@farm.js/core 0.1.36 → 0.1.38

package/dist/chunk-4E5QXOCL.cjs

@@ -0,0 +1,109 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+
+
+
+var _chunkPCOTGFSMcjs = require('./chunk-PCOTGFSM.cjs');
+
+
+
+var _chunk2DD4JMQCcjs = require('./chunk-2DD4JMQC.cjs');
+
+
+var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
+
+// src/nitro/native-mcp-source.ts
+function generateNativeMCPPluginSource(mcp) {
+  if (_optionalChain([mcp, 'optionalAccess', _ => _.enabled]) !== true) {
+    return { importSource: "", registerSource: "", pluginSource: "" };
+  }
+  return {
+    importSource: `import { createFarmMCPPlugin as __farmCreateMCPPlugin } from "@farm.js/mcp/internal";`,
+    registerSource: `function __farmMCPIsPlainObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+function __farmMergeMCPConfig(base, override) {
+  const output = { ...base };
+  for (const [key, value] of Object.entries(override)) {
+    if (value === undefined) continue;
+    output[key] =
+      __farmMCPIsPlainObject(output[key]) && __farmMCPIsPlainObject(value)
+        ? __farmMergeMCPConfig(output[key], value)
+        : value;
+  }
+  return output;
+}
+
+const farmNativeMCPConfig = farmRuntimeConfigs.reduce((merged, runtimeConfig) => {
+  const value = runtimeConfig?.mcp;
+  if (value === undefined) return merged;
+  if (value === false) return false;
+  return __farmMergeMCPConfig(merged && merged !== false ? merged : {}, value);
+}, undefined);
+const farmNativeMCPPlugin =
+  farmNativeMCPConfig && farmNativeMCPConfig.enabled !== false
+    ? __farmCreateMCPPlugin(farmNativeMCPConfig)
+    : null;`,
+    pluginSource: `...(farmNativeMCPPlugin ? [farmNativeMCPPlugin] : []),`
+  };
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, generateNativeMCPPluginSource, "generateNativeMCPPluginSource");
+
+// src/routing/layout-selector.ts
+function createFarmLayoutSelector(layouts, resolveRouteDirectory) {
+  const prepared = layouts.map((layout) => {
+    const segments = layout.pattern === "/" ? [] : _chunkPCOTGFSMcjs.parseRoutePattern.call(void 0, layout.pattern);
+    return {
+      layout,
+      segments: segments.length === 0 ? null : segments,
+      groupScope: _chunk2DD4JMQCcjs.getRouteGroupScope.call(void 0, layout.pattern)
+    };
+  });
+  return (pathname, routeDirectory) => {
+    const applicable = [];
+    let parts;
+    let directory = routeDirectory;
+    for (const { layout, segments, groupScope } of prepared) {
+      if (segments !== null) {
+        _nullishCoalesce(parts, () => ( (parts = _chunkPCOTGFSMcjs.splitNormalizedPathname.call(void 0, _chunkPCOTGFSMcjs.normalizePathname.call(void 0, pathname.replace(/\/$/, "") || "/")))));
+        if (_chunkPCOTGFSMcjs.matchSegmentParts.call(void 0, segments, parts, true) === null) continue;
+      }
+      if (groupScope !== null) {
+        if (directory === void 0) directory = _nullishCoalesce(_optionalChain([resolveRouteDirectory, 'optionalCall', _2 => _2(pathname)]), () => ( null));
+        if (!_chunk2DD4JMQCcjs.isInRouteGroupScope.call(void 0, directory, groupScope)) continue;
+      }
+      applicable.push(layout);
+    }
+    return applicable;
+  };
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, createFarmLayoutSelector, "createFarmLayoutSelector");
+function layoutsCanCoverSamePage(a, b) {
+  const scopeA = _chunk2DD4JMQCcjs.getRouteGroupScope.call(void 0, a);
+  const scopeB = _chunk2DD4JMQCcjs.getRouteGroupScope.call(void 0, b);
+  if (scopeA !== null && scopeB !== null && !_chunk2DD4JMQCcjs.isInRouteGroupScope.call(void 0, scopeA, scopeB) && !_chunk2DD4JMQCcjs.isInRouteGroupScope.call(void 0, scopeB, scopeA)) {
+    return false;
+  }
+  const segmentsA = a === "/" ? [] : _chunkPCOTGFSMcjs.parseRoutePattern.call(void 0, a);
+  const segmentsB = b === "/" ? [] : _chunkPCOTGFSMcjs.parseRoutePattern.call(void 0, b);
+  const length = Math.min(segmentsA.length, segmentsB.length);
+  for (let index = 0; index < length; index++) {
+    const segmentA = segmentsA[index];
+    const segmentB = segmentsB[index];
+    if (segmentA.type === "dynamic" && segmentA.catchAll) return true;
+    if (segmentB.type === "dynamic" && segmentB.catchAll) return true;
+    if (segmentA.type === "dynamic" || segmentB.type === "dynamic") continue;
+    if (segmentA.value !== segmentB.value) return false;
+  }
+  return true;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, layoutsCanCoverSamePage, "layoutsCanCoverSamePage");
+
+
+
+
+
+exports.generateNativeMCPPluginSource = generateNativeMCPPluginSource; exports.createFarmLayoutSelector = createFarmLayoutSelector; exports.layoutsCanCoverSamePage = layoutsCanCoverSamePage;

