@farm.js/core 0.1.0-beta.97 → 0.1.0-beta.99

package/dist/internal/build-runtime.cjs

@@ -410,6 +410,54 @@ var init_route_pattern = __esm({
   }
 });
 
+// src/request-origin.ts
+function normalizeAllowedOriginPattern(value, label) {
+  const pattern = value.trim().toLowerCase();
+  if (!pattern) {
+    throw new TypeError(`${label} cannot contain empty values`);
+  }
+  if (pattern.includes("*")) {
+    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
+      throw new TypeError(`Invalid ${label} pattern: ${JSON.stringify(value)}`);
+    }
+    return pattern;
+  }
+  if (pattern.includes("://")) {
+    let parsed;
+    try {
+      parsed = new URL(pattern);
+    } catch {
+      throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      throw new TypeError(`${label} must contain origins without paths: ${JSON.stringify(value)}`);
+    }
+    return parsed.origin;
+  }
+  if (/[/@?#]/.test(pattern)) {
+    throw new TypeError(`${label} must contain origins or hosts: ${JSON.stringify(value)}`);
+  }
+  try {
+    return new URL(`http://${pattern}`).host;
+  } catch {
+    throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+  }
+}
+var init_request_origin = __esm({
+  "src/request-origin.ts"() {
+    "use strict";
+    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
+  }
+});
+
+// src/integration-request-security.ts
+var init_integration_request_security = __esm({
+  "src/integration-request-security.ts"() {
+    "use strict";
+    init_request_origin();
+  }
+});
+
 // src/integration-api.ts
 function defineIntegrationAPIOperation(operation) {
   return {
@@ -1426,9 +1474,13 @@ function getStorage(namespace) {
   const namespaced = (0, import_unstorage.prefixStorage)(globalStorage, base);
   return {
     ...namespaced,
-    async clear() {
-      const keys = await namespaced.getKeys();
-      await Promise.all(keys.map((key) => namespaced.removeItem(key)));
+    // Scope the wipe to the namespace instead of the whole storage, and keep
+    // the caller's base so `clear("sessions")` cannot take unrelated keys with
+    // it. Dropping the argument silently widens a targeted clear into a
+    // namespace-wide delete.
+    async clear(base2, opts) {
+      const keys = await namespaced.getKeys(base2);
+      await Promise.all(keys.map((key) => namespaced.removeItem(key, opts)));
     }
   };
 }
@@ -3456,6 +3508,7 @@ var init_integrations = __esm({
   "src/integrations.ts"() {
     "use strict";
     init_route_pattern();
+    init_integration_request_security();
     init_integration_api();
     init_plugin_integration_context();
     init_decode();
@@ -3885,6 +3938,29 @@ var init_search_params = __esm({
   }
 });
 
+// src/utils/runtime-env.ts
+function getFarmRuntimeBindings() {
+  const runtimeBindings = globalThis.__env__;
+  return runtimeBindings && typeof runtimeBindings === "object" ? runtimeBindings : void 0;
+}
+function readFarmEnvironmentValue(name2) {
+  const runtimeValue = getFarmRuntimeBindings()?.[name2];
+  if (typeof runtimeValue === "string") return runtimeValue;
+  return typeof process !== "undefined" ? process.env?.[name2] : void 0;
+}
+function isFarmDeployedRuntime() {
+  if (getFarmRuntimeBindings()) return true;
+  return readFarmEnvironmentValue("NODE_ENV") === "production";
+}
+var init_runtime_env = __esm({
+  "src/utils/runtime-env.ts"() {
+    "use strict";
+    __name(getFarmRuntimeBindings, "getFarmRuntimeBindings");
+    __name(readFarmEnvironmentValue, "readFarmEnvironmentValue");
+    __name(isFarmDeployedRuntime, "isFarmDeployedRuntime");
+  }
+});
+
 // src/utils.ts
 function parseRoutePath(filePath) {
   const segments = [];
@@ -4109,7 +4185,8 @@ function resolveWorkflowsConfig(workflows) {
     dirs,
     route: normalizeWorkflowRoute(options.route || DEFAULT_FARM_WORKFLOW_ROUTE),
     secretEnv: options.secretEnv || DEFAULT_FARM_WORKFLOW_SECRET_ENV,
-    secret: options.secret
+    secret: options.secret,
+    allowUnsecured: options.allowUnsecured === true
   };
 }
 async function discoverFarmWorkflows(config, options = {}) {
@@ -4235,8 +4312,11 @@ async function prepareFarmWorkflowsForNitro(config) {
   await fs15.mkdir(generatedDir, { recursive: true });
   const tasks = {};
   const scheduledTasks = createScheduledTasks(workflows);
+  const wrapperNames = resolveWorkflowWrapperFileNames(workflows.map((workflow) => workflow.id));
   for (const workflow of workflows) {
-    const wrapperPath = toPosixPath(path42.join(generatedDir, `${safeFileName(workflow.id)}.mjs`));
+    const wrapperPath = toPosixPath(
+      path42.join(generatedDir, `${wrapperNames.get(workflow.id)}.mjs`)
+    );
     await fs15.writeFile(wrapperPath, createNitroTaskWrapper(workflow), "utf8");
     tasks[workflow.id] = {
       handler: wrapperPath,
@@ -4474,6 +4554,7 @@ import {
 const route = ${JSON.stringify(config.route)};
 const secretEnv = ${JSON.stringify(config.secretEnv)};
 const inlineSecret = ${JSON.stringify(config.secret || "")};
+const allowUnsecured = ${JSON.stringify(config.allowUnsecured === true)};
 const bodySizeLimit = ${JSON.stringify(server.bodySizeLimit)};
 const workflows = ${JSON.stringify(workflows.map(toWorkflowMetadata))};
 const workflowIds = new Set(workflows.map((workflow) => workflow.id));
@@ -4503,7 +4584,10 @@ function getSecret() {
 
