@demiurgejs/core 0.2.0-beta.2 → 0.2.0-beta.3

package/dist/chunks/{testing-B_iMFYz_.js → testing-CRflAw4X.js}

@@ -1,196 +1,218 @@
-import { w as $t, v as kt, x as _e, y as Ve, e as Je, z as Dt, A as Nt, l as Ot, a as Lt } from "./request-metadata-D5NrT8ks.js";
-import { createElement as fe } from "react";
-import { renderToString as Ke } from "react-dom/server";
-import { jsxs as I, jsx as M } from "react/jsx-runtime";
-const Ae = ["build", "private", "public"], It = {
+import { x as It, w as Ut, y as Qe, z as Xe, e as et, F as Ft, A as Ht, B as jt, l as Wt, a as zt } from "./request-metadata-DaIYq4Ea.js";
+import { createElement as de } from "react";
+import { renderToString as tt } from "react-dom/server";
+import { jsxs as H, jsx as j } from "react/jsx-runtime";
+const Ne = ["build", "private", "public"], Bt = {
   app: "demiurge-memory",
   environment: "local",
   schemaVersion: 1
-}, Mt = 1e4, Ut = 3e4;
-function ni(e) {
+}, qt = 1e4, Gt = 3e4;
+function Eo(e) {
   return (...t) => ({
     fn: () => e.fn(...t),
     key: e.key(...t),
+    notFoundTtl: e.notFoundTtl,
     scope: e.scope,
     staleWhileRevalidate: e.staleWhileRevalidate,
     tags: e.tags?.(...t),
     ttl: e.ttl
   });
 }
-function si(e) {
+class A extends Error {
+  constructor(t) {
+    super(t ?? "Not found"), this.name = "CacheNotFoundError";
+  }
+}
+function vo(e) {
+  throw new A(e);
+}
+function Ro(e) {
+  return e instanceof A;
+}
+function bo(e) {
   return { id: e };
 }
-function ii(e) {
+function To(e) {
   return e;
 }
-function Ye(e) {
-  const t = e.now ?? Date.now, r = Wt(e.refreshLeaseTtl), n = Ze(e.namespace), s = /* @__PURE__ */ new Map(), i = /* @__PURE__ */ new Map();
+function rt(e) {
+  const t = e.now ?? Date.now, r = Kt(e.refreshLeaseTtl), n = nt(e.namespace), s = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map();
   return {
-    async get(o) {
-      const a = o.scope ?? "request";
+    async get(i) {
+      const a = i.scope ?? "request";
       if (a === "none")
-        return await o.fn();
-      const c = $e(o.key);
+        return await i.fn();
+      const c = Le(i.key);
       if (a === "request")
-        return await Ft(s, c, o, t);
-      const u = ke(n, a, c), f = (o.tags ?? []).map(
-        (g) => De(n, a, le(g))
-      ), l = await e.store.get(u);
-      if (l && (l.expiresAt === null || l.expiresAt > t()))
-        return l.value;
-      if (l && qt(l, t())) {
-        const g = zt(e.store), A = globalThis.crypto.randomUUID();
-        if (await g.acquireRefreshLease(
+        return await Jt(s, c, i, t);
+      const u = Me(n, a, c), l = (i.tags ?? []).map(
+        (m) => Ie(n, a, he(m))
+      ), f = await e.store.get(u);
+      if (f && (f.expiresAt === null || f.expiresAt > t())) {
+        if (f.negative)
+          throw new A(
+            typeof f.value == "string" ? f.value : void 0
+          );
+        return f.value;
+      }
+      if (f && Yt(f, t())) {
+        const m = Zt(e.store), k = globalThis.crypto.randomUUID();
+        if (await m.acquireRefreshLease(
           u,
-          A,
+          k,
           t() + r
         )) {
-          const te = Bt({
+          const N = Qt({
             key: u,
             now: t,
             onBackgroundError: e.onBackgroundError,
-            refreshStore: g,
-            request: o,
-            tags: f,
-            token: A
+            refreshStore: m,
+            request: i,
+            tags: l,
+            token: k
           });
-          e.waitUntil?.(te);
+          e.waitUntil?.(N);
         }
-        return l.value;
+        return f.value;
       }
-      l && await e.store.delete(u);
-      const m = i.get(u);
-      if (m)
-        return await m.promise;
-      const d = { invalidated: !1 }, P = Promise.resolve().then(o.fn).then(async (g) => (d.invalidated || await e.store.set(u, {
-        expiresAt: Qe(t(), o.ttl),
-        staleUntil: Xe(
-          t(),
-          o.ttl,
-          o.staleWhileRevalidate
-        ),
-        tags: f,
-        value: g
-      }), g)), $ = {
-        promise: P,
+      f && await e.store.delete(u);
+      const h = o.get(u);
+      if (h)
+        return await h.promise;
+      const d = { invalidated: !1 }, D = Promise.resolve().then(i.fn).then(
+        async (m) => (d.invalidated || await e.store.set(u, {
+          expiresAt: Se(t(), i.ttl),
+          staleUntil: Ee(
+            t(),
+            i.ttl,
+            i.staleWhileRevalidate
+          ),
+          tags: l,
+          value: m
+        }), m),
+        async (m) => {
+          throw !d.invalidated && m instanceof A && await e.store.set(u, st(t(), i, l, m)), m;
+        }
+      ), $ = {
+        promise: D,
         state: d,
-        tags: f
+        tags: l
       };
-      i.set(u, $);
+      o.set(u, $);
       try {
-        return await P;
+        return await D;
       } finally {
-        i.get(u) === $ && i.delete(u);
+        o.get(u) === $ && o.delete(u);
       }
     },
-    async invalidateKey(o) {
-      const a = $e(o), c = s.delete(a);
+    async invalidateKey(i) {
+      const a = Le(i), c = s.delete(a);
       let u = !1;
-      const f = await Promise.all(
-        Ae.map((l) => {
-          const m = ke(n, l, a), d = i.get(m);
-          return d && (d.state.invalidated = !0, u = !0), e.store.delete(m);
+      const l = await Promise.all(
+        Ne.map((f) => {
+          const h = Me(n, f, a), d = o.get(h);
+          return d && (d.state.invalidated = !0, u = !0), e.store.delete(h);
         })
       );
-      return c || u || f.some(Boolean);
+      return c || u || l.some(Boolean);
     },
-    async invalidateTags(o) {
-      const a = o.map(le), c = Gt(
+    async invalidateTags(i) {
+      const a = i.map(he), c = Xt(
         s,
         new Set(a)
       ), u = new Set(
-        Ae.flatMap(
-          (m) => a.map((d) => De(n, m, d))
+        Ne.flatMap(
+          (h) => a.map((d) => Ie(n, h, d))
         )
       );
-      let f = 0;
-      for (const m of i.values())
-        !m.state.invalidated && m.tags.some((d) => u.has(d)) && (m.state.invalidated = !0, f += 1);
-      const l = await e.store.invalidateTags([...u]);
-      return c + f + l;
+      let l = 0;
+      for (const h of o.values())
+        !h.state.invalidated && h.tags.some((d) => u.has(d)) && (h.state.invalidated = !0, l += 1);
+      const f = await e.store.invalidateTags([...u]);
+      return c + l + f;
     }
   };
 }
-function ge(e = {}) {
+function we(e = {}) {
   const t = e.now ?? Date.now;
-  return Ye({
-    namespace: It,
+  return rt({
+    namespace: Bt,
     now: t,
     onBackgroundError: e.onBackgroundError,
     refreshLeaseTtl: e.refreshLeaseTtl,
-    store: Ht({
+    store: _t({
       maximumEntries: e.maximumEntries,
       now: t
     }),
     waitUntil: e.waitUntil
   });
 }
-function Ht(e = {}) {
-  const t = e.entries ?? /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), n = e.maximumEntries ?? Mt, s = e.now ?? Date.now;
+function _t(e = {}) {
+  const t = e.entries ?? /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), n = e.maximumEntries ?? qt, s = e.now ?? Date.now;
   if (!Number.isSafeInteger(n) || n <= 0)
     throw new Error(
       "Demiurge memory cache maximumEntries must be a positive integer."
     );
-  re(t, r, s()), jt(t, n);
-  let i = ne(t);
+  se(t, r, s()), Vt(t, n);
+  let o = oe(t);
   return {
-    acquireRefreshLease(o, a, c) {
-      const u = s(), f = r.get(o);
-      return f && f.expiresAt > u ? !1 : (r.set(o, { expiresAt: c, token: a }), !0);
+    acquireRefreshLease(i, a, c) {
+      const u = s(), l = r.get(i);
+      return l && l.expiresAt > u ? !1 : (r.set(i, { expiresAt: c, token: a }), !0);
     },
-    delete(o) {
-      return r.delete(o), t.delete(o);
+    delete(i) {
+      return r.delete(i), t.delete(i);
     },
-    get(o) {
-      return s() >= i && (re(t, r, s()), i = ne(t)), t.get(o);
+    get(i) {
+      return s() >= o && (se(t, r, s()), o = oe(t)), t.get(i);
     },
-    invalidateTags(o) {
-      const a = new Set(o);
+    invalidateTags(i) {
+      const a = new Set(i);
       let c = 0;
-      for (const [u, f] of t)
-        f.tags.some((l) => a.has(l)) && (t.delete(u), r.delete(u), c += 1);
+      for (const [u, l] of t)
+        l.tags.some((f) => a.has(f)) && (t.delete(u), r.delete(u), c += 1);
       return c;
     },
-    publishRefresh(o, a, c) {
-      const u = r.get(o);
-      return !u || u.token !== a || u.expiresAt <= s() ? !1 : (Ce(
+    publishRefresh(i, a, c) {
+      const u = r.get(i);
+      return !u || u.token !== a || u.expiresAt <= s() ? !1 : (Oe(
         t,
         r,
         n,
-        o,
+        i,
         c
-      ), r.delete(o), c.staleUntil !== null && (i = Math.min(i, c.staleUntil)), !0);
+      ), r.delete(i), c.staleUntil !== null && (o = Math.min(o, c.staleUntil)), !0);
     },
-    releaseRefreshLease(o, a) {
-      r.get(o)?.token === a && r.delete(o);
+    releaseRefreshLease(i, a) {
+      r.get(i)?.token === a && r.delete(i);
     },
-    set(o, a) {
+    set(i, a) {
       const c = s();
-      c >= i && (re(t, r, c), i = ne(t)), r.delete(o), Ce(
+      c >= o && (se(t, r, c), o = oe(t)), r.delete(i), Oe(
         t,
         r,
         n,
-        o,
+        i,
         a
-      ), a.staleUntil !== null && (i = Math.min(i, a.staleUntil));
+      ), a.staleUntil !== null && (o = Math.min(o, a.staleUntil));
     }
   };
 }
-function re(e, t, r) {
+function se(e, t, r) {
   for (const [n, s] of e)
     s.staleUntil !== null && s.staleUntil <= r && (e.delete(n), t.delete(n));
 }
-function Ce(e, t, r, n, s) {
+function Oe(e, t, r, n, s) {
   if (!e.has(n) && e.size >= r)
     for (; e.size >= r; ) {
-      const i = e.keys().next().value;
-      if (i === void 0)
+      const o = e.keys().next().value;
+      if (o === void 0)
         break;
-      e.delete(i), t.delete(i);
+      e.delete(o), t.delete(o);
     }
   e.set(n, s);
 }
-function jt(e, t) {
+function Vt(e, t) {
   for (; e.size > t; ) {
     const r = e.keys().next().value;
     if (r === void 0)
@@ -198,14 +220,14 @@ function jt(e, t) {
     e.delete(r);
   }
 }
-function ne(e) {
+function oe(e) {
   let t = Number.POSITIVE_INFINITY;
   for (const r of e.values())
     r.staleUntil !== null && (t = Math.min(t, r.staleUntil));
   return t;
 }
-function Ze(e) {
-  const t = se("app", e.app), r = se(
+function nt(e) {
+  const t = ie("app", e.app), r = ie(
     "environment",
     e.environment
   );
@@ -213,13 +235,13 @@ function Ze(e) {
     throw new Error(
       "Demiurge cache namespace schemaVersion must be a non-negative integer or string."
     );
-  const n = se(
+  const n = ie(
     "schemaVersion",
     String(e.schemaVersion)
   );
   return `${t}:${r}:${n}`;
 }
-function oi(e) {
+function xo(e) {
   return {
     async key(t) {
       return {
@@ -250,7 +272,7 @@ function oi(e) {
     }
   };
 }
-function U(e) {
+function P(e) {
   if (e === void 0)
     return Number.POSITIVE_INFINITY;
   if (typeof e == "number") {
@@ -264,40 +286,52 @@ function U(e) {
   const r = Number(t[1]), n = t[2];
   return n === "h" ? r * 36e5 : n === "m" ? r * 6e4 : n === "s" ? r * 1e3 : r;
 }
-function $e(e) {
-  return de(e, /* @__PURE__ */ new Set());
+function Le(e) {
+  return me(e, /* @__PURE__ */ new Set());
 }
-function le(e) {
+function he(e) {
   return e.id;
 }
-async function Ft(e, t, r, n) {
+async function Jt(e, t, r, n) {
   const s = e.get(t);
   if (s && s.expiresAt > n())
     return await s.value;
-  const i = Promise.resolve().then(r.fn), o = {
-    expiresAt: n() + U(r.ttl),
-    tags: (r.tags ?? []).map(le),
-    value: i
+  const o = Promise.resolve().then(r.fn), i = {
+    expiresAt: n() + P(r.ttl),
+    tags: (r.tags ?? []).map(he),
+    value: o
   };
-  e.set(t, o);
+  e.set(t, i);
   try {
-    return await i;
+    return await o;
   } catch (a) {
-    throw e.get(t) === o && e.delete(t), a;
+    throw e.get(t) === i && (a instanceof A ? i.expiresAt = n() + P(r.notFoundTtl ?? r.ttl) : e.delete(t)), a;
   }
 }
-function ke(e, t, r) {
+function Me(e, t, r) {
   return `${e}:${t}:key:${r}`;
 }
-function De(e, t, r) {
+function Ie(e, t, r) {
   return `${e}:${t}:tag:${r}`;
 }
-function Qe(e, t) {
-  const r = U(t);
+function Se(e, t) {
+  const r = P(t);
   return Number.isFinite(r) ? e + r : null;
 }
-function Xe(e, t, r) {
-  const n = U(t);
+function st(e, t, r, n) {
+  const s = t.notFoundTtl ?? t.ttl;
+  return {
+    expiresAt: Se(e, s),
+    negative: !0,
+    // Negative entries do not participate in stale-while-revalidate: they
+    // expire outright and recompute on the next request.
+    staleUntil: Ee(e, s, void 0),
+    tags: r,
+    value: n.message
+  };
+}
+function Ee(e, t, r) {
+  const n = P(t);
   if (!Number.isFinite(n)) {
     if (r !== void 0)
       throw new Error(
@@ -305,32 +339,32 @@ function Xe(e, t, r) {
       );
     return null;
   }
-  return e + n + U(r ?? 0);
+  return e + n + P(r ?? 0);
 }
-function Wt(e) {
-  const t = U(e ?? Ut);
+function Kt(e) {
+  const t = P(e ?? Gt);
   if (!Number.isFinite(t) || t <= 0)
     throw new Error(
       "Demiurge cache refreshLeaseTtl must be a positive finite duration."
     );
   return t;
 }
-function qt(e, t) {
+function Yt(e, t) {
   return e.expiresAt !== null && e.expiresAt <= t && (e.staleUntil === null || e.staleUntil > t);
 }
-function zt(e) {
+function Zt(e) {
   if (!e.acquireRefreshLease || !e.publishRefresh || !e.releaseRefreshLease)
     throw new Error(
       "Demiurge staleWhileRevalidate requires a cache store with acquireRefreshLease, publishRefresh, and releaseRefreshLease coordination methods."
     );
   return e;
 }
-async function Bt(e) {
+async function Qt(e) {
   try {
     const t = await e.request.fn(), r = e.now();
     await e.refreshStore.publishRefresh(e.key, e.token, {
-      expiresAt: Qe(r, e.request.ttl),
-      staleUntil: Xe(
+      expiresAt: Se(r, e.request.ttl),
+      staleUntil: Ee(
         r,
         e.request.ttl,
         e.request.staleWhileRevalidate
@@ -339,12 +373,20 @@ async function Bt(e) {
       value: t
     });
   } catch (t) {
+    if (t instanceof A) {
+      await e.refreshStore.publishRefresh(
+        e.key,
+        e.token,
+        st(e.now(), e.request, e.tags, t)
+      );
+      return;
+    }
     e.onBackgroundError ? e.onBackgroundError(t) : console.error("Demiurge stale cache refresh failed.", t);
   } finally {
     await e.refreshStore.releaseRefreshLease(e.key, e.token);
   }
 }
-function se(e, t) {
+function ie(e, t) {
   const r = [...t].some((n) => {
     const s = n.charCodeAt(0);
     return s <= 31 || s === 127;
@@ -355,13 +397,13 @@ function se(e, t) {
     );
   return t;
 }
-function Gt(e, t) {
+function Xt(e, t) {
   let r = 0;
   for (const [n, s] of e)
-    s.tags.some((i) => t.has(i)) && (e.delete(n), r += 1);
+    s.tags.some((o) => t.has(o)) && (e.delete(n), r += 1);
   return r;
 }
-function de(e, t) {
+function me(e, t) {
   if (e === null || typeof e == "boolean" || typeof e == "string")
     return JSON.stringify(e);
   if (typeof e == "number") {
@@ -378,18 +420,18 @@ function de(e, t) {
   if (t.has(e))
     throw new Error("Demiurge cache keys cannot contain circular references.");
   if (t.add(e), Array.isArray(e)) {
-    const o = Reflect.ownKeys(e), a = [
-      ...Array.from({ length: e.length }, (u, f) => String(f)),
+    const i = Reflect.ownKeys(e), a = [
+      ...Array.from({ length: e.length }, (u, l) => String(l)),
       "length"
     ];
-    if (o.length !== a.length || o.some((u, f) => u !== a[f]) || a.slice(0, -1).some((u) => {
-      const f = Object.getOwnPropertyDescriptor(e, u);
-      return !f?.enumerable || !("value" in f);
+    if (i.length !== a.length || i.some((u, l) => u !== a[l]) || a.slice(0, -1).some((u) => {
+      const l = Object.getOwnPropertyDescriptor(e, u);
+      return !l?.enumerable || !("value" in l);
     }))
       throw t.delete(e), new Error(
         "Demiurge cache key arrays must be dense and cannot contain accessors or custom properties."
