@farm.js/core 0.1.37 → 0.1.39

package/dist/{chunk-4P6ULFMD.mjs → chunk-HYTZYOW2.mjs}

@@ -28,6 +28,8 @@ import {
   createLateRedirectRecovery,
   createRouteDirectoryPattern,
   extractFarmFullDocument,
+  farmPathGuardCoversEndpoint,
+  farmPathGuardCoversPage,
   formatRouteSegment,
   getDefaultErrorStatusText,
   getRouteDirectoryDepth,
@@ -42,7 +44,7 @@ import {
   resolveFarmAppManifestInput,
   routeBoundaryCoversDirectory,
   stripRouteGroups
-} from "./chunk-LBGILORX.mjs";
+} from "./chunk-GKBWWRBG.mjs";
 import {
   FARM_DEFAULT_MCP_PATH,
   collectFarmDefaultMCPPages,
@@ -50,7 +52,7 @@ import {
   farmConfigMountsMCP,
   isFarmDefaultMCPPathname,
   resolveFarmDefaultMCPServer
-} from "./chunk-UH6QN5NL.mjs";
+} from "./chunk-P664ZVTV.mjs";
 import {
   isFarmPreviewDeploymentEnvironment
 } from "./chunk-BOYNDCZL.mjs";
@@ -73,12 +75,12 @@ import {
 import {
   _setDefaultFarmThemeConfig,
   getTheme
-} from "./chunk-TDNWPAVR.mjs";
+} from "./chunk-CUM5NYL5.mjs";
 import {
   generateFarmDocsAdapterClientRuntime,
   getFarmDocsAdapterConfigModule,
   isSecretDocsConfigKey
-} from "./chunk-ENLZ4R3Y.mjs";
+} from "./chunk-J7K2NZD6.mjs";
 import {
   resolveFarmDocsFontAssets,
   toFarmDocsPublicFontAssets
@@ -119,24 +121,27 @@ import {
 } from "./chunk-DAATZTKJ.mjs";
 import {
   FARM_PREVIEW_ROBOTS_TAG,
-  addFarmCspNonceToScriptTags,
   createFarmAgentRobots,
-  createFarmCspNonce,
-  createFarmCspNonceRewriter,
   createFarmDefaultSitemap,
-  getFarmSecurityHeader,
   resolveFarmAgentCrawlers,
   resolveFarmAgentSitemap,
-  resolveFarmPerformanceConfig,
-  resolveFarmSecurityConfig
-} from "./chunk-4E5WBPEG.mjs";
+  resolveFarmPerformanceConfig
+} from "./chunk-WFRT7JPX.mjs";
 import {
   collectFarmLlmsTxtPages,
   createFarmDefaultLlmsTxt,
   createFarmLlmsMarkdownReader,
   renderFarmLlmsFullTxt,
   resolveFarmLlmsTxtConfig
-} from "./chunk-DTSROJ5J.mjs";
+} from "./chunk-HD5CF3OE.mjs";
+import {
+  createFarmCspNonce,
+  createFarmCspNonceRewriter,
+  filterFarmCspNonces,
+  getFarmSecurityHeader,
+  resolveFarmSecurityConfig,
+  stampFarmCspNonce
+} from "./chunk-U6QLDL3G.mjs";
 import {
   getPublicFarmImageConfig,
   resolveFarmImageConfig
@@ -154,18 +159,20 @@ import {
 import {
   createFarmMarkdownRouteModuleFromFile,
   loadFarmMdxComponents
-} from "./chunk-FBOJ55OM.mjs";
+} from "./chunk-IVLZZZEI.mjs";
 import {
   createFarmMarkdownSourceResponse,
   isFarmMarkdownPageFile,
   normalizeFarmMarkdownRoutePath
-} from "./chunk-TPLJVC7E.mjs";
+} from "./chunk-QFW2IH5E.mjs";
 import {
   resolveFarmMdxComponentsModulePath,
   resolveMdxConfig
 } from "./chunk-FA2W42OV.mjs";
 import {
   FARM_MARKDOWN_CONTENT_TYPE,
+  FARM_MARKDOWN_PAGE_CHECK_HEADER,
+  _isFarmMarkdownPageCheck,
   createFarmMarkdownErrorBody,
   createMarkdownMirrorResponse,
   farmRequestWantsMarkdown,
@@ -173,7 +180,7 @@ import {
   getFarmMarkdownMirrorPath,
   resolveMarkdownConfig,
   resolveMarkdownMirrorTarget
-} from "./chunk-WWIKMBRN.mjs";
+} from "./chunk-VNGH5MLF.mjs";
 import {
   resolveWorkflowsConfig
 } from "./chunk-Q2KB32T4.mjs";
@@ -196,10 +203,10 @@ import {
   getRegisteredIntegrationAPIManifest,
   isFarmIntegrationProviderComponentReference,
   matchIntegrationRoute
-} from "./chunk-Z5BEWYVO.mjs";
+} from "./chunk-ATSDUUFK.mjs";
 import {
   MiddlewareManager
-} from "./chunk-NFMDCAOS.mjs";
+} from "./chunk-QYMZOOC5.mjs";
 import {
   createRouteSlotContainerId,
   parseRouteSlotFile
@@ -209,7 +216,7 @@ import {
   _clearCurrentMiddlewareData,
   _runWithMiddlewareContext,
   _runWithMiddlewareData
-} from "./chunk-J3ANCZKA.mjs";
+} from "./chunk-SKVTP5PR.mjs";
 import {
   createFarmDevServerDispatch
 } from "./chunk-SGBZPZUW.mjs";
@@ -221,7 +228,7 @@ import {
 } from "./chunk-IOEH4VWN.mjs";
 import {
   APIRouteManager
-} from "./chunk-VXAWRDK7.mjs";
+} from "./chunk-WLL43JMO.mjs";
 import {
   findProgrammaticRouteFiles,
   loadProgrammaticRouteManifests
@@ -240,7 +247,7 @@ import {
 } from "./chunk-YOZYCI6Z.mjs";
 import {
   isFarmAPIPathname
-} from "./chunk-HEVMCTSR.mjs";
+} from "./chunk-6HB6V3R7.mjs";
 import {
