@kirchdev/duxt 0.5.1-dev-main.48-5d5fca9 → 0.6.1-dev-main.51-119d6cc

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://www.schemastore.org/package.json",
   "name": "@kirchdev/duxt",
-  "version": "0.5.1-dev-main.48-5d5fca9",
+  "version": "0.6.1-dev-main.51-119d6cc",
   "description": "duxt is a Nuxt layer: extend it and your docs/ folder becomes a site, with theme, search, API reference and llms.txt included. Point it at other repositories, or at tags of the same one, and each becomes a version.",
   "keywords": [
     "content-v3",
@@ -68,59 +68,61 @@
   },
   "dependencies": {
     "@codemirror/autocomplete": "^6.20.3",
-    "@codemirror/commands": "^6.11.0",
+    "@codemirror/commands": "^6.11.1",
     "@codemirror/lang-json": "^6.0.2",
-    "@codemirror/language": "^6.12.4",
+    "@codemirror/language": "^6.13.1",
     "@codemirror/lint": "^6.9.7",
-    "@codemirror/state": "^6.7.4",
-    "@codemirror/view": "^6.43.11",
+    "@codemirror/state": "^6.7.6",
+    "@codemirror/view": "^6.43.14",
     "@iconify-json/flag": "^1.2.12",
-    "@iconify-json/lucide": "^1.2.127",
-    "@iconify-json/simple-icons": "^1.2.94",
-    "@lezer/highlight": "^1.2.3",
-    "@lucide/vue": "^1.37.0",
-    "@nuxt/content": "^3.16.0",
+    "@iconify-json/lucide": "^1.2.141",
+    "@iconify-json/simple-icons": "^1.2.99",
+    "@lezer/highlight": "^1.2.5",
+    "@lucide/vue": "^1.53.0",
+    "@nuxt/content": "^3.16.1",
     "@nuxt/icon": "^2.5.1",
     "@nuxt/image": "^2.1.0",
     "@nuxtjs/color-mode": "^4.0.1",
     "@nuxtjs/i18n": "^10.6.0",
-    "@nuxtjs/mcp-toolkit": "^0.19.0",
-    "@nuxtjs/seo": "^5.3.14",
-    "@nuxtjs/sitemap": "^8.5.0",
+    "@nuxtjs/mcp-toolkit": "^0.24.1",
+    "@nuxtjs/seo": "^5.3.16",
+    "@nuxtjs/sitemap": "^8.6.1",
     "@resvg/resvg-js": "^2.6.2",
-    "@shikijs/transformers": "^4.4.3",
+    "@shikijs/transformers": "^4.5.0",
     "@tailwindcss/vite": "^4.3.3",
-    "@vueuse/core": "^14.4.0",
+    "@vueuse/core": "^15.0.0",
     "citty": "^0.2.2",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "fuse.js": "^7.5.0",
     "jiti": "^2.7.0",
-    "mermaid": "^11.17.2",
-    "reka-ui": "^2.10.4",
-    "satori": "^0.33.4",
+    "mermaid": "^12.1.0",
+    "reka-ui": "^2.11.0",
+    "satori": "^0.44.0",
     "shadcn-nuxt": "^2.8.2",
-    "shiki": "^4.4.3",
-    "tailwind-merge": "^3.6.0",
+    "shiki": "^4.5.0",
+    "tailwind-merge": "^3.7.0",
     "tailwindcss": "^4.3.3",
     "tw-animate-css": "^1.4.0",
     "vue-sonner": "^2.0.9",
-    "yaml": "^2.9.0",
-    "zod": "^4.5.4"
+    "yaml": "^2.9.1",
+    "zod": "^4.6.5"
   },
   "devDependencies": {
     "@types/jsdom": "^30.0.0",
-    "@types/node": "^26.4.0",
-    "jsdom": "^30.0.1",
-    "nuxt": "^4.5.2",
+    "@types/node": "^26.6.4",
+    "jsdom": "^30.1.2",
+    "nuxt": "^4.6.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.3",
+    "vue": "^3.5.43"
   },
   "peerDependencies": {
-    "nuxt": "^4.0.0"
+    "nuxt": "^4.0.0",
+    "vue": "^3.5.0"
   },
   "engines": {
-    "node": ">=24"
+    "node": ">=24.15.0"
   },
   "scripts": {
     "check:previews": "node scripts/check-previews.ts",

package/server/devtools/entry-path.ts

@@ -1,9 +1,10 @@
-import { join, resolve } from 'node:path';
+import { lstatSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
 
