@demiurgejs/core 0.1.1 → 0.2.0-beta.2

package/dist/static/index.js

@@ -1,81 +1,559 @@
-import { mkdir as p, mkdtemp as k, writeFile as E, cp as P, rm as g, readFile as b } from "node:fs/promises";
-import { resolve as w, dirname as O, join as m, relative as M, sep as H } from "node:path";
-import { d as I } from "../chunks/index-BnX9Qxbm.js";
-import { S as $ } from "../chunks/ssr-BJejKlkZ.js";
-import { c as _, a as D, b as U, h as j, r as q, d as x } from "../chunks/testing-DR3eQAvY.js";
+import { readFile as O, mkdir as T, mkdtemp as k, cp as D, writeFile as b, rm as A, rename as nt } from "node:fs/promises";
+import { resolve as h, relative as w, sep as S, extname as it, dirname as C, join as y } from "node:path";
+import { d as ot, S as P } from "../chunks/request-metadata-D5NrT8ks.js";
+import { v as st, a as at, b as ct, d as ut, h as lt, r as ft, m as dt, e as _, f as ht } from "../chunks/testing-B_iMFYz_.js";
 import "react-dom/server";
 import "react";
 import "react/jsx-runtime";
-import { C as W, I as B, R as G } from "../chunks/static-files-DUjHw-4H.js";
-const C = "demiurge-static-manifest.json", yt = I({
+import { C as U, I as pt, R as mt } from "../chunks/static-files-DUjHw-4H.js";
+import { t as wt, n as gt, r as yt } from "../chunks/image-codec-BGTx_t5K.js";
+import { e as V, g as St, p as Et, h as $t } from "../chunks/images-B9MqcjSA.js";
+import { createServer as vt } from "node:http";
+import { normalizeRoutes as Ot, getTransformedRoutes as Rt } from "@vercel/routing-utils";
+async function Tt(t) {
+  const e = h(t.outDir), r = t.policy ?? {}, n = r.optimizerPath ?? V, o = new Set(
+    t.documents.flatMap(
+      (a) => St(a, n)
+    )
+  ), s = [], c = /* @__PURE__ */ new Map();
+  for (const a of [...o].sort()) {
+    const i = Et(a, n);
+    if (!i)
+      throw new Error(
+        `Static output references image variant ${JSON.stringify(a)}, which does not describe a transform the build can emit.`
+      );
+    if (!$t(i.src, r))
+      throw new Error(
+        `Image source ${JSON.stringify(i.src)} is not allowed by the image policy.`
+      );
+    const u = Ft(e, i.src);
+    let f = c.get(u);
+    f || (f = await Nt(u, i.src), c.set(u, f));
+    const E = await wt(f, {
+      format: gt(i, null),
+      quality: i.quality,
+      width: i.width
+    });
+    s.push({ body: E.body, file: a.slice(1) });
+  }
+  return s;
+}
+function At(t, e = {}) {
+  const r = e.optimizerPath ?? V, n = new RegExp(`${r.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\?`);
+  for (const o of t)
+    if (n.test(o))
+      throw new Error(
+        'Static output references the request-time image optimizer, which a static build cannot serve. Set loader: "static" in the image policy, or deploy a runtime adapter.'
+      );
+}
+async function Nt(t, e) {
+  try {
+    return new Uint8Array(await O(t));
+  } catch (r) {
+    throw new Error(
+      `Demiurge could not read the source image ${JSON.stringify(e)} from the build output.`,
+      { cause: r }
+    );
+  }
+}
+function Ft(t, e) {
+  let r;
+  try {
+    r = decodeURIComponent(e);
+  } catch {
+    throw new Error(`Image source is not valid UTF-8: ${JSON.stringify(e)}.`);
+  }
+  const n = h(t, `.${r}`);
+  if (w(t, n).split(S).includes(".."))