   registerFarmMCPServer
 } from "./chunk-ZLAT2CWY.mjs";
@@ -325,7 +332,7 @@ import {
 } from "./chunk-BTHHUD7Q.mjs";
 import {
   FARM_VERSION
-} from "./chunk-YCKO6FRS.mjs";
+} from "./chunk-SOP2EAA6.mjs";
 import {
   resolveFarmTrailingSlashRedirect,
   setFarmTrailingSlashPreference
@@ -346,7 +353,7 @@ import {
   renderMetadataHead,
   renderViewportHead,
   resolveFarmNotFoundMetadata
-} from "./chunk-CXEN47J3.mjs";
+} from "./chunk-73WX6PRY.mjs";
 import {
   FARM_DEPLOYMENT_ID_HEADER,
   createFarmDeploymentCookie,
@@ -363,7 +370,7 @@ import {
 } from "./chunk-CNOQY6Z7.mjs";
 import {
   FARM_CONFIG_REWRITES_PLUGIN_NAME
-} from "./chunk-HMRSWN47.mjs";
+} from "./chunk-INL3THCU.mjs";
 import {
   appendFarmRedirectQuery
 } from "./chunk-BRYHOB4X.mjs";
@@ -375,13 +382,15 @@ import {
 import {
   _getRequestReadCount,
   _runWithCurrentRequest,
+  _runWithFarmCspNonce,
   createWebRequestFromFarmRequest,
   getCurrentRequestOrNull,
   resolveFarmRequestURL
-} from "./chunk-3KGDJLJK.mjs";
+} from "./chunk-POSPE3IO.mjs";
 import {
+  _resolveCurrentCspNonce,
   _resolveCurrentRequest
-} from "./chunk-S3VWVTVA.mjs";
+} from "./chunk-QRKIMN7T.mjs";
 import {
   localizeFarmHref,
   localizeFarmPathname,
@@ -4707,6 +4716,11 @@ function createPreHydrationClickQueueScript() {
   return `<script>(function(){if(window.__FARM_PREHYDRATION_CLICK_QUEUE__)return;var queue=[];window.__FARM_PREHYDRATION_CLICK_QUEUE__=queue;window.__FARM_HYDRATED__=false;document.documentElement.dataset.farmHydrated="false";function isModified(event){return !!(event.metaKey||event.altKey||event.ctrlKey||event.shiftKey)}function inHydrated(node){return !!(node&&node.closest&&node.closest('[data-farm-island-hydrated="true"]'))}function closestQueuedTarget(target){while(target&&target!==document.documentElement){if(target.matches&&target.matches(${selector}))return target;target=target.parentElement}return null}function announce(target,kind){document.dispatchEvent(new CustomEvent("farm:island-interaction",{detail:{target:target,kind:kind||null}}))}function hold(event,target,kind){if(!queue.some(function(item){return item.target===target})){queue.push({target:target,kind:kind,createdAt:Date.now()});announce(target,kind)}event.preventDefault();event.stopImmediatePropagation()}document.addEventListener("click",function(event){if(window.__FARM_HYDRATED__)return;if(event.defaultPrevented||event.button!==0||isModified(event))return;var target=closestQueuedTarget(event.target);if(!target||target.closest&&target.closest("a[href]")||inHydrated(target))return;hold(event,target,"click")},true);document.addEventListener("submit",function(event){if(window.__FARM_HYDRATED__)return;if(event.defaultPrevented)return;var form=event.target;if(!form||form.nodeName!=="FORM"||inHydrated(form))return;hold(event,form,"submit")},true);function observe(event){if(window.__FARM_HYDRATED__)return;var target=event.target;if(!(target&&target.closest)||inHydrated(target))return;announce(target,null)}document.addEventListener("pointerdown",observe,true);document.addEventListener("focusin",observe,true);})();</script>`;
 }
 __name(createPreHydrationClickQueueScript, "createPreHydrationClickQueueScript");
+function rendererRenderOptions() {
+  const nonce = _resolveCurrentCspNonce();
+  return nonce ? { nonce } : void 0;
+}
+__name(rendererRenderOptions, "rendererRenderOptions");
 function createDocumentFooter(options) {
   return `</div>
   ${options.suspenseRevealFallback}
@@ -4960,22 +4974,27 @@ var _ServerRenderer = class _ServerRenderer {
     }
     return this.rendererRuntime.wrapClientGraph(element);
   }
-  async renderElementToCompleteHTML(element) {
+  async renderElementToCompleteHTML(element, options = {}) {
     const streaming = getFarmRendererStreamingCapabilitiesForRuntime(this.config.renderer, "node");
     const renderToPipeableStream = streaming.node ? this.rendererRuntime.renderToPipeableStream : void 0;
     if (renderToPipeableStream) {
       return await new Promise((resolve6, reject) => {
         const chunks = [];
         let started = false;
+        let lateNavigation;
