@farm.js/core 0.1.36 → 0.1.38

package/dist/{chunk-4E5AEDKY.mjs → chunk-A3EAIURZ.mjs}

@@ -1,20 +1,21 @@
 import {
   discoverFarmDocsPages,
+  getFarmDocsMarkdownPath,
   loadFarmDocsPage,
   resolveFarmDocsContentDir,
   toFarmDocsMarkdownPage
-} from "./chunk-O6WAEAX3.mjs";
+} from "./chunk-5BWWFHR2.mjs";
 import {
   docsEngine,
   loadFarmDocsEngine
 } from "./chunk-2VQKKQ6D.mjs";
 import {
   resolveDocsConfig
-} from "./chunk-OHLSEQ57.mjs";
+} from "./chunk-ZJD2PN6Z.mjs";
 import {
   getFarmDocsAdapterConfigModule,
   isSecretDocsConfigKey
-} from "./chunk-ENLZ4R3Y.mjs";
+} from "./chunk-J7K2NZD6.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
@@ -27,6 +28,15 @@ function hasFarmDocsRuntimeAdapter(docs) {
   return Boolean(docs?.enabled && docs.adapter?.server && docs.adapter.react);
 }
 __name(hasFarmDocsRuntimeAdapter, "hasFarmDocsRuntimeAdapter");
+function assertFarmDocsAdapterServesNoGuardedPages(docs, options, isPathGuarded) {
+  if (!isPathGuarded || !hasFarmDocsRuntimeAdapter(docs)) return;
+  const guarded = discoverFarmDocsPages(resolveFarmDocsContentDir(docs, options), docs).filter((page) => isPathGuarded(page.href) || isPathGuarded(getFarmDocsMarkdownPath(page.href))).map((page) => page.href);
+  if (guarded.length === 0) return;
+  throw new Error(
+    `Docs pages behind a path guard (${guarded.join(", ")}) would be public: the docs adapter ${JSON.stringify(docs.adapter.id)} serves their content in llms-full.txt, search, Markdown, and MCP without running the app's guards. Move those pages out of the docs content directory, or set docs.adapter = false to use Farm's built-in docs runtime, which keeps guarded pages off anonymous surfaces.`
+  );
+}
+__name(assertFarmDocsAdapterServesNoGuardedPages, "assertFarmDocsAdapterServesNoGuardedPages");
 async function loadFarmDocsConfigModule(docs, loadModule) {
   const configModule = getFarmDocsAdapterConfigModule(docs);
   if (!configModule) return void 0;
@@ -99,6 +109,7 @@ async function createFarmDocsAdapterHandler(docs, options) {
   if (!hasFarmDocsRuntimeAdapter(docs)) {
     throw new Error("Farm docs adapter requires server and react runtime entrypoints.");
   }
+  assertFarmDocsAdapterServesNoGuardedPages(docs, options, options.isPathGuarded);
   const serverModule = await options.loadModule(
     docs.adapter.server
   );
@@ -277,7 +288,7 @@ function getDocsDescription(docs) {
 }
 __name(getDocsDescription, "getDocsDescription");
 function getLoadedDocsPages(context) {
-  return discoverFarmDocsPages(context.contentDir, context.docs).map((page) => loadFarmDocsPage(context.contentDir, context.docs, page.slug)).filter((page) => Boolean(page));
+  return discoverFarmDocsPages(context.contentDir, context.docs).filter((page) => !context.isPathGuarded(page.href)).map((page) => loadFarmDocsPage(context.contentDir, context.docs, page.slug)).filter((page) => Boolean(page));
 }
 __name(getLoadedDocsPages, "getLoadedDocsPages");
 function toDocsSourcePage(page) {
@@ -389,7 +400,9 @@ __name(renderAgentsDocument, "renderAgentsDocument");
 function buildAgentSpec(context, request) {
   const url = new URL(request.url);
   const origin = url.origin;
-  const pages = discoverFarmDocsPages(context.contentDir, context.docs);
+  const pages = discoverFarmDocsPages(context.contentDir, context.docs).filter(
+    (page) => !context.isPathGuarded(page.href)
+  );
   const spec = docsEngine().buildDocsAgentDiscoverySpec(getDocsDiscoveryOptions(context, request));
   const title = getDocsTitle(context.docs);
   return {
@@ -552,12 +565,14 @@ async function resolveAPIContext(options) {
     configPath: options.configPath
   };
   const docs = isResolvedDocsConfig(docsInput) ? docsInput : await resolveDocsConfig(docsInput, { root, srcDir });
+  const guardedPaths = new Set(runtimeConfig?.guardedPaths ?? []);
   return {
     root,
     srcDir,
     docs,
     contentDir: resolveFarmDocsContentDir(docs, { root, srcDir }),
-    diagnostics: options.diagnostics === true
+    diagnostics: options.diagnostics === true,
+    isPathGuarded: options.isPathGuarded ?? ((pathname) => guardedPaths.has(pathname))
   };
 }
 __name(resolveAPIContext, "resolveAPIContext");
@@ -616,7 +631,9 @@ async function handleDocsAPIGet(request, context) {
     const pathParam = url.searchParams.get("path") || url.searchParams.get("slug");
     const slug = normalizeDocsApiSlug(pathParam ?? pathTarget.slug ?? "", context.docs);
     const page = loadFarmDocsPage(context.contentDir, context.docs, slug);
-    if (!page) return text("Docs page not found\n", "text/plain; charset=utf-8", { status: 404 });
+    if (!page || context.isPathGuarded(page.href)) {
+      return text("Docs page not found\n", "text/plain; charset=utf-8", { status: 404 });
+    }
     return text(
       docsEngine().renderDocsMarkdownDocument(toFarmDocsMarkdownPage(page), {
         origin: new URL(request.url).origin,
@@ -688,6 +705,7 @@ __name(createFarmDocsAPIHandler, "createFarmDocsAPIHandler");
 
