@farm.js/core 0.1.39 → 0.1.41

package/dist/{chunk-A657YSP4.cjs → chunk-WSOBCAYO.cjs}

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkD2ULAULScjs = require('./chunk-D2ULAULS.cjs');
+var _chunkFXFKIJDAcjs = require('./chunk-FXFKIJDA.cjs');
 
 
 
@@ -17,17 +17,19 @@ var _chunkD2ULAULScjs = require('./chunk-D2ULAULS.cjs');
 
 
 
+var _chunkBPOTSHDOcjs = require('./chunk-BPOTSHDO.cjs');
 
 
 
 
-var _chunkE2ROOWQCcjs = require('./chunk-E2ROOWQC.cjs');
 
+var _chunk4U5XZDLGcjs = require('./chunk-4U5XZDLG.cjs');
 
-var _chunkJSROZYYOcjs = require('./chunk-JSROZYYO.cjs');
 
+var _chunk6D24SDKOcjs = require('./chunk-6D24SDKO.cjs');
 
-var _chunkBWIQR4DHcjs = require('./chunk-BWIQR4DH.cjs');
+
+var _chunkRHGK2JENcjs = require('./chunk-RHGK2JEN.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -40,8 +42,8 @@ function collectSchemaDependencies(owners) {
   const claimedKeys = /* @__PURE__ */ new Map();
   for (const owner of owners) {
     try {
-      known.set(owner.name, _chunkJSROZYYOcjs.resolveSchemaModels.call(void 0, owner.name, owner.schema));
-      for (const model of _chunkE2ROOWQCcjs.collectSchemaModels.call(void 0, [[owner.name, owner.schema, owner.models]])) {
+      known.set(owner.name, _chunk6D24SDKOcjs.resolveSchemaModels.call(void 0, owner.name, owner.schema));
+      for (const model of _chunkBPOTSHDOcjs.collectSchemaModels.call(void 0, [[owner.name, owner.schema, owner.models]])) {
         creators.set(model.modelName.toLowerCase(), owner.name);
         claimedKeys.set(model.modelKey, owner.name);
       }
@@ -65,12 +67,12 @@ function collectSchemaDependencies(owners) {
       if (creator && creator !== owner.name) needs.add(creator);
     }, "add");
     try {
-      for (const model of _chunkE2ROOWQCcjs.collectSchemaModels.call(void 0, [[owner.name, owner.schema, owner.models]])) {
+      for (const model of _chunkBPOTSHDOcjs.collectSchemaModels.call(void 0, [[owner.name, owner.schema, owner.models]])) {
         for (const field of Object.values(model.model.fields)) {
           if (field.reference) add(referencedTable(owner.name, field.reference.model));
         }
       }
-      for (const extension of _chunkE2ROOWQCcjs.collectSchemaExtensions.call(void 0, owner.name, owner.schema, owner.models)) {
+      for (const extension of _chunk4U5XZDLGcjs.collectSchemaExtensions.call(void 0, owner.name, owner.schema, owner.models)) {
         add(extension.table);
       }
     } catch (e2) {
@@ -119,17 +121,17 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, withTimeout, "withTimeout");
 var formatSeconds = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, (ms) => ms < 1e3 ? `${ms}ms` : `${Number((ms / 1e3).toFixed(1))}s`, "formatSeconds");
 function collectSchemaOwners(config) {
   const owners = [];
-  const integrationSchemas = _chunkBWIQR4DHcjs.getIntegrationSchemas.call(void 0, config.integrations);
+  const integrationSchemas = _chunkRHGK2JENcjs.getIntegrationSchemas.call(void 0, config.integrations);
   let integrationClient;
   for (const [name, schema] of Object.entries(integrationSchemas)) {
     owners.push({
       name,
       kind: "integration",
       schema,
-      resolveClient: /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, (resolved) => _nullishCoalesce(integrationClient, () => ( (integrationClient = _chunkD2ULAULScjs.resolveIntegrationOrmRuntimeClient.call(void 0, { config: resolved })))), "resolveClient")
+      resolveClient: /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, (resolved) => _nullishCoalesce(integrationClient, () => ( (integrationClient = _chunkFXFKIJDAcjs.resolveIntegrationOrmRuntimeClient.call(void 0, { config: resolved })))), "resolveClient")
     });
   }
-  for (const declaration of _chunkE2ROOWQCcjs.findSchemaTableOwners.call(void 0, config)) {
+  for (const declaration of _chunkBPOTSHDOcjs.findSchemaTableOwners.call(void 0, config)) {
     if (owners.some((owner) => owner.name === declaration.name)) continue;
     owners.push({
       name: declaration.name,
@@ -159,7 +161,7 @@ function resolveSchemaExecutor(client, owner, timeoutMs) {
     if (candidate === void 0 || candidate === null) continue;
     let adapter;
     try {
-      adapter = _chunkE2ROOWQCcjs.createSchemaExecutor.call(void 0, candidate, owner);
+      adapter = _chunkBPOTSHDOcjs.createSchemaExecutor.call(void 0, candidate, owner);
     } catch (e3) {
       continue;
     }
@@ -179,7 +181,7 @@ function resolveSchemaExecutor(client, owner, timeoutMs) {
   return void 0;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, resolveSchemaExecutor, "resolveSchemaExecutor");
-var describeReferencedTable = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, (database, table) => _chunkE2ROOWQCcjs.describeSchemaTable.call(void 0, database.executor, database.dialect, table), "describeReferencedTable");
+var describeReferencedTable = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, (database, table) => _chunkBPOTSHDOcjs.describeSchemaTable.call(void 0, database.executor, database.dialect, table), "describeReferencedTable");
 async function checkSchema(config, options = {}) {
