jamdesk 1.1.203 → 1.1.205

package/vendored/components/navigation/LogoutButton.tsx

@@ -0,0 +1,41 @@
+'use client';
+
+import { useEffect, useState } from 'react';
+import { hasJwtSessionHint } from '../../lib/session-hint';
+
+/**
+ * Only mounted when docs.json has auth.jwt.enabled. The jd_authed hint
+ * cookie (client-readable, set by the callback, cleared by logout) gates the
+ * /me fetch: the Header persists across next/link soft-navs, so this mounts
+ * once per hard load — without the hint, every fresh anonymous entry (SEO
+ * landing, shared link) would pay a /me round-trip. Login and logout both end
+ * in hard loads, so the state re-derives whenever it can change. The hint is
+ * advisory only — the signed session cookie behind /me is what's trusted.
+ * cursor-pointer per UI rule.
+ */
+export default function LogoutButton() {
+  const [visible, setVisible] = useState(false);
+
+  useEffect(() => {
+    if (!hasJwtSessionHint(document.cookie)) return;
+    let cancelled = false;
+    fetch('/_jd/api/auth/me', { credentials: 'same-origin' })
+      .then((r) => r.json())
+      .then((d: { authenticated?: boolean; authType?: string }) => {
+        if (!cancelled && d.authenticated && d.authType === 'jwt') setVisible(true);
+      })
+      .catch(() => { /* header must render regardless */ });
+    return () => { cancelled = true; };
+  }, []);
+
+  if (!visible) return null;
+  return (
+    <a
+      href="/_jd/auth/logout"
+      className="cursor-pointer"
+      style={{ color: 'var(--color-text-secondary)', fontSize: '0.875rem', whiteSpace: 'nowrap' }}
+    >
+      Log out
+    </a>
+  );
+}

package/vendored/lib/auth-resolver.ts

@@ -1,13 +1,17 @@
 import { redis } from './redis';
-import { getProjectAuthSecret, getProjectAuthPublic } from './cached-redis';
-import { matchPublicPath } from './glob-match';
+import { getProjectAuthSecret, getProjectAuthPublic, getProjectJwtSecret } from './cached-redis';
+import { matchPublicPath, resolveRequiredGroups } from './glob-match';
 
-export { matchPublicPath };
+export { matchPublicPath, resolveRequiredGroups };
 
 export interface ResolvedAuth {
-  hash: string;
+  authType: 'password' | 'jwt';
+  hash?: string;
+  publicKeyPem?: string;
   version: number;
   publicPaths: string[];
+  loginUrl?: string;
+  groupsPaths?: Record<string, string[]>;
 }
 
 interface AuthSecret {
@@ -15,30 +19,50 @@ interface AuthSecret {
   version: number;
 }
 
+interface JwtSecret {
+  publicKeyPem: string;
+  version: number;
+}
+
 interface AuthPublic {
   enabled?: boolean;
   publicPaths?: string[];
+  authType?: 'password' | 'jwt';
+  loginUrl?: string;
+  groupsPaths?: Record<string, string[]>;
 }
 