 /**
  * Resolve a cache entry the tab may delete, or refuse.
  *
- * Its own file, importing nothing but `node:path`, for the same reason
+ * Its own file, importing nothing but `node:path` and `node:fs`, for the same reason
  * `validate-report.ts` is its own file: everything else under `devtools/`
  * reaches the virtual module the build generates, and a guard that cannot be
  * tested without booting Nitro is a guard nobody re-checks. This is the one
@@ -19,7 +20,13 @@ export function cacheEntryToDrop(
   dataDir: string,
   name: unknown
 ): string | undefined {
-  if (typeof name !== 'string' || !name || name === '.' || name === '..') {
+  if (
+    typeof name !== 'string' ||
+    !name ||
+    name === '.' ||
+    name === '..' ||
+    isAbsolute(name)
+  ) {
     return undefined;
   }
 
@@ -28,3 +35,41 @@ export function cacheEntryToDrop(
 
   return target;
 }
+
+/**
+ * Whether `target` is one of the entries the panel lists: a real directory.
+ *
+ * The panel offers downloaded repositories, which are directories. Content's
+ * parse cache sits beside them as a file and is not offered, and a symlink is
+ * neither — so neither may be dropped by naming it.
+ */
+export function isListedCacheEntry(target: string): boolean {
+  try {
+    return lstatSync(target).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Whether a mutation came from the tab itself rather than from another site.
+ *
+ * The dev server listens on localhost, and any page the developer has open can
+ * POST a form at it — no cookie is needed when the authority is simply being
+ * able to reach the listener. So the request has to prove it came from this
+ * origin: `Sec-Fetch-Site`, which a browser sets and a page cannot, must say
+ * `same-origin`; a browser too old to send it still sends `Origin` on a
+ * cross-origin POST, which must then match the server's own. A request with
+ * neither did not come from a browser, and a cross-site request is one only a
+ * browser can be tricked into sending.
+ */
+export function sameOriginMutation(headers: {
+  secFetchSite?: string;
+  origin?: string;
+  selfOrigin: string;
+}): boolean {
+  if (headers.secFetchSite) return headers.secFetchSite === 'same-origin';
+  if (headers.origin) return headers.origin === headers.selfOrigin;
+
+  return true;
+}

package/server/devtools/handler.ts

@@ -4,7 +4,11 @@ import { context } from './context';
 import { page, PANELS } from './shell';
 import { pathsPanel, sourcesPanel, versionsPanel } from './sources';
 import { checksPanel, pagesPanel, searchPanel } from './content';
-import { cacheEntryToDrop } from './entry-path';
+import {
+  cacheEntryToDrop,
+  isListedCacheEntry,
+  sameOriginMutation
+} from './entry-path';
 import { cachePanel, configPanel, i18nPanel, redirectsPanel } from './system';
 
 /**
@@ -39,10 +43,26 @@ export default defineEventHandler(async (event) => {
   // The one mutation in the tab: dropping a cache entry. A POST because it
   // deletes, so a reload or a prefetch cannot trigger it.
   if (event.method === 'POST' && slug === 'cache') {
+    const allowed = sameOriginMutation({
+      secFetchSite: getRequestHeader(event, 'sec-fetch-site'),
+      origin: getRequestHeader(event, 'origin'),
+      selfOrigin: getRequestURL(event).origin
+    });
+
+    if (!allowed) {
+      setResponseStatus(event, 403);
+      return html(
+        page(
+          slug,
+          cachePanel('Refused: the request did not come from this tab.')
+        )
+      );
+    }
+
     const body = (await readBody(event)) as { drop?: string } | undefined;
     const target = cacheEntryToDrop(context.dataDir, body?.drop);
 
