jamdesk 1.1.162 → 1.1.164

package/vendored/lib/fonts.ts

@@ -65,6 +65,31 @@ export function validateFontName(fontName: string | undefined): boolean {
   return fontName.trim().length > 0 && fontName.length < 100;
 }
 
+/**
+ * Merge a configured body weight with the theme's heading-weight ladder.
+ *
+ * The theme renders headings at 500/600 (--prose-hN-weight). If we requested
+ * ONLY the client's chosen body weight, headings would have no bold face and
+ * collapse down to the body weight — flattening the type hierarchy (Inter avoids
+ * this because next/font loads it as a full variable font). So we always keep the
+ * heading weights loaded alongside the chosen body weight. Deduped + sorted; the
+ * body weight defaults to 300 (the theme's --prose-body-weight) when unset.
+ */
+function withHeadingWeights(bodyWeight: number | undefined, headingLadder: number[]): number[] {
+  return Array.from(new Set([bodyWeight ?? 300, ...headingLadder])).sort((a, b) => a - b);
+}
+
+/**
+ * The client-configured body-text weight, across config formats. Legacy configs
+ * have no weight concept. Returns undefined when unset, so callers can fall back
+ * to the theme default rather than forcing a weight.
+ */
+function getConfiguredBodyWeight(fonts: FontConfig): number | undefined {
+  if (isSingleFontConfig(fonts)) return fonts.weight;
+  if (isHeadingBodyFontConfig(fonts)) return fonts.body?.weight;
+  return undefined;
+}
+
 /**
  * Type guard for legacy font config
  */
@@ -152,7 +177,9 @@ export function generateFontImports(fonts: FontConfig | undefined): string | nul
     if (fonts.family && validateFontName(fonts.family)) {
       // If source is provided, it's a custom font file - don't use Google Fonts
       if (!fonts.source && !isPreloadedFont(fonts.family)) {
-        const weights = fonts.weight ? [fonts.weight] : [300, 400, 500, 600, 700];
+        // Load the chosen body weight AND the theme's heading ladder, so headings
+        // keep a bold face instead of collapsing to the body weight.
+        const weights = withHeadingWeights(fonts.weight, [400, 500, 600, 700]);
         imports.push(generateGoogleFontsUrl(fonts.family, weights));
       }
     }
@@ -167,7 +194,9 @@ export function generateFontImports(fonts: FontConfig | undefined): string | nul
     
     if (fonts.body?.family && validateFontName(fonts.body.family)) {
       if (!fonts.body.source && !isPreloadedFont(fonts.body.family)) {
-        const weights = fonts.body.weight ? [fonts.body.weight] : [300, 400, 500, 600];
+        // Keep the heading weights (incl. h1's 600) loaded — the body font is
+        // reused for headings when no separate heading font is configured.
+        const weights = withHeadingWeights(fonts.body.weight, [400, 500, 600]);
         const bodyUrl = generateGoogleFontsUrl(fonts.body.family, weights);
         if (!imports.includes(bodyUrl)) {
           imports.push(bodyUrl);
@@ -229,5 +258,17 @@ export function generateFontVariables(fonts: FontConfig | undefined): string {
 
   if (variables.length === 0) return '';
 
-  return `:root {\n  ${variables.join('\n  ')}\n}`;
+  const blocks = [`:root {\n  ${variables.join('\n  ')}\n}`];
+
+  // Pin body text to the client's configured weight. The theme sets
+  // --prose-body-weight: 300 on :root (tuned for Inter); a custom font may not
+  // ship a 300, and the client may want a lighter/heavier body. Emit at
+  // :root:root specificity (0,0,2,0) so it beats the theme's :root default
+  // regardless of stylesheet order — the theme CSS is injected AFTER this block.
+  const bodyWeight = getConfiguredBodyWeight(fonts);
+  if (typeof bodyWeight === 'number' && Number.isFinite(bodyWeight)) {
+    blocks.push(`:root:root {\n  --prose-body-weight: ${bodyWeight};\n}`);
+  }
+
+  return blocks.join('\n');
 }

package/vendored/lib/openapi-isr.ts

@@ -5,7 +5,7 @@
  * with caching for ISR mode rendering.
  */
 
-import yaml from 'js-yaml';
+import {load as yamlLoad} from 'js-yaml';
 import SwaggerParser from '@apidevtools/swagger-parser';
 import { fetchOpenApiFile } from './r2-content';
 
