blume 1.3.0 → 1.4.0

package/src/cli/commands/build.ts

@@ -14,6 +14,12 @@ import {
 } from "../../ai/api-catalog.ts";
 import { buildHomeLinkHeader } from "../../ai/link-headers.ts";
 import { buildLlmsFiles } from "../../ai/llms.ts";
+import {
+  agentMarkdown,
+  buildRawMarkdown,
+  markdownRoutePaths,
+  markdownTokenCount,
+} from "../../ai/markdown.ts";
 import {
   AGENT_SKILLS_DIR,
   buildSkillsIndex,
@@ -32,14 +38,20 @@ import type { ProjectContext } from "../../core/types.ts";
 import {
   ADAPTER_IGNORE_DIRS,
   deployStaticDir,
+  readsHeaderFiles,
+  servesClientSubdir,
   surfaceAdapterOutput,
 } from "../../deploy/adapter-output.ts";
+import {
+  injectWorkerNegotiation,
+  NEGOTIATION_WORKER_FILE,
+} from "../../deploy/cloudflare-negotiation.ts";
 import { buildNetlifyHeaders } from "../../deploy/headers.ts";
 import {
-  applyBaseToPlatformRedirects,
   buildNetlifyRedirects,
   buildRedirectManifest,
   buildVercelConfig,
+  platformRedirects,
 } from "../../deploy/redirects.ts";
 import { buildRobots } from "../../deploy/robots.ts";
 import { buildSitemap } from "../../deploy/sitemap.ts";
@@ -93,11 +105,7 @@ const emitRedirectFiles = async (
   config: ResolvedConfig,
   distDir: string
 ): Promise<void> => {
-  const redirects = applyBaseToPlatformRedirects(
-    config.redirects,
-    config.basePath,
-    config.deployment.base ?? ""
-  );
+  const redirects = platformRedirects(config);
   if (redirects.length === 0 || config.deployment.output !== "static") {
     return;
   }
@@ -121,36 +129,61 @@ const emitRedirectFiles = async (
 };
 
