@demiurgejs/core 0.2.0-beta.2 → 0.2.0-beta.4

package/dist/index.js

@@ -1,211 +1,204 @@
-import { jsx as z } from "react/jsx-runtime";
-import { createContext as _, useState as T, useRef as I, useEffect as D, useMemo as V, createElement as f, useContext as W, Component as K } from "react";
-import { g as G, H as Z, h as N, i as Y, j as A } from "./chunks/request-metadata-D5NrT8ks.js";
-import { k as jt, l as Ft, m as Ht, d as Bt, n as qt, o as _t, q as Vt, t as Wt, u as Kt, p as Gt, a as Zt, v as Yt, w as Xt } from "./chunks/request-metadata-D5NrT8ks.js";
-import { p as C, l as X, n as J, t as Q, o as ee, R as te, q as $, u as re, k as M, w as ne, x as P, y as ae, N as O, z as ie, A as oe, B as se, C as ce, H as ue, D as le, E as fe, F as de } from "./chunks/testing-B_iMFYz_.js";
-import { G as Qt, I as er, J as tr, K as rr, L as nr, M as ar, O as ir, P as or, Q as sr, d as cr, c as ur, S as lr, f as fr, e as dr, T as mr, U as hr, V as pr, W as gr, X as wr, Y as yr, Z as vr, _ as br, $ as Sr, h as Er, a0 as Rr, a1 as Ar, a2 as xr, a3 as $r, a4 as kr, a5 as Tr, a6 as Ir, m as Dr, a7 as Nr, a8 as Cr, a9 as Or, aa as Lr, ab as zr, ac as Mr, ad as Pr, s as Ur, ae as jr, af as Fr, ag as Hr, ah as Br, ai as qr, aj as _r, ak as Vr, al as Wr, v as Kr, g as Gr, a as Zr } from "./chunks/testing-B_iMFYz_.js";
-import { k as me } from "./chunks/images-B9MqcjSA.js";
-import { d as Xr, l as Jr, m as Qr, n as en, f as tn, o as rn, q as nn, a as an, s as on, t as sn, b as cn, h as un, j as ln, r as fn } from "./chunks/images-B9MqcjSA.js";
+import { jsx as Et } from "react/jsx-runtime";
+import { createContext as We, useCallback as At, createElement as R, useContext as Je, useRef as k, useMemo as ae, useActionState as nr, useId as or, useLayoutEffect as ne, useState as U, useEffect as Y, Fragment as Te, Component as ir } from "react";
+import { g as ar, h as at, i as sr, H as cr, j as st, k as ur, l as lr, m as Me } from "./chunks/index-BVk9zWbe.js";
+import { F as oi, n as ii, o as ai, q as si, t as ci, d as ui, u as li, v as di, w as fi, x as hi, y as pi, z as mi, p as yi, a as gi, A as wi, B as vi } from "./chunks/index-BVk9zWbe.js";
+import { E as ct, C as dr, F as Ge, i as ee, G as fr, R as hr, H as Ye, I as Ze, J as Qe, K as pr, L as xt, N as mr, l as Xe, D as kt, O as Be, P as yr, r as gr, p as Rt, Q as wr, S as ut, T as vr, U as br, V as Sr, W as Er, X as Ar, Y as xr, Z as kr, _ as Rr } from "./chunks/testing-DueXbMo4.js";
+import { $ as Si, a0 as Ei, a1 as Ai, a2 as xi, a3 as ki, a4 as Ri, a5 as Ti, a6 as Mi, a7 as Ci, a8 as $i, a9 as Ni, aa as Li, ab as Ii, A as Di, ac as Pi, d as Oi, c as _i, z as Fi, k as Ui, j as Bi, ad as Hi, e as zi, ae as ji, af as Vi, ag as qi, ah as Ki, ai as Wi, aj as Ji, ak as Gi, al as Yi, am as Zi, h as Qi, an as Xi, ao as ea, ap as ta, aq as ra, ar as na, as as oa, g as ia, at as aa, au as sa, m as ca, av as ua, aw as la, ax as da, ay as fa, az as ha, aA as pa, aB as ma, aC as ya, aD as ga, s as wa, aE as va, B as ba, aF as Sa, aG as Ea, aH as Aa, aI as xa, aJ as ka, aK as Ra, aL as Ta, v as Ma, n as Ca, a as $a } from "./chunks/testing-DueXbMo4.js";
+import { I as Tr } from "./chunks/static-files-ehaD1kE7.js";
+import { D as La, c as Ia, i as Da } from "./chunks/static-files-ehaD1kE7.js";
+import { k as Mr } from "./chunks/images-BQ80950B.js";
+import { d as Oa, l as _a, m as Fa, n as Ua, f as Ba, o as Ha, q as za, a as ja, s as Va, t as qa, b as Ka, h as Wa, j as Ja, r as Ga } from "./chunks/images-BQ80950B.js";
+import { E as Za, d as Qa, a as Xa, e as es, r as ts, s as rs, b as ns, c as os, v as is } from "./chunks/env-startup-DOBYWlZD.js";
+import { c as ss, s as cs } from "./chunks/session-store-ChModVcq.js";
 import "react-dom/server";
-const he = "24h", pe = 1e4;
-function mt(e = {}) {
-  const t = e.now ?? Date.now, r = e.defaultTtl ?? he, n = e.maximumEntries ?? pe;
-  if (!Number.isSafeInteger(n) || n <= 0)
-    throw new Error(
-      "Demiurge idempotency maximumEntries must be a positive integer."
-    );
-  const a = C(r);
-  if (!Number.isFinite(a))
-    throw new Error("Demiurge idempotency defaultTtl must be finite.");
-  const i = /* @__PURE__ */ new Map();
+function xo(e) {
   return {
-    async run(s) {
-      const o = X(s.key), u = t();
-      ge(i, u);
-      const d = i.get(o);
-      if (d && (d.pending || d.expiresAt > u))
-        return {
-          key: o,
-          replayed: !0,
-          value: await d.value
-        };
-      if (i.size >= n && we(i), i.size >= n)
-        throw new Error(
-          "Demiurge idempotency store is at capacity with in-flight mutations."
-        );
-      const g = Promise.resolve().then(s.fn), c = {
-        expiresAt: Number.POSITIVE_INFINITY,
-        pending: !0,
-        value: g
-      };
-      i.set(o, c);
-      try {
-        const l = await g;
-        return c.pending = !1, c.expiresAt = t() + C(s.ttl ?? r), {
-          key: o,
-          replayed: !1,
-          value: l
-        };
-      } catch (l) {
-        throw i.get(o) === c && i.delete(o), l;
-      }
-    }
+    entries: e.map((t) => ({
+      ...t,
+      alternates: Cr(t.alternates ?? [])
+    }))
   };
 }
-function ge(e, t) {
-  for (const [r, n] of e)
-    !n.pending && n.expiresAt <= t && e.delete(r);
-}
-function we(e) {
-  for (const [t, r] of e)
-    if (!r.pending) {
-      e.delete(t);
-      return;
+function Cr(e) {
+  const t = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map();
+  for (const n of e) {
+    const o = n.hrefLang.toLowerCase();
+    let i;
+    try {
+      i = new URL(n.href).href;
+    } catch {
+      throw new Error(
+        `Sitemap alternate URL must be absolute: ${JSON.stringify(n.href)}.`
+      );
     }
+    const s = t.get(o), a = r.get(i);
+    if (s && s !== i)
+      throw new Error(`Sitemap language ${JSON.stringify(n.hrefLang)} has conflicting URLs.`);
+    if (a && a !== o && a !== "x-default" && o !== "x-default")
+      throw new Error(`Sitemap URL ${JSON.stringify(n.href)} has conflicting languages.`);
+    t.set(o, i), r.set(i, o);
+  }
+  return [...t].map(([n, o]) => ({ href: o, hrefLang: n }));
 }
-function ht(e, t) {
-  return e.run(t);
-}
-function pt(e) {
-  return {
-    entries: e
-  };
-}
-function gt(e) {
+function ko(e) {
   return [
     '<?xml version="1.0" encoding="UTF-8"?>',
     `<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"${e.entries.some((r) => r.alternates?.length) ? ' xmlns:xhtml="http://www.w3.org/1999/xhtml"' : ""}>`,
-    ...e.entries.map(ve),
+    ...e.entries.map(Nr),
     "</urlset>",
     ""
   ].join(`
 `);
 }
-function wt(e) {
+function Ro(e) {
   return e;
 }
-function yt(e) {
+function To(e) {
   return e;
 }
-function vt(e) {
+function Mo(e) {
   const t = [];
   for (const r of e.rules ?? []) {
-    for (const n of b(r.userAgent))
+    for (const n of de(r.userAgent))
       t.push(`User-agent: ${n}`);
-    for (const n of b(r.allow))
+    for (const n of de(r.allow))
       t.push(`Allow: ${n}`);
-    for (const n of b(r.disallow))
+    for (const n of de(r.disallow))
       t.push(`Disallow: ${n}`);
     t.push("");
   }
   e.host && t.push(`Host: ${e.host}`);
-  for (const r of b(e.sitemap))
+  for (const r of de(e.sitemap))
     t.push(`Sitemap: ${r}`);
   return `${t.join(`
 `).replace(/\n+$/, "")}
 `;
 }
-function ye(e) {
-  const t = e.width ?? 1200, r = e.height ?? 630, n = e.background ?? "#101820", a = e.foreground ?? "#ffffff", i = x(e.title, 120), s = e.subtitle ? x(e.subtitle, 160) : void 0, o = e.brand ? x(e.brand, 80) : void 0;
-  return Ee(t, r), [
-    `<svg xmlns="http://www.w3.org/2000/svg" width="${t}" height="${r}" viewBox="0 0 ${t} ${r}" role="img" aria-label="${p(i)}">`,
-    `  <rect width="100%" height="100%" fill="${p(n)}" />`,
-    o ? `  <text x="72" y="96" fill="${p(a)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="32" font-weight="700">${w(o)}</text>` : null,
-    `  <text x="72" y="${s ? 300 : 340}" fill="${p(a)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="76" font-weight="800">${w(i)}</text>`,
-    s ? `  <text x="72" y="392" fill="${p(a)}" fill-opacity="0.78" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="38" font-weight="500">${w(s)}</text>` : null,
+function $r(e) {
+  const t = e.width ?? 1200, r = e.height ?? 630, n = e.background ?? "#101820", o = e.foreground ?? "#ffffff", i = Ce(e.title, 120), s = e.subtitle ? Ce(e.subtitle, 160) : void 0, a = e.brand ? Ce(e.brand, 80) : void 0;
+  return Dr(t, r), [
+    `<svg xmlns="http://www.w3.org/2000/svg" width="${t}" height="${r}" viewBox="0 0 ${t} ${r}" role="img" aria-label="${j(i)}">`,
+    `  <rect width="100%" height="100%" fill="${j(n)}" />`,
+    a ? `  <text x="72" y="96" fill="${j(o)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="32" font-weight="700">${Q(a)}</text>` : null,
+    `  <text x="72" y="${s ? 300 : 340}" fill="${j(o)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="76" font-weight="800">${Q(i)}</text>`,
+    s ? `  <text x="72" y="392" fill="${j(o)}" fill-opacity="0.78" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="38" font-weight="500">${Q(s)}</text>` : null,
     "</svg>"
   ].filter((u) => !!u).join(`
 `);
 }
-function bt(e) {
-  return new Response(ye(e), {
+function Co(e) {
+  return new Response($r(e), {
     headers: {
-      "cache-control": "public, max-age=31536000, immutable",
+      "cache-control": Tr,
       "content-type": "image/svg+xml; charset=utf-8"
     }
   });
 }
-function ve(e) {
+function Nr(e) {
   return [
     "  <url>",
-    `    <loc>${w(e.url)}</loc>`,
-    e.lastModified ? `    <lastmod>${w(be(e.lastModified))}</lastmod>` : null,
+    `    <loc>${Q(e.url)}</loc>`,
+    e.lastModified ? `    <lastmod>${Q(Lr(e.lastModified))}</lastmod>` : null,
     e.changeFrequency ? `    <changefreq>${e.changeFrequency}</changefreq>` : null,
-    e.priority !== void 0 ? `    <priority>${Se(e.priority)}</priority>` : null,
+    e.priority !== void 0 ? `    <priority>${Ir(e.priority)}</priority>` : null,
     ...(e.alternates ?? []).map(
-      (t) => `    <xhtml:link rel="alternate" hreflang="${p(t.hrefLang)}" href="${p(t.href)}" />`
+      (t) => `    <xhtml:link rel="alternate" hreflang="${j(t.hrefLang)}" href="${j(t.href)}" />`
     ),
     "  </url>"
   ].filter((t) => !!t).join(`
 `);
 }
-function be(e) {
+function Lr(e) {
   return e instanceof Date ? e.toISOString() : e;
 }
-function Se(e) {
+function Ir(e) {
   if (e < 0 || e > 1)
     throw new Error("Sitemap entry priority must be between 0 and 1.");
   return String(e);
 }
-function b(e) {
+function de(e) {
   return e === void 0 ? [] : Array.isArray(e) ? e : [e];
 }
-function w(e) {
+function Q(e) {
   return e.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
-function p(e) {
-  return w(e).replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+function j(e) {
+  return Q(e).replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 }
-function x(e, t) {
+function Ce(e, t) {
   return e.length > t ? `${e.slice(0, t - 3)}...` : e;
 }
-function Ee(e, t) {
+function Dr(e, t) {
   if (!Number.isSafeInteger(e) || e <= 0)
     throw new Error("OG image width must be a positive integer.");
   if (!Number.isSafeInteger(t) || t <= 0)
     throw new Error("OG image height must be a positive integer.");
 }
-function St(e) {
-  return J(
-    async (t) => {
-      const r = e.input ? await e.input(t) : void 0, n = {
-        ...t,
-        input: r
-      }, a = async () => await Re(
-        await e.handler(n),
-        t
-      );
-      if (!e.idempotency)
-        return await a();
-      const i = typeof e.idempotency.key == "function" ? e.idempotency.key(n) : e.idempotency.key;
-      return (await e.idempotency.store.run({
-        fn: a,
-        key: i,
-        ttl: e.idempotency.ttl
-      })).value;
-    },
-    {
-      cors: e.cors,
-      security: e.security,
-      timing: e.timing
+const Pr = "24h", Or = 1e4;
+function $o(e = {}) {
+  const t = e.now ?? Date.now, r = e.defaultTtl ?? Pr, n = e.maximumEntries ?? Or;
+  if (!Number.isSafeInteger(n) || n <= 0)
+    throw new Error(
+      "Demiurge idempotency maximumEntries must be a positive integer."
