blume 1.6.4 → 1.6.6

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # blume
 
+## 1.6.6
+
+### Patch Changes
+
+- 2c373ef: Stop repeating `API` in generated descriptions when the name already says it. API reference overview and operation meta descriptions no longer turn a spec titled `Example API` (or `Payments APIs`, `Example API v2`) into `Example API API`, and the generated `/openapi.json` title no longer doubles the word for a site titled the same way.
+- 520a660: Write the deploy artifacts from the integration's `astro:build:done` hook instead of after `astro build` returns: the search index and hosted-provider sync, `llms.txt`, `sitemap.xml`, `robots.txt`, `agent-readability.json`, the `.well-known` discovery files, Agent Skills, and the platform `_redirects`/`_headers` files now land in the directory Astro reports as its client output during the build. `blume build` output is unchanged. An ejected app keeps producing all of them from plain `astro build` — its config tells the hook to scan the project — so `blume eject` no longer warns that they are lost.
+- a63c10e: Serve the prerendered per-page JSON documents on Cloudflare server builds whose requests run through the Worker: the wrapper answers them from the asset binding (conditional revalidations included) instead of letting Astro hand them to the `/api/` catch-all, and `.json` files stay on the static path under a deployment base or the coarse worker-first fallback.
+- 1197e8b: Opt Cloudflare server builds out of Astro sessions with `session: false` instead of configuring an in-memory session driver. Blume never reads `Astro.session`; the driver only existed to keep `@astrojs/cloudflare` from declaring a `SESSION` KV binding, which Astro's opt-out now does directly.
+- 1328384: Declare Blume's page front-matter schema on the generated content collections, so `entry.data` in the runtime is typed and normalized the same way the scan's page metadata is. Custom front-matter keys pass through, and a page the scan already dropped as invalid resolves to defaults instead of failing Astro's content sync.
+- 4f5660b: Honor `Accept: text/markdown` and send the homepage agent-discovery `Link` header in `blume dev` when `deployment.base` is set. Astro's dev server rewrites the base off the URL before Blume's handler runs, so stripping it a second time left every request unmatched.
+- bbdaa55: Keep the dev server up across page adds, removes, and folder renames. `blume dev` used to stop and recreate the Astro server on every route-set change; it now asks Astro's content layer to re-sync (`refreshContent`) and republishes the Markdown-negotiation routes in memory, so the generated config no longer changes with content and Astro never restarts in place for it. A moved page answers under its new route within a second, and editing an `<include>` partial re-syncs the store the same way instead of touching page mtimes.
+- 6b9f367: Drop the `image-size` dependency. Its ICNS, HEIF/AVIF, and JXL parsers can be driven into an infinite loop by a crafted file with a zero-sized box or entry, which would hang `blume audit` or a build, and no patched release exists. The audit's Open Graph image checks now read dimensions through sharp, the image optimizer the build already ships, which covers the same formats and rejects malformed input instead of looping on it. SVG logos for the header and the OG card are measured by a small root-tag parser with the same rules as before: explicit `width`/`height`, a `viewBox` fallback, and CSS units at 96dpi.
+- 7ee1100: Show Blume's config and content errors in the browser error overlay during `blume dev` on published installs. The dev-server handle was a module-level variable, and the CLI bundle and the copy of the integration Vite loads are separate module instances, so the overlay only ever worked inside the Blume repository itself. The handle now lives on `globalThis`, like the runtime data registry.
+- 6b26322: Improve Ask AI grounding for conversational follow-ups and long structured pages. A bare follow-up ("Why?", "And then?") retrieves from the earlier user turn, a short follow-up keeps that turn's best match in view behind its own, and a question that names its subject always leads. Excerpts now keep whole Markdown sections — heading, list, and code fence intact — chosen by how well they cover the question rather than by length, and pages are parsed once per endpoint instead of per request. A closing code fence must now be bare, as CommonMark requires, so a same-length fence line with an info string inside an open block no longer ends it.
+- 8d32eb3: Keep `<include>`-bearing Markdown pages fresh through Astro's documented loader context instead of patching the content store's writes. The collection loader now records a digest of each including page's partials in the collection's meta store and evicts the page's entry when that digest changes, so Astro's glob loader re-renders it on the next sync exactly as it would a new file. Same behavior on a partial edit in dev and on a warm-cache production build; no more replaying the store's private import bookkeeping.
+- e9cd88f: Declare the `blume:*` virtual modules through Astro's `injectTypes` hook instead of a generated `src/env.d.ts`. The declarations now live under `.astro/integrations/blume/` and are referenced from Astro's own `types.d.ts`, so every project that mounts the integration — the hidden runtime and an ejected app alike — gets them without a hand-written file. A project `tsconfig.json` no longer needs `.blume/src/env.d.ts` in its `include`.
+- 3e58b91: Load only the selected CLI command, reducing startup time for every command.
+- f04afce: Read the Vercel function bundle audit's imports with `es-module-lexer` instead of a text scan, so code samples inside the MCP data chunk (a page quoting `import { config } from 'dotenv'` or `await import('bcryptjs')`) no longer fail `blume build` as missing packages.
+- 3422d29: Read provider secrets through Astro's `getSecret()` from `astro:env/server` instead of `process.env`: the Ask AI endpoint's provider key (and the AI Gateway key, now passed to the gateway provider explicitly), the Mixedbread search endpoint's key, and `<GithubInfo>`'s `GITHUB_TOKEN`. Each adapter supplies secrets its own way, so a Cloudflare deployment's Worker bindings now reach these endpoints the same as environment variables do on Node and Vercel.
