@farm.js/core 0.1.0-beta.97 → 0.1.0-beta.99

package/dist/server.cjs

@@ -922,6 +922,29 @@ var init_search_params = __esm({
   }
 });
 
+// src/utils/runtime-env.ts
+function getFarmRuntimeBindings() {
+  const runtimeBindings = globalThis.__env__;
+  return runtimeBindings && typeof runtimeBindings === "object" ? runtimeBindings : void 0;
+}
+function readFarmEnvironmentValue(name2) {
+  const runtimeValue = getFarmRuntimeBindings()?.[name2];
+  if (typeof runtimeValue === "string") return runtimeValue;
+  return typeof process !== "undefined" ? process.env?.[name2] : void 0;
+}
+function isFarmDeployedRuntime() {
+  if (getFarmRuntimeBindings()) return true;
+  return readFarmEnvironmentValue("NODE_ENV") === "production";
+}
+var init_runtime_env = __esm({
+  "src/utils/runtime-env.ts"() {
+    "use strict";
+    __name(getFarmRuntimeBindings, "getFarmRuntimeBindings");
+    __name(readFarmEnvironmentValue, "readFarmEnvironmentValue");
+    __name(isFarmDeployedRuntime, "isFarmDeployedRuntime");
+  }
+});
+
 // src/utils/decode.ts
 function decodeRouteSegment(segment) {
   try {
@@ -1491,7 +1514,8 @@ function resolveWorkflowsConfig(workflows) {
     dirs,
     route: normalizeWorkflowRoute(options.route || DEFAULT_FARM_WORKFLOW_ROUTE),
     secretEnv: options.secretEnv || DEFAULT_FARM_WORKFLOW_SECRET_ENV,
-    secret: options.secret
+    secret: options.secret,
+    allowUnsecured: options.allowUnsecured === true
   };
 }
 async function discoverFarmWorkflows(config, options = {}) {
@@ -1617,8 +1641,11 @@ async function prepareFarmWorkflowsForNitro(config) {
   await fs16.mkdir(generatedDir, { recursive: true });
   const tasks = {};
   const scheduledTasks = createScheduledTasks(workflows);
+  const wrapperNames = resolveWorkflowWrapperFileNames(workflows.map((workflow) => workflow.id));
   for (const workflow of workflows) {
-    const wrapperPath = toPosixPath(path37.join(generatedDir, `${safeFileName(workflow.id)}.mjs`));
+    const wrapperPath = toPosixPath(
+      path37.join(generatedDir, `${wrapperNames.get(workflow.id)}.mjs`)
+    );
     await fs16.writeFile(wrapperPath, createNitroTaskWrapper(workflow), "utf8");
     tasks[workflow.id] = {
       handler: wrapperPath,
@@ -1856,6 +1883,7 @@ import {
 const route = ${JSON.stringify(config.route)};
 const secretEnv = ${JSON.stringify(config.secretEnv)};
 const inlineSecret = ${JSON.stringify(config.secret || "")};
+const allowUnsecured = ${JSON.stringify(config.allowUnsecured === true)};
 const bodySizeLimit = ${JSON.stringify(server.bodySizeLimit)};
 const workflows = ${JSON.stringify(workflows.map(toWorkflowMetadata))};
 const workflowIds = new Set(workflows.map((workflow) => workflow.id));
@@ -1885,7 +1913,10 @@ function getSecret() {
 
 function verifySecret(event) {
   const secret = getSecret();
-  if (!secret) return null;
+  if (!secret) {
+    if (allowUnsecured) return null;
+    return json({ error: ${JSON.stringify(MISSING_FARM_WORKFLOW_SECRET_ERROR)} }, 401);
+  }
   const authorization = getHeader(event, "authorization") || "";
   const headerSecret = getHeader(event, "x-farm-workflow-secret") || "";
   const bearer = authorization.match(/^Bearer\\s+(.+)$/i)?.[1] || "";
@@ -1979,8 +2010,16 @@ function readScheduledTime(payload) {
   return payload && typeof payload === "object" && "scheduledTime" in payload ? payload.scheduledTime : void 0;
 }
 function verifyWorkflowSecret(request, config) {
-  const secret = config.secret || process.env[config.secretEnv] || "";
-  if (!secret) return null;
+  const secret = config.secret || readFarmEnvironmentValue(config.secretEnv) || "";
+  if (!secret) {
+    if (config.allowUnsecured === true || !isFarmDeployedRuntime()) return null;
+    return Response.json(
+      {
+        error: MISSING_FARM_WORKFLOW_SECRET_ERROR
+      },
+      { status: 401 }
+    );
+  }
   const authorization = request.headers.get("authorization") || "";
   const bearer = authorization.match(/^Bearer\s+(.+)$/i)?.[1] || "";
   const headerSecret = request.headers.get("x-farm-workflow-secret") || "";
@@ -1993,18 +2032,50 @@ function joinRoute(...parts) {
 function trimSlashes(value) {
   return value.replace(/^\/+|\/+$/g, "");
 }
+function resolveWorkflowWrapperFileNames(ids) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const key = safeFileName(id).toLowerCase();
+    groups.set(key, (groups.get(key) ?? 0) + 1);
+  }
+  const resolved = /* @__PURE__ */ new Map();
+  const claimed = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const base = safeFileName(id);
+    const key = base.toLowerCase();
+    const fileName = (groups.get(key) ?? 0) > 1 ? `${key}-${workflowIdFingerprint(id)}` : base;
+    const claimedBy = claimed.get(fileName.toLowerCase());
+    if (claimedBy !== void 0) {
+      throw new Error(
+        `Farm workflows ${JSON.stringify(claimedBy)} and ${JSON.stringify(id)} generate the same wrapper file ${JSON.stringify(`${fileName}.mjs`)}. Rename one of them.`
+      );
+    }
+    claimed.set(fileName.toLowerCase(), id);
+    resolved.set(id, fileName);
+  }
+  return resolved;
+}
+function workflowIdFingerprint(value) {
+  let hash = 2166136261;
+  for (let index = 0; index < value.length; index += 1) {
+    hash ^= value.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
 function safeFileName(value) {
   return value.replace(/[^a-zA-Z0-9._-]+/g, "-") || "workflow";
 }
 function relativePath(root, filePath) {
   return filePath.replace(/\\/g, "/").replace(`${root.replace(/\\/g, "/")}/`, "");
 }
-var import_node_path, DEFAULT_FARM_WORKFLOW_DIRS, DEFAULT_FARM_WORKFLOW_ROUTE, DEFAULT_FARM_WORKFLOW_SECRET_ENV;
+var import_node_path, DEFAULT_FARM_WORKFLOW_DIRS, DEFAULT_FARM_WORKFLOW_ROUTE, DEFAULT_FARM_WORKFLOW_SECRET_ENV, MISSING_FARM_WORKFLOW_SECRET_ERROR;
 var init_workflows = __esm({
   "src/workflows.ts"() {
     "use strict";
     init_server_http();
     init_search_params();
+    init_runtime_env();
     init_decode();
     init_utils();
     init_route_pattern();
@@ -2012,6 +2083,7 @@ var init_workflows = __esm({
     DEFAULT_FARM_WORKFLOW_DIRS = ["src/jobs", "src/workflows", "src/cron"];
     DEFAULT_FARM_WORKFLOW_ROUTE = "/api/_farm/workflows";
     DEFAULT_FARM_WORKFLOW_SECRET_ENV = "CRON_SECRET";
+    MISSING_FARM_WORKFLOW_SECRET_ERROR = "Workflow route requires a secret. Set the CRON_SECRET environment variable, configure workflows.secret, or set workflows.allowUnsecured to true.";
     __name(defineWorkflow, "defineWorkflow");
     __name(defineTask, "defineTask");
     __name(defineCron, "defineCron");
@@ -2044,6 +2116,8 @@ var init_workflows = __esm({
     __name(verifyWorkflowSecret, "verifyWorkflowSecret");
     __name(joinRoute, "joinRoute");
     __name(trimSlashes, "trimSlashes");
+    __name(resolveWorkflowWrapperFileNames, "resolveWorkflowWrapperFileNames");
+    __name(workflowIdFingerprint, "workflowIdFingerprint");
     __name(safeFileName, "safeFileName");
     __name(relativePath, "relativePath");
   }
@@ -2194,6 +2268,7 @@ var init_cron = __esm({
   "src/cron.ts"() {
     "use strict";
     init_utils();
+    init_runtime_env();
     DEFAULT_FARM_CRON_SECRET_ENV = "CRON_SECRET";
     CRON_FIELD_RANGES = [
       [0, 59, "minute"],
@@ -2574,9 +2649,13 @@ function getStorage(namespace) {
   const namespaced = (0, import_unstorage.prefixStorage)(globalStorage, base);
   return {
     ...namespaced,
-    async clear() {
-      const keys = await namespaced.getKeys();
-      await Promise.all(keys.map((key) => namespaced.removeItem(key)));
+    // Scope the wipe to the namespace instead of the whole storage, and keep
+    // the caller's base so `clear("sessions")` cannot take unrelated keys with
+    // it. Dropping the argument silently widens a targeted clear into a
+    // namespace-wide delete.