+    throw new Error(
+      `Image source escaped the build output directory: ${JSON.stringify(e)}.`
+    );
+  return n;
+}
+const xt = "demiurge-static-manifest.json", bt = {
+  ".avif": "image/avif",
+  ".css": "text/css; charset=utf-8",
+  ".gif": "image/gif",
+  ".html": "text/html; charset=utf-8",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".txt": "text/plain; charset=utf-8",
+  ".webmanifest": "application/manifest+json",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2"
+};
+async function Ne(t) {
+  const e = h(t.outDir), r = Pt(
+    await O(h(e, xt), "utf8")
+  ), n = new Map(
+    r.entries.map((a) => [a.pathname, a])
+  ), o = new Map(
+    r.entries.map((a) => [a.file, a])
+  ), s = r.fileHeaderRules.map((a) => ({
+    ...a,
+    expression: new RegExp(a.pattern)
+  })), c = vt(async (a, i) => {
+    try {
+      if (a.method !== "GET" && a.method !== "HEAD") {
+        i.writeHead(405, { allow: "GET, HEAD" }), i.end();
+        return;
+      }
+      const u = new URL(a.url ?? "/", "http://demiurge.local");
+      let f;
+      try {
+        f = decodeURIComponent(u.pathname);
+      } catch {
+        i.writeHead(400, {
+          "content-type": "text/plain; charset=utf-8"
+        }), i.end("The request path is not valid UTF-8.");
+        return;
+      }
+      const E = f.replace(/\/$/, "") || "/", $ = n.get(E);
+      if ($) {
+        await F(e, $, a.method, i);
+        return;
+      }
+      const p = Ct(e, f);
+      if (p)
+        try {
+          const m = w(e, p).split(S).join("/"), l = o.get(m);
+          if (l) {
+            await F(e, l, a.method, i);
+            return;
+          }
+          const d = await O(p), v = bt[it(p).toLowerCase()];
+          v && i.setHeader("content-type", v);
+          const tt = f.split("/").at(-1) ?? "", et = s.find(({ expression: rt }) => rt.test(tt));
+          z(i, et?.headers ?? {}), i.writeHead(200), i.end(a.method === "HEAD" ? void 0 : d);
+          return;
+        } catch (m) {
+          if (!Ht(m)) throw m;
+        }
+      const g = n.get("*");
+      if (!g) {
+        i.writeHead(404), i.end();
+        return;
+      }
+      await F(e, g, a.method, i);
+    } catch {
+      i.writeHead(500, {
+        "content-type": "text/plain; charset=utf-8"
+      }), i.end("Demiurge could not serve the static output.");
+    }
+  });
+  return await new Promise((a, i) => {
+    const u = (f) => i(f);
+    c.once("error", u), c.listen(
+      t.port ?? 4173,
+      t.host ?? "localhost",
+      () => {
+        c.off("error", u), a();
+      }
+    );
+  }), c;
+}
+async function F(t, e, r, n) {
+  const o = q(t, e.file), s = await O(o);
+  z(n, e.headers), n.writeHead(e.status), n.end(r === "HEAD" ? void 0 : s);
+}
+function z(t, e) {
+  for (const [r, n] of Object.entries(e))
+    t.setHeader(r, n);
+}
+function Ct(t, e) {
+  if (!e.endsWith("/"))
+    return B(t, `.${e}`);
+}
+function q(t, e) {
+  const r = B(t, e);
+  if (!r)
+    throw new Error(`Static preview file is outside the output directory: ${JSON.stringify(e)}.`);
+  return r;
+}
+function B(t, e) {
+  if (!e || e.startsWith("/") || e.startsWith("\\") || e.split(/[\\/]/).includes(".."))
+    return;
+  const r = h(t, e), n = w(t, r);
+  return n !== ".." && !n.startsWith(`..${S}`) ? r : void 0;
+}
+function Pt(t) {
+  let e;
+  try {
+    e = JSON.parse(t);
+  } catch {
+    throw new Error("The static output manifest is not valid JSON.");
+  }
+  if (!N(e) || e.adapter !== "static" || e.version !== 1)
+    throw new Error("The static output manifest has an unsupported format.");
+  if (!Array.isArray(e.entries) || !Array.isArray(e.fileHeaderRules))
+    throw new Error("The static output manifest does not contain header rules and entries.");
+  const r = e.entries.map(It), n = e.fileHeaderRules.map(jt), o = /* @__PURE__ */ new Set();
+  for (const s of r) {
+    if (o.has(s.pathname))
+      throw new Error(`The static output manifest repeats pathname ${JSON.stringify(s.pathname)}.`);
+    o.add(s.pathname);
+  }
+  return { adapter: "static", entries: r, fileHeaderRules: n, version: 1 };
+}
+function It(t) {
+  if (!N(t) || typeof t.file != "string" || typeof t.pathname != "string" || t.status !== 200 && t.status !== 404 || !G(t.headers))
+    throw new Error("The static output manifest contains an invalid entry.");
+  return q("/demiurge-manifest-root", t.file), {
+    file: t.file,
+    headers: t.headers,
+    pathname: t.pathname,
+    status: t.status
+  };
+}
+function jt(t) {
+  if (!N(t) || typeof t.pattern != "string" || !G(t.headers))
+    throw new Error("The static output manifest contains an invalid file header rule.");
+  try {
+    new RegExp(t.pattern);
+  } catch {
+    throw new Error("The static output manifest contains an invalid file header pattern.");
+  }
+  return { headers: t.headers, pattern: t.pattern };
+}
+function N(t) {
+  return !!t && typeof t == "object" && !Array.isArray(t);
+}
+function G(t) {
+  return N(t) && Object.values(t).every(
+    (e) => typeof e == "string"
+  );
+}
+function Ht(t) {
+  return t instanceof Error && "code" in t && (t.code === "EISDIR" || t.code === "ENOENT");
+}
+const Jt = "demiurge-manifest.json", Mt = "demiurge-static-manifest.json";
+function Fe(t = {}) {
+  return {
+    adapter: "vercel",
+    cache: t.cache?.map((e) => ({
+      source: e.source,
+      value: e.value
+    })) ?? [],
+    cors: t.cors
+  };
+}
+async function xe(t) {
+  Vt(t.deployment);
+  const e = h(t.projectRoot), r = h(t.outDir), n = h(e, ".vercel/output");
+  if (zt(r, n))
+    throw new Error(
+      "The static output directory must not overlap the Vercel output directory."
