jamdesk 1.1.189 → 1.1.190

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jamdesk",
-  "version": "1.1.189",
+  "version": "1.1.190",
   "description": "CLI for Jamdesk — build, preview, and deploy documentation sites from MDX. Dev server with hot reload, 50+ components, OpenAPI support, AI search, and Mintlify migration",
   "keywords": [
     "jamdesk",

package/vendored/app/api/markdown-export/[project]/[...slug]/route.ts

@@ -15,13 +15,12 @@ import {
 import { parseFrontmatterLenient } from '@/lib/frontmatter-utils';
 import { siteHasOpenApiSpecs } from '@/lib/api-specs-bundle';
 import { getContextualOptions } from '@/lib/contextual-defaults';
-import { isIsrMode, getBaseUrlFromConfig, getDocsSubpath } from '@/lib/page-isr-helpers';
+import { isIsrMode, getBaseUrl, getDocsSubpath } from '@/lib/page-isr-helpers';
 import { apiSpecsMarkdownFooter } from '@/lib/api-specs-markdown-hint';
 import { collectLocalSpecPaths } from '@/lib/openapi/operation-description';
 import { operationMarkdownForRef } from '@/lib/openapi/enrich-page-infos';
 import { injectAgentDirective } from '@/lib/agent-directive';
 import { logger } from '@/shared/logger';
-import { DEFAULT_DOCS_SUBPATH } from '@/shared/docs-subpath';
 import type { DocsConfig } from '@/lib/docs-types';
 import type { OpenAPI } from 'openapi-types';
 
@@ -113,7 +112,14 @@ export async function GET(
   // Arg order is load-bearing: `withDirective` is the agent-visible body the
   // footer is appended to; `raw` is the unfiltered source the helper reads
   // frontmatter from (visibility filtering never touches the leading YAML block).
-  const body = await withApiSpecsHint(withDirective, raw, project, config, docsPrefix);
+  const body = await withApiSpecsHint(
+    withDirective,
+    raw,
+    project,
+    config,
+    request.headers,
+    hostAtDocs,
+  );
 
   // Two paths reach this handler via proxy rewrite:
   //   (a) `.md` URL: unique CDN cache key, safe to share.
@@ -143,17 +149,24 @@ export async function GET(
  * in ISR. Non-fatal: any failure returns the markdown unchanged — it never throws
  * and never 500s an export.
  *
- * The URL is built from the server-known project slug (getBaseUrlFromConfig), not
- * request headers — so it's unspoofable, deterministic, and cache-safe. The
- * api-specs.zip route is registered at both `/` and `/docs`, so
- * `https://<slug>.jamdesk.app[/docs]/api-specs.zip` always resolves.
+ * The URL is built with `getBaseUrl` — the same helper the canonical and OG
+ * tags use — so the link points at the host the reader actually asked for. It
+ * reads only TRUSTED_PROXY_HEADERS (canonical host, forwarded host), which
+ * buildProjectHeaders strips from the inbound request, so it stays unspoofable.
+ *
+ * It used to hard-code `https://<slug>.jamdesk.app[/docs]` off the slug. Both
+ * hosts serve the zip today, so that read as a cosmetic choice — but a tenant
+ * with `customDomainOnly: true` 404s its own bare subdomain for anything that
+ * isn't a presentation asset, and `.zip` is not on that exemption list. The
+ * footer would have handed agents a dead link the moment a customer ticked it.
  */
 async function withApiSpecsHint(
   markdown: string,
   raw: string,
   project: string,
   config: DocsConfig | null,
-  docsPrefix?: string,
+  headers: Headers,
+  hostAtDocs: boolean,
 ): Promise<string> {
   try {
     if (!isIsrMode()) return markdown;
@@ -196,23 +209,16 @@ async function withApiSpecsHint(
       }
     }
 
