jamdesk 1.1.203 → 1.1.205

package/vendored/app/(jd-system)/jd-inactive/page.tsx

@@ -5,8 +5,8 @@ import {BrandedInactive} from "./BrandedInactive";
 
 // Read project data from middleware-set headers per-request. We can't
 // use force-static because the proxy sets different headers for each
-// paused project (name, logo, custom-domain flag). The response is
-// still trivially cacheable at the edge with a short TTL.
+// paused project (name, logo). The response is still trivially
+// cacheable at the edge with a short TTL.
 export const dynamic = "force-dynamic";
 
 export default async function InactivePage() {
@@ -29,12 +29,10 @@ export default async function InactivePage() {
   // inactive-html.ts via sanitizeLogoUrl.
   const rawLogo = h.get("x-jd-project-logo");
   const logoUrl = rawLogo && isUrlSafe(rawLogo) ? rawLogo : undefined;
-  const hasCustomDomain = h.get("x-jd-custom-domain") === "1";
   return (
     <BrandedInactive
       projectName={projectName}
       logoUrl={logoUrl}
-      hasCustomDomain={hasCustomDomain}
     />
   );
 }

package/vendored/app/(unlock)/jd/auth/callback/CallbackClient.tsx

@@ -0,0 +1,33 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+
+/**
+ * The JWT arrives in the URL fragment (never sent to the server / logs).
+ * Exchange it for a session cookie via the POST endpoint, then continue to
+ * the original destination.
+ */
+export default function CallbackClient() {
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    const jwt = window.location.hash ? window.location.hash.slice(1) : '';
+    const redirect = new URLSearchParams(window.location.search).get('redirect') || '/';
+    if (!jwt) { setError('Missing token — please sign in again.'); return; }
+    // History hygiene: drop the fragment so the token can't be copied from the URL bar.
+    window.history.replaceState(null, '', window.location.pathname + window.location.search);
+    fetch('/_jd/api/auth/callback', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ jwt, redirect }),
+    })
+      .then(async (r) => {
+        const data = (await r.json()) as { ok?: boolean; redirect?: string };
+        if (r.ok && data.ok) window.location.replace(data.redirect || '/');
+        else setError('Sign-in failed — please try again from your login page.');
+      })
+      .catch(() => setError('Sign-in failed — please try again from your login page.'));
+  }, []);
+
+  return <p role="status">{error ?? 'Signing you in…'}</p>;
+}

package/vendored/app/(unlock)/jd/auth/callback/page.tsx

@@ -0,0 +1,15 @@
+import CallbackClient from './CallbackClient';
+
+export const dynamic = 'force-dynamic';
+
+export const metadata = {
+  robots: { index: false, follow: false },
+};
+
+export default function JwtCallbackPage() {
+  return (
+    <div style={{ display: 'flex', minHeight: '100vh', alignItems: 'center', justifyContent: 'center' }}>
+      <CallbackClient />
+    </div>
+  );
+}

package/vendored/app/(unlock)/jd/unlock/page.tsx

@@ -22,7 +22,11 @@ export default async function UnlockPage({ searchParams }: UnlockPageProps) {
 
   const config = slug ? await getDocsConfig(slug).catch(() => null) : null;
   const siteName = config?.name || 'Documentation';
-  const hint = config?.auth?.password?.hint || null;
+  // The gate rewrites jwt tenants here only when no usable loginUrl exists
+  // (missing, non-https, or one that would loop back into the gate). There
+  // is no password to type, so render an explainer instead of a dead-end form.
+  const jwtMode = config?.auth?.jwt?.enabled === true;
+  const hint = jwtMode ? null : config?.auth?.password?.hint || null;
   const primaryColor = config?.colors?.primary || '#635BFF';
   const logo = normalizeLogo(config?.logo, config?.assetVersion);
 
