npm - blume - Versions diffs - 1.2.0 → 1.3.0 - Mend

blume 1.2.0 → 1.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (77) hide show

package/CHANGELOG.md +45 -0
package/dist/cli/index.js +1715 -539
package/dist/cli/index.js.map +40 -31
package/dist/types/core/config-input.d.ts +131 -11
package/dist/types/core/config.d.ts +9 -1
package/dist/types/core/data.d.ts +24 -5
package/dist/types/core/i18n-ui.d.ts +58 -799
package/dist/types/core/schema.d.ts +534 -3305
package/dist/types/theme/fonts.d.ts +55 -11
package/docs/02-deployment.mdx +2 -0
package/docs/07-faq.mdx +14 -14
package/docs/advanced/skills.mdx +2 -2
package/docs/configuration/ai.mdx +126 -2
package/docs/configuration/index.mdx +19 -1
package/docs/configuration/search.mdx +17 -0
package/docs/configuration/seo.mdx +26 -3
package/docs/configuration/theming.mdx +44 -2
package/docs/content/syntax.mdx +18 -2
package/docs/reference/cli.mdx +3 -3
package/package.json +9 -8
package/skills/blume/SKILL.md +6 -4
package/skills/blume-migrate/SKILL.md +5 -3
package/skills/blume-migrate/references/mintlify.md +5 -5
package/skills/blume-migrate/references/monorepo.md +2 -1
package/src/ai/agent-readability.ts +31 -1
package/src/ai/api-catalog.ts +81 -0
package/src/ai/ask-context.ts +7 -1
package/src/ai/ask-data.ts +1 -0
package/src/ai/link-headers.ts +52 -0
package/src/ai/llms.ts +12 -1
package/src/ai/markdown.ts +15 -2
package/src/ai/mcp/data.ts +7 -0
package/src/ai/mcp/discovery.ts +70 -15
package/src/ai/mcp/server.ts +14 -8
package/src/ai/mcp/stdio.ts +4 -1
package/src/ai/skills.ts +193 -0
package/src/ai/tar.ts +104 -0
package/src/ai/web-bot-auth.ts +30 -0
package/src/astro/generate.ts +116 -6
package/src/astro/integration.ts +52 -14
package/src/astro/templates.ts +191 -37
package/src/audit/catalog.ts +20 -0
package/src/audit/checks/dns-aid.ts +190 -0
package/src/audit/report.ts +5 -0
package/src/audit/run.ts +2 -0
package/src/cli/commands/build.ts +178 -9
package/src/cli/init/scaffold.ts +1 -1
package/src/components/islands/ask-ai.tsx +4 -1
package/src/components/islands/webmcp.ts +203 -0
package/src/components/layout/NavTree.astro +4 -4
package/src/components/layout/PageLayout.astro +2 -0
package/src/components/layout/ReferenceLayout.astro +2 -0
package/src/components/layout/RootLayout.astro +63 -11
package/src/components/layout/Search.astro +2 -2
package/src/components/layout/WebMcp.astro +49 -0
package/src/components/layout/search/orama.ts +5 -2
package/src/core/config-input.ts +143 -11
package/src/core/config.ts +17 -1
package/src/core/content-assets.ts +199 -0
package/src/core/data.ts +21 -5
package/src/core/diagnostics.ts +6 -5
package/src/core/i18n-ui.ts +19 -28
package/src/core/project-graph.ts +6 -0
package/src/core/schema.ts +224 -71
package/src/core/sources/normalize.ts +5 -5
package/src/deploy/headers.ts +45 -3
package/src/deploy/vercel-negotiation.ts +233 -0
package/src/markdown/mermaid.ts +7 -1
package/src/markdown/table-wrap.ts +33 -1
package/src/og/card.ts +91 -22
package/src/og/derive.ts +200 -0
package/src/og/index.ts +6 -1
package/src/search/orama-index.ts +151 -7
package/src/theme/entry.ts +34 -13
package/src/theme/fonts.ts +183 -30
package/dist/types/og/card.d.ts +0 -63
package/dist/types/og/dimensions.d.ts +0 -12

package/src/astro/templates.ts CHANGED Viewed

@@ -5,12 +5,14 @@ import { dirname, isAbsolute, join, relative } from "pathe";
 import { askBackendRuntimeDep } from "../ai/ask.ts";
 import type { AskBackend } from "../ai/ask.ts";
+import { buildHomeLinkHeader } from "../ai/link-headers.ts";
 import { normalizeBasePath } from "../core/base-path.ts";
 import type { ResolvedConfig } from "../core/schema.ts";
 import { BLUME_IGNORE_DIRS } from "../core/sources/watch.ts";
 import { trimChar } from "../core/trim.ts";
 import type { ProjectContext } from "../core/types.ts";