 export {
   hasFarmDocsRuntimeAdapter,
+  assertFarmDocsAdapterServesNoGuardedPages,
   compileFarmDocsAdapterEdgeManifest,
   createFarmDocsAdapterHandler,
   isFarmDocsAPIRequest,

package/dist/{chunk-YDQZGSDS.mjs → chunk-ARC7I3O2.mjs}

@@ -34,7 +34,7 @@ import {
 } from "./chunk-4SIYUGRY.mjs";
 import {
   _resolveCurrentRequest
-} from "./chunk-IZY3V5XW.mjs";
+} from "./chunk-QRKIMN7T.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";

package/dist/{chunk-LSZAVSGY.mjs → chunk-B6G5CKMC.mjs}

@@ -1,18 +1,29 @@
 import {
   FARM_DEFAULT_MCP_TOOLS
-} from "./chunk-UH6QN5NL.mjs";
+} from "./chunk-P664ZVTV.mjs";
 import {
   DEFAULT_ERROR_STYLES
 } from "./chunk-XAXTTBUT.mjs";
 import {
   serializeFarmLlmsTxt
-} from "./chunk-DTSROJ5J.mjs";
+} from "./chunk-HD5CF3OE.mjs";
+import {
+  stampFarmCspNonce
+} from "./chunk-U6QLDL3G.mjs";
 import {
   emitFarmAgentRead
 } from "./chunk-MVL2RAJW.mjs";
 import {
   resolveFarmThemeConfig
 } from "./chunk-AELACLOB.mjs";
+import {
+  integrationMiddlewareMayHandlePath
+} from "./chunk-IBUQWVYA.mjs";
+import {
+  compileMiddlewareConfig,
+  matchesCompiledMiddlewareConfig,
+  matchesMiddlewareRoute
+} from "./chunk-HZFM2LWQ.mjs";
 import {
   omitFarmResponseBody
 } from "./chunk-5WI2S4CO.mjs";
@@ -25,12 +36,13 @@ import {
   matchesFarmIfNoneMatch
 } from "./chunk-ZMMBIVQM.mjs";
 import {
+  createFarmAPIMiddlewarePathnames,
   resolveFarmAPIServerBasePath,
   resolveFarmAPIServerRoutePath
 } from "./chunk-BTHHUD7Q.mjs";
 import {
   FARM_VERSION
-} from "./chunk-OO7GXVSR.mjs";
+} from "./chunk-LI2F57NI.mjs";
 import {
   localizeFarmPathname
 } from "./chunk-L3KT7IXV.mjs";
@@ -219,6 +231,71 @@ ${html}`;
 }
 __name(composeFarmFullDocument, "composeFarmFullDocument");
 
