jamdesk 1.1.205 → 1.1.207

package/vendored/components/ui/CodePanel.tsx

@@ -18,6 +18,15 @@ export interface CodePanelTab {
   statusCode?: string;
   /** Font Awesome icon class for the tab (e.g., 'fa-brands fa-js') */
   icon?: string;
+  /**
+   * Suppress the copy button while THIS tab is the active one. Set from a
+   * `nocopy` code fence. Per-tab rather than panel-wide because a CodeGroup
+   * mixes flagged and unflagged fences in one panel: the old panel-only flag
+   * forced an all-or-nothing choice, and CodeGroup resolved it by honouring
+   * nocopy for single-block groups only — so a nocopy fence sharing a group
+   * with any sibling silently kept its copy button.
+   */
+  hideCopy?: boolean;
 }
 
 /**
@@ -38,6 +47,13 @@ export interface CodePanelProps {
   hideTabs?: boolean;
   /** Show expand button to open fullscreen modal */
   enableFullscreen?: boolean;
+  /**
+   * Suppress the copy button for every tab, for blocks whose rendered text is
+   * not runnable — console transcripts with prompts and output interleaved,
+   * redacted values, deliberate counter-examples. A tab's own `hideCopy`
+   * overrides this while that tab is active.
+   */
+  hideCopy?: boolean;
   /** Additional CSS classes */
   className?: string;
 }
@@ -114,6 +130,7 @@ export function CodePanel({
   title,
   hideTabs = false,
   enableFullscreen = false,
+  hideCopy = false,
   className = '',
 }: CodePanelProps) {
   const [activeTab, setActiveTab] = useState(0);
@@ -133,16 +150,28 @@ export function CodePanel({
   // Extract tab labels for sync matching
   const tabLabels = tabs.map(t => t.label);
 
-  // Sync effect: when selectedLabel changes, switch to matching tab
+  // Sync effect: when selectedLabel changes, switch to the matching tab.
+  //
+  // The "already showing it" guard is load-bearing, not an optimisation.
+  // findIndex returns the FIRST match, and two fences in one CodeGroup can
+  // resolve to the same tab label: getTabLabel deliberately collapses several
+  // languages onto one display string (bash -> cURL), and a translation can
+  // collapse two distinct metas into one (projects/mintlify/fr/organize/
+  // navigation.mdx does). Without the guard, clicking the second such tab
+  // broadcast its label, this effect resolved that echo back to the FIRST
+  // index and snapped activeTab there — so the second tab could never be
+  // opened at all, permanently. Selection is therefore satisfied by the ACTIVE
+  // tab's own label rather than by the first index that happens to carry it,
+  // which keeps cross-panel sync intact (a panel showing a different language
+  // still switches) while leaving every tab reachable. Deduplicating labels
+  // would hide the collision without restoring access, and would change what
+  // the reader sees.
   useEffect(() => {
-    if (sync?.selectedLabel) {
-      const matchIndex = tabLabels.findIndex(
-        label => label.toLowerCase() === sync.selectedLabel?.toLowerCase()
-      );
-      if (matchIndex !== -1 && matchIndex !== activeTab) {
-        setActiveTab(matchIndex);
-      }
-    }
+    const selected = sync?.selectedLabel?.toLowerCase();
+    if (!selected) return;
+    if (tabLabels[activeTab]?.toLowerCase() === selected) return;
+    const matchIndex = tabLabels.findIndex((label) => label.toLowerCase() === selected);
+    if (matchIndex !== -1) setActiveTab(matchIndex);
   }, [sync?.selectedLabel, tabLabels, activeTab]);
 
   const handleTabClick = (index: number) => {
@@ -237,6 +266,9 @@ export function CodePanel({
   if (tabs.length === 0) return null;
 
   const currentTab = tabs[activeTab] || tabs[0];
+  // The active tab decides; the panel-level prop is the fallback for callers
+  // that set no per-tab flag (MdxPreBlock's titled branch, RequestExample).
+  const copyHidden = currentTab?.hideCopy ?? hideCopy;
   const isCompact = variant === 'compact';
   const fontSize = isCompact ? '11.5px' : '13.44px';
 
