@farm.js/core 0.1.36 → 0.1.38

package/dist/{chunk-UH6QN5NL.mjs → chunk-P664ZVTV.mjs}

@@ -1,10 +1,10 @@
 import {
   collectFarmLlmsTxtPages
-} from "./chunk-DTSROJ5J.mjs";
+} from "./chunk-HD5CF3OE.mjs";
 import {
   getFarmMarkdownMirrorPath,
   isFarmMarkdownMirrorExposed
-} from "./chunk-WWIKMBRN.mjs";
+} from "./chunk-VNGH5MLF.mjs";
 import {
   _listFarmMCPCatalogs,
   _listFarmRegisteredMCPServers

package/dist/{chunk-TE2G5ION.cjs → chunk-PGZDEPTM.cjs}

@@ -15,7 +15,10 @@ var _chunkIK6LVLKCcjs = require('./chunk-IK6LVLKC.cjs');
 var _chunkHREOKQWTcjs = require('./chunk-HREOKQWT.cjs');
 
 
-var _chunkEUV4YR3Vcjs = require('./chunk-EUV4YR3V.cjs');
+var _chunk2ZYGC6SScjs = require('./chunk-2ZYGC6SS.cjs');
+
+
+var _chunkSGBJ247Qcjs = require('./chunk-SGBJ247Q.cjs');
 
 
 var _chunkKIIMAWOJcjs = require('./chunk-KIIMAWOJ.cjs');
@@ -24,6 +27,12 @@ var _chunkKIIMAWOJcjs = require('./chunk-KIIMAWOJ.cjs');
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
 