         const writable = new Writable({
           write(chunk, _encoding, callback) {
             chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
             callback();
           }
         });
-        writable.once("finish", () => resolve6(Buffer.concat(chunks).toString("utf8")));
+        writable.once(
+          "finish",
+          () => lateNavigation === void 0 ? resolve6(Buffer.concat(chunks).toString("utf8")) : reject(lateNavigation)
+        );
         writable.once("error", reject);
         const stream = renderToPipeableStream(element, {
+          nonce: _resolveCurrentCspNonce(),
           onShellReady() {
             started = true;
             stream.pipe(writable);
@@ -4985,26 +5004,35 @@ var _ServerRenderer = class _ServerRenderer {
           },
           onError(error) {
             if (!started) reject(error);
+            else if (options.rejectLateNavigation && lateNavigation === void 0 && (isFarmRedirectError(error) || isFarmNotFoundError(error))) {
+              lateNavigation = error;
+            }
           }
         });
       });
     }
     if (streaming.web && this.rendererRuntime.renderToReadableStream) {
-      const stream = await this.rendererRuntime.renderToReadableStream(element);
+      const stream = await this.rendererRuntime.renderToReadableStream(
+        element,
+        rendererRenderOptions()
+      );
       return await readFarmRendererWebStream(stream);
     }
-    return await this.rendererRuntime.renderToString(element);
+    return await this.rendererRuntime.renderToString(element, rendererRenderOptions());
   }
   /**
    * Buffered render carrying document-head markup for renderers that emit it
    * during render (e.g. <svelte:head>). Other renderers return an empty head.
    */
-  async renderElementToDocumentParts(element) {
+  async renderElementToDocumentParts(element, options = {}) {
     if (this.rendererRuntime.renderToStringWithHead) {
-      const rendered = await this.rendererRuntime.renderToStringWithHead(element);
+      const rendered = await this.rendererRuntime.renderToStringWithHead(
+        element,
+        rendererRenderOptions()
+      );
       return { html: rendered.html, head: rendered.head || "" };
     }
-    return { html: await this.renderElementToCompleteHTML(element), head: "" };
+    return { html: await this.renderElementToCompleteHTML(element, options), head: "" };
   }
   /**
    * Render the route tree used by client navigation without producing a second
@@ -5373,7 +5401,10 @@ var _ServerRenderer = class _ServerRenderer {
         return;
       }
     }
-    return this.runWithRequestContext(request2, () => this.renderPageInContext(req, res));
+    return _runWithFarmCspNonce(
+      cspNonce,
+      () => this.runWithRequestContext(request2, () => this.renderPageInContext(req, res))
+    );
   }
   async renderPageInContext(req, res) {
     const renderStartTime = Date.now();
@@ -6283,7 +6314,7 @@ var _ServerRenderer = class _ServerRenderer {
         trustProxy: this.config.server?.trustProxy
       });
       const sources = await Promise.all(
-        [...this.routeManager.getRoutes()].filter(([pattern]) => !pattern.includes("[")).map(async ([pattern, route]) => {
+        this.getAgentListedRoutes().map(async ([pattern, route]) => {
           const [module, stat] = await Promise.all([
             this.routeManager.loadRouteModule(route.modulePath).catch((error) => {
               logger.warn(`Could not read metadata for ${pattern} in sitemap.xml: ${error}`);
@@ -6321,6 +6352,21 @@ var _ServerRenderer = class _ServerRenderer {
   setAPIRouteLookup(exists) {
     this.apiRouteExists = exists;
   }
+  /** The dev server's file middleware, so public page listings can leave guarded pages out. */
+  setMiddlewareRouteLookup(routes) {
+    this.middlewareRoutes = routes;
+  }
+  /**
+   * The static pages sitemap.xml, llms.txt and the default MCP server may list: not one a
+   * path-specific guard (non-root middleware.ts, a config or integration middleware
+   * matcher) covers, as the production build decides.
