npm - blume - Versions diffs - 1.4.0 → 1.4.2 - Mend

blume 1.4.0 → 1.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (50) hide show

package/CHANGELOG.md +32 -0
package/dist/cli/index.js +328 -644
package/dist/cli/index.js.map +35 -35
package/dist/types/core/data.d.ts +10 -0
package/docs/configuration/ai.mdx +15 -1
package/package.json +28 -7
package/src/ai/component-markdown.ts +7 -6
package/src/ai/link-headers.ts +7 -2
package/src/astro/generate.ts +8 -13
package/src/astro/islands.ts +4 -1
package/src/astro/templates.ts +5 -4
package/src/audit/checks/indexability.ts +3 -6
package/src/audit/checks/robots.ts +18 -37
package/src/audit/crawl.ts +49 -49
package/src/audit/image-size.ts +13 -53
package/src/audit/report.ts +22 -33
package/src/audit/types.ts +6 -2
package/src/cli/commands/dev.ts +9 -21
package/src/cli/commands/doctor.ts +9 -22
package/src/cli/env.ts +6 -52
package/src/cli/init/scaffold.ts +15 -28
package/src/cli/internal-error.ts +11 -11
package/src/components/islands/ask-ai.tsx +25 -100
package/src/components/islands/hooks.ts +10 -3
package/src/components/layout/RootLayout.astro +78 -109
package/src/components/layout/Search.astro +3 -5
package/src/components/layout/search/types.ts +4 -16
package/src/components/openapi/helpers.ts +21 -75
package/src/core/component-overrides.ts +0 -7
package/src/core/config.ts +3 -3
package/src/core/data.ts +7 -0
package/src/core/diagnostics.ts +10 -20
package/src/core/fs-atomic.ts +22 -0
package/src/core/sources/github-releases.ts +29 -26
package/src/core/sources/mdx-remote.ts +10 -57
package/src/core/sources/notion.ts +17 -23
package/src/core/tsconfig-aliases.ts +39 -172
package/src/deploy/rss.ts +4 -1
package/src/deploy/sitemap.ts +3 -1
package/src/eval/report.ts +20 -28
package/src/markdown/directives.ts +6 -18
package/src/markdown/index.ts +1 -6
package/src/markdown/package-commands.ts +0 -4
package/src/openapi/parse.ts +11 -9
package/src/search/popular-icon.ts +3 -3
package/src/translate/ledger.ts +5 -11
package/src/translate/report.ts +22 -28
package/src/translate/run.ts +5 -24
package/src/translate/work-list.ts +0 -0
package/src/deploy/xml.ts +0 -8

package/dist/types/core/data.d.ts CHANGED Viewed

@@ -107,6 +107,16 @@ export interface BlumeDataConfig {
     /** `dateFormat`: `Intl.DateTimeFormat` options for the date stamps. */
     dateFormat: ResolvedConfig["dateFormat"];
     description: string | undefined;
+    /**
+     * Which agent-discovery resources exist for the layout to advertise in every
+     * page's `<head>` (`seo.agentReadability`, `ai.llmsTxt.enabled`) — the HTML
+     * counterpart of the homepage-only HTTP `Link` header, for agents that enter
+     * on a deep page (see `ai/link-headers.ts`).
+     */
+    discovery: {
+        agentReadability: boolean;
+        llmsTxt: boolean;
+    };
     favicon: BlumeFavicon;
     feedback: boolean;
     i18n: BlumeDataI18n | null;

package/docs/configuration/ai.mdx CHANGED Viewed

@@ -338,7 +338,21 @@ Link: </agent-readability.json>; rel="describedby"; type="application/json",
   </index.md>; rel="alternate"; type="text/markdown"
 ```
-Each entry appears only when its feature is on. The `alternate` link points at the homepage's Markdown mirror — the page's own [raw Markdown](#raw-markdown) when the home route is a content page, or the synthesized `llms.txt` fallback when it's a landing page. Sites that publish APIs also get a `rel="api-catalog"` entry pointing at the [generated API catalog](#api-catalog). The header rides on every surface Blume controls: the dev server (check it with `curl -I localhost:4321`), static builds via the emitted `_headers` file (Netlify and Cloudflare), and Vercel server builds via the deploy's routing rules. Hosts that ignore `_headers` on static output (GitHub Pages, S3) can't send custom response headers at all — there, agents still find everything through `llms.txt` and `agent-readability.json` at the site root.
