blume 2.0.1 → 2.0.3

package/CHANGELOG.md

@@ -1,5 +1,152 @@
 # blume
 
+## 2.0.3
+
+### Patch Changes
+
+- 090211e: Operation links in the agent-facing Markdown of an API reference overview (`/<route>.md`, `llms-full.txt`, and MCP `get_page`) now include `deployment.base`. With a base of `/sub`, they used to point at `/api/pets/list-pets`, which 404s. In `llms.txt`, page and feed titles with square brackets (`[Beta] Webhooks`) are escaped, so their lines stay links.
+- ad20661: With `deployment.base` set, root-relative images and file links in the agent-facing Markdown (`/<route>.md`, `llms-full.txt`, and MCP `get_page`) now gain the base the way the rendered page's do: `![logo](/logo.png)` becomes `/sub/logo.png` and `[spec](/spec.pdf)` becomes `/sub/spec.pdf`. They used to keep the bare root path, which 404s on a subpath deploy.
+- be607f9: A file path longer than 100 bytes inside a published agent skill no longer fails `blume build`: the skill's `.tar.gz` stores it in the ustar `prefix` field up to 255 bytes and in a PAX extended header beyond that, so standard `tar` readers unpack it at its full path. Two skill directories that declare the same `name` now publish one index entry, from the directory that sorts first, with a build warning naming both, instead of two entries for one artifact whose digest could not match what was served.
+- 090211e: A schema with both properties and a `oneOf`/`anyOf` now shows its shared properties above the variants. Before, `{ properties: { amount, currency }, oneOf: [Card, BankAccount] }` showed only "One of Card | BankAccount". An OpenAPI spec whose `operationId`, tag, summary, or description YAML reads as a number (`operationId: 404`, `tags: [2024]`) now loads, using the number as text, where it used to fail with "text.normalize is not a function". The request and response tabs' Left and Right arrow keys follow the reading direction on right-to-left pages, as `<Tabs>` does.
+- 4f7785c: An OpenAPI, AsyncAPI, or GraphQL description that ends inside an unclosed code fence no longer swallows the reference UI rendered after it. The fence used to run to the end of the page, so an operation page lost its parameters, responses, and playground, and an overview page lost its operation lists. Blume now closes the fence where the description ends.
+- af7c4c9: ArkType schemas now work in `frontmatter.extend` and `content.types.<type>.frontmatter`. ArkType types are callable functions, and Blume only accepted Standard Schemas that were plain objects, so config validation rejected them.
+- 08219a2: Closing the assistant panel mid-answer now stops the model call. The generated assistant route passes the request's abort signal to the model, which used to keep generating, and billing, the rest of the answer after the reader left.
+- 6933892: With the assistant panel docked open on desktop, moving to another page keeps the page laid out beside the panel. Each navigation used to replay the page's slide to make room for the panel.
+- 090211e: AsyncAPI operations whose bindings are a `$ref` to `#/components/*Bindings` now resolve it. Before, the protocol read as "$ref", so a WebSocket operation got no samples and the composer said "Live sending isn't possible for $ref". Channel parameters are URL-encoded only for URL-based protocols (WebSocket, HTTP), so a Kafka or MQTT topic reads `sensors/sensor 1` rather than `sensors/sensor%201`. The message composer no longer hangs on "Connecting…" when the browser refuses a malformed WebSocket URL: it shows the error and lets you connect again.
+- b6992c0: `blume audit` no longer counts an inline SVG's `<title>` as a page title, so an accessible icon doesn't raise `BLUME_AUDIT_TITLE_MULTIPLE` (an error) or stand in for a missing head `<title>`. Text-fragment links (`#:~:text=…`) aren't reported as broken anchors, and only the id in front of a fragment's `:~:` has to exist. An i18n fallback copy of a page is no longer reported as an orphan, which failed `--strict`. A failing audit now delivers its whole report through a pipe; it used to exit before a long report finished writing, cutting the CI log off partway.
+- 6933892: `<Badge variant="accent">` now uses your theme accent, as documented, instead of a fixed blue. Its label mixes the accent toward the text color, so it stays readable over the accent tint in light and dark mode.
+- ad20661: A header link, featured link, or other configured link that already carries `deployment.base` followed by a fragment or query, like `/sub#install` under `base: "/sub"`, is no longer prefixed a second time. It used to render as `/sub/sub#install`.
+- 3311cee: A link that already carries `basePath` followed by a fragment or query, like `[Install](/docs#install)` under `basePath: "/docs"`, is no longer prefixed a second time. It used to render as `/docs/docs#install`, a 404 the link checker didn't catch.
+- f373654: A page whose body starts with a `---` horizontal rule, right below its front matter, no longer loses everything up to the next `---` line. The renderer read that stretch as a second front matter block and dropped it; both rules and the text between them now render, in `.md` and `.mdx` pages alike. Headings in that stretch are now anchors `blume validate` accepts and title an untitled page, the same as any other heading.
+- 7258f30: `blume translate`, `blume validate`, and `blume doctor` now let their whole report reach a piped stderr before exiting with a failure. Before, they exited immediately after writing, so a long list of findings could be cut off in CI logs and `| tee` output — the same fix `blume audit` and `blume eval` got.
+- 3311cee: A `cloudflare()` server build with a `base` now writes its `_headers` rules into `dist/client/_headers`, where Cloudflare reads them, next to the adapter's own. They used to land in `dist/client/<base>/_headers`, which Cloudflare never reads and served publicly, so the Markdown and text charset, the discovery files' media types and CORS header, and the agent skills media types were dropped. The Markdown and JSON 404 answers are wired up under a base too, and a `base` written without a leading slash (`cloudflare({ base: "docs" })`) no longer stops `Accept: text/markdown` negotiation from running.
+- f373654: Rich text from a CMS source (Notion, Contentful, Sanity, Strapi, Payload) renders neighboring runs with the same formatting as one: two bold runs side by side used to show `****` between them, and two italic runs `**`. Neighboring runs under the same link in Notion and Sanity now form one link. A bare URL containing `_`, `~`, or `*` stays a working link instead of gaining backslashes in its address, and struck-through text in a Contentful table cell no longer shows `~~~~`.
+- 4f7785c: Rich text from a CMS source (Notion, Contentful, Sanity, Strapi, Payload) renders more faithfully. A `^` no longer turns text like "2^10 and 2^20" into superscript, `$$` no longer starts math, and a colon before a word (`10:30`, `pets:read`) stays text. Two struck-through runs side by side now render as one strikethrough instead of showing `~~~~`, and a heading that ends in " #" keeps its `#`.
+  
+  A Notion page with no Slug property is now routed by its whole title, with slashes turned into hyphens: "CI/CD Setup" publishes at `ci-cd-setup` instead of at `cd-setup` in an invented `ci` group. A Slug property still sets a nested path. A Notion video URL that contains a double quote or a backslash no longer breaks the page.
