@demiurgejs/core 0.1.1 → 0.2.0-beta.1

package/dist/static/index.js

@@ -1,81 +1,460 @@
-import { mkdir as p, mkdtemp as k, writeFile as E, cp as P, rm as g, readFile as b } from "node:fs/promises";
-import { resolve as w, dirname as O, join as m, relative as M, sep as H } from "node:path";
-import { d as I } from "../chunks/index-BnX9Qxbm.js";
-import { S as $ } from "../chunks/ssr-BJejKlkZ.js";
-import { c as _, a as D, b as U, h as j, r as q, d as x } from "../chunks/testing-DR3eQAvY.js";
+import { readFile as v, mkdir as E, mkdtemp as W, cp as k, writeFile as A, rm as $, rename as rt } from "node:fs/promises";
+import { resolve as h, relative as w, sep as g, extname as nt, dirname as N, join as m } from "node:path";
+import { d as it, S as F } from "../chunks/request-metadata-DwEO1EAS.js";
+import { v as ot, c as st, a as at, h as ct, r as ut, m as ft, b as D, d as lt } from "../chunks/testing-DBjVCN5v.js";
 import "react-dom/server";
 import "react";
 import "react/jsx-runtime";
-import { C as W, I as B, R as G } from "../chunks/static-files-DUjHw-4H.js";
-const C = "demiurge-static-manifest.json", yt = I({
+import { C as _, I as dt, R as ht } from "../chunks/static-files-DUjHw-4H.js";
+import { createServer as pt } from "node:http";
+import { normalizeRoutes as mt, getTransformedRoutes as wt } from "@vercel/routing-utils";
+const yt = "demiurge-static-manifest.json", gt = {
+  ".avif": "image/avif",
+  ".css": "text/css; charset=utf-8",
+  ".gif": "image/gif",
+  ".html": "text/html; charset=utf-8",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain; charset=utf-8",
+  ".webmanifest": "application/manifest+json",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2"
+};
+async function de(t) {
+  const e = h(t.outDir), r = Et(
+    await v(h(e, yt), "utf8")
+  ), n = new Map(
+    r.entries.map((o) => [o.pathname, o])
+  ), i = new Map(
+    r.entries.map((o) => [o.file, o])
+  ), a = r.fileHeaderRules.map((o) => ({
+    ...o,
+    expression: new RegExp(o.pattern)
+  })), c = pt(async (o, s) => {
+    try {
+      if (o.method !== "GET" && o.method !== "HEAD") {
+        s.writeHead(405, { allow: "GET, HEAD" }), s.end();
+        return;
+      }
+      const f = new URL(o.url ?? "/", "http://demiurge.local");
+      let l;
+      try {
+        l = decodeURIComponent(f.pathname);
+      } catch {
+        s.writeHead(400, {
+          "content-type": "text/plain; charset=utf-8"
+        }), s.end("The request path is not valid UTF-8.");
+        return;
+      }
+      const R = l.replace(/\/$/, "") || "/", y = n.get(R);
+      if (y) {
+        await T(e, y, o.method, s);
+        return;
+      }
+      const u = St(e, l);
+      if (u)
+        try {
+          const p = w(e, u).split(g).join("/"), b = i.get(p);
+          if (b) {
+            await T(e, b, o.method, s);
+            return;
+          }
+          const X = await v(u), j = gt[nt(u).toLowerCase()];
+          j && s.setHeader("content-type", j);
+          const Y = l.split("/").at(-1) ?? "", tt = a.find(({ expression: et }) => et.test(Y));
+          U(s, tt?.headers ?? {}), s.writeHead(200), s.end(o.method === "HEAD" ? void 0 : X);
+          return;
+        } catch (p) {
+          if (!Ot(p)) throw p;
+        }
+      const d = n.get("*");
+      if (!d) {
+        s.writeHead(404), s.end();
+        return;
+      }
+      await T(e, d, o.method, s);
+    } catch {
+      s.writeHead(500, {
+        "content-type": "text/plain; charset=utf-8"
+      }), s.end("Demiurge could not serve the static output.");
+    }
+  });
+  return await new Promise((o, s) => {
+    const f = (l) => s(l);
+    c.once("error", f), c.listen(
+      t.port ?? 4173,
+      t.host ?? "localhost",
+      () => {
+        c.off("error", f), o();
+      }
+    );
+  }), c;
+}
+async function T(t, e, r, n) {
+  const i = B(t, e.file), a = await v(i);
+  U(n, e.headers), n.writeHead(e.status), n.end(r === "HEAD" ? void 0 : a);
+}
+function U(t, e) {
+  for (const [r, n] of Object.entries(e))
+    t.setHeader(r, n);
+}
+function St(t, e) {
+  if (!e.endsWith("/"))
+    return V(t, `.${e}`);
+}
+function B(t, e) {
+  const r = V(t, e);
+  if (!r)
+    throw new Error(`Static preview file is outside the output directory: ${JSON.stringify(e)}.`);
+  return r;
+}
+function V(t, e) {
+  if (!e || e.startsWith("/") || e.startsWith("\\") || e.split(/[\\/]/).includes(".."))
