@farm.js/core 0.1.0-beta.3 → 0.1.0-beta.5

package/dist/routes.mjs

@@ -19,12 +19,12 @@ import {
   redirect,
   routesBuilder,
   scanProgrammaticPagePaths
-} from "./chunk-CSU4KJJF.mjs";
+} from "./chunk-C2ROET2V.mjs";
 import "./chunk-QKVUNGAH.mjs";
 import "./chunk-GQVGIUSN.mjs";
-import "./chunk-GZWT6VI5.mjs";
+import "./chunk-V3XURYJO.mjs";
 import "./chunk-WZ5QFROO.mjs";
-import "./chunk-SHRJG6OG.mjs";
+import "./chunk-RBRLLZL5.mjs";
 import "./chunk-7ZY5AIJO.mjs";
 import "./chunk-CGILA3WO.mjs";
 export {

package/dist/{runtime-C1B7pSGT.d.mts → runtime-9nQjVM7X.d.mts}

@@ -1,4 +1,5 @@
-import { RouteDataCacheKey } from './cache.mjs';
+import { FarmCacheInvalidationTarget } from './cache.mjs';
+import { M as MultipartSchema, T as TypedFormData } from './transport-BmbGTXA5.mjs';
 
 type AnySchema = {
     _output?: any;
@@ -15,6 +16,7 @@ type InferOutput<T> = T extends {
 } ? O : T extends {
     parse: (data: unknown) => infer R;
 } ? R : unknown;
+type InferBodyInput<T> = T extends MultipartSchema<AnySchema> ? TypedFormData<InferOutput<T>> : InferOutput<T>;
 type InferHeadersOutput<T> = [T] extends [never] ? Record<string, string> : T extends AnySchema ? InferOutput<T> : Record<string, string>;
 type EndpointErrorDefinition<TSchema extends AnySchema = AnySchema, TStatus extends number = number> = {
     status: TStatus;
@@ -55,11 +57,7 @@ type EndpointMiddlewareResult<TProvidedContext extends object = object> = TProvi
 /** A plain async function. No wrapper or `next()` callback is required. */
 type EndpointMiddleware<TProvidedContext extends object = object, TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = (ctx: EndpointMiddlewareContext<TContext, TBody, TQuery, THeaders>) => MaybePromise<EndpointMiddlewareResult<TProvidedContext>>;
 type AnyEndpointMiddleware = (ctx: EndpointMiddlewareContext<any, any, any, any>) => unknown;
-type EndpointInvalidationTarget = {
-    key: RouteDataCacheKey;
-} | {
-    path: string;
-};
+type EndpointInvalidationTarget = FarmCacheInvalidationTarget;
 type EndpointInvalidationContext<TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = EndpointMiddlewareContext<TContext, TBody, TQuery, THeaders> & {
     /** The raw value returned by the endpoint handler. */
     result: unknown;
@@ -78,7 +76,7 @@ type EndpointOptions<TBody extends AnySchema = never, TQuery extends AnySchema =
     headers?: THeaders;
     middleware?: TMiddlewares;
     /**
-     * Cache keys and route paths made stale after a successful handler result.
+     * Cache keys, tags, and route paths made stale after a successful handler result.
      * The resolver receives validated input and middleware context.
      */
     invalidates?: EndpointInvalidations<InferEndpointMiddlewareContext<TMiddlewares>, InferOutput<TBody>, InferOutput<TQuery>, InferHeadersOutput<THeaders>>;
@@ -95,9 +93,10 @@ type EndpointHandler<TBody extends AnySchema = never, TQuery extends AnySchema =
     params: EndpointParams;
     fail: EndpointFail<TErrors>;
 }) => Promise<TResponse> | TResponse;
-type TypedEndpoint<TBody = never, TQuery = never, TResponse = any, THeaders = Record<string, string>, TErrors = never> = {
+type TypedEndpoint<TBody = never, TQuery = never, TResponse = any, THeaders = Record<string, string>, TErrors = never, TBodyInput = TBody> = {
     __types: {
         body: TBody;
+        inputBody: TBodyInput;
         query: TQuery;
         headers: THeaders;
         response: TResponse;
@@ -109,7 +108,7 @@ type TypedEndpoint<TBody = never, TQuery = never, TResponse = any, THeaders = Re
     body?: TBody;
     query?: TQuery;
 }) => Promise<TResponse>);
-type CreatedEndpoint<TBody extends AnySchema, TQuery extends AnySchema, THeaders extends AnySchema, TResponse, TErrors extends EndpointErrorDefinitions = {}> = TypedEndpoint<InferOutput<TBody>, InferOutput<TQuery>, Awaited<TResponse>, InferHeadersOutput<THeaders>, EndpointErrorContracts<TErrors>>;
+type CreatedEndpoint<TBody extends AnySchema, TQuery extends AnySchema, THeaders extends AnySchema, TResponse, TErrors extends EndpointErrorDefinitions = {}> = TypedEndpoint<InferOutput<TBody>, InferOutput<TQuery>, Awaited<TResponse>, InferHeadersOutput<THeaders>, EndpointErrorContracts<TErrors>, InferBodyInput<TBody>>;
 type AnyEndpointOptions = EndpointOptions<AnySchema, AnySchema, AnySchema, readonly AnyEndpointMiddleware[], EndpointErrorDefinitions>;
 type EndpointBodyFromOptions<TOptions> = TOptions extends {
     body: infer TBody extends AnySchema;

package/dist/{runtime-CdPHt0bv.d.ts → runtime-DgeS2skB.d.ts}

@@ -1,4 +1,5 @@
-import { RouteDataCacheKey } from './cache.js';
+import { FarmCacheInvalidationTarget } from './cache.js';
+import { M as MultipartSchema, T as TypedFormData } from './transport-BmbGTXA5.js';
 
 type AnySchema = {
     _output?: any;
@@ -15,6 +16,7 @@ type InferOutput<T> = T extends {
 } ? O : T extends {
     parse: (data: unknown) => infer R;
 } ? R : unknown;
+type InferBodyInput<T> = T extends MultipartSchema<AnySchema> ? TypedFormData<InferOutput<T>> : InferOutput<T>;
 type InferHeadersOutput<T> = [T] extends [never] ? Record<string, string> : T extends AnySchema ? InferOutput<T> : Record<string, string>;
 type EndpointErrorDefinition<TSchema extends AnySchema = AnySchema, TStatus extends number = number> = {
     status: TStatus;
@@ -55,11 +57,7 @@ type EndpointMiddlewareResult<TProvidedContext extends object = object> = TProvi
 /** A plain async function. No wrapper or `next()` callback is required. */
 type EndpointMiddleware<TProvidedContext extends object = object, TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = (ctx: EndpointMiddlewareContext<TContext, TBody, TQuery, THeaders>) => MaybePromise<EndpointMiddlewareResult<TProvidedContext>>;
 type AnyEndpointMiddleware = (ctx: EndpointMiddlewareContext<any, any, any, any>) => unknown;
-type EndpointInvalidationTarget = {
-    key: RouteDataCacheKey;
-} | {
-    path: string;
-};
+type EndpointInvalidationTarget = FarmCacheInvalidationTarget;
 type EndpointInvalidationContext<TContext extends object = {}, TBody = unknown, TQuery = unknown, THeaders = Record<string, string>> = EndpointMiddlewareContext<TContext, TBody, TQuery, THeaders> & {
     /** The raw value returned by the endpoint handler. */
     result: unknown;
@@ -78,7 +76,7 @@ type EndpointOptions<TBody extends AnySchema = never, TQuery extends AnySchema =
     headers?: THeaders;
     middleware?: TMiddlewares;
     /**
-     * Cache keys and route paths made stale after a successful handler result.
+     * Cache keys, tags, and route paths made stale after a successful handler result.
      * The resolver receives validated input and middleware context.
      */
     invalidates?: EndpointInvalidations<InferEndpointMiddlewareContext<TMiddlewares>, InferOutput<TBody>, InferOutput<TQuery>, InferHeadersOutput<THeaders>>;
@@ -95,9 +93,10 @@ type EndpointHandler<TBody extends AnySchema = never, TQuery extends AnySchema =
     params: EndpointParams;
     fail: EndpointFail<TErrors>;
 }) => Promise<TResponse> | TResponse;
-type TypedEndpoint<TBody = never, TQuery = never, TResponse = any, THeaders = Record<string, string>, TErrors = never> = {
+type TypedEndpoint<TBody = never, TQuery = never, TResponse = any, THeaders = Record<string, string>, TErrors = never, TBodyInput = TBody> = {
     __types: {
         body: TBody;
+        inputBody: TBodyInput;
         query: TQuery;
         headers: THeaders;
         response: TResponse;
@@ -109,7 +108,7 @@ type TypedEndpoint<TBody = never, TQuery = never, TResponse = any, THeaders = Re
     body?: TBody;
     query?: TQuery;
 }) => Promise<TResponse>);
-type CreatedEndpoint<TBody extends AnySchema, TQuery extends AnySchema, THeaders extends AnySchema, TResponse, TErrors extends EndpointErrorDefinitions = {}> = TypedEndpoint<InferOutput<TBody>, InferOutput<TQuery>, Awaited<TResponse>, InferHeadersOutput<THeaders>, EndpointErrorContracts<TErrors>>;
+type CreatedEndpoint<TBody extends AnySchema, TQuery extends AnySchema, THeaders extends AnySchema, TResponse, TErrors extends EndpointErrorDefinitions = {}> = TypedEndpoint<InferOutput<TBody>, InferOutput<TQuery>, Awaited<TResponse>, InferHeadersOutput<THeaders>, EndpointErrorContracts<TErrors>, InferBodyInput<TBody>>;
 type AnyEndpointOptions = EndpointOptions<AnySchema, AnySchema, AnySchema, readonly AnyEndpointMiddleware[], EndpointErrorDefinitions>;
 type EndpointBodyFromOptions<TOptions> = TOptions extends {
     body: infer TBody extends AnySchema;

package/dist/server-action-security.cjs

@@ -41,7 +41,8 @@ var FARM_CACHE_INVALIDATION_STATE = /* @__PURE__ */ Symbol.for("farm.cacheInvali
 var globalState = globalThis;
 function getFarmCacheInvalidationState() {
   return globalState[FARM_CACHE_INVALIDATION_STATE] ?? (globalState[FARM_CACHE_INVALIDATION_STATE] = {
-    listeners: /* @__PURE__ */ new Set()
+    listeners: /* @__PURE__ */ new Set(),
+    taskListeners: /* @__PURE__ */ new Set()
   });
 }
 __name(getFarmCacheInvalidationState, "getFarmCacheInvalidationState");
@@ -51,6 +52,12 @@ function subscribeFarmCacheInvalidation(listener) {
   return () => state.listeners.delete(listener);
 }
 __name(subscribeFarmCacheInvalidation, "subscribeFarmCacheInvalidation");
+function subscribeFarmCacheTask(listener) {
+  const state = getFarmCacheInvalidationState();
+  state.taskListeners.add(listener);
+  return () => state.taskListeners.delete(listener);
+}
+__name(subscribeFarmCacheTask, "subscribeFarmCacheTask");
 