       );
-    const c = `[${e.map((u) => de(u, t)).join(",")}]`;
+    const c = `[${e.map((u) => me(u, t)).join(",")}]`;
     return t.delete(e), c;
   }
   const r = Object.getPrototypeOf(e);
@@ -398,47 +440,47 @@ function de(e, t) {
       "Demiurge cache keys accept only primitives, arrays, and plain objects."
     );
   const n = Reflect.ownKeys(e);
-  if (n.some((o) => typeof o == "symbol") || n.some((o) => {
-    const a = Object.getOwnPropertyDescriptor(e, o);
+  if (n.some((i) => typeof i == "symbol") || n.some((i) => {
+    const a = Object.getOwnPropertyDescriptor(e, i);
     return !a?.enumerable || !("value" in a);
   }))
     throw new Error(
       "Demiurge cache key objects require enumerable string data properties."
     );
-  const s = e, i = `{${Object.keys(s).sort().map(
-    (o) => `${JSON.stringify(o)}:${de(s[o], t)}`
+  const s = e, o = `{${Object.keys(s).sort().map(
+    (i) => `${JSON.stringify(i)}:${me(s[i], t)}`
   ).join(",")}}`;
-  return t.delete(e), i;
+  return t.delete(e), o;
 }
-function ai(e) {
+function Ao(e) {
   return e;
 }
-function ci(e) {
+function Po(e) {
   return {
     ...e,
     kind: "meta"
   };
 }
-function ui(e) {
+function Co(e) {
   return {
     ...e,
     kind: "link"
   };
 }
-function fi(e) {
+function Do(e) {
   return {
     kind: "structured-data",
     value: e
   };
 }
-function v(...e) {
+function R(...e) {
   const t = {
     custom: [],
     structuredData: []
   };
-  for (const i of e)
-    i && _t(t, i);
-  const r = Jt(t), n = t.description, s = Kt(t.openGraph, r, n);
+  for (const o of e)
+    o && er(t, o);
+  const r = rr(t), n = t.description, s = nr(t.openGraph, r, n);
   return {
     canonical: t.canonical,
     charset: "utf-8",
@@ -451,8 +493,8 @@ function v(...e) {
     viewport: "width=device-width, initial-scale=1"
   };
 }
-function _t(e, t) {
-  Vt(e, t.title), t.description !== void 0 && (e.description = t.description), t.canonical !== void 0 && (e.canonical = t.canonical), t.robots && (e.robots = {
+function er(e, t) {
+  tr(e, t.title), t.description !== void 0 && (e.description = t.description), t.canonical !== void 0 && (e.canonical = t.canonical), t.robots && (e.robots = {
     ...e.robots ?? {},
     ...t.robots
   }), t.openGraph && (e.openGraph = {
@@ -460,7 +502,7 @@ function _t(e, t) {
     ...t.openGraph
   }), t.custom && e.custom.push(...t.custom), t.structuredData && e.structuredData.push(...t.structuredData);
 }
-function Vt(e, t) {
+function tr(e, t) {
   if (t !== void 0) {
     if (typeof t == "string") {
       e.title = t;
@@ -469,10 +511,10 @@ function Vt(e, t) {
     t.default !== void 0 && (e.titleDefault = t.default), t.format && (e.titleFormat = t.format);
   }
 }
-function Jt(e) {
+function rr(e) {
   return e.title === void 0 ? e.titleDefault : e.titleFormat ? e.titleFormat(e.title) : e.title;
 }
-function Kt(e, t, r) {
+function nr(e, t, r) {
   if (!(!e && !t && !r))
     return {
       ...t ? { title: t } : {},
@@ -480,7 +522,7 @@ function Kt(e, t, r) {
       ...e ?? {}
     };
 }
-function et(e) {
+function ot(e) {
   const t = {
     fallbacks: {
       error: [],
@@ -493,57 +535,57 @@ function et(e) {
     policies: []
   };
   for (const [r, n] of Object.entries(e)) {
-    const s = r.replace(/^\/src\/routes\//, "").replace(/^\.\/routes\//, "").replace(/\.tsx?$/, "").split("/"), i = s.at(-1);
-    if (i === "@layout") {
+    const s = r.replace(/^\/src\/routes\//, "").replace(/^\.\/routes\//, "").replace(/\.tsx?$/, "").split("/"), o = s.at(-1);
+    if (o === "@layout") {
       t.layouts.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
     }
-    if (i === "@policy") {
+    if (o === "@policy") {
       t.policies.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
     }
-    if (i === "@middleware") {
+    if (o === "@middleware") {
       t.middlewares.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
     }
-    if (i === "@loading") {
+    if (o === "@loading") {
       t.fallbacks.loading.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
     }
-    if (i === "@error") {
+    if (o === "@error") {
       t.fallbacks.error.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
     }
-    if (i === "@not-found") {
+    if (o === "@not-found") {
       t.fallbacks.notFound.push({
         file: r,
         fileSegments: s.slice(0, -1),
-        segments: R(s.slice(0, -1)),
+        segments: v(s.slice(0, -1)),
         load: n
       });
       continue;
@@ -551,12 +593,12 @@ function et(e) {
     t.routes.push({
       file: r,
       fileSegments: s,
-      segments: R(s),
-      score: dr(s),
+      segments: v(s),
+      score: Er(s),
       load: n
     });
   }
-  return Yt(t.routes), t.routes.sort(Xt), t.layouts.sort(
+  return sr(t.routes), t.routes.sort(ar), t.layouts.sort(
     (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
   ), t.policies.sort(
     (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
@@ -570,48 +612,48 @@ function et(e) {
     (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
   ), t;
 }
-function Yt(e) {
+function sr(e) {
   const t = /* @__PURE__ */ new Map();
   for (const r of e) {
     const n = r.segments.findIndex(
-      (o) => o.startsWith("*")
+      (i) => i.startsWith("*")
     );
     if (n !== -1 && n !== r.segments.length - 1)
       throw new Error(
         `Catchall route segment in "${r.file}" must be the final URL segment.`
       );
-    const s = r.segments.map(Zt).join("/"), i = t.get(s);
-    if (i)
+    const s = r.segments.map(or).join("/"), o = t.get(s);
+    if (o)
       throw new Error(
-        `Ambiguous routes "${i.file}" and "${r.file}" have the same runtime shape and both match "${Qt(r.segments)}".`
+        `Ambiguous routes "${o.file}" and "${r.file}" have the same runtime shape and both match "${ir(r.segments)}".`
       );
     t.set(s, r);
   }
 }
-function Zt(e) {
+function or(e) {
   return e.startsWith("*") ? "*" : e.startsWith(":") ? ":" : `=${e}`;
 }
-function Qt(e) {
+function ir(e) {
   return e.length === 0 ? "/" : `/${e.map((t) => t.startsWith(":") || t.startsWith("*") ? "example" : t).join("/")}`;
 }
-function Xt(e, t) {
+function ar(e, t) {
   const r = Math.max(e.segments.length, t.segments.length);
   for (let n = 0; n < r; n += 1) {
-    const s = Ne(t.segments[n]) - Ne(e.segments[n]);
+    const s = Ue(t.segments[n]) - Ue(e.segments[n]);
     if (s !== 0)
       return s;
   }
   return e.file.localeCompare(t.file);
 }
-function Ne(e) {
+function Ue(e) {
   return e === void 0 ? 4 : e.startsWith("*") ? 1 : e.startsWith(":") ? 2 : 3;
 }
-async function tt(e, t, r = new Request(`http://demiurge.local${t}`), n, s = ge(), i = {}) {
-  const o = i.documentContributions ?? !0, a = F(e.routes, t);
+async function it(e, t, r = new Request(`http://demiurge.local${t}`), n, s = we(), o = {}) {
+  const i = o.documentContributions ?? !0, a = B(e.routes, t);
   if (!a)
     return {
-      ...await me(e, t, {
-        documentContributions: o
+      ...await pe(e, t, {
+        documentContributions: i
       }),
       status: "not-found"
     };
@@ -620,136 +662,136 @@ async function tt(e, t, r = new Request(`http://demiurge.local${t}`), n, s = ge(
   ), u = await a.route.load();
   if (!u.GET || u.GET.kind !== "page")
     return {
-      ...await me(e, t, {
-        fallback: ye(
+      ...await pe(e, t, {
+        fallback: ve(
           e.fallbacks.notFound,
           a.route
         ),
-        documentContributions: o,
+        documentContributions: i,
         layouts: c
       }),
       status: "not-found"
     };
-  const f = u.GET.layout === !1 ? [] : await Promise.all(c.map((d) => d.load())), l = new URL(r.url), m = {
+  const l = u.GET.layout === !1 ? [] : await Promise.all(c.map((d) => d.load())), f = new URL(r.url), h = {
     cache: s,
-    context: i.requestContext ?? {},
+    context: o.requestContext ?? {},
     path: a.path,
     pathname: t,
     request: r,
-    search: l.searchParams,
-    url: l
+    search: f.searchParams,
+    url: f
   };
   return {
     status: "ready",
     match: {
-      data: u.GET.data && !n?.hasData ? await u.GET.data(m) : n?.data,
-      error: await rt(e, a.route),
-      links: o ? await kt(
+      data: u.GET.data && !n?.hasData ? await u.GET.data(h) : n?.data,
+      error: await at(e, a.route),
+      links: i ? await Ut(
         [
-          ...f.map((d) => d.links),
+          ...l.map((d) => d.links),
           u.links
         ],
-        m
+        h
       ) : [],
       page: u.GET.view,
-      layouts: f.map(
+      layouts: l.map(
         (d) => d.default
       ),
-      metadata: o ? v(
-        ...f.map((d) => d.metadata),
+      metadata: i ? R(
+        ...l.map((d) => d.metadata),
         u.metadata
-      ) : v(),
+      ) : R(),
       path: a.path,
       pathname: t,
       render: u.GET.render,
-      scripts: o ? await $t(
+      scripts: i ? await It(
         [
-          ...f.map((d) => d.scripts),
+          ...l.map((d) => d.scripts),
           u.scripts
         ],
-        m
+        h
       ) : []
     }
   };
 }
-async function li(e, t = {}) {
-  const r = ge(), n = [];
+async function $o(e, t = {}) {
+  const r = we(), n = [];
   for (const s of e.routes) {
-    const i = await s.load();
-    if (!i.GET || i.GET.kind !== "page" && !t.includeResources)
+    const o = await s.load();
+    if (!o.GET || o.GET.kind !== "page" && !t.includeResources)
       continue;
-    if (i.GET.kind === "page" && i.GET.render.mode !== "static")
+    if (o.GET.kind === "page" && o.GET.render.mode !== "static")
       throw new Error(
-        `Page route "${s.file}" uses render mode "${i.GET.render.mode}" and cannot be emitted as static output. Set render: { mode: "static" } or deploy a runtime adapter.`
+        `Page route "${s.file}" uses render mode "${o.GET.render.mode}" and cannot be emitted as static output. Set render: { mode: "static" } or deploy a runtime adapter.`
       );
-    const o = or(s.segments);
-    if (cr(s.segments).length === 0) {
+    const i = mr(s.segments);
+    if (gr(s.segments).length === 0) {
       n.push({
         file: s.file,
         path: {},
-        pattern: o,
-        pathname: o
+        pattern: i,
+        pathname: i
       });
       continue;
     }
-    if (!i.paths)
+    if (!o.paths)
       throw new Error(
-        `Dynamic static route "${s.file}" must export paths for "${o}".`
+        `Dynamic static route "${s.file}" must export paths for "${i}".`
       );
-    const c = await i.paths({ cache: r });
+    const c = await o.paths({ cache: r });
     for (const u of c) {
-      const f = ur(s, o, u);
+      const l = yr(s, i, u);
       n.push({
         file: s.file,
-        path: f,
-        pattern: o,
-        pathname: lr(s.segments, f)
+        path: l,
+        pattern: i,
+        pathname: Sr(s.segments, l)
       });
     }
   }
   return n;
 }
-async function di(e, t) {
-  const r = F(e.routes, t);
+async function ko(e, t) {
+  const r = B(e.routes, t);
   if (r)
-    return await sr(
-      ye(e.fallbacks.loading, r.route)
+    return await dr(
+      ve(e.fallbacks.loading, r.route)
     );
 }
-async function er(e, t) {
+async function cr(e, t) {
   let r;
   try {
-    r = F(e.routes, t);
+    r = B(e.routes, t);
   } catch (n) {
-    if (!(n instanceof Ee)) throw n;
-    return await Se(
+    if (!(n instanceof Te)) throw n;
+    return await be(
       e.fallbacks.error.find(
         (s) => s.fileSegments.length === 0
       )
     );
   }
-  return r ? await rt(e, r.route) : await tr(e, t);
+  return r ? await at(e, r.route) : await ur(e, t);
 }
-async function rt(e, t) {
-  return await Se(
-    ye(e.fallbacks.error, t)
+async function at(e, t) {
+  return await be(
+    ve(e.fallbacks.error, t)
   );
 }
-async function tr(e, t) {
-  return await Se(
-    nt(e.fallbacks.error, t)
+async function ur(e, t) {
+  return await be(
+    ct(e.fallbacks.error, t)
   );
 }
-async function me(e, t, r = {}) {
-  const s = await (r.fallback ?? nt(e.fallbacks.notFound, t))?.load(), i = s?.default, o = r.documentContributions ?? !0;
+async function pe(e, t, r = {}) {
+  const s = await (r.fallback ?? ct(e.fallbacks.notFound, t))?.load(), o = s?.default, i = r.documentContributions ?? !0;
   if (s?.layout === !1)
     return {
       layouts: [],
-      metadata: o ? v(s.metadata) : v(),
-      notFound: i,
+      metadata: i ? R(s.metadata) : R(),
+      notFound: o,
       pathname: t
     };
-  const a = r.layouts ?? rr(e, t);
+  const a = r.layouts ?? lr(e, t);
   try {
     const c = await Promise.all(
       a.map((u) => u.load())
@@ -758,86 +800,86 @@ async function me(e, t, r = {}) {
       layouts: c.map(
         (u) => u.default
       ),
-      metadata: o ? v(
+      metadata: i ? R(
         ...c.map((u) => u.metadata),
         s?.metadata
-      ) : v(),
-      notFound: i,
+      ) : R(),
+      notFound: o,
       pathname: t
     };
   } catch (c) {
     return r.onLayoutError?.(c), {
       layouts: [],
-      metadata: o ? v(s?.metadata) : v(),
-      notFound: i,
+      metadata: i ? R(s?.metadata) : R(),
+      notFound: o,
       pathname: t
     };
   }
 }
-function rr(e, t) {
-  const r = X(t);
+function lr(e, t) {
+  const r = re(t);
   return e.layouts.filter(
-    (n) => !n.fileSegments.some(Q) && we(n.segments, r)
+    (n) => !n.fileSegments.some(te) && Re(n.segments, r)
   );
 }
-function nr(e, t) {
-  const r = X(t);
+function fr(e, t) {
+  const r = re(t);
   return e.policies.filter(
-    (n) => !n.fileSegments.some(Q) && we(n.segments, r)
+    (n) => !n.fileSegments.some(te) && Re(n.segments, r)
   );
 }
-function ye(e, t) {
+function ve(e, t) {
   for (let r = e.length - 1; r >= 0; r -= 1) {
     const n = e[r];
     if (T(n.fileSegments, t.fileSegments))
       return n;
   }
 }
-function nt(e, t) {
-  const r = X(t);
+function ct(e, t) {
+  const r = re(t);
   for (let n = e.length - 1; n >= 0; n -= 1) {
     const s = e[n];
-    if (!s.fileSegments.some(Q) && we(s.segments, r))
+    if (!s.fileSegments.some(te) && Re(s.segments, r))
       return s;
   }
 }
-function we(e, t) {
+function Re(e, t) {
   return e.every((r, n) => r.startsWith("*") ? t.length > n : r.startsWith(":") ? !!t[n] : t[n] === r);
 }
-async function sr(e) {
+async function dr(e) {
   return e ? (await e.load()).default : void 0;
 }
-async function Se(e) {
+async function be(e) {
   return e ? (await e.load()).default : void 0;
 }
-function F(e, t) {
-  const r = X(t);
+function B(e, t) {
+  const r = re(t);
   for (const n of e) {
-    const s = ir(n.segments, r);
+    const s = hr(n.segments, r);
     if (s)
       return { route: n, path: s };
   }
   return null;
 }
-const mi = tt, hi = F;
-function ir(e, t) {
+const No = it, Oo = B;
+function hr(e, t) {
   const r = {};
   for (let n = 0; n < e.length; n += 1) {
-    const s = e[n], i = t[n];
+    const s = e[n], o = t[n];
     if (s?.startsWith("*"))
       return r[s.slice(1)] = t.slice(n).join("/"), r;
-    if (!i)
+    if (!o)
       return null;
     if (s.startsWith(":")) {
-      r[s.slice(1)] = i;
+      r[s.slice(1)] = o;
       continue;
     }
-    if (s !== i)
+    if (s !== o)
       return null;
   }
   return e.length === t.length ? r : null;
 }
-function pi(e, t) {
+function Lo(e, t) {
   return e.every(
     (r, n) => t[n] === r
   );
@@ -847,58 +889,58 @@ function T(e, t) {
     (r, n) => t[n] === r
   );
 }
-function R(e) {
-  return e.flatMap((t) => Q(t) ? [] : t === "index" ? [] : t.startsWith("[...") && t.endsWith("]") ? [`*${t.slice(4, -1)}`] : t.startsWith("[") && t.endsWith("]") ? [`:${t.slice(1, -1)}`] : [t]);
+function v(e) {
+  return e.flatMap((t) => te(t) ? [] : t === "index" ? [] : t.startsWith("[...") && t.endsWith("]") ? [`*${t.slice(4, -1)}`] : t.startsWith("[") && t.endsWith("]") ? [`:${t.slice(1, -1)}`] : [t]);
 }
-function Q(e) {
+function te(e) {
   return e.startsWith("(") && e.endsWith(")");
 }
-function or(e) {
-  return e.length === 0 ? "/" : `/${e.map(ar).join("/")}`;
+function mr(e) {
+  return e.length === 0 ? "/" : `/${e.map(pr).join("/")}`;
 }
-function ar(e) {
+function pr(e) {
   return e.startsWith("*") ? `[...${e.slice(1)}]` : e.startsWith(":") ? `[${e.slice(1)}]` : e;
 }
-function cr(e) {
+function gr(e) {
   return e.flatMap((t) => t.startsWith(":") || t.startsWith("*") ? [t.slice(1)] : []);
 }
-function ur(e, t, r) {
+function yr(e, t, r) {
   const n = {};
   for (const s of e.segments) {
     if (!s.startsWith(":") && !s.startsWith("*"))
       continue;
-    const i = s.slice(1), o = r[i];