-    if (!target) {
+    if (!target || !isListedCacheEntry(target)) {
       return html(
         page(
           slug,

package/server/mcp/tools/list-pages.ts

@@ -3,12 +3,11 @@ import {
   DUXT_PAGE_MAX,
   DUXT_PAGE_SIZE,
   duxtBadCursor,
-  duxtCursorPage,
   duxtLocaleSetup,
   duxtMcpEvent,
   duxtPageLine,
   duxtScope,
-  duxtScopedPages,
+  duxtScopedPage,
   duxtSources,
   duxtUnknownScope,
   duxtValidCursor
@@ -65,8 +64,13 @@ export default defineMcpTool({
     const scope = duxtScope(prefix, duxtSources(), setup);
     if (!scope) return duxtUnknownScope(prefix!);
 
-    const pages = await duxtScopedPages(event, scope, setup);
-    const { items, nextCursor } = duxtCursorPage(pages, limit, cursor);
+    const { items, nextCursor } = await duxtScopedPage(
+      event,
+      scope,
+      setup,
+      limit,
+      cursor
+    );
 
     if (!items.length)
       return {

package/server/mcp/tools/read-page.ts

@@ -1,7 +1,5 @@
-import { queryCollection } from '@nuxt/content/nitro';
 import { z } from 'zod';
-import { splitLocalePath } from '../../../app/utils/locale-path';
-import { sourcesForRoute } from '../../../build/sources/sources-resolve';
+import { duxtDocPage } from '../../utils/doc-page';
 import {
   duxtAuthoredMarkdown,
   duxtFrontmatter,
@@ -49,29 +47,9 @@ export default defineMcpTool({
     const event = duxtMcpEvent();
     const setup = duxtLocaleSetup(event);
     const sources = duxtSources();
-    const { locale, path: wanted } = splitLocalePath(path, setup.codes);
-
-    // The same chain the rendered page takes: the requested language, its
-    // siblings, the configured fallback, then the untranslated original.
-    const chain = sourcesForRoute(
-      wanted,
-      locale ?? setup.defaultLocale,
-      sources,
-      setup.fallbackLocale
-    );
-
-    for (const source of chain) {
-      const page = (await queryCollection(
-        event,
-        source.collection as Parameters<typeof queryCollection>[1]
-      )
-        .path(wanted)
-        .select('title', 'description', 'rawbody')
-        .first()) as unknown as
-        | { title?: string; description?: string; rawbody?: string }
-        | undefined;
-
-      if (!page) continue;
+    const found = await duxtDocPage(event, path, sources, setup);
+    if (found) {
+      const { page, source, locale, path: wanted } = found;
 
       const frontmatter = duxtFrontmatter({
         path: duxtPublicPath(wanted, locale, setup),

package/server/mcp/tools/search-docs.ts

@@ -3,18 +3,16 @@ import {
   DUXT_PAGE_MAX,
   DUXT_PAGE_SIZE,
   duxtBadCursor,
-  duxtCursorPage,
   duxtExcerpt,
   duxtLocaleSetup,
   duxtMcpEvent,
   duxtPageLine,
   duxtScope,
-  duxtScopedPages,
+  duxtScopedPage,
   duxtSources,
   duxtUnknownScope,
   duxtValidCursor
 } from '../../utils/mcp-docs';
-import { duxtPageSearchable } from '../../../app/utils/page-controls';
 
 /**
  * Search, so a model does not have to read every page to find one.
@@ -60,7 +58,7 @@ export default defineMcpTool({
       .describe('`nextCursor` from a previous call, to continue the results')
   },
 
-  async handler({ query, prefix, limit, cursor }) {
+  async handler({ query, prefix, limit, cursor }, extra) {
     if (cursor && !duxtValidCursor(cursor)) return duxtBadCursor(cursor);
 
     const event = duxtMcpEvent();
@@ -68,21 +66,17 @@ export default defineMcpTool({
     const scope = duxtScope(prefix, duxtSources(), setup);
     if (!scope) return duxtUnknownScope(prefix!);
 
