@farm.js/islx 0.0.0-stage → 0.0.1

package/dist/server.d.mts

@@ -0,0 +1,200 @@
+import { r as EncodeOptions, t as DecodeOptions } from "./_chunks/codec-CK8kZp4u.mjs";
+import { i as handleAction, n as HandleActionOptions, r as ReactFormState, t as ActionErrorOutcome } from "./_chunks/handle-C0N9ZyNV.mjs";
+import { a as setServerHooks, i as getServerHooks, n as ServerHooks, r as defineServerHooks, t as ActionInfo } from "./_chunks/hooks-3VZV8f_d.mjs";
+
+// src/server/values.d.ts
+/** Shorter values stay inline: a reference and its script cost about 60 bytes. */
+declare const VALUE_MIN_LENGTH = 512;
+/** A 64-bit hash of a value's JSON, as 14 base-36 characters. Not cryptographic. */
+declare function hashValue(json: string): string;
+interface AddressedValue {
+  key: string;
+  json: string;
+  /** Keys of the values this value's JSON refers to. */
+  children: string[];
+}
+interface AddressedProps {
+  /** The props as JSON, with each large value replaced by a reference. */
+  json: string;
+  values: Map<string, AddressedValue>;
+  /** Keys the props refer to directly. */
+  roots: string[];
+}
+interface AddressOptions {
+  /** Values whose JSON is shorter stay inline. */
+  minLength?: number;
+  /**
+   * Encodes what plain JSON cannot hold: a function (an action), an element (a slot). Return
+   * undefined to fall back to the codec, which throws for functions.
+   */
+  encodeSpecial?: (value: unknown) => unknown;
+  /**
+   * The input is JSON already, with its own tags (a server tree's payload): no type is tagged and
+   * no object is wrapped, values are only addressed.
+   */
+  encoded?: boolean;
+}
+/**
+ * Serializes props with every value whose JSON reaches `minLength` replaced by a reference to it.
+ * Types JSON cannot hold are tagged first (the codec), so a `Map` or a `Date` is addressed like
+ * any other value. Inner values are addressed first, so a large value that differs between pages
+ * in one place still shares its unchanged parts.
+ */
+declare function addressValues(props: Record<string, unknown>, {
+  minLength,
+  encodeSpecial,
+  encoded
+}?: AddressOptions): AddressedProps;
+/**
+ * The values a response sends for `addressed`, parents first. A value the browser holds is left
+ * out with everything inside it: the browser kept those when it read the value.
+ */
+declare function selectValuesToSend(addressed: AddressedProps, held: ReadonlySet<string> | null): AddressedValue[];
+/**
+ * The value keys a request names (`F-Values`): well-formed keys only, at most `MAX_HELD_VALUES`.
+ *
+ * A response that leaves values out is one browser's. Integrations must keep it out of shared
+ * caches (CDN, ISR, PPR shells), and add `Vary: F-Values` to cacheable responses.
+ */
+declare function parseHeldValues(input: Request | Headers | string | null | undefined): ReadonlySet<string>;
+/** A value script's JSON, safe inside a `<script>` element. */
+declare function escapeScriptJson(json: string): string;
+/** Thrown when a sealed value does not open: changed, made for another action, or stale. */
+declare class SealError extends Error {
+  /**
+   * `stale`: sealed with a key this server does not have, as after a deploy that changed keys.
+   * The page should reload. `invalid`: anything else; answer 400.
+   */
+  readonly reason: "stale" | "invalid";
+  constructor(reason: "stale" | "invalid", message: string);
+}
+interface ActionKeys {
+  /** The key new values are sealed with. */
+  current: CryptoKey;
+  /** Its id, written into each sealed value (0-255). */
+  currentId: number;
+  /**
+   * Every key that opens a value, by id: the current one and earlier ones still accepted. Ids are
+   * one byte, so two keys can share one; each is tried.
+   */
+  byId: ReadonlyMap<number, readonly CryptoKey[]>;
+}
+/** A new random key, as base64url: what `FURROW_ACTIONS_KEY` holds. */
+declare function generateActionKey(): string;
+/**
+ * The keys values are sealed and opened with. `current` seals; `previous` keys still open
+ * values, so pages rendered before a key rotation keep working until they are reloaded.
