@farm.js/core 0.1.31 → 0.1.34

package/dist/{chunk-4IEPYMHF.mjs → chunk-3UEVPCGW.mjs}

@@ -1,6 +1,6 @@
 import {
   applyFarmCacheInvalidationTargets
-} from "./chunk-IV6CQY7O.mjs";
+} from "./chunk-MSSFIQGM.mjs";
 import {
   isMultipartSchema
 } from "./chunk-EMLAPBEM.mjs";

package/dist/{chunk-5LJCOSKT.mjs → chunk-3VSKDFAT.mjs}

@@ -1,6 +1,6 @@
 import {
   createFarmMarkdownRouteModule
-} from "./chunk-7QOCTYBS.mjs";
+} from "./chunk-AGC75XAE.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";

package/dist/{chunk-5HGR3W6O.mjs → chunk-5SJWVY6R.mjs}

@@ -3,6 +3,13 @@ import {
 } from "./chunk-LPEX4YW6.mjs";
 
 // src/client/navigation-url.ts
+var FARM_NAVIGATION_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]);
+function isFarmBlockedNavigationURL(url) {
+  if (FARM_NAVIGATION_PROTOCOLS.has(url.protocol)) return false;
+  console.error(`[Farm.js] Blocked navigation to a ${url.protocol} URL as a security precaution.`);
+  return true;
+}
+__name(isFarmBlockedNavigationURL, "isFarmBlockedNavigationURL");
 function isFarmExternalNavigationURL(url, currentOrigin) {
   return url.protocol !== "http:" && url.protocol !== "https:" || url.origin !== currentOrigin;
 }
@@ -13,6 +20,7 @@ function resolveFarmNavigationURL(href, documentUrl) {
 __name(resolveFarmNavigationURL, "resolveFarmNavigationURL");
 
 export {
+  isFarmBlockedNavigationURL,
   isFarmExternalNavigationURL,
   resolveFarmNavigationURL
 };

package/dist/{chunk-X7WVQMIB.mjs → chunk-657WJNRY.mjs}

@@ -1,7 +1,7 @@
 import {
   isEndpointFailure,
   resolvePluginRoutes
-} from "./chunk-4IEPYMHF.mjs";
+} from "./chunk-3UEVPCGW.mjs";
 import {
   registerAPIRouteShape
 } from "./chunk-W3B4PKAW.mjs";
@@ -9,13 +9,16 @@ import {
   omitFarmResponseBody
 } from "./chunk-5WI2S4CO.mjs";
 import {
-  resolveFarmAPICanonicalPathname
-} from "./chunk-I6XDAKWQ.mjs";
+  validateIntegrationRequestOrigin
+} from "./chunk-FZ6YYU2W.mjs";
 import {
   DEFAULT_FARM_SERVER_BODY_SIZE_LIMIT,
   bufferFarmRequestBody,
   createFarmRequestBodyErrorResponse
 } from "./chunk-XF7Q24PF.mjs";
+import {
+  resolveFarmAPICanonicalPathname
+} from "./chunk-BTHHUD7Q.mjs";
 import {
   createStaticAPIRouteMatcher,
   matchAPIRoute
@@ -31,7 +34,7 @@ import {
 } from "./chunk-4SIYUGRY.mjs";
 import {
   _runWithCurrentRequest
-} from "./chunk-BSPQVJ4A.mjs";
+} from "./chunk-FDR64H6B.mjs";
 import {
   __name
 } from "./chunk-LPEX4YW6.mjs";
@@ -388,6 +391,9 @@ async function readRequestBody(request) {
   }
   if (!text) return { body: void 0 };
   if (contentType === void 0) {
+    if (!validateIntegrationRequestOrigin(request, { requireOriginMetadata: false }).ok) {
+      return { body: void 0 };
+    }
     try {
       return { body: JSON.parse(text) };
     } catch {

