@farm.js/core 0.1.0-beta.97 → 0.1.0-beta.98

package/dist/vite.cjs

@@ -922,6 +922,29 @@ var init_search_params = __esm({
   }
 });
 
+// src/utils/runtime-env.ts
+function getFarmRuntimeBindings() {
+  const runtimeBindings = globalThis.__env__;
+  return runtimeBindings && typeof runtimeBindings === "object" ? runtimeBindings : void 0;
+}
+function readFarmEnvironmentValue(name2) {
+  const runtimeValue = getFarmRuntimeBindings()?.[name2];
+  if (typeof runtimeValue === "string") return runtimeValue;
+  return typeof process !== "undefined" ? process.env?.[name2] : void 0;
+}
+function isFarmDeployedRuntime() {
+  if (getFarmRuntimeBindings()) return true;
+  return readFarmEnvironmentValue("NODE_ENV") === "production";
+}
+var init_runtime_env = __esm({
+  "src/utils/runtime-env.ts"() {
+    "use strict";
+    __name(getFarmRuntimeBindings, "getFarmRuntimeBindings");
+    __name(readFarmEnvironmentValue, "readFarmEnvironmentValue");
+    __name(isFarmDeployedRuntime, "isFarmDeployedRuntime");
+  }
+});
+
 // src/utils/decode.ts
 function decodeRouteSegment(segment) {
   try {
@@ -1364,7 +1387,8 @@ function resolveWorkflowsConfig(workflows) {
     dirs,
     route: normalizeWorkflowRoute(options.route || DEFAULT_FARM_WORKFLOW_ROUTE),
     secretEnv: options.secretEnv || DEFAULT_FARM_WORKFLOW_SECRET_ENV,
-    secret: options.secret
+    secret: options.secret,
+    allowUnsecured: options.allowUnsecured === true
   };
 }
 async function discoverFarmWorkflows(config, options = {}) {
@@ -1490,8 +1514,11 @@ async function prepareFarmWorkflowsForNitro(config) {
   await fs14.mkdir(generatedDir, { recursive: true });
   const tasks = {};
   const scheduledTasks = createScheduledTasks(workflows);
+  const wrapperNames = resolveWorkflowWrapperFileNames(workflows.map((workflow) => workflow.id));
   for (const workflow of workflows) {
-    const wrapperPath = toPosixPath(path35.join(generatedDir, `${safeFileName(workflow.id)}.mjs`));
+    const wrapperPath = toPosixPath(
+      path35.join(generatedDir, `${wrapperNames.get(workflow.id)}.mjs`)
+    );
     await fs14.writeFile(wrapperPath, createNitroTaskWrapper(workflow), "utf8");
     tasks[workflow.id] = {
       handler: wrapperPath,
@@ -1852,8 +1879,16 @@ function readScheduledTime(payload) {
   return payload && typeof payload === "object" && "scheduledTime" in payload ? payload.scheduledTime : void 0;
 }
 function verifyWorkflowSecret(request, config) {
-  const secret = config.secret || process.env[config.secretEnv] || "";
-  if (!secret) return null;
+  const secret = config.secret || readFarmEnvironmentValue(config.secretEnv) || "";
+  if (!secret) {
+    if (config.allowUnsecured === true || !isFarmDeployedRuntime()) return null;
+    return Response.json(
+      {
+        error: "Workflow route requires a secret. Set the CRON_SECRET environment variable, configure workflows.secret, or set workflows.allowUnsecured to true."
+      },
+      { status: 401 }
+    );
+  }
   const authorization = request.headers.get("authorization") || "";
   const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1] || "";
   const headerSecret = request.headers.get("x-farm-workflow-secret") || "";
@@ -1866,6 +1901,37 @@ function joinRoute(...parts) {
 function trimSlashes(value) {
   return value.replace(/^\/+|\/+$/g, "");
 }
+function resolveWorkflowWrapperFileNames(ids) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const key = safeFileName(id).toLowerCase();
+    groups.set(key, (groups.get(key) ?? 0) + 1);
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  const claimed = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const base = safeFileName(id);
+    const key = base.toLowerCase();
+    const fileName = (groups.get(key) ?? 0) > 1 ? `${key}-${workflowIdFingerprint(id)}` : base;
+    const claimedBy = claimed.get(fileName.toLowerCase());
+    if (claimedBy !== void 0) {
+      throw new Error(
+        `Farm workflows ${JSON.stringify(claimedBy)} and ${JSON.stringify(id)} generate the same wrapper file ${JSON.stringify(`${fileName}.mjs`)}. Rename one of them.`
+      );
+    }
+    claimed.set(fileName.toLowerCase(), id);
+    resolved.set(id, fileName);
+  }
+  return resolved;
+}
+function workflowIdFingerprint(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
 function safeFileName(value) {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-") || "workflow";
 }
@@ -1878,6 +1944,7 @@ var init_workflows = __esm({
     "use strict";
     init_server_http();
     init_search_params();
+    init_runtime_env();
     init_decode();
     init_utils();
     init_route_pattern();
@@ -1917,6 +1984,8 @@ var init_workflows = __esm({
     __name(verifyWorkflowSecret, "verifyWorkflowSecret");
     __name(joinRoute, "joinRoute");
     __name(trimSlashes, "trimSlashes");
+    __name(resolveWorkflowWrapperFileNames, "resolveWorkflowWrapperFileNames");
+    __name(workflowIdFingerprint, "workflowIdFingerprint");
     __name(safeFileName, "safeFileName");
     __name(relativePath, "relativePath");
   }
@@ -2067,6 +2136,7 @@ var init_cron = __esm({
   "src/cron.ts"() {
     "use strict";
     init_utils();
+    init_runtime_env();
     DEFAULT_FARM_CRON_SECRET_ENV = "CRON_SECRET";
     CRON_FIELD_RANGES = [
       [0, 59, "minute"],
@@ -2447,9 +2517,13 @@ function getStorage(namespace) {
   const namespaced = (0, import_unstorage.prefixStorage)(globalStorage, base);
   return {
     ...namespaced,
-    async clear() {
-      const keys = await namespaced.getKeys();
-      await Promise.all(keys.map((key) => namespaced.removeItem(key)));
+    // Scope the wipe to the namespace instead of the whole storage, and keep
+    // the caller's base so `clear("sessions")` cannot take unrelated keys with
+    // it. Dropping the argument silently widens a targeted clear into a
+    // namespace-wide delete.
+    async clear(base2, opts) {
+      const keys = await namespaced.getKeys(base2);
+      await Promise.all(keys.map((key) => namespaced.removeItem(key, opts)));
     }
   };
 }
@@ -3383,6 +3457,46 @@ var init_cache_invalidation = __esm({
   }
 });
 