package/dist/{chunk-Z2HLU4IX.cjs → chunk-4GWRFP22.cjs}

@@ -183,6 +183,25 @@ function matchPattern(pattern, pathname) {
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, matchPattern, "matchPattern");
+function withRoutePathname(ctx, routePathname) {
+  return new Proxy(ctx, {
+    get(target, key) {
+      return key === "pathname" || key === "routePathname" ? routePathname : Reflect.get(target, key, target);
+    }
+  });
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, withRoutePathname, "withRoutePathname");
+function matchesMiddlewarePredicate(predicate, ctx, getRoutePathname = () => ctx.routePathname) {
+  if (predicate(ctx)) return true;
+  const routePathname = getRoutePathname();
+  if (routePathname === void 0 || routePathname === ctx.pathname) return false;
+  return Boolean(predicate(withRoutePathname(ctx, routePathname)));
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, matchesMiddlewarePredicate, "matchesMiddlewarePredicate");
+function toMiddlewareRoutePathname(pathname, toRoutePathname = (value) => value) {
+  return _chunkUS2QVW3Ecjs.canonicalizeRequestPathname.call(void 0, toRoutePathname(pathname));
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, toMiddlewareRoutePathname, "toMiddlewareRoutePathname");
 function matchesCompiledMiddlewareConfig(pathname, config, ctx) {
   let canonicalPathname;
   const getCanonicalPathname = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, () => _nullishCoalesce(canonicalPathname, () => ( (canonicalPathname = _chunkUS2QVW3Ecjs.canonicalizeRequestPathname.call(void 0, pathname)))), "getCanonicalPathname");
@@ -196,7 +215,7 @@ function matchesCompiledMiddlewareConfig(pathname, config, ctx) {
   if (config.matcher) {
     for (const matcher of config.matcher) {
       if (typeof matcher === "function") {
-        if (matcher(ctx)) {
+        if (matchesMiddlewarePredicate(matcher, ctx, getCanonicalPathname)) {
           return { matched: true };
         }
         continue;
@@ -235,4 +254,6 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, matchesMiddlewareConfigAt, "matchesMiddlew
 
 
 
-exports.compileMiddlewareRoute = compileMiddlewareRoute; exports.matchesMiddlewareRoute = matchesMiddlewareRoute; exports.matchesMiddlewareRouteAt = matchesMiddlewareRouteAt; exports.compileMiddlewareConfig = compileMiddlewareConfig; exports.matchesCompiledMiddlewareConfig = matchesCompiledMiddlewareConfig; exports.matchesMiddlewareConfig = matchesMiddlewareConfig; exports.matchesMiddlewareConfigAt = matchesMiddlewareConfigAt;
+
+
+exports.compileMiddlewareRoute = compileMiddlewareRoute; exports.matchesMiddlewareRoute = matchesMiddlewareRoute; exports.matchesMiddlewareRouteAt = matchesMiddlewareRouteAt; exports.compileMiddlewareConfig = compileMiddlewareConfig; exports.matchesMiddlewarePredicate = matchesMiddlewarePredicate; exports.toMiddlewareRoutePathname = toMiddlewareRoutePathname; exports.matchesCompiledMiddlewareConfig = matchesCompiledMiddlewareConfig; exports.matchesMiddlewareConfig = matchesMiddlewareConfig; exports.matchesMiddlewareConfigAt = matchesMiddlewareConfigAt;

