@farm.js/core 0.1.0-beta.1 → 0.1.0-beta.3

package/dist/runtime-C1B7pSGT.d.mts

@@ -0,0 +1,207 @@
+import { RouteDataCacheKey } from './cache.mjs';
+
+type AnySchema = {
+    _output?: any;
+    _input?: any;
+    parse?: (data: unknown) => any;
+};
+type MaybePromise<T> = T | Promise<T>;
+type Simplify<T> = {
+    [TKey in keyof T]: T[TKey];
+} & {};
+type UnionToIntersection<T> = (T extends unknown ? (value: T) => void : never) extends (value: infer TIntersection) => void ? TIntersection : never;
+type InferOutput<T> = T extends {
+    _output: infer O;
+} ? O : T extends {
+    parse: (data: unknown) => infer R;
+} ? R : unknown;
+type InferHeadersOutput<T> = [T] extends [never] ? Record<string, string> : T extends AnySchema ? InferOutput<T> : Record<string, string>;
+type EndpointErrorDefinition<TSchema extends AnySchema = AnySchema, TStatus extends number = number> = {
+    status: TStatus;
+    schema: TSchema;
+    /** Public message safe to expose to API callers. */
+    message?: string;
+};
+type EndpointErrorDefinitions = Record<string, EndpointErrorDefinition<AnySchema, number>>;
+type EndpointErrorContracts<TErrors extends EndpointErrorDefinitions> = {
+    [TCode in keyof TErrors]: {
+        data: InferOutput<TErrors[TCode]["schema"]>;
+        status: TErrors[TCode]["status"];
+    };
+};
+type EndpointFail<TErrors extends EndpointErrorDefinitions> = <TCode extends keyof TErrors & string>(code: TCode, data: InferOutput<TErrors[TCode]["schema"]>) => never;
+declare class EndpointFailure<TCode extends string = string, TData = unknown> extends Error {
+    readonly code: TCode;
+    readonly data: TData;
+    readonly status: number;
+    constructor(code: TCode, data: TData, options: {
+        status: number;
+        message: string;
+    });
+}
+declare function isEndpointFailure(value: unknown): value is EndpointFailure<string, unknown>;
+type EndpointParamValue = string | string[];
+type EndpointParams = Record<string, EndpointParamValue>;
+type EndpointMiddlewareContext<TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = {
+    body: TBody;
+    query: TQuery;
+    headers: THeaders;
+    request: Request;
+    /** Context accumulated from middleware that ran earlier in the chain. */
+    context: Readonly<TContext>;
+    params: EndpointParams;
+};
+type EndpointMiddlewareResult<TProvidedContext extends object = object> = TProvidedContext | true | false | Response;
+/** A plain async function. No wrapper or `next()` callback is required. */
+type EndpointMiddleware<TProvidedContext extends object = object, TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = (ctx: EndpointMiddlewareContext<TContext, TBody, TQuery, THeaders>) => MaybePromise<EndpointMiddlewareResult<TProvidedContext>>;
+type AnyEndpointMiddleware = (ctx: EndpointMiddlewareContext<any, any, any, any>) => unknown;
+type EndpointInvalidationTarget = {
+    key: RouteDataCacheKey;
+} | {
+    path: string;
+};
+type EndpointInvalidationContext<TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = EndpointMiddlewareContext<TContext, TBody, TQuery, THeaders> & {
+    /** The raw value returned by the endpoint handler. */
+    result: unknown;
+};
+type EndpointInvalidations<TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = readonly EndpointInvalidationTarget[] | ((context: EndpointInvalidationContext<TContext, TBody, TQuery, THeaders>) => readonly EndpointInvalidationTarget[] | Promise<readonly EndpointInvalidationTarget[]>);
+type ValidateEndpointMiddlewares<TMiddlewares extends readonly AnyEndpointMiddleware[]> = {
+    readonly [TIndex in keyof TMiddlewares]: TMiddlewares[TIndex] extends AnyEndpointMiddleware ? [Awaited<ReturnType<TMiddlewares[TIndex]>>] extends [EndpointMiddlewareResult<object>] ? TMiddlewares[TIndex] : never : never;
+};
+type ContextFromMiddlewareResult<TResult> = Exclude<TResult, Response | boolean> extends infer TContext ? [TContext] extends [never] ? {} : TContext extends object ? TContext : {} : {};
+type ContextFromMiddleware<TMiddleware> = TMiddleware extends (...args: any[]) => infer TResult ? ContextFromMiddlewareResult<Awaited<TResult>> : {};
+type InferEndpointMiddlewareContext<TMiddlewares extends readonly ((...args: any[]) => any)[], TContext extends object = {}> = TMiddlewares extends readonly [infer TMiddleware, ...infer TRest] ? TMiddleware extends (...args: any[]) => any ? TRest extends readonly ((...args: any[]) => any)[] ? InferEndpointMiddlewareContext<TRest, Simplify<TContext & ContextFromMiddleware<TMiddleware>>> : Simplify<TContext> : Simplify<TContext> : number extends TMiddlewares["length"] ? Simplify<TContext & UnionToIntersection<ContextFromMiddleware<TMiddlewares[number]>>> : Simplify<TContext>;
+type EndpointOptions<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TMiddlewares extends readonly AnyEndpointMiddleware[] = readonly [], TErrors extends EndpointErrorDefinitions = {}> = {
+    method?: "GET" | "HEAD" | "POST" | "PUT" | "DELETE" | "PATCH" | "OPTIONS";
+    body?: TBody;
+    query?: TQuery;
+    headers?: THeaders;
+    middleware?: TMiddlewares;
+    /**
+     * Cache keys and route paths made stale after a successful handler result.
+     * The resolver receives validated input and middleware context.
+     */
+    invalidates?: EndpointInvalidations<InferEndpointMiddlewareContext<TMiddlewares>, InferOutput<TBody>, InferOutput<TQuery>, InferHeadersOutput<THeaders>>;
+    errors?: TErrors;
+    /** @deprecated Use plain functions in `middleware` for Farm endpoint middleware. */
+    use?: any[];
+};
+type EndpointHandler<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any, TContext extends object = {}, TErrors extends EndpointErrorDefinitions = {}> = (ctx: {
+    body: InferOutput<TBody>;
+    query: InferOutput<TQuery>;
+    headers: InferHeadersOutput<THeaders>;
+    request: Request;
+    context: Readonly<TContext>;
+    params: EndpointParams;
+    fail: EndpointFail<TErrors>;
+}) => Promise<TResponse> | TResponse;
+type TypedEndpoint<TBody = never, TQuery = never, TResponse = any, THeaders = Record<string, string>, TErrors = never> = {
+    __types: {
+        body: TBody;
+        query: TQuery;
+        headers: THeaders;
+        response: TResponse;
+        errors: TErrors;
+    };
+    __path?: string;
+    __method?: string;
+} & ((options?: {
+    body?: TBody;
+    query?: TQuery;
+}) => Promise<TResponse>);
+type CreatedEndpoint<TBody extends AnySchema, TQuery extends AnySchema, THeaders extends AnySchema, TResponse, TErrors extends EndpointErrorDefinitions = {}> = TypedEndpoint<InferOutput<TBody>, InferOutput<TQuery>, Awaited<TResponse>, InferHeadersOutput<THeaders>, EndpointErrorContracts<TErrors>>;
+type AnyEndpointOptions = EndpointOptions<AnySchema, AnySchema, AnySchema, readonly AnyEndpointMiddleware[], EndpointErrorDefinitions>;
+type EndpointBodyFromOptions<TOptions> = TOptions extends {
+    body: infer TBody extends AnySchema;
+} ? TBody : never;
+type EndpointQueryFromOptions<TOptions> = TOptions extends {
+    query: infer TQuery extends AnySchema;
+} ? TQuery : never;
+type EndpointHeadersFromOptions<TOptions> = TOptions extends {
+    headers: infer THeaders extends AnySchema;
+} ? THeaders : never;
+type EndpointMiddlewaresFromOptions<TOptions> = TOptions extends {
+    middleware: infer TMiddlewares extends readonly AnyEndpointMiddleware[];
+} ? TMiddlewares : readonly [];
+type EndpointErrorsFromOptions<TOptions> = TOptions extends {
+    errors: infer TErrors extends EndpointErrorDefinitions;
+} ? TErrors : {};
+type MethodlessEndpointOptions = Omit<AnyEndpointOptions, "method">;
+type EndpointHandlerFromOptions<TOptions, TResponse> = EndpointHandler<EndpointBodyFromOptions<TOptions>, EndpointQueryFromOptions<TOptions>, EndpointHeadersFromOptions<TOptions>, TResponse, InferEndpointMiddlewareContext<EndpointMiddlewaresFromOptions<TOptions>>, EndpointErrorsFromOptions<TOptions>>;
+type ValidatedEndpointHandlerFromOptions<TOptions, TResponse> = EndpointHandlerFromOptions<TOptions, TResponse> & (EndpointMiddlewaresFromOptions<TOptions> extends ValidateEndpointMiddlewares<EndpointMiddlewaresFromOptions<TOptions>> ? unknown : never);
+type CreatedEndpointFromOptions<TOptions, TResponse> = CreatedEndpoint<EndpointBodyFromOptions<TOptions>, EndpointQueryFromOptions<TOptions>, EndpointHeadersFromOptions<TOptions>, TResponse, EndpointErrorsFromOptions<TOptions>>;
+/**
+ * Create a Farm.js API endpoint
+ *
+ * Supports two patterns:
+ * 1. File-based routing (path auto-inferred from file location):
+ *    `export const POST = createEndpoint({ method: 'POST', body: schema }, handler)`
+ *    `createEndpoint({ method: 'GET', query: z.object({...}) }, handler)`
+ *
+ * 2. Explicit path (for routes.ts at project root):
+ *    `createEndpoint('/api/hello', { method: 'GET', query: z.object({...}) }, handler)`
+ */
+declare function createEndpoint<const TOptions extends AnyEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function createEndpoint<const TOptions extends AnyEndpointOptions, TResponse = any>(path: string, options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function createEndpoint<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: EndpointOptions<TBody, TQuery, THeaders, readonly []>, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+declare function createEndpoint<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(path: string, options: EndpointOptions<TBody, TQuery, THeaders, readonly []>, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for GET requests
+ */
+declare function GET<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function GET<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function GET<TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<never, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<never, TQuery, THeaders, TResponse>): CreatedEndpoint<never, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for HEAD requests
+ */
