@farm.js/core 0.1.37 → 0.1.38

package/dist/{chunk-WT4TGLXT.cjs → chunk-4E5QXOCL.cjs}

@@ -7,7 +7,7 @@ var _chunkPCOTGFSMcjs = require('./chunk-PCOTGFSM.cjs');
 
 
 
-var _chunkLOFKRKO7cjs = require('./chunk-LOFKRKO7.cjs');
+var _chunk2DD4JMQCcjs = require('./chunk-2DD4JMQC.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -59,7 +59,7 @@ function createFarmLayoutSelector(layouts, resolveRouteDirectory) {
     return {
       layout,
       segments: segments.length === 0 ? null : segments,
-      groupScope: _chunkLOFKRKO7cjs.getRouteGroupScope.call(void 0, layout.pattern)
+      groupScope: _chunk2DD4JMQCcjs.getRouteGroupScope.call(void 0, layout.pattern)
     };
   });
   return (pathname, routeDirectory) => {
@@ -73,7 +73,7 @@ function createFarmLayoutSelector(layouts, resolveRouteDirectory) {
       }
       if (groupScope !== null) {
         if (directory === void 0) directory = _nullishCoalesce(_optionalChain([resolveRouteDirectory, 'optionalCall', _2 => _2(pathname)]), () => ( null));
-        if (!_chunkLOFKRKO7cjs.isInRouteGroupScope.call(void 0, directory, groupScope)) continue;
+        if (!_chunk2DD4JMQCcjs.isInRouteGroupScope.call(void 0, directory, groupScope)) continue;
       }
       applicable.push(layout);
     }
@@ -82,9 +82,9 @@ function createFarmLayoutSelector(layouts, resolveRouteDirectory) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, createFarmLayoutSelector, "createFarmLayoutSelector");
 function layoutsCanCoverSamePage(a, b) {
-  const scopeA = _chunkLOFKRKO7cjs.getRouteGroupScope.call(void 0, a);
-  const scopeB = _chunkLOFKRKO7cjs.getRouteGroupScope.call(void 0, b);
-  if (scopeA !== null && scopeB !== null && !_chunkLOFKRKO7cjs.isInRouteGroupScope.call(void 0, scopeA, scopeB) && !_chunkLOFKRKO7cjs.isInRouteGroupScope.call(void 0, scopeB, scopeA)) {
+  const scopeA = _chunk2DD4JMQCcjs.getRouteGroupScope.call(void 0, a);
+  const scopeB = _chunk2DD4JMQCcjs.getRouteGroupScope.call(void 0, b);
+  if (scopeA !== null && scopeB !== null && !_chunk2DD4JMQCcjs.isInRouteGroupScope.call(void 0, scopeA, scopeB) && !_chunk2DD4JMQCcjs.isInRouteGroupScope.call(void 0, scopeB, scopeA)) {
     return false;
   }
   const segmentsA = a === "/" ? [] : _chunkPCOTGFSMcjs.parseRoutePattern.call(void 0, a);

package/dist/{chunk-7DWNJI73.cjs → chunk-4IE345DM.cjs}

@@ -3,18 +3,19 @@
 
 
 
-var _chunkTE2G5IONcjs = require('./chunk-TE2G5ION.cjs');
+
+var _chunkPGZDEPTMcjs = require('./chunk-PGZDEPTM.cjs');
 
 
 
 var _chunkIK6LVLKCcjs = require('./chunk-IK6LVLKC.cjs');
 
 
-var _chunk3A4KGQYIcjs = require('./chunk-3A4KGQYI.cjs');
+var _chunkQ3NXS4MUcjs = require('./chunk-Q3NXS4MU.cjs');
 
 
 