-    const term = query.toLowerCase();
-    const holds = (value: string | undefined) =>
-      Boolean(value?.toLowerCase().includes(term));
-
-    // `search: false` is applied HERE rather than in `duxtScopedPages`, which
-    // also feeds `list_pages` and `list_versions`: the opt-out makes a page
-    // un-findable, not unpublished, so the tree and the page itself are left
-    // alone. Same predicate the client search and the llms indexes use.
-    const matches = (await duxtScopedPages(event, scope, setup, true)).filter(
-      (page) =>
-        duxtPageSearchable(page) &&
-        (holds(page.title) || holds(page.description) || holds(page.rawbody))
+    const { items, nextCursor } = await duxtScopedPage(
+      event,
+      scope,
+      setup,
+      limit,
+      cursor,
+      query.toLowerCase(),
+      extra.signal
     );
 
-    if (!matches.length)
+    if (!items.length)
       return {
         content: [
           {
@@ -92,7 +86,6 @@ export default defineMcpTool({
         ]
       };
 
-    const { items, nextCursor } = duxtCursorPage(matches, limit, cursor);
     const listing = items.flatMap((page) => {
       const excerpt = duxtExcerpt(page.rawbody, query);
 

package/server/middleware/raw-markdown.ts

@@ -1,8 +1,6 @@
-import { queryCollection } from '@nuxt/content/nitro';
 import { defineEventHandler, setHeader } from 'h3';
-import { splitLocalePath } from '../../app/utils/locale-path';
-import { sourcesForRoute } from '../../build/sources/sources-resolve';
-import { duxtDefaults, mergeDuxtConfig } from '../../app/utils/duxt-config';
+import { duxtDocPage } from '../utils/doc-page';
+import { duxtLocaleSetup, duxtSources } from '../utils/mcp-docs';
 import { stripFrontmatter } from '../../build/content/frontmatter';
 
 /**
@@ -21,45 +19,13 @@ export default defineEventHandler(async (event) => {
   const path = event.path?.split('?')[0];
   if (!path?.endsWith('.md')) return;
 
-  const appConfig = useAppConfig() as { duxt?: Partial<DuxtConfig> };
-  const duxt = mergeDuxtConfig(appConfig.duxt, duxtDefaults);
-
-  const i18n = (
-    useRuntimeConfig(event).public as {
-      i18n?: {
-        locales?: ({ code: string } | string)[];
-        defaultLocale?: string;
-      };
-    }
-  ).i18n;
-  const { path: wanted, locale } = splitLocalePath(
+  const found = await duxtDocPage(
+    event,
     path.slice(0, -'.md'.length),
-    (i18n?.locales ?? []).map((entry) =>
-      typeof entry === 'string' ? entry : entry.code
-    )
-  );
-  // Nuxt i18n loads the consumer's merged Vue I18n config in its request hook.
-  // Browser-language detection's fallback is a different policy.
-  const fallbackLocale = event.context.nuxtI18n?.vueI18nOptions
-    ?.fallbackLocale as string | string[] | undefined;
-  const sources = sourcesForRoute(
-    wanted,
-    locale ?? i18n?.defaultLocale,
-    duxt.resolvedSources ?? [],
-    fallbackLocale
+    duxtSources(),
+    duxtLocaleSetup(event)
   );
-
-  let page;
-  for (const source of sources) {
-    page = await queryCollection(
-      event,
-      source.collection as Parameters<typeof queryCollection>[1]
-    )
-      .path(wanted)
-      .select('title', 'rawbody')
-      .first();
-    if (page) break;
-  }
+  const page = found?.page;
 
   // No page is not this middleware's error to raise: falling through lets the
   // app answer with its own 404, which knows how to suggest a near miss.

package/server/routes/llms-full.txt.get.ts

@@ -4,6 +4,7 @@ import { llmsPages } from '../utils/llms-pages';
 // pages use, or the two descriptions drift apart.
 import { duxtDefaults, mergeDuxtConfig } from '../../app/utils/duxt-config';
 import { resolveServerTexts } from '../utils/duxt-server-text';
+import { duxtPublicOrigin } from '../utils/public-origin';
 import { stripFrontmatter } from '../../build/content/frontmatter';
 
 /**
@@ -27,7 +28,7 @@ export default defineEventHandler(async (event) => {
 
   const pages = await llmsPages(event, duxt.resolvedSources, true);
 
