@farm.js/core 0.1.31 → 0.1.35

package/dist/{chunk-Z5HIWVDP.cjs → chunk-FTFYRMQQ.cjs}

@@ -1,12 +1,10 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
+var _chunkG643DQCHcjs = require('./chunk-G643DQCH.cjs');
 
 
 
-var _chunkSVRTJOUFcjs = require('./chunk-SVRTJOUF.cjs');
-
-
-var _chunkG643DQCHcjs = require('./chunk-G643DQCH.cjs');
+var _chunkZ2HLU4IXcjs = require('./chunk-Z2HLU4IX.cjs');
 
 
 
@@ -18,7 +16,7 @@ var _chunkG643DQCHcjs = require('./chunk-G643DQCH.cjs');
 
 
 
-var _chunkEM6SBQKMcjs = require('./chunk-EM6SBQKM.cjs');
+var _chunkOMVAU7NTcjs = require('./chunk-OMVAU7NT.cjs');
 
 
 
@@ -36,6 +34,12 @@ var _chunkDVM4FKZLcjs = require('./chunk-DVM4FKZL.cjs');
 var _chunkUS2QVW3Ecjs = require('./chunk-US2QVW3E.cjs');
 
 
+var _chunkBIDYX3SLcjs = require('./chunk-BIDYX3SL.cjs');
+
+
+var _chunkI57LW5VZcjs = require('./chunk-I57LW5VZ.cjs');
+
+
 
 
 
@@ -44,56 +48,6 @@ var _chunkNO3WWW3Ncjs = require('./chunk-NO3WWW3N.cjs');
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
 
