@farm.js/core 0.1.0-beta.14 → 0.1.0-beta.17

package/dist/index.cjs

@@ -4842,6 +4842,72 @@ var init_cache_invalidation = __esm({
   }
 });
 
+// src/server-fn-error.ts
+function isServerFnFailure(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return candidate[FARM_SERVER_FN_FAILURE_SYMBOL] === true && candidate.name === "ServerFnFailure" && typeof candidate.code === "string" && Number.isInteger(candidate.status) && (candidate.status ?? 0) >= 400 && (candidate.status ?? 0) <= 599;
+}
+function serializeServerFnFailure(value) {
+  if (!isServerFnFailure(value)) return null;
+  return {
+    name: "ServerFnFailure",
+    message: value.message,
+    code: value.code,
+    status: value.status,
+    data: value.data
+  };
+}
+function createServerFnTransportError(value) {
+  if (isSerializedServerFnFailure(value)) {
+    return new ServerFnFailure(value.code, value.data, {
+      status: value.status,
+      message: value.message
+    });
+  }
+  const message = value && typeof value === "object" && "message" in value && typeof value.message === "string" ? value.message : "Server function failed";
+  return new ServerActionError(message);
+}
+function isSerializedServerFnFailure(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return candidate.name === "ServerFnFailure" && typeof candidate.message === "string" && typeof candidate.code === "string" && Number.isInteger(candidate.status) && (candidate.status ?? 0) >= 400 && (candidate.status ?? 0) <= 599 && "data" in candidate;
+}
+var FARM_SERVER_FN_FAILURE_SYMBOL, _ServerFnFailure, ServerFnFailure, _ServerActionError, ServerActionError;
+var init_server_fn_error = __esm({
+  "src/server-fn-error.ts"() {
+    "use strict";
+    FARM_SERVER_FN_FAILURE_SYMBOL = /* @__PURE__ */ Symbol.for("farm.server-fn.failure");
+    _ServerFnFailure = class _ServerFnFailure extends Error {
+      constructor(code, data, options) {
+        super(options.message);
+        this.name = "ServerFnFailure";
+        this.code = code;
+        this.data = data;
+        this.status = options.status;
+        Object.defineProperty(this, FARM_SERVER_FN_FAILURE_SYMBOL, {
+          value: true,
+          enumerable: false
+        });
+      }
+    };
+    __name(_ServerFnFailure, "ServerFnFailure");
+    ServerFnFailure = _ServerFnFailure;
+    _ServerActionError = class _ServerActionError extends Error {
+      constructor(message = "Server function failed") {
+        super(message);
+        this.name = "ServerActionError";
+      }
+    };
+    __name(_ServerActionError, "ServerActionError");
+    ServerActionError = _ServerActionError;
+    __name(isServerFnFailure, "isServerFnFailure");
+    __name(serializeServerFnFailure, "serializeServerFnFailure");
+    __name(createServerFnTransportError, "createServerFnTransportError");
+    __name(isSerializedServerFnFailure, "isSerializedServerFnFailure");
+  }
+});
+
 // src/server-action-security.ts
 function resolveServerActionsConfig(config) {
   const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);
@@ -4928,7 +4994,9 @@ function createServerActionRequestErrorResponse(error) {
     headers: headers2
   });
 }
-function sanitizeServerActionError(_error) {
+function sanitizeServerActionError(error) {
+  const declaredFailure = serializeServerFnFailure(error);
+  if (declaredFailure) return declaredFailure;
   return {
     name: "ServerActionError",
     message: "Server function failed"
@@ -5227,6 +5295,7 @@ var init_server_action_security = __esm({
     "use strict";
     import_node_async_hooks = require("async_hooks");
     init_cache_invalidation();
+    init_server_fn_error();
     DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1e6;
     _ServerActionRequestError = class _ServerActionRequestError extends Error {
       constructor(code, status, message) {
@@ -10252,6 +10321,15 @@ var init_deferred = __esm({
 });
 
 // src/deployment.ts
+function getFarmPresetRuntime(preset) {
+  if (preset === "cloudflare" || preset === "cloudflare-pages" || preset === "cloudflare-module" || preset === "netlify-edge" || preset === "vercel-edge" || preset === "deno") {
+    return "edge";
+  }
+  if (preset === "node-server" || preset === "vercel" || preset === "netlify" || preset === "aws-lambda" || preset === "azure" || preset === "firebase" || preset === "bun" || preset === "self-host" || preset === "farm") {
+    return "node";
+  }
+  return "unknown";
+}
 function normalizeFarmDeploymentId(value) {
   if (typeof value !== "string" || value.trim() === "") {
     throw new TypeError("Farm deploymentId must be a non-empty string");
@@ -10370,6 +10448,7 @@ var init_deployment = __esm({
     FARM_DEPLOYMENT_COOKIE = "__farm_deployment";
     FARM_DEPLOYMENT_MISMATCH_CODE = "FARM_DEPLOYMENT_MISMATCH";
     FARM_DEPLOYMENT_MISMATCH_STATUS = 409;
+    __name(getFarmPresetRuntime, "getFarmPresetRuntime");
     _FarmDeploymentMismatchError = class _FarmDeploymentMismatchError extends Error {
       constructor(clientDeploymentId, serverDeploymentId) {
         super("The application was updated while this page was open. Refresh before trying again.");
@@ -15073,6 +15152,143 @@ var init_preload = __esm({
   }
 });
 
+// src/security.ts
+function resolveFarmSecurityConfig(input) {
+  if (input === void 0) return { csp: false };
+  if (!isPlainRecord(input)) {
+    throw new TypeError("security must be an object containing the csp option.");
+  }
+  if (Object.prototype.hasOwnProperty.call(input, "contentSecurityPolicy")) {
+    throw new TypeError(
+      "security.contentSecurityPolicy is not supported. Use security.csp instead."
+    );
+  }
+  const csp = input.csp;
+  if (csp === void 0 || csp === false) return { csp: false };
+  if (typeof csp === "string") {
+    return {
+      csp: {
+        value: validateSerializedCsp(csp),
+        reportOnly: false
+      }
+    };
+  }
+  if (!isPlainRecord(csp)) {
+    throw new TypeError("security.csp must be a policy string, false, or an options object.");
+  }
+  const reportOnly = validateReportOnly(csp.reportOnly);
+  if (Object.prototype.hasOwnProperty.call(csp, "value")) {
+    if (Object.prototype.hasOwnProperty.call(csp, "policy") || Object.prototype.hasOwnProperty.call(csp, "directives")) {
+      throw new TypeError(
+        "Resolved security.csp values cannot include policy or directives options."
