jamdesk 1.1.210 → 1.1.211

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jamdesk",
-  "version": "1.1.210",
+  "version": "1.1.211",
   "description": "CLI for Jamdesk — build, preview, and deploy documentation sites from MDX. Dev server with hot reload, 50+ components, OpenAPI support, AI search, and Mintlify migration",
   "keywords": [
     "jamdesk",

package/vendored/components/mdx/CodeGroup.tsx

@@ -221,10 +221,10 @@ function isTitledMdxFence(block: ReactElement): boolean {
 
 /**
  * Children that are neither code fences nor the blank text nodes MDX emits
- * between block children. These are rendered after the panel so a
- * <CodeGroup> cannot silently eat authored prose: before this fix such
- * content was visible (the whole group fell back to a plain <div>), so
- * dropping it now would be a content regression rather than a no-op.
+ * between block children. They are rendered, never dropped: before the
+ * fence-recognition fix such content was visible (the whole group fell back to
+ * a plain <div>), so dropping it now would be a content regression. See the
+ * CodeGroup body for where each one goes.
  */
 function isRenderableExtra(child: ReactNode): boolean {
   if (unwrapCodeFence(child) !== null) return false;
@@ -273,7 +273,13 @@ export const CodeGroup = memo(function CodeGroup({ children }: CodeGroupProps) {
     return <div>{children}</div>;
   }
 
-  const extras = allChildren.filter(isRenderableExtra);
+  // Anything before the first fence introduces the group and renders ABOVE
+  // the panel. Everything after it — between fences or trailing — renders
+  // below, in source order: a tab strip has nowhere to put prose between two
+  // tabs. codeBlocks is non-empty here, so a fence exists.
+  const firstFenceIndex = allChildren.findIndex((child) => unwrapCodeFence(child) !== null);
+  const leading = allChildren.slice(0, firstFenceIndex).filter(isRenderableExtra);
+  const trailing = allChildren.slice(firstFenceIndex + 1).filter(isRenderableExtra);
 
   // Extract title from first code block (only shown for single blocks)
   const title = codeBlocks.length === 1 ? getTitle(codeBlocks[0]) : undefined;
@@ -304,12 +310,13 @@ export const CodeGroup = memo(function CodeGroup({ children }: CodeGroupProps) {
 
   const panel = <CodePanel tabs={tabs} title={title} className="my-6" enableFullscreen />;
 
-  if (extras.length === 0) return panel;
+  if (leading.length === 0 && trailing.length === 0) return panel;
 
   return (
     <>
+      {leading}
       {panel}
-      {extras}
+      {trailing}
     </>
   );
 });

package/vendored/components/ui/CodePanel.tsx

@@ -118,6 +118,46 @@ export function extractTextContent(node: ReactNode): string {
   return '';
 }
 
+/**
+ * An icon button in the panel header — expand or copy. Both header variants
+ * render the same pair; only the margin differs, so it is the one prop.
+ */
+function HeaderIconButton({
+  onClick,
+  title,
+  ariaLabel,
+  marginClass,
+  children,
+}: {
+  onClick: () => void;
+  title: string;
+  ariaLabel: string;
+  marginClass: string;
+  children: ReactNode;
+}) {
+  return (
+    <button
+      onClick={onClick}
+      className={['p-1.5 rounded-md transition-colors flex-shrink-0 cursor-pointer', marginClass]
+        .filter(Boolean)
+        .join(' ')}
+      style={{ color: codePanelColors.textMuted }}
+      onMouseEnter={(e) => {
+        e.currentTarget.style.backgroundColor = codePanelColors.tabHoverBg;
+        e.currentTarget.style.color = codePanelColors.text;
+      }}
+      onMouseLeave={(e) => {
+        e.currentTarget.style.backgroundColor = 'transparent';
+        e.currentTarget.style.color = codePanelColors.textMuted;
+      }}
+      title={title}
+      aria-label={ariaLabel}
+    >
+      {children}
+    </button>
+  );
+}
+
 /**
  * Reusable code panel component with tabs, copy button, and syntax highlighting support.
  * Self-contained with CSS variable fallbacks - works standalone or with theme overrides.
@@ -288,6 +328,13 @@ export function CodePanel({
     setTimeout(() => setCopied(false), 2000);
   };
 
