@demiurgejs/core 0.2.0-beta.3 → 0.2.0-beta.5

package/dist/index.js

@@ -1,211 +1,203 @@
-import { jsx as V } from "react/jsx-runtime";
-import { createContext as re, useState as F, useRef as z, useEffect as P, useMemo as ne, createElement as w, useContext as oe, Component as ae } from "react";
-import { g as ie, H as se, h as U, i as ce, j as I } from "./chunks/request-metadata-DaIYq4Ea.js";
-import { F as xr, k as Cr, l as Ir, m as Nr, n as Lr, d as Pr, o as Dr, q as Or, t as Mr, u as Fr, v as zr, p as Ur, a as Br, w as _r, x as jr } from "./chunks/request-metadata-DaIYq4Ea.js";
-import { z as B, x as ue, A as le, B as fe, C as de, D as he, R as me, E as D, F as pe, y as W, G as ge, i as q, H as we, N as _, I as ye, J as ve, K as be, L as Se, O as Ee, P as Re, Q as Te, S as ke } from "./chunks/testing-CRflAw4X.js";
-import { T as Vr, U as Wr, V as qr, W as Gr, X as Kr, Y as Jr, Z as Yr, _ as Zr, $ as Xr, a0 as Qr, a1 as en, u as tn, a2 as rn, d as nn, c as on, q as an, f as sn, e as cn, a3 as un, a4 as ln, a5 as fn, a6 as dn, a7 as hn, a8 as mn, a9 as pn, aa as gn, ab as wn, ac as yn, h as vn, ad as bn, ae as Sn, af as En, ag as Rn, ah as Tn, ai as kn, aj as An, ak as $n, m as xn, al as Cn, am as In, an as Nn, ao as Ln, ap as Pn, aq as Dn, s as On, ar as Mn, w as Fn, as as zn, at as Un, au as Bn, av as _n, aw as jn, ax as Hn, v as Vn, g as Wn, a as qn } from "./chunks/testing-CRflAw4X.js";
-import { k as Ae } from "./chunks/images-Edar3eU1.js";
-import { d as Kn, l as Jn, m as Yn, n as Zn, f as Xn, o as Qn, q as eo, a as to, s as ro, t as no, b as oo, h as ao, j as io, r as so } from "./chunks/images-Edar3eU1.js";
+import { jsx as Et } from "react/jsx-runtime";
+import { createContext as We, useCallback as At, createElement as R, useContext as Je, useRef as k, useMemo as ae, useActionState as nr, useId as or, useLayoutEffect as ne, useState as U, useEffect as Y, Fragment as Te, Component as ir } from "react";
+import { g as ar, h as at, i as sr, H as cr, j as st, k as ur, l as lr, m as Me } from "./chunks/index-0MNiR_wo.js";
+import { F as oi, n as ii, o as ai, q as si, t as ci, d as ui, u as li, v as di, w as fi, x as hi, y as pi, z as mi, p as yi, a as gi, A as wi, B as vi } from "./chunks/index-0MNiR_wo.js";
+import { O as ct, J as dr, P as Ge, i as ee, Q as fr, R as hr, s as Ye, S as Ze, T as Xe, U as pr, V as xt, W as mr, l as Qe, L as kt, X as Be, Y as yr, r as gr, z as Rt, Z as wr, _ as ut, $ as vr, a0 as br, a1 as Sr, a2 as Er, a3 as Ar, a4 as xr, a5 as kr, a6 as Rr } from "./chunks/testing-CUwGj2ie.js";
+import { a7 as Si, D as Ei, a8 as Ai, a9 as xi, aa as ki, ab as Ri, ac as Ti, ad as Mi, ae as Ci, af as $i, ag as Ni, ah as Li, ai as Ii, aj as Di, ak as Pi, al as Oi, am as _i, an as Fi, H as Ui, ao as Bi, e as Hi, c as zi, G as ji, n as Vi, k as qi, ap as Ki, aq as Wi, ar as Ji, f as Gi, as as Yi, at as Zi, au as Xi, av as Qi, aw as ea, ax as ta, ay as ra, az as na, aA as oa, aB as ia, aC as aa, q as sa, aD as ca, aE as ua, h as la, aF as da, aG as fa, x as ha, aH as pa, aI as ma, aJ as ya, aK as ga, j as wa, aL as va, aM as ba, aN as Sa, m as Ea, aO as Aa, aP as xa, aQ as ka, aR as Ra, aS as Ta, aT as Ma, aU as Ca, aV as $a, aW as Na, p as La, aX as Ia, u as Da, aY as Pa, aZ as Oa, a_ as _a, w as Fa, a$ as Ua, I as Ba, K as Ha, b0 as za, b1 as ja, b2 as Va, b3 as qa, b4 as Ka, b5 as Wa, b6 as Ja, b7 as Ga, N as Ya, v as Za, b8 as Xa, o as Qa, b as es } from "./chunks/testing-CUwGj2ie.js";
+import { I as Tr } from "./chunks/static-files-ehaD1kE7.js";
+import { D as rs, c as ns, i as os } from "./chunks/static-files-ehaD1kE7.js";
+import { k as Mr } from "./chunks/images-CG7ZzayG.js";
+import { d as as, l as ss, m as cs, n as us, f as ls, o as ds, q as fs, a as hs, s as ps, t as ms, b as ys, h as gs, j as ws, r as vs } from "./chunks/images-CG7ZzayG.js";
+import { c as Ss, s as Es } from "./chunks/session-store-ChModVcq.js";
 import "react-dom/server";
-const $e = "24h", xe = 1e4;
-function Yt(e = {}) {
-  const t = e.now ?? Date.now, r = e.defaultTtl ?? $e, n = e.maximumEntries ?? xe;
-  if (!Number.isSafeInteger(n) || n <= 0)
-    throw new Error(
-      "Demiurge idempotency maximumEntries must be a positive integer."
-    );
-  const o = B(r);
-  if (!Number.isFinite(o))
-    throw new Error("Demiurge idempotency defaultTtl must be finite.");
-  const a = /* @__PURE__ */ new Map();
+function xo(e) {
   return {
-    async run(i) {
-      const s = ue(i.key), l = t();
-      Ce(a, l);
-      const d = a.get(s);
-      if (d && (d.pending || d.expiresAt > l))
-        return {
-          key: s,
-          replayed: !0,
-          value: await d.value
-        };
-      if (a.size >= n && Ie(a), a.size >= n)
-        throw new Error(
-          "Demiurge idempotency store is at capacity with in-flight mutations."
-        );
-      const p = Promise.resolve().then(i.fn), c = {
-        expiresAt: Number.POSITIVE_INFINITY,
-        pending: !0,
-        value: p
-      };
-      a.set(s, c);
-      try {
-        const f = await p;
-        return c.pending = !1, c.expiresAt = t() + B(i.ttl ?? r), {
-          key: s,
-          replayed: !1,
-          value: f
-        };
-      } catch (f) {
-        throw a.get(s) === c && a.delete(s), f;
-      }
-    }
+    entries: e.map((t) => ({
+      ...t,
+      alternates: Cr(t.alternates ?? [])
+    }))
   };
 }
-function Ce(e, t) {
-  for (const [r, n] of e)
-    !n.pending && n.expiresAt <= t && e.delete(r);
-}
-function Ie(e) {
-  for (const [t, r] of e)
-    if (!r.pending) {
-      e.delete(t);
-      return;
+function Cr(e) {
+  const t = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map();
+  for (const n of e) {
+    const o = n.hrefLang.toLowerCase();
+    let i;
+    try {
+      i = new URL(n.href).href;
+    } catch {
+      throw new Error(
+        `Sitemap alternate URL must be absolute: ${JSON.stringify(n.href)}.`
+      );
     }
+    const s = t.get(o), a = r.get(i);
+    if (s && s !== i)
+      throw new Error(`Sitemap language ${JSON.stringify(n.hrefLang)} has conflicting URLs.`);
+    if (a && a !== o && a !== "x-default" && o !== "x-default")
+      throw new Error(`Sitemap URL ${JSON.stringify(n.href)} has conflicting languages.`);
+    t.set(o, i), r.set(i, o);
+  }
+  return [...t].map(([n, o]) => ({ href: o, hrefLang: n }));
 }
-function Zt(e, t) {
-  return e.run(t);
-}
-function Xt(e) {
-  return {
-    entries: e
-  };
-}
-function Qt(e) {
+function ko(e) {
   return [
     '<?xml version="1.0" encoding="UTF-8"?>',
     `<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"${e.entries.some((r) => r.alternates?.length) ? ' xmlns:xhtml="http://www.w3.org/1999/xhtml"' : ""}>`,
-    ...e.entries.map(Le),
+    ...e.entries.map(Nr),
     "</urlset>",
     ""
   ].join(`
 `);
 }
-function er(e) {
+function Ro(e) {
   return e;
 }
-function tr(e) {
+function To(e) {
   return e;
 }
-function rr(e) {
+function Mo(e) {
   const t = [];
   for (const r of e.rules ?? []) {
-    for (const n of A(r.userAgent))
+    for (const n of de(r.userAgent))
       t.push(`User-agent: ${n}`);
-    for (const n of A(r.allow))
+    for (const n of de(r.allow))
       t.push(`Allow: ${n}`);
-    for (const n of A(r.disallow))
+    for (const n of de(r.disallow))
       t.push(`Disallow: ${n}`);
     t.push("");
   }
   e.host && t.push(`Host: ${e.host}`);
-  for (const r of A(e.sitemap))
+  for (const r of de(e.sitemap))
     t.push(`Sitemap: ${r}`);
   return `${t.join(`
 `).replace(/\n+$/, "")}
 `;
 }
-function Ne(e) {
-  const t = e.width ?? 1200, r = e.height ?? 630, n = e.background ?? "#101820", o = e.foreground ?? "#ffffff", a = N(e.title, 120), i = e.subtitle ? N(e.subtitle, 160) : void 0, s = e.brand ? N(e.brand, 80) : void 0;
-  return Oe(t, r), [
-    `<svg xmlns="http://www.w3.org/2000/svg" width="${t}" height="${r}" viewBox="0 0 ${t} ${r}" role="img" aria-label="${E(a)}">`,
-    `  <rect width="100%" height="100%" fill="${E(n)}" />`,
-    s ? `  <text x="72" y="96" fill="${E(o)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="32" font-weight="700">${R(s)}</text>` : null,
-    `  <text x="72" y="${i ? 300 : 340}" fill="${E(o)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="76" font-weight="800">${R(a)}</text>`,
-    i ? `  <text x="72" y="392" fill="${E(o)}" fill-opacity="0.78" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="38" font-weight="500">${R(i)}</text>` : null,
+function $r(e) {
+  const t = e.width ?? 1200, r = e.height ?? 630, n = e.background ?? "#101820", o = e.foreground ?? "#ffffff", i = Ce(e.title, 120), s = e.subtitle ? Ce(e.subtitle, 160) : void 0, a = e.brand ? Ce(e.brand, 80) : void 0;
+  return Dr(t, r), [
+    `<svg xmlns="http://www.w3.org/2000/svg" width="${t}" height="${r}" viewBox="0 0 ${t} ${r}" role="img" aria-label="${j(i)}">`,
+    `  <rect width="100%" height="100%" fill="${j(n)}" />`,
+    a ? `  <text x="72" y="96" fill="${j(o)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="32" font-weight="700">${X(a)}</text>` : null,
+    `  <text x="72" y="${s ? 300 : 340}" fill="${j(o)}" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="76" font-weight="800">${X(i)}</text>`,
+    s ? `  <text x="72" y="392" fill="${j(o)}" fill-opacity="0.78" font-family="Inter, ui-sans-serif, system-ui, sans-serif" font-size="38" font-weight="500">${X(s)}</text>` : null,
     "</svg>"
-  ].filter((l) => !!l).join(`
+  ].filter((u) => !!u).join(`
 `);
 }
-function nr(e) {
-  return new Response(Ne(e), {
+function Co(e) {
+  return new Response($r(e), {
     headers: {
-      "cache-control": "public, max-age=31536000, immutable",
+      "cache-control": Tr,
       "content-type": "image/svg+xml; charset=utf-8"
     }
   });
 }
-function Le(e) {
+function Nr(e) {
   return [
     "  <url>",
-    `    <loc>${R(e.url)}</loc>`,
-    e.lastModified ? `    <lastmod>${R(Pe(e.lastModified))}</lastmod>` : null,
+    `    <loc>${X(e.url)}</loc>`,
+    e.lastModified ? `    <lastmod>${X(Lr(e.lastModified))}</lastmod>` : null,
     e.changeFrequency ? `    <changefreq>${e.changeFrequency}</changefreq>` : null,
-    e.priority !== void 0 ? `    <priority>${De(e.priority)}</priority>` : null,
+    e.priority !== void 0 ? `    <priority>${Ir(e.priority)}</priority>` : null,
     ...(e.alternates ?? []).map(
-      (t) => `    <xhtml:link rel="alternate" hreflang="${E(t.hrefLang)}" href="${E(t.href)}" />`
+      (t) => `    <xhtml:link rel="alternate" hreflang="${j(t.hrefLang)}" href="${j(t.href)}" />`
     ),
     "  </url>"
   ].filter((t) => !!t).join(`
 `);
 }
-function Pe(e) {
+function Lr(e) {
   return e instanceof Date ? e.toISOString() : e;
 }
-function De(e) {
+function Ir(e) {
   if (e < 0 || e > 1)
     throw new Error("Sitemap entry priority must be between 0 and 1.");
   return String(e);
 }
-function A(e) {
+function de(e) {
   return e === void 0 ? [] : Array.isArray(e) ? e : [e];
 }
-function R(e) {
+function X(e) {
   return e.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
-function E(e) {
-  return R(e).replaceAll('"', "&quot;").replaceAll("'", "&apos;");
+function j(e) {
+  return X(e).replaceAll('"', "&quot;").replaceAll("'", "&apos;");
 }
-function N(e, t) {
+function Ce(e, t) {
   return e.length > t ? `${e.slice(0, t - 3)}...` : e;
 }
-function Oe(e, t) {
+function Dr(e, t) {
   if (!Number.isSafeInteger(e) || e <= 0)
     throw new Error("OG image width must be a positive integer.");
   if (!Number.isSafeInteger(t) || t <= 0)
     throw new Error("OG image height must be a positive integer.");
 }
-function or(e) {
-  return le(
-    async (t) => {
-      const r = e.input ? await e.input(t) : void 0, n = {
-        ...t,
-        input: r
-      }, o = async () => await Me(
-        await e.handler(n),
-        t
-      );
-      if (!e.idempotency)
-        return await o();
-      const a = typeof e.idempotency.key == "function" ? e.idempotency.key(n) : e.idempotency.key;
-      return (await e.idempotency.store.run({
-        fn: o,
-        key: a,
-        ttl: e.idempotency.ttl
-      })).value;
-    },
-    {
-      cors: e.cors,
-      security: e.security,
-      timing: e.timing
+const Pr = "24h", Or = 1e4;
+function $o(e = {}) {
+  const t = e.now ?? Date.now, r = e.defaultTtl ?? Pr, n = e.maximumEntries ?? Or;
+  if (!Number.isSafeInteger(n) || n <= 0)
+    throw new Error(
+      "Demiurge idempotency maximumEntries must be a positive integer."
