jamdesk 1.1.205 → 1.1.206

package/dist/__tests__/unit/turbopack-loader-config-drift.test.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Drift guard for the Turbopack `.js`-specifier workaround.
+ *
+ * `build-service/next.config.mjs` applies `scripts/turbopack-js-to-ts-loader.cjs`
+ * to every `*.ts`/`*.tsx` because Turbopack has no equivalent of webpack's
+ * `resolve.extensionAlias` and throws a hard "Module not found" on some
+ * `./foo.js` imports whose real source is `./foo.ts` — the convention this
+ * repo uses everywhere (tsconfig `moduleResolution: "bundler"`).
+ *
+ * The CLI vendors the SAME source tree, including the jwt-session subtree that
+ * provoked the original failure, and compiles it with Turbopack in
+ * `jamdesk dev`. So the CLI config needs the same rule, and the loader has to
+ * be vendored or the rule points at a file that is not in the workspace.
+ *
+ * CLAUDE.md already requires that a build-service next.config change be
+ * mirrored into the CLI config by hand. This test is what makes that rule
+ * enforceable instead of aspirational.
+ */
+export {};
+//# sourceMappingURL=turbopack-loader-config-drift.test.d.ts.map

package/dist/__tests__/unit/turbopack-loader-config-drift.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turbopack-loader-config-drift.test.d.ts","sourceRoot":"","sources":["../../../src/__tests__/unit/turbopack-loader-config-drift.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG"}

package/dist/__tests__/unit/turbopack-loader-config-drift.test.js

@@ -0,0 +1,79 @@
+/**
+ * Drift guard for the Turbopack `.js`-specifier workaround.
+ *
+ * `build-service/next.config.mjs` applies `scripts/turbopack-js-to-ts-loader.cjs`
+ * to every `*.ts`/`*.tsx` because Turbopack has no equivalent of webpack's
+ * `resolve.extensionAlias` and throws a hard "Module not found" on some
+ * `./foo.js` imports whose real source is `./foo.ts` — the convention this
+ * repo uses everywhere (tsconfig `moduleResolution: "bundler"`).
+ *
+ * The CLI vendors the SAME source tree, including the jwt-session subtree that
+ * provoked the original failure, and compiles it with Turbopack in
+ * `jamdesk dev`. So the CLI config needs the same rule, and the loader has to
+ * be vendored or the rule points at a file that is not in the workspace.
+ *
+ * CLAUDE.md already requires that a build-service next.config change be
+ * mirrored into the CLI config by hand. This test is what makes that rule
+ * enforceable instead of aspirational.
+ */
+import { describe, it, expect } from 'vitest';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const CLI_ROOT = path.join(__dirname, '../../..');
+const BUILD_SERVICE = path.join(CLI_ROOT, '../build-service');
+const LOADER_BASENAME = 'turbopack-js-to-ts-loader.cjs';
+const CONFIGS = {
+    'build-service/next.config.mjs': path.join(BUILD_SERVICE, 'next.config.mjs'),
+    'cli/config/next.config.js': path.join(CLI_ROOT, 'config/next.config.js'),
+    'cli/vendored/next.config.js': path.join(CLI_ROOT, 'vendored/next.config.js'),
+};
+function read(p) {
+    return fs.readFileSync(p, 'utf8');
+}
+/** Comments stripped, so a prose edit never fails the guard. */
+function code(src) {
+    return src.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+}
+describe('Turbopack loader rule is mirrored across every Next config', () => {
+    for (const [label, file] of Object.entries(CONFIGS)) {
+        it(`${label} applies the loader to *.ts and *.tsx`, () => {
+            const src = code(read(file));
+            expect(src, `${label} is missing a turbopack.rules block`).toMatch(/rules\s*:\s*\{/);
+            for (const glob of ['*.ts', '*.tsx']) {
+                const re = new RegExp(`'\\${glob}'\\s*:\\s*\\{\\s*loaders\\s*:\\s*\\[\\s*'\\./scripts/${LOADER_BASENAME.replace(/\./g, '\\.')}'`);
+                expect(src, `${label} does not route ${glob} through ${LOADER_BASENAME}`).toMatch(re);
+            }
+        });
+        it(`${label} keeps the webpack extensionAlias fallback`, () => {
+            // `jamdesk dev --webpack` is an advertised escape hatch (src/index.ts),
+            // and webpack needs the alias for exactly the same imports.
+            const src = code(read(file));
+            expect(src, `${label} is missing resolve.extensionAlias`).toMatch(/extensionAlias/);
+            expect(src).toMatch(/'\.js'\s*:\s*\[\s*'\.ts'\s*,\s*'\.tsx'\s*,\s*'\.js'\s*\]/);
+        });
+    }
+});
+describe('the loader itself is present wherever a config points at it', () => {
+    const canonical = path.join(BUILD_SERVICE, 'scripts', LOADER_BASENAME);
+    const vendored = path.join(CLI_ROOT, 'vendored/scripts', LOADER_BASENAME);
+    it('exists in build-service/scripts', () => {
+        expect(fs.existsSync(canonical), `${canonical} is missing`).toBe(true);
+    });
+    it('is vendored into the CLI workspace tree', () => {
+        // dev.ts copies vendored/ wholesale into the workspace, so vendored/scripts
+        // becomes <workspace>/scripts — the path the rule resolves against.
+        expect(fs.existsSync(vendored), `${vendored} is missing; add it to safeScripts in cli/scripts/vendor.js`).toBe(true);
+    });
+    it('is byte-identical to the canonical copy', () => {
+        expect(read(vendored)).toBe(read(canonical));
+    });
+    it('is on the vendor allowlist, so re-vendoring keeps it', () => {
+        // The copy loop in vendor.js is existsSync-guarded, so an omission here is
+        // silent: vendoring succeeds and the CLI fails at compile time instead.
+        const vendorScript = read(path.join(CLI_ROOT, 'scripts/vendor.js'));
+        expect(vendorScript).toContain(LOADER_BASENAME);
+    });
+});
+//# sourceMappingURL=turbopack-loader-config-drift.test.js.map

