@demiurgejs/core 0.2.0-beta.1 → 0.2.0-beta.3

package/dist/static/index.js

@@ -1,14 +1,76 @@
-import { readFile as v, mkdir as E, mkdtemp as W, cp as k, writeFile as A, rm as $, rename as rt } from "node:fs/promises";
-import { resolve as h, relative as w, sep as g, extname as nt, dirname as N, join as m } from "node:path";
-import { d as it, S as F } from "../chunks/request-metadata-DwEO1EAS.js";
-import { v as ot, c as st, a as at, h as ct, r as ut, m as ft, b as D, d as lt } from "../chunks/testing-DBjVCN5v.js";
+import { readFile as O, mkdir as T, mkdtemp as k, cp as D, writeFile as b, rm as A, rename as nt } from "node:fs/promises";
+import { resolve as h, relative as w, sep as S, extname as it, dirname as C, join as y } from "node:path";
+import { d as ot, S as P } from "../chunks/request-metadata-DaIYq4Ea.js";
+import { v as st, a as at, b as ct, d as ut, h as lt, r as ft, m as dt, e as _, f as ht } from "../chunks/testing-CRflAw4X.js";
 import "react-dom/server";
 import "react";
 import "react/jsx-runtime";
-import { C as _, I as dt, R as ht } from "../chunks/static-files-DUjHw-4H.js";
-import { createServer as pt } from "node:http";
-import { normalizeRoutes as mt, getTransformedRoutes as wt } from "@vercel/routing-utils";
-const yt = "demiurge-static-manifest.json", gt = {
+import { C as U, I as pt, R as mt } from "../chunks/static-files-DUjHw-4H.js";
+import { t as wt, n as gt, r as yt } from "../chunks/image-codec-Di53WpcH.js";
+import { e as V, g as St, p as Et, h as $t } from "../chunks/images-Edar3eU1.js";
+import { createServer as vt } from "node:http";
+import { normalizeRoutes as Ot, getTransformedRoutes as Rt } from "@vercel/routing-utils";
+async function Tt(t) {
+  const e = h(t.outDir), r = t.policy ?? {}, n = r.optimizerPath ?? V, o = new Set(
+    t.documents.flatMap(
+      (a) => St(a, n)
+    )
+  ), s = [], c = /* @__PURE__ */ new Map();
+  for (const a of [...o].sort()) {
+    const i = Et(a, n);
+    if (!i)
+      throw new Error(
+        `Static output references image variant ${JSON.stringify(a)}, which does not describe a transform the build can emit.`
+      );
+    if (!$t(i.src, r))
+      throw new Error(
+        `Image source ${JSON.stringify(i.src)} is not allowed by the image policy.`
+      );
+    const u = Ft(e, i.src);
+    let f = c.get(u);
+    f || (f = await Nt(u, i.src), c.set(u, f));
+    const E = await wt(f, {
+      format: gt(i, null),
+      quality: i.quality,
+      width: i.width
+    });
+    s.push({ body: E.body, file: a.slice(1) });
+  }
+  return s;
+}
+function At(t, e = {}) {
+  const r = e.optimizerPath ?? V, n = new RegExp(`${r.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\?`);
+  for (const o of t)
+    if (n.test(o))
+      throw new Error(
+        'Static output references the request-time image optimizer, which a static build cannot serve. Set loader: "static" in the image policy, or deploy a runtime adapter.'
+      );
+}
+async function Nt(t, e) {
+  try {
+    return new Uint8Array(await O(t));
+  } catch (r) {
+    throw new Error(
+      `Demiurge could not read the source image ${JSON.stringify(e)} from the build output.`,
+      { cause: r }
+    );
+  }
+}
+function Ft(t, e) {
+  let r;
+  try {
+    r = decodeURIComponent(e);
+  } catch {
+    throw new Error(`Image source is not valid UTF-8: ${JSON.stringify(e)}.`);
+  }
+  const n = h(t, `.${r}`);
+  if (w(t, n).split(S).includes(".."))
+    throw new Error(
+      `Image source escaped the build output directory: ${JSON.stringify(e)}.`
+    );
+  return n;
+}
+const xt = "demiurge-static-manifest.json", bt = {
   ".avif": "image/avif",
   ".css": "text/css; charset=utf-8",
   ".gif": "image/gif",
@@ -27,131 +89,131 @@ const yt = "demiurge-static-manifest.json", gt = {
   ".woff": "font/woff",
   ".woff2": "font/woff2"
 };
-async function de(t) {
-  const e = h(t.outDir), r = Et(
-    await v(h(e, yt), "utf8")
+async function Ne(t) {
+  const e = h(t.outDir), r = Pt(
+    await O(h(e, xt), "utf8")
   ), n = new Map(
-    r.entries.map((o) => [o.pathname, o])
-  ), i = new Map(
-    r.entries.map((o) => [o.file, o])
-  ), a = r.fileHeaderRules.map((o) => ({
-    ...o,
-    expression: new RegExp(o.pattern)