   const timeoutMs = _nullishCoalesce(options.timeoutMs, () => ( DEFAULT_TIMEOUT_MS));
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
@@ -191,7 +193,7 @@ async function checkSchema(config, options = {}) {
   const issues = [];
   const declared = /* @__PURE__ */ new Map();
   for (const candidate of _nullishCoalesce(config.plugins, () => ( []))) {
-    const declaration = _chunkE2ROOWQCcjs.readSchemaTables.call(void 0, candidate);
+    const declaration = _chunk4U5XZDLGcjs.readSchemaTables.call(void 0, candidate);
     if (!declaration) continue;
     const schemas = _nullishCoalesce(declared.get(declaration.name), () => ( []));
     if (!schemas.includes(declaration.schema)) schemas.push(declaration.schema);
@@ -212,8 +214,8 @@ async function checkSchema(config, options = {}) {
   const ownedModels = /* @__PURE__ */ new Map();
   for (const owner of owners) {
     try {
-      knownModels.set(owner.name, _chunkJSROZYYOcjs.resolveSchemaModels.call(void 0, owner.name, owner.schema));
-      ownedModels.set(owner.name, _chunkE2ROOWQCcjs.collectSchemaModels.call(void 0, [[owner.name, owner.schema, owner.models]]));
+      knownModels.set(owner.name, _chunk6D24SDKOcjs.resolveSchemaModels.call(void 0, owner.name, owner.schema));
+      ownedModels.set(owner.name, _chunkBPOTSHDOcjs.collectSchemaModels.call(void 0, [[owner.name, owner.schema, owner.models]]));
     } catch (error) {
       issues.push({
         severity: "error",
@@ -329,7 +331,7 @@ async function checkSchema(config, options = {}) {
   for (const owner of owners) {
     if (!ownedModels.has(owner.name)) continue;
     try {
-      const owned = _chunkE2ROOWQCcjs.collectSchemaExtensions.call(void 0, owner.name, owner.schema, owner.models);
+      const owned = _chunk4U5XZDLGcjs.collectSchemaExtensions.call(void 0, owner.name, owner.schema, owner.models);
       extensions.set(owner.name, owned);
       for (const extension of owned) {
         for (const { field } of extension.fields) {
@@ -369,9 +371,9 @@ async function checkSchema(config, options = {}) {
     const database = databases.get(owner.name);
     if (!models || !database) continue;
     try {
-      const crossOwner = await _chunkE2ROOWQCcjs.planCrossOwnerReferences.call(void 0, 
+      const crossOwner = await _chunkBPOTSHDOcjs.planCrossOwnerReferences.call(void 0, 
         owner,
-        _chunkE2ROOWQCcjs.findSchemaTableOwners.call(void 0, config),
+        _chunkBPOTSHDOcjs.findSchemaTableOwners.call(void 0, config),
         database.dialect,
         database.executor
       );
@@ -384,7 +386,7 @@ async function checkSchema(config, options = {}) {
           onDelete: reference.onDelete
         };
       }
-      const stepPlan = _optionalChain([owner, 'access', _30 => _30.migrations, 'optionalAccess', _31 => _31.length]) ? await _chunkE2ROOWQCcjs.planOwnerSchemaSteps.call(void 0, {
+      const stepPlan = _optionalChain([owner, 'access', _30 => _30.migrations, 'optionalAccess', _31 => _31.length]) ? await _chunkBPOTSHDOcjs.planOwnerSchemaSteps.call(void 0, {
         owner: owner.name,
         schema: owner.schema,
         steps: owner.migrations,
@@ -399,15 +401,15 @@ async function checkSchema(config, options = {}) {
       const plan = await checkOwnerTables(
         owner,
         // What a pending rename will produce is not missing yet.
-        _chunkE2ROOWQCcjs.withoutRenameTargets.call(void 0, models, stepPlan),
+        _chunkBPOTSHDOcjs.withoutRenameTargets.call(void 0, models, stepPlan),
         database.dialect,
         database.executor,
         issues
       );
       const pending = plan.statements.length + (_nullishCoalesce(_optionalChain([plan, 'access', _32 => _32.upgrades, 'optionalAccess', _33 => _33.length]), () => ( 0)));
-      const state = pending > 0 ? await _chunkE2ROOWQCcjs.readSchemaState.call(void 0, database.executor, database.dialect, owner.name) : void 0;
-      const changes = state ? _chunkE2ROOWQCcjs.diffSchemaSnapshots.call(void 0, state.snapshot, _chunkE2ROOWQCcjs.createSchemaSnapshot.call(void 0, models)) : void 0;
-      if (state && changes && _chunkE2ROOWQCcjs.hasSchemaChanges.call(void 0, changes)) {
+      const state = pending > 0 ? await _chunkBPOTSHDOcjs.readSchemaState.call(void 0, database.executor, database.dialect, owner.name) : void 0;
+      const changes = state ? _chunkBPOTSHDOcjs.diffSchemaSnapshots.call(void 0, state.snapshot, _chunkBPOTSHDOcjs.createSchemaSnapshot.call(void 0, models)) : void 0;
+      if (state && changes && _chunkBPOTSHDOcjs.hasSchemaChanges.call(void 0, changes)) {
         const versions = state.version && owner.version && state.version !== owner.version ? `upgraded ${state.version} \u2192 ${owner.version}` : "changed since it was last migrated";
         issues.push({
           severity: "warning",
@@ -444,7 +446,7 @@ async function checkSchema(config, options = {}) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, checkSchema, "checkSchema");
 async function checkOwnerTables(owner, models, dialect, executor, issues) {
