doccupine 0.0.93 → 0.0.94

package/dist/templates/app/robots.js

@@ -3,6 +3,16 @@ export const robotsTemplate = (hasSiteUrl) => {
         return `import type { MetadataRoute } from "next";
 
 export default function robots(): MetadataRoute.Robots {
+  // When the site is password protected, keep every crawler out entirely.
+  if (process.env.SITE_PASSWORD) {
+    return {
+      rules: {
+        userAgent: "*",
+        disallow: "/",
+      },
+    };
+  }
+
   return {
     rules: {
       userAgent: "*",
@@ -22,6 +32,17 @@ function resolveBaseUrl(): string | null {
 }
 
 export default function robots(): MetadataRoute.Robots {
+  // When the site is password protected, keep every crawler out entirely and
+  // don't advertise the sitemap.
+  if (process.env.SITE_PASSWORD) {
+    return {
+      rules: {
+        userAgent: "*",
+        disallow: "/",
+      },
+    };
+  }
+
   const base = resolveBaseUrl();
   const rules: MetadataRoute.Robots = {
     rules: {

package/dist/templates/app/sitemap.js

@@ -18,13 +18,7 @@ export const sitemapTemplate = (entries) => {
 import { config } from "@/utils/config";
 
 type ChangeFrequency =
-  | "always"
-  | "hourly"
-  | "daily"
-  | "weekly"
-  | "monthly"
-  | "yearly"
-  | "never";
+  "always" | "hourly" | "daily" | "weekly" | "monthly" | "yearly" | "never";
 
 interface Entry {
   slug: string;