+    );
+  const o = ct(r);
+  if (!Number.isFinite(o))
+    throw new Error("Demiurge idempotency defaultTtl must be finite.");
+  const i = /* @__PURE__ */ new Map();
+  return {
+    async run(s) {
+      const a = dr(s.key), u = t();
+      _r(i, u);
+      const d = i.get(a);
+      if (d && (d.pending || d.expiresAt > u)) {
+        const h = await d.value;
+        return {
+          key: a,
+          replayed: !0,
+          value: lt(h)
+        };
+      }
+      if (i.size >= n && Fr(i), i.size >= n)
+        throw new Error(
+          "Demiurge idempotency store is at capacity with in-flight mutations."
+        );
+      const v = Promise.resolve().then(s.fn), A = {
+        expiresAt: Number.POSITIVE_INFINITY,
+        pending: !0,
+        value: v
+      };
+      i.set(a, A);
+      try {
+        const h = await v;
+        return A.pending = !1, A.expiresAt = t() + ct(s.ttl ?? r), {
+          key: a,
+          replayed: !1,
+          value: lt(h)
+        };
+      } catch (h) {
+        throw i.get(a) === A && i.delete(a), h;
+      }
     }
-  );
+  };
 }
-const ar = {
-  async formData({ request: e }) {
-    return await e.formData();
-  },
-  async json({ request: e }) {
-    return await e.json();
-  },
-  async text({ request: e }) {
-    return await e.text();
-  }
-};
-async function Me(e, t) {
-  return e instanceof Response ? e : await fe(e, t);
+function lt(e) {
+  return e instanceof Response ? e.clone() : e;
 }
-function ir(e) {
+function _r(e, t) {
+  for (const [r, n] of e)
+    !n.pending && n.expiresAt <= t && e.delete(r);
+}
+function Fr(e) {
+  for (const [t, r] of e)
+    if (!r.pending) {
+      e.delete(t);
+      return;
+    }
+}
+function No(e, t) {
+  return e.run(t);
+}
+function Lo(e) {
   return typeof e == "function" ? {
     kind: "page",
     render: { mode: "ssr" },
@@ -218,10 +210,10 @@ function ir(e) {
     view: e.view
   };
 }
-function sr(e) {
+function Io(e) {
   return e;
 }
-const cr = {
+const Do = {
   hmac(e) {
     return {
       kind: "response",
@@ -229,7 +221,7 @@ const cr = {
         const r = new Uint8Array(await t.request.arrayBuffer()), n = t.request.headers.get(
           e.header ?? "x-webhook-signature"
         );
-        return n ? await Fe(r, n, e) ? await e.handler({
+        return n ? await Ur(r, n, e) ? await e.handler({
           ...t,
           rawBody: r,
           text: () => new TextDecoder().decode(r)
@@ -239,21 +231,29 @@ const cr = {
           status: 401
         });
       },
+      // ADR 0018: a framework helper that declares an exception names itself
+      // as the source, so the audit separates it from an application
+      // declaration.
       security: {
-        csrf: !1
+        csrf: {
+          origin: "framework",
+          reason: "A webhook sender holds no browser session, so an HMAC signature replaces the CSRF check.",
+          source: "webhook.hmac()",
+          value: !1
+        }
       }
     };
   }
 };
-async function Fe(e, t, r) {
-  const n = r.algorithm ?? "SHA-256", o = r.encoding ?? "hex", a = ze(
+async function Ur(e, t, r) {
+  const n = r.algorithm ?? "SHA-256", o = r.encoding ?? "hex", i = Br(
     t,
     n,
     r.prefix
-  ), i = Ue(a, o);
-  if (!i)
+  ), s = Hr(i, o);
+  if (!s)
     return !1;
-  const s = await globalThis.crypto.subtle.importKey(
+  const a = await globalThis.crypto.subtle.importKey(
     "raw",
     new TextEncoder().encode(r.secret),
     {
@@ -265,16 +265,16 @@ async function Fe(e, t, r) {
   );
   return await globalThis.crypto.subtle.verify(
     "HMAC",
+    a,
     s,
-    i,
     Uint8Array.from(e).buffer
   );
 }
-function ze(e, t, r) {
+function Br(e, t, r) {
   const n = e.trim(), o = r === void 0 ? `${t.toLowerCase().replace("-", "")}=` : r;
   return o !== !1 && n.startsWith(o) ? n.slice(o.length).trim() : n;
 }
-function Ue(e, t) {
+function Hr(e, t) {
   if (t === "hex")
     return /^(?:[0-9a-f]{2})+$/i.test(e) ? Uint8Array.from(
       e.match(/.{2}/g) ?? [],
@@ -291,19 +291,19 @@ function Ue(e, t) {
     return null;
   }
 }
-const Be = /^[!#$%&'*+\-.^_`|~A-Za-z0-9]+$/, _e = {
+const zr = /^[!#$%&'*+\-.^_`|~A-Za-z0-9]+$/, jr = {
   host: "__Host-",
   none: "",
   secure: "__Secure-"
-}, j = 4096;
-function O(e, t = "host") {
-  return `${_e[t]}${e}`;
+}, dt = 4096;
+function ce(e, t = "host") {
+  return `${jr[t]}${e}`;
 }
-function je(e) {
-  const t = e.scope ?? "host", r = O(e.name, t), n = [], o = (a, i) => {
-    n.push({ code: a, message: i, name: r });
+function Vr(e) {
+  const t = e.scope ?? "host", r = ce(e.name, t), n = [], o = (i, s) => {
+    n.push({ code: i, message: s, name: r });
   };
-  if (Be.test(e.name) || o(
+  if (zr.test(e.name) || o(
     "cookie-name-invalid",
     `Cookie name ${JSON.stringify(e.name)} contains a character that a cookie name cannot hold. Use letters, digits, or the token characters that RFC 6265 allows.`
   ), (e.name.startsWith("__Host-") || e.name.startsWith("__Secure-")) && o(
@@ -325,165 +325,603 @@ function je(e) {
     "cookie-max-age-invalid",
     `Cookie ${r} declares maxAge ${JSON.stringify(e.maxAge)}. Use a whole number of seconds that is zero or greater.`
   ), n.length === 0) {
-    const a = new TextEncoder().encode(G(e, t, r)).length;
-    a > j && o(
+    const i = new TextEncoder().encode(Tt(e, t, r)).length;
+    i > dt && o(
       "cookie-too-large",
-      `Cookie ${r} serializes to ${a} bytes, and a browser drops a cookie above ${j} bytes. Store the payload on the server and keep an identifier in the cookie.`
+      `Cookie ${r} serializes to ${i} bytes, and a browser drops a cookie above ${dt} bytes. Store the payload on the server and keep an identifier in the cookie.`
     );
   }
   return n;
 }
-function ur(e, t = "host") {
+function Po(e, t = "host") {
   if (typeof document > "u")
     return;
   const r = typeof e == "string" ? { name: e, scope: t } : e;
-  return de(document.cookie).get(
-    O(r.name, r.scope ?? "host")
+  return Ge(document.cookie).get(
+    ce(r.name, r.scope ?? "host")
   );
 }
-function lr(e) {
-  const t = je(e);
+function Se(e) {
+  const t = Vr(e);
   if (t.length > 0)
     throw new Error(
       `Demiurge rejected a cookie declaration. ${t.map((n) => n.message).join(" ")}`
     );
   const r = e.scope ?? "host";
-  return G(e, r, O(e.name, r));
+  return Tt(e, r, ce(e.name, r));
 }
-function G(e, t, r) {
+function Tt(e, t, r) {
   const n = [`${r}=${encodeURIComponent(e.value)}`], o = t === "host" ? "/" : e.path ?? "/";
   return n.push(`Path=${o}`), t !== "host" && e.domain !== void 0 && n.push(`Domain=${e.domain}`), e.expires && n.push(`Expires=${e.expires.toUTCString()}`), e.maxAge !== void 0 && n.push(`Max-Age=${e.maxAge}`), n.push(`SameSite=${e.sameSite ?? "Lax"}`), (e.httpOnly ?? !0) && n.push("HttpOnly"), (t !== "none" || (e.secure ?? !0)) && n.push("Secure"), n.join("; ");
 }
-class He extends Error {
-  issues;
-  constructor(t) {
-    super(Ye(t)), this.name = "EnvValidationError", this.issues = t;
+const qr = 10080 * 60 * 1e3, Kr = 1440 * 60 * 1e3, ft = 32;
+function Oo(e) {
+  const t = Ct(e);
+  return Mt(t, Jr(t.keys));
+}
+function _o(e) {
+  const t = Ct(e);
+  for (const r of t.keys)
+    if (r.value.byteLength !== 32)
+      throw new Error(
+        `Demiurge encrypted cookie session key ${JSON.stringify(r.id)} must contain exactly 32 bytes for AES-256-GCM.`
+      );
+  return Mt(
+    t,
+    Gr(t.keys, t.randomBytes)
+  );
+}
+function Mt(e, t) {
+  const r = ce(
+    e.cookie.name,
+    e.cookie.scope ?? "host"
+  );
+  return {
+    cookieName: r,
+    async open(n) {
+      const o = Ge(n.headers.get("cookie") ?? "").get(r), i = e.now(), s = o ? await t.decode(o) : void 0;
+      let a = s?.record, u = !!(o && !s), d = !!(s && !s.currentKey);
+      a && Zr(a, i) ? (a = void 0, u = !0, d = !1) : a && e.renewal && e.idleExpirationMs !== !1 && a.idleExpiresAt !== void 0 && a.idleExpiresAt - i <= e.idleExpirationMs / 4 && (a = {
+        ...a,
+        idleExpiresAt: Math.min(
+          a.expiresAt,
+          i + e.idleExpirationMs
+        ),
+        version: a.version + 1
+      }, d = !0);
+      const v = () => {
+        if (!a)
+          throw new Error(
+            "Demiurge cannot change a session that does not exist. Create the session first."
+          );
+        return a;
+      }, A = (h) => (a = Le(h), u = !1, d = !0, Le(h));
+      return {
+        async commit() {
+          return u ? [Xr(e.cookie)] : !a || !d ? [] : [Se({
+            ...e.cookie,
+            expires: new Date(a.expiresAt),
+            value: await t.encode(a)
+          })];
+        },
+        create(h, p = {}) {
+          if (a)
+            throw new Error(
+              "Demiurge cannot create a session when one already exists. Rotate or update the current session."
+            );
+          const E = e.now(), g = et(
+            "absoluteExpirationMs",
+            p.absoluteExpirationMs ?? e.absoluteExpirationMs
+          ), b = p.idleExpirationMs === void 0 ? e.idleExpirationMs : $t(p.idleExpirationMs), m = E + g;
+          return A({
+            createdAt: E,
+            data: Ne(h),
+            expiresAt: m,
+            id: pt(e.randomBytes),
+            ...b === !1 ? {} : {
+              idleExpiresAt: Math.min(
+                m,
+                E + b
+              )
+            },
+            version: 0
+          });
+        },
+        destroy() {
+          a = void 0, u = !0, d = !1;
+        },
+        get() {
+          return a ? Le(a) : void 0;
+        },
+        rotate(h) {
+          const p = v();
+          return A({
+            ...p,
+            data: h === void 0 ? p.data : Ne(h),
+            id: pt(e.randomBytes),
+            version: p.version + 1
+          });
+        },
+        update(h) {
+          const p = v();
+          return A({
+            ...p,
+            data: Ne(h),
+            version: p.version + 1
+          });
+        }
+      };
+    }
+  };
+}
+function Ct(e) {
+  const t = Wr(e.keys), r = et(
+    "absoluteExpirationMs",
+    e.absoluteExpirationMs ?? qr
+  ), n = $t(
+    e.idleExpirationMs ?? Kr
+  );
+  return {
+    absoluteExpirationMs: r,
+    cookie: { ...e.cookie, name: e.cookie?.name ?? "session" },
+    idleExpirationMs: n,
+    keys: t,
+    now: e.now ?? Date.now,
+    randomBytes: e.randomBytes ?? Qr,
+    renewal: e.renewal ?? !0
+  };
+}
+function Wr(e) {
+  if (e.length === 0)
+    throw new Error(
+      "Demiurge cookie sessions require at least one key. Put the current key first."
+    );
+  const t = /* @__PURE__ */ new Set();
+  for (const r of e) {
+    if (!/^[A-Za-z0-9_-]+$/.test(r.id))
+      throw new Error(
+        "Demiurge cookie session key identifiers can use only letters, digits, underscores, and hyphens."
+      );
+    if (t.has(r.id))
+      throw new Error(
+        `Demiurge cookie session key identifier ${JSON.stringify(r.id)} is not unique.`
+      );
+    if (r.value.byteLength < 32)
+      throw new Error(
+        `Demiurge cookie session key ${JSON.stringify(r.id)} must contain at least 32 bytes.`
+      );
+    t.add(r.id);
   }
+  return [...e];
 }
-function fr(e) {
-  return e;
+function et(e, t) {
+  if (!Number.isSafeInteger(t) || t <= 0)
+    throw new Error(
+      `Demiurge cookie session ${e} must be a positive whole number of milliseconds.`
+    );
+  return t;
 }
-function dr(e, t) {
-  const r = [], n = {};
-  for (const o of Object.keys(e)) {
-    const a = e[o], i = t[String(o)];
-    if (i === void 0 || i === "") {
-      if (a.optional) {
-        n[o] = void 0;
-        continue;
-      }
-      r.push({
-        code: "missing",
-        key: String(o),
-        message: `Environment variable ${String(o)} is required.`
-      });
-      continue;
+function $t(e) {
+  return e === !1 ? !1 : et("idleExpirationMs", e);
+}
+function Jr(e) {
+  return {
+    async decode(t) {
+      const r = t.split(".");
+      if (r.length !== 4 || r[0] !== "s1")
+        return;
+      const n = e.findIndex((v) => v.id === r[1]), o = e[n], i = be(r[2]), s = be(r[3]);
+      if (!o || !i || !s)
+        return;
+      const a = await crypto.subtle.importKey(
+        "raw",
+        I(o.value),
+        { hash: "SHA-256", name: "HMAC" },
+        !1,
+        ["verify"]
+      );
+      if (!await crypto.subtle.verify(
+        "HMAC",
+        a,
+        I(s),
+        I(Q(`s1.${o.id}.${r[2]}`))
+      ))
+        return;
+      const d = Nt(i);
+      return d ? { currentKey: n === 0, record: d } : void 0;
+    },
+    async encode(t) {
+      const r = e[0], n = se(Q(JSON.stringify(t))), o = `s1.${r.id}.${n}`, i = await crypto.subtle.importKey(
+        "raw",
+        I(r.value),
+        { hash: "SHA-256", name: "HMAC" },
+        !1,
+        ["sign"]
+      ), s = await crypto.subtle.sign(
+        "HMAC",
+        i,
+        I(Q(o))
+      );
+      return `${o}.${se(new Uint8Array(s))}`;
     }
-    try {
-      n[o] = a.parse(String(o), i);
-    } catch (s) {
-      r.push({
-        code: "invalid",
-        key: String(o),
-        message: s instanceof Error ? s.message : `Environment variable ${String(o)} is invalid.`
-      });
+  };
+}
+function Gr(e, t) {
+  return {
+    async decode(r) {
+      const n = r.split(".");
+      if (n.length !== 4 || n[0] !== "e1")
+        return;
+      const o = e.findIndex((u) => u.id === n[1]), i = e[o], s = be(n[2]), a = be(n[3]);
+      if (!(!i || s?.byteLength !== 12 || !a))
+        try {
+          const u = await ht(i), d = await crypto.subtle.decrypt(
+            {
+              additionalData: I(Q(`e1.${i.id}`)),
+              iv: I(s),
+              name: "AES-GCM"
+            },
+            u,
+            I(a)
+          ), v = Nt(new Uint8Array(d));
+          return v ? { currentKey: o === 0, record: v } : void 0;
+        } catch {
+          return;
+        }
+    },
+    async encode(r) {
+      const n = e[0], o = t(12);
+      if (o.byteLength !== 12)
+        throw new Error(
+          "Demiurge cookie session randomBytes returned an incorrect byte count."