+    async clear(base2, opts) {
+      const keys = await namespaced.getKeys(base2);
+      await Promise.all(keys.map((key) => namespaced.removeItem(key, opts)));
     }
   };
 }
@@ -3571,6 +3650,114 @@ var init_cache_invalidation = __esm({
   }
 });
 
+// src/request-origin.ts
+function getRequestSourceOrigin(request) {
+  const origin = request.headers.get("origin")?.trim();
+  if (origin) {
+    return parseSourceOrigin(origin);
+  }
+  const referer = request.headers.get("referer")?.trim();
+  if (referer) {
+    return parseSourceOrigin(referer);
+  }
+  return { ok: true, origin: null };
+}
+function parseSourceOrigin(value) {
+  if (value === "null") {
+    return { ok: false, reason: "opaque-origin" };
+  }
+  try {
+    const parsed = new URL(value);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return { ok: false, reason: "invalid-origin" };
+    }
+    return { ok: true, origin: parsed.origin };
+  } catch {
+    return { ok: false, reason: "invalid-origin" };
+  }
+}
+function matchesHostHeader(sourceOrigin, request) {
+  const host = request.headers.get("host")?.trim().toLowerCase();
+  if (!host) return false;
+  try {
+    const source = new URL(sourceOrigin);
+    const target = new URL(request.url);
+    return source.protocol === target.protocol && source.host.toLowerCase() === host;
+  } catch {
+    return false;
+  }
+}
+function matchesAllowedOrigin(sourceOrigin, pattern) {
+  const source = new URL(sourceOrigin);
+  if (!pattern.includes("*")) {
+    return pattern.includes("://") ? source.origin === pattern : source.host === pattern;
+  }
+  const schemeEnd = pattern.indexOf("://");
+  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);
+  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);
+  const [wildcardHost, port] = splitHostAndPort(hostPattern);
+  const baseHost = wildcardHost.slice(2);
+  if (scheme && source.protocol !== scheme) return false;
+  if (port && getEffectivePort(source) !== port) return false;
+  if (!port && source.port) return false;
+  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;
+}
+function normalizeAllowedOriginPattern(value, label) {
+  const pattern = value.trim().toLowerCase();
+  if (!pattern) {
+    throw new TypeError(`${label} cannot contain empty values`);
+  }
+  if (pattern.includes("*")) {
+    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
+      throw new TypeError(`Invalid ${label} pattern: ${JSON.stringify(value)}`);
+    }
+    return pattern;
+  }
+  if (pattern.includes("://")) {
+    let parsed;
+    try {
+      parsed = new URL(pattern);
+    } catch {
+      throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+    }
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
+      throw new TypeError(`${label} must contain origins without paths: ${JSON.stringify(value)}`);
+    }
+    return parsed.origin;
+  }
+  if (/[/@?#]/.test(pattern)) {
+    throw new TypeError(`${label} must contain origins or hosts: ${JSON.stringify(value)}`);
+  }
+  try {
+    return new URL(`http://${pattern}`).host;
+  } catch {
+    throw new TypeError(`Invalid ${label} value: ${JSON.stringify(value)}`);
+  }
+}
+function splitHostAndPort(value) {
+  const separator = value.lastIndexOf(":");
+  if (separator === -1) return [value, null];
+  return [value.slice(0, separator), value.slice(separator + 1)];
+}
+function getEffectivePort(url) {
+  if (url.port) return url.port;
+  if (url.protocol === "https:") return "443";
+  if (url.protocol === "http:") return "80";
+  return "";
+}
+var init_request_origin = __esm({
+  "src/request-origin.ts"() {
+    "use strict";
+    __name(getRequestSourceOrigin, "getRequestSourceOrigin");
+    __name(parseSourceOrigin, "parseSourceOrigin");
+    __name(matchesHostHeader, "matchesHostHeader");
+    __name(matchesAllowedOrigin, "matchesAllowedOrigin");
+    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
+    __name(splitHostAndPort, "splitHostAndPort");
+    __name(getEffectivePort, "getEffectivePort");
+  }
+});
+
 // src/server-fn-error.ts
 function isServerFnFailure(value) {
   if (!value || typeof value !== "object") return false;
@@ -3614,7 +3801,9 @@ var init_server_fn_error = __esm({
 
 // src/server-action-security.ts
 function resolveServerActionsConfig(config) {
-  const allowedOrigins = (config?.allowedOrigins ?? []).map(normalizeAllowedOriginPattern);
+  const allowedOrigins = (config?.allowedOrigins ?? []).map(
+    (value) => normalizeAllowedOriginPattern(value, SERVER_ACTION_ALLOWED_ORIGINS_LABEL)
+  );
   const bodySizeLimit = parseBodySizeLimit(
     config?.bodySizeLimit ?? DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT,
     "serverActions.bodySizeLimit"
@@ -3633,7 +3822,7 @@ function validateServerActionRequest(request, config) {
     );
   }
   const requestUrl = new URL(request.url);
-  const sourceOrigin = getRequestSourceOrigin(request);
+  const sourceOrigin = resolveSourceOrigin(request);
   const fetchSite = request.headers.get("sec-fetch-site")?.trim().toLowerCase();
   if (!sourceOrigin) {
     if (fetchSite !== "same-origin") {
@@ -3749,103 +3938,16 @@ function getFallbackAbortController() {
   }
   return globalState2[FALLBACK_ABORT_CONTROLLER_KEY];
 }
-function normalizeAllowedOriginPattern(value) {
-  const pattern = value.trim().toLowerCase();
-  if (!pattern) {
-    throw new TypeError("serverActions.allowedOrigins cannot contain empty values");
-  }
-  if (pattern.includes("*")) {
-    if (!/^(?:https?:\/\/)?\*\.[a-z0-9.-]+(?::\d+)?$/.test(pattern)) {
-      throw new TypeError(`Invalid serverActions.allowedOrigins pattern: ${JSON.stringify(value)}`);
-    }
-    return pattern;
-  }
-  if (pattern.includes("://")) {
-    let parsed;
-    try {
-      parsed = new URL(pattern);
-    } catch {
-      throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-    }
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-      throw new TypeError(
-        `serverActions.allowedOrigins must contain origins without paths: ${JSON.stringify(value)}`
-      );
-    }
-    return parsed.origin;
-  }
-  if (/[/@?#]/.test(pattern)) {
-    throw new TypeError(
-      `serverActions.allowedOrigins must contain origins or hosts: ${JSON.stringify(value)}`
+function resolveSourceOrigin(request) {
+  const result = getRequestSourceOrigin(request);
+  if (!result.ok) {
+    throw new ServerActionRequestError(
+      "INVALID_ORIGIN",
+      403,
+      result.reason === "opaque-origin" ? "Opaque origins are not allowed" : "Invalid request origin"
     );
   }
-  try {
-    return new URL(`http://${pattern}`).host;
-  } catch {
