@farm.js/core 0.1.30 → 0.1.34

package/dist/{chunk-E76XC6ZG.mjs → chunk-EZDQRNQ7.mjs}

@@ -17,10 +17,10 @@ import {
 import {
   isFarmLocaleChangeHref,
   localizeActiveFarmHref
-} from "./chunk-TOVMYGYW.mjs";
+} from "./chunk-F2SE2VDO.mjs";
 import {
   resolveFarmNavigationURL
-} from "./chunk-5HGR3W6O.mjs";
+} from "./chunk-5SJWVY6R.mjs";
 import {
   getFarmClientDataCache
 } from "./chunk-XNPDONUH.mjs";

package/dist/{chunk-TOVMYGYW.mjs → chunk-F2SE2VDO.mjs}

@@ -1,6 +1,6 @@
 import {
   resolveFarmNavigationURL
-} from "./chunk-5HGR3W6O.mjs";
+} from "./chunk-5SJWVY6R.mjs";
 import {
   getActiveFarmI18nSnapshot
 } from "./chunk-C4NCTZLM.mjs";

package/dist/{chunk-BSPQVJ4A.mjs → chunk-FDR64H6B.mjs}

@@ -21,6 +21,13 @@ function getRequestStore() {
 }
 __name(getRequestStore, "getRequestStore");
 var requestStore = getRequestStore();
+var REQUEST_READS_KEY = /* @__PURE__ */ Symbol.for("@farm.js/core/request-reads");
+function getRequestReads() {
+  const runtime = globalThis;
+  return runtime[REQUEST_READS_KEY] ?? (runtime[REQUEST_READS_KEY] = /* @__PURE__ */ new WeakMap());
+}
+__name(getRequestReads, "getRequestReads");
+var requestReads = getRequestReads();
 _setCurrentRequestResolver(() => requestStore.getStore());
 function resolveFarmRequestURL(req, options = {}) {
   if (options.origin) {
@@ -109,9 +116,14 @@ function getCurrentRequest() {
       "No current request is available. getCurrentRequest() can only be used during server rendering."
     );
   }
+  requestReads.set(request, (requestReads.get(request) ?? 0) + 1);
   return request;
 }
 __name(getCurrentRequest, "getCurrentRequest");
+function _getRequestReadCount(request = requestStore.getStore()) {
+  return request ? requestReads.get(request) ?? 0 : 0;
+}
+__name(_getRequestReadCount, "_getRequestReadCount");
 function getCurrentRequestOrNull() {
   return requestStore.getStore() ?? null;
 }
@@ -123,5 +135,6 @@ export {
   createWebRequestFromFarmRequest,
   _runWithCurrentRequest,
   getCurrentRequest,
+  _getRequestReadCount,
   getCurrentRequestOrNull
 };

package/dist/{chunk-5OVTOKGH.cjs → chunk-FFFW3OQ7.cjs}

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkSWN467MPcjs = require('./chunk-SWN467MP.cjs');
+var _chunkC4SPBWFMcjs = require('./chunk-C4SPBWFM.cjs');
 
 
 var _chunkLIUGYUX3cjs = require('./chunk-LIUGYUX3.cjs');
@@ -48,7 +48,7 @@ function isFarmLocaleChangeHref(href) {
   const snapshot = getFarmI18nClientState();
   if (!snapshot || typeof window === "undefined") return false;
   if (snapshot.routing === "none") return false;
-  const target = _chunkSWN467MPcjs.resolveFarmNavigationURL.call(void 0, href, window.location.href);
+  const target = _chunkC4SPBWFMcjs.resolveFarmNavigationURL.call(void 0, href, window.location.href);
   const match = _chunkBIDYX3SLcjs.resolveFarmLocalePath.call(void 0, target.pathname, snapshot);
   const targetLocale = match.locale || snapshot.defaultLocale;
   return targetLocale !== snapshot.locale;

package/dist/{chunk-D4JE5NNV.cjs → chunk-FNO7A7CM.cjs}

@@ -17,10 +17,10 @@ var _chunkSU7MH53Pcjs = require('./chunk-SU7MH53P.cjs');
 
 
 
-var _chunk5OVTOKGHcjs = require('./chunk-5OVTOKGH.cjs');
+var _chunkFFFW3OQ7cjs = require('./chunk-FFFW3OQ7.cjs');
 
