jamdesk 1.1.214 → 1.1.216

package/vendored/lib/indexnow.ts

@@ -9,6 +9,12 @@ import { createHash } from 'crypto';
 
 const INDEXNOW_ENDPOINT = 'https://api.indexnow.org/indexnow';
 const FETCH_TIMEOUT_MS = 5_000;
+
+/** Identifies the key self-check to bot protection (no shared outbound UA constant exists). */
+const INDEXNOW_CHECK_USER_AGENT = 'Jamdesk-IndexNow-KeyCheck/1.0 (+https://jamdesk.com)';
+// Separate from the single-URL GET budget: a batch body can carry thousands of
+// URLs, so the POST needs more headroom than a one-URL ping.
+const BATCH_FETCH_TIMEOUT_MS = 15_000;
 const MAX_BATCH_SIZE = 10_000;
 const KEY_SALT = 'jamdesk-indexnow-v1';
 
@@ -48,38 +54,185 @@ export function buildChangedUrls(
   });
 }
 
-/** Submit URLs to IndexNow. Single URL uses GET, multiple uses batch POST. */
+/**
+ * Submit URLs to IndexNow. Single URL uses GET, multiple uses batch POST.
+ *
+ * @param keyLocation - Where the key file is served. Omit for root tenants
+ *   (IndexNow's default `/{key}.txt` lookup works); required for prefixed
+ *   tenants (see the comment at the batch call below).
+ */
 export async function submitToIndexNow(
-  urls: string[], host: string, key: string
+  urls: string[], host: string, key: string, keyLocation?: string
 ): Promise<IndexNowResult> {
   if (urls.length === 0) {
     return { success: true, status: 200, submitted: 0 };
   }
 
-  const timeoutSignal = AbortSignal.timeout(FETCH_TIMEOUT_MS);
-
   if (urls.length === 1) {
     const params = new URLSearchParams({ url: urls[0], key });
+    if (keyLocation) params.set('keyLocation', keyLocation);
     const res = await fetch(`${INDEXNOW_ENDPOINT}?${params}`, {
-      signal: timeoutSignal,
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
     });
     return { success: isSuccessStatus(res.status), status: res.status, submitted: 1 };
   }
 
   const submitted = Math.min(urls.length, MAX_BATCH_SIZE);
-  // keyLocation omitted — IndexNow requires it at the root level of the host,
-  // and our key verification route is at /api/indexnow/{key} (a subdirectory).
-  // When omitted, IndexNow defaults to /{key}.txt which it verifies asynchronously.
+  // keyLocation is sent only when the caller passes it. Prefixed tenants
+  // (/docs, /help) need it: their Cloudflare Worker proxies only the prefix, so
+  // IndexNow's default root lookup (/{key}.txt) never reaches us, and a key
+  // served under /docs/ authorizes /docs/* URLs. The old /api/indexnow/{key}
+  // location was rejected because it did not sit above the page URLs it claimed.
   const res = await fetch(INDEXNOW_ENDPOINT, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json; charset=utf-8' },
-    signal: timeoutSignal,
+    signal: AbortSignal.timeout(BATCH_FETCH_TIMEOUT_MS),
     body: JSON.stringify({
       host,
       key,
+      ...(keyLocation ? { keyLocation } : {}),
       urlList: urls.slice(0, MAX_BATCH_SIZE),
     }),
   });
 
