@farm.js/core 0.1.37 → 0.1.39

package/dist/{chunk-TE2G5ION.cjs → chunk-PGZDEPTM.cjs}

@@ -15,7 +15,10 @@ var _chunkIK6LVLKCcjs = require('./chunk-IK6LVLKC.cjs');
 var _chunkHREOKQWTcjs = require('./chunk-HREOKQWT.cjs');
 
 
-var _chunkEUV4YR3Vcjs = require('./chunk-EUV4YR3V.cjs');
+var _chunk2ZYGC6SScjs = require('./chunk-2ZYGC6SS.cjs');
+
+
+var _chunkSGBJ247Qcjs = require('./chunk-SGBJ247Q.cjs');
 
 
 var _chunkKIIMAWOJcjs = require('./chunk-KIIMAWOJ.cjs');
@@ -24,6 +27,12 @@ var _chunkKIIMAWOJcjs = require('./chunk-KIIMAWOJ.cjs');
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
 
 // src/docs/handler.ts
+
+
+
+
+
+
 var _fs = require('fs');
 var _path = require('path'); var _path2 = _interopRequireDefault(_path);
 var _marked = require('marked');
@@ -718,15 +727,46 @@ function getRequestSlug(docs, request) {
   return normalizeSlug(pathname.slice(entry.length));
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getRequestSlug, "getRequestSlug");
+function isDiscoverableDocsEntryName(name) {
+  return Boolean(name) && !name.startsWith(".") && name !== "node_modules";
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, isDiscoverableDocsEntryName, "isDiscoverableDocsEntryName");
+function isDiscoverableDocsFile(contentDir, filePath) {
+  const segments = _path2.default.relative(contentDir, filePath).split(_path2.default.sep);
+  let dir = contentDir;
+  for (const [index, name] of segments.entries()) {
+    if (!isDiscoverableDocsEntryName(name)) return false;
+    let entry;
+    try {
+      entry = _fs.readdirSync.call(void 0, dir, { withFileTypes: true }).find(
+        (candidate) => candidate.name === name
+      );
+    } catch (e7) {
+      return false;
+    }
+    const isLast = index === segments.length - 1;
+    if (!entry || !(isLast ? entry.isFile() : entry.isDirectory())) return false;
+    dir = _path2.default.join(dir, name);
+  }
+  return true;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, isDiscoverableDocsFile, "isDiscoverableDocsFile");
 function findDocsPageFile(contentDir, slug) {
-  const segments = slug ? slug.split("/").filter(Boolean) : [];
-  if (!segments.every(isSafeSegment)) return null;
+  const canonicalSlug = trimSlashes(slug);
+  const segments = canonicalSlug ? canonicalSlug.split("/") : [];
+  if (!segments.every((segment) => isSafeSegment(segment) && isDiscoverableDocsEntryName(segment))) {
+    return null;
+  }
   const slugDir = _path2.default.join(contentDir, ...segments);
   const candidates = segments.length === 0 ? DOCS_FILE_NAMES.map((filename) => _path2.default.join(contentDir, filename)) : [
     ...DOCS_FILE_NAMES.map((filename) => _path2.default.join(slugDir, filename)),
-    ...DOCS_FILE_EXTENSIONS2.map((extension) => _path2.default.join(contentDir, `${slug}${extension}`))
+    ...DOCS_FILE_EXTENSIONS2.map(
+      (extension) => _path2.default.join(contentDir, `${canonicalSlug}${extension}`)
+    )
   ];
   for (const candidate of candidates) {
+    if (pathToSlug(contentDir, candidate) !== canonicalSlug) continue;
+    if (!isDiscoverableDocsFile(contentDir, candidate)) continue;
     const safePath = resolveExistingFileInside(contentDir, candidate);
     if (safePath) {
       return safePath;
@@ -784,6 +824,10 @@ function loadFarmDocsPage(contentDir, docs, slug) {
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, loadFarmDocsPage, "loadFarmDocsPage");
+function getFarmDocsMarkdownPath(href) {
+  return href === "/" ? "/.md" : `${href}.md`;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, getFarmDocsMarkdownPath, "getFarmDocsMarkdownPath");
 function createDocsHref(entry, slug) {
   const normalizedEntry = normalizeEntry2(entry);
   const normalizedSlug = trimSlashes(slug);
@@ -861,8 +905,8 @@ function getDocsDescription(docs) {
   return _optionalChain([docs, 'access', _51 => _51.config, 'access', _52 => _52.metadata, 'optionalAccess', _53 => _53.description]);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getDocsDescription, "getDocsDescription");
-function getLoadedDocsPages(contentDir, docs) {
-  return discoverFarmDocsPages(contentDir, docs).map((page) => loadFarmDocsPage(contentDir, docs, page.slug)).filter((page) => Boolean(page));
+function getLoadedDocsPages(contentDir, docs, isPathGuarded) {
+  return discoverFarmDocsPages(contentDir, docs).filter((page) => !_optionalChain([isPathGuarded, 'optionalCall', _54 => _54(page.href)])).map((page) => loadFarmDocsPage(contentDir, docs, page.slug)).filter((page) => Boolean(page));
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getLoadedDocsPages, "getLoadedDocsPages");
 function toDocsLlmsPage(page) {
@@ -942,7 +986,7 @@ function resolveReadingTimeDisplayConfig(docs) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, resolveReadingTimeDisplayConfig, "resolveReadingTimeDisplayConfig");
 function countMarkdownWords(body, includeCode) {
   const readable = (includeCode ? body : body.replace(/```[\s\S]*?```/g, " ").replace(/`[^`]*`/g, " ")).replace(/!\[[^\]]*]\([^)]*\)/g, " ").replace(/\[([^\]]+)]\([^)]*\)/g, "$1").replace(/<[^>]+>/g, " ").replace(/[#>*_~`|:-]/g, " ");