package/dist/{chunk-MKMBQSNQ.mjs → chunk-6VVL3MHY.mjs}

@@ -7,10 +7,10 @@ import {
   notifyHistoryChange,
   readPageState,
   subscribeHistoryChange
-} from "./chunk-JATSG2ZO.mjs";
+} from "./chunk-CLJYVZAD.mjs";
 import {
   getFarmI18nClientState
-} from "./chunk-TOVMYGYW.mjs";
+} from "./chunk-F2SE2VDO.mjs";
 import {
   _resolveCurrentRequest
 } from "./chunk-IZY3V5XW.mjs";
@@ -196,7 +196,7 @@ function readRouterState(basePath, routeMatcher) {
   }
   const pathname = normalizeClientPathname(url.pathname, basePath);
   const i18n = getFarmI18nClientState();
-  const routePathname = i18n ? stripFarmLocaleFromPathname(pathname, i18n) : pathname;
+  const routePathname = i18n ? stripFarmLocaleFromPathname(pathname, { ...i18n, basePath: "/" }) : pathname;
   return {
     pathname,
     searchParams: url.searchParams,

package/dist/{chunk-QZRVZSPN.cjs → chunk-77GNHH2Z.cjs}

@@ -12,7 +12,7 @@ var _chunkDVM4FKZLcjs = require('./chunk-DVM4FKZL.cjs');
 var _chunkOX6O6WVAcjs = require('./chunk-OX6O6WVA.cjs');
 
 
-var _chunk5ZSWG4UXcjs = require('./chunk-5ZSWG4UX.cjs');
+var _chunkUXFQ3UDAcjs = require('./chunk-UXFQ3UDA.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -41,7 +41,7 @@ function createRedirectsPlugin(redirects, {
       if (overrideBeforeRequest) {
         await overrideBeforeRequest(req, res, context);
       }
-      const url = _chunk5ZSWG4UXcjs.resolveFarmRequestURL.call(void 0, req);
+      const url = _chunkUXFQ3UDAcjs.resolveFarmRequestURL.call(void 0, req);
       const routePath = _chunkDVM4FKZLcjs.resolveConfigRoutePathname.call(void 0, url.pathname, i18n);
       const pathname = routePath.pathname;
       for (const { redirect, pattern } of compiledRedirects) {
@@ -153,7 +153,7 @@ function createHeadersPlugin(headers, {
       if (overrideBeforeRequest) {
         await overrideBeforeRequest(req, res, context);
       }
-      const url = _chunk5ZSWG4UXcjs.resolveFarmRequestURL.call(void 0, req);
+      const url = _chunkUXFQ3UDAcjs.resolveFarmRequestURL.call(void 0, req);
       const pathname = _chunkDVM4FKZLcjs.resolveConfigRoutePathname.call(void 0, url.pathname, i18n).pathname;
       const matchedHeaders = compiledHeaders.filter(({ pattern }) => pattern.regex.test(pathname)).map(({ config }) => config.headers);
       applyResponseHeaders(res, matchedHeaders);

package/dist/{chunk-KZLND3D2.cjs → chunk-7BT4H4P7.cjs}

@@ -1,9 +1,9 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
-var _chunkZHVYQL3Hcjs = require('./chunk-ZHVYQL3H.cjs');
+var _chunkU74I55WBcjs = require('./chunk-U74I55WB.cjs');
 
 
-var _chunkHBTUGXHScjs = require('./chunk-HBTUGXHS.cjs');
+var _chunkHLJ6MBUZcjs = require('./chunk-HLJ6MBUZ.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -410,16 +410,18 @@ function farmMiddlewarePlugin(options = {}) {
   let discoveryComplete = false;
   let discoveryPromise = null;
   const discover = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, async (server) => {
-    const i18n = _chunkHBTUGXHScjs.resolveFarmI18nConfig.call(void 0, false, {
+    const i18n = _chunkHLJ6MBUZcjs.resolveFarmI18nConfig.call(void 0, false, {
       root: server.config.root,
       mode: server.config.mode === "production" ? "production" : "development",
       basePath: _nullishCoalesce(options.basePath, () => ( "/"))
     });
-    manager = new (0, _chunkZHVYQL3Hcjs.MiddlewareManager)(
+    manager = new (0, _chunkU74I55WBcjs.MiddlewareManager)(
       getMiddlewareAppDirectory(server.config.root, srcDir),
       server,
+      options.middleware,
+      i18n,
       void 0,
-      i18n
+      options.apiBasePath
     );
     await manager.discover();
     discoveryComplete = true;