 // src/server-action-security.ts
 var DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1e6;
@@ -172,16 +179,24 @@ function sanitizeServerActionError(_error) {
   };
 }
 __name(sanitizeServerActionError, "sanitizeServerActionError");
-function runWithServerActionRequest(request, callback) {
+async function runWithServerActionRequest(request, callback) {
   throwIfAborted(request.signal);
-  return getServerActionStorage().run(
-    {
-      request,
-      signal: request.signal,
-      invalidations: /* @__PURE__ */ new Set()
-    },
-    callback
-  );
+  const context = {
+    request,
+    signal: request.signal,
+    invalidations: /* @__PURE__ */ new Set(),
+    cacheTasks: /* @__PURE__ */ new Set()
+  };
+  return getServerActionStorage().run(context, async () => {
+    try {
+      const result = await callback();
+      await Promise.all(context.cacheTasks);
+      return result;
+    } catch (error) {
+      await Promise.allSettled(context.cacheTasks);
+      throw error;
+    }
+  });
 }
 __name(runWithServerActionRequest, "runWithServerActionRequest");
 function getServerActionExecutionContext() {
@@ -199,6 +214,9 @@ __name(getServerActionInvalidations, "getServerActionInvalidations");
 subscribeFarmCacheInvalidation((key) => {
   getServerActionExecutionContext()?.invalidations.add(key);
 });
+subscribeFarmCacheTask((task) => {
+  getServerActionExecutionContext()?.cacheTasks.add(task);
+});
 function getServerActionStorage() {
   const globalState2 = globalThis;
   if (!globalState2[SERVER_ACTION_STORAGE_KEY]) {