-  const origin = getRequestURL(event).origin;
+  const origin = duxtPublicOrigin(event);
 
   const lines = [
     `# ${duxt.title}`,

package/server/routes/llms.txt.get.ts

@@ -4,6 +4,7 @@ import { llmsPages } from '../utils/llms-pages';
 // pages use, or the two descriptions drift apart.
 import { duxtDefaults, mergeDuxtConfig } from '../../app/utils/duxt-config';
 import { resolveServerTexts } from '../utils/duxt-server-text';
+import { duxtPublicOrigin } from '../utils/public-origin';
 
 /**
  * llms.txt — the site's own map, for a model reading it.
@@ -24,7 +25,7 @@ export default defineEventHandler(async (event) => {
   // has none by that name, and llms.txt is the whole site's index.
   const pages = await llmsPages(event, duxt.resolvedSources);
 
-  const origin = getRequestURL(event).origin;
+  const origin = duxtPublicOrigin(event);
 
   const lines = [
     `# ${duxt.title}`,

package/server/routes/rss.xml.get.ts

@@ -1,6 +1,7 @@
 import { queryCollection } from '@nuxt/content/nitro';
 import { duxtDefaults, mergeDuxtConfig } from '../../app/utils/duxt-config';
 import { resolveServerTexts } from '../utils/duxt-server-text';
+import { duxtPublicOrigin } from '../utils/public-origin';
 
 /**
  * An RSS feed over one section — a changelog, a release log, a blog.
@@ -36,7 +37,7 @@ export default defineEventHandler(async (event) => {
     mergeDuxtConfig(appConfig.duxt, duxtDefaults)
   );
 
-  const origin = getRequestURL(event).origin;
+  const origin = duxtPublicOrigin(event);
   const feed = duxt.feed;
   const title = typeof feed?.title === 'string' ? feed.title : undefined;
 

package/server/utils/doc-page.ts

@@ -0,0 +1,43 @@
+import { queryCollection } from '@nuxt/content/nitro';
+import type { H3Event } from 'h3';
+import { splitLocalePath } from '../../app/utils/locale-path';
+import {
+  sourcesForRoute,
+  type DuxtResolvedSource
+} from '../../build/sources/sources-resolve';
+import type { DuxtLocaleSetup } from './mcp-docs';
+
+/** Request-bound lookup shared by HTTP Markdown and MCP, including provenance. */
+export async function duxtDocPage(
+  event: H3Event,
+  path: string,
+  sources: DuxtResolvedSource[],
+  setup: DuxtLocaleSetup
+) {
+  const { locale, path: wanted } = splitLocalePath(path, setup.codes);
+  for (const source of sourcesForRoute(
+    wanted,
+    locale ?? setup.defaultLocale,
+    sources,
+    setup.fallbackLocale
+  )) {
+    const page = await queryCollection(
+      event,
+      source.collection as Parameters<typeof queryCollection>[1]
+    )
+      .path(wanted)
+      .select('title', 'description', 'rawbody')
+      .first();
+    if (page)
+      return {
+        page: page as {
+          title?: string;
+          description?: string;
+          rawbody?: string;
+        },
+        source,
+        locale,
+        path: wanted
+      };
+  }
+}

package/server/utils/mcp-docs.ts

@@ -379,56 +379,115 @@ export interface DuxtScopedPage {
   source: DuxtResolvedSource;
 }
 
