@farm.js/core 0.1.37 → 0.1.38

package/dist/chunk-6BK3K2GB.mjs

@@ -0,0 +1,318 @@
+import {
+  __name
+} from "./chunk-LPEX4YW6.mjs";
+
+// src/nitro/node-server-entry.ts
+var FARM_NODE_ENV_MODULE_FILE = "farm-node-env.mjs";
+var FARM_NODE_ENV_MODULE_SOURCE = `if (!process.env.NODE_ENV) process.env.NODE_ENV = "production";
+`;
+function createFarmNodeServerEntry(options) {
+  const serverConfig = JSON.stringify(options.server);
+  const nitroEntryImport = `./${options.nitroEntryFile.replace(/^\.\//, "")}`;
+  return `
+import "./${FARM_NODE_ENV_MODULE_FILE}";
+import "#nitro/virtual/polyfills";
+import { NodeRequest, serve } from ${JSON.stringify(options.nodeAdapterModule)};
+import wsAdapter from ${JSON.stringify(options.websocketAdapterModule)};
+import { resolveWebsocketHooks, useNitroApp, useNitroHooks } from "#nitro/runtime/app";
+import { useRuntimeConfig } from "#nitro/runtime/runtime-config";
+import { trapUnhandledErrors } from "#nitro/runtime/error/hooks";
+import { setupCloseHooks } from "#nitro/runtime/shutdown";
+import { startScheduleRunner } from "#nitro/runtime/task";
+import { tracingSrvxPlugins } from "#nitro/virtual/tracing";
+import { farmProductionLifecycle } from ${JSON.stringify(nitroEntryImport)};
+
+const farmServerConfig = ${serverConfig};
+if (!process.env.NITRO_SHUTDOWN_TIMEOUT) {
+  process.env.NITRO_SHUTDOWN_TIMEOUT = String(farmServerConfig.gracefulShutdownTimeout);
+}
+const shutdownConfig = {
+  disabled: Boolean(process.env.NITRO_SHUTDOWN_DISABLED),
+  signals: (process.env.NITRO_SHUTDOWN_SIGNALS || "SIGTERM SIGINT")
+    .split(" ")
+    .map((signal) => signal.trim())
+    .filter(Boolean),
+  timeout: Number.parseInt(process.env.NITRO_SHUTDOWN_TIMEOUT || "", 10) || 30000,
+  forceExit: !process.env.NITRO_SHUTDOWN_NO_FORCE_EXIT,
+};
+
+const nitroApp = useNitroApp();
+useNitroHooks().hook("close", async () => {
+  try {
+    await farmProductionLifecycle.close("production-server-closed");
+  } catch (error) {
+    process.exitCode = 1;
+    throw error;
+  }
+});
+
+let startupSignal;
+let resolveStartupSignal;
+const startupSignalPromise = new Promise((resolve) => {
+  resolveStartupSignal = resolve;
+});
+const startupSignalListeners = new Map();
+if (!shutdownConfig.disabled) {
+  for (const signal of shutdownConfig.signals) {
+    const listener = (receivedSignal) => {
+      if (!startupSignal) {
+        startupSignal = receivedSignal;
+        resolveStartupSignal(receivedSignal);
+      }
+      farmProductionLifecycle.beginDrain(receivedSignal);
+    };
+    startupSignalListeners.set(signal, listener);
+    process.once(signal, listener);
+  }
+}
+
+try {
+  await Promise.race([
+    Promise.resolve().then(() => farmProductionLifecycle.start()),
+    startupSignalPromise,
+  ]);
+} catch (error) {
+  await farmProductionLifecycle.close("production-start-failed").catch((closeError) => {
+    console.error("[Farm] Runtime cleanup after startup failure failed:", closeError);
+  });
+  throw error;
+} finally {
+  for (const [signal, listener] of startupSignalListeners) {
+    process.removeListener(signal, listener);
+  }
+}
+
+if (startupSignal) {
+  let startupCloseTimer;
+  const startupCloseCompleted = await Promise.race([
+    Promise.resolve()
+      .then(() => farmProductionLifecycle.close(startupSignal))
+      .then(
+        () => true,
+        (error) => {
+          console.error("[Farm] Runtime shutdown during startup failed:", error);
+          process.exitCode = 1;
