jamdesk 1.1.205 → 1.1.207

package/vendored/lib/middleware-helpers.ts

@@ -19,7 +19,7 @@ import { getDomainConfig, getDomainMapping, getDomainStatus, getProjectInactive
 import { getForwardedHosts, isJamdeskDomain, normalizeForwardedHost, parseRedisConfig } from './domain-helpers';
 import { getRedirects, matchRedirect, mergeQueryStrings, isInvalidDestination } from './redirect-matcher';
 import { ASSET_PREFIX } from './docs-types';
-import { extractLanguageFromPath } from './language-utils';
+import { extractLanguageFromPath, negotiateLanguage } from './language-utils';
 import { DEFAULT_DOCS_SUBPATH } from '../shared/docs-subpath';
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
@@ -1315,3 +1315,230 @@ export async function customDomainOnlyBlock(args: {
     },
   });
 }
+
+/**
+ * Is this the bare documentation root — the one path where auto-routing to the
+ * visitor's language is safe?
+ *
+ * Exactly two shapes qualify: the site root `/`, and the hostAtDocs `/docs`
+ * root (with or without a trailing slash). Nothing else. In particular an
+ * explicit `/<lang>` root does **not** qualify, and that is the whole point:
+ *
+ *   - `/fr` is a URL a human chose, pasted into a ticket, or reached from a
+ *     search result. Redirecting away from it means a shared French link opens
+ *     in English for any colleague whose browser does not ask for French —
+ *     including a French speaker running an English OS. The URL is a stronger
+ *     statement of intent than Accept-Language, so the URL wins.
+ *   - Bots are exempt from redirects, so a crawler indexes `/fr` happily while
+ *     every human who clicks the result gets bounced. That asymmetry is
+ *     invisible in testing and shows up as a ranking problem months later.
+ *   - It keeps this a pure string test with no language list, so proxy.ts can
+ *     reject every content path before paying for the Redis/R2 read. An earlier
+ *     draft admitted any bare `/<segment>`, which made `/quickstart` — an
+ *     ordinary page — pay that read on every request.
+ *
+ * At the call site `pathname` is INTERNAL (reassigned to `routing.rewrite` in
+ * proxy.ts's getDocsPrefixRouting block), so a subpath-hosted tenant's root
+ * arrives as `/docs`, not `/`.
+ * Both shapes are handled here; dropping the `/docs` case silently disables the
+ * feature for every subpath-mounted site.
+ */
+export function isLocaleRootPath(pathname: string): boolean {
+  // The type says string, and the only call site (proxy.ts's `if (routing?.rewrite)`
+  // guard, plus the always-string `request.nextUrl.pathname` fallback) guarantees
+  // one — so this branch is unreachable today. It stays because edge middleware has
+  // no error boundary: a throw here 500s every docs page, while returning false just
+  // declines to redirect, the same fail-safe direction as every other path in this
+  // feature. One line of insurance against a future caller that isn't as careful.
+  if (typeof pathname !== 'string') return false;
+  const trimmed = pathname.endsWith('/') && pathname.length > 1
+    ? pathname.slice(0, -1)
+    : pathname;
+  return trimmed === '' || trimmed === '/' || trimmed === '/docs';
+}
+
+/**
+ * Case-insensitive substring match list for `isBotUserAgent`.
+ *
+ * NOT in the brief's own snippet — Step 3 there calls `BOT_UA_PATTERNS` without
+ * ever defining it, and no such constant exists anywhere else in this repo
+ * (verified by grep across build-service, cli, and dashboard/hosting). That
+ * omission would not typecheck, so this list was authored here to make the
+ * brief's own required test cases pass: the named crawlers/bots plus `curl`
+ * from the test table, and `spider`/`crawler`/generic `bot` so a UA this list
+ * doesn't yet name by product still fails safe (see the doc comment on
+ * `isBotUserAgent` for why "fails safe" here means "gets flagged as a bot").
+ * `facebookexternalhit` and `curl` are listed explicitly because neither
+ * contains the substring "bot".
+ *
+ * Three more explicit entries beyond the brief's test table, none of them a
