@demiurgejs/core 0.2.0-beta.2 → 0.2.0-beta.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (232) hide show
  1. package/README.md +13 -11
  2. package/bin/demiurge.mjs +30 -12
  3. package/dist/adapter/testing.js.map +1 -1
  4. package/dist/browser/file-router.d.ts +388 -5
  5. package/dist/browser/file-router.d.ts.map +1 -1
  6. package/dist/browser/focus.d.ts +20 -0
  7. package/dist/browser/focus.d.ts.map +1 -0
  8. package/dist/browser/index.d.ts +7 -1
  9. package/dist/browser/index.d.ts.map +1 -1
  10. package/dist/browser/mutation-action.d.ts +81 -0
  11. package/dist/browser/mutation-action.d.ts.map +1 -0
  12. package/dist/chunks/document-shell-CpJnFtSC.js +36 -0
  13. package/dist/chunks/document-shell-CpJnFtSC.js.map +1 -0
  14. package/dist/chunks/env-startup-DOBYWlZD.js +257 -0
  15. package/dist/chunks/env-startup-DOBYWlZD.js.map +1 -0
  16. package/dist/chunks/{image-codec-BGTx_t5K.js → image-codec-BmzWnH6W.js} +2 -2
  17. package/dist/chunks/{image-codec-BGTx_t5K.js.map → image-codec-BmzWnH6W.js.map} +1 -1
  18. package/dist/chunks/{images-B9MqcjSA.js → images-BQ80950B.js} +99 -91
  19. package/dist/chunks/images-BQ80950B.js.map +1 -0
  20. package/dist/chunks/index-BVk9zWbe.js +832 -0
  21. package/dist/chunks/index-BVk9zWbe.js.map +1 -0
  22. package/dist/chunks/manifest-vO6c0G0W.js +19 -0
  23. package/dist/chunks/manifest-vO6c0G0W.js.map +1 -0
  24. package/dist/chunks/plugin-BQgMiHxa.js +1827 -0
  25. package/dist/chunks/plugin-BQgMiHxa.js.map +1 -0
  26. package/dist/chunks/session-store-ChModVcq.js +92 -0
  27. package/dist/chunks/session-store-ChModVcq.js.map +1 -0
  28. package/dist/chunks/static-files-ehaD1kE7.js +51 -0
  29. package/dist/chunks/static-files-ehaD1kE7.js.map +1 -0
  30. package/dist/chunks/{streaming-BQ1bykDo.js → streaming-BEbPN7Uk.js} +163 -163
  31. package/dist/chunks/streaming-BEbPN7Uk.js.map +1 -0
  32. package/dist/chunks/testing-DueXbMo4.js +4167 -0
  33. package/dist/chunks/testing-DueXbMo4.js.map +1 -0
  34. package/dist/chunks/vite-DO70kZA6.js +259 -0
  35. package/dist/chunks/vite-DO70kZA6.js.map +1 -0
  36. package/dist/cli.d.ts +17 -25
  37. package/dist/cli.d.ts.map +1 -1
  38. package/dist/cli.js +159 -124
  39. package/dist/cli.js.map +1 -1
  40. package/dist/config/define.d.ts +3 -0
  41. package/dist/config/define.d.ts.map +1 -0
  42. package/dist/config/index.d.ts +7 -0
  43. package/dist/config/index.d.ts.map +1 -0
  44. package/dist/config/index.js +78 -0
  45. package/dist/config/index.js.map +1 -0
  46. package/dist/config/load.d.ts +12 -0
  47. package/dist/config/load.d.ts.map +1 -0
  48. package/dist/config/types.d.ts +64 -0
  49. package/dist/config/types.d.ts.map +1 -0
  50. package/dist/config/validate.d.ts +9 -0
  51. package/dist/config/validate.d.ts.map +1 -0
  52. package/dist/config/vite.d.ts +12 -0
  53. package/dist/config/vite.d.ts.map +1 -0
  54. package/dist/data/cache.d.ts +10 -0
  55. package/dist/data/cache.d.ts.map +1 -1
  56. package/dist/data/idempotency.d.ts.map +1 -1
  57. package/dist/data/index.d.ts +3 -1
  58. package/dist/data/index.d.ts.map +1 -1
  59. package/dist/data/testing.d.ts.map +1 -1
  60. package/dist/data/testing.js +94 -72
  61. package/dist/data/testing.js.map +1 -1
  62. package/dist/data/tiered.d.ts +7 -0
  63. package/dist/data/tiered.d.ts.map +1 -0
  64. package/dist/deployment/testing.d.ts +25 -0
  65. package/dist/deployment/testing.d.ts.map +1 -0
  66. package/dist/deployment/testing.js +171 -0
  67. package/dist/deployment/testing.js.map +1 -0
  68. package/dist/document/deferred-scripts.d.ts.map +1 -1
  69. package/dist/document/hydration.d.ts +9 -0
  70. package/dist/document/hydration.d.ts.map +1 -1
  71. package/dist/document/index.d.ts +5 -2
  72. package/dist/document/index.d.ts.map +1 -1
  73. package/dist/document/metadata.d.ts +8 -0
  74. package/dist/document/metadata.d.ts.map +1 -1
  75. package/dist/document/navigation.d.ts +28 -0
  76. package/dist/document/navigation.d.ts.map +1 -0
  77. package/dist/document/render.d.ts +3 -1
  78. package/dist/document/render.d.ts.map +1 -1
  79. package/dist/document/seo.d.ts.map +1 -1
  80. package/dist/document/trusted-types.d.ts +10 -0
  81. package/dist/document/trusted-types.d.ts.map +1 -0
  82. package/dist/edge/assets.d.ts.map +1 -1
  83. package/dist/edge/index.js +55 -73
  84. package/dist/edge/index.js.map +1 -1
  85. package/dist/index.d.ts +15 -13
  86. package/dist/index.d.ts.map +1 -1
  87. package/dist/index.js +2078 -573
  88. package/dist/index.js.map +1 -1
  89. package/dist/internal/testing.js +11 -11
  90. package/dist/kv/index.d.ts +4 -0
  91. package/dist/kv/index.d.ts.map +1 -1
  92. package/dist/kv/index.js +180 -60
  93. package/dist/kv/index.js.map +1 -1
  94. package/dist/kv/rate-limit-store.d.ts +8 -0
  95. package/dist/kv/rate-limit-store.d.ts.map +1 -0
  96. package/dist/kv/session-store.d.ts +20 -0
  97. package/dist/kv/session-store.d.ts.map +1 -0
  98. package/dist/kv/store.d.ts.map +1 -1
  99. package/dist/manifest.d.ts +10 -0
  100. package/dist/manifest.d.ts.map +1 -0
  101. package/dist/node/http.d.ts.map +1 -1
  102. package/dist/node/image.d.ts.map +1 -1
  103. package/dist/node/index.d.ts +3 -0
  104. package/dist/node/index.d.ts.map +1 -1
  105. package/dist/node/index.js +251 -178
  106. package/dist/node/index.js.map +1 -1
  107. package/dist/node/serve.d.ts +47 -0
  108. package/dist/node/serve.d.ts.map +1 -0
  109. package/dist/node/static.d.ts.map +1 -1
  110. package/dist/node/streaming.d.ts.map +1 -1
  111. package/dist/platform/fonts.d.ts.map +1 -1
  112. package/dist/platform/image-url.d.ts.map +1 -1
  113. package/dist/platform/images.d.ts.map +1 -1
  114. package/dist/platform/index.d.ts +5 -1
  115. package/dist/platform/index.d.ts.map +1 -1
  116. package/dist/platform/observability.d.ts +2 -1
  117. package/dist/platform/observability.d.ts.map +1 -1
  118. package/dist/platform/url.d.ts +19 -0
  119. package/dist/platform/url.d.ts.map +1 -0
  120. package/dist/platform/web-vitals-client.d.ts +32 -0
  121. package/dist/platform/web-vitals-client.d.ts.map +1 -0
  122. package/dist/platform/web-vitals.d.ts +78 -0
  123. package/dist/platform/web-vitals.d.ts.map +1 -0
  124. package/dist/redis/index.d.ts +4 -0
  125. package/dist/redis/index.d.ts.map +1 -1
  126. package/dist/redis/index.js +209 -54
  127. package/dist/redis/index.js.map +1 -1
  128. package/dist/redis/rate-limit-store.d.ts +8 -0
  129. package/dist/redis/rate-limit-store.d.ts.map +1 -0
  130. package/dist/redis/session-store.d.ts +9 -0
  131. package/dist/redis/session-store.d.ts.map +1 -0
  132. package/dist/redis/store.d.ts.map +1 -1
  133. package/dist/route/index.d.ts +2 -2
  134. package/dist/route/index.d.ts.map +1 -1
  135. package/dist/route/middleware.d.ts.map +1 -1
  136. package/dist/route/mutation.d.ts +97 -0
  137. package/dist/route/mutation.d.ts.map +1 -0
  138. package/dist/route/response.d.ts.map +1 -1
  139. package/dist/route/types.d.ts +6 -1
  140. package/dist/route/types.d.ts.map +1 -1
  141. package/dist/router/index.d.ts +1 -1
  142. package/dist/router/index.d.ts.map +1 -1
  143. package/dist/router/manifest.d.ts +9 -0
  144. package/dist/router/manifest.d.ts.map +1 -1
  145. package/dist/router/navigation-data.d.ts +9 -1
  146. package/dist/router/navigation-data.d.ts.map +1 -1
  147. package/dist/routing/generate.d.ts +3 -0
  148. package/dist/routing/generate.d.ts.map +1 -1
  149. package/dist/routing/index.d.ts +3 -1
  150. package/dist/routing/index.d.ts.map +1 -1
  151. package/dist/routing/locale.d.ts +43 -0
  152. package/dist/routing/locale.d.ts.map +1 -0
  153. package/dist/routing/types.d.ts +12 -0
  154. package/dist/routing/types.d.ts.map +1 -1
  155. package/dist/security/cookie-session.d.ts +43 -0
  156. package/dist/security/cookie-session.d.ts.map +1 -0
  157. package/dist/security/cookies.d.ts +26 -0
  158. package/dist/security/cookies.d.ts.map +1 -0
  159. package/dist/security/csrf.d.ts +1 -1
  160. package/dist/security/csrf.d.ts.map +1 -1
  161. package/dist/security/env-startup.d.ts +15 -0
  162. package/dist/security/env-startup.d.ts.map +1 -0
  163. package/dist/security/env.d.ts +25 -6
  164. package/dist/security/env.d.ts.map +1 -1
  165. package/dist/security/fetch-metadata.d.ts +29 -0
  166. package/dist/security/fetch-metadata.d.ts.map +1 -0
  167. package/dist/security/index.d.ts +14 -2
  168. package/dist/security/index.d.ts.map +1 -1
  169. package/dist/security/policy.d.ts.map +1 -1
  170. package/dist/security/rate-limit.d.ts +6 -3
  171. package/dist/security/rate-limit.d.ts.map +1 -1
  172. package/dist/security/report.d.ts.map +1 -1
  173. package/dist/security/request.d.ts.map +1 -1
  174. package/dist/security/session-manager.d.ts +32 -0
  175. package/dist/security/session-manager.d.ts.map +1 -0
  176. package/dist/security/session-store.d.ts +51 -0
  177. package/dist/security/session-store.d.ts.map +1 -0
  178. package/dist/security/testing.d.ts +10 -0
  179. package/dist/security/testing.d.ts.map +1 -0
  180. package/dist/security/testing.js +145 -0
  181. package/dist/security/testing.js.map +1 -0
  182. package/dist/security/types.d.ts +73 -3
  183. package/dist/security/types.d.ts.map +1 -1
  184. package/dist/server/document-shell.d.ts.map +1 -1
  185. package/dist/server/errors.d.ts +1 -0
  186. package/dist/server/errors.d.ts.map +1 -1
  187. package/dist/server/index.d.ts +2 -1
  188. package/dist/server/index.d.ts.map +1 -1
  189. package/dist/server/not-found.d.ts +1 -0
  190. package/dist/server/not-found.d.ts.map +1 -1
  191. package/dist/server/render-tree.d.ts.map +1 -1
  192. package/dist/server/request-handler.d.ts +10 -2
  193. package/dist/server/request-handler.d.ts.map +1 -1
  194. package/dist/server/request-metadata.d.ts +1 -0
  195. package/dist/server/request-metadata.d.ts.map +1 -1
  196. package/dist/server/ssr.d.ts +2 -0
  197. package/dist/server/ssr.d.ts.map +1 -1
  198. package/dist/static/index.d.ts +2 -0
  199. package/dist/static/index.d.ts.map +1 -1
  200. package/dist/static/index.js +380 -363
  201. package/dist/static/index.js.map +1 -1
  202. package/dist/static/preview.d.ts.map +1 -1
  203. package/dist/static/vercel.d.ts +11 -2
  204. package/dist/static/vercel.d.ts.map +1 -1
  205. package/dist/static-files.d.ts +12 -0
  206. package/dist/static-files.d.ts.map +1 -1
  207. package/dist/type-guards.d.ts +19 -0
  208. package/dist/type-guards.d.ts.map +1 -0
  209. package/dist/vite/env-boundary.d.ts +14 -0
  210. package/dist/vite/env-boundary.d.ts.map +1 -0
  211. package/dist/vite/index.d.ts +8 -3
  212. package/dist/vite/index.d.ts.map +1 -1
  213. package/dist/vite/index.js +22 -1196
  214. package/dist/vite/index.js.map +1 -1
  215. package/dist/vite/plugin.d.ts +8 -1
  216. package/dist/vite/plugin.d.ts.map +1 -1
  217. package/dist/vite/policy-verification.d.ts.map +1 -1
  218. package/dist/vite/route-audit.d.ts +50 -0
  219. package/dist/vite/route-audit.d.ts.map +1 -0
  220. package/package.json +19 -6
  221. package/dist/chunks/document-shell-D1xo6cEA.js +0 -35
  222. package/dist/chunks/document-shell-D1xo6cEA.js.map +0 -1
  223. package/dist/chunks/images-B9MqcjSA.js.map +0 -1
  224. package/dist/chunks/request-metadata-D5NrT8ks.js +0 -642
  225. package/dist/chunks/request-metadata-D5NrT8ks.js.map +0 -1
  226. package/dist/chunks/static-files-DUjHw-4H.js +0 -11
  227. package/dist/chunks/static-files-DUjHw-4H.js.map +0 -1
  228. package/dist/chunks/streaming-BQ1bykDo.js.map +0 -1
  229. package/dist/chunks/testing-B_iMFYz_.js +0 -3321
  230. package/dist/chunks/testing-B_iMFYz_.js.map +0 -1
  231. package/dist/route/action.d.ts +0 -33
  232. package/dist/route/action.d.ts.map +0 -1
@@ -1,3321 +0,0 @@
1
- import { w as $t, v as kt, x as _e, y as Ve, e as Je, z as Dt, A as Nt, l as Ot, a as Lt } from "./request-metadata-D5NrT8ks.js";
2
- import { createElement as fe } from "react";
3
- import { renderToString as Ke } from "react-dom/server";
4
- import { jsxs as I, jsx as M } from "react/jsx-runtime";
5
- const Ae = ["build", "private", "public"], It = {
6
- app: "demiurge-memory",
7
- environment: "local",
8
- schemaVersion: 1
9
- }, Mt = 1e4, Ut = 3e4;
10
- function ni(e) {
11
- return (...t) => ({
12
- fn: () => e.fn(...t),
13
- key: e.key(...t),
14
- scope: e.scope,
15
- staleWhileRevalidate: e.staleWhileRevalidate,
16
- tags: e.tags?.(...t),
17
- ttl: e.ttl
18
- });
19
- }
20
- function si(e) {
21
- return { id: e };
22
- }
23
- function ii(e) {
24
- return e;
25
- }
26
- function Ye(e) {
27
- const t = e.now ?? Date.now, r = Wt(e.refreshLeaseTtl), n = Ze(e.namespace), s = /* @__PURE__ */ new Map(), i = /* @__PURE__ */ new Map();
28
- return {
29
- async get(o) {
30
- const a = o.scope ?? "request";
31
- if (a === "none")
32
- return await o.fn();
33
- const c = $e(o.key);
34
- if (a === "request")
35
- return await Ft(s, c, o, t);
36
- const u = ke(n, a, c), f = (o.tags ?? []).map(
37
- (g) => De(n, a, le(g))
38
- ), l = await e.store.get(u);
39
- if (l && (l.expiresAt === null || l.expiresAt > t()))
40
- return l.value;
41
- if (l && qt(l, t())) {
42
- const g = zt(e.store), A = globalThis.crypto.randomUUID();
43
- if (await g.acquireRefreshLease(
44
- u,
45
- A,
46
- t() + r
47
- )) {
48
- const te = Bt({
49
- key: u,
50
- now: t,
51
- onBackgroundError: e.onBackgroundError,
52
- refreshStore: g,
53
- request: o,
54
- tags: f,
55
- token: A
56
- });
57
- e.waitUntil?.(te);
58
- }
59
- return l.value;
60
- }
61
- l && await e.store.delete(u);
62
- const m = i.get(u);
63
- if (m)
64
- return await m.promise;
65
- const d = { invalidated: !1 }, P = Promise.resolve().then(o.fn).then(async (g) => (d.invalidated || await e.store.set(u, {
66
- expiresAt: Qe(t(), o.ttl),
67
- staleUntil: Xe(
68
- t(),
69
- o.ttl,
70
- o.staleWhileRevalidate
71
- ),
72
- tags: f,
73
- value: g
74
- }), g)), $ = {
75
- promise: P,
76
- state: d,
77
- tags: f
78
- };
79
- i.set(u, $);
80
- try {
81
- return await P;
82
- } finally {
83
- i.get(u) === $ && i.delete(u);
84
- }
85
- },
86
- async invalidateKey(o) {
87
- const a = $e(o), c = s.delete(a);
88
- let u = !1;
89
- const f = await Promise.all(
90
- Ae.map((l) => {
91
- const m = ke(n, l, a), d = i.get(m);
92
- return d && (d.state.invalidated = !0, u = !0), e.store.delete(m);
93
- })
94
- );
95
- return c || u || f.some(Boolean);
96
- },
97
- async invalidateTags(o) {
98
- const a = o.map(le), c = Gt(
99
- s,
100
- new Set(a)
101
- ), u = new Set(
102
- Ae.flatMap(
103
- (m) => a.map((d) => De(n, m, d))
104
- )
105
- );
106
- let f = 0;
107
- for (const m of i.values())
108
- !m.state.invalidated && m.tags.some((d) => u.has(d)) && (m.state.invalidated = !0, f += 1);
109
- const l = await e.store.invalidateTags([...u]);
110
- return c + f + l;
111
- }
112
- };
113
- }
114
- function ge(e = {}) {
115
- const t = e.now ?? Date.now;
116
- return Ye({
117
- namespace: It,
118
- now: t,
119
- onBackgroundError: e.onBackgroundError,
120
- refreshLeaseTtl: e.refreshLeaseTtl,
121
- store: Ht({
122
- maximumEntries: e.maximumEntries,
123
- now: t
124
- }),
125
- waitUntil: e.waitUntil
126
- });
127
- }
128
- function Ht(e = {}) {
129
- const t = e.entries ?? /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), n = e.maximumEntries ?? Mt, s = e.now ?? Date.now;
130
- if (!Number.isSafeInteger(n) || n <= 0)
131
- throw new Error(
132
- "Demiurge memory cache maximumEntries must be a positive integer."