+  const expandIcon = <i className="fa-solid fa-expand text-[14px]" aria-hidden="true" />;
+  const copyIcon = copied ? (
+    <i className="fa-solid fa-check text-[14px] text-emerald-500" aria-hidden="true" />
+  ) : (
+    <i className="fa-regular fa-copy text-[14px]" aria-hidden="true" />
+  );
+
   return (
     <div
       ref={panelRef}
@@ -317,47 +364,25 @@ export function CodePanel({
             <div className="flex items-center">
               {/* Expand Button */}
               {enableFullscreen && (
-                <button
+                <HeaderIconButton
                   onClick={() => setIsModalOpen(true)}
-                  className="p-1.5 rounded-md transition-colors flex-shrink-0 cursor-pointer"
-                  style={{ color: codePanelColors.textMuted }}
-                  onMouseEnter={(e) => {
-                    e.currentTarget.style.backgroundColor = codePanelColors.tabHoverBg;
-                    e.currentTarget.style.color = codePanelColors.text;
-                  }}
-                  onMouseLeave={(e) => {
-                    e.currentTarget.style.backgroundColor = 'transparent';
-                    e.currentTarget.style.color = codePanelColors.textMuted;
-                  }}
                   title="Open in fullscreen"
-                  aria-label="Open in fullscreen"
+                  ariaLabel="Open in fullscreen"
+                  marginClass=""
                 >
-                  <i className="fa-solid fa-expand text-[14px]" aria-hidden="true" />
-                </button>
+                  {expandIcon}
+                </HeaderIconButton>
               )}
               {/* Copy Button */}
               {!copyHidden && (
-                <button
+                <HeaderIconButton
                   onClick={handleCopy}
-                  className={`p-1.5 rounded-md transition-colors flex-shrink-0 cursor-pointer ${enableFullscreen ? 'ml-1' : ''}`}
-                  style={{ color: codePanelColors.textMuted }}
-                  onMouseEnter={(e) => {
-                    e.currentTarget.style.backgroundColor = codePanelColors.tabHoverBg;
-                    e.currentTarget.style.color = codePanelColors.text;
-                  }}
-                  onMouseLeave={(e) => {
-                    e.currentTarget.style.backgroundColor = 'transparent';
-                    e.currentTarget.style.color = codePanelColors.textMuted;
-                  }}
                   title="Copy code"
-                  aria-label="Copy code to clipboard"
+                  ariaLabel="Copy code to clipboard"
+                  marginClass={enableFullscreen ? 'ml-1' : ''}
                 >
-                  {copied ? (
-                    <i className="fa-solid fa-check text-[14px] text-emerald-500" aria-hidden="true" />
-                  ) : (
-                    <i className="fa-regular fa-copy text-[14px]" aria-hidden="true" />
-                  )}
-                </button>
+                  {copyIcon}
+                </HeaderIconButton>
               )}
             </div>
           </div>
@@ -447,47 +472,25 @@ export function CodePanel({
           </div>
           {/* Expand Button */}
           {enableFullscreen && (
-            <button
+            <HeaderIconButton
               onClick={() => setIsModalOpen(true)}
-              className="p-1.5 rounded-md transition-colors flex-shrink-0 ml-auto cursor-pointer"
-              style={{ color: codePanelColors.textMuted }}
-              onMouseEnter={(e) => {
-                e.currentTarget.style.backgroundColor = codePanelColors.tabHoverBg;
-                e.currentTarget.style.color = codePanelColors.text;
-              }}
-              onMouseLeave={(e) => {
-                e.currentTarget.style.backgroundColor = 'transparent';
-                e.currentTarget.style.color = codePanelColors.textMuted;
-              }}
               title="Open in fullscreen"
-              aria-label="Open in fullscreen"
+              ariaLabel="Open in fullscreen"
+              marginClass="ml-auto"
             >
-              <i className="fa-solid fa-expand text-[14px]" aria-hidden="true" />
-            </button>
+              {expandIcon}
+            </HeaderIconButton>
           )}
           {/* Fixed copy button */}
           {!copyHidden && (
-            <button
+            <HeaderIconButton
               onClick={handleCopy}
-              className={`p-1.5 rounded-md transition-colors flex-shrink-0 cursor-pointer ${enableFullscreen ? 'ml-1' : 'ml-auto'}`}
-              style={{ color: codePanelColors.textMuted }}
-              onMouseEnter={(e) => {
-                e.currentTarget.style.backgroundColor = codePanelColors.tabHoverBg;
-                e.currentTarget.style.color = codePanelColors.text;
-              }}
-              onMouseLeave={(e) => {
-                e.currentTarget.style.backgroundColor = 'transparent';
-                e.currentTarget.style.color = codePanelColors.textMuted;
-              }}
               title="Copy code"
-              aria-label="Copy code to clipboard"
+              ariaLabel="Copy code to clipboard"
+              marginClass={enableFullscreen ? 'ml-1' : 'ml-auto'}
             >
-              {copied ? (
-                <i className="fa-solid fa-check text-[14px] text-emerald-500" aria-hidden="true" />
-              ) : (
-                <i className="fa-regular fa-copy text-[14px]" aria-hidden="true" />
-              )}
-            </button>
+              {copyIcon}
+            </HeaderIconButton>
           )}
         </div>
         {/* Custom scrollbar track - always visible when there's overflow */}