-// src/integration-request-security.ts
-function resolveIntegrationAllowedOrigins(values, label) {
-  return Object.freeze((_nullishCoalesce(values, () => ( []))).map((value) => _chunkSVRTJOUFcjs.normalizeAllowedOriginPattern.call(void 0, value, label)));
-}
-_chunkS3JO3N4Hcjs.__name.call(void 0, resolveIntegrationAllowedOrigins, "resolveIntegrationAllowedOrigins");
-function validateIntegrationRequestOrigin(request, policy = {}) {
-  const allowedOrigins = _nullishCoalesce(policy.allowedOrigins, () => ( []));
-  const requireOriginMetadata = _nullishCoalesce(policy.requireOriginMetadata, () => ( true));
-  const fetchSite = _optionalChain([request, 'access', _ => _.headers, 'access', _2 => _2.get, 'call', _3 => _3("sec-fetch-site"), 'optionalAccess', _4 => _4.trim, 'call', _5 => _5(), 'access', _6 => _6.toLowerCase, 'call', _7 => _7()]);
-  const source = _chunkSVRTJOUFcjs.getRequestSourceOrigin.call(void 0, request);
-  if (!source.ok) {
-    return { ok: false, reason: source.reason };
-  }
-  if (source.origin === null) {
-    if (fetchSite === "same-origin") {
-      return { ok: true };
-    }
-    if (requireOriginMetadata) {
-      return { ok: false, reason: fetchSite === "cross-site" ? "cross-site" : "missing-origin" };
-    }
-    return fetchSite === "cross-site" ? { ok: false, reason: "cross-site" } : { ok: true };
-  }
-  const requestUrl = new URL(request.url);
-  const matchesConfiguredOrigin = allowedOrigins.some(
-    (pattern) => _chunkSVRTJOUFcjs.matchesAllowedOrigin.call(void 0, source.origin, pattern)
-  );
-  const matchesRequest = source.origin === requestUrl.origin || _chunkSVRTJOUFcjs.matchesHostHeader.call(void 0, source.origin, request);
-  if (!matchesRequest && !matchesConfiguredOrigin) {
-    return { ok: false, reason: "cross-site" };
-  }
-  if (fetchSite === "cross-site" && !matchesConfiguredOrigin) {
-    return { ok: false, reason: "cross-site" };
-  }
-  return { ok: true };
-}
-_chunkS3JO3N4Hcjs.__name.call(void 0, validateIntegrationRequestOrigin, "validateIntegrationRequestOrigin");
-function describeIntegrationOriginRejection(reason) {
-  switch (reason) {
-    case "missing-origin":
-      return "Request is missing same-origin metadata.";
-    case "opaque-origin":
-      return "Opaque origins are not allowed.";
-    case "invalid-origin":
-      return "Invalid request origin.";
-    case "cross-site":
-      return "Cross-site request was rejected.";
-  }
-}
-_chunkS3JO3N4Hcjs.__name.call(void 0, describeIntegrationOriginRejection, "describeIntegrationOriginRejection");
-
 // src/plugin-integration-context.ts
 var FARM_PLUGIN_INTEGRATION_CONTEXT = /* @__PURE__ */ Symbol.for("@farm.js/core/plugin-integration-context");
 function setFarmPluginIntegrationContext(plugin, integration) {
@@ -294,13 +248,13 @@ function defineIntegration(integration) {
     integrationRoute: routeFactory
   }) : integration.endpoints;
   const endpointRoutes = flattenIntegrationEndpoints(endpoints);
-  const allRoutes = _optionalChain([routes, 'optionalAccess', _8 => _8.length]) || endpointRoutes.length ? [...routes || [], ...endpointRoutes] : void 0;
+  const allRoutes = _optionalChain([routes, 'optionalAccess', _ => _.length]) || endpointRoutes.length ? [...routes || [], ...endpointRoutes] : void 0;
   for (const route of allRoutes || []) {
     _chunkNO3WWW3Ncjs.assertUniqueRouteParameters.call(void 0, route.path, "api");
     _chunkDVM4FKZLcjs.validateConfigRouteSource.call(void 0, route.path, `Integration route "${route.path}"`);
     _chunkNO3WWW3Ncjs.assertTerminalCatchAll.call(void 0, route.path, "api");
   }
-  const derivedApi = integration.api || (_optionalChain([allRoutes, 'optionalAccess', _9 => _9.length]) ? _chunkNZKJGRB3cjs.api.fromRoutes(
+  const derivedApi = integration.api || (_optionalChain([allRoutes, 'optionalAccess', _2 => _2.length]) ? _chunkNZKJGRB3cjs.api.fromRoutes(
     allRoutes
   ) : void 0);
   return {
@@ -402,7 +356,7 @@ function getIntegrationProviders(integrations) {
   }
   const providers = [];
   for (const integration of Object.values(integrations)) {
-    if (!integration || !isFarmIntegration(integration) || !_optionalChain([integration, 'access', _10 => _10.providers, 'optionalAccess', _11 => _11.length])) {
+    if (!integration || !isFarmIntegration(integration) || !_optionalChain([integration, 'access', _3 => _3.providers, 'optionalAccess', _4 => _4.length])) {
       continue;
     }
     for (const provider of integration.providers) {
@@ -430,7 +384,7 @@ function getIntegrationDocumentNavigationMatchers(integrations) {
   }
   const matchers = [];
   for (const integration of Object.values(integrations)) {
