jamdesk 1.1.156 → 1.1.158

package/vendored/lib/r2-cleanup.ts

@@ -14,6 +14,7 @@ import {
 import { getR2S3Client, getR2Config } from './r2.js';
 import { isKnownLanguageCode } from './language-utils.js';
 import { logger } from '../shared/logger.js';
+import { isDualWriteEnabled } from './r2-feature-flags.js';
 
 // AWS / R2 cap DeleteObjects to 1000 keys per request. Match ListObjectsV2's
 // MaxKeys to that so each list page maps 1:1 to a delete page.
@@ -35,7 +36,23 @@ export interface CleanupResult {
  * fails here won't reappear in the next build's diff — surface `failed` for
  * manual follow-up rather than relying on a re-attempt.
  *
+ * Dual-write coupling: mirrors `upload-to-r2.cjs`. Always deletes the
+ * versioned key `<slug>/<deployId>/<prefix><relKey>`. When
+ * `R2_DUAL_WRITE !== 'false'` (default true), ALSO deletes the legacy key
+ * `<slug>/<prefix><relKey>` so files dropped from the manifest don't leak
+ * at the legacy path during the dual-write phase.
+ *
+ * INTENTIONAL NO-OP: the versioned delete targets the CURRENT build's
+ * deployId, but a removed file was never uploaded under this build's prefix
+ * (the build only writes files present in the new manifest). S3 DeleteObject
+ * on a nonexistent key succeeds silently, so this arm is a harmless
+ * idempotent no-op kept for symmetry with the upload key scheme. Real
+ * deletions happen on the legacy arm; OLD deployIds' versioned trees are
+ * immutable by design and reclaimed wholesale by r2-deploy-gc, never
+ * per-file here.
+ *
  * @param projectSlug Project namespace under the bucket
+ * @param deployId    Current build/deploy id (versioned-path segment)
  * @param oldEntries  Hash map from the previous manifest (may be undefined)
  * @param newEntries  Hash map from the new manifest (may be undefined)
  * @param keyPrefix   Path under {slug}/ — empty for root files (custom.css),
@@ -43,6 +60,7 @@ export interface CleanupResult {
  */
 export async function deleteRemovedR2Objects(
   projectSlug: string,
+  deployId: string,
   oldEntries: Record<string, HashEntry> | undefined,
   newEntries: Record<string, HashEntry> | undefined,
   keyPrefix: string,
@@ -54,27 +72,37 @@ export async function deleteRemovedR2Objects(
   const removed = oldKeys.filter((k) => !newSet.has(k));
   if (removed.length === 0) return { deleted: [], failed: [] };
 
+  // Single source of truth: isDualWriteEnabled() trims env-var whitespace.
+  // Bare `process.env.R2_DUAL_WRITE !== 'false'` would treat ' false ' as truthy.
+  const dualWrite = isDualWriteEnabled();
   const client = getR2S3Client();
   const { bucketName } = getR2Config();
   const deleted: string[] = [];
   const failed: string[] = [];
 
+  const deleteOne = async (fullKey: string) => {
+    try {
+      await client.send(
+        new DeleteObjectCommand({ Bucket: bucketName, Key: fullKey }),
+      );
+      deleted.push(fullKey);
+    } catch (err) {
+      failed.push(fullKey);
+      logger.warn('R2 delete failed (non-fatal)', {
+        projectSlug,
+        key: fullKey,
+        error: (err as Error).message,
+      });
+    }
+  };
+
   await Promise.all(
-    removed.map(async (relKey) => {
-      const fullKey = `${projectSlug}/${keyPrefix}${relKey}`;
-      try {
-        await client.send(
-          new DeleteObjectCommand({ Bucket: bucketName, Key: fullKey }),
-        );
-        deleted.push(fullKey);
-      } catch (err) {
-        failed.push(fullKey);
-        logger.warn('R2 delete failed (non-fatal)', {
-          projectSlug,
-          key: fullKey,
-          error: (err as Error).message,
-        });
-      }
+    removed.flatMap((relKey) => {
+      const versionedKey = `${projectSlug}/${deployId}/${keyPrefix}${relKey}`;
+      const legacyKey = `${projectSlug}/${keyPrefix}${relKey}`;
+      return dualWrite
+        ? [deleteOne(versionedKey), deleteOne(legacyKey)]
+        : [deleteOne(versionedKey)];
     }),
   );
 
@@ -118,7 +146,7 @@ export interface PrunableManifest {
   commitTimestamp?: string;
 }
 
