@farm.js/core 0.1.38 → 0.1.40

package/dist/chunk-HANGSYMB.mjs

@@ -0,0 +1,67 @@
+import {
+  __name
+} from "./chunk-LPEX4YW6.mjs";
+
+// src/middleware/server.ts
+import { AsyncLocalStorage } from "async_hooks";
+var MIDDLEWARE_DATA_STORE_KEY = /* @__PURE__ */ Symbol.for("farm.middlewareDataStore");
+var MIDDLEWARE_CONTEXT_STORE_KEY = /* @__PURE__ */ Symbol.for("farm.middlewareContextStore");
+function getGlobalMiddlewareStore(key) {
+  const state = globalThis;
+  const existing = state[key];
+  if (existing instanceof AsyncLocalStorage) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage();
+  state[key] = store;
+  return store;
+}
+__name(getGlobalMiddlewareStore, "getGlobalMiddlewareStore");
+var middlewareStore = getGlobalMiddlewareStore(MIDDLEWARE_DATA_STORE_KEY);
+var middlewareContextStore = getGlobalMiddlewareStore(MIDDLEWARE_CONTEXT_STORE_KEY);
+function toMiddlewareMap(data) {
+  if (data instanceof Map) {
+    return new Map(data);
+  }
+  return new Map(Object.entries(data));
+}
+__name(toMiddlewareMap, "toMiddlewareMap");
+function _clearCurrentMiddlewareData() {
+  middlewareStore.enterWith(/* @__PURE__ */ new Map());
+}
+__name(_clearCurrentMiddlewareData, "_clearCurrentMiddlewareData");
+function _clearCurrentMiddlewareContext() {
+  middlewareContextStore.enterWith(/* @__PURE__ */ new Map());
+}
+__name(_clearCurrentMiddlewareContext, "_clearCurrentMiddlewareContext");
+async function _runWithMiddlewareData(data, fn) {
+  return middlewareStore.run(toMiddlewareMap(data), fn);
+}
+__name(_runWithMiddlewareData, "_runWithMiddlewareData");
+async function _runWithMiddlewareContext(context, fn) {
+  return middlewareContextStore.run(toMiddlewareMap(context), fn);
+}
+__name(_runWithMiddlewareContext, "_runWithMiddlewareContext");
+function getMiddlewareData() {
+  return middlewareStore.getStore() || /* @__PURE__ */ new Map();
+}
+__name(getMiddlewareData, "getMiddlewareData");
+function getMiddlewareValue(key) {
+  const data = getMiddlewareData();
+  return data.get(key);
+}
+__name(getMiddlewareValue, "getMiddlewareValue");
+function getMiddlewareContext() {
+  return middlewareContextStore.getStore() || /* @__PURE__ */ new Map();
+}
+__name(getMiddlewareContext, "getMiddlewareContext");
+
+export {
+  _clearCurrentMiddlewareData,
+  _clearCurrentMiddlewareContext,
+  _runWithMiddlewareData,
+  _runWithMiddlewareContext,
+  getMiddlewareData,
+  getMiddlewareValue,
+  getMiddlewareContext
+};

package/dist/{chunk-5BWWFHR2.mjs → chunk-HBEBV7OZ.mjs}

@@ -15,13 +15,13 @@ import {
 } from "./chunk-TVGP4BBZ.mjs";
 import {
   stampFarmCspNonce
-} from "./chunk-U6QLDL3G.mjs";
+} from "./chunk-PNCM5MFD.mjs";
 import {
   farmAcceptQuality
-} from "./chunk-VNGH5MLF.mjs";
+} from "./chunk-I6UVKUYK.mjs";
 import {
   matchesFarmIfNoneMatch
-} from "./chunk-ZMMBIVQM.mjs";
+} from "./chunk-ZZGQD7A4.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";

package/dist/{chunk-RSOJ7DRT.mjs → chunk-HCSVR4YZ.mjs}

@@ -304,61 +304,6 @@ if (import.meta.hot) {
 }
 __name(generateFarmDevIndicatorsClientRuntime, "generateFarmDevIndicatorsClientRuntime");
 