package/dist/templates/components/layout/Button.d.ts

@@ -1 +1 @@
-export declare const buttonTemplate = "\"use client\";\nimport Link from \"next/link\";\nimport styled from \"styled-components\";\nimport {\n  theme as localTheme,\n  ButtonProps,\n  buttonStyles,\n} from \"cherry-styled-components\";\nimport { Icon } from \"@/components/layout/Icon\";\n\ninterface LinkButtonProps extends ButtonProps {\n  href?: string;\n  target?: \"_blank\" | \"_self\" | \"_parent\" | \"_top\";\n  rel?: string;\n  variant?: \"primary\" | \"secondary\" | \"tertiary\";\n  size?: \"default\" | \"big\";\n  outline?: boolean;\n  fullWidth?: boolean;\n  icon?: string;\n  iconPosition?: \"left\" | \"right\";\n  theme?: typeof localTheme;\n}\n\n// Cherry's buttonStyles picks filled-button text via `isDark ? colors.dark : colors.light`.\n// Our theme's isDark is a stub (false) because mode switching lives in CSS vars, so\n// the fallback resolves to --color-light (black in dark mode). Re-pin to `surface`,\n// which resolves to white in both modes, for the filled, non-disabled case.\nconst StyledLinkButton = styled(Link)<LinkButtonProps>`\n  ${({ theme, $variant, $size, $outline, $fullWidth, disabled }) =>\n    buttonStyles(theme, $variant, $size, $outline, $fullWidth, disabled)}\n\n  ${({ theme, $outline, disabled }) =>\n    !disabled && !$outline && `color: ${theme.colors.surface};`}\n\n  & p {\n    color: inherit !important;\n  }\n\n  & svg.lucide {\n    margin: auto 0;\n    min-width: min-content;\n    color: inherit;\n  }\n`;\n\nconst ButtonBase = styled.button<ButtonProps>`\n  ${({ theme, $variant, $size, $outline, $fullWidth, disabled }) =>\n    buttonStyles(theme, $variant, $size, $outline, $fullWidth, disabled)}\n\n  ${({ theme, $outline, disabled }) =>\n    !disabled && !$outline && `color: ${theme.colors.surface};`}\n\n  & p {\n    color: inherit !important;\n  }\n\n  & svg.lucide {\n    margin: auto 0;\n    min-width: min-content;\n    color: inherit;\n  }\n`;\n\nfunction Button({\n  variant = \"primary\",\n  size,\n  outline,\n  fullWidth,\n  icon,\n  iconPosition = \"left\",\n  theme: _theme = localTheme,\n  href,\n  target,\n  rel,\n  ...props\n}: LinkButtonProps) {\n  const isExternal = typeof href === \"string\" && /^(https?:)?\\/\\//i.test(href);\n  const resolvedTarget = target ?? (isExternal ? \"_blank\" : undefined);\n  const resolvedRel =\n    rel ?? (resolvedTarget === \"_blank\" ? \"noopener noreferrer\" : undefined);\n  return href ? (\n    <div>\n      <StyledLinkButton\n        {...props}\n        href={href}\n        target={resolvedTarget}\n        rel={resolvedRel}\n        $variant={variant}\n        $size={size}\n        $outline={outline}\n        $fullWidth={fullWidth}\n      >\n        {iconPosition === \"left\" && icon && <Icon name={icon} size={16} />}\n        {props.children}\n        {iconPosition === \"right\" && icon && <Icon name={icon} size={16} />}\n      </StyledLinkButton>\n    </div>\n  ) : (\n    <div>\n      <ButtonBase\n        {...props}\n        $variant={variant}\n        $size={size}\n        $outline={outline}\n        $fullWidth={fullWidth}\n      >\n        {iconPosition === \"left\" && icon && <Icon name={icon} size={16} />}\n        {props.children}\n        {iconPosition === \"right\" && icon && <Icon name={icon} size={16} />}\n      </ButtonBase>\n    </div>\n  );\n}\n\nexport { Button };\n";
+export declare const buttonTemplate = "\"use client\";\nimport Link from \"next/link\";\nimport styled from \"styled-components\";\nimport {\n  theme as localTheme,\n  ButtonProps,\n  buttonStyles,\n} from \"cherry-styled-components\";\nimport { Icon } from \"@/components/layout/Icon\";\n\ninterface LinkButtonProps extends ButtonProps {\n  href?: string;\n  target?: \"_blank\" | \"_self\" | \"_parent\" | \"_top\";\n  rel?: string;\n  variant?: \"primary\" | \"secondary\" | \"tertiary\";\n  size?: \"default\" | \"big\";\n  outline?: boolean;\n  fullWidth?: boolean;\n  icon?: string;\n  iconPosition?: \"left\" | \"right\";\n  theme?: typeof localTheme;\n}\n\n// Cherry's buttonStyles picks filled-button text via `isDark ? colors.dark : colors.light`.\n// Our theme's isDark is a stub (false) because mode switching lives in CSS vars, so\n// the fallback resolves to --color-light (black in dark mode). Re-pin to `surface`,\n// which resolves to white in both modes, for the filled, non-disabled case.\nconst StyledLinkButton = styled(Link)<LinkButtonProps>`\n  ${({ theme, $variant, $size, $outline, $fullWidth, $error, disabled }) =>\n    buttonStyles(\n      theme,\n      $variant,\n      $size,\n      $outline,\n      $fullWidth,\n      $error,\n      disabled,\n    )}\n\n  ${({ theme, $outline, disabled }) =>\n    !disabled && !$outline && `color: ${theme.colors.surface};`}\n\n  & p {\n    color: inherit !important;\n  }\n\n  & svg.lucide {\n    margin: auto 0;\n    min-width: min-content;\n    color: inherit;\n  }\n`;\n\nconst ButtonBase = styled.button<ButtonProps>`\n  ${({ theme, $variant, $size, $outline, $fullWidth, $error, disabled }) =>\n    buttonStyles(\n      theme,\n      $variant,\n      $size,\n      $outline,\n      $fullWidth,\n      $error,\n      disabled,\n    )}\n\n  ${({ theme, $outline, disabled }) =>\n    !disabled && !$outline && `color: ${theme.colors.surface};`}\n\n  & p {\n    color: inherit !important;\n  }\n\n  & svg.lucide {\n    margin: auto 0;\n    min-width: min-content;\n    color: inherit;\n  }\n`;\n\nfunction Button({\n  variant = \"primary\",\n  size,\n  outline,\n  fullWidth,\n  icon,\n  iconPosition = \"left\",\n  theme: _theme = localTheme,\n  href,\n  target,\n  rel,\n  ...props\n}: LinkButtonProps) {\n  const isExternal = typeof href === \"string\" && /^(https?:)?\\/\\//i.test(href);\n  const resolvedTarget = target ?? (isExternal ? \"_blank\" : undefined);\n  const resolvedRel =\n    rel ?? (resolvedTarget === \"_blank\" ? \"noopener noreferrer\" : undefined);\n  return href ? (\n    <div>\n      <StyledLinkButton\n        {...props}\n        href={href}\n        target={resolvedTarget}\n        rel={resolvedRel}\n        $variant={variant}\n        $size={size}\n        $outline={outline}\n        $fullWidth={fullWidth}\n      >\n        {iconPosition === \"left\" && icon && <Icon name={icon} size={16} />}\n        {props.children}\n        {iconPosition === \"right\" && icon && <Icon name={icon} size={16} />}\n      </StyledLinkButton>\n    </div>\n  ) : (\n    <div>\n      <ButtonBase\n        {...props}\n        $variant={variant}\n        $size={size}\n        $outline={outline}\n        $fullWidth={fullWidth}\n      >\n        {iconPosition === \"left\" && icon && <Icon name={icon} size={16} />}\n        {props.children}\n        {iconPosition === \"right\" && icon && <Icon name={icon} size={16} />}\n      </ButtonBase>\n    </div>\n  );\n}\n\nexport { Button };\n";

package/dist/templates/components/layout/Button.js

@@ -26,8 +26,16 @@ interface LinkButtonProps extends ButtonProps {
 // the fallback resolves to --color-light (black in dark mode). Re-pin to \`surface\`,
 // which resolves to white in both modes, for the filled, non-disabled case.
 const StyledLinkButton = styled(Link)<LinkButtonProps>\`
-  \${({ theme, $variant, $size, $outline, $fullWidth, disabled }) =>
-    buttonStyles(theme, $variant, $size, $outline, $fullWidth, disabled)}
+  \${({ theme, $variant, $size, $outline, $fullWidth, $error, disabled }) =>
+    buttonStyles(
+      theme,
+      $variant,
+      $size,
+      $outline,
+      $fullWidth,
+      $error,
+      disabled,
+    )}
 