-  const plan = await _chunkE2ROOWQCcjs.planSchemaMigration.call(void 0, models, dialect, executor);
+  const plan = await _chunkBPOTSHDOcjs.planSchemaMigration.call(void 0, models, dialect, executor);
   const present = /* @__PURE__ */ new Set([
     ...plan.upToDate,
     ...plan.drift.map((drift) => drift.table),
@@ -525,7 +527,7 @@ async function checkOwnerTables(owner, models, dialect, executor, issues) {
       table: key.table,
       column: key.column,
       message: `"${key.table}.${key.column}" has no foreign key to "${key.referencedTable}.${key.referencedColumn}", which ${owner.name} could have.`,
-      hint: dialect === "sqlite" ? "SQLite can only add a foreign key when it creates the table." : `Allow it with \`${_chunkE2ROOWQCcjs.describeForeignKeyApproval.call(void 0, { owner: owner.name, modelKey: key.modelKey })}\` in farm.config, then run \`farm ${owner.name} migrate --apply\`. Rows that point at nothing are checked first.`
+      hint: dialect === "sqlite" ? "SQLite can only add a foreign key when it creates the table." : `Allow it with \`${_chunkBPOTSHDOcjs.describeForeignKeyApproval.call(void 0, { owner: owner.name, modelKey: key.modelKey })}\` in farm.config, then run \`farm ${owner.name} migrate --apply\`. Rows that point at nothing are checked first.`
     });
   }
   return plan;
@@ -609,9 +611,9 @@ async function checkReferences(owner, models, database, databases, resolveTarget
         continue;
       }
       if (database.dialect === "sqlite" || dialect === "sqlite") continue;
-      const expected = _chunkE2ROOWQCcjs.getSqlColumnType.call(void 0, field, database.dialect);
-      const mine = _chunkE2ROOWQCcjs.columnTypeFamily.call(void 0, expected);
-      const theirs = _chunkE2ROOWQCcjs.columnTypeFamily.call(void 0, column.type);
+      const expected = _chunkBPOTSHDOcjs.getSqlColumnType.call(void 0, field, database.dialect);
+      const mine = _chunkBPOTSHDOcjs.columnTypeFamily.call(void 0, expected);
+      const theirs = _chunkBPOTSHDOcjs.columnTypeFamily.call(void 0, column.type);
       if (mine && theirs && mine !== theirs) {
         issues.push({
           severity: "warning",
@@ -630,7 +632,7 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, checkReferences, "checkReferences");
 async function checkExtensions(owner, extensions, databaseForTable, ownDatabase, allowExtend, issues) {
   for (const extension of extensions) {
     const database = _nullishCoalesce(databaseForTable(extension.table), () => ( ownDatabase));
-    const table = await _chunkE2ROOWQCcjs.describeSchemaTable.call(void 0, database.executor, database.dialect, extension.table);
+    const table = await _chunkBPOTSHDOcjs.describeSchemaTable.call(void 0, database.executor, database.dialect, extension.table);
     const columns = extension.fields.map(({ field }) => field.name);
     if (!table) {
       issues.push({
@@ -643,7 +645,7 @@ async function checkExtensions(owner, extensions, databaseForTable, ownDatabase,
       });
       continue;
     }
-    const allowed = _chunkE2ROOWQCcjs.isSchemaExtensionAllowed.call(void 0, allowExtend, extension);
+    const allowed = _chunk4U5XZDLGcjs.isSchemaExtensionAllowed.call(void 0, allowExtend, extension);
     for (const { field } of extension.fields) {
       const existing = table.columns.find(
         (column) => database.dialect === "postgres" ? column.name === field.name : column.name.toLowerCase() === field.name.toLowerCase()
@@ -657,14 +659,14 @@ async function checkExtensions(owner, extensions, databaseForTable, ownDatabase,
           table: extension.table,
           column: field.name,
           message: `${owner.name} needs "${extension.table}.${field.name}", which does not exist.`,
-          hint: allowed ? `Add it with ${command}. If your ORM owns "${extension.table}", add the column to its schema instead.` : `Allow it in farm.config with \`${_chunkE2ROOWQCcjs.describeSchemaExtensionApproval.call(void 0, extension)}\`, then add it with ${command}. If your ORM owns "${extension.table}", add the column to its schema instead.`
+          hint: allowed ? `Add it with ${command}. If your ORM owns "${extension.table}", add the column to its schema instead.` : `Allow it in farm.config with \`${_chunk4U5XZDLGcjs.describeSchemaExtensionApproval.call(void 0, extension)}\`, then add it with ${command}. If your ORM owns "${extension.table}", add the column to its schema instead.`
         });
         continue;
       }
       if (database.dialect === "sqlite") continue;
-      const expected = _chunkE2ROOWQCcjs.getSqlColumnType.call(void 0, field, database.dialect);
-      const mine = _chunkE2ROOWQCcjs.columnTypeFamily.call(void 0, expected);
-      const theirs = _chunkE2ROOWQCcjs.columnTypeFamily.call(void 0, existing.type);
+      const expected = _chunkBPOTSHDOcjs.getSqlColumnType.call(void 0, field, database.dialect);
+      const mine = _chunkBPOTSHDOcjs.columnTypeFamily.call(void 0, expected);
+      const theirs = _chunkBPOTSHDOcjs.columnTypeFamily.call(void 0, existing.type);
       if (mine && theirs && mine !== theirs) {
         issues.push({
           severity: "warning",