package/vendored/lib/language-utils.ts

@@ -19,7 +19,8 @@ export const LANGUAGE_CODES = LANGUAGE_CODES_JSON as readonly LanguageCode[];
 /** BCP-47 syntax check (2-3 letter primary tag + optional 2-4 letter
  *  region/script). Shared by the chat and docs-search REST endpoints to
  *  keep their request-validation contracts identical. Limitation:
- *  3-segment tags like `zh-Hant-HK` are rejected. */
+ *  3-segment tags like `zh-Hant-HK` are rejected. negotiateLanguage does
+ *  NOT use it — Accept-Language needs the looser LANGUAGE_RANGE_RE. */
 export const BCP47_LANGUAGE_RE = /^[a-zA-Z]{2,3}(?:[-_][a-zA-Z]{2,4})?$/;
 
 /**
@@ -577,6 +578,55 @@ export function resolveLanguageWithFallback(
  */
 const MAX_ACCEPT_LANGUAGE_SEGMENTS = 20;
 
+/**
+ * An Accept-Language range after lowercasing and `_` → `-`: a 1-8 letter
+ * primary subtag, then any number of 1-8 alphanumeric subtags (RFC 4647 §2.1).
+ * Deliberately NOT BCP47_LANGUAGE_RE — that is the REST endpoints' request
+ * contract, and it rejects tags real browsers send: numeric regions (`es-419`)
+ * and three-subtag tags (`zh-Hant-TW`, `sr-Latn-RS`).
+ */
+const LANGUAGE_RANGE_RE = /^[a-z]{1,8}(?:-[a-z0-9]{1,8})*$/;
+
+/** RFC 5646 §4.4.1's minimum tag buffer. No browser sends a longer tag, and it
+ *  bounds the truncation loop below on an attacker-controlled header. */
+const MAX_LANGUAGE_TAG_LENGTH = 35;
+
+/** Chinese regions and the script each one writes in. Browsers send the
+ *  region (`zh-TW`); docs.json offers the script (`zh-Hant`). */
+const CHINESE_REGION_SCRIPT: Record<string, 'zh-hant' | 'zh-hans'> = {
+  tw: 'zh-hant',
+  hk: 'zh-hant',
+  mo: 'zh-hant',
+  cn: 'zh-hans',
+  sg: 'zh-hans',
+  my: 'zh-hans',
+};
+
+/**
+ * Lookup order for one lowercased, validated tag: the tag itself, then with
+ * subtags dropped from the right (RFC 4647 §3.4). Chinese also gets its script
+ * inserted before the bare `zh` (`zh-tw` → `zh-tw`, `zh-hant`, `zh`). A tag
+ * that NAMES the Hant script never falls back to bare `zh`: this platform
+ * labels that 简体中文 (LANGUAGE_DISPLAY_NAMES), so the reader would get the
+ * other script. Staying on the default language is the better answer.
+ */
+function lookupCandidates(tag: string): string[] {
+  const subtags = tag.split('-');
+  const candidates: string[] = [];
+  for (let n = subtags.length; n > 0; n--) candidates.push(subtags.slice(0, n).join('-'));
+  if (subtags[0] !== 'zh') return candidates;
+
+  const rest = subtags.slice(1);