+    return;
+  const r = h(t, e), n = w(t, r);
+  return n !== ".." && !n.startsWith(`..${g}`) ? r : void 0;
+}
+function Et(t) {
+  let e;
+  try {
+    e = JSON.parse(t);
+  } catch {
+    throw new Error("The static output manifest is not valid JSON.");
+  }
+  if (!O(e) || e.adapter !== "static" || e.version !== 1)
+    throw new Error("The static output manifest has an unsupported format.");
+  if (!Array.isArray(e.entries) || !Array.isArray(e.fileHeaderRules))
+    throw new Error("The static output manifest does not contain header rules and entries.");
+  const r = e.entries.map(vt), n = e.fileHeaderRules.map($t), i = /* @__PURE__ */ new Set();
+  for (const a of r) {
+    if (i.has(a.pathname))
+      throw new Error(`The static output manifest repeats pathname ${JSON.stringify(a.pathname)}.`);
+    i.add(a.pathname);
+  }
+  return { adapter: "static", entries: r, fileHeaderRules: n, version: 1 };
+}
+function vt(t) {
+  if (!O(t) || typeof t.file != "string" || typeof t.pathname != "string" || t.status !== 200 && t.status !== 404 || !q(t.headers))
+    throw new Error("The static output manifest contains an invalid entry.");
+  return B("/demiurge-manifest-root", t.file), {
+    file: t.file,
+    headers: t.headers,
+    pathname: t.pathname,
+    status: t.status
+  };
+}
+function $t(t) {
+  if (!O(t) || typeof t.pattern != "string" || !q(t.headers))
+    throw new Error("The static output manifest contains an invalid file header rule.");
+  try {
+    new RegExp(t.pattern);
+  } catch {
+    throw new Error("The static output manifest contains an invalid file header pattern.");
+  }
+  return { headers: t.headers, pattern: t.pattern };
+}
+function O(t) {
+  return !!t && typeof t == "object" && !Array.isArray(t);
+}
+function q(t) {
+  return O(t) && Object.values(t).every(
+    (e) => typeof e == "string"
+  );
+}
+function Ot(t) {
+  return t instanceof Error && "code" in t && (t.code === "EISDIR" || t.code === "ENOENT");
+}
+const Rt = "demiurge-manifest.json", Tt = "demiurge-static-manifest.json";
+function he(t = {}) {
+  return {
+    adapter: "vercel",
+    cache: t.cache?.map((e) => ({
+      source: e.source,
+      value: e.value
+    })) ?? []
+  };
+}
+async function pe(t) {
+  Ft(t.deployment);
+  const e = h(t.projectRoot), r = h(t.outDir), n = h(e, ".vercel/output");
+  if (Ht(r, n))
+    throw new Error(
+      "The static output directory must not overlap the Vercel output directory."