+    );
+  const o = C(n);
+  await T(o, { recursive: !0 });
+  const s = await k(y(o, "output-demiurge-"));
+  try {
+    const c = y(s, "static");
+    await D(r, c, {
+      filter: (a) => {
+        const i = w(r, a).split(S).join("/");
+        return i !== Jt && i !== Mt;
+      },
+      recursive: !0
+    }), await b(
+      y(s, "config.json"),
+      `${JSON.stringify(Lt(
+        t.manifest,
+        t.deployment
+      ), null, 2)}
+`
+    ), await A(n, { force: !0, recursive: !0 }), await nt(s, n);
+  } catch (c) {
+    throw await A(s, { force: !0, recursive: !0 }), c;
+  }
+  return n;
+}
+function Lt(t, e) {
+  const r = t.entries.find((i) => i.pathname === "*");
+  if (!r)
+    throw new Error("Vercel output requires a static fallback entry.");
+  const n = _t(e.cache), s = [
+    {
+      continue: !0,
+      headers: { "access-control-allow-origin": Ut(e.cors, t.origin) },
+      src: "^/.*$"
+    }
+  ];
+  for (const i of t.entries) {
+    if (i.pathname === "*") continue;
+    const u = `/${i.file}`;
+    u !== i.pathname && s.push({
+      continue: !0,
+      dest: i.pathname,
+      src: R(u)
+    });
+  }
+  for (const i of t.entries) {
+    const u = I(i.headers);
+    if (Object.keys(u).length === 0) continue;
+    const f = i.pathname === "*" ? `/${i.file}` : i.pathname;
+    s.push({
+      continue: !0,
+      headers: u,
+      src: R(f)
+    });
+  }
+  s.push(...n);
+  for (const i of t.entries) {
+    if (i.pathname === "*") {
+      s.push({
+        dest: `/${i.file}`,
+        src: R(`/${i.file}`),
+        status: 404
+      });
+      continue;
+    }
+    s.push({
+      dest: i.pathname === "/" ? `/${i.file}` : i.pathname,
+      src: R(i.pathname)
+    });
+  }
+  s.push({ handle: "hit" });
+  for (const i of [...t.fileHeaderRules].reverse())
+    s.push({
+      continue: !0,
+      headers: { ...i.headers },
+      src: kt(i.pattern)
+    });
+  s.push(...n.map((i) => ({ ...i }))), s.push({ handle: "error" });
+  const c = I(r.headers);
+  Object.keys(c).length > 0 && s.push({
+    continue: !0,
+    headers: c,
+    src: "^/.*$"
+  }), s.push(...n.map((i) => ({ ...i }))), s.push({ dest: `/${r.file}`, src: "^/.*$", status: 404 });
+  const a = Ot(s);
+  if (a.error || !a.routes)
+    throw new Error(
+      `Vercel rejected the generated routes: ${a.error?.message ?? "The route list is empty."}`
+    );
+  return {
+    overrides: Object.fromEntries(
+      t.entries.map((i) => [i.file, Wt(i)])
+    ),
+    routes: a.routes,
+    version: 3
+  };
+}
+function Wt(t) {
+  const e = {}, r = t.headers["content-type"];
+  if (r && (e.contentType = r), t.pathname !== "*") {
+    const n = t.file === "index.html" ? "/" : `/${t.file}`;
+    t.pathname !== n && (e.path = t.pathname.slice(1));
+  }
+  return e;
+}
+function R(t) {
+  const e = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return t === "/" ? "^/$" : `^${e}/?$`;
+}
+function I(t) {
+  return Object.fromEntries(
+    Object.entries(t).filter(([e]) => e.toLowerCase() !== "content-type")
+  );
+}
+function kt(t) {
+  return t === ".*" ? "^/.*$" : t === U.source ? "^/(?:.*/)?[^/]*-[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9]+$" : `^/${Dt(t)}$`;
+}
+function Dt(t) {
+  const e = t.startsWith("^"), r = t.endsWith("$") && !t.endsWith("\\$"), n = t.slice(
+    e ? 1 : 0,
+    r ? -1 : void 0
+  );
+  return `${e ? "(?:.*/)?" : "(?:.*/)?[^/]*"}(?:${n})${r ? "" : "[^/]*"}`;
+}
+function _t(t) {
+  const e = t.map((n) => ({
+    headers: [{ key: "cache-control", value: n.value }],
+    source: n.source
+  })), r = Rt({ headers: e });
+  if (r.error || !r.routes)
+    throw new Error(
+      `A Vercel static header rule is not valid: ${r.error?.message ?? "The route list is empty."}`
+    );
+  return r.routes;
+}
+function Ut(t, e) {
+  if (t) {
+    if (st(t), t.origins === "*")
+      return "*";
+    if (t.origins.length === 1)
+      return t.origins[0];
+    throw new Error(
+      "A Vercel static CORS policy must declare the wildcard origin or exactly one origin. A static response cannot vary access-control-allow-origin by request."