@@ -67,7 +67,7 @@ export async function fetchOpenApiSpecFromR2(
 
   // Parse YAML or JSON into a plain object
   const isYaml = /\.ya?ml$/i.test(specPath);
-  const raw = isYaml ? yaml.load(content) : JSON.parse(content);
+  const raw = isYaml ? yamlLoad(content) : JSON.parse(content);
 
   // Dereference all $ref pointers (matching static mode's SwaggerParser.validate behavior).
   // SwaggerParser.dereference accepts a loose Document type that does not line up with

package/vendored/lib/r2-public-fetch.ts

@@ -78,7 +78,15 @@ async function fetchPublicR2Body(
   const start = performance.now();
   const region = process.env.VERCEL_REGION || 'unknown';
   try {
-    const res = await fetch(url, { signal: controller.signal });
+    // WAF bypass for the r2.jamdesk.com default-deny rule: the public
+    // custom domain rejects requests missing this shared secret so the
+    // bucket can't be scanned, while platform reads keep their CDN cache
+    // hits (WAF custom rules evaluate before cache). Env unset → send no
+    // header; the resulting 403 routes the read to the S3 fallback.
+    const headers: Record<string, string> = {};
+    const wafSecret = process.env.R2_PUBLIC_FETCH_SECRET;
+    if (wafSecret) headers['x-jd-r2-key'] = wafSecret;
+    const res = await fetch(url, { signal: controller.signal, headers });
     const ms = Math.round(performance.now() - start);
     logger.info('[r2-timing]', {
       operation: `publicFetch(${key})`,