-  return _nullishCoalesce(_optionalChain([readable, 'access', _54 => _54.match, 'call', _55 => _55(/[A-Za-z0-9]+(?:[-'][A-Za-z0-9]+)*/g), 'optionalAccess', _56 => _56.length]), () => ( 0));
+  return _nullishCoalesce(_optionalChain([readable, 'access', _55 => _55.match, 'call', _56 => _56(/[A-Za-z0-9]+(?:[-'][A-Za-z0-9]+)*/g), 'optionalAccess', _57 => _57.length]), () => ( 0));
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, countMarkdownWords, "countMarkdownWords");
 function renderReadingTimeMeta(page, docs) {
@@ -1057,10 +1101,10 @@ function getDocsDiscoveryOptions(docs, request) {
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getDocsDiscoveryOptions, "getDocsDiscoveryOptions");
-function createFarmDocsPublicResponse(contentDir, docs, request) {
+function createFarmDocsPublicResponse(contentDir, docs, request, isPathGuarded) {
   const url = new URL(request.url);
   let loadedPages;
-  const getPages = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, () => _nullishCoalesce(loadedPages, () => ( (loadedPages = getLoadedDocsPages(contentDir, docs)))), "getPages");
+  const getPages = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, () => _nullishCoalesce(loadedPages, () => ( (loadedPages = getLoadedDocsPages(contentDir, docs, isPathGuarded)))), "getPages");
   const sitemapManifest = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, () => _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).buildDocsSitemapManifest({
     pages: getPages().map(toDocsSitemapPage),
     entry: docs.entry,
@@ -1181,11 +1225,11 @@ function shouldReturnMarkdown(request) {
   if (url.pathname.endsWith(".md")) return true;
   const accept = request.headers.get("accept");
   const markdown = Math.max(
-    _chunkEUV4YR3Vcjs.farmAcceptQuality.call(void 0, accept, "text/markdown"),
-    _chunkEUV4YR3Vcjs.farmAcceptQuality.call(void 0, accept, "text/plain")
+    _chunkSGBJ247Qcjs.farmAcceptQuality.call(void 0, accept, "text/markdown"),
+    _chunkSGBJ247Qcjs.farmAcceptQuality.call(void 0, accept, "text/plain")
   );
   if (markdown <= 0) return false;
-  return markdown >= _chunkEUV4YR3Vcjs.farmAcceptQuality.call(void 0, accept, "text/html", { wildcards: true });
+  return markdown >= _chunkSGBJ247Qcjs.farmAcceptQuality.call(void 0, accept, "text/html", { wildcards: true });
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, shouldReturnMarkdown, "shouldReturnMarkdown");
 function escapeAttribute(value) {
@@ -1212,7 +1256,7 @@ function stripHtml(value) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, stripHtml, "stripHtml");
 function getCodeFence(line) {
   const match = /^(?: {0,3})(`{3,}|~{3,})/.exec(line);
-  const value = _optionalChain([match, 'optionalAccess', _57 => _57[1]]);
+  const value = _optionalChain([match, 'optionalAccess', _58 => _58[1]]);
   if (!value) return null;
   return { marker: value[0], length: value.length };
 }
@@ -1297,16 +1341,16 @@ function isCodePathLabel(label) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, isCodePathLabel, "isCodePathLabel");
 function parseCodeInfo(info) {
   const source = (info || "").trim();
-  const language = _optionalChain([source, 'access', _58 => _58.match, 'call', _59 => _59(/^\S+/), 'optionalAccess', _60 => _60[0]]) || "text";
-  const explicitLabel = _optionalChain([source, 'access', _61 => _61.match, 'call', _62 => _62(/\b(?:title|filename|file|label|name)=["']([^"']+)["']/), 'optionalAccess', _63 => _63[1], 'optionalAccess', _64 => _64.trim, 'call', _65 => _65()]);
+  const language = _optionalChain([source, 'access', _59 => _59.match, 'call', _60 => _60(/^\S+/), 'optionalAccess', _61 => _61[0]]) || "text";
+  const explicitLabel = _optionalChain([source, 'access', _62 => _62.match, 'call', _63 => _63(/\b(?:title|filename|file|label|name)=["']([^"']+)["']/), 'optionalAccess', _64 => _64[1], 'optionalAccess', _65 => _65.trim, 'call', _66 => _66()]);
   return { language, label: explicitLabel || language, hasExplicitLabel: Boolean(explicitLabel) };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, parseCodeInfo, "parseCodeInfo");
 function getStandaloneCodeLabel(line) {
   const trimmed = line.trim();
   const match = /^(?:\*\*([^*]+)\*\*|__([^_]+)__|`([^`]+)`)$/u.exec(trimmed);
-  const label = _optionalChain([match, 'optionalAccess', _66 => _66[1]]) || _optionalChain([match, 'optionalAccess', _67 => _67[2]]) || _optionalChain([match, 'optionalAccess', _68 => _68[3]]);
-  return _optionalChain([label, 'optionalAccess', _69 => _69.trim, 'call', _70 => _70()]) || null;
+  const label = _optionalChain([match, 'optionalAccess', _67 => _67[1]]) || _optionalChain([match, 'optionalAccess', _68 => _68[2]]) || _optionalChain([match, 'optionalAccess', _69 => _69[3]]);
+  return _optionalChain([label, 'optionalAccess', _70 => _70.trim, 'call', _71 => _71()]) || null;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getStandaloneCodeLabel, "getStandaloneCodeLabel");
