stack-site-builder 1.18.0 → 1.19.1

package/CHANGELOG.md

@@ -11,6 +11,36 @@ content schema, while a consuming site supplies only content, taxonomy data and
 config. Sites track the theme with `pnpm up stack-site-builder`, so each release
 here is a plain version bump they pull in.
 
+## [1.19.1] - 2026-07-23
+
+### Changed
+
+- **Member-only entries are login-aware, and the Slides nav is back** —
+  1.18.0 dropped unlisted private entries from listings for everyone; the
+  intended behavior is per-VIEWER: logged-out visitors don't see them,
+  logged-in members do. Listings now render member-only cards with
+  `data-aas-member-only`; a pre-paint script stamps `html[data-aas-member]`
+  when a session exists and CSS does the rest — no flash either way. A
+  "shows after login" hint line replaces the invisible content for
+  logged-out visitors, and 1.19.0's listed-deck nav gating is reverted (the
+  Slides item follows the section toggle again).
+
+## [1.19.0] - 2026-07-23
+
+### Added
+
+- **Header member login/logout** — sites with private content get an account
+  control in the header: a login dropdown (id/password, same credential
+  machinery as the page gates) and a logout button once signed in. The
+  control reveals itself only when the new `/aas-auth.json` endpoint reports
+  configured login users (it serves the salted user table every private page
+  already embeds — nothing new is exposed); sites without `AAS_PRIVATE_*`
+  env see nothing. Credential verification moved into a shared
+  `loginWithCredentials` helper in `lib/private-client`.
+- **Slides nav hides without listed decks** — a site whose decks are all
+  private+unlisted reaches them from course pages, so the header's Slides
+  item now appears only when the index actually lists at least one deck.
+
 ## [1.18.0] - 2026-07-23
 
 ### Added
@@ -303,6 +333,8 @@ catalog sites from a thin content-only repository.
 - **Standalone development setup** — a devcontainer and a minimal `playground/`
   consuming site for developing and previewing the theme on its own.
 
+[1.19.1]: https://github.com/CodeCompose7/stack-site-builder/compare/v1.19.0...v1.19.1
+[1.19.0]: https://github.com/CodeCompose7/stack-site-builder/compare/v1.18.0...v1.19.0
 [1.18.0]: https://github.com/CodeCompose7/stack-site-builder/compare/v1.17.4...v1.18.0
 [1.17.4]: https://github.com/CodeCompose7/stack-site-builder/compare/v1.17.3...v1.17.4
 [1.17.3]: https://github.com/CodeCompose7/stack-site-builder/compare/v1.17.2...v1.17.3

package/index.mjs

@@ -129,6 +129,13 @@ export default function aasTheme({ glossary, sections = {} }) {
           });
         }
 
+        // Global (locale-less) login user table for the header login control —
+        // `{ enabled: false }` on sites without private-content env config.
+        injectRoute({
+          pattern: '/aas-auth.json',
+          entrypoint: 'stack-site-builder/pages/aas-auth.json.ts',
+        });
+
         updateConfig({
           markdown: aasMarkdown({ glossary, locales, defaultLocale }),
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "stack-site-builder",
   "type": "module",
-  "version": "1.18.0",
+  "version": "1.19.1",
   "license": "MIT",
   "description": "The engine behind the awesome-*-stack catalog sites: an Astro theme with the catalog/concepts/articles/slides/samples routes, components, styles and markdown pipeline. Sites provide content, taxonomy data and config.",
   "repository": {

package/src/components/ArticleCard.astro

@@ -19,9 +19,11 @@ interface Props {
   /** Private entry: show a lock and the (public) `teaser` instead of the description. */
   isPrivate?: boolean;
   teaser?: string;
+  /** Hidden from logged-out visitors (private without listed). */
+  memberOnly?: boolean;
 }
 
-const { slug, lang, title, description, date, tags, image, imageAlt, version, isPrivate = false, teaser } = Astro.props;
+const { slug, lang, title, description, date, tags, image, imageAlt, version, isPrivate = false, teaser, memberOnly = false } = Astro.props;
 const t = useTranslations(lang);
 const shownDesc = isPrivate ? (teaser ?? '') : description;
 const href = getRelativeLocaleUrl(lang, `article/${slug}/`);
@@ -31,6 +33,7 @@ const dateStr = date.toISOString().slice(0, 10);
 <a
   href={href}
   data-name={title.toLowerCase()}
+  data-aas-member-only={memberOnly ? '' : undefined}
   data-date={date.toISOString()}
   class="aas-lift flex items-stretch overflow-hidden rounded-2xl border border-[var(--aas-border)] bg-[var(--aas-panel)] no-underline"
 >

package/src/components/BlogIndex.astro

@@ -8,7 +8,7 @@ import ArrowUpRight from './ArrowUpRight.astro';
 const PAGE = 12;
 import { articleTree, articleCatOf } from '@aas-data/article-categories';
 import { getArticles, articleSlugOf, type ArticleEntry } from '../lib/articles';
-import { listedInIndex } from '../lib/listing';
+import { memberOnlyInIndex } from '../lib/listing';
 import { useTranslations, type Lang } from '../i18n/ui';
 