-/**
- * Every page in a scope, translations resolved.
- *
- * One pass per collection rather than one query per page: the chain is short
- * and the first collection holding a path wins, which is the same fallback the
- * rendered page takes. `rawbody` is only asked for when the caller needs it —
- * a table of contents that loads every body is the cost `llms.txt` already had
- * to have taken out of it.
- */
-export async function duxtScopedPages(
+// Production collections are immutable for the lifetime of a deployment.
+// Cache paths alone: retaining raw bodies here would turn every Worker into a
+// second database. Dev bypasses the cache so authored changes appear at once.
+const collectionPaths = new Map<string, Promise<string[]>>();
+async function paths(event: H3Event, collection: string): Promise<string[]> {
+  const load = async () => {
+    const rows = await queryCollection(
+      event,
+      collection as Parameters<typeof queryCollection>[1]
+    )
+      .select('path')
+      .all();
+    return rows.flatMap((row) =>
+      typeof row.path === 'string' ? [row.path] : []
+    );
+  };
+  if (import.meta.dev) return load();
+  let cached = collectionPaths.get(collection);
+  if (!cached) {
+    cached = load();
+    collectionPaths.set(collection, cached);
+    cached.catch(() => collectionPaths.delete(collection));
+  }
+  return cached;
+}
+
+/** Bounded payload reads, retaining locale precedence and Unicode matching. */
+export async function duxtScopedPage(
   event: H3Event,
   scope: DuxtScope,
   setup: DuxtLocaleSetup,
-  withBody = false
-): Promise<DuxtScopedPage[]> {
-  const fields = withBody
-    ? (['path', 'title', 'description', 'rawbody', 'search'] as const)
-    : (['path', 'title', 'description', 'search'] as const);
-  const found = new Map<string, DuxtScopedPage>();
-
+  limit: number = DUXT_PAGE_SIZE,
+  cursor?: string,
+  term?: string,
+  signal?: AbortSignal
+): Promise<DuxtCursorPage<DuxtScopedPage>> {
+  const found = new Map<string, DuxtResolvedSource>();
   for (const group of scope.groups) {
     for (const source of group.sources) {
-      const pages = (await queryCollection(
+      for (const path of await paths(event, source.collection)) {
+        if (!found.has(path)) found.set(path, source);
+      }
+    }
+  }
+  const candidates = [...found]
+    .map(([documentPath, source]) => ({
+      documentPath,
+      source,
+      path: duxtPublicPath(documentPath, scope.locale, setup)
+    }))
+    .sort((a, b) => a.path.localeCompare(b.path))
+    .filter((page) => !cursor || page.path.localeCompare(cursor) > 0);
+  const size = Math.max(1, Math.min(DUXT_PAGE_MAX, limit));
+  const matches: DuxtScopedPage[] = [];
+  const batchSize = term === undefined ? size + 1 : 64;
+  const fields =
+    term === undefined
+      ? (['path', 'title', 'description', 'search'] as const)
+      : (['path', 'title', 'description', 'rawbody', 'search'] as const);
+  for (
+    let offset = 0;
+    offset < candidates.length && matches.length <= size;
+    offset += batchSize
+  ) {
+    // A miss reads the whole scope, which is the price of exact matching; a
+    // client that has given up on the answer should not keep paying it.
+    signal?.throwIfAborted();
+    const batch = candidates.slice(offset, offset + batchSize);
+    const rows = new Map<string, DuxtScopedPage>();
+    for (const source of new Set(batch.map((page) => page.source))) {
+      const wanted = batch.filter((page) => page.source === source);
+      const pages = await queryCollection(
         event,
         source.collection as Parameters<typeof queryCollection>[1]
       )
+        .where(
+          'path',
+          'IN',
+          wanted.map((page) => page.documentPath)
+        )
         .select(...fields)
-        .all()) as unknown as {
-        path?: string;
-        title?: string;
-        description?: string;
-        rawbody?: string;
-        search?: boolean;
-      }[];
-
+        .limit(wanted.length)
+        .all();
       for (const page of pages) {
-        const documentPath = page.path;
-        if (!documentPath || found.has(documentPath)) continue;
-
-        found.set(documentPath, {
+        if (typeof page.path !== 'string') continue;
+        rows.set(page.path, {
           ...page,
-          documentPath,
-          path: duxtPublicPath(documentPath, scope.locale, setup),
+          documentPath: page.path,
+          path: duxtPublicPath(page.path, scope.locale, setup),
           source
-        });
+        } as DuxtScopedPage);
       }
     }
+    for (const candidate of batch) {
+      const page = rows.get(candidate.documentPath);
+      if (!page) continue;
+      if (
+        term !== undefined &&
+        (page.search === false ||
+          ![page.title, page.description, page.rawbody].some((value) =>
+            value?.toLowerCase().includes(term)
+          ))
+      )
+        continue;
+      matches.push(page);
+      if (matches.length > size) break;
+    }
   }
-
-  return [...found.values()].sort((a, b) => a.path.localeCompare(b.path));
+  return duxtCursorPage(matches, size);
 }
 
 /** How many results a listing returns when the caller does not say. */