package/dist/__tests__/unit/turbopack-loader-config-drift.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turbopack-loader-config-drift.test.js","sourceRoot":"","sources":["../../../src/__tests__/unit/turbopack-loader-config-drift.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAClD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAE9D,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAExD,MAAM,OAAO,GAAG;IACd,+BAA+B,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC;IAC5E,2BAA2B,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACzE,6BAA6B,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,yBAAyB,CAAC;CAC9E,CAAC;AAEF,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACpC,CAAC;AAED,gEAAgE;AAChE,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,QAAQ,CAAC,4DAA4D,EAAE,GAAG,EAAE;IAC1E,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,EAAE,CAAC,GAAG,KAAK,uCAAuC,EAAE,GAAG,EAAE;YACvD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,qCAAqC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACrF,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,wDAAwD,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;gBAClI,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,mBAAmB,IAAI,YAAY,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACxF,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,GAAG,KAAK,4CAA4C,EAAE,GAAG,EAAE;YAC5D,wEAAwE;YACxE,4DAA4D;YAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,oCAAoC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YACpF,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6DAA6D,EAAE,GAAG,EAAE;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,EAAE,eAAe,CAAC,CAAC;IAE1E,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,GAAG,SAAS,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,4EAA4E;QAC5E,oEAAoE;QACpE,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,GAAG,QAAQ,6DAA6D,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jamdesk",
-  "version": "1.1.205",
+  "version": "1.1.206",
   "description": "CLI for Jamdesk \u2014 build, preview, and deploy documentation sites from MDX. Dev server with hot reload, 50+ components, OpenAPI support, AI search, and Mintlify migration",
   "keywords": [
     "jamdesk",

package/vendored/app/[[...slug]]/page.tsx

@@ -5,10 +5,7 @@
 // non-ISR local dev). The render body lives in lib/render-doc-page.tsx.
 import { headers } from 'next/headers';
 import { after } from 'next/server';
-import fs from 'fs';
-import path from 'path';
 import type { Metadata } from 'next';
-import { getContentDir } from '@/lib/docs';
 import {
   isIsrMode,
   getProjectFromRequest,
@@ -18,7 +15,7 @@ import {
 import { renderDocPage, buildDocMetadata, type RenderInput } from '@/lib/render-doc-page';
 import { readNewsletterDisplay } from '@/lib/newsletter-display';
 import { withR2OpsContext, emitR2OpsSummary } from '@/lib/r2-content';
-import { readFileSync as readMdxFile } from '@/lib/fs-readfile';
+import { getAllDocPaths } from '@/lib/mdx-import-scan';
 
 export const dynamic = 'force-dynamic';
 export const dynamicParams = true;
@@ -30,104 +27,6 @@ interface PageProps {
   }>;
 }
 