-// src/plugin-dependencies.ts
-function pluginShortName(name) {
-  return name.slice(Math.max(name.lastIndexOf(":"), name.lastIndexOf("/")) + 1);
-}
-__name(pluginShortName, "pluginShortName");
-function assertPluginDependencies(plugins, integrations) {
-  const integrationKeys = integrations && !Array.isArray(integrations) ? Object.keys(integrations) : [];
-  const matches = /* @__PURE__ */ __name((plugin, dependency) => plugin.name === dependency || pluginShortName(plugin.name) === dependency, "matches");
-  for (const plugin of plugins) {
-    if (plugin.dependsOn === void 0) continue;
-    if (!Array.isArray(plugin.dependsOn) || plugin.dependsOn.some((entry) => typeof entry !== "string" || entry.trim() === "")) {
-      throw new TypeError(
-        `Plugin "${plugin.name}" has an invalid \`dependsOn\`: list plugin names, such as ["teams"].`
-      );
-    }
-    for (const dependency of plugin.dependsOn) {
-      if (matches(plugin, dependency)) {
-        throw new Error(`Plugin "${plugin.name}" lists itself in \`dependsOn\`.`);
-      }
-      const found = plugins.some((candidate) => candidate !== plugin && matches(candidate, dependency)) || integrationKeys.includes(dependency);
-      if (!found) {
-        const configured = [
-          ...plugins.map((candidate) => candidate.name),
-          ...integrationKeys
-        ].filter((name) => name !== plugin.name);
-        throw new Error(
-          `Plugin "${plugin.name}" depends on "${dependency}", which is not configured. Add it to \`plugins\` (or \`integrations\`) in farm.config.${configured.length > 0 ? ` Configured: ${configured.join(", ")}.` : ""}`
-        );
-      }
-    }
-  }
-  const state = /* @__PURE__ */ new Map();
-  const path3 = [];
-  const visit = /* @__PURE__ */ __name((plugin) => {
-    if (state.get(plugin) === "done") return;
-    if (state.get(plugin) === "visiting") {
-      const cycle = [...path3.slice(path3.indexOf(plugin)), plugin].map(
-        (entry) => pluginShortName(entry.name)
-      );
-      throw new Error(`Plugins depend on each other in a cycle: ${cycle.join(" \u2192 ")}.`);
-    }
-    state.set(plugin, "visiting");
-    path3.push(plugin);
-    for (const dependency of plugin.dependsOn ?? []) {
-      for (const candidate of plugins) {
-        if (candidate !== plugin && matches(candidate, dependency)) visit(candidate);
-      }
-    }
-    path3.pop();
-    state.set(plugin, "done");
-  }, "visit");
-  for (const plugin of plugins) visit(plugin);
-}
-__name(assertPluginDependencies, "assertPluginDependencies");
-
 // src/utils/source-dir.ts
 import path from "path";
 var FARM_PROJECT_SOURCE_DIRS = /* @__PURE__ */ Symbol.for("farm.projectSourceDirs");
@@ -500,7 +445,5 @@ export {
   resolveFarmDevIndicatorsConfig,
   generateFarmDevIndicatorsClientRuntime,
   resolveFarmAuthConfig,
-  resolveFarmAuthIntegration,
-  pluginShortName,
-  assertPluginDependencies
+  resolveFarmAuthIntegration
 };