+- 9dde9cb: Default `<html lang>` and `dir` in every document shell to the locale Astro resolves from the URL (`Astro.currentLocale`), then the site's default locale. A custom `pages/` page or a Scalar reference page under `/fr/` rendered as `lang="en"` unless it passed `locale` itself; the content catch-all still passes the manifest's locale, which also covers fallback pages.
+- 8bbf9a1: Set Astro's `trailingSlash: "never"` in the generated config instead of hand-splicing a trailing-slash redirect into the Vercel routing config. Blume already treats the slashless URL as the one address for a page (canonicals, sitemap, hreflang), so Astro now enforces it too: `blume dev` answers `/guide/` with a 404 that names the setting, an on-demand server route redirects to `/guide`, and the Vercel adapter emits the same 308 route from the config that Blume used to splice by hand. Prerendered pages on static hosts are served exactly as before.
+
+## 1.6.5
+
+### Patch Changes
+
+- 9753355: Render a spec `description` as the Markdown it is. An OpenAPI description is Markdown by specification, but schema properties, parameters, request bodies, responses, authorization schemes, AsyncAPI messages and every GraphQL description — field, enum value and operation return type — printed it as plain text — so a spec generated from code docstrings showed its own `**asterisks**` and backticks, a numbered list rendered as one long line, and because HTML collapses newlines every paragraph ran together into a single wall of text. The operation description on the same page never had this problem, because it is emitted into the MDX body and goes through the full pipeline; the two rendered side by side is what made it obvious. Descriptions now render through `marked` — synchronous, already a dependency, and already how the Ask AI island renders model Markdown — since the full pipeline is async and built for whole documents while these are thousands of short strings per build.
+  
+  Only a link the author clearly meant becomes an anchor: written as a link, to an absolute URL, a root-relative path, a fragment or a `mailto:`. Everything else keeps its raw source text, because a description is often prose that was never Markdown. GFM autolinks bare URLs, `www.` hosts and email addresses, and spec descriptions are full of example hosts (`https://myorg.my.salesforce.com`, `www.yourstore.myshopify.com`) that turned into links to hosts nobody should visit; worse, regex and format notation reads as link syntax — Debezium's column-list wording `schemaName[.]tableName[.](columnName1|columnName2)` is literally `[text](href)`, which both produced a broken link and deleted the notation, since the link text is only `.`. An image is held to the same policy. Raw HTML is escaped rather than passed through, for the same reason the Ask AI island runs its Markdown through DOMPurify: this is data lifted out of a file and interpolated into the page.
+  
+  A GFM table in a description is wrapped in the same scroll frame the body pipeline gives every other table, because `set:html` bypasses the plugin that would have done it and a description sits in a narrower column than the body.
+  
+  Styling lives in one style block on a single class rather than in per-element utilities. Written as utilities it repeated the same ~620 characters on every description, which on a large reference page is 1.5 MB of identical class attributes and enough to push pages past Googlebot's 2 MB crawl limit; `blume audit` flags that as an indexability error.
+- dd32b7b: Add `analytics.cloudflare` for Cloudflare Web Analytics. Pass the site token from the dashboard's JS snippet — `analytics: { cloudflare: { token } }` — and Blume renders the beacon tag, the same way `posthog` takes a key. Until now the beacon meant hand-writing a `scripts` entry with the beacon URL and a JSON `data-cf-beacon` attribute.
+  
+  This is for sites Cloudflare doesn't proxy. A proxied zone with automatic Web Analytics on already injects the beacon at the edge and should leave the option unset, or every pageview is counted twice; the analytics docs now spell out that distinction.
+- 597d824: Give a reference row room for what it holds. The row was scaled for a one-line description — 4px between the property name and its description, 8px before the disclosure, 12px of row padding — but a description is a block, so at 4px it sat closer to the label above it than its own paragraphs sat to each other. That inversion is what made a dense reference page read as a wall rather than as rows, and the disclosure below it touched the next row's divider. Every component that draws a reference row now shares one scale: 8px between a row's own lines, 12px before a disclosure, 16px of row padding. Measured on one operation page, the gap between two properties goes from 25px to 33px.
+  
+  Table cells gain the same treatment for the same reason. At 0.5rem of block padding against a line-height near 1.7, a cell whose content wrapped put more space between its own two lines than between itself and the next row. The inline padding is unchanged on purpose: widening it comes out of column width in a capped article, and on one corpus it pushed cells that fit on two lines onto three, spending the space it had just bought.
+- b03b43f: Update dependencies: Mermaid 12, React 19.3, Zod 4.6, `ai` 7.0.99, `@pierre/diffs` 1.4.2, and the latest patch releases of the remaining runtime dependencies. Mermaid 12 makes the ELK layout and the "neo" look its defaults; Blume pins the previous dagre layout and classic look so existing diagrams render as before and the ELK engine only downloads for diagrams that opt in through their own front matter.
+
 ## 1.6.4
 
 ### Patch Changes

package/bin/blume.mjs

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 // Blume CLI launcher.
 //
-// The published package ships a Node-compatible bundle at dist/cli/index.js
-// (built by scripts/build.ts) and the launcher prefers it. When it is absent —
+// The published package ships a Node-compatible bundle in dist/cli/ — the entry
+// index.js plus the code-split command chunks it imports, built by
+// scripts/build.ts — and the launcher prefers it. When it is absent —
 // e.g. running from a source checkout — it falls back to the TypeScript source,
 // which requires a TS-aware runtime such as Bun (`bun bin/blume.mjs <cmd>`).
 import { existsSync } from "node:fs";