@farm.js/core 0.1.0-beta.16 → 0.1.0-beta.17

package/dist/index.cjs

@@ -15152,6 +15152,143 @@ var init_preload = __esm({
   }
 });
 
+// src/security.ts
+function resolveFarmSecurityConfig(input) {
+  if (input === void 0) return { csp: false };
+  if (!isPlainRecord(input)) {
+    throw new TypeError("security must be an object containing the csp option.");
+  }
+  if (Object.prototype.hasOwnProperty.call(input, "contentSecurityPolicy")) {
+    throw new TypeError(
+      "security.contentSecurityPolicy is not supported. Use security.csp instead."
+    );
+  }
+  const csp = input.csp;
+  if (csp === void 0 || csp === false) return { csp: false };
+  if (typeof csp === "string") {
+    return {
+      csp: {
+        value: validateSerializedCsp(csp),
+        reportOnly: false
+      }
+    };
+  }
+  if (!isPlainRecord(csp)) {
+    throw new TypeError("security.csp must be a policy string, false, or an options object.");
+  }
+  const reportOnly = validateReportOnly(csp.reportOnly);
+  if (Object.prototype.hasOwnProperty.call(csp, "value")) {
+    if (Object.prototype.hasOwnProperty.call(csp, "policy") || Object.prototype.hasOwnProperty.call(csp, "directives")) {
+      throw new TypeError(
+        "Resolved security.csp values cannot include policy or directives options."
+      );
+    }
+    return {
+      csp: {
+        value: validateSerializedCsp(csp.value),
+        reportOnly
+      }
+    };
+  }
+  const { policy, directives } = csp;
+  if (policy !== void 0 && directives !== void 0) {
+    throw new TypeError("security.csp accepts either policy or directives, not both.");
+  }
+  if (policy === void 0 && directives === void 0) {
+    throw new TypeError("security.csp requires a policy string or directives object.");
+  }
+  return {
+    csp: {
+      value: policy !== void 0 ? validateSerializedCsp(policy) : serializeFarmCspDirectives(directives),
+      reportOnly
+    }
+  };
+}
+function serializeFarmCspDirectives(directives) {
+  if (!isPlainRecord(directives)) {
+    throw new TypeError("security.csp.directives must be an object.");
+  }
+  const serialized = [];
+  const normalizedNames = /* @__PURE__ */ new Set();
+  for (const [configuredName, configuredValue] of Object.entries(directives)) {
+    if (configuredValue === false || configuredValue === null || configuredValue === void 0) {
+      continue;
+    }
+    const name = normalizeDirectiveName(configuredName);
+    if (normalizedNames.has(name)) {
+      throw new TypeError(`security.csp contains the duplicate directive ${JSON.stringify(name)}.`);
+    }
+    normalizedNames.add(name);
+    const values = configuredValue === true ? [] : (Array.isArray(configuredValue) ? configuredValue : [configuredValue]).map(
+      validateDirectiveValue
+    );
+    serialized.push(values.length > 0 ? `${name} ${values.join(" ")}` : name);
+  }
+  if (serialized.length === 0) {
+    throw new TypeError("security.csp.directives must contain at least one enabled directive.");
+  }
+  return serialized.join("; ");
+}
+function getFarmSecurityHeader(security) {
+  if (!security.csp) return void 0;
+  return {
+    key: security.csp.reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy",
+    value: security.csp.value
+  };
+}
+function normalizeDirectiveName(value) {
+  const name = value.trim().replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+  if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+    throw new TypeError(`Invalid security.csp directive name: ${JSON.stringify(value)}.`);
+  }
+  return name;
+}
+function validateDirectiveValue(value) {
+  if (typeof value !== "string") {
+    throw new TypeError("security.csp directive values must be strings or booleans.");
+  }
+  const normalized = value.trim();