 // src/docs/handler.ts
+
+
+
+
+
+
 var _fs = require('fs');
 var _path = require('path'); var _path2 = _interopRequireDefault(_path);
 var _marked = require('marked');
@@ -718,15 +727,46 @@ function getRequestSlug(docs, request) {
   return normalizeSlug(pathname.slice(entry.length));
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getRequestSlug, "getRequestSlug");
+function isDiscoverableDocsEntryName(name) {
+  return Boolean(name) && !name.startsWith(".") && name !== "node_modules";
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, isDiscoverableDocsEntryName, "isDiscoverableDocsEntryName");
+function isDiscoverableDocsFile(contentDir, filePath) {
+  const segments = _path2.default.relative(contentDir, filePath).split(_path2.default.sep);
+  let dir = contentDir;
+  for (const [index, name] of segments.entries()) {
+    if (!isDiscoverableDocsEntryName(name)) return false;
+    let entry;
+    try {
+      entry = _fs.readdirSync.call(void 0, dir, { withFileTypes: true }).find(
+        (candidate) => candidate.name === name
+      );
+    } catch (e7) {
+      return false;
+    }
+    const isLast = index === segments.length - 1;
+    if (!entry || !(isLast ? entry.isFile() : entry.isDirectory())) return false;
+    dir = _path2.default.join(dir, name);
+  }
+  return true;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, isDiscoverableDocsFile, "isDiscoverableDocsFile");
 function findDocsPageFile(contentDir, slug) {
-  const segments = slug ? slug.split("/").filter(Boolean) : [];
-  if (!segments.every(isSafeSegment)) return null;
+  const canonicalSlug = trimSlashes(slug);
+  const segments = canonicalSlug ? canonicalSlug.split("/") : [];
+  if (!segments.every((segment) => isSafeSegment(segment) && isDiscoverableDocsEntryName(segment))) {
+    return null;
+  }
   const slugDir = _path2.default.join(contentDir, ...segments);
   const candidates = segments.length === 0 ? DOCS_FILE_NAMES.map((filename) => _path2.default.join(contentDir, filename)) : [
     ...DOCS_FILE_NAMES.map((filename) => _path2.default.join(slugDir, filename)),
-    ...DOCS_FILE_EXTENSIONS2.map((extension) => _path2.default.join(contentDir, `${slug}${extension}`))
+    ...DOCS_FILE_EXTENSIONS2.map(
+      (extension) => _path2.default.join(contentDir, `${canonicalSlug}${extension}`)
+    )
   ];
   for (const candidate of candidates) {
+    if (pathToSlug(contentDir, candidate) !== canonicalSlug) continue;
+    if (!isDiscoverableDocsFile(contentDir, candidate)) continue;
     const safePath = resolveExistingFileInside(contentDir, candidate);
     if (safePath) {
       return safePath;
@@ -784,6 +824,10 @@ function loadFarmDocsPage(contentDir, docs, slug) {
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, loadFarmDocsPage, "loadFarmDocsPage");
+function getFarmDocsMarkdownPath(href) {
+  return href === "/" ? "/.md" : `${href}.md`;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, getFarmDocsMarkdownPath, "getFarmDocsMarkdownPath");
 function createDocsHref(entry, slug) {
   const normalizedEntry = normalizeEntry2(entry);
   const normalizedSlug = trimSlashes(slug);
@@ -861,8 +905,8 @@ function getDocsDescription(docs) {
   return _optionalChain([docs, 'access', _51 => _51.config, 'access', _52 => _52.metadata, 'optionalAccess', _53 => _53.description]);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getDocsDescription, "getDocsDescription");
-function getLoadedDocsPages(contentDir, docs) {
-  return discoverFarmDocsPages(contentDir, docs).map((page) => loadFarmDocsPage(contentDir, docs, page.slug)).filter((page) => Boolean(page));
+function getLoadedDocsPages(contentDir, docs, isPathGuarded) {
+  return discoverFarmDocsPages(contentDir, docs).filter((page) => !_optionalChain([isPathGuarded, 'optionalCall', _54 => _54(page.href)])).map((page) => loadFarmDocsPage(contentDir, docs, page.slug)).filter((page) => Boolean(page));
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getLoadedDocsPages, "getLoadedDocsPages");
 function toDocsLlmsPage(page) {
@@ -942,7 +986,7 @@ function resolveReadingTimeDisplayConfig(docs) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, resolveReadingTimeDisplayConfig, "resolveReadingTimeDisplayConfig");
 function countMarkdownWords(body, includeCode) {
   const readable = (includeCode ? body : body.replace(/```[\s\S]*?```/g, " ").replace(/`[^`]*`/g, " ")).replace(/!\[[^\]]*]\([^)]*\)/g, " ").replace(/\[([^\]]+)]\([^)]*\)/g, "$1").replace(/<[^>]+>/g, " ").replace(/[#>*_~`|:-]/g, " ");
-  return _nullishCoalesce(_optionalChain([readable, 'access', _54 => _54.match, 'call', _55 => _55(/[A-Za-z0-9]+(?:[-'][A-Za-z0-9]+)*/g), 'optionalAccess', _56 => _56.length]), () => ( 0));
+  return _nullishCoalesce(_optionalChain([readable, 'access', _55 => _55.match, 'call', _56 => _56(/[A-Za-z0-9]+(?:[-'][A-Za-z0-9]+)*/g), 'optionalAccess', _57 => _57.length]), () => ( 0));
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, countMarkdownWords, "countMarkdownWords");
 function renderReadingTimeMeta(page, docs) {
@@ -1057,10 +1101,10 @@ function getDocsDiscoveryOptions(docs, request) {
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getDocsDiscoveryOptions, "getDocsDiscoveryOptions");
-function createFarmDocsPublicResponse(contentDir, docs, request) {
+function createFarmDocsPublicResponse(contentDir, docs, request, isPathGuarded) {
   const url = new URL(request.url);
   let loadedPages;
-  const getPages = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, () => _nullishCoalesce(loadedPages, () => ( (loadedPages = getLoadedDocsPages(contentDir, docs)))), "getPages");
+  const getPages = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, () => _nullishCoalesce(loadedPages, () => ( (loadedPages = getLoadedDocsPages(contentDir, docs, isPathGuarded)))), "getPages");
   const sitemapManifest = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, () => _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).buildDocsSitemapManifest({
     pages: getPages().map(toDocsSitemapPage),
     entry: docs.entry,
@@ -1181,11 +1225,11 @@ function shouldReturnMarkdown(request) {
   if (url.pathname.endsWith(".md")) return true;
   const accept = request.headers.get("accept");
   const markdown = Math.max(
-    _chunkEUV4YR3Vcjs.farmAcceptQuality.call(void 0, accept, "text/markdown"),
-    _chunkEUV4YR3Vcjs.farmAcceptQuality.call(void 0, accept, "text/plain")
+    _chunkSGBJ247Qcjs.farmAcceptQuality.call(void 0, accept, "text/markdown"),
+    _chunkSGBJ247Qcjs.farmAcceptQuality.call(void 0, accept, "text/plain")
   );
   if (markdown <= 0) return false;
-  return markdown >= _chunkEUV4YR3Vcjs.farmAcceptQuality.call(void 0, accept, "text/html", { wildcards: true });
+  return markdown >= _chunkSGBJ247Qcjs.farmAcceptQuality.call(void 0, accept, "text/html", { wildcards: true });
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, shouldReturnMarkdown, "shouldReturnMarkdown");
 function escapeAttribute(value) {
@@ -1212,7 +1256,7 @@ function stripHtml(value) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, stripHtml, "stripHtml");
 function getCodeFence(line) {
   const match = /^(?: {0,3})(`{3,}|~{3,})/.exec(line);
-  const value = _optionalChain([match, 'optionalAccess', _57 => _57[1]]);
+  const value = _optionalChain([match, 'optionalAccess', _58 => _58[1]]);
   if (!value) return null;
   return { marker: value[0], length: value.length };
 }
@@ -1297,16 +1341,16 @@ function isCodePathLabel(label) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, isCodePathLabel, "isCodePathLabel");
 function parseCodeInfo(info) {
   const source = (info || "").trim();
-  const language = _optionalChain([source, 'access', _58 => _58.match, 'call', _59 => _59(/^\S+/), 'optionalAccess', _60 => _60[0]]) || "text";
-  const explicitLabel = _optionalChain([source, 'access', _61 => _61.match, 'call', _62 => _62(/\b(?:title|filename|file|label|name)=["']([^"']+)["']/), 'optionalAccess', _63 => _63[1], 'optionalAccess', _64 => _64.trim, 'call', _65 => _65()]);
+  const language = _optionalChain([source, 'access', _59 => _59.match, 'call', _60 => _60(/^\S+/), 'optionalAccess', _61 => _61[0]]) || "text";
+  const explicitLabel = _optionalChain([source, 'access', _62 => _62.match, 'call', _63 => _63(/\b(?:title|filename|file|label|name)=["']([^"']+)["']/), 'optionalAccess', _64 => _64[1], 'optionalAccess', _65 => _65.trim, 'call', _66 => _66()]);
   return { language, label: explicitLabel || language, hasExplicitLabel: Boolean(explicitLabel) };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, parseCodeInfo, "parseCodeInfo");
 function getStandaloneCodeLabel(line) {
   const trimmed = line.trim();
   const match = /^(?:\*\*([^*]+)\*\*|__([^_]+)__|`([^`]+)`)$/u.exec(trimmed);
-  const label = _optionalChain([match, 'optionalAccess', _66 => _66[1]]) || _optionalChain([match, 'optionalAccess', _67 => _67[2]]) || _optionalChain([match, 'optionalAccess', _68 => _68[3]]);
-  return _optionalChain([label, 'optionalAccess', _69 => _69.trim, 'call', _70 => _70()]) || null;
+  const label = _optionalChain([match, 'optionalAccess', _67 => _67[1]]) || _optionalChain([match, 'optionalAccess', _68 => _68[2]]) || _optionalChain([match, 'optionalAccess', _69 => _69[3]]);
+  return _optionalChain([label, 'optionalAccess', _70 => _70.trim, 'call', _71 => _71()]) || null;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getStandaloneCodeLabel, "getStandaloneCodeLabel");
 function hasCodeFenceTitle(info) {
@@ -1438,7 +1482,7 @@ function getThemeName(docs) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getThemeName, "getThemeName");
 function getThemeTocDepth(docs) {
-  const toc = _optionalChain([getThemeUI, 'call', _71 => _71(docs), 'access', _72 => _72.layout, 'optionalAccess', _73 => _73.toc]);