   \${({ theme, $outline, disabled }) =>
     !disabled && !$outline && \`color: \${theme.colors.surface};\`}
@@ -44,8 +52,16 @@ const StyledLinkButton = styled(Link)<LinkButtonProps>\`
 \`;
 
 const ButtonBase = styled.button<ButtonProps>\`
-  \${({ theme, $variant, $size, $outline, $fullWidth, disabled }) =>
-    buttonStyles(theme, $variant, $size, $outline, $fullWidth, disabled)}
+  \${({ theme, $variant, $size, $outline, $fullWidth, $error, disabled }) =>
+    buttonStyles(
+      theme,
+      $variant,
+      $size,
+      $outline,
+      $fullWidth,
+      $error,
+      disabled,
+    )}
 
   \${({ theme, $outline, disabled }) =>
     !disabled && !$outline && \`color: \${theme.colors.surface};\`}

package/dist/templates/components/layout/SiteGate.d.ts

@@ -0,0 +1 @@
+export declare const siteGateComponentTemplate = "\"use client\";\nimport { Suspense, useState, type FormEvent } from \"react\";\nimport styled from \"styled-components\";\nimport { Input } from \"cherry-styled-components\";\nimport { Lock } from \"lucide-react\";\nimport { Theme } from \"@/app/theme\";\nimport { Button } from \"@/components/layout/Button\";\nimport { Callout } from \"@/components/layout/Callout\";\nimport {\n  ToggleTheme,\n  ToggleThemeLoading,\n} from \"@/components/layout/ThemeToggle\";\nimport { config } from \"@/utils/config\";\n\nconst StyledWrapper = styled.div<{ theme: Theme }>`\n  min-height: 100dvh;\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  padding: 20px;\n  background: ${({ theme }) => theme.colors.light};\n`;\n\nconst StyledInner = styled.div`\n  display: flex;\n  flex-direction: column;\n  align-items: center;\n  gap: 20px;\n  width: 100%;\n  max-width: 380px;\n`;\n\nconst StyledFooter = styled.div`\n  display: flex;\n  flex-direction: column;\n  align-items: center;\n  gap: 12px;\n`;\n\nconst StyledBranding = styled.p<{ theme: Theme }>`\n  margin: 0;\n  font-size: 14px;\n  color: ${({ theme }) => theme.colors.grayDark};\n\n  & a {\n    color: ${({ theme }) => theme.colors.accent};\n    font-weight: 700;\n    text-decoration: none;\n    transition: all 0.3s ease;\n  }\n\n  & a:hover {\n    color: ${({ theme }) => theme.colors.primary};\n  }\n`;\n\nconst StyledCard = styled.div<{ theme: Theme }>`\n  display: flex;\n  flex-direction: column;\n  align-items: center;\n  gap: 20px;\n  width: 100%;\n  padding: 40px 32px;\n  background: ${({ theme }) => theme.colors.light};\n  border: solid 1px ${({ theme }) => theme.colors.grayLight};\n  border-radius: ${({ theme }) => theme.spacing.radius.lg};\n  box-shadow: ${({ theme }) => theme.shadows.sm};\n  text-align: center;\n`;\n\nconst StyledIcon = styled.div<{ theme: Theme }>`\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 48px;\n  height: 48px;\n  border-radius: 50%;\n  color: ${({ theme }) => theme.colors.accent};\n  background: ${({ theme }) => theme.colors.grayLight};\n\n  & svg {\n    width: 22px;\n    height: 22px;\n  }\n`;\n\nconst StyledTitle = styled.h1<{ theme: Theme }>`\n  margin: 0;\n  font-size: 22px;\n  color: ${({ theme }) => theme.colors.accent};\n`;\n\nconst StyledLede = styled.p<{ theme: Theme }>`\n  margin: 0;\n  font-size: 15px;\n  color: ${({ theme }) => theme.colors.grayDark};\n`;\n\nconst StyledForm = styled.form`\n  display: flex;\n  flex-direction: column;\n  gap: 20px;\n  width: 100%;\n`;\n\nconst StyledAlert = styled.div`\n  width: 100%;\n  text-align: left;\n`;\n\nexport function SiteGate({ hideBranding }: { hideBranding?: boolean }) {\n  const [password, setPassword] = useState(\"\");\n  const [status, setStatus] = useState<\"idle\" | \"loading\" | \"error\">(\"idle\");\n\n  async function handleSubmit(event: FormEvent<HTMLFormElement>) {\n    event.preventDefault();\n    if (!password || status === \"loading\") return;\n\n    setStatus(\"loading\");\n    try {\n      const res = await fetch(\"/api/gate\", {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({ password }),\n      });\n      if (res.ok) {\n        window.location.reload();\n        return;\n      }\n      setStatus(\"error\");\n    } catch {\n      setStatus(\"error\");\n    }\n  }\n\n  return (\n    <StyledWrapper>\n      <StyledInner>\n        <StyledCard>\n          <StyledIcon>\n            <Lock />\n          </StyledIcon>\n          <StyledTitle>{config.name || \"Documentation\"}</StyledTitle>\n          <StyledLede>This site is password protected.</StyledLede>\n          <StyledForm onSubmit={handleSubmit} noValidate>\n            <Input\n              type=\"password\"\n              name=\"password\"\n              autoComplete=\"current-password\"\n              placeholder=\"Enter password\"\n              aria-label=\"Password\"\n              autoFocus\n              value={password}\n              $error={status === \"error\"}\n              $fullWidth\n              onChange={(e) => {\n                setPassword(e.target.value);\n                if (status === \"error\") setStatus(\"idle\");\n              }}\n            />\n            <Button\n              type=\"submit\"\n              fullWidth\n              disabled={status === \"loading\" || !password}\n            >\n              {status === \"loading\" ? \"Unlocking...\" : \"Enter\"}\n            </Button>\n          </StyledForm>\n          {status === \"error\" && (\n            <StyledAlert>\n              <Callout type=\"danger\">\n                <p>Incorrect password. Try again.</p>\n              </Callout>\n            </StyledAlert>\n          )}\n        </StyledCard>\n        <StyledFooter>\n          <Suspense fallback={<ToggleThemeLoading />}>\n            <ToggleTheme />\n          </Suspense>\n          {!hideBranding && (\n            <StyledBranding>\n              Powered by <a href=\"https://doccupine.com\">Doccupine</a>\n            </StyledBranding>\n          )}\n        </StyledFooter>\n      </StyledInner>\n    </StyledWrapper>\n  );\n}\n";