package/dist/{chunk-IWZKTWHZ.cjs → chunk-WU7ZS3EM.cjs}

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }
 
-var _chunkYWN746UScjs = require('./chunk-YWN746US.cjs');
+var _chunk6MVFHNYZcjs = require('./chunk-6MVFHNYZ.cjs');
 
 
 var _chunkARJWXNQLcjs = require('./chunk-ARJWXNQL.cjs');
@@ -50,6 +50,11 @@ function createEndpoint(pathOrOptions, optionsOrHandler, maybeHandler) {
   if (typeof handler !== "function") {
     throw new TypeError("createEndpoint requires a handler function");
   }
+  if (options.use !== void 0) {
+    throw new TypeError(
+      "createEndpoint does not support the `use` option. Move these functions to `middleware`: each receives the endpoint context and returns an object, true, false, or a Response."
+    );
+  }
   const middleware = normalizeEndpointMiddleware(options.middleware);
   const errors = normalizeEndpointErrors(options.errors);
   const error = createEndpointErrorHandler(errors);
@@ -220,7 +225,7 @@ async function applyEndpointInvalidations(declaration, context, result) {
       "Endpoint invalidates must resolve to an array of { key }, { path }, or { tag } targets"
     );
   }
-  return _chunkYWN746UScjs.applyFarmCacheInvalidationTargets.call(void 0, targets);
+  return _chunk6MVFHNYZcjs.applyFarmCacheInvalidationTargets.call(void 0, targets);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, applyEndpointInvalidations, "applyEndpointInvalidations");
 function createInitialEndpointContext(value) {

