docmd@0.10.0 – Production Server, Static Assets & MDX

Production Server, Static Assets & MDX

v0.10.0 introduces a dedicated production HTTP server (docmd serve), a zero-configuration public static root assets pipeline, native MDX component support powered by lite-mdx, pre-flight environment diagnostics (docmd doctor), and ecosystem-wide standardisation across supporting libraries.

Added

• Production HTTP Server (@docmd/core): Introduces the docmd serve command for running production documentation sites with zero file-watching overhead. Features built-in Gzip and Deflate compression, standard security response headers (CSP, HSTS, frame protections), container liveness and readiness probes at /healthz, and configurable host binding. Docker image now defaults to docmd serve --host 0.0.0.0. Contributed by @svallory in #273 and #279.
• Opt-in MCP over HTTP (@docmd/core): Exposes Model Context Protocol capabilities under docmd serve at POST /mcp, using a transport-independent JSON-RPC handler gated behind serve.mcp: true with bearer token or header authentication. Contributed by @svallory in #278.
• Production Plugin Action Host (@docmd/core, @docmd/api): Extends plugin actions to docmd serve with strict origin allowlists and caller identity gating, preventing unauthorised context writes in production. Contributed by @svallory in #272 and #277.
• Public Static Root Assets Pipeline (@docmd/core): Automatically detects a top-level public/ directory (or custom paths specified via static in docmd.config.json) and copies files directly to the build root, preserving directory hierarchy for root assets such as robots.txt, favicon.ico, CNAME, and .well-known/funding-manifest-urls.
• MDX Component Rendering (@docmd/plugin-mdx, lite-mdx): Bundles first-class MDX support into core using the high-performance lite-mdx compiler. Allows authoring interactive JSX components alongside standard Markdown syntax with zero required configuration.
• Pre-flight Doctor Diagnostics (@docmd/core, @docmd/tui): Adds docmd doctor command to validate environment health, Node.js version compatibility, engine prerequisites, port availability, template layouts, and plugin integrity with structured, colour-coded terminal reporting.
• Dynamic Headless Flag (@docmd/core): Adds --no-open CLI flag and DOCMD_NO_OPEN=true environment variable support across dev, serve, and test runners, preventing unwanted browser window spawns in automated CI and headless container workflows.
• Dynamic Version Fallbacks (@docmd/parser, @docmd/ui): Automates fallback synchronisation for docmd.version and docmd.buildYear in parser registries and client runtimes, backed by automated version maintenance scripts.
• Optional Iconify Plugin (@docmd/plugin-iconify): Adds zero-overhead on-demand icon resolution supporting over 100,000 icons from 100+ icon sets via standard icon:iconify:<name> syntax.

Improved

• Network Interface Binding (@docmd/core): Adds the --host <address> CLI flag for docmd dev, docmd serve, and workspace workflows, defaulting safely to 127.0.0.1 for local development. Contributed by @svallory in #269.
• Playground Web Worker Sandboxing (@docmd/plugin-playground): Offloads code execution into background web workers to ensure long-running or blocking scripts do not freeze the browser UI thread.
• Build Tree Hygiene: Ensures pnpm -r run build leaves a clean git working tree by isolating transient generated files. Contributed by @svallory in #275.
• Test Suite Isolation: Allocates dedicated temporary fixture roots per test process, preventing concurrency race conditions. Contributed by @svallory in #276.
• Ecosystem Metadata & Funding: Standardised package keywords, README documentation across internal plugins, and aligned repository and funding manifests to https://docmd.io and the docmd-io organisation.

Fixed

• CSP Compliance & Inline Script Synchronization (@docmd/ui): Replaced dynamic new Function() evaluation during SPA <head> hydration with safe static regex parsing and native JSON.parse, eliminating CSP violations under strict policies.
• Safari WebKit Layout & Sizing (@docmd/template-summer): Replaced -webkit-fill-available with height: 100% on heading anchors and adjusted .summer-main grid alignment to eliminate phantom whitespace in Safari.
• Multi-Word Tab Aliases (@docmd/parser): Extended tab container normaliser to support unquoted multi-word titles and canonical === / ==== tab delimiters.
• SPA Body Script Execution (@docmd/ui): Prevented Single-Page Application (SPA) client navigation from re-executing inline body scripts, avoiding duplicate DOM manipulation and event listeners. Contributed by @MSOB7YY in #270.
• Highlight.js Theme Flash (@docmd/ui, @docmd/template-summer): Applied syntax highlight theme styles immediately upon initial page load, eliminating unstyled code flashes during hydration. Contributed by @MSOB7YY in #270.
• Non-Index Folder Links (@docmd/parser): Resolved relative links targeting directory paths without trailing slashes from deeply nested pages. Contributed by @GPT-AGI in #271.
• Gitignore Ancestor Traversal (@docmd/core): Restricted unanchored gitignore and exclusion patterns to their own parent directories, preventing ancestor directory filters from over-excluding project source files. Contributed by @svallory in #274.
• MCP Path Traversal Hardening (@docmd/core): Confined read_doc and list_docs to markdown files inside configured source roots, blocking symlink escapes. Contributed by @svallory in #268.
• Breadcrumb Schema Fallback (@docmd/plugin-seo): Resolved missing intermediate items in JSON-LD breadcrumb markup with self-healing hierarchy fallbacks.

Security & Maintenance

• Playground HTML previews run inside sandboxed iframes without allow-same-origin, restricting access to parent DOM, cookies, and storage. Runtime variable injection uses .textContent to avoid DOM XSS.
• Production server security headers: docmd serve enforces Content-Security-Policy (CSP), HTTP Strict Transport Security (HSTS), X-Content-Type-Options, and Frame-Options by default.
• WebSocket origin validation: Enforces strict origin allowlists and blocks untrusted incoming messages during action host execution.
• Updated docker/login-action to 4.8.0 in PR #281.
• Updated npm runtime dependencies (ws, minimatch, @typescript-eslint, playwright, lucide-static) in PR #282.

Links

Documentation: https://docs.docmd.io/
Cloud Platform: https://cloud.docmd.io/
Dev & Writing Skills: https://github.com/docmd-io/docmd-skills

Contributors

• @svallory made their contribution in #268
• @MSOB7YY made their contribution in #270

New Contributors

• @GPT-AGI made their first contribution in #271

Full Changelog: 0.9.9...0.10.0