@demiurgejs/core 0.1.0 → 0.2.0-beta.1

package/dist/static/index.js

@@ -1,54 +1,460 @@
-import { mkdir as d, mkdtemp as b, writeFile as m, cp as C, rm as y, readFile as R } from "node:fs/promises";
-import { resolve as w, dirname as g, join as S, relative as x, sep as P } from "node:path";
-import { d as T } from "../chunks/index-BnX9Qxbm.js";
-import { c as L, a as M, b as q, h as A, r as k, d as W } from "../chunks/testing-BBnJ5WUR.js";
+import { readFile as v, mkdir as E, mkdtemp as W, cp as k, writeFile as A, rm as $, rename as rt } from "node:fs/promises";
+import { resolve as h, relative as w, sep as g, extname as nt, dirname as N, join as m } from "node:path";
+import { d as it, S as F } from "../chunks/request-metadata-DwEO1EAS.js";
+import { v as ot, c as st, a as at, h as ct, r as ut, m as ft, b as D, d as lt } from "../chunks/testing-DBjVCN5v.js";
 import "react-dom/server";
 import "react";
 import "react/jsx-runtime";
-const N = "demiurge-static-manifest.json", it = T({
+import { C as _, I as dt, R as ht } from "../chunks/static-files-DUjHw-4H.js";
+import { createServer as pt } from "node:http";
+import { normalizeRoutes as mt, getTransformedRoutes as wt } from "@vercel/routing-utils";
+const yt = "demiurge-static-manifest.json", gt = {
+  ".avif": "image/avif",
+  ".css": "text/css; charset=utf-8",
+  ".gif": "image/gif",
+  ".html": "text/html; charset=utf-8",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain; charset=utf-8",
+  ".webmanifest": "application/manifest+json",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2"
+};
+async function de(t) {
+  const e = h(t.outDir), r = Et(
+    await v(h(e, yt), "utf8")
+  ), n = new Map(
+    r.entries.map((o) => [o.pathname, o])
+  ), i = new Map(
+    r.entries.map((o) => [o.file, o])
+  ), a = r.fileHeaderRules.map((o) => ({
+    ...o,
+    expression: new RegExp(o.pattern)
+  })), c = pt(async (o, s) => {
+    try {
+      if (o.method !== "GET" && o.method !== "HEAD") {
+        s.writeHead(405, { allow: "GET, HEAD" }), s.end();
+        return;
+      }
+      const f = new URL(o.url ?? "/", "http://demiurge.local");
+      let l;
+      try {
+        l = decodeURIComponent(f.pathname);
+      } catch {
+        s.writeHead(400, {
+          "content-type": "text/plain; charset=utf-8"
+        }), s.end("The request path is not valid UTF-8.");
+        return;
+      }
+      const R = l.replace(/\/$/, "") || "/", y = n.get(R);
+      if (y) {
+        await T(e, y, o.method, s);
+        return;
+      }
+      const u = St(e, l);
+      if (u)
+        try {
+          const p = w(e, u).split(g).join("/"), b = i.get(p);
+          if (b) {
+            await T(e, b, o.method, s);
+            return;
+          }
+          const X = await v(u), j = gt[nt(u).toLowerCase()];
+          j && s.setHeader("content-type", j);
+          const Y = l.split("/").at(-1) ?? "", tt = a.find(({ expression: et }) => et.test(Y));
+          U(s, tt?.headers ?? {}), s.writeHead(200), s.end(o.method === "HEAD" ? void 0 : X);
+          return;
+        } catch (p) {
+          if (!Ot(p)) throw p;
+        }
+      const d = n.get("*");
+      if (!d) {
+        s.writeHead(404), s.end();
+        return;
+      }
+      await T(e, d, o.method, s);
+    } catch {
+      s.writeHead(500, {
+        "content-type": "text/plain; charset=utf-8"
+      }), s.end("Demiurge could not serve the static output.");
+    }
+  });
+  return await new Promise((o, s) => {
+    const f = (l) => s(l);
+    c.once("error", f), c.listen(
+      t.port ?? 4173,
+      t.host ?? "localhost",
+      () => {
+        c.off("error", f), o();
+      }
+    );
+  }), c;
+}
+async function T(t, e, r, n) {
+  const i = B(t, e.file), a = await v(i);
+  U(n, e.headers), n.writeHead(e.status), n.end(r === "HEAD" ? void 0 : a);
+}
+function U(t, e) {
+  for (const [r, n] of Object.entries(e))
+    t.setHeader(r, n);
+}
+function St(t, e) {
+  if (!e.endsWith("/"))
+    return V(t, `.${e}`);
+}
+function B(t, e) {
+  const r = V(t, e);
+  if (!r)
+    throw new Error(`Static preview file is outside the output directory: ${JSON.stringify(e)}.`);
+  return r;
+}
+function V(t, e) {
+  if (!e || e.startsWith("/") || e.startsWith("\\") || e.split(/[\\/]/).includes(".."))