+    );
+  const o = ct(r);
+  if (!Number.isFinite(o))
+    throw new Error("Demiurge idempotency defaultTtl must be finite.");
+  const i = /* @__PURE__ */ new Map();
+  return {
+    async run(s) {
+      const a = dr(s.key), u = t();
+      _r(i, u);
+      const d = i.get(a);
+      if (d && (d.pending || d.expiresAt > u)) {
+        const h = await d.value;
+        return {
+          key: a,
+          replayed: !0,
+          value: lt(h)
+        };
+      }
+      if (i.size >= n && Fr(i), i.size >= n)
+        throw new Error(
+          "Demiurge idempotency store is at capacity with in-flight mutations."
+        );
+      const v = Promise.resolve().then(s.fn), A = {
+        expiresAt: Number.POSITIVE_INFINITY,
+        pending: !0,
+        value: v
+      };
+      i.set(a, A);
+      try {
+        const h = await v;
+        return A.pending = !1, A.expiresAt = t() + ct(s.ttl ?? r), {
+          key: a,
+          replayed: !1,
+          value: lt(h)
+        };
+      } catch (h) {
+        throw i.get(a) === A && i.delete(a), h;
+      }
     }
-  );
+  };
 }
-const Et = {
-  async formData({ request: e }) {
-    return await e.formData();
-  },
-  async json({ request: e }) {
-    return await e.json();
-  },
-  async text({ request: e }) {
-    return await e.text();
-  }
-};
-async function Re(e, t) {
-  return e instanceof Response ? e : await Q(e, t);
+function lt(e) {
+  return e instanceof Response ? e.clone() : e;
+}
+function _r(e, t) {
+  for (const [r, n] of e)
+    !n.pending && n.expiresAt <= t && e.delete(r);
+}
+function Fr(e) {
+  for (const [t, r] of e)
+    if (!r.pending) {
+      e.delete(t);
+      return;
+    }
 }
-function Rt(e) {
+function No(e, t) {
+  return e.run(t);
+}
+function Lo(e) {
   return typeof e == "function" ? {
     kind: "page",
     render: { mode: "ssr" },
@@ -218,10 +211,10 @@ function Rt(e) {
     view: e.view
   };
 }
-function At(e) {
+function Io(e) {
   return e;
 }
-const xt = {
+const Do = {
   hmac(e) {
     return {
       kind: "response",
@@ -229,7 +222,7 @@ const xt = {
         const r = new Uint8Array(await t.request.arrayBuffer()), n = t.request.headers.get(
           e.header ?? "x-webhook-signature"
         );
-        return n ? await Ae(r, n, e) ? await e.handler({
+        return n ? await Ur(r, n, e) ? await e.handler({
           ...t,
           rawBody: r,
           text: () => new TextDecoder().decode(r)
@@ -245,15 +238,15 @@ const xt = {
     };
   }
 };
-async function Ae(e, t, r) {
-  const n = r.algorithm ?? "SHA-256", a = r.encoding ?? "hex", i = xe(
+async function Ur(e, t, r) {
+  const n = r.algorithm ?? "SHA-256", o = r.encoding ?? "hex", i = Br(
     t,
     n,
     r.prefix
-  ), s = $e(i, a);
+  ), s = Hr(i, o);
   if (!s)
     return !1;
-  const o = await globalThis.crypto.subtle.importKey(
+  const a = await globalThis.crypto.subtle.importKey(
     "raw",
     new TextEncoder().encode(r.secret),
     {
@@ -265,16 +258,16 @@ async function Ae(e, t, r) {
   );
   return await globalThis.crypto.subtle.verify(
     "HMAC",
-    o,
+    a,
     s,
     Uint8Array.from(e).buffer
   );
 }
-function xe(e, t, r) {
-  const n = e.trim(), a = r === void 0 ? `${t.toLowerCase().replace("-", "")}=` : r;
-  return a !== !1 && n.startsWith(a) ? n.slice(a.length).trim() : n;
+function Br(e, t, r) {
+  const n = e.trim(), o = r === void 0 ? `${t.toLowerCase().replace("-", "")}=` : r;
+  return o !== !1 && n.startsWith(o) ? n.slice(o.length).trim() : n;
 }
-function $e(e, t) {
+function Hr(e, t) {
   if (t === "hex")
     return /^(?:[0-9a-f]{2})+$/i.test(e) ? Uint8Array.from(
       e.match(/.{2}/g) ?? [],
@@ -291,136 +284,637 @@ function $e(e, t) {
     return null;
   }
 }
-class ke extends Error {
-  issues;
-  constructor(t) {
-    super(Le(t)), this.name = "EnvValidationError", this.issues = t;
+const zr = /^[!#$%&'*+\-.^_`|~A-Za-z0-9]+$/, jr = {
+  host: "__Host-",
+  none: "",
+  secure: "__Secure-"
+}, dt = 4096;
+function ce(e, t = "host") {
+  return `${jr[t]}${e}`;
+}
+function Vr(e) {
+  const t = e.scope ?? "host", r = ce(e.name, t), n = [], o = (i, s) => {
+    n.push({ code: i, message: s, name: r });
+  };
+  if (zr.test(e.name) || o(
+    "cookie-name-invalid",
+    `Cookie name ${JSON.stringify(e.name)} contains a character that a cookie name cannot hold. Use letters, digits, or the token characters that RFC 6265 allows.`
+  ), (e.name.startsWith("__Host-") || e.name.startsWith("__Secure-")) && o(
+    "cookie-name-carries-prefix",
+    `Cookie name ${JSON.stringify(e.name)} already carries a prefix. Remove the prefix from name and declare scope ${JSON.stringify(t === "none" ? "host" : t)} instead.`
+  ), t !== "none" && e.secure === !1 && o(
+    "cookie-scope-requires-secure",
+    `Cookie ${r} uses scope ${JSON.stringify(t)}, so it requires Secure. Remove secure: false, or declare scope "none" for a cookie that a browser must accept over plain HTTP.`
+  ), t === "host" && e.domain !== void 0 && o(
+    "cookie-domain-not-allowed",
+    `Cookie ${r} uses scope "host", so it cannot carry a Domain attribute. Remove domain, or declare scope "secure" to share the cookie with subdomains.`
+  ), t === "host" && e.path !== void 0 && e.path !== "/" && o(
+    "cookie-path-not-allowed",
+    `Cookie ${r} uses scope "host", so it requires Path=/. Remove path, or declare scope "secure" for a cookie that a path must limit.`
+  ), e.sameSite === "None" && e.secure === !1 && o(
+    "cookie-same-site-none-requires-secure",
+    `Cookie ${r} declares SameSite=None, so it requires Secure. Remove secure: false, or declare a SameSite policy of "Lax" or "Strict".`
+  ), e.maxAge !== void 0 && (!Number.isInteger(e.maxAge) || e.maxAge < 0) && o(
+    "cookie-max-age-invalid",
+    `Cookie ${r} declares maxAge ${JSON.stringify(e.maxAge)}. Use a whole number of seconds that is zero or greater.`
+  ), n.length === 0) {
+    const i = new TextEncoder().encode(Tt(e, t, r)).length;
+    i > dt && o(
+      "cookie-too-large",
+      `Cookie ${r} serializes to ${i} bytes, and a browser drops a cookie above ${dt} bytes. Store the payload on the server and keep an identifier in the cookie.`
+    );
   }
+  return n;
 }
-function $t(e) {
-  return e;
+function Po(e, t = "host") {
+  if (typeof document > "u")
+    return;
+  const r = typeof e == "string" ? { name: e, scope: t } : e;
+  return Ge(document.cookie).get(
+    ce(r.name, r.scope ?? "host")
+  );
 }
-function kt(e, t) {
-  const r = [], n = {};
-  for (const a of Object.keys(e)) {
-    const i = e[a], s = t[String(a)];
-    if (s === void 0 || s === "") {
-      if (i.optional) {
-        n[a] = void 0;
-        continue;
-      }
-      r.push({
-        code: "missing",
-        key: String(a),
-        message: `Environment variable ${String(a)} is required.`
-      });
-      continue;
-    }
-    try {
-      n[a] = i.parse(String(a), s);
-    } catch (o) {
-      r.push({
-        code: "invalid",
-        key: String(a),
-        message: o instanceof Error ? o.message : `Environment variable ${String(a)} is invalid.`
-      });
+function Se(e) {
+  const t = Vr(e);
+  if (t.length > 0)
+    throw new Error(
+      `Demiurge rejected a cookie declaration. ${t.map((n) => n.message).join(" ")}`
+    );
+  const r = e.scope ?? "host";
+  return Tt(e, r, ce(e.name, r));
+}
+function Tt(e, t, r) {
+  const n = [`${r}=${encodeURIComponent(e.value)}`], o = t === "host" ? "/" : e.path ?? "/";
+  return n.push(`Path=${o}`), t !== "host" && e.domain !== void 0 && n.push(`Domain=${e.domain}`), e.expires && n.push(`Expires=${e.expires.toUTCString()}`), e.maxAge !== void 0 && n.push(`Max-Age=${e.maxAge}`), n.push(`SameSite=${e.sameSite ?? "Lax"}`), (e.httpOnly ?? !0) && n.push("HttpOnly"), (t !== "none" || (e.secure ?? !0)) && n.push("Secure"), n.join("; ");
+}
+const qr = 10080 * 60 * 1e3, Kr = 1440 * 60 * 1e3, ft = 32;
+function Oo(e) {
+  const t = Ct(e);
+  return Mt(t, Jr(t.keys));
+}
+function _o(e) {
+  const t = Ct(e);
+  for (const r of t.keys)
+    if (r.value.byteLength !== 32)
+      throw new Error(
+        `Demiurge encrypted cookie session key ${JSON.stringify(r.id)} must contain exactly 32 bytes for AES-256-GCM.`
+      );
+  return Mt(
+    t,
+    Gr(t.keys, t.randomBytes)
+  );
+}
+function Mt(e, t) {
+  const r = ce(
+    e.cookie.name,
+    e.cookie.scope ?? "host"
+  );
+  return {
+    cookieName: r,
+    async open(n) {
+      const o = Ge(n.headers.get("cookie") ?? "").get(r), i = e.now(), s = o ? await t.decode(o) : void 0;
+      let a = s?.record, u = !!(o && !s), d = !!(s && !s.currentKey);
+      a && Zr(a, i) ? (a = void 0, u = !0, d = !1) : a && e.renewal && e.idleExpirationMs !== !1 && a.idleExpiresAt !== void 0 && a.idleExpiresAt - i <= e.idleExpirationMs / 4 && (a = {
+        ...a,
+        idleExpiresAt: Math.min(
+          a.expiresAt,
+          i + e.idleExpirationMs
+        ),
+        version: a.version + 1
+      }, d = !0);
+      const v = () => {
+        if (!a)
+          throw new Error(
+            "Demiurge cannot change a session that does not exist. Create the session first."
+          );
+        return a;
+      }, A = (h) => (a = Le(h), u = !1, d = !0, Le(h));
+      return {
+        async commit() {
+          return u ? [Qr(e.cookie)] : !a || !d ? [] : [Se({
+            ...e.cookie,
+            expires: new Date(a.expiresAt),
+            value: await t.encode(a)
+          })];
+        },
+        create(h, p = {}) {
+          if (a)
+            throw new Error(
+              "Demiurge cannot create a session when one already exists. Rotate or update the current session."
+            );
+          const E = e.now(), g = et(
+            "absoluteExpirationMs",
+            p.absoluteExpirationMs ?? e.absoluteExpirationMs
+          ), b = p.idleExpirationMs === void 0 ? e.idleExpirationMs : $t(p.idleExpirationMs), m = E + g;
+          return A({
+            createdAt: E,
+            data: Ne(h),
+            expiresAt: m,
+            id: pt(e.randomBytes),
+            ...b === !1 ? {} : {
+              idleExpiresAt: Math.min(
+                m,
+                E + b
+              )
+            },
+            version: 0
+          });
+        },
+        destroy() {
+          a = void 0, u = !0, d = !1;
+        },
+        get() {
+          return a ? Le(a) : void 0;
+        },
+        rotate(h) {
+          const p = v();
+          return A({
+            ...p,
+            data: h === void 0 ? p.data : Ne(h),
+            id: pt(e.randomBytes),
+            version: p.version + 1
+          });
+        },
+        update(h) {
+          const p = v();
+          return A({
+            ...p,
+            data: Ne(h),
+            version: p.version + 1
+          });
+        }
+      };
     }
-  }
-  if (r.length)
-    throw new ke(r);
-  return n;
+  };
 }
-function Te(e = {}) {
-  return y(e, !1, (t, r) => {
-    if (r === "true" || r === "1")
-      return !0;
-    if (r === "false" || r === "0")
-      return !1;
-    throw new Error(`Environment variable ${t} must be true, false, 1, or 0.`);
-  });
+function Ct(e) {
+  const t = Wr(e.keys), r = et(
+    "absoluteExpirationMs",
+    e.absoluteExpirationMs ?? qr
+  ), n = $t(
+    e.idleExpirationMs ?? Kr
+  );
+  return {
+    absoluteExpirationMs: r,
+    cookie: { ...e.cookie, name: e.cookie?.name ?? "session" },
+    idleExpirationMs: n,
+    keys: t,
+    now: e.now ?? Date.now,
+    randomBytes: e.randomBytes ?? Xr,
+    renewal: e.renewal ?? !0
+  };
 }
-function Ie(e, t = {}) {
-  return y(t, !1, (r, n) => {
-    if (e.includes(n))
-      return n;
+function Wr(e) {
+  if (e.length === 0)
     throw new Error(
-      `Environment variable ${r} must be one of: ${e.join(", ")}.`
+      "Demiurge cookie sessions require at least one key. Put the current key first."
     );
-  });
-}
-function De(e = {}) {
-  return y(e, !1, (t, r) => {
-    if (!/^-?\d+$/.test(r))
-      throw new Error(`Environment variable ${t} must be an integer.`);
-    const n = Number(r);
-    if (!Number.isSafeInteger(n))
-      throw new Error(`Environment variable ${t} must be a safe integer.`);
-    if (e.min !== void 0 && n < e.min)
+  const t = /* @__PURE__ */ new Set();
+  for (const r of e) {
+    if (!/^[A-Za-z0-9_-]+$/.test(r.id))
       throw new Error(
-        `Environment variable ${t} must be greater than or equal to ${e.min}.`
+        "Demiurge cookie session key identifiers can use only letters, digits, underscores, and hyphens."