   return { success: isSuccessStatus(res.status), status: res.status, submitted };
 }
+
+export interface IndexNowKeyCheck {
+  /**
+   * `ok`: 200 and the body is the key.
+   * `missing`: a definite misconfiguration (404/410, 200 with a different body,
+   * or any 3xx), so submitting would only be discarded.
+   * `inconclusive`: we could not tell (401/403/429/5xx, timeout, network error).
+   */
+  status: 'ok' | 'missing' | 'inconclusive';
+  /** Absent when no response arrived (timeout, network error). */
+  httpStatus?: number;
+  /** Value of the `cf-mitigated` response header (e.g. `challenge`), when sent. */
+  mitigated?: string;
+}
+
+/**
+ * Self-check that the key file is served before we submit. IndexNow verifies
+ * it asynchronously and silently discards submissions it cannot verify, so a
+ * missing key file is otherwise invisible.
+ *
+ * Tri-state on purpose: only a definite `missing` should suppress the
+ * submission. Bot protection (a Cloudflare challenge, a 403/429) or a transient
+ * 5xx on a customer zone blocks OUR check without saying anything about
+ * IndexNow's own fetcher, and before this check existed we submitted without
+ * any verification, so `inconclusive` callers should still submit (and warn).
+ *
+ * `redirect: 'manual'` because IndexNow's own fetch behaviour on redirects is
+ * undocumented: a key that only resolves through a redirect is treated as
+ * `missing` rather than optimistically trusted.
+ */
+export async function verifyIndexNowKeyFile(keyFileUrl: string, key: string): Promise<IndexNowKeyCheck> {
+  try {
+    const res = await fetch(keyFileUrl, {
+      // Descriptive UA: Node's default is a common target for bot challenges on
+      // Vercel, Cloudflare or a customer zone.
+      headers: { 'User-Agent': INDEXNOW_CHECK_USER_AGENT },
+      redirect: 'manual',
+      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    const httpStatus = res.status;
+    const mitigated = res.headers?.get('cf-mitigated') ?? undefined;
+    const withEvidence = (status: IndexNowKeyCheck['status']): IndexNowKeyCheck => ({
+      status,
+      httpStatus,
+      ...(mitigated ? { mitigated } : {}),
+    });
+
+    if (httpStatus === 200) {
+      return withEvidence((await res.text()).trim() === key ? 'ok' : 'missing');
+    }
+    if (httpStatus === 404 || httpStatus === 410 || (httpStatus >= 300 && httpStatus < 400)) {
+      return withEvidence('missing');
+    }
+    return withEvidence('inconclusive');
+  } catch {
+    // Timeout, DNS/TLS failure or a body-read error: no evidence either way.
+    return { status: 'inconclusive' };
+  }
+}
+
+export interface IndexNowPlanInput {
+  slug: string;
+  /** Custom domain (bare host); undefined for *.jamdesk.app tenants. */
+  domain?: string;
+  /** e.g. https://jamdesk.com — no trailing slash, no prefix. */
+  baseUrl: string;
+  /** '' | '/docs' | '/help' */
+  docsPrefix: string;
+  /** Site-wide robots noindex. */
+  noindex: boolean;
+  /** build.ts authPlaneGated. */
+  authGated: boolean;
+  /** Changed .mdx paths (extension stripped, locale-prefixed like `fr/intro`). */
+  mdxChangedPaths: string[];
+  mdxDeletedPaths: string[];
+  /** null = unavailable, so fail closed. */
+  pageIndexability: ReadonlyMap<string, boolean> | null;
+}
+
+export interface IndexNowSubmission {
+  urls: string[];
+  host: string;
+  key: string;
+  /** Where the key is served (always set; used for the self-check). */
+  keyFileUrl: string;
+  /** Sent to IndexNow only for prefixed tenants. */
+  keyLocation?: string;
+  /** URLs dropped past MAX_BATCH_SIZE. */
+  truncated: number;
+}
+
+/**
+ * Decide what (if anything) to tell IndexNow after a build. Pure: never
+ * mutates its inputs (changedPaths and mdxChangedPaths can be the same array).
+ *
+ * Returns null — submit nothing — when the site is noindex or auth-gated, when
+ * indexability is unknown (fail closed), or when a prefixed tenant has no
+ * custom domain (its *.jamdesk.app URLs are x-jd-noindex, so not canonical).
+ *
+ * A changed page is kept only if the sitemap would list it. Deleted pages are
+ * kept because they are absent from the build by definition; IndexNow is how
+ * engines learn to drop them. Pages that just became hidden/noindex are NOT
+ * submitted — engines drop them on their next crawl, and we cannot tell "just
+ * became hidden" from "was always hidden" without the previous build's state.
+ *
+ * The same blindness applies to deletions: a deleted page is submitted even if
+ * it was noindex or hidden before it was deleted. We have no previous-build
+ * visibility to tell, and the cost is benign (engines fetch the URL, get a
+ * 404, and drop it or ignore it).
+ */
+export function planIndexNowSubmission(input: IndexNowPlanInput): IndexNowSubmission | null {
+  const {
+    slug, domain, baseUrl, docsPrefix, noindex, authGated,
+    mdxChangedPaths, mdxDeletedPaths, pageIndexability,
+  } = input;
+
+  if (noindex || authGated || pageIndexability === null) return null;
+  if (docsPrefix !== '' && !domain) return null;
+
+  const deleted = new Set(mdxDeletedPaths);
+  const kept = [...new Set([...mdxChangedPaths, ...mdxDeletedPaths])].filter(
+    (p) => pageIndexability.get(p) === true || deleted.has(p),
+  );
+  if (kept.length === 0) return null;
+
+  const capped = kept.slice(0, MAX_BATCH_SIZE);
+  const key = generateIndexNowKey(slug);
+  const keyFileUrl = `${baseUrl}${docsPrefix}/${key}.txt`;
+
+  return {
+    urls: buildChangedUrls(capped, baseUrl, docsPrefix !== '', docsPrefix),
+    host: new URL(baseUrl).host,
+    key,
+    keyFileUrl,
+    // Root tenants: IndexNow's default /{key}.txt lookup already works.
+    keyLocation: docsPrefix ? keyFileUrl : undefined,
+    truncated: kept.length - capped.length,
+  };
+}