+    return;
+  const r = h(t, e), n = w(t, r);
+  return n !== ".." && !n.startsWith(`..${g}`) ? r : void 0;
+}
+function Et(t) {
+  let e;
+  try {
+    e = JSON.parse(t);
+  } catch {
+    throw new Error("The static output manifest is not valid JSON.");
+  }
+  if (!O(e) || e.adapter !== "static" || e.version !== 1)
+    throw new Error("The static output manifest has an unsupported format.");
+  if (!Array.isArray(e.entries) || !Array.isArray(e.fileHeaderRules))
+    throw new Error("The static output manifest does not contain header rules and entries.");
+  const r = e.entries.map(vt), n = e.fileHeaderRules.map($t), i = /* @__PURE__ */ new Set();
+  for (const a of r) {
+    if (i.has(a.pathname))
+      throw new Error(`The static output manifest repeats pathname ${JSON.stringify(a.pathname)}.`);
+    i.add(a.pathname);
+  }
+  return { adapter: "static", entries: r, fileHeaderRules: n, version: 1 };
+}
+function vt(t) {
+  if (!O(t) || typeof t.file != "string" || typeof t.pathname != "string" || t.status !== 200 && t.status !== 404 || !q(t.headers))
+    throw new Error("The static output manifest contains an invalid entry.");
+  return B("/demiurge-manifest-root", t.file), {
+    file: t.file,
+    headers: t.headers,
+    pathname: t.pathname,
+    status: t.status
+  };
+}
+function $t(t) {
+  if (!O(t) || typeof t.pattern != "string" || !q(t.headers))
+    throw new Error("The static output manifest contains an invalid file header rule.");
+  try {
+    new RegExp(t.pattern);
+  } catch {
+    throw new Error("The static output manifest contains an invalid file header pattern.");
+  }
+  return { headers: t.headers, pattern: t.pattern };
+}
+function O(t) {
+  return !!t && typeof t == "object" && !Array.isArray(t);
+}
+function q(t) {
+  return O(t) && Object.values(t).every(
+    (e) => typeof e == "string"
+  );
+}
+function Ot(t) {
+  return t instanceof Error && "code" in t && (t.code === "EISDIR" || t.code === "ENOENT");
+}
+const Rt = "demiurge-manifest.json", Tt = "demiurge-static-manifest.json";
+function he(t = {}) {
+  return {
+    adapter: "vercel",
+    cache: t.cache?.map((e) => ({
+      source: e.source,
+      value: e.value
+    })) ?? []
+  };
+}
+async function pe(t) {
+  Ft(t.deployment);
+  const e = h(t.projectRoot), r = h(t.outDir), n = h(e, ".vercel/output");
+  if (Ht(r, n))
+    throw new Error(
+      "The static output directory must not overlap the Vercel output directory."