       );
-    if (e.max !== void 0 && n > e.max)
+    if (t.has(r.id))
       throw new Error(
-        `Environment variable ${t} must be less than or equal to ${e.max}.`
+        `Demiurge cookie session key identifier ${JSON.stringify(r.id)} is not unique.`
       );
-    return n;
-  });
+    if (r.value.byteLength < 32)
+      throw new Error(
+        `Demiurge cookie session key ${JSON.stringify(r.id)} must contain at least 32 bytes.`
+      );
+    t.add(r.id);
+  }
+  return [...e];
 }
-function Ne(e = {}) {
-  return y(
-    e,
-    !0,
-    (t, r) => U(t, r, e)
-  );
+function et(e, t) {
+  if (!Number.isSafeInteger(t) || t <= 0)
+    throw new Error(
+      `Demiurge cookie session ${e} must be a positive whole number of milliseconds.`
+    );
+  return t;
+}
+function $t(e) {
+  return e === !1 ? !1 : et("idleExpirationMs", e);
+}
+function Jr(e) {
+  return {
+    async decode(t) {
+      const r = t.split(".");
+      if (r.length !== 4 || r[0] !== "s1")
+        return;
+      const n = e.findIndex((v) => v.id === r[1]), o = e[n], i = be(r[2]), s = be(r[3]);
+      if (!o || !i || !s)
+        return;
+      const a = await crypto.subtle.importKey(
+        "raw",
+        I(o.value),
+        { hash: "SHA-256", name: "HMAC" },
+        !1,
+        ["verify"]
+      );
+      if (!await crypto.subtle.verify(
+        "HMAC",
+        a,
+        I(s),
+        I(X(`s1.${o.id}.${r[2]}`))
+      ))
+        return;
+      const d = Nt(i);
+      return d ? { currentKey: n === 0, record: d } : void 0;
+    },
+    async encode(t) {
+      const r = e[0], n = se(X(JSON.stringify(t))), o = `s1.${r.id}.${n}`, i = await crypto.subtle.importKey(
+        "raw",
+        I(r.value),
+        { hash: "SHA-256", name: "HMAC" },
+        !1,
+        ["sign"]
+      ), s = await crypto.subtle.sign(
+        "HMAC",
+        i,
+        I(X(o))
+      );
+      return `${o}.${se(new Uint8Array(s))}`;
+    }
+  };
 }
-function Ce(e = {}) {
-  return y(
-    e,
+function Gr(e, t) {
+  return {
+    async decode(r) {
+      const n = r.split(".");
+      if (n.length !== 4 || n[0] !== "e1")
+        return;
+      const o = e.findIndex((u) => u.id === n[1]), i = e[o], s = be(n[2]), a = be(n[3]);
+      if (!(!i || s?.byteLength !== 12 || !a))
+        try {
+          const u = await ht(i), d = await crypto.subtle.decrypt(
+            {
+              additionalData: I(X(`e1.${i.id}`)),
+              iv: I(s),
+              name: "AES-GCM"
+            },
+            u,
+            I(a)
+          ), v = Nt(new Uint8Array(d));
+          return v ? { currentKey: o === 0, record: v } : void 0;
+        } catch {
+          return;
+        }
+    },
+    async encode(r) {
+      const n = e[0], o = t(12);
+      if (o.byteLength !== 12)
+        throw new Error(
+          "Demiurge cookie session randomBytes returned an incorrect byte count."
+        );
+      const i = await ht(n), s = await crypto.subtle.encrypt(
+        {
+          additionalData: I(X(`e1.${n.id}`)),
+          iv: I(o),
+          name: "AES-GCM"
+        },
+        i,
+        I(X(JSON.stringify(r)))
+      );
+      return `e1.${n.id}.${se(o)}.${se(new Uint8Array(s))}`;
+    }
+  };
+}
+async function ht(e) {
+  return await crypto.subtle.importKey(
+    "raw",
+    I(e.value),
+    "AES-GCM",
     !1,
-    (t, r) => U(t, r, e)
+    ["decrypt", "encrypt"]
   );
 }
-function Oe(e = {}) {
-  return y(e, !1, (t, r) => {
-    let n;
+function Nt(e) {
+  try {
+    const t = JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(e));
+    return !ee(t) || !$e(t.createdAt) || !$e(t.expiresAt) || typeof t.id != "string" || !/^[A-Za-z0-9_-]{43}$/.test(t.id) || !Yr(t.version) || t.idleExpiresAt !== void 0 && !$e(t.idleExpiresAt) || !ve(t.data) ? void 0 : t;
+  } catch {
+    return;
+  }
+}
+function $e(e) {
+  return typeof e == "number" && Number.isSafeInteger(e) && e >= 0;
+}
+function Yr(e) {
+  return typeof e == "number" && Number.isSafeInteger(e) && e >= 0;
+}
+function ve(e) {
+  return e === null || typeof e == "boolean" || typeof e == "string" ? !0 : typeof e == "number" ? Number.isFinite(e) : Array.isArray(e) ? e.every(ve) : ee(e) && Object.values(e).every(ve);
+}
+function Zr(e, t) {
+  return e.expiresAt <= t || e.idleExpiresAt !== void 0 && e.idleExpiresAt <= t;
+}
+function Qr(e) {
+  return Se({
+    ...e,
+    expires: /* @__PURE__ */ new Date(0),
+    maxAge: 0,
+    value: ""
+  });
+}
+function pt(e) {
+  const t = e(ft);
+  if (t.byteLength !== ft)
+    throw new Error(
+      "Demiurge cookie session randomBytes returned an incorrect byte count."
+    );
+  return se(t);
+}
+function Xr(e) {
+  return crypto.getRandomValues(new Uint8Array(e));
+}
+function Ne(e) {
+  if (!ve(e))
+    throw new Error(
+      "Demiurge session data must contain only finite JSON values."
+    );
+  return structuredClone(e);
+}
+function Le(e) {
+  return structuredClone(e);
+}
+function X(e) {
+  return new TextEncoder().encode(e);
+}
+function I(e) {
+  return Uint8Array.from(e).buffer;
+}
+function se(e) {
+  let t = "";
+  for (const r of e)
+    t += String.fromCharCode(r);
+  return btoa(t).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function be(e) {
+  if (/^[A-Za-z0-9_-]+$/.test(e))
     try {
-      n = new URL(r);
+      const t = "=".repeat((4 - e.length % 4) % 4), r = atob(e.replaceAll("-", "+").replaceAll("_", "/") + t);
+      return Uint8Array.from(r, (n) => n.charCodeAt(0));
     } catch {
-      throw new Error(`Environment variable ${t} must be a valid URL.`);
+      return;
     }
-    if (e.protocols?.length && !e.protocols.includes(n.protocol))
-      throw new Error(
-        `Environment variable ${t} must use one of these protocols: ${e.protocols.join(", ")}.`
-      );
-    return n;
-  });
 }
-const Tt = {
-  boolean: Te,
-  enum: Ie,
-  integer: De,
-  secret: Ne,
-  string: Ce,
-  url: Oe
-};
-function y(e, t, r) {
+const en = 10080 * 60 * 1e3, tn = 1440 * 60 * 1e3;
+class rn extends Error {
+  constructor(t) {
+    super(
+      `Demiurge session ${t} conflicted with another request. Load the current session before another lifecycle operation.`
+    ), this.name = "SessionStoreConflictError";
+  }
+}
+class mt extends Error {
+  constructor(t) {
+    super(
+      `Demiurge session ${t} failed because the session store is unavailable.`
+    ), this.name = "SessionStoreUnavailableError";
+  }
+}
+function Fo(e) {
+  const t = nn(e), r = ce(
+    t.cookie.name,
+    t.cookie.scope ?? "host"
+  );
   return {
-    optional: e.optional ?? !1,
-    parse: r,
-    sensitive: t
+    cookieName: r,
+    async open(n) {
+      const o = Ge(n.headers.get("cookie") ?? "").get(r), i = o ? await sn(o, t.keys) : void 0, s = t.now();
+      let a = i ? await t.store.read(i.id, s) : void 0, u = !!(o && (!i || !a)), d = !!(a && i && !i.currentKey);
+      if (a && t.renewal && t.idleExpirationMs !== !1 && a.idleExpiresAt !== void 0 && a.idleExpiresAt - s <= t.idleExpirationMs / 4) {
+        const h = await t.store.update({
+          ...Ie(a),
+          idleExpiresAt: Math.min(
+            a.expiresAt,
+            s + t.idleExpirationMs
+          )
+        }, a.version);
+        if (h.status === "stored")
+          a = h.record, d = !0;
+        else if (h.status === "conflict")
+          a = await t.store.read(a.id, s), u = !a;
+        else
+          throw new mt("renewal");
+      }
+      const v = () => {
+        if (!a)
+          throw new Error(
+            "Demiurge cannot change a session that does not exist. Create the session first."
+          );
+        return a;
+      }, A = (h, p) => {
+        if (h.status === "conflict")
+          throw new rn(p);
+        if (h.status === "unavailable")
+          throw new mt(p);
+        return a = Pe(h.record), u = !1, d = !0, Pe(h.record);
+      };
+      return {
+        async commit() {
+          return u ? [cn(t.cookie)] : !a || !d ? [] : [Se({
+            ...t.cookie,
+            expires: new Date(a.expiresAt),
+            value: await an(a.id, t.keys[0])
+          })];
+        },
+        async create(h, p = {}) {
+          if (a)
+            throw new Error(
+              "Demiurge cannot create a session when one already exists. Rotate or update the current session."
+            );
+          const E = t.now(), g = tt(
+            "absoluteExpirationMs",
+            p.absoluteExpirationMs ?? t.absoluteExpirationMs
+          ), b = p.idleExpirationMs === void 0 ? t.idleExpirationMs : Lt(p.idleExpirationMs), m = E + g, T = {
+            createdAt: E,
+            data: De(h),
+            expiresAt: m,
+            id: yt(t.randomBytes),
+            ...b === !1 ? {} : {
+              idleExpiresAt: Math.min(
+                m,
+                E + b
+              )
+            }
+          };
+          return A(await t.store.create(T), "creation");
+        },
+        async destroy() {
+          a && await t.store.destroy(a.id), a = void 0, u = !0, d = !1;
+        },
+        get() {
+          return a ? Pe(a) : void 0;
+        },
+        async rotate(h) {
+          const p = v(), E = {
+            ...Ie(p),
+            data: h === void 0 ? p.data : De(h),
+            id: yt(t.randomBytes)
+          };
+          return A(
+            await t.store.rotate(p.id, E, p.version),
+            "rotation"
+          );
+        },
+        async update(h) {
+          const p = v();
+          return A(
+            await t.store.update({
+              ...Ie(p),
+              data: De(h)
+            }, p.version),
+            "update"
+          );
+        }
+      };
+    }
+  };
+}
+function nn(e) {
+  if (!e.store || typeof e.store.read != "function")
+    throw new Error(
+      "Demiurge session manager requires a SessionStore implementation."
+    );
+  const t = on(e.keys);
+  return {
+    absoluteExpirationMs: tt(
+      "absoluteExpirationMs",
+      e.absoluteExpirationMs ?? en
+    ),
+    cookie: { ...e.cookie, name: e.cookie?.name ?? "session" },
+    idleExpirationMs: Lt(
+      e.idleExpirationMs ?? tn
+    ),
+    keys: t,
+    now: e.now ?? Date.now,
+    randomBytes: e.randomBytes ?? un,
+    renewal: e.renewal ?? !0,
+    store: e.store
   };
 }
-function U(e, t, r) {
-  if (r.minLength !== void 0 && t.length < r.minLength)
+function on(e) {
+  if (e.length === 0)
     throw new Error(
-      `Environment variable ${e} must be at least ${r.minLength} characters.`
+      "Demiurge session manager requires at least one key. Put the current key first."
+    );
+  const t = /* @__PURE__ */ new Set();
+  for (const r of e) {
+    if (!/^[A-Za-z0-9_-]+$/.test(r.id) || t.has(r.id))
+      throw new Error(
+        "Demiurge session manager key identifiers must be unique token values."
+      );
+    if (r.value.byteLength < 32)
+      throw new Error(
+        `Demiurge session manager key ${JSON.stringify(r.id)} must contain at least 32 bytes.`
+      );
+    t.add(r.id);
+  }
+  return [...e];
+}
+async function an(e, t) {
+  const r = `i1.${t.id}.${e}`, n = await crypto.subtle.importKey(
+    "raw",
+    oe(t.value),
+    { hash: "SHA-256", name: "HMAC" },
+    !1,
+    ["sign"]
+  ), o = await crypto.subtle.sign(
+    "HMAC",
+    n,
+    oe(new TextEncoder().encode(r))
+  );
+  return `${r}.${It(new Uint8Array(o))}`;
+}
+async function sn(e, t) {
+  const r = e.split(".");
+  if (r.length !== 4 || r[0] !== "i1" || !/^[A-Za-z0-9_-]{43}$/.test(r[2]))
+    return;
+  const n = t.findIndex((u) => u.id === r[1]), o = t[n], i = ln(r[3]);
+  if (!o || !i)
+    return;
+  const s = await crypto.subtle.importKey(
+    "raw",
+    oe(o.value),
+    { hash: "SHA-256", name: "HMAC" },
+    !1,
+    ["verify"]
+  );
+  return await crypto.subtle.verify(
+    "HMAC",
+    s,
+    oe(i),
+    oe(new TextEncoder().encode(r.slice(0, 3).join(".")))
+  ) ? { currentKey: n === 0, id: r[2] } : void 0;
+}
+function Ie(e) {
+  const { version: t, ...r } = e;
+  return r;
+}
+function cn(e) {
+  return Se({
+    ...e,
+    expires: /* @__PURE__ */ new Date(0),
+    maxAge: 0,
+    value: ""
+  });
+}
+function tt(e, t) {
+  if (!Number.isSafeInteger(t) || t <= 0)
+    throw new Error(
+      `Demiurge session manager ${e} must be a positive whole number of milliseconds.`
     );
   return t;
 }
-function Le(e) {
-  return e.length === 1 ? e[0].message : `Environment validation failed with ${e.length} issues.`;
+function Lt(e) {
+  return e === !1 ? !1 : tt("idleExpirationMs", e);
+}
+function yt(e) {
+  const t = e(32);
+  if (t.byteLength !== 32)
+    throw new Error(
+      "Demiurge session manager randomBytes returned an incorrect byte count."
