     return {
       layouts: [],
-      metadata: o ? v(s.metadata) : v(),
-      notFound: i,
+      metadata: i ? R(s.metadata) : R(),
+      notFound: o,
       pathname: t
     };
-  const a = r.layouts ?? ir(e, t);
+  const a = r.layouts ?? lr(e, t);
   try {
     const c = await Promise.all(
       a.map((u) => u.load())
@@ -818,86 +800,86 @@ async function de(e, t, r = {}) {
       layouts: c.map(
         (u) => u.default
       ),
-      metadata: o ? v(
+      metadata: i ? R(
         ...c.map((u) => u.metadata),
         s?.metadata
-      ) : v(),
-      notFound: i,
+      ) : R(),
+      notFound: o,
       pathname: t
     };
   } catch (c) {
     return r.onLayoutError?.(c), {
       layouts: [],
-      metadata: o ? v(s?.metadata) : v(),
-      notFound: i,
+      metadata: i ? R(s?.metadata) : R(),
+      notFound: o,
       pathname: t
     };
   }
 }
-function ir(e, t) {
-  const r = Q(t);
+function lr(e, t) {
+  const r = re(t);
   return e.layouts.filter(
-    (n) => !n.fileSegments.some(Z) && we(n.segments, r)
+    (n) => !n.fileSegments.some(te) && Re(n.segments, r)
   );
 }
-function or(e, t) {
-  const r = Q(t);
+function fr(e, t) {
+  const r = re(t);
   return e.policies.filter(
-    (n) => !n.fileSegments.some(Z) && we(n.segments, r)
+    (n) => !n.fileSegments.some(te) && Re(n.segments, r)
   );
 }
-function ye(e, t) {
+function ve(e, t) {
   for (let r = e.length - 1; r >= 0; r -= 1) {
     const n = e[r];
     if (T(n.fileSegments, t.fileSegments))
       return n;
   }
 }
-function it(e, t) {
-  const r = Q(t);
+function ct(e, t) {
+  const r = re(t);
   for (let n = e.length - 1; n >= 0; n -= 1) {
     const s = e[n];
-    if (!s.fileSegments.some(Z) && we(s.segments, r))
+    if (!s.fileSegments.some(te) && Re(s.segments, r))
       return s;
   }
 }
-function we(e, t) {
+function Re(e, t) {
   return e.every((r, n) => r.startsWith("*") ? t.length > n : r.startsWith(":") ? !!t[n] : t[n] === r);
 }
-async function ar(e) {
+async function dr(e) {
   return e ? (await e.load()).default : void 0;
 }
-async function Se(e) {
+async function be(e) {
   return e ? (await e.load()).default : void 0;
 }
-function j(e, t) {
-  const r = Q(t);
+function B(e, t) {
+  const r = re(t);
   for (const n of e) {
-    const s = cr(n.segments, r);
+    const s = hr(n.segments, r);
     if (s)
       return { route: n, path: s };
   }
   return null;
 }
-const pi = nt, gi = j;
-function cr(e, t) {
+const No = it, Oo = B;
+function hr(e, t) {
   const r = {};
   for (let n = 0; n < e.length; n += 1) {
-    const s = e[n], i = t[n];
+    const s = e[n], o = t[n];
     if (s?.startsWith("*"))
       return r[s.slice(1)] = t.slice(n).join("/"), r;
-    if (!i)
+    if (!o)
       return null;
     if (s.startsWith(":")) {
-      r[s.slice(1)] = i;
+      r[s.slice(1)] = o;
       continue;
     }
-    if (s !== i)
+    if (s !== o)
       return null;
   }
   return e.length === t.length ? r : null;
 }
-function yi(e, t) {
+function Lo(e, t) {
   return e.every(
     (r, n) => t[n] === r
   );
@@ -907,58 +889,58 @@ function T(e, t) {
     (r, n) => t[n] === r
   );
 }
-function R(e) {
-  return e.flatMap((t) => Z(t) ? [] : t === "index" ? [] : t.startsWith("[...") && t.endsWith("]") ? [`*${t.slice(4, -1)}`] : t.startsWith("[") && t.endsWith("]") ? [`:${t.slice(1, -1)}`] : [t]);
+function v(e) {
+  return e.flatMap((t) => te(t) ? [] : t === "index" ? [] : t.startsWith("[...") && t.endsWith("]") ? [`*${t.slice(4, -1)}`] : t.startsWith("[") && t.endsWith("]") ? [`:${t.slice(1, -1)}`] : [t]);
 }
-function Z(e) {
+function te(e) {
   return e.startsWith("(") && e.endsWith(")");
 }
-function ur(e) {
-  return e.length === 0 ? "/" : `/${e.map(fr).join("/")}`;
+function mr(e) {
+  return e.length === 0 ? "/" : `/${e.map(pr).join("/")}`;
 }
-function fr(e) {
+function pr(e) {
   return e.startsWith("*") ? `[...${e.slice(1)}]` : e.startsWith(":") ? `[${e.slice(1)}]` : e;
 }
-function lr(e) {
+function gr(e) {
   return e.flatMap((t) => t.startsWith(":") || t.startsWith("*") ? [t.slice(1)] : []);
 }
-function dr(e, t, r) {
+function yr(e, t, r) {
   const n = {};
   for (const s of e.segments) {
     if (!s.startsWith(":") && !s.startsWith("*"))
       continue;
-    const i = s.slice(1), o = r[i];
-    if (o === void 0)
+    const o = s.slice(1), i = r[o];
+    if (i === void 0)
       throw new Error(
-        `Static paths for "${e.file}" must include "${i}" for "${t}".`
+        `Static paths for "${e.file}" must include "${o}" for "${t}".`
       );
-    if (!mr(o))
+    if (!wr(i))
       throw new Error(
-        `Static path "${i}" for "${e.file}" must be a string, number, or boolean.`
+        `Static path "${o}" for "${e.file}" must be a string, number, or boolean.`
       );
-    n[i] = String(o);
+    n[o] = String(i);
   }
   return n;
 }
-function mr(e) {
+function wr(e) {
   return typeof e == "string" || typeof e == "number" || typeof e == "boolean";
 }
-function hr(e, t) {
+function Sr(e, t) {
   return `/${e.map((n) => n.startsWith("*") ? t[n.slice(1)].split("/").filter(Boolean).map(encodeURIComponent).join("/") : n.startsWith(":") ? encodeURIComponent(t[n.slice(1)]) : encodeURIComponent(n)).filter(Boolean).join("/")}`;
 }
-function pr(e) {
-  return R(e).reduce((t, r) => r.startsWith("*") ? t : r.startsWith(":") ? t + 1 : t + 2, 0);
+function Er(e) {
+  return v(e).reduce((t, r) => r.startsWith("*") ? t : r.startsWith(":") ? t + 1 : t + 2, 0);
 }
-function Q(e) {
+function re(e) {
   return e.replace(/^\/|\/$/g, "").split("/").filter(Boolean).map((t) => {
     try {
       return decodeURIComponent(t);
     } catch (r) {
-      throw new Ee(e, { cause: r });
+      throw new Te(e, { cause: r });
     }
   });
 }
-class Ee extends URIError {
+class Te extends URIError {
   pathname;
   constructor(t, r) {
     super(
@@ -967,35 +949,35 @@ class Ee extends URIError {
     ), this.name = "MalformedPathnameError", this.pathname = t;
   }
 }
-const C = "x-demiurge-navigation", gr = "data", yr = "data", se = "error", Ie = "not-found";
-function ot(e) {
-  return e.headers.get(C) === gr;
+const C = "x-demiurge-navigation", vr = "data", Rr = "data", ae = "error", Fe = "not-found";
+function ut(e) {
+  return e.headers.get(C) === vr;
 }
-function wr(e) {
+function br(e) {
   return Response.json(
     { data: e, hasData: !0 },
     {
       headers: {
         "cache-control": "no-store",
-        [C]: yr,
+        [C]: Rr,
         vary: C
       }
     }
   );
 }
-function q(e, t) {
+function _(e, t) {
   return e.headers.set("cache-control", "no-store"), e.headers.set(C, t), e.headers.append("vary", C), e;
 }
-function Sr(e) {
+function Tr(e) {
   if (typeof e == "string")
     return e;
-  const t = Er(br(
+  const t = xr(Cr(
     e.to,
     "path" in e ? e.path : void 0
-  )), r = e.search === void 0 ? t.search : Rr(e.search), n = e.hash === void 0 ? t.hash : e.hash ? e.hash.startsWith("#") ? e.hash : `#${e.hash}` : "";
+  )), r = e.search === void 0 ? t.search : Ar(e.search), n = e.hash === void 0 ? t.hash : e.hash ? e.hash.startsWith("#") ? e.hash : `#${e.hash}` : "";
   return `${t.pathname}${r}${n}`;
 }
-function Er(e) {
+function xr(e) {
   const t = e.indexOf("#"), r = t === -1 ? e : e.slice(0, t), n = r.indexOf("?");
   return {
     hash: t === -1 ? "" : e.slice(t),
@@ -1003,133 +985,133 @@ function Er(e) {
     search: n === -1 ? "" : r.slice(n)
   };
 }
-function Rr(e) {
+function Ar(e) {
   if (!e)
     return "";
   if (typeof e == "string")
     return e.startsWith("?") ? e : `?${e}`;
-  const r = (e instanceof URLSearchParams ? e : vr(e)).toString();
+  const r = (e instanceof URLSearchParams ? e : Pr(e)).toString();
   return r ? `?${r}` : "";
 }
-function vr(e) {
+function Pr(e) {
   const t = new URLSearchParams();
   for (const [r, n] of Object.entries(e)) {
     const s = Array.isArray(n) ? n : [n];
-    for (const i of s)
-      i != null && t.append(r, String(i));
+    for (const o of s)
+      o != null && t.append(r, String(o));
   }
   return t;
 }
-function br(e, t) {
+function Cr(e, t) {
   return t ? e.replace(
     /\[(\.\.\.)?([a-zA-Z_$][a-zA-Z0-9_$]*)\]/g,
     (r, n, s) => {
-      const i = t[s];
-      if (i === void 0)
+      const o = t[s];
+      if (o === void 0)
         throw new Error(`Missing path value for "${s}" in route "${e}".`);
-      return n ? String(i).split("/").filter(Boolean).map((o) => encodeURIComponent(o)).join("/") : encodeURIComponent(String(i));
+      return n ? String(o).split("/").filter(Boolean).map((i) => encodeURIComponent(i)).join("/") : encodeURIComponent(String(o));
     }
   ) : e;
 }
-function wi(e, t) {
+function Mo(e, t) {
   return {
     cors: t?.cors,
     kind: "json",
     security: t?.security,
-    timing: S(t?.timing),
+    timing: E(t?.timing),
     value: e,
     init: b(t)
   };
 }
-function Si(e, t) {
+function Io(e, t) {
   return {
     cors: t?.cors,
     init: b(t),
     kind: "jsonl",
     lines: e,
     security: t?.security,
-    timing: S(t?.timing)
+    timing: E(t?.timing)
   };
 }
-function Ei(e, t) {
+function Uo(e, t) {
   return {
     cors: t?.cors,
     kind: "text",
     security: t?.security,
-    timing: S(t?.timing),
+    timing: E(t?.timing),
     value: e,
     init: b(t)
   };
 }
-function Ri(e, t) {
+function Fo(e, t) {
   return {
     cors: t?.cors,
     kind: "html",
     security: t?.security,
-    timing: S(t?.timing),
+    timing: E(t?.timing),
     value: e,
     init: b(t)
   };
 }
-function vi(e, t) {
+function Ho(e, t) {
   const r = typeof t == "number" ? void 0 : t;
   return {
     cors: r?.cors,
     kind: "redirect",
     security: r?.security,
-    timing: S(r?.timing),
-    to: Or(e) ? Sr(e) : e,
+    timing: E(r?.timing),
+    to: Fr(e) ? Tr(e) : e,
     init: typeof t == "number" ? { status: t } : b(t)
   };
 }
-function bi(e, t) {
+function jo(e, t) {
   return {
     cors: t?.cors,
     kind: "not-found",
     security: t?.security,
-    timing: S(t?.timing),
+    timing: E(t?.timing),
     body: e,
     init: b(t)
   };
 }
-function Ti(e, t) {
+function Wo(e, t) {
   return {
     cors: t?.cors,
     kind: "response",
     response: e,
     security: t?.security,
-    timing: S(t?.timing)
+    timing: E(t?.timing)
   };
 }
-function xi(e, t) {
+function zo(e, t) {
   return {
     body: e,
     cors: t?.cors,
     init: b(t),
     kind: "stream",
     security: t?.security,
-    timing: S(t?.timing)
+    timing: E(t?.timing)
   };
 }
-function Pi(e, t) {
+function Bo(e, t) {
   return {
     cors: t?.cors,
     events: e,
     init: b(t),
     kind: "sse",
     security: t?.security,
-    timing: S(t?.timing)
+    timing: E(t?.timing)
   };
 }
-function ki(...e) {
+function qo(...e) {
   return e;
 }
-async function Tr(e, t) {
+async function Dr(e, t) {
   switch (e.kind) {
     case "json":
-      return new Response(JSON.stringify(await y(e.value, t)), {
+      return new Response(JSON.stringify(await w(e.value, t)), {
         ...e.init,
-        headers: ie(
+        headers: ce(
           e.init?.headers,
           "content-type",
           "application/json; charset=utf-8"
@@ -1137,10 +1119,10 @@ async function Tr(e, t) {
       });
     case "jsonl":
       return new Response(
-        Pr(await y(e.lines, t)),
+        kr(await w(e.lines, t)),
         {
           ...e.init,
-          headers: B(e.init?.headers, {
+          headers: K(e.init?.headers, {
             "cache-control": "no-cache",
             "content-type": "application/x-ndjson; charset=utf-8",
             "x-accel-buffering": "no"
@@ -1148,18 +1130,18 @@ async function Tr(e, t) {
         }
       );
     case "text":
-      return new Response(await y(e.value, t), {
+      return new Response(await w(e.value, t), {
         ...e.init,
-        headers: ie(
+        headers: ce(
           e.init?.headers,
           "content-type",
           "text/plain; charset=utf-8"
         )
       });
     case "html":
-      return new Response(await y(e.value, t), {
+      return new Response(await w(e.value, t), {
         ...e.init,
-        headers: ie(
+        headers: ce(
           e.init?.headers,
           "content-type",
           "text/html; charset=utf-8"
@@ -1167,7 +1149,7 @@ async function Tr(e, t) {
       });
     case "redirect": {
       const r = new Headers(e.init?.headers);
-      return r.set("location", String(await y(e.to, t))), new Response(null, {