+      );
+    }
+    return {
+      csp: {
+        value: validateSerializedCsp(csp.value),
+        reportOnly
+      }
+    };
+  }
+  const { policy, directives } = csp;
+  if (policy !== void 0 && directives !== void 0) {
+    throw new TypeError("security.csp accepts either policy or directives, not both.");
+  }
+  if (policy === void 0 && directives === void 0) {
+    throw new TypeError("security.csp requires a policy string or directives object.");
+  }
+  return {
+    csp: {
+      value: policy !== void 0 ? validateSerializedCsp(policy) : serializeFarmCspDirectives(directives),
+      reportOnly
+    }
+  };
+}
+function serializeFarmCspDirectives(directives) {
+  if (!isPlainRecord(directives)) {
+    throw new TypeError("security.csp.directives must be an object.");
+  }
+  const serialized = [];
+  const normalizedNames = /* @__PURE__ */ new Set();
+  for (const [configuredName, configuredValue] of Object.entries(directives)) {
+    if (configuredValue === false || configuredValue === null || configuredValue === void 0) {
+      continue;
+    }
+    const name = normalizeDirectiveName(configuredName);
+    if (normalizedNames.has(name)) {
+      throw new TypeError(`security.csp contains the duplicate directive ${JSON.stringify(name)}.`);
+    }
+    normalizedNames.add(name);
+    const values = configuredValue === true ? [] : (Array.isArray(configuredValue) ? configuredValue : [configuredValue]).map(
+      validateDirectiveValue
+    );
+    serialized.push(values.length > 0 ? `${name} ${values.join(" ")}` : name);
+  }
+  if (serialized.length === 0) {
+    throw new TypeError("security.csp.directives must contain at least one enabled directive.");
+  }
+  return serialized.join("; ");
+}
+function getFarmSecurityHeader(security) {
+  if (!security.csp) return void 0;
+  return {
+    key: security.csp.reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy",
+    value: security.csp.value
+  };
+}
+function normalizeDirectiveName(value) {
+  const name = value.trim().replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+  if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+    throw new TypeError(`Invalid security.csp directive name: ${JSON.stringify(value)}.`);
+  }
+  return name;
+}
+function validateDirectiveValue(value) {
+  if (typeof value !== "string") {
+    throw new TypeError("security.csp directive values must be strings or booleans.");
+  }
+  const normalized = value.trim();
+  if (!normalized || /[;\r\n]/.test(normalized) || normalized.includes("\0")) {
+    throw new TypeError(`Invalid security.csp directive value: ${JSON.stringify(value)}.`);
+  }
+  return normalized;
+}
+function validateSerializedCsp(value) {
+  if (typeof value !== "string") {
+    throw new TypeError("security.csp policy must be a non-empty single-line string.");
+  }
+  const normalized = value.trim().replace(/;+$/g, "").trim();
+  if (!normalized || /[\r\n]/.test(normalized) || normalized.includes("\0")) {
+    throw new TypeError("security.csp policy must be a non-empty single-line string.");
+  }
+  return normalized;
+}
+function validateReportOnly(value) {
+  if (value === void 0) return false;
+  if (typeof value !== "boolean") {
+    throw new TypeError("security.csp.reportOnly must be a boolean.");
+  }
+  return value;
+}
+function isPlainRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+var init_security = __esm({
+  "src/security.ts"() {
+    "use strict";
+    __name(resolveFarmSecurityConfig, "resolveFarmSecurityConfig");
+    __name(serializeFarmCspDirectives, "serializeFarmCspDirectives");
+    __name(getFarmSecurityHeader, "getFarmSecurityHeader");
+    __name(normalizeDirectiveName, "normalizeDirectiveName");
+    __name(validateDirectiveValue, "validateDirectiveValue");
+    __name(validateSerializedCsp, "validateSerializedCsp");
+    __name(validateReportOnly, "validateReportOnly");
+    __name(isPlainRecord, "isPlainRecord");
+  }
+});
+
 // src/app.ts
 function isResolvedDocsConfig(value) {
   return !!value && typeof value === "object" && "enabled" in value && "entry" in value && "config" in value;
@@ -15113,6 +15329,7 @@ var init_app = __esm({
     init_cache();
     init_auth_config();
     init_preload();
+    init_security();
     defaultDocsConfig = {
       enabled: false,
       entry: "/docs",
@@ -15177,6 +15394,7 @@ var init_app = __esm({
           routeRules: normalizeRouteRules(config.routeRules),
           context: config.context || (() => void 0),
           serverActions: resolveServerActionsConfig(config.serverActions),
+          security: resolveFarmSecurityConfig(config.security),
           images: resolveFarmImageConfig(config.images),
           performance: resolveFarmPerformanceConfig(config.performance),
           i18n: isResolvedI18nConfig(config.i18n) ? config.i18n : resolveFarmI18nConfig(config.i18n, {
@@ -15968,13 +16186,13 @@ function createEndpoint(pathOrOptions, optionsOrHandler, maybeHandler) {
   }
   const middleware2 = normalizeEndpointMiddleware(options.middleware);
   const errors = normalizeEndpointErrors(options.errors);
-  const fail = createEndpointFail(errors);
+  const error = createEndpointErrorHandler(errors);
   const wrappedHandler = /* @__PURE__ */ __name((async (ctx) => {
     const execution = await runEndpointMiddleware(
       middleware2,
       ctx,
       handler,
-      fail,
+      error,
       options.invalidates
     );
     return execution.result;
@@ -15994,7 +16212,7 @@ function createEndpoint(pathOrOptions, optionsOrHandler, maybeHandler) {
   endpoint2.__method = options.method || "GET";
   endpoint2.__autoPath = !path32;
   endpoint2.__handler = wrappedHandler;
-  endpoint2.__farmInvoke = (ctx) => runEndpointMiddleware(middleware2, ctx, handler, fail, options.invalidates);
+  endpoint2.__farmInvoke = (ctx) => runEndpointMiddleware(middleware2, ctx, handler, error, options.invalidates);
   endpoint2.__middleware = middleware2;
   endpoint2.__sourceHandler = handler;
   endpoint2.__invalidates = options.invalidates;
@@ -16025,8 +16243,9 @@ function normalizeEndpointErrors(definitions) {
     if (!Number.isInteger(definition.status) || definition.status < 400 || definition.status > 599) {
       throw new TypeError(`Endpoint error "${code}" status must be an integer between 400 and 599`);
     }
-    if (!definition.schema || typeof definition.schema.parse !== "function") {
-      throw new TypeError(`Endpoint error "${code}" requires a schema with parse()`);
+    const dataSchema = resolveEndpointErrorSchema(definition);
+    if (!dataSchema || typeof dataSchema.parse !== "function") {
+      throw new TypeError(`Endpoint error "${code}" requires a data schema with parse()`);
     }
     if (definition.message !== void 0 && typeof definition.message !== "string") {
       throw new TypeError(`Endpoint error "${code}" message must be a string`);
@@ -16035,13 +16254,19 @@ function normalizeEndpointErrors(definitions) {
   }