+    );
+  return It(t);
+}
+function un(e) {
+  return crypto.getRandomValues(new Uint8Array(e));
 }
-function It(e = {}) {
+function De(e) {
+  if (!He(e))
+    throw new Error(
+      "Demiurge session data must contain only finite JSON values."
+    );
+  return structuredClone(e);
+}
+function He(e) {
+  return e === null || typeof e == "boolean" || typeof e == "string" ? !0 : typeof e == "number" ? Number.isFinite(e) : Array.isArray(e) ? e.every(He) : typeof e == "object" && e !== null && Object.values(e).every(He);
+}
+function Pe(e) {
+  return structuredClone(e);
+}
+function It(e) {
+  let t = "";
+  for (const r of e)
+    t += String.fromCharCode(r);
+  return btoa(t).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function ln(e) {
+  if (/^[A-Za-z0-9_-]+$/.test(e))
+    try {
+      const t = "=".repeat((4 - e.length % 4) % 4), r = atob(e.replaceAll("-", "+").replaceAll("_", "/") + t);
+      return Uint8Array.from(r, (n) => n.charCodeAt(0));
+    } catch {
+      return;
+    }
+}
+function oe(e) {
+  return Uint8Array.from(e).buffer;
+}
+function Uo(e = {}) {
   return async function(r) {
     if (r.method.toUpperCase() !== "POST")
       return new Response(null, {
@@ -429,25 +923,25 @@ function It(e = {}) {
         },
         status: 405
       });
-    const n = Me(r);
+    const n = fn(r);
     if (n)
       return n;
-    const a = Pe(e, r);
-    if (a)
-      return a;
-    e.maxBodySize !== void 0 && (r = ee({ maxBodySize: e.maxBodySize }, r));
+    const o = hn(e, r);
+    if (o)
+      return o;
+    e.maxBodySize !== void 0 && (r = fr({ maxBodySize: e.maxBodySize }, r));
     let i;
     try {
       i = await r.json();
-    } catch (o) {
-      return o instanceof te ? new Response("Security report body too large.", { status: 413 }) : new Response("Invalid security report JSON.", {
+    } catch (a) {
+      return a instanceof hr ? new Response("Security report body too large.", { status: 413 }) : new Response("Invalid security report JSON.", {
         status: 400
       });
     }
-    const s = Ue(i);
-    for (let o = 0; o < s.length; o += 1)
-      await e.onReport?.(s[o], {
-        index: o,
+    const s = pn(i);
+    for (let a = 0; a < s.length; a += 1)
+      await e.onReport?.(s[a], {
+        index: a,
         request: r
       });
     return new Response(null, {
@@ -455,20 +949,20 @@ function It(e = {}) {
     });
   };
 }
-const ze = /* @__PURE__ */ new Set([
+const dn = /* @__PURE__ */ new Set([
   "application/csp-report",
   "application/reports+json"
 ]);
-function Me(e) {
+function fn(e) {
   const t = e.headers.get("content-type");
   if (!t)
     return null;
   const r = t.split(";", 1)[0]?.trim().toLowerCase();
-  return r && ze.has(r) ? null : new Response("Unsupported security report Content-Type.", {
+  return r && dn.has(r) ? null : new Response("Unsupported security report Content-Type.", {
     status: 415
   });
 }
-function Pe(e, t) {
+function hn(e, t) {
   if (e.maxBodySize === void 0)
     return null;
   const r = t.headers.get("content-length");
@@ -479,32 +973,29 @@ function Pe(e, t) {
       status: 400
     });
   const n = Number(r);
-  return Number.isSafeInteger(n) ? n > $(e.maxBodySize) ? new Response("Security report body too large.", {
+  return Number.isSafeInteger(n) ? n > Ye(e.maxBodySize) ? new Response("Security report body too large.", {
     status: 413
   }) : null : new Response("Invalid Content-Length.", {
     status: 400
   });
 }
-function Ue(e) {
-  return Array.isArray(e) ? e : je(e) && "csp-report" in e ? [e["csp-report"]] : [e];
-}
-function je(e) {
-  return typeof e == "object" && e !== null;
+function pn(e) {
+  return Array.isArray(e) ? e : Ze(e) && "csp-report" in e ? [e["csp-report"]] : [e];
 }
-function Dt(e, t) {
+function Bo(e, t) {
   const r = {}, n = [];
-  let a = 0;
+  let o = 0;
   for (const [i, s] of Object.entries(t.files)) {
-    const o = e.getAll(i).filter(Be);
-    r[i] = o, s.required && o.length === 0 && n.push({
+    const a = e.getAll(i).filter(gn);
+    r[i] = a, s.required && a.length === 0 && n.push({
       code: "file-missing",
       field: i,
       message: `Upload field ${i} requires at least one file.`
     });
-    for (const u of o)
-      a += u.size, Fe(i, u, s, n);
+    for (const u of a)
+      o += u.size, mn(i, u, s, n);
   }
-  return t.maxTotalSize !== void 0 && a > $(t.maxTotalSize) && n.push({
+  return t.maxTotalSize !== void 0 && o > Ye(t.maxTotalSize) && n.push({
     code: "total-upload-too-large",
     field: "*",
     message: `Uploaded files exceed the maximum total size of ${t.maxTotalSize}.`
@@ -512,27 +1003,27 @@ function Dt(e, t) {
     files: r,
     issues: n,
     ok: n.length === 0,
-    totalSize: a
+    totalSize: o
   };
 }
-function Fe(e, t, r, n) {
-  r.maxSize !== void 0 && t.size > $(r.maxSize) && n.push({
+function mn(e, t, r, n) {
+  r.maxSize !== void 0 && t.size > Ye(r.maxSize) && n.push({
     code: "file-too-large",
     field: e,
     message: `Upload field ${e} contains ${t.name || "a file"} larger than ${r.maxSize}.`
-  }), r.types?.length && !He(t.type, r.types) && n.push({
+  }), r.types?.length && !yn(t.type, r.types) && n.push({
     code: "file-type-not-allowed",
     field: e,
     message: `Upload field ${e} contains ${t.name || "a file"} with disallowed type ${t.type || "unknown"}.`
   });
 }
-function He(e, t) {
+function yn(e, t) {
   return t.some((r) => r.endsWith("/*") ? e.startsWith(r.slice(0, -1)) : e === r);
 }
-function Be(e) {
+function gn(e) {
   return e instanceof File;
 }
-function qe(e, t) {
+function wn(e, t) {
   const r = t.headers.get("origin");
   if (!r)
     return {
@@ -541,7 +1032,7 @@ function qe(e, t) {
       origin: r,
       reason: e.allowMissingOrigin ? void 0 : "missing-origin"
     };
-  const n = j(r);
+  const n = Dt(r);
   if (!n)
     return {
       allowed: !1,
@@ -549,28 +1040,28 @@ function qe(e, t) {
       origin: r,
       reason: "invalid-origin"
     };
-  const a = _e(e, n, t);
+  const o = vn(e, n, t);
   return {
-    allowed: a,
+    allowed: o,
     expected: e.origins,
     origin: n,
-    reason: a ? void 0 : "origin-not-allowed"
+    reason: o ? void 0 : "origin-not-allowed"
   };
 }
-function Nt(e, t) {
-  return !e || qe(e, t).allowed ? null : new Response("WebSocket origin not allowed.", {
+function Ho(e, t) {
+  return !e || wn(e, t).allowed ? null : new Response("WebSocket origin not allowed.", {
     status: 403
   });
 }
-function _e(e, t, r) {
+function vn(e, t, r) {
   return e.origins === "same-origin" ? t === new URL(r.url).origin : e.origins.some(
-    (n) => Ve(n, t)
+    (n) => bn(n, t)
   );
 }
-function Ve(e, t) {
-  return e === "null" ? t === "null" : j(e) === t;
+function bn(e, t) {
+  return e === "null" ? t === "null" : Dt(e) === t;
 }
-function j(e) {
+function Dt(e) {
   if (e === "null")
     return e;
   try {
@@ -588,122 +1079,568 @@ function j(e) {
     return null;
   }
 }
-function We(e) {
-  const t = M(e.routes), r = e.loadNavigationData ?? H;
+const Pt = We({
+  register: () => () => {
+  },
+  focus: () => !1
+});
+function Sn() {
+  const e = Je(Pt), t = k(void 0), r = At((n) => {
+    t.current?.(), t.current = void 0, n && (t.current = e.register(n));
+  }, [e]);
+  return ae(() => ({
+    ref: r,
+    tabIndex: -1
+  }), [r]);
+}
+function zo(e) {
+  const { as: t, children: r, ref: n, ...o } = e, i = Sn(), s = At((a) => {
+    if (a) {
+      i.ref(a), gt(n, a);
+      return;
+    }
+    gt(n, null), i.ref(null);
+  }, [i.ref, n]);
+  return R(t ?? "div", {
+    ...o,
+    ...i,
+    ref: s,
+    children: r
+  });
+}
+function gt(e, t) {
+  typeof e == "function" ? e(t) : e && (e.current = t);
+}
+const Ot = Symbol("Demiurge mutation form action");
+let ie;
+const ze = /* @__PURE__ */ new Set();
+function En(e) {
+  return ie = e, () => {
+    ie === e && (ie = void 0);
+  };
+}
+function je(e) {
+  for (const t of ze)
+    t !== e && t.abort();
+}
+function An(e) {
+  let t;
+  return (r, n) => {
+    t?.controller.abort();
+    const o = new AbortController(), i = {
+      controller: o,
+      // TYPE-EVIDENCE: the function assigns the promise before it exposes the invocation.
+      promise: void 0
+    };
+    ze.add(o);
+    const s = Qe({
+      to: e.route,
+      ...e.path === void 0 ? {} : { path: e.path }
+    }), a = xn({
+      body: n,
+      method: e.method,
+      signal: o.signal,
+      url: s
+    });
+    return i.promise = a.then(async (u) => {
+      if (t !== i) return await t.promise;
+      if (u.status === "redirect") {
+        const d = Ut(u.location);
+        if (!d) return Oe("The mutation returned an unsafe redirect.");
+        je(o), ie?.redirect(d, u.history, o);
+      } else u.status === "success" && u.revalidate && await ie?.refresh();
+      return o.signal.aborted ? r ?? Oe("The mutation was cancelled.") : t === i ? u : await t.promise;
+    }).catch(async (u) => {
+      if (t !== i) return await t.promise;
+      if (o.signal.aborted && r) return r;
+      if (o.signal.aborted) return Oe("The mutation was cancelled.");
+      throw u;
+    }).finally(() => {
+      ze.delete(o);
+    }), t = i, i.promise;
+  };
+}
+function jo(e, t) {
+  const r = Qe({
+    to: e.route,
+    ...e.path === void 0 ? {} : { path: e.path }
+  }), n = ae(
+    () => An(e),
+    [e.method, r]
+  ), [o, i, s] = nr(n, t), a = ae(() => {
+    const u = (d) => i(d);
+    return Object.defineProperty(u, Ot, {
+      value: { method: "POST", url: r }
+    }), u;
+  }, [i, r]);
+  return [o, a, s];
+}
+function _t(e) {
+  return e[Ot];
+}
+async function xn(e) {
+  const { result: t } = await Ft(e);
+  if (!t)
+    throw new Error("Demiurge expected a versioned mutation result.");
+  return t;
+}
+async function Ft(e) {
+  const t = await fetch(e.url, {
+    body: e.body,
+    credentials: "same-origin",
+    headers: {
+      accept: xt,
+      [mr]: pr,
+      ...e.contentType ? { "content-type": e.contentType } : {}
+    },
+    method: e.method,
+    redirect: "manual",
+    signal: e.signal
+  });
+  return { response: t, result: await kn(t) };
+}
+async function kn(e) {
+  const t = e.headers.get("content-type");
+  if (!t) return;
+  const [r, ...n] = t?.split(";").map((s) => s.trim().toLowerCase()) ?? [], o = xt.split(";")[0];
+  if (r !== o) return;
+  if (n.length !== 1 || n[0] !== "v=1")
+    throw new Error("Demiurge received a malformed versioned mutation result.");
+  let i;
+  try {
+    i = await e.clone().json();
+  } catch {
+    throw new Error("Demiurge received a malformed versioned mutation result.");
+  }
+  if (!ee(i) || i.version !== 1 || typeof i.status != "string")
+    throw new Error("Demiurge received a malformed versioned mutation result.");
+  if (i.status === "success") {
+    if (!Z(i, ["data", "revalidate", "status", "version"]) || i.revalidate !== void 0 && typeof i.revalidate != "boolean" || "data" in i && !Ve(i.data)) throw fe();
+    return { version: 1, status: "success", ...i.data === void 0 ? {} : { data: i.data }, ...i.revalidate === void 0 ? {} : { revalidate: i.revalidate } };
+  }
+  if (i.status === "invalid") {
+    if (!Z(i, ["status", "validation", "version"]) || !Rn(i.validation)) throw fe();
+    return { version: 1, status: "invalid", validation: i.validation };
+  }
+  if (i.status === "failed") {
+    if (!Z(i, ["message", "status", "version"]) || i.message !== void 0 && typeof i.message != "string") throw fe();
+    return { version: 1, status: "failed", ...i.message === void 0 ? {} : { message: i.message } };
+  }
+  if (i.status === "redirect" && typeof i.location == "string" && (i.history === "push" || i.history === "replace") && Z(i, ["history", "location", "status", "version"]))
+    return { version: 1, status: "redirect", location: i.location, history: i.history };
+  throw fe();
+}
+function Ut(e) {
+  try {
+    const t = new URL(e, window.location.href);
+    return t.protocol !== window.location.protocol || t.origin !== window.location.origin || t.username || t.password ? void 0 : `${t.pathname}${t.search}${t.hash}`;
+  } catch {
+    return;
+  }
+}
+function Oe(e) {
+  return { version: 1, status: "failed", message: e };
+}
+function fe() {
+  return new Error("Demiurge received a malformed mutation result.");
+}
+function Z(e, t) {
+  return Object.keys(e).every((r) => t.includes(r));
+}
+function Rn(e) {
+  return ee(e) && Z(e, ["issues"]) && Array.isArray(e.issues) && e.issues.every(Tn);
+}
+function Tn(e) {
+  return ee(e) && Z(e, ["code", "message", "path"]) && typeof e.code == "string" && typeof e.message == "string" && Array.isArray(e.path) && (e.path.length === 0 || typeof e.path[0] == "string") && e.path.every((t) => typeof t == "string" || typeof t == "number");
+}
+function Ve(e) {
+  return e === null || typeof e == "string" || typeof e == "boolean" ? !0 : typeof e == "number" ? Number.isFinite(e) : Array.isArray(e) ? e.every(Ve) : ee(e) && Object.values(e).every(Ve);
+}
+function Mn(e) {
+  const t = kt(e.routes), r = e.loadNavigationData ?? Kt;
   return function() {
-    const [a, i] = T(() => S()), [s, o] = T(
+    const [o, i] = U(() => F()), [s, a] = U(e.locale), u = Be(o.pathname, e.locales), d = k(o), [v, A] = U(
       () => e.initialMatch ?? { status: "loading" }
-    ), u = I(!!e.initialMatch), d = I(0);
-    D(() => {
+    ), h = k(!!e.initialMatch), p = k(!0), E = k(0), g = k(void 0), b = k("navigation"), m = k(/* @__PURE__ */ new Map()), T = k(/* @__PURE__ */ new Map()), [H, w] = U(0), [$, C] = U(0), V = k(/* @__PURE__ */ new Set()), [Xt, rt] = U(0), O = k("push"), [ue, Ae] = U(null), [q, xe] = U(null), nt = k(null);
+    nt.current = ue;
+    const K = k(void 0), ke = k(void 0), P = k(void 0), W = k(!1), ot = k(/* @__PURE__ */ new Map()), J = k([]), er = k(0);
+    function G() {
+      const c = P.current, l = qt();
+      c && ot.current.set(c, l), On(c, l);
+    }
+    const Re = ae(() => ({
+      register(c) {
+        const l = {
+          element: c,
+          order: er.current++
+        };
+        return J.current.length > 0 && typeof process < "u" && process.env.NODE_ENV !== "production" && console.warn(
+          "Demiurge found more than one RouteFocusBoundary. The first boundary remains active."
