@farm.js/core 0.1.0-beta.14 → 0.1.0-beta.17

package/dist/chunk-UB5UOSHB.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/server-action-security.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { subscribeFarmCacheInvalidation, subscribeFarmCacheTask } from \"./cache-invalidation\";\n\nexport const DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1_000_000;\n\nexport interface FarmServerActionsConfig {\n  /** Additional trusted origins or host patterns, such as https://app.example.com. */\n  allowedOrigins?: readonly string[];\n  /** Maximum encoded request body size in bytes or as a size string such as \"1mb\". */\n  bodySizeLimit?: number | string;\n}\n\nexport interface ResolvedFarmServerActionsConfig {\n  allowedOrigins: readonly string[];\n  bodySizeLimit: number;\n}\n\nexport type ServerActionRequestKind = \"javascript\" | \"form\";\n\nexport interface PreparedServerActionRequest {\n  body: string | FormData;\n  contentType: string;\n}\n\nexport type SanitizedServerActionError = {\n  name: \"ServerActionError\";\n  message: \"Server function failed\";\n};\n\ntype ServerActionRequestErrorCode =\n  | \"BODY_TOO_LARGE\"\n  | \"INVALID_ACTION_ID\"\n  | \"INVALID_BODY\"\n  | \"INVALID_CONTENT_LENGTH\"\n  | \"INVALID_METHOD\"\n  | \"INVALID_ORIGIN\"\n  | \"MISSING_ORIGIN\"\n  | \"UNSUPPORTED_CONTENT_TYPE\";\n\nexport class ServerActionRequestError extends Error {\n  readonly code: ServerActionRequestErrorCode;\n  readonly status: number;\n\n  constructor(code: ServerActionRequestErrorCode, status: number, message: string) {\n    super(message);\n    this.name = \"ServerActionRequestError\";\n    this.code = code;\n    this.status = status;\n  }\n}\n\ntype ServerActionExecutionContext = {\n  request: Request;\n  signal: AbortSignal;\n  invalidations: Set<string>;\n  cacheTasks: Set<Promise<void>>;\n};\n\nconst SERVER_ACTION_STORAGE_KEY = Symbol.for(\"farm.serverActionStorage\");\nconst FALLBACK_ABORT_CONTROLLER_KEY = Symbol.for(\"farm.serverActionFallbackAbortController\");\nconst FORM_ACTION_CONTENT_TYPES = new Set([\n  \"application/x-www-form-urlencoded\",\n  \"multipart/form-data\",\n]);\nconst JAVASCRIPT_ACTION_CONTENT_TYPES = new Set([\n  \"application/octet-stream\",\n  \"application/x-www-form-urlencoded\",\n  \"multipart/form-data\",\n  \"text/plain\",\n]);\n\ntype GlobalWithServerActionStorage = typeof globalThis & {\n  [SERVER_ACTION_STORAGE_KEY]?: AsyncLocalStorage<ServerActionExecutionContext>;\n  [FALLBACK_ABORT_CONTROLLER_KEY]?: AbortController;\n};\n\nexport function resolveServerActionsConfig(\n  config: FarmServerActionsConfig | undefined,\n): ResolvedFarmServerActionsConfig {\n  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);\n  const bodySizeLimit = parseBodySizeLimit(\n    config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,\n  );\n\n  return Object.freeze({\n    allowedOrigins: Object.freeze(allowedOrigins),\n    bodySizeLimit,\n  });\n}\n\nexport function validateServerActionRequest(\n  request: Request,\n  config: ResolvedFarmServerActionsConfig,\n): void {\n  if (request.method.toUpperCase() !== \"POST\") {\n    throw new ServerActionRequestError(\n      \"INVALID_METHOD\",\n      405,\n      \"Server actions only accept POST requests\",\n    );\n  }\n\n  const requestUrl = new URL(request.url);\n  const sourceOrigin = getRequestSourceOrigin(request);\n  const fetchSite = request.headers.get(\"sec-fetch-site\")?.trim().toLowerCase();\n\n  if (!sourceOrigin) {\n    if (fetchSite !== \"same-origin\") {\n      throw new ServerActionRequestError(\n        \"MISSING_ORIGIN\",\n        403,\n        \"Server action request is missing same-origin metadata\",\n      );\n    }\n    return;\n  }\n\n  const matchesRequest =\n    sourceOrigin === requestUrl.origin || matchesHostHeader(sourceOrigin, request);\n  const matchesConfiguredOrigin = config.allowedOrigins.some((pattern) =>\n    matchesAllowedOrigin(sourceOrigin, pattern),\n  );\n\n  if (!matchesRequest && !matchesConfiguredOrigin) {\n    throw new ServerActionRequestError(\n      \"INVALID_ORIGIN\",\n      403,\n      \"Server action origin does not match the request origin\",\n    );\n  }\n\n  if (fetchSite === \"cross-site\" && !matchesConfiguredOrigin) {\n    throw new ServerActionRequestError(\n      \"INVALID_ORIGIN\",\n      403,\n      \"Cross-site server action request was rejected\",\n    );\n  }\n}\n\nexport async function prepareServerActionRequest(\n  request: Request,\n  config: ResolvedFarmServerActionsConfig,\n  kind: ServerActionRequestKind,\n  actionId?: string | null,\n): Promise<PreparedServerActionRequest> {\n  validateServerActionRequest(request, config);\n\n  if (kind === \"javascript\") {\n    validateActionId(actionId);\n  }\n\n  const contentType = getSupportedContentType(request, kind);\n  const bytes = await readBodyWithLimit(request, config.bodySizeLimit);\n\n  if (kind === \"form\" || contentType === \"multipart/form-data\") {\n    return {\n      body: await parseFormData(request, bytes),\n      contentType,\n    };\n  }\n\n  return {\n    body: new TextDecoder().decode(bytes),\n    contentType,\n  };\n}\n\nexport function createServerActionRequestErrorResponse(error: unknown): Response | null {\n  if (!