-var _chunkHITLGIAOcjs = require('./chunk-HITLGIAO.cjs');
+var _chunkCY2ZQ5C6cjs = require('./chunk-CY2ZQ5C6.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -27,8 +28,17 @@ function hasFarmDocsRuntimeAdapter(docs) {
   return Boolean(_optionalChain([docs, 'optionalAccess', _ => _.enabled]) && _optionalChain([docs, 'access', _2 => _2.adapter, 'optionalAccess', _3 => _3.server]) && docs.adapter.react);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, hasFarmDocsRuntimeAdapter, "hasFarmDocsRuntimeAdapter");
+function assertFarmDocsAdapterServesNoGuardedPages(docs, options, isPathGuarded) {
+  if (!isPathGuarded || !hasFarmDocsRuntimeAdapter(docs)) return;
+  const guarded = _chunkPGZDEPTMcjs.discoverFarmDocsPages.call(void 0, _chunkPGZDEPTMcjs.resolveFarmDocsContentDir.call(void 0, docs, options), docs).filter((page) => isPathGuarded(page.href) || isPathGuarded(_chunkPGZDEPTMcjs.getFarmDocsMarkdownPath.call(void 0, page.href))).map((page) => page.href);
+  if (guarded.length === 0) return;
+  throw new Error(
+    `Docs pages behind a path guard (${guarded.join(", ")}) would be public: the docs adapter ${JSON.stringify(docs.adapter.id)} serves their content in llms-full.txt, search, Markdown, and MCP without running the app's guards. Move those pages out of the docs content directory, or set docs.adapter = false to use Farm's built-in docs runtime, which keeps guarded pages off anonymous surfaces.`
+  );
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, assertFarmDocsAdapterServesNoGuardedPages, "assertFarmDocsAdapterServesNoGuardedPages");
 async function loadFarmDocsConfigModule(docs, loadModule) {
-  const configModule = _chunkHITLGIAOcjs.getFarmDocsAdapterConfigModule.call(void 0, docs);
+  const configModule = _chunkCY2ZQ5C6cjs.getFarmDocsAdapterConfigModule.call(void 0, docs);
   if (!configModule) return void 0;
   const loaded = await loadModule(configModule);
   const config = _nullishCoalesce(_optionalChain([loaded, 'optionalAccess', _4 => _4.default]), () => ( loaded));
@@ -40,7 +50,7 @@ function createFarmDocsAdapterRuntimeConfig(docs, options, moduleConfig) {
     ...moduleConfig ? { ...moduleConfig, ...docs.configOverrides } : _nullishCoalesce(docs.runtimeConfig, () => ( docs.config)),
     entry: docs.config.entry || docs.entry.replace(/^\/+|\/+$/g, "") || "docs",
     docsPath: docs.entry,
-    contentDir: _chunkTE2G5IONcjs.resolveFarmDocsContentDir.call(void 0, docs, options)
+    contentDir: _chunkPGZDEPTMcjs.resolveFarmDocsContentDir.call(void 0, docs, options)
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, createFarmDocsAdapterRuntimeConfig, "createFarmDocsAdapterRuntimeConfig");
@@ -99,6 +109,7 @@ async function createFarmDocsAdapterHandler(docs, options) {
   if (!hasFarmDocsRuntimeAdapter(docs)) {
     throw new Error("Farm docs adapter requires server and react runtime entrypoints.");
   }
+  assertFarmDocsAdapterServesNoGuardedPages(docs, options, options.isPathGuarded);
   const serverModule = await options.loadModule(
     docs.adapter.server
   );
@@ -277,25 +288,25 @@ function getDocsDescription(docs) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getDocsDescription, "getDocsDescription");
 function getLoadedDocsPages(context) {
-  return _chunkTE2G5IONcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs).map((page) => _chunkTE2G5IONcjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, page.slug)).filter((page) => Boolean(page));
+  return _chunkPGZDEPTMcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs).filter((page) => !context.isPathGuarded(page.href)).map((page) => _chunkPGZDEPTMcjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, page.slug)).filter((page) => Boolean(page));
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getLoadedDocsPages, "getLoadedDocsPages");
 function toDocsSourcePage(page) {
   return {
-    ..._chunkTE2G5IONcjs.toFarmDocsMarkdownPage.call(void 0, page),
+    ..._chunkPGZDEPTMcjs.toFarmDocsMarkdownPage.call(void 0, page),
     sourcePath: page.sourcePath
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, toDocsSourcePage, "toDocsSourcePage");
 function toDocsSitemapPage(page) {
   return {
-    ..._chunkTE2G5IONcjs.toFarmDocsMarkdownPage.call(void 0, page),
+    ..._chunkPGZDEPTMcjs.toFarmDocsMarkdownPage.call(void 0, page),
     sourcePath: page.sourcePath
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, toDocsSitemapPage, "toDocsSitemapPage");
 function toDocsLlmsPage(page) {
-  return _chunkTE2G5IONcjs.toFarmDocsMarkdownPage.call(void 0, page);