+Each entry appears only when its feature is on. The `alternate` link points at the homepage's Markdown mirror — the page's own [raw Markdown](#raw-markdown) when the home route is a content page, or the synthesized `llms.txt` fallback when it's a landing page. Sites that publish APIs also get a `rel="api-catalog"` entry pointing at the [generated API catalog](#api-catalog). The header rides on every surface Blume controls: the dev server (check it with `curl -I localhost:4321`), static builds via the emitted `_headers` file (Netlify and Cloudflare), and Vercel server builds via the deploy's routing rules.
+Not every agent enters through the root, though — one following a search result or a shared link lands on a deep page and never sees the homepage header. So every rendered page also carries the same discovery links in its HTML `<head>`, using the same IANA-registered relations:
+```html
+<link
+  rel="describedby"
+  href="/agent-readability.json"
+  type="application/json"
+/>
+<link rel="describedby" href="/llms.txt" type="text/plain" />
+<link rel="alternate" href="/docs/example.md" type="text/markdown" />
+```
+Here the `alternate` link points at _that page's own_ [raw-Markdown mirror](#raw-markdown), so an agent can jump straight from the HTML it landed on to the token-efficient version. Because the head links travel with the prerendered HTML, they also work on hosts that ignore `_headers` and can't send custom response headers at all (GitHub Pages, S3) — no matter which page the agent enters on.
 ### API catalog

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "blume",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Documentation that's fast, AI-ready, and zero-config.",
   "keywords": [
     "astro",
@@ -71,7 +71,7 @@
     "@astrojs/mdx": "^7.0.0",
     "@astrojs/node": "^11.0.0",
     "@astrojs/react": "^6.0.0",
-    "@astrojs/vercel": "^11.0.0",
+    "@astrojs/vercel": "^11.0.3",
     "@clack/prompts": "^1.7.0",
     "@iconify-json/lucide": "^1.2.115",
     "@iconify/types": "^2.0.0",
@@ -88,25 +88,41 @@
     "@tailwindcss/vite": "^4",
     "@vercel/analytics": "^2.0.1",
     "ai": "^7.0.42",
-    "astro": "^7.0.2",
+    "astro": "^7.1.0",
     "babel-plugin-react-compiler": "^1.0.0",
+    "chokidar": "^5.0.0",
     "citty": "^0.1.6",
     "consola": "^3.4.0",
-    "dompurify": "^3.4.11",
+    "dompurify": "^3.4.13",
+    "dotenv": "^17.4.2",
     "epub-gen-memory": "^1.1.2",
+    "fast-xml-parser": "^5.10.1",
+    "get-tsconfig": "^4.14.1",
     "github-slugger": "^2.0.0",
     "gray-matter": "^4.0.3",
+    "html-escaper": "^3.0.3",
+    "image-size": "^2.0.2",
     "jiti": "^2.4.0",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^4.3.1",
     "katex": "^0.18.1",
+    "markdown-table": "^3.0.4",
     "marked": "^18.0.5",
-    "mermaid": "^11.15.0",
+    "mdast-util-from-markdown": "^2.0.3",
+    "mdast-util-gfm": "^3.1.0",
+    "mdast-util-to-string": "^4.0.0",
+    "medium-zoom": "^1.1.0",
+    "mermaid": "^11.16.1",
+    "micromark-extension-gfm": "^3.0.0",
     "node-html-parser": "^9.0.0",
+    "openapi-sampler": "^1.7.4",
     "pagefind": "^1.3.0",
     "pathe": "^2.0.0",
+    "picomatch": "^4.0.5",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
+    "robots-parser": "^3.0.1",
     "satteri": "^0.9.5",
+    "semver": "^7.8.5",
     "sharp": "^0.35.3",
     "shiki": "^4.2.0",
     "simple-icons": "^13.0.0",
@@ -115,14 +131,19 @@
     "tinyglobby": "^0.2.10",
     "twoslash": "^0.3.9",
     "typescript": "^6.0.3",
-    "undici": "^8.6.0",
+    "undici": "^8.9.0",
+    "write-file-atomic": "^8.0.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@types/html-escaper": "^3.0.4",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.10.0",