+          return true;
+        },
+      ),
+    new Promise((resolve) => {
+      startupCloseTimer = setTimeout(() => resolve(false), farmServerConfig.gracefulShutdownTimeout);
+    }),
+  ]);
+  clearTimeout(startupCloseTimer);
+  if (!startupCloseCompleted) {
+    console.warn("[Farm] Runtime startup did not settle before shutdown; forcing cleanup");
+    let forcedCloseTimer;
+    const forcedCloseCompleted = await Promise.race([
+      Promise.resolve()
+        .then(() => farmProductionLifecycle.forceClose(startupSignal))
+        .then(
+          () => true,
+          (error) => {
+            console.error("[Farm] Forced runtime shutdown during startup failed:", error);
+            process.exitCode = 1;
+            return true;
+          },
+        ),
+      new Promise((resolve) => {
+        forcedCloseTimer = setTimeout(
+          () => resolve(false),
+          farmServerConfig.gracefulShutdownTimeout,
+        );
+      }),
+    ]);
+    clearTimeout(forcedCloseTimer);
+    if (!forcedCloseCompleted) {
+      console.error("[Farm] Forced runtime shutdown during startup timed out");
+      process.exitCode = 1;
+    }
+  }
+  process.exit(process.exitCode || 0);
+}
+
+const cert = process.env.NITRO_SSL_CERT;
+const key = process.env.NITRO_SSL_KEY;
+const configuredPort = Number(process.env.NITRO_PORT || process.env.PORT);
+const port = Number.isFinite(configuredPort) && configuredPort > 0 ? configuredPort : 3000;
+const host = process.env.NITRO_HOST || process.env.HOST;
+const socketPath = process.env.NITRO_UNIX_SOCKET;
+const server = serve({
+  manual: true,
+  silent: true,
+  gracefulShutdown: false,
+  port,
+  hostname: host,
+  node: socketPath ? { path: socketPath } : undefined,
+  tls: cert && key ? { cert, key } : undefined,
+  fetch: nitroApp.fetch,
+  plugins: [...tracingSrvxPlugins],
+});
+const nodeServer = server.node?.server;
+if (!nodeServer) throw new Error("[Farm] Nitro did not create a Node server");
+
+nodeServer.headersTimeout = farmServerConfig.headersTimeout;
+nodeServer.requestTimeout = farmServerConfig.requestTimeout;
+nodeServer.keepAliveTimeout = farmServerConfig.keepAliveTimeout;
+
+let isShuttingDown = false;
+nodeServer.on("request", (_request, response) => {
+  response.once("finish", () => {
+    if (isShuttingDown) nodeServer.closeIdleConnections?.();
+  });
+});
+
+if (import.meta._websocket) {
+  const { handleUpgrade } = wsAdapter({ resolve: resolveWebsocketHooks });
+  nodeServer.on("upgrade", (request, socket, head) => {
+    handleUpgrade(
+      request,
+      socket,
+      head,
+      new NodeRequest({ req: request, upgrade: { socket, head } }),
+    );
+  });
+}
+
+setupCloseHooks(server);
+trapUnhandledErrors();
+
+let shutdownPromise;
+async function shutdown(signal) {
+  isShuttingDown = true;
+  farmProductionLifecycle.beginDrain(signal);
+
+  const gracefulClose = server.close().then(
+    () => true,
+    (error) => {
+      console.error("[Farm] Runtime shutdown failed:", error);
+      process.exitCode = 1;
+      return true;
+    },
+  );
+  nodeServer.closeIdleConnections?.();
+  let gracefulTimer;
+  const gracefullyClosed = await Promise.race([
+    gracefulClose,
+    new Promise((resolve) => {
+      gracefulTimer = setTimeout(() => resolve(false), shutdownConfig.timeout);
+    }),
+  ]);
+  clearTimeout(gracefulTimer);
+
+  if (!gracefullyClosed) {
+    console.warn("[Farm] Graceful shutdown timed out; forcing cleanup");