package/dist/server-action-security.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/server-action-security.ts","../src/cache-invalidation.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { subscribeFarmCacheInvalidation } from \"./cache-invalidation\";\n\nexport const DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1_000_000;\n\nexport interface FarmServerActionsConfig {\n  /** Additional trusted origins or host patterns, such as https://app.example.com. */\n  allowedOrigins?: readonly string[];\n  /** Maximum encoded request body size in bytes or as a size string such as \"1mb\". */\n  bodySizeLimit?: number | string;\n}\n\nexport interface ResolvedFarmServerActionsConfig {\n  allowedOrigins: readonly string[];\n  bodySizeLimit: number;\n}\n\nexport type ServerActionRequestKind = \"javascript\" | \"form\";\n\nexport interface PreparedServerActionRequest {\n  body: string | FormData;\n  contentType: string;\n}\n\nexport type SanitizedServerActionError = {\n  name: \"ServerActionError\";\n  message: \"Server function failed\";\n};\n\ntype ServerActionRequestErrorCode =\n  | \"BODY_TOO_LARGE\"\n  | \"INVALID_ACTION_ID\"\n  | \"INVALID_BODY\"\n  | \"INVALID_CONTENT_LENGTH\"\n  | \"INVALID_METHOD\"\n  | \"INVALID_ORIGIN\"\n  | \"MISSING_ORIGIN\"\n  | \"UNSUPPORTED_CONTENT_TYPE\";\n\nexport class ServerActionRequestError extends Error {\n  readonly code: ServerActionRequestErrorCode;\n  readonly status: number;\n\n  constructor(code: ServerActionRequestErrorCode, status: number, message: string) {\n    super(message);\n    this.name = \"ServerActionRequestError\";\n    this.code = code;\n    this.status = status;\n  }\n}\n\ntype ServerActionExecutionContext = {\n  request: Request;\n  signal: AbortSignal;\n  invalidations: Set<string>;\n};\n\nconst SERVER_ACTION_STORAGE_KEY = Symbol.for(\"farm.serverActionStorage\");\nconst FALLBACK_ABORT_CONTROLLER_KEY = Symbol.for(\"farm.serverActionFallbackAbortController\");\nconst FORM_ACTION_CONTENT_TYPES = new Set([\n  \"application/x-www-form-urlencoded\",\n  \"multipart/form-data\",\n]);\nconst JAVASCRIPT_ACTION_CONTENT_TYPES = new Set([\n  \"application/octet-stream\",\n  \"application/x-www-form-urlencoded\",\n  \"multipart/form-data\",\n  \"text/plain\",\n]);\n\ntype GlobalWithServerActionStorage = typeof globalThis & {\n  [SERVER_ACTION_STORAGE_KEY]?: AsyncLocalStorage<ServerActionExecutionContext>;\n  [FALLBACK_ABORT_CONTROLLER_KEY]?: AbortController;\n};\n\nexport function resolveServerActionsConfig(\n  config: FarmServerActionsConfig | undefined,\n): ResolvedFarmServerActionsConfig {\n  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);\n  const bodySizeLimit = parseBodySizeLimit(\n    config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,\n  );\n\n  return Object.freeze({\n    allowedOrigins: Object.freeze(allowedOrigins),\n    bodySizeLimit,\n  });\n}\n\nexport function validateServerActionRequest(\n  request: Request,\n  config: ResolvedFarmServerActionsConfig,\n): void {\n  if (request.method.toUpperCase() !== \"POST\") {\n    throw new ServerActionRequestError(\n      \"INVALID_METHOD\",\n      405,\n      \"Server actions only accept POST requests\",\n    );\n  }\n\n  const requestUrl = new URL(request.url);\n  const sourceOrigin = getRequestSourceOrigin(request);\n  const fetchSite = request.headers.get(\"sec-fetch-site\")?.trim().toLowerCase();\n\n  if (!sourceOrigin) {\n    if (fetchSite !== \"same-origin\") {\n      throw new ServerActionRequestError(\n        \"MISSING_ORIGIN\",\n        403,\n        \"Server action request is missing same-origin metadata\",\n      );\n    }\n    return;\n  }\n\n  const matchesRequest =\n    sourceOrigin === requestUrl.origin || matchesHostHeader(sourceOrigin, request);\n  const matchesConfiguredOrigin = config.allowedOrigins.some((pattern) =>\n    matchesAllowedOrigin(sourceOrigin, pattern),\n  );\n\n  if (!matchesRequest && !matchesConfiguredOrigin) {\n    throw new ServerActionRequestError(\n      \"INVALID_ORIGIN\",\n      403,\n      \"Server action origin does not match the request origin\",\n    );\n  }\n\n  if (fetchSite === \"cross-site\" && !matchesConfiguredOrigin) {\n    throw new ServerActionRequestError(\n      \"INVALID_ORIGIN\",\n      403,\n      \"Cross-site server action request was rejected\",\n    );\n  }\n}\n\nexport async function prepareServerActionRequest(\n  request: Request,\n  config: ResolvedFarmServerActionsConfig,\n  kind: ServerActionRequestKind,\n  actionId?: string | null,\n): Promise<PreparedServerActionRequest> {\n  validateServerActionRequest(request, config);\n\n  if (kind === \"javascript\") {\n    validateActionId(actionId);\n  }\n\n  const contentType = getSupportedContentType(request, kind);\n  const bytes = await readBodyWithLimit(request, config.bodySizeLimit);\n\n  if (kind === \"form\" || contentType === \"multipart/form-data\") {\n    return {\n      body: await parseFormData(request, bytes),\n      contentType,\n    };\n  }\n\n  return {\n    body: new TextDecoder().decode(bytes),\n    contentType,\n  };\n}\n\nexport function createServerActionRequestErrorResponse(error: unknown): Response | null {\n  if (!(error instanceof ServerActionRequestError)) {\n    return null;\n  }\n\n  const headers = new Headers({\n    \"cache-control\": \"no-store\",\n    \"content-type\": \"text/plain; charset=utf-8\",\n    \"x-content-type-options\": \"nosniff\",\n  });\n  if (error.status === 405) {\n    headers.set(\"allow\", \"POST\");\n  }\n\n  return new Response(getPublicErrorMessage(error.status), {\n    status: error.status,\n    headers,\n  });\n}\n\nexport function sanitizeServerActionError(_error: unknown): SanitizedServerActionError {\n  return {\n    name: \"ServerActionError\",\n    message: \"Server function failed\",\n  };\n}\n\nexport function runWithServerActionRequest<T>(\n  request: Request,\n  callback: () => T | Promise<T>,\n): T | Promise<T> {\n  throwIfAborted(request.signal);\n  return getServerActionStorage().run(\n    {\n      request,\n      signal: request.signal,\n      invalidations: new Set(),\n    },\n    callback,\n  );\n}\n\nexport function getServerActionExecutionContext(): ServerActionExecutionContext | undefined {\n  return getServerActionStorage().getStore();\n}\n\nexport function getServerActionSignal(): AbortSignal {\n  return getServerActionExecutionContext()?.signal ?? getFallbackAbortController().signal;\n}\n\nexport function getServerActionInvalidations(): readonly string[] {\n  return Array.from(getServerActionExecutionContext()?.invalidations ?? []);\n}\n\nsubscribeFarmCacheInvalidation((key) => {\n  getServerActionExecutionContext()?.invalidations.add(key);\n});\n\nfunction getServerActionStorage(): AsyncLocalStorage<ServerActionExecutionContext> {\n  const globalState = globalThis as GlobalWithServerActionStorage;\n  if (!globalState[SERVER_ACTION_STORAGE_KEY]) {\n    globalState[SERVER_ACTION_STORAGE_KEY] = new AsyncLocalStorage<ServerActionExecutionContext>();\n  }\n  return globalState[SERVER_ACTION_STORAGE_KEY]!;\n}\n\nfunction getFallbackAbortController(): AbortController {\n  const globalState = globalThis as GlobalWithServerActionStorage;\n  if (!globalState[FALLBACK_ABORT_CONTROLLER_KEY]) {\n    globalState[FALLBACK_ABORT_CONTROLLER_KEY] = new AbortController();\n  }\n  return globalState[FALLBACK_ABORT_CONTROLLER_KEY]!;\n}\n\nfunction parseBodySizeLimit(value: number | string): number {\n  if (typeof value === \"number\") {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new TypeError(\"serverActions.bodySizeLimit must be a positive safe integer\");\n    }\n    return value;\n  }\n\n  const match = value\n    .trim()\n    .toLowerCase()\n    .match(/^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb|kib|mib|gib)?$/);\n  if (!match) {\n    throw new TypeError(\n      'serverActions.bodySizeLimit must be bytes or a size string such as \"500kb\" or \"1mb\"',\n    );\n  }\n\n  const amount = Number(match[1]);\n  const unit = match[2] ?? \"b\";\n  const multiplier: Record<string, number> = {\n    b: 1,\n    kb: 1_000,\n    mb: 1_000_000,\n    gb: 1_000_000_000,\n    kib: 1_024,\n    mib: 1_048_576,\n    gib: 1_073_741_824,\n  };\n  const bytes = Math.floor(amount * multiplier[unit]);\n\n  if (!Number.isSafeInteger(bytes) || bytes <= 0) {\n    throw new TypeError(\"serverActions.bodySizeLimit must resolve to a positive safe integer\");\n  }\n\n  return bytes;\n}\n\nfunction normalizeAllowedOriginPattern(value: string): string {\n  const pattern = value.trim().toLowerCase();\n  if (!pattern) {\n    throw new TypeError(\"serverActions.allowedOrigins cannot contain empty values\");\n  }\n\n  if (pattern.includes(\"*\")) {\n    if (!/^(?:https?:\\/\\/)?\\*\\.[a-z0-9.-]+(?::\\d+)?$/.test(pattern)) {\n      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);\n    }\n    return pattern;\n  }\n\n  if (pattern.includes(\"://\")) {\n    let parsed: URL;\n    try {\n      parsed = new URL(pattern);\n    } catch {\n      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);\n    }\n\n    if (\n      (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n      parsed.username ||\n      parsed.password ||\n      parsed.pathname !== \"/\" ||\n      parsed.search ||\n      parsed.hash\n    ) {\n      throw new TypeError(\n        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`,\n      );\n    }\n    return parsed.origin;\n  }\n\n  if (/[/@?#]/.test(pattern)) {\n    throw new TypeError(\n      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`,\n    );\n  }\n\n  try {\n    return new URL(`http://${pattern}`).host;\n  } catch {\n    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);\n  }\n}\n\nfunction getRequestSourceOrigin(request: Request): string | null {\n  const origin = request.headers.get(\"origin\")?.trim();\n  if (origin) {\n    return parseSourceOrigin(origin);\n  }\n\n  const referer = request.headers.get(\"referer\")?.trim();\n  if (referer) {\n    return parseSourceOrigin(referer);\n  }\n\n  return null;\n}\n\nfunction parseSourceOrigin(value: string): string {\n  if (value === \"null\") {\n    throw new ServerActionRequestError(\"INVALID_ORIGIN\", 403, \"Opaque origins are not allowed\");\n  }\n\n  try {\n    const parsed = new URL(value);\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n      throw new Error(\"Unsupported protocol\");\n    }\n    return parsed.origin;\n  } catch {\n    throw new ServerActionRequestError(\"INVALID_ORIGIN\", 403, \"Invalid request origin\");\n  }\n}\n\nfunction matchesHostHeader(sourceOrigin: string, request: Request): boolean {\n  const host = request.headers.get(\"host\")?.trim().toLowerCase();\n  if (!host) return false;\n\n  try {\n    const source = new URL(sourceOrigin);\n    const target = new URL(request.url);\n    return source.protocol === target.protocol && source.host.toLowerCase() === host;\n  } catch {\n    return false;\n  }\n}\n\nfunction matchesAllowedOrigin(sourceOrigin: string, pattern: string): boolean {\n  const source = new URL(sourceOrigin);\n  if (!pattern.includes(\"*\")) {\n    return pattern.includes(\"://\") ? source.origin === pattern : source.host === pattern;\n  }\n\n  const schemeEnd = pattern.indexOf(\"://\");\n  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);\n  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);\n  const [wildcardHost, port] = splitHostAndPort(hostPattern);\n  const baseHost = wildcardHost.slice(2);\n\n  if (scheme && source.protocol !