+ * crash or a security issue — a missed bot just gets the same 307 a human
+ * would. These are crawl-hygiene and measurement-accuracy fixes, cheap enough
+ * to add on sight:
+ *   - `google-inspectiontool`: Search Console's URL inspection tool. Missed,
+ *     it sees a 307 to a translated locale instead of the canonical page —
+ *     actively misleading to someone debugging indexing on a docs product.
+ *   - `google-extended`: Google's AI-training crawler. Missed, it ingests a
+ *     translated variant instead of canonical.
+ *   - `chrome-lighthouse`: this repo's own CLAUDE.md requires a Lighthouse
+ *     mobile audit before builder-ISR and marketing deploys. Missed, an
+ *     audit measures a redirect hop instead of the target page and quietly
+ *     distorts our own pre-deploy gate. (Modern headless Chrome often drops
+ *     this token, which is exactly why it's low-risk to list: harmless when
+ *     absent, useful when present.)
+ */
+const BOT_UA_PATTERNS = [
+  'bot',
+  'spider',
+  'crawler',
+  'facebookexternalhit',
+  'curl',
+  'wget',
+  'google-inspectiontool',
+  'google-extended',
+  'chrome-lighthouse',
+];
+
+/**
+ * Total predicate: every input, including `null`/`''`/garbage, returns a
+ * boolean. This runs in edge middleware, which has no error boundary — a
+ * throw here 500s the page (see constraints.md).
+ *
+ * A missing or empty User-Agent is treated as a bot. No real browser omits
+ * the header, so the only visitors this can misclassify are non-browser
+ * clients — and for R1.4 the safe failure mode is "do not auto-redirect",
+ * not "guess a language for an unidentified client."
+ */
+export function isBotUserAgent(ua: string | null): boolean {
+  if (!ua) return true;
+  const lowered = ua.toLowerCase();
+  return BOT_UA_PATTERNS.some((pattern) => lowered.includes(pattern));
+}
+
+export interface LanguageRedirectInput {
+  /** Request pathname, already normalized past any hostAtDocs 308. */
+  pathname: string;
+  /** Descriptor from getLanguageRouting(), or null when absent. */
+  routing: { autoRedirect: boolean; defaultLanguage: string; languages: string[] } | null;
+  acceptLanguage: string | null;
+  userAgent: string | null;
+  cookieLanguage: string | null;
+}
+
+/**
+ * Spellings of `JD_LANG_ROUTING_DISABLED` that mean "every tenant". `*` is the
+ * documented one; the rest are here because an operator reaching for this at
+ * 2am should not have to remember a magic string, and no project slug can
+ * collide with any of them.
+ */
+const LANGUAGE_ROUTING_KILL_ALL = new Set(['*', 'all', 'true', '1', 'yes', 'on']);
+
+/** Spellings that mean "nothing disabled", so `...=false` is not a slug. */
+const LANGUAGE_ROUTING_KILL_NONE = new Set(['0', 'false', 'no', 'off']);
+
+/**
+ * The language-routing kill switch: is auto-redirect turned off for this
+ * project by platform configuration?
+ *
+ * Why this exists. `autoRedirect` is baked into `_languages.json` at BUILD
+ * time, so flipping docs.json does nothing until that tenant rebuilds — and
+ * the root CLAUDE.md forbids us triggering a customer rebuild without that
+ * customer's explicit permission for that exact rebuild. Poisoning the Redis
+ * key is not a rollback either: CACHE_TTL is 300s and R2 re-wins in five
+ * minutes. Without this, the only lever for one misbehaving tenant was
+ * rolling back the whole build-service deployment for all ~93.
+ *
+ * Format of the env var, read by proxy.ts:
+ *   unset / empty / `false`  -> nothing disabled (the default; an unset var
+ *                               must change nothing)
+ *   `*`                      -> disabled for every tenant
+ *   `acme,beta-docs`         -> disabled for those project slugs only
+ *
+ * TOTAL and non-throwing by construction — String.split and Set.has cannot
+ * raise, and a non-string argument returns false. That is not a style
+ * preference: proxy.ts has no error boundary, so a throw on this line 500s
+ * every docs page on every tenant. A value nobody can parse disables NOTHING
+ * rather than everything, so a typo cannot take the feature out platform-wide.
+ *
