blume 1.6.4 → 1.6.6

package/src/deploy/function-bundle.ts

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { readdir, readFile } from "node:fs/promises";
 import { builtinModules } from "node:module";
 
+import { init, parse } from "es-module-lexer";
 import { dirname, join, relative } from "pathe";
 import { z } from "zod";
 
@@ -65,32 +66,76 @@ export const packageName = (specifier: string): string | null => {
 };
 
 /**
- * Static specifiers: a side-effect `import "x"` or an `import`/`export … from
- * "x"` clause. Only `import` takes the bare-string form — `export "x"` is not
- * syntax, so a runtime message quoting `export 'ALL'` must not match. The
- * specifier quote must not be escaped either: a backslash-quoted `from \"zod\"`
- * is a code sample serialized into a string (the MCP snapshot carries page
- * Markdown), not module syntax.
+ * Fallback static specifiers for a module the lexer rejects: a side-effect
+ * `import "x"` or an `import`/`export … from "x"` clause. Only `import` takes
+ * the bare-string form — `export "x"` is not syntax, so a runtime message
+ * quoting `export 'ALL'` must not match.
  */
 const STATIC_IMPORT =
-  /(?:^|[;\s}])(?:import\s*(?<!\\)["'](?<bare>[^"'\n]+)["']|(?:import|export)\s*[\w$*{},\s]*?\s*from\s*(?<!\\)["'](?<from>[^"'\n]+)["'])/gu;
+  /(?:^|[;\s}])(?:import\s*["'](?<bare>[^"'\n]+)["']|(?:import|export)\s*[\w$*{},\s]*?\s*from\s*["'](?<from>[^"'\n]+)["'])/gu;
 
-/** Dynamic `import("…")` specifiers, same escaped-quote rule. */
-const DYNAMIC_IMPORT =
-  /\bimport\(\s*(?<!\\)["'](?<dynamic>[^"'\n]+)["']\s*\)/gu;
+/** Fallback dynamic `import("…")` specifiers. */
+const DYNAMIC_IMPORT = /\bimport\(\s*["'](?<dynamic>[^"'\n]+)["']\s*\)/gu;
 
-/** Every bare package name a module's source imports. */
-export const importedPackages = (source: string): string[] => {
-  const names = new Set<string>();
+/**
+ * Textual best effort for a module `es-module-lexer` cannot parse: every
+ * quoted specifier in import position, string contents included.
+ */
+const scannedSpecifiers = (source: string): string[] => {
+  const specifiers: string[] = [];
   for (const pattern of [STATIC_IMPORT, DYNAMIC_IMPORT]) {
     for (const match of source.matchAll(pattern)) {
       const groups = match.groups ?? {};
-      const name = packageName(
-        groups.bare ?? groups.from ?? groups.dynamic ?? ""
-      );
-      if (name) {
-        names.add(name);
-      }
+      specifiers.push(groups.bare ?? groups.from ?? groups.dynamic ?? "");
+    }
+  }
+  return specifiers;
+};
+
+/**
+ * Every specifier a module's syntax imports, read with `es-module-lexer` so
+ * text inside string literals never counts. That matters for Blume's data
+ * chunks: the MCP snapshot is `JSON.parse("…")` over every page's Markdown,
+ * and a code sample there reading `import { config } from 'dotenv'` is prose
+ * to a bundle audit, not a module the function needs. `import.meta` carries no
+ * specifier and a template-literal `import(\`pkg/${x}\`)` is a glob the
+ * bundler already resolved, so neither names a package.
+ */
+const lexedSpecifiers = (source: string, name: string): string[] => {
+  const [imports] = parse(source, name);
+  const specifiers: string[] = [];
+  for (const entry of imports) {
+    if (entry.type === "dynamic" && entry.glob) {
+      continue;
+    }
+    if (entry.specifier) {
+      specifiers.push(entry.specifier);
+    }
+  }
+  return specifiers;
+};
+
+/**
+ * Every bare package name a module's source imports. A module the lexer
+ * rejects (an unterminated string, an invalid escape in a specifier) falls
+ * back to the textual scan rather than going unaudited.
+ */
+export const importedPackages = async (
+  source: string,
+  name = "module"
+): Promise<string[]> => {
+  await init();
+  let specifiers: string[];
+  try {
+    specifiers = lexedSpecifiers(source, name);
+  } catch {
+    specifiers = scannedSpecifiers(source);
+  }
+  const names = new Set<string>();
+  for (const specifier of specifiers) {
+    const packageId = packageName(specifier);
+    if (packageId) {
+      names.add(packageId);
     }
   }
   return [...names];
@@ -164,7 +209,8 @@ export const auditFunctionBundle = async (
   for (const file of await listModules(serverDir)) {
     // oxlint-disable-next-line no-await-in-loop -- sequential read keeps the importer lists ordered
     const source = await readFile(file, "utf-8");
-    for (const name of importedPackages(source)) {
+    // oxlint-disable-next-line no-await-in-loop -- the lexer runs per file, in the same order
+    for (const name of await importedPackages(source, file)) {
       if (resolvable(name, dirname(file), funcDir)) {
         continue;
       }