package/dist/{chunk-VQLJWDVW.cjs → chunk-4IE345DM.cjs}

@@ -3,18 +3,19 @@
 
 
 
-var _chunkTE2G5IONcjs = require('./chunk-TE2G5ION.cjs');
+
+var _chunkPGZDEPTMcjs = require('./chunk-PGZDEPTM.cjs');
 
 
 
 var _chunkIK6LVLKCcjs = require('./chunk-IK6LVLKC.cjs');
 
 
-var _chunkUVW64BCBcjs = require('./chunk-UVW64BCB.cjs');
+var _chunkQ3NXS4MUcjs = require('./chunk-Q3NXS4MU.cjs');
 
 
 
-var _chunkHITLGIAOcjs = require('./chunk-HITLGIAO.cjs');
+var _chunkCY2ZQ5C6cjs = require('./chunk-CY2ZQ5C6.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -27,8 +28,17 @@ function hasFarmDocsRuntimeAdapter(docs) {
   return Boolean(_optionalChain([docs, 'optionalAccess', _ => _.enabled]) && _optionalChain([docs, 'access', _2 => _2.adapter, 'optionalAccess', _3 => _3.server]) && docs.adapter.react);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, hasFarmDocsRuntimeAdapter, "hasFarmDocsRuntimeAdapter");
+function assertFarmDocsAdapterServesNoGuardedPages(docs, options, isPathGuarded) {
+  if (!isPathGuarded || !hasFarmDocsRuntimeAdapter(docs)) return;
+  const guarded = _chunkPGZDEPTMcjs.discoverFarmDocsPages.call(void 0, _chunkPGZDEPTMcjs.resolveFarmDocsContentDir.call(void 0, docs, options), docs).filter((page) => isPathGuarded(page.href) || isPathGuarded(_chunkPGZDEPTMcjs.getFarmDocsMarkdownPath.call(void 0, page.href))).map((page) => page.href);
+  if (guarded.length === 0) return;
+  throw new Error(
+    `Docs pages behind a path guard (${guarded.join(", ")}) would be public: the docs adapter ${JSON.stringify(docs.adapter.id)} serves their content in llms-full.txt, search, Markdown, and MCP without running the app's guards. Move those pages out of the docs content directory, or set docs.adapter = false to use Farm's built-in docs runtime, which keeps guarded pages off anonymous surfaces.`
+  );
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, assertFarmDocsAdapterServesNoGuardedPages, "assertFarmDocsAdapterServesNoGuardedPages");
 async function loadFarmDocsConfigModule(docs, loadModule) {
-  const configModule = _chunkHITLGIAOcjs.getFarmDocsAdapterConfigModule.call(void 0, docs);
+  const configModule = _chunkCY2ZQ5C6cjs.getFarmDocsAdapterConfigModule.call(void 0, docs);
   if (!configModule) return void 0;
   const loaded = await loadModule(configModule);
   const config = _nullishCoalesce(_optionalChain([loaded, 'optionalAccess', _4 => _4.default]), () => ( loaded));
@@ -40,7 +50,7 @@ function createFarmDocsAdapterRuntimeConfig(docs, options, moduleConfig) {
     ...moduleConfig ? { ...moduleConfig, ...docs.configOverrides } : _nullishCoalesce(docs.runtimeConfig, () => ( docs.config)),
     entry: docs.config.entry || docs.entry.replace(/^\/+|\/+$/g, "") || "docs",
     docsPath: docs.entry,
-    contentDir: _chunkTE2G5IONcjs.resolveFarmDocsContentDir.call(void 0, docs, options)
+    contentDir: _chunkPGZDEPTMcjs.resolveFarmDocsContentDir.call(void 0, docs, options)
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, createFarmDocsAdapterRuntimeConfig, "createFarmDocsAdapterRuntimeConfig");
@@ -99,6 +109,7 @@ async function createFarmDocsAdapterHandler(docs, options) {
   if (!hasFarmDocsRuntimeAdapter(docs)) {
     throw new Error("Farm docs adapter requires server and react runtime entrypoints.");
   }
+  assertFarmDocsAdapterServesNoGuardedPages(docs, options, options.isPathGuarded);
   const serverModule = await options.loadModule(
     docs.adapter.server
   );
@@ -277,25 +288,25 @@ function getDocsDescription(docs) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getDocsDescription, "getDocsDescription");
 function getLoadedDocsPages(context) {
-  return _chunkTE2G5IONcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs).map((page) => _chunkTE2G5IONcjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, page.slug)).filter((page) => Boolean(page));
+  return _chunkPGZDEPTMcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs).filter((page) => !context.isPathGuarded(page.href)).map((page) => _chunkPGZDEPTMcjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, page.slug)).filter((page) => Boolean(page));
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getLoadedDocsPages, "getLoadedDocsPages");
 function toDocsSourcePage(page) {
   return {
-    ..._chunkTE2G5IONcjs.toFarmDocsMarkdownPage.call(void 0, page),
+    ..._chunkPGZDEPTMcjs.toFarmDocsMarkdownPage.call(void 0, page),
     sourcePath: page.sourcePath
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, toDocsSourcePage, "toDocsSourcePage");
 function toDocsSitemapPage(page) {
   return {
-    ..._chunkTE2G5IONcjs.toFarmDocsMarkdownPage.call(void 0, page),
+    ..._chunkPGZDEPTMcjs.toFarmDocsMarkdownPage.call(void 0, page),