+// src/middleware/may-handle.ts
+function hasFarmMiddlewareConfig(config) {
+  if (!config) return false;
+  if (Array.isArray(config)) return config.length > 0;
+  const configRecord = config;
+  return Boolean(
+    configRecord.matcher || configRecord.exclude || configRecord.runtime || configRecord.handler || Array.isArray(configRecord.handlers) && configRecord.handlers.length > 0
+  );
+}
+__name(hasFarmMiddlewareConfig, "hasFarmMiddlewareConfig");
+function configMiddlewareMayHandlePath(config, pathname) {
+  if (!hasFarmMiddlewareConfig(config)) return false;
+  const entries = Array.isArray(config) ? config : [config];
+  return entries.some((entry) => {
+    if (!entry.matcher && !entry.exclude) return true;
+    const matchers = entry.matcher ? (Array.isArray(entry.matcher) ? entry.matcher : [entry.matcher]).map(
+      (matcher) => (
+        // A request-aware matcher cannot be proven safe at build time.
+        typeof matcher === "function" ? () => true : matcher
+      )
+    ) : void 0;
+    const compiled = compileMiddlewareConfig({ matcher: matchers, exclude: entry.exclude });
+    return matchesCompiledMiddlewareConfig(pathname, compiled, {}).matched;
+  });
+}
+__name(configMiddlewareMayHandlePath, "configMiddlewareMayHandlePath");
+function appMiddlewareMayHandlePath(middlewareRoutes, pathname) {
+  return middlewareRoutes.some((route) => matchesMiddlewareRoute(pathname, route).matched);
+}
+__name(appMiddlewareMayHandlePath, "appMiddlewareMayHandlePath");
+var CATCH_ALL_PROBE = "/__farm-listing-probe__/0";
+function isPathSpecificMatcher(matcher) {
+  if (typeof matcher === "function") return false;
+  const compiled = compileMiddlewareConfig({ matcher });
+  return !matchesCompiledMiddlewareConfig(CATCH_ALL_PROBE, compiled, {}).matched;
+}
+__name(isPathSpecificMatcher, "isPathSpecificMatcher");
+function pathSpecificConfigMiddlewareCovers(config, pathname) {
+  if (!hasFarmMiddlewareConfig(config)) return false;
+  const entries = Array.isArray(config) ? config : [config];
+  return entries.some((entry) => {
+    if (!entry.matcher) return false;
+    const matchers = (Array.isArray(entry.matcher) ? entry.matcher : [entry.matcher]).filter(
+      isPathSpecificMatcher
+    );
+    if (matchers.length === 0) return false;
+    const compiled = compileMiddlewareConfig({ matcher: matchers, exclude: entry.exclude });
+    return matchesCompiledMiddlewareConfig(pathname, compiled, {}).matched;
+  });
+}
+__name(pathSpecificConfigMiddlewareCovers, "pathSpecificConfigMiddlewareCovers");
+function farmPathGuardCoversPage(options, pathname) {
+  return appMiddlewareMayHandlePath(
+    options.middlewareRoutes.filter((route) => route.path !== "/"),
+    pathname
+  ) || pathSpecificConfigMiddlewareCovers(options.config.middleware, pathname) || integrationMiddlewareMayHandlePath(options.config.integrations, pathname, CATCH_ALL_PROBE);
+}
+__name(farmPathGuardCoversPage, "farmPathGuardCoversPage");
+function farmPathGuardCoversEndpoint(options, path, apiServerBasePath) {
+  return createFarmAPIMiddlewarePathnames(apiServerBasePath)(path).some(
+    (pathname) => farmPathGuardCoversPage(options, pathname)
+  );
+}
+__name(farmPathGuardCoversEndpoint, "farmPathGuardCoversEndpoint");
+
 // src/i18n/alternates.ts
 function renderFarmLocaleAlternateLinks(pathname, config, options = {}) {
   if (config.routing === "none") return "";
@@ -269,13 +346,19 @@ function isLateRedirectTarget(url) {
   }
 }
 __name(isLateRedirectTarget, "isLateRedirectTarget");
-function createLateRedirectRecovery(url) {
+function createLateRedirectRecovery(url, nonce) {
   if (!isLateRedirectTarget(url)) return "";
-  return `<script>window.location.replace(${serializeForInlineScript(url)})</script>`;
+  return stampFarmCspNonce(
+    `<script>window.location.replace(${serializeForInlineScript(url)})</script>`,
+    nonce
+  );
 }
 __name(createLateRedirectRecovery, "createLateRedirectRecovery");
-function createLateNotFoundRecovery(content) {
-  return `<template id="${TEMPLATE_ID}">${content}</template><script>(function(){var t=document.getElementById("${TEMPLATE_ID}");var p=document.getElementById("${PAGE_CONTAINER_ID}");if(t&&p){p.replaceChildren(t.content.cloneNode(true));}if(t)t.remove();document.documentElement.dataset.farmLateNotFound="true";var m=document.createElement("meta");m.name="robots";m.content="noindex";document.head.appendChild(m);})();</script>`;
+function createLateNotFoundRecovery(content, nonce) {
+  return `<template id="${TEMPLATE_ID}">${content}</template>` + stampFarmCspNonce(
+    `<script>(function(){var t=document.getElementById("${TEMPLATE_ID}");var p=document.getElementById("${PAGE_CONTAINER_ID}");if(t&&p){p.replaceChildren(t.content.cloneNode(true));}if(t)t.remove();document.documentElement.dataset.farmLateNotFound="true";var m=document.createElement("meta");m.name="robots";m.content="noindex";document.head.appendChild(m);})();</script>`,
+    nonce
+  );
 }
 __name(createLateNotFoundRecovery, "createLateNotFoundRecovery");
 
