@farm.js/core 0.1.0-beta.97 → 0.1.0-beta.99

package/dist/index.cjs

@@ -917,9 +917,13 @@ function getStorage(namespace) {
   const namespaced = (0, import_unstorage.prefixStorage)(globalStorage, base);
   return {
     ...namespaced,
-    async clear() {
-      const keys = await namespaced.getKeys();
-      await Promise.all(keys.map((key) => namespaced.removeItem(key)));
+    // Scope the wipe to the namespace instead of the whole storage, and keep
+    // the caller's base so `clear("sessions")` cannot take unrelated keys with
+    // it. Dropping the argument silently widens a targeted clear into a
+    // namespace-wide delete.
+    async clear(base2, opts) {
+      const keys = await namespaced.getKeys(base2);
+      await Promise.all(keys.map((key) => namespaced.removeItem(key, opts)));
     }
   };
 }
@@ -1359,6 +1363,170 @@ var init_route_pattern = __esm({
   }
 });
 
+// src/request-origin.ts
+function getRequestSourceOrigin(request) {
+  const origin = request.headers.get("origin")?.trim();
+  if (origin) {
+    return parseSourceOrigin(origin);
+  }
+  const referer = request.headers.get("referer")?.trim();
+  if (referer) {
+    return parseSourceOrigin(referer);
+  }
+  return { ok: true, origin: null };
+}
+function parseSourceOrigin(value) {
+  if (value === "null") {
+    return { ok: false, reason: "opaque-origin" };
+  }
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return { ok: false, reason: "invalid-origin" };
+    }
+    return { ok: true, origin: parsed.origin };
+  } catch {
+    return { ok: false, reason: "invalid-origin" };
+  }
+}
+function matchesHostHeader(sourceOrigin, request) {
+  const host = request.headers.get("host")?.trim().toLowerCase();
+  if (!host) return false;
+  try {
+    const source = new URL(sourceOrigin);
+    const target = new URL(request.url);
+    return source.protocol === target.protocol && source.host.toLowerCase() === host;
+  } catch {
+    return false;
+  }
+}
+function matchesAllowedOrigin(sourceOrigin, pattern) {
+  const source = new URL(sourceOrigin);
+  if (!pattern.includes("*")) {
+    return pattern.includes("://") ? source.origin === pattern : source.host === pattern;
+  }
+  const schemeEnd = pattern.indexOf("://");
+  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);
+  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);
+  const [wildcardHost, port] = splitHostAndPort(hostPattern);
+  const baseHost = wildcardHost.slice(2);
+  if (scheme && source.protocol !== scheme) return false;
+  if (port && getEffectivePort(source) !== port) return false;
+  if (!port && source.port) return false;
+  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;
+}
+function normalizeAllowedOriginPattern(value, label) {
+  const pattern = value.trim().toLowerCase();
+  if (!pattern) {
+    throw new TypeError(`${label} cannot contain empty values`);
+  }
+  if (pattern.includes("*")) {
+    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
+      throw new TypeError(`Invalid ${label} pattern: ${JSON.stringify(value)}`);
+    }
+    return pattern;
+  }
+  if (pattern.includes("://")) {
+    let parsed;
+    try {
+      parsed = new URL(pattern);
+    } catch {
+      throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      throw new TypeError(`${label} must contain origins without paths: ${JSON.stringify(value)}`);
+    }
+    return parsed.origin;
+  }
+  if (/[/@?#]/.test(pattern)) {
+    throw new TypeError(`${label} must contain origins or hosts: ${JSON.stringify(value)}`);
+  }
+  try {
+    return new URL(`http://${pattern}`).host;
+  } catch {
+    throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+  }
+}
+function splitHostAndPort(value) {
+  const separator = value.lastIndexOf(":");
+  if (separator === -1) return [value, null];
+  return [value.slice(0, separator), value.slice(separator + 1)];
+}
+function getEffectivePort(url) {
+  if (url.port) return url.port;
+  if (url.protocol === "https:") return "443";
+  if (url.protocol === "http:") return "80";
+  return "";
+}
+var init_request_origin = __esm({
+  "src/request-origin.ts"() {
+    "use strict";
+    __name(getRequestSourceOrigin, "getRequestSourceOrigin");
+    __name(parseSourceOrigin, "parseSourceOrigin");
+    __name(matchesHostHeader, "matchesHostHeader");
+    __name(matchesAllowedOrigin, "matchesAllowedOrigin");
+    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
+    __name(splitHostAndPort, "splitHostAndPort");
+    __name(getEffectivePort, "getEffectivePort");
+  }
+});
+
+// src/integration-request-security.ts
+function resolveIntegrationAllowedOrigins(values, label) {
+  return Object.freeze((values ?? []).map((value) => normalizeAllowedOriginPattern(value, label)));
+}
+function validateIntegrationRequestOrigin(request, policy = {}) {
+  const allowedOrigins = policy.allowedOrigins ?? [];
+  const requireOriginMetadata = policy.requireOriginMetadata ?? true;
+  const fetchSite = request.headers.get("sec-fetch-site")?.trim().toLowerCase();
+  const source = getRequestSourceOrigin(request);
+  if (!source.ok) {
+    return { ok: false, reason: source.reason };
+  }
+  if (source.origin === null) {
+    if (fetchSite === "same-origin") {
+      return { ok: true };
+    }
+    if (requireOriginMetadata) {
+      return { ok: false, reason: fetchSite === "cross-site" ? "cross-site" : "missing-origin" };
+    }
+    return fetchSite === "cross-site" ? { ok: false, reason: "cross-site" } : { ok: true };
+  }
+  const requestUrl = new URL(request.url);
+  const matchesConfiguredOrigin = allowedOrigins.some(
+    (pattern) => matchesAllowedOrigin(source.origin, pattern)
+  );
+  const matchesRequest = source.origin === requestUrl.origin || matchesHostHeader(source.origin, request);
+  if (!matchesRequest && !matchesConfiguredOrigin) {
+    return { ok: false, reason: "cross-site" };
+  }
+  if (fetchSite === "cross-site" && !matchesConfiguredOrigin) {
+    return { ok: false, reason: "cross-site" };
+  }
+  return { ok: true };
+}
+function describeIntegrationOriginRejection(reason) {
+  switch (reason) {
+    case "missing-origin":
+      return "Request is missing same-origin metadata.";
+    case "opaque-origin":
+      return "Opaque origins are not allowed.";
+    case "invalid-origin":
+      return "Invalid request origin.";
+    case "cross-site":
+      return "Cross-site request was rejected.";
+  }
+}
+var init_integration_request_security = __esm({
+  "src/integration-request-security.ts"() {
+    "use strict";
+    init_request_origin();
+    __name(resolveIntegrationAllowedOrigins, "resolveIntegrationAllowedOrigins");
+    __name(validateIntegrationRequestOrigin, "validateIntegrationRequestOrigin");
+    __name(describeIntegrationOriginRejection, "describeIntegrationOriginRejection");
+  }
+});
+
 // src/integration-api.ts
 function defineIntegrationAPIOperation(operation2) {
   return {
@@ -4195,6 +4363,7 @@ var init_integrations = __esm({
   "src/integrations.ts"() {
     "use strict";
     init_route_pattern();
+    init_integration_request_security();
     init_integration_api();
     init_plugin_integration_context();
     init_decode();
@@ -4660,6 +4829,29 @@ var init_markdown = __esm({
   }
 });
 
+// src/utils/runtime-env.ts
+function getFarmRuntimeBindings() {
+  const runtimeBindings = globalThis.__env__;
+  return runtimeBindings && typeof runtimeBindings === "object" ? runtimeBindings : void 0;
+}
+function readFarmEnvironmentValue(name2) {
+  const runtimeValue = getFarmRuntimeBindings()?.[name2];
+  if (typeof runtimeValue === "string") return runtimeValue;
+  return typeof process !== "undefined" ? process.env?.[name2] : void 0;
+}
+function isFarmDeployedRuntime() {
+  if (getFarmRuntimeBindings()) return true;
+  return readFarmEnvironmentValue("NODE_ENV") === "production";
+}
+var init_runtime_env = __esm({
+  "src/utils/runtime-env.ts"() {
+    "use strict";
+    __name(getFarmRuntimeBindings, "getFarmRuntimeBindings");
+    __name(readFarmEnvironmentValue, "readFarmEnvironmentValue");
+    __name(isFarmDeployedRuntime, "isFarmDeployedRuntime");
+  }
+});
+
 // src/workflows.ts
 var workflows_exports = {};
 __export(workflows_exports, {
@@ -4708,7 +4900,8 @@ function resolveWorkflowsConfig(workflows) {
     dirs,
     route: normalizeWorkflowRoute(options.route || DEFAULT_FARM_WORKFLOW_ROUTE),
     secretEnv: options.secretEnv || DEFAULT_FARM_WORKFLOW_SECRET_ENV,
-    secret: options.secret
+    secret: options.secret,
+    allowUnsecured: options.allowUnsecured === true
   };
 }
 async function discoverFarmWorkflows(config, options = {}) {
@@ -4834,8 +5027,11 @@ async function prepareFarmWorkflowsForNitro(config) {
   await fs16.mkdir(generatedDir, { recursive: true });
   const tasks = {};
   const scheduledTasks = createScheduledTasks(workflows);
+  const wrapperNames = resolveWorkflowWrapperFileNames(workflows.map((workflow) => workflow.id));
   for (const workflow of workflows) {
-    const wrapperPath = toPosixPath(path43.join(generatedDir, `${safeFileName(workflow.id)}.mjs`));
+    const wrapperPath = toPosixPath(
+      path43.join(generatedDir, `${wrapperNames.get(workflow.id)}.mjs`)
+    );
     await fs16.writeFile(wrapperPath, createNitroTaskWrapper(workflow), "utf8");
     tasks[workflow.id] = {
       handler: wrapperPath,
@@ -5073,6 +5269,7 @@ import {
 const route = ${JSON.stringify(config.route)};
 const secretEnv = ${JSON.stringify(config.secretEnv)};
 const inlineSecret = ${JSON.stringify(config.secret || "")};
+const allowUnsecured = ${JSON.stringify(config.allowUnsecured === true)};
 const bodySizeLimit = ${JSON.stringify(server.bodySizeLimit)};
 const workflows = ${JSON.stringify(workflows.map(toWorkflowMetadata))};
 const workflowIds = new Set(workflows.map((workflow) => workflow.id));
@@ -5102,7 +5299,10 @@ function getSecret() {
 