 // Doubles as the writing index (no `categoryId` → all articles, grouped by
@@ -21,7 +21,8 @@ interface Props {
 
 const { lang, categoryId } = Astro.props;
 const t = useTranslations(lang);
-const all = (await getArticles(lang)).filter((e) => listedInIndex(e.data));
+const all = await getArticles(lang);
+const hasMemberOnly = all.some((e) => memberOnlyInIndex(e.data));
 const catUrl = (cid: string) => getRelativeLocaleUrl(lang, `article/category/${cid}/`);
 
 const itemsIn = (cid: string): ArticleEntry[] => {
@@ -61,6 +62,7 @@ const card = (a: ArticleEntry) => ({
   imageAlt: a.data.imageAlt,
   isPrivate: a.data.private,
   teaser: a.data.teaser,
+  memberOnly: memberOnlyInIndex(a.data),
 });
 ---
 
@@ -84,6 +86,9 @@ const card = (a: ArticleEntry) => ({
 }
 
 {all.length === 0 && <p class="mt-8 text-[var(--aas-muted)]">{t('blog.empty')}</p>}
+{hasMemberOnly && (
+  <p data-aas-member-hint class="mt-4 text-sm text-[var(--aas-muted)]">{t('private.memberHint')}</p>
+)}
 
 {all.length > 0 && <div class="mt-6"><ListControls lang={lang} /></div>}
 

package/src/components/CategoryIndex.astro

@@ -7,7 +7,7 @@ import ArrowUpRight from './ArrowUpRight.astro';
 import { categoryMap, childrenOf, pathOf } from '@aas-data/categories';
 import { getStacks, getStacksByCategory, slugOf, type StackEntry } from '../lib/stacks';
 import { deriveFacets } from '../lib/facets';
-import { listedInIndex } from '../lib/listing';
+import { memberOnlyInIndex } from '../lib/listing';
 import { useTranslations, type Lang } from '../i18n/ui';
 
 interface Props {
@@ -32,23 +32,19 @@ const crumbs = [
 
 const children = childrenOf(id);
 // Stacks attached directly to this node (vs. nested under a subcategory).
-const direct = (await getStacksByCategory(lang, id)).filter(
-  (s) => s.data.category === id && listedInIndex(s.data),
-);
+const direct = (await getStacksByCategory(lang, id)).filter((s) => s.data.category === id);
 // Each child subcategory with its own rolled-up stacks.
 const childGroups = await Promise.all(
-  children.map(async (c) => ({
-    cat: c,
-    items: (await getStacksByCategory(lang, c.id)).filter((s) => listedInIndex(s.data)),
-  })),
+  children.map(async (c) => ({ cat: c, items: await getStacksByCategory(lang, c.id) })),
 );
 
 // Filter facets are built from the WHOLE catalog (not just this page's tools) so
 // they're identical on every page — a sort/filter carried in from elsewhere can
 // always be restored here, even if no tool in this category has that value.
-const facets = deriveFacets((await getStacks(lang)).filter((e) => listedInIndex(e.data)), lang);
+const facets = deriveFacets(await getStacks(lang), lang);
 
 const cardProps = (e: StackEntry) => ({
+  memberOnly: memberOnlyInIndex(e.data),
   slug: slugOf(e),
   lang,
   name: e.data.name,

package/src/components/ConceptCard.astro

@@ -19,9 +19,11 @@ interface Props {
   /** Private entry: show a lock and the (public) `teaser` instead of the description. */
   isPrivate?: boolean;
   teaser?: string;
+  /** Hidden from logged-out visitors (private without listed). */
+  memberOnly?: boolean;
 }
 
