@farm.js/core 0.1.37 → 0.1.38

package/dist/chunk-2ZYGC6SS.cjs

@@ -0,0 +1,576 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+
+var _chunkFJ3M4CUXcjs = require('./chunk-FJ3M4CUX.cjs');
+
+
+var _chunkULASELLAcjs = require('./chunk-ULASELLA.cjs');
+
+
+var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
+
+// src/security.ts
+function resolveFarmSecurityConfig(input) {
+  if (input === void 0) return { csp: false };
+  if (!isPlainRecord(input)) {
+    throw new TypeError("security must be an object containing the csp option.");
+  }
+  if (Object.prototype.hasOwnProperty.call(input, "contentSecurityPolicy")) {
+    throw new TypeError(
+      "security.contentSecurityPolicy is not supported. Use security.csp instead."
+    );
+  }
+  const csp = input.csp;
+  if (csp === void 0 || csp === false) return { csp: false };
+  if (typeof csp === "string") {
+    return {
+      csp: {
+        value: validateSerializedCsp(csp),
+        reportOnly: false,
+        nonce: false
+      }
+    };
+  }
+  if (!isPlainRecord(csp)) {
+    throw new TypeError("security.csp must be a policy string, false, or an options object.");
+  }
+  const reportOnly = validateReportOnly(csp.reportOnly);
+  const nonce = validateNonce(csp.nonce);
+  if (Object.prototype.hasOwnProperty.call(csp, "value")) {
+    if (Object.prototype.hasOwnProperty.call(csp, "policy") || Object.prototype.hasOwnProperty.call(csp, "directives")) {
+      throw new TypeError(
+        "Resolved security.csp values cannot include policy or directives options."
+      );
+    }
+    return {
+      csp: {
+        value: validateSerializedCsp(csp.value),
+        reportOnly,
+        nonce
+      }
+    };
+  }
+  const { policy, directives } = csp;
+  if (policy !== void 0 && directives !== void 0) {
+    throw new TypeError("security.csp accepts either policy or directives, not both.");
+  }
+  if (policy === void 0 && directives === void 0) {
+    throw new TypeError("security.csp requires a policy string or directives object.");
+  }
+  return {
+    csp: {
+      value: policy !== void 0 ? validateSerializedCsp(policy) : serializeFarmCspDirectives(directives),
+      reportOnly,
+      nonce
+    }
+  };
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, resolveFarmSecurityConfig, "resolveFarmSecurityConfig");
+function serializeFarmCspDirectives(directives) {
+  if (!isPlainRecord(directives)) {
+    throw new TypeError("security.csp.directives must be an object.");
+  }
+  const serialized = [];
+  const normalizedNames = /* @__PURE__ */ new Set();
+  for (const [configuredName, configuredValue] of Object.entries(directives)) {
+    if (configuredValue === false || configuredValue === null || configuredValue === void 0) {
+      continue;
+    }
+    const name = normalizeDirectiveName(configuredName);
+    if (normalizedNames.has(name)) {
+      throw new TypeError(`security.csp contains the duplicate directive ${JSON.stringify(name)}.`);
+    }
+    normalizedNames.add(name);
+    const values = configuredValue === true ? [] : (Array.isArray(configuredValue) ? configuredValue : [configuredValue]).map(
+      validateDirectiveValue
+    );
+    serialized.push(values.length > 0 ? `${name} ${values.join(" ")}` : name);
+  }
+  if (serialized.length === 0) {
+    throw new TypeError("security.csp.directives must contain at least one enabled directive.");
+  }
+  return serialized.join("; ");
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, serializeFarmCspDirectives, "serializeFarmCspDirectives");
+function getFarmSecurityHeader(security, nonce) {
+  if (!security.csp) return void 0;
+  if (security.csp.nonce && !nonce) return void 0;
+  return {
+    key: security.csp.reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy",
+    value: nonce ? applyFarmCspNonceToPolicy(security.csp.value, nonce) : security.csp.value
+  };
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, getFarmSecurityHeader, "getFarmSecurityHeader");
+function createFarmCspNonce(security) {
+  if (!security.csp || !security.csp.nonce) return void 0;
+  const bytes = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(bytes);
