@thallylabs/migrate 0.2.25 → 0.2.26

package/dist/index.js

@@ -889,27 +889,104 @@ function normalizeAssetPath(value) {
 function objectValue(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
+var OPEN_NAVIGATION_ACCESS = Object.freeze({ hasPublicFalse: false, hasPublicTrue: false });
 var PUBLIC_FALSE_STRINGS = /* @__PURE__ */ new Set(["false", "no", "off", "0"]);
-function isPublicFalse(value) {
-  return value === false || value === 0 || typeof value === "string" && PUBLIC_FALSE_STRINGS.has(value.trim().toLowerCase());
+var PUBLIC_TRUE_STRINGS = /* @__PURE__ */ new Set(["true"]);
+function parsePublic(value) {
+  if (value === void 0 || value === null) return { isMalformed: false };
+  if (value === true) return { isPublic: true, isMalformed: false };
+  if (value === false || value === 0) return { isPublic: false, isMalformed: false };
+  if (typeof value === "string") {
+    const normalized = value.trim().toLowerCase();
+    if (PUBLIC_TRUE_STRINGS.has(normalized)) return { isPublic: true, isMalformed: false };
+    if (PUBLIC_FALSE_STRINGS.has(normalized)) return { isPublic: false, isMalformed: false };
+  }
+  return { isMalformed: true };
+}
+function parseGroups(value) {
+  if (value === void 0 || value === null || value === "" || value === false) return { groups: [], isMalformed: false };
+  if (typeof value === "string") {
+    const groups = value.split(",").map((group) => group.trim()).filter(Boolean);
+    return { groups: [...new Set(groups)], isMalformed: groups.length === 0 };
+  }
+  if (Array.isArray(value)) {
+    if (value.some((group) => typeof group !== "string")) return { groups: [], isMalformed: true };
+    const groups = value.map((group) => group.trim()).filter(Boolean);
+    return { groups: [...new Set(groups)], isMalformed: value.length > 0 && groups.length === 0 };
+  }
+  return { groups: [], isMalformed: true };
+}
+function accessFrom(groupsValue, publicValue, where) {
+  const groups = parseGroups(groupsValue);
+  const visibility = parsePublic(publicValue);
+  const problem = groups.isMalformed ? `${where} \`groups\` is not a list of group names` : visibility.isMalformed ? `${where} \`public\` is neither true nor false` : void 0;
+  return {
+    ...groups.groups.length > 0 ? { groups: groups.groups } : {},
+    ...visibility.isPublic !== void 0 ? { isPublic: visibility.isPublic } : {},
+    ...problem ? { problem } : {}
+  };
 }
-function isPublicTrue(value) {
-  return value === true || typeof value === "string" && value.trim().toLowerCase() === "true";
+function frontmatterAccess(data) {
+  return accessFrom(data.groups, data.public, "frontmatter");
 }
-function frontmatterGateReason(data) {
-  const groups = data.groups;
-  const hasGroups = Array.isArray(groups) ? groups.length > 0 : typeof groups === "string" ? groups.trim() !== "" : groups !== void 0 && groups !== null && groups !== false;
-  if (hasGroups) return "frontmatter `groups` restricts it to authenticated groups";
-  if (isPublicFalse(data.public)) return "frontmatter `public: false`";
-  return void 0;
+function isRestrictedAccess(access) {
+  return Boolean(access.problem) || (access.groups?.length ?? 0) > 0 || access.isPublic === false;
+}
+var NAVIGATION_CONTAINER_KEYS = ["group", "pages", "tab", "groups", "page", "root", "menu", "href"];
+function navigationAccess(node) {
+  const isContainer = (entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && NAVIGATION_CONTAINER_KEYS.some((key) => key in entry);
+  const groups = Array.isArray(node.groups) && node.groups.length > 0 && node.groups.every(isContainer) ? void 0 : node.groups;
+  const access = accessFrom(groups, node.public, "its navigation container's");
+  return Object.keys(access).length > 0 ? access : void 0;
 }
 function navigationGateReason(node) {
-  const groups = node.groups;
-  const isContainer = (entry) => typeof entry === "object" && entry !== null && !Array.isArray(entry) && ["group", "pages", "tab", "groups", "page", "root", "menu", "href"].some((key) => key in entry);
-  const restricted = typeof groups === "string" ? groups.trim() !== "" : Array.isArray(groups) && groups.length > 0 && !groups.every(isContainer);
-  if (restricted) return "its navigation container sets `groups`";