133
- );
134
- re(t, r, s()), jt(t, n);
135
- let i = ne(t);
136
- return {
137
- acquireRefreshLease(o, a, c) {
138
- const u = s(), f = r.get(o);
139
- return f && f.expiresAt > u ? !1 : (r.set(o, { expiresAt: c, token: a }), !0);
140
- },
141
- delete(o) {
142
- return r.delete(o), t.delete(o);
143
- },
144
- get(o) {
145
- return s() >= i && (re(t, r, s()), i = ne(t)), t.get(o);
146
- },
147
- invalidateTags(o) {
148
- const a = new Set(o);
149
- let c = 0;
150
- for (const [u, f] of t)
151
- f.tags.some((l) => a.has(l)) && (t.delete(u), r.delete(u), c += 1);
152
- return c;
153
- },
154
- publishRefresh(o, a, c) {
155
- const u = r.get(o);
156
- return !u || u.token !== a || u.expiresAt <= s() ? !1 : (Ce(
157
- t,
158
- r,
159
- n,
160
- o,
161
- c
162
- ), r.delete(o), c.staleUntil !== null && (i = Math.min(i, c.staleUntil)), !0);
163
- },
164
- releaseRefreshLease(o, a) {
165
- r.get(o)?.token === a && r.delete(o);
166
- },
167
- set(o, a) {
168
- const c = s();
169
- c >= i && (re(t, r, c), i = ne(t)), r.delete(o), Ce(
170
- t,
171
- r,
172
- n,
173
- o,
174
- a
175
- ), a.staleUntil !== null && (i = Math.min(i, a.staleUntil));
176
- }
177
- };
178
- }
179
- function re(e, t, r) {
180
- for (const [n, s] of e)
181
- s.staleUntil !== null && s.staleUntil <= r && (e.delete(n), t.delete(n));
182
- }
183
- function Ce(e, t, r, n, s) {
184
- if (!e.has(n) && e.size >= r)
185
- for (; e.size >= r; ) {
186
- const i = e.keys().next().value;
187
- if (i === void 0)
188
- break;
189
- e.delete(i), t.delete(i);
190
- }
191
- e.set(n, s);
192
- }
193
- function jt(e, t) {
194
- for (; e.size > t; ) {
195
- const r = e.keys().next().value;
196
- if (r === void 0)
197
- return;
198
- e.delete(r);
199
- }
200
- }
201
- function ne(e) {
202
- let t = Number.POSITIVE_INFINITY;
203
- for (const r of e.values())
204
- r.staleUntil !== null && (t = Math.min(t, r.staleUntil));
205
- return t;
206
- }
207
- function Ze(e) {
208
- const t = se("app", e.app), r = se(
209
- "environment",
210
- e.environment
211
- );
212
- if (typeof e.schemaVersion == "number" && (!Number.isInteger(e.schemaVersion) || e.schemaVersion < 0))
213
- throw new Error(
214
- "Demiurge cache namespace schemaVersion must be a non-negative integer or string."
215
- );
216
- const n = se(
217
- "schemaVersion",
218
- String(e.schemaVersion)
219
- );
220
- return `${t}:${r}:${n}`;
221
- }
222
- function oi(e) {
223
- return {
224
- async key(t) {
225
- return {
226
- deleted: await e.invalidateKey(t) ? 1 : 0,
227
- kind: "key"
228
- };
229
- },
230
- async keys(t) {
231
- let r = 0;
232
- for (const n of t)
233
- await e.invalidateKey(n) && (r += 1);
234
- return {
235
- deleted: r,
236
- kind: "key"
237
- };
238
- },
239
- async tag(t) {
240
- return {
241
- deleted: await e.invalidateTags([t]),
242
- kind: "tag"
243
- };
244
- },
245
- async tags(t) {
246
- return {
247
- deleted: await e.invalidateTags(t),
248
- kind: "tag"
249
- };
250
- }
251
- };
252
- }
253
- function U(e) {
254
- if (e === void 0)
255
- return Number.POSITIVE_INFINITY;
256
- if (typeof e == "number") {
257
- if (!Number.isInteger(e) || e < 0)
258
- throw new Error("Demiurge cache duration must be a non-negative integer.");
259
- return e;
260
- }
261
- const t = /^(\d+)(ms|s|m|h)$/.exec(e);
262
- if (!t)
263
- throw new Error("Demiurge cache duration must use an ms/s/m/h suffix.");
264
- const r = Number(t[1]), n = t[2];
265
- return n === "h" ? r * 36e5 : n === "m" ? r * 6e4 : n === "s" ? r * 1e3 : r;
266
- }
267
- function $e(e) {
268
- return de(e, /* @__PURE__ */ new Set());
269
- }
270
- function le(e) {
271
- return e.id;
272
- }
273
- async function Ft(e, t, r, n) {
274
- const s = e.get(t);
275
- if (s && s.expiresAt > n())
276
- return await s.value;
277
- const i = Promise.resolve().then(r.fn), o = {
278
- expiresAt: n() + U(r.ttl),
279
- tags: (r.tags ?? []).map(le),
280
- value: i
281
- };
282
- e.set(t, o);
283
- try {
284
- return await i;
285
- } catch (a) {
286
- throw e.get(t) === o && e.delete(t), a;
287
- }
288
- }
289
- function ke(e, t, r) {
290
- return `${e}:${t}:key:${r}`;
291
- }
292
- function De(e, t, r) {
293
- return `${e}:${t}:tag:${r}`;
294
- }
295
- function Qe(e, t) {
296
- const r = U(t);
297
- return Number.isFinite(r) ? e + r : null;
298
- }
299
- function Xe(e, t, r) {
300
- const n = U(t);
301
- if (!Number.isFinite(n)) {
302
- if (r !== void 0)
303
- throw new Error(
304
- "Demiurge staleWhileRevalidate requires a finite cache ttl."
305
- );
306
- return null;
307
- }
308
- return e + n + U(r ?? 0);
309
- }
310
- function Wt(e) {
311
- const t = U(e ?? Ut);
312
- if (!Number.isFinite(t) || t <= 0)
313
- throw new Error(
314
- "Demiurge cache refreshLeaseTtl must be a positive finite duration."
315
- );
316
- return t;
317
- }
318
- function qt(e, t) {
319
- return e.expiresAt !== null && e.expiresAt <= t && (e.staleUntil === null || e.staleUntil > t);
320
- }
321
- function zt(e) {
322
- if (!e.acquireRefreshLease || !e.publishRefresh || !e.releaseRefreshLease)
323
- throw new Error(
324
- "Demiurge staleWhileRevalidate requires a cache store with acquireRefreshLease, publishRefresh, and releaseRefreshLease coordination methods."
325
- );
326
- return e;
327
- }
328
- async function Bt(e) {
329
- try {
330
- const t = await e.request.fn(), r = e.now();
331
- await e.refreshStore.publishRefresh(e.key, e.token, {
332
- expiresAt: Qe(r, e.request.ttl),
333
- staleUntil: Xe(
334
- r,
335
- e.request.ttl,
336
- e.request.staleWhileRevalidate
337
- ),
338
- tags: e.tags,
339
- value: t
340
- });
341
- } catch (t) {
342
- e.onBackgroundError ? e.onBackgroundError(t) : console.error("Demiurge stale cache refresh failed.", t);
343
- } finally {
344
- await e.refreshStore.releaseRefreshLease(e.key, e.token);
345
- }
346
- }
347
- function se(e, t) {
348
- const r = [...t].some((n) => {
349
- const s = n.charCodeAt(0);
350
- return s <= 31 || s === 127;
351
- });
352
- if (!t || t.trim() !== t || t.includes(":") || r)
353
- throw new Error(
354
- `Demiurge cache namespace ${e} must be non-empty and cannot contain whitespace padding, colons, or control characters.`
355
- );
356
- return t;
357
- }
358
- function Gt(e, t) {
359
- let r = 0;
360
- for (const [n, s] of e)
361
- s.tags.some((i) => t.has(i)) && (e.delete(n), r += 1);
362
- return r;
363
- }
364
- function de(e, t) {
365
- if (e === null || typeof e == "boolean" || typeof e == "string")
366
- return JSON.stringify(e);
367
- if (typeof e == "number") {
368
- if (!Number.isFinite(e) || Object.is(e, -0))
369
- throw new Error(
370
- "Demiurge cache keys require finite numbers and do not accept negative zero."
371
- );
372
- return JSON.stringify(e);
373
- }
374
- if (typeof e != "object")
375
- throw new Error(
376
- `Demiurge cache keys do not accept values of type ${typeof e}.`
377
- );
378
- if (t.has(e))
379
- throw new Error("Demiurge cache keys cannot contain circular references.");
380
- if (t.add(e), Array.isArray(e)) {
381
- const o = Reflect.ownKeys(e), a = [
382
- ...Array.from({ length: e.length }, (u, f) => String(f)),
383
- "length"
384
- ];
385
- if (o.length !== a.length || o.some((u, f) => u !== a[f]) || a.slice(0, -1).some((u) => {
386
- const f = Object.getOwnPropertyDescriptor(e, u);
387
- return !f?.enumerable || !("value" in f);
388
- }))
389
- throw t.delete(e), new Error(
390
- "Demiurge cache key arrays must be dense and cannot contain accessors or custom properties."
391
- );
392
- const c = `[${e.map((u) => de(u, t)).join(",")}]`;
393
- return t.delete(e), c;
394
- }
395
- const r = Object.getPrototypeOf(e);
396
- if (r !== Object.prototype && r !== null)
397
- throw new Error(
398
- "Demiurge cache keys accept only primitives, arrays, and plain objects."
399
- );
400
- const n = Reflect.ownKeys(e);
401
- if (n.some((o) => typeof o == "symbol") || n.some((o) => {
402
- const a = Object.getOwnPropertyDescriptor(e, o);
403
- return !a?.enumerable || !("value" in a);
404
- }))
405
- throw new Error(
406
- "Demiurge cache key objects require enumerable string data properties."