+    "@types/picomatch": "^4.0.3",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
+    "@types/semver": "^7.8.0",
+    "@types/write-file-atomic": "^4.0.3",
     "@typescript/native-preview": "^7.0.0-dev.20260626.1",
     "bun-types": "^1.3.14"
   },

package/src/ai/component-markdown.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+import { markdownTable } from "markdown-table";
 import { mdxToMdast } from "satteri";
 import { parseYouTubeId } from "../components/content/youtube.ts";
@@ -238,15 +239,15 @@ const typeTable: ComponentMarkdown = ({ children, props }) => {
         .filter((part) => typeof part === "string" && part !== "")
         .join(" ")
     );
-    return `| ${prop} | ${typeCell} | ${defaultCell} | ${description} |`;
+    return [prop, typeCell, defaultCell, description];
   });
   const table =
     rows.length > 0
-      ? [
-          "| Prop | Type | Default | Description |",
-          "| --- | --- | --- | --- |",
-          ...rows,
-        ].join("\n")
+      ? markdownTable([["Prop", "Type", "Default", "Description"], ...rows], {
+          // Unpadded columns: cells hold prose and the output is for model
+          // consumption, so aligned delimiter rows are wasted tokens.
+          alignDelimiters: false,
+        })
       : "";
   // The component renders its slot after the table.
   return [table, children].filter(Boolean).join("\n\n");

package/src/ai/link-headers.ts CHANGED Viewed

@@ -14,8 +14,13 @@ import { API_CATALOG_PATH, hasApiCatalog } from "./api-catalog.ts";
  * The header is homepage-only by design: the root response is what agents
  * probe, and `agent-readability.json` indexes the rest of the surface (the
  * per-route Markdown pattern, MCP, feeds) far better than per-page headers
- * could. Targets are root-relative under `deployment.base` — RFC 8288 resolves
- * them against the request URL. Returns null when nothing is advertisable.
+ * could. An agent that enters on a deep page (a search result, a shared link)
+ * never sees this header at all — that path is covered in the HTML instead:
+ * every page's `<head>` carries the same `describedby` links plus its own
+ * Markdown mirror as an `alternate` (see `RootLayout.astro`), which also
+ * reaches hosts where Blume can't set response headers. Targets are
+ * root-relative under `deployment.base` — RFC 8288 resolves them against the
+ * request URL. Returns null when nothing is advertisable.
  */
 export const buildHomeLinkHeader = (
   config: ResolvedConfig,

package/src/astro/generate.ts CHANGED Viewed

@@ -6,10 +6,8 @@ import {
   readFile,
   readlink,
   realpath,
-  rename,
   rm,
   symlink,
-  writeFile,
 } from "node:fs/promises";
 import { createRequire } from "node:module";
 import { pathToFileURL } from "node:url";
@@ -33,6 +31,7 @@ import type {
   BlumeLogo,
 } from "../core/data.ts";
 import { BlumeError } from "../core/diagnostics.ts";
+import { writeTextAtomic } from "../core/fs-atomic.ts";
 import { EN_UI, resolveUIStrings } from "../core/i18n-ui.ts";
 import { resolveFallbackLocale } from "../core/i18n.ts";
 import {
@@ -762,17 +761,9 @@ const writeIfChanged = async (
   if (existing === content) {
     return false;
   }
-  await mkdir(dirname(path), { recursive: true });
-  // Write to a temp file then atomically rename into place, so a watching dev
-  // server never observes a missing or half-written file mid-regeneration.
-  const tmp = `${path}.${process.pid}.tmp`;
-  await writeFile(tmp, content, "utf-8");
-  try {
-    await rename(tmp, path);
-  } catch (error) {
-    await rm(tmp, { force: true });
-    throw error;
-  }
+  // Atomic temp-write + rename, so a watching dev server never observes a
+  // missing or half-written file mid-regeneration.