+        );
+      const i = await ht(n), s = await crypto.subtle.encrypt(
+        {
+          additionalData: I(Q(`e1.${n.id}`)),
+          iv: I(o),
+          name: "AES-GCM"
+        },
+        i,
+        I(Q(JSON.stringify(r)))
+      );
+      return `e1.${n.id}.${se(o)}.${se(new Uint8Array(s))}`;
     }
+  };
+}
+async function ht(e) {
+  return await crypto.subtle.importKey(
+    "raw",
+    I(e.value),
+    "AES-GCM",
+    !1,
+    ["decrypt", "encrypt"]
+  );
+}
+function Nt(e) {
+  try {
+    const t = JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(e));
+    return !ee(t) || !$e(t.createdAt) || !$e(t.expiresAt) || typeof t.id != "string" || !/^[A-Za-z0-9_-]{43}$/.test(t.id) || !Yr(t.version) || t.idleExpiresAt !== void 0 && !$e(t.idleExpiresAt) || !ve(t.data) ? void 0 : t;
+  } catch {
+    return;
   }
-  if (r.length)
-    throw new He(r);
-  return n;
 }
-function Ve(e = {}) {
-  return T(e, !1, (t, r) => {
-    if (r === "true" || r === "1")
-      return !0;
-    if (r === "false" || r === "0")
-      return !1;
-    throw new Error(`Environment variable ${t} must be true, false, 1, or 0.`);
+function $e(e) {
+  return typeof e == "number" && Number.isSafeInteger(e) && e >= 0;
+}
+function Yr(e) {
+  return typeof e == "number" && Number.isSafeInteger(e) && e >= 0;
+}
+function ve(e) {
+  return e === null || typeof e == "boolean" || typeof e == "string" ? !0 : typeof e == "number" ? Number.isFinite(e) : Array.isArray(e) ? e.every(ve) : ee(e) && Object.values(e).every(ve);
+}
+function Zr(e, t) {
+  return e.expiresAt <= t || e.idleExpiresAt !== void 0 && e.idleExpiresAt <= t;
+}
+function Xr(e) {
+  return Se({
+    ...e,
+    expires: /* @__PURE__ */ new Date(0),
+    maxAge: 0,
+    value: ""
   });
 }
-function We(e, t = {}) {
-  return T(t, !1, (r, n) => {
-    if (e.includes(n))
-      return n;
+function pt(e) {
+  const t = e(ft);
+  if (t.byteLength !== ft)
     throw new Error(
-      `Environment variable ${r} must be one of: ${e.join(", ")}.`
+      "Demiurge cookie session randomBytes returned an incorrect byte count."
     );
-  });
+  return se(t);
 }
-function qe(e = {}) {
-  return T(e, !1, (t, r) => {
-    if (!/^-?\d+$/.test(r))
-      throw new Error(`Environment variable ${t} must be an integer.`);
-    const n = Number(r);
-    if (!Number.isSafeInteger(n))
-      throw new Error(`Environment variable ${t} must be a safe integer.`);
-    if (e.min !== void 0 && n < e.min)
+function Qr(e) {
+  return crypto.getRandomValues(new Uint8Array(e));
+}
+function Ne(e) {
+  if (!ve(e))
+    throw new Error(
+      "Demiurge session data must contain only finite JSON values."
+    );
+  return structuredClone(e);
+}
+function Le(e) {
+  return structuredClone(e);
+}
+function Q(e) {
+  return new TextEncoder().encode(e);
+}
+function I(e) {
+  return Uint8Array.from(e).buffer;
+}
+function se(e) {
+  let t = "";
+  for (const r of e)
+    t += String.fromCharCode(r);
+  return btoa(t).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function be(e) {
+  if (/^[A-Za-z0-9_-]+$/.test(e))
+    try {
+      const t = "=".repeat((4 - e.length % 4) % 4), r = atob(e.replaceAll("-", "+").replaceAll("_", "/") + t);
+      return Uint8Array.from(r, (n) => n.charCodeAt(0));
+    } catch {
+      return;
+    }
+}
+const en = 10080 * 60 * 1e3, tn = 1440 * 60 * 1e3;
+class rn extends Error {
+  constructor(t) {
+    super(
+      `Demiurge session ${t} conflicted with another request. Load the current session before another lifecycle operation.`
+    ), this.name = "SessionStoreConflictError";
+  }
+}
+class mt extends Error {
+  constructor(t) {
+    super(
+      `Demiurge session ${t} failed because the session store is unavailable.`
+    ), this.name = "SessionStoreUnavailableError";
+  }
+}
+function Fo(e) {
+  const t = nn(e), r = ce(
+    t.cookie.name,
+    t.cookie.scope ?? "host"
+  );
+  return {
+    cookieName: r,
+    async open(n) {
+      const o = Ge(n.headers.get("cookie") ?? "").get(r), i = o ? await sn(o, t.keys) : void 0, s = t.now();
+      let a = i ? await t.store.read(i.id, s) : void 0, u = !!(o && (!i || !a)), d = !!(a && i && !i.currentKey);
+      if (a && t.renewal && t.idleExpirationMs !== !1 && a.idleExpiresAt !== void 0 && a.idleExpiresAt - s <= t.idleExpirationMs / 4) {
+        const h = await t.store.update({
+          ...Ie(a),
+          idleExpiresAt: Math.min(
+            a.expiresAt,
+            s + t.idleExpirationMs
+          )
+        }, a.version);
+        if (h.status === "stored")
+          a = h.record, d = !0;
+        else if (h.status === "conflict")
+          a = await t.store.read(a.id, s), u = !a;
+        else
+          throw new mt("renewal");
+      }
+      const v = () => {
+        if (!a)
+          throw new Error(
+            "Demiurge cannot change a session that does not exist. Create the session first."
+          );
+        return a;
+      }, A = (h, p) => {
+        if (h.status === "conflict")
+          throw new rn(p);
+        if (h.status === "unavailable")
+          throw new mt(p);
+        return a = Pe(h.record), u = !1, d = !0, Pe(h.record);
+      };
+      return {
+        async commit() {
+          return u ? [cn(t.cookie)] : !a || !d ? [] : [Se({
+            ...t.cookie,
+            expires: new Date(a.expiresAt),
+            value: await an(a.id, t.keys[0])
+          })];
+        },
+        async create(h, p = {}) {
+          if (a)
+            throw new Error(
+              "Demiurge cannot create a session when one already exists. Rotate or update the current session."
+            );
+          const E = t.now(), g = tt(
+            "absoluteExpirationMs",
+            p.absoluteExpirationMs ?? t.absoluteExpirationMs
+          ), b = p.idleExpirationMs === void 0 ? t.idleExpirationMs : Lt(p.idleExpirationMs), m = E + g, T = {
+            createdAt: E,
+            data: De(h),
+            expiresAt: m,
+            id: yt(t.randomBytes),
+            ...b === !1 ? {} : {
+              idleExpiresAt: Math.min(
+                m,
+                E + b
+              )
+            }
+          };
+          return A(await t.store.create(T), "creation");
+        },
+        async destroy() {
+          a && await t.store.destroy(a.id), a = void 0, u = !0, d = !1;
+        },
+        get() {
+          return a ? Pe(a) : void 0;
+        },
+        async rotate(h) {
+          const p = v(), E = {
+            ...Ie(p),
+            data: h === void 0 ? p.data : De(h),
+            id: yt(t.randomBytes)
+          };
+          return A(
+            await t.store.rotate(p.id, E, p.version),
+            "rotation"
+          );
+        },
+        async update(h) {
+          const p = v();
+          return A(
+            await t.store.update({
+              ...Ie(p),
+              data: De(h)
+            }, p.version),
+            "update"
+          );
+        }
+      };
+    }
+  };
+}
+function nn(e) {
+  if (!e.store || typeof e.store.read != "function")
+    throw new Error(
+      "Demiurge session manager requires a SessionStore implementation."
+    );
+  const t = on(e.keys);
+  return {
+    absoluteExpirationMs: tt(
+      "absoluteExpirationMs",
+      e.absoluteExpirationMs ?? en
+    ),
+    cookie: { ...e.cookie, name: e.cookie?.name ?? "session" },
+    idleExpirationMs: Lt(
+      e.idleExpirationMs ?? tn
+    ),
+    keys: t,
+    now: e.now ?? Date.now,
+    randomBytes: e.randomBytes ?? un,
+    renewal: e.renewal ?? !0,
+    store: e.store
+  };
+}
+function on(e) {
+  if (e.length === 0)
+    throw new Error(
+      "Demiurge session manager requires at least one key. Put the current key first."
+    );
+  const t = /* @__PURE__ */ new Set();
+  for (const r of e) {
+    if (!/^[A-Za-z0-9_-]+$/.test(r.id) || t.has(r.id))
       throw new Error(
-        `Environment variable ${t} must be greater than or equal to ${e.min}.`
+        "Demiurge session manager key identifiers must be unique token values."
       );
-    if (e.max !== void 0 && n > e.max)
+    if (r.value.byteLength < 32)
       throw new Error(
-        `Environment variable ${t} must be less than or equal to ${e.max}.`
+        `Demiurge session manager key ${JSON.stringify(r.id)} must contain at least 32 bytes.`
       );
-    return n;
-  });
+    t.add(r.id);
+  }
+  return [...e];
 }
-function Ge(e = {}) {
-  return T(
-    e,
-    !0,
-    (t, r) => K(t, r, e)
+async function an(e, t) {
+  const r = `i1.${t.id}.${e}`, n = await crypto.subtle.importKey(
+    "raw",
+    oe(t.value),
+    { hash: "SHA-256", name: "HMAC" },
+    !1,
+    ["sign"]
+  ), o = await crypto.subtle.sign(
+    "HMAC",
+    n,
+    oe(new TextEncoder().encode(r))
   );
+  return `${r}.${It(new Uint8Array(o))}`;
 }
-function Ke(e = {}) {
-  return T(
-    e,
+async function sn(e, t) {
+  const r = e.split(".");
+  if (r.length !== 4 || r[0] !== "i1" || !/^[A-Za-z0-9_-]{43}$/.test(r[2]))
+    return;
+  const n = t.findIndex((u) => u.id === r[1]), o = t[n], i = ln(r[3]);
+  if (!o || !i)
+    return;
+  const s = await crypto.subtle.importKey(
+    "raw",
+    oe(o.value),
+    { hash: "SHA-256", name: "HMAC" },
     !1,
-    (t, r) => K(t, r, e)
+    ["verify"]
   );
+  return await crypto.subtle.verify(
+    "HMAC",
+    s,
+    oe(i),
+    oe(new TextEncoder().encode(r.slice(0, 3).join(".")))
+  ) ? { currentKey: n === 0, id: r[2] } : void 0;
 }
-function Je(e = {}) {
-  return T(e, !1, (t, r) => {
-    let n;
-    try {
-      n = new URL(r);
-    } catch {
-      throw new Error(`Environment variable ${t} must be a valid URL.`);
-    }
-    if (e.protocols?.length && !e.protocols.includes(n.protocol))
-      throw new Error(
-        `Environment variable ${t} must use one of these protocols: ${e.protocols.join(", ")}.`
-      );
-    return n;
+function Ie(e) {
+  const { version: t, ...r } = e;
+  return r;
+}
+function cn(e) {
+  return Se({
+    ...e,
+    expires: /* @__PURE__ */ new Date(0),
+    maxAge: 0,
+    value: ""
   });
 }
-const hr = {
-  boolean: Ve,
-  enum: We,
-  integer: qe,
-  secret: Ge,
-  string: Ke,
-  url: Je
-};
-function T(e, t, r) {
-  return {
-    optional: e.optional ?? !1,
-    parse: r,
-    sensitive: t
-  };
-}
-function K(e, t, r) {
-  if (r.minLength !== void 0 && t.length < r.minLength)
+function tt(e, t) {
+  if (!Number.isSafeInteger(t) || t <= 0)
     throw new Error(
-      `Environment variable ${e} must be at least ${r.minLength} characters.`
+      `Demiurge session manager ${e} must be a positive whole number of milliseconds.`
     );
   return t;
 }
-function Ye(e) {
-  return e.length === 1 ? e[0].message : `Environment validation failed with ${e.length} issues.`;
+function Lt(e) {
+  return e === !1 ? !1 : tt("idleExpirationMs", e);
+}
+function yt(e) {
+  const t = e(32);
+  if (t.byteLength !== 32)
+    throw new Error(
+      "Demiurge session manager randomBytes returned an incorrect byte count."
+    );
+  return It(t);
+}
+function un(e) {
+  return crypto.getRandomValues(new Uint8Array(e));
+}
+function De(e) {
+  if (!He(e))
+    throw new Error(
+      "Demiurge session data must contain only finite JSON values."
