jamdesk 1.1.213 → 1.1.215

package/vendored/lib/indexnow.ts

@@ -9,6 +9,12 @@ import { createHash } from 'crypto';
 
 const INDEXNOW_ENDPOINT = 'https://api.indexnow.org/indexnow';
 const FETCH_TIMEOUT_MS = 5_000;
+
+/** Identifies the key self-check to bot protection (no shared outbound UA constant exists). */
+const INDEXNOW_CHECK_USER_AGENT = 'Jamdesk-IndexNow-KeyCheck/1.0 (+https://jamdesk.com)';
+// Separate from the single-URL GET budget: a batch body can carry thousands of
+// URLs, so the POST needs more headroom than a one-URL ping.
+const BATCH_FETCH_TIMEOUT_MS = 15_000;
 const MAX_BATCH_SIZE = 10_000;
 const KEY_SALT = 'jamdesk-indexnow-v1';
 
@@ -48,38 +54,185 @@ export function buildChangedUrls(
   });
 }
 
-/** Submit URLs to IndexNow. Single URL uses GET, multiple uses batch POST. */
+/**
+ * Submit URLs to IndexNow. Single URL uses GET, multiple uses batch POST.
+ *
+ * @param keyLocation - Where the key file is served. Omit for root tenants
+ *   (IndexNow's default `/{key}.txt` lookup works); required for prefixed
+ *   tenants (see the comment at the batch call below).
+ */
 export async function submitToIndexNow(
-  urls: string[], host: string, key: string
+  urls: string[], host: string, key: string, keyLocation?: string
 ): Promise<IndexNowResult> {
   if (urls.length === 0) {
     return { success: true, status: 200, submitted: 0 };
   }
 
-  const timeoutSignal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
-
   if (urls.length === 1) {
     const params = new URLSearchParams({ url: urls[0], key });
+    if (keyLocation) params.set('keyLocation', keyLocation);
     const res = await fetch(`${INDEXNOW_ENDPOINT}?${params}`, {
-      signal: timeoutSignal,
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
     });
     return { success: isSuccessStatus(res.status), status: res.status, submitted: 1 };
   }
 
   const submitted = Math.min(urls.length, MAX_BATCH_SIZE);
-  // keyLocation omitted — IndexNow requires it at the root level of the host,
-  // and our key verification route is at /api/indexnow/{key} (a subdirectory).
-  // When omitted, IndexNow defaults to /{key}.txt which it verifies asynchronously.
+  // keyLocation is sent only when the caller passes it. Prefixed tenants
+  // (/docs, /help) need it: their Cloudflare Worker proxies only the prefix, so
+  // IndexNow's default root lookup (/{key}.txt) never reaches us, and a key
+  // served under /docs/ authorizes /docs/* URLs. The old /api/indexnow/{key}
+  // location was rejected because it did not sit above the page URLs it claimed.
   const res = await fetch(INDEXNOW_ENDPOINT, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json; charset=utf-8' },
-    signal: timeoutSignal,
+    signal: AbortSignal.timeout(BATCH_FETCH_TIMEOUT_MS),
     body: JSON.stringify({
       host,
       key,
+      ...(keyLocation ? { keyLocation } : {}),
       urlList: urls.slice(0, MAX_BATCH_SIZE),
     }),
   });
 
