nuxt-og-image 6.4.7 → 6.4.9

package/dist/runtime/server/og-image/takumi/renderer.js

@@ -3,6 +3,8 @@ import { withBase } from "ufo";
 import { logger } from "../../../logger.js";
 import { fetchLocalAsset } from "../../util/fetchLocalAsset.js";
 import { getFetchTimeout } from "../../util/fetchTimeout.js";
+import { fetchWithRedirectValidation, isBlockedUrl } from "../../util/ssrf.js";
+import { withTimeout } from "../../util/withTimeout.js";
 import { buildSubsetFamilyChain, extractCodepoints, getDefaultFontFamily, loadFontsForRenderer, resolveSubsetChain } from "../fonts.js";
 import { getExtractResourceUrls, getTakumi } from "./instances.js";
 import { createTakumiNodes } from "./nodes.js";
@@ -20,10 +22,45 @@ async function getTakumiState(event) {
   };
   return nitro._takumiState;
 }
-function withTakumiLock(state, fn) {
-  const next = state.lock.then(fn, fn);
-  state.lock = next.catch(() => void 0);
-  return next;
+function withTakumiLock(state, timeoutMs, fn, onLockTimeout) {
+  const guarded = async () => {
+    let timer;
+    try {
+      return await Promise.race([
+        fn(),
+        new Promise((_, reject) => {
+          timer = setTimeout(
+            () => reject(new Error(`takumi render timed out after ${timeoutMs}ms (lock-held)`)),
+            timeoutMs
+          );
+        })
+      ]);
+    } catch (err) {
+      try {
+        const Renderer = await getTakumi();
+        state.renderer = new Renderer();
+        state.loadedFontKeys.clear();
+        state.loadedFamilies.clear();
+      } catch (resetErr) {
+        logger.warn(`failed to reset takumi renderer after lock timeout: ${resetErr?.message || resetErr}`);
+      }
+      throw err;
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  const work = state.lock.then(guarded, guarded);
+  state.lock = work.catch(() => void 0);
+  let acquireTimer;
+  return Promise.race([
+    work,
+    new Promise((_, reject) => {
+      acquireTimer = setTimeout(() => {
+        onLockTimeout?.();
+        reject(new Error(`takumi lock acquire timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+    })
+  ]).finally(() => clearTimeout(acquireTimer));
 }
 function dedupeFontsByBinary(fonts) {
   const byBinary = /* @__PURE__ */ new Map();
@@ -116,11 +153,16 @@ async function createImage(event, format) {
   const { fontFamilyOverride, defaultFont } = getDefaultFontFamily(options);
   const nodes = await createTakumiNodes(event);
   const codepoints = extractCodepoints(nodes);
-  const fonts = await timings.measure("font-load", () => loadFontsForRenderer(event, { supportedFormats: /* @__PURE__ */ new Set(["ttf", "woff2"]), component: options.component, fontFamilyOverride: fontFamilyOverride || defaultFont, codepoints }));
-  await event._nitro.hooks.callHook("nuxt-og-image:takumi:nodes", nodes, event);
+  const fonts = await timings.measure("font-load", () => loadFontsForRenderer(event, { supportedFormats: /* @__PURE__ */ new Set(["ttf", "woff2"]), preferStatic: true, component: options.component, fontFamilyOverride: fontFamilyOverride || defaultFont, codepoints }));
+  const hookTimeout = event.runtimeConfig.security?.renderTimeout ?? 15e3;
+  await withTimeout(
+    event._nitro.hooks.callHook("nuxt-og-image:takumi:nodes", nodes, event),
+    hookTimeout,
+    "nuxt-og-image:takumi:nodes hook"
+  );