+    );
+  }
+  if (!e)
+    throw new Error(
+      "Vercel static output requires a build origin to emit access-control-allow-origin. Pass --origin, set SITE_ORIGIN, or declare a Vercel CORS policy."
+    );
+  return e;
+}
+function Vt(t) {
+  if (t.adapter !== "vercel" || !Array.isArray(t.cache))
+    throw new Error("The Vercel static adapter configuration is not valid.");
+  for (const e of t.cache)
+    if (!e || typeof e != "object" || typeof e.source != "string" || !e.source || typeof e.value != "string" || !e.value)
+      throw new Error("A Vercel static header rule is not valid.");
+}
+function zt(t, e) {
+  const r = w(t, e), n = w(e, t);
+  return j(r) || j(n);
+}
+function j(t) {
+  return !t || t !== ".." && !t.startsWith(`..${S}`) && !t.startsWith("/");
+}
+const K = "demiurge-static-manifest.json", qt = ot({
   name: "static",
   capabilities: {
     staticOutput: !0
   }
-});
-async function Et(t) {
-  const e = z(t.origin), r = w(t.outDir), n = _(t.routes), o = await Q(n), i = await D(n, {
+}), Bt = 8;
+async function Gt(t) {
+  const e = Object.entries(t), r = new Array(e.length);
+  let n = 0;
+  const o = Array.from(
+    { length: Math.min(Bt, e.length) },
+    async () => {
+      for (; n < e.length; ) {
+        const s = n++, [c, a] = e[s];
+        try {
+          r[s] = [c, await a()];
+        } catch (i) {
+          throw new Error(
+            `Demiurge could not load route module ${JSON.stringify(c)}.`,
+            { cause: i }
+          );
+        }
+      }
+    }
+  );
+  return await Promise.all(o), Object.fromEntries(r);
+}
+async function be(t) {
+  const e = await Gt(t.routes), r = at(e, {
+    adapter: qt
+  }), n = Xt(t.origin), o = h(t.outDir), s = await te(r), c = await ct(r, {
     includeResources: !0
   });
-  V(
-    n,
-    i.filter((u) => o.get(u.file) === "document").length
+  Yt(
+    r,
+    c.filter((l) => s.get(l.file) === "document").length
   );
-  const c = Z(
-    i.map((u) => ({
-      kind: o.get(u.file) ?? "resource",
-      pathname: u.pathname
+  const a = ne(
+    c.map((l) => ({
+      kind: s.get(l.file) ?? "resource",
+      pathname: l.pathname
     }))
-  ), a = U(), s = [], f = { ...t.ssr, navigation: "document" };
-  for (const u of c) {
-    const l = v(e, u.pathname, u.kind), y = await j(n, l, {
+  ), i = ut(), u = [], f = { ...t.ssr, navigation: "document" };
+  for (const l of a) {
+    const d = J(n, l.pathname, l.kind), v = await lt(r, d, {
       onError: t.onError,
-      rateLimitStore: a,
+      rateLimitStore: i,
       ssr: f
     });
-    s.push(
-      u.kind === "document" ? await T(u, y, 200) : await rt(u, y)
+    u.push(
+      l.kind === "document" ? await M(l, v, 200) : await se(l, v)
     );
   }
-  const d = await q(
-    n,
-    v(e, "/404", "document"),
+  const E = await ft(
+    r,
+    J(n, "/404", "document"),
     {
       ...f,
-      onError: (u, l) => t.onError?.(u, { pathname: "/404", site: l })
+      onError: (l, d) => t.onError?.(l, { pathname: "/404", site: d })
     }
   );
-  s.push(
-    await T(
+  u.push(
+    await M(
       {
         file: "404.html",
         pathname: "*"
       },
-      d,
+      E,
       404
     )
-  ), s.sort((u, l) => u.file.localeCompare(l.file));
-  const S = {
+  );
+  const $ = u.map((l) => l.body);
+  At($, t.images);
+  const p = await Tt({
+    documents: $,
+    outDir: o,
+    policy: t.images
+  }), g = await yt({
+    fonts: t.fonts,
+    root: t.root ?? process.cwd()
+  });
+  u.sort((l, d) => l.file.localeCompare(d.file)), p.sort((l, d) => l.file.localeCompare(d.file)), g.sort((l, d) => l.file.localeCompare(d.file));
+  const m = {
     adapter: "static",
-    entries: s.map(({ body: u, ...l }) => l),
-    fileHeaderRules: K(),
+    entries: u.map(({ body: l, ...d }) => d),
+    fileHeaderRules: await Kt(
+      r,
+      t.staticFileHeaders ?? []
+    ),
+    fontFiles: g.map((l) => l.file),
+    imageFiles: p.map((l) => l.file),