   return { success: isSuccessStatus(res.status), status: res.status, submitted };
 }
+
+export interface IndexNowKeyCheck {
+  /**
+   * `ok`: 200 and the body is the key.
+   * `missing`: a definite misconfiguration (404/410, 200 with a different body,
+   * or any 3xx), so submitting would only be discarded.
+   * `inconclusive`: we could not tell (401/403/429/5xx, timeout, network error).
+   */
+  status: 'ok' | 'missing' | 'inconclusive';
+  /** Absent when no response arrived (timeout, network error). */
+  httpStatus?: number;
+  /** Value of the `cf-mitigated` response header (e.g. `challenge`), when sent. */
+  mitigated?: string;
+}
+
+/**
+ * Self-check that the key file is served before we submit. IndexNow verifies
+ * it asynchronously and silently discards submissions it cannot verify, so a
+ * missing key file is otherwise invisible.
+ *
+ * Tri-state on purpose: only a definite `missing` should suppress the
+ * submission. Bot protection (a Cloudflare challenge, a 403/429) or a transient
+ * 5xx on a customer zone blocks OUR check without saying anything about
+ * IndexNow's own fetcher, and before this check existed we submitted without
+ * any verification, so `inconclusive` callers should still submit (and warn).
+ *
+ * `redirect: 'manual'` because IndexNow's own fetch behaviour on redirects is
+ * undocumented: a key that only resolves through a redirect is treated as
+ * `missing` rather than optimistically trusted.
+ */
+export async function verifyIndexNowKeyFile(keyFileUrl: string, key: string): Promise<IndexNowKeyCheck> {
+  try {
+    const res = await fetch(keyFileUrl, {
+      // Descriptive UA: Node's default is a common target for bot challenges on
+      // Vercel, Cloudflare or a customer zone.
+      headers: { 'User-Agent': INDEXNOW_CHECK_USER_AGENT },
+      redirect: 'manual',
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    const httpStatus = res.status;
+    const mitigated = res.headers?.get('cf-mitigated') ?? undefined;
+    const withEvidence = (status: IndexNowKeyCheck['status']): IndexNowKeyCheck => ({
+      status,
+      httpStatus,
+      ...(mitigated ? { mitigated } : {}),
+    });
+
+    if (httpStatus === 200) {
+      return withEvidence((await res.text()).trim() === key ? 'ok' : 'missing');
+    }
+    if (httpStatus === 404 || httpStatus === 410 || (httpStatus >= 300 && httpStatus < 400)) {
+      return withEvidence('missing');
+    }
+    return withEvidence('inconclusive');
+  } catch {
+    // Timeout, DNS/TLS failure or a body-read error: no evidence either way.
+    return { status: 'inconclusive' };
+  }
+}
+
+export interface IndexNowPlanInput {
+  slug: string;
+  /** Custom domain (bare host); undefined for *.jamdesk.app tenants. */
+  domain?: string;
+  /** e.g. https://jamdesk.com — no trailing slash, no prefix. */
+  baseUrl: string;
+  /** '' | '/docs' | '/help' */
+  docsPrefix: string;
+  /** Site-wide robots noindex. */
+  noindex: boolean;
+  /** build.ts authPlaneGated. */
+  authGated: boolean;
+  /** Changed .mdx paths (extension stripped, locale-prefixed like `fr/intro`). */
+  mdxChangedPaths: string[];
+  mdxDeletedPaths: string[];
+  /** null = unavailable, so fail closed. */
+  pageIndexability: ReadonlyMap<string, boolean> | null;
+}
+
+export interface IndexNowSubmission {
+  urls: string[];
+  host: string;
+  key: string;
+  /** Where the key is served (always set; used for the self-check). */
+  keyFileUrl: string;
+  /** Sent to IndexNow only for prefixed tenants. */
+  keyLocation?: string;
+  /** URLs dropped past MAX_BATCH_SIZE. */
+  truncated: number;
+}
+
+/**
+ * Decide what (if anything) to tell IndexNow after a build. Pure: never
+ * mutates its inputs (changedPaths and mdxChangedPaths can be the same array).
+ *
+ * Returns null — submit nothing — when the site is noindex or auth-gated, when
+ * indexability is unknown (fail closed), or when a prefixed tenant has no
+ * custom domain (its *.jamdesk.app URLs are x-jd-noindex, so not canonical).
+ *
+ * A changed page is kept only if the sitemap would list it. Deleted pages are
+ * kept because they are absent from the build by definition; IndexNow is how
+ * engines learn to drop them. Pages that just became hidden/noindex are NOT
+ * submitted — engines drop them on their next crawl, and we cannot tell "just
+ * became hidden" from "was always hidden" without the previous build's state.
+ *
+ * The same blindness applies to deletions: a deleted page is submitted even if
+ * it was noindex or hidden before it was deleted. We have no previous-build
+ * visibility to tell, and the cost is benign (engines fetch the URL, get a
+ * 404, and drop it or ignore it).
+ */
+export function planIndexNowSubmission(input: IndexNowPlanInput): IndexNowSubmission | null {
+  const {
+    slug, domain, baseUrl, docsPrefix, noindex, authGated,
+    mdxChangedPaths, mdxDeletedPaths, pageIndexability,
+  } = input;
+
+  if (noindex || authGated || pageIndexability === null) return null;
+  if (docsPrefix !== '' && !domain) return null;
+
+  const deleted = new Set(mdxDeletedPaths);
+  const kept = [...new Set([...mdxChangedPaths, ...mdxDeletedPaths])].filter(
+    (p) => pageIndexability.get(p) === true || deleted.has(p),
+  );
+  if (kept.length === 0) return null;
+
+  const capped = kept.slice(0, MAX_BATCH_SIZE);
+  const key = generateIndexNowKey(slug);
+  const keyFileUrl = `${baseUrl}${docsPrefix}/${key}.txt`;
+
+  return {
+    urls: buildChangedUrls(capped, baseUrl, docsPrefix !== '', docsPrefix),
+    host: new URL(baseUrl).host,
+    key,
+    keyFileUrl,
+    // Root tenants: IndexNow's default /{key}.txt lookup already works.
+    keyLocation: docsPrefix ? keyFileUrl : undefined,
+    truncated: kept.length - capped.length,
+  };
+}