 
-var _chunkSWN467MPcjs = require('./chunk-SWN467MP.cjs');
+var _chunkC4SPBWFMcjs = require('./chunk-C4SPBWFM.cjs');
 
 
 var _chunk63H6BKXGcjs = require('./chunk-63H6BKXG.cjs');
@@ -1213,7 +1213,7 @@ function LinkInner({
     hash,
     trailingSlash: _nullishCoalesce(trailingSlash, () => ( _chunkOYEUREB6cjs.getFarmTrailingSlashPreference.call(void 0, )))
   });
-  const localizedHref = _chunk5OVTOKGHcjs.localizeActiveFarmHref.call(void 0, baseHref, locale);
+  const localizedHref = _chunkFFFW3OQ7cjs.localizeActiveFarmHref.call(void 0, baseHref, locale);
   const resolvedHref = isExternalUrl(localizedHref) ? localizedHref : _chunkI57LW5VZcjs.applyFarmBasePath.call(void 0, localizedHref, _nullishCoalesce(_optionalChain([farm, 'optionalAccess', _34 => _34.basePath]), () => ( _chunkI57LW5VZcjs.getFarmBasePath.call(void 0, ))));
   const isExternal = isExternalUrl(resolvedHref);
   const doPrefetch = _react.useCallback.call(void 0, () => {
@@ -1333,7 +1333,7 @@ function LinkInner({
       if (event.button !== 0) return;
       if (typeof window !== "undefined") {
         event.preventDefault();
-        if (_chunk5OVTOKGHcjs.isFarmLocaleChangeHref.call(void 0, localizedHref)) {
+        if (_chunkFFFW3OQ7cjs.isFarmLocaleChangeHref.call(void 0, localizedHref)) {
           window.location.assign(resolvedHref);
           return;
         }
@@ -1433,7 +1433,7 @@ function applyPreservedSearchParams(href) {
   const manifest = window.__FARM_MANIFEST__;
   const routes = _optionalChain([manifest, 'optionalAccess', _41 => _41.routes]) && typeof manifest.routes === "object" ? Object.values(manifest.routes) : [];
   if (routes.length === 0) return href;
-  const url = _chunkSWN467MPcjs.resolveFarmNavigationURL.call(void 0, href, window.location.href);
+  const url = _chunkC4SPBWFMcjs.resolveFarmNavigationURL.call(void 0, href, window.location.href);
   const route = routes.find((candidate) => matchManifestRoute(url.pathname, candidate));
   const preserve = Array.isArray(_optionalChain([route, 'optionalAccess', _42 => _42.search, 'optionalAccess', _43 => _43.preserve])) ? route.search.preserve : [];
   if (preserve.length === 0) return href;

package/dist/chunk-FZ6YYU2W.mjs

@@ -0,0 +1,65 @@
+import {
+  getRequestSourceOrigin,
+  matchesAllowedOrigin,
+  matchesHostHeader,
+  normalizeAllowedOriginPattern
+} from "./chunk-FP2INE7H.mjs";
+import {
+  __name
+} from "./chunk-LPEX4YW6.mjs";
+
+// src/integration-request-security.ts
+function resolveIntegrationAllowedOrigins(values, label) {
+  return Object.freeze((values ?? []).map((value) => normalizeAllowedOriginPattern(value, label)));
+}
+__name(resolveIntegrationAllowedOrigins, "resolveIntegrationAllowedOrigins");
+function validateIntegrationRequestOrigin(request, policy = {}) {
+  const allowedOrigins = policy.allowedOrigins ?? [];
+  const requireOriginMetadata = policy.requireOriginMetadata ?? true;
+  const fetchSite = request.headers.get("sec-fetch-site")?.trim().toLowerCase();
+  const source = getRequestSourceOrigin(request);
+  if (!source.ok) {
+    return { ok: false, reason: source.reason };
+  }
+  if (source.origin === null) {
+    if (fetchSite === "same-origin") {
+      return { ok: true };
+    }
+    if (requireOriginMetadata) {
+      return { ok: false, reason: fetchSite === "cross-site" ? "cross-site" : "missing-origin" };
+    }
+    return fetchSite === "cross-site" ? { ok: false, reason: "cross-site" } : { ok: true };
+  }
+  const requestUrl = new URL(request.url);
+  const matchesConfiguredOrigin = allowedOrigins.some(
+    (pattern) => matchesAllowedOrigin(source.origin, pattern)
+  );
+  const matchesRequest = source.origin === requestUrl.origin || matchesHostHeader(source.origin, request);
+  if (!matchesRequest && !matchesConfiguredOrigin) {
+    return { ok: false, reason: "cross-site" };
+  }
+  if (fetchSite === "cross-site" && !matchesConfiguredOrigin) {
+    return { ok: false, reason: "cross-site" };
+  }
+  return { ok: true };
+}
+__name(validateIntegrationRequestOrigin, "validateIntegrationRequestOrigin");
+function describeIntegrationOriginRejection(reason) {
+  switch (reason) {
+    case "missing-origin":
+      return "Request is missing same-origin metadata.";
+    case "opaque-origin":
+      return "Opaque origins are not allowed.";
+    case "invalid-origin":
+      return "Invalid request origin.";
+    case "cross-site":
+      return "Cross-site request was rejected.";
+  }
+}
+__name(describeIntegrationOriginRejection, "describeIntegrationOriginRejection");
+
+export {
+  resolveIntegrationAllowedOrigins,
+  validateIntegrationRequestOrigin,
+  describeIntegrationOriginRejection
+};