package/dist/{chunk-J63ZH5OQ.cjs → chunk-X3GMHKO3.cjs}

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }
 
-var _chunkE3UK5IIBcjs = require('./chunk-E3UK5IIB.cjs');
+var _chunkGS3WR5HXcjs = require('./chunk-GS3WR5HX.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -44,7 +44,7 @@ function emitFarmAgentRead(request, surface, status, view) {
   } catch (e) {
     return;
   }
-  _chunkE3UK5IIBcjs.emitFarmEvent.call(void 0, {
+  _chunkGS3WR5HXcjs.emitFarmEvent.call(void 0, {
     type: "agent.read",
     surface,
     route,

package/dist/{chunk-POSPE3IO.mjs → chunk-X3NGFVRF.mjs}

@@ -1,8 +1,9 @@
 import {
   _setAppRequestView,
   _setCspNonceResolver,
-  _setCurrentRequestResolver
-} from "./chunk-QRKIMN7T.mjs";
+  _setCurrentRequestResolver,
+  _setSharedCacheScopeRunner
+} from "./chunk-6LVRDOAW.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
@@ -23,6 +24,26 @@ function getRequestStore() {
 }
 __name(getRequestStore, "getRequestStore");
 var requestStore = getRequestStore();
+var SHARED_CACHE_SCOPE_KEY = /* @__PURE__ */ Symbol.for("@farm.js/core/shared-cache-scope");
+function getSharedCacheScopeStore() {
+  const runtime = globalThis;
+  const existing = runtime[SHARED_CACHE_SCOPE_KEY];
+  if (existing instanceof AsyncLocalStorage) return existing;
+  const storage = new AsyncLocalStorage();
+  runtime[SHARED_CACHE_SCOPE_KEY] = storage;
+  return storage;
+}
+__name(getSharedCacheScopeStore, "getSharedCacheScopeStore");
+var sharedCacheScope = getSharedCacheScopeStore();
+_setSharedCacheScopeRunner((label, fn) => sharedCacheScope.run(label, fn));
+function _assertRequestReadAllowed(api) {
+  const scope = sharedCacheScope.getStore();
+  if (!scope) return;
+  throw new Error(
+    `${api} cannot be called inside ${scope}: its result is cached and shared by every request, so one visitor's request data would be served to others. Read it outside the cached function and pass the value in as an argument, which also makes it part of the cache key.`
+  );
+}
+__name(_assertRequestReadAllowed, "_assertRequestReadAllowed");
 var REQUEST_READS_KEY = /* @__PURE__ */ Symbol.for("@farm.js/core/request-reads");
 function getRequestReads() {
   const runtime = globalThis;
@@ -42,32 +63,49 @@ function getAppRequestView(request) {
   if (request.method !== "GET" && request.method !== "HEAD") {
     countRequestRead(request);
     view = request;
+    try {
+      guardRequestReads(view, request, request.headers, request.clone);
+    } catch {
+    }
   } else {
     view = new Request(request);
-    Object.defineProperties(view, {
-      // The rendered request's own signal, so aborting it reaches the handler unchanged.
-      signal: { configurable: true, get: /* @__PURE__ */ __name(() => request.signal, "get") },
-      headers: {
-        configurable: true,
-        get() {
-          countRequestRead(request);
-          return request.headers;
-        }
-      },
-      clone: {
-        configurable: true,
-        value() {
-          countRequestRead(request);
-          return request.clone();
-        }
-      }
-    });
+    Object.defineProperty(view, "signal", { configurable: true, get: /* @__PURE__ */ __name(() => request.signal, "get") });
+    guardRequestReads(view, request, request.headers, request.clone);
   }
   appRequestViews.set(request, view);
   return view;
 }
 __name(getAppRequestView, "getAppRequestView");
-_setCurrentRequestResolver(() => requestStore.getStore());
+function guardRequestReads(view, request, requestHeaders, clone) {
+  Object.defineProperties(view, {
+    headers: {
+      configurable: true,
+      get() {
+        _assertRequestReadAllowed("request.headers");
+        countRequestRead(request);
+        return requestHeaders;
+      }
+    },
+    clone: {
+      configurable: true,
+      value() {
+        _assertRequestReadAllowed("request.clone()");
+        countRequestRead(request);
+        return clone.call(request);
+      }
+    }
+  });
+}
+__name(guardRequestReads, "guardRequestReads");
+_setCurrentRequestResolver(
+  () => {
+    _assertRequestReadAllowed(
+      "A helper that reads the current request (such as auth.user() or the server api client)"
+    );
+    return requestStore.getStore();
+  },
+  () => requestStore.getStore()
+);
 var CSP_NONCE_STORAGE_KEY = /* @__PURE__ */ Symbol.for("@farm.js/core/csp-nonce-storage");
 function getCspNonceStore() {
   const runtime = globalThis;
@@ -166,6 +204,7 @@ async function _runWithCurrentRequest(request, fn) {
 }
 __name(_runWithCurrentRequest, "_runWithCurrentRequest");
 function getCurrentRequest() {
+  _assertRequestReadAllowed("getCurrentRequest()");
   const request = requestStore.getStore();
   if (!request) {
     throw new Error(
@@ -186,6 +225,7 @@ function getCurrentRequestOrNull() {
 __name(getCurrentRequestOrNull, "getCurrentRequestOrNull");
 