+declare function HEAD<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function HEAD<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function HEAD<TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<never, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<never, TQuery, THeaders, TResponse>): CreatedEndpoint<never, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for POST requests
+ */
+declare function POST<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function POST<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function POST<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<TBody, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for PUT requests
+ */
+declare function PUT<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function PUT<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function PUT<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<TBody, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for DELETE requests
+ */
+declare function DELETE<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function DELETE<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function DELETE<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<TBody, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for PATCH requests
+ */
+declare function PATCH<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function PATCH<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function PATCH<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<TBody, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for OPTIONS requests
+ */
+declare function OPTIONS<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function OPTIONS<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function OPTIONS<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<TBody, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+
+type APIRouteParamValue = string | string[];
+type APIRouteParams = Record<string, APIRouteParamValue>;
+interface APIRouteMatch<T extends {
+    path: string;
+}> {
+    route: T;
+    params: APIRouteParams;
+}
+declare function matchAPIRoute<T extends {
+    path: string;
+}>(routes: Map<string, T>, pathname: string): APIRouteMatch<T> | null;
+declare function invokeAPIRouteEndpoint(endpoint: any, request: Request, params?: APIRouteParams): Promise<Response>;
+declare function normalizeRouteResponse(result: unknown): Response;
+declare function isWebResponse(value: unknown): value is Response;
+declare function createEndpointFailureResponse(failure: EndpointFailure<string, unknown>): Response;
+
+export { type APIRouteMatch as A, DELETE as D, type EndpointErrorDefinition as E, GET as G, HEAD as H, type InferEndpointMiddlewareContext as I, OPTIONS as O, POST as P, type TypedEndpoint as T, isWebResponse as a, type APIRouteParams as b, type APIRouteParamValue as c, type EndpointErrorDefinitions as d, type EndpointErrorContracts as e, type EndpointFail as f, EndpointFailure as g, isEndpointFailure as h, invokeAPIRouteEndpoint as i, type EndpointParamValue as j, type EndpointParams as k, type EndpointMiddlewareContext as l, matchAPIRoute as m, normalizeRouteResponse as n, type EndpointMiddlewareResult as o, type EndpointMiddleware as p, type AnyEndpointMiddleware as q, type EndpointInvalidationTarget as r, type EndpointInvalidationContext as s, type EndpointInvalidations as t, type EndpointOptions as u, type EndpointHandler as v, createEndpoint as w, PUT as x, PATCH as y, createEndpointFailureResponse as z };

package/dist/runtime-CdPHt0bv.d.ts

@@ -0,0 +1,207 @@
+import { RouteDataCacheKey } from './cache.js';
+
+type AnySchema = {
+    _output?: any;
+    _input?: any;
+    parse?: (data: unknown) => any;
+};
+type MaybePromise<T> = T | Promise<T>;
+type Simplify<T> = {
+    [TKey in keyof T]: T[TKey];
+} & {};
+type UnionToIntersection<T> = (T extends unknown ? (value: T) => void : never) extends (value: infer TIntersection) => void ? TIntersection : never;
+type InferOutput<T> = T extends {
+    _output: infer O;
+} ? O : T extends {
+    parse: (data: unknown) => infer R;
+} ? R : unknown;
+type InferHeadersOutput<T> = [T] extends [never] ? Record<string, string> : T extends AnySchema ? InferOutput<T> : Record<string, string>;
+type EndpointErrorDefinition<TSchema extends AnySchema = AnySchema, TStatus extends number = number> = {
+    status: TStatus;
+    schema: TSchema;
+    /** Public message safe to expose to API callers. */
+    message?: string;
+};
+type EndpointErrorDefinitions = Record<string, EndpointErrorDefinition<AnySchema, number>>;
+type EndpointErrorContracts<TErrors extends EndpointErrorDefinitions> = {
+    [TCode in keyof TErrors]: {
+        data: InferOutput<TErrors[TCode]["schema"]>;
+        status: TErrors[TCode]["status"];
+    };
+};
+type EndpointFail<TErrors extends EndpointErrorDefinitions> = <TCode extends keyof TErrors & string>(code: TCode, data: InferOutput<TErrors[TCode]["schema"]>) => never;
+declare class EndpointFailure<TCode extends string = string, TData = unknown> extends Error {
+    readonly code: TCode;
+    readonly data: TData;
+    readonly status: number;
+    constructor(code: TCode, data: TData, options: {
+        status: number;
+        message: string;
+    });
+}
+declare function isEndpointFailure(value: unknown): value is EndpointFailure<string, unknown>;
+type EndpointParamValue = string | string[];
+type EndpointParams = Record<string, EndpointParamValue>;
+type EndpointMiddlewareContext<TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = {
+    body: TBody;
+    query: TQuery;
+    headers: THeaders;
+    request: Request;
+    /** Context accumulated from middleware that ran earlier in the chain. */
+    context: Readonly<TContext>;
+    params: EndpointParams;
+};
+type EndpointMiddlewareResult<TProvidedContext extends object = object> = TProvidedContext | true | false | Response;
+/** A plain async function. No wrapper or `next()` callback is required. */
+type EndpointMiddleware<TProvidedContext extends object = object, TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = (ctx: EndpointMiddlewareContext<TContext, TBody, TQuery, THeaders>) => MaybePromise<EndpointMiddlewareResult<TProvidedContext>>;
+type AnyEndpointMiddleware = (ctx: EndpointMiddlewareContext<any, any, any, any>) => unknown;
+type EndpointInvalidationTarget = {
+    key: RouteDataCacheKey;
+} | {
+    path: string;
+};
+type EndpointInvalidationContext<TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = EndpointMiddlewareContext<TContext, TBody, TQuery, THeaders> & {
+    /** The raw value returned by the endpoint handler. */
+    result: unknown;
+};
+type EndpointInvalidations<TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = readonly EndpointInvalidationTarget[] | ((context: EndpointInvalidationContext<TContext, TBody, TQuery, THeaders>) => readonly EndpointInvalidationTarget[] | Promise<readonly EndpointInvalidationTarget[]>);
+type ValidateEndpointMiddlewares<TMiddlewares extends readonly AnyEndpointMiddleware[]> = {
+    readonly [TIndex in keyof TMiddlewares]: TMiddlewares[TIndex] extends AnyEndpointMiddleware ? [Awaited<ReturnType<TMiddlewares[TIndex]>>] extends [EndpointMiddlewareResult<object>] ? TMiddlewares[TIndex] : never : never;
+};
+type ContextFromMiddlewareResult<TResult> = Exclude<TResult, Response | boolean> extends infer TContext ? [TContext] extends [never] ? {} : TContext extends object ? TContext : {} : {};
+type ContextFromMiddleware<TMiddleware> = TMiddleware extends (...args: any[]) => infer TResult ? ContextFromMiddlewareResult<Awaited<TResult>> : {};
+type InferEndpointMiddlewareContext<TMiddlewares extends readonly ((...args: any[]) => any)[], TContext extends object = {}> = TMiddlewares extends readonly [infer TMiddleware, ...infer TRest] ? TMiddleware extends (...args: any[]) => any ? TRest extends readonly ((...args: any[]) => any)[] ? InferEndpointMiddlewareContext<TRest, Simplify<TContext & ContextFromMiddleware<TMiddleware>>> : Simplify<TContext> : Simplify<TContext> : number extends TMiddlewares["length"] ? Simplify<TContext & UnionToIntersection<ContextFromMiddleware<TMiddlewares[number]>>> : Simplify<TContext>;
+type EndpointOptions<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TMiddlewares extends readonly AnyEndpointMiddleware[] = readonly [], TErrors extends EndpointErrorDefinitions = {}> = {
+    method?: "GET" | "HEAD" | "POST" | "PUT" | "DELETE" | "PATCH" | "OPTIONS";
+    body?: TBody;
+    query?: TQuery;
+    headers?: THeaders;
+    middleware?: TMiddlewares;
+    /**
+     * Cache keys and route paths made stale after a successful handler result.
+     * The resolver receives validated input and middleware context.
+     */
+    invalidates?: EndpointInvalidations<InferEndpointMiddlewareContext<TMiddlewares>, InferOutput<TBody>, InferOutput<TQuery>, InferHeadersOutput<THeaders>>;
+    errors?: TErrors;
+    /** @deprecated Use plain functions in `middleware` for Farm endpoint middleware. */
+    use?: any[];
+};
+type EndpointHandler<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any, TContext extends object = {}, TErrors extends EndpointErrorDefinitions = {}> = (ctx: {
+    body: InferOutput<TBody>;
+    query: InferOutput<TQuery>;
+    headers: InferHeadersOutput<THeaders>;
+    request: Request;
+    context: Readonly<TContext>;
+    params: EndpointParams;
+    fail: EndpointFail<TErrors>;
+}) => Promise<TResponse> | TResponse;
+type TypedEndpoint<TBody = never, TQuery = never, TResponse = any, THeaders = Record<string, string>, TErrors = never> = {
+    __types: {
+        body: TBody;
+        query: TQuery;
+        headers: THeaders;
+        response: TResponse;
+        errors: TErrors;
+    };
+    __path?: string;
+    __method?: string;
+} & ((options?: {
+    body?: TBody;
+    query?: TQuery;
+}) => Promise<TResponse>);
+type CreatedEndpoint<TBody extends AnySchema, TQuery extends AnySchema, THeaders extends AnySchema, TResponse, TErrors extends EndpointErrorDefinitions = {}> = TypedEndpoint<InferOutput<TBody>, InferOutput<TQuery>, Awaited<TResponse>, InferHeadersOutput<THeaders>, EndpointErrorContracts<TErrors>>;