-    throw new TypeError(`Invalid serverActions.allowedOrigins value: ${JSON.stringify(value)}`);
-  }
-}
-function getRequestSourceOrigin(request) {
-  const origin = request.headers.get("origin")?.trim();
-  if (origin) {
-    return parseSourceOrigin(origin);
-  }
-  const referer = request.headers.get("referer")?.trim();
-  if (referer) {
-    return parseSourceOrigin(referer);
-  }
-  return null;
-}
-function parseSourceOrigin(value) {
-  if (value === "null") {
-    throw new ServerActionRequestError("INVALID_ORIGIN", 403, "Opaque origins are not allowed");
-  }
-  try {
-    const parsed = new URL(value);
-    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-      throw new Error("Unsupported protocol");
-    }
-    return parsed.origin;
-  } catch {
-    throw new ServerActionRequestError("INVALID_ORIGIN", 403, "Invalid request origin");
-  }
-}
-function matchesHostHeader(sourceOrigin, request) {
-  const host = request.headers.get("host")?.trim().toLowerCase();
-  if (!host) return false;
-  try {
-    const source = new URL(sourceOrigin);
-    const target = new URL(request.url);
-    return source.protocol === target.protocol && source.host.toLowerCase() === host;
-  } catch {
-    return false;
-  }
-}
-function matchesAllowedOrigin(sourceOrigin, pattern) {
-  const source = new URL(sourceOrigin);
-  if (!pattern.includes("*")) {
-    return pattern.includes("://") ? source.origin === pattern : source.host === pattern;
-  }
-  const schemeEnd = pattern.indexOf("://");
-  const scheme = schemeEnd === -1 ? null : pattern.slice(0, schemeEnd + 1);
-  const hostPattern = pattern.slice(schemeEnd === -1 ? 0 : schemeEnd + 3);
-  const [wildcardHost, port] = splitHostAndPort(hostPattern);
-  const baseHost = wildcardHost.slice(2);
-  if (scheme && source.protocol !== scheme) return false;
-  if (port && getEffectivePort(source) !== port) return false;
-  if (!port && source.port) return false;
-  return source.hostname.endsWith(`.${baseHost}`) && source.hostname !== baseHost;
-}
-function splitHostAndPort(value) {
-  const separator = value.lastIndexOf(":");
-  if (separator === -1) return [value, null];
-  return [value.slice(0, separator), value.slice(separator + 1)];
-}
-function getEffectivePort(url) {
-  if (url.port) return url.port;
-  if (url.protocol === "https:") return "443";
-  if (url.protocol === "http:") return "80";
-  return "";
+  return result.origin;
 }
 function validateActionId(actionId) {
   if (!actionId || actionId.length > 4096 || hasControlCharacters(actionId)) {
@@ -3966,14 +4068,16 @@ function throwIfAborted2(signal) {
   if (signal.reason !== void 0) throw signal.reason;
   throw new DOMException("The operation was aborted", "AbortError");
 }
-var import_node_async_hooks, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, _ServerActionRequestError, ServerActionRequestError, SERVER_ACTION_STORAGE_KEY, FALLBACK_ABORT_CONTROLLER_KEY, FORM_ACTION_CONTENT_TYPES, JAVASCRIPT_ACTION_CONTENT_TYPES;
+var import_node_async_hooks, SERVER_ACTION_ALLOWED_ORIGINS_LABEL, DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT, _ServerActionRequestError, ServerActionRequestError, SERVER_ACTION_STORAGE_KEY, FALLBACK_ABORT_CONTROLLER_KEY, FORM_ACTION_CONTENT_TYPES, JAVASCRIPT_ACTION_CONTENT_TYPES;
 var init_server_action_security = __esm({
   "src/server-action-security.ts"() {
     "use strict";
     import_node_async_hooks = require("async_hooks");
     init_cache_invalidation();
+    init_request_origin();
     init_server_fn_error();
     init_server_http();
+    SERVER_ACTION_ALLOWED_ORIGINS_LABEL = "serverActions.allowedOrigins";
     DEFAULT_SERVER_ACTION_BODY_SIZE_LIMIT = 1e6;
     _ServerActionRequestError = class _ServerActionRequestError extends Error {
       constructor(code, status, message) {
@@ -4014,13 +4118,7 @@ var init_server_action_security = __esm({
     });
     __name(getServerActionStorage, "getServerActionStorage");
     __name(getFallbackAbortController, "getFallbackAbortController");
-    __name(normalizeAllowedOriginPattern, "normalizeAllowedOriginPattern");
-    __name(getRequestSourceOrigin, "getRequestSourceOrigin");
-    __name(parseSourceOrigin, "parseSourceOrigin");
-    __name(matchesHostHeader, "matchesHostHeader");
-    __name(matchesAllowedOrigin, "matchesAllowedOrigin");
-    __name(splitHostAndPort, "splitHostAndPort");
-    __name(getEffectivePort, "getEffectivePort");
+    __name(resolveSourceOrigin, "resolveSourceOrigin");
     __name(validateActionId, "validateActionId");
     __name(hasControlCharacters, "hasControlCharacters");
     __name(getSupportedContentType, "getSupportedContentType");
@@ -6398,6 +6496,14 @@ var init_routes = __esm({
   }
 });
 
+// src/integration-request-security.ts
+var init_integration_request_security = __esm({
+  "src/integration-request-security.ts"() {
+    "use strict";
+    init_request_origin();
+  }
+});
+
 // src/integration-api.ts
 function defineIntegrationAPIOperation(operation) {
   return {
@@ -8573,6 +8679,7 @@ var init_integrations = __esm({
   "src/integrations.ts"() {
     "use strict";
     init_route_pattern();
+    init_integration_request_security();
     init_integration_api();
     init_plugin_integration_context();
     init_decode();
@@ -8779,6 +8886,51 @@ var init_renderer = __esm({
   }
 });
 
+// src/agent-config.ts
+function resolveFarmAgentConfig(input) {
+  const jsonLd = input?.jsonLd;
+  if (!jsonLd) return { jsonLd: false };
+  return { jsonLd: jsonLd === true ? {} : jsonLd };
+}
+function pruneUndefined(object) {
+  const result = {};
+  for (const [key, value] of Object.entries(object)) {
+    if (value !== void 0 && value !== null && value !== "") result[key] = value;
+  }
+  return result;
+}
+function serializeJsonLd(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+function renderFarmAgentJsonLd(config, context2) {
+  const base = pruneUndefined({
+    name: config.name ?? context2.siteName ?? context2.title,
+    url: config.url ?? context2.metadataBase,
+    description: config.description ?? context2.description,
+    logo: config.logo,
+    sameAs: config.sameAs && config.sameAs.length > 0 ? config.sameAs : void 0
+  });
+  const object = {
+    "@context": "https://schema.org",
+    "@type": config.type || "Organization",
+    ...base,
+    ...config.properties || {}
+  };
+  if (Object.keys(object).length <= 2 && !config.properties) {
+    return "";
+  }
+  return `<script type="application/ld+json">${serializeJsonLd(object)}</script>`;
+}
+var init_agent_config = __esm({
+  "src/agent-config.ts"() {
+    "use strict";
+    __name(resolveFarmAgentConfig, "resolveFarmAgentConfig");