+      return r.set("location", String(await w(e.to, t))), new Response(null, {
         ...e.init,
         headers: r,
         status: e.init?.status ?? 302
@@ -1175,20 +1157,20 @@ async function Tr(e, t) {
     }
     case "not-found":
       return new Response(
-        e.body ? await y(e.body, t) : null,
+        e.body ? await w(e.body, t) : null,
         {
           ...e.init,
           status: e.init?.status ?? 404
         }
       );
     case "response":
-      return await y(e.response, t);
+      return await w(e.response, t);
     case "stream":
       return new Response(
-        kr(await y(e.body, t)),
+        Nr(await w(e.body, t)),
         {
           ...e.init,
-          headers: B(e.init?.headers, {
+          headers: K(e.init?.headers, {
             "content-type": "application/octet-stream",
             "x-accel-buffering": "no"
           })
@@ -1196,10 +1178,10 @@ async function Tr(e, t) {
       );
     case "sse":
       return new Response(
-        xr(await y(e.events, t)),
+        $r(await w(e.events, t)),
         {
           ...e.init,
-          headers: B(e.init?.headers, {
+          headers: K(e.init?.headers, {
             "cache-control": "no-cache",
             "content-type": "text/event-stream; charset=utf-8",
             "x-accel-buffering": "no"
@@ -1208,22 +1190,22 @@ async function Tr(e, t) {
       );
   }
 }
-async function y(e, t) {
+async function w(e, t) {
   return typeof e != "function" ? e : await e(
     t
   );
 }
-function ie(e, t, r) {
-  return B(e, { [t]: r });
+function ce(e, t, r) {
+  return K(e, { [t]: r });
 }
-function B(e, t) {
+function K(e, t) {
   const r = new Headers(e);
   for (const [n, s] of Object.entries(t))
     r.has(n) || r.set(n, s);
   return r;
 }
-function xr(e) {
-  const t = new TextEncoder(), r = Re(e);
+function $r(e) {
+  const t = new TextEncoder(), r = xe(e);
   return new ReadableStream({
     async pull(n) {
       const s = await r.next();
@@ -1231,15 +1213,15 @@ function xr(e) {
         n.close();
         return;
       }
-      n.enqueue(t.encode(Dr(s.value)));
+      n.enqueue(t.encode(Mr(s.value)));
     },
     async cancel() {
       await r.return?.();
     }
   });
 }
-function Pr(e) {
-  const t = new TextEncoder(), r = Re(e);
+function kr(e) {
+  const t = new TextEncoder(), r = xe(e);
   return new ReadableStream({
     async pull(n) {
       const s = await r.next();
@@ -1255,8 +1237,8 @@ function Pr(e) {
     }
   });
 }
-function kr(e) {
-  const t = new TextEncoder(), r = Re(e);
+function Nr(e) {
+  const t = new TextEncoder(), r = xe(e);
   return new ReadableStream({
     async pull(n) {
       const s = await r.next();
@@ -1264,17 +1246,17 @@ function kr(e) {
         n.close();
         return;
       }
-      n.enqueue(Cr(s.value, t));
+      n.enqueue(Or(s.value, t));
     },
     async cancel() {
       await r.return?.();
     }
   });
 }
-function Cr(e, t) {
+function Or(e, t) {
   return typeof e == "string" ? t.encode(e) : e;
 }
-function Re(e) {
+function xe(e) {
   if (e instanceof ReadableStream) {
     const t = e.getReader();
     return {
@@ -1286,9 +1268,9 @@ function Re(e) {
       }
     };
   }
-  return Symbol.asyncIterator in e ? e[Symbol.asyncIterator]() : Ar(e[Symbol.iterator]());
+  return Symbol.asyncIterator in e ? e[Symbol.asyncIterator]() : Lr(e[Symbol.iterator]());
 }
-function Ar(e) {
+function Lr(e) {
   return {
     async next() {
       return e.next();
@@ -1298,35 +1280,35 @@ function Ar(e) {
     }
   };
 }
-function Dr(e) {
+function Mr(e) {
   if (typeof e == "string")
-    return $r(e);
+    return Ir(e);
   const t = [];
-  if (e.comment !== void 0 && t.push(...N("", e.comment)), e.id !== void 0 && t.push(...N("id", e.id)), e.event !== void 0 && t.push(...N("event", e.event)), e.retry !== void 0) {
+  if (e.comment !== void 0 && t.push(...M("", e.comment)), e.id !== void 0 && t.push(...M("id", e.id)), e.event !== void 0 && t.push(...M("event", e.event)), e.retry !== void 0) {
     if (!Number.isInteger(e.retry) || e.retry < 0)
       throw new Error("SSE retry must be a non-negative integer.");
     t.push(`retry: ${e.retry}`);
   }
-  return e.data !== void 0 && t.push(...N("data", Nr(e.data))), `${t.join(`
+  return e.data !== void 0 && t.push(...M("data", Ur(e.data))), `${t.join(`
 `)}
 
 `;
 }
-function $r(e) {
-  return `${N("data", e).join(`
+function Ir(e) {
+  return `${M("data", e).join(`
 `)}
 
 `;
 }
-function N(e, t) {
+function M(e, t) {
   return t.split(/\r\n|\r|\n/).map(
     (r) => e ? `${e}: ${r}` : `: ${r}`
   );
 }
-function Nr(e) {
+function Ur(e) {
   return typeof e == "string" ? e : JSON.stringify(e);
 }
-function Or(e) {
+function Fr(e) {
   return typeof e == "object" && e !== null && !(e instanceof URL) && "to" in e;
 }
 function b(e) {
@@ -1340,10 +1322,10 @@ function b(e) {
   } = e;
   return s;
 }
-function Lr(e, t) {
+function Hr(e, t) {
   if (!t?.length)
     return e;
-  const r = new Headers(e.headers), n = Ir(t), s = r.get("server-timing");
+  const r = new Headers(e.headers), n = jr(t), s = r.get("server-timing");
   return r.set(
     "server-timing",
     s ? `${s}, ${n}` : n
@@ -1353,15 +1335,15 @@ function Lr(e, t) {
     statusText: e.statusText
   });
 }
-function Ir(e) {
-  return e.map(Mr).join(", ");
+function jr(e) {
+  return e.map(Wr).join(", ");
 }
-function S(e) {
+function E(e) {
   if (e)
     return Array.isArray(e) ? e : [e];
 }
-function Mr(e) {
-  if (!Ur(e.name))
+function Wr(e) {
+  if (!zr(e.name))
     throw new Error(
       `Server-Timing metric name "${e.name}" is not a valid token.`
     );
@@ -1369,20 +1351,20 @@ function Mr(e) {
   if (e.duration !== void 0) {
     if (!Number.isFinite(e.duration) || e.duration < 0)
       throw new Error("Server-Timing metric duration must be a non-negative finite number.");
-    t.push(`dur=${Hr(e.duration)}`);
+    t.push(`dur=${Br(e.duration)}`);
   }
-  return e.description !== void 0 && t.push(`desc="${jr(e.description)}"`), t.join(";");
+  return e.description !== void 0 && t.push(`desc="${qr(e.description)}"`), t.join(";");
 }
-function Ur(e) {
+function zr(e) {
   return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(e);
 }
-function Hr(e) {
+function Br(e) {
   return Number.isInteger(e), String(e);
 }
-function jr(e) {
+function qr(e) {
   return e.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
 }
-const Fr = [
+const Gr = [
   400,
   401,
   402,
@@ -1423,7 +1405,7 @@ const Fr = [
   508,
   510,
   511
-], Wr = {
+], _r = {
   400: "Bad Request",
   401: "Unauthorized",
   402: "Payment Required",
@@ -1464,8 +1446,8 @@ const Fr = [
   508: "Loop Detected",
   510: "Not Extended",
   511: "Network Authentication Required"
-}, qr = new Set(Fr);
-class at extends Error {
+}, Vr = new Set(Gr);
+class lt extends Error {
   detail;
   extensions;
   headers;
@@ -1473,59 +1455,59 @@ class at extends Error {
   title;
   type;
   constructor(t, r = {}, n = {}) {
-    zr(t);
+    Jr(t);
     const s = typeof r == "string" ? { detail: r } : r, {
-      detail: i,
-      title: o = Wr[t],
+      detail: o,
+      title: i = _r[t],
       type: a = "about:blank",
       ...c
     } = s;
-    super(i ?? o, { cause: n.cause }), this.name = "HttpError", this.detail = i, this.extensions = Object.freeze({ ...c }), this.headers = new Headers(n.headers), this.status = t, this.title = o, this.type = a;
+    super(o ?? i, { cause: n.cause }), this.name = "HttpError", this.detail = o, this.extensions = Object.freeze({ ...c }), this.headers = new Headers(n.headers), this.status = t, this.title = i, this.type = a;
   }
 }
-function Ci(e, t, r) {
-  return new at(e, t, r);
+function Go(e, t, r) {
+  return new lt(e, t, r);
 }
-function ve(e) {
-  return e instanceof at;
+function Ae(e) {
+  return e instanceof lt;
 }
-function zr(e) {
-  if (!qr.has(e))
+function Jr(e) {
+  if (!Vr.has(e))
     throw new RangeError(
       `HTTP error status must be a standard 4xx or 5xx status; received ${JSON.stringify(e)}.`
     );
 }
-function Me({ pathname: e }) {
-  return /* @__PURE__ */ I("main", { children: [
-    /* @__PURE__ */ M("h1", { children: "404" }),
-    /* @__PURE__ */ I("p", { children: [
+function He({ pathname: e }) {
+  return /* @__PURE__ */ H("main", { children: [
+    /* @__PURE__ */ j("h1", { children: "404" }),
+    /* @__PURE__ */ H("p", { children: [
       "No route matched ",
       e,
       "."
     ] })
   ] });
 }
-function Ue({ status: e }) {
-  return /* @__PURE__ */ I("main", { children: [
-    /* @__PURE__ */ M("h1", { children: e }),
-    /* @__PURE__ */ M("p", { children: "Something went wrong." })
+function je({ status: e }) {
+  return /* @__PURE__ */ H("main", { children: [
+    /* @__PURE__ */ j("h1", { children: e }),
+    /* @__PURE__ */ j("p", { children: "Something went wrong." })
   ] });
 }
-function Br({ error: e, pathname: t, status: r }) {
-  const { message: n, name: s, stack: i } = ct(e);
-  return /* @__PURE__ */ I("main", { children: [
-    /* @__PURE__ */ I("h1", { children: [
+function Kr({ error: e, pathname: t, status: r }) {
+  const { message: n, name: s, stack: o } = ft(e);
+  return /* @__PURE__ */ H("main", { children: [
+    /* @__PURE__ */ H("h1", { children: [
       r,
       " ",
       s,
       " at ",
       t
     ] }),
-    /* @__PURE__ */ M("p", { children: n }),
-    i ? /* @__PURE__ */ M("pre", { children: i }) : null
+    /* @__PURE__ */ j("p", { children: n }),
+    o ? /* @__PURE__ */ j("pre", { children: o }) : null
   ] });
 }
-function ct(e) {
+function ft(e) {
   return e instanceof Error ? {
     message: e.message,
     name: e.name,
@@ -1536,27 +1518,27 @@ function ct(e) {
     stack: void 0
   };
 }
-const Gr = ["text/html", "application/xhtml+xml"];
-function ut(e) {
-  return _r(e.headers.get("accept"));
+const Yr = ["text/html", "application/xhtml+xml"];
+function dt(e) {
+  return Zr(e.headers.get("accept"));
 }
-function _r(e) {
-  return e ? Vr(e).some(
-    (t) => t.quality > 0 && Gr.includes(t.type)
+function Zr(e) {
+  return e ? Qr(e).some(
+    (t) => t.quality > 0 && Yr.includes(t.type)
   ) : !1;
 }
-function Vr(e) {
+function Qr(e) {
   return e.split(",").flatMap((t) => {
     const [r, ...n] = t.split(";"), s = r.trim().toLowerCase();
     return s ? [
       {
-        quality: Jr(n),
+        quality: Xr(n),
         type: s
       }
     ] : [];
   });
 }
-function Jr(e) {
+function Xr(e) {
   for (const t of e) {
     const [r, n] = t.split("=");
     if (r?.trim().toLowerCase() !== "q")
@@ -1566,14 +1548,14 @@ function Jr(e) {
   }
   return 1;
 }
-const Kr = "application/problem+json";
-function Yr({
+const en = "application/problem+json";
+function tn({
   detail: e,
   instance: t,
   status: r,
   title: n,
   type: s = "about:blank",
-  ...i
+  ...o
 }) {
   return {
     type: s,
@@ -1581,29 +1563,29 @@ function Yr({
     status: r,
     ...e === void 0 ? {} : { detail: e },
     ...t === void 0 ? {} : { instance: t },
-    ...i
+    ...o
   };
 }
-function V(e, t) {
+function Z(e, t) {
   const r = new Headers(t?.headers);
-  return r.set("content-type", `${Kr}; charset=utf-8`), new Response(JSON.stringify(Yr(e)), {
+  return r.set("content-type", `${en}; charset=utf-8`), new Response(JSON.stringify(tn(e)), {
     ...t,
     headers: r,
     status: e.status
   });
 }
-const Zr = "Internal Server Error";
-function ft(e) {
+const rn = "Internal Server Error";
+function ht(e) {
   return e === !0 && process.env.NODE_ENV !== "production";
 }
-async function G(e, t, r, n, s = {}) {
+async function Y(e, t, r, n, s = {}) {
   s.onError?.(r, n);
-  const i = new URL(t.url);
-  return n === "page" || n === "middleware" && ut(t) ? await Xr(e, i, r, s) : Qr(i, r, s);
+  const o = new URL(t.url);
+  return n === "page" || n === "middleware" && dt(t) ? await sn(e, o, r, s) : nn(o, r, s);
 }
-function Qr(e, t, r = {}) {
-  if (ve(t))
-    return V(
+function nn(e, t, r = {}) {
+  if (Ae(t))
+    return Z(
       {
         ...t.extensions,
         detail: t.detail,
@@ -1614,72 +1596,72 @@ function Qr(e, t, r = {}) {
       },
       { headers: t.headers }
     );
-  const { message: n } = ct(t);
-  return V({
+  const { message: n } = ft(t);
+  return Z({
     // `detail` carries the thrown message, so it is dev only for the same
     // reason the stack is.