+type AnyEndpointOptions = EndpointOptions<AnySchema, AnySchema, AnySchema, readonly AnyEndpointMiddleware[], EndpointErrorDefinitions>;
+type EndpointBodyFromOptions<TOptions> = TOptions extends {
+    body: infer TBody extends AnySchema;
+} ? TBody : never;
+type EndpointQueryFromOptions<TOptions> = TOptions extends {
+    query: infer TQuery extends AnySchema;
+} ? TQuery : never;
+type EndpointHeadersFromOptions<TOptions> = TOptions extends {
+    headers: infer THeaders extends AnySchema;
+} ? THeaders : never;
+type EndpointMiddlewaresFromOptions<TOptions> = TOptions extends {
+    middleware: infer TMiddlewares extends readonly AnyEndpointMiddleware[];
+} ? TMiddlewares : readonly [];
+type EndpointErrorsFromOptions<TOptions> = TOptions extends {
+    errors: infer TErrors extends EndpointErrorDefinitions;
+} ? TErrors : {};
+type MethodlessEndpointOptions = Omit<AnyEndpointOptions, "method">;
+type EndpointHandlerFromOptions<TOptions, TResponse> = EndpointHandler<EndpointBodyFromOptions<TOptions>, EndpointQueryFromOptions<TOptions>, EndpointHeadersFromOptions<TOptions>, TResponse, InferEndpointMiddlewareContext<EndpointMiddlewaresFromOptions<TOptions>>, EndpointErrorsFromOptions<TOptions>>;
+type ValidatedEndpointHandlerFromOptions<TOptions, TResponse> = EndpointHandlerFromOptions<TOptions, TResponse> & (EndpointMiddlewaresFromOptions<TOptions> extends ValidateEndpointMiddlewares<EndpointMiddlewaresFromOptions<TOptions>> ? unknown : never);
+type CreatedEndpointFromOptions<TOptions, TResponse> = CreatedEndpoint<EndpointBodyFromOptions<TOptions>, EndpointQueryFromOptions<TOptions>, EndpointHeadersFromOptions<TOptions>, TResponse, EndpointErrorsFromOptions<TOptions>>;
+/**
+ * Create a Farm.js API endpoint
+ *
+ * Supports two patterns:
+ * 1. File-based routing (path auto-inferred from file location):
+ *    `export const POST = createEndpoint({ method: 'POST', body: schema }, handler)`
+ *    `createEndpoint({ method: 'GET', query: z.object({...}) }, handler)`
+ *
+ * 2. Explicit path (for routes.ts at project root):
+ *    `createEndpoint('/api/hello', { method: 'GET', query: z.object({...}) }, handler)`
+ */
+declare function createEndpoint<const TOptions extends AnyEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function createEndpoint<const TOptions extends AnyEndpointOptions, TResponse = any>(path: string, options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function createEndpoint<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: EndpointOptions<TBody, TQuery, THeaders, readonly []>, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+declare function createEndpoint<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(path: string, options: EndpointOptions<TBody, TQuery, THeaders, readonly []>, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for GET requests
+ */
+declare function GET<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function GET<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function GET<TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<never, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<never, TQuery, THeaders, TResponse>): CreatedEndpoint<never, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for HEAD requests
+ */
+declare function HEAD<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function HEAD<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function HEAD<TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<never, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<never, TQuery, THeaders, TResponse>): CreatedEndpoint<never, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for POST requests
+ */
+declare function POST<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function POST<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function POST<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<TBody, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for PUT requests
+ */
+declare function PUT<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function PUT<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function PUT<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<TBody, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for DELETE requests
+ */
+declare function DELETE<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function DELETE<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function DELETE<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<TBody, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for PATCH requests
+ */
+declare function PATCH<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function PATCH<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function PATCH<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<TBody, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+/**
+ * Convenience method for OPTIONS requests
+ */
+declare function OPTIONS<T = any>(handler: EndpointHandler<never, never, never, T>): CreatedEndpoint<never, never, never, T>;
+declare function OPTIONS<const TOptions extends MethodlessEndpointOptions, TResponse = any>(options: TOptions, handler: ValidatedEndpointHandlerFromOptions<TOptions, TResponse>): CreatedEndpointFromOptions<TOptions, TResponse>;
+declare function OPTIONS<TBody extends AnySchema = never, TQuery extends AnySchema = never, THeaders extends AnySchema = never, TResponse = any>(options: Omit<EndpointOptions<TBody, TQuery, THeaders, readonly []>, "method">, handler: EndpointHandler<TBody, TQuery, THeaders, TResponse>): CreatedEndpoint<TBody, TQuery, THeaders, TResponse>;
+
+type APIRouteParamValue = string | string[];
+type APIRouteParams = Record<string, APIRouteParamValue>;
+interface APIRouteMatch<T extends {
+    path: string;
+}> {
+    route: T;
+    params: APIRouteParams;
+}
+declare function matchAPIRoute<T extends {
+    path: string;
+}>(routes: Map<string, T>, pathname: string): APIRouteMatch<T> | null;
+declare function invokeAPIRouteEndpoint(endpoint: any, request: Request, params?: APIRouteParams): Promise<Response>;
+declare function normalizeRouteResponse(result: unknown): Response;
+declare function isWebResponse(value: unknown): value is Response;
+declare function createEndpointFailureResponse(failure: EndpointFailure<string, unknown>): Response;
+
+export { type APIRouteMatch as A, DELETE as D, type EndpointErrorDefinition as E, GET as G, HEAD as H, type InferEndpointMiddlewareContext as I, OPTIONS as O, POST as P, type TypedEndpoint as T, isWebResponse as a, type APIRouteParams as b, type APIRouteParamValue as c, type EndpointErrorDefinitions as d, type EndpointErrorContracts as e, type EndpointFail as f, EndpointFailure as g, isEndpointFailure as h, invokeAPIRouteEndpoint as i, type EndpointParamValue as j, type EndpointParams as k, type EndpointMiddlewareContext as l, matchAPIRoute as m, normalizeRouteResponse as n, type EndpointMiddlewareResult as o, type EndpointMiddleware as p, type AnyEndpointMiddleware as q, type EndpointInvalidationTarget as r, type EndpointInvalidationContext as s, type EndpointInvalidations as t, type EndpointOptions as u, type EndpointHandler as v, createEndpoint as w, PUT as x, PATCH as y, createEndpointFailureResponse as z };

package/dist/server-action-security.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server-action-security.ts","../src/cache-invalidation.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { subscribeFarmCacheInvalidation } from \"./cache-invalidation\";\n\nexport const DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1_000_000;\n\nexport interface FarmServerActionsConfig {\n  /** Additional trusted origins or host patterns, such as https://app.example.com. */\n  allowedOrigins?: readonly string[];\n  /** Maximum encoded request body size in bytes or as a size string such as \"1mb\". */\n  bodySizeLimit?: number | string;\n}\n\nexport interface ResolvedFarmServerActionsConfig {\n  allowedOrigins: readonly string[];\n  bodySizeLimit: number;\n}\n\nexport type ServerActionRequestKind = \"javascript\" | \"form\";\n\nexport interface PreparedServerActionRequest {\n  body: string | FormData;\n  contentType: string;\n}\n\nexport type SanitizedServerActionError = {\n  name: \"ServerActionError\";\n  message: \"Server function failed\";\n};\n\ntype ServerActionRequestErrorCode =\n  | \"BODY_TOO_LARGE\"\n  | \"INVALID_ACTION_ID\"\n  | \"INVALID_BODY\"\n  | \"INVALID_CONTENT_LENGTH\"\n  | \"INVALID_METHOD\"\n  | \"INVALID_ORIGIN\"\n  | \"MISSING_ORIGIN\"\n  | \"UNSUPPORTED_CONTENT_TYPE\";\n\nexport class ServerActionRequestError extends Error {\n  readonly code: ServerActionRequestErrorCode;\n  readonly status: number;\n\n  constructor(code: ServerActionRequestErrorCode, status: number, message: string) {\n    super(message);\n    this.name = \"ServerActionRequestError\";\n    this.code = code;\n    this.status = status;\n  }\n}\n\ntype ServerActionExecutionContext = {\n  request: Request;\n  signal: AbortSignal;\n  invalidations: Set<string>;\n};\n\nconst SERVER_ACTION_STORAGE_KEY = Symbol.for(\"farm.serverActionStorage\");\nconst FALLBACK_ABORT_CONTROLLER_KEY = Symbol.for(\"farm.serverActionFallbackAbortController\");\nconst FORM_ACTION_CONTENT_TYPES = new Set([\n  \"application/x-www-form-urlencoded\",\n  \"multipart/form-data\",\n]);\nconst JAVASCRIPT_ACTION_CONTENT_TYPES = new Set([\n  \"application/octet-stream\",\n  \"application/x-www-form-urlencoded\",\n  \"multipart/form-data\",\n  \"text/plain\",\n]);\n\ntype GlobalWithServerActionStorage = typeof globalThis & {\n  [SERVER_ACTION_STORAGE_KEY]?: AsyncLocalStorage<ServerActionExecutionContext>;\n  [FALLBACK_ABORT_CONTROLLER_KEY]?: AbortController;\n};\n\nexport function resolveServerActionsConfig(\n  config: FarmServerActionsConfig | undefined,\n): ResolvedFarmServerActionsConfig {\n  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);\n  const bodySizeLimit = parseBodySizeLimit(\n    config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,\n  );\n\n  return Object.freeze({\n    allowedOrigins: Object.freeze(allowedOrigins),\n    bodySizeLimit,\n  });\n}\n\nexport function validateServerActionRequest(\n  request: Request,\n  config: ResolvedFarmServerActionsConfig,\n): void {\n  if (request.method.toUpperCase() !