package/dist/{chunk-PZNCMPJF.cjs → chunk-G26MUMKL.cjs}

@@ -1,7 +1,7 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 
-var _chunkVHJGDMCGcjs = require('./chunk-VHJGDMCG.cjs');
+var _chunkIWZKTWHZcjs = require('./chunk-IWZKTWHZ.cjs');
 
 
 var _chunkWMAPPDMMcjs = require('./chunk-WMAPPDMM.cjs');
@@ -10,7 +10,7 @@ var _chunkWMAPPDMMcjs = require('./chunk-WMAPPDMM.cjs');
 var _chunkTKJZFIMLcjs = require('./chunk-TKJZFIML.cjs');
 
 
-var _chunkWPYFSQKKcjs = require('./chunk-WPYFSQKK.cjs');
+var _chunkLSKZMJMPcjs = require('./chunk-LSKZMJMP.cjs');
 
 
 
@@ -18,6 +18,9 @@ var _chunkWPYFSQKKcjs = require('./chunk-WPYFSQKK.cjs');
 var _chunkEM6SBQKMcjs = require('./chunk-EM6SBQKM.cjs');
 
 
+var _chunkKNBBQHO2cjs = require('./chunk-KNBBQHO2.cjs');
+
+
 
 var _chunkG7HXGLECcjs = require('./chunk-G7HXGLEC.cjs');
 
@@ -31,7 +34,7 @@ var _chunkS3A45T7Fcjs = require('./chunk-S3A45T7F.cjs');
 var _chunkZEG3OPIBcjs = require('./chunk-ZEG3OPIB.cjs');
 