 /**
- * Emit a `_headers` file for a static build so Netlify / Cloudflare static
- * hosts serve the raw AI-ready endpoints (`*.md`, `*.mdx`, `*.txt`) with an
- * explicit `charset=utf-8`. Without it those hosts send `text/markdown` /
- * `text/plain` with no charset and browsers fall back to Windows-1252, garbling
- * any non-ASCII docs (#82). The same file also stamps the homepage
- * agent-discovery `Link` header (RFC 8288, see `ai/link-headers.ts`). A
- * `_headers` shipped in `public/` (copied into dist by Astro before this runs)
- * wins, exactly like `_redirects`. Server adapters set the Content-Type on the
- * Response directly, so this is static-only.
+ * Emit a `_headers` file so Netlify / Cloudflare serve the raw AI-ready
+ * endpoints (`*.md`, `*.mdx`, `*.txt`) with an explicit `charset=utf-8`. Without
+ * it those hosts send `text/markdown` / `text/plain` with no charset and
+ * browsers fall back to Windows-1252, garbling any non-ASCII docs (#82).
+ *
+ * The same file carries the rest of the agent-discovery surface that only a
+ * response header can express: the homepage `Link` header (RFC 8288, see
+ * `ai/link-headers.ts`), and the registered media types for the extensionless
+ * well-known files — `application/linkset+json` for the API catalog, the
+ * signatures directory, and the Agent Skills archives. A static host serves
+ * those as `octet-stream` or nothing at all without a rule.
+ *
+ * A `_headers` shipped in `public/` wins, exactly like `_redirects` — the opt-out
+ * is checked at its source rather than in `dist`, because on Cloudflare the file
+ * in `dist` is not necessarily the user's: `@astrojs/cloudflare` writes its own
+ * `_headers` (an immutable `Cache-Control` rule for `/_astro/*`) during the
+ * build, before this runs. Testing `dist` therefore read an adapter-generated
+ * file as a user opt-out and skipped silently. When both exist, the adapter's
+ * rules are preserved and ours are appended.
+ *
+ * Gated on {@link readsHeaderFiles}, not on `output === "static"`. A **Cloudflare
+ * server** build serves `dist/client` through the Worker's ASSETS binding, and
+ * Workers static assets honor `_headers` from that directory — so the file
+ * applies there too, and skipping it left every Cloudflare server build with no
+ * `Link` header and no media type on its own discovery files. The charset half
+ * of this file *is* redundant on a server build, because the runtime endpoint
+ * sets Content-Type on the Response itself; the `Link` and well-known halves are
+ * not, and one conclusion about the first was applied to all three.
+ *
+ * Exported for the test suite, which exercises it in a subprocess like the
+ * other command helpers.
  */
-const emitHeaderFiles = async (
+export const emitHeaderFiles = async (
   project: BlumeProject,
   distDir: string
 ): Promise<void> => {
   const { config } = project;
   if (
-    config.deployment.output !== "static" ||
-    existsSync(join(distDir, "_headers"))
+    !readsHeaderFiles(config.deployment) ||
+    existsSync(join(project.context.root, "public", "_headers"))
   ) {
     return;
   }
+  const ours = buildNetlifyHeaders(
+    config,
+    buildHomeLinkHeader(config, markdownRoutePaths(project))
+  );
+  // An adapter may have written its own rules here already (Cloudflare adds an
+  // immutable Cache-Control for /_astro/*). Keep them and append ours: both
+  // sets are wanted, and `_headers` has no merge semantics beyond order.
+  const target = join(distDir, "_headers");
+  const existing = existsSync(target) ? await readFile(target, "utf-8") : "";
   await writeFile(
-    join(distDir, "_headers"),
-    buildNetlifyHeaders(
-      config,
-      buildHomeLinkHeader(
-        config,
-        project.manifest.routes.map((route) => route.path)
-      )
-    ),
+    target,
+    existing ? `${existing.trimEnd()}\n${ours}` : ours,
     "utf-8"
   );
   logger.success(
@@ -253,10 +286,11 @@ const emitWellKnownFiles = async (
  * straight to the project root (see `withAdapterRoot`).
  */
 const emitVercelNegotiation = async (
-  config: ResolvedConfig,
+  project: BlumeProject,
   routePaths: string[],
   root: string
 ): Promise<void> => {
+  const { config } = project;
   const configPath = join(root, ".vercel", "output", "config.json");
   if (!existsSync(configPath)) {
     return;
@@ -269,11 +303,17 @@ const emitVercelNegotiation = async (
       ? { [SIGNATURES_DIRECTORY_PATH.slice(1)]: SIGNATURES_DIRECTORY_TYPE }
       : {}),
   };
+  // The homepage rewrite serves `/index.md` from the static layer, so its
+  // `x-markdown-tokens` estimate has to ride the routing config; the runtime
+  // endpoint stamps it on dev/server-rendered responses itself.
+  const rawMarkdown = await buildRawMarkdown(project);
+  const home = rawMarkdown["/"];
   const injected = injectNegotiationRoutes(
     await readFile(configPath, "utf-8"),
     routePaths,
     buildHomeLinkHeader(config, routePaths),
-    overrides
+    overrides,
+    home ? markdownTokenCount(agentMarkdown(home)) : undefined
   );
   if (injected === null) {
     logger.warn(
@@ -287,6 +327,72 @@ const emitVercelNegotiation = async (
   );
 };
 
