@farm.js/core 0.1.0-beta.97 → 0.1.0-beta.98

package/dist/index.cjs

@@ -917,9 +917,13 @@ function getStorage(namespace) {
   const namespaced = (0, import_unstorage.prefixStorage)(globalStorage, base);
   return {
     ...namespaced,
-    async clear() {
-      const keys = await namespaced.getKeys();
-      await Promise.all(keys.map((key) => namespaced.removeItem(key)));
+    // Scope the wipe to the namespace instead of the whole storage, and keep
+    // the caller's base so `clear("sessions")` cannot take unrelated keys with
+    // it. Dropping the argument silently widens a targeted clear into a
+    // namespace-wide delete.
+    async clear(base2, opts) {
+      const keys = await namespaced.getKeys(base2);
+      await Promise.all(keys.map((key) => namespaced.removeItem(key, opts)));
     }
   };
 }
@@ -1359,6 +1363,170 @@ var init_route_pattern = __esm({
   }
 });
 
+// src/request-origin.ts
+function getRequestSourceOrigin(request) {
+  const origin = request.headers.get("origin")?.trim();
+  if (origin) {
+    return parseSourceOrigin(origin);
+  }
+  const referer = request.headers.get("referer")?.trim();
+  if (referer) {
+    return parseSourceOrigin(referer);
+  }
+  return { ok: true, origin: null };
+}
+function parseSourceOrigin(value) {
+  if (value === "null") {
+    return { ok: false, reason: "opaque-origin" };
+  }
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return { ok: false, reason: "invalid-origin" };
+    }
+    return { ok: true, origin: parsed.origin };
+  } catch {
+    return { ok: false, reason: "invalid-origin" };
+  }
+}
+function matchesHostHeader(sourceOrigin, request) {
+  const host = request.headers.get("host")?.trim().toLowerCase();
+  if (!host) return false;
+  try {
+    const source = new URL(sourceOrigin);
+    const target = new URL(request.url);
+    return source.protocol === target.protocol && source.host.toLowerCase() === host;
+  } catch {
+    return false;
+  }
+}
+function matchesAllowedOrigin(sourceOrigin, pattern) {
+  const source = new URL(sourceOrigin);
+  if (!pattern.includes("*")) {
+    return pattern.includes("://") ? source.origin === pattern : source.host === pattern;
+  }
+  const schemeEnd = pattern.indexOf("://");
+  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);
+  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);
+  const [wildcardHost, port] = splitHostAndPort(hostPattern);
+  const baseHost = wildcardHost.slice(2);
+  if (scheme && source.protocol !== scheme) return false;
+  if (port && getEffectivePort(source) !== port) return false;
+  if (!port && source.port) return false;
+  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;
+}
+function normalizeAllowedOriginPattern(value, label) {
+  const pattern = value.trim().toLowerCase();
+  if (!pattern) {
+    throw new TypeError(`${label} cannot contain empty values`);
+  }
+  if (pattern.includes("*")) {
+    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
+      throw new TypeError(`Invalid ${label} pattern: ${JSON.stringify(value)}`);
+    }
+    return pattern;
+  }
+  if (pattern.includes("://")) {
+    let parsed;
+    try {
+      parsed = new URL(pattern);
+    } catch {
+      throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      throw new TypeError(`${label} must contain origins without paths: ${JSON.stringify(value)}`);
+    }
+    return parsed.origin;
+  }
+  if (/[/@?#]/.test(pattern)) {
+    throw new TypeError(`${label} must contain origins or hosts: ${JSON.stringify(value)}`);
+  }
+  try {
+    return new URL(`http://${pattern}`).host;
+  } catch {
+    throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+  }
+}
+function splitHostAndPort(value) {
+  const separator = value.lastIndexOf(":");
+  if (separator === -1) return [value, null];
+  return [value.slice(0, separator), value.slice(separator + 1)];
+}
+function getEffectivePort(url) {
+  if (url.port) return url.port;
+  if (url.protocol === "https:") return "443";
+  if (url.protocol === "http:") return "80";
+  return "";