+    );
+  const i = N(n);
+  await E(i, { recursive: !0 });
+  const a = await W(m(i, "output-demiurge-"));
+  try {
+    const c = m(a, "static");
+    await k(r, c, {
+      filter: (o) => {
+        const s = w(r, o).split(g).join("/");
+        return s !== Rt && s !== Tt;
+      },
+      recursive: !0
+    }), await A(
+      m(a, "config.json"),
+      `${JSON.stringify(xt(
+        t.manifest,
+        t.deployment
+      ), null, 2)}
+`
+    ), await $(n, { force: !0, recursive: !0 }), await rt(a, n);
+  } catch (c) {
+    throw await $(a, { force: !0, recursive: !0 }), c;
+  }
+  return n;
+}
+function xt(t, e) {
+  const r = t.entries.find((o) => o.pathname === "*");
+  if (!r)
+    throw new Error("Vercel output requires a static fallback entry.");
+  const n = jt(e.cache), i = [];
+  for (const o of t.entries) {
+    if (o.pathname === "*") continue;
+    const s = `/${o.file}`;
+    s !== o.pathname && i.push({
+      continue: !0,
+      dest: o.pathname,
+      src: S(s)
+    });
+  }
+  for (const o of t.entries) {
+    const s = H(o.headers);
+    if (Object.keys(s).length === 0) continue;
+    const f = o.pathname === "*" ? `/${o.file}` : o.pathname;
+    i.push({
+      continue: !0,
+      headers: s,
+      src: S(f)
+    });
+  }
+  i.push(...n);
+  for (const o of t.entries) {
+    if (o.pathname === "*") {
+      i.push({
+        dest: `/${o.file}`,
+        src: S(`/${o.file}`),
+        status: 404
+      });
+      continue;
+    }
+    i.push({
+      dest: o.pathname === "/" ? `/${o.file}` : o.pathname,
+      src: S(o.pathname)
+    });
+  }
+  i.push({ handle: "hit" });
+  for (const o of [...t.fileHeaderRules].reverse())
+    i.push({
+      continue: !0,
+      headers: { ...o.headers },
+      src: Nt(o.pattern)
+    });
+  i.push(...n.map((o) => ({ ...o }))), i.push({ handle: "error" });
+  const a = H(r.headers);
+  Object.keys(a).length > 0 && i.push({
+    continue: !0,
+    headers: a,
+    src: "^/.*$"
+  }), i.push(...n.map((o) => ({ ...o }))), i.push({ dest: `/${r.file}`, src: "^/.*$", status: 404 });
+  const c = mt(i);
+  if (c.error || !c.routes)
+    throw new Error(
+      `Vercel rejected the generated routes: ${c.error?.message ?? "The route list is empty."}`
+    );
+  return {
+    overrides: Object.fromEntries(
+      t.entries.map((o) => [o.file, At(o)])
+    ),
+    routes: c.routes,
+    version: 3
+  };
+}
+function At(t) {
+  const e = {}, r = t.headers["content-type"];
+  if (r && (e.contentType = r), t.pathname !== "*") {
+    const n = t.file === "index.html" ? "/" : `/${t.file}`;
+    t.pathname !== n && (e.path = t.pathname.slice(1));
+  }
+  return e;
+}
+function S(t) {
+  const e = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return t === "/" ? "^/$" : `^${e}/?$`;
+}
+function H(t) {
+  return Object.fromEntries(
+    Object.entries(t).filter(([e]) => e.toLowerCase() !== "content-type")
+  );
+}
+function Nt(t) {
+  return t === ".*" ? "^/.*$" : t === _.source ? "^/(?:.*/)?[^/]*-[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9]+$" : `^/${bt(t)}$`;
+}
+function bt(t) {
+  const e = t.startsWith("^"), r = t.endsWith("$") && !t.endsWith("\\$"), n = t.slice(
+    e ? 1 : 0,
+    r ? -1 : void 0
+  );
+  return `${e ? "(?:.*/)?" : "(?:.*/)?[^/]*"}(?:${n})${r ? "" : "[^/]*"}`;
+}
+function jt(t) {
+  const e = t.map((n) => ({
+    headers: [{ key: "cache-control", value: n.value }],
+    source: n.source
+  })), r = wt({ headers: e });
+  if (r.error || !r.routes)
+    throw new Error(
+      `A Vercel static header rule is not valid: ${r.error?.message ?? "The route list is empty."}`
+    );
+  return r.routes;
+}
+function Ft(t) {
+  if (t.adapter !== "vercel" || !Array.isArray(t.cache))
+    throw new Error("The Vercel static adapter configuration is not valid.");
+  for (const e of t.cache)
+    if (!e || typeof e != "object" || typeof e.source != "string" || !e.source || typeof e.value != "string" || !e.value)
+      throw new Error("A Vercel static header rule is not valid.");
+}
+function Ht(t, e) {
+  const r = w(t, e), n = w(e, t);
+  return C(r) || C(n);
+}
+function C(t) {
+  return !t || t !== ".." && !t.startsWith(`..${g}`) && !t.startsWith("/");
+}
+const G = "demiurge-static-manifest.json", Ct = it({
