@farm.js/core 0.1.0-beta.97 → 0.1.0-beta.98

package/dist/server.cjs

@@ -922,6 +922,29 @@ var init_search_params = __esm({
   }
 });
 
+// src/utils/runtime-env.ts
+function getFarmRuntimeBindings() {
+  const runtimeBindings = globalThis.__env__;
+  return runtimeBindings && typeof runtimeBindings === "object" ? runtimeBindings : void 0;
+}
+function readFarmEnvironmentValue(name2) {
+  const runtimeValue = getFarmRuntimeBindings()?.[name2];
+  if (typeof runtimeValue === "string") return runtimeValue;
+  return typeof process !== "undefined" ? process.env?.[name2] : void 0;
+}
+function isFarmDeployedRuntime() {
+  if (getFarmRuntimeBindings()) return true;
+  return readFarmEnvironmentValue("NODE_ENV") === "production";
+}
+var init_runtime_env = __esm({
+  "src/utils/runtime-env.ts"() {
+    "use strict";
+    __name(getFarmRuntimeBindings, "getFarmRuntimeBindings");
+    __name(readFarmEnvironmentValue, "readFarmEnvironmentValue");
+    __name(isFarmDeployedRuntime, "isFarmDeployedRuntime");
+  }
+});
+
 // src/utils/decode.ts
 function decodeRouteSegment(segment) {
   try {
@@ -1491,7 +1514,8 @@ function resolveWorkflowsConfig(workflows) {
     dirs,
     route: normalizeWorkflowRoute(options.route || DEFAULT_FARM_WORKFLOW_ROUTE),
     secretEnv: options.secretEnv || DEFAULT_FARM_WORKFLOW_SECRET_ENV,
-    secret: options.secret
+    secret: options.secret,
+    allowUnsecured: options.allowUnsecured === true
   };
 }
 async function discoverFarmWorkflows(config, options = {}) {
@@ -1617,8 +1641,11 @@ async function prepareFarmWorkflowsForNitro(config) {
   await fs16.mkdir(generatedDir, { recursive: true });
   const tasks = {};
   const scheduledTasks = createScheduledTasks(workflows);
+  const wrapperNames = resolveWorkflowWrapperFileNames(workflows.map((workflow) => workflow.id));
   for (const workflow of workflows) {
-    const wrapperPath = toPosixPath(path37.join(generatedDir, `${safeFileName(workflow.id)}.mjs`));
+    const wrapperPath = toPosixPath(
+      path37.join(generatedDir, `${wrapperNames.get(workflow.id)}.mjs`)
+    );
     await fs16.writeFile(wrapperPath, createNitroTaskWrapper(workflow), "utf8");
     tasks[workflow.id] = {
       handler: wrapperPath,
@@ -1979,8 +2006,16 @@ function readScheduledTime(payload) {
   return payload && typeof payload === "object" && "scheduledTime" in payload ? payload.scheduledTime : void 0;
 }
 function verifyWorkflowSecret(request, config) {
-  const secret = config.secret || process.env[config.secretEnv] || "";
-  if (!secret) return null;
+  const secret = config.secret || readFarmEnvironmentValue(config.secretEnv) || "";
+  if (!secret) {
+    if (config.allowUnsecured === true || !isFarmDeployedRuntime()) return null;
+    return Response.json(
+      {
+        error: "Workflow route requires a secret. Set the CRON_SECRET environment variable, configure workflows.secret, or set workflows.allowUnsecured to true."