+  const toc = _optionalChain([getThemeUI, 'call', _72 => _72(docs), 'access', _73 => _73.layout, 'optionalAccess', _74 => _74.toc]);
   return toc && typeof toc === "object" && typeof toc.depth === "number" ? toc.depth : 3;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getThemeTocDepth, "getThemeTocDepth");
@@ -1593,7 +1637,7 @@ function renderSidebarLabel(docs, icon, label, className) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderSidebarLabel, "renderSidebarLabel");
 function getSidebarPageLabel(item, configured) {
-  if (_optionalChain([configured, 'optionalAccess', _74 => _74.label])) return configured.label;
+  if (_optionalChain([configured, 'optionalAccess', _75 => _75.label])) return configured.label;
   if (item.slug === "") return "Why?";
   if (item.slug === "integrations") return "Overview";
   if (item.slug === "integrations/ui-registry") return "UI Registry";
@@ -1606,7 +1650,7 @@ function getSidebarPageLabel(item, configured) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, getSidebarPageLabel, "getSidebarPageLabel");
 function renderSidebarLink(item, activeHref, docs, configured) {
   const active = item.href === activeHref;
-  return `<a class="fd-sidebar-link${active ? " fd-sidebar-link-active" : ""}" data-active="${active ? "true" : "false"}" href="${escapeAttribute(item.href)}">${renderSidebarLabel(docs, _optionalChain([configured, 'optionalAccess', _75 => _75.icon]), getSidebarPageLabel(item, configured), "sidebar-link-label fd-sidebar-link-label")}</a>`;
+  return `<a class="fd-sidebar-link${active ? " fd-sidebar-link-active" : ""}" data-active="${active ? "true" : "false"}" href="${escapeAttribute(item.href)}">${renderSidebarLabel(docs, _optionalChain([configured, 'optionalAccess', _76 => _76.icon]), getSidebarPageLabel(item, configured), "sidebar-link-label fd-sidebar-link-label")}</a>`;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderSidebarLink, "renderSidebarLink");
 function collectConfiguredSidebarPages(items, maps, seen = /* @__PURE__ */ new Set()) {
@@ -1786,11 +1830,11 @@ function renderDocsSearchTrigger(showIcon = true, className = "") {
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderDocsSearchTrigger, "renderDocsSearchTrigger");
 function renderDocsSearchMount(clientEntry) {
   return `<div id="farm-docs-search-root" data-farm-docs-search-root data-api="/api/docs"></div>
-  <script type="module" src="${escapeAttribute(clientEntry)}"></script>`;
+  ${_chunk2ZYGC6SScjs.stampFarmCspNonce.call(void 0, `<script type="module" src="${escapeAttribute(clientEntry)}"></script>`)}`;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderDocsSearchMount, "renderDocsSearchMount");
 function renderDocsSearchBootstrapScript() {
-  return `<script>${_chunkMWWVKDW3cjs.generateFarmDocsSearchBootstrapRuntime.call(void 0, )}</script>`;
+  return _chunk2ZYGC6SScjs.stampFarmCspNonce.call(void 0, `<script>${_chunkMWWVKDW3cjs.generateFarmDocsSearchBootstrapRuntime.call(void 0, )}</script>`);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderDocsSearchBootstrapScript, "renderDocsSearchBootstrapScript");
 function renderPixelToc(items) {
@@ -1820,9 +1864,9 @@ function renderDocsHashRuntimeScript() {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderDocsHashRuntimeScript, "renderDocsHashRuntimeScript");
 function renderDocsRuntimeScripts(docs) {
-  return `${renderDocsRuntimeScript(docs)}
+  return _chunk2ZYGC6SScjs.stampFarmCspNonce.call(void 0, `${renderDocsRuntimeScript(docs)}
 ${renderDocsHashRuntimeScript()}
-${renderDocsPageActionsRuntimeScript()}`;
+${renderDocsPageActionsRuntimeScript()}`);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderDocsRuntimeScripts, "renderDocsRuntimeScripts");
 function renderFarmDocsFontPreloads(fontAssets) {
@@ -1837,8 +1881,8 @@ function renderFarmDocsFontPreloadHeader(fontAssets) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderFarmDocsFontPreloadHeader, "renderFarmDocsFontPreloadHeader");
 function getFarmLayoutFontPreloads(layoutFonts) {
   const seen = /* @__PURE__ */ new Set();
-  return [_optionalChain([layoutFonts, 'optionalAccess', _76 => _76.body]), _optionalChain([layoutFonts, 'optionalAccess', _77 => _77.code])].flatMap(
-    (font) => (_optionalChain([font, 'optionalAccess', _78 => _78.preloads]) || []).filter(({ href }) => {
+  return [_optionalChain([layoutFonts, 'optionalAccess', _77 => _77.body]), _optionalChain([layoutFonts, 'optionalAccess', _78 => _78.code])].flatMap(
+    (font) => (_optionalChain([font, 'optionalAccess', _79 => _79.preloads]) || []).filter(({ href }) => {
       if (seen.has(href)) return false;
       seen.add(href);
       return true;
@@ -1852,7 +1896,7 @@ function renderFarmLayoutFontPreloadHeader(layoutFonts) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderFarmLayoutFontPreloadHeader, "renderFarmLayoutFontPreloadHeader");
 function renderPixelDocsHtml(page, pages, docs, clientEntry, faviconHref, requestUrl, fontAssets, fontStylesheetHref, globalStylesheetHref) {
   const navTitle = typeof docs.config.nav === "object" && docs.config.nav && "title" in docs.config.nav ? String(docs.config.nav.title || "Docs") : "Docs";
-  const description = page.description || _optionalChain([docs, 'access', _79 => _79.config, 'access', _80 => _80.metadata, 'optionalAccess', _81 => _81.description]) || "";
+  const description = page.description || _optionalChain([docs, 'access', _80 => _80.config, 'access', _81 => _81.metadata, 'optionalAccess', _82 => _82.description]) || "";
   const renderedMarkdown = renderMarkdownDocument(page.body, getThemeTocDepth(docs));
   const tocItems = renderedMarkdown.tocItems;
   const themeName = getThemeName(docs);
@@ -1927,14 +1971,16 @@ function createFarmDocsHandler(docs, options) {
   const fontAssets = _nullishCoalesce(options.fontAssets, () => ( _chunkHREOKQWTcjs.toFarmDocsPublicFontAssets.call(void 0, _chunkHREOKQWTcjs.resolveFarmDocsFontAssets.call(void 0, options.root))));
   const fallbackFontPreloadHeader = renderFarmDocsFontPreloadHeader(fontAssets);
   return /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, async function handleFarmDocsRequest(request) {
-    if (!_optionalChain([docs, 'optionalAccess', _82 => _82.enabled]) || request.method !== "GET" && request.method !== "HEAD") return null;
+    if (!_optionalChain([docs, 'optionalAccess', _83 => _83.enabled]) || request.method !== "GET" && request.method !== "HEAD") return null;
     await _chunkIK6LVLKCcjs.loadFarmDocsEngine.call(void 0, );
     const contentDir = resolveFarmDocsContentDir(docs, options);
     const requestUrl = new URL(request.url);
     const socialImageSlug = getFarmDocsSocialImageSlug(docs, requestUrl);
     if (socialImageSlug !== null) {
       const socialImagePage = loadFarmDocsPage(contentDir, docs, socialImageSlug);
-      if (!socialImagePage || !isFarmDocsSocialImageEnabled(socialImagePage, docs) || getFarmDocsCustomSocialImage(socialImagePage)) {
+      if (!socialImagePage || // The image sits outside the page's URL, where its guard does not reach, and
+      // draws the page's title.
+      _optionalChain([options, 'access', _84 => _84.isPathGuarded, 'optionalCall', _85 => _85(socialImagePage.href)]) || !isFarmDocsSocialImageEnabled(socialImagePage, docs) || getFarmDocsCustomSocialImage(socialImagePage)) {
         return null;
       }
       const descriptor = createFarmDocsSocialImageDescriptor(socialImagePage, docs, requestUrl);
@@ -1953,12 +1999,20 @@ function createFarmDocsHandler(docs, options) {
       if (request.method === "HEAD") return new Response(null, { status: 200, headers });
       return new Response(renderFarmDocsSocialImageSvg(descriptor), { status: 200, headers });
     }
-    const publicResponse = createFarmDocsPublicResponse(contentDir, docs, request);
+    const publicResponse = createFarmDocsPublicResponse(
+      contentDir,
+      docs,
+      request,
+      options.isPathGuarded
+    );
     if (publicResponse) return omitFarmDocsHeadBody(request, publicResponse);
     if (!isFarmDocsRequest(docs, request)) return null;
     const page = loadPage(contentDir, docs, request);
     if (!page) return null;
     const negotiatesAccept = !requestUrl.pathname.endsWith(".md");
+    if (!negotiatesAccept && _optionalChain([options, 'access', _86 => _86.isPathGuarded, 'optionalCall', _87 => _87(page.href)]) && !options.isPathGuarded(getFarmDocsMarkdownPath(page.href))) {
+      return null;
+    }
     if (shouldReturnMarkdown(request)) {
       const origin = new URL(request.url).origin;
       return omitFarmDocsHeadBody(
@@ -1981,8 +2035,8 @@ function createFarmDocsHandler(docs, options) {
       );
     }
     const pathname = new URL(request.url).pathname;
-    const layoutFonts = await _optionalChain([options, 'access', _83 => _83.resolveLayoutFonts, 'optionalCall', _84 => _84(pathname)]);
-    const usesLayoutFonts = Boolean(_optionalChain([layoutFonts, 'optionalAccess', _85 => _85.body]) || _optionalChain([layoutFonts, 'optionalAccess', _86 => _86.code]));
+    const layoutFonts = await _optionalChain([options, 'access', _88 => _88.resolveLayoutFonts, 'optionalCall', _89 => _89(pathname)]);
+    const usesLayoutFonts = Boolean(_optionalChain([layoutFonts, 'optionalAccess', _90 => _90.body]) || _optionalChain([layoutFonts, 'optionalAccess', _91 => _91.code]));
     const activeFontAssets = usesLayoutFonts ? [] : fontAssets;
     const fontPreloadHeader = usesLayoutFonts ? renderFarmLayoutFontPreloadHeader(layoutFonts) : fallbackFontPreloadHeader;
     return omitFarmDocsHeadBody(
@@ -2025,4 +2079,5 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, createFarmDocsHandler, "createFarmDocsHand
 