   name: "static",
   capabilities: {
     staticOutput: !0
   }
-});
-async function Et(t) {
-  const e = z(t.origin), r = w(t.outDir), n = _(t.routes), o = await Q(n), i = await D(n, {
+}), Pt = 8;
+async function Jt(t) {
+  const e = Object.entries(t), r = new Array(e.length);
+  let n = 0;
+  const i = Array.from(
+    { length: Math.min(Pt, e.length) },
+    async () => {
+      for (; n < e.length; ) {
+        const a = n++, [c, o] = e[a];
+        try {
+          r[a] = [c, await o()];
+        } catch (s) {
+          throw new Error(
+            `Demiurge could not load route module ${JSON.stringify(c)}.`,
+            { cause: s }
+          );
+        }
+      }
+    }
+  );
+  return await Promise.all(i), Object.fromEntries(r);
+}
+async function me(t) {
+  const e = await Jt(t.routes), r = ot(e, {
+    adapter: Ct
+  }), n = Wt(t.origin), i = h(t.outDir), a = await Dt(r), c = await st(r, {
     includeResources: !0
   });
-  V(
-    n,
-    i.filter((u) => o.get(u.file) === "document").length
+  kt(
+    r,
+    c.filter((u) => a.get(u.file) === "document").length
   );
-  const c = Z(
-    i.map((u) => ({
-      kind: o.get(u.file) ?? "resource",
+  const o = Bt(
+    c.map((u) => ({
+      kind: a.get(u.file) ?? "resource",
       pathname: u.pathname
     }))
-  ), a = U(), s = [], f = { ...t.ssr, navigation: "document" };
-  for (const u of c) {
-    const l = v(e, u.pathname, u.kind), y = await j(n, l, {
+  ), s = at(), f = [], l = { ...t.ssr, navigation: "document" };
+  for (const u of o) {
+    const d = J(n, u.pathname, u.kind), p = await ct(r, d, {
       onError: t.onError,
-      rateLimitStore: a,
-      ssr: f
+      rateLimitStore: s,
+      ssr: l
     });
-    s.push(
-      u.kind === "document" ? await T(u, y, 200) : await rt(u, y)
+    f.push(
+      u.kind === "document" ? await L(u, p, 200) : await Gt(u, p)
     );
   }
-  const d = await q(
-    n,
-    v(e, "/404", "document"),
+  const R = await ut(
+    r,
+    J(n, "/404", "document"),
     {
-      ...f,
-      onError: (u, l) => t.onError?.(u, { pathname: "/404", site: l })
+      ...l,
+      onError: (u, d) => t.onError?.(u, { pathname: "/404", site: d })
     }
   );
-  s.push(
-    await T(
+  f.push(
+    await L(
       {
         file: "404.html",
         pathname: "*"
       },
-      d,
+      R,
       404
     )
-  ), s.sort((u, l) => u.file.localeCompare(l.file));
-  const S = {
+  ), f.sort((u, d) => u.file.localeCompare(d.file));
+  const y = {
     adapter: "static",
-    entries: s.map(({ body: u, ...l }) => l),
-    fileHeaderRules: K(),
+    entries: f.map(({ body: u, ...d }) => d),
+    fileHeaderRules: await Lt(
+      r,
+      t.staticFileHeaders ?? []
+    ),
     version: 1
   };
-  return await at(r, s, S), S;
+  return await te(i, f, y), y;
 }
-function K() {
+async function Lt(t, e) {
+  const r = await Mt(t), n = P(r);
   return [
+    ...e.map((i) => (It(i.pattern), {
+      headers: P(
+        ft(r, { headers: i.headers })
+      ),
+      pattern: i.pattern
+    })),
     {
-      headers: { "cache-control": B },
-      pattern: W.source
+      headers: {
+        ...n,
+        "cache-control": dt
+      },
+      pattern: _.source
     },
     {
-      headers: { "cache-control": G },
+      headers: {
+        ...n,
+        "cache-control": ht
+      },
       pattern: ".*"
     }
   ];
 }
-function z(t) {
+async function Mt(t) {
+  return { headers: (await t.policies.find(
+    (n) => n.fileSegments.length === 0
+  )?.load())?.policy?.document?.headers };
+}
+function P(t) {
+  return Object.fromEntries(lt(t, {}).entries());
+}
+function It(t) {
+  try {
+    new RegExp(t);
+  } catch {
+    throw new Error(
+      `Static file header pattern is not a valid regular expression: ${JSON.stringify(t)}.`
+    );
+  }
+}
+function Wt(t) {
   let e;
   try {
     e = new URL(t ?? "http://demiurge.local");
@@ -90,7 +469,7 @@ function z(t) {
     );
   return e.origin;
 }
-function V(t, e) {
+function kt(t, e) {
   if (e === 0)
     throw new Error("Static output requires at least one page route.");
   if (!t.fallbacks.notFound.some(
@@ -100,13 +479,13 @@ function V(t, e) {
       "Static output requires a root @not-found.tsx so 404.html is app-owned."