+// src/request-origin.ts
+function normalizeAllowedOriginPattern(value, label) {
+  const pattern = value.trim().toLowerCase();
+  if (!pattern) {
+    throw new TypeError(`${label} cannot contain empty values`);
+  }
+  if (pattern.includes("*")) {
+    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
+      throw new TypeError(`Invalid ${label} pattern: ${JSON.stringify(value)}`);
+    }
+    return pattern;
+  }
+  if (pattern.includes("://")) {
+    let parsed;
+    try {
+      parsed = new URL(pattern);
+    } catch {
+      throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      throw new TypeError(`${label} must contain origins without paths: ${JSON.stringify(value)}`);
+    }
+    return parsed.origin;
+  }
+  if (/[/@?#]/.test(pattern)) {
+    throw new TypeError(`${label} must contain origins or hosts: ${JSON.stringify(value)}`);
+  }
+  try {
+    return new URL(`http://${pattern}`).host;
+  } catch {
+    throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+  }
+}
+var init_request_origin = __esm({
+  "src/request-origin.ts"() {
+    "use strict";
+    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
+  }
+});
+
 // src/server-fn-error.ts
 var init_server_fn_error = __esm({
   "src/server-fn-error.ts"() {
@@ -3392,7 +3506,9 @@ var init_server_fn_error = __esm({
 
