@pracht/core 0.7.0 → 0.8.0

package/dist/index.mjs

@@ -1,2089 +1,8 @@
-import { createContext, h, hydrate, options, render } from "preact";
-import { useContext, useEffect, useMemo, useState } from "preact/hooks";
+import { a as matchApiRoute, c as resolveApp, i as group, l as route, n as buildPathFromSegments, o as matchAppRoute, r as defineApp, s as resolveApiRoutes, t as buildHref, u as timeRevalidate } from "./app-BvC1uQG5.mjs";
+import { S as createHref, _ as applyDefaultSecurityHeaders, a as useParams, i as useLocation, n as Form, o as useRevalidate, r as Link, s as useRouteData, t as PrachtHttpError, u as redirect } from "./types-idmK5omD.mjs";
+import { t as forwardRef } from "./forwardRef-grZ6t4GS.mjs";
+import { n as useNavigate, r as useIsHydrated, t as initClientRouter } from "./router-B7J4YYwg.mjs";
+import { i as startApp, r as readHydrationState, t as PrachtRuntimeProvider } from "./runtime-context-B5pREhcM.mjs";
+import { n as handlePrachtRequest, t as prerenderApp } from "./prerender-D3E2H96p.mjs";
 import { Suspense, lazy } from "preact-suspense";
-//#region src/app.ts
-function timeRevalidate(seconds) {
-	if (!Number.isInteger(seconds) || seconds <= 0) throw new Error("timeRevalidate expects a positive integer number of seconds.");
-	return {
-		kind: "time",
-		seconds
-	};
-}
-function route(path, fileOrConfig, meta = {}) {
-	if (typeof fileOrConfig === "string" || typeof fileOrConfig === "function") return {
-		kind: "route",
-		path: normalizeRoutePath(path),
-		file: resolveModuleRef(fileOrConfig),
-		...meta
-	};
-	const { component, loader, ...routeMeta } = fileOrConfig;
-	return {
-		kind: "route",
-		path: normalizeRoutePath(path),
-		file: resolveModuleRef(component),
-		loaderFile: resolveModuleRef(loader),
-		hasLoader: !!loader,
-		...routeMeta
-	};
-}
-function resolveModuleRef(ref) {
-	if (ref === void 0) return void 0;
-	if (typeof ref === "string") return ref;
-	return "";
-}
-function group(meta, routes) {
-	return {
-		kind: "group",
-		meta,
-		routes
-	};
-}
-function defineApp(config) {
-	return {
-		shells: resolveModuleRefRecord(config.shells ?? {}),
-		middleware: resolveModuleRefRecord(config.middleware ?? {}),
-		api: config.api ?? {},
-		routes: config.routes
-	};
-}
-function resolveModuleRefRecord(record) {
-	const result = {};
-	for (const [key, value] of Object.entries(record)) result[key] = resolveModuleRef(value);
-	return result;
-}
-function resolveApp(app) {
-	const routes = [];
-	const inherited = {
-		pathPrefix: "/",
-		middleware: []
-	};
-	for (const node of app.routes) flattenRouteNode(app, node, inherited, routes);
-	return {
-		shells: app.shells,
-		middleware: app.middleware,
-		api: app.api,
-		routes,
-		apiRoutes: []
-	};
-}
-function matchAppRoute(app, pathname) {
-	const resolved = isResolvedApp(app) ? app : resolveApp(app);
-	const normalizedPathname = normalizeRoutePath(pathname);
-	const targetSegments = splitPathSegments(normalizedPathname);
-	for (const currentRoute of resolved.routes) {
-		const params = matchRouteSegments(currentRoute.segments, targetSegments);
-		if (params) return {
-			route: currentRoute,
-			params,
-			pathname: normalizedPathname
-		};
-	}
-}
-function flattenRouteNode(app, node, inherited, routes) {
-	if (node.kind === "group") {
-		const nextInherited = {
-			pathPrefix: mergeRoutePaths(inherited.pathPrefix, node.meta.pathPrefix),
-			shell: node.meta.shell ?? inherited.shell,
-			render: node.meta.render ?? inherited.render,
-			middleware: [...inherited.middleware, ...node.meta.middleware ?? []]
-		};
-		for (const child of node.routes) flattenRouteNode(app, child, nextInherited, routes);
-		return;
-	}
-	const fullPath = mergeRoutePaths(inherited.pathPrefix, node.path);
-	const shell = node.shell ?? inherited.shell;
-	const middleware = [...inherited.middleware, ...node.middleware ?? []];
-	routes.push({
-		id: node.id ?? createRouteId(fullPath),
-		path: fullPath,
-		file: node.file,
-		loaderFile: node.loaderFile,
-		hasLoader: node.loaderFile ? true : node.hasLoader,
-		shell,
-		shellFile: shell ? app.shells[shell] : void 0,
-		render: node.render ?? inherited.render,
-		middleware,
-		middlewareFiles: middleware.flatMap((name) => {
-			const middlewareFile = app.middleware[name];
-			return middlewareFile ? [middlewareFile] : [];
-		}),
-		revalidate: node.revalidate,
-		segments: parseRouteSegments(fullPath)
-	});
-}
-function isResolvedApp(app) {
-	return app.routes.length === 0 || "segments" in app.routes[0];
-}
-function matchRouteSegments(routeSegments, targetSegments) {
-	const params = {};
-	let routeIndex = 0;
-	let targetIndex = 0;
-	while (routeIndex < routeSegments.length) {
-		const currentSegment = routeSegments[routeIndex];
-		if (currentSegment.type === "catchall") {
-			try {
-				params[currentSegment.name] = targetSegments.slice(targetIndex).map(decodeURIComponent).join("/");
-			} catch {
-				return null;
-			}
-			return params;
-		}
-		const targetSegment = targetSegments[targetIndex];
-		if (typeof targetSegment === "undefined") return null;
-		if (currentSegment.type === "static") {
-			if (currentSegment.value !== targetSegment) return null;
-		} else try {
-			params[currentSegment.name] = decodeURIComponent(targetSegment);
-		} catch {
-			return null;
-		}
-		routeIndex += 1;
-		targetIndex += 1;
-	}
-	return targetIndex === targetSegments.length ? params : null;
-}
-function parseRouteSegments(path) {
-	return splitPathSegments(path).map((segment) => {
-		if (segment === "*") return {
-			type: "catchall",
-			name: "*"
-		};
-		if (segment.startsWith(":") && segment.endsWith("*")) return {
-			type: "catchall",
-			name: segment.slice(1, -1) || "*"
-		};
-		if (segment.startsWith(":")) return {
-			type: "param",
-			name: segment.slice(1)
-		};
-		assertSafeStaticRouteSegment(segment);
-		return {
-			type: "static",
-			value: segment
-		};
-	});
-}
-function splitPathSegments(path) {
-	return normalizeRoutePath(path).split("/").filter(Boolean);
-}
-function assertSafeStaticRouteSegment(segment) {
-	if (segment === "." || segment === "..") throw new Error(`Unsafe static route segment "${segment}" is not allowed.`);
-	if (segment.includes("\0") || /[\r\n\\]/.test(segment)) throw new Error(`Unsafe static route segment "${segment}" contains a forbidden character.`);
-}
-function mergeRoutePaths(prefix, path) {
-	if (!path) return normalizeRoutePath(prefix);
-	const normalizedPrefix = normalizeRoutePath(prefix);
-	const normalizedPath = normalizeRoutePath(path);
-	if (normalizedPrefix === "/") return normalizedPath;
-	if (normalizedPath === "/") return normalizedPrefix;
-	return normalizeRoutePath(`${normalizedPrefix}/${normalizedPath.slice(1)}`);
-}
-function normalizeRoutePath(path) {
-	if (!path || path === "/") return "/";
-	const collapsed = (path.startsWith("/") ? path : `/${path}`).replace(/\/{2,}/g, "/");
-	return collapsed.length > 1 && collapsed.endsWith("/") ? collapsed.slice(0, -1) : collapsed;
-}
-function buildPathFromSegments(segments, params) {
-	return normalizeRoutePath("/" + segments.map((segment) => {
-		if (segment.type === "static") return segment.value;
-		if (segment.type === "param") return encodeDynamicPathSegment(params[segment.name] ?? "");
-		return (params[segment.name] ?? params["*"] ?? "").split("/").map((part) => encodeDynamicPathSegment(part)).join("/");
-	}).join("/"));
-}
-function buildHref(routes, routeId, ...args) {
-	return buildHrefUntyped(routes, String(routeId), args[0]);
-}
-function createHref(routes) {
-	return ((routeId, options) => buildHrefUntyped(routes, routeId, options));
-}
-function buildHrefUntyped(routes, routeId, options = {}) {
-	const route = routes.find((candidate) => candidate.id === routeId);
-	if (!route) throw new Error(`Unknown pracht route id: ${routeId}.`);
-	const segments = route.segments ?? parseRouteSegments(route.path);
-	return `${buildPathFromSegments(segments, normalizeHrefParams(segments, options.params ?? {}))}${serializeSearch(options.search)}${serializeHash(options.hash)}`;
-}
-function normalizeHrefParams(segments, params) {
-	const expected = new Set(segments.filter((segment) => segment.type === "param" || segment.type === "catchall").map((segment) => segment.name));
-	for (const name of expected) if (params[name] == null) throw new Error(`Missing route param: ${name}.`);
-	for (const name of Object.keys(params)) if (!expected.has(name)) throw new Error(`Unexpected route param: ${name}.`);
-	const normalized = {};
-	for (const name of expected) normalized[name] = String(params[name]);
-	return normalized;
-}
-function serializeSearch(search) {
-	if (search == null) return "";
-	if (typeof search === "string") {
-		if (!search) return "";
-		return search.startsWith("?") ? search : `?${search}`;
-	}
-	const serialized = (search instanceof URLSearchParams ? search : objectToSearchParams(search)).toString();
-	return serialized ? `?${serialized}` : "";
-}
-function objectToSearchParams(search) {
-	const params = new URLSearchParams();
-	for (const [key, value] of Object.entries(search)) {
-		if (Array.isArray(value)) {
-			for (const item of value) appendSearchValue(params, key, item);
-			continue;
-		}
-		appendSearchValue(params, key, value);
-	}
-	return params;
-}
-function appendSearchValue(params, key, value) {
-	if (value == null) return;
-	params.append(key, String(value));
-}
-function serializeHash(hash) {
-	if (!hash) return "";
-	return hash.startsWith("#") ? hash : `#${hash}`;
-}
-/**
-* Encode one dynamic URL path segment for SSG/ISG output. `encodeURIComponent`
-* leaves unreserved characters (including `.`) intact, and even percent-encoded
-* dot segments are normalized by URL parsers. Reject exact `.` / `..` segments
-* instead of allowing them to reach filesystem output path construction.