 /**
- * Resolve active password protection for a project.
+ * Resolve active auth protection (password OR jwt) for a project.
+ *
+ * Truth table — the config plane's declared `authType` alone picks the
+ * ACTIVE mode; the matching secret key must back it or the gate is off:
+ *   projectAuthPublic missing OR enabled!==true                       → no gate (return null)
+ *   authType==='jwt'      AND projectJwtSecret has a publicKeyPem      → jwt gate
+ *   authType==='jwt'      AND projectJwtSecret missing/malformed       → no gate (return null)
+ *   authType!=='jwt' (password, incl. absent) AND projectAuthSecret has a hash → password gate
+ *   authType!=='jwt' AND projectAuthSecret missing/malformed           → no gate (return null)
  *
- * Truth table (both sides must agree for gating to be active):
- *   projectAuthPublic.enabled=true AND projectAuthSecret has a hash → gate
- *   projectAuthPublic missing OR enabled!==true                     → no gate (return null)
- *   projectAuthSecret missing                                       → no gate (return null)
+ * Coexistence is by design: BOTH secret keys may exist simultaneously
+ * during a password→JWT migration (the build writes the new key before
+ * flipping authType, and the old key isn't deleted). Only the
+ * build-written `authType` decides which secret is consulted — a
+ * password hash never satisfies jwt mode and vice versa, so there is no
+ * window where a stale secret of the wrong kind is honored.
  *
- * Both project-level keys fail-CLOSED: if either read throws, this throws
- * `AuthResolutionError` so middleware returns 503 instead of serving gated
- * content without a check. A partial Upstash outage taking down one key
- * while the other is reachable would otherwise create a fail-open window.
+ * All three project-level keys fail-CLOSED: if any read throws, this
+ * throws `AuthResolutionError` so middleware returns 503 instead of
+ * serving gated content without a check. A partial Upstash outage taking
+ * down one key while the others are reachable would otherwise create a
+ * fail-open window.
  *
- * We intentionally do NOT read `domainAuthSecret` here even though it is
- * mirrored on every password write. The dashboard fan-out is best-effort,
- * so a failed mirror write can leave the domain key pointing at a stale
- * version. Reading the mirror would then accept old session cookies on
- * that host. Always reading the project-level key keeps a single source
- * of truth and costs one fewer Redis GET per request on custom domains.
+ * We intentionally do NOT read `domainAuthSecret`/`domainJwtSecret` here
+ * even though they are mirrored on every write. The dashboard fan-out is
+ * best-effort, so a failed mirror write can leave the domain key pointing
+ * at a stale version. Reading the mirror would then accept old session
+ * cookies on that host. Always reading the project-level key keeps a
+ * single source of truth and costs fewer Redis GETs per request on
+ * custom domains.
  *
  * When `redis` is null (local dev without Upstash configured), returns
  * null immediately so the CLI dev server doesn't try to gate anything.
@@ -50,35 +74,33 @@ export class AuthResolutionError extends Error {
   }
 }
 
-export async function resolveAuth(
-  projectSlug: string,
-): Promise<ResolvedAuth | null> {
-  if (!redis) return null;
-
-  let secret: AuthSecret | null;
-  let pub: AuthPublic | null;
-
+// Every auth read shares one failure contract: any throw becomes an
+// AuthResolutionError so callers fail CLOSED rather than treating an
+// unreachable Redis as "not gated".
+async function readOrFail<T>(read: () => Promise<unknown>): Promise<T | null> {
   try {
-    const [secretResult, publicResult] = await Promise.all([
-      getProjectAuthSecret(projectSlug),
-      getProjectAuthPublic(projectSlug),
-    ]);
-    secret = secretResult as AuthSecret | null;
-    pub = publicResult as AuthPublic | null;
+    return (await read()) as T | null;
   } catch (e) {
     throw new AuthResolutionError(
       'Failed to read project auth keys via cached-redis',
       e,
     );
   }
+}
 
-  if (
-    !secret ||
-    typeof secret.hash !== 'string' ||
-    typeof secret.version !== 'number'
-  ) {
-    return null;
-  }
+export async function resolveAuth(
+  projectSlug: string,
+): Promise<ResolvedAuth | null> {
+  if (!redis) return null;
+
+  // Public record FIRST: it decides whether any secret is needed at all, and
+  // which one. A non-gated tenant therefore costs one GET per cache miss
+  // (not three), and each mode reads only its own secret. The extra RTT on a
+  // gated tenant is paid once per 15s cache window, not per request.
+  // Fail-closed is unchanged: any throw becomes AuthResolutionError.
+  const pub = await readOrFail<AuthPublic>(
+    () => getProjectAuthPublic(projectSlug),
+  );
 
