jamdesk 1.1.222 → 1.1.223

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jamdesk",
-  "version": "1.1.222",
+  "version": "1.1.223",
   "description": "CLI for Jamdesk — build, preview, and deploy documentation sites from MDX. Dev server with hot reload, 50+ components, OpenAPI support, AI search, and Mintlify migration",
   "keywords": [
     "jamdesk",

package/vendored/app/api/jd/auth/callback/route.ts

@@ -13,7 +13,9 @@
  *       a cross-site POST would store an attacker-chosen session, groups and
  *       playground inputs included, in the victim's cookie jar).
  *   404 unknown-project / not-enabled — no slug header, or project isn't in
- *       jwt mode (mirrors resolveAuth's null-on-off-or-wrong-mode contract).
+ *       jwt mode (resolveAuth null, or a password-mode auth).
+ *   401 no-signing-key — jwt mode is on but no public key is stored
+ *       (resolveAuth `locked`): the site stays gated and no token can verify.
  *   400 bad-request — malformed JSON or missing/oversized jwt field.
  *   401 <reason> — verifyDocsJwt rejected the token (invalid signature,
  *       expired, host mismatch, etc.) — reason echoed from jwt-session.
@@ -60,9 +62,12 @@ export async function POST(req: Request): Promise<NextResponse> {
     if (e instanceof AuthResolutionError) return NextResponse.json({ ok: false, error: 'unavailable' }, { status: 503 });
     throw e;
   }
-  if (!auth || auth.authType !== 'jwt' || !auth.publicKeyPem) {
+  if (!auth || auth.authType !== 'jwt') {
     return NextResponse.json({ ok: false, error: 'not-enabled' }, { status: 404 });
   }
+  if (auth.locked || !auth.publicKeyPem) {
+    return NextResponse.json({ ok: false, error: 'no-signing-key' }, { status: 401 });
+  }
 
   const host = getRequestHost(req);
   const outcome = await verifyDocsJwt(body.jwt, auth.publicKeyPem, host);

package/vendored/app/api/jd/auth/logout/route.ts

@@ -54,7 +54,9 @@ export async function GET(req: Request): Promise<Response> {
   if (slug) {
     try {
       const auth = await resolveAuth(slug);
-      if (auth?.authType === 'jwt' && auth.loginUrl) location = auth.loginUrl;
+      // A locked site has no working login (no signing key): send visitors
+      // to '/', where the gate shows the explainer, like it does for pages.
+      if (auth?.authType === 'jwt' && !auth.locked && auth.loginUrl) location = auth.loginUrl;
     } catch { /* logout must always succeed; fall back to '/' */ }
   }
   const headers = new Headers({ Location: location, 'Cache-Control': 'no-store' });

package/vendored/app/api/jd/auth/me/route.ts

@@ -33,7 +33,8 @@ export async function GET(req: Request): Promise<NextResponse> {
 
   let auth;
   try { auth = await resolveAuth(slug); } catch { return NextResponse.json(UNAUTHENTICATED, noStore); }
-  if (!auth || auth.authType !== 'jwt') return NextResponse.json(UNAUTHENTICATED, noStore);
+  // A locked jwt site (no signing key) has no session anyone can hold.
+  if (!auth || auth.authType !== 'jwt' || auth.locked) return NextResponse.json(UNAUTHENTICATED, noStore);
 
   const cookieHeader = req.headers.get('cookie') || '';
   const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)jd_auth_${slug}=([^;]+)`));

package/vendored/app/api/jd/unlock/route.ts

@@ -7,8 +7,11 @@
  * Flow:
  *   1. Validate inputs (slug, password fields)
  *   2. Check rate limits (per-IP + per-slug backstop) — BEFORE scrypt
- *   3. Fetch stored hash from Redis
- *   4. Always run scrypt (DUMMY_HASH when no hash stored) to prevent timing oracles
+ *   3. Resolve the gate via resolveAuth (the edge gate's own function), so a
+ *      cookie is minted only for a site the gate treats as an ACTIVE
+ *      password gate: not for an off/missing record, a jwt site, or a LOCKED
+ *      site with no usable hash
+ *   4. Always run scrypt (DUMMY_HASH when there is no hash) to prevent timing oracles
  *   5. On match: sign host-bound cookie, 303 to sanitized `from`
  *   6. On mismatch: 303 to unlock page with error=1
  */
@@ -19,7 +22,7 @@ export const dynamic = 'force-dynamic';
 import { scrypt, randomBytes, timingSafeEqual } from 'crypto';
 import { promisify } from 'util';
 import { redis } from '@/lib/redis';
-import { getProjectAuthSecret, getProjectAuthPublic } from '@/lib/cached-redis';
+import { resolveAuth, type ResolvedAuth } from '@/lib/auth-resolver';
 import { sanitizeFrom } from '@/lib/sanitize-from';
 import { VALID_SLUG_RE } from '@/lib/middleware-helpers';
 import { signAuthCookie } from '@/shared/auth-cookie';
@@ -220,13 +223,6 @@ interface StoredSecret {
   version: number;
 }
 
-// Returns null only when Redis is unconfigured (local dev). Real errors
-// propagate so POST can fail closed with 503 — matching resolveAuth.
-async function fetchStoredSecret(slug: string): Promise<StoredSecret | null> {
-  if (!redis) return null;
-  return getProjectAuthSecret(slug);
-}
-
 export async function POST(req: Request): Promise<Response> {
   // Login-CSRF guard: a cross-site form POST would store a session in the
   // victim's jar. Checked first — before scrypt, before rate limiting — so a
@@ -297,15 +293,9 @@ export async function POST(req: Request): Promise<Response> {
     });
   }
 