package/dist/{chunk-A777V5WU.cjs → chunk-7M52YUMY.cjs}

@@ -27,7 +27,7 @@ var _chunkE2ROOWQCcjs = require('./chunk-E2ROOWQC.cjs');
 var _chunkJSROZYYOcjs = require('./chunk-JSROZYYO.cjs');
 
 
-var _chunkZ5HIWVDPcjs = require('./chunk-Z5HIWVDP.cjs');
+var _chunkTDFPACVXcjs = require('./chunk-TDFPACVX.cjs');
 
 
 var _chunkS3JO3N4Hcjs = require('./chunk-S3JO3N4H.cjs');
@@ -119,7 +119,7 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, withTimeout, "withTimeout");
 var formatSeconds = /* @__PURE__ */ _chunkS3JO3N4Hcjs.__name.call(void 0, (ms) => ms < 1e3 ? `${ms}ms` : `${Number((ms / 1e3).toFixed(1))}s`, "formatSeconds");
 function collectSchemaOwners(config) {
   const owners = [];
-  const integrationSchemas = _chunkZ5HIWVDPcjs.getIntegrationSchemas.call(void 0, config.integrations);
+  const integrationSchemas = _chunkTDFPACVXcjs.getIntegrationSchemas.call(void 0, config.integrations);
   let integrationClient;
   for (const [name, schema] of Object.entries(integrationSchemas)) {
     owners.push({

package/dist/{chunk-VUMAE7NC.mjs → chunk-7Y6ZNFPX.mjs}

@@ -1,13 +1,18 @@
 import {
-  compileMiddlewareConfig,
-  compileMiddlewareRoute,
-  matchesMiddlewareConfig,
-  matchesMiddlewareRoute,
+  isRouteSlotSegment
+} from "./chunk-UBO4SGH4.mjs";
+import {
   normalizeMiddlewareModule,
   parseMiddlewareCookieHeader,
   serializeMiddlewareCookie,
   serializeMiddlewareCookieDeletion
-} from "./chunk-NRVGEI5I.mjs";
+} from "./chunk-2NNMOPDN.mjs";
+import {
+  compileMiddlewareConfig,
+  compileMiddlewareRoute,
+  matchesMiddlewareConfigAt,
+  matchesMiddlewareRouteAt
+} from "./chunk-JG6DJF5A.mjs";
 import {
   createCliColors
 } from "./chunk-I2BHUNBU.mjs";
@@ -18,6 +23,9 @@ import {
 import {
   logger
 } from "./chunk-KI3MESHB.mjs";
+import {
+  createFarmAPIMiddlewarePathnames
+} from "./chunk-BTHHUD7Q.mjs";
 import {
   emitFarmEvent
 } from "./chunk-FUZEBRP3.mjs";
@@ -31,7 +39,7 @@ import {
 } from "./chunk-CBBLJMR5.mjs";
 import {
   resolveFarmRequestURL
-} from "./chunk-BSPQVJ4A.mjs";
+} from "./chunk-FDR64H6B.mjs";
 import {
   stripFarmLocaleFromPathname
 } from "./chunk-L3KT7IXV.mjs";
@@ -185,12 +193,24 @@ import * as path from "path";
 