+    );
+  return structuredClone(e);
+}
+function He(e) {
+  return e === null || typeof e == "boolean" || typeof e == "string" ? !0 : typeof e == "number" ? Number.isFinite(e) : Array.isArray(e) ? e.every(He) : typeof e == "object" && e !== null && Object.values(e).every(He);
+}
+function Pe(e) {
+  return structuredClone(e);
 }
-function mr(e = {}) {
+function It(e) {
+  let t = "";
+  for (const r of e)
+    t += String.fromCharCode(r);
+  return btoa(t).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+function ln(e) {
+  if (/^[A-Za-z0-9_-]+$/.test(e))
+    try {
+      const t = "=".repeat((4 - e.length % 4) % 4), r = atob(e.replaceAll("-", "+").replaceAll("_", "/") + t);
+      return Uint8Array.from(r, (n) => n.charCodeAt(0));
+    } catch {
+      return;
+    }
+}
+function oe(e) {
+  return Uint8Array.from(e).buffer;
+}
+function Uo(e = {}) {
   return async function(r) {
     if (r.method.toUpperCase() !== "POST")
       return new Response(null, {
@@ -492,25 +930,25 @@ function mr(e = {}) {
         },
         status: 405
       });
-    const n = Xe(r);
+    const n = fn(r);
     if (n)
       return n;
-    const o = Qe(e, r);
+    const o = hn(e, r);
     if (o)
       return o;
-    e.maxBodySize !== void 0 && (r = he({ maxBodySize: e.maxBodySize }, r));
-    let a;
+    e.maxBodySize !== void 0 && (r = fr({ maxBodySize: e.maxBodySize }, r));
+    let i;
     try {
-      a = await r.json();
-    } catch (s) {
-      return s instanceof me ? new Response("Security report body too large.", { status: 413 }) : new Response("Invalid security report JSON.", {
+      i = await r.json();
+    } catch (a) {
+      return a instanceof hr ? new Response("Security report body too large.", { status: 413 }) : new Response("Invalid security report JSON.", {
         status: 400
       });
     }
-    const i = et(a);
-    for (let s = 0; s < i.length; s += 1)
-      await e.onReport?.(i[s], {
-        index: s,
+    const s = pn(i);
+    for (let a = 0; a < s.length; a += 1)
+      await e.onReport?.(s[a], {
+        index: a,
         request: r
       });
     return new Response(null, {
@@ -518,20 +956,20 @@ function mr(e = {}) {
     });
   };
 }
-const Ze = /* @__PURE__ */ new Set([
+const dn = /* @__PURE__ */ new Set([
   "application/csp-report",
   "application/reports+json"
 ]);
-function Xe(e) {
+function fn(e) {
   const t = e.headers.get("content-type");
   if (!t)
     return null;
   const r = t.split(";", 1)[0]?.trim().toLowerCase();
-  return r && Ze.has(r) ? null : new Response("Unsupported security report Content-Type.", {
+  return r && dn.has(r) ? null : new Response("Unsupported security report Content-Type.", {
     status: 415
   });
 }
-function Qe(e, t) {
+function hn(e, t) {
   if (e.maxBodySize === void 0)
     return null;
   const r = t.headers.get("content-length");
@@ -542,32 +980,29 @@ function Qe(e, t) {
       status: 400
     });
   const n = Number(r);
-  return Number.isSafeInteger(n) ? n > D(e.maxBodySize) ? new Response("Security report body too large.", {
+  return Number.isSafeInteger(n) ? n > Ye(e.maxBodySize) ? new Response("Security report body too large.", {
     status: 413
   }) : null : new Response("Invalid Content-Length.", {
     status: 400
   });
 }
-function et(e) {
-  return Array.isArray(e) ? e : tt(e) && "csp-report" in e ? [e["csp-report"]] : [e];
-}
-function tt(e) {
-  return typeof e == "object" && e !== null;
+function pn(e) {
+  return Array.isArray(e) ? e : Ze(e) && "csp-report" in e ? [e["csp-report"]] : [e];
 }
-function pr(e, t) {
+function Bo(e, t) {
   const r = {}, n = [];
   let o = 0;
-  for (const [a, i] of Object.entries(t.files)) {
-    const s = e.getAll(a).filter(ot);
-    r[a] = s, i.required && s.length === 0 && n.push({
+  for (const [i, s] of Object.entries(t.files)) {
+    const a = e.getAll(i).filter(gn);
+    r[i] = a, s.required && a.length === 0 && n.push({
       code: "file-missing",
-      field: a,
-      message: `Upload field ${a} requires at least one file.`
+      field: i,
+      message: `Upload field ${i} requires at least one file.`
     });
-    for (const l of s)
-      o += l.size, rt(a, l, i, n);
+    for (const u of a)
+      o += u.size, mn(i, u, s, n);
   }
-  return t.maxTotalSize !== void 0 && o > D(t.maxTotalSize) && n.push({
+  return t.maxTotalSize !== void 0 && o > Ye(t.maxTotalSize) && n.push({
     code: "total-upload-too-large",
     field: "*",
     message: `Uploaded files exceed the maximum total size of ${t.maxTotalSize}.`
@@ -578,24 +1013,24 @@ function pr(e, t) {
     totalSize: o
   };
 }
-function rt(e, t, r, n) {
-  r.maxSize !== void 0 && t.size > D(r.maxSize) && n.push({
+function mn(e, t, r, n) {
+  r.maxSize !== void 0 && t.size > Ye(r.maxSize) && n.push({
     code: "file-too-large",
     field: e,
     message: `Upload field ${e} contains ${t.name || "a file"} larger than ${r.maxSize}.`
-  }), r.types?.length && !nt(t.type, r.types) && n.push({
+  }), r.types?.length && !yn(t.type, r.types) && n.push({
     code: "file-type-not-allowed",
     field: e,
     message: `Upload field ${e} contains ${t.name || "a file"} with disallowed type ${t.type || "unknown"}.`
   });
 }
-function nt(e, t) {
+function yn(e, t) {
   return t.some((r) => r.endsWith("/*") ? e.startsWith(r.slice(0, -1)) : e === r);
 }
-function ot(e) {
+function gn(e) {
   return e instanceof File;
 }
-function at(e, t) {
+function wn(e, t) {
   const r = t.headers.get("origin");
   if (!r)
     return {
@@ -604,7 +1039,7 @@ function at(e, t) {
       origin: r,
       reason: e.allowMissingOrigin ? void 0 : "missing-origin"
     };
-  const n = J(r);
+  const n = Dt(r);
   if (!n)
     return {
       allowed: !1,
@@ -612,7 +1047,7 @@ function at(e, t) {
       origin: r,
       reason: "invalid-origin"
     };
-  const o = it(e, n, t);
+  const o = vn(e, n, t);
   return {
     allowed: o,
     expected: e.origins,
@@ -620,20 +1055,20 @@ function at(e, t) {
     reason: o ? void 0 : "origin-not-allowed"
   };
 }
-function gr(e, t) {
-  return !e || at(e, t).allowed ? null : new Response("WebSocket origin not allowed.", {
+function Ho(e, t) {
+  return !e || wn(e, t).allowed ? null : new Response("WebSocket origin not allowed.", {
     status: 403
   });
 }
-function it(e, t, r) {
+function vn(e, t, r) {
   return e.origins === "same-origin" ? t === new URL(r.url).origin : e.origins.some(
-    (n) => st(n, t)
+    (n) => bn(n, t)
   );
 }
-function st(e, t) {
-  return e === "null" ? t === "null" : J(e) === t;
+function bn(e, t) {
+  return e === "null" ? t === "null" : Dt(e) === t;
 }
-function J(e) {
+function Dt(e) {
   if (e === "null")
     return e;
   try {
@@ -651,105 +1086,551 @@ function J(e) {
     return null;
   }
 }
-function ct(e) {
-  const t = W(e.routes), r = e.loadNavigationData ?? Z;
+const Pt = We({
+  register: () => () => {
+  },
+  focus: () => !1
+});
+function Sn() {
+  const e = Je(Pt), t = k(void 0), r = At((n) => {
+    t.current?.(), t.current = void 0, n && (t.current = e.register(n));
+  }, [e]);
+  return ae(() => ({
+    ref: r,
+    tabIndex: -1
+  }), [r]);
+}
+function zo(e) {
+  const { as: t, children: r, ref: n, ...o } = e, i = Sn(), s = At((a) => {
+    if (a) {
+      i.ref(a), gt(n, a);
+      return;
+    }
+    gt(n, null), i.ref(null);
+  }, [i.ref, n]);
+  return R(t ?? "div", {
+    ...o,
+    ...i,
+    ref: s,
+    children: r
+  });
+}
+function gt(e, t) {
+  typeof e == "function" ? e(t) : e && (e.current = t);
+}
+const Ot = Symbol("Demiurge mutation form action");
+let ie;
+const ze = /* @__PURE__ */ new Set();
+function En(e) {
+  return ie = e, () => {
+    ie === e && (ie = void 0);
+  };
+}
+function je(e) {
+  for (const t of ze)
+    t !== e && t.abort();
+}
+function An(e) {
+  let t;
+  return (r, n) => {
+    t?.controller.abort();
+    const o = new AbortController(), i = {
+      controller: o,
+      // TYPE-EVIDENCE: the function assigns the promise before it exposes the invocation.
+      promise: void 0
+    };
+    ze.add(o);
+    const s = Xe({
+      to: e.route,
+      ...e.path === void 0 ? {} : { path: e.path }
+    }), a = xn({
+      body: n,
+      method: e.method,
+      signal: o.signal,
+      url: s
+    });
+    return i.promise = a.then(async (u) => {
+      if (t !== i) return await t.promise;
+      if (u.status === "redirect") {
+        const d = Ut(u.location);
+        if (!d) return Oe("The mutation returned an unsafe redirect.");
+        je(o), ie?.redirect(d, u.history, o);
+      } else u.status === "success" && u.revalidate && await ie?.refresh();
+      return o.signal.aborted ? r ?? Oe("The mutation was cancelled.") : t === i ? u : await t.promise;
+    }).catch(async (u) => {
+      if (t !== i) return await t.promise;
+      if (o.signal.aborted && r) return r;
+      if (o.signal.aborted) return Oe("The mutation was cancelled.");
+      throw u;
+    }).finally(() => {
+      ze.delete(o);
+    }), t = i, i.promise;
+  };
+}
+function jo(e, t) {
+  const r = Xe({
+    to: e.route,
+    ...e.path === void 0 ? {} : { path: e.path }
+  }), n = ae(
+    () => An(e),
+    [e.method, r]
+  ), [o, i, s] = nr(n, t), a = ae(() => {
+    const u = (d) => i(d);
+    return Object.defineProperty(u, Ot, {
+      value: { method: "POST", url: r }
+    }), u;
+  }, [i, r]);
+  return [o, a, s];
+}
+function _t(e) {
+  return e[Ot];
+}
+async function xn(e) {
+  const { result: t } = await Ft(e);
+  if (!t)
+    throw new Error("Demiurge expected a versioned mutation result.");
+  return t;
+}
+async function Ft(e) {
+  const t = await fetch(e.url, {
+    body: e.body,
+    credentials: "same-origin",
+    headers: {
+      accept: xt,
+      [mr]: pr,
+      ...e.contentType ? { "content-type": e.contentType } : {}
+    },
+    method: e.method,
+    redirect: "manual",
+    signal: e.signal
+  });
+  return { response: t, result: await kn(t) };
+}
+async function kn(e) {
+  const t = e.headers.get("content-type");
+  if (!t) return;
+  const [r, ...n] = t?.split(";").map((s) => s.trim().toLowerCase()) ?? [], o = xt.split(";")[0];
+  if (r !== o) return;
+  if (n.length !== 1 || n[0] !== "v=1")
+    throw new Error("Demiurge received a malformed versioned mutation result.");
+  let i;
+  try {
+    i = await e.clone().json();
+  } catch {
+    throw new Error("Demiurge received a malformed versioned mutation result.");
+  }
+  if (!ee(i) || i.version !== 1 || typeof i.status != "string")
+    throw new Error("Demiurge received a malformed versioned mutation result.");
+  if (i.status === "success") {
+    if (!Z(i, ["data", "revalidate", "status", "version"]) || i.revalidate !== void 0 && typeof i.revalidate != "boolean" || "data" in i && !Ve(i.data)) throw fe();
+    return { version: 1, status: "success", ...i.data === void 0 ? {} : { data: i.data }, ...i.revalidate === void 0 ? {} : { revalidate: i.revalidate } };
+  }
+  if (i.status === "invalid") {
+    if (!Z(i, ["status", "validation", "version"]) || !Rn(i.validation)) throw fe();
+    return { version: 1, status: "invalid", validation: i.validation };
+  }
+  if (i.status === "failed") {
+    if (!Z(i, ["message", "status", "version"]) || i.message !== void 0 && typeof i.message != "string") throw fe();
+    return { version: 1, status: "failed", ...i.message === void 0 ? {} : { message: i.message } };
+  }
+  if (i.status === "redirect" && typeof i.location == "string" && (i.history === "push" || i.history === "replace") && Z(i, ["history", "location", "status", "version"]))
+    return { version: 1, status: "redirect", location: i.location, history: i.history };
+  throw fe();
+}
+function Ut(e) {
+  try {
+    const t = new URL(e, window.location.href);
+    return t.protocol !== window.location.protocol || t.origin !== window.location.origin || t.username || t.password ? void 0 : `${t.pathname}${t.search}${t.hash}`;
+  } catch {
+    return;
+  }
+}
+function Oe(e) {
+  return { version: 1, status: "failed", message: e };
+}
+function fe() {
+  return new Error("Demiurge received a malformed mutation result.");
+}
+function Z(e, t) {
+  return Object.keys(e).every((r) => t.includes(r));
+}
+function Rn(e) {
+  return ee(e) && Z(e, ["issues"]) && Array.isArray(e.issues) && e.issues.every(Tn);
+}
+function Tn(e) {
+  return ee(e) && Z(e, ["code", "message", "path"]) && typeof e.code == "string" && typeof e.message == "string" && Array.isArray(e.path) && (e.path.length === 0 || typeof e.path[0] == "string") && e.path.every((t) => typeof t == "string" || typeof t == "number");
+}
+function Ve(e) {
+  return e === null || typeof e == "string" || typeof e == "boolean" ? !0 : typeof e == "number" ? Number.isFinite(e) : Array.isArray(e) ? e.every(Ve) : ee(e) && Object.values(e).every(Ve);
+}
+function Mn(e) {
+  const t = kt(e.routes), r = e.loadNavigationData ?? Kt;
   return function() {
-    const [o, a] = F(() => $()), [i, s] = F(
+    const [o, i] = U(() => F()), [s, a] = U(e.locale), u = Be(o.pathname, e.locales), d = k(o), [v, A] = U(
       () => e.initialMatch ?? { status: "loading" }
-    ), l = z(!!e.initialMatch), d = z(0);
-    P(() => {
+    ), h = k(!!e.initialMatch), p = k(!0), E = k(0), g = k(void 0), b = k("navigation"), m = k(/* @__PURE__ */ new Map()), T = k(/* @__PURE__ */ new Map()), [H, w] = U(0), [$, C] = U(0), V = k(/* @__PURE__ */ new Set()), [Qt, rt] = U(0), O = k("push"), [ue, Ae] = U(null), [q, xe] = U(null), nt = k(null);
+    nt.current = ue;
+    const K = k(void 0), ke = k(void 0), P = k(void 0), W = k(!1), ot = k(/* @__PURE__ */ new Map()), J = k([]), er = k(0);
+    function G() {
+      const c = P.current, l = qt();
+      c && ot.current.set(c, l), On(c, l);
+    }
+    const Re = ae(() => ({
+      register(c) {
+        const l = {
+          element: c,
+          order: er.current++
+        };
+        return J.current.length > 0 && typeof process < "u" && process.env.NODE_ENV !== "production" && console.warn(
+          "Demiurge found more than one RouteFocusBoundary. The first boundary remains active."