 function verifySecret(event) {
   const secret = getSecret();
-  if (!secret) return null;
+  if (!secret) {
+    if (allowUnsecured) return null;
+    return json({ error: ${JSON.stringify(MISSING_FARM_WORKFLOW_SECRET_ERROR)} }, 401);
+  }
   const authorization = getHeader(event, "authorization") || "";
   const headerSecret = getHeader(event, "x-farm-workflow-secret") || "";
   const bearer = authorization.match(/^Bearer\\s+(.+)$/i)?.[1] || "";
@@ -4597,8 +4681,16 @@ function readScheduledTime(payload) {
   return payload && typeof payload === "object" && "scheduledTime" in payload ? payload.scheduledTime : void 0;
 }
 function verifyWorkflowSecret(request, config) {
-  const secret = config.secret || process.env[config.secretEnv] || "";
-  if (!secret) return null;
+  const secret = config.secret || readFarmEnvironmentValue(config.secretEnv) || "";
+  if (!secret) {
+    if (config.allowUnsecured === true || !isFarmDeployedRuntime()) return null;
+    return Response.json(
+      {
+        error: MISSING_FARM_WORKFLOW_SECRET_ERROR
+      },
+      { status: 401 }
+    );
+  }
   const authorization = request.headers.get("authorization") || "";
   const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1] || "";
   const headerSecret = request.headers.get("x-farm-workflow-secret") || "";
@@ -4611,18 +4703,50 @@ function joinRoute(...parts) {
 function trimSlashes(value) {
   return value.replace(/^\/+|\/+$/g, "");
 }
+function resolveWorkflowWrapperFileNames(ids) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const key = safeFileName(id).toLowerCase();
+    groups.set(key, (groups.get(key) ?? 0) + 1);
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  const claimed = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const base = safeFileName(id);
+    const key = base.toLowerCase();
+    const fileName = (groups.get(key) ?? 0) > 1 ? `${key}-${workflowIdFingerprint(id)}` : base;
+    const claimedBy = claimed.get(fileName.toLowerCase());
+    if (claimedBy !== void 0) {
+      throw new Error(
+        `Farm workflows ${JSON.stringify(claimedBy)} and ${JSON.stringify(id)} generate the same wrapper file ${JSON.stringify(`${fileName}.mjs`)}. Rename one of them.`
+      );
+    }
+    claimed.set(fileName.toLowerCase(), id);
+    resolved.set(id, fileName);
+  }
+  return resolved;
+}
+function workflowIdFingerprint(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
 function safeFileName(value) {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-") || "workflow";
 }
 function relativePath(root, filePath) {
   return filePath.replace(/\\/g, "/").replace(`${root.replace(/\\/g, "/")}/`, "");
 }
-var import_node_path, DEFAULT_FARM_WORKFLOW_DIRS, DEFAULT_FARM_WORKFLOW_ROUTE, DEFAULT_FARM_WORKFLOW_SECRET_ENV;
+var import_node_path, DEFAULT_FARM_WORKFLOW_DIRS, DEFAULT_FARM_WORKFLOW_ROUTE, DEFAULT_FARM_WORKFLOW_SECRET_ENV, MISSING_FARM_WORKFLOW_SECRET_ERROR;
 var init_workflows = __esm({
   "src/workflows.ts"() {
     "use strict";
     init_server_http();
     init_search_params();
+    init_runtime_env();
     init_decode();
     init_utils();
     init_route_pattern();
@@ -4630,6 +4754,7 @@ var init_workflows = __esm({
     DEFAULT_FARM_WORKFLOW_DIRS = ["src/jobs", "src/workflows", "src/cron"];
     DEFAULT_FARM_WORKFLOW_ROUTE = "/api/_farm/workflows";
     DEFAULT_FARM_WORKFLOW_SECRET_ENV = "CRON_SECRET";
+    MISSING_FARM_WORKFLOW_SECRET_ERROR = "Workflow route requires a secret. Set the CRON_SECRET environment variable, configure workflows.secret, or set workflows.allowUnsecured to true.";
     __name(defineWorkflow, "defineWorkflow");
     __name(defineTask, "defineTask");
     __name(defineCron, "defineCron");
@@ -4662,6 +4787,8 @@ var init_workflows = __esm({
     __name(verifyWorkflowSecret, "verifyWorkflowSecret");
     __name(joinRoute, "joinRoute");
     __name(trimSlashes, "trimSlashes");
+    __name(resolveWorkflowWrapperFileNames, "resolveWorkflowWrapperFileNames");
+    __name(workflowIdFingerprint, "workflowIdFingerprint");
     __name(safeFileName, "safeFileName");
     __name(relativePath, "relativePath");
   }
@@ -4713,9 +4840,10 @@ async function prepareFarmCronForNitro(config) {
   await fs15.rm(generatedDir, { recursive: true, force: true });
   await fs15.mkdir(generatedDir, { recursive: true });
   const tasks = {};
+  const wrapperNames = resolveCronWrapperFileNames(cron.jobs.map((job) => job.name));
   for (const job of cron.jobs) {
     const taskName = getFarmCronTaskName(job.name);
-    const wrapperPath = toPosixPath(path42.join(generatedDir, `${safeFileName2(job.name)}.mjs`));
+    const wrapperPath = toPosixPath(path42.join(generatedDir, `${wrapperNames.get(job.name)}.mjs`));
     await fs15.writeFile(wrapperPath, createNitroCronTaskWrapper(job, cron.secretEnv), "utf8");
     tasks[taskName] = {
       handler: wrapperPath,
@@ -4977,6 +5105,37 @@ export default defineTask({
 });
 `.trim();
 }
+function resolveCronWrapperFileNames(names) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const name2 of names) {
+    const key = safeFileName2(name2).toLowerCase();
+    groups.set(key, (groups.get(key) ?? 0) + 1);
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  const claimed = /* @__PURE__ */ new Map();
+  for (const name2 of names) {
+    const base = safeFileName2(name2);
+    const key = base.toLowerCase();
+    const fileName = (groups.get(key) ?? 0) > 1 ? `${key}-${cronNameFingerprint(name2)}` : base;
+    const claimedBy = claimed.get(fileName.toLowerCase());
+    if (claimedBy !== void 0) {
+      throw new Error(
+        `Farm cron jobs ${JSON.stringify(claimedBy)} and ${JSON.stringify(name2)} generate the same wrapper file ${JSON.stringify(`${fileName}.mjs`)}. Rename one of them.`
+      );
+    }
+    claimed.set(fileName.toLowerCase(), name2);
+    resolved.set(name2, fileName);
+  }
+  return resolved;
+}
+function cronNameFingerprint(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
 function safeFileName2(value) {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-") || "cron";
 }
@@ -4985,6 +5144,7 @@ var init_cron = __esm({
   "src/cron.ts"() {
     "use strict";
     init_utils();
+    init_runtime_env();
     DEFAULT_FARM_CRON_SECRET_ENV = "CRON_SECRET";
     FARM_CRON_MANIFEST = "cron-manifest.json";
     CRON_FIELD_RANGES = [
@@ -5013,6 +5173,8 @@ var init_cron = __esm({
     __name(mergeTaskNames, "mergeTaskNames");
     __name(getFarmCronTaskName, "getFarmCronTaskName");
     __name(createNitroCronTaskWrapper, "createNitroCronTaskWrapper");
+    __name(resolveCronWrapperFileNames, "resolveCronWrapperFileNames");
+    __name(cronNameFingerprint, "cronNameFingerprint");
     __name(safeFileName2, "safeFileName");
   }
 });
@@ -5604,7 +5766,9 @@ var init_server_fn_error = __esm({
 
 // src/server-action-security.ts
 function resolveServerActionsConfig(config) {
-  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);
+  const allowedOrigins = (config?.allowedOrigins ?? []).map(
+    (value) => normalizeAllowedOriginPattern(value, SERVER_ACTION_ALLOWED_ORIGINS_LABEL)
+  );
   const bodySizeLimit = parseBodySizeLimit(
     config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,
     "serverActions.bodySizeLimit"
@@ -5624,50 +5788,16 @@ function getServerActionStorage() {
   }
   return globalState2[SERVER_ACTION_STORAGE_KEY];
 }
-function normalizeAllowedOriginPattern(value) {
-  const pattern = value.trim().toLowerCase();
-  if (!pattern) {
-    throw new TypeError("serverActions.allowedOrigins cannot contain empty values");
-  }
-  if (pattern.includes("*")) {
-    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
-      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);
-    }
-    return pattern;
-  }
-  if (pattern.includes("://")) {
-    let parsed;
-    try {
-      parsed = new URL(pattern);
-    } catch {
-      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-      throw new TypeError(
-        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`
-      );
-    }
-    return parsed.origin;
-  }
-  if (/[/@?#]/.test(pattern)) {
-    throw new TypeError(
-      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`
-    );
-  }
-  try {
-    return new URL(`http://${pattern}`).host;
-  } catch {
-    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-  }
-}
-var import_node_async_hooks, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, SERVER_ACTION_STORAGE_KEY;
+var import_node_async_hooks, SERVER_ACTION_ALLOWED_ORIGINS_LABEL, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, SERVER_ACTION_STORAGE_KEY;
 var init_server_action_security = __esm({
   "src/server-action-security.ts"() {
     "use strict";
     import_node_async_hooks = require("async_hooks");
     init_cache_invalidation();
+    init_request_origin();
     init_server_fn_error();
     init_server_http();
+    SERVER_ACTION_ALLOWED_ORIGINS_LABEL = "serverActions.allowedOrigins";
     DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1e6;
     SERVER_ACTION_STORAGE_KEY = /* @__PURE__ */ Symbol.for("farm.serverActionStorage");
     __name(resolveServerActionsConfig, "resolveServerActionsConfig");
@@ -5679,7 +5809,6 @@ var init_server_action_security = __esm({
       getServerActionExecutionContext()?.cacheTasks.add(task);
     });
     __name(getServerActionStorage, "getServerActionStorage");
-    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
   }
 });
 
@@ -7121,6 +7250,51 @@ var init_config2 = __esm({
   }
 });
 