+}
+var init_request_origin = __esm({
+  "src/request-origin.ts"() {
+    "use strict";
+    __name(getRequestSourceOrigin, "getRequestSourceOrigin");
+    __name(parseSourceOrigin, "parseSourceOrigin");
+    __name(matchesHostHeader, "matchesHostHeader");
+    __name(matchesAllowedOrigin, "matchesAllowedOrigin");
+    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
+    __name(splitHostAndPort, "splitHostAndPort");
+    __name(getEffectivePort, "getEffectivePort");
+  }
+});
+
+// src/integration-request-security.ts
+function resolveIntegrationAllowedOrigins(values, label) {
+  return Object.freeze((values ?? []).map((value) => normalizeAllowedOriginPattern(value, label)));
+}
+function validateIntegrationRequestOrigin(request, policy = {}) {
+  const allowedOrigins = policy.allowedOrigins ?? [];
+  const requireOriginMetadata = policy.requireOriginMetadata ?? true;
+  const fetchSite = request.headers.get("sec-fetch-site")?.trim().toLowerCase();
+  const source = getRequestSourceOrigin(request);
+  if (!source.ok) {
+    return { ok: false, reason: source.reason };
+  }
+  if (source.origin === null) {
+    if (fetchSite === "same-origin") {
+      return { ok: true };
+    }
+    if (requireOriginMetadata) {
+      return { ok: false, reason: fetchSite === "cross-site" ? "cross-site" : "missing-origin" };
+    }
+    return fetchSite === "cross-site" ? { ok: false, reason: "cross-site" } : { ok: true };
+  }
+  const requestUrl = new URL(request.url);
+  const matchesConfiguredOrigin = allowedOrigins.some(
+    (pattern) => matchesAllowedOrigin(source.origin, pattern)
+  );
+  const matchesRequest = source.origin === requestUrl.origin || matchesHostHeader(source.origin, request);
+  if (!matchesRequest && !matchesConfiguredOrigin) {
+    return { ok: false, reason: "cross-site" };
+  }
+  if (fetchSite === "cross-site" && !matchesConfiguredOrigin) {
+    return { ok: false, reason: "cross-site" };
+  }
+  return { ok: true };
+}
+function describeIntegrationOriginRejection(reason) {
+  switch (reason) {
+    case "missing-origin":
+      return "Request is missing same-origin metadata.";
+    case "opaque-origin":
+      return "Opaque origins are not allowed.";
+    case "invalid-origin":
+      return "Invalid request origin.";
+    case "cross-site":
+      return "Cross-site request was rejected.";
+  }
+}
+var init_integration_request_security = __esm({
+  "src/integration-request-security.ts"() {
+    "use strict";
+    init_request_origin();
+    __name(resolveIntegrationAllowedOrigins, "resolveIntegrationAllowedOrigins");
+    __name(validateIntegrationRequestOrigin, "validateIntegrationRequestOrigin");
+    __name(describeIntegrationOriginRejection, "describeIntegrationOriginRejection");
+  }
+});
+
 // src/integration-api.ts
 function defineIntegrationAPIOperation(operation2) {
   return {
@@ -4195,6 +4363,7 @@ var init_integrations = __esm({
   "src/integrations.ts"() {
     "use strict";
     init_route_pattern();
+    init_integration_request_security();
     init_integration_api();
     init_plugin_integration_context();
     init_decode();
@@ -4660,6 +4829,29 @@ var init_markdown = __esm({
   }
 });
 
+// src/utils/runtime-env.ts
+function getFarmRuntimeBindings() {
+  const runtimeBindings = globalThis.__env__;
+  return runtimeBindings && typeof runtimeBindings === "object" ? runtimeBindings : void 0;
+}
+function readFarmEnvironmentValue(name2) {
+  const runtimeValue = getFarmRuntimeBindings()?.[name2];
+  if (typeof runtimeValue === "string") return runtimeValue;
+  return typeof process !== "undefined" ? process.env?.[name2] : void 0;
+}
+function isFarmDeployedRuntime() {
+  if (getFarmRuntimeBindings()) return true;
+  return readFarmEnvironmentValue("NODE_ENV") === "production";
+}
+var init_runtime_env = __esm({
+  "src/utils/runtime-env.ts"() {
+    "use strict";
+    __name(getFarmRuntimeBindings, "getFarmRuntimeBindings");
+    __name(readFarmEnvironmentValue, "readFarmEnvironmentValue");
+    __name(isFarmDeployedRuntime, "isFarmDeployedRuntime");