   return Object.freeze(normalized);
 }
-function createEndpointFail(definitions) {
+function resolveEndpointErrorSchema(definition) {
+  if (definition.data && definition.schema) {
+    throw new TypeError("Endpoint errors cannot define both data and schema");
+  }
+  return definition.data ?? definition.schema;
+}
+function createEndpointErrorHandler(definitions) {
   return ((code, data) => {
     const definition = definitions[code];
     if (!definition) {
       throw new TypeError(`Endpoint error "${code}" is not declared`);
     }
-    const parsed = definition.schema.parse(data);
+    const parsed = resolveEndpointErrorSchema(definition).parse(data);
     throw new EndpointFailure(code, parsed, {
       status: definition.status,
       message: definition.message ?? "Request failed"
@@ -16061,7 +16286,7 @@ function normalizeEndpointMiddleware(middleware2) {
   }
   return Object.freeze(normalized);
 }
-async function runEndpointMiddleware(middleware2, handlerContext, handler, fail, invalidations) {
+async function runEndpointMiddleware(middleware2, handlerContext, handler, error, invalidations) {
   let context = createInitialEndpointContext(handlerContext.context);
   for (let index = 0; index < middleware2.length; index++) {
     const result2 = await middleware2[index]({ ...handlerContext, context });
@@ -16089,7 +16314,7 @@ async function runEndpointMiddleware(middleware2, handlerContext, handler, fail,
     }
     context = mergeEndpointContext(context, result2, index);
   }
-  const result = await handler({ ...handlerContext, context, fail });
+  const result = await handler({ ...handlerContext, context, error, fail: error });
   return {
     result,
     context,
@@ -16219,7 +16444,8 @@ var init_endpoint = __esm({
     EMPTY_ENDPOINT_CONTEXT = Object.freeze(/* @__PURE__ */ Object.create(null));
     UNSAFE_ENDPOINT_CONTEXT_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
     __name(normalizeEndpointErrors, "normalizeEndpointErrors");
-    __name(createEndpointFail, "createEndpointFail");
+    __name(resolveEndpointErrorSchema, "resolveEndpointErrorSchema");
+    __name(createEndpointErrorHandler, "createEndpointErrorHandler");
     __name(normalizeEndpointMiddleware, "normalizeEndpointMiddleware");
     __name(runEndpointMiddleware, "runEndpointMiddleware");
     __name(applyEndpointInvalidations, "applyEndpointInvalidations");
@@ -17824,6 +18050,13 @@ function routePatternToTsTypeLiterals(pattern) {
 function routePatternToRouteLiteral(pattern) {
   return JSON.stringify(pattern);
 }
+function renderTypeUnion(values) {
+  return values.length <= 1 ? values[0] || "never" : `
+  | ${values.join("\n  | ")}`;
+}
+function renderTypeAlias(name, value) {
+  return `export type ${name} =${value.startsWith("\n") ? "" : " "}${value};`;
+}
 function createRoutePattern(route2) {
   if (route2.segments.length === 0) return "/";
   return "/" + route2.segments.map((seg) => {
@@ -17883,9 +18116,9 @@ async function createRouteTypeDeclarations(options, outPath) {
   const typeLiterals = Array.from(new Set(sortedPatterns.flatMap(routePatternToTsTypeLiterals)));
   const patternLiterals = sortedPatterns.map(routePatternToRouteLiteral);
   const routeModulePatternLiterals = Array.from(routeModulePatterns).sort().map(routePatternToRouteLiteral);
-  const routePathType = suppressLintOnLink ? "string" : typeLiterals.length ? typeLiterals.join(" | ") : "never";
-  const routePatternType = suppressLintOnLink ? "string" : patternLiterals.length ? patternLiterals.join(" | ") : "never";
-  const routeModulePatternType = routeModulePatternLiterals.length ? routeModulePatternLiterals.join(" | ") : "never";
+  const routePathType = suppressLintOnLink ? "string" : renderTypeUnion(typeLiterals);
+  const routePatternType = suppressLintOnLink ? "string" : renderTypeUnion(patternLiterals);
+  const routeModulePatternType = renderTypeUnion(routeModulePatternLiterals);
   const routeTypesImportPath = `./${path14.basename(outPath).replace(/\.d\.ts$/, "")}`;
   const linkAugmentationBlock = suppressLintOnLink ? "" : `
 declare module "@farm.js/core/client" {
@@ -17927,9 +18160,9 @@ declare global {
  * Regenerated on dev start and when routes change.
  * Set suppressLintOnLink: true in farm.config.ts to accept any string on Link href.
  */
-export type RoutePath = ${routePathType};
-export type RoutePattern = ${routePatternType};
-export type RouteModulePattern = ${routeModulePatternType};${linkAugmentationBlock}${routeModuleAugmentationBlock}
+${renderTypeAlias("RoutePath", routePathType)}
+${renderTypeAlias("RoutePattern", routePatternType)}
+${renderTypeAlias("RouteModulePattern", routeModulePatternType)}${linkAugmentationBlock}${routeModuleAugmentationBlock}
 `;
   return content;
 }
@@ -17946,6 +18179,8 @@ var init_generate_route_types = __esm({
     __name(routeSegmentsToTsTypeLiteral, "routeSegmentsToTsTypeLiteral");
     __name(routePatternToTsTypeLiterals, "routePatternToTsTypeLiterals");
     __name(routePatternToRouteLiteral, "routePatternToRouteLiteral");
+    __name(renderTypeUnion, "renderTypeUnion");
+    __name(renderTypeAlias, "renderTypeAlias");
     __name(createRoutePattern, "createRoutePattern");
     DEFAULT_OUT_FILE = "farm-routes.d.ts";
     __name(generateRouteTypes, "generateRouteTypes");
@@ -18246,7 +18481,8 @@ async function generateFarmTypeArtifacts(options) {
   const sourceRoots = getFarmSourceRoots({ root, srcDir, layers: options.layers });
   const appDirs = getFarmAppDirectories({ root, srcDir, layers: options.layers });
   const result = {
-    apiRoutes: []
+    apiRoutes: [],
+    stalePaths: []
   };
   const unifiedTypesPath = (0, import_path8.join)(root, srcDir, "farm.d.ts");
   const shouldRefreshUnifiedTypes = shouldGenerateRoutes && !options.routeTypesOutFile || shouldGenerateEnv && !options.envTypesOutFile || shouldGenerateI18n && !options.i18nTypesOutFile;
@@ -18262,22 +18498,29 @@ async function generateFarmTypeArtifacts(options) {
     unifiedSections.push(await createRouteTypeDeclarations(routeOptions, unifiedTypesPath));
     result.routeTypesPath = unifiedTypesPath;
   } else if (shouldGenerateRoutes) {
-    result.routeTypesPath = await generateRouteTypes({
+    const routeOptions = {
       root,
       srcDir,
       outFile: options.routeTypesOutFile,
       extraRoutes: options.extraRoutes || [],
       suppressLintOnLink: options.suppressLintOnLink,
       sourceRoots
-    });
+    };
+    if (options.check) {
+      const routeTypesPath = resolveGeneratedPath(root, srcDir, options.routeTypesOutFile);
+      const content = await createRouteTypeDeclarations(routeOptions, routeTypesPath);
+      checkGeneratedFile(routeTypesPath, content, result.stalePaths);
+      result.routeTypesPath = routeTypesPath;
+    } else {
+      result.routeTypesPath = await generateRouteTypes(routeOptions);
+    }
   }
   if (shouldGenerateApi) {
     const generator = new APITypeGenerator(appDirs);
     const apiRoutes = generator.scanAPIRoutes();