   const subsetChains = buildSubsetFamilyChain(fonts);
-  const state = await getTakumiState(event);
-  const extractResourceUrls = await getExtractResourceUrls();
+  const state = await timings.measure("takumi-init", () => getTakumiState(event));
+  const extractResourceUrls = await timings.measure("takumi-extract-init", () => getExtractResourceUrls());
   const resourceUrls = await extractResourceUrls(nodes);
   const baseURL = event.runtimeConfig.app.baseURL;
   const fetchedResources = [];
@@ -136,13 +178,18 @@ async function createImage(event, format) {
           headers,
           includeExternalFallback: true
         });
-      } else {
+      } else if (import.meta.dev) {
         data = await $fetch(src, {
           responseType: "arrayBuffer",
           signal: AbortSignal.timeout(fetchTimeout),
           timeout: fetchTimeout,
           headers
         }).catch(() => void 0);
+      } else if (!isBlockedUrl(src)) {
+        data = await fetchWithRedirectValidation(src, {
+          timeout: fetchTimeout,
+          headers
+        }) ?? void 0;
       }
       if (data)
         fetchedResources.push({ src, data: new Uint8Array(data) });
@@ -158,21 +205,26 @@ async function createImage(event, format) {
     fetchedResources,
     devicePixelRatio: dpr
   });
-  return await withTakumiLock(state, () => timings.measure("render-takumi", async () => {
-    await loadFontsIntoRenderer(state, fonts);
-    const rootStyle = nodes.style ?? {};
-    if (fontFamilyOverride) {
-      const chain = subsetChains.get(fontFamilyOverride);
-      if (chain) {
-        rootStyle.fontFamily = chain.map((f) => `"${f}"`).join(", ");
-      } else if (state.loadedFamilies.has(fontFamilyOverride)) {
-        rootStyle.fontFamily = fontFamilyOverride;
+  const lockTimeout = event.runtimeConfig.security?.renderTimeout ?? 15e3;
+  const endLockWait = timings.start("lock-wait");
+  return await withTakumiLock(state, lockTimeout, () => {
+    endLockWait();
+    return timings.measure("render-takumi", async () => {
+      await loadFontsIntoRenderer(state, fonts);
+      const rootStyle = nodes.style ?? {};
+      if (fontFamilyOverride) {
+        const chain = subsetChains.get(fontFamilyOverride);
+        if (chain) {
+          rootStyle.fontFamily = chain.map((f) => `"${f}"`).join(", ");
+        } else if (state.loadedFamilies.has(fontFamilyOverride)) {
+          rootStyle.fontFamily = fontFamilyOverride;
+        }
       }
-    }
-    nodes.style = rootStyle;
-    rewriteFontFamilies(nodes, state.loadedFamilies, subsetChains);
-    return state.renderer.render(nodes, renderOptions);
-  }));
+      nodes.style = rootStyle;
+      rewriteFontFamilies(nodes, state.loadedFamilies, subsetChains);
+      return state.renderer.render(nodes, renderOptions);
+    });
+  }, endLockWait);
 }
 const TakumiRenderer = {
   name: "takumi",
@@ -191,7 +243,7 @@ const TakumiRenderer = {
   async debug(e) {
     const [vnodes, fonts] = await Promise.all([
       createTakumiNodes(e),
-      loadFontsForRenderer(e, { supportedFormats: /* @__PURE__ */ new Set(["ttf", "woff2"]), component: e.options.component })
+      loadFontsForRenderer(e, { supportedFormats: /* @__PURE__ */ new Set(["ttf", "woff2"]), preferStatic: true, component: e.options.component })
     ]);
     return {
       vnodes,

