jamdesk 1.1.166 → 1.1.168

package/vendored/lib/middleware-helpers.ts

@@ -15,11 +15,12 @@ import {
   isSubdomain,
 } from './project-resolver';
 import { redis } from './redis';
-import { getDomainMapping, getDomainStatus, getProjectInactive } from './cached-redis';
-import { getForwardedHosts, isJamdeskDomain } from './domain-helpers';
+import { getDomainConfig, getDomainMapping, getDomainStatus, getProjectInactive } from './cached-redis';
+import { getForwardedHosts, isJamdeskDomain, normalizeForwardedHost, parseRedisConfig } from './domain-helpers';
 import { getRedirects, matchRedirect, mergeQueryStrings, isInvalidDestination } from './redirect-matcher';
 import { ASSET_PREFIX } from './docs-types';
 import { extractLanguageFromPath } from './language-utils';
+import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 
 /**
@@ -77,6 +78,13 @@ export interface ProjectResolutionResult {
    * URL indexing — the upstream subdomain is not the public face).
    */
   customDomain?: string;
+  // NOTE: there is deliberately no `customDomainOnly` here. The gate
+  // (`customDomainOnlyBlock`) re-derives it from `getProjectConfig(slug)` on
+  // purpose — one of its call sites has only a slug parsed out of the URL, and
+  // a gate that trusts a caller-supplied resolution is a gate that diverges
+  // from the one the other call site enforces. Do not add the field back "to
+  // save a Redis read": the read is TtlCached, and the field would be an
+  // invitation to trust it.
 }
 