-    if (o === void 0)
+    const o = s.slice(1), i = r[o];
+    if (i === void 0)
       throw new Error(
-        `Static paths for "${e.file}" must include "${i}" for "${t}".`
+        `Static paths for "${e.file}" must include "${o}" for "${t}".`
       );
-    if (!fr(o))
+    if (!wr(i))
       throw new Error(
-        `Static path "${i}" for "${e.file}" must be a string, number, or boolean.`
+        `Static path "${o}" for "${e.file}" must be a string, number, or boolean.`
       );
-    n[i] = String(o);
+    n[o] = String(i);
   }
   return n;
 }
-function fr(e) {
+function wr(e) {
   return typeof e == "string" || typeof e == "number" || typeof e == "boolean";
 }
-function lr(e, t) {
+function Sr(e, t) {
   return `/${e.map((n) => n.startsWith("*") ? t[n.slice(1)].split("/").filter(Boolean).map(encodeURIComponent).join("/") : n.startsWith(":") ? encodeURIComponent(t[n.slice(1)]) : encodeURIComponent(n)).filter(Boolean).join("/")}`;
 }
-function dr(e) {
-  return R(e).reduce((t, r) => r.startsWith("*") ? t : r.startsWith(":") ? t + 1 : t + 2, 0);
+function Er(e) {
+  return v(e).reduce((t, r) => r.startsWith("*") ? t : r.startsWith(":") ? t + 1 : t + 2, 0);
 }
-function X(e) {
+function re(e) {
   return e.replace(/^\/|\/$/g, "").split("/").filter(Boolean).map((t) => {
     try {
       return decodeURIComponent(t);
     } catch (r) {
-      throw new Ee(e, { cause: r });
+      throw new Te(e, { cause: r });
     }
   });
 }
-class Ee extends URIError {
+class Te extends URIError {
   pathname;
   constructor(t, r) {
     super(
@@ -907,35 +949,35 @@ class Ee extends URIError {
     ), this.name = "MalformedPathnameError", this.pathname = t;
   }
 }
-const C = "x-demiurge-navigation", mr = "data", hr = "data", ie = "error", Oe = "not-found";
-function st(e) {
-  return e.headers.get(C) === mr;
+const C = "x-demiurge-navigation", vr = "data", Rr = "data", ae = "error", Fe = "not-found";
+function ut(e) {
+  return e.headers.get(C) === vr;
 }
-function pr(e) {
+function br(e) {
   return Response.json(
     { data: e, hasData: !0 },
     {
       headers: {
         "cache-control": "no-store",
-        [C]: hr,
+        [C]: Rr,
         vary: C
       }
     }
   );
 }
-function z(e, t) {
+function _(e, t) {
   return e.headers.set("cache-control", "no-store"), e.headers.set(C, t), e.headers.append("vary", C), e;
 }
-function gr(e) {
+function Tr(e) {
   if (typeof e == "string")
     return e;
-  const t = yr(Er(
+  const t = xr(Cr(
     e.to,
     "path" in e ? e.path : void 0
-  )), r = e.search === void 0 ? t.search : wr(e.search), n = e.hash === void 0 ? t.hash : e.hash ? e.hash.startsWith("#") ? e.hash : `#${e.hash}` : "";
+  )), r = e.search === void 0 ? t.search : Ar(e.search), n = e.hash === void 0 ? t.hash : e.hash ? e.hash.startsWith("#") ? e.hash : `#${e.hash}` : "";
   return `${t.pathname}${r}${n}`;
 }
-function yr(e) {
+function xr(e) {
   const t = e.indexOf("#"), r = t === -1 ? e : e.slice(0, t), n = r.indexOf("?");
   return {
     hash: t === -1 ? "" : e.slice(t),
@@ -943,133 +985,133 @@ function yr(e) {
     search: n === -1 ? "" : r.slice(n)
   };
 }
-function wr(e) {
+function Ar(e) {
   if (!e)
     return "";
   if (typeof e == "string")
     return e.startsWith("?") ? e : `?${e}`;
-  const r = (e instanceof URLSearchParams ? e : Sr(e)).toString();
+  const r = (e instanceof URLSearchParams ? e : Pr(e)).toString();
   return r ? `?${r}` : "";
 }
-function Sr(e) {
+function Pr(e) {
   const t = new URLSearchParams();
   for (const [r, n] of Object.entries(e)) {
     const s = Array.isArray(n) ? n : [n];
-    for (const i of s)
-      i != null && t.append(r, String(i));
+    for (const o of s)
+      o != null && t.append(r, String(o));
   }
   return t;
 }
-function Er(e, t) {
+function Cr(e, t) {
   return t ? e.replace(
     /\[(\.\.\.)?([a-zA-Z_$][a-zA-Z0-9_$]*)\]/g,
     (r, n, s) => {
-      const i = t[s];
-      if (i === void 0)
+      const o = t[s];
+      if (o === void 0)
         throw new Error(`Missing path value for "${s}" in route "${e}".`);
-      return n ? String(i).split("/").filter(Boolean).map((o) => encodeURIComponent(o)).join("/") : encodeURIComponent(String(i));
+      return n ? String(o).split("/").filter(Boolean).map((i) => encodeURIComponent(i)).join("/") : encodeURIComponent(String(o));
     }
   ) : e;
 }
-function gi(e, t) {
+function Mo(e, t) {
   return {
     cors: t?.cors,
     kind: "json",
     security: t?.security,
-    timing: S(t?.timing),
+    timing: E(t?.timing),
     value: e,
     init: b(t)
   };
 }
-function yi(e, t) {
+function Io(e, t) {
   return {
     cors: t?.cors,
     init: b(t),
     kind: "jsonl",
     lines: e,
     security: t?.security,
-    timing: S(t?.timing)
+    timing: E(t?.timing)
   };
 }
-function wi(e, t) {
+function Uo(e, t) {
   return {
     cors: t?.cors,
     kind: "text",
     security: t?.security,
-    timing: S(t?.timing),
+    timing: E(t?.timing),
     value: e,
     init: b(t)
   };
 }
-function Si(e, t) {
+function Fo(e, t) {
   return {
     cors: t?.cors,
     kind: "html",
     security: t?.security,
-    timing: S(t?.timing),
+    timing: E(t?.timing),
     value: e,
     init: b(t)
   };
 }
-function Ei(e, t) {
+function Ho(e, t) {
   const r = typeof t == "number" ? void 0 : t;
   return {
     cors: r?.cors,
     kind: "redirect",
     security: r?.security,
-    timing: S(r?.timing),
-    to: kr(e) ? gr(e) : e,
+    timing: E(r?.timing),
+    to: Fr(e) ? Tr(e) : e,
     init: typeof t == "number" ? { status: t } : b(t)
   };
 }
-function Ri(e, t) {
+function jo(e, t) {
   return {
     cors: t?.cors,
     kind: "not-found",
     security: t?.security,
-    timing: S(t?.timing),
+    timing: E(t?.timing),
     body: e,
     init: b(t)
   };
 }
-function vi(e, t) {
+function Wo(e, t) {
   return {
     cors: t?.cors,
     kind: "response",
     response: e,
     security: t?.security,
-    timing: S(t?.timing)
+    timing: E(t?.timing)
   };
 }
-function bi(e, t) {
+function zo(e, t) {
   return {
     body: e,
     cors: t?.cors,
     init: b(t),
     kind: "stream",
     security: t?.security,
-    timing: S(t?.timing)
+    timing: E(t?.timing)
   };
 }
-function Ti(e, t) {
+function Bo(e, t) {
   return {
     cors: t?.cors,
     events: e,
     init: b(t),
     kind: "sse",
     security: t?.security,
-    timing: S(t?.timing)
+    timing: E(t?.timing)
   };
 }
-function xi(...e) {
+function qo(...e) {
   return e;
 }
-async function Rr(e, t) {
+async function Dr(e, t) {
   switch (e.kind) {
     case "json":
-      return new Response(JSON.stringify(await y(e.value, t)), {
+      return new Response(JSON.stringify(await w(e.value, t)), {
         ...e.init,
-        headers: oe(
+        headers: ce(
           e.init?.headers,
           "content-type",
           "application/json; charset=utf-8"
@@ -1077,10 +1119,10 @@ async function Rr(e, t) {
       });
     case "jsonl":
       return new Response(
-        br(await y(e.lines, t)),
+        kr(await w(e.lines, t)),
         {
           ...e.init,
-          headers: G(e.init?.headers, {
+          headers: K(e.init?.headers, {
             "cache-control": "no-cache",
             "content-type": "application/x-ndjson; charset=utf-8",
             "x-accel-buffering": "no"
@@ -1088,18 +1130,18 @@ async function Rr(e, t) {
         }
       );
     case "text":
-      return new Response(await y(e.value, t), {
+      return new Response(await w(e.value, t), {
         ...e.init,
-        headers: oe(
+        headers: ce(
           e.init?.headers,
           "content-type",
           "text/plain; charset=utf-8"
         )
       });
     case "html":
-      return new Response(await y(e.value, t), {
+      return new Response(await w(e.value, t), {
         ...e.init,
-        headers: oe(
+        headers: ce(
           e.init?.headers,
           "content-type",
           "text/html; charset=utf-8"
@@ -1107,7 +1149,7 @@ async function Rr(e, t) {
       });
     case "redirect": {
       const r = new Headers(e.init?.headers);
-      return r.set("location", String(await y(e.to, t))), new Response(null, {
+      return r.set("location", String(await w(e.to, t))), new Response(null, {
         ...e.init,
         headers: r,
         status: e.init?.status ?? 302
@@ -1115,20 +1157,20 @@ async function Rr(e, t) {
     }
     case "not-found":
       return new Response(
-        e.body ? await y(e.body, t) : null,
+        e.body ? await w(e.body, t) : null,
         {
           ...e.init,
           status: e.init?.status ?? 404
         }
       );
     case "response":
-      return await y(e.response, t);
+      return await w(e.response, t);
     case "stream":
       return new Response(
-        Tr(await y(e.body, t)),
+        Nr(await w(e.body, t)),
         {
           ...e.init,
-          headers: G(e.init?.headers, {
+          headers: K(e.init?.headers, {
             "content-type": "application/octet-stream",
             "x-accel-buffering": "no"
           })
@@ -1136,10 +1178,10 @@ async function Rr(e, t) {
       );
     case "sse":
       return new Response(
-        vr(await y(e.events, t)),
+        $r(await w(e.events, t)),
         {
           ...e.init,
-          headers: G(e.init?.headers, {
+          headers: K(e.init?.headers, {
             "cache-control": "no-cache",
             "content-type": "text/event-stream; charset=utf-8",
             "x-accel-buffering": "no"
@@ -1148,22 +1190,22 @@ async function Rr(e, t) {
       );
   }
 }
-async function y(e, t) {
+async function w(e, t) {
   return typeof e != "function" ? e : await e(
     t
   );
 }
-function oe(e, t, r) {
-  return G(e, { [t]: r });
+function ce(e, t, r) {
+  return K(e, { [t]: r });
 }
-function G(e, t) {
+function K(e, t) {
   const r = new Headers(e);
   for (const [n, s] of Object.entries(t))
     r.has(n) || r.set(n, s);
   return r;
 }
-function vr(e) {
-  const t = new TextEncoder(), r = Re(e);
+function $r(e) {
+  const t = new TextEncoder(), r = xe(e);
   return new ReadableStream({
     async pull(n) {
       const s = await r.next();
@@ -1171,15 +1213,15 @@ function vr(e) {
         n.close();
         return;
       }
-      n.enqueue(t.encode(Ar(s.value)));
+      n.enqueue(t.encode(Mr(s.value)));
     },
     async cancel() {
       await r.return?.();
     }
   });
 }
-function br(e) {
-  const t = new TextEncoder(), r = Re(e);
+function kr(e) {
+  const t = new TextEncoder(), r = xe(e);
   return new ReadableStream({
     async pull(n) {
       const s = await r.next();
@@ -1195,8 +1237,8 @@ function br(e) {
     }
   });
 }
-function Tr(e) {
-  const t = new TextEncoder(), r = Re(e);
+function Nr(e) {
+  const t = new TextEncoder(), r = xe(e);
   return new ReadableStream({
     async pull(n) {
       const s = await r.next();
@@ -1204,17 +1246,17 @@ function Tr(e) {
         n.close();
         return;
       }
-      n.enqueue(xr(s.value, t));
+      n.enqueue(Or(s.value, t));
     },
     async cancel() {
       await r.return?.();
     }
   });
 }
-function xr(e, t) {
+function Or(e, t) {
   return typeof e == "string" ? t.encode(e) : e;
 }
-function Re(e) {
+function xe(e) {
   if (e instanceof ReadableStream) {
     const t = e.getReader();
     return {
@@ -1226,9 +1268,9 @@ function Re(e) {
       }
     };
   }
-  return Symbol.asyncIterator in e ? e[Symbol.asyncIterator]() : Pr(e[Symbol.iterator]());
+  return Symbol.asyncIterator in e ? e[Symbol.asyncIterator]() : Lr(e[Symbol.iterator]());
 }
-function Pr(e) {
+function Lr(e) {
   return {
     async next() {
       return e.next();
@@ -1238,35 +1280,35 @@ function Pr(e) {
     }
   };
 }
-function Ar(e) {
+function Mr(e) {
   if (typeof e == "string")
-    return Cr(e);
+    return Ir(e);
   const t = [];
-  if (e.comment !== void 0 && t.push(...N("", e.comment)), e.id !== void 0 && t.push(...N("id", e.id)), e.event !== void 0 && t.push(...N("event", e.event)), e.retry !== void 0) {
+  if (e.comment !== void 0 && t.push(...M("", e.comment)), e.id !== void 0 && t.push(...M("id", e.id)), e.event !== void 0 && t.push(...M("event", e.event)), e.retry !== void 0) {
     if (!Number.isInteger(e.retry) || e.retry < 0)
       throw new Error("SSE retry must be a non-negative integer.");
     t.push(`retry: ${e.retry}`);
   }
-  return e.data !== void 0 && t.push(...N("data", $r(e.data))), `${t.join(`
+  return e.data !== void 0 && t.push(...M("data", Ur(e.data))), `${t.join(`
 `)}
 
 `;
 }
-function Cr(e) {
-  return `${N("data", e).join(`
+function Ir(e) {
+  return `${M("data", e).join(`
 `)}
 
 `;
 }
-function N(e, t) {
+function M(e, t) {
   return t.split(/\r\n|\r|\n/).map(
     (r) => e ? `${e}: ${r}` : `: ${r}`
   );
 }
-function $r(e) {
+function Ur(e) {
   return typeof e == "string" ? e : JSON.stringify(e);
 }
-function kr(e) {
+function Fr(e) {
   return typeof e == "object" && e !== null && !(e instanceof URL) && "to" in e;
 }
 function b(e) {
@@ -1280,10 +1322,10 @@ function b(e) {
   } = e;
   return s;
 }
-function Dr(e, t) {
+function Hr(e, t) {
   if (!t?.length)
     return e;
-  const r = new Headers(e.headers), n = Nr(t), s = r.get("server-timing");
+  const r = new Headers(e.headers), n = jr(t), s = r.get("server-timing");
   return r.set(
     "server-timing",
     s ? `${s}, ${n}` : n
@@ -1293,15 +1335,15 @@ function Dr(e, t) {
     statusText: e.statusText
   });
 }
-function Nr(e) {
-  return e.map(Or).join(", ");
+function jr(e) {
+  return e.map(Wr).join(", ");
 }
-function S(e) {
+function E(e) {
   if (e)
     return Array.isArray(e) ? e : [e];
 }
-function Or(e) {
-  if (!Lr(e.name))
+function Wr(e) {
+  if (!zr(e.name))
     throw new Error(
       `Server-Timing metric name "${e.name}" is not a valid token.`
     );
@@ -1309,20 +1351,20 @@ function Or(e) {
   if (e.duration !== void 0) {
     if (!Number.isFinite(e.duration) || e.duration < 0)
       throw new Error("Server-Timing metric duration must be a non-negative finite number.");
-    t.push(`dur=${Ir(e.duration)}`);
+    t.push(`dur=${Br(e.duration)}`);
   }
-  return e.description !== void 0 && t.push(`desc="${Mr(e.description)}"`), t.join(";");
+  return e.description !== void 0 && t.push(`desc="${qr(e.description)}"`), t.join(";");
 }
-function Lr(e) {
+function zr(e) {
   return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(e);
 }
-function Ir(e) {
+function Br(e) {
   return Number.isInteger(e), String(e);
 }
-function Mr(e) {
+function qr(e) {
   return e.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
 }
-const Ur = [
+const Gr = [
   400,
   401,
   402,
@@ -1363,7 +1405,7 @@ const Ur = [
   508,
   510,
   511
-], Hr = {
+], _r = {
   400: "Bad Request",
   401: "Unauthorized",
   402: "Payment Required",
@@ -1404,8 +1446,8 @@ const Ur = [
   508: "Loop Detected",
   510: "Not Extended",
   511: "Network Authentication Required"
-}, jr = new Set(Ur);
-class it extends Error {
+}, Vr = new Set(Gr);
+class lt extends Error {
   detail;
   extensions;
   headers;
@@ -1413,59 +1455,59 @@ class it extends Error {
   title;
   type;
   constructor(t, r = {}, n = {}) {
-    Fr(t);
+    Jr(t);
     const s = typeof r == "string" ? { detail: r } : r, {
-      detail: i,
-      title: o = Hr[t],
+      detail: o,
+      title: i = _r[t],
       type: a = "about:blank",
       ...c
     } = s;
-    super(i ?? o, { cause: n.cause }), this.name = "HttpError", this.detail = i, this.extensions = Object.freeze({ ...c }), this.headers = new Headers(n.headers), this.status = t, this.title = o, this.type = a;
+    super(o ?? i, { cause: n.cause }), this.name = "HttpError", this.detail = o, this.extensions = Object.freeze({ ...c }), this.headers = new Headers(n.headers), this.status = t, this.title = i, this.type = a;
   }
 }
-function Pi(e, t, r) {
-  return new it(e, t, r);
+function Go(e, t, r) {
+  return new lt(e, t, r);
 }
-function ve(e) {
-  return e instanceof it;
+function Ae(e) {
+  return e instanceof lt;
 }
-function Fr(e) {
-  if (!jr.has(e))
+function Jr(e) {
+  if (!Vr.has(e))
     throw new RangeError(
       `HTTP error status must be a standard 4xx or 5xx status; received ${JSON.stringify(e)}.`
     );
 }
-function Le({ pathname: e }) {
-  return /* @__PURE__ */ I("main", { children: [
-    /* @__PURE__ */ M("h1", { children: "404" }),
-    /* @__PURE__ */ I("p", { children: [
+function He({ pathname: e }) {
+  return /* @__PURE__ */ H("main", { children: [
+    /* @__PURE__ */ j("h1", { children: "404" }),
+    /* @__PURE__ */ H("p", { children: [
       "No route matched ",
       e,
       "."