+  }
+});
+
 // src/workflows.ts
 var workflows_exports = {};
 __export(workflows_exports, {
@@ -4708,7 +4900,8 @@ function resolveWorkflowsConfig(workflows) {
     dirs,
     route: normalizeWorkflowRoute(options.route || DEFAULT_FARM_WORKFLOW_ROUTE),
     secretEnv: options.secretEnv || DEFAULT_FARM_WORKFLOW_SECRET_ENV,
-    secret: options.secret
+    secret: options.secret,
+    allowUnsecured: options.allowUnsecured === true
   };
 }
 async function discoverFarmWorkflows(config, options = {}) {
@@ -4834,8 +5027,11 @@ async function prepareFarmWorkflowsForNitro(config) {
   await fs16.mkdir(generatedDir, { recursive: true });
   const tasks = {};
   const scheduledTasks = createScheduledTasks(workflows);
+  const wrapperNames = resolveWorkflowWrapperFileNames(workflows.map((workflow) => workflow.id));
   for (const workflow of workflows) {
-    const wrapperPath = toPosixPath(path43.join(generatedDir, `${safeFileName(workflow.id)}.mjs`));
+    const wrapperPath = toPosixPath(
+      path43.join(generatedDir, `${wrapperNames.get(workflow.id)}.mjs`)
+    );
     await fs16.writeFile(wrapperPath, createNitroTaskWrapper(workflow), "utf8");
     tasks[workflow.id] = {
       handler: wrapperPath,
@@ -5196,8 +5392,16 @@ function readScheduledTime(payload) {
   return payload && typeof payload === "object" && "scheduledTime" in payload ? payload.scheduledTime : void 0;
 }
 function verifyWorkflowSecret(request, config) {
-  const secret = config.secret || process.env[config.secretEnv] || "";
-  if (!secret) return null;
+  const secret = config.secret || readFarmEnvironmentValue(config.secretEnv) || "";
+  if (!secret) {
+    if (config.allowUnsecured === true || !isFarmDeployedRuntime()) return null;
+    return Response.json(
+      {
+        error: "Workflow route requires a secret. Set the CRON_SECRET environment variable, configure workflows.secret, or set workflows.allowUnsecured to true."
+      },
+      { status: 401 }
+    );
+  }
   const authorization = request.headers.get("authorization") || "";
   const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1] || "";
   const headerSecret = request.headers.get("x-farm-workflow-secret") || "";
@@ -5210,6 +5414,37 @@ function joinRoute(...parts) {
 function trimSlashes(value) {
   return value.replace(/^\/+|\/+$/g, "");
 }
+function resolveWorkflowWrapperFileNames(ids) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const key = safeFileName(id).toLowerCase();
+    groups.set(key, (groups.get(key) ?? 0) + 1);
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  const claimed = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const base = safeFileName(id);
+    const key = base.toLowerCase();
+    const fileName = (groups.get(key) ?? 0) > 1 ? `${key}-${workflowIdFingerprint(id)}` : base;
+    const claimedBy = claimed.get(fileName.toLowerCase());
+    if (claimedBy !== void 0) {
+      throw new Error(
+        `Farm workflows ${JSON.stringify(claimedBy)} and ${JSON.stringify(id)} generate the same wrapper file ${JSON.stringify(`${fileName}.mjs`)}. Rename one of them.`
+      );
+    }
+    claimed.set(fileName.toLowerCase(), id);
+    resolved.set(id, fileName);
+  }
+  return resolved;
+}
+function workflowIdFingerprint(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
 function safeFileName(value) {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-") || "workflow";
 }
@@ -5222,6 +5457,7 @@ var init_workflows = __esm({
     "use strict";
     init_server_http();
     init_search_params();
+    init_runtime_env();
     init_decode();
     init_utils();
     init_route_pattern();
@@ -5261,6 +5497,8 @@ var init_workflows = __esm({
     __name(verifyWorkflowSecret, "verifyWorkflowSecret");
     __name(joinRoute, "joinRoute");
     __name(trimSlashes, "trimSlashes");
+    __name(resolveWorkflowWrapperFileNames, "resolveWorkflowWrapperFileNames");
+    __name(workflowIdFingerprint, "workflowIdFingerprint");
     __name(safeFileName, "safeFileName");
     __name(relativePath, "relativePath");