+        ), J.current.push(l), () => {
+          const f = J.current.indexOf(l);
+          f !== -1 && J.current.splice(f, 1);
+        };
+      },
+      focus() {
+        const c = J.current.slice().sort((l, f) => l.order - f.order)[0]?.element;
+        if (!c || !c.isConnected || typeof c.focus != "function")
+          return !1;
+        try {
+          c.focus({ preventScroll: !0 });
+        } catch {
+          c.focus();
+        }
+        return !0;
+      }
+    }), []);
+    ne(() => (e.navigation !== "document" && ar(), () => {
+      J.current = [];
+    }), [e.navigation]), Y(() => () => {
+      je();
+      for (const c of V.current) c();
+      V.current.clear();
+      for (const c of m.current.values()) c.abort();
+      m.current.clear(), T.current.clear();
+    }, []);
+    function te(c) {
+      je(c);
+      let l = !1;
+      for (const [f, y] of m.current) {
+        if (y === c) continue;
+        y.abort(), m.current.delete(f);
+        const S = T.current.get(f);
+        (S?.state === "submitting" || S?.state === "loading") && T.current.set(f, {
+          state: "idle",
+          form: S.form,
+          submissionKey: S.submissionKey,
+          ...S.state === "loading" && S.result ? { result: S.result } : {}
+        }), l = !0;
+      }
+      l && w((f) => f + 1);
+    }
+    function z() {
+      E.current++, g.current?.abort(), g.current = void 0;
+    }
+    Y(() => {
+      if (e.navigation === "document")
+        return;
+      const c = window.history.scrollRestoration;
+      window.history.scrollRestoration = "manual", P.current = wt(), G();
+      const l = () => {
+        W.current || G();
+      };
+      return window.addEventListener("scroll", l, { passive: !0 }), () => {
+        window.removeEventListener("scroll", l), window.history.scrollRestoration = c;
+      };
+    }, [e.navigation]), Y(() => {
       function c() {
-        i(S());
+        te(), O.current = "pop", W.current = !0, P.current = wt(), ke.current = ot.current.get(
+          P.current
+        ) ?? _n();
+        const l = F(), f = d.current;
+        (f.pathname !== l.pathname || f.search !== l.search) && (z(), b.current = "navigation"), d.current = l, e.navigation !== "document" && f.pathname === l.pathname && f.search === l.search && f.hash !== l.hash && pe(l.hash), i(l);
       }
       return window.addEventListener("popstate", c), () => window.removeEventListener("popstate", c);
-    }, []), D(() => {
+    }, []), Y(() => {
       let c = !1, l = !1;
-      const m = ++d.current, R = new AbortController(), v = () => !c && m === d.current;
-      if (u.current && Ge(e.initialMatch) === a.pathname)
-        return u.current = !1, () => {
-          c = !0;
+      const f = ++E.current, y = new AbortController();
+      g.current = y;
+      const S = b.current, D = () => !c && f === E.current;
+      if (Ae(null), xe(null), h.current && $n(e.initialMatch) === u)
+        return h.current = !1, p.current = !1, () => {
+          c = !0, y.abort(), g.current === y && (g.current = void 0);
         };
-      o({ status: "loading" }), ne(t, a.pathname).then((h) => {
-        v() && !l && h && o({ loading: h, status: "loading" });
+      const _ = p.current;
+      p.current = !1, S !== "refresh" && e.navigation !== "document" && !_ && (K.current = {
+        navigation: O.current,
+        position: O.current === "pop" ? ke.current : void 0
+      }, ke.current = void 0), S !== "refresh" && (A({ status: "loading" }), yr(t, u).then((x) => {
+        D() && !l && x && A({ loading: x, status: "loading" });
       }).catch(() => {
-      });
-      const k = new Request(a.href, { signal: R.signal });
-      return Promise.resolve(r(k)).then(
-        (h) => P(
-          t,
-          a.pathname,
-          k,
-          h,
-          void 0,
-          { documentContributions: !1 }
-        )
-      ).then((h) => {
-        l = !0, v() && o(h);
-      }).catch(async (h) => {
-        if (l = !0, !v() || R.signal.aborted)
+      }));
+      const re = new Request(o.href, { signal: y.signal });
+      return Promise.resolve(r(re)).then(async (x) => {
+        const N = x.url ? new URL(x.url, o.href) : new URL(o.href);
+        N.hash || (N.hash = o.hash);
+        const M = x.locale ?? (e.locales ? gr(new Request(N), e.locales).locale : s);
+        return {
+          initialData: x,
+          responseUrl: N,
+          nextMatch: await Rt(
+            t,
+            Be(N.pathname, e.locales),
+            new Request(N.href, { signal: y.signal }),
+            x,
+            void 0,
+            { documentContributions: !1, locale: M }
+          )
+        };
+      }).then(({ initialData: x, nextMatch: N, responseUrl: M }) => {
+        if (l = !0, D()) {
+          if (x.document && at(x.document), "locale" in x && x.locale && a(x.locale), M.href !== o.href) {
+            window.history.replaceState(window.history.state, "", M);
+            const L = F();
+            d.current = L, i(L);
+          }
+          A(N), rt((L) => L + 1), S !== "refresh" && Ae({
+            kind: O.current,
+            outcome: N.status === "not-found" ? "not-found" : "ready",
+            title: document.title || "Demiurge App",
+            url: new URL(o.href)
+          });
+        }
+      }).catch(async (x) => {
+        if (l = !0, !D() || y.signal.aborted)
           return;
-        const q = await ae(
+        const N = await wr(
           t,
-          a.pathname
+          u
         );
-        v() && o({
-          Error: q,
-          error: h,
-          pathname: a.pathname,
-          status: "error"
-        });
+        if (D()) {
+          const M = typeof x == "object" && x ? Wt.get(x) : void 0;
+          M && at(M), A({
+            Error: N,
+            error: x,
+            locale: s,
+            pathname: u,
+            status: "error"
+          }), Ae(S === "refresh" ? null : {
+            kind: O.current,
+            outcome: "error",
+            title: M?.title ?? "Navigation failed",
+            url: new URL(o.href)
+          }), rt((L) => L + 1);
+        }
       }), () => {
-        c = !0, R.abort();
+        c = !0, y.abort(), g.current === y && (g.current = void 0);
       };
-    }, [a.pathname, a.search]);
-    const g = V(
+    }, [u, o.pathname, o.search, $]), ne(() => {
+      if (!(!q || e.navigation === "document")) {
+        if (q.url.hash) {
+          K.current && (K.current = void 0, pe(q.url.hash)), W.current = !1;
+          return;
+        }
+        if (Re.focus(), K.current) {
+          const c = K.current;
+          K.current = void 0, Fn(e.navigationScroll, {
+            ...q,
+            kind: c.navigation,
+            navigation: c.navigation,
+            position: c.position
+          });
+        }
+        W.current = !1, jn(q, e.navigationAccessibility);
+      }
+    }, [
+      q,
+      Re,
+      e.navigation,
+      e.navigationAccessibility,
+      e.navigationScroll
+    ]);
+    function B(c, l) {
+      T.current.set(c, l), w((f) => f + 1);
+    }
+    function tr(c, l) {
+      const f = Fe(c, l), y = T.current.get(f);
+      y?.form === c && (y.state === "loading" && y.result || (m.current.get(f)?.abort(), m.current.delete(f), T.current.delete(f), w((S) => S + 1)));
+    }
+    const rr = ae(
       () => ({
         navigation: e.navigation ?? "server",
+        locale: s,
+        locales: e.locales,
+        submissionVersion: H,
+        getMutationNavigation(c, l) {
+          const f = Fe(c, l);
+          return T.current.get(f) ?? {
+            state: "idle",
+            form: c,
+            submissionKey: l
+          };
+        },
+        releaseMutationNavigation: tr,
         push(c) {
-          const l = S();
-          window.history.pushState(null, "", c);
-          const m = S();
-          i(m), l.pathname === m.pathname && l.search === m.search && l.hash !== m.hash && Qe(m.hash);
+          te(), W.current = !1;
+          const l = F();
+          O.current = "push", e.navigation !== "document" && G();
+          const f = ge();
+          window.history.pushState(f.state, "", c), P.current = f.key;
+          const y = F();
+          (l.pathname !== y.pathname || l.search !== y.search) && (z(), b.current = "navigation"), d.current = y, i(y), l.pathname === y.pathname && l.search === y.search && l.hash !== y.hash && pe(y.hash);
+        },
+        replace(c) {
+          te(), W.current = !1;
+          const l = F();
+          O.current = "replace", e.navigation !== "document" && G(), window.history.replaceState(
+            we(window.history.state, P.current),
+            "",
+            c
+          );
+          const f = F();
+          (l.pathname !== f.pathname || l.search !== f.search) && (z(), b.current = "navigation"), d.current = f, i(f), e.navigation !== "document" && l.pathname === f.pathname && l.search === f.search && l.hash !== f.hash && pe(f.hash);
+        },
+        async submitMutation(c, l, f) {
+          if ((e.navigation ?? "server") !== "server") return;
+          const y = Bn(c, l);
+          if (!y) return;
+          const S = Fe(c, f);
+          m.current.get(S)?.abort();
+          const D = new AbortController();
+          m.current.set(S, D);
+          const _ = y.formData, re = () => !D.signal.aborted && m.current.get(S) === D;
+          B(S, {
+            state: "submitting",
+            form: c,
+            submissionKey: f,
+            formData: _
+          });
+          let x;
+          try {
+            const N = await Ft({
+              body: y.body,
+              contentType: y.contentType,
+              method: y.method,
+              signal: D.signal,
+              url: y.url
+            });
+            if (x = N.response, !re()) return;
+            const M = N.result;
+            if (!re()) return;
+            if (M?.status === "invalid") {
+              B(S, { state: "invalid", form: c, submissionKey: f, formData: _, result: M });
+              return;
+            }
+            if (M?.status === "redirect") {
+              const L = Ut(M.location);
+              if (!L) {
+                B(S, { state: "error", form: c, submissionKey: f, formData: _, response: x });
+                return;
+              }
+              if (z(), te(D), b.current = "navigation", B(S, { state: "loading", form: c, submissionKey: f, formData: _ }), G(), M.history === "replace")
+                window.history.replaceState(
+                  we(null, P.current),
+                  "",
+                  L
+                );
+              else {
+                const le = ge();
+                window.history.pushState(le.state, "", L), P.current = le.key;
+              }
+              O.current = M.history, d.current = F(), i(d.current), C((le) => le + 1);
+              return;
+            }
+            if (M?.status === "failed" || !x.ok) {
+              B(S, { state: "error", form: c, submissionKey: f, formData: _, response: x });
+              return;
+            }
+            M?.status === "success" && M.revalidate ? (B(S, { state: "loading", form: c, submissionKey: f, formData: _, result: M }), z(), b.current = "refresh", C((L) => L + 1)) : B(S, { state: "idle", form: c, submissionKey: f, result: M });
+          } catch {
+            re() && B(S, { state: "error", form: c, submissionKey: f, formData: _, response: x });
+          } finally {
+            m.current.get(S) === D && m.current.delete(S);
+          }
         }
       }),
-      []
+      [H]
     );
-    return f(B.Provider, {
-      value: g,
-      children: f(Ye, {
-        key: `${a.pathname}${a.search}`,
-        Loading: e.loading,
-        NotFound: e.notFound,
-        match: s
+    return ne(() => En({
+      redirect(c, l, f) {
+        if (z(), te(f), b.current = "navigation", G(), l === "replace")
+          window.history.replaceState(
+            we(null, P.current),
+            "",
+            c
+          );
+        else {
+          const y = ge();
+          window.history.pushState(y.state, "", c), P.current = y.key;
+        }
+        O.current = l, d.current = F(), i(d.current), C((y) => y + 1);
+      },
+      refresh() {
+        return new Promise((c) => {
+          z(), b.current = "refresh", V.current.add(c), C((l) => l + 1);
+        });
+      }
+    }), [s, e.locales, e.navigation]), R(Yt.Provider, {
+      value: rr,
+      children: R(Pt.Provider, {
+        value: Re,
+        children: R(Dn, {
+          key: `${o.pathname}${o.search}`,
+          Loading: e.loading,
+          NotFound: e.notFound,
+          match: v,
+          pendingCommit: ue,
+          resolvedRouteVersion: Xt,
+          onCommitted: (c) => {
+            nt.current === c && xe(c);
+          },
+          onRenderError: () => {
+            xe(ue ? { ...ue, outcome: "error", title: "Navigation failed" } : null), it();
+          },
+          onRouteCommitted: it
+        })
       })
     });
+    function it() {
+      for (const c of V.current) c();
+      V.current.clear();
+      for (const [c, l] of T.current)
+        l.state === "loading" && T.current.set(c, {
+          state: "idle",
+          form: l.form,
+          submissionKey: l.submissionKey,
+          result: l.result
+        });
+      w((c) => c + 1);
+    }
   };
 }
-function Ke(e, t) {
-  const r = t.getAttribute(Y);
+function Cn(e, t) {
+  const r = t.getAttribute(ur);
   return e.status === "not-found" ? r === "not-found" : e.status === "ready" && r === null;
 }
-function Ge(e) {
+function $n(e) {
   if (e)
     return e.status === "ready" ? e.match.pathname : e.status === "loading" ? void 0 : e.pathname;
 }
-async function Ct(e) {
+async function Vo(e) {
   const t = e.root ?? document.getElementById("root");
   if (!t)
     throw new Error(
       "Demiurge expected a #root element in the framework document."