 function hasCodeFenceTitle(info) {
@@ -1438,7 +1482,7 @@ function getThemeName(docs) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getThemeName, "getThemeName");
 function getThemeTocDepth(docs) {
-  const toc = _optionalChain([getThemeUI, 'call', _71 => _71(docs), 'access', _72 => _72.layout, 'optionalAccess', _73 => _73.toc]);
+  const toc = _optionalChain([getThemeUI, 'call', _72 => _72(docs), 'access', _73 => _73.layout, 'optionalAccess', _74 => _74.toc]);
   return toc && typeof toc === "object" && typeof toc.depth === "number" ? toc.depth : 3;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getThemeTocDepth, "getThemeTocDepth");
@@ -1593,7 +1637,7 @@ function renderSidebarLabel(docs, icon, label, className) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderSidebarLabel, "renderSidebarLabel");
 function getSidebarPageLabel(item, configured) {
-  if (_optionalChain([configured, 'optionalAccess', _74 => _74.label])) return configured.label;
+  if (_optionalChain([configured, 'optionalAccess', _75 => _75.label])) return configured.label;
   if (item.slug === "") return "Why?";
   if (item.slug === "integrations") return "Overview";
   if (item.slug === "integrations/ui-registry") return "UI Registry";
@@ -1606,7 +1650,7 @@ function getSidebarPageLabel(item, configured) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, getSidebarPageLabel, "getSidebarPageLabel");
 function renderSidebarLink(item, activeHref, docs, configured) {
   const active = item.href === activeHref;
-  return `<a class="fd-sidebar-link${active ? " fd-sidebar-link-active" : ""}" data-active="${active ? "true" : "false"}" href="${escapeAttribute(item.href)}">${renderSidebarLabel(docs, _optionalChain([configured, 'optionalAccess', _75 => _75.icon]), getSidebarPageLabel(item, configured), "sidebar-link-label fd-sidebar-link-label")}</a>`;
+  return `<a class="fd-sidebar-link${active ? " fd-sidebar-link-active" : ""}" data-active="${active ? "true" : "false"}" href="${escapeAttribute(item.href)}">${renderSidebarLabel(docs, _optionalChain([configured, 'optionalAccess', _76 => _76.icon]), getSidebarPageLabel(item, configured), "sidebar-link-label fd-sidebar-link-label")}</a>`;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderSidebarLink, "renderSidebarLink");
 function collectConfiguredSidebarPages(items, maps, seen = /* @__PURE__ */ new Set()) {
@@ -1786,11 +1830,11 @@ function renderDocsSearchTrigger(showIcon = true, className = "") {
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderDocsSearchTrigger, "renderDocsSearchTrigger");
 function renderDocsSearchMount(clientEntry) {
   return `<div id="farm-docs-search-root" data-farm-docs-search-root data-api="/api/docs"></div>
-  <script type="module" src="${escapeAttribute(clientEntry)}"></script>`;
+  ${_chunk2ZYGC6SScjs.stampFarmCspNonce.call(void 0, `<script type="module" src="${escapeAttribute(clientEntry)}"></script>`)}`;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderDocsSearchMount, "renderDocsSearchMount");
 function renderDocsSearchBootstrapScript() {
-  return `<script>${_chunkMWWVKDW3cjs.generateFarmDocsSearchBootstrapRuntime.call(void 0, )}</script>`;
+  return _chunk2ZYGC6SScjs.stampFarmCspNonce.call(void 0, `<script>${_chunkMWWVKDW3cjs.generateFarmDocsSearchBootstrapRuntime.call(void 0, )}</script>`);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderDocsSearchBootstrapScript, "renderDocsSearchBootstrapScript");
 function renderPixelToc(items) {
@@ -1820,9 +1864,9 @@ function renderDocsHashRuntimeScript() {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderDocsHashRuntimeScript, "renderDocsHashRuntimeScript");
 function renderDocsRuntimeScripts(docs) {
-  return `${renderDocsRuntimeScript(docs)}
+  return _chunk2ZYGC6SScjs.stampFarmCspNonce.call(void 0, `${renderDocsRuntimeScript(docs)}
 ${renderDocsHashRuntimeScript()}
-${renderDocsPageActionsRuntimeScript()}`;
+${renderDocsPageActionsRuntimeScript()}`);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderDocsRuntimeScripts, "renderDocsRuntimeScripts");
 function renderFarmDocsFontPreloads(fontAssets) {
@@ -1837,8 +1881,8 @@ function renderFarmDocsFontPreloadHeader(fontAssets) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderFarmDocsFontPreloadHeader, "renderFarmDocsFontPreloadHeader");
 function getFarmLayoutFontPreloads(layoutFonts) {
   const seen = /* @__PURE__ */ new Set();
-  return [_optionalChain([layoutFonts, 'optionalAccess', _76 => _76.body]), _optionalChain([layoutFonts, 'optionalAccess', _77 => _77.code])].flatMap(
-    (font) => (_optionalChain([font, 'optionalAccess', _78 => _78.preloads]) || []).filter(({ href }) => {
+  return [_optionalChain([layoutFonts, 'optionalAccess', _77 => _77.body]), _optionalChain([layoutFonts, 'optionalAccess', _78 => _78.code])].flatMap(
+    (font) => (_optionalChain([font, 'optionalAccess', _79 => _79.preloads]) || []).filter(({ href }) => {
       if (seen.has(href)) return false;
       seen.add(href);
       return true;