 import { applyBaseToAstroRedirects } from "../deploy/redirects.ts";
+import type { OgFont, OgFontFamilies } from "../og/card.ts";
 import { hasScalarReferences } from "../openapi/references.ts";
 import { searchProviderMeta } from "../search/providers.ts";
 import { buildFontEntries } from "../theme/fonts.ts";
@@ -358,6 +360,16 @@ const renderIntegrationBridge = (
   };
 };
+/**
+ * The generated config's `image` block. Remote images are only optimized when
+ * their host is authorized; local (relative-path) images need no
+ * configuration. Emitted only when set, so the generated config stays minimal.
+ */
+const renderImageOption = (config: ResolvedConfig): string =>
+  config.image.domains.length > 0 || config.image.remotePatterns.length > 0
+    ? `\n  image: ${JSON.stringify(config.image)},`
+    : "";
 export const astroConfigTemplate = (options: {
   context: ProjectContext;
   config: ResolvedConfig;
@@ -445,6 +457,7 @@ export const astroConfigTemplate = (options: {
   const baseOption = deployment.base
     ? `\n  base: ${JSON.stringify(deployment.base)},`
     : "";
+  const imageOption = renderImageOption(config);
   // Astro's native i18n gives locale-aware helpers + `<html lang>` correctness.
   // Blume owns getStaticPaths and materializes fallback routes in the manifest,
@@ -479,20 +492,43 @@ export const astroConfigTemplate = (options: {
         )},`
       : "";
-  // Self-hosted Google Fonts via Astro's Fonts API, derived from theme.fonts.
+  // Self-hosted fonts via Astro's Fonts API, derived from theme.fonts.
   // `fontProviders` is only imported when at least one font is configured.
+  // Local variant sources are emitted as absolute paths (the Astro root is
+  // `.blume/`, not the user's project, so root-relative paths would miss).
   const fontEntries = buildFontEntries(config.theme.fonts);
   const fontsOption = fontEntries.length
     ? `\n  fonts: [${fontEntries
-        .map(
-          (font) =>
-            `{ provider: fontProviders.google(), name: ${JSON.stringify(
-              font.name
-            )}, cssVariable: ${JSON.stringify(
-              font.cssVariable
-            )}, weights: ${JSON.stringify(
-              font.weights
-            )}, fallbacks: ${JSON.stringify(font.fallbacks)} }`
+        .map((font) =>
+          font.kind === "local"
+            ? `{ provider: fontProviders.local(), name: ${JSON.stringify(
+                font.name
+              )}, cssVariable: ${JSON.stringify(
+                font.cssVariable
+              )}, fallbacks: ${JSON.stringify(
+                font.fallbacks
+              )}, options: { variants: ${JSON.stringify(
+                font.variants.map((variant) => ({
+                  ...(variant.weight === undefined
+                    ? {}
+                    : { weight: variant.weight }),
+                  ...(variant.style === undefined
+                    ? {}
+                    : { style: variant.style }),
+                  src: [
+                    isAbsolute(variant.src)
+                      ? variant.src
+                      : join(context.root, variant.src),
+                  ],
+                }))
+              )} } }`
+            : `{ provider: fontProviders.${font.provider}(), name: ${JSON.stringify(
+                font.name
+              )}, cssVariable: ${JSON.stringify(
+                font.cssVariable
+              )}, weights: ${JSON.stringify(
+                font.weights
+              )}, fallbacks: ${JSON.stringify(font.fallbacks)} }`
         )
         .join(", ")}],`
     : "";
@@ -550,9 +586,15 @@ export const astroConfigTemplate = (options: {
     integrations.push("svelte()");
   }
   // Always mounted: injects user pages (a no-op when there are none) and wires
-  // up dev-server `Accept: text/markdown` negotiation over the content routes.