-*/
-function encodeDynamicPathSegment(part) {
-	if (part === "." || part === "..") throw new Error(`Unsafe dynamic route param segment "${part}" is not allowed.`);
-	return encodeURIComponent(part);
-}
-/**
-* Convert a list of file paths from `import.meta.glob` into resolved API routes.
-*
-* Example: `"/src/api/health.ts"` → path `/api/health`
-*          `"/src/api/users/[id].ts"` → path `/api/users/:id`
-*          `"/src/api/files/[...path].ts"` → path `/api/files/*`
-*          `"/src/api/index.ts"` → path `/api`
-*/
-function resolveApiRoutes(files, apiDir = "/src/api") {
-	const normalizedDir = apiDir.replace(/\/$/, "");
-	return files.map((file) => {
-		let relative = file;
-		if (relative.startsWith(normalizedDir)) relative = relative.slice(normalizedDir.length);
-		relative = relative.replace(/\.(ts|tsx|js|jsx)$/, "");
-		if (relative.endsWith("/index")) relative = relative.slice(0, -6) || "/";
-		relative = relative.replace(/\[\.\.\.[^\]]+\]/g, "*");
-		relative = relative.replace(/\[([^\]]+)\]/g, ":$1");
-		const path = normalizeRoutePath(`/api${relative}`);
-		return {
-			path,
-			file,
-			segments: parseRouteSegments(path)
-		};
-	}).sort(compareResolvedApiRoutes);
-}
-function matchApiRoute(apiRoutes, pathname) {
-	const normalizedPathname = normalizeRoutePath(pathname);
-	const targetSegments = splitPathSegments(normalizedPathname);
-	for (const route of apiRoutes) {
-		const params = matchRouteSegments(route.segments, targetSegments);
-		if (params) return {
-			route,
-			params,
-			pathname: normalizedPathname
-		};
-	}
-}
-function createRouteId(path) {
-	if (path === "/") return "index";
-	return path.slice(1).split("/").map((segment) => {
-		if (segment === "*") return "splat";
-		return segment.startsWith(":") ? segment.slice(1) : segment;
-	}).join("-").replace(/[^a-zA-Z0-9-]/g, "-");
-}
-function compareResolvedApiRoutes(left, right) {
-	const length = Math.max(left.segments.length, right.segments.length);
-	for (let index = 0; index < length; index += 1) {
-		const leftSegment = left.segments[index];
-		const rightSegment = right.segments[index];
-		if (!leftSegment) return 1;
-		if (!rightSegment) return -1;
-		const leftScore = getRouteSegmentSpecificity(leftSegment);
-		const rightScore = getRouteSegmentSpecificity(rightSegment);
-		if (leftScore !== rightScore) return rightScore - leftScore;
-	}
-	return left.path.localeCompare(right.path);
-}
-function getRouteSegmentSpecificity(segment) {
-	if (segment.type === "static") return 3;
-	if (segment.type === "param") return 2;
-	return 1;
-}
-//#endregion
-//#region src/forwardRef.ts
-let oldDiffHook = options.__b;
-options.__b = (vnode) => {
-	if (vnode.type && vnode.type.__f && vnode.ref) {
-		vnode.props.ref = vnode.ref;
-		vnode.ref = null;
-	}
-	if (oldDiffHook) oldDiffHook(vnode);
-};
-/**
-* Pass ref down to a child. This is mainly used in libraries with HOCs that
-* wrap components. Using `forwardRef` there is an easy way to get a reference
-* of the wrapped component instead of one of the wrapper itself.
-*/
-function forwardRef(fn) {
-	function Forwarded(props) {
-		const clone = { ...props };
-		delete clone.ref;
-		return fn(clone, props.ref || null);
-	}
-	Forwarded.__f = true;
-	Forwarded.displayName = "ForwardRef(" + (fn.displayName || fn.name) + ")";
-	return Forwarded;
-}
-//#endregion
-//#region src/hydration.ts
-const MODE_HYDRATE = 32;
-let _hydrating = false;
-let _suspensionCount = 0;
-let _hydrated = false;
-const oldCatchError = options.__e;
-options.__e = (err, newVNode, oldVNode, errorInfo) => {
-	if (_hydrating && !_hydrated && err && err.then) {
-		if (!!(newVNode && newVNode.__u && newVNode.__u & MODE_HYDRATE) || !!(newVNode && newVNode.__h)) {
-			_suspensionCount++;
-			let settled = false;
-			const onSettled = () => {
-				if (settled) return;
-				settled = true;
-				_suspensionCount--;
-			};
-			err.then(onSettled, onSettled);
-		}
-	}
-	if (oldCatchError) oldCatchError(err, newVNode, oldVNode, errorInfo);
-};
-const oldCommit = options.__c;
-options.__c = (vnode, commitQueue) => {
-	if (_hydrating && !_hydrated && _suspensionCount <= 0) {
-		_hydrated = true;
-		_hydrating = false;
-	}
-	if (oldCommit) oldCommit(vnode, commitQueue);
-};
-/**
-* Mark the start of a hydration pass. Call this right before `hydrate()`.
-*/
-function markHydrating() {
-	if (!_hydrated) _hydrating = true;
-}
-/**
-* Returns `true` once the initial hydration (including all Suspense
-* boundaries) has fully resolved. During SSR and hydration this returns
-* `false`.
-*/
-function useIsHydrated() {
-	const [hydrated, setHydrated] = useState(_hydrated);
-	useEffect(() => {
-		setHydrated(true);
-	}, []);
-	return hydrated;
-}
-//#endregion
-//#region src/runtime-constants.ts
-const SAFE_METHODS = new Set(["GET", "HEAD"]);
-const HYDRATION_STATE_ELEMENT_ID = "pracht-state";
-const ROUTE_STATE_REQUEST_HEADER = "x-pracht-route-state-request";
-const ROUTE_STATE_CACHE_CONTROL = "no-store";
-const EMPTY_ROUTE_PARAMS = {};
-//#endregion
-//#region src/runtime-errors.ts
-function isPrachtHttpError(error) {
-	return error instanceof Error && error.name === "PrachtHttpError" && "status" in error;
-}
-let warnedAboutProductionDebugErrors = false;
-/**
-* `debugErrors: true` opts into surfacing stack traces, module paths,
-* and middleware names in error responses. That is great in dev and
-* dangerous in production — a misconfigured deploy would leak internals
-* to the public. When `NODE_ENV === "production"` we refuse to honor
-* the flag and emit a single console warning so the misconfiguration
-* is visible in logs.
-*/
-function shouldExposeServerErrors(options) {
-	if (options.debugErrors !== true) return false;
-	if ((typeof process !== "undefined" && process.env ? process.env.NODE_ENV : typeof globalThis !== "undefined" && globalThis.process ? globalThis.process?.env?.NODE_ENV : void 0) === "production") {
-		if (!warnedAboutProductionDebugErrors) {
-			warnedAboutProductionDebugErrors = true;
-			console.warn("[pracht] debugErrors is ignored in production builds. Remove it to silence this warning.");
-		}
-		return false;
-	}
-	return true;
-}
-function createSerializedRouteError(message, status, options = {}) {
-	return {
-		message,
-		name: options.name ?? "Error",
-		status,
-		...options.diagnostics ? { diagnostics: options.diagnostics } : {}
-	};
-}
-function buildRuntimeDiagnostics(options) {
-	const route = options.route;
-	const routeId = route && "id" in route ? route.id : void 0;
-	return {
-		phase: options.phase,
-		routeId,
-		routePath: route?.path,
-		routeFile: route?.file,
-		loaderFile: options.loaderFile,
-		shellFile: options.shellFile,
-		middlewareFiles: options.middlewareFiles ? [...options.middlewareFiles] : [],
-		status: options.status
-	};
-}
-function normalizeRouteError(error, options) {
-	if (isPrachtHttpError(error)) {
-		const status = typeof error.status === "number" ? error.status : 500;
-		if (status >= 400 && status < 500) return {
-			message: error.message,
-			name: error.name,
-			status
-		};
-		if (options.exposeDetails) return {
-			message: error.message || "Internal Server Error",
-			name: error.name || "Error",
-			status
-		};
-		return {
-			message: "Internal Server Error",
-			name: "Error",
-			status
-		};
-	}
-	if (error instanceof Error) {
-		if (options.exposeDetails) return {
-			message: error.message || "Internal Server Error",
-			name: error.name || "Error",
-			status: 500
-		};
-		return {
-			message: "Internal Server Error",
-			name: "Error",
-			status: 500
-		};
-	}
-	if (options.exposeDetails) return {
-		message: typeof error === "string" && error ? error : "Internal Server Error",
-		name: "Error",
-		status: 500
-	};
-	return {
-		message: "Internal Server Error",
-		name: "Error",
-		status: 500
-	};
-}
-function deserializeRouteError(error) {
-	const result = new Error(error.message);
-	result.name = error.name;
-	result.status = error.status;
-	result.diagnostics = error.diagnostics;
-	return result;
-}
-//#endregion
-//#region src/runtime-headers.ts
-const HEADER_CRLF_RE = /[\r\n]/;
-/**
-* Reject header values containing CR/LF. Some runtimes (Node `undici`
-* Headers) throw on their own, but Web-runtime fetch implementations
-* vary, and a user-supplied `headers()` value is never trusted input.
-* Keeping the check here means response-splitting can't slip through on
-* any adapter.
