@farm.js/core 0.1.16 → 0.1.18

package/dist/server-action-security.cjs

@@ -1,547 +1,31 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
 
-// src/server-action-security.ts
-var server_action_security_exports = {};
-__export(server_action_security_exports, {
-  DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT: () => DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,
-  ServerActionRequestError: () => ServerActionRequestError,
-  createServerActionRequestErrorResponse: () => createServerActionRequestErrorResponse,
-  getServerActionExecutionContext: () => getServerActionExecutionContext,
-  getServerActionInvalidations: () => getServerActionInvalidations,
-  getServerActionSignal: () => getServerActionSignal,
-  prepareServerActionRequest: () => prepareServerActionRequest,
-  resolveServerActionsConfig: () => resolveServerActionsConfig,
-  runWithServerActionRequest: () => runWithServerActionRequest,
-  sanitizeServerActionError: () => sanitizeServerActionError,
-  validateServerActionRequest: () => validateServerActionRequest
-});
-module.exports = __toCommonJS(server_action_security_exports);
-var import_node_async_hooks = require("async_hooks");
 
-// src/cache-invalidation.ts
-var FARM_CACHE_INVALIDATION_STATE = /* @__PURE__ */ Symbol.for("farm.cacheInvalidationState");
-var globalState = globalThis;
-function getFarmCacheInvalidationState() {
-  return globalState[FARM_CACHE_INVALIDATION_STATE] ?? (globalState[FARM_CACHE_INVALIDATION_STATE] = {
-    listeners: /* @__PURE__ */ new Set(),
-    taskListeners: /* @__PURE__ */ new Set()
-  });
-}
-__name(getFarmCacheInvalidationState, "getFarmCacheInvalidationState");
-function subscribeFarmCacheInvalidation(listener) {
-  const state = getFarmCacheInvalidationState();
-  state.listeners.add(listener);
-  return () => state.listeners.delete(listener);
-}
-__name(subscribeFarmCacheInvalidation, "subscribeFarmCacheInvalidation");
-function subscribeFarmCacheTask(listener) {
-  const state = getFarmCacheInvalidationState();
-  state.taskListeners.add(listener);
-  return () => state.taskListeners.delete(listener);
-}
-__name(subscribeFarmCacheTask, "subscribeFarmCacheTask");
 
-// src/request-origin.ts
-function getRequestSourceOrigin(request) {
-  const origin = request.headers.get("origin")?.trim();
-  if (origin) {
-    return parseSourceOrigin(origin);
-  }
-  const referer = request.headers.get("referer")?.trim();
-  if (referer) {
-    return parseSourceOrigin(referer);
-  }
-  return { ok: true, origin: null };
-}
-__name(getRequestSourceOrigin, "getRequestSourceOrigin");
-function parseSourceOrigin(value) {
-  if (value === "null") {
-    return { ok: false, reason: "opaque-origin" };
-  }
-  try {
-    const parsed = new URL(value);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      return { ok: false, reason: "invalid-origin" };
-    }
-    return { ok: true, origin: parsed.origin };
-  } catch {
-    return { ok: false, reason: "invalid-origin" };
-  }
-}
-__name(parseSourceOrigin, "parseSourceOrigin");
-function matchesHostHeader(sourceOrigin, request) {
-  const host = request.headers.get("host")?.trim().toLowerCase();
-  if (!host) return false;
-  try {
-    const source = new URL(sourceOrigin);
-    const target = new URL(request.url);
-    return source.protocol === target.protocol && source.host.toLowerCase() === host;
-  } catch {
-    return false;
-  }
-}
-__name(matchesHostHeader, "matchesHostHeader");
-function matchesAllowedOrigin(sourceOrigin, pattern) {
-  const source = new URL(sourceOrigin);
-  if (!pattern.includes("*")) {
-    return pattern.includes("://") ? source.origin === pattern : source.host === pattern;
-  }
-  const schemeEnd = pattern.indexOf("://");
-  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);
-  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);
-  const [wildcardHost, port] = splitHostAndPort(hostPattern);
-  const baseHost = wildcardHost.slice(2);
-  if (scheme && source.protocol !== scheme) return false;
-  if (port && getEffectivePort(source) !== port) return false;