-  if (isPublicFalse(node.public)) return "its navigation container sets `public: false`";
-  return void 0;
+  const access = navigationAccess(node);
+  if (!access || !isRestrictedAccess(access)) return void 0;
+  return access.problem ?? (access.groups ? "its navigation container sets `groups`" : "its navigation container sets `public: false`");
+}
+function intersect(left, right) {
+  if (!left) return right;
+  if (!right) return left;
+  return left.filter((group) => right.includes(group));
+}
+function descendNavigationAccess(outer, container) {
+  if (!container) return outer;
+  const groups = intersect(outer.groups, container.groups);
+  const problem = outer.problem ?? container.problem ?? (groups && groups.length === 0 ? "nested navigation containers set `groups` that share no group" : void 0);
+  return {
+    ...groups ? { groups } : {},
+    hasPublicFalse: outer.hasPublicFalse || container.isPublic === false,
+    hasPublicTrue: outer.hasPublicTrue || container.isPublic === true,
+    ...problem ? { problem } : {}
+  };
+}
+function mergeNavigationAppearances(appearances) {
+  if (appearances.length === 0) return OPEN_NAVIGATION_ACCESS;
+  let groups;
+  for (const appearance of appearances) groups = intersect(groups, appearance.groups);
+  const problem = appearances.find((appearance) => appearance.problem)?.problem ?? (groups && groups.length === 0 ? "it is listed under navigation containers whose `groups` share no group" : void 0);
+  return {
+    ...groups ? { groups } : {},
+    hasPublicFalse: appearances.some((appearance) => appearance.hasPublicFalse),
+    hasPublicTrue: appearances.every((appearance) => appearance.hasPublicTrue),
+    ...problem ? { problem } : {}
+  };
+}
+function hasNavigationRules(access) {
+  return isNavigationRestricted(access) || access.hasPublicTrue;
+}
+function isNavigationRestricted(access) {
+  return Boolean(access.problem) || (access.groups?.length ?? 0) > 0 || access.hasPublicFalse;
+}
+function resolvePageAccess(own2, navigation) {
+  const problem = own2.problem ?? navigation.problem;
+  if (problem) return { problem };
+  const groups = intersect(own2.groups, navigation.groups);
+  if (groups && groups.length === 0) {
+    return { problem: "its frontmatter `groups` and its navigation container's `groups` share no group" };
+  }
+  const isPublic = own2.isPublic === false || navigation.hasPublicFalse ? false : own2.isPublic === true || navigation.hasPublicTrue && !groups ? true : void 0;
+  return { access: { ...groups ? { groups } : {}, ...isPublic !== void 0 ? { isPublic } : {} } };
 }
 var CONFIG_BASENAME = /(?:^|[.-])(?:config|rc)\.[cm]?js$|^(?:tailwind|postcss|next|eslint|prettier|babel|webpack|vite|vitest|jest|rollup|gulpfile|gruntfile|stylelint|commitlint|lint-staged|svgo|metro)[.-]/i;
 var BUILD_OUTPUT_SEGMENTS = /* @__PURE__ */ new Set(["dist", "build", "coverage"]);
@@ -4223,22 +4300,31 @@ function collectGatedSourceRefs(node, gate, out, limits, depth = 0) {
   if (reason && typeof object.sourceRef === "string") out.set(object, reason);
   for (const value of Object.values(object)) collectGatedSourceRefs(value, reason, out, limits, depth + 1);
 }
-function collectGatedReferences(node, gate, pathPrefix, out, depth = 0) {
+function collectReferenceAccess(node, access, pathPrefix, out, depth = 0) {
   if (depth > SWEEP_DEPTH_LIMIT) return;
   if (Array.isArray(node)) {
-    for (const item of node) collectGatedReferences(item, gate, pathPrefix, out, depth + 1);
+    for (const item of node) collectReferenceAccess(item, access, pathPrefix, out, depth + 1);
     return;
   }
   const object = objectValue2(node);
   if (!object) return;
-  const reason = gate ?? navigationGateReason(object);
-  if (reason) {
-    const refs = [object.page, object.root, ...Array.isArray(object.pages) ? object.pages : []];
+  const nested = descendNavigationAccess(access, navigationAccess(object));
+  if (hasNavigationRules(nested)) {
+    const refs = [object.page, object.root, object.href, ...Array.isArray(object.pages) ? object.pages : []];
     for (const ref of refs) {
-      if (typeof ref === "string" && normalizePageRef(ref, pathPrefix)) out.push({ ref, reason });
+      if (typeof ref === "string" && normalizePageRef(ref, pathPrefix)) out.push({ ref, access: nested });
     }
   }