+    __name(pruneUndefined, "pruneUndefined");
+    __name(serializeJsonLd, "serializeJsonLd");
+    __name(renderFarmAgentJsonLd, "renderFarmAgentJsonLd");
+  }
+});
+
 // src/deployment.ts
 function normalizeFarmDeploymentId(value) {
   if (typeof value !== "string" || value.trim() === "") {
@@ -10310,6 +10462,7 @@ export const apiRoutes = ${manifestSource} as const;
 function createFarmImageHandler(config, options) {
   const fetcher = options.fetch ?? globalThis.fetch;
   const cache = new FarmImageMemoryCache(options.cacheEntries ?? 100);
+  const inflight = /* @__PURE__ */ new Map();
   const allowedWidths = /* @__PURE__ */ new Set([...config.deviceSizes, ...config.imageSizes]);
   const allowedQualities = new Set(config.qualities);
   return /* @__PURE__ */ __name(async function handleFarmImage(request) {
@@ -10338,50 +10491,55 @@ function createFarmImageHandler(config, options) {
         "quality"
       );
       const accept = request.headers.get("accept") ?? "";
+      const negotiatedFormat = selectOutputFormat(accept, config.formats) ?? "";
       const cacheKey = `${sourceUrl.href}
 ${width}
 ${quality}
-${accept}`;
+${negotiatedFormat}`;
       let optimized = cache.get(cacheKey);
       if (!optimized) {
-        const fetchedSource = await fetchImageSource(
-          sourceUrl,
-          requestUrl.origin,
-          config,
-          fetcher,
-          options.fetchRemote,
-          options.validateRemoteUrl,
-          request.signal
-        );
-        const source = await readResponseWithLimit(
-          fetchedSource.response,
-          config.maximumResponseBody
-        );
-        const sourceType = detectImageContentType(source);
-        validateSourceType(sourceType, config);
-        throwIfAborted3(request.signal);
-        const result = await options.transform({
-          source,
-          sourceUrl: fetchedSource.url,
-          sourceType,
-          width,
-          quality,
-          accept,
-          formats: config.formats,
-          signal: request.signal
+        optimized = await runCoalesced(inflight, cacheKey, request.signal, async (signal) => {
+          const fetchedSource = await fetchImageSource(
+            sourceUrl,
+            requestUrl.origin,
+            config,
+            fetcher,
+            options.fetchRemote,
+            options.validateRemoteUrl,
+            signal
+          );
+          const source = await readResponseWithLimit(
+            fetchedSource.response,
+            config.maximumResponseBody
+          );
+          const sourceType = detectImageContentType(source);
+          validateSourceType(sourceType, config);
+          throwIfAborted3(signal);
+          const result = await options.transform({
+            source,
+            sourceUrl: fetchedSource.url,
+            sourceType,
+            width,
+            quality,
+            accept,
+            formats: config.formats,
+            signal,
+            maximumResponseBody: config.maximumResponseBody
+          });
+          throwIfAborted3(signal);
+          validateTransformedResult(result, config);
+          const entry = {
+            ...result,
+            etag: createImageEtag(result.body),
+            cacheControl: `public, max-age=${config.minimumCacheTTL}, stale-while-revalidate=${Math.max(
+              config.minimumCacheTTL,
+              60
+            )}`,
+            expiresAt: Date.now() + config.minimumCacheTTL * 1e3
+          };
+          cache.set(cacheKey, entry);
+          return entry;
         });
-        throwIfAborted3(request.signal);
-        validateTransformedResult(result, config);
-        optimized = {
-          ...result,
-          etag: createImageEtag(result.body),
-          cacheControl: `public, max-age=${config.minimumCacheTTL}, stale-while-revalidate=${Math.max(
-            config.minimumCacheTTL,
-            60
-          )}`,
-          expiresAt: Date.now() + config.minimumCacheTTL * 1e3
-        };
-        cache.set(cacheKey, optimized);
       }
       return createOptimizedImageResponse(request, optimized, config);
     } catch (error) {
@@ -10532,6 +10690,44 @@ async function fetchImageSource(initialUrl, requestOrigin, config, fetcher, fetc
     await validateImageSourceUrl(currentUrl, requestOrigin, config, validateRemoteUrl);
   }
 }
+async function runCoalesced(inflight, key, requestSignal, run) {
+  let entry = inflight.get(key);
+  if (!entry) {
+    const controller = new AbortController();
+    const created = {
+      controller,
+      waiters: 0,
+      promise: void 0
+    };
+    created.promise = run(controller.signal).finally(() => {
+      if (inflight.get(key) === created) inflight.delete(key);
+    });
+    created.promise.catch(() => {
+    });
+    inflight.set(key, created);
+    entry = created;
+  }
+  const pending = entry;
+  pending.waiters += 1;
+  try {
+    return await raceRequestAbort(pending.promise, requestSignal);
+  } finally {
+    pending.waiters -= 1;
+    if (pending.waiters === 0 && inflight.get(key) === pending) {
+      inflight.delete(key);
+      pending.controller.abort();
+    }
+  }
+}
+function raceRequestAbort(promise, signal) {
+  if (!signal) return promise;
+  if (signal.aborted) return Promise.reject(signal.reason ?? new Error("Aborted"));
+  return new Promise((resolve10, reject) => {
+    const onAbort = /* @__PURE__ */ __name(() => reject(signal.reason ?? new Error("Aborted")), "onAbort");
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(resolve10, reject).finally(() => signal.removeEventListener("abort", onAbort));
+  });
+}
 async function readResponseWithLimit(response, limit) {
   const contentLength = response.headers.get("content-length");
   if (contentLength && Number(contentLength) > limit) {
@@ -10699,7 +10895,7 @@ function throwIfAborted3(signal) {
 function isAbortError(error) {
   return error instanceof Error && error.name === "AbortError";
 }
-var _FarmImageRequestError, FarmImageRequestError, _FarmImageMemoryCache, FarmImageMemoryCache;
+var _FarmImageRequestError, FarmImageRequestError, DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT, _FarmImageMemoryCache, FarmImageMemoryCache;
 var init_image_server = __esm({
   "src/image-server.ts"() {
     "use strict";
@@ -10715,12 +10911,15 @@ var init_image_server = __esm({
     __name(_FarmImageRequestError, "FarmImageRequestError");
     FarmImageRequestError = _FarmImageRequestError;
     __name(createFarmImageHandler, "createFarmImageHandler");
+    DEFAULT_IMAGE_TRANSFORM_BODY_LIMIT = 10 * 1024 * 1024;