@@ -133,15 +137,33 @@ export default async function UnlockPage({ searchParams }: UnlockPageProps) {
               margin: 0,
             }}
           >
-            This site is private. Enter the password to continue.
+            {jwtMode
+              ? 'This site is private. Sign in through your organization to continue.'
+              : 'This site is private. Enter the password to continue.'}
           </p>
         </header>
 
-        <UnlockForm
-          from={from}
-          showError={showError}
-          primaryColor={primaryColor}
-        />
+        {jwtMode ? (
+          <p
+            style={{
+              fontSize: 14,
+              lineHeight: 1.5,
+              color: '#6b7280',
+              textAlign: 'center',
+              margin: 0,
+            }}
+          >
+            Access is granted by your organization&apos;s sign-in. If you arrived
+            here from a shared link, open the documentation from the application
+            that hosts it.
+          </p>
+        ) : (
+          <UnlockForm
+            from={from}
+            showError={showError}
+            primaryColor={primaryColor}
+          />
+        )}
 
         {hint && (
           <p

package/vendored/app/api/jd/auth/callback/route.ts

@@ -0,0 +1,103 @@
+/**
+ * POST /api/jd/auth/callback — JWT token-exchange endpoint.
+ *
+ * Node runtime only — jose EdDSA verification runs here. The client-side
+ * callback page (app/(unlock)/jd/auth/callback) extracts the JWT from the
+ * URL fragment (never sent to any server) and POSTs it here as a JSON body.
+ * On success, mints a v2 session cookie carrying the verified groups (and,
+ * budget permitting, playground inputs) and hands back the sanitized
+ * post-login redirect.
+ *
+ * Error ladder:
+ *   403 cross-site — the POST did not come from this origin (login-CSRF:
+ *       a cross-site POST would store an attacker-chosen session, groups and
+ *       playground inputs included, in the victim's cookie jar).
+ *   404 unknown-project / not-enabled — no slug header, or project isn't in
+ *       jwt mode (mirrors resolveAuth's null-on-off-or-wrong-mode contract).
+ *   400 bad-request — malformed JSON or missing/oversized jwt field.
+ *   401 <reason> — verifyDocsJwt rejected the token (invalid signature,
+ *       expired, host mismatch, etc.) — reason echoed from jwt-session.
+ *   503 unavailable — EDGE_AUTH_SECRET unset (never mint an unsigned
+ *       cookie) OR resolveAuth threw (Redis outage, fail closed).
+ *   401 session-too-large — verified, but even the groups-only cookie
+ *       exceeds the 4KB browser budget; refuse rather than set a cookie
+ *       that will be silently truncated or dropped.
+ */
+
+import { NextResponse } from 'next/server';
+import { resolveAuth, AuthResolutionError } from '@/lib/auth-resolver';
+import { verifyDocsJwt } from '@/lib/jwt-session';
+import { signAuthCookieV2 } from '@/shared/auth-cookie';
+import { sanitizeCallbackRedirect } from '@/lib/sanitize-from';
+import { isSameOriginRequest } from '@/lib/same-origin';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+function getRequestHost(req: Request): string {
+  // Same rule as the unlock route: customer reverse proxies forward the real
+  // public host in x-jamdesk-forwarded-host.
+  return req.headers.get('x-jamdesk-forwarded-host') || req.headers.get('host') || '';
+}
+
+export async function POST(req: Request): Promise<NextResponse> {
+  if (!isSameOriginRequest(req)) {
+    return NextResponse.json({ ok: false, error: 'cross-site' }, { status: 403 });
+  }
+  const slug = req.headers.get('x-project-slug');
+  const secret = process.env.EDGE_AUTH_SECRET;
+  if (!slug) return NextResponse.json({ ok: false, error: 'unknown-project' }, { status: 404 });
+  if (!secret) return NextResponse.json({ ok: false, error: 'unavailable' }, { status: 503 });
+
+  let body: { jwt?: unknown; redirect?: unknown };
+  try { body = await req.json(); } catch { return NextResponse.json({ ok: false, error: 'bad-request' }, { status: 400 }); }
+  if (typeof body.jwt !== 'string' || body.jwt.length === 0 || body.jwt.length > 8192) {