+  return Array.from(bytes, (value) => value.toString(16).padStart(2, "0")).join("");
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, createFarmCspNonce, "createFarmCspNonce");
+function applyFarmCspNonceToPolicy(policy, nonce) {
+  validateCspNonce(nonce);
+  return applyFarmCspScriptSourcesToPolicy(policy, [`'nonce-${nonce}'`]);
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, applyFarmCspNonceToPolicy, "applyFarmCspNonceToPolicy");
+function applyFarmCspHashesToPolicy(policy, hashes) {
+  const sources = hashes.map((hash) => {
+    if (!/^sha(?:256|384|512)-[A-Za-z0-9+/]+={0,2}$/.test(hash)) {
+      throw new TypeError(`Invalid CSP script hash: ${JSON.stringify(hash)}.`);
+    }
+    return `'${hash}'`;
+  });
+  return applyFarmCspScriptSourcesToPolicy(policy, sources);
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, applyFarmCspHashesToPolicy, "applyFarmCspHashesToPolicy");
+function applyFarmCspScriptSourcesToPolicy(policy, sources) {
+  const uniqueSources = [...new Set(sources)];
+  if (uniqueSources.length === 0) return policy;
+  const segments = policy.split(";").map((segment) => segment.trim()).filter(Boolean);
+  const names = segments.map((segment) => segment.split(/\s+/, 1)[0].toLowerCase());
+  const governingName = names.includes("script-src-elem") ? "script-src-elem" : names.includes("script-src") ? "script-src" : names.includes("default-src") ? "default-src" : void 0;
+  if (!governingName) return `${policy}; script-src ${uniqueSources.join(" ")}`;
+  return segments.map((segment, index) => {
+    if (names[index] !== governingName) return segment;
+    const existing = new Set(segment.split(/\s+/));
+    const missing = uniqueSources.filter((source) => !existing.has(source));
+    return missing.length > 0 ? `${segment} ${missing.join(" ")}` : segment;
+  }).join("; ");
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, applyFarmCspScriptSourcesToPolicy, "applyFarmCspScriptSourcesToPolicy");
+function addFarmCspNonceToScriptTags(html, nonce) {
+  validateCspNonce(nonce);
+  return createFarmScriptTagRewriter((tag) => stampScriptTag(tag, nonce)).write(html, true);
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, addFarmCspNonceToScriptTags, "addFarmCspNonceToScriptTags");
+function stampFarmCspNonce(html, nonce = _chunkULASELLAcjs._resolveCurrentCspNonce.call(void 0, )) {
+  return nonce && html ? addFarmCspNonceToScriptTags(html, nonce) : html;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, stampFarmCspNonce, "stampFarmCspNonce");
+function replaceFarmCspNonceMarker(html, marker, nonce = _chunkULASELLAcjs._resolveCurrentCspNonce.call(void 0, )) {
+  validateCspNonce(marker);
+  if (nonce) validateCspNonce(nonce);
+  return createFarmScriptTagRewriter((tag) => {
+    const range = findScriptTagAttributeRange(tag, "nonce");
+    if (!range || readAttributeValue(tag.slice(range.start, range.end)) !== marker) return tag;
+    return nonce ? stampScriptTag(tag, nonce) : stripScriptNonceAttribute(tag);
+  }).write(html, true);
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, replaceFarmCspNonceMarker, "replaceFarmCspNonceMarker");
+function filterFarmCspNonces(html, nonce) {
+  return createFarmCspNonceRewriter(nonce).write(html, true);
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, filterFarmCspNonces, "filterFarmCspNonces");
+function removeFarmCspNoncesFromScriptTags(html) {
+  return createFarmScriptTagRewriter(stripScriptNonceAttribute).write(html, true);
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, removeFarmCspNoncesFromScriptTags, "removeFarmCspNoncesFromScriptTags");
+async function createFarmCspScriptHashes(html) {
+  const hashes = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const content of collectFarmInlineScriptContents(html)) {
+    const digest = await globalThis.crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(content)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    const hash = `sha256-${globalThis.btoa(binary)}`;
+    if (!seen.has(hash)) {
+      seen.add(hash);
+      hashes.push(hash);
+    }
+  }
+  return hashes;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, createFarmCspScriptHashes, "createFarmCspScriptHashes");