-// Mirror of the CLI's detector regex in cli/src/lib/relative-mdx-imports.ts.
-// Duplicated intentionally — build-service uses bundler module resolution
-// and shouldn't reach into cli/src/. Keep the regex itself in sync with
-// that file. Two intentional simplifications vs the CLI version:
-//   - no `g` flag (boolean test, not iteration)
-//   - fence stripping replaces matches with empty string instead of
-//     blank lines of equal count — line numbers don't matter here, only
-//     a yes/no skip decision (the CLI preserves them for warning text).
-const PARENT_RELATIVE_MDX_IMPORT_RE =
-  /^[ \t]*import\s+(?:type\s+)?[\w$*{}, \n\r]+\s+from\s+["']\.{1,2}\/[^"']+\.mdx["']\s*;?/m;
-
-const FENCED_CODE_BLOCK_RE =
-  /^( *)(```+|~~~+)[^\n]*\n([\s\S]*?)\n\1\2\s*$/gm;
-
-// Cache for pageHasRelativeMdxImport, keyed by absolute file path,
-// invalidated when the file's mtime changes. `generateStaticParams` runs
-// on every nav in `jamdesk dev`, and the regex-test reads the FULL file
-// (per fix 7205c17c). For dodo (~200 MDX × 70-94 KB) that's 14-19 MB of
-// disk I/O per nav. Cache hit reduces it to a directory walk + statSync.
-//
-// In production ISR mode generateStaticParams returns [] before any of
-// this runs (see isIsrMode early-return), so the cache is dev-only in
-// practice. The cache is unbounded — entries for deleted files persist
-// until process exit. For a dev-only ~200-file working set this is
-// trivial (a few KB). If this pattern is reused in a long-running ISR
-// context in the future, add LRU eviction or rebuild-on-walk.
-const mdxImportCache = new Map<string, { mtimeMs: number; hasImport: boolean }>();
-
-export function pageHasRelativeMdxImport(filePath: string, mtimeMs?: number): boolean {
-  const cached = mdxImportCache.get(filePath);
-  if (cached && mtimeMs !== undefined && cached.mtimeMs === mtimeMs) {
-    return cached.hasImport;
-  }
-
-  let hasImport: boolean;
-  try {
-    // Read the full file — MDX imports can appear at any top-level position
-    // (after a long prose intro or table of contents), and a slice was
-    // missing real imports past byte ~8192 in 70-94 KB customer pages.
-    const content = readMdxFile(filePath);
-    // Strip fenced code blocks so documentation examples (e.g.
-    // ```mdx\nimport X from "../snippets/foo.mdx";\n```) don't false-trigger.
-    hasImport = PARENT_RELATIVE_MDX_IMPORT_RE.test(content.replace(FENCED_CODE_BLOCK_RE, ''));
-  } catch {
-    hasImport = false;
-  }
-
-  if (mtimeMs !== undefined) {
-    mdxImportCache.set(filePath, { mtimeMs, hasImport });
-  }
-  return hasImport;
-}
-
-/** Test-only: clear the per-file MDX-import cache between test cases. */
-export function _resetMdxImportCacheForTest(): void {
-  if (process.env.NODE_ENV === 'production') return;
-  mdxImportCache.clear();
-}
-
-interface CollectedPaths {
-  supported: string[];
-  skipped: string[];
-}
-
-export function getAllDocPaths(): CollectedPaths {
-  const contentDir = getContentDir();
-  const supported: string[] = [];
-  const skipped: string[] = [];
-
-  function traverseDir(dir: string, basePath: string = '') {
-    if (!fs.existsSync(dir)) return;
-    const files = fs.readdirSync(dir);
-    for (const file of files) {
-      if (file.startsWith('.')) continue;
-      const filePath = path.join(dir, file);
-      let stat;
-      try {
-        stat = fs.statSync(filePath);
-      } catch {
-        continue;
-      }
-      if (stat.isDirectory()) {
-        traverseDir(filePath, path.join(basePath, file));
-      } else if (file.endsWith('.mdx')) {
-        const slug = path.join(basePath, file.replace(/\.mdx$/, ''));
-        if (pageHasRelativeMdxImport(filePath, stat.mtimeMs)) {
-          skipped.push(slug);
-        } else {
-          supported.push(slug);
-        }
-      }
-    }
-  }
-
-  traverseDir(contentDir);
-  return { supported, skipped };
-}
-
 // In `jamdesk dev`, Next.js calls generateStaticParams during initial
 // compile AND for each lazily-compiled route (every page click). Without
 // a guard the same multi-line warning floods the dev console after every

package/vendored/app/api/jd/auth/logout/route.ts

@@ -10,6 +10,18 @@
  * route's redirects: never `NextResponse.redirect(new URL('/', req.url))`,
  * since `req.url`'s host is the internal rewrite host, not the customer's
  * public host behind a reverse proxy.
+ *
+ * Cross-site protection: clearing a cookie from a GET means any page on the
+ * web could log a reader out by pointing an <img> or <iframe> at this URL.
+ * We do NOT use `isSameOriginRequest` here, unlike the cookie-MINTING routes.
+ * That helper rejects `cross-site`, and a perfectly legitimate 'Log out of
+ * docs' link on the customer's own app is cross-site. The attack and the
+ * legitimate link differ by Sec-Fetch-Dest, not by site: a forced logout is
+ * always a sub-resource load, a real logout is always a document navigation.
+ * So we clear only for `document` (plus clients that send no Sec-Fetch at
+ * all, i.e. curl and pre-2020 browsers, which cannot be attacked this way).
+ * A suppressed logout still 303s — the route's contract is that it never
+ * fails loudly — it just leaves the session alone.
  */
 
 import { resolveAuth } from '@/lib/auth-resolver';
@@ -17,6 +29,23 @@ import { resolveAuth } from '@/lib/auth-resolver';
 export const runtime = 'nodejs';
 export const dynamic = 'force-dynamic';
 