+    origin: n,
     version: 1
   };
-  return await at(r, s, S), S;
+  return await he(o, u, [...p, ...g], m), m;
 }
-function K() {
+async function Kt(t, e) {
+  const r = await Zt(t), n = H(r);
   return [
+    ...e.map((o) => (Qt(o.pattern), {
+      headers: H(
+        dt(r, { headers: o.headers })
+      ),
+      pattern: o.pattern
+    })),
     {
-      headers: { "cache-control": B },
-      pattern: W.source
+      headers: {
+        ...n,
+        "cache-control": pt
+      },
+      pattern: U.source
     },
     {
-      headers: { "cache-control": G },
+      headers: {
+        ...n,
+        "cache-control": mt
+      },
       pattern: ".*"
     }
   ];
 }
-function z(t) {
+async function Zt(t) {
+  return { headers: (await t.policies.find(
+    (n) => n.fileSegments.length === 0
+  )?.load())?.policy?.document?.headers };
+}
+function H(t) {
+  return Object.fromEntries(ht(t, {}).entries());
+}
+function Qt(t) {
+  try {
+    new RegExp(t);
+  } catch {
+    throw new Error(
+      `Static file header pattern is not a valid regular expression: ${JSON.stringify(t)}.`
+    );
+  }
+}
+function Xt(t) {
   let e;
   try {
     e = new URL(t ?? "http://demiurge.local");
@@ -90,7 +568,7 @@ function z(t) {
     );
   return e.origin;
 }
-function V(t, e) {
+function Yt(t, e) {
   if (e === 0)
     throw new Error("Static output requires at least one page route.");
   if (!t.fallbacks.notFound.some(
@@ -100,10 +578,10 @@ function V(t, e) {
       "Static output requires a root @not-found.tsx so 404.html is app-owned."
     );
 }
-async function Q(t) {
+async function te(t) {
   const e = /* @__PURE__ */ new Map();
   for (const r of t.routes) {
-    const n = await r.load(), o = X(n);
+    const n = await r.load(), o = ee(n);
     if (o.length > 0)
       throw new Error(
         `Static route ${JSON.stringify(r.file)} exports unsupported methods ${o.join(", ")}. Deploy a runtime adapter for request-time methods.`
@@ -116,14 +594,14 @@ async function Q(t) {
       e.set(r.file, "document");
       continue;
     }
-    Y(r.file, n.GET), e.set(r.file, "resource");
+    re(r.file, n.GET), e.set(r.file, "resource");
   }
   return e;
 }
-function X(t) {
+function ee(t) {
   return ["POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"].filter((e) => t[e] !== void 0);
 }
-function Y(t, e) {
+function re(t, e) {
   if ((e.kind === "text" || e.kind === "html" || e.kind === "json") && typeof e.value != "function")
     return;
   const r = "value" in e && typeof e.value == "function" ? `uses a request-dependent ${e.kind} value` : `uses the ${e.kind} response helper`;
@@ -131,23 +609,23 @@ function Y(t, e) {
     `Static route ${JSON.stringify(t)} ${r} and cannot produce a fixed output file. Use a fixed text, html, or json value, or deploy a runtime adapter.`
   );
 }
-function Z(t) {
+function ne(t) {
   const e = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Set();
   return t.map(({ kind: n, pathname: o }) => {
     if (r.has(o))
       throw new Error(`Static output collected duplicate pathname ${JSON.stringify(o)}.`);
     r.add(o);
-    const i = n === "document" ? J(o) : tt(o), c = i.toLocaleLowerCase("en-US"), a = [...e.entries()].find(
-      ([s]) => s === c || s.startsWith(`${c}/`) || c.startsWith(`${s}/`)
+    const s = n === "document" ? Z(o) : ie(o), c = s.toLocaleLowerCase("en-US"), a = [...e.entries()].find(
+      ([i]) => i === c || i.startsWith(`${c}/`) || c.startsWith(`${i}/`)
     );
     if (a)
       throw new Error(
         `Static paths ${JSON.stringify(a[1])} and ${JSON.stringify(o)} map to the same portable output file or to a file and directory conflict.`
       );
-    return e.set(c, o), { file: i, kind: n, pathname: o };
+    return e.set(c, o), { file: s, kind: n, pathname: o };
   });
 }
-function J(t) {
+function Z(t) {
   if (!t.startsWith("/") || t.includes("?") || t.includes("#"))