-    ...ft(r.dev) ? { detail: n } : {},
+    ...ht(r.dev) ? { detail: n } : {},
     instance: `${e.pathname}${e.search}`,
     status: 500,
     title: "Internal Server Error"
   });
 }
-async function Xr(e, t, r, n) {
-  const s = lt(r);
+async function sn(e, t, r, n) {
+  const s = mt(r);
   try {
-    const i = await tn(
+    const o = await an(
       e,
       t.pathname,
       r,
       n
-    ), o = ve(r) ? new Headers(r.headers) : new Headers();
-    return o.set("content-type", "text/html; charset=utf-8"), new Response(await n.transformDocument?.(i) ?? i, {
-      headers: o,
+    ), i = Ae(r) ? new Headers(r.headers) : new Headers();
+    return i.set("content-type", "text/html; charset=utf-8"), new Response(await n.transformDocument?.(o) ?? o, {
+      headers: i,
       status: s
     });
-  } catch (i) {
-    return n.onError?.(i, "page"), en();
+  } catch (o) {
+    return n.onError?.(o, "page"), on();
   }
 }
-function en() {
-  return new Response(Zr, {
+function on() {
+  return new Response(rn, {
     headers: { "content-type": "text/plain; charset=utf-8" },
     status: 500
   });
 }
-async function tn(e, t, r, n) {
-  const s = await rn(e, t, n), i = Je({
+async function an(e, t, r, n) {
+  const s = await cn(e, t, n), o = Qe({
     dev: n.dev,
     nonce: n.nonce
-  }), o = Ze(
-    Ke(
-      i,
-      ue(s, { error: r, pathname: t, status: lt(r) })
+  }), i = tt(
+    Xe(
+      o,
+      de(s, { error: r, pathname: t, status: mt(r) })
     )
   );
-  return Ye({
-    body: { data: void 0, html: o, navigation: n.navigation },
+  return et({
+    body: { data: void 0, html: i, navigation: n.navigation },
     entrySrc: n.clientEntry,
     lang: n.lang,
     nonce: n.nonce,
-    scripts: i.scripts(),
+    scripts: o.scripts(),
     styles: n.styles,
     title: n.title
   });
 }
-function lt(e) {
-  return ve(e) ? e.status : 500;
+function mt(e) {
+  return Ae(e) ? e.status : 500;
 }
-async function rn(e, t, r) {
-  if (ft(r.dev))
-    return Br;
+async function cn(e, t, r) {
+  if (ht(r.dev))
+    return Kr;
   try {
-    return await nr(e, t) ?? Ue;
+    return await cr(e, t) ?? je;
   } catch {
-    return Ue;
+    return je;
   }
 }
-const J = "{nonce}", He = `'nonce-${J}'`, dt = {
+const Q = "{nonce}", We = `'nonce-${Q}'`, pt = {
   baseUri: ["'self'"],
   connectSrc: ["'self'"],
   defaultSrc: ["'self'"],
@@ -1688,14 +1670,14 @@ const J = "{nonce}", He = `'nonce-${J}'`, dt = {
   frameAncestors: ["'none'"],
   imgSrc: ["'self'", "data:", "blob:"],
   objectSrc: ["'none'"],
-  scriptSrc: [He, "'strict-dynamic'"],
-  styleSrc: ["'self'", He],
+  scriptSrc: [We, "'strict-dynamic'"],
+  styleSrc: ["'self'", We],
   upgradeInsecureRequests: !0
-}, nn = {
-  ...dt,
+}, un = {
+  ...pt,
   scriptSrc: ["'self'"],
   styleSrc: ["'self'"]
-}, je = {
+}, ze = {
   contentTypeOptions: "nosniff",
   crossOriginOpenerPolicy: "same-origin",
   crossOriginResourcePolicy: "same-origin",
@@ -1706,43 +1688,43 @@ const J = "{nonce}", He = `'nonce-${J}'`, dt = {
     maxAge: 31536e3,
     preload: !1
   }
-}, sn = {
+}, ln = {
   contentTypeOptions: "nosniff",
   crossOriginResourcePolicy: "same-origin",
   referrerPolicy: "strict-origin-when-cross-origin"
-}, $ = {
+}, L = {
   api(e = {}) {
-    return O(
+    return I(
       {
-        headers: sn
+        headers: ln
       },
       e
     );
   },
   preset(e, t = {}) {
-    return e === "api" ? $.api(t) : e === "cross-origin-isolated" ? $.crossOriginIsolated(t) : e === "static" ? $.static(t) : $.strict(t);
+    return e === "api" ? L.api(t) : e === "cross-origin-isolated" ? L.crossOriginIsolated(t) : e === "static" ? L.static(t) : L.strict(t);
   },
   static(e = {}) {
-    return O(
+    return I(
       {
-        csp: nn,
-        headers: je
+        csp: un,
+        headers: ze
       },
       e
     );
   },
   strict(e = {}) {
-    return O(
+    return I(
       {
-        csp: dt,
-        headers: je
+        csp: pt,
+        headers: ze
       },
       e
     );
   },
   crossOriginIsolated(e = {}) {
-    return O(
-      $.strict({
+    return I(
+      L.strict({
         headers: {
           crossOriginEmbedderPolicy: "require-corp",
           crossOriginOpenerPolicy: "same-origin"
@@ -1752,141 +1734,158 @@ const J = "{nonce}", He = `'nonce-${J}'`, dt = {
     );
   }
 };
-function Ai(e) {
+function _o(e) {
   return e;
 }
-function Di(e) {
+function Vo(e) {
   return e;
 }
-function on(...e) {
-  return e.reduce((t, r) => r ? O(t, r) : t, {});
+function fn(...e) {
+  return e.reduce((t, r) => r ? I(t, r) : t, {});
 }
-function K(...e) {
+function X(...e) {
   const t = e.reduce((r, n) => n ? {
-    document: on(r.document, n.document),
-    security: an(r.security, n.security)
+    document: fn(r.document, n.document),
+    security: dn(r.security, n.security)
   } : r, {});
   return {
     ...t,
-    document: un(t.document, t.security?.needs?.script)
+    document: mn(t.document, t.security?.needs)
   };
 }
-function an(...e) {
+function dn(...e) {
   return e.reduce((t, r) => r ? {
     csrf: r.csrf ?? t.csrf,
-    needs: cn(t.needs, r.needs),
+    fetchMetadata: r.fetchMetadata ?? t.fetchMetadata,
+    needs: hn(t.needs, r.needs),
     rateLimit: r.rateLimit ?? t.rateLimit,
-    request: ht(t.request, r.request)
+    request: wt(t.request, r.request)
   } : t, {});
 }
-function cn(e, t) {
-  const r = [.../* @__PURE__ */ new Set([
-    ...e?.script ?? [],
-    ...t?.script ?? []
-  ])];
-  return r.length > 0 ? { script: r } : void 0;
+const gt = [
+  { directive: "connectSrc", need: "connect" },
+  { directive: "imgSrc", need: "img" },
+  { directive: "scriptSrc", need: "script" }
+];
+function hn(e, t) {
+  const r = {};
+  for (const { need: n } of gt) {
+    const s = [.../* @__PURE__ */ new Set([
+      ...e?.[n] ?? [],
+      ...t?.[n] ?? []
+    ])];
+    s.length > 0 && (r[n] = s);
+  }
+  return Object.keys(r).length > 0 ? r : void 0;
+}
+function mn(e, t) {
+  if (!e?.csp || !t)
+    return e;
+  let r = e.csp;
+  for (const { directive: n, need: s } of gt)
+    r = pn(r, n, s, t[s]);
+  return r === e.csp ? e : { ...e, csp: r };
 }
-function un(e, t) {
-  if (!e?.csp || !t || t.length === 0)
+function pn(e, t, r, n) {
+  if (!n || n.length === 0)
     return e;
-  if (e.csp.scriptSrc === !1)
+  if (e[t] === !1)
     throw new Error(
-      `A route policy declares security.needs.script and sets csp.scriptSrc to false. Set an explicit csp.scriptSrc that includes ${t.join(", ")}.`
+      `A route policy declares security.needs.${r} and sets csp.${t} to false. Set an explicit csp.${t} that includes ${n.join(", ")}.`
     );
-  if (e.csp.scriptSrc === void 0 && e.csp.defaultSrc === void 0)
+  if (e[t] === void 0 && e.defaultSrc === void 0)
     return e;
-  const r = e.csp.scriptSrc ?? e.csp.defaultSrc, n = x(r) ?? [];
-  return Array.isArray(n) ? {
+  const s = x(
+    e[t] ?? e.defaultSrc
+  ) ?? [];
+  return Array.isArray(s) ? {
     ...e,
-    csp: {
-      ...e.csp,
-      scriptSrc: [.../* @__PURE__ */ new Set([...n, ...t])]
-    }
+    [t]: [.../* @__PURE__ */ new Set([...s, ...n])]
   } : e;
 }
-async function $i(e, t = "sha256") {
+async function Jo(e, t = "sha256") {
   const r = await globalThis.crypto.subtle.digest(
-    bn(t),
+    $n(t),
     new TextEncoder().encode(e)
   );
-  return `'${t}-${Tn(new Uint8Array(r))}'`;
+  return `'${t}-${kn(new Uint8Array(r))}'`;
 }
-function F(e, t = {}) {
-  e.csp && En(e.csp), Sn(e);
-  const r = new Headers(), n = e.csp !== !1 && e.csp ? gn(e.csp, t) : void 0, s = hn(e.trustedTypes), i = e.trustedTypes ? e.trustedTypes.mode === "report-only" : !1;
-  return w(
+function q(e, t = {}) {
+  e.csp && Pn(e.csp), An(e);
+  const r = new Headers(), n = e.csp !== !1 && e.csp ? bn(e.csp, t) : void 0, s = En(e.trustedTypes), o = e.trustedTypes ? e.trustedTypes.mode === "report-only" : !1;
+  return S(
     r,
     "content-security-policy",
-    Y(n, i ? void 0 : s)
-  ), w(
+    ee(n, o ? void 0 : s)
+  ), S(
     r,
     "content-security-policy-report-only",
-    i ? Y(s, gt(e.csp)) : void 0
-  ), mn(r, e.headers, t), r;
+    o ? ee(s, Et(e.csp)) : void 0
+  ), Sn(r, e.headers, t), r;
 }
-function X(e) {
-  return !e || !e.csp ? !1 : W(e.csp).some(([, t]) => {
+function ne(e) {
+  return !e || !e.csp ? !1 : G(e.csp).some(([, t]) => {
     const r = x(t);
-    return Array.isArray(r) && r.some((n) => n.includes(J));
+    return Array.isArray(r) && r.some((n) => n.includes(Q));
   });
 }
-function mt() {
+function yt() {
   const e = new Uint8Array(16);
   return globalThis.crypto.getRandomValues(e), btoa(String.fromCharCode(...e));
 }
-function O(e, t) {
+function I(e, t) {
   return {
-    csp: ln(e.csp, t.csp),
-    headers: fn(e.headers, t.headers),
+    csp: yn(e.csp, t.csp),
+    headers: gn(e.headers, t.headers),
     trustedTypes: t.trustedTypes ?? e.trustedTypes
   };
 }
-function fn(e, t) {
-  const r = ht(e, t);
+function gn(e, t) {
+  const r = wt(e, t);
   return !r || t?.reportingEndpoints === !1 || e?.reportingEndpoints && t?.reportingEndpoints && (r.reportingEndpoints = {
     ...e.reportingEndpoints,
     ...t.reportingEndpoints
   }), r;
 }
-function ht(e, t) {
+function wt(e, t) {
   return t ? {
     ...e ?? {},
     ...t
   } : e;
 }
-function ln(e, t) {
+function yn(e, t) {
   if (t === !1)
     return !1;
   if (!t)
     return e;
   if (!e)
-    return oe(t);
-  const r = oe(e), n = oe(t), s = {
+    return ue(t);
+  const r = ue(e), n = ue(t), s = {
     ...r,
     ...n
   };
-  for (const [i, o] of W(t)) {
+  for (const [o, i] of G(t)) {
     const a = x(
-      r[i]
+      r[o]
     );
-    !be(o) && Array.isArray(a) && Array.isArray(o) && pt(
+    !Pe(i) && Array.isArray(a) && Array.isArray(i) && St(
       s,
-      i,
-      dn([...a, ...o])
+      o,
+      wn([...a, ...i])
     );
   }
   return s;
 }
-function oe(e) {
+function ue(e) {
   const t = { ...e };
-  for (const [r, n] of W(e))
-    be(n) && pt(t, r, n.replace);
+  for (const [r, n] of G(e))
+    Pe(n) && St(t, r, n.replace);
   return t;
 }
-function dn(e) {
+function wn(e) {
   return [...new Set(e)];
 }
-function pt(e, t, r) {