+  return _chunkPGZDEPTMcjs.toFarmDocsMarkdownPage.call(void 0, page);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, toDocsLlmsPage, "toDocsLlmsPage");
 function getDocsLlmsOptions(context, request) {
@@ -389,7 +400,9 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, renderAgentsDocument, "renderAgentsDocumen
 function buildAgentSpec(context, request) {
   const url = new URL(request.url);
   const origin = url.origin;
-  const pages = _chunkTE2G5IONcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs);
+  const pages = _chunkPGZDEPTMcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs).filter(
+    (page) => !context.isPathGuarded(page.href)
+  );
   const spec = _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).buildDocsAgentDiscoverySpec(getDocsDiscoveryOptions(context, request));
   const title = getDocsTitle(context.docs);
   return {
@@ -449,7 +462,7 @@ function redactDocsConfigValue(value, key, inHeaders) {
     );
   }
   if (value === null || value === void 0 || typeof value === "function") return value;
-  return inHeaders || _chunkHITLGIAOcjs.isSecretDocsConfigKey.call(void 0, key) ? REDACTED_DOCS_CONFIG_VALUE : value;
+  return inHeaders || _chunkCY2ZQ5C6cjs.isSecretDocsConfigKey.call(void 0, key) ? REDACTED_DOCS_CONFIG_VALUE : value;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, redactDocsConfigValue, "redactDocsConfigValue");
 function toPublicDocsPath(value, root) {
@@ -479,7 +492,7 @@ function buildPublicConfig(context) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, buildPublicConfig, "buildPublicConfig");
 function buildDiagnostics(context) {
-  const pages = _chunkTE2G5IONcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs);
+  const pages = _chunkPGZDEPTMcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs);
   const diagnostics = _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).buildDocsDiagnostics(context.docs.config, {
     entry: context.docs.entry,
     mcp: {
@@ -551,13 +564,15 @@ async function resolveAPIContext(options) {
     config: options.config,
     configPath: options.configPath
   }));
-  const docs = isResolvedDocsConfig(docsInput) ? docsInput : await _chunk3A4KGQYIcjs.resolveDocsConfig.call(void 0, docsInput, { root, srcDir });
+  const docs = isResolvedDocsConfig(docsInput) ? docsInput : await _chunkQ3NXS4MUcjs.resolveDocsConfig.call(void 0, docsInput, { root, srcDir });
+  const guardedPaths = new Set(_nullishCoalesce(_optionalChain([runtimeConfig, 'optionalAccess', _20 => _20.guardedPaths]), () => ( [])));
   return {
     root,
     srcDir,
     docs,
-    contentDir: _chunkTE2G5IONcjs.resolveFarmDocsContentDir.call(void 0, docs, { root, srcDir }),
-    diagnostics: options.diagnostics === true
+    contentDir: _chunkPGZDEPTMcjs.resolveFarmDocsContentDir.call(void 0, docs, { root, srcDir }),
+    diagnostics: options.diagnostics === true,
+    isPathGuarded: _nullishCoalesce(options.isPathGuarded, () => ( ((pathname) => guardedPaths.has(pathname))))
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, resolveAPIContext, "resolveAPIContext");
@@ -615,10 +630,12 @@ async function handleDocsAPIGet(request, context) {
   if (format === "markdown" || url.pathname.endsWith(".md")) {
     const pathParam = url.searchParams.get("path") || url.searchParams.get("slug");
     const slug = normalizeDocsApiSlug(_nullishCoalesce(_nullishCoalesce(pathParam, () => ( pathTarget.slug)), () => ( "")), context.docs);
-    const page = _chunkTE2G5IONcjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, slug);
-    if (!page) return text("Docs page not found\n", "text/plain; charset=utf-8", { status: 404 });
+    const page = _chunkPGZDEPTMcjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, slug);
+    if (!page || context.isPathGuarded(page.href)) {
+      return text("Docs page not found\n", "text/plain; charset=utf-8", { status: 404 });
+    }
     return text(
-      _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).renderDocsMarkdownDocument(_chunkTE2G5IONcjs.toFarmDocsMarkdownPage.call(void 0, page), {
+      _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).renderDocsMarkdownDocument(_chunkPGZDEPTMcjs.toFarmDocsMarkdownPage.call(void 0, page), {
         origin: new URL(request.url).origin,
         llms: getDocsLlmsOptions(context, request),
         sitemap: context.docs.config.sitemap
@@ -693,4 +710,5 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, createFarmDocsAPIHandler, "createFarmDocsA
 