+   */
+  getAgentListedRoutes() {
+    const guards = { config: this.config, middlewareRoutes: this.middlewareRoutes?.() ?? [] };
+    return [...this.routeManager.getRoutes()].filter(
+      ([pattern]) => !pattern.includes("[") && !farmPathGuardCoversPage(guards, pattern)
+    );
+  }
   /**
    * The default read-only MCP server (`agent.mcp`), or undefined when the app has an MCP
    * server of its own: a route that answers /mcp, an API route at /api/mcp, `@farm.js/mcp`,
@@ -6340,14 +6386,14 @@ var _ServerRenderer = class _ServerRenderer {
     const server = this.getDefaultMCPServer();
     const request2 = getCurrentRequestOrNull() ?? createWebRequestFromFarmRequest(req, { trustProxy: this.config.server?.trustProxy });
     try {
-      const { handleFarmDefaultMCPRequest } = await import("./agent-mcp-handler-LPJ2CADR.mjs");
+      const { handleFarmDefaultMCPRequest } = await import("./agent-mcp-handler-OLRMZONF.mjs");
       const origin = new URL(request2.url).origin;
       const response = await handleFarmDefaultMCPRequest(request2, {
         server,
         basePath: this.config.basePath,
         listPages: /* @__PURE__ */ __name(async () => {
           const sources = await Promise.all(
-            [...this.routeManager.getRoutes()].filter(([pattern]) => !pattern.includes("[")).map(async ([pattern, route]) => ({
+            this.getAgentListedRoutes().map(async ([pattern, route]) => ({
               pattern,
               // The page itself surfaces a load error. Without its module a guard cannot
               // be ruled out, so the page is left out.
@@ -6383,14 +6429,12 @@ var _ServerRenderer = class _ServerRenderer {
   async createLlmsTxtContext(request2, options = {}) {
     const config = resolveFarmLlmsTxtConfig(this.config.agent?.llmsTxt);
     const origin = new URL(request2.url).origin;
-    const staticRoutes = [...this.routeManager.getRoutes()].filter(
-      ([pattern]) => !pattern.includes("[")
-    );
     const sources = await Promise.all(
-      staticRoutes.map(async ([pattern, route]) => {
+      this.getAgentListedRoutes().map(async ([pattern, route]) => {
         try {
-          const metadata = (await this.routeManager.loadRouteModule(route.modulePath)).metadata;
-          return { pattern, metadata };
+          const module = await this.routeManager.loadRouteModule(route.modulePath);
+          if (module.__farmRouteGuard) return null;
+          return { pattern, metadata: module.metadata };
         } catch (error) {
           logger.warn(`Could not read metadata for ${pattern} in llms.txt: ${error}`);
           return { pattern };
@@ -6399,13 +6443,16 @@ var _ServerRenderer = class _ServerRenderer {
     );
     const rootLayout = this.routeManager.getLayouts().get("/");
     const rootMetadata = rootLayout ? (await this.routeManager.loadLayoutModule(rootLayout.modulePath)).metadata : void 0;
-    const pages = collectFarmLlmsTxtPages(sources, {
-      origin,
-      basePath: this.config.basePath,
-      markdown: resolveMarkdownConfig(this.config.md),
-      include: config.include,
-      exclude: config.exclude
-    });
+    const pages = collectFarmLlmsTxtPages(
+      sources.filter((source) => source !== null),
+      {
+        origin,
+        basePath: this.config.basePath,
+        markdown: resolveMarkdownConfig(this.config.md),
+        include: config.include,
+        exclude: config.exclude
+      }
+    );
     return {
       pages,
       defaults: createFarmDefaultLlmsTxt({
@@ -6567,7 +6614,7 @@ var _ServerRenderer = class _ServerRenderer {
         options.middlewareMap,
         () => _runWithMiddlewareContext(
           options.middlewareContext,
-          () => this.rendererRuntime.renderToString(wrapped)
+          () => this.rendererRuntime.renderToString(wrapped, rendererRenderOptions())
         )
       );
       res.statusCode = options.statusCode;
@@ -6657,7 +6704,8 @@ var _ServerRenderer = class _ServerRenderer {
       const pagePath = req.__FARM_PAGE_PATH__;
       const relativePath = pagePath ? toViteModuleId(pagePath, this.config.root) : "/src/app/page.tsx";
       const deploymentId = this.getDeploymentId();
-      const bootstrapScript = `<script data-farm-refresh-state>
+      const farmScripts = /* @__PURE__ */ __name((markup) => this.stampFarmScripts(req, markup), "farmScripts");
+      const bootstrapScript = farmScripts(`<script data-farm-refresh-state>
 window.__FARM_PROPS__ = ${serializeInlineValue(deferredProps.data.page)};
 window.__FARM_ROUTE_SLOTS__ = ${serializeInlineValue(deferredProps.data.slots)};
 window.__FARM_DEPLOYMENT_ID__ = ${serializeInlineValue(deploymentId)};