     throw new Error(`Static output received invalid pathname ${JSON.stringify(t)}.`);
   return t === "/" ? "index.html" : [...t.split("/").slice(1).map((r) => {
@@ -157,27 +635,27 @@ function J(t) {
     } catch {
       throw new Error(`Static output pathname is not valid UTF-8: ${JSON.stringify(t)}.`);
     }
-    return et(n, t), n;
+    return oe(n, t), n;
   }), "index.html"].join("/");
 }
-function tt(t) {
+function ie(t) {
   if (t === "/")
     throw new Error("A static resource route cannot own the root pathname.");
-  return J(t).slice(0, -11);
+  return Z(t).slice(0, -11);
 }
-function et(t, e) {
+function oe(t, e) {
   const r = /[<>:"|?*]/.test(t) || [...t].some((n) => n.charCodeAt(0) <= 31) || /[. ]$/.test(t) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(t);
   if (!t || t === "." || t === ".." || t.includes("/") || t.includes("\\") || r)
     throw new Error(
       `Static pathname ${JSON.stringify(e)} contains a segment that is unsafe or not portable as a file name: ${JSON.stringify(t)}.`
     );
 }
-function v(t, e, r) {
+function J(t, e, r) {
   return new Request(`${t}${e}`, {
     headers: { accept: r === "document" ? "text/html" : "*/*" }
   });
 }
-async function T(t, e, r) {
+async function M(t, e, r) {
   if (e.status !== r)
     throw new Error(
       `Static output for ${JSON.stringify(t.pathname)} returned status ${e.status}; expected ${r}.`
@@ -191,19 +669,19 @@ async function T(t, e, r) {
     throw new Error(
       `Static output for ${JSON.stringify(t.pathname)} attempted to set a cookie. Build artifacts cannot contain per-user response state.`
     );
-  const o = await nt(
+  const o = await ae(
     await e.text(),
     e.headers
   );
-  return await it(t.pathname, o, e.headers), {
+  return await ue(t.pathname, o, e.headers), {
     file: t.file,
-    headers: A(e.headers),
+    headers: X(e.headers),
     body: o,
     pathname: t.pathname,
     status: r
   };
 }
-async function rt(t, e) {
+async function se(t, e) {
   if (e.status !== 200)
     throw new Error(
       `Static output for ${JSON.stringify(t.pathname)} returned status ${e.status}; expected 200.`
@@ -214,48 +692,48 @@ async function rt(t, e) {
     );
   return {
     file: t.file,
-    headers: A(e.headers),
+    headers: X(e.headers),
     body: await e.text(),
     pathname: t.pathname,
     status: 200
   };
 }
-async function nt(t, e) {
+async function ae(t, e) {
   const r = new RegExp(
-    `(?:^|\\s)${$}(?:\\s|$)`
-  ), n = F(t, "script").filter((i) => r.test(i.attributes));
+    `(?:^|\\s)${P}(?:\\s|$)`
+  ), n = Q(t, "script").filter((s) => r.test(s.attributes));
   if (n.length === 0)
     return t;
   const o = await Promise.all(
-    n.map((i) => x(i.content))
+    n.map((s) => _(s.content))
   );
-  for (const i of [
+  for (const s of [
     "content-security-policy",
     "content-security-policy-report-only"
   ]) {
-    const c = e.get(i);
-    c && e.set(i, ot(c, o));
+    const c = e.get(s);
+    c && e.set(s, ce(c, o));
   }
   return t.replace(
-    new RegExp(`\\s${$}(?=\\s|>)`, "g"),
+    new RegExp(`\\s${P}(?=\\s|>)`, "g"),
     ""
   );
 }
-function ot(t, e) {
-  const r = t.split(";").map((s) => s.trim()).filter(Boolean), n = r.findIndex(
-    (s) => s.split(/\s+/, 1)[0]?.toLowerCase() === "script-src"
+function ce(t, e) {
+  const r = t.split(";").map((i) => i.trim()).filter(Boolean), n = r.findIndex(
+    (i) => i.split(/\s+/, 1)[0]?.toLowerCase() === "script-src"
   ), o = r.find(
-    (s) => s.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
-  ), i = n === -1 ? o : r[n];
-  if (!i)
+    (i) => i.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
+  ), s = n === -1 ? o : r[n];
+  if (!s)
     return t;
-  const c = i.split(/\s+/).slice(1).filter((s) => s !== "'none'"), a = [
+  const c = s.split(/\s+/).slice(1).filter((i) => i !== "'none'"), a = [
     "script-src",
     .../* @__PURE__ */ new Set([...c, ...e])
   ].join(" ");