-const { lang, slug, title, description, tags, image, imageAlt, version, updated, isPrivate = false, teaser } = Astro.props;
+const { lang, slug, title, description, tags, image, imageAlt, version, updated, isPrivate = false, teaser, memberOnly = false } = Astro.props;
 const t = useTranslations(lang);
 const shownDesc = isPrivate ? (teaser ?? '') : description;
 ---
@@ -29,6 +31,7 @@ const shownDesc = isPrivate ? (teaser ?? '') : description;
 <a
   href={getRelativeLocaleUrl(lang, `concept/${slug}/`)}
   data-name={title.toLowerCase()}
+  data-aas-member-only={memberOnly ? '' : undefined}
   data-date={updated ? updated.toISOString() : ''}
   class="aas-lift block overflow-hidden rounded-3xl border border-[var(--aas-border)] bg-[var(--aas-panel)] no-underline"
 >

package/src/components/ConceptIndex.astro

@@ -8,7 +8,7 @@ import ArrowUpRight from './ArrowUpRight.astro';
 const PAGE = 12;
 import { conceptTree, conceptCatOf } from '@aas-data/concept-categories';
 import { getConcepts, conceptSlugOf, type ConceptEntry } from '../lib/concepts';
-import { listedInIndex } from '../lib/listing';
+import { memberOnlyInIndex } from '../lib/listing';
 import { useTranslations, type Lang } from '../i18n/ui';
 
 // Doubles as the concept index (no `categoryId` → all concepts, grouped by
@@ -23,11 +23,12 @@ const { lang, categoryId } = Astro.props;
 const t = useTranslations(lang);
 // Default order is most-recently-updated first (matches the ListControls
 // default), so the server render and the client sort agree — no reflow on load.
-const all = (await getConcepts(lang)).filter((e) => listedInIndex(e.data)).sort(
+const all = (await getConcepts(lang)).sort(
   (a, b) =>
     (b.data.updated?.getTime() ?? 0) - (a.data.updated?.getTime() ?? 0) ||
     a.data.title.localeCompare(b.data.title),
 );
+const hasMemberOnly = all.some((e) => memberOnlyInIndex(e.data));
 const catUrl = (cid: string) => getRelativeLocaleUrl(lang, `concept/category/${cid}/`);
 
 const itemsIn = (cid: string): ConceptEntry[] => {
@@ -67,6 +68,7 @@ const card = (c: ConceptEntry) => ({
   updated: c.data.updated,
   isPrivate: c.data.private,
   teaser: c.data.teaser,
+  memberOnly: memberOnlyInIndex(c.data),
 });
 ---
 
@@ -90,6 +92,9 @@ const card = (c: ConceptEntry) => ({
 }
 
 {all.length === 0 && <p class="mt-8 text-[var(--aas-muted)]">{t('concept.empty')}</p>}
+{hasMemberOnly && (
+  <p data-aas-member-hint class="mt-4 text-sm text-[var(--aas-muted)]">{t('private.memberHint')}</p>
+)}
 
 {all.length > 0 && <div class="mt-6"><ListControls lang={lang} /></div>}
 

package/src/components/CourseCard.astro

@@ -25,6 +25,8 @@ interface Props {
   /** Private entry: show a lock and the (public) `teaser` instead of the description. */
   isPrivate?: boolean;
   teaser?: string;
+  /** Hidden from logged-out visitors (private without listed). */
+  memberOnly?: boolean;
 }
 
 const {
@@ -43,6 +45,7 @@ const {
   order,
   isPrivate = false,
   teaser,
+  memberOnly = false,
 } = Astro.props;
 const t = useTranslations(lang);
 const shownDesc = isPrivate ? (teaser ?? '') : description;
@@ -57,6 +60,7 @@ const shownDate = updated ?? date;
 <a
   href={getRelativeLocaleUrl(lang, `course/${slug}/`)}
   data-name={title.toLowerCase()}
+  data-aas-member-only={memberOnly ? '' : undefined}
   data-date={sortKey}
   class="aas-lift block overflow-hidden rounded-3xl border border-[var(--aas-border)] bg-[var(--aas-panel)] no-underline"
 >

package/src/components/CourseIndex.astro

@@ -8,7 +8,7 @@ import ArrowUpRight from './ArrowUpRight.astro';
 const PAGE = 12;
 import { courseTree, courseCatOf } from '@aas-data/course-categories';
 import { getCourses, courseSlugOf, type CourseEntry } from '../lib/courses';
-import { listedInIndex } from '../lib/listing';
+import { memberOnlyInIndex } from '../lib/listing';
 import { useTranslations, type Lang } from '../i18n/ui';
 
 // Doubles as the course index (no `categoryId` → all courses, grouped by
@@ -23,7 +23,8 @@ const { lang, categoryId } = Astro.props;
 const t = useTranslations(lang);
 // getCourses() order (manual `order` desc, then date) agrees with the client
 // "recent" comparator over CourseCard's data-date keys — no reflow on load.
-const all = (await getCourses(lang)).filter((e) => listedInIndex(e.data));
+const all = await getCourses(lang);
+const hasMemberOnly = all.some((e) => memberOnlyInIndex(e.data));
 const catUrl = (cid: string) => getRelativeLocaleUrl(lang, `course/category/${cid}/`);
 
 const itemsIn = (cid: string): CourseEntry[] => {
@@ -67,6 +68,7 @@ const card = (c: CourseEntry) => ({
   order: c.data.order,
   isPrivate: c.data.private,
   teaser: c.data.teaser,
+  memberOnly: memberOnlyInIndex(c.data),
 });
 ---
 