package/dist/runtime/server/og-image/templates/html.js

@@ -1,6 +1,6 @@
-import resolvedFonts from "#og-image/fonts";
 import { createHead, renderSSRHead } from "@unhead/vue/server";
 import { createError } from "h3";
+import resolvedFonts from "#og-image/fonts";
 import { fetchIsland } from "../../util/kit.js";
 import { applyEmojis } from "../core/transforms/emojis/index.js";
 const RE_SCRIPT_TAG = /<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi;
@@ -13,7 +13,8 @@ export async function html(ctx) {
       statusMessage: `[Nuxt OG Image] Rendering an invalid component. Received options: ${JSON.stringify(options)}.`
     });
   }
-  const island = await fetchIsland(ctx.e, ctx.options.component, typeof ctx.options.props !== "undefined" ? ctx.options.props : ctx.options);
+  const islandTimeout = ctx.runtimeConfig.security?.renderTimeout ?? 15e3;
+  const island = await fetchIsland(ctx.e, ctx.options.component, typeof ctx.options.props !== "undefined" ? ctx.options.props : ctx.options, islandTimeout);
   const head = createHead();
   head.push(island.head);
   let defaultFontFamily = "sans-serif";

package/dist/runtime/server/plugins/prerender.js

@@ -1,9 +1,9 @@
-import { prerenderOptionsCache } from "#og-image-cache";
-import { createSitePathResolver } from "#site-config/server/composables/utils";
 import { parse } from "devalue";
 import { appendResponseHeader } from "h3";
 import { defineNitroPlugin } from "nitropack/runtime";
 import { parseURL } from "ufo";
+import { prerenderOptionsCache } from "#og-image-cache";
+import { createSitePathResolver } from "#site-config/server/composables/utils";
 import { isInternalRoute } from "../../shared.js";
 import { resolvePathCacheKey } from "../og-image/context.js";
 import { createNitroRouteRuleMatcher } from "../util/kit.js";

package/dist/runtime/server/routes/debug.json.js

@@ -1,3 +1,4 @@
+import { defineEventHandler, setHeader } from "h3";
 import { componentNames } from "#og-image-virtual/component-names.mjs";
 import compatibility from "#og-image/compatibility";
 import { fontRequirements } from "#og-image/font-requirements";
@@ -5,11 +6,10 @@ import resolvedFonts from "#og-image/fonts";
 import availableFonts from "#og-image/fonts-available";
 import { getNitroOrigin } from "#site-config/server/composables";
 import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
-import { defineEventHandler, setHeader } from "h3";
 import { useOgImageRuntimeConfig } from "../utils.js";
 export default defineEventHandler(async (e) => {
   setHeader(e, "Content-Type", "application/json");
-  const runtimeConfig = useOgImageRuntimeConfig();
+  const runtimeConfig = useOgImageRuntimeConfig(e);
   return {
     siteConfigUrl: getSiteConfig(e).url,
     origin: getNitroOrigin(e),

package/dist/runtime/server/routes/resolve.js

@@ -1,6 +1,6 @@
-import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
 import { createError, defineEventHandler, getQuery, getRequestHost, sendRedirect } from "h3";
 import { parseURL, withLeadingSlash, withQuery } from "ufo";
+import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
 import { isInternalRoute } from "../../shared.js";
 import { useOgImageRuntimeConfig } from "../utils.js";
 const RE_META_TAG = /<meta\b[^>]*>/gi;
@@ -30,7 +30,7 @@ function resolveTargetPath(event) {
   return stripped.replace(RE_IMAGE_EXT, "") || "/";
 }
 export default defineEventHandler(async (event) => {
-  const runtimeConfig = useOgImageRuntimeConfig();
+  const runtimeConfig = useOgImageRuntimeConfig(event);
   const security = runtimeConfig.security;
   if (!import.meta.prerender && !import.meta.dev && security?.restrictRuntimeImagesToOrigin) {
     const requestHost = getRequestHost(event, { xForwardedHost: true });

package/dist/runtime/server/util/eventHandlers.js

@@ -1,5 +1,5 @@
-import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
 import { createError, getRequestHost, H3Error, setHeader } from "h3";
+import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
 import { logger } from "../../logger.js";
 import { getBuildCachedImage, setBuildCachedImage } from "../og-image/cache/buildCache.js";
 import { resolveContext } from "../og-image/context.js";
@@ -16,6 +16,7 @@ export async function imageEventHandler(e) {
   if (ctx instanceof H3Error)
     return ctx;
   const timings = ctx.timings;
+  timings.record("resolve-context", performance.now() - reqStart);
   try {
     return await renderOgImage(e, ctx);
   } finally {
@@ -28,7 +29,7 @@ export async function imageEventHandler(e) {
 async function renderOgImage(e, ctx) {
   const timings = ctx.timings;
   const { isDevToolsContextRequest, extension, renderer } = ctx;
-  const { debug, baseCacheKey, security } = useOgImageRuntimeConfig();
+  const { debug, baseCacheKey, security } = useOgImageRuntimeConfig(e);
   if (!import.meta.prerender && !import.meta.dev && security?.restrictRuntimeImagesToOrigin) {
     const requestHost = getRequestHost(e, { xForwardedHost: true });
     let requestHostname;

