@farm.js/core 0.1.36 → 0.1.38

package/dist/{chunk-35WV46VL.mjs → chunk-OCIEZME4.mjs}

@@ -2,25 +2,32 @@ import {
   loadFarmProductionVite
 } from "./chunk-S3FNNQHR.mjs";
 import {
+  FARM_NODE_ENV_MODULE_FILE,
+  FARM_NODE_ENV_MODULE_SOURCE,
+  createFarmNodeServerEntry,
   withProductionNodeEnv
-} from "./chunk-655RLQQL.mjs";
+} from "./chunk-6BK3K2GB.mjs";
 import {
-  generateNativeMCPPluginSource
-} from "./chunk-FXEF4PPL.mjs";
+  generateNativeMCPPluginSource,
+  layoutsCanCoverSamePage
+} from "./chunk-TYMMBFN2.mjs";
 import {
+  assertFarmDocsAdapterServesNoGuardedPages,
   compileFarmDocsAdapterEdgeManifest,
-  createFarmDocsAPIHandler
-} from "./chunk-4E5AEDKY.mjs";
+  createFarmDocsAPIHandler,
+  hasFarmDocsRuntimeAdapter
+} from "./chunk-A3EAIURZ.mjs";
 import {
   FARM_DOCS_LAST_MODIFIED_MANIFEST,
   createFarmDocsHandler,
   createFarmDocsLastModifiedManifest,
   discoverFarmDocsPages,
+  getFarmDocsMarkdownPath,
   getFarmDocsRouteTypeEntries,
   loadFarmDocsPage,
   resolveFarmDocsContentDir,
   toFarmDocsMarkdownPage
-} from "./chunk-O6WAEAX3.mjs";
+} from "./chunk-5BWWFHR2.mjs";
 import {
   generateFarmDocsSearchClientRuntime,
   isFarmDocsSearchEnabled,
@@ -28,7 +35,7 @@ import {
 } from "./chunk-UP4CW6WP.mjs";
 import {
   FARM_PRERENDER_ENV
-} from "./chunk-3KZS4SUS.mjs";
+} from "./chunk-BZHXGVMA.mjs";
 import {
   loadFarmDocsEngine
 } from "./chunk-2VQKKQ6D.mjs";
@@ -37,7 +44,7 @@ import {
   getDeployTargetForPreset,
   hasCustomFarmRouteContext,
   resolveDeployOutputPath
-} from "./chunk-OHLSEQ57.mjs";
+} from "./chunk-ZJD2PN6Z.mjs";
 import {
   resolveFarmInstrumentationFile
 } from "./chunk-ZZSRYEYU.mjs";
@@ -76,30 +83,34 @@ import {
   resolveFarmIsolatedClientHydrationMode,
   resolveFarmNotFoundComponentPath,
   usesFarmServerTree
-} from "./chunk-276VJSM6.mjs";
+} from "./chunk-TUBTR2OP.mjs";
 import {
   findRequestBoundSourceBlockers,
   generateFarmTypeArtifacts,
   parseRouteRenderingDirective,
   resolveRouteRenderingConfigFromFile
-} from "./chunk-4GLOOWKE.mjs";
+} from "./chunk-CQMVIOYP.mjs";
 import {
   FARM_API_CATALOG_PATH,
   FARM_APP_MANIFEST_LEGACY_PATH,
   FARM_APP_MANIFEST_PATH,
   HOISTED_HEAD_ELEMENT,
+  appMiddlewareMayHandlePath,
+  configMiddlewareMayHandlePath,
+  farmPathGuardCoversPage,
   getRouteDirectoryDepth,
   getRouteGroupScope,
+  hasFarmMiddlewareConfig,
   resolveFarmApiCatalogInput,
   resolveFarmAppManifestInput,
   routeBoundaryCoversDirectory,
   stripRouteGroups
-} from "./chunk-LSZAVSGY.mjs";
+} from "./chunk-B6G5CKMC.mjs";
 import {
   FARM_DEFAULT_MCP_PATH,
   createFarmDefaultMCPServer,
   farmConfigMountsMCP
-} from "./chunk-UH6QN5NL.mjs";
+} from "./chunk-P664ZVTV.mjs";
 import {
   isFarmPreviewDeploymentEnvironment
 } from "./chunk-BOYNDCZL.mjs";
@@ -109,7 +120,7 @@ import {
 import {
   generateFarmDocsAdapterClientRuntime,
   getFarmDocsAdapterConfigModule
-} from "./chunk-ENLZ4R3Y.mjs";
+} from "./chunk-J7K2NZD6.mjs";
 import {
   resolveFarmDocsFontAssets,
   toFarmDocsPublicFontAssets
@@ -130,8 +141,9 @@ import {
   resolveFarmRendererAppSetup
 } from "./chunk-DAATZTKJ.mjs";
 import {
-  applyFarmCspHashesToHtml
-} from "./chunk-4E5WBPEG.mjs";
+  applyFarmCspHashesToHtml,
+  createFarmCspNonce
+} from "./chunk-U6QLDL3G.mjs";
 import {
   applyFarmCronVercelCrons,
   createFarmCronCloudflareConfig,
@@ -143,14 +155,14 @@ import {
 } from "./chunk-4OOBRCJX.mjs";
 import {
   isFarmMarkdownPageFile
-} from "./chunk-4WCZJQUO.mjs";
+} from "./chunk-QFW2IH5E.mjs";
 import {
   resolveFarmMdxComponentsModulePath,
   resolveMdxConfig
 } from "./chunk-FA2W42OV.mjs";
 import {
   getFarmMarkdownAlternatePath
-} from "./chunk-WWIKMBRN.mjs";
+} from "./chunk-VNGH5MLF.mjs";
 import {
   applyFarmWorkflowVercelCrons,
   prepareFarmWorkflowsForNitro
@@ -159,20 +171,15 @@ import {
   FARM_INTEGRATION_API_BASE_PATH_KEY,
   getFarmIntegrationPluginServerRuntime,
   getIntegrationProviders
-} from "./chunk-MKYBIIAQ.mjs";
+} from "./chunk-IBUQWVYA.mjs";
 import {
   appendMiddlewareDirectory,
   appendMiddlewareRoutePath,
   compareMiddlewareRouteLocations
-} from "./chunk-BPOF5U4N.mjs";
-import {
-  compileMiddlewareConfig,
-  matchesCompiledMiddlewareConfig,
-  matchesMiddlewareRoute
-} from "./chunk-JG6DJF5A.mjs";
+} from "./chunk-JCKYH4LG.mjs";
 import {
   APIRouteManager
-} from "./chunk-T4OGRVNS.mjs";
+} from "./chunk-WLL43JMO.mjs";
 import {
   readFarmI18nCatalogs
 } from "./chunk-QCFBDFRS.mjs";
@@ -199,10 +206,13 @@ import {
 } from "./chunk-BTHHUD7Q.mjs";
 import {
   FARM_VERSION
-} from "./chunk-OO7GXVSR.mjs";
+} from "./chunk-LI2F57NI.mjs";
 import {
   getFarmPresetRuntime
 } from "./chunk-2A3EQHXX.mjs";
+import {
+  _runWithFarmCspNonce
+} from "./chunk-POSPE3IO.mjs";
 import {
   compareRoutePatternSpecificity
 } from "./chunk-55YI3RRB.mjs";
@@ -211,7 +221,7 @@ import {
 } from "./chunk-LPEX4YW6.mjs";
 
 // src/build/index.ts
-import path7 from "path";
+import path9 from "path";
 import { existsSync as existsSync3 } from "fs";
 
 // src/nitro/client-css-href.ts
@@ -219,15 +229,15 @@ import path from "path";
 var FARM_CLIENT_CSS_HREF_PLACEHOLDER = "/__farm_client_css_href__";
 var FARM_CLIENT_JS_SRC_PLACEHOLDER = "/__farm_client_js_src__";
 async function hashAndCopy(sourcePath, destinationDir, hashedName) {
-  const fs = await import("fs/promises");
+  const fs3 = await import("fs/promises");
   try {
-    const bytes = await fs.readFile(sourcePath);
+    const bytes = await fs3.readFile(sourcePath);
     if (bytes.length === 0) return null;
     const { createHash } = await import("crypto");
     const hash = createHash("sha256").update(bytes).digest("hex").slice(0, 8);
     const name = hashedName(hash);
-    await fs.mkdir(destinationDir, { recursive: true });
-    await fs.writeFile(path.join(destinationDir, name), bytes);
+    await fs3.mkdir(destinationDir, { recursive: true });
+    await fs3.writeFile(path.join(destinationDir, name), bytes);
     return name;
   } catch {
     return null;
@@ -244,9 +254,9 @@ async function resolveHashedClientCssHref(clientOutputDir) {
 }
 __name(resolveHashedClientCssHref, "resolveHashedClientCssHref");
 async function findFingerprintedClientEntry(clientOutputDir) {
-  const fs = await import("fs/promises");
+  const fs3 = await import("fs/promises");
   try {
-    const entries = await fs.readdir(clientOutputDir);
+    const entries = await fs3.readdir(clientOutputDir);
     return entries.find((name) => /^farm-client-h[0-9a-f]+\.js$/.test(name)) ?? null;
   } catch {
     return null;
@@ -256,17 +266,17 @@ __name(findFingerprintedClientEntry, "findFingerprintedClientEntry");
 async function resolveHashedClientJsSrc(clientOutputDir) {
   const entryName = await findFingerprintedClientEntry(clientOutputDir);
   if (!entryName) return "/farm-client.js";
-  const fs = await import("fs/promises");
+  const fs3 = await import("fs/promises");
   const shim = `export * from "./${entryName}";
 `;
-  await fs.writeFile(path.join(clientOutputDir, "farm-client.js"), shim);
+  await fs3.writeFile(path.join(clientOutputDir, "farm-client.js"), shim);
   return `/${entryName}`;
 }
 __name(resolveHashedClientJsSrc, "resolveHashedClientJsSrc");
 
 // src/nitro/universal-build.ts
 import os from "os";
-import path6 from "path";
+import path8 from "path";
 import { constants as fsConstants, existsSync as existsSync2, readFileSync, realpathSync, statSync } from "fs";
 import { fileURLToPath } from "url";
 import { builtinModules, createRequire } from "module";
@@ -342,18 +352,21 @@ async function compileFarmDocsManifest(docs, options) {
     clientEntry: options.clientEntry,
     fontAssets: options.fontAssets,
     fontStylesheetHref: options.fontStylesheetHref,
-    globalStylesheetHref: options.globalStylesheetHref
+    globalStylesheetHref: options.globalStylesheetHref,
+    isPathGuarded: options.isPathGuarded
   });
   const apiHandler = createFarmDocsAPIHandler({
     rootDir: options.root,
     srcDir: options.srcDir,
-    docs
+    docs,
+    isPathGuarded: options.isPathGuarded
   });
+  const publicPages = pages.filter((page) => !options.isPathGuarded?.(page.href));
   const routes = {};
   const apiMarkdown = {};
   for (const page of pages) {
     const htmlResponse = await addHandlerRoute(routes, page.href, handler, absolutePaths);
-    const markdownPath = page.href === "/" ? "/.md" : `${page.href}.md`;
+    const markdownPath = getFarmDocsMarkdownPath(page.href);
     await addHandlerRoute(routes, markdownPath, handler, absolutePaths);
     if (htmlResponse) {
       const socialImagePath = findSocialImagePath(await htmlResponse.text());
@@ -361,6 +374,7 @@ async function compileFarmDocsManifest(docs, options) {
         await addHandlerRoute(routes, socialImagePath, handler, absolutePaths);
       }
     }
+    if (options.isPathGuarded?.(page.href)) continue;
     const apiResponse = await apiHandler(
       new Request(
         `${FARM_DOCS_COMPILED_ORIGIN}/api/docs?format=markdown&path=${encodeURIComponent(page.slug)}`
@@ -435,7 +449,7 @@ async function compileFarmDocsManifest(docs, options) {
       empty: await compileResponse(emptyResponse, absolutePaths),
       post: await compileResponse(postResponse, absolutePaths),
       search: {
-        pages: pages.map((page) => ({
+        pages: publicPages.map((page) => ({
           ...toFarmDocsMarkdownPage(page),
           sourcePath: `farm-docs:${page.slug || "index"}`
         })),
@@ -448,11 +462,179 @@ async function compileFarmDocsManifest(docs, options) {
 }
 __name(compileFarmDocsManifest, "compileFarmDocsManifest");
 
-// src/route-runtime-manifest.ts
+// src/nitro/client-module-preloads.ts
+import fs from "fs/promises";
 import path3 from "path";
+var FARM_CLIENT_MODULE_PRELOADS_PLACEHOLDER = "__farm_client_module_preloads__";
+var FARM_CLIENT_MODULE_PRELOADS_FILE = "client-module-preloads.json";
+function collectFarmClientModulePreloads(bundle, options) {
+  const chunks = Object.values(bundle).filter(
+    (output) => output.type === "chunk"
+  );
+  const entry = chunks.find((chunk) => chunk.isEntry && chunk.name === options.entryName);
+  if (!entry) return null;
+  const byFile = new Map(chunks.map((chunk) => [chunk.fileName, chunk]));
+  const files = [];
+  const indexOf = /* @__PURE__ */ new Map();
+  const index = /* @__PURE__ */ __name((fileName) => {
+    let value = indexOf.get(fileName);
+    if (value === void 0) {
+      value = files.push(fileName) - 1;
+      indexOf.set(fileName, value);
+    }
+    return value;
+  }, "index");
+  const staticImports = /* @__PURE__ */ __name((chunk, loaded, into) => {
+    for (const fileName of chunk.imports ?? []) {
+      const imported = byFile.get(fileName);
+      if (loaded.has(fileName) || !imported) continue;
+      loaded.add(fileName);
+      into.push(fileName);
+      staticImports(imported, loaded, into);
+    }
+    return into;
+  }, "staticImports");
+  const entryFiles = staticImports(entry, /* @__PURE__ */ new Set([entry.fileName]), []);
+  const entryLoaded = /* @__PURE__ */ new Set([entry.fileName, ...entryFiles]);
+  const modules = {};
+  for (const chunk of chunks) {
+    if (!chunk.isDynamicEntry || !chunk.facadeModuleId || entryLoaded.has(chunk.fileName)) {
+      continue;
+    }
+    const moduleId = chunk.facadeModuleId.split("?")[0];
+    if (!path3.isAbsolute(moduleId)) continue;
+    const loaded = /* @__PURE__ */ new Set([...entryLoaded, chunk.fileName]);
+    modules[toViteModuleId(moduleId, options.root)] = [
+      chunk.fileName,
+      ...staticImports(chunk, loaded, [])
+    ].map(index);
+  }
+  return { files, entry: entryFiles.map(index), modules };
+}
+__name(collectFarmClientModulePreloads, "collectFarmClientModulePreloads");
+function createFarmClientModulePreloadPlugin(options) {
+  return {
+    name: "farm-client-module-preloads",
+    async generateBundle(_output, bundle) {
+      await fs.mkdir(options.buildDir, { recursive: true });
+      await fs.writeFile(
+        path3.join(options.buildDir, FARM_CLIENT_MODULE_PRELOADS_FILE),
+        JSON.stringify(collectFarmClientModulePreloads(bundle, options))
+      );
+    }
+  };
+}
+__name(createFarmClientModulePreloadPlugin, "createFarmClientModulePreloadPlugin");
+async function readFarmClientModulePreloads(buildDir) {
+  try {
+    return JSON.parse(
+      await fs.readFile(path3.join(buildDir, FARM_CLIENT_MODULE_PRELOADS_FILE), "utf8")
+    );
+  } catch {
+    return null;
+  }
+}
+__name(readFarmClientModulePreloads, "readFarmClientModulePreloads");
+function encodeFarmClientModulePreloads(manifest) {
+  return JSON.stringify(JSON.stringify(manifest)).slice(1, -1).replace(/'/g, "\\u0027").replace(/`/g, "\\u0060").replace(/\$/g, "\\u0024").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+__name(encodeFarmClientModulePreloads, "encodeFarmClientModulePreloads");
+
+// src/docs/module-preloads.ts
+import fs2 from "fs/promises";
+import path4 from "path";
+var FARM_DOCS_MODULE_PRELOADS_PLACEHOLDER = "__farm_docs_module_preloads__";
+var FARM_DOCS_MODULE_PRELOADS_FILE = "docs-module-preloads.json";
+function normalizeModuleId(id) {
+  return id.split("?")[0].replace(/\\/g, "/");
+}
+__name(normalizeModuleId, "normalizeModuleId");
+function collectFarmDocsModulePreloads(bundle, options) {
+  const chunks = Object.values(bundle).filter(
+    (output) => output.type === "chunk"
+  );
+  const byFile = new Map(chunks.map((chunk) => [chunk.fileName, chunk]));
+  const byModule = new Map(
+    chunks.filter((chunk) => chunk.facadeModuleId).map((chunk) => [normalizeModuleId(chunk.facadeModuleId), chunk])
+  );
+  const withStaticImports = /* @__PURE__ */ __name((fileName, into) => {
+    if (into.has(fileName) || !byFile.has(fileName)) return into;
+    into.add(fileName);
+    for (const imported of byFile.get(fileName).imports ?? []) withStaticImports(imported, into);
+    return into;
+  }, "withStaticImports");
+  const runtimeChunks = options.runtimeModuleIds.map((id) => byModule.get(normalizeModuleId(id))).filter((chunk) => Boolean(chunk));
+  const entry = chunks.find((chunk) => chunk.isEntry && chunk.name === options.entryName);
+  if (!entry || runtimeChunks.length === 0) return null;
+  const runtime = withStaticImports(entry.fileName, /* @__PURE__ */ new Set());
+  for (const chunk of runtimeChunks) withStaticImports(chunk.fileName, runtime);
+  const files = [];
+  const indexOf = /* @__PURE__ */ new Map();
+  const index = /* @__PURE__ */ __name((fileName) => {
+    let value = indexOf.get(fileName);
+    if (value === void 0) {
+      value = files.push(fileName) - 1;
+      indexOf.set(fileName, value);
+    }
+    return value;
+  }, "index");
+  const pages = {};
+  const root = normalizeModuleId(path4.resolve(options.root));
+  for (const [moduleId, chunk] of byModule) {
+    if (!/\.mdx?$/.test(moduleId) || !moduleId.startsWith(`${root}/`)) continue;
+    const own = [...withStaticImports(chunk.fileName, /* @__PURE__ */ new Set())].filter(
+      (fileName) => !runtime.has(fileName)
+    );
+    pages[moduleId.slice(root.length)] = own.map(index);
+  }
+  return { files, runtime: [...runtime].map(index), pages };
+}
+__name(collectFarmDocsModulePreloads, "collectFarmDocsModulePreloads");
+function createFarmDocsModulePreloadPlugin(options) {
+  let runtimeModuleIds = [];
+  return {
+    name: "farm-docs-module-preloads",
+    async buildStart() {
+      const resolved = await Promise.all(
+        options.modules.map((specifier) => this.resolve(specifier, options.importer))
+      );
+      runtimeModuleIds = resolved.filter((value) => value !== null).map((value) => value.id);
+    },
+    async generateBundle(_output, bundle) {
+      const manifest = collectFarmDocsModulePreloads(bundle, {
+        root: options.root,
+        entryName: options.entryName,
+        runtimeModuleIds
+      });
+      await fs2.mkdir(options.buildDir, { recursive: true });
+      await fs2.writeFile(
+        path4.join(options.buildDir, FARM_DOCS_MODULE_PRELOADS_FILE),
+        JSON.stringify(manifest)
+      );
+    }
+  };
+}
+__name(createFarmDocsModulePreloadPlugin, "createFarmDocsModulePreloadPlugin");
+async function readFarmDocsModulePreloads(buildDir) {
+  try {
+    return JSON.parse(
+      await fs2.readFile(path4.join(buildDir, FARM_DOCS_MODULE_PRELOADS_FILE), "utf8")
+    );
+  } catch {
+    return null;
+  }
+}
+__name(readFarmDocsModulePreloads, "readFarmDocsModulePreloads");
+function encodeFarmDocsModulePreloads(manifest) {
+  return JSON.stringify(JSON.stringify(manifest)).slice(1, -1).replace(/'/g, "\\u0027").replace(/`/g, "\\u0060").replace(/\$/g, "\\u0024").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+__name(encodeFarmDocsModulePreloads, "encodeFarmDocsModulePreloads");
+
+// src/route-runtime-manifest.ts
+import path5 from "path";
 var FARM_ROUTE_RUNTIME_MANIFEST = "route-runtime-manifest.json";
 async function createFarmRouteRuntimeManifest(options) {
-  const root = path3.resolve(options.root || options.config.root || process.cwd());
+  const root = path5.resolve(options.root || options.config.root || process.cwd());
   const routes = [];
   for (const [pattern, entry] of options.routeManager.getRoutes()) {
     const routeModule = await options.routeManager.loadRouteModule(entry.modulePath);
@@ -522,10 +704,10 @@ async function createFarmRouteRuntimeManifest(options) {
 }
 __name(createFarmRouteRuntimeManifest, "createFarmRouteRuntimeManifest");
 async function writeFarmRouteRuntimeManifest(directory, manifest) {
-  const fs = await import("fs/promises");
-  const manifestPath = path3.join(directory, FARM_ROUTE_RUNTIME_MANIFEST);
-  await fs.mkdir(directory, { recursive: true });
-  await fs.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}
+  const fs3 = await import("fs/promises");
+  const manifestPath = path5.join(directory, FARM_ROUTE_RUNTIME_MANIFEST);
+  await fs3.mkdir(directory, { recursive: true });
+  await fs3.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}
 `);
   return manifestPath;
 }
@@ -563,14 +745,14 @@ function normalizeManifestSource(root, modulePath) {
   const queryIndex = modulePath.indexOf("?");
   const filePath = queryIndex === -1 ? modulePath : modulePath.slice(0, queryIndex);
   const query = queryIndex === -1 ? "" : modulePath.slice(queryIndex);
-  const relativePath = path3.isAbsolute(filePath) ? path3.relative(root, filePath) : filePath;
+  const relativePath = path5.isAbsolute(filePath) ? path5.relative(root, filePath) : filePath;
   return `${relativePath.replace(/\\/g, "/")}${query}`;
 }
 __name(normalizeManifestSource, "normalizeManifestSource");
 