-  let stored: StoredSecret | null;
-  let authType: 'password' | 'jwt' | undefined;
+  let auth: ResolvedAuth | null;
   try {
-    const [storedResult, pubResult] = await Promise.all([
-      fetchStoredSecret(slug),
-      getProjectAuthPublic(slug),
-    ]);
-    stored = storedResult;
-    authType = pubResult?.authType;
+    auth = await resolveAuth(slug);
   } catch (err) {
     console.error('[unlock] Redis fetch failed — failing closed', {
       slug,
@@ -322,10 +312,22 @@ export async function POST(req: Request): Promise<Response> {
   // unlock form verify and mint a v1 cookie the jwt gate rejects — not a
   // bypass (the jwt gate never accepts a v1 cookie), but a confusing dead
   // end for the user. Fail fast instead.
-  if (authType === 'jwt') {
+  if (auth?.authType === 'jwt') {
     return new Response('not-enabled', { status: 404 });
   }
 
+  // Only an ACTIVE password gate has a hash to verify against. null (local
+  // dev, protection off, never built) and LOCKED (enabled, no usable hash —
+  // the shape rule is isUsableAuthSecret, shared with the edge) both fall
+  // through to DUMMY_HASH with `stored` null, which can never mint: the
+  // DUMMY_HASH plaintext is public (this route ships in the npm CLI), so the
+  // `!stored` checks below are what make it safe, and the master password
+  // needs `stored` too.
+  const stored: StoredSecret | null =
+    auth && !auth.locked && typeof auth.hash === 'string'
+      ? { hash: auth.hash, version: auth.version }
+      : null;
+
   const hashToVerify = stored?.hash ?? DUMMY_HASH;
 
   // Always run scrypt — even with DUMMY_HASH when no password is set — to

package/vendored/lib/auth-gate-rules.ts

@@ -0,0 +1,43 @@
+/**
+ * The auth plane's shape rules, in one Redis-free place.
+ *
+ * Every component that decides "is this site gated?" or "can this stored
+ * secret unlock it?" must give the same answer, or one of them opens a site
+ * the others treat as closed. Consumers: resolveAuth and isProjectGated
+ * (auth-resolver.ts), the build's R2 write guard (r2-public-storage-guard.ts),
+ * and through resolveAuth the unlock route.
+ *
+ * scripts/lib/public-storage-guard.cjs (the jamdesk.cjs upload path) cannot
+ * import a TS module, so it carries a copy of isGatedPublicRecord; the drift
+ * test in __tests__/scripts/lib/public-storage-guard.test.ts pins the two to
+ * the same truth table.
+ */
+
+/**
+ * `projectAuthPublic.enabled === true` is gated, whether or not the mode's
+ * secret exists. A missing secret makes the gate LOCKED, never open. Strict
+ * `=== true`: the build writes a boolean, and 'true' or 1 are not gates.
+ */
+export function isGatedPublicRecord(pub: unknown): boolean {
+  return (pub as { enabled?: unknown } | null | undefined)?.enabled === true;
+}
+
+/** A password secret that can verify a password: string hash, numeric version. */
+export function isUsableAuthSecret(
+  value: unknown,
+): value is { hash: string; version: number } {
+  const v = value as { hash?: unknown; version?: unknown } | null | undefined;
+  return typeof v?.hash === 'string' && typeof v.version === 'number';
+}
+
+/** A jwt secret that can verify a token: non-empty PEM, numeric version. */
+export function isUsableJwtSecret(
+  value: unknown,
+): value is { publicKeyPem: string; version: number } {
+  const v = value as { publicKeyPem?: unknown; version?: unknown } | null | undefined;
+  return (
+    typeof v?.publicKeyPem === 'string' &&
+    v.publicKeyPem.length > 0 &&
+    typeof v.version === 'number'
+  );
+}

package/vendored/lib/auth-resolver.ts

@@ -1,29 +1,37 @@
 import { redis } from './redis';
 import { getProjectAuthSecret, getProjectAuthPublic, getProjectJwtSecret } from './cached-redis';
 import { matchPublicPath, resolveRequiredGroups } from './glob-match';
+import { isGatedPublicRecord, isUsableAuthSecret, isUsableJwtSecret } from './auth-gate-rules';
 
 export { matchPublicPath, resolveRequiredGroups };
 
-export interface ResolvedAuth {
+interface ResolvedAuthBase {
   authType: 'password' | 'jwt';
-  hash?: string;
-  publicKeyPem?: string;
-  version: number;
   publicPaths: string[];
   loginUrl?: string;
   groupsPaths?: Record<string, string[]>;
 }
 
-interface AuthSecret {
-  hash: string;
+/** Gate with a usable secret: a cookie bound to `version` can pass. */
+export interface ActiveAuth extends ResolvedAuthBase {
+  locked?: undefined;
+  hash?: string;
+  publicKeyPem?: string;
   version: number;
 }
 
-interface JwtSecret {
-  publicKeyPem: string;
-  version: number;
+/**
+ * Gate with NO usable secret (protection on, password not set / signing key
+ * cleared / malformed secret). Nothing can unlock it. It deliberately has no
+ * `version`, `hash` or `publicKeyPem`, so a consumer that verifies a cookie or
+ * token must narrow on `locked` first or it won't compile.
+ */
+export interface LockedAuth extends ResolvedAuthBase {
+  locked: true;
 }
 