+  await writeTextAtomic(path, content);
   return true;
 };
@@ -1169,6 +1160,10 @@ export const buildRuntimeData = (project: BlumeProject): string => {
       codeWrap: config.markdown.code.wrap,
       dateFormat: config.dateFormat,
       description: config.description,
+      discovery: {
+        agentReadability: config.seo.agentReadability,
+        llmsTxt: config.ai.llmsTxt.enabled,
+      },
       favicon: resolveFavicon(project),
       feedback: config.feedback,
       i18n: i18n

package/src/astro/islands.ts CHANGED Viewed

@@ -83,7 +83,10 @@ export const discoverIslands = async (
   root: string
 ): Promise<IslandDiscovery> => {
   const dir = join(root, "islands");
-  const matches = await glob(["**/*.{jsx,svelte,tsx,vue}"], {
+  // Enumerate everything and let ISLAND_FILE do the filtering below, so
+  // unknown extensions take the skip guard instead of relying on a glob
+  // pattern staying in sync with the regex and framework map.
+  const matches = await glob(["**/*"], {
     absolute: true,
     cwd: dir,
     onlyFiles: true,

package/src/astro/templates.ts CHANGED Viewed

@@ -1127,10 +1127,9 @@ export const searchClientTemplate = (config: ResolvedConfig): string => {
   if (search.provider === "orama" || search.provider === "flexsearch") {
     // Only Orama derives a tokenizer from the locale; FlexSearch has no
     // equivalent hook, so its client keeps the bare index URL.
-    return staticSearchClient(
-      search.provider,
-      search.provider === "orama" ? config.i18n?.defaultLocale : undefined
-    );
+    const locale =
+      search.provider === "orama" ? config.i18n?.defaultLocale : undefined;
+    return staticSearchClient(search.provider, locale);
   }
   const hosted = hostedSearchOptions(search);
@@ -1802,6 +1801,7 @@ const LayoutComponent = resolveSlot(layoutOverrides.Layout, RootLayout);
   exportPdf={${options.exportPdf}}
   exportEpub={${options.exportEpub}}
   feeds={data.feeds}
+  discovery={data.config.discovery}
   siteUrl={data.config.site}
   pageType={frontmatter.type}
   published={frontmatter.date ?? frontmatter.changelog?.date ?? null}
@@ -2023,6 +2023,7 @@ const LayoutComponent = resolveSlot(layoutOverrides.Layout, RootLayout);
   exportPdf={${options.exportPdf}}
   exportEpub={${options.exportEpub}}
   feeds={data.feeds}
+  discovery={data.config.discovery}
   siteUrl={data.config.site}
   noindex={false}
   structuredDataEnabled={data.config.structuredData}

package/src/audit/checks/indexability.ts CHANGED Viewed

@@ -8,12 +8,9 @@ import type { AuditContext, CheckModule, PageSnapshot } from "../types.ts";
 import { decodePath, normalizePath, siteOrigin } from "../url.ts";
 /** The canonical URL parsed, or null when it isn't a usable absolute URL. */
-const parseCanonical = (page: PageSnapshot): URL | null => {
-  if (!page.canonical) {
-    return null;
-  }
+const parseCanonical = (canonical: string): URL | null => {
   try {
-    return new URL(page.canonical);
+    return new URL(canonical);
   } catch {
     return null;
   }
@@ -48,7 +45,7 @@ const canonicalChecks = (
       : [];
   }
-  const canonical = parseCanonical(page);
+  const canonical = parseCanonical(page.canonical);
   if (!canonical) {
     return [
       finding(

package/src/audit/checks/robots.ts CHANGED Viewed

@@ -1,40 +1,16 @@
+import robotsParser from "robots-parser";
 import type { Diagnostic } from "../../core/types.ts";
 import { finding } from "../catalog.ts";
 import type { CheckModule } from "../types.ts";
 import { normalizePath } from "../url.ts";
 /**
- * Whether a robots.txt `Disallow` value covers a path. robots.txt matching is
- * prefix-based, with `*` as a wildcard and `$` anchoring the end.
+ * robots-parser needs full URLs on a single origin; the origin itself is
+ * irrelevant to path matching, so a fixed placeholder keeps the check
+ * independent of whether the project configured `deployment.site`.