+const warnCloudflareNegotiationSkipped = (): void =>
+  logger.warn(
+    "Could not wire Accept: text/markdown negotiation into dist/server/wrangler.json — raw Markdown stays available at the .md URLs."
+  );
+
+/**
+ * Wire `Accept: text/markdown` negotiation into a Cloudflare server build. The
+ * ASSETS binding serves the prerendered content pages before the Worker runs —
+ * and even a request that reaches the Worker is answered by the adapter's
+ * handler from that binding, ahead of the only place middleware runs — so the
+ * negotiation lives in a generated wrapper Worker, routed to by
+ * `assets.run_worker_first` (see `deploy/cloudflare-negotiation.ts`). Both
+ * pieces are spliced into the adapter's emitted `dist/server` bundle.
+ */
+const emitCloudflareNegotiation = async (
+  project: BlumeProject,
+  routePaths: string[]
+): Promise<void> => {
+  const { config, context } = project;
+  const serverDir = join(
+    context.distDir ?? join(context.root, "dist"),
+    "server"
+  );
+  const wranglerPath = join(serverDir, "wrangler.json");
+  if (!existsSync(wranglerPath)) {
+    warnCloudflareNegotiationSkipped();
+    return;
+  }
+  // The homepage mirror is served from the static layer, so its
+  // `x-markdown-tokens` estimate rides the wrapper Worker, mirroring the
+  // Vercel routing config.
+  const rawMarkdown = await buildRawMarkdown(project);
+  const home = rawMarkdown["/"];
+  const injected = injectWorkerNegotiation(
+    await readFile(wranglerPath, "utf-8"),
+    {
+      base: config.deployment.base,
+      // The manifest routes guard the wrapper's redirect table; `routePaths`
+      // also carries the synthesized homepage mirror, which must not block a
+      // configured root redirect.
+      contentRoutePaths: project.manifest.routes.map((route) => route.path),
+      homeLinkHeader: buildHomeLinkHeader(config, routePaths),
+      homeTokens: home ? markdownTokenCount(agentMarkdown(home)) : undefined,
+      // The wrapper Worker matches full served URLs, so the redirects are
+      // based the same way the platform files are — it answers any the
+      // worker-first rules claim, where `_redirects` is never consulted and
+      // Astro would default their status.
+      redirects: platformRedirects(config),
+      routePaths,
+    }
+  );
+  if (injected === null) {
+    warnCloudflareNegotiationSkipped();
+    return;
+  }
+  await writeFile(
+    join(serverDir, NEGOTIATION_WORKER_FILE),
+    injected.worker,
+    "utf-8"
+  );
+  await writeFile(wranglerPath, injected.wrangler, "utf-8");
+  logger.success(
+    "Wired Accept: text/markdown negotiation into the Cloudflare Worker"
+  );
+};
+
 const formatBytes = (bytes: number): string => {
   if (bytes < 1024) {
     return `${bytes} B`;
@@ -425,6 +531,8 @@ export const isolatedOutputDir = (
  * bundle to the project root — a Vercel server build's static output stays at
  * `<runtime>/.vercel/output/static`, where `deployStaticDir` would instead
  * point at the project-root copy (a previous real build's assets, or nothing).
+ * Node and Cloudflare server builds serve one level down, at `client/` — see
+ * {@link servesClientSubdir}.
  */
 export const isolatedStaticDir = (
   config: ResolvedConfig,
@@ -435,7 +543,7 @@ export const isolatedStaticDir = (
   if (output === "server" && adapter === "vercel") {
     return join(outputDir, "static");
   }
-  if (output === "server" && adapter === "node") {
+  if (servesClientSubdir(config.deployment)) {
     return join(outputDir, "client");
   }
   return outputDir;
@@ -709,11 +817,14 @@ export const buildCommand = defineCommand({
     }
 
     if (project.config.deployment.output === "server" && adapter === "vercel") {
-      await emitVercelNegotiation(
-        project.config,
-        project.manifest.routes.map((route) => route.path),
-        root
-      );
+      await emitVercelNegotiation(project, markdownRoutePaths(project), root);
+    }
+
+    if (
+      project.config.deployment.output === "server" &&
+      adapter === "cloudflare"
+    ) {
+      await emitCloudflareNegotiation(project, markdownRoutePaths(project));
     }
 