+export type ResolvedAuth = ActiveAuth | LockedAuth;
+
 interface AuthPublic {
   enabled?: boolean;
   publicPaths?: string[];
@@ -35,13 +43,29 @@ interface AuthPublic {
 /**
  * Resolve active auth protection (password OR jwt) for a project.
  *
- * Truth table — the config plane's declared `authType` alone picks the
- * ACTIVE mode; the matching secret key must back it or the gate is off:
+ * Truth table — `enabled === true` ALWAYS gates; the config plane's declared
+ * `authType` alone picks the mode, and only that mode's secret can unlock it:
  *   projectAuthPublic missing OR enabled!==true                       → no gate (return null)
  *   authType==='jwt'      AND projectJwtSecret has a publicKeyPem      → jwt gate
- *   authType==='jwt'      AND projectJwtSecret missing/malformed       → no gate (return null)
+ *   authType==='jwt'      AND projectJwtSecret missing/malformed       → LOCKED jwt gate
  *   authType!=='jwt' (password, incl. absent) AND projectAuthSecret has a hash → password gate
- *   authType!=='jwt' AND projectAuthSecret missing/malformed           → no gate (return null)
+ *   authType!=='jwt' AND projectAuthSecret missing/malformed           → LOCKED password gate
+ *
+ * LOCKED (`locked: true`) is the state between the build turning protection
+ * on and the owner setting a password or generating a key, or after "clear
+ * password" / "Clear signing key". The docs promise every request is rejected
+ * there, so it must never fall back to "no gate": a locked gate still honors
+ * publicPaths and answers like any unauthed request for its mode (unlock page,
+ * loginUrl redirect, plain 401), but no cookie, token or password passes it.
+ * This used to return null, which served a just-enabled site to the public.
+ *
+ * Project API keys (search, MCP) still work on a locked site, by design: they
+ * are a separate grant the owner created, checked before this gate's cookie
+ * logic. The owner revokes the key to stop that access.
+ *
+ * The shape rules (what counts as gated, what counts as a usable secret) live
+ * in auth-gate-rules.ts so the R2 write guard and the unlock route cannot
+ * drift from this function.
  *
  * Coexistence is by design: BOTH secret keys may exist simultaneously
  * during a password→JWT migration (the build writes the new key before
@@ -102,7 +126,7 @@ export async function resolveAuth(
     () => getProjectAuthPublic(projectSlug),
   );
 
-  if (!pub || pub.enabled !== true) {
+  if (!pub || !isGatedPublicRecord(pub)) {
     return null;
   }
 
@@ -117,42 +141,37 @@ export async function resolveAuth(
   const authType: 'password' | 'jwt' = pub.authType === 'jwt' ? 'jwt' : 'password';
 
   if (authType === 'jwt') {
-    const jwtSecret = await readOrFail<JwtSecret>(
+    const loginUrl = typeof pub.loginUrl === 'string' ? pub.loginUrl : undefined;
+    // Kept on a locked gate too: group pages must not be opened by an
+    // overlapping public glob just because the key is missing.
+    const groupsPaths =
+      pub.groupsPaths && typeof pub.groupsPaths === 'object' ? pub.groupsPaths : undefined;
+    const jwtSecret = await readOrFail<unknown>(
       () => getProjectJwtSecret(projectSlug),
     );
-    if (
-      !jwtSecret ||
-      typeof jwtSecret.publicKeyPem !== 'string' ||
-      jwtSecret.publicKeyPem.length === 0 ||
-      typeof jwtSecret.version !== 'number'
-    ) {
+    if (!isUsableJwtSecret(jwtSecret)) {
       // authType says jwt but the jwt-own secret isn't there (or is
-      // malformed) — gate off. A lingering password hash from a prior
-      // mode must NEVER satisfy jwt mode; that would be a half-on gate.
-      return null;
+      // malformed): locked, never open. A lingering password hash from a
+      // prior mode must NEVER satisfy jwt mode either.
+      return { authType, locked: true, publicPaths, loginUrl, groupsPaths };
     }
     return {
       authType,
       publicKeyPem: jwtSecret.publicKeyPem,
       version: jwtSecret.version,
       publicPaths,
-      loginUrl: typeof pub.loginUrl === 'string' ? pub.loginUrl : undefined,
-      groupsPaths:
-        pub.groupsPaths && typeof pub.groupsPaths === 'object'
-          ? pub.groupsPaths
-          : undefined,
+      loginUrl,
+      groupsPaths,
     };
   }
 
-  const secret = await readOrFail<AuthSecret>(
+  const secret = await readOrFail<unknown>(
     () => getProjectAuthSecret(projectSlug),
   );
-  if (
-    !secret ||
-    typeof secret.hash !== 'string' ||
-    typeof secret.version !== 'number'
-  ) {
-    return null;
+  if (!isUsableAuthSecret(secret)) {
+    // No password set yet (or "clear password", or a malformed record):
+    // locked. A jwt key that may still exist never satisfies password mode.
+    return { authType, locked: true, publicPaths };
   }
 
   return {
@@ -171,7 +190,7 @@ export async function resolveAuth(
 // like public-paths-resolver without dragging in the Redis client.
 
