jamdesk 1.1.213 → 1.1.214

package/vendored/lib/screenshot-capture.ts

@@ -14,6 +14,9 @@
 import { chromium, Browser } from 'playwright';
 import { S3Client, PutObjectCommand, ListObjectsV2Command, DeleteObjectsCommand } from '@aws-sdk/client-s3';
 import { getFirestore } from 'firebase-admin/firestore';
+import { randomBytes } from 'node:crypto';
+import { resolveAuth, type ResolvedAuth } from './auth-resolver';
+import { signAuthCookie, signAuthCookieV2 } from '../shared/auth-cookie';
 
 interface CaptureOptions {
   slug: string;
@@ -97,20 +100,64 @@ export async function launchChromiumWithRetry(
   throw lastError;
 }
 
+// Long enough to cover the 45s capture race, short enough that a leaked
+// cookie is worthless almost immediately (visitor unlocks last 30 days).
+const CAPTURE_COOKIE_TTL_MS = 5 * 60_000;
+
+/**
+ * Mint the jd_auth cookie a successful unlock would set, so a password- or
+ * JWT-gated site is captured as an unlocked visitor sees it instead of as the
+ * unlock form. Uses the gate's own resolveAuth + signing, so the cookie is
+ * exactly what the proxy verifies. Cloud Run already holds EDGE_AUTH_SECRET
+ * and R2 read access to every tenant's content, so this grants the capture
+ * nothing new. JWT mode gets no groups (least privilege): a group-restricted
+ * homepage captures as the gate's 404.
+ *
+ * Returns null when the site is ungated, or when the cookie can't be minted —
+ * the capture then proceeds unauthenticated, as it did before this existed.
+ * Never rejects: the capture starts it before launching Chromium and may
+ * abandon it on timeout.
+ */
+export async function mintCaptureAuthCookie(
+  slug: string,
+  host: string,
+): Promise<{ name: string; value: string } | null> {
+  let auth: ResolvedAuth | null;
+  try {
+    auth = await resolveAuth(slug);
+  } catch (error) {
+    console.warn(`Screenshot auth lookup failed for ${slug}; capturing without unlock cookie:`, error);
+    return null;
+  }
+  if (!auth) return null;
+  const secret = process.env.EDGE_AUTH_SECRET;
+  if (!secret) {
+    console.warn(`Screenshot: ${slug} is gated but EDGE_AUTH_SECRET is unset; capture will hit the password wall`);
+    return null;
+  }
+
+  const payload = { slug, host, version: auth.version, expiresAt: Date.now() + CAPTURE_COOKIE_TTL_MS };
+  const value = auth.authType === 'jwt'
+    ? await signAuthCookieV2(payload, {}, secret)
+    : await signAuthCookie(payload, secret);
+  return { name: `jd_auth_${slug}`, value };
+}
+
 /**
- * Clean up old screenshots for a project, keeping only the current build's screenshot.
- * This prevents R2 storage from accumulating old screenshots.
+ * Clean up old screenshots for a project, keeping only the one just uploaded.
+ * This prevents R2 storage from accumulating old screenshots. Exact key, not
+ * the build's prefix: a regenerate reuses the buildId under a new file name,
+ * and the superseded image must not stay reachable.
  */
 async function cleanupOldScreenshots(
   r2Client: S3Client,
   r2Bucket: string,
   slug: string,
-  currentBuildId: string
+  currentKey: string
 ): Promise<void> {
   try {
     // R2 key pattern matches assets API: {slug}/assets/_screenshots/{buildId}/
     const prefix = `${slug}/assets/_screenshots/`;
-    const currentPrefix = `${slug}/assets/_screenshots/${currentBuildId}/`;
 
     // List all screenshot objects for this project
     const listResponse = await r2Client.send(
@@ -124,9 +171,8 @@ async function cleanupOldScreenshots(
       return;
     }
 
-    // Filter out objects from the current build
     const objectsToDelete = listResponse.Contents.filter(
-      (obj) => obj.Key && !obj.Key.startsWith(currentPrefix)
+      (obj) => obj.Key && obj.Key !== currentKey
     ).map((obj) => ({ Key: obj.Key! }));
 
     if (objectsToDelete.length === 0) {
@@ -191,6 +237,11 @@ export async function captureHomepageScreenshot(options: CaptureOptions): Promis
     });
 
     const capturePromise = async (): Promise<CaptureResult> => {
+      // Gated site: without this the capture screenshots the unlock form.
+      // Started before launch so its Redis reads overlap Chromium startup
+      // instead of spending the 45s budget sequentially.
+      const authCookiePromise = mintCaptureAuthCookie(slug, new URL(siteUrl).host);
+
       // Launch browser with system Chromium (retry transient launch flakes)
       browser = await launchChromiumWithRetry();
 