 // src/nitro/vercel-route-runtime.ts
-import path4 from "path";
-async function createFarmVercelRouteRuntimeFunctions(outputDir, manifest, fs, basePath = "/") {
+import path6 from "path";
+async function createFarmVercelRouteRuntimeFunctions(outputDir, manifest, fs3, basePath = "/") {
   const dynamicRoutes = manifest.routes.filter(
     (route) => route.rendering === "dynamic" && route.runtime !== "edge"
   );
@@ -589,8 +771,8 @@ async function createFarmVercelRouteRuntimeFunctions(outputDir, manifest, fs, ba
     group.routes.push(route);
     groups.set(key, group);
   }
-  const functionsDir = path4.join(outputDir, "functions");
-  const baseFunctionDir = path4.join(functionsDir, "__nitro.func");
+  const functionsDir = path6.join(outputDir, "functions");
+  const baseFunctionDir = path6.join(functionsDir, "__nitro.func");
   const destinations = /* @__PURE__ */ new Map();
   let groupIndex = 0;
   for (const [key, group] of groups) {
@@ -600,9 +782,9 @@ async function createFarmVercelRouteRuntimeFunctions(outputDir, manifest, fs, ba
     }
     groupIndex += 1;
     const functionName = `__farm_runtime_${groupIndex}`;
-    const functionDir = path4.join(functionsDir, `${functionName}.func`);
-    await fs.cp(baseFunctionDir, functionDir, { recursive: true, force: true });
-    await configureVercelFunction(functionDir, group.config, fs);
+    const functionDir = path6.join(functionsDir, `${functionName}.func`);
+    await fs3.cp(baseFunctionDir, functionDir, { recursive: true, force: true });
+    await configureVercelFunction(functionDir, group.config, fs3);
     destinations.set(key, `/${functionName}`);
   }
   const routes = [];
@@ -651,15 +833,15 @@ function farmRoutePatternToVercelSource(pattern, basePath = "/") {
   return source === "/" ? normalizedBasePath : `${normalizedBasePath}${source}`;
 }
 __name(farmRoutePatternToVercelSource, "farmRoutePatternToVercelSource");
-async function configureVercelFunction(functionDir, config, fs) {
-  const configPath = path4.join(functionDir, ".vc-config.json");
-  const current = JSON.parse(await fs.readFile(configPath, "utf8"));
+async function configureVercelFunction(functionDir, config, fs3) {
+  const configPath = path6.join(functionDir, ".vc-config.json");
+  const current = JSON.parse(await fs3.readFile(configPath, "utf8"));
   const next = {
     ...current,
     ...config.regions?.length ? { regions: config.regions } : {},
     ...config.maxDuration ? { maxDuration: config.maxDuration } : {}
   };
-  await fs.writeFile(configPath, `${JSON.stringify(next, null, 2)}
+  await fs3.writeFile(configPath, `${JSON.stringify(next, null, 2)}
 `);
 }
 __name(configureVercelFunction, "configureVercelFunction");
@@ -736,10 +918,10 @@ __name(buildFarmVercelRoutes, "buildFarmVercelRoutes");
 
 // src/nitro/netlify-entry.ts
 import { existsSync } from "fs";
-import path5 from "path";
+import path7 from "path";
 function resolveNitroNetlifyEntry(nitroRuntimeEntry) {
-  const entry = path5.join(
-    path5.dirname(nitroRuntimeEntry),
+  const entry = path7.join(
+    path7.dirname(nitroRuntimeEntry),
     "..",
     "presets",
     "netlify",
@@ -751,7 +933,7 @@ function resolveNitroNetlifyEntry(nitroRuntimeEntry) {
       `[Farm.js] Could not find Nitro's Netlify function entry at ${entry}. Farm wraps it so private responses are never cached by Netlify's CDN; reinstall dependencies or report the installed Nitro version.`
     );
   }
-  return entry.split(path5.sep).join("/");
+  return entry.split(path7.sep).join("/");
 }
 __name(resolveNitroNetlifyEntry, "resolveNitroNetlifyEntry");
 function createFarmNetlifyEntry(options) {
@@ -759,15 +941,32 @@ function createFarmNetlifyEntry(options) {
 import nitroNetlifyHandler from ${JSON.stringify(options.nitroNetlifyEntry)};
 
 const PRIVATE_CACHE_DIRECTIVE = /(?:^|,)\\s*(?:private|no-store)\\s*(?:[,=]|$)/i;
+const CREDENTIAL_VARY = /(?:^|,)\\s*(?:\\*|cookie|authorization)\\s*(?:,|$)/i;
+// What Nitro's entry sets when the response has no Cache-Control of its own.
+const NITRO_DEFAULT_CACHE_CONTROL = "public, max-age=0, must-revalidate";
+
+function isSharedCacheable(request, response) {
+  return (
+    response.status === 200 &&
+    !request.headers.has("cookie") &&
+    !request.headers.has("authorization") &&
+    !response.headers.has("set-cookie") &&
+    !PRIVATE_CACHE_DIRECTIVE.test(response.headers.get("cache-control") || "") &&
+    !CREDENTIAL_VARY.test(response.headers.get("vary") || "")
+  );
+}
 
 export default async function farmNetlifyHandler(request, context) {
   const response = await nitroNetlifyHandler(request, context);
   if (
     response &&
     response.headers.has("netlify-cdn-cache-control") &&
-    PRIVATE_CACHE_DIRECTIVE.test(response.headers.get("cache-control") || "")
+    !isSharedCacheable(request, response)
   ) {
     response.headers.delete("netlify-cdn-cache-control");
+    if (response.headers.get("cache-control") === NITRO_DEFAULT_CACHE_CONTROL) {
+      response.headers.set("cache-control", "private, no-store");
+    }
   }
   return response;
 }
@@ -775,278 +974,6 @@ export default async function farmNetlifyHandler(request, context) {
 }
 __name(createFarmNetlifyEntry, "createFarmNetlifyEntry");
 