(error instanceof ServerActionRequestError)) {\n    return null;\n  }\n\n  const headers = new Headers({\n    \"cache-control\": \"no-store\",\n    \"content-type\": \"text/plain; charset=utf-8\",\n    \"x-content-type-options\": \"nosniff\",\n  });\n  if (error.status === 405) {\n    headers.set(\"allow\", \"POST\");\n  }\n\n  return new Response(getPublicErrorMessage(error.status), {\n    status: error.status,\n    headers,\n  });\n}\n\nexport function sanitizeServerActionError(_error: unknown): SanitizedServerActionError {\n  return {\n    name: \"ServerActionError\",\n    message: \"Server function failed\",\n  };\n}\n\nexport async function runWithServerActionRequest<T>(\n  request: Request,\n  callback: () => T | Promise<T>,\n): Promise<T> {\n  throwIfAborted(request.signal);\n  const context: ServerActionExecutionContext = {\n    request,\n    signal: request.signal,\n    invalidations: new Set(),\n    cacheTasks: new Set(),\n  };\n\n  return getServerActionStorage().run(context, async () => {\n    try {\n      const result = await callback();\n      await Promise.all(context.cacheTasks);\n      return result;\n    } catch (error) {\n      await Promise.allSettled(context.cacheTasks);\n      throw error;\n    }\n  });\n}\n\nexport function getServerActionExecutionContext(): ServerActionExecutionContext | undefined {\n  return getServerActionStorage().getStore();\n}\n\nexport function getServerActionSignal(): AbortSignal {\n  return getServerActionExecutionContext()?.signal ?? getFallbackAbortController().signal;\n}\n\nexport function getServerActionInvalidations(): readonly string[] {\n  return Array.from(getServerActionExecutionContext()?.invalidations ?? []);\n}\n\nsubscribeFarmCacheInvalidation((key) => {\n  getServerActionExecutionContext()?.invalidations.add(key);\n});\n\nsubscribeFarmCacheTask((task) => {\n  getServerActionExecutionContext()?.cacheTasks.add(task);\n});\n\nfunction getServerActionStorage(): AsyncLocalStorage<ServerActionExecutionContext> {\n  const globalState = globalThis as GlobalWithServerActionStorage;\n  if (!globalState[SERVER_ACTION_STORAGE_KEY]) {\n    globalState[SERVER_ACTION_STORAGE_KEY] = new AsyncLocalStorage<ServerActionExecutionContext>();\n  }\n  return globalState[SERVER_ACTION_STORAGE_KEY]!;\n}\n\nfunction getFallbackAbortController(): AbortController {\n  const globalState = globalThis as GlobalWithServerActionStorage;\n  if (!globalState[FALLBACK_ABORT_CONTROLLER_KEY]) {\n    globalState[FALLBACK_ABORT_CONTROLLER_KEY] = new AbortController();\n  }\n  return globalState[FALLBACK_ABORT_CONTROLLER_KEY]!;\n}\n\nfunction parseBodySizeLimit(value: number | string): number {\n  if (typeof value === \"number\") {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new TypeError(\"serverActions.bodySizeLimit must be a positive safe integer\");\n    }\n    return value;\n  }\n\n  const match = value\n    .trim()\n    .toLowerCase()\n    .match(/^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb|kib|mib|gib)?$/);\n  if (!match) {\n    throw new TypeError(\n      'serverActions.bodySizeLimit must be bytes or a size string such as \"500kb\" or \"1mb\"',\n    );\n  }\n\n  const amount = Number(match[1]);\n  const unit = match[2] ?? \"b\";\n  const multiplier: Record<string, number> = {\n    b: 1,\n    kb: 1_000,\n    mb: 1_000_000,\n    gb: 1_000_000_000,\n    kib: 1_024,\n    mib: 1_048_576,\n    gib: 1_073_741_824,\n  };\n  const bytes = Math.floor(amount * multiplier[unit]);\n\n  if (!Number.isSafeInteger(bytes) || bytes <= 0) {\n    throw new TypeError(\"serverActions.bodySizeLimit must resolve to a positive safe integer\");\n  }\n\n  return bytes;\n}\n\nfunction normalizeAllowedOriginPattern(value: string): string {\n  const pattern = value.trim().toLowerCase();\n  if (!pattern) {\n    throw new TypeError(\"serverActions.allowedOrigins cannot contain empty values\");\n  }\n\n  if (pattern.includes(\"*\")) {\n    if (!/^(?:https?:\\/\\/)?\\*\\.[a-z0-9.-]+(?::\\d+)?$/.test(pattern)) {\n      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);\n    }\n    return pattern;\n  }\n\n  if (pattern.includes(\"://\")) {\n    let parsed: URL;\n    try {\n      parsed = new URL(pattern);\n    } catch {\n      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);\n    }\n\n    if (\n      (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n      parsed.username ||\n      parsed.password ||\n      parsed.pathname !== \"/\" ||\n      parsed.search ||\n      parsed.hash\n    ) {\n      throw new TypeError(\n        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`,\n      );\n    }\n    return parsed.origin;\n  }\n\n  if (/[/@?#]/.test(pattern)) {\n    throw new TypeError(\n      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`,\n    );\n  }\n\n  try {\n    return new URL(`http://${pattern}`).host;\n  } catch {\n    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);\n  }\n}\n\nfunction getRequestSourceOrigin(request: Request): string | null {\n  const origin = request.headers.get(\"origin\")?.trim();\n  if (origin) {\n    return parseSourceOrigin(origin);\n  }\n\n  const referer = request.headers.get(\"referer\")?.trim();\n  if (referer) {\n    return parseSourceOrigin(referer);\n  }\n\n  return null;\n}\n\nfunction parseSourceOrigin(value: string): string {\n  if (value === \"null\") {\n    throw new ServerActionRequestError(\"INVALID_ORIGIN\", 403, \"Opaque origins are not allowed\");\n  }\n\n  try {\n    const parsed = new URL(value);\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n      throw new Error(\"Unsupported protocol\");\n    }\n    return parsed.origin;\n  } catch {\n    throw new ServerActionRequestError(\"INVALID_ORIGIN\", 403, \"Invalid request origin\");\n  }\n}\n\nfunction matchesHostHeader(sourceOrigin: string, request: Request): boolean {\n  const host = request.headers.get(\"host\")?.trim().toLowerCase();\n  if (!host) return false;\n\n  try {\n    const source = new URL(sourceOrigin);\n    const target = new URL(request.url);\n    return source.protocol === target.protocol && source.host.toLowerCase() === host;\n  } catch {\n    return false;\n  }\n}\n\nfunction matchesAllowedOrigin(sourceOrigin: string, pattern: string): boolean {\n  const source = new URL(sourceOrigin);\n  if (!pattern.includes(\"*\")) {\n    return pattern.includes(\"://\") ? source.origin === pattern : source.host === pattern;\n  }\n\n  const schemeEnd = pattern.indexOf(\"://\");\n  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);\n  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);\n  const [wildcardHost, port] = splitHostAndPort(hostPattern);\n  const baseHost = wildcardHost.slice(2);\n\n  if (scheme && source.protocol !== scheme) return false;\n  if (port && getEffectivePort(source) !