+        ), J.current.push(l), () => {
+          const f = J.current.indexOf(l);
+          f !== -1 && J.current.splice(f, 1);
+        };
+      },
+      focus() {
+        const c = J.current.slice().sort((l, f) => l.order - f.order)[0]?.element;
+        if (!c || !c.isConnected || typeof c.focus != "function")
+          return !1;
+        try {
+          c.focus({ preventScroll: !0 });
+        } catch {
+          c.focus();
+        }
+        return !0;
+      }
+    }), []);
+    ne(() => (e.navigation !== "document" && ar(), () => {
+      J.current = [];
+    }), [e.navigation]), Y(() => () => {
+      je();
+      for (const c of V.current) c();
+      V.current.clear();
+      for (const c of m.current.values()) c.abort();
+      m.current.clear(), T.current.clear();
+    }, []);
+    function te(c) {
+      je(c);
+      let l = !1;
+      for (const [f, y] of m.current) {
+        if (y === c) continue;
+        y.abort(), m.current.delete(f);
+        const S = T.current.get(f);
+        (S?.state === "submitting" || S?.state === "loading") && T.current.set(f, {
+          state: "idle",
+          form: S.form,
+          submissionKey: S.submissionKey,
+          ...S.state === "loading" && S.result ? { result: S.result } : {}
+        }), l = !0;
+      }
+      l && w((f) => f + 1);
+    }
+    function z() {
+      E.current++, g.current?.abort(), g.current = void 0;
+    }
+    Y(() => {
+      if (e.navigation === "document")
+        return;
+      const c = window.history.scrollRestoration;
+      window.history.scrollRestoration = "manual", P.current = wt(), G();
+      const l = () => {
+        W.current || G();
+      };
+      return window.addEventListener("scroll", l, { passive: !0 }), () => {
+        window.removeEventListener("scroll", l), window.history.scrollRestoration = c;
+      };
+    }, [e.navigation]), Y(() => {
       function c() {
-        a($());
+        te(), O.current = "pop", W.current = !0, P.current = wt(), ke.current = ot.current.get(
+          P.current
+        ) ?? _n();
+        const l = F(), f = d.current;
+        (f.pathname !== l.pathname || f.search !== l.search) && (z(), b.current = "navigation"), d.current = l, e.navigation !== "document" && f.pathname === l.pathname && f.search === l.search && f.hash !== l.hash && pe(l.hash), i(l);
       }
       return window.addEventListener("popstate", c), () => window.removeEventListener("popstate", c);
-    }, []), P(() => {
-      let c = !1, f = !1;
-      const h = ++d.current, v = new AbortController(), S = () => !c && h === d.current;
-      if (l.current && lt(e.initialMatch) === o.pathname)
-        return l.current = !1, () => {
-          c = !0;
+    }, []), Y(() => {
+      let c = !1, l = !1;
+      const f = ++E.current, y = new AbortController();
+      g.current = y;
+      const S = b.current, D = () => !c && f === E.current;
+      if (Ae(null), xe(null), h.current && $n(e.initialMatch) === u)
+        return h.current = !1, p.current = !1, () => {
+          c = !0, y.abort(), g.current === y && (g.current = void 0);
         };
-      s({ status: "loading" }), ge(t, o.pathname).then((m) => {
-        S() && !f && m && s({ loading: m, status: "loading" });
+      const _ = p.current;
+      p.current = !1, S !== "refresh" && e.navigation !== "document" && !_ && (K.current = {
+        navigation: O.current,
+        position: O.current === "pop" ? ke.current : void 0
+      }, ke.current = void 0), S !== "refresh" && (A({ status: "loading" }), yr(t, u).then((x) => {
+        D() && !l && x && A({ loading: x, status: "loading" });
       }).catch(() => {
-      });
-      const b = new Request(o.href, { signal: v.signal });
-      return Promise.resolve(r(b)).then(
-        (m) => q(
-          t,
-          o.pathname,
-          b,
-          m,
-          void 0,
-          { documentContributions: !1 }
-        )
-      ).then((m) => {
-        f = !0, S() && s(m);
-      }).catch(async (m) => {
-        if (f = !0, !S() || v.signal.aborted)
+      }));
+      const re = new Request(o.href, { signal: y.signal });
+      return Promise.resolve(r(re)).then(async (x) => {
+        const N = x.url ? new URL(x.url, o.href) : new URL(o.href);
+        N.hash || (N.hash = o.hash);
+        const M = x.locale ?? (e.locales ? gr(new Request(N), e.locales).locale : s);
+        return {
+          initialData: x,
+          responseUrl: N,
+          nextMatch: await Rt(
+            t,
+            Be(N.pathname, e.locales),
+            new Request(N.href, { signal: y.signal }),
+            x,
+            void 0,
+            { documentContributions: !1, locale: M }
+          )
+        };
+      }).then(({ initialData: x, nextMatch: N, responseUrl: M }) => {
+        if (l = !0, D()) {
+          if (x.document && at(x.document), "locale" in x && x.locale && a(x.locale), M.href !== o.href) {
+            window.history.replaceState(window.history.state, "", M);
+            const L = F();
+            d.current = L, i(L);
+          }
+          A(N), rt((L) => L + 1), S !== "refresh" && Ae({
+            kind: O.current,
+            outcome: N.status === "not-found" ? "not-found" : "ready",
+            title: document.title || "Demiurge App",
+            url: new URL(o.href)
+          });
+        }
+      }).catch(async (x) => {
+        if (l = !0, !D() || y.signal.aborted)
           return;
-        const k = await we(
+        const N = await wr(
           t,
-          o.pathname
+          u
         );
-        S() && s({
-          Error: k,
-          error: m,
-          pathname: o.pathname,
-          status: "error"
-        });
+        if (D()) {
+          const M = typeof x == "object" && x ? Wt.get(x) : void 0;
+          M && at(M), A({
+            Error: N,
+            error: x,
+            locale: s,
+            pathname: u,
+            status: "error"
+          }), Ae(S === "refresh" ? null : {
+            kind: O.current,
+            outcome: "error",
+            title: M?.title ?? "Navigation failed",
+            url: new URL(o.href)
+          }), rt((L) => L + 1);
+        }
       }), () => {
-        c = !0, v.abort();
+        c = !0, y.abort(), g.current === y && (g.current = void 0);
       };
-    }, [o.pathname, o.search]);
-    const p = ne(
+    }, [u, o.pathname, o.search, $]), ne(() => {
+      if (!(!q || e.navigation === "document")) {
+        if (q.url.hash) {
+          K.current && (K.current = void 0, pe(q.url.hash)), W.current = !1;
+          return;
+        }
+        if (Re.focus(), K.current) {
+          const c = K.current;
+          K.current = void 0, Fn(e.navigationScroll, {
+            ...q,
+            kind: c.navigation,
+            navigation: c.navigation,
+            position: c.position
+          });
+        }
+        W.current = !1, jn(q, e.navigationAccessibility);
+      }
+    }, [
+      q,
+      Re,
+      e.navigation,
+      e.navigationAccessibility,
+      e.navigationScroll
+    ]);
+    function B(c, l) {
+      T.current.set(c, l), w((f) => f + 1);
+    }
+    function tr(c, l) {
+      const f = Fe(c, l), y = T.current.get(f);
+      y?.form === c && (y.state === "loading" && y.result || (m.current.get(f)?.abort(), m.current.delete(f), T.current.delete(f), w((S) => S + 1)));
+    }
+    const rr = ae(
       () => ({
         navigation: e.navigation ?? "server",
+        locale: s,
+        locales: e.locales,
+        submissionVersion: H,
+        getMutationNavigation(c, l) {
+          const f = Fe(c, l);
+          return T.current.get(f) ?? {
+            state: "idle",
+            form: c,
+            submissionKey: l
+          };
+        },
+        releaseMutationNavigation: tr,
         push(c) {
-          const f = $();
-          window.history.pushState(null, "", c);
-          const h = $();
-          a(h), f.pathname === h.pathname && f.search === h.search && f.hash !== h.hash && pt(h.hash);
+          te(), W.current = !1;
+          const l = F();
+          O.current = "push", e.navigation !== "document" && G();
+          const f = ge();
+          window.history.pushState(f.state, "", c), P.current = f.key;
+          const y = F();
+          (l.pathname !== y.pathname || l.search !== y.search) && (z(), b.current = "navigation"), d.current = y, i(y), l.pathname === y.pathname && l.search === y.search && l.hash !== y.hash && pe(y.hash);
+        },
+        replace(c) {
+          te(), W.current = !1;
+          const l = F();
+          O.current = "replace", e.navigation !== "document" && G(), window.history.replaceState(
+            we(window.history.state, P.current),
+            "",
+            c
+          );
+          const f = F();
+          (l.pathname !== f.pathname || l.search !== f.search) && (z(), b.current = "navigation"), d.current = f, i(f), e.navigation !== "document" && l.pathname === f.pathname && l.search === f.search && l.hash !== f.hash && pe(f.hash);
+        },
+        async submitMutation(c, l, f) {
+          if ((e.navigation ?? "server") !== "server") return;
+          const y = Bn(c, l);
+          if (!y) return;
+          const S = Fe(c, f);
+          m.current.get(S)?.abort();
+          const D = new AbortController();
+          m.current.set(S, D);
+          const _ = y.formData, re = () => !D.signal.aborted && m.current.get(S) === D;
+          B(S, {
+            state: "submitting",
+            form: c,
+            submissionKey: f,
+            formData: _
+          });
+          let x;
+          try {
+            const N = await Ft({
+              body: y.body,
+              contentType: y.contentType,
+              method: y.method,
+              signal: D.signal,
+              url: y.url
+            });
+            if (x = N.response, !re()) return;
+            const M = N.result;
+            if (!re()) return;
+            if (M?.status === "invalid") {
+              B(S, { state: "invalid", form: c, submissionKey: f, formData: _, result: M });
+              return;
+            }
+            if (M?.status === "redirect") {
+              const L = Ut(M.location);
+              if (!L) {
+                B(S, { state: "error", form: c, submissionKey: f, formData: _, response: x });
+                return;
+              }
+              if (z(), te(D), b.current = "navigation", B(S, { state: "loading", form: c, submissionKey: f, formData: _ }), G(), M.history === "replace")
+                window.history.replaceState(
+                  we(null, P.current),
+                  "",
+                  L
+                );
+              else {
+                const le = ge();
+                window.history.pushState(le.state, "", L), P.current = le.key;
+              }
+              O.current = M.history, d.current = F(), i(d.current), C((le) => le + 1);
+              return;
+            }
+            if (M?.status === "failed" || !x.ok) {
+              B(S, { state: "error", form: c, submissionKey: f, formData: _, response: x });
+              return;
+            }
+            M?.status === "success" && M.revalidate ? (B(S, { state: "loading", form: c, submissionKey: f, formData: _, result: M }), z(), b.current = "refresh", C((L) => L + 1)) : B(S, { state: "idle", form: c, submissionKey: f, result: M });
+          } catch {
+            re() && B(S, { state: "error", form: c, submissionKey: f, formData: _, response: x });
+          } finally {
+            m.current.get(S) === D && m.current.delete(S);
+          }
         }
       }),
-      []
+      [H]
     );
-    return w(X.Provider, {
-      value: p,
-      children: w(dt, {
-        key: `${o.pathname}${o.search}`,
-        Loading: e.loading,
-        NotFound: e.notFound,
-        match: i
+    return ne(() => En({
+      redirect(c, l, f) {
+        if (z(), te(f), b.current = "navigation", G(), l === "replace")
+          window.history.replaceState(
+            we(null, P.current),
+            "",
+            c
+          );
+        else {
+          const y = ge();
+          window.history.pushState(y.state, "", c), P.current = y.key;
+        }
+        O.current = l, d.current = F(), i(d.current), C((y) => y + 1);
+      },
+      refresh() {
+        return new Promise((c) => {
+          z(), b.current = "refresh", V.current.add(c), C((l) => l + 1);
+        });
+      }
+    }), [s, e.locales, e.navigation]), R(Yt.Provider, {
+      value: rr,
+      children: R(Pt.Provider, {
+        value: Re,
+        children: R(Dn, {
+          key: `${o.pathname}${o.search}`,
+          Loading: e.loading,
+          NotFound: e.notFound,
+          match: v,
+          pendingCommit: ue,
+          resolvedRouteVersion: Qt,
+          onCommitted: (c) => {
+            nt.current === c && xe(c);
+          },
+          onRenderError: () => {
+            xe(ue ? { ...ue, outcome: "error", title: "Navigation failed" } : null), it();
+          },
+          onRouteCommitted: it
+        })
       })
     });
+    function it() {
+      for (const c of V.current) c();
+      V.current.clear();
+      for (const [c, l] of T.current)
+        l.state === "loading" && T.current.set(c, {
+          state: "idle",
+          form: l.form,
+          submissionKey: l.submissionKey,
+          result: l.result
+        });
+      w((c) => c + 1);
+    }
   };
 }
-function ut(e, t) {
-  const r = t.getAttribute(ce);
+function Cn(e, t) {
+  const r = t.getAttribute(ur);
   return e.status === "not-found" ? r === "not-found" : e.status === "ready" && r === null;
 }
-function lt(e) {
+function $n(e) {
   if (e)
     return e.status === "ready" ? e.match.pathname : e.status === "loading" ? void 0 : e.pathname;
 }
-async function wr(e) {
+async function Vo(e) {
   const t = e.root ?? document.getElementById("root");
   if (!t)
     throw new Error(
       "Demiurge expected a #root element in the framework document."