+// src/agent-config.ts
+function resolveFarmAgentConfig(input) {
+  const jsonLd = input?.jsonLd;
+  if (!jsonLd) return { jsonLd: false };
+  return { jsonLd: jsonLd === true ? {} : jsonLd };
+}
+function pruneUndefined(object) {
+  const result = {};
+  for (const [key, value] of Object.entries(object)) {
+    if (value !== void 0 && value !== null && value !== "") result[key] = value;
+  }
+  return result;
+}
+function serializeJsonLd(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+function renderFarmAgentJsonLd(config, context2) {
+  const base = pruneUndefined({
+    name: config.name ?? context2.siteName ?? context2.title,
+    url: config.url ?? context2.metadataBase,
+    description: config.description ?? context2.description,
+    logo: config.logo,
+    sameAs: config.sameAs && config.sameAs.length > 0 ? config.sameAs : void 0
+  });
+  const object = {
+    "@context": "https://schema.org",
+    "@type": config.type || "Organization",
+    ...base,
+    ...config.properties || {}
+  };
+  if (Object.keys(object).length <= 2 && !config.properties) {
+    return "";
+  }
+  return `<script type="application/ld+json">${serializeJsonLd(object)}</script>`;
+}
+var init_agent_config = __esm({
+  "src/agent-config.ts"() {
+    "use strict";
+    __name(resolveFarmAgentConfig, "resolveFarmAgentConfig");
+    __name(pruneUndefined, "pruneUndefined");
+    __name(serializeJsonLd, "serializeJsonLd");
+    __name(renderFarmAgentJsonLd, "renderFarmAgentJsonLd");
+  }
+});
+
 // src/renderer.ts
 function getFarmRendererCapabilities(renderer) {
   return {
@@ -7886,6 +8060,7 @@ async function resolveConfig(userConfig, mode) {
   const openapi = {
     enabled: false,
     route: "/docs/reference",
+    specRoute: "/openapi.json",
     title: "API Documentation",
     description: "Auto-generated API documentation",
     version: "1.0.0",
@@ -7893,6 +8068,7 @@ async function resolveConfig(userConfig, mode) {
     ...userConfig.openapi
   };
   if (openapi.route !== void 0) validateConfigRouteSource(openapi.route, "openapi.route");
+  if (openapi.specRoute) validateConfigRouteSource(openapi.specRoute, "openapi.specRoute");
   const resolved = {
     [FARM_RESOLVED_CUSTOM_CONTEXT]: typeof userConfig.context === "function",
     root,
@@ -7925,6 +8101,7 @@ async function resolveConfig(userConfig, mode) {
       ppr: false,
       ...userConfig.experimental
     },
+    agent: resolveFarmAgentConfig(userConfig.agent),
     plugins: [...resolveIntegrationPlugins(integrations), ...userConfig.plugins || []],
     integrations,
     trailingSlash: userConfig.trailingSlash ?? false,
@@ -8033,6 +8210,7 @@ var init_config4 = __esm({
     init_security();
     init_navigation_errors();
     init_config2();
+    init_agent_config();
     init_renderer();
     init_framework_detect();
     init_config3();
@@ -10909,6 +11087,18 @@ var init_routes_server = __esm({
 function isFarmMarkdownPageFile(filePath) {
   return /(^|[/\\])page\.mdx?$/i.test(filePath);
 }
+function farmRequestWantsMarkdown(pathname, accept) {
+  return pathname.toLowerCase().endsWith(".md") || requestAcceptsMarkdown(accept);
+}
+function createFarmMarkdownErrorBody(status, pathname, homeHref = "/") {
+  const heading = status === 404 ? "Page not found" : `Request failed (${status})`;
+  return `# ${heading}
+
+No page is available at \`${pathname}\`. The URL may be incorrect, or the page has not been published.
+
+Browse [the site homepage](${homeHref}) to find available pages.
+`;
+}
 function normalizeFarmMarkdownRoutePath(pathname) {
   const withoutExtension = pathname.replace(/\.md$/i, "");
   const normalized = withoutExtension.startsWith("/") ? withoutExtension : `/${withoutExtension}`;
@@ -11052,7 +11242,7 @@ async function createFarmMarkdownSourceResponse(options) {
     headers
   });
 }
-var import_promises4, import_path4, import_url;
+var import_promises4, import_path4, import_url, FARM_MARKDOWN_CONTENT_TYPE;
 var init_app_markdown = __esm({
   "src/app-markdown.ts"() {
     "use strict";
@@ -11062,6 +11252,9 @@ var init_app_markdown = __esm({
     init_markdown();
     init_app_markdown_config();
     __name(isFarmMarkdownPageFile, "isFarmMarkdownPageFile");
+    FARM_MARKDOWN_CONTENT_TYPE = "text/markdown; charset=utf-8";
+    __name(farmRequestWantsMarkdown, "farmRequestWantsMarkdown");
+    __name(createFarmMarkdownErrorBody, "createFarmMarkdownErrorBody");
     __name(normalizeFarmMarkdownRoutePath, "normalizeFarmMarkdownRoutePath");
     __name(parseMarkdownFrontmatter, "parseMarkdownFrontmatter");
     __name(titleFromMarkdown, "titleFromMarkdown");
@@ -11569,6 +11762,39 @@ function getStaticImportBindings(content) {
   }
   return bindings;
 }
+function findParserSensitiveJsxContainer(content, localBindings) {
+  if (!content || localBindings.length === 0) return void 0;
+  const names = new Set(localBindings);
+  const tokens = tokenizeModuleSource(content);
+  const openDepth = /* @__PURE__ */ new Map();
+  const isSelfClosing = /* @__PURE__ */ __name((openingIndex) => {
+    for (let index = openingIndex; index < tokens.length; index++) {
+      if (tokens[index].value === ">") return tokens[index - 1]?.value === "/";
+    }
+    return false;
+  }, "isSelfClosing");
+  for (let index = 0; index < tokens.length - 1; index++) {
+    if (tokens[index].value !== "<") continue;
+    if (tokens[index + 1].value === "/") {
+      const closing = tokens[index + 2]?.value;
+      if (closing && openDepth.has(closing)) {
+        openDepth.set(closing, Math.max(0, (openDepth.get(closing) ?? 0) - 1));
+      }
+      continue;
+    }
+    const tag = tokens[index + 1].value;
+    if (names.has(tag)) {
+      for (const [container, depth] of openDepth) {
+        if (depth > 0) return container;
+      }
+      continue;
+    }
+    if (PARSER_SENSITIVE_JSX_CONTAINERS.has(tag) && !isSelfClosing(index)) {
+      openDepth.set(tag, (openDepth.get(tag) ?? 0) + 1);
+    }
+  }
+  return void 0;
+}
 function countStaticJsxUses(content, localBindings) {
   if (!content || localBindings.length === 0) return 0;
   const names = new Set(localBindings);
@@ -11677,6 +11903,36 @@ function getClientRenderingHelpers(tokens, clientBindings) {
   }
   return helpers;
 }
+function passesElementValuedProps(content, localBindings) {
+  if (!content || localBindings.length === 0) return false;
+  const names = new Set(localBindings);
+  const tokens = tokenizeModuleSource(content);
+  for (let index = 0; index < tokens.length - 1; index++) {
+    if (tokens[index].value !== "<" || !names.has(tokens[index + 1].value)) continue;
+    const name2 = tokens[index + 1].value;
+    let cursor = index + 2;
+    let braceDepth = 0;
+    let selfClosing = false;
+    for (; cursor < tokens.length; cursor++) {
+      const value = tokens[cursor].value;
+      if (value === "{") braceDepth++;
+      else if (value === "}") braceDepth--;
+      else if (value === "<" && braceDepth > 0) return true;
+      else if (value === ">" && braceDepth === 0) {
+        selfClosing = tokens[cursor - 1]?.value === "/";
+        break;
+      }
+    }
+    if (selfClosing || cursor >= tokens.length) continue;
+    for (let child = cursor + 1; child < tokens.length; child++) {
+      if (tokens[child].value !== "<") continue;
+      const closesBoundary = tokens[child + 1]?.value === "/" && tokens[child + 2]?.value === name2;
+      if (!closesBoundary) return true;
+      break;
+    }
+  }
+  return false;
+}
 function hasDynamicJsxCardinality(content, localBindings) {
   if (!content || localBindings.length === 0) return false;
   const clientBindings = new Set(localBindings);
@@ -11758,6 +12014,17 @@ function collectIsolatedClientBoundaries(ownerPath, root) {
       if (fallbackReason || importedBoundaryCount === 0) continue;
       const localBindings = importedBindings.get(specifier) ?? [];
       const staticUses = countStaticJsxUses(content, localBindings);
+      if (staticUses > 0) {
+        const container = findParserSensitiveJsxContainer(content, localBindings);
+        if (container) {
+          fallbackReason = `the client boundary imported from ${specifier} renders inside <${container}>, where the HTML parser relocates its hydration marker`;
+          return 0;
+        }
+        if (passesElementValuedProps(content, localBindings)) {
+          fallbackReason = `the client boundary imported from ${specifier} receives React elements, which cannot cross the boundary as serialized props`;
+          return 0;
+        }
+      }
       if (staticUses > 0 && hasDynamicJsxCardinality(content, localBindings)) {
         fallbackReason = `the client boundary count imported from ${specifier} is data-dependent`;
         costGuardExceeded = true;
@@ -12054,7 +12321,7 @@ function resolveSourceCandidate(candidates) {
   }
   return null;
 }
-var import_fs2, import_path5, import_url2, FARM_ISOLATED_HYDRATION_MAX_BOUNDARIES, RESOLVABLE_SOURCE_EXTENSIONS, REGEXP_PREFIX_PUNCTUATION, REGEXP_PREFIX_KEYWORDS;
+var import_fs2, import_path5, import_url2, FARM_ISOLATED_HYDRATION_MAX_BOUNDARIES, RESOLVABLE_SOURCE_EXTENSIONS, REGEXP_PREFIX_PUNCTUATION, REGEXP_PREFIX_KEYWORDS, PARSER_SENSITIVE_JSX_CONTAINERS;
 var init_client_component = __esm({
   "src/utils/client-component.ts"() {
     "use strict";
@@ -12132,11 +12399,23 @@ var init_client_component = __esm({
     __name(enforceFarmIsolatedHydrationRouteBudget, "enforceFarmIsolatedHydrationRouteBudget");
     __name(isIsolatableClientBoundarySource, "isIsolatableClientBoundarySource");
     __name(getStaticImportBindings, "getStaticImportBindings");
+    PARSER_SENSITIVE_JSX_CONTAINERS = /* @__PURE__ */ new Set([
+      "table",
+      "thead",
+      "tbody",
+      "tfoot",
+      "tr",
+      "select",
+      "optgroup",
+      "svg"
+    ]);
+    __name(findParserSensitiveJsxContainer, "findParserSensitiveJsxContainer");
     __name(countStaticJsxUses, "countStaticJsxUses");
     __name(findMatchingToken, "findMatchingToken");
     __name(containsClientJsx, "containsClientJsx");
     __name(findStatementEnd, "findStatementEnd");
     __name(getClientRenderingHelpers, "getClientRenderingHelpers");
+    __name(passesElementValuedProps, "passesElementValuedProps");
     __name(hasDynamicJsxCardinality, "hasDynamicJsxCardinality");
     __name(collectIsolatedClientBoundaries, "collectIsolatedClientBoundaries");
     __name(inspectClientModuleMetadata, "inspectClientModuleMetadata");
@@ -13779,7 +14058,7 @@ function addMetadataImageReference(metadata, reference) {
     twitter
   };
 }
-function renderMetadataHead(metadata) {
+function renderMetadataHead(metadata, options = {}) {
   const resolvedMetadata = metadata || {};
   const metadataBase = resolveMetadataBase(resolvedMetadata);
   const explicitTitle = resolveMetadataTitle(resolvedMetadata.title);
@@ -13800,14 +14079,16 @@ function renderMetadataHead(metadata) {
   appendMetaName(tags, "publisher", resolvedMetadata.publisher);
   appendMetaName(tags, "robots", normalizeRobots(resolvedMetadata.robots));
   const alternates = resolvedMetadata.alternates;
-  if (isRecord3(alternates)) {
-    appendLink(tags, "canonical", resolveMetadataUrl(alternates.canonical, metadataBase));
-    if (isRecord3(alternates.languages)) {
-      for (const [language, href] of Object.entries(alternates.languages)) {
-        appendLink(tags, "alternate", resolveMetadataUrl(href, metadataBase), {
-          hreflang: language
-        });
-      }
+  const explicitCanonical = isRecord3(alternates) ? alternates.canonical : void 0;
+  const canonicalHref = explicitCanonical != null ? resolveMetadataUrl(explicitCanonical, metadataBase) : options.pathname ? resolveMetadataUrl(options.pathname, metadataBase) : void 0;
+  if (canonicalHref) {
+    appendLink(tags, "canonical", canonicalHref);
+  }
+  if (isRecord3(alternates) && isRecord3(alternates.languages)) {
+    for (const [language, href] of Object.entries(alternates.languages)) {
+      appendLink(tags, "alternate", resolveMetadataUrl(href, metadataBase), {
+        hreflang: language
+      });
     }
   }
   const hasFavicon = appendIcons(tags, resolvedMetadata.icons, metadataBase);
@@ -13820,6 +14101,16 @@ function renderMetadataHead(metadata) {
   }
   appendOpenGraph(tags, resolvedMetadata.openGraph, metadataBase);
   appendTwitter(tags, resolvedMetadata.twitter, metadataBase);
+  if (options.jsonLd) {
+    const jsonLdConfig = options.jsonLd === true ? {} : options.jsonLd;
+    const jsonLdScript = renderFarmAgentJsonLd(jsonLdConfig, {
+      metadataBase,
+      siteName: isRecord3(resolvedMetadata.openGraph) ? normalizeContent(resolvedMetadata.openGraph.siteName) : void 0,
+      title: explicitTitle,
+      description: normalizeContent(resolvedMetadata.description)
+    });
+    if (jsonLdScript) tags.push(jsonLdScript);
+  }
   return {
     title: escapeText(title),
     tags: tags.length > 0 ? `
@@ -13843,7 +14134,7 @@ function appendOpenGraph(tags, openGraph, metadataBase) {
   appendMetaProperty(tags, "og:description", openGraph.description);
   appendMetaProperty(tags, "og:url", resolveMetadataUrl(openGraph.url, metadataBase));
   appendMetaProperty(tags, "og:site_name", openGraph.siteName);
-  appendMetaProperty(tags, "og:type", openGraph.type);
+  appendMetaProperty(tags, "og:type", openGraph.type ?? "website");
   appendMetaProperty(tags, "og:locale", openGraph.locale);
   const images = normalizeMetadataImages(
     openGraph.images ?? openGraph.image,
@@ -14006,6 +14297,7 @@ function escapeAttribute(value) {
 var init_metadata = __esm({
   "src/metadata.ts"() {
     "use strict";
+    init_agent_config();
     __name(mergeMetadata, "mergeMetadata");
     __name(mergeMetadataTitle, "mergeMetadataTitle");
     __name(applyTitleTemplate, "applyTitleTemplate");
@@ -17097,7 +17389,7 @@ var init_server3 = __esm({
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.1.0-beta.97";
+    version = "0.1.0-beta.99";
   }
 });
 