@@ -763,7 +846,9 @@ function createFarmThemeDocumentParts(input, basePath = "/", serverTheme) {
   const script = createFarmThemeBootstrapScript(config, hydrationTheme);
   return {
     attributes: ` data-theme="${initialTheme}"`,
-    head: `<style id="${THEME_STYLE_ID}">:root[data-theme="light"]{color-scheme:light}:root[data-theme="dark"]{color-scheme:dark}</style><script id="${THEME_SCRIPT_ID}">${script}</script>`
+    head: stampFarmCspNonce(
+      `<style id="${THEME_STYLE_ID}">:root[data-theme="light"]{color-scheme:light}:root[data-theme="dark"]{color-scheme:dark}</style><script id="${THEME_SCRIPT_ID}">${script}</script>`
+    )
   };
 }
 __name(createFarmThemeDocumentParts, "createFarmThemeDocumentParts");
@@ -920,12 +1005,13 @@ function createFarmAppManifest(input, { full = false } = {}) {
     packages: input.packages,
     mcp: {
       servers: _listFarmMCPCatalogs().map(({ server, tools, details }) => {
-        const listed = full || details?.public === true;
+        const open = details?.public === true && !input.guardCoversPath?.(server.path);
+        const listed = full || open;
         return {
           name: server.name,
           version: server.version,
           path: server.path,
-          authorization: details?.public === true ? "none" : "required",
+          authorization: open ? "none" : "required",
           resources: listed ? [...details?.resources ?? []] : [],
           prompts: listed ? [...details?.prompts ?? []] : [],
           tools: (listed ? tools : []).map((tool) => {
@@ -1078,6 +1164,11 @@ export {
   removeFarmDocumentTitles,
   ensureFarmDocumentMeta,
   composeFarmFullDocument,
+  hasFarmMiddlewareConfig,
+  configMiddlewareMayHandlePath,
+  appMiddlewareMayHandlePath,
+  farmPathGuardCoversPage,
+  farmPathGuardCoversEndpoint,
   renderFarmLocaleAlternateLinks,
   createLateRedirectRecovery,
   createLateNotFoundRecovery,

package/dist/{chunk-3KZS4SUS.mjs → chunk-BZHXGVMA.mjs}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-FUZEBRP3.mjs";
 import {
   getCurrentRequestOrNull
-} from "./chunk-FDR64H6B.mjs";
+} from "./chunk-POSPE3IO.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";

package/dist/{chunk-KN7K4VQN.mjs → chunk-CNNOLE4O.mjs}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-CBBLJMR5.mjs";
 import {
   resolveFarmRequestURL
-} from "./chunk-FDR64H6B.mjs";
+} from "./chunk-POSPE3IO.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";

package/dist/{chunk-4GLOOWKE.mjs → chunk-CQMVIOYP.mjs}

@@ -29,7 +29,7 @@ import {
 } from "./chunk-RHAZ22ZN.mjs";
 import {
   discoverProgrammaticRoutePaths
-} from "./chunk-UDNPLXW7.mjs";
+} from "./chunk-MYIZXDZA.mjs";
 import {
   readFarmI18nCatalogs
 } from "./chunk-QCFBDFRS.mjs";

package/dist/{chunk-2ELDTQRN.mjs → chunk-CUM5NYL5.mjs}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-JM5XPKWH.mjs";
 import {
   getCurrentRequestOrNull
-} from "./chunk-FDR64H6B.mjs";
+} from "./chunk-POSPE3IO.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";