+  if (!normalized || /[;\r\n]/.test(normalized) || normalized.includes("\0")) {
+    throw new TypeError(`Invalid security.csp directive value: ${JSON.stringify(value)}.`);
+  }
+  return normalized;
+}
+function validateSerializedCsp(value) {
+  if (typeof value !== "string") {
+    throw new TypeError("security.csp policy must be a non-empty single-line string.");
+  }
+  const normalized = value.trim().replace(/;+$/g, "").trim();
+  if (!normalized || /[\r\n]/.test(normalized) || normalized.includes("\0")) {
+    throw new TypeError("security.csp policy must be a non-empty single-line string.");
+  }
+  return normalized;
+}
+function validateReportOnly(value) {
+  if (value === void 0) return false;
+  if (typeof value !== "boolean") {
+    throw new TypeError("security.csp.reportOnly must be a boolean.");
+  }
+  return value;
+}
+function isPlainRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+var init_security = __esm({
+  "src/security.ts"() {
+    "use strict";
+    __name(resolveFarmSecurityConfig, "resolveFarmSecurityConfig");
+    __name(serializeFarmCspDirectives, "serializeFarmCspDirectives");
+    __name(getFarmSecurityHeader, "getFarmSecurityHeader");
+    __name(normalizeDirectiveName, "normalizeDirectiveName");
+    __name(validateDirectiveValue, "validateDirectiveValue");
+    __name(validateSerializedCsp, "validateSerializedCsp");
+    __name(validateReportOnly, "validateReportOnly");
+    __name(isPlainRecord, "isPlainRecord");
+  }
+});
+
 // src/app.ts
 function isResolvedDocsConfig(value) {
   return !!value && typeof value === "object" && "enabled" in value && "entry" in value && "config" in value;
@@ -15192,6 +15329,7 @@ var init_app = __esm({
     init_cache();
     init_auth_config();
     init_preload();
+    init_security();
     defaultDocsConfig = {
       enabled: false,
       entry: "/docs",
@@ -15256,6 +15394,7 @@ var init_app = __esm({
           routeRules: normalizeRouteRules(config.routeRules),
           context: config.context || (() => void 0),
           serverActions: resolveServerActionsConfig(config.serverActions),
+          security: resolveFarmSecurityConfig(config.security),
           images: resolveFarmImageConfig(config.images),
           performance: resolveFarmPerformanceConfig(config.performance),
           i18n: isResolvedI18nConfig(config.i18n) ? config.i18n : resolveFarmI18nConfig(config.i18n, {
@@ -18894,7 +19033,7 @@ var init_environment_vite = __esm({
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.1.0-beta.16";
+    version = "0.1.0-beta.17";
   }
 });
 
@@ -19655,11 +19794,28 @@ function createFarmClientOptimizeDepsConfig(entries) {
     ...entries?.length ? { entries: [...entries] } : {}
   };
 }
+function createFarmSourceAlias(projectRoot, srcDir = "src") {
+  return {
+    "@": import_node_path9.default.resolve(projectRoot, srcDir)
+  };
+}
 function mergeNoExternal(farmValue, userValue) {
   if (farmValue === true || userValue === true) return true;
   const normalize = /* @__PURE__ */ __name((value) => value == null || value === true ? [] : Array.isArray(value) ? value : [value], "normalize");
   return Array.from(/* @__PURE__ */ new Set([...normalize(farmValue), ...normalize(userValue)]));
 }
+function mergeAlias(farmValue, userValue) {
+  if (!farmValue) return userValue || {};
+  if (!userValue) return farmValue;
+  if (!Array.isArray(farmValue) && !Array.isArray(userValue)) {
+    return {
+      ...farmValue,
+      ...userValue
+    };
+  }
+  const normalize = /* @__PURE__ */ __name((value) => Array.isArray(value) ? [...value] : Object.entries(value).map(([find, replacement]) => ({ find, replacement })), "normalize");
+  return [...normalize(userValue), ...normalize(farmValue)];
+}