+ *
+ * Every server that may receive an action must have the same keys. When an app runs more than
+ * one instance, or builds and serves on different machines, set them from the environment.
+ */
+declare function createActionKeys(current: string, previous?: readonly string[]): Promise<ActionKeys>;
+interface SealOptions extends Pick<EncodeOptions, "encodeFunction"> {
+  /**
+   * The captured variables' names, in order, for error messages: "`db` cannot be captured by the
+   * server action rename (src/page.tsx): class instances (Pool) are not serializable".
+   */
+  names?: readonly string[];
+  /** Names the action in error messages. */
+  label?: string;
+}
+/** Seals an action's captured values for the browser to carry. */
+declare function sealBound(keys: ActionKeys, actionId: string, values: readonly unknown[], options?: SealOptions): Promise<string>;
+/**
+ * Opens values sealed for `actionId`. Throws a `SealError`: `stale` when no key this server has
+ * sealed them, `invalid` when they were changed or sealed for another action.
+ */
+declare function unsealBound(keys: ActionKeys, actionId: string, sealed: string, options?: Pick<DecodeOptions, "decodeReference">): Promise<unknown[]>;
+type AnyFunction = (...args: any[]) => any;
+/**
+ * Sets the keys bound values are sealed with: `key` seals, `previousKeys` still open values
+ * sealed before a rotation. Without it, `ISLX_ACTIONS_KEY` and `ISLX_ACTIONS_PREVIOUS_KEYS`
+ * (comma-separated) are read from the environment; failing those, the key the bundler plugin
+ * made for this build; failing that, a key generated for this process: fine for one long-lived
+ * server, wrong for several instances or serverless, where every server must hold the same key.
+ */
+declare function configureActionKeys(options: {
+  key: string;
+  previousKeys?: readonly string[];
+}): void;
+/**
+ * Registers an export of a `"use server"` module. The export itself stays the function it was;
+ * it gains the hooks forms need and an id props can name.
+ */
+declare function registerServerReference<T>(action: T, id: string, label?: string): T;
+/**
+ * Registers an inline action the compiler hoisted to module scope. It takes the `captured`
+ * variables it read as one array, then its own arguments.
+ */
+declare function registerInlineAction(hoisted: AnyFunction, id: string, captured: number, label?: string): void;
+/**
+ * The function an inline action stands for where it was written: calling it runs the hoisted
+ * action with the captured variables, and passing it to a form or a client component sends them
+ * sealed. `capture` is read when first needed, after the component has assigned them.
+ */
+declare function bindInlineAction(id: string, capture: () => unknown[], names: readonly string[]): AnyFunction;
+/** What a reference travels as: `{"$":"a","v":id}` plus `"b"` when it has sealed values. */
+interface ActionReference {
+  id: string;
+  /** The sealed values, or undefined. Throws a pending promise while they are sealing. */
+  sealed(): string | undefined;
+  /** Resolves once the sealed values are ready. */
+  ready(): Promise<void>;
+}
+/** The reference a function stands for, if it is a server action. */
+declare function getActionReference(value: unknown): ActionReference | undefined;
+/** Encodes a server action for JSON (`encode`'s `encodeFunction`), or undefined for any other function. */
+declare function encodeActionReference(value: Function): Record<string, unknown> | undefined;
+/**
+ * Decodes an action reference the browser sent back (an argument): an id this server registered,
+ * whose sealed values open when it runs. Unknown ids are refused.
+ */
+declare function decodeActionReference(object: Record<string, unknown>): AnyFunction | undefined;
+/** The outcome of resolving a posted action. */
+type ResolvedAction = {
+  ok: true;
+  run(args: unknown[]): Promise<unknown>;
+  boundCount: number;
+  label: string;
+} | {
+  ok: false;
+  reason: "unknown" | "stale" | "invalid";
+};
+/** Finds the action an id names, and opens its sealed values. */
+declare function resolveAction(id: string, token: string | undefined): Promise<ResolvedAction>;
+/**
+ * Whether a state-changing request came from the app's own origin. Server actions run only for
+ * same-origin requests, or requests from an origin the app allows.
+ */
+/**
+ * Whether `origin` matches an allowed pattern: an origin (`https://app.example.com`), a host
+ * (`app.example.com`), or a subdomain wildcard (`*.example.com`, `https://*.example.com:8443`).