+- af7c4c9: An unknown `dateFormat.timeZone` (`Asia/Tokio`) is now a config error that points at the key, instead of a `RangeError` thrown later while rendering a page's "last updated" date or the changelog.
+- af7c4c9: Blume now warns when a content folder is named after the default locale (`docs/en/` with `defaultLocale: "en"`). The default locale's pages live at the content root, so such a folder is ordinary content that publishes at `/en/…` (`/en/en/…` when the default locale keeps its prefix, and `/fr/en/…` as fallbacks); before, it did so silently.
+- 08219a2: The homepage `Link` header `blume dev` sends now lists only what the dev server serves: the JSON API's OpenAPI description and the homepage's Markdown mirror. It used to also advertise `/llms.txt`, `/agent-readability.json`, and the API and AI catalogs, which `blume build` writes and the dev server answered with 404s. Built and deployed sites send the same header as before.
+- b6992c0: Two `blume dev` servers started at the same moment in one project no longer both get the `.blume` lock. The lock file now appears with its content already written, a lock that's still being written is waited on instead of being read as stale, and a stale lock left by a stopped server is cleared by one process at a time, so a starting server can't delete the lock another one claimed a moment earlier.
+- 1b83039: `blume dev` now shows a body edit to a `.md` page on sites whose content pages render in Astro's `prerender` environment, such as sites deployed with `cloudflare()`. Astro refreshes its content store in the `ssr` environment only, so the page kept rendering its old body until something structural changed or the dev server restarted.
+- 08219a2: `blume dev` now refreshes Blume's generated data in every Vite environment, not only the ones Vite's legacy module graph covers. On sites whose content pages render in Astro's `prerender` environment, such as sites deployed with `cloudflare()`, a page added while the dev server runs now opens instead of 404ing, sidebar label edits show up, `.md` mirrors follow body edits, and an edit to an included partial reaches the pages that include it. Until now they all kept their startup state until the dev server restarted.
+- 08219a2: The first search in a fresh `blume dev` session no longer reloads the page. The configured search adapter's browser library (`@orama/orama` for the default search, or the FlexSearch, Algolia, Orama Cloud, or Typesense client) is now pre-bundled when the dev server starts. It used to be discovered only when the search dialog first opened, which re-optimized dependencies and reloaded the page.
+- be9d98e: `blume dev` reloads on edits under a nested folder that shares a name with an excluded one. With `exclude: ["drafts/**"]`, which leaves out `drafts/` at the content root only, the watcher used to ignore every folder named `drafts`, so edits to pages in `guides/drafts/` never showed up until a restart.
+- be9d98e: `blume eject` now writes the JSON docs API (`/api/docs/…` and `/openapi.json`) into the ejected app, which its `llms.txt`, homepage `Link` header, and not-found page already pointed to, so those links no longer 404. The ejected `src/generated/includes.json` now lists partials and their pages relative to the project instead of as absolute paths from the machine that ran eject, so editing a partial still refreshes the pages that include it in any checkout.
+- 1b83039: `blume eject` now writes the not-found page's Markdown and JSON twins (`/404.md` and `/404.json`) beside its `404.astro`, so the ejected app answers the same missing-page URLs as the hidden runtime. Like the page itself, they're left out when the project already owns `/404` with a `pages/404.astro` or a `404.md` content page.
+- 1b83039: A failing `blume eval` now delivers its whole report through a pipe before exiting non-zero. It used to exit as soon as it wrote the summary, so a long `--verbose` report was cut off partway in CI logs.
+- b6992c0: `blume eval --threshold` rejects an empty value, which it used to read as `0`, so `--threshold "$EVAL_THRESHOLD"` with the variable unset switched the gate off. An absolute `--file` path is used as given instead of being nested under the project root, for runs and for `blume eval init`, whose "already exists" check missed it. `--timeout` on `blume eval` and `blume translate` refuses values above 2147483 seconds (about 24 days), which used to make every agent time out at once. Durations in their reports round before they split into minutes, so a run prints `2m 0s` rather than `1m 60s`, and `1m 0s` rather than `60.0s`.
+- af7c4c9: Front matter that opens with a blank line after its `---` fence is now read as front matter, the way Astro reads it. Blume used to treat that `---` as a divider, so the page's `draft`, `slug`, and `hidden` were ignored while Astro stripped the block, and its YAML leaked into search and `llms.txt`. A block that holds no key–value pairs now reads as empty front matter, again matching Astro.
+- ad20661: Every URL Blume generates for a page now puts `deployment.base` in front, even when the page's route starts with the same segment. With `base: "/guides"`, a page at `guides/setup.md` is served at `/guides/guides/setup`, but its canonical URL, sidebar and tab links, breadcrumbs, previous/next links, search results, JSON-LD, `llms.txt` and `llms-full.txt` entries, JSON API and MCP URLs, and relative links to it (`./setup`) all pointed at `/guides/setup`. They now point where the page is served. A root-relative link you write that already starts with the base is still left as written. The language switcher's links to locales a page has no translation for get the same fix for `basePath`.
+- be9d98e: With `lastModified: "git"`, a project opened through a symlink (such as `/tmp` on macOS, which links to `/private/tmp`) now gets its "Last updated" dates. Blume compared the project's path against the one git reports with the link resolved, so it treated every content folder as outside the repository and dated no page, without a warning.
+- af7c4c9: Heading anchors and titles now come from a heading's rendered text rather than its Markdown source, so they match the ids on the page. `## See [the docs](/x)` anchors as `#see-the-docs` (not `#see-the-docsx`), `## An _important_ note` as `#an-important-note`, and entities, code spans, inline HTML, images, reference links, footnote references (`## Setup[^note]` → `#setup1`, numbered in the page's footnote order), and smart punctuation (`A -- B` → `#a--b`) read the way the renderer reads them. `blume validate` no longer reports a correct link to such a heading as a broken anchor, `blume translate` pins the id the page actually has, Obsidian heading links land on the section, and a page without a frontmatter `title` is titled "Using Astro with Blume" instead of the raw "Using [Astro](https://astro.build) with **Blume**".
+- 6933892: `usePage()` and `useBlume()` now return the page being viewed after a client-side navigation. They used to keep answering with the first page's route, title, and navigation for the rest of the visit, so an island on a page reached by a link, or after switching language, read the wrong page. An island kept across navigations with `transition:persist` now updates too.
+- 4f7785c: Text in an `.mdx` page that reads as an inline or leaf directive now renders exactly as written. A colon followed by a letter or digit, as in `16:9`, `10:30am`, `og:image`, or `pets:read`, used to drop everything from the colon to the end of the word ("16:9 frame" rendered as "16 frame"), and a `::name[label]{attrs}` line vanished. This also covers headings and their anchors, callout titles and bodies, and API reference descriptions. `:::` callouts work as before, and `.md` pages were never affected.