-  for (const value of Object.values(object)) collectGatedReferences(value, reason, pathPrefix, out, depth + 1);
+  for (const value of Object.values(object)) collectReferenceAccess(value, nested, pathPrefix, out, depth + 1);
+}
+function withContainerAccess(object, context, walk2) {
+  const outer = context.access;
+  context.access = descendNavigationAccess(outer, navigationAccess(object));
+  try {
+    return walk2();
+  } finally {
+    context.access = outer;
+  }
 }
 function warnOnce(context, key, message) {
   if (context.warningKeys.has(key)) return;
@@ -4257,11 +4343,12 @@ function containerPresentation(value) {
   };
 }
 function registerReference(value, context) {
-  const withheld = context.gateReason ?? (context.limits.tooDeep ? "its navigation is too deeply nested to check access rules" : void 0);
-  if (withheld) {
-    if (normalizePageRef(value, context.pathPrefix)) context.gated.push({ ref: value, reason: withheld });
+  if (context.limits.tooDeep) {
+    const problem = "its navigation is too deeply nested to check access rules";
+    if (normalizePageRef(value, context.pathPrefix)) context.appearances.push({ ref: value, access: { ...context.access, problem } });
     return null;
   }
+  if (normalizePageRef(value, context.pathPrefix)) context.appearances.push({ ref: value, access: context.access });
   const localizedValue = context.locale ? mintlifyLocalizedReference(value, context.locale, context.defaultPageIds) : value;
   const navigationId = normalizePageRef(localizedValue, context.pathPrefix);
   if (!navigationId) return null;
@@ -4287,14 +4374,7 @@ function convertPage(value, context) {
   }
   const object = objectValue2(value);
   if (!object) return null;
-  const outerGate = context.gateReason;
-  const gate = navigationGateReason(object);
-  if (gate && !outerGate) context.gateReason = gate;
-  try {
-    return convertPageObject(object, context);
-  } finally {
-    context.gateReason = outerGate;
-  }
+  return withContainerAccess(object, context, () => convertPageObject(object, context));
 }
 function gatedSourceRef(repo, context) {
   if (!context.gatedSourceRefs.includes(repo)) context.gatedSourceRefs.push(repo);
@@ -4311,7 +4391,6 @@ function convertPageObject(object, context) {
   if (href && !object.pages && !object.groups) {
     const page = registerReference(href, context);
     if (page) return page;
-    if (context.gateReason) return null;
     warnOnce(
       context,
       "external-page-link",
@@ -4320,7 +4399,7 @@ function convertPageObject(object, context) {
     return null;
   }
   if (typeof object.sourceRef === "string") {
-    if (context.gateReason || context.gatedNodes.has(object) || context.limits.tooDeep) return gatedSourceRef(object.sourceRef, context);
+    if (isNavigationRestricted(context.access) || context.gatedNodes.has(object) || context.limits.tooDeep) return gatedSourceRef(object.sourceRef, context);
     const imported = context.resolveSourceRef?.(object.sourceRef);
     if (imported) return { group: object.sourceRef.split("/").pop() ?? object.sourceRef, pages: imported };
     const where = context.groupLabel ? `the "${context.groupLabel}" navigation group` : "the navigation";
@@ -4344,7 +4423,7 @@ function convertPageObject(object, context) {
       for (const page of pages) {
         const pageObject = objectValue2(page);
         const sourceRef = pageObject?.sourceRef;
-        const imported = typeof sourceRef === "string" && !context.gateReason && !navigationGateReason(pageObject) && !context.gatedNodes.has(pageObject) && !context.limits.tooDeep ? context.resolveSourceRef?.(sourceRef) : null;
+        const imported = typeof sourceRef === "string" && !isNavigationRestricted(context.access) && !navigationGateReason(pageObject) && !context.gatedNodes.has(pageObject) && !context.limits.tooDeep ? context.resolveSourceRef?.(sourceRef) : null;
         if (imported) {
           children.push(...imported);
           continue;
@@ -4462,15 +4541,7 @@ function convertContainerToTabs(containerValue, context, fallbackTab, trace, dep
           ...object.hidden === true ? { hidden: true } : {}
         }];
       }
-      const outerGate = context.gateReason;
-      const gate = navigationGateReason(object);