+function St(e, t, r) {
   if (!(t === "reportTo" || t === "upgradeInsecureRequests")) {
     if (t === "reportUri") {
       e.reportUri = r;
@@ -1895,87 +1894,96 @@ function pt(e, t, r) {
     e[t] = r;
   }
 }
-function mn(e, t, r) {
-  t && (w(e, "referrer-policy", t.referrerPolicy), w(e, "x-content-type-options", t.contentTypeOptions), w(e, "cross-origin-opener-policy", t.crossOriginOpenerPolicy), w(e, "cross-origin-embedder-policy", t.crossOriginEmbedderPolicy), w(e, "cross-origin-resource-policy", t.crossOriginResourcePolicy), w(e, "permissions-policy", t.permissionsPolicy), w(
+function Sn(e, t, r) {
+  t && (S(e, "referrer-policy", t.referrerPolicy), S(e, "x-content-type-options", t.contentTypeOptions), S(e, "cross-origin-opener-policy", t.crossOriginOpenerPolicy), S(e, "cross-origin-embedder-policy", t.crossOriginEmbedderPolicy), S(e, "cross-origin-resource-policy", t.crossOriginResourcePolicy), S(e, "permissions-policy", t.permissionsPolicy), S(
     e,
     "reporting-endpoints",
-    yn(t.reportingEndpoints)
+    Tn(t.reportingEndpoints)
   ), t.strictTransportSecurity && (!r.request || new URL(r.request.url).protocol === "https:") && e.set(
     "strict-transport-security",
-    pn(t.strictTransportSecurity)
+    Rn(t.strictTransportSecurity)
   ));
 }
-function hn(e) {
+function En(e) {
   if (!e)
     return;
   const t = [];
-  return e.requireFor?.includes("script") && t.push("require-trusted-types-for 'script'"), e.policies.length > 0 && t.push(`trusted-types ${e.policies.join(" ")}`), Y(...t);
-}
-function Y(...e) {
+  return e.requireFor?.includes("script") && t.push("require-trusted-types-for 'script'"), t.push(vn(e)), ee(...t);
+}
+function vn(e) {
+  if (e.policies !== void 0 && e.policies.length === 0)
+    return "trusted-types 'none'";
+  const t = [Ft];
+  e.allowDefaultPolicy && t.push("default");
+  for (const r of e.policies ?? [])
+    t.push(r);
+  return `trusted-types ${[...new Set(t)].join(" ")}`;
+}
+function ee(...e) {
   const t = e.filter((r) => r);
   return t.length > 0 ? t.join("; ") : void 0;
 }
-function w(e, t, r) {
+function S(e, t, r) {
   r && e.set(t, r);
 }
-function pn(e) {
+function Rn(e) {
   const t = [`max-age=${e.maxAge}`];
   return e.includeSubDomains && t.push("includeSubDomains"), e.preload && t.push("preload"), t.join("; ");
 }
-function gn(e, t) {
+function bn(e, t) {
   const r = [];
-  for (const [s, i] of W(e)) {
+  for (const [s, o] of G(e)) {
     if (s === "reportTo" || s === "reportUri")
       continue;
-    const o = x(i);
-    if (o === !1 || o === void 0)
+    const i = x(o);
+    if (i === !1 || i === void 0)
       continue;
-    const a = yt(s);
-    if (o === !0) {
+    const a = vt(s);
+    if (i === !0 || s === "sandbox" && Array.isArray(i) && i.length === 0) {
       r.push(a);
       continue;
     }
     r.push(
-      `${a} ${vn(o, t).join(" ")}`
+      `${a} ${Dn(i, t).join(" ")}`
     );
   }
-  const n = gt(e);
+  const n = Et(e);
   return n && r.push(n), r.join("; ");
 }
-function gt(e) {
+function Et(e) {
   if (!e)
     return;
   const t = [], r = x(e.reportUri);
-  return Array.isArray(r) && r.length && t.push(`report-uri ${r.join(" ")}`), e.reportTo && t.push(`report-to ${e.reportTo}`), Y(...t);
+  return Array.isArray(r) && r.length && t.push(`report-uri ${r.join(" ")}`), e.reportTo && t.push(`report-to ${e.reportTo}`), ee(...t);
 }
-function yn(e) {
+function Tn(e) {
   if (e)
-    return Object.entries(e).sort(([t], [r]) => t.localeCompare(r)).map(([t, r]) => `${t}="${wn(r)}"`).join(", ");
+    return Object.entries(e).sort(([t], [r]) => t.localeCompare(r)).map(([t, r]) => `${t}="${xn(r)}"`).join(", ");
 }
-function wn(e) {
+function xn(e) {
   return e.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
 }
-function Sn(e) {
+function An(e) {
   const t = e.headers?.reportingEndpoints;
   if (t) {
     const s = Object.entries(t);
     if (s.length === 0)
       throw new Error("Demiurge Reporting-Endpoints requires at least one endpoint.");
-    for (const [i, o] of s)
-      Fe(i), We(o, `Reporting-Endpoints member ${JSON.stringify(i)}`);
+    for (const [o, i] of s)
+      Be(o), qe(i, `Reporting-Endpoints member ${JSON.stringify(o)}`);
   }
   const r = e.csp || void 0;
-  if (r?.reportTo && (Fe(r.reportTo), !t || !(r.reportTo in t)))
+  if (r?.reportTo && (Be(r.reportTo), !t || !(r.reportTo in t)))
     throw new Error(
       `Demiurge CSP report-to group ${JSON.stringify(r.reportTo)} is not defined in headers.reportingEndpoints.`
     );
   const n = x(r?.reportUri);
   for (const s of Array.isArray(n) ? n : [])
-    We(s, "CSP report-uri target");
+    qe(s, "CSP report-uri target");
 }
-function En(e) {
-  for (const [t, r] of W(e)) {
-    const n = yt(t);
+function Pn(e) {
+  for (const [t, r] of G(e)) {
+    const n = vt(t);
     if (r === void 0)
       continue;
     if (t === "reportTo") {
@@ -1992,27 +2000,34 @@ function En(e) {
         );
       continue;
     }
+    if (t === "sandbox") {
+      if (typeof r != "boolean" && (!Array.isArray(r) || !r.every((o) => typeof o == "string")))
+        throw new Error(
+          `Demiurge CSP directive ${JSON.stringify(n)} must be a boolean or a list of sandbox tokens.`
+        );
+      continue;
+    }
     const s = x(r);
-    if (s !== !1 && (!Array.isArray(s) || !s.every((i) => typeof i == "string")))
+    if (s !== !1 && (!Array.isArray(s) || !s.every((o) => typeof o == "string")))
       throw new Error(
         `Demiurge CSP directive ${JSON.stringify(n)} must be a source list, false, or a replacement object with a source list.`
       );
   }
 }
-function be(e) {
+function Pe(e) {
   return !!(e && typeof e == "object" && !Array.isArray(e) && "replace" in e);
 }
 function x(e) {
-  return be(e) ? e.replace : e;
+  return Pe(e) ? e.replace : e;
 }
-function Fe(e) {
+function Be(e) {
   if (!/^(?:[a-z]|\*)[a-z0-9_.*-]*$/.test(e))
     throw new Error(
       `Invalid reporting endpoint name ${JSON.stringify(e)}. Use a lowercase Structured Field key.`
     );
 }
-function We(e, t) {
-  if (!Rn(e) || /[\s,;"\\]/.test(e) || !e.startsWith("/") && !e.startsWith("https://"))
+function qe(e, t) {
+  if (!Cn(e) || /[\s,;"\\]/.test(e) || !e.startsWith("/") && !e.startsWith("https://"))
     throw new Error(`${t} must be a same-origin path or an HTTPS URL.`);
   if (e.startsWith("//"))
     throw new Error(`${t} must not be a scheme-relative URL.`);
@@ -2025,81 +2040,81 @@ function We(e, t) {
   if (r.username || r.password || r.hash)
     throw new Error(`${t} must not contain credentials or a fragment.`);
 }
-function Rn(e) {
+function Cn(e) {
   return /^[\x20-\x7e]+$/.test(e);
 }
-function W(e) {
+function G(e) {
   return Object.entries(e);
 }
-function vn(e, t) {
+function Dn(e, t) {
   return e.map((r) => {
-    if (!r.includes(J))
+    if (!r.includes(Q))
       return r;
     if (!t.nonce)
       throw new Error("Demiurge security policy requires a CSP nonce.");
-    return r.replaceAll(J, t.nonce);
+    return r.replaceAll(Q, t.nonce);
   });
 }
-function yt(e) {
+function vt(e) {
   return e.replace(/[A-Z]/g, (t) => `-${t.toLowerCase()}`);
 }
-function bn(e) {
+function $n(e) {
   return e === "sha384" ? "SHA-384" : e === "sha512" ? "SHA-512" : "SHA-256";
 }
-function Tn(e) {
+function kn(e) {
   let t = "";
   for (const r of e)
     t += String.fromCharCode(r);
   return typeof btoa == "function" ? btoa(t) : Buffer.from(t, "binary").toString("base64");
 }
-function wt(e, t, r = {}) {
-  Te(e);
+function Rt(e, t, r = {}) {
+  Ce(e);
   const n = t.request.headers.get("origin"), s = new Headers();
-  if (e.origins !== "*" && St(s, "Origin"), !n)
+  if (e.origins !== "*" && bt(s, "Origin"), !n)
     return s;
-  const i = kn(e, n);
-  if (!i)
+  const o = Ln(e, n);
+  if (!o)
     return s;
-  if (s.set("access-control-allow-origin", i), e.credentials && s.set("access-control-allow-credentials", "true"), e.exposeHeaders?.length && s.set("access-control-expose-headers", e.exposeHeaders.join(", ")), r.preflight) {
+  if (s.set("access-control-allow-origin", o), e.credentials && s.set("access-control-allow-credentials", "true"), e.exposeHeaders?.length && s.set("access-control-expose-headers", e.exposeHeaders.join(", ")), r.preflight) {
     s.set("access-control-allow-methods", r.methods.join(", "));
-    const o = t.request.headers.get(
+    const i = t.request.headers.get(
       "access-control-request-headers"
-    ), a = e.headers?.join(", ") ?? o;
+    ), a = e.headers?.join(", ") ?? i;
     a && s.set("access-control-allow-headers", a), e.maxAge !== void 0 && s.set("access-control-max-age", String(e.maxAge));
   }
   return s;
 }
-function _(e, t, r) {
+function U(e, t, r) {
   if (!t)
     return e;
   const n = new Headers(e.headers);
-  return Cn(n, wt(t, { request: r })), new Response(e.body, {
+  return Mn(n, Rt(t, { request: r })), new Response(e.body, {
     headers: n,
     status: e.status,
     statusText: e.statusText
   });
 }
-function xn(e, t) {
-  const r = t.headers.get("access-control-request-method"), n = An(r);
+function Nn(e, t) {
+  const r = t.headers.get("access-control-request-method"), n = In(r);
   if (!n)
     return null;
-  const s = Et(e, n);
+  const s = Tt(e, n);
   if (!s?.cors)
     return null;
-  const i = s.cors.methods ?? Dn(e);
-  return i.includes(n) ? new Response(null, {
-    headers: wt(
+  const o = s.cors.methods ?? Un(e);
+  return o.includes(n) ? new Response(null, {
+    headers: Rt(
       s.cors,
       { request: t },
       {
-        methods: i,
+        methods: o,
         preflight: !0
       }
     ),
     status: 204
   }) : null;
 }
-function Te(e) {
+function Ce(e) {
   if (e.credentials && e.origins === "*")
     throw new Error(
       "Demiurge CORS policy cannot use wildcard origins with credentials."
@@ -2110,59 +2125,59 @@ function Te(e) {
     );
   if (e.origins !== "*")
     for (const t of e.origins)
-      Pn(t);
+      On(t);
   if (e.maxAge !== void 0 && (!Number.isSafeInteger(e.maxAge) || e.maxAge < 0))
     throw new Error(
       "Demiurge CORS maxAge must be a non-negative integer number of seconds."