== \"POST\") {\n    throw new ServerActionRequestError(\n      \"INVALID_METHOD\",\n      405,\n      \"Server actions only accept POST requests\",\n    );\n  }\n\n  const requestUrl = new URL(request.url);\n  const sourceOrigin = getRequestSourceOrigin(request);\n  const fetchSite = request.headers.get(\"sec-fetch-site\")?.trim().toLowerCase();\n\n  if (!sourceOrigin) {\n    if (fetchSite !== \"same-origin\") {\n      throw new ServerActionRequestError(\n        \"MISSING_ORIGIN\",\n        403,\n        \"Server action request is missing same-origin metadata\",\n      );\n    }\n    return;\n  }\n\n  const matchesRequest =\n    sourceOrigin === requestUrl.origin || matchesHostHeader(sourceOrigin, request);\n  const matchesConfiguredOrigin = config.allowedOrigins.some((pattern) =>\n    matchesAllowedOrigin(sourceOrigin, pattern),\n  );\n\n  if (!matchesRequest && !matchesConfiguredOrigin) {\n    throw new ServerActionRequestError(\n      \"INVALID_ORIGIN\",\n      403,\n      \"Server action origin does not match the request origin\",\n    );\n  }\n\n  if (fetchSite === \"cross-site\" && !matchesConfiguredOrigin) {\n    throw new ServerActionRequestError(\n      \"INVALID_ORIGIN\",\n      403,\n      \"Cross-site server action request was rejected\",\n    );\n  }\n}\n\nexport async function prepareServerActionRequest(\n  request: Request,\n  config: ResolvedFarmServerActionsConfig,\n  kind: ServerActionRequestKind,\n  actionId?: string | null,\n): Promise<PreparedServerActionRequest> {\n  validateServerActionRequest(request, config);\n\n  if (kind === \"javascript\") {\n    validateActionId(actionId);\n  }\n\n  const contentType = getSupportedContentType(request, kind);\n  const bytes = await readBodyWithLimit(request, config.bodySizeLimit);\n\n  if (kind === \"form\" || contentType === \"multipart/form-data\") {\n    return {\n      body: await parseFormData(request, bytes),\n      contentType,\n    };\n  }\n\n  return {\n    body: new TextDecoder().decode(bytes),\n    contentType,\n  };\n}\n\nexport function createServerActionRequestErrorResponse(error: unknown): Response | null {\n  if (!(error instanceof ServerActionRequestError)) {\n    return null;\n  }\n\n  const headers = new Headers({\n    \"cache-control\": \"no-store\",\n    \"content-type\": \"text/plain; charset=utf-8\",\n    \"x-content-type-options\": \"nosniff\",\n  });\n  if (error.status === 405) {\n    headers.set(\"allow\", \"POST\");\n  }\n\n  return new Response(getPublicErrorMessage(error.status), {\n    status: error.status,\n    headers,\n  });\n}\n\nexport function sanitizeServerActionError(_error: unknown): SanitizedServerActionError {\n  return {\n    name: \"ServerActionError\",\n    message: \"Server function failed\",\n  };\n}\n\nexport function runWithServerActionRequest<T>(\n  request: Request,\n  callback: () => T | Promise<T>,\n): T | Promise<T> {\n  throwIfAborted(request.signal);\n  return getServerActionStorage().run(\n    {\n      request,\n      signal: request.signal,\n      invalidations: new Set(),\n    },\n    callback,\n  );\n}\n\nexport function getServerActionExecutionContext(): ServerActionExecutionContext | undefined {\n  return getServerActionStorage().getStore();\n}\n\nexport function getServerActionSignal(): AbortSignal {\n  return getServerActionExecutionContext()?.signal ?? getFallbackAbortController().signal;\n}\n\nexport function getServerActionInvalidations(): readonly string[] {\n  return Array.from(getServerActionExecutionContext()?.invalidations ?? []);\n}\n\nsubscribeFarmCacheInvalidation((key) => {\n  getServerActionExecutionContext()?.invalidations.add(key);\n});\n\nfunction getServerActionStorage(): AsyncLocalStorage<ServerActionExecutionContext> {\n  const globalState = globalThis as GlobalWithServerActionStorage;\n  if (!globalState[SERVER_ACTION_STORAGE_KEY]) {\n    globalState[SERVER_ACTION_STORAGE_KEY] = new AsyncLocalStorage<ServerActionExecutionContext>();\n  }\n  return globalState[SERVER_ACTION_STORAGE_KEY]!;\n}\n\nfunction getFallbackAbortController(): AbortController {\n  const globalState = globalThis as GlobalWithServerActionStorage;\n  if (!globalState[FALLBACK_ABORT_CONTROLLER_KEY]) {\n    globalState[FALLBACK_ABORT_CONTROLLER_KEY] = new AbortController();\n  }\n  return globalState[FALLBACK_ABORT_CONTROLLER_KEY]!;\n}\n\nfunction parseBodySizeLimit(value: number | string): number {\n  if (typeof value === \"number\") {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new TypeError(\"serverActions.bodySizeLimit must be a positive safe integer\");\n    }\n    return value;\n  }\n\n  const match = value\n    .trim()\n    .toLowerCase()\n    .match(/^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb|kib|mib|gib)?$/);\n  if (!match) {\n    throw new TypeError(\n      'serverActions.bodySizeLimit must be bytes or a size string such as \"500kb\" or \"1mb\"',\n    );\n  }\n\n  const amount = Number(match[1]);\n  const unit = match[2] ?? \"b\";\n  const multiplier: Record<string, number> = {\n    b: 1,\n    kb: 1_000,\n    mb: 1_000_000,\n    gb: 1_000_000_000,\n    kib: 1_024,\n    mib: 1_048_576,\n    gib: 1_073_741_824,\n  };\n  const bytes = Math.floor(amount * multiplier[unit]);\n\n  if (!Number.isSafeInteger(bytes) || bytes <= 0) {\n    throw new TypeError(\"serverActions.bodySizeLimit must resolve to a positive safe integer\");\n  }\n\n  return bytes;\n}\n\nfunction normalizeAllowedOriginPattern(value: string): string {\n  const pattern = value.trim().toLowerCase();\n  if (!pattern) {\n    throw new TypeError(\"serverActions.allowedOrigins cannot contain empty values\");\n  }\n\n  if (pattern.includes(\"*\")) {\n    if (!/^(?:https?:\\/\\/)?\\*\\.[a-z0-9.-]+(?::\\d+)?$/.test(pattern)) {\n      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);\n    }\n    return pattern;\n  }\n\n  if (pattern.includes(\"://\")) {\n    let parsed: URL;\n    try {\n      parsed = new URL(pattern);\n    } catch {\n      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);\n    }\n\n    if (\n      (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n      parsed.username ||\n      parsed.password ||\n      parsed.pathname !== \"/\" ||\n      parsed.search ||\n      parsed.hash\n    ) {\n      throw new TypeError(\n        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`,\n      );\n    }\n    return parsed.origin;\n  }\n\n  if (/[/@?#]/.test(pattern)) {\n    throw new TypeError(\n      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`,\n    );\n  }\n\n  try {\n    return new URL(`http://${pattern}`).host;\n  } catch {\n    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);\n  }\n}\n\nfunction getRequestSourceOrigin(request: Request): string | null {\n  const origin = request.headers.get(\"origin\")?.trim();\n  if (origin) {\n    return parseSourceOrigin(origin);\n  }\n\n  const referer = request.headers.get(\"referer\")?.trim();\n  if (referer) {\n    return parseSourceOrigin(referer);\n  }\n\n  return null;\n}\n\nfunction parseSourceOrigin(value: string): string {\n  if (value === \"null\") {\n    throw new ServerActionRequestError(\"INVALID_ORIGIN\", 403, \"Opaque origins are not allowed\");\n  }\n\n  try {\n    const parsed = new URL(value);\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n      throw new Error(\"Unsupported protocol\");\n    }\n    return parsed.origin;\n  } catch {\n    throw new ServerActionRequestError(\"INVALID_ORIGIN\", 403, \"Invalid request origin\");\n  }\n}\n\nfunction matchesHostHeader(sourceOrigin: string, request: Request): boolean {\n  const host = request.headers.get(\"host\")?.trim().toLowerCase();\n  if (!host) return false;\n\n  try {\n    const source = new URL(sourceOrigin);\n    const target = new URL(request.url);\n    return source.protocol === target.protocol && source.host.toLowerCase() === host;\n  } catch {\n    return false;\n  }\n}\n\nfunction matchesAllowedOrigin(sourceOrigin: string, pattern: string): boolean {\n  const source = new URL(sourceOrigin);\n  if (!pattern.includes(\"*\")) {\n    return pattern.includes(\"://\") ? source.origin === pattern : source.host === pattern;\n  }\n\n  const schemeEnd = pattern.indexOf(\"://\");\n  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);\n  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);\n  const [wildcardHost, port] = splitHostAndPort(hostPattern);\n  const baseHost = wildcardHost.slice(2);\n\n  if (scheme && source.protocol !== scheme) return false;\n  if (port && getEffectivePort(source) !== port) return false;\n  if (!port && source.port) return false;\n\n  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;\n}\n\nfunction splitHostAndPort(value: string): [string, string | null] {\n  const separator = value.lastIndexOf(\":\");\n  if (separator === -1) return [value, null];\n  return [value.slice(0, separator), value.slice(separator + 1)];\n}\n\nfunction getEffectivePort(url: URL): string {\n  if (url.port) return url.port;\n  if (url.protocol === \"https:\") return \"443\";\n  if (url.protocol === \"http:\") return \"80\";\n  return \"\";\n}\n\nfunction validateActionId(actionId?: string | null): asserts actionId is string {\n  if (!actionId || actionId.length > 4096 || hasControlCharacters(actionId)) {\n    throw new ServerActionRequestError(\"INVALID_ACTION_ID\", 400, \"Invalid server action id\");\n  }\n}\n\nfunction hasControlCharacters(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code <= 31 || code === 127) return true;\n  }\n  return false;\n}\n\nfunction getSupportedContentType(request: Request, kind: ServerActionRequestKind): string {\n  const header = request.headers.get(\"content-type\")?.trim().toLowerCase();\n  const contentType = header?.split(\";\", 1)[0]?.trim() ?? \"\";\n  const supported = kind === \"form\" ? FORM_ACTION_CONTENT_TYPES : JAVASCRIPT_ACTION_CONTENT_TYPES;\n\n  if (!supported.has(contentType)) {\n    throw new ServerActionRequestError(\n      \"UNSUPPORTED_CONTENT_TYPE\",\n      415,\n      \"Unsupported server action content type\",\n    );\n  }\n\n  return contentType;\n}\n\nasync function readBodyWithLimit(request: Request, limit: number): Promise<Uint8Array> {\n  const contentLength = request.headers.get(\"content-length\")?.trim();\n  if (contentLength) {\n    if (!