-  if (!port && source.port) return false;
-  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;
-}
-__name(matchesAllowedOrigin, "matchesAllowedOrigin");
-function normalizeAllowedOriginPattern(value, label) {
-  const pattern = value.trim().toLowerCase();
-  if (!pattern) {
-    throw new TypeError(`${label} cannot contain empty values`);
-  }
-  if (pattern.includes("*")) {
-    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
-      throw new TypeError(`Invalid ${label} pattern: ${JSON.stringify(value)}`);
-    }
-    return pattern;
-  }
-  if (pattern.includes("://")) {
-    let parsed;
-    try {
-      parsed = new URL(pattern);
-    } catch {
-      throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-      throw new TypeError(`${label} must contain origins without paths: ${JSON.stringify(value)}`);
-    }
-    return parsed.origin;
-  }
-  if (/[/@?#]/.test(pattern)) {
-    throw new TypeError(`${label} must contain origins or hosts: ${JSON.stringify(value)}`);
-  }
-  try {
-    return new URL(`http://${pattern}`).host;
-  } catch {
-    throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
-  }
-}
-__name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
-function splitHostAndPort(value) {
-  const separator = value.lastIndexOf(":");
-  if (separator === -1) return [value, null];
-  return [value.slice(0, separator), value.slice(separator + 1)];
-}
-__name(splitHostAndPort, "splitHostAndPort");
-function getEffectivePort(url) {
-  if (url.port) return url.port;
-  if (url.protocol === "https:") return "443";
-  if (url.protocol === "http:") return "80";
-  return "";
-}
-__name(getEffectivePort, "getEffectivePort");
 
-// src/server-fn-error.ts
-var FARM_SERVER_FN_FAILURE_SYMBOL = /* @__PURE__ */ Symbol.for("farm.server-fn.failure");
-function isServerFnFailure(value) {
-  if (!value || typeof value !== "object") return false;
-  const candidate = value;
-  return candidate[FARM_SERVER_FN_FAILURE_SYMBOL] === true && candidate.name === "ServerFnFailure" && typeof candidate.code === "string" && Number.isInteger(candidate.status) && (candidate.status ?? 0) >= 400 && (candidate.status ?? 0) <= 599;
-}
-__name(isServerFnFailure, "isServerFnFailure");
-function serializeServerFnFailure(value) {
-  if (!isServerFnFailure(value)) return null;
-  return {
-    name: "ServerFnFailure",
-    message: value.message,
-    code: value.code,
-    status: value.status,
-    data: value.data
-  };
-}
-__name(serializeServerFnFailure, "serializeServerFnFailure");
 
-// src/server-http.ts
-function parseBodySizeLimit(value, optionName = "bodySizeLimit") {
-  if (typeof value === "number") {
-    if (!Number.isSafeInteger(value) || value <= 0) {
-      throw new TypeError(`${optionName} must be a positive safe integer`);
-    }
-    return value;
-  }
-  const match = value.trim().toLowerCase().match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb|kib|mib|gib)?$/);
-  if (!match) {
-    throw new TypeError(`${optionName} must be bytes or a size string such as "500kb" or "10mb"`);
-  }
-  const amount = Number(match[1]);
-  const unit = match[2] ?? "b";
-  const multiplier = {
-    b: 1,
-    kb: 1e3,
-    mb: 1e6,
-    gb: 1e9,
-    kib: 1024,
-    mib: 1048576,
-    gib: 1073741824
-  };
-  const bytes = Math.floor(amount * multiplier[unit]);
-  if (!Number.isSafeInteger(bytes) || bytes <= 0) {
-    throw new TypeError(`${optionName} must resolve to a positive safe integer`);
-  }
-  return bytes;
-}
-__name(parseBodySizeLimit, "parseBodySizeLimit");
 
-// src/server-action-security.ts
-var SERVER_ACTION_ALLOWED_ORIGINS_LABEL = "serverActions.allowedOrigins";
-var DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1e6;
-var _ServerActionRequestError = class _ServerActionRequestError extends Error {
-  constructor(code, status, message) {
-    super(message);
-    this.name = "ServerActionRequestError";
-    this.code = code;
-    this.status = status;
-  }
-};
-__name(_ServerActionRequestError, "ServerActionRequestError");