-    if (!integration || !isFarmIntegration(integration) || !_optionalChain([integration, 'access', _12 => _12.documentNavigations, 'optionalAccess', _13 => _13.length])) {
+    if (!integration || !isFarmIntegration(integration) || !_optionalChain([integration, 'access', _5 => _5.documentNavigations, 'optionalAccess', _6 => _6.length])) {
       continue;
     }
     for (const navigation of integration.documentNavigations) {
@@ -603,7 +557,7 @@ async function parseIntegrationConfigSchema(integration, schema, value) {
     }
     throw createIntegrationConfigValidationError(integration, result.error);
   }
-  if (_optionalChain([schema, 'access', _14 => _14["~standard"], 'optionalAccess', _15 => _15.validate])) {
+  if (_optionalChain([schema, 'access', _7 => _7["~standard"], 'optionalAccess', _8 => _8.validate])) {
     const result = await schema["~standard"].validate(value);
     if ("value" in result) {
       return result.value;
@@ -654,7 +608,7 @@ async function resolveIntegrationConfig(integration, context) {
     value,
     await resolveIntegrationConfigPart(config.input, context)
   );
-  value = mergeIntegrationConfigValue(value, await _optionalChain([config, 'access', _16 => _16.resolve, 'optionalCall', _17 => _17(context)]));
+  value = mergeIntegrationConfigValue(value, await _optionalChain([config, 'access', _9 => _9.resolve, 'optionalCall', _10 => _10(context)]));
   return config.schema ? parseIntegrationConfigSchema(integration, config.schema, value) : value;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, resolveIntegrationConfig, "resolveIntegrationConfig");
@@ -692,7 +646,7 @@ function createIntegrationLifecycleLogger(integration, phase) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, createIntegrationLifecycleLogger, "createIntegrationLifecycleLogger");
 async function emitIntegrationLog(integration, event) {
   try {
-    await _optionalChain([integration, 'access', _18 => _18.log, 'optionalCall', _19 => _19(event)]);
+    await _optionalChain([integration, 'access', _11 => _11.log, 'optionalCall', _12 => _12(event)]);
   } catch (e) {
   }
 }
@@ -885,9 +839,9 @@ function createIntegrationPlugin(integrationKey, integration) {
         if (!bodyLoaded) {
           bodyLoaded = true;
           if (req.method && req.method !== "GET" && req.method !== "HEAD") {
-            requestBody = await _chunkEM6SBQKMcjs.readNodeRequestBody.call(void 0, 
+            requestBody = await _chunkOMVAU7NTcjs.readNodeRequestBody.call(void 0, 
               req,
-              _chunkEM6SBQKMcjs.resolveFarmServerConfig.call(void 0, context.config.server).bodySizeLimit
+              _chunkOMVAU7NTcjs.resolveFarmServerConfig.call(void 0, context.config.server).bodySizeLimit
             );
           }
         }
@@ -897,14 +851,14 @@ function createIntegrationPlugin(integrationKey, integration) {
         try {
           return createWebRequest(req, fullUrl, await getRequestBody());
         } catch (error) {
-          const response = _chunkEM6SBQKMcjs.createFarmRequestBodyErrorResponse.call(void 0, error);
+          const response = _chunkOMVAU7NTcjs.createFarmRequestBodyErrorResponse.call(void 0, error);
           if (!response) throw error;
           await _chunkUQZ4AYTHcjs.sendWebResponse.call(void 0, res, response);
           return null;
         }
       }, "createHandlerRequest");
       for (const entry of middleware) {
-        const params = resolveMatcherParams(entry.matcher, pathname);
+        const params = resolveIntegrationMiddlewareParams(entry, pathname, context.config);
         if (!params) {
           continue;
         }
@@ -1266,7 +1220,7 @@ async function validateIntegrationRouteInput(route, request, url) {
     };
   }
   const schemas = route.input;
-  if (!_optionalChain([schemas, 'optionalAccess', _20 => _20.body]) && !_optionalChain([schemas, 'optionalAccess', _21 => _21.query])) {
+  if (!_optionalChain([schemas, 'optionalAccess', _13 => _13.body]) && !_optionalChain([schemas, 'optionalAccess', _14 => _14.query])) {
     return {
       success: true,
       input: {}
@@ -1329,7 +1283,7 @@ async function parseIntegrationInputSchema(source, schema, value) {
       issues: normalizeIntegrationValidationIssues(source, result.error)
     };
   }
-  if (_optionalChain([schema, 'access', _22 => _22["~standard"], 'optionalAccess', _23 => _23.validate])) {
+  if (_optionalChain([schema, 'access', _15 => _15["~standard"], 'optionalAccess', _16 => _16.validate])) {
     const result = await schema["~standard"].validate(value);
     if ("value" in result) {
       return {