     ] })
   ] });
 }
-function Ie({ status: e }) {
-  return /* @__PURE__ */ I("main", { children: [
-    /* @__PURE__ */ M("h1", { children: e }),
-    /* @__PURE__ */ M("p", { children: "Something went wrong." })
+function je({ status: e }) {
+  return /* @__PURE__ */ H("main", { children: [
+    /* @__PURE__ */ j("h1", { children: e }),
+    /* @__PURE__ */ j("p", { children: "Something went wrong." })
   ] });
 }
-function Wr({ error: e, pathname: t, status: r }) {
-  const { message: n, name: s, stack: i } = ot(e);
-  return /* @__PURE__ */ I("main", { children: [
-    /* @__PURE__ */ I("h1", { children: [
+function Kr({ error: e, pathname: t, status: r }) {
+  const { message: n, name: s, stack: o } = ft(e);
+  return /* @__PURE__ */ H("main", { children: [
+    /* @__PURE__ */ H("h1", { children: [
       r,
       " ",
       s,
       " at ",
       t
     ] }),
-    /* @__PURE__ */ M("p", { children: n }),
-    i ? /* @__PURE__ */ M("pre", { children: i }) : null
+    /* @__PURE__ */ j("p", { children: n }),
+    o ? /* @__PURE__ */ j("pre", { children: o }) : null
   ] });
 }
-function ot(e) {
+function ft(e) {
   return e instanceof Error ? {
     message: e.message,
     name: e.name,
@@ -1476,27 +1518,27 @@ function ot(e) {
     stack: void 0
   };
 }
-const qr = ["text/html", "application/xhtml+xml"];
-function at(e) {
-  return zr(e.headers.get("accept"));
+const Yr = ["text/html", "application/xhtml+xml"];
+function dt(e) {
+  return Zr(e.headers.get("accept"));
 }
-function zr(e) {
-  return e ? Br(e).some(
-    (t) => t.quality > 0 && qr.includes(t.type)
+function Zr(e) {
+  return e ? Qr(e).some(
+    (t) => t.quality > 0 && Yr.includes(t.type)
   ) : !1;
 }
-function Br(e) {
+function Qr(e) {
   return e.split(",").flatMap((t) => {
     const [r, ...n] = t.split(";"), s = r.trim().toLowerCase();
     return s ? [
       {
-        quality: Gr(n),
+        quality: Xr(n),
         type: s
       }
     ] : [];
   });
 }
-function Gr(e) {
+function Xr(e) {
   for (const t of e) {
     const [r, n] = t.split("=");
     if (r?.trim().toLowerCase() !== "q")
@@ -1506,14 +1548,14 @@ function Gr(e) {
   }
   return 1;
 }
-const _r = "application/problem+json";
-function Vr({
+const en = "application/problem+json";
+function tn({
   detail: e,
   instance: t,
   status: r,
   title: n,
   type: s = "about:blank",
-  ...i
+  ...o
 }) {
   return {
     type: s,
@@ -1521,29 +1563,29 @@ function Vr({
     status: r,
     ...e === void 0 ? {} : { detail: e },
     ...t === void 0 ? {} : { instance: t },
-    ...i
+    ...o
   };
 }
-function J(e, t) {
+function Z(e, t) {
   const r = new Headers(t?.headers);
-  return r.set("content-type", `${_r}; charset=utf-8`), new Response(JSON.stringify(Vr(e)), {
+  return r.set("content-type", `${en}; charset=utf-8`), new Response(JSON.stringify(tn(e)), {
     ...t,
     headers: r,
     status: e.status
   });
 }
-const Jr = "Internal Server Error";
-function ct(e) {
+const rn = "Internal Server Error";
+function ht(e) {
   return e === !0 && process.env.NODE_ENV !== "production";
 }
-async function _(e, t, r, n, s = {}) {
+async function Y(e, t, r, n, s = {}) {
   s.onError?.(r, n);
-  const i = new URL(t.url);
-  return n === "page" || n === "middleware" && at(t) ? await Yr(e, i, r, s) : Kr(i, r, s);
+  const o = new URL(t.url);
+  return n === "page" || n === "middleware" && dt(t) ? await sn(e, o, r, s) : nn(o, r, s);
 }
-function Kr(e, t, r = {}) {
-  if (ve(t))
-    return J(
+function nn(e, t, r = {}) {
+  if (Ae(t))
+    return Z(
       {
         ...t.extensions,
         detail: t.detail,
@@ -1554,72 +1596,72 @@ function Kr(e, t, r = {}) {
       },
       { headers: t.headers }
     );
-  const { message: n } = ot(t);
-  return J({
+  const { message: n } = ft(t);
+  return Z({
     // `detail` carries the thrown message, so it is dev only for the same
     // reason the stack is.
-    ...ct(r.dev) ? { detail: n } : {},
+    ...ht(r.dev) ? { detail: n } : {},
     instance: `${e.pathname}${e.search}`,
     status: 500,
     title: "Internal Server Error"
   });
 }
-async function Yr(e, t, r, n) {
-  const s = ut(r);
+async function sn(e, t, r, n) {
+  const s = mt(r);
   try {
-    const i = await Qr(
+    const o = await an(
       e,
       t.pathname,
       r,
       n
-    ), o = ve(r) ? new Headers(r.headers) : new Headers();
-    return o.set("content-type", "text/html; charset=utf-8"), new Response(await n.transformDocument?.(i) ?? i, {
-      headers: o,
+    ), i = Ae(r) ? new Headers(r.headers) : new Headers();
+    return i.set("content-type", "text/html; charset=utf-8"), new Response(await n.transformDocument?.(o) ?? o, {
+      headers: i,
       status: s
     });
-  } catch (i) {
-    return n.onError?.(i, "page"), Zr();
+  } catch (o) {
+    return n.onError?.(o, "page"), on();
   }
 }
-function Zr() {
-  return new Response(Jr, {
+function on() {
+  return new Response(rn, {
     headers: { "content-type": "text/plain; charset=utf-8" },
     status: 500
   });
 }
-async function Qr(e, t, r, n) {
-  const s = await Xr(e, t, n), i = _e({
+async function an(e, t, r, n) {
+  const s = await cn(e, t, n), o = Qe({
     dev: n.dev,
     nonce: n.nonce
-  }), o = Ke(
-    Ve(
-      i,
-      fe(s, { error: r, pathname: t, status: ut(r) })
+  }), i = tt(
+    Xe(
+      o,
+      de(s, { error: r, pathname: t, status: mt(r) })
     )
   );
-  return Je({
-    body: { data: void 0, html: o, navigation: n.navigation },
+  return et({
+    body: { data: void 0, html: i, navigation: n.navigation },
     entrySrc: n.clientEntry,
     lang: n.lang,
     nonce: n.nonce,
-    scripts: i.scripts(),
+    scripts: o.scripts(),
     styles: n.styles,
     title: n.title
   });
 }
-function ut(e) {
-  return ve(e) ? e.status : 500;
+function mt(e) {
+  return Ae(e) ? e.status : 500;
 }
-async function Xr(e, t, r) {
-  if (ct(r.dev))
-    return Wr;
+async function cn(e, t, r) {
+  if (ht(r.dev))
+    return Kr;
   try {
-    return await er(e, t) ?? Ie;
+    return await cr(e, t) ?? je;
   } catch {
-    return Ie;
+    return je;
   }
 }
-const K = "{nonce}", Me = `'nonce-${K}'`, ft = {
+const Q = "{nonce}", We = `'nonce-${Q}'`, pt = {
   baseUri: ["'self'"],
   connectSrc: ["'self'"],
   defaultSrc: ["'self'"],
@@ -1628,14 +1670,14 @@ const K = "{nonce}", Me = `'nonce-${K}'`, ft = {
   frameAncestors: ["'none'"],
   imgSrc: ["'self'", "data:", "blob:"],
   objectSrc: ["'none'"],
-  scriptSrc: [Me, "'strict-dynamic'"],
-  styleSrc: ["'self'", Me],
+  scriptSrc: [We, "'strict-dynamic'"],
+  styleSrc: ["'self'", We],
   upgradeInsecureRequests: !0
-}, en = {
-  ...ft,
+}, un = {
+  ...pt,
   scriptSrc: ["'self'"],
   styleSrc: ["'self'"]
-}, Ue = {
+}, ze = {
   contentTypeOptions: "nosniff",
   crossOriginOpenerPolicy: "same-origin",
   crossOriginResourcePolicy: "same-origin",
@@ -1646,43 +1688,43 @@ const K = "{nonce}", Me = `'nonce-${K}'`, ft = {
     maxAge: 31536e3,
     preload: !1
   }
-}, tn = {
+}, ln = {
   contentTypeOptions: "nosniff",
   crossOriginResourcePolicy: "same-origin",
   referrerPolicy: "strict-origin-when-cross-origin"
-}, D = {
+}, L = {
   api(e = {}) {
-    return O(
+    return I(
       {
-        headers: tn
+        headers: ln
       },
       e
     );
   },
   preset(e, t = {}) {
-    return e === "api" ? D.api(t) : e === "cross-origin-isolated" ? D.crossOriginIsolated(t) : e === "static" ? D.static(t) : D.strict(t);
+    return e === "api" ? L.api(t) : e === "cross-origin-isolated" ? L.crossOriginIsolated(t) : e === "static" ? L.static(t) : L.strict(t);
   },
   static(e = {}) {
-    return O(
+    return I(
       {
-        csp: en,
-        headers: Ue
+        csp: un,
+        headers: ze
       },
       e
     );
   },
   strict(e = {}) {
-    return O(
+    return I(
       {
-        csp: ft,
-        headers: Ue
+        csp: pt,
+        headers: ze
       },
       e
     );
   },
   crossOriginIsolated(e = {}) {
-    return O(
-      D.strict({
+    return I(
+      L.strict({
         headers: {
           crossOriginEmbedderPolicy: "require-corp",
           crossOriginOpenerPolicy: "same-origin"
@@ -1692,41 +1734,42 @@ const K = "{nonce}", Me = `'nonce-${K}'`, ft = {
     );
   }
 };
-function Ai(e) {
+function _o(e) {
   return e;
 }
-function Ci(e) {
+function Vo(e) {
   return e;
 }
-function rn(...e) {
-  return e.reduce((t, r) => r ? O(t, r) : t, {});
+function fn(...e) {
+  return e.reduce((t, r) => r ? I(t, r) : t, {});
 }
-function Y(...e) {
+function X(...e) {
   const t = e.reduce((r, n) => n ? {
-    document: rn(r.document, n.document),
-    security: nn(r.security, n.security)
+    document: fn(r.document, n.document),
+    security: dn(r.security, n.security)
   } : r, {});
   return {
     ...t,
-    document: on(t.document, t.security?.needs)
+    document: mn(t.document, t.security?.needs)
   };
 }
-function nn(...e) {
+function dn(...e) {
   return e.reduce((t, r) => r ? {
     csrf: r.csrf ?? t.csrf,
-    needs: sn(t.needs, r.needs),
+    fetchMetadata: r.fetchMetadata ?? t.fetchMetadata,
+    needs: hn(t.needs, r.needs),
     rateLimit: r.rateLimit ?? t.rateLimit,
-    request: mt(t.request, r.request)
+    request: wt(t.request, r.request)
   } : t, {});
 }
-const lt = [
+const gt = [
   { directive: "connectSrc", need: "connect" },
   { directive: "imgSrc", need: "img" },
   { directive: "scriptSrc", need: "script" }
 ];
-function sn(e, t) {
+function hn(e, t) {
   const r = {};
-  for (const { need: n } of lt) {
+  for (const { need: n } of gt) {
     const s = [.../* @__PURE__ */ new Set([
       ...e?.[n] ?? [],
       ...t?.[n] ?? []
@@ -1735,15 +1778,15 @@ function sn(e, t) {
   }
   return Object.keys(r).length > 0 ? r : void 0;
 }
-function on(e, t) {
+function mn(e, t) {
   if (!e?.csp || !t)
     return e;
   let r = e.csp;
-  for (const { directive: n, need: s } of lt)
-    r = an(r, n, s, t[s]);
+  for (const { directive: n, need: s } of gt)
+    r = pn(r, n, s, t[s]);
   return r === e.csp ? e : { ...e, csp: r };
 }
-function an(e, t, r, n) {
+function pn(e, t, r, n) {
   if (!n || n.length === 0)
     return e;
   if (e[t] === !1)
@@ -1760,89 +1803,89 @@ function an(e, t, r, n) {
     [t]: [.../* @__PURE__ */ new Set([...s, ...n])]
   } : e;
 }
-async function $i(e, t = "sha256") {
+async function Jo(e, t = "sha256") {
   const r = await globalThis.crypto.subtle.digest(
-    Rn(t),
+    $n(t),
     new TextEncoder().encode(e)
   );
-  return `'${t}-${vn(new Uint8Array(r))}'`;
+  return `'${t}-${kn(new Uint8Array(r))}'`;
 }
-function W(e, t = {}) {
-  e.csp && wn(e.csp), yn(e);
-  const r = new Headers(), n = e.csp !== !1 && e.csp ? hn(e.csp, t) : void 0, s = dn(e.trustedTypes), i = e.trustedTypes ? e.trustedTypes.mode === "report-only" : !1;
-  return w(
+function q(e, t = {}) {
+  e.csp && Pn(e.csp), An(e);
+  const r = new Headers(), n = e.csp !== !1 && e.csp ? bn(e.csp, t) : void 0, s = En(e.trustedTypes), o = e.trustedTypes ? e.trustedTypes.mode === "report-only" : !1;
+  return S(
     r,
     "content-security-policy",
-    Z(n, i ? void 0 : s)
-  ), w(
+    ee(n, o ? void 0 : s)
+  ), S(
     r,
     "content-security-policy-report-only",
-    i ? Z(s, pt(e.csp)) : void 0
-  ), ln(r, e.headers, t), r;
+    o ? ee(s, Et(e.csp)) : void 0
+  ), Sn(r, e.headers, t), r;
 }
-function ee(e) {
-  return !e || !e.csp ? !1 : q(e.csp).some(([, t]) => {
+function ne(e) {
+  return !e || !e.csp ? !1 : G(e.csp).some(([, t]) => {
     const r = x(t);
-    return Array.isArray(r) && r.some((n) => n.includes(K));
+    return Array.isArray(r) && r.some((n) => n.includes(Q));
   });
 }
-function dt() {
+function yt() {
   const e = new Uint8Array(16);