package/dist/{chunk-HZFM2LWQ.mjs → chunk-HKFBMHCD.mjs}

@@ -66,6 +66,37 @@ function parseColonParam(segment) {
   };
 }
 __name(parseColonParam, "parseColonParam");
+var MATCHER_PARAM_NAME = /^[\p{L}\p{N}_$-]+$/u;
+var MATCHER_UNSUPPORTED_LITERAL = /[()[\]|\\{}^$?:]|\.[*+]/;
+var MATCHER_BRACKET_PARAM = /^\[\[\.\.\.(.+)\]\]$|^\[\.\.\.(.+)\]$|^\[(.+)\]$/;
+function isSupportedMatcherSegment(segment) {
+  if (segment === "*" || segment === "**") return true;
+  if (segment.startsWith(":")) return MATCHER_PARAM_NAME.test(parseColonParam(segment).name);
+  const bracket = MATCHER_BRACKET_PARAM.exec(segment);
+  if (bracket) return MATCHER_PARAM_NAME.test(bracket[1] ?? bracket[2] ?? bracket[3]);
+  return !MATCHER_UNSUPPORTED_LITERAL.test(segment);
+}
+__name(isSupportedMatcherSegment, "isSupportedMatcherSegment");
+function isLiteralMatcherSegment(segment) {
+  return !MATCHER_UNSUPPORTED_LITERAL.test(segment) && !segment.includes("*");
+}
+__name(isLiteralMatcherSegment, "isLiteralMatcherSegment");
+function assertSupportedMiddlewareMatcher(pattern) {
+  if (pattern === "*" || pattern === "/(.*)") return;
+  const subtree = pattern.endsWith("(.*)");
+  const path = subtree ? pattern.slice(0, -4) : pattern;
+  const segments = path.split("/").filter(Boolean);
+  if (segments.every(subtree ? isLiteralMatcherSegment : isSupportedMatcherSegment)) return;
+  throw new Error(
+    `Middleware matcher "${pattern}" is not a supported string pattern, so it would never match a request and the middleware would not run. String matchers do not accept regular-expression syntax such as groups, alternation, character classes, lookaheads, or \`.*\`, or a param after literal text such as \`/user-:id\`. Pass a RegExp instead, for example \`matcher: /^\\/(?!api|_next).*/\`, or use the supported forms: /path/:param, /path/:param*, /path/[param], /path/[...param], /path/*, /path/**, or a trailing (.*) such as /path(.*).`
+  );
+}
+__name(assertSupportedMiddlewareMatcher, "assertSupportedMiddlewareMatcher");
+function compileConfigPattern(pattern, compile) {
+  if (typeof pattern === "string") assertSupportedMiddlewareMatcher(pattern);
+  return compile(pattern);
+}
+__name(compileConfigPattern, "compileConfigPattern");
 function compilePathPattern(pattern, trailingSlash = false) {
   const params = [];
   const segments = pattern.split("/").filter(Boolean);
@@ -140,9 +171,9 @@ __name(compilePattern, "compilePattern");
 function compileMiddlewareConfig(config) {
   const compiled = {
     matcher: config.matcher ? toMatcherList(config.matcher).map(
-      (matcher) => typeof matcher === "function" ? matcher : compileMatcherPattern(matcher)
+      (matcher) => typeof matcher === "function" ? matcher : compileConfigPattern(matcher, compileMatcherPattern)
     ) : void 0,
-    exclude: config.exclude?.map(compilePattern)
+    exclude: config.exclude?.map((pattern) => compileConfigPattern(pattern, compilePattern))
   };
   compiledConfigCache.set(config, {
     compiled,
@@ -250,6 +281,7 @@ export {
   compileMiddlewareRoute,
   matchesMiddlewareRoute,
   matchesMiddlewareRouteAt,
+  assertSupportedMiddlewareMatcher,
   compileMiddlewareConfig,
   matchesMiddlewarePredicate,
   toMiddlewareRoutePathname,

package/dist/{chunk-MLY2RP5R.mjs → chunk-I63UCMXW.mjs}

@@ -2,21 +2,24 @@ import {
   parseRequestCookieHeader
 } from "./chunk-JM5XPKWH.mjs";
 import {
+  _assertRequestReadAllowed,
   getCurrentRequest
-} from "./chunk-POSPE3IO.mjs";
+} from "./chunk-ZOABCQGT.mjs";
 import {
   _resolveCurrentCspNonce
-} from "./chunk-QRKIMN7T.mjs";
+} from "./chunk-Y6LRPO2K.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
 