-  })), c = pt(async (o, s) => {
+    r.entries.map((a) => [a.pathname, a])
+  ), o = new Map(
+    r.entries.map((a) => [a.file, a])
+  ), s = r.fileHeaderRules.map((a) => ({
+    ...a,
+    expression: new RegExp(a.pattern)
+  })), c = vt(async (a, i) => {
     try {
-      if (o.method !== "GET" && o.method !== "HEAD") {
-        s.writeHead(405, { allow: "GET, HEAD" }), s.end();
+      if (a.method !== "GET" && a.method !== "HEAD") {
+        i.writeHead(405, { allow: "GET, HEAD" }), i.end();
         return;
       }
-      const f = new URL(o.url ?? "/", "http://demiurge.local");
-      let l;
+      const u = new URL(a.url ?? "/", "http://demiurge.local");
+      let f;
       try {
-        l = decodeURIComponent(f.pathname);
+        f = decodeURIComponent(u.pathname);
       } catch {
-        s.writeHead(400, {
+        i.writeHead(400, {
           "content-type": "text/plain; charset=utf-8"
-        }), s.end("The request path is not valid UTF-8.");
+        }), i.end("The request path is not valid UTF-8.");
         return;
       }
-      const R = l.replace(/\/$/, "") || "/", y = n.get(R);
-      if (y) {
-        await T(e, y, o.method, s);
+      const E = f.replace(/\/$/, "") || "/", $ = n.get(E);
+      if ($) {
+        await F(e, $, a.method, i);
         return;
       }
-      const u = St(e, l);
-      if (u)
+      const p = Ct(e, f);
+      if (p)
         try {
-          const p = w(e, u).split(g).join("/"), b = i.get(p);
-          if (b) {
-            await T(e, b, o.method, s);
+          const m = w(e, p).split(S).join("/"), l = o.get(m);
+          if (l) {
+            await F(e, l, a.method, i);
             return;
           }
-          const X = await v(u), j = gt[nt(u).toLowerCase()];
-          j && s.setHeader("content-type", j);
-          const Y = l.split("/").at(-1) ?? "", tt = a.find(({ expression: et }) => et.test(Y));
-          U(s, tt?.headers ?? {}), s.writeHead(200), s.end(o.method === "HEAD" ? void 0 : X);
+          const d = await O(p), v = bt[it(p).toLowerCase()];
+          v && i.setHeader("content-type", v);
+          const tt = f.split("/").at(-1) ?? "", et = s.find(({ expression: rt }) => rt.test(tt));
+          z(i, et?.headers ?? {}), i.writeHead(200), i.end(a.method === "HEAD" ? void 0 : d);
           return;
-        } catch (p) {
-          if (!Ot(p)) throw p;
+        } catch (m) {
+          if (!Ht(m)) throw m;
         }
-      const d = n.get("*");
-      if (!d) {
-        s.writeHead(404), s.end();
+      const g = n.get("*");
+      if (!g) {
+        i.writeHead(404), i.end();
         return;
       }
-      await T(e, d, o.method, s);
+      await F(e, g, a.method, i);
     } catch {
-      s.writeHead(500, {
+      i.writeHead(500, {
         "content-type": "text/plain; charset=utf-8"
-      }), s.end("Demiurge could not serve the static output.");
+      }), i.end("Demiurge could not serve the static output.");
     }
   });
-  return await new Promise((o, s) => {
-    const f = (l) => s(l);
-    c.once("error", f), c.listen(
+  return await new Promise((a, i) => {
+    const u = (f) => i(f);
+    c.once("error", u), c.listen(
       t.port ?? 4173,
       t.host ?? "localhost",
       () => {
-        c.off("error", f), o();
+        c.off("error", u), a();
       }
     );
   }), c;
 }
-async function T(t, e, r, n) {
-  const i = B(t, e.file), a = await v(i);
-  U(n, e.headers), n.writeHead(e.status), n.end(r === "HEAD" ? void 0 : a);
+async function F(t, e, r, n) {
+  const o = q(t, e.file), s = await O(o);
+  z(n, e.headers), n.writeHead(e.status), n.end(r === "HEAD" ? void 0 : s);
 }
-function U(t, e) {
+function z(t, e) {
   for (const [r, n] of Object.entries(e))
     t.setHeader(r, n);
 }
-function St(t, e) {
+function Ct(t, e) {
   if (!e.endsWith("/"))
-    return V(t, `.${e}`);
+    return B(t, `.${e}`);
 }
-function B(t, e) {
-  const r = V(t, e);
+function q(t, e) {
+  const r = B(t, e);
   if (!r)
     throw new Error(`Static preview file is outside the output directory: ${JSON.stringify(e)}.`);
   return r;
 }
-function V(t, e) {
+function B(t, e) {
   if (!e || e.startsWith("/") || e.startsWith("\\") || e.split(/[\\/]/).includes(".."))
