@farm.js/plugin 0.1.0-beta.1 → 0.1.0-beta.100

package/dist/api/index.d.ts

@@ -27,6 +27,8 @@ export interface FarmApiOptions {
     srcDir?: string;
     /** Enable debug logging */
     debug?: boolean;
+    /** Maximum request body size, for example `"10mb"`. */
+    bodySizeLimit?: number | string;
 }
 export interface ApiRoute {
     path: string;

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAC;AAGlD,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,UAAU,OAAO,CAAC,OAAO,GAAE,cAAmB,GAAG,MAAM,CAgmBpE;AAED,OAAO,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,MAAM,CAAC;AAWlD,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,CAAC,OAAO,UAAU,OAAO,CAAC,OAAO,GAAE,cAAmB,GAAG,MAAM,CAmhBpE;AAED,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/api/index.js

@@ -22,12 +22,18 @@
  * ```
  */
 import { _withAfterNodeMiddleware } from "@farm.js/core/after";
+import { _runWithAPIRequestRuntime, createFarmRequestBodyErrorResponse, readNodeRequestBody, resolveFarmServerConfig, } from "@farm.js/core/internal/production-runtime";
+import { invokeAPIRouteEndpoint } from "@farm.js/core/api/runtime";
+import { sendWebResponse } from "@farm.js/core/server";
 /**
  * Farm.js API Routes Plugin
  */
 export default function farmApi(options = {}) {
     const srcDir = options.srcDir ?? "src";
     const debug = options.debug ?? false;
+    const bodySizeLimit = resolveFarmServerConfig({
+        bodySizeLimit: options.bodySizeLimit,
+    }).bodySizeLimit;
     // API routes cache
     let apiRoutesCache = new Map();
     let apiRouterHandler = null;
@@ -98,82 +104,7 @@ export default function farmApi(options = {}) {
                     });
                 }
                 try {
-                    // Parse query params
-                    const queryObj = {};
-                    url.searchParams.forEach((value, key) => {
-                        queryObj[key] = value;
-                    });
-                    // Parse body for non-GET requests
-                    let bodyObj = {};
-                    if (method !== "GET" && method !== "HEAD") {
-                        try {
-                            const bodyText = await request.text();
-                            if (bodyText) {
-                                bodyObj = JSON.parse(bodyText);
-                            }
-                        }
-                        catch {
-                            // Body parsing failed, use empty object
-                        }
-                    }
-                    // Parse headers
-                    const headersObj = {};
-                    request.headers.forEach((value, key) => {
-                        headersObj[key] = value;
-                    });
-                    // Validate with Zod if schemas are defined
-                    const types = endpoint.__types || {};
-                    let validatedQuery = queryObj;
-                    let validatedBody = bodyObj;
-                    if (types.query && typeof types.query.parse === "function") {
-                        try {
-                            validatedQuery = types.query.parse(queryObj);
-                        }
-                        catch (e) {
-                            return new Response(JSON.stringify({
-                                error: "Invalid query parameters",
-                                details: e.errors || e.message,
-                            }), {
-                                status: 400,
-                                headers: { "Content-Type": "application/json" },
-                            });
-                        }
-                    }
-                    if (types.body && typeof types.body.parse === "function") {
-                        try {
-                            validatedBody = types.body.parse(bodyObj);
-                        }
-                        catch (e) {
-                            return new Response(JSON.stringify({
-                                error: "Invalid request body",
-                                details: e.errors || e.message,
-                            }), {
-                                status: 400,
-                                headers: { "Content-Type": "application/json" },
-                            });
-                        }
-                    }
-                    // Build context object
-                    const ctx = {
-                        query: validatedQuery,
-                        body: validatedBody,
-                        headers: headersObj,
-                        request,
-                        context: {},
-                        params: {},
-                    };
-                    // Call the handler (use __handler if available, otherwise the endpoint itself)
-                    const handlerFn = endpoint.__handler || endpoint;
-                    const result = await handlerFn(ctx);
-                    // If result is already a Response, return it
-                    if (result instanceof Response) {
-                        return result;
-                    }
-                    // Otherwise, serialize to JSON
-                    return new Response(JSON.stringify(result), {
-                        status: 200,
-                        headers: { "Content-Type": "application/json" },
-                    });
+                    return await invokeAPIRouteEndpoint(endpoint, request);
                 }
                 catch (error) {
                     return new Response(JSON.stringify({ error: error.message || "Internal Server Error" }), {
@@ -354,7 +285,7 @@ export default function farmApi(options = {}) {
             };