   if (!pub || pub.enabled !== true) {
     return null;
@@ -92,11 +114,54 @@ export async function resolveAuth(
   const publicPaths: string[] = Array.isArray(pub.publicPaths)
     ? (pub.publicPaths as string[])
     : [];
+  const authType: 'password' | 'jwt' = pub.authType === 'jwt' ? 'jwt' : 'password';
+
+  if (authType === 'jwt') {
+    const jwtSecret = await readOrFail<JwtSecret>(
+      () => getProjectJwtSecret(projectSlug),
+    );
+    if (
+      !jwtSecret ||
+      typeof jwtSecret.publicKeyPem !== 'string' ||
+      jwtSecret.publicKeyPem.length === 0 ||
+      typeof jwtSecret.version !== 'number'
+    ) {
+      // authType says jwt but the jwt-own secret isn't there (or is
+      // malformed) — gate off. A lingering password hash from a prior
+      // mode must NEVER satisfy jwt mode; that would be a half-on gate.
+      return null;
+    }
+    return {
+      authType,
+      publicKeyPem: jwtSecret.publicKeyPem,
+      version: jwtSecret.version,
+      publicPaths,
+      loginUrl: typeof pub.loginUrl === 'string' ? pub.loginUrl : undefined,
+      groupsPaths:
+        pub.groupsPaths && typeof pub.groupsPaths === 'object'
+          ? pub.groupsPaths
+          : undefined,
+    };
+  }
+
+  const secret = await readOrFail<AuthSecret>(
+    () => getProjectAuthSecret(projectSlug),
+  );
+  if (
+    !secret ||
+    typeof secret.hash !== 'string' ||
+    typeof secret.version !== 'number'
+  ) {
+    return null;
+  }
 
   return {
+    authType,
     hash: secret.hash,
     version: secret.version,
     publicPaths,
+    loginUrl: undefined,
+    groupsPaths: undefined,
   };
 }
 
@@ -117,21 +182,31 @@ export async function resolveAuth(
  * fetch mechanism. Therefore: fail OPEN (return false) on Redis error so
  * brownouts don't nullify the CDN-cache latency win.
  *
- * Reads go through cached-redis (getProjectAuthSecret/getProjectAuthPublic) —
- * the same wrappers resolveAuth uses — so the two share per-instance cache
- * entries for these keys instead of each holding its own copy. cached-redis
- * does NOT cache fetch errors, so the fail-open path below still retries on
- * the next call rather than pinning `false`.
+ * Reads go through cached-redis (getProjectAuthSecret/getProjectAuthPublic/
+ * getProjectJwtSecret) — the same wrappers resolveAuth uses — so the two
+ * share per-instance cache entries for these keys instead of each holding
+ * its own copy. cached-redis does NOT cache fetch errors, so the fail-open
+ * path below still retries on the next call rather than pinning `false`.
+ *
+ * Mirrors resolveAuth's mode binding exactly: a jwt tenant is gated only by
+ * its jwt key, a password tenant only by its hash. A lingering hash from a
+ * previous mode never counts (resolveAuth ignores it too), so the storage
+ * scheme and the edge gate can never disagree about whether a site is open.
  */
 export async function isProjectGated(slug: string): Promise<boolean> {
   if (!redis) return false;
 
   try {
-    const [secret, pub] = await Promise.all([
-      getProjectAuthSecret(slug),
-      getProjectAuthPublic(slug),
-    ]);
-    return !!secret && typeof secret.hash === 'string' && pub?.enabled === true;
+    // Same public-first ordering as resolveAuth (shared cache entries): a
+    // disabled tenant is one GET, and only the mode's own secret is read.
+    const pub = await getProjectAuthPublic(slug);
+    if (pub?.enabled !== true) return false;
+    if (pub.authType === 'jwt') {
+      const jwtSecret = await getProjectJwtSecret(slug);
+      return typeof jwtSecret?.publicKeyPem === 'string';
+    }
+    const secret = await getProjectAuthSecret(slug);
+    return typeof secret?.hash === 'string';
   } catch {
     // Fail OPEN: this is a read-mechanism choice, not access control.
     // Gating already happened upstream in proxy.ts. Failing closed here

package/vendored/lib/cached-redis.ts

@@ -79,7 +79,15 @@ const projectMetaCache = new TtlCache<ProjectMeta>({ ttlMs: POSITIVE_TTL_MS, neg
 // emergency rotation requires the JD_CACHE_DISABLED kill switch + redeploy.
 // See docs/plans/2026-05-21-redis-in-function-memo-cache.md auto-memory.
 const projectAuthSecretCache = new TtlCache<{ hash: string; version: number }>({ ttlMs: AUTH_TTL_MS, negativeTtlMs: NEGATIVE_TTL_MS });
-const projectAuthPublicCache = new TtlCache<{ enabled: boolean; publicPaths: string[] }>({ ttlMs: AUTH_TTL_MS, negativeTtlMs: NEGATIVE_TTL_MS });
+
+export interface ProjectAuthPublic {
+  enabled: boolean;
+  publicPaths: string[];
+  authType?: 'password' | 'jwt';
+  loginUrl?: string;
+  groupsPaths?: Record<string, string[]>;
+}
+const projectAuthPublicCache = new TtlCache<ProjectAuthPublic>({ ttlMs: AUTH_TTL_MS, negativeTtlMs: NEGATIVE_TTL_MS });
 