     const apiTypesPath = options.apiTypesOutFile ? (0, import_path8.resolve)(root, options.apiTypesOutFile) : (0, import_path8.join)(root, srcDir, "lib", "api.generated.ts");
     const content = generator.generateAPIRouter(apiRoutes, { outFile: apiTypesPath });
-    (0, import_fs4.mkdirSync)((0, import_path8.dirname)(apiTypesPath), { recursive: true });
-    writeFileIfChanged(apiTypesPath, content);
+    writeOrCheckGeneratedFile(apiTypesPath, content, options.check, result.stalePaths);
     result.apiTypesPath = apiTypesPath;
     result.apiRoutes = apiRoutes;
   }
@@ -18295,36 +18538,63 @@ async function generateFarmTypeArtifacts(options) {
     );
     result.envTypesPath = unifiedTypesPath;
   } else if (shouldGenerateEnv) {
-    result.envTypesPath = await generateEnvTypes({
+    const envOptions = {
       root,
       srcDir,
       outFile: options.envTypesOutFile,
       configPath: options.configPath,
       layerConfigPaths: (options.layers ?? []).map((layer) => layer.configFile).filter((configFile) => Boolean(configFile))
-    });
+    };
+    if (options.check) {
+      const envTypesPath = resolveGeneratedPath(root, srcDir, options.envTypesOutFile);
+      checkGeneratedFile(
+        envTypesPath,
+        createEnvTypeDeclarations(envOptions, envTypesPath),
+        result.stalePaths
+      );
+      result.envTypesPath = envTypesPath;
+    } else {
+      result.envTypesPath = await generateEnvTypes(envOptions);
+    }
   }
   if (shouldGenerateImages && options.imageTypesOutFile) {
-    result.imageTypesPath = generateFarmImageTypes({
-      root,
-      srcDir,
-      outFile: options.imageTypesOutFile
-    });
+    const imageTypesPath = resolveGeneratedPath(root, srcDir, options.imageTypesOutFile, false);
+    if (options.check) {
+      checkGeneratedFile(imageTypesPath, createFarmImageTypeDeclarations(), result.stalePaths);
+      result.imageTypesPath = imageTypesPath;
+    } else {
+      result.imageTypesPath = generateFarmImageTypes({
+        root,
+        srcDir,
+        outFile: options.imageTypesOutFile
+      });
+    }
   }
   if (shouldRefreshUnifiedTypes && options.i18nConfig?.enabled && !options.i18nTypesOutFile) {
     const { signatures } = await readFarmI18nCatalogs(options.i18nConfig);
     unifiedSections.push(renderFarmI18nTypes(options.i18nConfig.locales, signatures));
     result.i18nTypesPath = unifiedTypesPath;
   } else if (shouldGenerateI18n && options.i18nConfig) {
-    result.i18nTypesPath = await generateFarmI18nTypes({
-      root,
-      srcDir,
-      config: options.i18nConfig,
-      outFile: options.i18nTypesOutFile
-    });
+    if (options.check) {
+      const i18nTypesPath = resolveGeneratedPath(root, srcDir, options.i18nTypesOutFile, false);
+      const { signatures } = await readFarmI18nCatalogs(options.i18nConfig);
+      checkGeneratedFile(
+        i18nTypesPath,
+        renderFarmI18nTypes(options.i18nConfig.locales, signatures),
+        result.stalePaths
+      );
+      result.i18nTypesPath = i18nTypesPath;
+    } else {
+      result.i18nTypesPath = await generateFarmI18nTypes({
+        root,
+        srcDir,
+        config: options.i18nConfig,
+        outFile: options.i18nTypesOutFile
+      });
+    }
   }
   if (shouldRefreshUnifiedTypes) {
-    (0, import_fs4.mkdirSync)((0, import_path8.dirname)(unifiedTypesPath), { recursive: true });
-    writeFileIfChanged(
+    writeOrCheckGeneratedFile(
       unifiedTypesPath,
       `/**
  * Generated by Farm.js. Do not edit.
@@ -18333,13 +18603,37 @@ async function generateFarmTypeArtifacts(options) {
 
 import "@farm.js/core/image";
 
-${unifiedSections.join("\n")}`
+${unifiedSections.map((section) => section.trimEnd()).join("\n\n")}
+`,
+      options.check,
+      result.stalePaths
     );
     result.typesPath = unifiedTypesPath;
-    removeLegacyTypeArtifacts(root, srcDir);
+    if (options.check) {
+      collectLegacyTypeArtifacts(root, srcDir, result.stalePaths);
+    } else {
+      removeLegacyTypeArtifacts(root, srcDir);
+    }
   }
   return result;
 }
+function resolveGeneratedPath(root, srcDir, outFile, relativeToSrc = true) {
+  if ((0, import_path8.isAbsolute)(outFile)) return (0, import_path8.resolve)(outFile);
+  return (0, import_path8.resolve)(root, relativeToSrc ? (0, import_path8.join)(srcDir, outFile) : outFile);
+}
+function writeOrCheckGeneratedFile(filePath, content, check, stalePaths) {
+  if (check) {
+    checkGeneratedFile(filePath, content, stalePaths);
+    return;
+  }
+  (0, import_fs4.mkdirSync)((0, import_path8.dirname)(filePath), { recursive: true });
+  writeFileIfChanged(filePath, content);
+}
+function checkGeneratedFile(filePath, content, stalePaths) {
+  if (!(0, import_fs4.existsSync)(filePath) || (0, import_fs4.readFileSync)(filePath, "utf8") !== content) {
+    stalePaths.push(filePath);
+  }
+}
 function removeLegacyTypeArtifacts(root, srcDir) {
   for (const [fileName, marker] of LEGACY_TYPE_ARTIFACTS) {
     const filePath = (0, import_path8.join)(root, srcDir, fileName);
@@ -18350,6 +18644,13 @@ function removeLegacyTypeArtifacts(root, srcDir) {
     }
   }
 }
+function collectLegacyTypeArtifacts(root, srcDir, stalePaths) {
+  for (const [fileName, marker] of LEGACY_TYPE_ARTIFACTS) {
+    const filePath = (0, import_path8.join)(root, srcDir, fileName);
+    if (!(0, import_fs4.existsSync)(filePath)) continue;
+    if ((0, import_fs4.readFileSync)(filePath, "utf8").includes(marker)) stalePaths.push(filePath);
+  }
+}
 var import_fs4, import_path8, LEGACY_TYPE_ARTIFACTS;
 var init_type_artifacts = __esm({
   "src/type-artifacts.ts"() {
@@ -18365,6 +18666,9 @@ var init_type_artifacts = __esm({
     init_layers();
     init_write_file_if_changed();
     __name(generateFarmTypeArtifacts, "generateFarmTypeArtifacts");
+    __name(resolveGeneratedPath, "resolveGeneratedPath");
+    __name(writeOrCheckGeneratedFile, "writeOrCheckGeneratedFile");
+    __name(checkGeneratedFile, "checkGeneratedFile");
     LEGACY_TYPE_ARTIFACTS = [
       ["farm-routes.d.ts", "Auto-generated route types"],
       ["farm-env.d.ts", "Auto-generated env types"],
@@ -18372,6 +18676,7 @@ var init_type_artifacts = __esm({
       ["farm-i18n.d.ts", "Generated by Farm.js"]
     ];
     __name(removeLegacyTypeArtifacts, "removeLegacyTypeArtifacts");
+    __name(collectLegacyTypeArtifacts, "collectLegacyTypeArtifacts");
   }
 });
 
@@ -18728,7 +19033,7 @@ var init_environment_vite = __esm({
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.1.0-beta.14";
+    version = "0.1.0-beta.17";
   }
 });
 
@@ -19489,11 +19794,28 @@ function createFarmClientOptimizeDepsConfig(entries) {
     ...entries?.length ? { entries: [...entries] } : {}
   };
 }
+function createFarmSourceAlias(projectRoot, srcDir = "src") {
+  return {
+    "@": import_node_path9.default.resolve(projectRoot, srcDir)
+  };
+}
 function mergeNoExternal(farmValue, userValue) {
   if (farmValue === true || userValue === true) return true;