@@ -90,6 +92,9 @@ const card = (c: CourseEntry) => ({
 }
 
 {all.length === 0 && <p class="mt-8 text-[var(--aas-muted)]">{t('course.empty')}</p>}
+{hasMemberOnly && (
+  <p data-aas-member-hint class="mt-4 text-sm text-[var(--aas-muted)]">{t('private.memberHint')}</p>
+)}
 
 {all.length > 0 && <div class="mt-6"><ListControls lang={lang} /></div>}
 

package/src/components/Home.astro

@@ -7,7 +7,7 @@ import { rootCategories, descendantIds } from '@aas-data/categories';
 import { getStacks, slugOf } from '../lib/stacks';
 import { site } from '@aas-data/site';
 import { deriveFacets } from '../lib/facets';
-import { listedInIndex } from '../lib/listing';
+import { memberOnlyInIndex } from '../lib/listing';
 import { useTranslations, type Lang } from '../i18n/ui';
 
 interface Props {
@@ -16,7 +16,7 @@ interface Props {
 
 const { lang } = Astro.props;
 const t = useTranslations(lang);
-const entries = (await getStacks(lang)).filter((e) => listedInIndex(e.data));
+const entries = await getStacks(lang);
 
 // Default order is alphabetical (matches the client's default sort, so no flash).
 // Group by top-level category, rolling up every subcategory in its subtree.
@@ -65,6 +65,7 @@ const facets = deriveFacets(entries, lang);
           <div class="mt-5 grid gap-4 sm:grid-cols-2" data-grid>
             {items.map((e) => (
               <StackCard
+                memberOnly={memberOnlyInIndex(e.data)}
                 slug={slugOf(e)}
                 lang={lang}
                 name={e.data.name}

package/src/components/PaperCard.astro

@@ -21,6 +21,8 @@ interface Props {
   /** Private entry: show a lock and the (public) `teaser` instead of the description. */
   isPrivate?: boolean;
   teaser?: string;
+  /** Hidden from logged-out visitors (private without listed). */
+  memberOnly?: boolean;
 }
 
 const {
@@ -37,6 +39,7 @@ const {
   imageAlt,
   isPrivate = false,
   teaser,
+  memberOnly = false,
 } = Astro.props;
 const t = useTranslations(lang);
 const shownDesc = isPrivate ? (teaser ?? '') : description;
@@ -45,6 +48,7 @@ const shownDesc = isPrivate ? (teaser ?? '') : description;
 <a
   href={getRelativeLocaleUrl(lang, `paper/${slug}/`)}
   data-name={title.toLowerCase()}
+  data-aas-member-only={memberOnly ? '' : undefined}
   data-date={year ? String(year) : ''}
   class="aas-lift block overflow-hidden rounded-3xl border border-[var(--aas-border)] bg-[var(--aas-panel)] no-underline"
 >

package/src/components/PapersIndex.astro

@@ -8,7 +8,7 @@ import ArrowUpRight from './ArrowUpRight.astro';
 const PAGE = 12;
 import { paperTree, paperCatOf } from '@aas-data/paper-categories';
 import { getPapers, paperSlugOf, type PaperEntry } from '../lib/papers';
-import { listedInIndex } from '../lib/listing';
+import { memberOnlyInIndex } from '../lib/listing';
 import { useTranslations, type Lang } from '../i18n/ui';
 
 // Doubles as the papers index (no `categoryId` → all papers, grouped by
@@ -23,7 +23,8 @@ const { lang, categoryId } = Astro.props;
 const t = useTranslations(lang);
 // getPapers() sorts newest publication year first, matching the client-side
 // "recent" comparator over PaperCard's data-date (= year) — no reflow on load.
-const all = (await getPapers(lang)).filter((e) => listedInIndex(e.data));
+const all = await getPapers(lang);
+const hasMemberOnly = all.some((e) => memberOnlyInIndex(e.data));
 const catUrl = (cid: string) => getRelativeLocaleUrl(lang, `paper/category/${cid}/`);
 
 const itemsIn = (cid: string): PaperEntry[] => {
@@ -65,6 +66,7 @@ const card = (c: PaperEntry) => ({
   imageAlt: c.data.imageAlt,
   isPrivate: c.data.private,
   teaser: c.data.teaser,
+  memberOnly: memberOnlyInIndex(c.data),
 });
 ---
 