-// src/nitro/node-server-entry.ts
-var FARM_NODE_ENV_MODULE_FILE = "farm-node-env.mjs";
-var FARM_NODE_ENV_MODULE_SOURCE = `if (!process.env.NODE_ENV) process.env.NODE_ENV = "production";
-`;
-function createFarmNodeServerEntry(options) {
-  const serverConfig = JSON.stringify(options.server);
-  const nitroEntryImport = `./${options.nitroEntryFile.replace(/^\.\//, "")}`;
-  return `
-import "./${FARM_NODE_ENV_MODULE_FILE}";
-import "#nitro/virtual/polyfills";
-import { NodeRequest, serve } from ${JSON.stringify(options.nodeAdapterModule)};
-import wsAdapter from ${JSON.stringify(options.websocketAdapterModule)};
-import { resolveWebsocketHooks, useNitroApp, useNitroHooks } from "#nitro/runtime/app";
-import { useRuntimeConfig } from "#nitro/runtime/runtime-config";
-import { trapUnhandledErrors } from "#nitro/runtime/error/hooks";
-import { setupCloseHooks } from "#nitro/runtime/shutdown";
-import { startScheduleRunner } from "#nitro/runtime/task";
-import { tracingSrvxPlugins } from "#nitro/virtual/tracing";
-import { farmProductionLifecycle } from ${JSON.stringify(nitroEntryImport)};
-
-const farmServerConfig = ${serverConfig};
-if (!process.env.NITRO_SHUTDOWN_TIMEOUT) {
-  process.env.NITRO_SHUTDOWN_TIMEOUT = String(farmServerConfig.gracefulShutdownTimeout);
-}
-const shutdownConfig = {
-  disabled: Boolean(process.env.NITRO_SHUTDOWN_DISABLED),
-  signals: (process.env.NITRO_SHUTDOWN_SIGNALS || "SIGTERM SIGINT")
-    .split(" ")
-    .map((signal) => signal.trim())
-    .filter(Boolean),
-  timeout: Number.parseInt(process.env.NITRO_SHUTDOWN_TIMEOUT || "", 10) || 30000,
-  forceExit: !process.env.NITRO_SHUTDOWN_NO_FORCE_EXIT,
-};
-
-const nitroApp = useNitroApp();
-useNitroHooks().hook("close", async () => {
-  try {
-    await farmProductionLifecycle.close("production-server-closed");
-  } catch (error) {
-    process.exitCode = 1;
-    throw error;
-  }
-});
-
-let startupSignal;
-let resolveStartupSignal;
-const startupSignalPromise = new Promise((resolve) => {
-  resolveStartupSignal = resolve;
-});
-const startupSignalListeners = new Map();
-if (!shutdownConfig.disabled) {
-  for (const signal of shutdownConfig.signals) {
-    const listener = (receivedSignal) => {
-      if (!startupSignal) {
-        startupSignal = receivedSignal;
-        resolveStartupSignal(receivedSignal);
-      }
-      farmProductionLifecycle.beginDrain(receivedSignal);
-    };
-    startupSignalListeners.set(signal, listener);
-    process.once(signal, listener);
-  }
-}
-
-try {
-  await Promise.race([
-    Promise.resolve().then(() => farmProductionLifecycle.start()),
-    startupSignalPromise,
-  ]);
-} catch (error) {
-  await farmProductionLifecycle.close("production-start-failed").catch((closeError) => {
-    console.error("[Farm] Runtime cleanup after startup failure failed:", closeError);
-  });
-  throw error;
-} finally {
-  for (const [signal, listener] of startupSignalListeners) {
-    process.removeListener(signal, listener);
-  }
-}
-
-if (startupSignal) {
-  let startupCloseTimer;
-  const startupCloseCompleted = await Promise.race([
-    Promise.resolve()
-      .then(() => farmProductionLifecycle.close(startupSignal))
-      .then(
-        () => true,
-        (error) => {
-          console.error("[Farm] Runtime shutdown during startup failed:", error);
-          process.exitCode = 1;
-          return true;
-        },
-      ),
-    new Promise((resolve) => {
-      startupCloseTimer = setTimeout(() => resolve(false), farmServerConfig.gracefulShutdownTimeout);
-    }),
-  ]);
-  clearTimeout(startupCloseTimer);
-  if (!startupCloseCompleted) {
-    console.warn("[Farm] Runtime startup did not settle before shutdown; forcing cleanup");
-    let forcedCloseTimer;
-    const forcedCloseCompleted = await Promise.race([
-      Promise.resolve()
-        .then(() => farmProductionLifecycle.forceClose(startupSignal))
-        .then(
-          () => true,
-          (error) => {
-            console.error("[Farm] Forced runtime shutdown during startup failed:", error);
-            process.exitCode = 1;
-            return true;
-          },
-        ),
-      new Promise((resolve) => {
-        forcedCloseTimer = setTimeout(
-          () => resolve(false),
-          farmServerConfig.gracefulShutdownTimeout,
-        );
-      }),
-    ]);
-    clearTimeout(forcedCloseTimer);
-    if (!forcedCloseCompleted) {
-      console.error("[Farm] Forced runtime shutdown during startup timed out");
-      process.exitCode = 1;
-    }
-  }
-  process.exit(process.exitCode || 0);
-}
-
-const cert = process.env.NITRO_SSL_CERT;
-const key = process.env.NITRO_SSL_KEY;
-const configuredPort = Number(process.env.NITRO_PORT || process.env.PORT);
-const port = Number.isFinite(configuredPort) && configuredPort > 0 ? configuredPort : 3000;
-const host = process.env.NITRO_HOST || process.env.HOST;
-const socketPath = process.env.NITRO_UNIX_SOCKET;
-const server = serve({
-  manual: true,
-  silent: true,
-  gracefulShutdown: false,
-  port,
-  hostname: host,
-  node: socketPath ? { path: socketPath } : undefined,
-  tls: cert && key ? { cert, key } : undefined,
-  fetch: nitroApp.fetch,
-  plugins: [...tracingSrvxPlugins],
-});
-const nodeServer = server.node?.server;
-if (!nodeServer) throw new Error("[Farm] Nitro did not create a Node server");
-
-nodeServer.headersTimeout = farmServerConfig.headersTimeout;
-nodeServer.requestTimeout = farmServerConfig.requestTimeout;
-nodeServer.keepAliveTimeout = farmServerConfig.keepAliveTimeout;
-
-let isShuttingDown = false;
-nodeServer.on("request", (_request, response) => {
-  response.once("finish", () => {
-    if (isShuttingDown) nodeServer.closeIdleConnections?.();
-  });
-});
-
-if (import.meta._websocket) {
-  const { handleUpgrade } = wsAdapter({ resolve: resolveWebsocketHooks });
-  nodeServer.on("upgrade", (request, socket, head) => {
-    handleUpgrade(
-      request,
-      socket,
-      head,
-      new NodeRequest({ req: request, upgrade: { socket, head } }),
-    );
-  });
-}
-
-setupCloseHooks(server);
-trapUnhandledErrors();
-
-let shutdownPromise;
-async function shutdown(signal) {
-  isShuttingDown = true;
-  farmProductionLifecycle.beginDrain(signal);
-
-  const gracefulClose = server.close().then(
-    () => true,
-    (error) => {
-      console.error("[Farm] Runtime shutdown failed:", error);
-      process.exitCode = 1;
-      return true;
-    },
-  );
-  nodeServer.closeIdleConnections?.();
-  let gracefulTimer;
-  const gracefullyClosed = await Promise.race([
-    gracefulClose,
-    new Promise((resolve) => {
-      gracefulTimer = setTimeout(() => resolve(false), shutdownConfig.timeout);
-    }),
-  ]);
-  clearTimeout(gracefulTimer);
-
-  if (!gracefullyClosed) {
-    console.warn("[Farm] Graceful shutdown timed out; forcing cleanup");
-    void server.close(true).catch((error) => {
-      console.error("[Farm] Forced server shutdown failed:", error);
-      process.exitCode = 1;
-    });
-
-    let forceTimer;
-    const forceClosed = await Promise.race([
-      Promise.resolve()
-        .then(() => farmProductionLifecycle.forceClose("production-server-closed"))
-        .then(
-          () => true,
-          (error) => {
-            console.error("[Farm] Forced runtime shutdown failed:", error);
-            process.exitCode = 1;
-            return true;
-          },
-        ),
-      new Promise((resolve) => {
-        forceTimer = setTimeout(() => resolve(false), shutdownConfig.timeout);
-      }),
-    ]);
-    clearTimeout(forceTimer);
-    if (!forceClosed) {
-      console.error("[Farm] Forced runtime shutdown timed out");
-      process.exitCode = 1;
-    }
-  }
-
-  if (shutdownConfig.forceExit) process.exit(process.exitCode || 0);
-}
-
-if (!shutdownConfig.disabled) {
-  for (const signal of shutdownConfig.signals) {
-    process.once(signal, (receivedSignal) => {
-      shutdownPromise ||= shutdown(receivedSignal);
-    });
-  }
-}
-
-try {
-  await server.serve();
-  const protocol = cert && key ? "https" : "http";
-  const addressInfo = nodeServer.address();
-  if (typeof addressInfo === "string") {
-    console.log(\`Listening on unix socket \${addressInfo}\`);
-  } else if (addressInfo) {
-    const configuredBaseURL = useRuntimeConfig().app.baseURL || "";
-    const baseURL = configuredBaseURL.endsWith("/")
-      ? configuredBaseURL.slice(0, -1)
-      : configuredBaseURL;
-    const address = addressInfo.family === "IPv6"
-      ? \`[\${addressInfo.address}]\`
-      : addressInfo.address;
-    console.log(\`Listening on \${protocol}://\${address}:\${addressInfo.port}\${baseURL}\`);
-  }
-} catch (error) {
-  console.error(error);
-  process.exitCode = 1;
-  await farmProductionLifecycle.close("production-listen-error").catch((closeError) => {
-    console.error("[Farm] Runtime cleanup after listen failure failed:", closeError);
-  });
-  throw error;
-}
-
-if (import.meta._tasks) {
-  startScheduleRunner({ waitUntil: server.waitUntil });
-}
-
-export default {};
-  `.trim();
-}
-__name(createFarmNodeServerEntry, "createFarmNodeServerEntry");
-
 // src/nitro/universal-build.ts
 function preloadFarmNitroBuilder() {
   return import("nitro/builder").then(
@@ -1056,18 +983,18 @@ function preloadFarmNitroBuilder() {
 }
 __name(preloadFarmNitroBuilder, "preloadFarmNitroBuilder");
 var _filename = typeof import.meta.url !== "undefined" ? fileURLToPath(import.meta.url) : "";
-var _dirname = path6.dirname(_filename);
+var _dirname = path8.dirname(_filename);
 function findFarmCoreRoot(from) {
-  let dir = path6.dirname(from);
-  while (dir !== path6.dirname(dir)) {
-    const manifest = path6.join(dir, "package.json");
+  let dir = path8.dirname(from);
+  while (dir !== path8.dirname(dir)) {
+    const manifest = path8.join(dir, "package.json");
     if (existsSync2(manifest)) {
       try {
         if (JSON.parse(readFileSync(manifest, "utf8")).name === "@farm.js/core") return dir;
       } catch {
       }
     }
-    dir = path6.dirname(dir);
+    dir = path8.dirname(dir);
   }
   return null;
 }
@@ -1079,16 +1006,16 @@ function toModulePath(file) {
 }
 __name(toModulePath, "toModulePath");
 function findInstalledPackageDir(name, from) {
-  for (let dir = from; ; dir = path6.dirname(dir)) {
-    const candidate = path6.join(dir, "node_modules", name);
-    if (existsSync2(path6.join(candidate, "package.json"))) {
+  for (let dir = from; ; dir = path8.dirname(dir)) {
+    const candidate = path8.join(dir, "node_modules", name);
+    if (existsSync2(path8.join(candidate, "package.json"))) {
       try {
         return realpathSync(candidate);
       } catch {
         return null;
       }
     }
-    if (dir === path6.dirname(dir)) return null;
+    if (dir === path8.dirname(dir)) return null;
   }
 }
 __name(findInstalledPackageDir, "findInstalledPackageDir");
@@ -1100,7 +1027,7 @@ function collectFarmDependencyDirs(root) {
     seen.add(dir);
     let manifest;
     try {
-      manifest = JSON.parse(readFileSync(path6.join(dir, "package.json"), "utf8"));
+      manifest = JSON.parse(readFileSync(path8.join(dir, "package.json"), "utf8"));
     } catch {
       return;
     }
@@ -1111,7 +1038,7 @@ function collectFarmDependencyDirs(root) {
   if (farmCoreRoot) visit(realpathSync(farmCoreRoot));
   queue.push({ name: "@farm.js/core", from: root });
   try {
-    const manifest = JSON.parse(readFileSync(path6.join(root, "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync(path8.join(root, "package.json"), "utf8"));
     for (const field of ["dependencies", "devDependencies"]) {
       for (const name of Object.keys(manifest[field] ?? {})) {
         if (name.startsWith("@farm.js/")) queue.push({ name, from: root });
@@ -1178,15 +1105,15 @@ var FARM_SSR_PACKAGE_IMPORT = "#farm-ssr-entry";
 var FARM_SSR_OUTPUT_DIR = "farm-ssr";
 var FARM_CLIENT_BUILD_TARGET = ["es2020", "edge88", "firefox78", "chrome87", "safari14"];
 function resolveNitroRuntimeDependency(root, specifier) {
-  return createRequire(resolveNitroPackageEntry(root)).resolve(specifier).split(path6.sep).join("/");
+  return createRequire(resolveNitroPackageEntry(root)).resolve(specifier).split(path8.sep).join("/");
 }
 __name(resolveNitroRuntimeDependency, "resolveNitroRuntimeDependency");
 function resolveNitroInternalRuntimeAliases(root) {
-  const runtimeDir = path6.dirname(resolveNitroPackageEntry(root));
+  const runtimeDir = path8.dirname(resolveNitroPackageEntry(root));
   return Object.fromEntries(
     ["app", "error/hooks", "runtime-config", "shutdown", "task"].map((moduleName) => [
       `#nitro/runtime/${moduleName}`,
-      path6.join(runtimeDir, "internal", `${moduleName}.mjs`).split(path6.sep).join("/")
+      path8.join(runtimeDir, "internal", `${moduleName}.mjs`).split(path8.sep).join("/")
     ])
   );
 }
@@ -1197,7 +1124,7 @@ function createPrerenderRuntimeResolverPlugin(root, resolveNitroEntry = resolveN
     name: "farm-prerender-runtime-resolver",
     async resolveId(id, _importer, options) {
       if (options.custom?.farmPrerenderRuntimeResolve) return null;
-      if (id.startsWith("\0") || id.startsWith(".") || id.startsWith("#") || id.startsWith("virtual:") || path6.isAbsolute(id) || NODE_BUILTIN_MODULES.has(id)) {
+      if (id.startsWith("\0") || id.startsWith(".") || id.startsWith("#") || id.startsWith("virtual:") || path8.isAbsolute(id) || NODE_BUILTIN_MODULES.has(id)) {
         return null;
       }
       if (nitroEntry === void 0) {
@@ -1218,7 +1145,7 @@ function createPrerenderRuntimeResolverPlugin(root, resolveNitroEntry = resolveN
 }
 __name(createPrerenderRuntimeResolverPlugin, "createPrerenderRuntimeResolverPlugin");
 function resolveNitroPackageEntry(root) {
-  const projectRequire = createRequire(path6.join(root, "package.json"));
+  const projectRequire = createRequire(path8.join(root, "package.json"));
   let runtimeRequire = projectRequire;
   try {
     runtimeRequire = createRequire(projectRequire.resolve("@farm.js/core"));
@@ -1293,7 +1220,7 @@ function createFarmReactWebServerAlias(hasEdgeBuild) {
 __name(createFarmReactWebServerAlias, "createFarmReactWebServerAlias");
 function hasReactDomEdgeServerBuild(root) {
   try {
-    createRequire(path6.join(root, "package.json")).resolve("react-dom/server.edge");
+    createRequire(path8.join(root, "package.json")).resolve("react-dom/server.edge");
     return true;
   } catch {
     return false;
@@ -1351,7 +1278,7 @@ function createMetadataImageWasmPlugin() {
         return null;
       }
       const requestPath = source.slice(0, -"?module".length);
-      const resolvedPath = path6.isAbsolute(requestPath) ? requestPath : path6.resolve(path6.dirname(importer.split("?", 1)[0]), requestPath);
+      const resolvedPath = path8.isAbsolute(requestPath) ? requestPath : path8.resolve(path8.dirname(importer.split("?", 1)[0]), requestPath);
       return `${FARM_METADATA_IMAGE_WASM_PREFIX}${resolvedPath}`;
     },
     load(id) {
@@ -1377,11 +1304,11 @@ function collectSSRExternalPackages(ssrBundle) {
     for (const importId of [...output.imports, ...output.dynamicImports]) {
       const normalizedImportId = importId.replace(/\\/g, "/");
       const normalizedId = normalizedImportId.replace(/^\.\//, "");
-      const resolvedRelativeId = normalizedImportId.startsWith("./") || normalizedImportId.startsWith("../") ? path6.posix.normalize(path6.posix.join(path6.posix.dirname(fileName), normalizedImportId)) : null;
+      const resolvedRelativeId = normalizedImportId.startsWith("./") || normalizedImportId.startsWith("../") ? path8.posix.normalize(path8.posix.join(path8.posix.dirname(fileName), normalizedImportId)) : null;
       if (emittedFiles.has(normalizedId) || resolvedRelativeId !== null && emittedFiles.has(resolvedRelativeId) || NODE_BUILTIN_MODULES.has(importId) || importId.startsWith("node:")) {
         continue;
       }
-      if (path6.isAbsolute(importId) || /^[A-Za-z]:[\\/]/.test(importId) || importId.startsWith("#") || importId.startsWith("\0")) {
+      if (path8.isAbsolute(importId) || /^[A-Za-z]:[\\/]/.test(importId) || importId.startsWith("#") || importId.startsWith("\0")) {
         externalPackages.add(importId);
         continue;
       }
@@ -1394,15 +1321,15 @@ function collectSSRExternalPackages(ssrBundle) {
 }
 __name(collectSSRExternalPackages, "collectSSRExternalPackages");
 function createExternalSSRBundlePlugin(nitroEntryPath, ssrOutputDir, ssrEntryFile) {
-  const resolvedNitroEntry = path6.resolve(nitroEntryPath);
-  const resolvedSSREntry = path6.resolve(ssrOutputDir, ssrEntryFile);
+  const resolvedNitroEntry = path8.resolve(nitroEntryPath);
+  const resolvedSSREntry = path8.resolve(ssrOutputDir, ssrEntryFile);
   return {
     name: "farm-externalize-prebuilt-ssr",
     resolveId(source, importer) {
-      if (!importer || path6.resolve(importer) !== resolvedNitroEntry) {
+      if (!importer || path8.resolve(importer) !== resolvedNitroEntry) {
         return null;
       }
-      const resolvedImport = path6.resolve(path6.dirname(importer), source);
+      const resolvedImport = path8.resolve(path8.dirname(importer), source);
       if (resolvedImport !== resolvedSSREntry) return null;
       return { id: FARM_SSR_PACKAGE_IMPORT, external: true };
     }
@@ -1530,13 +1457,13 @@ function resolveBuildDocsContentDir(config, root) {
   if (!config.docs?.enabled) return null;
   const configuredContentDir = config.docs.contentDir || config.docs.config.contentDir;
   if (typeof configuredContentDir === "string" && configuredContentDir.trim()) {
-    const contentDir = path6.isAbsolute(configuredContentDir) ? configuredContentDir : path6.join(root, configuredContentDir);
+    const contentDir = path8.isAbsolute(configuredContentDir) ? configuredContentDir : path8.join(root, configuredContentDir);
     return existsSync2(contentDir) ? contentDir : null;
   }
   const entryDir = config.docs.config.entry || trimSlashes(config.docs.entry) || "docs";
-  const appDocsDir = path6.join(root, config.srcDir || "src", "app", entryDir);
+  const appDocsDir = path8.join(root, config.srcDir || "src", "app", entryDir);
   if (existsSync2(appDocsDir)) return appDocsDir;
-  const rootDocsDir = path6.join(root, entryDir);
+  const rootDocsDir = path8.join(root, entryDir);
   return existsSync2(rootDocsDir) ? rootDocsDir : null;
 }
 __name(resolveBuildDocsContentDir, "resolveBuildDocsContentDir");
@@ -1554,7 +1481,7 @@ function hasProjectPostcssConfig(root) {
     ".postcssrc.mjs",
     ".postcssrc.ts"
   ];
-  const projectRequire = createRequire(path6.join(root, "package.json"));
+  const projectRequire = createRequire(path8.join(root, "package.json"));
   return candidates.some((file) => {
     try {
       projectRequire.resolve(`./${file}`);
@@ -1566,7 +1493,7 @@ function hasProjectPostcssConfig(root) {
 }
 __name(hasProjectPostcssConfig, "hasProjectPostcssConfig");
 async function findFarmConfigPath(root) {
-  const fs = await import("fs/promises");
+  const fs3 = await import("fs/promises");
   const candidates = [
     "farm.config.ts",
     "farm.config.mts",
@@ -1578,9 +1505,9 @@ async function findFarmConfigPath(root) {
     "config.mjs"
   ];
   for (const candidate of candidates) {
-    const resolvedPath = path6.join(root, candidate);
+    const resolvedPath = path8.join(root, candidate);
     try {
-      await fs.access(resolvedPath);
+      await fs3.access(resolvedPath);
       return resolvedPath;
     } catch {
     }
@@ -1588,15 +1515,6 @@ async function findFarmConfigPath(root) {
   return null;
 }
 __name(findFarmConfigPath, "findFarmConfigPath");
-function hasFarmMiddlewareConfig(config) {
-  if (!config) return false;
-  if (Array.isArray(config)) return config.length > 0;
-  const configRecord = config;
-  return Boolean(
-    configRecord.matcher || configRecord.exclude || configRecord.runtime || configRecord.handler || Array.isArray(configRecord.handlers) && configRecord.handlers.length > 0
-  );
-}
-__name(hasFarmMiddlewareConfig, "hasFarmMiddlewareConfig");
 function hasFarmServerRuntimePlugins(config) {
   return (config.plugins || []).some((plugin) => {
     if (getFarmIntegrationPluginServerRuntime(plugin) === false) return false;
@@ -1617,13 +1535,13 @@ function farmServerRuntimePluginsMayHandlePath(config, pathname) {
 }
 __name(farmServerRuntimePluginsMayHandlePath, "farmServerRuntimePluginsMayHandlePath");
 async function discoverMiddlewareRoutes(appDir) {
-  const fs = await import("fs/promises");
+  const fs3 = await import("fs/promises");
   const appDirs = Array.isArray(appDir) ? [...appDir] : [appDir];
   const routes = /* @__PURE__ */ new Map();
   async function walk(dir, routePath, directory, discovered) {
     let entries;
     try {
-      entries = await fs.readdir(dir, { withFileTypes: true });
+      entries = await fs3.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -1634,7 +1552,7 @@ async function discoverMiddlewareRoutes(appDir) {
       discovered.push({
         path: routePath,
         directory,
-        filePath: path6.join(dir, middlewareFile.name)
+        filePath: path8.join(dir, middlewareFile.name)
       });
     }
     for (const entry of entries) {
@@ -1642,7 +1560,7 @@ async function discoverMiddlewareRoutes(appDir) {
         continue;
       }
       await walk(
-        path6.join(dir, entry.name),
+        path8.join(dir, entry.name),
         appendMiddlewareRoutePath(routePath, entry.name),
         appendMiddlewareDirectory(directory, entry.name),
         discovered
@@ -1719,21 +1637,21 @@ async function buildUniversal(config, routeManager, apiRouteManager, serverRende
       })
     );
     logger.info(`\u{1F4CB} Found ${pageRoutes.length} page routes`);
-    const fs = await import("fs/promises");
+    const fs3 = await import("fs/promises");
     const layoutRoutes = [];
-    const appDir = path6.join(root, srcDir, "app");
+    const appDir = path8.join(root, srcDir, "app");
     async function findLayoutsForClient(dir, routePrefix = "/") {
       try {
-        const entries = await fs.readdir(dir, { withFileTypes: true });
+        const entries = await fs3.readdir(dir, { withFileTypes: true });
         for (const entry of entries) {
           if (entry.isFile() && entry.name.match(/^layout\.(tsx?|jsx?|vue|svelte)$/)) {
             layoutRoutes.push({
               pattern: routePrefix,
-              modulePath: path6.join(dir, entry.name)
+              modulePath: path8.join(dir, entry.name)
             });
           } else if (entry.isDirectory() && !entry.name.startsWith(".") && !entry.name.startsWith("_")) {
             const childPrefix = routePrefix === "/" ? `/${entry.name}` : `${routePrefix}/${entry.name}`;
-            await findLayoutsForClient(path6.join(dir, entry.name), childPrefix);
+            await findLayoutsForClient(path8.join(dir, entry.name), childPrefix);
           }
         }
       } catch {
@@ -1750,7 +1668,7 @@ async function buildUniversal(config, routeManager, apiRouteManager, serverRende
     logger.info(`\u{1F4CB} Found ${pageRoutes.length} page routes and ${layoutRoutes.length} layouts`);
     const isolatedClientBoundaryModules = routeManager.getIsolatedClientBoundaryModules(root);
     const hydrationPlanCache = /* @__PURE__ */ new Map();
-    const clientOutputDir = path6.join(root, distDir, "client");
+    const clientOutputDir = path8.join(root, distDir, "client");
     const [productionViteResult] = await productionViteResultPromise;
     if (productionViteResult.status === "rejected") {
       await routeRuntimeManifestResultPromise;
@@ -1859,10 +1777,10 @@ async function buildUniversal(config, routeManager, apiRouteManager, serverRende
       lifecyclePluginManager
     );
     const runtimeManifestPath = await writeFarmRouteRuntimeManifest(
-      path6.join(root, distDir),
+      path8.join(root, distDir),
       routeRuntimeManifest
     );
-    logger.info(`\u{1F4CB} Route runtime manifest: ${path6.relative(root, runtimeManifestPath)}`);
+    logger.info(`\u{1F4CB} Route runtime manifest: ${path8.relative(root, runtimeManifestPath)}`);
   } catch (error) {
     if (lifecyclePluginManager) {
       await lifecyclePluginManager.runHookParallel("onError", {
@@ -1882,50 +1800,50 @@ async function buildUniversal(config, routeManager, apiRouteManager, serverRende
 }
 __name(buildUniversal, "buildUniversal");
 async function writeSSRAssetsToClient(bundle, outputDir) {
-  const fs = await import("fs/promises");
+  const fs3 = await import("fs/promises");
   for (const [fileName, output] of Object.entries(bundle)) {
     if (output.type !== "asset") continue;
     if (fileName === "farm-fonts.css") {
       await mergeBuiltFontCss(outputDir, output.source);
       continue;
     }
-    const filePath = path6.join(outputDir, fileName);
-    await fs.mkdir(path6.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, output.source);
+    const filePath = path8.join(outputDir, fileName);
+    await fs3.mkdir(path8.dirname(filePath), { recursive: true });
+    await fs3.writeFile(filePath, output.source);
   }
 }
 __name(writeSSRAssetsToClient, "writeSSRAssetsToClient");
 async function copyFarmDocsFontAssetsToClient(root, outputDir) {
-  const fs = await import("fs/promises");
+  const fs3 = await import("fs/promises");
   await Promise.all(
     resolveFarmDocsFontAssets(root).map(async ({ sourcePath, url }) => {
-      const targetPath = path6.join(outputDir, url.replace(/^\/+/, ""));
-      await fs.mkdir(path6.dirname(targetPath), { recursive: true });
-      await fs.copyFile(sourcePath, targetPath);
+      const targetPath = path8.join(outputDir, url.replace(/^\/+/, ""));
+      await fs3.mkdir(path8.dirname(targetPath), { recursive: true });
+      await fs3.copyFile(sourcePath, targetPath);
     })
   );
 }
 __name(copyFarmDocsFontAssetsToClient, "copyFarmDocsFontAssetsToClient");
 async function mergeBuiltFontCss(outputDir, fontCssSource) {
-  const fs = await import("fs/promises");
-  const fontCssPath = path6.join(outputDir, "farm-fonts.css");
+  const fs3 = await import("fs/promises");
+  const fontCssPath = path8.join(outputDir, "farm-fonts.css");
   let fontCss = fontCssSource;
   if (fontCss === void 0) {
     try {
-      fontCss = await fs.readFile(fontCssPath);
+      fontCss = await fs3.readFile(fontCssPath);
     } catch {
       return;
     }
   }
-  const clientCssPath = path6.join(outputDir, "farm-client.css");
+  const clientCssPath = path8.join(outputDir, "farm-client.css");
   let clientCss = "";
   try {
-    clientCss = await fs.readFile(clientCssPath, "utf8");
+    clientCss = await fs3.readFile(clientCssPath, "utf8");
   } catch {
   }
   const normalizedFontCss = typeof fontCss === "string" ? fontCss : Buffer.from(fontCss).toString("utf8");
-  await fs.writeFile(fontCssPath, normalizedFontCss);
-  await fs.writeFile(clientCssPath, mergeFarmFontCss(clientCss, normalizedFontCss));
+  await fs3.writeFile(fontCssPath, normalizedFontCss);
+  await fs3.writeFile(clientCssPath, mergeFarmFontCss(clientCss, normalizedFontCss));
 }
 __name(mergeBuiltFontCss, "mergeBuiltFontCss");
 var _IncompleteClientBuildOutputError = class _IncompleteClientBuildOutputError extends Error {
@@ -1937,28 +1855,28 @@ var _IncompleteClientBuildOutputError = class _IncompleteClientBuildOutputError
 __name(_IncompleteClientBuildOutputError, "IncompleteClientBuildOutputError");
 var IncompleteClientBuildOutputError = _IncompleteClientBuildOutputError;
 async function validateClientBuildOutput(root, srcDir, outputDir) {
-  const fs = await import("fs/promises");
+  const fs3 = await import("fs/promises");
   const fingerprinted = await findFingerprintedClientEntry(outputDir);
-  const clientEntryPath = path6.join(outputDir, fingerprinted ?? "farm-client.js");
+  const clientEntryPath = path8.join(outputDir, fingerprinted ?? "farm-client.js");
   let clientEntrySize = 0;
   try {
-    const clientEntry = await fs.stat(clientEntryPath);
+    const clientEntry = await fs3.stat(clientEntryPath);
     if (clientEntry.isFile()) clientEntrySize = clientEntry.size;
   } catch {
   }
   if (clientEntrySize === 0) {
     throw new IncompleteClientBuildOutputError("farm-client.js is missing or empty");
   }
-  const clientCssPath = path6.join(outputDir, "farm-client.css");
-  const globalsCssPath = path6.join(root, srcDir, "app", "globals.css");
+  const clientCssPath = path8.join(outputDir, "farm-client.css");
+  const globalsCssPath = path8.join(root, srcDir, "app", "globals.css");
   let expectsCss = false;
   try {
-    const globalsCss = await fs.readFile(globalsCssPath, "utf8");
+    const globalsCss = await fs3.readFile(globalsCssPath, "utf8");
     expectsCss = globalsCss.replace(/\/\*[\s\S]*?\*\//g, "").trim().length > 0;
   } catch {
   }
   try {
-    const clientCss = await fs.stat(clientCssPath);
+    const clientCss = await fs3.stat(clientCssPath);
     if (expectsCss && (!clientCss.isFile() || clientCss.size === 0)) {
       throw new IncompleteClientBuildOutputError("farm-client.css is empty");
     }
@@ -1967,12 +1885,12 @@ async function validateClientBuildOutput(root, srcDir, outputDir) {
     if (expectsCss) {
       throw new IncompleteClientBuildOutputError("farm-client.css is missing");
     }
-    await fs.writeFile(clientCssPath, "");
+    await fs3.writeFile(clientCssPath, "");
   }
 }
 __name(validateClientBuildOutput, "validateClientBuildOutput");
 function getCachedClientModuleHydrationPlan(modulePath, root, mode, cache, options = {}) {
-  const key = `${path6.resolve(root)}\0${mode}\0${options.asyncOwnerIslands === true}\0${path6.resolve(modulePath)}`;
+  const key = `${path8.resolve(root)}\0${mode}\0${options.asyncOwnerIslands === true}\0${path8.resolve(modulePath)}`;
   let plan = cache.get(key);
   if (!plan) {
     plan = getClientModuleHydrationPlan(modulePath, root, mode, options);
@@ -1985,7 +1903,7 @@ async function buildClient(productionVite, config, root, srcDir, outputDir, page
   const viteBuild = productionVite.build;
   const { farmPlugin, farmServerOnlyEntriesPlugin } = await import("./vite.mjs");
   const { PluginManager: PluginManager2 } = await import("./plugin.mjs");
-  const fs = await import("fs/promises");
+  const fs3 = await import("fs/promises");
   const pluginManager = new PluginManager2({
     config,
     isDev: false,
@@ -2211,10 +2129,10 @@ async function buildClient(productionVite, config, root, srcDir, outputDir, page
   logger.info(
     `\u{1F4F1} Total hydratable routes detected: ${clientPages.length} pages, ${clientLayouts.filter((layout) => layout.shouldHydrate || layout.hasIsolatedClientBoundaries).length} layouts, and ${clientRouteSlots.length} slots`
   );
-  const clientEntryRoot = path6.join(root, ".farm", "tmp");
-  await fs.mkdir(clientEntryRoot, { recursive: true });
-  const clientEntryDir = await fs.mkdtemp(path6.join(clientEntryRoot, "client-entry-"));
-  const clientEntryPath = path6.join(clientEntryDir, "farm-client-entry.tsx");
+  const clientEntryRoot = path8.join(root, ".farm", "tmp");
+  await fs3.mkdir(clientEntryRoot, { recursive: true });
+  const clientEntryDir = await fs3.mkdtemp(path8.join(clientEntryRoot, "client-entry-"));
+  const clientEntryPath = path8.join(clientEntryDir, "farm-client-entry.tsx");
   const clientHydrationCode = generateClientHydrationEntry(
     clientPages,
     clientLayouts,
@@ -2235,7 +2153,7 @@ async function buildClient(productionVite, config, root, srcDir, outputDir, page
     generateClientCachePersistenceCode(resolveFarmClientCacheAdapterEntry(root, config.cache)),
     adapterOwnsDocsRuntime ? getFarmDocsAdapterConfigModule(config.docs) : void 0
   );
-  await fs.writeFile(clientEntryPath, clientHydrationCode);
+  await fs3.writeFile(clientEntryPath, clientHydrationCode);
   const hasScopedPostcssConfig = hasProjectPostcssConfig(root);
   let postcssSearchPath;
   let tailwindVitePlugin = void 0;
@@ -2246,8 +2164,8 @@ async function buildClient(productionVite, config, root, srcDir, outputDir, page
   if (hasScopedPostcssConfig) {
     logger.info("\u{1F4E6} Using project PostCSS/Tailwind configuration");
   } else {
-    const postcssConfigPath = path6.join(clientEntryDir, "postcss.config.cjs");
-    await fs.writeFile(postcssConfigPath, "module.exports = { plugins: [] };\n");
+    const postcssConfigPath = path8.join(clientEntryDir, "postcss.config.cjs");
+    await fs3.writeFile(postcssConfigPath, "module.exports = { plugins: [] };\n");
     postcssSearchPath = clientEntryDir;
     tailwindVitePlugin = await loadTailwindVitePlugin({
       builder: productionVite.builder,
@@ -2319,6 +2237,23 @@ async function buildClient(productionVite, config, root, srcDir, outputDir, page
       },
       plugins: [
         createFarmThemeCssPlugin(config.theme, config.basePath),
+        createFarmClientModulePreloadPlugin({
+          root,
+          buildDir: path8.dirname(outputDir),
+          entryName: "farm-client"
+        }),
+        ...adapterOwnsDocsRuntime ? [
+          createFarmDocsModulePreloadPlugin({
+            root,
+            buildDir: path8.dirname(outputDir),
+            importer: clientEntryPath,
+            entryName: "farm-client",
+            modules: [
+              config.docs.adapter.react,
+              getFarmDocsAdapterConfigModule(config.docs)
+            ].filter((specifier) => Boolean(specifier))
+          })
+        ] : [],
         ...tailwindVitePlugin ? [tailwindVitePlugin] : [],
         ...rendererVitePlugins,
         ...config.vite.plugins || [],
@@ -2400,7 +2335,7 @@ async function buildClient(productionVite, config, root, srcDir, outputDir, page
     await validateClientBuildOutput(root, srcDir, outputDir);
   } finally {
     try {
-      await fs.rm(clientEntryDir, { recursive: true, force: true });
+      await fs3.rm(clientEntryDir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -2408,12 +2343,12 @@ async function buildClient(productionVite, config, root, srcDir, outputDir, page
 __name(buildClient, "buildClient");
 function toBakedMarkdownSourcePath(root, filePath) {
   if (!filePath) return "";
-  if (!path6.isAbsolute(filePath)) return filePath.split(path6.sep).join("/");
-  const relative = path6.relative(root, filePath);
-  if (!relative || relative.startsWith("..") || path6.isAbsolute(relative)) {
-    return path6.basename(filePath);
+  if (!path8.isAbsolute(filePath)) return filePath.split(path8.sep).join("/");
+  const relative = path8.relative(root, filePath);
+  if (!relative || relative.startsWith("..") || path8.isAbsolute(relative)) {
+    return path8.basename(filePath);
   }
-  return relative.split(path6.sep).join("/");
+  return relative.split(path8.sep).join("/");
 }
 __name(toBakedMarkdownSourcePath, "toBakedMarkdownSourcePath");
 function generateUniversalRouterStateRuntime() {
@@ -3170,19 +3105,21 @@ __farmConfigureApp(__farmAppSetup);` : `import React, { createRoot, hydrateRoot
     root,
     renderer.componentExtensions ?? []
   );
-  const globalsCssPath = path6.join(root, srcDir, "app", "globals.css");
+  const globalsCssPath = path8.join(root, srcDir, "app", "globals.css");
   const cssImport = existsSync2(globalsCssPath) ? `import ${JSON.stringify(toImportPath(globalsCssPath))};` : "";
   const layoutImportStatements = [];
   const layoutRegistrations = [];
+  const hydratingLayoutPatterns = layoutRoutes.filter((layout) => layout.shouldHydrate).map((layout) => layout.pattern);
   layoutRoutes.forEach((layout, index) => {
     const relativePath = toImportPath(layout.modulePath);
-    if (!layout.hasIsolatedClientBoundaries) {
+    const rendersOnClient = !layout.hasIsolatedClientBoundaries && hydratingLayoutPatterns.some((pattern) => layoutsCanCoverSamePage(layout.pattern, pattern));
+    if (rendersOnClient) {
       layoutImportStatements.push(`import Layout${index} from "${relativePath}";`);
     }
     const groupScope = getRouteGroupScope(layout.pattern);
     const groupFields = groupScope ? `, urlPattern: ${JSON.stringify(stripRouteGroups(layout.pattern))}, groupScope: ${JSON.stringify(groupScope)}` : "";
     layoutRegistrations.push(
-      `  { pattern: ${JSON.stringify(layout.pattern)}${groupFields}, Component: ${layout.hasIsolatedClientBoundaries ? "null" : `Layout${index}`}, shouldHydrate: ${JSON.stringify(layout.shouldHydrate)}, islandStrategy: ${JSON.stringify(layout.islandStrategy)} }`
+      `  { pattern: ${JSON.stringify(layout.pattern)}${groupFields}, Component: ${rendersOnClient ? `Layout${index}` : "null"}, shouldHydrate: ${JSON.stringify(layout.shouldHydrate)}, islandStrategy: ${JSON.stringify(layout.islandStrategy)} }`
     );
   });
   const layoutImports = layoutImportStatements.join("\n");
@@ -4642,7 +4579,7 @@ async function buildSSRInMemory(productionVite, config, root, routeManager, apiR
   const viteBuild = productionVite.build;
   const { farmPlugin, farmServerOnlyEntriesPlugin } = await import("./vite.mjs");
   const { PluginManager: PluginManager2 } = await import("./plugin.mjs");
-  const fs = await import("fs/promises");
+  const fs3 = await import("fs/promises");
   const pluginManager = new PluginManager2({
     config,
     isDev: false,
@@ -4657,9 +4594,9 @@ async function buildSSRInMemory(productionVite, config, root, routeManager, apiR
     buildLifetime: rendererBuildLifetime
   });
   if (!hasScopedPostcssConfig) {
-    postcssConfigDir = await fs.mkdtemp(path6.join(os.tmpdir(), "farm-postcss-"));
-    await fs.writeFile(
-      path6.join(postcssConfigDir, "postcss.config.cjs"),
+    postcssConfigDir = await fs3.mkdtemp(path8.join(os.tmpdir(), "farm-postcss-"));
+    await fs3.writeFile(
+      path8.join(postcssConfigDir, "postcss.config.cjs"),
       "module.exports = { plugins: [] };\n"
     );
     tailwindVitePlugin = await loadTailwindVitePlugin({
@@ -4684,7 +4621,7 @@ async function buildSSRInMemory(productionVite, config, root, routeManager, apiR
         fileName: entry.fileName,
         sourceType: "static",
         staticInfo: entry.staticInfo,
-        data: (await fs.readFile(entry.modulePath)).toString("base64")
+        data: (await fs3.readFile(entry.modulePath)).toString("base64")
       });
       continue;
     }
@@ -4791,20 +4728,39 @@ async function buildSSRInMemory(productionVite, config, root, routeManager, apiR
   const hasConfiguredRuntimePlugins = Boolean(
     hasRuntimeConfigModule && (config.plugins || []).length > 0
   );
-  const farmDocsPrecompiledManifest = config.docs?.enabled && getFarmPresetRuntime(preset) === "edge" ? config.docs.adapter?.server ? await compileFarmDocsAdapterEdgeManifest(config.docs, {
-    root,
-    srcDir: config.srcDir,
-    clientEntry: FARM_CLIENT_JS_SRC_PLACEHOLDER,
-    fontStylesheetHref: "/farm-fonts.css",
-    globalStylesheetHref: "/assets/globals.css"
-  }) : await compileFarmDocsManifest(config.docs, {
-    root,
-    srcDir: config.srcDir,
-    clientEntry: FARM_CLIENT_JS_SRC_PLACEHOLDER,
-    fontAssets: toFarmDocsPublicFontAssets(resolveFarmDocsFontAssets(root)),
-    fontStylesheetHref: "/farm-fonts.css",
-    globalStylesheetHref: "/assets/globals.css"
-  }) : null;
+  if (hasFarmDocsRuntimeAdapter(config.docs)) {
+    const adapterGuardedPaths = new Set(getFarmDocsGuardedPaths(config, middlewareRoutes));
+    assertFarmDocsAdapterServesNoGuardedPages(
+      config.docs,
+      { root, srcDir: config.srcDir },
+      (pathname) => adapterGuardedPaths.has(pathname)
+    );
+  }
+  const farmDocsCspNonceMarker = createFarmCspNonce(config.security);
+  const farmDocsPrecompiledManifest = config.docs?.enabled && getFarmPresetRuntime(preset) === "edge" ? await _runWithFarmCspNonce(
+    farmDocsCspNonceMarker,
+    async () => config.docs.adapter?.server ? await compileFarmDocsAdapterEdgeManifest(config.docs, {
+      root,
+      srcDir: config.srcDir,
+      clientEntry: FARM_CLIENT_JS_SRC_PLACEHOLDER,
+      fontStylesheetHref: "/farm-fonts.css",
+      globalStylesheetHref: "/assets/globals.css"
+    }) : await (async () => {
+      const guardedPaths = new Set(getFarmDocsGuardedPaths(config, middlewareRoutes));
+      return compileFarmDocsManifest(config.docs, {
+        root,
+        srcDir: config.srcDir,
+        clientEntry: FARM_CLIENT_JS_SRC_PLACEHOLDER,
+        fontAssets: toFarmDocsPublicFontAssets(resolveFarmDocsFontAssets(root)),
+        fontStylesheetHref: "/farm-fonts.css",
+        globalStylesheetHref: "/assets/globals.css",
+        isPathGuarded: /* @__PURE__ */ __name((pathname) => guardedPaths.has(pathname), "isPathGuarded")
+      });
+    })()
+  ) : null;
+  if (farmDocsPrecompiledManifest && farmDocsCspNonceMarker) {
+    farmDocsPrecompiledManifest.cspNonceMarker = farmDocsCspNonceMarker;
+  }
   const virtualEntryCode = generateVirtualEntryCode(
     apiRoutes,
     pageRoutes,
@@ -5000,7 +4956,7 @@ async function buildSSRInMemory(productionVite, config, root, routeManager, apiR
   } finally {
     if (postcssConfigDir) {
       try {
-        await fs.rm(postcssConfigDir, { recursive: true, force: true });
+        await fs3.rm(postcssConfigDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -5014,7 +4970,7 @@ async function buildSSRInMemory(productionVite, config, root, routeManager, apiR
 __name(buildSSRInMemory, "buildSSRInMemory");
 function readFarmAppPackageIdentity(root) {
   try {
-    return JSON.parse(readFileSync(path6.join(root, "package.json"), "utf8"));
+    return JSON.parse(readFileSync(path8.join(root, "package.json"), "utf8"));
   } catch {
     return {};
   }
@@ -5034,6 +4990,19 @@ function readFarmPageLastModified(pageRoutes) {
   return lastModified;
 }
 __name(readFarmPageLastModified, "readFarmPageLastModified");
+function getFarmDocsGuardedPaths(config, middlewareRoutes) {
+  if (!config.docs?.enabled) return [];
+  const contentDir = resolveFarmDocsContentDir(config.docs, {
+    root: config.root,
+    srcDir: config.srcDir
+  });
+  const guards = {
+    config: { middleware: config.middleware, integrations: config.integrations },
+    middlewareRoutes
+  };
+  return discoverFarmDocsPages(contentDir, config.docs).flatMap((page) => [page.href, getFarmDocsMarkdownPath(page.href)]).filter((pathname) => farmPathGuardCoversPage(guards, pathname));
+}
+__name(getFarmDocsGuardedPaths, "getFarmDocsGuardedPaths");
 function getFarmAppOwnedDocsEnginePaths(agent, applicationMetadataRoutes) {
   const llmsTxt = agent?.llmsTxt;
   const ownedByFile = /* @__PURE__ */ __name((kind) => applicationMetadataRoutes.some(
@@ -5582,7 +5551,8 @@ function renderFarmRouteServerTree(element) { return element; }`;
     pattern: ${JSON.stringify(route.pattern)},${route.directory ? `
     directory: ${JSON.stringify(route.directory)},` : ""}
     module: ${varName},
-    shouldHydrate: ${JSON.stringify(clientMetadata.shouldHydrate)},
+    shouldHydrate: ${JSON.stringify(clientMetadata.shouldHydrate)},${clientMetadata.shouldHydrate ? `
+    clientModule: ${JSON.stringify(toViteModuleId(route.modulePath, config.root))},` : ""}
     islandStrategy: ${JSON.stringify(clientMetadata.islandStrategy)},${usesFarmServerTree(clientMetadata) ? "\n    serverTree: true," : ""}${renderingDirective ? `
     rendering: ${JSON.stringify(renderingDirective)},` : ""}
     ${route.source !== void 0 ? `markdownSource: {
@@ -5703,7 +5673,9 @@ function renderFarmRouteServerTree(element) { return element; }`;
   const productionRuntimeImport = `import {
   _getRequestReadCount,
   _runWithAfterRequest,
+  _resolveCurrentCspNonce,
   _runWithCurrentRequest,
+  _runWithFarmCspNonce,
   _runWithAPIRequestRuntime,
   _runWithMiddlewareContext,
   _runWithMiddlewareData,
@@ -5713,6 +5685,8 @@ function renderFarmRouteServerTree(element) { return element; }`;
   appendFarmRedirectQuery,
   applyFarmBasePath,
   applyFarmCspNonceToResponse,
+  createFarmCspNonce,
+  stampFarmCspNonce,
   applyFarmPreviewRobotsTag,
   applyFarmThemeDocument,
   appendFarmLinkHeader,
@@ -5734,6 +5708,7 @@ function renderFarmRouteServerTree(element) { return element; }`;
   createFarmAiCatalogResponse,
   createFarmApiCatalogResponse,
   createFarmAppManifestResponse,
+  farmPathGuardCoversEndpoint,
   collectFarmLlmsTxtPages,
   createFarmDefaultLlmsTxt,
   createFarmLlmsMarkdownReader,
@@ -5807,9 +5782,9 @@ import * as farmDocsConfigModule from ${toVirtualEntryImportSpecifier(docsConfig
 import { dirname as farmDocsDirname, join as farmDocsJoin } from "node:path";
 import { fileURLToPath as farmDocsFileURLToPath } from "node:url";` : "";
   const markdownHandlerImport = config.md?.enabled ? `import { applyMarkdownNegotiationHeaders, createMarkdownMirrorResponse, getFarmMarkdownAlternatePath } from "@farm.js/core/markdown";` : "";
-  const appMarkdownImport = hasMarkdownPages ? `import { createFarmMarkdownRouteModule, createFarmMarkdownSourceResponse, isFarmMarkdownPublicSourceResponse } from "@farm.js/core/internal/app-markdown-runtime";` : "const createFarmMarkdownSourceResponse = null;\nconst isFarmMarkdownPublicSourceResponse = null;";
-  const markdownErrorImport = `import { FARM_MARKDOWN_CONTENT_TYPE, createFarmMarkdownErrorBody, farmRequestWantsMarkdown } from "@farm.js/core/markdown";`;
-  const mdxComponentsPath = typeof config.mdx?.components === "string" ? path6.isAbsolute(config.mdx.components) ? config.mdx.components : path6.join(config.root, config.mdx.components) : null;
+  const appMarkdownImport = hasMarkdownPages ? `import { FARM_MARKDOWN_ANONYMOUS_CLIENT_ADDRESS, createFarmMarkdownRouteModule, createFarmMarkdownSourceResponse, isFarmMarkdownPublicSourceResponse } from "@farm.js/core/internal/app-markdown-runtime";` : "const createFarmMarkdownSourceResponse = null;\nconst isFarmMarkdownPublicSourceResponse = null;";
+  const markdownErrorImport = `import { FARM_MARKDOWN_CONTENT_TYPE, FARM_MARKDOWN_PAGE_CHECK_HEADER, _isFarmMarkdownPageCheck, createFarmMarkdownErrorBody, farmRequestWantsMarkdown } from "@farm.js/core/markdown";`;
+  const mdxComponentsPath = typeof config.mdx?.components === "string" ? path8.isAbsolute(config.mdx.components) ? config.mdx.components : path8.join(config.root, config.mdx.components) : null;
   const mdxComponentsImport = mdxComponentsPath ? `import * as FarmMdxComponentsModule from ${toVirtualEntryImportSpecifier(mdxComponentsPath)};` : "";
   const layerConfigPaths = (config.layers || []).map((layer) => layer.configFile).filter((configFile) => Boolean(configFile)).filter((configFile) => configFile !== configModulePath);
   const layerConfigImports = layerConfigPaths.map(
@@ -6213,12 +6188,41 @@ const farmDocsBundledContentDir = ${config.docs?.enabled && !hasPrecompiledDocs
 })()` : "null"};
 const farmDocsResolvedConfig = ${generateFarmDocsRuntimeConfigExpression(config.docs, hasPrecompiledDocs)};
 const farmDocsRuntimeRoot = ${hasPrecompiledDocs ? '"."' : `farmDocsBundledContentDir || ${JSON.stringify(config.root)}`};
+// Docs pages a path-specific guard covers, decided at build time. The docs API and the
+// root llms/sitemap files answer anyone, so they leave these pages out.
+const farmDocsGuardedPaths = ${JSON.stringify(
+    hasPrecompiledDocs ? [] : getFarmDocsGuardedPaths(config, middlewareRoutes)
+  )};
+const farmDocsGuardedPathSet = new Set(farmDocsGuardedPaths);
+const isFarmDocsPathGuarded = (pathname) => farmDocsGuardedPathSet.has(pathname);
 globalThis.__FARM_DOCS_RUNTIME_CONFIG__ = {
   root: farmDocsRuntimeRoot,
   srcDir: ${JSON.stringify(config.srcDir)},
   docs: farmDocsResolvedConfig,
+  guardedPaths: farmDocsGuardedPaths,
 };
 const farmDocsPrecompiledRuntime = ${hasPrecompiledDocs ? `createFarmDocsPrecompiledRuntime(${JSON.stringify(farmDocsPrecompiledManifest)})` : "null"};
+// Filled in from the client build once it has finished (see buildNitroUniversal).
+const farmDocsModulePreloads = (() => {
+  try {
+    return JSON.parse("${FARM_DOCS_MODULE_PRELOADS_PLACEHOLDER}");
+  } catch {
+    return null;
+  }
+})();
+// Paths the adapter matches against a page's source path the way the browser
+// finds the page's module.
+const farmDocsModulePreloadPaths = farmDocsModulePreloads
+  ? {
+      runtime: farmDocsModulePreloads.runtime.map((index) => "/" + farmDocsModulePreloads.files[index]),
+      pages: Object.fromEntries(
+        Object.entries(farmDocsModulePreloads.pages).map(([sourcePath, indexes]) => [
+          sourcePath,
+          indexes.map((index) => "/" + farmDocsModulePreloads.files[index]),
+        ]),
+      ),
+    }
+  : undefined;
 const farmDocsHandler = ${config.docs?.enabled ? hasPrecompiledDocs ? "farmDocsPrecompiledRuntime.handleDocsRequest" : adapterOwnsDocsRuntime ? `createFarmDocsAdapterRuntimeHandler({
   ${docsConfigModulePath ? "...(farmDocsConfigModule.default || farmDocsConfigModule),\n  ...farmDocsResolvedConfig.configOverrides," : "...farmDocsResolvedConfig.config,"}
   entry: farmDocsResolvedConfig.config?.entry || String(farmDocsResolvedConfig.entry || "/docs").replace(/^\\/+|\\/+$/g, "") || "docs",
@@ -6229,6 +6233,9 @@ const farmDocsHandler = ${config.docs?.enabled ? hasPrecompiledDocs ? "farmDocsP
   // A production build's content cannot change, so the adapter reads its
   // navigation once instead of scanning the content directory per request.
   immutableContent: true,
+  // List the chunks a page needs, so the browser fetches them alongside the
+  // client entry instead of discovering them one import at a time.
+  modulePreloads: farmDocsModulePreloadPaths,
   clientEntry: "/__farm_client_js_src__",
   // Font CSS is merged into the client stylesheet; farm-fonts.css only exists when the
   // app has fonts, so linking it separately 404'd for apps without them.
@@ -6251,18 +6258,30 @@ const farmDocsHandler = ${config.docs?.enabled ? hasPrecompiledDocs ? "farmDocsP
     ),
   fontStylesheetHref: "/farm-fonts.css",
   globalStylesheetHref: "/assets/globals.css",
+  isPathGuarded: isFarmDocsPathGuarded,
 })` : "null"};
-const farmDocsAPIHandler = ${config.docs?.enabled ? hasPrecompiledDocs ? "farmDocsPrecompiledRuntime.handleAPIRequest" : adapterOwnsDocsRuntime ? "null" : `createFarmDocsAPIHandler({ rootDir: farmDocsRuntimeRoot, srcDir: ${JSON.stringify(config.srcDir)}, docs: farmDocsResolvedConfig })` : "null"};
+const farmDocsAPIHandler = ${config.docs?.enabled ? hasPrecompiledDocs ? "farmDocsPrecompiledRuntime.handleAPIRequest" : adapterOwnsDocsRuntime ? "null" : `createFarmDocsAPIHandler({ rootDir: farmDocsRuntimeRoot, srcDir: ${JSON.stringify(config.srcDir)}, docs: farmDocsResolvedConfig, isPathGuarded: isFarmDocsPathGuarded })` : "null"};
 
