@farm.js/core 0.1.60 → 0.1.61

package/dist/chunk-4E5WBPEG.mjs

@@ -0,0 +1,1157 @@
+import {
+  isFarmMetadataNoIndex
+} from "./chunk-DTSROJ5J.mjs";
+import {
+  matchesFarmMarkdownRoutePattern
+} from "./chunk-WWIKMBRN.mjs";
+import {
+  _markFarmOwnedResponse,
+  _withFarmResponseHeaders
+} from "./chunk-Z3HATSKO.mjs";
+import {
+  applyFarmBasePath
+} from "./chunk-4RB44K6Z.mjs";
+import {
+  __name
+} from "./chunk-LPEX4YW6.mjs";
+
+// src/agent-crawlers.ts
+var FARM_AI_CRAWLERS = {
+  search: [
+    "OAI-SearchBot",
+    "ChatGPT-User",
+    "Claude-SearchBot",
+    "Claude-User",
+    "PerplexityBot",
+    "Perplexity-User"
+  ],
+  training: [
+    "GPTBot",
+    "ClaudeBot",
+    "Google-Extended",
+    "CCBot",
+    "Applebot-Extended",
+    "Meta-ExternalAgent",
+    "Bytespider"
+  ]
+};
+var LINE_BREAK = /[\r\n]/;
+function resolveFarmAgentCrawlers(input) {
+  if (!input) return { enabled: false, rules: [] };
+  if (input === true) return { enabled: true, rules: [] };
+  if (typeof input !== "object" || Array.isArray(input)) {
+    throw new TypeError("agent.crawlers must be true, false, or an options object.");
+  }
+  if (input.enabled === false) return { enabled: false, rules: [] };
+  for (const key of ["search", "training"]) {
+    const policy = input[key];
+    if (policy !== void 0 && policy !== "allow" && policy !== "block") {
+      throw new TypeError(`agent.crawlers.${key} must be "allow" or "block".`);
+    }
+  }
+  return {
+    enabled: true,
+    ...input.search ? { search: input.search } : {},
+    ...input.training ? { training: input.training } : {},
+    rules: resolveRobotsRules(input.rules),
+    ...input.sitemap !== void 0 ? { sitemap: resolveSitemapUrls(input.sitemap) } : {}
+  };
+}
+__name(resolveFarmAgentCrawlers, "resolveFarmAgentCrawlers");
+function resolveRobotsRules(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) {
+    throw new TypeError("agent.crawlers.rules must be an array of robots.txt rules.");
+  }
+  return value.map((rule, index) => {
+    const name = `agent.crawlers.rules[${index}]`;
+    if (!rule || typeof rule !== "object" || Array.isArray(rule)) {
+      throw new TypeError(`${name} must be an object.`);
+    }
+    const userAgent = readDirectiveValues(rule.userAgent, `${name}.userAgent`);
+    if (userAgent.length === 0) {
+      throw new TypeError(`${name}.userAgent must name at least one user agent.`);
+    }
+    const allow = readDirectiveValues(rule.allow, `${name}.allow`);
+    const disallow = readDirectiveValues(rule.disallow, `${name}.disallow`);
+    if (rule.crawlDelay !== void 0 && (typeof rule.crawlDelay !== "number" || !Number.isFinite(rule.crawlDelay) || rule.crawlDelay < 0)) {
+      throw new TypeError(`${name}.crawlDelay must be a number of seconds.`);
+    }
+    return {
+      userAgent,
+      ...allow.length ? { allow } : {},
+      ...disallow.length ? { disallow } : {},
+      ...rule.crawlDelay !== void 0 ? { crawlDelay: rule.crawlDelay } : {}
+    };
+  });
+}
+__name(resolveRobotsRules, "resolveRobotsRules");
+function readDirectiveValues(value, name) {
+  if (value === void 0) return [];
+  const values = Array.isArray(value) ? value : [value];
+  for (const item of values) {
+    if (typeof item !== "string" || !item || LINE_BREAK.test(item)) {
+      throw new TypeError(`${name} must be a non-empty string or an array of them.`);
+    }
+  }
+  return values;
+}
+__name(readDirectiveValues, "readDirectiveValues");
+function resolveSitemapUrls(value) {
+  const values = Array.isArray(value) ? value : [value];
+  for (const item of values) {
+    if (typeof item !== "string" || !toAbsoluteHttpUrl(item) || LINE_BREAK.test(item)) {
+      throw new TypeError("agent.crawlers.sitemap must be an absolute URL or an array of them.");
+    }
+  }
+  return values;
+}
+__name(resolveSitemapUrls, "resolveSitemapUrls");
+function toAbsoluteHttpUrl(value) {
+  if (typeof value !== "string" && !(value instanceof URL)) return null;
+  try {
+    const url = new URL(String(value));
+    return url.protocol === "https:" || url.protocol === "http:" ? url : null;
+  } catch {
+    return null;
+  }
+}
+__name(toAbsoluteHttpUrl, "toAbsoluteHttpUrl");
+function createFarmAgentRobots(options) {
+  const { crawlers } = options;
+  const rules = [];
+  for (const group of ["search", "training"]) {
+    const policy = crawlers[group];
+    if (!policy) continue;
+    rules.push({
+      userAgent: [...FARM_AI_CRAWLERS[group]],
+      ...policy === "allow" ? { allow: "/" } : { disallow: "/" }
+    });
+  }
+  rules.push(...crawlers.rules);
+  const namesEveryAgent = crawlers.rules.some(