     sourcePath: page.sourcePath
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, toDocsSitemapPage, "toDocsSitemapPage");
 function toDocsLlmsPage(page) {
-  return _chunkTE2G5IONcjs.toFarmDocsMarkdownPage.call(void 0, page);
+  return _chunkPGZDEPTMcjs.toFarmDocsMarkdownPage.call(void 0, page);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, toDocsLlmsPage, "toDocsLlmsPage");
 function getDocsLlmsOptions(context, request) {
@@ -389,7 +400,9 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, renderAgentsDocument, "renderAgentsDocumen
 function buildAgentSpec(context, request) {
   const url = new URL(request.url);
   const origin = url.origin;
-  const pages = _chunkTE2G5IONcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs);
+  const pages = _chunkPGZDEPTMcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs).filter(
+    (page) => !context.isPathGuarded(page.href)
+  );
   const spec = _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).buildDocsAgentDiscoverySpec(getDocsDiscoveryOptions(context, request));
   const title = getDocsTitle(context.docs);
   return {
@@ -449,7 +462,7 @@ function redactDocsConfigValue(value, key, inHeaders) {
     );
   }
   if (value === null || value === void 0 || typeof value === "function") return value;
-  return inHeaders || _chunkHITLGIAOcjs.isSecretDocsConfigKey.call(void 0, key) ? REDACTED_DOCS_CONFIG_VALUE : value;
+  return inHeaders || _chunkCY2ZQ5C6cjs.isSecretDocsConfigKey.call(void 0, key) ? REDACTED_DOCS_CONFIG_VALUE : value;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, redactDocsConfigValue, "redactDocsConfigValue");
 function toPublicDocsPath(value, root) {
@@ -479,7 +492,7 @@ function buildPublicConfig(context) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, buildPublicConfig, "buildPublicConfig");
 function buildDiagnostics(context) {
-  const pages = _chunkTE2G5IONcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs);
+  const pages = _chunkPGZDEPTMcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs);
   const diagnostics = _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).buildDocsDiagnostics(context.docs.config, {
     entry: context.docs.entry,
     mcp: {
@@ -551,13 +564,15 @@ async function resolveAPIContext(options) {
     config: options.config,
     configPath: options.configPath
   }));
-  const docs = isResolvedDocsConfig(docsInput) ? docsInput : await _chunkUVW64BCBcjs.resolveDocsConfig.call(void 0, docsInput, { root, srcDir });
+  const docs = isResolvedDocsConfig(docsInput) ? docsInput : await _chunkQ3NXS4MUcjs.resolveDocsConfig.call(void 0, docsInput, { root, srcDir });
+  const guardedPaths = new Set(_nullishCoalesce(_optionalChain([runtimeConfig, 'optionalAccess', _20 => _20.guardedPaths]), () => ( [])));
   return {
     root,
     srcDir,
     docs,
-    contentDir: _chunkTE2G5IONcjs.resolveFarmDocsContentDir.call(void 0, docs, { root, srcDir }),
-    diagnostics: options.diagnostics === true
+    contentDir: _chunkPGZDEPTMcjs.resolveFarmDocsContentDir.call(void 0, docs, { root, srcDir }),
+    diagnostics: options.diagnostics === true,
+    isPathGuarded: _nullishCoalesce(options.isPathGuarded, () => ( ((pathname) => guardedPaths.has(pathname))))
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, resolveAPIContext, "resolveAPIContext");
@@ -615,10 +630,12 @@ async function handleDocsAPIGet(request, context) {
   if (format === "markdown" || url.pathname.endsWith(".md")) {
     const pathParam = url.searchParams.get("path") || url.searchParams.get("slug");
     const slug = normalizeDocsApiSlug(_nullishCoalesce(_nullishCoalesce(pathParam, () => ( pathTarget.slug)), () => ( "")), context.docs);
-    const page = _chunkTE2G5IONcjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, slug);
-    if (!page) return text("Docs page not found\n", "text/plain; charset=utf-8", { status: 404 });
+    const page = _chunkPGZDEPTMcjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, slug);
+    if (!page || context.isPathGuarded(page.href)) {
+      return text("Docs page not found\n", "text/plain; charset=utf-8", { status: 404 });
+    }
     return text(
-      _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).renderDocsMarkdownDocument(_chunkTE2G5IONcjs.toFarmDocsMarkdownPage.call(void 0, page), {
+      _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).renderDocsMarkdownDocument(_chunkPGZDEPTMcjs.toFarmDocsMarkdownPage.call(void 0, page), {
         origin: new URL(request.url).origin,
         llms: getDocsLlmsOptions(context, request),
         sitemap: context.docs.config.sitemap
@@ -693,4 +710,5 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, createFarmDocsAPIHandler, "createFarmDocsA
 