 /**
@@ -880,3 +888,258 @@ export function getAssetsApiPath(pathname: string): string {
     .replace(/^public\//, '');
   return `/api/assets/${assetPath}`;
 }
+
+/**
+ * Domain-side validation for the canonical override.
+ *
+ * `resolution.customDomain` is a projectCfg-side MIRROR: registerDomain
+ * writes it PRE-verification, and clearCustomDomainOnRemove's best-effort
+ * Redis delete can fail — so the mirror alone can be premature (domain
+ * never activated) or stale (domain removed). The DOMAIN-side records
+ * (`domain:<host>`, `domainStatus:<host>`, `domainCfg:<host>`) are written
+ * only at activation and deleted on removal, so they are the source of
+ * truth:
+ *   - the mapping must point back at this project, and
+ *   - domainStatus must be 'active' (or 'cached', mirroring how
+ *     handleProjectResolution treats domainStatus).
+ *
+ * Returns null when validation fails — stale/premature mirror, or a
+ * transient Redis error (never break the request over a canonical tag).
+ * On success returns the domain's OWN serving mode from domainCfg
+ * (hostAtDocs defaults true when the field is absent, mirroring
+ * resolveCustomDomain), or `{ hostAtDocs: undefined }` when the domainCfg
+ * record is missing entirely (legacy domains) so the caller preserves the
+ * projectCfg-derived URL shape.
+ *
+ * Hot-path note: all three reads go through the TtlCache-fronted
+ * cached-redis helpers (60s positive TTL, single-flight), batched into one
+ * parallel round-trip — at most one Redis fetch per domain per instance
+ * per TTL window.
+ *
+ * Lives here (not proxy.ts) because `customDomainOnlyBlock` below needs it
+ * too — a helper used from two modules belongs in the shared one.
+ * `proxy.ts` re-exports it so existing imports keep resolving.
+ */
+export async function validateCanonicalDomain(
+  customDomain: string,
+  projectSlug: string | null,
+): Promise<{ hostAtDocs: boolean | undefined } | null> {
+  try {
+    const [mapping, status, cfgRaw] = await Promise.all([
+      getDomainMapping(customDomain),
+      getDomainStatus(customDomain),
+      getDomainConfig(customDomain),
+    ]);
+    if (!projectSlug || mapping !== projectSlug) {
+      log('warn', '[canonical-domain-stale]', { customDomain, projectSlug, mapping });
+      return null;
+    }
+    if (status !== 'active' && status !== 'cached') {
+      log('warn', '[canonical-domain-inactive]', { customDomain, projectSlug, status });
+      return null;
+    }
+    const cfg = parseRedisConfig(cfgRaw);
+    if (!cfg) return { hostAtDocs: undefined };
+    return { hostAtDocs: cfg.hostAtDocs !== false };
+  } catch (e) {
+    log('warn', '[canonical-domain-check-failed]', { customDomain, error: (e as Error).message });
+    return null;
+  }
+}
+
+// ─────────────────────────────────────────────────────────────────────────
+// "Custom domain only" mode
+//
+// When a project turns this on, a direct hit on <slug>.jamdesk.app 404s unless
+// the request looks like it came through the customer's reverse proxy.
+//
+// This is VISIBILITY control, not ACCESS control: the marker below is a
+// public, documented constant that anyone can append. It keeps crawlers,
+// slug-guessers and idle clicks off the bare subdomain. Customers who need
+// real access control use password protection — which the code below must
+// never, ever bypass.
+// ─────────────────────────────────────────────────────────────────────────
+
+/**
+ * The public query marker a reverse proxy appends when it cannot set a request
+ * header. Vercel `rewrites` — the shape the dashboard hands out, and the shape
+ * most Next.js customers use — can carry a query param in the destination but
+ * CANNOT set an upstream header. This exists for them.
+ *
+ * Namespaced on purpose: a bare `proxy` would collide with a customer's own
+ * query params. DOCUMENTED AND PUBLIC — changing this string breaks every
+ * deployed customer rewrite.
+ */
+export const PROXY_MARKER_PARAM = 'jd_proxy';
+
+/**
+ * Read the marker and strip it from the URL in one shot, at a single
+ * chokepoint, before anything downstream reads the query string.
+ *
+ * Stripping matters because `request.nextUrl` feeds redirect Locations