+async function applyFarmCspHashesToHtml(html, security) {
+  if (!security.csp || !security.csp.nonce) return void 0;
+  const hashes = await createFarmCspScriptHashes(html);
+  const staticHtml = removeFarmCspNoncesFromScriptTags(html);
+  return {
+    html: staticHtml,
+    header: {
+      key: security.csp.reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy",
+      value: applyFarmCspHashesToPolicy(security.csp.value, hashes)
+    }
+  };
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, applyFarmCspHashesToHtml, "applyFarmCspHashesToHtml");
+function applyFarmCspNonceToResponse(response, security, nonce = createFarmCspNonce(security)) {
+  if (!security.csp || !security.csp.nonce || !nonce) return response;
+  if (!_optionalChain([response, 'access', _ => _.headers, 'access', _2 => _2.get, 'call', _3 => _3("content-type"), 'optionalAccess', _4 => _4.toLowerCase, 'call', _5 => _5(), 'access', _6 => _6.includes, 'call', _7 => _7("text/html")])) return response;
+  const securityHeader = getFarmSecurityHeader(security, nonce);
+  if (!response.body) {
+    return _chunkFJ3M4CUXcjs._withFarmResponseHeaders.call(void 0, response, (headers2) => {
+      headers2.set(securityHeader.key, securityHeader.value);
+      headers2.delete("content-length");
+    });
+  }
+  const headers = new Headers(response.headers);
+  headers.set(securityHeader.key, securityHeader.value);
+  headers.delete("content-length");
+  const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
+  const rewriter = createFarmCspNonceRewriter(nonce);
+  const body = response.body.pipeThrough(
+    new TransformStream({
+      transform(chunk, controller) {
+        const output = rewriter.write(decoder.decode(chunk, { stream: true }));
+        if (output) controller.enqueue(encoder.encode(output));
+      },
+      flush(controller) {
+        const output = rewriter.write(decoder.decode(), true);
+        if (output) controller.enqueue(encoder.encode(output));
+      }
+    })
+  );
+  return _chunkFJ3M4CUXcjs._markFarmOwnedResponse.call(void 0, 
+    new Response(body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    })
+  );
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, applyFarmCspNonceToResponse, "applyFarmCspNonceToResponse");
+function farmCspBlocksFrameworkInlineScripts(security) {
+  if (!security.csp) return false;
+  if (security.csp.nonce) return false;
+  const directives = parseCspDirectives(security.csp.value);
+  const governing = _nullishCoalesce(_nullishCoalesce(directives.get("script-src-elem"), () => ( directives.get("script-src"))), () => ( directives.get("default-src")));
+  if (!governing) return false;
+  const sources = governing.map((source) => source.toLowerCase());
+  const disablesUnsafeInline = sources.some(
+    (value) => value === "'strict-dynamic'" || value.startsWith("'nonce-") || value.startsWith("'sha256-") || value.startsWith("'sha384-") || value.startsWith("'sha512-")
+  );
+  return !sources.includes("'unsafe-inline'") || disablesUnsafeInline;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, farmCspBlocksFrameworkInlineScripts, "farmCspBlocksFrameworkInlineScripts");
+function parseCspDirectives(value) {
+  const directives = /* @__PURE__ */ new Map();
+  for (const segment of value.split(";")) {
+    const parts = segment.trim().split(/\s+/).filter(Boolean);
+    if (parts.length === 0) continue;
+    const name = parts[0].toLowerCase();
+    if (!directives.has(name)) directives.set(name, parts.slice(1));
+  }
+  return directives;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, parseCspDirectives, "parseCspDirectives");
+function normalizeDirectiveName(value) {
+  const name = value.trim().replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+  if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+    throw new TypeError(`Invalid security.csp directive name: ${JSON.stringify(value)}.`);
+  }
+  return name;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, normalizeDirectiveName, "normalizeDirectiveName");
+function validateDirectiveValue(value) {
+  if (typeof value !== "string") {