     );
-  const r = W(e.routes), n = e.loadNavigationData ?? Z, o = e.initialData ?? ie(document), a = await q(
+  const r = kt(e.routes), n = e.loadNavigationData ?? Kt, o = e.initialData ?? sr(document), i = await Rt(
     r,
-    window.location.pathname,
+    Be(window.location.pathname, e.locales),
     new Request(window.location.href),
     o ?? await n(new Request(window.location.href)),
     void 0,
-    { documentContributions: !1 }
-  ), i = ut(a, t), s = ct(
-    i ? {
+    { documentContributions: !1, locale: o?.locale ?? e.locale }
+  ), s = Cn(i, t), a = Mn(
+    s ? {
       ...e,
-      initialMatch: a,
+      locale: o?.locale ?? e.locale,
+      initialMatch: i,
       loadNavigationData: n,
       navigation: o?.navigation ?? e.navigation
     } : {
@@ -757,16 +1638,16 @@ async function wr(e) {
       loadNavigationData: n,
       navigation: o?.navigation ?? e.navigation
     }
-  ), { createRoot: l, hydrateRoot: d } = ft(
+  ), { createRoot: u, hydrateRoot: d } = Nn(
     await import("react-dom/client")
   );
-  if (i && t.hasAttribute(se)) {
-    d(t, w(s)), U();
+  if (s && t.hasAttribute(cr)) {
+    d(t, R(a)), st();
     return;
   }
-  t.replaceChildren(), l(t).render(w(s)), U();
+  t.replaceChildren(), u(t).render(R(a)), st();
 }
-function ft(e) {
+function Nn(e) {
   const t = typeof e.createRoot == "function" && typeof e.hydrateRoot == "function" ? e : e.default;
   if (!t || typeof t.createRoot != "function" || typeof t.hydrateRoot != "function")
     throw new Error(
@@ -774,76 +1655,181 @@ function ft(e) {
     );
   return t;
 }
-function yr(e) {
-  const t = wt(), r = pe(e);
-  return /* @__PURE__ */ V(
+function Ln(e, t) {
+  const r = Ee(), {
+    children: n,
+    download: o,
+    hash: i,
+    locale: s,
+    onClick: a,
+    path: u,
+    reloadDocument: d,
+    replace: v,
+    search: A,
+    target: h,
+    to: p,
+    ...E
+  } = e, g = Xe(e), b = s, m = r.locales && (b ?? r.locale) ? Qe(
+    g,
+    b ?? r.locale,
+    r.locales,
+    typeof window > "u" ? "http://demiurge.local" : window.location.href
+  ) : g;
+  return /* @__PURE__ */ Et(
     "a",
     {
-      className: e.className,
-      href: r,
-      onClick: (n) => {
-        t.navigation === "server" && gt(n) && (n.preventDefault(), t.push(r));
+      ...E,
+      download: o,
+      href: m,
+      ref: t,
+      target: h,
+      onClick: (T) => {
+        a?.(T), r.navigation === "server" && !d && zn(T, { download: o, target: h, to: m }) && (T.preventDefault(), v ? r.replace(m) : r.push(m));
       },
-      children: e.children
+      children: n
     }
   );
 }
-function dt({
+function qo(e) {
+  return Ln(e, e.ref ?? null);
+}
+const Bt = We(void 0);
+function Ko(e) {
+  const t = Ee(), r = k(t);
+  r.current = t;
+  const n = or(), o = e.submissionKey ?? n, i = k(null), s = Ht(), a = typeof e.action == "function" ? e.action : void 0, u = a ? _t(a) : void 0, d = !!(a && s && t.navigation === "server");
+  ne(() => () => {
+    i.current && r.current.releaseMutationNavigation(i.current, o);
+  }, [o]);
+  function v(g) {
+    const b = e.onSubmit;
+    if (b?.(g), a || g.defaultPrevented || t.navigation !== "server") return;
+    const m = g.nativeEvent.submitter;
+    Jt(g.currentTarget, m) && (g.preventDefault(), t.submitMutation(
+      g.currentTarget,
+      m,
+      o
+    ));
+  }
+  const { submissionKey: A, ...h } = e, p = a ? d ? a : u?.url : h.action, E = typeof p == "string" && t.locales && (e.locale ?? t.locale) ? Qe(p, e.locale ?? t.locale, t.locales, typeof window > "u" ? "http://demiurge.local" : window.location.href) : p;
+  return R(
+    Bt.Provider,
+    {
+      value: o,
+      children: R("form", {
+        ...h,
+        action: E,
+        locale: void 0,
+        ...a ? {
+          encType: d ? void 0 : h.encType,
+          method: d ? void 0 : "post",
+          onSubmit: h.onSubmit
+        } : { onSubmit: v },
+        ref: (g) => {
+          i.current = g;
+        }
+      })
+    }
+  );
+}
+function Wo(e) {
+  const t = Ee(), r = Ht(), n = _t(e.formAction), o = r && t.navigation === "server", i = t.locales && (e.locale ?? t.locale) ? Qe(n.url, e.locale ?? t.locale, t.locales, typeof window > "u" ? "http://demiurge.local" : window.location.href) : n.url;
+  return R("button", {
+    ...e,
+    locale: void 0,
+    formAction: o ? e.formAction : i,
+    formMethod: o ? void 0 : "post"
+  });
+}
+function Ht() {
+  const [e, t] = U(!1);
+  return Y(() => t(!0), []), e;
+}
+function In(e) {
+  const t = Je(Bt);
+  return Ee().getMutationNavigation(e?.form, e?.submissionKey ?? t);
+}
+function Jo(e) {
+  return In({ submissionKey: e });
+}
+function Dn({
   Loading: e,
   NotFound: t,
-  match: r
+  match: r,
+  onRenderError: n,
+  onCommitted: o,
+  pendingCommit: i,
+  resolvedRouteVersion: s,
+  onRouteCommitted: a
 }) {
   if (r.status === "loading") {
-    const c = r.loading ?? e;
-    return c ? w(c) : null;
+    const m = r.loading ?? e;
+    return m ? R(m) : null;
   }
   if (r.status === "not-found") {
-    const c = r.notFound ?? t ?? Te;
-    return r.layouts.reduceRight(
-      (f, h) => w(h, {
-        children: f,
+    const m = r.notFound ?? t ?? kr;
+    return R(Te, null, r.layouts.reduceRight(
+      (T, H) => R(H, {
+        children: T,
+        locale: r.locale,
         path: {},
         pathname: r.pathname
       }),
-      w(c, { pathname: r.pathname })
-    );
+      R(m, { locale: r.locale, pathname: r.pathname })
+    ), R(_e, { commit: i, onCommit: o, onRouteCommitted: a, resolvedRouteVersion: s }));
   }
   if (r.status === "error")
-    return r.Error ? w(r.Error, {
+    return R(Te, null, r.Error ? R(r.Error, {
       error: r.error,
+      locale: "locale" in r ? r.locale : void 0,
       pathname: r.pathname,
-      status: Y(r.error)
-    }) : null;
-  const { data: n, error: o, page: a, layouts: i, path: s, pathname: l } = r.match, d = w(a, { data: n, path: s, pathname: l }), p = i.reduceRight(
-    (c, f) => w(f, { path: s, pathname: l, children: c }),
-    d
+      status: zt(r.error)
+    }) : null, R(_e, { commit: i, onCommit: o, onRouteCommitted: a, resolvedRouteVersion: s }));
+  const { data: u, error: d, locale: v, page: A, layouts: h, path: p, pathname: E } = r.match, g = R(A, { data: u, locale: v, path: p, pathname: E }), b = h.reduceRight(
+    (m, T) => R(T, { path: p, pathname: E, locale: v, children: m }),
+    g
   );
-  return w(ht, {
-    Error: o,
-    children: p,
-    pathname: l
+  return R(Pn, {
+    Error: d,
+    children: R(Te, null, b, R(_e, { commit: i, onCommit: o, onRouteCommitted: a, resolvedRouteVersion: s })),
+    onError: n,
+    pathname: E
   });
 }
-class ht extends ae {
+function _e({
+  commit: e,
+  onCommit: t,
+  onRouteCommitted: r,
+  resolvedRouteVersion: n
+}) {
+  const o = k(null), i = k(0);
+  return ne(() => {
+    n > i.current && (i.current = n, r()), e && o.current !== e && (o.current = e, t(e));
+  }, [e, t, r, n]), null;
+}
+class Pn extends ir {
   static getDerivedStateFromError(t) {
     return { error: t };
   }
   state = {};
+  componentDidCatch() {
+    this.props.onError();
+  }
   componentDidUpdate(t) {
     this.state.error !== void 0 && t.pathname !== this.props.pathname && this.setState({ error: void 0 });
   }
   render() {
-    return this.state.error !== void 0 ? this.props.Error ? w(this.props.Error, {
+    return this.state.error !== void 0 ? this.props.Error ? R(this.props.Error, {
       error: this.state.error,
       pathname: this.props.pathname,
-      status: Y(this.state.error)
+      status: zt(this.state.error)
     }) : null : this.props.children;
   }
 }
-function Y(e) {
-  return ke(e) ? e.status : 500;
+function zt(e) {
+  return Rr(e) ? e.status : 500;
 }
-function $() {
+function F() {
   return {
     hash: window.location.hash,
     href: window.location.href,
@@ -851,42 +1837,172 @@ function $() {
     search: window.location.search
   };
 }
-async function Z(e) {
+const qe = "__demiurge_scroll", Ke = "__demiurge_history_entry";
+let jt = 0;
+function wt() {
+  const e = Vt(window.history.state);
+  if (e) return e;
+  const t = ge(window.history.state);
+  return window.history.replaceState(t.state, "", window.location.href), t.key;
+}
+function ge(e) {
+  const t = `entry:${++jt}`;
+  return { key: t, state: we(e, t) };
+}
+function we(e, t = `entry:${++jt}`) {
+  return e && typeof e == "object" ? { ...e, [Ke]: t } : { [Ke]: t };
+}
+function Vt(e) {
+  if (!e || typeof e != "object") return;
+  const t = Reflect.get(e, Ke);
+  return typeof t == "string" ? t : void 0;
+}
+function qt() {
+  return { x: window.scrollX, y: window.scrollY };
+}
+function On(e, t = qt()) {
+  const r = window.history.state;
+  if (e && Vt(r) !== e) return;
+  const n = r && typeof r == "object" ? { ...r, [qe]: t } : { [qe]: t };
+  try {
+    window.history.replaceState(n, "", window.location.href);
+  } catch {
+  }
+}
+function _n() {
+  const e = window.history.state?.[qe];
+  return e && typeof e == "object" && typeof e.x == "number" && typeof e.y == "number" ? { x: e.x, y: e.y } : void 0;
+}
+function Fn(e, t) {
+  if (t.kind === "pop" && t.url.hash || e === !1)
+    return;
+  if (typeof e == "function") {
+    try {
+      e(t);
+    } catch {
+    }
+    return;
+  }
+  const r = t.kind === "pop" ? t.position?.x ?? 0 : 0, n = t.kind === "pop" ? t.position?.y ?? 0 : 0;
+  window.scrollTo?.(r, n);
+}
+async function Kt(e) {
   const t = new Headers(e.headers);
-  t.set("accept", "application/json"), t.set(_, ye);
+  t.set("accept", "application/json"), t.set(ut, vr);
   const r = await fetch(new Request(e, {
     credentials: "same-origin",
     headers: t
-  })), n = r.headers.get(_);
-  if (n === ve) {
+  })), n = r.headers.get(ut);
+  if (n === br) {
     const o = await r.json();
     if (o.hasData !== !0)
       throw new Error("Demiurge received malformed navigation route data.");
-    return { data: o.data, hasData: !0 };
+    return {
+      data: o.data,
+      document: o.document,
+      hasData: !0,
+      locale: o.locale,
+      url: r.url
+    };
+  }
+  if (n === Sr) {
+    const o = await vt(r);
+    return {
+      document: o?.document,
+      hasData: !0,
+      locale: o?.locale,
+      url: r.url
+    };
   }
-  if (n === be)
-    return { hasData: !0 };
-  if (n === Se || !r.ok) {
-    const o = await mt(r), a = Ee.includes(
+  if (n === Er || !r.ok) {
+    const o = await vt(r), i = Ar.includes(
       r.status
-    ) ? r.status : 500;
-    throw Re(a, {
-      detail: typeof o?.detail == "string" ? o.detail : void 0,
-      title: typeof o?.title == "string" ? o.title : void 0
+    ) ? r.status : 500, s = xr(i, {
+      detail: o?.error?.detail,
+      title: o?.error?.title
     });
+    throw o?.document && Wt.set(s, o.document), s;
   }
   throw new Error(
     "Demiurge expected a navigation data response from the application server."
   );
 }
-async function mt(e) {
+const Wt = /* @__PURE__ */ new WeakMap();
+async function vt(e) {
   try {
     return await e.json();
-  } catch {
+  } catch (t) {
+    if (t instanceof Error && t.message.includes("malformed versioned")) throw t;
     return;
   }
 }
-function pt(e) {
+function Fe(e, t) {
+  if (t) return t;
+  if (!e) return "default";
+  let r = bt.get(e);
+  return r || (r = `form:${Un++}`, bt.set(e, r)), r;
+}
+const bt = /* @__PURE__ */ new WeakMap();
+let Un = 1;
+function Jt(e, t) {
+  const r = Gt(e, t);
+  if (!r) return !1;
+  const { action: n, enctype: o, method: i, target: s } = r;
+  if (!["POST", "PUT", "PATCH", "DELETE"].includes(i) || s && s.toLowerCase() !== "_self") return !1;
+  try {
+    if (new URL(n, window.location.href).origin !== window.location.origin) return !1;
+  } catch {
+    return !1;
+  }
+  return ["application/x-www-form-urlencoded", "multipart/form-data", "text/plain"].includes(o);
+}
+function Bn(e, t) {
+  if (!Jt(e, t)) return;
+  const { action: r, enctype: n, method: o } = Gt(e, t), i = t ? new FormData(e, t) : new FormData(e);
+  if (n === "multipart/form-data")
+    return { body: i, contentType: void 0, formData: i, method: o, url: r };
+  if (n === "application/x-www-form-urlencoded") {
+    const a = new URLSearchParams();
+    for (const [u, d] of i)
+      typeof d == "string" ? a.append(u, d) : a.append(u, d.name);
+    return {
+      body: a,
+      contentType: "application/x-www-form-urlencoded;charset=UTF-8",
+      formData: i,
+      method: o,
+      url: r
+    };
+  }
+  const s = [];
+  for (const [a, u] of i)
+    s.push(`${a}=${typeof u == "string" ? u : u.name}`);
+  return {
+    body: `${s.join(`\r
+`)}\r
+`,
+    contentType: "text/plain;charset=UTF-8",
+    formData: i,
+    method: o,
+    url: r
+  };
+}
+function Gt(e, t) {
+  if (!Hn(t)) return;
+  const r = t instanceof HTMLButtonElement || t instanceof HTMLInputElement ? t : void 0;
+  return {
+    action: (he(r, "formaction") ?? e.action) || window.location.href,
+    enctype: ((he(r, "formenctype") ?? e.enctype) || "application/x-www-form-urlencoded").toLowerCase(),
+    method: ((he(r, "formmethod") ?? e.method) || "get").toUpperCase(),
+    target: he(r, "formtarget") ?? e.target
+  };
+}
+function he(e, t) {
+  return e?.hasAttribute(t) ? e.getAttribute(t) ?? "" : void 0;
+}
+function Hn(e) {
+  return e ? e instanceof HTMLButtonElement ? !e.disabled && e.type === "submit" : e instanceof HTMLInputElement && !e.disabled && e.type === "submit" : !0;
+}
+function pe(e) {
   queueMicrotask(() => {
     if (!e) {
       window.scrollTo?.(0, 0);
@@ -901,21 +2017,50 @@ function pt(e) {
     document.getElementById(t)?.scrollIntoView?.();
   });
 }
-function gt(e) {
-  return e.button === 0 && !e.metaKey && !e.altKey && !e.ctrlKey && !e.shiftKey;
+function zn(e, t) {
+  if (e.defaultPrevented || e.button !== 0 || e.metaKey || e.altKey || e.ctrlKey || e.shiftKey || t.download !== void 0 && t.download !== !1 || t.target !== void 0 && t.target.toLowerCase() !== "_self")
+    return !1;
+  const r = new URL(t.to, window.location.href);
+  return (r.protocol === "http:" || r.protocol === "https:") && r.origin === window.location.origin;
 }
-const X = re({
+function jn(e, t) {
+  const r = t?.announce ?? "title";
+  if (r === !1) return;
+  let n;
+  try {
+    n = r === "title" ? e.title : r(e);
+  } catch {
+    return;
+  }
+  n && Vn(n);
+}
+function Vn(e) {
+  lr(e);
+}
+const Yt = We({
   navigation: "document",
+  submissionVersion: 0,
   push(e) {
     window.location.href = e;
+  },
+  getMutationNavigation() {
+    return { state: "idle" };
+  },
+  releaseMutationNavigation() {
+  },
+  async submitMutation(e) {
+    e.submit();
+  },
+  replace(e) {
+    window.location.replace(e);
   }
 });
-function wt() {
-  return oe(X);
+function Ee() {
+  return Je(Yt);
 }
-function vr({ className: e, id: t, policy: r, ...n }) {
-  const o = Ae(n, r);
-  return /* @__PURE__ */ V(
+function Go({ className: e, id: t, policy: r, ...n }) {
+  const o = Mr(n, r);
+  return /* @__PURE__ */ Et(
     "img",
     {
       alt: o.alt,
@@ -932,14 +2077,14 @@ function vr({ className: e, id: t, policy: r, ...n }) {
     }
   );
 }
-const yt = "https://js.sentry-cdn.com", br = {
+const qn = "https://js.sentry-cdn.com", Yo = {
   /**
    * Plausible loads one script and posts events to its own API. The snippet
    * carries configuration in `data-domain`, so no inline code is involved.