 
 
-exports.hasFarmDocsRuntimeAdapter = hasFarmDocsRuntimeAdapter; exports.compileFarmDocsAdapterEdgeManifest = compileFarmDocsAdapterEdgeManifest; exports.createFarmDocsAdapterHandler = createFarmDocsAdapterHandler; exports.isFarmDocsAPIRequest = isFarmDocsAPIRequest; exports.createDocsAPI = createDocsAPI; exports.createFarmDocsAPIHandler = createFarmDocsAPIHandler;
+
+exports.hasFarmDocsRuntimeAdapter = hasFarmDocsRuntimeAdapter; exports.assertFarmDocsAdapterServesNoGuardedPages = assertFarmDocsAdapterServesNoGuardedPages; exports.compileFarmDocsAdapterEdgeManifest = compileFarmDocsAdapterEdgeManifest; exports.createFarmDocsAdapterHandler = createFarmDocsAdapterHandler; exports.isFarmDocsAPIRequest = isFarmDocsAPIRequest; exports.createDocsAPI = createDocsAPI; exports.createFarmDocsAPIHandler = createFarmDocsAPIHandler;

package/dist/{chunk-O6WAEAX3.mjs → chunk-5BWWFHR2.mjs}

@@ -13,9 +13,12 @@ import {
   resolveFarmDocsFontAssets,
   toFarmDocsPublicFontAssets
 } from "./chunk-TVGP4BBZ.mjs";
+import {
+  stampFarmCspNonce
+} from "./chunk-U6QLDL3G.mjs";
 import {
   farmAcceptQuality
-} from "./chunk-WWIKMBRN.mjs";
+} from "./chunk-VNGH5MLF.mjs";
 import {
   matchesFarmIfNoneMatch
 } from "./chunk-ZMMBIVQM.mjs";
@@ -24,7 +27,13 @@ import {
 } from "./chunk-LPEX4YW6.mjs";
 