@@ -17352,6 +17644,12 @@ function hasRequestHeader(req, name2) {
   const value = req.headers[name2.toLowerCase()];
   return Array.isArray(value) ? value.length > 0 : Boolean(value);
 }
+function getFarmMetadataPathname(req) {
+  const raw = req.__FARM_ROUTE__ || req.url;
+  if (typeof raw !== "string" || raw.length === 0) return void 0;
+  const boundary = raw.search(/[?#]/);
+  return boundary === -1 ? raw : raw.slice(0, boundary);
+}
 function serializeInlineValue2(value) {
   return JSON.stringify(value).replace(/</g, "\\u003c").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
@@ -17500,6 +17798,7 @@ var init_renderer2 = __esm({
     init_server();
     init_request_context();
     init_ssg();
+    init_app_markdown();
     init_integrations();
     init_request();
     init_cache();
@@ -17541,6 +17840,7 @@ var init_renderer2 = __esm({
     warnedFullDocumentLayout = false;
     __name(warnFarmFullDocumentLayout, "warnFarmFullDocumentLayout");
     __name(hasRequestHeader, "hasRequestHeader");
+    __name(getFarmMetadataPathname, "getFarmMetadataPathname");
     __name(serializeInlineValue2, "serializeInlineValue");
     __name(escapeHtmlAttribute2, "escapeHtmlAttribute");
     __name(appendResponseHeader, "appendResponseHeader");
@@ -17940,7 +18240,21 @@ var init_renderer2 = __esm({
               const html = await this.rendererRuntime.renderToString(
                 await this.wrapWithIntegrationProviders(pageElement)
               );
-              await this.cacheSSGPage(page2, html, { document: false });
+              const mergedMetadata = await this.resolveRouteMetadata({
+                layoutModules,
+                routeModule: mod,
+                pageProps,
+                pathname: page2.urlPath
+              });
+              const { title, tags, hasFavicon } = renderMetadataHead(mergedMetadata);
+              const metadataHead = `${hasFavicon ? "" : '<link rel="icon" href="data:,">\n  '}<title>${title}</title>${tags}`;
+              const fullDocument = this.createFullHTML(
+                html,
+                pageMetadata.shouldHydrate === true,
+                page2.urlPath,
+                metadataHead
+              );
+              await this.cacheSSGPage(page2, fullDocument, { document: true });
               logger.info(`ISR: Regenerated ${page2.urlPath}`);
             } catch (error) {
               logger.error(`ISR regeneration failed for ${page2.urlPath}: ${error}`);
@@ -18980,7 +19294,10 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
             tags: metaTags,
             hasFavicon,
             hasExplicitTitle
-          } = renderMetadataHead(req.__FARM_METADATA__);
+          } = renderMetadataHead(req.__FARM_METADATA__, {
+            pathname: getFarmMetadataPathname(req),
+            jsonLd: this.config.agent?.jsonLd
+          });
           const documentTitleTag = !hasExplicitTitle && /<title[\s>]/i.test(rendererHead) ? "" : `<title>${title}</title>`;
           const i18nSnapshot = getFarmI18nClientSnapshot();
           const alternateTags = i18nSnapshot ? renderI18nAlternateLinks(req.__FARM_ROUTE__ || req.url || "/", i18nSnapshot) : "";
@@ -19165,7 +19482,10 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
             title,
             tags: metaTags,
             hasFavicon
-          } = renderMetadataHead(req.__FARM_METADATA__);
+          } = renderMetadataHead(req.__FARM_METADATA__, {
+            pathname: getFarmMetadataPathname(req),
+            jsonLd: this.config.agent?.jsonLd
+          });
           const i18nSnapshot = getFarmI18nClientSnapshot();
           const i18nAlternateTags = i18nSnapshot ? renderI18nAlternateLinks(req.__FARM_ROUTE__ || req.url || "/", i18nSnapshot) : "";
           const fontHead = renderFarmFontDevHead(this.config.root || process.cwd());
@@ -19323,6 +19643,15 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
         const pathname = resolveFarmRequestURL(req, {
           trustProxy: this.config.server?.trustProxy
         }).pathname;
+        const acceptHeader = req.headers.accept;
+        const accept = Array.isArray(acceptHeader) ? acceptHeader.join(",") : acceptHeader;
+        if (farmRequestWantsMarkdown(pathname, accept)) {
+          res.setHeader("Content-Type", FARM_MARKDOWN_CONTENT_TYPE);
+          res.setHeader("X-Farm-Markdown-Error", "404");
+          res.setHeader("Cache-Control", "no-store");
+          res.end(createFarmMarkdownErrorBody(404, pathname, this.config.basePath || "/"));
+          return;
+        }
         try {
           const appDir = path15.join(this.config.root, this.config.srcDir, "app");
           const notFoundExtensions = getFarmRendererComponentExtensions(this.config.renderer);
@@ -19408,7 +19737,7 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
         res.write(html);
         res.end();
       }
-      createFullHTML(content, isClientComponent = false, requestPath = "/", documentTitle = "Farm.js App") {
+      createFullHTML(content, isClientComponent = false, requestPath = "/", metadataHead) {
         const i18nSnapshot = getFarmI18nClientSnapshot();
         const clientScript = isClientComponent ? `  <script type="module" src="/@farm/client.js"></script>` : "";
         const integrationManifestScript = `<script>
@@ -19432,6 +19761,7 @@ ${i18nSnapshot ? `window.__FARM_I18N__ = ${serializeInlineValue2(i18nSnapshot)};
             headAssets: [
               themeDocument.head,
               `<meta name="farm-deployment-id" content="${escapeHtmlAttribute2(this.getDeploymentId())}">`,
+              metadataHead,
               alternateLinks,
               fontHead,
               `<link rel="stylesheet" href="/src/app/globals.css" />`,
@@ -19450,8 +19780,7 @@ ${i18nSnapshot ? `window.__FARM_I18N__ = ${serializeInlineValue2(i18nSnapshot)};
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <meta name="farm-deployment-id" content="${escapeHtmlAttribute2(this.getDeploymentId())}">
-  <link rel="icon" href="data:,">
-  <title>${escapeHtmlAttribute2(documentTitle)}</title>${alternateLinks}
+  ${metadataHead ?? '<link rel="icon" href="data:,">\n  <title>Farm.js App</title>'}${alternateLinks}
   ${fontHead}
   <link rel="stylesheet" href="/src/app/globals.css" />${this.collectDevStyleLinks().map((l) => `
   ${l}`).join("")}
@@ -19658,6 +19987,7 @@ var init_app = __esm({
             ppr: config.experimental?.ppr ?? false,
             ...config.experimental
           },
+          agent: config.agent ?? {},
           vite: config.vite || {}
         };
       }
@@ -25109,6 +25439,116 @@ var init_server_query_boundary = __esm({
   }
 });
 