package/vendored/lib/regenerate-screenshot-handler.ts

@@ -0,0 +1,97 @@
+import type {Request, Response} from 'express';
+import {getFirestore} from 'firebase-admin/firestore';
+import {secretsEqual} from './crypto-helpers.js';
+import {captureAndStoreScreenshot} from './screenshot-capture.js';
+import {getR2S3Client, getR2Config} from './r2.js';
+
+const SLUG_RE = /^[A-Za-z0-9_-]{1,128}$/;
+
+/**
+ * Re-run screenshot capture for a project's latest completed build, WITHOUT a
+ * full rebuild. Called by the dashboard `regenerateScreenshot` callable
+ * (secret-guarded, mirrors /gc-deploys and /delete-project-assets).
+ *
+ * Reads the capture params (firstPagePath/hostAtDocs) off the build doc — they
+ * were persisted by captureAndStoreScreenshot at build time. This avoids
+ * reading docs.json (fetchDocsConfig uses next/cache, which is unavailable in
+ * this plain Express Cloud Run process).
+ *
+ * IMPORTANT: this handler AWAITS the capture (does NOT return 202 and background
+ * it). The build service is deployed WITHOUT --no-cpu-throttling, so once the
+ * HTTP response is sent Cloud Run may throttle CPU to ~zero and kill any
+ * in-flight background work. Holding the request open keeps CPU allocated until
+ * the capture finishes. The caller (regenerateScreenshot callable) therefore
+ * uses a single long-timeout request with NO retry — see Task 5.
+ */
+export async function handleRegenerateScreenshot(req: Request, res: Response): Promise<void> {
+  const buildSecret = req.headers['x-build-service-secret'] as string | undefined;
+  const expectedSecret = process.env.BUILD_SERVICE_SECRET;
+  if (!expectedSecret) {
+    console.log(JSON.stringify({severity: 'ERROR', message: 'BUILD_SERVICE_SECRET not configured - rejecting /regenerate-screenshot'}));
+    res.status(500).json({error: 'Server misconfiguration'});
+    return;
+  }
+  if (!buildSecret || !secretsEqual(buildSecret, expectedSecret)) {
+    console.log(JSON.stringify({severity: 'ERROR', message: 'Unauthorized /regenerate-screenshot request', hasSecret: !!buildSecret}));
+    res.status(401).json({error: 'Unauthorized'});
+    return;
+  }
+
+  const {projectId, slug, buildId} = (req.body ?? {}) as {
+    projectId?: string; slug?: string; buildId?: string;
+  };
+  if (!projectId || typeof projectId !== 'string') {
+    res.status(400).json({error: 'invalid_projectId'});
+    return;
+  }
+  if (!slug || typeof slug !== 'string' || !SLUG_RE.test(slug)) {
+    res.status(400).json({error: 'invalid_slug'});
+    return;
+  }
+  if (!buildId || typeof buildId !== 'string') {
+    res.status(400).json({error: 'invalid_buildId'});
+    return;
+  }
+
+  const buildRef = getFirestore()
+    .collection('projects').doc(projectId)
+    .collection('builds').doc(buildId);
+
+  const snap = await buildRef.get();
+  if (!snap.exists) {
+    res.status(404).json({error: 'build_not_found'});
+    return;
+  }
+  const params = (snap.data()?.screenshotCapture ?? {}) as {
+    firstPagePath?: string; hostAtDocs?: boolean;
+  };
+  const firstPagePath = params.firstPagePath ?? 'introduction';
+  const hostAtDocs = params.hostAtDocs ?? true;
+
+  // Flip to 'capturing' so the dashboard shows the spinner (not Retry) while we
+  // work. Stamp the start time so the dashboard can fall back to Retry if this
+  // capture is stranded here (e.g. the instance dies before the terminal write).
+  await buildRef
+    .update({screenshotStatus: 'capturing', screenshotCapturingAt: Date.now()})
+    .catch(() => {});
+
+  try {
+    await captureAndStoreScreenshot({
+      slug,
+      buildId,
+      projectId,
+      siteUrl: `https://${slug}.jamdesk.app`,
+      hostAtDocs,
+      firstPagePath,
+      r2Client: getR2S3Client(),
+      r2Bucket: getR2Config().bucketName,
+    });
+    // captureAndStoreScreenshot has already written screenshotStatus ready|failed.
+    // (A soft capture failure returns void here and is written 'failed' by it.)
+    res.status(200).json({ok: true});
+  } catch (err) {
+    console.log(JSON.stringify({severity: 'ERROR', message: 'regenerate-screenshot capture threw', projectId, buildId, error: err instanceof Error ? err.message : String(err)}));
+    await buildRef.update({screenshotStatus: 'failed'}).catch(() => {});
+    res.status(502).json({error: 'capture_failed'});
+  }
+}

package/vendored/lib/rehype-class-to-classname.ts

@@ -10,21 +10,22 @@ import type { Root, Element } from 'hast';
 export function rehypeClassToClassName() {
   return (tree: Root) => {
     visit(tree, 'element', (node: Element) => {
-      if (node.properties) {
-        // Check for both 'class' and 'className' as MDX might pass either
-        if ('class' in node.properties) {
-          const classValue = node.properties.class;
-          // Merge with existing className if present
-          if (node.properties.className) {
-            const existing = Array.isArray(node.properties.className) 
-              ? node.properties.className.join(' ') 
-              : node.properties.className;
-            node.properties.className = `${existing} ${classValue}`;
-          } else {
-            node.properties.className = classValue;
-          }
-          delete node.properties.class;
-        }
+      if (node.properties && 'class' in node.properties) {
+        // hast stores className as a space-separated token array, not a string.
+        // Split any incoming `class`/`className` value into tokens and merge, so
+        // the result satisfies the hast `Properties` type (the JSX runtime joins
+        // the array back into a string, so rendered output is unchanged).
+        const toTokens = (value: unknown): string[] =>
+          Array.isArray(value)
+            ? value.map(String)
+            : value == null
+              ? []
+              : String(value).split(/\s+/).filter(Boolean);
+        node.properties.className = [
+          ...toTokens(node.properties.className),
+          ...toTokens(node.properties.class),
+        ];
+        delete node.properties.class;
       }
     });
   };

package/vendored/lib/scanner-blocklist.ts

@@ -273,6 +273,29 @@ export function classifyScannerProbe(pathname: string): ScannerCategory | null {
   return null;
 }
 