+    return NextResponse.json({ ok: false, error: 'bad-request' }, { status: 400 });
+  }
+
+  let auth;
+  try { auth = await resolveAuth(slug); } catch (e) {
+    if (e instanceof AuthResolutionError) return NextResponse.json({ ok: false, error: 'unavailable' }, { status: 503 });
+    throw e;
+  }
+  if (!auth || auth.authType !== 'jwt' || !auth.publicKeyPem) {
+    return NextResponse.json({ ok: false, error: 'not-enabled' }, { status: 404 });
+  }
+
+  const host = getRequestHost(req);
+  const outcome = await verifyDocsJwt(body.jwt, auth.publicKeyPem, host);
+  if (!outcome.ok) {
+    return NextResponse.json({ ok: false, error: outcome.reason }, { status: 401 });
+  }
+
+  const expiresAt = outcome.user.sessionExpiresAt;
+  // Cookie budget: browsers cap a cookie at ~4KB and drop/truncate silently
+  // beyond it. Try with playground inputs; if the signed value is too big,
+  // retry without them (session still granted); if groups alone blow the
+  // budget, refuse loudly instead of setting a cookie that won't stick.
+  const MAX_COOKIE_VALUE_LEN = 3800;
+  let cookieValue = await signAuthCookieV2(
+    { slug, host, version: auth.version, expiresAt },
+    { g: outcome.user.groups, ...(outcome.user.apiPlaygroundInputs ? { api: outcome.user.apiPlaygroundInputs } : {}) },
+    secret,
+  );
+  if (cookieValue.length > MAX_COOKIE_VALUE_LEN && outcome.user.apiPlaygroundInputs) {
+    cookieValue = await signAuthCookieV2(
+      { slug, host, version: auth.version, expiresAt },
+      { g: outcome.user.groups },
+      secret,
+    );
+  }
+  if (cookieValue.length > MAX_COOKIE_VALUE_LEN) {
+    return NextResponse.json({ ok: false, error: 'session-too-large' }, { status: 401 });
+  }
+  const maxAge = Math.max(1, Math.floor((expiresAt - Date.now()) / 1000));
+  const res = NextResponse.json({ ok: true, redirect: sanitizeCallbackRedirect(body.redirect) });
+  res.headers.set('Set-Cookie', `jd_auth_${slug}=${cookieValue}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`);
+  // Non-HttpOnly hint (no security value, carries nothing): lets the client
+  // header skip the /me round-trip on anonymous page views — cookies are
+  // host-scoped, so a fixed name needs no slug.
+  res.headers.append('Set-Cookie', `jd_authed=1; Path=/; Secure; SameSite=Lax; Max-Age=${maxAge}`);
+  res.headers.set('Cache-Control', 'no-store');
+  return res;
+}

package/vendored/app/api/jd/auth/logout/route.ts

@@ -0,0 +1,38 @@
+/**
+ * GET /api/jd/auth/logout — clears the JWT session cookie and redirects.
+ *
+ * Node runtime not strictly required (no crypto here), but kept consistent
+ * with the other jd/auth routes. Always 303s — logout must never fail loudly,
+ * even when the project isn't JWT-gated or resolveAuth throws (Redis outage).
+ *
+ * Redirect target: the customer's `loginUrl` when known (so the user lands
+ * back on their own login page), else relative '/' — same rule as the unlock
+ * route's redirects: never `NextResponse.redirect(new URL('/', req.url))`,
+ * since `req.url`'s host is the internal rewrite host, not the customer's
+ * public host behind a reverse proxy.
+ */
+
+import { resolveAuth } from '@/lib/auth-resolver';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+export async function GET(req: Request): Promise<Response> {
+  const slug = req.headers.get('x-project-slug');
+  // Relative '/' works for the same-site fallback; the customer loginUrl is
+  // absolute by validation.
+  let location = '/';
+  if (slug) {
+    try {
+      const auth = await resolveAuth(slug);
+      if (auth?.authType === 'jwt' && auth.loginUrl) location = auth.loginUrl;
+    } catch { /* logout must always succeed; fall back to '/' */ }
+  }
+  const headers = new Headers({ Location: location, 'Cache-Control': 'no-store' });
+  if (slug) {
+    headers.append('Set-Cookie', `jd_auth_${slug}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
+  }
+  // Always clear the client-readable hint the callback set (Task 8).
+  headers.append('Set-Cookie', 'jd_authed=; Path=/; Secure; SameSite=Lax; Max-Age=0');
+  return new Response(null, { status: 303, headers });
+}