 export {
+  _assertRequestReadAllowed,
   _runWithFarmCspNonce,
   resolveFarmRequestURL,
   resolveFarmWebRequestOrigin,

package/dist/{chunk-VT4WFRHA.mjs → chunk-XUC6CFLE.mjs}

@@ -7,7 +7,7 @@ import {
   isAPIRouteRef,
   resolveServerFnInvalidateTargets,
   settleServerFnOptimisticUpdates
-} from "./chunk-ARC7I3O2.mjs";
+} from "./chunk-26RUNDIR.mjs";
 import {
   notifyClientObserver
 } from "./chunk-72AK62H5.mjs";

package/dist/chunk-Y5RG6B7S.mjs

@@ -0,0 +1,77 @@
+import {
+  __name
+} from "./chunk-LPEX4YW6.mjs";
+
+// src/plugin-runtime-endpoint.ts
+function normalizeFarmPluginRuntimeEndpointPath(pathname, label = "Farm plugin runtime endpoint") {
+  if (typeof pathname !== "string" || pathname.trim() !== pathname || pathname.length === 0) {
+    throw new TypeError(`${label} path must be a non-empty pathname without surrounding spaces`);
+  }
+  if (!pathname.startsWith("/") || pathname.startsWith("//") || pathname.includes("?") || pathname.includes("#") || pathname.includes("*")) {
+    throw new TypeError(`${label} path must be an exact pathname such as "/status"`);
+  }
+  if (pathname.includes("\\") || Array.from(pathname).some((character) => {
+    const code = character.charCodeAt(0);
+    return code <= 31 || code >= 127 && code <= 159;
+  })) {
+    throw new TypeError(`${label} path cannot contain backslashes or control characters`);
+  }
+  for (const segment of pathname.split("/").slice(1)) {
+    let decoded = segment;
+    try {
+      decoded = decodeURIComponent(segment);
+    } catch {
+      throw new TypeError(`${label} path contains a malformed percent escape`);
+    }
+    if (decoded.includes("/") || decoded.includes("\\")) {
+      throw new TypeError(`${label} path cannot contain percent-encoded path separators`);
+    }
+    if (Array.from(decoded).some((character) => {
+      const code = character.charCodeAt(0);
+      return code <= 31 || code >= 127 && code <= 159;
+    })) {
+      throw new TypeError(`${label} path cannot contain control characters`);
+    }
+    if (decoded === "." || decoded === "..") {
+      throw new TypeError(`${label} path cannot contain dot segments`);
+    }
+  }
+  return normalizeRuntimeEndpointRequestPath(pathname);
+}
+__name(normalizeFarmPluginRuntimeEndpointPath, "normalizeFarmPluginRuntimeEndpointPath");
+function normalizeRuntimeEndpointRequestPath(pathname) {
+  return pathname.length > 1 ? pathname.replace(/\/+$/, "") || "/" : pathname;
+}
+__name(normalizeRuntimeEndpointRequestPath, "normalizeRuntimeEndpointRequestPath");
+function farmPluginMayAffectRuntimePath(plugin, pathname) {
+  const runtime = plugin.runtime;
+  const endpoints = runtime?.endpoints;
+  const hasUnscopedRequestHooks = Boolean(
+    plugin.init || plugin.ready || plugin.shutdown || runtime?.context || runtime?.before || runtime?.after || runtime?.error || plugin.router || plugin.render || plugin.beforeRouteMatch || plugin.afterRouteMatch || plugin.beforeRender || plugin.afterRender || plugin.onError || plugin.transformHTML || plugin.beforeRequest || plugin.afterResponse
+  );
+  if (hasUnscopedRequestHooks) return true;
+  if (Array.isArray(endpoints) && endpoints.length > 0) {
+    const normalizedPathname = normalizeRuntimeEndpointRequestPath(pathname);
+    return endpoints.some(
+      (endpoint) => normalizeFarmPluginRuntimeEndpointPath(
+        endpoint.path,
+        `Farm plugin "${plugin.name}" runtime endpoint`
+      ) === normalizedPathname
+    );
+  }
+  return Boolean(plugin.setup || runtime?.start || runtime?.close);
+}
+__name(farmPluginMayAffectRuntimePath, "farmPluginMayAffectRuntimePath");
+function _farmPluginsKeepResponsesPrivate(plugins) {
+  return plugins.some(
+    (plugin) => typeof plugin?.runtime?.before === "function" && plugin.runtime.cache !== "public"
+  );
+}
+__name(_farmPluginsKeepResponsesPrivate, "_farmPluginsKeepResponsesPrivate");
+
+export {
+  normalizeFarmPluginRuntimeEndpointPath,
+  normalizeRuntimeEndpointRequestPath,
+  farmPluginMayAffectRuntimePath,
+  _farmPluginsKeepResponsesPrivate
+};