@@ -304,27 +336,29 @@ export function CodePanel({
                 </button>
               )}
               {/* Copy Button */}
-              <button
-                onClick={handleCopy}
-                className={`p-1.5 rounded-md transition-colors flex-shrink-0 cursor-pointer ${enableFullscreen ? 'ml-1' : ''}`}
-                style={{ color: codePanelColors.textMuted }}
-                onMouseEnter={(e) => {
-                  e.currentTarget.style.backgroundColor = codePanelColors.tabHoverBg;
-                  e.currentTarget.style.color = codePanelColors.text;
-                }}
-                onMouseLeave={(e) => {
-                  e.currentTarget.style.backgroundColor = 'transparent';
-                  e.currentTarget.style.color = codePanelColors.textMuted;
-                }}
-                title="Copy code"
-                aria-label="Copy code to clipboard"
-              >
-                {copied ? (
-                  <i className="fa-solid fa-check text-[14px] text-emerald-500" aria-hidden="true" />
-                ) : (
-                  <i className="fa-regular fa-copy text-[14px]" aria-hidden="true" />
-                )}
-              </button>
+              {!copyHidden && (
+                <button
+                  onClick={handleCopy}
+                  className={`p-1.5 rounded-md transition-colors flex-shrink-0 cursor-pointer ${enableFullscreen ? 'ml-1' : ''}`}
+                  style={{ color: codePanelColors.textMuted }}
+                  onMouseEnter={(e) => {
+                    e.currentTarget.style.backgroundColor = codePanelColors.tabHoverBg;
+                    e.currentTarget.style.color = codePanelColors.text;
+                  }}
+                  onMouseLeave={(e) => {
+                    e.currentTarget.style.backgroundColor = 'transparent';
+                    e.currentTarget.style.color = codePanelColors.textMuted;
+                  }}
+                  title="Copy code"
+                  aria-label="Copy code to clipboard"
+                >
+                  {copied ? (
+                    <i className="fa-solid fa-check text-[14px] text-emerald-500" aria-hidden="true" />
+                  ) : (
+                    <i className="fa-regular fa-copy text-[14px]" aria-hidden="true" />
+                  )}
+                </button>
+              )}
             </div>
           </div>
         ) : (
@@ -432,27 +466,29 @@ export function CodePanel({
             </button>
           )}
           {/* Fixed copy button */}
-          <button
-            onClick={handleCopy}
-            className={`p-1.5 rounded-md transition-colors flex-shrink-0 cursor-pointer ${enableFullscreen ? 'ml-1' : 'ml-auto'}`}
-            style={{ color: codePanelColors.textMuted }}
-            onMouseEnter={(e) => {
-              e.currentTarget.style.backgroundColor = codePanelColors.tabHoverBg;
-              e.currentTarget.style.color = codePanelColors.text;
-            }}
-            onMouseLeave={(e) => {
-              e.currentTarget.style.backgroundColor = 'transparent';
-              e.currentTarget.style.color = codePanelColors.textMuted;
-            }}
-            title="Copy code"
-            aria-label="Copy code to clipboard"
-          >
-            {copied ? (
-              <i className="fa-solid fa-check text-[14px] text-emerald-500" aria-hidden="true" />
-            ) : (
-              <i className="fa-regular fa-copy text-[14px]" aria-hidden="true" />
-            )}
-          </button>
+          {!copyHidden && (
+            <button
+              onClick={handleCopy}
+              className={`p-1.5 rounded-md transition-colors flex-shrink-0 cursor-pointer ${enableFullscreen ? 'ml-1' : 'ml-auto'}`}
+              style={{ color: codePanelColors.textMuted }}
+              onMouseEnter={(e) => {
+                e.currentTarget.style.backgroundColor = codePanelColors.tabHoverBg;
+                e.currentTarget.style.color = codePanelColors.text;
+              }}
+              onMouseLeave={(e) => {
+                e.currentTarget.style.backgroundColor = 'transparent';
+                e.currentTarget.style.color = codePanelColors.textMuted;
+              }}
+              title="Copy code"
+              aria-label="Copy code to clipboard"
+            >
+              {copied ? (
+                <i className="fa-solid fa-check text-[14px] text-emerald-500" aria-hidden="true" />
+              ) : (
+                <i className="fa-regular fa-copy text-[14px]" aria-hidden="true" />
+              )}
+            </button>
+          )}
         </div>
         {/* Custom scrollbar track - always visible when there's overflow */}
         {hasOverflow && (
@@ -525,6 +561,7 @@ export function CodePanel({
           tabs={tabs}
           title={title}
           initialTabIndex={activeTab}
+          hideCopy={hideCopy}
         />
       )}
     </div>