== scheme) return false;\n  if (port && getEffectivePort(source) !== port) return false;\n  if (!port && source.port) return false;\n\n  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;\n}\n\nfunction splitHostAndPort(value: string): [string, string | null] {\n  const separator = value.lastIndexOf(\":\");\n  if (separator === -1) return [value, null];\n  return [value.slice(0, separator), value.slice(separator + 1)];\n}\n\nfunction getEffectivePort(url: URL): string {\n  if (url.port) return url.port;\n  if (url.protocol === \"https:\") return \"443\";\n  if (url.protocol === \"http:\") return \"80\";\n  return \"\";\n}\n\nfunction validateActionId(actionId?: string | null): asserts actionId is string {\n  if (!actionId || actionId.length > 4096 || hasControlCharacters(actionId)) {\n    throw new ServerActionRequestError(\"INVALID_ACTION_ID\", 400, \"Invalid server action id\");\n  }\n}\n\nfunction hasControlCharacters(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code <= 31 || code === 127) return true;\n  }\n  return false;\n}\n\nfunction getSupportedContentType(request: Request, kind: ServerActionRequestKind): string {\n  const header = request.headers.get(\"content-type\")?.trim().toLowerCase();\n  const contentType = header?.split(\";\", 1)[0]?.trim() ?? \"\";\n  const supported = kind === \"form\" ? FORM_ACTION_CONTENT_TYPES : JAVASCRIPT_ACTION_CONTENT_TYPES;\n\n  if (!supported.has(contentType)) {\n    throw new ServerActionRequestError(\n      \"UNSUPPORTED_CONTENT_TYPE\",\n      415,\n      \"Unsupported server action content type\",\n    );\n  }\n\n  return contentType;\n}\n\nasync function readBodyWithLimit(request: Request, limit: number): Promise<Uint8Array> {\n  const contentLength = request.headers.get(\"content-length\")?.trim();\n  if (contentLength) {\n    if (!/^\\d+$/.test(contentLength)) {\n      throw new ServerActionRequestError(\n        \"INVALID_CONTENT_LENGTH\",\n        400,\n        \"Invalid content-length header\",\n      );\n    }\n    if (Number(contentLength) > limit) {\n      throw new ServerActionRequestError(\"BODY_TOO_LARGE\", 413, \"Server action body is too large\");\n    }\n  }\n\n  throwIfAborted(request.signal);\n  if (!request.body) return new Uint8Array();\n\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  const cancelBodyRead = () => {\n    void reader.cancel(request.signal.reason).catch(() => {});\n  };\n\n  request.signal.addEventListener(\"abort\", cancelBodyRead, { once: true });\n\n  try {\n    while (true) {\n      throwIfAborted(request.signal);\n      const { done, value } = await reader.read();\n      if (done) break;\n      if (!value) continue;\n\n      total += value.byteLength;\n      if (total > limit) {\n        await reader.cancel(\"Server action body is too large\");\n        throw new ServerActionRequestError(\n          \"BODY_TOO_LARGE\",\n          413,\n          \"Server action body is too large\",\n        );\n      }\n      chunks.push(value);\n    }\n  } catch (error) {\n    if (request.signal.aborted) throwIfAborted(request.signal);\n    throw error;\n  } finally {\n    request.signal.removeEventListener(\"abort\", cancelBodyRead);\n    reader.releaseLock();\n  }\n\n  throwIfAborted(request.signal);\n  const body = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body;\n}\n\nasync function parseFormData(request: Request, bytes: Uint8Array): Promise<FormData> {\n  const body = new ArrayBuffer(bytes.byteLength);\n  new Uint8Array(body).set(bytes);\n  const copy = new Request(request.url, {\n    method: \"POST\",\n    headers: request.headers,\n    body,\n  });\n\n  try {\n    return await copy.formData();\n  } catch {\n    throw new ServerActionRequestError(\"INVALID_BODY\", 400, \"Invalid server action form body\");\n  }\n}\n\nfunction getPublicErrorMessage(status: number): string {\n  switch (status) {\n    case 400:\n      return \"Bad Request\";\n    case 403:\n      return \"Forbidden\";\n    case 405:\n      return \"Method Not Allowed\";\n    case 413:\n      return \"Payload Too Large\";\n    case 415:\n      return \"Unsupported Media Type\";\n    default:\n      return \"Server Action Request Failed\";\n  }\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (!signal.aborted) return;\n  if (signal.reason !== undefined) throw signal.reason;\n  throw new DOMException(\"The operation was aborted\", \"AbortError\");\n}\n","export type FarmCacheInvalidationListener = (key: string) => void;\n\nexport const FARM_CACHE_INVALIDATION_HEADER = \"x-farm-cache-invalidations\";\n\ntype FarmCacheInvalidationState = {\n  listeners: Set<FarmCacheInvalidationListener>;\n};\n\nconst FARM_CACHE_INVALIDATION_STATE = Symbol.for(\"farm.cacheInvalidationState\");\nconst globalState = globalThis as typeof globalThis & {\n  [FARM_CACHE_INVALIDATION_STATE]?: FarmCacheInvalidationState;\n};\n\nfunction getFarmCacheInvalidationState(): FarmCacheInvalidationState {\n  return (globalState[FARM_CACHE_INVALIDATION_STATE] ??= {\n    listeners: new Set(),\n  });\n}\n\nexport function notifyFarmCacheInvalidation(key: string): void {\n  if (typeof key !== \"string\" || key.length === 0) return;\n\n  for (const listener of getFarmCacheInvalidationState().listeners) {\n    listener(key);\n  }\n}\n\nexport function applyFarmCacheInvalidations(keys: unknown): void {\n  if (!Array.isArray(keys)) return;\n\n  for (const key of keys) {\n    if (typeof key === \"string\") {\n      notifyFarmCacheInvalidation(key);\n    }\n  }\n}\n\nexport function encodeFarmCacheInvalidations(keys: readonly string[]): string | null {\n  const normalized = Array.from(\n    new Set(keys.filter((key) => typeof key === \"string\" && key.length > 0)),\n  );\n  if (normalized.length === 0) return null;\n  return encodeURIComponent(JSON.stringify(normalized));\n}\n\nexport function decodeFarmCacheInvalidations(value: string | null | undefined): readonly string[] {\n  if (!value) return [];\n\n  try {\n    const parsed = JSON.parse(decodeURIComponent(value));\n    return Array.isArray(parsed)\n      ? Array.from(\n          new Set(parsed.filter((key): key is string => typeof key === \"string\" && key.length > 0)),\n        )\n      : [];\n  } catch {\n    return [];\n  }\n}\n\nexport function subscribeFarmCacheInvalidation(\n  listener: FarmCacheInvalidationListener,\n): () => void {\n  const state = getFarmCacheInvalidationState();\n  state.listeners.add(listener);\n  return () => state.listeners.delete(listener);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,8BAAkC;;;ACQlC,IAAM,gCAAgC,uBAAO,IAAI,6BAA6B;AAC9E,IAAM,cAAc;AAIpB,SAAS,gCAA4D;AACnE,SAAQ,4FAA+C;AAAA,IACrD,WAAW,oBAAI,IAAI;AAAA,EACrB;AACF;AAJS;AA+CF,SAAS,+BACd,UACY;AACZ,QAAM,QAAQ,8BAA8B;AAC5C,QAAM,UAAU,IAAI,QAAQ;AAC5B,SAAO,MAAM,MAAM,UAAU,OAAO,QAAQ;AAC9C;AANgB;;;ADzDT,IAAM,wCAAwC;AAoC9C,IAAM,4BAAN,MAAM,kCAAiC,MAAM;AAAA,EAIlD,YAAY,MAAoC,QAAgB,SAAiB;AAC/E,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAVoD;AAA7C,IAAM,2BAAN;AAkBP,IAAM,4BAA4B,uBAAO,IAAI,0BAA0B;AACvE,IAAM,gCAAgC,uBAAO,IAAI,0CAA0C;AAC3F,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AACF,CAAC;AACD,IAAM,kCAAkC,oBAAI,IAAI;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,SAAS,2BACd,QACiC;AACjC,QAAM,kBAAkB,QAAQ,kBAAkB,CAAC,GAAG,IAAI,6BAA6B;AACvF,QAAM,gBAAgB;AAAA,IACpB,QAAQ,iBAAiB;AAAA,EAC3B;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,gBAAgB,OAAO,OAAO,cAAc;AAAA,IAC5C;AAAA,EACF,CAAC;AACH;AAZgB;AAcT,SAAS,4BACd,SACA,QACM;AACN,MAAI,QAAQ,OAAO,YAAY,MAAM,QAAQ;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AACtC,QAAM,eAAe,uBAAuB,OAAO;AACnD,QAAM,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK,EAAE,YAAY;AAE5E,MAAI,CAAC,cAAc;AACjB,QAAI,cAAc,eAAe;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAEA,QAAM,iBACJ,iBAAiB,WAAW,UAAU,kBAAkB,cAAc,OAAO;AAC/E,QAAM,0BAA0B,OAAO,eAAe;AAAA,IAAK,CAAC,YAC1D,qBAAqB,cAAc,OAAO;AAAA,EAC5C;AAEA,MAAI,CAAC,kBAAkB,CAAC,yBAAyB;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,cAAc,gBAAgB,CAAC,yBAAyB;AAC1D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;AAkDhB,eAAsB,2BACpB,SACA,QACA,MACA,UACsC;AACtC,8BAA4B,SAAS,MAAM;AAE3C,MAAI,SAAS,cAAc;AACzB,qBAAiB,QAAQ;AAAA,EAC3B;AAEA,QAAM,cAAc,wBAAwB,SAAS,IAAI;AACzD,QAAM,QAAQ,MAAM,kBAAkB,SAAS,OAAO,aAAa;AAEnE,MAAI,SAAS,UAAU,gBAAgB,uBAAuB;AAC5D,WAAO;AAAA,MACL,MAAM,MAAM,cAAc,SAAS,KAAK;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IACpC;AAAA,EACF;AACF;AA1BsB;AA4Bf,SAAS,uCAAuC,OAAiC;AACtF,MAAI,EAAE,iBAAiB,2BAA2B;AAChD,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,iBAAiB;AAAA,IACjB,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,CAAC;AACD,MAAI,MAAM,WAAW,KAAK;AACxB,YAAQ,IAAI,SAAS,MAAM;AAAA,EAC7B;AAEA,SAAO,IAAI,SAAS,sBAAsB,MAAM,MAAM,GAAG;AAAA,IACvD,QAAQ,MAAM;AAAA,IACd;AAAA,EACF,CAAC;AACH;AAlBgB;AAoBT,SAAS,0BAA0B,QAA6C;AACrF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AALgB;AAOT,SAAS,2BACd,SACA,UACgB;AAChB,iBAAe,QAAQ,MAAM;AAC7B,SAAO,uBAAuB,EAAE;AAAA,IAC9B;AAAA,MACE;AAAA,MACA,QAAQ,QAAQ;AAAA,MAChB,eAAe,oBAAI,IAAI;AAAA,IACzB;AAAA,IACA;AAAA,EACF;AACF;AAbgB;AAeT,SAAS,kCAA4E;AAC1F,SAAO,uBAAuB,EAAE,SAAS;AAC3C;AAFgB;AAIT,SAAS,wBAAqC;AACnD,SAAO,gCAAgC,GAAG,UAAU,2BAA2B,EAAE;AACnF;AAFgB;AAIT,SAAS,+BAAkD;AAChE,SAAO,MAAM,KAAK,gCAAgC,GAAG,iBAAiB,CAAC,CAAC;AAC1E;AAFgB;AAIhB,+BAA+B,CAAC,QAAQ;AACtC,kCAAgC,GAAG,cAAc,IAAI,GAAG;AAC1D,CAAC;AAED,SAAS,yBAA0E;AACjF,QAAMA,eAAc;AACpB,MAAI,CAACA,aAAY,yBAAyB,GAAG;AAC3C,IAAAA,aAAY,yBAAyB,IAAI,IAAI,0CAAgD;AAAA,EAC/F;AACA,SAAOA,aAAY,yBAAyB;AAC9C;AANS;AAQT,SAAS,6BAA8C;AACrD,QAAMA,eAAc;AACpB,MAAI,CAACA,aAAY,6BAA6B,GAAG;AAC/C,IAAAA,aAAY,6BAA6B,IAAI,IAAI,gBAAgB;AAAA,EACnE;AACA,SAAOA,aAAY,6BAA6B;AAClD;AANS;AAQT,SAAS,mBAAmB,OAAgC;AAC1D,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,YAAM,IAAI,UAAU,6DAA6D;AAAA,IACnF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MACX,KAAK,EACL,YAAY,EACZ,MAAM,+CAA+C;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,OAAO,MAAM,CAAC,KAAK;AACzB,QAAM,aAAqC;AAAA,IACzC,GAAG;AAAA,IACH,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACA,QAAM,QAAQ,KAAK,MAAM,SAAS,WAAW,IAAI,CAAC;AAElD,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,UAAM,IAAI,UAAU,qEAAqE;AAAA,EAC3F;AAEA,SAAO;AACT;AApCS;AAsCT,SAAS,8BAA8B,OAAuB;AAC5D,QAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,UAAU,0DAA0D;AAAA,EAChF;AAEA,MAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,QAAI,CAAC,6CAA6C,KAAK,OAAO,GAAG;AAC/D,YAAM,IAAI,UAAU,iDAAiD,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC9F;AACA,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,SAAS,KAAK,GAAG;AAC3B,QAAI;AACJ,QAAI;AACF,eAAS,IAAI,IAAI,OAAO;