blume 1.1.3 → 1.2.0

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # blume
 
+## 1.2.0
+
+### Minor Changes
+
+- 217975c: Add a top-level `integrations` array to `blume.config.ts` for registering Astro integrations. Entries are schema-validated as an array (each element is left for Astro to validate) and appended after Blume's built-in integrations in declaration order, with no sorting or deduplication. The generated Astro config loads them through a portable bridge back to `blume.config.ts` rather than serializing the instances, so function-bearing hooks survive across build, `blume dev`, config regeneration, and eject. Install and version each integration in the site itself — Blume neither adds it to the runtime's dependencies nor manages its Astro compatibility.
+- 592af35: Add `blume eval`, a test suite for your docs. An AI agent — Claude Code by default, Codex with `--agent codex`, spawned from your own installation with no API keys held by Blume — answers the questions in `evals.yaml` using ONLY the documentation, served over a private MCP stdio bridge to an agent locked out of its file, shell, and web tools; a judge pass then grades each answer against the expected facts you listed. Any question the docs can't answer fails CI (relax with `--threshold`), each failure is anchored to the source page that should answer it, `--json` emits the validate/audit-compatible machine report, `--fix` hands the failing report to the agent to edit the docs interactively, and `blume eval init` drafts a starter evals file from your existing docs. No build or deployment is needed — the docs snapshot is computed from the content tree.
+- 2063196: Let a header tab declare its link target with `href`. A tab's `path` scopes its sidebar section and doubles as the link, so a section whose `path` isn't a page of its own falls back to the section's first page rather than linking to a 404. That fallback only sees the content tree, so a tab pointing at a route generated outside it — the automatic `/changelog` index, or a custom page under `pages/` — lands on the section's first entry instead of the page the reader expected. Setting `href` keeps the tab on the declared route; the field is optional and tabs that omit it resolve exactly as before. Declared hrefs are localized and rebased like any other route, so they work under i18n and a `deployment.base`.
+- 55e176a: Support external Ask AI endpoints on static sites and per-source OpenAPI search, llms.txt, and crawler indexing controls.
+
+### Patch Changes
+
+- 18e1d8d: Stop Cloudflare server builds from declaring unused `SESSION` KV and `IMAGES` bindings in the generated wrangler config. Without a configured session driver, `@astrojs/cloudflare` force-enables KV-backed sessions — making `wrangler deploy` demand a real KV namespace nothing reads — and defaults images to the runtime Cloudflare Images binding. Blume never reads `Astro.session` and every HTML route prerenders, so the generated Astro config now sets an inert in-memory session driver and `imageService: "compile"`, which pre-optimizes images at build time with sharp.
+- 38475cb: `blume init` now adds `node_modules/` to the generated `.gitignore` alongside Blume's runtime and build output directories.
+- 0c8f78d: Make the entire sidebar navigation back row clickable. When a drilled-in section has no index page, the chevron and title now form a single full-width back button; when it does have one, the title link and back button each fill their side of the row so there are no dead zones, and both get row hover states.
+- 812b09e: Fix nested `<Tree>` folder chevrons, nested `<Accordion>` chevrons, and a nested object schema's "Show properties" toggle reflecting an ancestor's open state instead of their own. All three rotated or flipped on Tailwind's `group-open:` variant, which matches any open ancestor `.group` — the same leak as the nested sidebar chevron — so a collapsed disclosure inside an expanded one showed an open indicator. Each indicator is now scoped to its own `details`.
+- 812b09e: Fix a nested sidebar group's chevron pointing down while the group is collapsed. The chevron rotated on Tailwind's `group-open:` variant, which matches any descendant of an open `.group` — and since every collapsible group in the tree is a `.group`, expanding a parent rotated the chevrons of its collapsed children too, so the arrow disagreed with the items it was hiding. The rotation is now scoped to the group's own `details`, leaving each chevron to reflect only its own open state.
+- d5d6b7a: Fix the EPUB page action failing in dev with `epub is not a function`. `epub-gen-memory`'s browser bundle is a browserified UMD, and its dynamic import lives inside `node_modules/blume`, which Vite's optimizer scan doesn't crawl — so in dev it was served as raw ESM, where the UMD finds no `exports`/`define`, exposes no `default`, and strands its callable on `window.epubGen`. It now joins mermaid in `optimizeDeps.include`, naming the `/bundle` subpath that is actually imported, since optimizing the package root leaves that entry unoptimized. Production builds already bundled it correctly and are unchanged.
+- 55e176a: Pagefind now honors search exclusions: pages with `search.exclude` frontmatter (and hidden pages, unless `search.indexing.includeHiddenPages` opts them in) no longer appear in local search results.
+
+## 1.1.4
+
+### Patch Changes
+