@@ -6676,10 +6724,23 @@ window.__FARM_LOADING_MODULE__ = ${JSON.stringify(req.__FARM_LOADING_MODULE_PATH
 window.__FARM_MANIFEST__ = ${JSON.stringify(clientManifest)};
 window.__FARM_INTEGRATION_API_MANIFEST__ = ${JSON.stringify(getRegisteredIntegrationAPIManifest())};
 window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getFarmI18nClientSnapshot()) : "null"};
-</script>`;
-      const deferredScript = createDeferredHydrationScript(deferredProps.records);
-      const rendererHydrationScript = this.rendererRuntime.generateHydrationScript?.() || "";
-      const { html: content, head: rendererHead } = await this.renderElementToDocumentParts(element);
+</script>`);
+      const deferredScript = farmScripts(createDeferredHydrationScript(deferredProps.records));
+      const rendererHydrationScript = farmScripts(
+        this.rendererRuntime.generateHydrationScript?.() || ""
+      );
+      const viteClientScript = farmScripts(`<script type="module" src="/@vite/client"></script>`);
+      const farmClientScript = farmScripts(
+        `<script type="module" src="/@farm/client.js"></script>`
+      );
+      const { html: content, head: rendererHead } = await this.renderElementToDocumentParts(
+        element,
+        {
+          rejectLateNavigation: _isFarmMarkdownPageCheck(
+            req.headers?.[FARM_MARKDOWN_PAGE_CHECK_HEADER]
+          )
+        }
+      );
       const {
         title,
         tags: metaTags,
@@ -6703,6 +6764,7 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
         this.config.basePath,
         getTheme()
       );
+      themeDocument.head = farmScripts(themeDocument.head);
       const fullDocument = extractFarmFullDocument(content);
       let html;
       if (fullDocument) {
@@ -6727,11 +6789,11 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
             renderFarmFontDevHead(this.config.root || process.cwd()),
             this.devGlobalStylesheetLink(),
             ...this.collectDevStyleLinks(),
-            `<script type="module" src="/@vite/client"></script>`,
+            viteClientScript,
             rendererHydrationScript,
             bootstrapScript
           ].filter(Boolean).join("\n  "),
-          bodyFooter: [deferredScript, `<script type="module" src="/@farm/client.js"></script>`].filter(Boolean).join("\n  ")
+          bodyFooter: [deferredScript, farmClientScript].filter(Boolean).join("\n  ")
         });
       } else {
         html = `<!DOCTYPE html>
@@ -6747,14 +6809,14 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
   ${renderFarmFontDevHead(this.config.root || process.cwd())}
   ${this.devGlobalStylesheetLink()}${this.collectDevStyleLinks().map((l) => `
   ${l}`).join("")}
-  <script type="module" src="/@vite/client"></script>
+  ${viteClientScript}
   ${rendererHydrationScript}
   ${bootstrapScript}
 </head>
 <body class="">
   <div id="root">${content}</div>
   ${deferredScript}
-  <script type="module" src="/@farm/client.js"></script>
+  ${farmClientScript}
 </body>
 </html>`;
       }
@@ -6815,7 +6877,7 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
   async renderWithSSR(element, req, res, clearMiddlewareData, options = {}) {
     const renderToPipeableStream = this.rendererRuntime.renderToPipeableStream;
     const fullDocumentRouteKey = options.observabilityRoute || req.__FARM_ROUTE__ || req.url || "/";
-    if (!renderToPipeableStream || fullDocumentRoutes.has(fullDocumentRouteKey) || await this.rootLayoutRendersDocument()) {
+    if (!renderToPipeableStream || _isFarmMarkdownPageCheck(req.headers?.[FARM_MARKDOWN_PAGE_CHECK_HEADER]) || fullDocumentRoutes.has(fullDocumentRouteKey) || await this.rootLayoutRendersDocument()) {
       return this.renderBufferedSSR(element, req, res, clearMiddlewareData, options);
     }
     return new Promise((resolve6, reject) => {
@@ -6946,7 +7008,8 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
       const devStyleLinks = this.collectDevStyleLinks();
       const globalStylesheetLink = this.devGlobalStylesheetLink(true);
       const cspNonce = this.getCspNonce(req);
-      const secureDocumentHTML = /* @__PURE__ */ __name((html) => cspNonce ? addFarmCspNonceToScriptTags(html, cspNonce) : html, "secureDocumentHTML");
+      const stampDocumentHTML = /* @__PURE__ */ __name((html) => stampFarmCspNonce(html, cspNonce || ""), "stampDocumentHTML");
+      const filterDocumentHTML = /* @__PURE__ */ __name((html) => cspNonce ? filterFarmCspNonces(html, cspNonce) : html, "filterDocumentHTML");
       const createLateNavigationRecovery = /* @__PURE__ */ __name((navigationError) => this.createLateNavigationRecoveryHTML(req, navigationError), "createLateNavigationRecovery");
       const { pipe, abort } = renderToPipeableStream(streamRoot, {