+    throw new TypeError("security.csp directive values must be strings or booleans.");
+  }
+  const normalized = value.trim();
+  if (!normalized || /[;\r\n]/.test(normalized) || normalized.includes("\0")) {
+    throw new TypeError(`Invalid security.csp directive value: ${JSON.stringify(value)}.`);
+  }
+  return normalized;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, validateDirectiveValue, "validateDirectiveValue");
+function validateSerializedCsp(value) {
+  if (typeof value !== "string") {
+    throw new TypeError("security.csp policy must be a non-empty single-line string.");
+  }
+  const normalized = value.trim().replace(/;+$/g, "").trim();
+  if (!normalized || /[\r\n]/.test(normalized) || normalized.includes("\0")) {
+    throw new TypeError("security.csp policy must be a non-empty single-line string.");
+  }
+  return normalized;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, validateSerializedCsp, "validateSerializedCsp");
+function validateReportOnly(value) {
+  if (value === void 0) return false;
+  if (typeof value !== "boolean") {
+    throw new TypeError("security.csp.reportOnly must be a boolean.");
+  }
+  return value;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, validateReportOnly, "validateReportOnly");
+function validateNonce(value) {
+  if (value === void 0) return false;
+  if (typeof value !== "boolean") {
+    throw new TypeError("security.csp.nonce must be a boolean.");
+  }
+  return value;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, validateNonce, "validateNonce");
+function validateCspNonce(value) {
+  if (!/^[A-Za-z0-9+/_-]+={0,2}$/.test(value)) {
+    throw new TypeError("A CSP nonce must be a base64 or base64url value.");
+  }
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, validateCspNonce, "validateCspNonce");
+function createFarmCspNonceRewriter(nonce) {
+  validateCspNonce(nonce);
+  return createFarmScriptTagRewriter((tag) => keepOwnScriptNonce(tag, nonce));
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, createFarmCspNonceRewriter, "createFarmCspNonceRewriter");
+function createFarmScriptTagRewriter(transformScriptTag) {
+  let pending = "";
+  let rawTextElement;
+  return {
+    write(chunk, final = false) {
+      pending += chunk;
+      let output = "";
+      while (pending) {
+        if (rawTextElement) {
+          if (rawTextElement === "plaintext") {
+            output += pending;
+            pending = "";
+            break;
+          }
+          const closing = `</${rawTextElement}`;
+          const start2 = findRawTextEnd(pending, rawTextElement);
+          if (start2 === -1) {
+            if (final) {
+              output += pending;
+              pending = "";
+            } else {
+              const keep = matchingSuffixLength(pending, closing);
+              output += pending.slice(0, pending.length - keep);
+              pending = pending.slice(pending.length - keep);
+            }
+            break;
+          }
+          output += pending.slice(0, start2);
+          pending = pending.slice(start2);
+          const end2 = findHtmlTagEnd(pending);
+          if (end2 === -1) {
+            if (final) {
+              output += pending;
+              pending = "";
+            }
+            break;
+          }
+          output += pending.slice(0, end2 + 1);
+          pending = pending.slice(end2 + 1);
+          rawTextElement = void 0;
+          continue;
+        }
+        const start = pending.indexOf("<");
+        if (start === -1) {
+          output += pending;
+          pending = "";
+          break;
+        }
+        output += pending.slice(0, start);
+        pending = pending.slice(start);
+        if (pending.startsWith("<!--")) {
+          const end2 = pending.indexOf("-->", 4);
+          if (end2 === -1) {
+            if (final) {
+              output += pending;
+              pending = "";
+            }
+            break;
+          }
+          output += pending.slice(0, end2 + 3);
+          pending = pending.slice(end2 + 3);
+          continue;
+        }
+        if (!final && "<!--".startsWith(pending)) break;
+        const tagNameMatch = pending.match(/^<\/?([a-z][a-z0-9:-]*)\b/i);