     await publishBuildArtifacts(

package/src/cli/commands/translate.ts

@@ -0,0 +1,300 @@
+import { defineCommand } from "citty";
+
+import { AGENTS } from "../../audit/agent.ts";
+import type { AgentKind } from "../../audit/agent.ts";
+import { BlumeError } from "../../core/diagnostics.ts";
+import { i18nEnabled, localeCodes } from "../../core/i18n.ts";
+import { scanProject } from "../../core/project-graph.ts";
+import type { ResolvedI18nConfig } from "../../core/schema.ts";
+import { DEFAULT_TRANSLATE_TIMEOUT_MS } from "../../translate/agents.ts";
+import {
+  pruneLedger,
+  readLedger,
+  stampLedger,
+  writeLedger,
+} from "../../translate/ledger.ts";
+import {
+  checkLines,
+  checkReportJson,
+  checkSummaryLine,
+  createProgressRenderer,
+  diagnosticLines,
+  hasDrift,
+  translateHeaderLine,
+  translateReportJson,
+  translateSummaryLine,
+} from "../../translate/report.ts";
+import { runTranslate } from "../../translate/run.ts";
+import { computeWorkList } from "../../translate/work-list.ts";
+import { reportInternalError } from "../internal-error.ts";
+import { flushStdout, logger } from "../log.ts";
+
+/** Wall-clock ceiling per file, in seconds. */
+const DEFAULT_TIMEOUT_S = DEFAULT_TRANSLATE_TIMEOUT_MS / 1000;
+
+/** Parallel agent sessions per run; each one is a full agent process. */
+const DEFAULT_CONCURRENCY = 4;
+const MAX_CONCURRENCY = 16;
+
+interface TranslateFlags {
+  check?: boolean;
+  claude?: boolean;
+  codex?: boolean;
+  concurrency?: string;
+  force?: boolean;
+  json?: boolean;
+  locale?: string;
+  timeout?: string;
+}
+
+/** Validate the flag surface, exiting with a message on the first offense. */
+const parseFlags = (
+  args: TranslateFlags
+): { agent: AgentKind | undefined; concurrency: number; timeoutS: number } => {
+  const agents = (Object.keys(AGENTS) as AgentKind[]).filter(
+    (kind) => args[kind]
+  );
+  if (agents.length > 1) {
+    logger.error("Pass exactly one of --claude or --codex.");
+    process.exit(1);
+  }
+  if (args.check && agents.length > 0) {
+    logger.error(
+      "--check is read-only and never runs an agent; drop --claude/--codex."
+    );
+    process.exit(1);
+  }
+  if (!args.check && agents.length === 0) {
+    logger.error(
+      "Pass --claude or --codex to choose the agent CLI that translates."
+    );
+    process.exit(1);
+  }
+  const timeoutS =
+    args.timeout === undefined ? DEFAULT_TIMEOUT_S : Number(args.timeout);
+  if (!Number.isInteger(timeoutS) || timeoutS <= 0) {
+    logger.error(`Invalid --timeout "${args.timeout}" (whole seconds).`);
+    process.exit(1);
+  }
+  const concurrency =
+    args.concurrency === undefined
+      ? DEFAULT_CONCURRENCY
+      : Number(args.concurrency);
+  if (
+    !Number.isInteger(concurrency) ||
+    concurrency < 1 ||
+    concurrency > MAX_CONCURRENCY
+  ) {
+    logger.error(
+      `Invalid --concurrency "${args.concurrency}" (use 1..${MAX_CONCURRENCY}).`
+    );
+    process.exit(1);
+  }
+  return { agent: agents[0], concurrency, timeoutS };
+};
+
+/**
+ * Resolve `--locale` against the configured locales: comma-separated,
+ * case-insensitive, adopting the configured casing. Unknown codes and the
+ * default locale (the translation source) are errors.
+ */
+const parseLocales = (