+  if (rest.includes('hant')) return candidates.filter((c) => c !== 'zh');
+  if (rest.includes('hans')) return candidates;
+  const script = rest
+    .map((s) => (Object.hasOwn(CHINESE_REGION_SCRIPT, s) ? CHINESE_REGION_SCRIPT[s] : undefined))
+    .find(Boolean);
+  // candidates always ends with the bare 'zh'; the script goes just before it.
+  if (script) candidates.splice(candidates.length - 1, 0, script);
+  return candidates;
+}
+
 /**
  * Pick the best available language for an Accept-Language header.
  *
@@ -586,9 +636,10 @@ const MAX_ACCEPT_LANGUAGE_SEGMENTS = 20;
  * serve. This function never throws; middleware has no error boundary, so a
  * throw here would 500 the page.
  *
- * Matching is case-insensitive and two-pass: an exact tag match (`zh-Hans`)
- * beats a base-language match (`zh`), so a site offering both gets the precise
- * one.
+ * Matching is case-insensitive RFC 4647 lookup: each tag is tried whole, then
+ * with subtags dropped from the right (`zh-hant-tw` → `zh-hant`), so the most
+ * specific language the site offers wins. Chinese is script-aware — see
+ * lookupCandidates.
  */
 export function negotiateLanguage(
   header: string | null,
@@ -609,10 +660,10 @@ export function negotiateLanguage(
 
   for (const segment of segments) {
     const [rawTag, ...params] = segment.trim().split(';');
-    const tag = rawTag.trim().toLowerCase();
+    const tag = rawTag.trim().toLowerCase().replace(/_/g, '-');
     // '*' means "anything" — it expresses no preference, so we decline to guess.
     if (!tag || tag === '*') continue;
-    if (!BCP47_LANGUAGE_RE.test(tag)) continue;
+    if (tag.length > MAX_LANGUAGE_TAG_LENGTH || !LANGUAGE_RANGE_RE.test(tag)) continue;
 
     let q = 1;
     for (const param of params) {
@@ -636,14 +687,10 @@ export function negotiateLanguage(
   const defaultLower = defaultLang.toLowerCase();
 
   for (const { tag } of parsed) {
-    // Pass 1: exact tag ('zh-hans' -> 'zh-Hans').
-    const exact = availableByLower.get(tag);
-    if (exact) return exact.toLowerCase() === defaultLower ? null : exact;
-
-    // Pass 2: base language ('fr-ca' -> 'fr').
-    const base = tag.split('-')[0];
-    const baseMatch = availableByLower.get(base);
-    if (baseMatch) return baseMatch.toLowerCase() === defaultLower ? null : baseMatch;
+    for (const candidate of lookupCandidates(tag)) {
+      const match = availableByLower.get(candidate);
+      if (match) return match.toLowerCase() === defaultLower ? null : match;
+    }
   }
 
   return null;