   return n === -1 ? r.push(a) : r[n] = a, r.join("; ");
 }
-async function it(t, e, r) {
+async function ue(t, e, r) {
   const n = r.get("content-security-policy");
   if (!n)
     return;
@@ -263,25 +741,35 @@ async function it(t, e, r) {
     throw new Error(
       `Static output for ${JSON.stringify(t)} uses a nonce-backed CSP. Use security.static() with stable hashes or a runtime adapter that injects a fresh nonce.`
     );
-  const o = st(n);
-  await N(
+  const o = le(n);
+  await L(
     t,
     e,
     "script",
-    h(o, "script-src")
-  ), await N(
+    x(o, "script-src", "default-src")
+  ), await L(
     t,
     e,
     "style",
-    h(o, "style-src")
+    x(
+      o,
+      "style-src-elem",
+      "style-src",
+      "default-src"
+    )
   );
-  const i = h(o, "style-src");
-  if (i && /\sstyle\s*=/i.test(e) && !i.includes("'unsafe-inline'"))
+  const s = x(
+    o,
+    "style-src-attr",
+    "style-src",
+    "default-src"
+  );
+  if (s && /\sstyle\s*=/i.test(e) && !s.includes("'unsafe-inline'"))
     throw new Error(
       `Static output for ${JSON.stringify(t)} contains an inline style attribute that its CSP does not allow. Move the style into a stylesheet or explicitly allow inline styles.`
     );
 }
-function st(t) {
+function le(t) {
   const e = /* @__PURE__ */ new Map();
   for (const r of t.split(";")) {
     const [n, ...o] = r.trim().split(/\s+/);
@@ -289,89 +777,149 @@ function st(t) {
   }
   return e;
 }
-function h(t, e) {
-  return t.get(e) ?? t.get("default-src");
+function x(t, ...e) {
+  for (const r of e) {
+    const n = t.get(r);
+    if (n)
+      return n;
+  }
 }
-async function N(t, e, r, n) {
+async function L(t, e, r, n) {
   if (!(!n || n.includes("'unsafe-inline'")))
-    for (const o of F(e, r)) {
-      if (r === "script" && /(?:^|\s)src\s*=/i.test(o.attributes) || !o.content)
+    for (const o of Q(e, r)) {
+      if (r === "script") {
+        const c = fe(o.attributes, "src");
+        if (c) {
+          if (!de(n, c))
+            throw new Error(
+              `Static output for ${JSON.stringify(t)} contains script ${JSON.stringify(c)} that the effective script-src directive does not allow. Add its origin to security.needs.script or the route CSP policy.`
+            );
+          continue;
+        }
+      }
+      if (!o.content)
         continue;
-      const i = await x(o.content);
-      if (!n.includes(i))
+      const s = await _(o.content);
+      if (!n.includes(s))
         throw new Error(
-          `Static output for ${JSON.stringify(t)} contains an inline ${r} without the required CSP hash ${i}.`
+          `Static output for ${JSON.stringify(t)} contains an inline ${r} without the required CSP hash ${s}.`
         );
     }
 }
-function F(t, e) {
-  const r = t.toLowerCase(), n = [], o = `<${e}`, i = `</${e}`;
+function fe(t, e) {
+  return t.match(
+    new RegExp(`(?:^|\\s)${e}\\s*=\\s*["']([^"']+)["']`, "i")
+  )?.[1]?.replaceAll("&amp;", "&");
+}
+function de(t, e) {
+  if (!t)
+    return !0;
+  if (t.includes("'none'") || t.includes("'strict-dynamic'") && t.some(
+    (n) => n.startsWith("'nonce-") || /^'sha(?:256|384|512)-/.test(n)
+  ))
+    return !1;
+  if (t.includes("*") || t.includes("'self'") && e.startsWith("/") && !e.startsWith("//") || e.startsWith("https:") && t.includes("https:") || e.startsWith("http:") && t.includes("http:"))
+    return !0;
+  let r;
+  try {
+    r = new URL(e, "https://demiurge.invalid");
+  } catch {
+    return !1;
+  }
+  return t.some((n) => {
+    if (n.startsWith("'"))
+      return !1;
+    let o;
+    try {
+      o = new URL(n);
+    } catch {
+      return !1;
+    }
+    const s = o.hostname.startsWith("*.") ? r.hostname.endsWith(o.hostname.slice(1)) && r.hostname !== o.hostname.slice(2) : r.hostname === o.hostname, c = o.pathname === "/" || o.pathname.endsWith("/") ? r.pathname.startsWith(o.pathname) : r.pathname === o.pathname;