   const normalize = /* @__PURE__ */ __name((value) => value == null || value === true ? [] : Array.isArray(value) ? value : [value], "normalize");
   return Array.from(/* @__PURE__ */ new Set([...normalize(farmValue), ...normalize(userValue)]));
 }
+function mergeAlias(farmValue, userValue) {
+  if (!farmValue) return userValue || {};
+  if (!userValue) return farmValue;
+  if (!Array.isArray(farmValue) && !Array.isArray(userValue)) {
+    return {
+      ...farmValue,
+      ...userValue
+    };
+  }
+  const normalize = /* @__PURE__ */ __name((value) => Array.isArray(value) ? [...value] : Object.entries(value).map(([find, replacement]) => ({ find, replacement })), "normalize");
+  return [...normalize(userValue), ...normalize(farmValue)];
+}
 function mergeFarmViteConfig(farmConfig, userConfig = {}) {
   const noDiscovery = userConfig.optimizeDeps?.noDiscovery ?? farmConfig.optimizeDeps?.noDiscovery;
   const holdUntilCrawlEnd = userConfig.optimizeDeps?.holdUntilCrawlEnd ?? (userConfig.optimizeDeps?.noDiscovery === true ? false : farmConfig.optimizeDeps?.holdUntilCrawlEnd);
@@ -19508,6 +19830,7 @@ function mergeFarmViteConfig(farmConfig, userConfig = {}) {
     resolve: {
       ...farmConfig.resolve,
       ...userConfig.resolve,
+      alias: mergeAlias(farmConfig.resolve?.alias, userConfig.resolve?.alias),
       dedupe: Array.from(
         /* @__PURE__ */ new Set([...farmConfig.resolve?.dedupe || [], ...userConfig.resolve?.dedupe || []])
       )
@@ -19560,7 +19883,9 @@ var init_vite_config = __esm({
     ];
     __name(createFarmClientOptimizeDepsEntries, "createFarmClientOptimizeDepsEntries");
     __name(createFarmClientOptimizeDepsConfig, "createFarmClientOptimizeDepsConfig");
+    __name(createFarmSourceAlias, "createFarmSourceAlias");
     __name(mergeNoExternal, "mergeNoExternal");
+    __name(mergeAlias, "mergeAlias");
     __name(mergeFarmViteConfig, "mergeFarmViteConfig");
   }
 });
@@ -23520,6 +23845,8 @@ async function resolveConfig(userConfig, mode) {
   const routeRules = normalizeRouteRules(userConfig.routeRules);
   const routeRuleRedirects = routeRulesToRedirects(routeRules);
   const routeRuleHeaders = routeRulesToHeaders(routeRules);
+  const security = resolveFarmSecurityConfig(userConfig.security);
+  const securityHeader = getFarmSecurityHeader(security);
   const deploy = resolveDeployConfig(userConfig);
   const root = userConfig.root || process.cwd();
   const srcDir = userConfig.srcDir || "src";
@@ -23575,7 +23902,11 @@ async function resolveConfig(userConfig, mode) {
     trailingSlash: userConfig.trailingSlash ?? false,
     redirects: /* @__PURE__ */ __name(() => [...redirects, ...routeRuleRedirects], "redirects"),
     rewrites: /* @__PURE__ */ __name(() => rewrites, "rewrites"),
-    headers: /* @__PURE__ */ __name(() => [...headers2, ...routeRuleHeaders], "headers"),
+    headers: /* @__PURE__ */ __name(() => [
+      ...headers2,
+      ...routeRuleHeaders,
+      ...securityHeader ? [{ source: "/*", headers: [securityHeader] }] : []
+    ], "headers"),
     routeRules,
     images: resolveFarmImageConfig(userConfig.images),
     performance: resolveFarmPerformanceConfig(userConfig.performance),
@@ -23594,6 +23925,7 @@ async function resolveConfig(userConfig, mode) {
     notFound: userConfig.notFound || {},
     context: userConfig.context || (() => void 0),
     serverActions: resolveServerActionsConfig(userConfig.serverActions),
+    security,
     deploymentId,
     output: userConfig.output || "standalone",
     distDir: userConfig.distDir || ".farm",
@@ -23673,6 +24005,7 @@ var init_config2 = __esm({
     init_config();
     init_auth_config();
     init_preload();
+    init_security();
     init_config_entry();
     FARM_RESOLVED_CUSTOM_CONTEXT = /* @__PURE__ */ Symbol.for("farm.resolvedCustomContext");
     __name(hasCustomFarmRouteContext, "hasCustomFarmRouteContext");
@@ -30507,7 +30840,7 @@ async function defineConfig2(config = {}) {
       // Stub out problematic server-only modules during dev mode
       alias: {
         ...getFarmLayerAliases(config.layers),
-        "@": path25.resolve(appRoot, "src"),
+        ...createFarmSourceAlias(appRoot, config.srcDir),
         // Nitro internals that should not be resolved in browser
         "supports-color": "data:text/javascript,export default false; export const supportsColor = false; export const stdout = false; export const stderr = false;",
         "@poppinss/dumper": "data:text/javascript,export default {};",
@@ -31947,6 +32280,7 @@ __export(src_exports, {
   FARM_DEVTOOLS_LAUNCH_PARAM: () => FARM_DEVTOOLS_LAUNCH_PARAM,
   FARM_DEVTOOLS_PATH: () => FARM_DEVTOOLS_PATH,
   FARM_INTEGRATION_INTERNAL_DISPATCH_CONTEXT_KEY: () => FARM_INTEGRATION_INTERNAL_DISPATCH_CONTEXT_KEY,
+  FARM_SERVER_FN_FAILURE_SYMBOL: () => FARM_SERVER_FN_FAILURE_SYMBOL,
   FARM_SERVER_FN_SYMBOL: () => FARM_SERVER_FN_SYMBOL,
   FARM_SERVER_QUERY_SYMBOL: () => FARM_SERVER_QUERY_SYMBOL,
   FarmClientPluginManager: () => FarmClientPluginManager,
@@ -31969,7 +32303,10 @@ __export(src_exports, {
   PluginManager: () => PluginManager,
   SPARouter: () => SPARouter,
   ScalarAPIDocumentation: () => ScalarAPIDocumentation,
+  ServerActionError: () => ServerActionError,
   ServerActionRequestError: () => ServerActionRequestError,
+  ServerFnFailure: () => ServerFnFailure,
+  UnsupportedRateLimitStorageError: () => UnsupportedRateLimitStorageError,
   _parseServerFnSchema: () => _parseServerFnSchema,
   _runWithAfterNodeResponse: () => _runWithAfterNodeResponse,
   _runWithAfterRequest: () => _runWithAfterRequest,
@@ -32058,6 +32395,7 @@ __export(src_exports, {
   createServerAPIClient: () => createServerAPIClient,
   createServerActionRequestErrorResponse: () => createServerActionRequestErrorResponse,
   createServerFn: () => createServerFn,
+  createServerFnTransportError: () => createServerFnTransportError,
   createServerMiddleware: () => createServerMiddleware,
   createServerOnlyFn: () => createServerOnlyFn,
   createServerQuery: () => createServerQuery,
@@ -32111,6 +32449,7 @@ __export(src_exports, {
   getFarmDocsRouteTypeEntries: () => getFarmDocsRouteTypeEntries,
   getFarmIntegrationPluginServerRuntime: () => getFarmIntegrationPluginServerRuntime,
   getFarmLayerAliases: () => getFarmLayerAliases,
+  getFarmPresetRuntime: () => getFarmPresetRuntime,
   getFarmRedirectError: () => getFarmRedirectError,
   getFarmRequestDeploymentId: () => getFarmRequestDeploymentId,
   getFarmResponseDeploymentId: () => getFarmResponseDeploymentId,
@@ -32174,6 +32513,7 @@ __export(src_exports, {
   isProgrammaticRouteManifest: () => isProgrammaticRouteManifest,
   isProgrammaticRoutesFileName: () => isProgrammaticRoutesFileName,
   isSSGModule: () => isSSGModule,
+  isServerFnFailure: () => isServerFnFailure,
   isWebResponse: () => isWebResponse2,
   jsonStream: () => jsonStream,
   layout: () => layout,
@@ -32191,6 +32531,7 @@ __export(src_exports, {
   matchRegisteredIntegrationRoute: () => matchRegisteredIntegrationRoute,