package/vendored/lib/navbar-labels.ts

@@ -0,0 +1,34 @@
+import type { NavbarLink, NavbarPrimary } from './docs-types';
+
+/**
+ * Navbar labels in the reader's language. Shared by the header (md and up)
+ * and the mobile drawer (below md), which render the same navbar entries and
+ * must not disagree on what they're called.
+ */
+
+/**
+ * The override for `lang`. Exact key first, then case-insensitive:
+ * extractLanguageFromPath returns codes like 'pt-BR' and 'zh-Hans', while
+ * authors write `labels` keys by hand ("pt-br").
+ */
+function override(labels: Record<string, string> | undefined, lang: string | undefined): string | undefined {
+  if (!lang || !labels) return undefined;
+  if (labels[lang]) return labels[lang];
+  const wanted = lang.toLowerCase();
+  const key = Object.keys(labels).find((k) => k.toLowerCase() === wanted);
+  return key ? labels[key] : undefined;
+}
+
+/** A link's label for `lang`, falling back to `label`. */
+export function navbarLinkLabel(link: NavbarLink, lang: string | undefined): string {
+  return override(link.labels, lang) || link.label;
+}
+
+/** The primary button's label for `lang`, then `label`, then the default for its type. */
+export function navbarPrimaryLabel(primary: NavbarPrimary, lang: string | undefined): string {
+  return (
+    override(primary.labels, lang) ||
+    primary.label ||
+    (primary.type === 'github' ? 'GitHub' : 'Get Started')
+  );
+}

package/vendored/lib/project-deploy-id.ts

@@ -56,7 +56,7 @@ function lruSet(slug: string, value: string | null): void {
 
 /**
  * Clear the in-process LRU. With a slug, evicts just that project's entry —
- * whole-project revalidation calls this so the next read re-resolves the
+ * project-scoped revalidation calls this so the next read re-resolves the
  * pointer from Redis instead of serving a ≤30s-stale deployId into freshly
  * purged Data Cache entries. Without a slug, clears everything (tests,
  * bare `{all: true}` revalidation).

package/vendored/lib/revalidation-helpers.ts

@@ -15,7 +15,8 @@ import { getStaticRevalidationPaths } from './static-file-route';
 import { clearRedirectCache } from './redirect-matcher';
 import { clearLanguageCache } from './language-matcher';
 import { clearProjectDeployIdCache } from './project-deploy-id';
-import { mdxCacheTag, projectCacheTag } from './cache-tags';
+import { mdxCacheTag, projectCacheTag, staticFileCdnTag } from './cache-tags';
+import { purgeStaticFileCdn } from './static-cdn-purge';
 