package/vendored/components/ui/CodePanelModal.tsx

@@ -11,9 +11,23 @@ interface CodePanelModalProps {
   tabs: CodePanelTab[];
   title?: string;
   initialTabIndex?: number;
+  /**
+   * Suppress the header copy button, Cmd/Ctrl+C shortcut, and its footer hint
+   * for every tab. A tab's own `hideCopy` overrides this while it is active —
+   * the modal tracks its own activeTab, so it resolves this itself rather than
+   * receiving the panel's already-resolved value.
+   */
+  hideCopy?: boolean;
 }
 
-export function CodePanelModal({ isOpen, onClose, tabs, title, initialTabIndex = 0 }: CodePanelModalProps) {
+export function CodePanelModal({
+  isOpen,
+  onClose,
+  tabs,
+  title,
+  initialTabIndex = 0,
+  hideCopy = false,
+}: CodePanelModalProps) {
   const [activeTab, setActiveTab] = useState(initialTabIndex);
   const [copied, setCopied] = useState(false);
   const [isClosing, setIsClosing] = useState(false);
@@ -22,6 +36,9 @@ export function CodePanelModal({ isOpen, onClose, tabs, title, initialTabIndex =
   const contentRef = useRef<HTMLDivElement>(null);
 
   const currentTab = tabs[activeTab];
+  // Must agree with CodePanel's own resolution, or expanding a nocopy tab to
+  // fullscreen would hand back the copy button the panel just suppressed.
+  const copyHidden = currentTab?.hideCopy ?? hideCopy;
 
   // Handle close with animation
   const handleClose = useCallback(() => {
@@ -87,7 +104,7 @@ export function CodePanelModal({ isOpen, onClose, tabs, title, initialTabIndex =
       }
 
       // Cmd/Ctrl+C to copy (when not selecting text)
-      if ((e.metaKey || e.ctrlKey) && e.key === 'c' && !window.getSelection()?.toString()) {
+      if (!copyHidden && (e.metaKey || e.ctrlKey) && e.key === 'c' && !window.getSelection()?.toString()) {
         e.preventDefault();
         handleCopy();
         return;
@@ -113,7 +130,7 @@ export function CodePanelModal({ isOpen, onClose, tabs, title, initialTabIndex =
 
     document.addEventListener('keydown', handleKeyDown);
     return () => document.removeEventListener('keydown', handleKeyDown);
-  }, [isOpen, handleClose, handleCopy]);
+  }, [isOpen, handleClose, handleCopy, copyHidden]);
 
   if (!isOpen) return null;
 