   return globalThis.crypto.getRandomValues(e), btoa(String.fromCharCode(...e));
 }
-function O(e, t) {
+function I(e, t) {
   return {
-    csp: un(e.csp, t.csp),
-    headers: cn(e.headers, t.headers),
+    csp: yn(e.csp, t.csp),
+    headers: gn(e.headers, t.headers),
     trustedTypes: t.trustedTypes ?? e.trustedTypes
   };
 }
-function cn(e, t) {
-  const r = mt(e, t);
+function gn(e, t) {
+  const r = wt(e, t);
   return !r || t?.reportingEndpoints === !1 || e?.reportingEndpoints && t?.reportingEndpoints && (r.reportingEndpoints = {
     ...e.reportingEndpoints,
     ...t.reportingEndpoints
   }), r;
 }
-function mt(e, t) {
+function wt(e, t) {
   return t ? {
     ...e ?? {},
     ...t
   } : e;
 }
-function un(e, t) {
+function yn(e, t) {
   if (t === !1)
     return !1;
   if (!t)
     return e;
   if (!e)
-    return ae(t);
-  const r = ae(e), n = ae(t), s = {
+    return ue(t);
+  const r = ue(e), n = ue(t), s = {
     ...r,
     ...n
   };
-  for (const [i, o] of q(t)) {
+  for (const [o, i] of G(t)) {
     const a = x(
-      r[i]
+      r[o]
     );
-    !be(o) && Array.isArray(a) && Array.isArray(o) && ht(
+    !Pe(i) && Array.isArray(a) && Array.isArray(i) && St(
       s,
-      i,
-      fn([...a, ...o])
+      o,
+      wn([...a, ...i])
     );
   }
   return s;
 }
-function ae(e) {
+function ue(e) {
   const t = { ...e };
-  for (const [r, n] of q(e))
-    be(n) && ht(t, r, n.replace);
+  for (const [r, n] of G(e))
+    Pe(n) && St(t, r, n.replace);
   return t;
 }
-function fn(e) {
+function wn(e) {
   return [...new Set(e)];
 }
-function ht(e, t, r) {
+function St(e, t, r) {
   if (!(t === "reportTo" || t === "upgradeInsecureRequests")) {
     if (t === "reportUri") {
       e.reportUri = r;
@@ -1851,87 +1894,96 @@ function ht(e, t, r) {
     e[t] = r;
   }
 }
-function ln(e, t, r) {
-  t && (w(e, "referrer-policy", t.referrerPolicy), w(e, "x-content-type-options", t.contentTypeOptions), w(e, "cross-origin-opener-policy", t.crossOriginOpenerPolicy), w(e, "cross-origin-embedder-policy", t.crossOriginEmbedderPolicy), w(e, "cross-origin-resource-policy", t.crossOriginResourcePolicy), w(e, "permissions-policy", t.permissionsPolicy), w(
+function Sn(e, t, r) {
+  t && (S(e, "referrer-policy", t.referrerPolicy), S(e, "x-content-type-options", t.contentTypeOptions), S(e, "cross-origin-opener-policy", t.crossOriginOpenerPolicy), S(e, "cross-origin-embedder-policy", t.crossOriginEmbedderPolicy), S(e, "cross-origin-resource-policy", t.crossOriginResourcePolicy), S(e, "permissions-policy", t.permissionsPolicy), S(
     e,
     "reporting-endpoints",
-    pn(t.reportingEndpoints)
+    Tn(t.reportingEndpoints)
   ), t.strictTransportSecurity && (!r.request || new URL(r.request.url).protocol === "https:") && e.set(
     "strict-transport-security",
-    mn(t.strictTransportSecurity)
+    Rn(t.strictTransportSecurity)
   ));
 }
-function dn(e) {
+function En(e) {
   if (!e)
     return;
   const t = [];
-  return e.requireFor?.includes("script") && t.push("require-trusted-types-for 'script'"), e.policies.length > 0 && t.push(`trusted-types ${e.policies.join(" ")}`), Z(...t);
+  return e.requireFor?.includes("script") && t.push("require-trusted-types-for 'script'"), t.push(vn(e)), ee(...t);
 }
-function Z(...e) {
+function vn(e) {
+  if (e.policies !== void 0 && e.policies.length === 0)
+    return "trusted-types 'none'";
+  const t = [Ft];
+  e.allowDefaultPolicy && t.push("default");
+  for (const r of e.policies ?? [])
+    t.push(r);
+  return `trusted-types ${[...new Set(t)].join(" ")}`;
+}
+function ee(...e) {
   const t = e.filter((r) => r);
   return t.length > 0 ? t.join("; ") : void 0;
 }
-function w(e, t, r) {
+function S(e, t, r) {
   r && e.set(t, r);
 }
-function mn(e) {
+function Rn(e) {
   const t = [`max-age=${e.maxAge}`];
   return e.includeSubDomains && t.push("includeSubDomains"), e.preload && t.push("preload"), t.join("; ");
 }
-function hn(e, t) {
+function bn(e, t) {
   const r = [];
-  for (const [s, i] of q(e)) {
+  for (const [s, o] of G(e)) {
     if (s === "reportTo" || s === "reportUri")
       continue;
-    const o = x(i);
-    if (o === !1 || o === void 0)
+    const i = x(o);
+    if (i === !1 || i === void 0)
       continue;
-    const a = gt(s);
-    if (o === !0) {
+    const a = vt(s);
+    if (i === !0 || s === "sandbox" && Array.isArray(i) && i.length === 0) {
       r.push(a);
       continue;
     }
     r.push(
-      `${a} ${En(o, t).join(" ")}`
+      `${a} ${Dn(i, t).join(" ")}`
     );
   }
-  const n = pt(e);
+  const n = Et(e);
   return n && r.push(n), r.join("; ");
 }
-function pt(e) {
+function Et(e) {
   if (!e)
     return;
   const t = [], r = x(e.reportUri);
-  return Array.isArray(r) && r.length && t.push(`report-uri ${r.join(" ")}`), e.reportTo && t.push(`report-to ${e.reportTo}`), Z(...t);
+  return Array.isArray(r) && r.length && t.push(`report-uri ${r.join(" ")}`), e.reportTo && t.push(`report-to ${e.reportTo}`), ee(...t);
 }
-function pn(e) {
+function Tn(e) {
   if (e)
-    return Object.entries(e).sort(([t], [r]) => t.localeCompare(r)).map(([t, r]) => `${t}="${gn(r)}"`).join(", ");
+    return Object.entries(e).sort(([t], [r]) => t.localeCompare(r)).map(([t, r]) => `${t}="${xn(r)}"`).join(", ");
 }
-function gn(e) {
+function xn(e) {
   return e.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
 }
-function yn(e) {
+function An(e) {
   const t = e.headers?.reportingEndpoints;
   if (t) {
     const s = Object.entries(t);
     if (s.length === 0)
       throw new Error("Demiurge Reporting-Endpoints requires at least one endpoint.");
-    for (const [i, o] of s)
-      He(i), je(o, `Reporting-Endpoints member ${JSON.stringify(i)}`);
+    for (const [o, i] of s)
+      Be(o), qe(i, `Reporting-Endpoints member ${JSON.stringify(o)}`);
   }
   const r = e.csp || void 0;
-  if (r?.reportTo && (He(r.reportTo), !t || !(r.reportTo in t)))
+  if (r?.reportTo && (Be(r.reportTo), !t || !(r.reportTo in t)))
     throw new Error(
       `Demiurge CSP report-to group ${JSON.stringify(r.reportTo)} is not defined in headers.reportingEndpoints.`
     );
   const n = x(r?.reportUri);
   for (const s of Array.isArray(n) ? n : [])
-    je(s, "CSP report-uri target");
+    qe(s, "CSP report-uri target");
 }
-function wn(e) {
-  for (const [t, r] of q(e)) {
-    const n = gt(t);
+function Pn(e) {
+  for (const [t, r] of G(e)) {
+    const n = vt(t);
     if (r === void 0)
       continue;
     if (t === "reportTo") {
@@ -1948,27 +2000,34 @@ function wn(e) {
         );
       continue;
     }
+    if (t === "sandbox") {
+      if (typeof r != "boolean" && (!Array.isArray(r) || !r.every((o) => typeof o == "string")))
+        throw new Error(
+          `Demiurge CSP directive ${JSON.stringify(n)} must be a boolean or a list of sandbox tokens.`
+        );
+      continue;
+    }
     const s = x(r);
-    if (s !== !1 && (!Array.isArray(s) || !s.every((i) => typeof i == "string")))
+    if (s !== !1 && (!Array.isArray(s) || !s.every((o) => typeof o == "string")))
       throw new Error(
         `Demiurge CSP directive ${JSON.stringify(n)} must be a source list, false, or a replacement object with a source list.`
       );
   }
 }
-function be(e) {
+function Pe(e) {
   return !!(e && typeof e == "object" && !Array.isArray(e) && "replace" in e);
 }
 function x(e) {
-  return be(e) ? e.replace : e;
+  return Pe(e) ? e.replace : e;
 }
-function He(e) {
+function Be(e) {
   if (!/^(?:[a-z]|\*)[a-z0-9_.*-]*$/.test(e))
     throw new Error(
       `Invalid reporting endpoint name ${JSON.stringify(e)}. Use a lowercase Structured Field key.`
     );
 }
-function je(e, t) {
-  if (!Sn(e) || /[\s,;"\\]/.test(e) || !e.startsWith("/") && !e.startsWith("https://"))
+function qe(e, t) {
+  if (!Cn(e) || /[\s,;"\\]/.test(e) || !e.startsWith("/") && !e.startsWith("https://"))
     throw new Error(`${t} must be a same-origin path or an HTTPS URL.`);
   if (e.startsWith("//"))
     throw new Error(`${t} must not be a scheme-relative URL.`);
@@ -1981,81 +2040,81 @@ function je(e, t) {
   if (r.username || r.password || r.hash)
     throw new Error(`${t} must not contain credentials or a fragment.`);
 }
-function Sn(e) {
+function Cn(e) {
   return /^[\x20-\x7e]+$/.test(e);
 }
-function q(e) {
+function G(e) {
   return Object.entries(e);
 }
-function En(e, t) {
+function Dn(e, t) {
   return e.map((r) => {
-    if (!r.includes(K))
+    if (!r.includes(Q))
       return r;
     if (!t.nonce)
       throw new Error("Demiurge security policy requires a CSP nonce.");
-    return r.replaceAll(K, t.nonce);
+    return r.replaceAll(Q, t.nonce);
   });
 }
-function gt(e) {
+function vt(e) {
   return e.replace(/[A-Z]/g, (t) => `-${t.toLowerCase()}`);
 }
-function Rn(e) {
+function $n(e) {
   return e === "sha384" ? "SHA-384" : e === "sha512" ? "SHA-512" : "SHA-256";
 }
-function vn(e) {
+function kn(e) {
   let t = "";
   for (const r of e)
     t += String.fromCharCode(r);
   return typeof btoa == "function" ? btoa(t) : Buffer.from(t, "binary").toString("base64");
 }
-function yt(e, t, r = {}) {
-  Te(e);
+function Rt(e, t, r = {}) {
+  Ce(e);
   const n = t.request.headers.get("origin"), s = new Headers();
-  if (e.origins !== "*" && wt(s, "Origin"), !n)
+  if (e.origins !== "*" && bt(s, "Origin"), !n)
     return s;
-  const i = xn(e, n);
-  if (!i)
+  const o = Ln(e, n);
+  if (!o)
     return s;
-  if (s.set("access-control-allow-origin", i), e.credentials && s.set("access-control-allow-credentials", "true"), e.exposeHeaders?.length && s.set("access-control-expose-headers", e.exposeHeaders.join(", ")), r.preflight) {
+  if (s.set("access-control-allow-origin", o), e.credentials && s.set("access-control-allow-credentials", "true"), e.exposeHeaders?.length && s.set("access-control-expose-headers", e.exposeHeaders.join(", ")), r.preflight) {
     s.set("access-control-allow-methods", r.methods.join(", "));
-    const o = t.request.headers.get(
+    const i = t.request.headers.get(
       "access-control-request-headers"
-    ), a = e.headers?.join(", ") ?? o;
+    ), a = e.headers?.join(", ") ?? i;
     a && s.set("access-control-allow-headers", a), e.maxAge !== void 0 && s.set("access-control-max-age", String(e.maxAge));
   }
   return s;
 }
-function V(e, t, r) {
+function U(e, t, r) {
   if (!t)
     return e;
   const n = new Headers(e.headers);
-  return Pn(n, yt(t, { request: r })), new Response(e.body, {
+  return Mn(n, Rt(t, { request: r })), new Response(e.body, {
     headers: n,
     status: e.status,
     statusText: e.statusText
   });
 }
-function bn(e, t) {
-  const r = t.headers.get("access-control-request-method"), n = An(r);
+function Nn(e, t) {
+  const r = t.headers.get("access-control-request-method"), n = In(r);
   if (!n)
     return null;
-  const s = St(e, n);
+  const s = Tt(e, n);
   if (!s?.cors)
     return null;
-  const i = s.cors.methods ?? Cn(e);
-  return i.includes(n) ? new Response(null, {
-    headers: yt(
+  const o = s.cors.methods ?? Un(e);
+  return o.includes(n) ? new Response(null, {
+    headers: Rt(
       s.cors,
       { request: t },
       {
-        methods: i,
+        methods: o,
         preflight: !0
       }
     ),
     status: 204
   }) : null;
 }
-function Te(e) {
+function Ce(e) {
   if (e.credentials && e.origins === "*")
     throw new Error(
       "Demiurge CORS policy cannot use wildcard origins with credentials."
@@ -2066,59 +2125,59 @@ function Te(e) {
     );
   if (e.origins !== "*")
     for (const t of e.origins)
-      Tn(t);
+      On(t);
   if (e.maxAge !== void 0 && (!Number.isSafeInteger(e.maxAge) || e.maxAge < 0))
     throw new Error(
       "Demiurge CORS maxAge must be a non-negative integer number of seconds."