+/**
+ * True when this GET is a real top-level navigation, so acting on it is the
+ * reader's own doing. Sec-Fetch-Dest is browser-set and page-unforgeable.
+ * Absent means a non-browser client, which cannot be the victim of a
+ * cross-site sub-resource load, so we act.
+ *
+ * Prefetch is excluded separately: a speculative fetch of the logout link
+ * carries `Sec-Fetch-Dest: document` but no reader ever clicked it.
+ */
+function isUserInitiatedNavigation(req: Request): boolean {
+  const purpose = req.headers.get('sec-purpose') || '';
+  if (purpose.includes('prefetch')) return false;
+  const dest = req.headers.get('sec-fetch-dest');
+  if (!dest) return true;
+  return dest === 'document';
+}
+
 export async function GET(req: Request): Promise<Response> {
   const slug = req.headers.get('x-project-slug');
   // Relative '/' works for the same-site fallback; the customer loginUrl is
@@ -29,10 +58,13 @@ export async function GET(req: Request): Promise<Response> {
     } catch { /* logout must always succeed; fall back to '/' */ }
   }
   const headers = new Headers({ Location: location, 'Cache-Control': 'no-store' });
-  if (slug) {
-    headers.append('Set-Cookie', `jd_auth_${slug}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
+  if (isUserInitiatedNavigation(req)) {
+    if (slug) {
+      headers.append('Set-Cookie', `jd_auth_${slug}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`);
+    }
+    // Clear the client-readable hint the callback set (Task 8) alongside it,
+    // so the header never advertises a session the cookie no longer backs.
+    headers.append('Set-Cookie', 'jd_authed=; Path=/; Secure; SameSite=Lax; Max-Age=0');
   }
-  // Always clear the client-readable hint the callback set (Task 8).
-  headers.append('Set-Cookie', 'jd_authed=; Path=/; Secure; SameSite=Lax; Max-Age=0');
   return new Response(null, { status: 303, headers });
 }

package/vendored/app/api/jd/unlock/route.ts

@@ -24,6 +24,7 @@ import { sanitizeFrom } from '@/lib/sanitize-from';
 import { VALID_SLUG_RE } from '@/lib/middleware-helpers';
 import { signAuthCookie } from '@/shared/auth-cookie';
 import { secretsEqual } from '@/lib/crypto-helpers';
+import { MASTER_AUDIT_TAG } from '@/lib/unlock-audit';
 import { isSameOriginRequest } from '@/lib/same-origin';
 
 const scryptAsync = promisify(scrypt) as (
@@ -68,10 +69,6 @@ const MASTER_COOKIE_MAX_AGE = 60 * 60;
 // an attacker rotates slugs to evade the per-slug limit.
 const MASTER_PASSWORD_MIN_LENGTH = 32;
 
-// Audit log tag emitted on every successful master-password unlock. Exported
-// so tests can assert exact format without duplicating the literal.
-export const MASTER_AUDIT_TAG = '[unlock] master-password used';
-
 // Pre-compute a dummy hash at module load time so we can always run scrypt
 // even when no hash is stored, preventing timing oracles that reveal whether
 // a project has password protection configured.

package/vendored/lib/auth-plane-write-warning.ts

@@ -0,0 +1,84 @@
+import type { BuildWarning } from '../shared/status-reporter.js'; // vendored copy — NOT '../../shared'
+
+/**
+ * Warn when a gated project finished a build without its auth plane written.
+ *
+ * `setProjectAuthPublic` is the only thing that puts a project's gate config
+ * where the edge can read it, and in build.ts it sits inside a try whose catch
+ * logs `Failed to write projectAuthPublic to Redis (non-fatal)` and lets the
+ * build go green. That non-fatal choice is right for availability and wrong for
+ * visibility: `resolveAuth` returns null when the key is absent, and a null
+ * resolve means `applyAuthGate` returns null, which is NO GATE. So the failure
+ * mode of a dropped write is a fully public site reported as a successful build.
+ *
+ * Two ways in, neither of them a misconfiguration:
+ *   - Upstash is briefly unavailable during the write.
+ *   - The payload outgrows what `upstashCommand` can put in a URL path. It
+ *     encodes the whole value into the path, and a few hundred group-restricted
+ *     pages is tens of KB of URL, so this one arrives through ordinary growth on
+ *     a project that has been fine for months.
+ *
+ * Deliberately mode-agnostic. The fail-open lives in `resolveAuth` returning
+ * null, which happens before authType is ever consulted, so a password tenant
+ * loses its gate exactly as a jwt tenant does. Silent when `enabled` is false,
+ * where serving publicly is the stated intent.
+ *
+ * This warns rather than fails the build. Failing would be the safer default on
+ * the ordering alone (the write precedes the R2 upload, so a hard fail would
+ * stop unprotected content from publishing at all), but it converts every
+ * transient Upstash blip into a broken customer build. That tradeoff is a
+ * product call, not a build-service one.
+ */
+export function buildAuthPlaneWriteWarning(input: {
+  enabled: boolean;
+  writeFailed: boolean;
+}): BuildWarning | null {
+  if (!input.enabled || !input.writeFailed) return null;
+  return {
+    // Same reuse, and the same reasoning, as buildJwtKeyWarning: this routing
+    // (emailed, counted, badged) is what the warning needs, and a dedicated
+    // BuildWarningType would mean the six-place sync chain for no difference.
+    type: 'invalid_openapi_spec',
+    file: 'docs.json',
+    message:
+      'This project is password or JWT protected, but the build could not publish its access rules, ' +
+      'so the site is currently readable by anyone. Rebuild to retry. ' +
+      'If it keeps failing, the access rules may have grown too large to store and support can raise it.',
+  };
+}
+
+/**
+ * Does docs.json itself declare a gate? Read BEFORE the auth try block, so the
+ * warning above survives a throw inside it.
+ *
+ * The gap this closes: `authPlaneGated` used to be assigned only from
+ * `effectiveEnabled`, ~19 lines into the try, after `pageInfos.map` and
+ * `detectAuthMode`. Anything throwing in that window skipped both the
+ * assignment AND `setProjectAuthPublic`, so the site went public and the
+ * warning was suppressed by the same throw. That window is reachable from
+ * user-supplied config: `collectGroupsPaths` does
+ * `(navigation?.languages ?? []).map(...)`, and `??` only guards null and
+ * undefined, so a `languages` that is a string throws.
+ *
+ * Mirrors `detectAuthMode`'s own test exactly (`?.enabled === true`), never
+ * truthiness — 'false' and 0 are not gates there and must not be gates here,
+ * or the warning fires on a site that is public by intent.
+ *
+ * MUST NOT THROW. Optional chaining is safe against any non-null value, which
+ * is the point: docs.json is user JSON and `auth` can be a string, an array or
+ * a number. Callers combine this monotonically (`a || b`) with the in-try
+ * value, so it can only ever turn the warning on.
+ *
+ * Residual, named rather than hidden: `specific` mode is frontmatter-derived
+ * (`collectPrivatePaths`), so a tenant gated only by per-page `private`
+ * frontmatter reads false here. A throw before `detectAuthMode` on such a
+ * tenant still goes unwarned. Covering it would mean replicating the
+ * frontmatter walk outside the try, which reintroduces the throw it guards.
+ */
+export function configDeclaresGate(docsConfig: unknown): boolean {
+  const auth = (docsConfig as { auth?: unknown } | null | undefined)?.auth as {
+    password?: { enabled?: unknown };
+    jwt?: { enabled?: unknown };
+  } | undefined;
+  return auth?.password?.enabled === true || auth?.jwt?.enabled === true;
+}