 
 
-exports.FARM_DOCS_LAST_MODIFIED_MANIFEST = FARM_DOCS_LAST_MODIFIED_MANIFEST; exports.createFarmDocsLastModifiedManifest = createFarmDocsLastModifiedManifest; exports.isFarmDocsRequest = isFarmDocsRequest; exports.resolveFarmDocsContentDir = resolveFarmDocsContentDir; exports.getFarmDocsRouteTypeEntries = getFarmDocsRouteTypeEntries; exports.getFarmDocsDocumentNavigationMatchers = getFarmDocsDocumentNavigationMatchers; exports.loadFarmDocsPage = loadFarmDocsPage; exports.discoverFarmDocsPages = discoverFarmDocsPages; exports.toFarmDocsMarkdownPage = toFarmDocsMarkdownPage; exports.createFarmDocsHandler = createFarmDocsHandler;
+
+exports.FARM_DOCS_LAST_MODIFIED_MANIFEST = FARM_DOCS_LAST_MODIFIED_MANIFEST; exports.createFarmDocsLastModifiedManifest = createFarmDocsLastModifiedManifest; exports.isFarmDocsRequest = isFarmDocsRequest; exports.resolveFarmDocsContentDir = resolveFarmDocsContentDir; exports.getFarmDocsRouteTypeEntries = getFarmDocsRouteTypeEntries; exports.getFarmDocsDocumentNavigationMatchers = getFarmDocsDocumentNavigationMatchers; exports.loadFarmDocsPage = loadFarmDocsPage; exports.getFarmDocsMarkdownPath = getFarmDocsMarkdownPath; exports.discoverFarmDocsPages = discoverFarmDocsPages; exports.toFarmDocsMarkdownPage = toFarmDocsMarkdownPage; exports.createFarmDocsHandler = createFarmDocsHandler;