         nonce: cspNonce,
@@ -6987,7 +7050,7 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
 </head>
 <body class="">
   <div id="root">`;
-          const securedShell = secureDocumentHTML(shell);
+          const securedShell = stampDocumentHTML(shell);
           htmlParts.push(securedShell);
           staticShellParts?.push(securedShell);
           let firstChunk = true;
@@ -7045,7 +7108,7 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
                 lateNavigationError = null;
                 createLateNavigationRecovery(navigationError).then(
                   (recovery) => {
-                    const secured = secureDocumentHTML(recovery);
+                    const secured = filterDocumentHTML(recovery);
                     htmlParts.push(secured);
                     res.write(secured);
                     finishStream(callback);
@@ -7067,7 +7130,7 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
               if (tail) res.write(tail);
             }
             const suspenseRevealFallback = `<script>(function(){function moveFragment(srcId,placeholderId){var src=document.getElementById(srcId),ph=document.getElementById(placeholderId);if(!src||!ph||!ph.parentNode)return false;while(src.firstChild)ph.parentNode.insertBefore(src.firstChild,ph);ph.parentNode.removeChild(ph);if(src.parentNode)src.parentNode.removeChild(src);return true}function revealBoundary(boundaryId,sectionId){var boundary=document.getElementById(boundaryId),section=document.getElementById(sectionId);if(!boundary||!section||!boundary.parentNode)return false;var start=boundary.previousSibling;if(!start||start.nodeType!==8)return false;var parent=boundary.parentNode;var node=boundary;var depth=0;while(node){if(node.nodeType===8){var data=node.data;if(data==="/$"||data==="/&"){if(depth===0)break;depth--;}else if(data==="$"||data==="$?"||data==="$~"||data==="$!"||data==="&"){depth++;}}var next=node.nextSibling;parent.removeChild(node);node=next;}while(section.firstChild)parent.insertBefore(section.firstChild,node);if(section.parentNode)section.parentNode.removeChild(section);start.data="$";return true}var tries=0;var timer=setInterval(function(){var changed=false;document.querySelectorAll('div[id^="S:"]').forEach(function(section){var suffix=section.id.slice(2);changed=moveFragment('S:'+suffix,'P:'+suffix)||changed;});document.querySelectorAll('template[id^="B:"]').forEach(function(boundary){var suffix=boundary.id.slice(2);changed=revealBoundary('B:'+suffix,'S:'+suffix)||changed;});tries++;if(tries>80||(!document.querySelector('template[id^="B:"]')&&!document.querySelector('template[id^="P:"]'))){clearInterval(timer);}},50);})();</script>`;
-            const footer = secureDocumentHTML(
+            const footer = stampDocumentHTML(
               createDocumentFooter({
                 suspenseRevealFallback,
                 deferredHydrationScript: createDeferredHydrationScript(deferredProps.records)
@@ -7196,7 +7259,10 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
    */
   async createLateNavigationRecoveryHTML(req, error) {
     if (isFarmRedirectError(error)) {
-      return createLateRedirectRecovery(this.localizeRedirectUrl(getFarmRedirectError(error).url));
+      return createLateRedirectRecovery(
+        this.localizeRedirectUrl(getFarmRedirectError(error).url),
+        this.getCspNonce(req) || ""
+      );
     }
     const pathname = resolveFarmRequestURL(req, {
       trustProxy: this.config.server?.trustProxy
@@ -7208,13 +7274,14 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
         content = await this.rendererRuntime.renderToString(
           await this.wrapWithIntegrationProviders(
             this.rendererRuntime.createElement(NotFoundComponent, { pathname })
-          )
+          ),
+          rendererRenderOptions()
         );
       } catch (error2) {
         logger.warn(`not-found page could not render outside its layout, using Farm's: ${error2}`);
       }
     }
-    return createLateNotFoundRecovery(content);
+    return createLateNotFoundRecovery(content, this.getCspNonce(req) || "");
   }
   async render404(req, res) {
     res.statusCode = 404;
@@ -7257,7 +7324,10 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
             });
           }
           element = await this.wrapWithIntegrationProviders(element);
-          const content = await this.rendererRuntime.renderToString(element);
+          const content = await this.rendererRuntime.renderToString(
+            element,
+            rendererRenderOptions()
+          );
           const { head: head2, metadata: metadata2 } = await this.notFoundMetadataHead(layoutModule, notFoundModule);
