@farm.js/core 0.1.0-beta.97 → 0.1.0-beta.98

package/dist/internal/config-runtime.cjs

@@ -392,9 +392,13 @@ function getStorage(namespace) {
   const namespaced = (0, import_unstorage.prefixStorage)(globalStorage, base);
   return {
     ...namespaced,
-    async clear() {
-      const keys = await namespaced.getKeys();
-      await Promise.all(keys.map((key) => namespaced.removeItem(key)));
+    // Scope the wipe to the namespace instead of the whole storage, and keep
+    // the caller's base so `clear("sessions")` cannot take unrelated keys with
+    // it. Dropping the argument silently widens a targeted clear into a
+    // namespace-wide delete.
+    async clear(base2, opts) {
+      const keys = await namespaced.getKeys(base2);
+      await Promise.all(keys.map((key) => namespaced.removeItem(key, opts)));
     }
   };
 }
@@ -888,6 +892,41 @@ function validateConfigRouteSource(source, field = "Config route source") {
 }
 __name(validateConfigRouteSource, "validateConfigRouteSource");
 
+// src/request-origin.ts
+function normalizeAllowedOriginPattern(value, label) {
+  const pattern = value.trim().toLowerCase();
+  if (!pattern) {
+    throw new TypeError(`${label} cannot contain empty values`);
+  }
+  if (pattern.includes("*")) {
+    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
+      throw new TypeError(`Invalid ${label} pattern: ${JSON.stringify(value)}`);
+    }
+    return pattern;
+  }
+  if (pattern.includes("://")) {
+    let parsed;
+    try {
+      parsed = new URL(pattern);
+    } catch {
+      throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      throw new TypeError(`${label} must contain origins without paths: ${JSON.stringify(value)}`);
+    }
+    return parsed.origin;
+  }
+  if (/[/@?#]/.test(pattern)) {
+    throw new TypeError(`${label} must contain origins or hosts: ${JSON.stringify(value)}`);
+  }
+  try {
+    return new URL(`http://${pattern}`).host;
+  } catch {
+    throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+  }
+}
+__name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
+
 // src/integration-api.ts
 function defineIntegrationAPIOperation(operation) {
   return {
@@ -3217,7 +3256,8 @@ function resolveWorkflowsConfig(workflows) {
     dirs,
     route: normalizeWorkflowRoute(options.route || DEFAULT_FARM_WORKFLOW_ROUTE),
     secretEnv: options.secretEnv || DEFAULT_FARM_WORKFLOW_SECRET_ENV,
-    secret: options.secret
+    secret: options.secret,
+    allowUnsecured: options.allowUnsecured === true
   };
 }
 __name(resolveWorkflowsConfig, "resolveWorkflowsConfig");
@@ -3731,10 +3771,13 @@ function subscribeFarmCacheTask(listener) {
 __name(subscribeFarmCacheTask, "subscribeFarmCacheTask");
 
 // src/server-action-security.ts
+var SERVER_ACTION_ALLOWED_ORIGINS_LABEL = "serverActions.allowedOrigins";
 var DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1e6;
 var SERVER_ACTION_STORAGE_KEY = /* @__PURE__ */ Symbol.for("farm.serverActionStorage");
 function resolveServerActionsConfig(config) {
-  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);
+  const allowedOrigins = (config?.allowedOrigins ?? []).map(
+    (value) => normalizeAllowedOriginPattern(value, SERVER_ACTION_ALLOWED_ORIGINS_LABEL)
+  );
   const bodySizeLimit = parseBodySizeLimit(
     config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,
     "serverActions.bodySizeLimit"
@@ -3763,43 +3806,6 @@ function getServerActionStorage() {
   return globalState2[SERVER_ACTION_STORAGE_KEY];
 }
 __name(getServerActionStorage, "getServerActionStorage");
-function normalizeAllowedOriginPattern(value) {
-  const pattern = value.trim().toLowerCase();
-  if (!pattern) {
-    throw new TypeError("serverActions.allowedOrigins cannot contain empty values");
-  }
-  if (pattern.includes("*")) {
-    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
-      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);
-    }
-    return pattern;
-  }
-  if (pattern.includes("://")) {
-    let parsed;
-    try {
-      parsed = new URL(pattern);
-    } catch {
-      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-      throw new TypeError(
-        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`
-      );
-    }
-    return parsed.origin;
-  }
-  if (/[/@?#]/.test(pattern)) {
-    throw new TypeError(
-      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`
-    );
-  }
-  try {
-    return new URL(`http://${pattern}`).host;
-  } catch {
-    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-  }
-}
-__name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
 
 // src/layers.ts
 var import_node_fs = require("fs");