 // src/middleware/path.ts
 function appendMiddlewareRoutePath(routePath, directoryName) {
-  if (directoryName.startsWith("(") && directoryName.endsWith(")")) {
+  if (directoryName.startsWith("(") && directoryName.endsWith(")") || isRouteSlotSegment(directoryName)) {
     return routePath;
   }
   return routePath === "/" ? `/${directoryName}` : `${routePath}/${directoryName}`;
 }
 __name(appendMiddlewareRoutePath, "appendMiddlewareRoutePath");
+function appendMiddlewareDirectory(directory, directoryName) {
+  return directory === "" ? directoryName : `${directory}/${directoryName}`;
+}
+__name(appendMiddlewareDirectory, "appendMiddlewareDirectory");
+function countSegments(value) {
+  return value.split("/").filter(Boolean).length;
+}
+__name(countSegments, "countSegments");
+function compareMiddlewareRouteLocations(left, right) {
+  return countSegments(left.path) - countSegments(right.path) || left.path.localeCompare(right.path) || countSegments(left.directory) - countSegments(right.directory) || left.directory.localeCompare(right.directory);
+}
+__name(compareMiddlewareRouteLocations, "compareMiddlewareRouteLocations");
 
 // src/middleware/manager.ts
 function isMiddlewareResponse(value) {
@@ -198,13 +218,14 @@ function isMiddlewareResponse(value) {
 }
 __name(isMiddlewareResponse, "isMiddlewareResponse");
 var _MiddlewareManager = class _MiddlewareManager {
-  constructor(appDir, viteServer, config, i18n, server) {
+  constructor(appDir, viteServer, config, i18n, server, apiBasePath) {
     this.middleware = [];
     this.configMiddleware = [];
     this.appDirs = Array.isArray(appDir) ? [...appDir] : [appDir];
     this.viteServer = viteServer;
     this.i18n = i18n;
     this.server = server;
+    this.toMiddlewarePathnames = createFarmAPIMiddlewarePathnames(apiBasePath);
     this.configure(config);
   }
   configure(config) {
@@ -233,21 +254,16 @@ var _MiddlewareManager = class _MiddlewareManager {
    * Discover all middleware.ts files
    */
   async discover() {
-    const middlewareByPath = /* @__PURE__ */ new Map();
+    const middlewareByDirectory = /* @__PURE__ */ new Map();
     for (const appDir of this.appDirs) {
       const discovered = [];
-      await this.discoverInDirectory(appDir, "/", discovered);
-      for (const middleware of discovered) {
-        compileMiddlewareRoute(middleware);
-        middlewareByPath.set(middleware.path, middleware);
+      await this.discoverInDirectory(appDir, "/", "", discovered);
+      for (const entry of discovered) {
+        compileMiddlewareRoute(entry.middleware);
+        middlewareByDirectory.set(entry.location.directory, entry);
       }
     }
-    this.middleware = Array.from(middlewareByPath.values());
-    this.middleware.sort((a, b) => {
-      const depthA = a.path.split("/").filter(Boolean).length;
-      const depthB = b.path.split("/").filter(Boolean).length;
-      return depthA - depthB;
-    });
+    this.middleware = Array.from(middlewareByDirectory.values()).sort((left, right) => compareMiddlewareRouteLocations(left.location, right.location)).map((entry) => entry.middleware);
     if (process.env.FARM_VERBOSE && this.middleware.length > 0) {
       logger.success(`Discovered ${this.middleware.length} middleware files`);
       for (const mw of this.middleware) {
@@ -258,7 +274,7 @@ var _MiddlewareManager = class _MiddlewareManager {
   /**
    * Recursively discover middleware files
    */
-  async discoverInDirectory(dir, routePath, discovered) {
+  async discoverInDirectory(dir, routePath, directory, discovered) {
     if (!fs.existsSync(dir)) {
       return;
     }
@@ -266,15 +282,18 @@ var _MiddlewareManager = class _MiddlewareManager {
     if (middlewareFile) {
       const middleware = await this.loadMiddleware(middlewareFile, routePath);
       if (middleware) {
-        discovered.push(middleware);
+        discovered.push({ location: { path: routePath, directory }, middleware });
       }
     }
     const entries = fs.readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (entry.isDirectory() && !entry.name.startsWith(".") && !entry.name.startsWith("_")) {
-        const subPath = path.join(dir, entry.name);
-        const subRoutePath = appendMiddlewareRoutePath(routePath, entry.name);