+ * Trimmed and lowercased per entry — Vercel env values pick up trailing
+ * newlines (see the ISR_MODE incident in CLAUDE.md) and slugs are lowercase.
+ */
+export function isLanguageRoutingDisabled(
+  projectSlug: string | null | undefined,
+  rawDenylist: string | null | undefined,
+): boolean {
+  if (typeof rawDenylist !== 'string') return false;
+  const entries = rawDenylist
+    .split(',')
+    .map((entry) => entry.trim().toLowerCase())
+    .filter((entry) => entry.length > 0 && !LANGUAGE_ROUTING_KILL_NONE.has(entry));
+  if (entries.length === 0) return false;
+  if (entries.some((entry) => LANGUAGE_ROUTING_KILL_ALL.has(entry))) return true;
+  const slug = typeof projectSlug === 'string' ? projectSlug.trim().toLowerCase() : '';
+  return slug.length > 0 && entries.includes(slug);
+}
+
+/**
+ * Decide where a language redirect should go, or null for "serve the page
+ * as-is".
+ *
+ * Returns the **internal** (`/docs`-shaped) pathname plus the language that
+ * was chosen. The caller needs both: the pathname must be mapped back to the
+ * tenant's external prefix with toExternalPath(), and the language is the
+ * cookie value — deriving it from the last path segment would write an empty
+ * cookie whenever the destination is the default-language root `/`.
+ *
+ * `viaCookie` tells the caller WHY: true only when an existing cookie named
+ * an offered language, false when the decision came from Accept-Language (or
+ * a cookie was present but named a language the tenant no longer offers — a
+ * stale cookie falls through to negotiation and must not be reported as the
+ * reason). A caller logging "via" from `Boolean(cookieLanguage)` instead
+ * would misattribute every stale-cookie redirect to the cookie.
+ *
+ * Pure and total: every bail-out returns null, so the caller can wire this in
+ * without an error path. Precedence is cookie, then Accept-Language — an
+ * explicit choice always beats a browser default (R1.3).
+ */
+export function decideLanguageRedirect(
+  input: LanguageRedirectInput,
+): { pathname: string; language: string; viaCookie: boolean } | null {
+  const { pathname, routing, acceptLanguage, userAgent, cookieLanguage } = input;
+
+  if (!routing?.autoRedirect) return null;
+  if (isBotUserAgent(userAgent)) return null;
+  // Bare docs root only. An explicit /<lang> root is the visitor's own stated
+  // language and is never redirected away from — see isLocaleRootPath.
+  if (!isLocaleRootPath(pathname)) return null;
+  if (routing.languages.length < 2) return null;
+
+  const available = routing.languages;
+  const defaultLang = routing.defaultLanguage.toLowerCase();
+
+  // A cookie naming a language the tenant has since dropped is stale, not a
+  // preference — fall through to negotiation rather than 404 the visitor.
+  const cookieMatch = cookieLanguage
+    ? available.find((code) => code.toLowerCase() === cookieLanguage.toLowerCase())
+    : undefined;
+
+  // "No cookie match" and "nothing configured matched" are DIFFERENT answers
+  // and must not collapse. negotiateLanguage returning null means R1.6's "do
+  // nothing" — not "fall back to the default". An earlier draft wrote
+  // `?? defaultLang` here, which turned every unmatched visitor into a
+  // redirect to the default root.
+  // negotiateLanguage already returns `string | null` (never undefined), so
+  // wrapping it in another `?? null` added nothing — the single trailing one
+  // normalizes the `undefined` that `?.toLowerCase()` produces when it's null.
+  const negotiated = cookieMatch
+    ? cookieMatch.toLowerCase()
+    : negotiateLanguage(acceptLanguage, available, defaultLang)?.toLowerCase() ?? null;
+  if (!negotiated) return null;
+
+  // Already where they belong: the bare root IS the default-language root.
+  if (negotiated === defaultLang) return null;
+
+  const trimmed = pathname.endsWith('/') && pathname.length > 1
+    ? pathname.slice(0, -1)
+    : pathname;
+  const base = trimmed === '/docs' ? '/docs' : '';
+  return { pathname: `${base}/${negotiated}`, language: negotiated, viaCookie: !!cookieMatch };
+}