 /**
- * Quick boolean check: is this project password-gated right now?
+ * Quick boolean check: is this project gated (password or jwt) right now?
  * Used by R2 read paths to CHOOSE WHICH FETCH MECHANISM to use:
  *   - true  → S3 SDK (HMAC-authed, slower)
  *   - false → CF public domain (fast, cached)
@@ -182,31 +201,22 @@ export async function resolveAuth(
  * fetch mechanism. Therefore: fail OPEN (return false) on Redis error so
  * brownouts don't nullify the CDN-cache latency win.
  *
- * Reads go through cached-redis (getProjectAuthSecret/getProjectAuthPublic/
- * getProjectJwtSecret) — the same wrappers resolveAuth uses — so the two
- * share per-instance cache entries for these keys instead of each holding
- * its own copy. cached-redis does NOT cache fetch errors, so the fail-open
- * path below still retries on the next call rather than pinning `false`.
+ * Reads go through cached-redis (getProjectAuthPublic), the same wrapper
+ * resolveAuth uses, so the two share one per-instance cache entry.
+ * cached-redis does NOT cache fetch errors, so the fail-open path below
+ * still retries on the next call rather than pinning `false`.
  *
- * Mirrors resolveAuth's mode binding exactly: a jwt tenant is gated only by
- * its jwt key, a password tenant only by its hash. A lingering hash from a
- * previous mode never counts (resolveAuth ignores it too), so the storage
- * scheme and the edge gate can never disagree about whether a site is open.
+ * Same definition as resolveAuth: `enabled === true` is gated, whether or not
+ * the mode's secret exists (a LOCKED gate is still a gate), so only the public
+ * record is read. r2-public-storage-guard uses the same rule on the write
+ * side: a gated site never gets versioned public keys, so the read side must
+ * pick the S3 path for exactly those sites or it would find nothing.
  */
 export async function isProjectGated(slug: string): Promise<boolean> {
   if (!redis) return false;
 
   try {
-    // Same public-first ordering as resolveAuth (shared cache entries): a
-    // disabled tenant is one GET, and only the mode's own secret is read.
-    const pub = await getProjectAuthPublic(slug);
-    if (pub?.enabled !== true) return false;
-    if (pub.authType === 'jwt') {
-      const jwtSecret = await getProjectJwtSecret(slug);
-      return typeof jwtSecret?.publicKeyPem === 'string';
-    }
-    const secret = await getProjectAuthSecret(slug);
-    return typeof secret?.hash === 'string';
+    return isGatedPublicRecord(await getProjectAuthPublic(slug));
   } catch {
     // Fail OPEN: this is a read-mechanism choice, not access control.
     // Gating already happened upstream in proxy.ts. Failing closed here

package/vendored/lib/jwt-key-build-warning.ts

@@ -4,12 +4,13 @@ import type { BuildWarning } from '../shared/status-reporter.js'; // vendored co
  * Warn when a project declares JWT authentication but has no signing key.
  *
  * The truth table in auth-resolver.ts is explicit: `authType === 'jwt'` with a
- * missing or malformed `projectJwtSecret` means NO GATE. That is the correct
- * fail-safe for a key that was cleared deliberately, but it is also reachable
- * by accident: commit `auth.jwt.enabled: true`, publish, and never click
- * Generate signing key. The build then succeeds, the site serves every page to
- * the public, and nothing says so. The dashboard card does report it, but a
- * customer who publishes from git has no reason to open that page.
+ * missing or malformed `projectJwtSecret` is a LOCKED gate. Every visitor is
+ * turned away, because no token can be verified. That is the correct fail-safe
+ * for a key that was cleared deliberately, but it is also reachable by
+ * accident: commit `auth.jwt.enabled: true`, publish, and never click Generate
+ * signing key. The build then succeeds, nobody can read the site, and nothing
+ * says why. The dashboard card does report it, but a customer who publishes
+ * from git has no reason to open that page.
  *
  * Silent for `enabled: false`, where a public site is the stated intent, and
  * silent for password tenants, whose own secret has its own row in that table.
@@ -32,7 +33,7 @@ export function buildJwtKeyWarning(input: {
     // docs.json is where the opt-in lives and what an author edits to change it.
     file: 'docs.json',
     message:
-      'auth.jwt.enabled is true but this project has no signing key, so nothing is gated and every page is publicly readable. ' +
+      'auth.jwt.enabled is true but this project has no signing key, so the site is locked: every visitor is turned away until a signing key is generated. ' +
       'Generate an Ed25519 signing key under Settings, or set auth.jwt.enabled to false if the site is meant to be public.',
   };
 }

package/vendored/lib/r2-public-storage-guard.ts

@@ -1,17 +1,6 @@
 import { redis } from './redis.js';
 import { logger } from '../shared/logger.js';
-
-interface AuthSecret {
-  hash?: unknown;
-}
-
-interface JwtSecret {
-  publicKeyPem?: unknown;
-}
-
-interface AuthPublic {
-  enabled?: unknown;
-}
+import { isGatedPublicRecord } from './auth-gate-rules.js';
 
 function publicDomainConfigured(): boolean {
   return !!process.env.R2_PUBLIC_DOMAIN?.trim();
@@ -21,31 +10,12 @@ function overrideEnabled(): boolean {
   return process.env.R2_ALLOW_GATED_PUBLIC_BUCKET?.trim() === 'true';
 }
 