package/vendored/lib/languages-artifact.ts

@@ -14,8 +14,11 @@
  * side imports THIS module `import type`-only, so none of that reaches the
  * middleware bundle.
  *
- * `languages` and `defaultLanguage` are lowercased at build time by
- * normalizeLanguageList(), so comparisons at the edge need no normalization.
+ * `languages` and `defaultLanguage` keep the casing docs.json declares. The
+ * schema enum makes that the canonical casing, and it is the only one `/<code>`
+ * renders for (isValidLanguageCode is case-sensitive), so the edge compares
+ * case-insensitively but emits these strings verbatim. Descriptors written
+ * before 2026-09-22 are all-lowercase; the edge reads both.
  */
 import { normalizeLanguageList } from './locale-helpers';
 import { findFirstPage } from './root-page-slug';
@@ -107,8 +110,9 @@ function normalizePagePath(value: string): string {
  *    if it is the one `/<code>` lands on; two hundred are not enough if it is
  *    missing. Resolution goes through findFirstPage — the same module the HTML
  *    renderer and the markdown export both use — so this check cannot drift
- *    from what the URL actually serves; it is called with the lowercased code
- *    because that is the segment decideLanguageRedirect emits.
+ *    from what the URL actually serves; it is called with the DECLARED code
+ *    because findFirstPage matches the nav block exactly and that is the
+ *    segment decideLanguageRedirect emits.
  *
  * The default language is exempt from (2). It is never a redirect destination
  * — decideLanguageRedirect returns null as soon as the negotiated language is
@@ -137,13 +141,21 @@ export function buildLanguagesArtifact(
   // have silently changed which pages get translated or how chunks are
   // locale-tagged — a much bigger blast radius than this feature.
   const eligible = (nav?.languages ?? []).filter((l) => l.hidden !== true && !l.href);
-  const entries = normalizeLanguageList(eligible);
+  // normalizeLanguageList decides the default and lowercases the code for its
+  // chunk-locale caller. The code is taken back from the entry it came from
+  // (same order, one-to-one): lowercased, findFirstPage misses a `pt-BR` block
+  // and the redirect would emit a `/pt-br` that does not render.
+  const entries = normalizeLanguageList(eligible).map((entry, i) => ({
+    code: eligible[i].language,
+    isDefault: entry.isDefault,
+  }));
 
   const built = new Set(builtPagePaths.map(normalizePagePath));
   const routable = entries.filter((entry) => {
     if (entry.isDefault) return true;
     const landing = normalizePagePath(findFirstPage(docsConfig, entry.code));
-    return landing.startsWith(`${entry.code}/`) && built.has(landing);
+    // normalizePagePath lowercases, so the prefix must be lowercase too.
+    return landing.startsWith(`${entry.code.toLowerCase()}/`) && built.has(landing);
   });
 
   if (routable.length < 2) return noRoutingDescriptor();

package/vendored/lib/middleware-helpers.ts

@@ -1344,17 +1344,30 @@ export async function customDomainOnlyBlock(args: {
  * feature for every subpath-mounted site.
  */
 export function isLocaleRootPath(pathname: string): boolean {
+  return localeRootBase(pathname) !== null;
+}
+
+/**
+ * The redirect base for a locale root — `''` for the site root, `'/docs'` for
+ * the hostAtDocs root — or null for any other path. The ONE place the
+ * trailing-slash trim lives: isLocaleRootPath gates on it and
+ * decideLanguageRedirect builds its destination from it, so the two cannot
+ * disagree about what a root is.
+ */
+export function localeRootBase(pathname: string): '' | '/docs' | null {
   // The type says string, and the only call site (proxy.ts's `if (routing?.rewrite)`
   // guard, plus the always-string `request.nextUrl.pathname` fallback) guarantees
   // one — so this branch is unreachable today. It stays because edge middleware has
-  // no error boundary: a throw here 500s every docs page, while returning false just
+  // no error boundary: a throw here 500s every docs page, while returning null just
   // declines to redirect, the same fail-safe direction as every other path in this
   // feature. One line of insurance against a future caller that isn't as careful.
-  if (typeof pathname !== 'string') return false;
+  if (typeof pathname !== 'string') return null;
   const trimmed = pathname.endsWith('/') && pathname.length > 1
     ? pathname.slice(0, -1)
     : pathname;
-  return trimmed === '' || trimmed === '/' || trimmed === '/docs';
+  if (trimmed === '' || trimmed === '/') return '';
+  if (trimmed === '/docs') return '/docs';
+  return null;
 }
 