     );
 }
-async function Q(t) {
+async function Dt(t) {
   const e = /* @__PURE__ */ new Map();
   for (const r of t.routes) {
-    const n = await r.load(), o = X(n);
-    if (o.length > 0)
+    const n = await r.load(), i = _t(n);
+    if (i.length > 0)
       throw new Error(
-        `Static route ${JSON.stringify(r.file)} exports unsupported methods ${o.join(", ")}. Deploy a runtime adapter for request-time methods.`
+        `Static route ${JSON.stringify(r.file)} exports unsupported methods ${i.join(", ")}. Deploy a runtime adapter for request-time methods.`
       );
     if (!n.GET)
       throw new Error(
@@ -116,14 +495,14 @@ async function Q(t) {
       e.set(r.file, "document");
       continue;
     }
-    Y(r.file, n.GET), e.set(r.file, "resource");
+    Ut(r.file, n.GET), e.set(r.file, "resource");
   }
   return e;
 }
-function X(t) {
+function _t(t) {
   return ["POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"].filter((e) => t[e] !== void 0);
 }
-function Y(t, e) {
+function Ut(t, e) {
   if ((e.kind === "text" || e.kind === "html" || e.kind === "json") && typeof e.value != "function")
     return;
   const r = "value" in e && typeof e.value == "function" ? `uses a request-dependent ${e.kind} value` : `uses the ${e.kind} response helper`;
@@ -131,23 +510,23 @@ function Y(t, e) {
     `Static route ${JSON.stringify(t)} ${r} and cannot produce a fixed output file. Use a fixed text, html, or json value, or deploy a runtime adapter.`
   );
 }
-function Z(t) {
+function Bt(t) {
   const e = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Set();
-  return t.map(({ kind: n, pathname: o }) => {
-    if (r.has(o))
-      throw new Error(`Static output collected duplicate pathname ${JSON.stringify(o)}.`);
-    r.add(o);
-    const i = n === "document" ? J(o) : tt(o), c = i.toLocaleLowerCase("en-US"), a = [...e.entries()].find(
+  return t.map(({ kind: n, pathname: i }) => {
+    if (r.has(i))
+      throw new Error(`Static output collected duplicate pathname ${JSON.stringify(i)}.`);
+    r.add(i);
+    const a = n === "document" ? z(i) : Vt(i), c = a.toLocaleLowerCase("en-US"), o = [...e.entries()].find(
       ([s]) => s === c || s.startsWith(`${c}/`) || c.startsWith(`${s}/`)
     );
-    if (a)
+    if (o)
       throw new Error(
-        `Static paths ${JSON.stringify(a[1])} and ${JSON.stringify(o)} map to the same portable output file or to a file and directory conflict.`
+        `Static paths ${JSON.stringify(o[1])} and ${JSON.stringify(i)} map to the same portable output file or to a file and directory conflict.`
       );
-    return e.set(c, o), { file: i, kind: n, pathname: o };
+    return e.set(c, i), { file: a, kind: n, pathname: i };
   });
 }
-function J(t) {
+function z(t) {
   if (!t.startsWith("/") || t.includes("?") || t.includes("#"))
     throw new Error(`Static output received invalid pathname ${JSON.stringify(t)}.`);
   return t === "/" ? "index.html" : [...t.split("/").slice(1).map((r) => {
@@ -157,27 +536,27 @@ function J(t) {
     } catch {
       throw new Error(`Static output pathname is not valid UTF-8: ${JSON.stringify(t)}.`);
     }
-    return et(n, t), n;
+    return qt(n, t), n;
   }), "index.html"].join("/");
 }
-function tt(t) {
+function Vt(t) {
   if (t === "/")
     throw new Error("A static resource route cannot own the root pathname.");
-  return J(t).slice(0, -11);
+  return z(t).slice(0, -11);
 }
-function et(t, e) {
+function qt(t, e) {
   const r = /[<>:"|?*]/.test(t) || [...t].some((n) => n.charCodeAt(0) <= 31) || /[. ]$/.test(t) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(t);