   matchRoute: () => matchRoute,
   matchSSGPage: () => matchSSGPage,
+  memoryRateLimitStorage: () => memoryRateLimitStorage,
   memoryStorage: () => memoryStorage,
   mergeFarmRouteRuntimeConfigs: () => mergeFarmRouteRuntimeConfigs,
   mergeScheduledTasks: () => mergeScheduledTasks,
@@ -34647,35 +34988,69 @@ function parseRouteParams(input, parsers, options = {}) {
 __name(parseRouteParams, "parseRouteParams");
 
 // src/middleware/chain.ts
-init_storage();
-function getRateLimitStorage() {
-  return getStorage("ratelimit");
-}
-__name(getRateLimitStorage, "getRateLimitStorage");
-var defaultRateLimitStorage = {
-  async get(key) {
-    const storage = getRateLimitStorage();
-    const value = await storage.getItem(key);
-    return value ?? null;
-  },
-  async set(key, value, ttl) {
-    const storage = getRateLimitStorage();
-    await storage.setItem(key, value, ttl ? { ttl } : void 0);
-  },
-  async delete(key) {
-    const storage = getRateLimitStorage();
-    await storage.removeItem(key);
-  },
-  async ttl(key) {
-    const storage = getRateLimitStorage();
-    const record = await storage.getItem(key);
-    if (!record || !record.resetAt) {
+var DEFAULT_MEMORY_RATE_LIMIT_ENTRIES = 1e5;
+var _UnsupportedRateLimitStorageError = class _UnsupportedRateLimitStorageError extends TypeError {
+  constructor() {
+    super(
+      "RateLimitStorage must implement atomic increment(key, windowMs). Legacy get/set adapters can lose increments under concurrency. Use memoryRateLimitStorage() for one process or redisRateLimitStorage() from @farm.js/cache-redis for production."
+    );
+    this.name = "UnsupportedRateLimitStorageError";
+  }
+};
+__name(_UnsupportedRateLimitStorageError, "UnsupportedRateLimitStorageError");
+var UnsupportedRateLimitStorageError = _UnsupportedRateLimitStorageError;
+function memoryRateLimitStorage(options = {}) {
+  const maxEntries = options.maxEntries ?? DEFAULT_MEMORY_RATE_LIMIT_ENTRIES;
+  if (!Number.isSafeInteger(maxEntries) || maxEntries <= 0) {
+    throw new TypeError("memoryRateLimitStorage maxEntries must be a positive safe integer.");
+  }
+  const records = /* @__PURE__ */ new Map();
+  function read(key, now2) {
+    const record = records.get(key);
+    if (!record) return null;
+    if (record.resetAt <= now2) {
+      records.delete(key);
       return null;
     }
-    const remainingMs = record.resetAt - Date.now();
-    return remainingMs > 0 ? Math.ceil(remainingMs / 1e3) : null;
+    return record;
   }
-};
+  __name(read, "read");
+  function pruneExpired(now2) {
+    for (const [key, record] of records) {
+      if (record.resetAt <= now2) records.delete(key);
+    }
+  }
+  __name(pruneExpired, "pruneExpired");
+  return {
+    increment(key, windowMs) {
+      if (!Number.isSafeInteger(windowMs) || windowMs <= 0) {
+        throw new TypeError("Rate-limit windowMs must be a positive safe integer.");
+      }
+      const now2 = Date.now();
+      const current = read(key, now2);
+      if (current) {
+        const next2 = { count: current.count + 1, resetAt: current.resetAt };
+        records.set(key, next2);
+        return next2;
+      }
+      if (records.size >= maxEntries) pruneExpired(now2);
+      if (records.size >= maxEntries) {
+        throw new Error(
+          `Process-local rate-limit storage reached its ${maxEntries} active-key capacity. Configure a shared production adapter or increase maxEntries.`
+        );
+      }
+      const next = { count: 1, resetAt: now2 + windowMs };
+      records.set(key, next);
+      return next;
+    },
+    get(key) {
+      const record = read(key, Date.now());
+      return record ? { ...record } : null;
+    }
+  };
+}
+__name(memoryRateLimitStorage, "memoryRateLimitStorage");
+var defaultRateLimitStorage = memoryRateLimitStorage();
 function parseTimeWindow(window2) {
   const match = window2.match(/^(\d+)(ms|s|m|h|d)$/);
   if (!match) throw new Error(`Invalid time window: ${window2}`);
@@ -34688,52 +35063,73 @@ function parseTimeWindow(window2) {
     h: 60 * 60 * 1e3,
     d: 24 * 60 * 60 * 1e3
   };
-  return value * multipliers[unit];
+  const windowMs = value * multipliers[unit];
+  if (!Number.isSafeInteger(windowMs) || windowMs <= 0) {
+    throw new Error(`Invalid time window: ${window2}`);
+  }
+  return windowMs;
 }
 __name(parseTimeWindow, "parseTimeWindow");
 function createRateLimitMiddleware(config) {
+  if (!Number.isSafeInteger(config.requests) || config.requests <= 0) {
+    throw new TypeError("Rate limit requests must be a positive safe integer.");
+  }
   const windowMs = parseTimeWindow(config.window);
   const storage = config.storage || defaultRateLimitStorage;
+  assertAtomicRateLimitStorage(storage);
   return async (ctx, next) => {
     const key = config.keyGenerator ? config.keyGenerator(ctx) : `${ctx.request.socket.remoteAddress}:${ctx.pathname}`;
+    const current = await storage.increment(key, windowMs);
+    assertRateLimitIncrementResult(current);
     const now2 = Date.now();
-    const ttlSeconds = Math.ceil(windowMs / 1e3);
-    const record = await storage.get(key);
-    if (record && now2 > record.resetAt) {
-      await storage.delete(key);
-    }
-    const current = await storage.get(key);
-    if (!current) {
-      await storage.set(
-        key,
-        {
-          count: 1,
-          resetAt: now2 + windowMs
-        },
-        ttlSeconds
-      );
-      return next();
-    }
-    if (current.count >= config.requests) {
+    const resetIn = Math.max(1, Math.ceil((current.resetAt - now2) / 1e3));
+    const remaining = Math.max(0, config.requests - current.count);
+    setRateLimitHeaders(ctx, config.requests, remaining, resetIn, Math.ceil(windowMs / 1e3));
+    if (current.count > config.requests) {
+      setMiddlewareResponseHeader(ctx, "Retry-After", String(resetIn));
       if (config.onLimit) {
         const result = await config.onLimit(ctx);
-        if (result) return;
+        if (result) return result;
       }
       ctx.json(
         {
           error: "Rate limit exceeded",
-          retryAfter: Math.ceil((current.resetAt - now2) / 1e3)
+          retryAfter: resetIn
         },
         429
       );
       return;
     }
-    current.count++;
-    await storage.set(key, current, ttlSeconds);
     return next();
   };
 }
 __name(createRateLimitMiddleware, "createRateLimitMiddleware");
+function assertAtomicRateLimitStorage(storage) {
+  if (!storage || typeof storage.increment !== "function") {
+    throw new UnsupportedRateLimitStorageError();
+  }
+}
+__name(assertAtomicRateLimitStorage, "assertAtomicRateLimitStorage");
+function assertRateLimitIncrementResult(result) {
+  if (!result || !Number.isSafeInteger(result.count) || result.count <= 0 || !Number.isFinite(result.resetAt) || result.resetAt <= 0) {
+    throw new TypeError(
+      "RateLimitStorage.increment() must return a positive integer count and a resetAt timestamp."