+    (rule) => (Array.isArray(rule.userAgent) ? rule.userAgent : [rule.userAgent]).includes("*")
+  );
+  if (!namesEveryAgent) rules.push({ userAgent: "*", allow: "/" });
+  const sitemap = crawlers.sitemap ?? resolveDefaultSitemap(options);
+  return { rules, ...sitemap.length > 0 ? { sitemap } : {} };
+}
+__name(createFarmAgentRobots, "createFarmAgentRobots");
+function resolveDefaultSitemap(options) {
+  if (!options.sitemapPath) return [];
+  const base = toAbsoluteHttpUrl(options.metadataBase);
+  if (!base) return [];
+  return [new URL(applyFarmBasePath(options.sitemapPath, options.basePath), base).href];
+}
+__name(resolveDefaultSitemap, "resolveDefaultSitemap");
+
+// src/agent-sitemap.ts
+function resolveFarmAgentSitemap(input) {
+  if (!input) return { enabled: false, include: [], exclude: [] };
+  if (input === true) return { enabled: true, include: [], exclude: [] };
+  if (typeof input !== "object") {
+    throw new TypeError("agent.sitemap must be true, false, or an options object.");
+  }
+  if (input.enabled === false) return { enabled: false, include: [], exclude: [] };
+  return {
+    enabled: true,
+    include: resolveRoutePatterns(input.include, "include"),
+    exclude: resolveRoutePatterns(input.exclude, "exclude")
+  };
+}
+__name(resolveFarmAgentSitemap, "resolveFarmAgentSitemap");
+function resolveRoutePatterns(value, key) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) {
+    throw new TypeError(`agent.sitemap.${key} must be an array of route patterns.`);
+  }
+  return value.map((pattern, index) => {
+    if (typeof pattern !== "string" || !pattern.startsWith("/")) {
+      throw new TypeError(
+        `agent.sitemap.${key}[${index}] must be a route pattern starting with "/", such as "/admin/[...path]".`
+      );
+    }
+    return pattern;
+  });
+}
+__name(resolveRoutePatterns, "resolveRoutePatterns");
+function createFarmDefaultSitemap(sources, options) {
+  const { include, exclude } = options.config;
+  const base = toAbsoluteHttpOrigin(options.metadataBase) ?? options.origin;
+  const entries = /* @__PURE__ */ new Map();
+  for (const source of sources) {
+    const path = source.pattern;
+    if (path.includes("[") || path.includes("(") || entries.has(path)) continue;
+    if (include.length && !include.some((pattern) => matchesFarmMarkdownRoutePattern(pattern, path))) {
+      continue;
+    }
+    if (exclude.some((pattern) => matchesFarmMarkdownRoutePattern(pattern, path))) continue;
+    const module = isRecord(source.module) ? source.module : void 0;
+    if (isFarmMetadataNoIndex(module?.metadata)) continue;
+    if (module?.__farmRouteGuard) continue;
+    entries.set(path, {
+      url: new URL(applyFarmBasePath(path, options.basePath), base).href,
+      ...source.lastModified ? { lastModified: source.lastModified } : {}
+    });
+  }
+  return [...entries.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([, entry]) => entry);
+}
+__name(createFarmDefaultSitemap, "createFarmDefaultSitemap");
+function toAbsoluteHttpOrigin(value) {
+  if (typeof value !== "string" && !(value instanceof URL)) return void 0;
+  try {
+    const url = new URL(String(value));
+    return url.protocol === "https:" || url.protocol === "http:" ? url.origin : void 0;
+  } catch {
+    return void 0;
+  }
+}
+__name(toAbsoluteHttpOrigin, "toAbsoluteHttpOrigin");
+function isRecord(value) {
+  return Boolean(value && typeof value === "object");
+}
+__name(isRecord, "isRecord");
+
+// src/security.ts
+function resolveFarmSecurityConfig(input) {
+  if (input === void 0) return { csp: false };
+  if (!isPlainRecord(input)) {
+    throw new TypeError("security must be an object containing the csp option.");
+  }
+  if (Object.prototype.hasOwnProperty.call(input, "contentSecurityPolicy")) {
+    throw new TypeError(
+      "security.contentSecurityPolicy is not supported. Use security.csp instead."
+    );
+  }
+  const csp = input.csp;
+  if (csp === void 0 || csp === false) return { csp: false };
+  if (typeof csp === "string") {
+    return {
+      csp: {
+        value: validateSerializedCsp(csp),
+        reportOnly: false,
+        nonce: false
+      }
+    };
+  }
+  if (!isPlainRecord(csp)) {
+    throw new TypeError("security.csp must be a policy string, false, or an options object.");
+  }
+  const reportOnly = validateReportOnly(csp.reportOnly);
+  const nonce = validateNonce(csp.nonce);
+  if (Object.prototype.hasOwnProperty.call(csp, "value")) {
+    if (Object.prototype.hasOwnProperty.call(csp, "policy") || Object.prototype.hasOwnProperty.call(csp, "directives")) {
+      throw new TypeError(
+        "Resolved security.csp values cannot include policy or directives options."