== port) return false;\n  if (!port && source.port) return false;\n\n  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;\n}\n\nfunction splitHostAndPort(value: string): [string, string | null] {\n  const separator = value.lastIndexOf(\":\");\n  if (separator === -1) return [value, null];\n  return [value.slice(0, separator), value.slice(separator + 1)];\n}\n\nfunction getEffectivePort(url: URL): string {\n  if (url.port) return url.port;\n  if (url.protocol === \"https:\") return \"443\";\n  if (url.protocol === \"http:\") return \"80\";\n  return \"\";\n}\n\nfunction validateActionId(actionId?: string | null): asserts actionId is string {\n  if (!actionId || actionId.length > 4096 || hasControlCharacters(actionId)) {\n    throw new ServerActionRequestError(\"INVALID_ACTION_ID\", 400, \"Invalid server action id\");\n  }\n}\n\nfunction hasControlCharacters(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code <= 31 || code === 127) return true;\n  }\n  return false;\n}\n\nfunction getSupportedContentType(request: Request, kind: ServerActionRequestKind): string {\n  const header = request.headers.get(\"content-type\")?.trim().toLowerCase();\n  const contentType = header?.split(\";\", 1)[0]?.trim() ?? \"\";\n  const supported = kind === \"form\" ? FORM_ACTION_CONTENT_TYPES : JAVASCRIPT_ACTION_CONTENT_TYPES;\n\n  if (!supported.has(contentType)) {\n    throw new ServerActionRequestError(\n      \"UNSUPPORTED_CONTENT_TYPE\",\n      415,\n      \"Unsupported server action content type\",\n    );\n  }\n\n  return contentType;\n}\n\nasync function readBodyWithLimit(request: Request, limit: number): Promise<Uint8Array> {\n  const contentLength = request.headers.get(\"content-length\")?.trim();\n  if (contentLength) {\n    if (!/^\\d+$/.test(contentLength)) {\n      throw new ServerActionRequestError(\n        \"INVALID_CONTENT_LENGTH\",\n        400,\n        \"Invalid content-length header\",\n      );\n    }\n    if (Number(contentLength) > limit) {\n      throw new ServerActionRequestError(\"BODY_TOO_LARGE\", 413, \"Server action body is too large\");\n    }\n  }\n\n  throwIfAborted(request.signal);\n  if (!request.body) return new Uint8Array();\n\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  const cancelBodyRead = () => {\n    void reader.cancel(request.signal.reason).catch(() => {});\n  };\n\n  request.signal.addEventListener(\"abort\", cancelBodyRead, { once: true });\n\n  try {\n    while (true) {\n      throwIfAborted(request.signal);\n      const { done, value } = await reader.read();\n      if (done) break;\n      if (!value) continue;\n\n      total += value.byteLength;\n      if (total > limit) {\n        await reader.cancel(\"Server action body is too large\");\n        throw new ServerActionRequestError(\n          \"BODY_TOO_LARGE\",\n          413,\n          \"Server action body is too large\",\n        );\n      }\n      chunks.push(value);\n    }\n  } catch (error) {\n    if (request.signal.aborted) throwIfAborted(request.signal);\n    throw error;\n  } finally {\n    request.signal.removeEventListener(\"abort\", cancelBodyRead);\n    reader.releaseLock();\n  }\n\n  throwIfAborted(request.signal);\n  const body = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body;\n}\n\nasync function parseFormData(request: Request, bytes: Uint8Array): Promise<FormData> {\n  const body = new ArrayBuffer(bytes.byteLength);\n  new Uint8Array(body).set(bytes);\n  const copy = new Request(request.url, {\n    method: \"POST\",\n    headers: request.headers,\n    body,\n  });\n\n  try {\n    return await copy.formData();\n  } catch {\n    throw new ServerActionRequestError(\"INVALID_BODY\", 400, \"Invalid server action form body\");\n  }\n}\n\nfunction getPublicErrorMessage(status: number): string {\n  switch (status) {\n    case 400:\n      return \"Bad Request\";\n    case 403:\n      return \"Forbidden\";\n    case 405:\n      return \"Method Not Allowed\";\n    case 413:\n      return \"Payload Too Large\";\n    case 415:\n      return \"Unsupported Media Type\";\n    default:\n      return \"Server Action Request Failed\";\n  }\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (!signal.aborted) return;\n  if (signal.reason !== undefined) throw signal.reason;\n  throw new DOMException(\"The operation was aborted\", \"AbortError\");\n}\n"],"mappings":";;;;;;;;;AAAA,SAAS,yBAAyB;AAG3B,IAAM,wCAAwC;AAoC9C,IAAM,4BAAN,MAAM,kCAAiC,MAAM;AAAA,EAIlD,YAAY,MAAoC,QAAgB,SAAiB;AAC/E,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAVoD;AAA7C,IAAM,2BAAN;AAmBP,IAAM,4BAA4B,uBAAO,IAAI,0BAA0B;AACvE,IAAM,gCAAgC,uBAAO,IAAI,0CAA0C;AAC3F,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AACF,CAAC;AACD,IAAM,kCAAkC,oBAAI,IAAI;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,SAAS,2BACd,QACiC;AACjC,QAAM,kBAAkB,QAAQ,kBAAkB,CAAC,GAAG,IAAI,6BAA6B;AACvF,QAAM,gBAAgB;AAAA,IACpB,QAAQ,iBAAiB;AAAA,EAC3B;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,gBAAgB,OAAO,OAAO,cAAc;AAAA,IAC5C;AAAA,EACF,CAAC;AACH;AAZgB;AAcT,SAAS,4BACd,SACA,QACM;AACN,MAAI,QAAQ,OAAO,YAAY,MAAM,QAAQ;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AACtC,QAAM,eAAe,uBAAuB,OAAO;AACnD,QAAM,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK,EAAE,YAAY;AAE5E,MAAI,CAAC,cAAc;AACjB,QAAI,cAAc,eAAe;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAEA,QAAM,iBACJ,iBAAiB,WAAW,UAAU,kBAAkB,cAAc,OAAO;AAC/E,QAAM,0BAA0B,OAAO,eAAe;AAAA,IAAK,CAAC,YAC1D,qBAAqB,cAAc,OAAO;AAAA,EAC5C;AAEA,MAAI,CAAC,kBAAkB,CAAC,yBAAyB;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,cAAc,gBAAgB,CAAC,yBAAyB;AAC1D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;AAkDhB,eAAsB,2BACpB,SACA,QACA,MACA,UACsC;AACtC,8BAA4B,SAAS,MAAM;AAE3C,MAAI,SAAS,cAAc;AACzB,qBAAiB,QAAQ;AAAA,EAC3B;AAEA,QAAM,cAAc,wBAAwB,SAAS,IAAI;AACzD,QAAM,QAAQ,MAAM,kBAAkB,SAAS,OAAO,aAAa;AAEnE,MAAI,SAAS,UAAU,gBAAgB,uBAAuB;AAC5D,WAAO;AAAA,MACL,MAAM,MAAM,cAAc,SAAS,KAAK;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IACpC;AAAA,EACF;AACF;AA1BsB;AA4Bf,SAAS,uCAAuC,OAAiC;AACtF,MAAI,EAAE,iBAAiB,2BAA2B;AAChD,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,iBAAiB;AAAA,IACjB,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,CAAC;AACD,MAAI,MAAM,WAAW,KAAK;AACxB,YAAQ,IAAI,SAAS,MAAM;AAAA,EAC7B;AAEA,SAAO,IAAI,SAAS,sBAAsB,MAAM,MAAM,GAAG;AAAA,IACvD,QAAQ,MAAM;AAAA,IACd;AAAA,EACF,CAAC;AACH;AAlBgB;AAoBT,SAAS,0BAA0B,QAA6C;AACrF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AALgB;AAOhB,eAAsB,2BACpB,SACA,UACY;AACZ,iBAAe,QAAQ,MAAM;AAC7B,QAAM,UAAwC;AAAA,IAC5C;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB,eAAe,oBAAI,IAAI;AAAA,IACvB,YAAY,oBAAI,IAAI;AAAA,EACtB;AAEA,SAAO,uBAAuB,EAAE,IAAI,SAAS,YAAY;AACvD,QAAI;AACF,YAAM,SAAS,MAAM,SAAS;AAC9B,YAAM,QAAQ,IAAI,QAAQ,UAAU;AACpC,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,QAAQ,WAAW,QAAQ,UAAU;AAC3C,YAAM;AAAA,IACR;AAAA,EACF,CAAC;AACH;AAtBsB;AAwBf,SAAS,kCAA4E;AAC1F,SAAO,uBAAuB,EAAE,SAAS;AAC3C;AAFgB;AAIT,SAAS,wBAAqC;AACnD,SAAO,gCAAgC,GAAG,UAAU,2BAA2B,EAAE;AACnF;AAFgB;AAIT,SAAS,+BAAkD;AAChE,SAAO,MAAM,KAAK,gCAAgC,GAAG,iBAAiB,CAAC,CAAC;AAC1E;AAFgB;AAIhB,+BAA+B,CAAC,QAAQ;AACtC,kCAAgC,GAAG,cAAc,IAAI,GAAG;AAC1D,CAAC;AAED,uBAAuB,CAAC,SAAS;AAC/B,kCAAgC,GAAG,WAAW,IAAI,IAAI;AACxD,CAAC;AAED,SAAS,yBAA0E;AACjF,QAAM,cAAc;AACpB,MAAI,CAAC,YAAY,yBAAyB,GAAG;AAC3C,gBAAY,yBAAyB,IAAI,IAAI,kBAAgD;AAAA,EAC/F;AACA,SAAO,YAAY,yBAAyB;AAC9C;AANS;AAQT,SAAS,6BAA8C;AACrD,QAAM,cAAc;AACpB,MAAI,CAAC,YAAY,6BAA6B,GAAG;AAC/C,gBAAY,6BAA6B,IAAI,IAAI,gBAAgB;AAAA,EACnE;AACA,SAAO,YAAY,6BAA6B;AAClD;AANS;AAQT,SAAS,mBAAmB,OAAgC;AAC1D,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,YAAM,IAAI,UAAU,6DAA6D;AAAA,IACnF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MACX,KAAK,EACL,YAAY,EACZ,MAAM,+CAA+C;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,OAAO,MAAM,CAAC,KAAK;AACzB,QAAM,aAAqC;AAAA,IACzC,GAAG;AAAA,IACH,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACA,QAAM,QAAQ,KAAK,MAAM,SAAS,WAAW,IAAI,CAAC;AAElD,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,UAAM,IAAI,UAAU,qEAAqE;AAAA,EAC3F;AAEA,SAAO;AACT;AApCS;AAsCT,SAAS,8BAA8B,OAAuB;AAC5D,QAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,UAAU,0DAA0D;AAAA,EAChF;AAEA,MAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,QAAI,CAAC,6CAA6C,KAAK,OAAO,GAAG;AAC/D,YAAM,IAAI,UAAU,iDAAiD,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC9F;AACA,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,SAAS,KAAK,GAAG;AAC3B,QAAI;AACJ,QAAI;AACF,eAAS,IAAI,IAAI,OAAO;AAAA,IAC1B,QAAQ;AACN,YAAM,IAAI,UAAU,+CAA+C,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC5F;AAEA,QACG,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,OAAO,YACP,OAAO,YACP,OAAO,aAAa,OACpB,OAAO,UACP,OAAO,MACP;AACA,YAAM,IAAI;AAAA,QACR,oEAAoE,KAAK,UAAU,KAAK,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,SAAS,KAAK,OAAO,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,+DAA+D,KAAK,UAAU,KAAK,CAAC;AAAA,IACtF;AAAA,EACF;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,OAAO,EAAE,EAAE;AAAA,EACtC,QAAQ;AACN,UAAM,IAAI,UAAU,+CAA+C,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EAC5F;AACF;AA/CS;AAiDT,SAAS,uBAAuB,SAAiC;AAC/D,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ,GAAG,KAAK;AACnD,MAAI,QAAQ;AACV,WAAO,kBAAkB,MAAM;AAAA,EACjC;AAEA,QAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS,GAAG,KAAK;AACrD,MAAI,SAAS;AACX,WAAO,kBAAkB,OAAO;AAAA,EAClC;AAEA,SAAO;AACT;AAZS;AAcT,SAAS,kBAAkB,OAAuB;AAChD,MAAI,UAAU,QAAQ;AACpB,UAAM,IAAI,yBAAyB,kBAAkB,KAAK,gCAAgC;AAAA,EAC5F;AAEA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AACA,WAAO,OAAO;AAAA,EAChB,QAAQ;AACN,UAAM,IAAI,yBAAyB,kBAAkB,KAAK,wBAAwB;AAAA,EACpF;AACF;AAdS;AAgBT,SAAS,kBAAkB,cAAsB,SAA2B;AAC1E,QAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM,GAAG,KAAK,EAAE,YAAY;AAC7D,MAAI,CAAC,KAAM,QAAO;AAElB,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,YAAY;AACnC,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;AAClC,WAAO,OAAO,aAAa,OAAO,YAAY,OAAO,KAAK,YAAY,MAAM;AAAA,EAC9E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAXS;AAaT,SAAS,qBAAqB,cAAsB,SAA0B;AAC5E,QAAM,SAAS,IAAI,IAAI,YAAY;AACnC,MAAI,CAAC,QAAQ,SAAS,GAAG,GAAG;AAC1B,WAAO,QAAQ,SAAS,KAAK,IAAI,OAAO,WAAW,UAAU,OAAO,SAAS;AAAA,EAC/E;AAEA,QAAM,YAAY,QAAQ,QAAQ,KAAK;AACvC,QAAM,SAAS,cAAc,KAAK,OAAO,QAAQ,MAAM,GAAG,YAAY,CAAC;AACvE,QAAM,cAAc,QAAQ,MAAM,cAAc,KAAK,IAAI,YAAY,CAAC;AACtE,QAAM,CAAC,cAAc,IAAI,IAAI,iBAAiB,WAAW;AACzD,QAAM,WAAW,aAAa,MAAM,CAAC;AAErC,MAAI,UAAU,OAAO,aAAa,OAAQ,QAAO;AACjD,MAAI,QAAQ,iBAAiB,MAAM,MAAM,KAAM,QAAO;AACtD,MAAI,CAAC,QAAQ,OAAO,KAAM,QAAO;AAEjC,SAAO,OAAO,SAAS,SAAS,IAAI,QAAQ,EAAE,KAAK,OAAO,aAAa;AACzE;AAjBS;AAmBT,SAAS,iBAAiB,OAAwC;AAChE,QAAM,YAAY,MAAM,YAAY,GAAG;AACvC,MAAI,cAAc,GAAI,QAAO,CAAC,OAAO,IAAI;AACzC,SAAO,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,MAAM,MAAM,YAAY,CAAC,CAAC;AAC/D;AAJS;AAMT,SAAS,iBAAiB,KAAkB;AAC1C,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AALS;AAOT,SAAS,iBAAiB,UAAsD;AAC9E,MAAI,CAAC,YAAY,SAAS,SAAS,QAAQ,qBAAqB,QAAQ,GAAG;AACzE,UAAM,IAAI,yBAAyB,qBAAqB,KAAK,0BAA0B;AAAA,EACzF;AACF;AAJS;AAMT,SAAS,qBAAqB,OAAwB;AACpD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,MAAM,SAAS,IAAK,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AANS;AAQT,SAAS,wBAAwB,SAAkB,MAAuC;AACxF,QAAM,SAAS,QAAQ,QAAQ,IAAI,cAAc,GAAG,KAAK,EAAE,YAAY;AACvE,QAAM,cAAc,QAAQ,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,KAAK;AACxD,QAAM,YAAY,SAAS,SAAS,4BAA4B;AAEhE,MAAI,CAAC,UAAU,IAAI,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAdS;AAgBT,eAAe,kBAAkB,SAAkB,OAAoC;AACrF,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK;AAClE,MAAI,eAAe;AACjB,QAAI,CAAC,QAAQ,KAAK,aAAa,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAa,IAAI,OAAO;AACjC,YAAM,IAAI,yBAAyB,kBAAkB,KAAK,iCAAiC;AAAA,IAC7F;AAAA,EACF;AAEA,iBAAe,QAAQ,MAAM;AAC7B,MAAI,CAAC,QAAQ,KAAM,QAAO,IAAI,WAAW;AAEzC,QAAM,SAAS,QAAQ,KAAK,UAAU;AACtC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,QAAM,iBAAiB,6BAAM;AAC3B,SAAK,OAAO,OAAO,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC1D,GAFuB;AAIvB,UAAQ,OAAO,iBAAiB,SAAS,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAEvE,MAAI;AACF,WAAO,MAAM;AACX,qBAAe,QAAQ,MAAM;AAC7B,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,UAAI,CAAC,MAAO;AAEZ,eAAS,MAAM;AACf,UAAI,QAAQ,OAAO;AACjB,cAAM,OAAO,OAAO,iCAAiC;AACrD,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAS,gBAAe,QAAQ,MAAM;AACzD,UAAM;AAAA,EACR,UAAE;AACA,YAAQ,OAAO,oBAAoB,SAAS,cAAc;AAC1D,WAAO,YAAY;AAAA,EACrB;AAEA,iBAAe,QAAQ,MAAM;AAC7B,QAAM,OAAO,IAAI,WAAW,KAAK;AACjC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AA7De;AA+Df,eAAe,cAAc,SAAkB,OAAsC;AACnF,QAAM,OAAO,IAAI,YAAY,MAAM,UAAU;AAC7C,MAAI,WAAW,IAAI,EAAE,IAAI,KAAK;AAC9B,QAAM,OAAO,IAAI,QAAQ,QAAQ,KAAK;AAAA,IACpC,QAAQ;AAAA,IACR,SAAS,QAAQ;AAAA,IACjB;AAAA,EACF,CAAC;AAED,MAAI;AACF,WAAO,MAAM,KAAK,SAAS;AAAA,EAC7B,QAAQ;AACN,UAAM,IAAI,yBAAyB,gBAAgB,KAAK,iCAAiC;AAAA,EAC3F;AACF;AAde;AAgBf,SAAS,sBAAsB,QAAwB;AACrD,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAfS;AAiBT,SAAS,eAAe,QAA2B;AACjD,MAAI,CAAC,OAAO,QAAS;AACrB,MAAI,OAAO,WAAW,OAAW,OAAM,OAAO;AAC9C,QAAM,IAAI,aAAa,6BAA6B,YAAY;AAClE;AAJS;","names":[]}