+ */
+declare function matchesAllowedOrigin(origin: string, pattern: string): boolean;
+/** Validates and canonicalizes an allowed-origin pattern; throws for anything else. */
+declare function normalizeAllowedOrigin(value: string): string;
+/**
+ * Whether the request may run a server action: it names its origin (or `Sec-Fetch-Site:
+ * same-origin`), and that origin is the request's own or an allowed one. Cross-site requests
+ * run only from an allowed origin.
+ */
+declare function isSameOriginRequest(request: Request, allowedOrigins: readonly string[]): boolean;
+/**
+ * What a bundler plugin knows about the build, for the server runtime: the browser entry that
+ * hydrates islands, and the key a build seals action values with when the environment sets none.
+ * Set from the plugin's runtime module, which every module with islands or actions imports.
+ */
+interface BuildDefaults {
+  /** The URL of the browser entry `renderToStream` adds to pages. */
+  entry?: string;
+  /** A key made for this build: every instance of one build shares it. */
+  key?: string;
+  /**
+   * The browser files each client module needs (its chunk first, then the chunks it imports), by
+   * the module's path from the root: an island preloads them, so they load alongside the entry.
+   */
+  modules?: Record<string, string[]>;
+}
+declare function setBuildDefaults(defaults: BuildDefaults): void;
+declare function getBuildDefaults(): BuildDefaults;
+export { type ActionErrorOutcome, type ActionInfo, type ActionKeys, type ActionReference, type AddressOptions, type AddressedProps, type AddressedValue, type BuildDefaults, type HandleActionOptions, type ReactFormState, type ResolvedAction, SealError, type SealOptions, type ServerHooks, VALUE_MIN_LENGTH, addressValues, bindInlineAction, configureActionKeys, createActionKeys, decodeActionReference, defineServerHooks, encodeActionReference, escapeScriptJson, generateActionKey, getActionReference, getBuildDefaults, getServerHooks, handleAction, hashValue, isSameOriginRequest, matchesAllowedOrigin, normalizeAllowedOrigin, parseHeldValues, registerInlineAction, registerServerReference, resolveAction, sealBound, selectValuesToSend, setBuildDefaults, setServerHooks, unsealBound };

package/dist/server.mjs

@@ -0,0 +1,378 @@
+import { _ as hashValue, a as getActionReference, c as resolveAction, d as generateActionKey, f as sealBound, g as escapeScriptJson, h as addressValues, i as encodeActionReference, l as SealError, m as VALUE_MIN_LENGTH, n as configureActionKeys, o as registerInlineAction, p as unsealBound, r as decodeActionReference, s as registerServerReference, t as bindInlineAction, u as createActionKeys, v as parseHeldValues, y as selectValuesToSend } from "./_chunks/actions-C4dZ1-XD.mjs";
+import { a as encode, r as decode } from "./_chunks/codec-BTDkzzPP.mjs";
+import { F as stripRuntimeFields, P as readPostedAction, j as attachmentField, n as ACTION_KEY_FIELD, o as BOUND_FIELD, r as ACTION_STALE_HEADER, s as CALL_FIELD, t as ACTION_HEADER } from "./_chunks/wire-CXOodE06.mjs";
+import { n as setBuildDefaults, t as getBuildDefaults } from "./_chunks/build-COIcs7wm.mjs";
+// src/server/hooks.ts
+const HOOKS_KEY = Symbol.for("islx.server.hooks");
+/** Types an app's server hooks. */
+function defineServerHooks(hooks) {
+	return hooks;
+}
+/** Installs the app's hooks; the plugin's server runtime calls it. */
+function setServerHooks(hooks) {
+	globalThis[HOOKS_KEY] = hooks;
+}
+function getServerHooks() {
+	return globalThis[HOOKS_KEY] ?? {};
+}
+/** Splits a registry label, `save (src/actions.ts)`, into name and module. */
+function describeAction(id, label) {
+	const match = /^(.*) \((.*)\)$/.exec(label ?? "");
+	return match ? {
+		id,
+		name: match[1],
+		module: match[2]
+	} : {
+		id,
+		name: label ?? id,
+		module: ""
+	};
+}
+// src/server/body.ts
+/** Reading a request body within a size limit. */
+/** The body was larger than the limit. */
+var BodyTooLargeError = class extends Error {
+	/** The bytes read before the limit was passed, for callers that peek at the start. */
+	head;
+	constructor(head) {
+		super("request body is too large");
+		this.name = "BodyTooLargeError";
+		this.head = head;
+	}
+};
+function concat(chunks, total) {
+	const body = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		body.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return body;
+}
+/**
+* Reads `request`'s body, stopping as soon as it passes `limit` bytes: a lying or missing
+* `Content-Length` cannot make the server buffer more.