 
 
-exports.hasFarmDocsRuntimeAdapter = hasFarmDocsRuntimeAdapter; exports.compileFarmDocsAdapterEdgeManifest = compileFarmDocsAdapterEdgeManifest; exports.createFarmDocsAdapterHandler = createFarmDocsAdapterHandler; exports.isFarmDocsAPIRequest = isFarmDocsAPIRequest; exports.createDocsAPI = createDocsAPI; exports.createFarmDocsAPIHandler = createFarmDocsAPIHandler;
+
+exports.hasFarmDocsRuntimeAdapter = hasFarmDocsRuntimeAdapter; exports.assertFarmDocsAdapterServesNoGuardedPages = assertFarmDocsAdapterServesNoGuardedPages; exports.compileFarmDocsAdapterEdgeManifest = compileFarmDocsAdapterEdgeManifest; exports.createFarmDocsAdapterHandler = createFarmDocsAdapterHandler; exports.isFarmDocsAPIRequest = isFarmDocsAPIRequest; exports.createDocsAPI = createDocsAPI; exports.createFarmDocsAPIHandler = createFarmDocsAPIHandler;

package/dist/{chunk-O6WAEAX3.mjs → chunk-5BWWFHR2.mjs}

@@ -13,9 +13,12 @@ import {
   resolveFarmDocsFontAssets,
   toFarmDocsPublicFontAssets
 } from "./chunk-TVGP4BBZ.mjs";
+import {
+  stampFarmCspNonce
+} from "./chunk-U6QLDL3G.mjs";
 import {
   farmAcceptQuality
-} from "./chunk-WWIKMBRN.mjs";
+} from "./chunk-VNGH5MLF.mjs";
 import {
   matchesFarmIfNoneMatch
 } from "./chunk-ZMMBIVQM.mjs";
@@ -24,7 +27,13 @@ import {
 } from "./chunk-LPEX4YW6.mjs";
 