-        await this.discoverInDirectory(subPath, subRoutePath, discovered);
+        await this.discoverInDirectory(
+          path.join(dir, entry.name),
+          appendMiddlewareRoutePath(routePath, entry.name),
+          appendMiddlewareDirectory(directory, entry.name),
+          discovered
+        );
       }
     }
   }
@@ -329,7 +348,9 @@ var _MiddlewareManager = class _MiddlewareManager {
   async execute(req, res) {
     const url = resolveFarmRequestURL(req, { trustProxy: this.server?.trustProxy });
     const pathname = url.pathname;
-    const routePathname = this.i18n?.enabled ? stripFarmLocaleFromPathname(pathname, this.i18n) : stripFarmBasePath(pathname, this.i18n?.basePath ?? "/");
+    const toRoutePathname = /* @__PURE__ */ __name((value) => this.i18n?.enabled ? stripFarmLocaleFromPathname(value, this.i18n) : stripFarmBasePath(value, this.i18n?.basePath ?? "/"), "toRoutePathname");
+    const routePathname = toRoutePathname(pathname);
+    const toMiddlewarePathnames = this.toMiddlewarePathnames;
     const method = req.method || "GET";
     const startTime = Date.now();
     let parentData;
@@ -345,7 +366,10 @@ var _MiddlewareManager = class _MiddlewareManager {
     }
     const applicable = [
       ...this.configMiddleware.map((mw) => ({ mw, routeMatch: { matched: true } })),
-      ...this.middleware.map((mw) => ({ mw, routeMatch: matchesMiddlewareRoute(routePathname, mw) })).filter((entry) => entry.routeMatch.matched)
+      ...this.middleware.map((mw) => ({
+        mw,
+        routeMatch: matchesMiddlewareRouteAt(toMiddlewarePathnames(routePathname), mw)
+      })).filter((entry) => entry.routeMatch.matched)
     ];
     if (applicable.length === 0) {
       return false;
@@ -360,12 +384,37 @@ var _MiddlewareManager = class _MiddlewareManager {
       pc.dim(` (${(Date.now() - startTime).toFixed(2)}ms)`)
     ].join(" ");
     console.log(log);
-    for (const entry of applicable) {
-      const { mw, routeMatch } = entry;
-      const configMatch = mw.config ? this.matchesConfig(routePathname, mw.config, ctx) : { matched: true };
+    const ran = /* @__PURE__ */ new Set();
+    const allMiddleware = [...this.configMiddleware, ...this.middleware];
+    const globalConfig = this.globalConfig;
+    const trustProxy = this.server?.trustProxy;
+    function* applicableMiddleware() {
+      let passPathname = routePathname;
+      let pass = applicable;
+      for (; ; ) {
+        for (const entry of pass) yield { ...entry, pathname: passPathname };
+        const rewrittenPathname = toRoutePathname(
+          resolveFarmRequestURL(req, { trustProxy }).pathname
+        );
+        if (rewrittenPathname === passPathname) return;
+        passPathname = rewrittenPathname;
+        const passPathnames = toMiddlewarePathnames(passPathname);
+        if (globalConfig && !matchesMiddlewareConfigAt(passPathnames, globalConfig, ctx).matched) {
+          return;
+        }
+        pass = allMiddleware.filter((mw) => !ran.has(mw)).map((mw) => ({
+          mw,
+          routeMatch: mw.source === "config" ? { matched: true } : matchesMiddlewareRouteAt(passPathnames, mw)
+        })).filter((entry) => entry.routeMatch.matched);
+      }
+    }
+    __name(applicableMiddleware, "applicableMiddleware");
+    for (const { mw, routeMatch, pathname: passPathname } of applicableMiddleware()) {
+      const configMatch = mw.config ? this.matchesConfig(passPathname, mw.config, ctx) : { matched: true };
       if (!configMatch.matched) {
         continue;
       }
+      ran.add(mw);
       if (routeMatch.params) {
         ctx.params = { ...ctx.params, ...routeMatch.params };
       }
@@ -466,7 +515,7 @@ var _MiddlewareManager = class _MiddlewareManager {
    * Check if pathname matches middleware config
    */
   matchesConfig(pathname, config, ctx) {
-    return matchesMiddlewareConfig(pathname, config, ctx);
+    return matchesMiddlewareConfigAt(this.toMiddlewarePathnames(pathname), config, ctx);
   }
   /**
    * Reload middleware (for HMR)
@@ -501,5 +550,7 @@ var MiddlewareManager = _MiddlewareManager;
 export {
   createContext,
   appendMiddlewareRoutePath,
+  appendMiddlewareDirectory,
+  compareMiddlewareRouteLocations,
   MiddlewareManager
 };