+ * (trailing-slash, hostAtDocs) and the auth gate's `redirectFrom`. Left in, the
+ * marker bounces back to the browser on the customer's own domain, their proxy
+ * re-appends it, and it accumulates. It is not a secret — this is hygiene.
+ *
+ * CAVEAT: this mutates `request.nextUrl`, which NextResponse.next() does not
+ * propagate as a URL rewrite. Middleware-internal consumers see the stripped
+ * URL; the rendered page's own `searchParams` may still contain the marker.
+ * See the Test Strategy's manual-verification list.
+ *
+ * A present-but-wrong value (`?jd_proxy=yes`) is NOT proxied, but is still
+ * stripped.
+ */
+export function consumeProxyMarker(request: NextRequest): boolean {
+  const raw = request.nextUrl.searchParams.get(PROXY_MARKER_PARAM);
+  if (raw === null) return false;
+  request.nextUrl.searchParams.delete(PROXY_MARKER_PARAM);
+  return raw === '1';
+}
+
+/**
+ * Extensions that carry no documentation content and are fetched cross-origin
+ * from <slug>.jamdesk.app by things that cannot attach a marker: the
+ * dashboard's site-preview <img>, and the editor preview's <base href> image
+ * loads (a root-relative `/images/x.png` ignores any query on the base href, so
+ * there is no marker to give it).
+ *
+ * `.pdf` is DELIBERATELY ABSENT. isAssetRequest() includes it, but a PDF in a
+ * customer's repo is documentation content — exempting it would leave a
+ * content-shaped hole in the gate. Do not reuse isAssetRequest() here.
+ * Derived from ASSET_EXTENSIONS so a future asset type can't silently be in
+ * one list and not the other — only the .pdf carve-out may differ.
+ */
+const PRESENTATION_EXTENSIONS = ASSET_EXTENSIONS.filter((ext) => ext !== '.pdf');
+
+export function isPresentationAsset(pathname: string): boolean {
+  // Lowercase first: /_jd/images/HERO.JPG is served today (isAssetRequest matches
+  // by prefix, not extension), so the gate must not 404 it.
+  const p = pathname.toLowerCase();
+  return PRESENTATION_EXTENSIONS.some((ext) => p.endsWith(ext));
+}
+
+/**
+ * Should this request be 404'd because the project serves from its custom
+ * domain only? Returns the response to send, or null to continue.
+ *
+ * Called from THREE places in proxy.ts, because the middleware early-exits
+ * before its main body for the content-bearing internal API routes:
+ *
+ *   1. the internal-API block — /api/{chat,mcp,r2}/{slug}, which skip
+ *      shouldRunMiddleware and carry raw MDX, MCP, and RAG chat. A gate that
+ *      misses these does nothing at all. (/api/docs-search is intentionally
+ *      NOT covered here — it's an API-key-authenticated REST endpoint, not a
+ *      cookie-gated one; see the internalAuthMatch comment in proxy.ts.)
+ *   2. the /api/assets branch — same early-exit, but the slug comes from the
+ *      HOST, not the path (the route otherwise trusts a client-supplied
+ *      x-project-slug). Presentation assets self-exempt below; `.pdf` does
+ *      not, which is the whole point of that branch.
+ *   3. the main body — every page and content artifact.
+ *
+ * The helper is async and self-contained ON PURPOSE: it re-derives the custom
+ * domain from Redis rather than trusting a caller-supplied resolution. The
+ * call sites have very different context (one has only a slug parsed out of the
+ * URL), and a helper that trusts its caller is a helper that diverges. The
+ * reads are TtlCached. This is also why ProjectResolutionResult carries no
+ * customDomainOnly field — see the note there.
+ *
+ * FAIL OPEN: blocks only when validateCanonicalDomain() confirms, live from
+ * Redis, that the custom domain maps back to this slug and is active/cached.
+ * Broken DNS, a removed domain, or a Redis outage all fail that check and the
+ * subdomain keeps serving. A customer can never lock themselves out.
+ */
+// Body for the custom-domain-only 404 when a human lands on the bare
+// subdomain. Deliberately Jamdesk-branded, never tenant-branded — the
+// project's name or logo here would leak exactly the association the
+// feature exists to hide. Palette mirrors marketing/app/globals.css.