package/dist/templates/components/layout/SiteGate.js

@@ -0,0 +1,191 @@
+export const siteGateComponentTemplate = `"use client";
+import { Suspense, useState, type FormEvent } from "react";
+import styled from "styled-components";
+import { Input } from "cherry-styled-components";
+import { Lock } from "lucide-react";
+import { Theme } from "@/app/theme";
+import { Button } from "@/components/layout/Button";
+import { Callout } from "@/components/layout/Callout";
+import {
+  ToggleTheme,
+  ToggleThemeLoading,
+} from "@/components/layout/ThemeToggle";
+import { config } from "@/utils/config";
+
+const StyledWrapper = styled.div<{ theme: Theme }>\`
+  min-height: 100dvh;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 20px;
+  background: \${({ theme }) => theme.colors.light};
+\`;
+
+const StyledInner = styled.div\`
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 20px;
+  width: 100%;
+  max-width: 380px;
+\`;
+
+const StyledFooter = styled.div\`
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 12px;
+\`;
+
+const StyledBranding = styled.p<{ theme: Theme }>\`
+  margin: 0;
+  font-size: 14px;
+  color: \${({ theme }) => theme.colors.grayDark};
+
+  & a {
+    color: \${({ theme }) => theme.colors.accent};
+    font-weight: 700;
+    text-decoration: none;
+    transition: all 0.3s ease;
+  }
+
+  & a:hover {
+    color: \${({ theme }) => theme.colors.primary};
+  }
+\`;
+
+const StyledCard = styled.div<{ theme: Theme }>\`
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 20px;
+  width: 100%;
+  padding: 40px 32px;
+  background: \${({ theme }) => theme.colors.light};
+  border: solid 1px \${({ theme }) => theme.colors.grayLight};
+  border-radius: \${({ theme }) => theme.spacing.radius.lg};
+  box-shadow: \${({ theme }) => theme.shadows.sm};
+  text-align: center;
+\`;
+
+const StyledIcon = styled.div<{ theme: Theme }>\`
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 48px;
+  height: 48px;
+  border-radius: 50%;
+  color: \${({ theme }) => theme.colors.accent};
+  background: \${({ theme }) => theme.colors.grayLight};
+
+  & svg {
+    width: 22px;
+    height: 22px;
+  }
+\`;
+
+const StyledTitle = styled.h1<{ theme: Theme }>\`
+  margin: 0;
+  font-size: 22px;
+  color: \${({ theme }) => theme.colors.accent};
+\`;
+
+const StyledLede = styled.p<{ theme: Theme }>\`
+  margin: 0;
+  font-size: 15px;
+  color: \${({ theme }) => theme.colors.grayDark};
+\`;
+
+const StyledForm = styled.form\`
+  display: flex;
+  flex-direction: column;
+  gap: 20px;
+  width: 100%;
+\`;
+
+const StyledAlert = styled.div\`
+  width: 100%;
+  text-align: left;
+\`;
+
+export function SiteGate({ hideBranding }: { hideBranding?: boolean }) {
+  const [password, setPassword] = useState("");
+  const [status, setStatus] = useState<"idle" | "loading" | "error">("idle");
+
+  async function handleSubmit(event: FormEvent<HTMLFormElement>) {
+    event.preventDefault();
+    if (!password || status === "loading") return;
+
+    setStatus("loading");
+    try {
+      const res = await fetch("/api/gate", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ password }),
+      });
+      if (res.ok) {
+        window.location.reload();
+        return;
+      }
+      setStatus("error");
+    } catch {
+      setStatus("error");
+    }
+  }
+
+  return (
+    <StyledWrapper>
+      <StyledInner>
+        <StyledCard>
+          <StyledIcon>
+            <Lock />
+          </StyledIcon>
+          <StyledTitle>{config.name || "Documentation"}</StyledTitle>
+          <StyledLede>This site is password protected.</StyledLede>
+          <StyledForm onSubmit={handleSubmit} noValidate>
+            <Input
+              type="password"
+              name="password"
+              autoComplete="current-password"
+              placeholder="Enter password"
+              aria-label="Password"
+              autoFocus
+              value={password}
+              $error={status === "error"}
+              $fullWidth
+              onChange={(e) => {
+                setPassword(e.target.value);
+                if (status === "error") setStatus("idle");
+              }}
+            />
+            <Button
+              type="submit"
+              fullWidth
+              disabled={status === "loading" || !password}
+            >
+              {status === "loading" ? "Unlocking..." : "Enter"}
+            </Button>
+          </StyledForm>
+          {status === "error" && (
+            <StyledAlert>
+              <Callout type="danger">
+                <p>Incorrect password. Try again.</p>
+              </Callout>
+            </StyledAlert>
+          )}
+        </StyledCard>
+        <StyledFooter>
+          <Suspense fallback={<ToggleThemeLoading />}>
+            <ToggleTheme />
+          </Suspense>
+          {!hideBranding && (
+            <StyledBranding>
+              Powered by <a href="https://doccupine.com">Doccupine</a>
+            </StyledBranding>
+          )}
+        </StyledFooter>
+      </StyledInner>
+    </StyledWrapper>
+  );
+}
+`;