+        if (!tagNameMatch) {
+          if (!final && /^<\/?[a-z][a-z0-9:-]*$/i.test(pending)) break;
+          output += pending[0];
+          pending = pending.slice(1);
+          continue;
+        }
+        const end = findHtmlTagEnd(pending);
+        if (end === -1) {
+          if (!final) break;
+          output += pending;
+          pending = "";
+          break;
+        }
+        const tag = pending.slice(0, end + 1);
+        const tagName = tagNameMatch[1].toLowerCase();
+        const isClosing = pending.startsWith("</");
+        const isSelfClosing = /\/\s*>$/.test(tag);
+        output += !isClosing && tagName === "script" ? transformScriptTag(tag) : tag;
+        pending = pending.slice(end + 1);
+        if (!isClosing && !isSelfClosing && rawTextElements.has(tagName)) {
+          rawTextElement = tagName;
+        }
+      }
+      return output;
+    }
+  };
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, createFarmScriptTagRewriter, "createFarmScriptTagRewriter");
+var rawTextElements = /* @__PURE__ */ new Map([
+  ["iframe", /<\/iframe(?=[\s/>]|$)/gi],
+  ["noembed", /<\/noembed(?=[\s/>]|$)/gi],
+  ["noframes", /<\/noframes(?=[\s/>]|$)/gi],
+  ["plaintext", null],
+  ["script", /<\/script(?=[\s/>]|$)/gi],
+  ["style", /<\/style(?=[\s/>]|$)/gi],
+  ["textarea", /<\/textarea(?=[\s/>]|$)/gi],
+  ["title", /<\/title(?=[\s/>]|$)/gi],
+  ["xmp", /<\/xmp(?=[\s/>]|$)/gi]
+]);
+function stampScriptTag(tag, nonce) {
+  const opening = _optionalChain([tag, 'access', _8 => _8.match, 'call', _9 => _9(/^<script\b/i), 'optionalAccess', _10 => _10[0]]);
+  if (!opening) return tag;
+  const attributes = stripScriptNonceAttribute(tag).slice(opening.length, -1);
+  return `<script nonce="${nonce}"${attributes}>`;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, stampScriptTag, "stampScriptTag");
+function keepOwnScriptNonce(tag, nonce) {
+  const opening = _optionalChain([tag, 'access', _11 => _11.match, 'call', _12 => _12(/^<script\b/i), 'optionalAccess', _13 => _13[0]]);
+  if (!opening) return tag;
+  const range = findScriptTagAttributeRange(tag, "nonce");
+  if (!range) return tag;
+  const stripped = stripScriptNonceAttribute(tag);
+  const attributes = stripped.slice(opening.length, -1);
+  if (/<(?:script|style)/i.test(attributes)) return stripped;
+  if (readAttributeValue(tag.slice(range.start, range.end)) !== nonce) return stripped;
+  return `<script nonce="${nonce}"${attributes}>`;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, keepOwnScriptNonce, "keepOwnScriptNonce");
+function readAttributeValue(attribute) {
+  const equals = attribute.indexOf("=");
+  if (equals === -1) return void 0;
+  const value = attribute.slice(equals + 1).trim();
+  const quote = value[0];
+  if (quote === '"' || quote === "'") {
+    return value.length > 1 && value.endsWith(quote) ? value.slice(1, -1) : void 0;
+  }
+  return value;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, readAttributeValue, "readAttributeValue");
+function stripScriptNonceAttribute(tag) {
+  let normalized = tag;
+  let range = findScriptTagAttributeRange(normalized, "nonce");
+  while (range) {
+    normalized = normalized.slice(0, range.start) + normalized.slice(range.end);
+    range = findScriptTagAttributeRange(normalized, "nonce");
+  }
+  return normalized;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, stripScriptNonceAttribute, "stripScriptNonceAttribute");
+function collectFarmInlineScriptContents(html) {
+  const contents = [];
+  let offset = 0;
+  while (offset < html.length) {
+    const start = html.indexOf("<", offset);
+    if (start === -1) break;
+    if (html.startsWith("<!--", start)) {
+      const commentEnd = html.indexOf("-->", start + 4);
+      offset = commentEnd === -1 ? html.length : commentEnd + 3;
+      continue;
+    }
+    const remaining = html.slice(start);
+    const tagNameMatch = remaining.match(/^<\/?([a-z][a-z0-9:-]*)\b/i);
+    if (!tagNameMatch) {
+      offset = start + 1;
+      continue;
+    }
+    const tagEnd = findHtmlTagEnd(remaining);
+    if (tagEnd === -1) break;
+    const tag = remaining.slice(0, tagEnd + 1);