@@ -224,27 +241,29 @@ export function CodePanelModal({ isOpen, onClose, tabs, title, initialTabIndex =
             {/* Right: Actions */}
             <div className="flex items-center gap-2">
               {/* Copy Button */}
-              <button
-                onClick={handleCopy}
-                className="p-2 rounded-md transition-colors cursor-pointer"
-                style={{ color: codePanelColors.textMuted }}
-                onMouseEnter={(e) => {
-                  e.currentTarget.style.backgroundColor = codePanelColors.tabHoverBg;
-                  e.currentTarget.style.color = codePanelColors.text;
-                }}
-                onMouseLeave={(e) => {
-                  e.currentTarget.style.backgroundColor = 'transparent';
-                  e.currentTarget.style.color = codePanelColors.textMuted;
-                }}
-                title="Copy code"
-                aria-label="Copy code to clipboard"
-              >
-                {copied ? (
-                  <i className="fa-solid fa-check text-emerald-500" aria-hidden="true" />
-                ) : (
-                  <i className="fa-regular fa-copy" aria-hidden="true" />
-                )}
-              </button>
+              {!copyHidden && (
+                <button
+                  onClick={handleCopy}
+                  className="p-2 rounded-md transition-colors cursor-pointer"
+                  style={{ color: codePanelColors.textMuted }}
+                  onMouseEnter={(e) => {
+                    e.currentTarget.style.backgroundColor = codePanelColors.tabHoverBg;
+                    e.currentTarget.style.color = codePanelColors.text;
+                  }}
+                  onMouseLeave={(e) => {
+                    e.currentTarget.style.backgroundColor = 'transparent';
+                    e.currentTarget.style.color = codePanelColors.textMuted;
+                  }}
+                  title="Copy code"
+                  aria-label="Copy code to clipboard"
+                >
+                  {copied ? (
+                    <i className="fa-solid fa-check text-emerald-500" aria-hidden="true" />
+                  ) : (
+                    <i className="fa-regular fa-copy" aria-hidden="true" />
+                  )}
+                </button>
+              )}
 
               {/* Close Button */}
               <button
@@ -304,18 +323,20 @@ export function CodePanelModal({ isOpen, onClose, tabs, title, initialTabIndex =
                 </kbd>
                 <span>Close</span>
               </span>
-              <span className="flex items-center gap-1.5">
-                <kbd
-                  className="px-1.5 py-0.5 rounded text-[10px] font-mono"
-                  style={{
-                    backgroundColor: codePanelColors.tabHoverBg,
-                    border: `0.5px solid ${codePanelColors.border}`,
-                  }}
-                >
-                  {typeof navigator !== 'undefined' && navigator.platform?.includes('Mac') ? '\u2318' : 'Ctrl'}+C
-                </kbd>
-                <span>Copy</span>
-              </span>
+              {!copyHidden && (
+                <span className="flex items-center gap-1.5">
+                  <kbd
+                    className="px-1.5 py-0.5 rounded text-[10px] font-mono"
+                    style={{
+                      backgroundColor: codePanelColors.tabHoverBg,
+                      border: `0.5px solid ${codePanelColors.border}`,
+                    }}
+                  >
+                    {typeof navigator !== 'undefined' && navigator.platform?.includes('Mac') ? '\u2318' : 'Ctrl'}+C
+                  </kbd>
+                  <span>Copy</span>
+                </span>
+              )}
             </div>
             {currentTab?.language && (
               <span className="uppercase tracking-wide">{currentTab.language}</span>