package/vendored/app/api/jd/auth/me/route.ts

@@ -0,0 +1,52 @@
+/**
+ * GET /api/jd/auth/me — session info for the docs header and API playground.
+ *
+ * Node runtime — verifyAuthCookie's HMAC check runs here (Web Crypto, but
+ * kept on the Node route family alongside logout/callback for consistency).
+ * Degrades to `{authenticated: false}` on ANY failure (missing slug/secret,
+ * resolveAuth throwing, no cookie, invalid/expired cookie, wrong format
+ * version) — this is a read-only info endpoint, not a gate, so fail-closed
+ * here just means "logged out," never a 5xx. Always `Cache-Control: no-store`
+ * since the response is per-session and must never be shared across users
+ * or slugs by an intermediate cache.
+ *
+ * `x-project-slug` is set by the internal gate/rewrite from a resolved,
+ * validated project slug and stripped from any inbound client value
+ * (middleware-helpers.ts UNTRUSTED_HEADERS) — safe to interpolate into the
+ * cookie-name RegExp below without further escaping.
+ */
+
+import { NextResponse } from 'next/server';
+import { resolveAuth } from '@/lib/auth-resolver';
+import { verifyAuthCookie } from '@/shared/auth-cookie';
+
+export const runtime = 'nodejs';
+export const dynamic = 'force-dynamic';
+
+const UNAUTHENTICATED = { authenticated: false } as const;
+
+export async function GET(req: Request): Promise<NextResponse> {
+  const noStore = { headers: { 'Cache-Control': 'no-store' } };
+  const slug = req.headers.get('x-project-slug');
+  const secret = process.env.EDGE_AUTH_SECRET;
+  if (!slug || !secret) return NextResponse.json(UNAUTHENTICATED, noStore);
+
+  let auth;
+  try { auth = await resolveAuth(slug); } catch { return NextResponse.json(UNAUTHENTICATED, noStore); }
+  if (!auth || auth.authType !== 'jwt') return NextResponse.json(UNAUTHENTICATED, noStore);
+
+  const cookieHeader = req.headers.get('cookie') || '';
+  const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)jd_auth_${slug}=([^;]+)`));
+  const host = req.headers.get('x-jamdesk-forwarded-host') || req.headers.get('host') || '';
+  if (!match) return NextResponse.json(UNAUTHENTICATED, noStore);
+
+  const v = await verifyAuthCookie(match[1], { slug, host, version: auth.version }, secret);
+  if (!v.valid || v.formatVersion !== 'v2') return NextResponse.json(UNAUTHENTICATED, noStore);
+
+  return NextResponse.json({
+    authenticated: true,
+    authType: 'jwt',
+    groups: v.extras?.g ?? [],
+    ...(v.extras?.api ? { apiPlaygroundInputs: v.extras.api } : {}),
+  }, noStore);
+}