+// src/client-boundary-env.ts
+function shouldInspectClientBoundary(id, code) {
+  if (id.startsWith("\0") || id.startsWith("virtual:") || id.includes("node_modules")) return false;
+  return code.includes("process.env") || code.includes("node:");
+}
+function analyzeClientBoundary(program, publicKeys) {
+  const envKeys = /* @__PURE__ */ new Set();
+  const publicEnvKeys = /* @__PURE__ */ new Set();
+  const builtinImports = /* @__PURE__ */ new Set();
+  const visit = /* @__PURE__ */ __name((node, inFunction) => {
+    if (!node || typeof node !== "object") return;
+    if (Array.isArray(node)) {
+      for (const entry of node) visit(entry, inFunction);
+      return;
+    }
+    const estree = node;
+    if (typeof estree.type !== "string") return;
+    if (!inFunction) {
+      const builtin = readNodeBuiltinSource(estree);
+      if (builtin !== void 0) builtinImports.add(builtin);
+      const key = readProcessEnvKey(estree);
+      if (key !== void 0) {
+        if (key !== "NODE_ENV") {
+          (publicKeys.has(key) ? publicEnvKeys : envKeys).add(key);
+        }
+        return;
+      }
+    }
+    const nextInFunction = inFunction || FUNCTION_BODY_TYPES.has(estree.type);
+    for (const [childKey, value] of Object.entries(estree)) {
+      if (childKey === "type") continue;
+      visit(value, nextInFunction);
+    }
+  }, "visit");
+  visit(program.body, false);
+  return {
+    envKeys: [...envKeys],
+    publicEnvKeys: [...publicEnvKeys],
+    builtinImports: [...builtinImports]
+  };
+}
+function readNodeBuiltinSource(node) {
+  if (node.type === "ImportDeclaration" || node.type === "ExportNamedDeclaration" || node.type === "ExportAllDeclaration" || node.type === "ImportExpression") {
+    const value = node.source?.value;
+    return typeof value === "string" && value.startsWith("node:") ? value : void 0;
+  }
+  if (node.type === "CallExpression") {
+    const callee = node.callee;
+    if (callee?.type === "Identifier" && callee.name === "require") {
+      const arg = node.arguments?.[0];
+      const value = arg?.type === "Literal" ? arg.value : void 0;
+      return typeof value === "string" && value.startsWith("node:") ? value : void 0;
+    }
+  }
+  return void 0;
+}
+function readProcessEnvKey(node) {
+  if (node.type !== "MemberExpression") return void 0;
+  const object = node.object;
+  if (!object || object.type !== "MemberExpression" || object.object?.type !== "Identifier" || object.object.name !== "process" || object.property?.name !== "env") {
+    return void 0;
+  }
+  const property = node.property;
+  if (!property) return void 0;
+  if (!node.computed && property.type === "Identifier") {
+    return property.name;
+  }
+  if (node.computed && property.type === "Literal") {
+    const value = property.value;
+    return typeof value === "string" ? value : void 0;
+  }
+  return void 0;
+}
+function formatClientBoundaryWarning(id, findings) {
+  const { envKeys, publicEnvKeys, builtinImports } = findings;
+  const lines = [`${id} is compiled for the client but uses server-only APIs:`];
+  if (envKeys.length > 0) {
+    lines.push(
+      `- module-scope read of process.env.${envKeys.join(", process.env.")} \u2014 undefined in the browser. Move the read behind a server boundary, or expose it through env.public in farm.config.ts.`
+    );
+  }
+  if (publicEnvKeys.length > 0) {
+    lines.push(
+      `- module-scope read of process.env.${publicEnvKeys.join(", process.env.")} \u2014 process.env is not populated in the browser even for public keys. Read it through publicEnv from "@farm.js/core/env".`
+    );
+  }
+  if (builtinImports.length > 0) {
+    lines.push(
+      `- import of ${builtinImports.join(", ")} \u2014 stubbed with an empty object in the browser. Move the import into server-only code.`
+    );
+  }
+  return lines.join("\n");
+}
+var FUNCTION_BODY_TYPES;
+var init_client_boundary_env = __esm({
+  "src/client-boundary-env.ts"() {
+    "use strict";
+    FUNCTION_BODY_TYPES = /* @__PURE__ */ new Set([
+      "FunctionDeclaration",
+      "FunctionExpression",
+      "ArrowFunctionExpression"
+    ]);
+    __name(shouldInspectClientBoundary, "shouldInspectClientBoundary");
+    __name(analyzeClientBoundary, "analyzeClientBoundary");
+    __name(readNodeBuiltinSource, "readNodeBuiltinSource");
+    __name(readProcessEnvKey, "readProcessEnvKey");
+    __name(formatClientBoundaryWarning, "formatClientBoundaryWarning");
+  }
+});
+
 // src/image-vite.ts
 function farmImageImportsPlugin() {
   return {
@@ -25204,6 +25644,7 @@ var init_font = __esm({
 function createFarmImageHandler(config, options) {
   const fetcher = options.fetch ?? globalThis.fetch;
   const cache = new FarmImageMemoryCache(options.cacheEntries ?? 100);
+  const inflight = /* @__PURE__ */ new Map();
   const allowedWidths = /* @__PURE__ */ new Set([...config.deviceSizes, ...config.imageSizes]);
   const allowedQualities = new Set(config.qualities);
   return /* @__PURE__ */ __name(async function handleFarmImage(request) {
@@ -25232,50 +25673,55 @@ function createFarmImageHandler(config, options) {
         "quality"
       );
       const accept = request.headers.get("accept") ?? "";
+      const negotiatedFormat = selectOutputFormat(accept, config.formats) ?? "";
       const cacheKey = `${sourceUrl.href}
 ${width}
 ${quality}
-${accept}`;
+${negotiatedFormat}`;
       let optimized = cache.get(cacheKey);
       if (!optimized) {
-        const fetchedSource = await fetchImageSource(
-          sourceUrl,
-          requestUrl.origin,
-          config,
-          fetcher,
-          options.fetchRemote,
-          options.validateRemoteUrl,
-          request.signal
-        );
-        const source = await readResponseWithLimit(
-          fetchedSource.response,
-          config.maximumResponseBody
-        );
-        const sourceType = detectImageContentType(source);
-        validateSourceType(sourceType, config);
-        throwIfAborted2(request.signal);
-        const result = await options.transform({
-          source,
-          sourceUrl: fetchedSource.url,
-          sourceType,
-          width,
-          quality,
-          accept,
-          formats: config.formats,
-          signal: request.signal
+        optimized = await runCoalesced(inflight, cacheKey, request.signal, async (signal) => {
+          const fetchedSource = await fetchImageSource(
+            sourceUrl,
+            requestUrl.origin,
+            config,
+            fetcher,
+            options.fetchRemote,
+            options.validateRemoteUrl,
+            signal
+          );
+          const source = await readResponseWithLimit(
+            fetchedSource.response,
+            config.maximumResponseBody
+          );
+          const sourceType = detectImageContentType(source);
+          validateSourceType(sourceType, config);
+          throwIfAborted2(signal);
+          const result = await options.transform({
+            source,
+            sourceUrl: fetchedSource.url,
+            sourceType,
+            width,
+            quality,
+            accept,
+            formats: config.formats,
+            signal,
+            maximumResponseBody: config.maximumResponseBody
+          });
+          throwIfAborted2(signal);
+          validateTransformedResult(result, config);
+          const entry = {
+            ...result,
+            etag: createImageEtag(result.body),
+            cacheControl: `public, max-age=${config.minimumCacheTTL}, stale-while-revalidate=${Math.max(
+              config.minimumCacheTTL,
+              60
+            )}`,
+            expiresAt: Date.now() + config.minimumCacheTTL * 1e3
+          };
+          cache.set(cacheKey, entry);
+          return entry;
         });
-        throwIfAborted2(request.signal);
-        validateTransformedResult(result, config);
-        optimized = {
-          ...result,
-          etag: createImageEtag(result.body),
-          cacheControl: `public, max-age=${config.minimumCacheTTL}, stale-while-revalidate=${Math.max(
-            config.minimumCacheTTL,
-            60
-          )}`,
-          expiresAt: Date.now() + config.minimumCacheTTL * 1e3
-        };
-        cache.set(cacheKey, optimized);
       }
       return createOptimizedImageResponse(request, optimized, config);
     } catch (error) {
@@ -25426,6 +25872,44 @@ async function fetchImageSource(initialUrl, requestOrigin, config, fetcher, fetc
     await validateImageSourceUrl(currentUrl, requestOrigin, config, validateRemoteUrl);
   }
 }
+async function runCoalesced(inflight, key, requestSignal, run) {
+  let entry = inflight.get(key);
+  if (!entry) {
+    const controller = new AbortController();
+    const created = {
+      controller,
+      waiters: 0,
+      promise: void 0
+    };
+    created.promise = run(controller.signal).finally(() => {
+      if (inflight.get(key) === created) inflight.delete(key);
+    });
+    created.promise.catch(() => {
+    });
+    inflight.set(key, created);
+    entry = created;
+  }
+  const pending = entry;
+  pending.waiters += 1;
+  try {
+    return await raceRequestAbort(pending.promise, requestSignal);
+  } finally {
+    pending.waiters -= 1;
+    if (pending.waiters === 0 && inflight.get(key) === pending) {
+      inflight.delete(key);
+      pending.controller.abort();
+    }
+  }
+}
+function raceRequestAbort(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) return Promise.reject(signal.reason ?? new Error("Aborted"));
+  return new Promise((resolve10, reject) => {
+    const onAbort = /* @__PURE__ */ __name(() => reject(signal.reason ?? new Error("Aborted")), "onAbort");
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(resolve10, reject).finally(() => signal.removeEventListener("abort", onAbort));
+  });
+}
 async function readResponseWithLimit(response, limit) {
   const contentLength = response.headers.get("content-length");
   if (contentLength && Number(contentLength) > limit) {