package/vendored/hooks/useWheelScrollChaining.ts

@@ -0,0 +1,181 @@
+'use client';
+
+import { useEffect } from 'react';
+
+/**
+ * Restores native scroll chaining for the desktop three-column layout.
+ *
+ * At >=1024px the layout shell is `lg:h-screen lg:overflow-hidden`
+ * (LayoutWrapper), so the document never scrolls — `#content-scroll-container`
+ * does. That makes every sibling column a scroll dead end: the browser looks
+ * for an ancestor to chain the wheel to, finds only `overflow: hidden`, and
+ * drops the event.
+ *
+ * The worst case is the TOC <aside>, which PageColumns renders unconditionally
+ * at xl+ while TableOfContents returns null when the page has no h2/h3. On a
+ * heading-less page that leaves ~288px (a quarter of a 1280px viewport) where
+ * the wheel does nothing at all. A TOC too short to overflow, a short sidebar
+ * nav, and the shell's own horizontal padding fail the same way.
+ *
+ * This walks up from the event target looking for any scroll container. If
+ * there is none, the delta is handed to the content column — which is what the
+ * browser would have done had the ancestors not been `overflow: hidden`.
+ *
+ * Scope is deliberately narrower than true scroll chaining: a column that CAN
+ * scroll but has hit its end keeps the wheel and stops, exactly as it does
+ * today. Widening that is a separate, visible behaviour change.
+ *
+ * Listener is passive: nothing else was going to scroll, so there is no
+ * default to prevent and no scroll-blocking cost.
+ *
+ * Verifying this with Playwright: its synthetic wheel reports a deltaY twice
+ * what Chrome actually applies (confirmed on a bare overflow-y:auto box —
+ * event 200 -> 100px scrolled). The harness can show WHETHER a region scrolls,
+ * never HOW FAR. Real wheel events are 1:1 in DOM_DELTA_PIXEL.
+ */
+
+/** Fallback px-per-line for wheels reporting DOM_DELTA_LINE (Firefox). */
+const LINE_HEIGHT_PX = 16;
+
+/**
+ * Does `el` own this wheel event — either by declaring it, or by being a
+ * scroll container with somewhere left to go in either direction?
+ *
+ * Deliberately direction-agnostic. A sidebar already scrolled to its bottom
+ * still counts as "owns the wheel", so this hook does not take the wheel away
+ * from a column that merely ran out of room — that would be full scroll
+ * chaining, a behaviour change well beyond restoring the dead zones. Only a
+ * region that can never scroll at all hands its wheel to the content column.
+ *
+ * Only overflowY auto/scroll qualifies: a code block with `overflow-x: auto`
+ * and `overflow-y: hidden` must stay transparent to a vertical wheel, or every
+ * wide snippet becomes its own dead zone.
+ *
+ * The ORDER of the reads below is load-bearing, not incidental. overflowY and
+ * overscrollBehaviorY are style-only resolved values — reading them can cost a
+ * style recalc, never a layout. scrollHeight/clientHeight ARE layout-dependent
+ * and flush layout if it is dirty. Because the overflow test gates them, an
+ * ancestor that is not a scroll container costs one cheap read, and a typical
+ * 6-10 node walk forces zero layouts. Hoisting the scroll-range check above the
+ * overflow check would make every wheel event force layout on every ancestor.
+ */
+function ownsTheWheel(el: Element): boolean {
+  const style = getComputedStyle(el);
+
+  // `overscroll-behavior-y: contain | none` is an author saying explicitly
+  // "scrolling must not chain out of me". Honour it whether or not the element
+  // currently has room — an empty chat transcript or a short playground pane
+  // still means it, and forwarding past it would scroll the docs underneath.
+  // Used by ChatPanel, PlaygroundModal and Prompt.
+  const overscrollY = style.overscrollBehaviorY;
+  if (overscrollY === 'contain' || overscrollY === 'none') return true;
+
+  const overflowY = style.overflowY;
+  if (overflowY !== 'auto' && overflowY !== 'scroll') return false;
+  // Sub-pixel heights (zoom, fractional DPR) can leave a hairline of fake
+  // scroll range, so require more than a pixel before calling it scrollable.
+  return el.scrollHeight - el.clientHeight > 1;
+}
+
+/** Can the content column still move in the direction of `deltaY`? */
+function canConsume(el: Element, deltaY: number): boolean {
+  const overflowY = getComputedStyle(el).overflowY;
+  if (overflowY !== 'auto' && overflowY !== 'scroll') return false;
+  if (el.scrollHeight - el.clientHeight <= 1) return false;
+  return deltaY > 0
+    ? el.scrollTop + el.clientHeight < el.scrollHeight - 1
+    : el.scrollTop > 1;
+}
+