package/dist/chunk-UXUAWNO5.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/middleware/chain.ts","../src/middleware/helpers.ts","../src/middleware/vite-plugin.ts"],"sourcesContent":["/**\n * Middleware Chain Builder\n */\n\nimport type {\n  MiddlewareChain,\n  MiddlewareFunction,\n  MiddlewareContext,\n  MiddlewareConfig,\n  RateLimitConfig,\n  RateLimitStorage,\n  RateLimitStatus,\n  MiddlewareResult,\n} from \"./types\";\nimport { getStorage } from \"../storage\";\nimport type { Storage } from \"unstorage\";\n\ninterface RateLimitRecord {\n  count: number;\n  resetAt: number;\n}\n\nfunction getRateLimitStorage(): Storage {\n  return getStorage(\"ratelimit\");\n}\n\nconst defaultRateLimitStorage: RateLimitStorage = {\n  async get(key: string) {\n    const storage = getRateLimitStorage();\n    const value = await storage.getItem<RateLimitRecord>(key);\n    return value ?? null;\n  },\n  async set(key: string, value: any, ttl?: number) {\n    const storage = getRateLimitStorage();\n    await storage.setItem(key, value, ttl ? { ttl } : undefined);\n  },\n  async delete(key: string) {\n    const storage = getRateLimitStorage();\n    await storage.removeItem(key);\n  },\n  async ttl(key: string) {\n    const storage = getRateLimitStorage();\n    const record = await storage.getItem<RateLimitRecord>(key);\n    if (!record || !record.resetAt) {\n      return null;\n    }\n    const remainingMs = record.resetAt - Date.now();\n    return remainingMs > 0 ? Math.ceil(remainingMs / 1000) : null;\n  },\n};\n\nfunction parseTimeWindow(window: string): number {\n  const match = window.match(/^(\\d+)(ms|s|m|h|d)$/);\n  if (!match) throw new Error(`Invalid time window: ${window}`);\n\n  const [, amount, unit] = match;\n  const value = Number.parseInt(amount, 10);\n\n  const multipliers: Record<string, number> = {\n    ms: 1,\n    s: 1000,\n    m: 60 * 1000,\n    h: 60 * 60 * 1000,\n    d: 24 * 60 * 60 * 1000,\n  };\n\n  return value * multipliers[unit];\n}\n\nfunction createRateLimitMiddleware(config: RateLimitConfig): MiddlewareFunction {\n  const windowMs = parseTimeWindow(config.window);\n  const storage = config.storage || defaultRateLimitStorage;\n\n  return async (ctx: MiddlewareContext, next) => {\n    const key = config.keyGenerator\n      ? config.keyGenerator(ctx)\n      : `${ctx.request.socket.remoteAddress}:${ctx.pathname}`;\n\n    const now = Date.now();\n    const ttlSeconds = Math.ceil(windowMs / 1000);\n    const record = await storage.get(key);\n\n    if (record && now > record.resetAt) {\n      await storage.delete(key);\n    }\n\n    const current = await storage.get(key);\n\n    if (!current) {\n      await storage.set(\n        key,\n        {\n          count: 1,\n          resetAt: now + windowMs,\n        },\n        ttlSeconds,\n      );\n      return next();\n    }\n\n    if (current.count >= config.requests) {\n      if (config.onLimit) {\n        const result = await config.onLimit(ctx);\n        if (result) return;\n      }\n\n      ctx.json(\n        {\n          error: \"Rate limit exceeded\",\n          retryAfter: Math.ceil((current.resetAt - now) / 1000),\n        },\n        429,\n      );\n      return;\n    }\n\n    current.count++;\n    await storage.set(key, current, ttlSeconds);\n    return next();\n  };\n}\n\nfunction matchPattern(pattern: string | RegExp, pathname: string): boolean {\n  if (pattern instanceof RegExp) {\n    return pattern.test(pathname);\n  }\n\n  const regexPattern = pattern\n    .replace(/\\*\\*/g, \"__DOUBLE_STAR__\")\n    .replace(/\\*/g, \"[^/]+\")\n    .replace(/__DOUBLE_STAR__/g, \".*\")\n    .replace(/\\//g, \"\\\\/\");\n\n  const regex = new RegExp(`^${regexPattern}$`);\n  return regex.test(pathname);\n}\n\nclass MiddlewareChainImpl implements MiddlewareChain {\n  private handlers: MiddlewareFunction[] = [];\n  public config?: MiddlewareConfig;\n  private basePath: string;\n\n  constructor(basePath = \"/\") {\n    this.basePath =\n      basePath === \"/\" ? \"/\" : basePath.endsWith(\"/\") ? basePath.slice(0, -1) : basePath;\n  }\n\n  /**\n   * Set the base path for this middleware chain (called by manager when loading)\n   */\n  setBasePath(path: string): void {\n    this.basePath = path === \"/\" ? \"/\" : path.endsWith(\"/\") ? path.slice(0, -1) : path;\n  }\n\n  use(fn: MiddlewareFunction): MiddlewareChain {\n    this.handlers.push(fn);\n    return this;\n  }\n\n  /**\n   * Normalize a path pattern - auto-scope to middleware route\n   * If middleware is in /contact, then \"/api\" becomes \"/contact/api\"\n   */\n  private normalizePattern(pattern: string): string {\n    // If we're at root middleware, use pattern as-is\n    if (this.basePath === \"/\") {\n      // Ensure it starts with /\n      return pattern.startsWith(\"/\") ? pattern : `/${pattern}`;\n    }\n\n    // For route-specific middleware, always scope the pattern\n    // Remove leading / from pattern if present, then join with basePath\n    const cleanPattern = pattern.startsWith(\"/\") ? pattern.slice(1) : pattern;\n    return `${this.basePath}/${cleanPattern}`;\n  }\n\n  /**\n   * Conditionally run middleware based on a condition.\n   * Only supports boolean values or functions that evaluate to boolean.\n   * Route-based string matching has been removed - use function conditions instead.