 // API routes bundled at build time
 const apiRoutes = ${apiRoutes.length > 0 ? "mergePluginAPIRoutes(" : ""}[${apiRegistrations.join(",")}
-]${apiRoutes.length > 0 ? `, configuredPlugins, ${JSON.stringify(apiRoutes.map(({ path: path8, methods }) => ({ path: path8, methods })))}, { bodySizeLimit: ${JSON.stringify(config.server.bodySizeLimit)}, dispatch: dispatchFarmPluginAPIRequest })` : ""};
+]${apiRoutes.length > 0 ? `, configuredPlugins, ${JSON.stringify(apiRoutes.map(({ path: path10, methods }) => ({ path: path10, methods })))}, { bodySizeLimit: ${JSON.stringify(config.server.bodySizeLimit)}, dispatch: dispatchFarmPluginAPIRequest })` : ""};
 // A plugin calling an app endpoint (an MCP tool, say) goes through the whole
 // pipeline, so the endpoint's middleware and integration guards run for it.
 function dispatchFarmPluginAPIRequest(request) {
   const url = new URL(request.url);
   url.pathname = applyFarmBasePath(url.pathname);
-  return handleFarmRequest(url.href === request.url ? request : new Request(url, request));
+  return fetchFarmInnerRequest(url.href === request.url ? request : new Request(url, request));
+}
+// A request the app makes to itself (a Markdown page check, a plugin's endpoint call) enters
+// through this module's outer \`fetch\`, as a direct request does: plugin runtime hooks run and
+// it gets its own request context, so \`cookies()\` and \`headers()\` are its own, never the
+// caller's. It asks for an identity body: the caller reads it, and the outer response is
+// compressed once.
+function fetchFarmInnerRequest(request, context) {
+  if (!request.headers.has("accept-encoding")) return fetch(request, context);
+  const headers = new Headers(request.headers);
+  headers.delete("accept-encoding");
+  return fetch(new Request(request, { headers }), context);
 }
 const farmLocalAPIBasePath = ${JSON.stringify(resolveFarmAPIServerBasePath(config.api))};
 const farmOpenAPIReference = ${JSON.stringify(openAPIReference)};
@@ -6274,7 +6293,17 @@ ${config.agent?.apiCatalog ? `const farmApiCatalogInput = ${JSON.stringify(resol
       webmcpTools: config.plugins.some(({ name }) => name === "farm:webmcp") ? collectFarmWebMCPTools(config.root, config.srcDir) : []
     })
   )};
-${servesDefaultMCP ? "farmAppManifestInput.defaultMCP = getFarmDefaultMCPServer;\n" : ""}` : ""}
+${servesDefaultMCP ? "farmAppManifestInput.defaultMCP = getFarmDefaultMCPServer;\n" : ""}// A guard written for an MCP server's path keeps its tools out of the public view.
+farmAppManifestInput.guardCoversPath = (path) =>
+  farmPathGuardCoversEndpoint(
+    {
+      config: { middleware: farmMiddlewareConfig, integrations: serverRuntimeIntegrations },
+      middlewareRoutes: fileMiddlewareModules,
+    },
+    path,
+    farmLocalAPIBasePath,
+  );
+` : ""}
 function isFarmLocalAPIPathname(pathname) {
   return farmLocalAPIBasePath !== "/" &&
     (pathname === farmLocalAPIBasePath ||
@@ -6374,15 +6403,26 @@ function renderFarmClientBootstrapScript(canonicalPath, selectedRouteSlots, page
   }
   return '<script id="__farm_route_slots_data__" type="application/json">' +
     serializedRouteSlots +
-    '</script><script>' + source + '</script>';
+    '</script>' + stampFarmCspNonce('<script>' + source + '</script>');
 }
 