407
- );
408
- const s = e, i = `{${Object.keys(s).sort().map(
409
- (o) => `${JSON.stringify(o)}:${de(s[o], t)}`
410
- ).join(",")}}`;
411
- return t.delete(e), i;
412
- }
413
- function ai(e) {
414
- return e;
415
- }
416
- function ci(e) {
417
- return {
418
- ...e,
419
- kind: "meta"
420
- };
421
- }
422
- function ui(e) {
423
- return {
424
- ...e,
425
- kind: "link"
426
- };
427
- }
428
- function fi(e) {
429
- return {
430
- kind: "structured-data",
431
- value: e
432
- };
433
- }
434
- function v(...e) {
435
- const t = {
436
- custom: [],
437
- structuredData: []
438
- };
439
- for (const i of e)
440
- i && _t(t, i);
441
- const r = Jt(t), n = t.description, s = Kt(t.openGraph, r, n);
442
- return {
443
- canonical: t.canonical,
444
- charset: "utf-8",
445
- custom: t.custom,
446
- description: n,
447
- openGraph: s,
448
- robots: t.robots,
449
- structuredData: t.structuredData,
450
- title: r,
451
- viewport: "width=device-width, initial-scale=1"
452
- };
453
- }
454
- function _t(e, t) {
455
- Vt(e, t.title), t.description !== void 0 && (e.description = t.description), t.canonical !== void 0 && (e.canonical = t.canonical), t.robots && (e.robots = {
456
- ...e.robots ?? {},
457
- ...t.robots
458
- }), t.openGraph && (e.openGraph = {
459
- ...e.openGraph ?? {},
460
- ...t.openGraph
461
- }), t.custom && e.custom.push(...t.custom), t.structuredData && e.structuredData.push(...t.structuredData);
462
- }
463
- function Vt(e, t) {
464
- if (t !== void 0) {
465
- if (typeof t == "string") {
466
- e.title = t;
467
- return;
468
- }
469
- t.default !== void 0 && (e.titleDefault = t.default), t.format && (e.titleFormat = t.format);
470
- }
471
- }
472
- function Jt(e) {
473
- return e.title === void 0 ? e.titleDefault : e.titleFormat ? e.titleFormat(e.title) : e.title;
474
- }
475
- function Kt(e, t, r) {
476
- if (!(!e && !t && !r))
477
- return {
478
- ...t ? { title: t } : {},
479
- ...r ? { description: r } : {},
480
- ...e ?? {}
481
- };
482
- }
483
- function et(e) {
484
- const t = {
485
- fallbacks: {
486
- error: [],
487
- loading: [],
488
- notFound: []
489
- },
490
- routes: [],
491
- layouts: [],
492
- middlewares: [],
493
- policies: []
494
- };
495
- for (const [r, n] of Object.entries(e)) {
496
- const s = r.replace(/^\/src\/routes\//, "").replace(/^\.\/routes\//, "").replace(/\.tsx?$/, "").split("/"), i = s.at(-1);
497
- if (i === "@layout") {
498
- t.layouts.push({
499
- file: r,
500
- fileSegments: s.slice(0, -1),
501
- segments: R(s.slice(0, -1)),
502
- load: n
503
- });
504
- continue;
505
- }
506
- if (i === "@policy") {
507
- t.policies.push({
508
- file: r,
509
- fileSegments: s.slice(0, -1),
510
- segments: R(s.slice(0, -1)),
511
- load: n
512
- });
513
- continue;
514
- }
515
- if (i === "@middleware") {
516
- t.middlewares.push({
517
- file: r,
518
- fileSegments: s.slice(0, -1),
519
- segments: R(s.slice(0, -1)),
520
- load: n
521
- });
522
- continue;
523
- }
524
- if (i === "@loading") {
525
- t.fallbacks.loading.push({
526
- file: r,
527
- fileSegments: s.slice(0, -1),
528
- segments: R(s.slice(0, -1)),
529
- load: n
530
- });
531
- continue;
532
- }
533
- if (i === "@error") {
534
- t.fallbacks.error.push({
535
- file: r,
536
- fileSegments: s.slice(0, -1),
537
- segments: R(s.slice(0, -1)),
538
- load: n
539
- });
540
- continue;
541
- }
542
- if (i === "@not-found") {
543
- t.fallbacks.notFound.push({
544
- file: r,
545
- fileSegments: s.slice(0, -1),
546
- segments: R(s.slice(0, -1)),
547
- load: n
548
- });
549
- continue;
550
- }
551
- t.routes.push({
552
- file: r,
553
- fileSegments: s,
554
- segments: R(s),
555
- score: dr(s),
556
- load: n
557
- });
558
- }
559
- return Yt(t.routes), t.routes.sort(Xt), t.layouts.sort(
560
- (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
561
- ), t.policies.sort(
562
- (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
563
- ), t.middlewares.sort(
564
- (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
565
- ), t.fallbacks.loading.sort(
566
- (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
567
- ), t.fallbacks.error.sort(
568
- (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
569
- ), t.fallbacks.notFound.sort(
570
- (r, n) => r.fileSegments.length - n.fileSegments.length || r.file.localeCompare(n.file)
571
- ), t;
572
- }
573
- function Yt(e) {
574
- const t = /* @__PURE__ */ new Map();
575
- for (const r of e) {
576
- const n = r.segments.findIndex(
577
- (o) => o.startsWith("*")
578
- );
579
- if (n !== -1 && n !== r.segments.length - 1)
580
- throw new Error(
581
- `Catchall route segment in "${r.file}" must be the final URL segment.`
582
- );
583
- const s = r.segments.map(Zt).join("/"), i = t.get(s);
584
- if (i)
585
- throw new Error(
586
- `Ambiguous routes "${i.file}" and "${r.file}" have the same runtime shape and both match "${Qt(r.segments)}".`
587
- );
588
- t.set(s, r);
589
- }
590
- }
591
- function Zt(e) {
592
- return e.startsWith("*") ? "*" : e.startsWith(":") ? ":" : `=${e}`;
593
- }
594
- function Qt(e) {
595
- return e.length === 0 ? "/" : `/${e.map((t) => t.startsWith(":") || t.startsWith("*") ? "example" : t).join("/")}`;
596
- }
597
- function Xt(e, t) {
598
- const r = Math.max(e.segments.length, t.segments.length);
599
- for (let n = 0; n < r; n += 1) {
600
- const s = Ne(t.segments[n]) - Ne(e.segments[n]);
601
- if (s !== 0)
602
- return s;
603
- }
604
- return e.file.localeCompare(t.file);
605
- }
606
- function Ne(e) {
607
- return e === void 0 ? 4 : e.startsWith("*") ? 1 : e.startsWith(":") ? 2 : 3;
608
- }
609
- async function tt(e, t, r = new Request(`http://demiurge.local${t}`), n, s = ge(), i = {}) {
610
- const o = i.documentContributions ?? !0, a = F(e.routes, t);
611
- if (!a)
612
- return {
613
- ...await me(e, t, {
614
- documentContributions: o
615
- }),
616
- status: "not-found"
617
- };
618
- const c = e.layouts.filter(
619
- (d) => T(d.fileSegments, a.route.fileSegments)
620
- ), u = await a.route.load();
621
- if (!u.GET || u.GET.kind !== "page")
622
- return {
623
- ...await me(e, t, {
624
- fallback: ye(
625
- e.fallbacks.notFound,
626
- a.route
627
- ),
628
- documentContributions: o,
629
- layouts: c
630
- }),
631
- status: "not-found"
632
- };
633
- const f = u.GET.layout === !1 ? [] : await Promise.all(c.map((d) => d.load())), l = new URL(r.url), m = {
634
- cache: s,
635
- context: i.requestContext ?? {},
636
- path: a.path,
637
- pathname: t,
638
- request: r,
639
- search: l.searchParams,
640
- url: l
641
- };
642
- return {
643
- status: "ready",
644
- match: {
645
- data: u.GET.data && !n?.hasData ? await u.GET.data(m) : n?.data,
646
- error: await rt(e, a.route),
647
- links: o ? await kt(
648
- [
649
- ...f.map((d) => d.links),
650
- u.links
651
- ],
652
- m
653
- ) : [],
654
- page: u.GET.view,
655
- layouts: f.map(
656
- (d) => d.default
657
- ),
658
- metadata: o ? v(
659
- ...f.map((d) => d.metadata),
660
- u.metadata
661
- ) : v(),
662
- path: a.path,
663
- pathname: t,
664
- render: u.GET.render,
665
- scripts: o ? await $t(
666
- [
667
- ...f.map((d) => d.scripts),
668
- u.scripts
669
- ],
670
- m
671
- ) : []
672
- }
673
- };
674
- }
675
- async function li(e, t = {}) {
676
- const r = ge(), n = [];
677
- for (const s of e.routes) {
678
- const i = await s.load();
679
- if (!i.GET || i.GET.kind !== "page" && !t.includeResources)
680
- continue;
681
- if (i.GET.kind === "page" && i.GET.render.mode !== "static")
682
- throw new Error(
683
- `Page route "${s.file}" uses render mode "${i.GET.render.mode}" and cannot be emitted as static output. Set render: { mode: "static" } or deploy a runtime adapter.`
684
- );
685
- const o = or(s.segments);
686
- if (cr(s.segments).length === 0) {
687
- n.push({
688
- file: s.file,
689
- path: {},
690
- pattern: o,
691
- pathname: o
692
- });
693
- continue;
694
- }
695
- if (!i.paths)
696
- throw new Error(
697
- `Dynamic static route "${s.file}" must export paths for "${o}".`
698
- );
699
- const c = await i.paths({ cache: r });
700
- for (const u of c) {
701
- const f = ur(s, o, u);
702
- n.push({
703
- file: s.file,
704
- path: f,
705
- pattern: o,
706
- pathname: lr(s.segments, f)
707
- });
708
- }
709
- }
710
- return n;
711
- }
712
- async function di(e, t) {
713
- const r = F(e.routes, t);
714
- if (r)
715
- return await sr(
716
- ye(e.fallbacks.loading, r.route)
717
- );
718
- }
719
- async function er(e, t) {
720
- let r;
721
- try {
722
- r = F(e.routes, t);
723
- } catch (n) {
724
- if (!(n instanceof Ee)) throw n;
725
- return await Se(
726
- e.fallbacks.error.find(
727
- (s) => s.fileSegments.length === 0
728
- )
729
- );
730
- }
731
- return r ? await rt(e, r.route) : await tr(e, t);
732
- }
733
- async function rt(e, t) {
734
- return await Se(
735
- ye(e.fallbacks.error, t)
736
- );
737
- }
738
- async function tr(e, t) {
739
- return await Se(
740
- nt(e.fallbacks.error, t)
741
- );
742
- }
743
- async function me(e, t, r = {}) {
744
- const s = await (r.fallback ?? nt(e.fallbacks.notFound, t))?.load(), i = s?.default, o = r.documentContributions ?? !0;
745
- if (s?.layout === !1)
746
- return {
747
- layouts: [],
748
- metadata: o ? v(s.metadata) : v(),
749
- notFound: i,
750
- pathname: t
751
- };
752
- const a = r.layouts ?? rr(e, t);
753
- try {
754
- const c = await Promise.all(
755
- a.map((u) => u.load())
756
- );
757
- return {
758
- layouts: c.map(
759
- (u) => u.default
760
- ),
761
- metadata: o ? v(
762
- ...c.map((u) => u.metadata),
763
- s?.metadata
764
- ) : v(),
765
- notFound: i,
766
- pathname: t
767
- };
768
- } catch (c) {
769
- return r.onLayoutError?.(c), {
770
- layouts: [],
771
- metadata: o ? v(s?.metadata) : v(),
772
- notFound: i,
773
- pathname: t
774
- };
775
- }
776
- }
777
- function rr(e, t) {
778
- const r = X(t);
779
- return e.layouts.filter(
780
- (n) => !n.fileSegments.some(Q) && we(n.segments, r)
781
- );
782
- }
783
- function nr(e, t) {
784
- const r = X(t);
785
- return e.policies.filter(
786
- (n) => !n.fileSegments.some(Q) && we(n.segments, r)
787
- );
788
- }
789
- function ye(e, t) {
790
- for (let r = e.length - 1; r >= 0; r -= 1) {
791
- const n = e[r];
792
- if (T(n.fileSegments, t.fileSegments))
793
- return n;
794
- }
795
- }
796
- function nt(e, t) {
797
- const r = X(t);
798
- for (let n = e.length - 1; n >= 0; n -= 1) {
799
- const s = e[n];
800
- if (!s.fileSegments.some(Q) && we(s.segments, r))
801
- return s;
802
- }
803
- }
804
- function we(e, t) {
805
- return e.every((r, n) => r.startsWith("*") ? t.length > n : r.startsWith(":") ? !!t[n] : t[n] === r);
806
- }
807
- async function sr(e) {
808
- return e ? (await e.load()).default : void 0;
809
- }
810
- async function Se(e) {
811
- return e ? (await e.load()).default : void 0;
812
- }
813
- function F(e, t) {
814
- const r = X(t);
815
- for (const n of e) {
816
- const s = ir(n.segments, r);
817
- if (s)
818
- return { route: n, path: s };
819
- }
820
- return null;
821
- }
822
- const mi = tt, hi = F;
823
- function ir(e, t) {
824
- const r = {};
825
- for (let n = 0; n < e.length; n += 1) {
826
- const s = e[n], i = t[n];
827
- if (s?.startsWith("*"))
828
- return r[s.slice(1)] = t.slice(n).join("/"), r;
829
- if (!i)
830
- return null;
831
- if (s.startsWith(":")) {
832
- r[s.slice(1)] = i;
833
- continue;
834
- }
835
- if (s !== i)
836
- return null;
837
- }
838
- return e.length === t.length ? r : null;
839
- }
840
- function pi(e, t) {
841
- return e.every(
842
- (r, n) => t[n] === r
843
- );
844
- }
845
- function T(e, t) {
846
- return e.every(
847
- (r, n) => t[n] === r
848
- );
849
- }
850
- function R(e) {
851
- return e.flatMap((t) => Q(t) ? [] : t === "index" ? [] : t.startsWith("[...") && t.endsWith("]") ? [`*${t.slice(4, -1)}`] : t.startsWith("[") && t.endsWith("]") ? [`:${t.slice(1, -1)}`] : [t]);
852
- }
853
- function Q(e) {
854
- return e.startsWith("(") && e.endsWith(")");
855
- }
856
- function or(e) {
857
- return e.length === 0 ? "/" : `/${e.map(ar).join("/")}`;
858
- }
859
- function ar(e) {
860
- return e.startsWith("*") ? `[...${e.slice(1)}]` : e.startsWith(":") ? `[${e.slice(1)}]` : e;
861
- }
862
- function cr(e) {
863
- return e.flatMap((t) => t.startsWith(":") || t.startsWith("*") ? [t.slice(1)] : []);
864
- }
865
- function ur(e, t, r) {
866
- const n = {};
867
- for (const s of e.segments) {
868
- if (!s.startsWith(":") && !s.startsWith("*"))
869
- continue;
870
- const i = s.slice(1), o = r[i];
871
- if (o === void 0)
872
- throw new Error(
873
- `Static paths for "${e.file}" must include "${i}" for "${t}".`
874
- );
875
- if (!fr(o))
876
- throw new Error(
877
- `Static path "${i}" for "${e.file}" must be a string, number, or boolean.`
878
- );
879
- n[i] = String(o);
880
- }
881
- return n;
882
- }
883
- function fr(e) {
884
- return typeof e == "string" || typeof e == "number" || typeof e == "boolean";
885
- }
886
- function lr(e, t) {
887
- return `/${e.map((n) => n.startsWith("*") ? t[n.slice(1)].split("/").filter(Boolean).map(encodeURIComponent).join("/") : n.startsWith(":") ? encodeURIComponent(t[n.slice(1)]) : encodeURIComponent(n)).filter(Boolean).join("/")}`;
888
- }
889
- function dr(e) {
890
- return R(e).reduce((t, r) => r.startsWith("*") ? t : r.startsWith(":") ? t + 1 : t + 2, 0);
891
- }
892
- function X(e) {
893
- return e.replace(/^\/|\/$/g, "").split("/").filter(Boolean).map((t) => {
894
- try {
895
- return decodeURIComponent(t);
896
- } catch (r) {
897
- throw new Ee(e, { cause: r });
898
- }
899
- });
900
- }
901
- class Ee extends URIError {
902
- pathname;
903
- constructor(t, r) {
904
- super(
905
- `Malformed percent encoding in URL pathname ${JSON.stringify(t)}.`,
906
- r
907
- ), this.name = "MalformedPathnameError", this.pathname = t;
908
- }
909
- }
910
- const C = "x-demiurge-navigation", mr = "data", hr = "data", ie = "error", Oe = "not-found";
911
- function st(e) {
912
- return e.headers.get(C) === mr;
913
- }
914
- function pr(e) {
915
- return Response.json(
916
- { data: e, hasData: !0 },
917
- {
918
- headers: {
919
- "cache-control": "no-store",
920
- [C]: hr,
921
- vary: C
922
- }
923
- }
924
- );
925
- }
926
- function z(e, t) {
927
- return e.headers.set("cache-control", "no-store"), e.headers.set(C, t), e.headers.append("vary", C), e;
928
- }
929
- function gr(e) {
930
- if (typeof e == "string")
931
- return e;
932
- const t = yr(Er(
933
- e.to,
934
- "path" in e ? e.path : void 0
935
- )), r = e.search === void 0 ? t.search : wr(e.search), n = e.hash === void 0 ? t.hash : e.hash ? e.hash.startsWith("#") ? e.hash : `#${e.hash}` : "";
936
- return `${t.pathname}${r}${n}`;
937
- }
938
- function yr(e) {
939
- const t = e.indexOf("#"), r = t === -1 ? e : e.slice(0, t), n = r.indexOf("?");
940
- return {
941
- hash: t === -1 ? "" : e.slice(t),
942
- pathname: n === -1 ? r : r.slice(0, n),
943
- search: n === -1 ? "" : r.slice(n)
944
- };
945
- }
946
- function wr(e) {
947
- if (!e)
948
- return "";
949
- if (typeof e == "string")
950
- return e.startsWith("?") ? e : `?${e}`;
951
- const r = (e instanceof URLSearchParams ? e : Sr(e)).toString();
952
- return r ? `?${r}` : "";
953
- }
954
- function Sr(e) {
955
- const t = new URLSearchParams();
956
- for (const [r, n] of Object.entries(e)) {
957
- const s = Array.isArray(n) ? n : [n];
958
- for (const i of s)