    * `endpoint` accepts a same-origin path prefix for a proxied deployment.
    */
   plausible(e) {
-    const t = vt(e.domain), r = H(e.endpoint ?? "https://plausible.io");
+    const t = Kn(e.domain), r = St(e.endpoint ?? "https://plausible.io");
     return {
       consent: e.consent ?? !1,
       domain: t,
@@ -950,7 +2095,7 @@ const yt = "https://js.sentry-cdn.com", br = {
       },
       provider: "plausible",
       scripts: [
-        I({
+        Me({
           dataApi: `${r.base}/api/event`,
           dataDomain: t,
           defer: !0,
@@ -968,8 +2113,8 @@ const yt = "https://js.sentry-cdn.com", br = {
    * why the integration also declares a `connect-src` need.
    */
   sentry(e) {
-    const t = Et(e.dsn), r = St(
-      e.loaderHost ?? yt,
+    const t = Gn(e.dsn), r = Jn(
+      e.loaderHost ?? qn,
       "Sentry loader host"
     );
     return {
@@ -983,7 +2128,7 @@ const yt = "https://js.sentry-cdn.com", br = {
       projectId: t.projectId,
       provider: "sentry",
       scripts: [
-        I({
+        Me({
           crossOrigin: "anonymous",
           needs: { connect: [t.origin] },
           purpose: "error-monitoring",
@@ -1002,7 +2147,7 @@ const yt = "https://js.sentry-cdn.com", br = {
    * to, and an optional same-origin entry script that starts the SDK.
    */
   openTelemetry(e) {
-    const t = H(e.endpoint), r = e.script;
+    const t = St(e.endpoint), r = e.script;
     if (r !== void 0 && !r.startsWith("/"))
       throw new Error(
         "OpenTelemetry browser instrumentation must be a same-origin script path."
@@ -1014,7 +2159,7 @@ const yt = "https://js.sentry-cdn.com", br = {
       needs: r ? { connect: [t.source], script: ["'self'"] } : { connect: [t.source] },
       provider: "opentelemetry",
       scripts: r ? [
-        I({
+        Me({
           needs: { connect: [t.source] },
           purpose: "observability",
           src: r,
@@ -1038,13 +2183,13 @@ const yt = "https://js.sentry-cdn.com", br = {
     return e.flatMap((t) => [...t.scripts]);
   }
 };
-function vt(e) {
+function Kn(e) {
   const t = e.trim();
   if (!t || t.includes("/") || t.includes(" "))
     throw new Error("Analytics domain must be a hostname without a path.");
   return t;
 }
-function H(e) {
+function St(e) {
   if (e.startsWith("/")) {
     if (e.startsWith("//"))
       throw new Error("Analytics endpoint must not be a scheme-relative URL.");
@@ -1053,10 +2198,10 @@ function H(e) {
       source: "'self'"
     };
   }
-  const t = bt(e);
+  const t = Wn(e);
   return { base: t.origin, source: t.origin };
 }
-function bt(e) {
+function Wn(e) {
   let t;
   try {
     t = new URL(e);
@@ -1067,7 +2212,7 @@ function bt(e) {
     throw new Error("Analytics endpoint must use HTTPS.");
   return t;
 }
-function St(e, t) {
+function Jn(e, t) {
   let r;
   try {
     r = new URL(e);
@@ -1078,7 +2223,7 @@ function St(e, t) {
     throw new Error(`${t} must use HTTPS.`);
   return r.origin;
 }
-function Et(e) {
+function Gn(e) {
   let t;
   try {
     t = new URL(e);
@@ -1100,60 +2245,60 @@ function Et(e) {
     publicKey: t.username
   };
 }
-function Sr(e = {}) {
+function Zo(e = {}) {
   return {
     async request(t) {
-      await x({ kind: "request", signal: t }, e);
+      await me({ kind: "request", signal: t }, e);
     },
     async serverStart(t = {}) {
-      await x({ kind: "server-start", signal: t }, e);
+      await me({ kind: "server-start", signal: t }, e);
     },
     async trace(t) {
-      await x({ kind: "trace", signal: t }, e);
+      await me({ kind: "trace", signal: t }, e);
     },
     async reportWebVitals(t) {
-      await x({ kind: "web-vital", signal: t }, e);
+      await me({ kind: "web-vital", signal: t }, e);
     }
   };
 }
-async function x(e, t) {
+async function me(e, t) {
   await t.onEvent?.(e), e.kind === "request" ? await t.request?.(e.signal) : e.kind === "server-start" ? await t.serverStart?.(e.signal) : e.kind === "trace" ? await t.trace?.(e.signal) : await t.webVitals?.(e.signal);
 }
-const Rt = [
+const Yn = [
   "CLS",
   "FCP",
   "FID",
   "INP",
   "LCP",
   "TTFB"
-], L = [
+], Ue = [
   "CLS",
   "FCP",
   "INP",
   "LCP",
   "TTFB"
-], Tt = new Set(Rt), kt = /* @__PURE__ */ new Set([
+], Zn = new Set(Yn), Xn = /* @__PURE__ */ new Set([
   "back-forward",
   "back-forward-cache",
   "navigate",
   "prerender",
   "reload",
   "restore"
-]), At = /* @__PURE__ */ new Set([
+]), Qn = /* @__PURE__ */ new Set([
   "good",
   "needs-improvement",
   "poor"
 ]);
-function $t(e) {
-  return typeof e == "string" && Tt.has(e);
+function eo(e) {
+  return typeof e == "string" && Zn.has(e);
 }
-function xt(e) {
-  return typeof e == "string" && kt.has(e);
+function to(e) {
+  return typeof e == "string" && Xn.has(e);
 }
-function Ct(e) {
-  return typeof e == "string" && At.has(e);
+function ro(e) {
+  return typeof e == "string" && Qn.has(e);
 }
-const It = {
+const no = {
   CLS: { good: 0.1, poor: 0.25 },
   FCP: { good: 1800, poor: 3e3 },
   FID: { good: 100, poor: 300 },
@@ -1161,13 +2306,13 @@ const It = {
   LCP: { good: 2500, poor: 4e3 },
   TTFB: { good: 800, poor: 1800 }
 };
-function Nt(e, t) {
-  const r = It[e];
+function oo(e, t) {
+  const r = no[e];
   return t <= r.good ? "good" : t > r.poor ? "poor" : "needs-improvement";
 }
-const Q = 32;
-function Er(e) {
-  const t = Dt(e.endpoint), r = Ot(e.metrics), n = Mt(e.sampleRate);
+const Zt = 32;
+function Xo(e) {
+  const t = so(e.endpoint), r = co(e.metrics), n = uo(e.sampleRate);
   return {
     endpoint: t.url,
     kind: "web-vitals",
@@ -1176,48 +2321,45 @@ function Er(e) {
     sampleRate: n
   };
 }
-function Rr(...e) {
+function Qo(...e) {
   const t = /* @__PURE__ */ new Set();
   for (const r of e)
     for (const n of r.needs.connect ?? [])
       t.add(n);
   return t.size === 0 ? { security: { needs: {} } } : { security: { needs: { connect: [...t] } } };
 }
-async function Tr(e, t = {}) {
-  const r = t.maxMetrics ?? Q;
+async function ei(e, t = {}) {
+  const r = t.maxMetrics ?? Zt;
   let n;
   try {
     n = await e.json();
   } catch {
     return { ok: !1, reason: "unreadable-body" };
   }
-  return Lt(n, r);
+  return io(n, r);
 }
-function Lt(e, t = Q) {
-  if (!ee(e) || !Array.isArray(e.metrics))
+function io(e, t = Zt) {
+  if (!Ze(e) || !Array.isArray(e.metrics))
     return { ok: !1, reason: "invalid-payload" };
   if (e.metrics.length > t)
     return { ok: !1, reason: "too-many-metrics" };
   const r = [];
   for (const n of e.metrics) {
-    const o = Pt(n);
+    const o = ao(n);
     if (!o)
       return { ok: !1, reason: "invalid-payload" };
     r.push(o);
   }
   return { metrics: r, ok: !0 };
 }
-function Pt(e) {
-  if (!ee(e))
+function ao(e) {
+  if (!Ze(e))
     return;
-  const { id: t, name: r, navigationType: n, rating: o, url: a, value: i } = e;
-  if (!(typeof t != "string" || t.length === 0 || t.length > 128) && !(!$t(r) || !xt(n)) && Ct(o) && !(typeof a != "string" || a.length === 0 || a.length > 2048) && !(typeof i != "number" || !Number.isFinite(i) || i < 0))
-    return { id: t, name: r, navigationType: n, rating: o, url: a, value: i };
-}
-function ee(e) {
-  return typeof e == "object" && e !== null;
+  const { id: t, name: r, navigationType: n, rating: o, url: i, value: s } = e;
+  if (!(typeof t != "string" || t.length === 0 || t.length > 128) && !(!eo(r) || !to(n)) && ro(o) && !(typeof i != "string" || i.length === 0 || i.length > 2048) && !(typeof s != "number" || !Number.isFinite(s) || s < 0))
+    return { id: t, name: r, navigationType: n, rating: o, url: i, value: s };
 }
-function Dt(e) {
+function so(e) {
   if (e.startsWith("/")) {
     if (e.startsWith("//"))
       throw new Error(
@@ -1237,14 +2379,14 @@ function Dt(e) {
     throw new Error("The web vitals endpoint must use HTTPS.");
   return { source: t.origin, url: t.href };
 }
-function Ot(e) {
+function co(e) {
   if (!e)
-    return L;
+    return Ue;
   const t = [];
   for (const r of e) {
-    if (!L.includes(r))
+    if (!Ue.includes(r))
       throw new Error(
-        `The browser collector does not measure ${JSON.stringify(r)}. Demiurge collects ${L.join(", ")}.`
+        `The browser collector does not measure ${JSON.stringify(r)}. Demiurge collects ${Ue.join(", ")}.`
       );
     t.includes(r) || t.push(r);
   }
@@ -1252,15 +2394,15 @@ function Ot(e) {
     throw new Error("A web vitals integration must collect one metric or more.");
   return t;
 }
-function Mt(e) {
+function uo(e) {
   if (e === void 0)
     return 1;
   if (!Number.isFinite(e) || e < 0 || e > 1)
     throw new Error("The web vitals sample rate must be between 0 and 1.");
   return e;
 }
-const Ft = 1e3, zt = 5e3, Ut = 40;
-function Bt(e, t = {}) {
+const lo = 1e3, fo = 5e3, ho = 40;
+function po(e, t = {}) {
   if (typeof window > "u" || typeof PerformanceObserver > "u")
     return () => {
     };
@@ -1268,77 +2410,77 @@ function Bt(e, t = {}) {
   if (e.sampleRate < 1 && r() >= e.sampleRate)
     return () => {
     };
-  const n = t.transport ?? _t, o = new Set(e.metrics), a = [], i = [], s = /* @__PURE__ */ new Set();
-  let l = jt(), d = 0, p = 0, c = 0, f = 0, h, v, S = !1;
-  const b = (u, g) => {
-    if (S || s.has(u))
+  const n = t.transport ?? mo, o = new Set(e.metrics), i = [], s = [], a = /* @__PURE__ */ new Set();
+  let u = yo(), d = 0, v = 0, A = 0, h = 0, p, E, g = !1;
+  const b = (w, $) => {
+    if (g || a.has(w))
       return;
-    s.add(u);
-    const y = {
-      id: `${u}-${Date.now()}-${Math.floor(r() * 1e9)}`,
-      name: u,
-      navigationType: l,
-      rating: Nt(u, g),
+    a.add(w);
+    const C = {
+      id: `${w}-${Date.now()}-${Math.floor(r() * 1e9)}`,
+      name: w,
+      navigationType: u,
+      rating: oo(w, $),
       url: window.location.href,
-      value: Math.round(g * 1e3) / 1e3
+      value: Math.round($ * 1e3) / 1e3
     };
-    i.push(y), t.onReport?.(y);
+    s.push(C), t.onReport?.(C);
   }, m = () => {
-    if (S || (h !== void 0 && b("LCP", h), v !== void 0 && b("INP", v), o.has("CLS") && b("CLS", d), i.length === 0))
+    if (g || (p !== void 0 && b("LCP", p), E !== void 0 && b("INP", E), o.has("CLS") && b("CLS", d), s.length === 0))
       return;
-    const u = i.splice(0, i.length);
-    n(e.endpoint, { metrics: u });
-  }, k = () => {
+    const w = s.splice(0, s.length);
+    n(e.endpoint, { metrics: w });
+  }, T = () => {
     document.visibilityState === "hidden" && m();
-  }, M = (u) => {
-    u.persisted && (l = "back-forward-cache", s.clear(), d = 0, p = 0, c = 0, f = 0, h = void 0, v = void 0, o.has("FCP") && b("FCP", performance.now() - u.timeStamp));
+  }, H = (w) => {
+    w.persisted && (u = "back-forward-cache", a.clear(), d = 0, v = 0, A = 0, h = 0, p = void 0, E = void 0, o.has("FCP") && b("FCP", performance.now() - w.timeStamp));
   };
   if (o.has("TTFB")) {
-    const u = te();
-    u && u.responseStart > 0 && b("TTFB", u.responseStart);
+    const w = Xt();
+    w && w.responseStart > 0 && b("TTFB", w.responseStart);
   }
-  return o.has("FCP") && C(a, { buffered: !0, type: "paint" }, (u) => {
-    for (const g of u)
-      g.name === "first-contentful-paint" && b("FCP", g.startTime);
-  }), o.has("LCP") && C(
-    a,
+  return o.has("FCP") && ye(i, { buffered: !0, type: "paint" }, (w) => {
+    for (const $ of w)
+      $.name === "first-contentful-paint" && b("FCP", $.startTime);
+  }), o.has("LCP") && ye(
+    i,
     { buffered: !0, type: "largest-contentful-paint" },
-    (u) => {
-      const g = u.at(-1);
-      g && (h = g.startTime);
+    (w) => {
+      const $ = w.at(-1);
+      $ && (p = $.startTime);