-*/
-function assertSafeHeaderValue(name, value) {
-	if (HEADER_CRLF_RE.test(value)) throw new Error(`Refused to set header "${name}": value contains CR or LF`);
-}
-function applyHeaders(headers, init) {
-	for (const [key, value] of iterateHeaderInit(init)) assertSafeHeaderValue(key, value);
-	new Headers(init).forEach((value, key) => {
-		headers.set(key, value);
-	});
-}
-function* iterateHeaderInit(init) {
-	if (init instanceof Headers) {
-		for (const entry of init.entries()) yield entry;
-		return;
-	}
-	if (Array.isArray(init)) {
-		for (const entry of init) if (entry && entry.length >= 2) yield [entry[0], entry[1]];
-		return;
-	}
-	for (const [key, value] of Object.entries(init)) yield [key, value];
-}
-function applyDefaultSecurityHeaders(headers) {
-	if (!headers.has("permissions-policy")) headers.set("permissions-policy", "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()");
-	if (!headers.has("referrer-policy")) headers.set("referrer-policy", "strict-origin-when-cross-origin");
-	if (!headers.has("x-content-type-options")) headers.set("x-content-type-options", "nosniff");
-	if (!headers.has("x-frame-options")) headers.set("x-frame-options", "SAMEORIGIN");
-	return headers;
-}
-function applySecurityAndRouteHeaders(headers, options) {
-	applyDefaultSecurityHeaders(headers);
-	if (options) {
-		appendVaryHeader(headers, ROUTE_STATE_REQUEST_HEADER);
-		if (options.isRouteStateRequest && !headers.has("cache-control")) headers.set("cache-control", ROUTE_STATE_CACHE_CONTROL);
-	}
-	return headers;
-}
-function withDefaultSecurityHeaders(response) {
-	const headers = new Headers(response.headers);
-	applySecurityAndRouteHeaders(headers);
-	return new Response(response.body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers
-	});
-}
-function withRouteResponseHeaders(response, options) {
-	const headers = new Headers(response.headers);
-	applySecurityAndRouteHeaders(headers, options);
-	return new Response(response.body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers
-	});
-}
-function appendVaryHeader(headers, value) {
-	const current = headers.get("vary");
-	if (!current) {
-		headers.set("vary", value);
-		return;
-	}
-	const values = current.split(",").map((part) => part.trim().toLowerCase()).filter(Boolean);
-	if (values.includes("*") || values.includes(value.toLowerCase())) return;
-	headers.set("vary", `${current}, ${value}`);
-}
-//#endregion
-//#region src/runtime-client-fetch.ts
-const SAFE_NAVIGATION_PROTOCOLS = new Set(["http:", "https:"]);
-/**
-* Parse a possibly-server-supplied redirect target against a base URL and
-* return it only if it uses a safe navigation scheme (`http:` or `https:`).
-*
-* `javascript:`, `data:`, `vbscript:`, `blob:`, `file:` and similar schemes
-* can execute script or bypass same-origin assumptions when assigned to
-* `window.location.href` — a server-controlled redirect (from a loader,
-* middleware, form action response, or API route) must never be able to
-* trigger them. Returns `null` for unsafe or unparseable inputs.
-*/
-function parseSafeNavigationUrl(location, base) {
-	let targetUrl;
-	try {
-		targetUrl = new URL(location, base);
-	} catch {
-		return null;
-	}
-	if (!SAFE_NAVIGATION_PROTOCOLS.has(targetUrl.protocol)) return null;
-	return targetUrl;
-}
-function routeNeedsServerFetch(route) {
-	if (route.hasLoader === false && route.middlewareFiles.length === 0) return false;
-	return true;
-}
-function buildRouteStateUrl(url) {
-	return `${url}${url.includes("?") ? "&" : "?"}_data=1`;
-}
-async function fetchPrachtRouteState(url, options) {
-	const fetchUrl = options?.useDataParam ? buildRouteStateUrl(url) : url;
-	const response = await fetch(fetchUrl, {
-		headers: options?.useDataParam ? {} : {
-			[ROUTE_STATE_REQUEST_HEADER]: "1",
-			"Cache-Control": "no-cache"
-		},
-		redirect: "manual",
-		signal: options?.signal
-	});
-	if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) return {
-		location: response.headers.get("location") ?? url,
-		type: "redirect"
-	};
-	const json = await response.json();
-	if (json.redirect) return {
-		location: json.redirect,
-		type: "redirect"
-	};
-	if (!response.ok) {
-		if (json.error) return {
-			error: json.error,
-			type: "error"
-		};
-		throw new Error(`Failed to fetch route state (${response.status})`);
-	}
-	return {
-		data: json.data,
-		type: "data"
-	};
-}
-async function navigateToClientLocation(location, options) {
-	if (typeof window === "undefined") return;
-	const targetUrl = parseSafeNavigationUrl(location, window.location.href);
-	if (!targetUrl) {
-		console.error(`[pracht] refused to navigate to unsafe URL: ${location}`);
-		return;
-	}
-	const target = targetUrl.pathname + targetUrl.search + targetUrl.hash;
-	if (targetUrl.origin === window.location.origin && window.__PRACHT_NAVIGATE__) {
-		await window.__PRACHT_NAVIGATE__(target, options);
-		return;
-	}
-	if (options?.replace) {
-		window.location.replace(targetUrl.toString());
-		return;
-	}
-	window.location.href = targetUrl.toString();
-}
-//#endregion
-//#region src/prefetch.ts
-const CACHE_TTL_MS = 3e4;
-const MAX_PREFETCH_CACHE_ENTRIES = 100;
-const MAX_MATCH_CACHE_ENTRIES = 250;
-const EMPTY_ROUTE_STATE_PROMISE = Promise.resolve({
-	type: "data",
-	data: void 0
-});
-const prefetchCache = /* @__PURE__ */ new Map();
-function clearPrefetchCache() {
-	prefetchCache.clear();
-}
-function getCachedRouteState(url) {
-	const entry = prefetchCache.get(url);
-	if (!entry) return null;
-	if (Date.now() - entry.timestamp > CACHE_TTL_MS) {
-		prefetchCache.delete(url);
-		return null;
-	}
-	prefetchCache.delete(url);
-	prefetchCache.set(url, entry);
-	return entry.promise;
-}
-function prefetchRouteState(url, route) {
-	if (route && !routeNeedsServerFetch(route)) return EMPTY_ROUTE_STATE_PROMISE;
-	const cached = getCachedRouteState(url);
-	if (cached) return cached;
-	sweepPrefetchCache();
-	const promise = fetchPrachtRouteState(url);
-	prefetchCache.set(url, {
-		promise,
-		timestamp: Date.now()
-	});
-	trimMapToSize(prefetchCache, MAX_PREFETCH_CACHE_ENTRIES);
-	return promise;
-}
-function setupPrefetching(app, warmModules) {
-	let hoverTimer = null;
-	const observedViewportAnchors = /* @__PURE__ */ new WeakSet();
-	const matchCache = /* @__PURE__ */ new Map();
-	function getRoutePathname(url) {
-		try {
-			return new URL(url, window.location.origin).pathname;
-		} catch {
-			return null;
-		}
-	}
-	function getInternalHref(anchor) {
-		const href = anchor.getAttribute("href");
-		if (!href || href.startsWith("#")) return null;
-		let url;
-		try {
-			url = new URL(href, window.location.origin);
-		} catch {
-			return null;
-		}
-		if (url.origin !== window.location.origin) return null;
-		return url.pathname + url.search;
-	}
-	function getMatchEntry(href) {
-		const cached = matchCache.get(href);
-		if (cached) {
-			matchCache.delete(href);
-			matchCache.set(href, cached);
-			return cached;
-		}
-		const routePathname = getRoutePathname(href);
-		const match = routePathname ? matchAppRoute(app, routePathname) ?? null : null;
-		const entry = {
-			match,
-			strategy: match ? match.route.prefetch ?? "intent" : "none"
-		};
-		matchCache.set(href, entry);
-		trimMapToSize(matchCache, MAX_MATCH_CACHE_ENTRIES);
-		return entry;
-	}
-	function prefetchHref(href) {
-		const match = getMatchEntry(href).match;
-		prefetchRouteState(href, match?.route);
-		if (warmModules && match) warmModules(match);
-	}
-	document.addEventListener("mouseenter", (e) => {
-		const anchor = e.target.closest?.("a");
-		if (!anchor) return;
-		const href = getInternalHref(anchor);
-		if (!href) return;
-		const strategy = getMatchEntry(href).strategy;
-		if (strategy !== "hover" && strategy !== "intent") return;
-		if (hoverTimer) clearTimeout(hoverTimer);
-		hoverTimer = setTimeout(() => {
-			prefetchHref(href);
-		}, 50);
-	}, true);
-	document.addEventListener("mouseleave", (e) => {
-		if (!e.target.closest?.("a")) return;
-		if (hoverTimer) {
-			clearTimeout(hoverTimer);
-			hoverTimer = null;
-		}
-	}, true);
-	document.addEventListener("focusin", (e) => {
-		const anchor = e.target.closest?.("a");
-		if (!anchor) return;
-		const href = getInternalHref(anchor);
-		if (!href) return;
-		const strategy = getMatchEntry(href).strategy;
-		if (strategy !== "hover" && strategy !== "intent") return;
-		prefetchHref(href);
-	}, true);
-	if (typeof IntersectionObserver === "undefined") return;
-	const observer = new IntersectionObserver((entries) => {
-		for (const entry of entries) {
-			if (!entry.isIntersecting) continue;
-			const anchor = entry.target;
-			const href = getInternalHref(anchor);
-			if (!href) continue;
-			prefetchHref(href);
-			observer.unobserve(anchor);
-		}
-	}, { rootMargin: "200px" });
-	function observeAnchor(anchor) {
-		if (observedViewportAnchors.has(anchor)) return;
-		const href = getInternalHref(anchor);
-		if (!href) return;
-		if (getMatchEntry(href).strategy !== "viewport") return;
-		observedViewportAnchors.add(anchor);
-		observer.observe(anchor);
-	}
-	function observeViewportLinks(root) {
-		if (root instanceof HTMLAnchorElement) observeAnchor(root);
-		for (const anchor of root.querySelectorAll("a[href]")) observeAnchor(anchor);
-	}
-	observeViewportLinks(document.body);
-	new MutationObserver((records) => {
-		for (const record of records) for (const node of record.addedNodes) if (node instanceof HTMLElement || node instanceof DocumentFragment) observeViewportLinks(node);
-	}).observe(document.body, {
-		childList: true,
-		subtree: true
-	});
-}
-function sweepPrefetchCache(now = Date.now()) {
-	for (const [url, entry] of prefetchCache) if (now - entry.timestamp > CACHE_TTL_MS) prefetchCache.delete(url);
-}
-function trimMapToSize(map, maxEntries) {
-	while (map.size > maxEntries) {
-		const first = map.keys().next();
-		if (first.done) return;
-		map.delete(first.value);
-	}
-}
-//#endregion
-//#region src/runtime-hooks.ts
-const RouteDataContext = createContext(void 0);
-function PrachtRuntimeProvider({ children, data, params = EMPTY_ROUTE_PARAMS, routeId, routes, stateVersion = 0, url }) {
-	registerRuntimeRoutes(routes);
-	const [routeDataState, setRouteDataState] = useState({
-		data,
-		stateVersion
-	});
-	const routeData = routeDataState.stateVersion === stateVersion ? routeDataState.data : data;
-	useEffect(() => {
-		setRouteDataState({
-			data,
-			stateVersion
-		});
-	}, [
-		data,
-		routeId,