  */
-export const disallowMatches = (rule: string, path: string): boolean => {
-  const anchored = rule.endsWith("$");
-  const pattern = anchored ? rule.slice(0, -1) : rule;
-  const parts = pattern.split("*");
-  let cursor = 0;
-  for (const [index, part] of parts.entries()) {
-    if (part === "") {
-      continue;
-    }
-    // The first segment is anchored to the start of the path (robots.txt rules
-    // are prefix matches); every later segment may appear anywhere after the
-    // previous one, which is what makes `*` a wildcard.
-    let at: number;
-    if (index === 0) {
-      at = path.startsWith(part) ? 0 : -1;
-    } else {
-      at = path.indexOf(part, cursor);
-    }
-    if (at === -1) {
-      return false;
-    }
-    cursor = at + part.length;
-  }
-  // A wildcard just before `$` (`/docs*$`) absorbs the rest of the path, so
-  // the anchor is already satisfied by any prefix match.
-  return anchored && !pattern.endsWith("*") ? cursor === path.length : true;
-};
+const MATCH_ORIGIN = "https://robots-audit.invalid";
 /**
  * robots.txt: is it there, is it well-formed, does it point at the sitemap, and
@@ -82,8 +58,13 @@ export const robotsChecks: CheckModule = {
     }
     // A page can't be both blocked from crawling and advertised for indexing.
-    // Checking the disallow rules against the sitemap (rather than against every
-    // built file) keeps this to the pages the site actually wants indexed.
+    // Checking the rules against the sitemap (rather than against every built
+    // file) keeps this to the pages the site actually wants indexed.
+    // robots-parser resolves Allow/Disallow by longest match, so the common
+    // `Disallow: /` + `Allow: /docs/` pattern doesn't flag every page, and
+    // consecutive User-agent lines form one group as the spec requires.
+    const parser = robotsParser(`${MATCH_ORIGIN}/robots.txt`, robots.raw);
+    const lines = robots.raw.split(/\r?\n/u);
     for (const loc of context.sitemap?.urls ?? []) {
       let pathname: string;
       try {
@@ -94,15 +75,15 @@ export const robotsChecks: CheckModule = {
       // Match the pathname as served: robots.txt rules are literal prefixes,
       // so `Disallow: /page/` must see the trailing slash to match.
       const path = normalizePath(pathname);
-      const rule = robots.disallow.find((entry) =>
-        disallowMatches(entry, pathname)
-      );
-      if (rule) {
+      const url = `${MATCH_ORIGIN}${pathname}`;
+      if (parser.isDisallowed(url, "*")) {
+        const line = parser.getMatchingLineNumber(url, "*");
+        const rule = line > 0 ? lines[line - 1]?.trim() : undefined;
         found.push(
           finding(
             "BLUME_AUDIT_ROBOTS_DISALLOWS_INDEXABLE",
             { file: robots.file, url: path },
-            `robots.txt "Disallow: ${rule}" blocks ${path}, which sitemap.xml advertises.`
+            `robots.txt "${rule ?? "Disallow"}" blocks ${path}, which sitemap.xml advertises.`
           )
         );
       }

package/src/audit/crawl.ts CHANGED Viewed

@@ -1,5 +1,6 @@
 import { readFile, stat } from "node:fs/promises";
+import { XMLParser } from "fast-xml-parser";
 import { join, relative } from "pathe";
 import { glob } from "tinyglobby";
@@ -74,27 +75,25 @@ const routeIndex = (
   return index;
 };
-const SITEMAP_URL = /<url>(?<block>[\s\S]*?)<\/url>/gu;
-const SITEMAP_LOC = /<loc>(?<loc>[\s\S]*?)<\/loc>/gu;
-const SITEMAP_LASTMOD = /<lastmod>(?<date>[\s\S]*?)<\/lastmod>/u;
-const XML_ENTITIES: Record<string, string> = {
-  "&amp;": "&",
-  "&apos;": "'",
-  "&gt;": ">",
-  "&lt;": "<",
-  "&quot;": '"',
-};
-const unescapeXml = (value: string): string =>
-  value.replaceAll(
-    /&(?:amp|apos|gt|lt|quot);/gu,
-    (entity) => XML_ENTITIES[entity] ?? entity
-  );
+/**
+ * Sitemaps arrive from arbitrary generators (the audit also fetches remote
+ * ones), so parsing is fast-xml-parser's job: CDATA sections, numeric
+ * entities, and namespace-prefixed elements are all legal there and all
+ * invisible to a regex scan. Values stay strings (`parseTagValue: false`) so
+ * a numeric-looking `<lastmod>` isn't coerced.