+      },
+      { status: 401 }
+    );
+  }
   const authorization = request.headers.get("authorization") || "";
   const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1] || "";
   const headerSecret = request.headers.get("x-farm-workflow-secret") || "";
@@ -1993,6 +2028,37 @@ function joinRoute(...parts) {
 function trimSlashes(value) {
   return value.replace(/^\/+|\/+$/g, "");
 }
+function resolveWorkflowWrapperFileNames(ids) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const key = safeFileName(id).toLowerCase();
+    groups.set(key, (groups.get(key) ?? 0) + 1);
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  const claimed = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const base = safeFileName(id);
+    const key = base.toLowerCase();
+    const fileName = (groups.get(key) ?? 0) > 1 ? `${key}-${workflowIdFingerprint(id)}` : base;
+    const claimedBy = claimed.get(fileName.toLowerCase());
+    if (claimedBy !== void 0) {
+      throw new Error(
+        `Farm workflows ${JSON.stringify(claimedBy)} and ${JSON.stringify(id)} generate the same wrapper file ${JSON.stringify(`${fileName}.mjs`)}. Rename one of them.`
+      );
+    }
+    claimed.set(fileName.toLowerCase(), id);
+    resolved.set(id, fileName);
+  }
+  return resolved;
+}
+function workflowIdFingerprint(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
 function safeFileName(value) {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-") || "workflow";
 }
@@ -2005,6 +2071,7 @@ var init_workflows = __esm({
     "use strict";
     init_server_http();
     init_search_params();
+    init_runtime_env();
     init_decode();
     init_utils();
     init_route_pattern();
@@ -2044,6 +2111,8 @@ var init_workflows = __esm({
     __name(verifyWorkflowSecret, "verifyWorkflowSecret");
     __name(joinRoute, "joinRoute");
     __name(trimSlashes, "trimSlashes");
+    __name(resolveWorkflowWrapperFileNames, "resolveWorkflowWrapperFileNames");
+    __name(workflowIdFingerprint, "workflowIdFingerprint");
     __name(safeFileName, "safeFileName");
     __name(relativePath, "relativePath");
   }
@@ -2194,6 +2263,7 @@ var init_cron = __esm({
   "src/cron.ts"() {
     "use strict";
     init_utils();
+    init_runtime_env();
     DEFAULT_FARM_CRON_SECRET_ENV = "CRON_SECRET";
     CRON_FIELD_RANGES = [
       [0, 59, "minute"],
@@ -2574,9 +2644,13 @@ function getStorage(namespace) {
   const namespaced = (0, import_unstorage.prefixStorage)(globalStorage, base);
   return {
     ...namespaced,
-    async clear() {
-      const keys = await namespaced.getKeys();
-      await Promise.all(keys.map((key) => namespaced.removeItem(key)));
+    // Scope the wipe to the namespace instead of the whole storage, and keep
+    // the caller's base so `clear("sessions")` cannot take unrelated keys with
+    // it. Dropping the argument silently widens a targeted clear into a
+    // namespace-wide delete.
+    async clear(base2, opts) {
+      const keys = await namespaced.getKeys(base2);
+      await Promise.all(keys.map((key) => namespaced.removeItem(key, opts)));
     }
   };
 }
@@ -3571,6 +3645,114 @@ var init_cache_invalidation = __esm({
   }
 });
 
+// src/request-origin.ts
+function getRequestSourceOrigin(request) {
+  const origin = request.headers.get("origin")?.trim();
+  if (origin) {
+    return parseSourceOrigin(origin);
+  }
+  const referer = request.headers.get("referer")?.trim();
+  if (referer) {
+    return parseSourceOrigin(referer);
+  }
+  return { ok: true, origin: null };
+}
+function parseSourceOrigin(value) {
+  if (value === "null") {
+    return { ok: false, reason: "opaque-origin" };
+  }
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return { ok: false, reason: "invalid-origin" };
+    }
+    return { ok: true, origin: parsed.origin };
+  } catch {
+    return { ok: false, reason: "invalid-origin" };
+  }
+}
+function matchesHostHeader(sourceOrigin, request) {
+  const host = request.headers.get("host")?.trim().toLowerCase();
+  if (!host) return false;
+  try {
+    const source = new URL(sourceOrigin);