+      );
+    }
+    return {
+      csp: {
+        value: validateSerializedCsp(csp.value),
+        reportOnly,
+        nonce
+      }
+    };
+  }
+  const { policy, directives } = csp;
+  if (policy !== void 0 && directives !== void 0) {
+    throw new TypeError("security.csp accepts either policy or directives, not both.");
+  }
+  if (policy === void 0 && directives === void 0) {
+    throw new TypeError("security.csp requires a policy string or directives object.");
+  }
+  return {
+    csp: {
+      value: policy !== void 0 ? validateSerializedCsp(policy) : serializeFarmCspDirectives(directives),
+      reportOnly,
+      nonce
+    }
+  };
+}
+__name(resolveFarmSecurityConfig, "resolveFarmSecurityConfig");
+function serializeFarmCspDirectives(directives) {
+  if (!isPlainRecord(directives)) {
+    throw new TypeError("security.csp.directives must be an object.");
+  }
+  const serialized = [];
+  const normalizedNames = /* @__PURE__ */ new Set();
+  for (const [configuredName, configuredValue] of Object.entries(directives)) {
+    if (configuredValue === false || configuredValue === null || configuredValue === void 0) {
+      continue;
+    }
+    const name = normalizeDirectiveName(configuredName);
+    if (normalizedNames.has(name)) {
+      throw new TypeError(`security.csp contains the duplicate directive ${JSON.stringify(name)}.`);
+    }
+    normalizedNames.add(name);
+    const values = configuredValue === true ? [] : (Array.isArray(configuredValue) ? configuredValue : [configuredValue]).map(
+      validateDirectiveValue
+    );
+    serialized.push(values.length > 0 ? `${name} ${values.join(" ")}` : name);
+  }
+  if (serialized.length === 0) {
+    throw new TypeError("security.csp.directives must contain at least one enabled directive.");
+  }
+  return serialized.join("; ");
+}
+__name(serializeFarmCspDirectives, "serializeFarmCspDirectives");
+function getFarmSecurityHeader(security, nonce) {
+  if (!security.csp) return void 0;
+  if (security.csp.nonce && !nonce) return void 0;
+  return {
+    key: security.csp.reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy",
+    value: nonce ? applyFarmCspNonceToPolicy(security.csp.value, nonce) : security.csp.value
+  };
+}
+__name(getFarmSecurityHeader, "getFarmSecurityHeader");
+function createFarmCspNonce(security) {
+  if (!security.csp || !security.csp.nonce) return void 0;
+  const bytes = new Uint8Array(16);
+  globalThis.crypto.getRandomValues(bytes);
+  return Array.from(bytes, (value) => value.toString(16).padStart(2, "0")).join("");
+}
+__name(createFarmCspNonce, "createFarmCspNonce");
+function applyFarmCspNonceToPolicy(policy, nonce) {
+  validateCspNonce(nonce);
+  return applyFarmCspScriptSourcesToPolicy(policy, [`'nonce-${nonce}'`]);
+}
+__name(applyFarmCspNonceToPolicy, "applyFarmCspNonceToPolicy");
+function applyFarmCspHashesToPolicy(policy, hashes) {
+  const sources = hashes.map((hash) => {
+    if (!/^sha(?:256|384|512)-[A-Za-z0-9+/]+={0,2}$/.test(hash)) {
+      throw new TypeError(`Invalid CSP script hash: ${JSON.stringify(hash)}.`);
+    }
+    return `'${hash}'`;
+  });
+  return applyFarmCspScriptSourcesToPolicy(policy, sources);
+}
+__name(applyFarmCspHashesToPolicy, "applyFarmCspHashesToPolicy");
+function applyFarmCspScriptSourcesToPolicy(policy, sources) {
+  const uniqueSources = [...new Set(sources)];
+  if (uniqueSources.length === 0) return policy;
+  const segments = policy.split(";").map((segment) => segment.trim()).filter(Boolean);
+  const names = segments.map((segment) => segment.split(/\s+/, 1)[0].toLowerCase());
+  const governingName = names.includes("script-src-elem") ? "script-src-elem" : names.includes("script-src") ? "script-src" : names.includes("default-src") ? "default-src" : void 0;
+  if (!governingName) return `${policy}; script-src ${uniqueSources.join(" ")}`;
+  return segments.map((segment, index) => {
+    if (names[index] !== governingName) return segment;
+    const existing = new Set(segment.split(/\s+/));
+    const missing = uniqueSources.filter((source) => !existing.has(source));
+    return missing.length > 0 ? `${segment} ${missing.join(" ")}` : segment;
+  }).join("; ");
+}
+__name(applyFarmCspScriptSourcesToPolicy, "applyFarmCspScriptSourcesToPolicy");
+function addFarmCspNonceToScriptTags(html, nonce) {
+  validateCspNonce(nonce);
+  return createFarmCspNonceRewriter(nonce).write(html, true);
+}
+__name(addFarmCspNonceToScriptTags, "addFarmCspNonceToScriptTags");
+function removeFarmCspNoncesFromScriptTags(html) {
+  return createFarmScriptTagRewriter(stripScriptNonceAttribute).write(html, true);
+}
+__name(removeFarmCspNoncesFromScriptTags, "removeFarmCspNoncesFromScriptTags");
+async function createFarmCspScriptHashes(html) {
+  const hashes = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const content of collectFarmInlineScriptContents(html)) {
+    const digest = await globalThis.crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(content)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    const hash = `sha256-${globalThis.btoa(binary)}`;
+    if (!seen.has(hash)) {
+      seen.add(hash);
+      hashes.push(hash);
+    }
+  }
+  return hashes;
+}
+__name(createFarmCspScriptHashes, "createFarmCspScriptHashes");
+async function applyFarmCspHashesToHtml(html, security) {
+  if (!security.csp || !security.csp.nonce) return void 0;
+  const staticHtml = removeFarmCspNoncesFromScriptTags(html);
+  const hashes = await createFarmCspScriptHashes(staticHtml);
+  return {
+    html: staticHtml,
+    header: {
+      key: security.csp.reportOnly ? "Content-Security-Policy-Report-Only" : "Content-Security-Policy",
+      value: applyFarmCspHashesToPolicy(security.csp.value, hashes)
+    }
+  };
+}
+__name(applyFarmCspHashesToHtml, "applyFarmCspHashesToHtml");