+- be9d98e: `mdxRemote()` pages lose their file and folder names' ordering prefixes the way a local content folder's do: `01-getting-started/02-install.mdx` now routes to `/sdk/getting-started/install` instead of `/sdk/01-getting-started/02-install`, while the prefixes still order the sidebar.
+- f373654: A `:::` block in an `.mdx` page whose name isn't a callout type, like a `:::details` carried over from another docs tool or a typo like `:::warnig`, no longer disappears along with everything inside it. Its content now renders between its `:::` lines, which stay on the page as written, and `blume dev`, `blume build`, and `blume check` warn with `BLUME_UNKNOWN_DIRECTIVE`, naming the callout types. A callout nested inside another (a `::::note` around a `:::tip`) now renders instead of vanishing. Site search now indexes text like `16:9` and `og:image` as the page shows it, instead of as "16" and "og".
+- be607f9: The `blume-migrate` skill's Mintlify codemod removes a dropped front matter key's list items even when they're written flush at column 0 (`keywords:` then `- one`), instead of leaving them behind as front matter that no longer parses. Its Fumadocs and Nextra guides now map locale file suffixes (`page.cn.mdx`, `index.en.mdx`) to `i18n.parser: "dot"` as-is rather than restructuring them into locale folders.
+- 3e95f16: OG cards render every script by default. A Noto fallback for each script is now part of the default card font stack, not only for configured locales, so a Japanese, Hindi, or Arabic title renders instead of tofu on any site, including sites with no `i18n` block and ejected projects. A card fetches from Google Fonts only when its text has a glyph the built-in font can't draw, and then only the families and subsets those glyphs need, so English cards fetch nothing and Latin-only sites still build offline. Configured locales move their family to the front, so a `zh` site draws Han in Chinese forms.
+- 3cd8149: Add a `oneDollarStats()` analytics adapter. It renders the OneDollarStats tracker tag, needs no key, and forwards every option as a `data-` attribute (`hostname`, `devmode`, …). `hostname` must be a bare host name, and `"hash-routing": "false"` leaves the attribute off, since the tracker turns hash routing on whenever it's present. Blume's custom events (page feedback and Ask AI) reach `window.stonks.event` with their property values as strings.
+- 090211e: The API playground's built-in proxy (`playground: { proxy: true }`) now forwards only the headers the Try it panel sets itself: the credentials and header parameters filled in, and the body's `Content-Type`. It used to forward every request header except a handful, so credentials the browser or the host attached on their own reached the documented API: HTTP Basic credentials for a password-protected docs site, a Cloudflare Access `cf-access-jwt-assertion`, Vercel's `x-vercel-oidc-token`, and `X-Forwarded-For`/`X-Real-IP`. Platform headers are never forwarded, even when a spec declares a header parameter with the same name.
+- 1b83039: A `trace` operation's Try it panel now says that browsers can't send `TRACE` requests when you press Send, instead of blaming CORS or an unreachable API: `fetch` refuses the method before anything goes out. Its JavaScript sample, which is built on `fetch`, is now a note saying so rather than code that could only throw. The cURL and Python samples still send it.
+- 090211e: The Try it panel and the code samples now send requests the way the spec describes them. Array and object parameters follow their `style` and `explode`, with OpenAPI's defaults when the spec sets none: `tags: ["dog", "cat"]` becomes `?tags=dog&tags=cat` rather than a URL-encoded JSON array, a path array becomes `1,2`, and a `deepObject` filter becomes `filter[color]=red`, with `spaceDelimited`, `pipeDelimited`, `label`, and `matrix` supported too. An `application/x-www-form-urlencoded` body is sent as `name=value` pairs (following its `encoding`), and a `multipart/form-data` body as form fields: curl uses `--form-string`, JavaScript a `FormData`, and Python `files=`. Before, both were sent as JSON. A `text/plain` or XML body is sent as written, without being blocked as "Invalid JSON", and its string example is no longer wrapped in quotes.
+  
+  Examples that `$ref` an entry under `#/components/examples` now prefill the panel and the response samples instead of being replaced by a generated placeholder. A GraphQL endpoint keeps its trailing slash (`https://host/graphql/` was sent to `…/graphql`). The HEAD curl sample uses `--head` so it no longer waits for a body that never comes, and the Python sample for TRACE uses `requests.request("TRACE", …)`, since `requests.trace` doesn't exist.
+- 3311cee: With `deployment.base` set, root-relative images and file links in content now gain the base: `![logo](/logo.png)` renders as `/sub/logo.png` and `[spec](/spec.pdf)` (or `<Card href="/spec.pdf">`) as `/sub/spec.pdf`, where Astro serves `public/`. They used to keep the bare root path and 404 on a subpath deploy. Public files still never gain `basePath`, and neither does a redirect whose `to` names one: with `basePath: "/docs"`, a redirect to `/files/whitepaper.pdf` now lands on the file instead of `/docs/files/whitepaper.pdf`.
+- be9d98e: `mdxRemote()` and `githubReleases()` give up on a request after 30 seconds, like the CMS sources, and the diagnostic names the URL that didn't respond. A server that accepted the connection and never answered used to hang `blume build` and every `blume dev` rescan indefinitely.
+- af7c4c9: `%` is now dropped from routes the way `:` already was, so `sdks/100%.md` publishes at `/sdks/100` and sidebar and pagination links reach it, where a bare `%` used to break the build's URL decoding; `#` and `?` in a frontmatter `slug` are dropped the same way. A file or folder with `#` or `?` in its name is reported as an error and left out of the site: Astro's content loader can't read such a file, so it used to publish a page that only ever said "Page not found". A frontmatter `slug` with a `.` or `..` segment (`../../etc/escape`, `guides/./x`) is now rejected with an error at the key instead of publishing a page no link could reach. A group folder's numeric prefix now works on either side of the parentheses: `(01-zeta)` sorts first instead of last, and `01-(gamma)` publishes at `/g` as a "Gamma" group instead of at `/(gamma)/g`.
+- 6933892: On a versioned site, the search dialog shows its "All versions" toggle only with a search provider that scopes results by version: Orama, FlexSearch, Algolia, or Typesense. With Pagefind, Orama Cloud, or Mixedbread the toggle used to show but change nothing, since their results always span every version.
+- 3311cee: The sitemap and RSS feeds now always put `deployment.base` in front of a page's URL, even when the page's route starts with the same segment. With `base: "/guides"`, a page at `guides/setup.md` is listed at `/guides/guides/setup`, where it's served, instead of `/guides/setup`.
+- 1b83039: An agent skill's `.tar.gz` now always ends with the two zero blocks that mark the end of a tar archive. A skill whose files filled the archive to within a block of its 10 KB record ended with one zero block or none, and GNU `tar` warned "A lone zero block" while unpacking it. Archives that already ended correctly keep the same bytes and digest.