package/vendored/app/api/jd/unlock/route.ts

@@ -19,11 +19,12 @@ export const dynamic = 'force-dynamic';
 import { scrypt, randomBytes, timingSafeEqual } from 'crypto';
 import { promisify } from 'util';
 import { redis } from '@/lib/redis';
-import { getProjectAuthSecret } from '@/lib/cached-redis';
+import { getProjectAuthSecret, getProjectAuthPublic } from '@/lib/cached-redis';
 import { sanitizeFrom } from '@/lib/sanitize-from';
 import { VALID_SLUG_RE } from '@/lib/middleware-helpers';
 import { signAuthCookie } from '@/shared/auth-cookie';
 import { secretsEqual } from '@/lib/crypto-helpers';
+import { isSameOriginRequest } from '@/lib/same-origin';
 
 const scryptAsync = promisify(scrypt) as (
   password: string,
@@ -230,6 +231,13 @@ async function fetchStoredSecret(slug: string): Promise<StoredSecret | null> {
 }
 
 export async function POST(req: Request): Promise<Response> {
+  // Login-CSRF guard: a cross-site form POST would store a session in the
+  // victim's jar. Checked first — before scrypt, before rate limiting — so a
+  // cross-site attacker cannot even use the endpoint as a scrypt oracle.
+  if (!isSameOriginRequest(req)) {
+    return new Response('Forbidden: cross-site request', { status: 403 });
+  }
+
   // Fail-closed: if the signing secret is missing, we cannot issue valid
   // cookies. Return 503 rather than silently issuing unsigned tokens.
   const secret = process.env.EDGE_AUTH_SECRET;
@@ -293,8 +301,14 @@ export async function POST(req: Request): Promise<Response> {
   }
 
   let stored: StoredSecret | null;
+  let authType: 'password' | 'jwt' | undefined;
   try {
-    stored = await fetchStoredSecret(slug);
+    const [storedResult, pubResult] = await Promise.all([
+      fetchStoredSecret(slug),
+      getProjectAuthPublic(slug),
+    ]);
+    stored = storedResult;
+    authType = pubResult?.authType;
   } catch (err) {
     console.error('[unlock] Redis fetch failed — failing closed', {
       slug,
@@ -305,6 +319,16 @@ export async function POST(req: Request): Promise<Response> {
       headers: { 'Retry-After': '30' },
     });
   }
+
+  // JWT-mode projects don't use this route. During a password→jwt migration
+  // coexistence window, a lingering password hash would otherwise let the
+  // unlock form verify and mint a v1 cookie the jwt gate rejects — not a
+  // bypass (the jwt gate never accepts a v1 cookie), but a confusing dead
+  // end for the user. Fail fast instead.
+  if (authType === 'jwt') {
+    return new Response('not-enabled', { status: 404 });
+  }
+
   const hashToVerify = stored?.hash ?? DUMMY_HASH;
 
   // Always run scrypt — even with DUMMY_HASH when no password is set — to

package/vendored/app/api/markdown-export/[project]/[...slug]/route.ts

@@ -20,6 +20,7 @@ import { apiSpecsMarkdownFooter } from '@/lib/api-specs-markdown-hint';
 import { collectLocalSpecPaths } from '@/lib/openapi/operation-description';
 import { operationMarkdownForRef } from '@/lib/openapi/enrich-page-infos';
 import { injectAgentDirective } from '@/lib/agent-directive';
+import { resolveMarkdownFallbackPath } from '@/lib/root-page-slug';
 import { logger } from '@/shared/logger';
 import type { DocsConfig } from '@/lib/docs-types';
 import type { OpenAPI } from 'openapi-types';
@@ -66,38 +67,65 @@ export async function GET(
     return new NextResponse('Not found', { status: 404 });
   }
 
-  const pagePath = slug.join('/');
+  const requestedPath = slug.join('/');
 