package/src/deploy/sitemap.ts

@@ -36,6 +36,12 @@ export interface SitemapFile {
   xml: string;
 }
 
+/** The build log line for an emitted sitemap set: one file, or an index. */
+export const describeSitemapFiles = (files: readonly SitemapFile[]): string =>
+  files.length === 1
+    ? "Generated sitemap.xml"
+    : `Generated sitemap.xml (index of ${files.length - 1} sitemap files)`;
+
 /**
  * The sitemaps.org cap on `<url>` entries in a single file. Beyond it,
  * `sitemap.xml` becomes a sitemap index pointing at numbered chunk files —

package/src/deploy/vercel-negotiation.ts

@@ -235,21 +235,6 @@ export const buildNegotiationRoutes = (
 /** The `src` of the injected homepage `Link` header route. */
 const HOME_SRC = "^/$";
 
-/**
- * Permanent redirect from any trailing-slash URL to its slashless twin, so
- * `/docs/` and `/docs` don't serve as duplicate URLs (canonicals, sitemap, and
- * hreflang all use the slashless form; the root `/` is untouched — `.+`
- * requires a non-empty path). Spliced into the main phase before `handle:
- * "filesystem"`, after the Markdown rewrites, so an agent's `Accept:
- * text/markdown` request on a slashed URL still rewrites without the extra
- * hop. Vercel carries the query string over to the `Location` target itself.
- */
-export const TRAILING_SLASH_REDIRECT: VercelRoute = {
-  headers: { Location: "/$1" },
-  src: "^/(.+)/$",
-  status: 308,
-};
-
 /**
  * Whether a route is one this module previously injected, so re-injection
  * replaces rather than duplicates. Rewrites are identified by their `accept`
@@ -273,9 +258,7 @@ const isNegotiationRoute = (route: VercelRoute): boolean =>
   (route.continue === true &&
     isString(route.headers?.link) &&
     route.src === HOME_SRC &&
-    Object.keys(route).length === 3) ||
-  (route.status === TRAILING_SLASH_REDIRECT.status &&
-    route.src === TRAILING_SLASH_REDIRECT.src);
+    Object.keys(route).length === 3);
 