+const CUSTOM_DOMAIN_ONLY_404_HTML = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex, nofollow">
+<title>Page not found</title>
+<style>
+  :root { --bg:#faf8f5; --text:#1b3139; --muted:#5a6f77; --accent:#ff3621; --accent-hover:#eb1600; }
+  @media (prefers-color-scheme: dark) {
+    :root { --bg:#141b1e; --text:#e8eef1; --muted:#8fa8b3; }
+  }
+  * { margin:0; padding:0; box-sizing:border-box; }
+  body { min-height:100vh; display:flex; align-items:center; justify-content:center; background:var(--bg); color:var(--text); font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif; text-align:center; padding:24px; }
+  main { max-width:26rem; }
+  .mark { font-size:1.1rem; font-weight:700; letter-spacing:-0.01em; margin-bottom:2.5rem; }
+  h1 { font-size:1.5rem; font-weight:600; letter-spacing:-0.02em; margin-bottom:0.75rem; }
+  p { color:var(--muted); line-height:1.6; margin-bottom:2rem; }
+  a.home { display:inline-block; background:var(--accent); color:#fff; text-decoration:none; font-weight:600; font-size:0.95rem; padding:0.65rem 1.4rem; border-radius:8px; }
+  a.home:hover { background:var(--accent-hover); }
+</style>
+</head>
+<body>
+<main>
+  <div class="mark">Jamdesk</div>
+  <h1>Page not found</h1>
+  <p>There&rsquo;s nothing at this address.</p>
+  <a class="home" href="https://www.jamdesk.com">Go to jamdesk.com</a>
+</main>
+</body>
+</html>
+`;
+
+export async function customDomainOnlyBlock(args: {
+  request: NextRequest;
+  slug: string;
+  pathname: string;
+  hasProxyMarker: boolean;
+}): Promise<NextResponse | null> {
+  const { request, slug, pathname, hasProxyMarker } = args;
+
+  // Platform kill switch — a per-project Redis write is not an incident
+  // response. Tolerant of any truthy value except '0'/'false' (operators
+  // shouldn't have to remember a magic string mid-incident) and trimmed
+  // (Vercel env values can pick up trailing newlines — see CLAUDE.md
+  // ISR_MODE incident). Mirrors isCacheDisabled() in lib/cached-redis.ts;
+  // inlined rather than imported to avoid dragging that module's AWS SDK
+  // deps into the edge bundle.
+  const disabled = process.env.JD_CUSTOM_DOMAIN_ONLY_DISABLED?.trim().toLowerCase();
+  if (disabled && disabled !== '0' && disabled !== 'false') return null;
+
+  if (hasProxyMarker) return null;
+  if (isPresentationAsset(pathname)) return null;
+
+  // Not a bare-subdomain hit: the request arrived on the custom domain itself.
+  const hostname = request.headers.get('host') || '';
+  if (!isJamdeskDomain(hostname)) return null;
+
+  // Proxied by an edge that can set headers (CF worker, nginx, Apache, Caddy,
+  // HAProxy). Exactly as strong as the public marker — the header is spoofable
+  // and is NOT an auth boundary. Do not "harden" this; see the plan.
+  // Normalized the same way every other consumer in this file reads this
+  // header (lowercase, port stripped, first-of-comma-chain) — a raw read
+  // would let `acme.jamdesk.app:443`/`ACME.JAMDESK.APP` fail isJamdeskDomain
+  // and open the gate.
+  const forwardedHost = normalizeForwardedHost(request.headers.get('x-jamdesk-forwarded-host'));
+  if (forwardedHost && !isJamdeskDomain(forwardedHost)) return null;
+
+  const cfg = await getProjectConfig(slug);
+  if (cfg.customDomainOnly !== true) return null;
+  if (!cfg.customDomain) return null;
+
+  const domain = await validateCanonicalDomain(cfg.customDomain, slug);
+  if (!domain) return null; // FAIL OPEN
+
+  // log() emits single-line JSON, satisfying the monorepo edge-logging rule.
+  log('info', '[custom-domain-only]', { slug, pathname, host: hostname });
+
+  // Humans get the branded page; API consumers of this same gate (MCP,
+  // chat, /api/assets) keep the terse text body so nothing has to parse
+  // HTML. Status and the noindex/no-store headers are identical either way.
+  const wantsHtml = (request.headers.get('accept') || '').includes('text/html');
+  return new NextResponse(wantsHtml ? CUSTOM_DOMAIN_ONLY_404_HTML : 'Not Found', {
+    status: 404,
+    headers: {
+      'X-Robots-Tag': 'noindex, nofollow',
+      'Cache-Control': 'no-store',
+      ...(wantsHtml ? { 'Content-Type': 'text/html; charset=utf-8' } : {}),
+    },
+  });
+}