-var ServerActionRequestError = _ServerActionRequestError;
-var SERVER_ACTION_STORAGE_KEY = /* @__PURE__ */ Symbol.for("farm.serverActionStorage");
-var FALLBACK_ABORT_CONTROLLER_KEY = /* @__PURE__ */ Symbol.for("farm.serverActionFallbackAbortController");
-var FORM_ACTION_CONTENT_TYPES = /* @__PURE__ */ new Set([
-  "application/x-www-form-urlencoded",
-  "multipart/form-data"
-]);
-var JAVASCRIPT_ACTION_CONTENT_TYPES = /* @__PURE__ */ new Set([
-  "application/octet-stream",
-  "application/x-www-form-urlencoded",
-  "multipart/form-data",
-  "text/plain"
-]);
-function resolveServerActionsConfig(config) {
-  const allowedOrigins = (config?.allowedOrigins ?? []).map(
-    (value) => normalizeAllowedOriginPattern(value, SERVER_ACTION_ALLOWED_ORIGINS_LABEL)
-  );
-  const bodySizeLimit = parseBodySizeLimit(
-    config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,
-    "serverActions.bodySizeLimit"
-  );
-  return Object.freeze({
-    allowedOrigins: Object.freeze(allowedOrigins),
-    bodySizeLimit
-  });
-}
-__name(resolveServerActionsConfig, "resolveServerActionsConfig");
-function validateServerActionRequest(request, config) {
-  if (request.method.toUpperCase() !== "POST") {
-    throw new ServerActionRequestError(
-      "INVALID_METHOD",
-      405,
-      "Server actions only accept POST requests"
-    );
-  }
-  const requestUrl = new URL(request.url);
-  const sourceOrigin = resolveSourceOrigin(request);
-  const fetchSite = request.headers.get("sec-fetch-site")?.trim().toLowerCase();
-  if (!sourceOrigin) {
-    if (fetchSite !== "same-origin") {
-      throw new ServerActionRequestError(
-        "MISSING_ORIGIN",
-        403,
-        "Server action request is missing same-origin metadata"
-      );
-    }
-    return;
-  }
-  const matchesRequest = sourceOrigin === requestUrl.origin || matchesHostHeader(sourceOrigin, request);
-  const matchesConfiguredOrigin = config.allowedOrigins.some(
-    (pattern) => matchesAllowedOrigin(sourceOrigin, pattern)
-  );
-  if (!matchesRequest && !matchesConfiguredOrigin) {
-    throw new ServerActionRequestError(
-      "INVALID_ORIGIN",
-      403,
-      "Server action origin does not match the request origin"
-    );
-  }
-  if (fetchSite === "cross-site" && !matchesConfiguredOrigin) {
-    throw new ServerActionRequestError(
-      "INVALID_ORIGIN",
-      403,
-      "Cross-site server action request was rejected"
-    );
-  }
-}
-__name(validateServerActionRequest, "validateServerActionRequest");
-async function prepareServerActionRequest(request, config, kind, actionId) {
-  validateServerActionRequest(request, config);
-  if (kind === "javascript") {
-    validateActionId(actionId);
-  }
-  const contentType = getSupportedContentType(request, kind);
-  const bytes = await readBodyWithLimit(request, config.bodySizeLimit);
-  if (kind === "form" || contentType === "multipart/form-data") {
-    return {
-      body: await parseFormData(request, bytes),
-      contentType
-    };
-  }
-  return {
-    body: new TextDecoder().decode(bytes),
-    contentType
-  };
-}
-__name(prepareServerActionRequest, "prepareServerActionRequest");
-function createServerActionRequestErrorResponse(error) {
-  if (!(error instanceof ServerActionRequestError)) {
-    return null;
-  }
-  const headers = new Headers({
-    "cache-control": "no-store",
-    "content-type": "text/plain; charset=utf-8",
-    "x-content-type-options": "nosniff"
-  });
-  if (error.status === 405) {
-    headers.set("allow", "POST");
-  }
-  return new Response(getPublicErrorMessage(error.status), {
-    status: error.status,
-    headers
-  });
-}
-__name(createServerActionRequestErrorResponse, "createServerActionRequestErrorResponse");
-function sanitizeServerActionError(error) {
-  const declaredFailure = serializeServerFnFailure(error);
-  if (declaredFailure) return declaredFailure;
-  return {
-    name: "ServerActionError",
-    message: "Server function failed"
-  };
-}
-__name(sanitizeServerActionError, "sanitizeServerActionError");
-async function runWithServerActionRequest(request, callback) {