 // src/headers.ts
 function headers() {
+  _assertRequestReadAllowed("headers()");
   return new Headers(getCurrentRequest().headers);
 }
 __name(headers, "headers");
 function cookies() {
+  _assertRequestReadAllowed("cookies()");
   const cookieHeader = getCurrentRequest().headers.get("cookie") || "";
   const parsed = parseRequestCookieHeader(cookieHeader);
   return {
@@ -39,6 +42,7 @@ function cookies() {
 }
 __name(cookies, "cookies");
 function getCspNonce() {
+  _assertRequestReadAllowed("getCspNonce()");
   return _resolveCurrentCspNonce();
 }
 __name(getCspNonce, "getCspNonce");

package/dist/{chunk-TO4GJ56K.cjs → chunk-I64GEPOB.cjs}

@@ -4,14 +4,17 @@ var _chunk6QQDAAAZcjs = require('./chunk-6QQDAAAZ.cjs');
 
 
 
-var _chunk6V4TDWECcjs = require('./chunk-6V4TDWEC.cjs');
+
+
+
+var _chunkCGVPXIRNcjs = require('./chunk-CGVPXIRN.cjs');
 
 
 var _chunkSOR334EBcjs = require('./chunk-SOR334EB.cjs');
 
 
 
-var _chunkYWN746UScjs = require('./chunk-YWN746US.cjs');
+var _chunkUMQAK3KPcjs = require('./chunk-UMQAK3KP.cjs');
 