package/dist/runtime/server/util/fetchLocalAsset.js

@@ -1,5 +1,5 @@
-import { getNitroOrigin } from "#site-config/server/composables";
 import { $fetch } from "ofetch";
+import { getNitroOrigin } from "#site-config/server/composables";
 import { tryCloudflareAssetsFetch } from "./cloudflareAssets.js";
 export async function fetchLocalAsset(event, path, options) {
   const { fetchTimeout, headers, includeExternalFallback = false, onStepFailure } = options;

package/dist/runtime/server/util/kit.d.ts

@@ -2,5 +2,5 @@ import type { H3Event } from 'h3';
 import type { NitroRouteRules } from 'nitropack';
 import type { NuxtIslandResponse } from 'nuxt/app';
 export { withoutQuery } from 'nuxtseo-shared/utils';
-export declare function fetchIsland(e: H3Event, component: string, props: Record<string, any>): Promise<NuxtIslandResponse>;
+export declare function fetchIsland(e: H3Event, component: string, props: Record<string, any>, timeout?: number): Promise<NuxtIslandResponse>;
 export declare function createNitroRouteRuleMatcher(): ((path: string) => NitroRouteRules);

package/dist/runtime/server/util/kit.js

@@ -4,12 +4,15 @@ import { hash } from "ohash";
 import { createRouter as createRadixRouter, toRouteMatcher } from "radix3";
 import { withoutBase, withoutTrailingSlash } from "ufo";
 export { withoutQuery } from "nuxtseo-shared/utils";
-export function fetchIsland(e, component, props) {
+export function fetchIsland(e, component, props, timeout) {
   const hashId = hash([component, props]).replaceAll("_", "-");
+  const signal = timeout ? AbortSignal.timeout(timeout) : void 0;
   return e.$fetch(`/__nuxt_island/${component}_${hashId}.json`, {
     params: {
       props: JSON.stringify(props)
-    }
+    },
+    timeout,
+    signal
   });
 }
 export function createNitroRouteRuleMatcher() {

package/dist/runtime/server/util/options.js

@@ -1,5 +1,5 @@
-import { componentNames } from "#og-image-virtual/component-names.mjs";
 import { createError } from "h3";
+import { componentNames } from "#og-image-virtual/component-names.mjs";
 const RENDERER_SUFFIXES = ["satori", "browser", "takumi"];
 const RE_RENDERER_SUFFIX_DOT = /\.?(satori|browser|takumi)$/i;
 const RE_RENDERER_SUFFIX_PASCAL = /(Satori|Browser|Takumi)$/;

package/dist/runtime/server/util/ssrf.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Expand an IPv6 string to its 8 16-bit groups. Accepts `::` shorthand,
+ * embedded IPv4 in the trailing 32 bits (`::ffff:1.2.3.4`), and zone IDs
+ * (stripped). Returns `null` for any malformed input.
+ */
+export declare function expandIPv6(addr: string): number[] | null;
+/**
+ * Returns true if the URL points at an internal/private network or otherwise
+ * unsafe target. Only `http:` and `https:` are accepted; everything else is
+ * blocked outright.
+ */
+export declare function isBlockedUrl(url: string): boolean;
+export interface SafeFetchOptions {
+    timeout: number;
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+}
+/**
+ * Fetch a URL with manual redirect handling. Each hop (including the initial
+ * URL) is run through `isBlockedUrl` before the request is dispatched, so an
+ * allowed origin returning a 30x to an internal IP cannot complete the SSRF.
+ *
+ * Returns `null` on any failure (block, network error, non-2xx, redirect
+ * limit). The caller treats null as a soft failure and falls back to the
+ * usual missing-asset behaviour.
+ */
+export declare function fetchWithRedirectValidation(initialUrl: string, opts: SafeFetchOptions): Promise<ArrayBuffer | null>;

