@farm.js/core 0.1.51-beta.1 → 0.1.51-beta.2

package/dist/app-markdown.d.mts

@@ -1,5 +1,5 @@
-import { g as FarmMdxComponents, h as FarmMdxResolvedConfig, i as RouteModule } from './client-plugins.d-C_3CdALC.mjs';
-export { j as FARM_MARKDOWN_CONTENT_TYPE, m as FarmMdxComponent, n as FarmMdxUserConfig, k as createFarmMarkdownErrorBody, l as farmRequestWantsMarkdown, r as resolveFarmMdxComponentsModulePath, o as resolveMdxConfig } from './client-plugins.d-C_3CdALC.mjs';
+import { g as FarmMdxComponents, h as FarmMdxResolvedConfig, i as RouteModule } from './client-plugins.d-Bx3FXpqm.mjs';
+export { j as FARM_MARKDOWN_CONTENT_TYPE, m as FarmMdxComponent, n as FarmMdxUserConfig, k as createFarmMarkdownErrorBody, l as farmRequestWantsMarkdown, r as resolveFarmMdxComponentsModulePath, o as resolveMdxConfig } from './client-plugins.d-Bx3FXpqm.mjs';
 export { FARM_MARKDOWN_ANONYMOUS_CLIENT_ADDRESS, FarmMarkdownPageModuleInput, FarmMarkdownPageSource, createFarmMarkdownRouteModule, createFarmMarkdownSourceResponse, createMarkdownMetadata, isFarmMarkdownPageFile, isFarmMarkdownPublicSourceResponse, normalizeFarmMarkdownRoutePath, parseMarkdownFrontmatter, titleFromMarkdown } from './internal/app-markdown-runtime.mjs';
 import './lifecycle.d-C2aLBOwu.mjs';
 import './route.d-BaVH3V0w.mjs';
@@ -30,7 +30,7 @@ import 'rolldown/utils';
 import 'rolldown';
 import './image-config.d-CeDgNyX4.mjs';
 import './types.d-C41ePjvP.mjs';
-import './config.d-CnhyvvmT.mjs';
+import './config.d-iRPI16ku.mjs';
 import './types.d-DQnyD3VD.mjs';
 import './font.mjs';
 

package/dist/app-markdown.d.ts

@@ -1,5 +1,5 @@
-import { g as FarmMdxComponents, h as FarmMdxResolvedConfig, i as RouteModule } from './client-plugins.d-C0n8Yhh-.js';
-export { j as FARM_MARKDOWN_CONTENT_TYPE, m as FarmMdxComponent, n as FarmMdxUserConfig, k as createFarmMarkdownErrorBody, l as farmRequestWantsMarkdown, r as resolveFarmMdxComponentsModulePath, o as resolveMdxConfig } from './client-plugins.d-C0n8Yhh-.js';
+import { g as FarmMdxComponents, h as FarmMdxResolvedConfig, i as RouteModule } from './client-plugins.d-TiLbS5j4.js';
+export { j as FARM_MARKDOWN_CONTENT_TYPE, m as FarmMdxComponent, n as FarmMdxUserConfig, k as createFarmMarkdownErrorBody, l as farmRequestWantsMarkdown, r as resolveFarmMdxComponentsModulePath, o as resolveMdxConfig } from './client-plugins.d-TiLbS5j4.js';
 export { FARM_MARKDOWN_ANONYMOUS_CLIENT_ADDRESS, FarmMarkdownPageModuleInput, FarmMarkdownPageSource, createFarmMarkdownRouteModule, createFarmMarkdownSourceResponse, createMarkdownMetadata, isFarmMarkdownPageFile, isFarmMarkdownPublicSourceResponse, normalizeFarmMarkdownRoutePath, parseMarkdownFrontmatter, titleFromMarkdown } from './internal/app-markdown-runtime.js';
 import './lifecycle.d-C2aLBOwu.js';
 import './route.d-DBTEqifW.js';
@@ -30,7 +30,7 @@ import 'rolldown/utils';
 import 'rolldown';
 import './image-config.d-CeDgNyX4.js';
 import './types.d-C41ePjvP.js';
-import './config.d-CnhyvvmT.js';
+import './config.d-iRPI16ku.js';
 import './types.d-DQnyD3VD.js';
 import './font.js';
 