+    void server.close(true).catch((error) => {
+      console.error("[Farm] Forced server shutdown failed:", error);
+      process.exitCode = 1;
+    });
+
+    let forceTimer;
+    const forceClosed = await Promise.race([
+      Promise.resolve()
+        .then(() => farmProductionLifecycle.forceClose("production-server-closed"))
+        .then(
+          () => true,
+          (error) => {
+            console.error("[Farm] Forced runtime shutdown failed:", error);
+            process.exitCode = 1;
+            return true;
+          },
+        ),
+      new Promise((resolve) => {
+        forceTimer = setTimeout(() => resolve(false), shutdownConfig.timeout);
+      }),
+    ]);
+    clearTimeout(forceTimer);
+    if (!forceClosed) {
+      console.error("[Farm] Forced runtime shutdown timed out");
+      process.exitCode = 1;
+    }
+  }
+
+  if (shutdownConfig.forceExit) process.exit(process.exitCode || 0);
+}
+
+if (!shutdownConfig.disabled) {
+  for (const signal of shutdownConfig.signals) {
+    process.once(signal, (receivedSignal) => {
+      shutdownPromise ||= shutdown(receivedSignal);
+    });
+  }
+}
+
+try {
+  await server.serve();
+  const protocol = cert && key ? "https" : "http";
+  const addressInfo = nodeServer.address();
+  if (typeof addressInfo === "string") {
+    console.log(\`Listening on unix socket \${addressInfo}\`);
+  } else if (addressInfo) {
+    const configuredBaseURL = useRuntimeConfig().app.baseURL || "";
+    const baseURL = configuredBaseURL.endsWith("/")
+      ? configuredBaseURL.slice(0, -1)
+      : configuredBaseURL;
+    const address = addressInfo.family === "IPv6"
+      ? \`[\${addressInfo.address}]\`
+      : addressInfo.address;
+    console.log(\`Listening on \${protocol}://\${address}:\${addressInfo.port}\${baseURL}\`);
+  }
+} catch (error) {
+  console.error(error);
+  process.exitCode = 1;
+  await farmProductionLifecycle.close("production-listen-error").catch((closeError) => {
+    console.error("[Farm] Runtime cleanup after listen failure failed:", closeError);
+  });
+  throw error;
+}
+
+if (import.meta._tasks) {
+  startScheduleRunner({ waitUntil: server.waitUntil });
+}
+
+export default {};
+  `.trim();
+}
+__name(createFarmNodeServerEntry, "createFarmNodeServerEntry");
+
+// src/build/production-node-env.ts
+var productionNodeEnvStateKey = /* @__PURE__ */ Symbol.for("@farm.js/core/production-node-env-state");
+function getProductionNodeEnvState() {
+  return Reflect.get(globalThis, productionNodeEnvStateKey);
+}
+__name(getProductionNodeEnvState, "getProductionNodeEnvState");
+async function withProductionNodeEnv(operation) {
+  let state = getProductionNodeEnvState();
+  if (state) {
+    state.depth += 1;
+  } else {
+    state = {
+      depth: 1,
+      original: process.env.NODE_ENV
+    };
+    Reflect.set(globalThis, productionNodeEnvStateKey, state);
+  }
+  process.env.NODE_ENV = "production";
+  try {
+    return await operation();
+  } finally {
+    state.depth -= 1;
+    if (state.depth > 0) {
+      process.env.NODE_ENV = "production";
+    } else {
+      Reflect.deleteProperty(globalThis, productionNodeEnvStateKey);
+      if (state.original === void 0) {
+        delete process.env.NODE_ENV;
+      } else {
+        process.env.NODE_ENV = state.original;
+      }
+    }
+  }
+}
+__name(withProductionNodeEnv, "withProductionNodeEnv");
+
+export {
+  FARM_NODE_ENV_MODULE_FILE,
+  FARM_NODE_ENV_MODULE_SOURCE,
+  createFarmNodeServerEntry,
+  withProductionNodeEnv
+};