+    );
+  const i = N(n);
+  await E(i, { recursive: !0 });
+  const a = await W(m(i, "output-demiurge-"));
+  try {
+    const c = m(a, "static");
+    await k(r, c, {
+      filter: (o) => {
+        const s = w(r, o).split(g).join("/");
+        return s !== Rt && s !== Tt;
+      },
+      recursive: !0
+    }), await A(
+      m(a, "config.json"),
+      `${JSON.stringify(xt(
+        t.manifest,
+        t.deployment
+      ), null, 2)}
+`
+    ), await $(n, { force: !0, recursive: !0 }), await rt(a, n);
+  } catch (c) {
+    throw await $(a, { force: !0, recursive: !0 }), c;
+  }
+  return n;
+}
+function xt(t, e) {
+  const r = t.entries.find((o) => o.pathname === "*");
+  if (!r)
+    throw new Error("Vercel output requires a static fallback entry.");
+  const n = jt(e.cache), i = [];
+  for (const o of t.entries) {
+    if (o.pathname === "*") continue;
+    const s = `/${o.file}`;
+    s !== o.pathname && i.push({
+      continue: !0,
+      dest: o.pathname,
+      src: S(s)
+    });
+  }
+  for (const o of t.entries) {
+    const s = H(o.headers);
+    if (Object.keys(s).length === 0) continue;
+    const f = o.pathname === "*" ? `/${o.file}` : o.pathname;
+    i.push({
+      continue: !0,
+      headers: s,
+      src: S(f)
+    });
+  }
+  i.push(...n);
+  for (const o of t.entries) {
+    if (o.pathname === "*") {
+      i.push({
+        dest: `/${o.file}`,
+        src: S(`/${o.file}`),
+        status: 404
+      });
+      continue;
+    }
+    i.push({
+      dest: o.pathname === "/" ? `/${o.file}` : o.pathname,
+      src: S(o.pathname)
+    });
+  }
+  i.push({ handle: "hit" });
+  for (const o of [...t.fileHeaderRules].reverse())
+    i.push({
+      continue: !0,
+      headers: { ...o.headers },
+      src: Nt(o.pattern)
+    });
+  i.push(...n.map((o) => ({ ...o }))), i.push({ handle: "error" });
+  const a = H(r.headers);
+  Object.keys(a).length > 0 && i.push({
+    continue: !0,
+    headers: a,
+    src: "^/.*$"
+  }), i.push(...n.map((o) => ({ ...o }))), i.push({ dest: `/${r.file}`, src: "^/.*$", status: 404 });
+  const c = mt(i);
+  if (c.error || !c.routes)
+    throw new Error(
+      `Vercel rejected the generated routes: ${c.error?.message ?? "The route list is empty."}`
+    );
+  return {
+    overrides: Object.fromEntries(
+      t.entries.map((o) => [o.file, At(o)])
+    ),
+    routes: c.routes,
+    version: 3
+  };
+}
+function At(t) {
+  const e = {}, r = t.headers["content-type"];
+  if (r && (e.contentType = r), t.pathname !== "*") {
+    const n = t.file === "index.html" ? "/" : `/${t.file}`;
+    t.pathname !== n && (e.path = t.pathname.slice(1));
+  }
+  return e;
+}
+function S(t) {
+  const e = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return t === "/" ? "^/$" : `^${e}/?$`;
+}
+function H(t) {
+  return Object.fromEntries(
+    Object.entries(t).filter(([e]) => e.toLowerCase() !== "content-type")
+  );
+}
+function Nt(t) {
+  return t === ".*" ? "^/.*$" : t === _.source ? "^/(?:.*/)?[^/]*-[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9]+$" : `^/${bt(t)}$`;
+}
+function bt(t) {
+  const e = t.startsWith("^"), r = t.endsWith("$") && !t.endsWith("\\$"), n = t.slice(
+    e ? 1 : 0,
+    r ? -1 : void 0
+  );
+  return `${e ? "(?:.*/)?" : "(?:.*/)?[^/]*"}(?:${n})${r ? "" : "[^/]*"}`;
+}
+function jt(t) {
+  const e = t.map((n) => ({
+    headers: [{ key: "cache-control", value: n.value }],
+    source: n.source
+  })), r = wt({ headers: e });
+  if (r.error || !r.routes)
+    throw new Error(
+      `A Vercel static header rule is not valid: ${r.error?.message ?? "The route list is empty."}`
+    );
+  return r.routes;
+}
+function Ft(t) {
+  if (t.adapter !== "vercel" || !Array.isArray(t.cache))
+    throw new Error("The Vercel static adapter configuration is not valid.");
+  for (const e of t.cache)
+    if (!e || typeof e != "object" || typeof e.source != "string" || !e.source || typeof e.value != "string" || !e.value)
+      throw new Error("A Vercel static header rule is not valid.");
+}
+function Ht(t, e) {
+  const r = w(t, e), n = w(e, t);
+  return C(r) || C(n);
+}
+function C(t) {