@@ -1455,7 +1409,7 @@ async function readIntegrationValidationBody(request, format) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, readIntegrationValidationBody, "readIntegrationValidationBody");
 function getIntegrationRouteBodyFormat(route) {
-  return route.bodyFormat || _optionalChain([route, 'access', _24 => _24.__operation, 'optionalAccess', _25 => _25.bodyFormat]) || "json";
+  return route.bodyFormat || _optionalChain([route, 'access', _17 => _17.__operation, 'optionalAccess', _18 => _18.bodyFormat]) || "json";
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getIntegrationRouteBodyFormat, "getIntegrationRouteBodyFormat");
 function createIntegrationRouteArgs(input) {
@@ -1533,7 +1487,7 @@ function createLazyIntegrationOrmModel(resolveOrm, modelName) {
         return async (...args) => {
           const orm = await resolveOrm();
           const model = orm[modelName];
-          const member = _optionalChain([model, 'optionalAccess', _26 => _26[prop]]);
+          const member = _optionalChain([model, 'optionalAccess', _19 => _19[prop]]);
           if (typeof member !== "function") {
             throw new Error(
               `Integration ORM model "${String(modelName)}" does not expose "${String(prop)}".`
@@ -1604,26 +1558,26 @@ function createFormInput(formData) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, createFormInput, "createFormInput");
 async function dispatchIntegrationRequest(runtime, request, options = {}) {
   try {
-    request = await _chunkEM6SBQKMcjs.bufferFarmRequestBody.call(void 0, 
+    request = await _chunkOMVAU7NTcjs.bufferFarmRequestBody.call(void 0, 
       request,
-      _chunkEM6SBQKMcjs.resolveFarmServerConfig.call(void 0, runtime.config.server).bodySizeLimit
+      _chunkOMVAU7NTcjs.resolveFarmServerConfig.call(void 0, runtime.config.server).bodySizeLimit
     );
   } catch (error) {
-    const response = _chunkEM6SBQKMcjs.createFarmRequestBodyErrorResponse.call(void 0, error);
+    const response = _chunkOMVAU7NTcjs.createFarmRequestBodyErrorResponse.call(void 0, error);
     if (response) return response;
     throw error;
   }
   const integration = runtime.integration;
   const url = new URL(request.url);
   const pathname = url.pathname;
-  const requestId = request.headers.get("x-request-id") || _optionalChain([options, 'access', _27 => _27.currentRequest, 'optionalAccess', _28 => _28.headers, 'access', _29 => _29.get, 'call', _30 => _30("x-request-id")]) || String(Date.now());
+  const requestId = request.headers.get("x-request-id") || _optionalChain([options, 'access', _20 => _20.currentRequest, 'optionalAccess', _21 => _21.headers, 'access', _22 => _22.get, 'call', _23 => _23("x-request-id")]) || String(Date.now());
   const routes = normalizeIntegrationRoutes(integration.routes || []);
   const pathSegments = _chunkUS2QVW3Ecjs.canonicalizeRequestPathSegments.call(void 0, pathname);
   const method = normalizeIntegrationRequestMethod(request.method);
   const middleware = [...integration.middleware || []];
   const forwardedSetCookies = [];
   for (const entry of middleware) {
-    const params = resolveMatcherParams(entry.matcher, pathname);
+    const params = resolveIntegrationMiddlewareParams(entry, pathname, runtime.config);
     if (!params) {
       continue;
     }
@@ -1865,7 +1819,7 @@ async function dispatchIntegrationRequest(runtime, request, options = {}) {
     }
   }
   if (forwardedSetCookies.length > 0) {
-    _optionalChain([options, 'access', _31 => _31.onForwardedCookies, 'optionalCall', _32 => _32(forwardedSetCookies)]);
+    _optionalChain([options, 'access', _24 => _24.onForwardedCookies, 'optionalCall', _25 => _25(forwardedSetCookies)]);
   }
   return null;
 }
@@ -1977,38 +1931,38 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, createServerIntegrationHandlerContext, "cr
 function createServerIntegrationRequestContextStore(request, currentRequest) {
   return {
     get(key) {
-      const requestValue = _chunkEM6SBQKMcjs.getRequestContext.call(void 0, request, key);
+      const requestValue = _chunkOMVAU7NTcjs.getRequestContext.call(void 0, request, key);
       if (requestValue !== void 0) {
         return requestValue;
       }
       if (currentRequest) {
-        return _chunkEM6SBQKMcjs.getRequestContext.call(void 0, currentRequest, key);
+        return _chunkOMVAU7NTcjs.getRequestContext.call(void 0, currentRequest, key);
       }
       return void 0;
     },
     set(key, value, options) {
-      _chunkEM6SBQKMcjs.setRequestContext.call(void 0, request, key, value, options);
+      _chunkOMVAU7NTcjs.setRequestContext.call(void 0, request, key, value, options);
       if (currentRequest) {