+    );
+  }
+}
+__name(assertRateLimitIncrementResult, "assertRateLimitIncrementResult");
+function setRateLimitHeaders(ctx, limit, remaining, resetIn, windowSeconds) {
+  setMiddlewareResponseHeader(ctx, "RateLimit-Policy", `"farm";q=${limit};w=${windowSeconds}`);
+  setMiddlewareResponseHeader(ctx, "RateLimit", `"farm";r=${remaining};t=${resetIn}`);
+}
+__name(setRateLimitHeaders, "setRateLimitHeaders");
+function setMiddlewareResponseHeader(ctx, name, value) {
+  ctx.headers.set(name, value);
+  if (!ctx.response.headersSent && !ctx.response.writableEnded) {
+    ctx.response.setHeader(name, value);
+  }
+}
+__name(setMiddlewareResponseHeader, "setMiddlewareResponseHeader");
 function matchPattern(pattern, pathname) {
   if (pattern instanceof RegExp) {
     return pattern.test(pathname);
@@ -34883,6 +35279,15 @@ var _MiddlewareChainImpl = class _MiddlewareChainImpl {
 __name(_MiddlewareChainImpl, "MiddlewareChainImpl");
 var MiddlewareChainImpl = _MiddlewareChainImpl;
 async function getRateLimitStatus(key, limit, storage = defaultRateLimitStorage) {
+  if (!Number.isSafeInteger(limit) || limit <= 0) {
+    throw new TypeError("Rate limit must be a positive safe integer.");
+  }
+  assertAtomicRateLimitStorage(storage);
+  if (typeof storage.get !== "function") {
+    throw new TypeError(
+      "getRateLimitStatus() requires a RateLimitStorage adapter that implements get(key)."
+    );
+  }
   const record = await storage.get(key);
   if (!record) {
     return {
@@ -34894,6 +35299,7 @@ async function getRateLimitStatus(key, limit, storage = defaultRateLimitStorage)
       isLimited: false
     };
   }
+  assertRateLimitIncrementResult(record);
   const now2 = Date.now();
   if (record.resetAt && now2 > record.resetAt) {
     return {
@@ -34914,9 +35320,6 @@ async function getRateLimitStatus(key, limit, storage = defaultRateLimitStorage)
     const remainingMs = record.resetAt - now2;
     resetIn = remainingMs > 0 ? Math.ceil(remainingMs / 1e3) : null;
     resetAt = new Date(record.resetAt);
-  } else if (storage.ttl) {
-    resetIn = await storage.ttl(key);
-    resetAt = resetIn ? new Date(now2 + resetIn * 1e3) : null;
   }
   return {
     requests,
@@ -35722,6 +36125,8 @@ init_image_types();
 init_server_action_security();
 init_request_bridge();
 init_cache();
+init_server_fn_error();
+init_server_fn_error();
 var FARM_SERVER_FN_SYMBOL = /* @__PURE__ */ Symbol.for("farm.server-fn");
 var UNSAFE_FORM_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function createServerMiddleware(options) {
@@ -35744,6 +36149,8 @@ function createServerFn(options) {
     throw new TypeError("createServerFn requires a handler function");
   }
   const middleware2 = resolveServerFnMiddleware(options.middleware);
+  const errors = normalizeServerFnErrors(options.errors);
+  const error = createServerFnErrorHandler(errors);
   const serverFn = /* @__PURE__ */ __name(async (value) => {
     const formData = isFormData2(value) ? value : void 0;
     const rawInput = formData ? formDataToObject2(formData) : value;
@@ -35761,7 +36168,7 @@ function createServerFn(options) {
     let resolvedContext = Object.freeze(/* @__PURE__ */ Object.create(null));
     const result = await runServerFnMiddleware(middleware2, handlerContext, async (context) => {
       resolvedContext = context.context;
-      return options.handler(context);
+      return options.handler({ ...context, error });
     });
     const parsedResult = await _parseServerFnSchema(options.output, result, "output");
     if (options.invalidates) {
@@ -35791,6 +36198,10 @@ function createServerFn(options) {
       value: options.output,
       enumerable: false
     },
+    __farmServerFnError: {
+      value: void 0,
+      enumerable: false
+    },
     __farmServerFnMiddleware: {
       value: middleware2,
       enumerable: false
@@ -35829,6 +36240,78 @@ async function runServerFnMiddleware(middleware2, handlerContext, handler) {
   return dispatch(0, Object.freeze(/* @__PURE__ */ Object.create(null)));
 }
 __name(runServerFnMiddleware, "runServerFnMiddleware");
+function normalizeServerFnErrors(definitions) {
+  if (definitions === void 0) return Object.freeze({});
+  if (!isPlainServerFnObject(definitions)) {
+    throw new TypeError("createServerFn errors must be an object");
+  }
+  const normalized = /* @__PURE__ */ Object.create(null);
+  for (const [code, definition] of Object.entries(definitions)) {
+    if (!code.trim()) {
+      throw new TypeError("Server function error codes cannot be empty");
+    }
+    if (!definition || typeof definition !== "object") {
+      throw new TypeError(`Server function error "${code}" must be an object`);
+    }
+    if (!Number.isInteger(definition.status) || definition.status < 400 || definition.status > 599) {
+      throw new TypeError(
+        `Server function error "${code}" status must be an integer between 400 and 599`
+      );
+    }
+    if (!definition.data || typeof definition.data.parse !== "function" && typeof definition.data.safeParse !== "function") {
+      throw new TypeError(
+        `Server function error "${code}" data must provide synchronous parse() or safeParse()`
+      );
+    }
+    if (definition.message !== void 0 && typeof definition.message !== "string") {
+      throw new TypeError(`Server function error "${code}" message must be a string`);
+    }
+    normalized[code] = Object.freeze({ ...definition });
+  }
+  return Object.freeze(normalized);
+}
+__name(normalizeServerFnErrors, "normalizeServerFnErrors");
+function createServerFnErrorHandler(definitions) {
+  return ((code, data) => {
+    const definition = definitions[code];
+    if (!definition) {
+      throw new TypeError(`Server function error "${code}" is not declared`);
+    }
+    const parsed = parseServerFnFailureData(code, definition.data, data);
+    throw new ServerFnFailure(code, parsed, {
+      status: definition.status,
+      message: definition.message ?? "Server function failed"
+    });
+  });
+}