+function applyFarmCspNonceToResponse(response, security) {
+  if (!security.csp || !security.csp.nonce) return response;
+  if (!response.headers.get("content-type")?.toLowerCase().includes("text/html")) return response;
+  const nonce = createFarmCspNonce(security);
+  const securityHeader = getFarmSecurityHeader(security, nonce);
+  if (!response.body) {
+    return _withFarmResponseHeaders(response, (headers2) => {
+      headers2.set(securityHeader.key, securityHeader.value);
+      headers2.delete("content-length");
+    });
+  }
+  const headers = new Headers(response.headers);
+  headers.set(securityHeader.key, securityHeader.value);
+  headers.delete("content-length");
+  const decoder = new TextDecoder();
+  const encoder = new TextEncoder();
+  const rewriter = createFarmCspNonceRewriter(nonce);
+  const body = response.body.pipeThrough(
+    new TransformStream({
+      transform(chunk, controller) {
+        const output = rewriter.write(decoder.decode(chunk, { stream: true }));
+        if (output) controller.enqueue(encoder.encode(output));
+      },
+      flush(controller) {
+        const output = rewriter.write(decoder.decode(), true);
+        if (output) controller.enqueue(encoder.encode(output));
+      }
+    })
+  );
+  return _markFarmOwnedResponse(
+    new Response(body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    })
+  );
+}
+__name(applyFarmCspNonceToResponse, "applyFarmCspNonceToResponse");
+function farmCspBlocksFrameworkInlineScripts(security) {
+  if (!security.csp) return false;
+  if (security.csp.nonce) return false;
+  const directives = parseCspDirectives(security.csp.value);
+  const governing = directives.get("script-src-elem") ?? directives.get("script-src") ?? directives.get("default-src");
+  if (!governing) return false;
+  const sources = governing.map((source) => source.toLowerCase());
+  const disablesUnsafeInline = sources.some(
+    (value) => value === "'strict-dynamic'" || value.startsWith("'nonce-") || value.startsWith("'sha256-") || value.startsWith("'sha384-") || value.startsWith("'sha512-")
+  );
+  return !sources.includes("'unsafe-inline'") || disablesUnsafeInline;
+}
+__name(farmCspBlocksFrameworkInlineScripts, "farmCspBlocksFrameworkInlineScripts");
+function parseCspDirectives(value) {
+  const directives = /* @__PURE__ */ new Map();
+  for (const segment of value.split(";")) {
+    const parts = segment.trim().split(/\s+/).filter(Boolean);
+    if (parts.length === 0) continue;
+    const name = parts[0].toLowerCase();
+    if (!directives.has(name)) directives.set(name, parts.slice(1));
+  }
+  return directives;
+}
+__name(parseCspDirectives, "parseCspDirectives");
+function normalizeDirectiveName(value) {
+  const name = value.trim().replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
+  if (!/^[a-z][a-z0-9-]*$/.test(name)) {
+    throw new TypeError(`Invalid security.csp directive name: ${JSON.stringify(value)}.`);
+  }
+  return name;
+}
+__name(normalizeDirectiveName, "normalizeDirectiveName");
+function validateDirectiveValue(value) {
+  if (typeof value !== "string") {
+    throw new TypeError("security.csp directive values must be strings or booleans.");
+  }
+  const normalized = value.trim();
+  if (!normalized || /[;\r\n]/.test(normalized) || normalized.includes("\0")) {
+    throw new TypeError(`Invalid security.csp directive value: ${JSON.stringify(value)}.`);
+  }
+  return normalized;
+}
+__name(validateDirectiveValue, "validateDirectiveValue");
+function validateSerializedCsp(value) {
+  if (typeof value !== "string") {
+    throw new TypeError("security.csp policy must be a non-empty single-line string.");
+  }
+  const normalized = value.trim().replace(/;+$/g, "").trim();
+  if (!normalized || /[\r\n]/.test(normalized) || normalized.includes("\0")) {
+    throw new TypeError("security.csp policy must be a non-empty single-line string.");
+  }
+  return normalized;
+}
+__name(validateSerializedCsp, "validateSerializedCsp");
+function validateReportOnly(value) {
+  if (value === void 0) return false;
+  if (typeof value !== "boolean") {
+    throw new TypeError("security.csp.reportOnly must be a boolean.");
+  }
+  return value;
+}
+__name(validateReportOnly, "validateReportOnly");
+function validateNonce(value) {
+  if (value === void 0) return false;
+  if (typeof value !== "boolean") {
+    throw new TypeError("security.csp.nonce must be a boolean.");
+  }
+  return value;
+}
+__name(validateNonce, "validateNonce");
+function validateCspNonce(value) {
+  if (!/^[A-Za-z0-9+/_-]+={0,2}$/.test(value)) {
+    throw new TypeError("A CSP nonce must be a base64 or base64url value.");
+  }
+}
+__name(validateCspNonce, "validateCspNonce");
+function createFarmCspNonceRewriter(nonce) {
+  validateCspNonce(nonce);
+  return createFarmScriptTagRewriter((tag) => stampScriptTag(tag, nonce));
+}
+__name(createFarmCspNonceRewriter, "createFarmCspNonceRewriter");
+function createFarmScriptTagRewriter(transformScriptTag) {
+  let pending = "";
+  let rawTextElement;
+  return {
+    write(chunk, final = false) {
+      pending += chunk;
+      let output = "";
+      while (pending) {
+        if (rawTextElement) {
+          if (rawTextElement === "plaintext") {
+            output += pending;
+            pending = "";
+            break;
+          }
+          const closing = `</${rawTextElement}`;
+          const start2 = findRawTextEnd(pending, rawTextElement);
+          if (start2 === -1) {
+            if (final) {
+              output += pending;
+              pending = "";
+            } else {
+              const keep = matchingSuffixLength(pending, closing);
+              output += pending.slice(0, pending.length - keep);
+              pending = pending.slice(pending.length - keep);
+            }
+            break;
+          }