package/vendored/lib/page-timestamps.ts

@@ -142,3 +142,39 @@ export function injectLastUpdated(content: string, date: string): string {
 
   return `---\n${newInner}\n---\n${content.slice(match[0].length)}`;
 }
+
+/**
+ * Normalize a frontmatter date value to `YYYY-MM-DD`, or undefined.
+ *
+ * YAML hands back three shapes for what an author typed as a date:
+ * an unquoted `2026-09-01` becomes a **Date**, a quoted one stays a string,
+ * and a bare `2026` becomes a number. Only the first two can mean a date, and
+ * a Date must be formatted in UTC — rendering it raw produces a
+ * timezone-shifted `Date.toString()` inside `<time dateTime>`, the same bug
+ * injectLastUpdated() quotes its own output to avoid.
+ */
+function normalizeDateValue(value: unknown): string | undefined {
+  if (value instanceof Date) {
+    return Number.isNaN(value.getTime()) ? undefined : value.toISOString().slice(0, 10);
+  }
+  if (typeof value !== 'string') return undefined;
+  const trimmed = value.trim();
+  if (!trimmed) return undefined;
+  const parsed = new Date(trimmed);
+  if (Number.isNaN(parsed.getTime())) return undefined;
+  return parsed.toISOString().slice(0, 10);
+}
+
+/**
+ * Resolve the date shown as "Last updated on …".
+ *
+ * `lastUpdatedDate` is author-owned and wins; `lastUpdated` is build-owned (the
+ * git commit date injected by injectLastUpdated) and is the fallback. An
+ * unusable author value falls through to the git date rather than blanking the
+ * line — a typo should not silently remove a freshness signal.
+ */
+export function resolveLastUpdated(
+  data: { lastUpdated?: unknown; lastUpdatedDate?: unknown },
+): string | undefined {
+  return normalizeDateValue(data.lastUpdatedDate) ?? normalizeDateValue(data.lastUpdated);
+}

package/vendored/lib/rehype-code-meta.ts

@@ -16,6 +16,8 @@ export interface CodeMeta {
   showLineNumbers?: boolean;
   /** Starting line number (default: 1) */
   startLine?: number;
+  /** Suppress the copy button on this block */
+  nocopy?: boolean;
   /** Remaining meta string (status codes, etc.) */
   meta?: string;
 }
@@ -79,6 +81,25 @@ function parseShowLineNumbers(meta: string): boolean {
   return /\bshowLineNumbers\b/.test(meta);
 }
 
+/**
+ * Parse the nocopy flag from a meta string.
+ * Word-bounded so `title="nocopyright.txt"` does not trigger it, and scanned
+ * with any quoted title stripped first so `title="My nocopy guide"` (the word
+ * appearing inside free-text title, not as the flag) does not trigger it either.
+ */
+function parseNocopy(meta: string): boolean {
+  return /\bnocopy\b/.test(meta.replace(/title=(["'])(?:(?!\1).)*\1/g, ''));
+}
+
+/**
+ * The `nocopy` flag token with its surrounding whitespace. Shared by cleanMeta
+ * (pre-Shiki) and rehypeRestoreDataTitle (post-Shiki) because they strip the
+ * same fence at two pipeline stages and the caption is only right if both
+ * agree. Safe to share as a /g literal: String#replace resets lastIndex before
+ * and after; only .test/.exec carry state between calls.
+ */
+const NOCOPY_TOKEN = /\s*\bnocopy\b\s*/g;
+
 /**
  * Parse startLine attribute from meta string
  * Supports: startLine=10 or startLine="10"
@@ -94,6 +115,12 @@ function parseStartLine(meta: string): number | undefined {
 