 function verifySecret(event) {
   const secret = getSecret();
-  if (!secret) return null;
+  if (!secret) {
+    if (allowUnsecured) return null;
+    return json({ error: ${JSON.stringify(MISSING_FARM_WORKFLOW_SECRET_ERROR)} }, 401);
+  }
   const authorization = getHeader(event, "authorization") || "";
   const headerSecret = getHeader(event, "x-farm-workflow-secret") || "";
   const bearer = authorization.match(/^Bearer\\s+(.+)$/i)?.[1] || "";
@@ -5196,8 +5396,16 @@ function readScheduledTime(payload) {
   return payload && typeof payload === "object" && "scheduledTime" in payload ? payload.scheduledTime : void 0;
 }
 function verifyWorkflowSecret(request, config) {
-  const secret = config.secret || process.env[config.secretEnv] || "";
-  if (!secret) return null;
+  const secret = config.secret || readFarmEnvironmentValue(config.secretEnv) || "";
+  if (!secret) {
+    if (config.allowUnsecured === true || !isFarmDeployedRuntime()) return null;
+    return Response.json(
+      {
+        error: MISSING_FARM_WORKFLOW_SECRET_ERROR
+      },
+      { status: 401 }
+    );
+  }
   const authorization = request.headers.get("authorization") || "";
   const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1] || "";
   const headerSecret = request.headers.get("x-farm-workflow-secret") || "";
@@ -5210,18 +5418,50 @@ function joinRoute(...parts) {
 function trimSlashes(value) {
   return value.replace(/^\/+|\/+$/g, "");
 }
+function resolveWorkflowWrapperFileNames(ids) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const key = safeFileName(id).toLowerCase();
+    groups.set(key, (groups.get(key) ?? 0) + 1);
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  const claimed = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const base = safeFileName(id);
+    const key = base.toLowerCase();
+    const fileName = (groups.get(key) ?? 0) > 1 ? `${key}-${workflowIdFingerprint(id)}` : base;
+    const claimedBy = claimed.get(fileName.toLowerCase());
+    if (claimedBy !== void 0) {
+      throw new Error(
+        `Farm workflows ${JSON.stringify(claimedBy)} and ${JSON.stringify(id)} generate the same wrapper file ${JSON.stringify(`${fileName}.mjs`)}. Rename one of them.`
+      );
+    }
+    claimed.set(fileName.toLowerCase(), id);
+    resolved.set(id, fileName);
+  }
+  return resolved;
+}
+function workflowIdFingerprint(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
 function safeFileName(value) {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-") || "workflow";
 }
 function relativePath(root, filePath) {
   return filePath.replace(/\\/g, "/").replace(`${root.replace(/\\/g, "/")}/`, "");
 }
-var import_node_path2, DEFAULT_FARM_WORKFLOW_DIRS, DEFAULT_FARM_WORKFLOW_ROUTE, DEFAULT_FARM_WORKFLOW_SECRET_ENV;
+var import_node_path2, DEFAULT_FARM_WORKFLOW_DIRS, DEFAULT_FARM_WORKFLOW_ROUTE, DEFAULT_FARM_WORKFLOW_SECRET_ENV, MISSING_FARM_WORKFLOW_SECRET_ERROR;
 var init_workflows = __esm({
   "src/workflows.ts"() {
     "use strict";
     init_server_http();
     init_search_params();
+    init_runtime_env();
     init_decode();
     init_utils();
     init_route_pattern();
@@ -5229,6 +5469,7 @@ var init_workflows = __esm({
     DEFAULT_FARM_WORKFLOW_DIRS = ["src/jobs", "src/workflows", "src/cron"];
     DEFAULT_FARM_WORKFLOW_ROUTE = "/api/_farm/workflows";
     DEFAULT_FARM_WORKFLOW_SECRET_ENV = "CRON_SECRET";
+    MISSING_FARM_WORKFLOW_SECRET_ERROR = "Workflow route requires a secret. Set the CRON_SECRET environment variable, configure workflows.secret, or set workflows.allowUnsecured to true.";
     __name(defineWorkflow, "defineWorkflow");
     __name(defineTask, "defineTask");
     __name(defineCron, "defineCron");
@@ -5261,6 +5502,8 @@ var init_workflows = __esm({
     __name(verifyWorkflowSecret, "verifyWorkflowSecret");
     __name(joinRoute, "joinRoute");
     __name(trimSlashes, "trimSlashes");
+    __name(resolveWorkflowWrapperFileNames, "resolveWorkflowWrapperFileNames");
+    __name(workflowIdFingerprint, "workflowIdFingerprint");
     __name(safeFileName, "safeFileName");
     __name(relativePath, "relativePath");
   }
@@ -5312,9 +5555,10 @@ async function prepareFarmCronForNitro(config) {
   await fs16.rm(generatedDir, { recursive: true, force: true });
   await fs16.mkdir(generatedDir, { recursive: true });
   const tasks = {};
+  const wrapperNames = resolveCronWrapperFileNames(cron.jobs.map((job) => job.name));
   for (const job of cron.jobs) {
     const taskName = getFarmCronTaskName(job.name);
-    const wrapperPath = toPosixPath(path43.join(generatedDir, `${safeFileName2(job.name)}.mjs`));
+    const wrapperPath = toPosixPath(path43.join(generatedDir, `${wrapperNames.get(job.name)}.mjs`));
     await fs16.writeFile(wrapperPath, createNitroCronTaskWrapper(job, cron.secretEnv), "utf8");
     tasks[taskName] = {
       handler: wrapperPath,
@@ -5397,9 +5641,9 @@ function mergeScheduledTasks(...maps) {
 }
 function isCronRequestAuthorized(request, options = {}) {
   const secretEnv = options.secretEnv || DEFAULT_FARM_CRON_SECRET_ENV;
-  const secret = options.secret || readEnvironmentValue(secretEnv);
+  const secret = options.secret || readFarmEnvironmentValue(secretEnv);
   if (!secret) {
-    return options.allowUnsecured === true || !getFarmRuntimeBindings() && readEnvironmentValue("NODE_ENV") !== "production";
+    return options.allowUnsecured === true || !getFarmRuntimeBindings() && readFarmEnvironmentValue("NODE_ENV") !== "production";
   }
   const authorization = request.headers.get("authorization") || "";
   const bearer = /^Bearer (.*)$/i.exec(authorization)?.[1] || "";
@@ -5596,14 +5840,36 @@ export default defineTask({
 });
 `.trim();
 }
-function readEnvironmentValue(name2) {
-  const runtimeValue = getFarmRuntimeBindings()?.[name2];
-  if (typeof runtimeValue === "string") return runtimeValue;
-  return typeof process !== "undefined" ? process.env?.[name2] : void 0;
+function resolveCronWrapperFileNames(names) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const name2 of names) {
+    const key = safeFileName2(name2).toLowerCase();
+    groups.set(key, (groups.get(key) ?? 0) + 1);
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  const claimed = /* @__PURE__ */ new Map();
+  for (const name2 of names) {
+    const base = safeFileName2(name2);
+    const key = base.toLowerCase();
+    const fileName = (groups.get(key) ?? 0) > 1 ? `${key}-${cronNameFingerprint(name2)}` : base;
+    const claimedBy = claimed.get(fileName.toLowerCase());
+    if (claimedBy !== void 0) {
+      throw new Error(
+        `Farm cron jobs ${JSON.stringify(claimedBy)} and ${JSON.stringify(name2)} generate the same wrapper file ${JSON.stringify(`${fileName}.mjs`)}. Rename one of them.`
+      );
+    }
+    claimed.set(fileName.toLowerCase(), name2);
+    resolved.set(name2, fileName);
+  }
+  return resolved;
 }
-function getFarmRuntimeBindings() {
-  const runtimeBindings = globalThis.__env__;
-  return runtimeBindings && typeof runtimeBindings === "object" ? runtimeBindings : void 0;
+function cronNameFingerprint(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
 }
 function safeFileName2(value) {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-") || "cron";
@@ -5613,6 +5879,7 @@ var init_cron = __esm({
   "src/cron.ts"() {
     "use strict";
     init_utils();
+    init_runtime_env();
     DEFAULT_FARM_CRON_SECRET_ENV = "CRON_SECRET";
     FARM_CRON_MANIFEST = "cron-manifest.json";
     CRON_FIELD_RANGES = [
@@ -5643,8 +5910,8 @@ var init_cron = __esm({
     __name(mergeTaskNames, "mergeTaskNames");
     __name(getFarmCronTaskName, "getFarmCronTaskName");
     __name(createNitroCronTaskWrapper, "createNitroCronTaskWrapper");
-    __name(readEnvironmentValue, "readEnvironmentValue");
-    __name(getFarmRuntimeBindings, "getFarmRuntimeBindings");
+    __name(resolveCronWrapperFileNames, "resolveCronWrapperFileNames");
+    __name(cronNameFingerprint, "cronNameFingerprint");
     __name(safeFileName2, "safeFileName");
   }
 });
@@ -6715,7 +6982,9 @@ var init_server_fn_error = __esm({
 