     );
-  const r = M(e.routes), n = e.loadNavigationData ?? H, a = e.initialData ?? G(document), i = await P(
+  const r = kt(e.routes), n = e.loadNavigationData ?? Kt, o = e.initialData ?? sr(document), i = await Rt(
     r,
-    window.location.pathname,
+    Be(window.location.pathname, e.locales),
     new Request(window.location.href),
-    a ?? await n(new Request(window.location.href)),
+    o ?? await n(new Request(window.location.href)),
     void 0,
-    { documentContributions: !1 }
-  ), s = Ke(i, t), o = We(
+    { documentContributions: !1, locale: o?.locale ?? e.locale }
+  ), s = Cn(i, t), a = Mn(
     s ? {
       ...e,
+      locale: o?.locale ?? e.locale,
       initialMatch: i,
       loadNavigationData: n,
-      navigation: a?.navigation ?? e.navigation
+      navigation: o?.navigation ?? e.navigation
     } : {
       ...e,
       loadNavigationData: n,
-      navigation: a?.navigation ?? e.navigation
+      navigation: o?.navigation ?? e.navigation
     }
-  ), { createRoot: u, hydrateRoot: d } = Ze(
+  ), { createRoot: u, hydrateRoot: d } = Nn(
     await import("react-dom/client")
   );
-  if (s && t.hasAttribute(Z)) {
-    d(t, f(o)), N();
+  if (s && t.hasAttribute(cr)) {
+    d(t, R(a)), st();
     return;
   }
-  t.replaceChildren(), u(t).render(f(o)), N();
+  t.replaceChildren(), u(t).render(R(a)), st();
 }
-function Ze(e) {
+function Nn(e) {
   const t = typeof e.createRoot == "function" && typeof e.hydrateRoot == "function" ? e : e.default;
   if (!t || typeof t.createRoot != "function" || typeof t.hydrateRoot != "function")
     throw new Error(
@@ -711,76 +1648,181 @@ function Ze(e) {
     );
   return t;
 }
-function Ot(e) {
-  const t = tt(), r = re(e);
-  return /* @__PURE__ */ z(
+function Ln(e, t) {
+  const r = Ee(), {
+    children: n,
+    download: o,
+    hash: i,
+    locale: s,
+    onClick: a,
+    path: u,
+    reloadDocument: d,
+    replace: v,
+    search: A,
+    target: h,
+    to: p,
+    ...E
+  } = e, g = Qe(e), b = s, m = r.locales && (b ?? r.locale) ? Xe(
+    g,
+    b ?? r.locale,
+    r.locales,
+    typeof window > "u" ? "http://demiurge.local" : window.location.href
+  ) : g;
+  return /* @__PURE__ */ Et(
     "a",
     {
-      className: e.className,
-      href: r,
-      onClick: (n) => {
-        t.navigation === "server" && et(n) && (n.preventDefault(), t.push(r));
+      ...E,
+      download: o,
+      href: m,
+      ref: t,
+      target: h,
+      onClick: (T) => {
+        a?.(T), r.navigation === "server" && !d && zn(T, { download: o, target: h, to: m }) && (T.preventDefault(), v ? r.replace(m) : r.push(m));
       },
-      children: e.children
+      children: n
+    }
+  );
+}
+function qo(e) {
+  return Ln(e, e.ref ?? null);
+}
+const Bt = We(void 0);
+function Ko(e) {
+  const t = Ee(), r = k(t);
+  r.current = t;
+  const n = or(), o = e.submissionKey ?? n, i = k(null), s = Ht(), a = typeof e.action == "function" ? e.action : void 0, u = a ? _t(a) : void 0, d = !!(a && s && t.navigation === "server");
+  ne(() => () => {
+    i.current && r.current.releaseMutationNavigation(i.current, o);
+  }, [o]);
+  function v(g) {
+    const b = e.onSubmit;
+    if (b?.(g), a || g.defaultPrevented || t.navigation !== "server") return;
+    const m = g.nativeEvent.submitter;
+    Jt(g.currentTarget, m) && (g.preventDefault(), t.submitMutation(
+      g.currentTarget,
+      m,
+      o
+    ));
+  }
+  const { submissionKey: A, ...h } = e, p = a ? d ? a : u?.url : h.action, E = typeof p == "string" && t.locales && (e.locale ?? t.locale) ? Xe(p, e.locale ?? t.locale, t.locales, typeof window > "u" ? "http://demiurge.local" : window.location.href) : p;
+  return R(
+    Bt.Provider,
+    {
+      value: o,
+      children: R("form", {
+        ...h,
+        action: E,
+        locale: void 0,
+        ...a ? {
+          encType: d ? void 0 : h.encType,
+          method: d ? void 0 : "post",
+          onSubmit: h.onSubmit
+        } : { onSubmit: v },
+        ref: (g) => {
+          i.current = g;
+        }
+      })
     }
   );
 }
-function Ye({
+function Wo(e) {
+  const t = Ee(), r = Ht(), n = _t(e.formAction), o = r && t.navigation === "server", i = t.locales && (e.locale ?? t.locale) ? Xe(n.url, e.locale ?? t.locale, t.locales, typeof window > "u" ? "http://demiurge.local" : window.location.href) : n.url;
+  return R("button", {
+    ...e,
+    locale: void 0,
+    formAction: o ? e.formAction : i,
+    formMethod: o ? void 0 : "post"
+  });
+}
+function Ht() {
+  const [e, t] = U(!1);
+  return Y(() => t(!0), []), e;
+}
+function In(e) {
+  const t = Je(Bt);
+  return Ee().getMutationNavigation(e?.form, e?.submissionKey ?? t);
+}
+function Jo(e) {
+  return In({ submissionKey: e });
+}
+function Dn({
   Loading: e,
   NotFound: t,
-  match: r
+  match: r,
+  onRenderError: n,
+  onCommitted: o,
+  pendingCommit: i,
+  resolvedRouteVersion: s,
+  onRouteCommitted: a
 }) {
   if (r.status === "loading") {
-    const c = r.loading ?? e;
-    return c ? f(c) : null;
+    const m = r.loading ?? e;
+    return m ? R(m) : null;
   }
   if (r.status === "not-found") {
-    const c = r.notFound ?? t ?? fe;
-    return r.layouts.reduceRight(
-      (l, m) => f(m, {
-        children: l,
+    const m = r.notFound ?? t ?? kr;
+    return R(Te, null, r.layouts.reduceRight(
+      (T, H) => R(H, {
+        children: T,
+        locale: r.locale,
         path: {},
         pathname: r.pathname
       }),
-      f(c, { pathname: r.pathname })
-    );
+      R(m, { locale: r.locale, pathname: r.pathname })
+    ), R(_e, { commit: i, onCommit: o, onRouteCommitted: a, resolvedRouteVersion: s }));
   }
   if (r.status === "error")
-    return r.Error ? f(r.Error, {
+    return R(Te, null, r.Error ? R(r.Error, {
       error: r.error,
+      locale: "locale" in r ? r.locale : void 0,
       pathname: r.pathname,
-      status: F(r.error)
-    }) : null;
-  const { data: n, error: a, page: i, layouts: s, path: o, pathname: u } = r.match, d = f(i, { data: n, path: o, pathname: u }), g = s.reduceRight(
-    (c, l) => f(l, { path: o, pathname: u, children: c }),
-    d
+      status: zt(r.error)
+    }) : null, R(_e, { commit: i, onCommit: o, onRouteCommitted: a, resolvedRouteVersion: s }));
+  const { data: u, error: d, locale: v, page: A, layouts: h, path: p, pathname: E } = r.match, g = R(A, { data: u, locale: v, path: p, pathname: E }), b = h.reduceRight(
+    (m, T) => R(T, { path: p, pathname: E, locale: v, children: m }),
+    g
   );
-  return f(Xe, {
-    Error: a,
-    children: g,
-    pathname: u
+  return R(Pn, {
+    Error: d,
+    children: R(Te, null, b, R(_e, { commit: i, onCommit: o, onRouteCommitted: a, resolvedRouteVersion: s })),
+    onError: n,
+    pathname: E
   });
 }
-class Xe extends K {
+function _e({
+  commit: e,
+  onCommit: t,
+  onRouteCommitted: r,
+  resolvedRouteVersion: n
+}) {
+  const o = k(null), i = k(0);
+  return ne(() => {
+    n > i.current && (i.current = n, r()), e && o.current !== e && (o.current = e, t(e));
+  }, [e, t, r, n]), null;
+}
+class Pn extends ir {
   static getDerivedStateFromError(t) {
     return { error: t };
   }
   state = {};
+  componentDidCatch() {
+    this.props.onError();
+  }
   componentDidUpdate(t) {
     this.state.error !== void 0 && t.pathname !== this.props.pathname && this.setState({ error: void 0 });
   }
   render() {
-    return this.state.error !== void 0 ? this.props.Error ? f(this.props.Error, {
+    return this.state.error !== void 0 ? this.props.Error ? R(this.props.Error, {
       error: this.state.error,
       pathname: this.props.pathname,
-      status: F(this.state.error)
+      status: zt(this.state.error)
     }) : null : this.props.children;
   }
 }
-function F(e) {
-  return de(e) ? e.status : 500;
+function zt(e) {
+  return Rr(e) ? e.status : 500;
 }
-function S() {
+function F() {
   return {
     hash: window.location.hash,
     href: window.location.href,
@@ -788,42 +1830,172 @@ function S() {
     search: window.location.search
   };
 }
-async function H(e) {
+const qe = "__demiurge_scroll", Ke = "__demiurge_history_entry";
+let jt = 0;
+function wt() {
+  const e = Vt(window.history.state);
+  if (e) return e;
+  const t = ge(window.history.state);
+  return window.history.replaceState(t.state, "", window.location.href), t.key;
+}
+function ge(e) {
+  const t = `entry:${++jt}`;
+  return { key: t, state: we(e, t) };
+}
+function we(e, t = `entry:${++jt}`) {
+  return e && typeof e == "object" ? { ...e, [Ke]: t } : { [Ke]: t };
+}
+function Vt(e) {
+  if (!e || typeof e != "object") return;
+  const t = Reflect.get(e, Ke);
+  return typeof t == "string" ? t : void 0;
+}
+function qt() {
+  return { x: window.scrollX, y: window.scrollY };
+}
+function On(e, t = qt()) {
+  const r = window.history.state;
+  if (e && Vt(r) !== e) return;
+  const n = r && typeof r == "object" ? { ...r, [qe]: t } : { [qe]: t };
+  try {
+    window.history.replaceState(n, "", window.location.href);
+  } catch {
+  }
+}
+function _n() {
+  const e = window.history.state?.[qe];
+  return e && typeof e == "object" && typeof e.x == "number" && typeof e.y == "number" ? { x: e.x, y: e.y } : void 0;
+}
+function Fn(e, t) {
+  if (t.kind === "pop" && t.url.hash || e === !1)
+    return;
+  if (typeof e == "function") {
+    try {
+      e(t);
+    } catch {
+    }
+    return;
+  }
+  const r = t.kind === "pop" ? t.position?.x ?? 0 : 0, n = t.kind === "pop" ? t.position?.y ?? 0 : 0;
+  window.scrollTo?.(r, n);
+}
+async function Kt(e) {
   const t = new Headers(e.headers);
-  t.set("accept", "application/json"), t.set(O, ie);
+  t.set("accept", "application/json"), t.set(ut, vr);
   const r = await fetch(new Request(e, {
     credentials: "same-origin",
     headers: t
-  })), n = r.headers.get(O);
-  if (n === oe) {
-    const a = await r.json();
-    if (a.hasData !== !0)
+  })), n = r.headers.get(ut);
+  if (n === br) {
+    const o = await r.json();
+    if (o.hasData !== !0)
       throw new Error("Demiurge received malformed navigation route data.");
-    return { data: a.data, hasData: !0 };
+    return {
+      data: o.data,
+      document: o.document,
+      hasData: !0,
+      locale: o.locale,
+      url: r.url
+    };
   }
-  if (n === se)
-    return { hasData: !0 };
-  if (n === ce || !r.ok) {
-    const a = await Je(r), i = ue.includes(
+  if (n === Sr) {
+    const o = await vt(r);
+    return {
+      document: o?.document,
+      hasData: !0,
+      locale: o?.locale,
+      url: r.url
+    };
+  }
+  if (n === Er || !r.ok) {
+    const o = await vt(r), i = Ar.includes(
       r.status
-    ) ? r.status : 500;
-    throw le(i, {
-      detail: typeof a?.detail == "string" ? a.detail : void 0,
-      title: typeof a?.title == "string" ? a.title : void 0
+    ) ? r.status : 500, s = xr(i, {
+      detail: o?.error?.detail,
+      title: o?.error?.title
     });
+    throw o?.document && Wt.set(s, o.document), s;
   }
   throw new Error(
     "Demiurge expected a navigation data response from the application server."