+*/
+async function readBody(request, limit) {
+	const length = request.headers.get("content-length")?.trim();
+	if (length && /^\d+$/.test(length) && Number(length) > limit) throw new BodyTooLargeError(/* @__PURE__ */ new Uint8Array());
+	if (!request.body) return /* @__PURE__ */ new Uint8Array();
+	const reader = request.body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value) continue;
+			chunks.push(value);
+			total += value.byteLength;
+			if (total > limit) {
+				reader.cancel().catch(() => {});
+				throw new BodyTooLargeError(concat(chunks, total));
+			}
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	return concat(chunks, total);
+}
+/** Parses form bytes with the request's content type, as `Request#formData` would. */
+async function parseForm(request, body) {
+	return new Request(request.url, {
+		method: "POST",
+		headers: { "content-type": request.headers.get("content-type") ?? "" },
+		body
+	}).formData();
+}
+// src/server/origin.ts
+/**
+* Whether a state-changing request came from the app's own origin. Server actions run only for
+* same-origin requests, or requests from an origin the app allows.
+*/
+/** The origin a request claims to come from (Origin, then Referer), or why it has none. */
+function sourceOrigin(request) {
+	const value = request.headers.get("origin")?.trim() || request.headers.get("referer")?.trim() || null;
+	if (!value) return { origin: null };
+	if (value === "null") return { invalid: true };
+	try {
+		const parsed = new URL(value);
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return { invalid: true };
+		return { origin: parsed.origin };
+	} catch {
+		return { invalid: true };
+	}
+}
+/**
+* The source matches the `Host` header and the request URL's scheme. The scheme check blocks a
+* protocol-downgrade request; behind a TLS-terminating proxy that rebuilds `request.url` as
+* `http:`, list the browser origin in `allowedOrigins`.
+*/
+function matchesHost(origin, request) {
+	const host = request.headers.get("host")?.trim().toLowerCase();
+	if (!host) return false;
+	try {
+		const source = new URL(origin);
+		return source.protocol === new URL(request.url).protocol && source.host.toLowerCase() === host;
+	} catch {
+		return false;
+	}
+}
+function effectivePort(url) {
+	if (url.port) return url.port;
+	return url.protocol === "https:" ? "443" : url.protocol === "http:" ? "80" : "";
+}
+/**
+* Whether `origin` matches an allowed pattern: an origin (`https://app.example.com`), a host
+* (`app.example.com`), or a subdomain wildcard (`*.example.com`, `https://*.example.com:8443`).
+*/
+function matchesAllowedOrigin(origin, pattern) {
+	const source = new URL(origin);
+	if (!pattern.includes("*")) return pattern.includes("://") ? source.origin === pattern : source.host === pattern;
+	const schemeEnd = pattern.indexOf("://");
+	const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);
+	const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);
+	const separator = hostPattern.lastIndexOf(":");
+	const [wildcardHost, port] = separator === -1 ? [hostPattern, null] : [hostPattern.slice(0, separator), hostPattern.slice(separator + 1)];
+	const baseHost = wildcardHost.slice(2);
+	if (scheme && source.protocol !== scheme) return false;
+	if (port ? effectivePort(source) !== port : source.port) return false;
+	return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;
+}
+/** Validates and canonicalizes an allowed-origin pattern; throws for anything else. */
+function normalizeAllowedOrigin(value) {
+	const pattern = value.trim().toLowerCase();
+	if (!pattern) throw new TypeError("allowedOrigins cannot contain empty values");
+	if (pattern.includes("*")) {
+		if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) throw new TypeError(`Invalid allowedOrigins pattern: ${JSON.stringify(value)}`);
+		return pattern;
+	}
+	if (pattern.includes("://")) {
+		let parsed;
+		try {
+			parsed = new URL(pattern);
+		} catch {
+			throw new TypeError(`Invalid allowedOrigins value: ${JSON.stringify(value)}`);
+		}
+		if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) throw new TypeError(`allowedOrigins must hold origins without paths: ${JSON.stringify(value)}`);
+		return parsed.origin;
+	}
+	if (/[/@?#]/.test(pattern)) throw new TypeError(`allowedOrigins must hold origins or hosts: ${JSON.stringify(value)}`);
+	try {
+		return new URL(`http://${pattern}`).host;
+	} catch {
+		throw new TypeError(`Invalid allowedOrigins value: ${JSON.stringify(value)}`);
+	}
+}
+/**
+* Whether the request may run a server action: it names its origin (or `Sec-Fetch-Site:
+* same-origin`), and that origin is the request's own or an allowed one. Cross-site requests
+* run only from an allowed origin.