@@ -1852,7 +1896,7 @@ function renderFarmLayoutFontPreloadHeader(layoutFonts) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, renderFarmLayoutFontPreloadHeader, "renderFarmLayoutFontPreloadHeader");
 function renderPixelDocsHtml(page, pages, docs, clientEntry, faviconHref, requestUrl, fontAssets, fontStylesheetHref, globalStylesheetHref) {
   const navTitle = typeof docs.config.nav === "object" && docs.config.nav && "title" in docs.config.nav ? String(docs.config.nav.title || "Docs") : "Docs";
-  const description = page.description || _optionalChain([docs, 'access', _79 => _79.config, 'access', _80 => _80.metadata, 'optionalAccess', _81 => _81.description]) || "";
+  const description = page.description || _optionalChain([docs, 'access', _80 => _80.config, 'access', _81 => _81.metadata, 'optionalAccess', _82 => _82.description]) || "";
   const renderedMarkdown = renderMarkdownDocument(page.body, getThemeTocDepth(docs));
   const tocItems = renderedMarkdown.tocItems;
   const themeName = getThemeName(docs);
@@ -1927,14 +1971,16 @@ function createFarmDocsHandler(docs, options) {
   const fontAssets = _nullishCoalesce(options.fontAssets, () => ( _chunkHREOKQWTcjs.toFarmDocsPublicFontAssets.call(void 0, _chunkHREOKQWTcjs.resolveFarmDocsFontAssets.call(void 0, options.root))));
   const fallbackFontPreloadHeader = renderFarmDocsFontPreloadHeader(fontAssets);
   return /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, async function handleFarmDocsRequest(request) {
-    if (!_optionalChain([docs, 'optionalAccess', _82 => _82.enabled]) || request.method !== "GET" && request.method !== "HEAD") return null;
+    if (!_optionalChain([docs, 'optionalAccess', _83 => _83.enabled]) || request.method !== "GET" && request.method !== "HEAD") return null;
     await _chunkIK6LVLKCcjs.loadFarmDocsEngine.call(void 0, );
     const contentDir = resolveFarmDocsContentDir(docs, options);
     const requestUrl = new URL(request.url);
     const socialImageSlug = getFarmDocsSocialImageSlug(docs, requestUrl);
     if (socialImageSlug !== null) {
       const socialImagePage = loadFarmDocsPage(contentDir, docs, socialImageSlug);
-      if (!socialImagePage || !isFarmDocsSocialImageEnabled(socialImagePage, docs) || getFarmDocsCustomSocialImage(socialImagePage)) {
+      if (!socialImagePage || // The image sits outside the page's URL, where its guard does not reach, and
+      // draws the page's title.
+      _optionalChain([options, 'access', _84 => _84.isPathGuarded, 'optionalCall', _85 => _85(socialImagePage.href)]) || !isFarmDocsSocialImageEnabled(socialImagePage, docs) || getFarmDocsCustomSocialImage(socialImagePage)) {
         return null;
       }
       const descriptor = createFarmDocsSocialImageDescriptor(socialImagePage, docs, requestUrl);
@@ -1953,12 +1999,20 @@ function createFarmDocsHandler(docs, options) {
       if (request.method === "HEAD") return new Response(null, { status: 200, headers });
       return new Response(renderFarmDocsSocialImageSvg(descriptor), { status: 200, headers });
     }
-    const publicResponse = createFarmDocsPublicResponse(contentDir, docs, request);
+    const publicResponse = createFarmDocsPublicResponse(
+      contentDir,
+      docs,
+      request,
+      options.isPathGuarded
+    );
     if (publicResponse) return omitFarmDocsHeadBody(request, publicResponse);
     if (!isFarmDocsRequest(docs, request)) return null;
     const page = loadPage(contentDir, docs, request);
     if (!page) return null;
     const negotiatesAccept = !requestUrl.pathname.endsWith(".md");
+    if (!negotiatesAccept && _optionalChain([options, 'access', _86 => _86.isPathGuarded, 'optionalCall', _87 => _87(page.href)]) && !options.isPathGuarded(getFarmDocsMarkdownPath(page.href))) {
+      return null;
+    }
     if (shouldReturnMarkdown(request)) {
       const origin = new URL(request.url).origin;
       return omitFarmDocsHeadBody(
@@ -1981,8 +2035,8 @@ function createFarmDocsHandler(docs, options) {
       );
     }
     const pathname = new URL(request.url).pathname;
-    const layoutFonts = await _optionalChain([options, 'access', _83 => _83.resolveLayoutFonts, 'optionalCall', _84 => _84(pathname)]);
-    const usesLayoutFonts = Boolean(_optionalChain([layoutFonts, 'optionalAccess', _85 => _85.body]) || _optionalChain([layoutFonts, 'optionalAccess', _86 => _86.code]));
+    const layoutFonts = await _optionalChain([options, 'access', _88 => _88.resolveLayoutFonts, 'optionalCall', _89 => _89(pathname)]);
+    const usesLayoutFonts = Boolean(_optionalChain([layoutFonts, 'optionalAccess', _90 => _90.body]) || _optionalChain([layoutFonts, 'optionalAccess', _91 => _91.code]));
     const activeFontAssets = usesLayoutFonts ? [] : fontAssets;
     const fontPreloadHeader = usesLayoutFonts ? renderFarmLayoutFontPreloadHeader(layoutFonts) : fallbackFontPreloadHeader;
     return omitFarmDocsHeadBody(
@@ -2025,4 +2079,5 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, createFarmDocsHandler, "createFarmDocsHand
 