+  return !t || t !== ".." && !t.startsWith(`..${g}`) && !t.startsWith("/");
+}
+const G = "demiurge-static-manifest.json", Ct = it({
   name: "static",
   capabilities: {
     staticOutput: !0
   }
-});
-async function nt(t) {
-  const e = j(t.origin), i = w(t.outDir), r = L(t.routes), n = await M(r);
-  H(r, n.length);
-  const s = I(n.map((u) => u.pathname)), c = q(), o = [], a = { ...t.ssr, navigation: "document" };
-  for (const u of s) {
-    const l = O(e, u.pathname), F = await A(r, l, {
+}), Pt = 8;
+async function Jt(t) {
+  const e = Object.entries(t), r = new Array(e.length);
+  let n = 0;
+  const i = Array.from(
+    { length: Math.min(Pt, e.length) },
+    async () => {
+      for (; n < e.length; ) {
+        const a = n++, [c, o] = e[a];
+        try {
+          r[a] = [c, await o()];
+        } catch (s) {
+          throw new Error(
+            `Demiurge could not load route module ${JSON.stringify(c)}.`,
+            { cause: s }
+          );
+        }
+      }
+    }
+  );
+  return await Promise.all(i), Object.fromEntries(r);
+}
+async function me(t) {
+  const e = await Jt(t.routes), r = ot(e, {
+    adapter: Ct
+  }), n = Wt(t.origin), i = h(t.outDir), a = await Dt(r), c = await st(r, {
+    includeResources: !0
+  });
+  kt(
+    r,
+    c.filter((u) => a.get(u.file) === "document").length
+  );
+  const o = Bt(
+    c.map((u) => ({
+      kind: a.get(u.file) ?? "resource",
+      pathname: u.pathname
+    }))
+  ), s = at(), f = [], l = { ...t.ssr, navigation: "document" };
+  for (const u of o) {
+    const d = J(n, u.pathname, u.kind), p = await ct(r, d, {
       onError: t.onError,
-      rateLimitStore: c,
-      ssr: a
+      rateLimitStore: s,
+      ssr: l
     });
-    o.push(await E(u, F, 200));
+    f.push(
+      u.kind === "document" ? await L(u, p, 200) : await Gt(u, p)
+    );
   }
-  const f = await k(
+  const R = await ut(
     r,
-    O(e, "/404"),
+    J(n, "/404", "document"),
     {
-      ...a,
-      onError: (u, l) => t.onError?.(u, { pathname: "/404", site: l })
+      ...l,
+      onError: (u, d) => t.onError?.(u, { pathname: "/404", site: d })
     }
   );
-  o.push(
-    await E(
+  f.push(
+    await L(
       {
         file: "404.html",
         pathname: "*"
       },
-      f,
+      R,
       404
     )
-  ), o.sort((u, l) => u.file.localeCompare(l.file));
-  const p = {
+  ), f.sort((u, d) => u.file.localeCompare(d.file));
+  const y = {
     adapter: "static",
-    entries: o.map(({ html: u, ...l }) => l),
+    entries: f.map(({ body: u, ...d }) => d),
+    fileHeaderRules: await Lt(
+      r,
+      t.staticFileHeaders ?? []
+    ),
     version: 1
   };
-  return await K(i, o, p), p;
+  return await te(i, f, y), y;
+}
+async function Lt(t, e) {
+  const r = await Mt(t), n = P(r);
+  return [
+    ...e.map((i) => (It(i.pattern), {
+      headers: P(
+        ft(r, { headers: i.headers })
+      ),
+      pattern: i.pattern
+    })),
+    {
+      headers: {
+        ...n,
+        "cache-control": dt
+      },
+      pattern: _.source
+    },
+    {
+      headers: {
+        ...n,
+        "cache-control": ht
+      },
+      pattern: ".*"
+    }
+  ];
+}
+async function Mt(t) {
+  return { headers: (await t.policies.find(
+    (n) => n.fileSegments.length === 0
+  )?.load())?.policy?.document?.headers };
+}
+function P(t) {
+  return Object.fromEntries(lt(t, {}).entries());
+}
+function It(t) {
+  try {
+    new RegExp(t);
+  } catch {
+    throw new Error(
+      `Static file header pattern is not a valid regular expression: ${JSON.stringify(t)}.`
+    );
+  }
 }
-function j(t) {
+function Wt(t) {
   let e;
   try {
     e = new URL(t ?? "http://demiurge.local");
@@ -63,194 +469,349 @@ function j(t) {
     );
   return e.origin;
 }
-function H(t, e) {
+function kt(t, e) {
   if (e === 0)
     throw new Error("Static output requires at least one page route.");
   if (!t.fallbacks.notFound.some(
-    (r) => r.fileSegments.length === 0
+    (n) => n.fileSegments.length === 0
   ))
     throw new Error(
       "Static output requires a root @not-found.tsx so 404.html is app-owned."