+*/
+function isSameOriginRequest(request, allowedOrigins) {
+	const source = sourceOrigin(request);
+	if ("invalid" in source) return false;
+	const fetchSite = request.headers.get("sec-fetch-site")?.trim().toLowerCase();
+	if (!source.origin) return fetchSite === "same-origin";
+	const origin = source.origin;
+	const allowed = allowedOrigins.some((pattern) => matchesAllowedOrigin(origin, pattern));
+	if (!allowed && origin !== new URL(request.url).origin && !matchesHost(origin, request)) return false;
+	return fetchSite !== "cross-site" || allowed;
+}
+// src/server/handle.ts
+/**
+* Handling a posted server action: one function on a Web `Request`, so any server mounts it.
+* It returns `null` for a request that is not an action, which the app then handles as usual.
+*
+* Calls from JavaScript (`F-Action` header) answer JSON. Forms posted without JavaScript run the
+* action and answer `303 See Other` back to the page, or render the page with a
+* `useActionState` result when the app gives `renderFormState`.
+*/
+const DEFAULT_BODY_SIZE_LIMIT = 1e6;
+const ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{1,1000000}$/;
+function text(status, body, headers = {}) {
+	return new Response(body, {
+		status,
+		headers: {
+			"cache-control": "no-store",
+			"content-type": "text/plain; charset=utf-8",
+			"x-content-type-options": "nosniff",
+			...headers
+		}
+	});
+}
+function json(body, headers = {}) {
+	return new Response(JSON.stringify(body), {
+		status: 200,
+		headers: {
+			"cache-control": "no-store",
+			"content-type": "application/json",
+			...headers
+		}
+	});
+}
+function seeOther(location) {
+	return new Response(null, {
+		status: 303,
+		headers: {
+			"cache-control": "no-store",
+			location
+		}
+	});
+}
+const STALE = { [ACTION_STALE_HEADER]: "1" };
+/** A reference from the browser: only actions, and only ids this server registered. */
+function decodeArgumentReference(object) {
+	if (object["$"] === "r" || object["$"] === "s") return void 0;
+	return decodeActionReference(object);
+}
+function looksLikeActionForm(head) {
+	const start = new TextDecoder().decode(head);
+	return start.includes("$F_REF_") || start.includes(`%24F_REF_`);
+}
+/** Runs the server action a request posts, or returns null when it posts none. */
+async function handleAction(request, options = {}) {
+	if (request.method.toUpperCase() !== "POST") return null;
+	const allowedOrigins = (options.allowedOrigins ?? []).map(normalizeAllowedOrigin);
+	const limit = options.bodySizeLimit ?? DEFAULT_BODY_SIZE_LIMIT;
+	const run = options.run ?? ((_request, action) => action());
+	const hooks = getServerHooks();
+	/** Runs a resolved action through the app's hooks; maps what it throws. */
+	const execute = async (resolved, id, args) => {
+		const info = {
+			request,
+			...describeAction(id, resolved.label)
+		};
+		const invoke = () => resolved.run(args);
+		try {
+			return { result: await run(request, hooks.action ? () => hooks.action(info, invoke) : invoke) };
+		} catch (error) {
+			const outcome = options.mapError?.(error) ?? hooks.actionError?.(error, info);
+			if (!outcome?.redirect && !outcome?.status) {
+				if (options.onError) options.onError(error);
+				else if (hooks.error) hooks.error(error, info);
+				else console.error("[islx] Server action failed:", error);
+			}
+			return {
+				error,
+				outcome
+			};
+		}
+	};
+	const id = request.headers.get(ACTION_HEADER);
+	const contentType = (request.headers.get("content-type") ?? "").toLowerCase();
+	if (id !== null) {
+		if (!isSameOriginRequest(request, allowedOrigins)) return text(403, "Forbidden");
+		if (!ID_PATTERN.test(id)) return text(400, "Bad Request");
+		let body;
+		try {
+			body = await readBody(request, limit);
+		} catch (error) {
+			if (error instanceof BodyTooLargeError) return text(413, "Payload Too Large");