package/vendored/lib/jwt-key-build-warning.ts

@@ -0,0 +1,38 @@
+import type { BuildWarning } from '../shared/status-reporter.js'; // vendored copy — NOT '../../shared'
+
+/**
+ * Warn when a project declares JWT authentication but has no signing key.
+ *
+ * The truth table in auth-resolver.ts is explicit: `authType === 'jwt'` with a
+ * missing or malformed `projectJwtSecret` means NO GATE. That is the correct
+ * fail-safe for a key that was cleared deliberately, but it is also reachable
+ * by accident: commit `auth.jwt.enabled: true`, publish, and never click
+ * Generate signing key. The build then succeeds, the site serves every page to
+ * the public, and nothing says so. The dashboard card does report it, but a
+ * customer who publishes from git has no reason to open that page.
+ *
+ * Silent for `enabled: false`, where a public site is the stated intent, and
+ * silent for password tenants, whose own secret has its own row in that table.
+ * A password tenant can legitimately still hold a JWT key from a half-finished
+ * migration; coexistence is by design and only `authType` decides.
+ */
+export function buildJwtKeyWarning(input: {
+  authType: 'password' | 'jwt';
+  enabled: boolean;
+  hasSigningKey: boolean;
+}): BuildWarning | null {
+  if (input.authType !== 'jwt' || !input.enabled || input.hasSigningKey) return null;
+  return {
+    // Reuses invalid_openapi_spec deliberately: it already routes the way this
+    // needs — emailed, counted, badged, not filed as a suggestion — and a
+    // dedicated BuildWarningType would mean editing the six-place sync chain
+    // plus EMAILABLE_TYPES for no behavioural difference. Same reasoning, and
+    // the same call, as the spec-expansion warnings in build.ts.
+    type: 'invalid_openapi_spec',
+    // docs.json is where the opt-in lives and what an author edits to change it.
+    file: 'docs.json',
+    message:
+      'auth.jwt.enabled is true but this project has no signing key, so nothing is gated and every page is publicly readable. ' +
+      'Generate an Ed25519 signing key under Settings, or set auth.jwt.enabled to false if the site is meant to be public.',
+  };
+}