+- 6933892: Every tab panel now has the `tabpanel` role its tab points at, including the panels of a `<CodeGroup>`, a TypeScript/JavaScript pair, and a nested tab group, which had none. Panels of `<Tabs dropdown>` no longer claim the `tabpanel` role, since that layout shows a select instead of tabs to label them.
+- 6933892: The "On this page" highlight now skips headings inside tab panels that aren't selected. Such a heading used to count as already scrolled past, so the table of contents highlighted it from the top of the page.
+- 1b83039: `blume translate` now looks for `meta.ts` titles only in the folders the content source's `include` globs reach, the same meta files the build reads. A `meta.ts` elsewhere under a project-rooted source (beside tooling, say) configures no sidebar group, and it used to be translated anyway.
+- b6992c0: `blume translate` rewrites an existing translation where it lives. A stale hand-written `fr/guide.md` for a `guide.mdx` source is updated in place instead of gaining a `fr/guide.mdx` beside it (which failed the next build with a duplicate route), a locale's hand-written `meta.js` or `meta.mjs` is rewritten instead of getting a `meta.ts` next to it, and a locale folder authored in another casing (`pt-br/` for `pt-BR`) now receives the locale's `meta.ts` too, not a second `pt-BR/` folder. A source file saved with a byte order mark keeps its frontmatter in the translation; it used to be written with the body alone. Looking for `meta.ts` titles now skips the content source's `exclude` globs and moves past a meta file that fails to load, where an application file like `src/lib/meta.ts` in a project-rooted source used to crash the run with `BLUME_INTERNAL`.
+- 3311cee: Redirect `from` paths in the `vercel.json` a static build writes are now escaped, since Vercel reads each `source` as a pattern. A `from` like `/c++-guide` or `/what?` used to make the whole file invalid, and `/faq(old)` never matched.
+- be9d98e: `blume version` now also rewrites reference-style link definitions (`[setup]: /guides/setup`), single-quoted `href='…'` and `src='…'` attributes, and links that spell out the `basePath` (`/docs/guides/setup` becomes `/docs/v1.0/guides/setup`) inside the snapshot. Those links used to keep pointing at the current docs.
+
+## 2.0.2
+
+### Patch Changes
+
+- e80b141: Only a reader opening an `<AccordionItem>` or `<Expandable>` writes its id to the URL hash. A `defaultOpen` item on the page a client-side navigation lands on no longer replaces the hash the reader arrived with.
+- 4f9d1bf: `llms.txt`, `agent-readability.json`, the API and AI catalogs, and the `_headers` and `vercel.json` rules now list the agent skills index only when the build published a skill, and the MCP server only when it was generated, rather than whenever `agents.skills` or `agents.mcp` is set. The API catalog is now served as `application/linkset+json` with the RFC 9727 `profile` parameter, in its `Content-Type` and in the homepage `Link` header.
+- 4f9d1bf: Root-relative links in the agent Markdown (`.md` and `.mdx` mirrors, `llms-full.txt`, MCP `get_page`) now match the rendered page: `[Install](/guides/install)` and `<Card href="/guides/config">` gain the site's `deployment.base` and `basePath`, and on a translated page they point at that locale's copy of the page when it exists. A paragraph written straight after a converted `<Callout>`, `<Steps>`, or `<Prompt>` now stays its own paragraph instead of joining the quote or list, and `<Visibility>` markup inside inline code or an indented code block (in a tab or step) is left as written.
+- a70a0f1: GraphQL references build from schemas that use directives they don't declare, such as Apollo Federation subgraphs (`@key`, `@link`) and AppSync schemas (`@aws_*`); syntax errors and unknown types still fail the build. A custom scalar's `@specifiedBy` URL is a link only when it's a safe web address, so a `javascript:` URL from a remote schema shows as text. OpenAPI overview pages list tag sections in the order the spec's `tags` declares them, code spans in description lines that start with HTML keep their braces, and the build warns that OpenAPI 3.1 `webhooks` aren't rendered instead of dropping them silently.
+- f2ebe6f: `blume init --template api` now writes a small example spec, `openapi.json`, beside `blume.config.ts` and points `openapi()` at it, so a new project's first build no longer depends on the public Petstore server. Its operation pages carry descriptions that a fresh `blume audit` accepts.
+- 591c39e: The assistant shows its error message when an answer comes back empty, which is how a provider failure after the response starts (a bad key, a rate limit, an unknown model) arrives, instead of leaving a pulsing placeholder that never resolves. `useAssistant` from `blume/hooks` does the same.
+- 4f9d1bf: On a versioned site, the assistant now grounds its answers in the docs version the reader is viewing, the current docs unless they're on an archived page, instead of retrieving from every archived copy of each page.
+- 0befec9: `blume audit` passes on Blume's own output for multilingual and versioned sites. The hreflang checks and the non-canonical page check skip i18n fallback copies, which canonicalize to the page they copy on purpose; the hreflang checks also accept archived pages that canonicalize to the latest docs, and match non-ASCII slugs. The sitemap and llms.txt checks no longer flag pages those files leave out on purpose: fallback copies, archived pages that canonicalize elsewhere, and pages with `ai: { exclude: true }`, which the llms.txt fix now names. A sitemap index, which Blume writes past 50,000 URLs, is read through its child sitemaps, and the size limits apply to each file.
+  
+  Other checks no longer report what the config asked for. Noindex pages aren't asked for a canonical, robots.txt isn't expected to name a sitemap when `seo.sitemap` is off or to be reachable when `seo.robots` is off, `/_vercel/image` URLs aren't reported as broken images, and a locale prefix such as `pt-BR` doesn't count as an uppercase URL.
+- 0befec9: The `blume audit` report labels each check with the number of distinct pages it affects and previews each page once, while `--verbose` still lists every finding. A check's glyph follows its findings' actual severity, so an external link downgraded to a warning no longer shows as an error. Each distinct fix in a group is printed, and length findings on pages generated from an API spec point at the spec's summary or description instead of front matter.
+  
+  On a site with `deployment.base`, links, assets, and `og:image` URLs that leave out the base are reported, since the deployed site doesn't serve them. `blume audit --url` rejects a value with no scheme, such as `example.com`, with a message suggesting the `https://` form instead of failing with an internal error.
+- e80b141: `<AutoTypeTable>` shows the right type for properties inherited from an interface in another file (`interface Props extends Base`, with `Base` imported). Those rows read their type from the file that declares them, where they used to show a slice of unrelated text from the documented file.
+- e80b141: A `<Badge>` with a `variant` it doesn't recognize, such as `info`, renders as the default gray badge instead of failing the page build.