   }
@@ -5312,9 +5550,10 @@ async function prepareFarmCronForNitro(config) {
   await fs16.rm(generatedDir, { recursive: true, force: true });
   await fs16.mkdir(generatedDir, { recursive: true });
   const tasks = {};
+  const wrapperNames = resolveCronWrapperFileNames(cron.jobs.map((job) => job.name));
   for (const job of cron.jobs) {
     const taskName = getFarmCronTaskName(job.name);
-    const wrapperPath = toPosixPath(path43.join(generatedDir, `${safeFileName2(job.name)}.mjs`));
+    const wrapperPath = toPosixPath(path43.join(generatedDir, `${wrapperNames.get(job.name)}.mjs`));
     await fs16.writeFile(wrapperPath, createNitroCronTaskWrapper(job, cron.secretEnv), "utf8");
     tasks[taskName] = {
       handler: wrapperPath,
@@ -5397,9 +5636,9 @@ function mergeScheduledTasks(...maps) {
 }
 function isCronRequestAuthorized(request, options = {}) {
   const secretEnv = options.secretEnv || DEFAULT_FARM_CRON_SECRET_ENV;
-  const secret = options.secret || readEnvironmentValue(secretEnv);
+  const secret = options.secret || readFarmEnvironmentValue(secretEnv);
   if (!secret) {
-    return options.allowUnsecured === true || !getFarmRuntimeBindings() && readEnvironmentValue("NODE_ENV") !== "production";
+    return options.allowUnsecured === true || !getFarmRuntimeBindings() && readFarmEnvironmentValue("NODE_ENV") !== "production";
   }
   const authorization = request.headers.get("authorization") || "";
   const bearer = /^Bearer (.*)$/i.exec(authorization)?.[1] || "";
@@ -5596,14 +5835,36 @@ export default defineTask({
 });
 `.trim();
 }
-function readEnvironmentValue(name2) {
-  const runtimeValue = getFarmRuntimeBindings()?.[name2];
-  if (typeof runtimeValue === "string") return runtimeValue;
-  return typeof process !== "undefined" ? process.env?.[name2] : void 0;
+function resolveCronWrapperFileNames(names) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const name2 of names) {
+    const key = safeFileName2(name2).toLowerCase();
+    groups.set(key, (groups.get(key) ?? 0) + 1);
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  const claimed = /* @__PURE__ */ new Map();
+  for (const name2 of names) {
+    const base = safeFileName2(name2);
+    const key = base.toLowerCase();
+    const fileName = (groups.get(key) ?? 0) > 1 ? `${key}-${cronNameFingerprint(name2)}` : base;
+    const claimedBy = claimed.get(fileName.toLowerCase());
+    if (claimedBy !== void 0) {
+      throw new Error(
+        `Farm cron jobs ${JSON.stringify(claimedBy)} and ${JSON.stringify(name2)} generate the same wrapper file ${JSON.stringify(`${fileName}.mjs`)}. Rename one of them.`
+      );
+    }
+    claimed.set(fileName.toLowerCase(), name2);
+    resolved.set(name2, fileName);
+  }
+  return resolved;
 }
-function getFarmRuntimeBindings() {
-  const runtimeBindings = globalThis.__env__;
-  return runtimeBindings && typeof runtimeBindings === "object" ? runtimeBindings : void 0;
+function cronNameFingerprint(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
 }
 function safeFileName2(value) {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-") || "cron";
@@ -5613,6 +5874,7 @@ var init_cron = __esm({
   "src/cron.ts"() {
     "use strict";
     init_utils();
+    init_runtime_env();
     DEFAULT_FARM_CRON_SECRET_ENV = "CRON_SECRET";
     FARM_CRON_MANIFEST = "cron-manifest.json";
     CRON_FIELD_RANGES = [
@@ -5643,8 +5905,8 @@ var init_cron = __esm({
     __name(mergeTaskNames, "mergeTaskNames");
     __name(getFarmCronTaskName, "getFarmCronTaskName");
     __name(createNitroCronTaskWrapper, "createNitroCronTaskWrapper");
-    __name(readEnvironmentValue, "readEnvironmentValue");
-    __name(getFarmRuntimeBindings, "getFarmRuntimeBindings");
+    __name(resolveCronWrapperFileNames, "resolveCronWrapperFileNames");
+    __name(cronNameFingerprint, "cronNameFingerprint");
     __name(safeFileName2, "safeFileName");
   }
 });
@@ -6715,7 +6977,9 @@ var init_server_fn_error = __esm({
 
 // src/server-action-security.ts
 function resolveServerActionsConfig(config) {