package/dist/{chunk-HITLGIAO.cjs → chunk-CY2ZQ5C6.cjs}

@@ -20,15 +20,16 @@ async function hydrateFarmDocsAdapterRuntime() {
 async function hydrateFarmDocsAdapterRuntime() {
   const runtime = window.__FARM_DOCS_ADAPTER__;
   if (!runtime) return false;
-  const FarmDocsAdapterReact = await import(${JSON.stringify(reactModule)});
+  // The docs server flags pages whose config holds what its JSON copy cannot (icons,
+  // MDX components, callbacks); the adapter restores those from the module itself.
+  // Fetch it alongside the adapter rather than after it: they don't depend on each other.
+  const [FarmDocsAdapterReact, configModule] = await Promise.all([
+    import(${JSON.stringify(reactModule)}),
+    runtime.configModule ? ${configModule ? `import(${JSON.stringify(configModule)})` : "undefined"} : undefined,
+  ]);
   if (typeof FarmDocsAdapterReact.hydrateFarmDocs !== "function") {
     throw new Error("The configured Farm docs adapter does not export hydrateFarmDocs().");
   }
-  // The docs server flags pages whose config holds what its JSON copy cannot (icons,
-  // MDX components, callbacks); the adapter restores those from the module itself.
-  const configModule = runtime.configModule
-    ? ${configModule ? `await import(${JSON.stringify(configModule)})` : "undefined"}
-    : undefined;
   FarmDocsAdapterReact.hydrateFarmDocs({
     config: runtime.config || {},
     data: runtime.data,

package/dist/{chunk-PZNL3WEG.mjs → chunk-DMEPTZTI.mjs}

@@ -569,6 +569,10 @@ async function resolveProgrammaticRouteData(route, dataHooks, context) {
   if (routeDataKey == null) {
     return dataHooks.main(context);
   }
+  const revalidate = normalizeProgrammaticRouteStaleTime(dataHooks.staleTime, route.path);
+  if (revalidate === 0) {
+    return dataHooks.main(context);
+  }
   const cacheKey = createFarmCacheKey(["route-data", routeDataKey]);
   const cacheOptions = {
     tags: [
@@ -579,7 +583,7 @@ async function resolveProgrammaticRouteData(route, dataHooks, context) {
       ...typeof context.path === "string" ? [context.path] : [],
       ...await resolveProgrammaticRouteDataKeys(dataHooks.paths, context)
     ],
-    revalidate: normalizeProgrammaticRouteStaleTime(dataHooks.staleTime)
+    revalidate
   };
   return getFarmDataCache().getOrSet(cacheKey, () => dataHooks.main(context), cacheOptions);
 }
@@ -590,20 +594,26 @@ async function resolveProgrammaticRouteDataKeys(input, context) {
   return value.filter((item) => typeof item === "string" && item.trim().length > 0);
 }
 __name(resolveProgrammaticRouteDataKeys, "resolveProgrammaticRouteDataKeys");
-function normalizeProgrammaticRouteStaleTime(staleTime) {
+function normalizeProgrammaticRouteStaleTime(staleTime, routePath) {
   if (staleTime === void 0) return void 0;
   if (staleTime === false) return false;
+  let milliseconds;
   if (typeof staleTime === "number") {
-    if (!Number.isFinite(staleTime) || staleTime <= 0) return void 0;
-    return Math.max(1, Math.ceil(staleTime / 1e3));
+    milliseconds = staleTime;
+  } else {
+    const match = typeof staleTime === "string" && staleTime.match(/^(\d+(?:\.\d+)?)(ms|s|m|h)$/);
+    if (!match) {
+      throw new TypeError(
+        `Route "${routePath}" data.staleTime must be milliseconds or a duration like "250ms", "30s", "5m", or "1h".`
+      );
+    }
+    const unit = match[2];
+    milliseconds = Number(match[1]) * (unit === "ms" ? 1 : unit === "s" ? 1e3 : unit === "m" ? 6e4 : 36e5);
+  }
+  if (!Number.isFinite(milliseconds) || milliseconds < 0) {
+    throw new TypeError(`Route "${routePath}" data.staleTime must be a non-negative duration.`);
   }
-  const match = staleTime.match(/^(\d+(?:\.\d+)?)(ms|s|m|h)$/);
-  if (!match) return void 0;
-  const value = Number(match[1]);
-  if (!Number.isFinite(value) || value <= 0) return void 0;
-  const unit = match[2];
-  const milliseconds = unit === "ms" ? value : unit === "s" ? value * 1e3 : unit === "m" ? value * 6e4 : value * 36e5;
-  return Math.max(1, Math.ceil(milliseconds / 1e3));
+  return milliseconds === 0 ? 0 : Math.max(1, Math.ceil(milliseconds / 1e3));
 }
 __name(normalizeProgrammaticRouteStaleTime, "normalizeProgrammaticRouteStaleTime");
 function isProgrammaticRoutePropsResolved(value) {
@@ -662,6 +672,7 @@ function normalizeProgrammaticRoute(route) {
     };
   }
   const routeActions = route.kind === "page" ? normalizeProgrammaticRouteActions(route) : void 0;
+  normalizeProgrammaticRouteStaleTime(route.data?.staleTime, route.path);
   return {
     ...route,
     ...routeActions,