             // Add middleware to handle API requests
             return () => {
-                server.middlewares.use(_withAfterNodeMiddleware(async (req, res, next) => {
+                const apiMiddleware = _withAfterNodeMiddleware(async (req, res, next) => {
                     const url = req.url || "/";
                     const pathname = url.split("?")[0];
                     const method = req.method || "GET";
@@ -394,33 +325,26 @@ export default function farmApi(options = {}) {
                         // Get body for non-GET requests
                         let body;
                         if (method !== "GET" && method !== "HEAD") {
-                            body = await new Promise((resolve) => {
-                                let data = "";
-                                req.on("data", (chunk) => {
-                                    data += chunk;
-                                });
-                                req.on("end", () => {
-                                    resolve(data);
-                                });
-                            });
+                            body = await readNodeRequestBody(req, bodySizeLimit);
                         }
                         const request = new Request(fullUrl, {
                             method,
                             headers,
-                            body: body || undefined,
+                            body: body
+                                ? body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength)
+                                : undefined,
                         });
                         const response = await apiRouterHandler(request);
                         const duration = Date.now() - startTime;
                         logResponse(method, pathname, response.status, duration);
-                        // Send response
-                        res.statusCode = response.status;
-                        response.headers.forEach((value, key) => {
-                            res.setHeader(key, value);
-                        });
-                        const responseBody = await response.text();
-                        res.end(responseBody);
+                        await sendWebResponse(res, response);
                     }
                     catch (error) {
+                        const bodyErrorResponse = createFarmRequestBodyErrorResponse(error);
+                        if (bodyErrorResponse) {
+                            await sendWebResponse(res, bodyErrorResponse);
+                            return;
+                        }
                         const duration = Date.now() - startTime;
                         logResponse(method, pathname, 500, duration);
                         console.error("[FARM] API error:", error);
@@ -428,7 +352,13 @@ export default function farmApi(options = {}) {
                         res.setHeader("Content-Type", "application/json");
                         res.end(JSON.stringify({ error: "Internal server error" }));
                     }
-                }));
+                });
+                server.middlewares.use((req, res, next) => _runWithAPIRequestRuntime({
+                    basePath: "/api",
+                    dispatch: async (request) => apiRouterHandler
+                        ? apiRouterHandler(request)
+                        : Response.json({ error: "Not Found" }, { status: 404 }),
+                }, () => apiMiddleware(req, res, next)));
             };
         },
         async handleHotUpdate({ file, server, modules }) {

package/dist/dev-static.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Route segments may legitimately contain dots (e.g. /kinfish/farm.js), so a
+ * dot alone cannot classify a dev request as a static asset. A dotted path is
+ * only treated as an asset when it maps to a real file under the project root
+ * or public dir, matching the filesystem-first behavior of production hosting.
+ */
+export declare function devServableFileExists(pathname: string, baseDirs: Array<string | false | undefined>): boolean;
+//# sourceMappingURL=dev-static.d.ts.map

package/dist/dev-static.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-static.d.ts","sourceRoot":"","sources":["../src/dev-static.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC,GAC1C,OAAO,CAuBT"}

package/dist/dev-static.js

@@ -0,0 +1,37 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+/**
+ * Route segments may legitimately contain dots (e.g. /kinfish/farm.js), so a
+ * dot alone cannot classify a dev request as a static asset. A dotted path is
+ * only treated as an asset when it maps to a real file under the project root
+ * or public dir, matching the filesystem-first behavior of production hosting.
+ */
+export function devServableFileExists(pathname, baseDirs) {
+    let decodedPathname;
+    try {
+        decodedPathname = decodeURIComponent(pathname);
+    }
+    catch {
+        return false;
+    }
+    const relativePathname = decodedPathname.replace(/^\/+/, "");
+    if (!relativePathname)
+        return false;
+    for (const baseDir of baseDirs) {
+        if (typeof baseDir !== "string" || baseDir.length === 0)
+            continue;
+        const resolvedBase = path.resolve(baseDir);
+        const candidate = path.resolve(resolvedBase, relativePathname);
+        if (!candidate.startsWith(resolvedBase + path.sep))
+            continue;
+        try {
+            if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) {
+                return true;
+            }
+        }
+        catch {
+            // Ignore filesystem errors and keep checking other base dirs.