     );
 }
-function Pn(e) {
+function On(e) {
   let t;
   try {
     t = new URL(e);
   } catch {
-    throw qe(e);
+    throw Ge(e);
   }
   if (t.protocol !== "http:" && t.protocol !== "https:" || t.origin !== e)
-    throw qe(e);
+    throw Ge(e);
 }
-function qe(e) {
+function Ge(e) {
   return new Error(
     `Demiurge CORS origin ${JSON.stringify(e)} must be a canonical HTTP(S) origin without credentials, a path, query, or fragment.`
   );
 }
-function kn(e, t) {
+function Ln(e, t) {
   return e.origins === "*" ? "*" : e.origins.includes(t) ? t : null;
 }
-function Cn(e, t) {
+function Mn(e, t) {
   t.forEach((r, n) => {
     if (n === "vary" && e.has("vary")) {
       for (const s of r.split(","))
-        St(e, s.trim());
+        bt(e, s.trim());
       return;
     }
     e.set(n, r);
   });
 }
-function St(e, t) {
+function bt(e, t) {
   if (!t)
     return;
   const r = e.get("vary")?.split(",").map((n) => n.trim()).filter(Boolean) ?? [];
   r.some((n) => n.toLowerCase() === t.toLowerCase()) || e.set("vary", [...r, t].join(", "));
 }
-function An(e) {
+function In(e) {
   if (!e)
     return null;
   const t = e.toUpperCase();
-  return $n(t) ? t : null;
+  return Fn(t) ? t : null;
 }
-function Et(e, t) {
-  return t === "HEAD" ? e.HEAD ?? ze(e.GET) : ze(e[t]);
+function Tt(e, t) {
+  return t === "HEAD" ? e.HEAD ?? _e(e.GET) : _e(e[t]);
 }
-function ze(e) {
+function _e(e) {
   return e?.kind === "page" ? void 0 : e;
 }
-function Dn(e) {
+function Un(e) {
   return [
     "GET",
     "POST",
@@ -2171,25 +2186,25 @@ function Dn(e) {
     "DELETE",
     "OPTIONS",
     "HEAD"
-  ].filter((t) => Et(e, t));
+  ].filter((t) => Tt(e, t));
 }
-function $n(e) {
+function Fn(e) {
   return e === "GET" || e === "POST" || e === "PUT" || e === "PATCH" || e === "DELETE" || e === "OPTIONS" || e === "HEAD";
 }
-const Nn = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]);
-function On(e = {}) {
-  const t = [], r = e.document, n = r ? Mn(r.policy, r.headers, t) : {};
-  r && Ln(r.policy, t);
-  const s = e.route ? Gn(e.route, t) : void 0;
-  return r?.scripts && (Un(
+const Hn = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]);
+function jn(e = {}) {
+  const t = [], r = e.document, n = r ? Bn(r.policy, r.headers, t) : {};
+  r && Wn(r.policy, t);
+  const s = e.route ? Qn(e.route, t) : void 0;
+  return r?.scripts && (qn(
     r.policy.csp,
     r.scripts,
     r.headers,
     t
   ), r.scriptDependencies && t.push(
-    ...In(
+    ...zn(
       r.scripts,
-      Hn(r.scriptDependencies)
+      Gn(r.scriptDependencies)
     )
   )), {
     findings: t,
@@ -2197,21 +2212,21 @@ function On(e = {}) {
     route: s
   };
 }
-function Ln(e, t) {
+function Wn(e, t) {
   if (!e.trustedTypes || e.trustedTypes.mode !== "report-only")
     return;
-  const r = e.csp || void 0, n = !!me(r?.reportUri)?.length, s = e.headers?.reportingEndpoints, i = !!(r?.reportTo && s && s[r.reportTo]);
-  !n && !i && t.push({
+  const r = e.csp || void 0, n = !!ge(r?.reportUri)?.length, s = e.headers?.reportingEndpoints, o = !!(r?.reportTo && s && s[r.reportTo]);
+  !n && !o && t.push({
     code: "report-only-target-missing",
     message: "Trusted Types report-only mode has no deliverable target. Configure CSP reportTo with a matching Reporting-Endpoints member, reportUri for compatibility, or both.",
     severity: "warning"
   });
 }
-function In(e, t = {}) {
+function zn(e, t = {}) {
   const r = t.requirePurpose ?? !0, n = [];
   for (const s of e) {
-    const i = Jn(s);
-    i && (r && !s.purpose && n.push({
+    const o = ts(s);
+    o && (r && !s.purpose && n.push({
       code: "script-purpose-missing",
       message: `Third-party script ${s.src} should declare a purpose for audits and consent flows.`,
       severity: "warning"
@@ -2223,7 +2238,7 @@ function In(e, t = {}) {
       code: "script-third-party-before-interactive",
       message: `Third-party script ${s.src} runs before the app is interactive and should be justified by policy.`,
       severity: "warning"
-    }), Kn(i) && n.push({
+    }), rs(o) && n.push({
       code: "script-gtm-wide-trust-boundary",
       message: "Google Tag Manager can load additional scripts at runtime and should be treated as a wide trust boundary.",
       severity: "warning"
@@ -2231,9 +2246,9 @@ function In(e, t = {}) {
   }
   return n;
 }
-function Mn(e, t, r) {
+function Bn(e, t, r) {
   try {
-    return Object.fromEntries(F(e, t));
+    return Object.fromEntries(q(e, t));
   } catch (n) {
     return r.push({
       code: "security-header-render-failed",
@@ -2242,71 +2257,71 @@ function Mn(e, t, r) {
     }), {};
   }
 }
-function Un(e, t, r, n) {
+function qn(e, t, r, n) {
   if (!e)
     return;
-  const s = jn(e);
-  for (const i of t) {
-    if (Fn(s) && !i.nonce) {
+  const s = _n(e);
+  for (const o of t) {
+    if (Vn(s) && !o.nonce) {
       n.push({
         code: "csp-script-missing-nonce",
-        message: `Document script ${i.src} needs a nonce for the effective script-src policy.`,
+        message: `Document script ${o.src} needs a nonce for the effective script-src policy.`,
         severity: "error"
       });
       continue;
     }
-    i.nonce && r?.nonce && i.nonce === r.nonce || Wn(s, i.src) || n.push({
+    o.nonce && r?.nonce && o.nonce === r.nonce || Jn(s, o.src) || n.push({
       code: "csp-script-src-blocked",
-      message: `Document script ${i.src} is not allowed by the effective script-src policy.`,
+      message: `Document script ${o.src} is not allowed by the effective script-src policy.`,
       severity: "error"
     });
   }
 }
-function Hn(e) {
+function Gn(e) {
   return typeof e == "boolean" ? {} : e;
 }
-function jn(e) {
-  return me(e.scriptSrc) ?? me(e.defaultSrc) ?? [];
+function _n(e) {
+  return ge(e.scriptSrc) ?? ge(e.defaultSrc) ?? [];
 }
-function me(e) {
+function ge(e) {
   if (e)
     return "replace" in e ? e.replace : e;
 }
-function Fn(e) {
+function Vn(e) {
   return e.some((t) => t.includes("'nonce-{nonce}'"));
 }
-function Wn(e, t) {
-  return Bn(e) ? !1 : e.includes("*") ? !0 : e.includes("'none'") || e.some((r) => r.startsWith("'nonce-")) ? !1 : e.includes("'self'") && qn(t) || t.startsWith("https:") && e.includes("https:") || t.startsWith("http:") && e.includes("http:") ? !0 : e.some((r) => zn(r, t));
+function Jn(e, t) {
+  return Zn(e) ? !1 : e.includes("*") ? !0 : e.includes("'none'") || e.some((r) => r.startsWith("'nonce-")) ? !1 : e.includes("'self'") && Kn(t) || t.startsWith("https:") && e.includes("https:") || t.startsWith("http:") && e.includes("http:") ? !0 : e.some((r) => Yn(r, t));
 }
-function qn(e) {
+function Kn(e) {
   return e.startsWith("/") && !e.startsWith("//");
 }
-function zn(e, t) {
+function Yn(e, t) {
   if (e.startsWith("'"))
     return !1;
   try {
-    const r = new URL(e), n = new URL(t), s = r.hostname.startsWith("*.") ? n.hostname.endsWith(r.hostname.slice(1)) && n.hostname !== r.hostname.slice(2) : n.hostname === r.hostname, i = r.pathname === "/" || r.pathname.endsWith("/") ? n.pathname.startsWith(r.pathname) : n.pathname === r.pathname;
-    return n.protocol === r.protocol && s && n.port === r.port && i;
+    const r = new URL(e), n = new URL(t), s = r.hostname.startsWith("*.") ? n.hostname.endsWith(r.hostname.slice(1)) && n.hostname !== r.hostname.slice(2) : n.hostname === r.hostname, o = r.pathname === "/" || r.pathname.endsWith("/") ? n.pathname.startsWith(r.pathname) : n.pathname === r.pathname;
+    return n.protocol === r.protocol && s && n.port === r.port && o;
   } catch {
     return !1;
   }
 }
-function Bn(e) {
+function Zn(e) {
   return e.includes("'strict-dynamic'") && e.some(
     (t) => t.startsWith("'nonce-") || /^'sha(?:256|384|512)-/.test(t)
   );
 }
-function Gn(e, t) {
-  return _n(e.cors, t), Vn(e.method, e.security, t), {
+function Qn(e, t) {
+  return Xn(e.cors, t), es(e.method, e.security, t), {
     cors: e.cors,
     method: e.method,
     security: e.security
   };
 }
-function _n(e, t) {
+function Xn(e, t) {
   if (e)
     try {
-      Te(e);
+      Ce(e);
     } catch (r) {
       t.push({
         code: "cors-invalid",
@@ -2315,8 +2330,8 @@ function _n(e, t) {
       });
     }
 }
-function Vn(e, t, r) {
-  Nn.has(e) && (t?.csrf === !1 && r.push({
+function es(e, t, r) {
+  Hn.has(e) && (t?.csrf === !1 && r.push({
     code: "csrf-disabled",
     message: "CSRF protection is explicitly disabled for this unsafe route.",
     severity: "info"
@@ -2330,7 +2345,7 @@ function Vn(e, t, r) {
     severity: "warning"
   }));
 }
-function Jn(e) {
+function ts(e) {
   try {
     const t = new URL(e.src);
     if (t.protocol === "http:" || t.protocol === "https:")
@@ -2340,17 +2355,17 @@ function Jn(e) {
   }
   return null;
 }
-function Kn(e) {
+function rs(e) {
   return e.hostname === "www.googletagmanager.com" && (e.pathname === "/gtm.js" || e.pathname === "/ns.html");
 }
-const Yn = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]), Zn = /^[!#$%&'*+\-.^_`|~A-Za-z0-9]+$/;
-function Qn() {
+const ns = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]), ss = /^[!#$%&'*+\-.^_`|~A-Za-z0-9]+$/;
+function os() {
   const e = new Uint8Array(32);
   return globalThis.crypto.getRandomValues(e), btoa(String.fromCharCode(...e)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
 }
-function Xn(e, t = {}) {
+function is(e, t = {}) {
   const r = t.cookie ?? "csrf-token";
-  if (!Zn.test(r))
+  if (!ss.test(r))
     throw new Error("Demiurge CSRF cookie name is invalid.");
   if (!e)
     throw new Error("Demiurge CSRF token must not be empty.");
@@ -2361,25 +2376,25 @@ function Xn(e, t = {}) {
   ];
   return (t.secure ?? !0) && n.push("Secure"), n.join("; ");
 }
-function Ni(e = {}) {
-  const t = Qn();
+function Ko(e = {}) {
+  const t = os();
   return {
-    cookie: Xn(t, e),
+    cookie: is(t, e),
     token: t
   };
 }
-function es(e, t) {
-  if (!Yn.has(t.method.toUpperCase()) || e === !1)
+function as(e, t) {
+  if (!ns.has(t.method.toUpperCase()) || e === !1)
     return null;
   const r = t.headers.get("cookie");
   if (e === void 0 && !r?.trim())
     return null;
-  const n = rs(e ?? !0), i = ts(r).get(n.cookie), o = t.headers.get(n.header);
-  return !i || !o || !ss(i, o) ? new Response("Invalid CSRF token.", {
+  const n = us(e ?? !0), o = cs(r).get(n.cookie), i = t.headers.get(n.header);
+  return !o || !i || !fs(o, i) ? new Response("Invalid CSRF token.", {
     status: 403
   }) : null;
 }
-function ts(e) {
+function cs(e) {
   const t = /* @__PURE__ */ new Map();
   if (!e)
     return t;
@@ -2387,12 +2402,12 @@ function ts(e) {
     const n = r.indexOf("=");
     if (n === -1)
       continue;
-    const s = r.slice(0, n).trim(), i = r.slice(n + 1).trim();
-    s && t.set(s, ns(i));
+    const s = r.slice(0, n).trim(), o = r.slice(n + 1).trim();
+    s && t.set(s, ls(o));
   }
   return t;
 }
-function rs(e) {
+function us(e) {
   return e === !0 ? {
     cookie: "csrf-token",
     header: "x-csrf-token"
@@ -2401,27 +2416,88 @@ function rs(e) {
     header: e.header ?? "x-csrf-token"
   };
 }
-function ns(e) {
+function ls(e) {
   try {
     return decodeURIComponent(e);
   } catch {
     return e;
   }
 }
-function ss(e, t) {
+function fs(e, t) {
   let r = e.length ^ t.length;
   const n = Math.max(e.length, t.length);
   for (let s = 0; s < n; s += 1)
     r |= e.charCodeAt(s) ^ t.charCodeAt(s);
   return r === 0;
 }
-const is = {
+const le = "Sec-Fetch-Dest", ds = "Sec-Fetch-Mode", hs = "Sec-Fetch-Site", ms = /* @__PURE__ */ new Set(["embed", "object"]), ps = /* @__PURE__ */ new Set(["GET", "HEAD"]), Ve = {
+  allowCrossSite: !1,
+  allowNavigation: !0,
+  allowSameSite: !1
+};
+function gs(e, t, r = t.method) {
+  const n = e === !0 ? Ve : { ...Ve, ...e }, s = [];
+  if (ws(t, r))
+    return { allowed: !0, reason: "cors-preflight", vary: s };
+  s.push(hs);
+  const o = t.headers.get("sec-fetch-site");
+  if (o === null)
+    return { allowed: !0, reason: "metadata-absent", vary: s };
+  if (o === "same-origin")
+    return { allowed: !0, reason: "same-origin", vary: s };
+  if (o === "none")
+    return { allowed: !0, reason: "user-initiated", vary: s };
+  if (o === "same-site" && n.allowSameSite)
+    return { allowed: !0, reason: "same-site-trusted", vary: s };
+  if (n.allowCrossSite)
+    return { allowed: !0, reason: "cross-site-exempt", vary: s };
+  const i = e === !0 ? void 0 : e.allowedDestinations;
+  if (i?.length && (s.push(le), i.includes(t.headers.get("sec-fetch-dest") ?? "")))
+    return { allowed: !0, reason: "destination-exempt", vary: s };
+  if (n.allowNavigation && ps.has(r.toUpperCase()) && (s.push(ds), t.headers.get("sec-fetch-mode") === "navigate")) {
+    const a = t.headers.get("sec-fetch-dest") ?? "";
+    if (s.includes(le) || s.push(le), !ms.has(a))
+      return { allowed: !0, reason: "top-level-navigation", vary: s };
+  }
+  return {
+    allowed: !1,
+    reason: o === "same-site" ? "same-site-denied" : "cross-site-denied",
+    vary: s
+  };
+}
+function ys(e, t, r = t.method) {
+  if (!e)
+    return { response: null, vary: [] };
+  const n = gs(e, t, r);
+  if (n.allowed)
+    return { response: null, vary: n.vary };
+  const s = new Response("Request blocked by the Fetch Metadata policy.", {
+    headers: { "content-type": "text/plain; charset=utf-8" },
+    status: 403
+  });
+  return xt(s, n.vary), { response: s, vary: n.vary };
+}
+function xt(e, t) {
+  if (t.length === 0)
+    return e;
+  const r = e.headers.get("vary")?.split(",").map((s) => s.trim()).filter(Boolean) ?? [];
+  if (r.includes("*"))
+    return e;
+  const n = [...r];
+  for (const s of t)
+    n.some((o) => o.toLowerCase() === s.toLowerCase()) || n.push(s);
+  return e.headers.set("vary", n.join(", ")), e;
+}
+function ws(e, t) {
+  return t.toUpperCase() === "OPTIONS" && e.headers.has("access-control-request-method");
+}
+const Ss = {
   h: 3600 * 1e3,
   m: 60 * 1e3,
   s: 1e3
-}, os = 1e4;
-function Rt(e = {}) {
-  const t = e.maximumEntries ?? os;
+}, Es = 1e4;
+function At(e = {}) {
+  const t = e.maximumEntries ?? Es;
   if (!Number.isSafeInteger(t) || t <= 0)
     throw new Error(
       "Demiurge rate limit maximumEntries must be a positive integer."