 /**
  * Remove parsed attributes from meta string
+ *
+ * Accepted tradeoff: an UNQUOTED fallback title that happens to contain the
+ * word "nocopy" (e.g. ```txt My nocopy guide```) has it stripped here same
+ * as the real flag, so the caption renders "My guide" and the block also
+ * loses its copy button. Only a quoted `title="..."` is exempted (see
+ * parseNocopy above). The escape hatch is quoting the title.
  */
 function cleanMeta(meta: string): string {
   return meta
@@ -101,6 +128,7 @@ function cleanMeta(meta: string): string {
     .replace(/\s*title=["'][^"']+["']\s*/g, ' ')
     .replace(/\s*\{[^}]+\}\s*/g, ' ')
     .replace(/\s*showLineNumbers\s*/g, ' ')
+    .replace(NOCOPY_TOKEN, ' ')
     .replace(/\s*startLine=["']?\d+["']?\s*/g, ' ')
     .trim();
 }
@@ -122,6 +150,7 @@ export function parseCodeMeta(meta: string): CodeMeta {
     highlightLines: parseHighlightLines(meta),
     showLineNumbers: parseShowLineNumbers(meta),
     startLine: parseStartLine(meta),
+    nocopy: parseNocopy(meta),
     // Only include meta if we didn't use it as the title
     meta: explicitTitle ? cleanedMeta || undefined : undefined,
   };
@@ -248,8 +277,9 @@ function isCodeFenceFeature(meta: string): boolean {
   if (/^showLineNumbers(\s|$)/.test(trimmed)) return true;
   // startLine=N
   if (/^startLine=/.test(trimmed)) return true;
-  // Multiple features combined (no actual title)
-  if (/^(showLineNumbers|\{[\d,\-\s]+\}|startLine=\d+)(\s+(showLineNumbers|\{[\d,\-\s]+\}|startLine=\d+))*$/.test(trimmed)) return true;
+  // Multiple features combined (no actual title) — also covers a lone
+  // `nocopy`, so a standalone `^nocopy(\s|$)` check above would be redundant.
+  if (/^(showLineNumbers|nocopy|\{[\d,\-\s]+\}|startLine=\d+)(\s+(showLineNumbers|nocopy|\{[\d,\-\s]+\}|startLine=\d+))*$/.test(trimmed)) return true;
   return false;
 }
 
@@ -260,13 +290,48 @@ export const rehypeRestoreDataTitle: Plugin<[], Root> = () => {
         const dataMeta = node.properties['data-meta'] as string | undefined;
         const dataLanguage = node.properties['data-language'] as string | undefined;
 
-        // Only convert data-meta to data-title if:
-        // 1. data-meta exists
-        // 2. It doesn't look like a status code (no colon)
-        // 3. It's not a language/tool label (which CodeGroup uses for tabs)
-        // 4. It's not just code fence features (showLineNumbers, {1,3-5}, startLine=N)
-        if (dataMeta && !dataMeta.includes(':') && !isLanguageLabel(dataMeta, dataLanguage) && !isCodeFenceFeature(dataMeta)) {
-          node.properties['data-title'] = dataMeta;
+        if (!dataMeta || dataMeta.includes(':')) return;
+
+        // An explicit `title="..."` always wins. Promote the PARSED value,
+        // never the raw `data-meta` string — using raw meta here shipped
+        // `title="/snippets/counter.tsx"` as the literal on-page caption
+        // instead of `/snippets/counter.tsx` (pre-existing since 7ed2dfe26).
+        const explicitTitle = parseTitle(dataMeta);
+        if (explicitTitle) {
+          node.properties['data-title'] = explicitTitle;
+          return;
+        }
+
+        // Strip nocopy BEFORE classifying, not after: `JavaScript nocopy`
+        // must still read as the "javascript" language label. Classifying
+        // the raw meta first would test "JavaScript nocopy" against
+        // isLanguageLabel/isCodeFenceFeature (neither matches the combined
+        // string), wrongly promoting it to a standalone title "JavaScript".
+        const cleaned = dataMeta.replace(NOCOPY_TOKEN, ' ').trim();
+        if (!cleaned) return;
+
+        if (isLanguageLabel(cleaned, dataLanguage)) {
+          // The author wrote a language/tool token as the fence meta
+          // (```bash npm). Deliberately NOT promoted to data-title — a
+          // standalone block must not caption itself "npm" — but inside a
+          // <CodeGroup> that token IS the tab label Mintlify documents, and
+          // it is the only thing distinguishing an npm tab from a yarn one.
+          // Dropping it made `npm`/`yarn` both fall through to the language,
+          // and lib/code-utils.ts maps bash -> "cURL": 75 groups in
+          // projects/ rendered two or three IDENTICAL tabs. Re-emitted here
+          // under its own name, so the only reader is CodeGroup's
+          // getTabLabel and no caption changes outside a group.
+          //
+          // Emitted post-Shiki on purpose: this plugin runs after
+          // rehypeShikiFromHighlighter, which replaces the <pre> wholesale,
+          // so a pre-Shiki attribute would be discarded (same reason
+          // data-nocopy is stamped from transformerLineFeatures().pre()).
+          node.properties['data-language-label'] = cleaned;
+          return;
+        }
+
+        if (!isCodeFenceFeature(cleaned)) {
+          node.properties['data-title'] = cleaned;
         }
       }
     });