     return;
   const r = h(t, e), n = w(t, r);
-  return n !== ".." && !n.startsWith(`..${g}`) ? r : void 0;
+  return n !== ".." && !n.startsWith(`..${S}`) ? r : void 0;
 }
-function Et(t) {
+function Pt(t) {
   let e;
   try {
     e = JSON.parse(t);
   } catch {
     throw new Error("The static output manifest is not valid JSON.");
   }
-  if (!O(e) || e.adapter !== "static" || e.version !== 1)
+  if (!N(e) || e.adapter !== "static" || e.version !== 1)
     throw new Error("The static output manifest has an unsupported format.");
   if (!Array.isArray(e.entries) || !Array.isArray(e.fileHeaderRules))
     throw new Error("The static output manifest does not contain header rules and entries.");
-  const r = e.entries.map(vt), n = e.fileHeaderRules.map($t), i = /* @__PURE__ */ new Set();
-  for (const a of r) {
-    if (i.has(a.pathname))
-      throw new Error(`The static output manifest repeats pathname ${JSON.stringify(a.pathname)}.`);
-    i.add(a.pathname);
+  const r = e.entries.map(It), n = e.fileHeaderRules.map(jt), o = /* @__PURE__ */ new Set();
+  for (const s of r) {
+    if (o.has(s.pathname))
+      throw new Error(`The static output manifest repeats pathname ${JSON.stringify(s.pathname)}.`);
+    o.add(s.pathname);
   }
   return { adapter: "static", entries: r, fileHeaderRules: n, version: 1 };
 }
-function vt(t) {
-  if (!O(t) || typeof t.file != "string" || typeof t.pathname != "string" || t.status !== 200 && t.status !== 404 || !q(t.headers))
+function It(t) {
+  if (!N(t) || typeof t.file != "string" || typeof t.pathname != "string" || t.status !== 200 && t.status !== 404 || !G(t.headers))
     throw new Error("The static output manifest contains an invalid entry.");
-  return B("/demiurge-manifest-root", t.file), {
+  return q("/demiurge-manifest-root", t.file), {
     file: t.file,
     headers: t.headers,
     pathname: t.pathname,
     status: t.status
   };
 }
-function $t(t) {
-  if (!O(t) || typeof t.pattern != "string" || !q(t.headers))
+function jt(t) {
+  if (!N(t) || typeof t.pattern != "string" || !G(t.headers))
     throw new Error("The static output manifest contains an invalid file header rule.");
   try {
     new RegExp(t.pattern);
@@ -160,125 +222,132 @@ function $t(t) {
   }
   return { headers: t.headers, pattern: t.pattern };
 }
-function O(t) {
+function N(t) {
   return !!t && typeof t == "object" && !Array.isArray(t);
 }
-function q(t) {
-  return O(t) && Object.values(t).every(
+function G(t) {
+  return N(t) && Object.values(t).every(
     (e) => typeof e == "string"
   );
 }
-function Ot(t) {
+function Ht(t) {
   return t instanceof Error && "code" in t && (t.code === "EISDIR" || t.code === "ENOENT");
 }
-const Rt = "demiurge-manifest.json", Tt = "demiurge-static-manifest.json";
-function he(t = {}) {
+const Jt = "demiurge-manifest.json", Mt = "demiurge-static-manifest.json";
+function Fe(t = {}) {
   return {
     adapter: "vercel",
     cache: t.cache?.map((e) => ({
       source: e.source,
       value: e.value
-    })) ?? []
+    })) ?? [],
+    cors: t.cors
   };
 }
-async function pe(t) {
-  Ft(t.deployment);
+async function xe(t) {
+  Vt(t.deployment);
   const e = h(t.projectRoot), r = h(t.outDir), n = h(e, ".vercel/output");
-  if (Ht(r, n))
+  if (zt(r, n))
     throw new Error(
       "The static output directory must not overlap the Vercel output directory."
     );
-  const i = N(n);
-  await E(i, { recursive: !0 });
-  const a = await W(m(i, "output-demiurge-"));
+  const o = C(n);
+  await T(o, { recursive: !0 });
+  const s = await k(y(o, "output-demiurge-"));
   try {
-    const c = m(a, "static");
-    await k(r, c, {
-      filter: (o) => {
-        const s = w(r, o).split(g).join("/");
-        return s !== Rt && s !== Tt;
+    const c = y(s, "static");
+    await D(r, c, {
+      filter: (a) => {
+        const i = w(r, a).split(S).join("/");
+        return i !== Jt && i !== Mt;
       },
       recursive: !0
-    }), await A(
-      m(a, "config.json"),
-      `${JSON.stringify(xt(
+    }), await b(
+      y(s, "config.json"),
+      `${JSON.stringify(Lt(
         t.manifest,
         t.deployment
       ), null, 2)}
 `
-    ), await $(n, { force: !0, recursive: !0 }), await rt(a, n);
+    ), await A(n, { force: !0, recursive: !0 }), await nt(s, n);
   } catch (c) {
-    throw await $(a, { force: !0, recursive: !0 }), c;
+    throw await A(s, { force: !0, recursive: !0 }), c;
   }
   return n;
 }
-function xt(t, e) {
-  const r = t.entries.find((o) => o.pathname === "*");
+function Lt(t, e) {
+  const r = t.entries.find((i) => i.pathname === "*");
   if (!r)
     throw new Error("Vercel output requires a static fallback entry.");
-  const n = jt(e.cache), i = [];
-  for (const o of t.entries) {
-    if (o.pathname === "*") continue;
-    const s = `/${o.file}`;
-    s !== o.pathname && i.push({
+  const n = _t(e.cache), s = [
+    {
+      continue: !0,