   if (!t || t === "." || t === ".." || t.includes("/") || t.includes("\\") || r)
     throw new Error(
       `Static pathname ${JSON.stringify(e)} contains a segment that is unsafe or not portable as a file name: ${JSON.stringify(t)}.`
     );
 }
-function v(t, e, r) {
+function J(t, e, r) {
   return new Request(`${t}${e}`, {
     headers: { accept: r === "document" ? "text/html" : "*/*" }
   });
 }
-async function T(t, e, r) {
+async function L(t, e, r) {
   if (e.status !== r)
     throw new Error(
       `Static output for ${JSON.stringify(t.pathname)} returned status ${e.status}; expected ${r}.`
@@ -191,19 +570,19 @@ async function T(t, e, r) {
     throw new Error(
       `Static output for ${JSON.stringify(t.pathname)} attempted to set a cookie. Build artifacts cannot contain per-user response state.`
     );
-  const o = await nt(
+  const i = await zt(
     await e.text(),
     e.headers
   );
-  return await it(t.pathname, o, e.headers), {
+  return await Zt(t.pathname, i, e.headers), {
     file: t.file,
-    headers: A(e.headers),
-    body: o,
+    headers: Z(e.headers),
+    body: i,
     pathname: t.pathname,
     status: r
   };
 }
-async function rt(t, e) {
+async function Gt(t, e) {
   if (e.status !== 200)
     throw new Error(
       `Static output for ${JSON.stringify(t.pathname)} returned status ${e.status}; expected 200.`
@@ -214,48 +593,48 @@ async function rt(t, e) {
     );
   return {
     file: t.file,
-    headers: A(e.headers),
+    headers: Z(e.headers),
     body: await e.text(),
     pathname: t.pathname,
     status: 200
   };
 }
-async function nt(t, e) {
+async function zt(t, e) {
   const r = new RegExp(
-    `(?:^|\\s)${$}(?:\\s|$)`
-  ), n = F(t, "script").filter((i) => r.test(i.attributes));
+    `(?:^|\\s)${F}(?:\\s|$)`
+  ), n = K(t, "script").filter((a) => r.test(a.attributes));
   if (n.length === 0)
     return t;
-  const o = await Promise.all(
-    n.map((i) => x(i.content))
+  const i = await Promise.all(
+    n.map((a) => D(a.content))
   );
-  for (const i of [
+  for (const a of [
     "content-security-policy",
     "content-security-policy-report-only"
   ]) {
-    const c = e.get(i);
-    c && e.set(i, ot(c, o));
+    const c = e.get(a);
+    c && e.set(a, Kt(c, i));
   }
   return t.replace(
-    new RegExp(`\\s${$}(?=\\s|>)`, "g"),
+    new RegExp(`\\s${F}(?=\\s|>)`, "g"),
     ""
   );
 }
-function ot(t, e) {
+function Kt(t, e) {
   const r = t.split(";").map((s) => s.trim()).filter(Boolean), n = r.findIndex(
     (s) => s.split(/\s+/, 1)[0]?.toLowerCase() === "script-src"
-  ), o = r.find(
+  ), i = r.find(
     (s) => s.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
-  ), i = n === -1 ? o : r[n];
-  if (!i)
+  ), a = n === -1 ? i : r[n];
+  if (!a)
     return t;
-  const c = i.split(/\s+/).slice(1).filter((s) => s !== "'none'"), a = [
+  const c = a.split(/\s+/).slice(1).filter((s) => s !== "'none'"), o = [
     "script-src",
     .../* @__PURE__ */ new Set([...c, ...e])
   ].join(" ");
-  return n === -1 ? r.push(a) : r[n] = a, r.join("; ");
+  return n === -1 ? r.push(o) : r[n] = o, r.join("; ");
 }
-async function it(t, e, r) {
+async function Zt(t, e, r) {
   const n = r.get("content-security-policy");
   if (!n)
     return;
@@ -263,115 +642,176 @@ async function it(t, e, r) {
     throw new Error(
       `Static output for ${JSON.stringify(t)} uses a nonce-backed CSP. Use security.static() with stable hashes or a runtime adapter that injects a fresh nonce.`
     );
-  const o = st(n);
-  await N(