+          output += pending.slice(0, start2);
+          pending = pending.slice(start2);
+          const end2 = findHtmlTagEnd(pending);
+          if (end2 === -1) {
+            if (final) {
+              output += pending;
+              pending = "";
+            }
+            break;
+          }
+          output += pending.slice(0, end2 + 1);
+          pending = pending.slice(end2 + 1);
+          rawTextElement = void 0;
+          continue;
+        }
+        const start = pending.indexOf("<");
+        if (start === -1) {
+          output += pending;
+          pending = "";
+          break;
+        }
+        output += pending.slice(0, start);
+        pending = pending.slice(start);
+        if (pending.startsWith("<!--")) {
+          const end2 = pending.indexOf("-->", 4);
+          if (end2 === -1) {
+            if (final) {
+              output += pending;
+              pending = "";
+            }
+            break;
+          }
+          output += pending.slice(0, end2 + 3);
+          pending = pending.slice(end2 + 3);
+          continue;
+        }
+        if (!final && "<!--".startsWith(pending)) break;
+        const tagNameMatch = pending.match(/^<\/?([a-z][a-z0-9:-]*)\b/i);
+        if (!tagNameMatch) {
+          if (!final && /^<\/?[a-z][a-z0-9:-]*$/i.test(pending)) break;
+          output += pending[0];
+          pending = pending.slice(1);
+          continue;
+        }
+        const end = findHtmlTagEnd(pending);
+        if (end === -1) {
+          if (!final) break;
+          output += pending;
+          pending = "";
+          break;
+        }
+        const tag = pending.slice(0, end + 1);
+        const tagName = tagNameMatch[1].toLowerCase();
+        const isClosing = pending.startsWith("</");
+        const isSelfClosing = /\/\s*>$/.test(tag);
+        output += !isClosing && tagName === "script" ? transformScriptTag(tag) : tag;
+        pending = pending.slice(end + 1);
+        if (!isClosing && !isSelfClosing && rawTextElements.has(tagName)) {
+          rawTextElement = tagName;
+        }
+      }
+      return output;
+    }
+  };
+}
+__name(createFarmScriptTagRewriter, "createFarmScriptTagRewriter");
+var rawTextElements = /* @__PURE__ */ new Map([
+  ["iframe", /<\/iframe(?=[\s/>]|$)/gi],
+  ["noembed", /<\/noembed(?=[\s/>]|$)/gi],
+  ["noframes", /<\/noframes(?=[\s/>]|$)/gi],
+  ["plaintext", null],
+  ["script", /<\/script(?=[\s/>]|$)/gi],
+  ["style", /<\/style(?=[\s/>]|$)/gi],
+  ["textarea", /<\/textarea(?=[\s/>]|$)/gi],
+  ["title", /<\/title(?=[\s/>]|$)/gi],
+  ["xmp", /<\/xmp(?=[\s/>]|$)/gi]
+]);
+function stampScriptTag(tag, nonce) {
+  const opening = tag.match(/^<script\b/i)?.[0];
+  if (!opening) return tag;
+  const attributes = stripScriptNonceAttribute(tag).slice(opening.length, -1);
+  return `<script nonce="${nonce}"${attributes}>`;
+}
+__name(stampScriptTag, "stampScriptTag");
+function stripScriptNonceAttribute(tag) {
+  let normalized = tag;
+  let range = findScriptTagAttributeRange(normalized, "nonce");
+  while (range) {
+    normalized = normalized.slice(0, range.start) + normalized.slice(range.end);
+    range = findScriptTagAttributeRange(normalized, "nonce");
+  }
+  return normalized;
+}
+__name(stripScriptNonceAttribute, "stripScriptNonceAttribute");
+function collectFarmInlineScriptContents(html) {
+  const contents = [];
+  let offset = 0;
+  while (offset < html.length) {
+    const start = html.indexOf("<", offset);
+    if (start === -1) break;
+    if (html.startsWith("<!--", start)) {
+      const commentEnd = html.indexOf("-->", start + 4);
+      offset = commentEnd === -1 ? html.length : commentEnd + 3;
+      continue;
+    }
+    const remaining = html.slice(start);
+    const tagNameMatch = remaining.match(/^<\/?([a-z][a-z0-9:-]*)\b/i);
+    if (!tagNameMatch) {
+      offset = start + 1;
+      continue;
+    }
+    const tagEnd = findHtmlTagEnd(remaining);
+    if (tagEnd === -1) break;
+    const tag = remaining.slice(0, tagEnd + 1);
+    const tagName = tagNameMatch[1].toLowerCase();
+    const isClosing = remaining.startsWith("</");
+    const isSelfClosing = /\/\s*>$/.test(tag);
+    offset = start + tagEnd + 1;
+    if (isClosing || isSelfClosing || !rawTextElements.has(tagName)) continue;
+    if (tagName === "plaintext") break;
+    const closingStart = findRawTextEnd(html, tagName, offset);
+    const contentEnd = closingStart === -1 ? html.length : closingStart;
+    if (tagName === "script" && !findScriptTagAttributeRange(tag, "src")) {
+      contents.push(html.slice(offset, contentEnd));
+    }
+    if (closingStart === -1) break;
+    const closingEnd = findHtmlTagEnd(html.slice(contentEnd));
+    if (closingEnd === -1) break;
+    offset = contentEnd + closingEnd + 1;
+  }
+  return contents;
+}
+__name(collectFarmInlineScriptContents, "collectFarmInlineScriptContents");
+function findScriptTagAttributeRange(tag, expectedName) {
+  const opening = tag.match(/^<script\b/i)?.[0];
+  if (!opening) return void 0;
+  let offset = opening.length;
+  while (offset < tag.length - 1) {
+    const whitespaceStart = offset;
+    while (/\s/.test(tag[offset] || "")) offset++;
+    if (tag[offset] === "/" || tag[offset] === ">" || offset >= tag.length - 1) break;
+    const nameStart = offset;
+    while (offset < tag.length && !/[\s=/>]/.test(tag[offset])) offset++;
+    const name = tag.slice(nameStart, offset).toLowerCase();
+    while (/\s/.test(tag[offset] || "")) offset++;
+    if (tag[offset] === "=") {
+      offset++;
+      while (/\s/.test(tag[offset] || "")) offset++;
+      const quote = tag[offset] === '"' || tag[offset] === "'" ? tag[offset++] : void 0;
+      if (quote) {
+        while (offset < tag.length && tag[offset] !== quote) offset++;
+        if (tag[offset] === quote) offset++;
+      } else {