package/dist/{chunk-EIPC3FDA.cjs → chunk-YWCYV7QC.cjs}

@@ -3,21 +3,24 @@
 var _chunkAI7QMY7Ocjs = require('./chunk-AI7QMY7O.cjs');
 
 
-var _chunk6XWDE2P2cjs = require('./chunk-6XWDE2P2.cjs');
 
+var _chunkZTP3BJG6cjs = require('./chunk-ZTP3BJG6.cjs');
 
-var _chunkULASELLAcjs = require('./chunk-ULASELLA.cjs');
+
+var _chunk6IZWX6EScjs = require('./chunk-6IZWX6ES.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
 
 // src/headers.ts
 function headers() {
-  return new Headers(_chunk6XWDE2P2cjs.getCurrentRequest.call(void 0, ).headers);
+  _chunkZTP3BJG6cjs._assertRequestReadAllowed.call(void 0, "headers()");
+  return new Headers(_chunkZTP3BJG6cjs.getCurrentRequest.call(void 0, ).headers);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, headers, "headers");
 function cookies() {
-  const cookieHeader = _chunk6XWDE2P2cjs.getCurrentRequest.call(void 0, ).headers.get("cookie") || "";
+  _chunkZTP3BJG6cjs._assertRequestReadAllowed.call(void 0, "cookies()");
+  const cookieHeader = _chunkZTP3BJG6cjs.getCurrentRequest.call(void 0, ).headers.get("cookie") || "";
   const parsed = _chunkAI7QMY7Ocjs.parseRequestCookieHeader.call(void 0, cookieHeader);
   return {
     get(name) {
@@ -39,7 +42,8 @@ function cookies() {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, cookies, "cookies");
 function getCspNonce() {
-  return _chunkULASELLAcjs._resolveCurrentCspNonce.call(void 0, );
+  _chunkZTP3BJG6cjs._assertRequestReadAllowed.call(void 0, "getCspNonce()");
+  return _chunk6IZWX6EScjs._resolveCurrentCspNonce.call(void 0, );
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getCspNonce, "getCspNonce");
 

package/dist/{chunk-WLL43JMO.mjs → chunk-YYQVGKO5.mjs}

@@ -1,6 +1,6 @@
 import {
   findProgrammaticRouteFilesInDir
-} from "./chunk-MYIZXDZA.mjs";
+} from "./chunk-FWCGUVVL.mjs";
 import {
   isFarmAPIRouteFileName
 } from "./chunk-CU625VAY.mjs";
@@ -17,21 +17,23 @@ import {
   matchAPIRouteAtBasePath,
   mergePluginAPIRoutes,
   resolveAPIRouteEndpoint
-} from "./chunk-6HB6V3R7.mjs";
+} from "./chunk-VTBXE6QG.mjs";
 import {
   registerAPIRouteShape
 } from "./chunk-W3B4PKAW.mjs";
 import {
   createProgrammaticRouteModuleId
-} from "./chunk-EA5K5BKU.mjs";
+} from "./chunk-KNHBTJP6.mjs";
 import {
   getFarmRouteRuntimeConfig,
   normalizeFarmRouteRuntimeConfig
 } from "./chunk-2J7W2WND.mjs";
 import {
-  loadFarmDevModule,
   toFileModuleUrl
-} from "./chunk-KMTGADN3.mjs";
+} from "./chunk-7GNWGLWB.mjs";
+import {
+  loadFarmDevModule
+} from "./chunk-QCVIRVHE.mjs";
 import {
   logger
 } from "./chunk-KI3MESHB.mjs";