/^\\d+$/.test(contentLength)) {\n      throw new ServerActionRequestError(\n        \"INVALID_CONTENT_LENGTH\",\n        400,\n        \"Invalid content-length header\",\n      );\n    }\n    if (Number(contentLength) > limit) {\n      throw new ServerActionRequestError(\"BODY_TOO_LARGE\", 413, \"Server action body is too large\");\n    }\n  }\n\n  throwIfAborted(request.signal);\n  if (!request.body) return new Uint8Array();\n\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  const cancelBodyRead = () => {\n    void reader.cancel(request.signal.reason).catch(() => {});\n  };\n\n  request.signal.addEventListener(\"abort\", cancelBodyRead, { once: true });\n\n  try {\n    while (true) {\n      throwIfAborted(request.signal);\n      const { done, value } = await reader.read();\n      if (done) break;\n      if (!value) continue;\n\n      total += value.byteLength;\n      if (total > limit) {\n        await reader.cancel(\"Server action body is too large\");\n        throw new ServerActionRequestError(\n          \"BODY_TOO_LARGE\",\n          413,\n          \"Server action body is too large\",\n        );\n      }\n      chunks.push(value);\n    }\n  } catch (error) {\n    if (request.signal.aborted) throwIfAborted(request.signal);\n    throw error;\n  } finally {\n    request.signal.removeEventListener(\"abort\", cancelBodyRead);\n    reader.releaseLock();\n  }\n\n  throwIfAborted(request.signal);\n  const body = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body;\n}\n\nasync function parseFormData(request: Request, bytes: Uint8Array): Promise<FormData> {\n  const body = new ArrayBuffer(bytes.byteLength);\n  new Uint8Array(body).set(bytes);\n  const copy = new Request(request.url, {\n    method: \"POST\",\n    headers: request.headers,\n    body,\n  });\n\n  try {\n    return await copy.formData();\n  } catch {\n    throw new ServerActionRequestError(\"INVALID_BODY\", 400, \"Invalid server action form body\");\n  }\n}\n\nfunction getPublicErrorMessage(status: number): string {\n  switch (status) {\n    case 400:\n      return \"Bad Request\";\n    case 403:\n      return \"Forbidden\";\n    case 405:\n      return \"Method Not Allowed\";\n    case 413:\n      return \"Payload Too Large\";\n    case 415:\n      return \"Unsupported Media Type\";\n    default:\n      return \"Server Action Request Failed\";\n  }\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (!signal.aborted) return;\n  if (signal.reason !== undefined) throw signal.reason;\n  throw new DOMException(\"The operation was aborted\", \"AbortError\");\n}\n","export type FarmCacheInvalidationListener = (key: string) => void;\n\ntype FarmCacheInvalidationState = {\n  listeners: Set<FarmCacheInvalidationListener>;\n};\n\nconst FARM_CACHE_INVALIDATION_STATE = Symbol.for(\"farm.cacheInvalidationState\");\nconst globalState = globalThis as typeof globalThis & {\n  [FARM_CACHE_INVALIDATION_STATE]?: FarmCacheInvalidationState;\n};\n\nfunction getFarmCacheInvalidationState(): FarmCacheInvalidationState {\n  return (globalState[FARM_CACHE_INVALIDATION_STATE] ??= {\n    listeners: new Set(),\n  });\n}\n\nexport function notifyFarmCacheInvalidation(key: string): void {\n  if (typeof key !== \"string\" || key.length === 0) return;\n\n  for (const listener of getFarmCacheInvalidationState().listeners) {\n    listener(key);\n  }\n}\n\nexport function applyFarmCacheInvalidations(keys: unknown): void {\n  if (!Array.isArray(keys)) return;\n\n  for (const key of keys) {\n    if (typeof key === \"string\") {\n      notifyFarmCacheInvalidation(key);\n    }\n  }\n}\n\nexport function subscribeFarmCacheInvalidation(\n  listener: FarmCacheInvalidationListener,\n): () => void {\n  const state = getFarmCacheInvalidationState();\n  state.listeners.add(listener);\n  return () => state.listeners.delete(listener);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,8BAAkC;;;ACMlC,IAAM,gCAAgC,uBAAO,IAAI,6BAA6B;AAC9E,IAAM,cAAc;AAIpB,SAAS,gCAA4D;AACnE,SAAQ,4FAA+C;AAAA,IACrD,WAAW,oBAAI,IAAI;AAAA,EACrB;AACF;AAJS;AAwBF,SAAS,+BACd,UACY;AACZ,QAAM,QAAQ,8BAA8B;AAC5C,QAAM,UAAU,IAAI,QAAQ;AAC5B,SAAO,MAAM,MAAM,UAAU,OAAO,QAAQ;AAC9C;AANgB;;;ADhCT,IAAM,wCAAwC;AAoC9C,IAAM,4BAAN,MAAM,kCAAiC,MAAM;AAAA,EAIlD,YAAY,MAAoC,QAAgB,SAAiB;AAC/E,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAVoD;AAA7C,IAAM,2BAAN;AAkBP,IAAM,4BAA4B,uBAAO,IAAI,0BAA0B;AACvE,IAAM,gCAAgC,uBAAO,IAAI,0CAA0C;AAC3F,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AACF,CAAC;AACD,IAAM,kCAAkC,oBAAI,IAAI;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,SAAS,2BACd,QACiC;AACjC,QAAM,kBAAkB,QAAQ,kBAAkB,CAAC,GAAG,IAAI,6BAA6B;AACvF,QAAM,gBAAgB;AAAA,IACpB,QAAQ,iBAAiB;AAAA,EAC3B;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,gBAAgB,OAAO,OAAO,cAAc;AAAA,IAC5C;AAAA,EACF,CAAC;AACH;AAZgB;AAcT,SAAS,4BACd,SACA,QACM;AACN,MAAI,QAAQ,OAAO,YAAY,MAAM,QAAQ;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AACtC,QAAM,eAAe,uBAAuB,OAAO;AACnD,QAAM,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK,EAAE,YAAY;AAE5E,MAAI,CAAC,cAAc;AACjB,QAAI,cAAc,eAAe;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAEA,QAAM,iBACJ,iBAAiB,WAAW,UAAU,kBAAkB,cAAc,OAAO;AAC/E,QAAM,0BAA0B,OAAO,eAAe;AAAA,IAAK,CAAC,YAC1D,qBAAqB,cAAc,OAAO;AAAA,EAC5C;AAEA,MAAI,CAAC,kBAAkB,CAAC,yBAAyB;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,cAAc,gBAAgB,CAAC,yBAAyB;AAC1D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;AAkDhB,eAAsB,2BACpB,SACA,QACA,MACA,UACsC;AACtC,8BAA4B,SAAS,MAAM;AAE3C,MAAI,SAAS,cAAc;AACzB,qBAAiB,QAAQ;AAAA,EAC3B;AAEA,QAAM,cAAc,wBAAwB,SAAS,IAAI;AACzD,QAAM,QAAQ,MAAM,kBAAkB,SAAS,OAAO,aAAa;AAEnE,MAAI,SAAS,UAAU,gBAAgB,uBAAuB;AAC5D,WAAO;AAAA,MACL,MAAM,MAAM,cAAc,SAAS,KAAK;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IACpC;AAAA,EACF;AACF;AA1BsB;AA4Bf,SAAS,uCAAuC,OAAiC;AACtF,MAAI,EAAE,iBAAiB,2BAA2B;AAChD,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,iBAAiB;AAAA,IACjB,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,CAAC;AACD,MAAI,MAAM,WAAW,KAAK;AACxB,YAAQ,IAAI,SAAS,MAAM;AAAA,EAC7B;AAEA,SAAO,IAAI,SAAS,sBAAsB,MAAM,MAAM,GAAG;AAAA,IACvD,QAAQ,MAAM;AAAA,IACd;AAAA,EACF,CAAC;AACH;AAlBgB;AAoBT,SAAS,0BAA0B,QAA6C;AACrF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AALgB;AAOT,SAAS,2BACd,SACA,UACgB;AAChB,iBAAe,QAAQ,MAAM;AAC7B,SAAO,uBAAuB,EAAE;AAAA,IAC9B;AAAA,MACE;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,eAAe,oBAAI,IAAI;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AACF;AAbgB;AAeT,SAAS,kCAA4E;AAC1F,SAAO,uBAAuB,EAAE,SAAS;AAC3C;AAFgB;AAIT,SAAS,wBAAqC;AACnD,SAAO,gCAAgC,GAAG,UAAU,2BAA2B,EAAE;AACnF;AAFgB;AAIT,SAAS,+BAAkD;AAChE,SAAO,MAAM,KAAK,gCAAgC,GAAG,iBAAiB,CAAC,CAAC;AAC1E;AAFgB;AAIhB,+BAA+B,CAAC,QAAQ;AACtC,kCAAgC,GAAG,cAAc,IAAI,GAAG;AAC1D,CAAC;AAED,SAAS,yBAA0E;AACjF,QAAMA,eAAc;AACpB,MAAI,CAACA,aAAY,yBAAyB,GAAG;AAC3C,IAAAA,aAAY,yBAAyB,IAAI,IAAI,0CAAgD;AAAA,EAC/F;AACA,SAAOA,aAAY,yBAAyB;AAC9C;AANS;AAQT,SAAS,6BAA8C;AACrD,QAAMA,eAAc;AACpB,MAAI,CAACA,aAAY,6BAA6B,GAAG;AAC/C,IAAAA,aAAY,6BAA6B,IAAI,IAAI,gBAAgB;AAAA,EACnE;AACA,SAAOA,aAAY,6BAA6B;AAClD;AANS;AAQT,SAAS,mBAAmB,OAAgC;AAC1D,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,YAAM,IAAI,UAAU,6DAA6D;AAAA,IACnF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MACX,KAAK,EACL,YAAY,EACZ,MAAM,+CAA+C;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,OAAO,MAAM,CAAC,KAAK;AACzB,QAAM,aAAqC;AAAA,IACzC,GAAG;AAAA,IACH,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACA,QAAM,QAAQ,KAAK,MAAM,SAAS,WAAW,IAAI,CAAC;AAElD,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,UAAM,IAAI,UAAU,qEAAqE;AAAA,EAC3F;AAEA,SAAO;AACT;AApCS;AAsCT,SAAS,8BAA8B,OAAuB;AAC5D,QAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,UAAU,0DAA0D;AAAA,EAChF;AAEA,MAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,QAAI,CAAC,6CAA6C,KAAK,OAAO,GAAG;AAC/D,YAAM,IAAI,UAAU,iDAAiD,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC9F;AACA,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,SAAS,KAAK,GAAG;AAC3B,QAAI;AACJ,QAAI;AACF,eAAS,IAAI,IAAI,OAAO;AAAA,IAC1B,QAAQ;AACN,YAAM,IAAI,UAAU,+CAA+C,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC5F;AAEA,QACG,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,OAAO,YACP,OAAO,YACP,OAAO,aAAa,OACpB,OAAO,UACP,OAAO,MACP;AACA,YAAM,IAAI;AAAA,QACR,oEAAoE,KAAK,UAAU,KAAK,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,SAAS,KAAK,OAAO,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,+DAA+D,KAAK,UAAU,KAAK,CAAC;AAAA,IACtF;AAAA,EACF;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,OAAO,EAAE,EAAE;AAAA,EACtC,QAAQ;AACN,UAAM,IAAI,UAAU,+CAA+C,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EAC5F;AACF;AA/CS;AAiDT,SAAS,uBAAuB,SAAiC;AAC/D,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ,GAAG,KAAK;AACnD,MAAI,QAAQ;AACV,WAAO,kBAAkB,MAAM;AAAA,EACjC;AAEA,QAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS,GAAG,KAAK;AACrD,MAAI,SAAS;AACX,WAAO,kBAAkB,OAAO;AAAA,EAClC;AAEA,SAAO;AACT;AAZS;AAcT,SAAS,kBAAkB,OAAuB;AAChD,MAAI,UAAU,QAAQ;AACpB,UAAM,IAAI,yBAAyB,kBAAkB,KAAK,gCAAgC;AAAA,EAC5F;AAEA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AACA,WAAO,OAAO;AAAA,EAChB,QAAQ;AACN,UAAM,IAAI,yBAAyB,kBAAkB,KAAK,wBAAwB;AAAA,EACpF;AACF;AAdS;AAgBT,SAAS,kBAAkB,cAAsB,SAA2B;AAC1E,QAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM,GAAG,KAAK,EAAE,YAAY;AAC7D,MAAI,CAAC,KAAM,QAAO;AAElB,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,YAAY;AACnC,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;AAClC,WAAO,OAAO,aAAa,OAAO,YAAY,OAAO,KAAK,YAAY,MAAM;AAAA,EAC9E