+// Categories that are benign stale re-crawls of dead URLs, not hostile
+// probes. Two consumers key off this set:
+//   - the middlewares answer them 410 Gone instead of 404 — 410 is the
+//     permanent-removal signal, so well-behaved crawlers evict the URL
+//     from their index instead of replaying it forever;
+//   - the scanner-block digest keeps them out of the per-IP WAF-candidate
+//     table (they would show up every window as noise) and reports them
+//     only as a category-count line.
+// Never WAF-promote a category in this set.
+export const BENIGN_SCANNER_CATEGORIES: ReadonlySet<ScannerCategory> = new Set(
+  ['legacy-content'],
+);
+
+// Response for a blocked probe. Hostile probes get the plain 404 so the
+// block is indistinguishable from a nonexistent path.
+export function scannerBlockResponse(
+  category: ScannerCategory,
+): { status: 404 | 410; body: string } {
+  return BENIGN_SCANNER_CATEGORIES.has(category)
+    ? { status: 410, body: 'Gone' }
+    : { status: 404, body: 'Not Found' };
+}
+
 const LOG_PREFIX = '[middleware] scanner-block';
 
 export type ClientIpSource = 'x-real-ip' | 'x-forwarded-for' | 'none';

package/vendored/lib/screenshot-capture.ts

@@ -31,9 +31,64 @@ interface CaptureResult {
 }
 
 // Headroom for the retry path: two 15s page.goto budgets + 3s settle wait
-// already total 33s before the screenshot is even taken.
+// already total 33s before the screenshot is even taken. Launch retries
+// (closed-target only) fail fast (<~2s) so they stay inside this 45s race.
 const SCREENSHOT_TIMEOUT_MS = 45000;
 
+// Playwright launch flakes intermittently in the container — the Chromium
+// process is reaped during the CDP handshake, surfacing as one of a few
+// transient phrasings. Retry ONLY these. Do NOT match the generic
+// "browserType.launch:" prefix — it also fronts permanent failures like
+// "Executable doesn't exist", which must fail fast, not burn the 45s budget.
+// Observed in prod logs: "Target page, context or browser has been closed".
+// The crashed/disconnected/Protocol-error variants are the same reaped-process
+// failure under load and are equally safe to retry.
+const RETRIABLE_LAUNCH_RE =
+  /browser has been closed|browser has disconnected|Target (page, context or browser has been closed|closed|crashed)|Target crashed|Protocol error/i;
+
+function defaultChromiumLaunch(): Promise<Browser> {
+  return chromium.launch({
+    // Undefined → Playwright uses its own bundled, version-matched Chromium
+    // (see Dockerfile). The env override stays as an escape hatch for envs
+    // that must point at a system binary. Do NOT hardcode /usr/bin/chromium:
+    // the unpinned apt chromium drifted out of sync with Playwright and
+    // SIGTRAPped at launch (2026-07-08 capture outage).
+    executablePath: process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH || undefined,
+    args: ['--no-sandbox', '--disable-setuid-sandbox'],
+    // 8s (not 10s) so 3 hung launches (~24s) + backoff still leave headroom
+    // for a page.goto inside the 45s outer race. Closed-target flakes reject
+    // near-instantly in practice, so this only bounds the pathological case.
+    timeout: 8000,
+  });
+}
+
+export async function launchChromiumWithRetry(
+  launch: () => Promise<Browser> = defaultChromiumLaunch,
+  attempts = 3,
+  sleep: (ms: number) => Promise<void> = (ms) =>
+    new Promise((resolve) => setTimeout(resolve, ms)),
+): Promise<Browser> {
+  let lastError: unknown;
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      return await launch();
+    } catch (error) {
+      lastError = error;
+      const message = error instanceof Error ? error.message : String(error);
+      if (!RETRIABLE_LAUNCH_RE.test(message) || attempt === attempts) {
+        throw error;
+      }
+      const delayMs = 500 * 2 ** (attempt - 1); // 500ms, 1000ms
+      console.log(
+        `Chromium launch attempt ${attempt} failed (${message}); ` +
+          `retrying in ${delayMs}ms`,
+      );
+      await sleep(delayMs);
+    }
+  }
+  throw lastError;
+}
+
 /**
  * Clean up old screenshots for a project, keeping only the current build's screenshot.
  * This prevents R2 storage from accumulating old screenshots.
@@ -121,12 +176,18 @@ export async function captureHomepageScreenshot(options: CaptureOptions): Promis
     });
 