 /**
  * Validate the revalidation secret using constant-time comparison.
@@ -137,6 +138,16 @@ export async function executeRevalidation(
 ): Promise<RevalidateResult> {
   const revalidated: string[] = [];
 
+  // Every project-scoped request, targeted or not: evict this instance's
+  // deployId pointer LRU first. Cached fetchers key the Data Cache on the
+  // resolved deployId, so a <=30s-stale pointer here would keep reads pinned
+  // to the previous deploy's (dead) keys — and would let this instance refill
+  // the static-file CDN entry the tag purge below just deleted (that purge runs
+  // for paths-only builds too). Unlike the shims gated below, this only drops a
+  // Redis pointer cache: it emits no tag and discards no parsed data, so it
+  // cannot widen a targeted invalidation.
+  if (request.project) clearProjectDeployIdCache(request.project);
+
   // Whole-project clear: only when a project is named and the caller gave us
   // nothing to scope on. A targeted request (tags or paths supplied) must NOT
   // run the project-wide shims — clearConfigCache emits a revalidateTag that
@@ -149,11 +160,6 @@ export async function executeRevalidation(
 
   if (isWholeProjectClear) {
     const project = request.project!;
-    // Evict the deployId pointer LRU first: cached fetchers key the Data
-    // Cache on the resolved deployId, so a ≤30s-stale pointer on this
-    // instance would otherwise keep reads pinned to the previous deploy's
-    // (dead) cache keys until the LRU TTL lapses.
-    clearProjectDeployIdCache(project);
     clearConfigCache(project);
     clearSnippetCache(project);
     clearOpenApiCache(project);
@@ -205,6 +211,16 @@ export async function executeRevalidation(
     }
   }
 
+  // Purge the tenant's static-file responses (sitemap, llms.txt, ...) from the
+  // Vercel CDN by tag. Runs for targeted builds too: they re-upload the
+  // sitemap/llms files as well, and revalidatePath cannot evict them.
+  if (request.project) {
+    const outcome = await purgeStaticFileCdn(request.project);
+    if (outcome === 'purged') {
+      revalidated.push(`cdn-tag:${staticFileCdnTag(request.project)}`);
+    }
+  }
+
   // Revalidate everything
   if (request.all) {
     // Bare {all: true} (no project scope) must also flush the in-memory parsed
@@ -221,8 +237,10 @@ export async function executeRevalidation(
     await clearLanguageCache();
     if (revalidatePath) {
       revalidatePath('/', 'layout');
-      // Also purge CDN cache for static file routes (sitemap, robots, llms.txt, etc.)
-      // These are route handlers with s-maxage caching that revalidatePath('/', 'layout') doesn't cover.
+      // Also revalidate the static file route paths (sitemap, robots, llms.txt, etc.).
+      // NOTE: revalidatePath does not purge Vercel CDN entries of these
+      // force-dynamic s-maxage route handlers (prod evidence 2026-09-30); the
+      // tag delete above does. This loop still refreshes the ISR layer.
       // Absent docsPrefix/previousDocsSubpath fall back to the legacy '/docs'-only
       // set, so older in-flight requests purge exactly what they always did.
       const staticPaths = getStaticRevalidationPaths(

package/vendored/lib/revalidation-trigger.ts

@@ -5,6 +5,9 @@
 
 import { log } from './logger.js';
 import { redis } from './redis.js';
+// Constant only: @vercel/functions is dynamically imported inside
+// purgeStaticFileCdn, so this adds nothing to module load.
+import { STATIC_CDN_REPURGE_DELAY_MS } from './static-cdn-purge.js';
 
 export const DEPLOY_FLIP_TAG = '[deploy-flip]';
 
@@ -56,11 +59,18 @@ export async function triggerRevalidation(options: RevalidationOptions): Promise
   if (previousDocsSubpath) body.previousDocsSubpath = previousDocsSubpath;
 