@@ -2429,50 +2505,50 @@ function Rt(e = {}) {
   const r = /* @__PURE__ */ new Map();
   let n = Number.POSITIVE_INFINITY;
   return {
-    increment(s, i, o) {
-      o >= n && (as(r, o), n = cs(r));
+    increment(s, o, i) {
+      i >= n && (vs(r, i), n = Rs(r));
       const a = r.get(s);
-      if (!a || a.resetAt <= o) {
+      if (!a || a.resetAt <= i) {
         const c = {
           count: 1,
-          resetAt: o + i
+          resetAt: i + o
         };
-        return !a && r.size >= t && us(r), r.set(s, c), n = Math.min(n, c.resetAt), c;
+        return !a && r.size >= t && bs(r), r.set(s, c), n = Math.min(n, c.resetAt), { count: c.count, resetAt: c.resetAt };
       }
-      return a.count += 1, a;
+      return a.count += 1, { count: a.count, resetAt: a.resetAt };
     }
   };
 }
-function as(e, t) {
+function vs(e, t) {
   for (const [r, n] of e)
     n.resetAt <= t && e.delete(r);
 }
-function cs(e) {
+function Rs(e) {
   let t = Number.POSITIVE_INFINITY;
   for (const r of e.values())
     t = Math.min(t, r.resetAt);
   return t;
 }
-function us(e) {
+function bs(e) {
   const t = e.keys().next().value;
   t !== void 0 && e.delete(t);
 }
-function fs(e, t, r, n = Date.now()) {
+async function Ts(e, t, r, n = Date.now()) {
   if (!e)
     return null;
-  xe(e);
-  const s = vt(e.window), i = ls(e, t), o = r.increment(i, s, n), a = Math.max(0, e.limit - o.count), c = new Headers({
-    "retry-after": String(Math.ceil(Math.max(0, o.resetAt - n) / 1e3)),
+  De(e);
+  const s = Pt(e.window), o = xs(e, t), i = await r.increment(o, s, n), a = Math.max(0, e.limit - i.count), c = new Headers({
+    "retry-after": String(Math.ceil(Math.max(0, i.resetAt - n) / 1e3)),
     "x-ratelimit-limit": String(e.limit),
     "x-ratelimit-remaining": String(a),
-    "x-ratelimit-reset": String(Math.ceil(o.resetAt / 1e3))
+    "x-ratelimit-reset": String(Math.ceil(i.resetAt / 1e3))
   });
-  return o.count > e.limit ? new Response("Rate limit exceeded.", {
+  return i.count > e.limit ? new Response("Rate limit exceeded.", {
     headers: c,
     status: 429
   }) : null;
 }
-function vt(e) {
+function Pt(e) {
   if (typeof e == "number") {
     if (!Number.isSafeInteger(e) || e <= 0)
       throw new Error("Demiurge rate limit window must be a positive integer.");
@@ -2481,36 +2557,36 @@ function vt(e) {
   const t = /^(\d+)(s|m|h)$/i.exec(e.trim());
   if (!t)
     throw new Error("Demiurge rate limit window must use an s/m/h suffix.");
-  const r = Number(t[1]), n = t[2].toLowerCase(), s = r * is[n];
+  const r = Number(t[1]), n = t[2].toLowerCase(), s = r * Ss[n];
   if (!Number.isSafeInteger(s))
     throw new Error("Demiurge rate limit window is too large.");
   return s;
 }
-function xe(e) {
+function De(e) {
   if (!Number.isSafeInteger(e.limit) || e.limit <= 0)
     throw new Error("Demiurge rate limit limit must be a positive integer.");
-  vt(e.window);
+  Pt(e.window);
 }
-function ls(e, t) {
-  return `${ds(e.key)}:${ms(e.key, t)}`;
+function xs(e, t) {
+  return `${As(e.key)}:${Ps(e.key, t)}`;
 }
-function ds(e) {
+function As(e) {
   return typeof e == "string" ? e : `header:${e.header.toLowerCase()}`;
 }
-function ms(e, t) {
-  return e === "ip" ? hs(t) : t.headers.get(e.header) ?? "missing";
+function Ps(e, t) {
+  return e === "ip" ? Cs(t) : t.headers.get(e.header) ?? "missing";
 }
-function hs(e) {
-  return $t(e)?.clientIp ?? "unknown";
+function Cs(e) {
+  return Ht(e)?.clientIp ?? "unknown";
 }
-const ps = {
+const Ds = {
   b: 1,
   gb: 1024 ** 3,
   kb: 1024,
   mb: 1024 ** 2
 };
-function gs(e, t, r) {
-  const n = ws(e, r);
+function $s(e, t, r) {
+  const n = Ns(e, r);
   if (n)
     return n;
   if (e?.maxBodySize === void 0)
@@ -2518,27 +2594,27 @@ function gs(e, t, r) {
   const s = t.headers.get("content-length");
   if (!s)
     return null;
-  const i = Ss(s);
-  if (i === null)
+  const o = Os(s);
+  if (o === null)
     return new Response("Invalid Content-Length.", {
       status: 400
     });
-  const o = bt(e.maxBodySize);
-  return i > o ? new Response("Request body too large.", {
+  const i = Ct(e.maxBodySize);
+  return o > i ? new Response("Request body too large.", {
     status: 413
   }) : null;
 }
-class L extends Error {
+class F extends Error {
   constructor() {
     super("Demiurge request body exceeded maxBodySize while being read."), this.name = "RequestBodyTooLargeError";
   }
 }
-function ys(e, t) {
+function ks(e, t) {
   if (e?.maxBodySize === void 0 || t.body === null)
     return t;
-  const r = bt(e.maxBodySize), n = t.body.getReader();
+  const r = Ct(e.maxBodySize), n = t.body.getReader();
   let s = 0;
-  const i = new ReadableStream({
+  const o = new ReadableStream({
     async pull(a) {
       const c = await n.read();
       if (c.done) {
@@ -2546,7 +2622,7 @@ function ys(e, t) {
         return;
       }
       if (s += c.value.byteLength, s > r) {
-        const u = new L();
+        const u = new F();
         a.error(u);
         try {
           await n.cancel(u);
@@ -2562,24 +2638,24 @@ function ys(e, t) {
       } catch {
       }
     }
-  }), o = new Request(t, {
-    body: i,
+  }), i = new Request(t, {
+    body: o,
     duplex: "half"
   });
-  return Nt(t, o), o;
+  return jt(t, i), i;
 }
-function z() {
+function V() {
   return new Response("Request body too large.", { status: 413 });
 }
-function ws(e, t) {
-  return !e?.allowedMethods || Es(e.allowedMethods, t) ? null : new Response(null, {
+function Ns(e, t) {
+  return !e?.allowedMethods || Ls(e.allowedMethods, t) ? null : new Response(null, {
     headers: {
-      allow: Rs(e.allowedMethods)
+      allow: Ms(e.allowedMethods)
     },
     status: 405
   });
 }
-function bt(e) {
+function Ct(e) {
   if (typeof e == "number") {
     if (!Number.isSafeInteger(e) || e < 0)
       throw new Error("Demiurge request maxBodySize must be a non-negative integer.");
@@ -2590,25 +2666,25 @@ function bt(e) {
     throw new Error(
       "Demiurge request maxBodySize must use bytes or a b/kb/mb/gb suffix."
     );
-  const r = Number(t[1]), n = t[2].toLowerCase(), s = r * ps[n];
+  const r = Number(t[1]), n = t[2].toLowerCase(), s = r * Ds[n];
   if (!Number.isSafeInteger(s))
     throw new Error("Demiurge request maxBodySize is too large.");
   return s;
 }
-function Ss(e) {
+function Os(e) {
   if (!/^\d+$/.test(e))
     return null;
   const t = Number(e);
   return Number.isSafeInteger(t) ? t : null;
 }
-function Es(e, t) {
+function Ls(e, t) {
   return e.includes(t) || t === "HEAD" && e.includes("GET");
 }
-function Rs(e) {
+function Ms(e) {
   const t = [...e];
   return t.includes("GET") && !t.includes("HEAD") && t.push("HEAD"), t.join(", ");
 }
-const vs = [
+const Is = [
   "GET",
   "POST",
   "PUT",
@@ -2617,15 +2693,15 @@ const vs = [
   "OPTIONS",
   "HEAD"
 ];
-function bs(e, t = {}) {
+function Us(e, t = {}) {
   for (const [n, s] of Object.entries(e)) {
-    Ts(n, s);
-    for (const i of vs) {
-      const o = s[i];
-      !o || o.kind === "page" || xs(n, i, o, s);
+    Fs(n, s);
+    for (const o of Is) {
+      const i = s[o];
+      !i || i.kind === "page" || Hs(n, o, i, s);
     }
   }
-  const r = rt(
+  const r = ot(
     Object.fromEntries(
       Object.entries(e).map(([n, s]) => [
         n,
@@ -2633,53 +2709,53 @@ function bs(e, t = {}) {
       ])
     )
   );
-  return As(r, e, t.adapter), r;
+  return Bs(r, e, t.adapter), r;
 }
-function Ts(e, t) {
+function Fs(e, t) {
   const r = t.policy?.security?.rateLimit;
-  r && H(e, "policy", "rate limit", () => {
-    xe(r);
+  r && z(e, "policy", "rate limit", () => {
+    De(r);
   });
 }
-function xs(e, t, r, n) {
-  r.cors && H(e, t, "CORS", () => {
-    Te(r.cors), Ps(e, t, r.cors.methods, n);
-  }), r.security?.rateLimit && H(e, t, "rate limit", () => {
-    xe(r.security.rateLimit);
+function Hs(e, t, r, n) {
+  r.cors && z(e, t, "CORS", () => {
+    Ce(r.cors), js(e, t, r.cors.methods, n);
+  }), r.security?.rateLimit && z(e, t, "rate limit", () => {
+    De(r.security.rateLimit);
   });
 }
-function Ps(e, t, r, n) {
+function js(e, t, r, n) {
   if (r) {
     for (const s of r)
-      if (s !== "OPTIONS" && !ks(n, s))
+      if (s !== "OPTIONS" && !Ws(n, s))
         throw new Error(
           `Route ${JSON.stringify(e)} export ${t} allows CORS method ${s}, but the route does not export that response capability.`
         );
   }
 }
-function ks(e, t) {
+function Ws(e, t) {
   const r = t === "HEAD" ? e.HEAD ?? e.GET : e[t];
-  return Cs(r) ? r : void 0;
+  return zs(r) ? r : void 0;
 }
-function Cs(e) {
+function zs(e) {
   return !!(e && e.kind !== "page");
 }
-function As(e, t, r) {
+function Bs(e, t, r) {
   for (const s of e.routes) {
-    const i = t[s.file], o = i?.GET;
-    if (!o || o.kind !== "page")
+    const o = t[s.file], i = o?.GET;
+    if (!i || i.kind !== "page")
       continue;
-    const a = K(
+    const a = X(
       ...e.policies.filter(
         (c) => T(c.fileSegments, s.fileSegments)
       ).map((c) => t[c.file]?.policy),
-      i.policy
+      o.policy
     );
-    Be(s.file, "GET", a, r), $s(
+    Je(s.file, "GET", a, r), Ks(
       s.file,
-      o.render.mode,
+      i.render.mode,
       a.document
-    ), Ds(
+    ), qs(
       s.file,
       "GET",
       a,
@@ -2687,7 +2763,7 @@ function As(e, t, r) {
         ...e.layouts.filter(
           (c) => T(c.fileSegments, s.fileSegments)
         ).map((c) => t[c.file]?.scripts),
-        i.scripts
+        o.scripts
       ]
     );
   }
@@ -2697,61 +2773,117 @@ function As(e, t, r) {
     ...e.fallbacks.notFound
   ];
   for (const s of n) {
-    const i = K(
+    const o = X(
       ...e.policies.filter(
-        (o) => T(o.fileSegments, s.fileSegments)
-      ).map((o) => t[o.file]?.policy),
+        (i) => T(i.fileSegments, s.fileSegments)
+      ).map((i) => t[i.file]?.policy),
       t[s.file]?.policy
     );
-    Be(
+    Je(
       s.file,
       "policy",
-      i,
+      o,
       r
     );
   }
 }
-function Ds(e, t, r, n) {
+function qs(e, t, r, n) {
   const s = n.flatMap(
-    (l) => Array.isArray(l) ? l : []
+    (f) => Array.isArray(f) ? f : []
   );
   if (s.length === 0 || !r.document)
     return;
-  const i = "startup-verification-nonce", a = On({
+  const o = "startup-verification-nonce", a = jn({
     document: {
-      headers: { nonce: i },
+      headers: { nonce: o },
       policy: r.document,
-      scripts: s.map((l) => ({
-        ...l,
-        nonce: X(r.document) ? i : l.nonce
+      scripts: s.map((f) => ({
+        ...f,
+        nonce: ne(r.document) ? o : f.nonce
       }))
     }
   }).findings.find(
-    (l) => l.code === "csp-script-src-blocked"
+    (f) => f.code === "csp-script-src-blocked"
   );
-  if (!a)
+  if (!a) {
+    _s(
+      e,
+      t,
+      r.document.csp,
+      s
+    );
     return;
+  }
   const c = s.find(
-    (l) => a.message.includes(l.src)
-  ), f = (F(r.document, { nonce: i }).get("content-security-policy") ?? "").split("; ").find(
-    (l) => l.startsWith("script-src ")
+    (f) => a.message.includes(f.src)
+  ), l = (q(r.document, { nonce: o }).get("content-security-policy") ?? "").split("; ").find(
+    (f) => f.startsWith("script-src ")
   ) ?? "default-src (script-src fallback)";
   throw new Error(
-    `Route ${JSON.stringify(e)} export ${t} declares script ${JSON.stringify(c?.src)} that violates the effective ${f} policy.`
+    `Route ${JSON.stringify(e)} export ${t} declares script ${JSON.stringify(c?.src)} that violates the effective ${l} policy.`
   );
 }
-function Be(e, t, r, n) {
-  H(e, t, "effective document", () => {
-    F(r.document ?? {}, {
+const Gs = [
+  { directive: "connectSrc", name: "connect-src", need: "connect" },
+  { directive: "imgSrc", name: "img-src", need: "img" }
+];
+function _s(e, t, r, n) {
+  if (r)
+    for (const s of n)
+      for (const { directive: o, name: i, need: a } of Gs) {
+        const c = s.needs?.[a] ?? [];
+        if (c.length === 0)
+          continue;
+        const u = W(r[o]) ?? W(r.defaultSrc);