@@ -88,6 +90,9 @@ const card = (c: PaperEntry) => ({
 }
 
 {all.length === 0 && <p class="mt-8 text-[var(--aas-muted)]">{t('paper.empty')}</p>}
+{hasMemberOnly && (
+  <p data-aas-member-hint class="mt-4 text-sm text-[var(--aas-muted)]">{t('private.memberHint')}</p>
+)}
 
 {all.length > 0 && <div class="mt-6"><ListControls lang={lang} /></div>}
 

package/src/components/ProductsIndex.astro

@@ -7,7 +7,7 @@
 import { getRelativeLocaleUrl } from 'astro:i18n';
 import { productTree, productCatOf } from '@aas-data/product-categories';
 import { getTopProducts, productSlugOf, type ProductEntry } from '../lib/products';
-import { listedInIndex } from '../lib/listing';
+import { memberOnlyInIndex } from '../lib/listing';
 import { useTranslations, type Lang } from '../i18n/ui';
 
 interface Props {
@@ -16,7 +16,8 @@ interface Props {
 
 const { lang } = Astro.props;
 const t = useTranslations(lang);
-const all = (await getTopProducts(lang)).filter((e) => listedInIndex(e.data));
+const all = await getTopProducts(lang);
+const hasMemberOnly = all.some((e) => memberOnlyInIndex(e.data));
 const base = import.meta.env.BASE_URL.replace(/\/$/, '');
 const withBase = (p?: string) => (p && p.startsWith('/') ? base + p : p);
 
@@ -36,6 +37,9 @@ const sections = productTree.roots
 </section>
 
 {all.length === 0 && <p class="mt-8 text-[var(--aas-muted)]">{t('products.empty')}</p>}
+{hasMemberOnly && (
+  <p data-aas-member-hint class="mt-4 text-sm text-[var(--aas-muted)]">{t('private.memberHint')}</p>
+)}
 
 {
   sections.map(({ cat, items }) => (
@@ -46,6 +50,7 @@ const sections = productTree.roots
         {items.map((a: ProductEntry) => (
           <a
             href={getRelativeLocaleUrl(lang, `products/${productSlugOf(a)}/`)}
+            data-aas-member-only={memberOnlyInIndex(a.data) ? '' : undefined}
             class="aas-lift flex items-center gap-6 rounded-3xl border border-[var(--aas-border)] bg-[var(--aas-panel)] p-6 no-underline"
           >
             {a.data.icon && (

package/src/components/SlidesIndex.astro

@@ -1,6 +1,6 @@
 ---
 import { getRelativeLocaleUrl } from 'astro:i18n';
-import { listedInIndex } from '../lib/listing';
+import { memberOnlyInIndex } from '../lib/listing';
 import { useTranslations, type Lang } from '../i18n/ui';
 import { getDecks, deckSlugOf } from '../lib/slides';
 
@@ -13,18 +13,25 @@ const t = useTranslations(lang);
 
 // Decks are locale-partitioned (content/slides/<lang>/); list this locale's and
 // link to its localized deck page. `related` points at the concept it summarizes.
-const decks = (await getDecks(lang)).filter((e) => listedInIndex(e.data));
+const decks = await getDecks(lang);
+const hasMemberOnly = decks.some((e) => memberOnlyInIndex(e.data));
 ---
 
 <section class="py-6">
   <h1 class="text-4xl font-bold tracking-tight">{t('slides.title')}</h1>
   <p class="mt-3 max-w-2xl text-lg text-[var(--aas-muted)]">{t('slides.tagline')}</p>
 </section>
+{hasMemberOnly && (
+  <p data-aas-member-hint class="mt-4 text-sm text-[var(--aas-muted)]">{t('private.memberHint')}</p>
+)}
 
 <div class="mt-6 grid gap-5 sm:grid-cols-2">
   {
     decks.map((deck) => (
-      <div class="overflow-hidden rounded-3xl border border-[var(--aas-border)] bg-[var(--aas-panel)]">
+      <div
+        class="overflow-hidden rounded-3xl border border-[var(--aas-border)] bg-[var(--aas-panel)]"
+        data-aas-member-only={memberOnlyInIndex(deck.data) ? '' : undefined}
+      >
         <a
           href={getRelativeLocaleUrl(lang, `slides/${deckSlugOf(deck)}/`)}
           class="aas-lift block p-5 no-underline"

package/src/components/StackCard.astro

@@ -29,9 +29,11 @@ interface Props {
   /** Private entry: show a lock and the (public) `teaser` instead of the description. */
   isPrivate?: boolean;
   teaser?: string;
+  /** Hidden from logged-out visitors (private without listed). */
+  memberOnly?: boolean;
 }
 