+- 591c39e: The banner's link is written as if the site were mounted at root, like a featured link: with `basePath` set it lands under the base, and on a multi-locale site it points at the reader's locale when that locale serves the page. A link to a route served outside the docs (a custom page, the generated changelog) keeps its own path. A `<TypeTable>` entry's `typeDescriptionLink` gets the base too.
+- 351d6ab: `blume build` reports a page Astro can't compile or render (MDX that doesn't parse, say) as a `BLUME_BUILD_FAILED` error at that file and position, instead of an internal error asking you to report a Blume bug. After a `vercel()` or `netlify()` server build, `blume preview` explains that the adapter has no local preview server and suggests `blume dev` or the host's preview deploy, and in an ejected app `blume check`, `blume sync`, and `blume preview` now stop like `dev` and `build` do, naming the app's own command to run instead.
+- 3b5e90a: A `notion()` source saves a downloaded asset only when the server reports an image or video type, or when the response names no type and the URL has an image or video extension. An "image" that links to an HTML page keeps its original URL with a warning instead of being served as a page from `/blume-assets/`, and an image whose caption holds a bracket or whose URL holds spaces or parentheses is now downloaded too, instead of keeping a signed Notion URL that expires. `/blume-assets/` publishes only the images and videos a source downloaded, so a file an earlier build saved under another extension is no longer served, and a downloaded video carries its video type in dev.
+- 3b5e90a: Content imported from a CMS or GitHub releases can no longer run script on the docs site. A Sanity code span keeps its text as code however many backticks or braces it holds, and a `javascript:` link keeps only its label wherever it comes from: a Sanity link, a scheme hidden behind an escape (`java&#115;cript:`, `javascript&colon;`), a release note's footnote, or a Contentful, Payload, or Strapi Markdown field. A link's URL can't close it early to start a second link, a code block whose language holds a backtick still opens its fence, and an unsupported block's type can't end its comment. Lowered rich text also keeps `## text`, indented text, and an `import` followed by code in the next run as prose, instead of rendering a heading or code block or failing the MDX page.
+- 3b5e90a: Sanity bold and italic spans keep their edge spaces outside the markers, so `Hello ` in bold before `world` renders as bold text instead of literal asterisks, and nested list items indent to their parent item's text, so an item under a numbered one nests instead of joining the parent's line. Notion video captions show `<` and `>` as typed rather than as `&lt;` and `&gt;`, and a rate-limited Notion request waits for the `Retry-After` the API sends.
+- f2ebe6f: A config error now points at the line that holds the problem: an invalid `redirects[2].status` at the third redirect rather than the first, and a missing key such as `github.repo` or `i18n.locales[1].label` at its parent object or array entry rather than at a same-named key later in the file, so issues also list in the order they appear. A `blume.config.ts` without a default export (a bare `defineConfig({ … })` call, `export const config`, or `export default null`) now fails with one diagnostic naming the file and the missing `export default`, where it used to build a default site or fail with an unrelated error. The `defineConfig` hover docs no longer list `markdown.math` or inline-highlighting options the config doesn't accept.
+- f2ebe6f: Config paths and URLs are checked up front. `deployment.site` must be an absolute `http://` or `https://` URL, so `localhost:4321`, `mailto:`, and `javascript:` values fail with a hint instead of prefixing every sitemap entry and canonical link. Redirects need a leading slash on `from` and on a relative `to`, since a path without one never gained the base path. `basePath` rejects a full URL, query, or fragment. A navigation tab's `path` is normalized to one leading slash and no trailing slash, so `/guides/` marks its tab and scopes the sidebar, and `api` links to `/api`.
+- 5f5c72a: With `basePath: "/docs"`, a content folder named `docs/` now publishes beneath the base (`docs/guide.md` at `/docs/docs/guide`) instead of colliding with the root pages. Folder `meta.ts` discovery now honors the content source's `include` and `exclude` globs, so an unrelated `src/lib/meta.ts` in a `.`-rooted project is no longer imported, and meta in a lowercase locale folder (`pt-br/`) now applies to its configured locale (`pt-BR`).
+- abb982a: Only file and folder names lose an ordering prefix (`01-intro.mdx` → `/intro`, and an Obsidian note `01 Intro` → `/intro`). A frontmatter `slug`, a GitHub release tag, and a CMS slug keep their leading numbers, so releases `1.0.0` and `2.0.0` publish at `/changelog/1-0-0` and `/changelog/2-0-0` instead of colliding on `/changelog/0-0`. A version (`1.2.0.md`) or an ISO date (`2024-01-05-first-post.md`) is part of a name rather than an order, which also stops posts from the same year raising a duplicate sidebar order warning. A source `prefix` written with slashes (`sanity({ prefix: "/guides" })`) now names the source `guides`, so its pages no longer 404 and its asset URLs no longer carry a double slash.
+- abb982a: Remote sources keep one snapshot per preview mode and set of options under `.blume/cache/<source>/`. A plain `blume dev` after `blume dev --preview` no longer serves unpublished drafts, a build whose fetch fails no longer falls back to them, `--preview` fetches drafts even when a published snapshot is cached, and editing a source's `query` or `fields` refetches in dev. Contentful's `--preview` without a Preview API token now fails with a clear error instead of serving the cached snapshot with a warning, and a source passed to `custom()` from one of Blume's engine factories (`sanitySource`, `contentfulSource`, …) now honors `--preview` and caches in the runtime directory like the built-in adapter.
+- a6401cf: Add a `databuddy()` analytics adapter. It renders Databuddy's tracker tag with `clientId` as `data-client-id` and forwards any other option as a `data-` attribute, and page feedback events reach `window.databuddy.track`.
+- f2ebe6f: A `dateFormat` that sets only `timeZone`, `calendar`, or `numberingSystem` keeps the long date form (`July 21, 2026`) instead of falling back to a bare numeric date (`7/21/2026`). Setting `dateStyle` or a component field such as `year` still picks the shape.
+- 8d88600: `blume eject` now adds `tailwindcss` and `@tailwindcss/typography` to the project's dependencies, so the ejected stylesheets resolve under pnpm and other strict linkers, and the ejected `features.ts` names `epub-gen-memory` only when EPUB export is on. The ejected app also serves colocated images from its raw Markdown at `/blume-assets/content/…`, and renders the Open Graph card its `/changelog` page points at. With `playground: { proxy: true }` on a reference, the ejected app serves the API playground's built-in proxy at `{basePath}/_api-proxy`, with the same origin allowlist, instead of every Send returning a 404.
+- 5f5c72a: English pages (`en`, `en-GB`, and other `en-*` codes) on a site whose default locale isn't English now show Blume's built-in English interface strings, plus their own `i18n.ui` overrides, instead of the default locale's translation.
+- 351d6ab: Blume no longer takes `NODE_ENV` from `.env` files, so a monorepo root `.env` that sets it for another app can't turn `blume build` into a development build or `blume dev` into a production one. Set it in the shell when you need to.