+        if (u !== void 0) {
+          for (const l of c)
+            if (!(Array.isArray(u) && Vs(u, l)))
+              throw new Error(
+                `Route ${JSON.stringify(e)} export ${t} declares script ${JSON.stringify(s.src)} that needs ${i} ${l}, which the effective policy does not allow. Add ${l} to security.needs.${a} or to csp.${o} for this route.`
+              );
+        }
+      }
+}
+function Vs(e, t) {
+  return e.includes("'none'") ? !1 : e.includes("*") || e.includes(t) ? !0 : t.startsWith("'") ? !1 : e.some((r) => Js(r, t));
+}
+function Js(e, t) {
+  if (e.startsWith("'"))
+    return !1;
+  let r;
+  try {
+    r = new URL(t);
+  } catch {
+    return !1;
+  }
+  if (e === `${r.protocol}`)
+    return !0;
+  let n;
+  try {
+    n = new URL(e);
+  } catch {
+    return !1;
+  }
+  if (n.protocol !== r.protocol || n.port !== r.port)
+    return !1;
+  if (n.hostname.startsWith("*.")) {
+    const s = n.hostname.slice(1);
+    return r.hostname.endsWith(s) && r.hostname !== n.hostname.slice(2);
+  }
+  return n.hostname === r.hostname;
+}
+function Je(e, t, r, n) {
+  z(e, t, "effective document", () => {
+    q(r.document ?? {}, {
       nonce: "startup-verification-nonce"
     });
-  }), !(!n || !X(r.document)) && H(e, t, "effective CSP", () => {
-    Ot(n, ["nonceInjection"]);
+  }), !(!n || !ne(r.document)) && z(e, t, "effective CSP", () => {
+    Wt(n, ["nonceInjection"]);
   });
 }
-function $s(e, t, r) {
+function Ks(e, t, r) {
   if (t === "static") {
-    const s = Ns(r?.csp);
+    const s = Ys(r?.csp);
     if (s)
       throw new Error(
         `Route ${JSON.stringify(e)} uses render mode "static" with an effective ${s} directive that depends on a CSP nonce. Use security.static() for static output or remove the nonce source from the document policy.`
@@ -2760,76 +2892,76 @@ function $s(e, t, r) {
   }
   if (t !== "streaming")
     return;
-  const n = Os(r?.csp);
-  if (!(!n || Ls(n.sources)))
+  const n = Zs(r?.csp);
+  if (!(!n || Qs(n.sources)))
     throw new Error(
       `Route ${JSON.stringify(e)} uses render mode "streaming" with an effective ${n.name} directive that does not allow React runtime inline payload scripts. Add a nonce placeholder or allow 'unsafe-inline' without nonce or hash sources.`
     );
 }
-function Ns(e) {
+function Ys(e) {
   if (e)
     for (const [t, r] of Object.entries(e)) {
-      const n = he(r);
-      if (Array.isArray(n) && n.some((s) => Is(s)))
-        return Us(t);
+      const n = W(r);
+      if (Array.isArray(n) && n.some((s) => Xs(s)))
+        return to(t);
     }
 }
-function Os(e) {
+function Zs(e) {
   if (!e)
     return;
-  const t = he(e.scriptSrc);
+  const t = W(e.scriptSrc);
   if (Array.isArray(t))
     return { name: "script-src", sources: t };
-  const r = he(e.defaultSrc);
+  const r = W(e.defaultSrc);
   if (Array.isArray(r))
     return { name: "default-src", sources: r };
 }
-function Ls(e) {
-  return e.some((t) => Tt(t)) ? !0 : e.includes("'unsafe-inline'") && !e.some((t) => Ms(t));
+function Qs(e) {
+  return e.some((t) => Dt(t)) ? !0 : e.includes("'unsafe-inline'") && !e.some((t) => eo(t));
 }
-function Is(e) {
-  return Tt(e) || /^'nonce-[^']*'$/i.test(e);
+function Xs(e) {
+  return Dt(e) || /^'nonce-[^']*'$/i.test(e);
 }
-function Tt(e) {
+function Dt(e) {
   return e.includes("{nonce}");
 }
-function Ms(e) {
+function eo(e) {
   return /^'(?:nonce-|sha256-|sha384-|sha512-)/i.test(e);
 }
-function he(e) {
+function W(e) {
   return e && typeof e == "object" && !Array.isArray(e) && "replace" in e ? e.replace : e;
 }
-function Us(e) {
+function to(e) {
   return e.replace(/[A-Z]/g, (t) => `-${t.toLowerCase()}`);
 }
-function H(e, t, r, n) {
+function z(e, t, r, n) {
   try {
     n();
   } catch (s) {
     if (s instanceof Error && s.message.startsWith(`Route ${JSON.stringify(e)} export `))
       throw s;
-    const i = s instanceof Error ? s.message : `${r} validation failed.`;
+    const o = s instanceof Error ? s.message : `${r} validation failed.`;
     throw new Error(
-      `Route ${JSON.stringify(e)} export ${t} has an invalid ${r} policy. ${i}`,
+      `Route ${JSON.stringify(e)} export ${t} has an invalid ${r} policy. ${o}`,
       { cause: s }
     );
   }
 }
-function Hs(e) {
-  return V({
+function ro(e) {
+  return Z({
     instance: `${e.pathname}${e.search}`,
     status: 404,
     title: "Not Found"
   });
 }
-async function pe(e, t, r = {}) {
+async function ye(e, t, r = {}) {
   const n = new URL(t.url);
-  if (!ut(t))
-    return Hs(n);
-  const s = await de(e, n.pathname, {
+  if (!dt(t))
+    return ro(n);
+  const s = await pe(e, n.pathname, {
     onLayoutError: (u) => r.onError?.(u, "page")
-  }), i = await js(e, n.pathname), o = r.nonce ?? (X(i) ? mt() : void 0), a = Fs(s, { ...r, nonce: o }), c = F(i ?? {}, {
-    nonce: o,
+  }), o = await no(e, n.pathname), i = r.nonce ?? (ne(o) ? yt() : void 0), a = so(s, { ...r, nonce: i }), c = q(o ?? {}, {
+    nonce: i,
     request: t
   });
   return c.set("content-type", "text/html; charset=utf-8"), new Response(
@@ -2840,55 +2972,55 @@ async function pe(e, t, r = {}) {
     }
   );
 }
-async function js(e, t) {
+async function no(e, t) {
   const r = await Promise.all(
-    or(e, t).map((n) => n.load())
+    fr(e, t).map((n) => n.load())
   );
-  return K(...r.map((n) => n.policy)).document;
+  return X(...r.map((n) => n.policy)).document;
 }
-function Fs(e, t = {}) {
-  const r = e.notFound ?? Me;
+function so(e, t = {}) {
+  const r = e.notFound ?? He;
   try {
-    return ae(e, r, e.layouts, t);
+    return fe(e, r, e.layouts, t);
   } catch (n) {
     t.onError?.(n, "page");
   }
   try {
-    return ae(e, r, [], t);
+    return fe(e, r, [], t);
   } catch (n) {
     t.onError?.(n, "page");
   }
-  return ae(e, Me, [], t);
+  return fe(e, He, [], t);
 }
-function ae(e, t, r, n) {
+function fe(e, t, r, n) {
   const s = r.reduceRight(
-    (o, a) => ue(a, {
-      children: o,
+    (i, a) => de(a, {
+      children: i,
       path: {},
       pathname: e.pathname
     }),
-    ue(t, { pathname: e.pathname })
-  ), i = Je({
+    de(t, { pathname: e.pathname })
+  ), o = Qe({
     dev: n.dev,
     nonce: n.nonce
   });
-  return Ye({
+  return et({
     body: {
       data: void 0,
       fallback: "not-found",
-      html: Ze(Ke(i, s)),
+      html: tt(Xe(o, s)),
       navigation: n.navigation
     },
     entrySrc: n.clientEntry,
     lang: n.lang,
     metadata: e.metadata,
     nonce: n.nonce,
-    scripts: i.scripts(),
+    scripts: o.scripts(),
     styles: n.styles,
     title: n.title
   });
 }
-const xt = [
+const $t = [
   "GET",
   "POST",
   "PUT",
@@ -2896,12 +3028,12 @@ const xt = [
   "DELETE",
   "OPTIONS",
   "HEAD"
-], Pt = Rt();
-function Oi(e) {
-  e.routeModules && bs(e.routeModules, { adapter: e.adapter });
-  const t = rt(e.routes), r = e.rateLimitStore ?? Rt();
-  return e.cacheStore && Xe(e.cacheStore.namespace), async function(s) {
-    return await Ws(t, s, {
+], kt = At();
+function Yo(e) {
+  e.routeModules && Us(e.routeModules, { adapter: e.adapter });
+  const t = ot(e.routes), r = e.rateLimitStore ?? At();
+  return e.cacheStore && nt(e.cacheStore.namespace), async function(s) {
+    return await oo(t, s, {
       cacheStore: e.cacheStore,
       onError: e.onError,
       rateLimitStore: r,
@@ -2910,31 +3042,31 @@ function Oi(e) {
     });
   };
 }
-async function Ws(e, t, r = {
-  rateLimitStore: Pt
+async function oo(e, t, r = {
+  rateLimitStore: kt
 }) {
-  const n = new URL(t.url), s = Bs(n, r), i = ot(t);
-  let o;
+  const n = new URL(t.url), s = co(n, r), o = ut(t);
+  let i;
   try {
-    o = j(e.routes, n.pathname);
+    i = B(e.routes, n.pathname);
   } catch (a) {
-    if (!(a instanceof Ee))
+    if (!(a instanceof Te))
       throw a;
-    const c = V({
+    const c = Z({
       instance: `${n.pathname}${n.search}`,
       status: 400,
       title: "Bad Request"
     });
-    return i ? q(c, se) : c;
+    return o ? _(c, ae) : c;
   }
-  if (!o)
+  if (!i)
     try {
-      const a = await pe(
+      const a = await ye(
         e,
         t,
         s
       );
-      return i ? q(a, Ie) : a;
+      return o ? _(a, Fe) : a;
     } catch (a) {
       return s.onError(a, "page"), new Response("Not Found", {
         headers: { "content-type": "text/plain; charset=utf-8" },
@@ -2942,194 +3074,217 @@ async function Ws(e, t, r = {
       });
     }
   try {
-    const a = await qs(
+    const a = await io(
       e,
       t,
       n,
-      o,
+      i,
       r,
       s
     );
-    return i && !a.headers.has(C) ? q(
+    return o && !a.headers.has(C) ? _(
       a,
-      a.status === 404 ? Ie : se
+      a.status === 404 ? Fe : ae
     ) : a;
   } catch (a) {
-    const c = await G(
+    const c = await Y(
       e,
       t,
       a,
       "middleware",
       s
     );
-    return i ? q(c, se) : c;
+    return o ? _(c, ae) : c;
   }
 }
-async function qs(e, t, r, n, s, i) {
-  const o = await n.route.load();
+async function io(e, t, r, n, s, o) {
+  const i = await n.route.load();
   if (t.method.toUpperCase() === "OPTIONS") {
-    const h = xn(o, t);
-    if (h)
-      return h;
+    const p = Nn(i, t);
+    if (p)
+      return p;
   }
-  const a = Js(t.method);
+  const a = ho(t.method);
   if (!a)
-    return Ve(o);
-  const c = Ks(o, a);
+    return Ze(i);
+  const c = mo(i, a);
   if (!c)
-    return Ve(o);
-  const u = await _s(
+    return Ze(i);
+  const u = await lo(
     e,
     n.route,
-    o,
+    i,
     c
-  ), f = u.security, l = es(f?.csrf, t);
-  if (l)
-    return _(l, ce(c), t);
-  const m = fs(
-    f?.rateLimit,
+  ), l = u.security, f = ys(
+    l?.fetchMetadata,
+    t,
+    a
+  ), h = (p) => xt(p, f.vary);
+  if (f.response)
+    return h(
+      U(
+        f.response,
+        J(c),
+        t
+      )
+    );
+  const d = as(l?.csrf, t);
+  if (d)
+    return h(
+      U(d, J(c), t)
+    );
+  const D = await Ts(
+    l?.rateLimit,
     t,
-    s.rateLimitStore ?? Pt
+    s.rateLimitStore ?? kt
   );
-  if (m)
-    return _(
-      m,
-      ce(c),
-      t
+  if (D)
+    return h(
+      U(
+        D,
+        J(c),
+        t
+      )
     );
-  const d = gs(
-    f?.request,
+  const $ = $s(
+    l?.request,
     t,
     a
   );
-  if (d)
-    return _(
-      d,
-      ce(c),
-      t
+  if ($)
+    return h(
+      U(
+        $,
+        J(c),
+        t
+      )
     );
-  t = ys(f?.request, t);
-  const P = {};
+  t = ks(l?.request, t);
+  const m = {};
   if (c.kind === "page") {
-    const h = {
+    const p = {
       path: n.path,
       pathname: r.pathname,
       request: t,
-      context: P,
+      context: m,
       search: r.searchParams,
       url: r
-    }, ee = await Ge(
+    }, Nt = await Ke(
       e,
       n.route
-    ), D = X(u.document) ? mt() : void 0, kt = zs(s.cacheStore);
-    let E;
+    ), O = ne(u.document) ? yt() : void 0, Ot = ao(s.cacheStore);
+    let y;
     try {
-      E = await _e(ee, h, async () => {
+      y = await Ye(Nt, p, async () => {
         try {
-          const p = await nt(
+          const g = await it(
             e,
             r.pathname,
             t,
             void 0,
-            kt,
-            { requestContext: P }
+            Ot,
+            { requestContext: m }
           );
-          if (p.status !== "ready")
-            return await pe(e, t, {
-              ...i,
-              nonce: D
+          if (g.status !== "ready")
+            return await ye(e, t, {
+              ...o,
+              nonce: O
             });
-          if (ot(t))
-            return wr(p.match.data);
-          if (p.match.render.mode === "streaming" && !s.renderPage)
+          if (ut(t))
+            return br(g.match.data);
+          if (g.match.render.mode === "streaming" && !s.renderPage)
             throw new Error(
               "Streaming page routes require an adapter renderer. Pass renderNodePageResponse from @demiurgejs/core/node as createRequestHandler({ renderPage })."