+ */
+const sitemapParser = new XMLParser({
+  // htmlEntities adds numeric character references (&#38;) on top of the
+  // default XML five; a sitemap loc legitimately carries either form.
+  htmlEntities: true,
+  ignoreAttributes: true,
+  parseTagValue: false,
+  removeNSPrefix: true,
+});
 /**
- * Parse `sitemap.xml`. Deliberately shallow: we only need the `<loc>` list and
- * whether the document is a well-formed urlset, and pulling in an XML parser to
- * learn that would be a dependency for one regex.
+ * Parse `sitemap.xml`. Deliberately shallow: the checks only need the `<loc>`
+ * list, each loc's `<lastmod>`, and whether the document is a urlset at all.
  */
 export const parseSitemap = (
   file: string,
@@ -102,31 +101,34 @@ export const parseSitemap = (
   bytes: number
 ): SitemapDoc => {
   const doc: SitemapDoc = { bytes, file, lastmod: new Map(), urls: [] };
-  if (!xml.includes("<urlset")) {
-    doc.error = xml.includes("<sitemapindex")
+  let parsed: Record<string, unknown>;
+  try {
+    parsed = sitemapParser.parse(xml) as Record<string, unknown>;
+  } catch {
+    doc.error = "no <urlset> element";
+    return doc;
+  }
+  if (!Object.hasOwn(parsed, "urlset")) {
+    doc.error = Object.hasOwn(parsed, "sitemapindex")
       ? "sitemap is an index, not a urlset"
       : "no <urlset> element";
     return doc;
   }
-  for (const match of xml.matchAll(SITEMAP_LOC)) {
-    const loc = unescapeXml((match.groups?.loc ?? "").trim());
-    if (loc) {
-      doc.urls.push(loc);
+  const urlset = parsed.urlset as { url?: unknown } | string | null;
+  const entries =
+    typeof urlset === "object" && urlset !== null ? [urlset.url].flat() : [];
+  for (const entry of entries) {
+    if (typeof entry !== "object" || entry === null) {
+      continue;
     }
-  }
-  // `<lastmod>` is scoped per `<url>` block so it stays attached to its `<loc>`
-  // — the flat loc scan above deliberately isn't, so a sitemap with stray text
-  // between blocks still yields its URL list.
-  for (const match of xml.matchAll(SITEMAP_URL)) {
-    const block = match.groups?.block ?? "";
-    const loc = unescapeXml(
-      (
-        new RegExp(SITEMAP_LOC.source, "u").exec(block)?.groups?.loc ?? ""
-      ).trim()
-    );
-    const lastmod = SITEMAP_LASTMOD.exec(block)?.groups?.date?.trim();
-    if (loc && lastmod) {
-      doc.lastmod?.set(loc, lastmod);
+    const { loc, lastmod } = entry as { loc?: unknown; lastmod?: unknown };
+    const locText = typeof loc === "string" ? loc.trim() : "";
+    if (!locText) {
+      continue;
+    }
+    doc.urls.push(locText);
+    if (typeof lastmod === "string" && lastmod.trim() !== "") {
+      doc.lastmod?.set(locText, lastmod.trim());
     }
   }
   return doc;
@@ -153,12 +155,14 @@ export const parseLlms = (file: string, text: string): LlmsDoc => {
 const ROBOTS_DIRECTIVE = /^(?<field>[a-z-]+)\s*:\s*(?<value>.*)$/iu;
-/** Parse `robots.txt` into the directives the audit cares about. */
+/**
+ * Parse `robots.txt` into the pieces the audit cares about. Sitemap
+ * declarations and a not-a-directive lint come from a line scan; rule
+ * *matching* is robots-parser's job at check time (see `checks/robots.ts`),
+ * so the raw text rides along instead of a pre-extracted rule list.
+ */
 export const parseRobots = (file: string, text: string): RobotsDoc => {
-  const doc: RobotsDoc = { disallow: [], file, invalid: [], sitemaps: [] };
-  // Only `User-agent: *` rules bind the crawlers we're auditing for; a block
-  // scoped to some other agent isn't a finding about our indexable pages.