+        while (offset < tag.length && !/[\s>]/.test(tag[offset])) offset++;
+      }
+    }
+    if (name === expectedName) return { start: whitespaceStart, end: offset };
+  }
+  return void 0;
+}
+__name(findScriptTagAttributeRange, "findScriptTagAttributeRange");
+function findRawTextEnd(input, tagName, offset = 0) {
+  const closing = rawTextElements.get(tagName);
+  closing.lastIndex = offset;
+  return closing.exec(input)?.index ?? -1;
+}
+__name(findRawTextEnd, "findRawTextEnd");
+function matchingSuffixLength(input, token) {
+  const limit = Math.min(token.length - 1, input.length);
+  for (let length = limit; length > 0; length--) {
+    if (token.startsWith(input.slice(-length).toLowerCase())) return length;
+  }
+  return 0;
+}
+__name(matchingSuffixLength, "matchingSuffixLength");
+function findHtmlTagEnd(tag) {
+  let quote;
+  for (let index = 1; index < tag.length; index++) {
+    const character = tag[index];
+    if (quote) {
+      if (character === quote) quote = void 0;
+    } else if (character === '"' || character === "'") {
+      quote = character;
+    } else if (character === ">") {
+      return index;
+    }
+  }
+  return -1;
+}
+__name(findHtmlTagEnd, "findHtmlTagEnd");
+function isPlainRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+__name(isPlainRecord, "isPlainRecord");
+
+// src/preload.ts
+var DEFAULT_PRELOAD_CONFIG = {
+  mode: "enforce",
+  maxImages: 1,
+  maxFonts: 2
+};
+var reportedWarnings = /* @__PURE__ */ new Map();
+var nextWarningExpiry = Infinity;
+var PRELOAD_WARNING_TTL_MS = 6e4;
+var MAX_REPORTED_PRELOAD_WARNINGS = 256;
+function resolveFarmPerformanceConfig(config) {
+  return {
+    preload: {
+      mode: config?.preload?.mode === "warn" ? "warn" : "enforce",
+      maxImages: normalizeBudget(config?.preload?.maxImages, DEFAULT_PRELOAD_CONFIG.maxImages),
+      maxFonts: normalizeBudget(config?.preload?.maxFonts, DEFAULT_PRELOAD_CONFIG.maxFonts)
+    }
+  };
+}
+__name(resolveFarmPerformanceConfig, "resolveFarmPerformanceConfig");
+function manageFarmHtmlPreloads(html, config) {
+  const elements = findHtmlLinkElements(html);
+  const candidates = elements.flatMap((element, index) => {
+    const kind = getHtmlPreloadKind(element.value);
+    return kind ? [
+      {
+        index,
+        kind,
+        href: readHtmlAttribute(element.value, "href"),
+        highPriority: readHtmlAttribute(element.value, "fetchpriority")?.toLowerCase() === "high"
+      }
+    ] : [];
+  });
+  const budget = selectPreloadsWithinBudget(candidates, config);
+  if (config.mode === "warn" || budget.removed.size === 0) {
+    return { value: html, warnings: budget.warnings };
+  }
+  return {
+    value: removeHtmlLinkElements(html, elements, budget.removed),
+    warnings: budget.warnings
+  };
+}
+__name(manageFarmHtmlPreloads, "manageFarmHtmlPreloads");
+function manageFarmLinkHeaderPreloads(value, config) {
+  if (!value) return { value, warnings: [] };
+  const links = splitLinkHeader(value);
+  const candidates = links.flatMap((link, index) => {
+    const kind = getLinkHeaderPreloadKind(link);
+    return kind ? [
+      {
+        index,
+        kind,
+        href: getLinkHeaderTarget(link),
+        highPriority: getLinkHeaderParameter(link, "fetchpriority")?.toLowerCase() === "high"
+      }
+    ] : [];
+  });
+  const budget = selectPreloadsWithinBudget(candidates, config);
+  return {
+    value: config.mode === "enforce" ? links.filter((_, index) => !budget.removed.has(index)).join(", ") : value,
+    warnings: budget.warnings
+  };
+}
+__name(manageFarmLinkHeaderPreloads, "manageFarmLinkHeaderPreloads");
+function manageFarmDocumentPreloads(html, linkHeader, config) {
+  const elements = findHtmlLinkElements(html);
+  const links = linkHeader ? splitLinkHeader(linkHeader) : [];
+  const headerOffset = elements.length;
+  const candidates = [];
+  for (const [index, element] of elements.entries()) {
+    const kind = getHtmlPreloadKind(element.value);
+    if (!kind) continue;
+    candidates.push({
+      index,
+      kind,
+      href: readHtmlAttribute(element.value, "href"),
+      highPriority: readHtmlAttribute(element.value, "fetchpriority")?.toLowerCase() === "high"
+    });
+  }
+  for (const [index, link] of links.entries()) {
+    const kind = getLinkHeaderPreloadKind(link);
+    if (!kind) continue;
+    candidates.push({
+      index: headerOffset + index,
+      kind,
+      href: getLinkHeaderTarget(link),
+      highPriority: getLinkHeaderParameter(link, "fetchpriority")?.toLowerCase() === "high"
+    });
+  }
+  const budget = selectPreloadsWithinBudget(candidates, config);
+  if (config.mode === "warn" || budget.removed.size === 0) {
+    return { html, linkHeader, warnings: budget.warnings };
+  }
+  return {
+    html: removeHtmlLinkElements(html, elements, budget.removed),
+    linkHeader: links.filter((_, index) => !budget.removed.has(headerOffset + index)).join(", "),
+    warnings: budget.warnings
+  };
+}
+__name(manageFarmDocumentPreloads, "manageFarmDocumentPreloads");
+function reportFarmPreloadWarnings(warnings, context = "the rendered document") {
+  if (warnings.length === 0 && reportedWarnings.size === 0) return;
+  const now = Date.now();
+  if (now >= nextWarningExpiry) {
+    nextWarningExpiry = Infinity;
+    for (const [key, reportedAt] of reportedWarnings) {
+      const expiresAt = reportedAt + PRELOAD_WARNING_TTL_MS;
+      if (now >= expiresAt) reportedWarnings.delete(key);
+      else nextWarningExpiry = Math.min(nextWarningExpiry, expiresAt);
+    }
+  }
+  for (const warning of warnings) {
+    const key = `${context}:${warning.kind}:${warning.count}:${warning.budget}:${warning.removed}`;
+    const reportedAt = reportedWarnings.get(key);
+    if (reportedAt !== void 0 && now - reportedAt < PRELOAD_WARNING_TTL_MS) continue;