package/vendored/lib/render-doc-page.tsx

@@ -22,6 +22,7 @@ import { PageColumns } from '@/components/layout/PageColumns';
 import { EmbedLinkInterceptor } from '@/components/layout/EmbedLinkInterceptor';
 import { PageNavigation } from '@/components/navigation/PageNavigation';
 import { LastUpdated } from '@/components/navigation/LastUpdated';
+import { resolveLastUpdated } from './page-timestamps';
 import { SocialFooter } from '@/components/navigation/SocialFooter';
 import { ApiPageWrapper } from '@/components/mdx/ApiPage';
 import { OpenApiEndpoint } from '@/components/mdx/OpenApiEndpoint';
@@ -191,6 +192,16 @@ interface FrontmatterData {
   // Injected at build time (YYYY-MM-DD) when metadata.timestamp is enabled —
   // the date of the last git commit that touched this page. See LastUpdated.
   lastUpdated?: string;
+  /**
+   * Author override; wins over the build-injected `lastUpdated`.
+   *
+   * Typed `string | Date` because that is what YAML actually yields: an
+   * unquoted `2026-09-01` parses to a Date, a quoted one stays a string.
+   * Declaring it `string` would compile but describe a shape the runtime
+   * never guarantees. `resolveLastUpdated` takes `unknown` and handles both,
+   * plus the number YAML produces for a bare `2026`.
+   */
+  lastUpdatedDate?: string | Date;
   [key: string]: unknown;
 }
 
@@ -695,7 +706,7 @@ export async function renderDocPage(input: RenderInput): Promise<ReactElement> {
     faqPairs,
     isRootAlias,
     ogImageUrl,
-    dateModified: typeof data.lastUpdated === 'string' ? data.lastUpdated : undefined,
+    dateModified: resolveLastUpdated(data),
     author: typeof data.author === 'string' ? data.author : undefined,
   });
   const jsonLdScript = renderJsonLdScript(jsonLd);
@@ -1241,7 +1252,7 @@ export async function renderDocPage(input: RenderInput): Promise<ReactElement> {
             </div>
 
             {!embed && <PageNavigation currentSlug={slug.join('/')} config={config} />}
-            {!embed && config.metadata?.timestamp && <LastUpdated date={data.lastUpdated} />}
+            {!embed && config.metadata?.timestamp && <LastUpdated date={resolveLastUpdated(data)} />}
             <SocialFooter config={config} hidden={data.hideFooter} embed={embed} projectSlug={projectSlug ?? undefined} />
           </article>,
         )}
@@ -1303,7 +1314,7 @@ export async function renderDocPage(input: RenderInput): Promise<ReactElement> {
 
         {!embed && <PageNavigation currentSlug={slug.join('/')} config={config} isWideMode={isWideMode || hasPanel} />}
       </div>
-      {!embed && config.metadata?.timestamp && <LastUpdated date={data.lastUpdated} />}
+      {!embed && config.metadata?.timestamp && <LastUpdated date={resolveLastUpdated(data)} />}
       <SocialFooter config={config} hidden={data.hideFooter} embed={embed} projectSlug={projectSlug ?? undefined} />
     </article>,
   );

package/vendored/lib/revalidation-helpers.ts

@@ -13,6 +13,7 @@ import { clearProjectCache as clearMcpProjectCache, clearCache as clearMcpCache
 import { clearNavigationCache } from './navigation-resolver';
 import { getStaticRevalidationPaths } from './static-file-route';
 import { clearRedirectCache } from './redirect-matcher';
+import { clearLanguageCache } from './language-matcher';
 import { clearProjectDeployIdCache } from './project-deploy-id';
 import { mdxCacheTag, projectCacheTag } from './cache-tags';
 
@@ -158,6 +159,7 @@ export async function executeRevalidation(
     clearOpenApiCache(project);
     clearMcpProjectCache(project);
     await clearRedirectCache(project);
+    await clearLanguageCache(project);
     clearNavigationCache(); // Navigation cache keys include project name, clear all for simplicity
     revalidated.push(`cache:${project}`);
     request.tags = [projectCacheTag(project)];
@@ -216,6 +218,7 @@ export async function executeRevalidation(
     clearNavigationCache();
     clearProjectDeployIdCache();
     await clearRedirectCache();
+    await clearLanguageCache();
     if (revalidatePath) {
       revalidatePath('/', 'layout');
       // Also purge CDN cache for static file routes (sitemap, robots, llms.txt, etc.)