 // src/docs/handler.ts
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync as realpathSync2, statSync as statSync2 } from "fs";
+import {
+  existsSync as existsSync2,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync2,
+  realpathSync as realpathSync2,
+  statSync as statSync2
+} from "fs";
 import path2 from "path";
 import { marked, Renderer } from "marked";
 import { highlight } from "sugar-high";
@@ -718,15 +727,46 @@ function getRequestSlug(docs, request) {
   return normalizeSlug(pathname.slice(entry.length));
 }
 __name(getRequestSlug, "getRequestSlug");
+function isDiscoverableDocsEntryName(name) {
+  return Boolean(name) && !name.startsWith(".") && name !== "node_modules";
+}
+__name(isDiscoverableDocsEntryName, "isDiscoverableDocsEntryName");
+function isDiscoverableDocsFile(contentDir, filePath) {
+  const segments = path2.relative(contentDir, filePath).split(path2.sep);
+  let dir = contentDir;
+  for (const [index, name] of segments.entries()) {
+    if (!isDiscoverableDocsEntryName(name)) return false;
+    let entry;
+    try {
+      entry = readdirSync2(dir, { withFileTypes: true }).find(
+        (candidate) => candidate.name === name
+      );
+    } catch {
+      return false;
+    }
+    const isLast = index === segments.length - 1;
+    if (!entry || !(isLast ? entry.isFile() : entry.isDirectory())) return false;
+    dir = path2.join(dir, name);
+  }
+  return true;
+}
+__name(isDiscoverableDocsFile, "isDiscoverableDocsFile");
 function findDocsPageFile(contentDir, slug) {
-  const segments = slug ? slug.split("/").filter(Boolean) : [];
-  if (!segments.every(isSafeSegment)) return null;
+  const canonicalSlug = trimSlashes(slug);
+  const segments = canonicalSlug ? canonicalSlug.split("/") : [];
+  if (!segments.every((segment) => isSafeSegment(segment) && isDiscoverableDocsEntryName(segment))) {
+    return null;
+  }
   const slugDir = path2.join(contentDir, ...segments);
   const candidates = segments.length === 0 ? DOCS_FILE_NAMES.map((filename) => path2.join(contentDir, filename)) : [
     ...DOCS_FILE_NAMES.map((filename) => path2.join(slugDir, filename)),
-    ...DOCS_FILE_EXTENSIONS2.map((extension) => path2.join(contentDir, `${slug}${extension}`))
+    ...DOCS_FILE_EXTENSIONS2.map(
+      (extension) => path2.join(contentDir, `${canonicalSlug}${extension}`)
+    )
   ];
   for (const candidate of candidates) {
+    if (pathToSlug(contentDir, candidate) !== canonicalSlug) continue;
+    if (!isDiscoverableDocsFile(contentDir, candidate)) continue;
     const safePath = resolveExistingFileInside(contentDir, candidate);
     if (safePath) {
       return safePath;
@@ -784,6 +824,10 @@ function loadFarmDocsPage(contentDir, docs, slug) {
   };
 }
 __name(loadFarmDocsPage, "loadFarmDocsPage");
+function getFarmDocsMarkdownPath(href) {
+  return href === "/" ? "/.md" : `${href}.md`;
+}
+__name(getFarmDocsMarkdownPath, "getFarmDocsMarkdownPath");
 function createDocsHref(entry, slug) {
   const normalizedEntry = normalizeEntry2(entry);
   const normalizedSlug = trimSlashes(slug);
@@ -861,8 +905,8 @@ function getDocsDescription(docs) {
   return docs.config.metadata?.description;
 }
 __name(getDocsDescription, "getDocsDescription");
-function getLoadedDocsPages(contentDir, docs) {
-  return discoverFarmDocsPages(contentDir, docs).map((page) => loadFarmDocsPage(contentDir, docs, page.slug)).filter((page) => Boolean(page));
+function getLoadedDocsPages(contentDir, docs, isPathGuarded) {
+  return discoverFarmDocsPages(contentDir, docs).filter((page) => !isPathGuarded?.(page.href)).map((page) => loadFarmDocsPage(contentDir, docs, page.slug)).filter((page) => Boolean(page));
 }
 __name(getLoadedDocsPages, "getLoadedDocsPages");
 function toDocsLlmsPage(page) {
@@ -1057,10 +1101,10 @@ function getDocsDiscoveryOptions(docs, request) {
   };
 }
 __name(getDocsDiscoveryOptions, "getDocsDiscoveryOptions");
-function createFarmDocsPublicResponse(contentDir, docs, request) {
+function createFarmDocsPublicResponse(contentDir, docs, request, isPathGuarded) {