     );
 }
-function I(t) {
-  const e = /* @__PURE__ */ new Map(), i = /* @__PURE__ */ new Set();
-  return t.map((r) => {
-    if (i.has(r))
-      throw new Error(`Static output collected duplicate pathname ${JSON.stringify(r)}.`);
-    i.add(r);
-    const n = U(r), s = n.toLocaleLowerCase("en-US"), c = e.get(s);
-    if (c)
+async function Dt(t) {
+  const e = /* @__PURE__ */ new Map();
+  for (const r of t.routes) {
+    const n = await r.load(), i = _t(n);
+    if (i.length > 0)
+      throw new Error(
+        `Static route ${JSON.stringify(r.file)} exports unsupported methods ${i.join(", ")}. Deploy a runtime adapter for request-time methods.`
+      );
+    if (!n.GET)
+      throw new Error(
+        `Static route ${JSON.stringify(r.file)} does not export GET and cannot produce an output file.`
+      );
+    if (n.GET.kind === "page") {
+      e.set(r.file, "document");
+      continue;
+    }
+    Ut(r.file, n.GET), e.set(r.file, "resource");
+  }
+  return e;
+}
+function _t(t) {
+  return ["POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"].filter((e) => t[e] !== void 0);
+}
+function Ut(t, e) {
+  if ((e.kind === "text" || e.kind === "html" || e.kind === "json") && typeof e.value != "function")
+    return;
+  const r = "value" in e && typeof e.value == "function" ? `uses a request-dependent ${e.kind} value` : `uses the ${e.kind} response helper`;
+  throw new Error(
+    `Static route ${JSON.stringify(t)} ${r} and cannot produce a fixed output file. Use a fixed text, html, or json value, or deploy a runtime adapter.`
+  );
+}
+function Bt(t) {
+  const e = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Set();
+  return t.map(({ kind: n, pathname: i }) => {
+    if (r.has(i))
+      throw new Error(`Static output collected duplicate pathname ${JSON.stringify(i)}.`);
+    r.add(i);
+    const a = n === "document" ? z(i) : Vt(i), c = a.toLocaleLowerCase("en-US"), o = [...e.entries()].find(
+      ([s]) => s === c || s.startsWith(`${c}/`) || c.startsWith(`${s}/`)
+    );
+    if (o)
       throw new Error(
-        `Static paths ${JSON.stringify(c)} and ${JSON.stringify(r)} map to the same portable output file ${JSON.stringify(n)}.`
+        `Static paths ${JSON.stringify(o[1])} and ${JSON.stringify(i)} map to the same portable output file or to a file and directory conflict.`
       );
-    return e.set(s, r), { file: n, pathname: r };
+    return e.set(c, i), { file: a, kind: n, pathname: i };
   });
 }
-function U(t) {
+function z(t) {
   if (!t.startsWith("/") || t.includes("?") || t.includes("#"))
     throw new Error(`Static output received invalid pathname ${JSON.stringify(t)}.`);
-  return t === "/" ? "index.html" : [...t.split("/").slice(1).map((i) => {
-    let r;
+  return t === "/" ? "index.html" : [...t.split("/").slice(1).map((r) => {
+    let n;
     try {
-      r = decodeURIComponent(i);
+      n = decodeURIComponent(r);
     } catch {
       throw new Error(`Static output pathname is not valid UTF-8: ${JSON.stringify(t)}.`);
     }
-    return _(r, t), r;
+    return qt(n, t), n;
   }), "index.html"].join("/");
 }
-function _(t, e) {
-  const i = /[<>:"|?*]/.test(t) || [...t].some((r) => r.charCodeAt(0) <= 31) || /[. ]$/.test(t) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(t);
-  if (!t || t === "." || t === ".." || t.includes("/") || t.includes("\\") || i)
+function Vt(t) {
+  if (t === "/")
+    throw new Error("A static resource route cannot own the root pathname.");
+  return z(t).slice(0, -11);
+}
+function qt(t, e) {
+  const r = /[<>:"|?*]/.test(t) || [...t].some((n) => n.charCodeAt(0) <= 31) || /[. ]$/.test(t) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(t);
+  if (!t || t === "." || t === ".." || t.includes("/") || t.includes("\\") || r)