 const inFlight = new Map<string, Promise<unknown>>();
 
@@ -107,6 +115,7 @@ export function _resetForTest(): void {
   projectMetaCache.clear();
   projectAuthSecretCache.clear();
   projectAuthPublicCache.clear();
+  projectJwtSecretCache.clear();
   inFlight.clear();
   _hits = 0; _misses = 0; _readsSinceLog = 0; _totalReadMs = 0;
   _recent.length = 0; _recentIdx = 0; _recentSum = 0;
@@ -362,8 +371,24 @@ export async function getProjectAuthSecret(slug: string): Promise<{ hash: string
   );
 }
 
-export async function getProjectAuthPublic(slug: string): Promise<{ enabled: boolean; publicPaths: string[] } | null> {
+export async function getProjectAuthPublic(slug: string): Promise<ProjectAuthPublic | null> {
   return readThrough(projectAuthPublicCache, `projectAuthPublic:${slug}`, () =>
-    redis!.get<{ enabled: boolean; publicPaths: string[] }>(`projectAuthPublic:${slug}`),
+    redis!.get<ProjectAuthPublic>(`projectAuthPublic:${slug}`),
+  );
+}
+
+// JWT-mode's own secret key — deliberately a SEPARATE cache/key from
+// projectAuthSecret (password), never merged. Coexistence (both keys
+// present during a password→JWT migration) is by design: authType alone
+// (on the public plane) decides which one is consulted.
+export interface ProjectJwtSecret {
+  publicKeyPem: string;
+  version: number;
+}
+const projectJwtSecretCache = new TtlCache<ProjectJwtSecret>({ ttlMs: AUTH_TTL_MS, negativeTtlMs: NEGATIVE_TTL_MS });
+
+export async function getProjectJwtSecret(slug: string): Promise<ProjectJwtSecret | null> {
+  return readThrough(projectJwtSecretCache, `projectJwtSecret:${slug}`, () =>
+    redis!.get<ProjectJwtSecret>(`projectJwtSecret:${slug}`),
   );
 }

package/vendored/lib/docs-types.ts

@@ -846,12 +846,28 @@ export interface PasswordAuthConfig {
   private?: string[];
 }
 
+/**
+ * JWT authentication config. The verification key is generated and stored via
+ * the Jamdesk dashboard; this block only carries declarative opt-in, the
+ * customer login URL, and public path exceptions.
+ */
+export interface JwtAuthConfig {
+  /** Opt in to JWT auth. Site is only gated when this is true AND a signing key has been generated in the dashboard. */
+  enabled?: boolean;
+  /** Absolute https:// URL of your login flow. Unauthenticated visitors are redirected here with ?redirect=<path>. */
+  loginUrl?: string;
+  /** Paths or globs that bypass authentication. Supports '*' and '**'. */
+  public?: string[];
+}
+
 /**
  * Auth configuration for access control. Currently supports shared-password
- * protection; additional mechanisms may be added in future.
+ * protection and JWT authentication; additional mechanisms may be added in
+ * future.
  */
 export interface AuthConfig {
   password?: PasswordAuthConfig;
+  jwt?: JwtAuthConfig;
 }
 