+    const target = new URL(request.url);
+    return source.protocol === target.protocol && source.host.toLowerCase() === host;
+  } catch {
+    return false;
+  }
+}
+function matchesAllowedOrigin(sourceOrigin, pattern) {
+  const source = new URL(sourceOrigin);
+  if (!pattern.includes("*")) {
+    return pattern.includes("://") ? source.origin === pattern : source.host === pattern;
+  }
+  const schemeEnd = pattern.indexOf("://");
+  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);
+  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);
+  const [wildcardHost, port] = splitHostAndPort(hostPattern);
+  const baseHost = wildcardHost.slice(2);
+  if (scheme && source.protocol !== scheme) return false;
+  if (port && getEffectivePort(source) !== port) return false;
+  if (!port && source.port) return false;
+  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;
+}
+function normalizeAllowedOriginPattern(value, label) {
+  const pattern = value.trim().toLowerCase();
+  if (!pattern) {
+    throw new TypeError(`${label} cannot contain empty values`);
+  }
+  if (pattern.includes("*")) {
+    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
+      throw new TypeError(`Invalid ${label} pattern: ${JSON.stringify(value)}`);
+    }
+    return pattern;
+  }
+  if (pattern.includes("://")) {
+    let parsed;
+    try {
+      parsed = new URL(pattern);
+    } catch {
+      throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      throw new TypeError(`${label} must contain origins without paths: ${JSON.stringify(value)}`);
+    }
+    return parsed.origin;
+  }
+  if (/[/@?#]/.test(pattern)) {
+    throw new TypeError(`${label} must contain origins or hosts: ${JSON.stringify(value)}`);
+  }
+  try {
+    return new URL(`http://${pattern}`).host;
+  } catch {
+    throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+  }
+}
+function splitHostAndPort(value) {
+  const separator = value.lastIndexOf(":");
+  if (separator === -1) return [value, null];
+  return [value.slice(0, separator), value.slice(separator + 1)];
+}
+function getEffectivePort(url) {
+  if (url.port) return url.port;
+  if (url.protocol === "https:") return "443";
+  if (url.protocol === "http:") return "80";
+  return "";
+}
+var init_request_origin = __esm({
+  "src/request-origin.ts"() {
+    "use strict";
+    __name(getRequestSourceOrigin, "getRequestSourceOrigin");
+    __name(parseSourceOrigin, "parseSourceOrigin");
+    __name(matchesHostHeader, "matchesHostHeader");
+    __name(matchesAllowedOrigin, "matchesAllowedOrigin");
+    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
+    __name(splitHostAndPort, "splitHostAndPort");
+    __name(getEffectivePort, "getEffectivePort");
+  }
+});
+
 // src/server-fn-error.ts
 function isServerFnFailure(value) {
   if (!value || typeof value !== "object") return false;
@@ -3614,7 +3796,9 @@ var init_server_fn_error = __esm({
 
 // src/server-action-security.ts
 function resolveServerActionsConfig(config) {
-  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);
+  const allowedOrigins = (config?.allowedOrigins ?? []).map(
+    (value) => normalizeAllowedOriginPattern(value, SERVER_ACTION_ALLOWED_ORIGINS_LABEL)
+  );
   const bodySizeLimit = parseBodySizeLimit(
     config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,
     "serverActions.bodySizeLimit"
@@ -3633,7 +3817,7 @@ function validateServerActionRequest(request, config) {
     );
   }
   const requestUrl = new URL(request.url);
-  const sourceOrigin = getRequestSourceOrigin(request);
+  const sourceOrigin = resolveSourceOrigin(request);
   const fetchSite = request.headers.get("sec-fetch-site")?.trim().toLowerCase();
   if (!sourceOrigin) {
     if (fetchSite !== "same-origin") {
@@ -3749,103 +3933,16 @@ function getFallbackAbortController() {
   }
   return globalState2[FALLBACK_ABORT_CONTROLLER_KEY];
 }
-function normalizeAllowedOriginPattern(value) {
-  const pattern = value.trim().toLowerCase();
-  if (!pattern) {
-    throw new TypeError("serverActions.allowedOrigins cannot contain empty values");