-export type PruneSkipReason = 'disabled' | 'empty-manifest' | 'mass-delete' | 'stale-build';
+export type PruneSkipReason = 'disabled' | 'dual-write-off' | 'empty-manifest' | 'mass-delete' | 'stale-build';
 
 /**
  * Per-category context for a skipped prune, logged for instant triage — the
@@ -266,6 +294,16 @@ export async function pruneRemovedContent(
   if (envFlag('JD_PRUNE_CONTENT_DISABLED')) {
     return { deleted: [], failed: [], skipped: true, skipReason: 'disabled' };
   }
+  // Prune deletes LEGACY keys only. With dual-write off, builds no longer
+  // WRITE legacy keys, so pruning must not touch them either (prune prefix
+  // must match upload prefix); the frozen legacy tree gets reclaimed
+  // wholesale in the final migration step, not per-build here.
+  // NOTE: while readers still fall back to legacy on public-fetch 404s,
+  // that frozen tree can serve deleted-content ghosts — remove the legacy
+  // fallback from r2-content.ts BEFORE ever setting R2_DUAL_WRITE=false.
+  if (!isDualWriteEnabled()) {
+    return { deleted: [], failed: [], skipped: true, skipReason: 'dual-write-off' };
+  }
   if (Object.keys(newManifest.files ?? {}).length === 0) {
     return {
       deleted: [],
@@ -493,10 +531,41 @@ export async function deleteAllProjectR2Objects(
 ): Promise<number> {
   const client = getR2S3Client();
   const { bucketName } = getR2Config();
-  const prefix = `${projectSlug}/`;
+  return deleteKeysUnderPrefix(client, bucketName, `${projectSlug}/`);
+}
+
+/**
+ * Whether a `{slug}/<segment>/` path segment is a versioned deploy prefix (vs.
+ * a legacy content directory like `content/`, `snippets/`, `assets/`,
+ * `openapi/`, or a locale code). A deploy ID is a 20-char alphanumeric
+ * Firestore auto-ID (server buildId) or a 24-char hex ID (CLI upload).
+ *
+ * MUST stay identical to `looksLikeDeployId` in `scripts/r2-deploy-gc.cjs` —
+ * both gate DESTRUCTIVE deletes, and a looser match would delete a customer's
+ * live legacy content. Pinned by `__tests__/r2-cleanup.test.ts`.
+ */
+export function isVersionedDeployPrefixSegment(segment: string): boolean {
+  return /^[A-Za-z0-9]{20}$/.test(segment) || /^[a-f0-9]{24}$/i.test(segment);
+}
+
+/**
+ * Shared primitive: page ListObjectsV2 + DeleteObjects to remove every key
+ * under `prefix`, returning the count of keys successfully deleted.
+ *
+ * R2 caps both list and delete at 1000 per request, so each list page maps 1:1
+ * to a delete page. Per-key failures inside an otherwise-successful batch are
+ * logged (greppable) but do NOT throw — callers (`deleteAllProjectR2Objects`
+ * on project delete, `purgeVersionedDeployPrefixes` on gating) treat this as
+ * best-effort. A `send()` rejection (list or delete) DOES propagate so the
+ * caller's own error handling fires.
+ */
+async function deleteKeysUnderPrefix(
+  client: ReturnType<typeof getR2S3Client>,
+  bucketName: string,
+  prefix: string,
+): Promise<number> {
   let deleted = 0;
   let continuationToken: string | undefined;
-
   do {
     const listResp: {
       Contents?: Array<{ Key?: string }>;
@@ -528,11 +597,8 @@ export async function deleteAllProjectR2Objects(
       } = await client.send(
         new DeleteObjectsCommand({
           Bucket: bucketName,
-          Delete: {
-            Objects: keys.map((Key) => ({ Key })),
-            // Quiet=false so we get per-key Deleted[] for the count.
-            Quiet: false,
-          },
+          // Quiet=false so we get per-key Deleted[] for the count + Errors[].
+          Delete: { Objects: keys.map((Key) => ({ Key })), Quiet: false },
         }),
       );
 
@@ -540,11 +606,8 @@ export async function deleteAllProjectR2Objects(
 
       const errors = delResp.Errors || [];
       if (errors.length > 0) {
-        // Per-key failures inside an otherwise-successful batch. Log so ops
-        // can grep for the slug; we don't throw because the caller treats
-        // this whole operation as best-effort.
         logger.warn('R2 batch delete had per-key errors', {
-          projectSlug,
+          prefix,
           errorCount: errors.length,
           firstError: {
             key: errors[0]?.Key,
@@ -555,10 +618,76 @@ export async function deleteAllProjectR2Objects(
       }
     }
 