package/dist/templates/env.example.d.ts

@@ -1 +1 @@
-export declare const envExampleTemplate = "# Public Site URL\n# Used by sitemap.xml and robots.txt. Overrides `url` in config.json when set.\n# NEXT_PUBLIC_SITE_URL=https://docs.example.com\n\n# LLM Provider Configuration\n# Choose your preferred LLM provider: openai, anthropic, or google\nLLM_PROVIDER=openai\n\n# API Keys (set the one matching your provider)\nOPENAI_API_KEY=your_openai_api_key_here\nANTHROPIC_API_KEY=your_anthropic_api_key_here\nGOOGLE_API_KEY=your_google_api_key_here\n\n# Optional: Override default chat model\n# See available models at your provider's docs:\n#   OpenAI:    https://platform.openai.com/docs/models\n#   Anthropic: https://docs.anthropic.com/claude/docs/models-overview\n#   Google:    https://ai.google.dev/models/gemini\n# LLM_CHAT_MODEL=\n\n# Optional: Override default embedding model\n# See available embedding models at your provider's docs:\n#   OpenAI: https://platform.openai.com/docs/guides/embeddings\n#   Google: https://ai.google.dev/gemini-api/docs/embeddings\n# Note: Anthropic doesn't provide embeddings, will fallback to OpenAI\n# LLM_EMBEDDING_MODEL=\n\n# Optional: Set temperature (0-1, default: 0)\n# LLM_TEMPERATURE=0\n";
+export declare const envExampleTemplate = "# Public Site URL\n# Used by sitemap.xml and robots.txt. Overrides `url` in config.json when set.\n# NEXT_PUBLIC_SITE_URL=https://docs.example.com\n\n# Password Protection (optional)\n# Set a shared password to gate the whole site behind a login screen. When set,\n# pages require the password, the content APIs (chat + search) return 401\n# without it, and the site is hidden from search engines and crawlers. Leave\n# unset (or remove) to keep the site public.\n# SITE_PASSWORD=choose-a-strong-shared-password\n\n# LLM Provider Configuration\n# Choose your preferred LLM provider: openai, anthropic, or google\nLLM_PROVIDER=openai\n\n# API Keys (set the one matching your provider)\nOPENAI_API_KEY=your_openai_api_key_here\nANTHROPIC_API_KEY=your_anthropic_api_key_here\nGOOGLE_API_KEY=your_google_api_key_here\n\n# Optional: Override default chat model\n# See available models at your provider's docs:\n#   OpenAI:    https://platform.openai.com/docs/models\n#   Anthropic: https://docs.anthropic.com/claude/docs/models-overview\n#   Google:    https://ai.google.dev/models/gemini\n# LLM_CHAT_MODEL=\n\n# Optional: Override default embedding model\n# See available embedding models at your provider's docs:\n#   OpenAI: https://platform.openai.com/docs/guides/embeddings\n#   Google: https://ai.google.dev/gemini-api/docs/embeddings\n# Note: Anthropic doesn't provide embeddings, will fallback to OpenAI\n# LLM_EMBEDDING_MODEL=\n\n# Optional: Set temperature (0-1, default: 0)\n# LLM_TEMPERATURE=0\n";

package/dist/templates/env.example.js

@@ -2,6 +2,13 @@ export const envExampleTemplate = `# Public Site URL
 # Used by sitemap.xml and robots.txt. Overrides \`url\` in config.json when set.
 # NEXT_PUBLIC_SITE_URL=https://docs.example.com
 
+# Password Protection (optional)
+# Set a shared password to gate the whole site behind a login screen. When set,
+# pages require the password, the content APIs (chat + search) return 401
+# without it, and the site is hidden from search engines and crawlers. Leave
+# unset (or remove) to keep the site public.
+# SITE_PASSWORD=choose-a-strong-shared-password
+
 # LLM Provider Configuration
 # Choose your preferred LLM provider: openai, anthropic, or google
 LLM_PROVIDER=openai