-const { slug, lang, name, formerNames = [], vendor, description, tags, pricing, license, language, category, logo, logoDark, repo, version, deprecated, isPrivate = false, teaser } =
+const { slug, lang, name, formerNames = [], vendor, description, tags, pricing, license, language, category, logo, logoDark, repo, version, deprecated, isPrivate = false, teaser, memberOnly = false } =
   Astro.props;
 const t = useTranslations(lang);
 const href = getRelativeLocaleUrl(lang, `stack/${slug}/`);
@@ -70,6 +72,7 @@ const searchText = `${name} ${shownDesc} ${tags.join(' ')}`.toLowerCase();
 <div
   class="aas-lift relative isolate flex flex-col gap-3 overflow-hidden rounded-3xl border border-[var(--aas-border)] bg-[var(--aas-panel)] p-5 min-[1000px]:flex-row"
   data-tool
+  data-aas-member-only={memberOnly ? '' : undefined}
   data-name={name}
   data-search={searchText}
   data-pricing={pricingTags(pricing).join('|')}

package/src/components/TagIndex.astro

@@ -2,7 +2,7 @@
 import { getRelativeLocaleUrl } from 'astro:i18n';
 import StackCard from './StackCard.astro';
 import { getStacksByTag, slugOf } from '../lib/stacks';
-import { listedInIndex } from '../lib/listing';
+import { memberOnlyInIndex } from '../lib/listing';
 import { useTranslations, type Lang } from '../i18n/ui';
 
 interface Props {
@@ -12,7 +12,7 @@ interface Props {
 
 const { lang, tag } = Astro.props;
 const t = useTranslations(lang);
-const entries = (await getStacksByTag(lang, tag)).filter((e) => listedInIndex(e.data)).sort((a, b) =>
+const entries = (await getStacksByTag(lang, tag)).sort((a, b) =>
   a.data.name.localeCompare(b.data.name),
 );
 ---
@@ -30,6 +30,7 @@ const entries = (await getStacksByTag(lang, tag)).filter((e) => listedInIndex(e.
   {
     entries.map((e) => (
       <StackCard
+        memberOnly={memberOnlyInIndex(e.data)}
         slug={slugOf(e)}
         lang={lang}
         name={e.data.name}

package/src/components/VendorIndex.astro

@@ -2,7 +2,7 @@
 import { getRelativeLocaleUrl } from 'astro:i18n';
 import StackCard from './StackCard.astro';
 import { getStacksByVendor, slugOf } from '../lib/stacks';
-import { listedInIndex } from '../lib/listing';
+import { memberOnlyInIndex } from '../lib/listing';
 import { useTranslations, type Lang } from '../i18n/ui';
 
 interface Props {
@@ -12,7 +12,7 @@ interface Props {
 
 const { lang, vendor } = Astro.props;
 const t = useTranslations(lang);
-const entries = (await getStacksByVendor(lang, vendor)).filter((e) => listedInIndex(e.data));
+const entries = await getStacksByVendor(lang, vendor);
 // The display name is whatever the entries wrote (e.g. "Hugging Face").
 const vendorName = entries[0]?.data.vendor ?? vendor;
 ---
@@ -30,6 +30,7 @@ const vendorName = entries[0]?.data.vendor ?? vendor;
   {
     entries.map((e) => (
       <StackCard
+        memberOnly={memberOnlyInIndex(e.data)}
         slug={slugOf(e)}
         lang={lang}
         name={e.data.name}

package/src/i18n/ui.ts

@@ -71,6 +71,8 @@ export const ui = {
     'code.copy': 'Copy code',
     'code.copied': 'Copied',
     'private.badge': 'Private',
+    'private.login': 'Log in',
+    'private.memberHint': '\ud83d\udd12 Some content appears after logging in.',
     'private.locked': 'This content is private. Log in to view it.',
     'private.id': 'ID',
     'private.password': 'Password',
@@ -247,6 +249,8 @@ export const ui = {
     'code.copy': '코드 복사',
     'code.copied': '복사됨',
     'private.badge': '비공개',
+    'private.login': '로그인',
+    'private.memberHint': '\ud83d\udd12 일부 콘텐츠는 로그인 후에 표시됩니다.',
     'private.locked': '비공개 콘텐츠입니다. 로그인 후 볼 수 있습니다.',
     'private.id': '아이디',
     'private.password': '비밀번호',