package/vendored/lib/layout-helpers.tsx

@@ -114,7 +114,7 @@ export const figtree = Figtree({
 export const ibmPlexSerif = IBM_Plex_Serif({
   subsets: ['latin'],
   display: 'swap',
-  weight: ['400', '600'],
+  weight: ['400', '500', '600'],
   variable: '--font-serif',
   preload: false,
 });

package/vendored/lib/mailfully.ts

@@ -0,0 +1,86 @@
+// DO NOT EDIT — this file is auto-synced from shared/. Edit the source in shared/ and run ./scripts/sync-shared.sh
+
+/**
+ * Minimal Mailfully client — the one call Jamdesk makes (send an email).
+ * Not the `mailfully` npm SDK on purpose: it requires Node 24 and is
+ * ESM-only, and our Firebase Functions run Node 22. Never throws: every
+ * failure (transport, non-2xx, bad JSON) comes back on the error arm.
+ */
+
+export type MailfullySendInput = {
+  from: string;
+  to: string | string[];
+  cc?: string | string[];
+  bcc?: string | string[];
+  replyTo?: string | string[];
+  subject: string;
+  html?: string;
+  text?: string;
+  headers?: Record<string, string>;
+  tags?: { name: string; value: string }[];
+  type?: "transactional" | "marketing";
+};
+
+export type MailfullyResult =
+  | { data: { id: string; status: "queued" | "canceled" }; error: null }
+  | {
+      data: null;
+      error: {
+        statusCode: number | null;
+        type: string | null;
+        message: string;
+        retryAfter: number | null;
+      };
+    };
+
+const DEFAULT_BASE_URL = "https://api.mailfully.com";
+
+function fail(
+  statusCode: number | null,
+  type: string | null,
+  message: string,
+  retryAfter: number | null,
+): MailfullyResult {
+  return { data: null, error: { statusCode, type, message, retryAfter } };
+}
+
+export async function sendMailfullyEmail(
+  apiKey: string,
+  input: MailfullySendInput,
+  opts: { idempotencyKey?: string; baseUrl?: string } = {},
+): Promise<MailfullyResult> {
+  const { replyTo, ...rest } = input;
+  const body = { ...rest, ...(replyTo ? { reply_to: replyTo } : {}) };
+  let res: Response;
+  try {
+    res = await fetch(`${opts.baseUrl ?? DEFAULT_BASE_URL}/v1/emails`, {
+      method: "POST",
+      headers: {
+        "Authorization": `Bearer ${apiKey}`,
+        "Content-Type": "application/json",
+        ...(opts.idempotencyKey ?
+          { "Idempotency-Key": opts.idempotencyKey } : {}),
+      },
+      body: JSON.stringify(body),
+      // A hung request would otherwise hold a newsletter run or a function
+      // until its own timeout; a timeout comes back as a transport error.
+      signal: AbortSignal.timeout(15_000),
+    });
+  } catch (err) {
+    return fail(null, null, (err as Error).message, null);
+  }
+  const retryAfter = Number(res.headers.get("retry-after")) || null;
+  let json: unknown;
+  try {
+    json = await res.json();
+  } catch {
+    return fail(res.status, null, "Malformed JSON response", retryAfter);
+  }
+  if (!res.ok) {
+    const e = (json as { error?: { type?: string; message?: string } }).error;
+    return fail(res.status, e?.type ?? null,
+      e?.message ?? `HTTP ${res.status}`, retryAfter);
+  }
+  const { id, status } = json as { id: string; status: "queued" | "canceled" };
+  return { data: { id, status }, error: null };
+}