package/dist/{chunk-FDR64H6B.mjs → chunk-POSPE3IO.mjs}

@@ -1,6 +1,8 @@
 import {
+  _setAppRequestView,
+  _setCspNonceResolver,
   _setCurrentRequestResolver
-} from "./chunk-IZY3V5XW.mjs";
+} from "./chunk-QRKIMN7T.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
@@ -28,7 +30,61 @@ function getRequestReads() {
 }
 __name(getRequestReads, "getRequestReads");
 var requestReads = getRequestReads();
+function countRequestRead(request) {
+  requestReads.set(request, (requestReads.get(request) ?? 0) + 1);
+}
+__name(countRequestRead, "countRequestRead");
+var appRequestViews = /* @__PURE__ */ new WeakMap();
+function getAppRequestView(request) {
+  const existing = appRequestViews.get(request);
+  if (existing) return existing;
+  let view;
+  if (request.method !== "GET" && request.method !== "HEAD") {
+    countRequestRead(request);
+    view = request;
+  } else {
+    view = new Request(request);
+    Object.defineProperties(view, {
+      // The rendered request's own signal, so aborting it reaches the handler unchanged.
+      signal: { configurable: true, get: /* @__PURE__ */ __name(() => request.signal, "get") },
+      headers: {
+        configurable: true,
+        get() {
+          countRequestRead(request);
+          return request.headers;
+        }
+      },
+      clone: {
+        configurable: true,
+        value() {
+          countRequestRead(request);
+          return request.clone();
+        }
+      }
+    });
+  }
+  appRequestViews.set(request, view);
+  return view;
+}
+__name(getAppRequestView, "getAppRequestView");
 _setCurrentRequestResolver(() => requestStore.getStore());
+var CSP_NONCE_STORAGE_KEY = /* @__PURE__ */ Symbol.for("@farm.js/core/csp-nonce-storage");
+function getCspNonceStore() {
+  const runtime = globalThis;
+  const existing = runtime[CSP_NONCE_STORAGE_KEY];
+  if (existing instanceof AsyncLocalStorage) return existing;
+  const storage = new AsyncLocalStorage();
+  runtime[CSP_NONCE_STORAGE_KEY] = storage;
+  return storage;
+}
+__name(getCspNonceStore, "getCspNonceStore");
+var cspNonceStore = getCspNonceStore();
+_setCspNonceResolver(() => cspNonceStore.getStore());
+function _runWithFarmCspNonce(nonce, fn) {
+  return nonce ? cspNonceStore.run(nonce, fn) : fn();
+}
+__name(_runWithFarmCspNonce, "_runWithFarmCspNonce");
+_setAppRequestView(getAppRequestView);
 function resolveFarmRequestURL(req, options = {}) {
   if (options.origin) {
     return new URL(req.url || "/", options.origin);
@@ -116,7 +172,7 @@ function getCurrentRequest() {
       "No current request is available. getCurrentRequest() can only be used during server rendering."
     );
   }
-  requestReads.set(request, (requestReads.get(request) ?? 0) + 1);
+  countRequestRead(request);
   return request;
 }
 __name(getCurrentRequest, "getCurrentRequest");
@@ -130,6 +186,7 @@ function getCurrentRequestOrNull() {
 __name(getCurrentRequestOrNull, "getCurrentRequestOrNull");
 