-    // Config (fetched once in GET) drives the site-wide spec check, the
-    // menu-enabled check, and the hostAtDocs/docsPrefix link prefix. A
-    // failed/missing config must not block a page-level `openapi:` page
-    // (which qualifies on its own): treat it as "no site specs" but keep
-    // the default-enabled menu.
+    // Config (fetched once in GET) drives the site-wide spec check and the
+    // menu-enabled check. A failed/missing config must not block a page-level
+    // `openapi:` page (which qualifies on its own): treat it as "no site
+    // specs" but keep the default-enabled menu.
     //
-    // Only a CUSTOM prefix is passed through. '' and '/docs' keep deriving the
-    // base URL from `config.hostAtDocs` alone, exactly as before this route
-    // learned about subpaths — and since hostAtDocs is a runtime-only field
-    // that the stored docs.json never carries, that is the historical
-    // `https://<slug>.jamdesk.app/api-specs.zip`. Passing the middleware's
-    // '/docs' through instead would silently move every default tenant's zip
-    // link. Both shapes resolve (dotted paths skip the prefix redirects), so
-    // this is byte-identity, not correctness.
-    const customPrefix =
-      docsPrefix && docsPrefix !== DEFAULT_DOCS_SUBPATH ? docsPrefix : undefined;
-    const zipUrl = `${getBaseUrlFromConfig(project, !!config?.hostAtDocs, customPrefix)}/api-specs.zip`;
+    // getBaseUrl resolves the docs prefix from the same headers it resolves
+    // the host from, so a tenant at example.com/help gets
+    // `https://example.com/help/api-specs.zip` and a bare subdomain still gets
+    // the root. The zip route is registered at both `/` and `/<prefix>`.
+    const zipUrl = `${getBaseUrl(headers, project, hostAtDocs)}/api-specs.zip`;
 
     const footer = apiSpecsMarkdownFooter({
       isIsr: true,

package/vendored/lib/layout-helpers.tsx

@@ -492,6 +492,18 @@ export async function DocsChrome({
   const bannerContent = config.banner?.content?.trim() || '';
   const bannerNoFlash = !embed && !!bannerContent && config.banner?.dismissible === true && !!resolvedProjectSlug;
 
+  // SSR scroll lock, off under `next dev`. React 19 logs "Encountered a script
+  // tag while rendering React component" for any inline <script> in a
+  // component tree, and Next surfaces it as a full-screen console error on
+  // every docs page in `jamdesk dev` — the same reason the subdomain-error
+  // suppressor below is prod-gated. The lock only defends against Chrome's
+  // same-tab CROSS-ORIGIN scroll-restore heuristic, which needs a real prior
+  // origin, so dev loses nothing. The attribute and the bootstrap that
+  // releases it must move together: shipping the attribute without the script
+  // leaves #content-scroll-container permanently unscrollable.
+  // Read at render time (not module scope) so tests can exercise both arms.
+  const scrollLockEnabled = process.env.NODE_ENV !== 'development';
+
   // Font Awesome CSS uses preinit (not preload) so React 19 emits the
   // stylesheet link in <head> at SSR time. preinit (rather than a runtime
   // beforeInteractive <Script>/<link> injection) is what gets the @font-face
@@ -510,7 +522,7 @@ export async function DocsChrome({
   preinit(FA_CSS_HREF, { as: 'style' });
 
   return (
-    <html lang={toHreflang(lang)} dir={dir} suppressHydrationWarning data-scroll-behavior="smooth" data-scroll-locked="true">
+    <html lang={toHreflang(lang)} dir={dir} suppressHydrationWarning data-scroll-behavior="smooth" data-scroll-locked={scrollLockEnabled ? 'true' : undefined}>
       <head>
         {/* CMP scripts must be first + synchronous: auto-blocking CMPs
             (Osano/Termly) need to intercept later scripts. Never gated.
@@ -534,18 +546,22 @@ export async function DocsChrome({
           restore attempts hit a structurally non-scrollable element
           (scrollTop pinned to 0).
         */}
-        <script
-          dangerouslySetInnerHTML={{
-            __html: scrollLockBootstrap,
-          }}
-        />
-        {/* JS-off fallback — bootstrap can't unlock, so override the rule. */}
-        <noscript
-          dangerouslySetInnerHTML={{
-            __html:
-              '<style>html[data-scroll-locked] #content-scroll-container{overflow-y:auto !important;}</style>',
-          }}
-        />
+        {scrollLockEnabled && (
+          <>
+            <script
+              dangerouslySetInnerHTML={{
+                __html: scrollLockBootstrap,
+              }}
+            />
+            {/* JS-off fallback — bootstrap can't unlock, so override the rule. */}
+            <noscript
+              dangerouslySetInnerHTML={{
+                __html:
+                  '<style>html[data-scroll-locked] #content-scroll-container{overflow-y:auto !important;}</style>',
+              }}
+            />
+          </>
+        )}
         {/* Banner no-flash: hide a previously-dismissed (dismissible) banner
             before first paint. The <style> is inert until the script sets the
             attribute; the script is prod-gated like the analytics inline script. */}