package/vendored/lib/root-page-slug.ts

@@ -17,10 +17,15 @@
  * resolving to the first nav page. Parity with HTML is the contract here — the
  * helper is shared, so the two surfaces move together.
  */
-import type { DocsConfig } from '@/lib/docs-types';
-import { findFirstNavPage } from '@/lib/find-first-nav-page';
-import { isValidLanguageCode } from '@/lib/language-utils';
-import { pathToSlug } from '@/lib/page-isr-helpers';
+// Relative, not `@/lib/...`: this module is now reachable from build.ts (via
+// languages-artifact.ts) and therefore compiled by tsconfig.node.json for the
+// Cloud Run image, which does not carry the `@` path alias. Its whole
+// neighbourhood — locale-helpers, language-utils, page-isr-helpers — imports
+// relatively for the same reason. Caught by __tests__/build.cjs-interop.test.ts.
+import type { DocsConfig } from './docs-types';
+import { findFirstNavPage } from './find-first-nav-page';
+import { isValidLanguageCode } from './language-utils';
+import { pathToSlug } from './page-isr-helpers';
 
 /**
  * The page path proxy.ts rewrites the site root to (`/`, `/index.md`, and the

package/vendored/lib/shiki-transformers.ts

@@ -32,6 +32,7 @@ interface ParsedMeta {
   showLineNumbers: boolean;
   startLine: number;
   title: string | undefined;
+  nocopy: boolean;
 }
 
 const metaCache = new Map<string, ParsedMeta>();
@@ -50,6 +51,11 @@ function getParsedMeta(meta: string): ParsedMeta {
     showLineNumbers: /\bshowLineNumbers\b/.test(meta),
     startLine: parseStartLineImpl(meta),
     title: parseTitleImpl(meta),
+    // Word-boundary so `nocopyright.txt` is unaffected. Scanned on the meta
+    // with any quoted title removed first: a fence written
+    // `title="My nocopy guide"` must not set the flag, and must not have its
+    // caption mangled by the strip in rehypeRestoreDataTitle.
+    nocopy: /\bnocopy\b/.test(meta.replace(/title=(["'])(?:(?!\1).)*\1/g, '')),
   };
 
   // Prevent unbounded cache growth
@@ -318,6 +324,13 @@ export function transformerLineFeatures(): ShikiTransformer {
       if (parsed.highlightLines.length > 0) {
         node.properties['data-highlight-lines'] = JSON.stringify(parsed.highlightLines);
       }
+
+      // Suppress the copy button. Must be emitted HERE, not from
+      // rehypeCodeMeta: Shiki replaces the <pre>, so a pre-Shiki attribute is
+      // discarded, and CodeBlockCopyButton scans the post-Shiki `pre.shiki`.
+      if (parsed.nocopy) {
+        node.properties['data-nocopy'] = 'true';
+      }
     },
     line(node, line) {
       const meta = this.options.meta?.__raw || '';

package/vendored/lib/static-artifacts.ts

@@ -19,6 +19,7 @@ import { buildHreflangAlternates } from './seo.js';
 import { computePageVisibility, type VisibilityInputs } from './visibility.js';
 import { logger } from '../shared/logger.js';
 import { frontmatterText } from './frontmatter-utils.js';
+import { resolveLastUpdated } from './page-timestamps';
 
 /**
  * Page metadata for artifact generation.
@@ -447,6 +448,11 @@ export interface RawPageInfo {
     noindex?: boolean;
     hidden?: boolean;
     lastModified?: string;
+    // Author override for the sitemap's <lastmod>, resolved via
+    // resolveLastUpdated (page-timestamps.ts). YAML yields a Date for an
+    // unquoted YYYY-MM-DD and a string for a quoted one — see FrontmatterData
+    // in render-doc-page.tsx for the same shape.
+    lastUpdatedDate?: string | Date;
     rss?: boolean;
     seo?: {
       noindex?: boolean;
@@ -482,7 +488,16 @@ export function extractPageMetadata(
       description: frontmatterText(rawDescription) || undefined,
       noindex: page.frontmatter.noindex || page.frontmatter.seo?.noindex,
       hidden: page.frontmatter.hidden,
-      lastModified: page.frontmatter.lastModified,
+      // An explicit lastUpdatedDate is the author stating when this page was
+      // last meaningfully changed. The page body and the JSON-LD dateModified
+      // already honour it; the sitemap must agree or we publish two different
+      // answers to the same question. Deliberately NOT falling back to the
+      // build-injected `lastUpdated` here: that would change <lastmod> from the
+      // build date to the commit date for every page on every tenant, which is
+      // a platform-wide SEO change this plan has no mandate for.
+      lastModified:
+        resolveLastUpdated({ lastUpdatedDate: page.frontmatter.lastUpdatedDate }) ??
+        page.frontmatter.lastModified,
     };
   });
 }
@@ -766,6 +781,57 @@ export interface GeneratedArtifacts {
   changelog: string;
 }
 