+    const tagName = tagNameMatch[1].toLowerCase();
+    const isClosing = remaining.startsWith("</");
+    const isSelfClosing = /\/\s*>$/.test(tag);
+    offset = start + tagEnd + 1;
+    if (isClosing || isSelfClosing || !rawTextElements.has(tagName)) continue;
+    if (tagName === "plaintext") break;
+    const closingStart = findRawTextEnd(html, tagName, offset);
+    const contentEnd = closingStart === -1 ? html.length : closingStart;
+    if (tagName === "script" && findScriptTagAttributeRange(tag, "nonce") && !findScriptTagAttributeRange(tag, "src")) {
+      contents.push(html.slice(offset, contentEnd));
+    }
+    if (closingStart === -1) break;
+    const closingEnd = findHtmlTagEnd(html.slice(contentEnd));
+    if (closingEnd === -1) break;
+    offset = contentEnd + closingEnd + 1;
+  }
+  return contents;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, collectFarmInlineScriptContents, "collectFarmInlineScriptContents");
+function findScriptTagAttributeRange(tag, expectedName) {
+  const opening = _optionalChain([tag, 'access', _14 => _14.match, 'call', _15 => _15(/^<script\b/i), 'optionalAccess', _16 => _16[0]]);
+  if (!opening) return void 0;
+  let offset = opening.length;
+  while (offset < tag.length - 1) {
+    const whitespaceStart = offset;
+    while (/\s/.test(tag[offset] || "")) offset++;
+    if (tag[offset] === "/" || tag[offset] === ">" || offset >= tag.length - 1) break;
+    const nameStart = offset;
+    while (offset < tag.length && !/[\s=/>]/.test(tag[offset])) offset++;
+    const name = tag.slice(nameStart, offset).toLowerCase();
+    while (/\s/.test(tag[offset] || "")) offset++;
+    if (tag[offset] === "=") {
+      offset++;
+      while (/\s/.test(tag[offset] || "")) offset++;
+      const quote = tag[offset] === '"' || tag[offset] === "'" ? tag[offset++] : void 0;
+      if (quote) {
+        while (offset < tag.length && tag[offset] !== quote) offset++;
+        if (tag[offset] === quote) offset++;
+      } else {
+        while (offset < tag.length && !/[\s>]/.test(tag[offset])) offset++;
+      }
+    }
+    if (name === expectedName) return { start: whitespaceStart, end: offset };
+  }
+  return void 0;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, findScriptTagAttributeRange, "findScriptTagAttributeRange");
+function findRawTextEnd(input, tagName, offset = 0) {
+  const closing = rawTextElements.get(tagName);
+  closing.lastIndex = offset;
+  return _nullishCoalesce(_optionalChain([closing, 'access', _17 => _17.exec, 'call', _18 => _18(input), 'optionalAccess', _19 => _19.index]), () => ( -1));
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, findRawTextEnd, "findRawTextEnd");
+function matchingSuffixLength(input, token) {
+  const limit = Math.min(token.length - 1, input.length);
+  for (let length = limit; length > 0; length--) {
+    if (token.startsWith(input.slice(-length).toLowerCase())) return length;
+  }
+  return 0;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, matchingSuffixLength, "matchingSuffixLength");
+function findHtmlTagEnd(tag) {
+  let quote;
+  for (let index = 1; index < tag.length; index++) {
+    const character = tag[index];
+    if (quote) {
+      if (character === quote) quote = void 0;
+    } else if (character === '"' || character === "'") {
+      quote = character;
+    } else if (character === ">") {
+      return index;
+    }
+  }
+  return -1;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, findHtmlTagEnd, "findHtmlTagEnd");
+function isPlainRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, isPlainRecord, "isPlainRecord");
+
+
+
+
+
+
+
+
+
+
+
+
+exports.resolveFarmSecurityConfig = resolveFarmSecurityConfig; exports.getFarmSecurityHeader = getFarmSecurityHeader; exports.createFarmCspNonce = createFarmCspNonce; exports.stampFarmCspNonce = stampFarmCspNonce; exports.replaceFarmCspNonceMarker = replaceFarmCspNonceMarker; exports.filterFarmCspNonces = filterFarmCspNonces; exports.applyFarmCspHashesToHtml = applyFarmCspHashesToHtml; exports.applyFarmCspNonceToResponse = applyFarmCspNonceToResponse; exports.farmCspBlocksFrameworkInlineScripts = farmCspBlocksFrameworkInlineScripts; exports.createFarmCspNonceRewriter = createFarmCspNonceRewriter;