package/dist/{chunk-HEVMCTSR.mjs → chunk-6HB6V3R7.mjs}

@@ -34,7 +34,7 @@ import {
 } from "./chunk-4SIYUGRY.mjs";
 import {
   _runWithCurrentRequest
-} from "./chunk-3KGDJLJK.mjs";
+} from "./chunk-POSPE3IO.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";

package/dist/{chunk-NICDYKBS.cjs → chunk-6XWDE2P2.cjs}

@@ -1,7 +1,8 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 
-var _chunkOW67PDDScjs = require('./chunk-OW67PDDS.cjs');
+
+var _chunkULASELLAcjs = require('./chunk-ULASELLA.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -66,8 +67,24 @@ function getAppRequestView(request) {
   return view;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getAppRequestView, "getAppRequestView");
-_chunkOW67PDDScjs._setCurrentRequestResolver.call(void 0, () => requestStore.getStore());
-_chunkOW67PDDScjs._setAppRequestView.call(void 0, getAppRequestView);
+_chunkULASELLAcjs._setCurrentRequestResolver.call(void 0, () => requestStore.getStore());
+var CSP_NONCE_STORAGE_KEY = /* @__PURE__ */ Symbol.for("@farm.js/core/csp-nonce-storage");
+function getCspNonceStore() {
+  const runtime = globalThis;
+  const existing = runtime[CSP_NONCE_STORAGE_KEY];
+  if (existing instanceof _async_hooks.AsyncLocalStorage) return existing;
+  const storage = new (0, _async_hooks.AsyncLocalStorage)();
+  runtime[CSP_NONCE_STORAGE_KEY] = storage;
+  return storage;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, getCspNonceStore, "getCspNonceStore");
+var cspNonceStore = getCspNonceStore();
+_chunkULASELLAcjs._setCspNonceResolver.call(void 0, () => cspNonceStore.getStore());
+function _runWithFarmCspNonce(nonce, fn) {
+  return nonce ? cspNonceStore.run(nonce, fn) : fn();
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, _runWithFarmCspNonce, "_runWithFarmCspNonce");
+_chunkULASELLAcjs._setAppRequestView.call(void 0, getAppRequestView);
 function resolveFarmRequestURL(req, options = {}) {
   if (options.origin) {
     return new URL(req.url || "/", options.origin);
@@ -176,4 +193,5 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, getCurrentRequestOrNull, "getCurrentReques
 
 
 
-exports.resolveFarmRequestURL = resolveFarmRequestURL; exports.resolveFarmWebRequestOrigin = resolveFarmWebRequestOrigin; exports.createWebRequestFromFarmRequest = createWebRequestFromFarmRequest; exports._runWithCurrentRequest = _runWithCurrentRequest; exports.getCurrentRequest = getCurrentRequest; exports._getRequestReadCount = _getRequestReadCount; exports.getCurrentRequestOrNull = getCurrentRequestOrNull;
+
+exports._runWithFarmCspNonce = _runWithFarmCspNonce; exports.resolveFarmRequestURL = resolveFarmRequestURL; exports.resolveFarmWebRequestOrigin = resolveFarmWebRequestOrigin; exports.createWebRequestFromFarmRequest = createWebRequestFromFarmRequest; exports._runWithCurrentRequest = _runWithCurrentRequest; exports.getCurrentRequest = getCurrentRequest; exports._getRequestReadCount = _getRequestReadCount; exports.getCurrentRequestOrNull = getCurrentRequestOrNull;

package/dist/{chunk-Z7LA7MHQ.mjs → chunk-7FPTZLKH.mjs}

@@ -27,7 +27,7 @@ import {
 } from "./chunk-ZMSZZXOR.mjs";
 import {
   getIntegrationSchemas
-} from "./chunk-Z5BEWYVO.mjs";
+} from "./chunk-IBUQWVYA.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";

package/dist/{chunk-JPNFPAZ4.mjs → chunk-7PEP3BUT.mjs}

@@ -13,7 +13,7 @@ import {
 } from "./chunk-IHQIOZLC.mjs";
 import {
   _resolveCurrentRequest
-} from "./chunk-S3VWVTVA.mjs";
+} from "./chunk-QRKIMN7T.mjs";
 import {
   stripFarmLocaleFromPathname
 } from "./chunk-L3KT7IXV.mjs";