 // src/server-action-security.ts
 function resolveServerActionsConfig(config) {
-  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);
+  const allowedOrigins = (config?.allowedOrigins ?? []).map(
+    (value) => normalizeAllowedOriginPattern(value, SERVER_ACTION_ALLOWED_ORIGINS_LABEL)
+  );
   const bodySizeLimit = parseBodySizeLimit(
     config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,
     "serverActions.bodySizeLimit"
@@ -6734,7 +7003,7 @@ function validateServerActionRequest(request, config) {
     );
   }
   const requestUrl = new URL(request.url);
-  const sourceOrigin = getRequestSourceOrigin(request);
+  const sourceOrigin = resolveSourceOrigin(request);
   const fetchSite = request.headers.get("sec-fetch-site")?.trim().toLowerCase();
   if (!sourceOrigin) {
     if (fetchSite !== "same-origin") {
@@ -6850,103 +7119,16 @@ function getFallbackAbortController() {
   }
   return globalState2[FALLBACK_ABORT_CONTROLLER_KEY];
 }
-function normalizeAllowedOriginPattern(value) {
-  const pattern = value.trim().toLowerCase();
-  if (!pattern) {
-    throw new TypeError("serverActions.allowedOrigins cannot contain empty values");
-  }
-  if (pattern.includes("*")) {
-    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
-      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);
-    }
-    return pattern;
-  }
-  if (pattern.includes("://")) {
-    let parsed;
-    try {
-      parsed = new URL(pattern);
-    } catch {
-      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-      throw new TypeError(
-        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`
-      );
-    }
-    return parsed.origin;
-  }
-  if (/[/@?#]/.test(pattern)) {
-    throw new TypeError(
-      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`
+function resolveSourceOrigin(request) {
+  const result = getRequestSourceOrigin(request);
+  if (!result.ok) {
+    throw new ServerActionRequestError(
+      "INVALID_ORIGIN",
+      403,
+      result.reason === "opaque-origin" ? "Opaque origins are not allowed" : "Invalid request origin"
     );
   }
-  try {
-    return new URL(`http://${pattern}`).host;
-  } catch {
-    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-  }
-}
-function getRequestSourceOrigin(request) {
-  const origin = request.headers.get("origin")?.trim();
-  if (origin) {
-    return parseSourceOrigin(origin);
-  }
-  const referer = request.headers.get("referer")?.trim();
-  if (referer) {
-    return parseSourceOrigin(referer);
-  }
-  return null;
-}
-function parseSourceOrigin(value) {
-  if (value === "null") {
-    throw new ServerActionRequestError("INVALID_ORIGIN", 403, "Opaque origins are not allowed");
-  }
-  try {
-    const parsed = new URL(value);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      throw new Error("Unsupported protocol");
-    }
-    return parsed.origin;
-  } catch {
-    throw new ServerActionRequestError("INVALID_ORIGIN", 403, "Invalid request origin");
-  }
-}
-function matchesHostHeader(sourceOrigin, request) {
-  const host = request.headers.get("host")?.trim().toLowerCase();
-  if (!host) return false;
-  try {
-    const source = new URL(sourceOrigin);
-    const target = new URL(request.url);
-    return source.protocol === target.protocol && source.host.toLowerCase() === host;
-  } catch {
-    return false;
-  }
-}
-function matchesAllowedOrigin(sourceOrigin, pattern) {
-  const source = new URL(sourceOrigin);
-  if (!pattern.includes("*")) {
-    return pattern.includes("://") ? source.origin === pattern : source.host === pattern;
-  }
-  const schemeEnd = pattern.indexOf("://");
-  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);
-  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);
-  const [wildcardHost, port] = splitHostAndPort(hostPattern);
-  const baseHost = wildcardHost.slice(2);
-  if (scheme && source.protocol !== scheme) return false;
-  if (port && getEffectivePort(source) !== port) return false;
-  if (!port && source.port) return false;
-  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;
-}
-function splitHostAndPort(value) {
-  const separator = value.lastIndexOf(":");
-  if (separator === -1) return [value, null];
-  return [value.slice(0, separator), value.slice(separator + 1)];
-}
-function getEffectivePort(url) {
-  if (url.port) return url.port;
-  if (url.protocol === "https:") return "443";
-  if (url.protocol === "http:") return "80";
-  return "";
+  return result.origin;
 }
 function validateActionId(actionId) {
   if (!actionId || actionId.length > 4096 || hasControlCharacters(actionId)) {
@@ -7067,14 +7249,16 @@ function throwIfAborted2(signal) {
   if (signal.reason !== void 0) throw signal.reason;
   throw new DOMException("The operation was aborted", "AbortError");
 }
-var import_node_async_hooks, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, _ServerActionRequestError, ServerActionRequestError, SERVER_ACTION_STORAGE_KEY, FALLBACK_ABORT_CONTROLLER_KEY, FORM_ACTION_CONTENT_TYPES, JAVASCRIPT_ACTION_CONTENT_TYPES;
+var import_node_async_hooks, SERVER_ACTION_ALLOWED_ORIGINS_LABEL, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, _ServerActionRequestError, ServerActionRequestError, SERVER_ACTION_STORAGE_KEY, FALLBACK_ABORT_CONTROLLER_KEY, FORM_ACTION_CONTENT_TYPES, JAVASCRIPT_ACTION_CONTENT_TYPES;
 var init_server_action_security = __esm({
   "src/server-action-security.ts"() {
     "use strict";
     import_node_async_hooks = require("async_hooks");
     init_cache_invalidation();
+    init_request_origin();
     init_server_fn_error();
     init_server_http();
+    SERVER_ACTION_ALLOWED_ORIGINS_LABEL = "serverActions.allowedOrigins";
     DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1e6;
     _ServerActionRequestError = class _ServerActionRequestError extends Error {
       constructor(code, status, message) {
@@ -7115,13 +7299,7 @@ var init_server_action_security = __esm({
     });
     __name(getServerActionStorage, "getServerActionStorage");
     __name(getFallbackAbortController, "getFallbackAbortController");
-    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
-    __name(getRequestSourceOrigin, "getRequestSourceOrigin");
-    __name(parseSourceOrigin, "parseSourceOrigin");
-    __name(matchesHostHeader, "matchesHostHeader");
-    __name(matchesAllowedOrigin, "matchesAllowedOrigin");
-    __name(splitHostAndPort, "splitHostAndPort");
-    __name(getEffectivePort, "getEffectivePort");
+    __name(resolveSourceOrigin, "resolveSourceOrigin");
     __name(validateActionId, "validateActionId");
     __name(hasControlCharacters, "hasControlCharacters");
     __name(getSupportedContentType, "getSupportedContentType");
@@ -10233,6 +10411,18 @@ var init_routes_server = __esm({
 function isFarmMarkdownPageFile(filePath) {
   return /(^|[/\\])page\.mdx?$/i.test(filePath);
 }
+function farmRequestWantsMarkdown(pathname, accept) {
+  return pathname.toLowerCase().endsWith(".md") || requestAcceptsMarkdown(accept);
+}
+function createFarmMarkdownErrorBody(status, pathname, homeHref = "/") {
+  const heading = status === 404 ? "Page not found" : `Request failed (${status})`;
+  return `# ${heading}
+
+No page is available at \`${pathname}\`. The URL may be incorrect, or the page has not been published.
+
+Browse [the site homepage](${homeHref}) to find available pages.
+`;
+}
 function normalizeFarmMarkdownRoutePath(pathname) {
   const withoutExtension = pathname.replace(/\.md$/i, "");
   const normalized = withoutExtension.startsWith("/") ? withoutExtension : `/${withoutExtension}`;
@@ -10376,7 +10566,7 @@ async function createFarmMarkdownSourceResponse(options) {
     headers: headers2
   });
 }
-var import_promises3, import_path3, import_url;
+var import_promises3, import_path3, import_url, FARM_MARKDOWN_CONTENT_TYPE;
 var init_app_markdown = __esm({
   "src/app-markdown.ts"() {
     "use strict";
@@ -10386,6 +10576,9 @@ var init_app_markdown = __esm({
     init_markdown();
     init_app_markdown_config();
     __name(isFarmMarkdownPageFile, "isFarmMarkdownPageFile");
+    FARM_MARKDOWN_CONTENT_TYPE = "text/markdown; charset=utf-8";
+    __name(farmRequestWantsMarkdown, "farmRequestWantsMarkdown");
+    __name(createFarmMarkdownErrorBody, "createFarmMarkdownErrorBody");
     __name(normalizeFarmMarkdownRoutePath, "normalizeFarmMarkdownRoutePath");
     __name(parseMarkdownFrontmatter, "parseMarkdownFrontmatter");
     __name(titleFromMarkdown, "titleFromMarkdown");
@@ -10893,6 +11086,39 @@ function getStaticImportBindings(content) {
   }
   return bindings;
 }
+function findParserSensitiveJsxContainer(content, localBindings) {
+  if (!content || localBindings.length === 0) return void 0;
+  const names = new Set(localBindings);
+  const tokens = tokenizeModuleSource(content);
+  const openDepth = /* @__PURE__ */ new Map();
+  const isSelfClosing = /* @__PURE__ */ __name((openingIndex) => {
+    for (let index = openingIndex; index < tokens.length; index++) {
+      if (tokens[index].value === ">") return tokens[index - 1]?.value === "/";
+    }
+    return false;
+  }, "isSelfClosing");
+  for (let index = 0; index < tokens.length - 1; index++) {
+    if (tokens[index].value !== "<") continue;
+    if (tokens[index + 1].value === "/") {
+      const closing = tokens[index + 2]?.value;
+      if (closing && openDepth.has(closing)) {
+        openDepth.set(closing, Math.max(0, (openDepth.get(closing) ?? 0) - 1));
+      }
+      continue;
+    }
+    const tag = tokens[index + 1].value;
+    if (names.has(tag)) {
+      for (const [container, depth] of openDepth) {
+        if (depth > 0) return container;
+      }
+      continue;
+    }
+    if (PARSER_SENSITIVE_JSX_CONTAINERS.has(tag) && !isSelfClosing(index)) {
+      openDepth.set(tag, (openDepth.get(tag) ?? 0) + 1);
+    }
+  }
+  return void 0;
+}
 function countStaticJsxUses(content, localBindings) {
   if (!content || localBindings.length === 0) return 0;
   const names = new Set(localBindings);
@@ -11001,6 +11227,36 @@ function getClientRenderingHelpers(tokens, clientBindings) {
   }
   return helpers;
 }
+function passesElementValuedProps(content, localBindings) {
+  if (!content || localBindings.length === 0) return false;
+  const names = new Set(localBindings);
+  const tokens = tokenizeModuleSource(content);
+  for (let index = 0; index < tokens.length - 1; index++) {
+    if (tokens[index].value !== "<" || !names.has(tokens[index + 1].value)) continue;
+    const name2 = tokens[index + 1].value;
+    let cursor = index + 2;
+    let braceDepth = 0;
+    let selfClosing = false;
+    for (; cursor < tokens.length; cursor++) {
+      const value = tokens[cursor].value;
+      if (value === "{") braceDepth++;
+      else if (value === "}") braceDepth--;
+      else if (value === "<" && braceDepth > 0) return true;
+      else if (value === ">" && braceDepth === 0) {
+        selfClosing = tokens[cursor - 1]?.value === "/";
+        break;
+      }
+    }
+    if (selfClosing || cursor >= tokens.length) continue;
+    for (let child = cursor + 1; child < tokens.length; child++) {
+      if (tokens[child].value !== "<") continue;
+      const closesBoundary = tokens[child + 1]?.value === "/" && tokens[child + 2]?.value === name2;
+      if (!closesBoundary) return true;
+      break;
+    }
+  }
+  return false;
+}
 function hasDynamicJsxCardinality(content, localBindings) {
   if (!content || localBindings.length === 0) return false;
   const clientBindings = new Set(localBindings);
@@ -11082,6 +11338,17 @@ function collectIsolatedClientBoundaries(ownerPath, root) {
       if (fallbackReason || importedBoundaryCount === 0) continue;
       const localBindings = importedBindings.get(specifier) ?? [];
       const staticUses = countStaticJsxUses(content, localBindings);
+      if (staticUses > 0) {
+        const container = findParserSensitiveJsxContainer(content, localBindings);
+        if (container) {
+          fallbackReason = `the client boundary imported from ${specifier} renders inside <${container}>, where the HTML parser relocates its hydration marker`;
+          return 0;
+        }
+        if (passesElementValuedProps(content, localBindings)) {
+          fallbackReason = `the client boundary imported from ${specifier} receives React elements, which cannot cross the boundary as serialized props`;
+          return 0;
+        }
+      }
       if (staticUses > 0 && hasDynamicJsxCardinality(content, localBindings)) {
         fallbackReason = `the client boundary count imported from ${specifier} is data-dependent`;
         costGuardExceeded = true;
@@ -11378,7 +11645,7 @@ function resolveSourceCandidate(candidates) {
   }
   return null;
 }
-var import_fs2, import_path4, import_url2, FARM_ISOLATED_HYDRATION_MAX_BOUNDARIES, RESOLVABLE_SOURCE_EXTENSIONS, REGEXP_PREFIX_PUNCTUATION, REGEXP_PREFIX_KEYWORDS;
+var import_fs2, import_path4, import_url2, FARM_ISOLATED_HYDRATION_MAX_BOUNDARIES, RESOLVABLE_SOURCE_EXTENSIONS, REGEXP_PREFIX_PUNCTUATION, REGEXP_PREFIX_KEYWORDS, PARSER_SENSITIVE_JSX_CONTAINERS;
 var init_client_component = __esm({
   "src/utils/client-component.ts"() {
     "use strict";
@@ -11456,11 +11723,23 @@ var init_client_component = __esm({
     __name(enforceFarmIsolatedHydrationRouteBudget, "enforceFarmIsolatedHydrationRouteBudget");
     __name(isIsolatableClientBoundarySource, "isIsolatableClientBoundarySource");
     __name(getStaticImportBindings, "getStaticImportBindings");
+    PARSER_SENSITIVE_JSX_CONTAINERS = /* @__PURE__ */ new Set([
+      "table",
+      "thead",
+      "tbody",
+      "tfoot",
+      "tr",
+      "select",
+      "optgroup",
+      "svg"
+    ]);
+    __name(findParserSensitiveJsxContainer, "findParserSensitiveJsxContainer");
     __name(countStaticJsxUses, "countStaticJsxUses");
     __name(findMatchingToken, "findMatchingToken");
     __name(containsClientJsx, "containsClientJsx");
     __name(findStatementEnd, "findStatementEnd");
     __name(getClientRenderingHelpers, "getClientRenderingHelpers");
+    __name(passesElementValuedProps, "passesElementValuedProps");
     __name(hasDynamicJsxCardinality, "hasDynamicJsxCardinality");
     __name(collectIsolatedClientBoundaries, "collectIsolatedClientBoundaries");
     __name(inspectClientModuleMetadata, "inspectClientModuleMetadata");
@@ -13071,6 +13350,51 @@ var init_not_found = __esm({
   }
 });
 