 // src/server-action-security.ts
 function resolveServerActionsConfig(config) {
-  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);
+  const allowedOrigins = (config?.allowedOrigins ?? []).map(
+    (value) => normalizeAllowedOriginPattern(value, SERVER_ACTION_ALLOWED_ORIGINS_LABEL)
+  );
   const bodySizeLimit = parseBodySizeLimit(
     config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,
     "serverActions.bodySizeLimit"
@@ -3412,50 +3528,16 @@ function getServerActionStorage() {
   }
   return globalState2[SERVER_ACTION_STORAGE_KEY];
 }
-function normalizeAllowedOriginPattern(value) {
-  const pattern = value.trim().toLowerCase();
-  if (!pattern) {
-    throw new TypeError("serverActions.allowedOrigins cannot contain empty values");
-  }
-  if (pattern.includes("*")) {
-    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
-      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);
-    }
-    return pattern;
-  }
-  if (pattern.includes("://")) {
-    let parsed;
-    try {
-      parsed = new URL(pattern);
-    } catch {
-      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-      throw new TypeError(
-        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`
-      );
-    }
-    return parsed.origin;
-  }
-  if (/[/@?#]/.test(pattern)) {
-    throw new TypeError(
-      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`
-    );
-  }
-  try {
-    return new URL(`http://${pattern}`).host;
-  } catch {
-    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-  }
-}
-var import_node_async_hooks, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, SERVER_ACTION_STORAGE_KEY;
+var import_node_async_hooks, SERVER_ACTION_ALLOWED_ORIGINS_LABEL, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, SERVER_ACTION_STORAGE_KEY;
 var init_server_action_security = __esm({
   "src/server-action-security.ts"() {
     "use strict";
     import_node_async_hooks = require("async_hooks");
     init_cache_invalidation();
+    init_request_origin();
     init_server_fn_error();
     init_server_http();
+    SERVER_ACTION_ALLOWED_ORIGINS_LABEL = "serverActions.allowedOrigins";
     DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1e6;
     SERVER_ACTION_STORAGE_KEY = /* @__PURE__ */ Symbol.for("farm.serverActionStorage");
     __name(resolveServerActionsConfig, "resolveServerActionsConfig");
@@ -3467,7 +3549,6 @@ var init_server_action_security = __esm({
       getServerActionExecutionContext()?.cacheTasks.add(task);
     });
     __name(getServerActionStorage, "getServerActionStorage");
-    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
   }
 });
 
@@ -5740,6 +5821,14 @@ var init_routes = __esm({
   }
 });
 
+// src/integration-request-security.ts
+var init_integration_request_security = __esm({
+  "src/integration-request-security.ts"() {
+    "use strict";
+    init_request_origin();
+  }
+});
+
 // src/integration-api.ts
 function defineIntegrationAPIOperation(operation) {
   return {
@@ -7205,6 +7294,7 @@ var init_integrations = __esm({
   "src/integrations.ts"() {
     "use strict";
     init_route_pattern();
+    init_integration_request_security();
     init_integration_api();
     init_plugin_integration_context();
     init_decode();
@@ -8830,10 +8920,11 @@ function createFarmImageHandler(config, options) {
         "quality"
       );
       const accept = request.headers.get("accept") ?? "";
+      const negotiatedFormat = selectOutputFormat(accept, config.formats) ?? "";
       const cacheKey = `${sourceUrl.href}
 ${width}
 ${quality}
-${accept}`;
+${negotiatedFormat}`;
       let optimized = cache.get(cacheKey);
       if (!optimized) {
         const fetchedSource = await fetchImageSource(
@@ -8860,7 +8951,8 @@ ${accept}`;
           quality,
           accept,
           formats: config.formats,
-          signal: request.signal
+          signal: request.signal,
+          maximumResponseBody: config.maximumResponseBody
         });
         throwIfAborted2(request.signal);
         validateTransformedResult(result, config);
@@ -9191,7 +9283,7 @@ function throwIfAborted2(signal) {
 function isAbortError(error) {
   return error instanceof Error && error.name === "AbortError";
 }
-var _FarmImageRequestError, FarmImageRequestError, _FarmImageMemoryCache, FarmImageMemoryCache;
+var _FarmImageRequestError, FarmImageRequestError, DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT, _FarmImageMemoryCache, FarmImageMemoryCache;
 var init_image_server = __esm({
   "src/image-server.ts"() {
     "use strict";
@@ -9207,6 +9299,7 @@ var init_image_server = __esm({
     __name(_FarmImageRequestError, "FarmImageRequestError");
     FarmImageRequestError = _FarmImageRequestError;
     __name(createFarmImageHandler, "createFarmImageHandler");
+    DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT = 10 * 1024 * 1024;
     __name(selectOutputFormat, "selectOutputFormat");
     __name(isPrivateImageAddress, "isPrivateImageAddress");
     __name(parseAllowedInteger, "parseAllowedInteger");
@@ -21899,7 +21992,7 @@ _setFarmThemeServerSnapshotResolver(() => {
 });
 
 // package.json
-var version = "0.1.0-beta.97";
+var version = "0.1.0-beta.98";
 
 // src/version.ts
 var FARM_VERSION = version;