-// Considers EITHER secret key — a JWT-gated project must also be treated
-// as gated here, or its content gets written to public/versioned R2 keys
-// (defeating the guard's purpose). Deliberately a SUPERSET of
-// isProjectGated's mode-bound truth table (which consults only the key for
-// the configured authType): a lingering hash on a jwt tenant with no jwt
-// key makes this guard write gated keys while the reader takes the public
-// path and falls back to the S3 SDK — a latency cost, never an exposure.
-// Fail-closed is the right bias for a write-side guard.
-function isGated(
-  secret: AuthSecret | null,
-  pub: AuthPublic | null,
-  jwtSecret: JwtSecret | null,
-): boolean {
-  return (
-    pub?.enabled === true &&
-    (typeof secret?.hash === 'string' || typeof jwtSecret?.publicKeyPem === 'string')
-  );
-}
-
 /**
  * R2 write scheme for a build:
  *   - 'versioned+legacy': dual-write as normal (the versioned/public keys the
  *     CF custom domain serves are safe to write for this project).
- *   - 'legacy-only': password-gated project — write ONLY the legacy
- *     `{slug}/<file>` keys. The versioned public keys are never written, so
+ *   - 'legacy-only': gated project (password or jwt, locked or not) — write
+ *     ONLY the legacy `{slug}/<file>` keys. The versioned public keys are never written, so
  *     gated content cannot enter the CF-served key space. The ISR reader keeps
  *     serving these projects from the S3 SDK path (isProjectGated=true), so the
  *     legacy keys are all it needs.
@@ -60,22 +30,36 @@ export type R2WriteScheme = 'versioned+legacy' | 'legacy-only';
  * mechanism after request auth has already happened. The write side is
  * different: before writing objects into a bucket that is exposed by
  * R2_PUBLIC_DOMAIN, it must fail closed unless we can prove the project is not
- * password-gated or an explicit customer-acceptance override is set.
+ * gated or an explicit customer-acceptance override is set.
  *
- * A password-gated project resolves to `'legacy-only'` — its versioned/public
+ * A gated project resolves to `'legacy-only'` — its versioned/public
  * keys are never written, so gated content stays out of the CF-served key
  * space (the build still succeeds; the S3 read path serves it). Non-gated
  * projects, the no-public-domain case, and the acceptance override all resolve
- * to `'versioned+legacy'`. Throws when gated status cannot be determined (Redis
+ * to `'versioned+legacy'`.
+ *
+ * Gated means `isGatedPublicRecord` (auth-gate-rules.ts): enabled === true,
+ * secret or not, the same rule as resolveAuth and isProjectGated. A site with
+ * protection on and no password/key yet is a LOCKED gate at the edge; writing
+ * its content to the public versioned keys would make it readable through the
+ * CDN path while the edge rejects every request.
+ *
+ * `declaredGated` is the build's own docs.json verdict. It wins over Redis:
+ * the build writes projectAuthPublic earlier, but that write is non-fatal, so
+ * on a failed write Redis still holds the previous (public) record and would
+ * send a newly gated site's content to the public keys. A declared gate is
+ * decided without a Redis read.
+ *
+ * Throws when gated status cannot be determined (Redis
  * unavailable / read fails after retries) — we must never write to a public
  * bucket unverified, and a Redis outage during upload is a real failure worth
  * surfacing (rare — the build has already done many Redis reads by this point).
  */
 export async function resolveR2WriteScheme(
   slug: string,
-  opts: { retryAttempts?: number; retryDelayMs?: number } = {},
+  opts: { retryAttempts?: number; retryDelayMs?: number; declaredGated?: boolean } = {},
 ): Promise<R2WriteScheme> {
-  const { retryAttempts = 3, retryDelayMs = 200 } = opts;
+  const { retryAttempts = 3, retryDelayMs = 200, declaredGated = false } = opts;
   if (!publicDomainConfigured()) return 'versioned+legacy';
   if (overrideEnabled()) {
     // The override must never run silently: it disables the only write-side
@@ -87,6 +71,7 @@ export async function resolveR2WriteScheme(
     );
     return 'versioned+legacy';
   }
+  if (declaredGated) return 'legacy-only';
 
   if (!redis) {
     throw new Error(
@@ -100,21 +85,12 @@ export async function resolveR2WriteScheme(
   // any read error) even for non-gated projects. An outage that outlasts the
   // retries still fails closed — correct, since we must never write to a
   // public bucket unverified.
-  let secret: AuthSecret | null = null;
-  let pub: AuthPublic | null = null;
-  let jwtSecret: JwtSecret | null = null;
+  let pub: unknown = null;
   let lastErr: unknown;
   let read = false;
   for (let attempt = 1; attempt <= retryAttempts; attempt++) {
     try {
-      const [secretResult, publicResult, jwtSecretResult] = await Promise.all([
-        client.get(`projectAuthSecret:${slug}`),
-        client.get(`projectAuthPublic:${slug}`),
-        client.get(`projectJwtSecret:${slug}`),
-      ]);
-      secret = secretResult as AuthSecret | null;
-      pub = publicResult as AuthPublic | null;
-      jwtSecret = jwtSecretResult as JwtSecret | null;
+      pub = await client.get(`projectAuthPublic:${slug}`);
       read = true;
       break;
     } catch (err) {
@@ -131,5 +107,5 @@ export async function resolveR2WriteScheme(
     );
   }
 
-  return isGated(secret, pub, jwtSecret) ? 'legacy-only' : 'versioned+legacy';
+  return isGatedPublicRecord(pub) ? 'legacy-only' : 'versioned+legacy';
 }

package/vendored/lib/screenshot-capture.ts

@@ -113,9 +113,9 @@ const CAPTURE_COOKIE_TTL_MS = 5 * 60_000;
  * nothing new. JWT mode gets no groups (least privilege): a group-restricted
  * homepage captures as the gate's 404.
  *
- * Returns null when the site is ungated, or when the cookie can't be minted —
- * the capture then proceeds unauthenticated, as it did before this existed.
- * Never rejects: the capture starts it before launching Chromium and may
+ * Returns null when the site is ungated or locked, or when the cookie can't be
+ * minted — the capture then proceeds unauthenticated, as it did before this
+ * existed. Never rejects: the capture starts it before launching Chromium and may
  * abandon it on timeout.
  */
 export async function mintCaptureAuthCookie(
@@ -130,6 +130,9 @@ export async function mintCaptureAuthCookie(
     return null;
   }
   if (!auth) return null;
+  // Locked (protection on, no password/key yet): the edge accepts no cookie,
+  // so capture what every visitor sees, the unlock page or login redirect.
+  if (auth.locked) return null;
   const secret = process.env.EDGE_AUTH_SECRET;
   if (!secret) {
     console.warn(`Screenshot: ${slug} is gated but EDGE_AUTH_SECRET is unset; capture will hit the password wall`);

package/vendored/lib/snippet-loader-isr.ts

@@ -25,6 +25,7 @@ import {
   guardPropertyKey,
   KEY_GUARD_NAME,
   STRICT_MODE_PROLOGUE,
+  MdxEvalGuardError,
 } from './mdx-eval-guard';
 import { extractUtilityCandidates, MAX_UTILITY_CANDIDATES } from './user-utility-css';
 import { logger } from '../shared/logger';
@@ -250,6 +251,125 @@ function extractExports(transpiledCode: string): Record<string, string> {
   return exports;
 }
 