-      if (gate && !outerGate) context.gateReason = gate;
-      let nested;
-      try {
-        nested = convertContainerToTabs(object, context, tab, trace, depth + 1);
-      } finally {
-        context.gateReason = outerGate;
-      }
+      const nested = withContainerAccess(object, context, () => convertContainerToTabs(object, context, tab, trace, depth + 1));
       if (nested.length > 0) {
         if (nested.length === 1) {
           return [{
@@ -4844,10 +4915,11 @@ function projectMintlifyNavigation(config, options = {}) {
   const references = [];
   const seenReferences = /* @__PURE__ */ new Set();
   const warningKeys = /* @__PURE__ */ new Set();
-  const gated = [];
+  const appearances = [];
   const gatedSourceRefs = [];
   const gatedNodes = /* @__PURE__ */ new Map();
   const navigation = objectValue2(config.navigation) ?? config;
+  const rootAccess = descendNavigationAccess(OPEN_NAVIGATION_ACCESS, navigationAccess(navigation));
   const limits = { tooDeep: false };
   collectGatedSourceRefs(navigation, void 0, gatedNodes, limits);
   if (limits.tooDeep) {
@@ -4896,7 +4968,8 @@ function projectMintlifyNavigation(config, options = {}) {
         seenReferences,
         warnings,
         warningKeys,
-        gated,
+        appearances,
+        access: descendNavigationAccess(rootAccess, navigationAccess(language)),
         gatedSourceRefs,
         gatedNodes,
         limits
@@ -4916,7 +4989,7 @@ function projectMintlifyNavigation(config, options = {}) {
     }
     if (Object.keys(localizedNavigation).length > 0) i18n.navigation = localizedNavigation;
   } else {
-    const context = { references, seenReferences, warnings, warningKeys, gated, gatedSourceRefs, gatedNodes, limits, pathPrefix: options.pathPrefix, resolveSourceRef: options.resolveSourceRef };
+    const context = { references, seenReferences, warnings, warningKeys, appearances, access: rootAccess, gatedSourceRefs, gatedNodes, limits, pathPrefix: options.pathPrefix, resolveSourceRef: options.resolveSourceRef };
     tabs = convertContainerToTabs(navigation, context, "Documentation", projectionTrace);
     if (tabs.length === 0 && Array.isArray(config.navigation)) {
       const children = convertNavigationValues(config.navigation, context);
@@ -4996,7 +5069,7 @@ function projectMintlifyNavigation(config, options = {}) {
       ...typeof redirect.permanent === "boolean" ? { permanent: redirect.permanent } : {}
     }];
   }) : [];
-  collectGatedReferences(navigation, void 0, options.pathPrefix, gated);
+  collectReferenceAccess(navigation, OPEN_NAVIGATION_ACCESS, options.pathPrefix, appearances);
   return {
     docsConfig: {
       tabs,
@@ -5011,7 +5084,7 @@ function projectMintlifyNavigation(config, options = {}) {
       ...redirects.length > 0 ? { redirects } : {}
     },
     pageReferences: references,
-    gatedReferences: gated,
+    referenceAccess: appearances,
     gatedSourceRefs,
     warnings
   };
@@ -8567,7 +8640,7 @@ function flattenTabs(config) {
   });
 }
 function withheldNotSaved(message) {
-  return message.replace(/ and saved under migration-quarantine\/ \(local only[^)]*\)/g, " (not saved)").replace(/ and saved under migration-quarantine\/assets\//g, " (not saved)").replace(/, so it was NOT published and was not saved under migration-quarantine\/;/g, ", so it was NOT published and is not saved;").replace(/, so it was not copied to migration-quarantine\/;/g, ", so it is not saved;").replace(/The original is saved at migration-quarantine\/[^;]*;/g, "It is withheld from the site (not saved);").replace(/; review migration-quarantine\/assets\/ and copy any that published pages need\./g, "; they are withheld from the site (not saved).").replace(/Copy any that published pages need from migration-quarantine\/assets\/ into public\/ by hand\./g, "They are withheld from the site (not saved); recover any that published pages need from the referenced repository.").replace(/migration-quarantine\/\S*/g, "withheld from the site (not saved)");