package/dist/runtime/server/util/ssrf.js

@@ -0,0 +1,165 @@
+const RE_IPV6_BRACKETS = /^\[|\]$/g;
+const RE_DIGIT_ONLY = /^\d+$/;
+const RE_INT_IP = /^(?:0x[\da-f]+|\d+)$/i;
+const RE_HEX_GROUP = /^[0-9a-f]{1,4}$/i;
+const RE_IPV6_CHARS = /^[0-9a-f:.]+$/i;
+const RE_TRAILING_V4 = /(\d+\.\d+\.\d+\.\d+)$/;
+const MAX_REDIRECTS = 5;
+function isPrivateIPv4(a, b) {
+  if (a === 127)
+    return true;
+  if (a === 10)
+    return true;
+  if (a === 172 && b >= 16 && b <= 31)
+    return true;
+  if (a === 192 && b === 168)
+    return true;
+  if (a === 169 && b === 254)
+    return true;
+  if (a === 0)
+    return true;
+  return false;
+}
+export function expandIPv6(addr) {
+  const noZone = addr.split("%")[0];
+  if (!noZone || !RE_IPV6_CHARS.test(noZone))
+    return null;
+  let work = noZone;
+  const v4Match = work.match(RE_TRAILING_V4);
+  if (v4Match) {
+    const octets = v4Match[1].split(".").map(Number);
+    if (octets.some((o) => !Number.isFinite(o) || o < 0 || o > 255))
+      return null;
+    const hi = (octets[0] << 8 | octets[1]).toString(16);
+    const lo = (octets[2] << 8 | octets[3]).toString(16);
+    work = `${work.slice(0, -v4Match[1].length) + hi}:${lo}`;
+  }
+  const parts = work.split("::");
+  if (parts.length > 2)
+    return null;
+  const head = parts[0] ? parts[0].split(":") : [];
+  const tail = parts[1] !== void 0 && parts[1] ? parts[1].split(":") : [];
+  if (parts.length === 1) {
+    if (head.length !== 8)
+      return null;
+  } else if (head.length + tail.length > 7) {
+    return null;
+  }
+  const fillCount = parts.length === 2 ? 8 - head.length - tail.length : 0;
+  const allGroups = [...head, ...Array.from({ length: fillCount }).fill("0"), ...tail];
+  const result = [];
+  for (const g of allGroups) {
+    if (!RE_HEX_GROUP.test(g))
+      return null;
+    result.push(Number.parseInt(g, 16));
+  }
+  return result;
+}
+function isPrivateIPv6(groups) {
+  const [g0, g1, g2, g3, g4, g5, g6, g7] = groups;
+  if (g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0 && g6 === 0 && g7 === 1)
+    return true;
+  if (g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0 && g6 === 0 && g7 === 0)
+    return true;
+  if (g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 65535) {
+    const a = g6 >> 8 & 255;
+    const b = g6 & 255;
+    return isPrivateIPv4(a, b);
+  }
+  if (g0 === 100 && g1 === 65435 && g2 === 0 && g3 === 0 && g4 === 0 && g5 === 0) {
+    const a = g6 >> 8 & 255;
+    const b = g6 & 255;
+    return isPrivateIPv4(a, b);
+  }
+  if (g0 === 100 && g1 === 65435 && g2 === 1)
+    return true;
+  if ((g0 & 65024) === 64512)
+    return true;
+  if ((g0 & 65472) === 65152)
+    return true;
+  if ((g0 & 65472) === 65216)
+    return true;
+  if (g0 === 8193 && g1 === 3512)
+    return true;
+  if ((g0 & 65520) === 16368)
+    return true;
+  if (g0 === 24320)
+    return true;
+  if ((g0 & 65280) === 65280)
+    return true;
+  return false;
+}
+export function isBlockedUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return true;
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+    return true;
+  const hostname = parsed.hostname.toLowerCase();
+  const bare = hostname.replace(RE_IPV6_BRACKETS, "");
+  if (bare === "localhost" || bare.endsWith(".localhost"))
+    return true;
+  const dottedParts = bare.split(".");
+  if (dottedParts.length === 4 && dottedParts.every((p) => RE_DIGIT_ONLY.test(p))) {
+    const octets = dottedParts.map(Number);
+    if (octets.some((o) => o > 255))
+      return true;
+    return isPrivateIPv4(octets[0], octets[1]);
+  }
+  if (RE_INT_IP.test(bare)) {
+    const num = Number(bare);
+    if (Number.isFinite(num) && num >= 0 && num <= 4294967295)
+      return isPrivateIPv4(num >>> 24 & 255, num >>> 16 & 255);
+  }
+  if (bare.includes(":")) {
+    const groups = expandIPv6(bare);
+    if (groups)
+      return isPrivateIPv6(groups);
+    return true;
+  }
+  return false;
+}
+export async function fetchWithRedirectValidation(initialUrl, opts) {
+  const controller = new AbortController();
+  const externalAbort = opts.signal;
+  const onExternalAbort = () => controller.abort(externalAbort?.reason);
+  if (externalAbort) {
+    if (externalAbort.aborted)
+      controller.abort(externalAbort.reason);
+    else
+      externalAbort.addEventListener("abort", onExternalAbort, { once: true });
+  }
+  const timer = setTimeout(() => controller.abort(new Error("timeout")), opts.timeout);
+  try {
+    let url = initialUrl;
+    for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+      if (isBlockedUrl(url))
+        return null;
+      const res = await fetch(url, {
+        redirect: "manual",
+        signal: controller.signal,
+        headers: opts.headers
+      });
+      if (res.status >= 300 && res.status < 400) {
+        const loc = res.headers.get("location");
+        if (!loc)
+          return null;
+        url = new URL(loc, url).toString();
+        continue;
+      }
+      if (!res.ok)
+        return null;
+      return await res.arrayBuffer();
+    }
+    return null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+    if (externalAbort)
+      externalAbort.removeEventListener("abort", onExternalAbort);
+  }
+}