-  }
-  if (pattern.includes("*")) {
-    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
-      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);
-    }
-    return pattern;
-  }
-  if (pattern.includes("://")) {
-    let parsed;
-    try {
-      parsed = new URL(pattern);
-    } catch {
-      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-      throw new TypeError(
-        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`
-      );
-    }
-    return parsed.origin;
-  }
-  if (/[/@?#]/.test(pattern)) {
-    throw new TypeError(
-      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`
+function resolveSourceOrigin(request) {
+  const result = getRequestSourceOrigin(request);
+  if (!result.ok) {
+    throw new ServerActionRequestError(
+      "INVALID_ORIGIN",
+      403,
+      result.reason === "opaque-origin" ? "Opaque origins are not allowed" : "Invalid request origin"
     );
   }
-  try {
-    return new URL(`http://${pattern}`).host;
-  } catch {
-    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-  }
-}
-function getRequestSourceOrigin(request) {
-  const origin = request.headers.get("origin")?.trim();
-  if (origin) {
-    return parseSourceOrigin(origin);
-  }
-  const referer = request.headers.get("referer")?.trim();
-  if (referer) {
-    return parseSourceOrigin(referer);
-  }
-  return null;
-}
-function parseSourceOrigin(value) {
-  if (value === "null") {
-    throw new ServerActionRequestError("INVALID_ORIGIN", 403, "Opaque origins are not allowed");
-  }
-  try {
-    const parsed = new URL(value);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      throw new Error("Unsupported protocol");
-    }
-    return parsed.origin;
-  } catch {
-    throw new ServerActionRequestError("INVALID_ORIGIN", 403, "Invalid request origin");
-  }
-}
-function matchesHostHeader(sourceOrigin, request) {
-  const host = request.headers.get("host")?.trim().toLowerCase();
-  if (!host) return false;
-  try {
-    const source = new URL(sourceOrigin);
-    const target = new URL(request.url);
-    return source.protocol === target.protocol && source.host.toLowerCase() === host;
-  } catch {
-    return false;
-  }
-}
-function matchesAllowedOrigin(sourceOrigin, pattern) {
-  const source = new URL(sourceOrigin);
-  if (!pattern.includes("*")) {
-    return pattern.includes("://") ? source.origin === pattern : source.host === pattern;
-  }
-  const schemeEnd = pattern.indexOf("://");
-  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);
-  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);
-  const [wildcardHost, port] = splitHostAndPort(hostPattern);
-  const baseHost = wildcardHost.slice(2);
-  if (scheme && source.protocol !== scheme) return false;
-  if (port && getEffectivePort(source) !== port) return false;
-  if (!port && source.port) return false;
-  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;
-}
-function splitHostAndPort(value) {
-  const separator = value.lastIndexOf(":");
-  if (separator === -1) return [value, null];
-  return [value.slice(0, separator), value.slice(separator + 1)];
-}
-function getEffectivePort(url) {
-  if (url.port) return url.port;
-  if (url.protocol === "https:") return "443";
-  if (url.protocol === "http:") return "80";
-  return "";
+  return result.origin;
 }
 function validateActionId(actionId) {
   if (!actionId || actionId.length > 4096 || hasControlCharacters(actionId)) {
@@ -3966,14 +4063,16 @@ function throwIfAborted2(signal) {
   if (signal.reason !== void 0) throw signal.reason;
   throw new DOMException("The operation was aborted", "AbortError");
 }
-var import_node_async_hooks, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, _ServerActionRequestError, ServerActionRequestError, SERVER_ACTION_STORAGE_KEY, FALLBACK_ABORT_CONTROLLER_KEY, FORM_ACTION_CONTENT_TYPES, JAVASCRIPT_ACTION_CONTENT_TYPES;
+var import_node_async_hooks, SERVER_ACTION_ALLOWED_ORIGINS_LABEL, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, _ServerActionRequestError, ServerActionRequestError, SERVER_ACTION_STORAGE_KEY, FALLBACK_ABORT_CONTROLLER_KEY, FORM_ACTION_CONTENT_TYPES, JAVASCRIPT_ACTION_CONTENT_TYPES;