package/dist/{chunk-XOPOIFTJ.mjs → chunk-A3EAIURZ.mjs}

@@ -1,20 +1,21 @@
 import {
   discoverFarmDocsPages,
+  getFarmDocsMarkdownPath,
   loadFarmDocsPage,
   resolveFarmDocsContentDir,
   toFarmDocsMarkdownPage
-} from "./chunk-O6WAEAX3.mjs";
+} from "./chunk-5BWWFHR2.mjs";
 import {
   docsEngine,
   loadFarmDocsEngine
 } from "./chunk-2VQKKQ6D.mjs";
 import {
   resolveDocsConfig
-} from "./chunk-EXG5LD6B.mjs";
+} from "./chunk-ZJD2PN6Z.mjs";
 import {
   getFarmDocsAdapterConfigModule,
   isSecretDocsConfigKey
-} from "./chunk-ENLZ4R3Y.mjs";
+} from "./chunk-J7K2NZD6.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
@@ -27,6 +28,15 @@ function hasFarmDocsRuntimeAdapter(docs) {
   return Boolean(docs?.enabled && docs.adapter?.server && docs.adapter.react);
 }
 __name(hasFarmDocsRuntimeAdapter, "hasFarmDocsRuntimeAdapter");
+function assertFarmDocsAdapterServesNoGuardedPages(docs, options, isPathGuarded) {
+  if (!isPathGuarded || !hasFarmDocsRuntimeAdapter(docs)) return;
+  const guarded = discoverFarmDocsPages(resolveFarmDocsContentDir(docs, options), docs).filter((page) => isPathGuarded(page.href) || isPathGuarded(getFarmDocsMarkdownPath(page.href))).map((page) => page.href);
+  if (guarded.length === 0) return;
+  throw new Error(
+    `Docs pages behind a path guard (${guarded.join(", ")}) would be public: the docs adapter ${JSON.stringify(docs.adapter.id)} serves their content in llms-full.txt, search, Markdown, and MCP without running the app's guards. Move those pages out of the docs content directory, or set docs.adapter = false to use Farm's built-in docs runtime, which keeps guarded pages off anonymous surfaces.`
+  );
+}
+__name(assertFarmDocsAdapterServesNoGuardedPages, "assertFarmDocsAdapterServesNoGuardedPages");
 async function loadFarmDocsConfigModule(docs, loadModule) {
   const configModule = getFarmDocsAdapterConfigModule(docs);
   if (!configModule) return void 0;
@@ -99,6 +109,7 @@ async function createFarmDocsAdapterHandler(docs, options) {
   if (!hasFarmDocsRuntimeAdapter(docs)) {
     throw new Error("Farm docs adapter requires server and react runtime entrypoints.");
   }
+  assertFarmDocsAdapterServesNoGuardedPages(docs, options, options.isPathGuarded);
   const serverModule = await options.loadModule(
     docs.adapter.server
   );
@@ -277,7 +288,7 @@ function getDocsDescription(docs) {
 }
 __name(getDocsDescription, "getDocsDescription");
 function getLoadedDocsPages(context) {
-  return discoverFarmDocsPages(context.contentDir, context.docs).map((page) => loadFarmDocsPage(context.contentDir, context.docs, page.slug)).filter((page) => Boolean(page));
+  return discoverFarmDocsPages(context.contentDir, context.docs).filter((page) => !context.isPathGuarded(page.href)).map((page) => loadFarmDocsPage(context.contentDir, context.docs, page.slug)).filter((page) => Boolean(page));
 }
 __name(getLoadedDocsPages, "getLoadedDocsPages");
 function toDocsSourcePage(page) {
@@ -389,7 +400,9 @@ __name(renderAgentsDocument, "renderAgentsDocument");
 function buildAgentSpec(context, request) {
   const url = new URL(request.url);
   const origin = url.origin;
-  const pages = discoverFarmDocsPages(context.contentDir, context.docs);
+  const pages = discoverFarmDocsPages(context.contentDir, context.docs).filter(
+    (page) => !context.isPathGuarded(page.href)
+  );
   const spec = docsEngine().buildDocsAgentDiscoverySpec(getDocsDiscoveryOptions(context, request));
   const title = getDocsTitle(context.docs);
   return {
@@ -552,12 +565,14 @@ async function resolveAPIContext(options) {
     configPath: options.configPath
   };
   const docs = isResolvedDocsConfig(docsInput) ? docsInput : await resolveDocsConfig(docsInput, { root, srcDir });
+  const guardedPaths = new Set(runtimeConfig?.guardedPaths ?? []);
   return {
     root,
     srcDir,
     docs,
     contentDir: resolveFarmDocsContentDir(docs, { root, srcDir }),
-    diagnostics: options.diagnostics === true
+    diagnostics: options.diagnostics === true,
+    isPathGuarded: options.isPathGuarded ?? ((pathname) => guardedPaths.has(pathname))
   };
 }
 __name(resolveAPIContext, "resolveAPIContext");
@@ -616,7 +631,9 @@ async function handleDocsAPIGet(request, context) {
     const pathParam = url.searchParams.get("path") || url.searchParams.get("slug");
     const slug = normalizeDocsApiSlug(pathParam ?? pathTarget.slug ?? "", context.docs);
     const page = loadFarmDocsPage(context.contentDir, context.docs, slug);
-    if (!page) return text("Docs page not found\n", "text/plain; charset=utf-8", { status: 404 });
+    if (!page || context.isPathGuarded(page.href)) {
+      return text("Docs page not found\n", "text/plain; charset=utf-8", { status: 404 });
+    }
     return text(
       docsEngine().renderDocsMarkdownDocument(toFarmDocsMarkdownPage(page), {
         origin: new URL(request.url).origin,
@@ -688,6 +705,7 @@ __name(createFarmDocsAPIHandler, "createFarmDocsAPIHandler");
 