+// src/agent-config.ts
+function resolveFarmAgentConfig(input) {
+  const jsonLd = input?.jsonLd;
+  if (!jsonLd) return { jsonLd: false };
+  return { jsonLd: jsonLd === true ? {} : jsonLd };
+}
+function pruneUndefined(object) {
+  const result = {};
+  for (const [key, value] of Object.entries(object)) {
+    if (value !== void 0 && value !== null && value !== "") result[key] = value;
+  }
+  return result;
+}
+function serializeJsonLd(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+function renderFarmAgentJsonLd(config, context2) {
+  const base = pruneUndefined({
+    name: config.name ?? context2.siteName ?? context2.title,
+    url: config.url ?? context2.metadataBase,
+    description: config.description ?? context2.description,
+    logo: config.logo,
+    sameAs: config.sameAs && config.sameAs.length > 0 ? config.sameAs : void 0
+  });
+  const object = {
+    "@context": "https://schema.org",
+    "@type": config.type || "Organization",
+    ...base,
+    ...config.properties || {}
+  };
+  if (Object.keys(object).length <= 2 && !config.properties) {
+    return "";
+  }
+  return `<script type="application/ld+json">${serializeJsonLd(object)}</script>`;
+}
+var init_agent_config = __esm({
+  "src/agent-config.ts"() {
+    "use strict";
+    __name(resolveFarmAgentConfig, "resolveFarmAgentConfig");
+    __name(pruneUndefined, "pruneUndefined");
+    __name(serializeJsonLd, "serializeJsonLd");
+    __name(renderFarmAgentJsonLd, "renderFarmAgentJsonLd");
+  }
+});
+
 // src/metadata.ts
 function mergeMetadata(base, next) {
   if (!base) return next ? { ...next } : {};
@@ -13130,7 +13454,7 @@ function addMetadataImageReference(metadata, reference) {
     twitter
   };
 }
-function renderMetadataHead(metadata) {
+function renderMetadataHead(metadata, options = {}) {
   const resolvedMetadata = metadata || {};
   const metadataBase = resolveMetadataBase(resolvedMetadata);
   const explicitTitle = resolveMetadataTitle(resolvedMetadata.title);
@@ -13151,14 +13475,16 @@ function renderMetadataHead(metadata) {
   appendMetaName(tags, "publisher", resolvedMetadata.publisher);
   appendMetaName(tags, "robots", normalizeRobots(resolvedMetadata.robots));
   const alternates = resolvedMetadata.alternates;
-  if (isRecord(alternates)) {
-    appendLink(tags, "canonical", resolveMetadataUrl(alternates.canonical, metadataBase));
-    if (isRecord(alternates.languages)) {
-      for (const [language, href] of Object.entries(alternates.languages)) {
-        appendLink(tags, "alternate", resolveMetadataUrl(href, metadataBase), {
-          hreflang: language
-        });
-      }
+  const explicitCanonical = isRecord(alternates) ? alternates.canonical : void 0;
+  const canonicalHref = explicitCanonical != null ? resolveMetadataUrl(explicitCanonical, metadataBase) : options.pathname ? resolveMetadataUrl(options.pathname, metadataBase) : void 0;
+  if (canonicalHref) {
+    appendLink(tags, "canonical", canonicalHref);
+  }
+  if (isRecord(alternates) && isRecord(alternates.languages)) {
+    for (const [language, href] of Object.entries(alternates.languages)) {
+      appendLink(tags, "alternate", resolveMetadataUrl(href, metadataBase), {
+        hreflang: language
+      });
     }
   }
   const hasFavicon = appendIcons(tags, resolvedMetadata.icons, metadataBase);
@@ -13171,6 +13497,16 @@ function renderMetadataHead(metadata) {
   }
   appendOpenGraph(tags, resolvedMetadata.openGraph, metadataBase);
   appendTwitter(tags, resolvedMetadata.twitter, metadataBase);
+  if (options.jsonLd) {
+    const jsonLdConfig = options.jsonLd === true ? {} : options.jsonLd;
+    const jsonLdScript = renderFarmAgentJsonLd(jsonLdConfig, {
+      metadataBase,
+      siteName: isRecord(resolvedMetadata.openGraph) ? normalizeContent(resolvedMetadata.openGraph.siteName) : void 0,
+      title: explicitTitle,
+      description: normalizeContent(resolvedMetadata.description)
+    });
+    if (jsonLdScript) tags.push(jsonLdScript);
+  }
   return {
     title: escapeText(title),
     tags: tags.length > 0 ? `
@@ -13194,7 +13530,7 @@ function appendOpenGraph(tags, openGraph, metadataBase) {
   appendMetaProperty(tags, "og:description", openGraph.description);
   appendMetaProperty(tags, "og:url", resolveMetadataUrl(openGraph.url, metadataBase));
   appendMetaProperty(tags, "og:site_name", openGraph.siteName);
-  appendMetaProperty(tags, "og:type", openGraph.type);
+  appendMetaProperty(tags, "og:type", openGraph.type ?? "website");
   appendMetaProperty(tags, "og:locale", openGraph.locale);
   const images = normalizeMetadataImages(
     openGraph.images ?? openGraph.image,
@@ -13357,6 +13693,7 @@ function escapeAttribute(value) {
 var init_metadata = __esm({
   "src/metadata.ts"() {
     "use strict";
+    init_agent_config();
     __name(mergeMetadata, "mergeMetadata");
     __name(mergeMetadataTitle, "mergeMetadataTitle");
     __name(applyTitleTemplate, "applyTitleTemplate");
@@ -17012,7 +17349,7 @@ var init_server3 = __esm({
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.1.0-beta.97";
+    version = "0.1.0-beta.99";
   }
 });
 
@@ -17267,6 +17604,12 @@ function hasRequestHeader(req, name2) {
   const value = req.headers[name2.toLowerCase()];
   return Array.isArray(value) ? value.length > 0 : Boolean(value);
 }
+function getFarmMetadataPathname(req) {
+  const raw = req.__FARM_ROUTE__ || req.url;
+  if (typeof raw !== "string" || raw.length === 0) return void 0;
+  const boundary = raw.search(/[?#]/);
+  return boundary === -1 ? raw : raw.slice(0, boundary);
+}
 function serializeInlineValue2(value) {
   return JSON.stringify(value).replace(/</g, "\\u003c").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
@@ -17415,6 +17758,7 @@ var init_renderer2 = __esm({
     init_server();
     init_request_context();
     init_ssg();
+    init_app_markdown();
     init_integrations();
     init_request();
     init_cache();
@@ -17456,6 +17800,7 @@ var init_renderer2 = __esm({
     warnedFullDocumentLayout = false;
     __name(warnFarmFullDocumentLayout, "warnFarmFullDocumentLayout");
     __name(hasRequestHeader, "hasRequestHeader");
+    __name(getFarmMetadataPathname, "getFarmMetadataPathname");
     __name(serializeInlineValue2, "serializeInlineValue");
     __name(escapeHtmlAttribute2, "escapeHtmlAttribute");
     __name(appendResponseHeader, "appendResponseHeader");
@@ -17855,7 +18200,21 @@ var init_renderer2 = __esm({
               const html = await this.rendererRuntime.renderToString(
                 await this.wrapWithIntegrationProviders(pageElement)
               );
-              await this.cacheSSGPage(page2, html, { document: false });
+              const mergedMetadata = await this.resolveRouteMetadata({
+                layoutModules,
+                routeModule: mod,
+                pageProps,
+                pathname: page2.urlPath
+              });
+              const { title, tags, hasFavicon } = renderMetadataHead(mergedMetadata);
+              const metadataHead = `${hasFavicon ? "" : '<link rel="icon" href="data:,">\n  '}<title>${title}</title>${tags}`;
+              const fullDocument = this.createFullHTML(
+                html,
+                pageMetadata.shouldHydrate === true,
+                page2.urlPath,
+                metadataHead
+              );
+              await this.cacheSSGPage(page2, fullDocument, { document: true });
               logger.info(`ISR: Regenerated ${page2.urlPath}`);
             } catch (error) {
               logger.error(`ISR regeneration failed for ${page2.urlPath}: ${error}`);
@@ -18895,7 +19254,10 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
             tags: metaTags,
             hasFavicon,
             hasExplicitTitle
-          } = renderMetadataHead(req.__FARM_METADATA__);
+          } = renderMetadataHead(req.__FARM_METADATA__, {
+            pathname: getFarmMetadataPathname(req),
+            jsonLd: this.config.agent?.jsonLd
+          });
           const documentTitleTag = !hasExplicitTitle && /<title[\s>]/i.test(rendererHead) ? "" : `<title>${title}</title>`;
           const i18nSnapshot = getFarmI18nClientSnapshot();
           const alternateTags = i18nSnapshot ? renderI18nAlternateLinks(req.__FARM_ROUTE__ || req.url || "/", i18nSnapshot) : "";
@@ -19080,7 +19442,10 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
             title,
             tags: metaTags,
             hasFavicon
-          } = renderMetadataHead(req.__FARM_METADATA__);
+          } = renderMetadataHead(req.__FARM_METADATA__, {
+            pathname: getFarmMetadataPathname(req),
+            jsonLd: this.config.agent?.jsonLd
+          });
           const i18nSnapshot = getFarmI18nClientSnapshot();
           const i18nAlternateTags = i18nSnapshot ? renderI18nAlternateLinks(req.__FARM_ROUTE__ || req.url || "/", i18nSnapshot) : "";
           const fontHead = renderFarmFontDevHead(this.config.root || process.cwd());
@@ -19238,6 +19603,15 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
         const pathname = resolveFarmRequestURL(req, {
           trustProxy: this.config.server?.trustProxy
         }).pathname;
+        const acceptHeader = req.headers.accept;
+        const accept = Array.isArray(acceptHeader) ? acceptHeader.join(",") : acceptHeader;
+        if (farmRequestWantsMarkdown(pathname, accept)) {
+          res.setHeader("Content-Type", FARM_MARKDOWN_CONTENT_TYPE);
+          res.setHeader("X-Farm-Markdown-Error", "404");
+          res.setHeader("Cache-Control", "no-store");
+          res.end(createFarmMarkdownErrorBody(404, pathname, this.config.basePath || "/"));
+          return;
+        }
         try {
           const appDir = path12.join(this.config.root, this.config.srcDir, "app");
           const notFoundExtensions = getFarmRendererComponentExtensions(this.config.renderer);
@@ -19323,7 +19697,7 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
         res.write(html);
         res.end();
       }
-      createFullHTML(content, isClientComponent = false, requestPath = "/", documentTitle = "Farm.js App") {
+      createFullHTML(content, isClientComponent = false, requestPath = "/", metadataHead) {
         const i18nSnapshot = getFarmI18nClientSnapshot();
         const clientScript = isClientComponent ? `  <script type="module" src="/@farm/client.js"></script>` : "";
         const integrationManifestScript = `<script>
@@ -19347,6 +19721,7 @@ ${i18nSnapshot ? `window.__FARM_I18N__ = ${serializeInlineValue2(i18nSnapshot)};
             headAssets: [
               themeDocument.head,
               `<meta name="farm-deployment-id" content="${escapeHtmlAttribute2(this.getDeploymentId())}">`,
+              metadataHead,
               alternateLinks,
               fontHead,
               `<link rel="stylesheet" href="/src/app/globals.css" />`,
@@ -19365,8 +19740,7 @@ ${i18nSnapshot ? `window.__FARM_I18N__ = ${serializeInlineValue2(i18nSnapshot)};
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <meta name="farm-deployment-id" content="${escapeHtmlAttribute2(this.getDeploymentId())}">
-  <link rel="icon" href="data:,">
-  <title>${escapeHtmlAttribute2(documentTitle)}</title>${alternateLinks}
+  ${metadataHead ?? '<link rel="icon" href="data:,">\n  <title>Farm.js App</title>'}${alternateLinks}
   ${fontHead}
   <link rel="stylesheet" href="/src/app/globals.css" />${this.collectDevStyleLinks().map((l) => `
   ${l}`).join("")}
@@ -20202,6 +20576,7 @@ var init_app = __esm({
             ppr: config.experimental?.ppr ?? false,
             ...config.experimental
           },
+          agent: config.agent ?? {},
           vite: config.vite || {}
         };
       }
@@ -24924,6 +25299,116 @@ var init_server_query_boundary = __esm({
   }
 });
 