-    continuationToken = listResp.IsTruncated ?
-      listResp.NextContinuationToken :
-      undefined;
+    continuationToken = listResp.IsTruncated ? listResp.NextContinuationToken : undefined;
   } while (continuationToken);
 
   return deleted;
 }
+
+/**
+ * Delete every versioned deploy prefix `{slug}/<deployId>/*` for a project,
+ * leaving legacy keys (`{slug}/content/…`, `docs.json`, `manifest.json`, static
+ * artifacts) untouched.
+ *
+ * Used when a project becomes password-gated: the CF public custom domain
+ * serves the versioned keys, so a gated project must have NONE — this reclaims
+ * any snapshot written while the project was still public (which would
+ * otherwise stay publicly fetchable, and be protected forever by r2-deploy-gc
+ * once the deployId pointer freezes). Always-gated projects have no such
+ * prefixes, so this is a cheap no-op for them.
+ *
+ * Best-effort per prefix: a failed delete is logged (ERROR, greppable) and
+ * skipped, not thrown — the caller runs this inside a build and must not fail
+ * an otherwise-successful gated build on a cleanup blip; the next gated build
+ * retries idempotently. Caller must validate `projectSlug` against
+ * `^[A-Za-z0-9_-]{1,128}$`. Returns the deploy prefixes actually deleted.
+ */
+export async function purgeVersionedDeployPrefixes(
+  projectSlug: string,
+): Promise<string[]> {
+  const client = getR2S3Client();
+  const { bucketName } = getR2Config();
+  const slugPrefix = `${projectSlug}/`;
+
+  // 1) Enumerate top-level `{slug}/<seg>/` common prefixes; keep only deploys.
+  const deployPrefixes: string[] = [];
+  let continuationToken: string | undefined;
+  do {
+    const listed: {
+      CommonPrefixes?: Array<{ Prefix?: string }>;
+      IsTruncated?: boolean;
+      NextContinuationToken?: string;
+    } = await client.send(
+      new ListObjectsV2Command({
+        Bucket: bucketName,
+        Prefix: slugPrefix,
+        Delimiter: '/',
+        ContinuationToken: continuationToken,
+      }),
+    );
+    for (const cp of listed.CommonPrefixes ?? []) {
+      const prefix = cp.Prefix;
+      if (typeof prefix !== 'string') continue;
+      // `{slug}/<seg>/` → `<seg>` (strip leading slug prefix + trailing slash).
+      const segment = prefix.slice(slugPrefix.length, -1);
+      if (isVersionedDeployPrefixSegment(segment)) deployPrefixes.push(prefix);
+    }
+    continuationToken = listed.IsTruncated ? listed.NextContinuationToken : undefined;
+  } while (continuationToken);
+
+  // 2) Delete all keys under each deploy prefix, batched.
+  const purged: string[] = [];
+  for (const prefix of deployPrefixes) {
+    try {
+      await deleteKeysUnderPrefix(client, bucketName, prefix);
+      purged.push(prefix);
+    } catch (err) {
+      logger.error('Failed to purge versioned deploy prefix (non-fatal)', {
+        projectSlug,
+        prefix,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+  return purged;
+}