package/dist/{chunk-75X755YZ.cjs → chunk-34UCJRQO.cjs}

@@ -1,6 +1,6 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkB5PFZLKVcjs = require('./chunk-B5PFZLKV.cjs');
+var _chunkEKN7NSZOcjs = require('./chunk-EKN7NSZO.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -11,7 +11,7 @@ var _path = require('path'); var _path2 = _interopRequireDefault(_path);
 var _url = require('url');
 async function createFarmMarkdownRouteModuleFromFile(filePath, options = {}) {
   const source = await _promises.readFile.call(void 0, filePath, "utf8");
-  return _chunkB5PFZLKVcjs.createFarmMarkdownRouteModule.call(void 0, {
+  return _chunkEKN7NSZOcjs.createFarmMarkdownRouteModule.call(void 0, {
     source,
     filePath,
     components: options.components,

package/dist/{chunk-CVH2BXPY.cjs → chunk-3LOLJTFV.cjs}

@@ -4,7 +4,7 @@
 
 
 
-var _chunk6LGFV2CQcjs = require('./chunk-6LGFV2CQ.cjs');
+var _chunk5OKBARDNcjs = require('./chunk-5OKBARDN.cjs');
 
 
 var _chunkSK35NQKKcjs = require('./chunk-SK35NQKK.cjs');
@@ -35,7 +35,7 @@ function createServerQuery(options) {
     throw new TypeError("createServerQuery requires a key function");
   }
   const staleTime = normalizeServerQueryStaleTime(options.staleTime);
-  const execute = _chunk6LGFV2CQcjs.createServerFn.call(void 0, {
+  const execute = _chunk5OKBARDNcjs.createServerFn.call(void 0, {
     input: options.input,
     middleware: options.middleware,
     handler: /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, async (context) => {
@@ -45,7 +45,7 @@ function createServerQuery(options) {
       const cacheKey = _chunkNYJMY3JAcjs.createFarmCacheKey.call(void 0, ["route-data", routeKey]);
       const producer = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, async () => {
         const value = await options.handler(context);
-        return _chunk6LGFV2CQcjs._parseServerFnSchema.call(void 0, options.output, value, "output", "createServerQuery");
+        return _chunk5OKBARDNcjs._parseServerFnSchema.call(void 0, options.output, value, "output", "createServerQuery");
       }, "producer");
       let data;
       let updatedAt;
@@ -90,10 +90,10 @@ function createServerQuery(options) {
       enumerable: false
     }
   });
-  _chunk6LGFV2CQcjs._attachServerFunctionDescriptor.call(void 0, 
+  _chunk5OKBARDNcjs._attachServerFunctionDescriptor.call(void 0, 
     query,
-    _chunk6LGFV2CQcjs.createServerFunctionDescriptor.call(void 0, "query", options, async (value) => {
-      const result = await _chunk6LGFV2CQcjs._runServerFunctionForCaller.call(void 0, 
+    _chunk5OKBARDNcjs.createServerFunctionDescriptor.call(void 0, "query", options, async (value) => {
+      const result = await _chunk5OKBARDNcjs._runServerFunctionForCaller.call(void 0, 
         execute,
         value
       );

package/dist/{chunk-4GPOC4LN.cjs → chunk-472NCAZ7.cjs}

@@ -9,7 +9,7 @@ var _chunk7W3CPVXScjs = require('./chunk-7W3CPVXS.cjs');
 var _chunkAI7QMY7Ocjs = require('./chunk-AI7QMY7O.cjs');
 
 
-var _chunkNICDYKBScjs = require('./chunk-NICDYKBS.cjs');
+var _chunk6XWDE2P2cjs = require('./chunk-6XWDE2P2.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -20,12 +20,12 @@ function _setDefaultFarmThemeConfig(config, basePath = "/") {
   defaultThemeConfig = _chunkOI6CMLWXcjs.resolveFarmThemeConfig.call(void 0, config, basePath);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, _setDefaultFarmThemeConfig, "_setDefaultFarmThemeConfig");
-function getTheme(request = _chunkNICDYKBScjs.getCurrentRequestOrNull.call(void 0, )) {
+function getTheme(request = _chunk6XWDE2P2cjs.getCurrentRequestOrNull.call(void 0, )) {
   if (!request) return defaultThemeConfig.default;
   return readFarmThemePreference(request, defaultThemeConfig);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getTheme, "getTheme");
-function getThemeSnapshot(request = _chunkNICDYKBScjs.getCurrentRequestOrNull.call(void 0, )) {
+function getThemeSnapshot(request = _chunk6XWDE2P2cjs.getCurrentRequestOrNull.call(void 0, )) {
   const theme = request ? readFarmThemePreference(request, defaultThemeConfig) : defaultThemeConfig.default;
   return {
     theme,