package/dist/{chunk-MXDTKXO6.cjs → chunk-A5FGU2WU.cjs}

@@ -3,14 +3,14 @@
 
 
 
-var _chunk2FXWWUE5cjs = require('./chunk-2FXWWUE5.cjs');
+var _chunkZ2YLTERKcjs = require('./chunk-Z2YLTERK.cjs');
 
 
 
 var _chunkIK6LVLKCcjs = require('./chunk-IK6LVLKC.cjs');
 
 
-var _chunkDFLLARUKcjs = require('./chunk-DFLLARUK.cjs');
+var _chunkPQDFUSXDcjs = require('./chunk-PQDFUSXD.cjs');
 
 
 var _chunk75WGQVQAcjs = require('./chunk-75WGQVQA.cjs');
@@ -39,7 +39,7 @@ function createFarmDocsAdapterRuntimeConfig(docs, options, moduleConfig) {
     ...moduleConfig ? { ...moduleConfig, ...docs.configOverrides } : _nullishCoalesce(docs.runtimeConfig, () => ( docs.config)),
     entry: docs.config.entry || docs.entry.replace(/^\/+|\/+$/g, "") || "docs",
     docsPath: docs.entry,
-    contentDir: _chunk2FXWWUE5cjs.resolveFarmDocsContentDir.call(void 0, docs, options)
+    contentDir: _chunkZ2YLTERKcjs.resolveFarmDocsContentDir.call(void 0, docs, options)
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, createFarmDocsAdapterRuntimeConfig, "createFarmDocsAdapterRuntimeConfig");
@@ -124,6 +124,7 @@ async function createFarmDocsAdapterHandler(docs, options) {
 _chunkS3JO3N4Hcjs.__name.call(void 0, createFarmDocsAdapterHandler, "createFarmDocsAdapterHandler");
 