package/vendored/lib/r2-feature-flags.ts

@@ -5,3 +5,49 @@
 export function isR2ParallelCounterEnabled(): boolean {
   return process.env.R2_PARALLEL_COUNTER?.trim() === 'true';
 }
+
+/**
+ * CF public-domain caching flags (cf-r2-public-domain-cache plan).
+ *
+ * - USE_R2_PUBLIC_FETCH: master switch. When 'true' AND R2_PUBLIC_DOMAIN
+ *   is set, public (non-gated) projects read via the CF public domain.
+ *   Otherwise reads use the S3 SDK (legacy behavior). Default: false.
+ *
+ * - R2_DUAL_WRITE: during transition, upload-to-r2.cjs writes to BOTH
+ *   the versioned and legacy paths. Default: true. Flip to false once
+ *   all projects have at least one versioned deploy AND legacy reads
+ *   are gone.
+ */
+export function isPublicFetchEnabled(): boolean {
+  if (process.env.USE_R2_PUBLIC_FETCH?.trim() !== 'true') return false;
+  if (!process.env.R2_PUBLIC_DOMAIN?.trim()) return false;
+  return true;
+}
+
+export function isDualWriteEnabled(): boolean {
+  return process.env.R2_DUAL_WRITE?.trim() !== 'false';
+}
+
+/**
+ * Fail fast on the one flag combination that silently strands every site
+ * on its previous deploy: dual-write OFF (writes go to versioned keys only)
+ * while public fetch is OFF (reads resolve legacy keys only) — nothing
+ * would ever read what the build writes. Throwing turns a silent
+ * fleet-wide staleness incident into an immediate, attributable build
+ * failure.
+ *
+ * NOTE: this checks THIS process's env (Cloud Run / CLI uploader). The
+ * read flags must ALSO be live on the ISR app — mirror
+ * USE_R2_PUBLIC_FETCH + R2_PUBLIC_DOMAIN there FIRST, then disable
+ * dual-write here. (Mirrored cjs guard: scripts/upload-to-r2.cjs.)
+ */
+export function assertFlagSequencingValid(): void {
+  if (isDualWriteEnabled() || isPublicFetchEnabled()) return;
+  throw new Error(
+    'R2 flag sequencing error: R2_DUAL_WRITE=false while public fetch is disabled ' +
+      '(USE_R2_PUBLIC_FETCH/R2_PUBLIC_DOMAIN unset). New builds would write versioned ' +
+      'keys that no reader resolves, stranding every site on its previous deploy. ' +
+      'Enable USE_R2_PUBLIC_FETCH=true + R2_PUBLIC_DOMAIN on BOTH the ISR app and ' +
+      'this service before disabling dual-write.',
+  );
+}

package/vendored/lib/r2-key-builder.ts

@@ -0,0 +1,28 @@
+/**
+ * R2 key construction with deployId-versioned prefixing.
+ *
+ * Versioned shape:  {slug}/{deployId}/{rest}
+ * Legacy shape:     {slug}/{rest}                 (kept for migration & GC tooling)
+ *
+ * Versioned URLs auto-invalidate cache: each build writes a fresh prefix,
+ * old prefixes age out of CF cache as their URLs stop being requested.
+ * GC removes them from R2 after a 7-day retention window.
+ */
+
+const DEPLOY_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+
+function stripLeadingSlash(s: string): string {
+  return s.startsWith('/') ? s.slice(1) : s;
+}
+
+export function buildVersionedKey(slug: string, deployId: string, rest: string): string {
+  if (!deployId) throw new Error('deployId is required');
+  if (!DEPLOY_ID_PATTERN.test(deployId)) {
+    throw new Error(`Invalid deployId (must match ${DEPLOY_ID_PATTERN}): ${deployId}`);
+  }
+  return `${slug}/${deployId}/${stripLeadingSlash(rest)}`;
+}
+
+export function buildLegacyKey(slug: string, rest: string): string {
+  return `${slug}/${stripLeadingSlash(rest)}`;
+}

package/vendored/lib/r2-manifest.ts

@@ -50,6 +50,8 @@ function getR2Client(): S3Client {
 export interface Manifest {
   version: number;
   timestamp: string;
+  /** Build ID that produced this manifest; doubles as R2 prefix when versioned uploads are active. */
+  currentDeployId?: string;
   projectSlug?: string;
   files: Record<string, { hash: string; size?: number }>;
   snippets?: Record<string, { hash: string }>;