     );
 }
-function Tn(e) {
+function On(e) {
   let t;
   try {
     t = new URL(e);
   } catch {
-    throw Fe(e);
+    throw Ge(e);
   }
   if (t.protocol !== "http:" && t.protocol !== "https:" || t.origin !== e)
-    throw Fe(e);
+    throw Ge(e);
 }
-function Fe(e) {
+function Ge(e) {
   return new Error(
     `Demiurge CORS origin ${JSON.stringify(e)} must be a canonical HTTP(S) origin without credentials, a path, query, or fragment.`
   );
 }
-function xn(e, t) {
+function Ln(e, t) {
   return e.origins === "*" ? "*" : e.origins.includes(t) ? t : null;
 }
-function Pn(e, t) {
+function Mn(e, t) {
   t.forEach((r, n) => {
     if (n === "vary" && e.has("vary")) {
       for (const s of r.split(","))
-        wt(e, s.trim());
+        bt(e, s.trim());
       return;
     }
     e.set(n, r);
   });
 }
-function wt(e, t) {
+function bt(e, t) {
   if (!t)
     return;
   const r = e.get("vary")?.split(",").map((n) => n.trim()).filter(Boolean) ?? [];
   r.some((n) => n.toLowerCase() === t.toLowerCase()) || e.set("vary", [...r, t].join(", "));
 }
-function An(e) {
+function In(e) {
   if (!e)
     return null;
   const t = e.toUpperCase();
-  return $n(t) ? t : null;
+  return Fn(t) ? t : null;
 }
-function St(e, t) {
-  return t === "HEAD" ? e.HEAD ?? We(e.GET) : We(e[t]);
+function Tt(e, t) {
+  return t === "HEAD" ? e.HEAD ?? _e(e.GET) : _e(e[t]);
 }
-function We(e) {
+function _e(e) {
   return e?.kind === "page" ? void 0 : e;
 }
-function Cn(e) {
+function Un(e) {
   return [
     "GET",
     "POST",
@@ -2127,25 +2186,25 @@ function Cn(e) {
     "DELETE",
     "OPTIONS",
     "HEAD"
-  ].filter((t) => St(e, t));
+  ].filter((t) => Tt(e, t));
 }
-function $n(e) {
+function Fn(e) {
   return e === "GET" || e === "POST" || e === "PUT" || e === "PATCH" || e === "DELETE" || e === "OPTIONS" || e === "HEAD";
 }
-const kn = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]);
-function Dn(e = {}) {
-  const t = [], r = e.document, n = r ? Ln(r.policy, r.headers, t) : {};
-  r && Nn(r.policy, t);
-  const s = e.route ? zn(e.route, t) : void 0;
-  return r?.scripts && (In(
+const Hn = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]);
+function jn(e = {}) {
+  const t = [], r = e.document, n = r ? Bn(r.policy, r.headers, t) : {};
+  r && Wn(r.policy, t);
+  const s = e.route ? Qn(e.route, t) : void 0;
+  return r?.scripts && (qn(
     r.policy.csp,
     r.scripts,
     r.headers,
     t
   ), r.scriptDependencies && t.push(
-    ...On(
+    ...zn(
       r.scripts,
-      Mn(r.scriptDependencies)
+      Gn(r.scriptDependencies)
     )
   )), {
     findings: t,
@@ -2153,21 +2212,21 @@ function Dn(e = {}) {
     route: s
   };
 }
-function Nn(e, t) {
+function Wn(e, t) {
   if (!e.trustedTypes || e.trustedTypes.mode !== "report-only")
     return;
-  const r = e.csp || void 0, n = !!he(r?.reportUri)?.length, s = e.headers?.reportingEndpoints, i = !!(r?.reportTo && s && s[r.reportTo]);
-  !n && !i && t.push({
+  const r = e.csp || void 0, n = !!ge(r?.reportUri)?.length, s = e.headers?.reportingEndpoints, o = !!(r?.reportTo && s && s[r.reportTo]);
+  !n && !o && t.push({
     code: "report-only-target-missing",
     message: "Trusted Types report-only mode has no deliverable target. Configure CSP reportTo with a matching Reporting-Endpoints member, reportUri for compatibility, or both.",
     severity: "warning"
   });
 }
-function On(e, t = {}) {
+function zn(e, t = {}) {
   const r = t.requirePurpose ?? !0, n = [];
   for (const s of e) {
-    const i = _n(s);
-    i && (r && !s.purpose && n.push({
+    const o = ts(s);
+    o && (r && !s.purpose && n.push({
       code: "script-purpose-missing",
       message: `Third-party script ${s.src} should declare a purpose for audits and consent flows.`,
       severity: "warning"
@@ -2179,7 +2238,7 @@ function On(e, t = {}) {
       code: "script-third-party-before-interactive",
       message: `Third-party script ${s.src} runs before the app is interactive and should be justified by policy.`,
       severity: "warning"
-    }), Vn(i) && n.push({
+    }), rs(o) && n.push({
       code: "script-gtm-wide-trust-boundary",
       message: "Google Tag Manager can load additional scripts at runtime and should be treated as a wide trust boundary.",
       severity: "warning"
@@ -2187,9 +2246,9 @@ function On(e, t = {}) {
   }
   return n;
 }
-function Ln(e, t, r) {
+function Bn(e, t, r) {
   try {
-    return Object.fromEntries(W(e, t));
+    return Object.fromEntries(q(e, t));
   } catch (n) {
     return r.push({
       code: "security-header-render-failed",
@@ -2198,71 +2257,71 @@ function Ln(e, t, r) {
     }), {};
   }
 }
-function In(e, t, r, n) {
+function qn(e, t, r, n) {
   if (!e)
     return;
-  const s = Un(e);
-  for (const i of t) {
-    if (Hn(s) && !i.nonce) {
+  const s = _n(e);
+  for (const o of t) {
+    if (Vn(s) && !o.nonce) {
       n.push({
         code: "csp-script-missing-nonce",
-        message: `Document script ${i.src} needs a nonce for the effective script-src policy.`,
+        message: `Document script ${o.src} needs a nonce for the effective script-src policy.`,
         severity: "error"
       });
       continue;
     }
-    i.nonce && r?.nonce && i.nonce === r.nonce || jn(s, i.src) || n.push({
+    o.nonce && r?.nonce && o.nonce === r.nonce || Jn(s, o.src) || n.push({
       code: "csp-script-src-blocked",
-      message: `Document script ${i.src} is not allowed by the effective script-src policy.`,
+      message: `Document script ${o.src} is not allowed by the effective script-src policy.`,
       severity: "error"
     });
   }
 }
-function Mn(e) {
+function Gn(e) {
   return typeof e == "boolean" ? {} : e;
 }
-function Un(e) {
-  return he(e.scriptSrc) ?? he(e.defaultSrc) ?? [];
+function _n(e) {
+  return ge(e.scriptSrc) ?? ge(e.defaultSrc) ?? [];
 }
-function he(e) {
+function ge(e) {
   if (e)
     return "replace" in e ? e.replace : e;
 }
-function Hn(e) {
+function Vn(e) {
   return e.some((t) => t.includes("'nonce-{nonce}'"));
 }
-function jn(e, t) {
-  return qn(e) ? !1 : e.includes("*") ? !0 : e.includes("'none'") || e.some((r) => r.startsWith("'nonce-")) ? !1 : e.includes("'self'") && Fn(t) || t.startsWith("https:") && e.includes("https:") || t.startsWith("http:") && e.includes("http:") ? !0 : e.some((r) => Wn(r, t));
+function Jn(e, t) {
+  return Zn(e) ? !1 : e.includes("*") ? !0 : e.includes("'none'") || e.some((r) => r.startsWith("'nonce-")) ? !1 : e.includes("'self'") && Kn(t) || t.startsWith("https:") && e.includes("https:") || t.startsWith("http:") && e.includes("http:") ? !0 : e.some((r) => Yn(r, t));
 }
-function Fn(e) {
+function Kn(e) {
   return e.startsWith("/") && !e.startsWith("//");
 }
-function Wn(e, t) {
+function Yn(e, t) {
   if (e.startsWith("'"))
     return !1;
   try {
-    const r = new URL(e), n = new URL(t), s = r.hostname.startsWith("*.") ? n.hostname.endsWith(r.hostname.slice(1)) && n.hostname !== r.hostname.slice(2) : n.hostname === r.hostname, i = r.pathname === "/" || r.pathname.endsWith("/") ? n.pathname.startsWith(r.pathname) : n.pathname === r.pathname;
-    return n.protocol === r.protocol && s && n.port === r.port && i;
+    const r = new URL(e), n = new URL(t), s = r.hostname.startsWith("*.") ? n.hostname.endsWith(r.hostname.slice(1)) && n.hostname !== r.hostname.slice(2) : n.hostname === r.hostname, o = r.pathname === "/" || r.pathname.endsWith("/") ? n.pathname.startsWith(r.pathname) : n.pathname === r.pathname;
+    return n.protocol === r.protocol && s && n.port === r.port && o;
   } catch {
     return !1;
   }
 }
-function qn(e) {
+function Zn(e) {
   return e.includes("'strict-dynamic'") && e.some(
     (t) => t.startsWith("'nonce-") || /^'sha(?:256|384|512)-/.test(t)
   );
 }
-function zn(e, t) {
-  return Bn(e.cors, t), Gn(e.method, e.security, t), {
+function Qn(e, t) {
+  return Xn(e.cors, t), es(e.method, e.security, t), {
     cors: e.cors,
     method: e.method,
     security: e.security
   };
 }
-function Bn(e, t) {
+function Xn(e, t) {
   if (e)
     try {
-      Te(e);
+      Ce(e);
     } catch (r) {
       t.push({
         code: "cors-invalid",
@@ -2271,8 +2330,8 @@ function Bn(e, t) {
       });
     }
 }
-function Gn(e, t, r) {
-  kn.has(e) && (t?.csrf === !1 && r.push({
+function es(e, t, r) {
+  Hn.has(e) && (t?.csrf === !1 && r.push({
     code: "csrf-disabled",
     message: "CSRF protection is explicitly disabled for this unsafe route.",
     severity: "info"
@@ -2286,7 +2345,7 @@ function Gn(e, t, r) {
     severity: "warning"
   }));
 }
-function _n(e) {
+function ts(e) {
   try {
     const t = new URL(e.src);
     if (t.protocol === "http:" || t.protocol === "https:")
@@ -2296,17 +2355,17 @@ function _n(e) {
   }
   return null;
 }
-function Vn(e) {
+function rs(e) {
   return e.hostname === "www.googletagmanager.com" && (e.pathname === "/gtm.js" || e.pathname === "/ns.html");
 }
-const Jn = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]), Kn = /^[!#$%&'*+\-.^_`|~A-Za-z0-9]+$/;
-function Yn() {
+const ns = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]), ss = /^[!#$%&'*+\-.^_`|~A-Za-z0-9]+$/;
+function os() {
   const e = new Uint8Array(32);
   return globalThis.crypto.getRandomValues(e), btoa(String.fromCharCode(...e)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
 }
-function Zn(e, t = {}) {
+function is(e, t = {}) {
   const r = t.cookie ?? "csrf-token";
-  if (!Kn.test(r))
+  if (!ss.test(r))
     throw new Error("Demiurge CSRF cookie name is invalid.");
   if (!e)
     throw new Error("Demiurge CSRF token must not be empty.");
@@ -2317,25 +2376,25 @@ function Zn(e, t = {}) {
   ];
   return (t.secure ?? !0) && n.push("Secure"), n.join("; ");
 }
-function ki(e = {}) {
-  const t = Yn();
+function Ko(e = {}) {
+  const t = os();
   return {
-    cookie: Zn(t, e),
+    cookie: is(t, e),
     token: t
   };
 }
-function Qn(e, t) {
-  if (!Jn.has(t.method.toUpperCase()) || e === !1)
+function as(e, t) {
+  if (!ns.has(t.method.toUpperCase()) || e === !1)
     return null;
   const r = t.headers.get("cookie");
   if (e === void 0 && !r?.trim())
     return null;
-  const n = es(e ?? !0), i = Xn(r).get(n.cookie), o = t.headers.get(n.header);
-  return !i || !o || !rs(i, o) ? new Response("Invalid CSRF token.", {
+  const n = us(e ?? !0), o = cs(r).get(n.cookie), i = t.headers.get(n.header);
+  return !o || !i || !fs(o, i) ? new Response("Invalid CSRF token.", {
     status: 403
   }) : null;
 }
-function Xn(e) {
+function cs(e) {
   const t = /* @__PURE__ */ new Map();
   if (!e)
     return t;
@@ -2343,12 +2402,12 @@ function Xn(e) {
     const n = r.indexOf("=");
     if (n === -1)
       continue;
-    const s = r.slice(0, n).trim(), i = r.slice(n + 1).trim();
-    s && t.set(s, ts(i));
+    const s = r.slice(0, n).trim(), o = r.slice(n + 1).trim();
+    s && t.set(s, ls(o));
   }
   return t;
 }
-function es(e) {
+function us(e) {
   return e === !0 ? {
     cookie: "csrf-token",
     header: "x-csrf-token"
@@ -2357,27 +2416,88 @@ function es(e) {
     header: e.header ?? "x-csrf-token"
   };
 }
-function ts(e) {
+function ls(e) {
   try {
     return decodeURIComponent(e);
   } catch {
     return e;
   }
 }
-function rs(e, t) {
+function fs(e, t) {
   let r = e.length ^ t.length;
   const n = Math.max(e.length, t.length);
   for (let s = 0; s < n; s += 1)
     r |= e.charCodeAt(s) ^ t.charCodeAt(s);
   return r === 0;
 }
-const ns = {
+const le = "Sec-Fetch-Dest", ds = "Sec-Fetch-Mode", hs = "Sec-Fetch-Site", ms = /* @__PURE__ */ new Set(["embed", "object"]), ps = /* @__PURE__ */ new Set(["GET", "HEAD"]), Ve = {
+  allowCrossSite: !1,
+  allowNavigation: !0,
+  allowSameSite: !1
+};
+function gs(e, t, r = t.method) {
+  const n = e === !0 ? Ve : { ...Ve, ...e }, s = [];
+  if (ws(t, r))
+    return { allowed: !0, reason: "cors-preflight", vary: s };
+  s.push(hs);
+  const o = t.headers.get("sec-fetch-site");
+  if (o === null)
+    return { allowed: !0, reason: "metadata-absent", vary: s };
+  if (o === "same-origin")
+    return { allowed: !0, reason: "same-origin", vary: s };
+  if (o === "none")
+    return { allowed: !0, reason: "user-initiated", vary: s };
+  if (o === "same-site" && n.allowSameSite)
+    return { allowed: !0, reason: "same-site-trusted", vary: s };
+  if (n.allowCrossSite)
+    return { allowed: !0, reason: "cross-site-exempt", vary: s };
+  const i = e === !0 ? void 0 : e.allowedDestinations;
+  if (i?.length && (s.push(le), i.includes(t.headers.get("sec-fetch-dest") ?? "")))
+    return { allowed: !0, reason: "destination-exempt", vary: s };
+  if (n.allowNavigation && ps.has(r.toUpperCase()) && (s.push(ds), t.headers.get("sec-fetch-mode") === "navigate")) {
+    const a = t.headers.get("sec-fetch-dest") ?? "";
+    if (s.includes(le) || s.push(le), !ms.has(a))
+      return { allowed: !0, reason: "top-level-navigation", vary: s };
+  }
+  return {
+    allowed: !1,
+    reason: o === "same-site" ? "same-site-denied" : "cross-site-denied",
+    vary: s
+  };
+}
+function ys(e, t, r = t.method) {
+  if (!e)
+    return { response: null, vary: [] };
+  const n = gs(e, t, r);
+  if (n.allowed)
+    return { response: null, vary: n.vary };
+  const s = new Response("Request blocked by the Fetch Metadata policy.", {
+    headers: { "content-type": "text/plain; charset=utf-8" },
+    status: 403
+  });
+  return xt(s, n.vary), { response: s, vary: n.vary };
+}
+function xt(e, t) {
+  if (t.length === 0)
+    return e;
+  const r = e.headers.get("vary")?.split(",").map((s) => s.trim()).filter(Boolean) ?? [];
+  if (r.includes("*"))
+    return e;
+  const n = [...r];
+  for (const s of t)
+    n.some((o) => o.toLowerCase() === s.toLowerCase()) || n.push(s);
+  return e.headers.set("vary", n.join(", ")), e;
+}
+function ws(e, t) {
+  return t.toUpperCase() === "OPTIONS" && e.headers.has("access-control-request-method");
+}
+const Ss = {
   h: 3600 * 1e3,
   m: 60 * 1e3,
   s: 1e3
-}, ss = 1e4;
-function Et(e = {}) {
-  const t = e.maximumEntries ?? ss;
+}, Es = 1e4;
+function At(e = {}) {
+  const t = e.maximumEntries ?? Es;
   if (!Number.isSafeInteger(t) || t <= 0)
     throw new Error(
       "Demiurge rate limit maximumEntries must be a positive integer."
@@ -2385,50 +2505,50 @@ function Et(e = {}) {
   const r = /* @__PURE__ */ new Map();
   let n = Number.POSITIVE_INFINITY;
   return {
-    increment(s, i, o) {
-      o >= n && (is(r, o), n = os(r));
+    increment(s, o, i) {
+      i >= n && (vs(r, i), n = Rs(r));
       const a = r.get(s);
-      if (!a || a.resetAt <= o) {
+      if (!a || a.resetAt <= i) {
         const c = {
           count: 1,
-          resetAt: o + i
+          resetAt: i + o
         };
-        return !a && r.size >= t && as(r), r.set(s, c), n = Math.min(n, c.resetAt), c;
+        return !a && r.size >= t && bs(r), r.set(s, c), n = Math.min(n, c.resetAt), { count: c.count, resetAt: c.resetAt };
       }
-      return a.count += 1, a;
+      return a.count += 1, { count: a.count, resetAt: a.resetAt };
     }
   };
 }
-function is(e, t) {
+function vs(e, t) {
   for (const [r, n] of e)
     n.resetAt <= t && e.delete(r);
 }
-function os(e) {
+function Rs(e) {
   let t = Number.POSITIVE_INFINITY;
   for (const r of e.values())
     t = Math.min(t, r.resetAt);
   return t;
 }
-function as(e) {
+function bs(e) {
   const t = e.keys().next().value;
   t !== void 0 && e.delete(t);
 }
-function cs(e, t, r, n = Date.now()) {
+async function Ts(e, t, r, n = Date.now()) {
   if (!e)
     return null;
-  xe(e);
-  const s = Rt(e.window), i = us(e, t), o = r.increment(i, s, n), a = Math.max(0, e.limit - o.count), c = new Headers({
-    "retry-after": String(Math.ceil(Math.max(0, o.resetAt - n) / 1e3)),
+  De(e);
+  const s = Pt(e.window), o = xs(e, t), i = await r.increment(o, s, n), a = Math.max(0, e.limit - i.count), c = new Headers({
+    "retry-after": String(Math.ceil(Math.max(0, i.resetAt - n) / 1e3)),
     "x-ratelimit-limit": String(e.limit),
     "x-ratelimit-remaining": String(a),
-    "x-ratelimit-reset": String(Math.ceil(o.resetAt / 1e3))
+    "x-ratelimit-reset": String(Math.ceil(i.resetAt / 1e3))
   });
-  return o.count > e.limit ? new Response("Rate limit exceeded.", {
+  return i.count > e.limit ? new Response("Rate limit exceeded.", {
     headers: c,
     status: 429
   }) : null;
 }
-function Rt(e) {
+function Pt(e) {
   if (typeof e == "number") {
     if (!Number.isSafeInteger(e) || e <= 0)
       throw new Error("Demiurge rate limit window must be a positive integer.");
@@ -2437,36 +2557,36 @@ function Rt(e) {
   const t = /^(\d+)(s|m|h)$/i.exec(e.trim());
   if (!t)
     throw new Error("Demiurge rate limit window must use an s/m/h suffix.");
-  const r = Number(t[1]), n = t[2].toLowerCase(), s = r * ns[n];
+  const r = Number(t[1]), n = t[2].toLowerCase(), s = r * Ss[n];
   if (!Number.isSafeInteger(s))
     throw new Error("Demiurge rate limit window is too large.");
   return s;
 }
-function xe(e) {
+function De(e) {
   if (!Number.isSafeInteger(e.limit) || e.limit <= 0)
     throw new Error("Demiurge rate limit limit must be a positive integer.");
-  Rt(e.window);
+  Pt(e.window);
 }
-function us(e, t) {
-  return `${fs(e.key)}:${ls(e.key, t)}`;
+function xs(e, t) {
+  return `${As(e.key)}:${Ps(e.key, t)}`;
 }
-function fs(e) {
+function As(e) {
   return typeof e == "string" ? e : `header:${e.header.toLowerCase()}`;
 }
-function ls(e, t) {
-  return e === "ip" ? ds(t) : t.headers.get(e.header) ?? "missing";
+function Ps(e, t) {
+  return e === "ip" ? Cs(t) : t.headers.get(e.header) ?? "missing";
 }
-function ds(e) {
-  return Dt(e)?.clientIp ?? "unknown";
+function Cs(e) {
+  return Ht(e)?.clientIp ?? "unknown";
 }
-const ms = {
+const Ds = {
   b: 1,
   gb: 1024 ** 3,
   kb: 1024,
   mb: 1024 ** 2
 };
-function hs(e, t, r) {
-  const n = gs(e, r);
+function $s(e, t, r) {
+  const n = Ns(e, r);
   if (n)
     return n;
   if (e?.maxBodySize === void 0)
@@ -2474,27 +2594,27 @@ function hs(e, t, r) {
   const s = t.headers.get("content-length");
   if (!s)
     return null;
-  const i = ys(s);
-  if (i === null)
+  const o = Os(s);
+  if (o === null)
     return new Response("Invalid Content-Length.", {
       status: 400
     });
-  const o = vt(e.maxBodySize);
-  return i > o ? new Response("Request body too large.", {
+  const i = Ct(e.maxBodySize);
+  return o > i ? new Response("Request body too large.", {
     status: 413
   }) : null;
 }
-class L extends Error {
+class F extends Error {
   constructor() {
     super("Demiurge request body exceeded maxBodySize while being read."), this.name = "RequestBodyTooLargeError";
   }
 }
-function ps(e, t) {
+function ks(e, t) {
   if (e?.maxBodySize === void 0 || t.body === null)
     return t;
-  const r = vt(e.maxBodySize), n = t.body.getReader();
+  const r = Ct(e.maxBodySize), n = t.body.getReader();
   let s = 0;
-  const i = new ReadableStream({
+  const o = new ReadableStream({
     async pull(a) {
       const c = await n.read();
       if (c.done) {
@@ -2502,7 +2622,7 @@ function ps(e, t) {
         return;
       }
       if (s += c.value.byteLength, s > r) {
-        const u = new L();
+        const u = new F();
         a.error(u);
         try {
           await n.cancel(u);
@@ -2518,24 +2638,24 @@ function ps(e, t) {
       } catch {
       }
     }
-  }), o = new Request(t, {
-    body: i,
+  }), i = new Request(t, {
+    body: o,
     duplex: "half"
   });
-  return Nt(t, o), o;
+  return jt(t, i), i;
 }
-function B() {
+function V() {
   return new Response("Request body too large.", { status: 413 });
 }
-function gs(e, t) {
-  return !e?.allowedMethods || ws(e.allowedMethods, t) ? null : new Response(null, {
+function Ns(e, t) {
+  return !e?.allowedMethods || Ls(e.allowedMethods, t) ? null : new Response(null, {
     headers: {
-      allow: Ss(e.allowedMethods)
+      allow: Ms(e.allowedMethods)
     },
     status: 405
   });
 }
-function vt(e) {
+function Ct(e) {
   if (typeof e == "number") {
     if (!Number.isSafeInteger(e) || e < 0)
       throw new Error("Demiurge request maxBodySize must be a non-negative integer.");
@@ -2546,25 +2666,25 @@ function vt(e) {
     throw new Error(
       "Demiurge request maxBodySize must use bytes or a b/kb/mb/gb suffix."