 function renderFarmRendererHydrationScript() {
   return typeof ReactDOMServer.generateHydrationScript === "function"
-    ? ReactDOMServer.generateHydrationScript()
+    ? stampFarmCspNonce(ReactDOMServer.generateHydrationScript())
     : "";
 }
 
+function renderFarmClientEntryScript() {
+  return stampFarmCspNonce('<script type="module" src="/__farm_client_js_src__"></script>');
+}
+
+// Renderer options for the response being rendered: its CSP nonce, which the
+// renderer puts on the inline scripts it emits.
+function getFarmRendererRenderOptions() {
+  const nonce = _resolveCurrentCspNonce();
+  return nonce ? { nonce } : undefined;
+}
+
 function escapeFarmHtmlAttribute(value) {
   return String(value)
     .replace(/&/g, "&amp;")
@@ -6424,6 +6464,7 @@ async function renderFarmElement(ReactDOMServer, element, routeKey) {
   if (farmRendererStreamingCapabilities.web &&
       typeof ReactDOMServer.renderToReadableStream === "function") {
     const stream = await ReactDOMServer.renderToReadableStream(element, {
+      nonce: _resolveCurrentCspNonce(),
       onError(error) {
         // redirect()/notFound() are control flow, not render failures: the
         // request handler must still receive them to map the response status,
@@ -6556,6 +6597,7 @@ async function renderFarmElement(ReactDOMServer, element, routeKey) {
       },
     };
     pipeableStream = ReactDOMServer.renderToPipeableStream(element, {
+      nonce: _resolveCurrentCspNonce(),
       onShellReady() {
         try {
           pipeableStream.pipe(destination);
@@ -6618,7 +6660,10 @@ async function renderFarmElement(ReactDOMServer, element, routeKey) {
   }
 
   if (ReactDOMServer.renderToStringWithHead) {
-    const rendered = await ReactDOMServer.renderToStringWithHead(element);
+    const rendered = await ReactDOMServer.renderToStringWithHead(
+      element,
+      getFarmRendererRenderOptions(),
+    );
     return {
       html: rendered.html,
       head: rendered.head || "",
@@ -6626,7 +6671,7 @@ async function renderFarmElement(ReactDOMServer, element, routeKey) {
       streamErrors,
     };
   }
-  const html = await ReactDOMServer.renderToString(element);
+  const html = await ReactDOMServer.renderToString(element, getFarmRendererRenderOptions());
   return { html, head: "", shellHtml: html, streamErrors };
 }
 
@@ -6665,7 +6710,7 @@ function renderFarmElementSync(ReactDOMServer, element, routeKey) {
   if (typeof ReactDOMServer.renderToString !== "function") return undefined;
   let html;
   try {
-    html = ReactDOMServer.renderToString(element);
+    html = ReactDOMServer.renderToString(element, getFarmRendererRenderOptions());
   } catch {
     html = undefined;
   }
@@ -6680,6 +6725,8 @@ function renderFarmElementSync(ReactDOMServer, element, routeKey) {
 function createFarmDocumentStream(contentStream, prefix, suffix, onComplete) {
   const encoder = new TextEncoder();
   const reader = contentStream.getReader();
+  // The suffix renders after the handler returned, outside its async scope.
+  const cspNonce = _resolveCurrentCspNonce();
   return new ReadableStream({
     start(controller) {
       controller.enqueue(encoder.encode(prefix));
@@ -6688,7 +6735,9 @@ function createFarmDocumentStream(contentStream, prefix, suffix, onComplete) {
       try {
         const result = await reader.read();
         if (result.done) {
-          const tail = typeof suffix === "function" ? await suffix() : suffix;
+          const tail = typeof suffix === "function"
+            ? await _runWithFarmCspNonce(cspNonce, suffix)
+            : suffix;
           controller.enqueue(encoder.encode(tail));
           if (onComplete) onComplete();
           controller.close();
@@ -6810,18 +6859,18 @@ function createFarmErrorDocument(html, title) {
       '  <meta name="viewport" content="width=device-width, initial-scale=1">\\n' +
       '  <link rel="icon" href="data:,">\\n' +
       '  <title>' + escapedTitle + '</title>\\n' +
-      '  <link rel="stylesheet" href="/__farm_client_css_href__">\\n' +
+      '  <link rel="stylesheet" href="/__farm_client_css_href__">' + renderFarmClientModulePreloads(html) + '\\n' +
       renderFarmRendererHydrationScript() + '\\n' +
       '</head>\\n<body>\\n' +
       '  <div id="root">' + html + '</div>\\n' +
       '  ' + renderFarmClientBootstrapScript() + '\\n' +
-      '  <script type="module" src="/__farm_client_js_src__"></script>\\n' +
+      '  ' + renderFarmClientEntryScript() + '\\n' +
       '</body>\\n</html>';
   }
 
   let fullHtml = ensureFarmDocumentRoot(ensureFarmDocumentHead(fullDocument));
   fullHtml = fullHtml
-    .replace(/<head([^>]*)>/i, '<head$1>\\n  <link rel="stylesheet" href="/__farm_client_css_href__">')
+    .replace(/<head([^>]*)>/i, function(match, attrs) { return '<head' + attrs + '>\\n  <link rel="stylesheet" href="/__farm_client_css_href__">' + renderFarmClientModulePreloads(fullDocument); })
     // Function replacements: dynamic markup may contain $-sequences ($&, $', $$)
     // that a string replacement would expand, corrupting the document.
     .replace(/<\\/head>/i, function() { return renderFarmRendererHydrationScript() + '\\n</head>'; })
@@ -6834,7 +6883,7 @@ function createFarmErrorDocument(html, title) {
       /<\\/body>/i,
       function() {
         return '  ' + renderFarmClientBootstrapScript() + '\\n' +
-          '  <script type="module" src="/__farm_client_js_src__"></script>\\n</body>';
+          '  ' + renderFarmClientEntryScript() + '\\n</body>';
       },
     );
   return fullHtml.trim().startsWith("<!DOCTYPE")
@@ -6842,6 +6891,53 @@ function createFarmErrorDocument(html, title) {
     : "<!DOCTYPE html>\\n" + fullHtml;
 }
 
+// The client modules a page needs before it hydrates, filled in from the client
+// build once it has finished (see buildNitroUniversal).
+const farmClientModulePreloads = (() => {
+  try {
+    return JSON.parse("${FARM_CLIENT_MODULE_PRELOADS_PLACEHOLDER}");
+  } catch {
+    return null;
+  }
+})();
+const farmClientEntryPreloadTags = farmClientModulePreloads
+  ? farmClientModulePreloads.entry.map(renderFarmClientModulePreload).join("")
+  : "";
+// The client modules a document's markup loads: its islands' boundaries and the
+// client references of its server tree.
+const FARM_CLIENT_MODULE_REFERENCE_PATTERN = /data-farm-client-boundary="([^"]+)"|"r":"(\\/[^"]+)"/g;
+
+function renderFarmClientModulePreload(index) {
+  return '\\n  <link rel="modulepreload" href="/' +
+    escapeFarmHtmlAttribute(farmClientModulePreloads.files[index]) +
+    '" fetchpriority="low">';
+}
+
+// The modulepreload links for a document: the entry's static imports, then the
+// modules its hydrating page and its markup load.
+function renderFarmClientModulePreloads(markup, pageModule) {
+  // A nonce policy blocks parser-inserted links without the nonce, and the
+  // response filter manages nonces on script elements only, so CSP nonce mode
+  // keeps the documents it had.
+  if (!farmClientModulePreloads || (farmSecurityConfig.csp && farmSecurityConfig.csp.nonce)) return "";
+  const modules = farmClientModulePreloads.modules;
+  const listed = new Set();
+  let tags = farmClientEntryPreloadTags;
+  const add = (moduleId) => {
+    if (!moduleId || !Object.prototype.hasOwnProperty.call(modules, moduleId)) return;
+    for (const index of modules[moduleId]) {
+      if (listed.has(index)) continue;
+      listed.add(index);
+      tags += renderFarmClientModulePreload(index);
+    }
+  };
+  add(pageModule);
+  if (typeof markup === "string") {
+    for (const match of markup.matchAll(FARM_CLIENT_MODULE_REFERENCE_PATTERN)) add(match[1] || match[2]);
+  }
+  return tags;
+}
+
 // The origin hreflang alternates resolve against when the route sets no
 // metadataBase. Forwarded authority counts only under server.trustProxy, the
 // same rule the development server applies.
@@ -6874,7 +6970,7 @@ function applyFarmI18nDocument(html, requestPath, snapshot, request, metadata) {
   });
   const runtimeMarkup =
     renderFarmI18nAlternateLinks(requestPath, snapshot, request, metadata) +
-    '<script>window.__FARM_I18N__ = ' + serializeFarmInlineValue(snapshot) + ';</script>';
+    stampFarmCspNonce('<script>window.__FARM_I18N__ = ' + serializeFarmInlineValue(snapshot) + ';</script>');
   nextHtml = nextHtml.replace(/<head([^>]*)>/i, function(_match, attributes) {
     // Function replacement: runtimeMarkup may contain $-sequences ($&, $', $$).
     return '<head' + attributes + '>' + runtimeMarkup;
@@ -6944,6 +7040,26 @@ function hasPrivateFarmRequestHeaders(request, farmLocaleResolution) {
   );
 }
 
+// A docs response a guard let this visitor read is theirs, as for pages: one for a
+// request with credentials, or with middleware request data, never fills a shared cache.
+// Middleware headers cannot do this, since they never replace a response's own.
+function withFarmDocsRequestCache(response, request, farmLocaleResolution, middlewareData, middlewareContext) {
+  if (
+    !hasPrivateFarmRequestHeaders(request, farmLocaleResolution) &&
+    !middlewareData?.size &&
+    !middlewareContext?.size
+  ) {
+    return response;
+  }
+  const headers = new Headers(response.headers);
+  headers.set("Cache-Control", "private, no-store");
+  return farmOwnedResponse(response.body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  });
+}
+
 ${generateRuntimePathMatcherSource()}
 
 function getMatchingErrorBoundary(pathname) {
@@ -7174,6 +7290,27 @@ function createFarmAgentRobotsResponse(request) {
   );
 }
 ` : ""}
+// Static pages a path-specific guard covers (non-root middleware.ts, a config or
+// integration middleware matcher naming the path), decided at build time.
+// sitemap.xml, llms.txt and the default MCP server never list them, nor a page behind
+// a route guard.
+const farmAgentGuardedPages = new Set(${JSON.stringify(
+    pageRoutes.map((route) => route.pattern).filter(
+      (pattern) => !pattern.includes("[") && farmPathGuardCoversPage(
+        {
+          config: { middleware: config.middleware, integrations: config.integrations },
+          middlewareRoutes
+        },
+        pattern
+      )
+    )
+  )});
+function getFarmAgentListedPageRoutes() {
+  return pageRoutes.filter(
+    (route) =>
+      !farmAgentGuardedPages.has(route.pattern) && !(route.module && route.module.__farmRouteGuard),
+  );
+}
 ${servesAgentSitemap ? `// sitemap.xml from agent.sitemap, built the same way as in development. Each page's
 // lastmod is its file's modification time, read at build time.
 const farmAgentSitemapConfig = ${JSON.stringify(config.agent.sitemap)};
@@ -7183,7 +7320,7 @@ function createFarmAgentSitemapResponse(request) {
   return createFarmMetadataRouteResponse(
     "sitemap",
     createFarmDefaultSitemap(
-      pageRoutes.map((route) => ({
+      getFarmAgentListedPageRoutes().map((route) => ({
         pattern: route.pattern,
         module: route.module,
         lastModified: farmAgentSitemapLastModified[route.pattern],
@@ -7222,7 +7359,7 @@ async function handleFarmDefaultMCP(request) {
     basePath: ${JSON.stringify(config.basePath)},
     listPages: () =>
       collectFarmDefaultMCPPages(
-        pageRoutes.map((route) => ({ pattern: route.pattern, module: route.module })),
+        getFarmAgentListedPageRoutes().map((route) => ({ pattern: route.pattern, module: route.module })),
         { origin, basePath: ${JSON.stringify(config.basePath)}, markdown: farmMarkdownConfig },
       ),
     // A fresh request through this handler, so the caller's cookies never shape a page.
@@ -7234,13 +7371,15 @@ async function handleFarmDefaultMCP(request) {
     },
   });
 }
-const farmDefaultMCPReadMarkdown = createFarmLlmsMarkdownReader((page) => handleFarmRequest(page));
+// \`fetch\` is this module's outer request entry: plugin runtime hooks run and the page
+// gets its own request context, as for a direct request.
+const farmDefaultMCPReadMarkdown = createFarmLlmsMarkdownReader((page) => fetch(page));
 ` : ""}
 // Static pages and root metadata for llms.txt, built the same way as in development.
 function createFarmLlmsTxtContext(request, full) {
   const origin = new URL(request.url).origin;
   const pages = collectFarmLlmsTxtPages(
-    pageRoutes.map((route) => ({ pattern: route.pattern, metadata: route.module && route.module.metadata })),
+    getFarmAgentListedPageRoutes().map((route) => ({ pattern: route.pattern, metadata: route.module && route.module.metadata })),
     {
       origin,
       markdown: farmMarkdownConfig,
@@ -7261,14 +7400,15 @@ function createFarmLlmsTxtContext(request, full) {
         apiServerBasePath: farmLocalAPIBasePath,${servesDefaultMCP ? "\n        defaultMCP: getFarmDefaultMCPServer," : ""}
       }),` : ""}
     }),
-    // llms-full.txt reads each page's .md mirror through this same handler,
-    // with a fresh request so the caller's cookies never shape its content.
-    // HEAD discards the body, so it reads nothing.
+    // llms-full.txt reads each page's .md mirror through this module's outer
+    // request entry, so plugin runtime hooks run and each read has a fresh request
+    // context: the caller's cookies never shape its content. HEAD discards the
+    // body, so it reads nothing.
     ...(full
       ? {
           markdown: request.method.toUpperCase() === "HEAD"
             ? async () => null
-            : createFarmLlmsMarkdownReader((page) => handleFarmRequest(page)),
+            : createFarmLlmsMarkdownReader((page) => fetch(page)),
         }
       : {}),
   };
@@ -7716,7 +7856,7 @@ ${config.docs?.enabled ? `async function wrapFarmDocsResponseWithLayouts(request
   if (!html.includes('src="/__farm_client_js_src__"')) {
     html = html.replace(
       /<[/]body>/i,
-      '  <script type="module" src="/__farm_client_js_src__"></script>\\n</body>',
+      function() { return '  ' + renderFarmClientEntryScript() + '\\n</body>'; },
     );
   }
   if (!html.includes('window._$HY')) {
@@ -7753,6 +7893,9 @@ function resolvePPRConfig(route) {
 }
 