+- e4506a0: Keep the Ask AI panel open when Escape dismisses the search dialog stacked on top of it. The panel's window-level Escape listener fired alongside the dialog's native cancel, closing both surfaces when the user only meant to close search.
+- e4506a0: Stop reporting every `blume audit --claude`/`--codex` launch failure as "not found on PATH". Only a missing executable (`ENOENT`) gets the install hint now; any other spawn failure (`EACCES`, `EMFILE`, …) surfaces as itself instead of being masked by an irrelevant install suggestion.
+- e4506a0: Strip `deployment.base` before comparing canonical and sitemap URLs in `blume audit`. Canonicals and `<loc>`s are emitted as `site + base + route` while page URLs come from the base-less file tree, so on a subpath deployment every page false-fired `CANONICAL_BAD_TARGET`, `NON_CANONICAL_IN_SITEMAP`, and `INDEXABLE_PAGE_NOT_IN_SITEMAP` — and the duplicate-content checks silently skipped every page (each one looked like it canonicalized elsewhere).
+- e4506a0: Percent-decode pathnames before comparing them against the built file tree in `blume audit`. Sitemap `<loc>`s are `encodeURI`'d and `URL#pathname` re-encodes non-ASCII, while page URLs and file-index keys are raw on-disk names — so a non-ASCII route (e.g. a Japanese slug) false-fired `SITEMAP_BAD_URL`, and a percent-encoded href false-fired `LINK_TO_BROKEN`.
+- e4506a0: Probe live URLs under `deployment.base` in `blume audit --url`. Page URLs come from the base-less build tree, but the deployed site serves everything (pages, robots.txt, sitemap.xml) under the base — so auditing a healthy subpath deployment produced a wall of `HTTP_4XX` findings from probing the wrong URLs.
+- e4506a0: Strip query strings and fragments from redirect destinations before `blume audit` checks them against the build. A working redirect to `/guide#setup` or `/search?q=x` was reported `REDIRECT_BROKEN` because the suffixed path is not a file-tree member.
+- e4506a0: Apply `basePath` to configured redirects before `blume audit` resolves them. Redirects are authored as if mounted at root and gain the base at build time, but the audit compared them raw against built page URLs that carry the base — so every redirect on a `basePath` site was reported `REDIRECT_BROKEN`, while `LINK_TO_REDIRECT` and `REDIRECT_SOURCE_IS_PAGE` could never fire.
+- e4506a0: Keep `/` separators in Sanity and Notion slugs. Slugging deleted slashes along with other punctuation, so a `guides/setup` slug was mashed into `guidessetup` — and two documents whose slugs differ only by a slash silently overwrote each other. Segments are now slugged individually.
+- e4506a0: Stop promoting a `title="…"` embedded in another code-fence meta attribute's quoted value (`caption='set title="X" here' file.ts`) to the block title. Other quoted attributes are blanked before the explicit-title scan, so the bare-token title (`file.ts`) wins as intended.
+- 4294b00: Carry the resolved `dateFormat` config into the runtime data and its `BlumeDataConfig` type. A configured `dateFormat` was silently dropped from the serialized site data, so the date stamps always rendered the default long style, and `blume check` failed with ts(2339) on `data.config.dateFormat` in the generated catch-all page.
+- e4506a0: Fall through to the next platform env var when one is set but empty. `VERCEL_PROJECT_PRODUCTION_URL=""` dead-ended the chain before `VERCEL_URL` (same for Netlify's `URL`/`DEPLOY_PRIME_URL`/`DEPLOY_URL`), leaving `deployment.site` unset so canonicals, OG images, and the sitemap silently switched off for that deploy.
+- e4506a0: Leave the `.blume/node_modules` junction alone when it already points at the right target. It was deleted and re-created on every dev regeneration in the split-install layout, opening a window in which the dev server's module resolution raced a missing `node_modules` and intermittently failed with "Cannot find package".
+- e4506a0: Watch `blume.config.ts`, `theme.css`, and `components.ts` via their parent directory in `blume dev`. Watching the file path tracks the inode, so a rename-replace save (vim and most "atomic save" editors) orphaned the watcher after the first save — every later edit was silently ignored until the server restarted.
+- e4506a0: Localize internal `navigation.featured` hrefs per locale, like header tabs. A pinned `/changelog` link rendered on `/fr/…` pages always targeted the default-locale route, kicking the reader out of their language.
+- e4506a0: Stop opening a phantom code fence on a line-leading inline backtick span. A paragraph line like ` ```inline``` ` is not a fence opener (CommonMark forbids backticks in a backtick fence's info string), but the heading/link scanner treated it as one and silently dropped every heading and link after it from the TOC, search index, and anchor validation.
+- e4506a0: Stop misreading a body-leading thematic break as front matter in heading extraction. A stripped body opening with `---` followed by a blank line lost every heading up to the next `---` line — missing TOC and search entries, and false `BLUME_BROKEN_ANCHOR` findings from `blume validate`.
+- e4506a0: Strip the locale directory from a shared `.$` file's nav path with the `dir` parser. `fr/changelog.$.mdx` kept its `fr/` segment, silently routing the default locale's record inside the French URL namespace, the French copy to `/fr/fr/changelog`, and conjuring a spurious "Fr" sidebar group.