\n   *\n   * @example\n   * .when(true, (ctx, next) => { ... })  // Always run\n   * .when((ctx) => ctx.data.get('flag'), (ctx, next) => { ... })  // Conditional\n   * .when((ctx) => ctx.pathname === '/contact', (ctx, next) => { ... })  // Path-based condition\n   */\n  when(\n    condition: boolean | ((ctx: MiddlewareContext) => boolean),\n    fn: MiddlewareFunction | ((chain: MiddlewareChain) => void),\n  ): MiddlewareChain {\n    const conditionalMiddleware: MiddlewareFunction = async (ctx, next) => {\n      // Evaluate condition - boolean or function\n      const shouldRun = typeof condition === \"function\" ? condition(ctx) : condition;\n\n      if (!shouldRun) {\n        return next();\n      }\n\n      if (typeof fn === \"function\" && fn.length === 2) {\n        return (fn as MiddlewareFunction)(ctx, next);\n      } else {\n        const subChain = middleware(this.basePath);\n        (fn as (chain: MiddlewareChain) => void)(subChain);\n        const { handlers } = subChain.build();\n\n        let index = 0;\n        let returnedResponse: Response | undefined;\n        const executeNext = async (): Promise<MiddlewareResult> => {\n          if (index < handlers.length) {\n            const handler = handlers[index++];\n            const result = await handler(ctx, executeNext);\n            if (result instanceof Response) {\n              returnedResponse = result;\n              return result;\n            }\n          } else {\n            const result = await next();\n            if (result instanceof Response) {\n              returnedResponse = result;\n              return result;\n            }\n          }\n          return returnedResponse;\n        };\n\n        return executeNext();\n      }\n    };\n    this.handlers.push(conditionalMiddleware);\n    return this;\n  }\n\n  rateLimit(config: RateLimitConfig): MiddlewareChain {\n    this.handlers.push(createRateLimitMiddleware(config));\n    return this;\n  }\n\n  redirect(source: string, destination: string, permanent = false): MiddlewareChain {\n    const redirectMiddleware: MiddlewareFunction = async (ctx, next) => {\n      // Auto-scope source pattern to the middleware route\n      const normalizedSource = this.normalizePattern(source);\n      if (matchPattern(normalizedSource, ctx.pathname)) {\n        ctx.redirect(destination, permanent ? 308 : 307);\n        return;\n      }\n      return next();\n    };\n\n    this.handlers.push(redirectMiddleware);\n    return this;\n  }\n\n  /**\n   * Rewrite the current middleware route to a new destination.\n   * Since each middleware file is route-specific, the source is automatically\n   * the middleware's route, so you only need to specify the destination.\n   *\n   * @param destination - The destination path to rewrite to\n   * @param condition - Optional boolean or function that evaluates to boolean.\n   *                    If provided and evaluates to false, rewrite is skipped.\n   *                    If not provided, rewrite always happens.\n   *\n   * @example\n   * // In /contact/middleware.ts\n   * .rewrite('/about')  // Always rewrites /contact to /about\n   * .rewrite('/about', true)  // Always rewrites\n   * .rewrite('/about', false)  // Never rewrites\n   * .rewrite('/about', (ctx) => ctx.data.get('shouldRewrite'))  // Conditional rewrite\n   */\n  rewrite(\n    destination: string,\n    condition?: boolean | ((ctx: MiddlewareContext) => boolean),\n  ): MiddlewareChain {\n    const rewriteMiddleware: MiddlewareFunction = async (ctx, next) => {\n      // Check condition if provided\n      if (condition !== undefined) {\n        const shouldRewrite = typeof condition === \"function\" ? condition(ctx) : condition;\n        if (!shouldRewrite) {\n          return next();\n        }\n      }\n\n      // If this middleware is route-specific (not root)\n      if (this.basePath !== \"/\") {\n        // Rewrite when the pathname exactly matches this middleware's route\n        // This rewrites the entire route (e.g., /contact -> /about)\n        if (ctx.pathname === this.basePath) {\n          ctx.rewrite(destination);\n        }\n        // Also handle sub-routes: rewrite /contact/something to /destination/something\n        else if (ctx.pathname.startsWith(this.basePath + \"/\")) {\n          const subPath = ctx.pathname.slice(this.basePath.length);\n          const newPath = destination + subPath;\n          ctx.rewrite(newPath);\n        }\n      } else {\n        // For root middleware, this is less common\n        // Only rewrite if pathname matches exactly (edge case)\n        ctx.rewrite(destination);\n      }\n      return next();\n    };\n\n    this.handlers.push(rewriteMiddleware);\n    return this;\n  }\n\n  build() {\n    return {\n      handlers: this.handlers,\n      config: this.config,\n    };\n  }\n}\n\n/**\n * Get rate limit status for a key\n * @example\n * const status = await getRateLimitStatus('user:123', 100, storage);\n */\nexport async function getRateLimitStatus(\n  key: string,\n  limit: number,\n  storage: RateLimitStorage = defaultRateLimitStorage,\n): Promise<RateLimitStatus> {\n  const record = await storage.get(key);\n\n  if (!record) {\n    return {\n      requests: 0,\n      limit,\n      remaining: limit,\n      resetIn: null,\n      resetAt: null,\n      isLimited: false,\n    };\n  }\n\n  const now = Date.now();\n\n  if (record.resetAt && now > record.resetAt) {\n    return {\n      requests: 0,\n      limit,\n      remaining: limit,\n      resetIn: null,\n      resetAt: null,\n      isLimited: false,\n    };\n  }\n\n  const requests = record.count || 0;\n  const remaining = Math.max(0, limit - requests);\n  const isLimited = requests >= limit;\n\n  let resetIn: number | null = null;\n  let resetAt: Date | null = null;\n\n  if (record.resetAt) {\n    const remainingMs = record.resetAt - now;\n    resetIn = remainingMs > 0 ? Math.ceil(remainingMs / 1000) : null;\n    resetAt = new Date(record.resetAt);\n  } else if (storage.ttl) {\n    resetIn = await storage.ttl(key);\n    resetAt = resetIn ? new Date(now + resetIn * 1000) : null;\n  }\n\n  return {\n    requests,\n    limit,\n    remaining,\n    