     );
-  const r = Number(t[1]), n = t[2].toLowerCase(), s = r * ms[n];
+  const r = Number(t[1]), n = t[2].toLowerCase(), s = r * Ds[n];
   if (!Number.isSafeInteger(s))
     throw new Error("Demiurge request maxBodySize is too large.");
   return s;
 }
-function ys(e) {
+function Os(e) {
   if (!/^\d+$/.test(e))
     return null;
   const t = Number(e);
   return Number.isSafeInteger(t) ? t : null;
 }
-function ws(e, t) {
+function Ls(e, t) {
   return e.includes(t) || t === "HEAD" && e.includes("GET");
 }
-function Ss(e) {
+function Ms(e) {
   const t = [...e];
   return t.includes("GET") && !t.includes("HEAD") && t.push("HEAD"), t.join(", ");
 }
-const Es = [
+const Is = [
   "GET",
   "POST",
   "PUT",
@@ -2573,15 +2693,15 @@ const Es = [
   "OPTIONS",
   "HEAD"
 ];
-function Rs(e, t = {}) {
+function Us(e, t = {}) {
   for (const [n, s] of Object.entries(e)) {
-    vs(n, s);
-    for (const i of Es) {
-      const o = s[i];
-      !o || o.kind === "page" || bs(n, i, o, s);
+    Fs(n, s);
+    for (const o of Is) {
+      const i = s[o];
+      !i || i.kind === "page" || Hs(n, o, i, s);
     }
   }
-  const r = et(
+  const r = ot(
     Object.fromEntries(
       Object.entries(e).map(([n, s]) => [
         n,
@@ -2589,53 +2709,53 @@ function Rs(e, t = {}) {
       ])
     )
   );
-  return As(r, e, t.adapter), r;
+  return Bs(r, e, t.adapter), r;
 }
-function vs(e, t) {
+function Fs(e, t) {
   const r = t.policy?.security?.rateLimit;
-  r && j(e, "policy", "rate limit", () => {
-    xe(r);
+  r && z(e, "policy", "rate limit", () => {
+    De(r);
   });
 }
-function bs(e, t, r, n) {
-  r.cors && j(e, t, "CORS", () => {
-    Te(r.cors), Ts(e, t, r.cors.methods, n);
-  }), r.security?.rateLimit && j(e, t, "rate limit", () => {
-    xe(r.security.rateLimit);
+function Hs(e, t, r, n) {
+  r.cors && z(e, t, "CORS", () => {
+    Ce(r.cors), js(e, t, r.cors.methods, n);
+  }), r.security?.rateLimit && z(e, t, "rate limit", () => {
+    De(r.security.rateLimit);
   });
 }
-function Ts(e, t, r, n) {
+function js(e, t, r, n) {
   if (r) {
     for (const s of r)
-      if (s !== "OPTIONS" && !xs(n, s))
+      if (s !== "OPTIONS" && !Ws(n, s))
         throw new Error(
           `Route ${JSON.stringify(e)} export ${t} allows CORS method ${s}, but the route does not export that response capability.`
         );
   }
 }
-function xs(e, t) {
+function Ws(e, t) {
   const r = t === "HEAD" ? e.HEAD ?? e.GET : e[t];
-  return Ps(r) ? r : void 0;
+  return zs(r) ? r : void 0;
 }
-function Ps(e) {
+function zs(e) {
   return !!(e && e.kind !== "page");
 }
-function As(e, t, r) {
+function Bs(e, t, r) {
   for (const s of e.routes) {
-    const i = t[s.file], o = i?.GET;
-    if (!o || o.kind !== "page")
+    const o = t[s.file], i = o?.GET;
+    if (!i || i.kind !== "page")
       continue;
-    const a = Y(
+    const a = X(
       ...e.policies.filter(
         (c) => T(c.fileSegments, s.fileSegments)
       ).map((c) => t[c.file]?.policy),
-      i.policy
+      o.policy
     );
-    qe(s.file, "GET", a, r), Os(
+    Je(s.file, "GET", a, r), Ks(
       s.file,
-      o.render.mode,
+      i.render.mode,
       a.document
-    ), Cs(
+    ), qs(
       s.file,
       "GET",
       a,
@@ -2643,7 +2763,7 @@ function As(e, t, r) {
         ...e.layouts.filter(
           (c) => T(c.fileSegments, s.fileSegments)
         ).map((c) => t[c.file]?.scripts),
-        i.scripts
+        o.scripts
       ]
     );
   }
@@ -2653,40 +2773,40 @@ function As(e, t, r) {
     ...e.fallbacks.notFound
   ];
   for (const s of n) {
-    const i = Y(
+    const o = X(
       ...e.policies.filter(
-        (o) => T(o.fileSegments, s.fileSegments)
-      ).map((o) => t[o.file]?.policy),
+        (i) => T(i.fileSegments, s.fileSegments)
+      ).map((i) => t[i.file]?.policy),
       t[s.file]?.policy
     );
-    qe(
+    Je(
       s.file,
       "policy",
-      i,
+      o,
       r
     );
   }
 }
-function Cs(e, t, r, n) {
+function qs(e, t, r, n) {
   const s = n.flatMap(
-    (l) => Array.isArray(l) ? l : []
+    (f) => Array.isArray(f) ? f : []
   );
   if (s.length === 0 || !r.document)
     return;
-  const i = "startup-verification-nonce", a = Dn({
+  const o = "startup-verification-nonce", a = jn({
     document: {
-      headers: { nonce: i },
+      headers: { nonce: o },
       policy: r.document,
-      scripts: s.map((l) => ({
-        ...l,
-        nonce: ee(r.document) ? i : l.nonce
+      scripts: s.map((f) => ({
+        ...f,
+        nonce: ne(r.document) ? o : f.nonce
       }))
     }
   }).findings.find(
-    (l) => l.code === "csp-script-src-blocked"
+    (f) => f.code === "csp-script-src-blocked"
   );
   if (!a) {
-    ks(
+    _s(
       e,
       t,
       r.document.csp,
@@ -2695,39 +2815,39 @@ function Cs(e, t, r, n) {
     return;
   }
   const c = s.find(
-    (l) => a.message.includes(l.src)
-  ), f = (W(r.document, { nonce: i }).get("content-security-policy") ?? "").split("; ").find(
-    (l) => l.startsWith("script-src ")
+    (f) => a.message.includes(f.src)
+  ), l = (q(r.document, { nonce: o }).get("content-security-policy") ?? "").split("; ").find(
+    (f) => f.startsWith("script-src ")
   ) ?? "default-src (script-src fallback)";
   throw new Error(
-    `Route ${JSON.stringify(e)} export ${t} declares script ${JSON.stringify(c?.src)} that violates the effective ${f} policy.`
+    `Route ${JSON.stringify(e)} export ${t} declares script ${JSON.stringify(c?.src)} that violates the effective ${l} policy.`
   );
 }
-const $s = [
+const Gs = [
   { directive: "connectSrc", name: "connect-src", need: "connect" },
   { directive: "imgSrc", name: "img-src", need: "img" }
 ];
-function ks(e, t, r, n) {
+function _s(e, t, r, n) {
   if (r)
     for (const s of n)
-      for (const { directive: i, name: o, need: a } of $s) {
+      for (const { directive: o, name: i, need: a } of Gs) {
         const c = s.needs?.[a] ?? [];
         if (c.length === 0)
           continue;
-        const u = H(r[i]) ?? H(r.defaultSrc);
+        const u = W(r[o]) ?? W(r.defaultSrc);
         if (u !== void 0) {
-          for (const f of c)
-            if (!(Array.isArray(u) && Ds(u, f)))
+          for (const l of c)
+            if (!(Array.isArray(u) && Vs(u, l)))
               throw new Error(
-                `Route ${JSON.stringify(e)} export ${t} declares script ${JSON.stringify(s.src)} that needs ${o} ${f}, which the effective policy does not allow. Add ${f} to security.needs.${a} or to csp.${i} for this route.`
+                `Route ${JSON.stringify(e)} export ${t} declares script ${JSON.stringify(s.src)} that needs ${i} ${l}, which the effective policy does not allow. Add ${l} to security.needs.${a} or to csp.${o} for this route.`
               );
         }
       }
 }
-function Ds(e, t) {
-  return e.includes("'none'") ? !1 : e.includes("*") || e.includes(t) ? !0 : t.startsWith("'") ? !1 : e.some((r) => Ns(r, t));
+function Vs(e, t) {
+  return e.includes("'none'") ? !1 : e.includes("*") || e.includes(t) ? !0 : t.startsWith("'") ? !1 : e.some((r) => Js(r, t));
 }
-function Ns(e, t) {
+function Js(e, t) {
   if (e.startsWith("'"))
     return !1;
   let r;
@@ -2752,18 +2872,18 @@ function Ns(e, t) {
   }
   return n.hostname === r.hostname;
 }
-function qe(e, t, r, n) {
-  j(e, t, "effective document", () => {
-    W(r.document ?? {}, {
+function Je(e, t, r, n) {
+  z(e, t, "effective document", () => {
+    q(r.document ?? {}, {
       nonce: "startup-verification-nonce"
     });
-  }), !(!n || !ee(r.document)) && j(e, t, "effective CSP", () => {
-    Ot(n, ["nonceInjection"]);
+  }), !(!n || !ne(r.document)) && z(e, t, "effective CSP", () => {
+    Wt(n, ["nonceInjection"]);
   });
 }
-function Os(e, t, r) {
+function Ks(e, t, r) {
   if (t === "static") {
-    const s = Ls(r?.csp);
+    const s = Ys(r?.csp);
     if (s)
       throw new Error(
         `Route ${JSON.stringify(e)} uses render mode "static" with an effective ${s} directive that depends on a CSP nonce. Use security.static() for static output or remove the nonce source from the document policy.`
@@ -2772,76 +2892,76 @@ function Os(e, t, r) {
   }
   if (t !== "streaming")
     return;
-  const n = Is(r?.csp);
-  if (!(!n || Ms(n.sources)))
+  const n = Zs(r?.csp);
+  if (!(!n || Qs(n.sources)))
     throw new Error(
       `Route ${JSON.stringify(e)} uses render mode "streaming" with an effective ${n.name} directive that does not allow React runtime inline payload scripts. Add a nonce placeholder or allow 'unsafe-inline' without nonce or hash sources.`
     );
 }
-function Ls(e) {
+function Ys(e) {
   if (e)
     for (const [t, r] of Object.entries(e)) {
-      const n = H(r);
-      if (Array.isArray(n) && n.some((s) => Us(s)))
-        return js(t);
+      const n = W(r);
+      if (Array.isArray(n) && n.some((s) => Xs(s)))
+        return to(t);
     }
 }
-function Is(e) {
+function Zs(e) {
   if (!e)
     return;
-  const t = H(e.scriptSrc);
+  const t = W(e.scriptSrc);
   if (Array.isArray(t))
     return { name: "script-src", sources: t };
-  const r = H(e.defaultSrc);
+  const r = W(e.defaultSrc);
   if (Array.isArray(r))
     return { name: "default-src", sources: r };
 }
-function Ms(e) {
-  return e.some((t) => bt(t)) ? !0 : e.includes("'unsafe-inline'") && !e.some((t) => Hs(t));
+function Qs(e) {
+  return e.some((t) => Dt(t)) ? !0 : e.includes("'unsafe-inline'") && !e.some((t) => eo(t));
 }
-function Us(e) {
-  return bt(e) || /^'nonce-[^']*'$/i.test(e);
+function Xs(e) {
+  return Dt(e) || /^'nonce-[^']*'$/i.test(e);
 }
-function bt(e) {
+function Dt(e) {
   return e.includes("{nonce}");
 }
-function Hs(e) {
+function eo(e) {
   return /^'(?:nonce-|sha256-|sha384-|sha512-)/i.test(e);
 }
-function H(e) {
+function W(e) {
   return e && typeof e == "object" && !Array.isArray(e) && "replace" in e ? e.replace : e;
 }
-function js(e) {
+function to(e) {
   return e.replace(/[A-Z]/g, (t) => `-${t.toLowerCase()}`);
 }
-function j(e, t, r, n) {
+function z(e, t, r, n) {
   try {
     n();
   } catch (s) {
     if (s instanceof Error && s.message.startsWith(`Route ${JSON.stringify(e)} export `))
       throw s;
-    const i = s instanceof Error ? s.message : `${r} validation failed.`;
+    const o = s instanceof Error ? s.message : `${r} validation failed.`;
     throw new Error(
-      `Route ${JSON.stringify(e)} export ${t} has an invalid ${r} policy. ${i}`,
+      `Route ${JSON.stringify(e)} export ${t} has an invalid ${r} policy. ${o}`,
       { cause: s }
     );
   }
 }
-function Fs(e) {
-  return J({
+function ro(e) {
+  return Z({
     instance: `${e.pathname}${e.search}`,
     status: 404,
     title: "Not Found"
   });
 }
-async function pe(e, t, r = {}) {
+async function ye(e, t, r = {}) {
   const n = new URL(t.url);
-  if (!at(t))
-    return Fs(n);
-  const s = await me(e, n.pathname, {
+  if (!dt(t))
+    return ro(n);
+  const s = await pe(e, n.pathname, {
     onLayoutError: (u) => r.onError?.(u, "page")
-  }), i = await Ws(e, n.pathname), o = r.nonce ?? (ee(i) ? dt() : void 0), a = qs(s, { ...r, nonce: o }), c = W(i ?? {}, {
-    nonce: o,
+  }), o = await no(e, n.pathname), i = r.nonce ?? (ne(o) ? yt() : void 0), a = so(s, { ...r, nonce: i }), c = q(o ?? {}, {
+    nonce: i,
     request: t
   });
   return c.set("content-type", "text/html; charset=utf-8"), new Response(
@@ -2852,55 +2972,55 @@ async function pe(e, t, r = {}) {
     }
   );
 }
-async function Ws(e, t) {
+async function no(e, t) {
   const r = await Promise.all(
-    nr(e, t).map((n) => n.load())
+    fr(e, t).map((n) => n.load())
   );
-  return Y(...r.map((n) => n.policy)).document;
+  return X(...r.map((n) => n.policy)).document;
 }
-function qs(e, t = {}) {
-  const r = e.notFound ?? Le;
+function so(e, t = {}) {
+  const r = e.notFound ?? He;
   try {
-    return ce(e, r, e.layouts, t);
+    return fe(e, r, e.layouts, t);
   } catch (n) {
     t.onError?.(n, "page");
   }
   try {
-    return ce(e, r, [], t);
+    return fe(e, r, [], t);
   } catch (n) {
     t.onError?.(n, "page");
   }
-  return ce(e, Le, [], t);
+  return fe(e, He, [], t);
 }
-function ce(e, t, r, n) {
+function fe(e, t, r, n) {
   const s = r.reduceRight(
-    (o, a) => fe(a, {
-      children: o,
+    (i, a) => de(a, {
+      children: i,
       path: {},
       pathname: e.pathname
     }),
-    fe(t, { pathname: e.pathname })
-  ), i = _e({
+    de(t, { pathname: e.pathname })
+  ), o = Qe({
     dev: n.dev,
     nonce: n.nonce
   });
-  return Je({
+  return et({
     body: {
       data: void 0,
       fallback: "not-found",
-      html: Ke(Ve(i, s)),
+      html: tt(Xe(o, s)),
       navigation: n.navigation
     },
     entrySrc: n.clientEntry,
     lang: n.lang,
     metadata: e.metadata,
     nonce: n.nonce,
-    scripts: i.scripts(),
+    scripts: o.scripts(),
     styles: n.styles,
     title: n.title
   });
 }
-const Tt = [
+const $t = [
   "GET",
   "POST",
   "PUT",
@@ -2908,12 +3028,12 @@ const Tt = [
   "DELETE",
   "OPTIONS",
   "HEAD"
-], xt = Et();
-function Di(e) {
-  e.routeModules && Rs(e.routeModules, { adapter: e.adapter });
-  const t = et(e.routes), r = e.rateLimitStore ?? Et();
-  return e.cacheStore && Ze(e.cacheStore.namespace), async function(s) {
-    return await zs(t, s, {