-  throwIfAborted(request.signal);
-  const context = {
-    request,
-    signal: request.signal,
-    invalidations: /* @__PURE__ */ new Set(),
-    cacheTasks: /* @__PURE__ */ new Set()
-  };
-  return getServerActionStorage().run(context, async () => {
-    try {
-      const result = await callback();
-      await Promise.all(context.cacheTasks);
-      return result;
-    } catch (error) {
-      await Promise.allSettled(context.cacheTasks);
-      throw error;
-    }
-  });
-}
-__name(runWithServerActionRequest, "runWithServerActionRequest");
-function getServerActionExecutionContext() {
-  return getServerActionStorage().getStore();
-}
-__name(getServerActionExecutionContext, "getServerActionExecutionContext");
-function getServerActionSignal() {
-  return getServerActionExecutionContext()?.signal ?? getFallbackAbortController().signal;
-}
-__name(getServerActionSignal, "getServerActionSignal");
-function getServerActionInvalidations() {
-  return Array.from(getServerActionExecutionContext()?.invalidations ?? []);
-}
-__name(getServerActionInvalidations, "getServerActionInvalidations");
-subscribeFarmCacheInvalidation((key) => {
-  getServerActionExecutionContext()?.invalidations.add(key);
-});
-subscribeFarmCacheTask((task) => {
-  getServerActionExecutionContext()?.cacheTasks.add(task);
-});
-function getServerActionStorage() {
-  const globalState2 = globalThis;
-  if (!globalState2[SERVER_ACTION_STORAGE_KEY]) {
-    globalState2[SERVER_ACTION_STORAGE_KEY] = new import_node_async_hooks.AsyncLocalStorage();
-  }
-  return globalState2[SERVER_ACTION_STORAGE_KEY];
-}
-__name(getServerActionStorage, "getServerActionStorage");
-function getFallbackAbortController() {
-  const globalState2 = globalThis;
-  if (!globalState2[FALLBACK_ABORT_CONTROLLER_KEY]) {
-    globalState2[FALLBACK_ABORT_CONTROLLER_KEY] = new AbortController();
-  }
-  return globalState2[FALLBACK_ABORT_CONTROLLER_KEY];
-}
-__name(getFallbackAbortController, "getFallbackAbortController");
-function resolveSourceOrigin(request) {
-  const result = getRequestSourceOrigin(request);
-  if (!result.ok) {
-    throw new ServerActionRequestError(
-      "INVALID_ORIGIN",
-      403,
-      result.reason === "opaque-origin" ? "Opaque origins are not allowed" : "Invalid request origin"
-    );
-  }
-  return result.origin;
-}
-__name(resolveSourceOrigin, "resolveSourceOrigin");
-function validateActionId(actionId) {
-  if (!actionId || actionId.length > 4096 || hasControlCharacters(actionId)) {
-    throw new ServerActionRequestError("INVALID_ACTION_ID", 400, "Invalid server action id");
-  }
-}
-__name(validateActionId, "validateActionId");
-function hasControlCharacters(value) {
-  for (let index = 0; index < value.length; index++) {
-    const code = value.charCodeAt(index);
-    if (code <= 31 || code === 127) return true;
-  }
-  return false;
-}
-__name(hasControlCharacters, "hasControlCharacters");
-function getSupportedContentType(request, kind) {
-  const header = request.headers.get("content-type")?.trim().toLowerCase();
-  const contentType = header?.split(";", 1)[0]?.trim() ?? "";
-  const supported = kind === "form" ? FORM_ACTION_CONTENT_TYPES : JAVASCRIPT_ACTION_CONTENT_TYPES;
-  if (!supported.has(contentType)) {
-    throw new ServerActionRequestError(
-      "UNSUPPORTED_CONTENT_TYPE",
-      415,
-      "Unsupported server action content type"
-    );
-  }
-  return contentType;
-}
-__name(getSupportedContentType, "getSupportedContentType");
-async function readBodyWithLimit(request, limit) {
-  const contentLength = request.headers.get("content-length")?.trim();
-  if (contentLength) {
-    if (!/^\d+$/.test(contentLength)) {
-      throw new ServerActionRequestError(
-        "INVALID_CONTENT_LENGTH",
-        400,
-        "Invalid content-length header"
-      );
-    }
-    if (Number(contentLength) > limit) {
-      throw new ServerActionRequestError("BODY_TOO_LARGE", 413, "Server action body is too large");
-    }
-  }
-  throwIfAborted(request.signal);