AAAA,IAC1B,QAAQ;AACN,YAAM,IAAI,UAAU,+CAA+C,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC5F;AAEA,QACG,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,OAAO,YACP,OAAO,YACP,OAAO,aAAa,OACpB,OAAO,UACP,OAAO,MACP;AACA,YAAM,IAAI;AAAA,QACR,oEAAoE,KAAK,UAAU,KAAK,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,SAAS,KAAK,OAAO,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,+DAA+D,KAAK,UAAU,KAAK,CAAC;AAAA,IACtF;AAAA,EACF;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,OAAO,EAAE,EAAE;AAAA,EACtC,QAAQ;AACN,UAAM,IAAI,UAAU,+CAA+C,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EAC5F;AACF;AA/CS;AAiDT,SAAS,uBAAuB,SAAiC;AAC/D,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ,GAAG,KAAK;AACnD,MAAI,QAAQ;AACV,WAAO,kBAAkB,MAAM;AAAA,EACjC;AAEA,QAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS,GAAG,KAAK;AACrD,MAAI,SAAS;AACX,WAAO,kBAAkB,OAAO;AAAA,EAClC;AAEA,SAAO;AACT;AAZS;AAcT,SAAS,kBAAkB,OAAuB;AAChD,MAAI,UAAU,QAAQ;AACpB,UAAM,IAAI,yBAAyB,kBAAkB,KAAK,gCAAgC;AAAA,EAC5F;AAEA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AACA,WAAO,OAAO;AAAA,EAChB,QAAQ;AACN,UAAM,IAAI,yBAAyB,kBAAkB,KAAK,wBAAwB;AAAA,EACpF;AACF;AAdS;AAgBT,SAAS,kBAAkB,cAAsB,SAA2B;AAC1E,QAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM,GAAG,KAAK,EAAE,YAAY;AAC7D,MAAI,CAAC,KAAM,QAAO;AAElB,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,YAAY;AACnC,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;AAClC,WAAO,OAAO,aAAa,OAAO,YAAY,OAAO,KAAK,YAAY,MAAM;AAAA,EAC9E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAXS;AAaT,SAAS,qBAAqB,cAAsB,SAA0B;AAC5E,QAAM,SAAS,IAAI,IAAI,YAAY;AACnC,MAAI,CAAC,QAAQ,SAAS,GAAG,GAAG;AAC1B,WAAO,QAAQ,SAAS,KAAK,IAAI,OAAO,WAAW,UAAU,OAAO,SAAS;AAAA,EAC/E;AAEA,QAAM,YAAY,QAAQ,QAAQ,KAAK;AACvC,QAAM,SAAS,cAAc,KAAK,OAAO,QAAQ,MAAM,GAAG,YAAY,CAAC;AACvE,QAAM,cAAc,QAAQ,MAAM,cAAc,KAAK,IAAI,YAAY,CAAC;AACtE,QAAM,CAAC,cAAc,IAAI,IAAI,iBAAiB,WAAW;AACzD,QAAM,WAAW,aAAa,MAAM,CAAC;AAErC,MAAI,UAAU,OAAO,aAAa,OAAQ,QAAO;AACjD,MAAI,QAAQ,iBAAiB,MAAM,MAAM,KAAM,QAAO;AACtD,MAAI,CAAC,QAAQ,OAAO,KAAM,QAAO;AAEjC,SAAO,OAAO,SAAS,SAAS,IAAI,QAAQ,EAAE,KAAK,OAAO,aAAa;AACzE;AAjBS;AAmBT,SAAS,iBAAiB,OAAwC;AAChE,QAAM,YAAY,MAAM,YAAY,GAAG;AACvC,MAAI,cAAc,GAAI,QAAO,CAAC,OAAO,IAAI;AACzC,SAAO,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,MAAM,MAAM,YAAY,CAAC,CAAC;AAC/D;AAJS;AAMT,SAAS,iBAAiB,KAAkB;AAC1C,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AALS;AAOT,SAAS,iBAAiB,UAAsD;AAC9E,MAAI,CAAC,YAAY,SAAS,SAAS,QAAQ,qBAAqB,QAAQ,GAAG;AACzE,UAAM,IAAI,yBAAyB,qBAAqB,KAAK,0BAA0B;AAAA,EACzF;AACF;AAJS;AAMT,SAAS,qBAAqB,OAAwB;AACpD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,MAAM,SAAS,IAAK,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AANS;AAQT,SAAS,wBAAwB,SAAkB,MAAuC;AACxF,QAAM,SAAS,QAAQ,QAAQ,IAAI,cAAc,GAAG,KAAK,EAAE,YAAY;AACvE,QAAM,cAAc,QAAQ,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,KAAK;AACxD,QAAM,YAAY,SAAS,SAAS,4BAA4B;AAEhE,MAAI,CAAC,UAAU,IAAI,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAdS;AAgBT,eAAe,kBAAkB,SAAkB,OAAoC;AACrF,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK;AAClE,MAAI,eAAe;AACjB,QAAI,CAAC,QAAQ,KAAK,aAAa,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAa,IAAI,OAAO;AACjC,YAAM,IAAI,yBAAyB,kBAAkB,KAAK,iCAAiC;AAAA,IAC7F;AAAA,EACF;AAEA,iBAAe,QAAQ,MAAM;AAC7B,MAAI,CAAC,QAAQ,KAAM,QAAO,IAAI,WAAW;AAEzC,QAAM,SAAS,QAAQ,KAAK,UAAU;AACtC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,QAAM,iBAAiB,6BAAM;AAC3B,SAAK,OAAO,OAAO,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC1D,GAFuB;AAIvB,UAAQ,OAAO,iBAAiB,SAAS,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAEvE,MAAI;AACF,WAAO,MAAM;AACX,qBAAe,QAAQ,MAAM;AAC7B,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,UAAI,CAAC,MAAO;AAEZ,eAAS,MAAM;AACf,UAAI,QAAQ,OAAO;AACjB,cAAM,OAAO,OAAO,iCAAiC;AACrD,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAS,gBAAe,QAAQ,MAAM;AACzD,UAAM;AAAA,EACR,UAAE;AACA,YAAQ,OAAO,oBAAoB,SAAS,cAAc;AAC1D,WAAO,YAAY;AAAA,EACrB;AAEA,iBAAe,QAAQ,MAAM;AAC7B,QAAM,OAAO,IAAI,WAAW,KAAK;AACjC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AA7De;AA+Df,eAAe,cAAc,SAAkB,OAAsC;AACnF,QAAM,OAAO,IAAI,YAAY,MAAM,UAAU;AAC7C,MAAI,WAAW,IAAI,EAAE,IAAI,KAAK;AAC9B,QAAM,OAAO,IAAI,QAAQ,QAAQ,KAAK;AAAA,IACpC,QAAQ;AAAA,IACR,SAAS,QAAQ;AAAA,IACjB;AAAA,EACF,CAAC;AAED,MAAI;AACF,WAAO,MAAM,KAAK,SAAS;AAAA,EAC7B,QAAQ;AACN,UAAM,IAAI,yBAAyB,gBAAgB,KAAK,iCAAiC;AAAA,EAC3F;AACF;AAde;AAgBf,SAAS,sBAAsB,QAAwB;AACrD,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAfS;AAiBT,SAAS,eAAe,QAA2B;AACjD,MAAI,CAAC,OAAO,QAAS;AACrB,MAAI,OAAO,WAAW,OAAW,OAAM,OAAO;AAC9C,QAAM,IAAI,aAAa,6BAA6B,YAAY;AAClE;AAJS;","names":["globalState"]}
+{"version":3,"sources":["../src/server-action-security.ts","../src/cache-invalidation.ts"],"sourcesContent":["import { AsyncLocalStorage } from \"node:async_hooks\";\nimport { subscribeFarmCacheInvalidation, subscribeFarmCacheTask } from \"./cache-invalidation\";\n\nexport const DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1_000_000;\n\nexport interface FarmServerActionsConfig {\n  /** Additional trusted origins or host patterns, such as https://app.example.com. */\n  allowedOrigins?: readonly string[];\n  /** Maximum encoded request body size in bytes or as a size string such as \"1mb\". */\n  bodySizeLimit?: number | string;\n}\n\nexport interface ResolvedFarmServerActionsConfig {\n  allowedOrigins: readonly string[];\n  bodySizeLimit: number;\n}\n\nexport type ServerActionRequestKind = \"javascript\" | \"form\";\n\nexport interface PreparedServerActionRequest {\n  body: string | FormData;\n  contentType: string;\n}\n\nexport type SanitizedServerActionError = {\n  name: \"ServerActionError\";\n  message: \"Server function failed\";\n};\n\ntype ServerActionRequestErrorCode =\n  | \"BODY_TOO_LARGE\"\n  | \"INVALID_ACTION_ID\"\n  | \"INVALID_BODY\"\n  | \"INVALID_CONTENT_LENGTH\"\n  | \"INVALID_METHOD\"\n  | \"INVALID_ORIGIN\"\n  | \"MISSING_ORIGIN\"\n  | \"UNSUPPORTED_CONTENT_TYPE\";\n\nexport class ServerActionRequestError extends Error {\n  readonly code: ServerActionRequestErrorCode;\n  readonly status: number;\n\n  constructor(code: ServerActionRequestErrorCode, status: number, message: string) {\n    super(message);\n    this.name = \"ServerActionRequestError\";\n    this.code = code;\n    this.status = status;\n  }\n}\n\ntype ServerActionExecutionContext = {\n  request: Request;\n  signal: AbortSignal;\n  invalidations: Set<string>;\n  cacheTasks: Set<Promise<void>>;\n};\n\nconst SERVER_ACTION_STORAGE_KEY = Symbol.for(\"farm.serverActionStorage\");\nconst FALLBACK_ABORT_CONTROLLER_KEY = Symbol.for(\"farm.serverActionFallbackAbortController\");\nconst FORM_ACTION_CONTENT_TYPES = new Set([\n  \"application/x-www-form-urlencoded\",\n  \"multipart/form-data\",\n]);\nconst JAVASCRIPT_ACTION_CONTENT_TYPES = new Set([\n  \"application/octet-stream\",\n  \"application/x-www-form-urlencoded\",\n  \"multipart/form-data\",\n  \"text/plain\",\n]);\n\ntype GlobalWithServerActionStorage = typeof globalThis & {\n  [SERVER_ACTION_STORAGE_KEY]?: AsyncLocalStorage<ServerActionExecutionContext>;\n  [FALLBACK_ABORT_CONTROLLER_KEY]?: AbortController;\n};\n\nexport function resolveServerActionsConfig(\n  config: FarmServerActionsConfig | undefined,\n): ResolvedFarmServerActionsConfig {\n  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);\n  const bodySizeLimit = parseBodySizeLimit(\n    config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,\n  );\n\n  return Object.freeze({\n    allowedOrigins: Object.freeze(allowedOrigins),\n    bodySizeLimit,\n  });\n}\n\nexport function validateServerActionRequest(\n  request: Request,\n  config: ResolvedFarmServerActionsConfig,\n): void {\n  if (request.method.toUpperCase() !== \"POST\") {\n    throw new ServerActionRequestError(\n      \"INVALID_METHOD\",\n      405,\n      \"Server actions only accept POST requests\",\n    );\n  }\n\n  const requestUrl = new URL(request.url);\n  const sourceOrigin = getRequestSourceOrigin(request);\n  const fetchSite = request.headers.get(\"sec-fetch-site\")?.trim().toLowerCase();\n\n  if (!sourceOrigin) {\n    if (fetchSite !== \"same-origin\") {\n      throw new ServerActionRequestError(\n        \"MISSING_ORIGIN\",\n        403,\n        \"Server action request is missing same-origin metadata\",\n      );\n    }\n    return;\n  }\n\n  const matchesRequest =\n    sourceOrigin === requestUrl.origin || matchesHostHeader(sourceOrigin, request);\n  const matchesConfiguredOrigin = config.allowedOrigins.some((pattern) =>\n    matchesAllowedOrigin(sourceOrigin, pattern),\n  );\n\n  if (!matchesRequest && !matchesConfiguredOrigin) {\n    throw new ServerActionRequestError(\n      \"INVALID_ORIGIN\",\n      403,\n      \"Server action origin does not match the request origin\",\n    );\n  }\n\n  if (fetchSite === \"cross-site\" && !matchesConfiguredOrigin) {\n    throw new ServerActionRequestError(\n      \"INVALID_ORIGIN\",\n      403,\n      \"Cross-site server action request was rejected\",\n    );\n  }\n}\n\nexport async function prepareServerActionRequest(\n  request: Request,\n  config: ResolvedFarmServerActionsConfig,\n  kind: ServerActionRequestKind,\n  actionId?: string | null,\n): Promise<PreparedServerActionRequest> {\n  validateServerActionRequest(request, config);\n\n  if (kind === \"javascript\") {\n    validateActionId(actionId);\n  }\n\n  const contentType = getSupportedContentType(request, kind);\n  const bytes = await readBodyWithLimit(request, config.bodySizeLimit);\n\n  if (kind === \"form\" || contentType === \"multipart/form-data\") {\n    return {\n      body: await parseFormData(request, bytes),\n      contentType,\n    };\n  }\n\n  return {\n    body: new TextDecoder().decode(bytes),\n    contentType,\n  };\n}\n\nexport function createServerActionRequestErrorResponse(error: unknown): Response | null {\n  if (!