+], kt = At();
+function Yo(e) {
+  e.routeModules && Us(e.routeModules, { adapter: e.adapter });
+  const t = ot(e.routes), r = e.rateLimitStore ?? At();
+  return e.cacheStore && nt(e.cacheStore.namespace), async function(s) {
+    return await oo(t, s, {
       cacheStore: e.cacheStore,
       onError: e.onError,
       rateLimitStore: r,
@@ -2922,31 +3042,31 @@ function Di(e) {
     });
   };
 }
-async function zs(e, t, r = {
-  rateLimitStore: xt
+async function oo(e, t, r = {
+  rateLimitStore: kt
 }) {
-  const n = new URL(t.url), s = _s(n, r), i = st(t);
-  let o;
+  const n = new URL(t.url), s = co(n, r), o = ut(t);
+  let i;
   try {
-    o = F(e.routes, n.pathname);
+    i = B(e.routes, n.pathname);
   } catch (a) {
-    if (!(a instanceof Ee))
+    if (!(a instanceof Te))
       throw a;
-    const c = J({
+    const c = Z({
       instance: `${n.pathname}${n.search}`,
       status: 400,
       title: "Bad Request"
     });
-    return i ? z(c, ie) : c;
+    return o ? _(c, ae) : c;
   }
-  if (!o)
+  if (!i)
     try {
-      const a = await pe(
+      const a = await ye(
         e,
         t,
         s
       );
-      return i ? z(a, Oe) : a;
+      return o ? _(a, Fe) : a;
     } catch (a) {
       return s.onError(a, "page"), new Response("Not Found", {
         headers: { "content-type": "text/plain; charset=utf-8" },
@@ -2954,194 +3074,217 @@ async function zs(e, t, r = {
       });
     }
   try {
-    const a = await Bs(
+    const a = await io(
       e,
       t,
       n,
-      o,
+      i,
       r,
       s
     );
-    return i && !a.headers.has(C) ? z(
+    return o && !a.headers.has(C) ? _(
       a,
-      a.status === 404 ? Oe : ie
+      a.status === 404 ? Fe : ae
     ) : a;
   } catch (a) {
-    const c = await _(
+    const c = await Y(
       e,
       t,
       a,
       "middleware",
       s
     );
-    return i ? z(c, ie) : c;
+    return o ? _(c, ae) : c;
   }
 }
-async function Bs(e, t, r, n, s, i) {
-  const o = await n.route.load();
+async function io(e, t, r, n, s, o) {
+  const i = await n.route.load();
   if (t.method.toUpperCase() === "OPTIONS") {
-    const h = bn(o, t);
-    if (h)
-      return h;
+    const p = Nn(i, t);
+    if (p)
+      return p;
   }
-  const a = Ys(t.method);
+  const a = ho(t.method);
   if (!a)
-    return Ge(o);
-  const c = Zs(o, a);
+    return Ze(i);
+  const c = mo(i, a);
   if (!c)
-    return Ge(o);
-  const u = await Js(
+    return Ze(i);
+  const u = await lo(
     e,
     n.route,
-    o,
+    i,
     c
-  ), f = u.security, l = Qn(f?.csrf, t);
-  if (l)
-    return V(l, ue(c), t);
-  const m = cs(
-    f?.rateLimit,
+  ), l = u.security, f = ys(
+    l?.fetchMetadata,
     t,
-    s.rateLimitStore ?? xt
+    a
+  ), h = (p) => xt(p, f.vary);
+  if (f.response)
+    return h(
+      U(
+        f.response,
+        J(c),
+        t
+      )
+    );
+  const d = as(l?.csrf, t);
+  if (d)
+    return h(
+      U(d, J(c), t)
+    );
+  const D = await Ts(
+    l?.rateLimit,
+    t,
+    s.rateLimitStore ?? kt
   );
-  if (m)
-    return V(
-      m,
-      ue(c),
-      t
+  if (D)
+    return h(
+      U(
+        D,
+        J(c),
+        t
+      )
     );
-  const d = hs(
-    f?.request,
+  const $ = $s(
+    l?.request,
     t,
     a
   );
-  if (d)
-    return V(
-      d,
-      ue(c),
-      t
+  if ($)
+    return h(
+      U(
+        $,
+        J(c),
+        t
+      )
     );
-  t = ps(f?.request, t);
-  const P = {};
+  t = ks(l?.request, t);
+  const m = {};
   if (c.kind === "page") {
-    const h = {
+    const p = {
       path: n.path,
       pathname: r.pathname,
       request: t,
-      context: P,
+      context: m,
       search: r.searchParams,
       url: r
-    }, te = await ze(
+    }, Nt = await Ke(
       e,
       n.route
-    ), k = ee(u.document) ? dt() : void 0, Pt = Gs(s.cacheStore);
-    let E;
+    ), O = ne(u.document) ? yt() : void 0, Ot = ao(s.cacheStore);
+    let y;
     try {
-      E = await Be(te, h, async () => {
+      y = await Ye(Nt, p, async () => {
         try {
-          const p = await tt(
+          const g = await it(
             e,
             r.pathname,
             t,
             void 0,
-            Pt,
-            { requestContext: P }
+            Ot,
+            { requestContext: m }
           );
-          if (p.status !== "ready")
-            return await pe(e, t, {
-              ...i,
-              nonce: k
+          if (g.status !== "ready")
+            return await ye(e, t, {
+              ...o,
+              nonce: O
             });
-          if (st(t))
-            return pr(p.match.data);
-          if (p.match.render.mode === "streaming" && !s.renderPage)
+          if (ut(t))
+            return br(g.match.data);
+          if (g.match.render.mode === "streaming" && !s.renderPage)
             throw new Error(
               "Streaming page routes require an adapter renderer. Pass renderNodePageResponse from @demiurgejs/core/node as createRequestHandler({ renderPage })."
             );
-          return await (s.renderPage ?? Lt)(p.match, {
+          return await (s.renderPage ?? zt)(g.match, {
             ...s.ssr,
             dev: s.dev,
-            nonce: k,
-            onStreamError: (Ct) => {
-              s.onError?.(Ct, {
+            nonce: O,
+            onStreamError: (Mt) => {
+              s.onError?.(Mt, {
                 pathname: r.pathname,
                 site: "page"
               });
             },
             signal: t.signal
           });
-        } catch (p) {
-          return p instanceof L ? B() : await _(e, t, p, "page", {
-            ...i,
-            nonce: k
+        } catch (g) {
+          return g instanceof F ? V() : await Y(e, t, g, "page", {
+            ...o,
+            nonce: O
           });
         }
       });
-    } catch (p) {
-      if (!(p instanceof L))
-        throw p;
-      E = B();
+    } catch (g) {
+      if (!(g instanceof F))
+        throw g;
+      y = V();
     }
-    const At = W(u.document ?? {}, {
-      nonce: k,
+    const Lt = q(u.document ?? {}, {
+      nonce: O,
       request: t
     });
-    for (const [p, Pe] of At)
-      E.headers.set(p, Pe);
-    return k && E.headers.set("cache-control", "private, no-store"), a === "HEAD" ? (await E.body?.cancel(), new Response(null, {
-      headers: E.headers,
-      status: E.status
-    })) : E;
-  }
-  const $ = {
+    for (const [g, ke] of Lt)
+      y.headers.set(g, ke);
+    return O && y.headers.set("cache-control", "private, no-store"), h(y), a === "HEAD" ? (await y.body?.cancel(), new Response(null, {
+      headers: y.headers,
+      status: y.status
+    })) : y;
+  }
+  const k = {
     path: n.path,
     pathname: r.pathname,
     request: t,
-    context: P,
+    context: m,
     search: r.searchParams,
     url: r
-  }, g = await ze(
+  }, $e = await Ke(
     e,
     n.route
   );
-  let A;
+  let N;
   try {
-    A = await Be(g, $, async () => {
+    N = await Ye($e, k, async () => {
       try {
-        return c.kind === "not-found" && c.body === void 0 ? Vs(
-          await pe(e, t, i),
+        return c.kind === "not-found" && c.body === void 0 ? uo(
+          await ye(e, t, o),
           c.init
-        ) : await Rr(c, $);
-      } catch (h) {
-        return h instanceof L ? B() : await _(
+        ) : await Dr(c, k);
+      } catch (p) {
+        return p instanceof F ? V() : await Y(
           e,
           t,
-          h,
+          p,
           "route",
-          i
+          o
         );
       }
     });
-  } catch (h) {
-    if (!(h instanceof L))
-      throw h;
-    A = B();
+  } catch (p) {
+    if (!(p instanceof F))
+      throw p;
+    N = V();
   }
   try {
-    return Ks(A, c, t, a);
-  } catch (h) {
-    return await _(
-      e,
-      t,
-      h,
-      "route",
-      i
+    return h(
+      fo(N, c, t, a)
+    );
+  } catch (p) {
+    return h(
+      await Y(
+        e,
+        t,
+        p,
+        "route",
+        o
+      )
     );
   }
 }
-function Gs(e) {
-  return e ? Ye(e) : ge();
+function ao(e) {
+  return e ? rt(e) : we();
 }
-function _s(e, t) {
+function co(e, t) {
   return {
     ...t.ssr,
     dev: t.dev,
@@ -3151,12 +3294,12 @@ function _s(e, t) {
     transformDocument: t.transformDocument
   };
 }
-function Vs(e, t) {
+function uo(e, t) {
   if (!t)
     return e;
   const r = new Headers(e.headers), n = new Headers(t.headers);
-  for (const [s, i] of n)
-    s !== "set-cookie" && r.set(s, i);
+  for (const [s, o] of n)
+    s !== "set-cookie" && r.set(s, o);
   for (const s of n.getSetCookie())
     r.append("set-cookie", s);
   return new Response(e.body, {
@@ -3165,21 +3308,21 @@ function Vs(e, t) {
     statusText: t.statusText ?? e.statusText
   });
 }
-async function Js(e, t, r, n) {
+async function lo(e, t, r, n) {
   const s = await Promise.all(
     e.policies.filter(
-      (i) => T(i.fileSegments, t.fileSegments)
-    ).map((i) => i.load())
+      (o) => T(o.fileSegments, t.fileSegments)
+    ).map((o) => o.load())
   );
-  return Y(
-    ...s.map((i) => i.policy),
+  return X(
+    ...s.map((o) => o.policy),
     r.policy,
     {
-      security: n.kind === "page" ? void 0 : n.security
+      security: !n || n.kind === "page" ? void 0 : n.security
     }
   );
 }
-async function ze(e, t) {
+async function Ke(e, t) {
   return (await Promise.all(
     e.middlewares.filter(
       (n) => T(n.fileSegments, t.fileSegments)
@@ -3188,20 +3331,20 @@ async function ze(e, t) {
     (n) => n.middleware ? [n.middleware] : []
   );
 }
-async function Be(e, t, r) {
+async function Ye(e, t, r) {
   let n = -1;
-  async function s(i) {
-    if (i <= n)
+  async function s(o) {
+    if (o <= n)
       throw new Error("Demiurge route middleware next() called multiple times.");
-    n = i;
-    const o = e[i];
-    return o ? await o(t, () => s(i + 1)) : await r();
+    n = o;
+    const i = e[o];
+    return i ? await i(t, () => s(o + 1)) : await r();
   }
   return await s(0);
 }
-function Ks(e, t, r, n) {
-  const s = Dr(
-    V(e, t.cors, r),
+function fo(e, t, r, n) {
+  const s = Hr(
+    U(e, t.cors, r),
     t.timing
   );
   return n === "HEAD" ? new Response(null, {
@@ -3210,112 +3353,123 @@ function Ks(e, t, r, n) {
     statusText: s.statusText
   }) : s;
 }
-function ue(e) {
+function J(e) {
   return e.kind === "page" ? void 0 : e.cors;
 }
-function Ys(e) {
+function ho(e) {
   const t = e.toUpperCase();
-  return Tt.includes(t) ? t : null;
+  return $t.includes(t) ? t : null;
 }
-function Zs(e, t) {
+function mo(e, t) {
   return t === "HEAD" ? e.HEAD ?? e.GET : e[t];
 }
-function Ge(e) {
+function Ze(e) {
   return new Response(null, {
     headers: {
-      allow: Qs(e).join(", ")
+      allow: po(e).join(", ")
     },
     status: 405
   });
 }
-function Qs(e) {
-  const t = Tt.filter((r) => e[r]);
+function po(e) {
+  const t = $t.filter((r) => e[r]);
   return e.GET && !t.includes("HEAD") && t.push("HEAD"), t;
 }
 export {
-  hs as $,
-  hr as A,
-  Oe as B,
-  ie as C,
-  Pi as D,
-  Le as E,
-  ve as F,
-  it as G,
-  Ur as H,
-  On as I,
-  Ye as J,
-  yt as K,
-  Zn as L,
-  Yn as M,
+  is as $,
+  Wo as A,
+  Dr as B,
+  cs as C,
+  ks as D,
+  Ct as E,
+  Tr as F,
+  ko as G,
+  cr as H,
+  vr as I,
+  Rr as J,
+  Fe as K,
+  ae as L,
+  Te as M,
   C as N,
-  oi as O,
-  ge as P,
-  Ht as Q,
-  L as R,
-  Dn as S,
-  Me as T,
-  ai as U,
-  Ci as V,
-  Ai as W,
-  ii as X,
+  Gr as O,
+  Go as P,
+  He as Q,
+  F as R,
+  Ae as S,
+  A as T,
+  lt as U,
+  xt as V,
+  zn as W,
+  vo as X,
   gs as Y,
-  Qn as Z,
-  cs as _,
-  Rs as a,
-  Si as a0,
-  ki as a1,
-  gi as a2,
-  yi as a3,
-  ui as a4,
-  Y as a5,
-  nn as a6,
-  ci as a7,
-  Ri as a8,
-  Xn as a9,
-  Rt as aa,
-  ni as ab,
-  Ei as ac,
-  v as ad,
-  Ze as ae,
-  le as af,
-  xi as ag,
-  Ti as ah,
-  bi as ai,
-  fi as aj,
-  si as ak,
-  wi as al,
-  hi as am,
-  T as an,
-  pi as ao,
-  mi as ap,
-  ir as aq,
-  dr as ar,
-  X as as,
-  R as at,
-  li as b,
-  Di as c,
-  Et as d,
-  $i as e,
-  W as f,
-  xe as g,
-  zs as h,
-  dt as i,
-  F as j,
-  et as k,
-  $e as l,
-  rn as m,
-  vi as n,
-  ps as o,
-  U as p,
-  vt as q,
-  pe as r,
-  D as s,
-  Rr as t,
-  gr as u,
-  Te as v,
-  di as w,
-  tt as x,
-  er as y,
-  mr as z
+  rt as Z,
+  Rt as _,
+  Us as a,
+  os as a0,
+  xo as a1,
+  _t as a2,
+  We as a3,
+  Ao as a4,
+  Vo as a5,
+  _o as a6,
+  To as a7,
+  Ns as a8,
+  as as a9,
+  No as aA,
+  hr as aB,
+  Er as aC,
+  re as aD,
+  v as aE,
+  ys as aa,
+  Ts as ab,
+  $s as ac,
+  Fo as ad,
+  Ro as ae,
+  Ko as af,
+  Mo as ag,
+  Io as ah,
+  Co as ai,
+  X as aj,
+  dn as ak,
+  Po as al,
+  jo as am,
+  Pt as an,
+  Eo as ao,
+  Ho as ap,
+  R as aq,
+  nt as ar,
+  qo as as,
+  Bo as at,
+  zo as au,
+  Do as av,
+  bo as aw,
+  Uo as ax,
+  Oo as ay,
+  Lo as az,
+  $o as b,
+  Yo as c,
+  At as d,
+  Jo as e,
+  q as f,
+  De as g,
+  oo as h,
+  it as i,
+  T as j,
+  te as k,
+  lo as l,
+  fn as m,
+  B as n,
+  ne as o,
+  yt as p,
+  jn as q,
+  ye as r,
+  L as s,
+  mr as t,
+  we as u,
+  Ce as v,
+  he as w,
+  Le as x,
+  ot as y,
+  P as z
 };
-//# sourceMappingURL=testing-B_iMFYz_.js.map
+//# sourceMappingURL=testing-CRflAw4X.js.map