 
 var _chunkNYJMY3JAcjs = require('./chunk-NYJMY3JA.cjs');
@@ -39,7 +42,9 @@ function defineRoutes(input) {
   const routes = typeof input === "function" ? input(routesBuilder) : input;
   const manifest = {
     __farmRoutes: true,
-    routes: routes.map(normalizeProgrammaticRoute)
+    routes: routes.map(
+      (route) => stampProgrammaticRouteSource(normalizeProgrammaticRoute(route), route, false)
+    )
   };
   Object.defineProperty(manifest, FARM_ROUTES_BRAND, {
     value: true,
@@ -50,14 +55,14 @@ function defineRoutes(input) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, defineRoutes, "defineRoutes");
 var routesBuilder = {
   page(path, options) {
-    return normalizeProgrammaticRoute({
+    return createProgrammaticRoute({
       kind: "page",
       path,
       ...options
     });
   },
   layout(path, options) {
-    return normalizeProgrammaticRoute({
+    return createProgrammaticRoute({
       kind: "layout",
       path,
       ...options
@@ -65,7 +70,7 @@ var routesBuilder = {
   },
   api(path, options) {
     const { render, runtime, regions, maxDuration, ...methods } = options;
-    return normalizeProgrammaticRoute({
+    return createProgrammaticRoute({
       kind: "api",
       path,
       render,
@@ -76,7 +81,7 @@ var routesBuilder = {
     });
   },
   redirect(source, destination, options = {}) {
-    return normalizeProgrammaticRoute({
+    return createProgrammaticRoute({
       kind: "redirect",
       source,
       destination,
@@ -84,6 +89,41 @@ var routesBuilder = {
     });
   }
 };
+function createProgrammaticRoute(route) {
+  return stampProgrammaticRouteSource(normalizeProgrammaticRoute(route), route, true);
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, createProgrammaticRoute, "createProgrammaticRoute");
+function stampProgrammaticRouteSource(route, input, created) {
+  if (!globalThis[_chunkCGVPXIRNcjs.TRACK_PROGRAMMATIC_ROUTE_SOURCES]) return route;
+  const previous = _chunkCGVPXIRNcjs.getProgrammaticRouteDefinitionSource.call(void 0, input);
+  const source = {
+    stacks: [..._nullishCoalesce(_optionalChain([previous, 'optionalAccess', _ => _.stacks]), () => ( [])), captureRouteSourceStack()],
+    raw: created ? false : _nullishCoalesce(_optionalChain([previous, 'optionalAccess', _2 => _2.raw]), () => ( true))
+  };
+  Object.defineProperty(route, _chunkCGVPXIRNcjs.PROGRAMMATIC_ROUTE_SOURCE, {
+    value: source,
+    enumerable: true,
+    configurable: true,
+    writable: true
+  });
+  return route;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, stampProgrammaticRouteSource, "stampProgrammaticRouteSource");
+function captureRouteSourceStack() {
+  const limit = Error.stackTraceLimit;
+  try {
+    Error.stackTraceLimit = 200;
+    return _nullishCoalesce(new Error().stack, () => ( ""));
+  } catch (e) {
+    return "";
+  } finally {
+    try {
+      Error.stackTraceLimit = limit;
+    } catch (e2) {
+    }
+  }
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, captureRouteSourceStack, "captureRouteSourceStack");
 var page = routesBuilder.page;
 var layout = routesBuilder.layout;
 var api = routesBuilder.api;
@@ -98,8 +138,8 @@ function getProgrammaticRouteSearchClientOptions(search) {
   if (!search || isProgrammaticRouteSchema(search)) return void 0;
   const options = {};
   if (typeof search.stripDefaults !== "undefined") options.stripDefaults = search.stripDefaults;
-  if (_optionalChain([search, 'access', _ => _.preserve, 'optionalAccess', _2 => _2.length])) options.preserve = [...search.preserve];
-  if (_optionalChain([search, 'access', _3 => _3.temporary, 'optionalAccess', _4 => _4.length])) options.temporary = [...search.temporary];
+  if (_optionalChain([search, 'access', _3 => _3.preserve, 'optionalAccess', _4 => _4.length])) options.preserve = [...search.preserve];
+  if (_optionalChain([search, 'access', _5 => _5.temporary, 'optionalAccess', _6 => _6.length])) options.temporary = [...search.temporary];
   return Object.keys(options).length > 0 ? options : void 0;
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getProgrammaticRouteSearchClientOptions, "getProgrammaticRouteSearchClientOptions");
@@ -128,7 +168,7 @@ function isProgrammaticRouteSchema(value) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, isProgrammaticRouteSchema, "isProgrammaticRouteSchema");
 function resolveProgrammaticRouteCanonicalPath(input) {
   const options = input.options;
-  if (!_optionalChain([options, 'optionalAccess', _5 => _5.temporary, 'optionalAccess', _6 => _6.length]) && !_optionalChain([options, 'optionalAccess', _7 => _7.stripDefaults])) {