+			throw error;
+		}
+		let args;
+		let token;
+		try {
+			const form = contentType.startsWith("multipart/form-data") ? await parseForm(request, body) : null;
+			const call = form?.get(CALL_FIELD);
+			if (form && typeof call !== "string") {
+				const bound = form.get(BOUND_FIELD);
+				token = typeof bound === "string" ? bound : void 0;
+				form.delete(BOUND_FIELD);
+				args = [form];
+			} else if (form) {
+				const payload = JSON.parse(call);
+				if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new TypeError();
+				const decodeReference = (object) => {
+					const index = object["v"];
+					if (typeof index !== "number" || !Number.isInteger(index) || index < 0) return void 0;
+					if (object["$"] === "K") {
+						const file = form.get(attachmentField(index));
+						return typeof file === "string" || file === null ? void 0 : file;
+					}
+					if (object["$"] === "F") {
+						const prefix = attachmentField(index, "");
+						const data = new FormData();
+						for (const [key, value] of form) if (key.startsWith(prefix)) data.append(key.slice(prefix.length), value);
+						return data;
+					}
+					return decodeArgumentReference(object);
+				};
+				const decoded = decode(payload.a ?? [], { decodeReference });
+				if (!Array.isArray(decoded)) throw new TypeError("arguments must be an array");
+				if (payload.b !== void 0 && typeof payload.b !== "string") throw new TypeError();
+				args = decoded;
+				token = payload.b;
+			} else {
+				const payload = JSON.parse(new TextDecoder().decode(body) || "{}");
+				if (!payload || typeof payload !== "object" || Array.isArray(payload)) throw new TypeError();
+				const decoded = decode(payload.a ?? [], { decodeReference: decodeArgumentReference });
+				if (!Array.isArray(decoded)) throw new TypeError("arguments must be an array");
+				if (payload.b !== void 0 && typeof payload.b !== "string") throw new TypeError();
+				args = decoded;
+				token = payload.b;
+			}
+			if (token !== void 0 && !TOKEN_PATTERN.test(token)) throw new TypeError();
+		} catch {
+			return text(400, "Bad Request");
+		}
+		const resolved = await resolveAction(id, token);
+		if (!resolved.ok) return resolved.reason === "invalid" ? text(400, "Bad Request") : text(resolved.reason === "unknown" ? 404 : 409, "Stale Action", STALE);
+		const ran = await execute(resolved, id, args);
+		if ("error" in ran) {
+			if (ran.outcome?.redirect) return json({ redirect: ran.outcome.redirect });
+			if (ran.outcome?.status) return text(ran.outcome.status, "Server action failed");
+			return text(500, "Server action failed");
+		}
+		try {
+			return json({ result: encode(ran.result, { encodeFunction: encodeActionReference }) });
+		} catch (error) {
+			(options.onError ?? ((reason) => console.error("[islx] Server action failed:", reason)))(/* @__PURE__ */ new TypeError(`the server action's result is not serializable: ${error.message}`));
+			return text(500, "Server action failed");
+		}
+	}
+	if (!contentType.startsWith("multipart/form-data") && !contentType.startsWith("application/x-www-form-urlencoded")) return null;
+	let body;
+	try {
+		body = await readBody(request.clone(), limit);
+	} catch (error) {
+		if (error instanceof BodyTooLargeError) return looksLikeActionForm(error.head) ? text(413, "Payload Too Large") : null;
+		throw error;
+	}
+	let form;
+	try {
+		form = await parseForm(request, body);
+	} catch {
+		return null;
+	}
+	const posted = readPostedAction(form);
+	if (!posted) return null;
+	if (!isSameOriginRequest(request, allowedOrigins)) return text(403, "Forbidden");
+	if (!ID_PATTERN.test(posted.id) || posted.token !== void 0 && !TOKEN_PATTERN.test(posted.token)) return text(400, "Bad Request");
+	const actionKey = form.get(ACTION_KEY_FIELD);
+	stripRuntimeFields(form);
+	const page = new URL(request.url);