+  // up dev-server `Accept: text/markdown` negotiation over the content routes,
+  // plus the homepage agent-discovery `Link` header.
   integrations.push(
-    `blumeIntegration(${JSON.stringify({ base: deployment.base, contentRoutes, pages })})`
+    `blumeIntegration(${JSON.stringify({
+      base: deployment.base,
+      contentRoutes,
+      homeLinkHeader: buildHomeLinkHeader(config, contentRoutes) ?? undefined,
+      pages,
+    })})`
   );
   const watchOption = devWatchOption(
@@ -577,7 +619,7 @@ ${userConfigSetup}export default defineConfig({
   srcDir: ${JSON.stringify(`${context.outDir}/src`)},
   outDir: ${JSON.stringify(astroOutDir(context))},
   publicDir: ${JSON.stringify(`${context.root}/public`)},
-  output: ${JSON.stringify(deployment.output)},${adapterOption}${sessionOption}${siteOption}${baseOption}${redirectsOption}${i18nOption}${fontsOption}
+  output: ${JSON.stringify(deployment.output)},${adapterOption}${sessionOption}${siteOption}${baseOption}${imageOption}${redirectsOption}${i18nOption}${fontsOption}
   integrations: [${integrations.join(", ")}${userIntegrationSpread}],
   markdown: {
     processor: blumeMarkdownProcessor(${JSON.stringify({
@@ -875,18 +917,18 @@ export const askEndpointTemplate = (
         console.error("Ask AI provider error:", error);
       },`;
   const stream = grounded
-    ? `    const system =
+    ? `    const instructions =
       (await ground(messages, body.page)) ??
       "You are a helpful documentation assistant. Answer using the project's documentation.";
     const result = streamText({
       model: ${modelExpr},
-      system,
+      instructions,
       messages,
 ${onError}
     });`
     : `    const result = streamText({
       model: ${modelExpr},
-      system:
+      instructions:
         "You are a helpful documentation assistant. Answer using the project's documentation.",
       messages,
 ${onError}
@@ -976,12 +1018,18 @@ const searchClientImport = (module: string): string =>
 const SEARCH_BASE_IMPORT =
   'import { joinBase } from "blume/components/islands/base-path.ts";\n';
-/** A client that loads a static `blume-search.json` index (Orama, FlexSearch). */
-const staticSearchClient = (module: string): string =>
+/**
+ * A client that loads a static `blume-search.json` index (Orama, FlexSearch).
+ * `locale` (Orama only) is the site's `i18n.defaultLocale`, which selects a
+ * word-segmenting tokenizer for languages written without spaces.
+ */
+const staticSearchClient = (module: string, locale?: string): string =>
   `${SEARCH_CLIENT_HEADER}${searchClientImport(module)}${SEARCH_BASE_IMPORT}
 const indexUrl = joinBase(import.meta.env.BASE_URL, "blume-search.json");
-export const createSearch = () => create({ indexUrl });
+export const createSearch = () => create({ indexUrl${
+    locale ? `, locale: ${JSON.stringify(locale)}` : ""
+  } });
 `;
 /** A client that passes public credentials straight to the provider SDK. */
@@ -1030,7 +1078,12 @@ export const searchClientTemplate = (config: ResolvedConfig): string => {
   const { search } = config;
   if (search.provider === "orama" || search.provider === "flexsearch") {
-    return staticSearchClient(search.provider);
+    // Only Orama derives a tokenizer from the locale; FlexSearch has no
+    // equivalent hook, so its client keeps the bare index URL.