 /**

package/vendored/lib/glob-match.ts

@@ -76,8 +76,62 @@ export function matchPublicPath(
       normalized = pathname.slice(5); // '/docs/' → '/' (keep leading slash)
     }
   }
+  // The main gate runs on the pretty path BEFORE the `.md` → markdown-export
+  // rewrite, so `/changelog.md` must match a public `/changelog` — otherwise
+  // the export of a public page over-gates while the HTML page is open.
+  // (resolveRequiredGroups strips the same suffix for the group lookup.)
+  if (normalized.length > 3 && normalized.endsWith('.md')) {
+    normalized = normalized.slice(0, -3);
+  }
 
   const { literals, regexes } = compilePublicPaths(publicPaths);
   if (literals.has(normalized)) return true;
   return regexes.some((re) => re.test(normalized));
 }
+
+const R2_CONTENT_RE = /^\/api\/r2\/[^/]+\/content\/(.+?)(?:\.mdx)?$/;
+// Direct hit on the raw-markdown export route: /api/markdown-export/{slug}/{page}.
+// The captured group is the root-relative page path (the middleware rewrite
+// already stripped any /docs prefix), so — like the /api/r2 branch — this shape
+// carries page content and must resolve group restrictions on it. Without this,
+// a direct external hit would pass the edge gate with no group requirement
+// resolved (the path doesn't look like a page path) and leak group-restricted
+// MDX to any authenticated user (and, gated on the wrong slug, cross-tenant).
+const MARKDOWN_EXPORT_RE = /^\/api\/markdown-export\/[^/]+\/(.+?)(?:\.md)?$/;
+
+/**
+ * Look up the required groups for a request path against the build-written
+ * groupsPaths map (keys are root-relative page slugs). Normalizes every path
+ * shape that serves page content: percent-encoding, hostAtDocs /docs prefix,
+ * trailing slash, markdown-export .md suffix, /api/r2 raw-MDX paths, and direct
+ * /api/markdown-export hits. Returns the required groups, or null when the path
+ * carries no restriction.
+ */
+export function resolveRequiredGroups(
+  pathname: string,
+  groupsPaths: Record<string, string[]>,
+  hostAtDocs: boolean,
+): string[] | null {
+  let p = pathname;
+  try { p = decodeURIComponent(p); } catch { /* keep raw — never throw in the gate */ }
+
+  const r2 = p.match(R2_CONTENT_RE);
+  const mdExport = p.match(MARKDOWN_EXPORT_RE);
+  if (r2) {
+    p = `/${r2[1]}`;
+  } else if (mdExport) {
+    // Page path already root-relative (rewrite stripped /docs); no hostAtDocs
+    // normalization, matching the /api/r2 branch.
+    p = `/${mdExport[1]}`;
+  } else {
+    if (hostAtDocs) {
+      if (p === '/docs') p = '/';
+      else if (p.startsWith('/docs/')) p = p.slice(5);
+    }
+    if (p.endsWith('.md')) p = p.slice(0, -3);
+    if (p.length > 1 && p.endsWith('/')) p = p.slice(0, -1);
+  }
+
+  const required = groupsPaths[p];
+  return Array.isArray(required) && required.length > 0 ? required : null;
+}

package/vendored/lib/jwt-auth-config.ts

@@ -0,0 +1,37 @@
+import type { DocsConfig } from './docs-types.js';
+
+/**
+ * Pure validation for the auth.jwt block. Returns config_error strings.
+ * Kept out of validate-config.ts so the CLI's parallel validator and the
+ * dashboard can reuse identical logic without dragging in Ajv.
+ */
+export function validateJwtAuth(config: DocsConfig): string[] {
+  const auth = config.auth as
+    | { password?: { enabled?: unknown }; jwt?: { enabled?: unknown; loginUrl?: unknown; public?: unknown } }
+    | undefined;
+  const jwt = auth?.jwt;
+  if (!jwt) return [];
+
+  const errors: string[] = [];
+  if (auth?.password?.enabled === true && jwt.enabled === true) {
+    errors.push('auth.password and auth.jwt cannot both be enabled — choose one authentication method');
+    return errors;
+  }
+  if (jwt.enabled === true) {
+    if (typeof jwt.loginUrl !== 'string' || jwt.loginUrl.length === 0) {
+      errors.push('auth.jwt.enabled requires auth.jwt.loginUrl (an absolute https:// URL of your login flow)');
+    } else {
+      let ok = false;
+      try {
+        ok = new URL(jwt.loginUrl).protocol === 'https:';
+      } catch { /* unparseable */ }
+      if (!ok) errors.push('auth.jwt.loginUrl must be an absolute https:// URL');
+    }
+  }
+  if (jwt.public !== undefined) {
+    const valid = Array.isArray(jwt.public) &&
+      jwt.public.every((p) => typeof p === 'string' && p.startsWith('/'));
+    if (!valid) errors.push('auth.jwt.public must be an array of path strings starting with /');
+  }
+  return errors;
+}