+/** Normalise wheel delta to pixels — deltaY is lines in mode 1, pages in mode 2. */
+function deltaToPixels(event: WheelEvent, viewportHeight: number): number {
+  if (event.deltaMode === 1) return event.deltaY * LINE_HEIGHT_PX;
+  if (event.deltaMode === 2) return event.deltaY * viewportHeight;
+  return event.deltaY;
+}
+
+/**
+ * Is a modal holding a body scroll lock right now?
+ *
+ * `useBodyScrollLock` sets `document.body.style.overflow = 'hidden'` and
+ * nothing else. The `html[data-scroll-locked]` CSS rule in globals.css that
+ * DOES neutralise the content column is first-paint only — `scrollLockBootstrap`
+ * removes the attribute within ~100ms of DOMContentLoaded, long before any
+ * modal opens. So with Cmd+K open the content column is still `overflow-y:
+ * auto` and still scrollable, and without this check the wheel over a modal's
+ * dimmed backdrop scrolled the docs behind it (verified live).
+ */
+function isScrollLocked(): boolean {
+  // Inline first: that is literally what useBodyScrollLock writes, and it is
+  // the one form jsdom reports faithfully (it does not expand the `overflow`
+  // shorthand into computed `overflowY`). The computed check stays as the
+  // catch-all for a lock applied via a stylesheet instead. Both were confirmed
+  // to read 'hidden' in Chrome with the search modal open.
+  if (document.body.style.overflow === 'hidden') return true;
+  return getComputedStyle(document.body).overflowY === 'hidden';
+}
+
+/**
+ * @param enabled - pass false in embed mode. PageColumns emits
+ *   `#content-scroll-container` unconditionally (only the TOC aside is
+ *   embed-gated), so the hook is NOT inert there by construction — it only
+ *   happens to no-op because the embed shell is `min-h-screen`, leaving the
+ *   column unbounded. Any future bounded height would switch it on inside a
+ *   customer's embedded widget.
+ */
+export function useWheelScrollChaining(enabled = true): void {
+  useEffect(() => {
+    if (!enabled) return;
+
+    const handleWheel = (event: WheelEvent) => {
+      // ctrl+wheel is pinch-zoom, not a scroll. shift+wheel is the browser's
+      // horizontal-scroll modifier — it still arrives as deltaY, and native
+      // chaining would look for somewhere HORIZONTAL to go, find nothing in a
+      // dead zone, and do nothing. Scrolling vertically instead would invent
+      // behaviour the browser never had.
+      if (event.ctrlKey || event.shiftKey || event.deltaY === 0) return;
+      // A snippet can register its own non-passive wheel handler (a pan/zoom
+      // canvas, a custom carousel) and call preventDefault. Nothing in
+      // build-service does today, but customer `/snippets` 'use client' files
+      // can, and overriding them would scroll the docs out from under the
+      // widget. React's onWheel is passive at the root, so this only catches
+      // native listeners — which are exactly the ones that can mean it.
+      if (event.defaultPrevented) return;
+      if (isScrollLocked()) return;
+
+      const content = document.querySelector<HTMLElement>('#content-scroll-container');
+      if (!content) return;
+
+      // Below lg this is `overflow-y: visible`, so the document scrolls
+      // normally and native chaining already works — bail out there.
+      if (!canConsume(content, event.deltaY)) return;
+
+      // Element, not HTMLElement: an SVG target (D2/Mermaid diagrams, inline
+      // icons) is an SVGElement, and narrowing to HTMLElement skipped the walk
+      // entirely — the delta was then forwarded on top of the browser's own
+      // scroll, doubling scroll speed over every diagram.
+      const target: Element | null =
+        event.target instanceof Element ? event.target : null;
+
+      // The chat panel is its own surface, not page chrome. Before any message
+      // arrives it has nothing to scroll, and forwarding there would scroll the
+      // docs behind an open panel — surprising, and not the dead zone we set
+      // out to fix. Leave it inert, exactly as it is today.
+      if (target?.closest('[data-chat-panel]')) return;
+
+      let node: Element | null = target;
+
+      while (node) {
+        // Something under the cursor owns the wheel — let the browser do it.
+        if (ownsTheWheel(node)) return;
+        if (node === document.documentElement) break;
+        node = node.parentElement;
+      }
+
+      content.scrollTop += deltaToPixels(event, content.clientHeight);
+    };
+
+    window.addEventListener('wheel', handleWheel, { passive: true });
+    return () => window.removeEventListener('wheel', handleWheel);
+  }, [enabled]);
+}