 /**
  * Splice the negotiation routes into a Build Output `config.json`, plus — when
@@ -285,9 +268,11 @@ const isNegotiationRoute = (route: VercelRoute): boolean =>
  * rides on the prerendered homepage response. `contentTypeOverrides` maps static-dir
  * relative paths to media types via the Build Output `overrides` field — the
  * platform's mechanism for extensionless static files (e.g. the Web Bot Auth
- * signature directory). The trailing-slash 308 redirect is always spliced in
- * alongside, so slashed duplicates of every page collapse onto the canonical
- * slashless URL. For each 404 twin the build emitted (`notFound.markdown` for
+ * signature directory). The trailing-slash redirect that collapses `/docs/`
+ * onto `/docs` is not spliced here: the generated config sets Astro's
+ * `trailingSlash: "never"`, which the adapter turns into the platform's own
+ * 308 route ahead of everything below (so a slashed Markdown request takes
+ * that hop first, then negotiates). For each 404 twin the build emitted (`notFound.markdown` for
  * `404.md`, `notFound.json` for `404.json`), its routes go into the miss
  * phase right before the adapter's `/404.html` fallback — and nowhere when
  * that fallback is absent, since a `dest` with no file behind it would serve
@@ -342,15 +327,8 @@ export const injectNegotiationRoutes = (
   }
   // Headers first: `continue` routes accumulate, so a request the rewrite
   // route then terminates (Markdown negotiation on the homepage) still carries
-  // the Link header. The trailing-slash redirect goes last so a slashed URL's
-  // Markdown negotiation still rewrites directly instead of bouncing.
-  routes.splice(
-    filesystemIndex,
-    0,
-    ...headerRoutes,
-    ...rewriteRoutes,
-    TRAILING_SLASH_REDIRECT
-  );
+  // the Link header.
+  routes.splice(filesystemIndex, 0, ...headerRoutes, ...rewriteRoutes);
   const notFoundRoutes = [
     ...(notFound.markdown ? NOT_FOUND_MARKDOWN_ROUTES : []),
     ...(notFound.json ? NOT_FOUND_JSON_ROUTES : []),

package/src/og/card.ts

@@ -1,11 +1,11 @@
 import { readFile } from "node:fs/promises";
 
-import { imageSize } from "image-size";
 import { render } from "takumi-js";
 import type { RenderOptions } from "takumi-js";
 import { container, googleFonts, image, text } from "takumi-js/helpers";
 import type { FontSubset, GoogleFontFamily, Node } from "takumi-js/helpers";
 
+import { svgDimensions } from "../core/svg-dimensions.ts";
 import { ACCENTS, isAccentPreset } from "../theme/palette.ts";
 import { OG_IMAGE_HEIGHT, OG_IMAGE_WIDTH } from "./dimensions.ts";
 
@@ -234,19 +234,13 @@ const MARK_HEIGHT = 32;
 const MARK_MAX_WIDTH = 240;
 /**
  * The SVG's aspect ratio (w/h), or null when no usable dimensions exist (the
- * caller falls back to a square mark). image-size (already a dependency)
- * reads explicit width/height and falls back to the viewBox, tolerating the
- * quote/whitespace/attribute spellings the old regex silently missed —
- * `viewBox = "…"`, newline-separated values — which shipped visibly-squashed
- * marks instead of failing loudly.
+ * caller falls back to a square mark). The shared root-tag parser reads
+ * explicit width/height and falls back to the viewBox, so the card and the
+ * header measure one logo the same way.
  */
 const logoAspect = (svg: string): number | null => {
-  try {
-    const { height, width } = imageSize(Buffer.from(svg));
-    return width && height ? width / height : null;
-  } catch {
-    return null;
-  }
+  const size = svgDimensions(svg);
+  return size ? size.width / size.height : null;
 };
 
 // Render the configured logo as the brand mark. A `currentColor` logo carries

package/src/openapi/render-mdx.ts

@@ -3,6 +3,7 @@ import { fromMarkdown } from "mdast-util-from-markdown";
 import { toString as mdastToString } from "mdast-util-to-string";
 import stringWidth from "string-width";
 
+import { apiNamePhrase } from "../core/api-name.ts";
 import { columnsPrefix } from "../core/text-width.ts";
 import type { GraphqlMember } from "./graphql.ts";
 import { isGraphqlOperationKind } from "./graphql.ts";
@@ -158,6 +159,8 @@ const clip = (text: string, max: number): string => {
 };
 
 const apiName = (spec: ApiSpecData): string => spec.title || spec.label;
+/** The spec's name as "the ___" in generated prose (see `apiNamePhrase`). */
+const apiPhrase = (spec: ApiSpecData): string => apiNamePhrase(apiName(spec));
 