+/**
+ * Turn transpiled snippet code into ONE function body that declares everything
+ * at the file's top level and returns its named exports as an object.
+ *
+ * Why: per-export compile (extractExports) runs each export in its own
+ * function, so anything it references at the file's top level (a sibling
+ * `export const`, a non-exported helper) is "not defined" at render and the
+ * node silently drops. `jamdesk dev` imports the file as a real module, where
+ * that works, so the same snippet rendered locally and vanished in prod.
+ *
+ * The RETURNED names are exactly the ones extractExports finds (`export const`
+ * and plain `export function`). Other forms (`export let`, `export class`,
+ * `export { a as b }`, default exports) are still declared, so siblings can
+ * use them, but stay out of the result: a different export count would change
+ * which component loadSnippetsForIsr's single-export alias fallback picks for
+ * snippets that already work. `__proto__` is never returned, so no caller
+ * that copies exports by assignment can set a prototype through it.
+ *
+ * Runs on Babel OUTPUT, after mdxEvalGuardPlugin has already checked the
+ * author's code: it only removes `export` keywords and appends the return, so
+ * it adds no author-controlled code. Returns null for shapes it does not
+ * handle (re-exports from another module, destructured exports); the caller
+ * then uses the per-export path, exactly as before.
+ */
+export function toSnippetModuleBody(transpiledCode: string): string | null {
+  const names: string[] = [];
+  let unsupported = false;
+
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const stripExports = ({ types: t }: { types: any }) => ({
+    visitor: {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      ExportNamedDeclaration(path: any) {
+        const { node } = path;
+        if (node.source) {
+          unsupported = true;
+          return;
+        }
+        const decl = node.declaration;
+        if (!decl) {
+          // `export { a as b }`: the locals are already declared.
+          path.remove();
+          return;
+        }
+        if (t.isVariableDeclaration(decl)) {
+          for (const d of decl.declarations) {
+            if (!t.isIdentifier(d.id)) {
+              unsupported = true;
+              return;
+            }
+            if (decl.kind === 'const') names.push(d.id.name);
+          }
+        } else if (t.isFunctionDeclaration(decl) && decl.id) {
+          if (!decl.async && !decl.generator) names.push(decl.id.name);
+        } else if (!(t.isClassDeclaration(decl) && decl.id)) {
+          unsupported = true;
+          return;
+        }
+        path.replaceWith(decl);
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      ExportDefaultDeclaration(path: any) {
+        const decl = path.node.declaration;
+        if ((t.isFunctionDeclaration(decl) || t.isClassDeclaration(decl)) && decl.id) {
+          path.replaceWith(decl);
+        } else {
+          path.remove();
+        }
+      },
+      ExportAllDeclaration() {
+        unsupported = true;
+      },
+    },
+  });
+
+  let code: string | null | undefined;
+  try {
+    code = transform(transpiledCode, {
+      plugins: [stripExports],
+      sourceType: 'module',
+      filename: 'snippet.js',
+    })?.code;
+  } catch {
+    return null;
+  }
+  const exported = names.filter((n) => n !== '__proto__');
+  if (unsupported || !code || exported.length === 0) return null;
+
+  // The block lets a top-level `const Note` shadow the built-in parameter of
+  // the same name instead of throwing "already declared".
+  return `{\n${code}\nreturn { ${exported.join(', ')} };\n}`;
+}
+
+/**
+ * Evaluate tenant code in a `new Function` with the snippet scope: React, the
+ * JSX runtime, the runtime key guard and the built-in components. The ONE
+ * place both snippet compile paths build that function, so the strict-mode
+ * prologue and the guard binding cannot drift apart between them.
+ */
+function evaluateSnippetCode(
+  code: string,
+  builtInNames: string[],
+  builtInValues: AnyComponent[]
+): unknown {
+  // NOTE: new Function() is intentionally used here to compile user-provided snippets
+  const fn = new Function(
+    'React',
+    '_jsx',
+    '_jsxs',
+    '_Fragment',
+    KEY_GUARD_NAME, // runtime half of mdxEvalGuardPlugin — see mdx-eval-guard.ts
+    ...builtInNames,
+    // STRICT_MODE_PROLOGUE is load-bearing, not hygiene: without it this
+    // body is sloppy-mode and `this` is globalThis. See mdx-eval-guard.ts.
+    `${STRICT_MODE_PROLOGUE}\n${code}`
+  );
+  return fn(React, jsxRuntime.jsx, jsxRuntime.jsxs, jsxRuntime.Fragment, guardPropertyKey, ...builtInValues);
+}
+
 /**
  * Detect plain-markdown snippet source — Mintlify-style snippet files that
  * contain only markdown text (with optional inline JSX components) and have no
@@ -359,38 +479,74 @@ async function compileSnippet(
   // Transpile JSX to JavaScript
   const transpiled = transpileJsx(source);
 