 
 
-exports.FARM_DOCS_LAST_MODIFIED_MANIFEST = FARM_DOCS_LAST_MODIFIED_MANIFEST; exports.createFarmDocsLastModifiedManifest = createFarmDocsLastModifiedManifest; exports.isFarmDocsRequest = isFarmDocsRequest; exports.resolveFarmDocsContentDir = resolveFarmDocsContentDir; exports.getFarmDocsRouteTypeEntries = getFarmDocsRouteTypeEntries; exports.getFarmDocsDocumentNavigationMatchers = getFarmDocsDocumentNavigationMatchers; exports.loadFarmDocsPage = loadFarmDocsPage; exports.discoverFarmDocsPages = discoverFarmDocsPages; exports.toFarmDocsMarkdownPage = toFarmDocsMarkdownPage; exports.createFarmDocsHandler = createFarmDocsHandler;
+
+exports.FARM_DOCS_LAST_MODIFIED_MANIFEST = FARM_DOCS_LAST_MODIFIED_MANIFEST; exports.createFarmDocsLastModifiedManifest = createFarmDocsLastModifiedManifest; exports.isFarmDocsRequest = isFarmDocsRequest; exports.resolveFarmDocsContentDir = resolveFarmDocsContentDir; exports.getFarmDocsRouteTypeEntries = getFarmDocsRouteTypeEntries; exports.getFarmDocsDocumentNavigationMatchers = getFarmDocsDocumentNavigationMatchers; exports.loadFarmDocsPage = loadFarmDocsPage; exports.getFarmDocsMarkdownPath = getFarmDocsMarkdownPath; exports.discoverFarmDocsPages = discoverFarmDocsPages; exports.toFarmDocsMarkdownPage = toFarmDocsMarkdownPage; exports.createFarmDocsHandler = createFarmDocsHandler;