+  value: string | undefined,
+  i18n: ResolvedI18nConfig
+): string[] | undefined => {
+  if (value === undefined) {
+    return;
+  }
+  const configured = new Map(
+    i18n.locales.map((locale) => [locale.code.toLowerCase(), locale.code])
+  );
+  const resolved: string[] = [];
+  for (const part of value.split(",")) {
+    const code = configured.get(part.trim().toLowerCase());
+    if (code === undefined) {
+      logger.error(
+        `Unknown --locale "${part.trim()}" (configured: ${localeCodes(i18n).join(", ")}).`
+      );
+      process.exit(1);
+    }
+    if (code === i18n.defaultLocale) {
+      logger.error(
+        `--locale "${code}" is the default locale — it is the translation source, not a target.`
+      );
+      process.exit(1);
+    }
+    resolved.push(code);
+  }
+  return resolved;
+};
+
+const notInstalled = (agent: AgentKind): never => {
+  const cli = AGENTS[agent];
+  logger.error(
+    `${cli.name} (\`${cli.bin}\`) was not found on PATH. Install it with \`${cli.install}\`.`
+  );
+  return process.exit(1);
+};
+
+export const translateCommand = defineCommand({
+  args: {
+    check: {
+      description:
+        "Report missing/stale translations without writing anything; exits 1 on drift (for CI).",
+      type: "boolean",
+    },
+    claude: {
+      description: "Translate with Claude Code.",
+      type: "boolean",
+    },
+    codex: {
+      description: "Translate with Codex.",
+      type: "boolean",
+    },
+    concurrency: {
+      description: `Parallel agent sessions. Defaults to ${DEFAULT_CONCURRENCY}, max ${MAX_CONCURRENCY}.`,
+      type: "string",
+    },
+    force: {
+      description:
+        "Retranslate everything, up-to-date and hand-authored files included.",
+      type: "boolean",
+    },
+    json: {
+      description: "Emit the report as JSON on stdout (for CI/editors).",
+      type: "boolean",
+    },
+    locale: {
+      description:
+        "Comma-separated target locale codes; defaults to every non-default locale.",
+      type: "string",
+    },
+    timeout: {
+      description: `Agent time limit per file, in seconds. Defaults to ${DEFAULT_TIMEOUT_S}.`,
+      type: "string",
+    },
+  },
+  meta: {
+    description:
+      "Translate docs into the configured locales with a local agent CLI.",
+    name: "translate",
+  },
+  async run({ args }) {
+    const root = process.cwd();
+    const { agent, concurrency, timeoutS } = parseFlags(args);
+
+    try {
+      // `scanProject`, not `prepareProject`: translation reads the content
+      // tree and writes source files, never `.blume/`, so it doesn't contend
+      // with a running dev server. Same reasoning as `blume audit`/`eval`.
+      const project = await scanProject(root, { mode: "build" });
+      if (!i18nEnabled(project.config)) {
+        logger.error(
+          "i18n is not configured — add `i18n.locales` to blume.config to use `blume translate`."
+        );
+        process.exit(1);
+      }
+      const { i18n } = project.config;
+      if (localeCodes(i18n).every((code) => code === i18n.defaultLocale)) {
+        logger.error(
+          "i18n.locales has no locale besides the default — nothing to translate into."
+        );
+        process.exit(1);
+      }