+// src/client-boundary-env.ts
+function shouldInspectClientBoundary(id, code) {
+  if (id.startsWith("\0") || id.startsWith("virtual:") || id.includes("node_modules")) return false;
+  return code.includes("process.env") || code.includes("node:");
+}
+function analyzeClientBoundary(program, publicKeys) {
+  const envKeys = /* @__PURE__ */ new Set();
+  const publicEnvKeys = /* @__PURE__ */ new Set();
+  const builtinImports = /* @__PURE__ */ new Set();
+  const visit = /* @__PURE__ */ __name((node, inFunction) => {
+    if (!node || typeof node !== "object") return;
+    if (Array.isArray(node)) {
+      for (const entry of node) visit(entry, inFunction);
+      return;
+    }
+    const estree = node;
+    if (typeof estree.type !== "string") return;
+    if (!inFunction) {
+      const builtin = readNodeBuiltinSource(estree);
+      if (builtin !== void 0) builtinImports.add(builtin);
+      const key = readProcessEnvKey(estree);
+      if (key !== void 0) {
+        if (key !== "NODE_ENV") {
+          (publicKeys.has(key) ? publicEnvKeys : envKeys).add(key);
+        }
+        return;
+      }
+    }
+    const nextInFunction = inFunction || FUNCTION_BODY_TYPES.has(estree.type);
+    for (const [childKey, value] of Object.entries(estree)) {
+      if (childKey === "type") continue;
+      visit(value, nextInFunction);
+    }
+  }, "visit");
+  visit(program.body, false);
+  return {
+    envKeys: [...envKeys],
+    publicEnvKeys: [...publicEnvKeys],
+    builtinImports: [...builtinImports]
+  };
+}
+function readNodeBuiltinSource(node) {
+  if (node.type === "ImportDeclaration" || node.type === "ExportNamedDeclaration" || node.type === "ExportAllDeclaration" || node.type === "ImportExpression") {
+    const value = node.source?.value;
+    return typeof value === "string" && value.startsWith("node:") ? value : void 0;
+  }
+  if (node.type === "CallExpression") {
+    const callee = node.callee;
+    if (callee?.type === "Identifier" && callee.name === "require") {
+      const arg = node.arguments?.[0];
+      const value = arg?.type === "Literal" ? arg.value : void 0;
+      return typeof value === "string" && value.startsWith("node:") ? value : void 0;
+    }
+  }
+  return void 0;
+}
+function readProcessEnvKey(node) {
+  if (node.type !== "MemberExpression") return void 0;
+  const object = node.object;
+  if (!object || object.type !== "MemberExpression" || object.object?.type !== "Identifier" || object.object.name !== "process" || object.property?.name !== "env") {
+    return void 0;
+  }
+  const property = node.property;
+  if (!property) return void 0;
+  if (!node.computed && property.type === "Identifier") {
+    return property.name;
+  }
+  if (node.computed && property.type === "Literal") {
+    const value = property.value;
+    return typeof value === "string" ? value : void 0;
+  }
+  return void 0;
+}
+function formatClientBoundaryWarning(id, findings) {
+  const { envKeys, publicEnvKeys, builtinImports } = findings;
+  const lines = [`${id} is compiled for the client but uses server-only APIs:`];
+  if (envKeys.length > 0) {
+    lines.push(
+      `- module-scope read of process.env.${envKeys.join(", process.env.")} \u2014 undefined in the browser. Move the read behind a server boundary, or expose it through env.public in farm.config.ts.`
+    );
+  }
+  if (publicEnvKeys.length > 0) {
+    lines.push(
+      `- module-scope read of process.env.${publicEnvKeys.join(", process.env.")} \u2014 process.env is not populated in the browser even for public keys. Read it through publicEnv from "@farm.js/core/env".`
+    );
+  }
+  if (builtinImports.length > 0) {
+    lines.push(
+      `- import of ${builtinImports.join(", ")} \u2014 stubbed with an empty object in the browser. Move the import into server-only code.`
+    );
+  }
+  return lines.join("\n");
+}
+var FUNCTION_BODY_TYPES;
+var init_client_boundary_env = __esm({
+  "src/client-boundary-env.ts"() {
+    "use strict";
+    FUNCTION_BODY_TYPES = /* @__PURE__ */ new Set([
+      "FunctionDeclaration",
+      "FunctionExpression",
+      "ArrowFunctionExpression"
+    ]);
+    __name(shouldInspectClientBoundary, "shouldInspectClientBoundary");
+    __name(analyzeClientBoundary, "analyzeClientBoundary");
+    __name(readNodeBuiltinSource, "readNodeBuiltinSource");
+    __name(readProcessEnvKey, "readProcessEnvKey");
+    __name(formatClientBoundaryWarning, "formatClientBoundaryWarning");
+  }
+});
+
 // src/image-vite.ts
 function farmImageImportsPlugin() {
   return {
@@ -25037,6 +25522,7 @@ var init_font = __esm({
 function createFarmImageHandler(config, options) {
   const fetcher = options.fetch ?? globalThis.fetch;
   const cache = new FarmImageMemoryCache(options.cacheEntries ?? 100);
+  const inflight = /* @__PURE__ */ new Map();
   const allowedWidths = /* @__PURE__ */ new Set([...config.deviceSizes, ...config.imageSizes]);
   const allowedQualities = new Set(config.qualities);
   return /* @__PURE__ */ __name(async function handleFarmImage(request) {
@@ -25065,50 +25551,55 @@ function createFarmImageHandler(config, options) {
         "quality"
       );
       const accept = request.headers.get("accept") ?? "";
+      const negotiatedFormat = selectOutputFormat(accept, config.formats) ?? "";
       const cacheKey = `${sourceUrl.href}
 ${width}
 ${quality}
-${accept}`;
+${negotiatedFormat}`;
       let optimized = cache.get(cacheKey);
       if (!optimized) {
-        const fetchedSource = await fetchImageSource(
-          sourceUrl,
-          requestUrl.origin,
-          config,
-          fetcher,
-          options.fetchRemote,
-          options.validateRemoteUrl,
-          request.signal
-        );
-        const source = await readResponseWithLimit(
-          fetchedSource.response,
-          config.maximumResponseBody
-        );
-        const sourceType = detectImageContentType(source);
-        validateSourceType(sourceType, config);
-        throwIfAborted3(request.signal);
-        const result = await options.transform({
-          source,
-          sourceUrl: fetchedSource.url,
-          sourceType,
-          width,
-          quality,
-          accept,
-          formats: config.formats,
-          signal: request.signal
+        optimized = await runCoalesced(inflight, cacheKey, request.signal, async (signal) => {
+          const fetchedSource = await fetchImageSource(
+            sourceUrl,
+            requestUrl.origin,
+            config,
+            fetcher,
+            options.fetchRemote,
+            options.validateRemoteUrl,
+            signal
+          );
+          const source = await readResponseWithLimit(
+            fetchedSource.response,
+            config.maximumResponseBody
+          );
+          const sourceType = detectImageContentType(source);
+          validateSourceType(sourceType, config);
+          throwIfAborted3(signal);
+          const result = await options.transform({
+            source,
+            sourceUrl: fetchedSource.url,
+            sourceType,
+            width,
+            quality,
+            accept,
+            formats: config.formats,
+            signal,
+            maximumResponseBody: config.maximumResponseBody
+          });
+          throwIfAborted3(signal);
+          validateTransformedResult(result, config);
+          const entry = {
+            ...result,
+            etag: createImageEtag(result.body),
+            cacheControl: `public, max-age=${config.minimumCacheTTL}, stale-while-revalidate=${Math.max(
+              config.minimumCacheTTL,
+              60
+            )}`,
+            expiresAt: Date.now() + config.minimumCacheTTL * 1e3
+          };
+          cache.set(cacheKey, entry);
+          return entry;
         });
-        throwIfAborted3(request.signal);
-        validateTransformedResult(result, config);
-        optimized = {
-          ...result,
-          etag: createImageEtag(result.body),
-          cacheControl: `public, max-age=${config.minimumCacheTTL}, stale-while-revalidate=${Math.max(
-            config.minimumCacheTTL,
-            60
-          )}`,
-          expiresAt: Date.now() + config.minimumCacheTTL * 1e3
-        };
-        cache.set(cacheKey, optimized);
       }
       return createOptimizedImageResponse(request, optimized, config);
     } catch (error) {
@@ -25259,6 +25750,44 @@ async function fetchImageSource(initialUrl, requestOrigin, config, fetcher, fetc
     await validateImageSourceUrl(currentUrl, requestOrigin, config, validateRemoteUrl);
   }
 }
+async function runCoalesced(inflight, key, requestSignal, run) {
+  let entry = inflight.get(key);
+  if (!entry) {
+    const controller = new AbortController();
+    const created = {
+      controller,
+      waiters: 0,
+      promise: void 0
+    };
+    created.promise = run(controller.signal).finally(() => {
+      if (inflight.get(key) === created) inflight.delete(key);
+    });
+    created.promise.catch(() => {
+    });
+    inflight.set(key, created);
+    entry = created;
+  }
+  const pending = entry;
+  pending.waiters += 1;
+  try {
+    return await raceRequestAbort(pending.promise, requestSignal);
+  } finally {
+    pending.waiters -= 1;
+    if (pending.waiters === 0 && inflight.get(key) === pending) {
+      inflight.delete(key);
+      pending.controller.abort();
+    }
+  }
+}
+function raceRequestAbort(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) return Promise.reject(signal.reason ?? new Error("Aborted"));
+  return new Promise((resolve10, reject) => {
+    const onAbort = /* @__PURE__ */ __name(() => reject(signal.reason ?? new Error("Aborted")), "onAbort");
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(resolve10, reject).finally(() => signal.removeEventListener("abort", onAbort));
+  });
+}
 async function readResponseWithLimit(response, limit) {
   const contentLength = response.headers.get("content-length");
   if (contentLength && Number(contentLength) > limit) {
@@ -25426,7 +25955,7 @@ function throwIfAborted3(signal) {
 function isAbortError(error) {
   return error instanceof Error && error.name === "AbortError";
 }
-var _FarmImageRequestError, FarmImageRequestError, _FarmImageMemoryCache, FarmImageMemoryCache;
+var _FarmImageRequestError, FarmImageRequestError, DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT, _FarmImageMemoryCache, FarmImageMemoryCache;
 var init_image_server = __esm({
   "src/image-server.ts"() {
     "use strict";
@@ -25442,12 +25971,15 @@ var init_image_server = __esm({
     __name(_FarmImageRequestError, "FarmImageRequestError");
     FarmImageRequestError = _FarmImageRequestError;
     __name(createFarmImageHandler, "createFarmImageHandler");
+    DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT = 10 * 1024 * 1024;
     __name(selectOutputFormat, "selectOutputFormat");
     __name(isPrivateImageAddress, "isPrivateImageAddress");
     __name(parseAllowedInteger, "parseAllowedInteger");
     __name(resolveImageSourceUrl, "resolveImageSourceUrl");
     __name(validateImageSourceUrl, "validateImageSourceUrl");
     __name(fetchImageSource, "fetchImageSource");
+    __name(runCoalesced, "runCoalesced");
+    __name(raceRequestAbort, "raceRequestAbort");
     __name(readResponseWithLimit, "readResponseWithLimit");
     __name(cancelResponseBody, "cancelResponseBody");
     __name(detectImageContentType, "detectImageContentType");
@@ -28668,6 +29200,7 @@ async function resolveConfig(userConfig, mode) {
   const openapi = {
     enabled: false,
     route: "/docs/reference",
+    specRoute: "/openapi.json",
     title: "API Documentation",
     description: "Auto-generated API documentation",
     version: "1.0.0",
@@ -28675,6 +29208,7 @@ async function resolveConfig(userConfig, mode) {
     ...userConfig.openapi
   };
   if (openapi.route !== void 0) validateConfigRouteSource(openapi.route, "openapi.route");
+  if (openapi.specRoute) validateConfigRouteSource(openapi.specRoute, "openapi.specRoute");
   const resolved = {
     [FARM_RESOLVED_CUSTOM_CONTEXT]: typeof userConfig.context === "function",
     root,
@@ -28707,6 +29241,7 @@ async function resolveConfig(userConfig, mode) {
       ppr: false,
       ...userConfig.experimental
     },
+    agent: resolveFarmAgentConfig(userConfig.agent),
     plugins: [...resolveIntegrationPlugins(integrations), ...userConfig.plugins || []],
     integrations,
     trailingSlash: userConfig.trailingSlash ?? false,
@@ -28815,6 +29350,7 @@ var init_config4 = __esm({
     init_security();
     init_navigation_errors();
     init_config2();
+    init_agent_config();
     init_renderer();
     init_framework_detect();
     init_config3();
@@ -32669,6 +33205,22 @@ function isFarmConfigFile(file, root) {
   const relative6 = normalized.startsWith(`${rootSlug}/`) ? normalized.slice(rootSlug.length + 1) : normalized;
   return FARM_CONFIG_FILENAMES.has(relative6);
 }
+function warnClientBoundaryOnce(context2, id, code, config) {
+  if (warnedClientBoundaryIds.has(id)) return;
+  let program;
+  try {
+    program = context2.parse(code);
+  } catch {