package/dist/{app.d-DOGW1KI8.d.mts → app.d-BfgJCsTQ.d.mts}

@@ -1,14 +1,14 @@
-import { aF as FarmConfig, P as ParsedRoute, bE as ResolvedFarmRouteRuntimeConfig, bF as ApplicationMetadataRouteKind, i as RouteModule, aV as LayoutModule, b6 as SSGCollectionResult, s as FarmRequest, t as FarmResponse, bG as ResolvedFarmAPIConfig, bH as FarmDocsResolvedConfig, br as FarmMarkdownResolvedConfig, h as FarmMdxResolvedConfig, ax as ResolvedFarmDevtoolsConfig, bI as ResolvedFarmDevIndicatorsConfig, bJ as ResolvedFarmAuthConfig, bK as ResolvedFarmPerformanceConfig, bL as ResolvedFarmSecurityConfig } from './client-plugins.d-C_3CdALC.mjs';
+import { aF as FarmConfig, P as ParsedRoute, bE as ResolvedFarmRouteRuntimeConfig, bF as ApplicationMetadataRouteKind, i as RouteModule, aV as LayoutModule, b6 as SSGCollectionResult, s as FarmRequest, t as FarmResponse, bG as ResolvedFarmAPIConfig, bH as FarmDocsResolvedConfig, br as FarmMarkdownResolvedConfig, h as FarmMdxResolvedConfig, ax as ResolvedFarmDevtoolsConfig, bI as ResolvedFarmDevIndicatorsConfig, bJ as ResolvedFarmAuthConfig, bK as ResolvedFarmPerformanceConfig, bL as ResolvedFarmSecurityConfig } from './client-plugins.d-Bx3FXpqm.mjs';
 import { F as FarmWorkflowsResolvedConfig } from './workflows.d-CRMzQZ3k.mjs';
 import { FarmCronResolvedConfig } from './cron.mjs';
 import { R as ResolvedFarmImageConfig } from './image-config.d-CeDgNyX4.mjs';
 import { ProgrammaticRedirectRoute, ProgrammaticRouteSearchClientOptions } from './routes.mjs';
-import { P as ProgrammaticClientRoutes } from './programmatic-routes-client.d-BIowUXQC.mjs';
+import { P as ProgrammaticClientRoutes } from './programmatic-routes-client.d-6CGQ3TCk.mjs';
 import { ViteDevServer } from 'vite';
 import { F as FarmIslandStrategy } from './island.d-CfGru1MO.mjs';
-import { M as MetadataImageKind, c as createFarmDefaultMCPServer } from './agent-mcp.d-BPzpKBHQ.mjs';
+import { M as MetadataImageKind, c as createFarmDefaultMCPServer } from './agent-mcp.d-Z5DuwrqW.mjs';
 import { FarmServerRendererRuntime, FarmRenderer } from './renderer.mjs';
-import { F as FarmRouteRenderPlan } from './render-plan.d-BNeqyPyJ.mjs';
+import { F as FarmRouteRenderPlan } from './render-plan.d-BH9edqKs.mjs';
 import { R as ResolvedFarmI18nConfig } from './types.d-C41ePjvP.mjs';
 import { F as FarmI18nRuntime } from './runtime.d-3iJAKptR.mjs';
 import { R as ResolvedFarmThemeConfig } from './types.d-DQnyD3VD.mjs';