 function mergeFarmViteConfig(farmConfig, userConfig = {}) {
   const noDiscovery = userConfig.optimizeDeps?.noDiscovery ?? farmConfig.optimizeDeps?.noDiscovery;
   const holdUntilCrawlEnd = userConfig.optimizeDeps?.holdUntilCrawlEnd ?? (userConfig.optimizeDeps?.noDiscovery === true ? false : farmConfig.optimizeDeps?.holdUntilCrawlEnd);
@@ -19674,6 +19830,7 @@ function mergeFarmViteConfig(farmConfig, userConfig = {}) {
     resolve: {
       ...farmConfig.resolve,
       ...userConfig.resolve,
+      alias: mergeAlias(farmConfig.resolve?.alias, userConfig.resolve?.alias),
       dedupe: Array.from(
         /* @__PURE__ */ new Set([...farmConfig.resolve?.dedupe || [], ...userConfig.resolve?.dedupe || []])
       )
@@ -19726,7 +19883,9 @@ var init_vite_config = __esm({
     ];
     __name(createFarmClientOptimizeDepsEntries, "createFarmClientOptimizeDepsEntries");
     __name(createFarmClientOptimizeDepsConfig, "createFarmClientOptimizeDepsConfig");
+    __name(createFarmSourceAlias, "createFarmSourceAlias");
     __name(mergeNoExternal, "mergeNoExternal");
+    __name(mergeAlias, "mergeAlias");
     __name(mergeFarmViteConfig, "mergeFarmViteConfig");
   }
 });
@@ -23686,6 +23845,8 @@ async function resolveConfig(userConfig, mode) {
   const routeRules = normalizeRouteRules(userConfig.routeRules);
   const routeRuleRedirects = routeRulesToRedirects(routeRules);
   const routeRuleHeaders = routeRulesToHeaders(routeRules);
+  const security = resolveFarmSecurityConfig(userConfig.security);
+  const securityHeader = getFarmSecurityHeader(security);
   const deploy = resolveDeployConfig(userConfig);
   const root = userConfig.root || process.cwd();
   const srcDir = userConfig.srcDir || "src";
@@ -23741,7 +23902,11 @@ async function resolveConfig(userConfig, mode) {
     trailingSlash: userConfig.trailingSlash ?? false,
     redirects: /* @__PURE__ */ __name(() => [...redirects, ...routeRuleRedirects], "redirects"),
     rewrites: /* @__PURE__ */ __name(() => rewrites, "rewrites"),
-    headers: /* @__PURE__ */ __name(() => [...headers2, ...routeRuleHeaders], "headers"),
+    headers: /* @__PURE__ */ __name(() => [
+      ...headers2,
+      ...routeRuleHeaders,
+      ...securityHeader ? [{ source: "/*", headers: [securityHeader] }] : []
+    ], "headers"),
     routeRules,
     images: resolveFarmImageConfig(userConfig.images),
     performance: resolveFarmPerformanceConfig(userConfig.performance),
@@ -23760,6 +23925,7 @@ async function resolveConfig(userConfig, mode) {
     notFound: userConfig.notFound || {},
     context: userConfig.context || (() => void 0),
     serverActions: resolveServerActionsConfig(userConfig.serverActions),
+    security,
     deploymentId,
     output: userConfig.output || "standalone",
     distDir: userConfig.distDir || ".farm",
@@ -23839,6 +24005,7 @@ var init_config2 = __esm({
     init_config();
     init_auth_config();
     init_preload();
+    init_security();
     init_config_entry();
     FARM_RESOLVED_CUSTOM_CONTEXT = /* @__PURE__ */ Symbol.for("farm.resolvedCustomContext");
     __name(hasCustomFarmRouteContext, "hasCustomFarmRouteContext");
@@ -30673,7 +30840,7 @@ async function defineConfig2(config = {}) {
       // Stub out problematic server-only modules during dev mode
       alias: {
         ...getFarmLayerAliases(config.layers),
-        "@": path25.resolve(appRoot, "src"),
+        ...createFarmSourceAlias(appRoot, config.srcDir),
         // Nitro internals that should not be resolved in browser
         "supports-color": "data:text/javascript,export default false; export const supportsColor = false; export const stdout = false; export const stderr = false;",
         "@poppinss/dumper": "data:text/javascript,export default {};",