959
- i != null && t.append(r, String(i));
960
- }
961
- return t;
962
- }
963
- function Er(e, t) {
964
- return t ? e.replace(
965
- /\[(\.\.\.)?([a-zA-Z_$][a-zA-Z0-9_$]*)\]/g,
966
- (r, n, s) => {
967
- const i = t[s];
968
- if (i === void 0)
969
- throw new Error(`Missing path value for "${s}" in route "${e}".`);
970
- return n ? String(i).split("/").filter(Boolean).map((o) => encodeURIComponent(o)).join("/") : encodeURIComponent(String(i));
971
- }
972
- ) : e;
973
- }
974
- function gi(e, t) {
975
- return {
976
- cors: t?.cors,
977
- kind: "json",
978
- security: t?.security,
979
- timing: S(t?.timing),
980
- value: e,
981
- init: b(t)
982
- };
983
- }
984
- function yi(e, t) {
985
- return {
986
- cors: t?.cors,
987
- init: b(t),
988
- kind: "jsonl",
989
- lines: e,
990
- security: t?.security,
991
- timing: S(t?.timing)
992
- };
993
- }
994
- function wi(e, t) {
995
- return {
996
- cors: t?.cors,
997
- kind: "text",
998
- security: t?.security,
999
- timing: S(t?.timing),
1000
- value: e,
1001
- init: b(t)
1002
- };
1003
- }
1004
- function Si(e, t) {
1005
- return {
1006
- cors: t?.cors,
1007
- kind: "html",
1008
- security: t?.security,
1009
- timing: S(t?.timing),
1010
- value: e,
1011
- init: b(t)
1012
- };
1013
- }
1014
- function Ei(e, t) {
1015
- const r = typeof t == "number" ? void 0 : t;
1016
- return {
1017
- cors: r?.cors,
1018
- kind: "redirect",
1019
- security: r?.security,
1020
- timing: S(r?.timing),
1021
- to: kr(e) ? gr(e) : e,
1022
- init: typeof t == "number" ? { status: t } : b(t)
1023
- };
1024
- }
1025
- function Ri(e, t) {
1026
- return {
1027
- cors: t?.cors,
1028
- kind: "not-found",
1029
- security: t?.security,
1030
- timing: S(t?.timing),
1031
- body: e,
1032
- init: b(t)
1033
- };
1034
- }
1035
- function vi(e, t) {
1036
- return {
1037
- cors: t?.cors,
1038
- kind: "response",
1039
- response: e,
1040
- security: t?.security,
1041
- timing: S(t?.timing)
1042
- };
1043
- }
1044
- function bi(e, t) {
1045
- return {
1046
- body: e,
1047
- cors: t?.cors,
1048
- init: b(t),
1049
- kind: "stream",
1050
- security: t?.security,
1051
- timing: S(t?.timing)
1052
- };
1053
- }
1054
- function Ti(e, t) {
1055
- return {
1056
- cors: t?.cors,
1057
- events: e,
1058
- init: b(t),
1059
- kind: "sse",
1060
- security: t?.security,
1061
- timing: S(t?.timing)
1062
- };
1063
- }
1064
- function xi(...e) {
1065
- return e;
1066
- }
1067
- async function Rr(e, t) {
1068
- switch (e.kind) {
1069
- case "json":
1070
- return new Response(JSON.stringify(await y(e.value, t)), {
1071
- ...e.init,
1072
- headers: oe(
1073
- e.init?.headers,
1074
- "content-type",
1075
- "application/json; charset=utf-8"
1076
- )
1077
- });
1078
- case "jsonl":
1079
- return new Response(
1080
- br(await y(e.lines, t)),
1081
- {
1082
- ...e.init,
1083
- headers: G(e.init?.headers, {
1084
- "cache-control": "no-cache",
1085
- "content-type": "application/x-ndjson; charset=utf-8",
1086
- "x-accel-buffering": "no"
1087
- })
1088
- }
1089
- );
1090
- case "text":
1091
- return new Response(await y(e.value, t), {
1092
- ...e.init,
1093
- headers: oe(
1094
- e.init?.headers,
1095
- "content-type",
1096
- "text/plain; charset=utf-8"
1097
- )
1098
- });
1099
- case "html":
1100
- return new Response(await y(e.value, t), {
1101
- ...e.init,
1102
- headers: oe(
1103
- e.init?.headers,
1104
- "content-type",
1105
- "text/html; charset=utf-8"
1106
- )
1107
- });
1108
- case "redirect": {
1109
- const r = new Headers(e.init?.headers);
1110
- return r.set("location", String(await y(e.to, t))), new Response(null, {
1111
- ...e.init,
1112
- headers: r,
1113
- status: e.init?.status ?? 302
1114
- });
1115
- }
1116
- case "not-found":
1117
- return new Response(
1118
- e.body ? await y(e.body, t) : null,
1119
- {
1120
- ...e.init,
1121
- status: e.init?.status ?? 404
1122
- }
1123
- );
1124
- case "response":
1125
- return await y(e.response, t);
1126
- case "stream":
1127
- return new Response(
1128
- Tr(await y(e.body, t)),
1129
- {
1130
- ...e.init,
1131
- headers: G(e.init?.headers, {
1132
- "content-type": "application/octet-stream",
1133
- "x-accel-buffering": "no"
1134
- })
1135
- }
1136
- );
1137
- case "sse":
1138
- return new Response(
1139
- vr(await y(e.events, t)),
1140
- {
1141
- ...e.init,
1142
- headers: G(e.init?.headers, {
1143
- "cache-control": "no-cache",
1144
- "content-type": "text/event-stream; charset=utf-8",
1145
- "x-accel-buffering": "no"
1146
- })
1147
- }
1148
- );
1149
- }
1150
- }
1151
- async function y(e, t) {
1152
- return typeof e != "function" ? e : await e(
1153
- t
1154
- );
1155
- }
1156
- function oe(e, t, r) {
1157
- return G(e, { [t]: r });
1158
- }
1159
- function G(e, t) {
1160
- const r = new Headers(e);
1161
- for (const [n, s] of Object.entries(t))
1162
- r.has(n) || r.set(n, s);
1163
- return r;
1164
- }
1165
- function vr(e) {
1166
- const t = new TextEncoder(), r = Re(e);
1167
- return new ReadableStream({
1168
- async pull(n) {
1169
- const s = await r.next();
1170
- if (s.done) {
1171
- n.close();
1172
- return;
1173
- }
1174
- n.enqueue(t.encode(Ar(s.value)));
1175
- },
1176
- async cancel() {
1177
- await r.return?.();
1178
- }
1179
- });
1180
- }
1181
- function br(e) {
1182
- const t = new TextEncoder(), r = Re(e);
1183
- return new ReadableStream({
1184
- async pull(n) {
1185
- const s = await r.next();
1186
- if (s.done) {
1187
- n.close();
1188
- return;
1189
- }
1190
- n.enqueue(t.encode(`${JSON.stringify(s.value)}
1191
- `));
1192
- },
1193
- async cancel() {
1194
- await r.return?.();
1195
- }
1196
- });
1197
- }
1198
- function Tr(e) {
1199
- const t = new TextEncoder(), r = Re(e);
1200
- return new ReadableStream({
1201
- async pull(n) {
1202
- const s = await r.next();
1203
- if (s.done) {
1204
- n.close();
1205
- return;
1206
- }
1207
- n.enqueue(xr(s.value, t));
1208
- },
1209
- async cancel() {
1210
- await r.return?.();
1211
- }
1212
- });
1213
- }
1214
- function xr(e, t) {
1215
- return typeof e == "string" ? t.encode(e) : e;
1216
- }
1217
- function Re(e) {
1218
- if (e instanceof ReadableStream) {
1219
- const t = e.getReader();
1220
- return {
1221
- async next() {
1222
- return await t.read();
1223
- },
1224
- async return() {
1225
- return t.releaseLock(), { done: !0, value: void 0 };
1226
- }
1227
- };
1228
- }
1229
- return Symbol.asyncIterator in e ? e[Symbol.asyncIterator]() : Pr(e[Symbol.iterator]());
1230
- }
1231
- function Pr(e) {
1232
- return {
1233
- async next() {
1234
- return e.next();
1235
- },
1236
- async return() {
1237
- return e.return?.(), { done: !0, value: void 0 };
1238
- }
1239
- };
1240
- }
1241
- function Ar(e) {
1242
- if (typeof e == "string")
1243
- return Cr(e);
1244
- const t = [];
1245
- if (e.comment !== void 0 && t.push(...N("", e.comment)), e.id !== void 0 && t.push(...N("id", e.id)), e.event !== void 0 && t.push(...N("event", e.event)), e.retry !== void 0) {
1246
- if (!Number.isInteger(e.retry) || e.retry < 0)
1247
- throw new Error("SSE retry must be a non-negative integer.");
1248
- t.push(`retry: ${e.retry}`);
1249
- }
1250
- return e.data !== void 0 && t.push(...N("data", $r(e.data))), `${t.join(`
1251
- `)}
1252
-
1253
- `;
1254
- }
1255
- function Cr(e) {
1256
- return `${N("data", e).join(`
1257
- `)}
1258
-
1259
- `;
1260
- }
1261
- function N(e, t) {
1262
- return t.split(/\r\n|\r|\n/).map(
1263
- (r) => e ? `${e}: ${r}` : `: ${r}`
1264
- );
1265
- }
1266
- function $r(e) {
1267
- return typeof e == "string" ? e : JSON.stringify(e);
1268
- }
1269
- function kr(e) {
1270
- return typeof e == "object" && e !== null && !(e instanceof URL) && "to" in e;
1271
- }
1272
- function b(e) {
1273
- if (!e)
1274
- return;
1275
- const {
1276
- cors: t,
1277
- security: r,
1278
- timing: n,
1279
- ...s
1280
- } = e;
1281
- return s;
1282
- }
1283
- function Dr(e, t) {
1284
- if (!t?.length)
1285
- return e;
1286
- const r = new Headers(e.headers), n = Nr(t), s = r.get("server-timing");
1287
- return r.set(
1288
- "server-timing",
1289
- s ? `${s}, ${n}` : n
1290
- ), new Response(e.body, {
1291
- headers: r,
1292
- status: e.status,
1293
- statusText: e.statusText
1294
- });
1295
- }
1296
- function Nr(e) {
1297
- return e.map(Or).join(", ");
1298
- }
1299
- function S(e) {
1300
- if (e)
1301
- return Array.isArray(e) ? e : [e];
1302
- }
1303
- function Or(e) {
1304
- if (!Lr(e.name))
1305
- throw new Error(
1306
- `Server-Timing metric name "${e.name}" is not a valid token.`
1307
- );
1308
- const t = [e.name];
1309
- if (e.duration !== void 0) {
1310
- if (!Number.isFinite(e.duration) || e.duration < 0)
1311
- throw new Error("Server-Timing metric duration must be a non-negative finite number.");
1312
- t.push(`dur=${Ir(e.duration)}`);
1313
- }
1314
- return e.description !== void 0 && t.push(`desc="${Mr(e.description)}"`), t.join(";");
1315
- }
1316
- function Lr(e) {
1317
- return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(e);
1318
- }
1319
- function Ir(e) {
1320
- return Number.isInteger(e), String(e);
1321
- }
1322
- function Mr(e) {
1323
- return e.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
1324
- }
1325
- const Ur = [
1326
- 400,
1327
- 401,
1328
- 402,
1329
- 403,
1330
- 404,
1331
- 405,
1332
- 406,
1333
- 407,
1334
- 408,
1335
- 409,
1336
- 410,
1337
- 411,
1338
- 412,
1339
- 413,
1340
- 414,
1341
- 415,
1342
- 416,
1343
- 417,
1344
- 418,
1345
- 421,
1346
- 422,
1347
- 423,
1348
- 424,
1349
- 425,
1350
- 426,
1351
- 428,
1352
- 429,
1353
- 431,
1354
- 451,
1355
- 500,
1356
- 501,
1357
- 502,
1358
- 503,
1359
- 504,
1360
- 505,
1361
- 506,
1362
- 507,
1363
- 508,
1364
- 510,
1365
- 511
1366
- ], Hr = {
1367
- 400: "Bad Request",
1368
- 401: "Unauthorized",
1369
- 402: "Payment Required",
1370
- 403: "Forbidden",
1371
- 404: "Not Found",
1372
- 405: "Method Not Allowed",
1373
- 406: "Not Acceptable",
1374
- 407: "Proxy Authentication Required",
1375
- 408: "Request Timeout",
1376
- 409: "Conflict",
1377
- 410: "Gone",
1378
- 411: "Length Required",
1379
- 412: "Precondition Failed",
1380
- 413: "Content Too Large",
1381
- 414: "URI Too Long",
1382
- 415: "Unsupported Media Type",
1383
- 416: "Range Not Satisfiable",
1384
- 417: "Expectation Failed",
1385
- 418: "I'm a Teapot",
1386
- 421: "Misdirected Request",
1387
- 422: "Unprocessable Content",
1388
- 423: "Locked",
1389
- 424: "Failed Dependency",
1390
- 425: "Too Early",
1391
- 426: "Upgrade Required",
1392
- 428: "Precondition Required",
1393
- 429: "Too Many Requests",
1394
- 431: "Request Header Fields Too Large",
1395
- 451: "Unavailable For Legal Reasons",
1396
- 500: "Internal Server Error",
1397
- 501: "Not Implemented",
1398
- 502: "Bad Gateway",
1399
- 503: "Service Unavailable",
1400
- 504: "Gateway Timeout",
1401
- 505: "HTTP Version Not Supported",
1402
- 506: "Variant Also Negotiates",
1403
- 507: "Insufficient Storage",
1404
- 508: "Loop Detected",
1405
- 510: "Not Extended",
1406
- 511: "Network Authentication Required"
1407
- }, jr = new Set(Ur);
1408
- class it extends Error {
1409
- detail;
1410
- extensions;
1411
- headers;
1412
- status;
1413
- title;
1414
- type;
1415
- constructor(t, r = {}, n = {}) {
1416
- Fr(t);
1417
- const s = typeof r == "string" ? { detail: r } : r, {
1418
- detail: i,
1419
- title: o = Hr[t],
1420
- type: a = "about:blank",
1421
- ...c
1422
- } = s;
1423
- super(i ?? o, { cause: n.cause }), this.name = "HttpError", this.detail = i, this.extensions = Object.freeze({ ...c }), this.headers = new Headers(n.headers), this.status = t, this.title = o, this.type = a;
1424
- }
1425
- }
1426
- function Pi(e, t, r) {
1427
- return new it(e, t, r);
1428
- }
1429
- function ve(e) {
1430
- return e instanceof it;
1431
- }
1432
- function Fr(e) {
1433
- if (!jr.has(e))
1434
- throw new RangeError(
1435
- `HTTP error status must be a standard 4xx or 5xx status; received ${JSON.stringify(e)}.`
1436
- );
1437
- }
1438
- function Le({ pathname: e }) {
1439
- return /* @__PURE__ */ I("main", { children: [
1440
- /* @__PURE__ */ M("h1", { children: "404" }),
1441
- /* @__PURE__ */ I("p", { children: [
1442
- "No route matched ",
1443
- e,
1444
- "."
1445
- ] })
1446
- ] });
1447
- }
1448
- function Ie({ status: e }) {
1449
- return /* @__PURE__ */ I("main", { children: [
1450
- /* @__PURE__ */ M("h1", { children: e }),
1451
- /* @__PURE__ */ M("p", { children: "Something went wrong." })
1452
- ] });
1453
- }
1454
- function Wr({ error: e, pathname: t, status: r }) {
1455
- const { message: n, name: s, stack: i } = ot(e);
1456
- return /* @__PURE__ */ I("main", { children: [
1457
- /* @__PURE__ */ I("h1", { children: [
1458
- r,
1459
- " ",
1460
- s,
1461
- " at ",
1462
- t
1463
- ] }),
1464
- /* @__PURE__ */ M("p", { children: n }),
1465
- i ? /* @__PURE__ */ M("pre", { children: i }) : null
1466
- ] });
1467
- }
1468
- function ot(e) {
1469
- return e instanceof Error ? {
1470
- message: e.message,
1471
- name: e.name,
1472
- stack: e.stack
1473
- } : {
1474
- message: typeof e == "string" ? e : String(e),
1475
- name: "Error",
1476
- stack: void 0
1477
- };
1478
- }
1479
- const qr = ["text/html", "application/xhtml+xml"];
1480
- function at(e) {
1481
- return zr(e.headers.get("accept"));
1482
- }
1483
- function zr(e) {
1484
- return e ? Br(e).some(
1485
- (t) => t.quality > 0 && qr.includes(t.type)
1486
- ) : !1;
1487
- }
1488
- function Br(e) {
1489
- return e.split(",").flatMap((t) => {
1490
- const [r, ...n] = t.split(";"), s = r.trim().toLowerCase();
1491
- return s ? [
1492
- {
1493
- quality: Gr(n),
1494
- type: s
1495
- }
1496
- ] : [];
1497
- });
1498
- }
1499
- function Gr(e) {
1500
- for (const t of e) {
1501
- const [r, n] = t.split("=");
1502
- if (r?.trim().toLowerCase() !== "q")
1503
- continue;
1504
- const s = Number.parseFloat(n ?? "");
1505
- return Number.isNaN(s) ? 1 : s;
1506
- }
1507
- return 1;
1508
- }
1509
- const _r = "application/problem+json";
1510
- function Vr({
1511
- detail: e,
1512
- instance: t,
1513
- status: r,
1514
- title: n,
1515
- type: s = "about:blank",
1516
- ...i
1517
- }) {
1518
- return {
1519
- type: s,
1520
- title: n,
1521
- status: r,
1522
- ...e === void 0 ? {} : { detail: e },
1523
- ...t === void 0 ? {} : { instance: t },
1524
- ...i
1525
- };
1526
- }
1527
- function J(e, t) {
1528
- const r = new Headers(t?.headers);
1529
- return r.set("content-type", `${_r}; charset=utf-8`), new Response(JSON.stringify(Vr(e)), {
1530
- ...t,
1531
- headers: r,
1532
- status: e.status
1533
- });
1534
- }
1535
- const Jr = "Internal Server Error";
1536
- function ct(e) {
1537
- return e === !0 && process.env.NODE_ENV !== "production";
1538
- }
1539
- async function _(e, t, r, n, s = {}) {
1540
- s.onError?.(r, n);
1541
- const i = new URL(t.url);
1542
- return n === "page" || n === "middleware" && at(t) ? await Yr(e, i, r, s) : Kr(i, r, s);
1543
- }
1544
- function Kr(e, t, r = {}) {
1545
- if (ve(t))
1546
- return J(
1547
- {
1548
- ...t.extensions,
1549
- detail: t.detail,
1550
- instance: `${e.pathname}${e.search}`,
1551
- status: t.status,
1552
- title: t.title,
1553
- type: t.type
1554
- },
1555
- { headers: t.headers }
1556
- );
1557
- const { message: n } = ot(t);
1558
- return J({
1559
- // `detail` carries the thrown message, so it is dev only for the same
1560
- // reason the stack is.