+  // One config fetch feeds the root-alias fallback below, the directive
+  // (hostAtDocs link prefix) and the api-specs hint. It is STARTED before the
+  // content fetch so the two R2 reads overlap (the HTML path does the same
+  // with its configP) and awaited only where needed. A failed fetch must
+  // never 500 an export: the fallback is skipped, the directive falls back to
+  // the subdomain-rooted /llms.txt and the hint keeps its own defaults.
+  //
+  // The async IIFE (not `fetchDocsConfig(project).catch(...)`) is load-bearing
+  // in THREE ways, all of which a bare `.catch()` gets wrong:
+  //   1. a synchronous throw from fetchDocsConfig is caught, not propagated;
+  //   2. a non-promise return is normalised — several existing suites mock
+  //      `fetchDocsConfig: vi.fn()` with no implementation, so it returns
+  //      `undefined` and `.catch` on it is a TypeError that 500s the route;
+  //   3. `?? null` keeps the type `DocsConfig | null`, which is what
+  //      withApiSpecsHint's parameter and the `config?.` reads below expect.
+  const configP: Promise<DocsConfig | null> = (async () => {
+    try {
+      return (await fetchDocsConfig(project)) ?? null;
+    } catch (err) {
+      logger.warn('[markdown-export] config fetch failed', {
+        project,
+        error: err instanceof Error ? err.message : String(err),
+      });
+      return null;
+    }
+  })();
+
+  // `/`, `/index.md` and `/<lang>` reach this route as the `index` sentinel or
+  // a bare language code (proxy.ts markdown branch). The HTML for those URLs
+  // renders the first nav page in place (render-doc-page's resolveSlug); the
+  // export does the same — but only after the literal path missed, so a
+  // project with a real index.mdx keeps serving it and a missing real page
+  // still 404s. Any other R2 failure is a 502 straight away: falling back
+  // during an outage would report it as a 404 and double the load.
   let raw: string;
   try {
-    raw = await fetchMdxContent(project, pagePath);
+    raw = await fetchMdxContent(project, requestedPath);
   } catch (err) {
-    const msg = err instanceof Error ? err.message : '';
-    const name = err instanceof Error ? err.name : '';
-    if (
-      msg.startsWith(R2_NOT_FOUND_MESSAGE_PREFIX) ||
-      R2_NOT_FOUND_ERROR_NAMES.has(name)
-    ) {
+    if (!isMissingPageError(err)) {
+      return new NextResponse('Upstream unavailable', { status: 502 });
+    }
+    const fallbackPath = resolveMarkdownFallbackPath(requestedPath, await configP);
+    if (!fallbackPath) {
       return new NextResponse('Not found', { status: 404 });
     }
-    return new NextResponse('Upstream unavailable', { status: 502 });
+    try {
+      raw = await fetchMdxContent(project, fallbackPath);
+    } catch (fallbackErr) {
+      return isMissingPageError(fallbackErr)
+        ? new NextResponse('Not found', { status: 404 })
+        : new NextResponse('Upstream unavailable', { status: 502 });
+    }
   }
 
+  const config = await configP;
   const filtered = filterVisibility(raw, 'agents');
 
-  // One config fetch feeds both the directive (hostAtDocs link prefix) and the
-  // api-specs hint. A failed fetch must never 500 an export: directive falls
-  // back to the subdomain-rooted /llms.txt and the hint keeps its own defaults.
-  let config: DocsConfig | null = null;
-  try {
-    config = await fetchDocsConfig(project);
-  } catch (err) {
-    logger.warn('[markdown-export] config fetch failed', {
-      project,
-      error: err instanceof Error ? err.message : String(err),
-    });
-  }
-
   // hostAtDocs rides the middleware-stamped header — the stored docs.json
   // never carries it (runtime-only field, see DocsConfig), so reading it off
   // `config` alone always resolved false in prod. The config check stays as a
@@ -149,6 +177,21 @@ export async function GET(
   });
 }
 