+  return message.replace(/ and saved under migration-quarantine\/ \(local only[^)]*\)/g, " (not saved)").replace(/ and saved under migration-quarantine\/assets\//g, " (not saved)").replace(/; they are saved under migration-quarantine\/assets\/\. Copy them into public\/ manually if they may be public, or/g, "; they are withheld from the site (not saved). Recover any that may be public from the referenced repository, or").replace(/, so it was NOT published and was not saved under migration-quarantine\/;/g, ", so it was NOT published and is not saved;").replace(/, so it was not copied to migration-quarantine\/;/g, ", so it is not saved;").replace(/The original is saved at migration-quarantine\/[^;]*;/g, "It is withheld from the site (not saved);").replace(/; review migration-quarantine\/assets\/ and copy any that published pages need\./g, "; they are withheld from the site (not saved).").replace(/Copy any that published pages need from migration-quarantine\/assets\/ into public\/ by hand\./g, "They are withheld from the site (not saved); recover any that published pages need from the referenced repository.").replace(/migration-quarantine\/\S*/g, "withheld from the site (not saved)");
 }
 function empty(mapping, message) {
   return { ...mapping, pages: [], assets: [], navigation: [], warnings: [{ code: "skipped-file", message: `sourceRef ${mapping.repo} was not imported: ${message}` }] };
@@ -9949,6 +10022,9 @@ function readFrontmatterHead(path) {
     closeSync(fd);
   }
 }
+function ownRestrictionReason(access) {
+  return access.problem ?? (access.groups?.length ? "frontmatter `groups`" : "frontmatter `public: false`");
+}
 function canonicalPath(path) {
   try {
     return realpathSync3.native(path);
@@ -9956,11 +10032,15 @@ function canonicalPath(path) {
     return path;
   }
 }
-function pageHeadGateReason(raw) {
+function pageHeadAccess(raw) {
   const parsed = parseFrontmatter(raw);
-  const unreadable = parsed.error && /^(groups|public)\s*:/m.test(raw.slice(0, raw.length - parsed.content.length)) ? "frontmatter could not be parsed and declares `groups` or `public`" : void 0;
+  const unreadable = parsed.error && /^(groups|public)\s*:/m.test(raw.slice(0, raw.length - parsed.content.length));
   const openapi = typeof parsed.data.openapi === "string" ? parsed.data.openapi.trim() : void 0;
-  return { reason: frontmatterGateReason(parsed.data) ?? unreadable, publicTrue: isPublicTrue(parsed.data.public), openapi };
+  const access = unreadable ? { problem: "frontmatter could not be parsed and declares `groups` or `public`" } : frontmatterAccess(parsed.data);
+  return { access, openapi };
+}
+function describeRestriction(access) {
+  return access.groups?.length ? `restricted to groups ${access.groups.join(", ")}` : "`public: false`";
 }
 function withoutFrontmatter(value) {
   return value.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "").trim();
@@ -10818,7 +10898,7 @@ function migrateRepository(options) {
   const referenceOrder = /* @__PURE__ */ new Map();
   let docusaurusSidebars = null;
   let mintlifyConfig = null;
-  const mintlifyGatedRefs = /* @__PURE__ */ new Map();
+  const mintlifyNavigationAccess = /* @__PURE__ */ new Map();
   let fernRawConfig = null;
   let fernBasePath = "";
   let fernVersionPath = "";
@@ -10859,9 +10939,11 @@ function migrateRepository(options) {
         docsConfig = projected.docsConfig;
         warnings.push(...projected.warnings);
         for (const repo of projected.gatedSourceRefs) gatedSourceRepos.add(repo.toLowerCase());
-        for (const gated of projected.gatedReferences) {
-          const gatedKey = normalizedReferenceKey(gated.ref).toLowerCase();
-          if (!mintlifyGatedRefs.has(gatedKey)) mintlifyGatedRefs.set(gatedKey, gated.reason);
+        for (const appearance of projected.referenceAccess) {
+          const accessKey = normalizedReferenceKey(appearance.ref).toLowerCase();
+          const known = mintlifyNavigationAccess.get(accessKey);
+          if (known) known.push(appearance.access);
+          else mintlifyNavigationAccess.set(accessKey, [appearance.access]);
         }
         for (const [index, reference] of projected.pageReferences.entries()) {
           const key = normalizedReferenceKey(reference.ref);
@@ -10985,6 +11067,7 @@ function migrateRepository(options) {
   const docusaurusDocCardRoutes = /* @__PURE__ */ new Set();
   const seenPageIds = /* @__PURE__ */ new Set();
   const quarantinedFiles = [];
+  const restrictedPages = /* @__PURE__ */ new Set();
   const withheldAssetPaths = /* @__PURE__ */ new Set();