 export {
+  _runWithFarmCspNonce,
   resolveFarmRequestURL,
   resolveFarmWebRequestOrigin,
   createWebRequestFromFarmRequest,

package/dist/{chunk-UVW64BCB.cjs → chunk-Q3NXS4MU.cjs}

@@ -26,13 +26,15 @@ var _chunkPSV6XKPOcjs = require('./chunk-PSV6XKPO.cjs');
 
 
 
+var _chunkQTXBII4Zcjs = require('./chunk-QTXBII4Z.cjs');
 
 
+var _chunkWEW2JVA4cjs = require('./chunk-WEW2JVA4.cjs');
 
-var _chunkMRMI32SNcjs = require('./chunk-MRMI32SN.cjs');
 
 
-var _chunk4WQ6PGSJcjs = require('./chunk-4WQ6PGSJ.cjs');
+
+var _chunk2ZYGC6SScjs = require('./chunk-2ZYGC6SS.cjs');
 
 
 var _chunkYFPGHF5Fcjs = require('./chunk-YFPGHF5F.cjs');
@@ -51,7 +53,7 @@ var _chunkVEKFLAQMcjs = require('./chunk-VEKFLAQM.cjs');
 var _chunkOHY2ZWUGcjs = require('./chunk-OHY2ZWUG.cjs');
 
 
-var _chunkEUV4YR3Vcjs = require('./chunk-EUV4YR3V.cjs');
+var _chunkSGBJ247Qcjs = require('./chunk-SGBJ247Q.cjs');
 
 
 var _chunkUYIHRDE4cjs = require('./chunk-UYIHRDE4.cjs');
@@ -63,7 +65,7 @@ var _chunkSDOTRX3Vcjs = require('./chunk-SDOTRX3V.cjs');
 var _chunkOI6CMLWXcjs = require('./chunk-OI6CMLWX.cjs');
 
 
-var _chunkCBJJH36Acjs = require('./chunk-CBJJH36A.cjs');
+var _chunkVU6AAZVYcjs = require('./chunk-VU6AAZVY.cjs');
 