     __name(selectOutputFormat, "selectOutputFormat");
     __name(isPrivateImageAddress, "isPrivateImageAddress");
     __name(parseAllowedInteger, "parseAllowedInteger");
     __name(resolveImageSourceUrl, "resolveImageSourceUrl");
     __name(validateImageSourceUrl, "validateImageSourceUrl");
     __name(fetchImageSource, "fetchImageSource");
+    __name(runCoalesced, "runCoalesced");
+    __name(raceRequestAbort, "raceRequestAbort");
     __name(readResponseWithLimit, "readResponseWithLimit");
     __name(cancelResponseBody, "cancelResponseBody");
     __name(detectImageContentType, "detectImageContentType");
@@ -13571,6 +13770,7 @@ async function resolveConfig(userConfig, mode) {
   const openapi = {
     enabled: false,
     route: "/docs/reference",
+    specRoute: "/openapi.json",
     title: "API Documentation",
     description: "Auto-generated API documentation",
     version: "1.0.0",
@@ -13578,6 +13778,7 @@ async function resolveConfig(userConfig, mode) {
     ...userConfig.openapi
   };
   if (openapi.route !== void 0) validateConfigRouteSource(openapi.route, "openapi.route");
+  if (openapi.specRoute) validateConfigRouteSource(openapi.specRoute, "openapi.specRoute");
   const resolved = {
     [FARM_RESOLVED_CUSTOM_CONTEXT]: typeof userConfig.context === "function",
     root,
@@ -13610,6 +13811,7 @@ async function resolveConfig(userConfig, mode) {
       ppr: false,
       ...userConfig.experimental
     },
+    agent: resolveFarmAgentConfig(userConfig.agent),
     plugins: [...resolveIntegrationPlugins(integrations), ...userConfig.plugins || []],
     integrations,
     trailingSlash: userConfig.trailingSlash ?? false,
@@ -13718,6 +13920,7 @@ var init_config4 = __esm({
     init_security();
     init_navigation_errors();
     init_config2();
+    init_agent_config();
     init_renderer();
     init_framework_detect();
     init_config3();
@@ -17865,6 +18068,21 @@ function isFarmMarkdownPageFile(filePath) {
   return /(^|[/\\])page\.mdx?$/i.test(filePath);
 }
 __name(isFarmMarkdownPageFile, "isFarmMarkdownPageFile");
+var FARM_MARKDOWN_CONTENT_TYPE = "text/markdown; charset=utf-8";
+function farmRequestWantsMarkdown(pathname, accept) {
+  return pathname.toLowerCase().endsWith(".md") || requestAcceptsMarkdown(accept);
+}
+__name(farmRequestWantsMarkdown, "farmRequestWantsMarkdown");
+function createFarmMarkdownErrorBody(status, pathname, homeHref = "/") {
+  const heading = status === 404 ? "Page not found" : `Request failed (${status})`;
+  return `# ${heading}
+
+No page is available at \`${pathname}\`. The URL may be incorrect, or the page has not been published.
+
+Browse [the site homepage](${homeHref}) to find available pages.
+`;
+}
+__name(createFarmMarkdownErrorBody, "createFarmMarkdownErrorBody");
 function normalizeFarmMarkdownRoutePath(pathname) {
   const withoutExtension = pathname.replace(/\.md$/i, "");
   const normalized = withoutExtension.startsWith("/") ? withoutExtension : `/${withoutExtension}`;
@@ -18585,6 +18803,50 @@ function getStaticImportBindings(content) {
   return bindings;
 }
 __name(getStaticImportBindings, "getStaticImportBindings");
+var PARSER_SENSITIVE_JSX_CONTAINERS = /* @__PURE__ */ new Set([
+  "table",
+  "thead",
+  "tbody",
+  "tfoot",
+  "tr",
+  "select",
+  "optgroup",
+  "svg"
+]);
+function findParserSensitiveJsxContainer(content, localBindings) {
+  if (!content || localBindings.length === 0) return void 0;
+  const names = new Set(localBindings);
+  const tokens = tokenizeModuleSource(content);
+  const openDepth = /* @__PURE__ */ new Map();
+  const isSelfClosing = /* @__PURE__ */ __name((openingIndex) => {
+    for (let index = openingIndex; index < tokens.length; index++) {
+      if (tokens[index].value === ">") return tokens[index - 1]?.value === "/";
+    }
+    return false;
+  }, "isSelfClosing");
+  for (let index = 0; index < tokens.length - 1; index++) {
+    if (tokens[index].value !== "<") continue;
+    if (tokens[index + 1].value === "/") {
+      const closing = tokens[index + 2]?.value;
+      if (closing && openDepth.has(closing)) {
+        openDepth.set(closing, Math.max(0, (openDepth.get(closing) ?? 0) - 1));
+      }
+      continue;
+    }
+    const tag = tokens[index + 1].value;
+    if (names.has(tag)) {
+      for (const [container, depth] of openDepth) {
+        if (depth > 0) return container;
+      }
+      continue;
+    }
+    if (PARSER_SENSITIVE_JSX_CONTAINERS.has(tag) && !isSelfClosing(index)) {
+      openDepth.set(tag, (openDepth.get(tag) ?? 0) + 1);
+    }
+  }
+  return void 0;
+}
+__name(findParserSensitiveJsxContainer, "findParserSensitiveJsxContainer");
 function countStaticJsxUses(content, localBindings) {
   if (!content || localBindings.length === 0) return 0;
   const names = new Set(localBindings);
@@ -18698,6 +18960,37 @@ function getClientRenderingHelpers(tokens, clientBindings) {
   return helpers;
 }
 __name(getClientRenderingHelpers, "getClientRenderingHelpers");
+function passesElementValuedProps(content, localBindings) {
+  if (!content || localBindings.length === 0) return false;
+  const names = new Set(localBindings);
+  const tokens = tokenizeModuleSource(content);
+  for (let index = 0; index < tokens.length - 1; index++) {
+    if (tokens[index].value !== "<" || !names.has(tokens[index + 1].value)) continue;
+    const name2 = tokens[index + 1].value;
+    let cursor = index + 2;
+    let braceDepth = 0;
+    let selfClosing = false;
+    for (; cursor < tokens.length; cursor++) {
+      const value = tokens[cursor].value;
+      if (value === "{") braceDepth++;
+      else if (value === "}") braceDepth--;
+      else if (value === "<" && braceDepth > 0) return true;
+      else if (value === ">" && braceDepth === 0) {
+        selfClosing = tokens[cursor - 1]?.value === "/";
+        break;
+      }
+    }
+    if (selfClosing || cursor >= tokens.length) continue;
+    for (let child = cursor + 1; child < tokens.length; child++) {
+      if (tokens[child].value !== "<") continue;
+      const closesBoundary = tokens[child + 1]?.value === "/" && tokens[child + 2]?.value === name2;
+      if (!closesBoundary) return true;
+      break;
+    }
+  }
+  return false;
+}
+__name(passesElementValuedProps, "passesElementValuedProps");
 function hasDynamicJsxCardinality(content, localBindings) {
   if (!content || localBindings.length === 0) return false;
   const clientBindings = new Set(localBindings);
@@ -18780,6 +19073,17 @@ function collectIsolatedClientBoundaries(ownerPath, root) {
       if (fallbackReason || importedBoundaryCount === 0) continue;
       const localBindings = importedBindings.get(specifier) ?? [];