package/vendored/lib/r2-public-fetch.ts

@@ -0,0 +1,133 @@
+/**
+ * R2 Public Fetch Helper
+ *
+ * Reads R2 objects via the Cloudflare public custom domain (R2_PUBLIC_DOMAIN).
+ * Uses fetch() with an AbortController timeout (R2_PUBLIC_FETCH_TIMEOUT_MS,
+ * default 5s) that covers BOTH headers and body read. Emits [r2-timing] log lines including cf-cache-status so on-call
+ * can grep Vercel logs during rollout.
+ *
+ * Used by the public-fetch path in r2-content.ts (Task 5.3+) to swap
+ * public-project reads to the CF public custom domain.
+ */
+
+import { logger } from '../shared/logger';
+
+const DEFAULT_TIMEOUT_MS = 5000;
+
+/**
+ * Operator-tunable like the S3 path's R2_FETCH_TIMEOUT_MS (prod runs that
+ * at 15000ms) — separate var so tuning the S3 fallback doesn't silently
+ * stretch the public path's fail-fast budget. Bad/≤0 values floor to the
+ * default, mirroring resolveR2Timeout's semantics.
+ */
+function resolveTimeoutMs(): number {
+  const raw = Number(process.env.R2_PUBLIC_FETCH_TIMEOUT_MS);
+  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_TIMEOUT_MS;
+}
+
+export class R2PublicNotFoundError extends Error {
+  constructor(key: string) {
+    super(`R2 public 404: ${key}`);
+    this.name = 'R2PublicNotFoundError';
+  }
+}
+
+export interface PublicBytesResult {
+  body: Uint8Array;
+  /**
+   * Raw content-type header; null when the CDN omitted it. Callers own the
+   * fallback (r2-content.ts fetchAsset uses guessContentType for parity
+   * with the S3 path's `response.ContentType || guessContentType(...)`).
+   */
+  contentType: string | null;
+  contentLength: number;
+}
+
+function publicDomain(): string {
+  const d = process.env.R2_PUBLIC_DOMAIN;
+  if (!d) {
+    throw new Error('R2_PUBLIC_DOMAIN env var is required for public fetch path');
+  }
+  return d.replace(/\/$/, '');
+}
+
+/**
+ * Misrouted-domain guard: R2 serves objects with their stored content-type
+ * (text/mdx, application/json, image/*…). A text/html 200 for a non-.html
+ * key means R2_PUBLIC_DOMAIN isn't actually fronting the bucket — e.g. a
+ * CNAME still pointed at Vercel returning an HTML shell with status 200.
+ * Without this check that HTML would be cached and rendered as page
+ * content; throwing routes the read to the S3 fallback instead.
+ */
+function assertNotMisroutedHtml(key: string, contentType: string | null): void {
+  if (!contentType) return;
+  if (!contentType.toLowerCase().startsWith('text/html')) return;
+  if (key.toLowerCase().endsWith('.html')) return;
+  throw new Error(
+    `R2 public fetch returned text/html for non-HTML key ${key} — R2_PUBLIC_DOMAIN likely misrouted`,
+  );
+}
+
+async function fetchPublicR2Body(
+  key: string,
+  read: 'text' | 'bytes',
+): Promise<{ body: string | Uint8Array; contentType: string | null }> {
+  const url = `${publicDomain()}/${key.replace(/^\//, '')}`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), resolveTimeoutMs());
+  const start = performance.now();
+  const region = process.env.VERCEL_REGION || 'unknown';
+  try {
+    const res = await fetch(url, { signal: controller.signal });
+    const ms = Math.round(performance.now() - start);
+    logger.info('[r2-timing]', {
+      operation: `publicFetch(${key})`,
+      ms,
+      region,
+      cf: res.headers.get('cf-cache-status') || 'unknown',
+      status: res.status,
+    });
+    if (res.status === 404) throw new R2PublicNotFoundError(key);
+    if (!res.ok) throw new Error(`R2 public fetch ${res.status} for ${key}`);
+    const contentType = res.headers.get('content-type');
+    assertNotMisroutedHtml(key, contentType);
+    // Body is consumed while the abort timer is still armed — a CDN
+    // response whose headers arrive fast but whose body stalls gets cut
+    // at TIMEOUT_MS instead of wedging the render indefinitely.
+    const body =
+      read === 'text' ? await res.text() : new Uint8Array(await res.arrayBuffer());
+    return { body, contentType };
+  } catch (err) {
+    if (err instanceof R2PublicNotFoundError) throw err;
+    const ms = Math.round(performance.now() - start);
+    logger.warn('[r2-timing]', {
+      operation: `publicFetch(${key})`,
+      ms,
+      region,
+      error: (err as Error).message,
+    });
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export async function fetchPublicR2Text(key: string): Promise<string> {
+  const { body } = await fetchPublicR2Body(key, 'text');
+  return body as string;
+}
+
+export async function fetchPublicR2Bytes(key: string): Promise<PublicBytesResult | null> {
+  try {
+    const { body, contentType } = await fetchPublicR2Body(key, 'bytes');
+    const buf = body as Uint8Array;
+    return {
+      body: buf,
+      contentType,
+      contentLength: buf.length,
+    };
+  } catch (err) {
+    if (err instanceof R2PublicNotFoundError) return null;
+    throw err;
+  }
+}