 
 var _chunkKIIMAWOJcjs = require('./chunk-KIIMAWOJ.cjs');
@@ -138,13 +140,13 @@ function resolveFarmAgentConfig(input, context = {}) {
   const jsonLd = _optionalChain([input, 'optionalAccess', _ => _.jsonLd]);
   return {
     jsonLd: jsonLd === void 0 ? { ...DEFAULT_JSON_LD } : !jsonLd ? false : jsonLd === true ? {} : jsonLd,
-    noindexPreviews: _chunkMRMI32SNcjs.resolveFarmNoindexPreviews.call(void 0, _optionalChain([input, 'optionalAccess', _2 => _2.noindexPreviews])),
+    noindexPreviews: _chunkQTXBII4Zcjs.resolveFarmNoindexPreviews.call(void 0, _optionalChain([input, 'optionalAccess', _2 => _2.noindexPreviews])),
     // The docs engine answers /llms.txt with its own pages; a default here would replace it.
     // llms-full.txt renders every listed page, so it stays opt-in.
-    llmsTxt: _chunk4WQ6PGSJcjs.resolveFarmLlmsTxtConfig.call(void 0, _nullishCoalesce(_optionalChain([input, 'optionalAccess', _3 => _3.llmsTxt]), () => ( (context.docs ? false : { full: false })))),
+    llmsTxt: _chunkWEW2JVA4cjs.resolveFarmLlmsTxtConfig.call(void 0, _nullishCoalesce(_optionalChain([input, 'optionalAccess', _3 => _3.llmsTxt]), () => ( (context.docs ? false : { full: false })))),
     // Same rule as llms.txt: the docs engine answers /sitemap.xml with its own pages.
-    sitemap: _chunkMRMI32SNcjs.resolveFarmAgentSitemap.call(void 0, _nullishCoalesce(_optionalChain([input, 'optionalAccess', _4 => _4.sitemap]), () => ( !context.docs))),
-    crawlers: _chunkMRMI32SNcjs.resolveFarmAgentCrawlers.call(void 0, _optionalChain([input, 'optionalAccess', _5 => _5.crawlers])),
+    sitemap: _chunkQTXBII4Zcjs.resolveFarmAgentSitemap.call(void 0, _nullishCoalesce(_optionalChain([input, 'optionalAccess', _4 => _4.sitemap]), () => ( !context.docs))),
+    crawlers: _chunkQTXBII4Zcjs.resolveFarmAgentCrawlers.call(void 0, _optionalChain([input, 'optionalAccess', _5 => _5.crawlers])),
     apiCatalog: resolveFarmAgentBoolean(_optionalChain([input, 'optionalAccess', _6 => _6.apiCatalog]), "apiCatalog", false),
     aiCatalog: resolveFarmAgentBoolean(_optionalChain([input, 'optionalAccess', _7 => _7.aiCatalog]), "aiCatalog", true),
     manifest: resolveFarmAgentBoolean(_optionalChain([input, 'optionalAccess', _8 => _8.manifest]), "manifest", true),
@@ -697,9 +699,9 @@ async function resolveConfig(userConfig, mode) {
   const routeRules = _chunkQ5B3KJBPcjs.normalizeRouteRules.call(void 0, userConfig.routeRules);
   const routeRuleRedirects = _chunkQ5B3KJBPcjs.routeRulesToRedirects.call(void 0, routeRules);
   const routeRuleHeaders = _chunkQ5B3KJBPcjs.routeRulesToHeaders.call(void 0, routeRules);
-  const security = _chunkMRMI32SNcjs.resolveFarmSecurityConfig.call(void 0, userConfig.security);
-  const securityHeader = _chunkMRMI32SNcjs.getFarmSecurityHeader.call(void 0, security);
-  if (_chunkMRMI32SNcjs.farmCspBlocksFrameworkInlineScripts.call(void 0, security)) {
+  const security = _chunk2ZYGC6SScjs.resolveFarmSecurityConfig.call(void 0, userConfig.security);
+  const securityHeader = _chunk2ZYGC6SScjs.getFarmSecurityHeader.call(void 0, security);
+  if (_chunk2ZYGC6SScjs.farmCspBlocksFrameworkInlineScripts.call(void 0, security)) {
     _chunk5QIKR7RRcjs.logger.warn(
       "security.csp blocks the inline scripts Farm injects for theming and hydration. Set security.csp.nonce to true for managed dynamic nonces and prerendered hashes, or make the governing script directive allow 'unsafe-inline' without a nonce, hash, or 'strict-dynamic' source."
     );
@@ -709,7 +711,7 @@ async function resolveConfig(userConfig, mode) {
   const srcDir = userConfig.srcDir || "src";
   _chunk6MVFL3R5cjs.setFarmProjectSourceDir.call(void 0, root, srcDir);
   const docs = await resolveDocsConfig(userConfig.docs, { root, srcDir });
-  const md = _chunkEUV4YR3Vcjs.resolveMarkdownConfig.call(void 0, userConfig.md);
+  const md = _chunkSGBJ247Qcjs.resolveMarkdownConfig.call(void 0, userConfig.md);
   const mdx = _chunkOHY2ZWUGcjs.resolveMdxConfig.call(void 0, userConfig.mdx);
   const env = _chunkVEKFLAQMcjs.resolveEnv.call(void 0, userConfig.env, process.env);
   _chunkVEKFLAQMcjs.setEnv.call(void 0, env);
@@ -785,7 +787,7 @@ async function resolveConfig(userConfig, mode) {
     },
     agent: resolveFarmAgentConfig(userConfig.agent, { docs: docs.enabled }),
     plugins: [
-      ..._chunkCBJJH36Acjs.resolveIntegrationPlugins.call(void 0, integrations),
+      ..._chunkVU6AAZVYcjs.resolveIntegrationPlugins.call(void 0, integrations),
       ...nativeMCPPlugin ? [nativeMCPPlugin] : [],
       ...userConfig.plugins || []
     ],
@@ -800,7 +802,7 @@ async function resolveConfig(userConfig, mode) {
     ], "headers"),
     routeRules,
     images: _chunkYFPGHF5Fcjs.resolveFarmImageConfig.call(void 0, userConfig.images),
-    performance: _chunkMRMI32SNcjs.resolveFarmPerformanceConfig.call(void 0, userConfig.performance),
+    performance: _chunkQTXBII4Zcjs.resolveFarmPerformanceConfig.call(void 0, userConfig.performance),
     theme: _chunkOI6CMLWXcjs.resolveFarmThemeConfig.call(void 0, userConfig.theme, basePath),
     publicDir: userConfig.publicDir || "public",
     i18n: _chunkHLJ6MBUZcjs.resolveFarmI18nConfig.call(void 0, userConfig.i18n, { root, mode, basePath }),