+/**
+ * The two shapes fetchMdxContent throws for a missing page — the
+ * `Page not found: …` message the S3 path builds and the error names the
+ * public-fetch path forwards. Deliberately NOT r2-content's exported
+ * `isR2NotFound`: that one classifies raw S3ServiceException / HTTP 404
+ * failures inside the fetchers and does not recognise the message shape
+ * that reaches this route. This is the same test the route ran inline
+ * before the fallback existed, now needed at two sites.
+ */
+function isMissingPageError(err: unknown): boolean {
+  const msg = err instanceof Error ? err.message : '';
+  const name = err instanceof Error ? err.name : '';
+  return msg.startsWith(R2_NOT_FOUND_MESSAGE_PREFIX) || R2_NOT_FOUND_ERROR_NAMES.has(name);
+}
+
 /**
  * Append the agent-facing "download all OpenAPI specs" footer when the page is
  * an API/OpenAPI page of a spec-bearing site whose AI-actions menu is enabled,

package/vendored/app/api/raw-content/[...slug]/route.ts

@@ -5,6 +5,7 @@ import { parseFrontmatterLenient } from '@/lib/frontmatter-utils';
 import { collectLocalSpecPaths } from '@/lib/openapi/operation-description';
 import { operationMarkdownForRef } from '@/lib/openapi/enrich-page-infos';
 import { getCachedSpec } from '@/lib/openapi/cache';
+import { resolveMarkdownFallbackPath } from '@/lib/root-page-slug';
 import { NextResponse } from 'next/server';
 
 /**
@@ -19,7 +20,7 @@ export async function GET(
   const { slug } = await params;
   try {
     const loader = getContentLoader();
-    const raw = await loader.getContent(slug.join('/'));
+    const raw = await getContentWithRootFallback(loader, slug.join('/'));
     const filtered = filterVisibility(raw, 'agents');
     return new NextResponse(await withOperationMarkdown(filtered, raw, loader), {
       headers: {
@@ -33,6 +34,25 @@ export async function GET(
   }
 }
 
+/**
+ * Same root-alias rule as the production export: `/` and `/index.md` arrive
+ * as `index`, `/fr` as `fr`; when that file is missing, serve the first nav
+ * page — what the HTML for the same URL renders. Rethrows the original miss
+ * when there is no fallback so the caller's catch still answers 404.
+ */
+async function getContentWithRootFallback(
+  loader: ReturnType<typeof getContentLoader>,
+  requestedPath: string,
+): Promise<string> {
+  try {
+    return await loader.getContent(requestedPath);
+  } catch (err) {
+    const fallbackPath = resolveMarkdownFallbackPath(requestedPath, await loader.getConfig());
+    if (!fallbackPath) throw err;
+    return loader.getContent(fallbackPath);
+  }
+}
+
 /**
  * Append the operation markdown for an `openapi:`-backed page, exactly as the
  * production route does.

package/vendored/app/layout.tsx

@@ -23,6 +23,7 @@ import type { DocsConfig } from '@/lib/docs-types';
 import { buildSiteTitle, getFaviconIcons, FALLBACK_METADATA } from '@/lib/seo';
 import { withR2OpsContext, emitR2OpsSummary } from '@/lib/r2-content';
 import { DocsChrome, getLocalFileContent, loadCustomAssets } from '@/lib/layout-helpers';
+import { filterNavigationForViewer } from '@/lib/viewer-navigation';
 
 async function generateMetadataImpl(): Promise<Metadata> {
   // The placeholder shell would otherwise render with the paused
@@ -150,6 +151,12 @@ async function rootLayoutImpl({
       try {
         config = await getIsrDocsConfig(projectSlug);
         config = { ...config, hostAtDocs, docsPrefix };
+        if (config.auth?.jwt?.enabled) {
+          config = {
+            ...config,
+            navigation: await filterNavigationForViewer(projectSlug, config.navigation, headersList),
+          };
+        }
       } catch {
         config = {
           name: 'Documentation',

package/vendored/components/AIActionsMenu.tsx

@@ -289,8 +289,25 @@ export function AIActionsMenu({ options, projectName }: AIActionsMenuProps) {
 