+  if (!_optionalChain([options, 'optionalAccess', _7 => _7.temporary, 'optionalAccess', _8 => _8.length]) && !_optionalChain([options, 'optionalAccess', _9 => _9.stripDefaults])) {
     return void 0;
   }
   const params = createSearchParams(input.rawSearch);
@@ -174,7 +214,7 @@ function parseDefaultSearch(schema) {
   try {
     const value = schema.parse({});
     return value && typeof value === "object" ? value : void 0;
-  } catch (e) {
+  } catch (e3) {
     return void 0;
   }
 }
@@ -274,7 +314,7 @@ function parseProgrammaticRouteModuleId(moduleId) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, parseProgrammaticRouteModuleId, "parseProgrammaticRouteModuleId");
 function parseProgrammaticRoutePath2(routePath, type = "page") {
-  return _chunk6V4TDWECcjs.parseProgrammaticRoutePath.call(void 0, routePath, type);
+  return _chunkCGVPXIRNcjs.parseProgrammaticRoutePath.call(void 0, routePath, type);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, parseProgrammaticRoutePath2, "parseProgrammaticRoutePath");
 function createRouteModuleFromProgrammaticPage(route, rendererRuntime) {
@@ -337,7 +377,7 @@ function createLayoutModuleFromProgrammaticLayout(route) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, createLayoutModuleFromProgrammaticLayout, "createLayoutModuleFromProgrammaticLayout");
 function scanProgrammaticPagePaths(source) {
   const paths = /* @__PURE__ */ new Set();
-  for (const routePath of _chunk6V4TDWECcjs.extractProgrammaticPageCallPathLiterals.call(void 0, source)) {
+  for (const routePath of _chunkCGVPXIRNcjs.extractProgrammaticPageCallPathLiterals.call(void 0, source)) {
     if (routePath) {
       paths.add(normalizeRoutePath(routePath));
     }
@@ -357,7 +397,7 @@ function createProgrammaticPageComponent(route, rendererRuntime) {
     }
     return rendererRuntime.createElement(...args);
   }, "createElement");
-  const markFunctionComponent = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, (component) => _nullishCoalesce(_optionalChain([rendererRuntime, 'optionalAccess', _8 => _8.markFunctionComponent, 'optionalCall', _9 => _9(component)]), () => ( component)), "markFunctionComponent");
+  const markFunctionComponent = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, (component) => _nullishCoalesce(_optionalChain([rendererRuntime, 'optionalAccess', _10 => _10.markFunctionComponent, 'optionalCall', _11 => _11(component)]), () => ( component)), "markFunctionComponent");
   const Component = route.component;
   if (route.pending) {
     const PendingComponent = route.pending;
@@ -562,7 +602,7 @@ async function resolveProgrammaticRouteProps(route, props) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, resolveProgrammaticRouteProps, "resolveProgrammaticRouteProps");
 async function resolveProgrammaticRouteData(route, dataHooks, context) {
-  if (!_optionalChain([dataHooks, 'optionalAccess', _10 => _10.key])) {
+  if (!_optionalChain([dataHooks, 'optionalAccess', _12 => _12.key])) {
     return dataHooks.main(context);
   }
   const routeDataKey = await dataHooks.key(context);
@@ -576,7 +616,7 @@ async function resolveProgrammaticRouteData(route, dataHooks, context) {
   const cacheKey = _chunkNYJMY3JAcjs.createFarmCacheKey.call(void 0, ["route-data", routeDataKey]);
   const cacheOptions = {
     tags: [
-      _chunkYWN746UScjs.createRouteDataCacheTag.call(void 0, routeDataKey),
+      _chunkUMQAK3KPcjs.createRouteDataCacheTag.call(void 0, routeDataKey),
       ...await resolveProgrammaticRouteDataKeys(dataHooks.tags, context)
     ],
     paths: [
@@ -585,7 +625,7 @@ async function resolveProgrammaticRouteData(route, dataHooks, context) {
     ],
     revalidate
   };
-  return _chunkYWN746UScjs.getFarmDataCache.call(void 0, ).getOrSet(cacheKey, () => dataHooks.main(context), cacheOptions);
+  return _chunkUMQAK3KPcjs.getFarmDataCache.call(void 0, ).getOrSet(cacheKey, () => dataHooks.main(context), cacheOptions);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, resolveProgrammaticRouteData, "resolveProgrammaticRouteData");
 async function resolveProgrammaticRouteDataKeys(input, context) {
@@ -672,7 +712,7 @@ function normalizeProgrammaticRoute(route) {
     };
   }
   const routeActions = route.kind === "page" ? normalizeProgrammaticRouteActions(route) : void 0;
-  normalizeProgrammaticRouteStaleTime(_optionalChain([route, 'access', _11 => _11.data, 'optionalAccess', _12 => _12.staleTime]), route.path);
+  normalizeProgrammaticRouteStaleTime(_optionalChain([route, 'access', _13 => _13.data, 'optionalAccess', _14 => _14.staleTime]), route.path);
   return {
     ...route,
     ...routeActions,