package/dist/{chunk-3KGDJLJK.mjs → chunk-POSPE3IO.mjs}

@@ -1,7 +1,8 @@
 import {
   _setAppRequestView,
+  _setCspNonceResolver,
   _setCurrentRequestResolver
-} from "./chunk-S3VWVTVA.mjs";
+} from "./chunk-QRKIMN7T.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
@@ -67,6 +68,22 @@ function getAppRequestView(request) {
 }
 __name(getAppRequestView, "getAppRequestView");
 _setCurrentRequestResolver(() => requestStore.getStore());
+var CSP_NONCE_STORAGE_KEY = /* @__PURE__ */ Symbol.for("@farm.js/core/csp-nonce-storage");
+function getCspNonceStore() {
+  const runtime = globalThis;
+  const existing = runtime[CSP_NONCE_STORAGE_KEY];
+  if (existing instanceof AsyncLocalStorage) return existing;
+  const storage = new AsyncLocalStorage();
+  runtime[CSP_NONCE_STORAGE_KEY] = storage;
+  return storage;
+}
+__name(getCspNonceStore, "getCspNonceStore");
+var cspNonceStore = getCspNonceStore();
+_setCspNonceResolver(() => cspNonceStore.getStore());
+function _runWithFarmCspNonce(nonce, fn) {
+  return nonce ? cspNonceStore.run(nonce, fn) : fn();
+}
+__name(_runWithFarmCspNonce, "_runWithFarmCspNonce");
 _setAppRequestView(getAppRequestView);
 function resolveFarmRequestURL(req, options = {}) {
   if (options.origin) {
@@ -169,6 +186,7 @@ function getCurrentRequestOrNull() {
 __name(getCurrentRequestOrNull, "getCurrentRequestOrNull");
 