package/src/layouts/BaseLayout.astro

@@ -219,6 +219,15 @@ const navItems = allNavItems.filter((item) => !item.section || sectionEnabled(it
         } catch (e) {}
       })();
     </script>
+    {/* Stamp html[data-aas-member] before paint when a login session exists,
+        so member-only listing cards render without a flash (CSS keys off it). */}
+    <script is:inline>
+      (function () {
+        try {
+          if (localStorage.getItem('aas:pk')) document.documentElement.dataset.aasMember = '1';
+        } catch (e) {}
+      })();
+    </script>
     {/* Listing density (standard / gallery), persisted in localStorage. Gallery
         is the default; only an explicit 'grid' choice falls back to standard.
         Set before paint so the layout doesn't flash. */}
@@ -263,6 +272,53 @@ const navItems = allNavItems.filter((item) => !item.section || sectionEnabled(it
               ))
             }
           </div>
+          {/* Member login/logout for private content — hidden until
+              /aas-auth.json reports the site has login users configured. */}
+          <details class="aas-menu relative" data-auth hidden>
+            <summary
+              class="flex cursor-pointer list-none items-center rounded-lg border border-[var(--aas-border)] px-2.5 py-1 text-[var(--aas-text)] select-none"
+              aria-label={t('private.login')}
+              title={t('private.login')}
+            >
+              <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M19 21v-2a4 4 0 0 0-4-4H9a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>
+            </summary>
+            <div
+              class="absolute right-0 z-20 mt-1 w-64 rounded-lg border border-[var(--aas-border)] bg-[var(--aas-panel)] p-3 shadow-lg"
+            >
+              <form data-auth-form class="flex flex-col gap-2">
+                <input
+                  name="id"
+                  required
+                  autocomplete="username"
+                  placeholder={t('private.id')}
+                  class="rounded-lg border border-[var(--aas-border)] bg-[var(--aas-bg)] px-3 py-1.5 text-sm text-[var(--aas-text)]"
+                />
+                <input
+                  name="password"
+                  type="password"
+                  required
+                  autocomplete="current-password"
+                  placeholder={t('private.password')}
+                  class="rounded-lg border border-[var(--aas-border)] bg-[var(--aas-bg)] px-3 py-1.5 text-sm text-[var(--aas-text)]"
+                />
+                <p data-auth-error hidden class="text-xs text-[var(--aas-accent)]">{t('private.error')}</p>
+                <button
+                  type="submit"
+                  class="rounded-lg bg-[var(--aas-accent)] px-3 py-1.5 text-sm font-semibold text-white"
+                >
+                  {t('private.submit')}
+                </button>
+              </form>
+              <button
+                type="button"
+                data-auth-logout
+                hidden
+                class="w-full rounded-lg border border-[var(--aas-border)] px-3 py-1.5 text-sm text-[var(--aas-text)] hover:bg-[var(--aas-tint)]"
+              >
+                🔓 {t('private.logout')}
+              </button>
+            </div>
+          </details>
           <ThemeToggle lang={lang} />
           <LanguageSwitcher lang={lang} path={path} />
           <details class="aas-menu relative sm:hidden">
@@ -328,6 +384,55 @@ const navItems = allNavItems.filter((item) => !item.section || sectionEnabled(it
     <BackToTop lang={lang} />
 
     <script>
+      import {
+        hasSession,
+        clearSession,
+        loginWithCredentials,
+        type AuthData,
+      } from '../lib/private-client';
+
+      // Header member login/logout: reveal the control only when the site has
+      // login users configured (/aas-auth.json — { enabled: false } otherwise).
+      const authCtrl = document.querySelector<HTMLDetailsElement>('[data-auth]');
+      if (authCtrl) {
+        (async () => {
+          try {
+            const base = import.meta.env.BASE_URL.replace(/\/$/, '');
+            const res = await fetch(`${base}/aas-auth.json`);
+            const data = (await res.json()) as { enabled: boolean } & AuthData;
+            if (!data.enabled) return;
+            authCtrl.hidden = false;
+            const form = authCtrl.querySelector<HTMLFormElement>('[data-auth-form]')!;
+            const logoutBtn = authCtrl.querySelector<HTMLButtonElement>('[data-auth-logout]')!;
+            const errorEl = authCtrl.querySelector<HTMLElement>('[data-auth-error]')!;
+            const sync = () => {
+              const on = hasSession(data.days);
+              form.hidden = on;
+              logoutBtn.hidden = !on;
+            };
+            sync();
+            logoutBtn.addEventListener('click', () => {
+              clearSession();
+              location.reload();
+            });
+            form.addEventListener('submit', async (e) => {
+              e.preventDefault();
+              errorEl.hidden = true;
+              const fd = new FormData(form);
+              const ok = await loginWithCredentials(
+                data,
+                String(fd.get('id') ?? ''),
+                String(fd.get('password') ?? ''),
+              );
+              if (ok) location.reload();
+              else errorEl.hidden = false;
+            });
+          } catch {
+            /* endpoint unavailable — control stays hidden */
+          }
+        })();
+      }
+
       import { initOnReady } from '../lib/reinit';
 