package/vendored/lib/jwt-session.ts

@@ -0,0 +1,98 @@
+import { importSPKI, jwtVerify } from 'jose';
+import { MAX_GROUPS_PER_PAGE, MAX_GROUP_NAME_LEN } from './public-paths-resolver.js';
+
+// Node-runtime only (callback/me routes). NOT edge-safe by policy — the edge
+// never verifies JWTs; it verifies the HMAC session cookie minted here.
+export const DEFAULT_SESSION_MS = 7 * 24 * 3600 * 1000;
+export const MAX_SESSION_MS = 30 * 24 * 3600 * 1000;
+export const MAX_API_INPUTS_BYTES = 2048;
+export const MAX_TOKEN_EXP_AHEAD_SEC = 600;
+// Token-side group limits are the SAME constants the build applies to
+// frontmatter `groups:` — a token can never carry more (or longer) group
+// names than a page can require, so the two sides cannot drift apart.
+const MAX_GROUPS = MAX_GROUPS_PER_PAGE;
+const MAX_GROUP_LEN = MAX_GROUP_NAME_LEN;
+const API_INPUT_SECTIONS = new Set(['server', 'header', 'query', 'cookie', 'path']);
+
+export interface ValidatedJwtUser {
+  sessionExpiresAt: number; // ms since epoch
+  groups: string[];
+  apiPlaygroundInputs?: Record<string, unknown>;
+  apiInputsDropped: boolean;
+}
+
+export type JwtVerifyOutcome =
+  | { ok: true; user: ValidatedJwtUser }
+  | { ok: false; reason: string };
+
+export async function verifyDocsJwt(
+  token: string,
+  publicKeyPem: string,
+  requestHost: string,
+): Promise<JwtVerifyOutcome> {
+  if (!token || !publicKeyPem || !requestHost) return { ok: false, reason: 'missing-input' };
+
+  let payload: Record<string, unknown>;
+  try {
+    const key = await importSPKI(publicKeyPem, 'EdDSA');
+    // requireExp: customers must set a short exp (docs recommend ≤10s); jose
+    // rejects both missing and passed exp. Small clockTolerance absorbs skew
+    // between the customer backend and Vercel.
+    const result = await jwtVerify(token, key, { algorithms: ['EdDSA'], clockTolerance: 30, requiredClaims: ['exp'] });
+    payload = result.payload as Record<string, unknown>;
+  } catch {
+    return { ok: false, reason: 'invalid-token' };
+  }
+
+  // Replay bound: the handshake token must be short-lived (docs recommend
+  // exp ≤10s; we allow up to 10 min for slow clocks/flows). A token that
+  // validates today with exp a year out would otherwise be replayable until
+  // then — exp is the ONLY replay control (no jti store, matching Mintlify).
+  const expSec = payload.exp as number; // present: requiredClaims enforced it
+  if (expSec - Date.now() / 1000 > MAX_TOKEN_EXP_AHEAD_SEC) {
+    return { ok: false, reason: 'exp-too-far' };
+  }
+
+  // host binding prevents a token minted for one docs site (or grabbed from
+  // another tenant's flow) being replayed against a different host.
+  if (typeof payload.host !== 'string' || payload.host.toLowerCase() !== requestHost.toLowerCase()) {
+    return { ok: false, reason: 'host-mismatch' };
+  }
+
+  let groups: string[] = [];
+  if (payload.groups !== undefined) {
+    if (!Array.isArray(payload.groups) ||
+        payload.groups.length > MAX_GROUPS ||
+        !payload.groups.every((g) => typeof g === 'string' && g.length > 0 && g.length <= MAX_GROUP_LEN)) {
+      return { ok: false, reason: 'invalid-groups' };
+    }
+    groups = payload.groups as string[];
+  }
+
+  let sessionExpiresAt = Date.now() + DEFAULT_SESSION_MS;
+  if (payload.expiresAt !== undefined) {
+    const sec = Number(payload.expiresAt);
+    if (!Number.isSafeInteger(sec) || sec * 1000 <= Date.now()) {
+      return { ok: false, reason: 'invalid-expiresAt' };
+    }
+    sessionExpiresAt = Math.min(sec * 1000, Date.now() + MAX_SESSION_MS);
+  }
+
+  let apiPlaygroundInputs: Record<string, unknown> | undefined;
+  let apiInputsDropped = false;
+  const rawApi = payload.apiPlaygroundInputs;
+  if (rawApi && typeof rawApi === 'object' && !Array.isArray(rawApi)) {
+    const filtered: Record<string, unknown> = {};
+    for (const [k, v] of Object.entries(rawApi as Record<string, unknown>)) {
+      if (API_INPUT_SECTIONS.has(k) && v && typeof v === 'object' && !Array.isArray(v)) filtered[k] = v;
+    }
+    const serialized = JSON.stringify(filtered);
+    if (Object.keys(filtered).length > 0 && serialized.length <= MAX_API_INPUTS_BYTES) {
+      apiPlaygroundInputs = filtered;
+    } else if (Object.keys(filtered).length > 0) {
+      apiInputsDropped = true; // too big: session still granted, playground pre-fill lost
+    }
+  }
+
+  return { ok: true, user: { sessionExpiresAt, groups, apiPlaygroundInputs, apiInputsDropped } };
+}