(error instanceof ServerActionRequestError)) {\n    return null;\n  }\n\n  const headers = new Headers({\n    \"cache-control\": \"no-store\",\n    \"content-type\": \"text/plain; charset=utf-8\",\n    \"x-content-type-options\": \"nosniff\",\n  });\n  if (error.status === 405) {\n    headers.set(\"allow\", \"POST\");\n  }\n\n  return new Response(getPublicErrorMessage(error.status), {\n    status: error.status,\n    headers,\n  });\n}\n\nexport function sanitizeServerActionError(_error: unknown): SanitizedServerActionError {\n  return {\n    name: \"ServerActionError\",\n    message: \"Server function failed\",\n  };\n}\n\nexport async function runWithServerActionRequest<T>(\n  request: Request,\n  callback: () => T | Promise<T>,\n): Promise<T> {\n  throwIfAborted(request.signal);\n  const context: ServerActionExecutionContext = {\n    request,\n    signal: request.signal,\n    invalidations: new Set(),\n    cacheTasks: new Set(),\n  };\n\n  return getServerActionStorage().run(context, async () => {\n    try {\n      const result = await callback();\n      await Promise.all(context.cacheTasks);\n      return result;\n    } catch (error) {\n      await Promise.allSettled(context.cacheTasks);\n      throw error;\n    }\n  });\n}\n\nexport function getServerActionExecutionContext(): ServerActionExecutionContext | undefined {\n  return getServerActionStorage().getStore();\n}\n\nexport function getServerActionSignal(): AbortSignal {\n  return getServerActionExecutionContext()?.signal ?? getFallbackAbortController().signal;\n}\n\nexport function getServerActionInvalidations(): readonly string[] {\n  return Array.from(getServerActionExecutionContext()?.invalidations ?? []);\n}\n\nsubscribeFarmCacheInvalidation((key) => {\n  getServerActionExecutionContext()?.invalidations.add(key);\n});\n\nsubscribeFarmCacheTask((task) => {\n  getServerActionExecutionContext()?.cacheTasks.add(task);\n});\n\nfunction getServerActionStorage(): AsyncLocalStorage<ServerActionExecutionContext> {\n  const globalState = globalThis as GlobalWithServerActionStorage;\n  if (!globalState[SERVER_ACTION_STORAGE_KEY]) {\n    globalState[SERVER_ACTION_STORAGE_KEY] = new AsyncLocalStorage<ServerActionExecutionContext>();\n  }\n  return globalState[SERVER_ACTION_STORAGE_KEY]!;\n}\n\nfunction getFallbackAbortController(): AbortController {\n  const globalState = globalThis as GlobalWithServerActionStorage;\n  if (!globalState[FALLBACK_ABORT_CONTROLLER_KEY]) {\n    globalState[FALLBACK_ABORT_CONTROLLER_KEY] = new AbortController();\n  }\n  return globalState[FALLBACK_ABORT_CONTROLLER_KEY]!;\n}\n\nfunction parseBodySizeLimit(value: number | string): number {\n  if (typeof value === \"number\") {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new TypeError(\"serverActions.bodySizeLimit must be a positive safe integer\");\n    }\n    return value;\n  }\n\n  const match = value\n    .trim()\n    .toLowerCase()\n    .match(/^(\\d+(?:\\.\\d+)?)\\s*(b|kb|mb|gb|kib|mib|gib)?$/);\n  if (!match) {\n    throw new TypeError(\n      'serverActions.bodySizeLimit must be bytes or a size string such as \"500kb\" or \"1mb\"',\n    );\n  }\n\n  const amount = Number(match[1]);\n  const unit = match[2] ?? \"b\";\n  const multiplier: Record<string, number> = {\n    b: 1,\n    kb: 1_000,\n    mb: 1_000_000,\n    gb: 1_000_000_000,\n    kib: 1_024,\n    mib: 1_048_576,\n    gib: 1_073_741_824,\n  };\n  const bytes = Math.floor(amount * multiplier[unit]);\n\n  if (!Number.isSafeInteger(bytes) || bytes <= 0) {\n    throw new TypeError(\"serverActions.bodySizeLimit must resolve to a positive safe integer\");\n  }\n\n  return bytes;\n}\n\nfunction normalizeAllowedOriginPattern(value: string): string {\n  const pattern = value.trim().toLowerCase();\n  if (!pattern) {\n    throw new TypeError(\"serverActions.allowedOrigins cannot contain empty values\");\n  }\n\n  if (pattern.includes(\"*\")) {\n    if (!/^(?:https?:\\/\\/)?\\*\\.[a-z0-9.-]+(?::\\d+)?$/.test(pattern)) {\n      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);\n    }\n    return pattern;\n  }\n\n  if (pattern.includes(\"://\")) {\n    let parsed: URL;\n    try {\n      parsed = new URL(pattern);\n    } catch {\n      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);\n    }\n\n    if (\n      (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") ||\n      parsed.username ||\n      parsed.password ||\n      parsed.pathname !== \"/\" ||\n      parsed.search ||\n      parsed.hash\n    ) {\n      throw new TypeError(\n        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`,\n      );\n    }\n    return parsed.origin;\n  }\n\n  if (/[/@?#]/.test(pattern)) {\n    throw new TypeError(\n      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`,\n    );\n  }\n\n  try {\n    return new URL(`http://${pattern}`).host;\n  } catch {\n    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);\n  }\n}\n\nfunction getRequestSourceOrigin(request: Request): string | null {\n  const origin = request.headers.get(\"origin\")?.trim();\n  if (origin) {\n    return parseSourceOrigin(origin);\n  }\n\n  const referer = request.headers.get(\"referer\")?.trim();\n  if (referer) {\n    return parseSourceOrigin(referer);\n  }\n\n  return null;\n}\n\nfunction parseSourceOrigin(value: string): string {\n  if (value === \"null\") {\n    throw new ServerActionRequestError(\"INVALID_ORIGIN\", 403, \"Opaque origins are not allowed\");\n  }\n\n  try {\n    const parsed = new URL(value);\n    if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n      throw new Error(\"Unsupported protocol\");\n    }\n    return parsed.origin;\n  } catch {\n    throw new ServerActionRequestError(\"INVALID_ORIGIN\", 403, \"Invalid request origin\");\n  }\n}\n\nfunction matchesHostHeader(sourceOrigin: string, request: Request): boolean {\n  const host = request.headers.get(\"host\")?.trim().toLowerCase();\n  if (!host) return false;\n\n  try {\n    const source = new URL(sourceOrigin);\n    const target = new URL(request.url);\n    return source.protocol === target.protocol && source.host.toLowerCase() === host;\n  } catch {\n    return false;\n  }\n}\n\nfunction matchesAllowedOrigin(sourceOrigin: string, pattern: string): boolean {\n  const source = new URL(sourceOrigin);\n  if (!pattern.includes(\"*\")) {\n    return pattern.includes(\"://\") ? source.origin === pattern : source.host === pattern;\n  }\n\n  const schemeEnd = pattern.indexOf(\"://\");\n  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);\n  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);\n  const [wildcardHost, port] = splitHostAndPort(hostPattern);\n  const baseHost = wildcardHost.slice(2);\n\n  if (scheme && source.protocol !== scheme) return false;\n  if (port && getEffectivePort(source) !== port) return false;\n  if (!port && source.port) return false;\n\n  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;\n}\n\nfunction splitHostAndPort(value: string): [string, string | null] {\n  const separator = value.lastIndexOf(\":\");\n  if (separator === -1) return [value, null];\n  return [value.slice(0, separator), value.slice(separator + 1)];\n}\n\nfunction getEffectivePort(url: URL): string {\n  if (url.port) return url.port;\n  if (url.protocol === \"https:\") return \"443\";\n  if (url.protocol === \"http:\") return \"80\";\n  return \"\";\n}\n\nfunction validateActionId(actionId?: string | null): asserts actionId is string {\n  if (!actionId || actionId.length > 4096 || hasControlCharacters(actionId)) {\n    throw new ServerActionRequestError(\"INVALID_ACTION_ID\", 400, \"Invalid server action id\");\n  }\n}\n\nfunction hasControlCharacters(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index);\n    if (code <= 31 || code === 127) return true;\n  }\n  return false;\n}\n\nfunction getSupportedContentType(request: Request, kind: ServerActionRequestKind): string {\n  const header = request.headers.get(\"content-type\")?.trim().toLowerCase();\n  const contentType = header?.split(\";\", 1)[0]?.trim() ?? \"\";\n  const supported = kind === \"form\" ? FORM_ACTION_CONTENT_TYPES : JAVASCRIPT_ACTION_CONTENT_TYPES;\n\n  if (!supported.has(contentType)) {\n    throw new ServerActionRequestError(\n      \"UNSUPPORTED_CONTENT_TYPE\",\n      415,\n      \"Unsupported server action content type\",\n    );\n  }\n\n  return contentType;\n}\n\nasync function readBodyWithLimit(request: Request, limit: number): Promise<Uint8Array> {\n  const contentLength = request.headers.get(\"content-length\")?.trim();\n  if (contentLength) {\n    if (!/^\\d+$/.test(contentLength)) {\n      throw new ServerActionRequestError(\n        \"INVALID_CONTENT_LENGTH\",\n        400,\n        \"Invalid content-length header\",\n      );\n    }\n    if (Number(contentLength) > limit) {\n      throw new ServerActionRequestError(\"BODY_TOO_LARGE\", 413, \"Server action body is too large\");\n    }\n  }\n\n  throwIfAborted(request.signal);\n  if (!request.body) return new Uint8Array();\n\n  const reader = request.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let total = 0;\n  const cancelBodyRead = () => {\n    void reader.cancel(request.signal.reason).catch(() => {});\n  };\n\n  request.signal.addEventListener(\"abort\", cancelBodyRead, { once: true });\n\n  try {\n    while (true) {\n      throwIfAborted(request.signal);\n      const { done, value } = await reader.read();\n      if (done) break;\n      if (!value) continue;\n\n      total += value.byteLength;\n      if (total > limit) {\n        await reader.cancel(\"Server action body is too large\");\n        throw new ServerActionRequestError(\n          \"BODY_TOO_LARGE\",\n          413,\n          \"Server action body is too large\",\n        );\n      }\n      chunks.push(value);\n    }\n  } catch (error) {\n    if (request.signal.aborted) throwIfAborted(request.signal);\n    throw error;\n  } finally {\n    request.signal.removeEventListener(\"abort\", cancelBodyRead);\n    reader.releaseLock();\n  }\n\n  throwIfAborted(request.signal);\n  const body = new Uint8Array(total);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body;\n}\n\nasync function parseFormData(request: Request, bytes: Uint8Array): Promise<FormData> {\n  const body = new ArrayBuffer(bytes.byteLength);\n  new Uint8Array(body).set(bytes);\n  const copy = new Request(request.url, {\n    method: \"POST\",\n    headers: request.headers,\n    body,\n  });\n\n  try {\n    return await copy.formData();\n  } catch {\n    throw new ServerActionRequestError(\"INVALID_BODY\", 400, \"Invalid server action form body\");\n  }\n}\n\nfunction getPublicErrorMessage(status: number): string {\n  switch (status) {\n    case 400:\n      return \"Bad Request\";\n    case 403:\n      return \"Forbidden\";\n    case 405:\n      return \"Method Not Allowed\";\n    case 413:\n      return \"Payload Too Large\";\n    case 415:\n      return \"Unsupported Media Type\";\n    default:\n      return \"Server Action Request Failed\";\n  }\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (!signal.aborted) return;\n  if (signal.reason !== undefined) throw signal.reason;\n  throw new DOMException(\"The operation was aborted\", \"AbortError\");\n}\n","export type FarmCacheInvalidationListener = (key: string) => void;\nexport type FarmCacheTaskListener = (task: Promise<void>) => void;\n\nexport const FARM_CACHE_INVALIDATION_HEADER = \"x-farm-cache-invalidations\";\n\ntype FarmCacheInvalidationState = {\n  listeners: Set<FarmCacheInvalidationListener>;\n  taskListeners: Set<FarmCacheTaskListener>;\n};\n\nconst FARM_CACHE_INVALIDATION_STATE = Symbol.for(\"farm.cacheInvalidationState\");\nconst globalState = globalThis as typeof globalThis & {\n  [FARM_CACHE_INVALIDATION_STATE]?: FarmCacheInvalidationState;\n};\n\nfunction getFarmCacheInvalidationState(): FarmCacheInvalidationState {\n  return (globalState[FARM_CACHE_INVALIDATION_STATE] ??= {\n    listeners: new Set(),\n    taskListeners: new Set(),\n  });\n}\n\nexport function notifyFarmCacheInvalidation(key: string): void {\n  if (typeof key !