package/dist/{app.d-B5EWdob-.d.ts → app.d-DmapqkbV.d.ts}

@@ -1,14 +1,14 @@
-import { aF as FarmConfig, P as ParsedRoute, bE as ResolvedFarmRouteRuntimeConfig, bF as ApplicationMetadataRouteKind, i as RouteModule, aV as LayoutModule, b6 as SSGCollectionResult, s as FarmRequest, t as FarmResponse, bG as ResolvedFarmAPIConfig, bH as FarmDocsResolvedConfig, br as FarmMarkdownResolvedConfig, h as FarmMdxResolvedConfig, ax as ResolvedFarmDevtoolsConfig, bI as ResolvedFarmDevIndicatorsConfig, bJ as ResolvedFarmAuthConfig, bK as ResolvedFarmPerformanceConfig, bL as ResolvedFarmSecurityConfig } from './client-plugins.d-C0n8Yhh-.js';
+import { aF as FarmConfig, P as ParsedRoute, bE as ResolvedFarmRouteRuntimeConfig, bF as ApplicationMetadataRouteKind, i as RouteModule, aV as LayoutModule, b6 as SSGCollectionResult, s as FarmRequest, t as FarmResponse, bG as ResolvedFarmAPIConfig, bH as FarmDocsResolvedConfig, br as FarmMarkdownResolvedConfig, h as FarmMdxResolvedConfig, ax as ResolvedFarmDevtoolsConfig, bI as ResolvedFarmDevIndicatorsConfig, bJ as ResolvedFarmAuthConfig, bK as ResolvedFarmPerformanceConfig, bL as ResolvedFarmSecurityConfig } from './client-plugins.d-TiLbS5j4.js';
 import { F as FarmWorkflowsResolvedConfig } from './workflows.d-CRMzQZ3k.js';
 import { FarmCronResolvedConfig } from './cron.js';
 import { R as ResolvedFarmImageConfig } from './image-config.d-CeDgNyX4.js';
 import { ProgrammaticRedirectRoute, ProgrammaticRouteSearchClientOptions } from './routes.js';
-import { P as ProgrammaticClientRoutes } from './programmatic-routes-client.d-VZ0qcbH4.js';
+import { P as ProgrammaticClientRoutes } from './programmatic-routes-client.d-BlFp5hv4.js';
 import { ViteDevServer } from 'vite';
 import { F as FarmIslandStrategy } from './island.d-CfGru1MO.js';
-import { M as MetadataImageKind, c as createFarmDefaultMCPServer } from './agent-mcp.d-ZuuNgrkQ.js';
+import { M as MetadataImageKind, c as createFarmDefaultMCPServer } from './agent-mcp.d-CR5Ov83o.js';
 import { FarmServerRendererRuntime, FarmRenderer } from './renderer.js';
-import { F as FarmRouteRenderPlan } from './render-plan.d-BB6KrYjP.js';
+import { F as FarmRouteRenderPlan } from './render-plan.d-DhP0mTHF.js';
 import { R as ResolvedFarmI18nConfig } from './types.d-C41ePjvP.js';
 import { F as FarmI18nRuntime } from './runtime.d-BtL3PCL3.js';
 import { R as ResolvedFarmThemeConfig } from './types.d-DQnyD3VD.js';