 export {
+  _runWithFarmCspNonce,
   resolveFarmRequestURL,
   resolveFarmWebRequestOrigin,
   createWebRequestFromFarmRequest,

package/dist/{chunk-FGRYBX5X.mjs → chunk-PVZE2JGJ.mjs}

@@ -3,7 +3,7 @@ import {
   parseMiddlewareCookieHeader,
   serializeMiddlewareCookie,
   serializeMiddlewareCookieDeletion
-} from "./chunk-J3ANCZKA.mjs";
+} from "./chunk-SKVTP5PR.mjs";
 import {
   compileMiddlewareConfig,
   compileMiddlewareRoute,
@@ -11,7 +11,7 @@ import {
   matchesMiddlewareConfigAt,
   matchesMiddlewareRouteAt,
   toMiddlewareRoutePathname
-} from "./chunk-HZFM2LWQ.mjs";
+} from "./chunk-P3PLW4FR.mjs";
 import {
   emitFarmEvent
 } from "./chunk-FUZEBRP3.mjs";

package/dist/{chunk-TPLJVC7E.mjs → chunk-QFW2IH5E.mjs}

@@ -1,7 +1,9 @@
 import {
+  FARM_MARKDOWN_PAGE_CHECK_HEADER,
+  _getFarmMarkdownPageCheckToken,
   createFarmMarkdownViewResponse,
   requestAcceptsMarkdown
-} from "./chunk-WWIKMBRN.mjs";
+} from "./chunk-VNGH5MLF.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
@@ -159,6 +161,7 @@ var PAGE_CHECK_DROPPED_HEADERS = /* @__PURE__ */ new Set([
   "if-unmodified-since",
   "range"
 ]);
+var PAGE_SEGMENT_MARKER = /<div\s[^>]*\bid=["']?__farm_page__["'\s>]/i;
 async function anonymousVisitorOpensPage(options, url, targetPathname) {
   const pageUrl = new URL(url);
   pageUrl.pathname = targetPathname;
@@ -167,6 +170,7 @@ async function anonymousVisitorOpensPage(options, url, targetPathname) {
     if (!PAGE_CHECK_DROPPED_HEADERS.has(name.toLowerCase())) headers.append(name, value);
   }
   headers.set("accept", "text/html");
+  headers.set(FARM_MARKDOWN_PAGE_CHECK_HEADER, _getFarmMarkdownPageCheckToken());
   const response = await options.renderPage(
     new Request(pageUrl, {
       method: "GET",
@@ -175,9 +179,12 @@ async function anonymousVisitorOpensPage(options, url, targetPathname) {
       signal: options.request.signal
     })
   );
-  void response.body?.cancel().catch(() => {
-  });
-  return response.status >= 200 && response.status < 300 && Boolean(response.headers.get("content-type")?.toLowerCase().includes("text/html"));
+  if (response.status < 200 || response.status >= 300 || !response.headers.get("content-type")?.toLowerCase().includes("text/html")) {
+    void response.body?.cancel().catch(() => {
+    });
+    return false;
+  }
+  return PAGE_SEGMENT_MARKER.test(await response.text());
 }
 __name(anonymousVisitorOpensPage, "anonymousVisitorOpensPage");
 function hasOnlyAnonymousHeaders(headers) {
@@ -222,8 +229,18 @@ async function createFarmMarkdownSourceResponse(options) {
       })
     );
     if (publicResponse.headers.get("X-Farm-Markdown-Route") === targetPathname && publicResponse.headers.has("X-Farm-Markdown-Source")) {
-      publicSourceResponses.add(publicResponse);
-      return publicResponse;
+      let response = publicResponse;
+      if (options.request.headers.has("cookie") || options.request.headers.has("authorization")) {
+        const headers2 = new Headers(publicResponse.headers);
+        headers2.set("Cache-Control", "private, no-store");
+        response = new Response(publicResponse.body, {
+          status: publicResponse.status,
+          statusText: publicResponse.statusText,
+          headers: headers2
+        });
+      }
+      publicSourceResponses.add(response);
+      return response;
     }
     await publicResponse.body?.cancel();
     if (!hasMarkdownExtension) return null;

package/dist/{chunk-5BXGGEC7.cjs → chunk-QG775BRV.cjs}

@@ -3,7 +3,7 @@
 
 
 