resetIn,\n    resetAt,\n    isLimited,\n  };\n}\n\nexport function middleware(basePath = \"/\"): MiddlewareChain {\n  return new MiddlewareChainImpl(basePath);\n}\n","/**\n * Middleware helper utilities for pages\n */\n\nimport type { MiddlewareProps } from \"../types\";\n\n/**\n * Unwrap middleware data from PageProps\n *\n * @example\n * ```tsx\n * export default async function Page(props: PageProps) {\n *   const { user, stats } = await unwrapMiddleware(props.middleware, {\n *     user: null,\n *     stats: { views: 0, clicks: 0 }\n *   });\n *\n *   return <div>Welcome {user?.name}</div>;\n * }\n * ```\n */\nexport function unwrapMiddleware<T extends Record<string, any>>(\n  middleware: MiddlewareProps | undefined,\n  defaults?: Partial<T>,\n): Partial<T> {\n  if (!middleware) {\n    return (defaults || {}) as Partial<T>;\n  }\n\n  const result: any = { ...defaults };\n\n  for (const [key, value] of middleware.data) {\n    result[key] = value;\n  }\n\n  return result as Partial<T>;\n}\n\n/**\n * Get a single value from middleware with a default\n *\n * @example\n * ```tsx\n * export default async function Page(props: PageProps) {\n *   const user = await getMiddlewareValue(props.middleware, 'user', null);\n *   return <div>Welcome {user?.name || 'Guest'}</div>;\n * }\n * ```\n */\nexport function getFromMiddleware<T = any>(\n  middleware: MiddlewareProps | undefined,\n  key: string,\n  defaultValue?: T,\n): T | undefined {\n  if (!middleware) {\n    return defaultValue;\n  }\n\n  const value = middleware.data.get(key);\n  return value !== undefined ? value : defaultValue;\n}\n\n/**\n * Check if middleware data exists\n */\nexport function hasMiddlewareData(middleware: MiddlewareProps | undefined): boolean {\n  if (!middleware) return false;\n  return middleware.data.size > 0;\n}\n","/**\n * Standalone Vite middleware support used by Farm's RSC and API plugins.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { Plugin, ViteDevServer } from \"vite\";\nimport { MiddlewareManager } from \"./manager\";\n\nexport interface FarmMiddlewarePluginOptions {\n  /** Source directory (default: `src`). */\n  srcDir?: string;\n  /** Enable debug logging. */\n  debug?: boolean;\n}\n\nfunction getMiddlewareAppDirectory(root: string, srcDir: string): string {\n  const sourceDirectory = path.join(root, srcDir);\n  const appDirectory = path.join(sourceDirectory, \"app\");\n  return fs.existsSync(appDirectory) ? appDirectory : sourceDirectory;\n}\n\nexport function farmMiddlewarePlugin(options: FarmMiddlewarePluginOptions = {}): Plugin {\n  const srcDir = options.srcDir ?? \"src\";\n  let manager: MiddlewareManager | null = null;\n  let discoveryComplete = false;\n  let discoveryPromise: Promise<void> | null = null;\n\n  const discover = async (server: ViteDevServer): Promise<void> => {\n    manager = new MiddlewareManager(getMiddlewareAppDirectory(server.config.root, srcDir), server);\n    await manager.discover();\n    discoveryComplete = true;\n  };\n\n  return {\n    name: \"@farm.js/core:middleware\",\n    enforce: \"pre\",\n\n    configureServer(server) {\n      discoveryPromise = discover(server).catch((error) => {\n        discoveryComplete = true;\n        console.error(\"[FARM] Middleware discovery error:\", error);\n      });\n\n      const execute = async (\n        req: IncomingMessage,\n        res: ServerResponse,\n        _pathname?: string,\n        sharedData?: Map<string, any>,\n      ): Promise<boolean> => {\n        if (discoveryPromise && !discoveryComplete) {\n          await discoveryPromise;\n        }\n\n        if (!manager) {\n          return false;\n        }\n\n        const handled = await manager.execute(req, res);\n        const middlewareData = (req as any).__FARM_MIDDLEWARE_DATA__;\n        if (sharedData && middlewareData instanceof Map) {\n          for (const [key, value] of middlewareData) {\n            sharedData.set(key, value);\n          }\n        }\n        return handled;\n      };\n\n      (server as any).__farmMiddleware__ = {\n        execute,\n        getMiddlewares: () => manager?.getMiddlewares() ?? [],\n        isReady: () => discoveryComplete,\n        waitForDiscovery: () => discoveryPromise,\n      };\n    },\n\n    async handleHotUpdate({ file, server, modules }) {\n      if (!/^middleware\\.[tj]sx?$/.test(path.basename(file))) {\n        return;\n      }\n\n      for (const module of modules) {\n        server.moduleGraph.invalidateModule(module);\n      }\n\n      await manager?.reload();\n      server.ws.send({ type: \"full-reload\", path: \"*\" });\n      return [];\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;AAsBA,SAAS,sBAA+B;AACtC,SAAO,WAAW,WAAW;AAC/B;AAFS;AAIT,IAAM,0BAA4C;AAAA,EAChD,MAAM,IAAI,KAAa;AACrB,UAAM,UAAU,oBAAoB;AACpC,UAAM,QAAQ,MAAM,QAAQ,QAAyB,GAAG;AACxD,WAAO,SAAS;AAAA,EAClB;AAAA,EACA,MAAM,IAAI,KAAa,OAAY,KAAc;AAC/C,UAAM,UAAU,oBAAoB;AACpC,UAAM,QAAQ,QAAQ,KAAK,OAAO,MAAM,EAAE,IAAI,IAAI,MAAS;AAAA,EAC7D;AAAA,EACA,MAAM,OAAO,KAAa;AACxB,UAAM,UAAU,oBAAoB;AACpC,UAAM,QAAQ,WAAW,GAAG;AAAA,EAC9B;AAAA,EACA,MAAM,IAAI,KAAa;AACrB,UAAM,UAAU,oBAAoB;AACpC,UAAM,SAAS,MAAM,QAAQ,QAAyB,GAAG;AACzD,QAAI,CAAC,UAAU,CAAC,OAAO,SAAS;AAC9B,aAAO;AAAA,IACT;AACA,UAAM,cAAc,OAAO,UAAU,KAAK,IAAI;AAC9C,WAAO,cAAc,IAAI,KAAK,KAAK,cAAc,GAAI,IAAI;AAAA,EAC3D;AACF;AAEA,SAAS,gBAAgB,QAAwB;AAC/C,QAAM,QAAQ,OAAO,MAAM,qBAAqB;AAChD,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,wBAAwB,MAAM,EAAE;AAE5D,QAAM,CAAC,EAAE,QAAQ,IAAI,IAAI;AACzB,QAAM,QAAQ,OAAO,SAAS,QAAQ,EAAE;AAExC,QAAM,cAAsC;AAAA,IAC1C,IAAI;AAAA,IACJ,GAAG;AAAA,IACH,GAAG,KAAK;AAAA,IACR,GAAG,KAAK,KAAK;AAAA,IACb,GAAG,KAAK,KAAK,KAAK;AAAA,EACpB;AAEA,SAAO,QAAQ,YAAY,IAAI;AACjC;AAhBS;AAkBT,SAAS,0BAA0B,QAA6C;AAC9E,QAAM,WAAW,gBAAgB,OAAO,MAAM;AAC9C,QAAM,UAAU,OAAO,WAAW;AAElC,SAAO,OAAO,KAAwB,SAAS;AAC7C,UAAM,MAAM,OAAO,eACf,OAAO,aAAa,GAAG,IACvB,GAAG,IAAI,QAAQ,OAAO,aAAa,IAAI,IAAI,QAAQ;AAEvD,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,aAAa,KAAK,KAAK,WAAW,GAAI;AAC5C,UAAM,SAAS,MAAM,QAAQ,IAAI,GAAG;AAEpC,QAAI,UAAU,MAAM,OAAO,SAAS;AAClC,YAAM,QAAQ,OAAO,GAAG;AAAA,IAC1B;AAEA,UAAM,UAAU,MAAM,QAAQ,IAAI,GAAG;AAErC,QAAI,CAAC,SAAS;AACZ,YAAM,QAAQ;AAAA,QACZ;AAAA,QACA;AAAA,UACE,OAAO;AAAA,UACP,SAAS,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,MACF;AACA,aAAO,KAAK;AAAA,IACd;AAEA,QAAI,QAAQ,SAAS,OAAO,UAAU;AACpC,UAAI,OAAO,SAAS;AAClB,cAAM,SAAS,MAAM,OAAO,QAAQ,GAAG;AACvC,YAAI,OAAQ;AAAA,MACd;AAEA,UAAI;AAAA,QACF;AAAA,UACE,OAAO;AAAA,UACP,YAAY,KAAK,MAAM,QAAQ,UAAU,OAAO,GAAI;AAAA,QACtD;AAAA,QACA;AAAA,MACF;AACA;AAAA,IACF;AAEA,YAAQ;AACR,UAAM,QAAQ,IAAI,KAAK,SAAS,UAAU;AAC1C,WAAO,KAAK;AAAA,EACd;AACF;AAnDS;AAqDT,SAAS,aAAa,SAA0B,UAA2B;AACzE,MAAI,mBAAmB,QAAQ;AAC7B,WAAO,QAAQ,KAAK,QAAQ;AAAA,EAC9B;AAEA,QAAM,eAAe,QAClB,QAAQ,SAAS,iBAAiB,EAClC,QAAQ,OAAO,OAAO,EACtB,QAAQ,oBAAoB,IAAI,EAChC,QAAQ,OAAO,KAAK;AAEvB,QAAM,QAAQ,IAAI,OAAO,IAAI,YAAY,GAAG;AAC5C,SAAO,MAAM,KAAK,QAAQ;AAC5B;AAbS;AAeT,IAAM,uBAAN,MAAM,qBAA+C;AAAA,EAKnD,YAAY,WAAW,KAAK;AAJ5B,SAAQ,WAAiC,CAAC;AAKxC,SAAK,WACH,aAAa,MAAM,MAAM,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AAAA,EAC9E;AAAA;AAAA;AAAA;AAAA,EAKA,YAAYA,OAAoB;AAC9B,SAAK,WAAWA,UAAS,MAAM,MAAMA,MAAK,SAAS,GAAG,IAAIA,MAAK,MAAM,GAAG,EAAE,IAAIA;AAAA,EAChF;AAAA,EAEA,IAAI,IAAyC;AAC3C,SAAK,SAAS,KAAK,EAAE;AACrB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,iBAAiB,SAAyB;AAEhD,QAAI,KAAK,aAAa,KAAK;AAEzB,aAAO,QAAQ,WAAW,GAAG,IAAI,UAAU,IAAI,OAAO;AAAA,IACxD;AAIA,UAAM,eAAe,QAAQ,WAAW,GAAG,IAAI,QAAQ,MAAM,CAAC,IAAI;AAClE,WAAO,GAAG,KAAK,QAAQ,IAAI,YAAY;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,KACE,WACA,IACiB;AACjB,UAAM,wBAA4C,8BAAO,KAAK,SAAS;AAErE,YAAM,YAAY,OAAO,cAAc,aAAa,UAAU,GAAG,IAAI;AAErE,UAAI,CAAC,WAAW;AACd,eAAO,KAAK;AAAA,MACd;AAEA,UAAI,OAAO,OAAO,cAAc,GAAG,WAAW,GAAG;AAC/C,eAAQ,GAA0B,KAAK,IAAI;AAAA,MAC7C,OAAO;AACL,cAAM,WAAW,WAAW,KAAK,QAAQ;AACzC,QAAC,GAAwC,QAAQ;AACjD,cAAM,EAAE,SAAS,IAAI,SAAS,MAAM;AAEpC,YAAI,QAAQ;AACZ,YAAI;AACJ,cAAM,cAAc,mCAAuC;AACzD,cAAI,QAAQ,SAAS,QAAQ;AAC3B,kBAAM,UAAU,SAAS,OAAO;AAChC,kBAAM,SAAS,MAAM,QAAQ,KAAK,WAAW;AAC7C,gBAAI,kBAAkB,UAAU;AAC9B,iCAAmB;AACnB,qBAAO;AAAA,YACT;AAAA,UACF,OAAO;AACL,kBAAM,SAAS,MAAM,KAAK;AAC1B,gBAAI,kBAAkB,UAAU;AAC9B,iCAAmB;AACnB,qBAAO;AAAA,YACT;AAAA,UACF;AACA,iBAAO;AAAA,QACT,GAhBoB;AAkBpB,eAAO,YAAY;AAAA,MACrB;AAAA,IACF,GArCkD;AAsClD,SAAK,SAAS,KAAK,qBAAqB;AACxC,WAAO;AAAA,EACT;AAAA,EAEA,UAAU,QAA0C;AAClD,SAAK,SAAS,KAAK,0BAA0B,MAAM,CAAC;AACpD,WAAO;AAAA,EACT;AAAA,EAEA,SAAS,QAAgB,aAAqB,YAAY,OAAwB;AAChF,UAAM,qBAAyC,8BAAO,KAAK,SAAS;AAElE,YAAM,mBAAmB,KAAK,iBAAiB,MAAM;AACrD,UAAI,aAAa,kBAAkB,IAAI,QAAQ,GAAG;AAChD,YAAI,SAAS,aAAa,YAAY,MAAM,GAAG;AAC/C;AAAA,MACF;AACA,aAAO,KAAK;AAAA,IACd,GAR+C;AAU/C,SAAK,SAAS,KAAK,kBAAkB;AACrC,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmBA,QACE,aACA,WACiB;AACjB,UAAM,oBAAwC,8BAAO,KAAK,SAAS;AAEjE,UAAI,cAAc,QAAW;AAC3B,cAAM,gBAAgB,OAAO,cAAc,aAAa,UAAU,GAAG,IAAI;AACzE,YAAI,CAAC,eAAe;AAClB,iBAAO,KAAK;AAAA,QACd;AAAA,MACF;AAGA,UAAI,KAAK,aAAa,KAAK;AAGzB,YAAI,IAAI,aAAa,KAAK,UAAU;AAClC,cAAI,QAAQ,WAAW;AAAA,QACzB,WAES,IAAI,SAAS,WAAW,KAAK,WAAW,GAAG,GAAG;AACrD,gBAAM,UAAU,IAAI,SAAS,MAAM,KAAK,SAAS,MAAM;AACvD,gBAAM,UAAU,cAAc;AAC9B,cAAI,QAAQ,OAAO;AAAA,QACrB;AAAA,MACF,OAAO;AAGL,YAAI,QAAQ,WAAW;AAAA,MACzB;AACA,aAAO,KAAK;AAAA,IACd,GA5B8C;AA8B9C,SAAK,SAAS,KAAK,iBAAiB;AACpC,WAAO;AAAA,EACT;AAAA,EAEA,QAAQ;AACN,WAAO;AAAA,MACL,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,IACf;AAAA,EACF;AACF;AAhLqD;AAArD,IAAM,sBAAN;AAuLA,eAAsB,mBACpB,KACA,OACA,UAA4B,yBACF;AAC1B,QAAM,SAAS,MAAM,QAAQ,IAAI,GAAG;AAEpC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,UAAU;AAAA,MACV;AAAA,MACA,WAAW;AAAA,MACX,SAAS;AAAA,MACT,SAAS;AAAA,MACT,WAAW;AAAA,IACb;AAAA,EACF;AAEA,QAAM,MAAM,KAAK,IAAI;AAErB,MAAI,OAAO,WAAW,MAAM,OAAO,SAAS;AAC1C,WAAO;AAAA,MACL,UAAU;AAAA,MACV;AAAA,MACA,WAAW;AAAA,MACX,SAAS;AAAA,MACT,SAAS;AAAA,MACT,WAAW;AAAA,IACb;AAAA,EACF;AAEA,QAAM,WAAW,OAAO,SAAS;AACjC,QAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,QAAQ;AAC9C,QAAM,YAAY,YAAY;AAE9B,MAAI,UAAyB;AAC7B,MAAI,UAAuB;AAE3B,MAAI,OAAO,SAAS;AAClB,UAAM,cAAc,OAAO,UAAU;AACrC,cAAU,cAAc,IAAI,KAAK,KAAK,cAAc,GAAI,IAAI;AAC5D,cAAU,IAAI,KAAK,OAAO,OAAO;AAAA,EACnC,WAAW,QAAQ,KAAK;AACtB,cAAU,MAAM,QAAQ,IAAI,GAAG;AAC/B,cAAU,UAAU,IAAI,KAAK,MAAM,UAAU,GAAI,IAAI;AAAA,EACvD;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAvDsB;AAyDf,SAAS,WAAW,WAAW,KAAsB;AAC1D,SAAO,IAAI,oBAAoB,QAAQ;AACzC;AAFgB;;;ACpWT,SAAS,iBACdC,aACA,UACY;AACZ,MAAI,CAACA,aAAY;AACf,WAAQ,YAAY,CAAC;AAAA,EACvB;AAEA,QAAM,SAAc,EAAE,GAAG,SAAS;AAElC,aAAW,CAAC,KAAK,KAAK,KAAKA,YAAW,MAAM;AAC1C,WAAO,GAAG,IAAI;AAAA,EAChB;AAEA,SAAO;AACT;AAfgB;AA4BT,SAAS,kBACdA,aACA,KACA,cACe;AACf,MAAI,CAACA,aAAY;AACf,WAAO;AAAA,EACT;AAEA,QAAM,QAAQA,YAAW,KAAK,IAAI,GAAG;AACrC,SAAO,UAAU,SAAY,QAAQ;AACvC;AAXgB;AAgBT,SAAS,kBAAkBA,aAAkD;AAClF,MAAI,CAACA,YAAY,QAAO;AACxB,SAAOA,YAAW,KAAK,OAAO;AAChC;AAHgB;;;AC7DhB,OAAO,QAAQ;AACf,OAAO,UAAU;AAYjB,SAAS,0BAA0B,MAAc,QAAwB;AACvE,QAAM,kBAAkB,KAAK,KAAK,MAAM,MAAM;AAC9C,QAAM,eAAe,KAAK,KAAK,iBAAiB,KAAK;AACrD,SAAO,GAAG,WAAW,YAAY,IAAI,eAAe;AACtD;AAJS;AAMF,SAAS,qBAAqB,UAAuC,CAAC,GAAW;AACtF,QAAM,SAAS,QAAQ,UAAU;AACjC,MAAI,UAAoC;AACxC,MAAI,oBAAoB;AACxB,MAAI,mBAAyC;AAE7C,QAAM,WAAW,8BAAO,WAAyC;AAC/D,cAAU,IAAI,kBAAkB,0BAA0B,OAAO,OAAO,MAAM,MAAM,GAAG,MAAM;AAC7F,UAAM,QAAQ,SAAS;AACvB,wBAAoB;AAAA,EACtB,GAJiB;AAMjB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,IAET,gBAAgB,QAAQ;AACtB,yBAAmB,SAAS,MAAM,EAAE,MAAM,CAAC,UAAU;AACnD,4BAAoB;AACpB,gBAAQ,MAAM,sCAAsC,KAAK;AAAA,MAC3D,CAAC;AAED,YAAM,UAAU,8BACd,KACA,KACA,WACA,eACqB;AACrB,YAAI,oBAAoB,CAAC,mBAAmB;AAC1C,gBAAM;AAAA,QACR;AAEA,YAAI,CAAC,SAAS;AACZ,iBAAO;AAAA,QACT;AAEA,cAAM,UAAU,MAAM,QAAQ,QAAQ,KAAK,GAAG;AAC9C,cAAM,iBAAkB,IAAY;AACpC,YAAI,cAAc,0BAA0B,KAAK;AAC/C,qBAAW,CAAC,KAAK,KAAK,KAAK,gBAAgB;AACzC,uBAAW,IAAI,KAAK,KAAK;AAAA,UAC3B;AAAA,QACF;AACA,eAAO;AAAA,MACT,GAtBgB;AAwBhB,MAAC,OAAe,qBAAqB;AAAA,QACnC;AAAA,QACA,gBAAgB,6BAAM,SAAS,eAAe,KAAK,CAAC,GAApC;AAAA,QAChB,SAAS,6BAAM,mBAAN;AAAA,QACT,kBAAkB,6BAAM,kBAAN;AAAA,MACpB;AAAA,IACF;AAAA,IAEA,MAAM,gBAAgB,EAAE,MAAM,QAAQ,QAAQ,GAAG;AAC/C,UAAI,CAAC,wBAAwB,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG;AACtD;AAAA,MACF;AAEA,iBAAW,UAAU,SAAS;AAC5B,eAAO,YAAY,iBAAiB,MAAM;AAAA,MAC5C;AAEA,YAAM,SAAS,OAAO;AACtB,aAAO,GAAG,KAAK,EAAE,MAAM,eAAe,MAAM,IAAI,CAAC;AACjD,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACF;AApEgB;","names":["path","middleware"]}