+    return;
+  }
+  const publicKeys = new Set(Object.keys(config.env?.public ?? {}));
+  const findings = analyzeClientBoundary(program, publicKeys);
+  if (findings.envKeys.length === 0 && findings.publicEnvKeys.length === 0 && findings.builtinImports.length === 0) {
+    return;
+  }
+  warnedClientBoundaryIds.add(id);
+  logger.warn(formatClientBoundaryWarning(id, findings));
+}
 function farmPlugin(options = {}, initialPluginManager) {
   const imageImports = farmImageImportsPlugin();
   const fontImports = farmFontImportsPlugin({
@@ -33279,6 +33831,22 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             }
             return;
           }
+          if (openAPIManager && options.openapi?.specRoute && requestPathname === options.openapi.specRoute) {
+            if (requestMethod !== "GET" && requestMethod !== "HEAD") {
+              res.statusCode = 405;
+              res.setHeader("Allow", "GET, HEAD");
+              res.setHeader("Content-Type", "text/plain; charset=utf-8");
+              res.end("Method Not Allowed");
+              return;
+            }
+            const spec = await openAPIManager.getSpec();
+            const body = JSON.stringify(spec);
+            res.statusCode = 200;
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.setHeader("Cache-Control", "no-store");
+            res.end(requestMethod === "HEAD" ? void 0 : body);
+            return;
+          }
           if (openAPIManager && requestPathname === options.openapi?.route) {
             const docsHandler = openAPIManager.getDocsRouteHandler();
             return docsHandler(req, res);
@@ -33289,6 +33857,11 @@ window.__FARM_MANIFEST__ = ${inlineValue({
               docsHeaders.set(key, Array.isArray(value) ? value.join(", ") : value);
             }
           }
+          const runAppMiddlewareForContentRoute = /* @__PURE__ */ __name(async () => {
+            if (!middlewareManager?.hasMiddleware()) return false;
+            const middlewareRequest = createRequestFromNodeRequest(req, new URL(fullUrl));
+            return farmApp.getServerRenderer().runWithRequestContext(middlewareRequest, () => middlewareManager.execute(req, res));
+          }, "runAppMiddlewareForContentRoute");
           if (farmDocsHandler) {
             const docsRequest = new Request(fullUrl, {
               method: requestMethod,
@@ -33296,6 +33869,7 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             });
             const docsResponse = await farmDocsHandler(docsRequest.clone());
             if (docsResponse) {
+              if (await runAppMiddlewareForContentRoute()) return;
               await sendWebResponse(
                 res,
                 await wrapFarmDocsResponseWithLayouts(docsRequest, docsResponse)
@@ -33322,6 +33896,7 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             }, "resolveSource")
           });
           if (markdownSourceResponse) {
+            if (await runAppMiddlewareForContentRoute()) return;
             await sendWebResponse(res, markdownSourceResponse);
             return;
           }
@@ -33335,9 +33910,23 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             renderPage: /* @__PURE__ */ __name(async (request) => fetch(request), "renderPage")
           });
           if (markdownResponse) {
+            if (await runAppMiddlewareForContentRoute()) return;
             await sendWebResponse(res, markdownResponse);
             return;
           }
+          if (farmRequestWantsMarkdown(requestPathname, req.headers.accept)) {
+            const markdownRoute = farmApp.getRouteManager().matchRoute(normalizeFarmMarkdownRoutePath(requestPathname));
+            if (!markdownRoute.route) {
+              res.statusCode = 404;
+              res.setHeader("Content-Type", FARM_MARKDOWN_CONTENT_TYPE);
+              res.setHeader("X-Farm-Markdown-Error", "404");
+              res.setHeader("Cache-Control", "no-store");
+              res.end(
+                createFarmMarkdownErrorBody(404, requestPathname, farmConfig.basePath || "/")
+              );
+              return;
+            }
+          }
           const markdownPageTarget = resolveMarkdownMirrorTarget(
             farmApp.getConfig().md,
             requestPathname,
@@ -34286,6 +34875,9 @@ export const manifest = getManifest();
           }
         }
       }
+      if (!transformOptions?.ssr && shouldInspectClientBoundary(id, code)) {
+        warnClientBoundaryOnce(this, id, code, farmApp?.getConfig() ?? options);
+      }
       if (typeof imageImports.transform === "function") {
         const imageModule = await imageImports.transform.call(this, code, id, transformOptions);
         if (imageModule) return imageModule;
@@ -36625,7 +37217,7 @@ async function defineConfig2(config = {}) {
     }
   };
 }
-var fs13, path34, import_node_url8, ALL_TYPE_ARTIFACTS, createEmptyTypeArtifactSelection, FARM_I18N_CLIENT_BRIDGE_ID, warnedDeprecatedDevtoolsDashboard, EMPTY_FARM_DOCS_SEARCH_CLIENT_RUNTIME, FARM_CONFIG_FILENAMES;
+var fs13, path34, import_node_url8, ALL_TYPE_ARTIFACTS, createEmptyTypeArtifactSelection, FARM_I18N_CLIENT_BRIDGE_ID, warnedDeprecatedDevtoolsDashboard, EMPTY_FARM_DOCS_SEARCH_CLIENT_RUNTIME, FARM_CONFIG_FILENAMES, warnedClientBoundaryIds;
 var init_vite2 = __esm({
   "src/vite.ts"() {
     "use strict";
@@ -36662,6 +37254,7 @@ var init_vite2 = __esm({
     init_server_context();
     init_dev_static();
     init_server_query_boundary();
+    init_client_boundary_env();
     init_deployment();
     init_image_config();
     init_image_vite();
@@ -36761,6 +37354,8 @@ async function mountFarmDocsSearch() {
     __name(walkModuleAst, "walkModuleAst");
     __name(isFarmModuleAstNode, "isFarmModuleAstNode");
     __name(isFarmConfigFile, "isFarmConfigFile");
+    warnedClientBoundaryIds = /* @__PURE__ */ new Set();
+    __name(warnClientBoundaryOnce, "warnClientBoundaryOnce");
     __name(farmPlugin, "farmPlugin");
     __name(isFarmClientVirtualId, "isFarmClientVirtualId");
     __name(generateProgrammaticRouteModule, "generateProgrammaticRouteModule");
@@ -38129,6 +38724,7 @@ __export(src_exports, {
   FARM_DEVTOOLS_LAUNCH_PARAM: () => FARM_DEVTOOLS_LAUNCH_PARAM,
   FARM_DEVTOOLS_PATH: () => FARM_DEVTOOLS_PATH,
   FARM_INTEGRATION_INTERNAL_DISPATCH_CONTEXT_KEY: () => FARM_INTEGRATION_INTERNAL_DISPATCH_CONTEXT_KEY,
+  FARM_MARKDOWN_CONTENT_TYPE: () => FARM_MARKDOWN_CONTENT_TYPE,
   FARM_SERVER_FN_FAILURE_SYMBOL: () => FARM_SERVER_FN_FAILURE_SYMBOL,
   FARM_SERVER_FN_SYMBOL: () => FARM_SERVER_FN_SYMBOL,
   FARM_SERVER_QUERY_SYMBOL: () => FARM_SERVER_QUERY_SYMBOL,
@@ -38219,6 +38815,7 @@ __export(src_exports, {
   createFarmDocsAdapterHandler: () => createFarmDocsAdapterHandler,
   createFarmDocsHandler: () => createFarmDocsHandler,
   createFarmImageTypeDeclarations: () => createFarmImageTypeDeclarations,
+  createFarmMarkdownErrorBody: () => createFarmMarkdownErrorBody,
   createFarmMarkdownRouteModule: () => createFarmMarkdownRouteModule,
   createFarmMarkdownRouteModuleFromFile: () => createFarmMarkdownRouteModuleFromFile,
   createFarmMarkdownSourceResponse: () => createFarmMarkdownSourceResponse,
@@ -38279,6 +38876,7 @@ __export(src_exports, {
   defineStorageClient: () => defineStorageClient,
   defineTask: () => defineTask,
   defineWorkflow: () => defineWorkflow,
+  describeIntegrationOriginRejection: () => describeIntegrationOriginRejection,
   discoverFarmDocsPages: () => discoverFarmDocsPages,
   discoverFarmWorkflows: () => discoverFarmWorkflows,
   dispatchIntegrationRequest: () => dispatchIntegrationRequest,
@@ -38291,6 +38889,7 @@ __export(src_exports, {
   farmApiPlugin: () => farmApiPlugin,
   farmIntegrationSchemaToOrmSchema: () => farmIntegrationSchemaToOrmSchema,
   farmMiddlewarePlugin: () => farmMiddlewarePlugin,
+  farmRequestWantsMarkdown: () => farmRequestWantsMarkdown,
   farmRouteRuleMatches: () => farmRouteRuleMatches,
   fetchServerQuery: () => fetchServerQuery,
   fileExists: () => fileExists,
@@ -38475,6 +39074,7 @@ __export(src_exports, {
   resolveFarmRouteRuleRuntimeConfig: () => resolveFarmRouteRuleRuntimeConfig,
   resolveFarmRouteRuntimeConfig: () => resolveFarmRouteRuntimeConfig,
   resolveFarmThemeConfig: () => resolveFarmThemeConfig,
+  resolveIntegrationAllowedOrigins: () => resolveIntegrationAllowedOrigins,
   resolveIntegrationOrmRuntimeClient: () => resolveIntegrationOrmRuntimeClient,
   resolveIntegrationPlugins: () => resolveIntegrationPlugins,
   resolveMarkdownConfig: () => resolveMarkdownConfig,
@@ -38535,6 +39135,7 @@ __export(src_exports, {
   useServerFn: () => useServerFn,
   useServerQuery: () => useServerQuery,
   useTheme: () => useTheme,
+  validateIntegrationRequestOrigin: () => validateIntegrationRequestOrigin,
   validateServerActionRequest: () => validateServerActionRequest,
   vercelBlobStorage: () => vercelBlobStorage,
   vercelKVStorage: () => vercelKVStorage,
@@ -40247,6 +40848,7 @@ var _FarmClientDataCache = class _FarmClientDataCache {
     const watched = /* @__PURE__ */ new Set();
     for (const key of this.listeners.keys()) watched.add(this.resolveKey(key));
     let remaining = false;
+    const swept = /* @__PURE__ */ new Set();
     for (const [key, entry] of this.entries) {
       if (entry.gcAt === void 0) continue;
       if (now2 < entry.gcAt || entry.fetching || this.inflight.has(key) || watched.has(key)) {
@@ -40255,9 +40857,28 @@ var _FarmClientDataCache = class _FarmClientDataCache {
       }
       this.entries.delete(key);
       this.persistence?.onDelete(key);
+      swept.add(key);
     }
+    if (swept.size > 0) this.sweepEntryMetadata(swept);
     if (remaining) this.scheduleGcSweep();
   }
+  /**
+   * Entry eviction alone leaves the per-key metadata behind. `invalidatedAt`
+   * marks and provisional aliases are created per query invocation, so with
+   * dynamic keys they accumulate for the lifetime of the page even though the
+   * entries they describe are long gone.
+   */
+  sweepEntryMetadata(swept) {
+    for (const key of swept) this.invalidatedAt.delete(key);
+    for (const [alias, target] of this.aliases) {
+      if (this.entries.has(alias) || this.listeners.has(alias)) continue;
+      const resolved = this.resolveKey(target);
+      if (!swept.has(resolved)) continue;
+      if (this.entries.has(resolved) || this.listeners.has(resolved)) continue;
+      this.aliases.delete(alias);
+      this.invalidatedAt.delete(alias);
+    }
+  }
   emit(key, event) {
     this.notifyListeners(key, event);
     for (const [alias, target] of this.aliases) {
@@ -40268,7 +40889,12 @@ var _FarmClientDataCache = class _FarmClientDataCache {
   }
   notifyListeners(key, event) {
     for (const listener of this.listeners.get(key) ?? []) {
-      listener(event);
+      try {
+        listener(event);
+      } catch (error) {
+        const detail = error instanceof Error ? error.stack ?? error.message : String(error);
+        console.warn(`[farm:client-cache] cache listener failed: ${detail}`);
+      }
     }
   }
 };
@@ -48589,7 +49215,9 @@ async function buildSSRInMemory(productionVite, config, root, routeManager, apiR
     }
     openAPIReference = {
       route: config.openapi.route,
-      html: renderOpenAPIReferenceHTML2(spec, config.openapi)
+      html: renderOpenAPIReferenceHTML2(spec, config.openapi),
+      spec,
+      specRoute: config.openapi.specRoute || null
     };
   }
   const middlewareRoutes = await discoverMiddlewareRoutes(appDirs);
@@ -49211,6 +49839,7 @@ import { dirname as farmDocsDirname, join as farmDocsJoin } from "node:path";
 import { fileURLToPath as farmDocsFileURLToPath } from "node:url";` : "";
   const markdownHandlerImport = config.md?.enabled ? `import { applyMarkdownNegotiationHeaders, createMarkdownMirrorResponse } from "@farm.js/core/markdown";` : "";
   const appMarkdownImport = hasMarkdownPages ? `import { createFarmMarkdownRouteModule, createFarmMarkdownSourceResponse } from "@farm.js/core/app-markdown";` : "const createFarmMarkdownSourceResponse = null;";
+  const markdownErrorImport = `import { FARM_MARKDOWN_CONTENT_TYPE, createFarmMarkdownErrorBody, farmRequestWantsMarkdown } from "@farm.js/core/app-markdown";`;
   const mdxComponentsPath = typeof config.mdx?.components === "string" ? import_path14.default.isAbsolute(config.mdx.components) ? config.mdx.components : import_path14.default.join(config.root, config.mdx.components) : null;
   const mdxComponentsImport = mdxComponentsPath ? `import * as FarmMdxComponentsModule from ${toVirtualEntryImportSpecifier(mdxComponentsPath)};` : "";
   const layerConfigPaths = (config.layers || []).map((layer) => layer.configFile).filter((configFile) => Boolean(configFile)).filter((configFile) => configFile !== configModulePath);
@@ -49353,6 +49982,7 @@ ${docsFontImport}
 ${docsRuntimeImport}
 ${markdownHandlerImport}
 ${appMarkdownImport}
+${markdownErrorImport}
 ${mdxComponentsImport}
 ${integrationImports}
 ${providerServerImports}
@@ -50896,12 +51526,38 @@ async function handleFarmRequestInContext(
   }
   ` : ""}
 