 
-var _chunk5ZSWG4UXcjs = require('./chunk-5ZSWG4UX.cjs');
+var _chunkUXFQ3UDAcjs = require('./chunk-UXFQ3UDA.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -64,7 +67,7 @@ function mergePluginAPIRoutes(existing, plugins, expected, options = {}) {
     });
   }
   const api = createPluginLocalAPI(existing, options.bodySizeLimit);
-  for (const definition of _chunkVHJGDMCGcjs.resolvePluginRoutes.call(void 0, plugins, { api })) {
+  for (const definition of _chunkIWZKTWHZcjs.resolvePluginRoutes.call(void 0, plugins, { api })) {
     _chunkWMAPPDMMcjs.registerAPIRouteShape.call(void 0, shapes, definition.path, `plugin:${definition.path}`, "app");
     let route = routes.get(definition.path);
     if (_optionalChain([route, 'optionalAccess', _ => _.methods, 'access', _2 => _2.includes, 'call', _3 => _3(definition.method)])) {
@@ -164,7 +167,7 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, getAllowedAPIRouteMethods, "getAllowedAPIR
 function matchAPIRouteAtBasePath(routes, pathname, serverBasePath = _chunkS3A45T7Fcjs.DEFAULT_FARM_API_BASE_PATH) {
   const directMatch = _chunkG7HXGLECcjs.matchAPIRoute.call(void 0, routes, pathname);
   if (directMatch) return directMatch;
-  const canonicalPathname = _chunkWPYFSQKKcjs.resolveFarmAPICanonicalPathname.call(void 0, pathname, serverBasePath);
+  const canonicalPathname = _chunkKNBBQHO2cjs.resolveFarmAPICanonicalPathname.call(void 0, pathname, serverBasePath);
   return canonicalPathname === pathname ? null : _chunkG7HXGLECcjs.matchAPIRoute.call(void 0, routes, canonicalPathname);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, matchAPIRouteAtBasePath, "matchAPIRouteAtBasePath");
@@ -173,7 +176,7 @@ function createStaticAPIRouteMatcherAtBasePath(routes, serverBasePath = _chunkS3
   return (pathname) => {
     const directMatch = match(pathname);
     if (directMatch) return directMatch;
-    const canonicalPathname = _chunkWPYFSQKKcjs.resolveFarmAPICanonicalPathname.call(void 0, pathname, serverBasePath);
+    const canonicalPathname = _chunkKNBBQHO2cjs.resolveFarmAPICanonicalPathname.call(void 0, pathname, serverBasePath);
     return canonicalPathname === pathname ? null : match(canonicalPathname);
   };
 }
@@ -191,7 +194,7 @@ async function invokeAPIRouteEndpoint(endpoint, request, params = {}, bodySizeLi
     if (response2) return response2;
     throw error;
   }
-  const response = await _chunk5ZSWG4UXcjs._runWithCurrentRequest.call(void 0, 
+  const response = await _chunkUXFQ3UDAcjs._runWithCurrentRequest.call(void 0, 
     request,
     () => invokeAPIRouteEndpointInContext(endpoint, request, params)
   );
@@ -256,7 +259,7 @@ async function invokeAPIRouteEndpointInContext(endpoint, request, params) {
       invalidations: []
     };
   } catch (error) {
-    if (_chunkVHJGDMCGcjs.isEndpointFailure.call(void 0, error)) {
+    if (_chunkIWZKTWHZcjs.isEndpointFailure.call(void 0, error)) {
       return createEndpointFailureResponse(error);
     }
     throw error;
@@ -388,6 +391,9 @@ async function readRequestBody(request) {
   }
   if (!text) return { body: void 0 };
   if (contentType === void 0) {
+    if (!_chunkLSKZMJMPcjs.validateIntegrationRequestOrigin.call(void 0, request, { requireOriginMetadata: false }).ok) {
+      return { body: void 0 };
+    }
     try {
       return { body: JSON.parse(text) };
     } catch (e5) {

package/dist/{chunk-IXUY2F5U.mjs → chunk-GCXWJJKH.mjs}

@@ -1,3 +1,6 @@
+import {
+  decodeCookieName
+} from "./chunk-JM5XPKWH.mjs";
 import {
   localizeFarmPathname,
   resolveFarmLocalePath
@@ -139,13 +142,7 @@ function readCookie(header, name) {
   for (const part of header.split(";")) {
     const separator = part.indexOf("=");
     if (separator < 0) continue;
-    let key;
-    try {
-      key = decodeURIComponent(part.slice(0, separator).trim());
-    } catch {
-      continue;
-    }
-    if (key !== name) continue;
+    if (decodeCookieName(part.slice(0, separator).trim()) !== name) continue;
     try {
       return decodeURIComponent(part.slice(separator + 1).trim());
     } catch {

package/dist/{chunk-JLCQGPXE.mjs → chunk-GNSDTTWZ.mjs}

@@ -1,12 +1,10 @@
-import {
-  getRequestSourceOrigin,
-  matchesAllowedOrigin,
-  matchesHostHeader,
-  normalizeAllowedOriginPattern
-} from "./chunk-FP2INE7H.mjs";
 import {
   defineSchema
 } from "./chunk-44SYJEG3.mjs";
+import {
+  compileMiddlewareConfig,
+  matchesCompiledMiddlewareConfig
+} from "./chunk-JG6DJF5A.mjs";
 import {
   bufferFarmRequestBody,
   clearRequestContext,
@@ -34,6 +32,12 @@ import {
   canonicalizeRequestPathSegments,
   canonicalizeRequestPathname
 } from "./chunk-CQ6OSQ3K.mjs";
+import {
+  resolveFarmLocalePath
+} from "./chunk-L3KT7IXV.mjs";
+import {
+  stripFarmBasePath
+} from "./chunk-4RB44K6Z.mjs";
 import {
   assertTerminalCatchAll,
   assertUniqueRouteParameters,
@@ -44,56 +48,6 @@ import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
 