       // Clicking a heading's "#" anchor copies that section's URL to the

package/src/lib/listing.ts

@@ -1,9 +1,14 @@
 /**
- * Whether an entry belongs on index listings. Public entries always do;
- * PRIVATE entries only when they opt in with `listed: true` (shown as a
- * locked teaser card). Unlisted private entries still build and stay
- * reachable via direct links and the related-entry sections on detail pages —
- * that's the discovery path for gated content.
+ * Listing visibility for private entries. A private entry without
+ * `listed: true` is "member-only": it still renders in index listings but
+ * carries `data-aas-member-only`, and CSS hides it unless the pre-paint
+ * script stamped `html[data-aas-member]` (a login session exists). So
+ * logged-out visitors don't see it, members do — with no flash either way.
+ * `listed: true` shows the locked teaser card to everyone.
  */
+export const memberOnlyInIndex = (d: { private?: boolean; listed?: boolean }): boolean =>
+  d.private === true && d.listed !== true;
+
+/** Kept for compatibility: whether an entry is visible to logged-out visitors. */
 export const listedInIndex = (d: { private?: boolean; listed?: boolean }): boolean =>
   !d.private || d.listed === true;

package/src/lib/private-client.ts

@@ -60,7 +60,7 @@ function storedKey(days: number): Uint8Array | null {
   }
 }
 
-function clearSession(): void {
+export function clearSession(): void {
   try {
     localStorage.removeItem(STORE);
   } catch {
@@ -68,6 +68,50 @@ function clearSession(): void {
   }
 }
 
+/** The user table a login form needs — a GateData without the content. */
+export interface AuthData {
+  users: { h: string; s: string; iv: string; w: string }[];
+  salt: string;
+  days: number;
+}
+
+/** Whether this device holds a live session key. */
+export function hasSession(days: number): boolean {
+  return storedKey(days) !== null;
+}
+
+/**
+ * Verify credentials by unwrapping the site key (AES-GCM authentication
+ * fails on a wrong password) and store the session on success. Shared by
+ * the per-page gate form and the header login control.
+ */
+export async function loginWithCredentials(
+  data: AuthData,
+  id: string,
+  password: string,
+): Promise<boolean> {
+  const salt = dec(data.salt);
+  const idBytes = new TextEncoder().encode(id.trim().toLowerCase());
+  const joined = new Uint8Array(salt.length + idBytes.length);
+  joined.set(salt);
+  joined.set(idBytes, salt.length);
+  const h = await sha256Hex(joined);
+  const user = data.users.find((u) => u.h === h);
+  if (!user) return false;
+  try {
+    const kek = await deriveKek(password, dec(user.s));
+    const k = new Uint8Array(await aesDecrypt(kek, dec(user.iv), dec(user.w)));
+    try {
+      localStorage.setItem(STORE, JSON.stringify({ k: enc(k), t: Date.now() }));
+    } catch {
+      /* private browsing — session just won't persist */
+    }
+    return true;
+  } catch {
+    return false; // wrong password (unwrap failed)
+  }
+}
+
 /** Swap the gate for the decrypted HTML; re-run inline scripts; notify re-init hooks. */
 function inject(gate: HTMLElement, html: string, logoutLabel: string): void {
   const host = document.createElement('div');

package/src/pages/aas-auth.json.ts

@@ -0,0 +1,22 @@
+import type { APIRoute } from 'astro';
+import { privateClientData } from '../lib/private';
+
+/**
+ * The site's login user table (salted id hashes + per-user wrapped keys —
+ * the same data every private page already embeds in its gate payload, so
+ * this exposes nothing new). Powers the header login control on sites with
+ * private content; sites without the AAS_PRIVATE_* env render
+ * `{ enabled: false }` and the control stays hidden.
+ */
+export const GET: APIRoute = () => {
+  try {
+    const data = privateClientData();
+    return new Response(JSON.stringify({ enabled: true, ...data }), {
+      headers: { 'Content-Type': 'application/json' },
+    });
+  } catch {
+    return new Response(JSON.stringify({ enabled: false }), {
+      headers: { 'Content-Type': 'application/json' },
+    });
+  }
+};

package/src/styles/global.css

@@ -2392,3 +2392,13 @@ summary {
 .aas-slide :where(table) :where(th, td):first-child {
   white-space: nowrap;
 }
+
+/* Member-only listing cards (private without `listed: true`): rendered for
+   everyone, hidden unless the pre-paint script stamped html[data-aas-member]
+   (a login session exists). The hint line inverts: visible only logged-out. */
+html:not([data-aas-member]) [data-aas-member-only] {
+  display: none;
+}
+html[data-aas-member] [data-aas-member-hint] {
+  display: none;
+}