+/**
+ * Keep the root feed.xml / changelog.json to the DEFAULT locale's pages.
+ *
+ * Every translated copy of a changelog page carries the same <Update> entries,
+ * so without this each update appeared once per language: jamdesk-docs shipped
+ * 61 changelog entries for 9 real updates, RSS subscribers got each update
+ * seven times, and the English widget's "latest" rendered a Chinese label
+ * (generateChangelog breaks date ties on label slug, and '2026 \u5e74 9 \u6708'
+ * slugs to '2026-9', which sorts ahead of 'september-2026').
+ *
+ * Mirrors the bucketing generateLlmsTxtFiles already does for the root
+ * llms.txt; see there for why `|| defaultCode` and `.toLowerCase()` are both
+ * load-bearing. There are no per-locale feed.xml/changelog.json routes, so
+ * translated updates are dropped here rather than rehomed.
+ */
+function selectDefaultLocaleRssPages(
+  rssPages: RssPageInfo[],
+  languages: LanguageConfig[] | undefined,
+): RssPageInfo[] {
+  // Unlike generateLlmsTxtFiles, hidden languages are KEPT here. There `codes`
+  // also drives cross-links, which a hidden language must not appear in; here
+  // it is purely a list of path prefixes that mean "this is a translation",
+  // and hiding a language from the picker does not stop it being one. Dropping
+  // hidden locales would let their updates duplicate into the root feed — the
+  // exact bug this function exists to fix.
+  const codes = (languages ?? [])
+    .filter(
+      (l): l is LanguageConfig & { language: string } => typeof l.language === 'string',
+    )
+    .map((l) => l.language);
+  // Must come BEFORE defaultCode: resolveLanguageWithFallback returns
+  // configLanguages[0].language verbatim, which is customer JSON and need not
+  // be a string (the type guard above concedes that). Calling .toLowerCase()
+  // on `languages: [{}]` or `[{language: 123}]` throws and kills the whole
+  // build. generateLlmsTxtFiles is safe for the same reason — its own empty
+  // check fires before it lowercases. No dedupe is needed though: `codes` is
+  // only a whitelist for resolveLocaleFromPath, which folds it into a Set.
+  if (codes.length === 0) return rssPages;
+
+  const defaultCode = resolveLanguageWithFallback(null, languages).toLowerCase();
+  const selected = rssPages.filter(
+    (p) => (resolveLocaleFromPath(p.path, codes) || defaultCode).toLowerCase() === defaultCode,
+  );
+  // A tenant whose only changelog sits under a locale prefix would otherwise
+  // be left with nothing, and an empty `updates` means rssFeed === null, which
+  // SKIPS the R2 write entirely (upload-content-to-r2.ts) — the versioned key
+  // 404s while the legacy key goes on serving the old duplicated feed. Keeping
+  // every page there is no worse than today's behaviour for that tenant.
+  return selected.length > 0 ? selected : rssPages;
+}
+
 /**
  * Generate all static artifacts for a project.
  *
@@ -798,7 +864,9 @@ export function generateAllArtifacts(options: GenerateAllOptions): GeneratedArti
   // Extract <Update> entries once — they power BOTH the RSS feed and
   // changelog.json, so sharing the single pass keeps the widget's "latest" and
   // feed.xml structurally in sync (and avoids scanning every rss page twice).
-  const updates = rssPages && rssPages.length > 0 ? extractUpdatesFromPages(rssPages) : [];
+  const updates = rssPages && rssPages.length > 0
+    ? extractUpdatesFromPages(selectDefaultLocaleRssPages(rssPages, languages))
+    : [];
 
   let rssFeed: string | null = null;
   if (updates.length > 0) {