-  // Extract exports from transpiled code
-  const exportedFunctions = extractExports(transpiled);
-
-  // Compile each export into an actual React component
   const builtInNames = Object.keys(builtInComponents);
+  const builtInValues = builtInNames.map((n) => builtInComponents[n]);
+  const exports =
+    compileSnippetModule(transpiled, snippetPath, builtInNames, builtInValues) ??
+    compileSnippetPerExport(transpiled, snippetPath, builtInNames, builtInValues);
+
+  const result: CompiledSnippet = {
+    exports,
+    isClientComponent,
+    utilityCandidates: extractUtilityCandidates(source),
+  };
+
+  // Cache the result
+  snippetComponentCache.set(cacheKey, { result, timestamp: Date.now() });
+
+  return result;
+}
+
+/**
+ * Compile the whole snippet file as one function body, so exports share the
+ * file's top-level scope like they do under `jamdesk dev`. Returns null (and
+ * the caller falls back to per-export compile) when the shape is unsupported
+ * or the top-level code throws on the server, e.g. browser-only code that
+ * never ran here before.
+ */
+function compileSnippetModule(
+  transpiled: string,
+  snippetPath: string,
+  builtInNames: string[],
+  builtInValues: AnyComponent[]
+): Record<string, AnyComponent> | null {
+  const body = toSnippetModuleBody(transpiled);
+  if (!body) return null;
+  try {
+    return evaluateSnippetCode(body, builtInNames, builtInValues) as Record<string, AnyComponent>;
+  } catch (error) {
+    // An escape attempt caught by the runtime key guard must fail the snippet
+    // the way the static guard does, not slip through on the fallback path.
+    if (error instanceof MdxEvalGuardError) throw error;
+    logger.warn('[ISR Snippet] whole-file compile failed, using per-export compile', {
+      snippetPath,
+      error: error instanceof Error ? error.message : String(error),
+    });
+    return null;
+  }
+}
+
+/**
+ * Pre-2026-10-12 path: each export compiled alone, so it cannot see the
+ * file's other top-level names. Kept as the fallback so a snippet that worked
+ * before keeps working when the whole-file compile can't be used.
+ */
+function compileSnippetPerExport(
+  transpiled: string,
+  snippetPath: string,
+  builtInNames: string[],
+  builtInValues: AnyComponent[]
+): Record<string, AnyComponent> {
+  const exportedFunctions = extractExports(transpiled);
   const exports: Record<string, AnyComponent> = {};
 
   for (const [name, functionCode] of Object.entries(exportedFunctions)) {
     try {
-      // Create function that returns the component
-      // NOTE: new Function() is intentionally used here to compile user-provided snippets
-
-      const createComponent = new Function(
-        'React',
-        '_jsx',
-        '_jsxs',
-        '_Fragment',
-        KEY_GUARD_NAME, // runtime half of mdxEvalGuardPlugin — see mdx-eval-guard.ts
-        ...builtInNames,
-        // STRICT_MODE_PROLOGUE is load-bearing, not hygiene: without it this
-        // body is sloppy-mode and `this` is globalThis. See mdx-eval-guard.ts.
-        `${STRICT_MODE_PROLOGUE}\nreturn ${functionCode}`
-      );
-
-      const component = createComponent(
-        React,
-        jsxRuntime.jsx,
-        jsxRuntime.jsxs,
-        jsxRuntime.Fragment,
-        guardPropertyKey,
-        ...builtInNames.map((n) => builtInComponents[n])
-      );
+      const component = evaluateSnippetCode(
+        `return ${functionCode}`,
+        builtInNames,
+        builtInValues
+      ) as AnyComponent;
 
       exports[name] = component;
     } catch (error) {
@@ -402,16 +558,7 @@ async function compileSnippet(
     }
   }
 
-  const result: CompiledSnippet = {
-    exports,
-    isClientComponent,
-    utilityCandidates: extractUtilityCandidates(source),
-  };
-
-  // Cache the result
-  snippetComponentCache.set(cacheKey, { result, timestamp: Date.now() });
-
-  return result;
+  return exports;
 }
 
 /**

package/vendored/lib/viewer-navigation.ts

@@ -34,7 +34,9 @@ export async function filterNavigationForViewer(
   const secret = process.env.EDGE_AUTH_SECRET;
   const cookieHeader = headersList.get('cookie') || '';
   const match = cookieHeader.match(new RegExp(`(?:^|;\\s*)jd_auth_${slug}=([^;]+)`));
-  if (secret && match) {
+  // Locked (jwt on, no signing key): no session can be valid, so the viewer
+  // has no groups and the nav over-hides like it does for anonymous viewers.
+  if (secret && match && !auth.locked) {
     const host = headersList.get('x-jamdesk-forwarded-host') || headersList.get('host') || '';
     try {
       const v = await verifyAuthCookie(match[1], { slug, host, version: auth.version }, secret);

package/vendored/scripts/compile-snippets.cjs

@@ -39,6 +39,50 @@ async function writeIfChanged(filePath, content) {
   return true; // Written
 }
 