package/dist/{chunk-5A5GAZ75.mjs → chunk-4SSRBCBR.mjs}

@@ -13,13 +13,16 @@ import {
 import {
   generateNativeMCPPluginSource
 } from "./chunk-KQH2COEJ.mjs";
+import {
+  FARM_MOBILE_SESSION_PLUGIN
+} from "./chunk-C3BOESDW.mjs";
 import {
   assertFarmDocsAdapterServesNoGuardedPages,
   compileFarmDocsAdapterEdgeManifest,
   createFarmDocsAPIHandler,
   hasFarmDocsRuntimeAdapter,
   listFarmDocsAdapterPages
-} from "./chunk-I3EFXUAR.mjs";
+} from "./chunk-FM2UEKS2.mjs";
 import {
   FARM_DOCS_LAST_MODIFIED_MANIFEST,
   createFarmDocsHandler,
@@ -39,7 +42,7 @@ import {
 } from "./chunk-ALEUMLJN.mjs";
 import {
   FARM_PRERENDER_ENV
-} from "./chunk-KU7MBLDZ.mjs";
+} from "./chunk-E6LTONL4.mjs";
 import {
   resolveFarmInstrumentationFile
 } from "./chunk-N35YPV4N.mjs";
@@ -54,7 +57,7 @@ import {
   getDeployTargetForPreset,
   hasCustomFarmRouteContext,
   resolveDeployOutputPath
-} from "./chunk-KMB5BMFX.mjs";
+} from "./chunk-CTM4SPB3.mjs";
 import {
   DEFAULT_NOT_FOUND_STYLES,
   FARM_LAYOUT_ELEMENT_CLIENT_SOURCE,
@@ -86,7 +89,7 @@ import {
   resolveFarmIsolatedClientHydrationMode,
   resolveFarmNotFoundComponentPath,
   usesFarmServerTree
-} from "./chunk-EWC76P5D.mjs";
+} from "./chunk-PMKUU273.mjs";
 import {
   loadTailwindVitePlugin
 } from "./chunk-PIHKO25G.mjs";
@@ -124,7 +127,7 @@ import {
   listFarmBuiltInRoutePaths,
   resolveFarmApiCatalogInput,
   resolveFarmAppManifestInput
-} from "./chunk-QAIAFCRZ.mjs";
+} from "./chunk-E73PGHSR.mjs";
 import {
   FARM_DEFAULT_MCP_PATH,
   createFarmDefaultMCPServer,
@@ -233,7 +236,7 @@ import {
 } from "./chunk-LM2YOGDK.mjs";
 import {
   FARM_VERSION
-} from "./chunk-EOSFVNXZ.mjs";
+} from "./chunk-6CYQQQGR.mjs";
 import {
   getFarmPresetRuntime
 } from "./chunk-UAQD67HM.mjs";
@@ -1755,7 +1758,9 @@ function hasFarmPluginRoutes(config) {
 }
 function farmServerRuntimePluginsMayHandlePath(config, pathname) {
   return (config.plugins || []).some(
-    (plugin) => getFarmIntegrationPluginServerRuntime(plugin) !== false && farmPluginMayAffectRuntimePath(plugin, pathname)
+    (plugin) => getFarmIntegrationPluginServerRuntime(plugin) !== false && // Mobile session tokens change only bearer requests and cookie-clearing responses, which a
+    // prerendered file never answers or sends; its endpoints live under /__farm/.
+    plugin.name !== FARM_MOBILE_SESSION_PLUGIN && farmPluginMayAffectRuntimePath(plugin, pathname)
   );
 }
 async function discoverMiddlewareRoutes(appDir) {
@@ -2642,21 +2647,24 @@ async function fetchFarmNavigationDocument(url, headers, recover = true, signal)
   return response;
 }
 