 // src/docs/handler.ts
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync as realpathSync2, statSync as statSync2 } from "fs";
+import {
+  existsSync as existsSync2,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync2,
+  realpathSync as realpathSync2,
+  statSync as statSync2
+} from "fs";
 import path2 from "path";
 import { marked, Renderer } from "marked";
 import { highlight } from "sugar-high";
@@ -718,15 +727,46 @@ function getRequestSlug(docs, request) {
   return normalizeSlug(pathname.slice(entry.length));
 }
 __name(getRequestSlug, "getRequestSlug");
+function isDiscoverableDocsEntryName(name) {
+  return Boolean(name) && !name.startsWith(".") && name !== "node_modules";
+}
+__name(isDiscoverableDocsEntryName, "isDiscoverableDocsEntryName");
+function isDiscoverableDocsFile(contentDir, filePath) {
+  const segments = path2.relative(contentDir, filePath).split(path2.sep);
+  let dir = contentDir;
+  for (const [index, name] of segments.entries()) {
+    if (!isDiscoverableDocsEntryName(name)) return false;
+    let entry;
+    try {
+      entry = readdirSync2(dir, { withFileTypes: true }).find(
+        (candidate) => candidate.name === name
+      );
+    } catch {
+      return false;
+    }
+    const isLast = index === segments.length - 1;
+    if (!entry || !(isLast ? entry.isFile() : entry.isDirectory())) return false;
+    dir = path2.join(dir, name);
+  }
+  return true;
+}
+__name(isDiscoverableDocsFile, "isDiscoverableDocsFile");
 function findDocsPageFile(contentDir, slug) {
-  const segments = slug ? slug.split("/").filter(Boolean) : [];
-  if (!segments.every(isSafeSegment)) return null;
+  const canonicalSlug = trimSlashes(slug);
+  const segments = canonicalSlug ? canonicalSlug.split("/") : [];
+  if (!segments.every((segment) => isSafeSegment(segment) && isDiscoverableDocsEntryName(segment))) {
+    return null;
+  }
   const slugDir = path2.join(contentDir, ...segments);
   const candidates = segments.length === 0 ? DOCS_FILE_NAMES.map((filename) => path2.join(contentDir, filename)) : [
     ...DOCS_FILE_NAMES.map((filename) => path2.join(slugDir, filename)),
-    ...DOCS_FILE_EXTENSIONS2.map((extension) => path2.join(contentDir, `${slug}${extension}`))
+    ...DOCS_FILE_EXTENSIONS2.map(
+      (extension) => path2.join(contentDir, `${canonicalSlug}${extension}`)
+    )
   ];
   for (const candidate of candidates) {
+    if (pathToSlug(contentDir, candidate) !== canonicalSlug) continue;
+    if (!isDiscoverableDocsFile(contentDir, candidate)) continue;
     const safePath = resolveExistingFileInside(contentDir, candidate);
     if (safePath) {
       return safePath;
@@ -784,6 +824,10 @@ function loadFarmDocsPage(contentDir, docs, slug) {
   };
 }
 __name(loadFarmDocsPage, "loadFarmDocsPage");
+function getFarmDocsMarkdownPath(href) {
+  return href === "/" ? "/.md" : `${href}.md`;
+}
+__name(getFarmDocsMarkdownPath, "getFarmDocsMarkdownPath");
 function createDocsHref(entry, slug) {
   const normalizedEntry = normalizeEntry2(entry);
   const normalizedSlug = trimSlashes(slug);
@@ -861,8 +905,8 @@ function getDocsDescription(docs) {
   return docs.config.metadata?.description;
 }
 __name(getDocsDescription, "getDocsDescription");
-function getLoadedDocsPages(contentDir, docs) {
-  return discoverFarmDocsPages(contentDir, docs).map((page) => loadFarmDocsPage(contentDir, docs, page.slug)).filter((page) => Boolean(page));
+function getLoadedDocsPages(contentDir, docs, isPathGuarded) {
+  return discoverFarmDocsPages(contentDir, docs).filter((page) => !isPathGuarded?.(page.href)).map((page) => loadFarmDocsPage(contentDir, docs, page.slug)).filter((page) => Boolean(page));
 }
 __name(getLoadedDocsPages, "getLoadedDocsPages");
 function toDocsLlmsPage(page) {
@@ -1057,10 +1101,10 @@ function getDocsDiscoveryOptions(docs, request) {
   };
 }
 __name(getDocsDiscoveryOptions, "getDocsDiscoveryOptions");
-function createFarmDocsPublicResponse(contentDir, docs, request) {
+function createFarmDocsPublicResponse(contentDir, docs, request, isPathGuarded) {