-// src/integration-request-security.ts
-function resolveIntegrationAllowedOrigins(values, label) {
-  return Object.freeze((values ?? []).map((value) => normalizeAllowedOriginPattern(value, label)));
-}
-__name(resolveIntegrationAllowedOrigins, "resolveIntegrationAllowedOrigins");
-function validateIntegrationRequestOrigin(request, policy = {}) {
-  const allowedOrigins = policy.allowedOrigins ?? [];
-  const requireOriginMetadata = policy.requireOriginMetadata ?? true;
-  const fetchSite = request.headers.get("sec-fetch-site")?.trim().toLowerCase();
-  const source = getRequestSourceOrigin(request);
-  if (!source.ok) {
-    return { ok: false, reason: source.reason };
-  }
-  if (source.origin === null) {
-    if (fetchSite === "same-origin") {
-      return { ok: true };
-    }
-    if (requireOriginMetadata) {
-      return { ok: false, reason: fetchSite === "cross-site" ? "cross-site" : "missing-origin" };
-    }
-    return fetchSite === "cross-site" ? { ok: false, reason: "cross-site" } : { ok: true };
-  }
-  const requestUrl = new URL(request.url);
-  const matchesConfiguredOrigin = allowedOrigins.some(
-    (pattern) => matchesAllowedOrigin(source.origin, pattern)
-  );
-  const matchesRequest = source.origin === requestUrl.origin || matchesHostHeader(source.origin, request);
-  if (!matchesRequest && !matchesConfiguredOrigin) {
-    return { ok: false, reason: "cross-site" };
-  }
-  if (fetchSite === "cross-site" && !matchesConfiguredOrigin) {
-    return { ok: false, reason: "cross-site" };
-  }
-  return { ok: true };
-}
-__name(validateIntegrationRequestOrigin, "validateIntegrationRequestOrigin");
-function describeIntegrationOriginRejection(reason) {
-  switch (reason) {
-    case "missing-origin":
-      return "Request is missing same-origin metadata.";
-    case "opaque-origin":
-      return "Opaque origins are not allowed.";
-    case "invalid-origin":
-      return "Invalid request origin.";
-    case "cross-site":
-      return "Cross-site request was rejected.";
-  }
-}
-__name(describeIntegrationOriginRejection, "describeIntegrationOriginRejection");
-
 // src/plugin-integration-context.ts
 var FARM_PLUGIN_INTEGRATION_CONTEXT = /* @__PURE__ */ Symbol.for("@farm.js/core/plugin-integration-context");
 function setFarmPluginIntegrationContext(plugin, integration) {
@@ -904,7 +858,7 @@ function createIntegrationPlugin(integrationKey, integration) {
         }
       }, "createHandlerRequest");
       for (const entry of middleware) {
-        const params = resolveMatcherParams(entry.matcher, pathname);
+        const params = resolveIntegrationMiddlewareParams(entry, pathname, context.config);
         if (!params) {
           continue;
         }
@@ -1623,7 +1577,7 @@ async function dispatchIntegrationRequest(runtime, request, options = {}) {
   const middleware = [...integration.middleware || []];
   const forwardedSetCookies = [];
   for (const entry of middleware) {
-    const params = resolveMatcherParams(entry.matcher, pathname);
+    const params = resolveIntegrationMiddlewareParams(entry, pathname, runtime.config);
     if (!params) {
       continue;
     }
@@ -2046,6 +2000,44 @@ function matchesMethod(methods, normalizedMethod) {
   return methods.some((candidate) => candidate === "ALL" || candidate === normalizedMethod);
 }
 __name(matchesMethod, "matchesMethod");
+var compiledIntegrationGuards = /* @__PURE__ */ new WeakMap();
+var noMiddlewareContext = {};
+function resolveIntegrationMiddlewareParams(entry, pathname, config) {
+  const params = resolveMatcherParams(entry.matcher, pathname);
+  if (params || !entry.matcher) return params;
+  const routePathname = resolveIntegrationRoutePathname(pathname, config);
+  if (routePathname !== pathname) {
+    const routeParams = resolveMatcherParams(entry.matcher, routePathname);
+    if (routeParams) return routeParams;
+  }
+  let compiled = compiledIntegrationGuards.get(entry);
+  if (!compiled) {
+    compiled = compileMiddlewareConfig({
+      matcher: typeof entry.matcher === "string" ? entry.matcher : [...entry.matcher]
+    });
+    compiledIntegrationGuards.set(entry, compiled);
+  }
+  for (const candidate of routePathname === pathname ? [pathname] : [pathname, routePathname]) {
+    const result = matchesCompiledMiddlewareConfig(candidate, compiled, noMiddlewareContext);
+    if (result.matched) return result.params ?? {};
+  }
+  return null;
+}
+__name(resolveIntegrationMiddlewareParams, "resolveIntegrationMiddlewareParams");
+function resolveIntegrationRoutePathname(pathname, config) {
+  const basePath = typeof config?.basePath === "string" ? config.basePath : void 0;
+  let routePathname = basePath ? stripFarmBasePath(pathname, basePath) : pathname;
+  const i18n = config?.i18n;
+  if (i18n && Array.isArray(i18n.locales) && i18n.locales.length > 0) {
+    routePathname = resolveFarmLocalePath(routePathname, {
+      locales: i18n.locales,
+      defaultLocale: i18n.defaultLocale,
+      routing: i18n.routing || "prefix-except-default"
+    }).pathname;
+  }
+  return routePathname;
+}
+__name(resolveIntegrationRoutePathname, "resolveIntegrationRoutePathname");
 function resolveMatcherParams(matcher, pathname) {
   if (!matcher) {
     return {};
@@ -2143,9 +2135,6 @@ function normalizeMatcher(matcher) {
 __name(normalizeMatcher, "normalizeMatcher");
 