+- 0befec9: A `severity: warning` question in `blume eval` now warns instead of failing CI, as documented: its miss doesn't count against the gate or `--threshold`, so the exit code agrees with the JSON summary's error count. When an agent CLI exits before reading its prompt, `blume eval` and `blume translate` report the agent's exit code and stderr for that item instead of aborting the whole run with an internal error.
+- aa325a8: A header tab's `icon` now shows beside its label in the header, on a dropdown tab, and in the mobile navigation drawer. Before, `navigation.tabs[].icon` was accepted but never rendered.
+- aa325a8: On a multilingual site, a sidebar group with no `meta.ts` in a locale now mirrors the fallback locale's: that folder's `meta.ts` (title, order, `collapsed`, `display`) and the `sidebar.display` its index page sets. Groups set to collapsible no longer render flat on pages that fall back to the default language.
+- 351d6ab: `blume init` inside a pnpm workspace that doesn't list the new folder under `packages` now skips the install (pnpm would exit without installing Blume) and tells you to add the folder, instead of saying the project joined the workspace. The `cd` line in its next steps is quoted when the directory needs it (`cd "my docs"`), and when `init --eject` can't eject after an install that ran, it reports the actual error rather than blaming missing dependencies.
+- aa325a8: A `<Frame>` caption and a `<Prompt>` description keep code spans (`` `Array<string>` ``) and autolinks (`<https://…>`) intact, while raw HTML in them still shows as text. Before, their `<` and `>` rendered as `&lt;`/`&gt;` in code and as stray brackets around links.
+- 5f5c72a: Links now resolve the same way in the built site and in `blume validate`: relative links on a page named `Index.md` resolve beside it, as its `/…/Index` route does, and links to dotted page routes such as `/releases/v1.2` move into the reader's locale and under `basePath`, in content and in component `href`s alike; only a link no page is served at counts as a public asset. `blume version` also rewrites unprefixed links (`/guides/setup`) into the snapshot when the default locale keeps its URL prefix, and for pages that exist only in another locale.
+- 591c39e: More of the reader-facing chrome follows the page's language: the `<TypeTable>` column and row labels, `<Component>`'s Preview and Code tabs, untitled `<Tabs>` panels and the tab picker, `<Expandable>`'s default toggle, `<Update>`'s default heading, `<GithubInfo>`'s count labels, the search dialog's "latest" version tag, and the header on API reference pages. Each has a new `i18n.ui` key with a translation in every built-in locale. In right-to-left locales the sidebar's indents and badges, the assistant's close button, and the arrows on cards, tiles, and the banner link now mirror.
+- 65edd91: With a `basePath`, the `_headers` and `vercel.json` rules that pin `charset=utf-8` on raw Markdown now cover every mirror, not only those under `basePath`: the section home's `/<basePath>.md` and the generated `/index.md`, `/changelog.md`, and `/404.md` went out without a charset, so browsers showed their non-ASCII text as mojibake.
+- 4f9d1bf: The MCP endpoint now reads a request body only up to 64 KB and answers anything larger with `413`. A call to a tool that doesn't exist, or with `arguments` that aren't an object, now gets the JSON-RPC Invalid params error (`-32602`) with a short message. The `/mcp` operation in `openapi.json` now lists `text/event-stream` beside `application/json`, so a generated client sends the `Accept` header the endpoint requires.
+- 5f5c72a: Header and sidebar links now land where they should across versions, locales, and base paths:
+  
+  - On an archived version's pages, a tab links into that version's section (`/v1.0/guides/…`) instead of the current docs' path, which 404ed when the section had no index page.
+  - On a non-default locale, a `/changelog` tab opens the changelog timeline instead of the newest entry, and a tab whose path is a custom page opens that page.
+  - With a `basePath`, the logo in a non-default locale links inside the base (`/docs/fr`) instead of to `/fr`.
+  - Internal `href` links in an explicit `navigation.sidebar` move into the reader's locale, as featured links do.
+  - An explicit `navigation.sidebar` item that can't render as written now reports a warning: a route that matches no page, a `root` that matches no page, or an item with no route, `href`, `root`, or `items`.
+  - A featured or header link with a query or fragment (`/guides?tab=cli`) is no longer reported as `BLUME_NAV_MISSING_PAGE` when its page exists.
+- aa325a8: A `netlify()` server build now serves the header rules a static build puts in `_headers` — the homepage `Link` header, `charset=utf-8` on the raw Markdown and text files, and the `.well-known` discovery files' media types and CORS header — by writing them into Netlify's `.netlify/v1/config.json`, which a server build reads instead of `_headers`.
+- 8d88600: The default 404 page now switches to the reader's locale under a `deployment.base` or `basePath` too, and its localized home link includes the `basePath`. `<Component />` preview frames now follow the OS color scheme when browser storage is blocked, instead of rendering without a theme.
+- abb982a: Broken-link diagnostics in an Obsidian vault note now name the line in the note itself, rather than a line counted from the frontmatter Blume rewrites when it drops Obsidian-only properties.
+- f2ebe6f: Open Graph cards for non-Latin locales now render their text instead of empty boxes. Each configured locale whose script the card's built-in font can't draw adds a Google Noto fallback for it (`Noto Sans JP` for `ja`, `Noto Sans Devanagari` for `hi`, `Noto Sans` for Cyrillic, Greek, and accented Latin, and so on), with no config needed. Latin text keeps the built-in font, so English cards look the same, and an explicit `seo.og.fonts` still replaces the whole list.
+- a70a0f1: API reference samples now use the examples an OpenAPI 3.0 or Swagger 2.0 spec declares on parameters, request bodies, and responses, which the 3.1 upgrade had moved out of reach, so a path parameter with `example: "pet_123"` renders `/pets/pet_123` instead of `/pets/string`. Response examples keep `readOnly` fields and leave out `writeOnly` ones, and the curl, JavaScript, and Python samples quote header values, URLs, and bodies for their language, so an `If-Match: "33a64df5"` header or a `$` in a token comes through intact. Schema rows label a nullable `$ref` as `Pet | null` rather than `Pet | any`, and a type array like `["string", "integer"]` as `string | integer`.
+- a70a0f1: API reference schema tables stay a manageable size for specs whose schemas reference each other densely. A named schema expands wherever it appears in the first two levels of nesting, as before, and below that only where it first appears; later mentions show its name. A request body of twelve schemas that each reference four others went from tens of thousands of nested tables to a few dozen at most.
+- a70a0f1: API reference code samples, the Try it panel, and the AsyncAPI composer fill server `{variables}` with their declared defaults, so `https://{region}.api.example.com` becomes a real URL, and the built-in playground proxy allows the resulting origin instead of refusing it with a 403. An operation's own `servers`, or its path's, now replace the document's servers in its samples and panel, and the proxy allows those origins too.