+    return staticSearchClient(
+      search.provider,
+      search.provider === "orama" ? config.i18n?.defaultLocale : undefined
+    );
   }
   const hosted = hostedSearchOptions(search);
@@ -1136,6 +1189,105 @@ export function GET({ props }: { props: { route: string } }) {
 }
 `;
+/**
+ * Generate the `/blume-assets/[...asset]` endpoint. It serves two families of
+ * files that exist on disk but outside the public dir:
+ *   - `content/<project-relative path>` — colocated content images
+ *     (`![alt](./diagram.png)`), served as originals for the agent-facing
+ *     Markdown endpoints (the HTML render uses the `astro:assets`-optimized
+ *     copies instead). The mapping comes from `generated/content-assets.json`.
+ *   - `<source>/<hash>.<ext>` — remote-source images the scan pipeline
+ *     materializes under `.blume/public/blume-assets` (see
+ *     `core/sources/assets.ts`). That directory is NOT Astro's `publicDir`
+ *     (which points at the user project's `public/`), so without this endpoint
+ *     those references 404.
+ * Prerendered: every asset becomes a static file in the build output; the dev
+ * server renders on demand, so new images appear without a restart.
+ */
+export const contentAssetsEndpointTemplate = (
+  stagedAssetsDir: string
+): string =>
+  `// Generated by Blume. Do not edit.
+import { existsSync } from "node:fs";
+import { readdir, readFile } from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+import type { APIRoute } from "astro";
+import assets from "../../generated/content-assets.json";
+export const prerender = true;
+const files = assets as Record<string, string>;
+const STAGED_DIR = ${JSON.stringify(stagedAssetsDir)};
+const TYPES: Record<string, string> = {
+  ".apng": "image/apng",
+  ".avif": "image/avif",
+  ".bmp": "image/bmp",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".tiff": "image/tiff",
+  ".webp": "image/webp",
+};
+const contentType = (path: string): string =>
+  TYPES[path.slice(path.lastIndexOf(".")).toLowerCase()] ??
+  "application/octet-stream";
+const stagedParams = async (): Promise<string[]> => {
+  if (!existsSync(STAGED_DIR)) {
+    return [];
+  }
+  const entries = await readdir(STAGED_DIR, {
+    recursive: true,
+    withFileTypes: true,
+  });
+  return entries
+    .filter((entry) => entry.isFile())
+    .map((entry) =>
+      relative(STAGED_DIR, join(entry.parentPath, entry.name)).replaceAll(
+        "\\\\",
+        "/"
+      )
+    );
+};
+export async function getStaticPaths() {
+  const params = [
+    ...Object.keys(files).map((key) => "content/" + key),
+    ...(await stagedParams()),
+  ];
+  return params.map((asset) => ({ params: { asset } }));
+}
+const resolveAsset = (asset: string): string | null => {
+  if (asset.startsWith("content/")) {
+    return files[asset.slice("content/".length)] ?? null;
+  }
+  const abs = resolve(STAGED_DIR, asset);
+  // Traversal guard: the dev server renders on demand, so the param is
+  // attacker-controlled there — never step outside the staged directory.
+  if (!abs.startsWith(STAGED_DIR + "/")) {
+    return null;
+  }
+  return existsSync(abs) ? abs : null;
+};
+export const GET: APIRoute = async ({ params }) => {
+  const path = resolveAsset(String(params.asset ?? ""));
+  if (!path) {
+    return new Response(null, { status: 404 });
+  }
+  const body = await readFile(path);
+  return new Response(new Uint8Array(body), {
+    headers: { "Content-Type": contentType(path) },
+  });
+};
+`;
 /** The `src/pages` file that serves a route, e.g. `/mcp` -> `mcp.ts`. */
 export const mcpPageFile = (route: string): string =>
   `${trimChar(route, "/")}.ts`;
@@ -1201,12 +1353,14 @@ export function GET({ props }: { props: { section: string } }) {
 }
 `;
-/** Generate the OG image endpoint (`.blume/src/pages/_og/[...slug].png.ts`). */
+/** Generate the OG image endpoint (`.blume/src/pages/og/[...slug].png.ts`). */
 export const ogEndpointTemplate = (
-  customRoutes: OgCustomRoute[] = []
+  customRoutes: OgCustomRoute[] = [],
+  og: { families?: OgFontFamilies; fonts?: OgFont[] } = {}
 ): string =>
   `// Generated by Blume. Do not edit.