+  const i = Qt(n);
+  await M(
     t,
     e,
     "script",
-    h(o, "script-src")
-  ), await N(
+    x(i, "script-src", "default-src")
+  ), await M(
     t,
     e,
     "style",
-    h(o, "style-src")
+    x(
+      i,
+      "style-src-elem",
+      "style-src",
+      "default-src"
+    )
   );
-  const i = h(o, "style-src");
-  if (i && /\sstyle\s*=/i.test(e) && !i.includes("'unsafe-inline'"))
+  const a = x(
+    i,
+    "style-src-attr",
+    "style-src",
+    "default-src"
+  );
+  if (a && /\sstyle\s*=/i.test(e) && !a.includes("'unsafe-inline'"))
     throw new Error(
       `Static output for ${JSON.stringify(t)} contains an inline style attribute that its CSP does not allow. Move the style into a stylesheet or explicitly allow inline styles.`
     );
 }
-function st(t) {
+function Qt(t) {
   const e = /* @__PURE__ */ new Map();
   for (const r of t.split(";")) {
-    const [n, ...o] = r.trim().split(/\s+/);
-    n && e.set(n.toLowerCase(), o);
+    const [n, ...i] = r.trim().split(/\s+/);
+    n && e.set(n.toLowerCase(), i);
   }
   return e;
 }
-function h(t, e) {
-  return t.get(e) ?? t.get("default-src");
+function x(t, ...e) {
+  for (const r of e) {
+    const n = t.get(r);
+    if (n)
+      return n;
+  }
 }
-async function N(t, e, r, n) {
+async function M(t, e, r, n) {
   if (!(!n || n.includes("'unsafe-inline'")))
-    for (const o of F(e, r)) {
-      if (r === "script" && /(?:^|\s)src\s*=/i.test(o.attributes) || !o.content)
+    for (const i of K(e, r)) {
+      if (r === "script") {
+        const c = Xt(i.attributes, "src");
+        if (c) {
+          if (!Yt(n, c))
+            throw new Error(
+              `Static output for ${JSON.stringify(t)} contains script ${JSON.stringify(c)} that the effective script-src directive does not allow. Add its origin to security.needs.script or the route CSP policy.`
+            );
+          continue;
+        }
+      }
+      if (!i.content)
         continue;
-      const i = await x(o.content);
-      if (!n.includes(i))
+      const a = await D(i.content);
+      if (!n.includes(a))
         throw new Error(
-          `Static output for ${JSON.stringify(t)} contains an inline ${r} without the required CSP hash ${i}.`
+          `Static output for ${JSON.stringify(t)} contains an inline ${r} without the required CSP hash ${a}.`
         );
     }
 }
-function F(t, e) {
-  const r = t.toLowerCase(), n = [], o = `<${e}`, i = `</${e}`;
+function Xt(t, e) {
+  return t.match(
+    new RegExp(`(?:^|\\s)${e}\\s*=\\s*["']([^"']+)["']`, "i")
+  )?.[1]?.replaceAll("&amp;", "&");
+}
+function Yt(t, e) {
+  if (!t)
+    return !0;
+  if (t.includes("'none'") || t.includes("'strict-dynamic'") && t.some(
+    (n) => n.startsWith("'nonce-") || /^'sha(?:256|384|512)-/.test(n)
+  ))
+    return !1;
+  if (t.includes("*") || t.includes("'self'") && e.startsWith("/") && !e.startsWith("//") || e.startsWith("https:") && t.includes("https:") || e.startsWith("http:") && t.includes("http:"))
+    return !0;
+  let r;
+  try {
+    r = new URL(e, "https://demiurge.invalid");
+  } catch {
+    return !1;
+  }
+  return t.some((n) => {
+    if (n.startsWith("'"))
+      return !1;
+    let i;
+    try {
+      i = new URL(n);
+    } catch {
+      return !1;
+    }
+    const a = i.hostname.startsWith("*.") ? r.hostname.endsWith(i.hostname.slice(1)) && r.hostname !== i.hostname.slice(2) : r.hostname === i.hostname, c = i.pathname === "/" || i.pathname.endsWith("/") ? r.pathname.startsWith(i.pathname) : r.pathname === i.pathname;
+    return r.protocol === i.protocol && a && r.port === i.port && c;