   const url = new URL(request.url);
   let loadedPages;
-  const getPages = /* @__PURE__ */ __name(() => loadedPages ?? (loadedPages = getLoadedDocsPages(contentDir, docs)), "getPages");
+  const getPages = /* @__PURE__ */ __name(() => loadedPages ?? (loadedPages = getLoadedDocsPages(contentDir, docs, isPathGuarded)), "getPages");
   const sitemapManifest = /* @__PURE__ */ __name(() => docsEngine().buildDocsSitemapManifest({
     pages: getPages().map(toDocsSitemapPage),
     entry: docs.entry,
@@ -1786,11 +1830,11 @@ function renderDocsSearchTrigger(showIcon = true, className = "") {
 __name(renderDocsSearchTrigger, "renderDocsSearchTrigger");
 function renderDocsSearchMount(clientEntry) {
   return `<div id="farm-docs-search-root" data-farm-docs-search-root data-api="/api/docs"></div>
-  <script type="module" src="${escapeAttribute(clientEntry)}"></script>`;
+  ${stampFarmCspNonce(`<script type="module" src="${escapeAttribute(clientEntry)}"></script>`)}`;
 }
 __name(renderDocsSearchMount, "renderDocsSearchMount");
 function renderDocsSearchBootstrapScript() {
-  return `<script>${generateFarmDocsSearchBootstrapRuntime()}</script>`;
+  return stampFarmCspNonce(`<script>${generateFarmDocsSearchBootstrapRuntime()}</script>`);
 }
 __name(renderDocsSearchBootstrapScript, "renderDocsSearchBootstrapScript");
 function renderPixelToc(items) {
@@ -1820,9 +1864,9 @@ function renderDocsHashRuntimeScript() {
 }
 __name(renderDocsHashRuntimeScript, "renderDocsHashRuntimeScript");
 function renderDocsRuntimeScripts(docs) {
-  return `${renderDocsRuntimeScript(docs)}
+  return stampFarmCspNonce(`${renderDocsRuntimeScript(docs)}
 ${renderDocsHashRuntimeScript()}
-${renderDocsPageActionsRuntimeScript()}`;
+${renderDocsPageActionsRuntimeScript()}`);
 }
 __name(renderDocsRuntimeScripts, "renderDocsRuntimeScripts");
 function renderFarmDocsFontPreloads(fontAssets) {
@@ -1934,7 +1978,9 @@ function createFarmDocsHandler(docs, options) {
     const socialImageSlug = getFarmDocsSocialImageSlug(docs, requestUrl);
     if (socialImageSlug !== null) {
       const socialImagePage = loadFarmDocsPage(contentDir, docs, socialImageSlug);
-      if (!socialImagePage || !isFarmDocsSocialImageEnabled(socialImagePage, docs) || getFarmDocsCustomSocialImage(socialImagePage)) {
+      if (!socialImagePage || // The image sits outside the page's URL, where its guard does not reach, and
+      // draws the page's title.
+      options.isPathGuarded?.(socialImagePage.href) || !isFarmDocsSocialImageEnabled(socialImagePage, docs) || getFarmDocsCustomSocialImage(socialImagePage)) {
         return null;
       }
       const descriptor = createFarmDocsSocialImageDescriptor(socialImagePage, docs, requestUrl);
@@ -1953,12 +1999,20 @@ function createFarmDocsHandler(docs, options) {
       if (request.method === "HEAD") return new Response(null, { status: 200, headers });
       return new Response(renderFarmDocsSocialImageSvg(descriptor), { status: 200, headers });
     }
-    const publicResponse = createFarmDocsPublicResponse(contentDir, docs, request);
+    const publicResponse = createFarmDocsPublicResponse(
+      contentDir,
+      docs,
+      request,
+      options.isPathGuarded
+    );
     if (publicResponse) return omitFarmDocsHeadBody(request, publicResponse);
     if (!isFarmDocsRequest(docs, request)) return null;
     const page = loadPage(contentDir, docs, request);
     if (!page) return null;
     const negotiatesAccept = !requestUrl.pathname.endsWith(".md");
+    if (!negotiatesAccept && options.isPathGuarded?.(page.href) && !options.isPathGuarded(getFarmDocsMarkdownPath(page.href))) {
+      return null;
+    }
     if (shouldReturnMarkdown(request)) {
       const origin = new URL(request.url).origin;
       return omitFarmDocsHeadBody(
@@ -2022,6 +2076,7 @@ export {
   getFarmDocsRouteTypeEntries,
   getFarmDocsDocumentNavigationMatchers,
   loadFarmDocsPage,
+  getFarmDocsMarkdownPath,
   discoverFarmDocsPages,
   toFarmDocsMarkdownPage,
   createFarmDocsHandler