-${streamNavigations ? `const FARM_FLUSH_MARKER = "<!--farm-flush-->";
-
-// Reads a streamed navigation (F-Stream) up to the end of React's shell. \`next\` then resolves
+${streamNavigations ? `// Reads a streamed navigation (F-Stream) up to the end of React's shell. \`next\` then resolves
 // with each later flush as it ends, and null at the end; a document without a marker is all shell.
-async function readFarmNavigationStream(body) {
+// The marker carries the random token the server sent in the F-Flush header, so page content
+// cannot forge a boundary; a response without a valid token is all shell.
+async function readFarmNavigationStream(body, flushToken) {
   const reader = body.getReader();
   const decoder = new TextDecoder();
+  const marker = typeof flushToken === "string" && /^[0-9a-f]{32}$/.test(flushToken)
+    ? "<!--farm-flush:" + flushToken + "-->"
+    : "";
   let text = "";
   let done = false;
   const next = async function() {
     for (;;) {
-      const at = text.indexOf(FARM_FLUSH_MARKER);
+      const at = marker ? text.indexOf(marker) : -1;
       if (at !== -1) {
         const flush = text.slice(0, at);
-        text = text.slice(at + FARM_FLUSH_MARKER.length);
+        text = text.slice(at + marker.length);
         return flush;
       }
       if (done) {
@@ -3230,7 +3238,7 @@ ${streamNavigations ? `  // A streamed navigation swaps in the page's shell; its
         }
       };
 ${streamNavigations ? `      if (streamShell && response.body) {
-        const streamed = await readFarmNavigationStream(response.body);
+        const streamed = await readFarmNavigationStream(response.body, response.headers.get("F-Flush"));
         if (!streamed.next) {
           store(streamed.shell);
           return streamed.shell;
@@ -6433,12 +6441,16 @@ import { fileURLToPath as farmDocsFileURLToPath } from "node:url";` : "";
   const instrumentationImport = instrumentationPath ? `import * as FarmInstrumentationModule from ${toVirtualEntryImportSpecifier(instrumentationPath)};` : "";
   const nativeAuth = generateNativeAuthIntegrationSource(config.auth);
   const nativeMCP = generateNativeMCPPluginSource(config.mcp);
+  const mobileSession = (config.plugins || []).some(
+    (plugin) => plugin?.name === FARM_MOBILE_SESSION_PLUGIN
+  );
   const integrationImports = `
 ${configModulePath ? `import * as FarmUserConfigModule from ${toVirtualEntryImportSpecifier(configModulePath)};` : ""}
 ${layerConfigImports}
 ${integrationRuntimeImport}
 ${nativeAuth.importSource}
 ${nativeMCP.importSource}
+${mobileSession ? `import { createFarmMobileSessionPlugin as __farmCreateMobileSessionPlugin } from "@farm.js/core/internal/production-runtime";` : ""}
 `;
   const imageRuntime = resolveFarmImageServerRuntime(config.images, preset);
   const imageRuntimeImport = imageRuntime === "none" ? "" : `import { _withFarmImageSourceClientAddress, createCloudflareImageTransformer, createFarmImageHandler } from "@farm.js/core/image/server";`;
@@ -6719,6 +6731,10 @@ const configuredPlugins = [
   ${hasCompressionRuntime && hasPluginRuntime ? "createCompressionPlugin()," : ""}
   ${hasRuntimeIntegrationConfig ? "...resolveIntegrationPlugins(serverRuntimeIntegrations)," : ""}
   ${nativeMCP.pluginSource}
+  ${mobileSession ? `__farmCreateMobileSessionPlugin({
+    basePath: ${JSON.stringify(config.basePath)},
+    integrations: () => serverRuntimeIntegrations,
+  }),` : ""}
   ${hasConfiguredRuntimePlugins ? `...farmRuntimeConfigs.flatMap((runtimeConfig) =>
     Array.isArray(runtimeConfig.plugins) ? runtimeConfig.plugins : [],
   ),` : ""}
@@ -7078,10 +7094,22 @@ function escapeFarmHtmlAttribute(value) {
     .replace(/>/g, "&gt;");
 }
 
-async function renderFarmElement(ReactDOMServer, element, routeKey, flushMarkers = false) {
-  // Written after each React flush in a streamed navigation (flushMarkers): the browser swaps in
+// A streamed navigation's flush marker token: 128 random bits, hex.
+function createFarmFlushToken() {
+  const bytes = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(bytes);
+  let token = "";
+  for (const byte of bytes) token += byte.toString(16).padStart(2, "0");
+  return token;
+}
+
+async function renderFarmElement(ReactDOMServer, element, routeKey, flushToken = "") {
+  // Written after each React flush in a streamed navigation (flushToken): the browser swaps in
   // the shell, then adds each Suspense boundary as soon as the flush that completed it ends.
-  const FARM_FLUSH_MARKER = "<!--farm-flush-->";
+  // The token is random per response and reaches the browser in the F-Flush header, so page
+  // content cannot forge a boundary.
+  const flushMarkers = Boolean(flushToken);
+  const FARM_FLUSH_MARKER = flushMarkers ? "<!--farm-flush:" + flushToken + "-->" : "";
   // Islands mode: each render writes its islands' values itself, so a request that renders twice
   // (notFound(), or a synchronous attempt that suspends and streams) still sends them.
   if (typeof farmIslandsRender === "function") element = farmIslandsRender(element);
@@ -9619,10 +9647,13 @@ ${hasServerRuntimeIntegrations ? `
           !route.shouldHydrate &&
           request.headers.get("f-render") === "tree";
         // A navigation the browser streams marks where each React flush ends, so the browser
-        // shows the page before its Suspense content arrives (FARM_FLUSH_MARKER).
-        const farmFlushMarkers = request.headers.get("f-stream") === "flush";` : `const farmLayoutKeyOf = null;
+        // shows the page before its Suspense content arrives (FARM_FLUSH_MARKER). The marker
+        // carries a random token sent in the F-Flush header: page content cannot forge one.
+        const farmFlushToken = request.headers.get("f-stream") === "flush"
+          ? createFarmFlushToken()
+          : "";` : `const farmLayoutKeyOf = null;
         const farmPayloadOnlyNavigation = false;
-        const farmFlushMarkers = false;`}
+        const farmFlushToken = "";`}
         const renderPageElement = async () => {
             // First, render the page content
             let pageElement;
@@ -9744,7 +9775,7 @@ ${hasServerRuntimeIntegrations ? `
           }
 