package/dist/templates/lib/siteGate.d.ts

@@ -0,0 +1 @@
+export declare const siteGateTemplate = "/**\n * Shared site-gate crypto. The gate cookie never stores the password itself -\n * it stores HMAC-SHA256(key=SITE_PASSWORD, data=GATE_MESSAGE) as hex. Uses Web\n * Crypto (crypto.subtle) so the same helpers run in both the Edge middleware\n * (proxy.ts) and the Node route handler (app/api/gate/route.ts).\n */\nexport const GATE_COOKIE_NAME = \"doccupine_gate\";\n\n// Bump the suffix to invalidate every previously issued cookie at once.\nconst GATE_MESSAGE = \"doccupine-gate-v1\";\n\nasync function hmacHex(key: string, data: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const cryptoKey = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(key),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = await crypto.subtle.sign(\n    \"HMAC\",\n    cryptoKey,\n    encoder.encode(data),\n  );\n  return Array.from(new Uint8Array(signature))\n    .map((byte) => byte.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n\n/** Derive the gate cookie token for a given password. */\nexport function gateToken(password: string): Promise<string> {\n  return hmacHex(password, GATE_MESSAGE);\n}\n\n/** Constant-time comparison so a mismatch never leaks token bytes via timing. */\nexport function timingSafeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false;\n  let mismatch = 0;\n  for (let i = 0; i < a.length; i++) {\n    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);\n  }\n  return mismatch === 0;\n}\n\n/**\n * Whether the request carrying the given cookie value is allowed past the gate.\n * Returns true (open) when no password is configured.\n */\nexport async function isGateUnlocked(\n  cookieValue: string | undefined,\n  password: string | undefined = process.env.SITE_PASSWORD,\n): Promise<boolean> {\n  if (!password) return true;\n  if (!cookieValue) return false;\n  const expected = await gateToken(password);\n  return timingSafeEqual(cookieValue, expected);\n}\n";

package/dist/templates/lib/siteGate.js

@@ -0,0 +1,59 @@
+export const siteGateTemplate = `/**
+ * Shared site-gate crypto. The gate cookie never stores the password itself -
+ * it stores HMAC-SHA256(key=SITE_PASSWORD, data=GATE_MESSAGE) as hex. Uses Web
+ * Crypto (crypto.subtle) so the same helpers run in both the Edge middleware
+ * (proxy.ts) and the Node route handler (app/api/gate/route.ts).
+ */
+export const GATE_COOKIE_NAME = "doccupine_gate";
+
+// Bump the suffix to invalidate every previously issued cookie at once.
+const GATE_MESSAGE = "doccupine-gate-v1";
+
+async function hmacHex(key: string, data: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const cryptoKey = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(key),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    cryptoKey,
+    encoder.encode(data),
+  );
+  return Array.from(new Uint8Array(signature))
+    .map((byte) => byte.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+/** Derive the gate cookie token for a given password. */
+export function gateToken(password: string): Promise<string> {
+  return hmacHex(password, GATE_MESSAGE);
+}
+
+/** Constant-time comparison so a mismatch never leaks token bytes via timing. */
+export function timingSafeEqual(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < a.length; i++) {
+    mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+
+/**
+ * Whether the request carrying the given cookie value is allowed past the gate.
+ * Returns true (open) when no password is configured.
+ */
+export async function isGateUnlocked(
+  cookieValue: string | undefined,
+  password: string | undefined = process.env.SITE_PASSWORD,
+): Promise<boolean> {
+  if (!password) return true;
+  if (!cookieValue) return false;
+  const expected = await gateToken(password);
+  return timingSafeEqual(cookieValue, expected);
+}
+`;

package/dist/templates/mdx/authentication.mdx.d.ts

@@ -0,0 +1 @@
+export declare const authenticationMdxTemplate = "---\ntitle: \"Authentication\"\ndescription: \"Password protect your documentation site with a single environment variable that gates pages, content APIs, and search crawlers behind a shared password.\"\ndate: \"2026-07-01\"\ncategory: \"Configuration\"\ncategoryOrder: 3\norder: 12\n---\n\n# Authentication\n\nKeep your documentation private by putting the whole site behind a shared password. Set one environment variable and Doccupine gates every page behind a login screen, blocks the content APIs, and hides the site from search engines - no accounts, no database, no extra services.\n\n## Enabling password protection\n\nSet `SITE_PASSWORD` in your environment (for local development, add it to `.env`):\n\n```bash\nSITE_PASSWORD=choose-a-strong-shared-password\n```\n\nThat is the only setting. Everyone who visits the site shares this single password.\n\n<Callout type=\"note\">\n  When `SITE_PASSWORD` is unset or empty, the site is fully public and behaves exactly as before. Removing the variable turns protection off again.\n</Callout>\n\n## What gets protected\n\nWhile a password is set, protection is enforced across three layers:\n\n- **Pages**: Every page renders a login screen instead of your documentation until the visitor enters the correct password.\n- **Content APIs**: The AI chat (`/api/rag`) and search (`/api/search`) endpoints return `401 Unauthorized` without a valid session, so the docs cannot be scraped around the login screen.\n- **Search engines and crawlers**: `robots.txt` disallows all crawlers, every page ships a `noindex, nofollow` meta tag, and responses carry an `X-Robots-Tag: noindex, nofollow` header.\n\n<Callout type=\"note\">\n  The [MCP server](/model-context-protocol) keeps its own authentication through the `DOCS_API_KEY` bearer token and is not affected by `SITE_PASSWORD`. Set both when you want the docs and the MCP endpoint locked down.\n</Callout>\n\n## How it works\n\nWhen a visitor submits the correct password, Doccupine sets a signed, `httpOnly` cookie that unlocks the site for 30 days. The cookie never stores the password itself - it holds an HMAC derived from it - and it is checked in constant time to avoid leaking information through timing.\n\nBecause the check reads `SITE_PASSWORD` at request time, you can turn protection on or off by changing the environment variable and redeploying. No rebuild of your content is required.\n\n## Security notes\n\n- **Use a strong password.** It is shared by everyone with access, so treat it like any other shared secret and rotate it when needed.\n- **Serve over HTTPS in production.** The session cookie is marked `secure` in production, so it is only sent over encrypted connections.\n- **Brute-force protection.** Password attempts are rate limited by IP address to slow down guessing.\n- **Rotating the password.** Changing `SITE_PASSWORD` invalidates every existing session immediately - visitors will need to enter the new password.\n\n<Callout type=\"warning\">\n  A shared password is meant for lightweight gating - private previews, internal docs, or work-in-progress sites. For per-user access control or audit trails, put the site behind your own identity provider or a hosting platform's access controls.\n</Callout>\n\n## Behavior\n\n- **Runtime toggle**: Protection is controlled entirely by the `SITE_PASSWORD` environment variable, evaluated on each request.\n- **Graceful default**: With no password set, nothing changes - the site stays public and fully indexable.\n- **Session length**: A successful login lasts 30 days before the visitor is asked to sign in again.\n\n## Example\n\nProtect a staging deployment while it is being reviewed:\n\n```bash\nSITE_PASSWORD=preview-2026\nNEXT_PUBLIC_SITE_URL=https://staging.example.com\n```\n\nWhen you are ready to launch publicly, remove `SITE_PASSWORD` and redeploy. The login screen disappears, crawlers are welcomed back, and your [sitemap](/deployment-and-hosting) is advertised again.";