     throw new Error(
       `Static pathname ${JSON.stringify(e)} contains a segment that is unsafe or not portable as a file name: ${JSON.stringify(t)}.`
     );
 }
-function O(t, e) {
+function J(t, e, r) {
   return new Request(`${t}${e}`, {
-    headers: { accept: "text/html" }
+    headers: { accept: r === "document" ? "text/html" : "*/*" }
   });
 }
-async function E(t, e, i) {
-  if (e.status !== i)
+async function L(t, e, r) {
+  if (e.status !== r)
     throw new Error(
-      `Static output for ${JSON.stringify(t.pathname)} returned status ${e.status}; expected ${i}.`
+      `Static output for ${JSON.stringify(t.pathname)} returned status ${e.status}; expected ${r}.`
     );
-  const r = e.headers.get("content-type");
-  if (!r?.toLowerCase().startsWith("text/html"))
+  const n = e.headers.get("content-type");
+  if (!n?.toLowerCase().startsWith("text/html"))
     throw new Error(
-      `Static output for ${JSON.stringify(t.pathname)} returned ${JSON.stringify(r)} instead of text/html.`
+      `Static output for ${JSON.stringify(t.pathname)} returned ${JSON.stringify(n)} instead of text/html.`
     );
   if (e.headers.has("set-cookie"))
     throw new Error(
       `Static output for ${JSON.stringify(t.pathname)} attempted to set a cookie. Build artifacts cannot contain per-user response state.`
     );
-  const n = await e.text();
-  return await B(t.pathname, n, e.headers), {
-    ...t,
-    headers: G(e.headers),
-    html: n,
-    status: i
+  const i = await zt(
+    await e.text(),
+    e.headers
+  );
+  return await Zt(t.pathname, i, e.headers), {
+    file: t.file,
+    headers: Z(e.headers),
+    body: i,
+    pathname: t.pathname,
+    status: r
   };
 }
-async function B(t, e, i) {
-  const r = i.get("content-security-policy");
-  if (!r)
+async function Gt(t, e) {
+  if (e.status !== 200)
+    throw new Error(
+      `Static output for ${JSON.stringify(t.pathname)} returned status ${e.status}; expected 200.`
+    );
+  if (e.headers.has("set-cookie"))
+    throw new Error(
+      `Static output for ${JSON.stringify(t.pathname)} attempted to set a cookie. Build artifacts cannot contain per-user response state.`
+    );
+  return {
+    file: t.file,
+    headers: Z(e.headers),
+    body: await e.text(),
+    pathname: t.pathname,
+    status: 200
+  };
+}
+async function zt(t, e) {
+  const r = new RegExp(
+    `(?:^|\\s)${F}(?:\\s|$)`
+  ), n = K(t, "script").filter((a) => r.test(a.attributes));
+  if (n.length === 0)
+    return t;
+  const i = await Promise.all(
+    n.map((a) => D(a.content))
+  );
+  for (const a of [
+    "content-security-policy",
+    "content-security-policy-report-only"
+  ]) {
+    const c = e.get(a);
+    c && e.set(a, Kt(c, i));
+  }
+  return t.replace(
+    new RegExp(`\\s${F}(?=\\s|>)`, "g"),
+    ""
+  );
+}
+function Kt(t, e) {
+  const r = t.split(";").map((s) => s.trim()).filter(Boolean), n = r.findIndex(
+    (s) => s.split(/\s+/, 1)[0]?.toLowerCase() === "script-src"
+  ), i = r.find(
+    (s) => s.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
+  ), a = n === -1 ? i : r[n];
+  if (!a)
+    return t;
+  const c = a.split(/\s+/).slice(1).filter((s) => s !== "'none'"), o = [
+    "script-src",
+    .../* @__PURE__ */ new Set([...c, ...e])
+  ].join(" ");
+  return n === -1 ? r.push(o) : r[n] = o, r.join("; ");
+}
+async function Zt(t, e, r) {
+  const n = r.get("content-security-policy");
+  if (!n)
     return;
-  if (/'nonce-[^']+'/i.test(r) || /\snonce\s*=/i.test(e))
+  if (/'nonce-[^']+'/i.test(n) || /\snonce\s*=/i.test(e))
     throw new Error(
       `Static output for ${JSON.stringify(t)} uses a nonce-backed CSP. Use security.static() with stable hashes or a runtime adapter that injects a fresh nonce.`