   // Proxy/CF failures are non-fatal — caches will expire on their own
-  const [isrResult] = await Promise.all([
-    revalidateIsrApp(isrAppUrl, secret, body),
-    revalidateProxy(secret, projectSlug),
-    purgeCloudflareCache(projectSlug),
-  ]);
+  let isrResult: Awaited<ReturnType<typeof revalidateIsrApp>>;
+  try {
+    [isrResult] = await Promise.all([
+      revalidateIsrApp(isrAppUrl, secret, body),
+      revalidateProxy(secret, projectSlug),
+    ]);
+  } finally {
+    // After ISR settles (success or failure), never alongside it: Cloudflare's
+    // purge_everything racing the Vercel CDN purge refilled Cloudflare from the
+    // stale Vercel HIT. Never throws.
+    await purgeCloudflareCacheTwice(projectSlug);
+  }
 
   // Only throw if ISR revalidation failed (it's the critical one)
   if (!isrResult.ok) {
@@ -238,20 +248,54 @@ async function revalidateProxy(secret: string, projectSlug: string): Promise<voi
   }
 }
 
+/**
+ * Purge Cloudflare, wait past the stale-deployId window, purge again.
+ *
+ * Other ISR instances keep a per-instance deployId LRU for up to 30s
+ * (`lib/project-deploy-id.ts`); a jamdesk.com/docs request landing on one in
+ * that window refills Vercel with stale content, and Cloudflare then caches
+ * it for up to 4h (max-age=14400). The 2nd purge lands after every LRU entry
+ * has expired (repurge delay + 5s of slack). Awaited, not fire-and-forget:
+ * Cloud Run may throttle CPU once the build returns. Never throws.
+ */
+async function purgeCloudflareCacheTwice(projectSlug: string): Promise<void> {
+  await purgeCloudflareCache(projectSlug, 1);
+  // Without credentials pass 1 was a no-op, so don't sleep for nothing.
+  if (!isCloudflarePurgeEnabled(projectSlug)) return;
+  await sleep(CLOUDFLARE_REPURGE_DELAY_MS);
+  await purgeCloudflareCache(projectSlug, 2);
+}
+
+const CLOUDFLARE_REPURGE_DELAY_MS = STATIC_CDN_REPURGE_DELAY_MS + 5_000;
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function isCloudflarePurgeEnabled(projectSlug: string): boolean {
+  return (
+    projectSlug === 'jamdesk-docs' &&
+    Boolean(process.env.CLOUDFLARE_ZONE_ID) &&
+    Boolean(process.env.CLOUDFLARE_API_TOKEN)
+  );
+}
+
 /**
  * Purge Cloudflare CDN cache for jamdesk.com docs assets.
  * Only runs for the jamdesk-docs project (served via Cloudflare Worker at jamdesk.com/docs).
  * Customer projects at *.jamdesk.app go through Vercel CDN, not Cloudflare.
  * Non-fatal on failure — cache will expire based on TTL.
+ *
+ * @param pass 1 = immediate purge, 2 = delayed re-purge (see purgeCloudflareCacheTwice)
  */
-async function purgeCloudflareCache(projectSlug: string): Promise<void> {
+async function purgeCloudflareCache(projectSlug: string, pass: 1 | 2): Promise<void> {
   if (projectSlug !== 'jamdesk-docs') return;
 
   const zoneId = process.env.CLOUDFLARE_ZONE_ID;
   const apiToken = process.env.CLOUDFLARE_API_TOKEN;
 
   if (!zoneId || !apiToken) {
-    log('info', 'Skipping Cloudflare cache purge (credentials not configured)', { projectSlug });
+    log('info', 'Skipping Cloudflare cache purge (credentials not configured)', { projectSlug, pass });
     return;
   }
 
@@ -271,16 +315,16 @@ async function purgeCloudflareCache(projectSlug: string): Promise<void> {
     const data = await response.json() as { success: boolean; errors?: Array<{ message: string }> };
 
     if (response.ok && data.success) {
-      log('info', 'Cloudflare cache purged for jamdesk.com', { projectSlug });
+      log('info', 'Cloudflare cache purged for jamdesk.com', { projectSlug, pass });
     } else {
       const errorMsg = data.errors?.[0]?.message || `HTTP ${response.status}`;
       log('warn', 'Cloudflare cache purge failed (non-fatal)', {
-        projectSlug, error: errorMsg,
+        projectSlug, pass, error: errorMsg,
       });
     }
   } catch (err) {
     log('warn', 'Cloudflare cache purge error (non-fatal)', {
-      projectSlug, error: (err as Error).message,
+      projectSlug, pass, error: (err as Error).message,
     });
   }
 }
@@ -297,36 +341,67 @@ export interface Manifest {
   docsPrefix?: string;
 }
 