+    reportedWarnings.set(key, now);
+    nextWarningExpiry = Math.min(nextWarningExpiry, now + PRELOAD_WARNING_TTL_MS);
+    while (reportedWarnings.size > MAX_REPORTED_PRELOAD_WARNINGS) {
+      const oldest = reportedWarnings.keys().next().value;
+      if (oldest === void 0) break;
+      reportedWarnings.delete(oldest);
+    }
+    const action = warning.removed > 0 ? ` Removed ${warning.removed} lower-priority hint(s).` : "";
+    const recommendation = warning.kind === "image" ? ' Mark only the LCP image with `preload` or `fetchPriority="high"`.' : " Set `preload: false` on fonts that are not required above the fold.";
+    console.warn(
+      `[Farm.js] ${context} emitted ${warning.count} ${warning.kind} preload hints (budget: ${warning.budget}).${action}${recommendation}`
+    );
+  }
+}
+__name(reportFarmPreloadWarnings, "reportFarmPreloadWarnings");
+function selectPreloadsWithinBudget(candidates, config) {
+  const removed = /* @__PURE__ */ new Set();
+  const warnings = [];
+  for (const kind of ["image", "font"]) {
+    const resources = /* @__PURE__ */ new Map();
+    for (const candidate of candidates) {
+      if (candidate.kind !== kind) continue;
+      const key = candidate.href ?? `#${candidate.index}`;
+      const hints = resources.get(key);
+      if (hints) hints.push(candidate);
+      else resources.set(key, [candidate]);
+    }
+    const limit = kind === "image" ? config.maxImages : config.maxFonts;
+    if (resources.size <= limit) continue;
+    const ranked = [...resources.values()].map((hints) => ({
+      hints,
+      index: hints[0].index,
+      highPriority: hints.some((hint) => hint.highPriority)
+    })).sort(
+      (left, right) => Number(right.highPriority) - Number(left.highPriority) || left.index - right.index
+    );
+    if (config.mode === "enforce") {
+      for (const resource of ranked.slice(limit)) {
+        for (const hint of resource.hints) removed.add(hint.index);
+      }
+    }
+    warnings.push({
+      kind,
+      count: resources.size,
+      budget: limit,
+      removed: config.mode === "enforce" ? resources.size - limit : 0
+    });
+  }
+  return { removed, warnings };
+}
+__name(selectPreloadsWithinBudget, "selectPreloadsWithinBudget");
+function getHtmlPreloadKind(link) {
+  const rel = readHtmlAttribute(link, "rel")?.toLowerCase().split(/\s+/) || [];
+  if (!rel.includes("preload")) return void 0;
+  return normalizePreloadKind(readHtmlAttribute(link, "as"));
+}
+__name(getHtmlPreloadKind, "getHtmlPreloadKind");
+function getLinkHeaderPreloadKind(link) {
+  const relations = getLinkHeaderParameter(link, "rel")?.toLowerCase().split(/\s+/) ?? [];
+  if (!relations.includes("preload")) return void 0;
+  return normalizePreloadKind(getLinkHeaderParameter(link, "as"));
+}
+__name(getLinkHeaderPreloadKind, "getLinkHeaderPreloadKind");
+function getLinkHeaderTarget(link) {
+  const start = link.indexOf("<");
+  const end = link.indexOf(">", start + 1);
+  return start === -1 || end === -1 ? void 0 : link.slice(start + 1, end).trim();
+}
+__name(getLinkHeaderTarget, "getLinkHeaderTarget");
+function getLinkHeaderParameter(link, name) {
+  const uriEnd = link.indexOf(">");
+  if (uriEnd === -1) return void 0;
+  for (const parameter of splitLinkParameters(link.slice(uriEnd + 1))) {
+    const separator = parameter.indexOf("=");
+    const parameterName = (separator === -1 ? parameter : parameter.slice(0, separator)).trim().toLowerCase();
+    if (parameterName !== name.toLowerCase() || separator === -1) continue;
+    const rawValue = parameter.slice(separator + 1).trim();
+    if (rawValue.startsWith('"') && rawValue.endsWith('"')) {
+      return rawValue.slice(1, -1).replace(/\\([\\"])/g, "$1");
+    }
+    return rawValue;
+  }
+  return void 0;
+}
+__name(getLinkHeaderParameter, "getLinkHeaderParameter");
+function splitLinkParameters(value) {
+  const parameters = [];
+  let start = 0;
+  let quoted = false;
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index];
+    if (character === '"' && !isEscaped(value, index)) quoted = !quoted;
+    else if (character === ";" && !quoted) {
+      const parameter2 = value.slice(start, index).trim();
+      if (parameter2) parameters.push(parameter2);
+      start = index + 1;
+    }
+  }
+  const parameter = value.slice(start).trim();
+  if (parameter) parameters.push(parameter);
+  return parameters;
+}
+__name(splitLinkParameters, "splitLinkParameters");
+function normalizePreloadKind(value) {
+  const normalized = value?.toLowerCase();
+  return normalized === "image" || normalized === "font" ? normalized : void 0;
+}
+__name(normalizePreloadKind, "normalizePreloadKind");
+function readHtmlAttribute(element, name) {
+  const match = element.match(
+    new RegExp(`\\s${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s>]+))`, "i")
+  );
+  return match?.[1] ?? match?.[2] ?? match?.[3];
+}
+__name(readHtmlAttribute, "readHtmlAttribute");
+function findHtmlLinkElements(html) {
+  const lastToken = typeof html === "string" ? findLastPreloadToken(html) : Infinity;
+  if (lastToken === -1) return [];
+  const elements = [];
+  let lowerHtml = foldHtmlTagCase(
+    lastToken === Infinity ? html : html.slice(0, lastToken + RAW_TEXT_TAG_LOOKAHEAD)
+  );
+  const rawTextTag = /<(script|style|template|textarea|title|noscript|svg)(?=[\s/>])/y;
+  const linkTag = /<link(?=[\s/>])/iy;
+  const ordinaryTag = /<\/?[A-Za-z][\w:-]*(?=[\s/>])/y;
+  let cursor = 0;
+  while (cursor < html.length) {
+    const start = html.indexOf("<", cursor);
+    if (start === -1 || start > lastToken) break;
+    if (html.startsWith("<!--", start)) {
+      const commentEnd = html.indexOf("-->", start + 4);
+      cursor = commentEnd === -1 ? html.length : commentEnd + 3;
+      continue;
+    }
+    rawTextTag.lastIndex = start;