     );
-  const n = z(r);
-  await $(
+  const i = Qt(n);
+  await M(
     t,
     e,
     "script",
-    h(n, "script-src")
-  ), await $(
+    x(i, "script-src", "default-src")
+  ), await M(
     t,
     e,
     "style",
-    h(n, "style-src")
+    x(
+      i,
+      "style-src-elem",
+      "style-src",
+      "default-src"
+    )
+  );
+  const a = x(
+    i,
+    "style-src-attr",
+    "style-src",
+    "default-src"
   );
-  const s = h(n, "style-src");
-  if (/\sstyle\s*=/i.test(e) && !s.includes("'unsafe-inline'"))
+  if (a && /\sstyle\s*=/i.test(e) && !a.includes("'unsafe-inline'"))
     throw new Error(
       `Static output for ${JSON.stringify(t)} contains an inline style attribute that its CSP does not allow. Move the style into a stylesheet or explicitly allow inline styles.`
     );
 }
-function z(t) {
+function Qt(t) {
   const e = /* @__PURE__ */ new Map();
-  for (const i of t.split(";")) {
-    const [r, ...n] = i.trim().split(/\s+/);
-    r && e.set(r.toLowerCase(), n);
+  for (const r of t.split(";")) {
+    const [n, ...i] = r.trim().split(/\s+/);
+    n && e.set(n.toLowerCase(), i);
   }
   return e;
 }
-function h(t, e) {
-  return t.get(e) ?? t.get("default-src") ?? [];
+function x(t, ...e) {
+  for (const r of e) {
+    const n = t.get(r);
+    if (n)
+      return n;
+  }
 }
-async function $(t, e, i, r) {
-  if (!r.includes("'unsafe-inline'"))
-    for (const n of D(e, i)) {
-      if (i === "script" && /(?:^|\s)src\s*=/i.test(n.attributes) || !n.content)
+async function M(t, e, r, n) {
+  if (!(!n || n.includes("'unsafe-inline'")))
+    for (const i of K(e, r)) {
+      if (r === "script") {
+        const c = Xt(i.attributes, "src");
+        if (c) {
+          if (!Yt(n, c))
+            throw new Error(
+              `Static output for ${JSON.stringify(t)} contains script ${JSON.stringify(c)} that the effective script-src directive does not allow. Add its origin to security.needs.script or the route CSP policy.`
+            );
+          continue;
+        }
+      }
+      if (!i.content)
         continue;
-      const s = await W(n.content);
-      if (!r.includes(s))
+      const a = await D(i.content);
+      if (!n.includes(a))
         throw new Error(
-          `Static output for ${JSON.stringify(t)} contains an inline ${i} without the required CSP hash ${s}.`
+          `Static output for ${JSON.stringify(t)} contains an inline ${r} without the required CSP hash ${a}.`
         );
     }
 }
-function D(t, e) {
-  const i = t.toLowerCase(), r = [], n = `<${e}`, s = `</${e}`;
+function Xt(t, e) {
+  return t.match(
+    new RegExp(`(?:^|\\s)${e}\\s*=\\s*["']([^"']+)["']`, "i")
+  )?.[1]?.replaceAll("&amp;", "&");
+}
+function Yt(t, e) {
+  if (!t)
+    return !0;
+  if (t.includes("'none'") || t.includes("'strict-dynamic'") && t.some(
+    (n) => n.startsWith("'nonce-") || /^'sha(?:256|384|512)-/.test(n)
+  ))
+    return !1;
+  if (t.includes("*") || t.includes("'self'") && e.startsWith("/") && !e.startsWith("//") || e.startsWith("https:") && t.includes("https:") || e.startsWith("http:") && t.includes("http:"))
+    return !0;
+  let r;
+  try {
+    r = new URL(e, "https://demiurge.invalid");
+  } catch {
+    return !1;
+  }
+  return t.some((n) => {
+    if (n.startsWith("'"))
+      return !1;
+    let i;
+    try {
+      i = new URL(n);
+    } catch {
+      return !1;
+    }
+    const a = i.hostname.startsWith("*.") ? r.hostname.endsWith(i.hostname.slice(1)) && r.hostname !== i.hostname.slice(2) : r.hostname === i.hostname, c = i.pathname === "/" || i.pathname.endsWith("/") ? r.pathname.startsWith(i.pathname) : r.pathname === i.pathname;
+    return r.protocol === i.protocol && a && r.port === i.port && c;
+  });