-var _chunkG2TEB74Scjs = require('./chunk-G2TEB74S.cjs');
+var _chunkZXH4TS3Fcjs = require('./chunk-ZXH4TS3F.cjs');
 
 
 
@@ -11,7 +11,7 @@ var _chunkG2TEB74Scjs = require('./chunk-G2TEB74S.cjs');
 
 
 
-var _chunk4GWRFP22cjs = require('./chunk-4GWRFP22.cjs');
+var _chunkUPJLHLJUcjs = require('./chunk-UPJLHLJU.cjs');
 
 
 var _chunkE3UK5IIBcjs = require('./chunk-E3UK5IIB.cjs');
@@ -83,19 +83,19 @@ var WebResponseHeaderMap = _WebResponseHeaderMap;
 var _WebCookieJar = class _WebCookieJar {
   constructor(request, headers) {
     this.headers = headers;
-    this.cookies = _chunkG2TEB74Scjs.parseMiddlewareCookieHeader.call(void 0, request.headers.get("cookie"));
+    this.cookies = _chunkZXH4TS3Fcjs.parseMiddlewareCookieHeader.call(void 0, request.headers.get("cookie"));
   }
   get(name) {
     return this.cookies[name];
   }
   set(name, value, options = {}) {
     this.cookies[name] = value;
-    const cookieString = _chunkG2TEB74Scjs.serializeMiddlewareCookie.call(void 0, name, value, options);
+    const cookieString = _chunkZXH4TS3Fcjs.serializeMiddlewareCookie.call(void 0, name, value, options);
     this.headers.appendSetCookie(cookieString);
   }
   delete(name, options = {}) {
     delete this.cookies[name];
-    this.headers.appendSetCookie(_chunkG2TEB74Scjs.serializeMiddlewareCookieDeletion.call(void 0, name, options));
+    this.headers.appendSetCookie(_chunkZXH4TS3Fcjs.serializeMiddlewareCookieDeletion.call(void 0, name, options));
   }
   getAll() {
     return { ...this.cookies };
@@ -282,7 +282,7 @@ function createWebMiddlewareContext(request, parent, trustProxy = false, clientA
     response: responseShim.response,
     url,
     pathname: url.pathname,
-    routePathname: _chunk4GWRFP22cjs.toMiddlewareRoutePathname.call(void 0, url.pathname, toRoutePathname),
+    routePathname: _chunkUPJLHLJUcjs.toMiddlewareRoutePathname.call(void 0, url.pathname, toRoutePathname),
     searchParams: url.searchParams,
     method: currentRequest.method || "GET",
     params: {},
@@ -325,7 +325,7 @@ function createWebMiddlewareContext(request, parent, trustProxy = false, clientA
       ctx.request = currentRequest;
       ctx.url = nextUrl;
       ctx.pathname = nextUrl.pathname;
-      ctx.routePathname = _chunk4GWRFP22cjs.toMiddlewareRoutePathname.call(void 0, nextUrl.pathname, toRoutePathname);
+      ctx.routePathname = _chunkUPJLHLJUcjs.toMiddlewareRoutePathname.call(void 0, nextUrl.pathname, toRoutePathname);
       ctx.searchParams = nextUrl.searchParams;
       ctx.route = nextUrl.pathname;
     },
@@ -378,7 +378,7 @@ function createWebMiddlewareContext(request, parent, trustProxy = false, clientA
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, createWebMiddlewareContext, "createWebMiddlewareContext");
 function matchesMiddlewareConfig2(pathname, config, ctx) {
-  return _chunk4GWRFP22cjs.matchesMiddlewareConfig.call(void 0, pathname, config, ctx);
+  return _chunkUPJLHLJUcjs.matchesMiddlewareConfig.call(void 0, pathname, config, ctx);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, matchesMiddlewareConfig2, "matchesMiddlewareConfig");
 function getConfigHandlers(entry) {
@@ -411,7 +411,7 @@ function normalizeConfigMiddleware(config) {
       globalConfig = middlewareConfig;
       continue;
     }
-    _chunk4GWRFP22cjs.compileMiddlewareConfig.call(void 0, middlewareConfig);
+    _chunkUPJLHLJUcjs.compileMiddlewareConfig.call(void 0, middlewareConfig);
     entries.push({
       path: "/",
       filePath: `farm.config.ts#middleware-${index}`,
@@ -426,11 +426,11 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, normalizeConfigMiddleware, "normalizeConfi
 function normalizeFileMiddleware(modules = []) {
   const entries = [];
   for (const moduleEntry of modules) {
-    const normalized = _chunkG2TEB74Scjs.normalizeMiddlewareModule.call(void 0, moduleEntry.module, moduleEntry.path);
+    const normalized = _chunkZXH4TS3Fcjs.normalizeMiddlewareModule.call(void 0, moduleEntry.module, moduleEntry.path);
     if (!normalized) {
       continue;
     }
-    if (normalized.config) _chunk4GWRFP22cjs.compileMiddlewareConfig.call(void 0, normalized.config);
+    if (normalized.config) _chunkUPJLHLJUcjs.compileMiddlewareConfig.call(void 0, normalized.config);
     entries.push({
       path: moduleEntry.path,
       filePath: moduleEntry.filePath || moduleEntry.path,
@@ -474,10 +474,10 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, emptyResult, "emptyResult");
 function createProductionMiddlewareRunner(options = {}) {
   const configMiddleware = normalizeConfigMiddleware(options.config);
   const fileMiddleware = normalizeFileMiddleware(options.modules);
-  for (const entry of fileMiddleware) _chunk4GWRFP22cjs.compileMiddlewareRoute.call(void 0, entry);
+  for (const entry of fileMiddleware) _chunkUPJLHLJUcjs.compileMiddlewareRoute.call(void 0, entry);
   const entries = [...configMiddleware.entries, ...fileMiddleware];
   const globalConfig = configMiddleware.globalConfig;
-  if (globalConfig) _chunk4GWRFP22cjs.compileMiddlewareConfig.call(void 0, globalConfig);
+  if (globalConfig) _chunkUPJLHLJUcjs.compileMiddlewareConfig.call(void 0, globalConfig);
   const toMiddlewarePathnames = _chunkKNBBQHO2cjs.createFarmAPIMiddlewarePathnames.call(void 0, options.apiBasePath);
   return /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, async function runProductionMiddleware(request, requestOptions = {}) {
     if (!globalConfig && entries.length === 0) {
@@ -503,7 +503,7 @@ function createProductionMiddlewareRunner(options = {}) {
     ] : toMiddlewarePathnames(pathname), "matchPathnames");
     let parentData;
     if (globalConfig) {
-      const globalMatch = _chunk4GWRFP22cjs.matchesMiddlewareConfigAt.call(void 0, 
+      const globalMatch = _chunkUPJLHLJUcjs.matchesMiddlewareConfigAt.call(void 0, 
         matchPathnames(initialPathname, initialRequestPathname),
         globalConfig,
         ctx
@@ -520,11 +520,11 @@ function createProductionMiddlewareRunner(options = {}) {
       for (let pathname = initialPathname, requestPathname = initialRequestPathname, pass = 0; ; pass++) {
         const pathnames = matchPathnames(pathname, requestPathname);
         if (pass > 0 && globalConfig) {
-          if (!_chunk4GWRFP22cjs.matchesMiddlewareConfigAt.call(void 0, pathnames, globalConfig, ctx).matched) return;
+          if (!_chunkUPJLHLJUcjs.matchesMiddlewareConfigAt.call(void 0, pathnames, globalConfig, ctx).matched) return;
         }
         for (const entry of entries) {
           if (ran.has(entry)) continue;
-          const routeMatch = entry.source === "config" ? { matched: true } : _chunk4GWRFP22cjs.matchesMiddlewareRouteAt.call(void 0, pathnames, entry);
+          const routeMatch = entry.source === "config" ? { matched: true } : _chunkUPJLHLJUcjs.matchesMiddlewareRouteAt.call(void 0, pathnames, entry);
           if (routeMatch.matched) yield { entry, routeMatch, pathname, pathnames };
         }
         const rewrittenRequestPathname = new URL(currentRequest.url).pathname;
@@ -536,7 +536,7 @@ function createProductionMiddlewareRunner(options = {}) {
     }
     _chunkS3JO3N4Hcjs.__name.call(void 0, applicableMiddleware, "applicableMiddleware");
     for (const { entry, routeMatch, pathname, pathnames } of applicableMiddleware()) {
-      const configMatch = entry.config ? _chunk4GWRFP22cjs.matchesMiddlewareConfigAt.call(void 0, pathnames, entry.config, ctx) : { matched: true };
+      const configMatch = entry.config ? _chunkUPJLHLJUcjs.matchesMiddlewareConfigAt.call(void 0, pathnames, entry.config, ctx) : { matched: true };
       if (!configMatch.matched) {
         continue;
       }

package/dist/{chunk-S3VWVTVA.mjs → chunk-QRKIMN7T.mjs}

@@ -27,10 +27,22 @@ function _resolveCurrentRequestForApp() {
   return request && view ? view(request) : request;
 }
 __name(_resolveCurrentRequestForApp, "_resolveCurrentRequestForApp");
+var CSP_NONCE_RESOLVER_KEY = /* @__PURE__ */ Symbol.for("farm.cspNonceResolver");
+function _setCspNonceResolver(resolver) {
+  globalThis[CSP_NONCE_RESOLVER_KEY] = resolver;
+}
+__name(_setCspNonceResolver, "_setCspNonceResolver");
+function _resolveCurrentCspNonce() {
+  const resolver = globalThis[CSP_NONCE_RESOLVER_KEY];
+  return resolver?.();
+}
+__name(_resolveCurrentCspNonce, "_resolveCurrentCspNonce");
 
 export {
   _setCurrentRequestResolver,
   _resolveCurrentRequest,
   _setAppRequestView,
-  _resolveCurrentRequestForApp
+  _resolveCurrentRequestForApp,
+  _setCspNonceResolver,
+  _resolveCurrentCspNonce
 };