@@ -25593,7 +26077,7 @@ function throwIfAborted2(signal) {
 function isAbortError(error) {
   return error instanceof Error && error.name === "AbortError";
 }
-var _FarmImageRequestError, FarmImageRequestError, _FarmImageMemoryCache, FarmImageMemoryCache;
+var _FarmImageRequestError, FarmImageRequestError, DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT, _FarmImageMemoryCache, FarmImageMemoryCache;
 var init_image_server = __esm({
   "src/image-server.ts"() {
     "use strict";
@@ -25609,12 +26093,15 @@ var init_image_server = __esm({
     __name(_FarmImageRequestError, "FarmImageRequestError");
     FarmImageRequestError = _FarmImageRequestError;
     __name(createFarmImageHandler, "createFarmImageHandler");
+    DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT = 10 * 1024 * 1024;
     __name(selectOutputFormat, "selectOutputFormat");
     __name(isPrivateImageAddress, "isPrivateImageAddress");
     __name(parseAllowedInteger, "parseAllowedInteger");
     __name(resolveImageSourceUrl, "resolveImageSourceUrl");
     __name(validateImageSourceUrl, "validateImageSourceUrl");
     __name(fetchImageSource, "fetchImageSource");
+    __name(runCoalesced, "runCoalesced");
+    __name(raceRequestAbort, "raceRequestAbort");
     __name(readResponseWithLimit, "readResponseWithLimit");
     __name(cancelResponseBody, "cancelResponseBody");
     __name(detectImageContentType, "detectImageContentType");
@@ -31478,6 +31965,22 @@ function isFarmConfigFile(file, root) {
   const relative6 = normalized.startsWith(`${rootSlug}/`) ? normalized.slice(rootSlug.length + 1) : normalized;
   return FARM_CONFIG_FILENAMES.has(relative6);
 }
+function warnClientBoundaryOnce(context2, id, code, config) {
+  if (warnedClientBoundaryIds.has(id)) return;
+  let program;
+  try {
+    program = context2.parse(code);
+  } catch {
+    return;
+  }
+  const publicKeys = new Set(Object.keys(config.env?.public ?? {}));
+  const findings = analyzeClientBoundary(program, publicKeys);
+  if (findings.envKeys.length === 0 && findings.publicEnvKeys.length === 0 && findings.builtinImports.length === 0) {
+    return;
+  }
+  warnedClientBoundaryIds.add(id);
+  logger.warn(formatClientBoundaryWarning(id, findings));
+}
 function farmPlugin(options = {}, initialPluginManager) {
   const imageImports = farmImageImportsPlugin();
   const fontImports = farmFontImportsPlugin({
@@ -32088,6 +32591,22 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             }
             return;
           }
+          if (openAPIManager && options.openapi?.specRoute && requestPathname === options.openapi.specRoute) {
+            if (requestMethod !== "GET" && requestMethod !== "HEAD") {
+              res.statusCode = 405;
+              res.setHeader("Allow", "GET, HEAD");
+              res.setHeader("Content-Type", "text/plain; charset=utf-8");
+              res.end("Method Not Allowed");
+              return;
+            }
+            const spec = await openAPIManager.getSpec();
+            const body = JSON.stringify(spec);
+            res.statusCode = 200;
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.setHeader("Cache-Control", "no-store");
+            res.end(requestMethod === "HEAD" ? void 0 : body);
+            return;
+          }
           if (openAPIManager && requestPathname === options.openapi?.route) {
             const docsHandler = openAPIManager.getDocsRouteHandler();
             return docsHandler(req, res);
@@ -32098,6 +32617,11 @@ window.__FARM_MANIFEST__ = ${inlineValue({
               docsHeaders.set(key, Array.isArray(value) ? value.join(", ") : value);
             }
           }
+          const runAppMiddlewareForContentRoute = /* @__PURE__ */ __name(async () => {
+            if (!middlewareManager?.hasMiddleware()) return false;
+            const middlewareRequest = createRequestFromNodeRequest(req, new URL(fullUrl));
+            return farmApp.getServerRenderer().runWithRequestContext(middlewareRequest, () => middlewareManager.execute(req, res));
+          }, "runAppMiddlewareForContentRoute");
           if (farmDocsHandler) {
             const docsRequest = new Request(fullUrl, {
               method: requestMethod,
@@ -32105,6 +32629,7 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             });
             const docsResponse = await farmDocsHandler(docsRequest.clone());
             if (docsResponse) {
+              if (await runAppMiddlewareForContentRoute()) return;
               await sendWebResponse(
                 res,
                 await wrapFarmDocsResponseWithLayouts(docsRequest, docsResponse)
@@ -32131,6 +32656,7 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             }, "resolveSource")
           });
           if (markdownSourceResponse) {
+            if (await runAppMiddlewareForContentRoute()) return;
             await sendWebResponse(res, markdownSourceResponse);
             return;
           }
@@ -32144,9 +32670,23 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             renderPage: /* @__PURE__ */ __name(async (request) => fetch(request), "renderPage")
           });
           if (markdownResponse) {
+            if (await runAppMiddlewareForContentRoute()) return;
             await sendWebResponse(res, markdownResponse);
             return;
           }
+          if (farmRequestWantsMarkdown(requestPathname, req.headers.accept)) {
+            const markdownRoute = farmApp.getRouteManager().matchRoute(normalizeFarmMarkdownRoutePath(requestPathname));
+            if (!markdownRoute.route) {
+              res.statusCode = 404;
+              res.setHeader("Content-Type", FARM_MARKDOWN_CONTENT_TYPE);
+              res.setHeader("X-Farm-Markdown-Error", "404");
+              res.setHeader("Cache-Control", "no-store");
+              res.end(
+                createFarmMarkdownErrorBody(404, requestPathname, farmConfig.basePath || "/")
+              );
+              return;
+            }
+          }
           const markdownPageTarget = resolveMarkdownMirrorTarget(
             farmApp.getConfig().md,
             requestPathname,
@@ -33095,6 +33635,9 @@ export const manifest = getManifest();
           }
         }
       }
+      if (!transformOptions?.ssr && shouldInspectClientBoundary(id, code)) {
+        warnClientBoundaryOnce(this, id, code, farmApp?.getConfig() ?? options);
+      }
       if (typeof imageImports.transform === "function") {
         const imageModule = await imageImports.transform.call(this, code, id, transformOptions);
         if (imageModule) return imageModule;
@@ -35434,7 +35977,7 @@ async function defineConfig2(config = {}) {
     }
   };
 }
-var fs14, path38, import_node_url9, ALL_TYPE_ARTIFACTS, createEmptyTypeArtifactSelection, FARM_I18N_CLIENT_BRIDGE_ID, warnedDeprecatedDevtoolsDashboard, EMPTY_FARM_DOCS_SEARCH_CLIENT_RUNTIME, FARM_CONFIG_FILENAMES;
+var fs14, path38, import_node_url9, ALL_TYPE_ARTIFACTS, createEmptyTypeArtifactSelection, FARM_I18N_CLIENT_BRIDGE_ID, warnedDeprecatedDevtoolsDashboard, EMPTY_FARM_DOCS_SEARCH_CLIENT_RUNTIME, FARM_CONFIG_FILENAMES, warnedClientBoundaryIds;
 var init_vite2 = __esm({
   "src/vite.ts"() {
     "use strict";
@@ -35471,6 +36014,7 @@ var init_vite2 = __esm({
     init_server_context();
     init_dev_static();
     init_server_query_boundary();
+    init_client_boundary_env();
     init_deployment();
     init_image_config();
     init_image_vite();
@@ -35570,6 +36114,8 @@ async function mountFarmDocsSearch() {
     __name(walkModuleAst, "walkModuleAst");
     __name(isFarmModuleAstNode, "isFarmModuleAstNode");
     __name(isFarmConfigFile, "isFarmConfigFile");
+    warnedClientBoundaryIds = /* @__PURE__ */ new Set();
+    __name(warnClientBoundaryOnce, "warnClientBoundaryOnce");
     __name(farmPlugin, "farmPlugin");
     __name(isFarmClientVirtualId, "isFarmClientVirtualId");
     __name(generateProgrammaticRouteModule, "generateProgrammaticRouteModule");
@@ -40048,7 +40594,9 @@ async function buildSSRInMemory(productionVite, config, root, routeManager, apiR
     }
     openAPIReference = {
       route: config.openapi.route,
-      html: renderOpenAPIReferenceHTML2(spec, config.openapi)
+      html: renderOpenAPIReferenceHTML2(spec, config.openapi),
+      spec,
+      specRoute: config.openapi.specRoute || null
     };
   }
   const middlewareRoutes = await discoverMiddlewareRoutes(appDirs);
@@ -40670,6 +41218,7 @@ import { dirname as farmDocsDirname, join as farmDocsJoin } from "node:path";
 import { fileURLToPath as farmDocsFileURLToPath } from "node:url";` : "";
   const markdownHandlerImport = config.md?.enabled ? `import { applyMarkdownNegotiationHeaders, createMarkdownMirrorResponse } from "@farm.js/core/markdown";` : "";
   const appMarkdownImport = hasMarkdownPages ? `import { createFarmMarkdownRouteModule, createFarmMarkdownSourceResponse } from "@farm.js/core/app-markdown";` : "const createFarmMarkdownSourceResponse = null;";
+  const markdownErrorImport = `import { FARM_MARKDOWN_CONTENT_TYPE, createFarmMarkdownErrorBody, farmRequestWantsMarkdown } from "@farm.js/core/app-markdown";`;
   const mdxComponentsPath = typeof config.mdx?.components === "string" ? import_path14.default.isAbsolute(config.mdx.components) ? config.mdx.components : import_path14.default.join(config.root, config.mdx.components) : null;
   const mdxComponentsImport = mdxComponentsPath ? `import * as FarmMdxComponentsModule from ${toVirtualEntryImportSpecifier(mdxComponentsPath)};` : "";
   const layerConfigPaths = (config.layers || []).map((layer) => layer.configFile).filter((configFile) => Boolean(configFile)).filter((configFile) => configFile !== configModulePath);
@@ -40812,6 +41361,7 @@ ${docsFontImport}
 ${docsRuntimeImport}
 ${markdownHandlerImport}
 ${appMarkdownImport}
+${markdownErrorImport}
 ${mdxComponentsImport}
 ${integrationImports}
 ${providerServerImports}
@@ -42355,12 +42905,38 @@ async function handleFarmRequestInContext(
   }
   ` : ""}
 