-  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);
+  const allowedOrigins = (config?.allowedOrigins ?? []).map(
+    (value) => normalizeAllowedOriginPattern(value, SERVER_ACTION_ALLOWED_ORIGINS_LABEL)
+  );
   const bodySizeLimit = parseBodySizeLimit(
     config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,
     "serverActions.bodySizeLimit"
@@ -6734,7 +6998,7 @@ function validateServerActionRequest(request, config) {
     );
   }
   const requestUrl = new URL(request.url);
-  const sourceOrigin = getRequestSourceOrigin(request);
+  const sourceOrigin = resolveSourceOrigin(request);
   const fetchSite = request.headers.get("sec-fetch-site")?.trim().toLowerCase();
   if (!sourceOrigin) {
     if (fetchSite !== "same-origin") {
@@ -6850,103 +7114,16 @@ function getFallbackAbortController() {
   }
   return globalState2[FALLBACK_ABORT_CONTROLLER_KEY];
 }
-function normalizeAllowedOriginPattern(value) {
-  const pattern = value.trim().toLowerCase();
-  if (!pattern) {
-    throw new TypeError("serverActions.allowedOrigins cannot contain empty values");
-  }
-  if (pattern.includes("*")) {
-    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
-      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);
-    }
-    return pattern;
-  }
-  if (pattern.includes("://")) {
-    let parsed;
-    try {
-      parsed = new URL(pattern);
-    } catch {
-      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-      throw new TypeError(
-        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`
-      );
-    }
-    return parsed.origin;
-  }
-  if (/[/@?#]/.test(pattern)) {
-    throw new TypeError(
-      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`
+function resolveSourceOrigin(request) {
+  const result = getRequestSourceOrigin(request);
+  if (!result.ok) {
+    throw new ServerActionRequestError(
+      "INVALID_ORIGIN",
+      403,
+      result.reason === "opaque-origin" ? "Opaque origins are not allowed" : "Invalid request origin"
     );
   }
-  try {
-    return new URL(`http://${pattern}`).host;
-  } catch {
-    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-  }
-}
-function getRequestSourceOrigin(request) {
-  const origin = request.headers.get("origin")?.trim();
-  if (origin) {
-    return parseSourceOrigin(origin);
-  }
-  const referer = request.headers.get("referer")?.trim();
-  if (referer) {
-    return parseSourceOrigin(referer);
-  }
-  return null;
-}
-function parseSourceOrigin(value) {
-  if (value === "null") {
-    throw new ServerActionRequestError("INVALID_ORIGIN", 403, "Opaque origins are not allowed");
-  }
-  try {
-    const parsed = new URL(value);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      throw new Error("Unsupported protocol");
-    }
-    return parsed.origin;
-  } catch {
-    throw new ServerActionRequestError("INVALID_ORIGIN", 403, "Invalid request origin");
-  }
-}
-function matchesHostHeader(sourceOrigin, request) {
-  const host = request.headers.get("host")?.trim().toLowerCase();
-  if (!host) return false;
-  try {
-    const source = new URL(sourceOrigin);
-    const target = new URL(request.url);
-    return source.protocol === target.protocol && source.host.toLowerCase() === host;
-  } catch {
-    return false;
-  }
-}
-function matchesAllowedOrigin(sourceOrigin, pattern) {
-  const source = new URL(sourceOrigin);
-  if (!pattern.includes("*")) {
-    return pattern.includes("://") ? source.origin === pattern : source.host === pattern;
-  }
-  const schemeEnd = pattern.indexOf("://");
-  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);
-  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);
-  const [wildcardHost, port] = splitHostAndPort(hostPattern);
-  const baseHost = wildcardHost.slice(2);
-  if (scheme && source.protocol !== scheme) return false;
-  if (port && getEffectivePort(source) !== port) return false;
-  if (!port && source.port) return false;
-  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;
-}
-function splitHostAndPort(value) {