       const staticUses = countStaticJsxUses(content, localBindings);
+      if (staticUses > 0) {
+        const container = findParserSensitiveJsxContainer(content, localBindings);
+        if (container) {
+          fallbackReason = `the client boundary imported from ${specifier} renders inside <${container}>, where the HTML parser relocates its hydration marker`;
+          return 0;
+        }
+        if (passesElementValuedProps(content, localBindings)) {
+          fallbackReason = `the client boundary imported from ${specifier} receives React elements, which cannot cross the boundary as serialized props`;
+          return 0;
+        }
+      }
       if (staticUses > 0 && hasDynamicJsxCardinality(content, localBindings)) {
         fallbackReason = `the client boundary count imported from ${specifier} is data-dependent`;
         costGuardExceeded = true;
@@ -20624,6 +20928,7 @@ init_observability();
 init_navigation_errors();
 
 // src/metadata.ts
+init_agent_config();
 function mergeMetadata(base, next) {
   if (!base) return next ? { ...next } : {};
   if (!next) return { ...base };
@@ -20686,7 +20991,7 @@ function addMetadataImageReference(metadata, reference) {
   };
 }
 __name(addMetadataImageReference, "addMetadataImageReference");
-function renderMetadataHead(metadata) {
+function renderMetadataHead(metadata, options = {}) {
   const resolvedMetadata = metadata || {};
   const metadataBase = resolveMetadataBase(resolvedMetadata);
   const explicitTitle = resolveMetadataTitle(resolvedMetadata.title);
@@ -20707,14 +21012,16 @@ function renderMetadataHead(metadata) {
   appendMetaName(tags, "publisher", resolvedMetadata.publisher);
   appendMetaName(tags, "robots", normalizeRobots(resolvedMetadata.robots));
   const alternates = resolvedMetadata.alternates;
-  if (isRecord(alternates)) {
-    appendLink(tags, "canonical", resolveMetadataUrl(alternates.canonical, metadataBase));
-    if (isRecord(alternates.languages)) {
-      for (const [language, href] of Object.entries(alternates.languages)) {
-        appendLink(tags, "alternate", resolveMetadataUrl(href, metadataBase), {
-          hreflang: language
-        });
-      }
+  const explicitCanonical = isRecord(alternates) ? alternates.canonical : void 0;
+  const canonicalHref = explicitCanonical != null ? resolveMetadataUrl(explicitCanonical, metadataBase) : options.pathname ? resolveMetadataUrl(options.pathname, metadataBase) : void 0;
+  if (canonicalHref) {
+    appendLink(tags, "canonical", canonicalHref);
+  }
+  if (isRecord(alternates) && isRecord(alternates.languages)) {
+    for (const [language, href] of Object.entries(alternates.languages)) {
+      appendLink(tags, "alternate", resolveMetadataUrl(href, metadataBase), {
+        hreflang: language
+      });
     }
   }
   const hasFavicon = appendIcons(tags, resolvedMetadata.icons, metadataBase);
@@ -20727,6 +21034,16 @@ function renderMetadataHead(metadata) {
   }
   appendOpenGraph(tags, resolvedMetadata.openGraph, metadataBase);
   appendTwitter(tags, resolvedMetadata.twitter, metadataBase);
+  if (options.jsonLd) {
+    const jsonLdConfig = options.jsonLd === true ? {} : options.jsonLd;
+    const jsonLdScript = renderFarmAgentJsonLd(jsonLdConfig, {
+      metadataBase,
+      siteName: isRecord(resolvedMetadata.openGraph) ? normalizeContent(resolvedMetadata.openGraph.siteName) : void 0,
+      title: explicitTitle,
+      description: normalizeContent(resolvedMetadata.description)
+    });
+    if (jsonLdScript) tags.push(jsonLdScript);
+  }
   return {
     title: escapeText(title),
     tags: tags.length > 0 ? `
@@ -20752,7 +21069,7 @@ function appendOpenGraph(tags, openGraph, metadataBase) {
   appendMetaProperty(tags, "og:description", openGraph.description);
   appendMetaProperty(tags, "og:url", resolveMetadataUrl(openGraph.url, metadataBase));
   appendMetaProperty(tags, "og:site_name", openGraph.siteName);
-  appendMetaProperty(tags, "og:type", openGraph.type);
+  appendMetaProperty(tags, "og:type", openGraph.type ?? "website");
   appendMetaProperty(tags, "og:locale", openGraph.locale);
   const images = normalizeMetadataImages(
     openGraph.images ?? openGraph.image,
@@ -23907,7 +24224,7 @@ _setFarmThemeServerSnapshotResolver(() => {
 });
 
 // package.json
-var version = "0.1.0-beta.97";
+var version = "0.1.0-beta.99";
 
 // src/version.ts
 var FARM_VERSION = version;
@@ -24077,6 +24394,13 @@ function hasRequestHeader(req, name2) {
   return Array.isArray(value) ? value.length > 0 : Boolean(value);
 }
 __name(hasRequestHeader, "hasRequestHeader");
+function getFarmMetadataPathname(req) {
+  const raw = req.__FARM_ROUTE__ || req.url;
+  if (typeof raw !== "string" || raw.length === 0) return void 0;
+  const boundary = raw.search(/[?#]/);
+  return boundary === -1 ? raw : raw.slice(0, boundary);
+}
+__name(getFarmMetadataPathname, "getFarmMetadataPathname");
 function serializeInlineValue2(value) {
   return JSON.stringify(value).replace(/</g, "\\u003c").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
@@ -24610,7 +24934,21 @@ var _ServerRenderer = class _ServerRenderer {
           const html = await this.rendererRuntime.renderToString(
             await this.wrapWithIntegrationProviders(pageElement)
           );
-          await this.cacheSSGPage(page2, html, { document: false });
+          const mergedMetadata = await this.resolveRouteMetadata({
+            layoutModules,
+            routeModule: mod,
+            pageProps,
+            pathname: page2.urlPath
+          });
+          const { title, tags, hasFavicon } = renderMetadataHead(mergedMetadata);
+          const metadataHead = `${hasFavicon ? "" : '<link rel="icon" href="data:,">\n  '}<title>${title}</title>${tags}`;
+          const fullDocument = this.createFullHTML(
+            html,
+            pageMetadata.shouldHydrate === true,
+            page2.urlPath,
+            metadataHead
+          );
+          await this.cacheSSGPage(page2, fullDocument, { document: true });
           logger.info(`ISR: Regenerated ${page2.urlPath}`);
         } catch (error) {
           logger.error(`ISR regeneration failed for ${page2.urlPath}: ${error}`);
@@ -25650,7 +25988,10 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
         tags: metaTags,
         hasFavicon,
         hasExplicitTitle
-      } = renderMetadataHead(req.__FARM_METADATA__);
+      } = renderMetadataHead(req.__FARM_METADATA__, {
+        pathname: getFarmMetadataPathname(req),
+        jsonLd: this.config.agent?.jsonLd
+      });
       const documentTitleTag = !hasExplicitTitle && /<title[\s>]/i.test(rendererHead) ? "" : `<title>${title}</title>`;