+      headers: { "access-control-allow-origin": Ut(e.cors, t.origin) },
+      src: "^/.*$"
+    }
+  ];
+  for (const i of t.entries) {
+    if (i.pathname === "*") continue;
+    const u = `/${i.file}`;
+    u !== i.pathname && s.push({
       continue: !0,
-      dest: o.pathname,
-      src: S(s)
+      dest: i.pathname,
+      src: R(u)
     });
   }
-  for (const o of t.entries) {
-    const s = H(o.headers);
-    if (Object.keys(s).length === 0) continue;
-    const f = o.pathname === "*" ? `/${o.file}` : o.pathname;
-    i.push({
+  for (const i of t.entries) {
+    const u = I(i.headers);
+    if (Object.keys(u).length === 0) continue;
+    const f = i.pathname === "*" ? `/${i.file}` : i.pathname;
+    s.push({
       continue: !0,
-      headers: s,
-      src: S(f)
+      headers: u,
+      src: R(f)
     });
   }
-  i.push(...n);
-  for (const o of t.entries) {
-    if (o.pathname === "*") {
-      i.push({
-        dest: `/${o.file}`,
-        src: S(`/${o.file}`),
+  s.push(...n);
+  for (const i of t.entries) {
+    if (i.pathname === "*") {
+      s.push({
+        dest: `/${i.file}`,
+        src: R(`/${i.file}`),
         status: 404
       });
       continue;
     }
-    i.push({
-      dest: o.pathname === "/" ? `/${o.file}` : o.pathname,
-      src: S(o.pathname)
+    s.push({
+      dest: i.pathname === "/" ? `/${i.file}` : i.pathname,
+      src: R(i.pathname)
     });
   }
-  i.push({ handle: "hit" });
-  for (const o of [...t.fileHeaderRules].reverse())
-    i.push({
+  s.push({ handle: "hit" });
+  for (const i of [...t.fileHeaderRules].reverse())
+    s.push({
       continue: !0,
-      headers: { ...o.headers },
-      src: Nt(o.pattern)
+      headers: { ...i.headers },
+      src: kt(i.pattern)
     });
-  i.push(...n.map((o) => ({ ...o }))), i.push({ handle: "error" });
-  const a = H(r.headers);
-  Object.keys(a).length > 0 && i.push({
+  s.push(...n.map((i) => ({ ...i }))), s.push({ handle: "error" });
+  const c = I(r.headers);
+  Object.keys(c).length > 0 && s.push({
     continue: !0,
-    headers: a,
+    headers: c,
     src: "^/.*$"
-  }), i.push(...n.map((o) => ({ ...o }))), i.push({ dest: `/${r.file}`, src: "^/.*$", status: 404 });
-  const c = mt(i);
-  if (c.error || !c.routes)
+  }), s.push(...n.map((i) => ({ ...i }))), s.push({ dest: `/${r.file}`, src: "^/.*$", status: 404 });
+  const a = Ot(s);
+  if (a.error || !a.routes)
     throw new Error(
-      `Vercel rejected the generated routes: ${c.error?.message ?? "The route list is empty."}`
+      `Vercel rejected the generated routes: ${a.error?.message ?? "The route list is empty."}`
     );
   return {
     overrides: Object.fromEntries(
-      t.entries.map((o) => [o.file, At(o)])
+      t.entries.map((i) => [i.file, Wt(i)])
     ),
-    routes: c.routes,
+    routes: a.routes,
     version: 3
   };
 }
-function At(t) {
+function Wt(t) {
   const e = {}, r = t.headers["content-type"];
   if (r && (e.contentType = r), t.pathname !== "*") {
     const n = t.file === "index.html" ? "/" : `/${t.file}`;
@@ -286,166 +355,196 @@ function At(t) {
   }
   return e;
 }
-function S(t) {
+function R(t) {
   const e = t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return t === "/" ? "^/$" : `^${e}/?$`;
 }
-function H(t) {
+function I(t) {
   return Object.fromEntries(
     Object.entries(t).filter(([e]) => e.toLowerCase() !== "content-type")
   );
 }
-function Nt(t) {
-  return t === ".*" ? "^/.*$" : t === _.source ? "^/(?:.*/)?[^/]*-[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9]+$" : `^/${bt(t)}$`;
+function kt(t) {
+  return t === ".*" ? "^/.*$" : t === U.source ? "^/(?:.*/)?[^/]*-[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9]+$" : `^/${Dt(t)}$`;
 }
-function bt(t) {
+function Dt(t) {
   const e = t.startsWith("^"), r = t.endsWith("$") && !t.endsWith("\\$"), n = t.slice(
     e ? 1 : 0,
     r ? -1 : void 0
   );
   return `${e ? "(?:.*/)?" : "(?:.*/)?[^/]*"}(?:${n})${r ? "" : "[^/]*"}`;
 }
-function jt(t) {
+function _t(t) {
   const e = t.map((n) => ({
     headers: [{ key: "cache-control", value: n.value }],
     source: n.source
-  })), r = wt({ headers: e });
+  })), r = Rt({ headers: e });
   if (r.error || !r.routes)
     throw new Error(
       `A Vercel static header rule is not valid: ${r.error?.message ?? "The route list is empty."}`
     );
   return r.routes;
 }
-function Ft(t) {
+function Ut(t, e) {
+  if (t) {
+    if (st(t), t.origins === "*")
+      return "*";
+    if (t.origins.length === 1)
+      return t.origins[0];
+    throw new Error(
+      "A Vercel static CORS policy must declare the wildcard origin or exactly one origin. A static response cannot vary access-control-allow-origin by request."
+    );
+  }
+  if (!e)
+    throw new Error(
+      "Vercel static output requires a build origin to emit access-control-allow-origin. Pass --origin, set SITE_ORIGIN, or declare a Vercel CORS policy."