1561
- ...ct(r.dev) ? { detail: n } : {},
1562
- instance: `${e.pathname}${e.search}`,
1563
- status: 500,
1564
- title: "Internal Server Error"
1565
- });
1566
- }
1567
- async function Yr(e, t, r, n) {
1568
- const s = ut(r);
1569
- try {
1570
- const i = await Qr(
1571
- e,
1572
- t.pathname,
1573
- r,
1574
- n
1575
- ), o = ve(r) ? new Headers(r.headers) : new Headers();
1576
- return o.set("content-type", "text/html; charset=utf-8"), new Response(await n.transformDocument?.(i) ?? i, {
1577
- headers: o,
1578
- status: s
1579
- });
1580
- } catch (i) {
1581
- return n.onError?.(i, "page"), Zr();
1582
- }
1583
- }
1584
- function Zr() {
1585
- return new Response(Jr, {
1586
- headers: { "content-type": "text/plain; charset=utf-8" },
1587
- status: 500
1588
- });
1589
- }
1590
- async function Qr(e, t, r, n) {
1591
- const s = await Xr(e, t, n), i = _e({
1592
- dev: n.dev,
1593
- nonce: n.nonce
1594
- }), o = Ke(
1595
- Ve(
1596
- i,
1597
- fe(s, { error: r, pathname: t, status: ut(r) })
1598
- )
1599
- );
1600
- return Je({
1601
- body: { data: void 0, html: o, navigation: n.navigation },
1602
- entrySrc: n.clientEntry,
1603
- lang: n.lang,
1604
- nonce: n.nonce,
1605
- scripts: i.scripts(),
1606
- styles: n.styles,
1607
- title: n.title
1608
- });
1609
- }
1610
- function ut(e) {
1611
- return ve(e) ? e.status : 500;
1612
- }
1613
- async function Xr(e, t, r) {
1614
- if (ct(r.dev))
1615
- return Wr;
1616
- try {
1617
- return await er(e, t) ?? Ie;
1618
- } catch {
1619
- return Ie;
1620
- }
1621
- }
1622
- const K = "{nonce}", Me = `'nonce-${K}'`, ft = {
1623
- baseUri: ["'self'"],
1624
- connectSrc: ["'self'"],
1625
- defaultSrc: ["'self'"],
1626
- fontSrc: ["'self'"],
1627
- formAction: ["'self'"],
1628
- frameAncestors: ["'none'"],
1629
- imgSrc: ["'self'", "data:", "blob:"],
1630
- objectSrc: ["'none'"],
1631
- scriptSrc: [Me, "'strict-dynamic'"],
1632
- styleSrc: ["'self'", Me],
1633
- upgradeInsecureRequests: !0
1634
- }, en = {
1635
- ...ft,
1636
- scriptSrc: ["'self'"],
1637
- styleSrc: ["'self'"]
1638
- }, Ue = {
1639
- contentTypeOptions: "nosniff",
1640
- crossOriginOpenerPolicy: "same-origin",
1641
- crossOriginResourcePolicy: "same-origin",
1642
- permissionsPolicy: "camera=(), microphone=(), geolocation=(), payment=()",
1643
- referrerPolicy: "strict-origin-when-cross-origin",
1644
- strictTransportSecurity: {
1645
- includeSubDomains: !1,
1646
- maxAge: 31536e3,
1647
- preload: !1
1648
- }
1649
- }, tn = {
1650
- contentTypeOptions: "nosniff",
1651
- crossOriginResourcePolicy: "same-origin",
1652
- referrerPolicy: "strict-origin-when-cross-origin"
1653
- }, D = {
1654
- api(e = {}) {
1655
- return O(
1656
- {
1657
- headers: tn
1658
- },
1659
- e
1660
- );
1661
- },
1662
- preset(e, t = {}) {
1663
- return e === "api" ? D.api(t) : e === "cross-origin-isolated" ? D.crossOriginIsolated(t) : e === "static" ? D.static(t) : D.strict(t);
1664
- },
1665
- static(e = {}) {
1666
- return O(
1667
- {
1668
- csp: en,
1669
- headers: Ue
1670
- },
1671
- e
1672
- );
1673
- },
1674
- strict(e = {}) {
1675
- return O(
1676
- {
1677
- csp: ft,
1678
- headers: Ue
1679
- },
1680
- e
1681
- );
1682
- },
1683
- crossOriginIsolated(e = {}) {
1684
- return O(
1685
- D.strict({
1686
- headers: {
1687
- crossOriginEmbedderPolicy: "require-corp",
1688
- crossOriginOpenerPolicy: "same-origin"
1689
- }
1690
- }),
1691
- e
1692
- );
1693
- }
1694
- };
1695
- function Ai(e) {
1696
- return e;
1697
- }
1698
- function Ci(e) {
1699
- return e;
1700
- }
1701
- function rn(...e) {
1702
- return e.reduce((t, r) => r ? O(t, r) : t, {});
1703
- }
1704
- function Y(...e) {
1705
- const t = e.reduce((r, n) => n ? {
1706
- document: rn(r.document, n.document),
1707
- security: nn(r.security, n.security)
1708
- } : r, {});
1709
- return {
1710
- ...t,
1711
- document: on(t.document, t.security?.needs)
1712
- };
1713
- }
1714
- function nn(...e) {
1715
- return e.reduce((t, r) => r ? {
1716
- csrf: r.csrf ?? t.csrf,
1717
- needs: sn(t.needs, r.needs),
1718
- rateLimit: r.rateLimit ?? t.rateLimit,
1719
- request: mt(t.request, r.request)
1720
- } : t, {});
1721
- }
1722
- const lt = [
1723
- { directive: "connectSrc", need: "connect" },
1724
- { directive: "imgSrc", need: "img" },
1725
- { directive: "scriptSrc", need: "script" }
1726
- ];
1727
- function sn(e, t) {
1728
- const r = {};
1729
- for (const { need: n } of lt) {
1730
- const s = [.../* @__PURE__ */ new Set([
1731
- ...e?.[n] ?? [],
1732
- ...t?.[n] ?? []
1733
- ])];
1734
- s.length > 0 && (r[n] = s);
1735
- }
1736
- return Object.keys(r).length > 0 ? r : void 0;
1737
- }
1738
- function on(e, t) {
1739
- if (!e?.csp || !t)
1740
- return e;
1741
- let r = e.csp;
1742
- for (const { directive: n, need: s } of lt)
1743
- r = an(r, n, s, t[s]);
1744
- return r === e.csp ? e : { ...e, csp: r };
1745
- }
1746
- function an(e, t, r, n) {
1747
- if (!n || n.length === 0)
1748
- return e;
1749
- if (e[t] === !1)
1750
- throw new Error(
1751
- `A route policy declares security.needs.${r} and sets csp.${t} to false. Set an explicit csp.${t} that includes ${n.join(", ")}.`
1752
- );
1753
- if (e[t] === void 0 && e.defaultSrc === void 0)
1754
- return e;
1755
- const s = x(
1756
- e[t] ?? e.defaultSrc
1757
- ) ?? [];
1758
- return Array.isArray(s) ? {
1759
- ...e,
1760
- [t]: [.../* @__PURE__ */ new Set([...s, ...n])]
1761
- } : e;
1762
- }
1763
- async function $i(e, t = "sha256") {
1764
- const r = await globalThis.crypto.subtle.digest(
1765
- Rn(t),
1766
- new TextEncoder().encode(e)
1767
- );
1768
- return `'${t}-${vn(new Uint8Array(r))}'`;
1769
- }
1770
- function W(e, t = {}) {
1771
- e.csp && wn(e.csp), yn(e);
1772
- const r = new Headers(), n = e.csp !== !1 && e.csp ? hn(e.csp, t) : void 0, s = dn(e.trustedTypes), i = e.trustedTypes ? e.trustedTypes.mode === "report-only" : !1;
1773
- return w(
1774
- r,
1775
- "content-security-policy",
1776
- Z(n, i ? void 0 : s)
1777
- ), w(
1778
- r,
1779
- "content-security-policy-report-only",
1780
- i ? Z(s, pt(e.csp)) : void 0
1781
- ), ln(r, e.headers, t), r;
1782
- }
1783
- function ee(e) {
1784
- return !e || !e.csp ? !1 : q(e.csp).some(([, t]) => {
1785
- const r = x(t);
1786
- return Array.isArray(r) && r.some((n) => n.includes(K));
1787
- });
1788
- }
1789
- function dt() {
1790
- const e = new Uint8Array(16);
1791
- return globalThis.crypto.getRandomValues(e), btoa(String.fromCharCode(...e));
1792
- }
1793
- function O(e, t) {
1794
- return {
1795
- csp: un(e.csp, t.csp),
1796
- headers: cn(e.headers, t.headers),
1797
- trustedTypes: t.trustedTypes ?? e.trustedTypes
1798
- };
1799
- }
1800
- function cn(e, t) {
1801
- const r = mt(e, t);
1802
- return !r || t?.reportingEndpoints === !1 || e?.reportingEndpoints && t?.reportingEndpoints && (r.reportingEndpoints = {
1803
- ...e.reportingEndpoints,
1804
- ...t.reportingEndpoints
1805
- }), r;
1806
- }
1807
- function mt(e, t) {
1808
- return t ? {
1809
- ...e ?? {},
1810
- ...t
1811
- } : e;
1812
- }
1813
- function un(e, t) {
1814
- if (t === !1)
1815
- return !1;
1816
- if (!t)
1817
- return e;
1818
- if (!e)
1819
- return ae(t);
1820
- const r = ae(e), n = ae(t), s = {
1821
- ...r,
1822
- ...n
1823
- };
1824
- for (const [i, o] of q(t)) {
1825
- const a = x(
1826
- r[i]
1827
- );
1828
- !be(o) && Array.isArray(a) && Array.isArray(o) && ht(
1829
- s,
1830
- i,
1831
- fn([...a, ...o])
1832
- );
1833
- }
1834
- return s;
1835
- }
1836
- function ae(e) {
1837
- const t = { ...e };
1838
- for (const [r, n] of q(e))
1839
- be(n) && ht(t, r, n.replace);
1840
- return t;
1841
- }
1842
- function fn(e) {
1843
- return [...new Set(e)];
1844
- }
1845
- function ht(e, t, r) {
1846
- if (!(t === "reportTo" || t === "upgradeInsecureRequests")) {
1847
- if (t === "reportUri") {
1848
- e.reportUri = r;
1849
- return;
1850
- }
1851
- e[t] = r;
1852
- }
1853
- }
1854
- function ln(e, t, r) {
1855
- t && (w(e, "referrer-policy", t.referrerPolicy), w(e, "x-content-type-options", t.contentTypeOptions), w(e, "cross-origin-opener-policy", t.crossOriginOpenerPolicy), w(e, "cross-origin-embedder-policy", t.crossOriginEmbedderPolicy), w(e, "cross-origin-resource-policy", t.crossOriginResourcePolicy), w(e, "permissions-policy", t.permissionsPolicy), w(
1856
- e,
1857
- "reporting-endpoints",
1858
- pn(t.reportingEndpoints)
1859
- ), t.strictTransportSecurity && (!r.request || new URL(r.request.url).protocol === "https:") && e.set(
1860
- "strict-transport-security",
1861
- mn(t.strictTransportSecurity)
1862
- ));
1863
- }
1864
- function dn(e) {
1865
- if (!e)
1866
- return;
1867
- const t = [];
1868
- return e.requireFor?.includes("script") && t.push("require-trusted-types-for 'script'"), e.policies.length > 0 && t.push(`trusted-types ${e.policies.join(" ")}`), Z(...t);
1869
- }
1870
- function Z(...e) {
1871
- const t = e.filter((r) => r);
1872
- return t.length > 0 ? t.join("; ") : void 0;
1873
- }
1874
- function w(e, t, r) {
1875
- r && e.set(t, r);
1876
- }
1877
- function mn(e) {
1878
- const t = [`max-age=${e.maxAge}`];
1879
- return e.includeSubDomains && t.push("includeSubDomains"), e.preload && t.push("preload"), t.join("; ");
1880
- }
1881
- function hn(e, t) {
1882
- const r = [];
1883
- for (const [s, i] of q(e)) {
1884
- if (s === "reportTo" || s === "reportUri")
1885
- continue;
1886
- const o = x(i);
1887
- if (o === !1 || o === void 0)
1888
- continue;
1889
- const a = gt(s);
1890
- if (o === !0) {
1891
- r.push(a);
1892
- continue;
1893
- }
1894
- r.push(
1895
- `${a} ${En(o, t).join(" ")}`
1896
- );
1897
- }
1898
- const n = pt(e);
1899
- return n && r.push(n), r.join("; ");
1900
- }
1901
- function pt(e) {
1902
- if (!e)
1903
- return;
1904
- const t = [], r = x(e.reportUri);
1905
- return Array.isArray(r) && r.length && t.push(`report-uri ${r.join(" ")}`), e.reportTo && t.push(`report-to ${e.reportTo}`), Z(...t);
1906
- }
1907
- function pn(e) {
1908
- if (e)
1909
- return Object.entries(e).sort(([t], [r]) => t.localeCompare(r)).map(([t, r]) => `${t}="${gn(r)}"`).join(", ");
1910
- }
1911
- function gn(e) {
1912
- return e.replaceAll("\\", "\\\\").replaceAll('"', '\\"');
1913
- }
1914
- function yn(e) {
1915
- const t = e.headers?.reportingEndpoints;
1916
- if (t) {
1917
- const s = Object.entries(t);
1918
- if (s.length === 0)
1919
- throw new Error("Demiurge Reporting-Endpoints requires at least one endpoint.");
1920
- for (const [i, o] of s)
1921
- He(i), je(o, `Reporting-Endpoints member ${JSON.stringify(i)}`);
1922
- }
1923
- const r = e.csp || void 0;
1924
- if (r?.reportTo && (He(r.reportTo), !t || !(r.reportTo in t)))
1925
- throw new Error(
1926
- `Demiurge CSP report-to group ${JSON.stringify(r.reportTo)} is not defined in headers.reportingEndpoints.`
1927
- );
1928
- const n = x(r?.reportUri);
1929
- for (const s of Array.isArray(n) ? n : [])
1930
- je(s, "CSP report-uri target");
1931
- }
1932
- function wn(e) {
1933
- for (const [t, r] of q(e)) {
1934
- const n = gt(t);
1935
- if (r === void 0)
1936
- continue;
1937
- if (t === "reportTo") {
1938
- if (typeof r != "string")
1939
- throw new Error(
1940
- `Demiurge CSP directive ${JSON.stringify(n)} must be a string.`
1941
- );
1942
- continue;
1943
- }
1944
- if (t === "upgradeInsecureRequests") {
1945
- if (typeof r != "boolean")
1946
- throw new Error(
1947
- `Demiurge CSP directive ${JSON.stringify(n)} must be a boolean.`
1948
- );
1949
- continue;
1950
- }
1951
- const s = x(r);
1952
- if (s !== !1 && (!Array.isArray(s) || !s.every((i) => typeof i == "string")))
1953
- throw new Error(
1954
- `Demiurge CSP directive ${JSON.stringify(n)} must be a source list, false, or a replacement object with a source list.`
1955
- );
1956
- }
1957
- }
1958
- function be(e) {
1959
- return !!(e && typeof e == "object" && !Array.isArray(e) && "replace" in e);
1960
- }
1961
- function x(e) {
1962
- return be(e) ? e.replace : e;
1963
- }
1964
- function He(e) {
1965
- if (!/^(?:[a-z]|\*)[a-z0-9_.*-]*$/.test(e))
1966
- throw new Error(
1967
- `Invalid reporting endpoint name ${JSON.stringify(e)}. Use a lowercase Structured Field key.`
1968
- );
1969
- }
1970
- function je(e, t) {
1971
- if (!Sn(e) || /[\s,;"\\]/.test(e) || !e.startsWith("/") && !e.startsWith("https://"))
1972
- throw new Error(`${t} must be a same-origin path or an HTTPS URL.`);
1973
- if (e.startsWith("//"))
1974
- throw new Error(`${t} must not be a scheme-relative URL.`);
1975
- let r;
1976
- try {
1977
- r = new URL(e, "https://demiurge.invalid");
1978
- } catch {
1979
- throw new Error(`${t} must be a valid URI reference.`);
1980
- }
1981
- if (r.username || r.password || r.hash)
1982
- throw new Error(`${t} must not contain credentials or a fragment.`);
1983
- }
1984
- function Sn(e) {
1985
- return /^[\x20-\x7e]+$/.test(e);
1986
- }
1987
- function q(e) {
1988
- return Object.entries(e);
1989
- }
1990
- function En(e, t) {
1991
- return e.map((r) => {
1992
- if (!r.includes(K))
1993
- return r;
1994
- if (!t.nonce)
1995
- throw new Error("Demiurge security policy requires a CSP nonce.");
1996
- return r.replaceAll(K, t.nonce);
1997
- });
1998
- }
1999
- function gt(e) {
2000
- return e.replace(/[A-Z]/g, (t) => `-${t.toLowerCase()}`);
2001
- }
2002
- function Rn(e) {
2003
- return e === "sha384" ? "SHA-384" : e === "sha512" ? "SHA-512" : "SHA-256";
2004
- }
2005
- function vn(e) {
2006
- let t = "";
2007
- for (const r of e)
2008
- t += String.fromCharCode(r);
2009
- return typeof btoa == "function" ? btoa(t) : Buffer.from(t, "binary").toString("base64");
2010
- }
2011
- function yt(e, t, r = {}) {
2012
- Te(e);
2013
- const n = t.request.headers.get("origin"), s = new Headers();
2014
- if (e.origins !== "*" && wt(s, "Origin"), !n)
2015
- return s;
2016
- const i = xn(e, n);
2017
- if (!i)
2018
- return s;
2019
- if (s.set("access-control-allow-origin", i), e.credentials && s.set("access-control-allow-credentials", "true"), e.exposeHeaders?.length && s.set("access-control-expose-headers", e.exposeHeaders.join(", ")), r.preflight) {
2020
- s.set("access-control-allow-methods", r.methods.join(", "));
2021
- const o = t.request.headers.get(
2022
- "access-control-request-headers"
2023
- ), a = e.headers?.join(", ") ?? o;
2024
- a && s.set("access-control-allow-headers", a), e.maxAge !== void 0 && s.set("access-control-max-age", String(e.maxAge));
2025
- }
2026
- return s;
2027
- }
2028
- function V(e, t, r) {
2029
- if (!t)
2030
- return e;
2031
- const n = new Headers(e.headers);
2032
- return Pn(n, yt(t, { request: r })), new Response(e.body, {
2033
- headers: n,
2034
- status: e.status,
2035
- statusText: e.statusText
2036
- });
2037
- }
2038
- function bn(e, t) {
2039
- const r = t.headers.get("access-control-request-method"), n = An(r);
2040
- if (!n)
2041
- return null;
2042
- const s = St(e, n);
2043
- if (!s?.cors)
2044
- return null;
2045
- const i = s.cors.methods ?? Cn(e);
2046
- return i.includes(n) ? new Response(null, {
2047
- headers: yt(
2048
- s.cors,
2049
- { request: t },
2050
- {
2051
- methods: i,
2052
- preflight: !0
2053
- }
2054
- ),
2055
- status: 204
2056
- }) : null;
2057
- }
2058
- function Te(e) {
2059
- if (e.credentials && e.origins === "*")
2060
- throw new Error(
2061
- "Demiurge CORS policy cannot use wildcard origins with credentials."