 export {
   hasFarmDocsRuntimeAdapter,
+  assertFarmDocsAdapterServesNoGuardedPages,
   compileFarmDocsAdapterEdgeManifest,
   createFarmDocsAdapterHandler,
   isFarmDocsAPIRequest,

package/dist/{chunk-LBDP3YT3.mjs → chunk-ARC7I3O2.mjs}

@@ -34,7 +34,7 @@ import {
 } from "./chunk-4SIYUGRY.mjs";
 import {
   _resolveCurrentRequest
-} from "./chunk-S3VWVTVA.mjs";
+} from "./chunk-QRKIMN7T.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";

package/dist/{chunk-LBGILORX.mjs → chunk-B6G5CKMC.mjs}

@@ -1,18 +1,29 @@
 import {
   FARM_DEFAULT_MCP_TOOLS
-} from "./chunk-UH6QN5NL.mjs";
+} from "./chunk-P664ZVTV.mjs";
 import {
   DEFAULT_ERROR_STYLES
 } from "./chunk-XAXTTBUT.mjs";
 import {
   serializeFarmLlmsTxt
-} from "./chunk-DTSROJ5J.mjs";
+} from "./chunk-HD5CF3OE.mjs";
+import {
+  stampFarmCspNonce
+} from "./chunk-U6QLDL3G.mjs";
 import {
   emitFarmAgentRead
 } from "./chunk-MVL2RAJW.mjs";
 import {
   resolveFarmThemeConfig
 } from "./chunk-AELACLOB.mjs";
+import {
+  integrationMiddlewareMayHandlePath
+} from "./chunk-IBUQWVYA.mjs";
+import {
+  compileMiddlewareConfig,
+  matchesCompiledMiddlewareConfig,
+  matchesMiddlewareRoute
+} from "./chunk-HZFM2LWQ.mjs";
 import {
   omitFarmResponseBody
 } from "./chunk-5WI2S4CO.mjs";
@@ -25,12 +36,13 @@ import {
   matchesFarmIfNoneMatch
 } from "./chunk-ZMMBIVQM.mjs";
 import {
+  createFarmAPIMiddlewarePathnames,
   resolveFarmAPIServerBasePath,
   resolveFarmAPIServerRoutePath
 } from "./chunk-BTHHUD7Q.mjs";
 import {
   FARM_VERSION
-} from "./chunk-YCKO6FRS.mjs";
+} from "./chunk-LI2F57NI.mjs";
 import {
   localizeFarmPathname
 } from "./chunk-L3KT7IXV.mjs";
@@ -219,6 +231,71 @@ ${html}`;
 }
 __name(composeFarmFullDocument, "composeFarmFullDocument");
 