package/vendored/lib/language-utils.ts

@@ -340,7 +340,13 @@ export function transformLanguagePath(
  * may carry any casing — use isKnownLanguageCode instead.
  */
 export function isValidLanguageCode(code: string): code is LanguageCode {
-  return code in LANGUAGE_DISPLAY_NAMES;
+  // `Object.hasOwn`, not `in`: LANGUAGE_DISPLAY_NAMES is a plain object, so
+  // `in` also answered true for every Object.prototype key. That made
+  // `constructor`, `toString`, `valueOf` and friends read as language codes —
+  // and because needsSlugRewrite rewrites a single-segment alias BEFORE the
+  // literal path is tried, a tenant with a real page named `constructor` could
+  // not reach it in HTML at all.
+  return Object.hasOwn(LANGUAGE_DISPLAY_NAMES, code);
 }
 
 /** Lowercase → canonical lookup, built once. Lets `extractLanguageFromPath`
@@ -379,7 +385,13 @@ export function isKnownLanguageCode(code: string): boolean {
  * the bare code. Used by llms.txt cross-language links.
  */
 export function languageDisplayName(code: string): string {
-  const direct = (LANGUAGE_DISPLAY_NAMES as Record<string, string>)[code];
+  // hasOwn-guarded for the same reason as isValidLanguageCode, but the failure
+  // here is worse than a false positive: a bare `[code]` read of 'toString'
+  // returns Object.prototype.toString — a FUNCTION handed back through a
+  // `: string` signature, straight into llms.txt link text.
+  const direct = Object.hasOwn(LANGUAGE_DISPLAY_NAMES, code)
+    ? (LANGUAGE_DISPLAY_NAMES as Record<string, string>)[code]
+    : undefined;
   if (direct) return direct;
   const canonical = LANGUAGE_CODE_BY_LOWER.get(code.toLowerCase());
   return canonical ? LANGUAGE_DISPLAY_NAMES[canonical] : code;

package/vendored/lib/layout-helpers.tsx

@@ -531,6 +531,10 @@ export async function DocsChrome({
           <link key={`pc-${origin}`} rel="preconnect" href={origin} />
         ))}
         {cmpScriptSrcs.map((src) => (
+          // Load-bearing: an auto-blocking CMP must run synchronously and
+          // BEFORE any later script, or it cannot intercept them. next/script
+          // defers, which silently breaks consent gating.
+          // eslint-disable-next-line @next/next/no-sync-scripts
           <script key={src} src={src} />
         ))}
         {/*

package/vendored/lib/mdx-inline-components.ts

@@ -80,7 +80,7 @@ function transpileJsx(jsxSource: string): string {
     ],
   });
 
-  if (!result.code) {
+  if (!result?.code) {
     throw new Error('Babel transpilation failed');
   }