package/vendored/lib/mdx-import-scan.ts

@@ -0,0 +1,110 @@
+// Extracted from app/[[...slug]]/page.tsx: Next.js's route/page typegen
+// requires that a page.tsx export ONLY the known page-convention symbols
+// (default, generateStaticParams, generateMetadata, dynamic, ...) — any
+// other export fails `tsc`'s check of .next/types/app/**/page.ts with
+// TS2344 ("does not satisfy the constraint '{ [x: string]: never }'").
+// These helpers are used internally by generateStaticParams but also need
+// to be unit-testable, so they live here instead and are imported (not
+// re-exported) by page.tsx.
+import fs from 'fs';
+import path from 'path';
+import { getContentDir } from '@/lib/docs';
+import { readFileSync as readMdxFile } from '@/lib/fs-readfile';
+
+// Mirror of the CLI's detector regex in cli/src/lib/relative-mdx-imports.ts.
+// Duplicated intentionally — build-service uses bundler module resolution
+// and shouldn't reach into cli/src/. Keep the regex itself in sync with
+// that file. Two intentional simplifications vs the CLI version:
+//   - no `g` flag (boolean test, not iteration)
+//   - fence stripping replaces matches with empty string instead of
+//     blank lines of equal count — line numbers don't matter here, only
+//     a yes/no skip decision (the CLI preserves them for warning text).
+const PARENT_RELATIVE_MDX_IMPORT_RE =
+  /^[ \t]*import\s+(?:type\s+)?[\w$*{}, \n\r]+\s+from\s+["']\.{1,2}\/[^"']+\.mdx["']\s*;?/m;
+
+const FENCED_CODE_BLOCK_RE =
+  /^( *)(```+|~~~+)[^\n]*\n([\s\S]*?)\n\1\2\s*$/gm;
+
+// Cache for pageHasRelativeMdxImport, keyed by absolute file path,
+// invalidated when the file's mtime changes. `generateStaticParams` runs
+// on every nav in `jamdesk dev`, and the regex-test reads the FULL file
+// (per fix 7205c17c). For dodo (~200 MDX × 70-94 KB) that's 14-19 MB of
+// disk I/O per nav. Cache hit reduces it to a directory walk + statSync.
+//
+// In production ISR mode generateStaticParams returns [] before any of
+// this runs (see isIsrMode early-return), so the cache is dev-only in
+// practice. The cache is unbounded — entries for deleted files persist
+// until process exit. For a dev-only ~200-file working set this is
+// trivial (a few KB). If this pattern is reused in a long-running ISR
+// context in the future, add LRU eviction or rebuild-on-walk.
+const mdxImportCache = new Map<string, { mtimeMs: number; hasImport: boolean }>();
+
+export function pageHasRelativeMdxImport(filePath: string, mtimeMs?: number): boolean {
+  const cached = mdxImportCache.get(filePath);
+  if (cached && mtimeMs !== undefined && cached.mtimeMs === mtimeMs) {
+    return cached.hasImport;
+  }
+
+  let hasImport: boolean;
+  try {
+    // Read the full file — MDX imports can appear at any top-level position
+    // (after a long prose intro or table of contents), and a slice was
+    // missing real imports past byte ~8192 in 70-94 KB customer pages.
+    const content = readMdxFile(filePath);
+    // Strip fenced code blocks so documentation examples (e.g.
+    // ```mdx\nimport X from "../snippets/foo.mdx";\n```) don't false-trigger.
+    hasImport = PARENT_RELATIVE_MDX_IMPORT_RE.test(content.replace(FENCED_CODE_BLOCK_RE, ''));
+  } catch {
+    hasImport = false;
+  }
+
+  if (mtimeMs !== undefined) {
+    mdxImportCache.set(filePath, { mtimeMs, hasImport });
+  }
+  return hasImport;
+}
+
+/** Test-only: clear the per-file MDX-import cache between test cases. */
+export function _resetMdxImportCacheForTest(): void {
+  if (process.env.NODE_ENV === 'production') return;
+  mdxImportCache.clear();
+}
+
+interface CollectedPaths {
+  supported: string[];
+  skipped: string[];
+}
+
+export function getAllDocPaths(): CollectedPaths {
+  const contentDir = getContentDir();
+  const supported: string[] = [];
+  const skipped: string[] = [];
+
+  function traverseDir(dir: string, basePath: string = '') {
+    if (!fs.existsSync(dir)) return;
+    const files = fs.readdirSync(dir);
+    for (const file of files) {
+      if (file.startsWith('.')) continue;
+      const filePath = path.join(dir, file);
+      let stat;
+      try {
+        stat = fs.statSync(filePath);
+      } catch {
+        continue;
+      }
+      if (stat.isDirectory()) {
+        traverseDir(filePath, path.join(basePath, file));
+      } else if (file.endsWith('.mdx')) {
+        const slug = path.join(basePath, file.replace(/\.mdx$/, ''));
+        if (pageHasRelativeMdxImport(filePath, stat.mtimeMs)) {
+          skipped.push(slug);
+        } else {
+          supported.push(slug);
+        }
+      }
+    }
+  }
+
+  traverseDir(contentDir);
+  return { supported, skipped };
+}

package/vendored/lib/unlock-audit.ts

@@ -0,0 +1,10 @@
+// Extracted from app/api/jd/unlock/route.ts: Next.js's route typegen requires
+// that a route.ts export ONLY the known route-convention symbols (GET, POST,
+// runtime, dynamic, ...) — any other export fails `tsc`'s check of
+// .next/types/app/**/route.ts with TS2344 ("does not satisfy the constraint
+// '{ [x: string]: never }'"). This constant is used by the route handler but
+// also needs to be assertable-against in tests, so it lives here instead.
+
+// Audit log tag emitted on every successful master-password unlock. Exported
+// so tests can assert exact format without duplicating the literal.
+export const MASTER_AUDIT_TAG = '[unlock] master-password used';