     const capturePromise = async (): Promise<CaptureResult> => {
-      // Launch browser with system Chromium
-      browser = await chromium.launch({
-        executablePath: process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH || '/usr/bin/chromium',
-        args: ['--no-sandbox', '--disable-setuid-sandbox'],
-        timeout: 10000, // 10s browser launch timeout
-      });
+      // Launch browser with system Chromium (retry transient launch flakes)
+      browser = await launchChromiumWithRetry();
+
+      // The 45s outer race can fire while a retry is mid-backoff; if it already
+      // timed out, close the just-launched browser now so the retry path can't
+      // strand a Chromium process (the finally-block cleanup ran with browser
+      // still null). Widened by retry latency, so guard it explicitly.
+      if (timedOut) {
+        await browser.close().catch(() => {});
+        browser = null;
+        return { screenshotUrl: null, error: 'Screenshot capture timed out' };
+      }
 
       const page = await browser.newPage();
       await page.setViewportSize({ width: 1280, height: 720 });
@@ -222,22 +283,45 @@ interface CaptureAndStoreOptions extends CaptureOptions {
  * This is the main entry point called from build.ts after build completion.
  * Fire-and-forget - does NOT block build completion.
  */
-export async function captureAndStoreScreenshot(options: CaptureAndStoreOptions): Promise<void> {
-  const { projectId, ...captureOptions } = options;
-  const result = await captureHomepageScreenshot(captureOptions);
+export async function captureAndStoreScreenshot(
+  options: CaptureAndStoreOptions,
+  capture: (o: CaptureOptions) => Promise<CaptureResult> = captureHomepageScreenshot,
+): Promise<void> {
+  const {projectId, ...captureOptions} = options;
+  const buildRef = getFirestore()
+    .collection('projects')
+    .doc(projectId)
+    .collection('builds')
+    .doc(options.buildId);
+
+  // Persist the exact params so a later /regenerate-screenshot can reuse them
+  // without re-reading docs.json (which is unavailable in the Cloud Run server).
+  const screenshotCapture = {
+    firstPagePath: captureOptions.firstPagePath,
+    hostAtDocs: captureOptions.hostAtDocs,
+  };
+
+  const result = await capture(captureOptions);
 
   if (!result.screenshotUrl) {
-    if (result.error) console.log(`Screenshot skipped: ${result.error}`);
+    if (result.error) console.log(`Screenshot failed: ${result.error}`);
+    // Record the definitive failure so the dashboard can offer Retry instead of
+    // spinning forever. Non-fatal: never throw back into the build.
+    await buildRef
+      .update({screenshotStatus: 'failed', screenshotCapture})
+      .catch((err) => console.warn('Failed to record screenshotStatus:failed:', err));
     return;
   }
 
-  const db = getFirestore();
-  await db
-    .collection('projects')
-    .doc(projectId)
-    .collection('builds')
-    .doc(options.buildId)
-    .update({ screenshotUrl: result.screenshotUrl });
+  await buildRef.update({
+    screenshotUrl: result.screenshotUrl,
+    screenshotStatus: 'ready',
+    screenshotCapture,
+    // Real capture time. The dashboard folds this into its cache-bust query
+    // param so a same-URL regenerate (same buildId → same key) still busts the
+    // browser cache and re-renders; it also gives onSnapshot a changed field.
+    screenshotUpdatedAt: Date.now(),
+  });
 
   console.log(`Screenshot saved: ${result.screenshotUrl}`);
 }