       const i18nSnapshot = getFarmI18nClientSnapshot();
       const alternateTags = i18nSnapshot ? renderI18nAlternateLinks(req.__FARM_ROUTE__ || req.url || "/", i18nSnapshot) : "";
@@ -25835,7 +26176,10 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
         title,
         tags: metaTags,
         hasFavicon
-      } = renderMetadataHead(req.__FARM_METADATA__);
+      } = renderMetadataHead(req.__FARM_METADATA__, {
+        pathname: getFarmMetadataPathname(req),
+        jsonLd: this.config.agent?.jsonLd
+      });
       const i18nSnapshot = getFarmI18nClientSnapshot();
       const i18nAlternateTags = i18nSnapshot ? renderI18nAlternateLinks(req.__FARM_ROUTE__ || req.url || "/", i18nSnapshot) : "";
       const fontHead = renderFarmFontDevHead(this.config.root || process.cwd());
@@ -25993,6 +26337,15 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
     const pathname = resolveFarmRequestURL(req, {
       trustProxy: this.config.server?.trustProxy
     }).pathname;
+    const acceptHeader = req.headers.accept;
+    const accept = Array.isArray(acceptHeader) ? acceptHeader.join(",") : acceptHeader;
+    if (farmRequestWantsMarkdown(pathname, accept)) {
+      res.setHeader("Content-Type", FARM_MARKDOWN_CONTENT_TYPE);
+      res.setHeader("X-Farm-Markdown-Error", "404");
+      res.setHeader("Cache-Control", "no-store");
+      res.end(createFarmMarkdownErrorBody(404, pathname, this.config.basePath || "/"));
+      return;
+    }
     try {
       const appDir = path12.join(this.config.root, this.config.srcDir, "app");
       const notFoundExtensions = getFarmRendererComponentExtensions(this.config.renderer);
@@ -26078,7 +26431,7 @@ ${getFarmI18nClientSnapshot() ? `window.__FARM_I18N__ = ${serializeInlineValue2(
     res.write(html);
     res.end();
   }
-  createFullHTML(content, isClientComponent = false, requestPath = "/", documentTitle = "Farm.js App") {
+  createFullHTML(content, isClientComponent = false, requestPath = "/", metadataHead) {
     const i18nSnapshot = getFarmI18nClientSnapshot();
     const clientScript = isClientComponent ? `  <script type="module" src="/@farm/client.js"></script>` : "";
     const integrationManifestScript = `<script>
@@ -26102,6 +26455,7 @@ ${i18nSnapshot ? `window.__FARM_I18N__ = ${serializeInlineValue2(i18nSnapshot)};
         headAssets: [
           themeDocument.head,
           `<meta name="farm-deployment-id" content="${escapeHtmlAttribute2(this.getDeploymentId())}">`,
+          metadataHead,
           alternateLinks,
           fontHead,
           `<link rel="stylesheet" href="/src/app/globals.css" />`,
@@ -26120,8 +26474,7 @@ ${i18nSnapshot ? `window.__FARM_I18N__ = ${serializeInlineValue2(i18nSnapshot)};
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <meta name="farm-deployment-id" content="${escapeHtmlAttribute2(this.getDeploymentId())}">
-  <link rel="icon" href="data:,">
-  <title>${escapeHtmlAttribute2(documentTitle)}</title>${alternateLinks}
+  ${metadataHead ?? '<link rel="icon" href="data:,">\n  <title>Farm.js App</title>'}${alternateLinks}
   ${fontHead}
   <link rel="stylesheet" href="/src/app/globals.css" />${this.collectDevStyleLinks().map((l) => `
   ${l}`).join("")}
@@ -26286,6 +26639,7 @@ var _FarmApp = class _FarmApp {
         ppr: config.experimental?.ppr ?? false,
         ...config.experimental
       },
+      agent: config.agent ?? {},
       vite: config.vite || {}
     };
   }
@@ -30645,6 +30999,110 @@ function formatServerFnBoundaryError(violation, id) {
 }
 __name(formatServerFnBoundaryError, "formatServerFnBoundaryError");
 
+// src/client-boundary-env.ts
+var FUNCTION_BODY_TYPES = /* @__PURE__ */ new Set([
+  "FunctionDeclaration",
+  "FunctionExpression",
+  "ArrowFunctionExpression"
+]);
+function shouldInspectClientBoundary(id, code) {
+  if (id.startsWith("\0") || id.startsWith("virtual:") || id.includes("node_modules")) return false;
+  return code.includes("process.env") || code.includes("node:");
+}
+__name(shouldInspectClientBoundary, "shouldInspectClientBoundary");
+function analyzeClientBoundary(program, publicKeys) {
+  const envKeys = /* @__PURE__ */ new Set();
+  const publicEnvKeys = /* @__PURE__ */ new Set();
+  const builtinImports = /* @__PURE__ */ new Set();
+  const visit = /* @__PURE__ */ __name((node, inFunction) => {
+    if (!node || typeof node !== "object") return;
+    if (Array.isArray(node)) {
+      for (const entry of node) visit(entry, inFunction);
+      return;
+    }
+    const estree = node;
+    if (typeof estree.type !== "string") return;
+    if (!inFunction) {
+      const builtin = readNodeBuiltinSource(estree);
+      if (builtin !== void 0) builtinImports.add(builtin);
+      const key = readProcessEnvKey(estree);
+      if (key !== void 0) {
+        if (key !== "NODE_ENV") {
+          (publicKeys.has(key) ? publicEnvKeys : envKeys).add(key);
+        }
+        return;
+      }
+    }
+    const nextInFunction = inFunction || FUNCTION_BODY_TYPES.has(estree.type);
+    for (const [childKey, value] of Object.entries(estree)) {
+      if (childKey === "type") continue;
+      visit(value, nextInFunction);
+    }
+  }, "visit");
+  visit(program.body, false);
+  return {
+    envKeys: [...envKeys],
+    publicEnvKeys: [...publicEnvKeys],
+    builtinImports: [...builtinImports]
+  };
+}
+__name(analyzeClientBoundary, "analyzeClientBoundary");
+function readNodeBuiltinSource(node) {
+  if (node.type === "ImportDeclaration" || node.type === "ExportNamedDeclaration" || node.type === "ExportAllDeclaration" || node.type === "ImportExpression") {
+    const value = node.source?.value;
+    return typeof value === "string" && value.startsWith("node:") ? value : void 0;
+  }
+  if (node.type === "CallExpression") {
+    const callee = node.callee;
+    if (callee?.type === "Identifier" && callee.name === "require") {
+      const arg = node.arguments?.[0];
+      const value = arg?.type === "Literal" ? arg.value : void 0;
+      return typeof value === "string" && value.startsWith("node:") ? value : void 0;
+    }
+  }
+  return void 0;
+}
+__name(readNodeBuiltinSource, "readNodeBuiltinSource");
+function readProcessEnvKey(node) {
+  if (node.type !== "MemberExpression") return void 0;
+  const object = node.object;
+  if (!object || object.type !== "MemberExpression" || object.object?.type !== "Identifier" || object.object.name !== "process" || object.property?.name !== "env") {
+    return void 0;
+  }
+  const property = node.property;
+  if (!property) return void 0;
+  if (!node.computed && property.type === "Identifier") {