package/vendored/next.config.js

@@ -70,6 +70,25 @@ const nextConfig = {
       '../build/polyfills/polyfill-module': './lib/empty-polyfill.js',
       'next/dist/build/polyfills/polyfill-module': './lib/empty-polyfill.js',
     },
+    // Mirrors build-service/next.config.mjs. Turbopack has no equivalent of
+    // webpack's resolve.extensionAlias (https://github.com/vercel/next.js/issues/82945),
+    // so a relative `./foo.js` import whose real source is `./foo.ts` can fail
+    // to resolve. That is the convention every file in vendored/ uses, 120
+    // relative `.js` specifiers of it, including the lib/jwt-session.ts ->
+    // lib/public-paths-resolver.ts chain that made build-service fail
+    // deterministically. The workspace compiles the same tree, so it needs
+    // the same rule. Exempt from this file's keep-it-minimal rule: the
+    // 80s-compile warning above is about turbopack.root and resolution
+    // scope, and this is one regex pass over source text.
+    //
+    // vendored/ is copied wholesale into the workspace, so vendored/scripts
+    // lands at <workspace>/scripts and this relative path resolves. The
+    // loader is on the safeScripts allowlist in cli/scripts/vendor.js;
+    // turbopack-loader-config-drift.test.ts pins all of it together.
+    rules: {
+      '*.ts': { loaders: ['./scripts/turbopack-js-to-ts-loader.cjs'] },
+      '*.tsx': { loaders: ['./scripts/turbopack-js-to-ts-loader.cjs'] },
+    },
   },
   // Critical for fast builds
   experimental: {
@@ -87,6 +106,19 @@ const nextConfig = {
       '@radix-ui/react-tooltip',
     ],
   },
+  // `jamdesk dev --webpack` is an advertised fallback (src/index.ts), and
+  // webpack needs the same `.js`-means-`.ts` mapping the Turbopack rule above
+  // provides. Without it the escape hatch fails on the imports the escape
+  // hatch exists to work around.
+  webpack: (config) => {
+    config.resolve.extensionAlias = {
+      ...config.resolve.extensionAlias,
+      '.js': ['.ts', '.tsx', '.js'],
+      '.mjs': ['.mts', '.mjs'],
+      '.cjs': ['.cts', '.cjs'],
+    }
+    return config
+  },
 }
 
 export default nextConfig

package/vendored/scripts/turbopack-js-to-ts-loader.cjs

@@ -0,0 +1,51 @@
+/**
+ * Turbopack build-time source transform: strips the `.js` suffix off
+ * RELATIVE import/export/dynamic-import specifiers before Turbopack's own
+ * resolver sees them.
+ *
+ * Why this exists: this project's tsconfig.json sets
+ * `moduleResolution: "bundler"`, the TypeScript convention where source
+ * files are `.ts` but every relative import of them is written with a
+ * `.js` suffix (e.g. `import { x } from './foo.js'` for a file that is
+ * actually `./foo.ts` on disk). webpack supports this natively via
+ * `resolve.extensionAlias` (wired up in next.config.mjs's `webpack()`
+ * function). Turbopack has NO equivalent, documented, built-in support for
+ * this as of Next.js 16.3.x — see https://github.com/vercel/next.js/issues/82945
+ * ("Turbopack: support importing .ts/.tsx via .js extension"), which is
+ * open/unfixed upstream. In practice Turbopack resolves the VAST MAJORITY
+ * of this project's `.js`-suffixed relative imports fine through some
+ * internal inference, but was observed to throw a hard "Module not found"
+ * for specific files/subtrees (e.g. the whole lib/jwt-session.ts ->
+ * lib/public-paths-resolver.ts -> lib/{docs-types,glob-match,
+ * find-first-nav-page,language-utils}.ts chain added by the jwt docs-auth
+ * feature) — confirmed via a standalone unrs-resolver probe, and via
+ * removing the `.js` suffix by hand (which fixes resolution one hop at a
+ * time, confirming the failure is the extension-alias gap, not a real
+ * missing file). Rather than rewrite this project's whole import style
+ * (pervasive, deliberate convention — see tsconfig.json's
+ * `moduleResolution: "bundler"` and CLAUDE.md), this loader rewrites the
+ * `.js` -> (nothing) at Turbopack-compile time only. TypeScript itself,
+ * `tsc --noEmit`, vitest, and webpack builds are all UNAFFECTED (this file
+ * is wired into next.config.mjs's `turbopack.rules` only).
+ *
+ * Scoped to RELATIVE specifiers only (`./x.js`, `../x.js`) — never bare
+ * package specifiers — so a legitimate deep import of an npm package's own
+ * `.js` file (e.g. a subpath export) is never touched.
+ *
+ * Community-sourced workaround for the same open issue, adapted to be
+ * relative-imports-only (the referenced version was unscoped):
+ * https://github.com/vercel/next.js/issues/82945#issuecomment-3269958583
+ */
+
+// Matches: (import|export) ... from '<spec>'; and dynamic import('<spec>')
+// where <spec> starts with ./ or ../ and ends in .js/.jsx/.mjs, capturing
+// the quote character so it round-trips exactly.
+const RELATIVE_JS_SPECIFIER_RE =
+  /((?:from\s+|import\()\s*)(["'])(\.\.?\/[^"']+?)\.(m?js|jsx)\2/g;
+
+module.exports = function stripRelativeJsExtensions(source) {
+  return source.replace(
+    RELATIVE_JS_SPECIFIER_RE,
+    (_match, prefix, quote, specPath) => `${prefix}${quote}${specPath}${quote}`,
+  );
+};