+    );
+  return e;
+}
+function Vt(t) {
   if (t.adapter !== "vercel" || !Array.isArray(t.cache))
     throw new Error("The Vercel static adapter configuration is not valid.");
   for (const e of t.cache)
     if (!e || typeof e != "object" || typeof e.source != "string" || !e.source || typeof e.value != "string" || !e.value)
       throw new Error("A Vercel static header rule is not valid.");
 }
-function Ht(t, e) {
+function zt(t, e) {
   const r = w(t, e), n = w(e, t);
-  return C(r) || C(n);
+  return j(r) || j(n);
 }
-function C(t) {
-  return !t || t !== ".." && !t.startsWith(`..${g}`) && !t.startsWith("/");
+function j(t) {
+  return !t || t !== ".." && !t.startsWith(`..${S}`) && !t.startsWith("/");
 }
-const G = "demiurge-static-manifest.json", Ct = it({
+const K = "demiurge-static-manifest.json", qt = ot({
   name: "static",
   capabilities: {
     staticOutput: !0
   }
-}), Pt = 8;
-async function Jt(t) {
+}), Bt = 8;
+async function Gt(t) {
   const e = Object.entries(t), r = new Array(e.length);
   let n = 0;
-  const i = Array.from(
-    { length: Math.min(Pt, e.length) },
+  const o = Array.from(
+    { length: Math.min(Bt, e.length) },
     async () => {
       for (; n < e.length; ) {
-        const a = n++, [c, o] = e[a];
+        const s = n++, [c, a] = e[s];
         try {
-          r[a] = [c, await o()];
-        } catch (s) {
+          r[s] = [c, await a()];
+        } catch (i) {
           throw new Error(
             `Demiurge could not load route module ${JSON.stringify(c)}.`,
-            { cause: s }
+            { cause: i }
           );
         }
       }
     }
   );
-  return await Promise.all(i), Object.fromEntries(r);
+  return await Promise.all(o), Object.fromEntries(r);
 }
-async function me(t) {
-  const e = await Jt(t.routes), r = ot(e, {
-    adapter: Ct
-  }), n = Wt(t.origin), i = h(t.outDir), a = await Dt(r), c = await st(r, {
+async function be(t) {
+  const e = await Gt(t.routes), r = at(e, {
+    adapter: qt
+  }), n = Xt(t.origin), o = h(t.outDir), s = await te(r), c = await ct(r, {
     includeResources: !0
   });
-  kt(
+  Yt(
     r,
-    c.filter((u) => a.get(u.file) === "document").length
+    c.filter((l) => s.get(l.file) === "document").length
   );
-  const o = Bt(
-    c.map((u) => ({
-      kind: a.get(u.file) ?? "resource",
-      pathname: u.pathname
+  const a = ne(
+    c.map((l) => ({
+      kind: s.get(l.file) ?? "resource",
+      pathname: l.pathname
     }))
-  ), s = at(), f = [], l = { ...t.ssr, navigation: "document" };
-  for (const u of o) {
-    const d = J(n, u.pathname, u.kind), p = await ct(r, d, {
+  ), i = ut(), u = [], f = { ...t.ssr, navigation: "document" };
+  for (const l of a) {
+    const d = J(n, l.pathname, l.kind), v = await lt(r, d, {
       onError: t.onError,
-      rateLimitStore: s,
-      ssr: l
+      rateLimitStore: i,
+      ssr: f
     });
-    f.push(
-      u.kind === "document" ? await L(u, p, 200) : await Gt(u, p)
+    u.push(
+      l.kind === "document" ? await M(l, v, 200) : await se(l, v)
     );
   }
-  const R = await ut(
+  const E = await ft(
     r,
     J(n, "/404", "document"),
     {
-      ...l,
-      onError: (u, d) => t.onError?.(u, { pathname: "/404", site: d })
+      ...f,
+      onError: (l, d) => t.onError?.(l, { pathname: "/404", site: d })
     }
   );
-  f.push(
-    await L(
+  u.push(
+    await M(
       {
         file: "404.html",
         pathname: "*"
       },
-      R,
+      E,
       404
     )
-  ), f.sort((u, d) => u.file.localeCompare(d.file));
-  const y = {
+  );
+  const $ = u.map((l) => l.body);
+  At($, t.images);
+  const p = await Tt({
+    documents: $,
+    outDir: o,
+    policy: t.images
+  }), g = await yt({
+    fonts: t.fonts,
+    root: t.root ?? process.cwd()
+  });
+  u.sort((l, d) => l.file.localeCompare(d.file)), p.sort((l, d) => l.file.localeCompare(d.file)), g.sort((l, d) => l.file.localeCompare(d.file));
+  const m = {
     adapter: "static",
-    entries: f.map(({ body: u, ...d }) => d),
-    fileHeaderRules: await Lt(
+    entries: u.map(({ body: l, ...d }) => d),
+    fileHeaderRules: await Kt(
       r,
       t.staticFileHeaders ?? []
     ),
+    fontFiles: g.map((l) => l.file),
+    imageFiles: p.map((l) => l.file),
+    origin: n,
     version: 1
   };
-  return await te(i, f, y), y;
+  return await he(o, u, [...p, ...g], m), m;
 }
-async function Lt(t, e) {
-  const r = await Mt(t), n = P(r);
+async function Kt(t, e) {
+  const r = await Zt(t), n = H(r);
   return [
-    ...e.map((i) => (It(i.pattern), {
-      headers: P(
-        ft(r, { headers: i.headers })
+    ...e.map((o) => (Qt(o.pattern), {
+      headers: H(
+        dt(r, { headers: o.headers })
       ),
-      pattern: i.pattern
+      pattern: o.pattern
     })),
     {
       headers: {
         ...n,
-        "cache-control": dt
+        "cache-control": pt
       },
-      pattern: _.source
+      pattern: U.source
     },
     {
       headers: {
         ...n,
-        "cache-control": ht
+        "cache-control": mt
       },
       pattern: ".*"
     }
   ];
 }
-async function Mt(t) {
+async function Zt(t) {
   return { headers: (await t.policies.find(
     (n) => n.fileSegments.length === 0
   )?.load())?.policy?.document?.headers };
 }
-function P(t) {
-  return Object.fromEntries(lt(t, {}).entries());
+function H(t) {
+  return Object.fromEntries(ht(t, {}).entries());
 }
-function It(t) {
+function Qt(t) {
   try {
     new RegExp(t);
   } catch {
@@ -454,7 +553,7 @@ function It(t) {
     );
   }
 }
-function Wt(t) {
+function Xt(t) {
   let e;
   try {
     e = new URL(t ?? "http://demiurge.local");
@@ -469,7 +568,7 @@ function Wt(t) {
     );
   return e.origin;
 }
-function kt(t, e) {
+function Yt(t, e) {
   if (e === 0)
     throw new Error("Static output requires at least one page route.");
   if (!t.fallbacks.notFound.some(
@@ -479,13 +578,13 @@ function kt(t, e) {
       "Static output requires a root @not-found.tsx so 404.html is app-owned."