@@ -32139,6 +32306,7 @@ __export(src_exports, {
   ServerActionError: () => ServerActionError,
   ServerActionRequestError: () => ServerActionRequestError,
   ServerFnFailure: () => ServerFnFailure,
+  UnsupportedRateLimitStorageError: () => UnsupportedRateLimitStorageError,
   _parseServerFnSchema: () => _parseServerFnSchema,
   _runWithAfterNodeResponse: () => _runWithAfterNodeResponse,
   _runWithAfterRequest: () => _runWithAfterRequest,
@@ -32363,6 +32531,7 @@ __export(src_exports, {
   matchRegisteredIntegrationRoute: () => matchRegisteredIntegrationRoute,
   matchRoute: () => matchRoute,
   matchSSGPage: () => matchSSGPage,
+  memoryRateLimitStorage: () => memoryRateLimitStorage,
   memoryStorage: () => memoryStorage,
   mergeFarmRouteRuntimeConfigs: () => mergeFarmRouteRuntimeConfigs,
   mergeScheduledTasks: () => mergeScheduledTasks,
@@ -34819,35 +34988,69 @@ function parseRouteParams(input, parsers, options = {}) {
 __name(parseRouteParams, "parseRouteParams");
 
 // src/middleware/chain.ts
-init_storage();
-function getRateLimitStorage() {
-  return getStorage("ratelimit");
-}
-__name(getRateLimitStorage, "getRateLimitStorage");
-var defaultRateLimitStorage = {
-  async get(key) {
-    const storage = getRateLimitStorage();
-    const value = await storage.getItem(key);
-    return value ?? null;
-  },
-  async set(key, value, ttl) {
-    const storage = getRateLimitStorage();
-    await storage.setItem(key, value, ttl ? { ttl } : void 0);
-  },
-  async delete(key) {
-    const storage = getRateLimitStorage();
-    await storage.removeItem(key);
-  },
-  async ttl(key) {
-    const storage = getRateLimitStorage();
-    const record = await storage.getItem(key);
-    if (!record || !record.resetAt) {
+var DEFAULT_MEMORY_RATE_LIMIT_ENTRIES = 1e5;
+var _UnsupportedRateLimitStorageError = class _UnsupportedRateLimitStorageError extends TypeError {
+  constructor() {
+    super(
+      "RateLimitStorage must implement atomic increment(key, windowMs). Legacy get/set adapters can lose increments under concurrency. Use memoryRateLimitStorage() for one process or redisRateLimitStorage() from @farm.js/cache-redis for production."
+    );
+    this.name = "UnsupportedRateLimitStorageError";
+  }
+};
+__name(_UnsupportedRateLimitStorageError, "UnsupportedRateLimitStorageError");
+var UnsupportedRateLimitStorageError = _UnsupportedRateLimitStorageError;
+function memoryRateLimitStorage(options = {}) {
+  const maxEntries = options.maxEntries ?? DEFAULT_MEMORY_RATE_LIMIT_ENTRIES;
+  if (!Number.isSafeInteger(maxEntries) || maxEntries <= 0) {
+    throw new TypeError("memoryRateLimitStorage maxEntries must be a positive safe integer.");
+  }
+  const records = /* @__PURE__ */ new Map();
+  function read(key, now2) {
+    const record = records.get(key);
+    if (!record) return null;
+    if (record.resetAt <= now2) {
+      records.delete(key);
       return null;
     }
-    const remainingMs = record.resetAt - Date.now();
-    return remainingMs > 0 ? Math.ceil(remainingMs / 1e3) : null;
+    return record;
   }
-};
+  __name(read, "read");
+  function pruneExpired(now2) {
+    for (const [key, record] of records) {
+      if (record.resetAt <= now2) records.delete(key);
+    }
+  }
+  __name(pruneExpired, "pruneExpired");
+  return {
+    increment(key, windowMs) {
+      if (!Number.isSafeInteger(windowMs) || windowMs <= 0) {
+        throw new TypeError("Rate-limit windowMs must be a positive safe integer.");
+      }
+      const now2 = Date.now();
+      const current = read(key, now2);
+      if (current) {
+        const next2 = { count: current.count + 1, resetAt: current.resetAt };
+        records.set(key, next2);
+        return next2;
+      }
+      if (records.size >= maxEntries) pruneExpired(now2);