-  const separator = value.lastIndexOf(":");
-  if (separator === -1) return [value, null];
-  return [value.slice(0, separator), value.slice(separator + 1)];
-}
-function getEffectivePort(url) {
-  if (url.port) return url.port;
-  if (url.protocol === "https:") return "443";
-  if (url.protocol === "http:") return "80";
-  return "";
+  return result.origin;
 }
 function validateActionId(actionId) {
   if (!actionId || actionId.length > 4096 || hasControlCharacters(actionId)) {
@@ -7067,14 +7244,16 @@ function throwIfAborted2(signal) {
   if (signal.reason !== void 0) throw signal.reason;
   throw new DOMException("The operation was aborted", "AbortError");
 }
-var import_node_async_hooks, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, _ServerActionRequestError, ServerActionRequestError, SERVER_ACTION_STORAGE_KEY, FALLBACK_ABORT_CONTROLLER_KEY, FORM_ACTION_CONTENT_TYPES, JAVASCRIPT_ACTION_CONTENT_TYPES;
+var import_node_async_hooks, SERVER_ACTION_ALLOWED_ORIGINS_LABEL, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, _ServerActionRequestError, ServerActionRequestError, SERVER_ACTION_STORAGE_KEY, FALLBACK_ABORT_CONTROLLER_KEY, FORM_ACTION_CONTENT_TYPES, JAVASCRIPT_ACTION_CONTENT_TYPES;
 var init_server_action_security = __esm({
   "src/server-action-security.ts"() {
     "use strict";
     import_node_async_hooks = require("async_hooks");
     init_cache_invalidation();
+    init_request_origin();
     init_server_fn_error();
     init_server_http();
+    SERVER_ACTION_ALLOWED_ORIGINS_LABEL = "serverActions.allowedOrigins";
     DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1e6;
     _ServerActionRequestError = class _ServerActionRequestError extends Error {
       constructor(code, status, message) {
@@ -7115,13 +7294,7 @@ var init_server_action_security = __esm({
     });
     __name(getServerActionStorage, "getServerActionStorage");
     __name(getFallbackAbortController, "getFallbackAbortController");
-    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
-    __name(getRequestSourceOrigin, "getRequestSourceOrigin");
-    __name(parseSourceOrigin, "parseSourceOrigin");
-    __name(matchesHostHeader, "matchesHostHeader");
-    __name(matchesAllowedOrigin, "matchesAllowedOrigin");
-    __name(splitHostAndPort, "splitHostAndPort");
-    __name(getEffectivePort, "getEffectivePort");
+    __name(resolveSourceOrigin, "resolveSourceOrigin");
     __name(validateActionId, "validateActionId");
     __name(hasControlCharacters, "hasControlCharacters");
     __name(getSupportedContentType, "getSupportedContentType");
@@ -17012,7 +17185,7 @@ var init_server3 = __esm({
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.1.0-beta.97";
+    version = "0.1.0-beta.98";
   }
 });
 
@@ -25065,10 +25238,11 @@ function createFarmImageHandler(config, options) {
         "quality"
       );
       const accept = request.headers.get("accept") ?? "";
+      const negotiatedFormat = selectOutputFormat(accept, config.formats) ?? "";
       const cacheKey = `${sourceUrl.href}
 ${width}
 ${quality}
-${accept}`;
+${negotiatedFormat}`;
       let optimized = cache.get(cacheKey);
       if (!optimized) {
         const fetchedSource = await fetchImageSource(
@@ -25095,7 +25269,8 @@ ${accept}`;
           quality,
           accept,
           formats: config.formats,
-          signal: request.signal
+          signal: request.signal,
+          maximumResponseBody: config.maximumResponseBody
         });
         throwIfAborted3(request.signal);
         validateTransformedResult(result, config);
@@ -25426,7 +25601,7 @@ function throwIfAborted3(signal) {
 function isAbortError(error) {
   return error instanceof Error && error.name === "AbortError";
 }
-var _FarmImageRequestError, FarmImageRequestError, _FarmImageMemoryCache, FarmImageMemoryCache;
+var _FarmImageRequestError, FarmImageRequestError, DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT, _FarmImageMemoryCache, FarmImageMemoryCache;
 var init_image_server = __esm({
   "src/image-server.ts"() {