-		stateVersion,
-		url
-	]);
-	const context = useMemo(() => ({
-		data: routeData,
-		params,
-		routeId,
-		routes,
-		setData: (nextData) => setRouteDataState({
-			data: nextData,
-			stateVersion
-		}),
-		url
-	}), [
-		routeData,
-		params,
-		routeId,
-		routes,
-		stateVersion,
-		url
-	]);
-	return h(RouteDataContext.Provider, {
-		value: context,
-		children
-	});
-}
-function startApp(options = {}) {
-	if (typeof window === "undefined") return options.initialData;
-	if (typeof options.initialData !== "undefined") return options.initialData;
-	return readHydrationState()?.data;
-}
-function readHydrationState() {
-	if (typeof window === "undefined") return;
-	if (window.__PRACHT_STATE__) return window.__PRACHT_STATE__;
-	const element = document.getElementById(HYDRATION_STATE_ELEMENT_ID);
-	if (!(element instanceof HTMLScriptElement)) return;
-	const raw = element.textContent;
-	if (!raw) return;
-	const state = JSON.parse(raw);
-	window.__PRACHT_STATE__ = state;
-	return state;
-}
-function useRouteData() {
-	return useContext(RouteDataContext)?.data;
-}
-function useLocation() {
-	return parseLocation(useContext(RouteDataContext)?.url ?? (typeof window !== "undefined" ? window.location.pathname + window.location.search : "/"));
-}
-function useParams() {
-	return useContext(RouteDataContext)?.params ?? {};
-}
-function useRevalidate() {
-	const runtime = useContext(RouteDataContext);
-	return async () => {
-		if (typeof window === "undefined") return;
-		const result = await fetchPrachtRouteState(runtime?.url || window.location.pathname + window.location.search);
-		if (result.type === "redirect") {
-			await navigateToClientLocation(result.location);
-			return;
-		}
-		if (result.type === "error") throw deserializeRouteError(result.error);
-		runtime?.setData(result.data);
-		return result.data;
-	};
-}
-function Link(props) {
-	const routes = useContext(RouteDataContext)?.routes ?? globalThis.__PRACHT_ROUTE_DEFINITIONS__;
-	if (!routes) throw new Error("<Link route=...> must render inside a pracht route tree.");
-	const { route, params, search, hash, ...anchorProps } = props;
-	return h("a", {
-		...anchorProps,
-		href: buildHref(routes, route, {
-			params,
-			search,
-			hash
-		})
-	});
-}
-function registerRuntimeRoutes(routes) {
-	if (!routes) return;
-	globalThis.__PRACHT_ROUTE_DEFINITIONS__ = routes;
-}
-function Form(props) {
-	const { onSubmit, method, ...rest } = props;
-	return h("form", {
-		...rest,
-		method,
-		onSubmit: async (event) => {
-			onSubmit?.(event);
-			if (event.defaultPrevented) return;
-			const form = event.currentTarget;
-			if (!(form instanceof HTMLFormElement)) return;
-			const formMethod = (method ?? form.method ?? "post").toUpperCase();
-			if (SAFE_METHODS.has(formMethod)) return;
-			event.preventDefault();
-			clearPrefetchCache();
-			const response = await fetch(props.action ?? form.action, {
-				method: formMethod,
-				body: new FormData(form),
-				redirect: "manual"
-			});
-			if (response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) {
-				const location = response.headers.get("location");
-				if (location) {
-					await navigateToClientLocation(location);
-					return;
-				}
-				window.location.href = props.action ?? form.action;
-			}
-		}
-	});
-}
-function parseLocation(value) {
-	const url = new URL(value, "http://pracht.local");
-	return {
-		pathname: url.pathname,
-		search: url.search
-	};
-}
-//#endregion
-//#region src/runtime-html.ts
-function escapeHtml(str) {
-	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-function serializeJsonForHtml(value) {
-	return escapeScriptText(JSON.stringify(value) ?? "null");
-}
-function escapeScriptText(value) {
-	return value.replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
-}
-const SAFE_ATTRIBUTE_NAME_RE = /^[A-Za-z_:][A-Za-z0-9:._-]*$/;
-const GLOBAL_HEAD_ATTRIBUTE_PREFIXES = ["data-", "aria-"];
-const META_ATTRIBUTES = new Set([
-	"charset",
-	"content",
-	"http-equiv",
-	"itemprop",
-	"media",
-	"name",
-	"property"
-]);
-const LINK_ATTRIBUTES = new Set([
-	"as",
-	"blocking",
-	"color",
-	"crossorigin",
-	"disabled",
-	"fetchpriority",
-	"href",
-	"hreflang",
-	"imagesizes",
-	"imagesrcset",
-	"integrity",
-	"media",
-	"referrerpolicy",
-	"rel",
-	"sizes",
-	"title",
-	"type"
-]);
-const SCRIPT_ATTRIBUTES = new Set([
-	"async",
-	"blocking",
-	"class",
-	"crossorigin",
-	"defer",
-	"fetchpriority",
-	"id",
-	"integrity",
-	"nomodule",
-	"nonce",
-	"referrerpolicy",
-	"src",
-	"type"
-]);
-function renderAttributes(attributes, allowedAttributes) {
-	return Object.entries(attributes).filter(([key, value]) => isAllowedHeadAttribute(key, value, allowedAttributes)).map(([key, value]) => `${key}="${escapeHtml(value ?? "")}"`).join(" ");
-}
-function isAllowedHeadAttribute(key, value, allowedAttributes) {
-	if (key === "children" || typeof value === "undefined" || !SAFE_ATTRIBUTE_NAME_RE.test(key)) return false;
-	const normalized = key.toLowerCase();
-	if (normalized.startsWith("on")) return false;
-	return allowedAttributes.has(normalized) || GLOBAL_HEAD_ATTRIBUTE_PREFIXES.some((prefix) => normalized.startsWith(prefix));
-}
-function buildHtmlDocument(options) {
-	const { head, body, hydrationState, clientEntryUrl, cssUrls = [], modulePreloadUrls = [], routeStatePreloadUrl } = options;
-	const titleTag = head.title ? `<title>${escapeHtml(head.title)}</title>` : "";
-	const metaTags = (head.meta ?? []).map((m) => renderAttributes(m, META_ATTRIBUTES)).filter(Boolean).map((attrs) => `<meta ${attrs}>`).join("\n    ");
-	const linkTags = (head.link ?? []).map((l) => renderAttributes(l, LINK_ATTRIBUTES)).filter(Boolean).map((attrs) => `<link ${attrs}>`).join("\n    ");
-	const scriptTags = (head.script ?? []).map((script) => {
-		const attrs = renderAttributes(script, SCRIPT_ATTRIBUTES);
-		const children = script.children ? escapeScriptText(script.children) : "";
-		return attrs ? `<script ${attrs}>${children}<\/script>` : `<script>${children}<\/script>`;
-	}).join("\n    ");
-	const cssTags = cssUrls.map((url) => `<link rel="stylesheet" href="${escapeHtml(url)}">`).join("\n    ");
-	const modulePreloadTags = modulePreloadUrls.map((url) => `<link rel="modulepreload" href="${escapeHtml(url)}">`).join("\n    ");
-	const routeStatePreloadTag = routeStatePreloadUrl ? `<link rel="preload" as="fetch" href="${escapeHtml(routeStatePreloadUrl)}" crossorigin="anonymous">` : "";
-	const stateScript = `<script id="${HYDRATION_STATE_ELEMENT_ID}" type="application/json">${serializeJsonForHtml(hydrationState)}<\/script>`;
-	const entryScript = clientEntryUrl ? `<script type="module" src="${escapeHtml(clientEntryUrl)}"><\/script>` : "";
-	return `<!DOCTYPE html>
-<html${head.lang ? ` lang="${escapeHtml(head.lang)}"` : ""}>
-  <head>
-    <meta charset="utf-8">
-    ${titleTag}
-    ${metaTags}
-    ${linkTags}
-    ${scriptTags}
-    ${cssTags}
-    ${modulePreloadTags}
-    ${routeStatePreloadTag}
-  </head>
-  <body>
-    <div id="pracht-root">${body}</div>
-    ${stateScript}
-    ${entryScript}
-  </body>
-</html>`;
-}
-function htmlResponse(html, status = 200, initHeaders) {
-	const headers = new Headers({ "content-type": "text/html; charset=utf-8" });
-	if (initHeaders) applyHeaders(headers, initHeaders);
-	applySecurityAndRouteHeaders(headers, { isRouteStateRequest: false });
-	return new Response(html, {
-		status,
-		headers
-	});
-}
-//#endregion
-//#region src/runtime-manifest.ts
-/** Strip leading `./` and `/` so all module paths share one canonical form. */
-function normalizeModulePath(path) {
-	return path.replace(/^\.?\//, "");
-}
-function buildSuffixIndex(manifest) {
-	const index = /* @__PURE__ */ new Map();
-	for (const key of Object.keys(manifest)) {
-		const normalized = normalizeModulePath(key);
-		if (!normalized) continue;
-		if (!index.has(normalized)) index.set(normalized, key);
-		for (let i = normalized.indexOf("/"); i !== -1; i = normalized.indexOf("/", i + 1)) {
-			const suffix = normalized.slice(i + 1);
-			if (suffix && !index.has(suffix)) index.set(suffix, key);
-		}
-	}
-	return index;
-}
-const suffixIndexCache = /* @__PURE__ */ new WeakMap();
-function getSuffixIndex(manifest) {
-	let index = suffixIndexCache.get(manifest);
-	if (index) return index;
-	index = buildSuffixIndex(manifest);
-	suffixIndexCache.set(manifest, index);
-	return index;
-}
-function resolveManifestEntries(manifest, file) {
-	if (file in manifest) return manifest[file];
-	const resolved = getSuffixIndex(manifest).get(normalizeModulePath(file));
-	if (resolved) return manifest[resolved];
-}
-function resolvePageUrlsFromManifest(manifest, shellFile, routeFile) {
-	const urls = /* @__PURE__ */ new Set();
-	const add = (file) => {
-		const entries = resolveManifestEntries(manifest, file);
-		if (entries) for (const url of entries) urls.add(url);
-	};
-	if (shellFile) add(shellFile);
-	add(routeFile);
-	return [...urls];
-}
-function resolvePageCssUrls(cssManifest, shellFile, routeFile) {
-	if (!cssManifest) return [];
-	return resolvePageUrlsFromManifest(cssManifest, shellFile, routeFile);
-}
-function resolvePageJsUrls(jsManifest, shellFile, routeFile) {
-	if (!jsManifest) return [];
-	return resolvePageUrlsFromManifest(jsManifest, shellFile, routeFile);
-}
-async function resolveRegistryModule(modules, file) {
-	if (!modules) return void 0;
-	if (file in modules) return modules[file]();
-	const resolved = getSuffixIndex(modules).get(normalizeModulePath(file));
-	if (resolved) return modules[resolved]();
-}
-async function resolveDataFunctions(route, routeModule, registry) {
-	let loader = routeModule?.loader;
-	let loaderFile = routeModule?.loader ? route.file : void 0;
-	if (route.loaderFile) {
-		const dataModule = await resolveRegistryModule(registry.dataModules, route.loaderFile);
-		if (dataModule?.loader) {
-			loader = dataModule.loader;
-			loaderFile = route.loaderFile;
-		}
-	}
-	return {
-		loader,
-		loaderFile
-	};
-}
-//#endregion
-//#region src/runtime-middleware.ts
-const DEFAULT_REDIRECT_STATUS_SAFE = 302;
-const DEFAULT_REDIRECT_STATUS_UNSAFE = 303;
-/**
-* Build a safe redirect response from middleware/loader output. Rejects
-* non-http(s) schemes (no `javascript:`/`data:`/etc.) and CR/LF injection
-* against the `Location` header. When status is omitted, non-GET/HEAD
-* requests default to 303 so the browser does not resend the body to the
-* redirect target; safe methods default to 302.