package/vendored/lib/markdown-absolute-links.ts

@@ -0,0 +1,197 @@
+import { unified, type Processor } from 'unified';
+import remarkParse from 'remark-parse';
+import remarkGfm from 'remark-gfm';
+import { visit } from 'unist-util-visit';
+import type { Root, Link, Definition, Html } from 'mdast';
+import { prefixRelativeHref } from './link-prefix-helpers';
+
+/**
+ * Rewrite root-relative page links in a served `.md` export to absolute URLs
+ * on the tenant's public host.
+ *
+ * Two reasons, both about agents reading the markdown away from the page:
+ *
+ *  - The export is the author's MDX, so links are written as the author typed
+ *    them (`/setup/access-control`). The HTML renderer adds the tenant's docs
+ *    prefix to those hrefs (prefixRelativeHref), the export never did. On a
+ *    subpath-mounted site such as jamdesk.com/docs, `/setup/access-control`
+ *    resolves to the marketing site, not the docs page.
+ *  - Agent pipelines drop the fetch URL (RAG chunks, summaries, pastes), so even
+ *    a correct root-relative link stops resolving. afdocs 0.22's
+ *    `markdown-link-portability` check warns on every page that has one.
+ *
+ * Only `[text](/path)` links and `[id]: /path` definitions are rewritten, with
+ * the same prefix rule the HTML renderer applies to `<a href>`. Images are left
+ * alone: custom-domain images are served through `/_jd/images`, not the docs
+ * prefix, so the anchor rule would point them at a 404. Code spans and fenced
+ * code are never touched because they are not link nodes in the parse tree.
+ *
+ * `baseUrl` is the public docs root (e.g. `https://jamdesk.com/docs`, from
+ * getBaseUrl). `linkPrefix` is the prefix the HTML renderer puts on anchors
+ * for this request. The two can differ: a subdomain served at the root whose
+ * custom domain serves at `/help`. So a link is first resolved the renderer's
+ * way, then the renderer's prefix is swapped for the base URL.
+ */
+export function absolutizeMarkdownLinks(
+  markdown: string,
+  baseUrl: string,
+  linkPrefix: string,
+): string {
+  // Cheap exit: most pages have no root-relative link at all, and the parse is
+  // the only non-trivial cost on this route.
+  if (!/\]\(\s*<?\/(?!\/)|\]:\s*<?\/(?!\/)/.test(markdown)) return markdown;
+
+  // Frontmatter is YAML, not markdown: blank it (same length, newlines kept)
+  // so offsets still line up with `markdown` but nothing in it is parsed.
+  const fm = markdown.match(FRONTMATTER_RE);
+  const source = blankTagLines(
+    fm ? blank(fm[0]) + markdown.slice(fm[0].length) : markdown,
+  );
+
+  const edits: Edit[] = [];
+  try {
+    collectEdits(source, 0, baseUrl.replace(/\/+$/, ''), linkPrefix, edits, 0);
+  } catch {
+    return markdown;
+  }
+  if (edits.length === 0) return markdown;
+
+  let out = markdown;
+  for (const e of edits.sort((a, b) => b.start - a.start)) {
+    out = out.slice(0, e.start) + e.url + out.slice(e.end);
+  }
+  return out;
+}
+
+interface Edit { start: number; end: number; url: string }
+
+/**
+ * The source is MDX, and MDX has no indented code blocks: prose indented
+ * inside `<Step>` or `<Tab>` is still prose, and the HTML page renders its
+ * links. Plain markdown would read it as code and skip the link, so turn the
+ * construct off the way remark-mdx does. Fenced code is unaffected.
+ */
+function mdxIndentation(this: Processor) {
+  const data = this.data();
+  const list = (data.micromarkExtensions ??= []) as unknown[];
+  list.push({ disable: { null: ['codeIndented'] } });
+}
+
+/** Built once: the export route runs this on every uncached `.md` request. */
+const parser = unified().use(remarkParse).use(remarkGfm).use(mdxIndentation);
+
+/** Same anchored frontmatter match as agent-directive.tsx. */
+const FRONTMATTER_RE = /^\uFEFF?---\r?\n[\s\S]*?\r?\n---(\r?\n|$)/;
+
+/** Replace every character except line breaks with a space. */
+function blank(text: string): string {
+  return text.replace(/[^\r\n]/g, ' ');
+}
+
+/** One opening or closing tag. `[^>]*` stops at the first `>`, which is fine: only offsets matter. */
+const TAG = /<\/?[A-Za-z][^>]*>/g;
+
+/** A line made only of tags: `<Tab title="Py">`, `</Steps>`, `<iframe ...></iframe>`. */
+const TAG_ONLY_LINE = /^[ \t]*(?:<\/?[A-Za-z][^>]*>[ \t]*)+$/;
+
+/**