   );
 }
-async function Je(e) {
+const Wt = /* @__PURE__ */ new WeakMap();
+async function vt(e) {
   try {
     return await e.json();
-  } catch {
+  } catch (t) {
+    if (t instanceof Error && t.message.includes("malformed versioned")) throw t;
     return;
   }
 }
-function Qe(e) {
+function Fe(e, t) {
+  if (t) return t;
+  if (!e) return "default";
+  let r = bt.get(e);
+  return r || (r = `form:${Un++}`, bt.set(e, r)), r;
+}
+const bt = /* @__PURE__ */ new WeakMap();
+let Un = 1;
+function Jt(e, t) {
+  const r = Gt(e, t);
+  if (!r) return !1;
+  const { action: n, enctype: o, method: i, target: s } = r;
+  if (!["POST", "PUT", "PATCH", "DELETE"].includes(i) || s && s.toLowerCase() !== "_self") return !1;
+  try {
+    if (new URL(n, window.location.href).origin !== window.location.origin) return !1;
+  } catch {
+    return !1;
+  }
+  return ["application/x-www-form-urlencoded", "multipart/form-data", "text/plain"].includes(o);
+}
+function Bn(e, t) {
+  if (!Jt(e, t)) return;
+  const { action: r, enctype: n, method: o } = Gt(e, t), i = t ? new FormData(e, t) : new FormData(e);
+  if (n === "multipart/form-data")
+    return { body: i, contentType: void 0, formData: i, method: o, url: r };
+  if (n === "application/x-www-form-urlencoded") {
+    const a = new URLSearchParams();
+    for (const [u, d] of i)
+      typeof d == "string" ? a.append(u, d) : a.append(u, d.name);
+    return {
+      body: a,
+      contentType: "application/x-www-form-urlencoded;charset=UTF-8",
+      formData: i,
+      method: o,
+      url: r
+    };
+  }
+  const s = [];
+  for (const [a, u] of i)
+    s.push(`${a}=${typeof u == "string" ? u : u.name}`);
+  return {
+    body: `${s.join(`\r
+`)}\r
+`,
+    contentType: "text/plain;charset=UTF-8",
+    formData: i,
+    method: o,
+    url: r
+  };
+}
+function Gt(e, t) {
+  if (!Hn(t)) return;
+  const r = t instanceof HTMLButtonElement || t instanceof HTMLInputElement ? t : void 0;
+  return {
+    action: (he(r, "formaction") ?? e.action) || window.location.href,
+    enctype: ((he(r, "formenctype") ?? e.enctype) || "application/x-www-form-urlencoded").toLowerCase(),
+    method: ((he(r, "formmethod") ?? e.method) || "get").toUpperCase(),
+    target: he(r, "formtarget") ?? e.target
+  };
+}
+function he(e, t) {
+  return e?.hasAttribute(t) ? e.getAttribute(t) ?? "" : void 0;
+}
+function Hn(e) {
+  return e ? e instanceof HTMLButtonElement ? !e.disabled && e.type === "submit" : e instanceof HTMLInputElement && !e.disabled && e.type === "submit" : !0;
+}
+function pe(e) {
   queueMicrotask(() => {
     if (!e) {
       window.scrollTo?.(0, 0);
@@ -838,45 +2010,74 @@ function Qe(e) {
     document.getElementById(t)?.scrollIntoView?.();
   });
 }
-function et(e) {
-  return e.button === 0 && !e.metaKey && !e.altKey && !e.ctrlKey && !e.shiftKey;
+function zn(e, t) {
+  if (e.defaultPrevented || e.button !== 0 || e.metaKey || e.altKey || e.ctrlKey || e.shiftKey || t.download !== void 0 && t.download !== !1 || t.target !== void 0 && t.target.toLowerCase() !== "_self")
+    return !1;
+  const r = new URL(t.to, window.location.href);
+  return (r.protocol === "http:" || r.protocol === "https:") && r.origin === window.location.origin;
 }
-const B = _({
+function jn(e, t) {
+  const r = t?.announce ?? "title";
+  if (r === !1) return;
+  let n;
+  try {
+    n = r === "title" ? e.title : r(e);
+  } catch {
+    return;
+  }
+  n && Vn(n);
+}
+function Vn(e) {
+  lr(e);
+}
+const Yt = We({
   navigation: "document",
+  submissionVersion: 0,
   push(e) {
     window.location.href = e;
+  },
+  getMutationNavigation() {
+    return { state: "idle" };
+  },
+  releaseMutationNavigation() {
+  },
+  async submitMutation(e) {
+    e.submit();
+  },
+  replace(e) {
+    window.location.replace(e);
   }
 });
-function tt() {
-  return W(B);
+function Ee() {
+  return Je(Yt);
 }
-function Lt({ className: e, id: t, policy: r, ...n }) {
-  const a = me(n, r);
-  return /* @__PURE__ */ z(
+function Go({ className: e, id: t, policy: r, ...n }) {
+  const o = Mr(n, r);
+  return /* @__PURE__ */ Et(
     "img",
     {
-      alt: a.alt,
+      alt: o.alt,
       className: e,
-      decoding: a.decoding,
-      fetchPriority: a.fetchPriority,
-      height: a.height,
+      decoding: o.decoding,
+      fetchPriority: o.fetchPriority,
+      height: o.height,
       id: t,
-      loading: a.loading,
-      sizes: a.sizes,
-      src: a.src,
-      srcSet: a.srcSet,
-      width: a.width
+      loading: o.loading,
+      sizes: o.sizes,
+      src: o.src,
+      srcSet: o.srcSet,
+      width: o.width
     }
   );
 }
-const rt = "https://js.sentry-cdn.com", zt = {
+const qn = "https://js.sentry-cdn.com", Yo = {
   /**
    * Plausible loads one script and posts events to its own API. The snippet
    * carries configuration in `data-domain`, so no inline code is involved.
    * `endpoint` accepts a same-origin path prefix for a proxied deployment.
    */
   plausible(e) {
-    const t = nt(e.domain), r = L(e.endpoint ?? "https://plausible.io");
+    const t = Kn(e.domain), r = St(e.endpoint ?? "https://plausible.io");
     return {
       consent: e.consent ?? !1,
       domain: t,
@@ -887,7 +2088,7 @@ const rt = "https://js.sentry-cdn.com", zt = {
       },
       provider: "plausible",
       scripts: [
-        A({
+        Me({
           dataApi: `${r.base}/api/event`,
           dataDomain: t,
           defer: !0,
@@ -905,8 +2106,8 @@ const rt = "https://js.sentry-cdn.com", zt = {
    * why the integration also declares a `connect-src` need.
    */
   sentry(e) {
-    const t = ot(e.dsn), r = it(
-      e.loaderHost ?? rt,
+    const t = Gn(e.dsn), r = Jn(
+      e.loaderHost ?? qn,
       "Sentry loader host"
     );
     return {
@@ -920,7 +2121,7 @@ const rt = "https://js.sentry-cdn.com", zt = {
       projectId: t.projectId,
       provider: "sentry",
       scripts: [
-        A({
+        Me({
           crossOrigin: "anonymous",
           needs: { connect: [t.origin] },
           purpose: "error-monitoring",
@@ -939,7 +2140,7 @@ const rt = "https://js.sentry-cdn.com", zt = {
    * to, and an optional same-origin entry script that starts the SDK.
    */
   openTelemetry(e) {
-    const t = L(e.endpoint), r = e.script;
+    const t = St(e.endpoint), r = e.script;
     if (r !== void 0 && !r.startsWith("/"))
       throw new Error(
         "OpenTelemetry browser instrumentation must be a same-origin script path."
@@ -951,7 +2152,7 @@ const rt = "https://js.sentry-cdn.com", zt = {
       needs: r ? { connect: [t.source], script: ["'self'"] } : { connect: [t.source] },
       provider: "opentelemetry",
       scripts: r ? [
-        A({
+        Me({
           needs: { connect: [t.source] },
           purpose: "observability",
           src: r,
@@ -965,8 +2166,8 @@ const rt = "https://js.sentry-cdn.com", zt = {
     const t = {};
     for (const r of e)
       for (const n of ["connect", "img", "script"]) {
-        const a = r.needs[n];
-        !a || a.length === 0 || (t[n] = [.../* @__PURE__ */ new Set([...t[n] ?? [], ...a])]);
+        const o = r.needs[n];
+        !o || o.length === 0 || (t[n] = [.../* @__PURE__ */ new Set([...t[n] ?? [], ...o])]);
       }
     return { security: { needs: t } };
   },
@@ -975,13 +2176,13 @@ const rt = "https://js.sentry-cdn.com", zt = {
     return e.flatMap((t) => [...t.scripts]);
   }
 };
-function nt(e) {
+function Kn(e) {
   const t = e.trim();
   if (!t || t.includes("/") || t.includes(" "))
     throw new Error("Analytics domain must be a hostname without a path.");
   return t;
 }
-function L(e) {
+function St(e) {
   if (e.startsWith("/")) {
     if (e.startsWith("//"))
       throw new Error("Analytics endpoint must not be a scheme-relative URL.");
@@ -990,10 +2191,10 @@ function L(e) {
       source: "'self'"
     };
   }
-  const t = at(e);
+  const t = Wn(e);
   return { base: t.origin, source: t.origin };
 }
-function at(e) {
+function Wn(e) {
   let t;
   try {
     t = new URL(e);
@@ -1004,7 +2205,7 @@ function at(e) {
     throw new Error("Analytics endpoint must use HTTPS.");
   return t;
 }
-function it(e, t) {
+function Jn(e, t) {
   let r;
   try {
     r = new URL(e);
@@ -1015,7 +2216,7 @@ function it(e, t) {
     throw new Error(`${t} must use HTTPS.`);
   return r.origin;
 }
-function ot(e) {
+function Gn(e) {
   let t;
   try {
     t = new URL(e);
@@ -1037,143 +2238,447 @@ function ot(e) {
     publicKey: t.username
   };
 }
-function Mt(e = {}) {
+function Zo(e = {}) {
   return {
     async request(t) {
-      await E({ kind: "request", signal: t }, e);
+      await me({ kind: "request", signal: t }, e);
     },
     async serverStart(t = {}) {
-      await E({ kind: "server-start", signal: t }, e);
+      await me({ kind: "server-start", signal: t }, e);
     },
     async trace(t) {
-      await E({ kind: "trace", signal: t }, e);
+      await me({ kind: "trace", signal: t }, e);
     },
     async reportWebVitals(t) {
-      await E({ kind: "web-vital", signal: t }, e);
+      await me({ kind: "web-vital", signal: t }, e);
     }
   };
 }
-async function E(e, t) {
+async function me(e, t) {
   await t.onEvent?.(e), e.kind === "request" ? await t.request?.(e.signal) : e.kind === "server-start" ? await t.serverStart?.(e.signal) : e.kind === "trace" ? await t.trace?.(e.signal) : await t.webVitals?.(e.signal);
 }
+const Yn = [
+  "CLS",
+  "FCP",
+  "FID",
+  "INP",
+  "LCP",
+  "TTFB"
+], Ue = [
+  "CLS",
+  "FCP",
+  "INP",
+  "LCP",
+  "TTFB"
+], Zn = new Set(Yn), Qn = /* @__PURE__ */ new Set([
+  "back-forward",
+  "back-forward-cache",
+  "navigate",
+  "prerender",
+  "reload",
+  "restore"
+]), Xn = /* @__PURE__ */ new Set([
+  "good",
+  "needs-improvement",
+  "poor"
+]);
+function eo(e) {
+  return typeof e == "string" && Zn.has(e);
+}
+function to(e) {
+  return typeof e == "string" && Qn.has(e);
+}
+function ro(e) {
+  return typeof e == "string" && Xn.has(e);
+}
+const no = {
+  CLS: { good: 0.1, poor: 0.25 },
+  FCP: { good: 1800, poor: 3e3 },
+  FID: { good: 100, poor: 300 },
+  INP: { good: 200, poor: 500 },
+  LCP: { good: 2500, poor: 4e3 },
+  TTFB: { good: 800, poor: 1800 }
+};
+function oo(e, t) {
+  const r = no[e];
+  return t <= r.good ? "good" : t > r.poor ? "poor" : "needs-improvement";
+}
+const Zt = 32;
+function Qo(e) {
+  const t = so(e.endpoint), r = co(e.metrics), n = uo(e.sampleRate);
+  return {
+    endpoint: t.url,
+    kind: "web-vitals",
+    metrics: r,
+    needs: { connect: [t.source] },
+    sampleRate: n
+  };
+}
+function Xo(...e) {
+  const t = /* @__PURE__ */ new Set();
+  for (const r of e)
+    for (const n of r.needs.connect ?? [])
+      t.add(n);
+  return t.size === 0 ? { security: { needs: {} } } : { security: { needs: { connect: [...t] } } };
+}
+async function ei(e, t = {}) {
+  const r = t.maxMetrics ?? Zt;
+  let n;
+  try {
+    n = await e.json();
+  } catch {
+    return { ok: !1, reason: "unreadable-body" };
+  }
+  return io(n, r);
+}
+function io(e, t = Zt) {
+  if (!Ze(e) || !Array.isArray(e.metrics))
+    return { ok: !1, reason: "invalid-payload" };
+  if (e.metrics.length > t)
+    return { ok: !1, reason: "too-many-metrics" };
+  const r = [];
+  for (const n of e.metrics) {
+    const o = ao(n);
+    if (!o)
+      return { ok: !1, reason: "invalid-payload" };
+    r.push(o);
+  }
+  return { metrics: r, ok: !0 };
+}
+function ao(e) {
+  if (!Ze(e))
+    return;
+  const { id: t, name: r, navigationType: n, rating: o, url: i, value: s } = e;
+  if (!(typeof t != "string" || t.length === 0 || t.length > 128) && !(!eo(r) || !to(n)) && ro(o) && !(typeof i != "string" || i.length === 0 || i.length > 2048) && !(typeof s != "number" || !Number.isFinite(s) || s < 0))
+    return { id: t, name: r, navigationType: n, rating: o, url: i, value: s };
+}
+function so(e) {
+  if (e.startsWith("/")) {
+    if (e.startsWith("//"))
+      throw new Error(
+        "The web vitals endpoint must not be a scheme-relative URL."
+      );
+    return { source: "'self'", url: e };
+  }
+  let t;
+  try {
+    t = new URL(e);
+  } catch {
+    throw new Error(
+      "The web vitals endpoint must be a same-origin path or an absolute URL."