+/**
+ * IndexNow's per-request URL limit. Collection stops here so a pathological
+ * sweep (e.g., a 50k-page Prettier run) can't build an unbounded list; past
+ * it the tail is simply not submitted, which IndexNow's own cap would force
+ * anyway. The old cap was MANY_MDX_THRESHOLD + 1 because the list was
+ * discarded once the decision escalated to `all` — IndexNow now reads it
+ * exactly in that case, so the list must survive escalation.
+ */
+const MAX_TRACKED_MDX_CHANGES = 10_000;
+
 function getMdxChangedPaths(
   oldManifest: Manifest | null,
   newManifest: Manifest
-): string[] {
+): { changed: string[]; deleted: string[] } {
   if (!oldManifest) {
-    return Object.keys(newManifest.files).map(path => path.replace('.mdx', ''));
+    return {
+      changed: Object.keys(newManifest.files).map(path => path.replace('.mdx', '')),
+      deleted: [],
+    };
   }
 
-  // Past the threshold the decision escalates to project-wide and the array
-  // is discarded, so cap collection at threshold+1 to avoid building huge
-  // path lists for bulk edits (e.g., 5k-page Prettier sweeps).
-  const cap = MANY_MDX_THRESHOLD + 1;
   const changed: string[] = [];
+  const deleted: string[] = [];
+  let truncated = false;
 
   for (const [path, info] of Object.entries(newManifest.files)) {
-    if (changed.length >= cap) return changed;
     const oldInfo = oldManifest.files[path];
     if (!oldInfo || oldInfo.hash !== info.hash) {
+      if (changed.length >= MAX_TRACKED_MDX_CHANGES) {
+        truncated = true;
+        break;
+      }
       changed.push(path.replace('.mdx', ''));
     }
   }
 
-  for (const path of Object.keys(oldManifest.files)) {
-    if (changed.length >= cap) return changed;
-    if (!(path in newManifest.files)) {
-      changed.push(path.replace('.mdx', ''));
+  if (!truncated) {
+    for (const path of Object.keys(oldManifest.files)) {
+      if (path in newManifest.files) continue;
+      if (changed.length >= MAX_TRACKED_MDX_CHANGES) {
+        truncated = true;
+        break;
+      }
+      const stripped = path.replace('.mdx', '');
+      changed.push(stripped);
+      // Deletions stay distinguishable: a deleted page needs a different
+      // IndexNow treatment than an edited one (its URL now 404s).
+      deleted.push(stripped);
     }
   }
 
-  return changed;
+  // Silent truncation would look like a complete list downstream; one line per
+  // decision makes a capped sweep visible in Cloud Run logs.
+  if (truncated) {
+    log('warn', 'MDX change list truncated at the tracking cap; remaining changed pages will not be submitted to IndexNow', {
+      maxTrackedMdxChanges: MAX_TRACKED_MDX_CHANGES,
+      tracked: changed.length,
+    });
+  }
+
+  return { changed, deleted };
 }
 