+ * Blank every tag-only line (same length) before parsing.
+ *
+ * A component tag directly above a fence (`<CodeGroup>` then a code fence) parses
+ * as a CommonMark HTML block that ends at the first blank line in the code.
+ * The rest of the code is then read as prose and its links rewritten, and
+ * the closing fence opens a new fence that swallows the prose after it. MDX
+ * never reads the tag as HTML, so with the tag lines gone the plain parser
+ * sees the same fences and paragraphs MDX does. Only offsets matter here, and
+ * blanking keeps them.
+ */
+function blankTagLines(text: string): string {
+  return text
+    .split(/(\r?\n)/)
+    .map((part) => (TAG_ONLY_LINE.test(part) ? blank(part) : part))
+    .join('');
+}
+
+/**
+ * Walk one parse of `text` (which starts at `base` in the original string)
+ * and record a rewrite for every root-relative link or definition.
+ *
+ * Tag-only lines are blanked before the first pass, but a line that mixes a
+ * tag with text (`<li>See [a](/x).</li>`) still starts a raw HTML node that
+ * hides the links in it. MDX renders those as links, so such a node is parsed
+ * again with every tag in it blanked. One level of nesting per pass, capped
+ * so pathological input cannot recurse.
+ */
+function collectEdits(
+  text: string,
+  base: number,
+  baseUrl: string,
+  linkPrefix: string,
+  edits: Edit[],
+  depth: number,
+): void {
+  const tree = parser.parse(text) as Root;
+
+  visit(tree, (node) => {
+    if (node.type === 'html') {
+      const start = node.position?.start.offset;
+      if (start === undefined || depth >= 4) return;
+      const end = node.position?.end.offset;
+      const value = (node as Html).value;
+      if (end === undefined || value.trimStart().startsWith('<!--')) return;
+      // Inside a container (blockquote, list item) mdast strips the `> ` or
+      // indent from continuation lines, so `value` is no longer the source
+      // span and its offsets would land in the wrong place. Skip those.
+      if (text.slice(start, end) !== value) return;
+      const inner = value.replace(TAG, blank);
+      if (inner !== value) {
+        collectEdits(inner, base + start, baseUrl, linkPrefix, edits, depth + 1);
+      }
+      return;
+    }
+    if (node.type !== 'link' && node.type !== 'definition') return;
+    const n = node as Link | Definition;
+    const url = n.url;
+    if (!url.startsWith('/') || url.startsWith('//')) return;
+    const start = n.position?.start.offset;
+    const end = n.position?.end.offset;
+    if (start === undefined || end === undefined) return;
+
+    // The destination sits after the label: `](` for a link, `]:` for a
+    // definition. Search from the end of the label so link text that happens
+    // to contain the same path is never the match.
+    const labelEnd = n.type === 'link' && n.children.length > 0
+      ? n.children[n.children.length - 1].position?.end.offset ?? start
+      : start;
+    const opener = n.type === 'link' ? '](' : ']:';
+    const openAt = text.indexOf(opener, labelEnd);
+    if (openAt === -1 || openAt >= end) return;
+    let destAt = openAt + opener.length;
+    while (destAt < end && /\s/.test(text[destAt])) destAt++;
+    if (text[destAt] === '<') destAt++;
+
+    // The parser hands back the decoded URL. Skip anything whose source text
+    // differs (entities, escapes) rather than guess at the raw span.
+    if (text.slice(destAt, destAt + url.length) !== url) return;
+
+    edits.push({
+      start: base + destAt,
+      end: base + destAt + url.length,
+      url: toAbsolute(url, baseUrl, linkPrefix),
+    });
+  });
+}
+
+/**
+ * `/setup` → prefixRelativeHref gives the path the HTML page links to
+ * (`/docs/setup`); dropping that renderer prefix leaves the page path under
+ * the docs root, which is then joined to the public base URL.
+ */
+function toAbsolute(url: string, baseUrl: string, linkPrefix: string): string {
+  const rendered = prefixRelativeHref(url, linkPrefix);
+  const underPrefix = linkPrefix &&
+    (rendered === linkPrefix || rendered.startsWith(`${linkPrefix}/`) ||
+      rendered.startsWith(`${linkPrefix}?`) || rendered.startsWith(`${linkPrefix}#`));
+  const pagePath = underPrefix ? rendered.slice(linkPrefix.length) : rendered;
+  return `${baseUrl}${pagePath}`;
+}