 /**
@@ -1508,7 +1521,8 @@ export function decideLanguageRedirect(
   if (isBotUserAgent(userAgent)) return null;
   // Bare docs root only. An explicit /<lang> root is the visitor's own stated
   // language and is never redirected away from — see isLocaleRootPath.
-  if (!isLocaleRootPath(pathname)) return null;
+  const base = localeRootBase(pathname);
+  if (base === null) return null;
   if (routing.languages.length < 2) return null;
 
   const available = routing.languages;
@@ -1525,20 +1539,16 @@ export function decideLanguageRedirect(
   // nothing" — not "fall back to the default". An earlier draft wrote
   // `?? defaultLang` here, which turned every unmatched visitor into a
   // redirect to the default root.
-  // negotiateLanguage already returns `string | null` (never undefined), so
-  // wrapping it in another `?? null` added nothing — the single trailing one
-  // normalizes the `undefined` that `?.toLowerCase()` produces when it's null.
-  const negotiated = cookieMatch
-    ? cookieMatch.toLowerCase()
-    : negotiateLanguage(acceptLanguage, available, defaultLang)?.toLowerCase() ?? null;
-  if (!negotiated) return null;
+  // Kept in the descriptor's own casing, never lowercased: it becomes the URL
+  // segment and the cookie value, and `/pt-BR` renders where `/pt-br` does not
+  // (isValidLanguageCode is case-sensitive). Both sources already return a
+  // member of `available` as spelled there — cookieMatch by construction,
+  // negotiateLanguage by contract.
+  const chosen = cookieMatch ?? negotiateLanguage(acceptLanguage, available, defaultLang);
+  if (!chosen) return null;
 
   // Already where they belong: the bare root IS the default-language root.
-  if (negotiated === defaultLang) return null;
+  if (chosen.toLowerCase() === defaultLang) return null;
 
-  const trimmed = pathname.endsWith('/') && pathname.length > 1
-    ? pathname.slice(0, -1)
-    : pathname;
-  const base = trimmed === '/docs' ? '/docs' : '';
-  return { pathname: `${base}/${negotiated}`, language: negotiated, viaCookie: !!cookieMatch };
+  return { pathname: `${base}/${chosen}`, language: chosen, viaCookie: !!cookieMatch };
 }

package/vendored/lib/page-timestamps.ts

@@ -143,6 +143,14 @@ export function injectLastUpdated(content: string, date: string): string {
   return `---\n${newInner}\n---\n${content.slice(match[0].length)}`;
 }
 
+/**
+ * `YYYY-MM-DD`, optionally followed by an ISO time (`T` or a space, `HH:MM`,
+ * optional seconds and fraction, optional `Z` / `±HH:MM` / `±HHMM`). Hours
+ * 00-23, minutes/seconds 00-59.
+ */
+const ISO_DATE_RE =
+  /^(\d{4})-(\d{2})-(\d{2})(?:[T ](?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?)?$/;
+
 /**
  * Normalize a frontmatter date value to `YYYY-MM-DD`, or undefined.
  *
@@ -152,17 +160,28 @@ export function injectLastUpdated(content: string, date: string): string {
  * a Date must be formatted in UTC — rendering it raw produces a
  * timezone-shifted `Date.toString()` inside `<time dateTime>`, the same bug
  * injectLastUpdated() quotes its own output to avoid.
+ *
+ * Strings are matched against ISO_DATE_RE and the LITERAL date part is used —
+ * never `new Date(string)`, which parses a bare ISO date as UTC but anything
+ * else in local time (so "September 1, 2026" moved a day under a non-UTC TZ)
+ * and invents a year for "Sept 1" (2001 in V8). Impossible calendar dates
+ * (2026-02-30) are rejected rather than rolled over. Anything rejected returns
+ * undefined, so resolveLastUpdated falls back to the git date.
  */
 function normalizeDateValue(value: unknown): string | undefined {
   if (value instanceof Date) {
     return Number.isNaN(value.getTime()) ? undefined : value.toISOString().slice(0, 10);
   }
   if (typeof value !== 'string') return undefined;
-  const trimmed = value.trim();
-  if (!trimmed) return undefined;
-  const parsed = new Date(trimmed);
-  if (Number.isNaN(parsed.getTime())) return undefined;
-  return parsed.toISOString().slice(0, 10);
+  const match = ISO_DATE_RE.exec(value.trim());
+  if (!match) return undefined;
+  const [, year, month, day] = match;
+  const utc = new Date(Date.UTC(Number(year), Number(month) - 1, Number(day)));
+  const isRealDate =
+    utc.getUTCFullYear() === Number(year) &&
+    utc.getUTCMonth() === Number(month) - 1 &&
+    utc.getUTCDate() === Number(day);
+  return isRealDate ? `${year}-${month}-${day}` : undefined;
 }
 