           const html2 = this.createFullHTML(content, false, pathname, head2, { req, metadata: metadata2 });
           res.setHeader("Content-Type", "text/html; charset=utf-8");
@@ -7290,20 +7360,23 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
     });
     const diagnostics = isDev ? createDefaultErrorDiagnostics(error, this.config.root || process.cwd()) : void 0;
     const statusText = getDefaultErrorStatusText(statusCode);
-    const content = createDefaultErrorMarkup({
-      statusCode,
-      statusText,
-      requestPath: requestUrl.pathname,
-      method: req.method || "GET",
-      message: diagnostics?.message,
-      errorName: diagnostics?.name,
-      stack: diagnostics?.stack,
-      sourceFrame: diagnostics?.sourceFrame,
-      development: isDev,
-      farmVersion: FARM_VERSION,
-      nodeVersion: process.version,
-      mode: isDev ? "development" : "production"
-    });
+    const content = this.stampFarmScripts(
+      req,
+      createDefaultErrorMarkup({
+        statusCode,
+        statusText,
+        requestPath: requestUrl.pathname,
+        method: req.method || "GET",
+        message: diagnostics?.message,
+        errorName: diagnostics?.name,
+        stack: diagnostics?.stack,
+        sourceFrame: diagnostics?.sourceFrame,
+        development: isDev,
+        farmVersion: FARM_VERSION,
+        nodeVersion: process.version,
+        mode: isDev ? "development" : "production"
+      })
+    );
     const html = this.createFullHTML(
       content,
       false,
@@ -7331,12 +7404,14 @@ window.__FARM_I18N__ = ${getFarmI18nClientSnapshot() ? serializeInlineValue(getF
   }
   createFullHTML(content, isClientComponent = false, requestPath = "/", metadataHead, alternates = {}) {
     const i18nSnapshot = getFarmI18nClientSnapshot();
-    const clientScript = isClientComponent ? `  <script type="module" src="/@farm/client.js"></script>` : "";
-    const integrationManifestScript = `<script>
+    const farmScripts = /* @__PURE__ */ __name((html) => this.stampFarmScripts(alternates.req, html), "farmScripts");
+    const clientScript = isClientComponent ? `  ${farmScripts(`<script type="module" src="/@farm/client.js"></script>`)}` : "";
+    const viteClientScript = farmScripts(`<script type="module" src="/@vite/client"></script>`);
+    const integrationManifestScript = farmScripts(`<script>
 window.__FARM_DEPLOYMENT_ID__ = ${serializeInlineValue(this.getDeploymentId())};
 window.__FARM_INTEGRATION_API_MANIFEST__ = ${JSON.stringify(getRegisteredIntegrationAPIManifest())};
 ${i18nSnapshot ? `window.__FARM_I18N__ = ${serializeInlineValue(i18nSnapshot)};` : ""}
-</script>`;
+</script>`);
     const alternateLinks = i18nSnapshot ? renderI18nAlternateLinks(
       requestPath,
       i18nSnapshot,
@@ -7348,7 +7423,10 @@ ${i18nSnapshot ? `window.__FARM_I18N__ = ${serializeInlineValue(i18nSnapshot)};`
       this.config.basePath,
       getTheme()
     );
-    const rendererHydrationScript = this.rendererRuntime.generateHydrationScript?.() || "";
+    themeDocument.head = farmScripts(themeDocument.head);
+    const rendererHydrationScript = farmScripts(
+      this.rendererRuntime.generateHydrationScript?.() || ""
+    );
     const viewportTags = renderViewportHead(alternates.metadata?.viewport);
     const fullDocument = extractFarmFullDocument(content);
     if (fullDocument) {
@@ -7370,7 +7448,7 @@ ${i18nSnapshot ? `window.__FARM_I18N__ = ${serializeInlineValue(i18nSnapshot)};`
             fontHead,
             this.devGlobalStylesheetLink(true),
             ...this.collectDevStyleLinks(),
-            `<script type="module" src="/@vite/client"></script>`,
+            viteClientScript,
             rendererHydrationScript,
             integrationManifestScript
           ].filter(Boolean).join("\n  "),
@@ -7389,7 +7467,7 @@ ${i18nSnapshot ? `window.__FARM_I18N__ = ${serializeInlineValue(i18nSnapshot)};`
   ${fontHead}
   ${this.devGlobalStylesheetLink(true)}${this.collectDevStyleLinks().map((l) => `
   ${l}`).join("")}
-  <script type="module" src="/@vite/client"></script>
+  ${viteClientScript}
   ${rendererHydrationScript}
   ${integrationManifestScript}
 </head>
@@ -7403,9 +7481,18 @@ ${clientScript}
     const value = req.__FARM_CSP_NONCE__;
     return typeof value === "string" ? value : void 0;
   }
+  /** Stamp the response nonce on markup Farm generates (never on rendered app output). */
+  stampFarmScripts(req, html) {
+    return stampFarmCspNonce(html, req && this.getCspNonce(req) || "");
+  }
+  /**
+   * The last pass over a document that holds rendered app output: scripts
+   * keep the response nonce only when Farm or the app (through getCspNonce())
+   * gave it to them.