-        _chunkEM6SBQKMcjs.setRequestContext.call(void 0, currentRequest, key, value, options);
+        _chunkOMVAU7NTcjs.setRequestContext.call(void 0, currentRequest, key, value, options);
       }
     },
     has(key) {
-      return _chunkEM6SBQKMcjs.hasRequestContext.call(void 0, request, key) || !!currentRequest && _chunkEM6SBQKMcjs.hasRequestContext.call(void 0, currentRequest, key);
+      return _chunkOMVAU7NTcjs.hasRequestContext.call(void 0, request, key) || !!currentRequest && _chunkOMVAU7NTcjs.hasRequestContext.call(void 0, currentRequest, key);
     },
     delete(key) {
-      const deletedRequest = _chunkEM6SBQKMcjs.deleteRequestContext.call(void 0, request, key);
-      const deletedCurrent = currentRequest ? _chunkEM6SBQKMcjs.deleteRequestContext.call(void 0, currentRequest, key) : false;
+      const deletedRequest = _chunkOMVAU7NTcjs.deleteRequestContext.call(void 0, request, key);
+      const deletedCurrent = currentRequest ? _chunkOMVAU7NTcjs.deleteRequestContext.call(void 0, currentRequest, key) : false;
       return deletedRequest || deletedCurrent;
     },
     clear() {
-      _chunkEM6SBQKMcjs.clearRequestContext.call(void 0, request);
+      _chunkOMVAU7NTcjs.clearRequestContext.call(void 0, request);
       if (currentRequest) {
-        _chunkEM6SBQKMcjs.clearRequestContext.call(void 0, currentRequest);
+        _chunkOMVAU7NTcjs.clearRequestContext.call(void 0, currentRequest);
       }
     },
     snapshot(options) {
-      const merged = currentRequest ? _chunkEM6SBQKMcjs.getRequestContextSnapshot.call(void 0, currentRequest, options) : /* @__PURE__ */ new Map();
-      const requestSnapshot = _chunkEM6SBQKMcjs.getRequestContextSnapshot.call(void 0, request, options);
+      const merged = currentRequest ? _chunkOMVAU7NTcjs.getRequestContextSnapshot.call(void 0, currentRequest, options) : /* @__PURE__ */ new Map();
+      const requestSnapshot = _chunkOMVAU7NTcjs.getRequestContextSnapshot.call(void 0, request, options);
       for (const [key, value] of requestSnapshot) {
         merged.set(key, value);
       }
@@ -2046,6 +2000,44 @@ function matchesMethod(methods, normalizedMethod) {
   return methods.some((candidate) => candidate === "ALL" || candidate === normalizedMethod);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, matchesMethod, "matchesMethod");
+var compiledIntegrationGuards = /* @__PURE__ */ new WeakMap();
+var noMiddlewareContext = {};
+function resolveIntegrationMiddlewareParams(entry, pathname, config) {
+  const params = resolveMatcherParams(entry.matcher, pathname);
+  if (params || !entry.matcher) return params;
+  const routePathname = resolveIntegrationRoutePathname(pathname, config);
+  if (routePathname !== pathname) {
+    const routeParams = resolveMatcherParams(entry.matcher, routePathname);
+    if (routeParams) return routeParams;
+  }
+  let compiled = compiledIntegrationGuards.get(entry);
+  if (!compiled) {
+    compiled = _chunkZ2HLU4IXcjs.compileMiddlewareConfig.call(void 0, {
+      matcher: typeof entry.matcher === "string" ? entry.matcher : [...entry.matcher]
+    });
+    compiledIntegrationGuards.set(entry, compiled);
+  }
+  for (const candidate of routePathname === pathname ? [pathname] : [pathname, routePathname]) {
+    const result = _chunkZ2HLU4IXcjs.matchesCompiledMiddlewareConfig.call(void 0, candidate, compiled, noMiddlewareContext);
+    if (result.matched) return _nullishCoalesce(result.params, () => ( {}));
+  }
+  return null;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, resolveIntegrationMiddlewareParams, "resolveIntegrationMiddlewareParams");
+function resolveIntegrationRoutePathname(pathname, config) {
+  const basePath = typeof _optionalChain([config, 'optionalAccess', _26 => _26.basePath]) === "string" ? config.basePath : void 0;
+  let routePathname = basePath ? _chunkI57LW5VZcjs.stripFarmBasePath.call(void 0, pathname, basePath) : pathname;
+  const i18n = _optionalChain([config, 'optionalAccess', _27 => _27.i18n]);
+  if (i18n && Array.isArray(i18n.locales) && i18n.locales.length > 0) {
+    routePathname = _chunkBIDYX3SLcjs.resolveFarmLocalePath.call(void 0, routePathname, {
+      locales: i18n.locales,
+      defaultLocale: i18n.defaultLocale,
+      routing: i18n.routing || "prefix-except-default"
+    }).pathname;
+  }
+  return routePathname;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, resolveIntegrationRoutePathname, "resolveIntegrationRoutePathname");
 function resolveMatcherParams(matcher, pathname) {
   if (!matcher) {
     return {};
@@ -2167,7 +2159,4 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, normalizeMatcher, "normalizeMatcher");
 