package/dist/{chunk-VNGH5MLF.mjs → chunk-I6UVKUYK.mjs}

@@ -1,6 +1,6 @@
 import {
   emitFarmAgentRead
-} from "./chunk-MVL2RAJW.mjs";
+} from "./chunk-KYN5ODF6.mjs";
 import {
   _findFarmMCPEndpointTool
 } from "./chunk-ZLAT2CWY.mjs";

package/dist/{chunk-EPYU2EBL.mjs → chunk-IF4NU2NG.mjs}

@@ -2,7 +2,7 @@ import {
   FARM_DEFAULT_MCP_DESCRIPTION,
   FARM_DEFAULT_MCP_PROTOCOL_VERSIONS,
   FARM_DEFAULT_MCP_TOOLS
-} from "./chunk-P664ZVTV.mjs";
+} from "./chunk-4ZZNPK25.mjs";
 import {
   stripFarmBasePath
 } from "./chunk-4RB44K6Z.mjs";

package/dist/{chunk-IVLZZZEI.mjs → chunk-IM7DY3ED.mjs}

@@ -1,6 +1,6 @@
 import {
   createFarmMarkdownRouteModule
-} from "./chunk-QFW2IH5E.mjs";
+} from "./chunk-GZTUT75U.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";

package/dist/{chunk-A3EAIURZ.mjs → chunk-IMQO6ZUU.mjs}

@@ -4,14 +4,14 @@ import {
   loadFarmDocsPage,
   resolveFarmDocsContentDir,
   toFarmDocsMarkdownPage
-} from "./chunk-5BWWFHR2.mjs";
+} from "./chunk-HBEBV7OZ.mjs";
 import {
   docsEngine,
   loadFarmDocsEngine
 } from "./chunk-2VQKKQ6D.mjs";
 import {
   resolveDocsConfig
-} from "./chunk-ZJD2PN6Z.mjs";
+} from "./chunk-Y4QVEU67.mjs";
 import {
   getFarmDocsAdapterConfigModule,
   isSecretDocsConfigKey

package/dist/{chunk-F5QO4FNE.mjs → chunk-INQ64HTJ.mjs}

@@ -1,6 +1,9 @@
+import {
+  FARM_ANONYMOUS_CLIENT_ADDRESS
+} from "./chunk-BRYPZIMB.mjs";
 import {
   matchesFarmIfNoneMatch
-} from "./chunk-ZMMBIVQM.mjs";
+} from "./chunk-ZZGQD7A4.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
@@ -122,7 +125,7 @@ ${negotiatedFormat}`;
           return entry;
         });
       }
-      return createOptimizedImageResponse(request, optimized, config);
+      return createOptimizedImageResponse(request, optimized);
     } catch (error) {
       if (!(error instanceof FarmImageRequestError) && !isAbortError(error)) {
         try {
@@ -352,14 +355,18 @@ async function fetchImageSource(initialUrl, requestOrigin, trustedLocalOrigin, c
   let currentUrl = initialUrl;
   for (let redirectCount = 0; ; redirectCount += 1) {
     throwIfAborted(signal);
-    const sourceFetcher = currentUrl.origin === trustedLocalOrigin ? fetcher : fetchRemote ?? fetcher;
+    const isTrustedLocal = currentUrl.origin === trustedLocalOrigin;
+    const sourceFetcher = isTrustedLocal ? fetcher : fetchRemote ?? fetcher;
     const response = await sourceFetcher(currentUrl, {
       method: "GET",
       redirect: "manual",
       signal,
       headers: {
         accept: "image/avif,image/webp,image/*,*/*;q=0.8",
-        "user-agent": "Farm.js Image Optimizer"
+        "user-agent": "Farm.js Image Optimizer",
+        // This server fetching from itself arrives from a loopback address.
+        // Mark it so the app sees an anonymous visitor, not a trusted local one.
+        ...isTrustedLocal ? { [FARM_IMAGE_SOURCE_HEADER]: getFarmImageSourceToken() } : {}
       }
     });
     if (![301, 302, 303, 307, 308].includes(response.status)) {
@@ -398,6 +405,19 @@ async function fetchImageSource(initialUrl, requestOrigin, trustedLocalOrigin, c
   }
 }
 __name(fetchImageSource, "fetchImageSource");
+var FARM_IMAGE_SOURCE_HEADER = "x-farm-image-source";
+var FARM_IMAGE_SOURCE_TOKEN = /* @__PURE__ */ Symbol.for("farm.image.sourceToken");
+function getFarmImageSourceToken() {
+  const state = globalThis;
+  return state[FARM_IMAGE_SOURCE_TOKEN] ?? (state[FARM_IMAGE_SOURCE_TOKEN] = globalThis.crypto.randomUUID());
+}
+__name(getFarmImageSourceToken, "getFarmImageSourceToken");
+function _withFarmImageSourceClientAddress(request, context) {
+  const token = globalThis[FARM_IMAGE_SOURCE_TOKEN];
+  if (!token || request.headers.get(FARM_IMAGE_SOURCE_HEADER) !== token) return context;
+  return { ...context, clientAddress: FARM_ANONYMOUS_CLIENT_ADDRESS };
+}
+__name(_withFarmImageSourceClientAddress, "_withFarmImageSourceClientAddress");
 function resolveTrustedLocalOrigin(configured) {
   const value = typeof configured === "function" ? configured() : configured;
   if (!value) return void 0;
@@ -532,12 +552,23 @@ function validateTransformedResult(result, config) {
   if (!contentType || contentType === "image/svg+xml" && !config.dangerouslyAllowSVG) {
     throw new Error("The image transformer returned an unsupported content type");
   }
+  if (detectImageContentType(result.body) !== contentType) {
+    throw new Error("The image transformer returned bytes that do not match their content type");
+  }
   result.contentType = contentType;
 }
 __name(validateTransformedResult, "validateTransformedResult");
+var OPTIMIZED_IMAGE_TYPES = /* @__PURE__ */ new Set([
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "image/avif",
+  "image/svg+xml"
+]);
 function normalizeImageContentType(value) {
   const type = value?.split(";", 1)[0].trim().toLowerCase() ?? "";
-  return type.startsWith("image/") ? type : "";
+  return OPTIMIZED_IMAGE_TYPES.has(type) ? type : "";
 }
 __name(normalizeImageContentType, "normalizeImageContentType");
 function matchesRemoteSource(url, config) {
@@ -570,7 +601,7 @@ function matchesHostname(hostname, pattern) {
   return normalizedHostname === normalizedPattern;
 }
 __name(matchesHostname, "matchesHostname");
-function createOptimizedImageResponse(request, image, config) {
+function createOptimizedImageResponse(request, image) {
   const headers = new Headers({
     "cache-control": image.cacheControl,
     "content-type": image.contentType,
@@ -578,11 +609,11 @@ function createOptimizedImageResponse(request, image, config) {
     "content-disposition": "inline",
     etag: image.etag,
     vary: "Accept",
-    "x-content-type-options": "nosniff"
+    "x-content-type-options": "nosniff",
+    // Every optimized image, not only SVG: if a response is ever rendered as a
+    // document, it still cannot run script or load anything.
+    "content-security-policy": "default-src 'none'; sandbox"
   });
-  if (image.contentType === "image/svg+xml" && config.dangerouslyAllowSVG) {
-    headers.set("content-security-policy", "default-src 'none'; sandbox");
-  }
   if (matchesFarmIfNoneMatch(request.headers.get("if-none-match"), image.etag)) {
     headers.delete("content-length");
     return new Response(null, { status: 304, headers });
@@ -660,5 +691,6 @@ export {
   createFarmImageHandler,
   createCloudflareImageTransformer,
   selectOutputFormat,
-  isPrivateImageAddress
+  isPrivateImageAddress,
+  _withFarmImageSourceClientAddress
 };