@@ -207,6 +258,13 @@ export async function captureHomepageScreenshot(options: CaptureOptions): Promis
       const page = await browser.newPage();
       await page.setViewportSize({ width: 1280, height: 720 });
 
+      const authCookie = await authCookiePromise;
+      if (authCookie) {
+        await page.context().addCookies([
+          { ...authCookie, url: siteUrl, httpOnly: true, secure: true, sameSite: 'Lax' },
+        ]);
+      }
+
       // Cold render after a project-wide revalidation can transiently 404 —
       // retry once on 4xx/5xx, then capture whatever the page shows so the
       // dashboard preview reflects the real state of the site.
@@ -218,14 +276,22 @@ export async function captureHomepageScreenshot(options: CaptureOptions): Promis
       // (jamdesk-docs) NEVER goes network-idle. 'networkidle' timed out at 15s
       // and every capture/Retry failed. 'load' fires before the prefetch storm.
       const gotoOpts = { waitUntil: 'load', timeout: 15000 } as const;
-      console.log(`Capturing screenshot from: ${homepageUrl}`);
-      const firstResponse = await page.goto(homepageUrl, gotoOpts);
-      const firstStatus = firstResponse?.status();
+      console.log(`Capturing screenshot from: ${homepageUrl}${authCookie ? ' (unlock cookie attached)' : ''}`);
+      let response = await page.goto(homepageUrl, gotoOpts);
+      const firstStatus = response?.status();
 
       if (firstStatus !== undefined && firstStatus >= 400) {
         console.log(`Screenshot got ${firstStatus} on first attempt, retrying once after 3s`);
         await page.waitForTimeout(3000);
-        await page.goto(homepageUrl, gotoOpts);
+        response = await page.goto(homepageUrl, gotoOpts);
+      }
+
+      // Still behind the password/JWT wall (cookie not minted or rejected):
+      // the page is the unlock form, which must never be stored as the site
+      // preview. Fail so the dashboard offers Retry instead.
+      const finalStatus = response?.status();
+      if (finalStatus === 401 || finalStatus === 403) {
+        return { screenshotUrl: null, error: `Screenshot blocked by site auth (HTTP ${finalStatus})` };
       }
 
       // Short best-effort settle for late images/fonts — the page above already
@@ -256,10 +322,17 @@ export async function captureHomepageScreenshot(options: CaptureOptions): Promis
       }
 
       // Upload to R2 with timeout via AbortController
-      // R2 key follows ISR assets pattern: {slug}/assets/_screenshots/{buildId}/homepage.jpg
+      // R2 key follows ISR assets pattern: {slug}/assets/_screenshots/{buildId}/{name}.jpg
       // ISR middleware routes /_screenshots/*.jpeg → /api/assets/_screenshots/*.jpeg
       // Assets API builds R2 key: {project}/assets/{assetPath}
-      const screenshotKey = `${slug}/assets/_screenshots/${buildId}/homepage.jpg`;
+      //
+      // The random name is what keeps a password-protected site's preview
+      // private: the proxy serves this path without the unlock cookie, and the
+      // buildId alone is NOT secret (lastBuildId sits on the projects doc, which
+      // any signed-in user can read). The full URL is stored only on the
+      // members-only build doc. See isSiteScreenshotPath.
+      const screenshotPath = `_screenshots/${buildId}/${randomBytes(16).toString('hex')}.jpg`;
+      const screenshotKey = `${slug}/assets/${screenshotPath}`;
       const abortController = new AbortController();
       const uploadTimeout = setTimeout(() => abortController.abort(), 5000);
 
@@ -279,11 +352,10 @@ export async function captureHomepageScreenshot(options: CaptureOptions): Promis
       }
 
       // Clean up old screenshots after successful upload
-      await cleanupOldScreenshots(r2Client, r2Bucket, slug, buildId);
+      await cleanupOldScreenshots(r2Client, r2Bucket, slug, screenshotKey);
 