package/dist/runtime/server/util/withTimeout.d.ts

@@ -0,0 +1 @@
+export declare function withTimeout<T>(promise: Promise<T> | T, ms: number, label: string): Promise<T>;

package/dist/runtime/server/util/withTimeout.js

@@ -0,0 +1,12 @@
+export function withTimeout(promise, ms, label) {
+  let timer;
+  return Promise.race([
+    Promise.resolve(promise),
+    new Promise((_, reject) => {
+      timer = setTimeout(
+        () => reject(new Error(`${label} timed out after ${ms}ms`)),
+        ms
+      );
+    })
+  ]).finally(() => clearTimeout(timer));
+}

package/dist/runtime/server/utils.js

@@ -1,6 +1,6 @@
-import { componentNames } from "#og-image-virtual/component-names.mjs";
 import { useRuntimeConfig } from "nitropack/runtime";
 import { joinURL } from "ufo";
+import { componentNames } from "#og-image-virtual/component-names.mjs";
 import { buildOgImageUrl } from "../shared.js";
 export function getOgImagePath(_pagePath, _options) {
   const baseURL = useRuntimeConfig().app.baseURL;
@@ -20,9 +20,13 @@ export function getOgImagePath(_pagePath, _options) {
 }
 export function useOgImageRuntimeConfig(e) {
   const c = useRuntimeConfig(e);
+  const moduleCfg = c["nuxt-og-image"] || {};
+  const overrideSecret = c.ogImage?.secret;
+  const security = overrideSecret ? { ...moduleCfg.security || {}, secret: overrideSecret } : moduleCfg.security;
   return {
     defaults: {},
-    ...c["nuxt-og-image"],
+    ...moduleCfg,
+    security,
     app: {
       baseURL: c.app.baseURL
     }