     );
 }
-async function Dt(t) {
+async function te(t) {
   const e = /* @__PURE__ */ new Map();
   for (const r of t.routes) {
-    const n = await r.load(), i = _t(n);
-    if (i.length > 0)
+    const n = await r.load(), o = ee(n);
+    if (o.length > 0)
       throw new Error(
-        `Static route ${JSON.stringify(r.file)} exports unsupported methods ${i.join(", ")}. Deploy a runtime adapter for request-time methods.`
+        `Static route ${JSON.stringify(r.file)} exports unsupported methods ${o.join(", ")}. Deploy a runtime adapter for request-time methods.`
       );
     if (!n.GET)
       throw new Error(
@@ -495,14 +594,14 @@ async function Dt(t) {
       e.set(r.file, "document");
       continue;
     }
-    Ut(r.file, n.GET), e.set(r.file, "resource");
+    re(r.file, n.GET), e.set(r.file, "resource");
   }
   return e;
 }
-function _t(t) {
+function ee(t) {
   return ["POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"].filter((e) => t[e] !== void 0);
 }
-function Ut(t, e) {
+function re(t, e) {
   if ((e.kind === "text" || e.kind === "html" || e.kind === "json") && typeof e.value != "function")
     return;
   const r = "value" in e && typeof e.value == "function" ? `uses a request-dependent ${e.kind} value` : `uses the ${e.kind} response helper`;
@@ -510,23 +609,23 @@ function Ut(t, e) {
     `Static route ${JSON.stringify(t)} ${r} and cannot produce a fixed output file. Use a fixed text, html, or json value, or deploy a runtime adapter.`
   );
 }
-function Bt(t) {
+function ne(t) {
   const e = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Set();
-  return t.map(({ kind: n, pathname: i }) => {
-    if (r.has(i))
-      throw new Error(`Static output collected duplicate pathname ${JSON.stringify(i)}.`);
-    r.add(i);
-    const a = n === "document" ? z(i) : Vt(i), c = a.toLocaleLowerCase("en-US"), o = [...e.entries()].find(
-      ([s]) => s === c || s.startsWith(`${c}/`) || c.startsWith(`${s}/`)
+  return t.map(({ kind: n, pathname: o }) => {
+    if (r.has(o))
+      throw new Error(`Static output collected duplicate pathname ${JSON.stringify(o)}.`);
+    r.add(o);
+    const s = n === "document" ? Z(o) : ie(o), c = s.toLocaleLowerCase("en-US"), a = [...e.entries()].find(
+      ([i]) => i === c || i.startsWith(`${c}/`) || c.startsWith(`${i}/`)
     );
-    if (o)
+    if (a)
       throw new Error(
-        `Static paths ${JSON.stringify(o[1])} and ${JSON.stringify(i)} map to the same portable output file or to a file and directory conflict.`
+        `Static paths ${JSON.stringify(a[1])} and ${JSON.stringify(o)} map to the same portable output file or to a file and directory conflict.`
       );
-    return e.set(c, i), { file: a, kind: n, pathname: i };
+    return e.set(c, o), { file: s, kind: n, pathname: o };
   });
 }
-function z(t) {
+function Z(t) {
   if (!t.startsWith("/") || t.includes("?") || t.includes("#"))
     throw new Error(`Static output received invalid pathname ${JSON.stringify(t)}.`);
   return t === "/" ? "index.html" : [...t.split("/").slice(1).map((r) => {
@@ -536,15 +635,15 @@ function z(t) {
     } catch {
       throw new Error(`Static output pathname is not valid UTF-8: ${JSON.stringify(t)}.`);
     }
-    return qt(n, t), n;
+    return oe(n, t), n;
   }), "index.html"].join("/");
 }
-function Vt(t) {
+function ie(t) {
   if (t === "/")
     throw new Error("A static resource route cannot own the root pathname.");
-  return z(t).slice(0, -11);
+  return Z(t).slice(0, -11);
 }
-function qt(t, e) {
+function oe(t, e) {
   const r = /[<>:"|?*]/.test(t) || [...t].some((n) => n.charCodeAt(0) <= 31) || /[. ]$/.test(t) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(t);
   if (!t || t === "." || t === ".." || t.includes("/") || t.includes("\\") || r)
     throw new Error(
@@ -556,7 +655,7 @@ function J(t, e, r) {
     headers: { accept: r === "document" ? "text/html" : "*/*" }
   });
 }
-async function L(t, e, r) {
+async function M(t, e, r) {
   if (e.status !== r)
     throw new Error(
       `Static output for ${JSON.stringify(t.pathname)} returned status ${e.status}; expected ${r}.`
@@ -570,19 +669,19 @@ async function L(t, e, r) {
     throw new Error(
       `Static output for ${JSON.stringify(t.pathname)} attempted to set a cookie. Build artifacts cannot contain per-user response state.`
     );
-  const i = await zt(
+  const o = await ae(
     await e.text(),
     e.headers
   );
-  return await Zt(t.pathname, i, e.headers), {
+  return await ue(t.pathname, o, e.headers), {
     file: t.file,
-    headers: Z(e.headers),
-    body: i,
+    headers: X(e.headers),
+    body: o,
     pathname: t.pathname,
     status: r
   };
 }
-async function Gt(t, e) {
+async function se(t, e) {
   if (e.status !== 200)
     throw new Error(
       `Static output for ${JSON.stringify(t.pathname)} returned status ${e.status}; expected 200.`
@@ -593,48 +692,48 @@ async function Gt(t, e) {
     );
   return {