 function getPPRShellBypassReason(request, middlewareData, middlewareContext) {
+  // A shared shell would carry one response's nonce to every visitor, where
+  // the nonce filter strips it and Farm's scripts stop running.
+  if (farmSecurityConfig.csp && farmSecurityConfig.csp.nonce) return "csp-nonce";
   const method = request.method.toUpperCase();
   if (method !== "GET" && method !== "HEAD") return "method";
   if (request.headers.get("cookie")) return "cookie";
@@ -8030,11 +8173,17 @@ async function handleFarmRequestInContext(
     const docsResponse = await farmDocsHandler(cloneFarmRequestWithContext(request));
     if (docsResponse) {
       if (!docsResponse.headers.get("content-type")?.toLowerCase().includes("text/html")) {
-        return applyProductionMiddlewareHeaders(docsResponse, middlewareHeaders);
+        return applyProductionMiddlewareHeaders(
+          withFarmDocsRequestCache(docsResponse, request, farmLocaleResolution, middlewareData, middlewareContext),
+          middlewareHeaders,
+        );
       }
-      const wrappedDocsResponse = await wrapFarmDocsResponseWithLayouts(
+      const wrappedDocsResponse = withFarmDocsRequestCache(
+        await wrapFarmDocsResponseWithLayouts(request, docsResponse),
         request,
-        docsResponse,
+        farmLocaleResolution,
+        middlewareData,
+        middlewareContext,
       );
       const docsHeaders = new Headers(wrappedDocsResponse.headers);
       docsHeaders.set("x-farm-preload-buffered", "1");
@@ -8058,7 +8207,13 @@ async function handleFarmRequestInContext(
       const match = matchPageRoute(getFarmRoutePathname(targetPathname));
       return match?.route?.markdownSource || null;
     },
-    renderPage: (targetRequest) => handleFarmRequest(targetRequest, adapterContext),
+    clientAddress: adapterContext?.clientAddress,
+    // An anonymous visitor's request: guards never see the caller's address.
+    renderPage: (targetRequest) =>
+      fetchFarmInnerRequest(targetRequest, {
+        ...adapterContext,
+        clientAddress: FARM_MARKDOWN_ANONYMOUS_CLIENT_ADDRESS,
+      }),
   });
   if (markdownSourceResponse) {
     return isFarmMarkdownPublicSourceResponse(markdownSourceResponse)
@@ -8078,7 +8233,7 @@ async function handleFarmRequestInContext(
       config: farmMarkdownConfig,
       routeExists: (targetPathname) =>
         Boolean(matchPageRoute(getFarmRoutePathname(targetPathname))),
-      renderPage: (targetRequest) => handleFarmRequest(targetRequest, adapterContext),
+      renderPage: (targetRequest) => fetchFarmInnerRequest(targetRequest, adapterContext),
       apiServerBasePath: farmLocalAPIBasePath,
     });
     if (markdownResponse) {
@@ -8129,7 +8284,7 @@ async function handleFarmRequestInContext(
   ) {
     const method = request.method.toUpperCase();
     const response = method === "GET" || method === "HEAD"
-      ? farmOwnedResponse(method === "HEAD" ? null : farmOpenAPIReference.html, {
+      ? farmOwnedResponse(method === "HEAD" ? null : stampFarmCspNonce(farmOpenAPIReference.html), {
           status: 200,
           headers: {
             "Content-Type": "text/html; charset=utf-8",
@@ -8249,7 +8404,10 @@ async function handleFarmRequestInContext(
   ${config.docs?.enabled ? `if (farmDocsAPIHandler && isFarmDocsAPIRequest(pathname)) {
     const docsAPIResponse = await farmDocsAPIHandler(cloneFarmRequestWithContext(request));
     if (docsAPIResponse) {
-      return applyProductionMiddlewareHeaders(docsAPIResponse, middlewareHeaders);
+      return applyProductionMiddlewareHeaders(
+        withFarmDocsRequestCache(docsAPIResponse, request, farmLocaleResolution, middlewareData, middlewareContext),
+        middlewareHeaders,
+      );
     }
   }` : ""}
 
@@ -8763,13 +8921,16 @@ async function handleFarmRequestInContext(
 
         // Stream a suspended body as soon as React's shell is ready. Full-document
         // layouts, localized documents, and cacheable PPR shells still use the
-        // buffered path because they require whole-document transformation.
+        // buffered path because they require whole-document transformation, and so
+        // does the anonymous check behind a page's Markdown source: there, a
+        // redirect() under a loading boundary must still decide the status.
         if (
           pageStatus === 200 &&
           renderedPage.stream &&
           !hasFullDocument &&
           !farmI18nSnapshot &&
-          !pprCacheKey
+          !pprCacheKey &&
+          !_isFarmMarkdownPageCheck(request.headers.get(FARM_MARKDOWN_PAGE_CHECK_HEADER))
         ) {
           const farmThemeDocument = createFarmThemeDocumentParts(
             farmThemeConfig,
@@ -8783,7 +8944,7 @@ async function handleFarmRequestInContext(
             (hasFavicon ? '' : '  <link rel="icon" href="data:,">\\n') +
             '  <title>' + title + '</title>' + metaTags + '\\n' +
             '  <link rel="stylesheet" href="/__farm_client_css_href__">\\n' +
-            '  <link rel="modulepreload" href="/__farm_client_js_src__">\\n' +
+            '  <link rel="modulepreload" href="/__farm_client_js_src__">' + renderFarmClientModulePreloads(null, route.clientModule) + '\\n' +
             renderFarmRendererHydrationScript() + '\\n' +
             '</head>\\n<body>\\n  <div id="root">';
           const streamSuffix = '</div>\\n' +
@@ -8792,7 +8953,7 @@ async function handleFarmRequestInContext(
               routeSlotPayload,
               clientPageProps
             ) + '\\n' +
-            '  <script type="module" src="/__farm_client_js_src__"></script>\\n' +
+            '  ' + renderFarmClientEntryScript() + '\\n' +
             '</body>\\n</html>';
           const themedStreamPrefix = streamPrefix.replace(
             '<html lang="en">',
@@ -8816,7 +8977,8 @@ async function handleFarmRequestInContext(
               try {
                 return createLateNotFoundRecovery(
                   await ReactDOMServer.renderToString(
-                    wrapWithFarmIntegrationProviders(createFarmNotFoundElement(pathname))
+                    wrapWithFarmIntegrationProviders(createFarmNotFoundElement(pathname)),
+                    getFarmRendererRenderOptions()
                   )
                 ) + streamSuffix;
               } catch (error) {
@@ -8824,7 +8986,10 @@ async function handleFarmRequestInContext(
                 // needs their context cannot render alone, so use Farm's.
                 console.warn("not-found page could not render outside its layout, using Farm's:", error);
                 return createLateNotFoundRecovery(
-                  await ReactDOMServer.renderToString(React.createElement(FarmDefault404Page))
+                  await ReactDOMServer.renderToString(
+                    React.createElement(FarmDefault404Page),
+                    getFarmRendererRenderOptions()
+                  )
                 ) + streamSuffix;
               }
             },
@@ -8873,7 +9038,7 @@ async function handleFarmRequestInContext(
           );
           fullHtml = html
             // Inject CSS link after opening head tag or first meta tag
-            .replace(/<head([^>]*)>/i, '<head$1>\\n  <link rel="stylesheet" href="/__farm_client_css_href__">')
+            .replace(/<head([^>]*)>/i, function(match, attrs) { return '<head' + attrs + '>\\n  <link rel="stylesheet" href="/__farm_client_css_href__">' + renderFarmClientModulePreloads(html, route.clientModule); })
             .replace(/<\\/head>/i, () => renderFarmRendererHydrationScript() + '\\n</head>')
             // Explicit metadata wins over renderer and layout titles. Without
             // explicit metadata, a renderer title wins over the layout title.
@@ -8907,7 +9072,7 @@ async function handleFarmRequestInContext(
                 routeSlotPayload,
                 clientPageProps
               ) + '\\n' +
-                '  <script type="module" src="/__farm_client_js_src__"></script>\\n</body>',
+                '  ' + renderFarmClientEntryScript() + '\\n</body>',
             );
           
           // Last, so the charset (and the viewport, unless the layout wrote one) open the head.
@@ -8926,13 +9091,13 @@ async function handleFarmRequestInContext(
   \${viewportTags}
   \${hasFavicon ? "" : '<link rel="icon" href="data:,">'}
   \${suppressDefaultTitle ? "" : "<title>" + title + "</title>"}\${metaTags}\${rendererHead ? "\\n  " + rendererHead : ""}
-  <link rel="stylesheet" href="/__farm_client_css_href__">
+  <link rel="stylesheet" href="/__farm_client_css_href__">\${renderFarmClientModulePreloads(html, route.clientModule)}
   \${renderFarmRendererHydrationScript()}
 </head>
 <body>
   <div id="root">\${html}</div>
   \${renderFarmClientBootstrapScript(pageProps.__farmCanonicalPath, routeSlotPayload, clientPageProps)}
-  <script type="module" src="/__farm_client_js_src__"></script>
+  \${renderFarmClientEntryScript()}
 </body>
 </html>\`;
         }
@@ -9104,14 +9269,14 @@ async function handleFarmRequestInContext(
         }
       }
 
-      const fallbackHtml = createDefaultErrorMarkup({
+      const fallbackHtml = stampFarmCspNonce(createDefaultErrorMarkup({
         statusCode: errorStatus,
         statusText: errorStatusText,
         requestPath: pathname,
         method: request.method,
         development: false,
         mode: "production",
-      });
+      }));
       const fallbackDocument = applyFarmThemeDocument(
         applyFarmI18nDocument(
           createFarmErrorDocument(
@@ -9198,7 +9363,7 @@ ${servesDefaultMCP ? `
     }
     notFoundElement = wrapWithFarmIntegrationProviders(notFoundElement);
     
-    const html = await ReactDOMServer.renderToString(notFoundElement);
+    const html = await ReactDOMServer.renderToString(notFoundElement, getFarmRendererRenderOptions());
     // The layouts' and the not-found page's metadata, as the development renderer uses it.
     const notFoundMetadata = renderMetadataHead(
       await resolveFarmNotFoundMetadata(
@@ -9223,12 +9388,12 @@ ${servesDefaultMCP ? `
           "<head" + attrs + ">" +
           headContent.replace(/<title\\b[^>]*>[\\s\\S]*?<\\/title>\\s*/gi, "") +
           "\\n  <title>" + notFoundMetadata.title + "</title>" + notFoundMetadata.tags + "\\n</head>")
-        .replace(/<head([^>]*)>/i, '<head$1>\\n  <link rel="stylesheet" href="/__farm_client_css_href__">')
+        .replace(/<head([^>]*)>/i, function(match, attrs) { return '<head' + attrs + '>\\n  <link rel="stylesheet" href="/__farm_client_css_href__">' + renderFarmClientModulePreloads(fullDocument); })
         .replace(/<\\/head>/i, () => renderFarmRendererHydrationScript() + '\\n</head>')
         .replace(
           /<\\/body>/i,
           () => '  ' + renderFarmClientBootstrapScript() + '\\n' +
-            '  <script type="module" src="/__farm_client_js_src__"></script>\\n</body>',
+            '  ' + renderFarmClientEntryScript() + '\\n</body>',
         );
       fullHtml = ensureFarmDocumentMeta(fullHtml, notFoundMetadata.viewport);
       if (!fullHtml.trim().startsWith('<!DOCTYPE')) {
@@ -9241,14 +9406,14 @@ ${servesDefaultMCP ? `
   <meta charset="UTF-8">
   \${notFoundMetadata.viewport}
   \${notFoundMetadata.hasFavicon ? "" : '<link rel="icon" href="data:,">'}
-  <link rel="stylesheet" href="/__farm_client_css_href__">
+  <link rel="stylesheet" href="/__farm_client_css_href__">\${renderFarmClientModulePreloads(html)}
   <title>\${notFoundMetadata.title}</title>\${notFoundMetadata.tags}
   \${renderFarmRendererHydrationScript()}
 </head>
 <body>
   <div id="root">\${html}</div>
   \${renderFarmClientBootstrapScript()}
-  <script type="module" src="/__farm_client_js_src__"></script>
+  \${renderFarmClientEntryScript()}
 </body>
 </html>\`;
     }
@@ -9382,6 +9547,9 @@ async function handleFarmFetch(request, context) {
     () =>
       runWithFarmRequestSpan(request, async () => {
         const runtimeOptions = farmPluginRuntime ? getFarmPluginRequestOptions(request) : null;
+        // Created before rendering so only scripts Farm, the renderer, or the
+        // app (through getCspNonce()) give it carry the response nonce.
+        const cspNonce = createFarmCspNonce(farmSecurityConfig);
         const prepareResponse = async (runtimeRequest, responsePromise) => {
           const response = await responsePromise;
           // Headers need the path eagerly; preload reporting needs it only for
@@ -9393,6 +9561,7 @@ async function handleFarmFetch(request, context) {
             applyFarmCspNonceToResponse(
               applyConfiguredResponseHeaders(response, routePathname),
               farmSecurityConfig,
+              cspNonce,
             ),
             routePathname,
             runtimeRequest,
@@ -9425,7 +9594,7 @@ async function handleFarmFetch(request, context) {
             : ` : ""}prepareResponse(request, handleFarmRequest(request, context));
 