package/dist/{chunk-4WCZJQUO.mjs → chunk-QFW2IH5E.mjs}

@@ -1,7 +1,9 @@
 import {
+  FARM_MARKDOWN_PAGE_CHECK_HEADER,
+  _getFarmMarkdownPageCheckToken,
   createFarmMarkdownViewResponse,
   requestAcceptsMarkdown
-} from "./chunk-WWIKMBRN.mjs";
+} from "./chunk-VNGH5MLF.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
@@ -119,7 +121,6 @@ var ANONYMOUS_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "cache-control",
   "connection",
   "dnt",
-  "forwarded",
   "host",
   "if-match",
   "if-modified-since",
@@ -141,12 +142,9 @@ var ANONYMOUS_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "tracestate",
   "upgrade-insecure-requests",
   "user-agent",
-  "via",
-  "x-forwarded-for",
   "x-forwarded-host",
   "x-forwarded-port",
   "x-forwarded-proto",
-  "x-real-ip",
   "x-request-id"
 ]);
 function isAnonymousRequestHeader(name) {
@@ -154,6 +152,41 @@ function isAnonymousRequestHeader(name) {
   return ANONYMOUS_REQUEST_HEADERS.has(lower) || lower.startsWith("sec-fetch-") || lower.startsWith("sec-ch-");
 }
 __name(isAnonymousRequestHeader, "isAnonymousRequestHeader");
+var PAGE_CHECK_DROPPED_HEADERS = /* @__PURE__ */ new Set([
+  "accept-encoding",
+  "if-match",
+  "if-modified-since",
+  "if-none-match",
+  "if-range",
+  "if-unmodified-since",
+  "range"
+]);
+var PAGE_SEGMENT_MARKER = /<div\s[^>]*\bid=["']?__farm_page__["'\s>]/i;
+async function anonymousVisitorOpensPage(options, url, targetPathname) {
+  const pageUrl = new URL(url);
+  pageUrl.pathname = targetPathname;
+  const headers = new Headers();
+  for (const [name, value] of options.request.headers) {
+    if (!PAGE_CHECK_DROPPED_HEADERS.has(name.toLowerCase())) headers.append(name, value);
+  }
+  headers.set("accept", "text/html");
+  headers.set(FARM_MARKDOWN_PAGE_CHECK_HEADER, _getFarmMarkdownPageCheckToken());
+  const response = await options.renderPage(
+    new Request(pageUrl, {
+      method: "GET",
+      headers,
+      redirect: "manual",
+      signal: options.request.signal
+    })
+  );
+  if (response.status < 200 || response.status >= 300 || !response.headers.get("content-type")?.toLowerCase().includes("text/html")) {
+    void response.body?.cancel().catch(() => {
+    });
+    return false;
+  }
+  return PAGE_SEGMENT_MARKER.test(await response.text());
+}
+__name(anonymousVisitorOpensPage, "anonymousVisitorOpensPage");
 function hasOnlyAnonymousHeaders(headers) {
   for (const name of headers.keys()) {
     if (!isAnonymousRequestHeader(name)) return false;
@@ -161,6 +194,7 @@ function hasOnlyAnonymousHeaders(headers) {
   return true;
 }
 __name(hasOnlyAnonymousHeaders, "hasOnlyAnonymousHeaders");
+var FARM_MARKDOWN_ANONYMOUS_CLIENT_ADDRESS = "192.0.2.1";
 async function createFarmMarkdownSourceResponse(options) {
   if (options.request.method !== "GET" && options.request.method !== "HEAD") {
     return null;
@@ -178,7 +212,7 @@ async function createFarmMarkdownSourceResponse(options) {
   if (!source) {
     return null;
   }
-  const anonymous = hasOnlyAnonymousHeaders(options.request.headers);
+  const anonymous = hasOnlyAnonymousHeaders(options.request.headers) && (!options.clientAddress || options.clientAddress === FARM_MARKDOWN_ANONYMOUS_CLIENT_ADDRESS);
   if (options.renderPage && (hasMarkdownExtension || !anonymous)) {
     const publicUrl = new URL(url);
     publicUrl.pathname = targetPathname;
@@ -194,9 +228,19 @@ async function createFarmMarkdownSourceResponse(options) {
         signal: options.request.signal
       })
     );
-    if (publicResponse.headers.get("X-Farm-Markdown-Route") === targetPathname) {
-      publicSourceResponses.add(publicResponse);
-      return publicResponse;
+    if (publicResponse.headers.get("X-Farm-Markdown-Route") === targetPathname && publicResponse.headers.has("X-Farm-Markdown-Source")) {
+      let response = publicResponse;
+      if (options.request.headers.has("cookie") || options.request.headers.has("authorization")) {
+        const headers2 = new Headers(publicResponse.headers);
+        headers2.set("Cache-Control", "private, no-store");
+        response = new Response(publicResponse.body, {
+          status: publicResponse.status,
+          statusText: publicResponse.statusText,
+          headers: headers2
+        });
+      }
+      publicSourceResponses.add(response);
+      return response;
     }
     await publicResponse.body?.cancel();
     if (!hasMarkdownExtension) return null;
@@ -209,6 +253,9 @@ async function createFarmMarkdownSourceResponse(options) {
       }
     });
   }
+  if (options.renderPage && !await anonymousVisitorOpensPage(options, url, targetPathname)) {
+    return null;
+  }
   const headers = new Headers({
     "Content-Type": "text/markdown; charset=utf-8",
     "Content-Location": targetPathname === "/" ? "/index.md" : `${targetPathname}.md`,
@@ -238,5 +285,6 @@ export {
   createMarkdownMetadata,
   createFarmMarkdownRouteModule,
   isFarmMarkdownPublicSourceResponse,
+  FARM_MARKDOWN_ANONYMOUS_CLIENT_ADDRESS,
   createFarmMarkdownSourceResponse
 };

package/dist/{chunk-5SJWVY6R.mjs → chunk-QHSH7IH4.mjs}

@@ -10,6 +10,14 @@ function isFarmBlockedNavigationURL(url) {
   return true;
 }
 __name(isFarmBlockedNavigationURL, "isFarmBlockedNavigationURL");
+function isFarmScriptURL(href) {
+  try {
+    return new URL(href, "http://farm.invalid").protocol === "javascript:";
+  } catch {
+    return false;
+  }
+}
+__name(isFarmScriptURL, "isFarmScriptURL");
 function isFarmExternalNavigationURL(url, currentOrigin) {
   return url.protocol !== "http:" && url.protocol !== "https:" || url.origin !== currentOrigin;
 }
@@ -21,6 +29,7 @@ __name(resolveFarmNavigationURL, "resolveFarmNavigationURL");
 
 export {
   isFarmBlockedNavigationURL,
+  isFarmScriptURL,
   isFarmExternalNavigationURL,
   resolveFarmNavigationURL
 };