-*
-* The original `target` string is preserved on success (relative paths
-* stay relative) — we only parse it to validate scheme, not to rewrite
-* it. Both the original input and its resolved URL must be CR/LF-free.
-*/
-function buildRedirectResponse(target, options) {
-	if (/[\r\n]/.test(target)) throw new Error("Refused redirect target containing CR/LF");
-	if (!parseSafeNavigationUrl(target, options.baseUrl)) throw new Error("Refused unsafe redirect target");
-	const method = (options.method ?? "GET").toUpperCase();
-	const defaultStatus = SAFE_METHODS.has(method) ? DEFAULT_REDIRECT_STATUS_SAFE : DEFAULT_REDIRECT_STATUS_UNSAFE;
-	const status = options.status ?? defaultStatus;
-	return new Response(null, {
-		status,
-		headers: { location: target }
-	});
-}
-async function runMiddlewareChain(options) {
-	let context = options.context;
-	const modulePromises = options.middlewareFiles.map((mwFile) => resolveRegistryModule(options.registry.middlewareModules, mwFile));
-	for (const p of modulePromises) p.catch(() => {});
-	for (const modulePromise of modulePromises) {
-		const mwModule = await modulePromise;
-		if (!mwModule?.middleware) continue;
-		const result = await mwModule.middleware({
-			request: options.request,
-			params: options.params,
-			context,
-			signal: AbortSignal.timeout(3e4),
-			url: options.url,
-			route: options.route
-		});
-		if (!result) continue;
-		if (result instanceof Response) return { response: withDefaultSecurityHeaders(result) };
-		if ("redirect" in result) {
-			const status = "status" in result ? result.status : void 0;
-			return { response: withDefaultSecurityHeaders(buildRedirectResponse(result.redirect, {
-				baseUrl: options.request.url,
-				method: options.request.method,
-				status
-			})) };
-		}
-		if ("context" in result) context = {
-			...context,
-			...result.context
-		};
-	}
-	return { context };
-}
-async function mergeHeadMetadata(shellModule, routeModule, routeArgs, data) {
-	const [shellHead, routeHead] = await Promise.all([shellModule?.head ? shellModule.head(routeArgs) : Promise.resolve({}), routeModule?.head ? routeModule.head({
-		...routeArgs,
-		data
-	}) : Promise.resolve({})]);
-	return {
-		title: routeHead.title ?? shellHead.title,
-		lang: routeHead.lang ?? shellHead.lang,
-		meta: [...shellHead.meta ?? [], ...routeHead.meta ?? []],
-		link: [...shellHead.link ?? [], ...routeHead.link ?? []],
-		script: [...shellHead.script ?? [], ...routeHead.script ?? []]
-	};
-}
-async function mergeDocumentHeaders(shellModule, routeModule, routeArgs, data) {
-	const headers = new Headers();
-	const [shellHeaders, routeHeaders] = await Promise.all([shellModule?.headers ? shellModule.headers(routeArgs) : Promise.resolve(void 0), routeModule?.headers ? routeModule.headers({
-		...routeArgs,
-		data
-	}) : Promise.resolve(void 0)]);
-	if (shellHeaders) applyHeaders(headers, shellHeaders);
-	if (routeHeaders) applyHeaders(headers, routeHeaders);
-	return headers;
-}
-//#endregion
-//#region src/runtime-response.ts
-let _renderToStringAsync;
-async function getRenderToStringAsync() {
-	if (_renderToStringAsync) return _renderToStringAsync;
-	_renderToStringAsync = (await import("preact-render-to-string")).renderToStringAsync;
-	return _renderToStringAsync;
-}
-function jsonErrorResponse(routeError, options) {
-	const headers = applySecurityAndRouteHeaders(new Headers({ "content-type": "application/json; charset=utf-8" }), options.isRouteStateRequest ? { isRouteStateRequest: true } : void 0);
-	return new Response(JSON.stringify({ error: routeError }), {
-		status: routeError.status,
-		headers
-	});
-}
-function jsonRedirectResponse(location, options) {
-	const headers = new Headers(options.headers);
-	headers.set("content-type", "application/json; charset=utf-8");
-	return withRouteResponseHeaders(new Response(JSON.stringify({ redirect: location }), {
-		status: 200,
-		headers
-	}), { isRouteStateRequest: options.isRouteStateRequest });
-}
-function normalizePageResponse(response, options) {
-	if (options.isRouteStateRequest && response.status >= 300 && response.status < 400) {
-		const location = response.headers.get("location");
-		if (location) return jsonRedirectResponse(location, {
-			headers: response.headers,
-			isRouteStateRequest: true
-		});
-	}
-	return withRouteResponseHeaders(response, options);
-}
-function renderApiErrorResponse(options) {
-	const exposeDetails = shouldExposeServerErrors(options.options);
-	const routeError = normalizeRouteError(options.error, { exposeDetails });
-	const routeErrorWithDiagnostics = exposeDetails ? {
-		...routeError,
-		diagnostics: buildRuntimeDiagnostics({
-			middlewareFiles: options.middlewareFiles,
-			phase: options.phase,
-			route: options.route,
-			status: routeError.status
-		})
-	} : routeError;
-	if (exposeDetails) return jsonErrorResponse(routeErrorWithDiagnostics, { isRouteStateRequest: false });
-	const message = routeErrorWithDiagnostics.status >= 500 ? "Internal Server Error" : routeErrorWithDiagnostics.message;
-	return withDefaultSecurityHeaders(new Response(message, {
-		status: routeErrorWithDiagnostics.status,
-		headers: { "content-type": "text/plain; charset=utf-8" }
-	}));
-}
-async function renderRouteErrorResponse(options) {
-	const exposeDetails = shouldExposeServerErrors(options.options);
-	const routeError = normalizeRouteError(options.error, { exposeDetails });
-	const routeErrorWithDiagnostics = exposeDetails ? {
-		...routeError,
-		diagnostics: buildRuntimeDiagnostics({
-			loaderFile: options.loaderFile,
-			middlewareFiles: options.routeArgs.route.middlewareFiles,
-			phase: options.phase,
-			route: options.routeArgs.route,
-			shellFile: options.shellFile,
-			status: routeError.status
-		})
-	} : routeError;
-	if (options.isRouteStateRequest) return jsonErrorResponse(routeErrorWithDiagnostics, { isRouteStateRequest: true });
-	const shellModule = options.shellModule ?? (options.shellFile ? await resolveRegistryModule(options.options.registry?.shellModules, options.shellFile) : void 0);
-	const ErrorBoundary = options.routeModule?.ErrorBoundary ?? shellModule?.ErrorBoundary;
-	if (!ErrorBoundary) {
-		const message = routeErrorWithDiagnostics.status >= 500 && !exposeDetails ? "Internal Server Error" : routeErrorWithDiagnostics.message;
-		const diagnostics = exposeDetails && routeErrorWithDiagnostics.diagnostics ? `\n\n${JSON.stringify(routeErrorWithDiagnostics.diagnostics, null, 2)}` : "";
-		return withDefaultSecurityHeaders(new Response(`${message}${diagnostics}`, {
-			status: routeErrorWithDiagnostics.status,
-			headers: { "content-type": "text/plain; charset=utf-8" }
-		}));
-	}
-	const head = shellModule?.head ? await shellModule.head(options.routeArgs) : {};
-	const documentHeaders = await mergeDocumentHeaders(shellModule, void 0, options.routeArgs, void 0);
-	const cssUrls = resolvePageCssUrls(options.options.cssManifest, options.shellFile, options.routeArgs.route.file);
-	const modulePreloadUrls = resolvePageJsUrls(options.options.jsManifest, options.shellFile, options.routeArgs.route.file);
-	const renderToString = await getRenderToStringAsync();
-	const Boundary = ErrorBoundary;
-	const Shell = shellModule?.Shell;
-	const errorValue = deserializeRouteError(routeErrorWithDiagnostics);
-	const componentTree = Shell ? h(Shell, null, h(Boundary, { error: errorValue })) : h(Boundary, { error: errorValue });
-	return htmlResponse(buildHtmlDocument({
-		head,
-		body: await renderToString(h(PrachtRuntimeProvider, {
-			data: null,
-			routeId: options.routeId,
-			routes: options.routes,
-			url: options.requestPath
-		}, componentTree)),
-		hydrationState: {
-			url: options.requestPath,
-			routeId: options.routeId,
-			data: null,
-			error: routeErrorWithDiagnostics
-		},
-		clientEntryUrl: options.options.clientEntryUrl,
-		cssUrls,
-		modulePreloadUrls
-	}), routeErrorWithDiagnostics.status, documentHeaders);
-}
-//#endregion
-//#region src/runtime-negotiation.ts
-const MARKDOWN_MEDIA_TYPE = "text/markdown";
-function parseAccept(header) {
-	if (!header) return [];
-	const entries = [];
-	for (const raw of header.split(",")) {
-		const parts = raw.trim().split(";");
-		const type = parts.shift()?.trim().toLowerCase();
-		if (!type) continue;
-		let quality = 1;
-		for (const param of parts) {
-			const [key, value] = param.split("=").map((p) => p.trim());
-			if (key === "q" && value != null) {
-				const parsed = Number.parseFloat(value);
-				if (!Number.isNaN(parsed)) quality = parsed;
-			}
-		}
-		entries.push({
-			type,
-			quality
-		});
-	}
-	return entries;
-}
-function prefersMarkdown(accept) {
-	const entries = parseAccept(accept);
-	if (!entries.length) return false;
-	const md = entries.find((e) => e.type === MARKDOWN_MEDIA_TYPE);
-	if (!md || md.quality === 0) return false;
-	const html = entries.find((e) => e.type === "text/html");
-	if (!html) return true;
-	return md.quality >= html.quality;
-}
-function markdownResponse(source) {
-	const headers = new Headers({
-		"content-type": "text/markdown; charset=utf-8",
-		"cache-control": "public, max-age=0, must-revalidate"
-	});
-	appendVaryHeader(headers, "Accept");
-	applyDefaultSecurityHeaders(headers);
-	return new Response(source, {
-		status: 200,
-		headers
-	});
-}
-//#endregion
-//#region src/runtime.ts
-const SAME_ORIGIN_FETCH_SITE = "same-origin";
-/**
-* Stricter variant of first-party detection used for CSRF protection on
-* state-changing API requests. It rejects any browser signal that points
-* outside this exact origin — a cross-origin form POST will send `Origin`
-* from the attacker, and `Sec-Fetch-Site: same-site` is not enough because
-* sibling subdomains can be attacker-controlled. Requests with no browser
-* provenance headers are treated as non-browser callers.