package/dist/shared/{nuxt-og-image.Cr3WHMk1.mjs → nuxt-og-image.CW3PwVsO.mjs}

@@ -5067,7 +5067,7 @@ export const resolve = (import.meta.dev || import.meta.prerender) ? devResolve :
       if (hasNuxtFonts && fontContext) {
         persistFontUrlMapping({ fontContext, buildDir: nuxt.options.buildDir, logger });
       }
-      if (!fontProcessingDone && convertedWoff2Files.size === 0 && hasSatoriRenderer() && hasNuxtFonts) {
+      if (!fontProcessingDone && convertedWoff2Files.size === 0 && (hasSatoriRenderer() || hasTakumiRenderer()) && hasNuxtFonts) {
         if (pendingFontRequirements.length > 0)
           await Promise.all(pendingFontRequirements);
         await convertWoff2ToTtf({
@@ -5136,7 +5136,7 @@ export const rootDir = ${JSON.stringify(nuxt.options.rootDir)}`;
       });
       nuxt.hook("vite:compiled", async () => {
         persistFontUrlMapping({ fontContext, buildDir: nuxt.options.buildDir, logger });
-        if (fontProcessingDone || !hasSatoriRenderer())
+        if (fontProcessingDone || !hasSatoriRenderer() && !hasTakumiRenderer())
           return;
         if (pendingFontRequirements.length === 0)
           return;
@@ -5240,6 +5240,11 @@ export const rootDir = ${JSON.stringify(nuxt.options.rootDir)}`;
       }
       nuxt.hooks.callHook("nuxt-og-image:runtime-config", runtimeConfig);
       nuxt.options.runtimeConfig["nuxt-og-image"] = runtimeConfig;
+      const existingOgImageCfg = nuxt.options.runtimeConfig.ogImage;
+      nuxt.options.runtimeConfig.ogImage = {
+        ...existingOgImageCfg && typeof existingOgImageCfg === "object" ? existingOgImageCfg : {},
+        secret: existingOgImageCfg?.secret || config.security?.secret || process.env.NUXT_OG_IMAGE_SECRET || ""
+      };
       nuxt.options.runtimeConfig.public = {
         ...nuxt.options.runtimeConfig.public,
         "nuxt-og-image": {

package/dist/shared/{nuxt-og-image.TJuh6pW5.cjs → nuxt-og-image.DnwTVrnM.cjs}

@@ -4320,7 +4320,7 @@ const module$1 = kit.defineNuxtModule({
     await onUpgrade(nuxt, options, previousVersion);
   },
   async setup(config, nuxt) {
-    const _resolver = kit.createResolver((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('shared/nuxt-og-image.TJuh6pW5.cjs', document.baseURI).href)));
+    const _resolver = kit.createResolver((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('shared/nuxt-og-image.DnwTVrnM.cjs', document.baseURI).href)));
     const fixSharedPath = (p) => {
       if (p.includes("/shared/runtime/"))
         return p.replace("/shared/runtime/", "/runtime/");
@@ -5087,7 +5087,7 @@ export const resolve = (import.meta.dev || import.meta.prerender) ? devResolve :
       if (hasNuxtFonts && fontContext) {
         persistFontUrlMapping({ fontContext, buildDir: nuxt.options.buildDir, logger: logger_js.logger });
       }
-      if (!fontProcessingDone && convertedWoff2Files.size === 0 && hasSatoriRenderer() && hasNuxtFonts) {
+      if (!fontProcessingDone && convertedWoff2Files.size === 0 && (hasSatoriRenderer() || hasTakumiRenderer()) && hasNuxtFonts) {
         if (pendingFontRequirements.length > 0)
           await Promise.all(pendingFontRequirements);
         await convertWoff2ToTtf({
@@ -5156,7 +5156,7 @@ export const rootDir = ${JSON.stringify(nuxt.options.rootDir)}`;
       });
       nuxt.hook("vite:compiled", async () => {
         persistFontUrlMapping({ fontContext, buildDir: nuxt.options.buildDir, logger: logger_js.logger });
-        if (fontProcessingDone || !hasSatoriRenderer())
+        if (fontProcessingDone || !hasSatoriRenderer() && !hasTakumiRenderer())
           return;
         if (pendingFontRequirements.length === 0)
           return;
@@ -5260,6 +5260,11 @@ export const rootDir = ${JSON.stringify(nuxt.options.rootDir)}`;
       }
       nuxt.hooks.callHook("nuxt-og-image:runtime-config", runtimeConfig);
       nuxt.options.runtimeConfig["nuxt-og-image"] = runtimeConfig;
+      const existingOgImageCfg = nuxt.options.runtimeConfig.ogImage;
+      nuxt.options.runtimeConfig.ogImage = {
+        ...existingOgImageCfg && typeof existingOgImageCfg === "object" ? existingOgImageCfg : {},
+        secret: existingOgImageCfg?.secret || config.security?.secret || process.env.NUXT_OG_IMAGE_SECRET || ""
+      };
       nuxt.options.runtimeConfig.public = {
         ...nuxt.options.runtimeConfig.public,
         "nuxt-og-image": {