+    );
+  }
+  if (t.protocol !== "https:")
+    throw new Error("The web vitals endpoint must use HTTPS.");
+  return { source: t.origin, url: t.href };
+}
+function co(e) {
+  if (!e)
+    return Ue;
+  const t = [];
+  for (const r of e) {
+    if (!Ue.includes(r))
+      throw new Error(
+        `The browser collector does not measure ${JSON.stringify(r)}. Demiurge collects ${Ue.join(", ")}.`
+      );
+    t.includes(r) || t.push(r);
+  }
+  if (t.length === 0)
+    throw new Error("A web vitals integration must collect one metric or more.");
+  return t;
+}
+function uo(e) {
+  if (e === void 0)
+    return 1;
+  if (!Number.isFinite(e) || e < 0 || e > 1)
+    throw new Error("The web vitals sample rate must be between 0 and 1.");
+  return e;
+}
+const lo = 1e3, fo = 5e3, ho = 40;
+function po(e, t = {}) {
+  if (typeof window > "u" || typeof PerformanceObserver > "u")
+    return () => {
+    };
+  const r = t.random ?? Math.random;
+  if (e.sampleRate < 1 && r() >= e.sampleRate)
+    return () => {
+    };
+  const n = t.transport ?? mo, o = new Set(e.metrics), i = [], s = [], a = /* @__PURE__ */ new Set();
+  let u = yo(), d = 0, v = 0, A = 0, h = 0, p, E, g = !1;
+  const b = (w, $) => {
+    if (g || a.has(w))
+      return;
+    a.add(w);
+    const C = {
+      id: `${w}-${Date.now()}-${Math.floor(r() * 1e9)}`,
+      name: w,
+      navigationType: u,
+      rating: oo(w, $),
+      url: window.location.href,
+      value: Math.round($ * 1e3) / 1e3
+    };
+    s.push(C), t.onReport?.(C);
+  }, m = () => {
+    if (g || (p !== void 0 && b("LCP", p), E !== void 0 && b("INP", E), o.has("CLS") && b("CLS", d), s.length === 0))
+      return;
+    const w = s.splice(0, s.length);
+    n(e.endpoint, { metrics: w });
+  }, T = () => {
+    document.visibilityState === "hidden" && m();
+  }, H = (w) => {
+    w.persisted && (u = "back-forward-cache", a.clear(), d = 0, v = 0, A = 0, h = 0, p = void 0, E = void 0, o.has("FCP") && b("FCP", performance.now() - w.timeStamp));
+  };
+  if (o.has("TTFB")) {
+    const w = Qt();
+    w && w.responseStart > 0 && b("TTFB", w.responseStart);
+  }
+  return o.has("FCP") && ye(i, { buffered: !0, type: "paint" }, (w) => {
+    for (const $ of w)
+      $.name === "first-contentful-paint" && b("FCP", $.startTime);
+  }), o.has("LCP") && ye(
+    i,
+    { buffered: !0, type: "largest-contentful-paint" },
+    (w) => {
+      const $ = w.at(-1);
+      $ && (p = $.startTime);
+    }
+  ), o.has("CLS") && ye(i, { buffered: !0, type: "layout-shift" }, (w) => {
+    for (const $ of w) {
+      const C = $;
+      if (C.hadRecentInput)
+        continue;
+      v > 0 && C.startTime - h < lo && C.startTime - A < fo ? v += C.value : (v = C.value, A = C.startTime), h = C.startTime, d = Math.max(d, v);
+    }
+  }), o.has("INP") && ye(
+    i,
+    {
+      buffered: !0,
+      durationThreshold: ho,
+      type: "event"
+    },
+    (w) => {
+      for (const $ of w)
+        E = Math.max(E ?? 0, $.duration);
+    }
+  ), document.addEventListener("visibilitychange", T), window.addEventListener("pagehide", m), window.addEventListener("pageshow", H), () => {
+    m(), g = !0;
+    for (const w of i)
+      w.disconnect();
+    document.removeEventListener("visibilitychange", T), window.removeEventListener("pagehide", m), window.removeEventListener("pageshow", H);
+  };
+}
+function ti({ integration: e, onReport: t, transport: r }) {
+  return Y(
+    () => po(e, { onReport: t, transport: r }),
+    [e, t, r]
+  ), null;
+}
+function mo(e, t) {
+  const r = JSON.stringify(t);
+  if (typeof navigator < "u" && typeof navigator.sendBeacon == "function") {
+    const n = new Blob([r], { type: "application/json" });
+    if (navigator.sendBeacon(e, n))
+      return;
+  }
+  fetch(e, {
+    body: r,
+    headers: { "content-type": "application/json" },
+    keepalive: !0,
+    method: "POST"
+  }).catch(() => {
+  });
+}
+function ye(e, t, r) {
+  try {
+    const n = new PerformanceObserver((o) => r(o.getEntries()));
+    n.observe(t), e.push(n);
+  } catch {
+    return;
+  }
+}
+function Qt() {
+  if (!(typeof performance > "u"))
+    return performance.getEntriesByType("navigation")[0];
+}
+function yo() {
+  const e = Qt();
+  return e?.type === "back_forward" ? "back-forward" : e?.type === "reload" || e?.type === "prerender" ? e.type : "navigate";
+}
 export {
-  ke as EnvValidationError,
-  ue as HTTP_ERROR_STATUSES,
-  Qt as HttpError,
-  Lt as Image,
-  Ot as Link,
-  jt as Script,
-  St as action,
-  Et as actionInput,
-  zt as analytics,
-  Ft as assertAdapterCapabilities,
-  er as auditScriptDependencies,
-  Ht as checkAdapterCapabilities,
-  qe as checkWebSocketOrigin,
-  tr as createCache,
-  rr as createCorsHeaders,
-  nr as createCsrfCookie,
-  ar as createCsrfToken,
-  We as createFileRouter,
-  ir as createInvalidation,
-  or as createMemoryCache,
-  sr as createMemoryCacheStore,
-  mt as createMemoryIdempotencyStore,
-  cr as createMemoryRateLimitStore,
-  ur as createRequestHandler,
-  lr as createSecurityAudit,
-  fr as createSecurityHeaders,
-  It as createSecurityReportHandler,
-  dr as cspHash,
-  mr as cspNonce,
-  Xr as defaultFontPath,
-  Bt as defineAdapter,
-  $t as defineEnvSchema,
-  Jr as defineFonts,
-  Qr as defineImages,
-  Mt as defineInstrumentation,
-  qt as defineLinks,
-  hr as defineMetadata,
-  At as defineMiddleware,
-  yt as defineOgImage,
-  wt as defineRobots,
-  pr as defineRoutePolicy,
-  _t as defineScripts,
-  gr as defineSecurityPolicy,
-  pt as defineSitemap,
-  wr as defineTags,
-  yr as enforceAllowedMethods,
-  vr as enforceCsrfProtection,
-  br as enforceRateLimit,
-  Sr as enforceRequestSecurity,
-  Nt as enforceWebSocketOrigin,
-  Tt as env,
-  en as font,
-  tn as fontAssetFileName,
-  rn as fontAssetUrl,
-  nn as fontLinks,
-  an as fontMediaType,
-  on as fontPreloadLinks,
-  sn as fontSources,
-  cn as fontStylesheetUrl,
-  Vt as getScriptWorker,
-  Er as handleRequestWithManifest,
-  re as href,
-  Rr as html,
-  le as httpError,
-  Ct as hydrateFileRouter,
-  un as isAllowedImageSource,
-  de as isHttpError,
-  Ar as issueCsrfToken,
-  xr as json,
-  $r as jsonl,
-  kr as link,
-  Tr as mergeRoutePolicies,
-  Ir as mergeRouteSecurityPolicies,
-  Dr as mergeSecurityPolicies,
-  Nr as meta,
-  Wt as modulePreload,
-  Cr as notFound,
-  Rt as page,
-  $ as parseBodySize,
-  C as parseCacheDuration,
-  Or as parseCookieHeader,
-  ln as parseImageOptimizerRequest,
-  Lr as parseRateLimitWindow,
-  me as planImageTransform,
-  Kt as preconnect,
-  Gt as preload,
-  zr as query,
-  Mr as redirect,
-  fn as renderFontFaceCss,
-  bt as renderOgImageResponse,
-  ye as renderOgImageSvg,
-  Zt as renderPageResponse,
-  vt as renderRobots,
-  gt as renderSitemap,
-  Yt as resolveLinks,
-  Pr as resolveMetadata,
-  Xt as resolveScripts,
-  J as response,
-  ht as runIdempotentMutation,
-  A as script,
-  Ur as security,
-  X as serializeCacheKey,
-  jr as serializeCacheNamespace,
-  Fr as serializeCacheTag,
-  Hr as serverTiming,
-  Br as sse,
-  N as startDeferredScripts,
-  qr as stream,
-  _r as structuredData,
-  Vr as tag,
-  Wr as text,
-  Q as toResponse,
-  Kr as validateCorsPolicy,
-  kt as validateEnv,
-  Gr as validateRateLimitPolicy,
-  Zr as validateRouteModules,
-  Dt as validateUploads,
-  xt as webhook
+  Ue as COLLECTED_WEB_VITAL_NAMES,
+  Si as CacheNotFoundError,
+  La as DEFAULT_CONTENT_TYPE,
+  Za as EnvValidationError,
+  oi as FRAMEWORK_TRUSTED_TYPES_POLICY,
+  Ko as Form,
+  Ar as HTTP_ERROR_STATUSES,
+  Ei as HttpError,
+  Go as Image,
+  qo as Link,
+  mr as MUTATION_REQUEST_HEADER,
+  pr as MUTATION_REQUEST_VALUE,
+  xt as MUTATION_RESPONSE_MEDIA_TYPE,
+  Wo as MutationSubmit,
+  Ai as MutationValidationError,
+  zo as RouteFocusBoundary,
+  ii as Script,
+  rn as SessionStoreConflictError,
+  mt as SessionStoreUnavailableError,
+  Yn as WEB_VITAL_NAMES,
+  no as WEB_VITAL_THRESHOLDS,
+  ti as WebVitals,
+  Yo as analytics,
+  Be as applicationPathname,
+  xi as applyFetchMetadataVary,
+  ki as applyLocalizedMetadata,
+  ai as assertAdapterCapabilities,
+  Ri as auditScriptDependencies,
+  Ti as cacheNotFound,
+  si as checkAdapterCapabilities,
+  Mi as checkFetchMetadata,
+  wn as checkWebSocketOrigin,
+  po as collectWebVitals,
+  Ia as contentTypeForExtension,
+  Ci as createCache,
+  $i as createCorsHeaders,
+  Ni as createCsrfCookie,
+  Li as createCsrfToken,
+  _o as createEncryptedCookieSession,
+  Mn as createFileRouter,
+  ci as createFrameworkScriptUrl,
+  Ii as createInvalidation,
+  Di as createMemoryCache,
+  Pi as createMemoryCacheStore,
+  $o as createMemoryIdempotencyStore,
+  Oi as createMemoryRateLimitStore,
+  ss as createMemorySessionStore,
+  An as createMutationAction,
+  _i as createRequestHandler,
+  Se as createSecureCookie,
+  Fi as createSecurityAudit,
+  Ui as createSecurityHeaders,
+  Uo as createSecurityReportHandler,
+  Fo as createSessionManager,
+  Oo as createSignedCookieSession,
+  Bi as cspHash,
+  Hi as cspNonce,
+  Oa as defaultFontPath,
+  ui as defineAdapter,
+  Qa as defineEnvSchema,
+  _a as defineFonts,
+  Fa as defineImages,
+  Zo as defineInstrumentation,
+  li as defineLinks,
+  zi as defineLocales,
+  ji as defineMetadata,
+  Io as defineMiddleware,
+  To as defineOgImage,
+  Ro as defineRobots,
+  Vi as defineRoutePolicy,
+  di as defineScripts,
+  qi as defineSecurityPolicy,
+  xo as defineSitemap,
+  Ki as defineTags,
+  Qo as defineWebVitals,
+  Xa as deserializeEnvSchema,
+  Wi as enforceAllowedMethods,
+  Ji as enforceCsrfProtection,
+  Gi as enforceFetchMetadataPolicy,
+  Yi as enforceRateLimit,
+  Zi as enforceRequestSecurity,
+  Ho as enforceWebSocketOrigin,
+  es as env,
+  Ua as font,
+  Ba as fontAssetFileName,
+  Ha as fontAssetUrl,
+  za as fontLinks,
+  ja as fontMediaType,
+  Va as fontPreloadLinks,
+  qa as fontSources,
+  Ka as fontStylesheetUrl,
+  fi as getRequestClientAddress,
+  hi as getScriptWorker,
+  Qi as handleRequestWithManifest,
+  Qe as href,
+  Xi as html,
+  xr as httpError,
+  Vo as hydrateFileRouter,
+  Wa as isAllowedImageSource,
+  ea as isCacheNotFoundError,
+  Da as isContentHashedFileName,
+  Rr as isHttpError,
+  ta as issueCsrfToken,
+  ra as json,
+  na as jsonl,
+  oa as link,
+  ia as localeDirection,
+  Xe as localizeHref,
+  aa as mergeRoutePolicies,
+  sa as mergeRouteSecurityPolicies,
+  ca as mergeSecurityPolicies,
+  ua as meta,
+  pi as modulePreload,
+  la as mutation,
+  da as mutationInput,
+  fa as notFound,
+  Lo as page,
+  Ye as parseBodySize,
+  ct as parseCacheDuration,
+  Ge as parseCookieHeader,
+  Ja as parseImageOptimizerRequest,
+  ha as parseRateLimitWindow,
+  io as parseWebVitalsBeacon,
+  Mr as planImageTransform,
+  mi as preconnect,
+  yi as preload,
+  pa as query,
+  ts as readEnv,
+  Po as readSecureCookie,
+  ei as readWebVitalsBeacon,
+  ma as redirect,
+  Ga as renderFontFaceCss,
+  Co as renderOgImageResponse,
+  $r as renderOgImageSvg,
+  gi as renderPageResponse,
+  Mo as renderRobots,
+  ko as renderSitemap,
+  wi as resolveLinks,
+  gr as resolveLocale,
+  ya as resolveMetadata,
+  vi as resolveScripts,
+  ga as response,
+  No as runIdempotentMutation,
+  Me as script,
+  ce as secureCookieName,
+  wa as security,
+  mo as sendWebVitalsBeacon,
+  dr as serializeCacheKey,
+  va as serializeCacheNamespace,
+  ba as serializeCacheTag,
+  rs as serializeEnvSchema,
+  cs as serializeSessionNamespace,
+  Sa as serverTiming,
+  Ea as sse,
+  st as startDeferredScripts,
+  Aa as stream,
+  xa as structuredData,
+  ka as tag,
+  Ra as text,
+  Ta as toResponse,
+  ns as unstable_resetEnvironment,
+  os as unstable_startEnvironment,
+  Jo as useFormNavigation,
+  jo as useMutationAction,
+  In as useNavigation,
+  Sn as useRouteFocusBoundary,
+  Ma as validateCorsPolicy,
+  is as validateEnv,
+  Ca as validateRateLimitPolicy,
+  $a as validateRouteModules,
+  Vr as validateSecureCookie,
+  Bo as validateUploads,
+  oo as webVitalRating,
+  Xo as webVitalsPolicy,
+  Do as webhook
 };
 //# sourceMappingURL=index.js.map