blume 1.6.3 → 1.6.5

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # blume
 
+## 1.6.5
+
+### Patch Changes
+
+- 9753355: Render a spec `description` as the Markdown it is. An OpenAPI description is Markdown by specification, but schema properties, parameters, request bodies, responses, authorization schemes, AsyncAPI messages and every GraphQL description — field, enum value and operation return type — printed it as plain text — so a spec generated from code docstrings showed its own `**asterisks**` and backticks, a numbered list rendered as one long line, and because HTML collapses newlines every paragraph ran together into a single wall of text. The operation description on the same page never had this problem, because it is emitted into the MDX body and goes through the full pipeline; the two rendered side by side is what made it obvious. Descriptions now render through `marked` — synchronous, already a dependency, and already how the Ask AI island renders model Markdown — since the full pipeline is async and built for whole documents while these are thousands of short strings per build.
+  
+  Only a link the author clearly meant becomes an anchor: written as a link, to an absolute URL, a root-relative path, a fragment or a `mailto:`. Everything else keeps its raw source text, because a description is often prose that was never Markdown. GFM autolinks bare URLs, `www.` hosts and email addresses, and spec descriptions are full of example hosts (`https://myorg.my.salesforce.com`, `www.yourstore.myshopify.com`) that turned into links to hosts nobody should visit; worse, regex and format notation reads as link syntax — Debezium's column-list wording `schemaName[.]tableName[.](columnName1|columnName2)` is literally `[text](href)`, which both produced a broken link and deleted the notation, since the link text is only `.`. An image is held to the same policy. Raw HTML is escaped rather than passed through, for the same reason the Ask AI island runs its Markdown through DOMPurify: this is data lifted out of a file and interpolated into the page.
+  
+  A GFM table in a description is wrapped in the same scroll frame the body pipeline gives every other table, because `set:html` bypasses the plugin that would have done it and a description sits in a narrower column than the body.
+  
+  Styling lives in one style block on a single class rather than in per-element utilities. Written as utilities it repeated the same ~620 characters on every description, which on a large reference page is 1.5 MB of identical class attributes and enough to push pages past Googlebot's 2 MB crawl limit; `blume audit` flags that as an indexability error.
+- dd32b7b: Add `analytics.cloudflare` for Cloudflare Web Analytics. Pass the site token from the dashboard's JS snippet — `analytics: { cloudflare: { token } }` — and Blume renders the beacon tag, the same way `posthog` takes a key. Until now the beacon meant hand-writing a `scripts` entry with the beacon URL and a JSON `data-cf-beacon` attribute.
+  
+  This is for sites Cloudflare doesn't proxy. A proxied zone with automatic Web Analytics on already injects the beacon at the edge and should leave the option unset, or every pageview is counted twice; the analytics docs now spell out that distinction.
+- 597d824: Give a reference row room for what it holds. The row was scaled for a one-line description — 4px between the property name and its description, 8px before the disclosure, 12px of row padding — but a description is a block, so at 4px it sat closer to the label above it than its own paragraphs sat to each other. That inversion is what made a dense reference page read as a wall rather than as rows, and the disclosure below it touched the next row's divider. Every component that draws a reference row now shares one scale: 8px between a row's own lines, 12px before a disclosure, 16px of row padding. Measured on one operation page, the gap between two properties goes from 25px to 33px.
+  
+  Table cells gain the same treatment for the same reason. At 0.5rem of block padding against a line-height near 1.7, a cell whose content wrapped put more space between its own two lines than between itself and the next row. The inline padding is unchanged on purpose: widening it comes out of column width in a capped article, and on one corpus it pushed cells that fit on two lines onto three, spending the space it had just bought.
+- b03b43f: Update dependencies: Mermaid 12, React 19.3, Zod 4.6, `ai` 7.0.99, `@pierre/diffs` 1.4.2, and the latest patch releases of the remaining runtime dependencies. Mermaid 12 makes the ELK layout and the "neo" look its defaults; Blume pins the previous dagre layout and classic look so existing diagrams render as before and the ELK engine only downloads for diagrams that opt in through their own front matter.
+
+## 1.6.4
+
+### Patch Changes
+
+- 623fe85: Remove the extra vertical space at the bottom of code blocks. The scrolling code element carries a small bottom inset so a horizontal scrollbar thumb stays off the last line's descenders, but that inset was added on top of the block's padding, so every block, including a one-line install command, sat 0.375rem taller than the space above the text. The block now gives up the same amount below the code element, so the text sits an even 1rem from the top and bottom edges and the scrollbar gap is unchanged.
+- 6edd17b: Fix a `ReferenceError: rafThrottle is not defined` thrown on pages that render `<Component>`: the script block used `rafThrottle` without importing it. Preview panes now cap at the viewport with CSS (`max-height: 100lvh`) instead of a resize listener, so a pane capped by a small window grows back when the window does, mobile toolbar collapse no longer resizes it, and the docs page asks already-loaded frames to re-report their height so a report sent before the listener registered isn't lost.