 // src/docs/api.ts
+
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -274,25 +275,25 @@ function getDocsDescription(docs) {
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getDocsDescription, "getDocsDescription");
 function getLoadedDocsPages(context) {
-  return _chunk2FXWWUE5cjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs).map((page) => _chunk2FXWWUE5cjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, page.slug)).filter((page) => Boolean(page));
+  return _chunkZ2YLTERKcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs).map((page) => _chunkZ2YLTERKcjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, page.slug)).filter((page) => Boolean(page));
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, getLoadedDocsPages, "getLoadedDocsPages");
 function toDocsSourcePage(page) {
   return {
-    ..._chunk2FXWWUE5cjs.toFarmDocsMarkdownPage.call(void 0, page),
+    ..._chunkZ2YLTERKcjs.toFarmDocsMarkdownPage.call(void 0, page),
     sourcePath: page.sourcePath
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, toDocsSourcePage, "toDocsSourcePage");
 function toDocsSitemapPage(page) {
   return {
-    ..._chunk2FXWWUE5cjs.toFarmDocsMarkdownPage.call(void 0, page),
+    ..._chunkZ2YLTERKcjs.toFarmDocsMarkdownPage.call(void 0, page),
     sourcePath: page.sourcePath
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, toDocsSitemapPage, "toDocsSitemapPage");
 function toDocsLlmsPage(page) {
-  return _chunk2FXWWUE5cjs.toFarmDocsMarkdownPage.call(void 0, page);
+  return _chunkZ2YLTERKcjs.toFarmDocsMarkdownPage.call(void 0, page);
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, toDocsLlmsPage, "toDocsLlmsPage");
 function getDocsLlmsOptions(context, request) {
@@ -386,7 +387,7 @@ _chunkS3JO3N4Hcjs.__name.call(void 0, renderAgentsDocument, "renderAgentsDocumen
 function buildAgentSpec(context, request) {
   const url = new URL(request.url);
   const origin = url.origin;
-  const pages = _chunk2FXWWUE5cjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs);
+  const pages = _chunkZ2YLTERKcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs);
   const spec = _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).buildDocsAgentDiscoverySpec(getDocsDiscoveryOptions(context, request));
   const title = getDocsTitle(context.docs);
   return {
@@ -423,12 +424,66 @@ function buildAgentSpec(context, request) {
       robots: spec.capabilities.robots,
       post: false
     },
-    pages
+    // Same root-relative source paths the precompiled runtime serves.
+    pages: pages.map(({ sourcePath, ...page }) => {
+      const publicSourcePath = toPublicDocsPath(sourcePath, context.root);
+      return publicSourcePath ? { ...page, sourcePath: `./${publicSourcePath}` } : page;
+    })
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, buildAgentSpec, "buildAgentSpec");
+var REDACTED_DOCS_CONFIG_VALUE = "[redacted]";
+function isSecretDocsConfigKey(key) {
+  const normalized = key.replace(/[-_]/g, "").toLowerCase();
+  if (!normalized || normalized.endsWith("env")) return false;
+  return /apikey|token|secret|password|authorization|credential/.test(normalized);
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, isSecretDocsConfigKey, "isSecretDocsConfigKey");
+function redactDocsConfigValue(value, key, inHeaders) {
+  if (Array.isArray(value)) {
+    return value.map((entry) => redactDocsConfigValue(entry, key, inHeaders));
+  }
+  if (isRecord(value) && !(value instanceof Date) && !(value instanceof URL)) {
+    const headers = inHeaders || key.toLowerCase() === "headers";
+    return Object.fromEntries(
+      Object.entries(value).map(([childKey, child]) => [
+        childKey,
+        redactDocsConfigValue(child, childKey, headers)
+      ])
+    );
+  }
+  if (value === null || value === void 0 || typeof value === "function") return value;
+  return inHeaders || isSecretDocsConfigKey(key) ? REDACTED_DOCS_CONFIG_VALUE : value;
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, redactDocsConfigValue, "redactDocsConfigValue");
+function toPublicDocsPath(value, root) {
+  if (typeof value !== "string" || !value) return void 0;
+  if (!_path2.default.isAbsolute(value)) return value;
+  const relative = _path2.default.relative(root, value);
+  if (_path2.default.isAbsolute(relative) || relative === ".." || relative.startsWith(`..${_path2.default.sep}`)) {
+    return void 0;
+  }
+  return relative.split(_path2.default.sep).join("/") || ".";
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, toPublicDocsPath, "toPublicDocsPath");