     file: t.file,
-    headers: Z(e.headers),
+    headers: X(e.headers),
     body: await e.text(),
     pathname: t.pathname,
     status: 200
   };
 }
-async function zt(t, e) {
+async function ae(t, e) {
   const r = new RegExp(
-    `(?:^|\\s)${F}(?:\\s|$)`
-  ), n = K(t, "script").filter((a) => r.test(a.attributes));
+    `(?:^|\\s)${P}(?:\\s|$)`
+  ), n = Q(t, "script").filter((s) => r.test(s.attributes));
   if (n.length === 0)
     return t;
-  const i = await Promise.all(
-    n.map((a) => D(a.content))
+  const o = await Promise.all(
+    n.map((s) => _(s.content))
   );
-  for (const a of [
+  for (const s of [
     "content-security-policy",
     "content-security-policy-report-only"
   ]) {
-    const c = e.get(a);
-    c && e.set(a, Kt(c, i));
+    const c = e.get(s);
+    c && e.set(s, ce(c, o));
   }
   return t.replace(
-    new RegExp(`\\s${F}(?=\\s|>)`, "g"),
+    new RegExp(`\\s${P}(?=\\s|>)`, "g"),
     ""
   );
 }
-function Kt(t, e) {
-  const r = t.split(";").map((s) => s.trim()).filter(Boolean), n = r.findIndex(
-    (s) => s.split(/\s+/, 1)[0]?.toLowerCase() === "script-src"
-  ), i = r.find(
-    (s) => s.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
-  ), a = n === -1 ? i : r[n];
-  if (!a)
+function ce(t, e) {
+  const r = t.split(";").map((i) => i.trim()).filter(Boolean), n = r.findIndex(
+    (i) => i.split(/\s+/, 1)[0]?.toLowerCase() === "script-src"
+  ), o = r.find(
+    (i) => i.split(/\s+/, 1)[0]?.toLowerCase() === "default-src"
+  ), s = n === -1 ? o : r[n];
+  if (!s)
     return t;
-  const c = a.split(/\s+/).slice(1).filter((s) => s !== "'none'"), o = [
+  const c = s.split(/\s+/).slice(1).filter((i) => i !== "'none'"), a = [
     "script-src",
     .../* @__PURE__ */ new Set([...c, ...e])
   ].join(" ");
-  return n === -1 ? r.push(o) : r[n] = o, r.join("; ");
+  return n === -1 ? r.push(a) : r[n] = a, r.join("; ");
 }
-async function Zt(t, e, r) {
+async function ue(t, e, r) {
   const n = r.get("content-security-policy");
   if (!n)
     return;
@@ -642,39 +741,39 @@ async function Zt(t, e, r) {
     throw new Error(
       `Static output for ${JSON.stringify(t)} uses a nonce-backed CSP. Use security.static() with stable hashes or a runtime adapter that injects a fresh nonce.`
     );
-  const i = Qt(n);
-  await M(
+  const o = le(n);
+  await L(
     t,
     e,
     "script",
-    x(i, "script-src", "default-src")
-  ), await M(
+    x(o, "script-src", "default-src")
+  ), await L(
     t,
     e,
     "style",
     x(
-      i,
+      o,
       "style-src-elem",
       "style-src",
       "default-src"
     )
   );
-  const a = x(
-    i,
+  const s = x(
+    o,
     "style-src-attr",
     "style-src",
     "default-src"
   );
-  if (a && /\sstyle\s*=/i.test(e) && !a.includes("'unsafe-inline'"))
+  if (s && /\sstyle\s*=/i.test(e) && !s.includes("'unsafe-inline'"))
     throw new Error(
       `Static output for ${JSON.stringify(t)} contains an inline style attribute that its CSP does not allow. Move the style into a stylesheet or explicitly allow inline styles.`
     );
 }
-function Qt(t) {
+function le(t) {
   const e = /* @__PURE__ */ new Map();
   for (const r of t.split(";")) {
-    const [n, ...i] = r.trim().split(/\s+/);
-    n && e.set(n.toLowerCase(), i);
+    const [n, ...o] = r.trim().split(/\s+/);
+    n && e.set(n.toLowerCase(), o);
   }
   return e;
 }
@@ -685,34 +784,34 @@ function x(t, ...e) {
       return n;
   }
 }
-async function M(t, e, r, n) {
+async function L(t, e, r, n) {
   if (!(!n || n.includes("'unsafe-inline'")))
-    for (const i of K(e, r)) {
+    for (const o of Q(e, r)) {
       if (r === "script") {
-        const c = Xt(i.attributes, "src");
+        const c = fe(o.attributes, "src");
         if (c) {
-          if (!Yt(n, c))
+          if (!de(n, c))
             throw new Error(
               `Static output for ${JSON.stringify(t)} contains script ${JSON.stringify(c)} that the effective script-src directive does not allow. Add its origin to security.needs.script or the route CSP policy.`
             );
           continue;
         }
       }
-      if (!i.content)
+      if (!o.content)
         continue;
-      const a = await D(i.content);
-      if (!n.includes(a))
+      const s = await _(o.content);
+      if (!n.includes(s))
         throw new Error(
-          `Static output for ${JSON.stringify(t)} contains an inline ${r} without the required CSP hash ${a}.`
+          `Static output for ${JSON.stringify(t)} contains an inline ${r} without the required CSP hash ${s}.`
         );
     }
 }
-function Xt(t, e) {
+function fe(t, e) {
   return t.match(
     new RegExp(`(?:^|\\s)${e}\\s*=\\s*["']([^"']+)["']`, "i")
   )?.[1]?.replaceAll("&amp;", "&");
 }
-function Yt(t, e) {
+function de(t, e) {
   if (!t)
     return !0;
   if (t.includes("'none'") || t.includes("'strict-dynamic'") && t.some(
@@ -730,88 +829,97 @@ function Yt(t, e) {
   return t.some((n) => {
     if (n.startsWith("'"))