 import { renderOgImage } from "blume/og";
+import type { OgFont, OgFontFamilies } from "blume/og";
 import data from "blume:data";
 export const prerender = true;
@@ -1216,6 +1370,15 @@ export const prerender = true;
 // (ts(7034)) under a strict tsconfig.
 const customRoutes: { slug: string; title: string }[] = ${JSON.stringify(customRoutes)};
+// Card fonts, resolved at generation time (explicit seo.og.fonts, or derived
+// from theme.fonts). Local entries carry absolute build-machine paths, which
+// is why they are baked into this build-only endpoint instead of the runtime
+// data that pages serialize into HTML.
+const fonts: OgFont[] = ${JSON.stringify(og.fonts ?? [])};
+const families: OgFontFamilies | undefined = ${
+    og.families ? JSON.stringify(og.families) : "undefined"
+  };
 export function getStaticPaths() {
   const seen = new Set<string>();
   const paths: { params: { slug: string }; props: { title: string } }[] = [];
@@ -1236,32 +1399,23 @@ export function getStaticPaths() {
   return paths;
 }
-// Footer branding shared by every card, derived once from the resolved config.
-// The repo slug reuses the header link URL; the host comes from the site URL.
+// Footer branding shared by every card. The repo slug reuses the header link
+// URL; the site text (host plus deployment base) is resolved at generate time.
 const repoSlug = data.config.repoUrl
   ? data.config.repoUrl.split("github.com/")[1]
   : undefined;
-const siteHost = (() => {
-  if (!data.config.site) {
-    return undefined;
-  }
-  try {
-    return new URL(data.config.site).host;
-  } catch {
-    return undefined;
-  }
-})();
 export async function GET({ props }: { props: { title: string } }) {
   const png = await renderOgImage({
     accent: data.config.og.palette?.accent ?? data.config.theme.accent.light,
     brand: data.config.title,
-    description: data.config.description,
-    fonts: data.config.og.fonts,
+    description: data.config.og.description,
+    families,
+    fonts,
     logo: data.config.og.logo,
     palette: data.config.og.palette,
     repo: repoSlug,
-    site: siteHost,
+    site: data.config.og.site,
     title: props.title,
   });
   return new Response(new Uint8Array(png), {

package/src/audit/catalog.ts CHANGED Viewed

@@ -690,6 +690,26 @@ export const CHECKS = [
     tier: "static",
     title: "Indexable page missing from llms.txt",
   },
+  // DNS-AID (draft-mozleywilliams-dnsop-dnsaid) lives in the DNS zone, not the
+  // build, so unlike the llms.txt checks these can only observe and advise —
+  // hence `info`: publishing the records is a DNS-provider action Blume can't
+  // take for you, and the draft is young enough that absence is the norm.
+  {
+    category: "ai",
+    fix: "Publish a ServiceMode SVCB or HTTPS record at `_index._agents.<host>` with your DNS provider so agents can discover the site via DNS (DNS-AID).",
+    id: "BLUME_AUDIT_DNS_AID_MISSING",
+    severity: "info",
+    tier: "network",
+    title: "No DNS-AID agent-discovery records",
+  },
+  {
+    category: "ai",
+    fix: "Enable DNSSEC for the zone so validating resolvers return authenticated DNS-AID answers; if your DNS provider doesn't support DNSSEC, the records still work unsigned.",
+    id: "BLUME_AUDIT_DNS_AID_UNSIGNED",
+    severity: "info",
+    tier: "network",
+    title: "DNS-AID records are not DNSSEC-authenticated",
+  },
   // Structured data. Note we validate only what Blume itself emits — we do not
   // claim Google-rich-results or full schema.org validation (the former is an

package/src/audit/checks/dns-aid.ts ADDED Viewed

@@ -0,0 +1,190 @@
+import type { Diagnostic } from "../../core/types.ts";
+import { finding } from "../catalog.ts";
+import type { CheckModule } from "../types.ts";
+/**
+ * DNS-AID (draft-mozleywilliams-dnsop-dnsaid): agents discover a site's AI
+ * surface by querying ServiceMode SVCB/HTTPS records under the `_agents` DNS
+ * namespace — the well-known entrypoint is `_index._agents.<host>`. The
+ * records live in the DNS zone, which no build artifact can publish, so this
+ * check probes the live DNS over DoH and reports what to add. It queries the
+ * `deployment.site` host (the domain agents actually probe), not the `--url`
+ * origin, which is often a localhost preview.