+}
+function K(t, e) {
+  const r = t.toLowerCase(), n = [], i = `<${e}`, a = `</${e}`;
   let c = 0;
   for (; c < t.length; ) {
-    const o = i.indexOf(n, c);
+    const o = r.indexOf(i, c);
     if (o === -1)
       break;
-    const a = i.indexOf(">", o + n.length), f = a === -1 ? -1 : i.indexOf(s, a + 1), p = f === -1 ? -1 : i.indexOf(">", f + s.length);
-    if (a === -1 || f === -1 || p === -1)
+    const s = r.indexOf(">", o + i.length), f = s === -1 ? -1 : r.indexOf(a, s + 1), l = f === -1 ? -1 : r.indexOf(">", f + a.length);
+    if (s === -1 || f === -1 || l === -1)
       throw new Error(`Static output contains an unclosed <${e}> element.`);
-    r.push({
-      attributes: t.slice(o + n.length, a),
-      content: t.slice(a + 1, f)
-    }), c = p + 1;
+    n.push({
+      attributes: t.slice(o + i.length, s),
+      content: t.slice(s + 1, f)
+    }), c = l + 1;
   }
-  return r;
+  return n;
 }
-function G(t) {
+function Z(t) {
   return Object.fromEntries(
-    [...t.entries()].sort(([e], [i]) => e.localeCompare(i))
+    [...t.entries()].sort(([e], [r]) => e.localeCompare(r))
   );
 }
-async function K(t, e, i) {
-  const r = g(t);
-  await d(r, { recursive: !0 });
-  const n = await b(S(r, ".demiurge-static-"));
+async function te(t, e, r) {
+  const n = N(t);
+  await E(n, { recursive: !0 });
+  const i = await W(m(n, ".demiurge-static-"));
   try {
     for (const o of e) {
-      const a = v(n, o.file);
-      await d(g(a), { recursive: !0 }), await m(a, o.html);
+      const s = I(i, o.file);
+      await E(N(s), { recursive: !0 }), await A(s, o.body);
     }
-    await m(
-      S(n, N),
-      `${JSON.stringify(i, null, 2)}
+    await A(
+      m(i, G),
+      `${JSON.stringify(r, null, 2)}
 `
     );
-    const s = await Q(t);
-    await d(t, { recursive: !0 }), await C(n, t, { recursive: !0, force: !0 });
+    const a = await ee(t);
+    await E(t, { recursive: !0 }), await k(i, t, { recursive: !0, force: !0 });
     const c = new Set(e.map((o) => o.file));
-    for (const o of s)
-      c.has(o) || await y(v(t, o), { force: !0 });
+    for (const o of a)
+      c.has(o) || await $(I(t, o), { force: !0 });
   } finally {
-    await y(n, { force: !0, recursive: !0 });
+    await $(i, { force: !0, recursive: !0 });
   }
 }
-async function Q(t) {
+async function ee(t) {
   try {
-    const e = await R(S(t, N), "utf8"), i = JSON.parse(e);
-    return i.adapter !== "static" || i.version !== 1 || !Array.isArray(i.entries) ? [] : i.entries.flatMap(
-      (r) => typeof r.file == "string" && r.file.endsWith(".html") && J(r.file) ? [r.file] : []
+    const e = await v(m(t, G), "utf8"), r = JSON.parse(e);
+    return r.adapter !== "static" || r.version !== 1 || !Array.isArray(r.entries) ? [] : r.entries.flatMap(
+      (n) => typeof n.file == "string" && Q(n.file) ? [n.file] : []
     );
   } catch {
     return [];
   }
 }
-function v(t, e) {
-  if (!J(e))
+function I(t, e) {
+  if (!Q(e))
     throw new Error(`Static output file must stay inside the output directory: ${JSON.stringify(e)}.`);
-  const i = w(t), r = w(i, e);
-  if (x(i, r).split(P).includes(".."))
+  const r = h(t), n = h(r, e);
+  if (w(r, n).split(g).includes(".."))
     throw new Error(`Static output file escaped the output directory: ${JSON.stringify(e)}.`);
-  return r;
+  return n;
 }
-function J(t) {
+function Q(t) {
   return !!t && !t.startsWith("/") && !t.startsWith("\\") && !t.split(/[\\/]/).includes("..");
 }
 export {
-  nt as generateStaticOutput,
-  it as staticAdapter
+  de as createStaticPreviewServer,
+  xt as createVercelOutputConfig,
+  me as generateStaticOutput,
+  pe as generateVercelStaticOutput,
+  Ct as staticAdapter,
+  he as vercelStatic
 };
 //# sourceMappingURL=index.js.map