+	const back = page.pathname + page.search;
+	const resolved = await resolveAction(posted.id, posted.token);
+	if (!resolved.ok) return resolved.reason === "invalid" ? text(400, "Bad Request") : seeOther(back);
+	const ran = await execute(resolved, posted.id, [form]);
+	if ("error" in ran) {
+		if (ran.outcome?.redirect) return seeOther(ran.outcome.redirect);
+		if (ran.outcome?.status) return text(ran.outcome.status, "Server action failed");
+		return text(500, "Server action failed");
+	}
+	const result = ran.result;
+	if (typeof actionKey === "string" && options.renderFormState) {
+		const boundCount = Math.max(resolved.boundCount - 1, 0);
+		return options.renderFormState([
+			result,
+			actionKey,
+			posted.id,
+			boundCount
+		], request);
+	}
+	return seeOther(back);
+}
+export { SealError, VALUE_MIN_LENGTH, addressValues, bindInlineAction, configureActionKeys, createActionKeys, decodeActionReference, defineServerHooks, encodeActionReference, escapeScriptJson, generateActionKey, getActionReference, getBuildDefaults, getServerHooks, handleAction, hashValue, isSameOriginRequest, matchesAllowedOrigin, normalizeAllowedOrigin, parseHeldValues, registerInlineAction, registerServerReference, resolveAction, sealBound, selectValuesToSend, setBuildDefaults, setServerHooks, unsealBound };

package/dist/vite.d.mts

@@ -0,0 +1,57 @@
+import { r as ClientHooks } from "./_chunks/hooks-De0gNpOn.mjs";
+import { n as AstNode } from "./_chunks/actions-BCtIGvrP.mjs";
+import { n as ServerHooks } from "./_chunks/hooks-3VZV8f_d.mjs";
+import { Plugin } from "vite";
+
+// src/vite.d.ts
+interface IslxOptions {
+  clientComponents?: {
+    /**
+     * Client modules to build for the browser even when no page the server build saw imports
+     * them, as components chosen by name at runtime. Globs, from the root.
+     */
+    include?: string[];
+    /** Files never treated as client components, even with `"use client"`. Globs, from the root. */
+    exclude?: string[];
+  };
+  /** The environments that render on the server. Default: every environment but `client`. */
+  serverEnvironments?: string[];
+  /**
+   * The directives your code marks client modules and actions with. Default `"use client"` and
+   * `"use server"`; set others when another tool in the app already owns those. Libraries in
+   * `node_modules` always use `"use client"` (and their actions are never registered).
+   */
+  directives?: {
+    client?: string;
+    server?: string;
+  };
+  /**
+   * Same-site links move between pages without loading a new document: the runtime, its code
+   * and the values the browser holds stay. Default true; false loads every page.
+   */
+  navigation?: boolean | {
+    viewTransition?: boolean;
+  };
+  /**
+   * Lifecycle hooks: callbacks, or the path of a module that exports them (`defineClientHooks`,
+   * `defineServerHooks`). Callbacks are copied into the browser or server build as source, so
+   * they may use only their arguments and globals (`window`, `fetch`, `console`, …); hooks that
+   * import app code go in a module.
+   */
+  hooks?: {
+    client?: string | ClientHooks;
+    server?: string | ServerHooks;
+  };
+}
+/**
+ * The source of a hooks module made from callbacks. Each callback is copied as written, so it
+ * must not use anything from where it was written: an outside variable, an import.
+ */
+declare function serializeHooks(hooks: Record<string, unknown>, where: "client" | "server", parse: (file: string, code: string) => AstNode): string;
+/** The directives to use, refusing ones that would make a file mean two things. */
+declare function resolveDirectives(directives?: IslxOptions["directives"]): {
+  client: string;
+  server: string;
+};
+declare function islx(options?: IslxOptions): Plugin[];
+export { IslxOptions, islx as default, islx, resolveDirectives, serializeHooks };