+- ec879ad: Keep content links inside the reader's language on multi-locale sites. Markdown links and `Card`, `Tile`, `Tooltip`, and `Update` hrefs written as `/guides/setup` rendered verbatim on translated pages, so a reader on `/fr/…` was sent back to the default locale on the first click. Root-relative page links now resolve to the same-locale route when one is served — a translation or a fallback page — and keep their authored target otherwise, so custom pages and explicit cross-locale links are untouched. `blume check` resolves links the same way, so an anchor is validated against the translated page a reader actually lands on.
+  
+  Because anchors now travel with the link, `blume translate` pins every translated heading to its source heading's anchor id with a trailing `[#id]` marker (unless the translation already pins one), so `#fragment` links resolve identically in every language.
+- 5efd05e: Fix the language switcher's fallback target under a `basePath`. A switcher entry for a locale with no real translation derives its href by stripping the page's own locale from its route and re-adding the target locale, but `route` arrives with the base path already applied (`/docs/ja/reference`) while locale prefixes are base-less (`/ja`) — so the strip matched nothing and the re-add produced a second prefix, linking `/docs/ja/reference` at `/ja/docs/ja/reference`, `/ko/docs/ja/reference` and so on. None of those routes are built, so every affected entry was a dead link, and an audit that follows them reported the page as linking to broken routes. The route is now moved into base-less space before the locale is swapped and the base is re-applied to the result, using the same helpers the manifest composes real routes with. This affects any locale without a real translation of the page: a partially translated hand-written page for its missing locales, and, most visibly, a generated OpenAPI or GraphQL reference under a base path for every locale but its own.
+- 4de1d37: Downlevel `<Operation>`, `<ApiTagOperations>` and `<ApiOverview>` on the agent-facing surfaces. A generated reference page is its description as Markdown plus one of those components, so with no serializer for them an operation page reached `/<route>.md`, `llms-full.txt`, MCP `get_page` and the Ask AI corpus as its description followed by a bare tag — no method, no path, nowhere to go. On a site whose reference is most of the corpus, that is most of the corpus: measured on one 449-page site, 266 pages and 266 raw `<Operation>` in `llms-full.txt`, so "which endpoint do I call?" had no answer anywhere an agent could read. An operation now downlevels to its endpoint in the spec kind's own notation — `GET /pets/{id}`, `SEND user/signup`, `query pets` or `type Pet` — plus a deprecation marker; a tag section to its operations as links with their summaries; and the overview to the version and base URLs the rendered page shows. Site search indexes the same text, so a query for an endpoint's path now matches its page. Parameters and schemas stay with the component, which owns that rendering. The components and the serializers also share one own-property lookup, so a `source` or `id` that names an inherited property like `toString` renders the not-found state instead of throwing.
+- 830bd4e: Update the oxfmt directive-preservation patch documented in the FAQ for oxfmt 0.67.0. The patch body is unchanged; it now targets the renamed Markdown formatter chunk so `:::` container directives keep their fences on their own lines under the latest oxfmt, oxlint 1.82, and Ultracite 7.11.
+- a919bac: Add `nub` and `aube` tabs to the `package-install` block, alongside npm, pnpm, yarn, and bun. The commands come from the same maintained agent tables as the existing tabs, so `npx …` becomes `nubx …` and `aube dlx …`, `npm ci` becomes a frozen install, and global installs keep their `-g` form. An install block may also be written with a `nub`, `nubx`, or `aube` command as its input.
+- ecbb199: Stop the llms.txt audit reporting the MCP route as a stale entry. `llms.txt` advertises `ai.mcp.route` whenever the MCP server is on, but that endpoint is streamable HTTP — a route the server answers, not a file the build writes — so it appears in neither the page snapshots nor the static file index and the stale-entry check read the site's own index as broken. Every server-output site with `ai.mcp` enabled raised `BLUME_AUDIT_LLMS_TXT_STALE_ENTRY` for a file that was never meant to exist, and under `--fail-on warning` that failed the audit and blocked publishing. The configured route is now exempt while the server is enabled, and only then: with `ai.mcp` off, a listed `/mcp` is as stale as any other dead entry. The other targets llms.txt lists — `llms-full.txt`, `/index.md`, `agent-readability.json`, `sitemap.xml` — are real files and are unaffected.
+  
+  The link, llms.txt, and redirect checks now share one definition of what the build serves, so a page link or a configured redirect that lands on the MCP route is no longer reported as broken either, and an llms.txt entry that points at a directory served from its `index.html` is accepted the way the link check already did.
+- bbb6792: Scope search to the active language on every page of a multi-locale site. The search dialog derived its locale filter from the header's language-switcher entries, which only content pages receive, so custom pages built on `PageLayout`, the changelog index, the 404 page, and the API reference shell searched every language and hid the "All languages" toggle. The filter now reads the resolved i18n settings directly.
+- d7462bf: Update dependencies: Astro 7.3.2 with `@astrojs/mdx` 8.0.1 and `@astrojs/markdown-satteri` 0.4.1, plus the latest patch releases of the remaining runtime dependencies (`@clack/prompts`, `@scalar/astro`, `ai`, `dompurify`, `katex`, `marked`, `node-html-parser`, `simple-icons`, `takumi-js`). Astro's default image service already resolves to Sharp 0.35.4, the release that patches the AVIF remote code execution advisory (GHSA-26w7-cxv4-gfx2).
+
 ## 1.6.3
 
 ### Patch Changes