== \"string\" || key.length === 0) return;\n\n  for (const listener of getFarmCacheInvalidationState().listeners) {\n    listener(key);\n  }\n}\n\nexport function notifyFarmCacheTask(task: Promise<void>): void {\n  for (const listener of getFarmCacheInvalidationState().taskListeners) {\n    listener(task);\n  }\n}\n\nexport function applyFarmCacheInvalidations(keys: unknown): void {\n  if (!Array.isArray(keys)) return;\n\n  for (const key of keys) {\n    if (typeof key === \"string\") {\n      notifyFarmCacheInvalidation(key);\n    }\n  }\n}\n\nexport function encodeFarmCacheInvalidations(keys: readonly string[]): string | null {\n  const normalized = Array.from(\n    new Set(keys.filter((key) => typeof key === \"string\" && key.length > 0)),\n  );\n  if (normalized.length === 0) return null;\n  return encodeURIComponent(JSON.stringify(normalized));\n}\n\nexport function decodeFarmCacheInvalidations(value: string | null | undefined): readonly string[] {\n  if (!value) return [];\n\n  try {\n    const parsed = JSON.parse(decodeURIComponent(value));\n    return Array.isArray(parsed)\n      ? Array.from(\n          new Set(parsed.filter((key): key is string => typeof key === \"string\" && key.length > 0)),\n        )\n      : [];\n  } catch {\n    return [];\n  }\n}\n\nexport function subscribeFarmCacheInvalidation(\n  listener: FarmCacheInvalidationListener,\n): () => void {\n  const state = getFarmCacheInvalidationState();\n  state.listeners.add(listener);\n  return () => state.listeners.delete(listener);\n}\n\nexport function subscribeFarmCacheTask(listener: FarmCacheTaskListener): () => void {\n  const state = getFarmCacheInvalidationState();\n  state.taskListeners.add(listener);\n  return () => state.taskListeners.delete(listener);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,8BAAkC;;;ACUlC,IAAM,gCAAgC,uBAAO,IAAI,6BAA6B;AAC9E,IAAM,cAAc;AAIpB,SAAS,gCAA4D;AACnE,SAAQ,4FAA+C;AAAA,IACrD,WAAW,oBAAI,IAAI;AAAA,IACnB,eAAe,oBAAI,IAAI;AAAA,EACzB;AACF;AALS;AAsDF,SAAS,+BACd,UACY;AACZ,QAAM,QAAQ,8BAA8B;AAC5C,QAAM,UAAU,IAAI,QAAQ;AAC5B,SAAO,MAAM,MAAM,UAAU,OAAO,QAAQ;AAC9C;AANgB;AAQT,SAAS,uBAAuB,UAA6C;AAClF,QAAM,QAAQ,8BAA8B;AAC5C,QAAM,cAAc,IAAI,QAAQ;AAChC,SAAO,MAAM,MAAM,cAAc,OAAO,QAAQ;AAClD;AAJgB;;;AD1ET,IAAM,wCAAwC;AAoC9C,IAAM,4BAAN,MAAM,kCAAiC,MAAM;AAAA,EAIlD,YAAY,MAAoC,QAAgB,SAAiB;AAC/E,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAVoD;AAA7C,IAAM,2BAAN;AAmBP,IAAM,4BAA4B,uBAAO,IAAI,0BAA0B;AACvE,IAAM,gCAAgC,uBAAO,IAAI,0CAA0C;AAC3F,IAAM,4BAA4B,oBAAI,IAAI;AAAA,EACxC;AAAA,EACA;AACF,CAAC;AACD,IAAM,kCAAkC,oBAAI,IAAI;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,SAAS,2BACd,QACiC;AACjC,QAAM,kBAAkB,QAAQ,kBAAkB,CAAC,GAAG,IAAI,6BAA6B;AACvF,QAAM,gBAAgB;AAAA,IACpB,QAAQ,iBAAiB;AAAA,EAC3B;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,gBAAgB,OAAO,OAAO,cAAc;AAAA,IAC5C;AAAA,EACF,CAAC;AACH;AAZgB;AAcT,SAAS,4BACd,SACA,QACM;AACN,MAAI,QAAQ,OAAO,YAAY,MAAM,QAAQ;AAC3C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,IAAI,IAAI,QAAQ,GAAG;AACtC,QAAM,eAAe,uBAAuB,OAAO;AACnD,QAAM,YAAY,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK,EAAE,YAAY;AAE5E,MAAI,CAAC,cAAc;AACjB,QAAI,cAAc,eAAe;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AAEA,QAAM,iBACJ,iBAAiB,WAAW,UAAU,kBAAkB,cAAc,OAAO;AAC/E,QAAM,0BAA0B,OAAO,eAAe;AAAA,IAAK,CAAC,YAC1D,qBAAqB,cAAc,OAAO;AAAA,EAC5C;AAEA,MAAI,CAAC,kBAAkB,CAAC,yBAAyB;AAC/C,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,cAAc,gBAAgB,CAAC,yBAAyB;AAC1D,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAhDgB;AAkDhB,eAAsB,2BACpB,SACA,QACA,MACA,UACsC;AACtC,8BAA4B,SAAS,MAAM;AAE3C,MAAI,SAAS,cAAc;AACzB,qBAAiB,QAAQ;AAAA,EAC3B;AAEA,QAAM,cAAc,wBAAwB,SAAS,IAAI;AACzD,QAAM,QAAQ,MAAM,kBAAkB,SAAS,OAAO,aAAa;AAEnE,MAAI,SAAS,UAAU,gBAAgB,uBAAuB;AAC5D,WAAO;AAAA,MACL,MAAM,MAAM,cAAc,SAAS,KAAK;AAAA,MACxC;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK;AAAA,IACpC;AAAA,EACF;AACF;AA1BsB;AA4Bf,SAAS,uCAAuC,OAAiC;AACtF,MAAI,EAAE,iBAAiB,2BAA2B;AAChD,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,QAAQ;AAAA,IAC1B,iBAAiB;AAAA,IACjB,gBAAgB;AAAA,IAChB,0BAA0B;AAAA,EAC5B,CAAC;AACD,MAAI,MAAM,WAAW,KAAK;AACxB,YAAQ,IAAI,SAAS,MAAM;AAAA,EAC7B;AAEA,SAAO,IAAI,SAAS,sBAAsB,MAAM,MAAM,GAAG;AAAA,IACvD,QAAQ,MAAM;AAAA,IACd;AAAA,EACF,CAAC;AACH;AAlBgB;AAoBT,SAAS,0BAA0B,QAA6C;AACrF,SAAO;AAAA,IACL,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AALgB;AAOhB,eAAsB,2BACpB,SACA,UACY;AACZ,iBAAe,QAAQ,MAAM;AAC7B,QAAM,UAAwC;AAAA,IAC5C;AAAA,IACA,QAAQ,QAAQ;AAAA,IAChB,eAAe,oBAAI,IAAI;AAAA,IACvB,YAAY,oBAAI,IAAI;AAAA,EACtB;AAEA,SAAO,uBAAuB,EAAE,IAAI,SAAS,YAAY;AACvD,QAAI;AACF,YAAM,SAAS,MAAM,SAAS;AAC9B,YAAM,QAAQ,IAAI,QAAQ,UAAU;AACpC,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,QAAQ,WAAW,QAAQ,UAAU;AAC3C,YAAM;AAAA,IACR;AAAA,EACF,CAAC;AACH;AAtBsB;AAwBf,SAAS,kCAA4E;AAC1F,SAAO,uBAAuB,EAAE,SAAS;AAC3C;AAFgB;AAIT,SAAS,wBAAqC;AACnD,SAAO,gCAAgC,GAAG,UAAU,2BAA2B,EAAE;AACnF;AAFgB;AAIT,SAAS,+BAAkD;AAChE,SAAO,MAAM,KAAK,gCAAgC,GAAG,iBAAiB,CAAC,CAAC;AAC1E;AAFgB;AAIhB,+BAA+B,CAAC,QAAQ;AACtC,kCAAgC,GAAG,cAAc,IAAI,GAAG;AAC1D,CAAC;AAED,uBAAuB,CAAC,SAAS;AAC/B,kCAAgC,GAAG,WAAW,IAAI,IAAI;AACxD,CAAC;AAED,SAAS,yBAA0E;AACjF,QAAMA,eAAc;AACpB,MAAI,CAACA,aAAY,yBAAyB,GAAG;AAC3C,IAAAA,aAAY,yBAAyB,IAAI,IAAI,0CAAgD;AAAA,EAC/F;AACA,SAAOA,aAAY,yBAAyB;AAC9C;AANS;AAQT,SAAS,6BAA8C;AACrD,QAAMA,eAAc;AACpB,MAAI,CAACA,aAAY,6BAA6B,GAAG;AAC/C,IAAAA,aAAY,6BAA6B,IAAI,IAAI,gBAAgB;AAAA,EACnE;AACA,SAAOA,aAAY,6BAA6B;AAClD;AANS;AAQT,SAAS,mBAAmB,OAAgC;AAC1D,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,YAAM,IAAI,UAAU,6DAA6D;AAAA,IACnF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,MACX,KAAK,EACL,YAAY,EACZ,MAAM,+CAA+C;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,OAAO,MAAM,CAAC,CAAC;AAC9B,QAAM,OAAO,MAAM,CAAC,KAAK;AACzB,QAAM,aAAqC;AAAA,IACzC,GAAG;AAAA,IACH,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,IAAI;AAAA,IACJ,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACA,QAAM,QAAQ,KAAK,MAAM,SAAS,WAAW,IAAI,CAAC;AAElD,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,UAAM,IAAI,UAAU,qEAAqE;AAAA,EAC3F;AAEA,SAAO;AACT;AApCS;AAsCT,SAAS,8BAA8B,OAAuB;AAC5D,QAAM,UAAU,MAAM,KAAK,EAAE,YAAY;AACzC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,UAAU,0DAA0D;AAAA,EAChF;AAEA,MAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,QAAI,CAAC,6CAA6C,KAAK,OAAO,GAAG;AAC/D,YAAM,IAAI,UAAU,iDAAiD,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC9F;AACA,WAAO;AAAA,EACT;AAEA,MAAI,QAAQ,SAAS,KAAK,GAAG;AAC3B,QAAI;AACJ,QAAI;AACF,eAAS,IAAI,IAAI,OAAO;AAAA,IAC1B,QAAQ;AACN,YAAM,IAAI,UAAU,+CAA+C,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,IAC5F;AAEA,QACG,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,OAAO,YACP,OAAO,YACP,OAAO,aAAa,OACpB,OAAO,UACP,OAAO,MACP;AACA,YAAM,IAAI;AAAA,QACR,oEAAoE,KAAK,UAAU,KAAK,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,SAAS,KAAK,OAAO,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,+DAA+D,KAAK,UAAU,KAAK,CAAC;AAAA,IACtF;AAAA,EACF;AAEA,MAAI;AACF,WAAO,IAAI,IAAI,UAAU,OAAO,EAAE,EAAE;AAAA,EACtC,QAAQ;AACN,UAAM,IAAI,UAAU,+CAA+C,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,EAC5F;AACF;AA/CS;AAiDT,SAAS,uBAAuB,SAAiC;AAC/D,QAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ,GAAG,KAAK;AACnD,MAAI,QAAQ;AACV,WAAO,kBAAkB,MAAM;AAAA,EACjC;AAEA,QAAM,UAAU,QAAQ,QAAQ,IAAI,SAAS,GAAG,KAAK;AACrD,MAAI,SAAS;AACX,WAAO,kBAAkB,OAAO;AAAA,EAClC;AAEA,SAAO;AACT;AAZS;AAcT,SAAS,kBAAkB,OAAuB;AAChD,MAAI,UAAU,QAAQ;AACpB,UAAM,IAAI,yBAAyB,kBAAkB,KAAK,gCAAgC;AAAA,EAC5F;AAEA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,QAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,YAAM,IAAI,MAAM,sBAAsB;AAAA,IACxC;AACA,WAAO,OAAO;AAAA,EAChB,QAAQ;AACN,UAAM,IAAI,yBAAyB,kBAAkB,KAAK,wBAAwB;AAAA,EACpF;AACF;AAdS;AAgBT,SAAS,kBAAkB,cAAsB,SAA2B;AAC1E,QAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM,GAAG,KAAK,EAAE,YAAY;AAC7D,MAAI,CAAC,KAAM,QAAO;AAElB,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,YAAY;AACnC,UAAM,SAAS,IAAI,IAAI,QAAQ,GAAG;AAClC,WAAO,OAAO,aAAa,OAAO,YAAY,OAAO,KAAK,YAAY,MAAM;AAAA,EAC9E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAXS;AAaT,SAAS,qBAAqB,cAAsB,SAA0B;AAC5E,QAAM,SAAS,IAAI,IAAI,YAAY;AACnC,MAAI,CAAC,QAAQ,SAAS,GAAG,GAAG;AAC1B,WAAO,QAAQ,SAAS,KAAK,IAAI,OAAO,WAAW,UAAU,OAAO,SAAS;AAAA,EAC/E;AAEA,QAAM,YAAY,QAAQ,QAAQ,KAAK;AACvC,QAAM,SAAS,cAAc,KAAK,OAAO,QAAQ,MAAM,GAAG,YAAY,CAAC;AACvE,QAAM,cAAc,QAAQ,MAAM,cAAc,KAAK,IAAI,YAAY,CAAC;AACtE,QAAM,CAAC,cAAc,IAAI,IAAI,iBAAiB,WAAW;AACzD,QAAM,WAAW,aAAa,MAAM,CAAC;AAErC,MAAI,UAAU,OAAO,aAAa,OAAQ,QAAO;AACjD,MAAI,QAAQ,iBAAiB,MAAM,MAAM,KAAM,QAAO;AACtD,MAAI,CAAC,QAAQ,OAAO,KAAM,QAAO;AAEjC,SAAO,OAAO,SAAS,SAAS,IAAI,QAAQ,EAAE,KAAK,OAAO,aAAa;AACzE;AAjBS;AAmBT,SAAS,iBAAiB,OAAwC;AAChE,QAAM,YAAY,MAAM,YAAY,GAAG;AACvC,MAAI,cAAc,GAAI,QAAO,CAAC,OAAO,IAAI;AACzC,SAAO,CAAC,MAAM,MAAM,GAAG,SAAS,GAAG,MAAM,MAAM,YAAY,CAAC,CAAC;AAC/D;AAJS;AAMT,SAAS,iBAAiB,KAAkB;AAC1C,MAAI,IAAI,KAAM,QAAO,IAAI;AACzB,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,MAAI,IAAI,aAAa,QAAS,QAAO;AACrC,SAAO;AACT;AALS;AAOT,SAAS,iBAAiB,UAAsD;AAC9E,MAAI,CAAC,YAAY,SAAS,SAAS,QAAQ,qBAAqB,QAAQ,GAAG;AACzE,UAAM,IAAI,yBAAyB,qBAAqB,KAAK,0BAA0B;AAAA,EACzF;AACF;AAJS;AAMT,SAAS,qBAAqB,OAAwB;AACpD,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;AACjD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,MAAM,SAAS,IAAK,QAAO;AAAA,EACzC;AACA,SAAO;AACT;AANS;AAQT,SAAS,wBAAwB,SAAkB,MAAuC;AACxF,QAAM,SAAS,QAAQ,QAAQ,IAAI,cAAc,GAAG,KAAK,EAAE,YAAY;AACvE,QAAM,cAAc,QAAQ,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,KAAK;AACxD,QAAM,YAAY,SAAS,SAAS,4BAA4B;AAEhE,MAAI,CAAC,UAAU,IAAI,WAAW,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAdS;AAgBT,eAAe,kBAAkB,SAAkB,OAAoC;AACrF,QAAM,gBAAgB,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK;AAClE,MAAI,eAAe;AACjB,QAAI,CAAC,QAAQ,KAAK,aAAa,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,OAAO,aAAa,IAAI,OAAO;AACjC,YAAM,IAAI,yBAAyB,kBAAkB,KAAK,iCAAiC;AAAA,IAC7F;AAAA,EACF;AAEA,iBAAe,QAAQ,MAAM;AAC7B,MAAI,CAAC,QAAQ,KAAM,QAAO,IAAI,WAAW;AAEzC,QAAM,SAAS,QAAQ,KAAK,UAAU;AACtC,QAAM,SAAuB,CAAC;AAC9B,MAAI,QAAQ;AACZ,QAAM,iBAAiB,6BAAM;AAC3B,SAAK,OAAO,OAAO,QAAQ,OAAO,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAC1D,GAFuB;AAIvB,UAAQ,OAAO,iBAAiB,SAAS,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAEvE,MAAI;AACF,WAAO,MAAM;AACX,qBAAe,QAAQ,MAAM;AAC7B,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,UAAI,CAAC,MAAO;AAEZ,eAAS,MAAM;AACf,UAAI,QAAQ,OAAO;AACjB,cAAM,OAAO,OAAO,iCAAiC;AACrD,cAAM,IAAI;AAAA,UACR;AAAA,UACA;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,SAAS,OAAO;AACd,QAAI,QAAQ,OAAO,QAAS,gBAAe,QAAQ,MAAM;AACzD,UAAM;AAAA,EACR,UAAE;AACA,YAAQ,OAAO,oBAAoB,SAAS,cAAc;AAC1D,WAAO,YAAY;AAAA,EACrB;AAEA,iBAAe,QAAQ,MAAM;AAC7B,QAAM,OAAO,IAAI,WAAW,KAAK;AACjC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AA7De;AA+Df,eAAe,cAAc,SAAkB,OAAsC;AACnF,QAAM,OAAO,IAAI,YAAY,MAAM,UAAU;AAC7C,MAAI,WAAW,IAAI,EAAE,IAAI,KAAK;AAC9B,QAAM,OAAO,IAAI,QAAQ,QAAQ,KAAK;AAAA,IACpC,QAAQ;AAAA,IACR,SAAS,QAAQ;AAAA,IACjB;AAAA,EACF,CAAC;AAED,MAAI;AACF,WAAO,MAAM,KAAK,SAAS;AAAA,EAC7B,QAAQ;AACN,UAAM,IAAI,yBAAyB,gBAAgB,KAAK,iCAAiC;AAAA,EAC3F;AACF;AAde;AAgBf,SAAS,sBAAsB,QAAwB;AACrD,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAfS;AAiBT,SAAS,eAAe,QAA2B;AACjD,MAAI,CAAC,OAAO,QAAS;AACrB,MAAI,OAAO,WAAW,OAAW,OAAM,OAAO;AAC9C,QAAM,IAAI,aAAa,6BAA6B,YAAY;AAClE;AAJS;","names":["globalState"]}