+  ${hasMiddlewareRuntime ? `
+  const requestBeforeMiddleware = request;
+  const middlewareResult = await farmMiddlewareRunner(request);
+  if (middlewareResult.response) {
+    return middlewareResult.response;
+  }
+  request = middlewareResult.request;
+  const middlewareData = middlewareResult.data;
+  const middlewareContext = middlewareResult.context;
+  const middlewareHeaders = middlewareResult.headers;
+  url = new URL(request.url);
+  pathname = url.pathname;
+  routePathname = getFarmRoutePathname(pathname);
+
+  // Middleware may replace the Request when it rewrites a URL. Re-enter the
+  // request store so pages, layouts, and route context observe that rewritten
+  // request instead of the original outer-handler value.
+  const runResolvedRequest = async () => {
+  ` : `
+  const middlewareData = undefined;
+  const middlewareContext = undefined;
+  const middlewareHeaders = undefined;
+  `}
+
   ${config.docs?.enabled ? `
+  // Docs responses are served after app middleware so route guards and
+  // middleware headers apply to the docs engine like any other page content.
   if (farmDocsHandler) {
     const docsResponse = await farmDocsHandler(request.clone());
     if (docsResponse) {
       if (!docsResponse.headers.get("content-type")?.toLowerCase().includes("text/html")) {
-        return docsResponse;
+        return applyProductionMiddlewareHeaders(docsResponse, middlewareHeaders);
       }
       const wrappedDocsResponse = await wrapFarmDocsResponseWithLayouts(
         request,
@@ -42368,16 +42944,18 @@ async function handleFarmRequestInContext(
       );
       const docsHeaders = new Headers(wrappedDocsResponse.headers);
       docsHeaders.set("x-farm-preload-buffered", "1");
-      return new Response(wrappedDocsResponse.body, {
+      return applyProductionMiddlewareHeaders(new Response(wrappedDocsResponse.body, {
         status: wrappedDocsResponse.status,
         statusText: wrappedDocsResponse.statusText,
         headers: docsHeaders,
-      });
+      }), middlewareHeaders);
     }
   }
   ` : ""}
 