+- 5f5c72a: A heading inside a multi-line HTML (`<!-- … -->`) or MDX (`{/* … */}`) comment no longer becomes the page title, a table of contents entry, or a link anchor. Titles derived from file names spell acronyms the way sidebar groups do (`faq.md` is "FAQ"), and an untitled folder `index` page takes its folder's label instead of "Index". A root file named like a version (`v3-migration.md`) no longer triggers the unconfigured-version warning, and the missing content root hint now names the `filesystem()` source's `root` for projects that list `content.sources`.
+- 8d88600: The API playground's built-in proxy (`playground: { proxy: true }`) now works under a `basePath` or a `deployment.base`: the endpoint mounts under `basePath` at `{basePath}/_api-proxy`, and the Send button targets it with the deployment base included.
+- a70a0f1: The Try it panel no longer blocks Send on valid request bodies: it doesn't ask for `readOnly` properties the spec marks required, accepts `null` in nullable fields, and doesn't check one type of a field that allows several. The panel also works when the browser blocks storage (Safari's "Block All Cookies", sandboxed iframes), where it now simply doesn't remember credentials, and the AsyncAPI composer closes its WebSocket when a client-side navigation leaves the page. The request and response tabs move with the arrow keys, Home, and End, and the reference's spacing follows right-to-left layouts.
+- 0befec9: The `posthog()` analytics adapter only sends its own `$pageview` on client-router navigations while PostHog captures page loads alone. With `capture_pageview: "history_change"` or a `defaults` date such as `"2025-05-24"`, PostHog tracks navigations itself and each one is no longer counted twice, and `capture_pageview: false` now means no pageviews at all.
+- 591c39e: Export → PDF (and any print of a page) keeps callouts, panels, and changelog update headings. The print stylesheet now hides only the site chrome (banner, header, sidebar, table of contents, assistant panel) instead of every `<header>` and `<aside>` on the page.
+- 591c39e: Screen readers get a name for every piece of header and content chrome. An image-only logo (`logo: { image, text: "" }`) names the home link after the image's `alt`, or the site title when it has none. A navigation selector's accessible name includes the option it shows ("Version: v2"), matching the language switcher. `<GithubInfo>` labels its star and fork counts. The first "Copied" after each page load is announced reliably, since the status region now registers before its first message.
+- 65edd91: A `node()` server build answers a configured `302` or `307` redirect with that status, as the Cloudflare Worker already does, instead of a permanent `301` or `308` that browsers cache. A `netlify()` static build forces its `_redirects` rules (`/old /new 301!`), so Netlify issues the redirect instead of serving the redirect page at the old path with a `200`; the `_redirects` for `cloudflare()` and for a build with no named host stays unforced, since Cloudflare rejects the flag.
+- 3b5e90a: A `githubReleases()` source rewrites links in release notes that point at the site's own `deployment.site` to root-relative paths, so changelog pages follow preview deploys and the deployment base and no longer trip `blume audit`'s "Internal link hardcodes the site's own origin" check.
+- e80b141: The Left and Right arrow keys follow the reading direction in `<Tabs>` and `<Tree>`: on a right-to-left page, Left moves to the next tab and expands a tree folder, and Right moves to the previous tab and collapses a folder.
+- 65edd91: SVG images a content source downloads are now served with `Content-Security-Policy: sandbox` and `X-Content-Type-Options: nosniff` by `vercel()`, `netlify()`, and `cloudflare()` server builds too, each through its host's own mechanism: a route in Vercel's routing config, a header rule in Netlify's `.netlify/v1/config.json`, and the Worker Blume puts in front of Astro's on Cloudflare. The `/blume-assets` route prerenders, so its own headers never reached a deployed site. A `node()` server now matches those SVGs by the file it serves rather than the raw URL, so an encoded spelling (`abc.sv%67`, `abc%2Esvg`) or a path outside `deployment.base` no longer skips the sandbox, and static builds add `nosniff` beside it.
+- 4f9d1bf: The Algolia sync now declares `locale` and `version` for faceting (as `filterOnly`), keeping any facets you set yourself, so search on a multi-language or versioned site finds results. The search dialog's section for pages outside every sidebar group is now labeled in the reader's language through the new `search.docs` UI string, and the WebMCP `search_docs` tool returns plain text, with characters like `<` and `&` no longer HTML-escaped.
+- 591c39e: Sidebar sections loaded on first open show their icons on every page, where an icon could come out blank on a page that hadn't used it itself. A drill-in panel loaded on first open keeps its Back button and section title. Drilling into a panel or going back moves keyboard focus into the panel that slides in (its Back button, or the row that opened the panel you left), and each drill-in row reports whether its panel is open with `aria-expanded` and `aria-controls`.
+- 5f5c72a: A sidebar group's path now comes from its folder, so a page with a frontmatter `slug` no longer moves its whole folder out of its tab (a `guides/` page with `slug: install` left every page under a `/guides` tab with an empty sidebar). A folder `meta.ts` `pages` list now wins over a listed subfolder's own `order`, as it already did over a listed page's `sidebar.order`, and a listed position no longer reports a `BLUME_DUPLICATE_SIDEBAR_ORDER` warning against an unlisted sibling's numeric prefix or `sidebar.order`.
+- 4f9d1bf: The agent Markdown (`.md` mirrors, `llms-full.txt`, MCP `get_page`) and the search index now read component props like `title={...}` as literal data and never run them, on `.mdx` and plain `.md` pages and on content from CMS and GitHub release sources alike. Strings, numbers, booleans, arrays, objects, template strings, and `frontmatter.*` references resolve as before; any other expression, such as a function call, leaves the component as written.
+- 591c39e: A header tab with `items` renders as a dropdown: its items open in a menu from the header, and expand in place under the tab in the mobile navigation drawer. The tab's `path` still scopes the sidebar and marks it as current. Before, `navigation.tabs[].items` was accepted but every tab rendered as a plain link.
+- e80b141: `<Tabs>` deep links (`?install=windows`, `#windows`) now open the linked tab when the reader arrives through a client-side navigation, not only on a full page load, and a tab no longer opens because the previous page's URL carried a matching hash. A `ts2js` fence inside a `<CodeGroup>` now becomes one of the group's tabs, labeled with the fence title, instead of showing its TypeScript and JavaScript pair under every tab.
+- e80b141: A `<Tooltip>` stays open while the pointer moves from its trigger up to the panel, so a mouse can reach the panel's link. The panel now shifts to stay inside the viewport near either edge of the screen, and hidden tooltips no longer widen the page, which let a whole page scroll sideways on phones.
+- 0befec9: `blume translate --codex` runs Codex with the same lockdown as `blume eval`: no shell, exec, or local-image tool, and no inherited environment. Before, `--sandbox read-only` still let the translator's shell read any file the user could.