2062
- );
2063
- if (e.credentials && (e.headers?.includes("*") || e.exposeHeaders?.includes("*")))
2064
- throw new Error(
2065
- "Demiurge credentialed CORS policy must list allowed and exposed headers explicitly."
2066
- );
2067
- if (e.origins !== "*")
2068
- for (const t of e.origins)
2069
- Tn(t);
2070
- if (e.maxAge !== void 0 && (!Number.isSafeInteger(e.maxAge) || e.maxAge < 0))
2071
- throw new Error(
2072
- "Demiurge CORS maxAge must be a non-negative integer number of seconds."
2073
- );
2074
- }
2075
- function Tn(e) {
2076
- let t;
2077
- try {
2078
- t = new URL(e);
2079
- } catch {
2080
- throw Fe(e);
2081
- }
2082
- if (t.protocol !== "http:" && t.protocol !== "https:" || t.origin !== e)
2083
- throw Fe(e);
2084
- }
2085
- function Fe(e) {
2086
- return new Error(
2087
- `Demiurge CORS origin ${JSON.stringify(e)} must be a canonical HTTP(S) origin without credentials, a path, query, or fragment.`
2088
- );
2089
- }
2090
- function xn(e, t) {
2091
- return e.origins === "*" ? "*" : e.origins.includes(t) ? t : null;
2092
- }
2093
- function Pn(e, t) {
2094
- t.forEach((r, n) => {
2095
- if (n === "vary" && e.has("vary")) {
2096
- for (const s of r.split(","))
2097
- wt(e, s.trim());
2098
- return;
2099
- }
2100
- e.set(n, r);
2101
- });
2102
- }
2103
- function wt(e, t) {
2104
- if (!t)
2105
- return;
2106
- const r = e.get("vary")?.split(",").map((n) => n.trim()).filter(Boolean) ?? [];
2107
- r.some((n) => n.toLowerCase() === t.toLowerCase()) || e.set("vary", [...r, t].join(", "));
2108
- }
2109
- function An(e) {
2110
- if (!e)
2111
- return null;
2112
- const t = e.toUpperCase();
2113
- return $n(t) ? t : null;
2114
- }
2115
- function St(e, t) {
2116
- return t === "HEAD" ? e.HEAD ?? We(e.GET) : We(e[t]);
2117
- }
2118
- function We(e) {
2119
- return e?.kind === "page" ? void 0 : e;
2120
- }
2121
- function Cn(e) {
2122
- return [
2123
- "GET",
2124
- "POST",
2125
- "PUT",
2126
- "PATCH",
2127
- "DELETE",
2128
- "OPTIONS",
2129
- "HEAD"
2130
- ].filter((t) => St(e, t));
2131
- }
2132
- function $n(e) {
2133
- return e === "GET" || e === "POST" || e === "PUT" || e === "PATCH" || e === "DELETE" || e === "OPTIONS" || e === "HEAD";
2134
- }
2135
- const kn = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]);
2136
- function Dn(e = {}) {
2137
- const t = [], r = e.document, n = r ? Ln(r.policy, r.headers, t) : {};
2138
- r && Nn(r.policy, t);
2139
- const s = e.route ? zn(e.route, t) : void 0;
2140
- return r?.scripts && (In(
2141
- r.policy.csp,
2142
- r.scripts,
2143
- r.headers,
2144
- t
2145
- ), r.scriptDependencies && t.push(
2146
- ...On(
2147
- r.scripts,
2148
- Mn(r.scriptDependencies)
2149
- )
2150
- )), {
2151
- findings: t,
2152
- headers: n,
2153
- route: s
2154
- };
2155
- }
2156
- function Nn(e, t) {
2157
- if (!e.trustedTypes || e.trustedTypes.mode !== "report-only")
2158
- return;
2159
- const r = e.csp || void 0, n = !!he(r?.reportUri)?.length, s = e.headers?.reportingEndpoints, i = !!(r?.reportTo && s && s[r.reportTo]);
2160
- !n && !i && t.push({
2161
- code: "report-only-target-missing",
2162
- message: "Trusted Types report-only mode has no deliverable target. Configure CSP reportTo with a matching Reporting-Endpoints member, reportUri for compatibility, or both.",
2163
- severity: "warning"
2164
- });
2165
- }
2166
- function On(e, t = {}) {
2167
- const r = t.requirePurpose ?? !0, n = [];
2168
- for (const s of e) {
2169
- const i = _n(s);
2170
- i && (r && !s.purpose && n.push({
2171
- code: "script-purpose-missing",
2172
- message: `Third-party script ${s.src} should declare a purpose for audits and consent flows.`,
2173
- severity: "warning"
2174
- }), t.requireIntegrity && !s.integrity && n.push({
2175
- code: "script-integrity-missing",
2176
- message: `Third-party script ${s.src} should declare an integrity hash or an explicit trust-boundary exception.`,
2177
- severity: "warning"
2178
- }), s.strategy === "beforeInteractive" && !t.allowBeforeInteractiveThirdParty && n.push({
2179
- code: "script-third-party-before-interactive",
2180
- message: `Third-party script ${s.src} runs before the app is interactive and should be justified by policy.`,
2181
- severity: "warning"
2182
- }), Vn(i) && n.push({
2183
- code: "script-gtm-wide-trust-boundary",
2184
- message: "Google Tag Manager can load additional scripts at runtime and should be treated as a wide trust boundary.",
2185
- severity: "warning"
2186
- }));
2187
- }
2188
- return n;
2189
- }
2190
- function Ln(e, t, r) {
2191
- try {
2192
- return Object.fromEntries(W(e, t));
2193
- } catch (n) {
2194
- return r.push({
2195
- code: "security-header-render-failed",
2196
- message: n instanceof Error ? n.message : "Security headers failed to render.",
2197
- severity: "error"
2198
- }), {};
2199
- }
2200
- }
2201
- function In(e, t, r, n) {
2202
- if (!e)
2203
- return;
2204
- const s = Un(e);
2205
- for (const i of t) {
2206
- if (Hn(s) && !i.nonce) {
2207
- n.push({
2208
- code: "csp-script-missing-nonce",
2209
- message: `Document script ${i.src} needs a nonce for the effective script-src policy.`,
2210
- severity: "error"
2211
- });
2212
- continue;
2213
- }
2214
- i.nonce && r?.nonce && i.nonce === r.nonce || jn(s, i.src) || n.push({
2215
- code: "csp-script-src-blocked",
2216
- message: `Document script ${i.src} is not allowed by the effective script-src policy.`,
2217
- severity: "error"
2218
- });
2219
- }
2220
- }
2221
- function Mn(e) {
2222
- return typeof e == "boolean" ? {} : e;
2223
- }
2224
- function Un(e) {
2225
- return he(e.scriptSrc) ?? he(e.defaultSrc) ?? [];
2226
- }
2227
- function he(e) {
2228
- if (e)
2229
- return "replace" in e ? e.replace : e;
2230
- }
2231
- function Hn(e) {
2232
- return e.some((t) => t.includes("'nonce-{nonce}'"));
2233
- }
2234
- function jn(e, t) {
2235
- return qn(e) ? !1 : e.includes("*") ? !0 : e.includes("'none'") || e.some((r) => r.startsWith("'nonce-")) ? !1 : e.includes("'self'") && Fn(t) || t.startsWith("https:") && e.includes("https:") || t.startsWith("http:") && e.includes("http:") ? !0 : e.some((r) => Wn(r, t));
2236
- }
2237
- function Fn(e) {
2238
- return e.startsWith("/") && !e.startsWith("//");
2239
- }
2240
- function Wn(e, t) {
2241
- if (e.startsWith("'"))
2242
- return !1;
2243
- try {
2244
- const r = new URL(e), n = new URL(t), s = r.hostname.startsWith("*.") ? n.hostname.endsWith(r.hostname.slice(1)) && n.hostname !== r.hostname.slice(2) : n.hostname === r.hostname, i = r.pathname === "/" || r.pathname.endsWith("/") ? n.pathname.startsWith(r.pathname) : n.pathname === r.pathname;
2245
- return n.protocol === r.protocol && s && n.port === r.port && i;
2246
- } catch {
2247
- return !1;
2248
- }
2249
- }
2250
- function qn(e) {
2251
- return e.includes("'strict-dynamic'") && e.some(
2252
- (t) => t.startsWith("'nonce-") || /^'sha(?:256|384|512)-/.test(t)
2253
- );
2254
- }
2255
- function zn(e, t) {
2256
- return Bn(e.cors, t), Gn(e.method, e.security, t), {
2257
- cors: e.cors,
2258
- method: e.method,
2259
- security: e.security
2260
- };
2261
- }
2262
- function Bn(e, t) {
2263
- if (e)
2264
- try {
2265
- Te(e);
2266
- } catch (r) {
2267
- t.push({
2268
- code: "cors-invalid",
2269
- message: r instanceof Error ? r.message : "CORS policy is invalid.",
2270
- severity: "error"
2271
- });
2272
- }
2273
- }
2274
- function Gn(e, t, r) {
2275
- kn.has(e) && (t?.csrf === !1 && r.push({
2276
- code: "csrf-disabled",
2277
- message: "CSRF protection is explicitly disabled for this unsafe route.",
2278
- severity: "info"
2279
- }), t?.rateLimit || r.push({
2280
- code: "rate-limit-missing",
2281
- message: "Unsafe routes should declare rate limiting.",
2282
- severity: "warning"
2283
- }), t?.request?.maxBodySize || r.push({
2284
- code: "request-body-limit-missing",
2285
- message: "Unsafe routes should declare a request body size limit.",
2286
- severity: "warning"
2287
- }));
2288
- }
2289
- function _n(e) {
2290
- try {
2291
- const t = new URL(e.src);
2292
- if (t.protocol === "http:" || t.protocol === "https:")
2293
- return t;
2294
- } catch {
2295
- return null;
2296
- }
2297
- return null;
2298
- }
2299
- function Vn(e) {
2300
- return e.hostname === "www.googletagmanager.com" && (e.pathname === "/gtm.js" || e.pathname === "/ns.html");
2301
- }
2302
- const Jn = /* @__PURE__ */ new Set(["DELETE", "PATCH", "POST", "PUT"]), Kn = /^[!#$%&'*+\-.^_`|~A-Za-z0-9]+$/;
2303
- function Yn() {
2304
- const e = new Uint8Array(32);
2305
- return globalThis.crypto.getRandomValues(e), btoa(String.fromCharCode(...e)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
2306
- }
2307
- function Zn(e, t = {}) {
2308
- const r = t.cookie ?? "csrf-token";
2309
- if (!Kn.test(r))
2310
- throw new Error("Demiurge CSRF cookie name is invalid.");
2311
- if (!e)
2312
- throw new Error("Demiurge CSRF token must not be empty.");
2313
- const n = [
2314
- `${r}=${encodeURIComponent(e)}`,
2315
- "Path=/",
2316
- "SameSite=Lax"
2317
- ];
2318
- return (t.secure ?? !0) && n.push("Secure"), n.join("; ");
2319
- }
2320
- function ki(e = {}) {
2321
- const t = Yn();
2322
- return {
2323
- cookie: Zn(t, e),
2324
- token: t
2325
- };
2326
- }
2327
- function Qn(e, t) {
2328
- if (!Jn.has(t.method.toUpperCase()) || e === !1)
2329
- return null;
2330
- const r = t.headers.get("cookie");
2331
- if (e === void 0 && !r?.trim())
2332
- return null;
2333
- const n = es(e ?? !0), i = Xn(r).get(n.cookie), o = t.headers.get(n.header);
2334
- return !i || !o || !rs(i, o) ? new Response("Invalid CSRF token.", {
2335
- status: 403
2336
- }) : null;
2337
- }
2338
- function Xn(e) {
2339
- const t = /* @__PURE__ */ new Map();
2340
- if (!e)
2341
- return t;
2342
- for (const r of e.split(";")) {
2343
- const n = r.indexOf("=");
2344
- if (n === -1)
2345
- continue;
2346
- const s = r.slice(0, n).trim(), i = r.slice(n + 1).trim();
2347
- s && t.set(s, ts(i));
2348
- }
2349
- return t;
2350
- }
2351
- function es(e) {
2352
- return e === !0 ? {
2353
- cookie: "csrf-token",
2354
- header: "x-csrf-token"
2355
- } : {
2356
- cookie: e.cookie ?? "csrf-token",
2357
- header: e.header ?? "x-csrf-token"
2358
- };
2359
- }
2360
- function ts(e) {
2361
- try {
2362
- return decodeURIComponent(e);
2363
- } catch {
2364
- return e;
2365
- }
2366
- }
2367
- function rs(e, t) {
2368
- let r = e.length ^ t.length;
2369
- const n = Math.max(e.length, t.length);
2370
- for (let s = 0; s < n; s += 1)
2371
- r |= e.charCodeAt(s) ^ t.charCodeAt(s);
2372
- return r === 0;
2373
- }
2374
- const ns = {
2375
- h: 3600 * 1e3,
2376
- m: 60 * 1e3,
2377
- s: 1e3
2378
- }, ss = 1e4;
2379
- function Et(e = {}) {
2380
- const t = e.maximumEntries ?? ss;
2381
- if (!Number.isSafeInteger(t) || t <= 0)
2382
- throw new Error(
2383
- "Demiurge rate limit maximumEntries must be a positive integer."