package/vendored/lib/auth-plane-write-warning.ts

@@ -0,0 +1,84 @@
+import type { BuildWarning } from '../shared/status-reporter.js'; // vendored copy — NOT '../../shared'
+
+/**
+ * Warn when a gated project finished a build without its auth plane written.
+ *
+ * `setProjectAuthPublic` is the only thing that puts a project's gate config
+ * where the edge can read it, and in build.ts it sits inside a try whose catch
+ * logs `Failed to write projectAuthPublic to Redis (non-fatal)` and lets the
+ * build go green. That non-fatal choice is right for availability and wrong for
+ * visibility: `resolveAuth` returns null when the key is absent, and a null
+ * resolve means `applyAuthGate` returns null, which is NO GATE. So the failure
+ * mode of a dropped write is a fully public site reported as a successful build.
+ *
+ * Two ways in, neither of them a misconfiguration:
+ *   - Upstash is briefly unavailable during the write.
+ *   - The payload outgrows what `upstashCommand` can put in a URL path. It
+ *     encodes the whole value into the path, and a few hundred group-restricted
+ *     pages is tens of KB of URL, so this one arrives through ordinary growth on
+ *     a project that has been fine for months.
+ *
+ * Deliberately mode-agnostic. The fail-open lives in `resolveAuth` returning
+ * null, which happens before authType is ever consulted, so a password tenant
+ * loses its gate exactly as a jwt tenant does. Silent when `enabled` is false,
+ * where serving publicly is the stated intent.
+ *
+ * This warns rather than fails the build. Failing would be the safer default on
+ * the ordering alone (the write precedes the R2 upload, so a hard fail would
+ * stop unprotected content from publishing at all), but it converts every
+ * transient Upstash blip into a broken customer build. That tradeoff is a
+ * product call, not a build-service one.
+ */
+export function buildAuthPlaneWriteWarning(input: {
+  enabled: boolean;
+  writeFailed: boolean;
+}): BuildWarning | null {
+  if (!input.enabled || !input.writeFailed) return null;
+  return {
+    // Same reuse, and the same reasoning, as buildJwtKeyWarning: this routing
+    // (emailed, counted, badged) is what the warning needs, and a dedicated
+    // BuildWarningType would mean the six-place sync chain for no difference.
+    type: 'invalid_openapi_spec',
+    file: 'docs.json',
+    message:
+      'This project is password or JWT protected, but the build could not publish its access rules, ' +
+      'so the site is currently readable by anyone. Rebuild to retry. ' +
+      'If it keeps failing, the access rules may have grown too large to store and support can raise it.',
+  };
+}
+
+/**
+ * Does docs.json itself declare a gate? Read BEFORE the auth try block, so the
+ * warning above survives a throw inside it.
+ *
+ * The gap this closes: `authPlaneGated` used to be assigned only from
+ * `effectiveEnabled`, ~19 lines into the try, after `pageInfos.map` and
+ * `detectAuthMode`. Anything throwing in that window skipped both the
+ * assignment AND `setProjectAuthPublic`, so the site went public and the
+ * warning was suppressed by the same throw. That window is reachable from
+ * user-supplied config: `collectGroupsPaths` does
+ * `(navigation?.languages ?? []).map(...)`, and `??` only guards null and
+ * undefined, so a `languages` that is a string throws.
+ *
+ * Mirrors `detectAuthMode`'s own test exactly (`?.enabled === true`), never
+ * truthiness — 'false' and 0 are not gates there and must not be gates here,
+ * or the warning fires on a site that is public by intent.
+ *
+ * MUST NOT THROW. Optional chaining is safe against any non-null value, which
+ * is the point: docs.json is user JSON and `auth` can be a string, an array or
+ * a number. Callers combine this monotonically (`a || b`) with the in-try
+ * value, so it can only ever turn the warning on.
+ *
+ * Residual, named rather than hidden: `specific` mode is frontmatter-derived
+ * (`collectPrivatePaths`), so a tenant gated only by per-page `private`
+ * frontmatter reads false here. A throw before `detectAuthMode` on such a
+ * tenant still goes unwarned. Covering it would mean replicating the
+ * frontmatter walk outside the try, which reintroduces the throw it guards.
+ */
+export function configDeclaresGate(docsConfig: unknown): boolean {
+  const auth = (docsConfig as { auth?: unknown } | null | undefined)?.auth as {
+    password?: { enabled?: unknown };
+    jwt?: { enabled?: unknown };
+  } | undefined;
+  return auth?.password?.enabled === true || auth?.jwt?.enabled === true;
+}