       return !1;
-    let i;
+    let o;
     try {
-      i = new URL(n);
+      o = new URL(n);
     } catch {
       return !1;
     }
-    const a = i.hostname.startsWith("*.") ? r.hostname.endsWith(i.hostname.slice(1)) && r.hostname !== i.hostname.slice(2) : r.hostname === i.hostname, c = i.pathname === "/" || i.pathname.endsWith("/") ? r.pathname.startsWith(i.pathname) : r.pathname === i.pathname;
-    return r.protocol === i.protocol && a && r.port === i.port && c;
+    const s = o.hostname.startsWith("*.") ? r.hostname.endsWith(o.hostname.slice(1)) && r.hostname !== o.hostname.slice(2) : r.hostname === o.hostname, c = o.pathname === "/" || o.pathname.endsWith("/") ? r.pathname.startsWith(o.pathname) : r.pathname === o.pathname;
+    return r.protocol === o.protocol && s && r.port === o.port && c;
   });
 }
-function K(t, e) {
-  const r = t.toLowerCase(), n = [], i = `<${e}`, a = `</${e}`;
+function Q(t, e) {
+  const r = t.toLowerCase(), n = [], o = `<${e}`, s = `</${e}`;
   let c = 0;
   for (; c < t.length; ) {
-    const o = r.indexOf(i, c);
-    if (o === -1)
+    const a = r.indexOf(o, c);
+    if (a === -1)
       break;
-    const s = r.indexOf(">", o + i.length), f = s === -1 ? -1 : r.indexOf(a, s + 1), l = f === -1 ? -1 : r.indexOf(">", f + a.length);
-    if (s === -1 || f === -1 || l === -1)
+    const i = r.indexOf(">", a + o.length), u = i === -1 ? -1 : r.indexOf(s, i + 1), f = u === -1 ? -1 : r.indexOf(">", u + s.length);
+    if (i === -1 || u === -1 || f === -1)
       throw new Error(`Static output contains an unclosed <${e}> element.`);
     n.push({
-      attributes: t.slice(o + i.length, s),
-      content: t.slice(s + 1, f)
-    }), c = l + 1;
+      attributes: t.slice(a + o.length, i),
+      content: t.slice(i + 1, u)
+    }), c = f + 1;
   }
   return n;
 }
-function Z(t) {
+function X(t) {
   return Object.fromEntries(
     [...t.entries()].sort(([e], [r]) => e.localeCompare(r))
   );
 }
-async function te(t, e, r) {
-  const n = N(t);
-  await E(n, { recursive: !0 });
-  const i = await W(m(n, ".demiurge-static-"));
+async function he(t, e, r, n) {
+  const o = C(t);
+  await T(o, { recursive: !0 });
+  const s = await k(y(o, ".demiurge-static-"));
   try {
-    for (const o of e) {
-      const s = I(i, o.file);
-      await E(N(s), { recursive: !0 }), await A(s, o.body);
+    for (const i of [...e, ...r]) {
+      const u = W(s, i.file);
+      await T(C(u), { recursive: !0 }), await b(u, i.body);
     }
-    await A(
-      m(i, G),
-      `${JSON.stringify(r, null, 2)}
+    await b(
+      y(s, K),
+      `${JSON.stringify(n, null, 2)}
 `
     );
-    const a = await ee(t);
-    await E(t, { recursive: !0 }), await k(i, t, { recursive: !0, force: !0 });
-    const c = new Set(e.map((o) => o.file));
-    for (const o of a)
-      c.has(o) || await $(I(t, o), { force: !0 });
+    const c = await pe(t);
+    await T(t, { recursive: !0 }), await D(s, t, { recursive: !0, force: !0 });
+    const a = new Set(
+      [...e, ...r].map((i) => i.file)
+    );
+    for (const i of c)
+      a.has(i) || await A(W(t, i), { force: !0 });
   } finally {
-    await $(i, { force: !0, recursive: !0 });
+    await A(s, { force: !0, recursive: !0 });
   }
 }
-async function ee(t) {
+async function pe(t) {
   try {
-    const e = await v(m(t, G), "utf8"), r = JSON.parse(e);
-    return r.adapter !== "static" || r.version !== 1 || !Array.isArray(r.entries) ? [] : r.entries.flatMap(
-      (n) => typeof n.file == "string" && Q(n.file) ? [n.file] : []
+    const e = await O(y(t, K), "utf8"), r = JSON.parse(e);
+    if (r.adapter !== "static" || r.version !== 1 || !Array.isArray(r.entries))
+      return [];
+    const n = Array.isArray(r.fontFiles) ? r.fontFiles : [], o = Array.isArray(r.imageFiles) ? r.imageFiles : [];
+    return [
+      ...r.entries.map((s) => s.file),
+      ...n,
+      ...o
+    ].flatMap(
+      (s) => typeof s == "string" && Y(s) ? [s] : []
     );
   } catch {
     return [];
   }
 }
-function I(t, e) {
-  if (!Q(e))
+function W(t, e) {
+  if (!Y(e))
     throw new Error(`Static output file must stay inside the output directory: ${JSON.stringify(e)}.`);
   const r = h(t), n = h(r, e);
-  if (w(r, n).split(g).includes(".."))
+  if (w(r, n).split(S).includes(".."))
     throw new Error(`Static output file escaped the output directory: ${JSON.stringify(e)}.`);
   return n;
 }
-function Q(t) {
+function Y(t) {
   return !!t && !t.startsWith("/") && !t.startsWith("\\") && !t.split(/[\\/]/).includes("..");
 }
 export {
-  de as createStaticPreviewServer,
-  xt as createVercelOutputConfig,
-  me as generateStaticOutput,
-  pe as generateVercelStaticOutput,
-  Ct as staticAdapter,
-  he as vercelStatic
+  Ne as createStaticPreviewServer,
+  Lt as createVercelOutputConfig,
+  be as generateStaticOutput,
+  xe as generateVercelStaticOutput,
+  qt as staticAdapter,
+  Fe as vercelStatic
 };
 //# sourceMappingURL=index.js.map