2384
- );
2385
- const r = /* @__PURE__ */ new Map();
2386
- let n = Number.POSITIVE_INFINITY;
2387
- return {
2388
- increment(s, i, o) {
2389
- o >= n && (is(r, o), n = os(r));
2390
- const a = r.get(s);
2391
- if (!a || a.resetAt <= o) {
2392
- const c = {
2393
- count: 1,
2394
- resetAt: o + i
2395
- };
2396
- return !a && r.size >= t && as(r), r.set(s, c), n = Math.min(n, c.resetAt), c;
2397
- }
2398
- return a.count += 1, a;
2399
- }
2400
- };
2401
- }
2402
- function is(e, t) {
2403
- for (const [r, n] of e)
2404
- n.resetAt <= t && e.delete(r);
2405
- }
2406
- function os(e) {
2407
- let t = Number.POSITIVE_INFINITY;
2408
- for (const r of e.values())
2409
- t = Math.min(t, r.resetAt);
2410
- return t;
2411
- }
2412
- function as(e) {
2413
- const t = e.keys().next().value;
2414
- t !== void 0 && e.delete(t);
2415
- }
2416
- function cs(e, t, r, n = Date.now()) {
2417
- if (!e)
2418
- return null;
2419
- xe(e);
2420
- const s = Rt(e.window), i = us(e, t), o = r.increment(i, s, n), a = Math.max(0, e.limit - o.count), c = new Headers({
2421
- "retry-after": String(Math.ceil(Math.max(0, o.resetAt - n) / 1e3)),
2422
- "x-ratelimit-limit": String(e.limit),
2423
- "x-ratelimit-remaining": String(a),
2424
- "x-ratelimit-reset": String(Math.ceil(o.resetAt / 1e3))
2425
- });
2426
- return o.count > e.limit ? new Response("Rate limit exceeded.", {
2427
- headers: c,
2428
- status: 429
2429
- }) : null;
2430
- }
2431
- function Rt(e) {
2432
- if (typeof e == "number") {
2433
- if (!Number.isSafeInteger(e) || e <= 0)
2434
- throw new Error("Demiurge rate limit window must be a positive integer.");
2435
- return e;
2436
- }
2437
- const t = /^(\d+)(s|m|h)$/i.exec(e.trim());
2438
- if (!t)
2439
- throw new Error("Demiurge rate limit window must use an s/m/h suffix.");
2440
- const r = Number(t[1]), n = t[2].toLowerCase(), s = r * ns[n];
2441
- if (!Number.isSafeInteger(s))
2442
- throw new Error("Demiurge rate limit window is too large.");
2443
- return s;
2444
- }
2445
- function xe(e) {
2446
- if (!Number.isSafeInteger(e.limit) || e.limit <= 0)
2447
- throw new Error("Demiurge rate limit limit must be a positive integer.");
2448
- Rt(e.window);
2449
- }
2450
- function us(e, t) {
2451
- return `${fs(e.key)}:${ls(e.key, t)}`;
2452
- }
2453
- function fs(e) {
2454
- return typeof e == "string" ? e : `header:${e.header.toLowerCase()}`;
2455
- }
2456
- function ls(e, t) {
2457
- return e === "ip" ? ds(t) : t.headers.get(e.header) ?? "missing";
2458
- }
2459
- function ds(e) {
2460
- return Dt(e)?.clientIp ?? "unknown";
2461
- }
2462
- const ms = {
2463
- b: 1,
2464
- gb: 1024 ** 3,
2465
- kb: 1024,
2466
- mb: 1024 ** 2
2467
- };
2468
- function hs(e, t, r) {
2469
- const n = gs(e, r);
2470
- if (n)
2471
- return n;
2472
- if (e?.maxBodySize === void 0)
2473
- return null;
2474
- const s = t.headers.get("content-length");
2475
- if (!s)
2476
- return null;
2477
- const i = ys(s);
2478
- if (i === null)
2479
- return new Response("Invalid Content-Length.", {
2480
- status: 400
2481
- });
2482
- const o = vt(e.maxBodySize);
2483
- return i > o ? new Response("Request body too large.", {
2484
- status: 413
2485
- }) : null;
2486
- }
2487
- class L extends Error {
2488
- constructor() {
2489
- super("Demiurge request body exceeded maxBodySize while being read."), this.name = "RequestBodyTooLargeError";
2490
- }
2491
- }
2492
- function ps(e, t) {
2493
- if (e?.maxBodySize === void 0 || t.body === null)
2494
- return t;
2495
- const r = vt(e.maxBodySize), n = t.body.getReader();
2496
- let s = 0;
2497
- const i = new ReadableStream({
2498
- async pull(a) {
2499
- const c = await n.read();
2500
- if (c.done) {
2501
- a.close();
2502
- return;
2503
- }
2504
- if (s += c.value.byteLength, s > r) {
2505
- const u = new L();
2506
- a.error(u);
2507
- try {
2508
- await n.cancel(u);
2509
- } catch {
2510
- }
2511
- return;
2512
- }
2513
- a.enqueue(c.value);
2514
- },
2515
- async cancel(a) {
2516
- try {
2517
- await n.cancel(a);
2518
- } catch {
2519
- }
2520
- }
2521
- }), o = new Request(t, {
2522
- body: i,
2523
- duplex: "half"
2524
- });
2525
- return Nt(t, o), o;
2526
- }
2527
- function B() {
2528
- return new Response("Request body too large.", { status: 413 });
2529
- }
2530
- function gs(e, t) {
2531
- return !e?.allowedMethods || ws(e.allowedMethods, t) ? null : new Response(null, {
2532
- headers: {
2533
- allow: Ss(e.allowedMethods)
2534
- },
2535
- status: 405
2536
- });
2537
- }
2538
- function vt(e) {
2539
- if (typeof e == "number") {
2540
- if (!Number.isSafeInteger(e) || e < 0)
2541
- throw new Error("Demiurge request maxBodySize must be a non-negative integer.");
2542
- return e;
2543
- }
2544
- const t = /^(\d+)(b|kb|mb|gb)$/i.exec(e.trim());
2545
- if (!t)
2546
- throw new Error(
2547
- "Demiurge request maxBodySize must use bytes or a b/kb/mb/gb suffix."
2548
- );
2549
- const r = Number(t[1]), n = t[2].toLowerCase(), s = r * ms[n];
2550
- if (!Number.isSafeInteger(s))
2551
- throw new Error("Demiurge request maxBodySize is too large.");
2552
- return s;
2553
- }
2554
- function ys(e) {
2555
- if (!/^\d+$/.test(e))
2556
- return null;
2557
- const t = Number(e);
2558
- return Number.isSafeInteger(t) ? t : null;
2559
- }
2560
- function ws(e, t) {
2561
- return e.includes(t) || t === "HEAD" && e.includes("GET");
2562
- }
2563
- function Ss(e) {
2564
- const t = [...e];
2565
- return t.includes("GET") && !t.includes("HEAD") && t.push("HEAD"), t.join(", ");
2566
- }
2567
- const Es = [
2568
- "GET",
2569
- "POST",
2570
- "PUT",
2571
- "PATCH",
2572
- "DELETE",
2573
- "OPTIONS",
2574
- "HEAD"
2575
- ];
2576
- function Rs(e, t = {}) {
2577
- for (const [n, s] of Object.entries(e)) {
2578
- vs(n, s);
2579
- for (const i of Es) {
2580
- const o = s[i];
2581
- !o || o.kind === "page" || bs(n, i, o, s);
2582
- }
2583
- }
2584
- const r = et(
2585
- Object.fromEntries(
2586
- Object.entries(e).map(([n, s]) => [
2587
- n,
2588
- async () => s
2589
- ])
2590
- )
2591
- );
2592
- return As(r, e, t.adapter), r;
2593
- }
2594
- function vs(e, t) {
2595
- const r = t.policy?.security?.rateLimit;
2596
- r && j(e, "policy", "rate limit", () => {
2597
- xe(r);
2598
- });
2599
- }
2600
- function bs(e, t, r, n) {
2601
- r.cors && j(e, t, "CORS", () => {
2602
- Te(r.cors), Ts(e, t, r.cors.methods, n);
2603
- }), r.security?.rateLimit && j(e, t, "rate limit", () => {
2604
- xe(r.security.rateLimit);
2605
- });
2606
- }
2607
- function Ts(e, t, r, n) {
2608
- if (r) {
2609
- for (const s of r)
2610
- if (s !== "OPTIONS" && !xs(n, s))
2611
- throw new Error(
2612
- `Route ${JSON.stringify(e)} export ${t} allows CORS method ${s}, but the route does not export that response capability.`
2613
- );
2614
- }
2615
- }
2616
- function xs(e, t) {
2617
- const r = t === "HEAD" ? e.HEAD ?? e.GET : e[t];
2618
- return Ps(r) ? r : void 0;
2619
- }
2620
- function Ps(e) {
2621
- return !!(e && e.kind !== "page");
2622
- }
2623
- function As(e, t, r) {
2624
- for (const s of e.routes) {
2625
- const i = t[s.file], o = i?.GET;
2626
- if (!o || o.kind !== "page")
2627
- continue;
2628
- const a = Y(
2629
- ...e.policies.filter(
2630
- (c) => T(c.fileSegments, s.fileSegments)
2631
- ).map((c) => t[c.file]?.policy),
2632
- i.policy
2633
- );
2634
- qe(s.file, "GET", a, r), Os(
2635
- s.file,
2636
- o.render.mode,
2637
- a.document
2638
- ), Cs(
2639
- s.file,
2640
- "GET",
2641
- a,
2642
- [
2643
- ...e.layouts.filter(
2644
- (c) => T(c.fileSegments, s.fileSegments)
2645
- ).map((c) => t[c.file]?.scripts),
2646
- i.scripts
2647
- ]
2648
- );
2649
- }
2650
- const n = [
2651
- ...e.fallbacks.error,
2652
- ...e.fallbacks.loading,
2653
- ...e.fallbacks.notFound
2654
- ];
2655
- for (const s of n) {
2656
- const i = Y(
2657
- ...e.policies.filter(
2658
- (o) => T(o.fileSegments, s.fileSegments)
2659
- ).map((o) => t[o.file]?.policy),
2660
- t[s.file]?.policy
2661
- );
2662
- qe(
2663
- s.file,
2664
- "policy",
2665
- i,
2666
- r
2667
- );
2668
- }
2669
- }
2670
- function Cs(e, t, r, n) {
2671
- const s = n.flatMap(
2672
- (l) => Array.isArray(l) ? l : []
2673
- );
2674
- if (s.length === 0 || !r.document)
2675
- return;
2676
- const i = "startup-verification-nonce", a = Dn({
2677
- document: {
2678
- headers: { nonce: i },
2679
- policy: r.document,
2680
- scripts: s.map((l) => ({
2681
- ...l,
2682
- nonce: ee(r.document) ? i : l.nonce
2683
- }))
2684
- }
2685
- }).findings.find(
2686
- (l) => l.code === "csp-script-src-blocked"
2687
- );
2688
- if (!a) {
2689
- ks(
2690
- e,
2691
- t,
2692
- r.document.csp,
2693
- s
2694
- );
2695
- return;
2696
- }
2697
- const c = s.find(
2698
- (l) => a.message.includes(l.src)
2699
- ), f = (W(r.document, { nonce: i }).get("content-security-policy") ?? "").split("; ").find(
2700
- (l) => l.startsWith("script-src ")
2701
- ) ?? "default-src (script-src fallback)";
2702
- throw new Error(
2703
- `Route ${JSON.stringify(e)} export ${t} declares script ${JSON.stringify(c?.src)} that violates the effective ${f} policy.`
2704
- );
2705
- }
2706
- const $s = [
2707
- { directive: "connectSrc", name: "connect-src", need: "connect" },
2708
- { directive: "imgSrc", name: "img-src", need: "img" }
2709
- ];
2710
- function ks(e, t, r, n) {
2711
- if (r)
2712
- for (const s of n)
2713
- for (const { directive: i, name: o, need: a } of $s) {
2714
- const c = s.needs?.[a] ?? [];
2715
- if (c.length === 0)
2716
- continue;
2717
- const u = H(r[i]) ?? H(r.defaultSrc);
2718
- if (u !== void 0) {
2719
- for (const f of c)
2720
- if (!(Array.isArray(u) && Ds(u, f)))
2721
- throw new Error(
2722
- `Route ${JSON.stringify(e)} export ${t} declares script ${JSON.stringify(s.src)} that needs ${o} ${f}, which the effective policy does not allow. Add ${f} to security.needs.${a} or to csp.${i} for this route.`
2723
- );
2724
- }
2725
- }
2726
- }
2727
- function Ds(e, t) {
2728
- return e.includes("'none'") ? !1 : e.includes("*") || e.includes(t) ? !0 : t.startsWith("'") ? !1 : e.some((r) => Ns(r, t));
2729
- }
2730
- function Ns(e, t) {
2731
- if (e.startsWith("'"))
2732
- return !1;
2733
- let r;
2734
- try {
2735
- r = new URL(t);
2736
- } catch {
2737
- return !1;
2738
- }
2739
- if (e === `${r.protocol}`)
2740
- return !0;
2741
- let n;
2742
- try {
2743
- n = new URL(e);
2744
- } catch {
2745
- return !1;
2746
- }
2747
- if (n.protocol !== r.protocol || n.port !== r.port)
2748
- return !1;
2749
- if (n.hostname.startsWith("*.")) {
2750
- const s = n.hostname.slice(1);
2751
- return r.hostname.endsWith(s) && r.hostname !== n.hostname.slice(2);
2752
- }
2753
- return n.hostname === r.hostname;
2754
- }
2755
- function qe(e, t, r, n) {
2756
- j(e, t, "effective document", () => {
2757
- W(r.document ?? {}, {
2758
- nonce: "startup-verification-nonce"
2759
- });
2760
- }), !(!n || !ee(r.document)) && j(e, t, "effective CSP", () => {
2761
- Ot(n, ["nonceInjection"]);
2762
- });
2763
- }
2764
- function Os(e, t, r) {
2765
- if (t === "static") {
2766
- const s = Ls(r?.csp);
2767
- if (s)
2768
- throw new Error(
2769
- `Route ${JSON.stringify(e)} uses render mode "static" with an effective ${s} directive that depends on a CSP nonce. Use security.static() for static output or remove the nonce source from the document policy.`
2770
- );
2771
- return;
2772
- }
2773
- if (t !== "streaming")
2774
- return;
2775
- const n = Is(r?.csp);
2776
- if (!(!n || Ms(n.sources)))
2777
- throw new Error(
2778
- `Route ${JSON.stringify(e)} uses render mode "streaming" with an effective ${n.name} directive that does not allow React runtime inline payload scripts. Add a nonce placeholder or allow 'unsafe-inline' without nonce or hash sources.`
2779
- );
2780
- }
2781
- function Ls(e) {
2782
- if (e)
2783
- for (const [t, r] of Object.entries(e)) {
2784
- const n = H(r);
2785
- if (Array.isArray(n) && n.some((s) => Us(s)))
2786
- return js(t);
2787
- }
2788
- }
2789
- function Is(e) {
2790
- if (!e)
2791
- return;
2792
- const t = H(e.scriptSrc);
2793
- if (Array.isArray(t))
2794
- return { name: "script-src", sources: t };
2795
- const r = H(e.defaultSrc);
2796
- if (Array.isArray(r))
2797