+function buildPublicConfig(context) {
+  const redacted = redactDocsConfigValue(context.docs.config, "", false);
+  const contentDir = toPublicDocsPath(redacted.contentDir, context.root);
+  const publicInput = { ...redacted, contentDir };
+  const map = _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).buildDocsConfigMap(publicInput, {
+    file: toPublicDocsPath(context.docs.configPath, context.root) || "farm.config.ts"
+  });
+  const config = Object.fromEntries(Object.keys(map.values).map((key) => [key, publicInput[key]]));
+  return {
+    entry: context.docs.entry,
+    contentDir: toPublicDocsPath(context.docs.contentDir, context.root) || contentDir || null,
+    config,
+    map
+  };
+}
+_chunkS3JO3N4Hcjs.__name.call(void 0, buildPublicConfig, "buildPublicConfig");
 function buildDiagnostics(context) {
-  const pages = _chunk2FXWWUE5cjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs);
+  const pages = _chunkZ2YLTERKcjs.discoverFarmDocsPages.call(void 0, context.contentDir, context.docs);
   const diagnostics = _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).buildDocsDiagnostics(context.docs.config, {
     entry: context.docs.entry,
     mcp: {
@@ -500,12 +555,13 @@ async function resolveAPIContext(options) {
     config: options.config,
     configPath: options.configPath
   }));
-  const docs = isResolvedDocsConfig(docsInput) ? docsInput : await _chunkDFLLARUKcjs.resolveDocsConfig.call(void 0, docsInput, { root, srcDir });
+  const docs = isResolvedDocsConfig(docsInput) ? docsInput : await _chunkPQDFUSXDcjs.resolveDocsConfig.call(void 0, docsInput, { root, srcDir });
   return {
     root,
     srcDir,
     docs,
-    contentDir: _chunk2FXWWUE5cjs.resolveFarmDocsContentDir.call(void 0, docs, { root, srcDir })
+    contentDir: _chunkZ2YLTERKcjs.resolveFarmDocsContentDir.call(void 0, docs, { root, srcDir }),
+    diagnostics: options.diagnostics === true
   };
 }
 _chunkS3JO3N4Hcjs.__name.call(void 0, resolveAPIContext, "resolveAPIContext");
@@ -517,21 +573,16 @@ async function handleDocsAPIGet(request, context) {
   const format = getDocsAPIFormat(request);
   const pathTarget = getDocsAPIPathTarget(request);
   if (format === "config" || format === "docs-config") {
-    return json({
-      entry: context.docs.entry,
-      contentDir: context.docs.contentDir || context.docs.config.contentDir || null,
-      config: context.docs.config,
-      map: _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).buildDocsConfigMap(context.docs.config, {
-        file: context.docs.configPath || "farm.config.ts"
-      })
-    });
+    return json(buildPublicConfig(context));
   }
   if (format === "skill")
     return text(renderSkillDocument(context, request), "text/markdown; charset=utf-8");
   if (format === "agents")
     return text(renderAgentsDocument(context, request), "text/markdown; charset=utf-8");
   if (format === "agent" || format === "agent-spec") return json(buildAgentSpec(context, request));
-  if (format === "diagnostics") return json(buildDiagnostics(context));
+  if (format === "diagnostics") {
+    return context.diagnostics ? json(buildDiagnostics(context)) : json({ error: "Docs diagnostics are only available in development" }, { status: 404 });
+  }
   if (format === "llms")
     return text(renderLlmsTxt(context, request, false), "text/plain; charset=utf-8");
   if (format === "llms-full")
@@ -568,10 +619,10 @@ async function handleDocsAPIGet(request, context) {
   if (format === "markdown" || url.pathname.endsWith(".md")) {
     const pathParam = url.searchParams.get("path") || url.searchParams.get("slug");
     const slug = normalizeDocsApiSlug(_nullishCoalesce(_nullishCoalesce(pathParam, () => ( pathTarget.slug)), () => ( "")), context.docs);
-    const page = _chunk2FXWWUE5cjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, slug);
+    const page = _chunkZ2YLTERKcjs.loadFarmDocsPage.call(void 0, context.contentDir, context.docs, slug);
     if (!page) return text("Docs page not found\n", "text/plain; charset=utf-8", { status: 404 });
     return text(
-      _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).renderDocsMarkdownDocument(_chunk2FXWWUE5cjs.toFarmDocsMarkdownPage.call(void 0, page), {
+      _chunkIK6LVLKCcjs.docsEngine.call(void 0, ).renderDocsMarkdownDocument(_chunkZ2YLTERKcjs.toFarmDocsMarkdownPage.call(void 0, page), {
         origin: new URL(request.url).origin,
         llms: getDocsLlmsOptions(context, request),
         sitemap: context.docs.config.sitemap