package/vendored/lib/r2-public-storage-guard.ts

@@ -0,0 +1,113 @@
+import { redis } from './redis.js';
+import { logger } from '../shared/logger.js';
+
+interface AuthSecret {
+  hash?: unknown;
+}
+
+interface AuthPublic {
+  enabled?: unknown;
+}
+
+function publicDomainConfigured(): boolean {
+  return !!process.env.R2_PUBLIC_DOMAIN?.trim();
+}
+
+function overrideEnabled(): boolean {
+  return process.env.R2_ALLOW_GATED_PUBLIC_BUCKET?.trim() === 'true';
+}
+
+function isGated(secret: AuthSecret | null, pub: AuthPublic | null): boolean {
+  return typeof secret?.hash === 'string' && pub?.enabled === true;
+}
+
+/**
+ * R2 write scheme for a build:
+ *   - 'versioned+legacy': dual-write as normal (the versioned/public keys the
+ *     CF custom domain serves are safe to write for this project).
+ *   - 'legacy-only': password-gated project — write ONLY the legacy
+ *     `{slug}/<file>` keys. The versioned public keys are never written, so
+ *     gated content cannot enter the CF-served key space. The ISR reader keeps
+ *     serving these projects from the S3 SDK path (isProjectGated=true), so the
+ *     legacy keys are all it needs.
+ */
+export type R2WriteScheme = 'versioned+legacy' | 'legacy-only';
+
+/**
+ * Storage-safety guard for the R2 public custom domain rollout: decide a
+ * build's R2 write scheme.
+ *
+ * `isProjectGated()` intentionally fails open because it only chooses a read
+ * mechanism after request auth has already happened. The write side is
+ * different: before writing objects into a bucket that is exposed by
+ * R2_PUBLIC_DOMAIN, it must fail closed unless we can prove the project is not
+ * password-gated or an explicit customer-acceptance override is set.
+ *
+ * A password-gated project resolves to `'legacy-only'` — its versioned/public
+ * keys are never written, so gated content stays out of the CF-served key
+ * space (the build still succeeds; the S3 read path serves it). Non-gated
+ * projects, the no-public-domain case, and the acceptance override all resolve
+ * to `'versioned+legacy'`. Throws when gated status cannot be determined (Redis
+ * unavailable / read fails after retries) — we must never write to a public
+ * bucket unverified, and a Redis outage during upload is a real failure worth
+ * surfacing (rare — the build has already done many Redis reads by this point).
+ */
+export async function resolveR2WriteScheme(
+  slug: string,
+  opts: { retryAttempts?: number; retryDelayMs?: number } = {},
+): Promise<R2WriteScheme> {
+  const { retryAttempts = 3, retryDelayMs = 200 } = opts;
+  if (!publicDomainConfigured()) return 'versioned+legacy';
+  if (overrideEnabled()) {
+    // The override must never run silently: it disables the only write-side
+    // control keeping gated content out of a publicly fetchable bucket.
+    // WARN on every build so a forgotten env var stays visible in logs.
+    logger.warn(
+      '[r2-public-storage-guard] R2_ALLOW_GATED_PUBLIC_BUCKET override ACTIVE — gated-content write protection bypassed',
+      { slug },
+    );
+    return 'versioned+legacy';
+  }
+
+  if (!redis) {
+    throw new Error(
+      `Cannot verify gated status for ${slug}; refusing to write to a public R2 bucket`,
+    );
+  }
+  const client = redis;
+
+  // Retry a few times before failing closed: a transient Upstash blip during
+  // the upload phase otherwise hard-fails the whole build (we fail closed on
+  // any read error) even for non-gated projects. An outage that outlasts the
+  // retries still fails closed — correct, since we must never write to a
+  // public bucket unverified.
+  let secret: AuthSecret | null = null;
+  let pub: AuthPublic | null = null;
+  let lastErr: unknown;
+  let read = false;
+  for (let attempt = 1; attempt <= retryAttempts; attempt++) {
+    try {
+      const [secretResult, publicResult] = await Promise.all([
+        client.get(`projectAuthSecret:${slug}`),
+        client.get(`projectAuthPublic:${slug}`),
+      ]);
+      secret = secretResult as AuthSecret | null;
+      pub = publicResult as AuthPublic | null;
+      read = true;
+      break;
+    } catch (err) {
+      lastErr = err;
+      if (attempt < retryAttempts && retryDelayMs > 0) {
+        await new Promise((resolve) => setTimeout(resolve, retryDelayMs * attempt));
+      }
+    }
+  }
+  if (!read) {
+    throw new Error(
+      `Cannot verify gated status for ${slug}; refusing to write to a public R2 bucket`,
+      { cause: lastErr },
+    );
+  }
+
+  return isGated(secret, pub) ? 'legacy-only' : 'versioned+legacy';
+}