package/vendored/lib/openapi/patch-openapi-schemas-runtime.ts

@@ -0,0 +1,83 @@
+/**
+ * Runtime (in-memory) self-heal for two defects in
+ * @apidevtools/openapi-schemas@2.1.0's bundled OpenAPI 3.1 meta-schema.
+ *
+ * Why runtime: npm 12 blocks lifecycle scripts not covered by `allowScripts`
+ * (only a `warn install-scripts` line, exit 0), so the package postinstall
+ * (scripts/patch-openapi-schemas.js) can no longer be relied on to have
+ * patched the on-disk schema — the 2026-07-13 `jamdesk dev` failure on a
+ * valid spec was exactly this. swagger-parser's validator reads the schema
+ * from this module singleton (lib/validators/schema.js:
+ * `const { openapi } = require("@apidevtools/openapi-schemas")`), and
+ * require() of JSON returns a cached mutable object — so fixing
+ * `openapi.v31` in place heals every subsequent SwaggerParser.validate()
+ * in this process regardless of installer, script blocking, or file
+ * permissions. Disk is never touched.
+ *
+ * Defect 1 — server-variable typo: `properties` declares `descriptions`
+ * (plural). With `unevaluatedProperties: false` on the same def, every
+ * spec-valid `description` is rejected with
+ *   "#/servers/N/variables/<name> must NOT have unevaluated properties".
+ * Defect 2 — license over-constraint: `oneOf` forces identifier|url;
+ * OpenAPI 3.1 §4.8.4 requires only `name`. Correct guard:
+ *   `not: { required: ['identifier', 'url'] }`.
+ *
+ * Sync chain (drift-guarded by
+ * cli/src/__tests__/unit/openapi-schema-patch-sync.test.ts): this file,
+ * cli/src/lib/openapi/patch-openapi-schemas-runtime.ts, both package
+ * postinstall scripts, and patchWorkspaceOpenApiSchemas() in
+ * cli/src/lib/deps.ts. If you change one, change all five source sites
+ * (the vendored copy under cli/vendored/ is regenerated by `npm run
+ * vendor` and drift-guarded as a sixth).
+ */
+import { openapi } from '@apidevtools/openapi-schemas';
+
+type SchemaDef = {
+  properties?: Record<string, unknown>;
+  oneOf?: unknown;
+  not?: unknown;
+};
+
+/**
+ * @returns true when the schema is in the known-good healed state after the
+ * call; false when the heal could not verify it (upstream reshape, missing
+ * $defs). Callers warn on false so a real user failure is debuggable instead
+ * of reproducing the original opaque validation error.
+ *
+ * The tripwire catches upstream reshapes ONLY. It cannot detect a split module
+ * instance — if `openapi-schemas` resolves to two copies, this heals and
+ * verifies one of them and still returns true while swagger-parser reads the
+ * other. A single instance rests on TWO guarantees, both of which must hold:
+ *   (a) physical copy: the exact `2.1.0` pin (cli + build-service +
+ *       REQUIRED_DEPS) plus npm dedup against swagger-parser's own range, so
+ *       node_modules never contains a second nested copy;
+ *   (b) bundler copy: `@apidevtools/openapi-schemas` stays in
+ *       `serverExternalPackages` alongside `@apidevtools/swagger-parser` in
+ *       EVERY Next config (build-service/next.config.mjs,
+ *       cli/config/next.config.js), so Next never bundles one while
+ *       externalizing the other. (npm dedup does nothing about a
+ *       bundler-created duplicate — that is a separate failure mode.)
+ * Break either one and the heal silently patches a duplicate, returns true,
+ * and validation regresses to the original opaque error.
+ */
+export function patchOpenApiSchemasInMemory(): boolean {
+  const v31 = (openapi as unknown as { v31?: { $defs?: Record<string, SchemaDef> } }).v31;
+  if (!v31?.$defs) return false; // Unexpected upstream shape — leave alone.
+
+  const props = v31.$defs['server-variable']?.properties;
+  if (props && !props.description && props.descriptions) {
+    props.description = props.descriptions;
+    delete props.descriptions;
+  }
+
+  const license = v31.$defs.license;
+  if (license && Array.isArray(license.oneOf)) {
+    delete license.oneOf;
+    license.not = { required: ['identifier', 'url'] };
+  }
+
+  // `license` must EXIST and be oneOf-free. Asserting only `!oneOf` would
+  // report healthy when upstream drops the license def entirely (undefined
+  // has no `.oneOf`) — exactly the reshape class this tripwire guards.
+  return Boolean(props?.description) && Boolean(license) && !license.oneOf;
+}

package/vendored/lib/openapi/validator.ts

@@ -11,6 +11,25 @@ import path from 'path';
 import type { OpenAPI } from 'openapi-types';
 import type { ValidationResult, OpenApiValidationError } from './types';
 import { formatOpenApiError, createFileNotFoundError } from './errors';
+import { patchOpenApiSchemasInMemory } from './patch-openapi-schemas-runtime';
+import { logger } from '../../shared/logger';
+
+/**
+ * The self-heal tripwire warn is per-process, not per-spec: validateOpenApiSpecs()
+ * loops over every spec in docs.json, and a schema that can't be verified once
+ * can't be verified for any of them — without this flag a project with N specs
+ * logs the identical warning N times.
+ */
+let selfHealWarned = false;
+
+function warnSelfHealOnce(): void {
+  if (selfHealWarned) return;
+  selfHealWarned = true;
+  logger.warn(
+    '[jamdesk] OpenAPI 3.1 meta-schema self-heal could not verify the expected schema shape; ' +
+      'validation may falsely reject server-variable descriptions or name-only licenses.'
+  );
+}
 