package/dist/server-action-security.d.mts

@@ -28,13 +28,14 @@ type ServerActionExecutionContext = {
     request: Request;
     signal: AbortSignal;
     invalidations: Set<string>;
+    cacheTasks: Set<Promise<void>>;
 };
 declare function resolveServerActionsConfig(config: FarmServerActionsConfig | undefined): ResolvedFarmServerActionsConfig;
 declare function validateServerActionRequest(request: Request, config: ResolvedFarmServerActionsConfig): void;
 declare function prepareServerActionRequest(request: Request, config: ResolvedFarmServerActionsConfig, kind: ServerActionRequestKind, actionId?: string | null): Promise<PreparedServerActionRequest>;
 declare function createServerActionRequestErrorResponse(error: unknown): Response | null;
 declare function sanitizeServerActionError(_error: unknown): SanitizedServerActionError;
-declare function runWithServerActionRequest<T>(request: Request, callback: () => T | Promise<T>): T | Promise<T>;
+declare function runWithServerActionRequest<T>(request: Request, callback: () => T | Promise<T>): Promise<T>;
 declare function getServerActionExecutionContext(): ServerActionExecutionContext | undefined;
 declare function getServerActionSignal(): AbortSignal;
 declare function getServerActionInvalidations(): readonly string[];

package/dist/server-action-security.d.ts

@@ -28,13 +28,14 @@ type ServerActionExecutionContext = {
     request: Request;
     signal: AbortSignal;
     invalidations: Set<string>;
+    cacheTasks: Set<Promise<void>>;
 };
 declare function resolveServerActionsConfig(config: FarmServerActionsConfig | undefined): ResolvedFarmServerActionsConfig;
 declare function validateServerActionRequest(request: Request, config: ResolvedFarmServerActionsConfig): void;
 declare function prepareServerActionRequest(request: Request, config: ResolvedFarmServerActionsConfig, kind: ServerActionRequestKind, actionId?: string | null): Promise<PreparedServerActionRequest>;
 declare function createServerActionRequestErrorResponse(error: unknown): Response | null;
 declare function sanitizeServerActionError(_error: unknown): SanitizedServerActionError;
-declare function runWithServerActionRequest<T>(request: Request, callback: () => T | Promise<T>): T | Promise<T>;
+declare function runWithServerActionRequest<T>(request: Request, callback: () => T | Promise<T>): Promise<T>;
 declare function getServerActionExecutionContext(): ServerActionExecutionContext | undefined;
 declare function getServerActionSignal(): AbortSignal;
 declare function getServerActionInvalidations(): readonly string[];

package/dist/server-action-security.mjs

@@ -10,8 +10,8 @@ import {
   runWithServerActionRequest,
   sanitizeServerActionError,
   validateServerActionRequest
-} from "./chunk-45LKHSHJ.mjs";
-import "./chunk-SHRJG6OG.mjs";
+} from "./chunk-UB5UOSHB.mjs";
+import "./chunk-RBRLLZL5.mjs";
 import "./chunk-CGILA3WO.mjs";
 export {
   DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,

package/dist/server-fn-client.d.mts

@@ -1,4 +1,5 @@
 import { ServerFn } from './server-fn.mjs';
+import './cache.mjs';
 
 type ServerFnActionStatus = "idle" | "pending" | "success" | "error";
 type ServerFnSubmit<TInput, TResult> = [unknown] extends [TInput] ? (input?: TInput | FormData) => Promise<TResult> : (input: TInput | FormData) => Promise<TResult>;

package/dist/server-fn-client.d.ts

@@ -1,4 +1,5 @@
 import { ServerFn } from './server-fn.js';
+import './cache.js';
 
 type ServerFnActionStatus = "idle" | "pending" | "success" | "error";
 type ServerFnSubmit<TInput, TResult> = [unknown] extends [TInput] ? (input?: TInput | FormData) => Promise<TResult> : (input: TInput | FormData) => Promise<TResult>;