package/vendored/workspace-package-lock.json

@@ -82,13 +82,13 @@
       }
     },
     "node_modules/@antfu/install-pkg": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@antfu/install-pkg/-/install-pkg-2.0.1.tgz",
-      "integrity": "sha512-iCKVQcIC0e3oDxEfs3SHQGW+ovhBMZmS1TE+bTk50rVyMCBmCfClv7Qi3HQKlumYwvjb/iIMeWCW2i67q6kFfQ==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@antfu/install-pkg/-/install-pkg-2.1.0.tgz",
+      "integrity": "sha512-sdg9NxU3zR4Mnawfbc/x6GB5Wf17WYud5qOuEuxXjaKpYpMkISSJEjItGebXJ2bQ4DIcly4NYH23mtkGJjvKUw==",
       "license": "MIT",
       "dependencies": {
-        "package-manager-detector": "^1.7.0",
-        "tinyexec": "^1.2.4"
+        "package-manager-detector": "^1.8.0",
+        "tinyexec": "^1.3.1"
       },
       "funding": {
         "url": "https://github.com/sponsors/antfu"
@@ -1974,9 +1974,9 @@
       "license": "MIT"
     },
     "node_modules/@types/d3-selection": {
-      "version": "3.0.11",
-      "resolved": "https://registry.npmjs.org/@types/d3-selection/-/d3-selection-3.0.11.tgz",
-      "integrity": "sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w==",
+      "version": "3.0.12",
+      "resolved": "https://registry.npmjs.org/@types/d3-selection/-/d3-selection-3.0.12.tgz",
+      "integrity": "sha512-Qe/KWYhEiIIxGs7HrAAjMfShxKldx19SJtr5zu53f3afPsdZNz7HHtdTLXo/kqeiWNXVycI24kSnfzBYkTzpgw==",
       "license": "MIT"
     },
     "node_modules/@types/d3-shape": {
@@ -2119,9 +2119,9 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "26.5.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.5.1.tgz",
-      "integrity": "sha512-CzNm2FezW4VR/LjG6yUdiEgLE/rAQ9Slj5gCu/C2VrdcW7I0ahNZ8DRbHT7zOZ6r3ONgd/bsQIeSaoDGrd1C6g==",
+      "version": "26.6.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.6.1.tgz",
+      "integrity": "sha512-VqGJBMCtdhqkBUCcBLvywI0NJ+KLuVzgNnlBUNFOQjqVxzo2lxLUNg1DSey8+u2u6ktswSAxg+s68QLzWHNOuA==",
       "license": "MIT",
       "dependencies": {
         "undici-types": "~8.9.0"
@@ -2277,9 +2277,9 @@
       }
     },
     "node_modules/autoprefixer": {
-      "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.6.0.tgz",
-      "integrity": "sha512-A26d6qs9kqGgkmImIXMYvXTzqb4Qv7AVgpY1NXzr9Y659J8qHHnLOO/zE8ewIGFMprOolAoRAQYDgNryXIJKBw==",
+      "version": "10.6.1",
+      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.6.1.tgz",
+      "integrity": "sha512-cL1Qz6ADZhcEbny/8HPfe99J6HhNoYtpX2LFLIbhgGE7Q1hlQVkYFdetDN7Id3KiQxhDrHwzlHr/YQCnZ8+xSA==",
       "funding": [
         {
           "type": "opencollective",
@@ -2332,9 +2332,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.11.23",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.23.tgz",
-      "integrity": "sha512-le521dGVfxM7yRX0EikCoSz+rOK+hHzdDt/E7mG1jOJB/6WAAUuwVroLwaB7ApaUsz5Q0kFlDXLSA9MheUIfRQ==",
+      "version": "2.11.24",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.24.tgz",
+      "integrity": "sha512-hYrgxie335U08WqICoGqKRzV1HFXv6zdxwJE4ekCb80CM9a0SVVsN4QPwT67RraRo+9h8IATk6uxHJw7QSkdOg==",
       "license": "Apache-2.0",
       "bin": {
         "baseline-browser-mapping": "dist/cli.cjs"
@@ -2344,9 +2344,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -2356,9 +2356,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.9",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.9.tgz",
-      "integrity": "sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg==",
+      "version": "4.29.0",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.29.0.tgz",
+      "integrity": "sha512-3GSvyjvDI4Dur1Meg2BekJquu5uF+9R9a1+5M1Mde192eZoXbeXjzgOsgqPS2V8D5wrrip0gR5Hf/GhWQ9ZzaA==",
       "funding": [
         {
           "type": "opencollective",
@@ -2375,11 +2375,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.11.20",
+        "baseline-browser-mapping": "^2.11.23",
         "caniuse-lite": "^1.0.30001810",
-        "electron-to-chromium": "^1.5.420",
-        "node-releases": "^2.0.54",
-        "update-browserslist-db": "^1.3.2"
+        "electron-to-chromium": "^1.5.427",
+        "node-releases": "^2.0.55",
+        "update-browserslist-db": "^1.3.3"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -3132,9 +3132,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.427",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.427.tgz",
-      "integrity": "sha512-n14zb3FdsChZ2BNobqNHAJMcP3ifFv4paox2LvCrfVAQcqGiSURgbJl+PfMpHVCNFkStnNc+RRVtPBTVW5PDgw==",
+      "version": "1.5.429",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.429.tgz",
+      "integrity": "sha512-/1ENIE3cx4HTIx4IfPZFaOunJmsrSVTnj6coXoRVbiJUbkeTyFkJvBeWGkdgh08OhFbxYLMT1kbkwFVSarq6Ow==",
       "license": "ISC"
     },
     "node_modules/empathic": {
@@ -3365,9 +3365,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.7",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
-      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
       "funding": [
         {
           "type": "github",