 /**

package/vendored/lib/rehype-code-meta.ts

@@ -87,7 +87,7 @@ function parseShowLineNumbers(meta: string): boolean {
  * with any quoted title stripped first so `title="My nocopy guide"` (the word
  * appearing inside free-text title, not as the flag) does not trigger it either.
  */
-function parseNocopy(meta: string): boolean {
+export function parseNocopy(meta: string): boolean {
   return /\bnocopy\b/.test(meta.replace(/title=(["'])(?:(?!\1).)*\1/g, ''));
 }
 
@@ -290,18 +290,24 @@ export const rehypeRestoreDataTitle: Plugin<[], Root> = () => {
         const dataMeta = node.properties['data-meta'] as string | undefined;
         const dataLanguage = node.properties['data-language'] as string | undefined;
 
-        if (!dataMeta || dataMeta.includes(':')) return;
+        if (!dataMeta) return;
 
-        // An explicit `title="..."` always wins. Promote the PARSED value,
-        // never the raw `data-meta` string — using raw meta here shipped
-        // `title="/snippets/counter.tsx"` as the literal on-page caption
-        // instead of `/snippets/counter.tsx` (pre-existing since 7ed2dfe26).
+        // An explicit `title="..."` always wins — checked BEFORE the colon
+        // guard below, or `title="Step 1: config.ts"` lost its caption.
+        // Promote the PARSED value, never the raw `data-meta` string — using
+        // raw meta here shipped `title="/snippets/counter.tsx"` as the
+        // literal on-page caption instead of `/snippets/counter.tsx`
+        // (pre-existing since 7ed2dfe26).
         const explicitTitle = parseTitle(dataMeta);
         if (explicitTitle) {
           node.properties['data-title'] = explicitTitle;
           return;
         }
 
+        // Colon-bearing meta without an explicit title looks like a status
+        // code (`200: OK`), not a caption — leave it alone.
+        if (dataMeta.includes(':')) return;
+
         // Strip nocopy BEFORE classifying, not after: `JavaScript nocopy`
         // must still read as the "javascript" language label. Classifying
         // the raw meta first would test "JavaScript nocopy" against

package/vendored/lib/shiki-transformers.ts

@@ -12,6 +12,7 @@ import {
   transformerMetaHighlight,
   transformerNotationDiff,
 } from '@shikijs/transformers';
+import { parseNocopy } from './rehype-code-meta';
 
 // Class names for CSS styling
 export const LINE_HIGHLIGHT_CLASS = 'highlighted';
@@ -51,11 +52,9 @@ function getParsedMeta(meta: string): ParsedMeta {
     showLineNumbers: /\bshowLineNumbers\b/.test(meta),
     startLine: parseStartLineImpl(meta),
     title: parseTitleImpl(meta),
-    // Word-boundary so `nocopyright.txt` is unaffected. Scanned on the meta
-    // with any quoted title removed first: a fence written
-    // `title="My nocopy guide"` must not set the flag, and must not have its
-    // caption mangled by the strip in rehypeRestoreDataTitle.
-    nocopy: /\bnocopy\b/.test(meta.replace(/title=(["'])(?:(?!\1).)*\1/g, '')),
+    // Shared with rehypeCodeMeta/rehypeRestoreDataTitle so the pre-Shiki and
+    // post-Shiki stages cannot disagree about which fences are flagged.
+    nocopy: parseNocopy(meta),
   };
 
   // Prevent unbounded cache growth