-*/
-function isSameOriginMutation(request, url) {
-	const site = request.headers.get("sec-fetch-site");
-	if (site && site !== SAME_ORIGIN_FETCH_SITE) return false;
-	const origin = request.headers.get("origin");
-	if (origin) try {
-		return new URL(origin).origin === url.origin;
-	} catch {
-		return false;
-	}
-	if (site === SAME_ORIGIN_FETCH_SITE) return true;
-	const referer = request.headers.get("referer");
-	if (referer) try {
-		return new URL(referer).origin === url.origin;
-	} catch {
-		return false;
-	}
-	return true;
-}
-/**
-* Heuristic "this request came from our own page" check. Used to gate
-* the `_data=1` query-param form of the route-state endpoint, which is
-* otherwise reachable via any cross-origin `<a href>` / redirect.
-*
-* Accepts a request as first-party when:
-*   - Sec-Fetch-Site is `same-origin` (modern browsers),
-*   - OR Sec-Fetch-Site is absent AND the Origin header matches the
-*     request URL's origin (older clients that still send Origin),
-*   - OR Sec-Fetch-Site/Origin are absent AND Referer matches the request
-*     URL's origin,
-*   - OR no Origin/Sec-Fetch-Site/Referer is present (non-browser clients like
-*     curl — CSRF is not the threat model there; blocking would break
-*     tests and CLIs).
-*/
-function isFirstPartyFetch(request) {
-	const site = request.headers.get("sec-fetch-site");
-	if (site && site !== SAME_ORIGIN_FETCH_SITE) return false;
-	const origin = request.headers.get("origin");
-	if (origin) try {
-		return new URL(origin).origin === new URL(request.url).origin;
-	} catch {
-		return false;
-	}
-	if (site === SAME_ORIGIN_FETCH_SITE) return true;
-	const referer = request.headers.get("referer");
-	if (referer) try {
-		return new URL(referer).origin === new URL(request.url).origin;
-	} catch {
-		return false;
-	}
-	return true;
-}
-async function handlePrachtRequest(options) {
-	const url = new URL(options.request.url);
-	const hasDataParam = url.searchParams.get("_data") === "1";
-	if (hasDataParam) url.searchParams.delete("_data");
-	const requestPath = getRequestPath(url);
-	const registry = options.registry ?? {};
-	const resolvedApp = getResolvedApp(options.app);
-	const headerSignalsRouteState = options.request.headers.get(ROUTE_STATE_REQUEST_HEADER) === "1";
-	const dataParamIsFirstParty = hasDataParam && isFirstPartyFetch(options.request);
-	const isRouteStateRequest = headerSignalsRouteState || dataParamIsFirstParty;
-	const exposeDiagnostics = shouldExposeServerErrors(options);
-	if (options.apiRoutes?.length) {
-		const apiMatch = matchApiRoute(options.apiRoutes, url.pathname);
-		if (apiMatch) {
-			const apiMiddlewareFiles = (options.app.api.middleware ?? []).flatMap((name) => {
-				const middlewareFile = options.app.middleware[name];
-				return middlewareFile ? [middlewareFile] : [];
-			});
-			let currentPhase = "middleware";
-			if ((options.app.api.requireSameOrigin ?? true) && !SAFE_METHODS.has(options.request.method) && !isSameOriginMutation(options.request, url)) return withDefaultSecurityHeaders(new Response("Cross-origin request blocked", {
-				status: 403,
-				headers: { "content-type": "text/plain; charset=utf-8" }
-			}));
-			try {
-				const middlewareResult = await runMiddlewareChain({
-					context: options.context ?? {},
-					middlewareFiles: apiMiddlewareFiles,
-					params: apiMatch.params,
-					registry,
-					request: options.request,
-					route: apiMatch.route,
-					url
-				});
-				if (middlewareResult.response) return middlewareResult.response;
-				currentPhase = "api";
-				const apiModule = await resolveRegistryModule(registry.apiModules, apiMatch.route.file);
-				if (!apiModule) throw new Error("API route module not found");
-				const handler = apiModule[options.request.method.toUpperCase()] ?? apiModule.default;
-				if (!handler) return withDefaultSecurityHeaders(new Response("Method not allowed", {
-					status: 405,
-					headers: { "content-type": "text/plain; charset=utf-8" }
-				}));
-				return withDefaultSecurityHeaders(await handler({
-					request: options.request,
-					params: apiMatch.params,
-					context: middlewareResult.context,
-					signal: AbortSignal.timeout(3e4),
-					url,
-					route: apiMatch.route
-				}));
-			} catch (error) {
-				return renderApiErrorResponse({
-					error,
-					middlewareFiles: apiMiddlewareFiles,
-					options,
-					phase: currentPhase,
-					route: apiMatch.route
-				});
-			}
-		}
-	}
-	const match = matchAppRoute(resolvedApp, url.pathname);
-	if (!match) {
-		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Not found", 404, {
-			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
-				phase: "match",
-				status: 404
-			}) : void 0,
-			name: "Error"
-		}), { isRouteStateRequest: true });
-		return withDefaultSecurityHeaders(new Response("Not found", {
-			status: 404,
-			headers: { "content-type": "text/plain; charset=utf-8" }
-		}));
-	}
-	if (!SAFE_METHODS.has(options.request.method)) {
-		if (isRouteStateRequest) return jsonErrorResponse(createSerializedRouteError("Method not allowed", 405, {
-			diagnostics: exposeDiagnostics ? buildRuntimeDiagnostics({
-				middlewareFiles: match.route.middlewareFiles,
-				phase: "action",
-				route: match.route,
-				shellFile: match.route.shellFile,
-				status: 405
-			}) : void 0,
-			name: "Error"
-		}), { isRouteStateRequest: true });
-		return withRouteResponseHeaders(new Response("Method not allowed", {
-			status: 405,
-			headers: { "content-type": "text/plain; charset=utf-8" }
-		}), { isRouteStateRequest });
-	}
-	let routeArgs = {
-		request: options.request,
-		params: match.params,
-		context: options.context ?? {},
-		signal: AbortSignal.timeout(3e4),
-		url,
-		route: match.route
-	};
-	let routeModule;
-	let shellModule;
-	let loaderFile;
-	let currentPhase = "middleware";
-	try {
-		const middlewarePromise = runMiddlewareChain({
-			context: routeArgs.context,
-			middlewareFiles: match.route.middlewareFiles,
-			params: match.params,
-			registry,
-			request: options.request,
-			route: match.route,
-			url
-		});
-		const routeModulePromise = resolveRegistryModule(registry.routeModules, match.route.file);
-		const shellModulePromise = match.route.shellFile ? resolveRegistryModule(registry.shellModules, match.route.shellFile) : Promise.resolve(void 0);
-		const dataFunctionsPromise = routeModulePromise.then((mod) => resolveDataFunctions(match.route, mod, registry));
-		routeModulePromise.catch(() => {});
-		shellModulePromise.catch(() => {});
-		dataFunctionsPromise.catch(() => {});
-		const middlewareResult = await middlewarePromise;
-		if (middlewareResult.response) return normalizePageResponse(middlewareResult.response, { isRouteStateRequest });
-		routeArgs = {
-			...routeArgs,
-			context: middlewareResult.context
-		};
-		currentPhase = "render";
-		routeModule = await routeModulePromise;
-		if (!routeModule) throw new Error("Route module not found");
-		if (!isRouteStateRequest && typeof routeModule.markdown === "string" && prefersMarkdown(options.request.headers.get("accept"))) return markdownResponse(routeModule.markdown);
-		currentPhase = "loader";
-		const { loader, loaderFile: resolvedLoaderFile } = await dataFunctionsPromise;
-		loaderFile = resolvedLoaderFile;
-		const loaderResult = loader ? await loader(routeArgs) : void 0;
-		if (loaderResult instanceof Response) return normalizePageResponse(loaderResult, { isRouteStateRequest });
-		const data = loaderResult;
-		if (isRouteStateRequest) return withRouteResponseHeaders(Response.json({ data }), { isRouteStateRequest: true });
-		currentPhase = "render";
-		shellModule = await shellModulePromise;
-		const [head, documentHeaders] = await Promise.all([mergeHeadMetadata(shellModule, routeModule, routeArgs, data), mergeDocumentHeaders(shellModule, routeModule, routeArgs, data)]);
-		const cssUrls = resolvePageCssUrls(options.cssManifest, match.route.shellFile, match.route.file);
-		const modulePreloadUrls = resolvePageJsUrls(options.jsManifest, match.route.shellFile, match.route.file);
-		if (match.route.render === "spa") {
-			let body = "";
-			const Shell = shellModule?.Shell;
-			const Loading = shellModule?.Loading;
-			const loadingTree = Shell != null ? h(Shell, null, Loading ? h(Loading, null) : null) : Loading ? h(Loading, null) : null;
-			if (loadingTree) {
-				const tree = h(PrachtRuntimeProvider, {
-					data: null,
-					params: match.params,
-					routeId: match.route.id ?? "",
-					routes: resolvedApp.routes,
-					url: requestPath
-				}, loadingTree);
-				body = await (await getRenderToStringAsync())(tree);
-			}
-			return htmlResponse(buildHtmlDocument({
-				head,
-				body,
-				hydrationState: {
-					url: requestPath,
-					routeId: match.route.id ?? "",
-					data: null,
-					error: null,
-					pending: true
-				},
-				clientEntryUrl: options.clientEntryUrl,
-				cssUrls,
-				modulePreloadUrls,
-				routeStatePreloadUrl: loader ? buildRouteStateUrl(requestPath) : void 0
-			}), 200, documentHeaders);
-		}
-		const DefaultComponent = typeof routeModule.default === "function" ? routeModule.default : void 0;
-		const Component = routeModule.Component ?? DefaultComponent;
-		if (!Component) throw new Error("Route has no Component or default export");
-		const Shell = shellModule?.Shell;
-		const Comp = Component;
-		const componentProps = {
-			data,
-			params: match.params
-		};
-		const componentTree = Shell ? h(Shell, null, h(Comp, componentProps)) : h(Comp, componentProps);