     "use strict";
@@ -25442,6 +25617,7 @@ var init_image_server = __esm({
     __name(_FarmImageRequestError, "FarmImageRequestError");
     FarmImageRequestError = _FarmImageRequestError;
     __name(createFarmImageHandler, "createFarmImageHandler");
+    DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT = 10 * 1024 * 1024;
     __name(selectOutputFormat, "selectOutputFormat");
     __name(isPrivateImageAddress, "isPrivateImageAddress");
     __name(parseAllowedInteger, "parseAllowedInteger");
@@ -38279,6 +38455,7 @@ __export(src_exports, {
   defineStorageClient: () => defineStorageClient,
   defineTask: () => defineTask,
   defineWorkflow: () => defineWorkflow,
+  describeIntegrationOriginRejection: () => describeIntegrationOriginRejection,
   discoverFarmDocsPages: () => discoverFarmDocsPages,
   discoverFarmWorkflows: () => discoverFarmWorkflows,
   dispatchIntegrationRequest: () => dispatchIntegrationRequest,
@@ -38475,6 +38652,7 @@ __export(src_exports, {
   resolveFarmRouteRuleRuntimeConfig: () => resolveFarmRouteRuleRuntimeConfig,
   resolveFarmRouteRuntimeConfig: () => resolveFarmRouteRuntimeConfig,
   resolveFarmThemeConfig: () => resolveFarmThemeConfig,
+  resolveIntegrationAllowedOrigins: () => resolveIntegrationAllowedOrigins,
   resolveIntegrationOrmRuntimeClient: () => resolveIntegrationOrmRuntimeClient,
   resolveIntegrationPlugins: () => resolveIntegrationPlugins,
   resolveMarkdownConfig: () => resolveMarkdownConfig,
@@ -38535,6 +38713,7 @@ __export(src_exports, {
   useServerFn: () => useServerFn,
   useServerQuery: () => useServerQuery,
   useTheme: () => useTheme,
+  validateIntegrationRequestOrigin: () => validateIntegrationRequestOrigin,
   validateServerActionRequest: () => validateServerActionRequest,
   vercelBlobStorage: () => vercelBlobStorage,
   vercelKVStorage: () => vercelKVStorage,
@@ -40247,6 +40426,7 @@ var _FarmClientDataCache = class _FarmClientDataCache {
     const watched = /* @__PURE__ */ new Set();
     for (const key of this.listeners.keys()) watched.add(this.resolveKey(key));
     let remaining = false;
+    const swept = /* @__PURE__ */ new Set();
     for (const [key, entry] of this.entries) {
       if (entry.gcAt === void 0) continue;
       if (now2 < entry.gcAt || entry.fetching || this.inflight.has(key) || watched.has(key)) {
@@ -40255,9 +40435,28 @@ var _FarmClientDataCache = class _FarmClientDataCache {
       }
       this.entries.delete(key);
       this.persistence?.onDelete(key);
+      swept.add(key);
     }
+    if (swept.size > 0) this.sweepEntryMetadata(swept);
     if (remaining) this.scheduleGcSweep();
   }
+  /**
+   * Entry eviction alone leaves the per-key metadata behind. `invalidatedAt`
+   * marks and provisional aliases are created per query invocation, so with
+   * dynamic keys they accumulate for the lifetime of the page even though the
+   * entries they describe are long gone.
+   */
+  sweepEntryMetadata(swept) {
+    for (const key of swept) this.invalidatedAt.delete(key);
+    for (const [alias, target] of this.aliases) {
+      if (this.entries.has(alias) || this.listeners.has(alias)) continue;
+      const resolved = this.resolveKey(target);
+      if (!swept.has(resolved)) continue;
+      if (this.entries.has(resolved) || this.listeners.has(resolved)) continue;
+      this.aliases.delete(alias);
+      this.invalidatedAt.delete(alias);
+    }
+  }
   emit(key, event) {
     this.notifyListeners(key, event);
     for (const [alias, target] of this.aliases) {
@@ -40268,7 +40467,12 @@ var _FarmClientDataCache = class _FarmClientDataCache {
   }
   notifyListeners(key, event) {
     for (const listener of this.listeners.get(key) ?? []) {
-      listener(event);
+      try {
+        listener(event);
+      } catch (error) {
+        const detail = error instanceof Error ? error.stack ?? error.message : String(error);
+        console.warn(`[farm:client-cache] cache listener failed: ${detail}`);
+      }
     }
   }
 };
@@ -53922,29 +54126,36 @@ __name(isFormData4, "isFormData");