package/vendored/lib/middleware-helpers.ts

@@ -347,6 +347,9 @@ export async function validateForwardedHost(
           mappedProject: mappedProject || 'not-registered',
           status: status || 'missing',
         });
+        // dashboard/functions/src/reports/domain-reachability.ts matches
+        // this text (REFUSED_HOST_TEXT) to auto-detach dead retained
+        // domains. Change both together.
         return {
           allowed: false,
           error: `Domain "${forwardedHost}" is not authorized to serve this content.`,
@@ -1190,6 +1193,27 @@ export function isPresentationAsset(pathname: string): boolean {
   return PRESENTATION_EXTENSIONS.some((ext) => p.endsWith(ext));
 }
 
+// Exact shape written by lib/screenshot-capture.ts: a Firestore auto-ID build
+// id, then a per-capture 128-bit random hex file name.
+const SITE_SCREENSHOT_RE = /^\/_screenshots\/[A-Za-z0-9]{20}\/[0-9a-f]{32}\.jpg$/;
+
+/**
+ * The dashboard site-preview screenshot, exempt from the password/JWT gate.
+ *
+ * The dashboard's <img> is a cross-site subresource that never carries the
+ * visitor's jd_auth cookie, so a gated site's preview always 401'd. The random
+ * file name is the capability: the full URL is stored only on the members-only
+ * build doc. The build ID is NOT secret (lastBuildId sits on the projects doc,
+ * readable by any signed-in user), which is why the legacy
+ * `/_screenshots/{buildId}/homepage.jpg` shape stays gated.
+ *
+ * The image is the REAL gated homepage (the capture mints an unlock cookie), so
+ * never widen this match or write the file name anywhere world-readable.
+ */
+export function isSiteScreenshotPath(pathname: string): boolean {
+  return SITE_SCREENSHOT_RE.test(pathname);
+}
+
 /**
  * Should this request be 404'd because the project serves from its custom
  * domain only? Returns the response to send, or null to continue.

package/vendored/lib/navbar-labels.ts

@@ -0,0 +1,34 @@
+import type { NavbarLink, NavbarPrimary } from './docs-types';
+
+/**
+ * Navbar labels in the reader's language. Shared by the header (md and up)
+ * and the mobile drawer (below md), which render the same navbar entries and
+ * must not disagree on what they're called.
+ */
+
+/**
+ * The override for `lang`. Exact key first, then case-insensitive:
+ * extractLanguageFromPath returns codes like 'pt-BR' and 'zh-Hans', while
+ * authors write `labels` keys by hand ("pt-br").
+ */
+function override(labels: Record<string, string> | undefined, lang: string | undefined): string | undefined {
+  if (!lang || !labels) return undefined;
+  if (labels[lang]) return labels[lang];
+  const wanted = lang.toLowerCase();
+  const key = Object.keys(labels).find((k) => k.toLowerCase() === wanted);
+  return key ? labels[key] : undefined;
+}
+
+/** A link's label for `lang`, falling back to `label`. */
+export function navbarLinkLabel(link: NavbarLink, lang: string | undefined): string {
+  return override(link.labels, lang) || link.label;
+}
+
+/** The primary button's label for `lang`, then `label`, then the default for its type. */
+export function navbarPrimaryLabel(primary: NavbarPrimary, lang: string | undefined): string {
+  return (
+    override(primary.labels, lang) ||
+    primary.label ||
+    (primary.type === 'github' ? 'GitHub' : 'Get Started')
+  );
+}

package/vendored/lib/project-deploy-id.ts

@@ -56,7 +56,7 @@ function lruSet(slug: string, value: string | null): void {
 
 /**
  * Clear the in-process LRU. With a slug, evicts just that project's entry —
- * whole-project revalidation calls this so the next read re-resolves the
+ * project-scoped revalidation calls this so the next read re-resolves the
  * pointer from Redis instead of serving a ≤30s-stale deployId into freshly
  * purged Data Cache entries. Without a slug, clears everything (tests,
  * bare `{all: true}` revalidation).