package/vendored/lib/docs-types.ts

@@ -806,6 +806,17 @@ export interface MetadataConfig {
   timestamp?: boolean;
 }
 
+/**
+ * Localization behaviour.
+ *
+ * `autoRedirect` opts a project into server-side Accept-Language routing at
+ * locale roots. Default OFF: turning it on changes what a first-time visitor
+ * sees, so it is never inferred from the presence of `navigation.languages`.
+ */
+export interface LocalizationConfig {
+  autoRedirect?: boolean;
+}
+
 /**
  * Icons library configuration
  */
@@ -947,6 +958,7 @@ export interface DocsConfig {
   thumbnails?: ThumbnailsConfig;
   interaction?: InteractionConfig;
   metadata?: MetadataConfig;
+  localization?: LocalizationConfig;
   analytics?: AnalyticsConfig;
   chat?: ChatConfig;
   spellcheck?: SpellcheckConfig;

package/vendored/lib/jwt-key-build-warning.ts

@@ -0,0 +1,38 @@
+import type { BuildWarning } from '../shared/status-reporter.js'; // vendored copy — NOT '../../shared'
+
+/**
+ * Warn when a project declares JWT authentication but has no signing key.
+ *
+ * The truth table in auth-resolver.ts is explicit: `authType === 'jwt'` with a
+ * missing or malformed `projectJwtSecret` means NO GATE. That is the correct
+ * fail-safe for a key that was cleared deliberately, but it is also reachable
+ * by accident: commit `auth.jwt.enabled: true`, publish, and never click
+ * Generate signing key. The build then succeeds, the site serves every page to
+ * the public, and nothing says so. The dashboard card does report it, but a
+ * customer who publishes from git has no reason to open that page.
+ *
+ * Silent for `enabled: false`, where a public site is the stated intent, and
+ * silent for password tenants, whose own secret has its own row in that table.
+ * A password tenant can legitimately still hold a JWT key from a half-finished
+ * migration; coexistence is by design and only `authType` decides.
+ */
+export function buildJwtKeyWarning(input: {
+  authType: 'password' | 'jwt';
+  enabled: boolean;
+  hasSigningKey: boolean;
+}): BuildWarning | null {
+  if (input.authType !== 'jwt' || !input.enabled || input.hasSigningKey) return null;
+  return {
+    // Reuses invalid_openapi_spec deliberately: it already routes the way this
+    // needs — emailed, counted, badged, not filed as a suggestion — and a
+    // dedicated BuildWarningType would mean editing the six-place sync chain
+    // plus EMAILABLE_TYPES for no behavioural difference. Same reasoning, and
+    // the same call, as the spec-expansion warnings in build.ts.
+    type: 'invalid_openapi_spec',
+    // docs.json is where the opt-in lives and what an author edits to change it.
+    file: 'docs.json',
+    message:
+      'auth.jwt.enabled is true but this project has no signing key, so nothing is gated and every page is publicly readable. ' +
+      'Generate an Ed25519 signing key under Settings, or set auth.jwt.enabled to false if the site is meant to be public.',
+  };
+}