-      // Return the project subdomain URL (with buildId for cache busting)
-      // URL format: https://{slug}.jamdesk.app/_screenshots/{buildId}/homepage.jpg
-      const screenshotUrl = `https://${slug}.jamdesk.app/_screenshots/${buildId}/homepage.jpg`;
+      // Return the project subdomain URL (a new name per capture busts caches)
+      const screenshotUrl = `https://${slug}.jamdesk.app/${screenshotPath}`;
 
       return { screenshotUrl };
     };

package/vendored/lib/static-artifacts.ts

@@ -364,8 +364,9 @@ function bucketPagesByLocale<P extends { path: string }>(
 }
 
 /**
- * Render the root llms.txt (default locale) plus one file per declared,
- * non-hidden, non-default language (see bucketPagesByLocale for membership).
+ * Render the root llms.txt (default locale) plus one file per active language
+ * (see bucketPagesByLocale for membership). The default language's file is a
+ * copy of the root, written only when another language is active too.
  * Cross-links between locale files render under the trailing "## Optional"
  * section.
  */
@@ -400,7 +401,13 @@ export function generateLlmsTxtFiles(
 
   const byLocale: Record<string, string> = {};
   for (const code of activeCodes) {
-    if (code === defaultCode) continue;
+    if (code === defaultCode) {
+      // The default locale's index IS the root file. Also writing it under
+      // /{default}/ keeps its URL in step with /{default}/llms-full.txt, which
+      // generateLlmsFullTxtFiles writes under the same two-active-locales rule.
+      if (activeCodes.length > 1) byLocale[code] = root;
+      continue;
+    }
     byLocale[code] = generateLlmsTxt({
       ...rest, baseUrl, hostAtDocs, docsPrefix, sections,
       pages: pagesFor(code),

package/vendored/lib/static-file-route.ts

@@ -11,6 +11,7 @@ import path from 'path';
 
 import { NextRequest, NextResponse } from 'next/server';
 
+import { getLanguageRouting } from '@/lib/language-matcher';
 import { isKnownLanguageCode } from '@/lib/language-utils';
 import { log } from '@/lib/logger';
 import { isIsrMode } from '@/lib/page-isr-helpers';
@@ -173,6 +174,13 @@ export function createCorsStaticFileHandler(
  * Like llms.txt, locale files are intentionally NOT suppressed on
  * `x-jd-noindex` — AI agents fetch them directly and don't honor robots
  * semantics.
+ *
+ * Builds since 2026-09-23 write `/{default}/llms.txt` as a copy of the root.
+ * For sites not rebuilt since, a miss on the default language falls back to
+ * the root file, so `/en/llms.txt` answers next to `/en/llms-full.txt` without
+ * waiting for a rebuild. The default comes from `_languages.json`, which is
+ * null when fewer than two languages are routable, when a site predates the
+ * file, or on a read error — all of those keep the plain 404.
  */
 export function createLocaleLlmsTxtHandler(file: 'llms.txt' | 'llms-full.txt' = 'llms.txt'): (
   request: NextRequest,
@@ -205,7 +213,15 @@ export function createLocaleLlmsTxtHandler(file: 'llms.txt' | 'llms-full.txt' =
     }
 
     try {
-      const content = await fetchStaticFile(projectSlug, filename);
+      let content = await fetchStaticFile(projectSlug, filename);
+      if (content === null && file === 'llms.txt') {
+        // Fallback for sites built before the default-locale copy existed (see
+        // the doc comment for when routing is null).
+        const routing = await getLanguageRouting(projectSlug);
+        if (routing?.defaultLanguage.toLowerCase() === locale.toLowerCase()) {
+          content = await fetchStaticFile(projectSlug, 'llms.txt');
+        }
+      }
       if (content === null) {
         return new NextResponse('Not found', { status: 404 });
       }

package/vendored/themes/dusk/variables.css

@@ -40,9 +40,10 @@
 
   --color-border: #D4D7DD;
   --color-border-hover: #C6CBD3;
-  --border-width: 1px;
+  --border-width: 0.5px;   /* hairline dividers, jam's weight */
 
   --color-text-primary: #1A1D22;   /* 15.1:1 */
+  --color-heading: #2B3038;        /* 11.8:1 — a step softer than text-primary */
   --color-text-secondary: #3C424C; /*  9.0:1 */
   --color-text-tertiary: #515A67;  /*  6.2:1 */
   --color-text-muted: #616B7B;     /*  4.8:1 */
@@ -104,7 +105,7 @@
 
   /* Weights only — sizes come from jam's ladder. Body is 400, not jam's 300:
      a thin weight undoes the contrast the grays above are tuned for. */
-  --prose-h1-weight: 600;
+  --prose-h1-weight: 500;
   --prose-h2-weight: 600;
   --prose-h3-weight: 600;
   --prose-h4-weight: 600;
@@ -123,6 +124,7 @@
   --color-border-hover: #3E444E;
 