 export {
-  resolveIntegrationAllowedOrigins,
-  validateIntegrationRequestOrigin,
-  describeIntegrationOriginRejection,
   getFarmPluginIntegrationContext,
   FARM_INTEGRATION_INTERNAL_DISPATCH_CONTEXT_KEY,
   FARM_INTEGRATION_SET_COOKIES_KEY,

package/dist/{chunk-D234YWNA.mjs → chunk-GOABMOX3.mjs}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-XAXTTBUT.mjs";
 import {
   serializeFarmLlmsTxt
-} from "./chunk-YMUE7L3D.mjs";
+} from "./chunk-NGVORZVZ.mjs";
 import {
   emitFarmAgentRead
 } from "./chunk-MVL2RAJW.mjs";
@@ -13,10 +13,16 @@ import {
 import {
   omitFarmResponseBody
 } from "./chunk-5WI2S4CO.mjs";
+import {
+  _listFarmMCPCatalogs
+} from "./chunk-QLQ32WC4.mjs";
 import {
   resolveFarmAPIServerBasePath,
   resolveFarmAPIServerRoutePath
-} from "./chunk-I6XDAKWQ.mjs";
+} from "./chunk-BTHHUD7Q.mjs";
+import {
+  FARM_VERSION
+} from "./chunk-X242HVD5.mjs";
 import {
   localizeFarmPathname
 } from "./chunk-L3KT7IXV.mjs";
@@ -514,6 +520,145 @@ function createFarmApiCatalogResponse(method, input, request) {
 }
 __name(createFarmApiCatalogResponse, "createFarmApiCatalogResponse");
 