   const url = new URL(request.url);
   let loadedPages;
-  const getPages = /* @__PURE__ */ __name(() => loadedPages ?? (loadedPages = getLoadedDocsPages(contentDir, docs)), "getPages");
+  const getPages = /* @__PURE__ */ __name(() => loadedPages ?? (loadedPages = getLoadedDocsPages(contentDir, docs, isPathGuarded)), "getPages");
   const sitemapManifest = /* @__PURE__ */ __name(() => docsEngine().buildDocsSitemapManifest({
     pages: getPages().map(toDocsSitemapPage),
     entry: docs.entry,
@@ -1786,11 +1830,11 @@ function renderDocsSearchTrigger(showIcon = true, className = "") {
 __name(renderDocsSearchTrigger, "renderDocsSearchTrigger");
 function renderDocsSearchMount(clientEntry) {
   return `<div id="farm-docs-search-root" data-farm-docs-search-root data-api="/api/docs"></div>
-  <script type="module" src="${escapeAttribute(clientEntry)}"></script>`;
+  ${stampFarmCspNonce(`<script type="module" src="${escapeAttribute(clientEntry)}"></script>`)}`;
 }
 __name(renderDocsSearchMount, "renderDocsSearchMount");
 function renderDocsSearchBootstrapScript() {
-  return `<script>${generateFarmDocsSearchBootstrapRuntime()}</script>`;
+  return stampFarmCspNonce(`<script>${generateFarmDocsSearchBootstrapRuntime()}</script>`);
 }
 __name(renderDocsSearchBootstrapScript, "renderDocsSearchBootstrapScript");
 function renderPixelToc(items) {
@@ -1820,9 +1864,9 @@ function renderDocsHashRuntimeScript() {
 }
 __name(renderDocsHashRuntimeScript, "renderDocsHashRuntimeScript");
 function renderDocsRuntimeScripts(docs) {
-  return `${renderDocsRuntimeScript(docs)}
+  return stampFarmCspNonce(`${renderDocsRuntimeScript(docs)}
 ${renderDocsHashRuntimeScript()}
-${renderDocsPageActionsRuntimeScript()}`;
+${renderDocsPageActionsRuntimeScript()}`);
 }
 __name(renderDocsRuntimeScripts, "renderDocsRuntimeScripts");
 function renderFarmDocsFontPreloads(fontAssets) {
@@ -1934,7 +1978,9 @@ function createFarmDocsHandler(docs, options) {
     const socialImageSlug = getFarmDocsSocialImageSlug(docs, requestUrl);
     if (socialImageSlug !== null) {
       const socialImagePage = loadFarmDocsPage(contentDir, docs, socialImageSlug);
-      if (!socialImagePage || !isFarmDocsSocialImageEnabled(socialImagePage, docs) || getFarmDocsCustomSocialImage(socialImagePage)) {
+      if (!socialImagePage || // The image sits outside the page's URL, where its guard does not reach, and
+      // draws the page's title.
+      options.isPathGuarded?.(socialImagePage.href) || !isFarmDocsSocialImageEnabled(socialImagePage, docs) || getFarmDocsCustomSocialImage(socialImagePage)) {
         return null;
       }
       const descriptor = createFarmDocsSocialImageDescriptor(socialImagePage, docs, requestUrl);
@@ -1953,12 +1999,20 @@ function createFarmDocsHandler(docs, options) {
       if (request.method === "HEAD") return new Response(null, { status: 200, headers });
       return new Response(renderFarmDocsSocialImageSvg(descriptor), { status: 200, headers });
     }
-    const publicResponse = createFarmDocsPublicResponse(contentDir, docs, request);
+    const publicResponse = createFarmDocsPublicResponse(
+      contentDir,
+      docs,
+      request,
+      options.isPathGuarded
+    );
     if (publicResponse) return omitFarmDocsHeadBody(request, publicResponse);
     if (!isFarmDocsRequest(docs, request)) return null;
     const page = loadPage(contentDir, docs, request);
     if (!page) return null;
     const negotiatesAccept = !requestUrl.pathname.endsWith(".md");
+    if (!negotiatesAccept && options.isPathGuarded?.(page.href) && !options.isPathGuarded(getFarmDocsMarkdownPath(page.href))) {
+      return null;
+    }
     if (shouldReturnMarkdown(request)) {
       const origin = new URL(request.url).origin;
       return omitFarmDocsHeadBody(
@@ -2022,6 +2076,7 @@ export {
   getFarmDocsRouteTypeEntries,
   getFarmDocsDocumentNavigationMatchers,
   loadFarmDocsPage,
+  getFarmDocsMarkdownPath,
   discoverFarmDocsPages,
   toFarmDocsMarkdownPage,
   createFarmDocsHandler