         const response = await _runWithCurrentRequest(request, () =>
-          _runWithAfterRequest(request, runRequest, context),
+          _runWithFarmCspNonce(cspNonce, () => _runWithAfterRequest(request, runRequest, context)),
         );
         return ${hasCompressionRuntime && !hasPluginRuntime ? "compressFarmResponse(request, response, getFarmOwnedBufferedHtml(response), farmLazyBufferedHtml.has(response))" : "response"};
       }),
@@ -9500,26 +9669,6 @@ function middlewarePatternMatches(pattern, pathname) {
   return new RegExp(`^${expression}/?$`).test(pathname);
 }
 __name(middlewarePatternMatches, "middlewarePatternMatches");
-function configMiddlewareMayHandlePath(config, pathname) {
-  if (!hasFarmMiddlewareConfig(config)) return false;
-  const entries = Array.isArray(config) ? config : [config];
-  return entries.some((entry) => {
-    if (!entry.matcher && !entry.exclude) return true;
-    const matchers = entry.matcher ? (Array.isArray(entry.matcher) ? entry.matcher : [entry.matcher]).map(
-      (matcher) => (
-        // A request-aware matcher cannot be proven safe at build time.
-        typeof matcher === "function" ? () => true : matcher
-      )
-    ) : void 0;
-    const compiled = compileMiddlewareConfig({ matcher: matchers, exclude: entry.exclude });
-    return matchesCompiledMiddlewareConfig(pathname, compiled, {}).matched;
-  });
-}
-__name(configMiddlewareMayHandlePath, "configMiddlewareMayHandlePath");
-function appMiddlewareMayHandlePath(middlewareRoutes, pathname) {
-  return middlewareRoutes.some((route) => matchesMiddlewareRoute(pathname, route).matched);
-}
-__name(appMiddlewareMayHandlePath, "appMiddlewareMayHandlePath");
 function routePatternSpecificity(pattern) {
   return pattern.split("/").filter(Boolean).reduce((score, segment) => {
     if (segment === "**" || segment.startsWith("[[...")) return score + 1;
@@ -9575,7 +9724,7 @@ function getPhysicalPrerenderBypassReason(options) {
 }
 __name(getPhysicalPrerenderBypassReason, "getPhysicalPrerenderBypassReason");
 async function buildNitroUniversal(config, routeManager, apiRouteManager, serverRenderer, preset, root, distDir, ssrBundle, ssrEntryFile, clientOutputDir, routeRuntimeManifest, configuredHeaderRoutes, nitroBuilderResultPromise, pluginManager) {
-  const [fs, nitroBuilderResult] = await Promise.all([
+  const [fs3, nitroBuilderResult] = await Promise.all([
     import("fs/promises"),
     nitroBuilderResultPromise
   ]);
@@ -9584,8 +9733,8 @@ async function buildNitroUniversal(config, routeManager, apiRouteManager, server
   const isVercel = preset === "vercel" || preset === "vercel-edge";
   const isCloudflareWorker = preset === "cloudflare-module";
   const outputDir = resolveDeployOutputPath(root, config.deploy.outputDir);
-  const runtimeServerOutputDir = isVercel ? path6.join(outputDir, "functions", "__nitro.func") : path6.join(outputDir, "server");
-  const ssrOutputDir = path6.join(root, distDir, "ssr");
+  const runtimeServerOutputDir = isVercel ? path8.join(outputDir, "functions", "__nitro.func") : path8.join(outputDir, "server");
+  const ssrOutputDir = path8.join(root, distDir, "ssr");
   const imageRuntime = resolveImageRuntime(config, preset);
   const hasGeneratedMetadataImages = Array.from(routeManager.getMetadataImages().values()).some(
     (image) => image.sourceType === "module"
@@ -9654,12 +9803,22 @@ async function buildNitroUniversal(config, routeManager, apiRouteManager, server
   }
   const scheduledTasks = mergeScheduledTasks(farmWorkflows.scheduledTasks, farmCron.scheduledTasks);
   const cloudflareCronConfig = createFarmCronCloudflareConfig(farmCron.jobs);
-  const [clientCssHref, clientJsSrc] = await Promise.all([
+  const [clientCssHref, clientJsSrc, docsModulePreloads, clientModulePreloads] = await Promise.all([
     resolveHashedClientCssHref(clientOutputDir),
-    resolveHashedClientJsSrc(clientOutputDir)
+    resolveHashedClientJsSrc(clientOutputDir),
+    readFarmDocsModulePreloads(path8.join(root, distDir)),
+    readFarmClientModulePreloads(path8.join(root, distDir))
   ]);
+  const encodedDocsModulePreloads = encodeFarmDocsModulePreloads(docsModulePreloads);
+  const encodedClientModulePreloads = encodeFarmClientModulePreloads(clientModulePreloads);
   for (const output of Object.values(ssrBundle)) {
     if (output.type !== "chunk") continue;
+    if (output.code.includes(FARM_DOCS_MODULE_PRELOADS_PLACEHOLDER)) {
+      output.code = output.code.split(FARM_DOCS_MODULE_PRELOADS_PLACEHOLDER).join(encodedDocsModulePreloads);
+    }
+    if (output.code.includes(FARM_CLIENT_MODULE_PRELOADS_PLACEHOLDER)) {
+      output.code = output.code.split(FARM_CLIENT_MODULE_PRELOADS_PLACEHOLDER).join(encodedClientModulePreloads);
+    }
     if (output.code.includes(FARM_CLIENT_CSS_HREF_PLACEHOLDER)) {
       output.code = output.code.split(FARM_CLIENT_CSS_HREF_PLACEHOLDER).join(clientCssHref);
     }
@@ -9667,13 +9826,13 @@ async function buildNitroUniversal(config, routeManager, apiRouteManager, server
       output.code = output.code.split(FARM_CLIENT_JS_SRC_PLACEHOLDER).join(clientJsSrc);
     }
   }
-  await fs.mkdir(ssrOutputDir, { recursive: true });
+  await fs3.mkdir(ssrOutputDir, { recursive: true });
   for (const [fileName, output] of Object.entries(ssrBundle)) {
-    const filePath = path6.join(ssrOutputDir, fileName);
-    await fs.mkdir(path6.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, output.type === "chunk" ? output.code : output.source);
+    const filePath = path8.join(ssrOutputDir, fileName);
+    await fs3.mkdir(path8.dirname(filePath), { recursive: true });
+    await fs3.writeFile(filePath, output.type === "chunk" ? output.code : output.source);
   }
-  const nitroEntryPath = path6.join(ssrOutputDir, "nitro-entry.mjs");
+  const nitroEntryPath = path8.join(ssrOutputDir, "nitro-entry.mjs");
   const nodeAdapterModule = preset === "node-server" ? resolveNitroRuntimeDependency(root, "srvx/node") : null;
   const nitroEntryCode = `
 // Farm.js Nitro Entry
@@ -9825,26 +9984,26 @@ function toFarmNodeResponse(request, response) {
   })
 }` : ""}
   `.trim();
-  await fs.writeFile(nitroEntryPath, nitroEntryCode);
-  const farmNodeServerEntryPath = preset === "node-server" ? path6.join(ssrOutputDir, "farm-node-server-entry.mjs") : null;
+  await fs3.writeFile(nitroEntryPath, nitroEntryCode);
+  const farmNodeServerEntryPath = preset === "node-server" ? path8.join(ssrOutputDir, "farm-node-server-entry.mjs") : null;
   if (farmNodeServerEntryPath && nodeAdapterModule) {
-    await fs.writeFile(
-      path6.join(ssrOutputDir, FARM_NODE_ENV_MODULE_FILE),
+    await fs3.writeFile(
+      path8.join(ssrOutputDir, FARM_NODE_ENV_MODULE_FILE),
       FARM_NODE_ENV_MODULE_SOURCE
     );
-    await fs.writeFile(
+    await fs3.writeFile(
       farmNodeServerEntryPath,
       createFarmNodeServerEntry({
-        nitroEntryFile: path6.basename(nitroEntryPath),
+        nitroEntryFile: path8.basename(nitroEntryPath),
         nodeAdapterModule,
         server: config.server,
         websocketAdapterModule: resolveNitroRuntimeDependency(root, "crossws/adapters/node")
       })
     );
   }
-  const farmNetlifyEntryPath = preset === "netlify" ? path6.join(ssrOutputDir, "farm-netlify-entry.mjs") : null;
+  const farmNetlifyEntryPath = preset === "netlify" ? path8.join(ssrOutputDir, "farm-netlify-entry.mjs") : null;
   if (farmNetlifyEntryPath) {
-    await fs.writeFile(
+    await fs3.writeFile(
       farmNetlifyEntryPath,
       createFarmNetlifyEntry({
         nitroNetlifyEntry: resolveNitroNetlifyEntry(resolveNitroPackageEntry(root))
@@ -9884,7 +10043,7 @@ function toFarmNodeResponse(request, response) {
     // `src` directory), as Nitro handlers outside Farm's aliases.
     serverDir: false,
     serverEntry: false,
-    buildDir: path6.join(root, distDir, ".nitro"),
+    buildDir: path8.join(root, distDir, ".nitro"),
     alias: resolveNitroInternalRuntimeAliases(root),
     compatibilityDate: "2024-12-01",
     output: resolveFarmNitroOutputConfig(preset, outputDir),
@@ -9960,7 +10119,7 @@ function toFarmNodeResponse(request, response) {
   if (pluginManager) {
     nitroConfig = await pluginManager.runHookSerial("beforeNitroBuild", nitroConfig);
   }
-  const expectedServerDir = path6.join(outputDir, "server");
+  const expectedServerDir = path8.join(outputDir, "server");
   const customRollupKeys = Object.keys(nitroConfig.rollupConfig || {}).filter(
     (key) => key !== "external" && key !== "plugins"
   );
@@ -9973,9 +10132,9 @@ function toFarmNodeResponse(request, response) {
     snapshotSSRRebundleOptions(nitroConfig)
   );
   const requestedBuilder = nitroConfig.builder ?? process.env.NITRO_BUILDER;
-  const canReusePrebuiltSSR = isPrebuiltSSRCandidate && nitroConfig.preset === "node-server" && (requestedBuilder === void 0 || requestedBuilder === "rollup" || requestedBuilder === "rolldown") && nitroConfig.sourcemap === false && !hasCustomOxcOptions && !hasLateBuildMutationConfig && !hasUnsupportedSSRRebundleOverrides && nitroConfig.rollupConfig?.external === nitroRollupExternal && !hasRollupPlugins(nitroConfig.rollupConfig?.plugins) && customRollupKeys.length === 0 && path6.resolve(nitroConfig.output?.serverDir || "") === path6.resolve(expectedServerDir) && Boolean(
+  const canReusePrebuiltSSR = isPrebuiltSSRCandidate && nitroConfig.preset === "node-server" && (requestedBuilder === void 0 || requestedBuilder === "rollup" || requestedBuilder === "rolldown") && nitroConfig.sourcemap === false && !hasCustomOxcOptions && !hasLateBuildMutationConfig && !hasUnsupportedSSRRebundleOverrides && nitroConfig.rollupConfig?.external === nitroRollupExternal && !hasRollupPlugins(nitroConfig.rollupConfig?.plugins) && customRollupKeys.length === 0 && path8.resolve(nitroConfig.output?.serverDir || "") === path8.resolve(expectedServerDir) && Boolean(
     nitroConfig.handlers?.some(
-      (handler) => path6.resolve(handler?.handler || "") === nitroEntryPath
+      (handler) => path8.resolve(handler?.handler || "") === nitroEntryPath
     )
   );
   const selectRolldownBuilder = canReusePrebuiltSSR && requestedBuilder === void 0 && await canUseRolldownBuilder();
@@ -10062,14 +10221,14 @@ function toFarmNodeResponse(request, response) {
         });
       }
       prerenderer.hooks.hook("compiled", async () => {
-        const prerenderServerDir = path6.join(outputDir, "server");
+        const prerenderServerDir = path8.join(outputDir, "server");
         await copyPrebuiltSSRBundle(
           ssrBundle,
-          path6.join(prerenderServerDir, FARM_SSR_OUTPUT_DIR),
+          path8.join(prerenderServerDir, FARM_SSR_OUTPUT_DIR),
           null,
-          fs
+          fs3
         );
-        await registerPrebuiltSSRPackageImport(prerenderServerDir, ssrEntryFile, fs);
+        await registerPrebuiltSSRPackageImport(prerenderServerDir, ssrEntryFile, fs3);
       });
     });
   }
@@ -10100,7 +10259,7 @@ function toFarmNodeResponse(request, response) {
       else process.env[FARM_PRERENDER_ENV] = previousPrerender;
     }
   }
-  const sharpRuntimeStagePromise = imageRuntime === "node" ? stageSharpRuntime(config, root, distDir, fs, preset) : Promise.resolve(null);
+  const sharpRuntimeStagePromise = imageRuntime === "node" ? stageSharpRuntime(config, root, distDir, fs3, preset) : Promise.resolve(null);
   const prebuiltSSRFilesPromise = canReusePrebuiltSSR ? prepareSSRBundleFiles(
     ssrBundle,
     shouldMinify ? { keepNames: keepServerNames, target: "node18" } : null
@@ -10113,7 +10272,7 @@ function toFarmNodeResponse(request, response) {
   await nitroInstance.close();
   if (nitroBuildResult.status === "rejected") {
     if (sharpRuntimeStageResult.status === "fulfilled" && sharpRuntimeStageResult.value) {
-      await fs.rm(sharpRuntimeStageResult.value.stageDir, {
+      await fs3.rm(sharpRuntimeStageResult.value.stageDir, {
         recursive: true,
         force: true
       });
@@ -10126,20 +10285,20 @@ function toFarmNodeResponse(request, response) {
   if (prebuiltSSRFilesResult.status === "rejected") {
     throw prebuiltSSRFilesResult.reason;
   }
-  const stagedSharpRuntime = sharpRuntimeStageResult.value ?? (imageRuntime === "node" ? await stageSharpRuntime(config, root, distDir, fs, preset) : null);
+  const stagedSharpRuntime = sharpRuntimeStageResult.value ?? (imageRuntime === "node" ? await stageSharpRuntime(config, root, distDir, fs3, preset) : null);
   const runtimeCopyPromise = (async () => {
     if (stagedSharpRuntime) {
-      await installStagedSharpRuntime(stagedSharpRuntime, runtimeServerOutputDir, fs);
+      await installStagedSharpRuntime(stagedSharpRuntime, runtimeServerOutputDir, fs3);
     }
     if (useExternalMetadataImageRuntime) {
-      await copyMetadataImageRuntime(root, runtimeServerOutputDir, fs);
+      await copyMetadataImageRuntime(root, runtimeServerOutputDir, fs3);
     }
   })();
   const copyResults = await Promise.allSettled([
     prebuiltSSRFilesResult.value ? writeSSRBundleFiles(
       prebuiltSSRFilesResult.value,
-      path6.join(outputDir, "server", FARM_SSR_OUTPUT_DIR),
-      fs
+      path8.join(outputDir, "server", FARM_SSR_OUTPUT_DIR),
+      fs3
     ) : Promise.resolve(),
     runtimeCopyPromise
   ]);
@@ -10148,7 +10307,7 @@ function toFarmNodeResponse(request, response) {
   );
   if (failedCopy) throw failedCopy.reason;
   if (canReusePrebuiltSSR) {
-    await registerPrebuiltSSRPackageImport(path6.join(outputDir, "server"), ssrEntryFile, fs);
+    await registerPrebuiltSSRPackageImport(path8.join(outputDir, "server"), ssrEntryFile, fs3);
     logger.info("\u26A1 Reused Farm's prebuilt SSR bundle for the Node output");
   }
   if (useRolldownBuilder) {
@@ -10163,7 +10322,7 @@ function toFarmNodeResponse(request, response) {
     });
   }
   if (isVercel) {
-    await postProcessVercelOutput(root, outputDir, fs, config, farmWorkflows, routeRuntimeManifest);
+    await postProcessVercelOutput(root, outputDir, fs3, config, farmWorkflows, routeRuntimeManifest);
   }
   logger.success(`\u2705 Nitro build completed with preset: ${preset}`);
 }
@@ -10173,11 +10332,11 @@ function resolveFarmNitroOutputConfig(preset, outputDir) {
   return {
     dir: outputDir,
     ...preset === "node-server" ? {
-      serverDir: path6.join(outputDir, "server"),
-      publicDir: path6.join(outputDir, "public")
+      serverDir: path8.join(outputDir, "server"),
+      publicDir: path8.join(outputDir, "public")
     } : isVercel ? {
-      serverDir: path6.join(outputDir, "functions", "__nitro.func"),
-      publicDir: path6.join(outputDir, "static")
+      serverDir: path8.join(outputDir, "functions", "__nitro.func"),
+      publicDir: path8.join(outputDir, "static")
     } : {}
   };
 }
@@ -10191,24 +10350,24 @@ function prepareSSRBundleFiles(ssrBundle, minifyOptions) {
   );
 }
 __name(prepareSSRBundleFiles, "prepareSSRBundleFiles");
-async function writeSSRBundleFiles(files, targetDir, fs) {
-  await fs.rm(targetDir, { recursive: true, force: true });
+async function writeSSRBundleFiles(files, targetDir, fs3) {
+  await fs3.rm(targetDir, { recursive: true, force: true });
   await Promise.all(
     files.map(async ({ fileName, contents }) => {
-      const targetPath = path6.join(targetDir, fileName);
-      await fs.mkdir(path6.dirname(targetPath), { recursive: true });
-      await fs.writeFile(targetPath, contents);
+      const targetPath = path8.join(targetDir, fileName);
+      await fs3.mkdir(path8.dirname(targetPath), { recursive: true });
+      await fs3.writeFile(targetPath, contents);
     })
   );
 }
 __name(writeSSRBundleFiles, "writeSSRBundleFiles");
-async function copyPrebuiltSSRBundle(ssrBundle, targetDir, minifyOptions, fs) {
-  await writeSSRBundleFiles(await prepareSSRBundleFiles(ssrBundle, minifyOptions), targetDir, fs);
+async function copyPrebuiltSSRBundle(ssrBundle, targetDir, minifyOptions, fs3) {
+  await writeSSRBundleFiles(await prepareSSRBundleFiles(ssrBundle, minifyOptions), targetDir, fs3);
 }
 __name(copyPrebuiltSSRBundle, "copyPrebuiltSSRBundle");
-async function registerPrebuiltSSRPackageImport(serverDir, ssrEntryFile, fs) {
-  const packagePath = path6.join(serverDir, "package.json");
-  const packageJSON = await fs.readFile(packagePath, "utf8").then((contents) => JSON.parse(contents)).catch((error) => {
+async function registerPrebuiltSSRPackageImport(serverDir, ssrEntryFile, fs3) {
+  const packagePath = path8.join(serverDir, "package.json");
+  const packageJSON = await fs3.readFile(packagePath, "utf8").then((contents) => JSON.parse(contents)).catch((error) => {
     if (error.code === "ENOENT") return { type: "module" };
     throw error;
   });
@@ -10218,14 +10377,14 @@ async function registerPrebuiltSSRPackageImport(serverDir, ssrEntryFile, fs) {
     ...existingImports,
     [FARM_SSR_PACKAGE_IMPORT]: `./${outputEntry}`
   };
-  await fs.mkdir(serverDir, { recursive: true });
-  await fs.writeFile(packagePath, `${JSON.stringify(packageJSON, null, 2)}
+  await fs3.mkdir(serverDir, { recursive: true });
+  await fs3.writeFile(packagePath, `${JSON.stringify(packageJSON, null, 2)}
 `);
 }
 __name(registerPrebuiltSSRPackageImport, "registerPrebuiltSSRPackageImport");
-async function moveVercelOutputPath(src, dest, fs) {
+async function moveVercelOutputPath(src, dest, fs3) {
   try {
-    await fs.rename(src, dest);
+    await fs3.rename(src, dest);
     return;
   } catch (error) {
     const code = error?.code;
@@ -10233,39 +10392,39 @@ async function moveVercelOutputPath(src, dest, fs) {
       throw error;
     }
   }
-  await fs.cp(src, dest, { recursive: true, force: true });
-  await fs.rm(src, { recursive: true, force: true });
+  await fs3.cp(src, dest, { recursive: true, force: true });
+  await fs3.rm(src, { recursive: true, force: true });
 }
 __name(moveVercelOutputPath, "moveVercelOutputPath");
-async function postProcessVercelOutput(root, outputDir, fs, config, farmWorkflows, routeRuntimeManifest) {
-  const serverDir = path6.join(outputDir, "server");
-  const functionsDir = path6.join(outputDir, "functions");
-  const nitroFuncDir = path6.join(functionsDir, "__nitro.func");
-  const staticDir = path6.join(outputDir, "static");
-  const publicDir = path6.join(outputDir, "public");
-  await fs.mkdir(nitroFuncDir, { recursive: true });
-  const serverContents = await fs.readdir(serverDir).catch((error) => {
+async function postProcessVercelOutput(root, outputDir, fs3, config, farmWorkflows, routeRuntimeManifest) {
+  const serverDir = path8.join(outputDir, "server");
+  const functionsDir = path8.join(outputDir, "functions");
+  const nitroFuncDir = path8.join(functionsDir, "__nitro.func");
+  const staticDir = path8.join(outputDir, "static");
+  const publicDir = path8.join(outputDir, "public");
+  await fs3.mkdir(nitroFuncDir, { recursive: true });
+  const serverContents = await fs3.readdir(serverDir).catch((error) => {
     if (error.code === "ENOENT") return [];
     throw error;
   });
   for (const file of serverContents) {
-    await moveVercelOutputPath(path6.join(serverDir, file), path6.join(nitroFuncDir, file), fs);
+    await moveVercelOutputPath(path8.join(serverDir, file), path8.join(nitroFuncDir, file), fs3);
   }
-  if (serverContents.length > 0) await fs.rm(serverDir, { recursive: true, force: true });
+  if (serverContents.length > 0) await fs3.rm(serverDir, { recursive: true, force: true });
   try {
-    await moveVercelOutputPath(publicDir, staticDir, fs);
+    await moveVercelOutputPath(publicDir, staticDir, fs3);
   } catch (error) {
     if (error?.code !== "ENOENT") throw error;
   }
-  await copyFarmDocsContentForVercel(config, root, nitroFuncDir, fs);
-  await copyPrismaClientForVercel(root, nitroFuncDir, fs);
-  const configPath = path6.join(outputDir, "config.json");
-  const configContent = await fs.readFile(configPath, "utf-8");
+  await copyFarmDocsContentForVercel(config, root, nitroFuncDir, fs3);
+  await copyPrismaClientForVercel(root, nitroFuncDir, fs3);
+  const configPath = path8.join(outputDir, "config.json");
+  const configContent = await fs3.readFile(configPath, "utf-8");
   const vercelConfig = JSON.parse(configContent);
   const runtimeRoutes = await createFarmVercelRouteRuntimeFunctions(
     outputDir,
     routeRuntimeManifest,
-    fs,
+    fs3,
     config.basePath
   );
   vercelConfig.routes = buildFarmVercelRoutes({
@@ -10280,29 +10439,29 @@ async function postProcessVercelOutput(root, outputDir, fs, config, farmWorkflow
     vercelConfigWithWorkflowCrons,
     config.cron.jobs
   );
-  await fs.writeFile(configPath, JSON.stringify(vercelConfigWithCrons, null, 2));
+  await fs3.writeFile(configPath, JSON.stringify(vercelConfigWithCrons, null, 2));
   logger.info("\u2705 Post-processed Vercel output for Build Output API v3");
 }
 __name(postProcessVercelOutput, "postProcessVercelOutput");
-async function copyFarmDocsContentForVercel(config, root, nitroFuncDir, fs) {
+async function copyFarmDocsContentForVercel(config, root, nitroFuncDir, fs3) {
   const docsContentDir = resolveBuildDocsContentDir(config, root);
   if (!docsContentDir) return;
-  const bundledContentDir = path6.join(nitroFuncDir, "farm-docs-content");
+  const bundledContentDir = path8.join(nitroFuncDir, "farm-docs-content");
   const lastModifiedManifest = createFarmDocsLastModifiedManifest(docsContentDir, {
     fallback: "now"
   });
-  await fs.rm(bundledContentDir, { recursive: true, force: true });
-  await fs.mkdir(path6.dirname(bundledContentDir), { recursive: true });
-  await fs.cp(docsContentDir, bundledContentDir, {
+  await fs3.rm(bundledContentDir, { recursive: true, force: true });
+  await fs3.mkdir(path8.dirname(bundledContentDir), { recursive: true });
+  await fs3.cp(docsContentDir, bundledContentDir, {
     recursive: true,
     force: true
   });
-  await fs.writeFile(
-    path6.join(bundledContentDir, FARM_DOCS_LAST_MODIFIED_MANIFEST),
+  await fs3.writeFile(
+    path8.join(bundledContentDir, FARM_DOCS_LAST_MODIFIED_MANIFEST),
     `${JSON.stringify(lastModifiedManifest, null, 2)}
 `
   );
-  logger.info(`\u{1F4DA} Bundled docs content for Vercel: ${path6.relative(root, docsContentDir)}`);
+  logger.info(`\u{1F4DA} Bundled docs content for Vercel: ${path8.relative(root, docsContentDir)}`);
 }
 __name(copyFarmDocsContentForVercel, "copyFarmDocsContentForVercel");
 function resolveServerFunctionPlatform(preset) {
@@ -10321,9 +10480,9 @@ function platformFieldAllows(field, value) {
   return allowed.length === 0 || allowed.includes(value);
 }
 __name(platformFieldAllows, "platformFieldAllows");
-async function stageSharpRuntime(config, root, distDir, fs, preset) {
+async function stageSharpRuntime(config, root, distDir, fs3, preset) {
   const functionPlatform = resolveServerFunctionPlatform(preset);
-  const projectRequire = createRequire(path6.join(root, "package.json"));
+  const projectRequire = createRequire(path8.join(root, "package.json"));
   let sharpRequire = projectRequire;
   if (!resolvePackageJson(projectRequire, "sharp")) {
     try {
@@ -10333,10 +10492,10 @@ async function stageSharpRuntime(config, root, distDir, fs, preset) {
   }
   const copiedPackages = /* @__PURE__ */ new Map();
   const packageCopies = /* @__PURE__ */ new Map();
-  const stageRoot = path6.join(root, distDir, "tmp");
-  await fs.mkdir(stageRoot, { recursive: true });
-  const stageDir = await fs.mkdtemp(path6.join(stageRoot, "sharp-runtime-"));
-  const targetNodeModules = path6.join(stageDir, "node_modules");
+  const stageRoot = path8.join(root, distDir, "tmp");
+  await fs3.mkdir(stageRoot, { recursive: true });
+  const stageDir = await fs3.mkdtemp(path8.join(stageRoot, "sharp-runtime-"));
+  const targetNodeModules = path8.join(stageDir, "node_modules");
   function copyPackage(packageName, parentRequire) {
     const activeCopy = packageCopies.get(packageName);
     if (activeCopy) return activeCopy;
@@ -10348,19 +10507,19 @@ async function stageSharpRuntime(config, root, distDir, fs, preset) {
   async function copyPackageOnce(packageName, parentRequire) {
     const packageJsonPath = resolvePackageJson(parentRequire, packageName);
     if (!packageJsonPath) return;
-    const packageJson = JSON.parse(await fs.readFile(packageJsonPath, "utf8"));
+    const packageJson = JSON.parse(await fs3.readFile(packageJsonPath, "utf8"));
     if (functionPlatform && !packageSupportsPlatform(packageJson, functionPlatform)) return;
-    const packageDir = path6.dirname(packageJsonPath);
-    const targetDir = path6.join(targetNodeModules, ...packageName.split("/"));
+    const packageDir = path8.dirname(packageJsonPath);
+    const targetDir = path8.join(targetNodeModules, ...packageName.split("/"));
     copiedPackages.set(packageName, String(packageJson.version || "*"));
-    await fs.mkdir(path6.dirname(targetDir), { recursive: true });
+    await fs3.mkdir(path8.dirname(targetDir), { recursive: true });
     const packageRequire = createRequire(packageJsonPath);
     const dependencies = {
       ...packageJson.dependencies,
       ...packageJson.optionalDependencies
     };
     await settleAllOrThrow([
-      fs.cp(packageDir, targetDir, {
+      fs3.cp(packageDir, targetDir, {
         recursive: true,
         force: true,
         dereference: true,
@@ -10378,7 +10537,7 @@ async function stageSharpRuntime(config, root, distDir, fs, preset) {
       throw new Error(`Farm image optimization requires sharp. ${SHARP_INSTALL_HINT}`);
     }
   } catch (error) {
-    await fs.rm(stageDir, { recursive: true, force: true });
+    await fs3.rm(stageDir, { recursive: true, force: true });
     throw error;
   }
   return {
@@ -10389,19 +10548,19 @@ async function stageSharpRuntime(config, root, distDir, fs, preset) {
   };
 }
 __name(stageSharpRuntime, "stageSharpRuntime");
-async function installStagedSharpRuntime(staged, nitroFuncDir, fs) {
-  const stagedNodeModules = path6.join(staged.stageDir, "node_modules");
-  const targetNodeModules = path6.join(nitroFuncDir, "node_modules");
+async function installStagedSharpRuntime(staged, nitroFuncDir, fs3) {
+  const stagedNodeModules = path8.join(staged.stageDir, "node_modules");
+  const targetNodeModules = path8.join(nitroFuncDir, "node_modules");
   try {
-    await mergeStagedDirectory(stagedNodeModules, targetNodeModules, fs);
-    const functionPackage = await readNitroOutputPackage(nitroFuncDir, fs);
+    await mergeStagedDirectory(stagedNodeModules, targetNodeModules, fs3);
+    const functionPackage = await readNitroOutputPackage(nitroFuncDir, fs3);
     functionPackage.dependencies = {
       ...functionPackage.dependencies,
       ...staged.dependencies
     };
-    await writeNitroOutputPackage(nitroFuncDir, functionPackage, fs);
+    await writeNitroOutputPackage(nitroFuncDir, functionPackage, fs3);
   } finally {
-    await fs.rm(staged.stageDir, { recursive: true, force: true });
+    await fs3.rm(staged.stageDir, { recursive: true, force: true });
   }
   logger.info(
     `\u{1F5BC}\uFE0F  Bundled Sharp image runtime (${Object.keys(staged.dependencies).length} packages)`
@@ -10416,15 +10575,15 @@ async function settleAllOrThrow(operations) {
   if (failure) throw failure.reason;
 }
 __name(settleAllOrThrow, "settleAllOrThrow");
-async function mergeStagedDirectory(sourceDir, targetDir, fs) {
-  await fs.mkdir(targetDir, { recursive: true });
-  const entries = await fs.readdir(sourceDir, { withFileTypes: true });
+async function mergeStagedDirectory(sourceDir, targetDir, fs3) {
+  await fs3.mkdir(targetDir, { recursive: true });
+  const entries = await fs3.readdir(sourceDir, { withFileTypes: true });
   await settleAllOrThrow(
     entries.map(async (entry) => {
-      const sourcePath = path6.join(sourceDir, entry.name);
-      const targetPath = path6.join(targetDir, entry.name);
+      const sourcePath = path8.join(sourceDir, entry.name);
+      const targetPath = path8.join(targetDir, entry.name);
       try {
-        await fs.rename(sourcePath, targetPath);
+        await fs3.rename(sourcePath, targetPath);
         return;
       } catch (error) {
         const code = error.code;
@@ -10433,16 +10592,16 @@ async function mergeStagedDirectory(sourceDir, targetDir, fs) {
         }
       }
       if (entry.isDirectory()) {
-        await mergeStagedDirectory(sourcePath, targetPath, fs);
-        await fs.rm(sourcePath, { recursive: true, force: true });
+        await mergeStagedDirectory(sourcePath, targetPath, fs3);
+        await fs3.rm(sourcePath, { recursive: true, force: true });
         return;
       }
-      await fs.cp(sourcePath, targetPath, {
+      await fs3.cp(sourcePath, targetPath, {
         force: true,
         dereference: true,
         mode: fsConstants.COPYFILE_FICLONE
       });
-      await fs.rm(sourcePath, { force: true });
+      await fs3.rm(sourcePath, { force: true });
     })
   );
 }
@@ -10450,14 +10609,14 @@ __name(mergeStagedDirectory, "mergeStagedDirectory");
 function assertMetadataImageRuntimeInstalled(root, metadataImageRoutes) {
   const generated = metadataImageRoutes.find((image) => image.sourceType === "module");
   if (!generated || resolveMetadataImageRuntimePackageJson(root)) return;
-  const file = generated.modulePath ? toPosixPath(path6.relative(root, generated.modulePath)) : "";
+  const file = generated.modulePath ? toPosixPath(path8.relative(root, generated.modulePath)) : "";
   throw new Error(
     `${file || "A generated metadata image"} renders with @vercel/og, which is not installed. ${VERCEL_OG_INSTALL_HINT}`
   );
 }
 __name(assertMetadataImageRuntimeInstalled, "assertMetadataImageRuntimeInstalled");
 function resolveMetadataImageRuntimePackageJson(root) {
-  const projectRequire = createRequire(path6.join(root, "package.json"));
+  const projectRequire = createRequire(path8.join(root, "package.json"));
   const packageJsonPath = resolvePackageJson(projectRequire, "@vercel/og");
   if (packageJsonPath) return packageJsonPath;
   try {
@@ -10467,40 +10626,40 @@ function resolveMetadataImageRuntimePackageJson(root) {
   }
 }
 __name(resolveMetadataImageRuntimePackageJson, "resolveMetadataImageRuntimePackageJson");
-async function copyMetadataImageRuntime(root, nitroFuncDir, fs) {
+async function copyMetadataImageRuntime(root, nitroFuncDir, fs3) {
   const packageJsonPath = resolveMetadataImageRuntimePackageJson(root);
   if (!packageJsonPath) return;
-  const packageJson = JSON.parse(await fs.readFile(packageJsonPath, "utf8"));
-  const packageDir = path6.dirname(packageJsonPath);
-  const targetDir = path6.join(nitroFuncDir, "node_modules", "@vercel", "og");
-  await fs.mkdir(path6.dirname(targetDir), { recursive: true });
-  await fs.cp(packageDir, targetDir, {
+  const packageJson = JSON.parse(await fs3.readFile(packageJsonPath, "utf8"));
+  const packageDir = path8.dirname(packageJsonPath);
+  const targetDir = path8.join(nitroFuncDir, "node_modules", "@vercel", "og");
+  await fs3.mkdir(path8.dirname(targetDir), { recursive: true });
+  await fs3.cp(packageDir, targetDir, {
     recursive: true,
     force: true,
     dereference: true,
     mode: fsConstants.COPYFILE_FICLONE
   });
-  const functionPackage = await readNitroOutputPackage(nitroFuncDir, fs);
+  const functionPackage = await readNitroOutputPackage(nitroFuncDir, fs3);
   functionPackage.dependencies = {
     ...functionPackage.dependencies,
     "@vercel/og": String(packageJson.version || "0.11.1")
   };
-  await writeNitroOutputPackage(nitroFuncDir, functionPackage, fs);
+  await writeNitroOutputPackage(nitroFuncDir, functionPackage, fs3);
   logger.info("\u{1F5BC}\uFE0F  Bundled generated metadata image runtime");
 }
 __name(copyMetadataImageRuntime, "copyMetadataImageRuntime");
-async function readNitroOutputPackage(outputDir, fs) {
-  const packagePath = path6.join(outputDir, "package.json");
-  return fs.readFile(packagePath, "utf8").then((contents) => JSON.parse(contents)).catch((error) => {
+async function readNitroOutputPackage(outputDir, fs3) {
+  const packagePath = path8.join(outputDir, "package.json");
+  return fs3.readFile(packagePath, "utf8").then((contents) => JSON.parse(contents)).catch((error) => {
     if (error.code === "ENOENT") return {};
     throw error;
   });
 }
 __name(readNitroOutputPackage, "readNitroOutputPackage");
-async function writeNitroOutputPackage(outputDir, packageJson, fs) {
-  await fs.mkdir(outputDir, { recursive: true });
-  await fs.writeFile(
-    path6.join(outputDir, "package.json"),
+async function writeNitroOutputPackage(outputDir, packageJson, fs3) {
+  await fs3.mkdir(outputDir, { recursive: true });
+  await fs3.writeFile(
+    path8.join(outputDir, "package.json"),
     `${JSON.stringify(packageJson, null, 2)}
 `
   );
@@ -10517,9 +10676,9 @@ function resolvePackageJson(parentRequire, packageName) {
     }
   }
   try {
-    let directory = path6.dirname(metadataModule ?? parentRequire.resolve(packageName));
-    while (directory !== path6.dirname(directory)) {
-      const candidate = path6.join(directory, "package.json");
+    let directory = path8.dirname(metadataModule ?? parentRequire.resolve(packageName));
+    while (directory !== path8.dirname(directory)) {
+      const candidate = path8.join(directory, "package.json");
       if (existsSync2(candidate)) {
         try {
           const manifest = JSON.parse(readFileSync(candidate, "utf8"));
@@ -10527,55 +10686,79 @@ function resolvePackageJson(parentRequire, packageName) {
         } catch {
         }
       }
-      if (path6.basename(directory) === "node_modules") break;
-      directory = path6.dirname(directory);
+      if (path8.basename(directory) === "node_modules") break;
+      directory = path8.dirname(directory);
     }
   } catch {
   }
   return null;
 }
 __name(resolvePackageJson, "resolvePackageJson");
-async function copyPrismaClientForVercel(root, nitroFuncDir, fs) {
-  const projectRequire = createRequire(path6.join(root, "package.json"));
+async function copyPrismaClientForVercel(root, nitroFuncDir, fs3) {
+  const projectRequire = createRequire(path8.join(root, "package.json"));
   let prismaClientDir;
   try {
-    prismaClientDir = path6.dirname(projectRequire.resolve("@prisma/client/default.js"));
+    prismaClientDir = path8.dirname(projectRequire.resolve("@prisma/client/default.js"));
   } catch {
     return;
   }
-  const generatedClientDir = path6.join(prismaClientDir, "..", "..", ".prisma", "client");
+  const generatedClientDir = path8.join(prismaClientDir, "..", "..", ".prisma", "client");
   try {
-    await fs.access(generatedClientDir);
+    await fs3.access(generatedClientDir);
   } catch {
     return;
   }
-  const targetNodeModules = path6.join(nitroFuncDir, "node_modules");
-  const targetPrismaScopeDir = path6.join(targetNodeModules, "@prisma");
-  const targetGeneratedDir = path6.join(targetNodeModules, ".prisma", "client");
-  const targetClientDir = path6.join(targetPrismaScopeDir, "client");
-  await fs.mkdir(targetPrismaScopeDir, { recursive: true });
-  await fs.cp(prismaClientDir, targetClientDir, {
+  const targetNodeModules = path8.join(nitroFuncDir, "node_modules");
+  const targetPrismaScopeDir = path8.join(targetNodeModules, "@prisma");
+  const targetGeneratedDir = path8.join(targetNodeModules, ".prisma", "client");
+  const targetClientDir = path8.join(targetPrismaScopeDir, "client");
+  await fs3.mkdir(targetPrismaScopeDir, { recursive: true });
+  await fs3.cp(prismaClientDir, targetClientDir, {
     recursive: true,
     force: true
   });
-  await fs.cp(generatedClientDir, targetGeneratedDir, {
+  await fs3.cp(generatedClientDir, targetGeneratedDir, {
     recursive: true,
     force: true
   });
-  const clientPackagePath = path6.join(prismaClientDir, "package.json");
+  const clientPackagePath = path8.join(prismaClientDir, "package.json");
   const [functionPackage, clientPackageContent] = await Promise.all([
-    readNitroOutputPackage(nitroFuncDir, fs),
-    fs.readFile(clientPackagePath, "utf-8")
+    readNitroOutputPackage(nitroFuncDir, fs3),
+    fs3.readFile(clientPackagePath, "utf-8")
   ]);
   const clientPackage = JSON.parse(clientPackageContent);
   functionPackage.dependencies = {
     ...functionPackage.dependencies,
     "@prisma/client": clientPackage.version
   };
-  await writeNitroOutputPackage(nitroFuncDir, functionPackage, fs);
+  await writeNitroOutputPackage(nitroFuncDir, functionPackage, fs3);
 }
 __name(copyPrismaClientForVercel, "copyPrismaClientForVercel");
 