+// src/app-manifest.ts
+var FARM_APP_MANIFEST_PATH = "/.well-known/farmjs";
+var FARM_INFRA_SIGNATURE_HEADER = "farmjs-infra-signature";
+var SIGNED_PURPOSE = "farmjs-manifest-v1";
+var SIGNATURE_WINDOW_SECONDS = 300;
+function resolveFarmAppManifestInput(config, extra) {
+  const llms = config.agent?.llmsTxt;
+  const plugins = (config.plugins ?? []).map(({ name }) => name);
+  const webmcp = plugins.includes("farm:webmcp");
+  return {
+    renderer: config.renderer?.name ?? "react",
+    basePath: config.basePath || "/",
+    build: extra.build,
+    packages: extra.packages,
+    webmcp: { enabled: webmcp, tools: webmcp ? extra.webmcpTools ?? [] : [] },
+    integrations: Object.entries(config.integrations ?? {}).flatMap(([key, integration]) => {
+      const category = integration?.category ?? integration?.slot;
+      return integration && category && integration.type ? [{ key, category, type: integration.type }] : [];
+    }),
+    agent: {
+      apiCatalog: config.agent?.apiCatalog ? "/.well-known/api-catalog" : null,
+      llmsTxt: llms === true || typeof llms === "object" && llms !== null && llms.enabled !== false,
+      openapi: config.openapi?.enabled && config.openapi.specRoute ? config.openapi.specRoute : null
+    },
+    plugins,
+    analytics: config.analytics !== false
+  };
+}
+__name(resolveFarmAppManifestInput, "resolveFarmAppManifestInput");
+var SOURCES = {
+  endpoint: "endpoint",
+  standalone: "defineTool",
+  serverFunction: "serverFunction"
+};
+function createFarmAppManifest(input) {
+  return {
+    schemaVersion: 1,
+    app: {
+      farm: FARM_VERSION,
+      renderer: input.renderer,
+      basePath: input.basePath,
+      build: input.build
+    },
+    packages: input.packages,
+    mcp: {
+      servers: _listFarmMCPCatalogs().map(({ server, tools, details }) => ({
+        name: server.name,
+        version: server.version,
+        path: server.path,
+        resources: [...details?.resources ?? []],
+        prompts: [...details?.prompts ?? []],
+        tools: tools.map((tool) => {
+          const schemas = details?.schemas?.[tool.name];
+          const hints = Object.fromEntries(
+            ["readOnlyHint", "destructiveHint", "idempotentHint", "openWorldHint"].filter((hint) => typeof tool[hint] === "boolean").map((hint) => [hint, tool[hint]])
+          );
+          return {
+            name: tool.name,
+            ...tool.title ? { title: tool.title } : {},
+            ...tool.description ? { description: tool.description } : {},
+            source: SOURCES[tool.kind],
+            ...tool.kind === "endpoint" ? { method: tool.method, path: tool.path } : {},
+            ...hints,
+            ...schemas ? { inputSchema: schemas.input } : {},
+            ...schemas?.output ? { outputSchema: schemas.output } : {}
+          };
+        })
+      }))
+    },
+    webmcp: input.webmcp,
+    integrations: input.integrations,
+    agent: input.agent,
+    plugins: input.plugins
+  };
+}
+__name(createFarmAppManifest, "createFarmAppManifest");
+var encoder = new TextEncoder();
+var hex = /* @__PURE__ */ __name((bytes) => [...new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join(""), "hex");
+async function sha256Hex(value) {
+  return hex(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
+}
+__name(sha256Hex, "sha256Hex");
+async function hmacHex(secret, message) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  return hex(await crypto.subtle.sign("HMAC", key, encoder.encode(message)));
+}
+__name(hmacHex, "hmacHex");
+function sameHex(a, b) {
+  if (a.length !== b.length) return false;
+  let difference = 0;
+  for (let index = 0; index < a.length; index++)
+    difference |= a.charCodeAt(index) ^ b.charCodeAt(index);
+  return difference === 0;
+}
+__name(sameHex, "sameHex");
+async function verifyFarmInfraManifestSignature(header, key, now = Date.now()) {
+  if (!header || header.length > 2048) return false;
+  const parts = header.split(",").map((part) => part.trim());
+  const timestamp = Number(
+    /^t=(\d{1,12})$/.exec(parts.find((part) => part.startsWith("t=")) ?? "")?.[1]
+  );
+  if (!Number.isSafeInteger(timestamp)) return false;
+  if (Math.abs(now / 1e3 - timestamp) > SIGNATURE_WINDOW_SECONDS) return false;
+  const signatures = parts.filter((part) => part.startsWith("v1=")).map((part) => part.slice(3)).filter((value) => /^[0-9a-f]{64}$/.test(value));
+  if (!signatures.length || signatures.length > 8) return false;
+  const expected = await hmacHex(await sha256Hex(key), `${SIGNED_PURPOSE}
+${timestamp}`);
+  return signatures.some((signature) => sameHex(signature, expected));
+}
+__name(verifyFarmInfraManifestSignature, "verifyFarmInfraManifestSignature");
+function processEnv() {
+  return globalThis.process?.env ?? {};
+}
+__name(processEnv, "processEnv");
+async function createFarmAppManifestResponse(request, input, options) {
+  if (request.method !== "GET" && request.method !== "HEAD") return null;
+  if (!options.development) {
+    const key = (options.env ?? processEnv()).FARMJS_API_KEY?.trim();
+    if (!input.analytics || !key) return null;
+    const signed = await verifyFarmInfraManifestSignature(
+      request.headers.get(FARM_INFRA_SIGNATURE_HEADER),
+      key
+    );
+    if (!signed)
+      return new Response(null, { status: 404, headers: { "cache-control": "no-store" } });
+  }
+  const body = JSON.stringify(createFarmAppManifest(input));
+  return new Response(request.method === "HEAD" ? null : body, {
+    headers: { "content-type": "application/json", "cache-control": "private, no-store" }
+  });
+}
+__name(createFarmAppManifestResponse, "createFarmAppManifestResponse");
+
 export {
   renderFarmLocaleAlternateLinks,
   createLateRedirectRecovery,
@@ -526,5 +671,8 @@ export {
   applyFarmThemeDocument,
   FARM_API_CATALOG_PATH,
   resolveFarmApiCatalogInput,
-  createFarmApiCatalogResponse
+  createFarmApiCatalogResponse,
+  FARM_APP_MANIFEST_PATH,
+  resolveFarmAppManifestInput,
+  createFarmAppManifestResponse
 };