   const publishedExact = /* @__PURE__ */ new Set();
   const publishedLoose = /* @__PURE__ */ new Set();
@@ -10998,19 +11081,21 @@ function migrateRepository(options) {
   const withheldPaths = /* @__PURE__ */ new Set();
   const isDocFile = (file) => [".md", ".mdx"].includes(extname6(file.relativePath).toLowerCase());
   const isGateCandidate = (file) => isDocFile(file) && !file.relativePath.split("/").some((segment) => SNIPPET_DIRECTORIES.has(segment.toLowerCase()));
+  const navigationAccessFor = (relativePath) => mergeNavigationAppearances(mintlifyNavigationAccess.get(normalizedReferenceKey(relativePath).toLowerCase()) ?? []);
   const classifyPageGate = (file) => {
-    let head = { publicTrue: false };
-    let unreadableGate;
+    let head;
     try {
       const size = lstatSync6(file.absolutePath).size;
       const raw = readFrontmatterHead(file.absolutePath) ?? (size > MAX_PAGE_BYTES ? void 0 : readFileSync6(file.absolutePath, "utf8"));
       if (raw === void 0) throw new Error("frontmatter is not terminated within the bounded read");
-      head = pageHeadGateReason(raw);
+      head = pageHeadAccess(raw);
     } catch {
-      unreadableGate = "frontmatter could not be read";
+      head = { access: { problem: "frontmatter could not be read" } };
     }
-    const reason = head.reason ?? unreadableGate ?? mintlifyGatedRefs.get(normalizedReferenceKey(file.relativePath).toLowerCase());
-    return { reason, publicTrue: head.publicTrue, openapi: head.openapi };
+    const verdict = resolvePageAccess(head.access, navigationAccessFor(file.relativePath));
+    if (verdict.problem) return { reason: verdict.problem, quarantineReason: verdict.problem, openapi: head.openapi };
+    const access = verdict.access ?? {};
+    return { ...isRestrictedAccess(access) ? { reason: describeRestriction(access) } : {}, access, openapi: head.openapi };
   };
   const keptFiles = new Set(files);
   const droppedGatedFiles = [];
@@ -11026,7 +11111,7 @@ function migrateRepository(options) {
       }
       if (!isGateCandidate(file)) continue;
       const verdict = classifyPageGate(file);
-      gateByPath.set(file.absolutePath, { reason: verdict.reason, publicTrue: verdict.publicTrue });
+      gateByPath.set(file.absolutePath, verdict);
       if (verdict.openapi) (verdict.reason ? withheldSpecRefs : publishedSpecRefs).push(verdict.openapi);
       if (verdict.reason) withheldPaths.add(file.absolutePath);
     }
@@ -11074,10 +11159,12 @@ function migrateRepository(options) {
     } catch {
       return { kind: "unreadable", reason: "could not be read" };
     }
-    const gated = head === void 0 ? void 0 : pageHeadGateReason(head).reason;
-    if (gated) return { kind: inSnippetDirectory ? "snippet-gated" : "gated", reason: gated };
-    const navigationGated = inSnippetDirectory ? void 0 : mintlifyGatedRefs.get(normalizedReferenceKey(shown).toLowerCase());
-    if (navigationGated) return { kind: "gated", reason: navigationGated };
+    const own2 = head === void 0 ? void 0 : pageHeadAccess(head).access;
+    if (own2 && isRestrictedAccess(own2)) return { kind: inSnippetDirectory ? "snippet-gated" : "gated", reason: ownRestrictionReason(own2) };
+    if (!inSnippetDirectory) {
+      const navigation = navigationAccessFor(shown);
+      if (isNavigationRestricted(navigation)) return { kind: "gated", reason: navigation.problem ?? "its navigation container restricts it" };
+    }
     if (head !== void 0 && parseFrontmatter(head).error) return { kind: "unreadable", reason: "frontmatter could not be parsed" };
     if (lstatSync6(candidate).size > MAX_PAGE_BYTES) return { kind: "oversized", reason: "over 2 MB" };
     return head === void 0 ? { kind: "unreadable", reason: "frontmatter not terminated in the bounded read" } : void 0;
@@ -11192,10 +11279,11 @@ function migrateRepository(options) {
       continue;
     }
     const key = normalizedReferenceKey(file.relativePath);
+    let pageGate;
     if (platform === "mintlify") {
-      const gate = gateByPath.get(file.absolutePath);
-      if (gate?.publicTrue) sawPublicTrue = true;
-      const gateReason = gate?.reason;
+      pageGate = gateByPath.get(file.absolutePath);
+      if (pageGate?.access?.isPublic === true) sawPublicTrue = true;