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAXS;AAaT,SAAS,qBAAqB,cAAsB,SAA0B;AAC5E,QAAM,SAAS,IAAI,IAAI,YAAY;AACnC,MAAI,CAAC,QAAQ,SAAS,GAAG,GAAG;AAC1B,WAAO,QAAQ,SAAS,KAAK,IAAI,OAAO,WAAW,UAAU,OAAO,SAAS;AAAA,EAC/E;AAEA,QAAM,YAAY,QAAQ,QAAQ,KAAK;AACvC,QAAM,SAAS,cAAc,KAAK,OAAO,QAAQ,MAAM,GAAG,YAAY,CAAC;AACvE,QAAM,cAAc,QAAQ,MAAM,cAAc,KAAK,IAAI,YAAY,CAAC;AACtE,QAAM,CAAC,cAAc,IAAI,IAAI,iBAAiB,WAAW;AACzD,QAAM,WAAW,aAAa,MAAM,CAAC;AAErC,MAAI,UAAU,OAAO,aAAa,OAAQ,QAAO;AACjD,MAAI,QAAQ,iBAAiB,MAAM,MAAM,KAAM,QAAO;AACtD,MAAI,CAAC,QAAQ,OAAO,KAAM,QAAO;AAEjC,SAAO,OAAO,SAAS,SAAS,IAAI,QAAQ,EAAE,KAAK,OAAO,aAAa;AACzE;AAjBS;AAmBT,SAAS,iBAAiB,OAAwC;AAChE,QAAM,YAAY,MAAM,YAAY,GAAG;AACvC,MAAI,cAAc,GAAI,QAAO,CAAC,OAAO,IAAI;AACzC,SAAO,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,MAAM,MAAM,YAAY,CAAC,CAAC;AAC/D;AAJS;AAMT,SAAS,iBAAiB,KAAkB;AAC1C,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AALS;AAOT,SAAS,iBAAiB,UAAsD;AAC9E,MAAI,CAAC,YAAY,SAAS,SAAS,QAAQ,qBAAqB,QAAQ,GAAG;AACzE,UAAM,IAAI,yBAAyB,qBAAqB,KAAK,0BAA0B;AAAA,EACzF;AACF;AAJS;AAMT,SAAS,qBAAqB,OAAwB;AACpD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,MAAM,SAAS,IAAK,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AANS;AAQT,SAAS,wBAAwB,SAAkB,MAAuC;AACxF,QAAM,SAAS,QAAQ,QAAQ,IAAI,cAAc,GAAG,KAAK,EAAE,YAAY;AACvE,QAAM,cAAc,QAAQ,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,KAAK;AACxD,QAAM,YAAY,SAAS,SAAS,4BAA4B;AAEhE,MAAI,CAAC,UAAU,IAAI,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAdS;AAgBT,eAAe,kBAAkB,SAAkB,OAAoC;AACrF,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK;AAClE,MAAI,eAAe;AACjB,QAAI,CAAC,QAAQ,KAAK,aAAa,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAa,IAAI,OAAO;AACjC,YAAM,IAAI,yBAAyB,kBAAkB,KAAK,iCAAiC;AAAA,IAC7F;AAAA,EACF;AAEA,iBAAe,QAAQ,MAAM;AAC7B,MAAI,CAAC,QAAQ,KAAM,QAAO,IAAI,WAAW;AAEzC,QAAM,SAAS,QAAQ,KAAK,UAAU;AACtC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,QAAM,iBAAiB,6BAAM;AAC3B,SAAK,OAAO,OAAO,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC1D,GAFuB;AAIvB,UAAQ,OAAO,iBAAiB,SAAS,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAEvE,MAAI;AACF,WAAO,MAAM;AACX,qBAAe,QAAQ,MAAM;AAC7B,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,UAAI,CAAC,MAAO;AAEZ,eAAS,MAAM;AACf,UAAI,QAAQ,OAAO;AACjB,cAAM,OAAO,OAAO,iCAAiC;AACrD,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAS,gBAAe,QAAQ,MAAM;AACzD,UAAM;AAAA,EACR,UAAE;AACA,YAAQ,OAAO,oBAAoB,SAAS,cAAc;AAC1D,WAAO,YAAY;AAAA,EACrB;AAEA,iBAAe,QAAQ,MAAM;AAC7B,QAAM,OAAO,IAAI,WAAW,KAAK;AACjC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AA7De;AA+Df,eAAe,cAAc,SAAkB,OAAsC;AACnF,QAAM,OAAO,IAAI,YAAY,MAAM,UAAU;AAC7C,MAAI,WAAW,IAAI,EAAE,IAAI,KAAK;AAC9B,QAAM,OAAO,IAAI,QAAQ,QAAQ,KAAK;AAAA,IACpC,QAAQ;AAAA,IACR,SAAS,QAAQ;AAAA,IACjB;AAAA,EACF,CAAC;AAED,MAAI;AACF,WAAO,MAAM,KAAK,SAAS;AAAA,EAC7B,QAAQ;AACN,UAAM,IAAI,yBAAyB,gBAAgB,KAAK,iCAAiC;AAAA,EAC3F;AACF;AAde;AAgBf,SAAS,sBAAsB,QAAwB;AACrD,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAfS;AAiBT,SAAS,eAAe,QAA2B;AACjD,MAAI,CAAC,OAAO,QAAS;AACrB,MAAI,OAAO,WAAW,OAAW,OAAM,OAAO;AAC9C,QAAM,IAAI,aAAa,6BAA6B,YAAY;AAClE;AAJS;","names":["globalState"]}
+{"version":3,"sources":["../src/server-action-security.ts","../src/cache-invalidation.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { subscribeFarmCacheInvalidation } from \"./cache-invalidation\";\n\nexport const DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1_000_000;\n\nexport interface FarmServerActionsConfig {\n  /** Additional trusted origins or host patterns, such as https://app.example.com. */\n  allowedOrigins?: readonly string[];\n  /** Maximum encoded request body size in bytes or as a size string such as \"1mb\". */\n  bodySizeLimit?: number | string;\n}\n\nexport interface ResolvedFarmServerActionsConfig {\n  allowedOrigins: readonly string[];\n  bodySizeLimit: number;\n}\n\nexport type ServerActionRequestKind = \"javascript\" | \"form\";\n\nexport interface PreparedServerActionRequest {\n  body: string | FormData;\n  contentType: string;\n}\n\nexport type SanitizedServerActionError = {\n  name: \"ServerActionError\";\n  message: \"Server function failed\";\n};\n\ntype ServerActionRequestErrorCode =\n  | \"BODY_TOO_LARGE\"\n  | \"INVALID_ACTION_ID\"\n  | \"INVALID_BODY\"\n  | \"INVALID_CONTENT_LENGTH\"\n  | \"INVALID_METHOD\"\n  | \"INVALID_ORIGIN\"\n  | \"MISSING_ORIGIN\"\n  | \"UNSUPPORTED_CONTENT_TYPE\";\n\nexport class ServerActionRequestError extends Error {\n  readonly code: ServerActionRequestErrorCode;\n  readonly status: number;\n\n  constructor(code: ServerActionRequestErrorCode, status: number, message: string) {\n    super(message);\n    this.name = \"ServerActionRequestError\";\n    this.code = code;\n    this.status = status;\n  }\n}\n\ntype ServerActionExecutionContext = {\n  request: Request;\n  signal: AbortSignal;\n  invalidations: Set<string>;\n};\n\nconst SERVER_ACTION_STORAGE_KEY = Symbol.for(\"farm.serverActionStorage\");\nconst FALLBACK_ABORT_CONTROLLER_KEY = Symbol.for(\"farm.serverActionFallbackAbortController\");\nconst FORM_ACTION_CONTENT_TYPES = new Set([\n  \"application/x-www-form-urlencoded\",\n  \"multipart/form-data\",\n]);\nconst JAVASCRIPT_ACTION_CONTENT_TYPES = new Set([\n  \"application/octet-stream\",\n  \"application/x-www-form-urlencoded\",\n  \"multipart/form-data\",\n  \"text/plain\",\n]);\n\ntype GlobalWithServerActionStorage = typeof globalThis & {\n  [SERVER_ACTION_STORAGE_KEY]?: AsyncLocalStorage<ServerActionExecutionContext>;\n  [FALLBACK_ABORT_CONTROLLER_KEY]?: AbortController;\n};\n\nexport function resolveServerActionsConfig(\n  config: FarmServerActionsConfig | undefined,\n): ResolvedFarmServerActionsConfig {\n  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);\n  const bodySizeLimit = parseBodySizeLimit(\n    config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,\n  );\n\n  return Object.freeze({\n    allowedOrigins: Object.freeze(allowedOrigins),\n    bodySizeLimit,\n  });\n}\n\nexport function validateServerActionRequest(\n  request: Request,\n  config: ResolvedFarmServerActionsConfig,\n): void {\n  if (request.method.toUpperCase() !== \"POST\") {\n    throw new ServerActionRequestError(\n      \"INVALID_METHOD\",\n      405,\n      \"Server actions only accept POST requests\",\n    );\n  }\n\n  const requestUrl = new URL(request.url);\n  const sourceOrigin = getRequestSourceOrigin(request);\n  const fetchSite = request.headers.get(\"sec-fetch-site\")?.trim().toLowerCase();\n\n  if (!sourceOrigin) {\n    if (fetchSite !== \"same-origin\") {\n      throw new ServerActionRequestError(\n        \"MISSING_ORIGIN\",\n        403,\n        \"Server action request is missing same-origin metadata\",\n      );\n    }\n    return;\n  }\n\n  const matchesRequest =\n    sourceOrigin === requestUrl.origin || matchesHostHeader(sourceOrigin, request);\n  const matchesConfiguredOrigin = config.allowedOrigins.some((pattern) =>\n    matchesAllowedOrigin(sourceOrigin, pattern),\n  );\n\n  if (!matchesRequest && !matchesConfiguredOrigin) {\n    throw new ServerActionRequestError(\n      \"INVALID_ORIGIN\",\n      403,\n      \"Server action origin does not match the request origin\",\n    );\n  }\n\n  if (fetchSite === \"cross-site\" && !matchesConfiguredOrigin) {\n    throw new ServerActionRequestError(\n      \"INVALID_ORIGIN\",\n      403,\n      \"Cross-site server action request was rejected\",\n    );\n  }\n}\n\nexport async function prepareServerActionRequest(\n  request: Request,\n  config: ResolvedFarmServerActionsConfig,\n  kind: ServerActionRequestKind,\n  actionId?: string | null,\n): Promise<PreparedServerActionRequest> {\n  validateServerActionRequest(request, config);\n\n  if (kind === \"javascript\") {\n    validateActionId(actionId);\n  }\n\n  const contentType = getSupportedContentType(request, kind);\n  const bytes = await readBodyWithLimit(request, config.bodySizeLimit);\n\n  if (kind === \"form\" || contentType === \"multipart/form-data\") {\n    return {\n      body: await parseFormData(request, bytes),\n      contentType,\n    };\n  }\n\n  return {\n    body: new TextDecoder().decode(bytes),\n    contentType,\n  };\n}\n\nexport function createServerActionRequestErrorResponse(error: unknown): Response | null {\n  if (!(error instanceof ServerActionRequestError)) {\n    return null;\n  }\n\n  const headers = new Headers({\n    \"cache-control\": \"no-store\",\n    \"content-type\": \"text/plain; charset=utf-8\",\n    \"x-content-type-options\": \"nosniff\",\n  });\n  if (error.status === 405) {\n    headers.set(\"allow\", \"POST\");\n  }\n\n  return new Response(getPublicErrorMessage(error.status), {\n    status: error.status,\n    headers,\n  });\n}\n\nexport function sanitizeServerActionError(_error: unknown): SanitizedServerActionError {\n  return {\n    name: \"ServerActionError\",\n    message: \"Server function failed\",\n  };\n}\n\nexport function runWithServerActionRequest<T>(\n  request: Request,\n  callback: () => T | Promise<T>,\n): T | Promise<T> {\n  throwIfAborted(request.signal);\n  return getServerActionStorage().run(\n    {\n      request,\n      signal: request.signal,\n      invalidations: new Set(),\n    },\n    callback,\n  );\n}\n\nexport function getServerActionExecutionContext(): ServerActionExecutionContext | undefined {\n  return getServerActionStorage().getStore();\n}\n\nexport function getServerActionSignal(): AbortSignal {\n  return getServerActionExecutionContext()?.signal ?? getFallbackAbortController().signal;\n}\n\nexport function getServerActionInvalidations(): readonly string[] {\n  return Array.from(getServerActionExecutionContext()?.invalidations ?? []);\n}\n\nsubscribeFarmCacheInvalidation((key) => {\n  getServerActionExecutionContext()?.invalidations.add(key);\n});\n\nfunction getServerActionStorage(): AsyncLocalStorage<ServerActionExecutionContext> {\n  const globalState = globalThis as GlobalWithServerActionStorage;\n  if (!globalState[SERVER_ACTION_STORAGE_KEY]) {\n    globalState[SERVER_ACTION_STORAGE_KEY] = new AsyncLocalStorage<ServerActionExecutionContext>();\n  }\n  return globalState[SERVER_ACTION_STORAGE_KEY]!;\n}\n\nfunction getFallbackAbortController(): AbortController {\n  const globalState = globalThis as GlobalWithServerActionStorage;\n  if (!globalState[FALLBACK_ABORT_CONTROLLER_KEY]) {\n    globalState[FALLBACK_ABORT_CONTROLLER_KEY] = new AbortController();\n  }\n  return globalState[FALLBACK_ABORT_CONTROLLER_KEY]!;\n}\n\nfunction parseBodySizeLimit(value: number | string): number {\n  if (typeof value === \"number\") {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new TypeError(\"serverActions.bodySizeLimit must be a positive safe integer\");\n    }\n    return value;\n  }\n\n  const match = value\n    .trim()\n    .toLowerCase()\n    .match(/^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb|kib|mib|gib)?