 
 
-
-
-
-exports.resolveIntegrationAllowedOrigins = resolveIntegrationAllowedOrigins; exports.validateIntegrationRequestOrigin = validateIntegrationRequestOrigin; exports.describeIntegrationOriginRejection = describeIntegrationOriginRejection; exports.getFarmPluginIntegrationContext = getFarmPluginIntegrationContext; exports.FARM_INTEGRATION_INTERNAL_DISPATCH_CONTEXT_KEY = FARM_INTEGRATION_INTERNAL_DISPATCH_CONTEXT_KEY; exports.FARM_INTEGRATION_SET_COOKIES_KEY = FARM_INTEGRATION_SET_COOKIES_KEY; exports.forwardIntegrationSetCookies = forwardIntegrationSetCookies; exports.defineIntegrationSchema = defineIntegrationSchema; exports.getFarmIntegrationPluginServerRuntime = getFarmIntegrationPluginServerRuntime; exports.getFarmIntegrationPluginOwner = getFarmIntegrationPluginOwner; exports.createIntegrationRoute = createIntegrationRoute; exports.integrationRoute = integrationRoute; exports.defineIntegration = defineIntegration; exports.isFarmIntegration = isFarmIntegration; exports.resolveIntegrationPlugins = resolveIntegrationPlugins; exports.getIntegrationProviders = getIntegrationProviders; exports.isFarmIntegrationProviderComponentReference = isFarmIntegrationProviderComponentReference; exports.getIntegrationDocumentNavigationMatchers = getIntegrationDocumentNavigationMatchers; exports.getIntegrationSchemas = getIntegrationSchemas; exports.getRegisteredIntegrationRuntime = getRegisteredIntegrationRuntime; exports.getRegisteredIntegrations = getRegisteredIntegrations; exports.getRegisteredIntegrationSchemas = getRegisteredIntegrationSchemas; exports.matchIntegrationRoute = matchIntegrationRoute; exports.matchRegisteredIntegrationRoute = matchRegisteredIntegrationRoute; exports.getRegisteredIntegrationAPIManifest = getRegisteredIntegrationAPIManifest; exports.dispatchIntegrationRequest = dispatchIntegrationRequest; exports.dispatchIntegrationRequests = dispatchIntegrationRequests;
+exports.getFarmPluginIntegrationContext = getFarmPluginIntegrationContext; exports.FARM_INTEGRATION_INTERNAL_DISPATCH_CONTEXT_KEY = FARM_INTEGRATION_INTERNAL_DISPATCH_CONTEXT_KEY; exports.FARM_INTEGRATION_SET_COOKIES_KEY = FARM_INTEGRATION_SET_COOKIES_KEY; exports.forwardIntegrationSetCookies = forwardIntegrationSetCookies; exports.defineIntegrationSchema = defineIntegrationSchema; exports.getFarmIntegrationPluginServerRuntime = getFarmIntegrationPluginServerRuntime; exports.getFarmIntegrationPluginOwner = getFarmIntegrationPluginOwner; exports.createIntegrationRoute = createIntegrationRoute; exports.integrationRoute = integrationRoute; exports.defineIntegration = defineIntegration; exports.isFarmIntegration = isFarmIntegration; exports.resolveIntegrationPlugins = resolveIntegrationPlugins; exports.getIntegrationProviders = getIntegrationProviders; exports.isFarmIntegrationProviderComponentReference = isFarmIntegrationProviderComponentReference; exports.getIntegrationDocumentNavigationMatchers = getIntegrationDocumentNavigationMatchers; exports.getIntegrationSchemas = getIntegrationSchemas; exports.getRegisteredIntegrationRuntime = getRegisteredIntegrationRuntime; exports.getRegisteredIntegrations = getRegisteredIntegrations; exports.getRegisteredIntegrationSchemas = getRegisteredIntegrationSchemas; exports.matchIntegrationRoute = matchIntegrationRoute; exports.matchRegisteredIntegrationRoute = matchRegisteredIntegrationRoute; exports.getRegisteredIntegrationAPIManifest = getRegisteredIntegrationAPIManifest; exports.dispatchIntegrationRequest = dispatchIntegrationRequest; exports.dispatchIntegrationRequests = dispatchIntegrationRequests;