 function hasConfigChanges(oldManifest: Manifest, newManifest: Manifest): boolean {
@@ -372,9 +447,7 @@ function hasAssetChanges(oldManifest: Manifest, newManifest: Manifest): boolean
  * `previousDocsSubpath`, which is sticky BY DESIGN (Task 3 keeps it forever
  * so the old prefix's 308 redirect keeps working) and would otherwise make
  * every build after a rename look like a rename, permanently replacing
- * targeted revalidation with a full purge and starving IndexNow of paths
- * (build.ts's `indexNowPaths.length > 0` gate never fires again once `all`
- * empties changedPaths on every build).
+ * targeted revalidation with a full purge on every build.
  *
  * Manifest-based comparison self-clears: the build that performs the rename
  * records the new prefix into ITS OWN manifest, so the very next build's
@@ -392,13 +465,11 @@ function hasAssetChanges(oldManifest: Manifest, newManifest: Manifest): boolean
  * build after this shipped, then self-clears once the new manifest records
  * a value to compare against next time.
  *
- * That one legacy fire is not entirely free: it escalates the build to `all`,
- * which empties `changedPaths`, and build.ts gates IndexNow on
- * `indexNowPaths.length > 0` — so each tenant's FIRST post-deploy build
- * silently submits nothing to IndexNow. Harmless (the next build with real
- * MDX changes submits normally, and a full purge already refreshed the CDN),
- * but it means a wave of full-project purges with no IndexNow pings is the
- * EXPECTED signature in the days after this ships, not a regression.
+ * That one legacy fire escalates the build to `all`, which empties
+ * `changedPaths` — but IndexNow reads `mdxChangedPaths`, which `all` never
+ * touches, so the fire-once build still submits whatever MDX actually
+ * changed. A full purge with few or no IndexNow pings is therefore just a
+ * build that changed no MDX, not a sign IndexNow was starved.
  */
 function hasDocsPrefixChange(oldManifest: Manifest, newManifest: Manifest): boolean {
   if (newManifest.docsPrefix === undefined) return false;
@@ -421,6 +492,15 @@ export interface RevalidationDecision {
   changedPaths: string[];
   all: boolean;
   reasons: RevalidationReason[];
+  /** Added, modified and deleted MDX paths (`.mdx` stripped, locale-prefixed
+   * e.g. `fr/intro`), regardless of `all`. Unlike `changedPaths` — which is
+   * emptied whenever the decision escalates to a full purge — this survives
+   * config/many_mdx/docs_prefix/FORCE_ALL escalation, because IndexNow must
+   * not be starved by a cache-escalation decision. `[]` on first build. */
+  mdxChangedPaths: string[];
+  /** Subset of `mdxChangedPaths` present in the old manifest but not the new
+   * (deleted pages). `[]` on first build. */
+  mdxDeletedPaths: string[];
 }
 
 /**
@@ -436,10 +516,16 @@ export function getRevalidationDecision(
   newManifest: Manifest
 ): RevalidationDecision {
   if (!oldManifest) {
-    return { changedPaths: [], all: true, reasons: ['first_build'] };
+    return {
+      changedPaths: [],
+      all: true,
+      reasons: ['first_build'],
+      mdxChangedPaths: [],
+      mdxDeletedPaths: [],
+    };
   }
 
-  const changedPaths = getMdxChangedPaths(oldManifest, newManifest);
+  const { changed: changedPaths, deleted: deletedPaths } = getMdxChangedPaths(oldManifest, newManifest);
   const reasons: RevalidationReason[] = [];
   if (changedPaths.length > MANY_MDX_THRESHOLD) {
     reasons.push('many_mdx');
@@ -468,6 +554,8 @@ export function getRevalidationDecision(
     changedPaths: all ? [] : changedPaths,
     all,
     reasons,
+    mdxChangedPaths: changedPaths,
+    mdxDeletedPaths: deletedPaths,
   };
 }
 

package/vendored/lib/static-artifacts.ts

@@ -93,6 +93,21 @@ function isPageMetadataIncluded(page: PageMetadata, visibility?: VisibilityInput
   ).inArtifacts;
 }
 
+/**
+ * Per-page indexability for every page in the build, keyed by page path.
+ *
+ * Uses the same rule as the sitemap and llms.txt (isPageMetadataIncluded), so
+ * IndexNow submissions can never disagree with what we tell crawlers is
+ * indexable. A path missing from the map means the page is not in this build
+ * at all (deleted, or never existed) — callers must not treat that as "true".
+ */
+export function getPageIndexability(
+  pages: PageMetadata[],
+  visibility?: VisibilityInputs,
+): Map<string, boolean> {
+  return new Map(pages.map((p) => [p.path, isPageMetadataIncluded(p, visibility)]));
+}
+
 /**
  * Generate sitemap.xml from page metadata.
  *