+  ${hasMiddlewareRuntime ? `
+  const requestBeforeMiddleware = request;
+  const middlewareResult = await farmMiddlewareRunner(request);
+  if (middlewareResult.response) {
+    return middlewareResult.response;
+  }
+  request = middlewareResult.request;
+  const middlewareData = middlewareResult.data;
+  const middlewareContext = middlewareResult.context;
+  const middlewareHeaders = middlewareResult.headers;
+  url = new URL(request.url);
+  pathname = url.pathname;
+  routePathname = getFarmRoutePathname(pathname);
+
+  // Middleware may replace the Request when it rewrites a URL. Re-enter the
+  // request store so pages, layouts, and route context observe that rewritten
+  // request instead of the original outer-handler value.
+  const runResolvedRequest = async () => {
+  ` : `
+  const middlewareData = undefined;
+  const middlewareContext = undefined;
+  const middlewareHeaders = undefined;
+  `}
+
   ${config.docs?.enabled ? `
+  // Docs responses are served after app middleware so route guards and
+  // middleware headers apply to the docs engine like any other page content.
   if (farmDocsHandler) {
     const docsResponse = await farmDocsHandler(request.clone());
     if (docsResponse) {
       if (!docsResponse.headers.get("content-type")?.toLowerCase().includes("text/html")) {
-        return docsResponse;
+        return applyProductionMiddlewareHeaders(docsResponse, middlewareHeaders);
       }
       const wrappedDocsResponse = await wrapFarmDocsResponseWithLayouts(
         request,
@@ -50909,16 +51565,18 @@ async function handleFarmRequestInContext(
       );
       const docsHeaders = new Headers(wrappedDocsResponse.headers);
       docsHeaders.set("x-farm-preload-buffered", "1");
-      return new Response(wrappedDocsResponse.body, {
+      return applyProductionMiddlewareHeaders(new Response(wrappedDocsResponse.body, {
         status: wrappedDocsResponse.status,
         statusText: wrappedDocsResponse.statusText,
         headers: docsHeaders,
-      });
+      }), middlewareHeaders);
     }
   }
   ` : ""}
 