           wrappedElement = wrapWithFarmIntegrationProviders(wrappedElement);
-          return renderFarmElement(ReactDOMServer, wrappedElement, route.pattern, farmFlushMarkers);
+          return renderFarmElement(ReactDOMServer, wrappedElement, route.pattern, farmFlushToken);
         };
         const renderedPage = ${hasMiddlewareRuntime ? `await _runWithMiddlewareData(middlewareData, () =>
           _runWithMiddlewareContext(middlewareContext, renderPageElement)
@@ -10051,7 +10082,11 @@ ${hasServerRuntimeIntegrations ? `
               );
           return applyProductionMiddlewareHeaders(farmOwnedResponse(streamedDocument, {
             status: pageStatus,
-            headers: { ...responseHeaders, "x-farm-preload-streaming": "1" },
+            headers: {
+              ...responseHeaders,
+              "x-farm-preload-streaming": "1",
+              ...(farmFlushToken ? { "F-Flush": farmFlushToken } : {}),
+            },
           }), middlewareHeaders);
         }
 

package/dist/{chunk-EOSFVNXZ.mjs → chunk-6CYQQQGR.mjs}

@@ -1,5 +1,5 @@
 // package.json
-var version = "0.1.51-beta.1";
+var version = "0.1.51-beta.2";
 
 // src/version.ts
 var FARM_VERSION = version;

package/dist/{chunk-BSEKNTMS.mjs → chunk-74Z5KX4A.mjs}

@@ -37,7 +37,7 @@ import {
   resolveFarmIsolatedClientHydrationMode,
   resolveModuleSourcePath,
   stripUseClientDirective
-} from "./chunk-EWC76P5D.mjs";
+} from "./chunk-PMKUU273.mjs";
 import {
   loadTailwindVitePlugin
 } from "./chunk-PIHKO25G.mjs";
@@ -79,7 +79,7 @@ import {
   resolveFarmMCPRouteLabel,
   resolveFarmMarkdownRouteLabel,
   setFarmRouteLabel
-} from "./chunk-QAIAFCRZ.mjs";
+} from "./chunk-E73PGHSR.mjs";
 import {
   FARM_DEFAULT_MCP_PATH
 } from "./chunk-KRRZJ77U.mjs";
@@ -244,7 +244,7 @@ import {
 } from "./chunk-LM2YOGDK.mjs";
 import {
   FARM_VERSION
-} from "./chunk-EOSFVNXZ.mjs";
+} from "./chunk-6CYQQQGR.mjs";
 import {
   DEFAULT_FARM_API_BASE_PATH
 } from "./chunk-BLD5GVCG.mjs";
@@ -765,7 +765,7 @@ function loadFarmWorkflowsDevRuntime() {
   return import("./workflows.mjs");
 }
 function loadFarmDevtoolsSnapshotRuntime() {
-  return import("./devtools-BU5IT2PD.mjs");
+  return import("./devtools-UQLDAOEI.mjs");
 }
 function loadFarmDevtoolsUIRuntime() {
   return import("./devtools-ui-CYBVFLPH.mjs");