+- e4506a0: Skip images that are themselves links when wiring click-to-zoom. A linked image (`[![alt](/shot.png)](https://example.com)`) navigates on click, so the zoom binding only flashed an overlay in the instant before navigation while the `cursor-zoom-in` affordance promised a zoom that never happened.
+- e4506a0: Extract markdown link targets with balanced parentheses and image-wrapped labels intact. `[wiki](https://en.wikipedia.org/wiki/Foo_(bar))` was truncated at the inner `)` and reported as a broken link, and the outer target of `[![alt](/img.png)](/target)` was never validated at all (the nested image's own target still is).
+- e4506a0: Make the MCP tools' contract hold together: `search_docs` hits now include the `route` the tool description promises (alongside `url`), and `get_page` accepts a full URL or a base-prefixed path — an agent following "pass a route from `search_docs`" no longer gets "No page found" for a page that exists on a site with `deployment.site` or `deployment.base` configured.
+- ff0b2b0: Fix `.md` pages serving stale content in `blume dev`. The generated dev config kept Vite's watcher out of Astro's cache dir, which suppressed the `data-store.json` change events Astro relies on to invalidate content in a running dev server — so edited Markdown bodies (rendered into the data store at load time) kept serving the old HTML even after a hard reload, while `.mdx` pages (rendered through their own module) updated fine. The watcher ignore is now scoped to migrated (`content.root: "."`) projects, the only layout whose glob loader would otherwise churn on Astro's own cache writes.
+- e4506a0: Pair backtick code in OpenAPI descriptions the way CommonMark does — a run only closes on an _equal-length_ run. A lone inline backtick followed by a code fence used to "close" on the fence's first backtick, leaving `{`/`<` in the surrounding prose unescaped (an MDX compile error that fails the operation page's build) and entity-escaping the fence body.
+- e4506a0: Stop escaping `>` in OpenAPI descriptions rendered to MDX. It isn't MDX-special on its own, and escaping it turned a common `> **Note:** …` blockquote into a literal "&gt; Note:" paragraph.
+- e4506a0: Give every distinct OpenAPI tag a unique slug. Slugging strips all non-ASCII, so two non-Latin tags (`ペット`, `注文`) both collapsed to `operations` — merging their routes and sidebar groups and dropping the second tag's overview section. Colliding slugs now gain `-2`, `-3`, … in first-seen order.
+- e4506a0: Leave shifted and alted keyboard chords to the browser. Ctrl+Shift+I (DevTools) toggled the Ask AI panel and Ctrl+Shift+K (Firefox web console) opened the search dialog, because the ⌘I/⌘K matchers ignored the Shift and Alt modifiers.
+- e4506a0: Resolve explicit sidebar refs written with a trailing slash. A hand-written `"guides/"` normalized to `/guides/`, missed the slashless `/guides` route, and the item was silently dropped from the sidebar with no diagnostic.
+- 6554485: Keep the docs sidebar scrolled to the current page across navigations. Each page load previously reset the sidebar's own scroll container to the top, so on long sidebars the viewport visibly jumped away from the link you just clicked. A pre-paint inline script now centers the active link when it would otherwise be out of view — this also fixes deep links landing with the current page's link below the fold. Short sidebars, and pages whose active link is already visible, are untouched.
+- e4506a0: Only unwrap a _single_ rendered paragraph in `<Prompt>`, `<Frame>`, and `<Tooltip>`. The greedy unwrap matched across multiple paragraphs, injecting unbalanced `</p>`/`<p>` tags via `set:html` — a multi-paragraph description, caption, or tooltip label broke the surrounding layout when the parser re-parented the stray tags.
+- e4506a0: Dedupe repeated `<Update>` ids on a page, mirroring the accordion id dedupe. Two entries labeled "Bug fixes" produced duplicate DOM ids, so the second entry's self-anchor permalink jumped to the first one; later duplicates now gain `-2`, `-3`, … and their header anchors follow.
+- e4506a0: Make `useAskAI().reset()` revoke the in-flight stream, matching the built-in island. Resetting mid-answer used to let the next chunk re-append an orphaned assistant bubble onto the emptied conversation, and a fetch error after reset resurrected the entire pre-reset history. The request is now aborted and stale writes are discarded.
+
 ## 1.1.3
 
 ### Patch Changes

package/README.md

@@ -1,6 +1,6 @@
 # Blume
 
-[![npm version](https://img.shields.io/npm/v/blume.svg)](https://www.npmjs.com/package/blume) [![npm downloads](https://img.shields.io/npm/dm/blume.svg)](https://www.npmjs.com/package/blume) [![license](https://img.shields.io/npm/l/blume.svg)](./LICENSE) [![node](https://img.shields.io/node/v/blume.svg)](https://nodejs.org)
+[![npm downloads](https://img.shields.io/npm/dm/blume.svg)](https://www.npmjs.com/package/blume) [![Socket Badge](https://socket.dev/api/badge/npm/package/blume)](https://socket.dev/npm/package/blume) ![CodeRabbit Pull Request Reviews](https://img.shields.io/coderabbit/prs/github/haydenbleasel/blume?utm_source=oss&utm_medium=github&utm_campaign=haydenbleasel%2Fblume&labelColor=171717&color=FF570A&link=https%3A%2F%2Fcoderabbit.ai&label=CodeRabbit+Reviews)
 
 **Documentation for everything you build.** Fast, AI-ready, and zero-config. Free and open source, forever.