+        }
+    }
+    return false;
+}

package/dist/index.d.ts

@@ -39,5 +39,5 @@
  * })
  * ```
  */
-export declare const version = "0.1.0-beta.1";
+export declare const version = "0.1.0-beta.100";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,eAAO,MAAM,OAAO,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,eAAO,MAAM,OAAO,mBAAmB,CAAC"}

package/dist/index.js

@@ -39,7 +39,7 @@
  * })
  * ```
  */
-export const version = "0.1.0-beta.1";
+export const version = "0.1.0-beta.100";
 // Note: Import plugins from their respective subpaths:
 // - @farm.js/plugin/rsc
 // - @farm.js/plugin/middleware

package/dist/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AA+B5D,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAChE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAEhC,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,GAAG,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,eAAe,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IAGf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IAGd,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;IAGF,IAAI,EAAE;QACJ,KAAK,EAAE,OAAO,CAAC;QACf,GAAG,EAAE,OAAO,CAAC;QACb,MAAM,CAAC,EAAE,aAAa,CAAC;KACxB,CAAC;IAGF,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAGvB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,EAAE,SAAS,CAAC;IAGnB,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAGrB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE1B,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EACF,iBAAiB,GACjB;QAAE,KAAK,EAAE,MAAM;YAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAA;SAAE,CAAC;QAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IAC7F,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CACjC;AA8MD;;GAEG;AACH,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,OAAO,GAAE,qBAA0B,GAAG,MAAM,CAsSlF;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAiC5D,MAAM,WAAW,qBAAqB;IACpC,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACtC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAChE,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAEhC,OAAO,EAAE,eAAe,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,GAAG,EAAE,GAAG,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,eAAe,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IAGf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC;IAGd,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACjC,CAAC;IAGF,IAAI,EAAE;QACJ,KAAK,EAAE,OAAO,CAAC;QACf,GAAG,EAAE,OAAO,CAAC;QACb,MAAM,CAAC,EAAE,aAAa,CAAC;KACxB,CAAC;IAGF,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAGvB,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,EAAE,SAAS,CAAC;IAGnB,QAAQ,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IAGrB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9C;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE1B,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EACF,iBAAiB,GACjB;QAAE,KAAK,EAAE,MAAM;YAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAA;SAAE,CAAC;QAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IAC7F,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CACjC;AAuKD;;GAEG;AACH,MAAM,CAAC,OAAO,UAAU,cAAc,CAAC,OAAO,GAAE,qBAA0B,GAAG,MAAM,CAySlF;AAED,OAAO,EAAE,cAAc,EAAE,CAAC"}

package/dist/middleware/index.js

@@ -15,6 +15,8 @@
  */
 import { createRequire } from "node:module";
 import { _withAfterNodeMiddleware } from "@farm.js/core/after";
+import { devServableFileExists } from "../dev-static.js";
+import { middlewareMatchesPath, parseCookies, serializeCookie } from "./matching.js";
 // Create require for ESM compatibility
 const require_ = createRequire(import.meta.url);
 // Get picocolors with forced color support (to handle NO_COLOR env being set)
@@ -42,52 +44,6 @@ const getColors = () => {
         magenta: id,
     };
 };
-/**
- * Parse cookies from Cookie header
- */
-function parseCookies(cookieHeader) {
-    if (!cookieHeader)
-        return {};
-    return cookieHeader.split(";").reduce((cookies, cookie) => {
-        const [name, ...rest] = cookie.split("=");
-        const value = rest.join("=").trim();
-        if (name && value) {
-            cookies[name.trim()] = decodeURIComponent(value);
-        }
-        return cookies;
-    }, {});
-}
-/**
- * Serialize a cookie
- */
-function serializeCookie(name, value, options = {}) {
-    let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
-    if (options.maxAge) {
-        cookie += `; Max-Age=${options.maxAge}`;
-    }
-    if (options.expires) {
-        cookie += `; Expires=${options.expires.toUTCString()}`;
-    }
-    if (options.path) {
-        cookie += `; Path=${options.path}`;
-    }
-    else {
-        cookie += "; Path=/";
-    }
-    if (options.domain) {
-        cookie += `; Domain=${options.domain}`;
-    }
-    if (options.secure) {
-        cookie += "; Secure";
-    }
-    if (options.httpOnly) {
-        cookie += "; HttpOnly";
-    }
-    if (options.sameSite) {
-        cookie += `; SameSite=${options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1)}`;
-    }
-    return cookie;
-}
 /**
  * Create a cookie jar for managing cookies
  */
@@ -127,6 +83,21 @@ function createContext(req, res, viteServer) {
     const data = new Map();
     const cookies = createCookieJar(req, res);
     let handled = false;
+    // Mirror @farm.js/core's createContext: a header set on ctx.headers in the
+    // same handler that then short-circuits via a helper must still reach the
+    // response. The runner's tail flush is unreachable once a helper sets
+    // _handled, so each helper applies ctx.headers to res before its writeHead.