package/dist/{chunk-XKVVMZP5.cjs → chunk-IRYK4Z5M.cjs}

@@ -1,9 +1,9 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkKCQBAKIYcjs = require('./chunk-KCQBAKIY.cjs');
+var _chunkH44XGLFUcjs = require('./chunk-H44XGLFU.cjs');
 
 
-var _chunk4GWRFP22cjs = require('./chunk-4GWRFP22.cjs');
+var _chunkALPWLT27cjs = require('./chunk-ALPWLT27.cjs');
 
 
 var _chunkHLJ6MBUZcjs = require('./chunk-HLJ6MBUZ.cjs');
@@ -213,7 +213,7 @@ var _MiddlewareChainImpl = class _MiddlewareChainImpl {
    */
   when(condition, fn) {
     const conditionalMiddleware = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, async (ctx, next) => {
-      const shouldRun = typeof condition === "function" ? _chunk4GWRFP22cjs.matchesMiddlewarePredicate.call(void 0, condition, ctx) : condition;
+      const shouldRun = typeof condition === "function" ? _chunkALPWLT27cjs.matchesMiddlewarePredicate.call(void 0, condition, ctx) : condition;
       if (!shouldRun) {
         return next();
       }
@@ -418,7 +418,7 @@ function farmMiddlewarePlugin(options = {}) {
       mode: server.config.mode === "production" ? "production" : "development",
       basePath: _nullishCoalesce(options.basePath, () => ( "/"))
     });
-    manager = new (0, _chunkKCQBAKIYcjs.MiddlewareManager)(
+    manager = new (0, _chunkH44XGLFUcjs.MiddlewareManager)(
       getMiddlewareAppDirectory(server.config.root, srcDir),
       server,
       options.middleware,