package/dist/chunk-YZAKIXRL.cjs

@@ -0,0 +1,67 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
+
+// src/middleware/server.ts
+var _async_hooks = require('async_hooks');
+var MIDDLEWARE_DATA_STORE_KEY = /* @__PURE__ */ Symbol.for("farm.middlewareDataStore");
+var MIDDLEWARE_CONTEXT_STORE_KEY = /* @__PURE__ */ Symbol.for("farm.middlewareContextStore");
+function getGlobalMiddlewareStore(key) {
+  const state = globalThis;
+  const existing = state[key];
+  if (existing instanceof _async_hooks.AsyncLocalStorage) {
+    return existing;
+  }
+  const store = new (0, _async_hooks.AsyncLocalStorage)();
+  state[key] = store;
+  return store;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, getGlobalMiddlewareStore, "getGlobalMiddlewareStore");
+var middlewareStore = getGlobalMiddlewareStore(MIDDLEWARE_DATA_STORE_KEY);
+var middlewareContextStore = getGlobalMiddlewareStore(MIDDLEWARE_CONTEXT_STORE_KEY);
+function toMiddlewareMap(data) {
+  if (data instanceof Map) {
+    return new Map(data);
+  }
+  return new Map(Object.entries(data));
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, toMiddlewareMap, "toMiddlewareMap");
+function _clearCurrentMiddlewareData() {
+  middlewareStore.enterWith(/* @__PURE__ */ new Map());
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, _clearCurrentMiddlewareData, "_clearCurrentMiddlewareData");
+function _clearCurrentMiddlewareContext() {
+  middlewareContextStore.enterWith(/* @__PURE__ */ new Map());
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, _clearCurrentMiddlewareContext, "_clearCurrentMiddlewareContext");
+async function _runWithMiddlewareData(data, fn) {
+  return middlewareStore.run(toMiddlewareMap(data), fn);
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, _runWithMiddlewareData, "_runWithMiddlewareData");
+async function _runWithMiddlewareContext(context, fn) {
+  return middlewareContextStore.run(toMiddlewareMap(context), fn);
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, _runWithMiddlewareContext, "_runWithMiddlewareContext");
+function getMiddlewareData() {
+  return middlewareStore.getStore() || /* @__PURE__ */ new Map();
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, getMiddlewareData, "getMiddlewareData");
+function getMiddlewareValue(key) {
+  const data = getMiddlewareData();
+  return data.get(key);
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, getMiddlewareValue, "getMiddlewareValue");
+function getMiddlewareContext() {
+  return middlewareContextStore.getStore() || /* @__PURE__ */ new Map();
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, getMiddlewareContext, "getMiddlewareContext");
+
+
+
+
+
+
+
+
+
+exports._clearCurrentMiddlewareData = _clearCurrentMiddlewareData; exports._clearCurrentMiddlewareContext = _clearCurrentMiddlewareContext; exports._runWithMiddlewareData = _runWithMiddlewareData; exports._runWithMiddlewareContext = _runWithMiddlewareContext; exports.getMiddlewareData = getMiddlewareData; exports.getMiddlewareValue = getMiddlewareValue; exports.getMiddlewareContext = getMiddlewareContext;

package/dist/chunk-ZQRCSUSB.cjs

@@ -0,0 +1,25 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+
+var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
+
+// src/schema-capabilities.ts
+function assertNoSchemaListField(field, fieldPath, target) {
+  if (!field.list) {
+    return;
+  }
+  throw new Error(
+    `Schema field "${fieldPath}" declares list: true, but ${target} does not support list fields. Use type: "json" for an array value or model the values in a related table.`
+  );
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, assertNoSchemaListField, "assertNoSchemaListField");
+
+// src/schema-reference.ts
+function isDatabaseEnforcedReference(reference) {
+  return reference.enforced === void 0 || reference.enforced === "db";
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, isDatabaseEnforcedReference, "isDatabaseEnforcedReference");
+
+
+
+
+exports.assertNoSchemaListField = assertNoSchemaListField; exports.isDatabaseEnforcedReference = isDatabaseEnforcedReference;