+    const applyResponseHeaders = () => {
+        for (const [key, value] of headers) {
+            try {
+                res.setHeader(key, value);
+            }
+            catch {
+                // An invalid optional header must not prevent the response itself
+                // from completing.
+            }
+        }
+    };
     const ctx = {
         request: req,
         response: res,
@@ -153,6 +124,7 @@ function createContext(req, res, viteServer) {
             ctx._redirectUrl = redirectUrl;
             ctx._handled = true;
             handled = true;
+            applyResponseHeaders();
             res.writeHead(status, {
                 Location: redirectUrl,
                 "Content-Type": "text/plain",
@@ -176,6 +148,7 @@ function createContext(req, res, viteServer) {
             }
             ctx._handled = true;
             handled = true;
+            applyResponseHeaders();
             res.writeHead(status, {
                 "Content-Type": "application/json",
             });
@@ -188,6 +161,7 @@ function createContext(req, res, viteServer) {
             }
             ctx._handled = true;
             handled = true;
+            applyResponseHeaders();
             res.writeHead(status, {
                 "Content-Type": "text/plain",
             });
@@ -200,6 +174,7 @@ function createContext(req, res, viteServer) {
             }
             ctx._handled = true;
             handled = true;
+            applyResponseHeaders();
             res.writeHead(status, {
                 "Content-Type": "text/html",
             });
@@ -293,11 +268,7 @@ export default function farmMiddleware(options = {}) {
                 }
                 // Find applicable middleware (cascading from root to specific)
                 const applicable = Array.from(middlewareCache.values())
-                    .filter((mw) => {
-                    if (mw.path === "/")
-                        return true;
-                    return pathname.startsWith(mw.path) || pathname === mw.path;
-                })
+                    .filter((mw) => middlewareMatchesPath(pathname, mw.path))
                     .sort((a, b) => a.path.split("/").length - b.path.split("/").length);
                 if (applicable.length === 0)
                     return false;
@@ -384,11 +355,15 @@ export default function farmMiddleware(options = {}) {
                 server.middlewares.use(_withAfterNodeMiddleware(async (req, res, next) => {
                     const url = req.url || "/";
                     const pathname = url.split("?")[0];
-                    // Skip Vite internal requests
+                    // Skip Vite internal requests and real static assets. Dotted
+                    // paths that don't map to a file on disk are app routes (route
+                    // segments may contain dots) and must still run middleware.
                     if (pathname.startsWith("/@") ||
                         pathname.startsWith("/__") ||
                         pathname.startsWith("/node_modules") ||
-                        (pathname.includes(".") && !pathname.endsWith("/"))) {
+                        (pathname.includes(".") &&
+                            !pathname.endsWith("/") &&
+                            devServableFileExists(pathname, [server.config.publicDir, server.config.root]))) {
                         return next();
                     }
                     try {

package/dist/middleware/matching.d.ts

@@ -0,0 +1,29 @@
+import type { CookieOptions } from "./index.js";
+/**
+ * Parse cookies from a Cookie header.
+ *
+ * A single request cookie whose value is not valid UTF-8 percent-encoding
+ * (a latin-1 value from an old link, a crawler, or a bare `%`) must not take
+ * the whole map down: an unguarded `decodeURIComponent` throws `URIError`,
+ * which — because the middleware runner swallows the throw and calls `next()` —
+ * would silently skip every middleware for that request (a dev-time auth
+ * bypass). Decoding falls back to the raw value per entry instead.
+ */
+export declare function parseCookies(cookieHeader?: string): Record<string, string>;
+/**
+ * Whether a middleware registered at `middlewarePath` applies to `pathname`.
+ *
+ * Matching is by path segment, not raw string prefix: middleware at `/admin`
+ * covers `/admin` and everything under `/admin/`, but not sibling routes like
+ * `/administrator` or `/admin-public` that merely share a textual prefix.