package/dist/templates/mdx/authentication.mdx.js

@@ -0,0 +1,72 @@
+export const authenticationMdxTemplate = `---
+title: "Authentication"
+description: "Password protect your documentation site with a single environment variable that gates pages, content APIs, and search crawlers behind a shared password."
+date: "2026-07-01"
+category: "Configuration"
+categoryOrder: 3
+order: 12
+---
+
+# Authentication
+
+Keep your documentation private by putting the whole site behind a shared password. Set one environment variable and Doccupine gates every page behind a login screen, blocks the content APIs, and hides the site from search engines - no accounts, no database, no extra services.
+
+## Enabling password protection
+
+Set \`SITE_PASSWORD\` in your environment (for local development, add it to \`.env\`):
+
+\`\`\`bash
+SITE_PASSWORD=choose-a-strong-shared-password
+\`\`\`
+
+That is the only setting. Everyone who visits the site shares this single password.
+
+<Callout type="note">
+  When \`SITE_PASSWORD\` is unset or empty, the site is fully public and behaves exactly as before. Removing the variable turns protection off again.
+</Callout>
+
+## What gets protected
+
+While a password is set, protection is enforced across three layers:
+
+- **Pages**: Every page renders a login screen instead of your documentation until the visitor enters the correct password.
+- **Content APIs**: The AI chat (\`/api/rag\`) and search (\`/api/search\`) endpoints return \`401 Unauthorized\` without a valid session, so the docs cannot be scraped around the login screen.
+- **Search engines and crawlers**: \`robots.txt\` disallows all crawlers, every page ships a \`noindex, nofollow\` meta tag, and responses carry an \`X-Robots-Tag: noindex, nofollow\` header.
+
+<Callout type="note">
+  The [MCP server](/model-context-protocol) keeps its own authentication through the \`DOCS_API_KEY\` bearer token and is not affected by \`SITE_PASSWORD\`. Set both when you want the docs and the MCP endpoint locked down.
+</Callout>
+
+## How it works
+
+When a visitor submits the correct password, Doccupine sets a signed, \`httpOnly\` cookie that unlocks the site for 30 days. The cookie never stores the password itself - it holds an HMAC derived from it - and it is checked in constant time to avoid leaking information through timing.
+
+Because the check reads \`SITE_PASSWORD\` at request time, you can turn protection on or off by changing the environment variable and redeploying. No rebuild of your content is required.
+
+## Security notes
+
+- **Use a strong password.** It is shared by everyone with access, so treat it like any other shared secret and rotate it when needed.
+- **Serve over HTTPS in production.** The session cookie is marked \`secure\` in production, so it is only sent over encrypted connections.
+- **Brute-force protection.** Password attempts are rate limited by IP address to slow down guessing.
+- **Rotating the password.** Changing \`SITE_PASSWORD\` invalidates every existing session immediately - visitors will need to enter the new password.
+
+<Callout type="warning">
+  A shared password is meant for lightweight gating - private previews, internal docs, or work-in-progress sites. For per-user access control or audit trails, put the site behind your own identity provider or a hosting platform's access controls.
+</Callout>
+
+## Behavior
+
+- **Runtime toggle**: Protection is controlled entirely by the \`SITE_PASSWORD\` environment variable, evaluated on each request.
+- **Graceful default**: With no password set, nothing changes - the site stays public and fully indexable.
+- **Session length**: A successful login lasts 30 days before the visitor is asked to sign in again.
+
+## Example
+
+Protect a staging deployment while it is being reviewed:
+
+\`\`\`bash
+SITE_PASSWORD=preview-2026
+NEXT_PUBLIC_SITE_URL=https://staging.example.com
+\`\`\`
+
+When you are ready to launch publicly, remove \`SITE_PASSWORD\` and redeploy. The login screen disappears, crawlers are welcomed back, and your [sitemap](/deployment-and-hosting) is advertised again.`;