-		const tree = h(PrachtRuntimeProvider, {
-			data,
-			params: match.params,
-			routeId: match.route.id ?? "",
-			routes: resolvedApp.routes,
-			url: requestPath
-		}, componentTree);
-		return htmlResponse(buildHtmlDocument({
-			head,
-			body: await (await getRenderToStringAsync())(tree),
-			hydrationState: {
-				url: requestPath,
-				routeId: match.route.id ?? "",
-				data,
-				error: null
-			},
-			clientEntryUrl: options.clientEntryUrl,
-			cssUrls,
-			modulePreloadUrls
-		}), 200, documentHeaders);
-	} catch (error) {
-		return renderRouteErrorResponse({
-			error,
-			isRouteStateRequest,
-			loaderFile,
-			options,
-			phase: currentPhase,
-			routeArgs,
-			routeId: match.route.id ?? "",
-			routeModule,
-			routes: resolvedApp.routes,
-			shellFile: match.route.shellFile,
-			shellModule,
-			requestPath
-		});
-	}
-}
-function getRequestPath(url) {
-	return `${url.pathname}${url.search}`;
-}
-function getResolvedApp(app) {
-	const routes = app.routes;
-	if (routes.length === 0 || isHrefRouteDefinition(routes[0])) return app;
-	return resolveApp(app);
-}
-function isHrefRouteDefinition(value) {
-	return Boolean(value && typeof value === "object" && "path" in value && "segments" in value && Array.isArray(value.segments));
-}
-//#endregion
-//#region src/prerender.ts
-const DANGEROUS_PRERENDER_HEADER_NAMES = new Set([
-	"authorization",
-	"proxy-authenticate",
-	"proxy-authorization",
-	"set-cookie",
-	"www-authenticate"
-]);
-const SECRET_SHAPED_PRERENDER_HEADER_RE = /^x-.*(?:api[-_]?key|client[-_]?secret|credential|jwt[-_]?secret|password|private[-_]?key|refresh[-_]?token|secret|session[-_]?secret|token|webhook[-_]?secret)(?:$|[-_])/i;
-async function prerenderApp(options) {
-	const resolved = resolveApp(options.app);
-	const results = [];
-	const isgManifest = {};
-	const work = [];
-	for (const route of resolved.routes) {
-		if (route.render !== "ssg" && route.render !== "isg") continue;
-		const paths = await collectSSGPaths(route, options.registry);
-		for (const pathname of paths) work.push({
-			pathname,
-			render: route.render,
-			revalidate: route.revalidate
-		});
-	}
-	const concurrency = options.concurrency ?? 10;
-	if (!Number.isInteger(concurrency) || concurrency <= 0) throw new Error("prerenderApp({ concurrency }) expects a positive integer.");
-	for (let i = 0; i < work.length; i += concurrency) {
-		const batch = work.slice(i, i + concurrency);
-		const batchResults = await Promise.all(batch.map(async (item) => {
-			const url = new URL(item.pathname, "http://localhost");
-			const request = new Request(url, { method: "GET" });
-			const response = await handlePrachtRequest({
-				app: options.app,
-				request,
-				registry: options.registry,
-				clientEntryUrl: options.clientEntryUrl,
-				cssManifest: options.cssManifest,
-				jsManifest: options.jsManifest
-			});
-			if (response.status !== 200) {
-				console.warn(`  Warning: ${item.render.toUpperCase()} route "${item.pathname}" returned status ${response.status}, skipping.`);
-				return null;
-			}
-			assertSafePrerenderHeaders(response.headers, item);
-			const html = await response.text();
-			return {
-				headers: Object.fromEntries(response.headers),
-				html,
-				item
-			};
-		}));
-		for (const result of batchResults) {
-			if (!result) continue;
-			results.push({
-				path: result.item.pathname,
-				html: result.html,
-				headers: result.headers
-			});
-			if (result.item.render === "isg" && result.item.revalidate) isgManifest[result.item.pathname] = { revalidate: result.item.revalidate };
-		}
-	}
-	if (options.withISGManifest) return {
-		pages: results,
-		isgManifest
-	};
-	return results;
-}
-function assertSafePrerenderHeaders(headers, item) {
-	const dangerous = [...headers.keys()].filter(isDangerousPrerenderHeader);
-	if (dangerous.length === 0) return;
-	const names = dangerous.map((name) => `"${name}"`).join(", ");
-	throw new Error(`Refusing to prerender ${item.render.toUpperCase()} route "${item.pathname}" because its document headers include ${names}. SSG/ISG document headers are serialized into public static output and replayed for every visitor. Move cookies/authentication headers to API routes, loaders, middleware responses, or SSR-only routes.`);
-}
-function isDangerousPrerenderHeader(name) {
-	const normalized = name.toLowerCase();
-	return DANGEROUS_PRERENDER_HEADER_NAMES.has(normalized) || SECRET_SHAPED_PRERENDER_HEADER_RE.test(normalized);
-}
-async function collectSSGPaths(route, registry) {
-	if (!route.segments.some((s) => s.type === "param" || s.type === "catchall")) return [route.path];
-	const routeModule = await resolveRegistryModule(registry?.routeModules, route.file);
-	if (!routeModule?.getStaticPaths) {
-		console.warn(`  Warning: SSG route "${route.path}" has dynamic segments but no getStaticPaths() export, skipping.`);
-		return [];
-	}
-	return (await routeModule.getStaticPaths()).map((params) => buildPathFromSegments(route.segments, params));
-}
-//#endregion
-//#region src/hydration-mismatch.ts
-const HYDRATION_BANNER_ID = "__pracht_hydration_mismatch__";
-let installed = false;
-function installHydrationMismatchWarning() {
-	if (installed) return;
-	installed = true;
-	const prev = options.__m;
-	options.__m = function(vnode) {
-		appendHydrationWarning(vnode);
-		if (prev) prev(vnode);
-	};
-}
-function appendHydrationWarning(vnode) {
-	if (typeof document === "undefined") return;
-	const componentName = getVNodeName(vnode);
-	let banner = document.getElementById(HYDRATION_BANNER_ID);
-	const message = `Hydration mismatch detected on <${componentName}>. The server-rendered HTML did not match the client.`;
-	if (banner) {
-		const list = banner.querySelector(`[data-pracht-mismatch-list]`);
-		if (list) {
-			const item = document.createElement("li");
-			item.textContent = message;
-			list.appendChild(item);
-		}
-		return;
-	}
-	banner = document.createElement("div");
-	banner.id = HYDRATION_BANNER_ID;
-	banner.setAttribute("role", "alert");
-	banner.style.cssText = [
-		"position:fixed",
-		"top:0",
-		"left:0",
-		"right:0",
-		"z-index:2147483647",
-		"background:#1a1a2e",
-		"color:#ff6b6b",
-		"padding:12px 16px",
-		"font:12px/1.5 ui-monospace,Menlo,Consolas,monospace",
-		"border-bottom:2px solid #e74c3c",
-		"box-shadow:0 2px 8px rgba(0,0,0,0.3)"
-	].join(";");
-	const title = document.createElement("strong");
-	title.textContent = "pracht: hydration mismatch";
-	title.style.cssText = "display:block;margin-bottom:4px;color:#fff";
-	banner.appendChild(title);
-	const list = document.createElement("ul");
-	list.setAttribute("data-pracht-mismatch-list", "");
-	list.style.cssText = "margin:0;padding-left:18px";
-	const item = document.createElement("li");
-	item.textContent = message;
-	list.appendChild(item);
-	banner.appendChild(list);
-	document.body.appendChild(banner);
-}
-function getVNodeName(vnode) {
-	if (!vnode) return "Unknown";
-	const type = vnode.type;
-	if (typeof type === "string") return type;
-	if (typeof type === "function") {
-		const fn = type;
-		return fn.displayName || fn.name || "Component";
-	}
-	return "Unknown";
-}
-//#endregion
-//#region src/router.ts
-const NavigateContext = createContext(async () => {});
-function useNavigate() {
-	return useContext(NavigateContext);
-}
-async function initClientRouter(options) {
-	const { app, routeModules, shellModules, root, findModuleKey } = options;
-	if (import.meta.env?.DEV) installHydrationMismatchWarning();
-	const moduleCache = /* @__PURE__ */ new Map();
-	function loadModule(modules, key) {
-		let cached = moduleCache.get(key);
-		if (!cached) {
-			cached = modules[key]();
-			moduleCache.set(key, cached);
-		}
-		return cached;
-	}
-	function startRouteImport(match) {
-		const routeKey = findModuleKey(routeModules, match.route.file);
-		if (!routeKey) return null;
-		return loadModule(routeModules, routeKey);
-	}
-	function startShellImport(match) {
-		if (!match.route.shellFile) return null;
-		const shellKey = findModuleKey(shellModules, match.route.shellFile);
-		if (!shellKey) return null;
-		return loadModule(shellModules, shellKey);
-	}
-	let updateRouteState = null;
-	let routeStateVersion = 0;
-	let latestNavigationId = 0;
-	let activeNavigationAbort = null;
-	function RouterRoot({ initialState }) {
-		const [routeState, setRouteState] = useState(initialState);
-		updateRouteState = setRouteState;
-		const navigateValue = useMemo(() => navigate, []);
-		const { Shell, Component, componentProps, data, params, routeId, url, version } = routeState;
-		const componentTree = Shell ? h(Shell, null, h(Component, componentProps)) : h(Component, componentProps);
-		return h(NavigateContext.Provider, { value: navigateValue }, h(PrachtRuntimeProvider, {
-			data,
-			params,
-			routeId,
-			routes: app.routes,
-			stateVersion: version,
-			url
-		}, componentTree));
-	}
-	function applyRouteState(routeState) {
-		if (updateRouteState) {
-			updateRouteState(routeState);
-			return;
-		}
-		render(h(RouterRoot, { initialState: routeState }), root);
-	}
-	async function resolveRouteState(match, state, currentUrl, routeModPromise, shellModPromise) {
-		const routeMod = await (routeModPromise ?? startRouteImport(match));
-		if (!routeMod) return null;
-		let Shell = null;
-		const resolvedShell = await (shellModPromise ?? startShellImport(match));
-		if (resolvedShell) Shell = resolvedShell.Shell;