+      const gateReason = pageGate?.quarantineReason;
       if (gateReason) {
         skipped++;
         if (file.relativePath.split("/").some((segment) => segment === "..")) {
@@ -11222,12 +11310,24 @@ function migrateRepository(options) {
         }
         warnings.push({
           code: "gated-page",
-          message: `Access-restricted on the source site (${gateReason}), so it was NOT published. The original is saved at ${QUARANTINE_DIRECTORY}/${file.relativePath}; links from other pages to it will break.`,
+          message: `Access-restricted on the source site, but its access rules could not be migrated safely (${gateReason}), so it was NOT published. Fix the rules in the original, saved at ${QUARANTINE_DIRECTORY}/${file.relativePath}, and move it into src/content/; until then links from other pages to it will break.`,
           source: file.relativePath
         });
         continue;
       }
+      if (pageGate?.reason && mintlifyProjectRoot) {
+        try {
+          rewriteRepositoryAssetLinks(
+            inlineMdxSnippets(readFileSync6(file.absolutePath, "utf8"), file.absolutePath, repositoryDir, [], 0, mintlifyProjectRoot, snippetAliases, inlineGate),
+            file.absolutePath,
+            mintlifyProjectRoot,
+            withholdAsset
+          );
+        } catch {
+        }
+      }
     }
+    const isRestrictedPage = Boolean(pageGate?.reason);
     const referenced = exactReferenceMap.get(exactReferenceKey(file.relativePath)) ?? referenceMap.get(key);
     let locale = referenced?.locale;
     let navigationId = referenced?.navigationId ?? pageIdFromReference(file.relativePath, platform === "mintlify");
@@ -11257,7 +11357,7 @@ function migrateRepository(options) {
       snippetAliases,
       inlineGate
     );
-    const publishedText = trackPublishedRefs ? raw : void 0;
+    const publishedText = trackPublishedRefs && !isRestrictedPage ? raw : void 0;
     const pageAssetReferences = [];
     if (platform === "fern" || platform === "mintlify" || platform === "docusaurus") {
       raw = normalizeExplicitHeadingIds(
@@ -11350,7 +11450,8 @@ function migrateRepository(options) {
     if (platform === "fern" && fernHiddenIds.has(navigationId)) page.hidden = true;
     if (platform === "mintlify" && mintlifyProjectRoot) {
       page.body = rewriteRepositoryAssetLinks(page.body, file.absolutePath, mintlifyProjectRoot, (assetPath, onDiskSpelling) => {
-        pageAssetReferences.push(publicAssetKey(onDiskSpelling ?? assetPath));
+        if (isRestrictedPage) withholdAsset(assetPath, onDiskSpelling);
+        else pageAssetReferences.push(publicAssetKey(onDiskSpelling ?? assetPath));
       }, (spelled, used) => {
         warnings.push({ code: "unsupported-config", message: `"${spelled}" was not found beside this page; the file "${used}" in the site root was used instead and will be published.`, source: file.relativePath });
       });
@@ -11437,7 +11538,10 @@ function migrateRepository(options) {
       continue;
     }
     seenPageIds.add(page.id);
+    if (pageGate?.access?.groups) page.groups = pageGate.access.groups;
+    if (pageGate?.access?.isPublic !== void 0) page.public = pageGate.access.isPublic;
     pages.push(page);
+    if (isRestrictedPage) restrictedPages.add(page);
     for (const assetPath of pageAssetReferences) addAssetReference(assetPath, file.relativePath);
     if (publishedText !== void 0) addPathReferences(publishedText, posix4.dirname(file.relativePath).replace(/^\.$/, ""), publishedExact, publishedLoose);
     if (hasDocusaurusDocCardList) {
@@ -11533,7 +11637,9 @@ function migrateRepository(options) {
       try {
         rootNavbarButtons = navbarLinkButtons(css);
         rootStyleProjection = projectAuthoredStyles(css, [
-          ...pages.map((page) => page.body),
+          // Restricted pages' markup must not keep a rule (and the image its
+          // url() names) public; rules only they use are dropped.
+          ...pages.filter((page) => !restrictedPages.has(page)).map((page) => page.body),
           ...(componentMigrator?.files() ?? []).map((file) => typeof file.content === "string" ? file.content : ""),
           // Site-wide scripts build markup of their own (a CTA card, say) that the stylesheet is meant for.