+// src/middleware/may-handle.ts
+function hasFarmMiddlewareConfig(config) {
+  if (!config) return false;
+  if (Array.isArray(config)) return config.length > 0;
+  const configRecord = config;
+  return Boolean(
+    configRecord.matcher || configRecord.exclude || configRecord.runtime || configRecord.handler || Array.isArray(configRecord.handlers) && configRecord.handlers.length > 0
+  );
+}
+__name(hasFarmMiddlewareConfig, "hasFarmMiddlewareConfig");
+function configMiddlewareMayHandlePath(config, pathname) {
+  if (!hasFarmMiddlewareConfig(config)) return false;
+  const entries = Array.isArray(config) ? config : [config];
+  return entries.some((entry) => {
+    if (!entry.matcher && !entry.exclude) return true;
+    const matchers = entry.matcher ? (Array.isArray(entry.matcher) ? entry.matcher : [entry.matcher]).map(
+      (matcher) => (
+        // A request-aware matcher cannot be proven safe at build time.
+        typeof matcher === "function" ? () => true : matcher
+      )
+    ) : void 0;
+    const compiled = compileMiddlewareConfig({ matcher: matchers, exclude: entry.exclude });
+    return matchesCompiledMiddlewareConfig(pathname, compiled, {}).matched;
+  });
+}
+__name(configMiddlewareMayHandlePath, "configMiddlewareMayHandlePath");
+function appMiddlewareMayHandlePath(middlewareRoutes, pathname) {
+  return middlewareRoutes.some((route) => matchesMiddlewareRoute(pathname, route).matched);
+}
+__name(appMiddlewareMayHandlePath, "appMiddlewareMayHandlePath");
+var CATCH_ALL_PROBE = "/__farm-listing-probe__/0";
+function isPathSpecificMatcher(matcher) {
+  if (typeof matcher === "function") return false;
+  const compiled = compileMiddlewareConfig({ matcher });
+  return !matchesCompiledMiddlewareConfig(CATCH_ALL_PROBE, compiled, {}).matched;
+}
+__name(isPathSpecificMatcher, "isPathSpecificMatcher");
+function pathSpecificConfigMiddlewareCovers(config, pathname) {
+  if (!hasFarmMiddlewareConfig(config)) return false;
+  const entries = Array.isArray(config) ? config : [config];
+  return entries.some((entry) => {
+    if (!entry.matcher) return false;
+    const matchers = (Array.isArray(entry.matcher) ? entry.matcher : [entry.matcher]).filter(
+      isPathSpecificMatcher
+    );
+    if (matchers.length === 0) return false;
+    const compiled = compileMiddlewareConfig({ matcher: matchers, exclude: entry.exclude });
+    return matchesCompiledMiddlewareConfig(pathname, compiled, {}).matched;
+  });
+}
+__name(pathSpecificConfigMiddlewareCovers, "pathSpecificConfigMiddlewareCovers");
+function farmPathGuardCoversPage(options, pathname) {
+  return appMiddlewareMayHandlePath(
+    options.middlewareRoutes.filter((route) => route.path !== "/"),
+    pathname
+  ) || pathSpecificConfigMiddlewareCovers(options.config.middleware, pathname) || integrationMiddlewareMayHandlePath(options.config.integrations, pathname, CATCH_ALL_PROBE);
+}
+__name(farmPathGuardCoversPage, "farmPathGuardCoversPage");
+function farmPathGuardCoversEndpoint(options, path, apiServerBasePath) {
+  return createFarmAPIMiddlewarePathnames(apiServerBasePath)(path).some(
+    (pathname) => farmPathGuardCoversPage(options, pathname)
+  );
+}
+__name(farmPathGuardCoversEndpoint, "farmPathGuardCoversEndpoint");
+
 // src/i18n/alternates.ts
 function renderFarmLocaleAlternateLinks(pathname, config, options = {}) {
   if (config.routing === "none") return "";
@@ -269,13 +346,19 @@ function isLateRedirectTarget(url) {
   }
 }
 __name(isLateRedirectTarget, "isLateRedirectTarget");
-function createLateRedirectRecovery(url) {
+function createLateRedirectRecovery(url, nonce) {
   if (!isLateRedirectTarget(url)) return "";
-  return `<script>window.location.replace(${serializeForInlineScript(url)})</script>`;
+  return stampFarmCspNonce(
+    `<script>window.location.replace(${serializeForInlineScript(url)})</script>`,
+    nonce
+  );
 }
 __name(createLateRedirectRecovery, "createLateRedirectRecovery");
-function createLateNotFoundRecovery(content) {
-  return `<template id="${TEMPLATE_ID}">${content}</template><script>(function(){var t=document.getElementById("${TEMPLATE_ID}");var p=document.getElementById("${PAGE_CONTAINER_ID}");if(t&&p){p.replaceChildren(t.content.cloneNode(true));}if(t)t.remove();document.documentElement.dataset.farmLateNotFound="true";var m=document.createElement("meta");m.name="robots";m.content="noindex";document.head.appendChild(m);})();</script>`;
+function createLateNotFoundRecovery(content, nonce) {
+  return `<template id="${TEMPLATE_ID}">${content}</template>` + stampFarmCspNonce(
+    `<script>(function(){var t=document.getElementById("${TEMPLATE_ID}");var p=document.getElementById("${PAGE_CONTAINER_ID}");if(t&&p){p.replaceChildren(t.content.cloneNode(true));}if(t)t.remove();document.documentElement.dataset.farmLateNotFound="true";var m=document.createElement("meta");m.name="robots";m.content="noindex";document.head.appendChild(m);})();</script>`,
+    nonce
+  );
 }
 __name(createLateNotFoundRecovery, "createLateNotFoundRecovery");
 