$/);\n  if (!match) {\n    throw new TypeError(\n      'serverActions.bodySizeLimit must be bytes or a size string such as \"500kb\" or \"1mb\"',\n    );\n  }\n\n  const amount = Number(match[1]);\n  const unit = match[2] ?? \"b\";\n  const multiplier: Record<string, number> = {\n    b: 1,\n    kb: 1_000,\n    mb: 1_000_000,\n    gb: 1_000_000_000,\n    kib: 1_024,\n    mib: 1_048_576,\n    gib: 1_073_741_824,\n  };\n  const bytes = Math.floor(amount * multiplier[unit]);\n\n  if (!Number.isSafeInteger(bytes) || bytes <= 0) {\n    throw new TypeError(\"serverActions.bodySizeLimit must resolve to a positive safe integer\");\n  }\n\n  return bytes;\n}\n\nfunction normalizeAllowedOriginPattern(value: string): string {\n  const pattern = value.trim().toLowerCase();\n  if (!pattern) {\n    throw new TypeError(\"serverActions.allowedOrigins cannot contain empty values\");\n  }\n\n  if (pattern.includes(\"*\")) {\n    if (!/^(?:https?:\\/\\/)?\\*\\.[a-z0-9.-]+(?::\\d+)?$/.test(pattern)) {\n      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);\n    }\n    return pattern;\n  }\n\n  if (pattern.includes(\"://\")) {\n    let parsed: URL;\n    try {\n      parsed = new URL(pattern);\n    } catch {\n      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);\n    }\n\n    if (\n      (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n      parsed.username ||\n      parsed.password ||\n      parsed.pathname !== \"/\" ||\n      parsed.search ||\n      parsed.hash\n    ) {\n      throw new TypeError(\n        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`,\n      );\n    }\n    return parsed.origin;\n  }\n\n  if (/[/@?#]/.test(pattern)) {\n    throw new TypeError(\n      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`,\n    );\n  }\n\n  try {\n    return new URL(`http://${pattern}`).host;\n  } catch {\n    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);\n  }\n}\n\nfunction getRequestSourceOrigin(request: Request): string | null {\n  const origin = request.headers.get(\"origin\")?.trim();\n  if (origin) {\n    return parseSourceOrigin(origin);\n  }\n\n  const referer = request.headers.get(\"referer\")?.trim();\n  if (referer) {\n    return parseSourceOrigin(referer);\n  }\n\n  return null;\n}\n\nfunction parseSourceOrigin(value: string): string {\n  if (value === \"null\") {\n    throw new ServerActionRequestError(\"INVALID_ORIGIN\", 403, \"Opaque origins are not allowed\");\n  }\n\n  try {\n    const parsed = new URL(value);\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n      throw new Error(\"Unsupported protocol\");\n    }\n    return parsed.origin;\n  } catch {\n    throw new ServerActionRequestError(\"INVALID_ORIGIN\", 403, \"Invalid request origin\");\n  }\n}\n\nfunction matchesHostHeader(sourceOrigin: string, request: Request): boolean {\n  const host = request.headers.get(\"host\")?.trim().toLowerCase();\n  if (!host) return false;\n\n  try {\n    const source = new URL(sourceOrigin);\n    const target = new URL(request.url);\n    return source.protocol === target.protocol && source.host.toLowerCase() === host;\n  } catch {\n    return false;\n  }\n}\n\nfunction matchesAllowedOrigin(sourceOrigin: string, pattern: string): boolean {\n  const source = new URL(sourceOrigin);\n  if (!pattern.includes(\"*\")) {\n    return pattern.includes(\"://\") ? source.origin === pattern : source.host === pattern;\n  }\n\n  const schemeEnd = pattern.indexOf(\"://\");\n  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);\n  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);\n  const [wildcardHost, port] = splitHostAndPort(hostPattern);\n  const baseHost = wildcardHost.slice(2);\n\n  if (scheme && source.protocol !== scheme) return false;\n  if (port && getEffectivePort(source) !== port) return false;\n  if (!port && source.port) return false;\n\n  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;\n}\n\nfunction splitHostAndPort(value: string): [string, string | null] {\n  const separator = value.lastIndexOf(\":\");\n  if (separator === -1) return [value, null];\n  return [value.slice(0, separator), value.slice(separator + 1)];\n}\n\nfunction getEffectivePort(url: URL): string {\n  if (url.port) return url.port;\n  if (url.protocol === \"https:\") return \"443\";\n  if (url.protocol === \"http:\") return \"80\";\n  return \"\";\n}\n\nfunction validateActionId(actionId?: string | null): asserts actionId is string {\n  if (!actionId || actionId.length > 4096 || hasControlCharacters(actionId)) {\n    throw new ServerActionRequestError(\"INVALID_ACTION_ID\", 400, \"Invalid server action id\");\n  }\n}\n\nfunction hasControlCharacters(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code <= 31 || code === 127) return true;\n  }\n  return false;\n}\n\nfunction getSupportedContentType(request: Request, kind: ServerActionRequestKind): string {\n  const header = request.headers.get(\"content-type\")?.trim().toLowerCase();\n  const contentType = header?.split(\";\", 1)[0]?.trim() ?? \"\";\n  const supported = kind === \"form\" ? FORM_ACTION_CONTENT_TYPES : JAVASCRIPT_ACTION_CONTENT_TYPES;\n\n  if (!supported.has(contentType)) {\n    throw new ServerActionRequestError(\n      \"UNSUPPORTED_CONTENT_TYPE\",\n      415,\n      \"Unsupported server action content type\",\n    );\n  }\n\n  return contentType;\n}\n\nasync function readBodyWithLimit(request: Request, limit: number): Promise<Uint8Array> {\n  const contentLength = request.headers.get(\"content-length\")?.trim();\n  if (contentLength) {\n    if (!/^\\d+$/.test(contentLength)) {\n      throw new ServerActionRequestError(\n        \"INVALID_CONTENT_LENGTH\",\n        400,\n        \"Invalid content-length header\",\n      );\n    }\n    if (Number(contentLength) > limit) {\n      throw new ServerActionRequestError(\"BODY_TOO_LARGE\", 413, \"Server action body is too large\");\n    }\n  }\n\n  throwIfAborted(request.signal);\n  if (!request.body) return new Uint8Array();\n\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  const cancelBodyRead = () => {\n    void reader.cancel(request.signal.reason).catch(() => {});\n  };\n\n  request.signal.addEventListener(\"abort\", cancelBodyRead, { once: true });\n\n  try {\n    while (true) {\n      throwIfAborted(request.signal);\n      const { done, value } = await reader.read();\n      if (done) break;\n      if (!value) continue;\n\n      total += value.byteLength;\n      if (total > limit) {\n        await reader.cancel(\"Server action body is too large\");\n        throw new ServerActionRequestError(\n          \"BODY_TOO_LARGE\",\n          413,\n          \"Server action body is too large\",\n        );\n      }\n      chunks.push(value);\n    }\n  } catch (error) {\n    if (request.signal.aborted) throwIfAborted(request.signal);\n    throw error;\n  } finally {\n    request.signal.removeEventListener(\"abort\", cancelBodyRead);\n    reader.releaseLock();\n  }\n\n  throwIfAborted(request.signal);\n  const body = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body;\n}\n\nasync function parseFormData(request: Request, bytes: Uint8Array): Promise<FormData> {\n  const body = new ArrayBuffer(bytes.byteLength);\n  new Uint8Array(body).set(bytes);\n  const copy = new Request(request.url, {\n    method: \"POST\",\n    headers: request.headers,\n    body,\n  });\n\n  try {\n    return await copy.formData();\n  } catch {\n    throw new ServerActionRequestError(\"INVALID_BODY\", 400, \"Invalid server action form body\");\n  }\n}\n\nfunction getPublicErrorMessage(status: number): string {\n  switch (status) {\n    case 400:\n      return \"Bad Request\";\n    case 403:\n      return \"Forbidden\";\n    case 405:\n      return \"Method Not Allowed\";\n    case 413:\n      return \"Payload Too Large\";\n    case 415:\n      return \"Unsupported Media Type\";\n    default:\n      return \"Server Action Request Failed\";\n  }\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (!signal.aborted) return;\n  if (signal.reason !== undefined) throw signal.reason;\n  throw new DOMException(\"The operation was aborted\", \"AbortError\");\n}\n","export type FarmCacheInvalidationListener = (key: string) => void;\n\nexport const FARM_CACHE_INVALIDATION_HEADER = \"x-farm-cache-invalidations\";\n\ntype FarmCacheInvalidationState = {\n  listeners: Set<FarmCacheInvalidationListener>;\n};\n\nconst FARM_CACHE_INVALIDATION_STATE = Symbol.for(\"farm.cacheInvalidationState\");\nconst globalState = globalThis as typeof globalThis & {\n  [FARM_CACHE_INVALIDATION_STATE]?: FarmCacheInvalidationState;\n};\n\nfunction getFarmCacheInvalidationState(): FarmCacheInvalidationState {\n  return (globalState[FARM_CACHE_INVALIDATION_STATE] ??= {\n    listeners: new Set(),\n  });\n}\n\nexport function notifyFarmCacheInvalidation(key: string): void {\n  if (typeof key !