package/dist/chunk-FZ6YYU2W.mjs

@@ -0,0 +1,65 @@
+import {
+  getRequestSourceOrigin,
+  matchesAllowedOrigin,
+  matchesHostHeader,
+  normalizeAllowedOriginPattern
+} from "./chunk-FP2INE7H.mjs";
+import {
+  __name
+} from "./chunk-LPEX4YW6.mjs";
+
+// src/integration-request-security.ts
+function resolveIntegrationAllowedOrigins(values, label) {
+  return Object.freeze((values ?? []).map((value) => normalizeAllowedOriginPattern(value, label)));
+}
+__name(resolveIntegrationAllowedOrigins, "resolveIntegrationAllowedOrigins");
+function validateIntegrationRequestOrigin(request, policy = {}) {
+  const allowedOrigins = policy.allowedOrigins ?? [];
+  const requireOriginMetadata = policy.requireOriginMetadata ?? true;
+  const fetchSite = request.headers.get("sec-fetch-site")?.trim().toLowerCase();
+  const source = getRequestSourceOrigin(request);
+  if (!source.ok) {
+    return { ok: false, reason: source.reason };
+  }
+  if (source.origin === null) {
+    if (fetchSite === "same-origin") {
+      return { ok: true };
+    }
+    if (requireOriginMetadata) {
+      return { ok: false, reason: fetchSite === "cross-site" ? "cross-site" : "missing-origin" };
+    }
+    return fetchSite === "cross-site" ? { ok: false, reason: "cross-site" } : { ok: true };
+  }
+  const requestUrl = new URL(request.url);
+  const matchesConfiguredOrigin = allowedOrigins.some(
+    (pattern) => matchesAllowedOrigin(source.origin, pattern)
+  );
+  const matchesRequest = source.origin === requestUrl.origin || matchesHostHeader(source.origin, request);
+  if (!matchesRequest && !matchesConfiguredOrigin) {
+    return { ok: false, reason: "cross-site" };
+  }
+  if (fetchSite === "cross-site" && !matchesConfiguredOrigin) {
+    return { ok: false, reason: "cross-site" };
+  }
+  return { ok: true };
+}
+__name(validateIntegrationRequestOrigin, "validateIntegrationRequestOrigin");
+function describeIntegrationOriginRejection(reason) {
+  switch (reason) {
+    case "missing-origin":
+      return "Request is missing same-origin metadata.";
+    case "opaque-origin":
+      return "Opaque origins are not allowed.";
+    case "invalid-origin":
+      return "Invalid request origin.";
+    case "cross-site":
+      return "Cross-site request was rejected.";
+  }
+}
+__name(describeIntegrationOriginRejection, "describeIntegrationOriginRejection");
+
+export {
+  resolveIntegrationAllowedOrigins,
+  validateIntegrationRequestOrigin,
+  describeIntegrationOriginRejection
+};

package/dist/{chunk-X7WVQMIB.mjs → chunk-G5RT7EXW.mjs}

@@ -1,7 +1,7 @@
 import {
   isEndpointFailure,
   resolvePluginRoutes
-} from "./chunk-4IEPYMHF.mjs";
+} from "./chunk-3UEVPCGW.mjs";
 import {
   registerAPIRouteShape
 } from "./chunk-W3B4PKAW.mjs";
@@ -9,13 +9,16 @@ import {
   omitFarmResponseBody
 } from "./chunk-5WI2S4CO.mjs";
 import {
-  resolveFarmAPICanonicalPathname
-} from "./chunk-I6XDAKWQ.mjs";
+  validateIntegrationRequestOrigin
+} from "./chunk-FZ6YYU2W.mjs";
 import {
   DEFAULT_FARM_SERVER_BODY_SIZE_LIMIT,
   bufferFarmRequestBody,
   createFarmRequestBodyErrorResponse
-} from "./chunk-XF7Q24PF.mjs";
+} from "./chunk-Y7RKTKYI.mjs";
+import {
+  resolveFarmAPICanonicalPathname
+} from "./chunk-BTHHUD7Q.mjs";
 import {
   createStaticAPIRouteMatcher,
   matchAPIRoute
@@ -31,7 +34,7 @@ import {
 } from "./chunk-4SIYUGRY.mjs";
 import {
   _runWithCurrentRequest
-} from "./chunk-BSPQVJ4A.mjs";
+} from "./chunk-FDR64H6B.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
@@ -388,6 +391,9 @@ async function readRequestBody(request) {
   }
   if (!text) return { body: void 0 };
   if (contentType === void 0) {
+    if (!validateIntegrationRequestOrigin(request, { requireOriginMetadata: false }).ok) {
+      return { body: void 0 };
+    }
     try {
       return { body: JSON.parse(text) };
     } catch {

package/dist/{chunk-IXUY2F5U.mjs → chunk-GCXWJJKH.mjs}

@@ -1,3 +1,6 @@
+import {
+  decodeCookieName
+} from "./chunk-JM5XPKWH.mjs";
 import {
   localizeFarmPathname,
   resolveFarmLocalePath
@@ -139,13 +142,7 @@ function readCookie(header, name) {
   for (const part of header.split(";")) {
     const separator = part.indexOf("=");
     if (separator < 0) continue;
-    let key;
-    try {
-      key = decodeURIComponent(part.slice(0, separator).trim());
-    } catch {
-      continue;
-    }
-    if (key !== name) continue;
+    if (decodeCookieName(part.slice(0, separator).trim()) !== name) continue;
     try {
       return decodeURIComponent(part.slice(separator + 1).trim());
     } catch {

package/dist/{chunk-ES4B2IXW.cjs → chunk-GFHLGIYC.cjs}

@@ -4,10 +4,10 @@
 
 
 