+__name(createServerFnErrorHandler, "createServerFnErrorHandler");
+function parseServerFnFailureData(code, schema, value) {
+  if (typeof schema.safeParse === "function") {
+    const result2 = schema.safeParse(value);
+    if (isPromiseLike2(result2)) {
+      throw new TypeError(`Server function error "${code}" data schema must parse synchronously`);
+    }
+    return unwrapSafeParseResult(result2);
+  }
+  const result = schema.parse(value);
+  if (isPromiseLike2(result)) {
+    throw new TypeError(`Server function error "${code}" data schema must parse synchronously`);
+  }
+  return result;
+}
+__name(parseServerFnFailureData, "parseServerFnFailureData");
+function isPlainServerFnObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+__name(isPlainServerFnObject, "isPlainServerFnObject");
+function isPromiseLike2(value) {
+  return Boolean(
+    value && (typeof value === "object" || typeof value === "function") && "then" in value && typeof value.then === "function"
+  );
+}
+__name(isPromiseLike2, "isPromiseLike");
 function resolveServerFnMiddleware(middleware2) {
   const resolved = [];
   const seen = /* @__PURE__ */ new Set();
@@ -36441,6 +36924,7 @@ init_fonts();
 
 // src/route-runtime-manifest.ts
 var import_path10 = __toESM(require("path"));
+init_deployment();
 init_route_runtime();
 init_ssg();
 var FARM_ROUTE_RUNTIME_MANIFEST = "route-runtime-manifest.json";
@@ -36501,10 +36985,15 @@ async function writeFarmRouteRuntimeManifest(directory, manifest) {
 }
 __name(writeFarmRouteRuntimeManifest, "writeFarmRouteRuntimeManifest");
 function validateFarmRouteRuntimeDeployment(manifest, preset) {
-  const runtime = getPresetRuntime(preset);
+  const runtime = getFarmPresetRuntime(preset);
   const warnings = /* @__PURE__ */ new Set();
   for (const route2 of manifest.routes) {
     if (route2.rendering === "static") continue;
+    if (runtime === "unknown" && route2.runtime !== "auto") {
+      warnings.add(
+        `Preset "${preset}" has an unknown runtime, so Farm could not verify routes that explicitly require node or edge.`
+      );
+    }
     if (runtime !== "unknown" && route2.runtime !== "auto" && route2.runtime !== runtime) {
       throw new Error(
         `Route "${route2.pattern}" requires the ${route2.runtime} runtime, but preset "${preset}" emits ${runtime} functions. Choose a compatible preset or change the route runtime.`
@@ -36524,16 +37013,6 @@ function validateFarmRouteRuntimeDeployment(manifest, preset) {
   return { runtime, warnings: Array.from(warnings) };
 }
 __name(validateFarmRouteRuntimeDeployment, "validateFarmRouteRuntimeDeployment");
-function getPresetRuntime(preset) {
-  if (preset === "cloudflare" || preset === "cloudflare-pages" || preset === "cloudflare-module" || preset === "netlify-edge" || preset === "vercel-edge" || preset === "deno") {
-    return "edge";
-  }
-  if (preset === "node-server" || preset === "vercel" || preset === "netlify" || preset === "aws-lambda" || preset === "azure" || preset === "firebase" || preset === "bun") {
-    return "node";
-  }
-  return "unknown";
-}
-__name(getPresetRuntime, "getPresetRuntime");
 function normalizeManifestSource(root, modulePath) {
   const queryIndex = modulePath.indexOf("?");
   const filePath = queryIndex === -1 ? modulePath : modulePath.slice(0, queryIndex);
@@ -36803,6 +37282,7 @@ __name(withVite5TransformContext, "withVite5TransformContext");
 
 // src/nitro/universal-build.ts
 init_font_vite();
+init_vite_config();
 var import_meta = {};
 function preloadFarmNitroRuntime() {
   return import("nitro").then(
@@ -39196,9 +39676,7 @@ async function buildSSRInMemory(productionVite, config, root, routeManager, apiR
         postcss: postcssConfigDir
       } : void 0,
       resolve: {
-        alias: {
-          "@": import_path12.default.resolve(root, "src")
-        },
+        alias: createFarmSourceAlias(root, config.srcDir),
         // Programmatic route wrappers are created inside @farm.js/core. Resolve
         // their React imports from the application so React 18/19 elements and
         // the selected server renderer always share the same runtime instance.
@@ -42856,6 +43334,9 @@ async function createProjectModuleServer(createViteServer, config, root) {
         middlewareMode: true,
         hmr: false
       },
+      resolve: {
+        alias: createFarmSourceAlias(root, config.srcDir)
+      },
       optimizeDeps: {
         noDiscovery: true
       },
@@ -44526,6 +45007,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   FARM_DEVTOOLS_LAUNCH_PARAM,
   FARM_DEVTOOLS_PATH,
   FARM_INTEGRATION_INTERNAL_DISPATCH_CONTEXT_KEY,
+  FARM_SERVER_FN_FAILURE_SYMBOL,
   FARM_SERVER_FN_SYMBOL,
   FARM_SERVER_QUERY_SYMBOL,
   FarmClientPluginManager,
@@ -44548,7 +45030,10 @@ __name(decodeCookiePart, "decodeCookiePart");
   PluginManager,
   SPARouter,
   ScalarAPIDocumentation,
+  ServerActionError,
   ServerActionRequestError,
+  ServerFnFailure,
+  UnsupportedRateLimitStorageError,
   _parseServerFnSchema,
   _runWithAfterNodeResponse,
   _runWithAfterRequest,
@@ -44637,6 +45122,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   createServerAPIClient,
   createServerActionRequestErrorResponse,
   createServerFn,
+  createServerFnTransportError,
   createServerMiddleware,
   createServerOnlyFn,
   createServerQuery,
@@ -44690,6 +45176,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   getFarmDocsRouteTypeEntries,
   getFarmIntegrationPluginServerRuntime,
   getFarmLayerAliases,
+  getFarmPresetRuntime,
   getFarmRedirectError,
   getFarmRequestDeploymentId,
   getFarmResponseDeploymentId,
@@ -44753,6 +45240,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   isProgrammaticRouteManifest,
   isProgrammaticRoutesFileName,
   isSSGModule,
+  isServerFnFailure,
   isWebResponse,
   jsonStream,
   layout,
@@ -44770,6 +45258,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   matchRegisteredIntegrationRoute,
   matchRoute,
   matchSSGPage,
+  memoryRateLimitStorage,
   memoryStorage,
   mergeFarmRouteRuntimeConfigs,
   mergeScheduledTasks,