+/**
+ * Generated file names must be unique IGNORING case. On a case-insensitive disk
+ * (the macOS default) exports `brandColor` and `BrandColor` would be one file:
+ * the second write overwrote the first and Turbopack could not resolve one of
+ * the imports. Each component (`identity` = dir + name) owns one file name; a
+ * different component that wants a name already taken, in any case, gets a
+ * `.2`, `.3`, ... suffix. A dot cannot clash with the `__` directory separator
+ * or with a PascalCase base name. Claiming again with the same identity
+ * returns the same file name, so the same-name dedupe below still works.
+ */
+function createFileNameClaimer() {
+  const owners = new Map(); // lowercased file name -> identity that owns it
+  const byIdentity = new Map(); // identity -> file name
+  return function claimFileName(desired, identity) {
+    if (byIdentity.has(identity)) return byIdentity.get(identity);
+    const stem = desired.replace(/\.tsx$/, '');
+    for (let n = 1; ; n++) {
+      const candidate = n === 1 ? desired : `${stem}.${n}.tsx`;
+      if (!owners.has(candidate.toLowerCase())) {
+        owners.set(candidate.toLowerCase(), identity);
+        byIdentity.set(identity, candidate);
+        return candidate;
+      }
+    }
+  };
+}
+
+/**
+ * Delete files that differ from `fileName` only by case before writing it.
+ * Names are unique ignoring case within a run (createFileNameClaimer), so any
+ * such file is left over from an earlier run. Without this, a case-insensitive
+ * disk keeps the OLD casing (writeIfChanged skips identical content), and the
+ * case-sensitive stale cleanup then deletes what is really the live file.
+ */
+async function removeCaseVariants(dir, fileName, existingNames) {
+  for (let i = existingNames.length - 1; i >= 0; i--) {
+    const name = existingNames[i];
+    if (name !== fileName && name.toLowerCase() === fileName.toLowerCase()) {
+      await fs.remove(path.join(dir, name));
+      existingNames.splice(i, 1);
+    }
+  }
+}
+
 // Parse command line arguments
 const args = process.argv.slice(2);
 const projectArgIndex = args.indexOf('--project');
@@ -359,6 +403,8 @@ export const SnippetComponents: Record<string, React.ComponentType<any>> = {};
 
   // Track all components and their files
   const componentInfo = []; // { name, fileName, needsClient }
+  const claimFileName = createFileNameClaimer();
+  const namesOnDisk = fs.existsSync(generatedDir) ? await fs.readdir(generatedDir) : [];
 
   for (const snippetFile of snippetFiles) {
     const { file, dir, fullPath: filePath } = snippetFile;
@@ -381,11 +427,12 @@ export const SnippetComponents: Record<string, React.ComponentType<any>> = {};
       for (const exportName of exportNames) {
         // Use dir prefix in filename only (to avoid file collisions)
         const filePrefix = dir ? `${dir.replace(/\//g, '__')}__` : '';
-        const fileName = `${filePrefix}${exportName}.tsx`;
+        const fileName = claimFileName(`${filePrefix}${exportName}.tsx`, `${dir}|${exportName}`);
         const componentFile = generateComponentFile(exportName, processedCode, needsClient, false);
 
         const filePath = path.join(generatedDir, fileName);
         generatedFiles.add(fileName);
+        await removeCaseVariants(generatedDir, fileName, namesOnDisk);
         const written = await writeIfChanged(filePath, componentFile);
         // Track with directory for alias mapping
         componentInfo.push({
@@ -406,11 +453,12 @@ export const SnippetComponents: Record<string, React.ComponentType<any>> = {};
       const needsClient = needsClientDirective(wrappedCode);
       // Use dir prefix in filename only (double underscore to avoid collisions)
       const filePrefix = dir ? `${dir.replace(/\//g, '__')}__` : '';
-      const fileName = `${filePrefix}${baseName}.tsx`;
+      const fileName = claimFileName(`${filePrefix}${baseName}.tsx`, `${dir}|${baseName}`);
 
       const componentFile = generateComponentFile(baseName, wrappedCode, needsClient, true);
       const filePath = path.join(generatedDir, fileName);
       generatedFiles.add(fileName);
+      await removeCaseVariants(generatedDir, fileName, namesOnDisk);
       const written = await writeIfChanged(filePath, componentFile);
       componentInfo.push({
         name: baseName,
@@ -458,14 +506,22 @@ export const SnippetComponents: Record<string, React.ComponentType<any>> = {};
   const dedupedComponentInfo = [...seenComponentKeys.values()];
 
   // Build unique import names for each component (prefixed with dir if needed)
+  // Identifiers in the index must be unique too: in a subdirectory, `brandColor`
+  // and `BrandColor` both become `XBrandColor`, a duplicate import that breaks
+  // the whole index. Later duplicates get a `_2`, `_3`, ... suffix.
+  const usedImportNames = new Set();
   const importInfo = dedupedComponentInfo.map(c => {
     const prefix = c.dir ? toPascalCase(c.dir.replace(/\//g, '-')) : '';
-    const uniqueName = prefix + c.name.charAt(0).toUpperCase() + c.name.slice(1);
+    const prefixed = prefix + c.name.charAt(0).toUpperCase() + c.name.slice(1);
+    const baseName = c.dir ? prefixed : c.name; // Only add prefix if in subdirectory
+    let uniqueName = baseName;
+    for (let n = 2; usedImportNames.has(uniqueName); n++) uniqueName = `${baseName}_${n}`;
+    usedImportNames.add(uniqueName);
     // Strip the .tsx extension from fileName to get the import path
     const importPath = c.fileName.replace(/\.tsx$/, '');
     return {
       ...c,
-      uniqueName: c.dir ? uniqueName : c.name, // Only add prefix if in subdirectory
+      uniqueName,
       importPath
     };
   });

package/vendored/workspace-package-lock.json

@@ -3264,9 +3264,9 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "3.4.16",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.16.tgz",
-      "integrity": "sha512-sqo+pNp3qRhCIpbgRi1y8Tgk27Bo2Ry7w0dC1NBeNTdZChWjz9Xb/KOoZbRP/R6pQZ80Qw8YhXw13hWWBbMRnQ==",
+      "version": "3.4.17",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.17.tgz",
+      "integrity": "sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"