package/dist/{chunk-6LGFV2CQ.cjs → chunk-5OKBARDN.cjs}

@@ -13,7 +13,7 @@ var _chunkYWN746UScjs = require('./chunk-YWN746US.cjs');
 var _chunkOX6O6WVAcjs = require('./chunk-OX6O6WVA.cjs');
 
 
-var _chunkOW67PDDScjs = require('./chunk-OW67PDDS.cjs');
+var _chunkULASELLAcjs = require('./chunk-ULASELLA.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -118,7 +118,7 @@ function createServerFn(options) {
       throw labelInputErrors && isSchemaValidationFailure(cause) ? new ServerFnInputError(cause) : cause;
     }
     const executionContext = _chunkT5OJPTVNcjs.getServerActionExecutionContext.call(void 0, );
-    const request = _nullishCoalesce(_optionalChain([executionContext, 'optionalAccess', _ => _.request]), () => ( _chunkOW67PDDScjs._resolveCurrentRequestForApp.call(void 0, )));
+    const request = _nullishCoalesce(_optionalChain([executionContext, 'optionalAccess', _ => _.request]), () => ( _chunkULASELLAcjs._resolveCurrentRequestForApp.call(void 0, )));
     const signal = _nullishCoalesce(_nullishCoalesce(_optionalChain([executionContext, 'optionalAccess', _2 => _2.signal]), () => ( _optionalChain([request, 'optionalAccess', _3 => _3.signal]))), () => ( _chunkT5OJPTVNcjs.getServerActionSignal.call(void 0, )));
     const handlerContext = {
       input,

package/dist/{chunk-3IP27TCG.cjs → chunk-5PWXMJOH.cjs}

@@ -9,7 +9,7 @@ var _chunk4PPEPOZZcjs = require('./chunk-4PPEPOZZ.cjs');
 var _chunkMQ3H6LT5cjs = require('./chunk-MQ3H6LT5.cjs');
 
 
-var _chunkU6MPZ35Qcjs = require('./chunk-U6MPZ35Q.cjs');
+var _chunkRWFLWR5Jcjs = require('./chunk-RWFLWR5J.cjs');
 
 
 var _chunkFUCSUGDMcjs = require('./chunk-FUCSUGDM.cjs');
@@ -23,7 +23,7 @@ var _chunk2CQ74SP6cjs = require('./chunk-2CQ74SP6.cjs');
 
 
 
-var _chunkNDILNQ4Lcjs = require('./chunk-NDILNQ4L.cjs');
+var _chunkXKG2BLFNcjs = require('./chunk-XKG2BLFN.cjs');
 
 
 var _chunk6V4TDWECcjs = require('./chunk-6V4TDWEC.cjs');
@@ -47,7 +47,7 @@ var _chunk5QIKR7RRcjs = require('./chunk-5QIKR7RR.cjs');
 var _chunkUQZ4AYTHcjs = require('./chunk-UQZ4AYTH.cjs');
 
 
-var _chunkNICDYKBScjs = require('./chunk-NICDYKBS.cjs');
+var _chunk6XWDE2P2cjs = require('./chunk-6XWDE2P2.cjs');
 