   // Compute URLs client-side to survive SPA navigation
   const origin = typeof window !== 'undefined' ? window.location.origin : '';
-  const mdRelativePath = `${pathname}.md`;
-  const mdAbsoluteUrl = `${origin}${pathname}.md`;
+  // At the docs ROOT, `${pathname}.md` is never a working URL, and it fails
+  // three different ways depending on how the site is mounted:
+  //   - bare root: pathname `/` -> `/.md`, which classifyScannerProbe reads as
+  //     a dotfile and proxy.ts 404s ~770 lines before the markdown branch (and
+  //     which the CLI's `/:path*.md` dev rewrite never matches either);
+  //   - worker-fronted subpath (jamdesk.com/docs): `/docs.md` isn't proxied at
+  //     all — cloudflare-worker/index.js's shouldProxy requires `=== '/docs'`
+  //     or `startsWith('/docs/')` — so it lands on marketing's 404;
+  //   - custom subpath (`/fun`): `/fun.md` reaches us but getDocsPrefixRouting
+  //     drops it on the dotted-asset guard before internalising, so the route
+  //     sees the slug `fun` and 404s.
+  // `<linkPrefix>/index.md` is the one shape that works on all three: it is the
+  // sentinel both markdown routes resolve to the first nav page, and it always
+  // sits under the prefix the worker and the proxy actually route. linkPrefix
+  // is '' on a bare-root tenant, so that case stays `/index.md`.
+  const atDocsRoot = pathname === linkPrefix || pathname === '/' || pathname === '';
+  const mdPath = atDocsRoot ? `${linkPrefix}/index.md` : `${pathname}.md`;
+  const mdRelativePath = mdPath;
+  const mdAbsoluteUrl = `${origin}${mdPath}`;
   const mcpUrl = `${origin}${linkPrefix}/_mcp`;
   const apiSpecZipUrl = buildApiSpecZipUrl(origin, linkPrefix);
 

package/vendored/components/mdx/OpenApiEndpoint.tsx

@@ -68,6 +68,9 @@ interface OpenApiEndpointProps {
    *  are the same text — an author's DIFFERENT frontmatter description must
    *  not suppress the operation's own. */
   descriptionAlreadyShown?: boolean;
+  /** When true, PlaygroundModal fetches the signed-in JWT session's
+   *  apiPlaygroundInputs on open and pre-fills matching values. */
+  jwtAuthEnabled?: boolean;
 }
 
 /**
@@ -830,6 +833,7 @@ export function OpenApiEndpoint({
   languages,
   playgroundOnly,
   descriptionAlreadyShown,
+  jwtAuthEnabled,
 }: OpenApiEndpointProps) {
   const {
     method,

package/vendored/components/navigation/Header.tsx

@@ -13,6 +13,7 @@ import { ThemeToggle } from '@/components/theme/ThemeToggle';
 import { LazySearchModal as SearchModal } from '@/components/search/LazySearchModal';
 import { DefaultLogo } from './DefaultLogo';
 import { LanguageSelector } from './LanguageSelector';
+import LogoutButton from './LogoutButton';
 import { resolveNavigation } from '@/lib/navigation-resolver';
 import { getIconClass } from '@/lib/icon-utils';
 import { useLinkPrefix } from '@/lib/link-prefix-context';
@@ -550,6 +551,10 @@ export function Header({ config, layout = 'header-logo', tabsPosition: tabsPosit
               </>
             )}
 
+            {/* Log-out affordance - only mounted for JWT-authenticated docs sites;
+                renders nothing until the client confirms an active session. */}
+            {config.auth?.jwt?.enabled === true && <LogoutButton />}
+
             {/* Theme toggle - hidden on mobile since it's in the sidebar menu.
                 Also hidden when appearance.strict pins users to the configured mode. */}
             {!config.appearance?.strict && (