-  let appliesToAll = false;
+  const doc: RobotsDoc = { file, invalid: [], raw: text, sitemaps: [] };
   for (const [index, raw] of text.split(/\r?\n/u).entries()) {
     const line = raw.trim();
     if (line === "" || line.startsWith("#")) {
@@ -171,11 +175,7 @@ export const parseRobots = (file: string, text: string): RobotsDoc => {
     }
     const field = (match.groups?.field ?? "").toLowerCase();
     const value = (match.groups?.value ?? "").trim();
-    if (field === "user-agent") {
-      appliesToAll = value === "*";
-    } else if (field === "disallow" && appliesToAll && value) {
-      doc.disallow.push(value);
-    } else if (field === "sitemap" && value) {
+    if (field === "sitemap" && value) {
       doc.sitemaps.push(value);
     }
   }

package/src/audit/image-size.ts CHANGED Viewed

@@ -1,63 +1,23 @@
+import { imageSize as measureImage } from "image-size";
 /**
- * Pixel dimensions read straight from a PNG, JPEG, or GIF header. A dedicated
- * image library would be a dependency for three well-documented byte layouts;
- * anything else (SVG, WebP, AVIF) yields null and its checks simply don't run.
+ * Pixel dimensions read from an image header via the image-size package,
+ * which covers the formats a modern pipeline actually emits — WebP and AVIF
+ * included, where the previous hand parser (PNG/JPEG/GIF only) went silent
+ * and the dimension checks never ran. An unrecognized or truncated buffer
+ * yields null and its checks simply don't run.
  */
 export interface ImageSize {
   width: number;
   height: number;
 }
-const PNG_SIGNATURE = Buffer.from([0x89, 0x50, 0x4e, 0x47]);
-const pngSize = (bytes: Buffer): ImageSize | null => {
-  // Signature, then the IHDR chunk is required to come first: width and height
-  // are big-endian u32s at fixed offsets 16 and 20.
-  if (bytes.length < 24 || !bytes.subarray(0, 4).equals(PNG_SIGNATURE)) {
-    return null;
-  }
-  return { height: bytes.readUInt32BE(20), width: bytes.readUInt32BE(16) };
-};
-/** JPEG start-of-frame markers (C0–CF minus DHT C4, JPG C8, DAC CC). */
-const isSof = (marker: number): boolean =>
-  marker >= 0xc0 &&
-  marker <= 0xcf &&
-  marker !== 0xc4 &&
-  marker !== 0xc8 &&
-  marker !== 0xcc;
-const jpegSize = (bytes: Buffer): ImageSize | null => {
-  if (bytes.length < 4 || bytes[0] !== 0xff || bytes[1] !== 0xd8) {
-    return null;
-  }
-  // Walk the segment list: each is FF <marker> <u16 length> <payload>. The
-  // dimensions live in the first start-of-frame segment's payload, as
-  // big-endian u16s after a one-byte precision field.
-  let offset = 2;
-  while (offset + 9 < bytes.length) {
-    if (bytes[offset] !== 0xff) {
-      return null;
-    }
-    const marker = bytes[offset + 1] ?? 0;
-    if (isSof(marker)) {
-      return {
-        height: bytes.readUInt16BE(offset + 5),
-        width: bytes.readUInt16BE(offset + 7),
-      };
-    }
-    offset += 2 + bytes.readUInt16BE(offset + 2);
-  }
-  return null;
-};
-const gifSize = (bytes: Buffer): ImageSize | null => {
-  if (bytes.length < 10 || bytes.subarray(0, 4).toString("latin1") !== "GIF8") {
+/** The image's pixel dimensions, or null when the format isn't recognized. */
+export const imageSize = (bytes: Buffer): ImageSize | null => {
+  try {
+    const { width, height } = measureImage(bytes);
+    return width > 0 && height > 0 ? { height, width } : null;
+  } catch {
     return null;
   }
-  return { height: bytes.readUInt16LE(8), width: bytes.readUInt16LE(6) };
 };
-/** The image's pixel dimensions, or null when the format isn't recognized. */
-export const imageSize = (bytes: Buffer): ImageSize | null =>
-  pngSize(bytes) ?? jpegSize(bytes) ?? gifSize(bytes);