 /** Human phrase for each GraphQL page kind, for meta descriptions. */
 const GRAPHQL_MEMBER_PHRASES = {
@@ -194,16 +197,17 @@ const operationDescription = (
   }
   // AsyncAPI operations act on a channel, not an HTTP endpoint; GraphQL pages
   // document a root field or a named type.
-  let suffix: string;
+  let subject: string;
   if (spec.kind === "asyncapi") {
-    suffix = `Reference for the ${operation.method} operation on ${operation.path} in the ${apiName(spec)} API.`;
+    subject = `${operation.method} operation on ${operation.path}`;
   } else if (spec.kind === "graphql") {
     // SAFETY: the GraphQL extractor only ever assigns member kinds as the
     // method (see `extractGraphqlOperations`).
-    suffix = `Reference for the ${operation.path} ${GRAPHQL_MEMBER_PHRASES[operation.method as GraphqlMember]} in the ${apiName(spec)} API.`;
+    subject = `${operation.path} ${GRAPHQL_MEMBER_PHRASES[operation.method as GraphqlMember]}`;
   } else {
-    suffix = `Reference for the ${operation.method.toUpperCase()} ${operation.path} endpoint in the ${apiName(spec)} API.`;
+    subject = `${operation.method.toUpperCase()} ${operation.path} endpoint`;
   }
+  const suffix = `Reference for the ${subject} in the ${apiPhrase(spec)}.`;
   const prose = clip(
     plainProse(operation.description || operation.summary),
     META_DESCRIPTION_MAX - stringWidth(suffix) - 1
@@ -350,7 +354,7 @@ export const overviewMdx = (
   const seo: RenderedPageData["seo"] = {
     description:
       clip(plainProse(spec.description), META_DESCRIPTION_MAX) ||
-      `${apiName(spec)} API reference.`,
+      `${apiPhrase(spec)} reference.`,
   };
   if (reference?.noindex) {
     seo.noindex = true;

package/src/registry/eject.ts

@@ -30,7 +30,6 @@ import {
   catchAllPageTemplate,
   changelogIndexTemplate,
   contentConfigTemplate,
-  envTemplate,
   exampleMapTemplate,
   exampleWrapperTemplate,
   examplesPageTemplate,
@@ -427,7 +426,6 @@ export const eject = async (
       // Never clobber a hand-tuned tsconfig; only write ours if none exists.
       skipIfExists: true,
     },
-    { content: envTemplate(), path: join(srcDir, "env.d.ts") },
     {
       content: contentConfigTemplate({
         config,

package/src/theme/entry.ts

@@ -560,9 +560,16 @@ blume-diff {
 /* Restore inner padding on every cell. Typography zeroes the first/last cell's
    inline padding so a borderless table aligns to the prose margin; inside the
    framed wrapper that leaves edge text touching the border. The :is() selector
-   outweighs Typography's :where()-scoped rules so the outer columns get it too. */
+   outweighs Typography's :where()-scoped rules so the outer columns get it too.
+
+   The block padding is 0.75rem against a table line-height near 1.7: at 0.5rem a
+   cell whose content wrapped put MORE space between its own two lines than
+   between itself and the next row, so a table of wrapping cells read as one
+   block rather than as rows. The inline padding stays where it was, deliberately
+   — widening it comes out of column width in a capped article, and on one corpus
+   that pushed cells fitting on two lines onto three. */
 .blume-table-scroll :is(th, td) {
-  padding: 0.5rem 0.75rem;
+  padding: 0.75rem;
 }
 /* Keep column labels on one line so a two-word header does not wrap into a
    ragged stack; the table just scrolls a little wider instead. Body cells keep