+      if (records.size >= maxEntries) {
+        throw new Error(
+          `Process-local rate-limit storage reached its ${maxEntries} active-key capacity. Configure a shared production adapter or increase maxEntries.`
+        );
+      }
+      const next = { count: 1, resetAt: now2 + windowMs };
+      records.set(key, next);
+      return next;
+    },
+    get(key) {
+      const record = read(key, Date.now());
+      return record ? { ...record } : null;
+    }
+  };
+}
+__name(memoryRateLimitStorage, "memoryRateLimitStorage");
+var defaultRateLimitStorage = memoryRateLimitStorage();
 function parseTimeWindow(window2) {
   const match = window2.match(/^(\d+)(ms|s|m|h|d)$/);
   if (!match) throw new Error(`Invalid time window: ${window2}`);
@@ -34860,52 +35063,73 @@ function parseTimeWindow(window2) {
     h: 60 * 60 * 1e3,
     d: 24 * 60 * 60 * 1e3
   };
-  return value * multipliers[unit];
+  const windowMs = value * multipliers[unit];
+  if (!Number.isSafeInteger(windowMs) || windowMs <= 0) {
+    throw new Error(`Invalid time window: ${window2}`);
+  }
+  return windowMs;
 }
 __name(parseTimeWindow, "parseTimeWindow");
 function createRateLimitMiddleware(config) {
+  if (!Number.isSafeInteger(config.requests) || config.requests <= 0) {
+    throw new TypeError("Rate limit requests must be a positive safe integer.");
+  }
   const windowMs = parseTimeWindow(config.window);
   const storage = config.storage || defaultRateLimitStorage;
+  assertAtomicRateLimitStorage(storage);
   return async (ctx, next) => {
     const key = config.keyGenerator ? config.keyGenerator(ctx) : `${ctx.request.socket.remoteAddress}:${ctx.pathname}`;
+    const current = await storage.increment(key, windowMs);
+    assertRateLimitIncrementResult(current);
     const now2 = Date.now();
-    const ttlSeconds = Math.ceil(windowMs / 1e3);
-    const record = await storage.get(key);
-    if (record && now2 > record.resetAt) {
-      await storage.delete(key);
-    }
-    const current = await storage.get(key);
-    if (!current) {
-      await storage.set(
-        key,
-        {
-          count: 1,
-          resetAt: now2 + windowMs
-        },
-        ttlSeconds
-      );
-      return next();
-    }
-    if (current.count >= config.requests) {
+    const resetIn = Math.max(1, Math.ceil((current.resetAt - now2) / 1e3));
+    const remaining = Math.max(0, config.requests - current.count);
+    setRateLimitHeaders(ctx, config.requests, remaining, resetIn, Math.ceil(windowMs / 1e3));
+    if (current.count > config.requests) {
+      setMiddlewareResponseHeader(ctx, "Retry-After", String(resetIn));
       if (config.onLimit) {
         const result = await config.onLimit(ctx);
-        if (result) return;
+        if (result) return result;
       }
       ctx.json(
         {
           error: "Rate limit exceeded",
-          retryAfter: Math.ceil((current.resetAt - now2) / 1e3)
+          retryAfter: resetIn
         },
         429
       );
       return;
     }
-    current.count++;
-    await storage.set(key, current, ttlSeconds);
     return next();
   };
 }
 __name(createRateLimitMiddleware, "createRateLimitMiddleware");
+function assertAtomicRateLimitStorage(storage) {
+  if (!storage || typeof storage.increment !== "function") {
+    throw new UnsupportedRateLimitStorageError();
+  }
+}
+__name(assertAtomicRateLimitStorage, "assertAtomicRateLimitStorage");
+function assertRateLimitIncrementResult(result) {
+  if (!result || !Number.isSafeInteger(result.count) || result.count <= 0 || !Number.isFinite(result.resetAt) || result.resetAt <= 0) {
+    throw new TypeError(
+      "RateLimitStorage.increment() must return a positive integer count and a resetAt timestamp."