   ${hasMarkdownPages ? `
+  // The raw markdown source of a page route is the page's content in another
+  // representation; middleware guarding the route must run before serving it.
   const markdownSourceResponse = await createFarmMarkdownSourceResponse?.({
     request: request.clone(),
     config: farmMdxConfig,
@@ -50928,7 +51586,7 @@ async function handleFarmRequestInContext(
     },
   });
   if (markdownSourceResponse) {
-    return markdownSourceResponse;
+    return applyProductionMiddlewareHeaders(markdownSourceResponse, middlewareHeaders);
   }
   ` : ""}
 
@@ -50942,35 +51600,11 @@ async function handleFarmRequestInContext(
       renderPage: (targetRequest) => handleFarmRequest(targetRequest),
     });
     if (markdownResponse) {
-      return markdownResponse;
+      return applyProductionMiddlewareHeaders(markdownResponse, middlewareHeaders);
     }
   }
   ` : ""}
 
-  ${hasMiddlewareRuntime ? `
-  const requestBeforeMiddleware = request;
-  const middlewareResult = await farmMiddlewareRunner(request);
-  if (middlewareResult.response) {
-    return middlewareResult.response;
-  }
-  request = middlewareResult.request;
-  const middlewareData = middlewareResult.data;
-  const middlewareContext = middlewareResult.context;
-  const middlewareHeaders = middlewareResult.headers;
-  url = new URL(request.url);
-  pathname = url.pathname;
-  routePathname = getFarmRoutePathname(pathname);
-
-  // Middleware may replace the Request when it rewrites a URL. Re-enter the
-  // request store so pages, layouts, and route context observe that rewritten
-  // request instead of the original outer-handler value.
-  const runResolvedRequest = async () => {
-  ` : `
-  const middlewareData = undefined;
-  const middlewareContext = undefined;
-  const middlewareHeaders = undefined;
-  `}
-
   ${apiRoutes.length > 0 ? `
   const apiResponse = await handleAPIRequest(request.clone());
   if (apiResponse) {
@@ -50978,6 +51612,31 @@ async function handleFarmRequestInContext(
   }
   ` : ""}
 
+  if (
+    farmOpenAPIReference &&
+    farmOpenAPIReference.specRoute &&
+    normalizeRuntimePath(pathname) === normalizeRuntimePath(farmOpenAPIReference.specRoute)
+  ) {
+    const method = request.method.toUpperCase();
+    const specResponse = method === "GET" || method === "HEAD"
+      ? new Response(method === "HEAD" ? null : JSON.stringify(farmOpenAPIReference.spec), {
+          status: 200,
+          headers: {
+            "Content-Type": "application/json; charset=utf-8",
+            "Cache-Control": "public, max-age=0, must-revalidate",
+            "X-Content-Type-Options": "nosniff",
+          },
+        })
+      : new Response("Method Not Allowed", {
+          status: 405,
+          headers: {
+            "Allow": "GET, HEAD",
+            "Content-Type": "text/plain; charset=utf-8",
+          },
+        });
+    return applyProductionMiddlewareHeaders(specResponse, middlewareHeaders);
+  }
+
   if (
     farmOpenAPIReference &&
     normalizeRuntimePath(pathname) === normalizeRuntimePath(farmOpenAPIReference.route)
@@ -51450,7 +52109,7 @@ async function handleFarmRequestInContext(
           }
         }
 
-        const renderedMetadata = renderMetadataHead(mergedMetadata);
+        const renderedMetadata = renderMetadataHead(mergedMetadata, { pathname, jsonLd: ${JSON.stringify(config.agent?.jsonLd ?? false)} });
         const title = renderedMetadata.title;
         const metaTags = renderedMetadata.tags;
         const hasFavicon = renderedMetadata.hasFavicon;
@@ -51826,6 +52485,30 @@ async function handleFarmRequestInContext(
 
   // 404 fallback - render proper HTML page
   emitFarmEvent({ type: "route.notFound", pathname });
+
+  // Agents that navigate in Markdown (a \`.md\` URL or \`Accept: text/markdown\`)
+  // get a Markdown error body instead of the HTML not-found shell.
+  if (farmRequestWantsMarkdown(pathname, request.headers.get("accept"))) {
+    emitFarmEvent({
+      type: "render.complete",
+      route: pathname,
+      pathname,
+      status: 404,
+      durationMs: Date.now() - requestStartTime,
+    });
+    return applyProductionMiddlewareHeaders(new Response(
+      createFarmMarkdownErrorBody(404, pathname, applyFarmBasePath("/", farmResolvedRuntimeConfig.basePath)),
+      {
+        status: 404,
+        headers: {
+          "Content-Type": FARM_MARKDOWN_CONTENT_TYPE,
+          "X-Farm-Markdown-Error": "404",
+          "Cache-Control": "no-store",
+        },
+      }
+    ), middlewareHeaders);
+  }
+
   try {
     const defaultNotFoundHomeHref = applyFarmBasePath("/", farmResolvedRuntimeConfig.basePath);
     // Default 404 page component
@@ -52065,6 +52748,9 @@ async function handleFarmFetch(request, context) {
   const healthResponse = await farmProductionLifecycle.handleHealthRequest(request);
   if (healthResponse) return healthResponse;
 
+  const productionSiteAttestation = farmProductionSiteTelemetry?.handleAttestation(request);
+  if (productionSiteAttestation) return productionSiteAttestation;
+
   farmProductionSiteTelemetry?.report(
     request.url,
     typeof context?.waitUntil === "function" ? context.waitUntil.bind(context) : undefined,
@@ -53922,29 +54608,36 @@ __name(isFormData4, "isFormData");
 // src/cache-invalidation-broadcast.ts
 init_cache_invalidation();
 var FARM_CACHE_INVALIDATION_CHANNEL = "farm:cache-invalidation";
-var activeBridge;
+var FARM_CACHE_INVALIDATION_BRIDGE = /* @__PURE__ */ Symbol.for("farm.cacheInvalidationBridge");
+var bridgeGlobal = globalThis;
 function enableCrossTabCacheInvalidation(options = {}) {
   if (typeof BroadcastChannel !== "function") return () => {
   };
   const channelName = options.channelName ?? FARM_CACHE_INVALIDATION_CHANNEL;
-  if (activeBridge) {
-    if (activeBridge.channelName !== channelName) {
+  const existing = bridgeGlobal[FARM_CACHE_INVALIDATION_BRIDGE];
+  let bridge;
+  if (existing) {
+    if (existing.channelName !== channelName) {
       throw new Error(
-        `Cross-tab cache invalidation is already enabled on channel "${activeBridge.channelName}".`
+        `Cross-tab cache invalidation is already enabled on channel "${existing.channelName}".`
       );
     }
-    activeBridge.refCount += 1;
+    existing.refCount += 1;
+    bridge = existing;
   } else {
-    activeBridge = createBridge(channelName);
+    bridge = createBridge(channelName);
+    bridgeGlobal[FARM_CACHE_INVALIDATION_BRIDGE] = bridge;
   }
   let disposed = false;
   return () => {
-    if (disposed || !activeBridge) return;
+    if (disposed) return;
     disposed = true;
-    activeBridge.refCount -= 1;
-    if (activeBridge.refCount === 0) {
-      activeBridge.teardown();
-      activeBridge = void 0;
+    bridge.refCount -= 1;
+    if (bridge.refCount === 0) {
+      bridge.teardown();
+      if (bridgeGlobal[FARM_CACHE_INVALIDATION_BRIDGE] === bridge) {
+        bridgeGlobal[FARM_CACHE_INVALIDATION_BRIDGE] = void 0;
+      }
     }
   };
 }
@@ -54152,7 +54845,7 @@ function createSink(engine) {
       scheduleFlush(engine);
     },
     onClear() {
-      if (engine.disabled) return;
+      if (engine.disabled || engine.clearing) return;
       engine.pendingSets.clear();
       engine.pendingDeletes.clear();
       void engine.adapter.clear().catch((error) => disableEngine(engine, error));
@@ -54173,7 +54866,8 @@ function initPersistedClientCache(adapter, options = {}) {
     pendingDeletes: /* @__PURE__ */ new Set(),
     flushTimer: void 0,
     hydrating: false,
-    disabled: false
+    disabled: false,
+    clearing: false
   };
   activeEngine = engine;
   engine.cache.attachPersistence(createSink(engine));
@@ -54188,6 +54882,7 @@ function disposePersistedClientCache() {
   const engine = activeEngine;
   if (!engine) return;
   activeEngine = void 0;
+  engine.disabled = true;
   engine.cache.attachPersistence(void 0);
   if (engine.flushTimer !== void 0) {
     clearTimeout(engine.flushTimer);
@@ -54199,7 +54894,18 @@ function disposePersistedClientCache() {
 __name(disposePersistedClientCache, "disposePersistedClientCache");
 async function clearPersistedCache() {
   const engine = activeEngine;
-  if (!engine) return;
+  if (!engine) {
+    getFarmClientDataCache().clear();
+    return;
+  }
+  engine.pendingSets.clear();
+  engine.pendingDeletes.clear();
+  engine.clearing = true;
+  try {
+    engine.cache.clear();
+  } finally {
+    engine.clearing = false;
+  }
   engine.pendingSets.clear();
   engine.pendingDeletes.clear();
   try {
@@ -57522,6 +58228,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   FARM_DEVTOOLS_LAUNCH_PARAM,
   FARM_DEVTOOLS_PATH,
   FARM_INTEGRATION_INTERNAL_DISPATCH_CONTEXT_KEY,
+  FARM_MARKDOWN_CONTENT_TYPE,
   FARM_SERVER_FN_FAILURE_SYMBOL,
   FARM_SERVER_FN_SYMBOL,
   FARM_SERVER_QUERY_SYMBOL,
@@ -57612,6 +58319,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   createFarmDocsAdapterHandler,
   createFarmDocsHandler,
   createFarmImageTypeDeclarations,
+  createFarmMarkdownErrorBody,
   createFarmMarkdownRouteModule,
   createFarmMarkdownRouteModuleFromFile,
   createFarmMarkdownSourceResponse,
@@ -57672,6 +58380,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   defineStorageClient,
   defineTask,
   defineWorkflow,
+  describeIntegrationOriginRejection,
   discoverFarmDocsPages,
   discoverFarmWorkflows,
   dispatchIntegrationRequest,
@@ -57684,6 +58393,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   farmApiPlugin,
   farmIntegrationSchemaToOrmSchema,
   farmMiddlewarePlugin,
+  farmRequestWantsMarkdown,
   farmRouteRuleMatches,
   fetchServerQuery,
   fileExists,
@@ -57868,6 +58578,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   resolveFarmRouteRuleRuntimeConfig,
   resolveFarmRouteRuntimeConfig,
   resolveFarmThemeConfig,
+  resolveIntegrationAllowedOrigins,
   resolveIntegrationOrmRuntimeClient,
   resolveIntegrationPlugins,
   resolveMarkdownConfig,
@@ -57928,6 +58639,7 @@ __name(decodeCookiePart, "decodeCookiePart");
   useServerFn,
   useServerQuery,
   useTheme,
+  validateIntegrationRequestOrigin,
   validateServerActionRequest,
   vercelBlobStorage,
   vercelKVStorage,