package/dist/{chunk-QORUJDIV.mjs → chunk-DRLKAXDM.mjs}

@@ -1,9 +1,9 @@
 import {
   useRouter
-} from "./chunk-SC2WYWPF.mjs";
+} from "./chunk-7PEP3BUT.mjs";
 import {
   getRouter
-} from "./chunk-XCMCS4DA.mjs";
+} from "./chunk-ND2CWPOD.mjs";
 import {
   applyFarmBasePath
 } from "./chunk-4RB44K6Z.mjs";

package/dist/{chunk-DQQOKWYA.cjs → chunk-EIPC3FDA.cjs}

@@ -3,18 +3,21 @@
 var _chunkAI7QMY7Ocjs = require('./chunk-AI7QMY7O.cjs');
 
 
-var _chunkUXFQ3UDAcjs = require('./chunk-UXFQ3UDA.cjs');
+var _chunk6XWDE2P2cjs = require('./chunk-6XWDE2P2.cjs');
+
+
+var _chunkULASELLAcjs = require('./chunk-ULASELLA.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
 
 // src/headers.ts
 function headers() {
-  return new Headers(_chunkUXFQ3UDAcjs.getCurrentRequest.call(void 0, ).headers);
+  return new Headers(_chunk6XWDE2P2cjs.getCurrentRequest.call(void 0, ).headers);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, headers, "headers");
 function cookies() {
-  const cookieHeader = _chunkUXFQ3UDAcjs.getCurrentRequest.call(void 0, ).headers.get("cookie") || "";
+  const cookieHeader = _chunk6XWDE2P2cjs.getCurrentRequest.call(void 0, ).headers.get("cookie") || "";
   const parsed = _chunkAI7QMY7Ocjs.parseRequestCookieHeader.call(void 0, cookieHeader);
   return {
     get(name) {
@@ -35,8 +38,13 @@ function cookies() {
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, cookies, "cookies");
+function getCspNonce() {
+  return _chunkULASELLAcjs._resolveCurrentCspNonce.call(void 0, );
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, getCspNonce, "getCspNonce");
+
 
 
 
 
-exports.headers = headers; exports.cookies = cookies;
+exports.headers = headers; exports.cookies = cookies; exports.getCspNonce = getCspNonce;

package/dist/{chunk-HOXTWRGB.mjs → chunk-EKF7KDFD.mjs}

@@ -1,6 +1,9 @@
 import {
   MiddlewareManager
-} from "./chunk-BPOF5U4N.mjs";
+} from "./chunk-JCKYH4LG.mjs";
+import {
+  matchesMiddlewarePredicate
+} from "./chunk-HZFM2LWQ.mjs";
 import {
   resolveFarmI18nConfig
 } from "./chunk-BCMSYSN2.mjs";
@@ -210,7 +213,7 @@ var _MiddlewareChainImpl = class _MiddlewareChainImpl {
    */
   when(condition, fn) {
     const conditionalMiddleware = /* @__PURE__ */ __name(async (ctx, next) => {
-      const shouldRun = typeof condition === "function" ? condition(ctx) : condition;
+      const shouldRun = typeof condition === "function" ? matchesMiddlewarePredicate(condition, ctx) : condition;
       if (!shouldRun) {
         return next();
       }