+    return r.protocol === o.protocol && s && r.port === o.port && c;
+  });
+}
+function Q(t, e) {
+  const r = t.toLowerCase(), n = [], o = `<${e}`, s = `</${e}`;
   let c = 0;
   for (; c < t.length; ) {
     const a = r.indexOf(o, c);
     if (a === -1)
       break;
-    const s = r.indexOf(">", a + o.length), f = s === -1 ? -1 : r.indexOf(i, s + 1), d = f === -1 ? -1 : r.indexOf(">", f + i.length);
-    if (s === -1 || f === -1 || d === -1)
+    const i = r.indexOf(">", a + o.length), u = i === -1 ? -1 : r.indexOf(s, i + 1), f = u === -1 ? -1 : r.indexOf(">", u + s.length);
+    if (i === -1 || u === -1 || f === -1)
       throw new Error(`Static output contains an unclosed <${e}> element.`);
     n.push({
-      attributes: t.slice(a + o.length, s),
-      content: t.slice(s + 1, f)
-    }), c = d + 1;
+      attributes: t.slice(a + o.length, i),
+      content: t.slice(i + 1, u)
+    }), c = f + 1;
   }
   return n;
 }
-function A(t) {
+function X(t) {
   return Object.fromEntries(
     [...t.entries()].sort(([e], [r]) => e.localeCompare(r))
   );
 }
-async function at(t, e, r) {
-  const n = O(t);
-  await p(n, { recursive: !0 });
-  const o = await k(m(n, ".demiurge-static-"));
+async function he(t, e, r, n) {
+  const o = C(t);
+  await T(o, { recursive: !0 });
+  const s = await k(y(o, ".demiurge-static-"));
   try {
-    for (const a of e) {
-      const s = R(o, a.file);
-      await p(O(s), { recursive: !0 }), await E(s, a.body);
+    for (const i of [...e, ...r]) {
+      const u = W(s, i.file);
+      await T(C(u), { recursive: !0 }), await b(u, i.body);
     }
-    await E(
-      m(o, C),
-      `${JSON.stringify(r, null, 2)}
+    await b(
+      y(s, K),
+      `${JSON.stringify(n, null, 2)}
 `
     );
-    const i = await ct(t);
-    await p(t, { recursive: !0 }), await P(o, t, { recursive: !0, force: !0 });
-    const c = new Set(e.map((a) => a.file));
-    for (const a of i)
-      c.has(a) || await g(R(t, a), { force: !0 });
+    const c = await pe(t);
+    await T(t, { recursive: !0 }), await D(s, t, { recursive: !0, force: !0 });
+    const a = new Set(
+      [...e, ...r].map((i) => i.file)
+    );
+    for (const i of c)
+      a.has(i) || await A(W(t, i), { force: !0 });
   } finally {
-    await g(o, { force: !0, recursive: !0 });
+    await A(s, { force: !0, recursive: !0 });
   }
 }
-async function ct(t) {
+async function pe(t) {
   try {
-    const e = await b(m(t, C), "utf8"), r = JSON.parse(e);
-    return r.adapter !== "static" || r.version !== 1 || !Array.isArray(r.entries) ? [] : r.entries.flatMap(
-      (n) => typeof n.file == "string" && L(n.file) ? [n.file] : []
+    const e = await O(y(t, K), "utf8"), r = JSON.parse(e);
+    if (r.adapter !== "static" || r.version !== 1 || !Array.isArray(r.entries))
+      return [];
+    const n = Array.isArray(r.fontFiles) ? r.fontFiles : [], o = Array.isArray(r.imageFiles) ? r.imageFiles : [];
+    return [
+      ...r.entries.map((s) => s.file),
+      ...n,
+      ...o
+    ].flatMap(
+      (s) => typeof s == "string" && Y(s) ? [s] : []
     );
   } catch {
     return [];
   }
 }
-function R(t, e) {
-  if (!L(e))
+function W(t, e) {
+  if (!Y(e))
     throw new Error(`Static output file must stay inside the output directory: ${JSON.stringify(e)}.`);
-  const r = w(t), n = w(r, e);
-  if (M(r, n).split(H).includes(".."))
+  const r = h(t), n = h(r, e);
+  if (w(r, n).split(S).includes(".."))
     throw new Error(`Static output file escaped the output directory: ${JSON.stringify(e)}.`);
   return n;
 }
-function L(t) {
+function Y(t) {
   return !!t && !t.startsWith("/") && !t.startsWith("\\") && !t.split(/[\\/]/).includes("..");
 }
 export {
-  Et as generateStaticOutput,
-  yt as staticAdapter
+  Ne as createStaticPreviewServer,
+  Lt as createVercelOutputConfig,
+  be as generateStaticOutput,
+  xe as generateVercelStaticOutput,
+  qt as staticAdapter,
+  Fe as vercelStatic
 };
 //# sourceMappingURL=index.js.map