 /**
  * Detect OpenAPI version from a parsed spec
@@ -82,6 +101,15 @@ export async function validateOpenApiSpec(
   specPath: string,
   projectDir: string
 ): Promise<ValidationResult> {
+  // Self-heal the 3.1 meta-schema before every validation: postinstall may
+  // never have run (npm 12 blocks install scripts by default). Idempotent,
+  // O(1) after the first call. A false return = heal couldn't verify the
+  // schema shape — warn (once per process) so users don't hit the original
+  // opaque error blind.
+  if (!patchOpenApiSchemasInMemory()) {
+    warnSelfHealOnce();
+  }
+
   const isUrl = specPath.startsWith('http://') || specPath.startsWith('https://');
 
   let target: string;

package/vendored/lib/project-resolver.ts

@@ -107,6 +107,14 @@ export async function resolveCustomDomain(hostname: string): Promise<DomainResol
 export interface ProjectCfg {
   hostAtDocs: boolean;
   customDomain?: string;
+  /**
+   * "Custom domain only" — when true, a direct hit on <slug>.jamdesk.app is
+   * 404'd unless it looks proxied. Visibility control, NOT access control: the
+   * ?jd_proxy=1 marker that satisfies it is a public constant. Only ever
+   * enforced when the project's custom domain passes live Redis validation, so
+   * a broken domain fails OPEN.
+   */
+  customDomainOnly?: boolean;
 }
 
 /**
@@ -134,6 +142,7 @@ export async function getProjectConfig(projectSlug: string): Promise<ProjectCfg>
     return {
       hostAtDocs: cfg?.hostAtDocs === true,
       customDomain: typeof cfg?.customDomain === 'string' ? cfg.customDomain : undefined,
+      customDomainOnly: cfg?.customDomainOnly === true,
     };
   } catch {
     return { hostAtDocs: false };
@@ -160,6 +169,7 @@ export async function getProjectConfigStrict(projectSlug: string): Promise<Proje
   return {
     hostAtDocs: cfg?.hostAtDocs === true,
     customDomain: typeof cfg?.customDomain === 'string' ? cfg.customDomain : undefined,
+    customDomainOnly: cfg?.customDomainOnly === true,
   };
 }
 

package/vendored/lib/screenshot-capture.ts

@@ -148,7 +148,13 @@ export async function captureHomepageScreenshot(options: CaptureOptions): Promis
   const { slug, buildId, siteUrl, hostAtDocs, firstPagePath, r2Client, r2Bucket } = options;
 
   // For hostAtDocs sites, homepage is at /docs/{firstPagePath}; otherwise /{firstPagePath}
-  const homepageUrl = hostAtDocs ? `${siteUrl}/docs/${firstPagePath}` : `${siteUrl}/${firstPagePath}`;
+  //
+  // The bare subdomain 404s for projects in custom-domain-only mode, so the
+  // capture must look proxied. Subresources (CSS/JS/fonts/images) carry no
+  // marker but are exempt or middleware-skipped — see the subresource test in
+  // __tests__/proxy-custom-domain-only.test.ts.
+  const homepagePath = hostAtDocs ? `/docs/${firstPagePath}` : `/${firstPagePath}`;
+  const homepageUrl = `${siteUrl}${homepagePath}?jd_proxy=1`;
 
   let browser: Browser | null = null;
   let timeoutId: NodeJS.Timeout | null = null;

package/vendored/next.config.js

@@ -47,10 +47,22 @@ const nextConfig = {
     ],
   },
   // Keep swagger-parser external (uses Node.js APIs).
+  // @apidevtools/openapi-schemas MUST stay external alongside it — the pairing
+  // is load-bearing, not cosmetic. patchOpenApiSchemasInMemory() heals the
+  // openapi-schemas module singleton that swagger-parser reads at validate()
+  // time; if one package is external and the other is bundled, Next produces
+  // TWO module instances and the self-heal patches a bundled duplicate,
+  // verifies THAT copy, and returns true while swagger-parser keeps reading
+  // the untouched node_modules copy — a silent no-op that reports success.
+  // Pinned by build-service/__tests__/next-config-external-packages.test.ts.
   // @terrastruct/d2 ships a WASM binary; keep it external so it loads from
   // node_modules at runtime instead of being bundled by Turbopack — the
   // same mitigation pattern used for the Shiki/oniguruma WASM landmine.
-  serverExternalPackages: ['@apidevtools/swagger-parser', '@terrastruct/d2'],
+  serverExternalPackages: [
+    '@apidevtools/swagger-parser',
+    '@apidevtools/openapi-schemas',
+    '@terrastruct/d2',
+  ],
   // Turbopack config - only resolveAlias, NOT root (root causes caching issues)
   turbopack: {
     resolveAlias: {