package/dist/{chunk-42NHY7HW.cjs → chunk-EKN7NSZO.cjs}

@@ -1,7 +1,9 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 
-var _chunkEUV4YR3Vcjs = require('./chunk-EUV4YR3V.cjs');
+
+
+var _chunkSGBJ247Qcjs = require('./chunk-SGBJ247Q.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -119,7 +121,6 @@ var ANONYMOUS_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "cache-control",
   "connection",
   "dnt",
-  "forwarded",
   "host",
   "if-match",
   "if-modified-since",
@@ -141,12 +142,9 @@ var ANONYMOUS_REQUEST_HEADERS = /* @__PURE__ */ new Set([
   "tracestate",
   "upgrade-insecure-requests",
   "user-agent",
-  "via",
-  "x-forwarded-for",
   "x-forwarded-host",
   "x-forwarded-port",
   "x-forwarded-proto",
-  "x-real-ip",
   "x-request-id"
 ]);
 function isAnonymousRequestHeader(name) {
@@ -154,6 +152,41 @@ function isAnonymousRequestHeader(name) {
   return ANONYMOUS_REQUEST_HEADERS.has(lower) || lower.startsWith("sec-fetch-") || lower.startsWith("sec-ch-");
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, isAnonymousRequestHeader, "isAnonymousRequestHeader");
+var PAGE_CHECK_DROPPED_HEADERS = /* @__PURE__ */ new Set([
+  "accept-encoding",
+  "if-match",
+  "if-modified-since",
+  "if-none-match",
+  "if-range",
+  "if-unmodified-since",
+  "range"
+]);
+var PAGE_SEGMENT_MARKER = /<div\s[^>]*\bid=["']?__farm_page__["'\s>]/i;
+async function anonymousVisitorOpensPage(options, url, targetPathname) {
+  const pageUrl = new URL(url);
+  pageUrl.pathname = targetPathname;
+  const headers = new Headers();
+  for (const [name, value] of options.request.headers) {
+    if (!PAGE_CHECK_DROPPED_HEADERS.has(name.toLowerCase())) headers.append(name, value);
+  }
+  headers.set("accept", "text/html");
+  headers.set(_chunkSGBJ247Qcjs.FARM_MARKDOWN_PAGE_CHECK_HEADER, _chunkSGBJ247Qcjs._getFarmMarkdownPageCheckToken.call(void 0, ));
+  const response = await options.renderPage(
+    new Request(pageUrl, {
+      method: "GET",
+      headers,
+      redirect: "manual",
+      signal: options.request.signal
+    })
+  );
+  if (response.status < 200 || response.status >= 300 || !_optionalChain([response, 'access', _9 => _9.headers, 'access', _10 => _10.get, 'call', _11 => _11("content-type"), 'optionalAccess', _12 => _12.toLowerCase, 'call', _13 => _13(), 'access', _14 => _14.includes, 'call', _15 => _15("text/html")])) {
+    void _optionalChain([response, 'access', _16 => _16.body, 'optionalAccess', _17 => _17.cancel, 'call', _18 => _18(), 'access', _19 => _19.catch, 'call', _20 => _20(() => {
+    })]);
+    return false;
+  }
+  return PAGE_SEGMENT_MARKER.test(await response.text());
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, anonymousVisitorOpensPage, "anonymousVisitorOpensPage");
 function hasOnlyAnonymousHeaders(headers) {
   for (const name of headers.keys()) {
     if (!isAnonymousRequestHeader(name)) return false;
@@ -161,16 +194,17 @@ function hasOnlyAnonymousHeaders(headers) {
   return true;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, hasOnlyAnonymousHeaders, "hasOnlyAnonymousHeaders");
+var FARM_MARKDOWN_ANONYMOUS_CLIENT_ADDRESS = "192.0.2.1";
 async function createFarmMarkdownSourceResponse(options) {
   if (options.request.method !== "GET" && options.request.method !== "HEAD") {
     return null;
   }
-  if (_optionalChain([options, 'access', _9 => _9.config, 'optionalAccess', _10 => _10.markdownRoutes]) === false) {
+  if (_optionalChain([options, 'access', _21 => _21.config, 'optionalAccess', _22 => _22.markdownRoutes]) === false) {
     return null;
   }
   const url = new URL(options.request.url);
   const hasMarkdownExtension = url.pathname.toLowerCase().endsWith(".md");
-  if (!hasMarkdownExtension && !_chunkEUV4YR3Vcjs.requestAcceptsMarkdown.call(void 0, options.request.headers.get("accept"))) {
+  if (!hasMarkdownExtension && !_chunkSGBJ247Qcjs.requestAcceptsMarkdown.call(void 0, options.request.headers.get("accept"))) {
     return null;
   }
   const targetPathname = normalizeFarmMarkdownRoutePath(url.pathname);
@@ -178,7 +212,7 @@ async function createFarmMarkdownSourceResponse(options) {
   if (!source) {
     return null;
   }
-  const anonymous = hasOnlyAnonymousHeaders(options.request.headers);
+  const anonymous = hasOnlyAnonymousHeaders(options.request.headers) && (!options.clientAddress || options.clientAddress === FARM_MARKDOWN_ANONYMOUS_CLIENT_ADDRESS);
   if (options.renderPage && (hasMarkdownExtension || !anonymous)) {
     const publicUrl = new URL(url);
     publicUrl.pathname = targetPathname;
@@ -194,11 +228,21 @@ async function createFarmMarkdownSourceResponse(options) {
         signal: options.request.signal
       })
     );
-    if (publicResponse.headers.get("X-Farm-Markdown-Route") === targetPathname) {
-      publicSourceResponses.add(publicResponse);
-      return publicResponse;
+    if (publicResponse.headers.get("X-Farm-Markdown-Route") === targetPathname && publicResponse.headers.has("X-Farm-Markdown-Source")) {
+      let response = publicResponse;
+      if (options.request.headers.has("cookie") || options.request.headers.has("authorization")) {
+        const headers2 = new Headers(publicResponse.headers);
+        headers2.set("Cache-Control", "private, no-store");
+        response = new Response(publicResponse.body, {
+          status: publicResponse.status,
+          statusText: publicResponse.statusText,
+          headers: headers2
+        });
+      }
+      publicSourceResponses.add(response);
+      return response;
     }
-    await _optionalChain([publicResponse, 'access', _11 => _11.body, 'optionalAccess', _12 => _12.cancel, 'call', _13 => _13()]);
+    await _optionalChain([publicResponse, 'access', _23 => _23.body, 'optionalAccess', _24 => _24.cancel, 'call', _25 => _25()]);
     if (!hasMarkdownExtension) return null;
     return new Response(`No public Markdown version of ${targetPathname}.
 `, {
@@ -209,6 +253,9 @@ async function createFarmMarkdownSourceResponse(options) {
       }
     });
   }
+  if (options.renderPage && !await anonymousVisitorOpensPage(options, url, targetPathname)) {
+    return null;
+  }
   const headers = new Headers({
     "Content-Type": "text/markdown; charset=utf-8",
     "Content-Location": targetPathname === "/" ? "/index.md" : `${targetPathname}.md`,
@@ -219,7 +266,7 @@ async function createFarmMarkdownSourceResponse(options) {
   if (!hasMarkdownExtension) {
     headers.set("Vary", "Accept");
   }
-  return _chunkEUV4YR3Vcjs.createFarmMarkdownViewResponse.call(void 0, {
+  return _chunkSGBJ247Qcjs.createFarmMarkdownViewResponse.call(void 0, {
     request: options.request,
     requestUrl: url,
     markdown: source.source,
@@ -239,4 +286,5 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, createFarmMarkdownSourceResponse, "createF
 