@@ -763,7 +846,9 @@ function createFarmThemeDocumentParts(input, basePath = "/", serverTheme) {
   const script = createFarmThemeBootstrapScript(config, hydrationTheme);
   return {
     attributes: ` data-theme="${initialTheme}"`,
-    head: `<style id="${THEME_STYLE_ID}">:root[data-theme="light"]{color-scheme:light}:root[data-theme="dark"]{color-scheme:dark}</style><script id="${THEME_SCRIPT_ID}">${script}</script>`
+    head: stampFarmCspNonce(
+      `<style id="${THEME_STYLE_ID}">:root[data-theme="light"]{color-scheme:light}:root[data-theme="dark"]{color-scheme:dark}</style><script id="${THEME_SCRIPT_ID}">${script}</script>`
+    )
   };
 }
 __name(createFarmThemeDocumentParts, "createFarmThemeDocumentParts");
@@ -920,12 +1005,13 @@ function createFarmAppManifest(input, { full = false } = {}) {
     packages: input.packages,
     mcp: {
       servers: _listFarmMCPCatalogs().map(({ server, tools, details }) => {
-        const listed = full || details?.public === true;
+        const open = details?.public === true && !input.guardCoversPath?.(server.path);
+        const listed = full || open;
         return {
           name: server.name,
           version: server.version,
           path: server.path,
-          authorization: details?.public === true ? "none" : "required",
+          authorization: open ? "none" : "required",
           resources: listed ? [...details?.resources ?? []] : [],
           prompts: listed ? [...details?.prompts ?? []] : [],
           tools: (listed ? tools : []).map((tool) => {
@@ -1078,6 +1164,11 @@ export {
   removeFarmDocumentTitles,
   ensureFarmDocumentMeta,
   composeFarmFullDocument,
+  hasFarmMiddlewareConfig,
+  configMiddlewareMayHandlePath,
+  appMiddlewareMayHandlePath,
+  farmPathGuardCoversPage,
+  farmPathGuardCoversEndpoint,
   renderFarmLocaleAlternateLinks,
   createLateRedirectRecovery,
   createLateNotFoundRecovery,