+    );
+  }
+}
+__name(assertRateLimitIncrementResult, "assertRateLimitIncrementResult");
+function setRateLimitHeaders(ctx, limit, remaining, resetIn, windowSeconds) {
+  setMiddlewareResponseHeader(ctx, "RateLimit-Policy", `"farm";q=${limit};w=${windowSeconds}`);
+  setMiddlewareResponseHeader(ctx, "RateLimit", `"farm";r=${remaining};t=${resetIn}`);
+}
+__name(setRateLimitHeaders, "setRateLimitHeaders");
+function setMiddlewareResponseHeader(ctx, name, value) {
+  ctx.headers.set(name, value);
+  if (!ctx.response.headersSent && !ctx.response.writableEnded) {
+    ctx.response.setHeader(name, value);
+  }
+}
+__name(setMiddlewareResponseHeader, "setMiddlewareResponseHeader");
 function matchPattern(pattern, pathname) {
   if (pattern instanceof RegExp) {
     return pattern.test(pathname);
@@ -35055,6 +35279,15 @@ var _MiddlewareChainImpl = class _MiddlewareChainImpl {
 __name(_MiddlewareChainImpl, "MiddlewareChainImpl");
 var MiddlewareChainImpl = _MiddlewareChainImpl;
 async function getRateLimitStatus(key, limit, storage = defaultRateLimitStorage) {
+  if (!Number.isSafeInteger(limit) || limit <= 0) {
+    throw new TypeError("Rate limit must be a positive safe integer.");
+  }
+  assertAtomicRateLimitStorage(storage);
+  if (typeof storage.get !== "function") {
+    throw new TypeError(
+      "getRateLimitStatus() requires a RateLimitStorage adapter that implements get(key)."
+    );
+  }
   const record = await storage.get(key);
   if (!record) {
     return {
@@ -35066,6 +35299,7 @@ async function getRateLimitStatus(key, limit, storage = defaultRateLimitStorage)
       isLimited: false
     };
   }
+  assertRateLimitIncrementResult(record);
   const now2 = Date.now();
   if (record.resetAt && now2 > record.resetAt) {
     return {
@@ -35086,9 +35320,6 @@ async function getRateLimitStatus(key, limit, storage = defaultRateLimitStorage)
     const remainingMs = record.resetAt - now2;
     resetIn = remainingMs > 0 ? Math.ceil(remainingMs / 1e3) : null;
     resetAt = new Date(record.resetAt);
-  } else if (storage.ttl) {
-    resetIn = await storage.ttl(key);
-    resetAt = resetIn ? new Date(now2 + resetIn * 1e3) : null;
   }
   return {
     requests,
@@ -37051,6 +37282,7 @@ __name(withVite5TransformContext, "withVite5TransformContext");
 
 // src/nitro/universal-build.ts
 init_font_vite();
+init_vite_config();
 var import_meta = {};
 function preloadFarmNitroRuntime() {
   return import("nitro").then(
@@ -39444,9 +39676,7 @@ async function buildSSRInMemory(productionVite, config, root, routeManager, apiR
         postcss: postcssConfigDir
       } : void 0,
       resolve: {
-        alias: {
-          "@": import_path12.default.resolve(root, "src")
-        },
+        alias: createFarmSourceAlias(root, config.srcDir),
         // Programmatic route wrappers are created inside @farm.js/core. Resolve
         // their React imports from the application so React 18/19 elements and
         // the selected server renderer always share the same runtime instance.
@@ -43104,6 +43334,9 @@ async function createProjectModuleServer(createViteServer, config, root) {
         middlewareMode: true,
         hmr: false
       },
+      resolve: {
+        alias: createFarmSourceAlias(root, config.srcDir)
+      },
       optimizeDeps: {
         noDiscovery: true
       },
@@ -44800,6 +45033,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   ServerActionError,
   ServerActionRequestError,
   ServerFnFailure,
+  UnsupportedRateLimitStorageError,
   _parseServerFnSchema,
   _runWithAfterNodeResponse,
   _runWithAfterRequest,
@@ -45024,6 +45258,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   matchRegisteredIntegrationRoute,
   matchRoute,
   matchSSGPage,
+  memoryRateLimitStorage,
   memoryStorage,
   mergeFarmRouteRuntimeConfigs,
   mergeScheduledTasks,