+ */
+/** SVCB and its HTTPS specialization (RFC 9460). */
+const RR_SVCB = 64;
+const RR_HTTPS = 65;
+const DOH_TIMEOUT_MS = 5000;
+/**
+ * DoH JSON resolvers, tried in order until one answers. Both accept the same
+ * `?name=&type=` query and the `application/dns-json` accept header (Google
+ * ignores it, Cloudflare requires it). `BLUME_DOH_URL` overrides the list for
+ * networks that block the public resolvers (and for tests, which must never
+ * touch the real DNS).
+ */
+const DOH_RESOLVERS = [
+  "https://dns.google/resolve",
+  "https://cloudflare-dns.com/dns-query",
+];
+const resolvers = (): string[] => {
+  const override = process.env.BLUME_DOH_URL;
+  return override ? [override] : DOH_RESOLVERS;
+};
+/** The subset of the DoH JSON response this check reads (RFC 8427-shaped). */
+interface DohResponse {
+  /** DNSSEC-validated by the resolver (the AD flag). */
+  AD?: boolean;
+  Answer?: { data?: string; type?: number }[];
+  Status?: number;
+}
+export interface DnsAidResult {
+  /** Whether every record set found came back DNSSEC-authenticated. */
+  authenticated: boolean;
+  /** Whether any SVCB/HTTPS record exists at the well-known entrypoint. */
+  found: boolean;
+}
+/** One resolver's answer, or null when it's unreachable or not DoH-JSON. */
+const fetchDohJson = async (
+  base: string,
+  name: string,
+  type: number,
+  fetchFn: typeof fetch
+): Promise<DohResponse | null> => {
+  try {
+    const response = await fetchFn(
+      `${base}?name=${encodeURIComponent(name)}&type=${type}`,
+      {
+        headers: { accept: "application/dns-json" },
+        signal: AbortSignal.timeout(DOH_TIMEOUT_MS),
+      }
+    );
+    if (!response.ok) {
+      return null;
+    }
+    return (await response.json()) as DohResponse;
+  } catch {
+    return null;
+  }
+};
+const queryDoh = async (
+  name: string,
+  type: number,
+  fetchFn: typeof fetch
+): Promise<DohResponse | null> => {
+  for (const base of resolvers()) {
+    // oxlint-disable-next-line no-await-in-loop -- fallback chain: the next resolver is only tried when this one fails
+    const response = await fetchDohJson(base, name, type, fetchFn);
+    if (response) {
+      return response;
+    }
+  }
+  return null;
+};
+/**
+ * Query the DNS-AID entrypoint for a host over DoH: both SVCB and HTTPS
+ * rrtypes at `_index._agents.<host>` (the checker-facing convention accepts
+ * either). Returns null when no resolver answered at all — "couldn't check"
+ * must stay distinct from "checked and absent", or a flaky network would
+ * report every site as undiscoverable.