           ...files.filter((file) => isMintlifyServedScriptOrStyle(file.relativePath) && extname6(file.relativePath).toLowerCase() === ".js" && lstatSync6(file.absolutePath).size <= MAX_PAGE_BYTES).map((file) => readFileSync6(file.absolutePath, "utf8"))
@@ -11866,7 +11972,7 @@ function migrateRepository(options) {
       warnings.push({ code: "gated-page", message: sharedSpecMessage(path, excluded), source: path });
     };
     const keptSpecRefs = [...publishedSpecRefs, ...navigationOperationRefs(mintlifyConfig)];
-    const allSpecs = resolveMintlifyApiSpecs(mintlifyConfig, files, warnings, remoteApiSpecs, pages);
+    const allSpecs = resolveMintlifyApiSpecs(mintlifyConfig, files, warnings, remoteApiSpecs, pages.filter((page) => !restrictedPages.has(page)));
     for (const remote of remoteApiSpecs) {
       const { withheld, kept } = withheldOperationKeys({ sourcePath: remote.url, filename: remote.url }, withheldSpecRefs, keptSpecRefs);
       if (withheld.length > 0) {
@@ -12360,8 +12466,15 @@ ${reasons.map((reason) => `- ${reason}`).join("\n")}` : "No importable Markdown
   });
   if (platform === "mintlify") {
     docsConfig = { ...docsConfig, markdown: { enabled: true } };
+    if (restrictedPages.size > 0) {
+      const apiNote = [...restrictedPages].some((page) => page.openapi) ? " API operations documented only on restricted pages were withheld from the published OpenAPI spec (specs are not access-controlled), so those pages do not render their endpoint until you restore the operation." : "";
+      warnings.push({
+        code: "gated-page",
+        message: `${restrictedPages.size} page(s) are restricted with \`groups\`/\`public: false\`. Thally hides them from everyone until you configure reader authentication in docs.json \`auth\` (see /guides/authenticated-docs).${apiNote}`
+      });
+    }
     if (quarantinedPageCount > 0 || withheldAssetCount > 0 || unreferencedAssetCount > 0) {
-      const assetNote = withheldAssetCount > 0 ? `${withheldAssetCount} file(s) used only by access-restricted pages were kept out of public/ and saved under ${QUARANTINE_DIRECTORY}/assets/. ` : "";
+      const assetNote = withheldAssetCount > 0 ? `${withheldAssetCount} file(s) used only by access-restricted pages were not copied to public/, because public/ is not access-controlled; they are saved under ${QUARANTINE_DIRECTORY}/assets/. Copy them into public/ manually if they may be public, or the restricted pages will show them broken. ` : "";
       const unreferencedReason = [
         ...hasWithheldContent ? ["this site has access-restricted content"] : [],
         ...pagesNotClassified ? ["pages were dropped by the file limit (or the file scan stopped at its cap) and could not all be checked for access restrictions"] : []
@@ -12369,12 +12482,12 @@ ${reasons.map((reason) => `- ${reason}`).join("\n")}` : "No importable Markdown
       const unreferencedNote = unreferencedAssetCount > 0 ? `${unreferencedAssetCount} unreferenced asset(s) were kept out of public/ because ${unreferencedReason}; review ${QUARANTINE_DIRECTORY}/assets/ and copy any that published pages need. ` : "";
       warnings.push({
         code: "gated-page",
-        message: (quarantinedPageCount > 0 ? `${quarantinedPageCount} access-restricted page(s) were withheld from the published site and saved under ${QUARANTINE_DIRECTORY}/ (local only: git-ignored, never served or deployed). ` : "") + assetNote + unreferencedNote + "Assets that published pages also use are still copied to public/. Review them before deciding how to publish or protect that content."
+        message: (quarantinedPageCount > 0 ? `${quarantinedPageCount} access-restricted page(s) whose access rules could not be migrated safely were withheld from the published site and saved under ${QUARANTINE_DIRECTORY}/ (local only: git-ignored, never served or deployed). ` : "") + assetNote + unreferencedNote + "Assets that published pages also use are still copied to public/. Review them before deciding how to publish or protect that content."
       });
     }
     warnings.push({
       code: "gated-page",
-      message: (sawPublicTrue ? "Some pages set `public: true`, which means the source site used Mintlify authentication and every page WITHOUT it was private. " : "") + "Access control set in the Mintlify dashboard is not visible in the repository. Check the source site's dashboard access settings before publishing: Thally will publish ALL imported pages publicly. Confirm nothing here was meant to stay private before deploying."
+      message: (sawPublicTrue ? "Some pages set `public: true`, which means the source site used Mintlify authentication and every page WITHOUT it was private. " : "") + "Access control set in the Mintlify dashboard is not visible in the repository. Check the source site's dashboard access settings before publishing: until docs.json `auth` is configured, Thally publishes every imported page that has no `groups` or `public: false` to everyone. Confirm nothing here was meant to stay private before deploying."
     });
   }
   if (fernRawConfig?.logo && !logoLight && !logo.light) warnings.push({
@@ -12438,6 +12551,10 @@ function renderPage(bundle, page) {
     page.mode ? `mode: ${yamlString(page.mode)}` : null,
     page.hidden ? "hidden: true" : null,
     page.noindex ? "noindex: true" : null,
+    // Group names must match identity-provider claims exactly, so they are
+    // quoted as-is rather than whitespace-collapsed like display strings.
+    page.groups?.length ? `groups: [${page.groups.map((group) => JSON.stringify(group)).join(", ")}]` : null,
+    page.public !== void 0 ? `public: ${page.public ? "true" : "false"}` : null,
     ...Object.entries(page.meta ?? {}).map(([field, value]) => `${field}: ${yamlString(value)}`),
     page.openapi ? `openapi: ${yamlString(page.openapi)}` : null,
     page.api ? `api: ${yamlString(page.api)}` : null,