+   */
   secureDocumentHTML(req, html) {
     const nonce = this.getCspNonce(req);
-    return nonce ? addFarmCspNonceToScriptTags(html, nonce) : html;
+    return nonce ? filterFarmCspNonces(html, nonce) : html;
   }
   applyDeploymentHeaders(req, res) {
     const deploymentId = this.getDeploymentId();
@@ -9349,19 +9436,23 @@ function unwrapFarmDocumentElement(node) {
   });
 }
 
+function farmLayoutBoundaryElement(pattern, content) {
+  return React.createElement(
+    "div",
+    {
+      "data-farm-layout-boundary": "true",
+      "data-farm-layout-pattern": pattern,
+      style: { display: "contents" },
+    },
+    content,
+  );
+}
+
 function FarmLayoutBoundary(props) {
   const Component = props.component;
   const layoutProps = { children: props.children, params: props.params };
   const boundary = function (content) {
-    return React.createElement(
-      "div",
-      {
-        "data-farm-layout-boundary": "true",
-        "data-farm-layout-pattern": props.pattern,
-        style: { display: "contents" },
-      },
-      content,
-    );
+    return farmLayoutBoundaryElement(props.pattern, content);
   };
   const isPlainFunction =
     typeof Component === "function" &&
@@ -9377,6 +9468,12 @@ function FarmLayoutBoundary(props) {
 }
 
 function createFarmLayoutElement(Component, pattern, children, params) {
+  if (typeof React.markFunctionComponent === "function") {
+    return farmLayoutBoundaryElement(
+      pattern,
+      React.createElement(Component, { children: children, params: params }),
+    );
+  }
   return React.createElement(
     FarmLayoutBoundary,
     { key: farmLayoutComponentKey(Component), component: Component, pattern: pattern, params: params },
@@ -10164,7 +10261,7 @@ function loadFarmWorkflowsDevRuntime() {
 }
 __name(loadFarmWorkflowsDevRuntime, "loadFarmWorkflowsDevRuntime");
 function loadFarmDevtoolsSnapshotRuntime() {
-  return import("./devtools-KVOY2TCZ.mjs");
+  return import("./devtools-5AFIPVUJ.mjs");
 }
 __name(loadFarmDevtoolsSnapshotRuntime, "loadFarmDevtoolsSnapshotRuntime");
 function loadFarmDevtoolsUIRuntime() {
@@ -11128,6 +11225,9 @@ function farmPlugin(options = {}, initialPluginManager) {
         apiServerBasePath
       );
       await middlewareManager.discover();
+      farmApp.getServerRenderer().setMiddlewareRouteLookup(
+        () => middlewareManager.getMiddlewares().filter((entry) => entry.source !== "config")
+      );
       if (pm) {
         for (const middleware of middlewareManager.getMiddlewares()) {
           await pm.runHookParallel("middlewareDiscovered", {
@@ -11169,6 +11269,13 @@ function farmPlugin(options = {}, initialPluginManager) {
         return resolveFarmLayoutFonts(layoutModules);
       }, "resolveDocsLayoutFonts");
       releaseDocsMCPServers();
+      const isFarmDocsPathGuarded = /* @__PURE__ */ __name((href) => farmPathGuardCoversPage(
+        {
+          config: farmConfig,
+          middlewareRoutes: middlewareManager.getMiddlewares().filter((entry) => entry.source !== "config")
+        },
+        href
+      ), "isFarmDocsPathGuarded");
       const farmDocsHandler = farmDocsDevRuntime ? farmDocsDevRuntime.hasFarmDocsRuntimeAdapter(farmConfig.docs) ? await farmDocsDevRuntime.createFarmDocsAdapterHandler(farmConfig.docs, {
         root: farmConfig.root,
         srcDir: farmConfig.srcDir,
@@ -11196,7 +11303,8 @@ function farmPlugin(options = {}, initialPluginManager) {
             docsMCPServerDisposers.delete(dispose);
             dispose();
           };
-        }, "registerMCPServer")
+        }, "registerMCPServer"),
+        isPathGuarded: isFarmDocsPathGuarded
       }) : farmDocsDevRuntime.createFarmDocsHandler(farmConfig.docs, {
         root: farmConfig.root,
         srcDir: farmConfig.srcDir,
@@ -11207,7 +11315,8 @@ function farmPlugin(options = {}, initialPluginManager) {
         globalStylesheetHref: resolveDevGlobalStylesheetHref(
           farmConfig.root,
           farmConfig.srcDir
-        )
+        ),
+        isPathGuarded: isFarmDocsPathGuarded
       }) : null;
       const wrapFarmDocsResponseWithLayouts = /* @__PURE__ */ __name(async (request2, response) => {
         if (request2.method === "HEAD" || response.headers.has("x-farm-docs-adapter") || !response.headers.get("content-type")?.toLowerCase().includes("text/html")) {
@@ -11315,7 +11424,8 @@ window.__FARM_MANIFEST__ = ${inlineValue({
         rootDir: farmConfig.root,
         srcDir: farmConfig.srcDir,
         docs: farmConfig.docs,
-        diagnostics: true
+        diagnostics: true,
+        isPathGuarded: isFarmDocsPathGuarded
       }) : null;
       const farmDocsFontAssets = new Map(
         farmDocsFontAssetList.map(({ url, sourcePath }) => [url, sourcePath])
@@ -11509,7 +11619,16 @@ window.__FARM_MANIFEST__ = ${inlineValue({
                   // Read again on each request; unchanged files come from a cache.
                   webmcpTools: farmConfig.plugins?.some(({ name }) => name === "farm:webmcp") ? collectFarmWebMCPTools(farmConfig.root ?? process.cwd(), farmConfig.srcDir) : []
                 }),
-                defaultMCP: /* @__PURE__ */ __name(() => farmApp.getServerRenderer().getDefaultMCPServer(), "defaultMCP")
+                defaultMCP: /* @__PURE__ */ __name(() => farmApp.getServerRenderer().getDefaultMCPServer(), "defaultMCP"),
+                // A guard written for an MCP server's path keeps its tools out of the public view.
+                guardCoversPath: /* @__PURE__ */ __name((path22) => farmPathGuardCoversEndpoint(
+                  {
+                    config: farmConfig,
+                    middlewareRoutes: middlewareManager.getMiddlewares().filter((entry) => entry.source !== "config")
+                  },
+                  path22,
+                  apiServerBasePath
+                ), "guardCoversPath")
               }
             );
             await sendWebResponse(res, manifest);