             );
-          return await (s.renderPage ?? Lt)(p.match, {
+          return await (s.renderPage ?? zt)(g.match, {
             ...s.ssr,
             dev: s.dev,
-            nonce: D,
-            onStreamError: (At) => {
-              s.onError?.(At, {
+            nonce: O,
+            onStreamError: (Mt) => {
+              s.onError?.(Mt, {
                 pathname: r.pathname,
                 site: "page"
               });
             },
             signal: t.signal
           });
-        } catch (p) {
-          return p instanceof L ? z() : await G(e, t, p, "page", {
-            ...i,
-            nonce: D
+        } catch (g) {
+          return g instanceof F ? V() : await Y(e, t, g, "page", {
+            ...o,
+            nonce: O
           });
         }
       });
-    } catch (p) {
-      if (!(p instanceof L))
-        throw p;
-      E = z();
+    } catch (g) {
+      if (!(g instanceof F))
+        throw g;
+      y = V();
     }
-    const Ct = F(u.document ?? {}, {
-      nonce: D,
+    const Lt = q(u.document ?? {}, {
+      nonce: O,
       request: t
     });
-    for (const [p, Pe] of Ct)
-      E.headers.set(p, Pe);
-    return D && E.headers.set("cache-control", "private, no-store"), a === "HEAD" ? (await E.body?.cancel(), new Response(null, {
-      headers: E.headers,
-      status: E.status
-    })) : E;
-  }
-  const A = {
+    for (const [g, ke] of Lt)
+      y.headers.set(g, ke);
+    return O && y.headers.set("cache-control", "private, no-store"), h(y), a === "HEAD" ? (await y.body?.cancel(), new Response(null, {
+      headers: y.headers,
+      status: y.status
+    })) : y;
+  }
+  const k = {
     path: n.path,
     pathname: r.pathname,
     request: t,
-    context: P,
+    context: m,
     search: r.searchParams,
     url: r
-  }, g = await Ge(
+  }, $e = await Ke(
     e,
     n.route
   );
-  let k;
+  let N;
   try {
-    k = await _e(g, A, async () => {
+    N = await Ye($e, k, async () => {
       try {
-        return c.kind === "not-found" && c.body === void 0 ? Gs(
-          await pe(e, t, i),
+        return c.kind === "not-found" && c.body === void 0 ? uo(
+          await ye(e, t, o),
           c.init
-        ) : await Tr(c, A);
-      } catch (h) {
-        return h instanceof L ? z() : await G(
+        ) : await Dr(c, k);
+      } catch (p) {
+        return p instanceof F ? V() : await Y(
           e,
           t,
-          h,
+          p,
           "route",
-          i
+          o
         );
       }
     });
-  } catch (h) {
-    if (!(h instanceof L))
-      throw h;
-    k = z();
+  } catch (p) {
+    if (!(p instanceof F))
+      throw p;
+    N = V();
   }
   try {
-    return Vs(k, c, t, a);
-  } catch (h) {
-    return await G(
-      e,
-      t,
-      h,
-      "route",
-      i
+    return h(
+      fo(N, c, t, a)
+    );
+  } catch (p) {
+    return h(
+      await Y(
+        e,
+        t,
+        p,
+        "route",
+        o
+      )
     );
   }
 }
-function zs(e) {
-  return e ? Qe(e) : ge();
+function ao(e) {
+  return e ? rt(e) : we();
 }
-function Bs(e, t) {
+function co(e, t) {
   return {
     ...t.ssr,
     dev: t.dev,
@@ -3139,12 +3294,12 @@ function Bs(e, t) {
     transformDocument: t.transformDocument
   };
 }
-function Gs(e, t) {
+function uo(e, t) {
   if (!t)
     return e;
   const r = new Headers(e.headers), n = new Headers(t.headers);
-  for (const [s, i] of n)
-    s !== "set-cookie" && r.set(s, i);
+  for (const [s, o] of n)
+    s !== "set-cookie" && r.set(s, o);
   for (const s of n.getSetCookie())
     r.append("set-cookie", s);
   return new Response(e.body, {
@@ -3153,21 +3308,21 @@ function Gs(e, t) {
     statusText: t.statusText ?? e.statusText
   });
 }
-async function _s(e, t, r, n) {
+async function lo(e, t, r, n) {
   const s = await Promise.all(
     e.policies.filter(
-      (i) => T(i.fileSegments, t.fileSegments)
-    ).map((i) => i.load())
+      (o) => T(o.fileSegments, t.fileSegments)
+    ).map((o) => o.load())
   );
-  return K(
-    ...s.map((i) => i.policy),
+  return X(
+    ...s.map((o) => o.policy),
     r.policy,
     {
-      security: n.kind === "page" ? void 0 : n.security
+      security: !n || n.kind === "page" ? void 0 : n.security
     }
   );
 }
-async function Ge(e, t) {
+async function Ke(e, t) {
   return (await Promise.all(
     e.middlewares.filter(
       (n) => T(n.fileSegments, t.fileSegments)
@@ -3176,20 +3331,20 @@ async function Ge(e, t) {
     (n) => n.middleware ? [n.middleware] : []
   );
 }
-async function _e(e, t, r) {
+async function Ye(e, t, r) {
   let n = -1;
-  async function s(i) {
-    if (i <= n)
+  async function s(o) {
+    if (o <= n)
       throw new Error("Demiurge route middleware next() called multiple times.");
-    n = i;
-    const o = e[i];
-    return o ? await o(t, () => s(i + 1)) : await r();
+    n = o;
+    const i = e[o];
+    return i ? await i(t, () => s(o + 1)) : await r();
   }
   return await s(0);
 }
-function Vs(e, t, r, n) {
-  const s = Lr(
-    _(e, t.cors, r),
+function fo(e, t, r, n) {
+  const s = Hr(
+    U(e, t.cors, r),
     t.timing
   );
   return n === "HEAD" ? new Response(null, {
@@ -3198,117 +3353,123 @@ function Vs(e, t, r, n) {
     statusText: s.statusText
   }) : s;
 }
-function ce(e) {
+function J(e) {
   return e.kind === "page" ? void 0 : e.cors;
 }
-function Js(e) {
+function ho(e) {
   const t = e.toUpperCase();
-  return xt.includes(t) ? t : null;
+  return $t.includes(t) ? t : null;
 }
-function Ks(e, t) {
+function mo(e, t) {
   return t === "HEAD" ? e.HEAD ?? e.GET : e[t];
 }
-function Ve(e) {
+function Ze(e) {
   return new Response(null, {
     headers: {
-      allow: Ys(e).join(", ")
+      allow: po(e).join(", ")
     },
     status: 405
   });
 }
-function Ys(e) {
-  const t = xt.filter((r) => e[r]);
+function po(e) {
+  const t = $t.filter((r) => e[r]);
   return e.GET && !t.includes("HEAD") && t.push("HEAD"), t;
 }
 export {
-  fs as $,
-  Ie as A,
-  se as B,
-  Ci as C,
-  Me as D,
-  ve as E,
-  at as F,
-  In as G,
-  Fr as H,
-  Qe as I,
-  wt as J,
-  Xn as K,
-  Qn as L,
-  si as M,
+  is as $,
+  Wo as A,
+  Dr as B,
+  cs as C,
+  ks as D,
+  Ct as E,
+  Tr as F,
+  ko as G,
+  cr as H,
+  vr as I,
+  Rr as J,
+  Fe as K,
+  ae as L,
+  Te as M,
   C as N,
-  ge as O,
-  Ht as P,
-  Oi as Q,
-  L as R,
-  On as S,
-  He as T,
-  ii as U,
-  ui as V,
-  Di as W,
-  Ai as X,
-  ni as Y,
-  ws as Z,
-  es as _,
-  Rt as a,
-  gs as a0,
-  Ri as a1,
-  Ni as a2,
-  wi as a3,
-  Si as a4,
-  li as a5,
-  K as a6,
-  an as a7,
-  fi as a8,
-  ci as a9,
-  bi as aa,
-  ts as ab,
-  vt as ac,
-  oi as ad,
-  ai as ae,
-  ti as af,
-  vi as ag,
-  _t as ah,
-  v as ai,
-  Xe as aj,
-  fe as ak,
-  ki as al,
-  Pi as am,
-  xi as an,
-  di as ao,
-  ri as ap,
-  Ei as aq,
-  gi as ar,
-  T as as,
-  yi as at,
-  pi as au,
-  cr as av,
-  pr as aw,
-  Q as ax,
-  R as ay,
-  $i as b,
-  mi as c,
-  F as d,
-  Te as e,
-  xe as f,
-  mt as g,
-  Ws as h,
-  j as i,
-  rt as j,
-  Ae as k,
-  Ti as l,
-  on as m,
-  ys as n,
-  bt as o,
-  U as p,
-  Sr as q,
-  pe as r,
-  $ as s,
-  Tr as t,
-  hi as u,
-  bs as v,
-  nt as w,
-  nr as x,
-  gr as y,
-  yr as z
+  Gr as O,
+  Go as P,
+  He as Q,
+  F as R,
+  Ae as S,
+  A as T,
+  lt as U,
+  xt as V,
+  zn as W,
+  vo as X,
+  gs as Y,
+  rt as Z,
+  Rt as _,
+  Us as a,
+  os as a0,
+  xo as a1,
+  _t as a2,
+  We as a3,
+  Ao as a4,
+  Vo as a5,
+  _o as a6,
+  To as a7,
+  Ns as a8,
+  as as a9,
+  No as aA,
+  hr as aB,
+  Er as aC,
+  re as aD,
+  v as aE,
+  ys as aa,
+  Ts as ab,
+  $s as ac,
+  Fo as ad,
+  Ro as ae,
+  Ko as af,
+  Mo as ag,
+  Io as ah,
+  Co as ai,
+  X as aj,
+  dn as ak,
+  Po as al,
+  jo as am,
+  Pt as an,
+  Eo as ao,
+  Ho as ap,
+  R as aq,
+  nt as ar,
+  qo as as,
+  Bo as at,
+  zo as au,
+  Do as av,
+  bo as aw,
+  Uo as ax,
+  Oo as ay,
+  Lo as az,
+  $o as b,
+  Yo as c,
+  At as d,
+  Jo as e,
+  q as f,
+  De as g,
+  oo as h,
+  it as i,
+  T as j,
+  te as k,
+  lo as l,
+  fn as m,
+  B as n,
+  ne as o,
+  yt as p,
+  jn as q,
+  ye as r,
+  L as s,
+  mr as t,
+  we as u,
+  Ce as v,
+  he as w,
+  Le as x,
+  ot as y,
+  P as z
 };
-//# sourceMappingURL=testing-DBjVCN5v.js.map
+//# sourceMappingURL=testing-CRflAw4X.js.map