 // src/cache-invalidation-broadcast.ts
 init_cache_invalidation();
 var FARM_CACHE_INVALIDATION_CHANNEL = "farm:cache-invalidation";
-var activeBridge;
+var FARM_CACHE_INVALIDATION_BRIDGE = /* @__PURE__ */ Symbol.for("farm.cacheInvalidationBridge");
+var bridgeGlobal = globalThis;
 function enableCrossTabCacheInvalidation(options = {}) {
   if (typeof BroadcastChannel !== "function") return () => {
   };
   const channelName = options.channelName ?? FARM_CACHE_INVALIDATION_CHANNEL;
-  if (activeBridge) {
-    if (activeBridge.channelName !== channelName) {
+  const existing = bridgeGlobal[FARM_CACHE_INVALIDATION_BRIDGE];
+  let bridge;
+  if (existing) {
+    if (existing.channelName !== channelName) {
       throw new Error(
-        `Cross-tab cache invalidation is already enabled on channel "${activeBridge.channelName}".`
+        `Cross-tab cache invalidation is already enabled on channel "${existing.channelName}".`
       );
     }
-    activeBridge.refCount += 1;
+    existing.refCount += 1;
+    bridge = existing;
   } else {
-    activeBridge = createBridge(channelName);
+    bridge = createBridge(channelName);
+    bridgeGlobal[FARM_CACHE_INVALIDATION_BRIDGE] = bridge;
   }
   let disposed = false;
   return () => {
-    if (disposed || !activeBridge) return;
+    if (disposed) return;
     disposed = true;
-    activeBridge.refCount -= 1;
-    if (activeBridge.refCount === 0) {
-      activeBridge.teardown();
-      activeBridge = void 0;
+    bridge.refCount -= 1;
+    if (bridge.refCount === 0) {
+      bridge.teardown();
+      if (bridgeGlobal[FARM_CACHE_INVALIDATION_BRIDGE] === bridge) {
+        bridgeGlobal[FARM_CACHE_INVALIDATION_BRIDGE] = void 0;
+      }
     }
   };
 }
@@ -54152,7 +54363,7 @@ function createSink(engine) {
       scheduleFlush(engine);
     },
     onClear() {
-      if (engine.disabled) return;
+      if (engine.disabled || engine.clearing) return;
       engine.pendingSets.clear();
       engine.pendingDeletes.clear();
       void engine.adapter.clear().catch((error) => disableEngine(engine, error));
@@ -54173,7 +54384,8 @@ function initPersistedClientCache(adapter, options = {}) {
     pendingDeletes: /* @__PURE__ */ new Set(),
     flushTimer: void 0,
     hydrating: false,
-    disabled: false
+    disabled: false,
+    clearing: false
   };
   activeEngine = engine;
   engine.cache.attachPersistence(createSink(engine));
@@ -54188,6 +54400,7 @@ function disposePersistedClientCache() {
   const engine = activeEngine;
   if (!engine) return;
   activeEngine = void 0;
+  engine.disabled = true;
   engine.cache.attachPersistence(void 0);
   if (engine.flushTimer !== void 0) {
     clearTimeout(engine.flushTimer);
@@ -54199,7 +54412,18 @@ function disposePersistedClientCache() {
 __name(disposePersistedClientCache, "disposePersistedClientCache");
 async function clearPersistedCache() {
   const engine = activeEngine;
-  if (!engine) return;
+  if (!engine) {
+    getFarmClientDataCache().clear();
+    return;
+  }
+  engine.pendingSets.clear();
+  engine.pendingDeletes.clear();
+  engine.clearing = true;
+  try {
+    engine.cache.clear();
+  } finally {
+    engine.clearing = false;
+  }
   engine.pendingSets.clear();
   engine.pendingDeletes.clear();
   try {
@@ -57672,6 +57896,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   defineStorageClient,
   defineTask,
   defineWorkflow,
+  describeIntegrationOriginRejection,
   discoverFarmDocsPages,
   discoverFarmWorkflows,
   dispatchIntegrationRequest,
@@ -57868,6 +58093,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   resolveFarmRouteRuleRuntimeConfig,
   resolveFarmRouteRuntimeConfig,
   resolveFarmThemeConfig,
+  resolveIntegrationAllowedOrigins,
   resolveIntegrationOrmRuntimeClient,
   resolveIntegrationPlugins,
   resolveMarkdownConfig,
@@ -57928,6 +58154,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   useServerFn,
   useServerQuery,
   useTheme,
+  validateIntegrationRequestOrigin,
   validateServerActionRequest,
   vercelBlobStorage,
   vercelKVStorage,