+ */
+export declare function middlewareMatchesPath(pathname: string, middlewarePath: string): boolean;
+/**
+ * Serialize a cookie.
+ *
+ * `Max-Age=0` is the canonical immediate-expiry directive, so the attribute is
+ * emitted whenever `maxAge` is provided — a `0` must not be dropped the way a
+ * plain truthiness check would drop it.
+ */
+export declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;
+//# sourceMappingURL=matching.d.ts.map

package/dist/middleware/matching.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matching.d.ts","sourceRoot":"","sources":["../../src/middleware/matching.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAc1E;AAUD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAIvF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,MAAM,CAkChG"}

package/dist/middleware/matching.js

@@ -0,0 +1,79 @@
+/**
+ * Parse cookies from a Cookie header.
+ *
+ * A single request cookie whose value is not valid UTF-8 percent-encoding
+ * (a latin-1 value from an old link, a crawler, or a bare `%`) must not take
+ * the whole map down: an unguarded `decodeURIComponent` throws `URIError`,
+ * which — because the middleware runner swallows the throw and calls `next()` —
+ * would silently skip every middleware for that request (a dev-time auth
+ * bypass). Decoding falls back to the raw value per entry instead.
+ */
+export function parseCookies(cookieHeader) {
+    if (!cookieHeader)
+        return {};
+    return cookieHeader.split(";").reduce((cookies, cookie) => {
+        const [name, ...rest] = cookie.split("=");
+        const value = rest.join("=").trim();
+        if (name && value) {
+            cookies[name.trim()] = decodeCookieValue(value);
+        }
+        return cookies;
+    }, {});
+}
+function decodeCookieValue(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+/**
+ * Whether a middleware registered at `middlewarePath` applies to `pathname`.
+ *
+ * Matching is by path segment, not raw string prefix: middleware at `/admin`
+ * covers `/admin` and everything under `/admin/`, but not sibling routes like
+ * `/administrator` or `/admin-public` that merely share a textual prefix.
+ */
+export function middlewareMatchesPath(pathname, middlewarePath) {
+    if (middlewarePath === "/")
+        return true;
+    if (pathname === middlewarePath)
+        return true;
+    return pathname.startsWith(`${middlewarePath}/`);
+}
+/**
+ * Serialize a cookie.
+ *
+ * `Max-Age=0` is the canonical immediate-expiry directive, so the attribute is
+ * emitted whenever `maxAge` is provided — a `0` must not be dropped the way a
+ * plain truthiness check would drop it.
+ */
+export function serializeCookie(name, value, options = {}) {
+    let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+    if (options.maxAge != null) {
+        cookie += `; Max-Age=${options.maxAge}`;
+    }
+    if (options.expires) {
+        cookie += `; Expires=${options.expires.toUTCString()}`;
+    }
+    if (options.path) {
+        cookie += `; Path=${options.path}`;
+    }
+    else {
+        cookie += "; Path=/";
+    }
+    if (options.domain) {
+        cookie += `; Domain=${options.domain}`;
+    }
+    if (options.secure) {
+        cookie += "; Secure";
+    }
+    if (options.httpOnly) {
+        cookie += "; HttpOnly";
+    }
+    if (options.sameSite) {
+        cookie += `; SameSite=${options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1)}`;
+    }
+    return cookie;
+}

package/dist/rsc/automatic-optimized-boundary.d.ts

@@ -0,0 +1,11 @@
+export interface AutomaticOptimizedBoundaryTransform {
+    code: string;
+    boundaryCount: number;
+}
+/**
+ * Wrap React JSX-runtime calls for native host boundaries with Farm's
+ * server-only optimizer. Eligibility is decided against the fully evaluated
+ * React element at runtime, so unsupported trees retain normal React behavior.
+ */
+export declare function transformAutomaticOptimizedBoundaries(code: string, id: string): AutomaticOptimizedBoundaryTransform | null;
+//# sourceMappingURL=automatic-optimized-boundary.d.ts.map

package/dist/rsc/automatic-optimized-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"automatic-optimized-boundary.d.ts","sourceRoot":"","sources":["../../src/rsc/automatic-optimized-boundary.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,mCAAmC;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,MAAM,CAAC;CACvB;AAiGD;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,GACT,mCAAmC,GAAG,IAAI,CA8C5C"}