package/dist/{chunk-HBTUGXHS.cjs → chunk-HLJ6MBUZ.cjs}

@@ -52,6 +52,9 @@ function resolveFarmI18nConfig(input, options = {}) {
   if (sameSite !== "lax" && sameSite !== "strict" && sameSite !== "none") {
     throw new Error('i18n.cookie.sameSite must be "lax", "strict", or "none".');
   }
+  if (sameSite === "none" && _optionalChain([input, 'access', _3 => _3.cookie, 'optionalAccess', _4 => _4.secure]) === false) {
+    throw new Error('i18n.cookie.secure cannot be false when i18n.cookie.sameSite is "none".');
+  }
   const direction = {};
   for (const [rawLocale, value] of Object.entries(input.direction || {})) {
     const locale = canonicalizeLocale(rawLocale);
@@ -74,15 +77,15 @@ function resolveFarmI18nConfig(input, options = {}) {
     fallbackLocale,
     strict: _nullishCoalesce(input.strict, () => ( strictByDefault)),
     cookie: {
-      name: _optionalChain([input, 'access', _3 => _3.cookie, 'optionalAccess', _4 => _4.name, 'optionalAccess', _5 => _5.trim, 'call', _6 => _6()]) || DEFAULT_FARM_I18N_COOKIE,
+      name: _optionalChain([input, 'access', _5 => _5.cookie, 'optionalAccess', _6 => _6.name, 'optionalAccess', _7 => _7.trim, 'call', _8 => _8()]) || DEFAULT_FARM_I18N_COOKIE,
       maxAge: normalizePositiveInteger(
-        _optionalChain([input, 'access', _7 => _7.cookie, 'optionalAccess', _8 => _8.maxAge]),
+        _optionalChain([input, 'access', _9 => _9.cookie, 'optionalAccess', _10 => _10.maxAge]),
         DEFAULT_FARM_I18N_COOKIE_MAX_AGE,
         "i18n.cookie.maxAge"
       ),
-      path: normalizeCookiePath(_optionalChain([input, 'access', _9 => _9.cookie, 'optionalAccess', _10 => _10.path])),
+      path: normalizeCookiePath(_optionalChain([input, 'access', _11 => _11.cookie, 'optionalAccess', _12 => _12.path])),
       sameSite,
-      secure: _nullishCoalesce(_optionalChain([input, 'access', _11 => _11.cookie, 'optionalAccess', _12 => _12.secure]), () => ( options.mode === "production"))
+      secure: _nullishCoalesce(_optionalChain([input, 'access', _13 => _13.cookie, 'optionalAccess', _14 => _14.secure]), () => ( (sameSite === "none" || options.mode === "production")))
     },
     direction
   };