package/dist/{chunk-JNUWCDTF.cjs → chunk-5D2JIPLH.cjs}

@@ -29,7 +29,7 @@ var _chunkPSV6XKPOcjs = require('./chunk-PSV6XKPO.cjs');
 var _chunkM7MKQXAFcjs = require('./chunk-M7MKQXAF.cjs');
 
 
-var _chunkSJNMVDDFcjs = require('./chunk-SJNMVDDF.cjs');
+var _chunkFUCSUGDMcjs = require('./chunk-FUCSUGDM.cjs');
 
 
 var _chunkUFDAAQFXcjs = require('./chunk-UFDAAQFX.cjs');
@@ -736,7 +736,7 @@ async function createRouteTypeDeclarations(options, outPath) {
         }
       }
     }
-    for (const route of await _chunkSJNMVDDFcjs.discoverProgrammaticRoutePaths.call(void 0, source.root, source.srcDir)) {
+    for (const route of await _chunkFUCSUGDMcjs.discoverProgrammaticRoutePaths.call(void 0, source.root, source.srcDir)) {
       patterns.add(route);
       routeModulePatterns.add(route);
     }

package/dist/{chunk-BO36SELV.cjs → chunk-5OKBARDN.cjs}

@@ -13,7 +13,7 @@ var _chunkYWN746UScjs = require('./chunk-YWN746US.cjs');
 var _chunkOX6O6WVAcjs = require('./chunk-OX6O6WVA.cjs');
 
 
-var _chunkU4KT7QP3cjs = require('./chunk-U4KT7QP3.cjs');
+var _chunkULASELLAcjs = require('./chunk-ULASELLA.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -118,7 +118,7 @@ function createServerFn(options) {
       throw labelInputErrors && isSchemaValidationFailure(cause) ? new ServerFnInputError(cause) : cause;
     }
     const executionContext = _chunkT5OJPTVNcjs.getServerActionExecutionContext.call(void 0, );
-    const request = _nullishCoalesce(_optionalChain([executionContext, 'optionalAccess', _ => _.request]), () => ( _chunkU4KT7QP3cjs._resolveCurrentRequest.call(void 0, )));
+    const request = _nullishCoalesce(_optionalChain([executionContext, 'optionalAccess', _ => _.request]), () => ( _chunkULASELLAcjs._resolveCurrentRequestForApp.call(void 0, )));
     const signal = _nullishCoalesce(_nullishCoalesce(_optionalChain([executionContext, 'optionalAccess', _2 => _2.signal]), () => ( _optionalChain([request, 'optionalAccess', _3 => _3.signal]))), () => ( _chunkT5OJPTVNcjs.getServerActionSignal.call(void 0, )));
     const handlerContext = {
       input,