-		const DefaultComponent = typeof routeMod.default === "function" ? routeMod.default : void 0;
-		const ErrorBoundary = routeMod.ErrorBoundary ?? resolvedShell?.ErrorBoundary;
-		const Component = state.error ? ErrorBoundary : routeMod.Component ?? DefaultComponent;
-		if (!Component) return null;
-		const componentProps = state.error ? { error: deserializeRouteError(state.error) } : {
-			data: state.data,
-			params: match.params
-		};
-		return {
-			Shell,
-			Component,
-			componentProps,
-			data: state.data,
-			params: match.params,
-			routeId: match.route.id ?? "",
-			url: currentUrl,
-			version: ++routeStateVersion
-		};
-	}
-	async function resolveSpaPendingState(match, currentUrl, shellModPromise) {
-		const resolvedShell = await (shellModPromise ?? startShellImport(match));
-		if (!resolvedShell) return null;
-		const Shell = resolvedShell.Shell ?? null;
-		const Loading = resolvedShell.Loading;
-		if (!Shell && !Loading) return null;
-		return {
-			Shell,
-			Component: Loading ?? (() => null),
-			componentProps: {},
-			data: void 0,
-			params: match.params,
-			routeId: match.route.id ?? "",
-			url: currentUrl,
-			version: ++routeStateVersion
-		};
-	}
-	function resolveRedirectTarget(location) {
-		const targetUrl = parseSafeNavigationUrl(location, window.location.href);
-		if (!targetUrl) return {
-			isCurrentLocation: false,
-			unsafe: true
-		};
-		const fullInternalTarget = targetUrl.pathname + targetUrl.search + targetUrl.hash;
-		const internalPath = targetUrl.pathname + targetUrl.search;
-		const currentPath = window.location.pathname + window.location.search + window.location.hash;
-		const isCurrentLocation = targetUrl.origin === window.location.origin && fullInternalTarget === currentPath;
-		if (targetUrl.origin !== window.location.origin) return {
-			externalUrl: targetUrl.toString(),
-			isCurrentLocation: false
-		};
-		if (targetUrl.hash) return {
-			documentUrl: targetUrl.toString(),
-			isCurrentLocation
-		};
-		return {
-			internalPath,
-			isCurrentLocation
-		};
-	}
-	async function navigate(to, opts) {
-		const navigationId = ++latestNavigationId;
-		activeNavigationAbort?.abort();
-		const abortController = new AbortController();
-		activeNavigationAbort = abortController;
-		const navigationTarget = typeof to === "string" ? to : buildHref(app.routes, to.route, to);
-		const target = resolveBrowserRouteTarget(navigationTarget);
-		if (!target) {
-			window.location.href = navigationTarget;
-			return;
-		}
-		const match = matchAppRoute(app, target.pathname);
-		if (!match) {
-			window.location.href = target.browserUrl;
-			return;
-		}
-		let statePromise;
-		if (routeNeedsServerFetch(match.route)) statePromise = getCachedRouteState(target.requestUrl) ?? fetchPrachtRouteState(target.requestUrl, { signal: abortController.signal });
-		else statePromise = Promise.resolve({
-			type: "data",
-			data: void 0
-		});
-		const routeModPromise = startRouteImport(match);
-		const shellModPromise = startShellImport(match);
-		let state = {
-			data: void 0,
-			error: null
-		};
-		try {
-			const result = await statePromise;
-			if (navigationId !== latestNavigationId) return;
-			if (result.type === "redirect") {
-				if (result.location) {
-					const redirect = resolveRedirectTarget(result.location);
-					if (redirect.unsafe) {
-						console.error(`[pracht] refused to navigate to unsafe URL: ${result.location}`);
-						return;
-					}
-					if (redirect.externalUrl) {
-						window.location.href = redirect.externalUrl;
-						return;
-					}
-					if (redirect.isCurrentLocation) return;
-					if (redirect.documentUrl) {
-						window.location.href = redirect.documentUrl;
-						return;
-					}
-					if (redirect.internalPath) {
-						await navigate(redirect.internalPath, opts);
-						return;
-					}
-					window.location.href = target.browserUrl;
-					return;
-				}
-				window.location.href = target.browserUrl;
-				return;
-			}
-			if (result.type === "error") state = {
-				data: void 0,
-				error: result.error
-			};
-			else state = {
-				data: result.data,
-				error: null
-			};
-		} catch {
-			if (abortController.signal.aborted || navigationId !== latestNavigationId) return;
-			window.location.href = target.browserUrl;
-			return;
-		}
-		if (navigationId !== latestNavigationId) return;
-		if (!opts?._popstate) if (opts?.replace) history.replaceState(null, "", target.browserUrl);
-		else history.pushState(null, "", target.browserUrl);
-		const routeState = await resolveRouteState(match, state, target.requestUrl, routeModPromise, shellModPromise);
-		if (navigationId !== latestNavigationId) return;
-		if (routeState) {
-			applyRouteState(routeState);
-			window.scrollTo(0, 0);
-		} else window.location.href = target.browserUrl;
-	}
-	const initialTarget = resolveBrowserRouteTarget(options.initialState.url);
-	const initialRequestUrl = initialTarget?.requestUrl ?? options.initialState.url;
-	const initialBrowserUrl = initialTarget?.browserUrl ?? options.initialState.url;
-	const initialMatch = matchAppRoute(app, initialTarget?.pathname ?? options.initialState.url);
-	if (initialMatch) {
-		const initialShellPromise = initialMatch.route.render === "spa" && options.initialState.pending ? startShellImport(initialMatch) : null;
-		let state = {
-			data: options.initialState.data,
-			error: options.initialState.error ?? null
-		};
-		if (initialMatch.route.render === "spa" && options.initialState.pending) {
-			const dataPromise = fetchPrachtRouteState(initialRequestUrl, { useDataParam: true });
-			const pendingState = await resolveSpaPendingState(initialMatch, initialRequestUrl, initialShellPromise);
-			if (pendingState) hydrate(h(RouterRoot, { initialState: pendingState }), root);
-			try {
-				const result = await dataPromise;
-				if (result.type === "redirect") {
-					const safeRedirect = parseSafeNavigationUrl(result.location, window.location.href);
-					if (!safeRedirect) {
-						console.error(`[pracht] refused to navigate to unsafe URL: ${result.location}`);
-						return;
-					}
-					window.location.href = safeRedirect.toString();
-					return;
-				}
-				if (result.type === "error") state = {
-					data: void 0,
-					error: result.error
-				};
-				else state = {
-					data: result.data,
-					error: null
-				};
-			} catch {
-				window.location.href = initialBrowserUrl;
-				return;
-			}
-			const resolvedState = await resolveRouteState(initialMatch, state, initialRequestUrl, void 0, initialShellPromise);
-			if (resolvedState) applyRouteState(resolvedState);
-		} else {
-			const initialRouteState = await resolveRouteState(initialMatch, state, initialRequestUrl, void 0, initialShellPromise);
-			if (initialRouteState) if (initialMatch.route.render === "spa") render(h(RouterRoot, { initialState: initialRouteState }), root);
-			else {
-				markHydrating();
-				hydrate(h(RouterRoot, { initialState: initialRouteState }), root);
-			}
-		}
-	}
-	document.addEventListener("click", (e) => {
-		const anchor = e.target.closest?.("a");
-		if (!anchor) return;
-		if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
-		if (e.defaultPrevented) return;
-		if (e.button !== 0) return;
-		const target = anchor.getAttribute("target");
-		if (target && target !== "_self") return;
-		if (anchor.hasAttribute("download")) return;
-		const href = anchor.getAttribute("href");
-		if (!href || href.startsWith("#")) return;
-		let url;
-		try {
-			url = new URL(href, window.location.origin);
-		} catch {
-			return;
-		}
-		if (url.origin !== window.location.origin) return;
-		e.preventDefault();
-		navigate(url.pathname + url.search + url.hash);
-	});
-	window.addEventListener("popstate", () => {
-		navigate(window.location.pathname + window.location.search + window.location.hash, { _popstate: true });
-	});
-	window.__PRACHT_NAVIGATE__ = navigate;
-	window.__PRACHT_ROUTER_READY__ = true;
-	const warmModules = (match) => {
-		startRouteImport(match);
-		startShellImport(match);
-	};
-	setupPrefetching(app, warmModules);
-}
-function resolveBrowserRouteTarget(to) {
-	if (typeof window === "undefined") return null;
-	try {
-		const url = new URL(to, window.location.href);
-		if (url.origin !== window.location.origin) return null;
-		return {
-			browserUrl: url.pathname + url.search + url.hash,
-			pathname: url.pathname,
-			requestUrl: url.pathname + url.search
-		};
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/types.ts
-var PrachtHttpError = class extends Error {
-	status;
-	constructor(status, message) {
-		super(message);
-		this.name = "PrachtHttpError";
-		this.status = status;
-	}
-};
-//#endregion
-export { Form, Link, PrachtHttpError, PrachtRuntimeProvider, Suspense, applyDefaultSecurityHeaders, buildHref, buildPathFromSegments, createHref, defineApp, forwardRef, group, handlePrachtRequest, initClientRouter, lazy, matchApiRoute, matchAppRoute, prerenderApp, readHydrationState, resolveApiRoutes, resolveApp, route, startApp, timeRevalidate, useIsHydrated, useLocation, useNavigate, useParams, useRevalidate, useRouteData };
+export { Form, Link, PrachtHttpError, PrachtRuntimeProvider, Suspense, applyDefaultSecurityHeaders, buildHref, buildPathFromSegments, createHref, defineApp, forwardRef, group, handlePrachtRequest, initClientRouter, lazy, matchApiRoute, matchAppRoute, prerenderApp, readHydrationState, redirect, resolveApiRoutes, resolveApp, route, startApp, timeRevalidate, useIsHydrated, useLocation, useNavigate, useParams, useRevalidate, useRouteData };