 
 
-exports.isFarmMarkdownPageFile = isFarmMarkdownPageFile; exports.normalizeFarmMarkdownRoutePath = normalizeFarmMarkdownRoutePath; exports.parseMarkdownFrontmatter = parseMarkdownFrontmatter; exports.titleFromMarkdown = titleFromMarkdown; exports.createMarkdownMetadata = createMarkdownMetadata; exports.createFarmMarkdownRouteModule = createFarmMarkdownRouteModule; exports.isFarmMarkdownPublicSourceResponse = isFarmMarkdownPublicSourceResponse; exports.createFarmMarkdownSourceResponse = createFarmMarkdownSourceResponse;
+
+exports.isFarmMarkdownPageFile = isFarmMarkdownPageFile; exports.normalizeFarmMarkdownRoutePath = normalizeFarmMarkdownRoutePath; exports.parseMarkdownFrontmatter = parseMarkdownFrontmatter; exports.titleFromMarkdown = titleFromMarkdown; exports.createMarkdownMetadata = createMarkdownMetadata; exports.createFarmMarkdownRouteModule = createFarmMarkdownRouteModule; exports.isFarmMarkdownPublicSourceResponse = isFarmMarkdownPublicSourceResponse; exports.FARM_MARKDOWN_ANONYMOUS_CLIENT_ADDRESS = FARM_MARKDOWN_ANONYMOUS_CLIENT_ADDRESS; exports.createFarmMarkdownSourceResponse = createFarmMarkdownSourceResponse;