-  if (!request.body) return new Uint8Array();
-  const reader = request.body.getReader();
-  const chunks = [];
-  let total = 0;
-  const cancelBodyRead = /* @__PURE__ */ __name(() => {
-    void reader.cancel(request.signal.reason).catch(() => {
-    });
-  }, "cancelBodyRead");
-  request.signal.addEventListener("abort", cancelBodyRead, { once: true });
-  try {
-    while (true) {
-      throwIfAborted(request.signal);
-      const { done, value } = await reader.read();
-      if (done) break;
-      if (!value) continue;
-      total += value.byteLength;
-      if (total > limit) {
-        const error = new ServerActionRequestError(
-          "BODY_TOO_LARGE",
-          413,
-          "Server action body is too large"
-        );
-        void reader.cancel(error).catch(() => {
-        });
-        throw error;
-      }
-      chunks.push(value);
-    }
-  } catch (error) {
-    if (request.signal.aborted) throwIfAborted(request.signal);
-    throw error;
-  } finally {
-    request.signal.removeEventListener("abort", cancelBodyRead);
-    reader.releaseLock();
-  }
-  throwIfAborted(request.signal);
-  const body = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    body.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return body;
-}
-__name(readBodyWithLimit, "readBodyWithLimit");
-async function parseFormData(request, bytes) {
-  const body = new ArrayBuffer(bytes.byteLength);
-  new Uint8Array(body).set(bytes);
-  const copy = new Request(request.url, {
-    method: "POST",
-    headers: request.headers,
-    body
-  });
-  try {
-    return await copy.formData();
-  } catch {
-    throw new ServerActionRequestError("INVALID_BODY", 400, "Invalid server action form body");
-  }
-}
-__name(parseFormData, "parseFormData");
-function getPublicErrorMessage(status) {
-  switch (status) {
-    case 400:
-      return "Bad Request";
-    case 403:
-      return "Forbidden";
-    case 405:
-      return "Method Not Allowed";
-    case 413:
-      return "Payload Too Large";
-    case 415:
-      return "Unsupported Media Type";
-    default:
-      return "Server Action Request Failed";
-  }
-}
-__name(getPublicErrorMessage, "getPublicErrorMessage");
-function throwIfAborted(signal) {
-  if (!signal.aborted) return;
-  if (signal.reason !== void 0) throw signal.reason;
-  throw new DOMException("The operation was aborted", "AbortError");
-}
-__name(throwIfAborted, "throwIfAborted");
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,
-  ServerActionRequestError,
-  createServerActionRequestErrorResponse,
-  getServerActionExecutionContext,
-  getServerActionInvalidations,
-  getServerActionSignal,
-  prepareServerActionRequest,
-  resolveServerActionsConfig,
-  runWithServerActionRequest,
-  sanitizeServerActionError,
-  validateServerActionRequest
-});
+
+
+
+
+
+var _chunkT5CERMEHcjs = require('./chunk-T5CERMEH.cjs');
+require('./chunk-SVRTJOUF.cjs');
+require('./chunk-EM6SBQKM.cjs');
+require('./chunk-ZEG3OPIB.cjs');
+require('./chunk-NO3WWW3N.cjs');
+require('./chunk-S3JO3N4H.cjs');
+
+
+
+
+
+
+
+
+
+
+
+
+exports.DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = _chunkT5CERMEHcjs.DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT; exports.ServerActionRequestError = _chunkT5CERMEHcjs.ServerActionRequestError; exports.createServerActionRequestErrorResponse = _chunkT5CERMEHcjs.createServerActionRequestErrorResponse; exports.getServerActionExecutionContext = _chunkT5CERMEHcjs.getServerActionExecutionContext; exports.getServerActionInvalidations = _chunkT5CERMEHcjs.getServerActionInvalidations; exports.getServerActionSignal = _chunkT5CERMEHcjs.getServerActionSignal; exports.prepareServerActionRequest = _chunkT5CERMEHcjs.prepareServerActionRequest; exports.resolveServerActionsConfig = _chunkT5CERMEHcjs.resolveServerActionsConfig; exports.runWithServerActionRequest = _chunkT5CERMEHcjs.runWithServerActionRequest; exports.sanitizeServerActionError = _chunkT5CERMEHcjs.sanitizeServerActionError; exports.validateServerActionRequest = _chunkT5CERMEHcjs.validateServerActionRequest;