+  });
+}
+function K(t, e) {
+  const r = t.toLowerCase(), n = [], i = `<${e}`, a = `</${e}`;
   let c = 0;
   for (; c < t.length; ) {
-    const a = r.indexOf(o, c);
-    if (a === -1)
+    const o = r.indexOf(i, c);
+    if (o === -1)
       break;
-    const s = r.indexOf(">", a + o.length), f = s === -1 ? -1 : r.indexOf(i, s + 1), d = f === -1 ? -1 : r.indexOf(">", f + i.length);
-    if (s === -1 || f === -1 || d === -1)
+    const s = r.indexOf(">", o + i.length), f = s === -1 ? -1 : r.indexOf(a, s + 1), l = f === -1 ? -1 : r.indexOf(">", f + a.length);
+    if (s === -1 || f === -1 || l === -1)
       throw new Error(`Static output contains an unclosed <${e}> element.`);
     n.push({
-      attributes: t.slice(a + o.length, s),
+      attributes: t.slice(o + i.length, s),
       content: t.slice(s + 1, f)
-    }), c = d + 1;
+    }), c = l + 1;
   }
   return n;
 }
-function A(t) {
+function Z(t) {
   return Object.fromEntries(
     [...t.entries()].sort(([e], [r]) => e.localeCompare(r))
   );
 }
-async function at(t, e, r) {
-  const n = O(t);
-  await p(n, { recursive: !0 });
-  const o = await k(m(n, ".demiurge-static-"));
+async function te(t, e, r) {
+  const n = N(t);
+  await E(n, { recursive: !0 });
+  const i = await W(m(n, ".demiurge-static-"));
   try {
-    for (const a of e) {
-      const s = R(o, a.file);
-      await p(O(s), { recursive: !0 }), await E(s, a.body);
+    for (const o of e) {
+      const s = I(i, o.file);
+      await E(N(s), { recursive: !0 }), await A(s, o.body);
     }
-    await E(
-      m(o, C),
+    await A(
+      m(i, G),
       `${JSON.stringify(r, null, 2)}
 `
     );
-    const i = await ct(t);
-    await p(t, { recursive: !0 }), await P(o, t, { recursive: !0, force: !0 });
-    const c = new Set(e.map((a) => a.file));
-    for (const a of i)
-      c.has(a) || await g(R(t, a), { force: !0 });
+    const a = await ee(t);
+    await E(t, { recursive: !0 }), await k(i, t, { recursive: !0, force: !0 });
+    const c = new Set(e.map((o) => o.file));
+    for (const o of a)
+      c.has(o) || await $(I(t, o), { force: !0 });
   } finally {
-    await g(o, { force: !0, recursive: !0 });
+    await $(i, { force: !0, recursive: !0 });
   }
 }
-async function ct(t) {
+async function ee(t) {
   try {
-    const e = await b(m(t, C), "utf8"), r = JSON.parse(e);
+    const e = await v(m(t, G), "utf8"), r = JSON.parse(e);
     return r.adapter !== "static" || r.version !== 1 || !Array.isArray(r.entries) ? [] : r.entries.flatMap(
-      (n) => typeof n.file == "string" && L(n.file) ? [n.file] : []
+      (n) => typeof n.file == "string" && Q(n.file) ? [n.file] : []
     );
   } catch {
     return [];
   }
 }
-function R(t, e) {
-  if (!L(e))
+function I(t, e) {
+  if (!Q(e))
     throw new Error(`Static output file must stay inside the output directory: ${JSON.stringify(e)}.`);
-  const r = w(t), n = w(r, e);
-  if (M(r, n).split(H).includes(".."))
+  const r = h(t), n = h(r, e);
+  if (w(r, n).split(g).includes(".."))
     throw new Error(`Static output file escaped the output directory: ${JSON.stringify(e)}.`);
   return n;
 }
-function L(t) {
+function Q(t) {
   return !!t && !t.startsWith("/") && !t.startsWith("\\") && !t.split(/[\\/]/).includes("..");
 }
 export {
-  Et as generateStaticOutput,
-  yt as staticAdapter
+  de as createStaticPreviewServer,
+  xt as createVercelOutputConfig,
+  me as generateStaticOutput,
+  pe as generateVercelStaticOutput,
+  Ct as staticAdapter,
+  he as vercelStatic
 };
 //# sourceMappingURL=index.js.map