package/vendored/workspace-package-lock.json

@@ -6,7 +6,8 @@
     "": {
       "name": "jamdesk-workspace",
       "dependencies": {
-        "@apidevtools/swagger-parser": "^12.1.0",
+        "@apidevtools/openapi-schemas": "2.1.0",
+        "@apidevtools/swagger-parser": "12.1.0",
         "@babel/standalone": "^8.0.4",
         "@fortawesome/fontawesome-svg-core": "^7.1.0",
         "@fortawesome/free-brands-svg-icons": "^7.1.0",
@@ -2040,9 +2041,9 @@
       }
     },
     "node_modules/autoprefixer": {
-      "version": "10.5.2",
-      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.2.tgz",
-      "integrity": "sha512-rD5t5DwOjJdmSORcTq64j8MawTC+tbQ+HHqjR4NDumamy/ambn1UJrlKL+KdwujWxMkFjPM3pPHOEA9tl4767Q==",
+      "version": "10.5.3",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.3.tgz",
+      "integrity": "sha512-bJRzflk8GgE4JX+iZNEwz9f9p460NCHnU7bd+CZ9vIjIlZuTkt6F3WSl2oNO8StZBFx17nLEsiQ6H2wcZiY7nA==",
       "funding": [
         {
           "type": "opencollective",
@@ -2059,8 +2060,8 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "browserslist": "^4.28.4",
-        "caniuse-lite": "^1.0.30001799",
+        "browserslist": "^4.28.6",
+        "caniuse-lite": "^1.0.30001805",
         "fraction.js": "^5.3.4",
         "picocolors": "^1.1.1",
         "postcss-value-parser": "^4.2.0"
@@ -2889,9 +2890,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.389",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.389.tgz",
-      "integrity": "sha512-cEto7aeOqBfU1D+c5py5pE+ooscKE75JifxLBdFUZsqAxRS6y7kebtxAZvICszSl05gPjYHDTjY+lXpyGvpJbg==",
+      "version": "1.5.392",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.392.tgz",
+      "integrity": "sha512-1yQq3VQCZRwsnYc67Oc+1fge6Lwtn0hzi6zmEVkB61Zx21kTbwJAW4dFLadl5Rc1tKhG/kSpYXnfiAhu0f0a1g==",
       "license": "ISC"
     },
     "node_modules/enhanced-resolve": {

package/vendored/lib/sidebar-prefetch-walker.ts

@@ -1,50 +0,0 @@
-import type { ResolvedGroup } from '@/lib/navigation-resolver';
-
-/**
- * Flatten a resolved navigation tree to the list of hrefs that should be
- * prefetched under the existing group-engagement rule from Sidebar.tsx:
- *
- *   shouldPrefetch = level !== 0 || isExpanded || !group.name
- *
- * Children of a level-0 group emit only when that group is expanded.
- * Children of nameless or deeper-level groups always emit. Order matches
- * the rendered sidebar so paced prefetches mirror what a user is most
- * likely to click next.
- */
-export function getPrefetchableHrefs(
-  groups: ResolvedGroup[],
-  expandedGroups: Set<string>,
-  linkPrefix: string,
-  level: number = 0,
-): string[] {
-  const out: string[] = [];
-  const walk = (groups: ResolvedGroup[], level: number) => {
-    for (const group of groups) {
-      const isExpanded = expandedGroups.has(group.name);
-      const groupOpen = level !== 0 || isExpanded || !group.name;
-      if (!groupOpen) continue;
-
-      if (group.items) {
-        for (const item of group.items) {
-          if (item.type === 'page') {
-            out.push(`${linkPrefix}/${item.page.path}`);
-          } else if (item.type === 'group') {
-            walk([item.group], level + 1);
-          }
-        }
-      } else {
-        for (const page of group.pages) {
-          out.push(`${linkPrefix}/${page.path}`);
-        }
-        if (group.nested) walk(group.nested, level + 1);
-      }
-    }
-  };
-  walk(groups, level);
-
-  // Dedup: a docs.json config can reference the same page from two groups
-  // (uncommon but legal). Without this, the pacer fires router.prefetch()
-  // twice for the same href since scheduleNext walks the items array
-  // literally and `seen` is populated up-front, not within the chain.
-  return Array.from(new Set(out));
-}