+    return property.name;
+  }
+  if (node.computed && property.type === "Literal") {
+    const value = property.value;
+    return typeof value === "string" ? value : void 0;
+  }
+  return void 0;
+}
+__name(readProcessEnvKey, "readProcessEnvKey");
+function formatClientBoundaryWarning(id, findings) {
+  const { envKeys, publicEnvKeys, builtinImports } = findings;
+  const lines = [`${id} is compiled for the client but uses server-only APIs:`];
+  if (envKeys.length > 0) {
+    lines.push(
+      `- module-scope read of process.env.${envKeys.join(", process.env.")} \u2014 undefined in the browser. Move the read behind a server boundary, or expose it through env.public in farm.config.ts.`
+    );
+  }
+  if (publicEnvKeys.length > 0) {
+    lines.push(
+      `- module-scope read of process.env.${publicEnvKeys.join(", process.env.")} \u2014 process.env is not populated in the browser even for public keys. Read it through publicEnv from "@farm.js/core/env".`
+    );
+  }
+  if (builtinImports.length > 0) {
+    lines.push(
+      `- import of ${builtinImports.join(", ")} \u2014 stubbed with an empty object in the browser. Move the import into server-only code.`
+    );
+  }
+  return lines.join("\n");
+}
+__name(formatClientBoundaryWarning, "formatClientBoundaryWarning");
+
 // src/vite.ts
 init_deployment();
 init_image_config();
@@ -31629,6 +32087,24 @@ function isFarmConfigFile(file, root) {
   return FARM_CONFIG_FILENAMES.has(relative6);
 }
 __name(isFarmConfigFile, "isFarmConfigFile");
+var warnedClientBoundaryIds = /* @__PURE__ */ new Set();
+function warnClientBoundaryOnce(context2, id, code, config) {
+  if (warnedClientBoundaryIds.has(id)) return;
+  let program;
+  try {
+    program = context2.parse(code);
+  } catch {
+    return;
+  }
+  const publicKeys = new Set(Object.keys(config.env?.public ?? {}));
+  const findings = analyzeClientBoundary(program, publicKeys);
+  if (findings.envKeys.length === 0 && findings.publicEnvKeys.length === 0 && findings.builtinImports.length === 0) {
+    return;
+  }
+  warnedClientBoundaryIds.add(id);
+  logger.warn(formatClientBoundaryWarning(id, findings));
+}
+__name(warnClientBoundaryOnce, "warnClientBoundaryOnce");
 function farmPlugin(options = {}, initialPluginManager) {
   const imageImports = farmImageImportsPlugin();
   const fontImports = farmFontImportsPlugin({
@@ -32239,6 +32715,22 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             }
             return;
           }
+          if (openAPIManager && options.openapi?.specRoute && requestPathname === options.openapi.specRoute) {
+            if (requestMethod !== "GET" && requestMethod !== "HEAD") {
+              res.statusCode = 405;
+              res.setHeader("Allow", "GET, HEAD");
+              res.setHeader("Content-Type", "text/plain; charset=utf-8");
+              res.end("Method Not Allowed");
+              return;
+            }
+            const spec = await openAPIManager.getSpec();
+            const body = JSON.stringify(spec);
+            res.statusCode = 200;
+            res.setHeader("Content-Type", "application/json; charset=utf-8");
+            res.setHeader("Cache-Control", "no-store");
+            res.end(requestMethod === "HEAD" ? void 0 : body);
+            return;
+          }
           if (openAPIManager && requestPathname === options.openapi?.route) {
             const docsHandler = openAPIManager.getDocsRouteHandler();
             return docsHandler(req, res);
@@ -32249,6 +32741,11 @@ window.__FARM_MANIFEST__ = ${inlineValue({
               docsHeaders.set(key, Array.isArray(value) ? value.join(", ") : value);
             }
           }
+          const runAppMiddlewareForContentRoute = /* @__PURE__ */ __name(async () => {
+            if (!middlewareManager?.hasMiddleware()) return false;
+            const middlewareRequest = createRequestFromNodeRequest(req, new URL(fullUrl));
+            return farmApp.getServerRenderer().runWithRequestContext(middlewareRequest, () => middlewareManager.execute(req, res));
+          }, "runAppMiddlewareForContentRoute");
           if (farmDocsHandler) {
             const docsRequest = new Request(fullUrl, {
               method: requestMethod,
@@ -32256,6 +32753,7 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             });
             const docsResponse = await farmDocsHandler(docsRequest.clone());
             if (docsResponse) {
+              if (await runAppMiddlewareForContentRoute()) return;
               await sendWebResponse(
                 res,
                 await wrapFarmDocsResponseWithLayouts(docsRequest, docsResponse)
@@ -32282,6 +32780,7 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             }, "resolveSource")
           });
           if (markdownSourceResponse) {
+            if (await runAppMiddlewareForContentRoute()) return;
             await sendWebResponse(res, markdownSourceResponse);
             return;
           }
@@ -32295,9 +32794,23 @@ window.__FARM_MANIFEST__ = ${inlineValue({
             renderPage: /* @__PURE__ */ __name(async (request) => fetch(request), "renderPage")
           });
           if (markdownResponse) {
+            if (await runAppMiddlewareForContentRoute()) return;
             await sendWebResponse(res, markdownResponse);
             return;
           }
+          if (farmRequestWantsMarkdown(requestPathname, req.headers.accept)) {
+            const markdownRoute = farmApp.getRouteManager().matchRoute(normalizeFarmMarkdownRoutePath(requestPathname));
+            if (!markdownRoute.route) {
+              res.statusCode = 404;
+              res.setHeader("Content-Type", FARM_MARKDOWN_CONTENT_TYPE);
+              res.setHeader("X-Farm-Markdown-Error", "404");
+              res.setHeader("Cache-Control", "no-store");
+              res.end(
+                createFarmMarkdownErrorBody(404, requestPathname, farmConfig.basePath || "/")
+              );
+              return;
+            }
+          }
           const markdownPageTarget = resolveMarkdownMirrorTarget(
             farmApp.getConfig().md,
             requestPathname,
@@ -33246,6 +33759,9 @@ export const manifest = getManifest();
           }
         }
       }
+      if (!transformOptions?.ssr && shouldInspectClientBoundary(id, code)) {
+        warnClientBoundaryOnce(this, id, code, farmApp?.getConfig() ?? options);
+      }
       if (typeof imageImports.transform === "function") {
         const imageModule = await imageImports.transform.call(this, code, id, transformOptions);
         if (imageModule) return imageModule;