- return { name: "default-src", sources: r };
2798
- }
2799
- function Ms(e) {
2800
- return e.some((t) => bt(t)) ? !0 : e.includes("'unsafe-inline'") && !e.some((t) => Hs(t));
2801
- }
2802
- function Us(e) {
2803
- return bt(e) || /^'nonce-[^']*'$/i.test(e);
2804
- }
2805
- function bt(e) {
2806
- return e.includes("{nonce}");
2807
- }
2808
- function Hs(e) {
2809
- return /^'(?:nonce-|sha256-|sha384-|sha512-)/i.test(e);
2810
- }
2811
- function H(e) {
2812
- return e && typeof e == "object" && !Array.isArray(e) && "replace" in e ? e.replace : e;
2813
- }
2814
- function js(e) {
2815
- return e.replace(/[A-Z]/g, (t) => `-${t.toLowerCase()}`);
2816
- }
2817
- function j(e, t, r, n) {
2818
- try {
2819
- n();
2820
- } catch (s) {
2821
- if (s instanceof Error && s.message.startsWith(`Route ${JSON.stringify(e)} export `))
2822
- throw s;
2823
- const i = s instanceof Error ? s.message : `${r} validation failed.`;
2824
- throw new Error(
2825
- `Route ${JSON.stringify(e)} export ${t} has an invalid ${r} policy. ${i}`,
2826
- { cause: s }
2827
- );
2828
- }
2829
- }
2830
- function Fs(e) {
2831
- return J({
2832
- instance: `${e.pathname}${e.search}`,
2833
- status: 404,
2834
- title: "Not Found"
2835
- });
2836
- }
2837
- async function pe(e, t, r = {}) {
2838
- const n = new URL(t.url);
2839
- if (!at(t))
2840
- return Fs(n);
2841
- const s = await me(e, n.pathname, {
2842
- onLayoutError: (u) => r.onError?.(u, "page")
2843
- }), i = await Ws(e, n.pathname), o = r.nonce ?? (ee(i) ? dt() : void 0), a = qs(s, { ...r, nonce: o }), c = W(i ?? {}, {
2844
- nonce: o,
2845
- request: t
2846
- });
2847
- return c.set("content-type", "text/html; charset=utf-8"), new Response(
2848
- await r.transformDocument?.(a) ?? a,
2849
- {
2850
- headers: c,
2851
- status: 404
2852
- }
2853
- );
2854
- }
2855
- async function Ws(e, t) {
2856
- const r = await Promise.all(
2857
- nr(e, t).map((n) => n.load())
2858
- );
2859
- return Y(...r.map((n) => n.policy)).document;
2860
- }
2861
- function qs(e, t = {}) {
2862
- const r = e.notFound ?? Le;
2863
- try {
2864
- return ce(e, r, e.layouts, t);
2865
- } catch (n) {
2866
- t.onError?.(n, "page");
2867
- }
2868
- try {
2869
- return ce(e, r, [], t);
2870
- } catch (n) {
2871
- t.onError?.(n, "page");
2872
- }
2873
- return ce(e, Le, [], t);
2874
- }
2875
- function ce(e, t, r, n) {
2876
- const s = r.reduceRight(
2877
- (o, a) => fe(a, {
2878
- children: o,
2879
- path: {},
2880
- pathname: e.pathname
2881
- }),
2882
- fe(t, { pathname: e.pathname })
2883
- ), i = _e({
2884
- dev: n.dev,
2885
- nonce: n.nonce
2886
- });
2887
- return Je({
2888
- body: {
2889
- data: void 0,
2890
- fallback: "not-found",
2891
- html: Ke(Ve(i, s)),
2892
- navigation: n.navigation
2893
- },
2894
- entrySrc: n.clientEntry,
2895
- lang: n.lang,
2896
- metadata: e.metadata,
2897
- nonce: n.nonce,
2898
- scripts: i.scripts(),
2899
- styles: n.styles,
2900
- title: n.title
2901
- });
2902
- }
2903
- const Tt = [
2904
- "GET",
2905
- "POST",
2906
- "PUT",
2907
- "PATCH",
2908
- "DELETE",
2909
- "OPTIONS",
2910
- "HEAD"
2911
- ], xt = Et();
2912
- function Di(e) {
2913
- e.routeModules && Rs(e.routeModules, { adapter: e.adapter });
2914
- const t = et(e.routes), r = e.rateLimitStore ?? Et();
2915
- return e.cacheStore && Ze(e.cacheStore.namespace), async function(s) {
2916
- return await zs(t, s, {
2917
- cacheStore: e.cacheStore,
2918
- onError: e.onError,
2919
- rateLimitStore: r,
2920
- renderPage: e.renderPage,
2921
- ssr: e.ssr
2922
- });
2923
- };
2924
- }
2925
- async function zs(e, t, r = {
2926
- rateLimitStore: xt
2927
- }) {
2928
- const n = new URL(t.url), s = _s(n, r), i = st(t);
2929
- let o;
2930
- try {
2931
- o = F(e.routes, n.pathname);
2932
- } catch (a) {
2933
- if (!(a instanceof Ee))
2934
- throw a;
2935
- const c = J({
2936
- instance: `${n.pathname}${n.search}`,
2937
- status: 400,
2938
- title: "Bad Request"
2939
- });
2940
- return i ? z(c, ie) : c;
2941
- }
2942
- if (!o)
2943
- try {
2944
- const a = await pe(
2945
- e,
2946
- t,
2947
- s
2948
- );
2949
- return i ? z(a, Oe) : a;
2950
- } catch (a) {
2951
- return s.onError(a, "page"), new Response("Not Found", {
2952
- headers: { "content-type": "text/plain; charset=utf-8" },
2953
- status: 404
2954
- });
2955
- }
2956
- try {
2957
- const a = await Bs(
2958
- e,
2959
- t,
2960
- n,
2961
- o,
2962
- r,
2963
- s
2964
- );
2965
- return i && !a.headers.has(C) ? z(
2966
- a,
2967
- a.status === 404 ? Oe : ie
2968
- ) : a;
2969
- } catch (a) {
2970
- const c = await _(
2971
- e,
2972
- t,
2973
- a,
2974
- "middleware",
2975
- s
2976
- );
2977
- return i ? z(c, ie) : c;
2978
- }
2979
- }
2980
- async function Bs(e, t, r, n, s, i) {
2981
- const o = await n.route.load();
2982
- if (t.method.toUpperCase() === "OPTIONS") {
2983
- const h = bn(o, t);
2984
- if (h)
2985
- return h;
2986
- }
2987
- const a = Ys(t.method);
2988
- if (!a)
2989
- return Ge(o);
2990
- const c = Zs(o, a);
2991
- if (!c)
2992
- return Ge(o);
2993
- const u = await Js(
2994
- e,
2995
- n.route,
2996
- o,
2997
- c
2998
- ), f = u.security, l = Qn(f?.csrf, t);
2999
- if (l)
3000
- return V(l, ue(c), t);
3001
- const m = cs(
3002
- f?.rateLimit,
3003
- t,
3004
- s.rateLimitStore ?? xt
3005
- );
3006
- if (m)
3007
- return V(
3008
- m,
3009
- ue(c),
3010
- t
3011
- );
3012
- const d = hs(
3013
- f?.request,
3014
- t,
3015
- a
3016
- );
3017
- if (d)
3018
- return V(
3019
- d,
3020
- ue(c),
3021
- t
3022
- );
3023
- t = ps(f?.request, t);
3024
- const P = {};
3025
- if (c.kind === "page") {
3026
- const h = {
3027
- path: n.path,
3028
- pathname: r.pathname,
3029
- request: t,
3030
- context: P,
3031
- search: r.searchParams,
3032
- url: r
3033
- }, te = await ze(
3034
- e,
3035
- n.route
3036
- ), k = ee(u.document) ? dt() : void 0, Pt = Gs(s.cacheStore);
3037
- let E;
3038
- try {
3039
- E = await Be(te, h, async () => {
3040
- try {
3041
- const p = await tt(
3042
- e,
3043
- r.pathname,
3044
- t,
3045
- void 0,
3046
- Pt,
3047
- { requestContext: P }
3048
- );
3049
- if (p.status !== "ready")
3050
- return await pe(e, t, {
3051
- ...i,
3052
- nonce: k
3053
- });
3054
- if (st(t))
3055
- return pr(p.match.data);
3056
- if (p.match.render.mode === "streaming" && !s.renderPage)
3057
- throw new Error(
3058
- "Streaming page routes require an adapter renderer. Pass renderNodePageResponse from @demiurgejs/core/node as createRequestHandler({ renderPage })."
3059
- );
3060
- return await (s.renderPage ?? Lt)(p.match, {
3061
- ...s.ssr,
3062
- dev: s.dev,
3063
- nonce: k,
3064
- onStreamError: (Ct) => {
3065
- s.onError?.(Ct, {
3066
- pathname: r.pathname,
3067
- site: "page"
3068
- });
3069
- },
3070
- signal: t.signal
3071
- });
3072
- } catch (p) {
3073
- return p instanceof L ? B() : await _(e, t, p, "page", {
3074
- ...i,
3075
- nonce: k
3076
- });
3077
- }
3078
- });
3079
- } catch (p) {
3080
- if (!(p instanceof L))
3081
- throw p;
3082
- E = B();
3083
- }
3084
- const At = W(u.document ?? {}, {
3085
- nonce: k,
3086
- request: t
3087
- });
3088
- for (const [p, Pe] of At)
3089
- E.headers.set(p, Pe);
3090
- return k && E.headers.set("cache-control", "private, no-store"), a === "HEAD" ? (await E.body?.cancel(), new Response(null, {
3091
- headers: E.headers,
3092
- status: E.status
3093
- })) : E;
3094
- }
3095
- const $ = {
3096
- path: n.path,
3097
- pathname: r.pathname,
3098
- request: t,
3099
- context: P,
3100
- search: r.searchParams,
3101
- url: r
3102
- }, g = await ze(
3103
- e,
3104
- n.route
3105
- );
3106
- let A;
3107
- try {
3108
- A = await Be(g, $, async () => {
3109
- try {
3110
- return c.kind === "not-found" && c.body === void 0 ? Vs(
3111
- await pe(e, t, i),
3112
- c.init
3113
- ) : await Rr(c, $);
3114
- } catch (h) {
3115
- return h instanceof L ? B() : await _(
3116
- e,
3117
- t,
3118
- h,
3119
- "route",
3120
- i
3121
- );
3122
- }
3123
- });
3124
- } catch (h) {
3125
- if (!(h instanceof L))
3126
- throw h;
3127
- A = B();
3128
- }
3129
- try {
3130
- return Ks(A, c, t, a);
3131
- } catch (h) {
3132
- return await _(
3133
- e,
3134
- t,
3135
- h,
3136
- "route",
3137
- i
3138
- );
3139
- }
3140
- }
3141
- function Gs(e) {
3142
- return e ? Ye(e) : ge();
3143
- }
3144
- function _s(e, t) {
3145
- return {
3146
- ...t.ssr,
3147
- dev: t.dev,
3148
- onError: (r, n) => {
3149
- t.onError?.(r, { pathname: e.pathname, site: n });
3150
- },
3151
- transformDocument: t.transformDocument
3152
- };
3153
- }
3154
- function Vs(e, t) {
3155
- if (!t)
3156
- return e;
3157
- const r = new Headers(e.headers), n = new Headers(t.headers);
3158
- for (const [s, i] of n)
3159
- s !== "set-cookie" && r.set(s, i);
3160
- for (const s of n.getSetCookie())
3161
- r.append("set-cookie", s);
3162
- return new Response(e.body, {
3163
- headers: r,
3164
- status: t.status ?? e.status,
3165
- statusText: t.statusText ?? e.statusText
3166
- });
3167
- }
3168
- async function Js(e, t, r, n) {
3169
- const s = await Promise.all(
3170
- e.policies.filter(
3171
- (i) => T(i.fileSegments, t.fileSegments)
3172
- ).map((i) => i.load())
3173
- );
3174
- return Y(
3175
- ...s.map((i) => i.policy),
3176
- r.policy,
3177
- {
3178
- security: n.kind === "page" ? void 0 : n.security
3179
- }
3180
- );
3181
- }
3182
- async function ze(e, t) {
3183
- return (await Promise.all(
3184
- e.middlewares.filter(
3185
- (n) => T(n.fileSegments, t.fileSegments)
3186
- ).map((n) => n.load())
3187
- )).flatMap(
3188
- (n) => n.middleware ? [n.middleware] : []
3189
- );
3190
- }
3191
- async function Be(e, t, r) {
3192
- let n = -1;
3193
- async function s(i) {
3194
- if (i <= n)
3195
- throw new Error("Demiurge route middleware next() called multiple times.");
3196
- n = i;
3197
- const o = e[i];
3198
- return o ? await o(t, () => s(i + 1)) : await r();
3199
- }
3200
- return await s(0);
3201
- }
3202
- function Ks(e, t, r, n) {
3203
- const s = Dr(
3204
- V(e, t.cors, r),
3205
- t.timing
3206
- );
3207
- return n === "HEAD" ? new Response(null, {
3208
- headers: s.headers,
3209
- status: s.status,
3210
- statusText: s.statusText
3211
- }) : s;
3212
- }
3213
- function ue(e) {
3214
- return e.kind === "page" ? void 0 : e.cors;
3215
- }
3216
- function Ys(e) {
3217
- const t = e.toUpperCase();
3218
- return Tt.includes(t) ? t : null;
3219
- }
3220
- function Zs(e, t) {
3221
- return t === "HEAD" ? e.HEAD ?? e.GET : e[t];
3222
- }
3223
- function Ge(e) {
3224
- return new Response(null, {
3225
- headers: {
3226
- allow: Qs(e).join(", ")
3227
- },
3228
- status: 405
3229
- });
3230
- }
3231
- function Qs(e) {
3232
- const t = Tt.filter((r) => e[r]);
3233
- return e.GET && !t.includes("HEAD") && t.push("HEAD"), t;
3234
- }
3235
- export {
3236
- hs as $,
3237
- hr as A,
3238
- Oe as B,
3239
- ie as C,
3240
- Pi as D,
3241
- Le as E,
3242
- ve as F,
3243
- it as G,
3244
- Ur as H,
3245
- On as I,
3246
- Ye as J,
3247
- yt as K,
3248
- Zn as L,
3249
- Yn as M,
3250
- C as N,
3251
- oi as O,
3252
- ge as P,
3253
- Ht as Q,
3254
- L as R,
3255
- Dn as S,
3256
- Me as T,
3257
- ai as U,
3258
- Ci as V,
3259
- Ai as W,
3260
- ii as X,
3261
- gs as Y,
3262
- Qn as Z,
3263
- cs as _,
3264
- Rs as a,
3265
- Si as a0,
3266
- ki as a1,
3267
- gi as a2,
3268
- yi as a3,
3269
- ui as a4,
3270
- Y as a5,
3271
- nn as a6,
3272
- ci as a7,
3273
- Ri as a8,
3274
- Xn as a9,
3275
- Rt as aa,
3276
- ni as ab,
3277
- Ei as ac,
3278
- v as ad,
3279
- Ze as ae,
3280
- le as af,
3281
- xi as ag,
3282
- Ti as ah,
3283
- bi as ai,
3284
- fi as aj,
3285
- si as ak,
3286
- wi as al,
3287
- hi as am,
3288
- T as an,
3289
- pi as ao,
3290
- mi as ap,
3291
- ir as aq,
3292
- dr as ar,
3293
- X as as,
3294
- R as at,
3295
- li as b,
3296
- Di as c,
3297
- Et as d,
3298
- $i as e,
3299
- W as f,
3300
- xe as g,
3301
- zs as h,
3302
- dt as i,
3303
- F as j,
3304
- et as k,
3305
- $e as l,
3306
- rn as m,
3307
- vi as n,
3308
- ps as o,
3309
- U as p,
3310
- vt as q,
3311
- pe as r,
3312
- D as s,
3313
- Rr as t,
3314
- gr as u,
3315
- Te as v,
3316
- di as w,
3317
- tt as x,
3318
- er as y,
3319
- mr as z
3320
- };
3321
- //# sourceMappingURL=testing-B_iMFYz_.js.map