+    const rawText = rawTextTag.exec(lowerHtml);
+    if (rawText?.[1]) {
+      const openingEnd = findHtmlTagEnd2(html, start);
+      if (openingEnd === -1) break;
+      if (rawText[1] === "svg" && html[openingEnd - 2] === "/") {
+        cursor = openingEnd;
+        continue;
+      }
+      let closingStart = findHtmlClosingTag(lowerHtml, rawText[1], openingEnd);
+      if (closingStart === -1 && lowerHtml.length < html.length) {
+        lowerHtml = foldHtmlTagCase(html);
+        closingStart = findHtmlClosingTag(lowerHtml, rawText[1], openingEnd);
+      }
+      if (closingStart === -1) {
+        cursor = html.length;
+        continue;
+      }
+      const closingEnd = findHtmlTagEnd2(html, closingStart);
+      cursor = closingEnd === -1 ? html.length : closingEnd;
+      continue;
+    }
+    linkTag.lastIndex = start;
+    if (linkTag.test(html)) {
+      const end = findHtmlTagEnd2(html, start);
+      if (end === -1) break;
+      elements.push({ start, end, value: html.slice(start, end) });
+      cursor = end;
+      continue;
+    }
+    ordinaryTag.lastIndex = start;
+    if (ordinaryTag.test(html)) {
+      const end = findHtmlTagEnd2(html, start);
+      cursor = end === -1 ? html.length : end;
+      continue;
+    }
+    cursor = start + 1;
+  }
+  return elements;
+}
+__name(findHtmlLinkElements, "findHtmlLinkElements");
+var RAW_TEXT_TAG_LOOKAHEAD = 16;
+var PRELOAD_TOKEN = /\bpreload\b/gi;
+function findLastPreloadToken(html) {
+  let last = -1;
+  PRELOAD_TOKEN.lastIndex = 0;
+  for (let match = PRELOAD_TOKEN.exec(html); match; match = PRELOAD_TOKEN.exec(html)) {
+    last = match.index;
+  }
+  return last;
+}
+__name(findLastPreloadToken, "findLastPreloadToken");
+function foldHtmlTagCase(html) {
+  const lowerHtml = html.toLowerCase();
+  return lowerHtml.length === html.length ? lowerHtml : html.replace(/[A-Z]/g, (letter) => letter.toLowerCase());
+}
+__name(foldHtmlTagCase, "foldHtmlTagCase");
+function findHtmlClosingTag(html, tagName, start) {
+  const prefix = `</${tagName}`;
+  let candidate = html.indexOf(prefix, start);
+  while (candidate !== -1) {
+    const boundary = html[candidate + prefix.length];
+    if (boundary === ">" || boundary === "/" || /\s/.test(boundary ?? "")) return candidate;
+    candidate = html.indexOf(prefix, candidate + prefix.length);
+  }
+  return -1;
+}
+__name(findHtmlClosingTag, "findHtmlClosingTag");
+function findHtmlTagEnd2(html, start) {
+  let quote;
+  for (let index = start + 1; index < html.length; index += 1) {
+    const character = html[index];
+    if (quote) {
+      if (character === quote) quote = void 0;
+    } else if (character === '"' || character === "'") {
+      quote = character;
+    } else if (character === ">") {
+      return index + 1;
+    }
+  }
+  return -1;
+}
+__name(findHtmlTagEnd2, "findHtmlTagEnd");
+function removeHtmlLinkElements(html, elements, removed) {
+  let cursor = 0;
+  let output = "";
+  for (const [index, element] of elements.entries()) {
+    if (!removed.has(index)) continue;
+    output += html.slice(cursor, element.start);
+    cursor = element.end;
+  }
+  return output + html.slice(cursor);
+}
+__name(removeHtmlLinkElements, "removeHtmlLinkElements");
+function splitLinkHeader(value) {
+  const links = [];
+  let start = 0;
+  let insideAngleBrackets = false;
+  let quoted = false;
+  for (let index = 0; index < value.length; index += 1) {
+    const character = value[index];
+    if (quoted) {
+      if (character === '"' && !isEscaped(value, index)) quoted = false;
+      continue;
+    }
+    if (character === '"') {
+      quoted = true;
+    } else if (character === "<") {
+      insideAngleBrackets = true;
+    } else if (character === ">") {
+      insideAngleBrackets = false;
+    } else if (character === "," && !insideAngleBrackets) {
+      links.push(value.slice(start, index).trim());
+      start = index + 1;
+    }
+  }
+  links.push(value.slice(start).trim());
+  return links.filter(Boolean);
+}
+__name(splitLinkHeader, "splitLinkHeader");
+function isEscaped(value, index) {
+  let backslashes = 0;
+  for (let cursor = index - 1; cursor >= 0 && value[cursor] === "\\"; cursor -= 1) {
+    backslashes += 1;
+  }
+  return backslashes % 2 === 1;
+}
+__name(isEscaped, "isEscaped");
+function normalizeBudget(value, fallback) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : fallback;
+}
+__name(normalizeBudget, "normalizeBudget");
+
+// src/preview-noindex.ts
+var FARM_PREVIEW_ROBOTS_TAG = "noindex, nofollow";
+function resolveFarmNoindexPreviews(input) {
+  if (input === void 0) return false;
+  if (typeof input !== "boolean") {
+    throw new TypeError("agent.noindexPreviews must be a boolean.");
+  }
+  return input;
+}
+__name(resolveFarmNoindexPreviews, "resolveFarmNoindexPreviews");
+function applyFarmPreviewRobotsTag(response) {
+  try {
+    response.headers.set("X-Robots-Tag", FARM_PREVIEW_ROBOTS_TAG);
+    return response;
+  } catch {
+    const headers = new Headers(response.headers);
+    headers.set("X-Robots-Tag", FARM_PREVIEW_ROBOTS_TAG);
+    return new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  }
+}
+__name(applyFarmPreviewRobotsTag, "applyFarmPreviewRobotsTag");
+
+export {
+  resolveFarmAgentCrawlers,
+  createFarmAgentRobots,
+  resolveFarmAgentSitemap,
+  createFarmDefaultSitemap,
+  resolveFarmSecurityConfig,
+  getFarmSecurityHeader,
+  createFarmCspNonce,
+  addFarmCspNonceToScriptTags,
+  applyFarmCspHashesToHtml,
+  applyFarmCspNonceToResponse,
+  farmCspBlocksFrameworkInlineScripts,
+  createFarmCspNonceRewriter,
+  resolveFarmPerformanceConfig,
+  manageFarmHtmlPreloads,
+  manageFarmLinkHeaderPreloads,
+  manageFarmDocumentPreloads,
+  reportFarmPreloadWarnings,
+  FARM_PREVIEW_ROBOTS_TAG,
+  resolveFarmNoindexPreviews,
+  applyFarmPreviewRobotsTag
+};