package/dist/templates/package.js

@@ -10,39 +10,39 @@ export const packageJsonTemplate = JSON.stringify({
         format: "prettier --write .",
     },
     dependencies: {
-        "@langchain/anthropic": "^1.4.0",
-        "@langchain/core": "^1.1.48",
-        "@langchain/google-genai": "^2.1.31",
-        "@langchain/openai": "^1.4.7",
+        "@langchain/anthropic": "^1.5.1",
+        "@langchain/core": "^1.2.1",
+        "@langchain/google-genai": "^2.2.0",
+        "@langchain/openai": "^1.5.3",
         "@mdx-js/react": "^3.1.1",
         "@modelcontextprotocol/sdk": "^1.29.0",
-        "@posthog/react": "^1.10.1",
-        "cherry-styled-components": "^0.1.17",
-        langchain: "^1.4.4",
-        "lucide-react": "^1.17.0",
+        "@posthog/react": "^1.10.3",
+        "cherry-styled-components": "^0.1.18",
+        langchain: "^1.5.2",
+        "lucide-react": "^1.23.0",
         minisearch: "^7.2.0",
         next: "16.2.9",
         "next-mdx-remote": "^6.0.0",
-        "posthog-js": "^1.384.1",
-        "posthog-node": "^5.36.10",
+        "posthog-js": "^1.396.4",
+        "posthog-node": "^5.39.2",
         react: "19.2.7",
         "react-dom": "19.2.7",
         "rehype-highlight": "^7.0.2",
         "rehype-parse": "^9.0.1",
         "rehype-stringify": "^10.0.1",
         "remark-gfm": "^4.0.1",
-        "styled-components": "^6.4.2",
+        "styled-components": "^6.4.3",
         unified: "^11.0.5",
         zod: "^4.4.3",
     },
     devDependencies: {
-        "@types/node": "^25",
+        "@types/node": "^26",
         "@types/react": "^19",
         "@types/react-dom": "^19",
-        "baseline-browser-mapping": "^2.10.35",
+        "baseline-browser-mapping": "^2.10.40",
         eslint: "^9",
         "eslint-config-next": "16.2.9",
-        prettier: "^3.8.4",
+        prettier: "^3.9.4",
         typescript: "^6",
     },
 }, null, 2) + "\n";

package/dist/templates/pnpmWorkspace.d.ts

@@ -1 +1 @@
-export declare const pnpmWorkspaceTemplate = "allowBuilds:\n  core-js: false\n  protobufjs: false\n  sharp: false\n  unrs-resolver: false\nminimumReleaseAgeExclude:\n  - '@next/env@16.2.9'\n  - '@next/eslint-plugin-next@16.2.9'\n  - '@next/swc-darwin-arm64@16.2.9'\n  - '@next/swc-darwin-x64@16.2.9'\n  - '@next/swc-linux-arm64-gnu@16.2.9'\n  - '@next/swc-linux-arm64-musl@16.2.9'\n  - '@next/swc-linux-x64-gnu@16.2.9'\n  - '@next/swc-linux-x64-musl@16.2.9'\n  - '@next/swc-win32-arm64-msvc@16.2.9'\n  - '@next/swc-win32-x64-msvc@16.2.9'\n  - '@posthog/core@1.31.1'\n  - '@posthog/types@1.384.1'\n  - baseline-browser-mapping@2.10.35\n  - eslint-config-next@16.2.9\n  - next@16.2.9\n  - posthog-js@1.384.1\n  - posthog-node@5.36.10\n  - prettier@3.8.4\n";
+export declare const pnpmWorkspaceTemplate = "allowBuilds:\n  core-js: false\n  protobufjs: false\n  sharp: false\n  unrs-resolver: false\n# Disable pnpm's minimum-release-age supply-chain gate for the generated app.\n# The gate blocks freshly published versions, which trips installs whenever the\n# pinned dependencies here are newer than the cutoff. Set to 0 to install any\n# resolved version without waiting out the release-age window.\nminimumReleaseAge: 0\n";

package/dist/templates/pnpmWorkspace.js

@@ -3,23 +3,9 @@ export const pnpmWorkspaceTemplate = `allowBuilds:
   protobufjs: false
   sharp: false
   unrs-resolver: false
-minimumReleaseAgeExclude:
-  - '@next/env@16.2.9'
-  - '@next/eslint-plugin-next@16.2.9'
-  - '@next/swc-darwin-arm64@16.2.9'
-  - '@next/swc-darwin-x64@16.2.9'
-  - '@next/swc-linux-arm64-gnu@16.2.9'
-  - '@next/swc-linux-arm64-musl@16.2.9'
-  - '@next/swc-linux-x64-gnu@16.2.9'
-  - '@next/swc-linux-x64-musl@16.2.9'
-  - '@next/swc-win32-arm64-msvc@16.2.9'
-  - '@next/swc-win32-x64-msvc@16.2.9'
-  - '@posthog/core@1.31.1'
-  - '@posthog/types@1.384.1'
-  - baseline-browser-mapping@2.10.35
-  - eslint-config-next@16.2.9
-  - next@16.2.9
-  - posthog-js@1.384.1
-  - posthog-node@5.36.10
-  - prettier@3.8.4
+# Disable pnpm's minimum-release-age supply-chain gate for the generated app.
+# The gate blocks freshly published versions, which trips installs whenever the
+# pinned dependencies here are newer than the cutoff. Set to 0 to install any
+# resolved version without waiting out the release-age window.
+minimumReleaseAge: 0
 `;