   --color-text-primary: #E4E7EA;   /* 15.0:1 */
+  --color-heading: var(--color-text-primary);
   --color-text-secondary: #B8BFC7; /* 10.0:1 */
   --color-text-tertiary: #909AA7;  /*  6.5:1 */
   --color-text-muted: #768394;     /*  4.8:1 */
@@ -192,7 +194,24 @@ body[data-theme="dusk"] h1 {
   line-height: var(--prose-h1-line-height);
   font-weight: var(--prose-h1-weight);
   letter-spacing: -0.01em;
-  color: var(--color-text-primary);
+  color: var(--color-heading);
+}
+
+/* A bigger H1 than jam's 30/27/24 ladder. Set on body so it beats jam's
+   :root media queries regardless of stylesheet order. */
+body[data-theme="dusk"] {
+  --prose-h1-size: 34px;
+}
+@media (min-width: 640px) and (max-width: 1023px) {
+  body[data-theme="dusk"] { --prose-h1-size: 30px; }
+}
+@media (max-width: 639px) {
+  body[data-theme="dusk"] { --prose-h1-size: 26px; }
+}
+
+/* More air around the page title (breadcrumb above, lead text below). */
+body[data-theme="dusk"] header > div > h1 {
+  margin-block: 12px;
 }
 
 body[data-theme="dusk"] .prose h2 {
@@ -201,7 +220,7 @@ body[data-theme="dusk"] .prose h2 {
   line-height: var(--prose-h2-line-height);
   font-weight: var(--prose-h2-weight);
   letter-spacing: var(--prose-h2-tracking);
-  color: var(--color-text-primary);
+  color: var(--color-heading);
 }
 
 body[data-theme="dusk"] .prose h3 {
@@ -210,7 +229,7 @@ body[data-theme="dusk"] .prose h3 {
   line-height: var(--prose-h3-line-height);
   font-weight: var(--prose-h3-weight);
   letter-spacing: var(--prose-h3-tracking);
-  color: var(--color-text-primary);
+  color: var(--color-heading);
 }
 
 body[data-theme="dusk"] .prose h4 {
@@ -219,7 +238,7 @@ body[data-theme="dusk"] .prose h4 {
   line-height: var(--prose-h4-line-height);
   font-weight: var(--prose-h4-weight);
   letter-spacing: var(--prose-h4-tracking);
-  color: var(--color-text-primary);
+  color: var(--color-heading);
 }
 
 /* Inline code — jam's padding, Dusk's surface. */
@@ -250,14 +269,14 @@ body[data-theme="dusk"] hr {
 
 /* ===== HEADER ===== */
 /* The header-logo <header> has no border of its own. Same construction as
-   nebula's divider (see its comment for the inset math), at Dusk's 1px. */
+   nebula's divider (see its comment for the inset math), at --border-width. */
 body[data-theme="dusk"] header[data-has-tabs]::after {
   content: '';
   position: absolute;
   left: -1rem;
   right: -1rem;
   bottom: 0;
-  height: 1px;
+  height: var(--border-width);
   background-color: var(--color-border);
   pointer-events: none;
 }
@@ -269,10 +288,41 @@ body[data-theme="dusk"] header[data-has-tabs]::after {
   }
 }
 
+/* Tailwind's `border*` utilities are a hard 1px. Route them through
+   --border-width so every divider (sidebar edge, cards, panels) is the same
+   hairline — jam's rule, re-scoped. */
+body[data-theme="dusk"] .border {
+  border-width: var(--border-width) !important;
+}
+body[data-theme="dusk"] .border-t {
+  border-top-width: var(--border-width) !important;
+}
+body[data-theme="dusk"] .border-b {
+  border-bottom-width: var(--border-width) !important;
+}
+body[data-theme="dusk"] .border-l {
+  border-left-width: var(--border-width) !important;
+}
+body[data-theme="dusk"] .border-r {
+  border-right-width: var(--border-width) !important;
+}
+
 /* ===== SIDEBAR (jam's spacing, re-scoped) ===== */
 /* The sidebar keeps base's border-r — Dusk separates with borders, so unlike
    jam and halo it does not remove it. */
 
+/* The shared desktop <aside> is `lg:self-start`, so it is only as tall as its
+   nav and the border-r stopped short of the column bottom on short pages.
+   Stretch it to the full layout row so the edge always runs the whole height;
+   `lg:max-h-full` still caps it and .sidebar-scroll (flex: 1, below) keeps
+   scrolling inside it. Matched via .sidebar-scroll so the TOC <aside> is
+   untouched; desktop only, since below lg this element is the drawer. */
+@media (min-width: 1024px) {
+  body[data-theme="dusk"] aside:has(.sidebar-scroll) {
+    align-self: stretch;
+  }
+}
+
 body[data-theme="dusk"] [data-nav-anchor] {
   padding: 0 0 16px 0;
   position: relative;