   ${hasMarkdownPages ? `
+  // The raw markdown source of a page route is the page's content in another
+  // representation; middleware guarding the route must run before serving it.
   const markdownSourceResponse = await createFarmMarkdownSourceResponse?.({
     request: request.clone(),
     config: farmMdxConfig,
@@ -42387,7 +42965,7 @@ async function handleFarmRequestInContext(
     },
   });
   if (markdownSourceResponse) {
-    return markdownSourceResponse;
+    return applyProductionMiddlewareHeaders(markdownSourceResponse, middlewareHeaders);
   }
   ` : ""}
 
@@ -42401,35 +42979,11 @@ async function handleFarmRequestInContext(
       renderPage: (targetRequest) => handleFarmRequest(targetRequest),
     });
     if (markdownResponse) {
-      return markdownResponse;
+      return applyProductionMiddlewareHeaders(markdownResponse, middlewareHeaders);
     }
   }
   ` : ""}
 
-  ${hasMiddlewareRuntime ? `
-  const requestBeforeMiddleware = request;
-  const middlewareResult = await farmMiddlewareRunner(request);
-  if (middlewareResult.response) {
-    return middlewareResult.response;
-  }
-  request = middlewareResult.request;
-  const middlewareData = middlewareResult.data;
-  const middlewareContext = middlewareResult.context;
-  const middlewareHeaders = middlewareResult.headers;
-  url = new URL(request.url);
-  pathname = url.pathname;
-  routePathname = getFarmRoutePathname(pathname);
-
-  // Middleware may replace the Request when it rewrites a URL. Re-enter the
-  // request store so pages, layouts, and route context observe that rewritten
-  // request instead of the original outer-handler value.
-  const runResolvedRequest = async () => {
-  ` : `
-  const middlewareData = undefined;
-  const middlewareContext = undefined;
-  const middlewareHeaders = undefined;
-  `}
-
   ${apiRoutes.length > 0 ? `
   const apiResponse = await handleAPIRequest(request.clone());
   if (apiResponse) {
@@ -42437,6 +42991,31 @@ async function handleFarmRequestInContext(
   }
   ` : ""}
 
+  if (
+    farmOpenAPIReference &&
+    farmOpenAPIReference.specRoute &&
+    normalizeRuntimePath(pathname) === normalizeRuntimePath(farmOpenAPIReference.specRoute)
+  ) {
+    const method = request.method.toUpperCase();
+    const specResponse = method === "GET" || method === "HEAD"
+      ? new Response(method === "HEAD" ? null : JSON.stringify(farmOpenAPIReference.spec), {
+          status: 200,
+          headers: {
+            "Content-Type": "application/json; charset=utf-8",
+            "Cache-Control": "public, max-age=0, must-revalidate",
+            "X-Content-Type-Options": "nosniff",
+          },
+        })
+      : new Response("Method Not Allowed", {
+          status: 405,
+          headers: {
+            "Allow": "GET, HEAD",
+            "Content-Type": "text/plain; charset=utf-8",
+          },
+        });
+    return applyProductionMiddlewareHeaders(specResponse, middlewareHeaders);
+  }
+
   if (
     farmOpenAPIReference &&
     normalizeRuntimePath(pathname) === normalizeRuntimePath(farmOpenAPIReference.route)
@@ -42909,7 +43488,7 @@ async function handleFarmRequestInContext(
           }
         }
 
-        const renderedMetadata = renderMetadataHead(mergedMetadata);
+        const renderedMetadata = renderMetadataHead(mergedMetadata, { pathname, jsonLd: ${JSON.stringify(config.agent?.jsonLd ?? false)} });
         const title = renderedMetadata.title;
         const metaTags = renderedMetadata.tags;
         const hasFavicon = renderedMetadata.hasFavicon;
@@ -43285,6 +43864,30 @@ async function handleFarmRequestInContext(
 
   // 404 fallback - render proper HTML page
   emitFarmEvent({ type: "route.notFound", pathname });
+
+  // Agents that navigate in Markdown (a \`.md\` URL or \`Accept: text/markdown\`)
+  // get a Markdown error body instead of the HTML not-found shell.
+  if (farmRequestWantsMarkdown(pathname, request.headers.get("accept"))) {
+    emitFarmEvent({
+      type: "render.complete",
+      route: pathname,
+      pathname,
+      status: 404,
+      durationMs: Date.now() - requestStartTime,
+    });
+    return applyProductionMiddlewareHeaders(new Response(
+      createFarmMarkdownErrorBody(404, pathname, applyFarmBasePath("/", farmResolvedRuntimeConfig.basePath)),
+      {
+        status: 404,
+        headers: {
+          "Content-Type": FARM_MARKDOWN_CONTENT_TYPE,
+          "X-Farm-Markdown-Error": "404",
+          "Cache-Control": "no-store",
+        },
+      }
+    ), middlewareHeaders);
+  }
+
   try {
     const defaultNotFoundHomeHref = applyFarmBasePath("/", farmResolvedRuntimeConfig.basePath);
     // Default 404 page component
@@ -43524,6 +44127,9 @@ async function handleFarmFetch(request, context) {
   const healthResponse = await farmProductionLifecycle.handleHealthRequest(request);
   if (healthResponse) return healthResponse;
 
+  const productionSiteAttestation = farmProductionSiteTelemetry?.handleAttestation(request);
+  if (productionSiteAttestation) return productionSiteAttestation;
+
   farmProductionSiteTelemetry?.report(
     request.url,
     typeof context?.waitUntil === "function" ? context.waitUntil.bind(context) : undefined,