+      const locales = parseLocales(args.locale, i18n);
+      const ledger = await readLedger(root);
+      const workList = await computeWorkList(project, ledger, {
+        force: !args.check && Boolean(args.force),
+        locales,
+      });
+
+      if (args.check) {
+        const lines = [
+          ...diagnosticLines(workList.diagnostics),
+          ...checkLines(workList),
+          "",
+          `  ${checkSummaryLine(workList)}`,
+          "",
+        ];
+        process.stderr.write(`${lines.join("\n")}\n`);
+        if (args.json) {
+          process.stdout.write(checkReportJson(workList));
+        }
+        if (hasDrift(workList)) {
+          await flushStdout();
+          process.exit(1);
+        }
+        return;
+      }
+
+      const kind = agent as AgentKind;
+      process.stderr.write(
+        `${translateHeaderLine(workList.items.length, workList.targetLocales.length, kind)}\n\n`
+      );
+
+      // Adopt pre-existing hand-authored translations (stamp, never rewrite)
+      // and persist BEFORE the agents run, so adoption survives an interrupt.
+      for (const entry of workList.untracked) {
+        stampLedger(ledger, entry.sourceRel, entry.locale, entry.hash);
+      }
+      await writeLedger(root, ledger);
+
+      const renderer = createProgressRenderer({
+        isTTY: process.stderr.isTTY === true,
+        write: (chunk) => process.stderr.write(chunk),
+      });
+      const result = await runTranslate({
+        agent: kind,
+        concurrency,
+        ledger,
+        onProgress: (event) => renderer.onProgress(event),
+        // Flush after every finished item, so stopping a long run mid-way
+        // keeps everything already translated out of the next work list.
+        persistLedger: () => writeLedger(root, ledger),
+        project,
+        timeoutMs: timeoutS * 1000,
+        workList,
+      });
+      renderer.stop();
+
+      // Prune entries whose source or locale no longer exists. Pruning spans
+      // ALL non-default locales — a `--locale fr` run must not drop the other
+      // locales' stamps.
+      const knownLocales = new Set(
+        localeCodes(i18n).filter((code) => code !== i18n.defaultLocale)
+      );
+      await writeLedger(
+        root,
+        pruneLedger(ledger, workList.knownSources, knownLocales)
+      );
+
+      const tail = [
+        "",
+        ...diagnosticLines(workList.diagnostics),
+        `  ${translateSummaryLine(result, workList)}`,
+        "",
+      ];
+      process.stderr.write(tail.join("\n"));
+
+      if (args.json) {
+        process.stdout.write(translateReportJson(result, workList));
+      }
+      if (result.counts.failed > 0 || result.counts.partial > 0) {
+        // The ledger write above already persisted every success, so a failed
+        // rerun only retries what actually failed.
+        await flushStdout();
+        process.exit(1);
+      }
+    } catch (error) {
+      if (error instanceof BlumeError) {
+        logger.error(error.diagnostic.message);
+        process.exit(1);
+      }
+      if ((error as NodeJS.ErrnoException)?.code === "ENOENT" && agent) {
+        notInstalled(agent);
+      }
+      reportInternalError(error);
+      process.exit(1);
+    }
+  },
+});