 var init_server_action_security = __esm({
   "src/server-action-security.ts"() {
     "use strict";
     import_node_async_hooks = require("async_hooks");
     init_cache_invalidation();
+    init_request_origin();
     init_server_fn_error();
     init_server_http();
+    SERVER_ACTION_ALLOWED_ORIGINS_LABEL = "serverActions.allowedOrigins";
     DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1e6;
     _ServerActionRequestError = class _ServerActionRequestError extends Error {
       constructor(code, status, message) {
@@ -4014,13 +4113,7 @@ var init_server_action_security = __esm({
     });
     __name(getServerActionStorage, "getServerActionStorage");
     __name(getFallbackAbortController, "getFallbackAbortController");
-    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
-    __name(getRequestSourceOrigin, "getRequestSourceOrigin");
-    __name(parseSourceOrigin, "parseSourceOrigin");
-    __name(matchesHostHeader, "matchesHostHeader");
-    __name(matchesAllowedOrigin, "matchesAllowedOrigin");
-    __name(splitHostAndPort, "splitHostAndPort");
-    __name(getEffectivePort, "getEffectivePort");
+    __name(resolveSourceOrigin, "resolveSourceOrigin");
     __name(validateActionId, "validateActionId");
     __name(hasControlCharacters, "hasControlCharacters");
     __name(getSupportedContentType, "getSupportedContentType");
@@ -6398,6 +6491,14 @@ var init_routes = __esm({
   }
 });
 
+// src/integration-request-security.ts
+var init_integration_request_security = __esm({
+  "src/integration-request-security.ts"() {
+    "use strict";
+    init_request_origin();
+  }
+});
+
 // src/integration-api.ts
 function defineIntegrationAPIOperation(operation) {
   return {
@@ -8573,6 +8674,7 @@ var init_integrations = __esm({
   "src/integrations.ts"() {
     "use strict";
     init_route_pattern();
+    init_integration_request_security();
     init_integration_api();
     init_plugin_integration_context();
     init_decode();
@@ -10338,10 +10440,11 @@ function createFarmImageHandler(config, options) {
         "quality"
       );
       const accept = request.headers.get("accept") ?? "";
+      const negotiatedFormat = selectOutputFormat(accept, config.formats) ?? "";
       const cacheKey = `${sourceUrl.href}
 ${width}
 ${quality}
-${accept}`;
+${negotiatedFormat}`;
       let optimized = cache.get(cacheKey);
       if (!optimized) {
         const fetchedSource = await fetchImageSource(
@@ -10368,7 +10471,8 @@ ${accept}`;
           quality,
           accept,
           formats: config.formats,
-          signal: request.signal
+          signal: request.signal,
+          maximumResponseBody: config.maximumResponseBody
         });
         throwIfAborted3(request.signal);
         validateTransformedResult(result, config);
@@ -10699,7 +10803,7 @@ function throwIfAborted3(signal) {
 function isAbortError(error) {
   return error instanceof Error && error.name === "AbortError";
 }
-var _FarmImageRequestError, FarmImageRequestError, _FarmImageMemoryCache, FarmImageMemoryCache;
+var _FarmImageRequestError, FarmImageRequestError, DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT, _FarmImageMemoryCache, FarmImageMemoryCache;
 var init_image_server = __esm({
   "src/image-server.ts"() {
     "use strict";
@@ -10715,6 +10819,7 @@ var init_image_server = __esm({
     __name(_FarmImageRequestError, "FarmImageRequestError");
     FarmImageRequestError = _FarmImageRequestError;
     __name(createFarmImageHandler, "createFarmImageHandler");
+    DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT = 10 * 1024 * 1024;
     __name(selectOutputFormat, "selectOutputFormat");
     __name(isPrivateImageAddress, "isPrivateImageAddress");
     __name(parseAllowedInteger, "parseAllowedInteger");
@@ -23907,7 +24012,7 @@ _setFarmThemeServerSnapshotResolver(() => {
 });
 
 // package.json
-var version = "0.1.0-beta.97";
+var version = "0.1.0-beta.98";
 
 // src/version.ts
 var FARM_VERSION = version;