 
 
@@ -114,7 +114,7 @@ function farmApiPlugin(options = {}) {
     const existing = apiRoutesCache.get(routePath);
     const existingFile = _optionalChain([endpointSources, 'access', _ => _.get, 'call', _2 => _2(routePath), 'optionalAccess', _3 => _3.get, 'call', _4 => _4(normalizedMethod)]);
     if (existingFile) {
-      throw new (0, _chunkU6MPZ35Qcjs.APIRouteConflictError)(routePath, normalizedMethod, existingFile, filePath);
+      throw new (0, _chunkRWFLWR5Jcjs.APIRouteConflictError)(routePath, normalizedMethod, existingFile, filePath);
     }
     if (existing) {
       if (!existing.methods.includes(normalizedMethod)) {
@@ -190,7 +190,7 @@ function farmApiPlugin(options = {}) {
   const createRouter = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, async () => {
     const plugins = options.plugins ? await (_nullishCoalesce(routePlugins, () => ( (routePlugins = Promise.resolve(options.plugins({ root: projectRoot })))))) : [];
     pluginMergedRoutes = plugins.length ? new Map(
-      _chunkNDILNQ4Lcjs.mergePluginAPIRoutes.call(void 0, [...apiRoutesCache.values()], plugins, void 0, {
+      _chunkXKG2BLFNcjs.mergePluginAPIRoutes.call(void 0, [...apiRoutesCache.values()], plugins, void 0, {
         bodySizeLimit,
         // A plugin calling an app endpoint (an MCP tool, say) goes back through this server,
         // so the middleware that guards the endpoint's path runs for it.
@@ -210,7 +210,7 @@ function farmApiPlugin(options = {}) {
         const url = new URL(request.url);
         const method = request.method.toUpperCase();
         const pathname = url.pathname;
-        const match = _chunkNDILNQ4Lcjs.matchAPIRouteAtBasePath.call(void 0, servedRoutes(), pathname, basePath);
+        const match = _chunkXKG2BLFNcjs.matchAPIRouteAtBasePath.call(void 0, servedRoutes(), pathname, basePath);
         if (!match) {
           return new Response(JSON.stringify({ error: "Not Found" }), {
             status: 404,
@@ -218,18 +218,18 @@ function farmApiPlugin(options = {}) {
           });
         }
         const { route, params } = match;
-        const endpoint = _chunkNDILNQ4Lcjs.resolveAPIRouteEndpoint.call(void 0, route, method);
+        const endpoint = _chunkXKG2BLFNcjs.resolveAPIRouteEndpoint.call(void 0, route, method);
         if (!endpoint) {
           return new Response(JSON.stringify({ error: "Method Not Allowed" }), {
             status: 405,
             headers: {
-              Allow: _chunkNDILNQ4Lcjs.getAllowedAPIRouteMethods.call(void 0, route).join(", "),
+              Allow: _chunkXKG2BLFNcjs.getAllowedAPIRouteMethods.call(void 0, route).join(", "),
               "Content-Type": "application/json"
             }
           });
         }
         try {
-          return await _chunkNDILNQ4Lcjs.invokeAPIRouteEndpoint.call(void 0, endpoint, request, params, bodySizeLimit);
+          return await _chunkXKG2BLFNcjs.invokeAPIRouteEndpoint.call(void 0, endpoint, request, params, bodySizeLimit);
         } catch (error) {
           return new Response(JSON.stringify({ error: error.message || "Internal Server Error" }), {
             status: 500,
@@ -278,7 +278,7 @@ function farmApiPlugin(options = {}) {
             const routeModule = await _chunkSHLXACIOcjs.loadFarmDevModule.call(void 0, server, filePath);
             const endpoints = {};
             const availableMethods = [];
-            for (const method of _chunkNDILNQ4Lcjs.API_ROUTE_METHODS) {
+            for (const method of _chunkXKG2BLFNcjs.API_ROUTE_METHODS) {
               if (routeModule[method]) {
                 availableMethods.push(method);
                 endpoints[method] = routeModule[method];
@@ -291,7 +291,7 @@ function farmApiPlugin(options = {}) {
               log(`API route discovered: ${availableMethods.join(", ")} ${routePath}`);
             }
           } catch (e) {
-            if (e instanceof _chunkU6MPZ35Qcjs.APIRouteConflictError || e instanceof _chunkNO3WWW3Ncjs.AmbiguousRouteError) throw e;
+            if (e instanceof _chunkRWFLWR5Jcjs.APIRouteConflictError || e instanceof _chunkNO3WWW3Ncjs.AmbiguousRouteError) throw e;
             log(`API route load failed at ${filePath}: ${e.message}`);
           }
         }
@@ -318,7 +318,7 @@ function farmApiPlugin(options = {}) {
                 }
               }
             } catch (e) {
-              if (e instanceof _chunkU6MPZ35Qcjs.APIRouteConflictError || e instanceof _chunkNO3WWW3Ncjs.AmbiguousRouteError) throw e;
+              if (e instanceof _chunkRWFLWR5Jcjs.APIRouteConflictError || e instanceof _chunkNO3WWW3Ncjs.AmbiguousRouteError) throw e;
               log(`Root routes.ts load failed: ${e.message}`);
             }
             break;
@@ -349,7 +349,7 @@ function farmApiPlugin(options = {}) {
               }
             }
           } catch (e) {
-            if (e instanceof _chunkU6MPZ35Qcjs.APIRouteConflictError || e instanceof _chunkNO3WWW3Ncjs.AmbiguousRouteError) throw e;
+            if (e instanceof _chunkRWFLWR5Jcjs.APIRouteConflictError || e instanceof _chunkNO3WWW3Ncjs.AmbiguousRouteError) throw e;
             log(`Programmatic routes file load failed at ${routeFile}: ${e.message}`);
           }
         }
@@ -401,7 +401,7 @@ function farmApiPlugin(options = {}) {
           const pathname = url.split("?")[0];
           const method = req.method || "GET";
           if (discoveryPromise) await waitForDiscovery();
-          if (!_chunkNDILNQ4Lcjs.matchAPIRouteAtBasePath.call(void 0, servedRoutes(), pathname, basePath)) {
+          if (!_chunkXKG2BLFNcjs.matchAPIRouteAtBasePath.call(void 0, servedRoutes(), pathname, basePath)) {
             return next();
           }
           if (!apiRouterHandler) {
@@ -422,10 +422,10 @@ function farmApiPlugin(options = {}) {
             }
             const currentUrl = req.url || url;
             const currentPathname = currentUrl.split("?")[0];
-            if (currentPathname !== pathname && !_chunkNDILNQ4Lcjs.matchAPIRouteAtBasePath.call(void 0, servedRoutes(), currentPathname, basePath)) {
+            if (currentPathname !== pathname && !_chunkXKG2BLFNcjs.matchAPIRouteAtBasePath.call(void 0, servedRoutes(), currentPathname, basePath)) {
               return next();
             }
-            const fullUrl = _chunkNICDYKBScjs.resolveFarmRequestURL.call(void 0, req);
+            const fullUrl = _chunk6XWDE2P2cjs.resolveFarmRequestURL.call(void 0, req);
             const headers = new Headers();
             for (const [key, value] of Object.entries(req.headers)) {
               if (value) {
@@ -526,7 +526,7 @@ function farmApiPlugin(options = {}) {
           log(`API router recreated`);
         } catch (e) {
           restoreRouteState(previousState);
-          if (e instanceof _chunkU6MPZ35Qcjs.APIRouteConflictError || e instanceof _chunkNO3WWW3Ncjs.AmbiguousRouteError) throw e;
+          if (e instanceof _chunkRWFLWR5Jcjs.APIRouteConflictError || e instanceof _chunkNO3WWW3Ncjs.AmbiguousRouteError) throw e;
           log(`Root routes.ts HMR failed: ${e.message}`);
         }
         return [];
@@ -554,7 +554,7 @@ function farmApiPlugin(options = {}) {
           const routeModule = await _chunkSHLXACIOcjs.loadFarmDevModule.call(void 0, server, file);
           removeEndpointsFromFile(file);
           const availableMethods = [];
-          for (const method of _chunkNDILNQ4Lcjs.API_ROUTE_METHODS) {
+          for (const method of _chunkXKG2BLFNcjs.API_ROUTE_METHODS) {
             if (!routeModule[method]) continue;
             availableMethods.push(method);
             addEndpoint(routePath, file, method, routeModule[method]);
@@ -564,7 +564,7 @@ function farmApiPlugin(options = {}) {
           log(`API router recreated`);
         } catch (e) {
           restoreRouteState(previousState);
-          if (e instanceof _chunkU6MPZ35Qcjs.APIRouteConflictError || e instanceof _chunkNO3WWW3Ncjs.AmbiguousRouteError) throw e;
+          if (e instanceof _chunkRWFLWR5Jcjs.APIRouteConflictError || e instanceof _chunkNO3WWW3Ncjs.AmbiguousRouteError) throw e;
           log(`API route HMR failed: ${e.message}`);
         }
         return [];