+ */
+export const lookupDnsAid = async (
+  host: string,
+  fetchFn: typeof fetch = fetch
+): Promise<DnsAidResult | null> => {
+  const name = `_index._agents.${host}`;
+  let answered = false;
+  let found = false;
+  let authenticated = true;
+  const responses = await Promise.all(
+    [RR_HTTPS, RR_SVCB].map((type) => queryDoh(name, type, fetchFn))
+  );
+  for (const response of responses) {
+    if (!response) {
+      continue;
+    }
+    answered = true;
+    const records = (response.Answer ?? []).filter(
+      (answer) => answer.type === RR_SVCB || answer.type === RR_HTTPS
+    );
+    if (records.length > 0) {
+      found = true;
+      authenticated &&= response.AD === true;
+    }
+  }
+  return answered ? { authenticated, found } : null;
+};
+/** The findings for a lookup result — pure, so it's testable without DoH. */
+export const dnsAidFindings = (
+  host: string,
+  result: DnsAidResult
+): Diagnostic[] => {
+  if (!result.found) {
+    return [
+      finding(
+        "BLUME_AUDIT_DNS_AID_MISSING",
+        { url: "/" },
+        `No SVCB or HTTPS records at _index._agents.${host} — agents probing DNS for AI Discovery (DNS-AID) find nothing.`,
+        `Publish a ServiceMode record with your DNS provider, e.g. \`_index._agents.${host}. 3600 IN HTTPS 1 ${host}. alpn=h2\`, and sign the zone with DNSSEC if the provider supports it.`
+      ),
+    ];
+  }
+  if (!result.authenticated) {
+    return [
+      finding(
+        "BLUME_AUDIT_DNS_AID_UNSIGNED",
+        { url: "/" },
+        `The DNS-AID records at _index._agents.${host} exist but are not DNSSEC-authenticated, so validating resolvers can't prove they're genuine.`
+      ),
+    ];
+  }
+  return [];
+};
+/** The `deployment.site` hostname, or null when unset/unusable for DNS. */
+export const dnsAidHost = (site?: string): string | null => {
+  if (!site) {
+    return null;
+  }
+  let hostname: string;
+  try {
+    ({ hostname } = new URL(site));
+  } catch {
+    return null;
+  }
+  // A local or dotless host has no public zone to query.
+  if (
+    hostname === "localhost" ||
+    hostname.endsWith(".local") ||
+    !hostname.includes(".")
+  ) {
+    return null;
+  }
+  return hostname;
+};
+export const dnsAidChecks: CheckModule = {
+  category: "ai",
+  async run(context) {
+    if (!context.origin) {
+      return [];
+    }
+    const host = dnsAidHost(context.project.config.deployment.site);
+    if (!host) {
+      return [];
+    }
+    const result = await lookupDnsAid(host);
+    // No resolver answered: report nothing rather than guess.
+    return result ? dnsAidFindings(host, result) : [];
+  },
+  tier: "network",
+};

package/src/audit/report.ts CHANGED Viewed

@@ -192,6 +192,11 @@ export const formatReport = (
       : group.findings.slice(0, PREVIEW);
     for (const diagnostic of shown) {
       lines.push(findingLine(diagnostic, root));
+      // The message names the specifics the rolled-up line can't — which target
+      // is broken, what the duplicate is — so --verbose prints it per finding.
+      if (options.verbose) {
+        lines.push(`        ${COLORS.dim}${diagnostic.message}${COLORS.reset}`);
+      }
     }
     const hidden = group.count - shown.length;
     if (hidden > 0) {

package/src/audit/run.ts CHANGED Viewed

@@ -8,6 +8,7 @@ import { CHECKS } from "./catalog.ts";
 import type { CheckId } from "./catalog.ts";
 import { assetChecks } from "./checks/assets.ts";
 import { contentChecks } from "./checks/content.ts";
+import { dnsAidChecks } from "./checks/dns-aid.ts";
 import { duplicateChecks } from "./checks/duplicates.ts";
 import { i18nChecks } from "./checks/i18n.ts";
 import { indexabilityChecks } from "./checks/indexability.ts";
@@ -51,6 +52,7 @@ const MODULES: CheckModule[] = [
   structuredDataChecks,
   urlChecks,
   networkChecks,
+  dnsAidChecks,
   externalChecks,
 ];