== \"string\" || key.length === 0) return;\n\n  for (const listener of getFarmCacheInvalidationState().listeners) {\n    listener(key);\n  }\n}\n\nexport function applyFarmCacheInvalidations(keys: unknown): void {\n  if (!Array.isArray(keys)) return;\n\n  for (const key of keys) {\n    if (typeof key === \"string\") {\n      notifyFarmCacheInvalidation(key);\n    }\n  }\n}\n\nexport function encodeFarmCacheInvalidations(keys: readonly string[]): string | null {\n  const normalized = Array.from(\n    new Set(keys.filter((key) => typeof key === \"string\" && key.length > 0)),\n  );\n  if (normalized.length === 0) return null;\n  return encodeURIComponent(JSON.stringify(normalized));\n}\n\nexport function decodeFarmCacheInvalidations(value: string | null | undefined): readonly string[] {\n  if (!value) return [];\n\n  try {\n    const parsed = JSON.parse(decodeURIComponent(value));\n    return Array.isArray(parsed)\n      ? Array.from(\n          new Set(parsed.filter((key): key is string => typeof key === \"string\" && key.length > 0)),\n        )\n      : [];\n  } catch {\n    return [];\n  }\n}\n\nexport function subscribeFarmCacheInvalidation(\n  listener: FarmCacheInvalidationListener,\n): () => void {\n  const state = getFarmCacheInvalidationState();\n  state.listeners.add(listener);\n  return () => state.listeners.delete(listener);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,8BAAkC;;;ACQlC,IAAM,gCAAgC,uBAAO,IAAI,6BAA6B;AAC9E,IAAM,cAAc;AAIpB,SAAS,gCAA4D;AACnE,SAAQ,4FAA+C;AAAA,IACrD,WAAW,oBAAI,IAAI;AAAA,EACrB;AACF;AAJS;AA+CF,SAAS,+BACd,UACY;AACZ,QAAM,QAAQ,8BAA8B;AAC5C,QAAM,UAAU,IAAI,QAAQ;AAC5B,SAAO,MAAM,MAAM,UAAU,OAAO,QAAQ;AAC9C;AANgB;;;ADzDT,IAAM,wCAAwC;AAoC9C,IAAM,4BAAN,MAAM,kCAAiC,MAAM;AAAA,EAIlD,YAAY,MAAoC,QAAgB,SAAiB;AAC/E,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAVoD;AAA7C,IAAM,2BAAN;AAkBP,IAAM,4BAA4B,uBAAO,IAAI,0BAA0B;AACvE,IAAM,gCAAgC,uBAAO,IAAI,0CAA0C;AAC3F,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AACF,CAAC;AACD,IAAM,kCAAkC,oBAAI,IAAI;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,SAAS,2BACd,QACiC;AACjC,QAAM,kBAAkB,QAAQ,kBAAkB,CAAC,GAAG,IAAI,6BAA6B;AACvF,QAAM,gBAAgB;AAAA,IACpB,QAAQ,iBAAiB;AAAA,EAC3B;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,gBAAgB,OAAO,OAAO,cAAc;AAAA,IAC5C;AAAA,EACF,CAAC;AACH;AAZgB;AAcT,SAAS,4BACd,SACA,QACM;AACN,MAAI,QAAQ,OAAO,YAAY,MAAM,QAAQ;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AACtC,QAAM,eAAe,uBAAuB,OAAO;AACnD,QAAM,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK,EAAE,YAAY;AAE5E,MAAI,CAAC,cAAc;AACjB,QAAI,cAAc,eAAe;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAEA,QAAM,iBACJ,iBAAiB,WAAW,UAAU,kBAAkB,cAAc,OAAO;AAC/E,QAAM,0BAA0B,OAAO,eAAe;AAAA,IAAK,CAAC,YAC1D,qBAAqB,cAAc,OAAO;AAAA,EAC5C;AAEA,MAAI,CAAC,kBAAkB,CAAC,yBAAyB;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,cAAc,gBAAgB,CAAC,yBAAyB;AAC1D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;AAkDhB,eAAsB,2BACpB,SACA,QACA,MACA,UACsC;AACtC,8BAA4B,SAAS,MAAM;AAE3C,MAAI,SAAS,cAAc;AACzB,qBAAiB,QAAQ;AAAA,EAC3B;AAEA,QAAM,cAAc,wBAAwB,SAAS,IAAI;AACzD,QAAM,QAAQ,MAAM,kBAAkB,SAAS,OAAO,aAAa;AAEnE,MAAI,SAAS,UAAU,gBAAgB,uBAAuB;AAC5D,WAAO;AAAA,MACL,MAAM,MAAM,cAAc,SAAS,KAAK;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IACpC;AAAA,EACF;AACF;AA1BsB;AA4Bf,SAAS,uCAAuC,OAAiC;AACtF,MAAI,EAAE,iBAAiB,2BAA2B;AAChD,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,iBAAiB;AAAA,IACjB,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,CAAC;AACD,MAAI,MAAM,WAAW,KAAK;AACxB,YAAQ,IAAI,SAAS,MAAM;AAAA,EAC7B;AAEA,SAAO,IAAI,SAAS,sBAAsB,MAAM,MAAM,GAAG;AAAA,IACvD,QAAQ,MAAM;AAAA,IACd;AAAA,EACF,CAAC;AACH;AAlBgB;AAoBT,SAAS,0BAA0B,QAA6C;AACrF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AALgB;AAOT,SAAS,2BACd,SACA,UACgB;AAChB,iBAAe,QAAQ,MAAM;AAC7B,SAAO,uBAAuB,EAAE;AAAA,IAC9B;AAAA,MACE;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,eAAe,oBAAI,IAAI;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AACF;AAbgB;AAeT,SAAS,kCAA4E;AAC1F,SAAO,uBAAuB,EAAE,SAAS;AAC3C;AAFgB;AAIT,SAAS,wBAAqC;AACnD,SAAO,gCAAgC,GAAG,UAAU,2BAA2B,EAAE;AACnF;AAFgB;AAIT,SAAS,+BAAkD;AAChE,SAAO,MAAM,KAAK,gCAAgC,GAAG,iBAAiB,CAAC,CAAC;AAC1E;AAFgB;AAIhB,+BAA+B,CAAC,QAAQ;AACtC,kCAAgC,GAAG,cAAc,IAAI,GAAG;AAC1D,CAAC;AAED,SAAS,yBAA0E;AACjF,QAAMA,eAAc;AACpB,MAAI,CAACA,aAAY,yBAAyB,GAAG;AAC3C,IAAAA,aAAY,yBAAyB,IAAI,IAAI,0CAAgD;AAAA,EAC/F;AACA,SAAOA,aAAY,yBAAyB;AAC9C;AANS;AAQT,SAAS,6BAA8C;AACrD,QAAMA,eAAc;AACpB,MAAI,CAACA,aAAY,6BAA6B,GAAG;AAC/C,IAAAA,aAAY,6BAA6B,IAAI,IAAI,gBAAgB;AAAA,EACnE;AACA,SAAOA,aAAY,6BAA6B;AAClD;AANS;AAQT,SAAS,mBAAmB,OAAgC;AAC1D,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,YAAM,IAAI,UAAU,6DAA6D;AAAA,IACnF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MACX,KAAK,EACL,YAAY,EACZ,MAAM,+CAA+C;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,OAAO,MAAM,CAAC,KAAK;AACzB,QAAM,aAAqC;AAAA,IACzC,GAAG;AAAA,IACH,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACA,QAAM,QAAQ,KAAK,MAAM,SAAS,WAAW,IAAI,CAAC;AAElD,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,UAAM,IAAI,UAAU,qEAAqE;AAAA,EAC3F;AAEA,SAAO;AACT;AApCS;AAsCT,SAAS,8BAA8B,OAAuB;AAC5D,QAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,UAAU,0DAA0D;AAAA,EAChF;AAEA,MAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,QAAI,CAAC,6CAA6C,KAAK,OAAO,GAAG;AAC/D,YAAM,IAAI,UAAU,iDAAiD,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC9F;AACA,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,SAAS,KAAK,GAAG;AAC3B,QAAI;AACJ,QAAI;AACF,eAAS,IAAI,IAAI,OAAO;AAAA,IAC1B,QAAQ;AACN,YAAM,IAAI,UAAU,+CAA+C,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC5F;AAEA,QACG,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,OAAO,YACP,OAAO,YACP,OAAO,aAAa,OACpB,OAAO,UACP,OAAO,MACP;AACA,YAAM,IAAI;AAAA,QACR,oEAAoE,KAAK,UAAU,KAAK,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,SAAS,KAAK,OAAO,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,+DAA+D,KAAK,UAAU,KAAK,CAAC;AAAA,IACtF;AAAA,EACF;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,OAAO,EAAE,EAAE;AAAA,EACtC,QAAQ;AACN,UAAM,IAAI,UAAU,+CAA+C,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EAC5F;AACF;AA/CS;AAiDT,SAAS,uBAAuB,SAAiC;AAC/D,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ,GAAG,KAAK;AACnD,MAAI,QAAQ;AACV,WAAO,kBAAkB,MAAM;AAAA,EACjC;AAEA,QAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS,GAAG,KAAK;AACrD,MAAI,SAAS;AACX,WAAO,kBAAkB,OAAO;AAAA,EAClC;AAEA,SAAO;AACT;AAZS;AAcT,SAAS,kBAAkB,OAAuB;AAChD,MAAI,UAAU,QAAQ;AACpB,UAAM,IAAI,yBAAyB,kBAAkB,KAAK,gCAAgC;AAAA,EAC5F;AAEA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AACA,WAAO,OAAO;AAAA,EAChB,QAAQ;AACN,UAAM,IAAI,yBAAyB,kBAAkB,KAAK,wBAAwB;AAAA,EACpF;AACF;AAdS;AAgBT,SAAS,kBAAkB,cAAsB,SAA2B;AAC1E,QAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM,GAAG,KAAK,EAAE,YAAY;AAC7D,MAAI,CAAC,KAAM,QAAO;AAElB,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,YAAY;AACnC,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;AAClC,WAAO,OAAO,aAAa,OAAO,YAAY,OAAO,KAAK,YAAY,MAAM;AAAA,EAC9E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAXS;AAaT,SAAS,qBAAqB,cAAsB,SAA0B;AAC5E,QAAM,SAAS,IAAI,IAAI,YAAY;AACnC,MAAI,CAAC,QAAQ,SAAS,GAAG,GAAG;AAC1B,WAAO,QAAQ,SAAS,KAAK,IAAI,OAAO,WAAW,UAAU,OAAO,SAAS;AAAA,EAC/E;AAEA,QAAM,YAAY,QAAQ,QAAQ,KAAK;AACvC,QAAM,SAAS,cAAc,KAAK,OAAO,QAAQ,MAAM,GAAG,YAAY,CAAC;AACvE,QAAM,cAAc,QAAQ,MAAM,cAAc,KAAK,IAAI,YAAY,CAAC;AACtE,QAAM,CAAC,cAAc,IAAI,IAAI,iBAAiB,WAAW;AACzD,QAAM,WAAW,aAAa,MAAM,CAAC;AAErC,MAAI,UAAU,OAAO,aAAa,OAAQ,QAAO;AACjD,MAAI,QAAQ,iBAAiB,MAAM,MAAM,KAAM,QAAO;AACtD,MAAI,CAAC,QAAQ,OAAO,KAAM,QAAO;AAEjC,SAAO,OAAO,SAAS,SAAS,IAAI,QAAQ,EAAE,KAAK,OAAO,aAAa;AACzE;AAjBS;AAmBT,SAAS,iBAAiB,OAAwC;AAChE,QAAM,YAAY,MAAM,YAAY,GAAG;AACvC,MAAI,cAAc,GAAI,QAAO,CAAC,OAAO,IAAI;AACzC,SAAO,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,MAAM,MAAM,YAAY,CAAC,CAAC;AAC/D;AAJS;AAMT,SAAS,iBAAiB,KAAkB;AAC1C,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AALS;AAOT,SAAS,iBAAiB,UAAsD;AAC9E,MAAI,CAAC,YAAY,SAAS,SAAS,QAAQ,qBAAqB,QAAQ,GAAG;AACzE,UAAM,IAAI,yBAAyB,qBAAqB,KAAK,0BAA0B;AAAA,EACzF;AACF;AAJS;AAMT,SAAS,qBAAqB,OAAwB;AACpD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,MAAM,SAAS,IAAK,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AANS;AAQT,SAAS,wBAAwB,SAAkB,MAAuC;AACxF,QAAM,SAAS,QAAQ,QAAQ,IAAI,cAAc,GAAG,KAAK,EAAE,YAAY;AACvE,QAAM,cAAc,QAAQ,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,KAAK;AACxD,QAAM,YAAY,SAAS,SAAS,4BAA4B;AAEhE,MAAI,CAAC,UAAU,IAAI,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAdS;AAgBT,eAAe,kBAAkB,SAAkB,OAAoC;AACrF,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK;AAClE,MAAI,eAAe;AACjB,QAAI,CAAC,QAAQ,KAAK,aAAa,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAa,IAAI,OAAO;AACjC,YAAM,IAAI,yBAAyB,kBAAkB,KAAK,iCAAiC;AAAA,IAC7F;AAAA,EACF;AAEA,iBAAe,QAAQ,MAAM;AAC7B,MAAI,CAAC,QAAQ,KAAM,QAAO,IAAI,WAAW;AAEzC,QAAM,SAAS,QAAQ,KAAK,UAAU;AACtC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,QAAM,iBAAiB,6BAAM;AAC3B,SAAK,OAAO,OAAO,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC1D,GAFuB;AAIvB,UAAQ,OAAO,iBAAiB,SAAS,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAEvE,MAAI;AACF,WAAO,MAAM;AACX,qBAAe,QAAQ,MAAM;AAC7B,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,UAAI,CAAC,MAAO;AAEZ,eAAS,MAAM;AACf,UAAI,QAAQ,OAAO;AACjB,cAAM,OAAO,OAAO,iCAAiC;AACrD,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAS,gBAAe,QAAQ,MAAM;AACzD,UAAM;AAAA,EACR,UAAE;AACA,YAAQ,OAAO,oBAAoB,SAAS,cAAc;AAC1D,WAAO,YAAY;AAAA,EACrB;AAEA,iBAAe,QAAQ,MAAM;AAC7B,QAAM,OAAO,IAAI,WAAW,KAAK;AACjC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AA7De;AA+Df,eAAe,cAAc,SAAkB,OAAsC;AACnF,QAAM,OAAO,IAAI,YAAY,MAAM,UAAU;AAC7C,MAAI,WAAW,IAAI,EAAE,IAAI,KAAK;AAC9B,QAAM,OAAO,IAAI,QAAQ,QAAQ,KAAK;AAAA,IACpC,QAAQ;AAAA,IACR,SAAS,QAAQ;AAAA,IACjB;AAAA,EACF,CAAC;AAED,MAAI;AACF,WAAO,MAAM,KAAK,SAAS;AAAA,EAC7B,QAAQ;AACN,UAAM,IAAI,yBAAyB,gBAAgB,KAAK,iCAAiC;AAAA,EAC3F;AACF;AAde;AAgBf,SAAS,sBAAsB,QAAwB;AACrD,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAfS;AAiBT,SAAS,eAAe,QAA2B;AACjD,MAAI,CAAC,OAAO,QAAS;AACrB,MAAI,OAAO,WAAW,OAAW,OAAM,OAAO;AAC9C,QAAM,IAAI,aAAa,6BAA6B,YAAY;AAClE;AAJS;","names":["globalState"]}

package/dist/server-action-security.mjs

@@ -10,8 +10,8 @@ import {
   runWithServerActionRequest,
   sanitizeServerActionError,
   validateServerActionRequest
-} from "./chunk-AGS7UJ52.mjs";
-import "./chunk-TXCFGOHW.mjs";
+} from "./chunk-45LKHSHJ.mjs";
+import "./chunk-SHRJG6OG.mjs";
 import "./chunk-CGILA3WO.mjs";
 export {
   DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,