-var _chunkT5CERMEHcjs = require('./chunk-T5CERMEH.cjs');
+var _chunkZXGAFZDOcjs = require('./chunk-ZXGAFZDO.cjs');
 
 
-var _chunk2SDO73HKcjs = require('./chunk-2SDO73HK.cjs');
+var _chunkYWN746UScjs = require('./chunk-YWN746US.cjs');
 
 
 var _chunkOX6O6WVAcjs = require('./chunk-OX6O6WVA.cjs');
@@ -70,13 +70,13 @@ async function _invokeServerFunction(value, input, request) {
     throw new TypeError("Expected a function created with createServerFn or createServerQuery");
   }
   try {
-    const data = await _chunkT5CERMEHcjs.runWithServerActionRequest.call(void 0, request, () => runner.run(input));
+    const data = await _chunkZXGAFZDOcjs.runWithServerActionRequest.call(void 0, request, () => runner.run(input));
     return { ok: true, data };
   } catch (error) {
     if (error instanceof ServerFnInputError) {
       return { ok: false, reason: "input", error: error.cause };
     }
-    if (_chunkT5CERMEHcjs.isServerFnFailure.call(void 0, error)) return { ok: false, reason: "failure", failure: error };
+    if (_chunkZXGAFZDOcjs.isServerFnFailure.call(void 0, error)) return { ok: false, reason: "failure", failure: error };
     const redirect = _chunkOX6O6WVAcjs.getFarmRedirectError.call(void 0, error);
     if (redirect) {
       return { ok: false, reason: "redirect", url: redirect.url, status: redirect.status };
@@ -117,9 +117,9 @@ function createServerFn(options) {
     } catch (cause) {
       throw labelInputErrors && isSchemaValidationFailure(cause) ? new ServerFnInputError(cause) : cause;
     }
-    const executionContext = _chunkT5CERMEHcjs.getServerActionExecutionContext.call(void 0, );
+    const executionContext = _chunkZXGAFZDOcjs.getServerActionExecutionContext.call(void 0, );
     const request = _nullishCoalesce(_optionalChain([executionContext, 'optionalAccess', _ => _.request]), () => ( _chunkU4KT7QP3cjs._resolveCurrentRequest.call(void 0, )));
-    const signal = _nullishCoalesce(_nullishCoalesce(_optionalChain([executionContext, 'optionalAccess', _2 => _2.signal]), () => ( _optionalChain([request, 'optionalAccess', _3 => _3.signal]))), () => ( _chunkT5CERMEHcjs.getServerActionSignal.call(void 0, )));
+    const signal = _nullishCoalesce(_nullishCoalesce(_optionalChain([executionContext, 'optionalAccess', _2 => _2.signal]), () => ( _optionalChain([request, 'optionalAccess', _3 => _3.signal]))), () => ( _chunkZXGAFZDOcjs.getServerActionSignal.call(void 0, )));
     const handlerContext = {
       input,
       rawInput,
@@ -139,7 +139,7 @@ function createServerFn(options) {
         context: resolvedContext,
         result: parsedResult
       }) : options.invalidates;
-      await _chunk2SDO73HKcjs.applyFarmCacheInvalidationTargets.call(void 0, declaration);
+      await _chunkYWN746UScjs.applyFarmCacheInvalidationTargets.call(void 0, declaration);
     }
     return parsedResult;
   }, "run");
@@ -245,7 +245,7 @@ function createServerFnErrorHandler(definitions) {
       throw new TypeError(`Server function error "${code}" is not declared`);
     }
     const parsed = parseServerFnFailureData(code, definition.data, data);
-    throw new (0, _chunkT5CERMEHcjs.ServerFnFailure)(code, parsed, {
+    throw new (0, _chunkZXGAFZDOcjs.ServerFnFailure)(code, parsed, {
       status: definition.status,
       message: _nullishCoalesce(definition.message, () => ( "Server function failed"))
     });