     }
-  ), o.has("CLS") && C(a, { buffered: !0, type: "layout-shift" }, (u) => {
-    for (const g of u) {
-      const y = g;
-      if (y.hadRecentInput)
+  ), o.has("CLS") && ye(i, { buffered: !0, type: "layout-shift" }, (w) => {
+    for (const $ of w) {
+      const C = $;
+      if (C.hadRecentInput)
         continue;
-      p > 0 && y.startTime - f < Ft && y.startTime - c < zt ? p += y.value : (p = y.value, c = y.startTime), f = y.startTime, d = Math.max(d, p);
+      v > 0 && C.startTime - h < lo && C.startTime - A < fo ? v += C.value : (v = C.value, A = C.startTime), h = C.startTime, d = Math.max(d, v);
     }
-  }), o.has("INP") && C(
-    a,
+  }), o.has("INP") && ye(
+    i,
     {
       buffered: !0,
-      durationThreshold: Ut,
+      durationThreshold: ho,
       type: "event"
     },
-    (u) => {
-      for (const g of u)
-        v = Math.max(v ?? 0, g.duration);
+    (w) => {
+      for (const $ of w)
+        E = Math.max(E ?? 0, $.duration);
     }
-  ), document.addEventListener("visibilitychange", k), window.addEventListener("pagehide", m), window.addEventListener("pageshow", M), () => {
-    m(), S = !0;
-    for (const u of a)
-      u.disconnect();
-    document.removeEventListener("visibilitychange", k), window.removeEventListener("pagehide", m), window.removeEventListener("pageshow", M);
+  ), document.addEventListener("visibilitychange", T), window.addEventListener("pagehide", m), window.addEventListener("pageshow", H), () => {
+    m(), g = !0;
+    for (const w of i)
+      w.disconnect();
+    document.removeEventListener("visibilitychange", T), window.removeEventListener("pagehide", m), window.removeEventListener("pageshow", H);
   };
 }
-function kr({ integration: e, onReport: t, transport: r }) {
-  return P(
-    () => Bt(e, { onReport: t, transport: r }),
+function ti({ integration: e, onReport: t, transport: r }) {
+  return Y(
+    () => po(e, { onReport: t, transport: r }),
     [e, t, r]
   ), null;
 }
-function _t(e, t) {
+function mo(e, t) {
   const r = JSON.stringify(t);
   if (typeof navigator < "u" && typeof navigator.sendBeacon == "function") {
     const n = new Blob([r], { type: "application/json" });
@@ -1353,7 +2495,7 @@ function _t(e, t) {
   }).catch(() => {
   });
 }
-function C(e, t, r) {
+function ye(e, t, r) {
   try {
     const n = new PerformanceObserver((o) => r(o.getEntries()));
     n.observe(t), e.push(n);
@@ -1361,155 +2503,204 @@ function C(e, t, r) {
     return;
   }
 }
-function te() {
+function Xt() {
   if (!(typeof performance > "u"))
     return performance.getEntriesByType("navigation")[0];
 }
-function jt() {
-  const e = te();
+function yo() {
+  const e = Xt();
   return e?.type === "back_forward" ? "back-forward" : e?.type === "reload" || e?.type === "prerender" ? e.type : "navigate";
 }
 export {
-  L as COLLECTED_WEB_VITAL_NAMES,
-  Vr as CacheNotFoundError,
-  He as EnvValidationError,
-  xr as FRAMEWORK_TRUSTED_TYPES_POLICY,
-  Ee as HTTP_ERROR_STATUSES,
-  Wr as HttpError,
-  vr as Image,
-  yr as Link,
-  Cr as Script,
-  Rt as WEB_VITAL_NAMES,
-  It as WEB_VITAL_THRESHOLDS,
-  kr as WebVitals,
-  or as action,
-  ar as actionInput,
-  br as analytics,
-  qr as applyFetchMetadataVary,
-  Ir as assertAdapterCapabilities,
-  Gr as auditScriptDependencies,
-  Kr as cacheNotFound,
-  Nr as checkAdapterCapabilities,
-  Jr as checkFetchMetadata,
-  at as checkWebSocketOrigin,
-  Bt as collectWebVitals,
-  Yr as createCache,
-  Zr as createCorsHeaders,
-  Xr as createCsrfCookie,
-  Qr as createCsrfToken,
-  ct as createFileRouter,
-  Lr as createFrameworkScriptUrl,
-  en as createInvalidation,
-  tn as createMemoryCache,
-  rn as createMemoryCacheStore,
-  Yt as createMemoryIdempotencyStore,
-  nn as createMemoryRateLimitStore,
-  on as createRequestHandler,
-  lr as createSecureCookie,
-  an as createSecurityAudit,
-  sn as createSecurityHeaders,
-  mr as createSecurityReportHandler,
-  cn as cspHash,
-  un as cspNonce,
-  Kn as defaultFontPath,
-  Pr as defineAdapter,
-  fr as defineEnvSchema,
-  Jn as defineFonts,
-  Yn as defineImages,
-  Sr as defineInstrumentation,
-  Dr as defineLinks,
-  ln as defineMetadata,
-  sr as defineMiddleware,
-  tr as defineOgImage,
-  er as defineRobots,
-  fn as defineRoutePolicy,
-  Or as defineScripts,
-  dn as defineSecurityPolicy,
-  Xt as defineSitemap,
-  hn as defineTags,
-  Er as defineWebVitals,
-  mn as enforceAllowedMethods,
-  pn as enforceCsrfProtection,
-  gn as enforceFetchMetadataPolicy,
-  wn as enforceRateLimit,
-  yn as enforceRequestSecurity,
-  gr as enforceWebSocketOrigin,
-  hr as env,
-  Zn as font,
-  Xn as fontAssetFileName,
-  Qn as fontAssetUrl,
-  eo as fontLinks,
-  to as fontMediaType,
-  ro as fontPreloadLinks,
-  no as fontSources,
-  oo as fontStylesheetUrl,
-  Mr as getScriptWorker,
-  vn as handleRequestWithManifest,
-  pe as href,
-  bn as html,
-  Re as httpError,
-  wr as hydrateFileRouter,
-  ao as isAllowedImageSource,
-  Sn as isCacheNotFoundError,
-  ke as isHttpError,
-  En as issueCsrfToken,
-  Rn as json,
-  Tn as jsonl,
-  kn as link,
-  An as mergeRoutePolicies,
-  $n as mergeRouteSecurityPolicies,
-  xn as mergeSecurityPolicies,
-  Cn as meta,
-  Fr as modulePreload,
-  In as notFound,
-  ir as page,
-  D as parseBodySize,
-  B as parseCacheDuration,
-  de as parseCookieHeader,
-  io as parseImageOptimizerRequest,
-  Nn as parseRateLimitWindow,
-  Lt as parseWebVitalsBeacon,
-  Ae as planImageTransform,
-  zr as preconnect,
-  Ur as preload,
-  Ln as query,
-  ur as readSecureCookie,
-  Tr as readWebVitalsBeacon,
-  Pn as redirect,
-  so as renderFontFaceCss,
-  nr as renderOgImageResponse,
-  Ne as renderOgImageSvg,
-  Br as renderPageResponse,
-  rr as renderRobots,
-  Qt as renderSitemap,
-  _r as resolveLinks,
-  Dn as resolveMetadata,
-  jr as resolveScripts,
-  le as response,
-  Zt as runIdempotentMutation,
-  I as script,
-  O as secureCookieName,
-  On as security,
-  _t as sendWebVitalsBeacon,
-  ue as serializeCacheKey,
-  Mn as serializeCacheNamespace,
-  Fn as serializeCacheTag,
-  zn as serverTiming,
-  Un as sse,
-  U as startDeferredScripts,
-  Bn as stream,
-  _n as structuredData,
-  jn as tag,
-  Hn as text,
-  fe as toResponse,
-  Vn as validateCorsPolicy,
-  dr as validateEnv,
-  Wn as validateRateLimitPolicy,
-  qn as validateRouteModules,
-  je as validateSecureCookie,
-  pr as validateUploads,
-  Nt as webVitalRating,
-  Rr as webVitalsPolicy,
-  cr as webhook
+  Ue as COLLECTED_WEB_VITAL_NAMES,
+  Si as CacheNotFoundError,
+  rs as DEFAULT_CONTENT_TYPE,
+  Ei as DEFAULT_MAX_BODY_SIZE,
+  Ai as EnvValidationError,
+  oi as FRAMEWORK_TRUSTED_TYPES_POLICY,
+  Ko as Form,
+  Ar as HTTP_ERROR_STATUSES,
+  xi as HttpError,
+  Go as Image,
+  qo as Link,
+  mr as MUTATION_REQUEST_HEADER,
+  pr as MUTATION_REQUEST_VALUE,
+  xt as MUTATION_RESPONSE_MEDIA_TYPE,
+  Wo as MutationSubmit,
+  ki as MutationValidationError,
+  zo as RouteFocusBoundary,
+  Ri as RouteSerializationError,
+  ii as Script,
+  rn as SessionStoreConflictError,
+  mt as SessionStoreUnavailableError,
+  Yn as WEB_VITAL_NAMES,
+  no as WEB_VITAL_THRESHOLDS,
+  ti as WebVitals,
+  Yo as analytics,
+  Be as applicationPathname,
+  Ti as applyFetchMetadataVary,
+  Mi as applyLocalizedMetadata,
+  ai as assertAdapterCapabilities,
+  Ci as attachExceptionSource,
+  $i as auditScriptDependencies,
+  Ni as authorizeRoute,
+  Li as cacheNotFound,
+  si as checkAdapterCapabilities,
+  Ii as checkFetchMetadata,
+  wn as checkWebSocketOrigin,
+  po as collectWebVitals,
+  ns as contentTypeForExtension,
+  Di as createCache,
+  Pi as createCorsHeaders,
+  Oi as createCsrfCookie,
+  _i as createCsrfToken,
+  _o as createEncryptedCookieSession,
+  Mn as createFileRouter,
+  ci as createFrameworkScriptUrl,
+  Fi as createInvalidation,
+  Ui as createMemoryCache,
+  Bi as createMemoryCacheStore,
+  $o as createMemoryIdempotencyStore,
+  Hi as createMemoryRateLimitStore,
+  Ss as createMemorySessionStore,
+  An as createMutationAction,
+  zi as createRequestHandler,
+  Se as createSecureCookie,
+  ji as createSecurityAudit,
+  Vi as createSecurityHeaders,
+  Uo as createSecurityReportHandler,
+  Fo as createSessionManager,
+  Oo as createSignedCookieSession,
+  qi as cspHash,
+  Ki as cspNonce,
+  as as defaultFontPath,
+  ui as defineAdapter,
+  Wi as defineAuthorization,
+  Ji as defineEnvSchema,
+  ss as defineFonts,
+  cs as defineImages,
+  Zo as defineInstrumentation,
+  li as defineLinks,
+  Gi as defineLocales,
+  Yi as defineMetadata,
+  Io as defineMiddleware,
+  To as defineOgImage,
+  Ro as defineRobots,
+  Zi as defineRoutePolicy,
+  di as defineScripts,
+  Xi as defineSecurityPolicy,
+  xo as defineSitemap,
+  Qi as defineTags,
+  Xo as defineWebVitals,
+  ea as deserializeEnvSchema,
+  ta as enforceAllowedMethods,
+  ra as enforceCsrfProtection,
+  na as enforceFetchMetadataPolicy,
+  oa as enforceRateLimit,
+  ia as enforceRequestSecurity,
+  Ho as enforceWebSocketOrigin,
+  aa as env,
+  us as font,
+  ls as fontAssetFileName,
+  ds as fontAssetUrl,
+  fs as fontLinks,
+  hs as fontMediaType,
+  ps as fontPreloadLinks,
+  ms as fontSources,
+  ys as fontStylesheetUrl,
+  sa as getBodySizeException,
+  ca as getCspException,
+  ua as getCsrfException,
+  fi as getRequestClientAddress,
+  hi as getScriptWorker,
+  la as handleRequestWithManifest,
+  Xe as href,
+  da as html,
+  xr as httpError,
+  Vo as hydrateFileRouter,
+  gs as isAllowedImageSource,
+  fa as isCacheNotFoundError,
+  os as isContentHashedFileName,
+  Rr as isHttpError,
+  ha as isSecurityException,
+  pa as issueCsrfToken,
+  ma as json,
+  ya as jsonl,
+  ga as link,
+  wa as localeDirection,
+  Qe as localizeHref,
+  va as mergeRouteAccess,
+  ba as mergeRoutePolicies,
+  Sa as mergeRouteSecurityPolicies,
+  Ea as mergeSecurityPolicies,
+  Aa as meta,
+  pi as modulePreload,
+  xa as mutation,
+  ka as mutationInput,
+  Ra as notFound,
+  Lo as page,
+  Ye as parseBodySize,
+  ct as parseCacheDuration,
+  Ge as parseCookieHeader,
+  ws as parseImageOptimizerRequest,
+  Ta as parseRateLimitWindow,
+  io as parseWebVitalsBeacon,
+  Ma as permitsRequest,
+  Mr as planImageTransform,
+  mi as preconnect,
+  yi as preload,
+  Ca as query,
+  $a as readEnv,
+  Po as readSecureCookie,
+  ei as readWebVitalsBeacon,
+  Na as redirect,
+  vs as renderFontFaceCss,
+  Co as renderOgImageResponse,
+  $r as renderOgImageSvg,
+  gi as renderPageResponse,
+  Mo as renderRobots,
+  ko as renderSitemap,
+  La as resolveCsp,
+  Ia as resolveCsrf,
+  wi as resolveLinks,
+  gr as resolveLocale,
+  Da as resolveMaxBodySize,
+  Pa as resolveMetadata,
+  Oa as resolveRouteAccess,
+  vi as resolveScripts,
+  _a as response,
+  No as runIdempotentMutation,
+  Me as script,
+  ce as secureCookieName,
+  Fa as security,
+  mo as sendWebVitalsBeacon,
+  dr as serializeCacheKey,
+  Ua as serializeCacheNamespace,
+  Ba as serializeCacheTag,
+  Ha as serializeEnvSchema,
+  Es as serializeSessionNamespace,
+  za as serverTiming,
+  ja as sse,
+  st as startDeferredScripts,
+  Va as stream,
+  qa as structuredData,
+  Ka as tag,
+  Wa as text,
+  Ja as toResponse,
+  Ga as unstable_resetEnvironment,
+  Ya as unstable_startEnvironment,
+  Jo as useFormNavigation,
+  jo as useMutationAction,
+  In as useNavigation,
+  Sn as useRouteFocusBoundary,
+  Za as validateCorsPolicy,
+  Xa as validateEnv,
+  Qa as validateRateLimitPolicy,
+  es as validateRouteModules,
+  Vr as validateSecureCookie,
+  Bo as validateUploads,
+  oo as webVitalRating,
+  Qo as webVitalsPolicy,
+  Do as webhook
 };
 //# sourceMappingURL=index.js.map