package/src/cli/index.ts

@@ -13,6 +13,7 @@ import { initCommand } from "./commands/init.ts";
 import { mcpStdioCommand } from "./commands/mcp-stdio.ts";
 import { previewCommand } from "./commands/preview.ts";
 import { syncCommand } from "./commands/sync.ts";
+import { translateCommand } from "./commands/translate.ts";
 import { validateCommand } from "./commands/validate.ts";
 import { loadEnvFiles } from "./env.ts";
 import { reportInternalError } from "./internal-error.ts";
@@ -36,6 +37,7 @@ const main = defineCommand({
     "mcp-stdio": mcpStdioCommand,
     preview: previewCommand,
     sync: syncCommand,
+    translate: translateCommand,
     validate: validateCommand,
   },
 });

package/src/components/Icon.astro

@@ -1,4 +1,5 @@
 ---
+import { isImageIcon, isInlineSvg } from "../theme/icon-kind.ts";
 import { resolveIcon } from "../theme/icons.ts";
 import { withBase } from "./islands/base-path.ts";
 
@@ -27,13 +28,7 @@ const customIcon =
     ? rawIcon
     : null;
 const iconName = typeof rawIcon === "string" ? rawIcon : null;
-const rawSvg =
-  iconName && /^\s*<svg[\s\S]*<\/svg>\s*$/u.test(iconName)
-    ? iconName.trim()
-    : null;
-const isImageIcon = (value: string): boolean =>
-  /^(?:https?:\/\/|data:image\/|\/|\.{1,2}\/)/u.test(value) ||
-  /\.(?:avif|gif|jpe?g|png|svg|webp)$/iu.test(value);
+const rawSvg = iconName && isInlineSvg(iconName) ? iconName.trim() : null;
 const imageSrc = iconName && !rawSvg && isImageIcon(iconName) ? iconName : null;
 const resolvedIcon =
   iconName && !(imageSrc || rawSvg) ? resolveIcon(iconName) : null;

package/src/components/content/Step.astro

@@ -1,6 +1,7 @@
 ---
-import Icon from "../Icon.astro";
+import { isAssetIcon } from "../../theme/icon-kind.ts";
 import { hasIcon } from "../../theme/icons.ts";
+import Icon from "../Icon.astro";
 
 interface Props {
   icon?: string;
@@ -10,14 +11,8 @@ interface Props {
 const { icon, title } = Astro.props;
 const markerClass =
   "absolute top-0 -start-[2.75rem] flex size-6 items-center justify-center rounded-full bg-accent text-center font-semibold text-accent-foreground text-xs";
-const isImageIcon = (value: string): boolean =>
-  /^(?:https?:\/\/|data:image\/|\/|\.{1,2}\/)/u.test(value) ||
-  /\.(?:avif|gif|jpe?g|png|svg|webp)$/iu.test(value);
 const canRenderIcon =
-  icon !== undefined &&
-  (/^\s*<svg[\s\S]*<\/svg>\s*$/u.test(icon) ||
-    isImageIcon(icon) ||
-    hasIcon(icon));
+  icon !== undefined && (isAssetIcon(icon) || hasIcon(icon));
 ---
 
 <div

package/src/components/content/Tab.astro

@@ -21,9 +21,28 @@ const slugify = (value: string): string =>
 const tabId = id ?? slugify(title);
 ---
 
+{/*
+  Drop the inset only when the panel is *nothing but* code fences: a fence owns
+  its own frame, so a code-only panel would double-inset it. A panel holding a
+  fence AND prose is real prose content and keeps the inset, matching every
+  other code-block host (CodeGroup, Steps, Callout, Card, Accordion) — see the
+  scroll-container note in theme/entry.ts. Previously the bare `:has(>pre)`
+  also matched mixed panels, stripping padding from the prose too; with
+  `[&>:last-child]:mb-0!` a trailing paragraph sat flush against the border.
+
+  The `template` exclusion is load-bearing, not defensive: when `icon` is set
+  this component renders a `<template data-blume-tab-icon>` that stays a
+  permanent child, because the tabs script *clones* its content into the
+  trigger (`icon.content.cloneNode(true)`) rather than moving the node. So the
+  panel legitimately has a non-`pre` child even when it is code-only, and
+  `:has(>pre:only-child)` would stop matching every icon tab — restoring the
+  double inset. `:only-of-type` survives the single-fence case but breaks a
+  code-only panel holding two fences. Excluding `template` handles both. Do
+  not "simplify" this to those.
+*/}
 <div
   class:list={[
-    "px-4 py-3 [&:has(>pre)]:p-0 [&>:first-child]:mt-0! [&>:last-child]:mb-0!",
+    "px-4 py-3 [&:has(>pre):not(:has(>:not(pre,template)))]:p-0 [&>:first-child]:mt-0! [&>:last-child]:mb-0!",
     className,
   ]}
   data-blume-tab-panel

package/src/components/layout/LanguageSwitcher.astro

@@ -26,7 +26,8 @@ const menuRowClass =
         class={`${iconButton} list-none [&::-webkit-details-marker]:hidden`}
       >
         <Icon name="globe" size={16} />
-        <span class="max-sm:hidden">{current?.label ?? label}</span>
+        {/* Collapses to the globe icon below `lg`, matching the search field. */}
+        <span class="max-lg:hidden">{current?.label ?? label}</span>
         <Icon
           class="transition-transform group-open:rotate-180"
           name="chevron-down"