+// src/build/project-module-runner.ts
+async function createFarmProjectModuleSsrEnvironment() {
+  const vite = await import("vite");
+  const { ModuleRunner, createNodeImportMeta } = await import("vite/module-runner");
+  return {
+    dev: {
+      createEnvironment(name, config) {
+        return vite.createRunnableDevEnvironment(name, config, {
+          runner: /* @__PURE__ */ __name((environment) => new ModuleRunner({
+            transport: {
+              ...vite.createServerModuleRunnerTransport({ channel: environment.hot }),
+              timeout: 0
+            },
+            hmr: false,
+            createImportMeta: createNodeImportMeta,
+            sourcemapInterceptor: "node"
+          }), "runner")
+        });
+      }
+    }
+  };
+}
+__name(createFarmProjectModuleSsrEnvironment, "createFarmProjectModuleSsrEnvironment");
+
 // src/build/index.ts
 async function build(config, options = {}) {
   return withProductionNodeEnv(() => buildWithProductionNodeEnv(config, options));
@@ -10721,9 +10904,9 @@ async function buildWithProductionNodeEnv(inputConfig, options) {
     } else {
       const { build: legacyViteBuild } = await import("vite");
       logger.info("\u{1F4E6} Building client bundle...");
-      await buildClient2(legacyViteBuild, config, root, srcDir, path7.join(root, distDir, "client"));
+      await buildClient2(legacyViteBuild, config, root, srcDir, path9.join(root, distDir, "client"));
       logger.info("\u{1F4E6} Building SSR bundle...");
-      await buildSSR(legacyViteBuild, config, root, srcDir, path7.join(root, distDir, "server"));
+      await buildSSR(legacyViteBuild, config, root, srcDir, path9.join(root, distDir, "server"));
       logger.info(`\u{1F680} Building server with Nitro (preset: ${preset})...`);
       await buildNitro(
         config,
@@ -10836,6 +11019,14 @@ async function createProjectModuleServer(createViteServer, config, root, buildLi
     optimizeDeps: {
       ...viteConfig.optimizeDeps,
       noDiscovery: true
+    },
+    // An app or plugin that brings its own SSR environment keeps it.
+    environments: viteConfig.environments?.ssr?.dev?.createEnvironment ? viteConfig.environments : {
+      ...viteConfig.environments,
+      ssr: {
+        ...viteConfig.environments?.ssr,
+        ...await createFarmProjectModuleSsrEnvironment()
+      }
     }
   });
 }
@@ -10903,12 +11094,12 @@ async function buildSSR(viteBuild, config, root, srcDir, outputDir) {
 }
 __name(buildSSR, "buildSSR");
 function resolveLegacyPageEntry(config, root, srcDir) {
-  const appDir = path7.join(root, srcDir, "app");
+  const appDir = path9.join(root, srcDir, "app");
   for (const extension of getFarmRendererComponentExtensions(config.renderer)) {
-    const candidate = path7.join(appDir, `page${extension}`);
+    const candidate = path9.join(appDir, `page${extension}`);
     if (existsSync3(candidate)) return candidate;
   }
-  return path7.join(appDir, "page.tsx");
+  return path9.join(appDir, "page.tsx");
 }
 __name(resolveLegacyPageEntry, "resolveLegacyPageEntry");
 async function buildNitro(config, routeManager, apiRouteManager, serverRenderer, preset, root, distDir, pluginManager) {
@@ -10927,23 +11118,23 @@ async function buildNitro(config, routeManager, apiRouteManager, serverRenderer,
     nitroConfig = await pluginManager.runHookSerial("beforeNitroBuild", nitroConfig);
   }
   const outputDir = resolveDeployOutputPath(root, config.deploy.outputDir);
-  const serverOutputDir = path7.join(outputDir, "server");
-  const publicOutputDir = path7.join(outputDir, "public");
+  const serverOutputDir = path9.join(outputDir, "server");
+  const publicOutputDir = path9.join(outputDir, "public");
   const { mkdir, cp } = await import("fs/promises");
   await mkdir(serverOutputDir, { recursive: true });
   await mkdir(publicOutputDir, { recursive: true });
-  const clientDir = path7.join(root, distDir, "client");
+  const clientDir = path9.join(root, distDir, "client");
   try {
     await mkdir(publicOutputDir, { recursive: true });
     await cp(clientDir, publicOutputDir, { recursive: true });
     logger.info("\u{1F4E6} Copied client assets to public directory");
-    const manifestPath = path7.join(publicOutputDir, "farm-client-manifest.json");
-    const assetsDir = path7.join(publicOutputDir, "assets");
+    const manifestPath = path9.join(publicOutputDir, "farm-client-manifest.json");
+    const assetsDir = path9.join(publicOutputDir, "assets");
     const manifestExists = await import("fs/promises").then(
-      (fs) => fs.access(manifestPath).then(() => true).catch(() => false)
+      (fs3) => fs3.access(manifestPath).then(() => true).catch(() => false)
     );
     const assetsExist = await import("fs/promises").then(
-      (fs) => fs.access(assetsDir).then(() => true).catch(() => false)
+      (fs3) => fs3.access(assetsDir).then(() => true).catch(() => false)
     );
     if (manifestExists && assetsExist) {
       logger.info("\u2705 Verified client assets are present");
@@ -10954,8 +11145,8 @@ async function buildNitro(config, routeManager, apiRouteManager, serverRenderer,
     logger.error(`\u274C Failed to copy client assets: ${error}`);
     throw error;
   }
-  const serverDir = path7.join(root, distDir, "server");
-  const nitroServerDir = path7.join(root, distDir, ".nitro", "server", "farm");
+  const serverDir = path9.join(root, distDir, "server");
+  const nitroServerDir = path9.join(root, distDir, ".nitro", "server", "farm");
   try {
     await mkdir(nitroServerDir, { recursive: true });
     await cp(serverDir, nitroServerDir, { recursive: true });
@@ -10964,7 +11155,7 @@ async function buildNitro(config, routeManager, apiRouteManager, serverRenderer,
     logger.warn(`Could not copy SSR bundles: ${error}`);
   }
   const nitro = await createNitro(nitroConfig);
-  const registryPath = path7.join(root, distDir, ".nitro", "server", "farm-registry.ts");
+  const registryPath = path9.join(root, distDir, ".nitro", "server", "farm-registry.ts");
   try {
     const { farmRegistry } = await import(
       /* @vite-ignore */
@@ -10981,7 +11172,7 @@ async function buildNitro(config, routeManager, apiRouteManager, serverRenderer,
     }
     farmRegistry.routePaths = routePaths;
     try {
-      const clientManifestPath = path7.join(root, distDir, "client", "farm-client-manifest.json");
+      const clientManifestPath = path9.join(root, distDir, "client", "farm-client-manifest.json");
       const { readFile } = await import("fs/promises");
       const manifestContent = await readFile(clientManifestPath, "utf-8");
       farmRegistry.clientManifest = JSON.parse(manifestContent);