+- abb982a: `blume translate` writes into a locale folder that already exists in another casing (`pt-br/` for a configured `pt-BR`) instead of creating a second one beside it, which on a case-sensitive filesystem published every page twice.
+- 0befec9: `blume translate` leaves archived-version folders' `meta.ts` files alone, like the rest of a frozen snapshot. Drafts count as content: a hand-written translation marked `draft: true` is adopted instead of overwritten, and a source page that is a draft for a while keeps its ledger entries, so its outdated translations still read as stale. A partial that is one code block validates without its own fences being stripped, and folder titles from two sources with the same folder name each get their own translation.
+  
+  A `blume.translations.json` with unresolved merge-conflict markers now fails with a clear error instead of reading as empty, which let `--check` pass over outdated translations. Line endings are normalized before hashing, so a CRLF checkout doesn't look like an edit to every page.
+- 351d6ab: Config validation reports `content.root` (or `include`/`exclude`) beside `content.sources` even while a source entry is still in the Blume 1 `{ type }` form, so `blume upgrade` and `blume doctor` list both on the first run. A `blume` range `blume upgrade` can't bump, such as `catalog:` or an `npm:` alias, is reported with what to change by hand (the catalog entry in `pnpm-workspace.yaml`, or the alias's version) instead of as ready.
+
 ## 2.0.1
 
 ### Patch Changes

package/dist/cli/{chunk-qwsrynx5.js → chunk-1d7ve1dm.js}

@@ -531,7 +531,7 @@ var CHECKS = [
   },
   {
     category: "sitemap",
-    fix: "Sitemaps must be valid XML in the sitemaps.org urlset format.",
+    fix: "Sitemaps must be valid XML in the sitemaps.org urlset or sitemap index format.",
     id: "BLUME_AUDIT_SITEMAP_INVALID",
     severity: "error",
     tier: "static",
@@ -627,7 +627,7 @@ var CHECKS = [
   },
   {
     category: "ai",
-    fix: "Rebuild so llms.txt matches the site; if the page is deliberately excluded, mark it `seo.noindex` or `sidebar.hidden`.",
+    fix: "Rebuild so llms.txt matches the site; if the page is deliberately excluded, set `ai.exclude: true` in its front matter.",
     id: "BLUME_AUDIT_LLMS_TXT_PAGE_MISSING",
     severity: "warning",
     tier: "static",
@@ -763,6 +763,30 @@ var TIER_FLAGS = [
   { flag: "--external", tier: "external" },
   { flag: "--url <origin>", tier: "network" }
 ];
+var SEVERITY_ORDER = {
+  error: 0,
+  info: 2,
+  warning: 1
+};
+var worstSeverity = (findings) => {
+  let worst = "info";
+  for (const finding of findings) {
+    if (SEVERITY_ORDER[finding.severity] < SEVERITY_ORDER[worst]) {
+      worst = finding.severity;
+    }
+  }
+  return worst;
+};
+var firstPerPage = (findings) => {
+  const seen = new Set;
+  return findings.filter((finding) => {
+    if (seen.has(finding.url)) {
+      return false;
+    }
+    seen.add(finding.url);
+    return true;
+  });
+};
 var rollup = (diagnostics) => {
   const groups = new Map;
   for (const diagnostic of diagnostics) {
@@ -773,29 +797,25 @@ var rollup = (diagnostics) => {
       groups.set(diagnostic.code, [diagnostic]);
     }
   }
-  const order = {
-    error: 0,
-    info: 2,
-    warning: 1
-  };
   const checks = [...groups.entries()].map(([id, findings]) => {
     const checkId = id;
-    const { category, severity, title } = checkMeta(checkId);
+    const { category, title } = checkMeta(checkId);
     return {
       category,
       count: findings.length,
       findings,
       id: checkId,
-      severity,
+      pages: firstPerPage(findings).length,
+      severity: worstSeverity(findings),
       title
     };
   });
   const worst = new Map;
   for (const check of checks) {
-    const rank = order[check.severity];
+    const rank = SEVERITY_ORDER[check.severity];
     worst.set(check.category, Math.min(worst.get(check.category) ?? rank, rank));
   }
-  return checks.toSorted((a, b) => (worst.get(a.category) ?? 0) - (worst.get(b.category) ?? 0) || a.category.localeCompare(b.category) || order[a.severity] - order[b.severity] || b.count - a.count);
+  return checks.toSorted((a, b) => (worst.get(a.category) ?? 0) - (worst.get(b.category) ?? 0) || a.category.localeCompare(b.category) || SEVERITY_ORDER[a.severity] - SEVERITY_ORDER[b.severity] || b.count - a.count);
 };
 var skippedTiers = (tiers) => TIER_FLAGS.filter(({ tier }) => !tiers[tier]).map(({ flag, tier }) => {
   const label = CHECKS.filter((check) => check.tier === tier).length;
@@ -831,22 +851,21 @@ var formatReport = (result, root, options = {}) => {
       lines.push(`  ${colors.bold(category)}`, "");
     }
     const color = SEVERITY_COLOR[group.severity];
-    const pages = `${group.count} page${group.count === 1 ? "" : "s"}`;
+    const pages = `${group.pages} page${group.pages === 1 ? "" : "s"}`;
     lines.push(`  ${color(`${GLYPH[group.severity]} ${group.title}`)}  ${colors.dim(pages)}`);
-    const shown = options.verbose ? group.findings : group.findings.slice(0, PREVIEW);
+    const shown = options.verbose ? group.findings : firstPerPage(group.findings).slice(0, PREVIEW);
     for (const diagnostic of shown) {
       lines.push(findingLine(diagnostic, root));
       if (options.verbose) {
         lines.push(`        ${colors.dim(diagnostic.message)}`);
       }
     }
-    const hidden = group.count - shown.length;
+    const hidden = options.verbose ? 0 : group.pages - shown.length;
     if (hidden > 0) {
       lines.push(`      ${colors.dim(`… and ${hidden} more (--verbose)`)}`);
     }
-    const [first] = group.findings;
-    const fix = first?.suggestion;
-    if (fix) {
+    const fixes = new Set(group.findings.flatMap((finding) => finding.suggestion ? [finding.suggestion] : []));
+    for (const fix of fixes) {
       lines.push(`      ${colors.cyan(`fix: ${fix}`)}`);
     }
     lines.push("");
@@ -958,5 +977,5 @@ var launchInstalledAgent = async (bin, prompt, platform = process.platform) => {
 
 export { CHECKS, finding, formatReport, reportJson, formatCatalog, AGENTS, writeAgentReport, fixPrompt, launchAgent, launchInstalledAgent };
 
-//# debugId=0DEBBF082B3707F764756E2164756E21
-//# sourceMappingURL=chunk-qwsrynx5.js.map
+//# debugId=E6F2D36C0552C7F664756E2164756E21
+//# sourceMappingURL=chunk-1d7ve1dm.js.map