package/vendored/lib/revalidation-helpers.ts

@@ -15,7 +15,8 @@ import { getStaticRevalidationPaths } from './static-file-route';
 import { clearRedirectCache } from './redirect-matcher';
 import { clearLanguageCache } from './language-matcher';
 import { clearProjectDeployIdCache } from './project-deploy-id';
-import { mdxCacheTag, projectCacheTag } from './cache-tags';
+import { mdxCacheTag, projectCacheTag, staticFileCdnTag } from './cache-tags';
+import { purgeStaticFileCdn } from './static-cdn-purge';
 
 /**
  * Validate the revalidation secret using constant-time comparison.
@@ -137,6 +138,16 @@ export async function executeRevalidation(
 ): Promise<RevalidateResult> {
   const revalidated: string[] = [];
 
+  // Every project-scoped request, targeted or not: evict this instance's
+  // deployId pointer LRU first. Cached fetchers key the Data Cache on the
+  // resolved deployId, so a <=30s-stale pointer here would keep reads pinned
+  // to the previous deploy's (dead) keys — and would let this instance refill
+  // the static-file CDN entry the tag purge below just deleted (that purge runs
+  // for paths-only builds too). Unlike the shims gated below, this only drops a
+  // Redis pointer cache: it emits no tag and discards no parsed data, so it
+  // cannot widen a targeted invalidation.
+  if (request.project) clearProjectDeployIdCache(request.project);
+
   // Whole-project clear: only when a project is named and the caller gave us
   // nothing to scope on. A targeted request (tags or paths supplied) must NOT
   // run the project-wide shims — clearConfigCache emits a revalidateTag that
@@ -149,11 +160,6 @@ export async function executeRevalidation(
 
   if (isWholeProjectClear) {
     const project = request.project!;
-    // Evict the deployId pointer LRU first: cached fetchers key the Data
-    // Cache on the resolved deployId, so a ≤30s-stale pointer on this
-    // instance would otherwise keep reads pinned to the previous deploy's
-    // (dead) cache keys until the LRU TTL lapses.
-    clearProjectDeployIdCache(project);
     clearConfigCache(project);
     clearSnippetCache(project);
     clearOpenApiCache(project);
@@ -205,6 +211,16 @@ export async function executeRevalidation(
     }
   }
 
+  // Purge the tenant's static-file responses (sitemap, llms.txt, ...) from the
+  // Vercel CDN by tag. Runs for targeted builds too: they re-upload the
+  // sitemap/llms files as well, and revalidatePath cannot evict them.
+  if (request.project) {
+    const outcome = await purgeStaticFileCdn(request.project);
+    if (outcome === 'purged') {
+      revalidated.push(`cdn-tag:${staticFileCdnTag(request.project)}`);
+    }
+  }
+
   // Revalidate everything
   if (request.all) {
     // Bare {all: true} (no project scope) must also flush the in-memory parsed
@@ -221,8 +237,10 @@ export async function executeRevalidation(
     await clearLanguageCache();
     if (revalidatePath) {
       revalidatePath('/', 'layout');
-      // Also purge CDN cache for static file routes (sitemap, robots, llms.txt, etc.)
-      // These are route handlers with s-maxage caching that revalidatePath('/', 'layout') doesn't cover.
+      // Also revalidate the static file route paths (sitemap, robots, llms.txt, etc.).
+      // NOTE: revalidatePath does not purge Vercel CDN entries of these
+      // force-dynamic s-maxage route handlers (prod evidence 2026-09-30); the
+      // tag delete above does. This loop still refreshes the ISR layer.
       // Absent docsPrefix/previousDocsSubpath fall back to the legacy '/docs'-only
       // set, so older in-flight requests purge exactly what they always did.
       const staticPaths = getStaticRevalidationPaths(